Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/settings/environment/(sections)/environment-settings-section.tsx

@@ -2,14 +2,17 @@ import { useContext, useState } from "react";
 import { AppContext } from "@/src/pages/__root";
 import type { EnvsMutationResult, EnvsOverviewPayload } from "@/src/types";
 import EnvsGroup from "../../(partials)/envs/envs-group";
+import postEnvApi from "../../(functions)/post-env-api";
+import PersonalSecretsGroup from "../../(partials)/secrets/personal-secrets-group";
 import EnvScopeSelect from "../(partials)/env-scope-select";
 import KnownEnvsGroup from "../(partials)/known-envs-group";
 import scopeValue, { envInScope } from "../(utils)/scope-value";
 
 /**
  * Pick where (general, a workspace, a bot or a computer), then that scope's
- * envs. General also lists the app settings. Every change saves at once and
- * refreshes the page data.
+ * envs. General also lists the app settings. Below, every user's personal
+ * secrets (set from the chat), which can only be removed here. Every change
+ * saves at once and refreshes the page data.
  */
 export default function EnvironmentSettingsSection() {
     const { pageProps } = useContext(AppContext);
@@ -20,6 +23,7 @@ export default function EnvironmentSettingsSection() {
      * Remounts the lists when the data changes under them.
      */
     const [version, setVersion] = useState(0);
+    const [removing, setRemoving] = useState<number>();
 
     if (!overview) return null;
 
@@ -60,6 +64,23 @@ export default function EnvironmentSettingsSection() {
                 onChanged={changed}
                 onError={failed}
             />
+            <PersonalSecretsGroup
+                title="Personal secrets"
+                description="What users gave their bots from the chat, each for one user's runs of one bot. Only its user can see or replace one; you can remove it."
+                secrets={overview.personal || []}
+                show_user
+                busy_id={removing}
+                onRemove={async ({ secret }) => {
+                    if (!window.confirm(`Remove ${secret.user_name}'s ${secret.key} for ${secret.bot_name}?`)) return;
+
+                    setRemoving(secret.id);
+                    const res = await postEnvApi({ path: "delete-env", body: { env_id: secret.id } }).catch(() => null);
+                    setRemoving(undefined);
+
+                    if (res?.success && res.singleRes) changed(res.singleRes, res.msg || "Removed.");
+                    else failed(res?.msg || "Couldn't remove it.");
+                }}
+            />
         </>
     );
 }