Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/harness/tools/computer/capture-secret-tool.ts

@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { AppData } from "@/src/data/app-data";
+import saveUserSecret from "@/src/functions/backend/db/envs/save-user-secret";
+import { resolveComputerPath, type ComputerRunDirs } from "@/src/utils/computer-work-dirs";
+import secretRef from "@/src/utils/secret-ref";
+import type { HarnessTool } from "../../types";
+import computerDirsShell from "./computer-dirs-shell";
+import downloadComputerFile from "./download-computer-file";
+import runComputerCommand from "./run-computer-command";
+
+type Params = {
+    /**
+     * The sandbox's REST address (no `/mcp`).
+     */
+    base_url: string;
+    /**
+     * The computer's env file, sourced before a command.
+     */
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    /**
+     * Whose secret it becomes: the run's user, for this bot.
+     */
+    user_id: number | string;
+    bot_id: number | string;
+    /**
+     * Called with each captured value and its key, so the run blanks it
+     * out of everything the bot reads from then on.
+     */
+    onCapture: (params: { key: string; value: string; ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+    description: string;
+    from: "file" | "command";
+    path?: string;
+    command?: string;
+};
+
+/**
+ * Saves a secret that's on the computer (a generated password, a token a
+ * CLI printed, a key file) as the user's personal secret for this bot,
+ * without the bot ever reading it: the file comes over the sandbox's
+ * download endpoint, a command's output over its REST shell, and neither
+ * is returned. The bot gets a `[secret:ID]` ref to show the user, and the
+ * value is redacted from everything it reads afterwards.
+ */
+export default function captureSecretTool({
+    base_url,
+    shell_path,
+    dirs,
+    user_id,
+    bot_id,
+    onCapture,
+}: Params): HarnessTool<Args> {
+    return {
+        name: "capture_secret",
+        description: `Save a secret that's on this computer (a password you generated, a token or API key a command printed, a key file) as the user's own secret for you, without reading it yourself: never cat, echo or print a secret, capture it instead. from "file" saves a file's contents (path in your folders); from "command" saves what a bash command prints (stdout, with your envs set), e.g. "printenv NAME" or "openssl rand -base64 24 | tee pw.txt". One trailing newline is dropped. You get back a [secret:ID] ref: put it in your message and the user sees the secret masked, with Reveal and Copy. It's also set as $KEY on your computers for this user's later runs. Values over ${AppData.CapturedSecretMaxChars} characters are refused.`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128).describe("The env key it's saved under, e.g. ADMIN_PASSWORD"),
+            description: z.string().trim().min(1).max(500).describe("What it is, for the user"),
+            from: z.enum(["file", "command"]),
+            path: z.string().trim().min(1).max(1000).optional().describe("For from file"),
+            command: z.string().trim().min(1).max(4000).optional().describe("For from command"),
+        }),
+        run: async ({ args, signal }) => {
+            const value = await readValue({ args, base_url, shell_path, dirs, signal });
+
+            if (value.text === undefined) return value.error;
+
+            const env_id = await saveUserSecret({
+                user_id,
+                bot_id,
+                key: args.key,
+                value: value.text,
+                description: args.description,
+            });
+            const ref = secretRef({ id: env_id });
+
+            onCapture({ key: args.key.trim(), value: value.text, ref });
+
+            return `Saved as ${args.key.trim()} (${value.text.length} characters). Put ${ref} in your message to show it to the user; never repeat or guess the value.`;
+        },
+    };
+}
+
+async function readValue({
+    args,
+    base_url,
+    shell_path,
+    dirs,
+    signal,
+}: {
+    args: Args;
+    base_url: string;
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    signal?: AbortSignal;
+}): Promise<{ text: string; error?: undefined } | { text?: undefined; error: string }> {
+    let text = "";
+
+    if (args.from == "file") {
+        if (!args.path) return { error: `Give the file's path.` };
+
+        const download = await downloadComputerFile({
+            base_url,
+            path: resolveComputerPath({ path: args.path, dirs }),
+            max_bytes: AppData.CapturedSecretMaxChars * 4,
+            signal,
+        });
+
+        if (!download.ok) {
+            return {
+                error:
+                    download.reason == "missing"
+                        ? `There's no file at ${args.path}.`
+                        : download.reason == "too_big"
+                          ? `That file is too big to be a secret.`
+                          : `The file changed while it was read. Try again.`,
+            };
+        }
+
+        text = download.bytes.toString("utf8");
+    } else {
+        if (!args.command) return { error: `Give the command.` };
+
+        const result = await runComputerCommand({
+            base_url,
+            command: `(${computerDirsShell({ dirs })}[ -f ${shell_path} ] && . ${shell_path}; ${args.command}) 2>/dev/null`,
+            timeout_ms: AppData.CaptureSecretTimeoutMs,
+            signal,
+        });
+
+        if (result.exit_code != 0) {
+            return { error: `The command failed (exit code ${result.exit_code ?? "unknown"}). Nothing was saved.` };
+        }
+
+        text = result.output;
+    }
+
+    text = text.replace(/\r?\n$/, "");
+
+    if (!text) return { error: `It was empty. Nothing was saved.` };
+
+    if (text.length > AppData.CapturedSecretMaxChars) {
+        return { error: `That's over ${AppData.CapturedSecretMaxChars} characters, too long to be a secret. Nothing was saved.` };
+    }
+
+    return { text };
+}

src/harness/tools/computer/open-computer-tools.ts

@@ -10,6 +10,7 @@ import grabMcpTools from "../../mcp/grab-mcp-tools";
 import readImage from "../../media/read-image";
 import type { HarnessTool } from "../../types";
 import computerDirsShell from "./computer-dirs-shell";
+import captureSecretTool from "./capture-secret-tool";
 import runComputerCommand from "./run-computer-command";
 import withComputerDirs from "./with-computer-dirs";
 import withComputerEnv from "./with-computer-env";
@@ -21,6 +22,10 @@ type Params = {
      * Screenshots are read with this bot's media reading model.
      */
     bot_id?: number | string;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply, and its models read
      * screenshots.
@@ -31,6 +36,12 @@ type Params = {
      * kept inside them.
      */
     dirs: ComputerRunDirs;
+    /**
+     * Called with the ref of each secret the bot captures on the computer
+     * (`capture_secret`), so the run's message always carries its chip.
+     * Without it, or without a user, the bot can't capture secrets.
+     */
+    onSecretRef?: (params: { ref: string }) => void;
     signal?: AbortSignal;
 };
 
@@ -61,8 +72,10 @@ export type OpenComputer = {
 export default async function openComputerTools({
     computer_id,
     bot_id,
+    user_id,
     workspace_id,
     dirs,
+    onSecretRef,
     signal,
 }: Params): Promise<OpenComputer> {
     const target = await grabComputerMcpUrl({ computer_id });
@@ -75,7 +88,7 @@ export default async function openComputerTools({
         throw new Error(computerNotReadyMessage(target));
     }
 
-    const envs = await grabComputerEnvs({ computer_id, bot_id, workspace_id });
+    const envs = await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id });
     const paths = await writeComputerEnv({ base_url: target.base_url, envs, signal });
 
     await runComputerCommand({
@@ -85,7 +98,11 @@ export default async function openComputerTools({
         signal,
     });
 
-    const secrets = envs.filter((env) => env.secret);
+    /**
+     * Grows as the bot captures secrets, so a value it saved is blanked
+     * from everything it reads afterwards too.
+     */
+    const secrets: { key: string; value: string }[] = envs.filter((env) => env.secret);
     const redact = (text: string) => redactSecrets({ text, secrets });
 
     const client = await connectMcpServer({ url: target.url, signal });
@@ -107,7 +124,24 @@ export default async function openComputerTools({
 
         return {
             name: target.name,
-            tools: tools.map((tool) => withComputerDirs({ tool: withComputerEnv({ tool, ...paths }), dirs })),
+            tools: [
+                ...tools.map((tool) => withComputerDirs({ tool: withComputerEnv({ tool, ...paths }), dirs })),
+                ...(user_id && bot_id && onSecretRef
+                    ? [
+                          captureSecretTool({
+                              base_url: target.base_url,
+                              shell_path: paths.shell_path,
+                              dirs,
+                              user_id,
+                              bot_id,
+                              onCapture: ({ key, value, ref }) => {
+                                  secrets.push({ key, value });
+                                  onSecretRef({ ref });
+                              },
+                          }),
+                      ]
+                    : []),
+            ],
             envs: envs.map((env) => ({ key: env.key, description: env.description })),
             redact,
             close: () => client.close().catch(() => {}),

src/harness/tools/computer/search-computers-tool.ts

@@ -16,6 +16,10 @@ type Params = {
      * The bot the run is for: its own envs beat everything.
      */
     bot_id?: number | string | null;
+    /**
+     * The user the run is for: their personal envs for the bot apply.
+     */
+    user_id?: number | string | null;
     /**
      * The workspace the run is in: its envs apply.
      */
@@ -44,6 +48,7 @@ type Args = {
  */
 export default function searchComputersTool({
     bot_id,
+    user_id,
     workspace_id,
     computers,
     dirs,
@@ -76,6 +81,7 @@ export default function searchComputersTool({
                             grabComputerEnvs({
                                 computer_id: computer.id || 0,
                                 bot_id,
+                                user_id,
                                 workspace_id,
                             }),
                         ]);