@myvillage/cli 2.14.0 → 2.15.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@myvillage/cli",
-  "version": "2.14.0",
+  "version": "2.15.0",
   "description": "MyVillageOS CLI for community developers",
   "type": "module",
   "bin": {

package/src/agent-runtime/mcp-client.js

@@ -167,7 +167,10 @@ export async function getMCPTools(agentDir, agentConfig) {
       // withhold everything else this server offers (e.g. grant `network_feed`
       // but not `wallet_send`). Absent/empty → all tools, the backward-compatible
       // default.
-      const tools = applyToolAllowlist(await client.tools(), server.allowed_tools, name);
+      const tools = withSecretPlaceholders(
+        applyToolAllowlist(await client.tools(), server.allowed_tools, name),
+        server.secrets,
+      );
       const toolNames = Object.keys(tools);
       Object.assign(allTools, tools);
       servers.push({
@@ -216,6 +219,76 @@ export function applyToolAllowlist(tools, allowed, serverName) {
   return filtered;
 }
 
+/**
+ * Let an agent use a secret without ever seeing it.
+ *
+ * `secrets` is a server's list of `.env` names from tools.yaml (e.g.
+ * `[SCHOOL_USERNAME, SCHOOL_PASSWORD]`). The agent writes `${SCHOOL_PASSWORD}`
+ * in a tool call, say as the value for `puppeteer_fill`, and the real value is
+ * swapped in right before the tool runs. Anything the tool sends back has the
+ * value turned back into its placeholder, so the secret never reaches the
+ * model, its context, or the activity log.
+ *
+ * Only the names listed are swapped, per server, so an agent cannot ask for
+ * `${MYVILLAGE_ACCESS_TOKEN}` or any other variable it wasn't given. Unknown or
+ * unset names are left as written.
+ */
+export function withSecretPlaceholders(tools, secretNames, env = process.env) {
+  if (!Array.isArray(secretNames) || secretNames.length === 0) return tools;
+  const allowed = new Set(secretNames.filter((n) => typeof n === 'string' && /^\w+$/.test(n)));
+  if (allowed.size === 0) return tools;
+
+  const fill = (v) => {
+    if (typeof v === 'string') {
+      return v.replace(/\$\{(\w+)\}/g, (m, n) => (allowed.has(n) && env[n] ? env[n] : m));
+    }
+    if (Array.isArray(v)) return v.map(fill);
+    if (v && typeof v === 'object') {
+      return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, fill(x)]));
+    }
+    return v;
+  };
+
+  // Longest first, so a value that contains another is replaced whole. Very
+  // short values are skipped: blanking every "a" in a page would wreck it.
+  const values = [...allowed]
+    .map((n) => [n, env[n]])
+    .filter(([, v]) => typeof v === 'string' && v.length >= 3)
+    .sort((a, b) => b[1].length - a[1].length);
+  const redact = (v) => {
+    if (typeof v === 'string') {
+      let out = v;
+      for (const [n, secret] of values) out = out.split(secret).join(`\${${n}}`);
+      return out;
+    }
+    if (Array.isArray(v)) return v.map(redact);
+    if (v && typeof v === 'object') {
+      return Object.fromEntries(Object.entries(v).map(([k, x]) => [k, redact(x)]));
+    }
+    return v;
+  };
+
+  const wrapped = {};
+  for (const [name, tool] of Object.entries(tools)) {
+    if (typeof tool?.execute !== 'function') {
+      wrapped[name] = tool;
+      continue;
+    }
+    wrapped[name] = {
+      ...tool,
+      execute: async (args, options) => {
+        try {
+          return redact(await tool.execute(fill(args), options));
+        } catch (err) {
+          if (err && typeof err.message === 'string') err.message = redact(err.message);
+          throw err;
+        }
+      },
+    };
+  }
+  return wrapped;
+}
+
 export async function cleanupMCPClients() {
   for (const client of activeClients) {
     try { await client.close(); } catch { /* ignore */ }