chore: integrate v0.1 secret tooling

scripts/src/cli.ts

@@ -4,6 +4,7 @@ import { MemoryAgentRunStore } from "../../src/mgr/store.js";
 import { ManagerClient } from "../../src/mgr/client.js";
 import { runOnce } from "../../src/runner/run-once.js";
 import { renderRunnerJobDryRun } from "../../src/runner/k8s-job.js";
+import { renderCodexProviderSecretPlan } from "./secret-render.js";
 import type { JsonRecord, JsonValue, RunRecord } from "../../src/common/types.js";
 import { AgentRunError, errorToJson } from "../../src/common/errors.js";
 import type { RunnerOnceOptions } from "../../src/runner/run-once.js";
@@ -30,6 +31,7 @@ async function dispatch(args: ParsedArgs): Promise<JsonValue> {
   if (group === "server" && command === "start") return startServer(args);
   if (group === "server" && command === "status") return client(args).get("/health/readiness");
   if (group === "backends" && command === "list") return client(args).get("/api/v1/backends");
+  if (group === "secrets" && command === "codex" && id === "render") return renderCodexSecret(args);
   if (group === "runs" && command === "create") return client(args).post("/api/v1/runs", await jsonFile(args));
   if (group === "runs" && command === "show" && id) return client(args).get(`/api/v1/runs/${encodeURIComponent(id)}`);
   if (group === "runs" && command === "events" && id) return client(args).get(`/api/v1/runs/${encodeURIComponent(id)}/events?afterSeq=${flag(args, "after-seq", "0")}&limit=${flag(args, "limit", "100")}`);
@@ -91,6 +93,24 @@ async function renderRunnerJob(args: ParsedArgs): Promise<JsonRecord> {
   });
 }
 
+async function renderCodexSecret(args: ParsedArgs): Promise<JsonRecord> {
+  if (args.flags.get("dry-run") !== true) {
+    throw new AgentRunError("schema-invalid", "secrets codex render requires --dry-run", { httpStatus: 2 });
+  }
+  const options: Parameters<typeof renderCodexProviderSecretPlan>[0] = { dryRun: true };
+  const codexHome = optionalFlag(args, "codex-home");
+  const authFile = optionalFlag(args, "auth-file");
+  const configFile = optionalFlag(args, "config-file");
+  const namespace = optionalFlag(args, "namespace");
+  const secretName = optionalFlag(args, "secret-name");
+  if (codexHome) options.codexHome = codexHome;
+  if (authFile) options.authFile = authFile;
+  if (configFile) options.configFile = configFile;
+  if (namespace) options.namespace = namespace;
+  if (secretName) options.secretName = secretName;
+  return renderCodexProviderSecretPlan(options);
+}
+
 async function startServer(args: ParsedArgs): Promise<JsonRecord> {
   const port = Number(flag(args, "port", "8080"));
   const host = flag(args, "host", "0.0.0.0");
@@ -156,6 +176,7 @@ function help(): JsonRecord {
       "commands show <commandId> --run-id <runId>",
       "runner start --run-id <runId>",
       "runner job --dry-run --run-id <runId> --command-id <commandId> --image <image>",
+      "secrets codex render --dry-run [--codex-home <dir>] [--namespace agentrun-v01] [--secret-name agentrun-v01-provider-codex]",
       "backends list",
       "server start|status",
     ],