Migrating docmost and my-home-assistant, both rendered their secret and
neither picked it up. The pod spec showed why:
command: (empty)
args: ["node","build/index.js"]
server.entrypoint: (unset)
wrapCommand consulted only `server.entrypoint` for non-package servers, so
with `entrypoint` unset it returned undefined, the wrapper was skipped
entirely, and the container ran its normal command — which never sourced
/vault/secrets/<name>. The failure is silent by construction: the agent
init container succeeds, the file is there, and the server simply starts
with empty credentials.
An explicit `command` on an image server is already a complete command
line — mcpd's exec mode would run exactly it — so it should be wrapped
verbatim. `entrypoint` is only needed when there is no command at all and
the image's own ENTRYPOINT would take over.
Now branches on the three real shapes: package server (prepend the runner
entrypoint mcpd owns), image + command (use verbatim), image only (require
the declared entrypoint).
Seven tests, one per shape plus the two undefined cases. Reintroducing the
old logic fails two of them — checked before keeping.
Both servers were rolled back to secretDelivery: env and are healthy; they
can migrate once this ships.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_018vybEitX4FykeMatKe5Xki
