### Fixes

- Config/secrets: allow exec SecretRef ids to include `#` selectors so AWS-style `secret#json_key` ids validate consistently. (#80731) Thanks @TurboTheTurtle.

- Installer: include the optional verify phase in the progress counter so `--verify` shows `[4/4] Verifying installation` instead of `[4/3]`.

- Tests: run upgrade-survivor config recipe commands through the Windows npm shim so native Windows package walks keep baseline config coverage.

- Image tool: use bundled Anthropic media limits when resolving image compression policy without provider-runtime hooks.

- `provider` pattern: `^[a-z][a-z0-9_-]{0,63}$`

- `source: "env"` id pattern: `^[A-Z][A-Z0-9_]{0,127}$`

- `source: "file"` id: absolute JSON pointer (for example `"/providers/openai/apiKey"`)

- `source: "exec"` id pattern: `^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$`

- `source: "exec"` id pattern: `^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$` (supports AWS-style `secret#json_key` selectors)

- `source: "exec"` ids must not contain `.` or `..` slash-delimited path segments (for example `a/../b` is rejected)

### Supported credential surface

</Tab>

<Tab title="exec">

```json5

{ source: "exec", provider: "vault", id: "providers/openai/apiKey" }

{ source: "exec", provider: "vault", id: "providers/openai/apiKey#value" }

```

Validation:

- `provider` must match `^[a-z][a-z0-9_-]{0,63}$`

- `id` must match `^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$`

- `id` must match `^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$` (supports selectors such as `secret#json_key`)

- `id` must not contain `.` or `..` as slash-delimited path segments (for example `a/../b` is rejected)

</Tab>

export function resolveNpmPackFilename(output) {

const filename = output

.split(/\r?\n/u)

.map((line) => line.trim())

.filter(Boolean)

.at(-1);

.findLast((line) => line.trim().length > 0)

?.trim();

if (typeof filename !== "string" || !filename.endsWith(".tgz")) {

throw new Error(`npm pack did not report a tarball filename`);

}

const FILE_SECRET_REF_SEGMENT_PATTERN = /^(?:[^~]|~0|~1)*$/;

export const SECRET_PROVIDER_ALIAS_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;

const EXEC_SECRET_REF_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/;

const EXEC_SECRET_REF_ID_PATTERN = /^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$/;

export const SINGLE_VALUE_FILE_REF_ID = "value";

export const FILE_SECRET_REF_ID_ABSOLUTE_JSON_SCHEMA_PATTERN = "^/";

export const FILE_SECRET_REF_ID_INVALID_ESCAPE_JSON_SCHEMA_PATTERN = "~(?:[^01]|$)";

export const EXEC_SECRET_REF_ID_JSON_SCHEMA_PATTERN =

"^(?!.*(?:^|/)\\.{1,2}(?:/|$))[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$";

"^(?!.*(?:^|/)\\.{1,2}(?:/|$))[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$";

export type ExecSecretRefIdValidationReason = "pattern" | "traversal-segment";

export function formatExecSecretRefIdValidationMessage(): string {

return [

"Exec secret reference id must match /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,255}$/",

"Exec secret reference id must match /^[A-Za-z0-9][A-Za-z0-9._:/#-]{0,255}$/",

'and must not include "." or ".." path segments',

'(example: "vault/openai/api-key").',

'(example: "vault/openai/api-key" or "aws/secret#json_key").',

].join(" ");

}

"vault/openai/api-key",

"vault:secret/mykey",

"providers/openai/apiKey",

"aws/secret#json_key",

"a..b/c",

"a/.../b",

"a/.well-known/key",