From 4a0015335cbf39af714938ce363df08eea43a415 Mon Sep 17 00:00:00 2001
From: Sawyer <sawyer@dirtroad.dev>
Date: Thu, 17 Sep 2026 20:02:11 -0700
Subject: [PATCH] fix(scripts): dev preflight and .env.example require
 SIDECAR_CREDENTIAL_ENCRYPTION_KEY (CL-8419)

---
 .env.example   | 6 ++++--
 scripts/dev.ts | 1 +
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/.env.example b/.env.example
index dd08cd0689..f7c945be04 100644
--- a/.env.example
+++ b/.env.example
@@ -1,8 +1,8 @@
 # cp .env.example .env
 #
 # Required: DATABASE_URL, HUB_DATA_DIR, CREDENTIAL_ENCRYPTION_KEY,
-# PRINCIPAL_KEY_ENCRYPTION_KEY. Everything else is optional and off when
-# unset. The hub reads DB_HOST/DB_PORT/DB_USER/DB_PASSWORD/DB_NAME;
+# PRINCIPAL_KEY_ENCRYPTION_KEY, SIDECAR_CREDENTIAL_ENCRYPTION_KEY.
+# Everything else is optional and off when unset. The hub reads DB_HOST/DB_PORT/DB_USER/DB_PASSWORD/DB_NAME;
 # `bun run dev` derives them from DATABASE_URL.
 
 DATABASE_URL=postgres://localhost:5432/workbench
@@ -23,6 +23,8 @@ HUB_ALLOW_GIT_INSIDE_WORK_TREE=1
 # 32 bytes hex each (openssl rand -hex 32). Generate your own outside a laptop.
 CREDENTIAL_ENCRYPTION_KEY=0000000000000000000000000000000000000000000000000000000000000000
 PRINCIPAL_KEY_ENCRYPTION_KEY=1111111111111111111111111111111111111111111111111111111111111111
+# Kept separate from the hub's key so a sidecar compromise cannot read the hub's database.
+SIDECAR_CREDENTIAL_ENCRYPTION_KEY=2222222222222222222222222222222222222222222222222222222222222222
 
 # Max tool-package tarball the registry accepts. Default 10 MiB.
 # HUB_MAX_TARBALL_BYTES=10485760
diff --git a/scripts/dev.ts b/scripts/dev.ts
index 2cca62d4df..6e75642c5b 100644
--- a/scripts/dev.ts
+++ b/scripts/dev.ts
@@ -49,6 +49,7 @@ function validateConfig(): DevConfig {
   for (const [name, hex] of [
     ["CREDENTIAL_ENCRYPTION_KEY", process.env["CREDENTIAL_ENCRYPTION_KEY"]],
     ["PRINCIPAL_KEY_ENCRYPTION_KEY", process.env["PRINCIPAL_KEY_ENCRYPTION_KEY"]],
+    ["SIDECAR_CREDENTIAL_ENCRYPTION_KEY", process.env["SIDECAR_CREDENTIAL_ENCRYPTION_KEY"]],
   ] as const) {
     if (hex === undefined || hex.trim() === "") {
       fail(`${name} is not set. Set it in .env; see .env.example.`);