Config directory
~/.prime/agent/ (set by APP_NAME and CONFIG_DIR_NAME in packages/coding-agent/src/config.ts).
Environment variables
Strip ambient keys for a single run with
--no-env. Forwarding from client to daemon is limited to the keys named in DAEMON_CLIENT_ENV_KEYS (packages/coding-agent/src/modes/daemon/daemon-protocol.ts).
Auth storage
FileAuthStorageBackend reads and writes auth.json. Concurrent processes coordinate through proper-lockfile so refreshing an OAuth token from one client doesn’t race a read from another. auth.json supports both API-key and OAuth entries.
Inline keys passed with --api-key go through setRuntimeApiKey and never touch disk.
Related
- Providers and models — how credentials are loaded per turn.
- Security — trust model and credential handling.