You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
fix: private secrets keep their spaces exactly as typed - #31722
The private secret card (shown when an agent calls request_secret) would not accept a secret made only of whitespace: with a single space typed, Save securely stayed disabled. Secrets with leading or trailing spaces were silently trimmed before they were stored. On main (938b4d4) in the web dev app, typing " " left Save disabled, and saving " pw " delivered a 2-byte file containing pw.
Change
The secret is now kept exactly as typed, and only an empty field counts as empty:
packages/contracts: the save answer's secret is Schema.NonEmptyString instead of TrimmedNonEmptyString, so the server no longer trims it or rejects whitespace-only values on decode.
packages/client-runtime: secretRequestAnswerInput no longer trims the secret.
Web and mobile SecretRequestCard: Save is disabled only when secret.length === 0.
Storage and file delivery already passed the value through unchanged.
vp test run packages/client-runtime/src/secretRequest.test.ts: the new test sends values through secretRequestAnswerInput and then the wire contract decode. On main it fails with expected 'pass word' to be ' pass word '. With the fix, 4/4 tests pass, including a direct check that the contract still rejects "".
vp test run apps/server/src/secrets/SecretRequests.test.ts: 17/17.
vp run check:changed on the merged head: format, lint, knip, typecheck (36 packages), tests and react compiler all pass.
Delivered file bytes (real app, fresh databases, an agent calling request_secret with delivery: "file"; od -An -tx1 -v and wc -c on the returned file):
Evidence (Chrome, 1280×900 CSS px, DPR 2, dark; Pixel 9 and iPhone 17 Pro from the device pool, dark, large text). The images are attached below:
Web, single space: before (938b4d4) Save disabled, after (b075a42) Save enabled. Zero-threshold and 5% fuzz diffs are attached. Inside the card, only the Save button differs. Outside it, the generated thread title, the sidebar history, the elapsed time and the live "Asking" label highlight differ between runs.
Web, empty field: Save disabled on both sides.
Web, padded value: six masked characters, saved; Saved row shown.
Android and iOS (after only): an empty field keeps Save disabled; a single space typed with the native Space key enables Save; the padded value is submitted with native Done; Saved rows shown.
Not checked: interaction recordings were made but could not be published, so clear/retype and Enter/Done ordering rest on the stills and byte table above. Only the web single-space pair has diff images, and those diffs also include the unrelated run differences listed above. There is no unpadded pw control capture. Mobile was captured only after the fix; the mobile change is the same one-line predicate as web. A newer client talking to an older server still has the old trimming on the server side.
AI-assisted; verified with the tests and tools listed above.
These tests reproduce #31690: a saved secret should be
delivered exactly as typed. Today the client trims it (and refuses a
whitespace-only value) and the wire contract trims it again.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The secret card trimmed the value in the client and again in the wire
contract, so leading/trailing whitespace was lost and a whitespace-only
secret could not be saved. Only an empty value now counts as empty:
the contract uses Schema.NonEmptyString, the client stops trimming, and
the web and mobile "Save securely" buttons enable for any non-empty value.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Macroscope's review found this PR approvable — Secret submissions now retain whitespace exactly as entered across web, mobile, and the shared input contract. Existing private storage and delivery behavior remain unchanged, and empty values are still rejected.
You can add or adjust custom eligibility rules. Learn more.
No actionable comments were generated in the recent review.
Walkthrough
The secret-answer schema and client now preserve non-empty secret values without trimming. The web and mobile secret cards allow whitespace-only values to be saved. Tests cover whitespace preservation and empty-input handling.
Changes: Secret submission
Layer / File(s)
Summary
Secret answer contract and payload packages/contracts/src/secretRequest.ts, packages/client-runtime/src/secretRequest.ts, packages/client-runtime/src/secretRequest.test.ts
The save-answer schema now accepts non-empty strings. The answer helper preserves the supplied secret, and tests cover whitespace preservation and empty-input handling.
Web and mobile save controls apps/web/src/components/chat/SecretRequestCard.tsx, apps/mobile/src/features/threads/SecretRequestCard.tsx
Both cards enable the Save button for any non-empty secret, including whitespace-only values.
pingdotgg/t3code#31257: Changes trimming in secretRequestAnswerInput, which this PR reverses for single-secret answers.
pingdotgg/t3code#31670: Changes how the mobile Save button uses input drafts; this PR changes when whitespace-only values enable saving.
Suggested labels:size:S
Suggested reviewers:t3dotgg
Merge Risk: Low · up to 10c4b
Whitespace-only secrets require a server update; retrying against an older server will not work.
Pre-merge checks: 4
Check name
Status
Explanation
Title check
The title clearly describes the change to preserve spaces in private secrets.
Description check
The description is mostly complete. It explains the problem, changes, verification results, and limitations. It links an issue, but does not confirm its triage status. It names the agent harness but n…
Linked Issues check
[#31690] The web card enables Save for nonempty values and submits the input value. The client helper and wire contract preserve whitespace and reject empty secrets. Automated tests cover padded, whit…
Out of Scope Changes check
[#31690] The contract, client helper, web card, and tests support exact secret submission. The mobile card applies the same rule to the shared secret flow.
Full details: Description check
Explanation
The description is mostly complete. It explains the problem, changes, verification results, and limitations. It links an issue, but does not confirm its triage status. It names the agent harness but not the model. Mobile before screenshots and interaction recordings are missing.
Full details: Linked Issues check
Explanation
[#31690] The web card enables Save for nonempty values and submits the input value. The client helper and wire contract preserve whitespace and reject empty secrets. Automated tests cover padded, whitespace-only, and empty values. The PR reports unchanged file bytes for submitted whitespace and padded secrets.
Finishing Touches
Generate docstrings
Commit to this branch
Create a new PR
Generate unit tests (beta)
Commit to this branch
Create a new PR
Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Included review availability: This review used your included allowance. Your plan provides up to 10 included reviews per hour; 3 remain after this review.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
bugfixFix PR opened by an issue lead; enters the PR looppr:needs-juliusNeeds Julius: route gate, unverifiable surface, or blockedsize:S10-29 changed lines (additions + deletions).vouch:trustedPR author is trusted by repo permissions or the VOUCHED list.
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The private secret card (shown when an agent calls
request_secret) would not accept a secret made only of whitespace: with a single space typed, Save securely stayed disabled. Secrets with leading or trailing spaces were silently trimmed before they were stored. On main (938b4d4) in the web dev app, typing" "left Save disabled, and saving" pw "delivered a 2-byte file containingpw.Change
The secret is now kept exactly as typed, and only an empty field counts as empty:
packages/contracts: thesaveanswer'ssecretisSchema.NonEmptyStringinstead ofTrimmedNonEmptyString, so the server no longer trims it or rejects whitespace-only values on decode.packages/client-runtime:secretRequestAnswerInputno longer trims the secret.SecretRequestCard: Save is disabled only whensecret.length === 0.Storage and file delivery already passed the value through unchanged.
Scope and approval
Fixes #31690
Verification
vp test run packages/client-runtime/src/secretRequest.test.ts: the new test sends values throughsecretRequestAnswerInputand then the wire contract decode. On main it fails withexpected 'pass word' to be ' pass word '. With the fix, 4/4 tests pass, including a direct check that the contract still rejects"".vp test run apps/server/src/secrets/SecretRequests.test.ts: 17/17.vp run check:changedon the merged head: format, lint, knip, typecheck (36 packages), tests and react compiler all pass.Delivered file bytes (real app, fresh databases, an agent calling
request_secretwithdelivery: "file";od -An -tx1 -vandwc -con the returned file):" pw "70 77" "20" pw "20 20 70 77 20 20" "20" pw "20 20 70 77 20 20" "20" pw "20 20 70 77 20 20On main,
" "cannot be submitted at all.Evidence (Chrome, 1280×900 CSS px, DPR 2, dark; Pixel 9 and iPhone 17 Pro from the device pool, dark, large text). The images are attached below:
Not checked: interaction recordings were made but could not be published, so clear/retype and Enter/Done ordering rest on the stills and byte table above. Only the web single-space pair has diff images, and those diffs also include the unrelated run differences listed above. There is no unpadded
pwcontrol capture. Mobile was captured only after the fix; the mobile change is the same one-line predicate as web. A newer client talking to an older server still has the old trimming on the server side.AI-assisted; verified with the tests and tools listed above.
🤖 Generated with Claude Code