feat(ai): vault_path secret resolver (env:/file:)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

tests/ai/secret.test.js

@@ -0,0 +1,30 @@
+import { describe, it, expect, beforeEach } from 'vitest';
+import { writeFileSync, mkdtempSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { resolveSecret } from '../../lib/ai/secret.js';
+
+describe('resolveSecret', () => {
+  beforeEach(() => { delete process.env.__SECRET_TEST; });
+
+  it('resolves env: specs', () => {
+    process.env.__SECRET_TEST = 'sk-from-env';
+    expect(resolveSecret('env:__SECRET_TEST')).toBe('sk-from-env');
+  });
+
+  it('resolves file: specs (trimmed)', () => {
+    const dir = mkdtempSync(join(tmpdir(), 'sec-'));
+    const f = join(dir, 'key');
+    writeFileSync(f, 'sk-from-file\n');
+    expect(resolveSecret('file:' + f)).toBe('sk-from-file');
+  });
+
+  it('returns a raw value unchanged', () => {
+    expect(resolveSecret('sk-raw')).toBe('sk-raw');
+  });
+
+  it('returns null for empty/missing', () => {
+    expect(resolveSecret('')).toBeNull();
+    expect(resolveSecret('env:__SECRET_TEST')).toBeNull();
+  });
+});