mirror of
https://github.com/paperclipai/paperclip.git
synced 2026-10-25 09:41:04 +01:00
Nicky LeachandClaude Opus 4.8
b00271280a
Stage 6 of the Dynamic Secrets epic (PAP-623). Inert behind the enableDynamicSecrets experimental flag. UI (ui/src/pages/Secrets.tsx): - New "Generate at runtime" mode in the Create Secret modal, revealed only when enableDynamicSecrets is on. Captures name, key, generator command, a single cache TTL, and description; provider is fixed to host-command. - Test button dry-runs the generator via the resolver and reports success/failure clearly without ever showing the produced value. - Posture labeling (PRD §5): soft (same-UID / local-trusted) vs hard (sandboxed), driven by the Stage 5 capability flag and never claiming a hard boundary when the flag resolves to soft. §5 explainer covers privileged runtime minting, applicable posture, and operator-owned generator trust. Surfaced in the create modal and the secret detail tab. - Lightweight fail-closed affordance for runtime generator failures (§7-2). Binding UI (ui/src/components/EnvVarEditor.tsx): - Operator-fixed static ARGV params per binding, revealed when a bound secret is dynamic_command. Never agent-supplied. Backend: - staticArgv threaded through EnvSecretRefBinding type/validator and the env-binding sync path (canonicalize, normalize, syncEnvBindingsForTarget). - testDynamicCommand service + gated POST /companies/:id/secrets/dynamic-command/test route (returns pass/fail + byte length + posture, never the value). - secretsApi.testDynamicCommand client + dynamicCommand on CreateSecretInput. Tests: shared validator + server service/binding round-trip. Typecheck clean across shared/server/ui. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>