0.27.1 — flat Infisical keys (_), seed-secrets.sh in deploy, plist cleanup, .env strip

scripts/deploy.sh

@@ -51,10 +51,14 @@ echo "[6/6] health check"
 for i in $(seq 1 $RETRIES); do
     if curl -sf "$HEALTH_URL" > /dev/null 2>&1; then
         echo "healthy after ${i}s"
-        exit 0
+        break
     fi
     sleep "$SLEEP"
 done
 
-echo "ERROR: health check failed after $((RETRIES * SLEEP))s"
-exit 1
+# 7. Seed secrets into Infisical (idempotent)
+echo "[7/7] seed secrets"
+docker compose exec -T api oikos secret list > /dev/null 2>&1 && \
+    docker compose cp scripts/seed-secrets.sh api:/opt/oikos/scripts/seed-secrets.sh 2>/dev/null && \
+    docker compose exec -T api /opt/oikos/scripts/seed-secrets.sh || \
+    echo "WARNING: secret seeding skipped (infisical not reachable)"

scripts/deploy/network.hubris.oikos-deploy-webhook.plist

@@ -10,8 +10,16 @@
     </array>
     <key>EnvironmentVariables</key>
     <dict>
-        <key>WEBHOOK_HMAC_SECRET</key>
-        <string>6502524162d6dbc3f6d137000395d401f1837d74ef9bb0a876f8e6bbd65d1ff2</string>
+        <key>OIKOS_INFISICAL_SITE_URL</key>
+        <string>http://localhost:8080</string>
+        <key>OIKOS_INFISICAL_CLIENT_ID</key>
+        <string>82e6e362-bbee-4f22-b44e-215c85bdb14a</string>
+        <key>OIKOS_INFISICAL_CLIENT_SECRET</key>
+        <string>aa7c928b366591741e4fa99016c5644fc6119b4174ba0dab3570db1229e0bdf1</string>
+        <key>OIKOS_INFISICAL_PROJECT_ID</key>
+        <string>a436936f-6610-4698-9075-76013af7c68e</string>
+        <key>OIKOS_INFISICAL_ENV</key>
+        <string>dev</string>
         <key>WEBHOOK_REPO_DIR</key>
         <string>/Users/dtoro/Projects/oikos</string>
         <key>WEBHOOK_LISTEN</key>

scripts/seed-secrets.sh

@@ -0,0 +1,44 @@
+#!/bin/sh
+# One-shot: populate Infisical with oikos secrets from env vars.
+# Designed to run inside the oikos-api container where Infisical is reachable.
+# Safe to re-run (set is idempotent).
+#
+# Usage: docker exec oikos-api-1 /opt/oikos/scripts/seed-secrets.sh
+#
+# Secrets are read from the container environment (set via docker-compose).
+# If a secret is already in Infisical, it is updated in place.
+
+set -e
+
+echo "=== seed-secrets: $(date) ==="
+
+KEYS="
+matrix_token:${OIKOS_MATRIX_TOKEN:-}
+approval_hmac-secret:${OIKOS_APPROVAL_HMAC_SECRET:-}
+mcp_bearer-token:${OIKOS_MCP_BEARER_TOKEN:-}
+api_token:${OIKOS_API_TOKEN:-}
+oidc_client-secret:${OIKOS_OIDC_CLIENT_SECRET:-}
+openrouter_api-key:${OPENROUTER_API_KEY:-}
+webhook_hmac-secret:${WEBHOOK_HMAC_SECRET:-}
+"
+
+set_count=0
+skip_count=0
+
+echo "$KEYS" | while IFS=: read -r key value; do
+    [ -z "$key" ] && continue
+    if [ -z "$value" ]; then
+        echo "SKIP: $key (env var empty/missing)"
+        skip_count=$((skip_count + 1))
+        continue
+    fi
+    if oikos secret set "$key" "$value" 2>/dev/null; then
+        echo "SET:  $key"
+        set_count=$((set_count + 1))
+    else
+        echo "FAIL: $key"
+    fi
+done
+
+echo ""
+echo "seed-secrets complete: $set_count set, $skip_count skipped"