feat(secrets): repository secrets and variables for agent shells and terminals

backend/src/db/migrations/202610181400-secrets.ts

@@ -0,0 +1,26 @@
+import type { Migration } from '../migration-runner'
+
+const migration: Migration = {
+  id: '202610181400-secrets',
+  up(db) {
+    db.run(`
+      CREATE TABLE IF NOT EXISTS secrets (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        kind TEXT NOT NULL CHECK (kind IN ('secret','variable')),
+        repo_id INTEGER REFERENCES repos(id) ON DELETE CASCADE,
+        environment TEXT NOT NULL DEFAULT '',
+        name TEXT NOT NULL,
+        value TEXT NOT NULL,
+        created_at INTEGER NOT NULL,
+        updated_at INTEGER NOT NULL
+      )
+    `)
+
+    db.run('CREATE UNIQUE INDEX IF NOT EXISTS idx_secrets_scope ON secrets(kind, COALESCE(repo_id, 0), environment, name)')
+  },
+  down(db) {
+    db.run('DROP TABLE IF EXISTS secrets')
+  },
+}
+
+export default migration

backend/src/db/migrations/202610181410-secrets-global-scope-index.ts

@@ -0,0 +1,57 @@
+import type { Database } from 'bun:sqlite'
+import type { Migration } from '../migration-runner'
+import { GLOBAL_SECRETS_SCOPE_ID } from '../secrets-scope'
+
+const LEGACY_GLOBAL_SCOPE_ID = 0
+
+function rebuildScopeIndex(db: Database, globalScopeId: number): void {
+  db.run('DROP INDEX IF EXISTS idx_secrets_scope')
+  db.run(
+    `CREATE UNIQUE INDEX idx_secrets_scope ON secrets(kind, COALESCE(repo_id, ${globalScopeId}), environment, name)`,
+  )
+}
+
+/**
+ * Deletes the rows the legacy scope key cannot hold.
+ *
+ * The legacy index merged global rows (`repo_id IS NULL`) with the Assistant repository's scope
+ * (`repo_id = 0`), and the old upsert let the last write win, so the newest row of each merged
+ * group is the state legacy code would hold. Ordering by `updated_at`, then `id`, keeps that row
+ * and deletes the rest, which lets the legacy unique index be recreated.
+ */
+function collapseLegacyScopeDuplicates(db: Database): void {
+  db.run(`
+    DELETE FROM secrets
+    WHERE (repo_id IS NULL OR repo_id = ${LEGACY_GLOBAL_SCOPE_ID})
+      AND EXISTS (
+        SELECT 1
+        FROM secrets AS newer
+        WHERE (newer.repo_id IS NULL OR newer.repo_id = ${LEGACY_GLOBAL_SCOPE_ID})
+          AND newer.kind = secrets.kind
+          AND newer.environment = secrets.environment
+          AND newer.name = secrets.name
+          AND (
+            newer.updated_at > secrets.updated_at
+            OR (newer.updated_at = secrets.updated_at AND newer.id > secrets.id)
+          )
+      )
+  `)
+}
+
+export const secretsGlobalScopeIndexMigration: Migration = {
+  id: '202610181410-secrets-global-scope-index',
+  up(db) {
+    rebuildScopeIndex(db, GLOBAL_SECRETS_SCOPE_ID)
+  },
+  down(db) {
+    db.run('BEGIN TRANSACTION')
+    try {
+      collapseLegacyScopeDuplicates(db)
+      rebuildScopeIndex(db, LEGACY_GLOBAL_SCOPE_ID)
+      db.run('COMMIT')
+    } catch (error) {
+      db.run('ROLLBACK')
+      throw error
+    }
+  },
+}

backend/src/db/migrations/index.ts

@@ -37,6 +37,8 @@ import migration202610181200 from './202610181200-opencode-servers'
 import migration202610181300 from './202610181300-session-server-scope'
 import migration202610181310 from './202610181310-multi-run-targets'
 import migration202610181320 from './202610181320-remote-schedule-targets'
+import migration202610181400 from './202610181400-secrets'
+import { secretsGlobalScopeIndexMigration } from './202610181410-secrets-global-scope-index'
 
 export const allMigrations: Migration[] = [
   migration001,
@@ -77,4 +79,6 @@ export const allMigrations: Migration[] = [
   migration202610181300,
   migration202610181310,
   migration202610181320,
+  migration202610181400,
+  secretsGlobalScopeIndexMigration,
 ]

backend/src/db/queries.ts

@@ -4,6 +4,7 @@ import { getReposPath } from '@opencode-manager/shared/config/env'
 import { ASSISTANT_REPO_ID, ASSISTANT_REPO_PATH, getRepoDisplayName } from '@opencode-manager/shared/utils'
 import { getErrorMessage } from '../utils/error-utils'
 import { canonicalPathSync } from '../utils/fs-safe'
+import { invalidateRepoEnvCache } from '../utils/repo-env-cache'
 import path from 'path'
 
 interface RepoRow {
@@ -93,6 +94,12 @@ export function setRepoSandboxGitCredentials(db: Database, repoId: number, allow
   setRepoSetting(db, repoId, REPO_SANDBOX_GIT_CREDENTIALS_SETTING_KEY, allowed === null ? null : String(allowed))
 }
 
+export function getRepoByExactDirectory(db: Database, directory: string): Repo | null {
+  const resolvedDirectory = canonicalPathSync(path.resolve(directory))
+
+  return listRepos(db).find((repo) => canonicalPathSync(path.resolve(repo.fullPath)) === resolvedDirectory) ?? null
+}
+
 export function getRepoByDirectory(db: Database, directory: string): Repo | null {
   const resolvedDirectory = canonicalPathSync(path.resolve(directory))
   const repos = listRepos(db)
@@ -185,6 +192,7 @@ export function ensureAssistantRepo(db: Database): Repo {
 }
 
 export function createRepo(db: Database, repo: CreateRepoInput): Repo {
+  invalidateRepoEnvCache()
   const normalizedPath = repo.localPath.trim().replace(/\/+$/, '')
 
   const existing = repo.isLocal 
@@ -351,10 +359,12 @@ export function deleteRepo(db: Database, id: number): void {
     db.prepare('DELETE FROM multi_run_fusions WHERE multi_run_id IN (SELECT id FROM multi_runs WHERE repo_id = ?)').run(id)
     db.prepare('DELETE FROM multi_run_entries WHERE multi_run_id IN (SELECT id FROM multi_runs WHERE repo_id = ?)').run(id)
     db.prepare('DELETE FROM multi_runs WHERE repo_id = ?').run(id)
+    db.prepare('DELETE FROM secrets WHERE repo_id = ?').run(id)
     for (const table of TABLES_WITH_REPO_ID) {
       db.prepare(`DELETE FROM ${table} WHERE repo_id = ?`).run(id)
     }
     db.prepare('DELETE FROM repos WHERE id = ?').run(id)
   })
   remove()
+  invalidateRepoEnvCache()
 }

backend/src/db/secrets-scope.ts

@@ -0,0 +1,7 @@
+/**
+ * Repo scope stored in place of a NULL `repo_id` for global secrets, so the unique scope index
+ * and its conflict target treat every global entry as one scope while repository scopes keep
+ * their own. Real repo ids are `0` (the Assistant repository) or positive, so a negative
+ * sentinel can never collide with one.
+ */
+export const GLOBAL_SECRETS_SCOPE_ID = -1

backend/src/index.ts

@@ -46,6 +46,7 @@ import { createChangeWalkthroughRoutes } from './routes/change-walkthroughs'
 import { getChangeWalkthroughByWalkthroughSession } from './db/change-walkthroughs'
 import { createLogRoutes } from './routes/logs'
 import { createPreviewRoutes, createPreviewAvailability } from './routes/preview'
+import { createGlobalSecretRoutes } from './routes/secrets'
 import { createPreviewGatewayApp, PreviewSessionStore } from './services/preview/gateway'
 import { createInternalRoutes } from './routes/internal'
 import { sweepStaleUploadSessions } from './routes/internal/repo-mirror-helpers'
@@ -76,6 +77,8 @@ import { ScheduleRunner, ScheduleService } from './services/schedules'
 import { CredentialProvider } from './services/credential-provider'
 import { TerminalService } from './services/terminal'
 import { ProjectConfigService } from './services/project-config'
+import { SecretsService } from './services/secrets'
+import { RepoEnvService } from './services/repo-env'
 import { RepoWorkspaceService } from './services/repo-workspace'
 import { createGitService } from './services/git/GitService'
 import { ScheduleWorktreeManager } from './services/schedule-worktree'
@@ -141,6 +144,10 @@ import { DEFAULT_AGENTS_MD } from './constants'
 
 let ipcServer: IPCServer | undefined
 const gitAuthService = new GitAuthService()
+const gitService = createGitService(gitAuthService)
+const projectConfigService = new ProjectConfigService(db, gitService, gitAuthService)
+const secretsService = new SecretsService(db)
+const repoEnvService = new RepoEnvService(db, projectConfigService, secretsService)
 let openCodeSupervisor: OpenCodeSupervisor | undefined
 async function ensureOpenCodeConfigFileExists(): Promise<void> {
   await withOpenCodeConfigLock(foldLegacyConfigJsonSource)
@@ -239,7 +246,7 @@ try {
 
   opencodeServerManager.setDatabase(db)
   detectSandboxCapability()
-  void new SandboxRuntimeService(db).prepareSandboxOnBoot().catch((error) => {
+  void new SandboxRuntimeService(db, repoEnvService).prepareSandboxOnBoot().catch((error) => {
     logger.warn('Sandbox preparation failed:', error)
   })
   const openCodeStatus = await openCodeSupervisor.start()
@@ -257,20 +264,19 @@ const terminalService = new TerminalService(
   {
     client: openCodeClient,
     baseUrl: () => getOpenCodeUpstreamBaseUrl(opencodeServerManager.getEffectiveServerHost()),
-    includeLocalCredentials: true,
+    includeLocalEnv: true,
   },
   new CredentialProvider(db),
+  repoEnvService,
 )
 const resolveServerTerminalService = (serverId: string): TerminalService => {
   const connection = opencodeServerRegistry.getConnection(serverId)
   return terminalService.forTarget({
     client: opencodeServerRegistry.getClient(serverId),
     baseUrl: () => connection.baseUrl,
-    includeLocalCredentials: false,
+    includeLocalEnv: false,
   })
 }
-const gitService = createGitService(gitAuthService)
-const projectConfigService = new ProjectConfigService(db, gitService, gitAuthService)
 const scheduleWorktreeManager = new ScheduleWorktreeManager(gitAuthService, db)
 const scheduleService = new ScheduleService(db, openCodeClient, scheduleWorktreeManager, opencodeServerRegistry)
 scheduleService.setWorktreeRemovedHandler(async (directory) => {
@@ -385,14 +391,14 @@ app.route('/api/auth-info', createAuthInfoRoutes(auth, db))
 app.route('/api/health', createHealthRoutes(db, openCodeSupervisor))
 
 app.route('/api/mcp-oauth-proxy', createMcpOauthProxyRoutes(openCodeClient, requireAuth))
-app.route('/api/internal', createInternalRoutes(db, scheduleService, notificationService, settingsService, openCodeClient, sessionPermissionModeService, repoWorkspaces, gitAuthService, sessionGoalService, multiRunService, changeWalkthroughService, sessionSandboxService))
+app.route('/api/internal', createInternalRoutes(db, scheduleService, notificationService, settingsService, openCodeClient, sessionPermissionModeService, repoWorkspaces, gitAuthService, sessionGoalService, multiRunService, changeWalkthroughService, sessionSandboxService, repoEnvService))
 app.route('/api/opencode-proxy', createOpenCodeProxyRoutes(db, settingsService, upgradeWebSocket))
 
 const protectedApi = new Hono()
 protectedApi.use('/*', requireAuth)
 
 protectedApi.route('/repos', createRepoTerminalSocketRoutes(db, gitAuthService, openCodeClient, terminalService, upgradeWebSocket))
-protectedApi.route('/repos', createRepoRoutes(db, gitAuthService, scheduleService, openCodeClient, terminalService, projectConfigService, repoWorkspaces))
+protectedApi.route('/repos', createRepoRoutes(db, gitAuthService, scheduleService, openCodeClient, terminalService, projectConfigService, repoWorkspaces, secretsService))
 protectedApi.route('/settings', createSettingsRoutes(db, gitAuthService, openCodeClient, openCodeSupervisor))
   protectedApi.route('/files', createFileRoutes())
   protectedApi.route('/filesystem', createFilesystemRoutes())
@@ -404,6 +410,8 @@ protectedApi.route('/sse', createSSERoutes())
 protectedApi.route('/ssh', createSSHRoutes(gitAuthService))
 protectedApi.route('/notifications', createNotificationRoutes(notificationService))
 protectedApi.route('/prompt-templates', createPromptTemplateRoutes(db))
+protectedApi.route('/secrets', createGlobalSecretRoutes(secretsService, 'secret'))
+protectedApi.route('/variables', createGlobalSecretRoutes(secretsService, 'variable'))
 protectedApi.route('/session-pins', createSessionPinRoutes(db))
 protectedApi.route('/opencode-servers/:serverId/schedules', createServerScheduleRoutes(scheduleService))
 protectedApi.route('/opencode-servers', createOpenCodeServerTerminalSocketRoutes(resolveServerTerminalService, upgradeWebSocket))

backend/src/routes/internal/git-credentials.ts

@@ -2,6 +2,12 @@ import { Hono } from 'hono'
 import type { Database } from 'bun:sqlite'
 import { CredentialProvider } from '../../services/credential-provider'
 
+/**
+ * Legacy GitHub CLI environment route, kept for one release for OpenCode
+ * processes that were adopted before the upgrade: those processes still run the
+ * removed gh-env plugin and keep calling this path, so it answers with the same
+ * flat env a fresh install fetches from `/shell-env`.
+ */
 export function createInternalGitCredentialsRoutes(db: Database) {
   const app = new Hono()
 

backend/src/routes/internal/index.ts

@@ -15,6 +15,7 @@ import { createInternalRepoMirrorRoutes as mirrorRoutes } from './repo-mirror'
 import { createInternalOpenCodeWorkspacesRoutes } from './opencode-workspaces'
 import { createInternalSessionRoutes } from './sessions'
 import { createInternalAssistantRoutes } from './assistant'
+import { createInternalShellEnvRoutes } from './shell-env'
 import { createInternalGitCredentialsRoutes } from './git-credentials'
 import { createInternalSandboxRoutes } from './sandbox'
 import { createInternalSessionArtifactRoutes } from './session-artifacts'
@@ -29,6 +30,7 @@ import type { GitAuthService } from '../../services/git-auth'
 import type { SessionGoalService } from '../../services/session-goals'
 import type { MultiRunService } from '../../services/multi-runs'
 import type { ChangeWalkthroughService } from '../../services/change-walkthroughs'
+import type { RepoEnvService } from '../../services/repo-env'
 
 export function createInternalRoutes(
   db: Database,
@@ -43,6 +45,7 @@ export function createInternalRoutes(
   multiRuns: MultiRunService,
   changeWalkthroughService: ChangeWalkthroughService,
   sessionSandbox: SessionSandboxService,
+  repoEnvService: RepoEnvService,
 ) {
   const app = new Hono()
   app.use('/*', createInternalTokenMiddleware(db))
@@ -64,7 +67,8 @@ export function createInternalRoutes(
   app.route('/change-walkthroughs', createChangeWalkthroughRoutes(changeWalkthroughService))
   app.route('/walkthrough-sessions', createInternalWalkthroughSessionRoutes(changeWalkthroughService))
   app.route('/session-artifacts', createInternalSessionArtifactRoutes(openCodeClient))
+  app.route('/shell-env', createInternalShellEnvRoutes(db, repoEnvService))
   app.route('/git-credentials', createInternalGitCredentialsRoutes(db))
-  app.route('/sandbox', createInternalSandboxRoutes(db, sessionSandbox))
+  app.route('/sandbox', createInternalSandboxRoutes(db, sessionSandbox, repoEnvService))
   return app
 }

backend/src/routes/internal/sandbox.ts

@@ -3,6 +3,7 @@ import { z } from 'zod'
 import type { Database } from 'bun:sqlite'
 import { SandboxRuntimeService } from '../../services/sandbox/runtime'
 import type { SessionSandboxService } from '../../services/session-sandbox'
+import type { RepoEnvService } from '../../services/repo-env'
 import { logger } from '../../utils/logger'
 
 const SandboxShellRequestSchema = z.object({
@@ -12,7 +13,11 @@ const SandboxShellRequestSchema = z.object({
   enforced: z.boolean().optional(),
 })
 
-export function createInternalSandboxRoutes(db: Database, sessionSandbox: SessionSandboxService) {
+export function createInternalSandboxRoutes(
+  db: Database,
+  sessionSandbox: SessionSandboxService,
+  repoEnvService: RepoEnvService,
+) {
   const app = new Hono()
 
   app.get('/sessions/:sessionId', async (c) => {
@@ -40,7 +45,7 @@ export function createInternalSandboxRoutes(db: Database, sessionSandbox: Sessio
     try {
       const target = await sessionSandbox.resolveShellTarget(parsed.data.sessionId)
       return c.json(
-        await new SandboxRuntimeService(db).planShell(
+        await new SandboxRuntimeService(db, repoEnvService).planShell(
           parsed.data.directory,
           { ...target, locationDirectory: parsed.data.locationDirectory },
           parsed.data.enforced === true,

backend/src/routes/internal/shell-env.ts

@@ -0,0 +1,22 @@
+import { Hono } from 'hono'
+import type { Database } from 'bun:sqlite'
+import { CredentialProvider } from '../../services/credential-provider'
+import type { RepoEnvService } from '../../services/repo-env'
+
+export function createInternalShellEnvRoutes(db: Database, repoEnvService: RepoEnvService) {
+  const app = new Hono()
+
+  app.get('/', async (c) => {
+    const provider = new CredentialProvider(db)
+    const cwd = c.req.query('cwd')
+    const ghEnv = provider.getGhCliEnv({ cwd })
+    if (!cwd || c.req.query('sandboxed') === '1') {
+      return c.json({ env: ghEnv, mask: [] })
+    }
+
+    const repoEnv = await repoEnvService.resolveForDirectory(cwd)
+    return c.json({ env: { ...ghEnv, ...repoEnv.env }, mask: repoEnv.maskValues })
+  })
+
+  return app
+}

backend/src/routes/repos.test.ts

@@ -8,6 +8,7 @@
 import { createStubOpenCodeClient } from '../../test/helpers/stub-opencode-client'
 import { createGitService } from '../services/git/GitService'
 import { ProjectConfigService } from '../services/project-config'
+import type { SecretsService } from '../services/secrets'
 import { RepoWorkspaceService } from '../services/repo-workspace'
 import type { GitAuthService } from '../services/git-auth'
 import type { TerminalService } from '../services/terminal'
@@ -31,8 +32,8 @@
 
 beforeEach(() => {
   mock.module('../services/project-id-resolver', () => ({
     resolveProjectId: (() => null) as any,
     isGitMainCheckout: (() => Promise.resolve(false)) as any,
   }))
 })
 
@@ -65,10 +66,10 @@
     updateSchedule: () => {},
     deleteSchedule: () => {},
     prepareRepoDelete: async () => {},
   } as any
   const projectConfigService = new ProjectConfigService(db, createGitService(stubGitAuthService), stubGitAuthService)
   const repoWorkspaces = new RepoWorkspaceService(db, openCodeClient, stubGitAuthService, projectConfigService, terminalService, scheduleService)
-  app.route('/repos', createRepoRoutes(db, stubGitAuthService, scheduleService, openCodeClient, terminalService, projectConfigService, repoWorkspaces))
+  app.route('/repos', createRepoRoutes(db, stubGitAuthService, scheduleService, openCodeClient, terminalService, projectConfigService, repoWorkspaces, {} as unknown as SecretsService))
   return app
 }
 
@@ -102,8 +103,8 @@
     mock.module('../services/project-id-resolver', () => ({
       resolveProjectId: ((path: string) => Promise.resolve(
         path.includes('repo-unrelated') ? 'commit-B' : 'commit-A'
       )) as any,
       isGitMainCheckout: (() => Promise.resolve(false)) as any,
     }))
 
     createRepo(db, { localPath: 'repo-a', defaultBranch: 'main', cloneStatus: 'ready', clonedAt: Date.now(), isLocal: true })
@@ -120,8 +121,8 @@
 
   it('includes OpenCode worktrees that are not manager repo rows', async () => {
     mock.module('../services/project-id-resolver', () => ({
       resolveProjectId: (() => Promise.resolve('commit-A')) as any,
       isGitMainCheckout: (() => Promise.resolve(false)) as any,
     }))
 
     createRepo(db, { localPath: 'repo-a', defaultBranch: 'main', cloneStatus: 'ready', clonedAt: Date.now(), isLocal: true })
@@ -130,7 +131,7 @@
     client.api.worktree.list = mock(async () => ([{
       directory: worktreeDir,
       strategy: 'plugin-strategy',
     }])) as any
     app = createTestApp(db, client)
 
     const res = await app.request('/repos/1/siblings')
@@ -148,8 +149,8 @@
 
   it('deduplicates OpenCode worktrees with the same directory', async () => {
     mock.module('../services/project-id-resolver', () => ({
       resolveProjectId: (() => Promise.resolve('commit-A')) as any,
       isGitMainCheckout: (() => Promise.resolve(false)) as any,
     }))
 
     createRepo(db, { localPath: 'repo-a', defaultBranch: 'main', cloneStatus: 'ready', clonedAt: Date.now(), isLocal: true })

backend/src/routes/repos.ts

@@ -18,10 +18,12 @@ import { isWorktreeError, openCodeLocation } from '@opencode-manager/shared/open
 import { createRepoGitRoutes } from './repo-git'
 import { createRepoTerminalRoutes } from './repo-terminals'
 import { createRepoProjectConfigRoutes } from './repo-project-config'
+import { createRepoSecretRoutes } from './secrets'
 import { createScheduleRoutes } from './schedules'
 import type { GitAuthService } from '../services/git-auth'
 import type { TerminalService } from '../services/terminal'
 import type { ProjectConfigService } from '../services/project-config'
+import type { SecretsService } from '../services/secrets'
 import type { RepoWorkspaceService } from '../services/repo-workspace'
 import { createGitService } from '../services/git/GitService'
 import { ScheduleService } from '../services/schedules'
@@ -47,6 +49,7 @@ export function createRepoRoutes(
   terminalService: TerminalService,
   projectConfigService: ProjectConfigService,
   repoWorkspaces: RepoWorkspaceService,
+  secretsService: SecretsService,
 ) {
   const app = new Hono()
   const git = createGitService(gitAuthService)
@@ -55,6 +58,8 @@ export function createRepoRoutes(
   app.route('/', createRepoTerminalRoutes(database, gitAuthService, openCodeClient, terminalService))
   app.route('/', createRepoProjectConfigRoutes(database, gitAuthService, openCodeClient, projectConfigService, terminalService))
   app.route('/:id/schedules', createScheduleRoutes(scheduleService))
+  app.route('/', createRepoSecretRoutes({ database, projectConfigService, secretsService }, 'secret'))
+  app.route('/', createRepoSecretRoutes({ database, projectConfigService, secretsService }, 'variable'))
 
   app.post('/', async (c) => {
     try {