@skaile/workspaces 4.32.0 → 4.32.1

package/CHANGELOG.md

@@ -1,5 +1,11 @@
 # Changelog
 
+## 4.32.1
+
+### Patch Changes
+
+- [#949](https://github.com/skaile-ai/workspaces/pull/949) [`14c761a`](https://github.com/skaile-ai/workspaces/commit/14c761a86ae0308a063d24f52b2f25e57014f054) Thanks [@mortegro](https://github.com/mortegro)! - `skaile serve` in env secrets mode (the default) now resolves `env:NAME` refs against the process environment when it builds the session at startup. Previously that eager build had no secret provider, so `resolveRecordSecretsStrict` rejected every `env:` ref in a runner-managed MCP declaration (for example `headers: { Authorization: env:TOKEN }` in `skaile.yaml`) with "unresolved secret ref" and the server was skipped, although the variable was set in the runner's environment. Unset variables still fail the spawn before any request is made. A later `session_init` still replaces the provider with its provisioned secrets.
+
 ## 4.32.0
 
 ### Minor Changes

package/dist/{chunk-MJUDVEFN.js → chunk-EOX3QH74.js}

@@ -4,10 +4,10 @@ import { findAiAssetsRoot } from './chunk-7IH3RKKK.js';
 import { WebSocketServerTransport } from './chunk-5LKOAX7I.js';
 import { assembleSystemPrompt, buildCapabilitiesPromptSection } from './chunk-W3UDISS2.js';
 import { prepareNativePolicy, codexInstanceEnvironment, parseCodexCredential, parseCodexRefreshInput, parseCodexRefreshResult } from './chunk-HCYS7GFP.js';
-import { resolveFlowPath } from './chunk-SMZT7QMT.js';
+import { resolveFlowPath } from './chunk-OS4SXZTQ.js';
 import { findAiAssetsRoot as findAiAssetsRoot$1, deployCatalogEntry, undeployCatalogEntry } from './chunk-Q6NDQ6BH.js';
 import { registerBuiltinConnectors, buildConnectorPromptSection, findMissingPackages, installNpmPackages, ConnectorManager, buildSdkConnectorTools, buildLazySdkFlowTools, describeFlowOperations, buildConnectorToolDefs, buildFlowToolDefs, SessionNodeExecutor, SessionSubpromptRunner, ClassifierSubpromptRunner, SessionInlineSubFlowRunner, driveOrchestratorTurn, buildSdkFlowTools } from './chunk-223FKFTC.js';
-import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-2JANXYTJ.js';
+import { loadYamlConnectorDeclarations, withMaterializedConnectorDeclarations, SecretProviderChain, ConnectorStartupError, EnvSecretProvider, PreMintedSecretProvider, InMemorySecretProvider, resolvedConfigToDeclarations, isKnownSecretRef, deriveSingleMaterializedConnectorDeclaration } from './chunk-2JANXYTJ.js';
 import { EventNormalizer } from './chunk-MNA22VPT.js';
 import { probeResumeTranscript, transcriptStoreForRuntime } from './chunk-LX3FKVLL.js';
 import { scopeReconfigureModel } from './chunk-EINLFFP6.js';
@@ -9032,7 +9032,7 @@ async function startAgentServer(opts) {
   if (secretsMode === "provisioned") {
     log("[serve] secrets mode: provisioned \u2014 waiting for provision_secrets command");
   } else {
-    sessionConfig = buildSessionConfig();
+    sessionConfig = buildSessionConfig(new EnvSecretProvider());
     agentSession = await createAgentSession(sessionConfig);
     emitSystemPromptComposed(agentSession, sendEvent);
     noteAgentSessionBuilt(sessionConfig.resumeSessionId);
@@ -11119,5 +11119,5 @@ function touchSession(state) {
 }
 
 export { CLAUDE_CODE_CREDENTIALS_KEY, COMPILE_MANIFEST_FILENAME, CONNECTOR_MUTATE_NOT_READY, CapabilityRegistry, DEFAULT_CAPABILITY_CALL_TIMEOUT_MS, DEFAULT_COALESCE_MS, DEFAULT_FLOW_MUTATE_CONNECTOR_WAIT_MS, MOUNT_LIST_MAX_DEPTH, MOUNT_LIST_MAX_ENTRIES, MOUNT_READ_DEADLINE_FACTOR, MOUNT_READ_MAX_CHUNK_BYTES, MOUNT_STAT_BUDGET_MS, MOUNT_STAT_MAX_ENTRIES, MOUNT_TREE_OP_DEADLINE_FACTOR, MarkdownStreamer, PreInitRingSink, ResourceOperationError, SESSION_ROOT_WRITABLE_DIRS, SESSION_ROOT_WRITABLE_FILES, WS_AUTH_TOKEN_ENV, WS_AUTH_TOKEN_FILE_ENV, agentDefinitionExists, bootstrapCapabilityRegistry, bootstrapRunnerLogStore, buildAgentResources, buildClientCapabilityHandler, buildConnectorTokenMediator, buildContextSection, buildEnvironmentSection, buildResourcesAvailablePayload, buildStoreSnapshotReplay, builtinCapabilities, capabilityLogInstance, clearPreInitRingSink, clearSession, compileComposition, computeCapabilitySignature, computeDirectoryTotals, connectorRefreshKind, createAgentSession, createFlowConnectorReadiness, createManagedCodexSubpromptDriver, createSessionStimulusBus, defineCapability, deleteSession, dispatchResourceRequest, dispatchRunnerCapabilityInvocation, emitSystemPromptComposed, ensureClaudeSettingsDisablesConnectors, ensureGitConfigInclude, executeConnectorMutate, extractClaudeAiOauthExpiresAt, flowRunDrivesTurns, flowStartNeedsDriverRestart, getPreInitRingSink, handleMountResourceRequest, handleResourceRequest, handleSessionRootResourceRequest, hasNonTerminalFlow, hostOpResumeStimulus, installPreInitRingSink, isSessionRootPathAllowed, isTerminalFlowStatus, listSessions, loadAgentManifest, loadCompileManifest, loadCompileManifestFromDir, loadManagedCodexHostConfig, loadSession, loadSessionById, mcpAuthSecretKey, newSession, nulTailPaddingLength, pickChatFlowTarget, pickFlowToolTarget, pickRepointedManager, planFlowMutate, prepareCodexTools, reconcilePendingDecisions, recreateKeepingLiveFlows, registerActiveFlow, registerCompositionCapabilities, rejectCapabilityOnApprovalDeny, rejectPendingCapabilityCallsOnDisconnect, resetRunnerLogStore, resolveAgentComposition, resolveAgentMixins, resolveBinding, resolveCapabilityCallTimeoutMs, resolveCapabilityResult, resolveComposition, resolveFlowMutateConnectorWaitMs, resolveMixin, restoredRunHasWorkToResume, runAgentChat, saveSession, setCurrentSession, setUpFlowConnector, startAgentServer, stimulusFromMetas, supportsLiveToolUpdates, takeRunnerWsAuthToken, toActiveFlowTarget, touchSession, validateInputResponse, writeClaudeCodeCredentialsFile };
-//# sourceMappingURL=chunk-MJUDVEFN.js.map
-//# sourceMappingURL=chunk-MJUDVEFN.js.map
+//# sourceMappingURL=chunk-EOX3QH74.js.map
+//# sourceMappingURL=chunk-EOX3QH74.js.map