@lazehq/cli 0.1.26 → 0.1.28

package/dist/laze.mjs

@@ -30997,6 +30997,41 @@ function isBasicAuthPayload(value) {
 }
 var CREDENTIAL_QUALIFIERS = "master|encryption|signing|private|access|api|auth|secret|refresh|session|bearer|verification|webhook|client|service|personal|root|admin";
 var CREDENTIAL_KEYWORD = `(?:x[_.\\- ]?)?(?:(?:${CREDENTIAL_QUALIFIERS})[_.\\- ]?(?:api[_.\\- ]?)?key|(?:${CREDENTIAL_QUALIFIERS})?[_.\\- ]?(?:api[_.\\- ]?)?(?:token|secret|password|passwd|pwd|credentials?|authorization|cookie))`;
+var UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var GIT_SHA = /^[0-9a-f]{40}$/;
+var DOMAIN_PATH = /^[A-Za-z0-9-]+(?:\.[A-Za-z0-9-]+)*\.[A-Za-z]{2,}\//;
+var NAMED_KEY_MIN = 24;
+var NAMED_KEY_MAX = 256;
+function isSlug(value) {
+  const parts = value.split(/[-_.]/);
+  if (parts.length < 3) return false;
+  const short = parts.every((part) => /^(?:[a-z0-9]{1,10}|[A-Z0-9]{1,10})$/.test(part));
+  return short && parts.some((part) => /^[A-Za-z]{3,}$/.test(part));
+}
+var NOT_A_NAMED_KEY = [
+  /^\/|\/\//,
+  GIT_SHA,
+  DOMAIN_PATH,
+  PATH_LIKE,
+  CODE_EXPRESSION,
+  ENV_REFERENCE,
+  VERSION_LIKE
+];
+function isNamedKeyValue(value) {
+  if (value.length < NAMED_KEY_MIN || value.length > NAMED_KEY_MAX) return false;
+  if (UUID.test(value)) return true;
+  if (isSlug(value)) return false;
+  if (NOT_A_NAMED_KEY.some((shape) => shape.test(value))) return false;
+  const prefix = /^([A-Za-z][A-Za-z0-9]{1,11})[_-]/.exec(value)?.[1];
+  if (prefix && isNonCredentialPrefix(prefix)) return false;
+  if (HEX.test(value)) return true;
+  if (shannonEntropyBits(value) < 3.5) return false;
+  const c = charClasses(value);
+  return c.digit >= 2 && c.lower + c.upper >= 8 && (c.lower >= 2 || c.upper >= 2);
+}
+var KEY_WORD = String.raw`(?:api[_.\- ]?key|apikey|access[_.\- ]?key|key|token|secret|password|passwd|pwd)`;
+var QUOTE = "[\"'`]";
+var KEY_WORD_GAP = String.raw`(?:[ \t]{0,3}(?:is|was|here|it's|its|below|:|=|->|=>|-{1,2}))`;
 var TOKEN_START = "(?<![A-Za-z0-9_-])";
 var TOKEN_END = "(?![A-Za-z0-9_-])";
 var VENDOR_KEY_PATTERNS = [
@@ -31125,11 +31160,21 @@ var RULES = [
       "i"
     ),
     value: { kind: "group", group: 2 },
+    dropsFullStop: true,
     accept: (match) => {
       const introduction = groupOf(match, 1);
       const value = groupOf(match, 2);
       return STRICT_INTRODUCTION.test(introduction) ? isCredentialValue(value) : isKeyMaterial(value);
     }
+  },
+  {
+    id: "named_key",
+    regex: rx(
+      String.raw`\b(${KEY_WORD})\b(${KEY_WORD_GAP}{0,3}[ \t]*(?:\r?\n[ \t]*)?${QUOTE}?)` + String.raw`([A-Za-z0-9+/=_.-]{${NAMED_KEY_MIN - 1},${NAMED_KEY_MAX - 1}}[A-Za-z0-9+/=_-])` + String.raw`(?![A-Za-z0-9+/=_-]|\.[A-Za-z0-9])`,
+      "i"
+    ),
+    value: { kind: "group", group: 3 },
+    accept: (match) => /[\s:="'`]/.test(groupOf(match, 2)) && isNamedKeyValue(groupOf(match, 3))
   }
 ];
 var SECRET_RULE_IDS = RULES.map((rule) => rule.id);
@@ -31157,12 +31202,21 @@ function spanStartOf({ rule, text: text2, fullStart }) {
   const before = rule.precededBy.exec(text2.slice(from, fullStart));
   return before ? fullStart - before[0].length : fullStart;
 }
+function withoutFullStop({
+  text: text2,
+  span
+}) {
+  let end = span.end;
+  while (end > span.start && text2[end - 1] === "." && !/\S/.test(text2[end] ?? "")) end--;
+  return end === span.end ? span : { start: span.start, end, spanEnd: Math.min(span.spanEnd, end) };
+}
 function rawMatches(rule, text2) {
   const out = [];
   rule.regex.lastIndex = 0;
   for (const match of text2.matchAll(rule.regex)) {
     if (rule.accept && !rule.accept(match)) continue;
-    const span = valueSpan(rule, match);
+    const found = valueSpan(rule, match);
+    const span = found && rule.dropsFullStop ? withoutFullStop({ text: text2, span: found }) : found;
     if (!span || span.end <= span.start) continue;
     const spanStart = spanStartOf({ rule, text: text2, fullStart: match.index });
     out.push({ ruleId: rule.id, spanStart, ...span });
@@ -31322,7 +31376,33 @@ function suggestedName({
   const line = lineBreak === -1 ? before : before.slice(lineBreak + 1);
   const assigned = ASSIGNMENT.exec(line)?.[1]?.toUpperCase();
   if (assigned && isValidSecretName(assigned)) return assigned;
-  return defaultName({ kind, value, before });
+  const lead = before.replace(/\s+$/, "");
+  const lastLine = lead.slice(lead.search(/[^\r\n]*$/));
+  const named = KEY_WORD_KINDS.has(kind) ? keyWordName({ line: lastLine }) : null;
+  return named ?? defaultName({ kind, value, before });
+}
+var KEY_WORD_KINDS = /* @__PURE__ */ new Set(["named_key", "sensitive_assignment"]);
+var VENDOR_KEY_WORD = /([A-Za-z][A-Za-z0-9]{1,30})[ _.-]+(?:(?:api|access)[ _.-]?)?(key|token|secret|password|passwd|pwd)\b/gi;
+var NOT_VENDOR_WORDS = new Set(
+  "a an the my your our their his her its this that these new old here is of for with and or to my api access secret private public personal prod production live test dev staging master admin root bearer auth client service session refresh read write full main default".split(
+    " "
+  )
+);
+var KEY_WORD_SUFFIXES = {
+  key: "_API_KEY",
+  token: "_TOKEN",
+  secret: "_SECRET",
+  password: "_PASSWORD",
+  passwd: "_PASSWORD",
+  pwd: "_PASSWORD"
+};
+function keyWordName({ line }) {
+  const last = [...line.slice(-80).matchAll(VENDOR_KEY_WORD)].at(-1);
+  const vendor = last?.[1]?.toLowerCase();
+  const word3 = last?.[2]?.toLowerCase();
+  if (!vendor || !word3 || NOT_VENDOR_WORDS.has(vendor)) return null;
+  const name2 = `${vendor.toUpperCase()}${KEY_WORD_SUFFIXES[word3] ?? "_KEY"}`;
+  return isValidSecretName(name2) ? name2 : null;
 }
 var SAFE_CUT_LOOKAHEAD = 4096;
 var PEM_BEGIN = "-----BEGIN";
@@ -35426,6 +35506,8 @@ function cliEnvironment({
 } = {}) {
   return {
     configPath: env.LAZE_CLI_CONFIG || join(homedir(), ".laze", "config.json"),
+    // Claude Code names a subagent's commands `claude-code_<version>_agent`.
+    subagent: /^claude-code_.+_agent$/.test(env.AI_AGENT ?? ""),
     profile: env.LAZE_PROFILE || void 0,
     url: env.LAZE_URL || void 0,
     opsToken: env.LAZE_OPS_TOKEN || void 0,
@@ -35625,7 +35707,7 @@ function flagText({
 }
 
 // src/rules/cli-version.rules.ts
-var STAMPED = "0.1.26";
+var STAMPED = "0.1.28";
 function cliVersionOf({ stamped = STAMPED } = {}) {
   return stamped.startsWith("__") ? "dev" : stamped;
 }
@@ -57848,6 +57930,17 @@ var chatScrubReportSchemaDefinition = external_exports.object({
   channels: external_exports.array(chatScrubChannelSchemaDefinition)
 });
 var chatScrubReportSchema = chatScrubReportSchemaDefinition;
+var saveMessageSecretBodySchemaDefinition = external_exports.object({
+  /** One token, as keys are: a value with spaces is text, not a key. */
+  value: external_exports.string().min(8).max(4096).regex(/^\S+$/),
+  name: external_exports.string().regex(/^[a-z0-9][a-z0-9-]{0,62}$/),
+  description: external_exports.string().trim().min(1).max(120)
+});
+var messageSecretSavedSchemaDefinition = external_exports.object({
+  outcome: external_exports.enum(["named", "already_named"]),
+  name: external_exports.string(),
+  connectionId: external_exports.string()
+});
 
 // ../../modules/chat/contract/src/chat.sent.ts
 var SENT_PAGE_MAX = 50;
@@ -62603,6 +62696,16 @@ var savePendingSecretBodySchemaDefinition = external_exports.object({
   name: connectionName2,
   description: external_exports.string().trim().min(1).max(120)
 });
+var saveMessageSecretInputSchemaDefinition = external_exports.object({
+  workspaceId: external_exports.string().min(1),
+  channelId: external_exports.string().min(1),
+  messageId: external_exports.string().min(1),
+  /** The message's author, a person: the keychain the value goes to. */
+  ownerUserId: external_exports.string().min(1),
+  value: external_exports.string().min(8).max(4096).regex(/^\S+$/),
+  name: connectionName2,
+  description: external_exports.string().trim().min(1).max(120)
+});
 var vaultPendingSecretSavedSchemaDefinition = external_exports.object({
   outcome: external_exports.enum(["named", "already_named"]),
   name: connectionName2,
@@ -66817,14 +66920,26 @@ async function liveElsewhere({
   }
   return false;
 }
-function notBoundText({ meta: meta3 }) {
-  return `Laze: this agent listens in another session${meta3.bound ? `: ${meta3.bound}` : ""}. Create a new Laze agent with this session: laze agent request. Or move this agent here: laze agent bind.`;
+function refuseInSubagent({ context, args }) {
+  if (!context.environment.subagent || flagText({ args, name: "session" })) return;
+  throw new CliUsageError(
+    "This runs inside a Claude Code subagent, which shares its parent's session: it would take that session. Run it in the session itself, or pass --session <id>."
+  );
+}
+function notBoundText({
+  meta: meta3,
+  agent: agent2,
+  configPath
+}) {
+  const who = `${agent2 ? `"${agent2}"` : "this agent"} (config ${configPath})`;
+  return `Laze: ${who} listens in another session${meta3.bound ? `: ${meta3.bound}` : ""}. Create a new Laze agent with this session: laze agent request. Or move this agent here: laze agent bind.`;
 }
 async function notBoundNotice({
   context,
   client,
   session,
-  error: error62
+  error: error62,
+  profile
 }) {
   if (!(error62 instanceof LazeApiError) || error62.code !== "session_not_bound") return void 0;
   const meta3 = error62.meta ?? {};
@@ -66844,7 +66959,10 @@ async function notBoundNotice({
   if (told) return { notice: void 0 };
   await mkdir3(dirname3(path), { recursive: true, mode: 448 });
   await writeFile3(path, String(context.nowMs()), { mode: 384 });
-  return { notice: notBoundText({ meta: meta3 }) };
+  const agent2 = (await context.store.read()).profiles[profile]?.name;
+  return {
+    notice: notBoundText({ meta: meta3, agent: agent2, configPath: context.environment.configPath })
+  };
 }
 
 // src/services/plugin-hook.service.ts
@@ -67676,7 +67794,8 @@ async function settleRound(round) {
       context,
       client: forSession({ client, session }),
       session,
-      error: error62
+      error: error62,
+      profile: name2
     });
     if (!refused) throw error62;
     return refused;
@@ -69321,6 +69440,7 @@ async function linkCodexSession({
 
 // src/services/laze-plugin.service.ts
 import { mkdir as mkdir11, readFile as readFile11, writeFile as writeFile11 } from "node:fs/promises";
+import { homedir as homedir3 } from "node:os";
 import { dirname as dirname11, join as join13 } from "node:path";
 
 // src/rules/laze-plugin.rules.ts
@@ -69461,15 +69581,7 @@ async function writeLazePlugin({ context }) {
   }
   return folder;
 }
-async function registerWithClaude({ context, folder }) {
-  const quiet = ">/dev/null 2>&1 </dev/null";
-  const script = [
-    `claude plugin marketplace add ${quote2(folder)} --scope user ${quiet}`,
-    `claude plugin marketplace update ${LAZE_PLUGIN} ${quiet}`,
-    // install is a no-op for a plugin Claude Code already has; update refreshes its cached copy.
-    `{ claude plugin install ${LAZE_PLUGIN}@${LAZE_PLUGIN} --scope user ${quiet} || true; }`,
-    `claude plugin update ${LAZE_PLUGIN}@${LAZE_PLUGIN} ${quiet}`
-  ].join("; ");
+async function claudeScript({ context, script }) {
   const stop3 = new AbortController();
   const command = ["sh", "-c", script];
   const run4 = context.runCommand({ command, env: {}, signal: stop3.signal }).catch(() => 1);
@@ -69480,6 +69592,44 @@ async function registerWithClaude({ context, folder }) {
   stop3.abort();
   return code === 0;
 }
+var QUIET = ">/dev/null 2>&1 </dev/null";
+async function registerWithClaude({ context, folder }) {
+  const script = [
+    `claude plugin marketplace add ${quote2(folder)} --scope user ${QUIET}`,
+    `claude plugin marketplace update ${LAZE_PLUGIN} ${QUIET}`,
+    // install is a no-op for a plugin Claude Code already has; update refreshes its cached copy.
+    `{ claude plugin install ${LAZE_PLUGIN}@${LAZE_PLUGIN} --scope user ${QUIET} || true; }`,
+    `claude plugin update ${LAZE_PLUGIN}@${LAZE_PLUGIN} ${QUIET}`
+  ].join("; ");
+  return claudeScript({ context, script });
+}
+var RUN_FILES = ["hooks/hooks.json", "monitors/monitors.json"];
+async function cachedPluginOf({ context }) {
+  const inherited = context.environment.inherited;
+  const home = inherited.HOME || homedir3();
+  const claude = inherited.CLAUDE_CONFIG_DIR || join13(home, ".claude");
+  const listed = await readFile11(join13(claude, "plugins", "installed_plugins.json"), "utf8").then(
+    (text2) => JSON.parse(text2),
+    () => void 0
+  );
+  return listed?.plugins?.[`${LAZE_PLUGIN}@${LAZE_PLUGIN}`]?.[0]?.installPath;
+}
+async function refreshStaleCache({ context, folder }) {
+  const cached2 = await cachedPluginOf({ context });
+  if (!cached2) return true;
+  const read3 = (path) => readFile11(path, "utf8").catch(() => "");
+  for (const file3 of RUN_FILES) {
+    const ours = await read3(join13(folder, LAZE_PLUGIN, file3));
+    if (ours === await read3(join13(cached2, file3))) continue;
+    const plugin2 = `${LAZE_PLUGIN}@${LAZE_PLUGIN}`;
+    const script = [
+      `claude plugin uninstall ${plugin2} --scope user ${QUIET}`,
+      `claude plugin install ${plugin2} --scope user ${QUIET}`
+    ].join("; ");
+    return claudeScript({ context, script });
+  }
+  return true;
+}
 function registeredMarkOf({ context }) {
   return join13(pluginFolderOf({ context }), "registered");
 }
@@ -69491,7 +69641,7 @@ async function pluginRegistered({ context }) {
 }
 async function installLazePlugin({ context }) {
   const folder = await writeLazePlugin({ context });
-  const registered = await registerWithClaude({ context, folder });
+  const registered = await registerWithClaude({ context, folder }) && await refreshStaleCache({ context, folder });
   if (registered) await writeFile11(registeredMarkOf({ context }), cliVersionOf());
   return { folder, registered };
 }
@@ -69840,6 +69990,7 @@ function sandboxed({ context, error: error62 }) {
 async function linkAgent({ context, args }) {
   const token2 = flagText({ args, name: "token" });
   if (!token2) throw new CliUsageError("Usage: laze agent link --token <token>");
+  refuseInSubagent({ context, args });
   const url2 = serverUrlOf({ context, args });
   const { harness, pid } = await harnessOf2({ context, args });
   const client = LazeClient.create({ baseUrl: url2, fetcher: context.fetcher });
@@ -69989,7 +70140,13 @@ async function handOver({ context, args }) {
   try {
     fresh = await receiveMessages({ context, client: claim3, waitSeconds: 0 });
   } catch (error62) {
-    const refused = await notBoundNotice({ context, client: claim3, session, error: error62 });
+    const refused = await notBoundNotice({
+      context,
+      client: claim3,
+      session,
+      error: error62,
+      profile: agent2
+    });
     if (!refused) throw error62;
     if (refused.notice) stopContext({ context, text: refused.notice });
     return;
@@ -70723,17 +70880,30 @@ async function setAgentPool({
 
 // src/services/agent-session-commands.service.ts
 var NO_SESSION = "Run this inside the Claude Code or Codex session the agent should listen in, or pass --session <id>.";
+var NO_AGENT = "This session and its folder have no agent: name one with `laze agent bind --profile <name>`.";
 var DEFAULT_WAIT_SECONDS = 300;
 async function bindAgentSession({
   context,
   args
 }) {
+  refuseInSubagent({ context, args });
   const session = await currentSessionOf({ context, args });
   if (!session) throw new CliUsageError(NO_SESSION);
-  const { client, name: name2 } = await signedIn({ context, args });
+  const key = sessionKeyOf({ session });
+  const config2 = await context.store.read();
+  const held = config2.sessions?.[key];
+  const own2 = held && config2.profiles[held] ? held : void 0;
+  const explicit = flagText({ args, name: "profile" }) || void 0;
+  const target = explicit ?? own2 ?? boundProfileOf({ bindings: config2.bindings, cwd: context.cwd });
+  if (!target) throw new CliUsageError(NO_AGENT);
+  const named = { ...args, flags: { ...args.flags, profile: target } };
+  const { client, name: name2, profile } = await signedIn({ context, args: named });
   await forSession({ client, session }).post("/api/agents/me/bind", {});
-  await context.store.bindSession({ session: sessionKeyOf({ session }), profile: name2 });
-  context.out("This agent now listens in this session.\n");
+  await context.store.bindSession({ session: key, profile: name2 });
+  const where = `profile ${name2}, config ${context.environment.configPath}`;
+  const from = own2 && own2 !== name2 ? ` It moved from "${config2.profiles[own2]?.name}".` : "";
+  context.out(`"${profile.name}" now listens in this session (${where}).${from}
+`);
 }
 async function mintedRequestProfile({
   context,
@@ -71898,7 +72068,9 @@ var appPinSchemaDefinition = external_exports.object({
   pinnedByName: external_exports.string().nullable(),
   pinnedAt: external_exports.iso.datetime(),
   /** Set for a browser tab, null for an app. */
-  browser: browserPinSchemaDefinition.nullable()
+  browser: browserPinSchemaDefinition.nullable(),
+  /** Whether the reader may unpin it; a browser tab only its owner, their agents or an Admin. */
+  canUnpin: external_exports.boolean().default(true)
 });
 var appPinViewSchemaDefinition = external_exports.object({
   activeAppId: external_exports.string().nullable(),
@@ -72404,6 +72576,7 @@ var AppNavSlot = appUi.component("nav");
 var AppPanelSlot = appUi.component("panel");
 var AppCardSlot = appUi.component("card");
 var AppPinStripSlot = appUi.component("pin-strip");
+var AppPinListSlot = appUi.component("pin-list");
 
 // ../../modules/app/contract/src/app.config.ts
 var appConfig = Config.define((c) => ({
@@ -76347,7 +76520,13 @@ async function monitorRound(turn) {
     const named = { ...turn.args, flags: { ...turn.args.flags, profile: turn.profile } };
     const { client } = await signedIn({ context, args: named });
     const claim3 = forSession({ client, session });
-    const refused = await notBoundNotice({ context, client: claim3, session, error: error62 });
+    const refused = await notBoundNotice({
+      context,
+      client: claim3,
+      session,
+      error: error62,
+      profile: turn.profile
+    });
     if (refused?.rebound) return true;
     if (refused?.notice) context.out(`${refused.notice}
 `);
@@ -81431,6 +81610,7 @@ var MCP_REFUSED_COMMANDS = /* @__PURE__ */ new Set([
   "vault add",
   "vault replace",
   "vault compare",
+  "vault save-from-message",
   "connect mcp-key",
   "connect card-key"
 ]);
@@ -83502,15 +83682,20 @@ async function update2({
   return 0;
 }
 
-// src/services/vault-save-commands.service.ts
-var USAGE18 = `Usage: laze vault save <pending> --name <name> --description "<what it is for>"
-Names a key Laze held from a message you received, in the sender's vault.`;
+// src/services/vault-save-message-commands.service.ts
+var SAVE_USAGE = `Usage: laze vault save <pending> --name <name> --description "<what it is for>"
+Names a key Laze held from a message you received, in the sender's vault.
+   or: laze vault save --from-message <message-id> --name <name> --description "<what>" <<'EOF'
+Saves a key a person sent in that message, which Laze did not hold, to their own vault: the key
+on stdin, exactly as it is in the message. The message then shows {{vault:<name>}}. Run it in
+your turn in the message's conversation; it needs no vault access. MCP cannot send stdin.`;
 var KEPT_IN_LAZE = "The key never left Laze: the chat, its history and your session hold only a reference, so there is nothing to rotate. Tell the person that.";
-async function vaultSave({ context, args }) {
-  const pending = args.words[2];
-  const name2 = flagText({ args, name: "name" });
-  const description = flagText({ args, name: "description" });
-  if (!pending || !name2 || !description) throw new CliUsageError(USAGE18);
+async function postInTurn({
+  context,
+  args,
+  path,
+  body
+}) {
   const env = context.environment.inherited;
   const turn = await turnTokenOf4({
     env,
@@ -83518,11 +83703,13 @@ async function vaultSave({ context, args }) {
     command: "laze vault save"
   });
   const { client } = await signedIn({ context, args });
-  const saved3 = await client.withHeaders({ "x-laze-turn": turn }).post("/api/vault/pending-secrets/save", {
-    pending,
-    name: name2,
-    description
-  });
+  return client.withHeaders({ "x-laze-turn": turn }).post(path, body);
+}
+function printSaved({
+  context,
+  args,
+  saved: saved3
+}) {
   if (args.flags.json) return context.out(`${JSON.stringify(saved3, null, 2)}
 `);
   const done = saved3.outcome === "named" ? "Saved as" : "Already named";
@@ -83532,6 +83719,40 @@ ${KEPT_IN_LAZE}
 `
   );
 }
+async function vaultSaveFromMessage({
+  context,
+  args
+}) {
+  const messageId = flagText({ args, name: "from-message" });
+  const name2 = flagText({ args, name: "name" });
+  const description = flagText({ args, name: "description" });
+  if (!messageId || !name2 || !description) throw new CliUsageError(SAVE_USAGE);
+  const value = (await context.readStdin()).trim();
+  if (!value) throw new CliUsageError(SAVE_USAGE);
+  const saved3 = await postInTurn({
+    context,
+    args,
+    path: `/api/chat/messages/${encodeURIComponent(messageId)}/save-secret`,
+    body: { value, name: name2, description }
+  });
+  printSaved({ context, args, saved: saved3 });
+}
+
+// src/services/vault-save-commands.service.ts
+async function vaultSave({ context, args }) {
+  if (flagText({ args, name: "from-message" })) return vaultSaveFromMessage({ context, args });
+  const pending = args.words[2];
+  const name2 = flagText({ args, name: "name" });
+  const description = flagText({ args, name: "description" });
+  if (!pending || !name2 || !description) throw new CliUsageError(SAVE_USAGE);
+  const saved3 = await postInTurn({
+    context,
+    args,
+    path: "/api/vault/pending-secrets/save",
+    body: { pending, name: name2, description }
+  });
+  printSaved({ context, args, saved: saved3 });
+}
 
 // src/services/vault-scrub-commands.service.ts
 function lineOf3(channel) {
@@ -84265,7 +84486,7 @@ var PATHS3 = {
 var STATUS_WAIT_SECONDS2 = 50;
 var STATUS_CALLS2 = 2;
 var SETTLED = /* @__PURE__ */ new Set(["sent", "denied", "expired", "failed"]);
-var USAGE19 = [
+var USAGE18 = [
   "Usage: laze whatsapp chats <machine> [--limit <n>]          the chats on the machine, newest first",
   "       laze whatsapp read <machine> <chat> [--limit <n>]    a chat's last messages, oldest first",
   '       laze whatsapp send <machine> <chat> "<text>"         send as the owner; an agent waits for their approval',
@@ -84275,14 +84496,14 @@ var USAGE19 = [
 ].join("\n");
 function word2({ args, at }) {
   const value = args.words[at];
-  if (!value) throw new CliUsageError(USAGE19);
+  if (!value) throw new CliUsageError(USAGE18);
   return value;
 }
 function limitOf5({ args }) {
   const text2 = flagText({ args, name: "limit" });
   if (!text2) return {};
   const limit = Number(text2);
-  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE19);
+  if (!Number.isInteger(limit) || limit < 1) throw new CliUsageError(USAGE18);
   return { limit };
 }
 async function chats({ context, args }) {
@@ -84344,7 +84565,7 @@ Still waiting. Run \`laze whatsapp status ${send4.id}\` later to see the answer.
 }
 async function send3({ context, args }) {
   const text2 = args.words.slice(4).join(" ") || args.rest.join(" ");
-  if (!text2) throw new CliUsageError(USAGE19);
+  if (!text2) throw new CliUsageError(USAGE18);
   const client = await computeClient({ context, args });
   const asked = await client.post(PATHS3.send, {
     machine: word2({ args, at: 2 }),
@@ -84374,11 +84595,11 @@ async function whatsapp({
   if (command === "status") return status7({ context, args });
   const linking = whatsappPairingCommand(command);
   if (linking) return linking({ context, args });
-  throw new CliUsageError(USAGE19);
+  throw new CliUsageError(USAGE18);
 }
 
 // src/services/wiki-commands.service.ts
-var USAGE20 = `Usage:
+var USAGE19 = `Usage:
   laze wiki list
   laze wiki get <path>
   laze wiki put <path> <markdown|@file|-> [--title <title>] [--channel <channel>] [--base <version>]
@@ -84398,7 +84619,7 @@ async function wikiList({ context, args }) {
 }
 async function wikiGet({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/get", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -84415,7 +84636,7 @@ Linked from: ${page.backlinks.map((link) => link.path).join(", ")}
 async function wikiPut({ context, args }) {
   const path = args.words[2];
   const value = args.words.slice(3).join(" ");
-  if (!path || !value) throw new CliUsageError(USAGE20);
+  if (!path || !value) throw new CliUsageError(USAGE19);
   const body = await textArgument({ context, value });
   const title = flagText({ args, name: "title" });
   const channel = flagText({ args, name: "channel" });
@@ -84435,7 +84656,7 @@ async function wikiPut({ context, args }) {
 }
 async function wikiSearch({ context, args }) {
   const query = args.words.slice(2).join(" ").trim();
-  if (!query) throw new CliUsageError(USAGE20);
+  if (!query) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const hits = await client.post("/api/wiki/search", { query });
   if (args.flags.json) return context.out(`${JSON.stringify(hits, null, 2)}
@@ -84445,7 +84666,7 @@ async function wikiSearch({ context, args }) {
 }
 async function wikiHistory({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const revisions = await client.post("/api/wiki/history", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(revisions, null, 2)}
@@ -84459,7 +84680,7 @@ async function wikiHistory({ context, args }) {
 }
 async function wikiMove({ context, args }) {
   const [, , path, to] = args.words;
-  if (!path || !to) throw new CliUsageError(USAGE20);
+  if (!path || !to) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const page = await client.post("/api/wiki/move", { path, to });
   if (args.flags.json) return context.out(`${JSON.stringify(page, null, 2)}
@@ -84469,7 +84690,7 @@ async function wikiMove({ context, args }) {
 }
 async function wikiRemove({ context, args }) {
   const path = args.words[2];
-  if (!path) throw new CliUsageError(USAGE20);
+  if (!path) throw new CliUsageError(USAGE19);
   const { client } = await signedIn({ context, args });
   const removed = await client.post("/api/wiki/remove", { path });
   if (args.flags.json) return context.out(`${JSON.stringify(removed)}
@@ -84489,7 +84710,7 @@ var WIKI_COMMANDS = {
 async function wiki({ context, args }) {
   const name2 = args.words[1] ?? "";
   const command = Object.hasOwn(WIKI_COMMANDS, name2) ? WIKI_COMMANDS[name2] : void 0;
-  if (!command) throw new CliUsageError(USAGE20);
+  if (!command) throw new CliUsageError(USAGE19);
   await command({ context, args });
 }
 
@@ -85107,6 +85328,8 @@ var HELP = `laze: work in a Laze workspace from your terminal or your agent.
   laze adopt codex --status | --stop             the background adopt that laze agent link started
   laze vault run <name> --reason "<why>" -- <cmd>  run a command with a vault connection (agents)
   laze vault save <pending> --name <name> --description "<text>"   name a key Laze held from a message (agents)
+  laze vault save --from-message <id> --name <name> --description "<text>"   save a key a person sent,
+      read from stdin, to their own vault; the message keeps {{vault:<name>}} (agents, no vault access)
   laze vault scrub [--dry-run]                   move secrets found in messages to the vault now (admins)
   laze vault list|add|update|replace|compare|rm|revoke|uses   your keychains with your own key
       a value comes from stdin or --from-file, never a flag; no command prints a value
@@ -85262,6 +85485,7 @@ var COMMANDS3 = {
   app,
   "vault run": vaultRun,
   "vault save": vaultSave,
+  "vault save-from-message": vaultSaveFromMessage,
   connect,
   slack,
   "connect providers": connectAsPerson,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lazehq/cli",
-  "version": "0.1.26",
+  "version": "0.1.28",
   "description": "The Laze command line: sign in, read and post in chat, and connect your own Claude Code or Codex session as an agent.",
   "license": "UNLICENSED",
   "type": "module",