Load secret values in account editor

e2e/connect-secret.spec.ts

@@ -49,6 +49,6 @@ test('connect secret shows editable name and scope and saves the edited name', a
 	await expect(page.getByLabel('Description')).toHaveValue(description)
 	await expect(
 		page.getByPlaceholder('Enter the secret value').first(),
-	).toHaveValue('')
+	).toHaveValue(secretValue)
 	await expect(page.getByPlaceholder('saved package id')).toHaveValue(packageId)
 })

packages/worker/client/routes/account-secrets.tsx

@@ -66,7 +66,9 @@ type SecretListItem = {
 	ttlMs: number | null
 }
 
-type SecretDetail = SecretListItem
+type SecretDetail = SecretListItem & {
+	value: string
+}
 
 type AccountSecretsPayload = {
 	ok: true
@@ -176,7 +178,7 @@ function createEditorStateFromSecret(secret: SecretDetail): EditorState {
 		scope: secret.scope,
 		appId: secret.appId ?? '',
 		description: secret.description,
-		value: '',
+		value: secret.value,
 		allowedHosts: allowedHosts.length > 0 ? allowedHosts : [''],
 		allowedCapabilities:
 			allowedCapabilities.length > 0 ? allowedCapabilities : [''],
@@ -510,6 +512,7 @@ export function AccountSecretsRoute(handle: Handle) {
 				createEditorStateFromSecret(selectedSecret),
 				capabilityPrefill,
 			)
+			revealState = 'revealed'
 			return
 		}
 		editorState = applyCapabilityPrefill(

packages/worker/src/app/handlers/account-secrets.node.test.ts

@@ -35,7 +35,7 @@ const mockModule = vi.hoisted(() => ({
 	listSavedPackagesByUserId: vi.fn(async () => []),
 	listSecrets: vi.fn(async () => []),
 	listAppSecretsByAppIds: vi.fn(async () => []),
-	resolveSecret: vi.fn(async () => null),
+	resolveSecret: vi.fn(async () => ({ found: false, value: null })),
 	deleteSecret: vi.fn(async () => false),
 	setSecretAllowedCapabilities: vi.fn(async () => undefined),
 	setSecretAllowedPackages: vi.fn(async () => undefined),
@@ -564,7 +564,7 @@ test('package approval approve deduplicates allowed package ids', async () => {
 	)
 })
 
-test('GET /account/secrets.json does not include value in selectedSecret', async () => {
+test('GET /account/secrets.json includes decrypted value in selectedSecret', async () => {
 	mockModule.listSecrets.mockResolvedValueOnce([
 		{
 			name: 'myApiKey',
@@ -581,6 +581,10 @@ test('GET /account/secrets.json does not include value in selectedSecret', async
 	])
 	mockModule.listSavedPackagesByUserId.mockResolvedValueOnce([])
 	mockModule.listAppSecretsByAppIds.mockResolvedValueOnce(new Map())
+	mockModule.resolveSecret.mockResolvedValueOnce({
+		found: true,
+		value: 'the-actual-secret-value',
+	})
 
 	const handler = createAccountSecretsApiHandler(createEnv())
 	const response = await handler.handler({
@@ -596,7 +600,14 @@ test('GET /account/secrets.json does not include value in selectedSecret', async
 	expect(payload.ok).toBe(true)
 	expect(payload.selectedSecret).toBeDefined()
 	expect(payload.selectedSecret.name).toBe('myApiKey')
-	expect(payload.selectedSecret).not.toHaveProperty('value')
+	expect(payload.selectedSecret.value).toBe('the-actual-secret-value')
+	expect(mockModule.resolveSecret).toHaveBeenCalledWith(
+		expect.objectContaining({
+			name: 'myApiKey',
+			scope: 'user',
+			storageContext: { appId: null, sessionId: null },
+		}),
+	)
 })
 
 test('POST /account/secrets/reveal without password returns 401', async () => {

packages/worker/src/app/handlers/account-secrets.ts

@@ -67,7 +67,9 @@ type AccountSecretListItem = {
 	ttlMs: number | null
 }
 
-type AccountSecretDetail = AccountSecretListItem
+type AccountSecretDetail = AccountSecretListItem & {
+	value: string
+}
 
 type SecretApprovalView = {
 	name: string
@@ -735,7 +737,9 @@ async function buildAccountSecretsPayload(input: {
 		packageApps,
 	})
 	const selectedSecret = input.selectedSecretId
-		? resolveAccountSecretDetail({
+		? await resolveAccountSecretDetail({
+				env: input.env,
+				userId: input.user.mcpUser.userId,
 				secretId: input.selectedSecretId,
 				secrets,
 			})
@@ -896,15 +900,31 @@ async function resolveSecretApprovalView(input: {
 	} satisfies SecretApprovalView
 }
 
-function resolveAccountSecretDetail(input: {
+async function resolveAccountSecretDetail(input: {
+	env: Env
+	userId: string
 	secretId: string
 	secrets: Array<AccountSecretListItem>
 }) {
 	const parsed = parseAccountSecretId(input.secretId)
 	if (!parsed) return null
 
 	const selected = input.secrets.find((secret) => secret.id === input.secretId)
-	return selected ?? null
+	if (!selected) return null
+
+	const resolved = await resolveSecret({
+		env: input.env,
+		userId: input.userId,
+		name: parsed.name,
+		scope: parsed.scope,
+		storageContext: getSecretContextForAccountSecret(parsed),
+	})
+	if (!resolved?.found || resolved.value == null) return null
+
+	return {
+		...selected,
+		value: resolved.value,
+	} satisfies AccountSecretDetail
 }
 
 function toAccountSecretListItem(