thepopebot 1.2.74-beta.3 → 1.2.74-beta.4

package/lib/github-api.js

@@ -60,16 +60,28 @@ export async function listGitHubSecrets() {
 }
 
 /**
- * Set a repository secret.
+ * Set a repository secret (encrypted with repo public key per GitHub API requirement).
  */
 export async function setGitHubSecret(name, value) {
   const repo = getRepoPath();
   if (!repo) return { error: 'GitHub not configured' };
   try {
+    const pubKey = await ghFetch(`/repos/${repo}/actions/secrets/public-key`);
+
+    const sodium = await import('libsodium-wrappers');
+    await sodium.default.ready;
+    const binKey = sodium.default.from_base64(pubKey.key, sodium.default.base64_variants.ORIGINAL);
+    const binValue = sodium.default.from_string(value);
+    const encrypted = sodium.default.crypto_box_seal(binValue, binKey);
+    const encryptedBase64 = sodium.default.to_base64(encrypted, sodium.default.base64_variants.ORIGINAL);
+
     await ghFetch(`/repos/${repo}/actions/secrets/${name}`, {
       method: 'PUT',
       headers: { 'Content-Type': 'application/json' },
-      body: JSON.stringify({ value }),
+      body: JSON.stringify({
+        encrypted_value: encryptedBase64,
+        key_id: pubKey.key_id,
+      }),
     });
     return { success: true };
   } catch (err) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thepopebot",
-  "version": "1.2.74-beta.3",
+  "version": "1.2.74-beta.4",
   "type": "module",
   "description": "Create autonomous AI agents with a two-layer architecture: Next.js Event Handler + Docker Agent.",
   "bin": {

package/setup/lib/targets.mjs

@@ -15,7 +15,7 @@
  */
 export const CONFIG_TARGETS = {
   // Secrets → DB encrypted (never .env)
-  GH_TOKEN:              { dbSecret: true, secret: 'AGENT_GH_TOKEN' },
+  GH_TOKEN:              { env: true, dbSecret: true, secret: 'AGENT_GH_TOKEN' },
   ANTHROPIC_API_KEY:     { dbSecret: true, secret: 'AGENT_ANTHROPIC_API_KEY' },
   OPENAI_API_KEY:        { dbSecret: true, secret: 'AGENT_OPENAI_API_KEY' },
   GOOGLE_API_KEY:        { dbSecret: true, secret: 'AGENT_GOOGLE_API_KEY' },

package/setup/setup.mjs

@@ -315,6 +315,7 @@ async function main() {
       '  Contents: Read and write\n' +
       '  Metadata: Read-only (required, auto-selected)\n' +
       '  Pull requests: Read and write\n' +
+      '  Secrets: Read and write (required for managing agent secrets from UI)\n' +
       '  Workflows: Read and write'
     );