From 5f3d676af09b80c29ffc67f0c4d2c2cf265a2e17 Mon Sep 17 00:00:00 2001 From: ajnart Date: Tue, 28 Jul 2026 23:47:07 +0200 Subject: [PATCH] fix: derive assistant approval key at runtime --- apps/nextjs/src/app/api/assistant/chat/route.ts | 9 +++++---- 1 file changed, 5 insertions(+), 4 deletions(-) diff --git a/apps/nextjs/src/app/api/assistant/chat/route.ts b/apps/nextjs/src/app/api/assistant/chat/route.ts index cb58701d2..e221fec08 100644 --- a/apps/nextjs/src/app/api/assistant/chat/route.ts +++ b/apps/nextjs/src/app/api/assistant/chat/route.ts @@ -22,9 +22,10 @@ import { extractMcpTools } from "../../mcp/_extract-tools"; export const maxDuration = 60; const logger = createLogger({ module: "assistant" }); -const toolApprovalSecret = Buffer.from( - hkdfSync("sha256", Buffer.from(env.SECRET_ENCRYPTION_KEY, "hex"), "", "assistant-tool-approval", 32), -).toString("base64url"); +const getToolApprovalSecret = () => + Buffer.from( + hkdfSync("sha256", Buffer.from(env.SECRET_ENCRYPTION_KEY, "hex"), "", "assistant-tool-approval", 32), + ).toString("base64url"); const safeStreamError = "The model endpoint stopped the response. Check its URL, model, and credentials."; const requestSchema = z.object({ @@ -243,7 +244,7 @@ export async function POST(request: Request) { timeout: { totalMs: 55_000, stepMs: 30_000, toolMs: 30_000 }, maxRetries: 2, toolApproval, - experimental_toolApprovalSecret: toolApprovalSecret, + experimental_toolApprovalSecret: getToolApprovalSecret(), onError: ({ error }) => { logger.error("Assistant response stream failed", { error: error instanceof Error ? error.message : String(error),