feat: configure workspace runtime secrets through API

backend/src/app.ts

@@ -21,8 +21,10 @@ import { WorkspaceRegistry } from "./workspaces/registry.js";
 import { createProductionWorkspaceDiagnoser } from "./workspaces/diagnostics.js";
 import { workspaceRoutes, type WorkspaceDiagnoser } from "./routes/workspaces.js";
 import { piManagementRoutes } from "./routes/pi-management.js";
-import { resolveRuntimeBindings, supportsSessionRuntime } from "./workspaces/bindings.js";
+import { supportsSessionRuntime } from "./workspaces/bindings.js";
+import { resolveRuntimeBindingsWithWorkspaceSecrets } from "./workspaces/secret-requirements.js";
 import type { WorkspaceDescriptor } from "./workspaces/schema.js";
+import { WorkspaceSecretStore } from "./workspaces/secret-store.js";
 
 export interface BuildAppDeps {
   thtRunner?: ThtRunner;
@@ -34,6 +36,7 @@ export interface BuildAppDeps {
   hub?: SseHub;
   workspaceRegistry?: WorkspaceRegistry;
   workspaceDiagnoser?: WorkspaceDiagnoser;
+  workspaceSecretStore?: WorkspaceSecretStore;
   workspaceRuntimeSupport?: (workspace: WorkspaceDescriptor) => boolean;
   maintenanceBarrier?: MaintenanceBarrier;
   piManagement?: PiManagementService;
@@ -41,6 +44,11 @@ export interface BuildAppDeps {
 
 export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstance {
   const app = Fastify({ logger: { level: "warn" }, disableRequestLogging: true });
+  const workspaceSecretStore = deps?.workspaceSecretStore ?? new WorkspaceSecretStore({
+    root: config.workspaceSecretStoreRoot,
+    runtimeRoot: config.workspaceSecretRuntimeRoot,
+    installationId: config.workspaceRegistry.installationId,
+  });
 
   // Allow any origin in dev/e2e; tighten in production via config if needed.
   app.register(cors, {
@@ -58,6 +66,7 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
     secretRoots: config.workspaceRegistry.secretRoots,
     secretsFile: config.secretsFile,
     secretFiles: config.secretFiles,
+    workspaceSecretStore,
     semanticRuntime: {
       internalQdrantUrl: config.internalQdrantUrl,
       internalEmbeddingUrl: config.internalEmbeddingUrl,
@@ -75,13 +84,19 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
       internalEmbeddingModel: config.internalEmbeddingModel,
       internalEmbeddingDimensions: config.internalEmbeddingDimensions,
     });
-  const workspaceRuntimeSupport = deps?.workspaceRuntimeSupport ?? ((workspace: WorkspaceDescriptor) => (
-    supportsSessionRuntime(resolveRuntimeBindings(
+  const workspaceRuntimeSupport = deps?.workspaceRuntimeSupport ?? ((workspace: WorkspaceDescriptor) => {
+    const lease = resolveRuntimeBindingsWithWorkspaceSecrets(
       workspace,
       process.env,
       config.workspaceRegistry.secretRoots,
-    ))
-  ));
+      workspaceSecretStore,
+    );
+    try {
+      return supportsSessionRuntime(lease.bindings);
+    } finally {
+      lease.release();
+    }
+  });
   const readiness = deps?.readiness ?? new ReadinessManager(
     tht as ThtRunner,
     Math.round(config.ollamaEnsureTimeoutMs / 1000),
@@ -180,7 +195,12 @@ export function buildApp(config: AppConfig, deps?: BuildAppDeps): FastifyInstanc
   });
   sqlRoutes(app, { tht: tht as ThtRunner, getSettings, workspaceRegistry });
   metaRoutes(app, { harnessDir: config.harnessDir, listModels });
-  workspaceRoutes(app, { registry: workspaceRegistry, config: config.workspaceRegistry, diagnose: workspaceDiagnoser });
+  workspaceRoutes(app, {
+    registry: workspaceRegistry,
+    config: config.workspaceRegistry,
+    diagnose: workspaceDiagnoser,
+    secretStore: workspaceSecretStore,
+  });
   settingsRoutes(app, { cfg: config, listModels, getSettings });
   piManagementRoutes(app, { config, service: piManagement });