Stop an untouched secret field from deleting the stored credential

Making `null` actually clear a secret — which it had to, since a blanked token was previously never revoked — turned the config editors into a credential shredder. Secrets are `#[serde(skip_serializing)]`, so the inputs always render empty whether or not one is stored, and the blur handlers sent `value || null` unconditionally. Focusing the Git token field and tabbing away deleted it, with nothing shown and no undo. `useSecretField` encodes the rule: only a field the user typed in may speak about a secret. Untouched, `patch()` contributes no key at all, and Rust already distinguishes an absent key from an explicit null. `withoutUntouchedSecrets` covers the structural half. `saveBedrock` spreads `{ ...bedrock, ...patch }`, and when that falls back to DEFAULT_BEDROCK_CONFIG the literal spells every secret out as `null` — so editing the AWS region would have wiped the credentials as a side effect. Also here: `WorkspaceSection` no longer saves a half-filled folder row, which `update_project`'s new validation would refuse on every keystroke between the two inputs; `snapshots_skipped` is declared on the wire type rather than widened locally; and `#[must_use]` on `ProjectGuard` and `ScrubOutcome` — which immediately caught the migration path discarding its scrub outcome, the one scrub whose silence is expensive because the layer it declined to clean is about to be committed. The capability test reads the real file and is mutation-verified: adding `core:default` back makes it fail. That grant pulls in an unscoped `std::fs::read` of any host path and went unnoticed for months, because nothing in the suite read the file at all. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01GBq2rGum6GX7xXgsas1fDc
2026-08-23 13:23:00 -07:00
parent 7bbb699e4e
commit 6a8972980d
11 changed files with 354 additions and 49 deletions
@@ -1,4 +1,5 @@
 import { useEffect, useState } from "react";
+import { useSecretField } from "../../../../hooks/useSecretField";
 import { open } from "@tauri-apps/plugin-dialog";
 import type { Project } from "../../../../lib/types";
 import Button from "../../../ui/Button";
@@ -24,14 +25,15 @@ export default function AccessSection({
  const [caCertPath, setCaCertPath] = useState(project.ca_cert_path ?? "");
  const [gitName, setGitName] = useState(project.git_user_name ?? "");
  const [gitEmail, setGitEmail] = useState(project.git_user_email ?? "");
-  const [gitToken, setGitToken] = useState(project.git_token ?? "");
+  // Never seeded from `project` — the backend does not serialize secrets, so
+  // the box is always empty and only an edit may speak about the stored value.
+  const gitToken = useSecretField(project.id);

  useEffect(() => {
    setSshKeyPath(project.ssh_key_path ?? "");
    setCaCertPath(project.ca_cert_path ?? "");
    setGitName(project.git_user_name ?? "");
    setGitEmail(project.git_user_email ?? "");
-    setGitToken(project.git_token ?? "");
  }, [project]);

  return (
@@ -101,15 +103,19 @@ export default function AccessSection({

      <Field
        label="Git HTTPS token"
-        hint="A personal access token (e.g. a GitHub PAT) for HTTPS git operations inside the container."
+        hint={
+          gitToken.edited
+            ? "Saved when you click away. Clearing the box removes the stored token."
+            : "A personal access token (e.g. a GitHub PAT) for HTTPS git operations inside the container. A stored token is not shown; leave this empty to keep it."
+        }
      >
        {(id) => (
          <input
            id={id}
            type="password"
-            value={gitToken}
-            onChange={(e) => setGitToken(e.target.value)}
-            onBlur={() => save({ git_token: gitToken || null })}
+            value={gitToken.value}
+            onChange={(e) => gitToken.setValue(e.target.value)}
+            onBlur={() => save({ ...gitToken.patch("git_token") })}
            placeholder="ghp_…"
            disabled={disabled}
            className={inputClass}
@@ -1,4 +1,5 @@
 import { useEffect, useState } from "react";
+import { useSecretField, withoutUntouchedSecrets } from "../../../../hooks/useSecretField";
 import type {
  Backend,
  BedrockAuthMethod,
@@ -16,6 +17,17 @@ import Field, {
 } from "../../../ui/Field";
 import Toggle from "../../../ui/Toggle";

+/** Bedrock fields held in the OS keychain, never serialized back to us. */
+const BEDROCK_SECRET_KEYS = [
+  "aws_access_key_id",
+  "aws_secret_access_key",
+  "aws_session_token",
+  "aws_bearer_token",
+] as const;
+
+/** The same, for the OpenAI-compatible backend. */
+const OPENAI_SECRET_KEYS = ["api_key"] as const;
+
 export const DEFAULT_BEDROCK_CONFIG: BedrockConfig = {
  auth_method: "static_credentials",
  aws_region: "us-east-1",
@@ -65,11 +77,12 @@ export default function ModelSection({ project, save, disabled }: Props) {

  // Local text state — saved on blur, not on every keystroke.
  const [bedrockRegion, setBedrockRegion] = useState(bedrock.aws_region);
-  const [accessKeyId, setAccessKeyId] = useState(bedrock.aws_access_key_id ?? "");
-  const [secretKey, setSecretKey] = useState(bedrock.aws_secret_access_key ?? "");
-  const [sessionToken, setSessionToken] = useState(bedrock.aws_session_token ?? "");
+  // Secrets are never seeded from `project` — see `useSecretField`.
+  const accessKeyId = useSecretField(project.id);
+  const secretKey = useSecretField(project.id);
+  const sessionToken = useSecretField(project.id);
  const [profile, setProfile] = useState(bedrock.aws_profile ?? "");
-  const [bearerToken, setBearerToken] = useState(bedrock.aws_bearer_token ?? "");
+  const bearerToken = useSecretField(project.id);
  const [bedrockModelId, setBedrockModelId] = useState(bedrock.model_id ?? "");
  const [serviceTier, setServiceTier] = useState(bedrock.service_tier ?? "");

@@ -97,9 +110,7 @@ export default function ModelSection({ project, save, disabled }: Props) {
    project.openai_compatible_config?.base_url ??
      DEFAULT_OPENAI_COMPATIBLE_CONFIG.base_url,
  );
-  const [oaiApiKey, setOaiApiKey] = useState(
-    project.openai_compatible_config?.api_key ?? "",
-  );
+  const oaiApiKey = useSecretField(project.id);
  const [oaiModelId, setOaiModelId] = useState(
    project.openai_compatible_config?.model_id ?? "",
  );
@@ -107,14 +118,13 @@ export default function ModelSection({ project, save, disabled }: Props) {
    project.openai_compatible_config?.haiku_model_id ?? "",
  );

+  // Secret fields are deliberately absent here: `useSecretField` owns its own
+  // reset, and re-seeding one from `project` would write an empty string over
+  // whatever the user had half-typed on any unrelated project update.
  useEffect(() => {
    const bc = project.bedrock_config ?? DEFAULT_BEDROCK_CONFIG;
    setBedrockRegion(bc.aws_region);
-    setAccessKeyId(bc.aws_access_key_id ?? "");
-    setSecretKey(bc.aws_secret_access_key ?? "");
-    setSessionToken(bc.aws_session_token ?? "");
    setProfile(bc.aws_profile ?? "");
-    setBearerToken(bc.aws_bearer_token ?? "");
    setBedrockModelId(bc.model_id ?? "");
    setServiceTier(bc.service_tier ?? "");
    setOllamaBaseUrl(project.ollama_config?.base_url ?? DEFAULT_OLLAMA_CONFIG.base_url);
@@ -129,13 +139,18 @@ export default function ModelSection({ project, save, disabled }: Props) {
      project.openai_compatible_config?.base_url ??
        DEFAULT_OPENAI_COMPATIBLE_CONFIG.base_url,
    );
-    setOaiApiKey(project.openai_compatible_config?.api_key ?? "");
    setOaiModelId(project.openai_compatible_config?.model_id ?? "");
    setOaiHaikuModelId(project.openai_compatible_config?.haiku_model_id ?? "");
  }, [project]);

  const saveBedrock = (patch: Partial<BedrockConfig>) =>
-    save({ bedrock_config: { ...bedrock, ...patch } });
+    save({
+      bedrock_config: withoutUntouchedSecrets(
+        { ...bedrock, ...patch },
+        patch,
+        BEDROCK_SECRET_KEYS,
+      ),
+    });

  const saveOllama = (patch: Partial<OllamaConfig>) =>
    save({
@@ -152,10 +167,14 @@ export default function ModelSection({ project, save, disabled }: Props) {

  const saveOpenAi = (patch: Partial<OpenAiCompatibleConfig>) =>
    save({
-      openai_compatible_config: {
-        ...(project.openai_compatible_config ?? DEFAULT_OPENAI_COMPATIBLE_CONFIG),
-        ...patch,
-      },
+      openai_compatible_config: withoutUntouchedSecrets(
+        {
+          ...(project.openai_compatible_config ?? DEFAULT_OPENAI_COMPATIBLE_CONFIG),
+          ...patch,
+        },
+        patch,
+        OPENAI_SECRET_KEYS,
+      ),
    });

  // Defaults to on: projects created before the field existed, and any data
@@ -261,9 +280,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
                {(id) => (
                  <input
                    id={id}
-                    value={accessKeyId}
-                    onChange={(e) => setAccessKeyId(e.target.value)}
-                    onBlur={() => saveBedrock({ aws_access_key_id: accessKeyId || null })}
+                    value={accessKeyId.value}
+                    onChange={(e) => accessKeyId.setValue(e.target.value)}
+                    onBlur={() => saveBedrock(accessKeyId.patch("aws_access_key_id"))}
                    placeholder="AKIA…"
                    disabled={disabled}
                    className={monoInputClass}
@@ -278,10 +297,10 @@ export default function ModelSection({ project, save, disabled }: Props) {
                  <input
                    id={id}
                    type="password"
-                    value={secretKey}
-                    onChange={(e) => setSecretKey(e.target.value)}
+                    value={secretKey.value}
+                    onChange={(e) => secretKey.setValue(e.target.value)}
                    onBlur={() =>
-                      saveBedrock({ aws_secret_access_key: secretKey || null })
+                      saveBedrock(secretKey.patch("aws_secret_access_key"))
                    }
                    disabled={disabled}
                    className={monoInputClass}
@@ -296,10 +315,10 @@ export default function ModelSection({ project, save, disabled }: Props) {
                  <input
                    id={id}
                    type="password"
-                    value={sessionToken}
-                    onChange={(e) => setSessionToken(e.target.value)}
+                    value={sessionToken.value}
+                    onChange={(e) => sessionToken.setValue(e.target.value)}
                    onBlur={() =>
-                      saveBedrock({ aws_session_token: sessionToken || null })
+                      saveBedrock(sessionToken.patch("aws_session_token"))
                    }
                    disabled={disabled}
                    className={monoInputClass}
@@ -337,9 +356,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
                <input
                  id={id}
                  type="password"
-                  value={bearerToken}
-                  onChange={(e) => setBearerToken(e.target.value)}
-                  onBlur={() => saveBedrock({ aws_bearer_token: bearerToken || null })}
+                  value={bearerToken.value}
+                  onChange={(e) => bearerToken.setValue(e.target.value)}
+                  onBlur={() => saveBedrock(bearerToken.patch("aws_bearer_token"))}
                  disabled={disabled}
                  className={monoInputClass}
                />
@@ -507,9 +526,9 @@ export default function ModelSection({ project, save, disabled }: Props) {
              <input
                id={id}
                type="password"
-                value={oaiApiKey}
-                onChange={(e) => setOaiApiKey(e.target.value)}
-                onBlur={() => saveOpenAi({ api_key: oaiApiKey || null })}
+                value={oaiApiKey.value}
+                onChange={(e) => oaiApiKey.setValue(e.target.value)}
+                onBlur={() => saveOpenAi(oaiApiKey.patch("api_key"))}
                placeholder="sk-…"
                disabled={disabled}
                className={monoInputClass}
@@ -19,6 +19,22 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
    setPaths(project.paths ?? []);
  }, [project]);

+  /**
+   * Save only when every row is fully filled in.
+   *
+   * Both inputs save on blur, so tabbing from the host path to the mount name
+   * fires a save with the name still empty. `update_project` now validates —
+   * a half-filled row is refused — so the unconditional save turned an ordinary
+   * keystroke into an error toast. A blank row is *not* incomplete: the
+   * "+ Add folder" button adds one deliberately, and it is dropped on save.
+   */
+  const saveIfComplete = () => {
+    const filled = paths.filter((p) => p.host_path.trim() || p.mount_name.trim());
+    const halfFilled = filled.some((p) => !p.host_path.trim() || !p.mount_name.trim());
+    if (halfFilled) return;
+    return save({ paths });
+  };
+
  return (
    <ConfigGroup
      title="Workspace"
@@ -70,7 +86,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                  updated[i] = { ...updated[i], host_path: e.target.value };
                  setPaths(updated);
                }}
-                onBlur={() => save({ paths })}
+                onBlur={() => saveIfComplete()}
                placeholder="/path/to/folder"
                disabled={disabled}
                className={`flex-1 min-w-0 ${inputClass}`}
@@ -107,7 +123,7 @@ export default function WorkspaceSection({ project, save, disabled }: Props) {
                    updated[i] = { ...updated[i], mount_name: e.target.value };
                    setPaths(updated);
                  }}
-                  onBlur={() => save({ paths })}
+                  onBlur={() => saveIfComplete()}
                  placeholder="name"
                  disabled={disabled}
                  className={`w-40 ${monoInputClass}`}