@openape/apes 1.30.0 → 1.31.1

package/dist/{http-UPOTOYQV.js → http-SILH37L7.js}

@@ -8,7 +8,7 @@ import {
   getAgentChallengeEndpoint,
   getDelegationsEndpoint,
   getGrantsEndpoint
-} from "./chunk-NYJSBFLG.js";
+} from "./chunk-MMBFV5WN.js";
 import "./chunk-OBF7IMQ2.js";
 export {
   ApiError,
@@ -20,4 +20,4 @@ export {
   getDelegationsEndpoint,
   getGrantsEndpoint
 };
-//# sourceMappingURL=http-UPOTOYQV.js.map
+//# sourceMappingURL=http-SILH37L7.js.map

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ResolvedCommand } from '@openape/shapes';
 export { AdapterMeta, BuiltGrantRequest, GrantRequestOptions, LoadedAdapter, RegistryEntry, RegistryIndex, ResolvedCapability, ResolvedCommand, ShapesAdapter, ShapesOperation, appendAuditLog, buildExactCommandGrantRequest, buildStructuredCliGrantRequest, extractShellCommandString, fetchRegistry, findAdapter, findConflictingAdapters, getInstalledDigest, installAdapter, isInstalled, loadAdapter, loadOrInstallAdapter, parseShellCommand, removeAdapter, resolveAdapterPath, resolveCapabilityRequest, resolveCommand, searchAdapters, tryLoadAdapter } from '@openape/shapes';
-export { ApeShellResult, ChatMessage, RpcSessionMap, RunOptions, RunResult, RunStreamHandlers, RuntimeConfig, TOOLS, ToolDefinition, TraceEntry, runApeShell, runLoop, taskTools } from '@openape/agent-runtime';
+export { ApeShellResult, ChatMessage, RpcSessionMap, RunOptions, RunResult, RunStreamHandlers, RuntimeConfig, TOOLS, ToolDefinition, TraceEntry, addReadRoot, runApeShell, runLoop, taskTools } from '@openape/agent-runtime';
 
 interface SimilarGrantsInfo {
     similar_grants: Array<{
@@ -143,6 +143,34 @@ declare function apiFetch<T = unknown>(path: string, options?: {
     token?: string;
 }): Promise<T>;
 
+interface MaterializeOptions {
+    dir?: string;
+    keyPath?: string;
+    /** Target env map (defaults to process.env). Injected in tests. */
+    env?: NodeJS.ProcessEnv;
+    /** Env names applied by a previous materialize, to drop on revoke. */
+    previouslyApplied?: Iterable<string>;
+    log?: (line: string) => void;
+}
+interface MaterializeResult {
+    applied: string[];
+    failed: string[];
+}
+/**
+ * Open every sealed blob in the secrets dir and set the corresponding
+ * env var. Any env that was applied before but whose blob is now gone
+ * (revoke) is deleted. Best-effort per blob — a corrupt/foreign blob
+ * is logged and skipped, never throws.
+ */
+declare function materializeSecrets(opts?: MaterializeOptions): MaterializeResult;
+/**
+ * Materialize once, then fs.watch the secrets dir and re-materialize
+ * on any change (rotate/revoke take effect live — the user's M2 v1
+ * choice). Returns a stop function. Safe to call when the dir doesn't
+ * exist yet (watch attaches once it appears on the next agent start).
+ */
+declare function startSecretsWatcher(opts?: MaterializeOptions): () => void;
+
 /**
  * Parse a human-readable duration string into seconds.
  * Supported formats: 30s, 5m, 1h, 7d
@@ -158,4 +186,4 @@ declare class CliExit extends Error {
     constructor(exitCode?: number);
 }
 
-export { type ApesConfig, ApiError, type AuthData, CliError, CliExit, apiFetch, clearAuth, createShapesGrant, discoverEndpoints, extractOption, extractWrappedCommand, fetchGrantToken, findExistingGrant, getAuthToken, getIdpUrl, getRequesterIdentity, loadAuth, loadConfig, parseDuration, saveAuth, saveConfig, verifyAndExecute, waitForGrantStatus };
+export { type ApesConfig, ApiError, type AuthData, CliError, CliExit, apiFetch, clearAuth, createShapesGrant, discoverEndpoints, extractOption, extractWrappedCommand, fetchGrantToken, findExistingGrant, getAuthToken, getIdpUrl, getRequesterIdentity, loadAuth, loadConfig, materializeSecrets, parseDuration, saveAuth, saveConfig, startSecretsWatcher, verifyAndExecute, waitForGrantStatus };

package/dist/index.js

@@ -2,8 +2,10 @@
 import {
   CliError,
   CliExit,
-  parseDuration
-} from "./chunk-QMMRZPD2.js";
+  materializeSecrets,
+  parseDuration,
+  startSecretsWatcher
+} from "./chunk-3LH4FT4R.js";
 import {
   createShapesGrant,
   extractOption,
@@ -17,7 +19,7 @@ import {
   ApiError,
   apiFetch,
   discoverEndpoints
-} from "./chunk-NYJSBFLG.js";
+} from "./chunk-MMBFV5WN.js";
 import {
   clearAuth,
   getAuthToken,
@@ -51,13 +53,14 @@ import {
   searchAdapters,
   tryLoadAdapter
 } from "@openape/shapes";
-import { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell } from "@openape/agent-runtime";
+import { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell, addReadRoot } from "@openape/agent-runtime";
 export {
   ApiError,
   CliError,
   CliExit,
   RpcSessionMap,
   TOOLS,
+  addReadRoot,
   apiFetch,
   appendAuditLog,
   buildExactCommandGrantRequest,
@@ -83,6 +86,7 @@ export {
   loadAuth,
   loadConfig,
   loadOrInstallAdapter,
+  materializeSecrets,
   parseDuration,
   parseShellCommand,
   removeAdapter,
@@ -94,6 +98,7 @@ export {
   saveAuth,
   saveConfig,
   searchAdapters,
+  startSecretsWatcher,
   taskTools,
   tryLoadAdapter,
   verifyAndExecute,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Pure shapes library — re-exported from @openape/shapes\nexport {\n  appendAuditLog,\n  buildExactCommandGrantRequest,\n  buildStructuredCliGrantRequest,\n  extractShellCommandString,\n  fetchRegistry,\n  findAdapter,\n  findConflictingAdapters,\n  getInstalledDigest,\n  installAdapter,\n  isInstalled,\n  loadAdapter,\n  loadOrInstallAdapter,\n  parseShellCommand,\n  removeAdapter,\n  resolveAdapterPath,\n  resolveCapabilityRequest,\n  resolveCommand,\n  searchAdapters,\n  tryLoadAdapter,\n} from '@openape/shapes'\n\nexport type {\n  AdapterMeta,\n  BuiltGrantRequest,\n  GrantRequestOptions,\n  LoadedAdapter,\n  RegistryEntry,\n  RegistryIndex,\n  ResolvedCapability,\n  ResolvedCommand,\n  ShapesAdapter,\n  ShapesOperation,\n} from '@openape/shapes'\n\n// Grant-orchestration + CLI glue — stayed in apes\nexport { createShapesGrant, fetchGrantToken, findExistingGrant, verifyAndExecute, waitForGrantStatus } from './shapes/grants.js'\nexport { extractOption, extractWrappedCommand } from './shapes/commands/explain.js'\n\n// Apes-specific exports\nexport { loadAuth, saveAuth, clearAuth, loadConfig, saveConfig, getIdpUrl, getAuthToken, getRequesterIdentity } from './config'\nexport type { AuthData, ApesConfig } from './config'\nexport { apiFetch, discoverEndpoints, ApiError } from './http'\nexport { parseDuration } from './duration'\nexport { CliError, CliExit } from './errors'\n\n// Agent-runtime: callable in-process from the chat-bridge so it doesn't\n// need to spawn `apes agents serve --rpc` per turn. Same loop the\n// stdio-RPC server runs internally — see commands/agents/serve.ts.\nexport { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell } from '@openape/agent-runtime'\nexport type {\n  ChatMessage,\n  RunOptions,\n  RunResult,\n  RuntimeConfig,\n  RunStreamHandlers,\n  TraceEntry,\n  ToolDefinition,\n  ApeShellResult,\n} from '@openape/agent-runtime'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA6BP,SAAS,SAAS,eAAe,WAAW,OAAO,mBAAmB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Pure shapes library — re-exported from @openape/shapes\nexport {\n  appendAuditLog,\n  buildExactCommandGrantRequest,\n  buildStructuredCliGrantRequest,\n  extractShellCommandString,\n  fetchRegistry,\n  findAdapter,\n  findConflictingAdapters,\n  getInstalledDigest,\n  installAdapter,\n  isInstalled,\n  loadAdapter,\n  loadOrInstallAdapter,\n  parseShellCommand,\n  removeAdapter,\n  resolveAdapterPath,\n  resolveCapabilityRequest,\n  resolveCommand,\n  searchAdapters,\n  tryLoadAdapter,\n} from '@openape/shapes'\n\nexport type {\n  AdapterMeta,\n  BuiltGrantRequest,\n  GrantRequestOptions,\n  LoadedAdapter,\n  RegistryEntry,\n  RegistryIndex,\n  ResolvedCapability,\n  ResolvedCommand,\n  ShapesAdapter,\n  ShapesOperation,\n} from '@openape/shapes'\n\n// Grant-orchestration + CLI glue — stayed in apes\nexport { createShapesGrant, fetchGrantToken, findExistingGrant, verifyAndExecute, waitForGrantStatus } from './shapes/grants.js'\nexport { extractOption, extractWrappedCommand } from './shapes/commands/explain.js'\n\n// Apes-specific exports\nexport { loadAuth, saveAuth, clearAuth, loadConfig, saveConfig, getIdpUrl, getAuthToken, getRequesterIdentity } from './config'\nexport type { AuthData, ApesConfig } from './config'\nexport { apiFetch, discoverEndpoints, ApiError } from './http'\nexport { materializeSecrets, startSecretsWatcher } from './lib/agent-secrets-runtime'\nexport { parseDuration } from './duration'\nexport { CliError, CliExit } from './errors'\n\n// Agent-runtime: callable in-process from the chat-bridge so it doesn't\n// need to spawn `apes agents serve --rpc` per turn. Same loop the\n// stdio-RPC server runs internally — see commands/agents/serve.ts.\nexport { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell, addReadRoot } from '@openape/agent-runtime'\nexport type {\n  ChatMessage,\n  RunOptions,\n  RunResult,\n  RuntimeConfig,\n  RunStreamHandlers,\n  TraceEntry,\n  ToolDefinition,\n  ApeShellResult,\n} from '@openape/agent-runtime'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA8BP,SAAS,SAAS,eAAe,WAAW,OAAO,aAAa,mBAAmB;","names":[]}

package/dist/{orchestrator-P7QFDBBK.js → orchestrator-6PZXCE54.js}

@@ -20,7 +20,7 @@ import {
 import {
   apiFetch,
   getGrantsEndpoint
-} from "./chunk-NYJSBFLG.js";
+} from "./chunk-MMBFV5WN.js";
 import {
   loadAuth
 } from "./chunk-OBF7IMQ2.js";
@@ -779,4 +779,4 @@ async function runInteractiveShell() {
 export {
   runInteractiveShell
 };
-//# sourceMappingURL=orchestrator-P7QFDBBK.js.map
+//# sourceMappingURL=orchestrator-6PZXCE54.js.map

package/dist/{server-X4HHOCKV.js → server-32CG5WG2.js}

@@ -11,7 +11,7 @@ import {
 import {
   apiFetch,
   getGrantsEndpoint
-} from "./chunk-NYJSBFLG.js";
+} from "./chunk-MMBFV5WN.js";
 import {
   getAuthToken,
   getIdpUrl,
@@ -305,7 +305,7 @@ function registerAdapterTools(server) {
 async function startMcpServer(transport, port) {
   const server = new McpServer({
     name: "apes",
-    version: true ? "1.30.0" : "0.1.0"
+    version: true ? "1.31.1" : "0.1.0"
   });
   registerStaticTools(server);
   registerAdapterTools(server);
@@ -333,4 +333,4 @@ async function startMcpServer(transport, port) {
 export {
   startMcpServer
 };
-//# sourceMappingURL=server-X4HHOCKV.js.map
+//# sourceMappingURL=server-32CG5WG2.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openape/apes",
-  "version": "1.30.0",
+  "version": "1.31.1",
   "turbo": {
     "tags": [
       "publishable"
@@ -29,12 +29,12 @@
     "consola": "^3.4.2",
     "giget": "^2.0.0",
     "@lydell/node-pty": "1.2.0-beta.12",
-    "shell-quote": "^1.8.3",
+    "shell-quote": "^1.8.4",
     "zod": "^4.3.6",
     "@openape/cli-auth": "0.5.0",
-    "@openape/core": "0.18.0",
-    "@openape/agent-runtime": "0.2.1",
     "@openape/grants": "0.12.1",
+    "@openape/core": "0.18.0",
+    "@openape/agent-runtime": "0.2.2",
     "@openape/shapes": "0.7.1",
     "@openape/proxy": "0.4.6"
   },
@@ -47,7 +47,7 @@
     "tsup": "^8.5.1",
     "typescript": "^5.8.2",
     "vitest": "^4.1.7",
-    "@openape/server": "0.3.14"
+    "@openape/server": "0.3.15"
   },
   "license": "MIT",
   "author": "Patrick Hofmann <phofmann@delta-mind.at>",

package/dist/chunk-QMMRZPD2.js

@@ -1,47 +0,0 @@
-#!/usr/bin/env node
-
-// src/errors.ts
-var CliError = class extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
-    this.exitCode = exitCode;
-    this.name = "CliError";
-  }
-  exitCode;
-};
-var CliExit = class extends Error {
-  constructor(exitCode = 0) {
-    super("");
-    this.exitCode = exitCode;
-    this.name = "CliExit";
-  }
-  exitCode;
-};
-
-// src/duration.ts
-function parseDuration(value) {
-  const match = value.match(/^(\d+)\s*([smhd])$/);
-  if (!match) {
-    throw new Error(`Invalid duration format: "${value}". Use e.g. 30m, 1h, 7d`);
-  }
-  const amount = Number.parseInt(match[1], 10);
-  switch (match[2]) {
-    case "s":
-      return amount;
-    case "m":
-      return amount * 60;
-    case "h":
-      return amount * 3600;
-    case "d":
-      return amount * 86400;
-    default:
-      throw new Error(`Unknown duration unit: ${match[2]}`);
-  }
-}
-
-export {
-  CliError,
-  CliExit,
-  parseDuration
-};
-//# sourceMappingURL=chunk-QMMRZPD2.js.map

package/dist/chunk-QMMRZPD2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/duration.ts"],"sourcesContent":["export class CliError extends Error {\n  constructor(message: string, public exitCode: number = 1) {\n    super(message)\n    this.name = 'CliError'\n  }\n}\n\nexport class CliExit extends Error {\n  constructor(public exitCode: number = 0) {\n    super('')\n    this.name = 'CliExit'\n  }\n}\n","/**\n * Parse a human-readable duration string into seconds.\n * Supported formats: 30s, 5m, 1h, 7d\n */\nexport function parseDuration(value: string): number {\n  const match = value.match(/^(\\d+)\\s*([smhd])$/)\n  if (!match) {\n    throw new Error(`Invalid duration format: \"${value}\". Use e.g. 30m, 1h, 7d`)\n  }\n  const amount = Number.parseInt(match[1]!, 10)\n  switch (match[2]) {\n    case 's': return amount\n    case 'm': return amount * 60\n    case 'h': return amount * 3600\n    case 'd': return amount * 86400\n    default: throw new Error(`Unknown duration unit: ${match[2]}`)\n  }\n}\n"],"mappings":";;;AAAO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YAAY,SAAwB,WAAmB,GAAG;AACxD,UAAM,OAAO;AADqB;AAElC,SAAK,OAAO;AAAA,EACd;AAAA,EAHoC;AAItC;AAEO,IAAM,UAAN,cAAsB,MAAM;AAAA,EACjC,YAAmB,WAAmB,GAAG;AACvC,UAAM,EAAE;AADS;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;;;ACRO,SAAS,cAAc,OAAuB;AACnD,QAAM,QAAQ,MAAM,MAAM,oBAAoB;AAC9C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,6BAA6B,KAAK,yBAAyB;AAAA,EAC7E;AACA,QAAM,SAAS,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AAC5C,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B;AAAS,YAAM,IAAI,MAAM,0BAA0B,MAAM,CAAC,CAAC,EAAE;AAAA,EAC/D;AACF;","names":[]}