secrets:read caller scopes + rt-client packaging honesty

[m4ttheweric]

The deck lane's rt half: secrets:read gains a caller-scope whitelist (extension default = the two existing keys; deck = the CF pair from the encrypted deck domain; structural per-scope isolation, token gate first on both transports, bad-scope refusal). rt-client: prepack build, an honest full-tree dist-freshness diff test, and the transport default-sock path moves to call-time resolution (the RED test reached the real socket, proving the hazard).

Gates: lib 1388/0, commands 70/0, packages 154/0, tsc 0.

🤖 Generated with Claude Code

Summary by CodeRabbit

• New Features

  • Added support for reading approved Cloudflare deck credentials through the secrets command.
  • Added optional secret scopes for extension and deck credentials, with scope-specific access controls and token protection.
  • Default socket resolution now respects the current home directory at command time.

• Bug Fixes

  • Package builds now run automatically before publishing.
  • Added checks to detect stale or missing compiled package artifacts.

[coderabbitai]

Caution

Review failed

The pull request is closed.

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: 64cebf32-8ef2-45c0-b107-cbbf05c709ed

📥 Commits

Reviewing files that changed from the base of the PR and between 71474d6 and 8ff86c7.

📒 Files selected for processing (8)

• extensions/vscode/rt-context/src/secretsMapping.ts
• lib/daemon/__tests__/secrets-handler.test.ts
• lib/daemon/handlers/secrets.ts
• packages/rt-client/package.json
• packages/rt-client/src/commands.ts
• packages/rt-client/src/transport.ts
• packages/rt-client/test/dist-freshness.test.ts
• packages/rt-client/test/transport.test.ts

---

📝 Walkthrough

Walkthrough

The daemon now supports token-gated extension and deck secret scopes. The client contract exposes both response shapes. The client resolves default sockets at invocation time and validates fresh distribution output.

Changes

Scoped secrets reads

Layer / File(s)	Summary
Daemon scoped secret handling lib/daemon/handlers/secrets.ts, lib/daemon/__tests__/secrets-handler.test.ts, extensions/vscode/rt-context/src/secretsMapping.ts	The daemon adds deck secret loading, scope validation, per-scope whitelists, token checks, and failure coverage.
Client secrets command contract packages/rt-client/src/commands.ts	secrets:read accepts optional extension or deck scopes and returns the matching secret shape.

rt-client runtime and distribution

Layer / File(s)	Summary
Dynamic default socket resolution packages/rt-client/src/transport.ts, packages/rt-client/test/transport.test.ts	rtCommand resolves the default socket from the current HOME value on each call.
Distribution build and freshness validation packages/rt-client/package.json, packages/rt-client/test/dist-freshness.test.ts	The package builds before packing, and tests compare committed dist/ files with fresh JavaScript and declaration output.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
participant Client
participant Daemon
participant SecretLoader
Client->>Daemon: secrets:read(scope, token)
Daemon->>Daemon: validate scope and token
Daemon->>SecretLoader: load selected secret domain
SecretLoader-->>Daemon: scoped secret values
Daemon-->>Client: whitelisted response

Loading

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch deck-secrets-whitelist

---

_{Comment @coderabbitai help to get the list of available commands.}