Waleed 9cd2e7f5fd fix(cli): validate each install secret against its own requirement (#6440) ...

Every secret was held to the 64-hex AES form, but only the encryption keys
need it — BETTER_AUTH_SECRET and INTERNAL_API_SECRET are HMAC secrets that
just need 32 characters. An operator-chosen passphrase was silently replaced
on the next run, invalidating every sign-in.

Reject the repository's published example values at any length: they are
longer than the 32-character minimum and would otherwise pass as real.

Back the file up and say so when replacing a value that was already there,
rather than reporting it as a routine generation. Generate and pass
API_ENCRYPTION_KEY, without which the app stores workspace API keys in plain
text; values predating it lack the encrypted shape and are still read as-is.

Resolve secrets before any container starts, so a filesystem problem reports
a usable message instead of leaving a half-started stack behind.

2026-08-08 13:59:24 -07:00

..

index.ts

fix(cli): validate each install secret against its own requirement (#6440)

2026-08-08 13:59:24 -07:00