Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
2026-10-25 16:51:32 +01:00
parent 83ff79b9c3
commit 69988e08fc
78 changed files with 2472 additions and 52 deletions
@@ -0,0 +1,81 @@
+import { useState } from "react";
+import Row from "@moduletrace/twui/layout/Row";
+import Span from "@moduletrace/twui/layout/Span";
+import { Check, Copy, Eye, EyeOff, KeyRound } from "lucide-react";
+import revealSecret from "@/src/functions/frontend/reveal-secret";
+import copyPendingText from "@/src/utils/copy-pending-text";
+import useSecretRef from "../(hooks)/use-secret-ref";
+import SecretChipButton from "./secret-chip-button";
+
+type Props = {
+    env_id: number;
+};
+
+/**
+ * A secret a bot showed (`secretRef`): its key, masked, with Reveal and
+ * Copy for whoever may see it (`canRevealEnv`). The value is fetched only
+ * on a click, held only while shown, and never in the page or the thread.
+ */
+export default function SecretRefChip({ env_id }: Props) {
+    const { view, loading } = useSecretRef({ env_id });
+    const [value, setValue] = useState<string>();
+    const [copied, setCopied] = useState(false);
+    const [error, setError] = useState<string>();
+
+    if (!view) {
+        return (
+            <Span className="font-bold">{loading ? `secret ${env_id}` : `secret ${env_id} (not available)`}</Span>
+        );
+    }
+
+    const reveal = async () => {
+        if (value !== undefined) {
+            setValue(undefined);
+            return;
+        }
+
+        setError(undefined);
+
+        try {
+            setValue(await revealSecret({ env_id }));
+        } catch (e) {
+            setError(e instanceof Error ? e.message : String(e));
+        }
+    };
+
+    const copy = async () => {
+        setError(undefined);
+
+        const ok = await copyPendingText({ text: revealSecret({ env_id }) }).catch((e: Error) => {
+            setError(e.message);
+            return false;
+        });
+
+        if (!ok) return;
+
+        setCopied(true);
+        setTimeout(() => setCopied(false), 2000);
+    };
+
+    return (
+        <Row
+            title={view.description || view.key}
+            className="inline-flex h-6 max-w-full gap-1! flex-nowrap items-center align-middle rounded-default border border-hairline px-2 text-[13px] text-ink"
+        >
+            <KeyRound size={14} aria-hidden className="shrink-0" />
+            <Span className="font-bold whitespace-nowrap">{view.key}</Span>
+            <Span className="font-mono truncate select-all">{value ?? "••••••••"}</Span>
+            {view.can_reveal ? (
+                <>
+                    <SecretChipButton
+                        title={value === undefined ? `Reveal ${view.key}` : `Hide ${view.key}`}
+                        icon={value === undefined ? Eye : EyeOff}
+                        onClick={reveal}
+                    />
+                    <SecretChipButton title={`Copy ${view.key}`} icon={copied ? Check : Copy} onClick={copy} />
+                </>
+            ) : null}
+            {error ? <Span className="text-[12px] text-ink-secondary whitespace-nowrap">{error}</Span> : null}
+        </Row>
+    );
+}