Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-25 16:51:32 +01:00
parent 83ff79b9c3
commit 69988e08fc
78 changed files with 2472 additions and 52 deletions
@@ -0,0 +1,151 @@
+import { z } from "zod";
+import { AppData } from "@/src/data/app-data";
+import saveUserSecret from "@/src/functions/backend/db/envs/save-user-secret";
+import { resolveComputerPath, type ComputerRunDirs } from "@/src/utils/computer-work-dirs";
+import secretRef from "@/src/utils/secret-ref";
+import type { HarnessTool } from "../../types";
+import computerDirsShell from "./computer-dirs-shell";
+import downloadComputerFile from "./download-computer-file";
+import runComputerCommand from "./run-computer-command";
+
+type Params = {
+    /**
+     * The sandbox's REST address (no `/mcp`).
+     */
+    base_url: string;
+    /**
+     * The computer's env file, sourced before a command.
+     */
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    /**
+     * Whose secret it becomes: the run's user, for this bot.
+     */
+    user_id: number | string;
+    bot_id: number | string;
+    /**
+     * Called with each captured value and its key, so the run blanks it
+     * out of everything the bot reads from then on.
+     */
+    onCapture: (params: { key: string; value: string; ref: string }) => void;
+};
+
+type Args = {
+    key: string;
+    description: string;
+    from: "file" | "command";
+    path?: string;
+    command?: string;
+};
+
+/**
+ * Saves a secret that's on the computer (a generated password, a token a
+ * CLI printed, a key file) as the user's personal secret for this bot,
+ * without the bot ever reading it: the file comes over the sandbox's
+ * download endpoint, a command's output over its REST shell, and neither
+ * is returned. The bot gets a `[secret:ID]` ref to show the user, and the
+ * value is redacted from everything it reads afterwards.
+ */
+export default function captureSecretTool({
+    base_url,
+    shell_path,
+    dirs,
+    user_id,
+    bot_id,
+    onCapture,
+}: Params): HarnessTool<Args> {
+    return {
+        name: "capture_secret",
+        description: `Save a secret that's on this computer (a password you generated, a token or API key a command printed, a key file) as the user's own secret for you, without reading it yourself: never cat, echo or print a secret, capture it instead. from "file" saves a file's contents (path in your folders); from "command" saves what a bash command prints (stdout, with your envs set), e.g. "printenv NAME" or "openssl rand -base64 24 | tee pw.txt". One trailing newline is dropped. You get back a [secret:ID] ref: put it in your message and the user sees the secret masked, with Reveal and Copy. It's also set as $KEY on your computers for this user's later runs. Values over ${AppData.CapturedSecretMaxChars} characters are refused.`,
+        schema: z.object({
+            key: z.string().trim().min(1).max(128).describe("The env key it's saved under, e.g. ADMIN_PASSWORD"),
+            description: z.string().trim().min(1).max(500).describe("What it is, for the user"),
+            from: z.enum(["file", "command"]),
+            path: z.string().trim().min(1).max(1000).optional().describe("For from file"),
+            command: z.string().trim().min(1).max(4000).optional().describe("For from command"),
+        }),
+        run: async ({ args, signal }) => {
+            const value = await readValue({ args, base_url, shell_path, dirs, signal });
+
+            if (value.text === undefined) return value.error;
+
+            const env_id = await saveUserSecret({
+                user_id,
+                bot_id,
+                key: args.key,
+                value: value.text,
+                description: args.description,
+            });
+            const ref = secretRef({ id: env_id });
+
+            onCapture({ key: args.key.trim(), value: value.text, ref });
+
+            return `Saved as ${args.key.trim()} (${value.text.length} characters). Put ${ref} in your message to show it to the user; never repeat or guess the value.`;
+        },
+    };
+}
+
+async function readValue({
+    args,
+    base_url,
+    shell_path,
+    dirs,
+    signal,
+}: {
+    args: Args;
+    base_url: string;
+    shell_path: string;
+    dirs: ComputerRunDirs;
+    signal?: AbortSignal;
+}): Promise<{ text: string; error?: undefined } | { text?: undefined; error: string }> {
+    let text = "";
+
+    if (args.from == "file") {
+        if (!args.path) return { error: `Give the file's path.` };
+
+        const download = await downloadComputerFile({
+            base_url,
+            path: resolveComputerPath({ path: args.path, dirs }),
+            max_bytes: AppData.CapturedSecretMaxChars * 4,
+            signal,
+        });
+
+        if (!download.ok) {
+            return {
+                error:
+                    download.reason == "missing"
+                        ? `There's no file at ${args.path}.`
+                        : download.reason == "too_big"
+                          ? `That file is too big to be a secret.`
+                          : `The file changed while it was read. Try again.`,
+            };
+        }
+
+        text = download.bytes.toString("utf8");
+    } else {
+        if (!args.command) return { error: `Give the command.` };
+
+        const result = await runComputerCommand({
+            base_url,
+            command: `(${computerDirsShell({ dirs })}[ -f ${shell_path} ] && . ${shell_path}; ${args.command}) 2>/dev/null`,
+            timeout_ms: AppData.CaptureSecretTimeoutMs,
+            signal,
+        });
+
+        if (result.exit_code != 0) {
+            return { error: `The command failed (exit code ${result.exit_code ?? "unknown"}). Nothing was saved.` };
+        }
+
+        text = result.output;
+    }
+
+    text = text.replace(/\r?\n$/, "");
+
+    if (!text) return { error: `It was empty. Nothing was saved.` };
+
+    if (text.length > AppData.CapturedSecretMaxChars) {
+        return { error: `That's over ${AppData.CapturedSecretMaxChars} characters, too long to be a secret. Nothing was saved.` };
+    }
+
+    return { text };
+}