feat(secrets): apply a secret change instead of only storing it

Merged
CA
2mo ago
+253-22

What

insta secrets set FOO=bar wrote the row and exited zero while the running container kept serving the old value, with nothing on screen suggesting anything was outstanding.

This points insta secrets set and insta secrets unset at the platform's new POST /projects/{projectId}/apply, which writes the value and then redeploys the compute services that receive it. Needs instacloud-platform#464 on staging first.

An InstaCloud agent hit this in the field: its verification failed because the container never restarted, its follow-up source deploy was deduplicated to a no-op because the archive and image were unchanged, and it was about to force a fake build purely to trigger a rollout. That is the shape of workaround this removes.

How

Both commands now POST a single entry to /apply instead of calling the per-name secret routes. A set or delete with no --branch is project-wide, so the entry carries no branch field, which is the same scope rule the old routes applied, now stated in the body rather than implied by the URL.

The response reports per entry whether it was written and per service what happened to it, so the commands print one line per affected service. The distinction that matters is started: it means the service was down and this call brought it up, which costs money. A user who stops a service to save money should not discover from their bill that a variable change restarted it.

secretsSet gained an optional deps parameter so the new request body is testable, mirroring the pattern secretsUnset already used. Both real call sites still pass three arguments.

Deliberately out of scope, decided with the user: no --skip-deploys flag and no help-text rewrite. The API keeps skipDeploy and no client surfaces it yet, which means these commands now redeploy without their own help saying so. That is a decision rather than an oversight, and the follow-up is tracked with the rest of the CLI and MCP polish.

Verify

npm test          77 files, 1549 tests passed
npx tsc --noEmit  clean

The tests assert the exact request shape sent to /apply, and those shapes were checked against the platform's ApplyEntrySchema and route body schema rather than against a paraphrase. Neither suite hits a live platform, so a future platform-side shape change would not be caught here. That is a pre-existing gap in how these repos relate, since there are no shared generated types, and it is not something this change introduces.

Summary by cubic

Routes insta secrets set and insta secrets unset through POST /projects/{projectId}/apply, so a changed secret now redeploys the compute services that receive it. The commands also report when the write didn’t land or a service failed to redeploy, instead of exiting 0 while the running container kept serving the old value.

  • Prints one line per service outcome; started means the service was down and this call brought it up, which bills.
  • Exits 3 when the change is saved but a service failed or was skipped for an unrecognized reason, and 1 when the secret wasn’t written; JSON output includes the raw entries and services.
  • Requires instacloud-platform#464 to be live first.
  • No --skip-deploys flag and no help-text rewrite; the API’s skipDeploy stays unsurfaced, so commands now redeploy without their help text saying so.