[ethan-huo]

Summary

Migrates the platform API key lookup to @celados/argc 8.1 defineValueSource (CR 8.1, celados/argc#20). This also releases 0.2.9, following the convention of earlier dependency-bump PRs (#7, #8).

WBOT_API_KEY is declared once in packages/wbot/wbot-values.ts. Sources are tried in this order:

1. env WBOT_API_KEY: for automation and CI.
2. The wbot auth set store ($XDG_CONFIG_HOME/wbot/credentials.json), now a custom Source in wbot-config.ts.
3. latch wbot / test / platform-tenant-key. This source is used only when WBOT_PLATFORM_URL is https://wbot-api-test.celados.com.

Other changes:

• The key is resolved lazily, only when a command calls the Platform. @schema, --help, auth set, and MCP startup do not touch any source. The CLI passes values: wbotValues to cli(), so @schema lists these sources under values:.
• The MCP path uses the same createWbotPlatformClient. wbot-mcp.ts now takes the client factory as an injected parameter and no longer imports the config module. MCP tool errors return the structured argc envelope instead of the bare DOMAIN_ERROR message.
• A missing key used to raise RUNTIME_ERROR with a sentence. It now raises DOMAIN_ERROR / value_unavailable with a tried: list. The store source reports not_configured, invalid_credentials (without echoing the file), or unreadable_credentials, each with a hint to run wbot auth set. CHANGELOG, README, and BDD are updated.
• The value-source code is split into its own module. wbot-config.ts stays free of runtime argc imports because @celados/argc/values uses the Bun global, and vitest workers run on Node.

Decisions

• Keep the store. wbot is a publicly distributed client, and wbot auth set is how external users log in. Following the principle that an application owns its credentials and does not depend on latch, the store stays as the source between env and latch. The repo has no internal documentation about copying keys from Vaultwarden into the store or rendering .env, so no docs needed deleting.
• Only the test target uses the vault key. The CLI targets production by default, and the vault entry is the test tenant key. The latch source is wrapped in onlyForTestPlatform, which reports a miss with not_test_platform for any other target. A production call therefore never gets the test key, and external users never run latch. If latch is not installed, the source simply reports a miss.
• Store before latch. If a team member has a production key in the store and targets test, the store key wins, as it did before. Clearing the store or setting WBOT_API_KEY uses the vault key instead.
• Known exposure: @schema and value_unavailable show the vault item id and name. These are not secrets, but they appear in a public client.

Test plan

• bun run check, bun run typecheck, bun run test (120 passed), bun run verify:package (0.2.9 artifact), bun test packages/wbot/scripts
• New tests: env overrides store and store is used without env (each checks the Authorization header on a fake server); the latch source is reached only on the test target (NODE_ENV=test, so latch is never actually called); @schema lists values:.
• Live test: from $TMPDIR, with an empty XDG_CONFIG_HOME and no WBOT_API_KEY, ran WBOT_PLATFORM_URL=https://wbot-api-test.celados.com wbot conversations.list '{"limit":1}'. It succeeded with the key from latch's agent profile. MCP list_conversations succeeded the same way.

[ethan-huo]

Closing: wbot is out of scope for the argc value-source migration (no support / migration tracking for this tool).