@seekrit/cli 1.2.2 → 1.4.0

package/dist/index.js

@@ -9,6 +9,7 @@ import { createInterface } from "node:readline";
 import { Writable } from "node:stream";
 import { createHash } from "node:crypto";
 import { fileURLToPath } from "node:url";
+import { request } from "node:http";
 /** Default lifetime of a published bundle (7 days), in seconds. */
 const POLICY_DEFAULT_TTL_SECONDS = 10080 * 60;
 /** Bounds on a bundle's lifetime: an hour at the short end, 90 days at the long. */
@@ -5051,7 +5052,7 @@ async function createAgentTaskToken() {
 }
 //#endregion
 //#region package.json
-var version = "1.2.2";
+var version = "1.4.0";
 //#endregion
 //#region ../../packages/api-client/src/index.ts
 var SeekritApiError = class extends Error {
@@ -11510,9 +11511,20 @@ function renderProxyConfig(plan) {
 		out.push("# agent. Requires SEEKRIT_PROXY_CONTROL_TOKEN in the environment, and that");
 		out.push("# token must not be readable by the agents.");
 		out.push("[control]");
-		out.push(`listen = ${tomlString(plan.control.listen)}`);
+		if (plan.control.socket) out.push(`socket = ${tomlString(plan.control.socket)}`);
+		else if (plan.control.listen) out.push(`listen = ${tomlString(plan.control.listen)}`);
 		out.push(`ttl = ${tomlString(plan.control.ttl)}`);
 		out.push(`max_ttl = ${tomlString(plan.control.maxTtl)}`);
+		if (plan.control.socket) {
+			out.push("# Only this program may mint tickets and decide held requests. Without it,");
+			out.push("# any process running as your user and holding the control token can.");
+			out.push("# allow_binary = [\"/usr/local/bin/your-orchestrator\"]");
+			out.push("# allow_sha256 = [\"<sha256 of that binary>\"]");
+		} else {
+			out.push("# A TCP control listener carries no peer credentials, so the token is the");
+			out.push("# only gate — and an agent spawned by the orchestrator inherits it. Use a");
+			out.push("# Unix socket (--control /run/seekrit/control.sock) to attest the caller.");
+		}
 		out.push("");
 	}
 	if (plan.tasks) {
@@ -12165,7 +12177,7 @@ function collect$2(value, acc) {
 * release-please-config.json), so the pin follows the crate without anyone
 * remembering to move it.
 */
-const PROXY_VERSION = "0.10.2";
+const PROXY_VERSION = "0.12.0";
 const BIN = "seekrit-proxy";
 /**
 * Host → Rust target triple.
@@ -12201,7 +12213,7 @@ function versionPrefix(version) {
 	return version.startsWith("v") ? version : `v${version}`;
 }
 function resolveVersion(explicit) {
-	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.2";
+	return explicit ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
 }
 function resolveBaseUrl(explicit) {
 	return (explicit ?? process.env.SEEKRIT_PROXY_BASE_URL ?? "https://proxy.seekrit.dev").replace(/\/+$/, "");
@@ -12328,6 +12340,93 @@ function signalNumber(signal) {
 * — and none of them changes what the proxy does. The generated config is the
 * same config; the fetched binary is the released binary, checksum-verified.
 */
+/**
+* Where `seekrit proxy approvals` looks by default.
+*
+* The control listener is loopback-bound by design, so the only interesting
+* variable is the port — and one URL is easier to override than a host/port pair.
+*/
+const DEFAULT_CONTROL_URL = "http://127.0.0.1:9090";
+/** Header the control listener authenticates with (mirrors `src/tickets.rs`). */
+const CONTROL_TOKEN_HEADER = "x-seekrit-control-token";
+/**
+* Talk to a running proxy's control listener.
+*
+* The token comes from the environment and never from a flag: it is what decides
+* whether a held request goes through, and a flag would put it in shell history
+* next to the operation it is guarding.
+*/
+async function controlRequest(base, path, decision) {
+	const token = process.env.SEEKRIT_PROXY_CONTROL_TOKEN;
+	if (!token) fail("SEEKRIT_PROXY_CONTROL_TOKEN is not set — it is the same token the proxy was started with, and without it the listener will not answer");
+	const headers = {
+		[CONTROL_TOKEN_HEADER]: token,
+		...decision ? { "content-type": "application/json" } : {}
+	};
+	const method = decision ? "POST" : "GET";
+	const body = decision ? JSON.stringify({ decision }) : void 0;
+	let status;
+	let text;
+	try {
+		({status, text} = isSocketPath(base) ? await socketRequest(socketPathOf(base), path, method, headers, body) : await fetchRequest(base, path, method, headers, body));
+	} catch (e) {
+		fail(`could not reach the proxy's control listener at ${base}: ${e.message}\nIs the proxy running, and does its config have a [control] block?`);
+		throw e;
+	}
+	if (status < 200 || status >= 300) fail(`${status} from the control listener: ${text.trim()}`);
+	return JSON.parse(text);
+}
+/** Is this `--control` value a Unix socket rather than a URL? */
+function isSocketPath(value) {
+	return value.startsWith("unix:") || value.startsWith("/") || value.startsWith(".");
+}
+/** The filesystem path inside a `--control` value. */
+function socketPathOf(value) {
+	return value.startsWith("unix:") ? value.slice(5).replace(/^\/\//, "") : value;
+}
+async function fetchRequest(base, path, method, headers, body) {
+	const resp = await fetch(new URL(path, base), {
+		method,
+		headers,
+		...body ? { body } : {}
+	});
+	return {
+		status: resp.status,
+		text: await resp.text()
+	};
+}
+/**
+* The same request over a Unix socket.
+*
+* `fetch` cannot dial one without a custom dispatcher, and `node:http` can with
+* no dependency at all — which matters for a CLI shipped over npm.
+*/
+function socketRequest(socketPath, path, method, headers, body) {
+	return new Promise((resolve, reject) => {
+		const req = request({
+			socketPath,
+			path,
+			method,
+			headers: {
+				...headers,
+				...body ? { "content-length": Buffer.byteLength(body) } : {}
+			}
+		}, (res) => {
+			let text = "";
+			res.setEncoding("utf8");
+			res.on("data", (chunk) => {
+				text += chunk;
+			});
+			res.on("end", () => resolve({
+				status: res.statusCode ?? 0,
+				text
+			}));
+		});
+		req.on("error", reject);
+		if (body) req.write(body);
+		req.end();
+	});
+}
 const DEFAULT_CONFIG = "seekrit-proxy.toml";
 /**
 * The exact grammar `seekrit_cache::parse_duration` accepts: a positive integer,
@@ -12350,7 +12449,8 @@ function planOptions(options) {
 	const listen = options.listen ?? PLAN_DEFAULTS.listen;
 	const forwardListen = options.forwardListen ?? PLAN_DEFAULTS.forwardListen;
 	if (mode === "both" && listen === forwardListen) fail(`--listen and --forward-listen cannot both be ${listen} — the two planes need separate ports`);
-	if (options.control && (options.control === listen || options.control === forwardListen)) fail(`--control cannot share an address with a data plane (${options.control})`);
+	const controlIsSocket = options.control !== void 0 && isSocketPath(options.control);
+	if (options.control && !controlIsSocket && (options.control === listen || options.control === forwardListen)) fail(`--control cannot share an address with a data plane (${options.control})`);
 	const refresh = duration(options.refresh, "--refresh");
 	return {
 		mode,
@@ -12362,7 +12462,7 @@ function planOptions(options) {
 		...options.cache || options.cacheMaxAge ? { cacheMaxAge: duration(options.cacheMaxAge, "--cache-max-age") ?? "24h" } : {},
 		...refresh ? { secretsRefresh: refresh } : {},
 		...options.control ? { control: {
-			listen: options.control,
+			...controlIsSocket ? { socket: options.control } : { listen: options.control },
 			ttl: "1h",
 			maxTtl: "12h"
 		} } : {},
@@ -12486,7 +12586,7 @@ async function buildPlan(options) {
 }
 /** Add the generation flags to a command, so `init` and `run` stay in step. */
 function withGenerateOptions(cmd) {
-	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr>", "add a [control] listener for per-agent session tickets").option("--tasks", "add a [tasks] block so this proxy honours runs dispatched with `seekrit agents dispatch`").option("--tasks-cache-ttl <dur>", "how long an introspected task is reused (implies --tasks)").option("--activity", "add an [activity] block so this proxy reports aggregate decisions for `seekrit agents review`").option("--activity-interval <dur>", "how often counts are flushed (implies --activity)");
+	return cmd.option("--preset <name>", "gateway preset (repeatable; see `seekrit proxy presets`)", (value, acc = []) => [...acc, value]).option("--host <host[=SECRET,…]>", "ad-hoc rule: bare hostname, optionally the secrets it may receive (repeatable)", (value, acc = []) => [...acc, value]).option("--base-url <url>", "upstream base URL for an OpenAI-compatible gateway").option("--secret <NAME>", "override a preset's secret name").option("--prefix <path>", "override a preset's route prefix").option("--agent <slug>", "take the rules from published agent policy (server mode)").option("--agents <slug>", "additional identities this proxy may serve", (v, a = []) => [...a, v]).option("--org <slug>", "organization (for --agent)").option("--mode <reverse|forward|both>", "which data plane(s) to configure", "reverse").option("--listen <addr>", `reverse-proxy address (default: ${PLAN_DEFAULTS.listen})`).option("--forward-listen <addr>", `forward-proxy address (default: ${PLAN_DEFAULTS.forwardListen})`).option("--unmatched <tunnel|deny>", "what to do with an unruled host in forward mode").option("--ca-cert <path>", "interception CA certificate path (forward mode)").option("--ca-key <path>", "interception CA key path (forward mode)").option("--cache", "add a [cache] block so the proxy can start during an outage").option("--cache-max-age <dur>", "how stale a cached resolve may be (implies --cache)").option("--refresh <dur>", "re-resolve/re-fetch interval").option("--control <addr|path>", "add a [control] listener for per-agent session tickets; a path makes it a Unix socket, which is the only transport whose caller can be attested").option("--tasks", "add a [tasks] block so this proxy honours runs dispatched with `seekrit agents dispatch`").option("--tasks-cache-ttl <dur>", "how long an introspected task is reused (implies --tasks)").option("--activity", "add an [activity] block so this proxy reports aggregate decisions for `seekrit agents review`").option("--activity-interval <dur>", "how often counts are flushed (implies --activity)");
 }
 function registerProxyCommands(program) {
 	const proxy = program.command("proxy").description("run and configure the agent egress proxy (`seekrit proxy --help`)");
@@ -12553,10 +12653,10 @@ Next:
 		});
 		console.log(path);
 		const { target } = detectTarget();
-		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.10.2")} (${target})\n`);
+		process.stderr.write(`seekrit-proxy ${versionPrefix(options.proxyVersion ?? "0.12.0")} (${target})\n`);
 	});
 	proxy.command("where").description("show which binary `seekrit proxy run` would use, without fetching it").option("--proxy-version <version>", `version to report (default: ${PROXY_VERSION})`).option("--json", "machine-readable output").action((options) => {
-		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.10.2";
+		const version = options.proxyVersion ?? process.env.SEEKRIT_PROXY_VERSION ?? "0.12.0";
 		const override = process.env.SEEKRIT_PROXY_BIN;
 		const { target, exe } = detectTarget();
 		const path = override ?? proxyBinaryPath(version, target, exe);
@@ -12572,12 +12672,50 @@ Next:
 			process.stderr.write(`${info.version} · ${info.target} · ${info.source}\n`);
 		});
 	});
+	proxy.command("approvals").description("list requests a running proxy is holding for approval").option("--control <url|path>", "control listener URL, or a Unix socket path", DEFAULT_CONTROL_URL).option("--json", "machine-readable output").action(async (options) => {
+		const { pending } = await controlRequest(options.control, "/approvals");
+		emit(options, { pending }, () => {
+			printTable(pending, [
+				col("ID", (p) => p.id),
+				col("OPERATION", (p) => p.operation),
+				col("REQUEST", (p) => `${p.method} ${p.host}${p.path}`),
+				col("CARRIES", (p) => p.secrets.join(", ") || "no credential"),
+				col("EXPIRES", (p) => `${p.expires_in_seconds}s`)
+			], "nothing is waiting");
+		});
+	});
+	for (const [verb, decision, summary] of [
+		[
+			"approve",
+			"approve",
+			"let a held request through"
+		],
+		[
+			"deny",
+			"deny",
+			"refuse a held request"
+		],
+		[
+			"always",
+			"always",
+			"let it through and stop asking about that host and method for this run"
+		]
+	]) proxy.command(`${verb} <id>`).description(summary).option("--control <url|path>", "control listener URL, or a Unix socket path", DEFAULT_CONTROL_URL).option("--json", "machine-readable output").action(async (id, options) => {
+		const result = await controlRequest(options.control, `/approvals/${encodeURIComponent(id)}`, decision);
+		emit(options, {
+			id,
+			decision,
+			...result
+		}, () => {
+			process.stderr.write(`${id}: ${decision}\n`);
+		});
+	});
 	withGenerateOptions(proxy.command("compose").description("print a docker compose sidecar snippet for a generated config")).option("--service <name>", "compose service name for the proxy", COMPOSE_DEFAULTS.service).option("--workload <name>", "compose service name for your workload", COMPOSE_DEFAULTS.workload).option("--image <ref>", "image to pin (default: seekritdev/proxy:<version>)").option("--publish", "also publish the proxy's ports to the host").action(async (options) => {
 		const plan = await buildPlan(options);
 		process.stdout.write(renderComposeSnippet(plan, {
 			service: options.service,
 			workload: options.workload,
-			image: options.image ?? `seekritdev/proxy:0.10.2`,
+			image: options.image ?? `seekritdev/proxy:0.12.0`,
 			publish: Boolean(options.publish)
 		}));
 	});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@seekrit/cli",
-  "version": "1.2.2",
+  "version": "1.4.0",
   "description": "End-to-end encrypted secrets manager CLI — inject decrypted secrets into any command.",
   "type": "module",
   "publishConfig": {