tbenandClaude Opus 5.5
69988e08fc
A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
46 lines
1.5 KiB
TypeScript
46 lines
1.5 KiB
TypeScript
import BunSQLite from "@moduletrace/bun-sqlite";
|
|
import grabAllEnvs from "./grab-all-envs";
|
|
import resolveScopedEnvs from "./resolve-scoped-envs";
|
|
|
|
type Params = {
|
|
computer_id: number | string;
|
|
/**
|
|
* The bot the run is for: its own envs beat everything else.
|
|
*/
|
|
bot_id?: number | string | null;
|
|
/**
|
|
* The user the run is for: their personal envs for the bot apply.
|
|
*/
|
|
user_id?: number | string | null;
|
|
/**
|
|
* The workspace the run is in. Its envs apply when the computer is
|
|
* linked to it (and it isn't archived); outside a workspace only the
|
|
* computer's own and general envs do.
|
|
*/
|
|
workspace_id?: number | string | null;
|
|
};
|
|
|
|
/**
|
|
* The envs a run on this computer gets (`resolveScopedEnvs`).
|
|
*/
|
|
export default async function grabComputerEnvs({ computer_id, bot_id, user_id, workspace_id }: Params) {
|
|
const linked = workspace_id
|
|
? (
|
|
await BunSQLite.sql<{ id: number }>({
|
|
sql: `SELECT w.id FROM workspaces w
|
|
JOIN workspace_computers wc ON wc.workspace_id = w.id AND wc.computer_id = ?
|
|
WHERE w.id = ? AND w.archived = 0 LIMIT 1`,
|
|
values: [computer_id, workspace_id],
|
|
})
|
|
).payload?.[0]
|
|
: null;
|
|
|
|
return resolveScopedEnvs({
|
|
envs: await grabAllEnvs(),
|
|
bot_id,
|
|
user_id,
|
|
computer_id: Number(computer_id),
|
|
workspace_ids: linked?.id ? [Number(linked.id)] : [],
|
|
});
|
|
}
|