Add AGENT_ENV_VARS_PRIVATE_KEY to dev-start config

Allow setting the private key in dev-start.conf so it syncs into .dev.vars
automatically, avoiding manual setup and the placeholder validation error.

Author: evanjacobson

kiloclaw/scripts/.dev-start.conf.example

@@ -9,6 +9,9 @@
 # TUNNEL_NAME=          # tunnel
 # TUNNEL_HOSTNAME=      # tunnel.yourdomain.com
 
+# RSA private key for agent env var encryption (get from 1Password, engineering vault)
+# AGENT_ENV_VARS_PRIVATE_KEY=
+
 # How to display the 3 dev processes:
 #   tabs   — separate terminal tabs (default; auto-detects iTerm2 vs Terminal.app)
 #   split  — single tab with split panes (requires iTerm2)

kiloclaw/scripts/dev-start.sh

@@ -88,6 +88,18 @@ if [ ! -f "$KILOCLAW_DIR/.dev.vars" ]; then
   cp "$KILOCLAW_DIR/.dev.vars.example" "$KILOCLAW_DIR/.dev.vars"
 fi
 
+# Sync AGENT_ENV_VARS_PRIVATE_KEY from config into .dev.vars
+if [ -n "${AGENT_ENV_VARS_PRIVATE_KEY:-}" ]; then
+  echo "==> Syncing AGENT_ENV_VARS_PRIVATE_KEY from config into .dev.vars..."
+  if grep -q '^AGENT_ENV_VARS_PRIVATE_KEY=' "$KILOCLAW_DIR/.dev.vars"; then
+    sed "s|^AGENT_ENV_VARS_PRIVATE_KEY=.*|AGENT_ENV_VARS_PRIVATE_KEY=$AGENT_ENV_VARS_PRIVATE_KEY|" \
+      "$KILOCLAW_DIR/.dev.vars" > "$KILOCLAW_DIR/.dev.vars.tmp"
+    mv "$KILOCLAW_DIR/.dev.vars.tmp" "$KILOCLAW_DIR/.dev.vars"
+  else
+    echo "AGENT_ENV_VARS_PRIVATE_KEY=$AGENT_ENV_VARS_PRIVATE_KEY" >> "$KILOCLAW_DIR/.dev.vars"
+  fi
+fi
+
 # Check AGENT_ENV_VARS_PRIVATE_KEY is configured
 AGENT_KEY="$(grep '^AGENT_ENV_VARS_PRIVATE_KEY=' "$KILOCLAW_DIR/.dev.vars" | head -1 | sed 's/^[^=]*=//' | sed 's/^"//;s/"$//')"
 if [ -z "$AGENT_KEY" ] || [ "$AGENT_KEY" = "..." ]; then