feat(dashboard): view and edit non-secret environment values after save

[walker-tx]

Summary

Dashboard half of AGE-2986. Stacked on #4228, which adds the server's is_secret support (this PR's base; retarget to main once #4228 merges).

Environment variable values can now be viewed after save when they are not secret, on both surfaces that manage them:

Environment detail page

• Rows show masked values with an eye reveal; non-secret values reveal in cleartext, secret values only ever reveal their redacted preview.
• A "Sensitive" badge marks secret variables.
• Editing moves into a shared dialog (EnvironmentVariableDialog) with a Secret toggle. Making a secret variable readable requires typing a new value (the server enforces this too); leaving the value blank on a secret keeps the stored value.
• Row actions move into a kebab menu: Edit, Copy to Clipboard (locked for secrets — copying would only capture the redacted preview), Delete with confirmation.
• Saves apply immediately per dialog submit; the page-level save bar and draft state are gone.

MCP server environment settings

• The same shared dialog replaces inline value inputs; the Save button now only stages MCP metadata (mode, header display names).
• Rows gain the mask/eye reveal, the Sensitive badge, and the same kebab actions.
• The Add Variable sheet gains a per-row Secret switch (default on) and rejects an empty non-secret value before submitting, since the server cannot store empty plaintext.
• Deleting a stored value confirms first and captures the environment slug at click time — the selected view can move under an open dialog when MCP metadata refetches. The edit dialog pins its environment the same way.

Known gap

The MoreActions lock icon for the disabled copy action renders via the shared components/ui/more-actions icon map; no per-item tooltip explains why it is locked. Left as-is pending a call on extending the shared component.

Testing

• pnpm -F dashboard lint, type-check, and 737 tests green.
• Playwright smoke against the local stack: add a non-secret variable via the sheet, reveal cleartext, edit through the dialog, re-reveal the new value, delete with confirmation.

🤖 Generated with Claude Code

[linear-code]

AGE-2986

[changeset-bot]

🦋 Changeset detected

Latest commit: 8b29525

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
dashboard	Minor

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[cubic-dev-ai]

cubic analysis

Review completed against the latest diff

Linked issue analysis

Linked issue: AGE-2986: feat: allow viewing/revealing non-secret env var values after save

Status	Acceptance criteria	Notes
✅	Add an is_secret flag to the API types / OpenAPI / SDK so clients can mark entries secret vs non-secret	OpenAPI, Goa design, generated server types, and TS SDK types were updated to include is_secret / isSecret.
⚠️	DB schema migration adding environment_entries.is_secret (so storage layer can persist the flag)	Queries and repo/models assume an is_secret column, but the migration file itself is not present in this PR — the PR is stacked on a separate migration PR (#4154) that must be merged first.
✅	Store non-secret values plaintext and keep secret values encrypted (invariant: is_secret ⇔ ciphertext)	Create and update code now conditionally encrypts values based on the is_secret flag; storage parameters include is_secret.
✅	Reads return cleartext for non-secret entries and redacted format for secret entries	List/decode paths check entry.IsSecret and only decrypt/redact when appropriate; response types include is_secret and value semantics updated.
✅	Flip rules: secret → non-secret requires a new value in the same request; non-secret → secret allowed without a new value (encrypts stored plaintext)	Update handler enforces the secret→non check and allows non-secret→secret without a value. Tests exercise both directions.
✅	Preserve rule: omitting value on an existing entry preserves stored value (matches headers preserve semantics)	Update logic uses existing value when value omitted; tests verify omitted-value preserves secret and omitted-is_secret preserves secrecy.
✅	Dashboard: Secret checkbox on new-entry form (default on), per-row lock/unlock toggle, cleartext display + copy for non-secret rows, unlocking a secret forces entering a new value	Dashboard changes add newEntryIsSecret checkbox, per-row lock/unlock UI and handlers, copy button for non-secret rows, and helper text requiring a new value when unlocking secrets.
✅	API/SDK regen and client examples updated to include is_secret; generated clients/types reflect new behavior	Generated server/client code and CLI examples include is_secret/isSecret fields and validation changes; SDK models updated.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[speakeasybot]

🚀 Preview Environment (PR #4157)

Preview URL: https://pr-4157.dev.getgram.ai

Component	Status	Details	Updated (UTC)
⏳ Database	Pending	Waiting for db-init job	2026-07-15 19:27:19.
✅ Images	Available	Container images ready	2026-07-15 19:27:16.

_{Gram Preview Bot}

[cubic-dev-ai]

cubic analysis

1 issue found across 36 files

Prompt for AI agents (unresolved issues)

Check if these issues are valid — if so, understand the root cause of each and fix them. If appropriate, use sub-agents to investigate and fix each issue separately.


<file name="client/dashboard/src/pages/mcp/MCPEnvironmentSettings.tsx">

<violation number="1" location="client/dashboard/src/pages/mcp/MCPEnvironmentSettings.tsx:364">
P2: Saving a named blank secret variable closes the sheet but creates neither its environment entry nor MCP config. Include empty secret entries in `systemEntries` (while continuing to reject/validate blank readable values) so placeholder rows reach the API.</violation>
</file>

Linked issue analysis

Linked issue: AGE-2986: feat: allow viewing/revealing non-secret env var values after save

Status	Acceptance criteria	Notes
✅	Non-secret environment variable values are readable after save; secret values remain redacted on reads.	API and server types now include is_secret and value semantics; dashboard shows cleartext for non-secret entries and redacted previews for secrets; tests and manual E2E exercised the scenario.
✅	Storage invariant: non-secret values stored plaintext, secret values encrypted at rest (is_secret ⇔ ciphertext at rest).	DB/queries and repo code now include is_secret and write/read paths that preserve encryption semantics.
✅	Flip rules: changing secret→non-secret requires supplying a new value in the same request; non-secret→secret allowed without a value and encrypts stored value in place.	Create/Update handlers enforce supplied-value requirement when flipping to non-secret; tests cover both flip directions.
✅	Preserve rule: omitting value on an existing entry preserves the stored value (no accidental overwrite).	Update logic reads existing value for omitted entries and ListEnvironmentEntriesForUpdate adds a FOR UPDATE path to avoid races; tests assert preservation behavior.
✅	Back-compat: omitted is_secret defaults to secret for new entries and keeps current secrecy for existing entries.	Handlers default omitted flag to true for new entries and use current stored secrecy for existing ones; comments and tests reflect this policy.
✅	Dashboard UX: per-variable view/edit flow with a view action exposing server-returned value, modal editing that enforces secret/readable rules, and changes to AddVariableSheet to default new entries to secret.	Client adds EnvironmentVariableDialog, updates Environment page and rows, adds Eye/EyeOff and copy behavior, and default-is-secret behavior in AddVariableSheet; modal enforces rules described in PR.
✅	Tests and lint/type-check: handler-level tests, client lint/type-check, and E2E checks exercising the core scenario.	PR claims 52 handler-level tests (including new ones for flips/preserve), client lint and type-check pass, and manual E2E verification was performed.

<sub>Tip: instead of fixing issues one by one fix them all with cubic

Re-trigger cubic</sub>

[cubic-dev-ai]

All reported issues were addressed across 2 files (changes from recent commits).

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>

Linked issue analysis

Linked issue: AGE-2986: feat: allow viewing/revealing non-secret env var values after save

Status	Acceptance criteria	Notes
✅	Non-secret environment variable values can be revealed after save (eye icon shows cleartext) while secret values only show the redacted preview.	Environment pages and MCP rows now track per-row reveal state and render MASK vs actual value depending on isSecret and reveal state.
✅	Secret variables are visually marked (Sensitive badge)	Rows render a 'Sensitive' Badge when an entry is secret and stored.
✅	Editing uses a shared EnvironmentVariableDialog with a Secret toggle; making a secret variable readable requires entering a new value; leaving the value blank on a secret preserves the stored value.	EnvironmentVariableDialog enforces needsNewValue and validates blank handling; it seeds value empty for stored secrets and requires new value to flip secrecy.
✅	Copy-to-clipboard is available for readable (non-secret) values and is disabled/locked for secrets	Copy action is included but disabled for secrets; dialog also shows CopyButton only when entry is non-secret and not dirty.
✅	Delete action requires confirmation and deletes the stored value	Delete flows open a confirmation dialog that triggers updateEnvironment with entriesToRemove to remove the variable.
✅	MCP server environment settings: value rows gain mask/eye reveal, Sensitive badge, kebab menu actions, and editing uses the shared dialog; MCP Save now only stages MCP metadata	MCP tab and rows were modified to use dialog-driven edits, show badges and reveal behavior, and dialog usage captures environment slug at click time; MCP metadata save logic remains responsible for header/mode staging.
✅	Add Variable sheet: per-row Secret switch (default on) and it rejects an empty non-secret value before submitting	AddVariableSheet initializes entries with isSecret true, includes a per-row Switch, and validates non-secret empty values with an error message before calling onAddVariables.

[walker-tx]

Demo

Recorded against the local ecommerce-api seed. The environment detail page now renders variables as a table with a lock icon for secret entries and a code icon for readable ones.

What it shows:

1. Reveal a non-secret variable (DEMO_API_URL): the stored value comes back in cleartext.
2. Reveal a secret variable (IPSUM): only the redacted preview (DOL*****) is shown.
3. Open the row actions menu and click Edit: the shared dialog opens seeded with the stored value and the Secret toggle.

[walker-tx]

Demo: MCP server Authentication tab

Recorded against the local ecommerce-api seed on the ecommerce-api-seed server (played at 1.4x).

What it shows:

1. Reveal a non-secret variable (ECOMMERCE_API_SERVER_URL): the stored value comes back in cleartext.
2. Add a new variable through the sheet with the new Secret toggle turned off.
3. Open the new row's actions menu and click Edit: the shared dialog opens seeded with the stored value and the Secret toggle.

[cubic-dev-ai]

cubic analysis

All reported issues were addressed across 9 files

Linked issue analysis

Linked issue: AGE-2986: feat: allow viewing/revealing non-secret env var values after save

Status	Acceptance criteria	Notes
✅	Non-secret environment variable values can be revealed after save (eye icon shows cleartext) while secret values only show the redacted preview.	Environment pages and MCP rows now track per-row reveal state and render MASK vs actual value depending on isSecret and reveal state.
✅	Secret variables are visually marked (Sensitive badge)	Rows render a 'Sensitive' Badge when an entry is secret and stored.
✅	Editing uses a shared EnvironmentVariableDialog with a Secret toggle; making a secret variable readable requires entering a new value; leaving the value blank on a secret preserves the stored value.	EnvironmentVariableDialog enforces needsNewValue and validates blank handling; it seeds value empty for stored secrets and requires new value to flip secrecy.
✅	Copy-to-clipboard is available for readable (non-secret) values and is disabled/locked for secrets	Copy action is included but disabled for secrets; dialog also shows CopyButton only when entry is non-secret and not dirty.
✅	Delete action requires confirmation and deletes the stored value	Delete flows open a confirmation dialog that triggers updateEnvironment with entriesToRemove to remove the variable.
✅	MCP server environment settings: value rows gain mask/eye reveal, Sensitive badge, kebab menu actions, and editing uses the shared dialog; MCP Save now only stages MCP metadata	MCP tab and rows were modified to use dialog-driven edits, show badges and reveal behavior, and dialog usage captures environment slug at click time; MCP metadata save logic remains responsible for header/mode staging.
✅	Add Variable sheet: per-row Secret switch (default on) and it rejects an empty non-secret value before submitting	AddVariableSheet initializes entries with isSecret true, includes a per-row Switch, and validates non-secret empty values with an error message before calling onAddVariables.

<sub>Reply with feedback, questions, or to request a fix.

Fix all with cubic | Re-trigger cubic</sub>