@ai-ecoverse/slicc-agent 3.43.1 → 3.45.0

package/dist/types/licks/licks.d.ts

@@ -65,5 +65,6 @@ export declare const MAX_ITEMS = 50;
 export declare const MAX_EVENTS = 64;
 export declare function render(pending: Pending): Lick;
 export declare function strongest(a: LickSeverity | undefined, b: LickSeverity | undefined): LickSeverity | undefined;
+export declare function scrubbedLick(event: LickEvent): Promise<LickEvent>;
 export declare function createLicks(host: Promise<LicksHost>): Licks;
 export { LICK_STATE_KIND };

package/dist/types/mcp/content.d.ts

@@ -13,7 +13,7 @@ export interface Truncation {
 }
 export declare function formatSize(bytes: number): string;
 export declare function truncateMiddle(content: string, maxBytes: number): Truncation;
-export declare function limitContent(content: Content[], save: Saver): Promise<{
+export declare function limitContent(raw: Content[], save: Saver): Promise<{
     content: Content[];
     fullOutputPath?: string;
 }>;

package/dist/types/remote/host.d.ts

@@ -1,7 +1,10 @@
-import type { Context } from '@earendil-works/chord';
+import type { Context, ReplicatedState } from '@earendil-works/chord';
 import { type AgentEvent, type Conversation, type EntryRecord, type Harness, type SnapshotEvent, type SubmissionId } from '@earendil-works/pi-durable';
+import { type VaultState } from '../secrets/vault.ts';
 import type { Delivered, SendMode, SendRequest, SendResponse } from '../services.ts';
 import { Mapper, type RemoteEvent } from './events.ts';
+export declare const VAULT_BACK = "the vault is answering again";
+export declare function vaultNotices(vault: ReplicatedState<VaultState> | undefined, push: (events: RemoteEvent[]) => void): () => void;
 export declare const MAX_QUEUED = 10000;
 export declare const IDLE_MS = 120000;
 export type RemoteOpened = {
@@ -41,6 +44,7 @@ export interface RemoteHost {
     harness: Harness;
     conversation(agentId: string | null, context: Context): Promise<Conversation>;
     send(request: SendRequest, context: Context): Promise<SendResponse>;
+    vault?: ReplicatedState<VaultState>;
     now?: () => number;
     limit?: number;
     sweepMs?: number;

package/dist/types/secrets/extension.d.ts

@@ -0,0 +1,31 @@
+import type { Context, JsonValue } from '@earendil-works/chord';
+import { type AgentChange, type Extension, type Harness, type Storage, type ToolExecutionResult } from '@earendil-works/pi-durable';
+import type { Names, SecretName } from './names.ts';
+import type { Scrub } from './scrub.ts';
+import type { Vault } from './vault.ts';
+import { listedLine, SECRETS_KIND } from './view.ts';
+export { listedLine, SECRETS_KIND };
+export declare const SECRETS = "slicc-secrets";
+export declare const SECRETS_COMMAND = "/secrets";
+export declare const SHELL_GRANTS: readonly ['fnox', 'exec', '--shell-grants', '--'];
+export declare const MODEL_LINE = "Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.";
+export declare function scrubResult(result: ToolExecutionResult, scrub: Pick<Scrub, 'texts'>): Promise<ToolExecutionResult | undefined>;
+export declare function renderSecrets(names: readonly SecretName[]): string | undefined;
+export declare function secretsEntry(names: readonly SecretName[]): {
+    kind: string;
+    data: {
+        names: JsonValue;
+    };
+    model: {
+        role: 'user';
+        content: string;
+        timestamp: number;
+    }[];
+};
+export declare function shellGrants(names: Pick<Names, 'state'>): (argv: readonly string[]) => readonly string[];
+export declare function pinned<T extends AgentChange>(change: T): T;
+export declare function repin(harness: Pick<Harness, 'conversation'>, storage: Pick<Storage, 'scanConversations'>, context: Context): Promise<number>;
+export declare function secretsExtension(deps: {
+    names: Pick<Names, 'state'>;
+    vault: Pick<Vault, 'ready' | 'texts'>;
+}): Extension;

package/dist/types/secrets/names.d.ts

@@ -0,0 +1,24 @@
+import { type Context, type MutableReplicatedState } from '@earendil-works/chord';
+import type { ExecutionEnv } from '@earendil-works/pi-durable/env';
+import type { Vault } from './vault.ts';
+export interface SecretRule {
+    domain: string;
+    header?: string;
+    methods?: string[];
+    paths?: string[];
+}
+export interface SecretName {
+    name: string;
+    placeholder: string;
+    exec: false | 'any' | 'argv' | 'shell';
+    rules: SecretRule[];
+}
+export declare const LIST = "secret list --json";
+export declare function parseNames(text: string): SecretName[];
+export declare function listNames(env: ExecutionEnv, context: Context): Promise<SecretName[]>;
+export interface Names {
+    readonly state: MutableReplicatedState<SecretName[]>;
+    refresh(context: Context): Promise<void>;
+    close(): void;
+}
+export declare function secretNames(env: ExecutionEnv, vault: Pick<Vault, 'state'>): Names;

package/dist/types/secrets/scrub.d.ts

@@ -0,0 +1,21 @@
+export type Scrubbable = string | Uint8Array;
+export interface ScrubStream {
+    push(chunk: Uint8Array): Promise<Uint8Array>;
+    end(): Promise<Uint8Array>;
+    drop(): void;
+}
+export interface Scrub {
+    texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]>;
+    stream(): ScrubStream;
+}
+export declare const IDENTITY: Scrub;
+export declare function scrubWith(next: Scrub): void;
+export declare function scrubTexts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]>;
+export declare function scrubText(text: string): Promise<string>;
+export declare function scrubItems<T extends {
+    type: string;
+    text?: string;
+}>(items: readonly T[]): Promise<T[]>;
+export declare function scrubbedOutput(api: {
+    output(text: string): unknown;
+}, text: string): Promise<boolean>;

package/dist/types/secrets/vault.d.ts

@@ -0,0 +1,30 @@
+import { type MutableReplicatedState } from '@earendil-works/chord';
+import type { Scrub, Scrubbable, ScrubStream } from './scrub.ts';
+export type ScrubPair = {
+    needed: boolean;
+    version: number;
+};
+export type Locked = 'no' | 'scrubbing' | 'passkey';
+export interface VaultState {
+    port: 'none' | 'ready' | 'waiting';
+    needed: boolean;
+    version: number;
+    locked: Locked;
+    held: number;
+}
+export declare const WAITING_MS = 2000;
+export declare const WAITING = "waiting for the vault";
+export declare class Vault implements Scrub {
+    #private;
+    readonly state: MutableReplicatedState<VaultState>;
+    constructor(now?: () => number);
+    get needed(): boolean;
+    connect(port: MessagePort | undefined, scrub: unknown): void;
+    ready(): Promise<void>;
+    texts<T extends Scrubbable>(texts: readonly T[]): Promise<T[]>;
+    stream(): ScrubStream;
+}
+export declare function holdText(state: VaultState): string | undefined;
+export declare function listenVault(scope: {
+    addEventListener(type: 'message', listener: (event: MessageEvent) => void): void;
+}, vault: Vault): void;

package/dist/types/secrets/view.d.ts

@@ -0,0 +1,9 @@
+import type { SecretName } from './names.ts';
+import type { VaultState } from './vault.ts';
+export declare const SECRETS_KIND = "slicc.secrets";
+export interface VaultHold {
+    reason: 'waiting' | 'locked';
+    held: number;
+}
+export declare function vaultHold(state: VaultState | undefined): VaultHold | null;
+export declare function listedLine(names: readonly SecretName[]): string;

package/dist/types/services.d.ts

@@ -5,6 +5,7 @@ import type { FrozenCone } from './freezer/index.ts';
 import type { MemoryEntry, MemoryScope, MemoryTag } from './memory/format.ts';
 import type { AgentRemote } from './remote/host.ts';
 import type { AgentPages } from './remote/pages.ts';
+import type { VaultState } from './secrets/vault.ts';
 import type { Sprinkle } from './sprinkles/kind.ts';
 export type SendMode = 'steer' | 'followUp' | 'reject';
 export interface SendRequest {
@@ -222,11 +223,12 @@ export interface AgentTranscript {
     readonly frozen: ReplicatedState<FrozenCone[]>;
     readonly changes: ReplicatedState<ChangesView>;
     readonly monitor: ReplicatedState<MonitorFeed>;
+    readonly vault: ReplicatedState<VaultState>;
 }
 export interface Command {
     name: string;
     description: string;
-    kind: 'prompt' | 'skill';
+    kind: 'prompt' | 'skill' | 'action';
 }
 export declare const AgentTranscript: import("@earendil-works/chord").Service<AgentTranscript>;
 export interface AgentSessions {

package/dist/types/skills/index.d.ts

@@ -41,5 +41,6 @@ export declare function problemLick(problem: Diagnostic, home: string): {
     severity: 'warn';
     eventId: string;
 };
+export declare const SECRETS_ACTION: Command;
 export declare function commandsOf(skills: readonly Skill[], templates: readonly PromptTemplate[]): Command[];
 export declare function setupSkills(registry: Registry, licks: Licks): SkillsSetup;

package/dist/types/spectrum/agent-port.d.ts

@@ -1,11 +1,19 @@
 import type { Agent, AgentEvents, AgentPort, FrozenCone, Message, Outgoing, SlashCommand, Thinking, UserMessage } from '@ai-ecoverse/slicc-spectrum/ui';
 import type { AgentConnection } from '../client.ts';
+import { type VaultHold } from '../secrets/view.ts';
+import type { Command } from '../services.ts';
 import { Emitter } from './emitter.ts';
 export declare const CONE = "cone";
-export declare class AgentAdapter extends Emitter<AgentEvents> implements AgentPort {
+export declare function slashCommand({ kind, ...command }: Command): SlashCommand;
+export type AgentHold = VaultHold;
+export type AgentAdapterEvents = AgentEvents & {
+    hold: AgentHold | null;
+};
+export declare class AgentAdapter extends Emitter<AgentAdapterEvents> implements AgentPort {
     #private;
     constructor(connection: AgentConnection);
     ready(): Promise<void>;
+    hold(): AgentHold | null;
     list(): readonly Agent[];
     active(): string;
     select(id: string): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "3.43.1",
+  "version": "3.45.0",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -62,8 +62,8 @@
   },
   "devDependencies": {
     "@ai-ecoverse/slicc-kernel": "1.47.1",
-    "@ai-ecoverse/slicc-shared-web": "1.13.0",
-    "@ai-ecoverse/slicc-spectrum": "1.60.2",
+    "@ai-ecoverse/slicc-shared-web": "1.13.1",
+    "@ai-ecoverse/slicc-spectrum": "1.62.0",
     "@ai-ecoverse/wasm-bash": "5.3.0-17",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-5",
     "@ai-ecoverse/wasm-git": "2.55.0-15",