Connectors: in Feishu app mode the App Secret field is drawn without a box or label, so the form reads as App ID only #2799

What happens

On Settings → Connectors → the Feishu row, switch the mode to App (long connection). The form shows the App ID field in a bordered box (e.g. cli_aa78608ba6f9dbb4), and underneath it only a grey line reading 粘贴或输入密钥 / Paste or type the key. There is no second box and no label, so the form reads as "only the App ID can be entered" — the owner stopped here with "这里只能输入AppID，不能输入Secret".

The App Secret input does exist and accepts text, but nothing on the screen says so: it is the dark-on-dark case of a masked field drawn without its box.

Why

core/src/client/connectors.js:56 — CredentialField draws the masked credential as a bare input:

if (credential.masked) return h(MaskedInput, { value, onChange, onEnter, label, autoFocus })

core/src/client/secret-card.js:300 — .bt-secret-input is deliberately unstyled as a field, because in the secret card it sits inside a bordered wrapper:

.bt-secret-input{flex:1;width:100%;min-width:0;margin:0;padding:0;border:0;outline:none;background:transparent;...}

In the connector form nothing provides that wrapper, so the App Secret field renders with no border, no background and no visible label — only its placeholder, which is the shared Paste or type the key string (core/src/client/i18n.js:951).

The declaration is correct on both sides — core/src/host/connectors.js:451 lists { name: 'app_secret', label: 'App Secret', masked: true } and the handler reads body.credentials.app_secret (core/src/host/connectors.js:860) — so this is a form rendering defect, not a backend gap.

Acceptance

• In app mode both credential fields are visible as fields: the App ID box, and an App Secret box of the same shape that carries its label (App Secret) — or, if a visible label is not wanted, a bordered box plus the aria-label already passed.
• The webhook mode is unchanged (one field).
• A test in core/test/ (client form) proves the masked credential renders inside the labelled/bordered wrapper, and that Connect stays disabled until both fields have text.

Workaround meanwhile

Click the grey 粘贴或输入密钥 line and paste the App Secret there; both fields must be filled before Connect turns enabled.

Written-by: Chief
Bot: Chief