From 80bbfef1f05aa0ad7eb429f0d782b163b9d192d2 Mon Sep 17 00:00:00 2001
From: Wes Mason <wes@trigger.dev>
Date: Sun, 20 Sep 2026 10:50:31 +0000
Subject: [PATCH] fix(supervisor): stop the runner token's uid reaching the
 Runner spec

Mono-RevId: b882af2b96296eb4b1010903fe41af0b2b612572
---
 .../src/workloadManager/runCrd.test.ts        | 27 +++++++++++++++++++
 apps/supervisor/src/workloadManager/runCrd.ts |  4 ++-
 2 files changed, 30 insertions(+), 1 deletion(-)

diff --git a/apps/supervisor/src/workloadManager/runCrd.test.ts b/apps/supervisor/src/workloadManager/runCrd.test.ts
index f8be5df01ed..e3f85cef805 100644
--- a/apps/supervisor/src/workloadManager/runCrd.test.ts
+++ b/apps/supervisor/src/workloadManager/runCrd.test.ts
@@ -53,6 +53,33 @@ describe("runnerBodyFor carries the isolation lane it is given", () => {
   });
 });
 
+/**
+ * Asserted here because the type cannot: create() passes a variable, and
+ * TypeScript's excess property check only applies to object literals.
+ */
+describe("runnerBodyFor sends only what the CRD declares", () => {
+  it("takes only name and key from a wider token handle", () => {
+    const body = runnerBodyFor(createOptions(), {
+      ...meta,
+      token: { name: "runner-abc123-token-deadbeef", key: "token", uid: "uid-not-in-the-crd" } as {
+        name: string;
+        key: string;
+      },
+    });
+
+    expect(body.spec.deployment.token).toEqual({
+      name: "runner-abc123-token-deadbeef",
+      key: "token",
+    });
+  });
+
+  it("omits the token entirely when there is none", () => {
+    const body = runnerBodyFor(createOptions(), meta);
+
+    expect(body.spec.deployment).not.toHaveProperty("token");
+  });
+});
+
 describe("runnerBodyFor", () => {
   it("names the object after the runner and carries the required spec", () => {
     const body = runnerBodyFor(createOptions(), meta);
diff --git a/apps/supervisor/src/workloadManager/runCrd.ts b/apps/supervisor/src/workloadManager/runCrd.ts
index f05e111fb9f..27b0ffde3fd 100644
--- a/apps/supervisor/src/workloadManager/runCrd.ts
+++ b/apps/supervisor/src/workloadManager/runCrd.ts
@@ -296,7 +296,9 @@ export function runnerBodyFor(
       deployment: {
         friendlyID: opts.deploymentFriendlyId,
         version: opts.deploymentVersion,
-        ...(meta.token ? { token: meta.token } : {}),
+        // Field by field, not spread: the handle also carries the Secret's uid,
+        // which the spec has no field for and Strict validation rejects by name.
+        ...(meta.token ? { token: { name: meta.token.name, key: meta.token.key } } : {}),
       },
       owner: {
         envID: opts.envId,