feat(missions): forward ZAI/KIMI keys so one binary serves three backends

All three providers run through the SAME `claude` binary, verified live:

  Anthropic  CLAUDE_CODE_OAUTH_TOKEN                          -> ANTHROPIC-OK
  GLM        ANTHROPIC_BASE_URL=https://api.z.ai/api/anthropic -> GLM-OK
  Kimi       ANTHROPIC_BASE_URL=https://api.kimi.com/coding/   -> KIMI-OK

That is a stronger multi-provider story than a provider-per-implementation:
skills, subagents, MCP, hooks and tool policy are identical across all
three because it is literally the same harness.

The `kimi` CLI (0.31.1, shipped in the image) 401s on this key and is not
needed -- the claude binary reaches Kimi's Anthropic-compatible endpoint
directly. Worth knowing before someone debugs the CLI.

forwarded_provider_keys now ships ZAI_API_KEY and KIMI_API_KEY into
mission containers in BOTH auth modes: they are unrelated to the Anthropic
credential, so the api_key/subscription split does not apply to them. A
mission that selects a backend without its key present would otherwise
fail at the first turn.

Keys persisted in /opt/clawmates/.env and passed through compose.

Co-Authored-By: Claude Opus 5 <[email protected]>

crates/cm-api/src/mission_delivery.rs

@@ -583,6 +583,7 @@ pub async fn commit_phase_work(
                 String::new()
             }
         );
+        clear_stale_commit_editmsg(repo);
         git(repo, &["commit", "--no-verify", "-m", &message]).await?;
     }
 
@@ -878,6 +879,34 @@ impl TestOutcome {
     }
 }
 
+/// Remove a `COMMIT_EDITMSG` the agent left behind as root.
+///
+/// The checkout is shared between the server (uid 65532) and the agent
+/// container (root). `core.sharedRepository` makes git create *objects and
+/// refs* group-writable — `.git/index` lands as 0666, which is why commits
+/// work at all — but it does not cover `COMMIT_EDITMSG`, which git writes
+/// with the default umask. An agent that runs `git commit` itself leaves that
+/// file owned by root at 0644, and the server's next commit dies with:
+///
+/// ```text
+/// git commit → exit 128: could not open '.git/COMMIT_EDITMSG': Permission denied
+/// ```
+///
+/// Observed on mission `019fcd0c`, which produced correct work — a reviewed,
+/// tested function plus a REVIEW.md quoting a real `cargo test` summary — and
+/// then delivered none of it.
+///
+/// Unlinking works where overwriting does not: removing a file requires write
+/// permission on the *directory*, and `.git/` is owned by the server. Silent
+/// on failure by design — if the file is absent or cannot be removed, the
+/// commit below reports the real error rather than this speculative cleanup.
+fn clear_stale_commit_editmsg(repo: &Path) {
+    let msg = repo.join(".git/COMMIT_EDITMSG");
+    if msg.exists() {
+        let _ = std::fs::remove_file(&msg);
+    }
+}
+
 /// Mark a phase as impossible to capture, so it stops being selected.
 ///
 /// A phase whose checkout has already been reaped can never be captured. It

crates/cm-api/src/mission_runtime.rs

@@ -91,7 +91,17 @@ impl RuntimeAuth {
 /// `claude -p` simply hangs with no credential, which is what a phase stuck
 /// at `running` for ten minutes looked like when this was first switched on.
 pub fn forwarded_provider_keys(auth: RuntimeAuth) -> Vec<&'static str> {
-    let mut keys = vec!["GEMINI_API_KEY", "GROQ_API_KEY", "OPENAI_API_KEY"];
+    // ZAI/KIMI reach their backends through the SAME `claude` binary via
+    // ANTHROPIC_BASE_URL, so a mission that selects one needs its key present
+    // in the container. They are unrelated to the Anthropic credential and
+    // forward in both auth modes.
+    let mut keys = vec![
+        "GEMINI_API_KEY",
+        "GROQ_API_KEY",
+        "OPENAI_API_KEY",
+        "ZAI_API_KEY",
+        "KIMI_API_KEY",
+    ];
     match auth {
         RuntimeAuth::ApiKey => keys.push("ANTHROPIC_API_KEY"),
         RuntimeAuth::Subscription => keys.push("CLAUDE_CODE_OAUTH_TOKEN"),
@@ -810,7 +820,13 @@ mod tests {
              it silently bills the API. Forwarded: {keys:?}"
         );
         // Unrelated providers have no subscription equivalent and must survive.
-        for k in ["GEMINI_API_KEY", "GROQ_API_KEY", "OPENAI_API_KEY"] {
+        for k in [
+            "GEMINI_API_KEY",
+            "GROQ_API_KEY",
+            "OPENAI_API_KEY",
+            "ZAI_API_KEY",
+            "KIMI_API_KEY",
+        ] {
             assert!(keys.contains(&k), "{k} should still be forwarded");
         }
         // And the subscription credential MUST travel. A mission container

crates/cm-api/tests/mission_delivery.rs

@@ -876,3 +876,43 @@ async fn an_unrunnable_suite_is_distinguishable_from_no_suite() {
         "the two must be distinguishable — this is the whole point"
     );
 }
+
+/// A COMMIT_EDITMSG left by the agent must not block delivery.
+///
+/// From mission 019fcd0c: the agent ran `git commit` itself, leaving
+/// `.git/COMMIT_EDITMSG` owned by root at 0644, and the server's commit died
+/// with "Permission denied". The mission produced correct work — a reviewed,
+/// tested function — and delivered none of it.
+///
+/// A test process cannot own a file as another uid, so this asserts the
+/// mechanism: whatever COMMIT_EDITMSG was there before, a delivery commit
+/// still succeeds and the file is the one git just wrote.
+#[tokio::test]
+async fn a_stale_commit_editmsg_does_not_block_delivery() {
+    let pool = cm_testkit::test_pool().await;
+    let tmp = tempfile::tempdir().unwrap();
+    let mission = Uuid::now_v7();
+    let repo = seed_repo(tmp.path(), mission);
+    let (_, phase) = seed_mission_phase(&pool, mission).await;
+
+    // Stand in for the agent's leftover: content that must not survive.
+    let msg = repo.join(".git/COMMIT_EDITMSG");
+    std::fs::write(&msg, "LEFTOVER FROM THE AGENT\n").unwrap();
+
+    std::fs::write(repo.join("WORK.md"), "work\n").unwrap();
+    let cap = capture(&pool, tmp.path(), mission, phase)
+        .await
+        .unwrap()
+        .unwrap();
+
+    let commit = cap
+        .committed
+        .expect("delivery must commit despite a stale COMMIT_EDITMSG");
+    assert!(!commit.sha.is_empty());
+
+    let body = std::fs::read_to_string(&msg).unwrap_or_default();
+    assert!(
+        !body.contains("LEFTOVER FROM THE AGENT"),
+        "the stale message survived: {body:?}"
+    );
+}