From a0b396d478587408526dffda9d33a393beb726c6 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Fri, 9 Oct 2026 19:06:30 +0000
Subject: [PATCH] Enable AgentID linking in production + fix put-secrets.sh
 empty-array bug
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- wrangler.toml: set the production [vars] to turn AgentID on — AGENTID_ENABLED=1,
  AGENTID_CLIENT_ID (public client id for the registered 'BasedAgents' AgentID
  client), AGENTID_REDIRECT_URI=https://api.basedagents.ai/v1/agentid/callback.
  ISSUER/SCOPES stay implicit (code defaults: https://auth.agentid.com, 'openid
  email profile'). The feature still fails closed until the AGENTID_CLIENT_SECRET
  wrangler secret is set, so GET /v1/status -> agentid flips to 'enabled' only
  once that secret is present.
- put-secrets.sh: fix 'WRANGLER_ENV_ARGS[@]: unbound variable' on bash 3.2
  (macOS) under set -u when no --env is passed (production path). Use the
  empty-array-safe expansion ${arr[@]+"${arr[@]}"}.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01NNqTSRyDjL1LcayDuUeDkr
---
 packages/api/wrangler.toml | 17 ++++++++---------
 scripts/put-secrets.sh     |  2 +-
 2 files changed, 9 insertions(+), 10 deletions(-)

diff --git a/packages/api/wrangler.toml b/packages/api/wrangler.toml
index 6a817f3..6d15ba1 100644
--- a/packages/api/wrangler.toml
+++ b/packages/api/wrangler.toml
@@ -38,15 +38,14 @@ POSTHOG_PROJECT_TOKEN = "phc_sDSFNrjkniWVhvBekx2UL4PkwrmT6jMeWnyswdC3S2LV"
 ACQUISITION_ANALYTICS = "1"
 INTERNAL_AGENT_IDS = ""
 # AgentID verified-identity linking (src/agentid/). OPTIONAL attestation on top
-# of AgentSig. Fails closed until a client is registered at the AgentID console
-# (npx @agentmail/agentid-cli init) and these are filled. Uncomment + set the
-# three vars and add the AGENTID_CLIENT_SECRET secret (scripts/put-secrets.sh);
-# ISSUER defaults to https://auth.agentid.com. GET /v1/status -> agentid.
-# AGENTID_ENABLED = "1"
-# AGENTID_CLIENT_ID = ""
-# AGENTID_REDIRECT_URI = "https://api.basedagents.ai/v1/agentid/callback"
-# AGENTID_ISSUER = "https://auth.agentid.com"
-# AGENTID_SCOPES = "openid email profile"
+# of AgentSig. Fails closed until the AGENTID_CLIENT_SECRET secret is also set
+# (scripts/put-secrets.sh) — GET /v1/status -> agentid flips to "enabled" only
+# when the secret is present too. CLIENT_ID is a public identifier; the registered
+# client must list AGENTID_REDIRECT_URI as an allowed redirect. ISSUER/SCOPES
+# default to the values below, so they are left implicit.
+AGENTID_ENABLED = "1"
+AGENTID_CLIENT_ID = "6c151bc5-c838-4f8a-acf3-3655a7e5b47e"
+AGENTID_REDIRECT_URI = "https://api.basedagents.ai/v1/agentid/callback"
 # House accounts: paid tasks they posted carry `sponsored: true` in GET /v1/tasks/settled
 # (the platform paying for work, labeled as such). Agent ids are public; add the
 # console owner id (ow_…) that posts house tasks from app.basedagents.ai too.
diff --git a/scripts/put-secrets.sh b/scripts/put-secrets.sh
index 1378dec..59410c4 100755
--- a/scripts/put-secrets.sh
+++ b/scripts/put-secrets.sh
@@ -27,7 +27,7 @@ put() {
     echo "· $name not set in environment — skipped"
     return
   fi
-  printf '%s' "$value" | npx wrangler secret put "$name" "${WRANGLER_ENV_ARGS[@]}"
+  printf '%s' "$value" | npx wrangler secret put "$name" ${WRANGLER_ENV_ARGS[@]+"${WRANGLER_ENV_ARGS[@]}"}
   echo "✓ $name"
 }