Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/harness/tools/bot/grab-bot-chat-tools.ts

@@ -133,6 +133,7 @@ export default async function grabBotChatTools({
             ? [
                   searchComputersTool({
                       bot_id,
+                      user_id,
                       computers,
                       workspace_id,
                       dirs: computerRunDirs({ bot_id, bot_kind: bot.kind, user_id, workspace_id }),

src/harness/tools/bot/secrets/grab-bot-secret-tools.ts

@@ -0,0 +1,44 @@
+import type { HarnessTool } from "../../../types";
+import requestSecretTool from "./request-secret-tool";
+import showSecretTool from "./show-secret-tool";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    session_id?: number | string;
+    workspace_id?: number | string | null;
+    computer_id?: number | string | null;
+    in_task?: boolean;
+    /**
+     * Called with a secret request's ref: the message needs the user.
+     */
+    onRequest?: (params: { ref: string }) => void;
+    /**
+     * Called with a shown secret's ref.
+     */
+    onShow?: (params: { ref: string }) => void;
+};
+
+/**
+ * The tools that move secrets without the model seeing them: asking the
+ * user for one (`request_secret`, needs a conversation to show its card
+ * in) and showing one (`show_secret`). Capturing one on a computer is a
+ * computer tool (`capture_secret`).
+ */
+export default function grabBotSecretTools({
+    user_id,
+    bot_id,
+    session_id,
+    workspace_id,
+    computer_id,
+    in_task,
+    onRequest,
+    onShow,
+}: Params): HarnessTool[] {
+    return [
+        ...(session_id && onRequest
+            ? [requestSecretTool({ user_id, bot_id, session_id, workspace_id, in_task, onRequest })]
+            : []),
+        ...(onShow ? [showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow })] : []),
+    ];
+}

src/harness/tools/bot/secrets/request-secret-tool.ts

@@ -0,0 +1,70 @@
+import { z } from "zod";
+import createSecretRequest from "@/src/functions/backend/db/secret-requests/create-secret-request";
+import secretRequestRef from "@/src/utils/secret-request-ref";
+import type { HarnessTool } from "../../../types";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    /**
+     * The conversation it's asked in, where its card shows.
+     */
+    session_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * Whether the run is a task, which stops and reports rather than waits.
+     */
+    in_task?: boolean;
+    /**
+     * Called with the request's ref, so the message always carries its card.
+     */
+    onRequest: (params: { ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+    description: string;
+    reason: string;
+};
+
+/**
+ * Lets a bot ask the user for a secret (a password, token or API key)
+ * without it going through the chat: the user types it into a card, it's
+ * saved as their personal secret for this bot, and the bot only ever
+ * learns that it's saved and its key.
+ */
+export default function requestSecretTool({
+    user_id,
+    bot_id,
+    session_id,
+    workspace_id,
+    in_task,
+    onRequest,
+}: Params): HarnessTool<Args> {
+    return {
+        name: "request_secret",
+        description: `Ask the user for a secret you need (a password, token or API key) through a masked card in the chat, never by asking them to type it into a message: what they type there goes to you and the model provider, the card's value never does. It's saved as their own secret for you, under key, and set as $KEY in your shell (and {{env.KEY}} for tools) on this user's later runs; you never see the value. Check your envs first: if the key is already set, don't ask. Their answer comes as a message saying it's saved${
+            in_task ? `. In a task, ask, then stop and report that you're waiting for it.` : `.`
+        }`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128).describe("The env key to save it under, e.g. GITHUB_TOKEN"),
+            description: z.string().trim().min(1).max(500).describe("What it is, shown on the card, e.g. \"GitHub personal access token with repo scope\""),
+            reason: z.string().trim().min(10, "Say why you need it").max(2000).describe("Why you need it and what you'll do with it, shown on the card as your words"),
+        }),
+        run: async ({ args }) => {
+            const id = await createSecretRequest({
+                user_id,
+                bot_id,
+                session_id,
+                workspace_id,
+                key: args.key,
+                description: args.description,
+                reason: args.reason,
+            });
+
+            onRequest({ ref: secretRequestRef({ id }) });
+
+            return `Asked the user for ${args.key.trim()}: the card is on your message. Their answer arrives as a message once it's saved; then it's $${args.key.trim()} on your computers. Never ask them to paste it in the chat.`;
+        },
+    };
+}

src/harness/tools/bot/secrets/show-secret-tool.ts

@@ -0,0 +1,55 @@
+import { z } from "zod";
+import grabComputerEnvs from "@/src/functions/backend/db/envs/grab-computer-envs";
+import grabRunEnvs from "@/src/functions/backend/db/extensions/grab-run-envs";
+import secretRef from "@/src/utils/secret-ref";
+import type { HarnessTool } from "../../../types";
+
+type Params = {
+    user_id: number | string;
+    bot_id: number | string;
+    workspace_id?: number | string | null;
+    /**
+     * The computer the run is on, whose envs count too.
+     */
+    computer_id?: number | string | null;
+    /**
+     * Called with the secret's ref, so the message always carries its chip.
+     */
+    onShow: (params: { ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+};
+
+/**
+ * Lets a bot show the user an env it has (by key) as a masked chip, without
+ * ever holding the value: it gets a `[secret:ID]` ref, and the chat
+ * fetches the value only for whoever may see it (`canRevealEnv`).
+ */
+export default function showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow }: Params): HarnessTool<Args> {
+    return {
+        name: "show_secret",
+        description: `Show the user one of your envs (by key, e.g. a password or token they saved or you captured) without reading it: you get a [secret:ID] ref to put in your message, which the user sees masked with Reveal and Copy. Never print a secret with a command to show it. Only its owner (for a personal secret) or a super admin can reveal it.`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128),
+        }),
+        run: async ({ args }) => {
+            const key = args.key.trim();
+            const on_computer = computer_id
+                ? await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id })
+                : [];
+            const env =
+                on_computer.find((e) => e.key == key) ||
+                (await grabRunEnvs({ bot_id, user_id, workspace_id })).find((e) => e.key == key);
+
+            if (!env) return `No env called ${key} reaches you here. Ask the user with request_secret if you need it.`;
+
+            const ref = secretRef({ id: env.id });
+
+            onShow({ ref });
+
+            return `Put ${ref} in your message: the user sees ${key} masked, with Reveal and Copy. Never repeat or guess the value.`;
+        },
+    };
+}