Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/bots/[bot_id]/(functions)/decide-secret-request.ts

@@ -0,0 +1,22 @@
+import fetchApi from "@moduletrace/twui/utils/fetch/fetchApi";
+import type { APIResponseObject } from "@moduletrace/bunext/types";
+import type { SecretRequestView } from "@/src/types";
+
+type Params = {
+    request_id: number;
+    /**
+     * The secret the user typed; none declines the request.
+     */
+    value?: string;
+};
+
+/**
+ * Saves the secret a bot asked for from its card, or declines it,
+ * returning the request as it now stands (never the value).
+ */
+export default async function decideSecretRequest({ request_id, value }: Params) {
+    return await fetchApi<{ request_id: number; value?: string }, APIResponseObject<SecretRequestView>>(
+        `/api/admin/secret-requests/${value === undefined ? "decline" : "answer"}-request`,
+        { method: "POST", body: value === undefined ? { request_id } : { request_id, value } },
+    );
+}