Phase 3 of secrets at rest (#213, #216), same AES-256-GCM scheme and key.
- tools.exec joins the secret columns for system=false rows (AAD
tools.exec): the whole JSON is sealed in the {"__artex_enc":"enc:v1:..."}
envelope, so headers, body, proxy, script code and command are covered;
{} stays {}
- CreateCustomTool and UpdateCustomTool seal it; scanTool opens it, so
GetTool, ListTools and ListCustomTools (and through them customTools,
the platform tools and the test endpoint) see the clear JSON in memory
- the startup backfill, the no-key refusal and the wrong-key check cover
it, for system=false rows only; built-in rows stay in clear for the seeds
API: GET /api/tools returns the header values, proxy and body of a custom
tool masked, with headers_set, proxy_set and body_set. On update (API and
update_custom_tool) the placeholder keeps the stored value, an explicit
value replaces it and "" clears it; on create (API and create_custom_tool)
a placeholder is refused. The test endpoint takes an optional key: the
saved tool's stored values replace the placeholders; the editor sends it.
Comments, doc comments, UI labels, log and error messages, LLM prompt
strings, markdown docs, test data and assertions. Identifiers, enum
keys, routes, placeholders and code structure are unchanged.
Notes:
- docs/漏洞流量证据.md renamed to docs/vulnerability-traffic-evidence.md
- tests that exercised CJK specific handling (GBK zip names, Chinese
full text search) now use ASCII equivalents; go build passes and the
test suite matches the pre translation baseline (remaining failures
need a PostgreSQL DSN and fail identically on the original)
- frontend mention syntax now uses English kinds (finding, asset, ...)
matching the backend, chat mentions tests pass
BaaRai