0.27.1 — flat Infisical keys (_), seed-secrets.sh in deploy, plist cleanup, .env strip

cmd/nomos/main.go

@@ -63,11 +63,11 @@ func main() {
 	var secretsResolved int
 	if sec != nil {
 		resCtx, resCancel := context.WithTimeout(context.Background(), 10*time.Second)
-		if v := secrets.ResolveSecret(resCtx, sec, "mcp/bearer-token", ""); v != "" {
+		if v := secrets.ResolveSecret(resCtx, sec, "mcp_bearer-token", ""); v != "" {
 			mcpToken = v
 			secretsResolved++
 		}
-		openrouterAPIKey = secrets.ResolveSecret(resCtx, sec, "openrouter/api-key", os.Getenv("OPENROUTER_API_KEY"))
+		openrouterAPIKey = secrets.ResolveSecret(resCtx, sec, "openrouter_api-key", os.Getenv("OPENROUTER_API_KEY"))
 		if openrouterAPIKey != "" && openrouterAPIKey != os.Getenv("OPENROUTER_API_KEY") {
 			secretsResolved++
 		}

cmd/oikos/main.go

@@ -53,18 +53,18 @@ func main() {
 	)
 	if sec != nil {
 		overlays := secrets.ConfigOverlays(map[string]func(string){
-			"matrix/token":         func(v string) { cfg.MatrixToken = v },
-			"approval/hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
-			"mcp/bearer-token":     func(v string) { cfg.MCPBearerToken = v },
-			"api/token":            func(v string) { cfg.APIToken = v },
-			"oidc/client-secret":   func(v string) { cfg.OIDCClientSecret = v },
+			"matrix_token":         func(v string) { cfg.MatrixToken = v },
+			"approval_hmac-secret": func(v string) { cfg.ApprovalHMACSecret = v },
+			"mcp_bearer-token":     func(v string) { cfg.MCPBearerToken = v },
+			"api_token":            func(v string) { cfg.APIToken = v },
+			"oidc_client-secret":   func(v string) { cfg.OIDCClientSecret = v },
 		})
 		n := secrets.OverlayConfig(ctx, sec, overlays)
 		slog.Info("secrets resolved from Infisical", "count", n)
 
 		secrets.VerifyExpectedSecrets(ctx, sec, []string{
-			"matrix/token", "approval/hmac-secret", "mcp/bearer-token",
-			"api/token", "oidc/client-secret", "openrouter/api-key", "webhook/hmac-secret",
+			"matrix_token", "approval_hmac-secret", "mcp_bearer-token",
+			"api_token", "oidc_client-secret", "openrouter_api-key", "webhook_hmac-secret",
 		})
 	}
 
@@ -381,13 +381,13 @@ func runSecret(ctx context.Context, cfg config.Config) {
 // expectedSecrets is the set of keys that should exist in Infisical
 // for a fully-migrated deployment.
 var expectedSecrets = []string{
-	"matrix/token",
-	"approval/hmac-secret",
-	"mcp/bearer-token",
-	"api/token",
-	"oidc/client-secret",
-	"openrouter/api-key",
-	"webhook/hmac-secret",
+	"matrix_token",
+	"approval_hmac-secret",
+	"mcp_bearer-token",
+	"api_token",
+	"oidc_client-secret",
+	"openrouter_api-key",
+	"webhook_hmac-secret",
 }
 
 // runSecretVerify checks that all expected secrets are present in Infisical.
@@ -425,11 +425,11 @@ func runSecretAudit(ctx context.Context, cfg config.Config) {
 	backend := newInfisicalBackendOrFail(cfg)
 
 	envValues := map[string]string{
-		"matrix/token":         cfg.MatrixToken,
-		"approval/hmac-secret": cfg.ApprovalHMACSecret,
-		"mcp/bearer-token":     cfg.MCPBearerToken,
-		"api/token":            cfg.APIToken,
-		"oidc/client-secret":   cfg.OIDCClientSecret,
+		"matrix_token":         cfg.MatrixToken,
+		"approval_hmac-secret": cfg.ApprovalHMACSecret,
+		"mcp_bearer-token":     cfg.MCPBearerToken,
+		"api_token":            cfg.APIToken,
+		"oidc_client-secret":   cfg.OIDCClientSecret,
 	}
 
 	fmt.Println("key                           infisical  env        status")

cmd/webhook/main.go

@@ -32,7 +32,7 @@ func main() {
 
 	secret := resolveWebhookHMAC(ctx)
 	if secret == "" {
-		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook/hmac-secret)")
+		fmt.Fprintln(os.Stderr, "WEBHOOK_HMAC_SECRET must be set (env var or Infisical webhook_hmac-secret)")
 		os.Exit(1)
 	}
 
@@ -111,5 +111,5 @@ func resolveWebhookHMAC(ctx context.Context) string {
 		os.Getenv("OIKOS_SECRETS_DIR"),
 	)
 	envFallback := os.Getenv("WEBHOOK_HMAC_SECRET")
-	return secrets.ResolveSecret(ctx, sec, "webhook/hmac-secret", envFallback)
+	return secrets.ResolveSecret(ctx, sec, "webhook_hmac-secret", envFallback)
 }