@deployfoundation/foundation-deploy 0.2.47 → 0.2.49

package/dist/bin/app.js

@@ -8,13 +8,13 @@ import {
   FoundationPages,
   FoundationPipeline,
   NewsletterStack
-} from "../chunk-yn8x77x6.js";
+} from "../chunk-6f2hkamj.js";
 import {
   adminsFor,
   instanceNames,
   loadInstanceFile,
   provisionsIntegration
-} from "../chunk-k6mcv6dk.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 
 // bin/app.ts

package/dist/bin/foundation-deploy.js

@@ -22,12 +22,15 @@ import {
   slackCommandPrefix,
   verifyManifest,
   versionedConfigKey
-} from "../chunk-k6mcv6dk.js";
+} from "../chunk-gnz747z2.js";
 import {
   DEFAULT_RELEASE_BUCKET,
   expectedKeyArn
 } from "../chunk-dz91avrb.js";
 
+// src/deploy/cli.ts
+import { readFileSync as readFileSync10 } from "node:fs";
+
 // src/deploy/aws.ts
 import { mkdtempSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
@@ -282,7 +285,7 @@ async function callerAccountId(ctx) {
 }
 
 // src/deploy/config-sync.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readdirSync } from "node:fs";
+import { existsSync as existsSync3, mkdirSync as mkdirSync2, mkdtempSync as mkdtempSync2, readFileSync as readFileSync3, readdirSync } from "node:fs";
 import { tmpdir as tmpdir2 } from "node:os";
 import { join as join3, resolve as resolve3 } from "node:path";
 
@@ -494,6 +497,11 @@ async function uploadRuntimeConfig(ctx, opts) {
   if (opts.runtimeConfigPath === undefined && ctx.instance.customization !== undefined)
     throw new Error("customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`");
   const source = opts.runtimeConfigPath ?? ctx.paths.configPath;
+  try {
+    parseInstanceConfig(readFileSync3(source, "utf8"));
+  } catch (error) {
+    throw new Error(`config for ${opts.version} does not parse with this release's schema, so nothing was uploaded: ${error instanceof Error ? error.message : String(error)}`);
+  }
   const key = versionedConfigKey(ctx.names.configKey, opts.version);
   await awsMutate(ctx, ["s3", "cp", source, `s3://${opts.bucket}/${key}`]);
   return key;
@@ -908,7 +916,7 @@ var UPWORK_GRAPHQL_DOCUMENTS = Object.freeze({
 var ETRADE_RESPONSE_MAX_BYTES = 1024 * 1024;
 var MAX_SECRET_JSON_LENGTH = 16 * 1024;
 // src/deploy/config.ts
-import { readFileSync as readFileSync3 } from "node:fs";
+import { readFileSync as readFileSync4 } from "node:fs";
 import { parse } from "yaml";
 function adminsCsv(yamlText, source = "runtime config") {
   const doc = parse(yamlText);
@@ -922,7 +930,7 @@ function adminsCsv(yamlText, source = "runtime config") {
   }).join(",");
 }
 function adminsCsvFromFile(path) {
-  return adminsCsv(readFileSync3(path, "utf8"), path);
+  return adminsCsv(readFileSync4(path, "utf8"), path);
 }
 
 // src/deploy/endpoint.ts
@@ -1416,7 +1424,7 @@ function composeRuntimeSecret(inputs) {
 import {
   lstatSync,
   mkdirSync as mkdirSync3,
-  readFileSync as readFileSync4,
+  readFileSync as readFileSync5,
   realpathSync,
   rmSync as rmSync2,
   statSync,
@@ -1536,9 +1544,9 @@ function stageCustomization(options) {
   const sourceFile = resolvedCustomizationFile(sourceRoot, customization.path);
   if (sourceFile === undefined)
     return migrationFallback(customization.required, log, platformConfigPath);
-  const yaml = readFileSync4(sourceFile);
+  const yaml = readFileSync5(sourceFile);
   const tenantConfig = parseInstanceConfig(yaml.toString("utf8"));
-  const platformConfig = parseInstanceConfig(readFileSync4(platformConfigPath, "utf8"));
+  const platformConfig = parseInstanceConfig(readFileSync5(platformConfigPath, "utf8"));
   if (tenantConfig.name !== instance.displayName)
     throw new Error("Customization config name must match the selected instance.");
   assertValidTenantJobs(tenantConfig);
@@ -1895,7 +1903,7 @@ async function deploy(ctx, opts) {
 import { createServer } from "node:http";
 
 // src/deploy/github-app-manifest.ts
-import { readFileSync as readFileSync5 } from "node:fs";
+import { readFileSync as readFileSync6 } from "node:fs";
 import { join as join6 } from "node:path";
 import { parse as parseYaml } from "yaml";
 var GITHUB_APP_MANIFEST_PATH = join6(PACKAGE_ASSETS, "github-app-manifest.yml");
@@ -1916,7 +1924,7 @@ function renderAppManifest(template, instance) {
   });
 }
 function loadAppManifest(instance, template) {
-  const text = template ?? readFileSync5(GITHUB_APP_MANIFEST_PATH, "utf8");
+  const text = template ?? readFileSync6(GITHUB_APP_MANIFEST_PATH, "utf8");
   const manifest = parseYaml(renderAppManifest(text, instance));
   if ("default_permissions" in manifest)
     throw new Error("app-manifest.yml: default_permissions are generated from the capability registry; remove them from the template");
@@ -2034,7 +2042,7 @@ async function githubAppCreate(options) {
 }
 
 // src/deploy/job-key.ts
-import { readFileSync as readFileSync6 } from "node:fs";
+import { readFileSync as readFileSync7 } from "node:fs";
 function jobWebhookOutputKey(jobId) {
   return `JobWebhookUrl${jobId.replace(/[^A-Za-z0-9]/g, "")}`;
 }
@@ -2042,7 +2050,7 @@ function jobsWebhookSecretName(secretPrefix) {
   return `${secretPrefix}/jobs/webhook`;
 }
 async function jobKey(ctx, jobId, options = {}) {
-  const config = parseInstanceConfig(readFileSync6(ctx.paths.configPath, "utf8"));
+  const config = parseInstanceConfig(readFileSync7(ctx.paths.configPath, "utf8"));
   const job = config.jobs.find((entry) => entry.id === jobId);
   if (job === undefined)
     throw new Error(`no job "${jobId}" in ${ctx.paths.configPath}`);
@@ -2108,11 +2116,11 @@ async function postDeploy(ctx, opts = {}) {
 }
 
 // src/deploy/setup.ts
-import { existsSync as existsSync5, readFileSync as readFileSync8 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync9 } from "node:fs";
 import { resolve as resolve5 } from "node:path";
 
 // src/deploy/slack-manifest.ts
-import { readFileSync as readFileSync7 } from "node:fs";
+import { readFileSync as readFileSync8 } from "node:fs";
 import { join as join7 } from "node:path";
 import { parse as parse2 } from "yaml";
 var SLACK_APP_MANIFEST_PATH = join7(PACKAGE_ASSETS, "slack-app-manifest.yml");
@@ -2151,7 +2159,7 @@ function buildSlackManifest(template, instance, env) {
   return manifest;
 }
 function slackManifestFor(instance, env) {
-  return buildSlackManifest(readFileSync7(SLACK_APP_MANIFEST_PATH, "utf8"), {
+  return buildSlackManifest(readFileSync8(SLACK_APP_MANIFEST_PATH, "utf8"), {
     displayName: instance.displayName,
     commandPrefix: slackCommandPrefix(instance),
     pages: instance.integrations.pages
@@ -2377,7 +2385,7 @@ async function writeRuntimeSecret(ctx) {
 async function seedCodex(ctx, codexFile) {
   if (!existsSync5(codexFile))
     throw new Error(`${codexFile} not found — sign in locally first, or pass --codex-file`);
-  const document = readFileSync8(codexFile, "utf8");
+  const document = readFileSync9(codexFile, "utf8");
   JSON.parse(document);
   await putSecretString(ctx, ctx.names.secretCodex, document);
   console.log(`  ${ctx.names.secretCodex} seeded from ${codexFile}`);
@@ -2555,6 +2563,7 @@ Done. Now say \`@${ctx.instance.displayName} hello\` in Slack.`);
 
 // src/deploy/cli.ts
 var COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -2567,6 +2576,10 @@ var COMMANDS = [
 var USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -2645,6 +2658,18 @@ async function main(argv2 = process.argv.slice(2)) {
 ${USAGE}`);
     return 1;
   }
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync10(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(`${paths.configPath} does not parse with this release (v${toolVersion()}):
+${error instanceof Error ? error.message : String(error)}`);
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
   if (command === "slack-manifest") {
     const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
     if (process.env.EVENTS_REQUEST_URL === undefined)

package/dist/bin/release-account.js

@@ -111,6 +111,11 @@ class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"]
             }),
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"]
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],

package/dist/{chunk-yn8x77x6.js → chunk-6f2hkamj.js}

@@ -24,7 +24,7 @@ import {
   scheduledJobBindings,
   slackCommandPrefixes,
   webhookJobBindings
-} from "./chunk-k6mcv6dk.js";
+} from "./chunk-gnz747z2.js";
 
 // src/stacks/agent-stack.ts
 import * as cdk from "aws-cdk-lib";
@@ -259,6 +259,12 @@ class FoundationAgent extends cdk.Stack {
           resource: "secret",
           resourceName: `${docsSecretPrefix}/personal/*-??????`,
           arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
+        }),
+        cdk.Stack.of(this).formatArn({
+          service: "secretsmanager",
+          resource: "secret",
+          resourceName: `${docsSecretPrefix}/personal-drive/*-??????`,
+          arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME
         })
       ]
     }));
@@ -382,6 +388,12 @@ class FoundationAgent extends cdk.Stack {
     this.denyDirectKnockSecretAccess(role, props);
     this.denyDirectEmailSecretAccess(role, props.secrets.googleEmail, instanceNames(props.instance).secretGoogleEmail);
     this.denyDirectDocsSecretAccess(role, instanceNames(props.instance).secretGoogleDocs);
+    role.addToPolicy(new iam.PolicyStatement({
+      sid: "DenySlackSigningSecret",
+      effect: iam.Effect.DENY,
+      actions: ["secretsmanager:*"],
+      resources: [secretArnPattern(props.secrets.signing)]
+    }));
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });
@@ -906,6 +918,14 @@ class FoundationApi extends cdk2.Stack {
         generateStringKey: "placeholder"
       }
     }));
+    for (const identity of docsIdentities.filter((entry) => entry.readPersonalDrive === true)) {
+      docsSecrets.push(new secretsmanager.Secret(this, `PersonalDriveSecret${identity.owner}`, {
+        secretName: `${instanceNames(props.instance).secretGoogleDocs}/personal-drive/${identity.owner}`,
+        description: `${display} separate read-only personal Drive grant for Slack ${identity.owner}`,
+        removalPolicy: cdk2.RemovalPolicy.DESTROY,
+        generateSecretString: { secretStringTemplate: "{}", generateStringKey: "placeholder" }
+      }));
+    }
     const gatewayRole = new iam2.Role(this, "GatewayRole", {
       assumedBy: new iam2.ServicePrincipal("lambda.amazonaws.com"),
       description: `${display} gateway Lambda role (least privilege)`,
@@ -1807,7 +1827,7 @@ function configTimezoneFor(configPath) {
 }
 function googleDocsIdentitiesFor(configPath) {
   const docs = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.googleDocs;
-  return docs.enabled ? docs.identities.map(({ address, channel, owner }) => ({ address, channel, owner })) : [];
+  return docs.enabled ? docs.identities.map((identity) => ({ ...identity })) : [];
 }
 function emailIdentitiesFor(configPath) {
   const email = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.email;

package/dist/{chunk-k6mcv6dk.js → chunk-gnz747z2.js}

@@ -369,7 +369,8 @@ var RawGoogleDriveCapability = z.object({
 var RawGoogleDocsIdentity = z.object({
   address: z.string().regex(/^[a-z0-9._%+-]+@[a-z0-9.-]+\.[a-z]{2,}$/i),
   channel: z.string().regex(/^[CGD][A-Z0-9]{8,}$/),
-  owner: z.string().regex(/^U[A-Z0-9]{8,}$/, "owner must be a Slack U id")
+  owner: z.string().regex(/^U[A-Z0-9]{8,}$/, "owner must be a Slack U id"),
+  readPersonalDrive: z.boolean().optional()
 }).strict();
 var RawGoogleDocsCapability = z.object({
   enabled: z.boolean().default(false),
@@ -384,6 +385,12 @@ var RawGoogleDocsCapability = z.object({
   for (const field of ["owner", "channel"]) {
     const seen = new Set;
     for (const [index, identity] of value.identities.entries()) {
+      if (field === "owner" && identity.readPersonalDrive && !identity.channel.startsWith("D"))
+        ctx.addIssue({
+          code: z.ZodIssueCode.custom,
+          path: ["identities", index, "channel"],
+          message: "personal Drive reading requires an owner-bound DM"
+        });
       if (seen.has(identity[field]))
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
@@ -675,13 +682,17 @@ var CAPABILITIES = [
   },
   {
     id: "googleDocs",
-    summary: "Draft Google Docs in a person's own Drive, by personal consent; it reaches only the Docs it created.",
+    summary: "Draft Google Docs by personal consent; optionally connect a separate read-only personal Drive grant in the owner's DM.",
     config: RawGoogleDocsCapability,
     ...NONE,
     secrets: ["google/docs", GOOGLE_OAUTH_SECRET],
     resources: ["googleDocsProxyFunctionName"],
-    slackCommands: ["docs-connect"],
-    googleScopes: ["https://www.googleapis.com/auth/drive.file", ...GOOGLE_IDENTITY_SCOPES]
+    slackCommands: ["docs-connect", "personal-drive"],
+    googleScopes: [
+      "https://www.googleapis.com/auth/drive.file",
+      "https://www.googleapis.com/auth/drive.readonly",
+      ...GOOGLE_IDENTITY_SCOPES
+    ]
   },
   {
     id: "googleCalendar",
@@ -1964,4 +1975,4 @@ function ecrRepositoryArn(repositoryUri) {
   return `arn:aws:ecr:${region}:${account}:repository/${name}`;
 }
 
-export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };
+export { parseSchedule, BASE_SLACK_EVENTS, CAPABILITY_IDS, requiredGithubPermissions, requiredSlackScopes, requiredSlackCommands, isScheduledJob, isWebhookJob, webhookJobBindings, scheduledJobBindings, jobWebhookKey, capabilityScheduledJobs, crmOutreachConfigured, crmPolicyFingerprint, parseInstanceConfig, encodeProactiveChannels, CUSTOMIZATION_ARTIFACT_NAME, newsletterManifestFor, FOUNDATION_VERSION_RE, versionedConfigKey, instanceNames, slackCommandPrefix, slackCommandPrefixes, loadInstanceFile, configPathFor, capabilityEnabled, requiresAuthenticatedQueue, enabledIntegrations, provisionsIntegration, adminsFor, WEB_SEARCH_TARGET, WEB_SEARCH_CONNECTOR_VERSION, LIVE_ENDPOINT_NAME, RELEASE_VERSION_RE, parseManifest, manifestKey, lambdaKey, skillsKey, buildManifest, manifestSigningPayload, verifyManifest, lambdaBundleContext, BUN_VERSION, LAMBDA_ENTRY_POINTS, skipBundle, RELEASE_BUCKET_ENV, RELEASE_DIR_ENV, releaseCacheDir, releaseSource, releaseAccess, lambdaCode, agentImage, agentImageTagRequired, releaseImageRepositoryArn, ecrRepositoryArn };

package/dist/src/index.js

@@ -10,7 +10,7 @@ import {
   FoundationPipeline,
   NewsletterStack,
   deployStatements
-} from "../chunk-yn8x77x6.js";
+} from "../chunk-6f2hkamj.js";
 import {
   BUN_VERSION,
   LAMBDA_ENTRY_POINTS,
@@ -44,7 +44,7 @@ import {
   skillsKey,
   skipBundle,
   verifyManifest
-} from "../chunk-k6mcv6dk.js";
+} from "../chunk-gnz747z2.js";
 import"../chunk-dz91avrb.js";
 export {
   BUILD_TIMEOUT,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@deployfoundation/foundation-deploy",
-  "version": "0.2.47",
+  "version": "0.2.49",
   "description": "Deploys one Foundation instance from a published, signed release: the CDK app and the deploy tool.",
   "license": "UNLICENSED",
   "private": false,

package/src/deploy/assets/slack-app-manifest.yml

@@ -73,6 +73,10 @@ features:
       url: ${COMMANDS_REQUEST_URL}
       description: Let ${DISPLAY_NAME} draft Google Docs in your own Drive
       should_escape: false
+    - command: /${COMMAND_PREFIX}-personal-drive
+      url: ${COMMANDS_REQUEST_URL}
+      description: Connect your personal Drive read-only in your configured DM
+      should_escape: false
     - command: /${COMMAND_PREFIX}-knock-connect
       url: ${COMMANDS_REQUEST_URL}
       description: Connect ${DISPLAY_NAME} to Knock read-only tools (admins)

package/src/deploy/cli.ts

@@ -11,6 +11,8 @@
  * tree into a deploy would make every release of the tool carry a model
  * runtime it never executes.
  */
+import { readFileSync } from "node:fs";
+import { parseInstanceConfig } from "@deployfoundation/foundation-core";
 import { type AwsContext, awsContext } from "./aws.ts";
 import { configSync } from "./config-sync.ts";
 import { deploy } from "./deploy.ts";
@@ -18,12 +20,13 @@ import { githubAppCreate } from "./github-app-create.ts";
 import { instanceBanner, loadInstanceContext, resolveInstanceFilePath } from "./instance.ts";
 import { jobKey } from "./job-key.ts";
 import { postDeploy } from "./post-deploy.ts";
-import { releaseRequest, resolveRelease } from "./release.ts";
+import { releaseRequest, resolveRelease, toolVersion } from "./release.ts";
 import { setup } from "./setup.ts";
 import { slackManifestFor } from "./slack-manifest.ts";
 import { stageCustomization } from "./stage-customization.ts";
 
 export const COMMANDS = [
+  "check",
   "deploy",
   "post-deploy",
   "config:sync",
@@ -39,6 +42,10 @@ export type Command = (typeof COMMANDS)[number];
 export const USAGE = `usage: foundation-deploy <command> --instance <path> [options]
 
 commands
+  check                parse the instance and config files with THIS release's
+                       schema; no AWS. Run it on config PRs with the pinned
+                       version: a config the deployed release rejects puts the
+                       teammate on the fallback config.
   deploy               build and push the agent image, cdk deploy --all, refresh
                        the runtime secret, sync config
   post-deploy          smoke DEFAULT, probe the mount, promote \`live\`, smoke \`live\`
@@ -120,6 +127,23 @@ export async function main(argv: readonly string[] = process.argv.slice(2)): Pro
     return 1;
   }
 
+  // `check` reads files only, so it runs in a pull request with no credentials.
+  if (command === "check") {
+    const paths = loadInstanceContext(resolveInstanceFilePath(args, process.env));
+    try {
+      parseInstanceConfig(readFileSync(paths.configPath, "utf8"));
+    } catch (error) {
+      console.error(
+        `${paths.configPath} does not parse with this release (v${toolVersion()}):\n${
+          error instanceof Error ? error.message : String(error)
+        }`,
+      );
+      return 1;
+    }
+    console.log(`${paths.configPath} parses with this release (v${toolVersion()})`);
+    return 0;
+  }
+
   // `slack-manifest` writes a machine-readable document to stdout and must not
   // print a banner into it; every other command announces its target first.
   if (command === "slack-manifest") {

package/src/deploy/config-sync.ts

@@ -17,9 +17,10 @@
  * checkout's `skills/` otherwise. A company's own skills are a source in its
  * runtime config (a GitHub repo), never a directory in this package.
  */
-import { existsSync, mkdirSync, mkdtempSync, readdirSync } from "node:fs";
+import { existsSync, mkdirSync, mkdtempSync, readFileSync, readdirSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join, resolve } from "node:path";
+import { parseInstanceConfig } from "@deployfoundation/foundation-core";
 import { versionedConfigKey } from "@deployfoundation/foundation-core/instance";
 import { skillsKey } from "../release/manifest.ts";
 import { type AwsContext, awsMutate, stackOutput } from "./aws.ts";
@@ -130,6 +131,19 @@ export async function uploadRuntimeConfig(
       "customized instances require a freshly validated runtimeConfigPath; run through `deploy` or `config:sync`",
     );
   const source = opts.runtimeConfigPath ?? ctx.paths.configPath;
+  // Parse with THIS release's schema before anything is written. Redeploying
+  // the live version writes the very object the live runtime reads, so an
+  // unparseable upload puts every session on the fallback config even though
+  // the deploy then fails at synth (Sky, 2026-10-19: no Upwork for a day).
+  try {
+    parseInstanceConfig(readFileSync(source, "utf8"));
+  } catch (error) {
+    throw new Error(
+      `config for ${opts.version} does not parse with this release's schema, so nothing was uploaded: ${
+        error instanceof Error ? error.message : String(error)
+      }`,
+    );
+  }
   const key = versionedConfigKey(ctx.names.configKey, opts.version);
   await awsMutate(ctx, ["s3", "cp", source, `s3://${opts.bucket}/${key}`]);
   return key;

package/src/deploy/deploy.ts

@@ -672,9 +672,11 @@ export async function deploy(ctx: AwsContext, opts: DeployOptions): Promise<void
 
   // The config of the version going in, written BEFORE `cdk deploy` creates
   // that version, so its pre-warmed containers boot with it rather than with
-  // the fallback. Nothing else reads this object: the version serving now
-  // reads its own, which this deploy never touches. A brand-new instance has
-  // no bucket yet; the config sync after `cdk deploy` covers it.
+  // the fallback. When the version going in is the one serving now (a config
+  // change on the same release), the live runtime reads this very object, so
+  // uploadRuntimeConfig parses it with this release's schema first and refuses
+  // rather than write a config the runtime would reject. A brand-new instance
+  // has no bucket yet; the config sync after `cdk deploy` covers it.
   const version = foundationVersion(release);
   const bucket = phase1
     ? undefined

package/src/stacks/agent-stack.ts

@@ -433,6 +433,12 @@ export class FoundationAgent extends cdk.Stack {
             resourceName: `${docsSecretPrefix}/personal/*-??????`,
             arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
           }),
+          cdk.Stack.of(this).formatArn({
+            service: "secretsmanager",
+            resource: "secret",
+            resourceName: `${docsSecretPrefix}/personal-drive/*-??????`,
+            arnFormat: cdk.ArnFormat.COLON_RESOURCE_NAME,
+          }),
         ],
       }),
     );
@@ -629,6 +635,14 @@ export class FoundationAgent extends cdk.Stack {
       namesFor(props.instance).secretGoogleEmail,
     );
     this.denyDirectDocsSecretAccess(role, namesFor(props.instance).secretGoogleDocs);
+    role.addToPolicy(
+      new iam.PolicyStatement({
+        sid: "DenySlackSigningSecret",
+        effect: iam.Effect.DENY,
+        actions: ["secretsmanager:*"],
+        resources: [secretArnPattern(props.secrets.signing)],
+      }),
+    );
     this.denyDirectUpworkApprovalAccess(role, props.upworkApprovalTable);
     this.denyDirectEtradeAccess(role, props);
     this.pagesPolicy("AgentReadOnlyPagesPolicy", role, props.instance, { invoke: false });

package/src/stacks/api-stack.ts

@@ -233,6 +233,16 @@ export class FoundationApi extends cdk.Stack {
           },
         }),
     );
+    for (const identity of docsIdentities.filter((entry) => entry.readPersonalDrive === true)) {
+      docsSecrets.push(
+        new secretsmanager.Secret(this, `PersonalDriveSecret${identity.owner}`, {
+          secretName: `${namesFor(props.instance).secretGoogleDocs}/personal-drive/${identity.owner}`,
+          description: `${display} separate read-only personal Drive grant for Slack ${identity.owner}`,
+          removalPolicy: cdk.RemovalPolicy.DESTROY,
+          generateSecretString: { secretStringTemplate: "{}", generateStringKey: "placeholder" },
+        }),
+      );
+    }
 
     const gatewayRole = new iam.Role(this, "GatewayRole", {
       assumedBy: new iam.ServicePrincipal("lambda.amazonaws.com"),
@@ -1495,9 +1505,7 @@ function configTimezoneFor(configPath: string): string {
 /** The Google Docs drafting identities to provision, read from the instance config at synth. */
 export function googleDocsIdentitiesFor(configPath: string): GoogleDocsIdentity[] {
   const docs = parseInstanceConfig(readFileSync(configPath, "utf8")).capabilities.googleDocs;
-  return docs.enabled
-    ? docs.identities.map(({ address, channel, owner }) => ({ address, channel, owner }))
-    : [];
+  return docs.enabled ? docs.identities.map((identity) => ({ ...identity })) : [];
 }
 
 export function emailIdentitiesFor(configPath: string): EmailIdentity[] {

package/src/stacks/release-account-stack.ts

@@ -208,6 +208,13 @@ export class ReleaseAccountStack extends cdk.Stack {
               actions: ["ecr:GetAuthorizationToken"],
               resources: ["*"],
             }),
+            // Pull-only login to public ECR. Anonymous base-image pulls share
+            // the hosted runners' quota and failed v0.2.48's build with 429.
+            new iam.PolicyStatement({
+              sid: "EcrPublicLogin",
+              actions: ["ecr-public:GetAuthorizationToken", "sts:GetServiceBearerToken"],
+              resources: ["*"],
+            }),
             new iam.PolicyStatement({
               sid: "SignManifest",
               actions: ["kms:Sign", "kms:GetPublicKey", "kms:DescribeKey"],