[HugoXK]

Draw masked connector credentials in a bordered field wrapper

Fixes #2799

Owner: Dev-1
Written-by: Dev-1
Bot: Dev-1
Reviewer: Birfy
Risk tier: T1
Base: 5b8d980
Claim-Id: 42545a65305b47bd8345a1b3315e3d37

What changed

CredentialField (core/src/client/connectors.js) drew a masked credential as a bare MaskedInput.
That component is the Secrets page's field and .bt-secret-input carries no border, background or label
of its own — by design, because it is always placed inside a .bt-q-field wrapper. The connector form
supplied no wrapper, so Feishu's app mode showed the App ID in a box and the App Secret as nothing but
the grey Paste or type the key placeholder line under it: the form read as if only the App ID could be
filled in, while the secret field did accept text.

The masked branch now renders the same label.bt-q-field.bt-secret-field wrapper the Secrets page and
the gateway token field (connectors.js:261) already use, so app mode draws an App Secret box beside the
App ID box, with the App Secret aria-label it already carried. The webhook mode still asks for exactly
one field and now gets the border it was missing for the same reason. Nothing on the host side changes:
the declaration (core/src/host/connectors.js:451) and the body.credentials.app_secret read were
already correct. docs/subsystems/core-client.md records how a masked credential is drawn, and one
changelog fragment is added.

Red first — clean base, only the new test on the branch

$ node --import ./test/harness-resolve.mjs --test test/connectors-app-secret-field.test.js
not ok 1 - #2799: app mode draws the masked App Secret inside the same bordered field wrapper as the App ID
  error: 'the App Secret field has no bordered wrapper: it renders as a bare .bt-secret-input, so the form reads as App ID only'
not ok 2 - #2799: the webhook mode is unchanged — one masked field, still wrapped
  error: 'and that field keeps its bordered wrapper'
ok 3 - #2799: Connect stays disabled until both app fields have text
# tests 3  # pass 1  # fail 2

The third test passes on the base because filled already required both credentials; that guard is kept
so a future change to the wrapper cannot enable Connect early.

After the fix

$ node --import ./test/harness-resolve.mjs --test test/connectors-app-secret-field.test.js
# tests 3  # pass 3  # fail 0

$ node --import ./test/harness-resolve.mjs --test test/*connector*.test.js test/feishu*.test.js test/*secret*.test.js
# tests 143  # pass 143  # fail 0

Generated mirrors

npm --prefix core run build rewrote core/client.js; node scripts/ds-bot-patches.mjs generate then
wrote patches/ds-bot/files/ (392 files) and all ten patch files. Against this base the change is exactly
three generated paths:

• patches/ds-bot/0001-core-fixes.patch +7/−2 — the src/client/connectors.js hunk
• patches/ds-bot/0008-client-bundle.patch 1 line — the built client.js
• patches/ds-bot/files/test/connectors-app-secret-field.test.js (new, 96 lines) — the mirror of the test

generate reads only tracked files, so the test's files/ mirror appears after the test is committed;
the second commit carries it. check answers all three lines ok — ds-bot/ = Fei2411/DeepSeek-Bot@2b10c70 (tree 5834c00, v0.1.5), 10 patches apply cleanly in order, core/ equals ds-bot/ + patches/ds-bot/ —
and canonical reports patches/ds-bot/ is what generate writes (generate is a no-op).
node core/scripts/build-client.mjs --check is silent (exit 0).

Ran

• TZ=UTC npm run verify — exit 0: core # tests 3193 / # pass 3193, social 619, tree 143, timeline 161,
  workflow 528, .github/scripts + policy 673, interop 37, live-e2e 34, zero failures.
• node scripts/lint.mjs — Found 88 warnings and 0 errors (the warnings are on main too).
• ARCH_DOCS_BASE=5b8d980f npm --prefix core run arch-docs — arch-docs: OK (8 changed file(s)).
• node .github/scripts/changelog.mjs check — 22 fragment(s) in changelog.d/ are well formed.
• node scripts/ds-bot-patches.mjs generate / check / canonical and the client build check as above.
• the red-first runs, the fixed test, and the connector/Feishu/secret neighbour suites.
• Verified commit 9f91970b (tree cbb3fafa), eight files +207/−8; the pushed head is generated from
  that tree by the push helper.

Not run

• the smoke test: no index.js or src/host/ change (this is a client form only).
• npm run pack, typecheck and actionlint: not part of npm run verify.

Checkpoint

{
  "pr": 2802, "claim": "Dev-1", "issue": 2799,
  "summary": "CredentialField drew a masked credential as a bare MaskedInput, and that field's .bt-secret-input is unstyled because the Secrets page only puts it inside a bordered .bt-q-field wrapper. With no wrapper, Feishu's app mode showed the App Secret as a grey placeholder line under the App ID box, so the form read as App ID only. The masked branch now uses that same wrapper, so both app fields are boxes and Connect stays disabled until both have text; webhook mode keeps one field, now bordered. A client form test covers the wrapper, the one-field webhook mode and the Connect rule.",
  "files": ["core/src/client/connectors.js", "core/client.js", "core/test/connectors-app-secret-field.test.js", "docs/subsystems/core-client.md", "changelog.d/2799-connectors-app-secret-field.fixed.md", "patches/ds-bot/0001-core-fixes.patch", "patches/ds-bot/0008-client-bundle.patch", "patches/ds-bot/files/test/connectors-app-secret-field.test.js"],
  "checks": { "ran": "TZ=UTC npm run verify (exit 0); ds-bot-patches generate/check/canonical; ARCH_DOCS_BASE=5b8d980f npm --prefix core run arch-docs", "result": "green", "at": "181ba3fbeb58df5705638d2e657c6119c084c46f" },
  "next": "none — ready for review"
}

[HugoXK]

@Birfy review request for this tip — 181ba3fbeb58df5705638d2e657c6119c084c46f.

Read at the tip (REST Date 09:44:24 GMT): 18 checks = 16 success + 2 skipped + 0 failure, enqueue-guard success, mergeable: true, maintainer_can_modify: true, head in our fork. checkpointReasons() against live main's .github/scripts/enqueue-rules.mjs with this body and the 8 changed files returns [].

This is a T1 change (core/src/client/**, core/client.js, core/test/**, docs, changelog, patches/**): the masked branch of CredentialField now renders inside the same label.bt-q-field.bt-secret-field wrapper the Secrets page and the gateway token field already use, so Feishu app mode draws an App Secret box beside the App ID box instead of a bare unstyled .bt-secret-input; the webhook mode still asks for one field and Connect still requires both app credentials. Generated core/client.js and patches/ds-bot/{0001,0008} are regenerated from that tree, and ds-bot-patches check/canonical and the client build check are clean.

One review request for this tip only — I will not repeat it on this sha.