@safekb/mcp 0.11.0 → 0.12.1

package/README.md

@@ -371,11 +371,21 @@ custom fields and the key name of every custom field (sealed ones too) stay read
   space takes its credentials along (a credential's group in the old space is left behind).
 - `reveal_sealed_credential` and `get_sealed_totp` decrypt locally. The hosted `reveal_credential` and
   `get_credential_totp` cannot open a sealed credential.
-- AI access (`llm_visibility`): `visible`, `use_only` or `human_only`. `reveal_sealed_credential` and
-  `get_sealed_totp` work only on `visible` credentials. New and migrated sealed credentials start
-  `use_only`; only you make one `visible`, in the SafeKB app. `set_sealed_credential_llm_visibility`
-  only tightens it. The client enforces this: a client older than 0.11.0 still reveals every sealed
-  credential.
+- AI access: `visible`, `use_only` or `human_only`, per credential (`llm_visibility`) and per sealed
+  field (`llm_field_visibility`, e.g. a card's number and CVC hidden, its expiry date visible).
+  `reveal_sealed_credential` and `get_sealed_totp` work only on a `visible` field. New and migrated
+  sealed credentials start with the tenant default (Settings → Sealed credentials; `use_only` until
+  set). Only you make anything more visible, in the SafeKB app; `set_sealed_credential_llm_visibility`
+  only tightens. The client enforces this: a client older than 0.11.0 reveals every sealed credential, and 0.11.0 ignores field overrides.
+- Using a secret without showing it (0.12.0): `secret_exec` runs a program with it in env or stdin
+  (never argv), `secret_http` sends one request with it in the url, headers or body (redirects are not
+  followed), and `secret_adb_input` types it on an Android device (`adb shell input text`, value on stdin;
+  printable ASCII only). The agent names it by handle, `{{secret://<credential_id>/<field>}}`; a `totp`
+  handle becomes the current code. `|form`, `|json` or `|url` encodes the value for where it goes
+  (`{{secret://<id>/password|form}}` in a form body); without one it goes in as is, URL-encoded in a url.
+  `visible` and `use_only` fields can be used; `human_only` fields never.
+  Output comes back scrubbed of the value, in any mix of percent-, form-, JSON- and adb-encoding and as
+  base64 or hex, with the credentials and fields used. Scrubbing stops careless leaks, not a program written to leak one.
 - Visible fields can be edited without the secret. Such an edit is flagged (`visible_tampered`) with the
   changed fields until a signed save accepts it (`accept_visible_changes`).
 

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.11.0",
+  version: "0.12.1",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -3276,9 +3276,10 @@ class SealedApi {
   fetchSealedCredential(id) {
     return this.http.getJson(`/credentials/${id}/sealed`);
   }
-  setLlmVisibility(id, llmVisibility) {
+  setLlmVisibility(id, llmVisibility, field) {
     return this.http.putJson(`/credentials/${id}/sealed/llm-visibility`, {
-      llm_visibility: llmVisibility
+      llm_visibility: llmVisibility,
+      ...field === undefined ? {} : { field }
     });
   }
   lastAttestedVisibleFields(id) {
@@ -8914,6 +8915,282 @@ class LocalKeys {
   }
 }
 
+// src/sealed/credentialAccess.ts
+var REVEALABLE = new Set(["visible"]);
+var USABLE = new Set(["visible", "use_only"]);
+var CUSTOM_PREFIX2 = customFieldName("");
+function visibleOf(credential2) {
+  return {
+    title: credential2.title,
+    username: credential2.username,
+    url: credential2.url,
+    tags: credential2.tags,
+    notes: credential2.notes,
+    custom: credential2.custom.flatMap(({ key, value }) => value === undefined ? [] : [{ key, value }])
+  };
+}
+function sealedValue(open5, field) {
+  const { values, credential: credential2 } = open5;
+  const value = field.startsWith(CUSTOM_PREFIX2) ? values.custom.find((item) => item.key === field.slice(CUSTOM_PREFIX2.length))?.value : SEALED_CREDENTIAL_FIELDS.includes(field) ? values[field] : undefined;
+  if (value === undefined || value === null) {
+    throw new ClientError(`Credential ${credential2.id} has no sealed field '${field}'. Sealed fields: password, totp, sealed_notes, custom:{key}.`);
+  }
+  return value;
+}
+function assertDistinctCustomKeys(visible, values) {
+  const keys = [...visible.custom, ...values.custom].map(({ key }) => key);
+  if (keys.some((key) => key.length === 0)) {
+    throw new ClientError("A custom field needs a key");
+  }
+  if (new Set(keys).size !== keys.length) {
+    throw new ClientError("Custom field keys must be unique");
+  }
+}
+
+class CredentialAccess {
+  ctx;
+  constructor(ctx) {
+    this.ctx = ctx;
+  }
+  context(credentialId) {
+    return { tenant: this.ctx.tenant, credential: credentialId };
+  }
+  async newDek(rootId, credentialId) {
+    const { keys } = await this.ctx.session.open(rootId);
+    const dek = generateDek();
+    return {
+      dek,
+      encDek: serializeEnvelope(await wrapDek(keys, credentialId, dek))
+    };
+  }
+  async rewrapDek(dek, rootId, credentialId) {
+    const { keys } = await this.ctx.session.open(rootId);
+    return serializeEnvelope(await wrapDek(keys, credentialId, dek));
+  }
+  async open(credentialId) {
+    return this.decrypt(await this.ctx.api.fetchSealedCredential(credentialId));
+  }
+  async openForReveal(credentialId, field) {
+    return this.openAllowing(credentialId, field, REVEALABLE, (visibility) => visibility === "use_only" ? "it is never shown to an LLM. Use it without seeing it: secret_exec, secret_http or secret_adb_input with the handle secret://<credential_id>/<field>." : "it is never shown to an LLM and never handed to a tool: ask the user to enter it.");
+  }
+  async openForUse(credentialId, field) {
+    return this.openAllowing(credentialId, field, USABLE, () => "no tool may use it: ask the user to enter it.");
+  }
+  async openAllowing(credentialId, field, allowed, refusal) {
+    const credential2 = await this.ctx.api.fetchSealedCredential(credentialId);
+    const visibility = Object.hasOwn(credential2.llm_field_visibility, field) ? credential2.llm_field_visibility[field] : credential2.llm_visibility;
+    if (!allowed.has(visibility)) {
+      throw new ClientError(`Field '${field}' of credential ${credentialId} (${credential2.title}) is ${visibility}: ${refusal(visibility)} Only the user can change this, in the SafeKB app.`);
+    }
+    return this.decrypt(credential2);
+  }
+  async decrypt(credential2) {
+    const credentialId = credential2.id;
+    const { keys } = await this.ctx.session.open(credential2.seal_root_id);
+    const dek = await unwrapDek(keys, credentialId, parseEnvelope(credential2.enc_dek));
+    const values = await unsealCredentialFields(dek, this.context(credentialId), credential2.enc_fields);
+    return { credential: credential2, dek, values };
+  }
+  async seal(credentialId, dek, visible, values) {
+    assertDistinctCustomKeys(visible, values);
+    return {
+      visible,
+      encFields: await sealCredentialFields(dek, this.context(credentialId), values),
+      visibleDigest: await visibleFieldsDigest(visible)
+    };
+  }
+  async sign(message, signerRootIds) {
+    const signers = [];
+    for (const rootId of signerRootIds) {
+      signers.push((await this.ctx.session.open(rootId)).keys);
+    }
+    return signMessage(await buildCredentialMessage(message), signers);
+  }
+}
+
+// src/sinks/redaction.ts
+var MAX_SHOWN_CHARS2 = 32 * 1024;
+var escapeRegex = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var bothCases = (hex) => hex.toUpperCase() === hex.toLowerCase() ? hex : `(?:${hex.toUpperCase()}|${hex.toLowerCase()})`;
+function characterPattern(char) {
+  const percent = [...Buffer.from(char, "utf8")].map((byte) => `%${bothCases(byte.toString(16).padStart(2, "0"))}`).join("");
+  const unicode = [...char].map((unit) => `\\\\u${bothCases(unit.charCodeAt(0).toString(16).padStart(4, "0"))}`).join("");
+  const forms = [escapeRegex(char), percent, unicode];
+  if (char === " ")
+    forms.push("\\+", "%s");
+  if (char === "'")
+    forms.push(escapeRegex(`'\\''`));
+  if (char === '"' || char === "\\" || char === "/") {
+    forms.push(escapeRegex(`\\${char}`));
+  }
+  return `(?:${forms.join("|")})`;
+}
+function wholeForms(value) {
+  const bytes = Buffer.from(value, "utf8");
+  const base64 = bytes.toString("base64");
+  const hex = bytes.toString("hex");
+  return [
+    base64,
+    base64.replace(/=+$/, ""),
+    bytes.toString("base64url"),
+    hex,
+    hex.toUpperCase()
+  ];
+}
+
+class Redactor {
+  pattern;
+  markers;
+  longest;
+  constructor(secrets) {
+    const kept = secrets.filter(({ value }) => value.length > 0).sort((a, b) => b.value.length - a.value.length);
+    this.markers = kept.map(({ name }) => `«redacted:${name}»`);
+    this.pattern = kept.length === 0 ? null : new RegExp(kept.map(({ value }) => `(${[
+      [...value].map(characterPattern).join(""),
+      ...wholeForms(value).map(escapeRegex)
+    ].join("|")})`).join("|"), "g");
+    this.longest = Math.max(0, ...kept.map(({ value }) => Buffer.byteLength(value, "utf8") * 6));
+  }
+  redact(text) {
+    if (this.pattern === null)
+      return text;
+    return text.replace(this.pattern, (...match) => {
+      const groups = match.slice(1, this.markers.length + 1);
+      return this.markers[groups.findIndex((g) => g !== undefined)];
+    });
+  }
+  shown(text, cut) {
+    const whole = cut ? text.slice(0, Math.max(0, text.length - this.longest)) : text;
+    const scrubbed = this.redact(whole);
+    return {
+      text: scrubbed.slice(0, MAX_SHOWN_CHARS2),
+      truncated: cut || scrubbed.length > MAX_SHOWN_CHARS2
+    };
+  }
+}
+
+// src/sinks/secretHandles.ts
+var HANDLE = /\{\{secret:\/\/([0-9a-f]{24})\/([^{}|]+)(?:\|([^{}|]*))?\}\}/g;
+var ANY_HANDLE = /secret:\/\//;
+var ENCODINGS = {
+  raw: (value) => value,
+  url: encodeURIComponent,
+  form: (value) => new URLSearchParams({ v: value }).toString().slice(2),
+  json: (value) => JSON.stringify(value).slice(1, -1)
+};
+function encodingOf(name, fallback) {
+  if (name === undefined)
+    return fallback;
+  if (!Object.hasOwn(ENCODINGS, name)) {
+    throw new ClientError(`Unknown handle encoding '|${name}': use |url, |form, |json or |raw`);
+  }
+  return name;
+}
+var handleKey = ({ credentialId, field }) => `${credentialId}/${field}`;
+function refsIn(text) {
+  const refs = [];
+  const rest = text.replace(HANDLE, (_, credentialId, field, encoding2) => {
+    encodingOf(encoding2, "raw");
+    refs.push({ credentialId, field });
+    return "";
+  });
+  if (ANY_HANDLE.test(rest)) {
+    throw new ClientError("A secret handle must be written {{secret://<24-character credential id>/<field>}}, optionally with |url, |form or |json, e.g. {{secret://0123456789abcdef01234567/password|form}}");
+  }
+  return refs;
+}
+function hasHandle(text) {
+  return ANY_HANDLE.test(text);
+}
+function fillHandles(text, lookup, fallback = "raw") {
+  return text.replace(HANDLE, (_, credentialId, field, encoding2) => ENCODINGS[encodingOf(encoding2, fallback)](lookup({ credentialId, field })));
+}
+function requireHandlesAfterOrigin(url) {
+  const first = url.search(ANY_HANDLE);
+  if (first === -1)
+    return;
+  if (!/^https?:\/\/[^/?#{}]+[/?#]/.test(url.slice(0, first))) {
+    throw new ClientError("A secret handle can go in the path, query or fragment of a url, never in its scheme, host or port.");
+  }
+}
+
+// src/sinks/secretResolver.ts
+var TOTP_FIELD = "totp";
+var MIN_TOTP_SECONDS = 5;
+var SYSTEM_CLOCK = {
+  now: () => Date.now(),
+  sleep: (ms) => new Promise((resolve) => setTimeout(resolve, ms))
+};
+
+class ResolvedSecrets {
+  byKey;
+  redactor;
+  constructor(resolved) {
+    this.byKey = new Map(resolved.map((item) => [handleKey(item.ref), item]));
+    this.redactor = new Redactor(resolved.map(({ ref, value }) => ({ name: handleKey(ref), value })));
+  }
+  fill(text, fallback = "raw") {
+    return fillHandles(text, (ref) => this.valueOf(ref), fallback);
+  }
+  valueOf(ref) {
+    const resolved = this.byKey.get(handleKey(ref));
+    if (resolved === undefined) {
+      throw new Error(`Handle ${handleKey(ref)} was not resolved`);
+    }
+    return resolved.value;
+  }
+  redact(text) {
+    return this.redactor.redact(text);
+  }
+  shown(text, cut) {
+    return this.redactor.shown(text, cut);
+  }
+  used() {
+    return [...this.byKey.values()].map(({ ref, title }) => ({
+      credential_id: ref.credentialId,
+      title,
+      field: ref.field
+    }));
+  }
+}
+
+class SecretResolver {
+  access;
+  clock;
+  constructor(access, clock = SYSTEM_CLOCK) {
+    this.access = access;
+    this.clock = clock;
+  }
+  async resolve(texts) {
+    const refs = new Map;
+    for (const ref of texts.flatMap(refsIn))
+      refs.set(handleKey(ref), ref);
+    const ordered = [...refs.values()].sort((a, b) => Number(a.field === TOTP_FIELD) - Number(b.field === TOTP_FIELD));
+    const resolved = [];
+    for (const ref of ordered)
+      resolved.push(await this.resolveOne(ref));
+    return new ResolvedSecrets(resolved);
+  }
+  async resolveOne(ref) {
+    const open5 = await this.access.openForUse(ref.credentialId, ref.field);
+    const value = sealedValue(open5, ref.field);
+    return {
+      ref,
+      title: open5.credential.title,
+      value: ref.field === TOTP_FIELD ? await this.freshCode(value) : value
+    };
+  }
+  async freshCode(seed) {
+    const params = parseTotp(seed);
+    for (;; ) {
+      const current = await totp(params, this.clock.now());
+      if (current.secondsRemaining > MIN_TOTP_SECONDS)
+        return current.code;
+      await this.clock.sleep(current.secondsRemaining * 1000);
+    }
+  }
+}
+
 // src/sealed/content.ts
 function metaOf(content) {
   return {
@@ -9252,81 +9529,6 @@ class CreateService {
   }
 }
 
-// src/sealed/credentialAccess.ts
-function visibleOf(credential2) {
-  return {
-    title: credential2.title,
-    username: credential2.username,
-    url: credential2.url,
-    tags: credential2.tags,
-    notes: credential2.notes,
-    custom: credential2.custom.flatMap(({ key, value }) => value === undefined ? [] : [{ key, value }])
-  };
-}
-function assertDistinctCustomKeys(visible, values) {
-  const keys = [...visible.custom, ...values.custom].map(({ key }) => key);
-  if (keys.some((key) => key.length === 0)) {
-    throw new ClientError("A custom field needs a key");
-  }
-  if (new Set(keys).size !== keys.length) {
-    throw new ClientError("Custom field keys must be unique");
-  }
-}
-
-class CredentialAccess {
-  ctx;
-  constructor(ctx) {
-    this.ctx = ctx;
-  }
-  context(credentialId) {
-    return { tenant: this.ctx.tenant, credential: credentialId };
-  }
-  async newDek(rootId, credentialId) {
-    const { keys } = await this.ctx.session.open(rootId);
-    const dek = generateDek();
-    return {
-      dek,
-      encDek: serializeEnvelope(await wrapDek(keys, credentialId, dek))
-    };
-  }
-  async rewrapDek(dek, rootId, credentialId) {
-    const { keys } = await this.ctx.session.open(rootId);
-    return serializeEnvelope(await wrapDek(keys, credentialId, dek));
-  }
-  async open(credentialId) {
-    return this.decrypt(await this.ctx.api.fetchSealedCredential(credentialId));
-  }
-  async openForReveal(credentialId) {
-    const credential2 = await this.ctx.api.fetchSealedCredential(credentialId);
-    if (credential2.llm_visibility !== "visible") {
-      throw new ClientError(`Credential ${credentialId} (${credential2.title}) is ${credential2.llm_visibility}: its secrets are never shown to an LLM. No tool uses a secret without showing it yet: ask the user to enter it. Only the user can change this, in the SafeKB app.`);
-    }
-    return this.decrypt(credential2);
-  }
-  async decrypt(credential2) {
-    const credentialId = credential2.id;
-    const { keys } = await this.ctx.session.open(credential2.seal_root_id);
-    const dek = await unwrapDek(keys, credentialId, parseEnvelope(credential2.enc_dek));
-    const values = await unsealCredentialFields(dek, this.context(credentialId), credential2.enc_fields);
-    return { credential: credential2, dek, values };
-  }
-  async seal(credentialId, dek, visible, values) {
-    assertDistinctCustomKeys(visible, values);
-    return {
-      visible,
-      encFields: await sealCredentialFields(dek, this.context(credentialId), values),
-      visibleDigest: await visibleFieldsDigest(visible)
-    };
-  }
-  async sign(message, signerRootIds) {
-    const signers = [];
-    for (const rootId of signerRootIds) {
-      signers.push((await this.ctx.session.open(rootId)).keys);
-    }
-    return signMessage(await buildCredentialMessage(message), signers);
-  }
-}
-
 // src/sealed/secretScan.ts
 var PEM_BLOCK = /-----BEGIN [A-Z0-9 ]+-----/;
 var SECRET_WORD = "pass(?:word|wd|phrase|code|wort)?|kennwort|geheim(?:nis)?|pwd|pin|puk|tan|secret|token|api[ _-]?key|access[ _-]?key|private[ _-]?key|client[ _-]?secret|bearer|recovery[ _-]?codes?|backup[ _-]?codes?|seed|cvv|cvc";
@@ -9703,7 +9905,6 @@ class CredentialMigration {
 
 // src/sealed/credentialService.ts
 var NOT_FOUND2 = 404;
-var CUSTOM_PREFIX2 = customFieldName("");
 var VISIBLE_NAMES = [
   "title",
   "username",
@@ -9751,8 +9952,8 @@ class CredentialService {
     this.access = access;
   }
   async reveal(credentialId, field) {
-    const open5 = await this.access.openForReveal(credentialId);
-    const value = this.valueOf(open5, field);
+    const open5 = await this.access.openForReveal(credentialId, field);
+    const value = sealedValue(open5, field);
     return {
       id: credentialId,
       version: open5.credential.version,
@@ -9762,8 +9963,8 @@ class CredentialService {
     };
   }
   async totp(credentialId, nowMs = Date.now()) {
-    const open5 = await this.access.openForReveal(credentialId);
-    const code = await totp(parseTotp(this.valueOf(open5, "totp")), nowMs);
+    const open5 = await this.access.openForReveal(credentialId, "totp");
+    const code = await totp(parseTotp(sealedValue(open5, "totp")), nowMs);
     return {
       id: credentialId,
       code: code.code,
@@ -9771,17 +9972,13 @@ class CredentialService {
       ...await this.attestation(open5.credential)
     };
   }
-  async setLlmVisibility(credentialId, llmVisibility) {
-    const credential2 = await this.ctx.api.setLlmVisibility(credentialId, llmVisibility);
-    return { id: credential2.id, llm_visibility: credential2.llm_visibility };
-  }
-  valueOf(open5, field) {
-    const { values, credential: credential2 } = open5;
-    const value = field.startsWith(CUSTOM_PREFIX2) ? values.custom.find((item) => item.key === field.slice(CUSTOM_PREFIX2.length))?.value : SEALED_CREDENTIAL_FIELDS.includes(field) ? values[field] : undefined;
-    if (value === undefined || value === null) {
-      throw new ClientError(`Credential ${credential2.id} has no sealed field '${field}'. Sealed fields: password, totp, sealed_notes, custom:{key}.`);
-    }
-    return value;
+  async setLlmVisibility(credentialId, llmVisibility, field) {
+    const credential2 = await this.ctx.api.setLlmVisibility(credentialId, llmVisibility, field);
+    return {
+      id: credential2.id,
+      llm_visibility: credential2.llm_visibility,
+      llm_field_visibility: credential2.llm_field_visibility
+    };
   }
   async attestation(credential2) {
     const current = visibleOf(credential2);
@@ -10739,7 +10936,8 @@ function createSealedServices(ctx) {
     attachments: new AttachmentService(ctx, access),
     deposits: new DepositService(ctx, access, tree, documents),
     credentials: new CredentialService(ctx, credentialAccess),
-    migration: new CredentialMigration(ctx, credentialAccess)
+    migration: new CredentialMigration(ctx, credentialAccess),
+    secrets: new SecretResolver(credentialAccess)
   };
 }
 
@@ -12769,7 +12967,7 @@ __export(exports_util, {
   floatSafeRemainder: () => floatSafeRemainder,
   finalizeIssue: () => finalizeIssue,
   extend: () => extend,
-  escapeRegex: () => escapeRegex,
+  escapeRegex: () => escapeRegex2,
   esc: () => esc,
   defineLazy: () => defineLazy,
   createTransparentProxy: () => createTransparentProxy,
@@ -13021,7 +13219,7 @@ var getParsedType = (data) => {
 };
 var propertyKeyTypes = new Set(["string", "number", "symbol"]);
 var primitiveTypes = new Set(["string", "number", "bigint", "boolean", "symbol", "undefined"]);
-function escapeRegex(str) {
+function escapeRegex2(str) {
   return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 function clone(inst, def, params) {
@@ -13717,7 +13915,7 @@ function emoji() {
 var ipv4 = /^(?:(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(?:25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])$/;
 var ipv6 = /^(([0-9a-fA-F]{1,4}:){7}[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,7}:|([0-9a-fA-F]{1,4}:){1,6}:[0-9a-fA-F]{1,4}|([0-9a-fA-F]{1,4}:){1,5}(:[0-9a-fA-F]{1,4}){1,2}|([0-9a-fA-F]{1,4}:){1,4}(:[0-9a-fA-F]{1,4}){1,3}|([0-9a-fA-F]{1,4}:){1,3}(:[0-9a-fA-F]{1,4}){1,4}|([0-9a-fA-F]{1,4}:){1,2}(:[0-9a-fA-F]{1,4}){1,5}|[0-9a-fA-F]{1,4}:((:[0-9a-fA-F]{1,4}){1,6})|:((:[0-9a-fA-F]{1,4}){1,7}|:))$/;
 var mac = (delimiter) => {
-  const escapedDelim = escapeRegex(delimiter ?? ":");
+  const escapedDelim = escapeRegex2(delimiter ?? ":");
   return new RegExp(`^(?:[0-9A-F]{2}${escapedDelim}){5}[0-9A-F]{2}$|^(?:[0-9a-f]{2}${escapedDelim}){5}[0-9a-f]{2}$`);
 };
 var cidrv4 = /^((25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\.){3}(25[0-5]|2[0-4][0-9]|1[0-9][0-9]|[1-9][0-9]|[0-9])\/([0-9]|[1-2][0-9]|3[0-2])$/;
@@ -14217,7 +14415,7 @@ var $ZodCheckUpperCase = /* @__PURE__ */ $constructor("$ZodCheckUpperCase", (ins
 });
 var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const escapedRegex = escapeRegex(def.includes);
+  const escapedRegex = escapeRegex2(def.includes);
   const pattern = new RegExp(typeof def.position === "number" ? `^.{${def.position}}${escapedRegex}` : escapedRegex);
   def.pattern = pattern;
   inst._zod.onattach.push((inst2) => {
@@ -14241,7 +14439,7 @@ var $ZodCheckIncludes = /* @__PURE__ */ $constructor("$ZodCheckIncludes", (inst,
 });
 var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`^${escapeRegex(def.prefix)}.*`);
+  const pattern = new RegExp(`^${escapeRegex2(def.prefix)}.*`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -14264,7 +14462,7 @@ var $ZodCheckStartsWith = /* @__PURE__ */ $constructor("$ZodCheckStartsWith", (i
 });
 var $ZodCheckEndsWith = /* @__PURE__ */ $constructor("$ZodCheckEndsWith", (inst, def) => {
   $ZodCheck.init(inst, def);
-  const pattern = new RegExp(`.*${escapeRegex(def.suffix)}$`);
+  const pattern = new RegExp(`.*${escapeRegex2(def.suffix)}$`);
   def.pattern ?? (def.pattern = pattern);
   inst._zod.onattach.push((inst2) => {
     const bag = inst2._zod.bag;
@@ -15803,7 +16001,7 @@ var $ZodEnum = /* @__PURE__ */ $constructor("$ZodEnum", (inst, def) => {
   const values = getEnumValues(def.entries);
   const valuesSet = new Set(values);
   inst._zod.values = valuesSet;
-  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex(o) : o.toString()).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${values.filter((k) => propertyKeyTypes.has(typeof k)).map((o) => typeof o === "string" ? escapeRegex2(o) : o.toString()).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (valuesSet.has(input)) {
@@ -15825,7 +16023,7 @@ var $ZodLiteral = /* @__PURE__ */ $constructor("$ZodLiteral", (inst, def) => {
   }
   const values = new Set(def.values);
   inst._zod.values = values;
-  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex(o) : o ? escapeRegex(o.toString()) : String(o)).join("|")})$`);
+  inst._zod.pattern = new RegExp(`^(${def.values.map((o) => typeof o === "string" ? escapeRegex2(o) : o ? escapeRegex2(o.toString()) : String(o)).join("|")})$`);
   inst._zod.parse = (payload, _ctx) => {
     const input = payload.value;
     if (values.has(input)) {
@@ -16181,7 +16379,7 @@ var $ZodTemplateLiteral = /* @__PURE__ */ $constructor("$ZodTemplateLiteral", (i
       const end = source.endsWith("$") ? source.length - 1 : source.length;
       regexParts.push(source.slice(start, end));
     } else if (part === null || primitiveTypes.has(typeof part)) {
-      regexParts.push(escapeRegex(`${part}`));
+      regexParts.push(escapeRegex2(`${part}`));
     } else {
       throw new Error(`Invalid template literal part: ${part}`);
     }
@@ -35723,6 +35921,271 @@ function keyTools(parts) {
   ];
 }
 
+// src/sinks/processRunner.ts
+import { spawn as spawn3 } from "node:child_process";
+var MAX_CAPTURE_BYTES = 1024 * 1024;
+var KILL_GRACE_MS = 2000;
+
+class Capture {
+  chunks = [];
+  size = 0;
+  cut = false;
+  add(chunk) {
+    const room = MAX_CAPTURE_BYTES - this.size;
+    if (chunk.length > room)
+      this.cut = true;
+    if (room <= 0)
+      return;
+    const kept = chunk.subarray(0, room);
+    this.chunks.push(kept);
+    this.size += kept.length;
+  }
+  text() {
+    return Buffer.concat(this.chunks).toString("utf8");
+  }
+}
+async function runProcess(request) {
+  const [command, ...args] = request.argv;
+  if (command === undefined) {
+    throw new ClientError("argv needs at least the program to run");
+  }
+  return new Promise((resolve, reject) => {
+    const child = spawn3(command, args, {
+      cwd: request.cwd,
+      env: { ...process.env, ...request.env },
+      stdio: ["pipe", "pipe", "pipe"],
+      detached: true
+    });
+    const killGroup = (signal) => {
+      if (child.pid === undefined)
+        return;
+      try {
+        process.kill(-child.pid, signal);
+      } catch (error48) {
+        if (error48.code !== "ESRCH")
+          throw error48;
+      }
+    };
+    const stdout = new Capture;
+    const stderr = new Capture;
+    let timedOut = false;
+    let stdinError = null;
+    const timer = setTimeout(() => {
+      timedOut = true;
+      killGroup("SIGTERM");
+      setTimeout(() => killGroup("SIGKILL"), KILL_GRACE_MS).unref();
+    }, request.timeoutMs);
+    child.stdout.on("data", (chunk) => stdout.add(chunk));
+    child.stderr.on("data", (chunk) => stderr.add(chunk));
+    child.stdin.on("error", (error48) => {
+      if (error48.code !== "EPIPE")
+        stdinError = error48;
+    });
+    child.once("error", (error48) => {
+      clearTimeout(timer);
+      reject(new ClientError(error48.code === "ENOENT" ? `${command} was not found${request.cwd ? ` (cwd ${request.cwd})` : ""}` : `${command} could not be started: ${error48.code ?? "unknown error"}`));
+    });
+    child.once("close", (exitCode, signal) => {
+      clearTimeout(timer);
+      if (stdinError !== null) {
+        reject(new ClientError(`stdin of ${command} could not be written: ${stdinError.code}`));
+        return;
+      }
+      resolve({
+        exitCode,
+        signal,
+        timedOut,
+        stdout: stdout.text(),
+        stderr: stderr.text(),
+        stdoutCut: stdout.cut,
+        stderrCut: stderr.cut
+      });
+    });
+    child.stdin.end(request.stdin ?? "");
+  });
+}
+
+// src/sinks/adbSink.ts
+var ADB_TIMEOUT_MS = 15000;
+var PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
+var FOCUSED_PACKAGE = /mCurrentFocus=Window\{\S+ \S+ ([^/\s}]+)/;
+function adbInputCommand(value) {
+  if (!PRINTABLE_ASCII.test(value)) {
+    throw new ClientError("adb input text types printable ASCII only; this value has other characters. The user has to enter it.");
+  }
+  if (value.includes("%s")) {
+    throw new ClientError("adb input text reads %s as a space, so this value cannot be typed exactly. The user has to enter it.");
+  }
+  const quoted = value.replaceAll(" ", "%s").replaceAll("'", `'\\''`);
+  return `input text '${quoted}'
+`;
+}
+
+class AdbSink {
+  resolver;
+  adb;
+  constructor(resolver, adb = "adb") {
+    this.resolver = resolver;
+    this.adb = adb;
+  }
+  async input(args) {
+    if (refsIn(args.text).length === 0) {
+      throw new ClientError("text needs a secret handle: {{secret://<credential_id>/<field>}}");
+    }
+    const target = args.serial === undefined ? [] : ["-s", args.serial];
+    const secrets = await this.resolver.resolve([args.text]);
+    const value = secrets.fill(args.text);
+    const command = adbInputCommand(value);
+    await this.requireFocus(target, args.expect_package);
+    await this.shell(target, command, secrets);
+    return {
+      entered_length: value.length,
+      package: args.expect_package,
+      used: secrets.used()
+    };
+  }
+  async requireFocus(target, expected) {
+    const outcome = await runProcess({
+      argv: [this.adb, ...target, "shell", "dumpsys", "window"],
+      timeoutMs: ADB_TIMEOUT_MS
+    });
+    if (outcome.exitCode !== 0) {
+      throw new ClientError(`adb could not read the focused window: ${outcome.stderr.trim()}`);
+    }
+    const focused = FOCUSED_PACKAGE.exec(outcome.stdout)?.[1];
+    if (focused === undefined) {
+      throw new ClientError("No focused app found on the device (is it locked?); nothing was typed.");
+    }
+    if (focused !== expected) {
+      throw new ClientError(`The focused app is ${focused}, not ${expected}; nothing was typed.`);
+    }
+  }
+  async shell(target, command, secrets) {
+    const outcome = await runProcess({
+      argv: [this.adb, ...target, "shell", "-T"],
+      stdin: command,
+      timeoutMs: ADB_TIMEOUT_MS
+    });
+    if (outcome.exitCode !== 0 || outcome.timedOut) {
+      throw new ClientError(`adb input text failed (exit ${outcome.exitCode}${outcome.timedOut ? ", timed out" : ""}): ${secrets.redact(`${outcome.stderr}${outcome.stdout}`).trim()}`);
+    }
+  }
+}
+
+// src/sinks/execSink.ts
+class ExecSink {
+  resolver;
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  async run(args) {
+    if (args.argv.some(hasHandle)) {
+      throw new ClientError("A secret handle cannot go in argv, which other processes can read: pass it in env or stdin.");
+    }
+    const env = args.env ?? {};
+    const secrets = await this.resolver.resolve([
+      ...Object.values(env),
+      args.stdin ?? ""
+    ]);
+    if (secrets.used().length === 0) {
+      throw new ClientError("secret_exec needs a secret handle in env or stdin; run other programs without it.");
+    }
+    const outcome = await runProcess({
+      argv: args.argv,
+      cwd: args.cwd,
+      env: Object.fromEntries(Object.entries(env).map(([name, value]) => [name, secrets.fill(value)])),
+      stdin: args.stdin === undefined ? undefined : secrets.fill(args.stdin),
+      timeoutMs: args.timeout_s * 1000
+    });
+    const stdout = secrets.shown(outcome.stdout, outcome.stdoutCut);
+    const stderr = secrets.shown(outcome.stderr, outcome.stderrCut);
+    return {
+      exit_code: outcome.exitCode,
+      signal: outcome.signal,
+      timed_out: outcome.timedOut,
+      stdout: stdout.text,
+      stderr: stderr.text,
+      output_truncated: stdout.truncated || stderr.truncated,
+      used: secrets.used()
+    };
+  }
+}
+
+// src/sinks/httpSink.ts
+var MAX_READ_BYTES = 1024 * 1024;
+async function cappedText(response) {
+  const reader = response.body?.getReader();
+  if (reader === undefined)
+    return { text: "", cut: false };
+  const chunks = [];
+  let size = 0;
+  while (size < MAX_READ_BYTES) {
+    const { done, value } = await reader.read();
+    if (done) {
+      return { text: Buffer.concat(chunks).toString("utf8"), cut: false };
+    }
+    chunks.push(value);
+    size += value.length;
+  }
+  await reader.cancel();
+  return {
+    text: Buffer.concat(chunks).subarray(0, MAX_READ_BYTES).toString("utf8"),
+    cut: true
+  };
+}
+function causeOf(error48) {
+  if (!(error48 instanceof Error))
+    return String(error48);
+  const cause = error48.cause instanceof Error ? `: ${error48.cause.message}` : "";
+  return `${error48.message}${cause}`;
+}
+
+class HttpSink {
+  resolver;
+  constructor(resolver) {
+    this.resolver = resolver;
+  }
+  async send(args) {
+    requireHandlesAfterOrigin(args.url);
+    const headers = args.headers ?? {};
+    const secrets = await this.resolver.resolve([
+      args.url,
+      ...Object.keys(headers),
+      ...Object.values(headers),
+      args.body ?? ""
+    ]);
+    const { response, text: text2, cut } = await this.exchange(args, headers, secrets);
+    const body = secrets.shown(text2, cut);
+    return {
+      status: response.status,
+      headers: Object.fromEntries([...response.headers].map(([name, value]) => [
+        name,
+        secrets.redact(value)
+      ])),
+      body: body.text,
+      body_truncated: body.truncated,
+      used: secrets.used()
+    };
+  }
+  async exchange(args, headers, secrets) {
+    try {
+      const response = await fetch(secrets.fill(args.url, "url"), {
+        method: args.method,
+        headers: Object.fromEntries(Object.entries(headers).map(([name, value]) => [
+          secrets.fill(name),
+          secrets.fill(value)
+        ])),
+        body: args.body === undefined ? undefined : secrets.fill(args.body),
+        redirect: "manual",
+        signal: AbortSignal.timeout(args.timeout_s * 1000)
+      });
+      return { response, ...await cappedText(response) };
+    } catch (error48) {
+      throw new ClientError(`The request failed: ${secrets.redact(causeOf(error48))}`);
+    }
+  }
+}
+
 // src/tools/attachmentTools.ts
 function attachmentTools(attachments) {
   return [
@@ -35774,11 +36237,12 @@ function credentialTools(credentials, migration, names) {
       field: exports_external.string().min(1).describe("password, totp, sealed_notes, or custom:{key}.")
     }, (args) => credentials.reveal(args.credential_id, args.field)),
     defineTool("get_sealed_totp", `Compute the current TOTP code of a sealed credential on this machine, without revealing the seed. Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, { credential_id: credentialId }, (args) => credentials.totp(args.credential_id)),
-    defineTool("set_sealed_credential_llm_visibility", "Make a sealed credential's secrets less visible to LLMs: use_only (never revealed to an LLM) or human_only (never revealed, entered by a person). It only tightens: human_only cannot go back to use_only from here, and only the user makes a credential visible, in the SafeKB app. The value is not signed and does not change the credential's version.", {
+    defineTool("set_sealed_credential_llm_visibility", "Make a sealed credential's secrets, or one sealed field, less visible to LLMs: use_only (never revealed to an LLM) or human_only (never revealed, entered by a person). It only tightens: human_only cannot go back to use_only from here, and only the user makes anything visible, in the SafeKB app. The value is not signed and does not change the credential's version.", {
       credential_id: credentialId,
-      llm_visibility: exports_external.enum(["use_only", "human_only"]).describe("human_only is the more restrictive.")
-    }, (args) => credentials.setLlmVisibility(args.credential_id, args.llm_visibility)),
-    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. It starts use_only: its secrets cannot be revealed to an LLM until the user makes it visible in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
+      llm_visibility: exports_external.enum(["use_only", "human_only"]).describe("human_only is the more restrictive."),
+      field: exports_external.string().min(1).describe("One sealed field: password, totp, sealed_notes or custom:{key}. Omit for the whole credential; a field without its own value follows the credential.").optional()
+    }, (args) => credentials.setLlmVisibility(args.credential_id, args.llm_visibility, args.field)),
+    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. Whether an LLM may reveal its secrets follows the default the user chose for the tenant; only the user changes it, in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
       root_id: rootRef("The seal root that will own it."),
       title: exports_external.string().min(1).describe("Visible to the server."),
       folder_id: exports_external.string().min(1).describe("Group it belongs to.").optional(),
@@ -35916,6 +36380,34 @@ function documentTools(creator, documents, search, names) {
   ];
 }
 
+// src/tools/sinkTools.ts
+var HANDLE_NOTE = "Name a secret by its handle {{secret://<credential_id>/<field>}} (field: password, totp, sealed_notes or custom:{key}); it is decrypted on this machine and the value never enters the conversation. A totp handle becomes the current code. Add |form, |json or |url to encode the value for where it goes, e.g. {{secret://<id>/password|form}} in a form body; without it the value goes in as is (in a url: URL-encoded). Fields whose llm_visibility is human_only are refused.";
+var SCRUB_NOTE = "What comes back is scrubbed of the values (as is, URL-encoded, base64, hex, JSON-escaped) and names the secrets used. Scrubbing guards against careless output, not against a program written to leak: run only code you trust.";
+var timeout = (fallback) => exports_external.number().int().min(1).max(600).default(fallback).describe("Seconds.");
+function sinkTools(exec, http, adb) {
+  return [
+    defineTool("secret_exec", `Run a program with secrets in its environment or on its stdin, without seeing them. ${HANDLE_NOTE} At least one handle is needed; handles are refused in argv, which other processes can read. The program inherits this client's environment. No shell: argv is run as is. ${SCRUB_NOTE}`, {
+      argv: exports_external.array(exports_external.string()).min(1).describe('Program and arguments, e.g. ["uv", "run", "script.py"].'),
+      cwd: absolutePath("Working directory."),
+      env: exports_external.record(exports_external.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/), exports_external.string()).describe('Added to the environment; values may hold handles, e.g. {"API_KEY": "{{secret://<id>/password}}"}.').optional(),
+      stdin: exports_external.string().describe("Written to stdin, then closed; may hold handles.").optional(),
+      timeout_s: timeout(60)
+    }, (args) => exec.run(args)),
+    defineTool("secret_http", `Send one HTTP request with secrets in its url, headers or body, without seeing them. ${HANDLE_NOTE} Handles go in the path, query or fragment of the url (URL-encoded for you), never its host. A redirect is returned, not followed. ${SCRUB_NOTE}`, {
+      method: exports_external.enum(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"]),
+      url: exports_external.string().url().describe("May hold handles, e.g. in the query."),
+      headers: exports_external.record(exports_external.string(), exports_external.string()).describe('e.g. {"Authorization": "Bearer {{secret://<id>/password}}"}.').optional(),
+      body: exports_external.string().describe("May hold handles.").optional(),
+      timeout_s: timeout(30)
+    }, (args) => http.send(args)),
+    defineTool("secret_adb_input", `Type a secret into the focused field of an Android device with adb (input text), without seeing it. ${HANDLE_NOTE} Only printable ASCII can be typed; anything else is refused, never typed differently. Returns only the length typed.`, {
+      text: exports_external.string().min(1).describe("What to type, holding a handle: {{secret://<id>/password}}."),
+      serial: exports_external.string().min(1).describe("adb -s: which device, when several are connected.").optional(),
+      expect_package: exports_external.string().min(1).describe("Type only if this app has the focus, e.g. com.example.bank.")
+    }, (args) => adb.input(args))
+  ];
+}
+
 // src/tools/treeTools.ts
 var documentId = objectId2("Id of the sealed document or folder.");
 function treeTools(tree, names) {
@@ -35969,7 +36461,8 @@ The keys of this machine, and backups, are handled by tools that never take or r
 A credential with \`sealed: true\` belongs to a seal root. Its title, username, url, tags, notes and visible custom fields are readable by the server: find it with the standard credential tools. Its password, TOTP seed, sealed_notes and sealed custom fields open only here: reveal_sealed_credential, get_sealed_totp, insert_sealed_credential, update_sealed_credential.
 
 - Reveal a secret only when the task needs it, and prefer get_sealed_totp over revealing a TOTP seed.
-- llm_visibility: reveal_sealed_credential and get_sealed_totp work only on visible credentials; on use_only and human_only ones, ask the user to enter the secret. New sealed credentials start use_only, and only the user makes one visible, in the SafeKB app.
+- llm_visibility is set per credential, and llm_field_visibility overrides it for single sealed fields. reveal_sealed_credential and get_sealed_totp work only on a field that is visible. Only the user makes anything visible, in the SafeKB app.
+- To use a secret without seeing it (visible or use_only fields): secret_exec (a program gets it in env or stdin), secret_http (one request gets it in url, headers or body) or secret_adb_input (typed on an Android device). Name it by handle, {{secret://<credential_id>/<field>}}; a totp handle becomes the current code. Prefer these over revealing, even for a visible field. A human_only field is never used by a tool: ask the user to enter it.
 - visible_tampered means the visible fields were changed without the key since the last sealed save. Do not trust the url or username of such a credential until the user has reviewed the change.`;
 function createSealedTools(ctx) {
   const services = createSealedServices(ctx);
@@ -35980,7 +36473,8 @@ function createSealedTools(ctx) {
     ...treeTools(services.tree, names),
     ...attachmentTools(services.attachments),
     ...depositTools(services.deposits, names),
-    ...credentialTools(services.credentials, services.migration, names)
+    ...credentialTools(services.credentials, services.migration, names),
+    ...sinkTools(new ExecSink(services.secrets), new HttpSink(services.secrets), new AdbSink(services.secrets))
   ];
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.11.0",
+  "version": "0.12.1",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",