Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/bots/[bot_id]/(hooks)/use-secret-ref.ts

@@ -0,0 +1,55 @@
+import fetchApi from "@moduletrace/twui/utils/fetch/fetchApi";
+import type { APIResponseObject } from "@moduletrace/bunext/types";
+import { useEffect, useState } from "react";
+import type { SecretRefView } from "@/src/types";
+
+type Params = {
+    env_id: number;
+};
+
+/**
+ * Secret refs already read, by id. Only the key and whether the viewer may
+ * reveal it: the value is fetched on Reveal or Copy and never cached here.
+ */
+const loaded = new Map<number, Promise<SecretRefView | null>>();
+
+function loadSecret({ env_id }: Params) {
+    const cached = loaded.get(env_id);
+
+    if (cached) return cached;
+
+    const pending = fetchApi<{}, APIResponseObject<SecretRefView>>(
+        `/api/admin/secrets/get-secret?env_id=${env_id}`,
+        { method: "GET" },
+    )
+        .then((res) => (res?.success && res.singleRes ? res.singleRes : null))
+        .catch(() => null);
+
+    loaded.set(env_id, pending);
+
+    return pending;
+}
+
+/**
+ * A secret a bot showed (`[secret:ID]`), for its masked chip.
+ */
+export default function useSecretRef({ env_id }: Params) {
+    const [view, setView] = useState<SecretRefView | null>(null);
+    const [loading, setLoading] = useState(true);
+
+    useEffect(() => {
+        let live = true;
+
+        loadSecret({ env_id }).then((result) => {
+            if (!live) return;
+            setView(result);
+            setLoading(false);
+        });
+
+        return () => {
+            live = false;
+        };
+    }, [env_id]);
+
+    return { view, loading };
+}

src/pages/admin/bots/[bot_id]/(hooks)/use-secret-request.ts

@@ -0,0 +1,65 @@
+import fetchApi from "@moduletrace/twui/utils/fetch/fetchApi";
+import type { APIResponseObject } from "@moduletrace/bunext/types";
+import { useCallback, useEffect, useState } from "react";
+import type { SecretRequestView } from "@/src/types";
+
+type Params = {
+    request_id: number;
+};
+
+/**
+ * Secret requests already read, by id, so a thread naming one twice asks
+ * once. An answer replaces its entry.
+ */
+const loaded = new Map<number, Promise<SecretRequestView | null>>();
+
+function loadRequest({ request_id }: Params) {
+    const cached = loaded.get(request_id);
+
+    if (cached) return cached;
+
+    const pending = fetchApi<{}, APIResponseObject<SecretRequestView>>(
+        `/api/admin/secret-requests/get-request?request_id=${request_id}`,
+        { method: "GET" },
+    )
+        .then((res) => (res?.success && res.singleRes ? res.singleRes : null))
+        .catch(() => null);
+
+    loaded.set(request_id, pending);
+
+    return pending;
+}
+
+/**
+ * A secret a bot asked for (`[secret-request:ID]`), for its chip and card:
+ * read when the chip renders, so it shows whether it's still waiting.
+ * Only the user it was asked of can read it; anyone else gets null.
+ */
+export default function useSecretRequest({ request_id }: Params) {
+    const [view, setViewState] = useState<SecretRequestView | null>(null);
+    const [loading, setLoading] = useState(true);
+
+    useEffect(() => {
+        let live = true;
+
+        loadRequest({ request_id }).then((result) => {
+            if (!live) return;
+            setViewState(result);
+            setLoading(false);
+        });
+
+        return () => {
+            live = false;
+        };
+    }, [request_id]);
+
+    const setView = useCallback(
+        (next: SecretRequestView) => {
+            loaded.set(request_id, Promise.resolve(next));
+            setViewState(next);
+        },
+        [request_id],
+    );
+
+    return { view, loading, setView };
+}