CLI: no way to set a workspace environment variable (blocks deploying any agent that needs a secret)

[khaliqgant]

The problem

A deployed cloud agent has no supported way to receive a secret.

Secrets cannot be persona inputs: persona-kit's inputs docstring is explicit that resolved input values are substituted into the system prompt, so a token declared as an input leaks into the prompt. The documented alternative is "set it as a workspace environment variable" — and there is no mechanism to do that.

Enumerated every top-level agentworkforce command (v4.1.52):

create, agent, list, show, persona compile, agent-card, install, sources,
integrations, trigger, harness check, pick, deploy, local-surface, invoke,
runs export, deployments list, deployments logs, destroy, login, logout

No env, no secret, no workspace. agentworkforce deploy has only --input, which is the thing a secret must not be.

Concrete blocker

AgentWorkforce/internal-agents #87/#88 shipped repo-intel, which needs RTH_TOKEN (a rth_st_* relayhistory service token, scope rth:read) at runtime. The agent is built, reviewed, merged, and undeployable — the token has nowhere to live.

Its README says to set RTH_TOKEN "as a workspace environment variable", which is currently a documented instruction with no implementation behind it.

Proposed shape

Mirror a pattern this org already relies on. relayhistory-cloud's production deploy workflow pipes its embedding key to sst secret set on stdin specifically so it never reaches argv, shell history, or a process listing:

agentworkforce env set <KEY>      # value read from STDIN, never argv
agentworkforce env list           # names, last-set time, who set it — never values
agentworkforce env unset <KEY>

Workspace-scoped, with --workspace <name> to override, matching the other commands.

A dashboard field would also help, but the CLI matters more: it is what CI and a scripted deploy can use, and a dashboard-only path makes every rotation manual.

Requirements worth pinning

• A value must never be accepted via argv, and must never appear in a log, error message, or --json output.
• env list must not expose values.
• Workspace-scoped — one workspace must not read or overwrite another's.
• The value must actually reach a deployed agent's process.env. A CLI that stores something nothing reads would reproduce this bug at one remove, which is exactly how we got here.
• Setting an existing key overwrites and says so; unsetting a missing key must not report success.

Related

• AgentWorkforce/internal-agents feat(personas-core): add proactive-agent-builder persona + fix optional-input regression #87, feat: add deploy v1 runtime, schema, and examples #88 — the blocked agent
• AgentWorkforce/relayhistory-cloud feat(cli): default claude/opencode to sandbox mount with git included #31 — POST /v1/auth/service-tokens, which mints the credential that has nowhere to go