| 140 | }; |
| 141 | |
| 142 | const createSecretPlaceholder = async ( |
| 143 | ctx: CliContext, |
| 144 | scope: string, |
| 145 | expectedHandoffScope: string, |
| 146 | name: string, |
| 147 | ) => { |
| 148 | const result = toolData<{ readonly id: string; readonly url: string }>( |
| 149 | parseJsonOutput( |
| 150 | await callTool(ctx, ["executor", "coreTools", "secrets", "create"], { name, scope }), |
| 151 | ), |
| 152 | ); |
| 153 | const handoff = new URL(result.url); |
| 154 | assert(handoff.pathname === "/secrets", `Expected /secrets handoff URL, got ${result.url}`); |
| 155 | assert( |
| 156 | handoff.searchParams.get("scope") === expectedHandoffScope, |
| 157 | `Secret handoff omitted scope: ${result.url}`, |
| 158 | ); |
| 159 | return result; |
| 160 | }; |
| 161 | |
| 162 | const setSecretViaBrowserBoundary = async ( |
| 163 | ctx: CliContext, |