chore: address review findings

- Add _detectPrevBackend test for env-source SecretRef returning "unknown".
- Extract ExecSecretRef / EnvSecretRef named types so the public
  signature of _resolveSecretRefWithOverrides reads ExecSecretRef
  instead of Extract<SecretRef, { source: "exec" }>.
- Switch README docker run example to --env-file to keep secrets out
  of shell history and ps output.

Author: yerzhansa

README.md

@@ -302,13 +302,12 @@ docker build -t cycling-coach .
 
 docker run -d --name cycling-coach \
   -v cycling-coach-data:/data \
-  -e ANTHROPIC_API_KEY=sk-ant-... \
-  -e INTERVALS_API_KEY=... \
-  -e INTERVALS_ATHLETE_ID=i12345 \
-  -e TELEGRAM_BOT_TOKEN=123456:ABC-DEF... \
+  --env-file .env \
   cycling-coach
 ```
 
+Use `--env-file` rather than inline `-e KEY=value` flags — inline values land in shell history and are visible to other users via `ps`. Your `.env` should contain `ANTHROPIC_API_KEY` (or `OPENAI_API_KEY` / `GOOGLE_GENERATIVE_AI_API_KEY`), `INTERVALS_API_KEY`, `INTERVALS_ATHLETE_ID`, and `TELEGRAM_BOT_TOKEN`.
+
 The image runs as a non-root user, mounts `/data` for state, and reads `/data/config.yaml` if present. With the `-e` env vars above, no `config.yaml` is required — the legacy env-var fallback (`ANTHROPIC_API_KEY` etc.) covers the three secret fields.
 
 For finer control (custom model, idle timeout, etc.) drop a `config.yaml` into the volume:

src/secrets/resolve.ts

@@ -1,5 +1,5 @@
 import { spawn } from "node:child_process";
-import { SecretRef, SecretResolutionError } from "./types.js";
+import { ExecSecretRef, SecretRef, SecretResolutionError } from "./types.js";
 
 const DEFAULT_TIMEOUT_MS = 30_000;
 const DEFAULT_MAX_BYTES = 64 * 1024;
@@ -29,7 +29,7 @@ function resolveEnvRef(name: string): string {
 }
 
 export async function _resolveSecretRefWithOverrides(
-  ref: Extract<SecretRef, { source: "exec" }>,
+  ref: ExecSecretRef,
   overrides: { timeoutMs?: number; maxBytes?: number },
 ): Promise<string> {
   const timeoutMs = overrides.timeoutMs ?? DEFAULT_TIMEOUT_MS;

src/secrets/types.ts

@@ -1,6 +1,6 @@
-export type SecretRef =
-  | { source: "exec"; command: string; args?: string[] }
-  | { source: "env"; var: string };
+export type ExecSecretRef = { source: "exec"; command: string; args?: string[] };
+export type EnvSecretRef = { source: "env"; var: string };
+export type SecretRef = ExecSecretRef | EnvSecretRef;
 
 export type SecretResolutionErrorCode =
   | "ENOENT"

tests/setup.secret-ref.test.ts

@@ -107,6 +107,13 @@ describe("_detectPrevBackend", () => {
       }),
     ).toBe("unknown");
   });
+
+  it("returns unknown for env-source SecretRef (wizard does not manage env refs)", async () => {
+    const { _detectPrevBackend } = await import("../src/setup.js");
+    expect(
+      _detectPrevBackend({ source: "env", var: "ANTHROPIC_API_KEY" }),
+    ).toBe("unknown");
+  });
 });
 
 describe("_formatOrphanCleanup", () => {