@safekb/mcp 0.10.1 → 0.12.0

package/README.md

@@ -371,6 +371,19 @@ custom fields and the key name of every custom field (sealed ones too) stay read
   space takes its credentials along (a credential's group in the old space is left behind).
 - `reveal_sealed_credential` and `get_sealed_totp` decrypt locally. The hosted `reveal_credential` and
   `get_credential_totp` cannot open a sealed credential.
+- AI access: `visible`, `use_only` or `human_only`, per credential (`llm_visibility`) and per sealed
+  field (`llm_field_visibility`, e.g. a card's number and CVC hidden, its expiry date visible).
+  `reveal_sealed_credential` and `get_sealed_totp` work only on a `visible` field. New and migrated
+  sealed credentials start with the tenant default (Settings → Sealed credentials; `use_only` until
+  set). Only you make anything more visible, in the SafeKB app; `set_sealed_credential_llm_visibility`
+  only tightens. The client enforces this: a client older than 0.11.0 reveals every sealed credential, and 0.11.0 ignores field overrides.
+- Using a secret without showing it (0.12.0): `secret_exec` runs a program with it in env or stdin
+  (never argv), `secret_http` sends one request with it in the url, headers or body (redirects are not
+  followed), and `secret_adb_input` types it on an Android device (`adb shell input text`, value on stdin;
+  printable ASCII only). The agent names it by handle, `{{secret://<credential_id>/<field>}}`; a `totp`
+  handle becomes the current code. `visible` and `use_only` fields can be used; `human_only` fields never.
+  Output comes back scrubbed of the value (as is, URL-encoded, base64, hex, JSON-escaped) with the
+  credentials and fields used. Scrubbing stops careless leaks, not a program written to leak one.
 - Visible fields can be edited without the secret. Such an edit is flagged (`visible_tampered`) with the
   changed fields until a signed save accepts it (`accept_visible_changes`).
 

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.10.1",
+  version: "0.12.0",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -3276,6 +3276,12 @@ class SealedApi {
   fetchSealedCredential(id) {
     return this.http.getJson(`/credentials/${id}/sealed`);
   }
+  setLlmVisibility(id, llmVisibility, field) {
+    return this.http.putJson(`/credentials/${id}/sealed/llm-visibility`, {
+      llm_visibility: llmVisibility,
+      ...field === undefined ? {} : { field }
+    });
+  }
   lastAttestedVisibleFields(id) {
     return this.http.getJson(`/credentials/${id}/sealed/attested`);
   }
@@ -8909,6 +8915,259 @@ class LocalKeys {
   }
 }
 
+// src/sealed/credentialAccess.ts
+var REVEALABLE = new Set(["visible"]);
+var USABLE = new Set(["visible", "use_only"]);
+var CUSTOM_PREFIX2 = customFieldName("");
+function visibleOf(credential2) {
+  return {
+    title: credential2.title,
+    username: credential2.username,
+    url: credential2.url,
+    tags: credential2.tags,
+    notes: credential2.notes,
+    custom: credential2.custom.flatMap(({ key, value }) => value === undefined ? [] : [{ key, value }])
+  };
+}
+function sealedValue(open5, field) {
+  const { values, credential: credential2 } = open5;
+  const value = field.startsWith(CUSTOM_PREFIX2) ? values.custom.find((item) => item.key === field.slice(CUSTOM_PREFIX2.length))?.value : SEALED_CREDENTIAL_FIELDS.includes(field) ? values[field] : undefined;
+  if (value === undefined || value === null) {
+    throw new ClientError(`Credential ${credential2.id} has no sealed field '${field}'. Sealed fields: password, totp, sealed_notes, custom:{key}.`);
+  }
+  return value;
+}
+function assertDistinctCustomKeys(visible, values) {
+  const keys = [...visible.custom, ...values.custom].map(({ key }) => key);
+  if (keys.some((key) => key.length === 0)) {
+    throw new ClientError("A custom field needs a key");
+  }
+  if (new Set(keys).size !== keys.length) {
+    throw new ClientError("Custom field keys must be unique");
+  }
+}
+
+class CredentialAccess {
+  ctx;
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  context(credentialId) {
+    return { tenant: this.ctx.tenant, credential: credentialId };
+  }
+  async newDek(rootId, credentialId) {
+    const { keys } = await this.ctx.session.open(rootId);
+    const dek = generateDek();
+    return {
+      dek,
+      encDek: serializeEnvelope(await wrapDek(keys, credentialId, dek))
+    };
+  }
+  async rewrapDek(dek, rootId, credentialId) {
+    const { keys } = await this.ctx.session.open(rootId);
+    return serializeEnvelope(await wrapDek(keys, credentialId, dek));
+  }
+  async open(credentialId) {
+    return this.decrypt(await this.ctx.api.fetchSealedCredential(credentialId));
+  }
+  async openForReveal(credentialId, field) {
+    return this.openAllowing(credentialId, field, REVEALABLE, (visibility) => visibility === "use_only" ? "it is never shown to an LLM. Use it without seeing it: secret_exec, secret_http or secret_adb_input with the handle secret://<credential_id>/<field>." : "it is never shown to an LLM and never handed to a tool: ask the user to enter it.");
+  }
+  async openForUse(credentialId, field) {
+    return this.openAllowing(credentialId, field, USABLE, () => "no tool may use it: ask the user to enter it.");
+  }
+  async openAllowing(credentialId, field, allowed, refusal) {
+    const credential2 = await this.ctx.api.fetchSealedCredential(credentialId);
+    const visibility = Object.hasOwn(credential2.llm_field_visibility, field) ? credential2.llm_field_visibility[field] : credential2.llm_visibility;
+    if (!allowed.has(visibility)) {
+      throw new ClientError(`Field '${field}' of credential ${credentialId} (${credential2.title}) is ${visibility}: ${refusal(visibility)} Only the user can change this, in the SafeKB app.`);
+    }
+    return this.decrypt(credential2);
+  }
+  async decrypt(credential2) {
+    const credentialId = credential2.id;
+    const { keys } = await this.ctx.session.open(credential2.seal_root_id);
+    const dek = await unwrapDek(keys, credentialId, parseEnvelope(credential2.enc_dek));
+    const values = await unsealCredentialFields(dek, this.context(credentialId), credential2.enc_fields);
+    return { credential: credential2, dek, values };
+  }
+  async seal(credentialId, dek, visible, values) {
+    assertDistinctCustomKeys(visible, values);
+    return {
+      visible,
+      encFields: await sealCredentialFields(dek, this.context(credentialId), values),
+      visibleDigest: await visibleFieldsDigest(visible)
+    };
+  }
+  async sign(message, signerRootIds) {
+    const signers = [];
+    for (const rootId of signerRootIds) {
+      signers.push((await this.ctx.session.open(rootId)).keys);
+    }
+    return signMessage(await buildCredentialMessage(message), signers);
+  }
+}
+
+// src/sinks/redaction.ts
+var MAX_SHOWN_CHARS2 = 32 * 1024;
+function encodedForms(value) {
+  const bytes = Buffer.from(value, "utf8");
+  const base64 = bytes.toString("base64");
+  const hex = bytes.toString("hex");
+  return [
+    value,
+    encodeURIComponent(value),
+    new URLSearchParams({ v: value }).toString().slice(2),
+    value.replaceAll(" ", "%s"),
+    value.replaceAll(" ", "%s").replaceAll("'", `'\\''`),
+    JSON.stringify(value).slice(1, -1),
+    base64,
+    base64.replace(/=+$/, ""),
+    bytes.toString("base64url"),
+    hex,
+    hex.toUpperCase()
+  ];
+}
+var escapeRegex = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+class Redactor {
+  markers;
+  pattern;
+  longest;
+  constructor(secrets) {
+    this.markers = new Map;
+    for (const { name, value } of secrets) {
+      for (const form of encodedForms(value)) {
+        if (form.length > 0)
+          this.markers.set(form, `«redacted:${name}»`);
+      }
+    }
+    const forms = [...this.markers.keys()].sort((a, b) => b.length - a.length);
+    this.pattern = forms.length === 0 ? null : new RegExp(forms.map(escapeRegex).join("|"), "g");
+    this.longest = forms[0]?.length ?? 0;
+  }
+  redact(text) {
+    if (this.pattern === null)
+      return text;
+    return text.replace(this.pattern, (form) => this.markers.get(form));
+  }
+  shown(text, cut) {
+    const whole = cut ? text.slice(0, Math.max(0, text.length - this.longest)) : text;
+    const scrubbed = this.redact(whole);
+    return {
+      text: scrubbed.slice(0, MAX_SHOWN_CHARS2),
+      truncated: cut || scrubbed.length > MAX_SHOWN_CHARS2
+    };
+  }
+}
+
+// src/sinks/secretHandles.ts
+var HANDLE = /\{\{secret:\/\/([0-9a-f]{24})\/([^{}]+)\}\}/g;
+var ANY_HANDLE = /secret:\/\//;
+var handleKey = ({ credentialId, field }) => `${credentialId}/${field}`;
+function refsIn(text) {
+  const refs = [];
+  const rest = text.replace(HANDLE, (_, credentialId, field) => {
+    refs.push({ credentialId, field });
+    return "";
+  });
+  if (ANY_HANDLE.test(rest)) {
+    throw new ClientError("A secret handle must be written {{secret://<24-character credential id>/<field>}}, e.g. {{secret://0123456789abcdef01234567/password}}");
+  }
+  return refs;
+}
+function hasHandle(text) {
+  return ANY_HANDLE.test(text);
+}
+function fillHandles(text, lookup) {
+  return text.replace(HANDLE, (_, credentialId, field) => lookup({ credentialId, field }));
+}
+function requireHandlesAfterOrigin(url) {
+  const first = url.search(ANY_HANDLE);
+  if (first === -1)
+    return;
+  if (!/^https?:\/\/[^/?#{}]+[/?#]/.test(url.slice(0, first))) {
+    throw new ClientError("A secret handle can go in the path, query or fragment of a url, never in its scheme, host or port.");
+  }
+}
+
+// src/sinks/secretResolver.ts
+var TOTP_FIELD = "totp";
+var MIN_TOTP_SECONDS = 5;
+var SYSTEM_CLOCK = {
+  now: () => Date.now(),
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
+
+class ResolvedSecrets {
+  byKey;
+  redactor;
+  constructor(resolved) {
+    this.byKey = new Map(resolved.map((item) => [handleKey(item.ref), item]));
+    this.redactor = new Redactor(resolved.map(({ ref, value }) => ({ name: handleKey(ref), value })));
+  }
+  fill(text, encode = (v) => v) {
+    return fillHandles(text, (ref) => encode(this.valueOf(ref)));
+  }
+  valueOf(ref) {
+    const resolved = this.byKey.get(handleKey(ref));
+    if (resolved === undefined) {
+      throw new Error(`Handle ${handleKey(ref)} was not resolved`);
+    }
+    return resolved.value;
+  }
+  redact(text) {
+    return this.redactor.redact(text);
+  }
+  shown(text, cut) {
+    return this.redactor.shown(text, cut);
+  }
+  used() {
+    return [...this.byKey.values()].map(({ ref, title }) => ({
+      credential_id: ref.credentialId,
+      title,
+      field: ref.field
+    }));
+  }
+}
+
+class SecretResolver {
+  access;
+  clock;
+  constructor(access, clock = SYSTEM_CLOCK) {
+    this.access = access;
+    this.clock = clock;
+  }
+  async resolve(texts) {
+    const refs = new Map;
+    for (const ref of texts.flatMap(refsIn))
+      refs.set(handleKey(ref), ref);
+    const ordered = [...refs.values()].sort((a, b) => Number(a.field === TOTP_FIELD) - Number(b.field === TOTP_FIELD));
+    const resolved = [];
+    for (const ref of ordered)
+      resolved.push(await this.resolveOne(ref));
+    return new ResolvedSecrets(resolved);
+  }
+  async resolveOne(ref) {
+    const open5 = await this.access.openForUse(ref.credentialId, ref.field);
+    const value = sealedValue(open5, ref.field);
+    return {
+      ref,
+      title: open5.credential.title,
+      value: ref.field === TOTP_FIELD ? await this.freshCode(value) : value
+    };
+  }
+  async freshCode(seed) {
+    const params = parseTotp(seed);
+    for (;; ) {
+      const current = await totp(params, this.clock.now());
+      if (current.secondsRemaining > MIN_TOTP_SECONDS)
+        return current.code;
+      await this.clock.sleep(current.secondsRemaining * 1000);
+    }
+  }
+}
+
 // src/sealed/content.ts
 function metaOf(content) {
   return {
@@ -9247,71 +9506,6 @@ class CreateService {
   }
 }
 
-// src/sealed/credentialAccess.ts
-function visibleOf(credential2) {
-  return {
-    title: credential2.title,
-    username: credential2.username,
-    url: credential2.url,
-    tags: credential2.tags,
-    notes: credential2.notes,
-    custom: credential2.custom.flatMap(({ key, value }) => value === undefined ? [] : [{ key, value }])
-  };
-}
-function assertDistinctCustomKeys(visible, values) {
-  const keys = [...visible.custom, ...values.custom].map(({ key }) => key);
-  if (keys.some((key) => key.length === 0)) {
-    throw new ClientError("A custom field needs a key");
-  }
-  if (new Set(keys).size !== keys.length) {
-    throw new ClientError("Custom field keys must be unique");
-  }
-}
-
-class CredentialAccess {
-  ctx;
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  context(credentialId) {
-    return { tenant: this.ctx.tenant, credential: credentialId };
-  }
-  async newDek(rootId, credentialId) {
-    const { keys } = await this.ctx.session.open(rootId);
-    const dek = generateDek();
-    return {
-      dek,
-      encDek: serializeEnvelope(await wrapDek(keys, credentialId, dek))
-    };
-  }
-  async rewrapDek(dek, rootId, credentialId) {
-    const { keys } = await this.ctx.session.open(rootId);
-    return serializeEnvelope(await wrapDek(keys, credentialId, dek));
-  }
-  async open(credentialId) {
-    const credential2 = await this.ctx.api.fetchSealedCredential(credentialId);
-    const { keys } = await this.ctx.session.open(credential2.seal_root_id);
-    const dek = await unwrapDek(keys, credentialId, parseEnvelope(credential2.enc_dek));
-    const values = await unsealCredentialFields(dek, this.context(credentialId), credential2.enc_fields);
-    return { credential: credential2, dek, values };
-  }
-  async seal(credentialId, dek, visible, values) {
-    assertDistinctCustomKeys(visible, values);
-    return {
-      visible,
-      encFields: await sealCredentialFields(dek, this.context(credentialId), values),
-      visibleDigest: await visibleFieldsDigest(visible)
-    };
-  }
-  async sign(message, signerRootIds) {
-    const signers = [];
-    for (const rootId of signerRootIds) {
-      signers.push((await this.ctx.session.open(rootId)).keys);
-    }
-    return signMessage(await buildCredentialMessage(message), signers);
-  }
-}
-
 // src/sealed/secretScan.ts
 var PEM_BLOCK = /-----BEGIN [A-Z0-9 ]+-----/;
 var SECRET_WORD = "pass(?:word|wd|phrase|code|wort)?|kennwort|geheim(?:nis)?|pwd|pin|puk|tan|secret|token|api[ _-]?key|access[ _-]?key|private[ _-]?key|client[ _-]?secret|bearer|recovery[ _-]?codes?|backup[ _-]?codes?|seed|cvv|cvc";
@@ -9688,7 +9882,6 @@ class CredentialMigration {
 
 // src/sealed/credentialService.ts
 var NOT_FOUND2 = 404;
-var CUSTOM_PREFIX2 = customFieldName("");
 var VISIBLE_NAMES = [
   "title",
   "username",
@@ -9736,8 +9929,8 @@ class CredentialService {
     this.access = access;
   }
   async reveal(credentialId, field) {
-    const open5 = await this.access.open(credentialId);
-    const value = this.valueOf(open5, field);
+    const open5 = await this.access.openForReveal(credentialId, field);
+    const value = sealedValue(open5, field);
     return {
       id: credentialId,
       version: open5.credential.version,
@@ -9747,8 +9940,8 @@ class CredentialService {
     };
   }
   async totp(credentialId, nowMs = Date.now()) {
-    const open5 = await this.access.open(credentialId);
-    const code = await totp(parseTotp(this.valueOf(open5, "totp")), nowMs);
+    const open5 = await this.access.openForReveal(credentialId, "totp");
+    const code = await totp(parseTotp(sealedValue(open5, "totp")), nowMs);
     return {
       id: credentialId,
       code: code.code,
@@ -9756,13 +9949,13 @@ class CredentialService {
       ...await this.attestation(open5.credential)
     };
   }
-  valueOf(open5, field) {
-    const { values, credential: credential2 } = open5;
-    const value = field.startsWith(CUSTOM_PREFIX2) ? values.custom.find((item) => item.key === field.slice(CUSTOM_PREFIX2.length))?.value : SEALED_CREDENTIAL_FIELDS.includes(field) ? values[field] : undefined;
-    if (value === undefined || value === null) {
-      throw new ClientError(`Credential ${credential2.id} has no sealed field '${field}'. Sealed fields: password, totp, sealed_notes, custom:{key}.`);
-    }
-    return value;
+  async setLlmVisibility(credentialId, llmVisibility, field) {
+    const credential2 = await this.ctx.api.setLlmVisibility(credentialId, llmVisibility, field);
+    return {
+      id: credential2.id,
+      llm_visibility: credential2.llm_visibility,
+      llm_field_visibility: credential2.llm_field_visibility
+    };
   }
   async attestation(credential2) {
     const current = visibleOf(credential2);
@@ -10720,7 +10913,8 @@ function createSealedServices(ctx) {
     attachments: new AttachmentService(ctx, access),
     deposits: new DepositService(ctx, access, tree, documents),
     credentials: new CredentialService(ctx, credentialAccess),
-    migration: new CredentialMigration(ctx, credentialAccess)
+    migration: new CredentialMigration(ctx, credentialAccess),
+    secrets: new SecretResolver(credentialAccess)
   };
 }
 
@@ -12750,7 +12944,7 @@ __export(exports_util, {
   floatSafeRemainder: () => floatSafeRemainder,
   finalizeIssue: () => finalizeIssue,
   extend: () => extend,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   esc: () => esc,
   defineLazy: () => defineLazy,
   createTransparentProxy: () => createTransparentProxy,
@@ -13002,7 +13196,7 @@ var getParsedType = (data) => {
 };
 var propertyKeyTypes = new Set(["string", "number", "symbol"]);
 var primitiveTypes = new Set(["string", "number", "bigint", "boolean", "symbol", "undefined"]);
-function escapeRegex(str) {
+function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -13698,7 +13892,7 @@ function emoji() {
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+  const escapedDelim = escapeRegex2(delimiter ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -14198,7 +14392,7 @@ var $ZodCheckUpperCase = /* @__PURE__ */ $constructor("$ZodCheckUpperCase", (ins
 });
 var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const escapedRegex = escapeRegex(def.includes);
+  const escapedRegex = escapeRegex2(def.includes);
   const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
   def.pattern = pattern;
   inst._zod.onattach.push((inst2) => {
@@ -14222,7 +14416,7 @@ var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst,
 });
 var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+  const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -14245,7 +14439,7 @@ var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (i
 });
 var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+  const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -15784,7 +15978,7 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
   const values = getEnumValues(def.entries);
   const valuesSet = new Set(values);
   inst._zod.values = valuesSet;
-  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex2(o) : o.toString()).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (valuesSet.has(input)) {
@@ -15806,7 +16000,7 @@ var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
   }
   const values = new Set(def.values);
   inst._zod.values = values;
-  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex2(o) : o ? escapeRegex2(o.toString()) : String(o)).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (values.has(input)) {
@@ -16162,7 +16356,7 @@ var $ZodTemplateLiteral = /* @__PURE__ */ $constructor("$ZodTemplateLiteral", (i
       const end = source.endsWith("$") ? source.length - 1 : source.length;
       regexParts.push(source.slice(start, end));
     } else if (part === null || primitiveTypes.has(typeof part)) {
-      regexParts.push(escapeRegex(`${part}`));
+      regexParts.push(escapeRegex2(`${part}`));
     } else {
       throw new Error(`Invalid template literal part: ${part}`);
     }
@@ -35704,6 +35898,271 @@ function keyTools(parts) {
   ];
 }
 
+// src/sinks/processRunner.ts
+import { spawn as spawn3 } from "node:child_process";
+var MAX_CAPTURE_BYTES = 1024 * 1024;
+var KILL_GRACE_MS = 2000;
+
+class Capture {
+  chunks = [];
+  size = 0;
+  cut = false;
+  add(chunk) {
+    const room = MAX_CAPTURE_BYTES - this.size;
+    if (chunk.length > room)
+      this.cut = true;
+    if (room <= 0)
+      return;
+    const kept = chunk.subarray(0, room);
+    this.chunks.push(kept);
+    this.size += kept.length;
+  }
+  text() {
+    return Buffer.concat(this.chunks).toString("utf8");
+  }
+}
+async function runProcess(request) {
+  const [command, ...args] = request.argv;
+  if (command === undefined) {
+    throw new ClientError("argv needs at least the program to run");
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn3(command, args, {
+      cwd: request.cwd,
+      env: { ...process.env, ...request.env },
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: true
+    });
+    const killGroup = (signal) => {
+      if (child.pid === undefined)
+        return;
+      try {
+        process.kill(-child.pid, signal);
+      } catch (error48) {
+        if (error48.code !== "ESRCH")
+          throw error48;
+      }
+    };
+    const stdout = new Capture;
+    const stderr = new Capture;
+    let timedOut = false;
+    let stdinError = null;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killGroup("SIGTERM");
+      setTimeout(() => killGroup("SIGKILL"), KILL_GRACE_MS).unref();
+    }, request.timeoutMs);
+    child.stdout.on("data", (chunk) => stdout.add(chunk));
+    child.stderr.on("data", (chunk) => stderr.add(chunk));
+    child.stdin.on("error", (error48) => {
+      if (error48.code !== "EPIPE")
+        stdinError = error48;
+    });
+    child.once("error", (error48) => {
+      clearTimeout(timer);
+      reject(new ClientError(error48.code === "ENOENT" ? `${command} was not found${request.cwd ? ` (cwd ${request.cwd})` : ""}` : `${command} could not be started: ${error48.code ?? "unknown error"}`));
+    });
+    child.once("close", (exitCode, signal) => {
+      clearTimeout(timer);
+      if (stdinError !== null) {
+        reject(new ClientError(`stdin of ${command} could not be written: ${stdinError.code}`));
+        return;
+      }
+      resolve({
+        exitCode,
+        signal,
+        timedOut,
+        stdout: stdout.text(),
+        stderr: stderr.text(),
+        stdoutCut: stdout.cut,
+        stderrCut: stderr.cut
+      });
+    });
+    child.stdin.end(request.stdin ?? "");
+  });
+}
+
+// src/sinks/adbSink.ts
+var ADB_TIMEOUT_MS = 15000;
+var PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
+var FOCUSED_PACKAGE = /mCurrentFocus=Window\{\S+ \S+ ([^/\s}]+)/;
+function adbInputCommand(value) {
+  if (!PRINTABLE_ASCII.test(value)) {
+    throw new ClientError("adb input text types printable ASCII only; this value has other characters. The user has to enter it.");
+  }
+  if (value.includes("%s")) {
+    throw new ClientError("adb input text reads %s as a space, so this value cannot be typed exactly. The user has to enter it.");
+  }
+  const quoted = value.replaceAll(" ", "%s").replaceAll("'", `'\\''`);
+  return `input text '${quoted}'
+`;
+}
+
+class AdbSink {
+  resolver;
+  adb;
+  constructor(resolver, adb = "adb") {
+    this.resolver = resolver;
+    this.adb = adb;
+  }
+  async input(args) {
+    if (refsIn(args.text).length === 0) {
+      throw new ClientError("text needs a secret handle: {{secret://<credential_id>/<field>}}");
+    }
+    const target = args.serial === undefined ? [] : ["-s", args.serial];
+    const secrets = await this.resolver.resolve([args.text]);
+    const value = secrets.fill(args.text);
+    const command = adbInputCommand(value);
+    await this.requireFocus(target, args.expect_package);
+    await this.shell(target, command, secrets);
+    return {
+      entered_length: value.length,
+      package: args.expect_package,
+      used: secrets.used()
+    };
+  }
+  async requireFocus(target, expected) {
+    const outcome = await runProcess({
+      argv: [this.adb, ...target, "shell", "dumpsys", "window"],
+      timeoutMs: ADB_TIMEOUT_MS
+    });
+    if (outcome.exitCode !== 0) {
+      throw new ClientError(`adb could not read the focused window: ${outcome.stderr.trim()}`);
+    }
+    const focused = FOCUSED_PACKAGE.exec(outcome.stdout)?.[1];
+    if (focused === undefined) {
+      throw new ClientError("No focused app found on the device (is it locked?); nothing was typed.");
+    }
+    if (focused !== expected) {
+      throw new ClientError(`The focused app is ${focused}, not ${expected}; nothing was typed.`);
+    }
+  }
+  async shell(target, command, secrets) {
+    const outcome = await runProcess({
+      argv: [this.adb, ...target, "shell", "-T"],
+      stdin: command,
+      timeoutMs: ADB_TIMEOUT_MS
+    });
+    if (outcome.exitCode !== 0 || outcome.timedOut) {
+      throw new ClientError(`adb input text failed (exit ${outcome.exitCode}${outcome.timedOut ? ", timed out" : ""}): ${secrets.redact(`${outcome.stderr}${outcome.stdout}`).trim()}`);
+    }
+  }
+}
+
+// src/sinks/execSink.ts
+class ExecSink {
+  resolver;
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  async run(args) {
+    if (args.argv.some(hasHandle)) {
+      throw new ClientError("A secret handle cannot go in argv, which other processes can read: pass it in env or stdin.");
+    }
+    const env = args.env ?? {};
+    const secrets = await this.resolver.resolve([
+      ...Object.values(env),
+      args.stdin ?? ""
+    ]);
+    if (secrets.used().length === 0) {
+      throw new ClientError("secret_exec needs a secret handle in env or stdin; run other programs without it.");
+    }
+    const outcome = await runProcess({
+      argv: args.argv,
+      cwd: args.cwd,
+      env: Object.fromEntries(Object.entries(env).map(([name, value]) => [name, secrets.fill(value)])),
+      stdin: args.stdin === undefined ? undefined : secrets.fill(args.stdin),
+      timeoutMs: args.timeout_s * 1000
+    });
+    const stdout = secrets.shown(outcome.stdout, outcome.stdoutCut);
+    const stderr = secrets.shown(outcome.stderr, outcome.stderrCut);
+    return {
+      exit_code: outcome.exitCode,
+      signal: outcome.signal,
+      timed_out: outcome.timedOut,
+      stdout: stdout.text,
+      stderr: stderr.text,
+      output_truncated: stdout.truncated || stderr.truncated,
+      used: secrets.used()
+    };
+  }
+}
+
+// src/sinks/httpSink.ts
+var MAX_READ_BYTES = 1024 * 1024;
+async function cappedText(response) {
+  const reader = response.body?.getReader();
+  if (reader === undefined)
+    return { text: "", cut: false };
+  const chunks = [];
+  let size = 0;
+  while (size < MAX_READ_BYTES) {
+    const { done, value } = await reader.read();
+    if (done) {
+      return { text: Buffer.concat(chunks).toString("utf8"), cut: false };
+    }
+    chunks.push(value);
+    size += value.length;
+  }
+  await reader.cancel();
+  return {
+    text: Buffer.concat(chunks).subarray(0, MAX_READ_BYTES).toString("utf8"),
+    cut: true
+  };
+}
+function causeOf(error48) {
+  if (!(error48 instanceof Error))
+    return String(error48);
+  const cause = error48.cause instanceof Error ? `: ${error48.cause.message}` : "";
+  return `${error48.message}${cause}`;
+}
+
+class HttpSink {
+  resolver;
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  async send(args) {
+    requireHandlesAfterOrigin(args.url);
+    const headers = args.headers ?? {};
+    const secrets = await this.resolver.resolve([
+      args.url,
+      ...Object.keys(headers),
+      ...Object.values(headers),
+      args.body ?? ""
+    ]);
+    const { response, text: text2, cut } = await this.exchange(args, headers, secrets);
+    const body = secrets.shown(text2, cut);
+    return {
+      status: response.status,
+      headers: Object.fromEntries([...response.headers].map(([name, value]) => [
+        name,
+        secrets.redact(value)
+      ])),
+      body: body.text,
+      body_truncated: body.truncated,
+      used: secrets.used()
+    };
+  }
+  async exchange(args, headers, secrets) {
+    try {
+      const response = await fetch(secrets.fill(args.url, encodeURIComponent), {
+        method: args.method,
+        headers: Object.fromEntries(Object.entries(headers).map(([name, value]) => [
+          secrets.fill(name),
+          secrets.fill(value)
+        ])),
+        body: args.body === undefined ? undefined : secrets.fill(args.body),
+        redirect: "manual",
+        signal: AbortSignal.timeout(args.timeout_s * 1000)
+      });
+      return { response, ...await cappedText(response) };
+    } catch (error48) {
+      throw new ClientError(`The request failed: ${secrets.redact(causeOf(error48))}`);
+    }
+  }
+}
+
 // src/tools/attachmentTools.ts
 function attachmentTools(attachments) {
   return [
@@ -35750,12 +36209,17 @@ var sealedFields = {
 };
 function credentialTools(credentials, migration, names) {
   return [
-    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). ${EXPOSURE_NOTE}`, {
+    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, {
       credential_id: credentialId,
       field: exports_external.string().min(1).describe("password, totp, sealed_notes, or custom:{key}.")
     }, (args) => credentials.reveal(args.credential_id, args.field)),
-    defineTool("get_sealed_totp", `Compute the current TOTP code of a sealed credential on this machine, without revealing the seed. ${EXPOSURE_NOTE}`, { credential_id: credentialId }, (args) => credentials.totp(args.credential_id)),
-    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
+    defineTool("get_sealed_totp", `Compute the current TOTP code of a sealed credential on this machine, without revealing the seed. Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, { credential_id: credentialId }, (args) => credentials.totp(args.credential_id)),
+    defineTool("set_sealed_credential_llm_visibility", "Make a sealed credential's secrets, or one sealed field, less visible to LLMs: use_only (never revealed to an LLM) or human_only (never revealed, entered by a person). It only tightens: human_only cannot go back to use_only from here, and only the user makes anything visible, in the SafeKB app. The value is not signed and does not change the credential's version.", {
+      credential_id: credentialId,
+      llm_visibility: exports_external.enum(["use_only", "human_only"]).describe("human_only is the more restrictive."),
+      field: exports_external.string().min(1).describe("One sealed field: password, totp, sealed_notes or custom:{key}. Omit for the whole credential; a field without its own value follows the credential.").optional()
+    }, (args) => credentials.setLlmVisibility(args.credential_id, args.llm_visibility, args.field)),
+    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. Whether an LLM may reveal its secrets follows the default the user chose for the tenant; only the user changes it, in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
       root_id: rootRef("The seal root that will own it."),
       title: exports_external.string().min(1).describe("Visible to the server."),
       folder_id: exports_external.string().min(1).describe("Group it belongs to.").optional(),
@@ -35893,6 +36357,34 @@ function documentTools(creator, documents, search, names) {
   ];
 }
 
+// src/tools/sinkTools.ts
+var HANDLE_NOTE = "Name a secret by its handle {{secret://<credential_id>/<field>}} (field: password, totp, sealed_notes or custom:{key}); it is decrypted on this machine and the value never enters the conversation. A totp handle becomes the current code. Fields whose llm_visibility is human_only are refused.";
+var SCRUB_NOTE = "What comes back is scrubbed of the values (as is, URL-encoded, base64, hex, JSON-escaped) and names the secrets used. Scrubbing guards against careless output, not against a program written to leak: run only code you trust.";
+var timeout = (fallback) => exports_external.number().int().min(1).max(600).default(fallback).describe("Seconds.");
+function sinkTools(exec, http, adb) {
+  return [
+    defineTool("secret_exec", `Run a program with secrets in its environment or on its stdin, without seeing them. ${HANDLE_NOTE} At least one handle is needed; handles are refused in argv, which other processes can read. The program inherits this client's environment. No shell: argv is run as is. ${SCRUB_NOTE}`, {
+      argv: exports_external.array(exports_external.string()).min(1).describe('Program and arguments, e.g. ["uv", "run", "script.py"].'),
+      cwd: absolutePath("Working directory."),
+      env: exports_external.record(exports_external.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), exports_external.string()).describe('Added to the environment; values may hold handles, e.g. {"API_KEY": "{{secret://<id>/password}}"}.').optional(),
+      stdin: exports_external.string().describe("Written to stdin, then closed; may hold handles.").optional(),
+      timeout_s: timeout(60)
+    }, (args) => exec.run(args)),
+    defineTool("secret_http", `Send one HTTP request with secrets in its url, headers or body, without seeing them. ${HANDLE_NOTE} Handles go in the path, query or fragment of the url (URL-encoded for you), never its host. A redirect is returned, not followed. ${SCRUB_NOTE}`, {
+      method: exports_external.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]),
+      url: exports_external.string().url().describe("May hold handles, e.g. in the query."),
+      headers: exports_external.record(exports_external.string(), exports_external.string()).describe('e.g. {"Authorization": "Bearer {{secret://<id>/password}}"}.').optional(),
+      body: exports_external.string().describe("May hold handles.").optional(),
+      timeout_s: timeout(30)
+    }, (args) => http.send(args)),
+    defineTool("secret_adb_input", `Type a secret into the focused field of an Android device with adb (input text), without seeing it. ${HANDLE_NOTE} Only printable ASCII can be typed; anything else is refused, never typed differently. Returns only the length typed.`, {
+      text: exports_external.string().min(1).describe("What to type, holding a handle: {{secret://<id>/password}}."),
+      serial: exports_external.string().min(1).describe("adb -s: which device, when several are connected.").optional(),
+      expect_package: exports_external.string().min(1).describe("Type only if this app has the focus, e.g. com.example.bank.")
+    }, (args) => adb.input(args))
+  ];
+}
+
 // src/tools/treeTools.ts
 var documentId = objectId2("Id of the sealed document or folder.");
 function treeTools(tree, names) {
@@ -35946,6 +36438,8 @@ The keys of this machine, and backups, are handled by tools that never take or r
 A credential with \`sealed: true\` belongs to a seal root. Its title, username, url, tags, notes and visible custom fields are readable by the server: find it with the standard credential tools. Its password, TOTP seed, sealed_notes and sealed custom fields open only here: reveal_sealed_credential, get_sealed_totp, insert_sealed_credential, update_sealed_credential.
 
 - Reveal a secret only when the task needs it, and prefer get_sealed_totp over revealing a TOTP seed.
+- llm_visibility is set per credential, and llm_field_visibility overrides it for single sealed fields. reveal_sealed_credential and get_sealed_totp work only on a field that is visible. Only the user makes anything visible, in the SafeKB app.
+- To use a secret without seeing it (visible or use_only fields): secret_exec (a program gets it in env or stdin), secret_http (one request gets it in url, headers or body) or secret_adb_input (typed on an Android device). Name it by handle, {{secret://<credential_id>/<field>}}; a totp handle becomes the current code. Prefer these over revealing, even for a visible field. A human_only field is never used by a tool: ask the user to enter it.
 - visible_tampered means the visible fields were changed without the key since the last sealed save. Do not trust the url or username of such a credential until the user has reviewed the change.`;
 function createSealedTools(ctx) {
   const services = createSealedServices(ctx);
@@ -35956,7 +36450,8 @@ function createSealedTools(ctx) {
     ...treeTools(services.tree, names),
     ...attachmentTools(services.attachments),
     ...depositTools(services.deposits, names),
-    ...credentialTools(services.credentials, services.migration, names)
+    ...credentialTools(services.credentials, services.migration, names),
+    ...sinkTools(new ExecSink(services.secrets), new HttpSink(services.secrets), new AdbSink(services.secrets))
   ];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.10.1",
+  "version": "0.12.0",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",