fix(cli): generate per-install secrets instead of using fixed values

[waleedlatif1]

Summary

• The launcher passed the same built-in values for BETTER_AUTH_SECRET and ENCRYPTION_KEY to every install. It now generates them once per install and reuses them.
• Secrets persist at ~/.simstudio/secrets.env (written 0600). Reuse matters: ENCRYPTION_KEY decrypts data already in the Postgres volume under ~/.simstudio/data, so a fresh key each launch would orphan it.
• Also passes INTERNAL_API_SECRET, which the realtime container requires and never received.

Type of Change

• Bug fix

Testing

Exercised the secret resolution directly: values are 64-hex and distinct per key, stable across repeated runs, a non-conforming stored value is replaced, a valid uppercase hex key is preserved rather than rotated, and the file is written 0600. Typecheck and lint clean.

Checklist

• Code follows project style guidelines
• Self-reviewed my changes
• Tests added/updated and passing
• No new warnings introduced
• I confirm that I have read and agree to the terms outlined in the Contributor License Agreement (CLA)

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated (UTC)
docs	Skipped		Aug 8, 2026 8:18pm

[cursor]

PR Summary

Medium Risk
Changes how auth, encryption, and internal API secrets are sourced for local Docker runs; mistakes could break sessions or decrypt stored credentials, but persistence and atomic writes reduce data-loss risk.

Overview
The Docker CLI no longer injects the same placeholder auth and encryption secrets into every install. It now generates per-install 32-byte hex values for BETTER_AUTH_SECRET, ENCRYPTION_KEY, and INTERNAL_API_SECRET, stores them in ~/.simstudio/secrets.env, and reuses them on later runs so encrypted Postgres data under ~/.simstudio/data stays decryptable.

Secret handling adds validation (invalid or missing keys are regenerated), atomic writes via a temp file + rename, and mode 0600 on every run. The realtime and app containers receive the resolved values, including INTERNAL_API_SECRET for realtime, which was missing before.

^{Reviewed by Cursor Bugbot for commit e658a88. Configure here.}

[greptile-apps]

Greptile Summary

The CLI now generates and persists distinct per-install authentication and encryption secrets, atomically rewrites invalid secret files, enforces restrictive file permissions, and supplies the secrets to both application containers.

• Generates three persistent 32-byte secrets under ~/.simstudio/secrets.env
• Reuses valid stored values to preserve access to encrypted data
• Reasserts mode 0600 on every launch
• Supplies the shared internal API secret to the realtime and application containers

Confidence Score: 5/5

The PR appears safe to merge.

No blocking failure remains.

Important Files Changed

Filename	Overview
packages/cli/src/index.ts	Adds persistent per-install secret resolution, atomic replacement, permission enforcement, and container environment propagation; the previously reported permission exposure is fixed.

_{Reviews (3): Last reviewed commit: "fix(cli): write the secrets file atomica..." | Re-trigger Greptile}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

1 issue from previous review remains unresolved.

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 610b9ea. Configure here.}

[waleedlatif1]

@greptile

[waleedlatif1]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit e658a88. Configure here.}