[aledbf]

Problem. A missing or unparsable --secrets-file was ignored: up, run-user-commands and build ran with no secrets injected or masked and could exit 0. (build with a Dockerfile did fail, but with a different message, and its Feature build dropped the secrets.)

Reference (TS readSecretsFromFile). It throws ContainerError({description: 'Failed to read/parse secrets'}); up and run-user-commands then print an error result and exit 1, before looking for the configuration.

Now (Go = TS)

• Missing file: {"outcome":"error","message":"ENOENT: no such file or directory, open '<path>'","description":"Failed to read/parse secrets"}, exit 1. Other read errors use Node's wording.
• Parse error: the same result with "message":"Invalid json data".
• Parsed as jsonc.parse: comments and any JSON value are accepted; trailing commas, a BOM, an empty file, trailing data and unquoted keys are rejected. I checked these against jsonc-parser 3.3.1.
• Values become env vars as JS String() makes them, in JS key order.
• Masking follows Object.values(...).filter(v => v.length), including TS's failure on a null value.
• No flag still means no secrets.
• build --secrets-file (Go-only) fails the same way; docs/go-only-features.md says so.

Tests

• 8 hermetic parity cases (4 each for up and run-user-commands): missing, invalid JSON, JSONC with non-string values, null value. 6 fail with the pre-change binary; the 2 JSONC cases also passed before, because the file was silently dropped.
• secrets_cmd_test.go: exact output and exit code for the three commands.
• secrets_held_test.go and secrets_repo_held_test.go asserted nil for a missing file and bad JSON, which codified the bug; they now assert the error contract.

Known remaining differences (unchanged): a non-string secret with --dotfiles-repository crashes TS (quoteValue) and not Go; a top-level string is split by rune, not by UTF-16 unit. Separately, secrets vs remoteEnv precedence (TS lets secrets win) will be a follow-up PR.

Validation (local)

• task lint, task spec:compliance: pass.
• task test:race with TMPDIR outside /tmp: pass.
• task parity:contract: only the 2 known /tmp/.git cases fail.
• TestE2E_UpSecretsFile: pass.
• PARITY_COMMAND=up task parity:runtime: the 8 new cases pass. The failing cases, up.workspace-secrets-success among them, fail identically on main on this machine: Go treats /tmp as a git root because of a stray /tmp/.git, which changes remoteWorkspaceFolder. CI is the check for those.

🤖 Generated with Claude Code