@sema-agent/settings-schema 6.4.0 → 7.0.1

package/dist/secret-refs.js

@@ -16,7 +16,11 @@ export function collectEnvRefs(eff) {
         add(r.apiKeyEnv, "workers", `worker "${w.name}".secretRefs.apiKeyEnv`);
         add(r.serviceAuthTokenEnv, "workers", `worker "${w.name}".secretRefs.serviceAuthTokenEnv`);
         add(r.gitTokenEnv, "workers", `worker "${w.name}".secretRefs.gitTokenEnv`);
-        add(r.tidbPasswordEnv, "workers", `worker "${w.name}".secretRefs.tidbPasswordEnv`);
+        add(r.dbPasswordEnv, "workers", `worker "${w.name}".secretRefs.dbPasswordEnv`);
+        // 7.0.0: the execution lane's secrets (E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN …) moved out of the general
+        // `secretEnv` passthrough into `runtime.execution.secretRefs` — still env-NAMEs the host must provide.
+        for (const [key, envName] of Object.entries(w.runtime.execution?.secretRefs ?? {}))
+            add(envName, "workers", `worker "${w.name}".runtime.execution.secretRefs.${key}`);
         // the general secretEnv passthrough also references env-NAMEs (worker-env.ts merges them) — include them
         // so the rotation inventory isn't blind to app-specific tokens like OA_SERVICE_TOKEN→OA_CALLBACK_TOKEN.
         for (const [key, envName] of Object.entries(w.secretEnv ?? {}))
@@ -32,7 +36,8 @@ export function collectEnvRefs(eff) {
     return [...map.entries()].map(([envName, refs]) => ({ envName, refs })).sort((a, b) => a.envName.localeCompare(b.envName));
 }
 /**
- * Names of workers that reference a given env-NAME — via any of the 4 structured `secretRefs` OR the general
+ * Names of workers that reference a given env-NAME — via any of the structured `secretRefs`, the execution lane's
+ * `runtime.execution.secretRefs` (7.0.0: where E2B_API_KEY / SSH_PRIVATE_KEY / K8S_TOKEN … live now), OR the general
  * `secretEnv` passthrough. Drives batch-rotate (POST /secrets/<name>/rotate): after a credential write, recreate
  * exactly the workers that project it. Reads the raw workers domain (the same shape collectEnvRefs would see).
  */
@@ -40,8 +45,9 @@ export function workersReferencingSecret(workers, envName) {
     const out = [];
     for (const w of workers) {
         const inStructured = Object.values(w.secretRefs ?? {}).includes(envName);
+        const inLane = Object.values(w.runtime?.execution?.secretRefs ?? {}).includes(envName);
         const inPassthrough = Object.values(w.secretEnv ?? {}).includes(envName);
-        if (inStructured || inPassthrough)
+        if (inStructured || inLane || inPassthrough)
             out.push(w.name);
     }
     return out;