@ai-ecoverse/slicc-jerk 0.3.0 → 0.4.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +19 -1
- package/bin/jerk.wasm +0 -0
- package/package.json +7 -7
package/README.md
CHANGED
|
@@ -4,7 +4,7 @@ Get, list, create and drop OAuth tokens across operating systems and inside SLIC
|
|
|
4
4
|
|
|
5
5
|
`jerk` (as in an ice-cream jerk) asks `gh`, `npm`, `wrangler`, `aio` and friends for their tokens, so that adding a provider is configuration, not code. It feeds [fnox](https://fnox.jdx.dev) as a `command` lease backend on a real machine. Inside seven, tokens go to the vault's sealed store, and programs only ever see placeholders.
|
|
6
6
|
|
|
7
|
-
**Status:** being built. `jerk list`, `jerk config`, and `get`, `list`, `create` and `drop` for providers backed by a CLI (gh, npm, wrangler, aio) work
|
|
7
|
+
**Status:** being built. `jerk list`, `jerk config`, and `get`, `list`, `create` and `drop` for providers backed by a CLI (gh, npm, wrangler, aio) work, and so do `lease`, `drop --lease`, `sync` and `config fnox`. OAuth providers and `intercept` print `not implemented yet` and exit 5 until they land.
|
|
8
8
|
|
|
9
9
|
`jerk <provider> get` prints the token only to a terminal, or with `--reveal`. To a pipe it prints a masked form such as `gho_…1234`. A token already in the provider's first `env` variable (`GH_TOKEN`, …) wins over the CLI, as gh does. `--scope` checks the granted scopes, with GitHub's implied scopes understood, and exits 3 when they don't cover it. jerk never signs in by itself: `get` exits 3, and `get --login` on a terminal runs `create` first. The provider's CLI runs without the provider's own token variables in its environment.
|
|
10
10
|
|
|
@@ -58,6 +58,24 @@ drop = { run = ["gh", "auth", "logout", "--hostname", "{host}", "--user", "{id}"
|
|
|
58
58
|
|
|
59
59
|
Commands are argument lists, never shell strings. `{name}` placeholders come from `params` or from `scope`, `id`, `name`, `expires` and `user`. `jerk config check` validates every layer, `jerk config show <provider>` prints the provider that wins, and `jerk config path` shows where each layer lives.
|
|
60
60
|
|
|
61
|
+
## fnox
|
|
62
|
+
|
|
63
|
+
jerk feeds [fnox](https://fnox.jdx.dev) as a `command` lease backend. `jerk config fnox [--proxy] [<provider>...]` prints the stanzas to paste into `~/.config/fnox/config.toml`:
|
|
64
|
+
|
|
65
|
+
```toml
|
|
66
|
+
[leases.github]
|
|
67
|
+
type = "command"
|
|
68
|
+
create_command = "jerk github lease"
|
|
69
|
+
revoke_command = "jerk github drop --lease"
|
|
70
|
+
duration = "1h"
|
|
71
|
+
```
|
|
72
|
+
|
|
73
|
+
- **`jerk <provider> lease`** prints fnox's lease JSON: every `env` name mapped to the token, an `expires_at` that is the earlier of the token's real expiry and now + `FNOX_LEASE_DURATION`, and a `lease_id`. It refuses to run on a terminal.
|
|
74
|
+
- **`lease_via = "create"`** mints a fresh token per lease.
|
|
75
|
+
- **`jerk <provider> drop --lease`** reads `FNOX_LEASE_ID`. It revokes upstream only a token jerk minted for that lease. A token jerk only read is left to expire.
|
|
76
|
+
- **`--proxy`** adds `[[proxy.rules]]` for the provider's domains. They need a fnox build that lets proxy rules read lease credentials (F2, carried on ai-ecoverse/fnox).
|
|
77
|
+
- **Until then, `jerk <provider> sync --fnox <SECRET> --provider <fnox provider> [--global]`** pipes the token into `fnox set` on stdin. It only writes to providers that encrypt or use an OS store (age, keychain, 1password, bitwarden, fido2, yubikey and the cloud KMSes), never `plain`.
|
|
78
|
+
|
|
61
79
|
## Install
|
|
62
80
|
|
|
63
81
|
- **npm:** `npm install -g @ai-ecoverse/slicc-jerk`. The package is a small Node launcher; npm picks one of the platform packages `@ai-ecoverse/slicc-jerk-<os>-<arch>` (darwin, linux, win32; arm64, x64). The same package carries `bin/jerk.wasm` for seven's kernel.
|
package/bin/jerk.wasm
CHANGED
|
Binary file
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@ai-ecoverse/slicc-jerk",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.4.0",
|
|
4
4
|
"description": "Get, list, create and drop OAuth tokens across operating systems and inside SLICC, by dispatching to each provider's own CLI",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -27,11 +27,11 @@
|
|
|
27
27
|
}
|
|
28
28
|
},
|
|
29
29
|
"optionalDependencies": {
|
|
30
|
-
"@ai-ecoverse/slicc-jerk-darwin-arm64": "0.
|
|
31
|
-
"@ai-ecoverse/slicc-jerk-darwin-x64": "0.
|
|
32
|
-
"@ai-ecoverse/slicc-jerk-linux-arm64": "0.
|
|
33
|
-
"@ai-ecoverse/slicc-jerk-linux-x64": "0.
|
|
34
|
-
"@ai-ecoverse/slicc-jerk-win32-arm64": "0.
|
|
35
|
-
"@ai-ecoverse/slicc-jerk-win32-x64": "0.
|
|
30
|
+
"@ai-ecoverse/slicc-jerk-darwin-arm64": "0.4.0",
|
|
31
|
+
"@ai-ecoverse/slicc-jerk-darwin-x64": "0.4.0",
|
|
32
|
+
"@ai-ecoverse/slicc-jerk-linux-arm64": "0.4.0",
|
|
33
|
+
"@ai-ecoverse/slicc-jerk-linux-x64": "0.4.0",
|
|
34
|
+
"@ai-ecoverse/slicc-jerk-win32-arm64": "0.4.0",
|
|
35
|
+
"@ai-ecoverse/slicc-jerk-win32-x64": "0.4.0"
|
|
36
36
|
}
|
|
37
37
|
}
|