@moxxy/plugin-vault 0.26.0 → 0.27.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (5) hide show
  1. package/dist/index.d.ts.map +1 -1
  2. package/dist/index.js +43 -0
  3. package/dist/index.js.map +1 -1
  4. package/package.json +4 -4
  5. package/src/index.ts +44 -0
package/dist/index.d.ts.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,MAAM,EAIZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpG,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CA+L1G"}
1
+ {"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAKL,KAAK,MAAM,EAIZ,MAAM,YAAY,CAAC;AAEpB,OAAO,EAA2B,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAC9D,YAAY,EAAE,UAAU,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,YAAY,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,KAAK,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEpG,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,SAAS,CAAC,EAAE,eAAe,CAAC;IACrC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;CAClC;AAED,wBAAgB,gBAAgB,IAAI,MAAM,CAEzC;AAED,wBAAgB,gBAAgB,CAAC,IAAI,GAAE,uBAA4B,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,UAAU,CAAA;CAAE,CA2O1G"}
package/dist/index.js CHANGED
@@ -19,6 +19,14 @@ export function buildVaultPlugin(opts = {}) {
19
19
  disableKeytar: opts.disableKeytar,
20
20
  });
21
21
  const vault = new VaultStore({ filePath, keySource });
22
+ // Capability surface shared by every vault tool: the encrypted store file and
23
+ // the cached master key, INCLUDING their atomic-write temp siblings
24
+ // (`<file>.<pid>.<uuid>.tmp` — see writeFileAtomic). Read and write are
25
+ // declared together because any open() may create the store or backfill the
26
+ // key cache. No timeMs on these tools: a first open() can block indefinitely
27
+ // on an interactive passphrase prompt.
28
+ const vaultFsGlobs = [`${filePath}*`, `${moxxyPath('vault.key')}*`];
29
+ const vaultEnv = [opts.envVar ?? 'MOXXY_VAULT_PASSPHRASE'];
22
30
  // `/vault` slash command. Lets the USER store a secret out-of-band: the
23
31
  // value travels in the slash-command args, which channels intercept and
24
32
  // never send to the model. After storing, we inject a note into the event
@@ -125,6 +133,13 @@ export function buildVaultPlugin(opts = {}) {
125
133
  tags: z.array(z.string()).optional(),
126
134
  }),
127
135
  permission: { action: 'prompt' },
136
+ isolation: {
137
+ capabilities: {
138
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
139
+ net: { mode: 'none' },
140
+ env: vaultEnv,
141
+ },
142
+ },
128
143
  handler: async ({ name, value, tags }) => {
129
144
  await vault.set(name, value, tags);
130
145
  return `stored ${name} (${value.length} chars) in vault`;
@@ -135,6 +150,13 @@ export function buildVaultPlugin(opts = {}) {
135
150
  description: 'Fetch a secret from the encrypted vault by name. Returns the plaintext value.',
136
151
  inputSchema: z.object({ name: z.string().min(1) }),
137
152
  permission: { action: 'prompt' },
153
+ isolation: {
154
+ capabilities: {
155
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
156
+ net: { mode: 'none' },
157
+ env: vaultEnv,
158
+ },
159
+ },
138
160
  handler: async ({ name }) => {
139
161
  const value = await vault.get(name);
140
162
  if (value === null) {
@@ -153,6 +175,13 @@ export function buildVaultPlugin(opts = {}) {
153
175
  description: 'List entries in the vault. Returns names + metadata only, never plaintext.',
154
176
  inputSchema: z.object({}),
155
177
  permission: { action: 'prompt' },
178
+ isolation: {
179
+ capabilities: {
180
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
181
+ net: { mode: 'none' },
182
+ env: vaultEnv,
183
+ },
184
+ },
156
185
  handler: async () => {
157
186
  const entries = await vault.list();
158
187
  return entries.map((e) => ({ name: e.name, createdAt: e.createdAt, tags: e.tags ?? [] }));
@@ -163,6 +192,13 @@ export function buildVaultPlugin(opts = {}) {
163
192
  description: 'Delete a vault entry by name.',
164
193
  inputSchema: z.object({ name: z.string().min(1) }),
165
194
  permission: { action: 'prompt' },
195
+ isolation: {
196
+ capabilities: {
197
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
198
+ net: { mode: 'none' },
199
+ env: vaultEnv,
200
+ },
201
+ },
166
202
  handler: async ({ name }) => {
167
203
  const removed = await vault.delete(name);
168
204
  return removed ? `deleted ${name}` : `not found: ${name}`;
@@ -172,6 +208,13 @@ export function buildVaultPlugin(opts = {}) {
172
208
  name: 'vault_status',
173
209
  description: 'Report which key source unlocked the vault (keychain, env, passphrase).',
174
210
  inputSchema: z.object({}),
211
+ isolation: {
212
+ capabilities: {
213
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
214
+ net: { mode: 'none' },
215
+ env: vaultEnv,
216
+ },
217
+ },
175
218
  handler: async () => {
176
219
  await vault.open();
177
220
  const entries = await vault.list();
package/dist/index.js.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,CAAC,EACD,UAAU,EACV,YAAY,EACZ,UAAU,GAKX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAwB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpG,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,CAAC,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgC,EAAE;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;IACrD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,uBAAuB,CAAC;YACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,aAAa;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAEtD,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,QAAQ,GAAe;QAC3B,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qCAAqC;QAClD,YAAY,EAAE,oBAAoB;QAClC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE5C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;YACrD,CAAC;YAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kEAAkE,EAAE,CAAC;gBACpG,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,GAAG,CACzG,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACxF,CAAC;YAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,6EAA6E;qBACvF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,iCAAiC,EAAE,CAAC;gBAChG,CAAC;gBAED,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAE7B,wEAAwE;gBACxE,sEAAsE;gBACtE,yEAAyE;gBACzE,+DAA+D;gBAC/D,MAAM,IAAI,GACR,mBAAmB,IAAI,sCAAsC,IAAI,mCAAmC,CAAC;gBACvG,MAAM,CAAC,GAAG,GAAG,CAAC,OAAuC,CAAC;gBACtD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC7E,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;4BACjB,IAAI,EAAE,aAAa;4BACnB,SAAS,EAAE,GAAG,CAAC,SAAS;4BACxB,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM;4BAC5B,MAAM,EAAE,QAAQ;4BAChB,IAAI,EAAE,IAAI;yBACX,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,+DAA+D;wBAC/D,iEAAiE;wBACjE,8DAA8D;wBAC9D,8DAA8D;wBAC9D,6DAA6D;wBAC7D,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,6CAA6C;4BAClE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,iEAAiE;gBACjE,4DAA4D;gBAE5D,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,aAAa,IAAI,2BAA2B;wBAC5C,8CAA8C,IAAI,kCAAkC;iBACvF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;QAChB,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,6BAA6B;QAC7B,KAAK,EAAE;YACL,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACd,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtC,0EAA0E;gBAC1E,yEAAyE;gBACzE,6CAA6C;gBAC7C,GAAG,CAAC,QAAQ,CAAC,QAAQ,CACnB,gBAAgB,EAChB,CAAC,KAAa,EAAmB,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAChE,CAAC;YACJ,CAAC;SACF;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,KAAK,EAAE;YACL,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,WAAW,EACT,oEAAoE;oBACpE,mFAAmF;oBACnF,+FAA+F;oBAC/F,+FAA+F;oBAC/F,wCAAwC;gBAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;iBACrC,CAAC;gBACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;oBACvC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;oBACnC,OAAO,UAAU,IAAI,KAAK,KAAK,CAAC,MAAM,kBAAkB,CAAC;gBAC3D,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,+EAA+E;gBAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,MAAM,IAAI,UAAU,CAAC;4BACnB,IAAI,EAAE,YAAY;4BAClB,OAAO,EAAE,WAAW,IAAI,aAAa;4BACrC,IAAI,EAAE,6CAA6C;4BACnD,OAAO,EAAE,EAAE,IAAI,EAAE;yBAClB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,4EAA4E;gBACzF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,OAAO,EAAE,KAAK,IAAI,EAAE;oBAClB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5F,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,+BAA+B;gBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzC,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;gBAC5D,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,yEAAyE;gBACtF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,OAAO,EAAE,KAAK,IAAI,EAAE;oBAClB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/D,CAAC;aACF,CAAC;SACH;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAYD,SAAS,iBAAiB;IACxB,OAAO,CACL,UAAU;QACV,yFAAyF;QACzF,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,iFAAiF;IACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,wEAAwE;IACxE,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wDAAwD;YACtD,iEAAiE;YACjE,8DAA8D,CACjE,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}
1
+ {"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,CAAC,EACD,UAAU,EACV,YAAY,EACZ,UAAU,GAKX,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,uBAAuB,EAAwB,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAExC,OAAO,EAAE,UAAU,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAE9D,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAwB,MAAM,gBAAgB,CAAC;AACtG,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACpF,OAAO,EAAE,SAAS,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAUpG,MAAM,UAAU,gBAAgB;IAC9B,OAAO,SAAS,CAAC,YAAY,CAAC,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,OAAgC,EAAE;IACjE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,gBAAgB,EAAE,CAAC;IACrD,MAAM,SAAS,GACb,IAAI,CAAC,SAAS;QACd,uBAAuB,CAAC;YACtB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,aAAa;YACxD,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,aAAa,EAAE,IAAI,CAAC,aAAa;SAClC,CAAC,CAAC;IACL,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAEtD,8EAA8E;IAC9E,oEAAoE;IACpE,wEAAwE;IACxE,4EAA4E;IAC5E,6EAA6E;IAC7E,uCAAuC;IACvC,MAAM,YAAY,GAAG,CAAC,GAAG,QAAQ,GAAG,EAAE,GAAG,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACpE,MAAM,QAAQ,GAAG,CAAC,IAAI,CAAC,MAAM,IAAI,wBAAwB,CAAC,CAAC;IAE3D,wEAAwE;IACxE,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,4EAA4E;IAC5E,MAAM,QAAQ,GAAe;QAC3B,IAAI,EAAE,OAAO;QACb,WAAW,EAAE,qCAAqC;QAClD,YAAY,EAAE,oBAAoB;QAClC,aAAa,EAAE,gBAAgB;QAC/B,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;YACrB,MAAM,OAAO,GAAG,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAE5C,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC3B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,iBAAiB,EAAE,EAAE,CAAC;YACrD,CAAC;YAED,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;gBACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,kEAAkE,EAAE,CAAC;gBACpG,CAAC;gBACD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CACvB,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,iBAAiB,CAAC,CAAC,IAAI,GAAG,CACzG,CAAC;gBACF,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,oCAAoC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;YACxF,CAAC;YAED,IAAI,GAAG,KAAK,KAAK,EAAE,CAAC;gBAClB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;gBACrB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACtC,IAAI,CAAC,IAAI,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;oBAC7C,OAAO;wBACL,IAAI,EAAE,OAAO;wBACb,OAAO,EAAE,6EAA6E;qBACvF,CAAC;gBACJ,CAAC;gBACD,IAAI,CAAC,KAAK,EAAE,CAAC;oBACX,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,qBAAqB,IAAI,iCAAiC,EAAE,CAAC;gBAChG,CAAC;gBAED,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAE7B,wEAAwE;gBACxE,sEAAsE;gBACtE,yEAAyE;gBACzE,+DAA+D;gBAC/D,MAAM,IAAI,GACR,mBAAmB,IAAI,sCAAsC,IAAI,mCAAmC,CAAC;gBACvG,MAAM,CAAC,GAAG,GAAG,CAAC,OAAuC,CAAC;gBACtD,IAAI,OAAO,CAAC,CAAC,GAAG,EAAE,MAAM,KAAK,UAAU,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,UAAU,EAAE,CAAC;oBAC7E,IAAI,CAAC;wBACH,MAAM,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC;4BACjB,IAAI,EAAE,aAAa;4BACnB,SAAS,EAAE,GAAG,CAAC,SAAS;4BACxB,MAAM,EAAE,CAAC,CAAC,SAAS,EAAE,CAAC,MAAM;4BAC5B,MAAM,EAAE,QAAQ;4BAChB,IAAI,EAAE,IAAI;yBACX,CAAC,CAAC;oBACL,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACb,+DAA+D;wBAC/D,iEAAiE;wBACjE,8DAA8D;wBAC9D,8DAA8D;wBAC9D,6DAA6D;wBAC7D,OAAO,CAAC,IAAI,CACV,mBAAmB,IAAI,6CAA6C;4BAClE,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CACrD,CAAC;oBACJ,CAAC;gBACH,CAAC;gBACD,iEAAiE;gBACjE,4DAA4D;gBAE5D,OAAO;oBACL,IAAI,EAAE,MAAM;oBACZ,IAAI,EACF,aAAa,IAAI,2BAA2B;wBAC5C,8CAA8C,IAAI,kCAAkC;iBACvF,CAAC;YACJ,CAAC;YAED,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,uBAAuB,GAAG,OAAO,iBAAiB,EAAE,EAAE,EAAE,CAAC;QAC5F,CAAC;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,YAAY,CAAC;QAC1B,IAAI,EAAE,qBAAqB;QAC3B,OAAO,EAAE,OAAO;QAChB,2EAA2E;QAC3E,uEAAuE;QACvE,4EAA4E;QAC5E,2EAA2E;QAC3E,6BAA6B;QAC7B,KAAK,EAAE;YACL,MAAM,EAAE,CAAC,GAAG,EAAE,EAAE;gBACd,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;gBACtC,0EAA0E;gBAC1E,yEAAyE;gBACzE,6CAA6C;gBAC7C,GAAG,CAAC,QAAQ,CAAC,QAAQ,CACnB,gBAAgB,EAChB,CAAC,KAAa,EAAmB,EAAE,CAAC,aAAa,CAAC,KAAK,EAAE,KAAK,CAAC,CAChE,CAAC;YACJ,CAAC;SACF;QACD,QAAQ,EAAE,CAAC,QAAQ,CAAC;QACpB,KAAK,EAAE;YACL,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,WAAW,EACT,oEAAoE;oBACpE,mFAAmF;oBACnF,+FAA+F;oBAC/F,+FAA+F;oBAC/F,wCAAwC;gBAC1C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC;oBACpB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,mBAAmB,CAAC;oBAClD,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;oBACxB,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,QAAQ,EAAE;iBACrC,CAAC;gBACF,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;wBAC/C,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACrB,GAAG,EAAE,QAAQ;qBACd;iBACF;gBACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE;oBACvC,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;oBACnC,OAAO,UAAU,IAAI,KAAK,KAAK,CAAC,MAAM,kBAAkB,CAAC;gBAC3D,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,WAAW;gBACjB,WAAW,EAAE,+EAA+E;gBAC5F,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;wBAC/C,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACrB,GAAG,EAAE,QAAQ;qBACd;iBACF;gBACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC1B,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;oBACpC,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;wBACnB,MAAM,IAAI,UAAU,CAAC;4BACnB,IAAI,EAAE,YAAY;4BAClB,OAAO,EAAE,WAAW,IAAI,aAAa;4BACrC,IAAI,EAAE,6CAA6C;4BACnD,OAAO,EAAE,EAAE,IAAI,EAAE;yBAClB,CAAC,CAAC;oBACL,CAAC;oBACD,OAAO,KAAK,CAAC;gBACf,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,YAAY;gBAClB,WAAW,EAAE,4EAA4E;gBACzF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;wBAC/C,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACrB,GAAG,EAAE,QAAQ;qBACd;iBACF;gBACD,OAAO,EAAE,KAAK,IAAI,EAAE;oBAClB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC5F,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,+BAA+B;gBAC5C,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClD,UAAU,EAAE,EAAE,MAAM,EAAE,QAAQ,EAAE;gBAChC,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;wBAC/C,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACrB,GAAG,EAAE,QAAQ;qBACd;iBACF;gBACD,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC1B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;oBACzC,OAAO,OAAO,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,CAAC,cAAc,IAAI,EAAE,CAAC;gBAC5D,CAAC;aACF,CAAC;YACF,UAAU,CAAC;gBACT,IAAI,EAAE,cAAc;gBACpB,WAAW,EAAE,yEAAyE;gBACtF,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC;gBACzB,SAAS,EAAE;oBACT,YAAY,EAAE;wBACZ,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,EAAE;wBAC/C,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;wBACrB,GAAG,EAAE,QAAQ;qBACd;iBACF;gBACD,OAAO,EAAE,KAAK,IAAI,EAAE;oBAClB,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnB,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAC;oBACnC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;gBAC/D,CAAC;aACF,CAAC;SACH;KACF,CAAC,CAAC;IAEH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAYD,SAAS,iBAAiB;IACxB,OAAO,CACL,UAAU;QACV,yFAAyF;QACzF,wDAAwD,CACzD,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,aAAa;IAC1B,iFAAiF;IACjF,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CACb,uHAAuH,CACxH,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;IACxD,wEAAwE;IACxE,wEAAwE;IACxE,4DAA4D;IAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,wDAAwD;YACtD,iEAAiE;YACjE,8DAA8D,CACjE,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;IACb,CAAC;AACH,CAAC"}
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@moxxy/plugin-vault",
3
- "version": "0.26.0",
3
+ "version": "0.27.0",
4
4
  "description": "Encrypted secret storage for moxxy. AES-256-GCM at rest. Master key from OS keychain (@napi-rs/keyring) or passphrase fallback.",
5
5
  "keywords": [
6
6
  "moxxy",
@@ -44,7 +44,7 @@
44
44
  },
45
45
  "dependencies": {
46
46
  "zod": "^3.24.0",
47
- "@moxxy/sdk": "0.26.0"
47
+ "@moxxy/sdk": "0.27.0"
48
48
  },
49
49
  "optionalDependencies": {
50
50
  "@napi-rs/keyring": "^1.3.0"
@@ -53,8 +53,8 @@
53
53
  "@types/node": "^22.10.0",
54
54
  "typescript": "^5.7.3",
55
55
  "vitest": "^2.1.8",
56
- "@moxxy/vitest-preset": "0.0.0",
57
- "@moxxy/tsconfig": "0.0.0"
56
+ "@moxxy/tsconfig": "0.0.0",
57
+ "@moxxy/vitest-preset": "0.0.0"
58
58
  },
59
59
  "scripts": {
60
60
  "build": "tsc -p tsconfig.json",
package/src/index.ts CHANGED
@@ -42,6 +42,15 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
42
42
  });
43
43
  const vault = new VaultStore({ filePath, keySource });
44
44
 
45
+ // Capability surface shared by every vault tool: the encrypted store file and
46
+ // the cached master key, INCLUDING their atomic-write temp siblings
47
+ // (`<file>.<pid>.<uuid>.tmp` — see writeFileAtomic). Read and write are
48
+ // declared together because any open() may create the store or backfill the
49
+ // key cache. No timeMs on these tools: a first open() can block indefinitely
50
+ // on an interactive passphrase prompt.
51
+ const vaultFsGlobs = [`${filePath}*`, `${moxxyPath('vault.key')}*`];
52
+ const vaultEnv = [opts.envVar ?? 'MOXXY_VAULT_PASSPHRASE'];
53
+
45
54
  // `/vault` slash command. Lets the USER store a secret out-of-band: the
46
55
  // value travels in the slash-command args, which channels intercept and
47
56
  // never send to the model. After storing, we inject a note into the event
@@ -165,6 +174,13 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
165
174
  tags: z.array(z.string()).optional(),
166
175
  }),
167
176
  permission: { action: 'prompt' },
177
+ isolation: {
178
+ capabilities: {
179
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
180
+ net: { mode: 'none' },
181
+ env: vaultEnv,
182
+ },
183
+ },
168
184
  handler: async ({ name, value, tags }) => {
169
185
  await vault.set(name, value, tags);
170
186
  return `stored ${name} (${value.length} chars) in vault`;
@@ -175,6 +191,13 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
175
191
  description: 'Fetch a secret from the encrypted vault by name. Returns the plaintext value.',
176
192
  inputSchema: z.object({ name: z.string().min(1) }),
177
193
  permission: { action: 'prompt' },
194
+ isolation: {
195
+ capabilities: {
196
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
197
+ net: { mode: 'none' },
198
+ env: vaultEnv,
199
+ },
200
+ },
178
201
  handler: async ({ name }) => {
179
202
  const value = await vault.get(name);
180
203
  if (value === null) {
@@ -193,6 +216,13 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
193
216
  description: 'List entries in the vault. Returns names + metadata only, never plaintext.',
194
217
  inputSchema: z.object({}),
195
218
  permission: { action: 'prompt' },
219
+ isolation: {
220
+ capabilities: {
221
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
222
+ net: { mode: 'none' },
223
+ env: vaultEnv,
224
+ },
225
+ },
196
226
  handler: async () => {
197
227
  const entries = await vault.list();
198
228
  return entries.map((e) => ({ name: e.name, createdAt: e.createdAt, tags: e.tags ?? [] }));
@@ -203,6 +233,13 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
203
233
  description: 'Delete a vault entry by name.',
204
234
  inputSchema: z.object({ name: z.string().min(1) }),
205
235
  permission: { action: 'prompt' },
236
+ isolation: {
237
+ capabilities: {
238
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
239
+ net: { mode: 'none' },
240
+ env: vaultEnv,
241
+ },
242
+ },
206
243
  handler: async ({ name }) => {
207
244
  const removed = await vault.delete(name);
208
245
  return removed ? `deleted ${name}` : `not found: ${name}`;
@@ -212,6 +249,13 @@ export function buildVaultPlugin(opts: BuildVaultPluginOptions = {}): { plugin:
212
249
  name: 'vault_status',
213
250
  description: 'Report which key source unlocked the vault (keychain, env, passphrase).',
214
251
  inputSchema: z.object({}),
252
+ isolation: {
253
+ capabilities: {
254
+ fs: { read: vaultFsGlobs, write: vaultFsGlobs },
255
+ net: { mode: 'none' },
256
+ env: vaultEnv,
257
+ },
258
+ },
215
259
  handler: async () => {
216
260
  await vault.open();
217
261
  const entries = await vault.list();