Moduletrace/cobble
2
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 32 Wiki Activity

Tell replies their envs and call queued work runs

Browse Source 
Chat replies now list the envs that reach them (keys and descriptions,
never values), so a bot no longer asks for keys that are set or "checks"
them with show_secret or printenv. request_secret refuses a key that's
already set unless the user asked to replace it, and search_computers
says envs aren't loaded in its shell.

start_task and delegate_task results say "Run #N" and that list_tasks
doesn't show it, since bots sent users to the to-do list for queue jobs.
start_task refuses a second open run in the session on the same
computer unless it's separate work, and says how many runs are ahead on
that computer.

Co-Authored-By: Claude Opus 5.5 <[email protected]>
This commit is contained in:
tben
2026-10-27 19:33:45 +01:00
co-authored by Claude Opus 5.5
parent f39c824c34
commit 8890d80e6e
13 changed files with 247 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/harness/tools/bot/secrets/show-secret-tool.ts
+4 -9
View File
@@ -1,6 +1,5 @@
import { z } from "zod";
import grabComputerEnvs from "@/src/functions/backend/db/envs/grab-computer-envs";
import grabRunEnvs from "@/src/functions/backend/db/extensions/grab-run-envs";
import grabReachableEnvs from "@/src/functions/backend/db/envs/grab-reachable-envs";
import secretRef from "@/src/utils/secret-ref";
import type { HarnessTool } from "../../../types";
@@ -30,18 +29,14 @@ type Args = {
export default function showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow }: Params): HarnessTool<Args> {
return {
name: "show_secret",
description: `Show the user one of your envs (by key, e.g. a password or token they saved or you captured) without reading it: you get a [secret:ID] ref to put in your message, which the user sees masked with Reveal and Copy. Never print a secret with a command to show it. Only its owner (for a personal secret) or a super admin can reveal it.`,
description: `Show the user one of your envs (by key, e.g. a password or token they saved or you captured) without reading it: you get a [secret:ID] ref to put in your message, which the user sees masked with Reveal and Copy. Only when the user wants to see it: to check which envs you have, read "Your envs" in your instructions instead. Never print a secret with a command to show it. Only its owner (for a personal secret) or a super admin can reveal it.`,
schema: z.object({
key: z.string().trim().min(1).max(128),
}),
run: async ({ args }) => {
const key = args.key.trim();
const on_computer = computer_id
? await grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id })
: [];
const env =
on_computer.find((e) => e.key == key) ||
(await grabRunEnvs({ bot_id, user_id, workspace_id })).find((e) => e.key == key);
const { on_computer, tools_only } = await grabReachableEnvs({ bot_id, user_id, workspace_id, computer_id });
const env = [...on_computer, ...tools_only].find((e) => e.key == key);
if (!env) return `No env called ${key} reaches you here. Ask the user with request_secret if you need it.`;