fix(secrets): reject provider limit violations

steipete · steipete · commit 287ab97c75fb · 2026-07-17T04:54:01.000+01:00
diff --git a/src/secrets/resolve.ts b/src/secrets/resolve.ts
@@ -511,6 +511,7 @@ async function resolveExecRefs(params: {
   const ids = uniqueStrings(params.refs.map((ref) => ref.id));
   if (ids.length > params.limits.maxRefsPerProvider) {
     throw providerResolutionError({
+      code: "SECRET_PROVIDER_INVALID",
       source: "exec",
       provider: params.providerName,
       message: `Exec provider "${params.providerName}" exceeded maxRefsPerProvider (${params.limits.maxRefsPerProvider}).`,
@@ -544,6 +545,7 @@ async function resolveExecRefs(params: {
   const input = JSON.stringify(requestPayload);
   if (Buffer.byteLength(input, "utf8") > params.limits.maxBatchBytes) {
     throw providerResolutionError({
+      code: "SECRET_PROVIDER_INVALID",
       source: "exec",
       provider: params.providerName,
       message: `Exec provider "${params.providerName}" request exceeded maxBatchBytes (${params.limits.maxBatchBytes}).`,
@@ -763,6 +765,7 @@ function createProviderResolutionTasks(params: {
     (group) => async (): Promise<{ group: ProviderRefGroup; values: ProviderResolutionOutput }> => {
       if (group.refs.length > params.limits.maxRefsPerProvider) {
         throw providerResolutionError({
+          code: "SECRET_PROVIDER_INVALID",
           source: group.source,
           provider: group.providerName,
           message: `Secret provider "${group.providerName}" exceeded maxRefsPerProvider (${params.limits.maxRefsPerProvider}).`,
diff --git a/src/secrets/runtime.test.ts b/src/secrets/runtime.test.ts
@@ -439,6 +439,41 @@ describe("secrets runtime snapshot", () => {
     ).rejects.toThrow("Env secret reference id must match");
   });
 
+  it("keeps provider resolution limit violations fail-closed", async () => {
+    await expect(
+      prepareSecretsRuntimeSnapshot({
+        config: asConfig({
+          secrets: {
+            resolution: { maxRefsPerProvider: 1 },
+          },
+          models: {
+            providers: {
+              openai: {
+                apiKey: { source: "env", provider: "default", id: "OPENAI_API_KEY" },
+                baseUrl: "https://api.openai.com/v1",
+                models: [],
+              },
+            },
+          },
+          messages: {
+            tts: {
+              providers: {
+                elevenlabs: { apiKey: TTS_REF },
+              },
+            },
+          },
+        }),
+        env: {
+          OPENAI_API_KEY: "test-openai-api-key",
+          ELEVENLABS_API_KEY: "test-elevenlabs-api-key",
+        },
+        includeAuthStoreRefs: false,
+        allowUnavailableSecretOwners: true,
+        loadablePluginOrigins: EMPTY_LOADABLE_PLUGIN_ORIGINS,
+      }),
+    ).rejects.toThrow('Secret provider "default" exceeded maxRefsPerProvider (1).');
+  });
+
   it("keeps unconfigured SecretRef provider aliases fail-closed", async () => {
     await expect(
       prepareSecretsRuntimeSnapshot({
