Skip to content

fix(wizard-ask): tell the agent to pass a warehouse credential in the tool's arguments #1492

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
Gilbert09 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

fix(wizard-ask): tell the agent to pass a warehouse credential in the tool's arguments #1492

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions src/agent/runner/harness/pi/__tests__/tools.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -224,6 +224,7 @@ describe('pi wizard_ask — sensitive answers are vaulted', () => {
expect(desc).toBe(WIZARD_ASK_SENSITIVE_DESCRIPTION);
expect(desc).toMatch(/data-warehouse tools/);
expect(desc).toMatch(/reject it/);
expect(desc).toMatch(/passed in that tool's arguments/);
});
});

Expand Down
26 changes: 14 additions & 12 deletions src/agent/tools/tools.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,22 +113,24 @@ export function resolveAskQuestionKinds<
* the secret-handling guidance cannot drift between them — the same discipline
* `HANDOFF_FIELDS` applies to the handoff schema.
*
* The load-bearing part is the last two sentences: a vaulted `{secretRef}` is
* resolved only by wizard-tools that accept it, and the PostHog data-warehouse
* tools reject it. Without that, a pi agent collecting a credential it must hand
* to `external-data-sources-create` vaults it, gets a ref the create tool
* rejects, and dead-ends into the browser fallback — the exact loss the wizard's
* in-cli source setup is meant to avoid.
* The load-bearing part is the tail: a vaulted `{secretRef}` is resolved only by
* `set_env_values`, and a credential bound for a PostHog data-warehouse tool is
* a plain answer passed in that tool's arguments. Read as a ban on secrets in
* tool arguments, it leaves the agent holding a credential the user typed and
* dead-ending into the browser fallback — the exact loss the wizard's in-cli
* source setup is meant to avoid.
*/
export const WIZARD_ASK_SENSITIVE_DESCRIPTION =
"Only valid for kind='text'. When true, the user's answer is stored in the " +
"wizard's secret vault and returned to you as { secretRef: 'secret:...' } " +
'instead of the raw string. Use for API keys, tokens, and any other secret ' +
'the user types in. The secretRef is only resolved by wizard-tools that ' +
'accept it (e.g. set_env_values) — it is NOT resolved when passed to other ' +
'MCP tools (e.g. PostHog data-warehouse tools), which will reject it. For a ' +
'secret that must reach another tool, write it to the env with set_env_values ' +
"first, or use that tool's own credential-reference flow.";
'instead of the raw string. Set it only for a secret whose one destination ' +
'is a .env file: set_env_values resolves the secretRef, and no other tool ' +
'does — the PostHog data-warehouse tools and every other MCP tool reject it. ' +
'A credential you must hand to another tool, such as a data-warehouse ' +

@johncwaters johncwaters Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Automated review. Not written by a human.

[security] HIGH

Telling the agent to collect a warehouse credential with sensitive unset means the terminal prompt does not mask it: shouldMaskAnswer in src/tui/screens/WizardAskScreen.tsx masks only when sensitive === true. The password or API key is echoed on screen (the leak that function's comment describes) and enters the model conversation. Keep masking for this case, or note that unmasked echo is accepted.

'source credential, is collected with sensitive unset and passed in that ' +
Comment thread
veria-ai[bot] marked this conversation as resolved.
"tool's arguments exactly as the user typed it. That is the intended path: " +
'the user typed it for that purpose, so do not withhold it or swap in a ' +
'browser or credential-reference flow instead.';

@johncwaters johncwaters Oct 26, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Note

Automated review. Not written by a human.

[code-review] LOW

This description is shared by every wizard_ask caller. "do not withhold it" could push the agent to pass a typed secret as plain text to any tool. Narrow the wording to the PostHog source-setup tools.


/**
* The `wizard_ask` `subject` field description, shared by both harness facades
Expand Down
Loading