feat(config): load one validated secret bundle

2026-07-12 11:06:19 +02:00
parent b539303002
commit 5fe74612fb
9 changed files with 255 additions and 2 deletions
@@ -115,3 +115,13 @@ test("single-key providers scrub ambient compound companions before injecting th
  expect(env).not.toHaveProperty("CLOUDFLARE_ACCOUNT_ID");
  expect(env).not.toHaveProperty("CLOUDFLARE_GATEWAY_ID");
 });
+
+test("bundle value is injected without exposing bundle metadata to Pi", () => {
+  const env = buildPiChildEnv({
+    ambient: { THT_SECRETS_FILE: "/run/secrets/thothii.secrets", THT_MODEL_API_KEY_FILE: "/run/secrets/model" },
+    provider: "openai", credentialValue: "bundle-secret",
+  });
+  expect(env.OPENAI_API_KEY).toBe("bundle-secret");
+  expect(env).not.toHaveProperty("THT_SECRETS_FILE");
+  expect(env).not.toHaveProperty("THT_MODEL_API_KEY_FILE");
+});