build: seed APP_VERSION and API_KEY from the environment

Fresh cmake configures pick up APP_VERSION/API_KEY from environment
variables (as nix develop and CI provide them); -D still wins on
reconfigure. Also normalizes indentation in the sd-bus blocks.

AGENTS.md

@@ -30,7 +30,11 @@ the project version, or pass your own at configure time:
 cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION="1.2.3"
 ```
 
-The Nix package passes its flake version automatically via `cmakeFlags`.
+The Nix package bakes `-DAPP_VERSION=<pkg version>` via `cmakeFlags` (version is
+hardcoded `0.1.0` in `nix/package.nix`, not read from the flake). `nix develop`
+sets `APP_VERSION=dev` and exports `API_KEY` from the ambient environment
+(falling back to `RWT_LIVE_API_KEY`). CMake seeds a *fresh* configure from the
+`APP_VERSION` / `API_KEY` env vars; `-D` wins on reconfigure.
 
 The portal API key is also a build-time argument: `-DAPI_KEY="..."` (CMake) or
 `apiKey` on `callPackage` (Nix). It is compiled into the binary as the

CMakeLists.txt

@@ -8,15 +8,29 @@ set(CMAKE_EXPORT_COMPILE_COMMANDS ON)
 # App version string shown at the top of the Home footer. Defaults to the
 # project version; override at configure time with:
 #   cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug -DAPP_VERSION="1.2.3"
-set(APP_VERSION "${PROJECT_VERSION}" CACHE STRING
+# or by exporting APP_VERSION in the environment (the `nix develop` shell does
+# this; the env var only seeds a fresh configure, -D wins on reconfigure).
+if(DEFINED ENV{APP_VERSION})
+  set(APP_VERSION "$ENV{APP_VERSION}" CACHE STRING
       "Version string shown in the Home footer (override at configure time)")
+else()
+  set(APP_VERSION "${PROJECT_VERSION}" CACHE STRING
+      "Version string shown in the Home footer (override at configure time)")
+endif()
 
 # API bearer key baked into the binary and sent as `Authorization: Bearer <key>`
 # on every portal request. Leave empty to send no auth header. Never commit the
 # real value — inject it at CI build time from a secret, e.g.:
 #   cmake ... -DAPI_KEY="${{ secrets.PORTAL_API_KEY }}"
-set(API_KEY "" CACHE STRING
+# The `nix develop` shell exports API_KEY from the ambient environment, which
+# seeds a fresh configure; -D wins on reconfigure.
+if(DEFINED ENV{API_KEY})
+  set(API_KEY "$ENV{API_KEY}" CACHE STRING
       "Portal API key baked into the binary (leave empty to skip auth)")
+else()
+  set(API_KEY "" CACHE STRING
+      "Portal API key baked into the binary (leave empty to skip auth)")
+endif()
 
 find_package(SDL3 REQUIRED)
 find_package(SDL3_ttf REQUIRED)

flake.nix

@@ -39,8 +39,20 @@
             devShells.default = pkgs.mkShell {
               inputsFrom = [ self.packages.${system}.default ];
               packages = [ ];
+              env = {
+                # APP_VERSION and API_KEY are CMake cache variables with no
+                # default; on a fresh configure cmake seeds their cache from
+                # environment variables of the same name, so a plain
+                # `cmake -S . -B build` bakes them into the binary.
+                APP_VERSION = "dev";
+              };
               shellHook = ''
-                echo "RadiantWave dev shell"
+                # Never commit the real key. Export API_KEY (or the CI name
+                # RWT_LIVE_API_KEY) in your ambient environment and this shell
+                # picks it up; empty by default (no auth header).
+                export API_KEY="''${API_KEY:-''${RWT_LIVE_API_KEY:-}}"
+
+                echo "RadiantWave dev shell (APP_VERSION=dev, API_KEY=$([[ -n "$API_KEY" ]] && echo set || echo unset))"
                 echo "  Configure: cmake -S . -B build -G Ninja -DCMAKE_BUILD_TYPE=Debug"
                 echo "  Build:     cmake --build build"
                 echo "  Run:       ./build/radiantwave"