fix: sync agentrun v02 runner secrets

scripts/src/agentrun-lanes.ts

@@ -19,7 +19,8 @@ export interface AgentRunSecretRef {
 export interface AgentRunLaneSecretSpec {
   readonly id: string;
   readonly sourceRef: string;
-  readonly sourceKey: string;
+  readonly sourceMode: "env" | "file";
+  readonly sourceKey: string | null;
   readonly targetRef: AgentRunSecretRef;
 }
 
@@ -298,6 +299,7 @@ export function agentRunLaneSummary(spec: AgentRunLaneSpec): Record<string, unkn
     secrets: spec.secrets.map((secret) => ({
       id: secret.id,
       sourceRef: secret.sourceRef.startsWith("/") ? secret.sourceRef : `.state/secrets/${secret.sourceRef}`,
+      sourceMode: secret.sourceMode,
       sourceKey: secret.sourceKey,
       targetRef: secret.targetRef,
       valuesPrinted: false,
@@ -511,10 +513,15 @@ function parseImageBuild(input: Record<string, unknown>, path: string): AgentRun
 }
 
 function parseLaneSecret(input: Record<string, unknown>, path: string): AgentRunLaneSecretSpec {
+  const sourceMode = optionalStringField(input, "sourceMode", path) ?? "env";
+  if (sourceMode !== "env" && sourceMode !== "file") throw new Error(`${path}.sourceMode must be env or file`);
+  const sourceKey = optionalStringField(input, "sourceKey", path) ?? null;
+  if (sourceMode === "env" && sourceKey === null) throw new Error(`${path}.sourceKey is required when sourceMode is env`);
   return {
     id: stringField(input, "id", path),
     sourceRef: secretSourceRefField(input, "sourceRef", path),
-    sourceKey: stringField(input, "sourceKey", path),
+    sourceMode,
+    sourceKey,
     targetRef: parseNamespacedSecretRef(recordField(input, "targetRef", path), `${path}.targetRef`),
   };
 }