fix(settings): servers check secret provider writes and keep unknown configs to themselves

apps/server/src/serverSettings.test.ts

@@ -235,6 +235,24 @@ it.layer(NodeServices.layer)("server settings", (it) => {
     }).pipe(Effect.provide(layerServerSettings())),
   );
 
+  it.effect("sends clients a known secret provider's config but never an unknown kind's", () =>
+    Effect.gen(function* () {
+      const settings = yield* decodeServerSettings({
+        secretProviders: {
+          personal: { kind: "one_password", label: "Personal", config: { account: "my" } },
+          vault: { kind: "openbao", label: "Vault", config: { token: "bao-token" } },
+        },
+      });
+      assert.deepStrictEqual<unknown>(
+        ServerSettingsModule.redactServerSettingsForClient(settings).secretProviders,
+        {
+          personal: { kind: "one_password", label: "Personal", config: { account: "my" } },
+          vault: { kind: "openbao", label: "Vault" },
+        },
+      );
+    }),
+  );
+
   it.effect("saves through a symlinked settings file without replacing the link", () =>
     Effect.gen(function* () {
       const config = yield* ServerConfig.ServerConfig;

apps/server/src/serverSettings.ts

@@ -7,6 +7,7 @@ import {
   type ProviderInstanceConfig,
   type ProviderInstanceMutation,
   defaultInstanceIdForDriver,
+  isKnownSecretProviderKind,
   isProviderDriverKind,
   ProviderDriverKind,
   ProviderInstanceId,
@@ -128,11 +129,25 @@ const normalizeServerSettings = (
   );
 
 export function redactServerSettingsForClient(settings: ServerSettings): ServerSettings {
-  return mapSettingsSecrets(settings, (secret) =>
+  const redacted = mapSettingsSecrets(settings, (secret) =>
     secret.sensitive
       ? { value: "", redacted: secret.redacted || secret.value.length > 0 }
       : { value: secret.value, redacted: false },
   );
+  return { ...redacted, secretProviders: withoutUnknownSecretProviderConfigs(redacted) };
+}
+
+// A newer kind's config may hold credentials this build cannot recognize, so it never leaves the server.
+function withoutUnknownSecretProviderConfigs(
+  settings: ServerSettings,
+): ServerSettings["secretProviders"] {
+  return Object.fromEntries(
+    Object.entries(settings.secretProviders).map(([id, entry]) => {
+      if (isKnownSecretProviderKind(entry.kind)) return [id, entry];
+      const { config: _config, ...envelope } = entry;
+      return [id, envelope];
+    }),
+  ) as ServerSettings["secretProviders"];
 }
 
 export function applyProviderInstanceMutation(

apps/server/src/ws.ts

@@ -1791,6 +1791,7 @@ export const layerWsRpc = (
           threadSnapshotPagination: true,
           threadFind: true,
           threadFindProgressive: true,
+          secretProviderSettings: true,
           ...Option.match(scratchWorkspaceRoot, {
             onNone: () => ({}),
             onSome: (root) => ({ scratchWorkspaceRoot: root }),

apps/web/src/components/settings/SecretsSettings.tsx

@@ -35,9 +35,18 @@ const SECRET_PROVIDER_KINDS: Readonly<
 
 export function SecretsSettingsPanel() {
   const { scope, environment } = useSettingsScope();
+  const connected = environment?.connection.phase === "connected";
   return (
     <SettingsPageContainer>
-      {environment?.connection.phase === "connected" ? (
+      {connected &&
+      environment.serverConfig !== null &&
+      environment.serverConfig.secretProviderSettings !== true ? (
+        <SettingsSection {...searchableSetting("secret-providers")}>
+          <p className="px-4 py-3 text-sm text-muted-foreground">
+            Update T3 Code on {environment.label} to manage its secret providers.
+          </p>
+        </SettingsSection>
+      ) : connected ? (
         <EnvironmentSecretProviders
           key={environment.environmentId}
           environment={environment}

packages/contracts/src/server.ts

@@ -638,6 +638,8 @@ export const ServerConfig = Schema.Struct({
   threadSnapshotPagination: Schema.optionalKey(Schema.Boolean),
   threadFind: Schema.optionalKey(Schema.Boolean),
   threadFindProgressive: Schema.optionalKey(Schema.Boolean),
+  /** Settings patches may carry `secretProviders`; older servers drop the key without an error. */
+  secretProviderSettings: Schema.optionalKey(Schema.Boolean),
   scratchWorkspaceRoot: Schema.optionalKey(TrimmedNonEmptyString),
   newProjectsRoot: Schema.optionalKey(TrimmedNonEmptyString),
   /**

packages/contracts/src/settings.test.ts

@@ -15,7 +15,6 @@ import {
   resolveProjectProviderInstanceEnabled,
   resolveProviderInstanceEnabled,
   ServerSettings,
-  OnePasswordSecretProviderConfig,
   ServerSettingsPatch,
   withIdleCompaction,
 } from "./settings.ts";
@@ -26,7 +25,6 @@ const encodeClientSettings = Schema.encodeSync(ClientSettingsSchema);
 const decodeServerSettings = Schema.decodeUnknownSync(ServerSettings);
 const decodeServerSettingsPatch = Schema.decodeUnknownSync(ServerSettingsPatch);
 const encodeServerSettings = Schema.encodeSync(ServerSettings);
-const decodeOnePasswordConfig = Schema.decodeUnknownSync(OnePasswordSecretProviderConfig);
 const decodeClaudeSettings = Schema.decodeUnknownSync(ClaudeSettings);
 
 describe("storage cleanup settings", () => {
@@ -155,13 +153,14 @@ describe("ServerSettings secret providers", () => {
     ).toThrow();
   });
 
-  it("rejects a 1Password account op could misread", () => {
+  it("rejects writes of an unknown kind or an account op could misread", () => {
+    const write = (entry: unknown) => () =>
+      decodeServerSettingsPatch({ secretProviders: { personal: entry } });
     for (const account of ["", "my account", "--help"]) {
-      expect(() => decodeOnePasswordConfig({ account })).toThrow();
+      expect(write(onePassword(account))).toThrow();
     }
-    expect(decodeOnePasswordConfig({ account: "my.1password.com" }).account).toBe(
-      "my.1password.com",
-    );
+    expect(write({ kind: "one_password", label: "Personal" })).toThrow();
+    expect(write({ kind: "openbao", label: "Vault", config: { address: "https://x" } })).toThrow();
   });
 });
 

packages/contracts/src/settings.ts

@@ -859,7 +859,7 @@ export const UsageLimitSourceConfig = Schema.Struct({
 });
 export type UsageLimitSourceConfig = typeof UsageLimitSourceConfig.Type;
 
-// Final once shipped: a key or field that fails here fails the whole settings decode on older builds.
+// Final once shipped: older builds drop entries whose key fails here, and erase them on their next save.
 // Unlike provider slugs it may start with a digit, so a provider named "1Password" fits.
 const SecretProviderSlug = TrimmedNonEmptyString.check(
   Schema.isMaxLength(64),
@@ -903,11 +903,31 @@ export const SecretProviderConfig = Schema.Struct({
 });
 export type SecretProviderConfig = typeof SecretProviderConfig.Type;
 
+/** Kinds this build can resolve. Their `config` holds no credentials, so clients may read it. */
+const SECRET_PROVIDER_KIND_CONFIG_GUARDS: Readonly<Record<string, (config: unknown) => boolean>> = {
+  one_password: Schema.is(OnePasswordSecretProviderConfig),
+};
+
+export function isKnownSecretProviderKind(kind: string): boolean {
+  return Object.hasOwn(SECRET_PROVIDER_KIND_CONFIG_GUARDS, kind);
+}
+
 // Limits that may change later are enforced on writes only, never on the stored envelope.
+// Writes must be a kind this build knows with a config it accepts, so an older server
+// rejects a newer kind instead of storing what it cannot check.
 const SecretProviderConfigWrite = Schema.Struct({
   ...SecretProviderConfig.fields,
   label: SecretProviderLabel,
-});
+}).check(
+  Schema.makeFilter((entry) => {
+    if (!isKnownSecretProviderKind(entry.kind)) {
+      return `Unsupported secret provider kind: ${entry.kind}.`;
+    }
+    return SECRET_PROVIDER_KIND_CONFIG_GUARDS[entry.kind]!(entry.config)
+      ? true
+      : `Invalid ${entry.kind} secret provider config.`;
+  }),
+);
 
 export const SourceControlHostSettings = Schema.Record(Schema.String, Schema.Unknown);
 export type SourceControlHostSettings = typeof SourceControlHostSettings.Type;