From 7c667401f4bc85358ccc69e01919e0edae223abc Mon Sep 17 00:00:00 2001
From: Codex <codex@noreply.local>
Date: Sun, 28 Jun 2026 01:26:01 +0000
Subject: [PATCH] fix: scope web sentinel runtime env injection

---
 scripts/src/hwlab-node-web-sentinel-cicd.ts | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/scripts/src/hwlab-node-web-sentinel-cicd.ts b/scripts/src/hwlab-node-web-sentinel-cicd.ts
index 515a234c..74e79d46 100644
--- a/scripts/src/hwlab-node-web-sentinel-cicd.ts
+++ b/scripts/src/hwlab-node-web-sentinel-cicd.ts
@@ -590,8 +590,9 @@ function sentinelContainerEnv(sentinelId: string, secrets: Record<string, unknow
       const targetKey = stringAtNullable(item, "targetKey");
       const sourcePurpose = stringAtNullable(item, "sourcePurpose");
       const sourceKey = sourcePurpose === null ? null : stringAtNullable(sourcesByPurpose.get(sourcePurpose), "sourceKey");
-      if (targetKey !== null && sourceKey !== null && /^[A-Za-z_][A-Za-z0-9_]*$/u.test(sourceKey)) {
-        pushEnv({ name: sourceKey, valueFrom: { secretKeyRef: { name: secretName, key: targetKey } } });
+      const sourceKeyEnvName = sourcePurpose === "bootstrap-admin" || sourcePurpose === "prompt-set" ? sourceKey : null;
+      if (targetKey !== null && sourceKeyEnvName !== null && /^[A-Za-z_][A-Za-z0-9_]*$/u.test(sourceKeyEnvName)) {
+        pushEnv({ name: sourceKeyEnvName, valueFrom: { secretKeyRef: { name: secretName, key: targetKey } } });
       }
       const envName = sourcePurpose === null || targetKey === null ? null : accountSecretEnvName(sourcePurpose, targetKey);
       if (envName === null) continue;