@envseal/prompters 0.1.1 → 0.1.3

package/dist/ide.d.ts

@@ -1,6 +1,6 @@
 import type { PromptRequest, PromptResponse } from './types.js';
 export declare class IdePrompter {
-    readonly id: 'ide';
+    readonly id: "ide";
     available(): Promise<boolean>;
     cancel(ticket: string): Promise<void>;
     prompt(req: PromptRequest): Promise<PromptResponse>;

package/dist/loopback.d.ts

@@ -12,7 +12,7 @@ export interface LoopbackPrompterOptions {
     }) => void;
 }
 export declare class LoopbackPrompter implements Prompter {
-    readonly id: 'loopback-browser';
+    readonly id: "loopback-browser";
     private readonly options;
     private openerProbe;
     private current;

package/dist/loopback.js

@@ -44,17 +44,29 @@ function respondText(res, status, body, headers) {
 function renderKeySection(key) {
     const sectionId = `field-${key.key}`;
     const revealId = `reveal-${key.key}`;
+    // Audit follow-up: these links are manifest/model-controlled. Rendering a
+    // polished "Get your key" button with no destination shown turned the
+    // consent page itself into a phishing referral inside trusted envseal
+    // chrome. The hostname is now part of the visible link text, so wherever
+    // the user would land is on screen before they click.
+    const externalLink = (cls, url, label) => {
+        let host;
+        try {
+            host = new URL(url).hostname;
+        }
+        catch {
+            return ''; // unreachable when isHttpUrl gates the call; fail closed anyway
+        }
+        return (`      <p class="${cls}"><a href="${escapeHtml(url)}" ` +
+            `rel="noreferrer noopener" target="_blank">${escapeHtml(label)} \u2192 ${escapeHtml(host)}</a></p>\n`);
+    };
     let signup = '';
     if (isHttpUrl(key.signupUrl ?? '')) {
-        signup =
-            `      <p class="signup"><a href="${escapeHtml(key.signupUrl ?? '')}" ` +
-                `rel="noreferrer noopener" target="_blank">Get your key</a></p>\n`;
+        signup = externalLink('signup', key.signupUrl ?? '', 'Get your key');
     }
     let docs = '';
     if (isHttpUrl(key.docsUrl ?? '')) {
-        docs =
-            `      <p class="docs"><a href="${escapeHtml(key.docsUrl ?? '')}" ` +
-                `rel="noreferrer noopener" target="_blank">Documentation</a></p>\n`;
+        docs = externalLink('docs', key.docsUrl ?? '', 'Documentation');
     }
     let hint = '';
     if (key.formatHint) {
@@ -230,7 +242,7 @@ export class LoopbackPrompter {
         const promptPromise = new Promise((resolve) => {
             resolvePrompt = resolve;
         });
-        let launchedUrl;
+        const state = {};
         let complete = () => { };
         let teardown = () => { };
         const sockets = new Set();
@@ -262,8 +274,8 @@ export class LoopbackPrompter {
             settled = true;
             clearTimeout(timer);
             teardown();
-            if (launchedUrl !== undefined) {
-                resolvePrompt({ ticket: req.ticket, results, url: launchedUrl });
+            if (state.launchedUrl !== undefined) {
+                resolvePrompt({ ticket: req.ticket, results, url: state.launchedUrl });
             }
             else {
                 resolvePrompt({ ticket: req.ticket, results });
@@ -299,7 +311,8 @@ export class LoopbackPrompter {
         const launched = this.options.openBrowser === false
             ? { ok: false, url: fallbackUrl }
             : await openBrowser(address.port, pathNonce);
-        launchedUrl = launched.ok ? undefined : launched.url;
+        if (!launched.ok)
+            state.launchedUrl = launched.url;
         const result = await promptPromise;
         if (this.current !== null && this.current.ticket === req.ticket) {
             this.current = null;

package/dist/native.d.ts

@@ -1,6 +1,6 @@
 import type { Prompter, PromptRequest, PromptResponse } from './types.js';
 export declare class NativePrompter implements Prompter {
-    readonly id: 'native-dialog';
+    readonly id: "native-dialog";
     private adapter;
     available(): Promise<boolean>;
     cancel(_ticket: string): Promise<void>;

package/dist/none.d.ts

@@ -4,7 +4,7 @@ import type { Prompter, PromptRequest, PromptResponse } from './types.js';
  * MUST NOT fall back to asking in chat.
  */
 export declare class NonePrompter implements Prompter {
-    readonly id: 'none';
+    readonly id: "none";
     available(): Promise<boolean>;
     cancel(_ticket: string): Promise<void>;
     prompt(req: PromptRequest): Promise<PromptResponse>;

package/dist/tty.d.ts

@@ -1,6 +1,6 @@
 import type { Prompter, PromptRequest, PromptResponse } from './types.js';
 export declare class TtyPrompter implements Prompter {
-    readonly id: 'tty';
+    readonly id: "tty";
     available(): Promise<boolean>;
     private openReadFd;
     private openWriteFd;

package/dist/tty.js

@@ -8,7 +8,6 @@ import { asSecret } from '@envseal/protocol';
 const POSIX_DEVICE = '/dev/tty';
 const WIN_IN = 'CONIN$';
 const WIN_OUT = 'CONOUT$';
-const ENABLE_ECHO_INPUT = 0x4;
 function isPosix() {
     return process.platform !== 'win32';
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/prompters",
-  "version": "0.1.1",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -20,7 +20,7 @@
     "provenance": true
   },
   "dependencies": {
-    "@envseal/protocol": "0.1.1"
+    "@envseal/protocol": "0.1.3"
   },
   "devDependencies": {
     "undici": "^7.2.0"