@nexus-cortex/core 4.130.0 → 4.131.2

package/dist/config/localBrowser.d.ts

@@ -0,0 +1,13 @@
+export interface BrowserBackend {
+    mode: 'hosted' | 'local';
+    using: 'hosted' | 'local';
+    reason: string;
+    serverJs?: string;
+    packageDir?: string;
+}
+export declare const browserToolsHome: (env?: NodeJS.ProcessEnv) => string;
+/** The installed @nexus-cortex/browser package directory, or null. */
+export declare function localBrowserPackageDir(): string | null;
+export declare function resolveBrowserBackendCached(env?: NodeJS.ProcessEnv): BrowserBackend;
+export declare function resolveBrowserBackend(env?: NodeJS.ProcessEnv): BrowserBackend;
+//# sourceMappingURL=localBrowser.d.ts.map

package/dist/config/localBrowser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBrowser.d.ts","sourceRoot":"","sources":["../../src/config/localBrowser.ts"],"names":[],"mappings":"AAcA,MAAM,WAAW,cAAc;IAAG,IAAI,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAE;AAE/I,eAAO,MAAM,gBAAgB,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MACO,CAAC;AAEhF,sEAAsE;AACtE,wBAAgB,sBAAsB,IAAI,MAAM,GAAG,IAAI,CAEtD;AAID,wBAAgB,2BAA2B,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAMhG;AAED,wBAAgB,qBAAqB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,cAAc,CAW1F"}

package/dist/config/localBrowser.js

@@ -0,0 +1,53 @@
+/**
+ * Which browser the harness drives (NEXUS_BROWSER_MODE; operator policy 2026-11-03):
+ *   hosted (default) — the hosted nexus-browser MCP (McpServerRegistry's http entry); nothing to install.
+ *   local            — the @nexus-cortex/browser library on this machine, run as a stdio MCP server — ONLY when the package is installed
+ *                      AND its installer recorded the core as ready (<tools home>/install.json). Otherwise hosted, with the reason, so a
+ *                      broken or half-finished local install never leaves an agent without a browser.
+ * The library is an optional, separately licensed package (AGPL-3.0-only OR commercial); core never imports it — it only finds its
+ * server entry point.
+ */
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+import { createRequire } from 'module';
+export const browserToolsHome = (env = process.env) => env.NEXUS_BROWSER_HOME ?? path.join(os.homedir(), '.nexus-cortex', 'browser');
+/** The installed @nexus-cortex/browser package directory, or null. */
+export function localBrowserPackageDir() {
+    try {
+        return path.dirname(createRequire(import.meta.url).resolve('@nexus-cortex/browser/package.json'));
+    }
+    catch {
+        return null;
+    }
+}
+/** resolveBrowserBackend for HOT paths (the per-tool web gate runs for every tool on every request): cached 5 s per mode/home. */
+let cached = null;
+export function resolveBrowserBackendCached(env = process.env) {
+    const key = `${env.NEXUS_BROWSER_MODE ?? ''}|${browserToolsHome(env)}`;
+    if (cached && cached.key === key && Date.now() - cached.at < 5000)
+        return cached.value;
+    const value = resolveBrowserBackend(env);
+    cached = { key, at: Date.now(), value };
+    return value;
+}
+export function resolveBrowserBackend(env = process.env) {
+    const mode = String(env.NEXUS_BROWSER_MODE ?? '').trim().toLowerCase() === 'local' ? 'local' : 'hosted';
+    if (mode === 'hosted')
+        return { mode, using: 'hosted', reason: 'NEXUS_BROWSER_MODE is hosted (default)' };
+    const dir = localBrowserPackageDir();
+    if (!dir)
+        return { mode, using: 'hosted', reason: 'the @nexus-cortex/browser package is not installed' };
+    const serverJs = path.join(dir, 'dist', 'server.js');
+    if (!fs.existsSync(serverJs))
+        return { mode, using: 'hosted', reason: `${serverJs} is missing (package not built)`, packageDir: dir };
+    let ready = false;
+    try {
+        ready = JSON.parse(fs.readFileSync(path.join(browserToolsHome(env), 'install.json'), 'utf8'))?.ready?.core === true;
+    }
+    catch { /* no install yet */ }
+    if (!ready)
+        return { mode, using: 'hosted', reason: 'the local browser is not installed yet — run `cortex browser install`', packageDir: dir };
+    return { mode, using: 'local', reason: 'local browser installed and ready', serverJs, packageDir: dir };
+}
+//# sourceMappingURL=localBrowser.js.map

package/dist/config/localBrowser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localBrowser.js","sourceRoot":"","sources":["../../src/config/localBrowser.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,QAAQ,CAAC;AAIvC,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,MAAyB,OAAO,CAAC,GAAG,EAAU,EAAE,CAC/E,GAAG,CAAC,kBAAkB,IAAI,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,eAAe,EAAE,SAAS,CAAC,CAAC;AAEhF,sEAAsE;AACtE,MAAM,UAAU,sBAAsB;IACpC,IAAI,CAAC;QAAC,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,oCAAoC,CAAC,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AACnI,CAAC;AAED,kIAAkI;AAClI,IAAI,MAAM,GAA8D,IAAI,CAAC;AAC7E,MAAM,UAAU,2BAA2B,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC9E,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,kBAAkB,IAAI,EAAE,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;IACvE,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,KAAK,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,EAAE,GAAG,IAAI;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC;IACvF,MAAM,KAAK,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACzC,MAAM,GAAG,EAAE,GAAG,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC;IACxC,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACxE,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC;IACxG,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,wCAAwC,EAAE,CAAC;IAC1G,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,oDAAoD,EAAE,CAAC;IACzG,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;IACrD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,QAAQ,iCAAiC,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IACtI,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;IAC3J,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,uEAAuE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;IAC/I,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,mCAAmC,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAC1G,CAAC"}

package/dist/config/logRedaction.d.ts

@@ -0,0 +1,5 @@
+/** Mask secrets in one already-formatted log line. Exported for tests and for writers that bypass console. */
+export declare function redactLogText(text: string, env?: NodeJS.ProcessEnv): string;
+/** Wrap console.log/info/warn/error/debug/trace so every line is redacted before it is written. Idempotent. */
+export declare function installConsoleRedaction(env?: NodeJS.ProcessEnv): boolean;
+//# sourceMappingURL=logRedaction.d.ts.map

package/dist/config/logRedaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"logRedaction.d.ts","sourceRoot":"","sources":["../../src/config/logRedaction.ts"],"names":[],"mappings":"AAsCA,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAMxF;AAED,+GAA+G;AAC/G,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAarF"}

package/dist/config/logRedaction.js

@@ -0,0 +1,68 @@
+/**
+ * Console secret redaction (2026-11-03).
+ *
+ * The bundled @anthropic-ai/sdk (0.20.x) prints every request's raw headers — including `x-api-key` — through console.log
+ * whenever process.env.DEBUG === 'true', and DEBUG=true is also the harness's own debug switch. A cx-local run on 11-02 wrote
+ * the operator's Anthropic key into nine server logs that way. Any other dependency that logs a request can do the same, so
+ * the fix is at the sink: every console line is formatted once, secret values are replaced, and the masked line is printed.
+ *
+ * What is masked: values of secret-like environment variables (…_API_KEY, …_TOKEN, …_SECRET, …_KEY, PASSWORD, ≥ 12 chars),
+ * every vault value (maskSecretText), and the value of credential headers / bearer tokens by pattern.
+ * Installed once per process by bootstrapEnv. CORTEX_LOG_REDACTION=off disables it (debugging the redactor itself).
+ */
+import { formatWithOptions } from 'node:util';
+import { maskSecrets, maskSecretText } from './secretsVault.js';
+const SECRET_NAME = /(?:^|_)(?:API_KEY|KEY|TOKEN|SECRET|PASSWORD|PASS|PAT|CREDENTIALS?)$|^(?:ANTHROPIC|OPENAI|XAI|DEEPSEEK|GEMINI|GOOGLE)_.*KEY/i;
+const NOT_SECRET = /^(?:CORTEX_SECRETS_KEY_FILE|.*_KEY_NOTE|.*_KEY_PATH|.*_TOKEN_LIMIT|.*_MAX_TOKENS?|.*_TOKENS)$/i;
+// Credential headers in util.inspect / JSON / HTTP text form, and bearer tokens.
+const HEADER_PATTERNS = [
+    // The value never includes a backslash, and an escaped quote (\") may open it: on JSON-escaped text (a CLI --json answer) the old
+    // class ate the backslash of `\"` and left a bare quote — ms-after-r5 Best Buy: `site cookie: locStoreId=513\"` → invalid JSON, answer
+    // lost to the judge (2026-11-04).
+    /((?:\\?['"]?)(?:x-api-key|api-key|x-goog-api-key|authorization|proxy-authorization|cookie|set-cookie)(?:\\?['"]?)\s*[:=]\s*(?:\\?['"])?)(?:Bearer\s+|Basic\s+)?(?!«)[^'"\s,}«\\]{8,}/gi,
+    /(Bearer\s+)[A-Za-z0-9._~+/=-]{16,}/g,
+];
+let installed = false;
+let cache = { sig: '', values: [] };
+function envSecretValues(env) {
+    const names = Object.keys(env).filter((n) => SECRET_NAME.test(n) && !NOT_SECRET.test(n));
+    const sig = names.map((n) => `${n}:${(env[n] ?? '').length}`).join('|');
+    if (sig === cache.sig)
+        return cache.values;
+    const values = names.map((name) => ({ name, value: env[name] ?? '' })).filter((v) => v.value.length >= 12 && !/^(true|false|\d+)$/i.test(v.value));
+    cache = { sig, values };
+    return values;
+}
+/** Mask secrets in one already-formatted log line. Exported for tests and for writers that bypass console. */
+export function redactLogText(text, env = process.env) {
+    if (!text)
+        return text;
+    let out = maskSecretText(text);
+    out = maskSecrets(out, envSecretValues(env));
+    for (const re of HEADER_PATTERNS)
+        out = out.replace(re, (_m, p1) => `${p1}«redacted»`);
+    return out;
+}
+/** Wrap console.log/info/warn/error/debug/trace so every line is redacted before it is written. Idempotent. */
+export function installConsoleRedaction(env = process.env) {
+    if (installed || /^(off|false|0)$/i.test(env.CORTEX_LOG_REDACTION ?? ''))
+        return false;
+    installed = true;
+    for (const method of ['log', 'info', 'warn', 'error', 'debug', 'trace']) {
+        const original = console[method].bind(console);
+        console[method] = (...args) => {
+            if (args.length === 0)
+                return original();
+            let line;
+            try {
+                line = redactLogText(formatWithOptions({ colors: false }, ...args), env);
+            }
+            catch {
+                return original(...args);
+            }
+            original(line);
+        };
+    }
+    return true;
+}
+//# sourceMappingURL=logRedaction.js.map

package/dist/config/logRedaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logRedaction.js","sourceRoot":"","sources":["../../src/config/logRedaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEhE,MAAM,WAAW,GAAG,6HAA6H,CAAC;AAClJ,MAAM,UAAU,GAAG,gGAAgG,CAAC;AACpH,iFAAiF;AACjF,MAAM,eAAe,GAAa;IAChC,kIAAkI;IAClI,uIAAuI;IACvI,kCAAkC;IAClC,wLAAwL;IACxL,qCAAqC;CACtC,CAAC;AAEF,IAAI,SAAS,GAAG,KAAK,CAAC;AACtB,IAAI,KAAK,GAAoE,EAAE,GAAG,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAErG,SAAS,eAAe,CAAC,GAAsB;IAC7C,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,KAAK,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC,MAAM,CAAC;IAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;IACnJ,KAAK,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IACxB,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC9E,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,IAAI,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IAC/B,GAAG,GAAG,WAAW,CAAC,GAAG,EAAE,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC;IAC7C,KAAK,MAAM,EAAE,IAAI,eAAe;QAAE,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC,EAAE,EAAE,EAAU,EAAE,EAAE,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAC/F,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+GAA+G;AAC/G,MAAM,UAAU,uBAAuB,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC1E,IAAI,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,SAAS,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,MAAM,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,CAAU,EAAE,CAAC;QACjF,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,OAAO,CAA8B,CAAC;QAC3E,OAA8C,CAAC,MAAM,CAAC,GAAG,CAAC,GAAG,IAAe,EAAE,EAAE;YAC/E,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;gBAAE,OAAO,QAAQ,EAAE,CAAC;YACzC,IAAI,IAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,IAAI,GAAG,aAAa,CAAC,iBAAiB,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,EAAE,GAAG,IAAI,CAAC,EAAE,GAAG,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC;gBAAC,OAAO,QAAQ,CAAC,GAAG,IAAI,CAAC,CAAC;YAAC,CAAC;YACrH,QAAQ,CAAC,IAAI,CAAC,CAAC;QACjB,CAAC,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/config/secretProviders.d.ts

@@ -0,0 +1,16 @@
+/**
+ * The provider catalog for the secrets vault UI — the Nexus Terminal SPA's own catalog (spaSecretTypes.ts, synced from
+ * nexus-terminal/services/secrets/types.ts), plus the helpers the /secrets dialogs need: provider auto-detect from a pasted key (the
+ * SPA's keyPatterns), a suggested env-style name (the SPA's PROVIDER_TYPE convention), the icon.
+ */
+import { type KnownProvider, type ProviderConfig, type SecretType } from './spaSecretTypes.js';
+export type { KnownProvider, ProviderConfig, SecretType };
+export declare const SECRET_PROVIDERS: ProviderConfig[];
+/** The provider a pasted value most likely belongs to (first keyPattern match), or null. */
+export declare function detectProvider(value: string): ProviderConfig | null;
+/** DEEPSEEK_API_KEY-style name for a provider + secret type (the SPA stores keys as PROVIDER_TYPE). */
+export declare function suggestSecretName(provider: string, type?: SecretType | string): string;
+/** The provider a stored name belongs to, by its prefix (GITHUB_TOKEN → github). */
+export declare function providerForName(name: string): ProviderConfig | null;
+export declare const providerIcon: (id?: string | null) => string;
+//# sourceMappingURL=secretProviders.d.ts.map

package/dist/config/secretProviders.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.d.ts","sourceRoot":"","sources":["../../src/config/secretProviders.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,cAAc,EAAE,KAAK,UAAU,EAAE,MAAM,qBAAqB,CAAC;AAEjH,YAAY,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;AAC1D,eAAO,MAAM,gBAAgB,EAAE,cAAc,EAAoC,CAAC;AAElF,4FAA4F;AAC5F,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAInE;AAED,uGAAuG;AACvG,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,GAAE,UAAU,GAAG,MAAkB,GAAG,MAAM,CAEjG;AAED,oFAAoF;AACpF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI,CAGnE;AAED,eAAO,MAAM,YAAY,GAAI,KAAK,MAAM,GAAG,IAAI,KAAG,MAAwF,CAAC"}

package/dist/config/secretProviders.js

@@ -0,0 +1,26 @@
+/**
+ * The provider catalog for the secrets vault UI — the Nexus Terminal SPA's own catalog (spaSecretTypes.ts, synced from
+ * nexus-terminal/services/secrets/types.ts), plus the helpers the /secrets dialogs need: provider auto-detect from a pasted key (the
+ * SPA's keyPatterns), a suggested env-style name (the SPA's PROVIDER_TYPE convention), the icon.
+ */
+import { PROVIDER_CONFIGS } from './spaSecretTypes.js';
+export const SECRET_PROVIDERS = Object.values(PROVIDER_CONFIGS);
+/** The provider a pasted value most likely belongs to (first keyPattern match), or null. */
+export function detectProvider(value) {
+    const v = value.trim();
+    for (const p of SECRET_PROVIDERS)
+        if (p.keyPatterns?.some((re) => re.test(v)))
+            return p;
+    return null;
+}
+/** DEEPSEEK_API_KEY-style name for a provider + secret type (the SPA stores keys as PROVIDER_TYPE). */
+export function suggestSecretName(provider, type = 'api-key') {
+    return `${provider}_${type}`.toUpperCase().replace(/[^A-Z0-9]+/g, '_').replace(/^_+|_+$/g, '');
+}
+/** The provider a stored name belongs to, by its prefix (GITHUB_TOKEN → github). */
+export function providerForName(name) {
+    const n = name.toLowerCase();
+    return SECRET_PROVIDERS.find((p) => p.id !== 'custom' && (n.startsWith(`${p.id.replace(/-/g, '_')}_`) || n === p.id)) ?? null;
+}
+export const providerIcon = (id) => (id && PROVIDER_CONFIGS[id]?.icon) || '🔑';
+//# sourceMappingURL=secretProviders.js.map

package/dist/config/secretProviders.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretProviders.js","sourceRoot":"","sources":["../../src/config/secretProviders.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,gBAAgB,EAA4D,MAAM,qBAAqB,CAAC;AAGjH,MAAM,CAAC,MAAM,gBAAgB,GAAqB,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC;AAElF,4FAA4F;AAC5F,MAAM,UAAU,cAAc,CAAC,KAAa;IAC1C,MAAM,CAAC,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IACvB,KAAK,MAAM,CAAC,IAAI,gBAAgB;QAAE,IAAI,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACxF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,iBAAiB,CAAC,QAAgB,EAAE,OAA4B,SAAS;IACvF,OAAO,GAAG,QAAQ,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AACjG,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IAC7B,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;AAChI,CAAC;AAED,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,EAAkB,EAAU,EAAE,CAAC,CAAC,EAAE,IAAK,gBAAmD,CAAC,EAAE,CAAC,EAAE,IAAI,CAAC,IAAI,IAAI,CAAC"}

package/dist/config/secretsVault.d.ts

@@ -0,0 +1,121 @@
+export declare const VAULT_FILE = "secrets.enc";
+export declare const VAULT_ID = "cortex-local";
+import { PBKDF2_ITERATIONS, ENCRYPTION_VERSION } from './spaSecretTypes.js';
+export { PBKDF2_ITERATIONS, ENCRYPTION_VERSION };
+export interface EncryptedSecret {
+    iv: string;
+    ciphertext: string;
+    tag: string;
+    version: number;
+}
+export interface VaultEntry {
+    enc: EncryptedSecret;
+    provider?: string;
+    type?: string;
+    category?: string;
+    note?: string;
+    updatedAt: number;
+}
+export interface VaultBinding {
+    secret: string;
+    envVar: string;
+    scope: 'global' | 'tool';
+    tool?: string;
+}
+export interface VaultFile {
+    version: 1;
+    id: string;
+    check: EncryptedSecret;
+    secrets: Record<string, VaultEntry>;
+    bindings: VaultBinding[];
+}
+export type UnlockSource = 'env' | 'env-file' | 'keychain' | 'key-file' | 'passphrase';
+export interface VaultStatus {
+    exists: boolean;
+    unlocked: boolean;
+    source?: UnlockSource;
+    count?: number;
+    error?: string;
+    path: string;
+}
+export declare const vaultPath: () => string;
+/** Where `cortex secrets init` keeps the key when the machine has no keychain (headless VM / container): owner-only, beside the vault. */
+export declare const vaultKeyFilePath: () => string;
+export declare function deriveKey(master: string, id?: string): Buffer;
+export declare function encryptValue(key: Buffer, plaintext: string): EncryptedSecret;
+export declare function decryptValue(key: Buffer, e: EncryptedSecret): string;
+/** Store the master secret in the OS keychain. Returns false when no usable keychain exists (headless VM, container). */
+export declare function keychainSet(master: string): boolean;
+/** The master secret from the non-interactive sources, in order. Never prompts. */
+export declare function resolveMasterSecret(env?: NodeJS.ProcessEnv): {
+    master: string;
+    source: UnlockSource;
+} | null;
+export declare const newMasterSecret: () => string;
+export declare function readVaultFile(file?: string): VaultFile | null;
+export declare function writeVaultFile(v: VaultFile, file?: string): void;
+export declare function createVault(master: string, file?: string): VaultFile;
+/** An open vault: values are decrypted only on request and never logged. */
+export declare class Vault {
+    private readonly key;
+    private data;
+    readonly file: string;
+    readonly source: UnlockSource;
+    private constructor();
+    static open(master: string, source: UnlockSource, file?: string): Vault;
+    names(): string[];
+    meta(name: string): Omit<VaultEntry, 'enc'> | null;
+    get(name: string): string | null;
+    set(name: string, value: string, meta?: Omit<VaultEntry, 'enc' | 'updatedAt'>): void;
+    delete(name: string): boolean;
+    bindings(): VaultBinding[];
+    bind(b: VaultBinding): void;
+    unbind(envVar: string, tool?: string): void;
+    /** Every value, for output masking only (never for display). */
+    allValues(): Array<{
+        name: string;
+        value: string;
+    }>;
+}
+/** Open the vault from the non-interactive sources, or report why not. */
+export declare function openVaultNonInteractive(env?: NodeJS.ProcessEnv, file?: string): {
+    vault: Vault | null;
+    status: VaultStatus;
+};
+/** STARTUP: put the vault's secrets into `env` without overriding what is already set (real env > vault > .env files). Never throws. */
+export declare function loadVaultIntoEnv(env?: NodeJS.ProcessEnv): VaultStatus;
+/** Replace any stored secret value appearing in `text` with «secret:NAME» — applied to tool output before the model sees it. */
+export declare function maskSecrets(text: string, values: Array<{
+    name: string;
+    value: string;
+}>): string;
+/** Create the vault the zero-friction way (shared by `cortex secrets init` and the /secrets dialogs): the key already given
+ *  (CORTEX_SECRETS_KEY / _FILE), else a new random key kept in the OS keychain, else in the owner-only key file beside the vault. */
+export declare function initVaultDefault(env?: NodeJS.ProcessEnv): {
+    where: UnlockSource;
+    path: string;
+    hint: string;
+};
+/** Environment for a process that runs model-chosen code. `tool` selects tool-scoped bindings (e.g. 'Bash'). Always returns an object. */
+export declare function toolChildEnv(base?: NodeJS.ProcessEnv, tool?: string): NodeJS.ProcessEnv;
+/** Replace every vault value (and the vault key) in `text` with «secret:NAME». Identity when no vault is unlocked. */
+export declare function maskSecretText(text: string): string;
+/** maskSecretText over a batch of tool results (content strings only; everything else passes through). */
+export declare function maskToolResults<T extends {
+    content: unknown;
+}>(results: T[]): T[];
+/** What the secrets-list tool reports: names, providers, bindings, and how the vault unlocked. Never values. */
+export declare function describeVaultForAgent(): {
+    unlocked: boolean;
+    source?: string;
+    secrets: Array<{
+        name: string;
+        provider?: string;
+        type?: string;
+        boundAs: string[];
+    }>;
+    note: string;
+};
+/** Test hook: forget the recorded session. */
+export declare function _resetVaultSessionForTests(): void;
+//# sourceMappingURL=secretsVault.d.ts.map

package/dist/config/secretsVault.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretsVault.d.ts","sourceRoot":"","sources":["../../src/config/secretsVault.ts"],"names":[],"mappings":"AAwBA,eAAO,MAAM,UAAU,gBAAgB,CAAC;AACxC,eAAO,MAAM,QAAQ,iBAAiB,CAAC;AAEvC,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,CAAC;AAKjD,MAAM,WAAW,eAAe;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AACjG,MAAM,WAAW,UAAU;IAAG,GAAG,EAAE,eAAe,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAC3I,MAAM,WAAW,YAAY;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE;AACzG,MAAM,WAAW,SAAS;IAAG,OAAO,EAAE,CAAC,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,eAAe,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAAC,QAAQ,EAAE,YAAY,EAAE,CAAA;CAAE;AAC5I,MAAM,MAAM,YAAY,GAAG,KAAK,GAAG,UAAU,GAAG,UAAU,GAAG,UAAU,GAAG,YAAY,CAAC;AACvF,MAAM,WAAW,WAAW;IAAG,MAAM,EAAE,OAAO,CAAC;IAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,YAAY,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE;AAExI,eAAO,MAAM,SAAS,QAAO,MAAqD,CAAC;AACnF,0IAA0I;AAC1I,eAAO,MAAM,gBAAgB,QAAO,MAAsD,CAAC;AAG3F,wBAAgB,SAAS,CAAC,MAAM,EAAE,MAAM,EAAE,EAAE,SAAW,GAAG,MAAM,CAE/D;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,eAAe,CAK5E;AACD,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,eAAe,GAAG,MAAM,CAIpE;AAUD,yHAAyH;AACzH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAMnD;AACD,mFAAmF;AACnF,wBAAgB,mBAAmB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAOzH;AACD,eAAO,MAAM,eAAe,QAAO,MAAsD,CAAC;AAG1F,wBAAgB,aAAa,CAAC,IAAI,SAAc,GAAG,SAAS,GAAG,IAAI,CAElE;AACD,wBAAgB,cAAc,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,SAAc,GAAG,IAAI,CAKrE;AACD,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,SAAc,GAAG,SAAS,CAGzE;AAED,4EAA4E;AAC5E,qBAAa,KAAK;IACI,OAAO,CAAC,QAAQ,CAAC,GAAG;IAAU,OAAO,CAAC,IAAI;IAAa,QAAQ,CAAC,IAAI,EAAE,MAAM;IAAE,QAAQ,CAAC,MAAM,EAAE,YAAY;IAA/H,OAAO;IACP,MAAM,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,EAAE,IAAI,SAAc,GAAG,KAAK;IAM5E,KAAK,IAAI,MAAM,EAAE;IACjB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,GAAG,IAAI;IAClD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI;IAChC,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAE,IAAI,CAAC,UAAU,EAAE,KAAK,GAAG,WAAW,CAAM,GAAG,IAAI;IAMxF,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAC7B,QAAQ,IAAI,YAAY,EAAE;IAC1B,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,IAAI;IAC3B,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI;IAC3C,gEAAgE;IAChE,SAAS,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CACpD;AAED,0EAA0E;AAC1E,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,SAAc,GAAG;IAAE,KAAK,EAAE,KAAK,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAO9I;AAED,wIAAwI;AACxI,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,WAAW,CASlF;AAED,gIAAgI;AAChI,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,GAAG,MAAM,CAOhG;AAED;qIACqI;AACrI,wBAAgB,gBAAgB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG;IAAE,KAAK,EAAE,YAAY,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAc1H;AAyCD,0IAA0I;AAC1I,wBAAgB,YAAY,CAAC,IAAI,GAAE,MAAM,CAAC,UAAwB,EAAE,IAAI,CAAC,EAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAQpG;AAED,sHAAsH;AACtH,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED,0GAA0G;AAC1G,wBAAgB,eAAe,CAAC,CAAC,SAAS;IAAE,OAAO,EAAE,OAAO,CAAA;CAAE,EAAE,OAAO,EAAE,CAAC,EAAE,GAAG,CAAC,EAAE,CAGjF;AAED,gHAAgH;AAChH,wBAAgB,qBAAqB,IAAI;IAAE,QAAQ,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAUnL;AAED,8CAA8C;AAC9C,wBAAgB,0BAA0B,IAAI,IAAI,CAAoB"}