fix: resolve tts secret refs for local infer (#72549)

src/cli/capability-cli.ts

@@ -79,6 +79,8 @@ import {
   runWebSearch,
 } from "../web-search/runtime.js";
 import { runCommandWithRuntime } from "./cli-utils.js";
+import { resolveCommandSecretRefsViaGateway } from "./command-secret-gateway.js";
+import { getTtsCommandSecretTargetIds } from "./command-secret-targets.js";
 import { createDefaultDeps } from "./deps.js";
 import { removeCommandByName } from "./program/command-tree.js";
 import { collectOption } from "./program/helpers.js";
@@ -1111,7 +1113,12 @@ async function runTtsConvert(params: {
     } satisfies CapabilityEnvelope;
   }
 
-  const cfg = loadConfig();
+  const { resolvedConfig: cfg } = await resolveCommandSecretRefsViaGateway({
+    config: loadConfig(),
+    commandName: "infer tts convert",
+    targetIds: getTtsCommandSecretTargetIds(),
+    mode: "enforce_resolved",
+  });
   const overrides = resolveExplicitTtsOverrides({
     cfg,
     provider: params.provider,