Add secrets file

.gitignore

@@ -28,3 +28,6 @@ ielm-history.eld
 
 # Ignore actual init as it can contain private data
 init.el
+
+# Ignore secrets
+icejam-secrets.el

early-init.el

@@ -26,8 +26,8 @@
                               (time-subtract after-init-time before-init-time)))
                      gcs-done)))
 
-;; set path for native compilation to work
-(setenv "PATH" "/Users/maciej/.local/share/zinit/polaris/bin:/Users/maciej/.asdf/shims:/Users/maciej/.local/bin:/Users/maciej/.opam/default/bin:/Users/maciej/.go/bin:/Users/maciej/.elan/bin:/opt/homebrew/opt/postgresql@17/bin:/opt/homebrew/bin:/opt/homebrew/sbin:/usr/local/bin:/System/Cryptexes/App/usr/bin:/usr/bin:/bin:/usr/sbin:/sbin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/local/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/bin:/var/run/com.apple.security.cryptexd/codex.system/bootstrap/usr/appleinternal/bin:/Library/Apple/usr/bin:/usr/local/MacGPG2/bin:/usr/local/share/dotnet:/Users/maciej/.dotnet/tools:/Applications/Postgres.app/Contents/Versions/latest/bin:/Applications/kitty.app/Contents/MacOS")
-(setq exec-path (split-string (getenv "PATH") path-separator))
-
+;; Load secrets file before doing anything else:
+(let ((secrets-file (concat user-emacs-directory "icejam-secrets.el")))
+  (when (file-exists-p secrets-file)
+    (load secrets-file)))
 ;;; early-init.el ends here

lisp/icejam-agent-shell.el

@@ -10,6 +10,7 @@
 
 ;;; Code:
 (declare-function agent-shell-make-environment-variables 'agent-shell)
+(defvar icejam-variables-to-load-in-agent-shell '())
 
 (use-package agent-shell
   :ensure t
@@ -21,9 +22,9 @@
   (setopt agent-shell-anthropic-claude-environment
           (agent-shell-make-environment-variables :inherit-env t))
   (setopt agent-shell-opencode-environment
-          (agent-shell-make-environment-variables
+          (apply #'agent-shell-make-environment-variables
                  :inherit-env t
-           "GOOGLE_CLOUD_PROJECT" "mv-ai-architecture"))
+                 icejam-variables-to-load-in-agent-shell))
   (setopt
    agent-shell-opencode-default-model-id
    "google-vertex-anthropic/claude-sonnet-4-6@default"))

lisp/icejam-base.el

@@ -110,6 +110,9 @@
 (eval-when-compile
   (declare-function exec-path-from-shell-initialize 'exec-path-from-shell))
 
+;; This should be defined in secrets.
+(defvar icejam-variables-to-load-from-shell '())
+
 ;; Allow to execute path from shell
 (use-package exec-path-from-shell
   ;; :if (memq window-system '(x mac ns))
@@ -118,19 +121,7 @@
   :hook ((elpaca-after-init . exec-path-from-shell-initialize))
   :config
   (add-to-list 'exec-path "/usr/local/bin")
-  (dolist (var '("DEFT_PATH"
-                 "LANG"
-                 "LC_CTYPE"
-                 "CLAUDE_CODE_USE_VERTEX"
-                 "CLOUD_ML_REGION"
-                 "ANTHROPIC_VERTEX_PROJECT_ID"
-                 "VERTEX_REGION_CLAUDE_3_5_HAIKU"
-                 "VERTEX_REGION_CLAUDE_3_5_SONNET"
-                 "VERTEX_REGION_CLAUDE_3_7_SONNET"
-                 "VERTEX_REGION_CLAUDE_4_0_OPUS"
-                 "VERTEX_REGION_CLAUDE_4_0_SONNET"
-                 "VERTEX_REGION_CLAUDE_4_1_OPUS"
-                 "ANTHROPIC_MODEL"))
+  (dolist (var icejam-variables-to-load-from-shell)
     (add-to-list 'exec-path-from-shell-variables var)))
 
 (use-package direnv :ensure t :defer t