fix: 移除 provider Secret 旧阻断

scripts/src/agentrun/trigger.ts

@@ -39,7 +39,6 @@ import { triggerCurrentYamlLaneConfirmed } from "./cleanup-scripts";
 import { readAgentRunClientConfig } from "./config";
 import { displayValue } from "./options";
 import { pathValue } from "./render";
-import { providerSecretActivationPreflight, providerSecretDesiredEncodedFingerprint, providerSecretStagedActivation } from "./provider-activation";
 import { startAsyncAgentRunJob } from "./rest-bridge";
 import { collectLaneSecretSources, inspectSecretSourceValue, restartYamlLaneScript, secretSyncScript } from "./secrets";
 import { capture, captureJsonPayload, compactCapture, isGitSha, stringOrNull } from "./utils";
@@ -257,66 +256,7 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
     };
   }
   const values = inspected.map(({ spec: item, inspection }) => ({ spec: item, value: inspection.sourceValue! }));
-  const providerSecretsByTargetRef = new Map<string, AgentRunLaneSpec["secrets"][number]>();
-  for (const secret of spec.secrets) {
-    if (secret.providerCredentialProfile === null) continue;
-    const targetRef = laneSecretTargetRefKey(secret.targetRef);
-    const existing = providerSecretsByTargetRef.get(targetRef);
-    if (existing !== undefined) {
-      throw new Error(`provider Secret targetRef ${targetRef} is declared by both ${existing.id} and ${secret.id}`);
-    }
-    providerSecretsByTargetRef.set(targetRef, secret);
-  }
-  const providerValues = values.filter(({ spec: item }) => providerSecretsByTargetRef.has(laneSecretTargetRefKey(item.targetRef)));
-  const providerSecrets = providerValues.map(({ spec: item }) => providerSecretsByTargetRef.get(laneSecretTargetRefKey(item.targetRef))!);
-  const providerActivationTargets = providerValues.map(({ spec: item, value }) => {
-    return {
-      id: item.id,
-      targetRef: item.targetRef,
-      desiredEncodedFingerprint: providerSecretDesiredEncodedFingerprint(value.value),
-    };
-  });
-  const activationPreflight = providerValues.length > 0
-    ? await providerSecretActivationPreflight(config, spec, providerActivationTargets, { full: options.full || options.raw })
-    : null;
-  const syncValues = values.filter(({ spec: item }) => !providerSecretsByTargetRef.has(laneSecretTargetRefKey(item.targetRef)));
-  if (activationPreflight !== null && activationPreflight.ok !== true) {
-    const profiles = providerSecrets
-      .map((secret) => secret.providerCredentialProfile)
-      .filter((profile): profile is string => profile !== null);
-    return {
-      ok: false,
-      command: "agentrun control-plane secret-sync",
-      mode: options.dryRun || !options.confirm ? "dry-run-blocked-before-mutation" : "confirm-blocked-before-mutation",
-      status: "blocked",
-      mutation: false,
-      blockedBeforeMutation: true,
-      secretSyncStarted: false,
-      configPath,
-      target: { node: spec.nodeId, lane: spec.lane, namespace: spec.runtime.namespace, valuesPrinted: false },
-      degradedReason: activationPreflight.reason ?? "existing-runner-provider-secret-activation-risk",
-      filter: options.secretIds.length === 0 ? null : { secretIds: options.secretIds, selected: sources.map((source) => source.id) },
-      plan: {
-        secretCount: plan.length,
-        items: plan,
-        omittedCount: 0,
-        valuesPrinted: false,
-      },
-      activationPreflight,
-      execution: {
-        providerSecretClassification: "exact-target-ref",
-        providerSecretWriteBlockedCount: providerValues.length,
-        secretSyncStarted: false,
-        valuesPrinted: false,
-      },
-      stagedActivation: providerSecretStagedActivation(spec, profiles),
-      next: {
-        observeRunners: `bun scripts/cli.ts agentrun control-plane cleanup-runners --node ${spec.nodeId} --lane ${spec.lane} --dry-run`,
-        retryAfterManagerFence: `bun scripts/cli.ts agentrun control-plane secret-sync --node ${spec.nodeId} --lane ${spec.lane}${options.secretIds.map((id) => ` --secret-id ${id}`).join("")} --confirm`,
-      },
-      valuesPrinted: false,
-    };
-  }
+  const syncValues = values;
   if (options.dryRun || !options.confirm) {
     return {
       ok: true,
@@ -326,12 +266,9 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
       configPath,
       target: compactAgentRunLaneStatusTarget(spec),
       filter: options.secretIds.length === 0 ? null : { secretIds: options.secretIds, selected: sources.map((source) => source.id) },
-      plan: { secretCount: plan.length, items: plan, activationPreflight, valuesPrinted: false },
+      plan: { secretCount: plan.length, items: plan, valuesPrinted: false },
       execution: {
-        providerSecretClassification: "exact-target-ref",
-        providerSecretWritePolicy: "skip-exact-no-op-until-manager-activation-fence",
-        providerSecretWriteSkippedCount: providerValues.length,
-        writableNonProviderSecretCount: syncValues.length,
+        writableSecretCount: syncValues.length,
         valuesPrinted: false,
       },
       next: {
@@ -341,34 +278,6 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
       valuesPrinted: false,
     };
   }
-  if (syncValues.length === 0) {
-    return {
-      ok: true,
-      command: "agentrun control-plane secret-sync",
-      mode: "confirmed-provider-secret-no-op-skip",
-      mutation: false,
-      secretSyncStarted: false,
-      providerSecretWriteSkipped: providerValues.length > 0,
-      configPath,
-      target: compactAgentRunLaneStatusTarget(spec),
-      filter: options.secretIds.length === 0 ? null : { secretIds: options.secretIds, selected: sources.map((source) => source.id) },
-      plan: { secretCount: plan.length, items: plan, valuesPrinted: false },
-      activationPreflight,
-      result: {
-        ok: true,
-        status: "skipped-exact-provider-secret-no-op",
-        skippedProviderSecretCount: providerValues.length,
-        providerSecretClassification: "exact-target-ref",
-        reason: "provider-secret-writes-require-agentrun-manager-activation-fence",
-        runtimeSecretValuesDecoded: false,
-        valuesPrinted: false,
-      },
-      next: {
-        status: `bun scripts/cli.ts agentrun control-plane status --node ${spec.nodeId} --lane ${spec.lane}`,
-      },
-      valuesPrinted: false,
-    };
-  }
   const result = await capture(config, spec.nodeKubeRoute, ["sh", "--", secretSyncScript(spec, syncValues.map(({ spec: item, value }) => ({ targetRef: item.targetRef, value: value.value })))]);
   const payload = captureJsonPayload(result);
   return {
@@ -387,7 +296,6 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
       writableNonProviderSecretCount: syncValues.length,
       valuesPrinted: false,
     },
-    activationPreflight,
     result: payload,
     capture: compactCapture(result, { full: result.exitCode !== 0, stdoutTailChars: 3000, stderrTailChars: 3000 }),
     next: {
@@ -397,10 +305,6 @@ export async function secretSync(config: UniDeskConfig, options: SecretSyncOptio
   };
 }
 
-function laneSecretTargetRefKey(targetRef: { namespace: string; name: string; key: string }): string {
-  return `${targetRef.namespace}/${targetRef.name}/${targetRef.key}`;
-}
-
 export async function exposeAgentRun(_config: UniDeskConfig, options: ConfirmOptions): Promise<Record<string, unknown>> {
   const clientConfig = readAgentRunClientConfig();
   const exposure = clientConfig.publicExposure;