fix(connectors): preserve bot token drafts

[luokerenx4]

What changed

• keep newly entered connector secrets as a local controlled-input draft while the user types
• continue clearing the password field once the save response replaces the draft with a configuredSecrets presence marker
• add regression coverage that types a token one character at a time and verifies the complete value reaches auto-save

Why

Connector password inputs were hard-coded to value="". Every keystroke therefore triggered a render that immediately emptied the field; the next key started from an empty input and overwrote the previous character. A human-entered bot token could silently save as only its final character.

The Settings API already never returns stored tokens. Rendering adapter.settings[field.key] is safe because that value exists only as the current local draft and disappears when the sealed save response arrives.

User impact

Discord and Telegram bot tokens now accumulate normally behind password bullets and save in full. After saving, the field is blank again and only shows the configured placeholder, so stored secrets are still never revealed.

Validation

• pnpm vitest run ui/src/pages/Connectors.demo.spec.tsx (3 passed)
• pnpm -F @traderalice/connector-service typecheck
• pnpm test:connector-replay (3 files, 11 tests passed)
• pnpm -F @traderalice/connector-service build && pnpm test:connector-service
• git diff --check
• npx tsc --noEmit
• cd ui && npx tsc -b
• pnpm test (357 passed, 1 skipped files; 3389 passed, 9 skipped tests)
• pnpm -F open-alice-ui build:demo
• real demo walkthrough: sequential input retained a, then ab; after auto-save the value cleared and the placeholder changed to Configured — enter a new value to replace

External Discord/Telegram DM delivery was skipped because this input-only fix does not require or authorize user-owned platform credentials.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
openalice-demo	Ready	Preview, Comment	Jul 28, 2026 8:46pm