tbenandClaude Opus 5.5
69988e08fc
A new personal env scope (paradigm user: one user's secret for one bot) beats every other scope, reaches only that user's runs of that bot, and is redacted like any secret. Bots take secrets in with request_secret, which puts a [secret-request:ID] card in the chat: the user types the value into a masked input there, never into a message, and the bot is told only the key. Bots show secrets with capture_secret (a task's computer tool that saves a file or a command's output straight to a personal env, then redacts it from the rest of the run) and show_secret (an env by key): both give a [secret:ID] chip whose Reveal and Copy fetch the value on click, for its own user (personal) or a super admin (anything else), logged by key. Values never go into messages, page props, history, Copy chat or logs. Users manage their own secrets on Settings > Secrets; the Environment page lists everyone's, remove only. Deleting a bot or user removes its personal secrets, and SecretsNote tells bots never to ask for or print secrets in chat. Co-Authored-By: Claude Opus 5.5 <[email protected]>
36 lines
1.2 KiB
TypeScript
36 lines
1.2 KiB
TypeScript
import BunSQLite from "@moduletrace/bun-sqlite";
|
|
import type { SecretRequestStatus } from "@/src/dict/env-dict";
|
|
import type { SecretRequestView } from "@/src/types";
|
|
import grabSecretRequest from "./grab-secret-request";
|
|
|
|
type Params = {
|
|
request_id: number | string;
|
|
user_id: number | string;
|
|
};
|
|
|
|
/**
|
|
* A secret request as its chip and card show it: the key, what it's for
|
|
* and why the bot asks. Never a value: the request never holds one.
|
|
*/
|
|
export default async function grabSecretRequestView({ request_id, user_id }: Params): Promise<SecretRequestView> {
|
|
const row = await grabSecretRequest({ request_id, user_id });
|
|
|
|
const bot = (
|
|
await BunSQLite.sql<{ name: string }>({
|
|
sql: `SELECT name FROM bots WHERE id = ? LIMIT 1`,
|
|
values: [row.bot_id || 0],
|
|
})
|
|
).payload?.[0];
|
|
|
|
return {
|
|
id: Number(row.id),
|
|
key: row.key || "",
|
|
description: row.description || "",
|
|
reason: row.reason || "",
|
|
status: (row.status || "pending") as SecretRequestStatus,
|
|
bot_id: Number(row.bot_id),
|
|
bot_name: bot?.name || "The bot",
|
|
env_id: row.env_id ? Number(row.env_id) : null,
|
|
};
|
|
}
|