fix: support PK01 Codex pool sync

scripts/src/platform-infra-sub2api-codex/runtime-target.ts

@@ -41,6 +41,8 @@ export function readSub2ApiRuntimeConfig(): Sub2ApiRuntimeConfig {
   const secrets = runtime !== null && isRecord(runtime.secrets) ? runtime.secrets : null;
   const secretsRoot = secrets === null ? null : stringValue(secrets.root);
   if (secretsRoot === null || !secretsRoot.startsWith("/")) throw new Error(`${sub2apiConfigPath}.runtime.secrets.root must be an absolute path`);
+  const appSourceRef = secrets === null ? null : stringValue(secrets.appSourceRef);
+  if (appSourceRef === null || !/^[A-Za-z0-9_./-]+$/u.test(appSourceRef)) throw new Error(`${sub2apiConfigPath}.runtime.secrets.appSourceRef has an unsupported format`);
   const sentinel = runtime !== null && isRecord(runtime.sentinel) ? runtime.sentinel : null;
   const enabledOnTargets = Array.isArray(sentinel?.enabledOnTargets)
     ? sentinel.enabledOnTargets.map((entry) => stringValue(entry)).filter((entry): entry is string => entry !== null && entry.length > 0)
@@ -50,6 +52,7 @@ export function readSub2ApiRuntimeConfig(): Sub2ApiRuntimeConfig {
     defaultTargetId,
     appSecretName,
     secretsRoot,
+    appSourceRef,
     sentinelEnabledOnTargets: enabledOnTargets,
     targets: parsed.targets,
   };
@@ -99,9 +102,13 @@ export function codexPoolRuntimeTarget(targetId?: string): CodexPoolRuntimeTarge
   if (publicExposure !== null && publicExposure.enabled) publicBaseUrl = publicExposure.publicBaseUrl;
   const hostDocker = runtimeMode === "host-docker" && isRecord(raw.hostDocker) ? raw.hostDocker : null;
   const hostDockerAppPort = hostDocker === null ? null : numberValue(hostDocker.appPort);
+  const hostDockerEnvPath = hostDocker === null ? null : stringValue(hostDocker.envPath);
   if (runtimeMode === "host-docker" && (hostDockerAppPort === null || !Number.isInteger(hostDockerAppPort) || hostDockerAppPort < 1 || hostDockerAppPort > 65535)) {
     throw new Error(`${sub2apiConfigPath}.targets[${id}].hostDocker.appPort must be an integer TCP port when runtimeMode=host-docker`);
   }
+  if (runtimeMode === "host-docker" && (hostDockerEnvPath === null || !hostDockerEnvPath.startsWith("/"))) {
+    throw new Error(`${sub2apiConfigPath}.targets[${id}].hostDocker.envPath must be an absolute path when runtimeMode=host-docker`);
+  }
 
   return {
     id,
@@ -114,6 +121,9 @@ export function codexPoolRuntimeTarget(targetId?: string): CodexPoolRuntimeTarge
     publicExposure,
     appSecretName: runtimeConfig.appSecretName,
     secretsRoot: runtimeConfig.secretsRoot,
+    appSourceRef: runtimeConfig.appSourceRef,
+    hostDockerAppPort,
+    hostDockerEnvPath,
     sentinelEnabled,
     sentinelImageBuild,
     egressProxy,