@geekbeer/minion 3.53.1 → 3.57.0

package/core/db/migrations/20260510100000_secrets_workspace.js

@@ -0,0 +1,36 @@
+/**
+ * Move minion secrets from `.env.secrets` (flat file) into SQLite with
+ * workspace scoping.
+ *
+ * Design:
+ * - PRIMARY KEY (workspace_id, key); workspace_id='' is the minion-wide bucket.
+ * - Same key can exist at multiple scopes; at execution time the runner merges
+ *   minion-wide + current-workspace secrets, with the WS-scoped value winning.
+ * - The actual data migration from `.env.secrets` is performed by
+ *   variable-store at server start (it needs filesystem access which sits
+ *   outside the DB transaction). See `migrateLegacySecretsFile()`.
+ *
+ * Secrets stay minion-local — they are NEVER persisted in HQ DB, by design.
+ * HQ→minion APIs only pass values through to the minion's local store.
+ */
+
+module.exports = {
+  version: 9,
+  name: 'secrets_workspace',
+
+  up(db, { tableExists }) {
+    if (tableExists(db, 'secrets')) return
+
+    db.exec(`
+      CREATE TABLE secrets (
+        workspace_id TEXT NOT NULL DEFAULT '',
+        key TEXT NOT NULL,
+        value TEXT NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (workspace_id, key)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_secrets_workspace ON secrets(workspace_id);
+    `)
+  },
+}

package/core/db/migrations/20260511100000_variables_workspace.js

@@ -0,0 +1,37 @@
+/**
+ * Move minion variables from `.env.variables` (flat file) into SQLite with
+ * workspace scoping — mirrors the secrets workspace migration.
+ *
+ * Design:
+ * - PRIMARY KEY (workspace_id, key); workspace_id='' is the minion-wide bucket.
+ * - Same key can exist at multiple scopes; at execution time the
+ *   template-expander merges minion-wide + current-workspace variables, with
+ *   the WS-scoped value winning.
+ * - Variables are non-sensitive — values are returned by the API (unlike
+ *   secrets) — but they still benefit from scoping so a single minion serving
+ *   multiple workspaces doesn't leak per-tenant config across runs.
+ * - Actual data migration from `.env.variables` is performed by variable-store
+ *   at first use (filesystem access lives outside this transaction). See
+ *   `migrateLegacyVariablesFile()`.
+ */
+
+module.exports = {
+  version: 10,
+  name: 'variables_workspace',
+
+  up(db, { tableExists }) {
+    if (tableExists(db, 'variables')) return
+
+    db.exec(`
+      CREATE TABLE variables (
+        workspace_id TEXT NOT NULL DEFAULT '',
+        key TEXT NOT NULL,
+        value TEXT NOT NULL,
+        updated_at INTEGER NOT NULL,
+        PRIMARY KEY (workspace_id, key)
+      );
+
+      CREATE INDEX IF NOT EXISTS idx_variables_workspace ON variables(workspace_id);
+    `)
+  },
+}

package/core/lib/dag-step-poller.js

@@ -119,12 +119,15 @@ async function pollOnce() {
 
 /**
  * Execute a single pending DAG node.
- * Routes to skill or transform execution based on node_type.
+ * Routes to skill / transform / script execution based on node_type.
  */
 async function executeNode(node) {
   if (node.node_type === 'transform') {
     return executeTransformNode(node)
   }
+  if (node.node_type === 'script') {
+    return executeScriptNode(node)
+  }
   return executeSkillNode(node)
 }
 
@@ -467,6 +470,247 @@ function appendContractTable(lines, fields) {
   }
 }
 
+/**
+ * Execute a script node:
+ * 1. Claim the node
+ * 2. Spawn python3 / node as a child process
+ * 3. Pipe input_data as JSON on stdin
+ * 4. Parse stdout as JSON → output_data, report completion
+ *
+ * Failure modes (all → status 'failed'):
+ * - Unsupported runtime
+ * - Non-zero exit code (stderr → error_message)
+ * - stdout is not parseable as JSON
+ * - Wall-clock timeout exceeded (process is SIGKILL'd)
+ *
+ * No tmux session is involved — this is a synchronous in-process child.
+ * The Output Contract on the outgoing edge is enforced by HQ on
+ * /node-complete, identical to skill / transform nodes.
+ */
+async function executeScriptNode(node) {
+  const {
+    node_execution_id,
+    node_id,
+    dag_workflow_name,
+    scope_path,
+    assigned_role,
+    input_data,
+    script_runtime,
+    script_source,
+    script_timeout_seconds,
+  } = node
+
+  console.log(
+    `[DagPoller] Executing script node "${node_id}" of DAG "${dag_workflow_name}" ` +
+    `(runtime: ${script_runtime}, scope: "${scope_path || 'root'}", role: ${assigned_role})`
+  )
+
+  try {
+    try {
+      await dagRequest('/claim-node', {
+        method: 'POST',
+        body: JSON.stringify({ node_execution_id }),
+      })
+    } catch (claimErr) {
+      if (claimErr.statusCode === 409) {
+        console.log(`[DagPoller] Script node ${node_id} already claimed, skipping`)
+        return
+      }
+      throw claimErr
+    }
+
+    if (!script_source || !script_source.trim()) {
+      await reportNodeComplete(node_execution_id, 'failed', null, 'Script node has empty script_source')
+      return
+    }
+
+    let interpreter
+    if (script_runtime === 'python') {
+      interpreter = 'python3'
+    } else if (script_runtime === 'node') {
+      interpreter = 'node'
+    } else {
+      await reportNodeComplete(
+        node_execution_id,
+        'failed',
+        null,
+        `Unsupported script_runtime: ${script_runtime} (allowed: python, node)`,
+      )
+      return
+    }
+
+    const timeoutMs = clampTimeout(script_timeout_seconds) * 1000
+
+    const result = await runScriptProcess(interpreter, script_source, input_data || {}, timeoutMs)
+
+    if (result.timedOut) {
+      await reportNodeComplete(
+        node_execution_id,
+        'failed',
+        null,
+        `Script timed out after ${timeoutMs / 1000}s. stderr: ${truncate(result.stderr, 2000)}`,
+      )
+      return
+    }
+
+    if (result.exitCode !== 0) {
+      await reportNodeComplete(
+        node_execution_id,
+        'failed',
+        null,
+        `Script exited with code ${result.exitCode}. stderr: ${truncate(result.stderr, 2000)}`,
+      )
+      return
+    }
+
+    let outputData
+    try {
+      outputData = JSON.parse(result.stdout)
+    } catch (parseErr) {
+      await reportNodeComplete(
+        node_execution_id,
+        'failed',
+        null,
+        `Script stdout is not valid JSON: ${parseErr.message}. stdout (first 500 chars): ${truncate(result.stdout, 500)}`,
+      )
+      return
+    }
+
+    if (typeof outputData !== 'object' || outputData === null || Array.isArray(outputData)) {
+      await reportNodeComplete(
+        node_execution_id,
+        'failed',
+        null,
+        `Script output_data must be a JSON object (got ${Array.isArray(outputData) ? 'array' : typeof outputData})`,
+      )
+      return
+    }
+
+    await reportNodeComplete(
+      node_execution_id,
+      'completed',
+      outputData,
+      buildScriptSummary(outputData, result.stderr),
+    )
+    console.log(`[DagPoller] Script node "${node_id}" completed`)
+
+  } catch (err) {
+    console.error(`[DagPoller] Failed to execute script node ${node_id}: ${err.message}`)
+    try {
+      await reportNodeComplete(node_execution_id, 'failed', null, err.message)
+    } catch {
+      // best-effort
+    }
+  }
+}
+
+/**
+ * Build the output_summary text shown in the HQ execution detail UI for a
+ * successful script node. The UI renders output_summary as a collapsible
+ * code block under "Output"; output_data itself is only visible from the
+ * Pin-fixture dialog. Always emit at least the JSON output so users can
+ * inspect what the script returned without round-tripping through fixtures.
+ */
+function buildScriptSummary(outputData, stderr) {
+  const lines = []
+  let serialized
+  try {
+    serialized = JSON.stringify(outputData, null, 2)
+  } catch {
+    serialized = '(failed to serialize output_data)'
+  }
+  lines.push('output_data:')
+  lines.push('```json')
+  lines.push(truncate(serialized, 8000))
+  lines.push('```')
+  if (stderr && stderr.trim()) {
+    lines.push('')
+    lines.push('stderr:')
+    lines.push(truncate(stderr, 2000))
+  }
+  return lines.join('\n')
+}
+
+function clampTimeout(seconds) {
+  const n = typeof seconds === 'number' && Number.isFinite(seconds) ? seconds : 60
+  if (n < 1) return 1
+  if (n > 600) return 600
+  return Math.floor(n)
+}
+
+function truncate(str, max) {
+  if (!str) return ''
+  return str.length > max ? str.slice(0, max) + '…(truncated)' : str
+}
+
+/**
+ * Spawn the interpreter, write the script to stdin via `-` / `-c` is not
+ * portable (python requires `-`, node requires `-e` with the source as an
+ * argument and no stdin). Instead we feed the script via stdin for both:
+ * - python3 reads source from stdin when invoked with `-`
+ * - node reads source from stdin when invoked with no args, but stdin is
+ *   then consumed by the script — so for node we must use `-e` with the
+ *   source as a flag value. To keep input_data on stdin for both, we
+ *   write the script to a temp file and pass the path as argv[1].
+ */
+function runScriptProcess(interpreter, source, inputData, timeoutMs) {
+  const { spawn } = require('child_process')
+  const fs = require('fs')
+  const os = require('os')
+  const path = require('path')
+  const crypto = require('crypto')
+
+  const ext = interpreter === 'python3' ? 'py' : 'js'
+  const tmpFile = path.join(
+    os.tmpdir(),
+    `dag-script-${crypto.randomBytes(8).toString('hex')}.${ext}`,
+  )
+  fs.writeFileSync(tmpFile, source, 'utf-8')
+
+  return new Promise(resolve => {
+    const child = spawn(interpreter, [tmpFile], {
+      stdio: ['pipe', 'pipe', 'pipe'],
+    })
+
+    let stdout = ''
+    let stderr = ''
+    let timedOut = false
+    let killed = false
+
+    const timer = setTimeout(() => {
+      timedOut = true
+      killed = true
+      try { child.kill('SIGKILL') } catch { /* noop */ }
+    }, timeoutMs)
+
+    child.stdout.on('data', chunk => { stdout += chunk.toString('utf-8') })
+    child.stderr.on('data', chunk => { stderr += chunk.toString('utf-8') })
+
+    child.on('error', err => {
+      clearTimeout(timer)
+      cleanup(tmpFile)
+      resolve({ exitCode: -1, stdout, stderr: stderr + `\nspawn error: ${err.message}`, timedOut })
+    })
+
+    child.on('close', code => {
+      clearTimeout(timer)
+      cleanup(tmpFile)
+      resolve({ exitCode: killed ? -1 : (code ?? -1), stdout, stderr, timedOut })
+    })
+
+    try {
+      child.stdin.write(JSON.stringify(inputData))
+      child.stdin.end()
+    } catch (writeErr) {
+      stderr += `\nstdin write error: ${writeErr.message}`
+    }
+  })
+}
+
+function cleanup(tmpFile) {
+  try { require('fs').unlinkSync(tmpFile) } catch { /* noop */ }
+}
+
 /**
  * Resolve skill_version_id to skill name via HQ API.
  */

package/core/lib/session-env.js

@@ -0,0 +1,96 @@
+/**
+ * Session environment builder
+ *
+ * Builds workspace-scoped environment variable injection for runners.
+ * Resolves minion-wide + workspace-scoped secrets, and exposes both
+ * `tmux -e` flags (Linux/macOS) and a node-pty env object (Windows).
+ *
+ * Why this exists:
+ *   Before this module, all secrets were loaded once into `process.env`
+ *   at server start and inherited by every child process — fine for a
+ *   single-workspace minion but a leakage path for multi-workspace
+ *   setups. Each runner now passes the effective env explicitly for the
+ *   workspace it is running on; workspace-scoped values override
+ *   minion-wide ones at this layer.
+ */
+
+const variableStore = require('../stores/variable-store')
+
+/**
+ * Shell-escape a value for a `KEY=VALUE` argument passed via `-e` to tmux.
+ * We use single-quote wrapping; the surrounding shell sees one literal arg.
+ * @param {string} s
+ * @returns {string}
+ */
+function singleQuote(s) {
+  return "'" + String(s).replace(/'/g, "'\\''") + "'"
+}
+
+/**
+ * Build an array of `-e 'KEY=VALUE'` shell-safe flags for tmux new-session.
+ *
+ * @param {string|null|undefined} workspaceId - The session's workspace scope
+ * @param {Record<string,string>} [extraEnv] - Per-execution identifiers (e.g.
+ *   MINION_EXECUTION_ID). Layered on top so they always win.
+ * @returns {string[]} List of `-e <quoted>` fragments to splice into a shell command
+ */
+function buildTmuxEnvFlags(workspaceId, extraEnv = {}) {
+  const merged = { ...variableStore.getEffectiveSecrets(workspaceId), ...extraEnv }
+  const flags = []
+  for (const [k, v] of Object.entries(merged)) {
+    if (v == null) continue
+    flags.push(`-e ${singleQuote(`${k}=${v}`)}`)
+  }
+  return flags
+}
+
+/**
+ * Build a `tmux new-session` invocation line including all secret env vars.
+ *
+ * Caller typically does:
+ *   `${buildTmuxNewSessionCommand({sessionName, workspaceId, extraEnv, width, height})}`
+ *
+ * The session is created detached (`-d`) with no command so we can configure
+ * `remain-on-exit` and `pipe-pane` before injecting the real workload via
+ * `send-keys`.
+ *
+ * @param {object} opts
+ * @param {string} opts.sessionName
+ * @param {string|null|undefined} opts.workspaceId
+ * @param {Record<string,string>} [opts.extraEnv]
+ * @param {number} [opts.width]
+ * @param {number} [opts.height]
+ * @returns {string}
+ */
+function buildTmuxNewSessionCommand({ sessionName, workspaceId, extraEnv = {}, width = 200, height = 50 }) {
+  const envFlags = buildTmuxEnvFlags(workspaceId, extraEnv)
+  return [
+    'tmux new-session -d',
+    `-s "${sessionName}"`,
+    `-x ${width} -y ${height}`,
+    ...envFlags,
+  ].join(' ')
+}
+
+/**
+ * Build an env object for node-pty / child_process.spawn that contains the
+ * caller's `process.env` plus the workspace-effective secrets and any extra
+ * per-execution identifiers (extraEnv wins last).
+ *
+ * @param {string|null|undefined} workspaceId
+ * @param {Record<string,string>} [extraEnv]
+ * @returns {Record<string,string>}
+ */
+function buildSpawnEnv(workspaceId, extraEnv = {}) {
+  return {
+    ...process.env,
+    ...variableStore.getEffectiveSecrets(workspaceId),
+    ...extraEnv,
+  }
+}
+
+module.exports = {
+  buildTmuxEnvFlags,
+  buildTmuxNewSessionCommand,
+  buildSpawnEnv,
+}

package/core/lib/step-poller.js

@@ -104,6 +104,7 @@ async function executeStep(step) {
     skill_name,
     revision_feedback,
     template_vars,
+    workspace_id,
   } = step
 
   console.log(
@@ -135,11 +136,15 @@ async function executeStep(step) {
 
     // 2. Fetch the skill from HQ to ensure it's deployed locally
     //    Merge minion variables into template_vars so HQ expands {{VAR_NAME}} in SKILL.md.
-    //    Merge order: minion vars < project vars < workflow vars (template_vars already merged by HQ)
+    //    Resolution order: workspace < project < workflow < minion (minion wins).
+    //    template_vars already merges workspace/project/workflow on HQ side; we
+    //    layer effective minion vars (minion-wide ∪ WS-scoped) on top so any
+    //    conflicting key resolves to the minion-local value before HQ rewrites
+    //    the SKILL.md.
     if (skill_name) {
       try {
-        const minionVars = variableStore.getAll('variables')
-        const mergedVars = { ...minionVars, ...(template_vars || {}) }
+        const minionVars = variableStore.getEffectiveVariables(workspace_id || '')
+        const mergedVars = { ...(template_vars || {}), ...minionVars }
         const varsParam = Object.keys(mergedVars).length > 0
           ? `?vars=${Buffer.from(JSON.stringify(mergedVars)).toString('base64')}`
           : ''

package/core/lib/template-expander.js

@@ -32,17 +32,31 @@ function expandTemplateVars(content, vars) {
 
 /**
  * Expand templates in SKILL.md files for the given skill names.
- * Reads each SKILL.md, expands {{VAR}} with minion variables, writes back.
+ * Reads each SKILL.md, expands {{VAR}} with the merged variable set, writes back.
  * Returns the original contents for restoration after execution.
  *
+ * Resolution order (later entries override earlier ones):
+ *   extraVars (e.g., HQ workspace vars passed by the caller)
+ *     < minion-wide variables
+ *     < workspace-scoped minion variables for the given workspaceId
+ *
+ * The minion-local layer always wins at this stage, which mirrors the
+ * cross-scope rule (workspace < project < workflow < minion). For workflow
+ * execution, project/workflow scopes are pre-expanded by HQ before the
+ * SKILL.md reaches the minion; for routine execution the caller can pass
+ * workspace-scoped HQ vars via `extraVars`.
+ *
  * @param {string[]} skillNames - Skill slugs to expand
+ * @param {Record<string, string>} [extraVars] - Additional vars (lowest priority of the three layers)
+ * @param {string|null|undefined} [workspaceId] - Workspace context for resolving minion variables (defaults to minion-wide only)
  * @returns {Promise<Map<string, string>>} Map of skillName -> original content (for restoration)
  */
-async function expandSkillTemplates(skillNames) {
-  const minionVars = variableStore.getAll('variables')
+async function expandSkillTemplates(skillNames, extraVars = {}, workspaceId = '') {
+  const minionVars = variableStore.getEffectiveVariables(workspaceId)
+  const mergedVars = { ...extraVars, ...minionVars }
 
-  // If no variables defined, skip
-  if (Object.keys(minionVars).length === 0) return new Map()
+  // If nothing to expand, skip
+  if (Object.keys(mergedVars).length === 0) return new Map()
 
   // originals key: `${root}::${name}` so we restore the right copy in each
   // plugin's skill dir (multi-plugin distribution).
@@ -55,7 +69,7 @@ async function expandSkillTemplates(skillNames) {
       const skillMdPath = path.join(root, name, 'SKILL.md')
       try {
         const original = await fs.readFile(skillMdPath, 'utf-8')
-        const expanded = expandTemplateVars(original, minionVars)
+        const expanded = expandTemplateVars(original, mergedVars)
         if (expanded !== original) {
           originals.set(`${root}::${name}`, { skillMdPath, original })
           await fs.writeFile(skillMdPath, expanded, 'utf-8')

package/core/routes/variables.js

@@ -32,14 +32,26 @@ function isValidValue(value) {
 }
 
 function variableRoutes(fastify, _opts, done) {
-  // ─── Variables (non-sensitive) ───────────────────────────────────────
+  function readWorkspaceId(request) {
+    const rawWs = request.query?.workspace_id
+    return (typeof rawWs === 'string') ? rawWs : ''
+  }
+
+  // ─── Variables (non-sensitive, workspace-scoped) ──────────────────────
+  //
+  // Variables are scoped per workspace just like secrets. Pass
+  // ?workspace_id=<uuid> to target a specific workspace's bucket; omit it
+  // (or pass '') for the minion-wide bucket. At skill execution time the
+  // template-expander merges minion-wide + current-workspace variables, with
+  // WS-scoped values overriding minion-wide ones.
 
   fastify.get('/api/variables', async (request, reply) => {
     if (!verifyToken(request)) {
       return reply.code(401).send({ error: 'Unauthorized' })
     }
-    const variables = variableStore.getAll('variables')
-    return { success: true, variables }
+    const workspaceId = readWorkspaceId(request)
+    const variables = variableStore.getVariablesForScope(workspaceId)
+    return { success: true, workspace_id: workspaceId, variables }
   })
 
   fastify.get('/api/variables/:key', async (request, reply) => {
@@ -47,11 +59,12 @@ function variableRoutes(fastify, _opts, done) {
       return reply.code(401).send({ error: 'Unauthorized' })
     }
     const { key } = request.params
-    const value = variableStore.get('variables', key)
+    const workspaceId = readWorkspaceId(request)
+    const value = variableStore.getVariable(workspaceId, key)
     if (value === null) {
       return reply.code(404).send({ error: `Variable not found: ${key}` })
     }
-    return { success: true, key, value }
+    return { success: true, key, value, workspace_id: workspaceId }
   })
 
   fastify.put('/api/variables/:key', async (request, reply) => {
@@ -60,6 +73,7 @@ function variableRoutes(fastify, _opts, done) {
     }
     const { key } = request.params
     const { value } = request.body || {}
+    const workspaceId = readWorkspaceId(request)
 
     if (!isValidKey(key)) {
       return reply.code(400).send({ error: 'Invalid key. Use alphanumeric characters and underscores (1-100 chars).' })
@@ -68,8 +82,8 @@ function variableRoutes(fastify, _opts, done) {
       return reply.code(400).send({ error: 'Invalid value. Must be a string, no newlines, max 2000 chars.' })
     }
 
-    variableStore.set('variables', key, value)
-    return { success: true, key, value }
+    variableStore.setVariable(workspaceId, key, value)
+    return { success: true, key, value, workspace_id: workspaceId }
   })
 
   fastify.delete('/api/variables/:key', async (request, reply) => {
@@ -77,22 +91,45 @@ function variableRoutes(fastify, _opts, done) {
       return reply.code(401).send({ error: 'Unauthorized' })
     }
     const { key } = request.params
-    const removed = variableStore.remove('variables', key)
+    const workspaceId = readWorkspaceId(request)
+    const removed = variableStore.removeVariable(workspaceId, key)
     if (!removed) {
       return reply.code(404).send({ error: `Variable not found: ${key}` })
     }
-    return { success: true, key }
+    return { success: true, key, workspace_id: workspaceId }
   })
 
-  // ─── Secrets (sensitive) ─────────────────────────────────────────────
+  // List the workspace scopes (workspace_ids) that currently hold any
+  // variable. '' represents the minion-wide bucket.
+  fastify.get('/api/variables/scopes', async (request, reply) => {
+    if (!verifyToken(request)) {
+      return reply.code(401).send({ error: 'Unauthorized' })
+    }
+    return { success: true, scopes: variableStore.listVariableScopes() }
+  })
+
+  // ─── Secrets (sensitive, workspace-scoped) ────────────────────────────
+  //
+  // Secrets are scoped per workspace. Pass ?workspace_id=<uuid> to target a
+  // specific workspace's bucket; omit it (or pass '') for the minion-wide
+  // bucket. At skill execution time, the runner merges minion-wide +
+  // current-workspace secrets, with WS-scoped values overriding.
+  //
+  // Values are never returned via the API by design — only key names. Secrets
+  // never leave the minion: the HQ proxy is a pure pass-through.
+
+  function readWorkspaceId(request) {
+    const rawWs = request.query?.workspace_id
+    return (typeof rawWs === 'string') ? rawWs : ''
+  }
 
   fastify.get('/api/secrets', async (request, reply) => {
     if (!verifyToken(request)) {
       return reply.code(401).send({ error: 'Unauthorized' })
     }
-    // Return keys only — never expose secret values via API
-    const keys = variableStore.listKeys('secrets')
-    return { success: true, keys }
+    const workspaceId = readWorkspaceId(request)
+    const keys = variableStore.listSecretKeys(workspaceId)
+    return { success: true, workspace_id: workspaceId, keys }
   })
 
   fastify.put('/api/secrets/:key', async (request, reply) => {
@@ -101,6 +138,7 @@ function variableRoutes(fastify, _opts, done) {
     }
     const { key } = request.params
     const { value } = request.body || {}
+    const workspaceId = readWorkspaceId(request)
 
     if (!isValidKey(key)) {
       return reply.code(400).send({ error: 'Invalid key. Use alphanumeric characters and underscores (1-100 chars).' })
@@ -109,8 +147,8 @@ function variableRoutes(fastify, _opts, done) {
       return reply.code(400).send({ error: 'Invalid value. Must be a string, no newlines, max 2000 chars.' })
     }
 
-    variableStore.set('secrets', key, value)
-    return { success: true, key }
+    variableStore.setSecret(workspaceId, key, value)
+    return { success: true, key, workspace_id: workspaceId }
   })
 
   fastify.delete('/api/secrets/:key', async (request, reply) => {
@@ -118,11 +156,23 @@ function variableRoutes(fastify, _opts, done) {
       return reply.code(401).send({ error: 'Unauthorized' })
     }
     const { key } = request.params
-    const removed = variableStore.remove('secrets', key)
+    const workspaceId = readWorkspaceId(request)
+    const removed = variableStore.removeSecret(workspaceId, key)
     if (!removed) {
       return reply.code(404).send({ error: `Secret not found: ${key}` })
     }
-    return { success: true, key }
+    return { success: true, key, workspace_id: workspaceId }
+  })
+
+  // List the scopes (workspace_ids) that currently hold any secret.
+  // '' represents the minion-wide bucket. Useful for the dashboard secrets
+  // editor to populate the workspace selector even when a workspace has no
+  // active minion membership yet.
+  fastify.get('/api/secrets/scopes', async (request, reply) => {
+    if (!verifyToken(request)) {
+      return reply.code(401).send({ error: 'Unauthorized' })
+    }
+    return { success: true, scopes: variableStore.listSecretScopes() }
   })
 
   done()