deploy: configure NC01 HWLAB monitor exposure

scripts/src/agentrun/control-plane.ts

@@ -45,6 +45,7 @@ export function parseSecretSyncOptions(args: string[]): SecretSyncOptions {
   const base = parseConfirmOptions(args);
   let node: string | null = null;
   let lane: string | null = null;
+  const secretIds: string[] = [];
   for (let index = 0; index < args.length; index += 1) {
     const arg = args[index];
     if (arg === "--confirm" || arg === "--dry-run") continue;
@@ -62,9 +63,17 @@ export function parseSecretSyncOptions(args: string[]): SecretSyncOptions {
       index += 1;
       continue;
     }
+    if (arg === "--secret-id") {
+      const value = args[index + 1];
+      if (value === undefined || value.startsWith("--")) throw new Error("--secret-id requires a value");
+      if (!/^[A-Za-z0-9._-]+$/u.test(value)) throw new Error("--secret-id must be a simple YAML secret id");
+      if (!secretIds.includes(value)) secretIds.push(value);
+      index += 1;
+      continue;
+    }
     throw new Error(`unsupported secret-sync option: ${arg}`);
   }
-  return { ...base, node, lane };
+  return { ...base, node, lane, secretIds };
 }
 
 export function parseLaneConfirmOptions(args: string[]): LaneConfirmOptions {