Align immediate terminal-run cleanup with stranded recovery reconciliation so recovery issues are blocked in place instead of receiving generic retry copy. Update the heartbeat recovery test expectation for the in-place guard notice.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Switch sandbox and SSH shell wrappers away from login-shell invocation, harden bridge shutdown races, and make the SSH fixture compatible with local macOS/Git 2.21 environments.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wires the frontend half of [PAP-9023](/PAP/issues/PAP-9023). New
`ImportFromVaultDialog` component (Select → Review → Result) talks to the
preview/import routes shipped in PAP-9022, surfaces row-level state from the
backend (ready/duplicate/conflict), keeps selection persistent across
pagination and search, and reports per-row import outcomes. Entry point lives
beside `New secret` on the Secrets tab and only shows when an AWS vault is
configured.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Drops the bordered inner header that doubled the parent main padding so
the page title aligns with the table/section content below. Search,
filter, and "New secret" controls now live inside the Secrets tab; the
duplicate page-level "New vault" button is gone — the per-provider "Add
vault" buttons are the single source of truth.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Remove duplicate secret name/key display in table row; show name only
- Replace mode and status badges with plain text (status uses color only)
- Drop provider vault second line from table
- Change 'Owned by Paperclip' reference to 'Owned'
- Gray out GCP and Hashicorp vault sections with 'Coming soon' label
- Replace inner sheet TabsList with PageTabBar for consistent tab style
- Rename 'Rotate' → 'Update value' for managed secrets
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wraps a tiny static HTTP server around `ui/storybook-static` and
runs Playwright to screenshot the `Product/Secrets > BindingPicker`
story at 1440x900 dark mode. Used to verify the fixture-wiring fix
and re-attach the active-bound happy-path screenshot for the
Phase 6 UX review on PAP-2351 / PAP-2350.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Storybook fixture now seeds the company id at module load and gates
child render on it, so SecretBindingPicker renders the active-bound
state with a populated version dropdown instead of falling into the
missing-secret branch.
- Provider chip badge now reads "1 warning" with an alert glyph instead
of an unlabeled "(1)", per UX feedback.
- Storybook env-editor scenario renamed from "attention required" to
"Mixed bindings (some need attention)" so the heading matches the
per-row footer.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Docs were silent on what happens to a secret value once an agent receives it.
Add a Custody Boundaries section to the deploy guide and a matching note in the
API guide so operators do not over-trust strict mode and at-rest encryption.
Rename the now-misleading API "Update Secret" heading to "Rotate Secret".
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Adds product/secrets story coverage for the inventory, binding picker
(empty/active/disabled/missing variants), env editor with secret
bindings, and the run-failure copy. Wires fetch fixtures and provider
health response into the storybook preview so the page renders against
canned data. Fall through to selectedCompanyId so the page shows when
the company is selected even before the companies list resolves.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Implements PAP-2350. Adds a dedicated company-scoped Secrets page with
inventory, detail drawer, create/link/rotate/disable/archive/delete flows,
provider health bar, usage and access-event tabs. Surfaces a reusable
SecretBindingPicker component plus an enhanced EnvVarEditor that selects
versions and warns on missing/disabled secrets.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Dotta