[immakermatty]

Motivation

Root decision 0198 point 9: a secret never reaches agents through chat or a file, and a person needs no account in the vault to hand one over. An agent gets it in this order:

1. (a) The person signs in to the service in the Environment's shared browser window, and the Bitwarden extension saves it.
2. (b) The agent creates the secret itself in a signed-in session of the service.
3. (c) Otherwise the agent asks for it in words the person understands: what it needs, why, and where in the service to find it.

Until now an agent had no way to do (c) and no instructions for the order. This PR builds (c) end to end and teaches agents a → b → c (DEV-6631 tasks 651 and 652). It builds on the vault (#391) and on Nastavení → Trezor (#402), both merged. Decision F54 records it.

Target state

• lazurio vault request creates a request:
  • Arguments: --item <name> --need <what> --why <why> --where <where in the service> --field <Name>[:secret] ... (1–10 fields).
  • It prints the request's id and its page, <the Folder's recorded external origin>/settings/vault/requests/<id>. Where no entry is recorded, it prints the page's path instead. --json gives the request with link.
  • request status <id> answers pending, saved (with the item's name) or declined; request list lists every request.
  • Input is validated: one line each, bounded lengths, unique field names, at most 50 waiting.
  • A request is refused unless the Environment's own vault is connected: not while its creation is unresolved (creating), and never for a 0197 pilot.
• One core for the CLI and the Launchpad, coordinated by files and the account's kernel lock: one JSON per request in the account's custody (requests/<id>.json, 0600 in 0700) with a random 24-character base32 id, and never a value. The CLI never calls the Launchpad.
• Admitted, same-origin routes: GET /api/vault/requests (waiting), GET /api/vault/requests/<id>, POST …/<id>/save {values} and POST …/<id>/decline {}. Any admitted person answers; no account in the vault is needed.
  • A save holds the account's lock, so a request is answered once.
  • It writes exactly one Secure note named like the request into the collection Agenti: one custom field per request field (hidden for a secret one, text otherwise), with the need, why and where as its notes.
  • The item goes through bw create item with the encoded item on stdin (a new stdin option of the ToolRunner), never on argv. Then bw sync, and the request is saved.
  • A vault that refuses or does not answer leaves the request waiting.
• The page /settings/vault/requests/<id> is a sub-route of Nastavení → Trezor, like Integrace's forms:
  • the need as its title, then why and where;
  • one input per field (a password input with "Zobrazit" for a secret one) and the item it becomes;
  • "Uložit do trezoru" and "Odmítnout".
  • On its route, the request page alone shows of the Trezor section.
• "Žádosti agentů" fills Vault: Nastavení → Trezor and the Správci of the Environment's own vault (DEV-6631 tasks 648, 638b) #402's slot #vault-requests above the vault: the count and one row per waiting request, each with "Zadat".
• Values never go to browser storage, the address or a log; the inputs are emptied once the request is answered. The texts are formal Czech, neutral and minimal.
• Runtime secrets (F46) may also come from a Secure note with exactly one hidden field, besides a Login's password. Two hidden fields are ambiguous. The frozen 0197 pilot reads passwords only, as before.
• Agents' guidance (task 652) is in the bitwarden usage text and the manual's Secrets section, template revision base-instructions-50. It tells agents:
  • never ask for a secret in chat and never take one from a file;
  • re-check lazurio vault status before saying anything about the vault;
  • read secrets only from the vault through the shared session, and never print values;
  • get what is missing by (a), worded as conditional on the extension being present; then (b), with bw encode piped into bw create item, never as an argument; then (c), lazurio vault request in plain words and formal Czech, handing over the link and going on with other work.

What changes

• src/tools/status.ts: the ToolRunner takes stdin.
• src/vault/bw.ts: createNote sends the encoded note on stdin and reads only the new id from bw's answer. The item reader keeps a Secure note's hidden-field count and the value of the only one.
• src/vault/session.ts and flow.ts: readSecrets reads Secure notes for the own vault (notes: true), and the journal gains a request operation.
• New core files: src/vault/requests.ts (the core) and src/vault/request-id.ts (the import-free id pattern and page path). src/vault/cli.ts gains request, request status and request list.
• New src/launchpad/vault-request-routes.ts, composed in server.ts on the same vaultHostOf as the Tools row and the Trezor page.
• routes.ts gets the request sub-route of vault. index.html gets the first paint, the request page #vault-request as the last child of Vault: Nastavení → Trezor and the Správci of the Environment's own vault (DEV-6631 tasks 648, 638b) #402's section, the comment of its slot, and CSS. New vault-requests-panel.ts and vault-requests-view.ts, plus changes to ui.ts and messages.ts (en, and formal neutral cs).
• src/tools/catalog.ts and src/folder/manual.ts carry paths a, b and c. render.ts moves to base-instructions-50 (main's Copy: address people formally (vykání) in Launchpad, shell, CLI and agents' speech #328 took 48 and Vault: each Environment owns its vault (root decision 0198, DEV-6631 task 638a) #391 took 49), with its pinned digest, the folder-tools test and the snapshots.
• Docs: new decision F54 (main took F52 for the module generator, and the vault is F53). F46 and F53 point to it. Also updated: environment-tools.md, launchpad-development.md, module-adoption.md and public-development.md.
• Tests: new tests/vault-requests.test.ts and tests/vault-requests-view.test.ts. Extended: the vault-secrets, vault-pilot, launchpad-routes, launchpad-first-paint and folder-manual tests. The fake bw now creates items from stdin, as the real one does.

What deliberately does not change

• The Trezor page and the Správci (Vault: Nastavení → Trezor and the Správci of the Environment's own vault (DEV-6631 tasks 648, 638b) #402), the browser extension (task 639), Dashboard, Machines and releases.
• The session model, the pinned bw, the account's custody (only requests/ is added beside it), and the frozen 0197 pilot's reading of runtime secrets.
• Every shared string keeps Copy: address people formally (vykání) in Launchpad, shell, CLI and agents' speech #328's neutral formal wording. The bitwarden purpose shown to people is main's; the usage text is agents' instructions and stays in ty.
• The chat card of the wireframe: it belongs to Chat (T3 Code), so the agent hands the link over as text.

Verification

• bun run check on head 8d7f316fa0dd882708f3ccf27e937d958cea333a, rebased on main 1cc2ef6: Biome, tsc, the public guard, the proof build and smoke, then 3528 pass, 8 skip, 0 fail across 251 files, exit 0 (650 s).

• GitHub's checks on this head passed: static checks, tests 1/2 and 2/2, check ubuntu-24.04 and scope; macOS and Macroscope skipped.

• Contract tests on the real consumers, against the fake Vaultwarden and the fake bw (tests/vault-requests.test.ts, 10 tests):

  • create, list and status;
  • invalid words and fields;
  • no vault, a 0197 pilot or a workstation; too many waiting; a vault whose creation is unresolved (creating);
  • the save writes exactly one Secure note with a text and a hidden field in Agenti, notes = need/why/where. bw's argv is create item --nointeraction only, followed by a sync;
  • the values reach no argv ($HOME/bw.calls), request file, file of this Platform, journal or answer;
  • answered once;
  • read right away as a runtime secret;
  • decline;
  • values that are not exactly the fields;
  • no token, a wrong token, no Origin or a foreign Origin refused locally (403); a cross-site or foreign-origin save and a missing cookie refused behind the gateway (401);
  • a refused or unreachable vault keeps the request.

• F46: tests/vault-secrets.test.ts and tests/vault-pilot.test.ts.

• The page: tests/launchpad-routes.test.ts, tests/launchpad-first-paint.test.ts and tests/vault-requests-view.test.ts.

• The guidance: tests/folder-manual.test.ts renders every preset in both languages and checks the order a, b, c and each path's commands. The revision is pinned in tests/folder-template-revision.test.ts.

• In a browser (root decision 0178), on this head: a throwaway Launchpad with the fake vault and two requests. The harness is outside the repository, at ~/Lazurio/drafts/DEV-6631-phase1/secret-requests/ui-check/serve.ts. Checked:

  • Vault: Nastavení → Trezor and the Správci of the Environment's own vault (DEV-6631 tasks 648, 638b) #402's Trezor page shows the rule, "Žádosti agentů 2" with "Zadat", then the vault row;
  • a request's page shows alone, with Trezor's own content hidden; "Uložit do trezoru" is enabled once filled;
  • saving gives "Uloženo do trezoru.";
  • the vault holds one Secure note in Agenti with a text and a hidden field;
  • the typed values were nowhere: not in the DOM, browser storage, the address, the Launchpad's log, bw.calls or the request files;
  • back on Trezor the count drops to 1.

  Earlier on the pre-rebase branch: show/hide, decline, an unreachable vault and the retry, and a narrow screen. Screenshots (local, synthetic values): ~/Lazurio/drafts/DEV-6631-phase1/secret-requests/01…13-*.png.

• End to end against the real image ghcr.io/lazurio/vaultwarden:1.37.4-lazurio.1@sha256:68da93bb…f492 (amd64 under Rosetta in OrbStack) with the real pinned bw 2026.7.0 (macOS arm64), run on the pre-rebase head 18aefea (the request path has not changed since). 22 of 22 checks passed:

  • the real bw lists exactly one Secure note per save in Agenti, Client ID as text and Client secret hidden with the given values, and notes without a value;
  • nothing exists for the declined request, and a second save is refused as answered;
  • vaultSecrets reads the note's hidden field;
  • argv was exactly create item --nointeraction, and the items went on stdin;
  • no value appears in 19 argv lists, 11 journal entries or the request files.

  Everything was removed afterwards. The Linux bw binary was not exercised.

Risks, open questions, follow-ups

• A save interrupted after bw created the item can leave a duplicate. This happens if the Launchpad stops between bw creating the item and the request being marked saved, or if a timeout hits after the request reached the vault. The request then still waits, and a second save creates another item of the same name, which F46 reads as ambiguous until a person removes one. F54's limits record this.
• Who answered is not recorded. The Launchpad has the admission, not the person (F11). F53's addendum now names the admitted subject, so a later change could record it.
• Inputs are single-line, so a multi-line secret (a PEM key) cannot be pasted as is. A browser's own password manager may offer to save a password field; the person decides.
• Answered requests are kept; nothing prunes them yet.
• Open question: should lazurio vault request refuse when the vault already holds an item of that name? The guidance tells agents to look first.

Plan and work context

• Mission Control: DEV-6631 tasks 651 and 652, plan; root decision 0198 point 9; wireframe prototypes-lazurio 794f3735.
• Worktree: HumanAndMachine-ai_GEN3/.worktrees/productionspace/LazurioPlatform/DEV-6631-secret-requests, branch agent/DEV-6631-secret-requests, on main.
• Agent / thread: Claude Code (Opus 5.5), a subagent of session b643d1c5-bc04-44a8-a2c5-d80707571628 (claude --resume b643d1c5-bc04-44a8-a2c5-d80707571628).
• Machine: the Admin's development workstation.

Status: ready for review

🤖 Generated with Claude Code

[agentrozjedemeai]

@immakermatty Exact-head review of 2a57a9c against stacked base 3425e71: APPROVED. I traced the request store/lock, CLI, admitted Launchpad routes, stdin-only bw create path, Secure-note reader, UI and guidance. Locally in an isolated clone, git diff --check and check:static passed; 74 focused tests passed (0 failed, 28 snapshots) with Bun 1.4.3 under the host's heavy-command lock. GitHub's current-head checks are green; I did not independently rerun the full 2639-test suite or the real Vaultwarden run. The documented interrupted-create duplicate and absent answerer attribution remain known limits, not additional claims of verification. Public-diff scan found no named client Organization or person; the sole named Organization in added lines is the internal HumanAndMachine-ai reference to a wireframe. No merge performed.

The base branch was changed.

[agentrozjedemeai]

@immakermatty Exact-head re-review of 8d7f316 against main 1cc2ef6: APPROVED. I compared the prior approved stack via range-diff, inspected the #402 Trezor slot/request-only route, F54/F53 references and base-instructions-50 pin, and traced the retained request core, stdin-only bw create and Secure-note reader. In a fresh isolated clone, git diff --check and check:static passed; focused tests passed in two serial shards (23 + 74, 0 failed, 28 snapshots) under the host heavy-command lock. Current-head CI is green; no unresolved threads or competing review requests. I did not independently rerun the full suite, real-image e2e or browser smoke; the author reports those separately, with real-image e2e on the pre-rebase head. Known interrupted-create duplication and absent answerer attribution remain documented limits. No merge performed.