@safekb/mcp 0.12.0 → 0.12.1

package/README.md

@@ -381,9 +381,11 @@ custom fields and the key name of every custom field (sealed ones too) stay read
   (never argv), `secret_http` sends one request with it in the url, headers or body (redirects are not
   followed), and `secret_adb_input` types it on an Android device (`adb shell input text`, value on stdin;
   printable ASCII only). The agent names it by handle, `{{secret://<credential_id>/<field>}}`; a `totp`
-  handle becomes the current code. `visible` and `use_only` fields can be used; `human_only` fields never.
-  Output comes back scrubbed of the value (as is, URL-encoded, base64, hex, JSON-escaped) with the
-  credentials and fields used. Scrubbing stops careless leaks, not a program written to leak one.
+  handle becomes the current code. `|form`, `|json` or `|url` encodes the value for where it goes
+  (`{{secret://<id>/password|form}}` in a form body); without one it goes in as is, URL-encoded in a url.
+  `visible` and `use_only` fields can be used; `human_only` fields never.
+  Output comes back scrubbed of the value, in any mix of percent-, form-, JSON- and adb-encoding and as
+  base64 or hex, with the credentials and fields used. Scrubbing stops careless leaks, not a program written to leak one.
 - Visible fields can be edited without the secret. Such an edit is flagged (`visible_tampered`) with the
   changed fields until a signed save accepts it (`accept_visible_changes`).
 

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.12.0",
+  version: "0.12.1",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -9010,17 +9010,26 @@ class CredentialAccess {
 
 // src/sinks/redaction.ts
 var MAX_SHOWN_CHARS2 = 32 * 1024;
-function encodedForms(value) {
+var escapeRegex = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var bothCases = (hex) => hex.toUpperCase() === hex.toLowerCase() ? hex : `(?:${hex.toUpperCase()}|${hex.toLowerCase()})`;
+function characterPattern(char) {
+  const percent = [...Buffer.from(char, "utf8")].map((byte) => `%${bothCases(byte.toString(16).padStart(2, "0"))}`).join("");
+  const unicode = [...char].map((unit) => `\\\\u${bothCases(unit.charCodeAt(0).toString(16).padStart(4, "0"))}`).join("");
+  const forms = [escapeRegex(char), percent, unicode];
+  if (char === " ")
+    forms.push("\\+", "%s");
+  if (char === "'")
+    forms.push(escapeRegex(`'\\''`));
+  if (char === '"' || char === "\\" || char === "/") {
+    forms.push(escapeRegex(`\\${char}`));
+  }
+  return `(?:${forms.join("|")})`;
+}
+function wholeForms(value) {
   const bytes = Buffer.from(value, "utf8");
   const base64 = bytes.toString("base64");
   const hex = bytes.toString("hex");
   return [
-    value,
-    encodeURIComponent(value),
-    new URLSearchParams({ v: value }).toString().slice(2),
-    value.replaceAll(" ", "%s"),
-    value.replaceAll(" ", "%s").replaceAll("'", `'\\''`),
-    JSON.stringify(value).slice(1, -1),
     base64,
     base64.replace(/=+$/, ""),
     bytes.toString("base64url"),
@@ -9028,28 +9037,27 @@ function encodedForms(value) {
     hex.toUpperCase()
   ];
 }
-var escapeRegex = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 
 class Redactor {
-  markers;
   pattern;
+  markers;
   longest;
   constructor(secrets) {
-    this.markers = new Map;
-    for (const { name, value } of secrets) {
-      for (const form of encodedForms(value)) {
-        if (form.length > 0)
-          this.markers.set(form, `«redacted:${name}»`);
-      }
-    }
-    const forms = [...this.markers.keys()].sort((a, b) => b.length - a.length);
-    this.pattern = forms.length === 0 ? null : new RegExp(forms.map(escapeRegex).join("|"), "g");
-    this.longest = forms[0]?.length ?? 0;
+    const kept = secrets.filter(({ value }) => value.length > 0).sort((a, b) => b.value.length - a.value.length);
+    this.markers = kept.map(({ name }) => `«redacted:${name}»`);
+    this.pattern = kept.length === 0 ? null : new RegExp(kept.map(({ value }) => `(${[
+      [...value].map(characterPattern).join(""),
+      ...wholeForms(value).map(escapeRegex)
+    ].join("|")})`).join("|"), "g");
+    this.longest = Math.max(0, ...kept.map(({ value }) => Buffer.byteLength(value, "utf8") * 6));
   }
   redact(text) {
     if (this.pattern === null)
       return text;
-    return text.replace(this.pattern, (form) => this.markers.get(form));
+    return text.replace(this.pattern, (...match) => {
+      const groups = match.slice(1, this.markers.length + 1);
+      return this.markers[groups.findIndex((g) => g !== undefined)];
+    });
   }
   shown(text, cut) {
     const whole = cut ? text.slice(0, Math.max(0, text.length - this.longest)) : text;
@@ -9062,25 +9070,40 @@ class Redactor {
 }
 
 // src/sinks/secretHandles.ts
-var HANDLE = /\{\{secret:\/\/([0-9a-f]{24})\/([^{}]+)\}\}/g;
+var HANDLE = /\{\{secret:\/\/([0-9a-f]{24})\/([^{}|]+)(?:\|([^{}|]*))?\}\}/g;
 var ANY_HANDLE = /secret:\/\//;
+var ENCODINGS = {
+  raw: (value) => value,
+  url: encodeURIComponent,
+  form: (value) => new URLSearchParams({ v: value }).toString().slice(2),
+  json: (value) => JSON.stringify(value).slice(1, -1)
+};
+function encodingOf(name, fallback) {
+  if (name === undefined)
+    return fallback;
+  if (!Object.hasOwn(ENCODINGS, name)) {
+    throw new ClientError(`Unknown handle encoding '|${name}': use |url, |form, |json or |raw`);
+  }
+  return name;
+}
 var handleKey = ({ credentialId, field }) => `${credentialId}/${field}`;
 function refsIn(text) {
   const refs = [];
-  const rest = text.replace(HANDLE, (_, credentialId, field) => {
+  const rest = text.replace(HANDLE, (_, credentialId, field, encoding2) => {
+    encodingOf(encoding2, "raw");
     refs.push({ credentialId, field });
     return "";
   });
   if (ANY_HANDLE.test(rest)) {
-    throw new ClientError("A secret handle must be written {{secret://<24-character credential id>/<field>}}, e.g. {{secret://0123456789abcdef01234567/password}}");
+    throw new ClientError("A secret handle must be written {{secret://<24-character credential id>/<field>}}, optionally with |url, |form or |json, e.g. {{secret://0123456789abcdef01234567/password|form}}");
   }
   return refs;
 }
 function hasHandle(text) {
   return ANY_HANDLE.test(text);
 }
-function fillHandles(text, lookup) {
-  return text.replace(HANDLE, (_, credentialId, field) => lookup({ credentialId, field }));
+function fillHandles(text, lookup, fallback = "raw") {
+  return text.replace(HANDLE, (_, credentialId, field, encoding2) => ENCODINGS[encodingOf(encoding2, fallback)](lookup({ credentialId, field })));
 }
 function requireHandlesAfterOrigin(url) {
   const first = url.search(ANY_HANDLE);
@@ -9106,8 +9129,8 @@ class ResolvedSecrets {
     this.byKey = new Map(resolved.map((item) => [handleKey(item.ref), item]));
     this.redactor = new Redactor(resolved.map(({ ref, value }) => ({ name: handleKey(ref), value })));
   }
-  fill(text, encode = (v) => v) {
-    return fillHandles(text, (ref) => encode(this.valueOf(ref)));
+  fill(text, fallback = "raw") {
+    return fillHandles(text, (ref) => this.valueOf(ref), fallback);
   }
   valueOf(ref) {
     const resolved = this.byKey.get(handleKey(ref));
@@ -36146,7 +36169,7 @@ class HttpSink {
   }
   async exchange(args, headers, secrets) {
     try {
-      const response = await fetch(secrets.fill(args.url, encodeURIComponent), {
+      const response = await fetch(secrets.fill(args.url, "url"), {
         method: args.method,
         headers: Object.fromEntries(Object.entries(headers).map(([name, value]) => [
           secrets.fill(name),
@@ -36358,7 +36381,7 @@ function documentTools(creator, documents, search, names) {
 }
 
 // src/tools/sinkTools.ts
-var HANDLE_NOTE = "Name a secret by its handle {{secret://<credential_id>/<field>}} (field: password, totp, sealed_notes or custom:{key}); it is decrypted on this machine and the value never enters the conversation. A totp handle becomes the current code. Fields whose llm_visibility is human_only are refused.";
+var HANDLE_NOTE = "Name a secret by its handle {{secret://<credential_id>/<field>}} (field: password, totp, sealed_notes or custom:{key}); it is decrypted on this machine and the value never enters the conversation. A totp handle becomes the current code. Add |form, |json or |url to encode the value for where it goes, e.g. {{secret://<id>/password|form}} in a form body; without it the value goes in as is (in a url: URL-encoded). Fields whose llm_visibility is human_only are refused.";
 var SCRUB_NOTE = "What comes back is scrubbed of the values (as is, URL-encoded, base64, hex, JSON-escaped) and names the secrets used. Scrubbing guards against careless output, not against a program written to leak: run only code you trust.";
 var timeout = (fallback) => exports_external.number().int().min(1).max(600).default(fallback).describe("Seconds.");
 function sinkTools(exec, http, adb) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.12.0",
+  "version": "0.12.1",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",