[Birfy]

Reproduce

On main, with GITHUB_TOKEN saved for all Bots (scope: 'all'):

1. A Bot shared with one other person opens a scheduled turn, or a group round starts from someone else's line; its shell env is {}.
2. The same Bot's shell on a turn the owner typed holds the key.
3. Nothing in either env tells the three cases apart: not configured, configured-but-withheld, present-and-empty. resolveEnv returns {} for every refusal, so the Bot reports "the user did not configure it" (issue Secrets: an absent $DSH_SECRET_* says nothing — distinguish not-configured, withheld-this-turn and empty, and honour an explicit per-Bot scope on the owner s scheduled turns #651, steps 1-4).
4. list_secrets says you may use it as $DSH_SECRET_GITHUB_TOKEN even when the key is withheld from that turn.

What changed

• core/src/host/turn-origin.js: turnOrigin(rt, sessionId) returns the turn's recorded verdict before settled narrows it, so a shared Bot's scheduled turn stays scheduled instead of collapsing to other.
• core/src/host/secrets.js: withheldReason() with a closed reason set (remote-bot, turn-not-owner, shared-bot-scheduled, shared-room, unknown-turn); resolveEnv writes DSH_SECRETS_WITHHELD=NAME:reason,... (names and reasons, never a value); list_secrets and the request_secret answer read the same function. A key whose scope names this Bot reaches that Bot's own scheduled turn while it is shared; scope: 'all' keeps the fail-closed rule.
• Tests: 5 new #651 cases and one updated expectation in core/test/secrets.test.js.
• Docs: new ### A withheld key says why (#651) in docs/subsystems/core-host.md, one changelog.d/651-secrets-withheld.fixed.md fragment, and one sentence in AGENTS.md hard rule 2 (main has no "Secrets" section; that rule is the closest place, and the issue asked for a line there).
• patches/ds-bot/ regenerated (0014-flybot-branding.patch and files/src/host/turn-origin.js).

What I ran

• node --import ./test/harness-resolve.mjs --test test/secrets.test.js test/turn-origin.test.js test/group-status.test.js -> 44 tests, 44 pass, 0 fail (test/secrets.test.js alone: 17/17).
• node .github/scripts/changelog.mjs check -> 2 fragments well formed.
• node scripts/ds-bot-patches.mjs check -> core/ equals ds-bot/ + patches, 10 patches apply cleanly.
• core/scripts/check-arch-docs.mjs -> OK (8 changed files).
• npx oxlint@1.76.0 -c .oxlintrc.json index.js web-search.js src dev scripts test -> 0 errors, 43 warnings (pre-existing).
• Rebased onto 0204900 (the fix(turn-origin): fail closed on a source kind it does not recognise (#620) #626 merge) before pushing; the diff applied cleanly and fix(turn-origin): fail closed on a source kind it does not recognise (#620) #626's turn-origin changes are kept.

Red without the source change

With core/src/host/secrets.js and core/src/host/turn-origin.js reverted to 0204900 and the tests unchanged, 5 of 17 fail:

not ok 11 - a key for all Bots stays out of a shared Bot's shell when the turn is not known to be the owner's
not ok 14 - #651: someone else's turn names the key and the reason, and carries no value
not ok 15 - #651: a friend's Bot says remote-bot, and a host with no key says nothing at all
not ok 16 - #651: a shared Bot's scheduled turn withholds scope "all" and keeps it for the Bot it names
not ok 17 - #651: list_secrets and request_secret give the same reason, and never a value
# pass 12
# fail 5

The 12 that stay green are the pre-existing cases plus the owner-turn guard (a key the owner's own turn already had).

Not run

• npm run verify and the full core suite: this working copy has no core/node_modules (npm ci needs esbuild; unrelated suites stop at Cannot find package 'esbuild'), so CI runs them. test/secrets.test.js runs standalone here.
• The smoke test (needs dev/bench.sh and a DSH checkout). The change is in core/src/host/secrets.js, so a smoke run after merge is advisable.

Risk

Security surface (secrets). No value is ever added anywhere new: the variable carries names and reasons only, and redaction is unchanged. Two behaviour changes: (1) a shell now carries DSH_SECRETS_WITHHELD when something is withheld; (2) a key whose scope list names this Bot now reaches that Bot's own scheduled turn while it is shared - the owner's explicit choice per #545 - while scope: 'all' is unchanged and stays fail-closed. Needs a PASS at the tip plus green tests-ok.

Fixes #651

[Birfy]

Verdict: PASS at 726eb72
Written-by: Reviewer

Tip SHA: 726eb72149b0b3ab13b3e5865fd742053aff9dae
CI at tip: 8/8 success
Tier: T3 — core/src/host/secrets.js is on the T3 list in .github/agent/risk-rules.json

Ran at this tip:

$ cd core && TZ=UTC DSH_HARNESS=… node --import ./test/harness-resolve.mjs --test test/secrets.test.js
# tests 17 / pass 17 / fail 0

$ export PATH=<portable git>/bin:$PATH && node scripts/ds-bot-patches.mjs check
ok  ds-bot/ = Fei2411/DeepSeek-Bot@2b10c70 (tree 5834c00, v0.1.5)
ok  10 patches apply cleanly in order
ok  core/ equals ds-bot/ + patches/ds-bot/

Gate ③, core/src/host/secrets.js back to 0204900, tests kept:

not ok 11 - a key for all Bots stays out of a shared Bot's shell when the turn is not known to be the owner's
not ok 14 - #651: someone else's turn names the key and the reason, and carries no value
not ok 15 - #651: a friend's Bot says remote-bot, and a host with no key says nothing at all
not ok 16 - #651: a shared Bot's scheduled turn withholds scope "all" and keeps it for the Bot it names
not ok 17 - #651: list_secrets and request_secret give the same reason, and never a value
# tests 17 / pass 12 / fail 5

Checked by reading. withheldReason is a closed set and the only source for all three surfaces (resolveEnv, list_secrets, request_secret); no path returns a value; turnOrigin returns the recorded verdict before settled narrows it, which is the only way to tell a shared Bot's scheduled turn from a room turn, and it reads entry.origin without mutating anything. scope: 'all' keeps the fail-closed rule and only an explicit scope: [<botId>] reaches that Bot's own scheduled turn (B), which is the owner's decision in #651. DSH_SECRETS_WITHHELD cannot collide with a secret's own variable (DSH_SECRET_<NAME>). Docs, AGENTS.md hard rule 2, the changelog fragment and the patch series all match the code, and the 168 lines moved inside 0014-flybot-branding.patch are a regeneration, not a behaviour change — check above proves the series still rebuilds core/ exactly.

Two things the owner should read before approving — they are not reasons to refuse the code, they are consequences of it.

1. A withheld key names itself to turns that are not the owner's. remote-bot and turn-not-owner put NAME:reason into the environment of that turn's shell. list_secrets already lists every saved key's name to any Bot on the team, so no new class of disclosure arrives through the tool — but the environment variable is ambient: it is present for every command a guest's turn runs, without calling anything. If the owner would rather a turn they are not driving learn only that something was withheld, the fix is to omit the names for REMOTE and NOT_OWNER (report a count or the bare reason) and keep names for the owner's own turns, which is what the feature is for.

2. B reaches further than "the Bot's own scheduled turn". On a shared Bot, a scheduled turn now carries an explicitly scoped key. A Bot's schedules can be created from a turn someone else is driving (the tool is DSH's, not this repo's), so a guest who can talk the Bot into scheduling something has arranged for the owner's key to be present when that turn runs — with whatever prompt they wrote. Scoping the key to the Bot is what makes it available there; 'all' keys are still refused. If that is not what "only this Bot" was meant to promise, the rule should be "a key reaches a scheduled turn only when the schedule's creator was the owner", and that is a policy decision, not something this diff can settle.

Not enqueued: T3 needs the maintainer's approve together with this PASS. The PASS stands until the tip moves.