@edgehero/pi-dispatch-admin 1.2.0 → 1.3.0

package/dist/index.mjs

@@ -7611,7 +7611,7 @@ function isForgeKind(kind) {
 function forgeSpec(kind) {
   return isForgeKind(kind) ? FORGES[kind] : void 0;
 }
-var FORGES, FORGE_KINDS, RUN_KINDS, MINTED_TOKEN_VARS;
+var FORGES, FORGE_KINDS, RUN_KINDS, MINTED_TOKEN_VARS, FORGE_HOST_VARS;
 var init_forges = __esm({
   "../worker/src/forges.mjs"() {
     FORGES = {
@@ -7677,6 +7677,13 @@ var init_forges = __esm({
     FORGE_KINDS = Object.freeze(Object.keys(FORGES));
     RUN_KINDS = Object.freeze(["local", ...FORGE_KINDS]);
     MINTED_TOKEN_VARS = new Set(FORGE_KINDS.flatMap((kind) => FORGES[kind].tokenVars));
+    FORGE_HOST_VARS = new Set(FORGE_KINDS.map((kind) => FORGES[kind].hostVar).filter((name) => typeof name === "string"));
+  }
+});
+
+// ../worker/src/secret-profiles.mjs
+var init_secret_profiles = __esm({
+  "../worker/src/secret-profiles.mjs"() {
   }
 });
 
@@ -7701,13 +7708,16 @@ function defaultGraphDir(env = process.env) {
 function defaultSettingsFile() {
   return `${process.env.TMPDIR ?? process.env.TEMP ?? "/tmp"}/pi-dispatch/settings.json`.replace(/\\/g, "/");
 }
-var CHAIN_DEPTH_MAX_DEFAULT, CHAIN_MAX_PER_JOB_DEFAULT;
+var CHAIN_DEPTH_MAX_DEFAULT, CHAIN_MAX_PER_JOB_DEFAULT, WORKER_ONLY_SECRET_VARS, EGRESS_ENV_VARS;
 var init_config2 = __esm({
   "../worker/src/config.mjs"() {
     init_egress();
     init_forges();
+    init_secret_profiles();
     CHAIN_DEPTH_MAX_DEFAULT = 1;
     CHAIN_MAX_PER_JOB_DEFAULT = 2;
+    WORKER_ONLY_SECRET_VARS = /* @__PURE__ */ new Set(["GITHUB_APP_PRIVATE_KEY"]);
+    EGRESS_ENV_VARS = /* @__PURE__ */ new Set(["HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "NODE_USE_ENV_PROXY"]);
   }
 });
 
@@ -7752,6 +7762,21 @@ function validateOverlay(candidate, log) {
         if (!isIntInRange(value, 1, 10)) return { invalid: "concurrency must be an integer 1-10" };
         overlay[key] = value;
         break;
+      case "secretProfiles": {
+        if (value === null || typeof value !== "object" || Array.isArray(value)) {
+          return { invalid: "secretProfiles must be an object mapping profile names to resolver paths" };
+        }
+        for (const name of Object.keys(value)) {
+          if (!/^[A-Za-z0-9._-]+$/.test(name)) {
+            return { invalid: "secretProfiles names may use letters, digits, dot, dash and underscore only" };
+          }
+          if (typeof value[name] !== "string" || value[name].trim() === "") {
+            return { invalid: `secretProfiles.${name} must be a non-empty absolute path` };
+          }
+        }
+        overlay[key] = { ...value };
+        break;
+      }
       case "softHoldPct":
         if (!isIntInRange(value, 1, 99)) return { invalid: "softHoldPct must be an integer 1-99" };
         overlay[key] = value;
@@ -7861,6 +7886,29 @@ var init_budget = __esm({
   }
 });
 
+// ../worker/src/reserved-env.mjs
+var CONTAINER_ENV_NAMES;
+var init_reserved_env = __esm({
+  "../worker/src/reserved-env.mjs"() {
+    CONTAINER_ENV_NAMES = /* @__PURE__ */ new Set([
+      "PI_PROVIDER",
+      "PI_MODEL",
+      "PI_MAX_TURNS",
+      "PI_MAX_TOKENS",
+      "PI_JOB_ID",
+      "PI_GLOBAL_ALLOW_EXTENSIONS",
+      "PI_PACKAGES",
+      "PI_SESSION_FILE",
+      "PI_FLOW",
+      "PI_COMMAND",
+      "PI_OFFLINE",
+      "PLAYWRIGHT_BROWSERS_PATH",
+      "PLAYWRIGHT_MCP_BROWSER",
+      "PLAYWRIGHT_MCP_SANDBOX"
+    ]);
+  }
+});
+
 // ../worker/src/triggers.mjs
 function isNonEmptyString2(value) {
   return typeof value === "string" && value.trim() !== "";
@@ -7953,9 +8001,11 @@ function normalizeCron(on, run, index, path, state) {
   validateInstructions(run, `cron trigger "${id}"`, path, { cron: true });
   const resume = validateResumeFlag(run, `cron trigger "${id}"`, path);
   validateReplicas(run, `cron trigger "${id}"`, path);
+  const secrets = validateSecrets(run, `cron trigger "${id}"`, path);
+  const secretsProfile = validateSecretsProfile(run, `cron trigger "${id}"`, path);
   return {
     on: { type: "cron", id, pattern },
-    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir } }
+    run: { kind: "local", folder: run.folder, flow: run.flow, task: run.task, provider: run.provider, model: run.model, maxTurns: run.maxTurns, github: run.github, packages, image, resume, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
 }
 function validatePackagesFlag(run, at, path) {
@@ -8086,6 +8136,56 @@ function validateReplicas(run, at, path) {
   }
   return replicas;
 }
+function validateSecrets(run, at, path) {
+  const secrets = run.secrets;
+  if (secrets === void 0) return void 0;
+  if (secrets === null || typeof secrets !== "object" || Array.isArray(secrets)) {
+    throw configError(`${at}: run.secrets must be an object mapping environment variable names to references when present (got ${JSON.stringify(secrets)}): ${path}`);
+  }
+  const names = Object.keys(secrets);
+  if (names.length === 0) {
+    throw configError(`${at}: run.secrets is empty -- an empty map is a field that does nothing, and this trigger reads as though it binds a secret: ${path}`);
+  }
+  if (names.length > SECRETS_MAX) {
+    throw configError(`${at}: run.secrets names ${names.length} variables, over the ${SECRETS_MAX} cap -- each one is resolved before the container starts, holding a concurrency slot while it runs: ${path}`);
+  }
+  for (const name of names) {
+    if (!ENV_NAME.test(name)) {
+      throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is not an environment variable name (letters, digits and underscore, not starting with a digit): ${path}`);
+    }
+    if (RESERVED_ENV_NAMES.has(name)) {
+      throw configError(`${at}: run.secrets key ${JSON.stringify(name)} is a variable the worker sets itself -- the job container would receive the worker's value, not this trigger's, and the trigger would look like it worked: ${path}`);
+    }
+    const reference = secrets[name];
+    if (!isNonEmptyString2(reference)) {
+      throw configError(`${at}: run.secrets.${name} must be a non-empty string reference for your resolver to read (got ${JSON.stringify(reference)}): ${path}`);
+    }
+    if (reference !== reference.trim()) {
+      throw configError(`${at}: run.secrets.${name} must not have leading or trailing whitespace -- the file is the reviewed artifact and silently trimming it would make the file disagree with what the resolver is asked for: ${path}`);
+    }
+    if (reference.startsWith("-")) {
+      throw configError(`${at}: run.secrets.${name} must not start with "-" -- it is passed as the resolver's first argument, where a leading dash parses as a flag: ${path}`);
+    }
+  }
+  if (run.resume === true) {
+    throw configError(`${at}: run.secrets and run.resume cannot be combined -- a resumed job replays a transcript kept on host disk, and any command the agent ran that echoed a resolved value wrote it into that transcript, which is then prefilled into every later job on the same key: ${path}`);
+  }
+  return { ...secrets };
+}
+function validateSecretsProfile(run, at, path) {
+  const profile = run.secretsProfile;
+  if (profile === void 0) return void 0;
+  if (!isNonEmptyString2(profile)) {
+    throw configError(`${at}: run.secretsProfile must be a non-empty string naming one of the resolver profiles this deployment declares (got ${JSON.stringify(profile)}): ${path}`);
+  }
+  if (!ID_CHARSET.test(profile)) {
+    throw configError(`${at}: run.secretsProfile ${JSON.stringify(profile)} may use letters, digits, dot, dash and underscore only -- PI_SECRET_PROFILES is a comma-separated list of name:path pairs, so a name carrying either separator cannot be declared: ${path}`);
+  }
+  if (run.secrets === void 0) {
+    throw configError(`${at}: run.secretsProfile is set but run.secrets names nothing -- a profile that resolves no references is a field that does nothing: ${path}`);
+  }
+  return profile;
+}
 function normalizeLabel(on, run, index, path) {
   const at = `trigger at index ${index}`;
   const predicate = validatePredicate(on, index, path, true);
@@ -8100,9 +8200,11 @@ function normalizeLabel(on, run, index, path) {
   const resume = validateResumeFlag(run, at, path);
   const repository = validateRepository(run, "label", at, path);
   const replicas = validateReplicas(run, at, path);
+  const secrets = validateSecrets(run, at, path);
+  const secretsProfile = validateSecretsProfile(run, at, path);
   return {
     on: { type: "label", any: predicate.any, all: predicate.all, none: predicate.none },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
 }
 function normalizeComment(on, run, index, path, state) {
@@ -8125,9 +8227,11 @@ function normalizeComment(on, run, index, path, state) {
   const resume = validateResumeFlag(run, at, path);
   const repository = validateRepository(run, "comment", at, path);
   const replicas = validateReplicas(run, at, path);
+  const secrets = validateSecrets(run, at, path);
+  const secretsProfile = validateSecretsProfile(run, at, path);
   return {
     on: { type: "comment", phrase: on.phrase },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...repository !== void 0 && { repository }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
 }
 function normalizePullRequest(on, run, index, path) {
@@ -8161,6 +8265,8 @@ function normalizePullRequest(on, run, index, path) {
   const resume = validateResumeFlag(run, at, path);
   validateRepository(run, "pull_request", at, path);
   const replicas = validateReplicas(run, at, path);
+  const secrets = validateSecrets(run, at, path);
+  const secretsProfile = validateSecretsProfile(run, at, path);
   return {
     on: {
       type: "pull_request",
@@ -8172,7 +8278,7 @@ function normalizePullRequest(on, run, index, path) {
       all: predicate.all,
       none: predicate.none
     },
-    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions } }
+    run: { kind: run.kind, flow: run.flow, packages, image, resume, replicas, ...command !== void 0 && { command }, ...skillsDir !== void 0 && { skillsDir }, ...instructions !== void 0 && { instructions }, ...secrets !== void 0 && { secrets }, ...secretsProfile !== void 0 && { secretsProfile } }
   };
 }
 function validateReviewState(on, actions, run, at, path) {
@@ -8194,11 +8300,12 @@ function validateReviewState(on, actions, run, at, path) {
   }
   return [...on.reviewState];
 }
-var ON_TYPES, PR_ACTIONS, REVIEW_STATES, REVIEW_ACTION, ID_CHARSET, REPLICAS_MAX, INSTRUCTIONS_MAX;
+var ON_TYPES, PR_ACTIONS, REVIEW_STATES, REVIEW_ACTION, ID_CHARSET, REPLICAS_MAX, SECRETS_MAX, ENV_NAME, RESERVED_ENV_NAMES, INSTRUCTIONS_MAX;
 var init_triggers = __esm({
   "../worker/src/triggers.mjs"() {
     init_config2();
     init_forges();
+    init_reserved_env();
     ON_TYPES = /* @__PURE__ */ new Set(["cron", "label", "comment", "pull_request"]);
     PR_ACTIONS = {
       github: /* @__PURE__ */ new Set(["labeled", "opened", "synchronize", "reopened", "review_submitted"]),
@@ -8221,6 +8328,9 @@ var init_triggers = __esm({
     REVIEW_ACTION = "review_submitted";
     ID_CHARSET = /^[A-Za-z0-9._-]+$/;
     REPLICAS_MAX = 3;
+    SECRETS_MAX = 16;
+    ENV_NAME = /^[A-Za-z_][A-Za-z0-9_]*$/;
+    RESERVED_ENV_NAMES = /* @__PURE__ */ new Set([...MINTED_TOKEN_VARS, ...FORGE_HOST_VARS, ...WORKER_ONLY_SECRET_VARS, ...EGRESS_ENV_VARS, ...CONTAINER_ENV_NAMES]);
     INSTRUCTIONS_MAX = 2e3;
   }
 });
@@ -8553,7 +8663,7 @@ import { Queue } from "bullmq";
 function makeQueue(connection) {
   return new Queue(QUEUE, { connection });
 }
-async function enqueueLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, image, skillsDir, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
+async function enqueueLocalJob(queue, { folder, flow, task, command, provider, model, maxTurns, image, skillsDir, secrets, secretsProfile, chainDepth, parentJobId, jobId, now = /* @__PURE__ */ new Date() }) {
   const minute = now.toISOString().slice(0, 16);
   const id = jobId ?? localJobId({ folder, flow: command !== void 0 ? `cmd:${command}` : flow, task, minute });
   const data = {
@@ -8574,6 +8684,11 @@ async function enqueueLocalJob(queue, { folder, flow, task, command, provider, m
     // than inside `trigger` because a worker-host path is an execution knob, not a fact about the
     // delivery -- and `trigger` is the object copied into /job/event.json.
     ...skillsDir !== void 0 && { skillsDir },
+    // REQ-TRIGGER-SECRETS, on the forge path's terms: references only, resolved by the worker at job
+    // start. A cron trigger may bind secrets (a nightly deploy is the obvious user), which is where
+    // this differs from `replicas` -- that one is refused on a local job and this one is not.
+    ...secrets !== void 0 && { secrets },
+    ...secretsProfile !== void 0 && { secretsProfile },
     ...chainDepth !== void 0 && { chainDepth },
     ...parentJobId !== void 0 && { parentJobId }
   };
@@ -10393,6 +10508,8 @@ function normalizeTriggerForDisplay(entry) {
   const resume = run.resume === true;
   const forge = typeof run.kind === "string" && run.kind.trim() !== "" ? run.kind : null;
   const replicas = Number.isInteger(run.replicas) && run.replicas > 1 ? run.replicas : null;
+  const secrets = run.secrets !== null && typeof run.secrets === "object" && !Array.isArray(run.secrets) ? Object.keys(run.secrets).length : 0;
+  const secretsProfile = typeof run.secretsProfile === "string" && run.secretsProfile.trim() !== "" ? run.secretsProfile : null;
   switch (on.type) {
     case "cron":
       return {
@@ -10409,12 +10526,14 @@ function normalizeTriggerForDisplay(entry) {
         image,
         skillsDir,
         instructions,
-        resume
+        resume,
+        secrets,
+        secretsProfile
       };
     case "label":
-      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, command, packages, image, skillsDir, instructions, resume, replicas, forge };
+      return { type: "label", any: normalizeSelector(on.any), all: normalizeSelector(on.all), none: normalizeSelector(on.none), flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
     case "comment":
-      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, command, packages, image, skillsDir, instructions, resume, replicas, forge };
+      return { type: "comment", phrase: typeof on.phrase === "string" ? on.phrase : null, flow, command, packages, image, skillsDir, instructions, resume, secrets, secretsProfile, replicas, forge };
     case "pull_request":
       return {
         type: "pull_request",
@@ -10429,6 +10548,8 @@ function normalizeTriggerForDisplay(entry) {
         skillsDir,
         instructions,
         resume,
+        secrets,
+        secretsProfile,
         replicas,
         forge
       };
@@ -38917,17 +39038,18 @@ function triggerLine(t) {
   const ins = t?.instructions === true ? "  [instructions]" : "";
   const res = t?.resume === true ? "  [resume]" : "";
   const rep = t?.replicas > 1 ? `  [x${t.replicas}]` : "";
+  const sec = t?.secrets > 0 ? `  [secrets ${t.secrets}${t.secretsProfile ? ` via ${t.secretsProfile}` : ""}]` : "";
   switch (t?.type) {
     case "cron":
-      return `cron  ${t.id ?? "-"}  ${t.pattern ?? "-"} \u2192 ${t.folder ?? "-"}/${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}`;
+      return `cron  ${t.id ?? "-"}  ${t.pattern ?? "-"} \u2192 ${t.folder ?? "-"}/${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
     case "label":
-      return `label  ${ruleClauses(t) || "(no selector)"} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}`;
+      return `label  ${ruleClauses(t) || "(no selector)"} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
     case "comment":
-      return `comment  "${t.phrase ?? "-"}" \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}`;
+      return `comment  "${t.phrase ?? "-"}" \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
     case "pull_request": {
       const clauses = ruleClauses(t);
       const action = `action[${(t.action ?? []).join(",")}]`;
-      return `pull_request  ${action}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}`;
+      return `pull_request  ${action}${clauses ? ` ${clauses}` : ""} \u2192 ${flow}${forge}${pkgs}${img}${skl}${ins}${res}${rep}${sec}`;
     }
     default:
       return "(unknown trigger)";
@@ -40038,6 +40160,12 @@ function renderTriggerDetail(t, inner, styler, sched = null, staged = null) {
     keeps("issue text, file contents, tool output, the agent's own reasoning");
     keeps("replayed into the next job on the same branch; forks never resume");
   }
+  if (t.secrets > 0) {
+    const holds = (text) => out.push(fitLine(styler.fg("border", "\xB7 ") + styler.fg("warning", text), inner, styler));
+    holds(`${t.secrets} vault secret(s) injected${t.secretsProfile ? ` via profile ${t.secretsProfile}` : ""}`);
+    holds("resolved on the host before the container; the job holds no vault credential");
+    holds("the agent can read them, and the forge is on the egress allowlist");
+  }
   if (t.replicas > 1) {
     const races = (text) => out.push(fitLine(styler.fg("border", "\xB7 ") + styler.fg("warning", text), inner, styler));
     races(`each delivery starts ${t.replicas} independent jobs`);
@@ -40867,8 +40995,8 @@ var init_setup_wizard = __esm({
     init_deployment_pointer();
     init_read_model();
     init_index();
-    RUNTIME_VERSION = "1.2.0";
-    RECEIVER_VERSION = "1.1.0";
+    RUNTIME_VERSION = "1.3.0";
+    RECEIVER_VERSION = "1.2.0";
     RUNTIME_PKG = "@edgehero/pi-dispatch";
     RECEIVER_PKG = "@edgehero/pi-dispatch-receiver";
     NUDGE_MARKER_BASENAME = "pi-dispatch-setup.nudged";
@@ -40883,6 +41011,104 @@ var init_setup_wizard = __esm({
   }
 });
 
+// src/secrets-command.ts
+var secrets_command_exports = {};
+__export(secrets_command_exports, {
+  runSecretsCommand: () => runSecretsCommand
+});
+function renderProfiles(profiles) {
+  const names = Object.keys(profiles).sort();
+  if (names.length === 0) return "No resolver profiles are declared in the settings overlay.";
+  return ["Resolver profiles (settings overlay):", ...names.map((n) => `  ${n} -> ${profiles[n]}`)].join("\n");
+}
+async function runSecretsCommand(paths, ctx, notify, tokens, deps = {}) {
+  const ui = ctx?.ui;
+  const fsSeam = deps.fs ? { fs: deps.fs } : {};
+  const view = readSettingsView({ settingsFile: paths.settingsFile, ...fsSeam });
+  if (view.invalid) {
+    notify?.(`settings overlay is unreadable (${view.invalid}) \u2014 fix it before declaring a profile`, "error");
+    return;
+  }
+  const profiles = { ...view.overlay?.secretProfiles ?? {} };
+  const action = tokens[0] ?? "list";
+  if (action === "list") {
+    notify?.(renderProfiles(profiles), "info");
+    return;
+  }
+  if (typeof ui?.input !== "function" || typeof ui?.confirm !== "function") {
+    notify?.("declaring a profile needs dialogs (newer pi) \u2014 no input/confirm available", "warning");
+    return;
+  }
+  if (action === "add") {
+    const nameAnswer = await ui.input("profile name \u2014 what a trigger's run.secretsProfile will say (e.g. prod)", "default");
+    const name = (nameAnswer ?? "").trim();
+    if (name === "") return;
+    if (!PROFILE_NAME.test(name)) {
+      notify?.("a profile name may use letters, digits, dot, dash and underscore only \u2014 PI_SECRET_PROFILES is a comma-separated list of name:path pairs", "error");
+      return;
+    }
+    const pathAnswer = await ui.input("resolver \u2014 ABSOLUTE path to the script that reads one reference", "/opt/pi/resolve.sh");
+    const path = (pathAnswer ?? "").trim();
+    if (path === "") return;
+    if (!(path.startsWith("/") || /^([A-Za-z]:[\\/]|\\\\)/.test(path))) {
+      notify?.("the resolver needs an ABSOLUTE path: a service manager's working directory is not your shell's", "error");
+      return;
+    }
+    const replacing = profiles[name] ? `
+
+This REPLACES the current ${name} -> ${profiles[name]}` : "";
+    const ok = await ui.confirm(
+      "Declare a secret resolver",
+      `${paths.settingsFile} gets:
+${JSON.stringify({ secretProfiles: { ...profiles, [name]: path } }, null, 2)}${replacing}
+
+The worker EXECUTES this script, as the account it runs as, once per reference. It must also sit inside PI_SECRET_RESOLVER_ROOTS or the worker will refuse it.`
+    );
+    if (!ok) {
+      notify?.("not declared", "info");
+      return;
+    }
+    const res = writeSettings({ settingsFile: paths.settingsFile, mutate: (o) => ({ ...o, secretProfiles: { ...profiles, [name]: path } }), ...fsSeam });
+    if (res.invalid) {
+      notify?.(`rejected: ${res.invalid}`, "error");
+      return;
+    }
+    notify?.(`declared ${name} -> ${path}. A trigger reaches it with "secretsProfile": "${name}" beside its "secrets" map, which is an edit to triggers.json.`, "info");
+    return;
+  }
+  if (action === "remove") {
+    const name = (tokens[1] ?? "").trim();
+    if (!name || !(name in profiles)) {
+      notify?.(`no such profile. ${renderProfiles(profiles)}`, "warning");
+      return;
+    }
+    const ok = await ui.confirm("Remove a secret resolver", `${name} -> ${profiles[name]}
+
+Every trigger naming it refuses PRE-SPEND after this, rather than running without its secrets.`);
+    if (!ok) {
+      notify?.("not removed", "info");
+      return;
+    }
+    const next = { ...profiles };
+    delete next[name];
+    const res = writeSettings({ settingsFile: paths.settingsFile, mutate: (o) => ({ ...o, secretProfiles: next }), ...fsSeam });
+    if (res.invalid) {
+      notify?.(`rejected: ${res.invalid}`, "error");
+      return;
+    }
+    notify?.(`removed ${name}`, "info");
+    return;
+  }
+  notify?.("usage: /dispatch secrets <list|add|remove <name>>", "warning");
+}
+var PROFILE_NAME;
+var init_secrets_command = __esm({
+  "src/secrets-command.ts"() {
+    init_read_model();
+    PROFILE_NAME = /^[A-Za-z0-9._-]+$/;
+  }
+});
+
 // src/index.ts
 import { VERSION } from "@earendil-works/pi-coding-agent";
 import { fileURLToPath as fileURLToPath2, pathToFileURL } from "node:url";
@@ -41458,6 +41684,11 @@ ${renderBudget({ budget, settings: settings2 })}`);
       applyUnset(paths.settingsFile, tokens, notify);
       return;
     }
+    case "secrets": {
+      const { runSecretsCommand: runSecretsCommand2 } = await Promise.resolve().then(() => (init_secrets_command(), secrets_command_exports));
+      await runSecretsCommand2(paths, ctx, notify, tokens.slice(1));
+      return;
+    }
     case "setup": {
       const { runSetupWizard: runSetupWizard2 } = await Promise.resolve().then(() => (init_setup_wizard(), setup_wizard_exports));
       await runSetupWizard2(paths, ctx, notify, { openDashboardFn: openDashboard });
@@ -42063,7 +42294,7 @@ var init_index = __esm({
     runtimeSkewNoticed = false;
     CHANNEL = "pi-dispatch-admin";
     REBUILT_NOTICE = (reason) => `replaced invalid settings file (${reason}) \u2014 other keys were lost`;
-    USAGE = "usage: /dispatch <status|pause|resume|run|runs|logs|budget|insights|triggers|settings|set|unset|setup>";
+    USAGE = "usage: /dispatch <status|pause|resume|run|runs|logs|budget|insights|triggers|settings|set|unset|setup|secrets>";
     KNOWN_SUBCOMMANDS = [
       "status",
       "pause",
@@ -42077,7 +42308,8 @@ var init_index = __esm({
       "settings",
       "set",
       "unset",
-      "setup"
+      "setup",
+      "secrets"
     ];
     FORGE_PROMPT = "forge \u2014 github, gitlab, forgejo or azure";
     PR_ACTION_VOCAB = {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@edgehero/pi-dispatch-admin",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Operator console (a pi extension) + skill for pi-dispatch: run the pi coding agent as a self-hosted service. A /dispatch TUI for the queue, spend caps, run history, editable GitHub, GitLab, Forgejo and Azure DevOps triggers (cron/label/comment/PR/MR/work item), and scheduled pause windows — plus AI-operable, human-confirmed controls. Runs against a live pi-dispatch deployment.",
   "keywords": [
     "pi-package",

package/skills/operate-pi-dispatch/SKILL.md

@@ -120,6 +120,36 @@ cannot, and that it is an edit they make to `triggers.json` themselves.** Do not
 built or pulled on the worker's own host, because jobs run with `--pull=never` and nothing is fetched at
 job time; and `pi-dispatch doctor` lists every image their triggers name and flags one that is missing.
 
+## Vault secrets — `run.secrets`, and why you cannot set it
+
+A trigger may carry `run.secrets`: a map of environment variable name to an opaque **reference**, plus
+`run.secretsProfile` naming which of the operator's resolvers reads them. Before the container starts, the
+worker runs that resolver once per reference on the HOST and injects the values into the job's environment.
+It exists so one trigger can hold a deploy key while every other job on the deployment holds none.
+
+Report it when asked, and be precise about the shape of the trade. **The job holds no vault credential.** It
+receives values, never the thing that can fetch values, so it cannot enumerate the vault or reach anything
+the operator did not name in a reviewed file. What that does *not* do is bound where a value can go once the
+agent has it: the agent can read its own environment, and the forge is on the egress allowlist by necessity.
+The panel shows the count and the profile name in the trigger list and in the drill-in, never the references.
+
+**You cannot set it, in either direction.** No `dispatch_*` tool has a `secrets` parameter, and none has a
+`secretsProfile` parameter either. The second absence is worth understanding rather than treating as an
+oversight: a profile that resolves nothing is refused at load, and no tool can write `run.secrets`, so a
+profile picker could never produce a valid trigger even once. It would be a control that looks like a grant
+and is only ever an error.
+
+You also cannot declare a **resolver profile**. That is `/dispatch secrets add`, which the operator types
+themselves, because declaring one means naming an absolute host path the worker executes.
+
+So if a user asks you to give a trigger access to a vault, or to wire up 1Password: **say plainly that you
+cannot, and that both halves are theirs.** Three useful things you *can* say: declaring the manager is
+`/dispatch secrets add`, and it is two questions (a name and the path to a one-line script such as
+`exec op read --no-newline "$1"`); binding it to a trigger is an edit to `triggers.json` beside that
+trigger's `flow`; and `pi-dispatch doctor` lists every declared profile, fails loudly when a trigger names
+one that is not declared, and warns when a **local** trigger binds secrets, because a local job edits the
+operator's own folder in place and a credential the agent writes into `.env` lands in their real repository.
+
 ## The forge a trigger listens to — `run.kind`
 
 A webhook trigger names its forge: `"kind"` is `github`, `gitlab`, `forgejo` or `azure`. Everything else