Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/harness/tools/bot/grab-bot-chat-tools.ts

@@ -133,6 +133,7 @@ export default async function grabBotChatTools({
             ? [
                   searchComputersTool({
                       bot_id,
+                      user_id,
                       computers,
                       workspace_id,
                       dirs: computerRunDirs({ bot_id, bot_kind: bot.kind, user_id, workspace_id }),

src/harness/tools/bot/secrets/grab-bot-secret-tools.ts

@@ -0,0 +1,44 @@
+import type { HarnessTool } from "../../../types";
+import requestSecretTool from "./request-secret-tool";
+import showSecretTool from "./show-secret-tool";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    session_id?: number | string;
+    workspace_id?: number | string | null;
+    computer_id?: number | string | null;
+    in_task?: boolean;
+    /**
+     * Called with a secret request's ref: the message needs the user.
+     */
+    onRequest?: (params: { ref: string }) => void;
+    /**
+     * Called with a shown secret's ref.
+     */
+    onShow?: (params: { ref: string }) => void;
+};
+
+/**
+ * The tools that move secrets without the model seeing them: asking the
+ * user for one (`request_secret`, needs a conversation to show its card
+ * in) and showing one (`show_secret`). Capturing one on a computer is a
+ * computer tool (`capture_secret`).
+ */
+export default function grabBotSecretTools({
+    user_id,
+    bot_id,
+    session_id,
+    workspace_id,
+    computer_id,
+    in_task,
+    onRequest,
+    onShow,
+}: Params): HarnessTool[] {
+    return [
+        ...(session_id && onRequest
+            ? [requestSecretTool({ user_id, bot_id, session_id, workspace_id, in_task, onRequest })]
+            : []),
+        ...(onShow ? [showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow })] : []),
+    ];
+}

src/harness/tools/bot/secrets/request-secret-tool.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+import createSecretRequest from "@/src/functions/backend/db/secret-requests/create-secret-request";
+import secretRequestRef from "@/src/utils/secret-request-ref";
+import type { HarnessTool } from "../../../types";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    /**
+     * The conversation it's asked in, where its card shows.
+     */
+    session_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * Whether the run is a task, which stops and reports rather than waits.
+     */
+    in_task?: boolean;
+    /**
+     * Called with the request's ref, so the message always carries its card.
+     */
+    onRequest: (params: { ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+    description: string;
+    reason: string;
+};
+
+/**
+ * Lets a bot ask the user for a secret (a password, token or API key)
+ * without it going through the chat: the user types it into a card, it's
+ * saved as their personal secret for this bot, and the bot only ever
+ * learns that it's saved and its key.
+ */
+export default function requestSecretTool({
+    user_id,
+    bot_id,
+    session_id,
+    workspace_id,
+    in_task,
+    onRequest,
+}: Params): HarnessTool<Args> {
+    return {
+        name: "request_secret",
+        description: `Ask the user for a secret you need (a password, token or API key) through a masked card in the chat, never by asking them to type it into a message: what they type there goes to you and the model provider, the card's value never does. It's saved as their own secret for you, under key, and set as $KEY in your shell (and {{env.KEY}} for tools) on this user's later runs; you never see the value. Check your envs first: if the key is already set, don't ask. Their answer comes as a message saying it's saved${
+            in_task ? `. In a task, ask, then stop and report that you're waiting for it.` : `.`
+        }`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128).describe("The env key to save it under, e.g. GITHUB_TOKEN"),
+            description: z.string().trim().min(1).max(500).describe("What it is, shown on the card, e.g. \"GitHub personal access token with repo scope\""),
+            reason: z.string().trim().min(10, "Say why you need it").max(2000).describe("Why you need it and what you'll do with it, shown on the card as your words"),
+        }),
+        run: async ({ args }) => {
+            const id = await createSecretRequest({
+                user_id,
+                bot_id,
+                session_id,
+                workspace_id,
+                key: args.key,
+                description: args.description,
+                reason: args.reason,
+            });
+
+            onRequest({ ref: secretRequestRef({ id }) });
+
+            return `Asked the user for ${args.key.trim()}: the card is on your message. Their answer arrives as a message once it's saved; then it's $${args.key.trim()} on your computers. Never ask them to paste it in the chat.`;
+        },
+    };
+}

src/harness/tools/bot/secrets/show-secret-tool.ts

@@ -0,0 +1,55 @@
+import { z } from "zod";
+import grabComputerEnvs from "@/src/functions/backend/db/envs/grab-computer-envs";
+import grabRunEnvs from "@/src/functions/backend/db/extensions/grab-run-envs";
+import secretRef from "@/src/utils/secret-ref";
+import type { HarnessTool } from "../../../types";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * The computer the run is on, whose envs count too.
+     */
+    computer_id?: number | string | null;
+    /**
+     * Called with the secret's ref, so the message always carries its chip.
+     */
+    onShow: (params: { ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+};
+
+/**
+ * Lets a bot show the user an env it has (by key) as a masked chip, without
+ * ever holding the value: it gets a `[secret:ID]` ref, and the chat
+ * fetches the value only for whoever may see it (`canRevealEnv`).
+ */
+export default function showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow }: Params): HarnessTool<Args> {
+    return {
+        name: "show_secret",
+        description: `Show the user one of your envs (by key, e.g. a password or token they saved or you captured) without reading it: you get a [secret:ID] ref to put in your message, which the user sees masked with Reveal and Copy. Never print a secret with a command to show it. Only its owner (for a personal secret) or a super admin can reveal it.`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128),
+        }),
+        run: async ({ args }) => {
+            const key = args.key.trim();
+            const on_computer = computer_id
+                ? await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id })
+                : [];
+            const env =
+                on_computer.find((e) => e.key == key) ||
+                (await grabRunEnvs({ bot_id, user_id, workspace_id })).find((e) => e.key == key);
+
+            if (!env) return `No env called ${key} reaches you here. Ask the user with request_secret if you need it.`;
+
+            const ref = secretRef({ id: env.id });
+
+            onShow({ ref });
+
+            return `Put ${ref} in your message: the user sees ${key} masked, with Reveal and Copy. Never repeat or guess the value.`;
+        },
+    };
+}

src/harness/tools/computer/capture-secret-tool.ts

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { AppData } from "@/src/data/app-data";
+import saveUserSecret from "@/src/functions/backend/db/envs/save-user-secret";
+import { resolveComputerPath, type ComputerRunDirs } from "@/src/utils/computer-work-dirs";
+import secretRef from "@/src/utils/secret-ref";
+import type { HarnessTool } from "../../types";
+import computerDirsShell from "./computer-dirs-shell";
+import downloadComputerFile from "./download-computer-file";
+import runComputerCommand from "./run-computer-command";
+
+type Params = {
+    /**
+     * The sandbox's REST address (no `/mcp`).
+     */
+    base_url: string;
+    /**
+     * The computer's env file, sourced before a command.
+     */
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    /**
+     * Whose secret it becomes: the run's user, for this bot.
+     */
+    user_id: number | string;
+    bot_id: number | string;
+    /**
+     * Called with each captured value and its key, so the run blanks it
+     * out of everything the bot reads from then on.
+     */
+    onCapture: (params: { key: string; value: string; ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+    description: string;
+    from: "file" | "command";
+    path?: string;
+    command?: string;
+};
+
+/**
+ * Saves a secret that's on the computer (a generated password, a token a
+ * CLI printed, a key file) as the user's personal secret for this bot,
+ * without the bot ever reading it: the file comes over the sandbox's
+ * download endpoint, a command's output over its REST shell, and neither
+ * is returned. The bot gets a `[secret:ID]` ref to show the user, and the
+ * value is redacted from everything it reads afterwards.
+ */
+export default function captureSecretTool({
+    base_url,
+    shell_path,
+    dirs,
+    user_id,
+    bot_id,
+    onCapture,
+}: Params): HarnessTool<Args> {
+    return {
+        name: "capture_secret",
+        description: `Save a secret that's on this computer (a password you generated, a token or API key a command printed, a key file) as the user's own secret for you, without reading it yourself: never cat, echo or print a secret, capture it instead. from "file" saves a file's contents (path in your folders); from "command" saves what a bash command prints (stdout, with your envs set), e.g. "printenv NAME" or "openssl rand -base64 24 | tee pw.txt". One trailing newline is dropped. You get back a [secret:ID] ref: put it in your message and the user sees the secret masked, with Reveal and Copy. It's also set as $KEY on your computers for this user's later runs. Values over ${AppData.CapturedSecretMaxChars} characters are refused.`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128).describe("The env key it's saved under, e.g. ADMIN_PASSWORD"),
+            description: z.string().trim().min(1).max(500).describe("What it is, for the user"),
+            from: z.enum(["file", "command"]),
+            path: z.string().trim().min(1).max(1000).optional().describe("For from file"),
+            command: z.string().trim().min(1).max(4000).optional().describe("For from command"),
+        }),
+        run: async ({ args, signal }) => {
+            const value = await readValue({ args, base_url, shell_path, dirs, signal });
+
+            if (value.text === undefined) return value.error;
+
+            const env_id = await saveUserSecret({
+                user_id,
+                bot_id,
+                key: args.key,
+                value: value.text,
+                description: args.description,
+            });
+            const ref = secretRef({ id: env_id });
+
+            onCapture({ key: args.key.trim(), value: value.text, ref });
+
+            return `Saved as ${args.key.trim()} (${value.text.length} characters). Put ${ref} in your message to show it to the user; never repeat or guess the value.`;
+        },
+    };
+}
+
+async function readValue({
+    args,
+    base_url,
+    shell_path,
+    dirs,
+    signal,
+}: {
+    args: Args;
+    base_url: string;
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    signal?: AbortSignal;
+}): Promise<{ text: string; error?: undefined } | { text?: undefined; error: string }> {
+    let text = "";
+
+    if (args.from == "file") {
+        if (!args.path) return { error: `Give the file's path.` };
+
+        const download = await downloadComputerFile({
+            base_url,
+            path: resolveComputerPath({ path: args.path, dirs }),
+            max_bytes: AppData.CapturedSecretMaxChars * 4,
+            signal,
+        });
+
+        if (!download.ok) {
+            return {
+                error:
+                    download.reason == "missing"
+                        ? `There's no file at ${args.path}.`
+                        : download.reason == "too_big"
+                          ? `That file is too big to be a secret.`
+                          : `The file changed while it was read. Try again.`,
+            };
+        }
+
+        text = download.bytes.toString("utf8");
+    } else {
+        if (!args.command) return { error: `Give the command.` };
+
+        const result = await runComputerCommand({
+            base_url,
+            command: `(${computerDirsShell({ dirs })}[ -f ${shell_path} ] && . ${shell_path}; ${args.command}) 2>/dev/null`,
+            timeout_ms: AppData.CaptureSecretTimeoutMs,
+            signal,
+        });
+
+        if (result.exit_code != 0) {
+            return { error: `The command failed (exit code ${result.exit_code ?? "unknown"}). Nothing was saved.` };
+        }
+
+        text = result.output;
+    }
+
+    text = text.replace(/\r?\n$/, "");
+
+    if (!text) return { error: `It was empty. Nothing was saved.` };
+
+    if (text.length > AppData.CapturedSecretMaxChars) {
+        return { error: `That's over ${AppData.CapturedSecretMaxChars} characters, too long to be a secret. Nothing was saved.` };
+    }
+
+    return { text };
+}

src/harness/tools/computer/open-computer-tools.ts

@@ -10,6 +10,7 @@ import grabMcpTools from "../../mcp/grab-mcp-tools";
 import readImage from "../../media/read-image";
 import type { HarnessTool } from "../../types";
 import computerDirsShell from "./computer-dirs-shell";
+import captureSecretTool from "./capture-secret-tool";
 import runComputerCommand from "./run-computer-command";
 import withComputerDirs from "./with-computer-dirs";
 import withComputerEnv from "./with-computer-env";
@@ -21,6 +22,10 @@ type Params = {
      * Screenshots are read with this bot's media reading model.
      */
     bot_id?: number | string;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply, and its models read
      * screenshots.
@@ -31,6 +36,12 @@ type Params = {
      * kept inside them.
      */
     dirs: ComputerRunDirs;
+    /**
+     * Called with the ref of each secret the bot captures on the computer
+     * (`capture_secret`), so the run's message always carries its chip.
+     * Without it, or without a user, the bot can't capture secrets.
+     */
+    onSecretRef?: (params: { ref: string }) => void;
     signal?: AbortSignal;
 };
 
@@ -61,8 +72,10 @@ export type OpenComputer = {
 export default async function openComputerTools({
     computer_id,
     bot_id,
+    user_id,
     workspace_id,
     dirs,
+    onSecretRef,
     signal,
 }: Params): Promise<OpenComputer> {
     const target = await grabComputerMcpUrl({ computer_id });
@@ -75,7 +88,7 @@ export default async function openComputerTools({
         throw new Error(computerNotReadyMessage(target));
     }
 
-    const envs = await grabComputerEnvs({ computer_id, bot_id, workspace_id });
+    const envs = await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id });
     const paths = await writeComputerEnv({ base_url: target.base_url, envs, signal });
 
     await runComputerCommand({
@@ -85,7 +98,11 @@ export default async function openComputerTools({
         signal,
     });
 
-    const secrets = envs.filter((env) => env.secret);
+    /**
+     * Grows as the bot captures secrets, so a value it saved is blanked
+     * from everything it reads afterwards too.
+     */
+    const secrets: { key: string; value: string }[] = envs.filter((env) => env.secret);
     const redact = (text: string) => redactSecrets({ text, secrets });
 
     const client = await connectMcpServer({ url: target.url, signal });
@@ -107,7 +124,24 @@ export default async function openComputerTools({
 
         return {
             name: target.name,
-            tools: tools.map((tool) => withComputerDirs({ tool: withComputerEnv({ tool, ...paths }), dirs })),
+            tools: [
+                ...tools.map((tool) => withComputerDirs({ tool: withComputerEnv({ tool, ...paths }), dirs })),
+                ...(user_id && bot_id && onSecretRef
+                    ? [
+                          captureSecretTool({
+                              base_url: target.base_url,
+                              shell_path: paths.shell_path,
+                              dirs,
+                              user_id,
+                              bot_id,
+                              onCapture: ({ key, value, ref }) => {
+                                  secrets.push({ key, value });
+                                  onSecretRef({ ref });
+                              },
+                          }),
+                      ]
+                    : []),
+            ],
             envs: envs.map((env) => ({ key: env.key, description: env.description })),
             redact,
             close: () => client.close().catch(() => {}),

src/harness/tools/computer/search-computers-tool.ts

@@ -16,6 +16,10 @@ type Params = {
      * The bot the run is for: its own envs beat everything.
      */
     bot_id?: number | string | null;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply.
      */
@@ -44,6 +48,7 @@ type Args = {
  */
 export default function searchComputersTool({
     bot_id,
+    user_id,
     workspace_id,
     computers,
     dirs,
@@ -76,6 +81,7 @@ export default function searchComputersTool({
                             grabComputerEnvs({
                                 computer_id: computer.id || 0,
                                 bot_id,
+                                user_id,
                                 workspace_id,
                             }),
                         ]);

src/harness/tools/custom/build-custom-tool.ts

@@ -20,6 +20,10 @@ type Params = {
      */
     computer_id?: number | string | null;
     bot_id?: number | string;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     workspace_id?: number | string | null;
     /**
      * The run's folders on the computer (`computerRunDirs`), where a
@@ -45,6 +49,7 @@ export default function buildCustomTool({
     envs,
     computer_id,
     bot_id,
+    user_id,
     workspace_id,
     dirs,
     record = true,
@@ -64,6 +69,7 @@ export default function buildCustomTool({
                     args,
                     computer_id: computer_id!,
                     bot_id,
+                    user_id,
                     workspace_id,
                     dirs,
                     signal,

src/harness/tools/custom/run-script-tool.ts

@@ -18,6 +18,10 @@ type Params = {
      * The bot the run is for: its own envs beat everything.
      */
     bot_id?: number | string | null;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply on the computer.
      */
@@ -44,6 +48,7 @@ export default async function runScriptTool({
     args,
     computer_id,
     bot_id,
+    user_id,
     workspace_id,
     dirs,
     signal,
@@ -53,7 +58,7 @@ export default async function runScriptTool({
     if (!target) throw new Error(`Computer #${computer_id} has no container to run on.`);
     if (!target.ready) throw new Error(computerNotReadyMessage(target));
 
-    const envs = await grabComputerEnvs({ computer_id, bot_id, workspace_id });
+    const envs = await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id });
     const { shell_path } = await writeComputerEnv({ base_url: target.base_url, envs, signal });
     const language =
         CustomToolScriptLanguages.find((l) => l.value == config.language) || CustomToolScriptLanguages[0];

src/harness/tools/extensions/open-bot-extensions.ts

@@ -12,6 +12,11 @@ import type { ComputerRunDirs } from "@/src/utils/computer-work-dirs";
 
 type Params = {
     bot_id: number | string;
+    /**
+     * The user the run is for: their personal envs for the bot fill
+     * templates and reach scripts.
+     */
+    user_id?: number | string | null;
     workspace_id?: number | string | null;
     /**
      * Where script tools run: the task's computer, or in chat the bot's
@@ -54,6 +59,7 @@ export type OpenBotExtensions = {
  */
 export default async function openBotExtensions({
     bot_id,
+    user_id,
     workspace_id,
     computer_id,
     dirs,
@@ -66,7 +72,7 @@ export default async function openBotExtensions({
         return { tools: [], note: "", skills, close: async () => {} };
     }
 
-    const envs = await grabRunEnvs({ bot_id, workspace_id });
+    const envs = await grabRunEnvs({ bot_id, user_id, workspace_id });
     const secrets = envs.filter((env) => env.secret);
     const redact = (text: string) => redactSecrets({ text, secrets });
     const names = new Set(taken);
@@ -81,7 +87,7 @@ export default async function openBotExtensions({
     };
 
     for (const tool of tools) {
-        add(buildCustomTool({ tool, envs, computer_id, bot_id, workspace_id, dirs }));
+        add(buildCustomTool({ tool, envs, computer_id, bot_id, user_id, workspace_id, dirs }));
     }
 
     for (const server of servers) {