agent-board-runner 0.1.15 → 0.1.16

package/dist/cli.js

@@ -2840,6 +2840,7 @@ var OUTPUT_TAIL_CHARS = 2e4;
 var COMMAND_TIMEOUT_MS = 5 * 60 * 1e3;
 var MAX_BUFFER = 10 * 1024 * 1024;
 var SECRET_PLACEHOLDER_RE = /\{\{secret:([A-Z][A-Z0-9_]*)\}\}/g;
+var SECRET_ENV_PLACEHOLDER_RE = /^\{\{secret_env:([A-Z][A-Z0-9_]*)\}\}$/;
 function isRunProjectCommandPayload(value) {
   if (!value || typeof value !== "object") return false;
   const candidate = value;
@@ -2855,14 +2856,26 @@ async function runProjectCommand(supabase, config, payload) {
   if (!registered) throw new Error("This runner does not have that project registered.");
   const secretsEnv = await resolveProjectSecretsEnv(supabase, projectId, null);
   const referencedSecretNames = /* @__PURE__ */ new Set();
-  const resolvedArgv = argv.map(
-    (part) => part.replace(SECRET_PLACEHOLDER_RE, (_match, name) => {
-      const value = secretsEnv[name];
-      if (value === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
+  const resolvedArgv = [];
+  for (const part of argv) {
+    const envOnlyMatch = part.match(SECRET_ENV_PLACEHOLDER_RE);
+    if (envOnlyMatch) {
+      const name = envOnlyMatch[1];
+      if (secretsEnv[name] === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
       referencedSecretNames.add(name);
-      return value;
-    })
-  );
+      continue;
+    }
+    resolvedArgv.push(
+      part.replace(SECRET_PLACEHOLDER_RE, (_match, name) => {
+        const value = secretsEnv[name];
+        if (value === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
+        referencedSecretNames.add(name);
+        return value;
+      })
+    );
+  }
+  const secretEnv = { ...process.env };
+  for (const name of referencedSecretNames) secretEnv[name] = secretsEnv[name];
   function redact(text) {
     let redacted = text;
     for (const name of referencedSecretNames) {
@@ -2874,7 +2887,7 @@ async function runProjectCommand(supabase, config, payload) {
   try {
     const { stdout, stderr } = await execFileAsync4(resolvedArgv[0], resolvedArgv.slice(1), {
       cwd: registered.repoPath,
-      env: process.env,
+      env: secretEnv,
       timeout: COMMAND_TIMEOUT_MS,
       maxBuffer: MAX_BUFFER
     });

package/dist/index.js

@@ -2728,6 +2728,7 @@ var OUTPUT_TAIL_CHARS = 2e4;
 var COMMAND_TIMEOUT_MS = 5 * 60 * 1e3;
 var MAX_BUFFER = 10 * 1024 * 1024;
 var SECRET_PLACEHOLDER_RE = /\{\{secret:([A-Z][A-Z0-9_]*)\}\}/g;
+var SECRET_ENV_PLACEHOLDER_RE = /^\{\{secret_env:([A-Z][A-Z0-9_]*)\}\}$/;
 function isRunProjectCommandPayload(value) {
   if (!value || typeof value !== "object") return false;
   const candidate = value;
@@ -2743,14 +2744,26 @@ async function runProjectCommand(supabase, config, payload) {
   if (!registered) throw new Error("This runner does not have that project registered.");
   const secretsEnv = await resolveProjectSecretsEnv(supabase, projectId, null);
   const referencedSecretNames = /* @__PURE__ */ new Set();
-  const resolvedArgv = argv.map(
-    (part) => part.replace(SECRET_PLACEHOLDER_RE, (_match, name) => {
-      const value = secretsEnv[name];
-      if (value === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
+  const resolvedArgv = [];
+  for (const part of argv) {
+    const envOnlyMatch = part.match(SECRET_ENV_PLACEHOLDER_RE);
+    if (envOnlyMatch) {
+      const name = envOnlyMatch[1];
+      if (secretsEnv[name] === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
       referencedSecretNames.add(name);
-      return value;
-    })
-  );
+      continue;
+    }
+    resolvedArgv.push(
+      part.replace(SECRET_PLACEHOLDER_RE, (_match, name) => {
+        const value = secretsEnv[name];
+        if (value === void 0) throw new Error(`Secret "${name}" referenced by this command is no longer configured for this project.`);
+        referencedSecretNames.add(name);
+        return value;
+      })
+    );
+  }
+  const secretEnv = { ...process.env };
+  for (const name of referencedSecretNames) secretEnv[name] = secretsEnv[name];
   function redact(text) {
     let redacted = text;
     for (const name of referencedSecretNames) {
@@ -2762,7 +2775,7 @@ async function runProjectCommand(supabase, config, payload) {
   try {
     const { stdout, stderr } = await execFileAsync4(resolvedArgv[0], resolvedArgv.slice(1), {
       cwd: registered.repoPath,
-      env: process.env,
+      env: secretEnv,
       timeout: COMMAND_TIMEOUT_MS,
       maxBuffer: MAX_BUFFER
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-board-runner",
-  "version": "0.1.15",
+  "version": "0.1.16",
   "description": "Local runner for Agent Board — signs in with your own Supabase account (no shared secrets) and drives Claude Code against repos under your local repos root.",
   "type": "module",
   "bin": {