Add dynamic secrets experimental flag

Co-Authored-By: Paperclip <noreply@paperclip.ing>

server/src/__tests__/instance-settings-routes.test.ts

@@ -81,6 +81,8 @@ describe("instance settings routes", () => {
         enableIssuePlanDecompositions: false,
         enableExperimentalFileViewer: false,
         enableCloudSync: false,
+        enableExternalObjects: false,
+        enableDynamicSecrets: false,
         autoRestartDevServerWhenIdle: false,
         enableIssueGraphLivenessAutoRecovery: true,
         issueGraphLivenessAutoRecoveryLookbackHours: 24,
@@ -101,6 +103,7 @@ describe("instance settings routes", () => {
       enableTaskWatchdogs: false,
       enableCloudSync: false,
       enableExternalObjects: false,
+      enableDynamicSecrets: false,
       autoRestartDevServerWhenIdle: false,
       enableIssueGraphLivenessAutoRecovery: true,
       issueGraphLivenessAutoRecoveryLookbackHours: 24,
@@ -119,6 +122,8 @@ describe("instance settings routes", () => {
         enableIssuePlanDecompositions: true,
         enableExperimentalFileViewer: true,
         enableCloudSync: true,
+        enableExternalObjects: false,
+        enableDynamicSecrets: false,
         autoRestartDevServerWhenIdle: false,
         enableIssueGraphLivenessAutoRecovery: true,
         issueGraphLivenessAutoRecoveryLookbackHours: 24,
@@ -144,6 +149,7 @@ describe("instance settings routes", () => {
         enableTaskWatchdogs: true,
         enableCloudSync: true,
         enableExternalObjects: false,
+        enableDynamicSecrets: true,
         autoRestartDevServerWhenIdle: false,
         enableIssueGraphLivenessAutoRecovery: true,
         issueGraphLivenessAutoRecoveryLookbackHours: 24,
@@ -197,6 +203,7 @@ describe("instance settings routes", () => {
       enableTaskWatchdogs: false,
       enableCloudSync: false,
       enableExternalObjects: false,
+      enableDynamicSecrets: false,
       autoRestartDevServerWhenIdle: false,
       enableIssueGraphLivenessAutoRecovery: true,
       issueGraphLivenessAutoRecoveryLookbackHours: 24,
@@ -292,6 +299,24 @@ describe("instance settings routes", () => {
     });
   });
 
+  it("allows local board users to update dynamic secrets", async () => {
+    const app = await createApp({
+      type: "board",
+      userId: "local-board",
+      source: "local_implicit",
+      isInstanceAdmin: true,
+    });
+
+    await request(app)
+      .patch("/api/instance/settings/experimental")
+      .send({ enableDynamicSecrets: true })
+      .expect(200);
+
+    expect(mockInstanceSettingsService.updateExperimental).toHaveBeenCalledWith({
+      enableDynamicSecrets: true,
+    });
+  });
+
   it("allows local board users to update issue graph liveness auto-recovery", async () => {
     const app = await createApp({
       type: "board",

server/src/__tests__/instance-settings-service.test.ts

@@ -10,6 +10,7 @@ describe("instance settings service", () => {
       enableExperimentalFileViewer: true,
       enableTaskWatchdogs: true,
       enableCloudSync: true,
+      enableDynamicSecrets: true,
       autoRestartDevServerWhenIdle: true,
       enableIssueGraphLivenessAutoRecovery: true,
       issueGraphLivenessAutoRecoveryLookbackHours: 48,
@@ -24,6 +25,7 @@ describe("instance settings service", () => {
       enableExperimentalFileViewer: true,
       enableTaskWatchdogs: true,
       enableCloudSync: true,
+      enableDynamicSecrets: true,
       autoRestartDevServerWhenIdle: true,
       enableIssueGraphLivenessAutoRecovery: true,
       issueGraphLivenessAutoRecoveryLookbackHours: 48,
@@ -47,6 +49,24 @@ describe("instance settings service", () => {
     ).toBe(false);
   });
 
+  it("defaults enableDynamicSecrets to false for empty and legacy stored settings", () => {
+    expect(normalizeExperimentalSettings(undefined).enableDynamicSecrets).toBe(false);
+    expect(normalizeExperimentalSettings({}).enableDynamicSecrets).toBe(false);
+    expect(
+      normalizeExperimentalSettings({ enableExternalObjects: true }).enableDynamicSecrets,
+    ).toBe(false);
+  });
+
+  it("round-trips an enableDynamicSecrets patch through the update merge", () => {
+    const current = normalizeExperimentalSettings({});
+    const enabled = normalizeExperimentalSettings({ ...current, enableDynamicSecrets: true });
+    expect(enabled.enableDynamicSecrets).toBe(true);
+    expect(enabled.enableStreamlinedLeftNavigation).toBe(true);
+
+    const disabled = normalizeExperimentalSettings({ ...enabled, enableDynamicSecrets: false });
+    expect(disabled).toEqual(current);
+  });
+
   it("round-trips an enableConferenceRoomChat patch through the update merge", () => {
     // updateExperimental merges `{ ...normalize(current), ...patch }` and
     // re-normalizes; emulate that to prove the flag survives the roundtrip

server/src/services/instance-settings.ts

@@ -53,6 +53,7 @@ export function normalizeExperimentalSettings(raw: unknown): InstanceExperimenta
       enableTaskWatchdogs: parsed.data.enableTaskWatchdogs ?? false,
       enableCloudSync: parsed.data.enableCloudSync ?? false,
       enableExternalObjects: parsed.data.enableExternalObjects ?? false,
+      enableDynamicSecrets: parsed.data.enableDynamicSecrets ?? false,
       autoRestartDevServerWhenIdle: parsed.data.autoRestartDevServerWhenIdle ?? false,
       enableIssueGraphLivenessAutoRecovery: parsed.data.enableIssueGraphLivenessAutoRecovery ?? false,
       issueGraphLivenessAutoRecoveryLookbackHours:
@@ -70,6 +71,7 @@ export function normalizeExperimentalSettings(raw: unknown): InstanceExperimenta
     enableExperimentalFileViewer: false,
     enableCloudSync: false,
     enableExternalObjects: false,
+    enableDynamicSecrets: false,
     autoRestartDevServerWhenIdle: false,
     enableIssueGraphLivenessAutoRecovery: false,
     issueGraphLivenessAutoRecoveryLookbackHours: