CB-612: suppress unneeded token warnings

fleetd/src/main/java/dev/ltms/fleet/Fleetd.java

@@ -795,7 +795,7 @@ public final class Fleetd {
 
     /**
      * CB-594: which env vars the loaded config actually needs, and why — every non-{@code
-     * subscription} profile's {@code tokenEnv} (a subscription profile never reads one, see
+     * subscription} profile's explicitly configured {@code tokenEnv} (a subscription profile never reads one, see
      * {@link FleetConfig.Profile#isSubscription()}), plus every profile's {@code gitTokenEnv}
      * where set (opt-in), plus a configured {@code broker.uriEnv} (CB-151). Derived from the
      * config, not hard-coded, so a new profile is covered for free. A var required by more than one
@@ -812,7 +812,9 @@ public final class Fleetd {
     static Map<String, List<String>> requiredSecretEnvVars(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = new LinkedHashMap<>();
         cfg.profiles().forEach((name, profile) -> {
-            if (!profile.isSubscription()) {
+            // All kinds are checked when tokenEnv is explicit. OpenCode may use provider credentials,
+            // but an explicit tokenEnv still declares a required host secret for its configured provider.
+            if (!profile.isSubscription() && profile.hasTokenEnv()) {
                 requiredBy.computeIfAbsent(profile.tokenEnv(), _ -> new ArrayList<>())
                         .add("profile '" + name + "' tokenEnv");
             }
@@ -838,7 +840,7 @@ public final class Fleetd {
      * <p>A missing entry only warns — it must never refuse to start. A daemon that boots and says
      * what is wrong is strictly more useful than one that will not boot at all.
      */
-    private static void reportRequiredSecrets(FleetConfig cfg) {
+    static void reportRequiredSecrets(FleetConfig cfg) {
         Map<String, List<String>> requiredBy = requiredSecretEnvVars(cfg);
         if (requiredBy.isEmpty()) {
             log.info("startup secrets: no profile references a token env var — nothing to check");

fleetd/src/main/java/dev/ltms/fleet/config/FleetConfig.java

@@ -240,7 +240,8 @@ public record FleetConfig(
      * @param configDir {@code CLAUDE_CONFIG_DIR} so the worker inherits the profile's
      *                  skills/MCP/hooks (may be {@code null})
      * @param tokenEnv  name of the host env var holding the worker's auth token; its value
-     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config)
+     *                  is injected as {@code ANTHROPIC_AUTH_TOKEN} (never stored in config).
+     *                  {@code null}/blank means this profile needs no token.
      * @param argv      launch command; defaults to {@code ["claude"]}
      * @param placement where a worker lands: {@code "tab"} (default — its own tab in the
      *                  worker space) or {@code "pane"} (legacy — split the focused tab)
@@ -389,7 +390,7 @@ public record FleetConfig(
                     ? (KIND_CLAUDE_CODE.equals(k) ? List.of("claude") : List.of(k))
                     : List.copyOf(argv);
             kind = k;
-            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? "FLEETD_WORKER_TOKEN" : tokenEnv;
+            tokenEnv = (tokenEnv == null || tokenEnv.isBlank()) ? null : tokenEnv;
             placement = (placement == null || placement.isBlank()) ? "tab" : placement.toLowerCase();
             workspace = (workspace == null || workspace.isBlank()) ? "fleet" : workspace;
             // CB-557: no per-profile default any more. A label is generated from the member's ROLE
@@ -604,6 +605,11 @@ public record FleetConfig(
             return gitTokenEnv != null && !gitTokenEnv.isBlank();
         }
 
+        /** True when this profile explicitly names a host token environment variable. */
+        public boolean hasTokenEnv() {
+            return tokenEnv != null && !tokenEnv.isBlank();
+        }
+
         /**
          * True when this profile's {@code env:} block names a worker-side Anthropic binding variable.
          * Those two keys are the adapter's, never the operator's: on a claude-code worker

fleetd/src/test/java/dev/ltms/fleet/RequiredSecretEnvVarsTest.java

@@ -1,8 +1,12 @@
 package dev.ltms.fleet;
 
+import ch.qos.logback.classic.Logger;
+import ch.qos.logback.classic.spi.ILoggingEvent;
+import ch.qos.logback.core.read.ListAppender;
 import dev.ltms.fleet.config.FleetConfig;
 import org.junit.jupiter.api.Test;
 import org.junit.jupiter.api.io.TempDir;
+import org.slf4j.LoggerFactory;
 
 import java.nio.file.Files;
 import java.nio.file.Path;
@@ -26,19 +30,66 @@ class RequiredSecretEnvVarsTest {
         return FleetConfig.load(f);
     }
 
+    private static ListAppender<ILoggingEvent> attach() {
+        Logger logger = (Logger) LoggerFactory.getLogger(Fleetd.class);
+        ListAppender<ILoggingEvent> appender = new ListAppender<>();
+        appender.start();
+        logger.addAppender(appender);
+        return appender;
+    }
+
+    private static void detach(ListAppender<ILoggingEvent> appender) {
+        ((Logger) LoggerFactory.getLogger(Fleetd.class)).detachAppender(appender);
+    }
+
     @Test
-    void collectsATokenEnvPerNonSubscriptionProfile(@TempDir Path dir) throws Exception {
+    void explicitlyConfiguredUnsetTokenEnvWarnsWithCurrentWording(@TempDir Path dir) throws Exception {
         FleetConfig cfg = load(dir, """
                 profiles:
                   local:
                     baseUrl: http://gx00.gw:8000
-                    tokenEnv: AI_GATEWAY_TOKEN
+                    tokenEnv: CB115_MISSING_TOKEN_ENV_819367
                 """);
 
         Map<String, List<String>> required = Fleetd.requiredSecretEnvVars(cfg);
 
-        assertTrue(required.containsKey("AI_GATEWAY_TOKEN"));
-        assertEquals(List.of("profile 'local' tokenEnv"), required.get("AI_GATEWAY_TOKEN"));
+        assertTrue(required.containsKey("CB115_MISSING_TOKEN_ENV_819367"));
+        assertEquals(List.of("profile 'local' tokenEnv"), required.get("CB115_MISSING_TOKEN_ENV_819367"));
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRequiredSecrets(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertTrue(appender.list.stream().anyMatch(e ->
+                        e.getLevel() == ch.qos.logback.classic.Level.WARN
+                                && e.getFormattedMessage().contains("startup secret CB115_MISSING_TOKEN_ENV_819367: MISSING")
+                                && e.getFormattedMessage().contains("profile 'local' tokenEnv")),
+                "an explicitly configured but unset tokenEnv must retain the startup warning");
+    }
+
+    @Test
+    void profileWithoutTokenEnvDoesNotRequireTheOldDefault(@TempDir Path dir) throws Exception {
+        FleetConfig cfg = load(dir, """
+                profiles:
+                  local:
+                    baseUrl: http://gx00.gw:8000
+                """);
+
+        assertTrue(Fleetd.requiredSecretEnvVars(cfg).isEmpty(),
+                "an absent tokenEnv means this profile needs no token, not FLEETD_WORKER_TOKEN");
+
+        ListAppender<ILoggingEvent> appender = attach();
+        try {
+            Fleetd.reportRequiredSecrets(cfg);
+        } finally {
+            detach(appender);
+        }
+
+        assertFalse(appender.list.stream().anyMatch(e -> e.getLevel() == ch.qos.logback.classic.Level.WARN),
+                "a profile without tokenEnv must not produce a startup secret warning");
     }
 
     @Test