TK-10105: fix heygen 'Not logged in' auth wiring in buildloop

cf5c27a7bce23c5f0baaadf57e2e627d09c55acd · 2026-08-07 13:54:34 -0700 · Steve Abrams

The heygen CLI authenticates from EITHER ~/.heygen/credentials OR $HEYGEN_API_KEY.
Under launchd/sandbox the credentials file can be unreachable and the env var is
empty, so any heygen call in a cycle dies with 'Not logged in' / 'no API key found'.
Export the valid key (routed by secrets-manager into the heygen skill .env) before
invoking claude so auth/list/whoami checks work. Renders stay gated (no spend tool;
prompt forces HeyGen renders to a pending-approval memo).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Files touched

M ops/buildloop-cycle.sh

Diff

commit cf5c27a7bce23c5f0baaadf57e2e627d09c55acd
Author: Steve Abrams <steve@designerwallcoverings.com>
Date:   Fri Aug 7 13:54:34 2026 -0700

    TK-10105: fix heygen 'Not logged in' auth wiring in buildloop
    
    The heygen CLI authenticates from EITHER ~/.heygen/credentials OR $HEYGEN_API_KEY.
    Under launchd/sandbox the credentials file can be unreachable and the env var is
    empty, so any heygen call in a cycle dies with 'Not logged in' / 'no API key found'.
    Export the valid key (routed by secrets-manager into the heygen skill .env) before
    invoking claude so auth/list/whoami checks work. Renders stay gated (no spend tool;
    prompt forces HeyGen renders to a pending-approval memo).
    
    Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 ops/buildloop-cycle.sh | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/ops/buildloop-cycle.sh b/ops/buildloop-cycle.sh
index c5dc1953..8239d96c 100755
--- a/ops/buildloop-cycle.sh
+++ b/ops/buildloop-cycle.sh
@@ -19,6 +19,18 @@ PROMPT='/yoloforever continue — autonomous build loop for the RENTV project (~
 # `claude` is a shell function in interactive shells; launchd runs non-interactive, so pin the real binary.
 CLAUDE_BIN="$HOME/.local/bin/claude"; [ -x "$CLAUDE_BIN" ] || CLAUDE_BIN="$(command -v claude)"
 
+# TK-10105: the heygen CLI authenticates from EITHER ~/.heygen/credentials OR $HEYGEN_API_KEY.
+# Under launchd/sandbox the credentials file may be unreachable and this env is empty, so the
+# CLI dies with "Not logged in" / "no API key found". Export the valid key from the heygen skill
+# .env (the secrets-manager routes HEYGEN_API_KEY there) so any auth/list/whoami check works.
+# NOTE: this only enables AUTH — actual renders spend money and remain gated: this loop has no
+# curl/spend tool and the prompt forces HeyGen renders to a pending-approval memo, never a live call.
+HEYGEN_ENV="$HOME/.claude/skills/heygen-video/.env"
+if [ -z "${HEYGEN_API_KEY:-}" ] && [ -f "$HEYGEN_ENV" ]; then
+  HEYGEN_API_KEY="$(grep -E '^HEYGEN_API_KEY=' "$HEYGEN_ENV" | head -1 | cut -d= -f2- | tr -d '\r\n')"
+  export HEYGEN_API_KEY
+fi
+
 {
   echo "==================== $(date '+%Y-%m-%d %H:%M:%S') cycle start ===================="
   "$CLAUDE_BIN" -p "$PROMPT" \

← 3e325c5f template-toggle: add admin 'View all — compare' overlay (all · back to Rentv 2026 · docs: surgical deploy handoff for claude-rentv-max (toggle + 1add61c9 →