@falkenslab/agent-kit 0.20.0 → 0.22.0

package/dist/core/runner.js

@@ -36,6 +36,8 @@ export function runQuery(prompt, options) {
         contextUsage: () => contextUsage(),
         toggleMcpServer: (server, enabled) => result.toggleMcpServer(server, enabled),
         reloadPlugins: () => result.reloadPlugins(),
+        reconnectMcpServer: (server) => result.reconnectMcpServer(server),
+        mcpServerStatus: () => result.mcpServerStatus(),
     });
     // The main agent's tool calls by id, to name the results that come back for them.
     const toolNames = new Map();

package/dist/core/session.d.ts

@@ -6,7 +6,7 @@ import type { ToolLabels } from "./toolLabels.js";
 import type { AgentSpec, BaseSessionConfig } from "./agentSpec.js";
 import { type Language } from "./language.js";
 import { type RunFolder } from "./runs.js";
-import { type ExtensionSwitch } from "./liveExtensions.js";
+import { type ExtensionRestart, type ExtensionSwitch } from "./liveExtensions.js";
 /**
  * Builds the `options` object passed to the Agent SDK's `query()` — everything about
  * *how* the agent runs a session (system prompt, tools, MCP servers, hooks), independent
@@ -44,11 +44,23 @@ export declare function buildSessionOptions<TConfig extends BaseSessionConfig>(c
     apis: Record<string, Record<string, unknown>>;
     /** Turns an installed extension off or on in the running session; false when that takes opening it again (#49). */
     switchExtension: ExtensionSwitch;
+    /** Restarts an installed extension's servers in the running session, with its options as they are now (#55). */
+    restartExtension: ExtensionRestart;
 }>;
 export { createModeControl, togglePlanMode, type ModeControl } from "./modeControl.js";
 /** The extensions of a session: where they're installed, what's installed, what runs and what can't (with why). */
 export interface ExtensionsStatus {
     dirs: ExtensionDirs;
+    /** The agent's own marketplace (`officialMarketplace`), for the chats' catalog. */
+    official?: string;
+    /** The topics the chats' catalog shows (`catalogTopics`); none, every extension. */
+    catalogTopics?: string[];
+    /** The workspace's extensions that don't run until the person trusts them there (#57): the chats ask. */
+    untrusted: {
+        name: string;
+        version?: string;
+        source: string;
+    }[];
     installed: InstalledExtension[];
     /** The names of the extensions this session runs with, the kit's and the agent's too. */
     active: string[];

package/dist/core/session.js

@@ -1,4 +1,4 @@
-import { cp, readdir, readFile, rm } from "node:fs/promises";
+import { readdir, readFile } from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { createTranscriptLogger } from "./hooks/transcriptLogger.js";
@@ -17,12 +17,15 @@ import { extensionsPromptSection, resolveExtensions, skillsMissingCapabilities }
 import { allowAnyMcpTool } from "./mcpPermissions.js";
 import { pluginAgents } from "./pluginAgents.js";
 import { outsideArchive, unpackedClaudeExecutable } from "./packaged.js";
-import { listInstalled, loadExternalExtensions } from "./externalExtensions.js";
+import { listInstalled, loadExternalExtensions, scopePrivateDir } from "./externalExtensions.js";
 import { replyLanguageInstruction } from "./language.js";
 import { chooseLanguage } from "./messages/index.js";
 import { createRunStore } from "./runs.js";
 import { createSessionView, registerSessionView } from "./sessionFacts.js";
-import { createExtensionSwitch } from "./liveExtensions.js";
+import { createExtensionRestart, createExtensionSwitch, mountPlugin } from "./liveExtensions.js";
+import { secretsDir } from "./extensionOptions.js";
+import { createElicitationHandler } from "./elicitation.js";
+import { createReadOnlyHints } from "./readOnlyHints.js";
 import { agentKitVersion } from "./version.js";
 /**
  * Builds the `options` object passed to the Agent SDK's `query()` — everything about
@@ -81,15 +84,15 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     const enabledNames = new Set((spec.extensions ?? []).map((extension) => extension.name));
     const resolved = resolveExtensions([...(spec.extensions ?? []), ...external.extensions.filter((extension) => !enabledNames.has(extension.name))], extensionContext);
     resolved.inactive.push(...external.off, ...external.extensions.filter((extension) => enabledNames.has(extension.name)).map((extension) => ({ name: extension.name, reason: "has the name of one this agent already has" })));
-    // Each installed one's plugin, copied into the run's folder: the running session empties and
-    // fills the copy to turn the extension off and on (liveExtensions.ts), never what's installed.
+    // Each installed one's plugin, mounted in the run's folder (a link, nothing copied): the running
+    // session unmounts and mounts it to turn the extension off and on (liveExtensions.ts), never
+    // touching what's installed.
     const installedDirs = new Map();
     for (const { extension } of resolved.active.filter(({ extension }) => extension.external)) {
-        const copy = path.join(runDir, "extensions", extension.name);
-        await rm(copy, { recursive: true, force: true });
-        await cp(extension.plugin, copy, { recursive: true });
-        installedDirs.set(extension.name, extension.plugin);
-        extension.plugin = copy;
+        const mount = path.join(runDir, "extensions", extension.name);
+        await mountPlugin(extension.plugin, mount);
+        installedDirs.set(extension.name, { dir: extension.plugin, scopeDir: extension.installedIn ?? path.dirname(extension.plugin) });
+        extension.plugin = mount;
     }
     const externalPlugins = new Set(resolved.active.filter(({ extension }) => extension.external).map(({ extension }) => path.resolve(extension.plugin)));
     extensionContext.capabilities = resolved.capabilities;
@@ -170,8 +173,18 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     const allowedSubagentTypes = [...new Set([...(subagents?.allowedSubagentTypes ?? []), ...Object.keys(fromPlugins)])];
     // The extensions' read-only tools, for the plan gate: a list the live switch changes (liveExtensions.ts).
     const readOnlyTools = fromExtensions((contribution) => contribution.readOnlyTools);
+    // Those whose manifest lists none: their servers say, asked while the session runs (#53).
+    const readOnlyHintServers = fromExtensions((contribution) => contribution.readOnlyHintServers);
     // What no file tool may touch: the agent's denied paths and the SDK's own credentials.
-    const deniedPaths = [...(config.deniedPaths ?? []), path.join(claudeConfigDir(), ".credentials.json")];
+    // And the installed extensions' sensitive option values (#55), in each scope's .secrets/.
+    const deniedPaths = [
+        ...(config.deniedPaths ?? []),
+        path.join(claudeConfigDir(), ".credentials.json"),
+        ...["agent", "project"].flatMap((scope) => {
+            const privateDir = config.extensionDirs ? scopePrivateDir(config.extensionDirs, scope) : undefined;
+            return privateDir ? [secretsDir(privateDir)] : [];
+        }),
+    ];
     const transcriptPath = path.join(runDir, "transcript.jsonl");
     const transcriptLogger = createTranscriptLogger(transcriptPath, config.secrets ?? []);
     const promptSections = [
@@ -269,6 +282,9 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
             // The date and date arithmetic, in every session and mode: only reads (tools/time.ts).
             time: createTimeServer(config.timeZone),
         },
+        // A server asking the person for something mid-tool (MCP elicitation, #58): through the
+        // interaction port, never the model; declined when no one can be asked (autonomous).
+        onElicitation: createElicitationHandler(runDir, () => modeControl.mode !== "autonomous"),
         hooks: {
             PreToolUse: [
                 { hooks: [transcriptLogger.preToolUse] },
@@ -303,6 +319,7 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                                 createPlanGate({
                                     projectDir: config.projectDir,
                                     readOnlyTools,
+                                    ...(readOnlyHintServers.length ? { isReadOnlyHinted: createReadOnlyHints(readOnlyHintServers, () => late.view?.controls().mcpServerStatus) } : {}),
                                     ...(spec.planMode?.isPlanFile ? { isPlanFile: (filePath) => spec.planMode.isPlanFile(filePath, config) } : {}),
                                     ...(spec.planMode?.isReadOnlyTool ? { isReadOnlyTool: spec.planMode.isReadOnlyTool } : {}),
                                 }, () => modeControl.mode === "plan"),
@@ -330,6 +347,9 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     const toolLabels = Object.assign({}, ...added.map((contribution) => contribution.toolLabels ?? {}));
     const extensions = {
         dirs: extensionDirs,
+        ...(config.officialMarketplace ? { official: config.officialMarketplace } : {}),
+        ...(config.catalogTopics?.length ? { catalogTopics: config.catalogTopics } : {}),
+        untrusted: external.untrusted.map((installed) => ({ name: installed.name, ...(installed.manifest?.version ? { version: installed.manifest.version } : {}), source: installed.lock.marketplace ?? installed.lock.source })),
         installed: await listInstalled(extensionDirs),
         active: resolved.active.map(({ extension }) => extension.name),
         about: Object.fromEntries(resolved.active.map(({ extension, manifest }) => [extension.name, { description: manifest.description, provides: manifest.provides }])),
@@ -357,18 +377,19 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
     };
     late.view = createSessionView(viewBase, modeControl);
     registerSessionView(sdkOptions, late.view);
-    // Turning an installed extension off and on while the session runs (#49).
-    const switchExtension = createExtensionSwitch(resolved.active.flatMap(({ extension, manifest }, index) => {
-        const installedDir = installedDirs.get(extension.name);
-        if (!installedDir)
+    // Turning an installed extension off and on while the session runs (#49), and restarting its
+    // servers when its options change (#55).
+    const liveExtensions = resolved.active.flatMap(({ extension, manifest }, index) => {
+        const installed = installedDirs.get(extension.name);
+        if (!installed)
             return [];
         const contribution = added[index];
         return [
             {
                 name: extension.name,
-                installedDir,
-                scopeDir: path.dirname(installedDir),
-                pluginCopy: extension.plugin,
+                installedDir: installed.dir,
+                scopeDir: installed.scopeDir,
+                pluginMount: extension.plugin,
                 servers: Object.keys(contribution?.mcpServers ?? {}),
                 readOnlyTools: contribution?.readOnlyTools ?? [],
                 toolLabels: contribution?.toolLabels ?? {},
@@ -378,9 +399,12 @@ export async function buildSessionOptions(config, runDir, spec, options = {}) {
                 help: contribution?.helpLines ?? [],
             },
         ];
-    }), { readOnlyTools, allowedSubagentTypes, toolLabels, status: extensions, facts: viewBase, controls: () => late.view?.controls() ?? {} });
+    });
+    const liveTargets = { readOnlyTools, allowedSubagentTypes, toolLabels, status: extensions, facts: viewBase, controls: () => late.view?.controls() ?? {} };
+    const switchExtension = createExtensionSwitch(liveExtensions, liveTargets);
+    const restartExtension = createExtensionRestart(liveExtensions, liveTargets);
     const apis = Object.fromEntries(resolved.active.flatMap(({ extension }, index) => (added[index]?.api ? [[extension.name, added[index].api]] : [])));
-    return { options: sdkOptions, transcriptLogger, transcriptPath, modeControl, language, toolLabels, extensions, apis, switchExtension };
+    return { options: sdkOptions, transcriptLogger, transcriptPath, modeControl, language, toolLabels, extensions, apis, switchExtension, restartExtension };
 }
 export { createModeControl, togglePlanMode } from "./modeControl.js";
 /** The Claude Code configuration folder the SDK's CLI uses: `CLAUDE_CONFIG_DIR`, or `~/.claude`. */

package/dist/core/sessionFacts.d.ts

@@ -1,4 +1,4 @@
-import type { Options, SlashCommand } from "@anthropic-ai/claude-agent-sdk";
+import type { McpServerStatus, Options, SlashCommand } from "@anthropic-ai/claude-agent-sdk";
 import type { AgentIdentity, Mode } from "./agentSpec.js";
 import type { Language } from "./language.js";
 import type { ModeControl } from "./modeControl.js";
@@ -61,6 +61,10 @@ export interface SessionLive {
     /** The running session's controls an installed extension is turned off and on with (liveExtensions.ts). */
     toggleMcpServer?: (server: string, enabled: boolean) => Promise<void>;
     reloadPlugins?: () => Promise<unknown>;
+    /** Restarts one of its MCP servers: an installed extension's, when its options change (#55). */
+    reconnectMcpServer?: (server: string) => Promise<void>;
+    /** Its MCP servers as they are now: their tools and what each says of itself (plan mode's read-only hints). */
+    mcpServerStatus?: () => Promise<McpServerStatus[]>;
 }
 /** The facts known when the options are built: everything but the mode and what only the running session knows. */
 export type StaticSessionFacts = Omit<SessionFacts, "mode" | "switchableModes" | "tools" | "commands" | "context" | "extensions"> & {

package/dist/core/workspaceTrust.d.ts

@@ -0,0 +1,12 @@
+import { type ExtensionDirs, type LockEntry } from "./externalExtensions.js";
+/** What's trusted of an extension: its code, its files' hash and its npx packages'. */
+export declare function codeHash(lock: LockEntry): string;
+/** Whether an extension of a project's scope is trusted in that workspace, with the code its lock has now. */
+export declare function isTrusted(agentDir: string, projectScope: string, name: string, lock: LockEntry): Promise<boolean>;
+/** Trusts these extensions of a project's scope, with the code their lock has now. */
+export declare function trust(agentDir: string, projectScope: string, entries: Record<string, LockEntry>): Promise<void>;
+/**
+ * Trusts a workspace's extensions (its project scope's, all or `names`) with the code its lock
+ * has now: what the person does when the chat asks, or with `extension trust`. The names trusted.
+ */
+export declare function trustWorkspace(dirs: ExtensionDirs, names?: readonly string[]): Promise<string[]>;

package/dist/core/workspaceTrust.js

@@ -0,0 +1,60 @@
+import { createHash } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import path from "node:path";
+import { readLock } from "./externalExtensions.js";
+/**
+ * Trusting a workspace's extensions (#57): a project's scope comes with the project, from whoever
+ * shared it (a clone, a download), and its extensions' servers run code on this computer. They
+ * run only once the person trusts them in that workspace: what's trusted is each one's code (its
+ * files' SHA-256 and its npx packages'), kept in the agent's folder, outside the project, so a
+ * project can't trust itself. Another version (a changed lock, an update from someone else) asks
+ * again; turning one on or off, or its options, don't. What the person installs into the
+ * project's scope themselves is trusted as they install it. The agent's own scope is the
+ * person's: it never asks.
+ */
+const TRUST_FILE = ".trust.json";
+/** What's trusted of an extension: its code, its files' hash and its npx packages'. */
+export function codeHash(lock) {
+    const packages = Object.entries(lock.packages ?? {})
+        .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0))
+        .map(([spec, cached]) => `${spec}=${cached.sha256}`);
+    // A linked one has no hash of its own: its folder is what's trusted.
+    return createHash("sha256").update([lock.linked ? `linked:${path.resolve(lock.source)}` : lock.sha256, ...packages].join("\n")).digest("hex");
+}
+async function readTrust(agentDir) {
+    try {
+        return JSON.parse(await readFile(path.join(agentDir, TRUST_FILE), "utf8"));
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return {};
+        throw error;
+    }
+}
+/** The workspace a project scope is, as the trust file names it. */
+const workspaceKey = (projectScope) => path.resolve(projectScope);
+/** Whether an extension of a project's scope is trusted in that workspace, with the code its lock has now. */
+export async function isTrusted(agentDir, projectScope, name, lock) {
+    return (await readTrust(agentDir))[workspaceKey(projectScope)]?.[name] === codeHash(lock);
+}
+/** Trusts these extensions of a project's scope, with the code their lock has now. */
+export async function trust(agentDir, projectScope, entries) {
+    const file = await readTrust(agentDir);
+    const workspace = (file[workspaceKey(projectScope)] ??= {});
+    for (const [name, lock] of Object.entries(entries))
+        workspace[name] = codeHash(lock);
+    await mkdir(agentDir, { recursive: true });
+    await writeFile(path.join(agentDir, TRUST_FILE), `${JSON.stringify(file, null, 2)}\n`, "utf8");
+}
+/**
+ * Trusts a workspace's extensions (its project scope's, all or `names`) with the code its lock
+ * has now: what the person does when the chat asks, or with `extension trust`. The names trusted.
+ */
+export async function trustWorkspace(dirs, names) {
+    if (!dirs.agent || !dirs.project)
+        return [];
+    const lock = await readLock(dirs.project);
+    const entries = Object.fromEntries(Object.entries(lock).filter(([name]) => !names || names.includes(name)));
+    await trust(dirs.agent, dirs.project, entries);
+    return Object.keys(entries);
+}

package/dist/index.d.ts

@@ -16,8 +16,13 @@ export { sources, type SourcesOptions } from "./extensions/sources/index.js";
 export { knowledge, type KnowledgeOptions } from "./extensions/knowledge/index.js";
 export { memory, type MemoryOptions } from "./extensions/memory/index.js";
 export { readExtensionManifest, type Extension, type ExtensionContext, type ExtensionContribution, type ExtensionManifest, type FolderOption, } from "./core/extensions.js";
-export { addExtension, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, type ExtensionAuthor, type ExtensionDirs, type ExtensionScope, type ExternalManifest, type ExternalToolLabel, type PluginServer, type InstalledExtension, type LockEntry, } from "./core/externalExtensions.js";
+export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, type ExtensionAuthor, type ExtensionDirs, type ExtensionScope, type ExternalManifest, type ExternalToolLabel, type PluginServer, type InstalledExtension, type LockEntry, type ExtensionOptionState, } from "./core/externalExtensions.js";
+export type { ExtensionOption, OptionValue } from "./core/extensionOptions.js";
+export type { ExtensionRestart, ExtensionSwitch } from "./core/liveExtensions.js";
+export { packageCacheDir, type CachedPackage } from "./core/npxPackages.js";
 export { addMarketplace, findPlugin, inspectMarketplace, installFromMarketplace, listMarketplaces, readMarketplaceManifest, removeMarketplace, resolvePluginSource, updateMarketplace, type KnownMarketplace, type MarketplaceManifest, type MarketplacePlugin, type PluginSource, } from "./core/marketplaces.js";
+export { extensionCatalog, installExtension, restoreExtensions, updateExtension, type CatalogEntry } from "./core/extensionCatalog.js";
+export { trustWorkspace } from "./core/workspaceTrust.js";
 export { runExtensionCommand } from "./tui/extensionCommand.js";
 export { agentKitVersion } from "./core/version.js";
 export { BUILT_IN_PAGE_TYPES, isSlug, parseId, linkedIds, type KnowledgeStore, type PageType, type KnowledgePage, type PageInfo, type SearchHit, type CheckReport, type FieldChanges, type NewPage, } from "./extensions/knowledge/knowledgeStore.js";
@@ -37,6 +42,7 @@ export { createFileScopeGate, checkFileScope, type FileScope } from "./core/hook
 export { createPlanGate, checkPlanScope, type PlanScope } from "./core/hooks/planGate.js";
 export { askForDecision, askForManualIntervention, askForChoice, askForText, type ChoiceAnswer } from "./core/hooks/humanInput.js";
 export { setInteractionPort, getInteractionPort, type InteractionPort, type ApprovalPrompt, type ChoiceSettings } from "./core/interaction.js";
+export { formFields, type FormAnswer, type FormField, type FormRequest } from "./core/elicitation.js";
 export { terminalInteractionPort, setSharedReadline, getSharedReadline } from "./tui/terminalInteraction.js";
 export { createHumanApprovalServer, DEFAULT_HUMAN_APPROVAL_TEXTS, type HumanApprovalTexts } from "./core/tools/humanApproval.js";
 export { createManualLoginServer, type ManualInterventionTexts } from "./core/tools/manualLogin.js";

package/dist/index.js

@@ -16,8 +16,11 @@ export { sources } from "./extensions/sources/index.js";
 export { knowledge } from "./extensions/knowledge/index.js";
 export { memory } from "./extensions/memory/index.js";
 export { readExtensionManifest, } from "./core/extensions.js";
-export { addExtension, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, } from "./core/externalExtensions.js";
+export { addExtension, codeStoreDir, installTarget, scopePrivateDir, extensionDataDir, extensionOptionStates, setExtensionOptions, removeExtension, setExtensionEnabled, listInstalled, readExternalManifest, } from "./core/externalExtensions.js";
+export { packageCacheDir } from "./core/npxPackages.js";
 export { addMarketplace, findPlugin, inspectMarketplace, installFromMarketplace, listMarketplaces, readMarketplaceManifest, removeMarketplace, resolvePluginSource, updateMarketplace, } from "./core/marketplaces.js";
+export { extensionCatalog, installExtension, restoreExtensions, updateExtension } from "./core/extensionCatalog.js";
+export { trustWorkspace } from "./core/workspaceTrust.js";
 export { runExtensionCommand } from "./tui/extensionCommand.js";
 export { agentKitVersion } from "./core/version.js";
 export { BUILT_IN_PAGE_TYPES, isSlug, parseId, linkedIds, } from "./extensions/knowledge/knowledgeStore.js";
@@ -38,6 +41,7 @@ export { createFileScopeGate, checkFileScope } from "./core/hooks/fileScopeGate.
 export { createPlanGate, checkPlanScope } from "./core/hooks/planGate.js";
 export { askForDecision, askForManualIntervention, askForChoice, askForText } from "./core/hooks/humanInput.js";
 export { setInteractionPort, getInteractionPort } from "./core/interaction.js";
+export { formFields } from "./core/elicitation.js";
 export { terminalInteractionPort, setSharedReadline, getSharedReadline } from "./tui/terminalInteraction.js";
 // The checkpoints answer on the terminal by default, as they always have; a non-terminal
 // host replaces the port with its own (or null, to answer through the response file only).

package/dist/tui/extensionCommand.d.ts

@@ -8,8 +8,14 @@ export { chatExtensionsCommand, describe } from "../chat/extensions.js";
  *
  * - `extension list`
  * - `extension info <name>`: its metadata, what it offers and where its README is
- * - `extension add <folder | git URL[#ref] | plugin[@marketplace]> [--project] [--path <subfolder>] [--yes]`
- * - `extension remove|enable|disable <name> [--project | --agent]`
+ * - `extension add <folder | git URL[#ref] | plugin[@marketplace]> [--project] [--path <subfolder>] [--set key=value…] [--yes]`: asks for its options (#55) unless `--set` gives them
+ * - `extension add <folder> --link [--project]`: registered where it is, to develop it (not copied, its files not checked)
+ * - `extension remove <name> [--project | --agent] [--yes | --keep-data]`: asks before deleting its data folder
+ * - `extension enable|disable <name> [--project | --agent]`
+ * - `extension config <name> [key=value… | key… | --unset key…] [--project | --agent]`: its options; `key` alone asks for it (without echo when it's a secret)
+ * - `extension update [name] [--yes]`: one installed from a marketplace (or all that have a newer version there) to the version it offers now, its data and options kept
+ * - `extension restore [--trust]`: gets the code a workspace's lock lists and this computer lacks (#57); `--trust` trusts it too
+ * - `extension trust [name…]`: lets a workspace's extensions run, as their code is now
  * - `extension search [words]`: what the known marketplaces offer
  * - `extension marketplace add <folder | git URL[#ref] | owner/repo> [--yes]`, `list`, `update [name]`, `remove <name>`
  *
@@ -25,6 +31,10 @@ export declare function runExtensionCommand(argv: readonly string[], options: {
     write?: (line: string) => void;
     /** The agent's official marketplace: a folder or a git URL (`#ref`). */
     official?: string;
-    /** Asks the person (a confirmation); by default on the terminal, and nothing without one. */
+    /** The topics of the extensions `search` shows (#59), as the agent's `catalogTopics`; without it, every one. */
+    catalogTopics?: string[];
+    /** Asks the person (a confirmation, an option's value); by default on the terminal, and nothing without one. */
     ask?: (question: string) => Promise<string>;
+    /** Asks for a secret (a sensitive option), without echo; by default on the terminal. */
+    askSecret?: (question: string) => Promise<string>;
 }): Promise<boolean>;