@ai-ecoverse/slicc-spectrum 2.1.0 → 2.2.0

package/README.md

@@ -335,6 +335,11 @@ Sudo and guest requests show the verdict under the command, in a live region (`.
 Focus starts on Deny (on Close once `decide` rejects) and goes back, after Deny, Always allow, Allow once, <kbd>Esc</kbd> or Close, to what had it when the dialog opened; inside a terminal, to that `<slicc-terminal>` through its own `focus()`, even when it remounted meanwhile.
 Guest requests (`guest-message`, `guest-tool`) get their own copy, the guest's text as plain text (`[data-guest-text]`), attachments (`[data-attachments]`), the automatic check's verdict (`[data-verdict]`), and Deny and Allow once, plus **Always allow** (`data-action="always"`) with a hint saying what it covers when the approval's `always` is `true`; the dialog body carries `[data-approval-kind]` and fills the dialog's width at every size.
 Tray requests (`tray`) get their own title and one sentence (`#asking`), and only **Deny** (`deny`, focused) and **Allow once** (`once`), never Always allow.
+Secret requests (`secret`, `dialog[data-kind=secret]`) read "Enter a value for {name}?" (`mode: 'enter'`) or "Reveal {name} to a program?" (`reveal`). Under the title comes the trusted block, which only bios and the kernel fill: "{name} ran this[ in {where}]:" for an agent or "You ran this[ in {where}] (as {name}):" for a user, then the command (`[data-command]`), which is `process.exe` followed by `argv[1…]`, each word shell-quoted (`argv[0]` is the program's own choice), then "In {cwd}". The command follows sudo's rules: the same scrolling box, the same control-character chips, and the same end-in-view rule. Then the untrusted `prompt`, if any, in its own block (`[data-prompt]`) under "From the agent, not checked by SLICC:", with control characters as chips and cut at 200 characters. With `reveal`, a negative block (`[data-reveal]`) says "{exe} gets the plaintext. It can send it anywhere.", and adds "The agent asked for this." when `requester.kind` is `agent`.
+The body is the vault's own frame (`[data-value-frame]`, a `<slicc-vault-value>` on `vault.valueFrame(id)`). The value is typed and Save or Allow clicked there, so spectrum never sees the value and can't fake the consent. The frame is `inert` until the end of the command has been in view, and "Scroll to the end of the command to answer it." (`[data-allow-hint]`) shows while it isn't. Without `vault.valueFrame`, "The vault isn’t available here, so this request can only be denied." (`[data-id="no-frame"]`) stands in its place.
+The title shows control characters in the name as chips, and so does the notice. The only button is **Deny** (`deny`, focused). The element's `decide()` takes only `deny` for a secret, and only while that request is the one showing: not once it was denied, answered in its frame, closed, or ended (timed out, answered elsewhere, withdrawn). A late `escape` from the frame does nothing either.
+When a listed request is replaced (the same `id` with another `createdAt`, command, mode, name, `reveal`, prompt or requester), or an `id` comes back after it left `list()`, the dialog counts it as a new request: a new frame, the end of its command unseen again, and the half-second guard again. Escape on the dialog denies, and so does the frame's `escape` event, posted when Escape is pressed inside the frame. The frame's `done` for this request closes the dialog and moves on to the next request, with no "answered" dialog. The frame's `gone` shows "Secret request timed out" (`expired`) or "Answered elsewhere", or closes silently (`withdrawn`), except for a request this tab denied or answered. The frame's `error` shows its message under the frame (`[data-frame-error]`). A secret request that leaves `list()` without `ended` before `expiresAt` closes silently, because the frame's `done` and the list change can arrive in either order. Focus then goes back as for sudo, to the `<slicc-terminal>` that had it.
+`approvalKinds` (from `/ui`) is a frozen array of the kinds this build shows (`sudo`, `guest-message`, `guest-tool`, `tray`, `secret`), so an embedder can hold back the kinds an older UI would leave waiting unseen.
 
 #### `<slicc-follow>`
 
@@ -480,7 +485,7 @@ The secrets, sorted by name (`li[data-secret][data-state]`, with `[data-rules]`,
 Locked, every form (Add secret, Replace value, Import, Export) says "Unlock the vault first" (`p[data-locked]`) next to the vault's own small **Unlock** button (`slicc-vault-button[data-action=unlock]`) and disables its submit; once unlocked, the form stays open with what was typed and its submit enables.
 Vault errors show their message, EACCES as "Unlock the vault first", an EACCES with `cause: 'policy-paused'` as "Secrets are paused until the missing policy file is back", and ENOTSUP as "This arrives with a later vault version".
 Each action shows only when the port has its method.
-Then **Rules SLICC refused** (`[data-refused]`), where the rules live (`[data-policy]`) and **Activity** (`ol.audit li[data-seq][data-type]`; an entry with `uid` and `tag` both `null` reads "by you", a `refresh` entry "Refreshed automatically" (with the sign-in it used), an `endpoints` entry (vault-originated, no "by …") one part per field it carries: (1.91.0's `EndpointsEntry` had a required `purged` with `url`; no vault wrote it before 1.13.0, so the shape was corrected rather than kept, with `purged` optional and `host` replacing `url`) `purged` "Removed custom model URLs an agent set, automatically: {provider name} at {host}, …. Only you can set a model URL now, in Settings › Accounts" (the provider's name from `settings.accounts()`, else its id), `adopted` "Kept the MCP servers your tokens use, automatically: {server} at {host}, …", `pinned` "{name} pinned to {host} automatically, on first use" with **Unpin** (`data-action=unpin`, calling the vault port's optional `unpin([name])`; disabled while the vault is locked; a failure shows in the row as `[data-error=unpin]`, in the same words as other vault failures; it's hidden once a newer `unpinned` entry for that name is in the log), and `unpinned` "{name} unpinned from {host}; the next use pins it again", an `mcp` entry "Sent to the MCP server SERVER at DOMAIN" with its request and exit, a `session` entry (a value the vault handed the kernel for a verified TLS session, vault 1.15.0) "Sent over {HTTP/1.1, SMTP or Postgres} to {domain}:{port}, {trusted by public roots, or trusted by its pinned anchor}, through {exit}" (no trust part when an older entry has no `verifiedBy` or a newer vault sends one spectrum doesn't know; a protocol it doesn't know reads as its raw name), and a policy entry lists its changes, its warning and, when accepted, how to change the file back, except that an entry with `absent` reads "{file} was removed. Secrets are paused until it’s back." and the accepted entry that ends its pause reads "{file} is back. Secrets are running again." ("Secrets stay paused until the other file is back." while the other file is still missing), neither with the way back; **Only reveals to programs**, `data-action="reveals"`, and **Show older**, `data-action="older"`).
+Then **Rules SLICC refused** (`[data-refused]`), where the rules live (`[data-policy]`) and **Activity** (`ol.audit li[data-seq][data-type]`; an entry with `uid` and `tag` both `null` reads "by you", a `refresh` entry "Refreshed automatically" (with the sign-in it used), an `endpoints` entry (vault-originated, no "by …") one part per field it carries: (1.91.0's `EndpointsEntry` had a required `purged` with `url`; no vault wrote it before 1.13.0, so the shape was corrected rather than kept, with `purged` optional and `host` replacing `url`) `purged` "Removed custom model URLs an agent set, automatically: {provider name} at {host}, …. Only you can set a model URL now, in Settings › Accounts" (the provider's name from `settings.accounts()`, else its id), `adopted` "Kept the MCP servers your tokens use, automatically: {server} at {host}, …", `pinned` "{name} pinned to {host} automatically, on first use" with **Unpin** (`data-action=unpin`, calling the vault port's optional `unpin([name])`; disabled while the vault is locked; a failure shows in the row as `[data-error=unpin]`, in the same words as other vault failures; it's hidden once a newer `unpinned` entry for that name is in the log), and `unpinned` "{name} unpinned from {host}; the next use pins it again", an `mcp` entry "Sent to the MCP server SERVER at DOMAIN" with its request and exit, a `reveal` entry (vault 1.23.0, a secret ask whose plaintext the user allowed) "Revealed to {argv} in {cwd}, allowed in a dialog", (the argv, cwd and "by …" of `materialize` and `reveal` entries, and of a secret's "Revealed to programs…, last by … with {argv}" line, show control characters as chips, as the approval dialog does), which counts as a reveal for **Only reveals to programs** and for the secret's "Revealed to programs…" line, a policy change of `[reveal] agent` "Programs an agent runs may no longer ask for a secret’s plaintext" (or "…may ask for a secret’s plaintext again, in a dialog each time"), a `session` entry (a value the vault handed the kernel for a verified TLS session, vault 1.15.0) "Sent over {HTTP/1.1, SMTP or Postgres} to {domain}:{port}, {trusted by public roots, or trusted by its pinned anchor}, through {exit}" (no trust part when an older entry has no `verifiedBy` or a newer vault sends one spectrum doesn't know; a protocol it doesn't know reads as its raw name), and a policy entry lists its changes, its warning and, when accepted, how to change the file back, except that an entry with `absent` reads "{file} was removed. Secrets are paused until it’s back." and the accepted entry that ends its pause reads "{file} is back. Secrets are running again." ("Secrets stay paused until the other file is back." while the other file is still missing), neither with the way back; **Only reveals to programs**, `data-action="reveals"`, and **Show older**, `data-action="older"`).
 The section's `data-vault` is `locked`, `unlocked` or `loading`.
 A popup the browser blocked shows how to allow it (`[data-popup=blocked]`).
 Widened-rule notices aren't shown.
@@ -490,8 +495,14 @@ An open **Removed** list (`details[data-removed]`) stays open across a layout sw
 
 Places `vault.button()`'s element (the vault's own button frame), posts its `config` (`ButtonConfig` plus `theme`) once the button is `ready`, sets the frame's `color-scheme` to `theme` (or leaves it to the page) so the frame stays transparent, takes the reported `size` (with the focus-ring `inset` as negative margin) and `label` (as its title), moves focus to the control before or after it when the frame reports `focus` (`previous` or `next`), and fires `vault-popup` (bubbles, composed) with each `popup` event's `{ intent, state }`. spectrum sends only the `unlock` and `protect` intents.
 
+#### `<slicc-vault-value>`
+
+Places `vault.valueFrame(request)`'s element (the vault's `value.html` frame) and, once the frame is `ready`, posts `{ type: 'slicc-vault', v: 1, op: 'value', request, config }`, where `config` is a `ValueConfig` (`theme`, `dir`, `lang`, `scale`). It posts again when `config` changes, and mounts a new frame when `vault` or `request` changes. It sets the frame's `color-scheme` to `theme`. From `size` it takes the height, at most 480 px (and at most `45dvh`, beyond which the frame scrolls), and makes the frame its own width, with the `inset` (at most 4 px) as a negative margin above and below only, so the dialog never scrolls sideways. A value that isn't a finite number counts as 0. The element clips the frame to its own box (with room above and below for the largest inset it allows, 4 px, for the focus ring), so a frame can't paint over the command above it or the dialog's buttons. On the frame's `focus` event it moves focus to the control after or before the frame (`next` or `previous`), within its `<dialog>` and wrapping around. `focus()` posts `{ op: 'focus' }`, which focuses the frame's first control. It fires `vault-value` (bubbles, composed) with each `done`, `gone`, `error` and `escape` event. The detail holds only `event`, `request`, `state`, `code` and `message` (each when it's a string), so anything else the frame sends goes no further.
+
 #### `<slicc-value-request>`
 
+For the older `value` requests only, until bios stops sending them: `ask` requests show in `<slicc-approvals>` instead.
+
 The vault's waiting `value` requests (`fnox set` on a terminal) as a modal dialog, one at a time, oldest first, with "N more waiting"; `<slicc-app>` mounts it.
 `dialog[data-request]`: "Enter a value for NAME" (a Name field when the request has no name), who asks, as on the Settings card ("docs-pass asks for NAME", or "A program running as uid N asks for NAME"), the prompt under "From the agent, not checked by SLICC:", a masked value field with the same rules as Settings › Secrets, "Expires in N min", and **Later** (`data-action="later"`, or Escape: closes, the request stays in Settings › Secrets, whose **Enter value** reopens it), **Cancel request** (`data-action="cancel-request"`, with `cancel`) and **Save** (`data-action="save"`, `put(name, value, request.id)`, with `put`).
 Locked, it shows the vault's Unlock button and disables Save.
@@ -967,6 +978,9 @@ It has no `always`: the dialog never offers Always allow for it, even when the i
 Its dialog reads "Share this seven’s join URL?" with "{name} wants this seven’s join URL. Anyone with it can ask to link to this seven.", "Make a new join URL?" with "{name} wants a new join URL. Linked devices move to it, and the old one stops working.", or "Unlink {device.name}?" with "{name} wants to unlink {device.name} from this seven." ("Unlink a device?" and "…unlink a device from this seven." without `device`), then the countdown, **Deny** and **Allow once**.
 Ended tray requests read "Answered in another tab" or "Tray request timed out", and a withdrawn one closes silently.
 Without `decide`, its notice reads "Waiting for tray approval" with the same sentence, then "It waits for the owner's approval. Denied automatically at {time}."
+A secret request (`kind` `secret`, a `SecretApproval`) is a program asking for a secret through `/dev/sealed`. Its fields are `mode` (`enter` when there is no live secret of that name, `reveal` when there is), `name`, an optional `prompt` (the program's own words, ≤ 200 characters, untrusted), `reveal` (the process gets the plaintext back too), `requester` (`kind` `agent` or `user`, `name`, optional `where`), `process` (`exe`, the resolved program file; `argv`; `cwd`, all from the kernel), `createdAt` and `expiresAt`.
+`decide(id, 'deny')` cancels it in the vault, and the UI never sends `once` or `always` for it: the answer is given in the vault's frame. Send `ended` (`answered`, `expired` or `withdrawn`) only for a request that ended outside this tab: not for one this tab denied, and not for one whose frame in this tab posted `done`.
+Without `decide`, its notice (`[data-approval-kind=secret]`) reads "Waiting for a secret" with "{name} ran {exe}, which asks for a value for {secret}." ("You ran…" for a user, "…the plaintext of {secret}." for `reveal`), then "It waits for the owner's answer. Denied automatically at {time}."
 An approval whose `kind` this build doesn't know shows neither a dialog nor a notice, so it waits until it ends and is never allowed from here.
 
 #### `vault` (optional)
@@ -977,10 +991,12 @@ The vault's view for SLICC, typed after `@ai-ecoverse/slicc-vault` (spectrum re-
 Emit `status` and `list` when they change (bios re-lists after the vault's `changed` events), and `availability` when the optional `availability()` (`connecting`, `waiting`, `locked` or `ready`) changes.
 `audit(before?, limit?)` resolves with an older `AuditPage` (`before` is a `seq`).
 The optional page ops, each hiding its control when missing: `put(name, value, request?)` (a value request's `put` must use its `name`), `cancel(request)`, `remove(name, kind?)`, `restore(name, kind?)`, `import(kind, bytes, { password?, pick? })` (a `pick` stage, then `done`), `export(passphrase)` (the bundle's bytes), `lock()`, `dismissBackupReminder()` and `endpoints({ add?, remove? })`, which registers or takes back the URLs a page-sealed credential may be filled on (each an `EndpointSet`, `{ model?: [{ name, url }], mcp?: [{ server, url }] }`, a model URL bound to one record by name), checks the whole change first (`EINVAL` changes nothing) and rejects with a sentence. Settings registers them itself, never through the agent. `settings(name, kind, settings)` replaces a record's tenant settings as a whole without touching its key (the vault's `put` without a value); `put`'s options take the same `settings` on a first save.
-They reject with a `VaultFailure`, an `Error` with an `ErrorCode` `code` (`isVaultFailure` from `/ui`) and an optional `ErrorCause` `cause`, matching slicc-vault 1.22.0’s stable refusal causes; `isPolicyPaused` still identifies only `policy-paused`.
+They reject with a `VaultFailure`, an `Error` with an `ErrorCode` `code` (`isVaultFailure` from `/ui`) and an optional `ErrorCause` `cause`, matching slicc-vault 1.22.0’s stable refusal causes (checked against the pinned 1.23.0, whose ask types `compat/vault.ts` also checks: `Requester`, `ValueConfig`, `ValueEvent` and, the other way, `ValueMessage`); `isPolicyPaused` still identifies only `policy-paused`.
 Values go to the vault only through `put`, and never through another port.
 `button()` returns a new `VaultButton`, `{ element, post(message), listen(fn) }` returning an unsubscribe: bios wraps the vault's `button.html` frame and its postMessage protocol, and spectrum only sends `ButtonMessage`s and receives `ButtonEvent`s.
 The passkey lock (unlock and protect) happens in the vault's own popup, which only a click in that frame can open.
+The optional `valueFrame(request)` returns a new `VaultValueFrame` for an `ask` request, `{ element, post(message), listen(fn) }` like `button()`. bios wraps the vault's `value.html` frame. spectrum sends only `ValueMessage`s (`op: 'value'` with the request and a `ValueConfig`, and `op: 'focus'`) and receives only `ValueEvent`s (`ready`, `size`, `focus`, `done { request, state: 'sealed' | 'allowed' }`, `gone { request, state }`, `error { code, message }`, `escape`). The value is typed in that frame, and a reveal is allowed only by a click there, so the page never holds the value or the consent.
+An `ask` request in `status.waiting` also carries `mode`, `reveal` and `requester` (`{ kind, name?, where?, exe, argv, cwd, tty, stdin }`). Settings › Secrets lists it with Cancel request only, and `RequestState` includes `withdrawn`.
 `notices`, `acknowledge` and the `notice` event are still typed, and ignored.
 
 #### `guests` (optional)

package/dist/slicc-dummy.js

@@ -148,6 +148,86 @@ function trayFixtures(scenario, now2) {
   const id = scenario === "tray-expired" ? "tray-url" : scenario;
   return all.filter((approval) => approval.id === id);
 }
+function secretFixtures(scenario, now2) {
+  const base = { createdAt: now2, expiresAt: now2 + 5 * minutes };
+  const enter = {
+    ...base,
+    id: "ask-harbor",
+    kind: "secret",
+    mode: "enter",
+    name: "HARBOR_DEPLOY_TOKEN",
+    prompt: "Paste the harbor deploy token from the release checklist.",
+    reveal: false,
+    requester: { kind: "user", name: "cone", where: "Terminal 1" },
+    process: {
+      exe: "/usr/bin/fnox",
+      argv: ["fnox", "set", "HARBOR_DEPLOY_TOKEN"],
+      cwd: "/home/cone/harbor"
+    }
+  };
+  const reveal = {
+    ...base,
+    id: "ask-lagoon",
+    kind: "secret",
+    mode: "reveal",
+    name: "LAGOON_API_KEY",
+    prompt: "The tide report script signs its uploads with this key.",
+    reveal: true,
+    requester: { kind: "agent", name: "docs-pass", where: "scoop:docs" },
+    process: {
+      exe: "/usr/bin/sealed",
+      argv: ["sealed", "ask", "LAGOON_API_KEY", "--reveal"],
+      cwd: "/home/cone/harbor"
+    },
+    createdAt: now2 + 1
+  };
+  if (scenario === "secret-enter") return [enter];
+  if (scenario === "secret-reveal") return [reveal];
+  if (scenario === "secret-long")
+    return [
+      {
+        ...enter,
+        id: "ask-long",
+        reveal: true,
+        requester: { kind: "agent", name: "quiet-otter" },
+        prompt: `Paste it\u202Eevil\r${"and wait. ".repeat(30)}`,
+        process: {
+          exe: "/usr/bin/sh",
+          argv: [
+            "sh",
+            "-c",
+            [longCommand, longCommand, longCommand].join(" && \\\n"),
+            "tide\rreport"
+          ],
+          cwd: "/home/cone/harbor\rferry"
+        }
+      }
+    ];
+  return [enter, reveal];
+}
+function pendingAsk(approval) {
+  const { kind, name: name2, where } = approval.requester;
+  return {
+    id: approval.id,
+    kind: "ask",
+    name: approval.name,
+    ...approval.prompt ? { prompt: approval.prompt } : {},
+    mode: approval.mode,
+    reveal: approval.reveal,
+    requester: {
+      kind,
+      name: name2,
+      ...where ? { where } : {},
+      ...approval.process,
+      tty: kind === "user" ? "/dev/pts/1" : null,
+      stdin: kind === "user" ? "tty" : "pipe"
+    },
+    uid: 1e3,
+    tag: kind,
+    createdAt: approval.createdAt,
+    expiresAt: approval.expiresAt
+  };
+}
 function levelFixture(scenario, now2) {
   const base = {
     id: `sudo-${scenario}`,
@@ -296,6 +376,7 @@ function approvalFixtures(scenario, now2 = Date.now()) {
   if (scenario === "guest" || scenario === "guest-follower") return guestFixtures(now2);
   if (scenario === "guest-always") return guestAlways(now2);
   if (scenario.startsWith("tray")) return trayFixtures(scenario, now2);
+  if (scenario.startsWith("secret-") || scenario === "secret") return secretFixtures(scenario, now2);
   if (scenario.startsWith("guest-")) return [guestCall(scenario, now2)];
   if (scenario === "none") return [];
   if (scenario === "long")
@@ -355,12 +436,20 @@ var DummyApprovals = class extends Emitter {
   #approvals;
   #time;
   #fail;
+  #vault;
+  #quiet = /* @__PURE__ */ new Set();
   decisions = [];
   decide;
-  constructor(scenario, time) {
+  constructor(scenario, time, vault) {
     super();
     this.#approvals = approvalFixtures(scenario);
     this.#time = time;
+    this.#vault = vault;
+    if (vault) {
+      for (const approval of this.#approvals)
+        if (approval.kind === "secret") vault.hold(pendingAsk(approval));
+      vault.on("status", (status2) => this.#left(status2.waiting));
+    }
     this.#fail = scenario === "fail";
     if (scenario !== "follower" && scenario !== "guest-follower")
       this.decide = (id, decision) => this.#decide(id, decision);
@@ -370,10 +459,24 @@ var DummyApprovals = class extends Emitter {
       void time.sleep(100).then(() => this.end("tray-url", "expired"));
   }
   raise(approval) {
+    if (approval.kind === "secret") this.#vault?.hold(pendingAsk(approval));
     this.#approvals = [...this.#approvals.filter(({ id }) => id !== approval.id), approval];
     this.emit("approvals", this.list());
   }
+  #left(waiting2) {
+    const vault = this.#vault;
+    for (const approval of this.#approvals) {
+      if (approval.kind !== "secret" || waiting2.some(({ id }) => id === approval.id)) continue;
+      if (vault.answered.has(approval.id) || this.#quiet.has(approval.id)) this.#drop(approval.id);
+      else this.end(approval.id, "answered");
+    }
+  }
+  #drop(id) {
+    this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
+    this.emit("approvals", this.list());
+  }
   end(id, reason) {
+    if (!this.#approvals.some((approval) => approval.id === id)) return;
     this.emit("ended", { id, reason });
     this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
     this.emit("approvals", this.list());
@@ -385,7 +488,14 @@ var DummyApprovals = class extends Emitter {
     await this.#time.sleep(10);
     if (this.#fail) throw new Error("The kernel stopped waiting. Run the command again.");
     if (id === "guest-late") throw new Error("Someone else already answered this.");
+    const approval = this.#approvals.find((item) => item.id === id);
+    if (approval?.kind === "secret" && decision !== "deny")
+      throw new Error("Save or Allow in the vault\u2019s frame.");
     this.decisions.push([id, decision]);
+    if (approval?.kind === "secret" && this.#vault?.ask(id)) {
+      this.#quiet.add(id);
+      await this.#vault.cancel(id);
+    }
     this.end(id, "answered");
   }
 };
@@ -6351,7 +6461,8 @@ function vaultAudit(now2 = Date.now()) {
           secret: "HARBOR_API_KEY",
           from: ["proxy", "device:link-pier"],
           to: ["proxy", "tailscale", "device:link-pier"]
-        }
+        },
+        { kind: "reveal", field: "agent", from: true, to: false }
       ]
     },
     {
@@ -6750,6 +6861,151 @@ var DummyVaultButton = class {
     this.#emit({ event: "popup", intent: resolved, state: "done" });
   }
 };
+var DummyValueFrame = class {
+  element;
+  request;
+  config = null;
+  messages = [];
+  arming = 500;
+  #listeners = /* @__PURE__ */ new Set();
+  #vault;
+  #box;
+  #view = "";
+  #armed = false;
+  #finished = false;
+  #sizes = new ResizeObserver(() => this.#size());
+  constructor(vault, time, request) {
+    this.#vault = vault;
+    this.request = request;
+    this.element = document.createElement("div");
+    this.element.dataset.vaultValue = "";
+    this.#box = document.createElement("div");
+    this.#box.style.padding = "2px";
+    this.element.append(this.#box);
+    this.element.addEventListener("keydown", (event) => {
+      if (event.key !== "Escape" || event.isComposing) return;
+      event.preventDefault();
+      event.stopPropagation();
+      this.#emit({ event: "escape" });
+    });
+    vault.on("status", () => this.#render());
+    this.#sizes.observe(this.#box);
+    void time.sleep(0).then(() => this.#emit({ event: "ready" }));
+  }
+  post(message) {
+    this.messages.push(message);
+    if (message.op === "focus") {
+      this.#box.querySelector("input, swc-button")?.focus();
+      return;
+    }
+    this.request = message.request;
+    this.config = message.config;
+    this.element.style.colorScheme = message.config.theme ?? "";
+    this.#render();
+  }
+  listen(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  #emit(event) {
+    const message = { type: "slicc-vault", v: 1, ...event };
+    for (const listener of [...this.#listeners]) listener(message);
+  }
+  #size() {
+    const { width, height } = this.#box.getBoundingClientRect();
+    this.#emit({ event: "size", width: Math.ceil(width), height: Math.ceil(height), inset: 2 });
+  }
+  #render() {
+    if (!this.config || this.#finished) return;
+    const ask2 = this.#vault.ask(this.request);
+    if (!ask2) {
+      this.#finished = true;
+      this.#box.replaceChildren();
+      this.#emit({ event: "gone", request: this.request, state: "cancelled" });
+      return;
+    }
+    const view = this.#vault.status()?.locked ? "locked" : ask2.mode ?? "enter";
+    if (view === this.#view) return;
+    if (view !== "locked" && (this.#view === "" || this.#view === "locked"))
+      setTimeout(() => {
+        this.#armed = true;
+        this.#arm();
+      }, this.arming);
+    this.#view = view;
+    this.#box.replaceChildren(...this.#controls(view, ask2));
+    this.#arm();
+    this.#size();
+  }
+  #arm() {
+    for (const button of this.#box.querySelectorAll("[data-action=save], [data-action=allow]"))
+      button.toggleAttribute("disabled", !this.#armed);
+  }
+  #button(action, label2, variant, click) {
+    const button = document.createElement("swc-button");
+    button.dataset.action = action;
+    button.setAttribute("variant", variant);
+    button.textContent = label2;
+    button.addEventListener("click", click);
+    return button;
+  }
+  #controls(view, ask2) {
+    const text = document.createElement("p");
+    text.style.margin = "0 0 8px";
+    const problem = document.createElement("p");
+    problem.dataset.problem = "";
+    problem.style.margin = "8px 0 0";
+    if (view === "locked") {
+      text.textContent = "Unlock the vault to answer.";
+      return [
+        text,
+        this.#button("unlock", "Unlock", "accent", () => {
+          void this.#vault.answer({ kind: "unlock" });
+        })
+      ];
+    }
+    if (view === "reveal") {
+      text.textContent = `${ask2.requester?.exe} gets the plaintext of ${ask2.name}`;
+      return [
+        text,
+        this.#button("allow", "Allow", "negative", () => void this.#answer(problem, "")),
+        problem
+      ];
+    }
+    const label2 = document.createElement("label");
+    label2.textContent = `Value for ${ask2.name}`;
+    label2.style.display = "grid";
+    const input = document.createElement("input");
+    input.type = "password";
+    input.dataset.field = "value";
+    input.autocomplete = "off";
+    label2.append(input);
+    text.append(label2);
+    return [
+      text,
+      this.#button("save", "Save", "accent", () => {
+        const value = input.value;
+        input.value = "";
+        void this.#answer(problem, value);
+      }),
+      problem
+    ];
+  }
+  async #answer(problem, value) {
+    const reveal = this.#view === "reveal";
+    problem.textContent = "";
+    this.#finished = true;
+    try {
+      if (reveal) await this.#vault.allow(this.request);
+      else await this.#vault.seal(this.request, value);
+      this.#emit({ event: "done", request: this.request, state: reveal ? "allowed" : "sealed" });
+    } catch (error) {
+      this.#finished = false;
+      const { code, message } = error;
+      if (code === "EINVAL") problem.textContent = message;
+      else this.#emit({ event: "error", code, message });
+    }
+  }
+};
 var DummyVault = class extends Emitter {
   #status;
   #list;
@@ -6759,6 +7015,9 @@ var DummyVault = class extends Emitter {
   #older = vaultOlder();
   #serial = 0;
   buttons = [];
+  frames = [];
+  answered = /* @__PURE__ */ new Set();
+  revealed = [];
   puts = [];
   endpointChanges = [];
   settingsCalls = [];
@@ -7033,6 +7292,55 @@ var DummyVault = class extends Emitter {
     this.buttons.push(button);
     return button;
   }
+  valueFrame(request) {
+    const frame = new DummyValueFrame(this, this.#time, request);
+    this.frames.push(frame);
+    return frame;
+  }
+  hold(request) {
+    this.#status = {
+      ...this.#status,
+      waiting: [...this.#status.waiting.filter(({ id }) => id !== request.id), request]
+    };
+    this.emit("status", this.#status);
+  }
+  ask(request) {
+    return this.#status.waiting.find(({ id, kind }) => id === request && kind === "ask");
+  }
+  #asked(request) {
+    this.#unlocked();
+    const found = this.ask(request);
+    if (!found) throw vaultFailure("ENOENT", "That request is no longer waiting.");
+    return found;
+  }
+  async seal(request, value) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    const problem = valueProblem(value);
+    if (problem) throw vaultFailure("EINVAL", problem);
+    this.answered.add(request);
+    this.#take(request);
+    return this.#seal(found.name, "settings");
+  }
+  async allow(request) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    this.answered.add(request);
+    this.revealed.push(request);
+    this.#take(request);
+    const { exe, argv, cwd, kind } = found.requester;
+    this.#log(found.name, {
+      type: "reveal",
+      uid: found.uid,
+      tag: found.tag,
+      exe,
+      argv: argv.join(" "),
+      cwd,
+      requester: kind,
+      request
+    });
+    this.emit("list", this.#list);
+  }
   autoLabel() {
     return this.#status.locked ? "Vault locked" : "Vault unlocked";
   }
@@ -7175,6 +7483,7 @@ function createDummyModel({
   if (older === "paged") agent.paginate(6, 4);
   if (hold !== "off") agent.setHold({ reason: hold, held: 2 });
   const noticePort = noticesPort(agent, time, notices, readonly, arrival);
+  const vaultPort = vault === "off" ? void 0 : new DummyVault(vault, time, vaultRecords(accounts2, mcp));
   if (scenario === "driving") void browser.run(drive);
   const base = {
     agent,
@@ -7217,11 +7526,9 @@ function createDummyModel({
     ...changes === "files" ? {} : { changes: new DummyChanges(files3, changes === "git") },
     ...noticePort ? { notices: noticePort } : {},
     ...tabs2 === "off" ? {} : { tabs: new DummyTabs(tabs2, time) },
-    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time) },
+    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time, vaultPort) },
     ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) },
-    ...vault === "off" ? {} : {
-      vault: new DummyVault(vault, time, vaultRecords(accounts2, mcp))
-    },
+    ...vaultPort ? { vault: vaultPort } : {},
     ...guestsPort(guests, time)
   };
   base.vault?.on("status", (status2) => {
@@ -7244,6 +7551,7 @@ export {
   DummyNotices,
   DummyTabs,
   DummyUpdates,
+  DummyValueFrame,
   DummyVault,
   DummyVaultButton,
   actionLimits,