@ai-ecoverse/slicc-spectrum 2.0.3 → 2.2.0

package/README.md

@@ -307,6 +307,7 @@ When a live agent's model, or `Settings.model`, is no longer offered and its pro
 The chat re-runs this on `follow` and `readOnly` too, and `<slicc-app>` does it as well, when it binds, on those events and on `follow` and `readOnly`, so a new cone that starts on a provider that isn't set up moves at once.
 The transcript pads its end, and its `scroll-padding-block-end`, by the composer's measured height plus the height its frosted layer fades out over (`--composer-fade`, 72 px, 0 under `prefers-reduced-transparency` and `forced-colors` and without a composer), so at the bottom the last line sits a line above the glass, and a focused element scrolls clear of it.
 The log follows new content only while it sits within one line (its `line-height`) of the bottom. Scrolling up by wheel, touch, keys or the scrollbar stops that, and the log then keeps its place, whatever re-renders or ticks; content that grows above the view, such as a tool card opening, doesn't move what's in view either. New output while the reader is scrolled up shows **Jump to latest** (`data-action="jump-latest"`), floating over the log's bottom edge above the composer, with the number of new items, "Jump to latest (2 new)", once there are any; it, or scrolling back to the bottom, resumes following, and so does the reader's own send. While it follows, a log that gets shorter (a notice above it, a taller composer, a shorter panel) or a latest card that grows (a lick opened, a sprinkle loading) doesn't scroll that card's top out of view: a card that fits shows whole, and a taller one keeps its top at the top of the log, with the rest under the composer, instead of its end above the composer's padding; a new item, a streaming reply and Jump to latest still go to the very bottom.
+With the agent port's optional `hasOlder(agentId)`, the log pages back through the conversation: while it is less than a screen from its top (which includes a log that doesn't fill the view) and `hasOlder` is true, it calls `older(agentId, id)` with the id of the first message in `messages()`, one load at a time per agent, and renders the earlier messages from `messages()` by id once the port emits `messages`, never from what `older` resolves with. The first turn in view keeps its place: its offset is measured before the render and put back before the next paint (scroll anchoring does nothing at the very top), and the log's follow bookkeeping moves with it, so the jump never reads as the reader scrolling. It loads until the log is more than a screen above the view or the start is reached; an empty answer, or one that leaves the first message as it was, is the start, and the chat doesn't ask again for that agent until its first message changes or it is shown again. While there is more, the top of the log reads "Loading earlier messages…" (`[data-older=loading]`, `aria-busy` while a load runs), and at the start it shows nothing; a rejected `older` shows "Couldn’t load earlier messages." with **Retry** (`[data-older=failed]`, `role="alert"`, `data-action="retry-older"`) instead of trying again. A load that ends after another agent is shown touches only its own conversation. Without `hasOlder` (an older agent), it never calls `older`.
 While a reply streams, its status icon follows what it is doing: a pencil for an edit, a page for a read, a magnifier for a search, an eye for the browser and an hourglass for any other tool; thinking and text keep the AI logo.
 Between the header and the transcript, a `<slicc-notices>` shows the model's notices.
 On a follower without Control, or while the agent port's `readOnly()` returns a line, a note (`p[data-follow="watch"]`, that line first, else the follow-based one) takes the composer's place, the header shows the model's name instead of the pickers and New conversation, and there's no suggested follow-up.
@@ -334,6 +335,11 @@ Sudo and guest requests show the verdict under the command, in a live region (`.
 Focus starts on Deny (on Close once `decide` rejects) and goes back, after Deny, Always allow, Allow once, <kbd>Esc</kbd> or Close, to what had it when the dialog opened; inside a terminal, to that `<slicc-terminal>` through its own `focus()`, even when it remounted meanwhile.
 Guest requests (`guest-message`, `guest-tool`) get their own copy, the guest's text as plain text (`[data-guest-text]`), attachments (`[data-attachments]`), the automatic check's verdict (`[data-verdict]`), and Deny and Allow once, plus **Always allow** (`data-action="always"`) with a hint saying what it covers when the approval's `always` is `true`; the dialog body carries `[data-approval-kind]` and fills the dialog's width at every size.
 Tray requests (`tray`) get their own title and one sentence (`#asking`), and only **Deny** (`deny`, focused) and **Allow once** (`once`), never Always allow.
+Secret requests (`secret`, `dialog[data-kind=secret]`) read "Enter a value for {name}?" (`mode: 'enter'`) or "Reveal {name} to a program?" (`reveal`). Under the title comes the trusted block, which only bios and the kernel fill: "{name} ran this[ in {where}]:" for an agent or "You ran this[ in {where}] (as {name}):" for a user, then the command (`[data-command]`), which is `process.exe` followed by `argv[1…]`, each word shell-quoted (`argv[0]` is the program's own choice), then "In {cwd}". The command follows sudo's rules: the same scrolling box, the same control-character chips, and the same end-in-view rule. Then the untrusted `prompt`, if any, in its own block (`[data-prompt]`) under "From the agent, not checked by SLICC:", with control characters as chips and cut at 200 characters. With `reveal`, a negative block (`[data-reveal]`) says "{exe} gets the plaintext. It can send it anywhere.", and adds "The agent asked for this." when `requester.kind` is `agent`.
+The body is the vault's own frame (`[data-value-frame]`, a `<slicc-vault-value>` on `vault.valueFrame(id)`). The value is typed and Save or Allow clicked there, so spectrum never sees the value and can't fake the consent. The frame is `inert` until the end of the command has been in view, and "Scroll to the end of the command to answer it." (`[data-allow-hint]`) shows while it isn't. Without `vault.valueFrame`, "The vault isn’t available here, so this request can only be denied." (`[data-id="no-frame"]`) stands in its place.
+The title shows control characters in the name as chips, and so does the notice. The only button is **Deny** (`deny`, focused). The element's `decide()` takes only `deny` for a secret, and only while that request is the one showing: not once it was denied, answered in its frame, closed, or ended (timed out, answered elsewhere, withdrawn). A late `escape` from the frame does nothing either.
+When a listed request is replaced (the same `id` with another `createdAt`, command, mode, name, `reveal`, prompt or requester), or an `id` comes back after it left `list()`, the dialog counts it as a new request: a new frame, the end of its command unseen again, and the half-second guard again. Escape on the dialog denies, and so does the frame's `escape` event, posted when Escape is pressed inside the frame. The frame's `done` for this request closes the dialog and moves on to the next request, with no "answered" dialog. The frame's `gone` shows "Secret request timed out" (`expired`) or "Answered elsewhere", or closes silently (`withdrawn`), except for a request this tab denied or answered. The frame's `error` shows its message under the frame (`[data-frame-error]`). A secret request that leaves `list()` without `ended` before `expiresAt` closes silently, because the frame's `done` and the list change can arrive in either order. Focus then goes back as for sudo, to the `<slicc-terminal>` that had it.
+`approvalKinds` (from `/ui`) is a frozen array of the kinds this build shows (`sudo`, `guest-message`, `guest-tool`, `tray`, `secret`), so an embedder can hold back the kinds an older UI would leave waiting unseen.
 
 #### `<slicc-follow>`
 
@@ -479,7 +485,7 @@ The secrets, sorted by name (`li[data-secret][data-state]`, with `[data-rules]`,
 Locked, every form (Add secret, Replace value, Import, Export) says "Unlock the vault first" (`p[data-locked]`) next to the vault's own small **Unlock** button (`slicc-vault-button[data-action=unlock]`) and disables its submit; once unlocked, the form stays open with what was typed and its submit enables.
 Vault errors show their message, EACCES as "Unlock the vault first", an EACCES with `cause: 'policy-paused'` as "Secrets are paused until the missing policy file is back", and ENOTSUP as "This arrives with a later vault version".
 Each action shows only when the port has its method.
-Then **Rules SLICC refused** (`[data-refused]`), where the rules live (`[data-policy]`) and **Activity** (`ol.audit li[data-seq][data-type]`; an entry with `uid` and `tag` both `null` reads "by you", a `refresh` entry "Refreshed automatically" (with the sign-in it used), an `endpoints` entry (vault-originated, no "by …") one part per field it carries: (1.91.0's `EndpointsEntry` had a required `purged` with `url`; no vault wrote it before 1.13.0, so the shape was corrected rather than kept, with `purged` optional and `host` replacing `url`) `purged` "Removed custom model URLs an agent set, automatically: {provider name} at {host}, …. Only you can set a model URL now, in Settings › Accounts" (the provider's name from `settings.accounts()`, else its id), `adopted` "Kept the MCP servers your tokens use, automatically: {server} at {host}, …", `pinned` "{name} pinned to {host} automatically, on first use" with **Unpin** (`data-action=unpin`, calling the vault port's optional `unpin([name])`; disabled while the vault is locked; a failure shows in the row as `[data-error=unpin]`, in the same words as other vault failures; it's hidden once a newer `unpinned` entry for that name is in the log), and `unpinned` "{name} unpinned from {host}; the next use pins it again", an `mcp` entry "Sent to the MCP server SERVER at DOMAIN" with its request and exit, a `session` entry (a value the vault handed the kernel for a verified TLS session, vault 1.15.0) "Sent over {HTTP/1.1, SMTP or Postgres} to {domain}:{port}, {trusted by public roots, or trusted by its pinned anchor}, through {exit}" (no trust part when an older entry has no `verifiedBy` or a newer vault sends one spectrum doesn't know; a protocol it doesn't know reads as its raw name), and a policy entry lists its changes, its warning and, when accepted, how to change the file back, except that an entry with `absent` reads "{file} was removed. Secrets are paused until it’s back." and the accepted entry that ends its pause reads "{file} is back. Secrets are running again." ("Secrets stay paused until the other file is back." while the other file is still missing), neither with the way back; **Only reveals to programs**, `data-action="reveals"`, and **Show older**, `data-action="older"`).
+Then **Rules SLICC refused** (`[data-refused]`), where the rules live (`[data-policy]`) and **Activity** (`ol.audit li[data-seq][data-type]`; an entry with `uid` and `tag` both `null` reads "by you", a `refresh` entry "Refreshed automatically" (with the sign-in it used), an `endpoints` entry (vault-originated, no "by …") one part per field it carries: (1.91.0's `EndpointsEntry` had a required `purged` with `url`; no vault wrote it before 1.13.0, so the shape was corrected rather than kept, with `purged` optional and `host` replacing `url`) `purged` "Removed custom model URLs an agent set, automatically: {provider name} at {host}, …. Only you can set a model URL now, in Settings › Accounts" (the provider's name from `settings.accounts()`, else its id), `adopted` "Kept the MCP servers your tokens use, automatically: {server} at {host}, …", `pinned` "{name} pinned to {host} automatically, on first use" with **Unpin** (`data-action=unpin`, calling the vault port's optional `unpin([name])`; disabled while the vault is locked; a failure shows in the row as `[data-error=unpin]`, in the same words as other vault failures; it's hidden once a newer `unpinned` entry for that name is in the log), and `unpinned` "{name} unpinned from {host}; the next use pins it again", an `mcp` entry "Sent to the MCP server SERVER at DOMAIN" with its request and exit, a `reveal` entry (vault 1.23.0, a secret ask whose plaintext the user allowed) "Revealed to {argv} in {cwd}, allowed in a dialog", (the argv, cwd and "by …" of `materialize` and `reveal` entries, and of a secret's "Revealed to programs…, last by … with {argv}" line, show control characters as chips, as the approval dialog does), which counts as a reveal for **Only reveals to programs** and for the secret's "Revealed to programs…" line, a policy change of `[reveal] agent` "Programs an agent runs may no longer ask for a secret’s plaintext" (or "…may ask for a secret’s plaintext again, in a dialog each time"), a `session` entry (a value the vault handed the kernel for a verified TLS session, vault 1.15.0) "Sent over {HTTP/1.1, SMTP or Postgres} to {domain}:{port}, {trusted by public roots, or trusted by its pinned anchor}, through {exit}" (no trust part when an older entry has no `verifiedBy` or a newer vault sends one spectrum doesn't know; a protocol it doesn't know reads as its raw name), and a policy entry lists its changes, its warning and, when accepted, how to change the file back, except that an entry with `absent` reads "{file} was removed. Secrets are paused until it’s back." and the accepted entry that ends its pause reads "{file} is back. Secrets are running again." ("Secrets stay paused until the other file is back." while the other file is still missing), neither with the way back; **Only reveals to programs**, `data-action="reveals"`, and **Show older**, `data-action="older"`).
 The section's `data-vault` is `locked`, `unlocked` or `loading`.
 A popup the browser blocked shows how to allow it (`[data-popup=blocked]`).
 Widened-rule notices aren't shown.
@@ -489,8 +495,14 @@ An open **Removed** list (`details[data-removed]`) stays open across a layout sw
 
 Places `vault.button()`'s element (the vault's own button frame), posts its `config` (`ButtonConfig` plus `theme`) once the button is `ready`, sets the frame's `color-scheme` to `theme` (or leaves it to the page) so the frame stays transparent, takes the reported `size` (with the focus-ring `inset` as negative margin) and `label` (as its title), moves focus to the control before or after it when the frame reports `focus` (`previous` or `next`), and fires `vault-popup` (bubbles, composed) with each `popup` event's `{ intent, state }`. spectrum sends only the `unlock` and `protect` intents.
 
+#### `<slicc-vault-value>`
+
+Places `vault.valueFrame(request)`'s element (the vault's `value.html` frame) and, once the frame is `ready`, posts `{ type: 'slicc-vault', v: 1, op: 'value', request, config }`, where `config` is a `ValueConfig` (`theme`, `dir`, `lang`, `scale`). It posts again when `config` changes, and mounts a new frame when `vault` or `request` changes. It sets the frame's `color-scheme` to `theme`. From `size` it takes the height, at most 480 px (and at most `45dvh`, beyond which the frame scrolls), and makes the frame its own width, with the `inset` (at most 4 px) as a negative margin above and below only, so the dialog never scrolls sideways. A value that isn't a finite number counts as 0. The element clips the frame to its own box (with room above and below for the largest inset it allows, 4 px, for the focus ring), so a frame can't paint over the command above it or the dialog's buttons. On the frame's `focus` event it moves focus to the control after or before the frame (`next` or `previous`), within its `<dialog>` and wrapping around. `focus()` posts `{ op: 'focus' }`, which focuses the frame's first control. It fires `vault-value` (bubbles, composed) with each `done`, `gone`, `error` and `escape` event. The detail holds only `event`, `request`, `state`, `code` and `message` (each when it's a string), so anything else the frame sends goes no further.
+
 #### `<slicc-value-request>`
 
+For the older `value` requests only, until bios stops sending them: `ask` requests show in `<slicc-approvals>` instead.
+
 The vault's waiting `value` requests (`fnox set` on a terminal) as a modal dialog, one at a time, oldest first, with "N more waiting"; `<slicc-app>` mounts it.
 `dialog[data-request]`: "Enter a value for NAME" (a Name field when the request has no name), who asks, as on the Settings card ("docs-pass asks for NAME", or "A program running as uid N asks for NAME"), the prompt under "From the agent, not checked by SLICC:", a masked value field with the same rules as Settings › Secrets, "Expires in N min", and **Later** (`data-action="later"`, or Escape: closes, the request stays in Settings › Secrets, whose **Enter value** reopens it), **Cancel request** (`data-action="cancel-request"`, with `cancel`) and **Save** (`data-action="save"`, `put(name, value, request.id)`, with `put`).
 Locked, it shows the vault's Unlock button and disables Save.
@@ -765,6 +777,7 @@ The optional `toolLabel(agentId, callIds)` resolves with a short label for a run
 Spectrum asks once a reply's status has two calls and again each time it grows, once per set of ids, and shows the label once the status is complete.
 The optional `readOnly()` returns a line, or `null`, with a `readOnly` event when it changes: while it's a non-empty string, such as when this follower runs a different major version from its owner, every surface is watch-only just as a follower without Control is (no composer, no cone or conversation actions, no pickers, no Stop, no Accept or Revert in Changes, inline sprinkles view only, no model settling), and the line takes the place of the follow-based watch-only note under the chat.
 The optional `starting()` returns a line, or `null`, with a `starting` event when it changes: while it's a non-empty string, there's no agent yet but one is on its way (such as while seven installs its first agent, or replaces one), the chat drops its empty state and the composer queues what's sent until an agent is there (see `<slicc-composer>`); without it, or at `null`, nothing changes.
+The optional `hasOlder(agentId)` says whether `older(agentId, before)` can load messages before the first one in `messages()`; `older` resolves once at least one earlier message has arrived in `messages()`, emitting `messages`, or with `[]` at the start, and the chat pages back with them (see `<slicc-chat>`).
 
 #### `files`
 
@@ -965,6 +978,9 @@ It has no `always`: the dialog never offers Always allow for it, even when the i
 Its dialog reads "Share this seven’s join URL?" with "{name} wants this seven’s join URL. Anyone with it can ask to link to this seven.", "Make a new join URL?" with "{name} wants a new join URL. Linked devices move to it, and the old one stops working.", or "Unlink {device.name}?" with "{name} wants to unlink {device.name} from this seven." ("Unlink a device?" and "…unlink a device from this seven." without `device`), then the countdown, **Deny** and **Allow once**.
 Ended tray requests read "Answered in another tab" or "Tray request timed out", and a withdrawn one closes silently.
 Without `decide`, its notice reads "Waiting for tray approval" with the same sentence, then "It waits for the owner's approval. Denied automatically at {time}."
+A secret request (`kind` `secret`, a `SecretApproval`) is a program asking for a secret through `/dev/sealed`. Its fields are `mode` (`enter` when there is no live secret of that name, `reveal` when there is), `name`, an optional `prompt` (the program's own words, ≤ 200 characters, untrusted), `reveal` (the process gets the plaintext back too), `requester` (`kind` `agent` or `user`, `name`, optional `where`), `process` (`exe`, the resolved program file; `argv`; `cwd`, all from the kernel), `createdAt` and `expiresAt`.
+`decide(id, 'deny')` cancels it in the vault, and the UI never sends `once` or `always` for it: the answer is given in the vault's frame. Send `ended` (`answered`, `expired` or `withdrawn`) only for a request that ended outside this tab: not for one this tab denied, and not for one whose frame in this tab posted `done`.
+Without `decide`, its notice (`[data-approval-kind=secret]`) reads "Waiting for a secret" with "{name} ran {exe}, which asks for a value for {secret}." ("You ran…" for a user, "…the plaintext of {secret}." for `reveal`), then "It waits for the owner's answer. Denied automatically at {time}."
 An approval whose `kind` this build doesn't know shows neither a dialog nor a notice, so it waits until it ends and is never allowed from here.
 
 #### `vault` (optional)
@@ -975,10 +991,12 @@ The vault's view for SLICC, typed after `@ai-ecoverse/slicc-vault` (spectrum re-
 Emit `status` and `list` when they change (bios re-lists after the vault's `changed` events), and `availability` when the optional `availability()` (`connecting`, `waiting`, `locked` or `ready`) changes.
 `audit(before?, limit?)` resolves with an older `AuditPage` (`before` is a `seq`).
 The optional page ops, each hiding its control when missing: `put(name, value, request?)` (a value request's `put` must use its `name`), `cancel(request)`, `remove(name, kind?)`, `restore(name, kind?)`, `import(kind, bytes, { password?, pick? })` (a `pick` stage, then `done`), `export(passphrase)` (the bundle's bytes), `lock()`, `dismissBackupReminder()` and `endpoints({ add?, remove? })`, which registers or takes back the URLs a page-sealed credential may be filled on (each an `EndpointSet`, `{ model?: [{ name, url }], mcp?: [{ server, url }] }`, a model URL bound to one record by name), checks the whole change first (`EINVAL` changes nothing) and rejects with a sentence. Settings registers them itself, never through the agent. `settings(name, kind, settings)` replaces a record's tenant settings as a whole without touching its key (the vault's `put` without a value); `put`'s options take the same `settings` on a first save.
-They reject with a `VaultFailure`, an `Error` with an `ErrorCode` `code` (`isVaultFailure` from `/ui`) and an optional `ErrorCause` `cause`, matching slicc-vault 1.22.0’s stable refusal causes; `isPolicyPaused` still identifies only `policy-paused`.
+They reject with a `VaultFailure`, an `Error` with an `ErrorCode` `code` (`isVaultFailure` from `/ui`) and an optional `ErrorCause` `cause`, matching slicc-vault 1.22.0’s stable refusal causes (checked against the pinned 1.23.0, whose ask types `compat/vault.ts` also checks: `Requester`, `ValueConfig`, `ValueEvent` and, the other way, `ValueMessage`); `isPolicyPaused` still identifies only `policy-paused`.
 Values go to the vault only through `put`, and never through another port.
 `button()` returns a new `VaultButton`, `{ element, post(message), listen(fn) }` returning an unsubscribe: bios wraps the vault's `button.html` frame and its postMessage protocol, and spectrum only sends `ButtonMessage`s and receives `ButtonEvent`s.
 The passkey lock (unlock and protect) happens in the vault's own popup, which only a click in that frame can open.
+The optional `valueFrame(request)` returns a new `VaultValueFrame` for an `ask` request, `{ element, post(message), listen(fn) }` like `button()`. bios wraps the vault's `value.html` frame. spectrum sends only `ValueMessage`s (`op: 'value'` with the request and a `ValueConfig`, and `op: 'focus'`) and receives only `ValueEvent`s (`ready`, `size`, `focus`, `done { request, state: 'sealed' | 'allowed' }`, `gone { request, state }`, `error { code, message }`, `escape`). The value is typed in that frame, and a reveal is allowed only by a click there, so the page never holds the value or the consent.
+An `ask` request in `status.waiting` also carries `mode`, `reveal` and `requester` (`{ kind, name?, where?, exe, argv, cwd, tty, stdin }`). Settings › Secrets lists it with Cancel request only, and `RequestState` includes `withdrawn`.
 `notices`, `acknowledge` and the `notice` event are still typed, and ignored.
 
 #### `guests` (optional)
@@ -1099,6 +1117,7 @@ Import offers five invented candidates (one replaces a secret, one is a model ke
 Its buttons are plain Spectrum buttons that answer at once: Unlock unlocks, and created buttons are in `model.vault.buttons`.
 `vaultFixtures`, `DummyVault` and `DummyVaultButton` are exported from `/dummy`.
 `createDummyModel({ hold: 'waiting' | 'locked' | 'off' })` (`?hold=` on `/ui/`) makes the agent hold two tool results; a `locked` hold clears when the dummy vault unlocks, and `model.agent.setHold(hold)` changes it.
+`createDummyModel({ older: 'paged' })` (`?older=paged` on `/ui/`, off by default) holds back all but the last six messages of every conversation, and the agent's `older` brings them back four at a time after a short wait (`model.agent.olderTicks`, 10 ticks); `model.agent.paginate(keep, size, ids?)` holds them back again for those agents (all by default), `failOlder(times)` makes the next loads reject, and `olderCalls` lists the agents each load was for. `hasOlder` is false wherever nothing is held back.
 
 On phones the update status and the tray connection show only their status light (the tray's budget is hidden) and the network indicator a cloud icon, with the text in their labels and tooltips; the agent picker keeps room for the cone's name, cut with an ellipsis when long, and the bottom rail scrolls when needed.
 On tablets the agent picker gives up room before the View menu does, so the header keeps the View menu and its last button in view from 640 to 1199 px, the tray's chips stay on one line each, the budget chip leaves out its window and a tray that isn't live shows only its state.

package/dist/slicc-dummy.js

@@ -148,6 +148,86 @@ function trayFixtures(scenario, now2) {
   const id = scenario === "tray-expired" ? "tray-url" : scenario;
   return all.filter((approval) => approval.id === id);
 }
+function secretFixtures(scenario, now2) {
+  const base = { createdAt: now2, expiresAt: now2 + 5 * minutes };
+  const enter = {
+    ...base,
+    id: "ask-harbor",
+    kind: "secret",
+    mode: "enter",
+    name: "HARBOR_DEPLOY_TOKEN",
+    prompt: "Paste the harbor deploy token from the release checklist.",
+    reveal: false,
+    requester: { kind: "user", name: "cone", where: "Terminal 1" },
+    process: {
+      exe: "/usr/bin/fnox",
+      argv: ["fnox", "set", "HARBOR_DEPLOY_TOKEN"],
+      cwd: "/home/cone/harbor"
+    }
+  };
+  const reveal = {
+    ...base,
+    id: "ask-lagoon",
+    kind: "secret",
+    mode: "reveal",
+    name: "LAGOON_API_KEY",
+    prompt: "The tide report script signs its uploads with this key.",
+    reveal: true,
+    requester: { kind: "agent", name: "docs-pass", where: "scoop:docs" },
+    process: {
+      exe: "/usr/bin/sealed",
+      argv: ["sealed", "ask", "LAGOON_API_KEY", "--reveal"],
+      cwd: "/home/cone/harbor"
+    },
+    createdAt: now2 + 1
+  };
+  if (scenario === "secret-enter") return [enter];
+  if (scenario === "secret-reveal") return [reveal];
+  if (scenario === "secret-long")
+    return [
+      {
+        ...enter,
+        id: "ask-long",
+        reveal: true,
+        requester: { kind: "agent", name: "quiet-otter" },
+        prompt: `Paste it\u202Eevil\r${"and wait. ".repeat(30)}`,
+        process: {
+          exe: "/usr/bin/sh",
+          argv: [
+            "sh",
+            "-c",
+            [longCommand, longCommand, longCommand].join(" && \\\n"),
+            "tide\rreport"
+          ],
+          cwd: "/home/cone/harbor\rferry"
+        }
+      }
+    ];
+  return [enter, reveal];
+}
+function pendingAsk(approval) {
+  const { kind, name: name2, where } = approval.requester;
+  return {
+    id: approval.id,
+    kind: "ask",
+    name: approval.name,
+    ...approval.prompt ? { prompt: approval.prompt } : {},
+    mode: approval.mode,
+    reveal: approval.reveal,
+    requester: {
+      kind,
+      name: name2,
+      ...where ? { where } : {},
+      ...approval.process,
+      tty: kind === "user" ? "/dev/pts/1" : null,
+      stdin: kind === "user" ? "tty" : "pipe"
+    },
+    uid: 1e3,
+    tag: kind,
+    createdAt: approval.createdAt,
+    expiresAt: approval.expiresAt
+  };
+}
 function levelFixture(scenario, now2) {
   const base = {
     id: `sudo-${scenario}`,
@@ -296,6 +376,7 @@ function approvalFixtures(scenario, now2 = Date.now()) {
   if (scenario === "guest" || scenario === "guest-follower") return guestFixtures(now2);
   if (scenario === "guest-always") return guestAlways(now2);
   if (scenario.startsWith("tray")) return trayFixtures(scenario, now2);
+  if (scenario.startsWith("secret-") || scenario === "secret") return secretFixtures(scenario, now2);
   if (scenario.startsWith("guest-")) return [guestCall(scenario, now2)];
   if (scenario === "none") return [];
   if (scenario === "long")
@@ -355,12 +436,20 @@ var DummyApprovals = class extends Emitter {
   #approvals;
   #time;
   #fail;
+  #vault;
+  #quiet = /* @__PURE__ */ new Set();
   decisions = [];
   decide;
-  constructor(scenario, time) {
+  constructor(scenario, time, vault) {
     super();
     this.#approvals = approvalFixtures(scenario);
     this.#time = time;
+    this.#vault = vault;
+    if (vault) {
+      for (const approval of this.#approvals)
+        if (approval.kind === "secret") vault.hold(pendingAsk(approval));
+      vault.on("status", (status2) => this.#left(status2.waiting));
+    }
     this.#fail = scenario === "fail";
     if (scenario !== "follower" && scenario !== "guest-follower")
       this.decide = (id, decision) => this.#decide(id, decision);
@@ -370,10 +459,24 @@ var DummyApprovals = class extends Emitter {
       void time.sleep(100).then(() => this.end("tray-url", "expired"));
   }
   raise(approval) {
+    if (approval.kind === "secret") this.#vault?.hold(pendingAsk(approval));
     this.#approvals = [...this.#approvals.filter(({ id }) => id !== approval.id), approval];
     this.emit("approvals", this.list());
   }
+  #left(waiting2) {
+    const vault = this.#vault;
+    for (const approval of this.#approvals) {
+      if (approval.kind !== "secret" || waiting2.some(({ id }) => id === approval.id)) continue;
+      if (vault.answered.has(approval.id) || this.#quiet.has(approval.id)) this.#drop(approval.id);
+      else this.end(approval.id, "answered");
+    }
+  }
+  #drop(id) {
+    this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
+    this.emit("approvals", this.list());
+  }
   end(id, reason) {
+    if (!this.#approvals.some((approval) => approval.id === id)) return;
     this.emit("ended", { id, reason });
     this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
     this.emit("approvals", this.list());
@@ -385,7 +488,14 @@ var DummyApprovals = class extends Emitter {
     await this.#time.sleep(10);
     if (this.#fail) throw new Error("The kernel stopped waiting. Run the command again.");
     if (id === "guest-late") throw new Error("Someone else already answered this.");
+    const approval = this.#approvals.find((item) => item.id === id);
+    if (approval?.kind === "secret" && decision !== "deny")
+      throw new Error("Save or Allow in the vault\u2019s frame.");
     this.decisions.push([id, decision]);
+    if (approval?.kind === "secret" && this.#vault?.ask(id)) {
+      this.#quiet.add(id);
+      await this.#vault.cancel(id);
+    }
     this.end(id, "answered");
   }
 };
@@ -1916,6 +2026,11 @@ var DummyAgent = class extends Emitter {
   #ice = /* @__PURE__ */ new Map();
   #suggestions = /* @__PURE__ */ new Map();
   #runs = /* @__PURE__ */ new Map();
+  #earlier = /* @__PURE__ */ new Map();
+  #page = 0;
+  #failing = 0;
+  olderTicks = 10;
+  olderCalls = [];
   #active;
   #clock;
   #effects;
@@ -2278,6 +2393,7 @@ var DummyAgent = class extends Emitter {
     const messages = this.#messages.get(agentId);
     if (agent.kind === "cone" && messages.length) this.#shelve(agent, messages);
     this.#messages.set(agentId, []);
+    this.#earlier.delete(agentId);
     this.#queues.set(agentId, []);
     this.#suggestions.delete(agentId);
     this.emit("messages", agentId);
@@ -2309,8 +2425,36 @@ var DummyAgent = class extends Emitter {
     agent.thinking = thinking;
     this.#changed();
   }
-  async older() {
-    return [];
+  paginate(keep, size, ids = [...this.#messages.keys()]) {
+    this.#page = size;
+    for (const agentId of ids) {
+      const all = [...this.#earlier.get(agentId) ?? [], ...this.#messages.get(agentId) ?? []];
+      const cut = Math.max(0, all.length - keep);
+      this.#earlier.set(agentId, all.slice(0, cut));
+      this.#messages.set(agentId, all.slice(cut));
+      this.emit("messages", agentId);
+    }
+  }
+  failOlder(times = 1) {
+    this.#failing = times;
+  }
+  hasOlder(agentId) {
+    return !!this.#earlier.get(agentId)?.length;
+  }
+  async older(agentId) {
+    this.olderCalls.push(agentId);
+    await this.#clock.sleep(this.olderTicks);
+    if (this.#failing > 0) {
+      this.#failing--;
+      throw new Error("The earlier messages couldn\u2019t be read.");
+    }
+    const earlier = this.#earlier.get(agentId) ?? [];
+    const page2 = earlier.splice(Math.max(0, earlier.length - this.#page));
+    if (page2.length) {
+      this.#messages.get(agentId)?.unshift(...page2);
+      this.emit("messages", agentId);
+    }
+    return page2;
   }
   commands(agentId) {
     if (this.#agent(agentId)?.kind !== "cone") return [];
@@ -2354,6 +2498,7 @@ var DummyAgent = class extends Emitter {
     this.stop(agentId);
     this.#agents = this.#agents.filter((candidate) => candidate !== agent);
     this.#messages.delete(agentId);
+    this.#earlier.delete(agentId);
     this.#queues.delete(agentId);
     this.#suggestions.delete(agentId);
     if (this.#active === agentId) this.select(agent.parentId ?? this.#agents[0].id);
@@ -6316,7 +6461,8 @@ function vaultAudit(now2 = Date.now()) {
           secret: "HARBOR_API_KEY",
           from: ["proxy", "device:link-pier"],
           to: ["proxy", "tailscale", "device:link-pier"]
-        }
+        },
+        { kind: "reveal", field: "agent", from: true, to: false }
       ]
     },
     {
@@ -6715,6 +6861,151 @@ var DummyVaultButton = class {
     this.#emit({ event: "popup", intent: resolved, state: "done" });
   }
 };
+var DummyValueFrame = class {
+  element;
+  request;
+  config = null;
+  messages = [];
+  arming = 500;
+  #listeners = /* @__PURE__ */ new Set();
+  #vault;
+  #box;
+  #view = "";
+  #armed = false;
+  #finished = false;
+  #sizes = new ResizeObserver(() => this.#size());
+  constructor(vault, time, request) {
+    this.#vault = vault;
+    this.request = request;
+    this.element = document.createElement("div");
+    this.element.dataset.vaultValue = "";
+    this.#box = document.createElement("div");
+    this.#box.style.padding = "2px";
+    this.element.append(this.#box);
+    this.element.addEventListener("keydown", (event) => {
+      if (event.key !== "Escape" || event.isComposing) return;
+      event.preventDefault();
+      event.stopPropagation();
+      this.#emit({ event: "escape" });
+    });
+    vault.on("status", () => this.#render());
+    this.#sizes.observe(this.#box);
+    void time.sleep(0).then(() => this.#emit({ event: "ready" }));
+  }
+  post(message) {
+    this.messages.push(message);
+    if (message.op === "focus") {
+      this.#box.querySelector("input, swc-button")?.focus();
+      return;
+    }
+    this.request = message.request;
+    this.config = message.config;
+    this.element.style.colorScheme = message.config.theme ?? "";
+    this.#render();
+  }
+  listen(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  #emit(event) {
+    const message = { type: "slicc-vault", v: 1, ...event };
+    for (const listener of [...this.#listeners]) listener(message);
+  }
+  #size() {
+    const { width, height } = this.#box.getBoundingClientRect();
+    this.#emit({ event: "size", width: Math.ceil(width), height: Math.ceil(height), inset: 2 });
+  }
+  #render() {
+    if (!this.config || this.#finished) return;
+    const ask2 = this.#vault.ask(this.request);
+    if (!ask2) {
+      this.#finished = true;
+      this.#box.replaceChildren();
+      this.#emit({ event: "gone", request: this.request, state: "cancelled" });
+      return;
+    }
+    const view = this.#vault.status()?.locked ? "locked" : ask2.mode ?? "enter";
+    if (view === this.#view) return;
+    if (view !== "locked" && (this.#view === "" || this.#view === "locked"))
+      setTimeout(() => {
+        this.#armed = true;
+        this.#arm();
+      }, this.arming);
+    this.#view = view;
+    this.#box.replaceChildren(...this.#controls(view, ask2));
+    this.#arm();
+    this.#size();
+  }
+  #arm() {
+    for (const button of this.#box.querySelectorAll("[data-action=save], [data-action=allow]"))
+      button.toggleAttribute("disabled", !this.#armed);
+  }
+  #button(action, label2, variant, click) {
+    const button = document.createElement("swc-button");
+    button.dataset.action = action;
+    button.setAttribute("variant", variant);
+    button.textContent = label2;
+    button.addEventListener("click", click);
+    return button;
+  }
+  #controls(view, ask2) {
+    const text = document.createElement("p");
+    text.style.margin = "0 0 8px";
+    const problem = document.createElement("p");
+    problem.dataset.problem = "";
+    problem.style.margin = "8px 0 0";
+    if (view === "locked") {
+      text.textContent = "Unlock the vault to answer.";
+      return [
+        text,
+        this.#button("unlock", "Unlock", "accent", () => {
+          void this.#vault.answer({ kind: "unlock" });
+        })
+      ];
+    }
+    if (view === "reveal") {
+      text.textContent = `${ask2.requester?.exe} gets the plaintext of ${ask2.name}`;
+      return [
+        text,
+        this.#button("allow", "Allow", "negative", () => void this.#answer(problem, "")),
+        problem
+      ];
+    }
+    const label2 = document.createElement("label");
+    label2.textContent = `Value for ${ask2.name}`;
+    label2.style.display = "grid";
+    const input = document.createElement("input");
+    input.type = "password";
+    input.dataset.field = "value";
+    input.autocomplete = "off";
+    label2.append(input);
+    text.append(label2);
+    return [
+      text,
+      this.#button("save", "Save", "accent", () => {
+        const value = input.value;
+        input.value = "";
+        void this.#answer(problem, value);
+      }),
+      problem
+    ];
+  }
+  async #answer(problem, value) {
+    const reveal = this.#view === "reveal";
+    problem.textContent = "";
+    this.#finished = true;
+    try {
+      if (reveal) await this.#vault.allow(this.request);
+      else await this.#vault.seal(this.request, value);
+      this.#emit({ event: "done", request: this.request, state: reveal ? "allowed" : "sealed" });
+    } catch (error) {
+      this.#finished = false;
+      const { code, message } = error;
+      if (code === "EINVAL") problem.textContent = message;
+      else this.#emit({ event: "error", code, message });
+    }
+  }
+};
 var DummyVault = class extends Emitter {
   #status;
   #list;
@@ -6724,6 +7015,9 @@ var DummyVault = class extends Emitter {
   #older = vaultOlder();
   #serial = 0;
   buttons = [];
+  frames = [];
+  answered = /* @__PURE__ */ new Set();
+  revealed = [];
   puts = [];
   endpointChanges = [];
   settingsCalls = [];
@@ -6998,6 +7292,55 @@ var DummyVault = class extends Emitter {
     this.buttons.push(button);
     return button;
   }
+  valueFrame(request) {
+    const frame = new DummyValueFrame(this, this.#time, request);
+    this.frames.push(frame);
+    return frame;
+  }
+  hold(request) {
+    this.#status = {
+      ...this.#status,
+      waiting: [...this.#status.waiting.filter(({ id }) => id !== request.id), request]
+    };
+    this.emit("status", this.#status);
+  }
+  ask(request) {
+    return this.#status.waiting.find(({ id, kind }) => id === request && kind === "ask");
+  }
+  #asked(request) {
+    this.#unlocked();
+    const found = this.ask(request);
+    if (!found) throw vaultFailure("ENOENT", "That request is no longer waiting.");
+    return found;
+  }
+  async seal(request, value) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    const problem = valueProblem(value);
+    if (problem) throw vaultFailure("EINVAL", problem);
+    this.answered.add(request);
+    this.#take(request);
+    return this.#seal(found.name, "settings");
+  }
+  async allow(request) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    this.answered.add(request);
+    this.revealed.push(request);
+    this.#take(request);
+    const { exe, argv, cwd, kind } = found.requester;
+    this.#log(found.name, {
+      type: "reveal",
+      uid: found.uid,
+      tag: found.tag,
+      exe,
+      argv: argv.join(" "),
+      cwd,
+      requester: kind,
+      request
+    });
+    this.emit("list", this.#list);
+  }
   autoLabel() {
     return this.#status.locked ? "Vault locked" : "Vault unlocked";
   }
@@ -7111,7 +7454,8 @@ function createDummyModel({
   monitor = "dummy",
   import: imports = "off",
   login,
-  budget = "plain"
+  budget = "plain",
+  older = "off"
 } = {}) {
   const time = clock(delay);
   const mount = mounts === "off" ? null : { scenario: mounts, point: mountPoint, files: mounted };
@@ -7136,8 +7480,10 @@ function createDummyModel({
     browser.release(agentId);
   };
   importPort(imports, agent, time);
+  if (older === "paged") agent.paginate(6, 4);
   if (hold !== "off") agent.setHold({ reason: hold, held: 2 });
   const noticePort = noticesPort(agent, time, notices, readonly, arrival);
+  const vaultPort = vault === "off" ? void 0 : new DummyVault(vault, time, vaultRecords(accounts2, mcp));
   if (scenario === "driving") void browser.run(drive);
   const base = {
     agent,
@@ -7180,11 +7526,9 @@ function createDummyModel({
     ...changes === "files" ? {} : { changes: new DummyChanges(files3, changes === "git") },
     ...noticePort ? { notices: noticePort } : {},
     ...tabs2 === "off" ? {} : { tabs: new DummyTabs(tabs2, time) },
-    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time) },
+    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time, vaultPort) },
     ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) },
-    ...vault === "off" ? {} : {
-      vault: new DummyVault(vault, time, vaultRecords(accounts2, mcp))
-    },
+    ...vaultPort ? { vault: vaultPort } : {},
     ...guestsPort(guests, time)
   };
   base.vault?.on("status", (status2) => {
@@ -7207,6 +7551,7 @@ export {
   DummyNotices,
   DummyTabs,
   DummyUpdates,
+  DummyValueFrame,
   DummyVault,
   DummyVaultButton,
   actionLimits,