@openape/apes 1.31.0 → 1.31.2

package/dist/index.d.ts

@@ -1,6 +1,6 @@
 import { ResolvedCommand } from '@openape/shapes';
 export { AdapterMeta, BuiltGrantRequest, GrantRequestOptions, LoadedAdapter, RegistryEntry, RegistryIndex, ResolvedCapability, ResolvedCommand, ShapesAdapter, ShapesOperation, appendAuditLog, buildExactCommandGrantRequest, buildStructuredCliGrantRequest, extractShellCommandString, fetchRegistry, findAdapter, findConflictingAdapters, getInstalledDigest, installAdapter, isInstalled, loadAdapter, loadOrInstallAdapter, parseShellCommand, removeAdapter, resolveAdapterPath, resolveCapabilityRequest, resolveCommand, searchAdapters, tryLoadAdapter } from '@openape/shapes';
-export { ApeShellResult, ChatMessage, RpcSessionMap, RunOptions, RunResult, RunStreamHandlers, RuntimeConfig, TOOLS, ToolDefinition, TraceEntry, runApeShell, runLoop, taskTools } from '@openape/agent-runtime';
+export { ApeShellResult, ChatMessage, RpcSessionMap, RunOptions, RunResult, RunStreamHandlers, RuntimeConfig, TOOLS, ToolDefinition, TraceEntry, addReadRoot, runApeShell, runLoop, taskTools } from '@openape/agent-runtime';
 
 interface SimilarGrantsInfo {
     similar_grants: Array<{
@@ -143,6 +143,34 @@ declare function apiFetch<T = unknown>(path: string, options?: {
     token?: string;
 }): Promise<T>;
 
+interface MaterializeOptions {
+    dir?: string;
+    keyPath?: string;
+    /** Target env map (defaults to process.env). Injected in tests. */
+    env?: NodeJS.ProcessEnv;
+    /** Env names applied by a previous materialize, to drop on revoke. */
+    previouslyApplied?: Iterable<string>;
+    log?: (line: string) => void;
+}
+interface MaterializeResult {
+    applied: string[];
+    failed: string[];
+}
+/**
+ * Open every sealed blob in the secrets dir and set the corresponding
+ * env var. Any env that was applied before but whose blob is now gone
+ * (revoke) is deleted. Best-effort per blob — a corrupt/foreign blob
+ * is logged and skipped, never throws.
+ */
+declare function materializeSecrets(opts?: MaterializeOptions): MaterializeResult;
+/**
+ * Materialize once, then fs.watch the secrets dir and re-materialize
+ * on any change (rotate/revoke take effect live — the user's M2 v1
+ * choice). Returns a stop function. Safe to call when the dir doesn't
+ * exist yet (watch attaches once it appears on the next agent start).
+ */
+declare function startSecretsWatcher(opts?: MaterializeOptions): () => void;
+
 /**
  * Parse a human-readable duration string into seconds.
  * Supported formats: 30s, 5m, 1h, 7d
@@ -158,4 +186,4 @@ declare class CliExit extends Error {
     constructor(exitCode?: number);
 }
 
-export { type ApesConfig, ApiError, type AuthData, CliError, CliExit, apiFetch, clearAuth, createShapesGrant, discoverEndpoints, extractOption, extractWrappedCommand, fetchGrantToken, findExistingGrant, getAuthToken, getIdpUrl, getRequesterIdentity, loadAuth, loadConfig, parseDuration, saveAuth, saveConfig, verifyAndExecute, waitForGrantStatus };
+export { type ApesConfig, ApiError, type AuthData, CliError, CliExit, apiFetch, clearAuth, createShapesGrant, discoverEndpoints, extractOption, extractWrappedCommand, fetchGrantToken, findExistingGrant, getAuthToken, getIdpUrl, getRequesterIdentity, loadAuth, loadConfig, materializeSecrets, parseDuration, saveAuth, saveConfig, startSecretsWatcher, verifyAndExecute, waitForGrantStatus };

package/dist/index.js

@@ -2,8 +2,10 @@
 import {
   CliError,
   CliExit,
-  parseDuration
-} from "./chunk-QMMRZPD2.js";
+  materializeSecrets,
+  parseDuration,
+  startSecretsWatcher
+} from "./chunk-3LH4FT4R.js";
 import {
   createShapesGrant,
   extractOption,
@@ -51,13 +53,14 @@ import {
   searchAdapters,
   tryLoadAdapter
 } from "@openape/shapes";
-import { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell } from "@openape/agent-runtime";
+import { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell, addReadRoot } from "@openape/agent-runtime";
 export {
   ApiError,
   CliError,
   CliExit,
   RpcSessionMap,
   TOOLS,
+  addReadRoot,
   apiFetch,
   appendAuditLog,
   buildExactCommandGrantRequest,
@@ -83,6 +86,7 @@ export {
   loadAuth,
   loadConfig,
   loadOrInstallAdapter,
+  materializeSecrets,
   parseDuration,
   parseShellCommand,
   removeAdapter,
@@ -94,6 +98,7 @@ export {
   saveAuth,
   saveConfig,
   searchAdapters,
+  startSecretsWatcher,
   taskTools,
   tryLoadAdapter,
   verifyAndExecute,

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Pure shapes library — re-exported from @openape/shapes\nexport {\n  appendAuditLog,\n  buildExactCommandGrantRequest,\n  buildStructuredCliGrantRequest,\n  extractShellCommandString,\n  fetchRegistry,\n  findAdapter,\n  findConflictingAdapters,\n  getInstalledDigest,\n  installAdapter,\n  isInstalled,\n  loadAdapter,\n  loadOrInstallAdapter,\n  parseShellCommand,\n  removeAdapter,\n  resolveAdapterPath,\n  resolveCapabilityRequest,\n  resolveCommand,\n  searchAdapters,\n  tryLoadAdapter,\n} from '@openape/shapes'\n\nexport type {\n  AdapterMeta,\n  BuiltGrantRequest,\n  GrantRequestOptions,\n  LoadedAdapter,\n  RegistryEntry,\n  RegistryIndex,\n  ResolvedCapability,\n  ResolvedCommand,\n  ShapesAdapter,\n  ShapesOperation,\n} from '@openape/shapes'\n\n// Grant-orchestration + CLI glue — stayed in apes\nexport { createShapesGrant, fetchGrantToken, findExistingGrant, verifyAndExecute, waitForGrantStatus } from './shapes/grants.js'\nexport { extractOption, extractWrappedCommand } from './shapes/commands/explain.js'\n\n// Apes-specific exports\nexport { loadAuth, saveAuth, clearAuth, loadConfig, saveConfig, getIdpUrl, getAuthToken, getRequesterIdentity } from './config'\nexport type { AuthData, ApesConfig } from './config'\nexport { apiFetch, discoverEndpoints, ApiError } from './http'\nexport { parseDuration } from './duration'\nexport { CliError, CliExit } from './errors'\n\n// Agent-runtime: callable in-process from the chat-bridge so it doesn't\n// need to spawn `apes agents serve --rpc` per turn. Same loop the\n// stdio-RPC server runs internally — see commands/agents/serve.ts.\nexport { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell } from '@openape/agent-runtime'\nexport type {\n  ChatMessage,\n  RunOptions,\n  RunResult,\n  RuntimeConfig,\n  RunStreamHandlers,\n  TraceEntry,\n  ToolDefinition,\n  ApeShellResult,\n} from '@openape/agent-runtime'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA6BP,SAAS,SAAS,eAAe,WAAW,OAAO,mBAAmB;","names":[]}
+{"version":3,"sources":["../src/index.ts"],"sourcesContent":["// Pure shapes library — re-exported from @openape/shapes\nexport {\n  appendAuditLog,\n  buildExactCommandGrantRequest,\n  buildStructuredCliGrantRequest,\n  extractShellCommandString,\n  fetchRegistry,\n  findAdapter,\n  findConflictingAdapters,\n  getInstalledDigest,\n  installAdapter,\n  isInstalled,\n  loadAdapter,\n  loadOrInstallAdapter,\n  parseShellCommand,\n  removeAdapter,\n  resolveAdapterPath,\n  resolveCapabilityRequest,\n  resolveCommand,\n  searchAdapters,\n  tryLoadAdapter,\n} from '@openape/shapes'\n\nexport type {\n  AdapterMeta,\n  BuiltGrantRequest,\n  GrantRequestOptions,\n  LoadedAdapter,\n  RegistryEntry,\n  RegistryIndex,\n  ResolvedCapability,\n  ResolvedCommand,\n  ShapesAdapter,\n  ShapesOperation,\n} from '@openape/shapes'\n\n// Grant-orchestration + CLI glue — stayed in apes\nexport { createShapesGrant, fetchGrantToken, findExistingGrant, verifyAndExecute, waitForGrantStatus } from './shapes/grants.js'\nexport { extractOption, extractWrappedCommand } from './shapes/commands/explain.js'\n\n// Apes-specific exports\nexport { loadAuth, saveAuth, clearAuth, loadConfig, saveConfig, getIdpUrl, getAuthToken, getRequesterIdentity } from './config'\nexport type { AuthData, ApesConfig } from './config'\nexport { apiFetch, discoverEndpoints, ApiError } from './http'\nexport { materializeSecrets, startSecretsWatcher } from './lib/agent-secrets-runtime'\nexport { parseDuration } from './duration'\nexport { CliError, CliExit } from './errors'\n\n// Agent-runtime: callable in-process from the chat-bridge so it doesn't\n// need to spawn `apes agents serve --rpc` per turn. Same loop the\n// stdio-RPC server runs internally — see commands/agents/serve.ts.\nexport { runLoop, RpcSessionMap, taskTools, TOOLS, runApeShell, addReadRoot } from '@openape/agent-runtime'\nexport type {\n  ChatMessage,\n  RunOptions,\n  RunResult,\n  RuntimeConfig,\n  RunStreamHandlers,\n  TraceEntry,\n  ToolDefinition,\n  ApeShellResult,\n} from '@openape/agent-runtime'\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AACA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AA8BP,SAAS,SAAS,eAAe,WAAW,OAAO,aAAa,mBAAmB;","names":[]}

package/dist/{server-MDXOGP2U.js → server-OSX5LE4W.js}

@@ -305,7 +305,7 @@ function registerAdapterTools(server) {
 async function startMcpServer(transport, port) {
   const server = new McpServer({
     name: "apes",
-    version: true ? "1.31.0" : "0.1.0"
+    version: true ? "1.31.2" : "0.1.0"
   });
   registerStaticTools(server);
   registerAdapterTools(server);
@@ -333,4 +333,4 @@ async function startMcpServer(transport, port) {
 export {
   startMcpServer
 };
-//# sourceMappingURL=server-MDXOGP2U.js.map
+//# sourceMappingURL=server-OSX5LE4W.js.map

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@openape/apes",
-  "version": "1.31.0",
+  "version": "1.31.2",
   "turbo": {
     "tags": [
       "publishable"
@@ -31,12 +31,12 @@
     "@lydell/node-pty": "1.2.0-beta.12",
     "shell-quote": "^1.8.4",
     "zod": "^4.3.6",
-    "@openape/cli-auth": "0.5.0",
+    "@openape/cli-auth": "0.5.1",
     "@openape/core": "0.18.0",
-    "@openape/agent-runtime": "0.2.2",
-    "@openape/shapes": "0.7.1",
     "@openape/grants": "0.12.1",
-    "@openape/proxy": "0.4.6"
+    "@openape/agent-runtime": "0.2.2",
+    "@openape/proxy": "0.4.6",
+    "@openape/shapes": "0.7.1"
   },
   "devDependencies": {
     "@types/node": "^25.3.5",

package/dist/chunk-QMMRZPD2.js

@@ -1,47 +0,0 @@
-#!/usr/bin/env node
-
-// src/errors.ts
-var CliError = class extends Error {
-  constructor(message, exitCode = 1) {
-    super(message);
-    this.exitCode = exitCode;
-    this.name = "CliError";
-  }
-  exitCode;
-};
-var CliExit = class extends Error {
-  constructor(exitCode = 0) {
-    super("");
-    this.exitCode = exitCode;
-    this.name = "CliExit";
-  }
-  exitCode;
-};
-
-// src/duration.ts
-function parseDuration(value) {
-  const match = value.match(/^(\d+)\s*([smhd])$/);
-  if (!match) {
-    throw new Error(`Invalid duration format: "${value}". Use e.g. 30m, 1h, 7d`);
-  }
-  const amount = Number.parseInt(match[1], 10);
-  switch (match[2]) {
-    case "s":
-      return amount;
-    case "m":
-      return amount * 60;
-    case "h":
-      return amount * 3600;
-    case "d":
-      return amount * 86400;
-    default:
-      throw new Error(`Unknown duration unit: ${match[2]}`);
-  }
-}
-
-export {
-  CliError,
-  CliExit,
-  parseDuration
-};
-//# sourceMappingURL=chunk-QMMRZPD2.js.map

package/dist/chunk-QMMRZPD2.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/errors.ts","../src/duration.ts"],"sourcesContent":["export class CliError extends Error {\n  constructor(message: string, public exitCode: number = 1) {\n    super(message)\n    this.name = 'CliError'\n  }\n}\n\nexport class CliExit extends Error {\n  constructor(public exitCode: number = 0) {\n    super('')\n    this.name = 'CliExit'\n  }\n}\n","/**\n * Parse a human-readable duration string into seconds.\n * Supported formats: 30s, 5m, 1h, 7d\n */\nexport function parseDuration(value: string): number {\n  const match = value.match(/^(\\d+)\\s*([smhd])$/)\n  if (!match) {\n    throw new Error(`Invalid duration format: \"${value}\". Use e.g. 30m, 1h, 7d`)\n  }\n  const amount = Number.parseInt(match[1]!, 10)\n  switch (match[2]) {\n    case 's': return amount\n    case 'm': return amount * 60\n    case 'h': return amount * 3600\n    case 'd': return amount * 86400\n    default: throw new Error(`Unknown duration unit: ${match[2]}`)\n  }\n}\n"],"mappings":";;;AAAO,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YAAY,SAAwB,WAAmB,GAAG;AACxD,UAAM,OAAO;AADqB;AAElC,SAAK,OAAO;AAAA,EACd;AAAA,EAHoC;AAItC;AAEO,IAAM,UAAN,cAAsB,MAAM;AAAA,EACjC,YAAmB,WAAmB,GAAG;AACvC,UAAM,EAAE;AADS;AAEjB,SAAK,OAAO;AAAA,EACd;AAAA,EAHmB;AAIrB;;;ACRO,SAAS,cAAc,OAAuB;AACnD,QAAM,QAAQ,MAAM,MAAM,oBAAoB;AAC9C,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,6BAA6B,KAAK,yBAAyB;AAAA,EAC7E;AACA,QAAM,SAAS,OAAO,SAAS,MAAM,CAAC,GAAI,EAAE;AAC5C,UAAQ,MAAM,CAAC,GAAG;AAAA,IAChB,KAAK;AAAK,aAAO;AAAA,IACjB,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B,KAAK;AAAK,aAAO,SAAS;AAAA,IAC1B;AAAS,YAAM,IAAI,MAAM,0BAA0B,MAAM,CAAC,CAAC,EAAE;AAAA,EAC/D;AACF;","names":[]}