@envseal/sdk 0.1.2 → 0.1.3

package/dist/confirm.d.ts

@@ -1,4 +1,4 @@
-import type { BrokerOptions } from '@envseal/core';
+import { escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, type BrokerOptions, type TargetInfo } from '@envseal/core';
 import type { ManifestEntry, VerifyResult } from '@envseal/protocol';
 import type { Prompter } from '@envseal/prompters';
 /**
@@ -18,13 +18,11 @@ import type { Prompter } from '@envseal/prompters';
  * between a prompt-injected model and arbitrary code holding live
  * credentials. In CI these operations are simply unavailable, and say so.
  *
- * DUPLICATION: this file is a hand-maintained twin of
- * packages/mcp-server/src/confirm.ts. Its natural home is a `confirm()` method
- * on the `Prompter` interface — every surface already knows how to draw a
- * dialog — but @envseal/mcp-server does not depend on @envseal/sdk, and
- * @envseal/prompters was outside the scope of the change that added this. Both
- * packages test the behaviour independently, so drift shows up as a red test
- * rather than as a binding that quietly stops asking.
+ * DUPLICATION: this file remains a hand-maintained twin of
+ * packages/mcp-server/src/confirm.ts for the ask/outcome mapping, but the dialog
+ * BODY (escaping, truncation caps, fingerprints, warnings) is shared via
+ * useConfirmationBody from @envseal/core so the CLI, SDK and MCP surfaces
+ * can never drift on what the user is shown.
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export declare const CONFIRM_KEY_USE = "APPROVE";
@@ -40,10 +38,13 @@ export interface ConfirmSurface {
     prompter: () => Promise<Prompter>;
     timeoutMs?: number;
 }
+export declare const escapeForDisplay: typeof coreEscapeForDisplay;
+export declare const displayArg: typeof coreDisplayArg;
 export declare function useConfirmationBody(info: {
     command: string[];
     keys: string[];
     networkEgress: boolean;
+    target?: TargetInfo;
 }, projectRoot: string): string;
 export declare function probeConfirmationBody(entry: ManifestEntry): string | null;
 /**

package/dist/confirm.js

@@ -1,4 +1,5 @@
 import { randomBytes } from 'node:crypto';
+import { useConfirmationBody as sharedUseConfirmationBody, escapeForDisplay as coreEscapeForDisplay, displayArg as coreDisplayArg, } from '@envseal/core';
 import { SepError, zero } from '@envseal/protocol';
 import { makeDisplayNonce } from '@envseal/prompters';
 /**
@@ -18,21 +19,17 @@ import { makeDisplayNonce } from '@envseal/prompters';
  * between a prompt-injected model and arbitrary code holding live
  * credentials. In CI these operations are simply unavailable, and say so.
  *
- * DUPLICATION: this file is a hand-maintained twin of
- * packages/mcp-server/src/confirm.ts. Its natural home is a `confirm()` method
- * on the `Prompter` interface — every surface already knows how to draw a
- * dialog — but @envseal/mcp-server does not depend on @envseal/sdk, and
- * @envseal/prompters was outside the scope of the change that added this. Both
- * packages test the behaviour independently, so drift shows up as a red test
- * rather than as a binding that quietly stops asking.
+ * DUPLICATION: this file remains a hand-maintained twin of
+ * packages/mcp-server/src/confirm.ts for the ask/outcome mapping, but the dialog
+ * BODY (escaping, truncation caps, fingerprints, warnings) is shared via
+ * useConfirmationBody from @envseal/core so the CLI, SDK and MCP surfaces
+ * can never drift on what the user is shown.
  */
 /** Value-entry key name carrying the `env_use` confirmation. */
 export const CONFIRM_KEY_USE = 'APPROVE';
 /** Value-entry key name carrying the `env_verify` probe-consent question. */
 export const CONFIRM_KEY_PROBE = 'APPROVE_PROBE';
 const DEFAULT_TIMEOUT_MS = 120_000;
-/** Per-argument display cap; longer arguments are shown truncated, and said to be. */
-const MAX_ARG_CHARS = 300;
 /** Whole-dialog cap. Past this we refuse rather than ask about something unreadable. */
 const MAX_BODY_CHARS = 16 * 1024;
 const INSTRUCTION = 'Type yes to approve, or submit an empty box to deny.';
@@ -41,57 +38,13 @@ const INSTRUCTION = 'Type yes to approve, or submit an empty box to deny.';
  * `env_use` in a loop and stack up dialogs until one gets clicked through.
  */
 let confirmationOpen = false;
-/**
- * Model-supplied argv, key names and probe metadata land in a dialog the user
- * is about to trust. A raw newline lets a crafted argument forge extra lines —
- * "keys: none", "this command is safe" — inside the very block that exists to
- * tell the truth about the command. Render control characters visibly instead.
- */
-function escapeForDisplay(value) {
-    let out = '';
-    for (const ch of value) {
-        const code = ch.codePointAt(0) ?? 0;
-        if (code < 0x20 || (code >= 0x7f && code <= 0x9f)) {
-            out += `<0x${code.toString(16).padStart(2, '0')}>`;
-        }
-        else {
-            out += ch;
-        }
-    }
-    return out;
-}
-function displayArg(arg) {
-    const escaped = escapeForDisplay(arg);
-    if (escaped.length <= MAX_ARG_CHARS) {
-        return escaped;
-    }
-    const hidden = escaped.length - MAX_ARG_CHARS;
-    return `${escaped.slice(0, MAX_ARG_CHARS)}[... ${hidden} more characters, not shown]`;
-}
+// Re-exported so existing importers of the twins keep working; the
+// implementations live in @envseal/core/display.ts and are shared across
+// every binding (CLI, SDK and MCP alike).
+export const escapeForDisplay = coreEscapeForDisplay;
+export const displayArg = coreDisplayArg;
 export function useConfirmationBody(info, projectRoot) {
-    const lines = [
-        'EnvSeal is about to run a program with these secrets in its environment.',
-        '',
-        `  project: ${escapeForDisplay(projectRoot)}`,
-        `  keys:    ${info.keys.length > 0 ? info.keys.map(escapeForDisplay).join(', ') : '(none)'}`,
-        '',
-        '  command, one argument per line, exactly as it will be run (no shell):',
-    ];
-    info.command.forEach((arg, index) => {
-        lines.push(`    [${index}] ${displayArg(arg)}`);
-    });
-    lines.push('');
-    if (info.networkEgress) {
-        lines.push('  WARNING: this command can reach the network, so it could send these', '           values somewhere. Only continue if you trust it.');
-    }
-    else {
-        // Honest about what the check is worth: NETWORK_TOOLS plus a URL scan is a
-        // heuristic, and claiming more would be the kind of overstatement this
-        // project has already had to walk back once.
-        lines.push('  No network tool or URL was recognised in this command. That is a', '  heuristic, not a guarantee: any program can open a socket.');
-    }
-    lines.push('', `${INSTRUCTION} Nothing runs unless you approve.`);
-    return lines.join('\n');
+    return sharedUseConfirmationBody(info, projectRoot);
 }
 export function probeConfirmationBody(entry) {
     const probe = entry.verify;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@envseal/sdk",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "type": "module",
   "license": "Apache-2.0",
   "main": "./dist/index.js",
@@ -21,10 +21,10 @@
   },
   "dependencies": {
     "zod-to-json-schema": "^3.24.1",
-    "@envseal/protocol": "0.1.2",
-    "@envseal/prompters": "0.1.2",
-    "@envseal/core": "0.1.2",
-    "@envseal/registry": "0.1.2"
+    "@envseal/protocol": "0.1.3",
+    "@envseal/core": "0.1.3",
+    "@envseal/registry": "0.1.3",
+    "@envseal/prompters": "0.1.3"
   },
   "devDependencies": {
     "vitest": "^2.1.8"