@ai-ecoverse/slicc-agent 6.11.1 → 6.11.2

package/dist/types/secrets/extension.d.ts

@@ -1,20 +1,23 @@
 import type { JsonValue } from '@earendil-works/chord';
 import { type Extension, type ToolExecutionResult } from '@earendil-works/pi-durable';
-import type { Names, SecretName } from './names.ts';
+import type { Names, SecretListing } from './names.ts';
 import type { Scrub } from './scrub.ts';
 import type { Vault } from './vault.ts';
-import { listedLine, SECRETS_KIND } from './view.ts';
-export { listedLine, SECRETS_KIND };
+import { exposedLine, listedLine, SECRETS_KIND, unavailableLine } from './view.ts';
+export { exposedLine, listedLine, SECRETS_KIND, unavailableLine };
 export declare const SECRETS = "slicc-secrets";
 export declare const SECRETS_COMMAND = "/secrets";
 export declare const SHELL_GRANTS: readonly ['fnox', 'exec', '--shell-grants', '--'];
-export declare const MODEL_LINE = "Credentials are env vars (`$NAME`) holding placeholders; `secret list` shows them and where each works. The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.";
+export declare const MODEL_LINE = "Credentials are env vars (`$NAME`) holding placeholders, listed below with where each works (`fnox list` shows the fnox config). The vault fills in the real value only in the listed header, for the listed domain, method and path, over HTTPS (curl, git, fetch). Adding a rule means editing `/etc/fnox/config.toml` with sudo, which the user approves. `fnox exec` gives real values only for secrets the user enabled for exec, and the secrets listed as 'in every bash' already hold real values in your commands. Everything is logged, and stored values are replaced by their placeholder in everything you see; edit around placeholders, since files show them too. Never ask the user to paste a credential into the chat.";
 export declare function scrubResult(result: ToolExecutionResult, scrub: Pick<Scrub, 'texts'>): Promise<ToolExecutionResult | undefined>;
-export declare function renderSecrets(names: readonly SecretName[]): string | undefined;
-export declare function secretsEntry(names: readonly SecretName[]): {
+export declare const NO_SECRETS = "No secrets are configured: the fnox config has no keys and the vault no sealed secrets.";
+export declare function renderSecrets(listing: SecretListing): string;
+export declare function secretsEntry(listing: SecretListing): {
     kind: string;
     data: {
         names: JsonValue;
+        error: string | null;
+        exposed: string[];
     };
     model: {
         role: 'user';
@@ -22,6 +25,7 @@ export declare function secretsEntry(names: readonly SecretName[]): {
         timestamp: number;
     }[];
 };
+export declare function granting(listing: SecretListing): boolean;
 export declare function shellGrants(names: Pick<Names, 'state'>): (argv: readonly string[]) => readonly string[];
 export declare function secretsExtension(deps: {
     names: Pick<Names, 'state'>;

package/dist/types/secrets/names.d.ts

@@ -6,19 +6,47 @@ export interface SecretRule {
     header?: string;
     methods?: string[];
     paths?: string[];
+    proposed?: true;
 }
 export interface SecretName {
     name: string;
-    placeholder: string;
+    placeholder: string | null;
     exec: false | 'any' | 'argv' | 'shell';
     rules: SecretRule[];
+    fnox: boolean;
 }
-export declare const LIST = "secret list --json";
-export declare function parseNames(text: string): SecretName[];
-export declare function listNames(env: ExecutionEnv, context: Context): Promise<SecretName[]>;
+export interface SecretListing {
+    names: SecretName[];
+    error: string | null;
+    exposed: string[];
+}
+export declare const DESCRIBE = "fnox env --json --describe";
+export declare const RULES = "fnox proxy rules --json";
+export declare const SEALED_LIST = "exec 3<>/dev/sealed && printf '%s' '{\"v\":1,\"op\":\"list\"}' >&3 && cat <&3";
+export declare const NO_PROXY = "No [proxy] configuration found";
+export declare const MISSING = "fnox isn't installed";
+export declare const EXPOSED = "shell grants are off: fnox exec would also give every command the unsealed fnox secrets";
+export declare function guarded(command: string): string;
+export declare class Unavailable extends Error {
+    readonly detail: string | undefined;
+    constructor(shown: string, detail?: string);
+}
+export interface FnoxKey {
+    name: string;
+    injected: boolean;
+}
+export declare function parseDescribe(text: string): FnoxKey[];
+export declare function parseRules(text: string): Map<string, SecretRule[]>;
+export declare function parseSealed(text: string): Omit<SecretName, 'fnox'>[];
+export declare function joinNames(keys: readonly FnoxKey[], proposed: ReadonlyMap<string, SecretRule[]>, sealed: readonly Omit<SecretName, 'fnox'>[]): SecretListing;
+export interface Listed {
+    listing: SecretListing;
+    details: string[];
+}
+export declare function listNames(env: ExecutionEnv, context: Context): Promise<Listed>;
 export interface Names {
-    readonly state: MutableReplicatedState<SecretName[]>;
+    readonly state: MutableReplicatedState<SecretListing>;
     refresh(context: Context): Promise<void>;
     close(): void;
 }
-export declare function secretNames(env: ExecutionEnv, vault: Pick<Vault, 'state'>): Names;
+export declare function secretNames(env: ExecutionEnv, vault: Pick<Vault, 'state' | 'texts'>, warn?: (message: string) => void): Names;

package/dist/types/secrets/view.d.ts

@@ -1,4 +1,4 @@
-import type { SecretName } from './names.ts';
+import type { SecretListing } from './names.ts';
 import type { VaultState } from './vault.ts';
 export declare const SECRETS_KIND = "slicc.secrets";
 export interface VaultHold {
@@ -6,4 +6,9 @@ export interface VaultHold {
     held: number;
 }
 export declare function vaultHold(state: VaultState | undefined): VaultHold | null;
-export declare function listedLine(names: readonly SecretName[]): string;
+export declare function unavailableLine(reason: string): string;
+export declare function exposedLine(exposed: readonly string[]): string;
+export declare function listedLine(listing: Pick<SecretListing, 'names'> & {
+    error?: string | null;
+    exposed?: string[];
+}): string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/slicc-agent",
-  "version": "6.11.1",
+  "version": "6.11.2",
   "description": "SLICC's agent core on pi durable: an agent worker, session storage, remoting and pi extensions",
   "type": "module",
   "license": "Apache-2.0",
@@ -69,6 +69,7 @@
     "@ai-ecoverse/slicc-scrub": "1.0.0",
     "@ai-ecoverse/slicc-shared-web": "1.24.2",
     "@ai-ecoverse/slicc-spectrum": "1.94.0",
+    "@ai-ecoverse/wasi-fnox": "1.39.0-5",
     "@ai-ecoverse/wasm-bash": "5.3.0-20",
     "@ai-ecoverse/wasm-coreutils": "9.12.0-10",
     "@ai-ecoverse/wasm-git": "2.55.0-17",