feat: add secure multi-runtime controls

Make agent backends configurable and governable with encrypted credentials, explicit context sharing, and tool approval boundaries.

Co-authored-by: factory-droid[bot] <138933559+factory-droid[bot]@users.noreply.github.com>

src/main/agent/create-runtime.ts

@@ -1,13 +1,27 @@
 import { BigtokenAgentRuntime } from './bigtoken-runtime'
+import { ContinueAgentRuntime } from './continue-runtime'
 import { DemoAgentRuntime } from './demo-runtime'
 import { OpenCodeRuntime } from './opencode-runtime'
 import type { AgentRuntime } from './runtime'
+import type { ResolvedRuntimeSettings } from '../runtime-settings-store'
+import { defaultRuntimeSettings } from '../../shared/contracts'
 
-export function createAgentRuntime(defaultWorkspace: string): AgentRuntime {
+export function createAgentRuntime(
+  defaultWorkspace: string,
+  settings?: ResolvedRuntimeSettings
+): AgentRuntime {
   const baseUrl = process.env.GOODBUDDY_OPENCODE_URL
   const embedded = process.env.GOODBUDDY_OPENCODE_EMBEDDED === 'true'
+  const provider = settings?.provider ?? 'auto'
 
-  if (baseUrl || embedded) {
+  if (provider === 'continue') {
+    return new ContinueAgentRuntime({
+      command: process.env.GOODBUDDY_CONTINUE_COMMAND ?? 'cn',
+      defaultWorkspace
+    })
+  }
+
+  if (provider === 'opencode' || (provider === 'auto' && (baseUrl || embedded))) {
     return new OpenCodeRuntime({
       baseUrl,
       embedded,
@@ -15,13 +29,14 @@ export function createAgentRuntime(defaultWorkspace: string): AgentRuntime {
     })
   }
 
-  const bigtokenApiKey = process.env.GOODBUDDY_BIGTOKEN_API_KEY?.trim()
-  if (bigtokenApiKey) {
+  const bigtokenApiKey =
+    settings?.apiKey ?? process.env.GOODBUDDY_BIGTOKEN_API_KEY?.trim()
+  if (provider === 'bigtoken' || (provider === 'auto' && bigtokenApiKey)) {
     return new BigtokenAgentRuntime({
-      apiKey: bigtokenApiKey,
+      apiKey: bigtokenApiKey ?? '',
       baseUrl:
-        process.env.GOODBUDDY_BIGTOKEN_BASE_URL ?? 'https://bigtoken.ai',
-      model: process.env.GOODBUDDY_BIGTOKEN_MODEL ?? 'sonnet-5'
+        settings?.bigtokenBaseUrl ?? defaultRuntimeSettings.bigtokenBaseUrl,
+      model: settings?.bigtokenModel ?? defaultRuntimeSettings.bigtokenModel
     })
   }