@aexol/spectral 0.9.245 → 0.9.246

package/dist/cli.js

@@ -39,6 +39,7 @@ function printHeader() {
         "  spectral desktop       Start the agent in the background and open the UI",
         "  spectral bind          Link this directory to an Aexol Studio project",
         "  spectral unbind        Remove the Aexol Studio project binding",
+        "  spectral secret        Manage local secrets (set/list/rm)",
         "  spectral update        Check for and install the latest Spectral version",
         "  spectral ports         Diagnose port collisions across local projects",
         "  spectral --version     Print version and exit",
@@ -135,6 +136,11 @@ async function main() {
         await runUnbind();
         process.exit(0);
     }
+    if (first === "secret") {
+        const { runSecret } = await import("./commands/secret.js");
+        await runSecret(args.slice(1));
+        process.exit(0);
+    }
     if (first === "update") {
         const { runUpdate } = await import("./commands/update.js");
         await runUpdate(args.slice(1));

package/dist/commands/secret.d.ts

@@ -0,0 +1,16 @@
+/**
+ * `spectral secret` — manage the local encrypted secret store.
+ *
+ * Usage:
+ *   spectral secret set NAME   create/update a secret; value is read from
+ *                              STDIN (piped or hidden interactive prompt) and
+ *                              is NEVER passed as a command-line argument
+ *   spectral secret list       list names + timestamps — values are never shown
+ *   spectral secret rm NAME    delete a secret
+ *
+ * Shares the exact same store as the /api/secrets relay API and the
+ * `list_secrets` agent tool. Secrets set here are injected as env vars into
+ * the agent's bash tool (see src/secrets/store.ts).
+ */
+export declare function runSecret(args: string[]): Promise<void>;
+//# sourceMappingURL=secret.d.ts.map

package/dist/commands/secret.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.d.ts","sourceRoot":"","sources":["../../src/commands/secret.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAsEH,wBAAsB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAyG7D"}

package/dist/commands/secret.js

@@ -0,0 +1,153 @@
+/**
+ * `spectral secret` — manage the local encrypted secret store.
+ *
+ * Usage:
+ *   spectral secret set NAME   create/update a secret; value is read from
+ *                              STDIN (piped or hidden interactive prompt) and
+ *                              is NEVER passed as a command-line argument
+ *   spectral secret list       list names + timestamps — values are never shown
+ *   spectral secret rm NAME    delete a secret
+ *
+ * Shares the exact same store as the /api/secrets relay API and the
+ * `list_secrets` agent tool. Secrets set here are injected as env vars into
+ * the agent's bash tool (see src/secrets/store.ts).
+ */
+import { createInterface } from "node:readline";
+import { Writable } from "node:stream";
+import pc from "picocolors";
+import { SecretNameError, SecretStoreCorruptError, SecretValueError, deleteSecret, listSecrets, setSecret, } from "../secrets/index.js";
+/**
+ * Read the secret value from STDIN. Never from argv — argv is visible in
+ * shell history and the process table.
+ *
+ *  - Piped input: the entire stdin is consumed; a single trailing newline
+ *    (from `echo "value" | …`) is stripped, everything else is preserved.
+ *  - Interactive TTY: a single line is read with the typed characters hidden
+ *    (readline with a swallowing output stream).
+ */
+function readValueFromStdin(name) {
+    return new Promise((resolve, reject) => {
+        if (process.stdin.isTTY) {
+            // Hide input: swallow every echoed chunk; the prompt goes to real stdout.
+            const muted = new Writable({
+                write(_chunk, _enc, cb) {
+                    cb();
+                },
+            });
+            const rl = createInterface({ input: process.stdin, output: muted, terminal: true });
+            process.stdout.write(`Enter value for ${name} (input hidden): `);
+            rl.question("", (answer) => {
+                rl.close();
+                process.stdout.write("\n");
+                resolve(answer);
+            });
+            rl.on("error", reject);
+            return;
+        }
+        const chunks = [];
+        process.stdin.on("data", (chunk) => chunks.push(chunk));
+        process.stdin.on("error", reject);
+        process.stdin.on("end", () => {
+            const raw = Buffer.concat(chunks).toString("utf8");
+            // Strip exactly one trailing newline/CR from `echo`-style pipes; keep
+            // any other whitespace — the value is preserved verbatim otherwise.
+            const value = raw.replace(/\r?\n$/, "");
+            resolve(value);
+        });
+    });
+}
+function fail(err) {
+    if (err instanceof SecretNameError ||
+        err instanceof SecretValueError ||
+        err instanceof SecretStoreCorruptError) {
+        process.stderr.write(pc.red(`${err.message}\n`));
+        process.exit(1);
+    }
+    process.stderr.write(pc.red(`Secret operation failed: ${err instanceof Error ? err.message : String(err)}\n`));
+    process.exit(1);
+}
+export async function runSecret(args) {
+    const sub = args[0];
+    if (sub === "set") {
+        const nameArg = args[1];
+        if (!nameArg || nameArg.trim() === "") {
+            process.stderr.write(pc.red('Usage: spectral secret set NAME  (value is read from STDIN, e.g. `echo -n "value" | spectral secret set NAME`)\n'));
+            process.exit(1);
+        }
+        let value;
+        try {
+            value = await readValueFromStdin(nameArg.trim());
+        }
+        catch (err) {
+            fail(err);
+        }
+        if (value.length === 0) {
+            process.stderr.write(pc.red("Secret value is empty — pipe a non-empty value on STDIN, e.g. `echo -n \"value\" | spectral secret set NAME`\n"));
+            process.exit(1);
+        }
+        try {
+            const meta = setSecret(nameArg.trim(), value);
+            process.stdout.write(pc.green(`✓ Secret ${meta.name} stored (encrypted at rest, injected as env var into the agent bash tool)\n`));
+        }
+        catch (err) {
+            fail(err);
+        }
+        return;
+    }
+    if (sub === "list") {
+        try {
+            const secrets = listSecrets();
+            if (secrets.length === 0) {
+                process.stdout.write("No secrets stored.\n");
+                return;
+            }
+            const nameW = Math.max(5, ...secrets.map((s) => s.name.length));
+            process.stdout.write([
+                `${secrets.length} stored secret(s) (values are never shown):`,
+                "",
+                `${"NAME".padEnd(nameW)}  Created               Updated`,
+                `${"─".repeat(nameW)}  ${"─".repeat(19)}  ${"─".repeat(19)}`,
+                ...secrets.map((s) => `${s.name.padEnd(nameW)}  ${s.createdAt.padEnd(19)}  ${s.updatedAt}`),
+            ].join("\n") + "\n");
+        }
+        catch (err) {
+            fail(err);
+        }
+        return;
+    }
+    if (sub === "rm") {
+        const nameArg = args[1];
+        if (!nameArg || nameArg.trim() === "") {
+            process.stderr.write(pc.red("Usage: spectral secret rm NAME\n"));
+            process.exit(1);
+        }
+        try {
+            const deleted = deleteSecret(nameArg.trim());
+            if (!deleted) {
+                process.stderr.write(pc.red(`Secret ${nameArg.trim().toUpperCase()} not found\n`));
+                process.exit(1);
+            }
+            process.stdout.write(pc.green(`✓ Secret ${nameArg.trim().toUpperCase()} removed\n`));
+        }
+        catch (err) {
+            fail(err);
+        }
+        return;
+    }
+    if (sub === "--help" || sub === "-h") {
+        process.stdout.write([
+            "Usage:",
+            "  spectral secret set NAME    create/update a secret (value read from STDIN, never argv)",
+            "  spectral secret list        list names + timestamps (values are never shown)",
+            "  spectral secret rm NAME     delete a secret",
+            "",
+            "Stored secrets are encrypted at rest (AES-256-GCM) and injected as env vars",
+            "into the agent's bash tool. Manage them remotely via the /api/secrets API.",
+            "",
+        ].join("\n"));
+        process.exit(0);
+    }
+    process.stderr.write(pc.red(`Unknown secret subcommand: ${sub ?? ""}\n`) +
+        pc.dim("Use `spectral secret --help` for usage.\n"));
+    process.exit(1);
+}

package/dist/extensions/list-secrets.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `list_secrets` tool extension.
+ *
+ * Lets the agent see which local secrets are stored (names + timestamps) so it
+ * can reason about what env vars will be injected into its bash tool.
+ *
+ * SECURITY: this tool returns ONLY names and timestamps. Secret values are
+ * never returned by this tool, by the relay GET API, or by anything else —
+ * values exist solely as env vars injected into the agent's bash environment
+ * (see src/secrets/store.ts `getSecretEnvVars`).
+ */
+import type { ExtensionAPI } from "../sdk/coding-agent/index.js";
+export default function listSecretsExtension(ext: ExtensionAPI): void;
+//# sourceMappingURL=list-secrets.d.ts.map

package/dist/extensions/list-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"list-secrets.d.ts","sourceRoot":"","sources":["../../src/extensions/list-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAoB,MAAM,8BAA8B,CAAC;AAGnF,MAAM,CAAC,OAAO,UAAU,oBAAoB,CAAC,GAAG,EAAE,YAAY,GAAG,IAAI,CA4DpE"}

package/dist/extensions/list-secrets.js

@@ -0,0 +1,63 @@
+/**
+ * `list_secrets` tool extension.
+ *
+ * Lets the agent see which local secrets are stored (names + timestamps) so it
+ * can reason about what env vars will be injected into its bash tool.
+ *
+ * SECURITY: this tool returns ONLY names and timestamps. Secret values are
+ * never returned by this tool, by the relay GET API, or by anything else —
+ * values exist solely as env vars injected into the agent's bash environment
+ * (see src/secrets/store.ts `getSecretEnvVars`).
+ */
+import { getSecretEnvVars, listSecrets } from "../secrets/index.js";
+export default function listSecretsExtension(ext) {
+    ext.registerTool({
+        name: "list_secrets",
+        label: "List Secrets",
+        description: "List the locally stored secret env vars that will be injected into your bash tool environment " +
+            "(e.g. GITHUB_TOKEN). Returns ONLY names and timestamps — secret values are never returned by " +
+            "this tool or any other; they exist solely as environment variables in your bash sessions. " +
+            "Manage secrets with the `spectral secret` CLI command or the /api/secrets relay API.",
+        parameters: {
+            type: "object",
+            properties: {},
+        },
+        async execute(_toolCallId, _params, _signal, _onUpdate, ctx) {
+            try {
+                const secrets = listSecrets();
+                if (secrets.length === 0) {
+                    return {
+                        content: [
+                            {
+                                type: "text",
+                                text: "No secrets stored. Add one with `spectral secret set NAME` (value read from STDIN) " +
+                                    "or POST /api/secrets. Stored secrets are injected as env vars into your bash tool.",
+                            },
+                        ],
+                        details: { isError: false },
+                    };
+                }
+                const envNames = Object.keys(getSecretEnvVars());
+                const lines = [
+                    `${secrets.length} stored secret(s) (values are never returned — they are injected as env vars):`,
+                    "",
+                    ...secrets.map((s) => `  ${s.name}  created ${s.createdAt}  updated ${s.updatedAt}` +
+                        (envNames.includes(s.name) ? "" : "  (not injected: reserved name)")),
+                    "",
+                    "These are available as environment variables in your bash tool sessions.",
+                ];
+                return {
+                    content: [{ type: "text", text: lines.join("\n") }],
+                    details: { isError: false },
+                };
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return {
+                    content: [{ type: "text", text: `Error reading secrets: ${msg}` }],
+                    details: { isError: true },
+                };
+            }
+        },
+    });
+}

package/dist/relay/routing.d.ts

@@ -20,7 +20,7 @@ import { type WizardLoginResult } from "./wizard-login.js";
  * `id` is populated when the route had an `:id` placeholder.
  */
 interface RouteMatch {
-    route: "list_projects" | "create_project" | "update_project" | "delete_project" | "bind_studio" | "unbind_studio" | "get_project_observations" | "list_project_sessions" | "cleanup_project_sessions" | "cleanup_all_sessions" | "create_session" | "get_session" | "get_session_active_agent" | "update_session_active_agent" | "get_session_messages" | "update_session" | "delete_session" | "get_session_memory" | "get_session_memory_details" | "compact_session" | "remember_and_delete_session" | "fork_session" | "list_path_autocomplete" | "list_directory" | "get_home_directory" | "create_directory" | "search_project_files" | "enqueue_prompt" | "get_prompt_queue" | "remove_prompt" | "clear_prompt_queue" | "list_mcp_status" | "reload_mcp_config" | "refresh_native_extensions" | "refresh_cloud_agents" | "get_settings" | "put_settings" | "get_agent_settings" | "put_agent_settings" | "get_prompt_mutation_settings" | "put_prompt_mutation_settings" | "wizard_login" | "list_agents" | "list_dev_processes" | "start_dev_process" | "kill_dev_process" | "restart_dev_process" | "scan_dev_servers" | "kill_dev_server";
+    route: "list_projects" | "create_project" | "update_project" | "delete_project" | "bind_studio" | "unbind_studio" | "get_project_observations" | "list_project_sessions" | "cleanup_project_sessions" | "cleanup_all_sessions" | "create_session" | "get_session" | "get_session_active_agent" | "update_session_active_agent" | "get_session_messages" | "update_session" | "delete_session" | "get_session_memory" | "get_session_memory_details" | "compact_session" | "remember_and_delete_session" | "fork_session" | "list_path_autocomplete" | "list_directory" | "get_home_directory" | "create_directory" | "search_project_files" | "enqueue_prompt" | "get_prompt_queue" | "remove_prompt" | "clear_prompt_queue" | "list_mcp_status" | "reload_mcp_config" | "refresh_native_extensions" | "refresh_cloud_agents" | "get_settings" | "put_settings" | "get_agent_settings" | "put_agent_settings" | "get_prompt_mutation_settings" | "put_prompt_mutation_settings" | "wizard_login" | "list_agents" | "list_dev_processes" | "start_dev_process" | "kill_dev_process" | "restart_dev_process" | "scan_dev_servers" | "kill_dev_server" | "list_secrets" | "create_secret" | "delete_secret";
     id?: string;
     /** Parsed query params, if the path carried a `?...` suffix. */
     query?: URLSearchParams;

package/dist/relay/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/relay/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmDzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AASzD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM7E;;;GAGG;AACH,UAAU,UAAU;IAClB,KAAK,EACD,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,0BAA0B,GAC1B,6BAA6B,GAC7B,sBAAsB,GACtB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,4BAA4B,GAC5B,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,kBAAkB,GAClB,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CA6PnB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAgZlB"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/relay/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmDzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAczD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAqB7E;;;GAGG;AACH,UAAU,UAAU;IAClB,KAAK,EACD,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,0BAA0B,GAC1B,6BAA6B,GAC7B,sBAAsB,GACtB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,4BAA4B,GAC5B,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,kBAAkB,GAClB,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,eAAe,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CA4RnB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAyZlB"}

package/dist/relay/routing.js

@@ -25,7 +25,26 @@ import { handleGetAgentSettingsAsync, handleListAgents, handlePutAgentSettingsAs
 import { handleGetSettingsAsync, handlePutSettingsAsync, } from "../server/handlers/settings.js";
 import { handleGetPromptMutationSettings, handlePutPromptMutationSettings, } from "../server/handlers/prompt-mutation-settings.js";
 import { handleKillDevProcess, handleKillDetectedDevServer, handleListDevProcesses, handleRestartDevProcess, handleScanDevServers, handleStartDevProcess, } from "../server/handlers/dev-processes.js";
+import { handleDeleteSecret, handleListSecrets, handleSetSecret, } from "../server/handlers/secrets.js";
 import { startWizardLogin } from "./wizard-login.js";
+// ---------------------------------------------------------------------------
+// Path matching
+// ---------------------------------------------------------------------------
+/**
+ * `decodeURIComponent` that never throws. Malformed percent-encoding (e.g.
+ * `%ZZ`) returns `null` instead of a URIError escaping `matchRoute` — the
+ * matcher sits OUTSIDE the REST try/catch, so a synchronous throw here would
+ * surface as an unhandled rejection and could take down `spectral serve`.
+ * Callers treat `null` as no-match → 404.
+ */
+function decodeSegment(raw) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Inline path matcher. Returns `null` for any path/method combination we
  * don't recognise; the caller turns that into a `404 Unknown route`.
@@ -134,7 +153,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/files/search
     const projectFilesMatch = /^\/api\/projects\/([^/]+)\/files\/search$/.exec(cleanPath);
     if (projectFilesMatch) {
-        const id = decodeURIComponent(projectFilesMatch[1]);
+        const id = decodeSegment(projectFilesMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "search_project_files", id, query };
         return null;
@@ -142,14 +163,18 @@ export function matchRoute(method, path) {
     // /api/projects/:id/bind-studio  and  /api/projects/:id/unbind-studio
     const bindStudioMatch = /^\/api\/projects\/([^/]+)\/bind-studio$/.exec(cleanPath);
     if (bindStudioMatch) {
-        const id = decodeURIComponent(bindStudioMatch[1]);
+        const id = decodeSegment(bindStudioMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "bind_studio", id };
         return null;
     }
     const unbindStudioMatch = /^\/api\/projects\/([^/]+)\/unbind-studio$/.exec(cleanPath);
     if (unbindStudioMatch) {
-        const id = decodeURIComponent(unbindStudioMatch[1]);
+        const id = decodeSegment(unbindStudioMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "unbind_studio", id };
         return null;
@@ -157,7 +182,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/observations
     const projectObsMatch = /^\/api\/projects\/([^/]+)\/observations$/.exec(cleanPath);
     if (projectObsMatch) {
-        const id = decodeURIComponent(projectObsMatch[1]);
+        const id = decodeSegment(projectObsMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_project_observations", id };
         return null;
@@ -165,7 +192,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id  and  /api/projects/:id/sessions
     const projectMatch = /^\/api\/projects\/([^/]+)(\/sessions)?$/.exec(cleanPath);
     if (projectMatch) {
-        const id = decodeURIComponent(projectMatch[1]);
+        const id = decodeSegment(projectMatch[1]);
+        if (id === null)
+            return null;
         const isSessions = projectMatch[2] === "/sessions";
         if (isSessions) {
             if (method === "GET")
@@ -181,7 +210,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/cleanup-sessions
     const projectCleanupMatch = /^\/api\/projects\/([^/]+)\/cleanup-sessions$/.exec(cleanPath);
     if (projectCleanupMatch) {
-        const id = decodeURIComponent(projectCleanupMatch[1]);
+        const id = decodeSegment(projectCleanupMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "cleanup_project_sessions", id };
         return null;
@@ -196,14 +227,18 @@ export function matchRoute(method, path) {
     // /api/sessions/:id
     const sessionMessagesMatch = /^\/api\/sessions\/([^/]+)\/messages$/.exec(cleanPath);
     if (sessionMessagesMatch) {
-        const id = decodeURIComponent(sessionMessagesMatch[1]);
+        const id = decodeSegment(sessionMessagesMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session_messages", id, query };
         return null;
     }
     const sessionMatch = /^\/api\/sessions\/([^/]+)$/.exec(cleanPath);
     if (sessionMatch) {
-        const id = decodeURIComponent(sessionMatch[1]);
+        const id = decodeSegment(sessionMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session", id };
         if (method === "PATCH")
@@ -214,7 +249,9 @@ export function matchRoute(method, path) {
     }
     const sessionAgentMatch = /^\/api\/sessions\/([^/]+)\/active-agent$/.exec(cleanPath);
     if (sessionAgentMatch) {
-        const id = decodeURIComponent(sessionAgentMatch[1]);
+        const id = decodeSegment(sessionAgentMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session_active_agent", id };
         if (method === "PUT")
@@ -224,7 +261,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/memory/details and /api/sessions/:id/memory and /api/sessions/:id/compact
     const sessionActionMatch = /^\/api\/sessions\/([^/]+)\/(memory(?:\/details)?|compact)$/.exec(cleanPath);
     if (sessionActionMatch) {
-        const id = decodeURIComponent(sessionActionMatch[1]);
+        const id = decodeSegment(sessionActionMatch[1]);
+        if (id === null)
+            return null;
         const action = sessionActionMatch[2];
         if (action === "memory" && method === "GET")
             return { route: "get_session_memory", id };
@@ -237,7 +276,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/remember-and-delete
     const rememberDeleteMatch = /^\/api\/sessions\/([^/]+)\/remember-and-delete$/.exec(cleanPath);
     if (rememberDeleteMatch) {
-        const id = decodeURIComponent(rememberDeleteMatch[1]);
+        const id = decodeSegment(rememberDeleteMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "remember_and_delete_session", id };
         return null;
@@ -245,7 +286,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/fork
     const forkMatch = /^\/api\/sessions\/([^/]+)\/fork$/.exec(cleanPath);
     if (forkMatch) {
-        const id = decodeURIComponent(forkMatch[1]);
+        const id = decodeSegment(forkMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "fork_session", id };
         return null;
@@ -253,8 +296,12 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/queue  and  /api/sessions/:id/queue/:itemId
     const queueMatch = /^\/api\/sessions\/([^/]+)\/queue(\/([^/]+))?$/.exec(cleanPath);
     if (queueMatch) {
-        const id = decodeURIComponent(queueMatch[1]);
-        const itemId = queueMatch[3] ? decodeURIComponent(queueMatch[3]) : undefined;
+        const id = decodeSegment(queueMatch[1]);
+        if (id === null)
+            return null;
+        const itemId = queueMatch[3] ? decodeSegment(queueMatch[3]) : undefined;
+        if (itemId === null)
+            return null;
         if (!itemId) {
             if (method === "GET")
                 return { route: "get_prompt_queue", id };
@@ -279,14 +326,18 @@ export function matchRoute(method, path) {
     }
     const restartDevProcessMatch = /^\/api\/dev-processes\/([^/]+)\/restart$/.exec(cleanPath);
     if (restartDevProcessMatch) {
-        const id = decodeURIComponent(restartDevProcessMatch[1]);
+        const id = decodeSegment(restartDevProcessMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "restart_dev_process", id };
         return null;
     }
     const devProcessMatch = /^\/api\/dev-processes\/([^/]+)$/.exec(cleanPath);
     if (devProcessMatch) {
-        const id = decodeURIComponent(devProcessMatch[1]);
+        const id = decodeSegment(devProcessMatch[1]);
+        if (id === null)
+            return null;
         if (method === "DELETE")
             return { route: "kill_dev_process", id };
         return null;
@@ -299,7 +350,9 @@ export function matchRoute(method, path) {
     }
     const devServerMatch = /^\/api\/dev-servers\/([^/]+)$/.exec(cleanPath);
     if (devServerMatch) {
-        const id = decodeURIComponent(devServerMatch[1]);
+        const id = decodeSegment(devServerMatch[1]);
+        if (id === null)
+            return null;
         if (method === "DELETE") {
             const rawPort = query?.get("port");
             const parsedPort = rawPort === null ? Number.NaN : Number(rawPort);
@@ -310,6 +363,23 @@ export function matchRoute(method, path) {
         }
         return null;
     }
+    // /api/secrets and /api/secrets/:name
+    if (cleanPath === "/api/secrets") {
+        if (method === "GET")
+            return { route: "list_secrets" };
+        if (method === "POST")
+            return { route: "create_secret" };
+        return null;
+    }
+    const secretMatch = /^\/api\/secrets\/([^/]+)$/.exec(cleanPath);
+    if (secretMatch) {
+        const id = decodeSegment(secretMatch[1]);
+        if (id === null)
+            return null;
+        if (method === "DELETE")
+            return { route: "delete_secret", id };
+        return null;
+    }
     return null;
 }
 /**
@@ -646,6 +716,12 @@ export async function dispatchRoute(match, body, deps) {
             return handleScanDevServers(store, deps.devProcessRegistry);
         case "kill_dev_server":
             return await handleKillDetectedDevServer(store, Number(id), match.port);
+        case "list_secrets":
+            return handleListSecrets();
+        case "create_secret":
+            return handleSetSecret(asObject(body));
+        case "delete_secret":
+            return handleDeleteSecret(id);
     }
 }
 /**

package/dist/sdk/coding-agent/utils/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/utils/shell.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAyCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAqDpE;AAED,wBAAgB,WAAW,IAAI,MAAM,CAAC,UAAU,CAsB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAU3D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAQD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAKlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAyBjD"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/utils/shell.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAyCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAqDpE;AAED,wBAAgB,WAAW,IAAI,MAAM,CAAC,UAAU,CAmC/C;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAU3D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAQD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAKlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAyBjD"}

package/dist/sdk/coding-agent/utils/shell.js

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { delimiter } from "node:path";
 import { spawn, spawnSync } from "child_process";
 import { getBinDir } from "../config.js";
+import { getSecretEnvVars } from "../../../secrets/index.js";
 /**
  * Find bash executable on PATH (cross-platform)
  */
@@ -100,7 +101,7 @@ export function getShellEnv() {
     const pathEntries = currentPath.split(delimiter).filter(Boolean);
     const hasBinDir = pathEntries.includes(binDir);
     const updatedPath = hasBinDir ? currentPath : [binDir, currentPath].filter(Boolean).join(delimiter);
-    return {
+    const env = {
         ...process.env,
         [pathKey]: updatedPath,
         // Agent shell hygiene (mirrors mini-swe-agent / SWE-agent environments):
@@ -114,6 +115,19 @@ export function getShellEnv() {
         TQDM_DISABLE: "1",
         GIT_TERMINAL_PROMPT: "0",
     };
+    // Secret env-var injection (see src/secrets/store.ts). Synchronous,
+    // mtime-cached read of the encrypted store, so new/updated/deleted secrets
+    // are picked up on the next bash spawn without an agent restart. Secrets
+    // are applied on top of the base environment and intentionally win over any
+    // same-named variable from process.env — the store is the managed source.
+    // PATH is excluded by the store itself (a secret named PATH would override
+    // the rebuilt PATH above and break the bin dir injection). Failures degrade
+    // to the base env: spawning must never break, and no values are ever logged.
+    const secretEnv = getSecretEnvVars();
+    const secretKeys = Object.keys(secretEnv);
+    if (secretKeys.length === 0)
+        return env;
+    return { ...env, ...secretEnv };
 }
 /**
  * Platform-specific instructions injected into the system prompt.

package/dist/secrets/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Public surface of the local encrypted secret store.
+ *
+ * Note what is deliberately NOT exported here: `getSecretValue()` (internal —
+ * used only for env-var injection) and `resetSecretStore()` (test/reset
+ * helper). Consumers importing from this index can never expose secret values:
+ * every export either returns metadata-only views or the raw env map consumed
+ * by the bash tool's shell environment.
+ */
+export { MAX_SECRET_VALUE_BYTES, SECRET_NAME_PATTERN, SecretNameError, SecretStoreCorruptError, SecretValueError, deleteSecret, getSecretDataPath, getSecretEnvVars, getSecretKeyPath, listSecrets, normalizeSecretName, setSecret, type SecretMeta, } from "./store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,SAAS,EACT,KAAK,UAAU,GACf,MAAM,YAAY,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,10 @@
+/**
+ * Public surface of the local encrypted secret store.
+ *
+ * Note what is deliberately NOT exported here: `getSecretValue()` (internal —
+ * used only for env-var injection) and `resetSecretStore()` (test/reset
+ * helper). Consumers importing from this index can never expose secret values:
+ * every export either returns metadata-only views or the raw env map consumed
+ * by the bash tool's shell environment.
+ */
+export { MAX_SECRET_VALUE_BYTES, SECRET_NAME_PATTERN, SecretNameError, SecretStoreCorruptError, SecretValueError, deleteSecret, getSecretDataPath, getSecretEnvVars, getSecretKeyPath, listSecrets, normalizeSecretName, setSecret, } from "./store.js";