0.27.0 — Infisical hardening: runtime refresh, audit logging, CLI verify/audit, startup verification, SSH host key verification, interface consolidation

cmd/nomos/main.go

@@ -18,6 +18,7 @@ import (
 	"time"
 
 	"github.com/dtoro/oikos/internal/safego"
+	"github.com/dtoro/oikos/internal/secrets"
 	"github.com/google/uuid"
 	"github.com/jackc/pgx/v5"
 )
@@ -46,6 +47,36 @@ func main() {
 		databaseURL = os.Getenv("OIKOS_DATABASE_URL")
 	}
 
+	// Resolve secrets from Infisical, falling back to env vars.
+	// The MCP token and OpenRouter key are fetched once at startup and
+	// injected via os.Setenv so downstream code (newAgent) picks them up
+	// without signature changes.
+	sec := secrets.NewManagerFromConfig(
+		os.Getenv("OIKOS_INFISICAL_SITE_URL"),
+		os.Getenv("OIKOS_INFISICAL_CLIENT_ID"),
+		os.Getenv("OIKOS_INFISICAL_CLIENT_SECRET"),
+		os.Getenv("OIKOS_INFISICAL_PROJECT_ID"),
+		os.Getenv("OIKOS_INFISICAL_ENV"),
+		os.Getenv("OIKOS_SECRETS_DIR"),
+	)
+	var openrouterAPIKey string
+	var secretsResolved int
+	if sec != nil {
+		resCtx, resCancel := context.WithTimeout(context.Background(), 10*time.Second)
+		if v := secrets.ResolveSecret(resCtx, sec, "mcp/bearer-token", ""); v != "" {
+			mcpToken = v
+			secretsResolved++
+		}
+		openrouterAPIKey = secrets.ResolveSecret(resCtx, sec, "openrouter/api-key", os.Getenv("OPENROUTER_API_KEY"))
+		if openrouterAPIKey != "" && openrouterAPIKey != os.Getenv("OPENROUTER_API_KEY") {
+			secretsResolved++
+		}
+		resCancel()
+		if secretsResolved > 0 {
+			slog.Info("nomos: secrets resolved from Infisical", "count", secretsResolved)
+		}
+	}
+
 	switch os.Args[1] {
 	case "serve":
 		ctx, cancel := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
@@ -75,7 +106,7 @@ func main() {
 			defer st.close()
 		}
 
-		nAgent, err := newAgent(ctx, clientPool, st, agentSlug)
+		nAgent, err := newAgent(ctx, clientPool, st, agentSlug, openrouterAPIKey)
 		if err != nil {
 			slog.Error("nomos: agent init", "error", err)
 			os.Exit(1)