Align immediate terminal-run cleanup with stranded recovery reconciliation so recovery issues are blocked in place instead of receiving generic retry copy. Update the heartbeat recovery test expectation for the in-place guard notice.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Switch sandbox and SSH shell wrappers away from login-shell invocation, harden bridge shutdown races, and make the SSH fixture compatible with local macOS/Git 2.21 environments.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Wires the frontend half of [PAP-9023](/PAP/issues/PAP-9023). New
`ImportFromVaultDialog` component (Select → Review → Result) talks to the
preview/import routes shipped in PAP-9022, surfaces row-level state from the
backend (ready/duplicate/conflict), keeps selection persistent across
pagination and search, and reports per-row import outcomes. Entry point lives
beside `New secret` on the Secrets tab and only shows when an AWS vault is
configured.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Drops the bordered inner header that doubled the parent main padding so
the page title aligns with the table/section content below. Search,
filter, and "New secret" controls now live inside the Secrets tab; the
duplicate page-level "New vault" button is gone — the per-provider "Add
vault" buttons are the single source of truth.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Remove duplicate secret name/key display in table row; show name only
- Replace mode and status badges with plain text (status uses color only)
- Drop provider vault second line from table
- Change 'Owned by Paperclip' reference to 'Owned'
- Gray out GCP and Hashicorp vault sections with 'Coming soon' label
- Replace inner sheet TabsList with PageTabBar for consistent tab style
- Rename 'Rotate' → 'Update value' for managed secrets
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Wraps a tiny static HTTP server around `ui/storybook-static` and
runs Playwright to screenshot the `Product/Secrets > BindingPicker`
story at 1440x900 dark mode. Used to verify the fixture-wiring fix
and re-attach the active-bound happy-path screenshot for the
Phase 6 UX review on PAP-2351 / PAP-2350.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
- Storybook fixture now seeds the company id at module load and gates
child render on it, so SecretBindingPicker renders the active-bound
state with a populated version dropdown instead of falling into the
missing-secret branch.
- Provider chip badge now reads "1 warning" with an alert glyph instead
of an unlabeled "(1)", per UX feedback.
- Storybook env-editor scenario renamed from "attention required" to
"Mixed bindings (some need attention)" so the heading matches the
per-row footer.
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Docs were silent on what happens to a secret value once an agent receives it.
Add a Custody Boundaries section to the deploy guide and a matching note in the
API guide so operators do not over-trust strict mode and at-rest encryption.
Rename the now-misleading API "Update Secret" heading to "Rotate Secret".
Co-Authored-By: Paperclip <noreply@paperclip.ing>
Dotta