Honor USE_DEFENDER_SIGNER env var to route this run via Defender

Talos' per-action "Use Defender Relayer signer" checkbox sets this
env var on the dispatch spawn when an operator opts in. Add a branch
in getSigner() before the KMS check that honors it: if the env vars
are missing throw a structured error (so it surfaces cleanly in
talos run_logs instead of as a Defender SDK 401), otherwise call the
existing getDefenderSigner().

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 2 people

src/js/utils/signers.ts

@@ -141,6 +141,25 @@ export async function getSigner(address?: string): Promise<Signer> {
     return maybeWrap(wallet);
   }
 
+  // Per-action override set by talos dispatch when the operator checked
+  // the "Use Defender Relayer signer" box on this action. Skip KMS and
+  // route through Defender for this run only. Throw a structured error
+  // if the env vars aren't actually present so the failure surfaces
+  // cleanly in run_logs instead of as an SDK 401.
+  if (process.env.USE_DEFENDER_SIGNER === "1") {
+    if (
+      !process.env.DEFENDER_RELAYER_KEY ||
+      !process.env.DEFENDER_RELAYER_SECRET
+    ) {
+      throw new Error(
+        "USE_DEFENDER_SIGNER=1 was requested but DEFENDER_RELAYER_KEY / " +
+          "DEFENDER_RELAYER_SECRET are not configured on this runner. " +
+          "Either uncheck the Defender option on this action or configure the env vars.",
+      );
+    }
+    return maybeWrap(await getDefenderSigner());
+  }
+
   if (hasAwsKmsCredentials()) {
     return maybeWrap(await getKmsSigner());
   }