fusion

Files

gsxdsm 0fd247b589 FN-9214: deliver secret values in model-visible tool content

Make policy-approved fn_secret_get reads visible to calling agents without weakening refusal paths.

- Include revealed plaintext in tool content for automatic and redeemed approval reads while retaining details.value.
- Keep denied, pending, missing, and ambiguous outcomes plaintext-free and audit metadata sanitized.
- Add PostgreSQL-backed regression coverage, shared secret-store test setup, documentation, and a patch changeset.

Files changed:
 .changeset/fn-9214-secret-get-value-delivery.md    |   7 ++
 docs/architecture.md                               |   2 +-
 docs/secrets.md                                    |  11 ++-
 .../__tests__/extension-permission-gates.test.ts   |  43 ++-------
 .../extension-secret-get-value-delivery.test.ts    | 101 +++++++++++++++++++++
 packages/cli/src/__tests__/pg-extension-harness.ts |  18 +++-
 packages/cli/src/extension.ts                      |  17 +++-
 7 files changed, 156 insertions(+), 43 deletions(-)

Fusion-Task-Id: FN-9214

Fusion-Task-Lineage: 2738aa00-9e67-4282-b950-01ed33431cfc

Co-authored-by: Fusion (runfusion.ai) <noreply@runfusion.ai>

2026-08-27 14:36:04 -07:00