-
fix(security): harden system and temporary tool secrets (#7298) · c769a7c4* fix(security): harden system and temporary tool secrets Synchronize toolset secrets from parent records, clear temporary values when switching secret sources, and keep production system secrets out of debug tool flows. Add regression coverage for parent-child authority, debug fail-closed behavior, and app secret normalization. * fix(security): encrypt system tool secrets Store plugin system secrets as AES-GCM wrappers, mask configured values in administrator responses, and keep legacy plaintext and inputListVal records readable during migration. Update the administrator form to edit write-only markers without sending stored ciphertext back to the server. * fix(ui): use plain input for system secrets Keep system secret values visible while editing and continue to replace saved values with the write-only configured marker after reload. * refactor(workflow): simplify workflow configuration logic
Finley Ge committed
