@proagentstore/cli 0.4.158 → 0.4.159

package/dist/browser-runner/coding/pane-redact.js

@@ -1,4 +1,5 @@
 import { maskSecrets } from "../crash-reports.js";
+import { machineSecureTypeDeps, secureType } from "./secure-type.js";
 import { tmuxExec } from "./tmux.js";
 /** How long a delivered value is masked in captures. */
 export const INJECTED_TTL_MS = 24 * 60 * 60_000;
@@ -82,3 +83,7 @@ export function scrubDelivered(body) {
         return { remembered: true, cleared: false };
     }
 }
+/** The two secret routes a delivery uses: `/secure/type` (the value over stdin, #1143) and `/secure/scrub` (after it, #1166). */
+export async function secureTerminalRoute(path, body) {
+    return path === "/secure/scrub" ? scrubDelivered(body) : secureType(body, await machineSecureTypeDeps());
+}

package/dist/browser-runner/coding/secure-type.js

@@ -0,0 +1,78 @@
+/**
+ * Type a secret into a terminal WITHOUT putting it in any process's argv (#1143).
+ *
+ * `secure_input_inject` used to type through `/tmux/send` / `/terminal/send`, which run
+ * `tmux send-keys -t <session> -l <value>` and `kitty @ send-text --match id:<n> <value>`: the plaintext sat
+ * in a child process's argv for the life of the call, readable by any local user through `ps` or
+ * `/proc/<pid>/cmdline`, and by whatever records process launches. Here the value travels over STDIN:
+ *
+ *   • tmux  — `load-buffer -b <one-use name> -` (the value on stdin), then `paste-buffer -d -b <name> -t <session>`,
+ *             which deletes the buffer as it pastes; a paste that fails deletes it anyway.
+ *   • kitty — `kitty @ send-text --match id:<n> --stdin` (the value on stdin).
+ *   • iTerm2 — refused: its `write text` takes the value inside an AppleScript argument, and always presses Return.
+ *
+ * Its own route (`POST /secure/type`), so ordinary `tmux_send_keys` text is unaffected, and so there is one body
+ * this runner promises never to log or put in an error: errors name the target, never the value — and with the
+ * value off argv, a failed command's own message (which quotes its argv) cannot carry it either.
+ */
+import { execFileSync } from "node:child_process";
+import { randomUUID } from "node:crypto";
+import { RunnerInputError } from "../errors.js";
+/** Deliver `value` to `target` (a bare tmux session, `tmux:<session>` or `kitty:<id>`); the pane before and after. */
+export async function secureType(body, deps) {
+    const target = typeof body.target === "string" ? body.target.trim() : "";
+    const value = typeof body.value === "string" ? body.value : "";
+    if (!target)
+        throw new RunnerInputError("A `target` is required.");
+    if (!value)
+        throw new RunnerInputError("Nothing to type.");
+    const opts = (input) => ({ input, encoding: "utf8", timeout: 5000, stdio: ["pipe", "pipe", "pipe"] });
+    const kitty = /^kitty:(.+)$/i.exec(target);
+    if (kitty) {
+        const paneBefore = deps.capture(kitty[1], "kitty");
+        try {
+            deps.exec("kitty", ["@", "send-text", "--match", `id:${kitty[1]}`, "--stdin"], opts(value));
+        }
+        catch {
+            throw new Error(`Typing into ${target} failed: kitty remote control is unavailable (allow_remote_control yes).`);
+        }
+        const pane = deps.capture(kitty[1], "kitty");
+        return { target, pane, paneBefore, changed: pane !== paneBefore };
+    }
+    if (/^iterm2:/i.test(target))
+        throw new RunnerInputError("iTerm2 cannot be typed into without the value in a script argument; use a tmux or kitty target.");
+    const session = target.replace(/^tmux:/i, "");
+    if (!deps.exists(session))
+        throw new RunnerInputError(`No tmux session "${session}".`, 404);
+    const paneBefore = deps.capture(session, "tmux");
+    const buffer = `pags-secure-${randomUUID()}`;
+    try {
+        deps.exec("tmux", ["load-buffer", "-b", buffer, "-"], opts(value));
+        deps.exec("tmux", ["paste-buffer", "-d", "-b", buffer, "-t", session], opts(""));
+    }
+    catch {
+        throw new Error(`Typing into "${session}" failed: tmux did not accept the paste.`);
+    }
+    finally {
+        // `-d` deleted it on a paste that ran; this is the paste that did not.
+        try {
+            deps.exec("tmux", ["delete-buffer", "-b", buffer], opts(""));
+        }
+        catch {
+            // Already gone — the normal case.
+        }
+    }
+    const pane = await deps.settle(session);
+    return { target, pane, paneBefore, changed: pane !== paneBefore };
+}
+/** The real hands. */
+export async function machineSecureTypeDeps() {
+    const { capturePane, sessionExists, waitForPaneSettle } = await import("./tmux.js");
+    const { captureTerminalTarget } = await import("./terminal.js");
+    return {
+        exec: (file, args, opts) => execFileSync(file, args, opts),
+        exists: sessionExists,
+        capture: (t, backend) => (backend === "kitty" ? captureTerminalTarget(t, { backend: "kitty" }) : capturePane(t, 200)),
+        settle: (session) => waitForPaneSettle(session, { quietMs: 750, timeoutMs: 3_000 }),
+    };
+}

package/dist/browser-runner/server.js

@@ -1,4 +1,4 @@
-import { outgoing, redactPanesOf, scrubDelivered } from "./coding/pane-redact.js";
+import { outgoing, redactPanesOf, secureTerminalRoute } from "./coding/pane-redact.js";
 import { codingSessionRefusal, instanceOf, readJson } from "./request-instance.js";
 import { createServer, } from "node:http";
 import { URL } from "node:url";
@@ -84,8 +84,8 @@ async function route(runner, req, res) {
         return json(res, 403, { error: refused });
     // Panes leave this machine redacted (#1166, coding/pane-redact.ts); a delivered secret is scrubbed.
     redactPanesOf(res, path, req.method === "POST" && /^\/(tmux|terminal)\//.test(path) ? await readJson(req) : undefined);
-    if (req.method === "POST" && path === "/secure/scrub")
-        return json(res, 200, scrubDelivered(await readJson(req)));
+    if (req.method === "POST" && (path === "/secure/scrub" || path === "/secure/type"))
+        return json(res, 200, await secureTerminalRoute(path, await readJson(req)));
     if ((req.method === "GET" || req.method === "POST") && path === "/health") {
         // #896: a health check that cannot say WHO answered is not enough to decide anything with.
         // A contender for the single-instance lock has a pid and a port from the lock file; what it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@proagentstore/cli",
-  "version": "0.4.158",
+  "version": "0.4.159",
   "description": "CLI for creating, publishing, and running ProAgentStore agents",
   "license": "MIT",
   "type": "module",