@pikku/mongodb 0.12.13 → 0.12.15

package/CHANGELOG.md

@@ -1,5 +1,93 @@
 # @pikku/mongodb
 
+## 0.12.15
+
+### Patch Changes
+
+- 6dada45: fix(workflow,ai-agent): make a run's owner, entry node and step function authoritative
+
+  A graph run may only start at a node the graph declared in `meta.entryNodeIds`, and
+  the generated `POST /workflow/:workflowName/graph/:nodeId` route that let an HTTP
+  caller pick the entry node is gone. `startNode` stays for `PikkuTriggerService`,
+  which names a declared entry node anyway.
+
+  `StepState` now records the `rpcName` the workflow dispatched a step with, and the
+  step claim rejects a queue message naming a different function with
+  `WorkflowStepFunctionMismatchError` before mutating any status — a step runs under
+  the run owner's identity and without the `expose` gate, so the message must not
+  choose what runs.
+
+  `approveStep` takes the caller's session, and the generated status routes and
+  streams assert the same `assertWorkflowRunOwner` check: a run started through a
+  session may only be read and approved by that session's user. A run with no
+  recorded owner (trigger, scheduler, unauthenticated route) has nobody to compare
+  against and is still gated by the entrypoint's own `auth`/`permissions`.
+
+  `AIRunStateService.resolveApproval` is now a compare-and-swap returning whether
+  _this_ caller made the claim, and both agent resume paths run a tool only for the
+  approvals they claimed — concurrent approvals of one tool call no longer all
+  execute it.
+
+- Updated dependencies [41c1a95]
+- Updated dependencies [ce96383]
+- Updated dependencies [7e60867]
+- Updated dependencies [f8f1244]
+- Updated dependencies [dcf20cb]
+- Updated dependencies [6512384]
+- Updated dependencies [e3b4c14]
+- Updated dependencies [efd0ed1]
+- Updated dependencies [cba98fb]
+- Updated dependencies [ce96383]
+- Updated dependencies [f8f1244]
+- Updated dependencies [f8f1244]
+- Updated dependencies [6e93a35]
+- Updated dependencies [6dada45]
+  - @pikku/core@0.12.80
+
+## 0.12.14
+
+### Patch Changes
+
+- 78b29f0: `SecretService` now returns a `SecretValue<T>` rather than the bare value, so a
+  vault secret cannot reach a sink by accident.
+
+  `SecretValue` is nominally typed, which means it is not assignable to `string`
+  (or to any other concretely-typed field). Every sink with a real type — a
+  database column, an email body, a session payload — rejects it with no lint
+  rule involved. The sinks typed `any`, `unknown`, or a free generic — the logger,
+  queue payloads, webhook and email inputs, and a function's own output — are
+  guarded with `Safe<T>`, which collapses a `SecretValue` found anywhere inside
+  `T`, however deeply nested, to `never`.
+
+  Unwrap deliberately at the point the secret reaches the wire:
+
+  ```ts
+  const secret = await secrets.getSecret('BETTER_AUTH_SECRET')
+  betterAuth({ secret: secret.reveal() })
+  ```
+
+  Two behaviours cover what types cannot see. Structured serialization redacts —
+  `JSON.stringify` and node's inspect both yield `[secret]`, so an audit or log
+  write stays honest without crashing the request. String coercion throws
+  `SecretCoercionError`, because a template literal is always a leak.
+
+  `AuditLog.write` is guarded the same way as the logger, since an audit event
+  carries `input` and `metadata` as `unknown` and nominality alone cannot stop a
+  secret landing in one.
+
+  `.reveal()` is the deliberate escape hatch, and what it hands back is an
+  ordinary string as far as every sink signature is concerned. **PKU953** closes
+  that gap: under `pikku all --security` the inspector reports a revealed secret
+  that flows into a logger, an audit, a queue, an email or a webhook — `console` included.
+
+  This also fixed a real one: `remote-addon-auth.ts` called `String(token)` on an
+  `unknown` and wrote the result straight into an `Authorization` header.
+
+- Updated dependencies [62ea4cc]
+- Updated dependencies [9dddff8]
+- Updated dependencies [78b29f0]
+  - @pikku/core@0.12.76
+
 ## 0.12.13
 
 ### Patch Changes

package/dist/src/mongodb-ai-storage-service.d.ts

@@ -36,6 +36,6 @@ export declare class MongoDBAIStorageService implements AIStorageService, AIRunS
         run: AgentRunState;
         approval: NonNullable<AgentRunState['pendingApprovals']>[number];
     } | null>;
-    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<void>;
+    resolveApproval(toolCallId: string, status: 'approved' | 'denied'): Promise<boolean>;
     close(): Promise<void>;
 }

package/dist/src/mongodb-ai-storage-service.js

@@ -402,7 +402,9 @@ export class MongoDBAIStorageService {
         return { run, approval };
     }
     async resolveApproval(toolCallId, status) {
-        await this.toolCalls.updateOne({ _id: toolCallId }, { $set: { approvalStatus: status } });
+        // Only the caller that moves the tool call off 'pending' has claimed it.
+        const result = await this.toolCalls.updateOne({ _id: toolCallId, approvalStatus: 'pending' }, { $set: { approvalStatus: status } });
+        return result.modifiedCount > 0;
     }
     async close() { }
 }

package/dist/src/mongodb-secret-service.d.ts

@@ -1,4 +1,5 @@
-import type { SecretService } from '@pikku/core/services';
+import { type SecretValue } from '@pikku/core';
+import type { SecretService, SecretValues } from '@pikku/core/services';
 import type { Db } from 'mongodb';
 export interface MongoDBSecretServiceConfig {
     key: string;
@@ -25,10 +26,10 @@ export declare class MongoDBSecretService implements SecretService {
     private logAudit;
     private getKEKSalt;
     private getKEK;
-    getSecret<T = string>(key: string): Promise<T>;
+    getSecret<T = string>(key: string): Promise<SecretValue<T>>;
     hasSecret(key: string): Promise<boolean>;
     setSecret(key: string, value: unknown): Promise<void>;
     deleteSecret(key: string): Promise<void>;
-    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<T>;
+    getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(keys: (keyof T & string)[]): Promise<Partial<SecretValues<T>>>;
     rotateKEK(): Promise<number>;
 }

package/dist/src/mongodb-secret-service.js

@@ -1,3 +1,4 @@
+import { createSecretValue, isSecretValue } from '@pikku/core';
 import { deriveKEK, generateKEKSalt, envelopeEncrypt, envelopeDecrypt, envelopeRewrap, } from '@pikku/core/crypto-utils';
 export class MongoDBSecretService {
     db;
@@ -74,14 +75,16 @@ export class MongoDBSecretService {
         const kek = await this.getKEK(row.keyVersion);
         const result = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
         await this.logAudit(key, 'read');
-        return result;
+        return createSecretValue(result);
     }
     async hasSecret(key) {
         const count = await this.secrets.countDocuments({ _id: key }, { limit: 1 });
         return count > 0;
     }
     async setSecret(key, value) {
-        const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), value);
+        // Encrypting the wrapper would store its redaction, not the secret —
+        // writing a secret back to the vault is exactly what this method is for.
+        const { ciphertext, wrappedDEK } = await envelopeEncrypt(await this.getKEK(this.keyVersion), isSecretValue(value) ? value.reveal() : value);
         const now = new Date();
         await this.secrets.updateOne({ _id: key }, {
             $set: {
@@ -109,7 +112,7 @@ export class MongoDBSecretService {
         for (const row of rows) {
             try {
                 const kek = await this.getKEK(row.keyVersion);
-                out[row._id] = await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek);
+                out[row._id] = createSecretValue(await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek));
             }
             catch (cause) {
                 throw new Error(`Failed to decrypt secret "${row._id}" (key_version ${row.keyVersion}): ` +

package/dist/src/mongodb-workflow-service.js

@@ -85,6 +85,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId,
             status: 'pending',
+            rpcName,
             result: undefined,
             error: undefined,
             attemptCount: 1,
@@ -109,6 +110,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,
@@ -238,6 +240,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
         return {
             stepId: row._id,
             status: row.status,
+            rpcName: row.rpcName ?? null,
             result: row.result ?? undefined,
             error: row.error ?? undefined,
             attemptCount,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@pikku/mongodb",
-  "version": "0.12.13",
+  "version": "0.12.15",
   "description": "MongoDB services for Pikku — workflow state, agent runs, secrets and channel stores",
   "author": "yasser.fadl@gmail.com",
   "license": "MIT",
@@ -18,7 +18,7 @@
     "prepublishOnly": "yarn build"
   },
   "peerDependencies": {
-    "@pikku/core": "^0.12.74"
+    "@pikku/core": "^0.12.80"
   },
   "dependencies": {
     "mongodb": "^6.12.0"

package/src/mongodb-ai-storage-service.ts

@@ -565,11 +565,13 @@ export class MongoDBAIStorageService
   async resolveApproval(
     toolCallId: string,
     status: 'approved' | 'denied'
-  ): Promise<void> {
-    await this.toolCalls.updateOne(
-      { _id: toolCallId },
+  ): Promise<boolean> {
+    // Only the caller that moves the tool call off 'pending' has claimed it.
+    const result = await this.toolCalls.updateOne(
+      { _id: toolCallId, approvalStatus: 'pending' },
       { $set: { approvalStatus: status } }
     )
+    return result.modifiedCount > 0
   }
 
   public async close(): Promise<void> {}

package/src/mongodb-secret-service.ts

@@ -1,4 +1,5 @@
-import type { SecretService } from '@pikku/core/services'
+import { createSecretValue, isSecretValue, type SecretValue } from '@pikku/core'
+import type { SecretService, SecretValues } from '@pikku/core/services'
 import type { Db, Collection } from 'mongodb'
 import {
   deriveKEK,
@@ -124,14 +125,14 @@ export class MongoDBSecretService implements SecretService {
     return kek
   }
 
-  async getSecret<T = string>(key: string): Promise<T> {
+  async getSecret<T = string>(key: string): Promise<SecretValue<T>> {
     const row = await this.secrets.findOne({ _id: key })
     if (!row) throw new Error('Requested secret not found')
 
     const kek = await this.getKEK(row.keyVersion)
     const result = await envelopeDecrypt<T>(kek, row.ciphertext, row.wrappedDek)
     await this.logAudit(key, 'read')
-    return result
+    return createSecretValue(result)
   }
 
   async hasSecret(key: string): Promise<boolean> {
@@ -140,9 +141,11 @@ export class MongoDBSecretService implements SecretService {
   }
 
   async setSecret(key: string, value: unknown): Promise<void> {
+    // Encrypting the wrapper would store its redaction, not the secret —
+    // writing a secret back to the vault is exactly what this method is for.
     const { ciphertext, wrappedDEK } = await envelopeEncrypt(
       await this.getKEK(this.keyVersion),
-      value
+      isSecretValue(value) ? value.reveal() : value
     )
     const now = new Date()
 
@@ -173,7 +176,7 @@ export class MongoDBSecretService implements SecretService {
 
   async getSecrets<T extends Record<string, unknown> = Record<string, unknown>>(
     keys: (keyof T & string)[]
-  ): Promise<T> {
+  ): Promise<Partial<SecretValues<T>>> {
     const rows = await this.secrets
       .find({ _id: { $in: keys } } as any)
       .toArray()
@@ -181,10 +184,8 @@ export class MongoDBSecretService implements SecretService {
     for (const row of rows) {
       try {
         const kek = await this.getKEK(row.keyVersion)
-        out[row._id] = await envelopeDecrypt(
-          kek,
-          row.ciphertext,
-          row.wrappedDek
+        out[row._id] = createSecretValue(
+          await envelopeDecrypt(kek, row.ciphertext, row.wrappedDek)
         )
       } catch (cause) {
         throw new Error(
@@ -194,7 +195,7 @@ export class MongoDBSecretService implements SecretService {
         )
       }
     }
-    return out as T
+    return out as Partial<SecretValues<T>>
   }
 
   async rotateKEK(): Promise<number> {

package/src/mongodb-services.test.ts

@@ -171,7 +171,8 @@ function registerTests(name: string, getDb: () => Db) {
         'batch-b': string
       }>(['batch-a', 'batch-b'])
 
-      assert.deepEqual(out, { 'batch-a': { v: 1 }, 'batch-b': 'two' })
+      assert.deepEqual(out['batch-a']!.reveal(), { v: 1 })
+      assert.equal(out['batch-b']!.reveal(), 'two')
     })
 
     test('getSecrets omits keys that were never stored', async () => {
@@ -181,7 +182,8 @@ function registerTests(name: string, getDb: () => Db) {
 
       const out = await service.getSecrets(['present', 'never-stored'])
 
-      assert.deepEqual(out, { present: 'here' })
+      assert.deepEqual(Object.keys(out), ['present'])
+      assert.equal(out.present!.reveal(), 'here')
     })
   })
 }

package/src/mongodb-workflow-service.ts

@@ -203,6 +203,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId,
       status: 'pending',
+      rpcName,
       result: undefined,
       error: undefined,
       attemptCount: 1,
@@ -233,6 +234,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,
@@ -426,6 +428,7 @@ export class MongoDBWorkflowService extends PikkuWorkflowService {
     return {
       stepId: row._id,
       status: row.status as StepState['status'],
+      rpcName: row.rpcName ?? null,
       result: row.result ?? undefined,
       error: row.error ?? undefined,
       attemptCount,