@safekb/mcp 0.14.0 → 0.14.2

package/dist/safekb-mcp.js

@@ -2581,7 +2581,7 @@ import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js"
 // package.json
 var package_default = {
   name: "@safekb/mcp",
-  version: "0.14.0",
+  version: "0.14.2",
   description: "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   license: "SEE LICENSE IN LICENSE",
   author: "Mustafa Öztürk",
@@ -34531,12 +34531,16 @@ function defaultSidecarSocket(configPath) {
 // src/sidecar/client.ts
 var SIDECAR_PROMPT_TIMEOUT_MS = 5 * 60 * 1000;
 var SIDECAR_QUICK_TIMEOUT_MS = 3000;
-var PROMPTING_OPS = new Set([
-  "lookup",
-  "new",
-  "passphrase",
-  "confirm"
-]);
+var WAITS_FOR_USER = {
+  holds: false,
+  lookup: true,
+  new: true,
+  discard: false,
+  settle: false,
+  passphrase: true,
+  secret: true,
+  confirm: true
+};
 var NOT_RUNNING_CODES = new Set(["ENOENT", "ECONNREFUSED"]);
 
 class SidecarNotRunningError extends ClientError {
@@ -34576,7 +34580,7 @@ class SidecarClient {
     this.quickTimeoutMs = quickTimeoutMs;
   }
   async request(request) {
-    const text2 = await send(this.socketPath, request, PROMPTING_OPS.has(request.op) ? this.promptTimeoutMs : this.quickTimeoutMs);
+    const text2 = await send(this.socketPath, request, WAITS_FOR_USER[request.op] ? this.promptTimeoutMs : this.quickTimeoutMs);
     let response;
     try {
       response = JSON.parse(text2);
@@ -36165,6 +36169,7 @@ var credentialId = objectId2("Id of the sealed credential.");
 var expectedVersion = exports_external.number().int().min(1).describe("The version you last read for this credential. The write fails if it changed since.");
 var CLEARABLE = "An empty string clears the field.";
 var SECRET_ARGUMENT_NOTE = "Secret values passed here are part of the conversation transcript and reach the model provider; the server never sees them.";
+var TYPED_NOTE = "For a secret you must not see (one the user has not given you, e.g. a card number, PIN or bank password), pass typed_at_sidecar with the field names instead of the value: the user types it at the sidecar while the call waits. Then use it with secret_exec, never by revealing it.";
 var visibleFields = {
   username: exports_external.string().describe(`Visible to the server. ${CLEARABLE}`).optional(),
   url: exports_external.string().describe(`Visible to the server. ${CLEARABLE}`).optional(),
@@ -36185,7 +36190,7 @@ var sealedFields = {
 function credentialTools(credentials, migration, names, entry) {
   const atSidecar = (fields2) => fields2 === undefined ? undefined : { fields: fields2, entry };
   return [
-    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). Refused unless its llm_visibility is visible. ${EXPOSURE_NOTE}`, {
+    defineTool("reveal_sealed_credential", `Decrypt one sealed field of a sealed credential on this machine. The server only sees that the ciphertext was fetched. Find credentials and their visible fields with the standard credential tools (search_credentials, get_credential). Refused unless its llm_visibility is visible. To use a secret (log in, call an API, type it on a device), use secret_exec instead: it never shows the value. ${EXPOSURE_NOTE}`, {
       credential_id: credentialId,
       field: exports_external.string().min(1).describe("password, totp, sealed_notes, or custom:{key}.")
     }, (args) => credentials.reveal(args.credential_id, args.field)),
@@ -36195,7 +36200,7 @@ function credentialTools(credentials, migration, names, entry) {
       llm_visibility: exports_external.enum(["use_only", "human_only"]).describe("human_only is the more restrictive."),
       field: exports_external.string().min(1).describe("One sealed field: password, totp, sealed_notes or custom:{key}. Omit for the whole credential; a field without its own value follows the credential.").optional()
     }, (args) => credentials.setLlmVisibility(args.credential_id, args.llm_visibility, args.field)),
-    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. It is kept in the space of that root. Whether an LLM may reveal its secrets follows the default the user chose for the tenant; only the user changes it, in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
+    defineTool("insert_sealed_credential", `Create a sealed credential in a seal root. ${TYPED_NOTE} It is kept in the space of that root. Whether an LLM may reveal its secrets follows the default the user chose for the tenant (it may be visible): tighten a field the user wants hidden with set_sealed_credential_llm_visibility (use_only); only the user loosens it, in the SafeKB app. password, totp, sealed_notes and the values of sealed custom fields are encrypted on this machine; title, username, url, tags, notes, visible custom fields and the key name of every custom field (sealed ones too) stay readable by the server so search and duplicate detection work. ${SECRET_ARGUMENT_NOTE}`, {
       root_id: rootRef("The seal root that will own it."),
       title: exports_external.string().min(1).describe("Visible to the server."),
       folder_id: exports_external.string().min(1).describe("Group it belongs to.").optional(),
@@ -36206,7 +36211,7 @@ function credentialTools(credentials, migration, names, entry) {
       root_id: await names.resolve(args.root_id),
       typed_at_sidecar: atSidecar(args.typed_at_sidecar)
     })),
-    defineTool("update_sealed_credential", `Change a sealed credential with its seal root's signature. Pass only the fields to change; the save also attests the visible fields as they are now. If visible fields were changed without the key since the last sealed save, the call fails and names them until accept_visible_changes is true. ${SECRET_ARGUMENT_NOTE}`, {
+    defineTool("update_sealed_credential", `Change a sealed credential with its seal root's signature. Pass only the fields to change; the save also attests the visible fields as they are now. If visible fields were changed without the key since the last sealed save, the call fails and names them until accept_visible_changes is true. ${TYPED_NOTE} ${SECRET_ARGUMENT_NOTE}`, {
       credential_id: credentialId,
       expected_version: expectedVersion,
       accept_visible_changes: exports_external.boolean().describe("Attest visible fields that were changed without the key, after reviewing them.").optional(),
@@ -36417,6 +36422,11 @@ The keys of this machine, and backups, are handled by tools that never take or r
 
 ## Sealed credentials
 
+Secrets in short:
+1. Store a secret you must not see: insert_sealed_credential with only the visible fields and typed_at_sidecar: ["password"] (or custom:{key}, totp, sealed_notes). The user types it at the sidecar (safekb-mcp --sidecar, started from a folder outside the knowledge-base repo) while the call waits. Never ask for it in the conversation.
+2. Keep it hidden: set_sealed_credential_llm_visibility(field, "use_only"); the account default may let LLMs reveal it.
+3. Use it: secret_exec with a handle {{secret://<credential_id>/<field>}} in env, stdin or files; your own program does the rest (HTTP, browser, adb, ssh, ...).
+
 A credential with \`sealed: true\` belongs to a seal root. Its title, username, url, tags, notes and visible custom fields are readable by the server: find it with the standard credential tools. Its password, TOTP seed, sealed_notes and sealed custom fields open only here: reveal_sealed_credential, get_sealed_totp, insert_sealed_credential, update_sealed_credential.
 
 - A secret the user has not given you yet (a card number, a PIN, a new password): never ask for it in the conversation. Call insert_sealed_credential or update_sealed_credential with typed_at_sidecar naming the fields; the user types them at the sidecar (safekb-mcp --sidecar) while the call waits. Or they enter it in the SafeKB web app.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@safekb/mcp",
-  "version": "0.14.0",
+  "version": "0.14.2",
   "description": "SafeKB local MCP client: proxies the hosted SafeKB tools and adds zero-knowledge sealed documents.",
   "license": "SEE LICENSE IN LICENSE",
   "author": "Mustafa Öztürk",