@ai-ecoverse/wasi-fnox 1.45.0-2 → 1.46.0-2

package/README.md

@@ -1,6 +1,6 @@
 # @ai-ecoverse/wasi-fnox
 
-[fnox](https://fnox.jdx.dev) 1.45 for [slicc](https://github.com/ai-ecoverse/slicc)'s kernel: a WASI preview1 command, `fnox`, built from upstream jdx/fnox v1.45.0 with [homescoop's patch series](https://github.com/ai-ecoverse/homescoop/tree/main/packages/wasi-fnox) (`NNNN-*.patch`, listed in `recipe.yaml`). The patches are carried by homescoop, not upstreamed.
+[fnox](https://fnox.jdx.dev) 1.46 for [slicc](https://github.com/ai-ecoverse/slicc)'s kernel: a WASI preview1 command, `fnox`, built from upstream jdx/fnox v1.46.0 with [homescoop's patch series](https://github.com/ai-ecoverse/homescoop/tree/main/packages/wasi-fnox) (`NNNN-*.patch`, listed in `recipe.yaml`). The patches are carried by homescoop, not upstreamed.
 
 ## In seven
 
@@ -22,11 +22,11 @@ Seven's vault holds the secret values, and fnox keeps only placeholders. The vau
 - **`fnox proxy rules --json`:** prints a project's rules as proposals.
 - **`fnox check`:** asks the vault about each sealed record.
 - **`fnox deactivate`:** removes the shell hooks and the `fnox` function even if the binary is gone (since 1.42.1), as upstream.
-- **Refused:** `as_file` secrets, `sync`, `reencrypt`, `fnox edit`, `fnox files`, and `fnox set|get --file` (use `fnox set` / `fnox get`).
+- **Refused:** `as_file` secrets, `sync`, `reencrypt`, `fnox edit`, `fnox files`, `fnox set|get --file` (use `fnox set` / `fnox get`), and since 1.46.0 proxy rules that name a `lease` (native short-lived credentials).
 - **age:** decrypting an age secret isn't supported yet (slicc-vault#2). Encrypting to age recipients works.
 - **Other providers:** only `sealed`, `age` and `plain` are built. Values from `plain` are passed on with a warning.
 - **Templates:** a secret's `default` and a provider's string fields can use `{{ fnox.profile }}` and `{{ fnox.profiles }}` (Tera, since 1.41), as upstream. A sealed secret's `value`, its placeholder, is never rendered.
-- **Not in this build:** leases (including managed identity for `azure-token`), the daemon, the TUI, the MCP server (including `request_secret`), secret-file write paths, and Lua provider plugins (`fnox plugin`).
+- **Not in this build:** leases (including managed identity for `azure-token`), `fnox push` and push targets (since 1.46.0), the daemon, the TUI, the MCP server (including `request_secret`), secret-file write paths, and Lua provider plugins (`fnox plugin`).
 
 It needs slicc-kernel 1.175.0 or later (`engines`): `/dev/sealed` arrived in slicc-kernel 1.68.0 (KS-2), the exec tickets that `fnox exec` redeems in slicc-kernel 1.83.0 (KS-8), and the `ask` op that the vault dialog of `fnox set` uses in slicc-kernel 1.175.0. On an older kernel the dialog fails with `seven: /dev/sealed refused ask: EINVAL`, and a piped `fnox set` still works.
 
@@ -36,7 +36,7 @@ Without `/dev/sealed`, every sealed operation fails with `not running in seven:
 
 fnox is MIT (see `LICENSE`). `THIRD-PARTY-NOTICES.md` lists the crates, Rust's standard library and wasi-libc that `bin/fnox.wasm` links.
 
-## WASI support for fnox 1.45
+## WASI support for fnox 1.46
 
 `fnox exec --only` and `--except` retain upstream filtering: excluded providers are not resolved, dependencies are resolved without being exported, and excluded configured values are not injected. Inherited environment variables retain their original values unless the child plan replaces or removes them; these flags do not clear the environment. The WASI child starts from the environment captured before resolution, so a resolved interpolation dependency cannot enter it through process-environment mutation. Sealed selections still use the kernel ticket path.
 
@@ -45,3 +45,5 @@ Exec output redaction uses helper threads upstream. This WASI build refuses `--r
 The new OAuth2, GitLab, Tailscale and Kubernetes lease backends are compiled out with the existing lease backends. `audit`, `scan --values` and `set --generate` retain upstream behavior: audit records names, scan sees sealed placeholders, and generated secrets are created inside fnox before storage (`--show` explicitly prints generated values). Staged scanning and hook installation use native process execution and are unavailable on WASI.
 
 Since 1.45.0, upstream secret files (`[files]`, `fnox files`, `set|get|edit --file`) and the MCP `request_secret` one-time page need native HTTP, tempfile and editor paths. This build refuses those commands and flags before they run; the MCP module and the native proxy HTTP stack stay compiled out.
+
+Since 1.46.0, upstream `fnox push` (CI and hosting secret stores), proxy lease credentials, and the `[files]` sync cache need native HTTP, CLIs and helper threads. This build compiles `push` and `push_targets` out, refuses proxy rules that name a `lease`, and keeps `sync` refused; port-specific `allow_private` entries still validate in the WASI proxy stub.

package/THIRD-PARTY-NOTICES.md

@@ -53952,7 +53952,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 ```
 
-## usage-argv 7.1.3 (MIT)
+## usage-argv 7.1.4 (MIT)
 
 ```text
 # Third-party notices
@@ -54176,7 +54176,7 @@ The Apache-2.0 option is available upstream at
 <https://github.com/withoutboats/heck/blob/master/LICENSE-APACHE>.
 ```
 
-## usage-config 7.1.3 (MIT)
+## usage-config 7.1.4 (MIT)
 
 ```text
 # Third-party notices
@@ -54400,7 +54400,7 @@ The Apache-2.0 option is available upstream at
 <https://github.com/withoutboats/heck/blob/master/LICENSE-APACHE>.
 ```
 
-## usage-derive 7.1.3 (MIT)
+## usage-derive 7.1.4 (MIT)
 
 ```text
 # Third-party notices
@@ -54624,7 +54624,7 @@ The Apache-2.0 option is available upstream at
 <https://github.com/withoutboats/heck/blob/master/LICENSE-APACHE>.
 ```
 
-## usage-rs 7.1.3 (MIT)
+## usage-rs 7.1.4 (MIT)
 
 ```text
 # Third-party notices
@@ -58513,7 +58513,7 @@ See the License for the specific language governing permissions and
 limitations under the License.
 ```
 
-## usage-test 7.1.3 (MIT)
+## usage-test 7.1.4 (MIT)
 
 ```text
 Copyright (c) 2025 Jeff Dickey

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-ecoverse/wasi-fnox",
-  "version": "1.45.0-2",
+  "version": "1.46.0-2",
   "description": "fnox, a secrets manager that keeps values in SLICC's sealed store and hands commands placeholders.",
   "license": "MIT",
   "repository": {
@@ -31,7 +31,7 @@
   },
   "homescoop": {
     "recipe": "wasi-fnox",
-    "upstream": "1.45.0"
+    "upstream": "1.46.0"
   },
   "slicc": {
     "abi": "wasi",