Move secrets between users and computers without the model seeing them

A new personal env scope (paradigm user: one user's secret for one bot)
beats every other scope, reaches only that user's runs of that bot, and
is redacted like any secret. Bots take secrets in with request_secret,
which puts a [secret-request:ID] card in the chat: the user types the
value into a masked input there, never into a message, and the bot is
told only the key. Bots show secrets with capture_secret (a task's
computer tool that saves a file or a command's output straight to a
personal env, then redacts it from the rest of the run) and show_secret
(an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch
the value on click, for its own user (personal) or a super admin
(anything else), logged by key. Values never go into messages, page
props, history, Copy chat or logs. Users manage their own secrets on
Settings > Secrets; the Environment page lists everyone's, remove only.
Deleting a bot or user removes its personal secrets, and SecretsNote
tells bots never to ask for or print secrets in chat.

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/pages/admin/settings/secrets/(sections)/secrets-settings-section.tsx

@@ -0,0 +1,59 @@
+import { useContext, useState } from "react";
+import fetchApi from "@moduletrace/twui/utils/fetch/fetchApi";
+import type { APIResponseObject } from "@moduletrace/bunext/types";
+import { AppContext } from "@/src/pages/__root";
+import type { PersonalSecret } from "@/src/types";
+import PersonalSecretsGroup from "../../(partials)/secrets/personal-secrets-group";
+
+/**
+ * The user's own personal secrets, with Replace and Remove. Every change
+ * saves at once and refreshes the list.
+ */
+export default function SecretsSettingsSection() {
+    const { pageProps } = useContext(AppContext);
+    const [secrets, setSecrets] = useState<PersonalSecret[]>(pageProps?.personal_secrets || []);
+    const [busy_id, setBusyId] = useState<number>();
+    const [status, setStatus] = useState<{ error?: boolean; success?: boolean; msg?: string }>();
+
+    const post = async ({ path, body }: { path: "save-secret" | "delete-secret"; body: Record<string, unknown> }) => {
+        const res = await fetchApi<Record<string, unknown>, APIResponseObject<PersonalSecret[]>>(
+            `/api/admin/secrets/${path}`,
+            { method: "POST", body },
+        ).catch(() => null);
+
+        if (res?.success && res.singleRes) {
+            setSecrets(res.singleRes);
+            setStatus({ success: true, msg: res.msg || "Saved." });
+            return true;
+        }
+
+        setStatus({ error: true, msg: res?.msg || "Couldn't save it." });
+        return false;
+    };
+
+    return (
+        <PersonalSecretsGroup
+            title="Your secrets"
+            description="Each one is for one bot and only your runs of it. Bots ask for them with a card in the chat, never in a message."
+            secrets={secrets}
+            busy_id={busy_id}
+            status={status}
+            onReplace={async ({ secret, value }) => {
+                if (!window.confirm(`Replace ${secret.key} for ${secret.bot_name}?`)) return false;
+
+                setBusyId(secret.id);
+                const ok = await post({ path: "save-secret", body: { env_id: secret.id, value } });
+                setBusyId(undefined);
+
+                return ok;
+            }}
+            onRemove={async ({ secret }) => {
+                if (!window.confirm(`Remove ${secret.key} for ${secret.bot_name}? Its computers drop it on their next run.`)) return;
+
+                setBusyId(secret.id);
+                await post({ path: "delete-secret", body: { env_id: secret.id } });
+                setBusyId(undefined);
+            }}
+        />
+    );
+}

src/pages/admin/settings/secrets/index.server.ts

@@ -0,0 +1,23 @@
+import type { PagePropsType } from "@/src/types";
+import type { BunextPageServerFn } from "@moduletrace/bunext/types";
+import userAuth from "@/src/functions/backend/auth/user-auth";
+import grabPersonalSecrets from "@/src/functions/backend/db/envs/grab-personal-secrets";
+import grabSettingsServerProps from "../(functions)/grab-settings-server-props";
+
+/**
+ * Every user's own personal secrets: keys only, never values.
+ */
+export const server: BunextPageServerFn<PagePropsType> = async (params) => {
+    const settings = await grabSettingsServerProps(params);
+
+    if (!settings.props) return settings;
+
+    const { user } = await userAuth({ req: params.req });
+
+    return {
+        props: {
+            ...settings.props,
+            personal_secrets: user?.id ? await grabPersonalSecrets({ user_id: user.id }) : [],
+        },
+    };
+};

src/pages/admin/settings/secrets/index.tsx

@@ -0,0 +1,16 @@
+import SecretsSettingsSection from "./(sections)/secrets-settings-section";
+import SettingsShell from "../(partials)/settings-shell";
+import settingsPageMeta from "../(functions)/settings-page-meta";
+
+export default function AdminSettingsSecretsPage() {
+    return (
+        <SettingsShell
+            title="Secrets"
+            description="Passwords, tokens and keys you gave your bots from the chat, or they saved for you. Bots use them by name and never see them."
+        >
+            <SecretsSettingsSection />
+        </SettingsShell>
+    );
+}
+
+export const meta = settingsPageMeta({ label: "Secrets" });