tbenandClaude Opus 5.5
8890d80e6e
Chat replies now list the envs that reach them (keys and descriptions, never values), so a bot no longer asks for keys that are set or "checks" them with show_secret or printenv. request_secret refuses a key that's already set unless the user asked to replace it, and search_computers says envs aren't loaded in its shell. start_task and delegate_task results say "Run #N" and that list_tasks doesn't show it, since bots sent users to the to-do list for queue jobs. start_task refuses a second open run in the session on the same computer unless it's separate work, and says how many runs are ahead on that computer. Co-Authored-By: Claude Opus 5.5 <[email protected]>
51 lines
2.2 KiB
TypeScript
51 lines
2.2 KiB
TypeScript
import { z } from "zod";
|
|
import grabReachableEnvs from "@/src/functions/backend/db/envs/grab-reachable-envs";
|
|
import secretRef from "@/src/utils/secret-ref";
|
|
import type { HarnessTool } from "../../../types";
|
|
|
|
type Params = {
|
|
user_id: number | string;
|
|
bot_id: number | string;
|
|
workspace_id?: number | string | null;
|
|
/**
|
|
* The computer the run is on, whose envs count too.
|
|
*/
|
|
computer_id?: number | string | null;
|
|
/**
|
|
* Called with the secret's ref, so the message always carries its chip.
|
|
*/
|
|
onShow: (params: { ref: string }) => void;
|
|
};
|
|
|
|
type Args = {
|
|
key: string;
|
|
};
|
|
|
|
/**
|
|
* Lets a bot show the user an env it has (by key) as a masked chip, without
|
|
* ever holding the value: it gets a `[secret:ID]` ref, and the chat
|
|
* fetches the value only for whoever may see it (`canRevealEnv`).
|
|
*/
|
|
export default function showSecretTool({ user_id, bot_id, workspace_id, computer_id, onShow }: Params): HarnessTool<Args> {
|
|
return {
|
|
name: "show_secret",
|
|
description: `Show the user one of your envs (by key, e.g. a password or token they saved or you captured) without reading it: you get a [secret:ID] ref to put in your message, which the user sees masked with Reveal and Copy. Only when the user wants to see it: to check which envs you have, read "Your envs" in your instructions instead. Never print a secret with a command to show it. Only its owner (for a personal secret) or a super admin can reveal it.`,
|
|
schema: z.object({
|
|
key: z.string().trim().min(1).max(128),
|
|
}),
|
|
run: async ({ args }) => {
|
|
const key = args.key.trim();
|
|
const { on_computer, tools_only } = await grabReachableEnvs({ bot_id, user_id, workspace_id, computer_id });
|
|
const env = [...on_computer, ...tools_only].find((e) => e.key == key);
|
|
|
|
if (!env) return `No env called ${key} reaches you here. Ask the user with request_secret if you need it.`;
|
|
|
|
const ref = secretRef({ id: env.id });
|
|
|
|
onShow({ ref });
|
|
|
|
return `Put ${ref} in your message: the user sees ${key} masked, with Reveal and Copy. Never repeat or guess the value.`;
|
|
},
|
|
};
|
|
}
|