@ai-ecoverse/slicc-spectrum 2.1.0 → 2.3.0

package/dist/slicc-dummy.js

@@ -29,7 +29,7 @@ import {
   skillEdit,
   tabs,
   terminals
-} from "./chunk-CQDLADJZ.js";
+} from "./chunk-47KEBIYA.js";
 import {
   Emitter
 } from "./chunk-T5NHW4KC.js";
@@ -148,6 +148,86 @@ function trayFixtures(scenario, now2) {
   const id = scenario === "tray-expired" ? "tray-url" : scenario;
   return all.filter((approval) => approval.id === id);
 }
+function secretFixtures(scenario, now2) {
+  const base = { createdAt: now2, expiresAt: now2 + 5 * minutes };
+  const enter = {
+    ...base,
+    id: "ask-harbor",
+    kind: "secret",
+    mode: "enter",
+    name: "HARBOR_DEPLOY_TOKEN",
+    prompt: "Paste the harbor deploy token from the release checklist.",
+    reveal: false,
+    requester: { kind: "user", name: "cone", where: "Terminal 1" },
+    process: {
+      exe: "/usr/bin/fnox",
+      argv: ["fnox", "set", "HARBOR_DEPLOY_TOKEN"],
+      cwd: "/home/cone/harbor"
+    }
+  };
+  const reveal = {
+    ...base,
+    id: "ask-lagoon",
+    kind: "secret",
+    mode: "reveal",
+    name: "LAGOON_API_KEY",
+    prompt: "The tide report script signs its uploads with this key.",
+    reveal: true,
+    requester: { kind: "agent", name: "docs-pass", where: "scoop:docs" },
+    process: {
+      exe: "/usr/bin/sealed",
+      argv: ["sealed", "ask", "LAGOON_API_KEY", "--reveal"],
+      cwd: "/home/cone/harbor"
+    },
+    createdAt: now2 + 1
+  };
+  if (scenario === "secret-enter") return [enter];
+  if (scenario === "secret-reveal") return [reveal];
+  if (scenario === "secret-long")
+    return [
+      {
+        ...enter,
+        id: "ask-long",
+        reveal: true,
+        requester: { kind: "agent", name: "quiet-otter" },
+        prompt: `Paste it\u202Eevil\r${"and wait. ".repeat(30)}`,
+        process: {
+          exe: "/usr/bin/sh",
+          argv: [
+            "sh",
+            "-c",
+            [longCommand, longCommand, longCommand].join(" && \\\n"),
+            "tide\rreport"
+          ],
+          cwd: "/home/cone/harbor\rferry"
+        }
+      }
+    ];
+  return [enter, reveal];
+}
+function pendingAsk(approval) {
+  const { kind, name: name2, where } = approval.requester;
+  return {
+    id: approval.id,
+    kind: "ask",
+    name: approval.name,
+    ...approval.prompt ? { prompt: approval.prompt } : {},
+    mode: approval.mode,
+    reveal: approval.reveal,
+    requester: {
+      kind,
+      name: name2,
+      ...where ? { where } : {},
+      ...approval.process,
+      tty: kind === "user" ? "/dev/pts/1" : null,
+      stdin: kind === "user" ? "tty" : "pipe"
+    },
+    uid: 1e3,
+    tag: kind,
+    createdAt: approval.createdAt,
+    expiresAt: approval.expiresAt
+  };
+}
 function levelFixture(scenario, now2) {
   const base = {
     id: `sudo-${scenario}`,
@@ -296,6 +376,7 @@ function approvalFixtures(scenario, now2 = Date.now()) {
   if (scenario === "guest" || scenario === "guest-follower") return guestFixtures(now2);
   if (scenario === "guest-always") return guestAlways(now2);
   if (scenario.startsWith("tray")) return trayFixtures(scenario, now2);
+  if (scenario.startsWith("secret-") || scenario === "secret") return secretFixtures(scenario, now2);
   if (scenario.startsWith("guest-")) return [guestCall(scenario, now2)];
   if (scenario === "none") return [];
   if (scenario === "long")
@@ -355,12 +436,20 @@ var DummyApprovals = class extends Emitter {
   #approvals;
   #time;
   #fail;
+  #vault;
+  #quiet = /* @__PURE__ */ new Set();
   decisions = [];
   decide;
-  constructor(scenario, time) {
+  constructor(scenario, time, vault) {
     super();
     this.#approvals = approvalFixtures(scenario);
     this.#time = time;
+    this.#vault = vault;
+    if (vault) {
+      for (const approval of this.#approvals)
+        if (approval.kind === "secret") vault.hold(pendingAsk(approval));
+      vault.on("status", (status2) => this.#left(status2.waiting));
+    }
     this.#fail = scenario === "fail";
     if (scenario !== "follower" && scenario !== "guest-follower")
       this.decide = (id, decision) => this.#decide(id, decision);
@@ -370,10 +459,24 @@ var DummyApprovals = class extends Emitter {
       void time.sleep(100).then(() => this.end("tray-url", "expired"));
   }
   raise(approval) {
+    if (approval.kind === "secret") this.#vault?.hold(pendingAsk(approval));
     this.#approvals = [...this.#approvals.filter(({ id }) => id !== approval.id), approval];
     this.emit("approvals", this.list());
   }
+  #left(waiting2) {
+    const vault = this.#vault;
+    for (const approval of this.#approvals) {
+      if (approval.kind !== "secret" || waiting2.some(({ id }) => id === approval.id)) continue;
+      if (vault.answered.has(approval.id) || this.#quiet.has(approval.id)) this.#drop(approval.id);
+      else this.end(approval.id, "answered");
+    }
+  }
+  #drop(id) {
+    this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
+    this.emit("approvals", this.list());
+  }
   end(id, reason) {
+    if (!this.#approvals.some((approval) => approval.id === id)) return;
     this.emit("ended", { id, reason });
     this.#approvals = this.#approvals.filter((approval) => approval.id !== id);
     this.emit("approvals", this.list());
@@ -385,7 +488,14 @@ var DummyApprovals = class extends Emitter {
     await this.#time.sleep(10);
     if (this.#fail) throw new Error("The kernel stopped waiting. Run the command again.");
     if (id === "guest-late") throw new Error("Someone else already answered this.");
+    const approval = this.#approvals.find((item) => item.id === id);
+    if (approval?.kind === "secret" && decision !== "deny")
+      throw new Error("Save or Allow in the vault\u2019s frame.");
     this.decisions.push([id, decision]);
+    if (approval?.kind === "secret" && this.#vault?.ask(id)) {
+      this.#quiet.add(id);
+      await this.#vault.cancel(id);
+    }
     this.end(id, "answered");
   }
 };
@@ -6351,7 +6461,8 @@ function vaultAudit(now2 = Date.now()) {
           secret: "HARBOR_API_KEY",
           from: ["proxy", "device:link-pier"],
           to: ["proxy", "tailscale", "device:link-pier"]
-        }
+        },
+        { kind: "reveal", field: "agent", from: true, to: false }
       ]
     },
     {
@@ -6750,6 +6861,151 @@ var DummyVaultButton = class {
     this.#emit({ event: "popup", intent: resolved, state: "done" });
   }
 };
+var DummyValueFrame = class {
+  element;
+  request;
+  config = null;
+  messages = [];
+  arming = 500;
+  #listeners = /* @__PURE__ */ new Set();
+  #vault;
+  #box;
+  #view = "";
+  #armed = false;
+  #finished = false;
+  #sizes = new ResizeObserver(() => this.#size());
+  constructor(vault, time, request) {
+    this.#vault = vault;
+    this.request = request;
+    this.element = document.createElement("div");
+    this.element.dataset.vaultValue = "";
+    this.#box = document.createElement("div");
+    this.#box.style.padding = "2px";
+    this.element.append(this.#box);
+    this.element.addEventListener("keydown", (event) => {
+      if (event.key !== "Escape" || event.isComposing) return;
+      event.preventDefault();
+      event.stopPropagation();
+      this.#emit({ event: "escape" });
+    });
+    vault.on("status", () => this.#render());
+    this.#sizes.observe(this.#box);
+    void time.sleep(0).then(() => this.#emit({ event: "ready" }));
+  }
+  post(message) {
+    this.messages.push(message);
+    if (message.op === "focus") {
+      this.#box.querySelector("input, swc-button")?.focus();
+      return;
+    }
+    this.request = message.request;
+    this.config = message.config;
+    this.element.style.colorScheme = message.config.theme ?? "";
+    this.#render();
+  }
+  listen(listener) {
+    this.#listeners.add(listener);
+    return () => this.#listeners.delete(listener);
+  }
+  #emit(event) {
+    const message = { type: "slicc-vault", v: 1, ...event };
+    for (const listener of [...this.#listeners]) listener(message);
+  }
+  #size() {
+    const { width, height } = this.#box.getBoundingClientRect();
+    this.#emit({ event: "size", width: Math.ceil(width), height: Math.ceil(height), inset: 2 });
+  }
+  #render() {
+    if (!this.config || this.#finished) return;
+    const ask2 = this.#vault.ask(this.request);
+    if (!ask2) {
+      this.#finished = true;
+      this.#box.replaceChildren();
+      this.#emit({ event: "gone", request: this.request, state: "cancelled" });
+      return;
+    }
+    const view = this.#vault.status()?.locked ? "locked" : ask2.mode ?? "enter";
+    if (view === this.#view) return;
+    if (view !== "locked" && (this.#view === "" || this.#view === "locked"))
+      setTimeout(() => {
+        this.#armed = true;
+        this.#arm();
+      }, this.arming);
+    this.#view = view;
+    this.#box.replaceChildren(...this.#controls(view, ask2));
+    this.#arm();
+    this.#size();
+  }
+  #arm() {
+    for (const button of this.#box.querySelectorAll("[data-action=save], [data-action=allow]"))
+      button.toggleAttribute("disabled", !this.#armed);
+  }
+  #button(action, label2, variant, click) {
+    const button = document.createElement("swc-button");
+    button.dataset.action = action;
+    button.setAttribute("variant", variant);
+    button.textContent = label2;
+    button.addEventListener("click", click);
+    return button;
+  }
+  #controls(view, ask2) {
+    const text = document.createElement("p");
+    text.style.margin = "0 0 8px";
+    const problem = document.createElement("p");
+    problem.dataset.problem = "";
+    problem.style.margin = "8px 0 0";
+    if (view === "locked") {
+      text.textContent = "Unlock the vault to answer.";
+      return [
+        text,
+        this.#button("unlock", "Unlock", "accent", () => {
+          void this.#vault.answer({ kind: "unlock" });
+        })
+      ];
+    }
+    if (view === "reveal") {
+      text.textContent = `${ask2.requester?.exe} gets the plaintext of ${ask2.name}`;
+      return [
+        text,
+        this.#button("allow", "Allow", "negative", () => void this.#answer(problem, "")),
+        problem
+      ];
+    }
+    const label2 = document.createElement("label");
+    label2.textContent = `Value for ${ask2.name}`;
+    label2.style.display = "grid";
+    const input = document.createElement("input");
+    input.type = "password";
+    input.dataset.field = "value";
+    input.autocomplete = "off";
+    label2.append(input);
+    text.append(label2);
+    return [
+      text,
+      this.#button("save", "Save", "accent", () => {
+        const value = input.value;
+        input.value = "";
+        void this.#answer(problem, value);
+      }),
+      problem
+    ];
+  }
+  async #answer(problem, value) {
+    const reveal = this.#view === "reveal";
+    problem.textContent = "";
+    this.#finished = true;
+    try {
+      if (reveal) await this.#vault.allow(this.request);
+      else await this.#vault.seal(this.request, value);
+      this.#emit({ event: "done", request: this.request, state: reveal ? "allowed" : "sealed" });
+    } catch (error) {
+      this.#finished = false;
+      const { code, message } = error;
+      if (code === "EINVAL") problem.textContent = message;
+      else this.#emit({ event: "error", code, message });
+    }
+  }
+};
 var DummyVault = class extends Emitter {
   #status;
   #list;
@@ -6759,6 +7015,9 @@ var DummyVault = class extends Emitter {
   #older = vaultOlder();
   #serial = 0;
   buttons = [];
+  frames = [];
+  answered = /* @__PURE__ */ new Set();
+  revealed = [];
   puts = [];
   endpointChanges = [];
   settingsCalls = [];
@@ -7033,6 +7292,55 @@ var DummyVault = class extends Emitter {
     this.buttons.push(button);
     return button;
   }
+  valueFrame(request) {
+    const frame = new DummyValueFrame(this, this.#time, request);
+    this.frames.push(frame);
+    return frame;
+  }
+  hold(request) {
+    this.#status = {
+      ...this.#status,
+      waiting: [...this.#status.waiting.filter(({ id }) => id !== request.id), request]
+    };
+    this.emit("status", this.#status);
+  }
+  ask(request) {
+    return this.#status.waiting.find(({ id, kind }) => id === request && kind === "ask");
+  }
+  #asked(request) {
+    this.#unlocked();
+    const found = this.ask(request);
+    if (!found) throw vaultFailure("ENOENT", "That request is no longer waiting.");
+    return found;
+  }
+  async seal(request, value) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    const problem = valueProblem(value);
+    if (problem) throw vaultFailure("EINVAL", problem);
+    this.answered.add(request);
+    this.#take(request);
+    return this.#seal(found.name, "settings");
+  }
+  async allow(request) {
+    await this.#time.sleep(5);
+    const found = this.#asked(request);
+    this.answered.add(request);
+    this.revealed.push(request);
+    this.#take(request);
+    const { exe, argv, cwd, kind } = found.requester;
+    this.#log(found.name, {
+      type: "reveal",
+      uid: found.uid,
+      tag: found.tag,
+      exe,
+      argv: argv.join(" "),
+      cwd,
+      requester: kind,
+      request
+    });
+    this.emit("list", this.#list);
+  }
   autoLabel() {
     return this.#status.locked ? "Vault locked" : "Vault unlocked";
   }
@@ -7175,6 +7483,7 @@ function createDummyModel({
   if (older === "paged") agent.paginate(6, 4);
   if (hold !== "off") agent.setHold({ reason: hold, held: 2 });
   const noticePort = noticesPort(agent, time, notices, readonly, arrival);
+  const vaultPort = vault === "off" ? void 0 : new DummyVault(vault, time, vaultRecords(accounts2, mcp));
   if (scenario === "driving") void browser.run(drive);
   const base = {
     agent,
@@ -7217,11 +7526,9 @@ function createDummyModel({
     ...changes === "files" ? {} : { changes: new DummyChanges(files3, changes === "git") },
     ...noticePort ? { notices: noticePort } : {},
     ...tabs2 === "off" ? {} : { tabs: new DummyTabs(tabs2, time) },
-    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time) },
+    ...approvals === "off" ? {} : { approvals: new DummyApprovals(approvals, time, vaultPort) },
     ...follow === "off" ? {} : { follow: new DummyFollow(follow, time) },
-    ...vault === "off" ? {} : {
-      vault: new DummyVault(vault, time, vaultRecords(accounts2, mcp))
-    },
+    ...vaultPort ? { vault: vaultPort } : {},
     ...guestsPort(guests, time)
   };
   base.vault?.on("status", (status2) => {
@@ -7244,6 +7551,7 @@ export {
   DummyNotices,
   DummyTabs,
   DummyUpdates,
+  DummyValueFrame,
   DummyVault,
   DummyVaultButton,
   actionLimits,