@safekb/mcp 0.13.0 → 0.14.0

package/README.md

@@ -377,6 +377,10 @@ custom fields and the key name of every custom field (sealed ones too) stay read
   sealed credentials start with the tenant default (Settings → Sealed credentials; `use_only` until
   set). Only you make anything more visible, in the SafeKB app; `set_sealed_credential_llm_visibility`
   only tightens. The client enforces this: a client older than 0.11.0 reveals every sealed credential, and 0.11.0 ignores field overrides.
+- Entering a secret without the agent seeing it: `insert_sealed_credential` and
+  `update_sealed_credential` take `typed_at_sidecar`, e.g. `["custom:number", "custom:cvc", "password"]`.
+  The call waits while you type each field at the sidecar (`safekb-mcp --sidecar`), hidden and twice;
+  the agent passes only the visible fields. Or enter it in the SafeKB web app.
 - Using a secret without showing it: SafeKB only provides the value. `secret_exec` runs your own
   program with it in env, stdin or a temp file (`files`, mode 0600, deleted afterwards), never argv;
   every integration (HTTP API, browser form, `adb shell input text`, ssh, wallet, `cryptsetup`, …) is

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.13.0",
+  version: "0.14.0",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -9895,6 +9895,47 @@ class CredentialMigration {
   }
 }
 
+// src/sealed/typedFields.ts
+var NAMED = ["password", "totp", "sealed_notes"];
+var CUSTOM_PREFIX3 = customFieldName("");
+var NOTHING_TYPED = { named: {}, custom: [] };
+function checked(fields2, passed) {
+  if (new Set(fields2).size !== fields2.length) {
+    throw new ClientError("typed_at_sidecar names a field twice");
+  }
+  for (const field of fields2) {
+    if (NAMED.includes(field)) {
+      if (passed[field] !== undefined) {
+        throw new ClientError(`${field} is both passed and typed_at_sidecar: pass it one way only`);
+      }
+    } else if (field.startsWith(CUSTOM_PREFIX3) && field.length > CUSTOM_PREFIX3.length) {
+      const key = field.slice(CUSTOM_PREFIX3.length);
+      if (passed.custom?.some((item) => item.key === key)) {
+        throw new ClientError(`custom field '${key}' is both in custom and typed_at_sidecar: pass it one way only`);
+      }
+    } else {
+      throw new ClientError(`typed_at_sidecar: '${field}' is not a sealed field. Use password, totp, sealed_notes or custom:{key}.`);
+    }
+  }
+}
+async function typeAtSidecar(entry, credential2, fields2, passed) {
+  checked(fields2, passed);
+  const typed = { named: {}, custom: [] };
+  for (const field of fields2) {
+    const value = await entry.secret(credential2, field);
+    if (field.startsWith(CUSTOM_PREFIX3)) {
+      typed.custom.push({ key: field.slice(CUSTOM_PREFIX3.length), value });
+    } else {
+      typed.named[field] = value;
+    }
+  }
+  return typed;
+}
+function withTypedCustom(sealed, typed) {
+  const keys = new Set(typed.custom.map(({ key }) => key));
+  return [...sealed.filter(({ key }) => !keys.has(key)), ...typed.custom];
+}
+
 // src/sealed/credentialService.ts
 var NOT_FOUND2 = 404;
 var VISIBLE_NAMES = [
@@ -10006,6 +10047,7 @@ class CredentialService {
     const id = newObjectId();
     const custom = splitCustom(args.custom ?? []);
     const { dek, encDek } = await this.access.newDek(args.root_id, id);
+    const typed = await this.typed(args.title, args);
     const save = await this.access.seal(id, dek, {
       title: args.title,
       username: textOrNull(args.username, null),
@@ -10014,10 +10056,10 @@ class CredentialService {
       notes: textOrNull(args.notes, null),
       custom: custom.visible
     }, {
-      password: textOrNull(args.password, null),
-      totp: this.checkedTotp(textOrNull(args.totp, null)),
-      sealed_notes: textOrNull(args.sealed_notes, null),
-      custom: custom.sealed
+      password: typed.named.password ?? textOrNull(args.password, null),
+      totp: this.checkedTotp(typed.named.totp ?? textOrNull(args.totp, null)),
+      sealed_notes: typed.named.sealed_notes ?? textOrNull(args.sealed_notes, null),
+      custom: withTypedCustom(custom.sealed, typed)
     });
     const sigs = await this.access.sign({
       op: "credential_create",
@@ -10051,6 +10093,7 @@ class CredentialService {
       throw new ClientError(`${attestation.warning} ${describeChanges(attestation.changed_visible_fields, current)} ` + "Show this to the user. Only after they have reviewed it, repeat with accept_visible_changes: true (and pass the right values for any field to correct).");
     }
     const custom = args.custom === undefined ? { visible: current.custom, sealed: values.custom } : splitCustom(args.custom);
+    const typed = await this.typed(args.title ?? current.title, args);
     const save = await this.access.seal(credential2.id, dek, {
       title: args.title ?? current.title,
       username: textOrNull(args.username, current.username),
@@ -10059,10 +10102,10 @@ class CredentialService {
       notes: textOrNull(args.notes, current.notes),
       custom: custom.visible
     }, {
-      password: textOrNull(args.password, values.password),
-      totp: this.checkedTotp(textOrNull(args.totp, values.totp)),
-      sealed_notes: textOrNull(args.sealed_notes, values.sealed_notes),
-      custom: custom.sealed
+      password: typed.named.password ?? textOrNull(args.password, values.password),
+      totp: this.checkedTotp(typed.named.totp ?? textOrNull(args.totp, values.totp)),
+      sealed_notes: typed.named.sealed_notes ?? textOrNull(args.sealed_notes, values.sealed_notes),
+      custom: withTypedCustom(custom.sealed, typed)
     });
     const sigs = await this.access.sign({
       op: "credential_update",
@@ -10120,6 +10163,10 @@ class CredentialService {
     });
     return { id: credentialId, deleted: true };
   }
+  typed(title, args) {
+    const atSidecar = args.typed_at_sidecar;
+    return atSidecar === undefined || atSidecar.fields.length === 0 ? Promise.resolve(NOTHING_TYPED) : typeAtSidecar(atSidecar.entry, title, atSidecar.fields, args);
+  }
   checkedTotp(value) {
     if (value !== null)
       parseTotp(value);
@@ -31313,7 +31360,7 @@ function decodeDirective(html) {
 
 // ../shared/js/canvas-markdown/src/html.ts
 var ENTITY = /&(#x[0-9a-fA-F]+|#[0-9]+|amp|lt|gt|quot|apos);/g;
-var NAMED = {
+var NAMED2 = {
   amp: "&",
   lt: "<",
   gt: ">",
@@ -31329,7 +31376,7 @@ function unescapeHtmlText(text2) {
       return String.fromCodePoint(Number.parseInt(body.slice(2), 16));
     if (body.startsWith("#"))
       return String.fromCodePoint(Number(body.slice(1)));
-    return NAMED[body];
+    return NAMED2[body];
   });
 }
 
@@ -31660,12 +31707,12 @@ class BlockParser {
   }
   item(taskable) {
     this.pos++;
-    const checked = taskable ? this.takeTaskMarker() : null;
+    const checked2 = taskable ? this.takeTaskMarker() : null;
     const children = this.blocks((token) => token.type === "list_item_close");
     this.pos++;
     return {
-      task: checked !== null,
-      checked: checked === true,
+      task: checked2 !== null,
+      checked: checked2 === true,
       children: children.length > 0 ? children : [node("paragraph")]
     };
   }
@@ -34474,7 +34521,7 @@ import { connect } from "node:net";
 
 // src/sidecar/protocol.ts
 import { dirname as dirname4, join as join6 } from "node:path";
-var SIDECAR_PROTOCOL_VERSION = 2;
+var SIDECAR_PROTOCOL_VERSION = 3;
 var SIDECAR_SOCKET_NAME = "sidecar.sock";
 var SIDECAR_SUPPORTED = process.platform !== "win32";
 function defaultSidecarSocket(configPath) {
@@ -34619,6 +34666,10 @@ class SidecarQuestions {
     const { passphrase } = await this.asking("The passphrase", () => this.client.request({ op: "passphrase", of }));
     return passphrase;
   }
+  async secret(credential2, field2) {
+    const { value } = await this.asking(`The value of ${field2}`, () => this.client.request({ op: "secret", credential: credential2, field: field2 }));
+    return value;
+  }
   async ask(notice, question) {
     const { typed: typed2 } = await this.asking("The confirmation", () => this.client.request({ op: "confirm", notice, question }));
     return typed2;
@@ -34648,6 +34699,9 @@ class NoSidecarQuestions {
   ask() {
     return this.refuse();
   }
+  secret() {
+    return Promise.reject(new ClientError("Typing a secret at the sidecar is not available on this platform. Ask the user to enter it in the SafeKB web app (Credentials)."));
+  }
   refuse() {
     return Promise.reject(new ClientError(`This needs the user to type at the sidecar, which is not available on this platform. Ask them to run it at a terminal: ${this.commandLine}`));
   }
@@ -34721,6 +34775,15 @@ The MCP client asks for the passphrase of ${printable2(of)}. It is used for this
       return typed2.length === 0 ? null : typed2;
     });
   }
+  secret({ credential: credential2, field: field2 }, signal) {
+    return this.inTurn(async () => {
+      signal.throwIfAborted();
+      this.reader.write(`
+The MCP client asks for ${printable2(field2)} of credential "${printable2(credential2)}". It is sealed on this machine; the model never sees it.
+`);
+      return this.readTwice(`${printable2(field2)} (not shown; empty to decline): `, signal);
+    });
+  }
   typed(notice, question, signal) {
     return this.inTurn(async () => {
       signal.throwIfAborted();
@@ -34852,9 +34915,12 @@ ${printableLines(notice)}`);
 ` : `Forgotten.
 `);
   }
-  async readNewPassphrase(signal) {
+  readNewPassphrase(signal) {
+    return this.readTwice("New passphrase (not shown; empty to decline): ", signal);
+  }
+  async readTwice(prompt, signal) {
     for (;; ) {
-      const first = await this.reader.read("New passphrase (not shown; empty to decline): ", { hidden: true, signal });
+      const first = await this.reader.read(prompt, { hidden: true, signal });
       if (first.length === 0)
         return null;
       const second = await this.reader.read("Repeat it: ", {
@@ -35118,6 +35184,8 @@ class SidecarServer {
         return {};
       case "passphrase":
         return { passphrase: await this.passphrase(request, clientGone) };
+      case "secret":
+        return { value: await this.secret(request, clientGone) };
       case "confirm":
         return {
           typed: await this.prompter.typed(requireText(request.notice, "notice"), requireText(request.question, "question"), clientGone)
@@ -35144,6 +35212,16 @@ class SidecarServer {
     }
     return typed2;
   }
+  async secret(request, clientGone) {
+    const credential2 = requireText(request.credential, "credential");
+    const field2 = requireText(request.field, "field");
+    const typed2 = await this.prompter.secret({ credential: credential2, field: field2 }, clientGone);
+    clientGone.throwIfAborted();
+    if (typed2 === null) {
+      throw new ClientError(`The sidecar's user entered no ${field2} for credential "${credential2}"`);
+    }
+    return typed2;
+  }
   async create(rootId, label2, clientGone) {
     const chosen = await this.prompter.newSecret(rootId, label2, clientGone);
     clientGone.throwIfAborted();
@@ -36097,13 +36175,15 @@ var sealedFields = {
   password: exports_external.string().describe(`Sealed. ${CLEARABLE}`).optional(),
   totp: exports_external.string().describe(`Sealed TOTP seed (base32) or otpauth://totp URI. ${CLEARABLE}`).optional(),
   sealed_notes: exports_external.string().describe(`Sealed notes. ${CLEARABLE}`).optional(),
+  typed_at_sidecar: exports_external.array(exports_external.string().min(1)).describe(`Sealed fields the user types at the sidecar instead of you passing them: password, totp, sealed_notes or custom:{key} (a new or replaced sealed custom field). The call waits while they type each one, hidden and twice. ${SIDECAR_TYPING} Use this for any secret the user has not already given you, e.g. a card number, CVC or PIN; set the visible fields (title, holder name, last 4 digits) yourself.`).optional(),
   custom: exports_external.array(exports_external.strictObject({
     key: exports_external.string().min(1).describe("Field name. Always stored in clear, also for a sealed field: never put a secret in it."),
     value: exports_external.string(),
     sealed: exports_external.boolean().describe("true: the value is encrypted on this machine (the key name is not). false: visible to the server.")
   })).describe("The complete list of custom fields; it replaces the stored list.").optional()
 };
-function credentialTools(credentials, migration, names) {
+function credentialTools(credentials, migration, names, entry) {
+  const atSidecar = (fields2) => fields2 === undefined ? undefined : { fields: fields2, entry };
   return [
     defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, {
       credential_id: credentialId,
@@ -36123,7 +36203,8 @@ function credentialTools(credentials, migration, names) {
       ...sealedFields
     }, async (args) => credentials.insert({
       ...args,
-      root_id: await names.resolve(args.root_id)
+      root_id: await names.resolve(args.root_id),
+      typed_at_sidecar: atSidecar(args.typed_at_sidecar)
     })),
     defineTool("update_sealed_credential", `Change a sealed credential with its seal root's signature. Pass only the fields to change; the save also attests the visible fields as they are now. If visible fields were changed without the key since the last sealed save, the call fails and names them until accept_visible_changes is true. ${SECRET_ARGUMENT_NOTE}`, {
       credential_id: credentialId,
@@ -36132,7 +36213,10 @@ function credentialTools(credentials, migration, names) {
       title: exports_external.string().min(1).describe("Visible to the server.").optional(),
       ...visibleFields,
       ...sealedFields
-    }, (args) => credentials.update(args)),
+    }, (args) => credentials.update({
+      ...args,
+      typed_at_sidecar: atSidecar(args.typed_at_sidecar)
+    })),
     defineTool("move_sealed_credential", "Move a sealed credential to another seal root of its space. Both roots must be openable here: its key is re-wrapped under the new root and both roots sign. Afterwards only the new root's secret opens it. Whoever held the old root's secret keeps what they already read.", {
       credential_id: credentialId,
       expected_version: expectedVersion,
@@ -36335,11 +36419,12 @@ The keys of this machine, and backups, are handled by tools that never take or r
 
 A credential with \`sealed: true\` belongs to a seal root. Its title, username, url, tags, notes and visible custom fields are readable by the server: find it with the standard credential tools. Its password, TOTP seed, sealed_notes and sealed custom fields open only here: reveal_sealed_credential, get_sealed_totp, insert_sealed_credential, update_sealed_credential.
 
+- A secret the user has not given you yet (a card number, a PIN, a new password): never ask for it in the conversation. Call insert_sealed_credential or update_sealed_credential with typed_at_sidecar naming the fields; the user types them at the sidecar (safekb-mcp --sidecar) while the call waits. Or they enter it in the SafeKB web app.
 - Reveal a secret only when the task needs it, and prefer get_sealed_totp over revealing a TOTP seed.
 - llm_visibility is set per credential, and llm_field_visibility overrides it for single sealed fields. reveal_sealed_credential and get_sealed_totp work only on a field that is visible. Only the user makes anything visible, in the SafeKB app.
 - To use a secret without seeing it (visible or use_only fields): secret_exec runs your own program with it in env, stdin or a temp file; every integration (HTTP, browser, adb, ssh, ...) is that program. Name it by handle, {{secret://<credential_id>/<field>}}; a totp handle becomes the current code. Prefer this over revealing, even for a visible field. A human_only field is never used by a tool: ask the user to enter it.
 - visible_tampered means the visible fields were changed without the key since the last sealed save. Do not trust the url or username of such a credential until the user has reviewed the change.`;
-function createSealedTools(ctx) {
+function createSealedTools(ctx, entry) {
   const services = createSealedServices(ctx);
   const { names } = ctx;
   return [
@@ -36348,7 +36433,7 @@ function createSealedTools(ctx) {
     ...treeTools(services.tree, names),
     ...attachmentTools(services.attachments),
     ...depositTools(services.deposits, names),
-    ...credentialTools(services.credentials, services.migration, names),
+    ...credentialTools(services.credentials, services.migration, names, entry),
     ...sinkTools(new ExecSink(services.secrets))
   ];
 }
@@ -36694,7 +36779,7 @@ async function openTools(options, config3, session, systemKeyring, chosen) {
   };
   const conversions = createConversions(sealed, new KbApi(http), sharedCanvasMarkdown);
   const localTools = [
-    ...createSealedTools(sealed),
+    ...createSealedTools(sealed, userQuestionsOf(options)("")),
     ...unsealTools(conversions.unseal),
     ...options.sealedOnly ? [] : sealTools(conversions.seal),
     ...await adminTools({ options, config: config3, systemKeyring, chosen })

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",