@aexol/spectral 0.9.245 → 0.9.247

package/dist/relay/routing.d.ts

@@ -20,7 +20,7 @@ import { type WizardLoginResult } from "./wizard-login.js";
  * `id` is populated when the route had an `:id` placeholder.
  */
 interface RouteMatch {
-    route: "list_projects" | "create_project" | "update_project" | "delete_project" | "bind_studio" | "unbind_studio" | "get_project_observations" | "list_project_sessions" | "cleanup_project_sessions" | "cleanup_all_sessions" | "create_session" | "get_session" | "get_session_active_agent" | "update_session_active_agent" | "get_session_messages" | "update_session" | "delete_session" | "get_session_memory" | "get_session_memory_details" | "compact_session" | "remember_and_delete_session" | "fork_session" | "list_path_autocomplete" | "list_directory" | "get_home_directory" | "create_directory" | "search_project_files" | "enqueue_prompt" | "get_prompt_queue" | "remove_prompt" | "clear_prompt_queue" | "list_mcp_status" | "reload_mcp_config" | "refresh_native_extensions" | "refresh_cloud_agents" | "get_settings" | "put_settings" | "get_agent_settings" | "put_agent_settings" | "get_prompt_mutation_settings" | "put_prompt_mutation_settings" | "wizard_login" | "list_agents" | "list_dev_processes" | "start_dev_process" | "kill_dev_process" | "restart_dev_process" | "scan_dev_servers" | "kill_dev_server";
+    route: "list_projects" | "create_project" | "update_project" | "delete_project" | "bind_studio" | "unbind_studio" | "get_project_observations" | "list_project_sessions" | "cleanup_project_sessions" | "cleanup_all_sessions" | "create_session" | "get_session" | "get_session_active_agent" | "update_session_active_agent" | "get_session_messages" | "update_session" | "delete_session" | "get_session_memory" | "get_session_memory_details" | "compact_session" | "remember_and_delete_session" | "fork_session" | "list_path_autocomplete" | "list_directory" | "get_home_directory" | "create_directory" | "search_project_files" | "enqueue_prompt" | "get_prompt_queue" | "remove_prompt" | "clear_prompt_queue" | "list_mcp_status" | "reload_mcp_config" | "refresh_native_extensions" | "refresh_cloud_agents" | "get_settings" | "put_settings" | "get_agent_settings" | "put_agent_settings" | "get_prompt_mutation_settings" | "put_prompt_mutation_settings" | "wizard_login" | "list_agents" | "list_dev_processes" | "start_dev_process" | "kill_dev_process" | "restart_dev_process" | "scan_dev_servers" | "kill_dev_server" | "list_secrets" | "create_secret" | "delete_secret";
     id?: string;
     /** Parsed query params, if the path carried a `?...` suffix. */
     query?: URLSearchParams;

package/dist/relay/routing.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/relay/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmDzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AASzD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAM7E;;;GAGG;AACH,UAAU,UAAU;IAClB,KAAK,EACD,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,0BAA0B,GAC1B,6BAA6B,GAC7B,sBAAsB,GACtB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,4BAA4B,GAC5B,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,kBAAkB,GAClB,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,CAAC;IACtB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CA6PnB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAgZlB"}
+{"version":3,"file":"routing.d.ts","sourceRoot":"","sources":["../../src/relay/routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,uBAAuB,CAAC;AAKvD,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmDzD,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACxE,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,mCAAmC,CAAC;AAC5E,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,sBAAsB,CAAC;AAczD,OAAO,EAAoB,KAAK,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAqB7E;;;GAGG;AACH,UAAU,UAAU;IAClB,KAAK,EACD,eAAe,GACf,gBAAgB,GAChB,gBAAgB,GAChB,gBAAgB,GAChB,aAAa,GACb,eAAe,GACf,0BAA0B,GAC1B,uBAAuB,GACvB,0BAA0B,GAC1B,sBAAsB,GACtB,gBAAgB,GAChB,aAAa,GACb,0BAA0B,GAC1B,6BAA6B,GAC7B,sBAAsB,GACtB,gBAAgB,GAChB,gBAAgB,GAChB,oBAAoB,GACpB,4BAA4B,GAC5B,iBAAiB,GACjB,6BAA6B,GAC7B,cAAc,GACd,wBAAwB,GACxB,gBAAgB,GAChB,oBAAoB,GACpB,kBAAkB,GAClB,sBAAsB,GACtB,gBAAgB,GAChB,kBAAkB,GAClB,eAAe,GACf,oBAAoB,GACpB,iBAAiB,GACjB,mBAAmB,GACnB,2BAA2B,GAC3B,sBAAsB,GACtB,cAAc,GACd,cAAc,GACd,oBAAoB,GACpB,oBAAoB,GACpB,8BAA8B,GAC9B,8BAA8B,GAC9B,cAAc,GACd,aAAa,GACb,oBAAoB,GACpB,mBAAmB,GACnB,kBAAkB,GAClB,qBAAqB,GACrB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,eAAe,GACf,eAAe,CAAC;IACpB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,gEAAgE;IAChE,KAAK,CAAC,EAAE,eAAe,CAAC;IACxB,sEAAsE;IACtE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;GAMG;AACH,wBAAgB,UAAU,CACxB,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,GACX,UAAU,GAAG,IAAI,CA4RnB;AAMD;;;;;;;;;GASG;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC;AAE1D,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,YAAY,CAAC;IACpB,OAAO,EAAE,oBAAoB,CAAC;IAC9B,6FAA6F;IAC7F,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,uGAAuG;IACvG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB;;;;OAIG;IACH,MAAM,CAAC,EAAE;QACP,KAAK,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC;KACrC,CAAC;IACF;;;;OAIG;IACH,QAAQ,CAAC,EAAE,iBAAiB,CAAC;IAC7B,wEAAwE;IACxE,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC;;;;;;;;;OASG;IACH,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,uBAAuB,CAAC,EAAE,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C;;;;OAIG;IACH,kBAAkB,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC1D,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,iBAAiB,CAAC,CAAC;CACrD;AAED;;;;;;;;;;;GAWG;AACH,wBAAsB,aAAa,CACjC,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,OAAO,EACb,IAAI,EAAE,eAAe,GACpB,OAAO,CAAC,OAAO,CAAC,CAyZlB"}

package/dist/relay/routing.js

@@ -25,7 +25,26 @@ import { handleGetAgentSettingsAsync, handleListAgents, handlePutAgentSettingsAs
 import { handleGetSettingsAsync, handlePutSettingsAsync, } from "../server/handlers/settings.js";
 import { handleGetPromptMutationSettings, handlePutPromptMutationSettings, } from "../server/handlers/prompt-mutation-settings.js";
 import { handleKillDevProcess, handleKillDetectedDevServer, handleListDevProcesses, handleRestartDevProcess, handleScanDevServers, handleStartDevProcess, } from "../server/handlers/dev-processes.js";
+import { handleDeleteSecret, handleListSecrets, handleSetSecret, } from "../server/handlers/secrets.js";
 import { startWizardLogin } from "./wizard-login.js";
+// ---------------------------------------------------------------------------
+// Path matching
+// ---------------------------------------------------------------------------
+/**
+ * `decodeURIComponent` that never throws. Malformed percent-encoding (e.g.
+ * `%ZZ`) returns `null` instead of a URIError escaping `matchRoute` — the
+ * matcher sits OUTSIDE the REST try/catch, so a synchronous throw here would
+ * surface as an unhandled rejection and could take down `spectral serve`.
+ * Callers treat `null` as no-match → 404.
+ */
+function decodeSegment(raw) {
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        return null;
+    }
+}
 /**
  * Inline path matcher. Returns `null` for any path/method combination we
  * don't recognise; the caller turns that into a `404 Unknown route`.
@@ -134,7 +153,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/files/search
     const projectFilesMatch = /^\/api\/projects\/([^/]+)\/files\/search$/.exec(cleanPath);
     if (projectFilesMatch) {
-        const id = decodeURIComponent(projectFilesMatch[1]);
+        const id = decodeSegment(projectFilesMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "search_project_files", id, query };
         return null;
@@ -142,14 +163,18 @@ export function matchRoute(method, path) {
     // /api/projects/:id/bind-studio  and  /api/projects/:id/unbind-studio
     const bindStudioMatch = /^\/api\/projects\/([^/]+)\/bind-studio$/.exec(cleanPath);
     if (bindStudioMatch) {
-        const id = decodeURIComponent(bindStudioMatch[1]);
+        const id = decodeSegment(bindStudioMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "bind_studio", id };
         return null;
     }
     const unbindStudioMatch = /^\/api\/projects\/([^/]+)\/unbind-studio$/.exec(cleanPath);
     if (unbindStudioMatch) {
-        const id = decodeURIComponent(unbindStudioMatch[1]);
+        const id = decodeSegment(unbindStudioMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "unbind_studio", id };
         return null;
@@ -157,7 +182,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/observations
     const projectObsMatch = /^\/api\/projects\/([^/]+)\/observations$/.exec(cleanPath);
     if (projectObsMatch) {
-        const id = decodeURIComponent(projectObsMatch[1]);
+        const id = decodeSegment(projectObsMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_project_observations", id };
         return null;
@@ -165,7 +192,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id  and  /api/projects/:id/sessions
     const projectMatch = /^\/api\/projects\/([^/]+)(\/sessions)?$/.exec(cleanPath);
     if (projectMatch) {
-        const id = decodeURIComponent(projectMatch[1]);
+        const id = decodeSegment(projectMatch[1]);
+        if (id === null)
+            return null;
         const isSessions = projectMatch[2] === "/sessions";
         if (isSessions) {
             if (method === "GET")
@@ -181,7 +210,9 @@ export function matchRoute(method, path) {
     // /api/projects/:id/cleanup-sessions
     const projectCleanupMatch = /^\/api\/projects\/([^/]+)\/cleanup-sessions$/.exec(cleanPath);
     if (projectCleanupMatch) {
-        const id = decodeURIComponent(projectCleanupMatch[1]);
+        const id = decodeSegment(projectCleanupMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "cleanup_project_sessions", id };
         return null;
@@ -196,14 +227,18 @@ export function matchRoute(method, path) {
     // /api/sessions/:id
     const sessionMessagesMatch = /^\/api\/sessions\/([^/]+)\/messages$/.exec(cleanPath);
     if (sessionMessagesMatch) {
-        const id = decodeURIComponent(sessionMessagesMatch[1]);
+        const id = decodeSegment(sessionMessagesMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session_messages", id, query };
         return null;
     }
     const sessionMatch = /^\/api\/sessions\/([^/]+)$/.exec(cleanPath);
     if (sessionMatch) {
-        const id = decodeURIComponent(sessionMatch[1]);
+        const id = decodeSegment(sessionMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session", id };
         if (method === "PATCH")
@@ -214,7 +249,9 @@ export function matchRoute(method, path) {
     }
     const sessionAgentMatch = /^\/api\/sessions\/([^/]+)\/active-agent$/.exec(cleanPath);
     if (sessionAgentMatch) {
-        const id = decodeURIComponent(sessionAgentMatch[1]);
+        const id = decodeSegment(sessionAgentMatch[1]);
+        if (id === null)
+            return null;
         if (method === "GET")
             return { route: "get_session_active_agent", id };
         if (method === "PUT")
@@ -224,7 +261,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/memory/details and /api/sessions/:id/memory and /api/sessions/:id/compact
     const sessionActionMatch = /^\/api\/sessions\/([^/]+)\/(memory(?:\/details)?|compact)$/.exec(cleanPath);
     if (sessionActionMatch) {
-        const id = decodeURIComponent(sessionActionMatch[1]);
+        const id = decodeSegment(sessionActionMatch[1]);
+        if (id === null)
+            return null;
         const action = sessionActionMatch[2];
         if (action === "memory" && method === "GET")
             return { route: "get_session_memory", id };
@@ -237,7 +276,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/remember-and-delete
     const rememberDeleteMatch = /^\/api\/sessions\/([^/]+)\/remember-and-delete$/.exec(cleanPath);
     if (rememberDeleteMatch) {
-        const id = decodeURIComponent(rememberDeleteMatch[1]);
+        const id = decodeSegment(rememberDeleteMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "remember_and_delete_session", id };
         return null;
@@ -245,7 +286,9 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/fork
     const forkMatch = /^\/api\/sessions\/([^/]+)\/fork$/.exec(cleanPath);
     if (forkMatch) {
-        const id = decodeURIComponent(forkMatch[1]);
+        const id = decodeSegment(forkMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "fork_session", id };
         return null;
@@ -253,8 +296,12 @@ export function matchRoute(method, path) {
     // /api/sessions/:id/queue  and  /api/sessions/:id/queue/:itemId
     const queueMatch = /^\/api\/sessions\/([^/]+)\/queue(\/([^/]+))?$/.exec(cleanPath);
     if (queueMatch) {
-        const id = decodeURIComponent(queueMatch[1]);
-        const itemId = queueMatch[3] ? decodeURIComponent(queueMatch[3]) : undefined;
+        const id = decodeSegment(queueMatch[1]);
+        if (id === null)
+            return null;
+        const itemId = queueMatch[3] ? decodeSegment(queueMatch[3]) : undefined;
+        if (itemId === null)
+            return null;
         if (!itemId) {
             if (method === "GET")
                 return { route: "get_prompt_queue", id };
@@ -279,14 +326,18 @@ export function matchRoute(method, path) {
     }
     const restartDevProcessMatch = /^\/api\/dev-processes\/([^/]+)\/restart$/.exec(cleanPath);
     if (restartDevProcessMatch) {
-        const id = decodeURIComponent(restartDevProcessMatch[1]);
+        const id = decodeSegment(restartDevProcessMatch[1]);
+        if (id === null)
+            return null;
         if (method === "POST")
             return { route: "restart_dev_process", id };
         return null;
     }
     const devProcessMatch = /^\/api\/dev-processes\/([^/]+)$/.exec(cleanPath);
     if (devProcessMatch) {
-        const id = decodeURIComponent(devProcessMatch[1]);
+        const id = decodeSegment(devProcessMatch[1]);
+        if (id === null)
+            return null;
         if (method === "DELETE")
             return { route: "kill_dev_process", id };
         return null;
@@ -299,7 +350,9 @@ export function matchRoute(method, path) {
     }
     const devServerMatch = /^\/api\/dev-servers\/([^/]+)$/.exec(cleanPath);
     if (devServerMatch) {
-        const id = decodeURIComponent(devServerMatch[1]);
+        const id = decodeSegment(devServerMatch[1]);
+        if (id === null)
+            return null;
         if (method === "DELETE") {
             const rawPort = query?.get("port");
             const parsedPort = rawPort === null ? Number.NaN : Number(rawPort);
@@ -310,6 +363,23 @@ export function matchRoute(method, path) {
         }
         return null;
     }
+    // /api/secrets and /api/secrets/:name
+    if (cleanPath === "/api/secrets") {
+        if (method === "GET")
+            return { route: "list_secrets" };
+        if (method === "POST")
+            return { route: "create_secret" };
+        return null;
+    }
+    const secretMatch = /^\/api\/secrets\/([^/]+)$/.exec(cleanPath);
+    if (secretMatch) {
+        const id = decodeSegment(secretMatch[1]);
+        if (id === null)
+            return null;
+        if (method === "DELETE")
+            return { route: "delete_secret", id };
+        return null;
+    }
     return null;
 }
 /**
@@ -646,6 +716,12 @@ export async function dispatchRoute(match, body, deps) {
             return handleScanDevServers(store, deps.devProcessRegistry);
         case "kill_dev_server":
             return await handleKillDetectedDevServer(store, Number(id), match.port);
+        case "list_secrets":
+            return handleListSecrets();
+        case "create_secret":
+            return handleSetSecret(asObject(body));
+        case "delete_secret":
+            return handleDeleteSecret(id);
     }
 }
 /**

package/dist/sdk/coding-agent/utils/shell.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/utils/shell.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAyCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAqDpE;AAED,wBAAgB,WAAW,IAAI,MAAM,CAAC,UAAU,CAsB/C;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAU3D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAQD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAKlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAyBjD"}
+{"version":3,"file":"shell.d.ts","sourceRoot":"","sources":["../../../../src/sdk/coding-agent/utils/shell.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;CACf;AAyCD;;;;;;GAMG;AACH,wBAAgB,cAAc,CAAC,eAAe,CAAC,EAAE,MAAM,GAAG,WAAW,CAqDpE;AAED,wBAAgB,WAAW,IAAI,MAAM,CAAC,UAAU,CAmC/C;AAED;;;;;;;GAOG;AACH,wBAAgB,kCAAkC,IAAI,MAAM,CAU3D;AAED;;;;;;;GAOG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CA8BxD;AAQD,wBAAgB,qBAAqB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEvD;AAED,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAEzD;AAED,wBAAgB,2BAA2B,IAAI,IAAI,CAKlD;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAyBjD"}

package/dist/sdk/coding-agent/utils/shell.js

@@ -2,6 +2,7 @@ import { existsSync } from "node:fs";
 import { delimiter } from "node:path";
 import { spawn, spawnSync } from "child_process";
 import { getBinDir } from "../config.js";
+import { getSecretEnvVars } from "../../../secrets/index.js";
 /**
  * Find bash executable on PATH (cross-platform)
  */
@@ -100,7 +101,7 @@ export function getShellEnv() {
     const pathEntries = currentPath.split(delimiter).filter(Boolean);
     const hasBinDir = pathEntries.includes(binDir);
     const updatedPath = hasBinDir ? currentPath : [binDir, currentPath].filter(Boolean).join(delimiter);
-    return {
+    const env = {
         ...process.env,
         [pathKey]: updatedPath,
         // Agent shell hygiene (mirrors mini-swe-agent / SWE-agent environments):
@@ -114,6 +115,19 @@ export function getShellEnv() {
         TQDM_DISABLE: "1",
         GIT_TERMINAL_PROMPT: "0",
     };
+    // Secret env-var injection (see src/secrets/store.ts). Synchronous,
+    // mtime-cached read of the encrypted store, so new/updated/deleted secrets
+    // are picked up on the next bash spawn without an agent restart. Secrets
+    // are applied on top of the base environment and intentionally win over any
+    // same-named variable from process.env — the store is the managed source.
+    // PATH is excluded by the store itself (a secret named PATH would override
+    // the rebuilt PATH above and break the bin dir injection). Failures degrade
+    // to the base env: spawning must never break, and no values are ever logged.
+    const secretEnv = getSecretEnvVars();
+    const secretKeys = Object.keys(secretEnv);
+    if (secretKeys.length === 0)
+        return env;
+    return { ...env, ...secretEnv };
 }
 /**
  * Platform-specific instructions injected into the system prompt.

package/dist/secrets/index.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Public surface of the local encrypted secret store.
+ *
+ * Note what is deliberately NOT exported here: `getSecretValue()` (internal —
+ * used only for env-var injection) and `resetSecretStore()` (test/reset
+ * helper). Consumers importing from this index can never expose secret values:
+ * every export either returns metadata-only views or the raw env map consumed
+ * by the bash tool's shell environment.
+ */
+export { MAX_SECRET_VALUE_BYTES, SECRET_NAME_PATTERN, SecretNameError, SecretStoreCorruptError, SecretValueError, deleteSecret, getSecretDataPath, getSecretEnvVars, getSecretKeyPath, listSecrets, normalizeSecretName, setSecret, type SecretMeta, } from "./store.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/secrets/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/secrets/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EACN,sBAAsB,EACtB,mBAAmB,EACnB,eAAe,EACf,uBAAuB,EACvB,gBAAgB,EAChB,YAAY,EACZ,iBAAiB,EACjB,gBAAgB,EAChB,gBAAgB,EAChB,WAAW,EACX,mBAAmB,EACnB,SAAS,EACT,KAAK,UAAU,GACf,MAAM,YAAY,CAAC"}

package/dist/secrets/index.js

@@ -0,0 +1,10 @@
+/**
+ * Public surface of the local encrypted secret store.
+ *
+ * Note what is deliberately NOT exported here: `getSecretValue()` (internal —
+ * used only for env-var injection) and `resetSecretStore()` (test/reset
+ * helper). Consumers importing from this index can never expose secret values:
+ * every export either returns metadata-only views or the raw env map consumed
+ * by the bash tool's shell environment.
+ */
+export { MAX_SECRET_VALUE_BYTES, SECRET_NAME_PATTERN, SecretNameError, SecretStoreCorruptError, SecretValueError, deleteSecret, getSecretDataPath, getSecretEnvVars, getSecretKeyPath, listSecrets, normalizeSecretName, setSecret, } from "./store.js";

package/dist/secrets/store.d.ts

@@ -0,0 +1,109 @@
+/**
+ * Local encrypted secret store.
+ *
+ * Storage layout (both files under `getConfigDir()`, honoring
+ * `SPECTRAL_CONFIG_DIR` for tests):
+ *  - `<configDir>/secrets.key`      32 random bytes, mode 0600 — AES-256 key
+ *  - `<configDir>/secrets.json.enc` AES-256-GCM encrypted JSON, mode 0600
+ *
+ * Encrypted file layout:
+ *  - bytes 0-7:   magic `"SPSECRT1"` (format tag)
+ *  - bytes 8-19:  12-byte random IV
+ *  - bytes 20-35: 16-byte GCM auth tag
+ *  - bytes 36+:   ciphertext (UTF-8 JSON)
+ *
+ * Security rules enforced here and by this module's consumers:
+ *  - `listSecrets()` returns ONLY `{ name, createdAt, updatedAt }` — values are
+ *    never part of any listing.
+ *  - `getSecretValue()` is INTERNAL: it is consumed only by
+ *    `getSecretEnvVars()` (env-var injection into the agent's bash tool). It
+ *    is deliberately NOT re-exported from `./index.js`, so neither the relay
+ *    handlers nor the LLM-facing tool surface can reach it.
+ *  - No caller ever logs a value; error messages and listings carry names only.
+ *
+ * All I/O is synchronous by design: `getSecretEnvVars()` must be callable from
+ * the sync `getShellEnv()` in `src/sdk/coding-agent/utils/shell.ts`. The store
+ * is tiny (values are capped at 64 KiB each), so sync reads are negligible.
+ *
+ * Keep this module zero-side-effect on import: nothing touches the filesystem
+ * until one of the exported functions is called.
+ */
+/** Secret names: start with a letter, then letters/digits/underscores, max 64 chars. */
+export declare const SECRET_NAME_PATTERN: RegExp;
+/** Maximum UTF-8 byte size of a secret value (64 KiB). */
+export declare const MAX_SECRET_VALUE_BYTES: number;
+/** Metadata-safe view of a secret: NEVER includes the value. */
+export interface SecretMeta {
+    name: string;
+    createdAt: string;
+    updatedAt: string;
+}
+/** Thrown when a secret name is missing/invalid after normalization. */
+export declare class SecretNameError extends Error {
+    constructor(message: string);
+}
+/** Thrown when a secret value exceeds `MAX_SECRET_VALUE_BYTES`. */
+export declare class SecretValueError extends Error {
+    constructor(message: string);
+}
+/** Thrown when the encrypted store is unreadable, corrupt, or key-mismatched. */
+export declare class SecretStoreCorruptError extends Error {
+    constructor(message: string);
+}
+/** Path to the AES-256 key file (32 random bytes). Lazily computed — see `getConfigDir`. */
+export declare function getSecretKeyPath(): string;
+/** Path to the AES-256-GCM encrypted store. Lazily computed — see `getConfigDir`. */
+export declare function getSecretDataPath(): string;
+/**
+ * Normalize a secret name per the shared contract: trim surrounding
+ * whitespace, uppercase, then validate against `SECRET_NAME_PATTERN`.
+ * Throws `SecretNameError` with a generic message — the offending raw input
+ * is never echoed back, so it can't leak into logs.
+ */
+export declare function normalizeSecretName(raw: string): string;
+/**
+ * Return the secret env vars (name → value) for injection into the agent
+ * shell environment. Synchronous, mtime-cached: new/updated/deleted secrets
+ * are picked up on the next call without a CLI restart.
+ *
+ * Failure modes degrade gracefully — a corrupt store, missing key, or unreadable
+ * file returns `{}` instead of throwing, because `getShellEnv()` is sync and
+ * must never break bash spawning. No values are ever logged.
+ */
+export declare function getSecretEnvVars(): Record<string, string>;
+/**
+ * Create or update a secret. Returns the metadata-only view (never the value).
+ * Throws `SecretNameError` for invalid names, `SecretValueError` for oversized
+ * values, and `SecretStoreCorruptError` when the store cannot be read/written.
+ *
+ * Fully synchronous (no awaits): the read-modify-write below is atomic per
+ * event-loop turn, so concurrent relay POSTs in one process can never
+ * interleave — no mutex is needed. Cross-process writers are isolated by the
+ * unique per-request tmp name + rename in `writeStoreData`; the last rename
+ * wins and every writer re-reads the store on its next call.
+ */
+export declare function setSecret(rawName: string, value: string): SecretMeta;
+/**
+ * Delete a secret. Returns true when a record was removed, false when the
+ * name was not stored. Throws `SecretNameError` for invalid names.
+ */
+export declare function deleteSecret(rawName: string): boolean;
+/**
+ * List secrets as metadata only — `{ name, createdAt, updatedAt }`. Values are
+ * never part of the returned shape (this is the source for the relay GET
+ * response and the `list_secrets` agent tool).
+ */
+export declare function listSecrets(): SecretMeta[];
+/**
+ * INTERNAL — read a single secret value. Used ONLY for env-var injection via
+ * `getSecretEnvVars()`. Deliberately not re-exported from `./index.js` so it
+ * cannot be reached from the relay handlers or the LLM-facing tool surface.
+ * Never log the return value.
+ */
+export declare function getSecretValue(rawName: string): string | undefined;
+/**
+ * Remove the store + key (test helper and future "reset secrets" support).
+ * Returns true when either file was deleted.
+ */
+export declare function resetSecretStore(): boolean;
+//# sourceMappingURL=store.d.ts.map

package/dist/secrets/store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../src/secrets/store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAiBH,wFAAwF;AACxF,eAAO,MAAM,mBAAmB,QAA2B,CAAC;AAE5D,0DAA0D;AAC1D,eAAO,MAAM,sBAAsB,QAAY,CAAC;AAQhD,gEAAgE;AAChE,MAAM,WAAW,UAAU;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;CAClB;AAaD,wEAAwE;AACxE,qBAAa,eAAgB,SAAQ,KAAK;gBAC7B,OAAO,EAAE,MAAM;CAI3B;AAED,mEAAmE;AACnE,qBAAa,gBAAiB,SAAQ,KAAK;gBAC9B,OAAO,EAAE,MAAM;CAI3B;AAED,iFAAiF;AACjF,qBAAa,uBAAwB,SAAQ,KAAK;gBACrC,OAAO,EAAE,MAAM;CAI3B;AAMD,4FAA4F;AAC5F,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,qFAAqF;AACrF,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAMD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAWvD;AA+ND;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAczD;AAMD;;;;;;;;;;GAUG;AACH,wBAAgB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,UAAU,CAcpE;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAUrD;AAED;;;;GAIG;AACH,wBAAgB,WAAW,IAAI,UAAU,EAAE,CAS1C;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIlE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,IAAI,OAAO,CAY1C"}