agent-board-runner 0.1.10 → 0.1.11

package/dist/cli.js

@@ -881,7 +881,7 @@ async function getProject(supabase, projectId) {
   return data;
 }
 async function getProjectRepos(supabase, projectId) {
-  const { data, error } = await supabase.from("project_repos").select("subpath, dev_command, column_actions").eq("project_id", projectId);
+  const { data, error } = await supabase.from("project_repos").select("id, subpath, dev_command, column_actions").eq("project_id", projectId);
   if (error) throw error;
   return data;
 }
@@ -2389,6 +2389,29 @@ async function ensureBranchWatchers(supabase, config) {
 import { exec } from "node:child_process";
 import { join as join11 } from "node:path";
 import { promisify as promisify4 } from "node:util";
+
+// src/vaultSecrets.ts
+async function resolveProjectSecretsEnv(supabase, projectId, repoId) {
+  try {
+    const { data, error } = await supabase.rpc("resolve_project_secrets", { p_project_id: projectId, p_repo_id: repoId });
+    if (error) throw error;
+    const rows = data ?? [];
+    const env = {};
+    for (const row of rows) env[row.name] = row.value;
+    if (rows.length > 0) {
+      logger.runner.info(
+        "VAULT",
+        `Resolved ${rows.length} secret(s) for project ${projectId}${repoId ? ` (repo ${repoId})` : ""}: ${rows.map((r) => r.name).join(", ")}.`
+      );
+    }
+    return env;
+  } catch (err) {
+    logger.runner.error("VAULT", `Failed to resolve secrets for project ${projectId}${repoId ? ` (repo ${repoId})` : ""}:`, err);
+    return {};
+  }
+}
+
+// src/columnActions.ts
 var execAsync = promisify4(exec);
 var OUTPUT_TAIL_CHARS = 4e3;
 function tail(text) {
@@ -2397,15 +2420,15 @@ function tail(text) {
 function resolveTargets(project, children, repoRoot, column, timing) {
   if (children.length > 0) {
     return children.flatMap(
-      (child2) => (child2.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: child2.subpath, cwd: join11(repoRoot, child2.subpath), command: action.command }))
+      (child2) => (child2.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: child2.subpath, cwd: join11(repoRoot, child2.subpath), command: action.command, repoId: child2.id }))
     );
   }
-  return (project.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: null, cwd: repoRoot, command: action.command }));
+  return (project.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: null, cwd: repoRoot, command: action.command, repoId: null }));
 }
 var EXEC_OPTIONS = { maxBuffer: 10 * 1024 * 1024 };
-async function runCommand(target) {
+async function runCommand(target, extraEnv) {
   try {
-    const { stdout, stderr } = await execAsync(target.command, { ...EXEC_OPTIONS, cwd: target.cwd });
+    const { stdout, stderr } = await execAsync(target.command, { ...EXEC_OPTIONS, cwd: target.cwd, env: { ...process.env, ...extraEnv } });
     return { ok: true, output: tail(`${stdout}${stderr}`) };
   } catch (err) {
     const { stdout, stderr } = err;
@@ -2432,7 +2455,8 @@ async function handleColumnEntered(supabase, config, card) {
     );
     let failure = null;
     for (const target of targets) {
-      const result = await runCommand(target);
+      const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+      const result = await runCommand(target, secretsEnv);
       if (!result.ok) {
         failure = { label: target.label, output: result.output };
         break;
@@ -2462,10 +2486,11 @@ async function clearColumnActionStatus(supabase, card) {
   if (card.custom_action_status === null) return;
   await updateCard(supabase, card.id, { customActionStatus: null, customActionOutput: null });
 }
-async function runAfterColumnActions(project, children, repoRoot, column) {
+async function runAfterColumnActions(supabase, project, children, repoRoot, column) {
   const targets = resolveTargets(project, children, repoRoot, column, "after");
   for (const target of targets) {
-    const result = await runCommand(target);
+    const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+    const result = await runCommand(target, secretsEnv);
     if (!result.ok) {
       return { ok: false, error: target.label ? `${target.label}: ${result.output}` : result.output };
     }
@@ -2643,7 +2668,7 @@ function killProcessTree(child2) {
   }
 }
 var previews = /* @__PURE__ */ new Map();
-function ensurePreview(key, label, cwd, command2, cardId) {
+function ensurePreview(key, label, cwd, command2, cardId, extraEnv = {}) {
   const existing = previews.get(key);
   if (existing) {
     existing.cardIds.add(cardId);
@@ -2651,7 +2676,7 @@ function ensurePreview(key, label, cwd, command2, cardId) {
   }
   let child2;
   try {
-    child2 = spawn4(command2, { cwd, shell: true, windowsHide: true });
+    child2 = spawn4(command2, { cwd, shell: true, windowsHide: true, env: { ...process.env, ...extraEnv } });
   } catch (err) {
     logger.runner.error("DEV_SERVER", `Failed to spawn "${command2}" in ${cwd}:`, err);
     return Promise.resolve(null);
@@ -3490,7 +3515,7 @@ async function runDeploy(supabase, config, project) {
     await clearProjectDeployRequest(supabase, project.id);
     return;
   }
-  const columnActionResult = await runAfterColumnActions(project, children, repoRoot, "deploy");
+  const columnActionResult = await runAfterColumnActions(supabase, project, children, repoRoot, "deploy");
   if (!columnActionResult.ok) {
     logger.runner.error("DEPLOY", `Deploy column action failed for project ${project.id}: ${columnActionResult.error}`);
     await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: columnActionResult.error })));
@@ -3616,13 +3641,16 @@ async function handleCardEnteredRevisao(supabase, config, card) {
     const project = await getProject(supabase, card.project_id);
     const children = await getProjectRepos(supabase, project.id);
     const repoRoot = resolveRepoPath(config, project.repo_path);
-    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join15(repoRoot, child2.subpath), command: child2.dev_command })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command }] : [];
+    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join15(repoRoot, child2.subpath), command: child2.dev_command, repoId: child2.id })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command, repoId: null }] : [];
     if (targets.length === 0) {
       logger.card.info(card.id, `No dev_command configured for project ${project.id}, skipping automatic preview.`);
       return;
     }
     const results = await Promise.all(
-      targets.map((target) => ensurePreview(`${project.id}:${target.label}`, target.label, target.cwd, target.command, card.id))
+      targets.map(async (target) => {
+        const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+        return ensurePreview(`${project.id}:${target.label}`, target.label, target.cwd, target.command, card.id, secretsEnv);
+      })
     );
     const previews2 = results.filter((result) => result !== null);
     if (previews2.length === 0) {

package/dist/index.js

@@ -719,7 +719,7 @@ async function getProject(supabase, projectId) {
   return data;
 }
 async function getProjectRepos(supabase, projectId) {
-  const { data, error } = await supabase.from("project_repos").select("subpath, dev_command, column_actions").eq("project_id", projectId);
+  const { data, error } = await supabase.from("project_repos").select("id, subpath, dev_command, column_actions").eq("project_id", projectId);
   if (error) throw error;
   return data;
 }
@@ -2328,6 +2328,29 @@ async function ensureBranchWatchers(supabase, config) {
 import { exec } from "node:child_process";
 import { join as join11 } from "node:path";
 import { promisify as promisify4 } from "node:util";
+
+// src/vaultSecrets.ts
+async function resolveProjectSecretsEnv(supabase, projectId, repoId) {
+  try {
+    const { data, error } = await supabase.rpc("resolve_project_secrets", { p_project_id: projectId, p_repo_id: repoId });
+    if (error) throw error;
+    const rows = data ?? [];
+    const env = {};
+    for (const row of rows) env[row.name] = row.value;
+    if (rows.length > 0) {
+      logger.runner.info(
+        "VAULT",
+        `Resolved ${rows.length} secret(s) for project ${projectId}${repoId ? ` (repo ${repoId})` : ""}: ${rows.map((r) => r.name).join(", ")}.`
+      );
+    }
+    return env;
+  } catch (err) {
+    logger.runner.error("VAULT", `Failed to resolve secrets for project ${projectId}${repoId ? ` (repo ${repoId})` : ""}:`, err);
+    return {};
+  }
+}
+
+// src/columnActions.ts
 var execAsync = promisify4(exec);
 var OUTPUT_TAIL_CHARS = 4e3;
 function tail(text) {
@@ -2336,15 +2359,15 @@ function tail(text) {
 function resolveTargets(project, children, repoRoot, column, timing) {
   if (children.length > 0) {
     return children.flatMap(
-      (child2) => (child2.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: child2.subpath, cwd: join11(repoRoot, child2.subpath), command: action.command }))
+      (child2) => (child2.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: child2.subpath, cwd: join11(repoRoot, child2.subpath), command: action.command, repoId: child2.id }))
     );
   }
-  return (project.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: null, cwd: repoRoot, command: action.command }));
+  return (project.column_actions[column] ?? []).filter((action) => action.timing === timing).map((action) => ({ label: null, cwd: repoRoot, command: action.command, repoId: null }));
 }
 var EXEC_OPTIONS = { maxBuffer: 10 * 1024 * 1024 };
-async function runCommand(target) {
+async function runCommand(target, extraEnv) {
   try {
-    const { stdout, stderr } = await execAsync(target.command, { ...EXEC_OPTIONS, cwd: target.cwd });
+    const { stdout, stderr } = await execAsync(target.command, { ...EXEC_OPTIONS, cwd: target.cwd, env: { ...process.env, ...extraEnv } });
     return { ok: true, output: tail(`${stdout}${stderr}`) };
   } catch (err) {
     const { stdout, stderr } = err;
@@ -2371,7 +2394,8 @@ async function handleColumnEntered(supabase, config, card) {
     );
     let failure = null;
     for (const target of targets) {
-      const result = await runCommand(target);
+      const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+      const result = await runCommand(target, secretsEnv);
       if (!result.ok) {
         failure = { label: target.label, output: result.output };
         break;
@@ -2401,10 +2425,11 @@ async function clearColumnActionStatus(supabase, card) {
   if (card.custom_action_status === null) return;
   await updateCard(supabase, card.id, { customActionStatus: null, customActionOutput: null });
 }
-async function runAfterColumnActions(project, children, repoRoot, column) {
+async function runAfterColumnActions(supabase, project, children, repoRoot, column) {
   const targets = resolveTargets(project, children, repoRoot, column, "after");
   for (const target of targets) {
-    const result = await runCommand(target);
+    const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+    const result = await runCommand(target, secretsEnv);
     if (!result.ok) {
       return { ok: false, error: target.label ? `${target.label}: ${result.output}` : result.output };
     }
@@ -2582,7 +2607,7 @@ function killProcessTree(child2) {
   }
 }
 var previews = /* @__PURE__ */ new Map();
-function ensurePreview(key, label, cwd, command, cardId) {
+function ensurePreview(key, label, cwd, command, cardId, extraEnv = {}) {
   const existing = previews.get(key);
   if (existing) {
     existing.cardIds.add(cardId);
@@ -2590,7 +2615,7 @@ function ensurePreview(key, label, cwd, command, cardId) {
   }
   let child2;
   try {
-    child2 = spawn4(command, { cwd, shell: true, windowsHide: true });
+    child2 = spawn4(command, { cwd, shell: true, windowsHide: true, env: { ...process.env, ...extraEnv } });
   } catch (err) {
     logger.runner.error("DEV_SERVER", `Failed to spawn "${command}" in ${cwd}:`, err);
     return Promise.resolve(null);
@@ -3429,7 +3454,7 @@ async function runDeploy(supabase, config, project) {
     await clearProjectDeployRequest(supabase, project.id);
     return;
   }
-  const columnActionResult = await runAfterColumnActions(project, children, repoRoot, "deploy");
+  const columnActionResult = await runAfterColumnActions(supabase, project, children, repoRoot, "deploy");
   if (!columnActionResult.ok) {
     logger.runner.error("DEPLOY", `Deploy column action failed for project ${project.id}: ${columnActionResult.error}`);
     await Promise.all(cards.map((card) => updateCard(supabase, card.id, { deployError: columnActionResult.error })));
@@ -3555,13 +3580,16 @@ async function handleCardEnteredRevisao(supabase, config, card) {
     const project = await getProject(supabase, card.project_id);
     const children = await getProjectRepos(supabase, project.id);
     const repoRoot = resolveRepoPath(config, project.repo_path);
-    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join15(repoRoot, child2.subpath), command: child2.dev_command })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command }] : [];
+    const targets = children.length > 0 ? children.filter((child2) => child2.dev_command).map((child2) => ({ label: child2.subpath, cwd: join15(repoRoot, child2.subpath), command: child2.dev_command, repoId: child2.id })) : project.dev_command ? [{ label: "", cwd: repoRoot, command: project.dev_command, repoId: null }] : [];
     if (targets.length === 0) {
       logger.card.info(card.id, `No dev_command configured for project ${project.id}, skipping automatic preview.`);
       return;
     }
     const results = await Promise.all(
-      targets.map((target) => ensurePreview(`${project.id}:${target.label}`, target.label, target.cwd, target.command, card.id))
+      targets.map(async (target) => {
+        const secretsEnv = await resolveProjectSecretsEnv(supabase, project.id, target.repoId);
+        return ensurePreview(`${project.id}:${target.label}`, target.label, target.cwd, target.command, card.id, secretsEnv);
+      })
     );
     const previews2 = results.filter((result) => result !== null);
     if (previews2.length === 0) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-board-runner",
-  "version": "0.1.10",
+  "version": "0.1.11",
   "description": "Local runner for Agent Board — signs in with your own Supabase account (no shared secrets) and drives Claude Code against repos under your local repos root.",
   "type": "module",
   "bin": {