@lazehq/cli 0.1.25 → 0.1.27

package/dist/laze.mjs

@@ -30997,6 +30997,41 @@ function isBasicAuthPayload(value) {
 }
 var CREDENTIAL_QUALIFIERS = "master|encryption|signing|private|access|api|auth|secret|refresh|session|bearer|verification|webhook|client|service|personal|root|admin";
 var CREDENTIAL_KEYWORD = `(?:x[_.\\- ]?)?(?:(?:${CREDENTIAL_QUALIFIERS})[_.\\- ]?(?:api[_.\\- ]?)?key|(?:${CREDENTIAL_QUALIFIERS})?[_.\\- ]?(?:api[_.\\- ]?)?(?:token|secret|password|passwd|pwd|credentials?|authorization|cookie))`;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var GIT_SHA = /^[0-9a-f]{40}$/;
+var DOMAIN_PATH = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}\//;
+var NAMED_KEY_MIN = 24;
+var NAMED_KEY_MAX = 256;
+function isSlug(value) {
+  const parts = value.split(/[-_.]/);
+  if (parts.length < 3) return false;
+  const short = parts.every((part) => /^(?:[a-z0-9]{1,10}|[A-Z0-9]{1,10})$/.test(part));
+  return short && parts.some((part) => /^[A-Za-z]{3,}$/.test(part));
+}
+var NOT_A_NAMED_KEY = [
+  /^\/|\/\//,
+  GIT_SHA,
+  DOMAIN_PATH,
+  PATH_LIKE,
+  CODE_EXPRESSION,
+  ENV_REFERENCE,
+  VERSION_LIKE
+];
+function isNamedKeyValue(value) {
+  if (value.length < NAMED_KEY_MIN || value.length > NAMED_KEY_MAX) return false;
+  if (UUID.test(value)) return true;
+  if (isSlug(value)) return false;
+  if (NOT_A_NAMED_KEY.some((shape) => shape.test(value))) return false;
+  const prefix = /^([A-Za-z][A-Za-z0-9]{1,11})[_-]/.exec(value)?.[1];
+  if (prefix && isNonCredentialPrefix(prefix)) return false;
+  if (HEX.test(value)) return true;
+  if (shannonEntropyBits(value) < 3.5) return false;
+  const c = charClasses(value);
+  return c.digit >= 2 && c.lower + c.upper >= 8 && (c.lower >= 2 || c.upper >= 2);
+}
+var KEY_WORD = String.raw`(?:api[_.\- ]?key|apikey|access[_.\- ]?key|key|token|secret|password|passwd|pwd)`;
+var QUOTE = "[\"'`]";
+var KEY_WORD_GAP = String.raw`(?:[ \t]{0,3}(?:is|was|here|it's|its|below|:|=|->|=>|-{1,2}))`;
 var TOKEN_START = "(?<![A-Za-z0-9_-])";
 var TOKEN_END = "(?![A-Za-z0-9_-])";
 var VENDOR_KEY_PATTERNS = [
@@ -31125,11 +31160,21 @@ var RULES = [
       "i"
     ),
     value: { kind: "group", group: 2 },
+    dropsFullStop: true,
     accept: (match) => {
       const introduction = groupOf(match, 1);
       const value = groupOf(match, 2);
       return STRICT_INTRODUCTION.test(introduction) ? isCredentialValue(value) : isKeyMaterial(value);
     }
+  },
+  {
+    id: "named_key",
+    regex: rx(
+      String.raw`\b(${KEY_WORD})\b(${KEY_WORD_GAP}{0,3}[ \t]*(?:\r?\n[ \t]*)?${QUOTE}?)` + String.raw`([A-Za-z0-9+/=_.-]{${NAMED_KEY_MIN - 1},${NAMED_KEY_MAX - 1}}[A-Za-z0-9+/=_-])` + String.raw`(?![A-Za-z0-9+/=_-]|\.[A-Za-z0-9])`,
+      "i"
+    ),
+    value: { kind: "group", group: 3 },
+    accept: (match) => /[\s:="'`]/.test(groupOf(match, 2)) && isNamedKeyValue(groupOf(match, 3))
   }
 ];
 var SECRET_RULE_IDS = RULES.map((rule) => rule.id);
@@ -31157,12 +31202,21 @@ function spanStartOf({ rule, text: text2, fullStart }) {
   const before = rule.precededBy.exec(text2.slice(from, fullStart));
   return before ? fullStart - before[0].length : fullStart;
 }
+function withoutFullStop({
+  text: text2,
+  span
+}) {
+  let end = span.end;
+  while (end > span.start && text2[end - 1] === "." && !/\S/.test(text2[end] ?? "")) end--;
+  return end === span.end ? span : { start: span.start, end, spanEnd: Math.min(span.spanEnd, end) };
+}
 function rawMatches(rule, text2) {
   const out = [];
   rule.regex.lastIndex = 0;
   for (const match of text2.matchAll(rule.regex)) {
     if (rule.accept && !rule.accept(match)) continue;
-    const span = valueSpan(rule, match);
+    const found = valueSpan(rule, match);
+    const span = found && rule.dropsFullStop ? withoutFullStop({ text: text2, span: found }) : found;
     if (!span || span.end <= span.start) continue;
     const spanStart = spanStartOf({ rule, text: text2, fullStart: match.index });
     out.push({ ruleId: rule.id, spanStart, ...span });
@@ -31322,7 +31376,33 @@ function suggestedName({
   const line = lineBreak === -1 ? before : before.slice(lineBreak + 1);
   const assigned = ASSIGNMENT.exec(line)?.[1]?.toUpperCase();
   if (assigned && isValidSecretName(assigned)) return assigned;
-  return defaultName({ kind, value, before });
+  const lead = before.replace(/\s+$/, "");
+  const lastLine = lead.slice(lead.search(/[^\r\n]*$/));
+  const named = KEY_WORD_KINDS.has(kind) ? keyWordName({ line: lastLine }) : null;
+  return named ?? defaultName({ kind, value, before });
+}
+var KEY_WORD_KINDS = /* @__PURE__ */ new Set(["named_key", "sensitive_assignment"]);
+var VENDOR_KEY_WORD = /([A-Za-z][A-Za-z0-9]{1,30})[ _.-]+(?:(?:api|access)[ _.-]?)?(key|token|secret|password|passwd|pwd)\b/gi;
+var NOT_VENDOR_WORDS = new Set(
+  "a an the my your our their his her its this that these new old here is of for with and or to my api access secret private public personal prod production live test dev staging master admin root bearer auth client service session refresh read write full main default".split(
+    " "
+  )
+);
+var KEY_WORD_SUFFIXES = {
+  key: "_API_KEY",
+  token: "_TOKEN",
+  secret: "_SECRET",
+  password: "_PASSWORD",
+  passwd: "_PASSWORD",
+  pwd: "_PASSWORD"
+};
+function keyWordName({ line }) {
+  const last = [...line.slice(-80).matchAll(VENDOR_KEY_WORD)].at(-1);
+  const vendor = last?.[1]?.toLowerCase();
+  const word3 = last?.[2]?.toLowerCase();
+  if (!vendor || !word3 || NOT_VENDOR_WORDS.has(vendor)) return null;
+  const name2 = `${vendor.toUpperCase()}${KEY_WORD_SUFFIXES[word3] ?? "_KEY"}`;
+  return isValidSecretName(name2) ? name2 : null;
 }
 var SAFE_CUT_LOOKAHEAD = 4096;
 var PEM_BEGIN = "-----BEGIN";
@@ -35437,7 +35517,7 @@ function cliEnvironment({
 
 // src/services/config-store.service.ts
 import { chmod, mkdir, readFile, rename, writeFile } from "node:fs/promises";
-import { dirname, resolve } from "node:path";
+import { basename, dirname, resolve } from "node:path";
 var EMPTY = { profiles: {}, bindings: {} };
 var ConfigStore = class _ConfigStore {
   constructor(path) {
@@ -35540,6 +35620,11 @@ function chooseProfile({
   const profile = name2 ? config2.profiles[name2] : void 0;
   return name2 && profile ? { name: name2, profile } : { name: void 0, profile: void 0 };
 }
+function isWorktreeRoot({ directory }) {
+  const parent = dirname(directory);
+  if (basename(parent) === ".worktrees") return true;
+  return basename(parent) === "worktrees" && basename(dirname(parent)) === ".claude";
+}
 function boundProfileOf({
   bindings,
   cwd
@@ -35549,7 +35634,7 @@ function boundProfileOf({
     const bound = bindings[directory];
     if (bound) return bound;
     const parent = dirname(directory);
-    if (parent === directory) return void 0;
+    if (parent === directory || isWorktreeRoot({ directory })) return void 0;
     directory = parent;
   }
   return void 0;
@@ -35620,7 +35705,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.25";
+var STAMPED = "0.1.27";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -57843,6 +57928,17 @@ var chatScrubReportSchemaDefinition = external_exports.object({
   channels: external_exports.array(chatScrubChannelSchemaDefinition)
 });
 var chatScrubReportSchema = chatScrubReportSchemaDefinition;
+var saveMessageSecretBodySchemaDefinition = external_exports.object({
+  /** One token, as keys are: a value with spaces is text, not a key. */
+  value: external_exports.string().min(8).max(4096).regex(/^\S+$/),
+  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/),
+  description: external_exports.string().trim().min(1).max(120)
+});
+var messageSecretSavedSchemaDefinition = external_exports.object({
+  outcome: external_exports.enum(["named", "already_named"]),
+  name: external_exports.string(),
+  connectionId: external_exports.string()
+});
 
 // ../../modules/chat/contract/src/chat.sent.ts
 var SENT_PAGE_MAX = 50;
@@ -62598,6 +62694,16 @@ var savePendingSecretBodySchemaDefinition = external_exports.object({
   name: connectionName2,
   description: external_exports.string().trim().min(1).max(120)
 });
+var saveMessageSecretInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  channelId: external_exports.string().min(1),
+  messageId: external_exports.string().min(1),
+  /** The message's author, a person: the keychain the value goes to. */
+  ownerUserId: external_exports.string().min(1),
+  value: external_exports.string().min(8).max(4096).regex(/^\S+$/),
+  name: connectionName2,
+  description: external_exports.string().trim().min(1).max(120)
+});
 var vaultPendingSecretSavedSchemaDefinition = external_exports.object({
   outcome: external_exports.enum(["named", "already_named"]),
   name: connectionName2,
@@ -65627,6 +65733,29 @@ function selfClauseOf({ self: self2 }) {
   return self2 ? `, where you are ${self2}` : "";
 }
 
+// src/rules/session-headers.rules.ts
+import { relative, sep } from "node:path";
+function sessionKeyOf({ session }) {
+  return `${session.harness}:${session.sessionId}`;
+}
+function sessionHeadersOf({
+  session
+}) {
+  if (!session) return {};
+  return {
+    [AGENT_SESSION_HEADER]: sessionKeyOf({ session }),
+    [AGENT_SESSION_FOLDER_HEADER]: encodeURIComponent(session.folder),
+    [AGENT_SESSION_HOST_HEADER]: encodeURIComponent(session.host)
+  };
+}
+function displayFolderOf({ folder, home }) {
+  if (!home) return folder;
+  const below = relative(home, folder);
+  if (below === "") return "~";
+  if (below.startsWith("..") || below.startsWith(sep)) return folder;
+  return `~/${below.split(sep).join("/")}`;
+}
+
 // src/rules/transcript.rules.ts
 function record2(value) {
   return typeof value === "object" && value !== null ? value : {};
@@ -66545,33 +66674,32 @@ import { mkdir as mkdir3, readdir, readFile as readFile3, writeFile as writeFile
 import { hostname as hostname3 } from "node:os";
 import { dirname as dirname3, join as join3 } from "node:path";
 
-// src/rules/session-headers.rules.ts
-import { relative, sep } from "node:path";
-function sessionKeyOf({ session }) {
-  return `${session.harness}:${session.sessionId}`;
-}
-function sessionHeadersOf({
-  session
+// src/rules/rush-host.rules.ts
+function rushSessionOf({
+  parentArgs
 }) {
-  if (!session) return {};
-  return {
-    [AGENT_SESSION_HEADER]: sessionKeyOf({ session }),
-    [AGENT_SESSION_FOLDER_HEADER]: encodeURIComponent(session.folder),
-    [AGENT_SESSION_HOST_HEADER]: encodeURIComponent(session.host)
-  };
+  if (!parentArgs) return void 0;
+  const [program = "", verb, action, id] = parentArgs;
+  const isRush = program === "rush" || program.endsWith("/rush");
+  if (!isRush || verb !== "host" || action !== "run" || !id) return void 0;
+  return { id, program };
 }
-function displayFolderOf({ folder, home }) {
-  if (!home) return folder;
-  const below = relative(home, folder);
-  if (below === "") return "~";
-  if (below.startsWith("..") || below.startsWith(sep)) return folder;
-  return `~/${below.split(sep).join("/")}`;
+function rushSendCommand({ program, id }) {
+  return ["sh", "-c", 'printf "%s\\n" "$LAZE_WAKE_TEXT" | "$0" session send "$1"', program, id];
+}
+function rushListsLive({ listed, sessionId }) {
+  try {
+    const sessions = JSON.parse(listed);
+    return sessions.some((one) => one.sessionId === sessionId && one.state !== "stopped");
+  } catch {
+    return false;
+  }
 }
 
 // src/services/claude-project.service.ts
-import { basename, isAbsolute, relative as relative2, resolve as resolve2 } from "node:path";
+import { basename as basename2, isAbsolute, relative as relative2, resolve as resolve2 } from "node:path";
 function harnessIn({ words }) {
-  const names = words.slice(0, 2).map((word3) => basename(word3).replace(/\.(js|mjs|cjs)$/, ""));
+  const names = words.slice(0, 2).map((word3) => basename2(word3).replace(/\.(js|mjs|cjs)$/, ""));
   if (names.includes("codex")) return "codex";
   if (words.some((word3) => word3.includes("@openai/codex"))) return "codex";
   const claude = words.some((word3) => word3.includes("@anthropic-ai/claude-code"));
@@ -66744,7 +66872,8 @@ async function currentSessionOf({
 async function sessionProfileArgs({
   context,
   args,
-  session
+  session,
+  binds = true
 }) {
   if (!session) return args;
   const key = sessionKeyOf({ session });
@@ -66754,16 +66883,29 @@ async function sessionProfileArgs({
     return { ...args, flags: { ...args.flags, profile: bound } };
   }
   const own2 = flagText({ args, name: "profile" });
-  if (own2 && config2.profiles[own2]?.kind === "agent") {
+  if (binds && !args.flags.plugin && own2 && config2.profiles[own2]?.kind === "agent") {
     await context.store.bindSession({ session: key, profile: own2 });
   }
   return args;
 }
+async function rushKeeps({ context, key }) {
+  const sessionId = key.slice(key.indexOf(":") + 1);
+  let listed = "";
+  const code = await context.runCommand({
+    command: ["sh", "-c", "command -v rush >/dev/null && rush session list --json"],
+    env: {},
+    stdout: { write: (chunk) => listed += chunk },
+    stderr: { write: () => true }
+  }).catch(() => 1);
+  if (code !== 0) return false;
+  return rushListsLive({ listed, sessionId });
+}
 async function liveElsewhere({
   context,
   key,
   claudePid
 }) {
+  if (await rushKeeps({ context, key })) return true;
   const folder = dirname3(statePathOf({ context, kind: "sessions", profile: "x" }));
   for (const file3 of await readdir(folder).catch(() => [])) {
     const pid = Number(file3.replace(/\.json$/, ""));
@@ -66776,14 +66918,20 @@ async function liveElsewhere({
   }
   return false;
 }
-function notBoundText({ meta: meta3 }) {
-  return `Laze: this agent listens in another session${meta3.bound ? `: ${meta3.bound}` : ""}. Create a new Laze agent with this session: laze agent request. Or move this agent here: laze agent bind.`;
+function notBoundText({
+  meta: meta3,
+  agent: agent2,
+  configPath
+}) {
+  const who = `${agent2 ? `"${agent2}"` : "this agent"} (config ${configPath})`;
+  return `Laze: ${who} listens in another session${meta3.bound ? `: ${meta3.bound}` : ""}. Create a new Laze agent with this session: laze agent request. Or move this agent here: laze agent bind.`;
 }
 async function notBoundNotice({
   context,
   client,
   session,
-  error: error62
+  error: error62,
+  profile
 }) {
   if (!(error62 instanceof LazeApiError) || error62.code !== "session_not_bound") return void 0;
   const meta3 = error62.meta ?? {};
@@ -66803,7 +66951,10 @@ async function notBoundNotice({
   if (told) return { notice: void 0 };
   await mkdir3(dirname3(path), { recursive: true, mode: 448 });
   await writeFile3(path, String(context.nowMs()), { mode: 384 });
-  return { notice: notBoundText({ meta: meta3 }) };
+  const agent2 = (await context.store.read()).profiles[profile]?.name;
+  return {
+    notice: notBoundText({ meta: meta3, agent: agent2, configPath: context.environment.configPath })
+  };
 }
 
 // src/services/plugin-hook.service.ts
@@ -66821,7 +66972,7 @@ async function agentProfileHere({
   if (!folder && !session) return void 0;
   const asked = { ...args, flags: { ...args.flags, ...folder ? { profile: folder } : {} } };
   const name2 = flagText({
-    args: await sessionProfileArgs({ context, args: asked, session }),
+    args: await sessionProfileArgs({ context, args: asked, session, binds: false }),
     name: "profile"
   });
   return name2 && config2.profiles[name2]?.kind === "agent" ? name2 : void 0;
@@ -67482,20 +67633,6 @@ function channelLabelIn(channel) {
 import { readFile as readFile7, rm as rm2, writeFile as writeFile6, mkdir as mkdir6 } from "node:fs/promises";
 import { dirname as dirname6 } from "node:path";
 
-// src/rules/rush-host.rules.ts
-function rushSessionOf({
-  parentArgs
-}) {
-  if (!parentArgs) return void 0;
-  const [program = "", verb, action, id] = parentArgs;
-  const isRush = program === "rush" || program.endsWith("/rush");
-  if (!isRush || verb !== "host" || action !== "run" || !id) return void 0;
-  return { id, program };
-}
-function rushSendCommand({ program, id }) {
-  return ["sh", "-c", 'printf "%s\\n" "$LAZE_WAKE_TEXT" | "$0" session send "$1"', program, id];
-}
-
 // src/services/rush-host.service.ts
 import { mkdir as mkdir5, readFile as readFile6, writeFile as writeFile5 } from "node:fs/promises";
 import { dirname as dirname5, join as join6 } from "node:path";
@@ -67649,7 +67786,8 @@ async function settleRound(round) {
       context,
       client: forSession({ client, session }),
       session,
-      error: error62
+      error: error62,
+      profile: name2
     });
     if (!refused) throw error62;
     return refused;
@@ -69907,10 +70045,10 @@ async function nextStepsFor({
 }) {
   if (harness === "codex") return linkCodexSession({ context, args, profile, laze, directory });
   if (!hooked) return waiterStepsOf({ profile, laze });
+  const session = await currentSessionOf({ context, args });
+  if (session) await context.store.bindSession({ session: sessionKeyOf({ session }), profile });
   const plugin2 = args.flags["no-plugin"] ? void 0 : await installLazePlugin({ context });
-  if (plugin2?.registered) {
-    await markReloadTipTold({ context, session: await currentSessionOf({ context, args }) });
-  }
+  if (plugin2?.registered) await markReloadTipTold({ context, session });
   const mcp2 = args.flags.mcp ? await registerMcp({ context, directory, profile }) : void 0;
   const mcpAdd2 = mcpAddCommandOf({ context, profile });
   const lines = pluginLinesOf({ context, registered: plugin2?.registered });
@@ -69962,7 +70100,13 @@ async function handOver({ context, args }) {
   try {
     fresh = await receiveMessages({ context, client: claim3, waitSeconds: 0 });
   } catch (error62) {
-    const refused = await notBoundNotice({ context, client: claim3, session, error: error62 });
+    const refused = await notBoundNotice({
+      context,
+      client: claim3,
+      session,
+      error: error62,
+      profile: agent2
+    });
     if (!refused) throw error62;
     if (refused.notice) stopContext({ context, text: refused.notice });
     return;
@@ -70696,6 +70840,7 @@ async function setAgentPool({
 
 // src/services/agent-session-commands.service.ts
 var NO_SESSION = "Run this inside the Claude Code or Codex session the agent should listen in, or pass --session <id>.";
+var NO_AGENT = "This session and its folder have no agent: name one with `laze agent bind --profile <name>`.";
 var DEFAULT_WAIT_SECONDS = 300;
 async function bindAgentSession({
   context,
@@ -70703,10 +70848,21 @@ async function bindAgentSession({
 }) {
   const session = await currentSessionOf({ context, args });
   if (!session) throw new CliUsageError(NO_SESSION);
-  const { client, name: name2 } = await signedIn({ context, args });
+  const key = sessionKeyOf({ session });
+  const config2 = await context.store.read();
+  const held = config2.sessions?.[key];
+  const own2 = held && config2.profiles[held] ? held : void 0;
+  const explicit = flagText({ args, name: "profile" }) || void 0;
+  const target = explicit ?? own2 ?? boundProfileOf({ bindings: config2.bindings, cwd: context.cwd });
+  if (!target) throw new CliUsageError(NO_AGENT);
+  const named = { ...args, flags: { ...args.flags, profile: target } };
+  const { client, name: name2, profile } = await signedIn({ context, args: named });
   await forSession({ client, session }).post("/api/agents/me/bind", {});
-  await context.store.bindSession({ session: sessionKeyOf({ session }), profile: name2 });
-  context.out("This agent now listens in this session.\n");
+  await context.store.bindSession({ session: key, profile: name2 });
+  const where = `profile ${name2}, config ${context.environment.configPath}`;
+  const from = own2 && own2 !== name2 ? ` It moved from "${config2.profiles[own2]?.name}".` : "";
+  context.out(`"${profile.name}" now listens in this session (${where}).${from}
+`);
 }
 async function mintedRequestProfile({
   context,
@@ -75813,7 +75969,7 @@ async function channelSettings({ context, args }) {
 
 // src/services/chat-actions-commands.service.ts
 import { readFile as readFile17 } from "node:fs/promises";
-import { basename as basename2, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve7 } from "node:path";
+import { basename as basename3, isAbsolute as isAbsolute2, relative as relative4, resolve as resolve7 } from "node:path";
 
 // src/services/file-upload.service.ts
 async function sendParts({
@@ -76113,7 +76269,7 @@ var files = async ({ context, args, client }) => {
 };
 function uploadNameOf({ cwd, path }) {
   const inside = relative4(cwd, path);
-  return inside && !inside.startsWith("..") && !isAbsolute2(inside) ? inside : basename2(path);
+  return inside && !inside.startsWith("..") && !isAbsolute2(inside) ? inside : basename3(path);
 }
 var fileUpload = async ({ context, args, client }) => {
   const path = resolve7(context.cwd, wordAt(args, 3));
@@ -76320,7 +76476,13 @@ async function monitorRound(turn) {
     const named = { ...turn.args, flags: { ...turn.args.flags, profile: turn.profile } };
     const { client } = await signedIn({ context, args: named });
     const claim3 = forSession({ client, session });
-    const refused = await notBoundNotice({ context, client: claim3, session, error: error62 });
+    const refused = await notBoundNotice({
+      context,
+      client: claim3,
+      session,
+      error: error62,
+      profile: turn.profile
+    });
     if (refused?.rebound) return true;
     if (refused?.notice) context.out(`${refused.notice}
 `);
@@ -79110,7 +79272,7 @@ function feedFlagsOf({ args }) {
 
 // src/services/feed-files.service.ts
 import { readFile as readFile23 } from "node:fs/promises";
-import { basename as basename3, resolve as resolve9 } from "node:path";
+import { basename as basename4, resolve as resolve9 } from "node:path";
 
 // ../../modules/feed/contract/src/feed.ts
 var feedAuthorSchemaDefinition = external_exports.object({
@@ -79689,7 +79851,7 @@ async function bytesOf2({
 async function downloaded({ context, url: url2 }) {
   const response = await context.fetcher(url2);
   if (!response.ok) throw new CliUsageError(`${url2} answered ${response.status}`);
-  const fileName = basename3(new URL(url2).pathname) || "file";
+  const fileName = basename4(new URL(url2).pathname) || "file";
   const header = (response.headers.get("content-type") ?? "").split(";")[0]?.trim();
   return {
     fileName,
@@ -79699,7 +79861,7 @@ async function downloaded({ context, url: url2 }) {
 }
 async function local({ context, path }) {
   const full = resolve9(context.cwd, path);
-  const fileName = basename3(full);
+  const fileName = basename4(full);
   return {
     fileName,
     contentType: contentTypeOf(fileName),
@@ -81404,6 +81566,7 @@ var MCP_REFUSED_COMMANDS = /* @__PURE__ */ new Set([
   "vault add",
   "vault replace",
   "vault compare",
+  "vault save-from-message",
   "connect mcp-key",
   "connect card-key"
 ]);
@@ -83475,15 +83638,20 @@ async function update2({
   return 0;
 }
 
-// src/services/vault-save-commands.service.ts
-var USAGE18 = `Usage: laze vault save <pending> --name <name> --description "<what it is for>"
-Names a key Laze held from a message you received, in the sender's vault.`;
+// src/services/vault-save-message-commands.service.ts
+var SAVE_USAGE = `Usage: laze vault save <pending> --name <name> --description "<what it is for>"
+Names a key Laze held from a message you received, in the sender's vault.
+   or: laze vault save --from-message <message-id> --name <name> --description "<what>" <<'EOF'
+Saves a key a person sent in that message, which Laze did not hold, to their own vault: the key
+on stdin, exactly as it is in the message. The message then shows {{vault:<name>}}. Run it in
+your turn in the message's conversation; it needs no vault access. MCP cannot send stdin.`;
 var KEPT_IN_LAZE = "The key never left Laze: the chat, its history and your session hold only a reference, so there is nothing to rotate. Tell the person that.";
-async function vaultSave({ context, args }) {
-  const pending = args.words[2];
-  const name2 = flagText({ args, name: "name" });
-  const description = flagText({ args, name: "description" });
-  if (!pending || !name2 || !description) throw new CliUsageError(USAGE18);
+async function postInTurn({
+  context,
+  args,
+  path,
+  body
+}) {
   const env = context.environment.inherited;
   const turn = await turnTokenOf4({
     env,
@@ -83491,11 +83659,13 @@ async function vaultSave({ context, args }) {
     command: "laze vault save"
   });
   const { client } = await signedIn({ context, args });
-  const saved3 = await client.withHeaders({ "x-laze-turn": turn }).post("/api/vault/pending-secrets/save", {
-    pending,
-    name: name2,
-    description
-  });
+  return client.withHeaders({ "x-laze-turn": turn }).post(path, body);
+}
+function printSaved({
+  context,
+  args,
+  saved: saved3
+}) {
   if (args.flags.json) return context.out(`${JSON.stringify(saved3, null, 2)}
 `);
   const done = saved3.outcome === "named" ? "Saved as" : "Already named";
@@ -83505,6 +83675,40 @@ ${KEPT_IN_LAZE}
 `
   );
 }
+async function vaultSaveFromMessage({
+  context,
+  args
+}) {
+  const messageId = flagText({ args, name: "from-message" });
+  const name2 = flagText({ args, name: "name" });
+  const description = flagText({ args, name: "description" });
+  if (!messageId || !name2 || !description) throw new CliUsageError(SAVE_USAGE);
+  const value = (await context.readStdin()).trim();
+  if (!value) throw new CliUsageError(SAVE_USAGE);
+  const saved3 = await postInTurn({
+    context,
+    args,
+    path: `/api/chat/messages/${encodeURIComponent(messageId)}/save-secret`,
+    body: { value, name: name2, description }
+  });
+  printSaved({ context, args, saved: saved3 });
+}
+
+// src/services/vault-save-commands.service.ts
+async function vaultSave({ context, args }) {
+  if (flagText({ args, name: "from-message" })) return vaultSaveFromMessage({ context, args });
+  const pending = args.words[2];
+  const name2 = flagText({ args, name: "name" });
+  const description = flagText({ args, name: "description" });
+  if (!pending || !name2 || !description) throw new CliUsageError(SAVE_USAGE);
+  const saved3 = await postInTurn({
+    context,
+    args,
+    path: "/api/vault/pending-secrets/save",
+    body: { pending, name: name2, description }
+  });
+  printSaved({ context, args, saved: saved3 });
+}
 
 // src/services/vault-scrub-commands.service.ts
 function lineOf3(channel) {
@@ -84238,7 +84442,7 @@ var PATHS3 = {
 var STATUS_WAIT_SECONDS2 = 50;
 var STATUS_CALLS2 = 2;
 var SETTLED = /* @__PURE__ */ new Set(["sent", "denied", "expired", "failed"]);
-var USAGE19 = [
+var USAGE18 = [
   "Usage: laze whatsapp chats <machine> [--limit <n>]          the chats on the machine, newest first",
   "       laze whatsapp read <machine> <chat> [--limit <n>]    a chat's last messages, oldest first",
   '       laze whatsapp send <machine> <chat> "<text>"         send as the owner; an agent waits for their approval',
@@ -84248,14 +84452,14 @@ var USAGE19 = [
 ].join("\n");
 function word2({ args, at }) {
   const value = args.words[at];
-  if (!value) throw new CliUsageError(USAGE19);
+  if (!value) throw new CliUsageError(USAGE18);
   return value;
 }
 function limitOf5({ args }) {
   const text2 = flagText({ args, name: "limit" });
   if (!text2) return {};
   const limit = Number(text2);
-  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE19);
+  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE18);
   return { limit };
 }
 async function chats({ context, args }) {
@@ -84317,7 +84521,7 @@ Still waiting. Run \`laze whatsapp status ${send4.id}\` later to see the answer.
 }
 async function send3({ context, args }) {
   const text2 = args.words.slice(4).join(" ") || args.rest.join(" ");
-  if (!text2) throw new CliUsageError(USAGE19);
+  if (!text2) throw new CliUsageError(USAGE18);
   const client = await computeClient({ context, args });
   const asked = await client.post(PATHS3.send, {
     machine: word2({ args, at: 2 }),
@@ -84347,11 +84551,11 @@ async function whatsapp({
   if (command === "status") return status7({ context, args });
   const linking = whatsappPairingCommand(command);
   if (linking) return linking({ context, args });
-  throw new CliUsageError(USAGE19);
+  throw new CliUsageError(USAGE18);
 }
 
 // src/services/wiki-commands.service.ts
-var USAGE20 = `Usage:
+var USAGE19 = `Usage:
   laze wiki list
   laze wiki get <path>
   laze wiki put <path> <markdown|@file|-> [--title <title>] [--channel <channel>] [--base <version>]
@@ -84371,7 +84575,7 @@ async function wikiList({ context, args }) {
 }
 async function wikiGet({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/get", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -84388,7 +84592,7 @@ Linked from: ${page.backlinks.map((link) => link.path).join(", ")}
 async function wikiPut({ context, args }) {
   const path = args.words[2];
   const value = args.words.slice(3).join(" ");
-  if (!path || !value) throw new CliUsageError(USAGE20);
+  if (!path || !value) throw new CliUsageError(USAGE19);
   const body = await textArgument({ context, value });
   const title = flagText({ args, name: "title" });
   const channel = flagText({ args, name: "channel" });
@@ -84408,7 +84612,7 @@ async function wikiPut({ context, args }) {
 }
 async function wikiSearch({ context, args }) {
   const query = args.words.slice(2).join(" ").trim();
-  if (!query) throw new CliUsageError(USAGE20);
+  if (!query) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const hits = await client.post("/api/wiki/search", { query });
   if (args.flags.json) return context.out(`${JSON.stringify(hits, null, 2)}
@@ -84418,7 +84622,7 @@ async function wikiSearch({ context, args }) {
 }
 async function wikiHistory({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const revisions = await client.post("/api/wiki/history", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(revisions, null, 2)}
@@ -84432,7 +84636,7 @@ async function wikiHistory({ context, args }) {
 }
 async function wikiMove({ context, args }) {
   const [, , path, to] = args.words;
-  if (!path || !to) throw new CliUsageError(USAGE20);
+  if (!path || !to) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/move", { path, to });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -84442,7 +84646,7 @@ async function wikiMove({ context, args }) {
 }
 async function wikiRemove({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const removed = await client.post("/api/wiki/remove", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(removed)}
@@ -84462,7 +84666,7 @@ var WIKI_COMMANDS = {
 async function wiki({ context, args }) {
   const name2 = args.words[1] ?? "";
   const command = Object.hasOwn(WIKI_COMMANDS, name2) ? WIKI_COMMANDS[name2] : void 0;
-  if (!command) throw new CliUsageError(USAGE20);
+  if (!command) throw new CliUsageError(USAGE19);
   await command({ context, args });
 }
 
@@ -85080,6 +85284,8 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze adopt codex --status | --stop             the background adopt that laze agent link started
   laze vault run <name> --reason "<why>" -- <cmd>  run a command with a vault connection (agents)
   laze vault save <pending> --name <name> --description "<text>"   name a key Laze held from a message (agents)
+  laze vault save --from-message <id> --name <name> --description "<text>"   save a key a person sent,
+      read from stdin, to their own vault; the message keeps {{vault:<name>}} (agents, no vault access)
   laze vault scrub [--dry-run]                   move secrets found in messages to the vault now (admins)
   laze vault list|add|update|replace|compare|rm|revoke|uses   your keychains with your own key
       a value comes from stdin or --from-file, never a flag; no command prints a value
@@ -85235,6 +85441,7 @@ var COMMANDS3 = {
   app,
   "vault run": vaultRun,
   "vault save": vaultSave,
+  "vault save-from-message": vaultSaveFromMessage,
   connect,
   slack,
   "connect providers": connectAsPerson,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazehq/cli",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "The Laze command line: sign in, read and post in chat, and connect your own Claude Code or Codex session as an agent.",
   "license": "UNLICENSED",
   "type": "module",