@envseal/mcp-server 0.1.2 → 0.1.4

package/dist/bin.js

@@ -4,7 +4,7 @@ import { Broker } from '@envseal/core';
 import { selectPrompter } from '@envseal/prompters';
 import { createServer } from './index.js';
 import { parseArgv, resolveProjectRoot, USAGE, VERSION } from './cli-args.js';
-import { createProbeApproval, createUseConfirm } from './confirm.js';
+import { createProbeApproval, createRevokeConfirm, createUseConfirm } from './confirm.js';
 import { createRefusingPrompter, createStubPrompter, isStubOutcome, } from './test-prompter.js';
 // NOTE: MCP protocol owns stdout. All diagnostics MUST go to stderr.
 // Any output to stdout corrupts the JSON-RPC stream.
@@ -57,6 +57,7 @@ async function main() {
             // cannot ask anyone, and exec.ts turns that absence into "the user
             // denied the confirmation" for a user who was never asked.
             onConfirm: createUseConfirm(surface),
+            onRevokeConfirm: createRevokeConfirm(surface),
             // PLAN.md §6.4: consent before a credential goes to a host the registry
             // does not allowlist. Supplied by no binding before this.
             onApprovalNeeded: createProbeApproval(surface),

package/dist/cli-args.d.ts

@@ -2,8 +2,8 @@
  * Argument handling for the `envseal-mcp` binary, kept out of bin.ts so it can
  * be tested without importing a module whose side effect is starting a server.
  */
-export declare const VERSION = "0.1.2";
-export declare const USAGE = "envseal-mcp 0.1.2\n\nServes the SEP/1 tools to an MCP host over stdio JSON-RPC.\n\nUsage: envseal-mcp [--project <dir>]\n\nOptions:\n  --project <dir>    Project root to broker secrets for. Default: search\n                     upward from the current directory for env.schema.jsonc,\n                     .git or package.json. If none is found, this server\n                     refuses to start rather than create .envseal/ in a\n                     directory that is not a project.\n  --help, -h         Show this help and exit.\n  --version, -v      Print the version and exit.\n\nTransport: stdio only. --http and --port were removed; they were parsed and\nthen ignored, and no HTTP or SSE transport was ever implemented. For an HTTP\nsurface use @envseal/http-server, which speaks REST + OpenAPI on loopback --\nthat is a different protocol, not MCP over HTTP.\n";
+export declare const VERSION = "0.1.4";
+export declare const USAGE = "envseal-mcp 0.1.4\n\nServes the SEP/1 tools to an MCP host over stdio JSON-RPC.\n\nUsage: envseal-mcp [--project <dir>]\n\nOptions:\n  --project <dir>    Project root to broker secrets for. Default: search\n                     upward from the current directory for env.schema.jsonc,\n                     .git or package.json. If none is found, this server\n                     refuses to start rather than create .envseal/ in a\n                     directory that is not a project.\n  --help, -h         Show this help and exit.\n  --version, -v      Print the version and exit.\n\nTransport: stdio only. --http and --port were removed; they were parsed and\nthen ignored, and no HTTP or SSE transport was ever implemented. For an HTTP\nsurface use @envseal/http-server, which speaks REST + OpenAPI on loopback --\nthat is a different protocol, not MCP over HTTP.\n";
 export type ParsedArgv = {
     kind: 'help';
 } | {

package/dist/cli-args.js

@@ -5,7 +5,7 @@ import { findProjectRoot } from '@envseal/core';
  * Argument handling for the `envseal-mcp` binary, kept out of bin.ts so it can
  * be tested without importing a module whose side effect is starting a server.
  */
-export const VERSION = '0.1.2';
+export const VERSION = '0.1.4';
 export const USAGE = `envseal-mcp ${VERSION}
 
 Serves the SEP/1 tools to an MCP host over stdio JSON-RPC.

package/dist/confirm.d.ts

@@ -1,4 +1,4 @@
-import type { BrokerOptions } from '@envseal/core';
+import { escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, type BrokerOptions, type TargetInfo } from '@envseal/core';
 import type { ManifestEntry, VerifyResult } from '@envseal/protocol';
 import type { Prompter } from '@envseal/prompters';
 /**
@@ -18,16 +18,16 @@ import type { Prompter } from '@envseal/prompters';
  * between a prompt-injected model and arbitrary code holding live
  * credentials. In CI these operations are simply unavailable, and say so.
  *
- * DUPLICATION: this file is a hand-maintained twin of
- * packages/sdk/src/confirm.ts. Its natural home is a `confirm()` method
- * on the `Prompter` interface — every surface already knows how to draw a
- * dialog — but @envseal/mcp-server does not depend on @envseal/sdk, and
- * @envseal/prompters was outside the scope of the change that added this. Both
- * packages test the behaviour independently, so drift shows up as a red test
- * rather than as a binding that quietly stops asking.
+ * DUPLICATION: this file remains a hand-maintained twin of
+ * packages/sdk/src/confirm.ts for the ask/outcome mapping, but the dialog
+ * BODY (escaping, truncation caps, fingerprints, warnings) is shared via
+ * useConfirmationBody from @envseal/core so the CLI, SDK and MCP surfaces
+ * can never drift on what the user is shown.
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export declare const CONFIRM_KEY_USE = "APPROVE";
+/** Value-entry key name carrying the `env_revoke` confirmation. */
+export declare const CONFIRM_KEY_REVOKE = "APPROVE_REVOKE";
 /** Value-entry key name carrying the `env_verify` probe-consent question. */
 export declare const CONFIRM_KEY_PROBE = "APPROVE_PROBE";
 export interface ConfirmSurface {
@@ -40,11 +40,15 @@ export interface ConfirmSurface {
     prompter: () => Promise<Prompter>;
     timeoutMs?: number;
 }
+export declare const escapeForDisplay: typeof coreEscapeForDisplay;
+export declare const displayArg: typeof coreDisplayArg;
 export declare function useConfirmationBody(info: {
     command: string[];
     keys: string[];
     networkEgress: boolean;
+    target?: TargetInfo;
 }, projectRoot: string): string;
+export declare function revokeConfirmationBody(keys: string[], projectRoot: string): string;
 export declare function probeConfirmationBody(entry: ManifestEntry): string | null;
 /**
  * `onConfirm` for the Broker: gates `env_use`.
@@ -55,6 +59,13 @@ export declare function probeConfirmationBody(entry: ManifestEntry): string | nu
  * or for a silence — the defect this project already fixed once in the CLI.
  */
 export declare function createUseConfirm(surface: ConfirmSurface): NonNullable<BrokerOptions['onConfirm']>;
+/**
+ * `onRevokeConfirm` for the Broker: gates `env_revoke`.
+ *
+ * Same ask/outcome mapping as createUseConfirm. Throws rather than returning
+ * false when no human could be asked or when the ask expired unanswered.
+ */
+export declare function createRevokeConfirm(surface: ConfirmSurface): NonNullable<BrokerOptions['onRevokeConfirm']>;
 /**
  * `onApprovalNeeded` for the Broker: PLAN.md §6.4 probe consent for
  * `env_verify` against a host that is not registry-allowlisted.

package/dist/confirm.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { useConfirmationBody as sharedUseConfirmationBody, revokeConfirmationBody as sharedRevokeConfirmationBody, escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, } from '@envseal/core';
 import { SepError, zero } from '@envseal/protocol';
 import { makeDisplayNonce } from '@envseal/prompters';
 /**
@@ -18,21 +19,19 @@ import { makeDisplayNonce } from '@envseal/prompters';
  * between a prompt-injected model and arbitrary code holding live
  * credentials. In CI these operations are simply unavailable, and say so.
  *
- * DUPLICATION: this file is a hand-maintained twin of
- * packages/sdk/src/confirm.ts. Its natural home is a `confirm()` method
- * on the `Prompter` interface — every surface already knows how to draw a
- * dialog — but @envseal/mcp-server does not depend on @envseal/sdk, and
- * @envseal/prompters was outside the scope of the change that added this. Both
- * packages test the behaviour independently, so drift shows up as a red test
- * rather than as a binding that quietly stops asking.
+ * DUPLICATION: this file remains a hand-maintained twin of
+ * packages/sdk/src/confirm.ts for the ask/outcome mapping, but the dialog
+ * BODY (escaping, truncation caps, fingerprints, warnings) is shared via
+ * useConfirmationBody from @envseal/core so the CLI, SDK and MCP surfaces
+ * can never drift on what the user is shown.
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export const CONFIRM_KEY_USE = 'APPROVE';
+/** Value-entry key name carrying the `env_revoke` confirmation. */
+export const CONFIRM_KEY_REVOKE = 'APPROVE_REVOKE';
 /** Value-entry key name carrying the `env_verify` probe-consent question. */
 export const CONFIRM_KEY_PROBE = 'APPROVE_PROBE';
 const DEFAULT_TIMEOUT_MS = 120_000;
-/** Per-argument display cap; longer arguments are shown truncated, and said to be. */
-const MAX_ARG_CHARS = 300;
 /** Whole-dialog cap. Past this we refuse rather than ask about something unreadable. */
 const MAX_BODY_CHARS = 16 * 1024;
 const INSTRUCTION = 'Type yes to approve, or submit an empty box to deny.';
@@ -41,57 +40,16 @@ const INSTRUCTION = 'Type yes to approve, or submit an empty box to deny.';
  * `env_use` in a loop and stack up dialogs until one gets clicked through.
  */
 let confirmationOpen = false;
-/**
- * Model-supplied argv, key names and probe metadata land in a dialog the user
- * is about to trust. A raw newline lets a crafted argument forge extra lines —
- * "keys: none", "this command is safe" — inside the very block that exists to
- * tell the truth about the command. Render control characters visibly instead.
- */
-function escapeForDisplay(value) {
-    let out = '';
-    for (const ch of value) {
-        const code = ch.codePointAt(0) ?? 0;
-        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
-            out += `<0x${code.toString(16).padStart(2, '0')}>`;
-        }
-        else {
-            out += ch;
-        }
-    }
-    return out;
-}
-function displayArg(arg) {
-    const escaped = escapeForDisplay(arg);
-    if (escaped.length <= MAX_ARG_CHARS) {
-        return escaped;
-    }
-    const hidden = escaped.length - MAX_ARG_CHARS;
-    return `${escaped.slice(0, MAX_ARG_CHARS)}[... ${hidden} more characters, not shown]`;
-}
+// Re-exported so existing importers of the twins keep working; the
+// implementations live in @envseal/core/display.ts and are shared across
+// every binding (CLI, SDK and MCP alike).
+export const escapeForDisplay = coreEscapeForDisplay;
+export const displayArg = coreDisplayArg;
 export function useConfirmationBody(info, projectRoot) {
-    const lines = [
-        'EnvSeal is about to run a program with these secrets in its environment.',
-        '',
-        `  project: ${escapeForDisplay(projectRoot)}`,
-        `  keys:    ${info.keys.length > 0 ? info.keys.map(escapeForDisplay).join(', ') : '(none)'}`,
-        '',
-        '  command, one argument per line, exactly as it will be run (no shell):',
-    ];
-    info.command.forEach((arg, index) => {
-        lines.push(`    [${index}] ${displayArg(arg)}`);
-    });
-    lines.push('');
-    if (info.networkEgress) {
-        lines.push('  WARNING: this command can reach the network, so it could send these', '           values somewhere. Only continue if you trust it.');
-    }
-    else {
-        // Honest about what the check is worth: NETWORK_TOOLS plus a URL scan is a
-        // heuristic, and claiming more would be the kind of overstatement this
-        // project has already had to walk back once.
-        lines.push('  No network tool or URL was recognised in this command. That is a', '  heuristic, not a guarantee: any program can open a socket.');
-    }
-    lines.push('', `${INSTRUCTION} Nothing runs unless you approve.`);
-    return lines.join('\n');
+    return sharedUseConfirmationBody(info, projectRoot);
+}
+export function revokeConfirmationBody(keys, projectRoot) {
+    return sharedRevokeConfirmationBody(keys, projectRoot);
 }
 export function probeConfirmationBody(entry) {
     const probe = entry.verify;
@@ -207,6 +165,50 @@ export function createUseConfirm(surface) {
         }
     };
 }
+/**
+ * `onRevokeConfirm` for the Broker: gates `env_revoke`.
+ *
+ * Same ask/outcome mapping as createUseConfirm. Throws rather than returning
+ * false when no human could be asked or when the ask expired unanswered.
+ */
+export function createRevokeConfirm(surface) {
+    return async (keys) => {
+        const outcome = await ask(surface, CONFIRM_KEY_REVOKE, 'Approve removing stored credentials? Nothing has been removed yet.', revokeConfirmationBody(keys, surface.projectRoot));
+        switch (outcome) {
+            case 'approved':
+                return true;
+            case 'denied':
+                return false;
+            case 'timed-out':
+                throw new SepError({
+                    code: 'SEP_TICKET_EXPIRED',
+                    userMessage: 'The env_revoke confirmation closed after its timeout with nobody answering it. Nothing was ' +
+                        'removed. This is not a denial: ask the user to approve it, then call env_revoke again.',
+                });
+            case 'no-surface':
+                throw new SepError({
+                    code: 'SEP_NO_INTERACTIVE_SURFACE',
+                    userMessage: 'env_revoke needs the user to confirm before stored credentials are removed, ' +
+                        'but there is no interactive surface here to ask on (this is what CI looks like to envseal). ' +
+                        'Nothing was removed. ' +
+                        'There is no flag or environment variable that skips this prompt in this binding: the request ' +
+                        'came from a model, and the confirmation is the only control on it. ' +
+                        'Run `envseal revoke` yourself in a session that has a browser or a terminal.',
+                });
+            case 'busy':
+                throw new SepError({
+                    code: 'SEP_RATE_LIMITED',
+                    userMessage: 'Another envseal confirmation is already open. Answer that one first, then call env_revoke again.',
+                });
+            case 'too-large':
+                throw new SepError({
+                    code: 'SEP_FORMAT_INVALID',
+                    userMessage: 'This revoke request is too large to display in a confirmation dialog, and envseal will not ask ' +
+                        'anyone to approve something it cannot show them. Revoke fewer keys at once.',
+                });
+        }
+    };
+}
 /**
  * `onApprovalNeeded` for the Broker: PLAN.md §6.4 probe consent for
  * `env_verify` against a host that is not registry-allowlisted.
@@ -219,7 +221,7 @@ export function createUseConfirm(surface) {
  */
 export function createProbeApproval(surface) {
     return async (entry) => {
-        const outcome = await ask(surface, CONFIRM_KEY_PROBE, `Approve sending ${entry.key} to a host that is not on envseal's allowlist? Nothing has been sent yet.`, probeConfirmationBody(entry));
+        const outcome = await ask(surface, CONFIRM_KEY_PROBE, `Approve sending ${escapeForDisplay(entry.key)} to a host that is not on envseal's allowlist? Nothing has been sent yet.`, probeConfirmationBody(entry));
         return outcome === 'approved';
     };
 }

package/dist/test-prompter.js

@@ -24,14 +24,22 @@ export function createStubPrompter(value) {
     return {
         id: 'ide',
         available: async () => true,
-        prompt: async (req) => ({
-            ticket: req.ticket,
-            results: req.keys.map((k) => ({
-                key: k.key,
-                outcome: 'entered',
-                value: secretFromUtf8(value),
-            })),
-        }),
+        prompt: async (req) => {
+            // Announce the stub on stderr, mirroring the CLI's probe-approval
+            // notice: any answer that did not come from a human must be visible in
+            // the transcript. A model that discovers the two-variable gate cannot
+            // use it as a silent approval oracle.
+            process.stderr.write(`ENVSEAL_TEST_MODE: prompter is a STUB — key(s) [${req.keys.map((k) => k.key).join(', ')}] ` +
+                `answered from ENVSEAL_TEST_PROMPTER_VALUE with no UI.\n`);
+            return {
+                ticket: req.ticket,
+                results: req.keys.map((k) => ({
+                    key: k.key,
+                    outcome: 'entered',
+                    value: secretFromUtf8(value),
+                })),
+            };
+        },
         cancel: async () => {
             /* nothing to tear down */
         },

package/dist/tools/declare.d.ts

@@ -8,7 +8,7 @@ export declare const inputSchema: import("zod").ZodObject<{
         required: import("zod").ZodDefault<import("zod").ZodBoolean>;
         secret: import("zod").ZodDefault<import("zod").ZodBoolean>;
         format: import("zod").ZodOptional<import("zod").ZodObject<{
-            pattern: import("zod").ZodOptional<import("zod").ZodString>;
+            pattern: import("zod").ZodOptional<import("zod").ZodEffects<import("zod").ZodString, string, string>>;
             minLength: import("zod").ZodOptional<import("zod").ZodNumber>;
             maxLength: import("zod").ZodOptional<import("zod").ZodNumber>;
             example: import("zod").ZodOptional<import("zod").ZodString>;

package/dist/tools/revoke.d.ts

@@ -1,6 +1,6 @@
 import type { Broker } from '@envseal/core';
 export declare const name = "env_revoke";
-export declare const description = "Removes stored credentials. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.";
+export declare const description = "Removes stored credentials after user confirmation. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.";
 export declare const inputSchema: import("zod").ZodObject<{
     keys: import("zod").ZodArray<import("zod").ZodString, "many">;
 }, "strict", import("zod").ZodTypeAny, {

package/dist/tools/revoke.js

@@ -1,7 +1,7 @@
 import { EnvRevokeInput, INPUT_SCHEMAS } from '@envseal/protocol';
 import { respond, respondError } from '../respond.js';
 export const name = 'env_revoke';
-export const description = 'Removes stored credentials. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.';
+export const description = 'Removes stored credentials after user confirmation. Records in the audit log and emits the provider rotation URL so you can help the user invalidate the old key.';
 export const inputSchema = INPUT_SCHEMAS.env_revoke;
 export async function handler(args, broker) {
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/mcp-server",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -25,10 +25,10 @@
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.13.0",
     "zod": "^3.24.1",
-    "@envseal/protocol": "0.1.2",
-    "@envseal/core": "0.1.2",
-    "@envseal/registry": "0.1.2",
-    "@envseal/prompters": "0.1.2"
+    "@envseal/protocol": "0.1.4",
+    "@envseal/core": "0.1.4",
+    "@envseal/registry": "0.1.4",
+    "@envseal/prompters": "0.1.4"
   },
   "devDependencies": {
     "tsx": "^4.19.2",