tbenandClaude Opus 5.5
69988e08fc
A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
39 lines
1.4 KiB
TypeScript
39 lines
1.4 KiB
TypeScript
import { describe, expect, test } from "bun:test";
|
|
import { renderToString } from "react-dom/server";
|
|
import type { SecretRequestView } from "@/src/types";
|
|
import SecretRequestCard from "./secret-request-card";
|
|
|
|
const token: SecretRequestView = {
|
|
id: 4,
|
|
key: "GITHUB_TOKEN",
|
|
description: "GitHub personal access token with repo scope",
|
|
reason: "To list your repositories with gh.",
|
|
status: "pending",
|
|
bot_id: 6,
|
|
bot_name: "Ada",
|
|
env_id: null,
|
|
};
|
|
|
|
function render({ view }: { view: SecretRequestView }) {
|
|
return renderToString(<SecretRequestCard view={view} onDecided={() => {}} onDone={() => {}} />);
|
|
}
|
|
|
|
describe("SecretRequestCard", () => {
|
|
test("asks for it in a masked input, with the bot's reason", () => {
|
|
const html = render({ view: token });
|
|
|
|
expect(html).toContain("GitHub personal access token with repo scope");
|
|
expect(html).toContain("To list your repositories with gh.");
|
|
expect(html).toContain(`type="password"`);
|
|
expect(html).toContain(">Save<");
|
|
});
|
|
|
|
test("once answered, offers no input or buttons", () => {
|
|
const saved = render({ view: { ...token, status: "saved", env_id: 9 } });
|
|
|
|
expect(saved).not.toContain(`type="password"`);
|
|
expect(saved).not.toContain(">Save<");
|
|
expect(render({ view: { ...token, status: "declined" } })).toContain("Nothing was saved");
|
|
});
|
|
});
|