@seekrit/paperclip-plugin 0.1.0

package/README.md

@@ -0,0 +1,85 @@
+# @seekrit/paperclip-plugin
+
+seekrit for [Paperclip](https://docs.paperclip.ing) — end-to-end encrypted
+secrets for the agents you run at work, without a credential ever coming to rest
+in Paperclip.
+
+```bash
+npx paperclipai plugin install @seekrit/paperclip-plugin
+```
+
+## What it adds
+
+| | |
+| --- | --- |
+| **4 agent tools** | `seekrit:list_secrets`, `seekrit:run_command`, `seekrit:store_secret`, `seekrit:proxy_config` |
+| **3 skills** | `seekrit-secrets`, `seekrit-agent-keys`, `seekrit-paperclip`, installed into the company's library |
+| **1 page** | A secrets panel at `/:company/seekrit` — names, versions, last changed. No values. |
+
+## Configure it
+
+One field is required: a **seekrit service token**, picked with Paperclip's
+secret picker in Settings → Plugins → seekrit. Scope it to the environments
+these agents should reach; it is the ceiling on everything the tools can do.
+
+The optional fields set defaults so a tool call needs no arguments: `app`,
+`env`, `group`, plus `allowRunCommand` (turn off execution and leave the
+read-only and write-only tools), `cliPath`, and `timeoutSeconds`.
+
+The [seekrit CLI](https://www.npmjs.com/package/@seekrit/cli) must be on the
+Paperclip host's `PATH` — the plugin shells out to it rather than reimplementing
+the crypto. `npm i -g @seekrit/cli`, or point `cliPath` at it.
+
+## Why a seekrit secret is not a Paperclip `secret_ref`
+
+Paperclip's secret provider list is closed — `local_encrypted`,
+`aws_secrets_manager`, `gcp_secret_manager`, `vault` — so there is no seekrit
+provider to select, and this plugin does not pretend otherwise. It does not copy
+values into Paperclip's store either: that would create a second plaintext copy
+under a different lifecycle, where a rotation in seekrit silently leaves
+Paperclip serving the old value and a revocation revokes nothing.
+
+Instead the tools keep resolution at the moment of use, two ways:
+
+- **`run_command`** injects secrets into one child process and returns its exit
+  code and output. The plugin worker never sees a value; `seekrit run` decrypts
+  inside the child it execs.
+- **`proxy_config`** generates a [`seekrit-proxy`](https://seekrit.dev/docs/guides/agent-proxy)
+  configuration so an untrusted workload sends `{{seekrit:NAME}}` placeholders and
+  the proxy — which holds the credentials — swaps them in on the way out, toward
+  allowlisted hosts only.
+
+Paperclip's database ends up holding exactly one credential: this plugin's own
+service token.
+
+## What it deliberately cannot do
+
+- **Read a secret value.** There is no `get_secret` tool, and a test enforces
+  the absence. Reading a value is the local MCP server's job, next to the key.
+- **Reach the network.** No `http.outbound` capability — the CLI subprocess makes
+  the API calls, in its own process.
+- **Post to an issue.** No `issue.comments.create`. Tools return results to the
+  agent, which writes its own comment in its own voice.
+- **Redact a command's output.** Because the plugin never sees the injected
+  values, it cannot scan for them. A program that prints its own credential has
+  leaked it, and the `run_command` description says so to the agent.
+
+## Development
+
+```bash
+pnpm --filter @seekrit/paperclip-plugin test    # regenerates skills, then runs vitest
+pnpm --filter @seekrit/paperclip-plugin build   # dist/manifest.js, dist/worker.js, dist/ui/
+npx paperclipai plugin install ./apps/paperclip-plugin
+```
+
+`src/skills.generated.ts` is generated from `agent-plugin/skills/**` by
+`gen-skills.mjs` and gitignored — Paperclip installs managed skills from inline
+content, so the manifest has to carry the bytes. `test/skills.test.ts` re-reads
+the originals, so a stale generated file fails rather than shipping.
+
+Tests run the real worker against a **fake `seekrit` binary** that records how it
+was called, which is what pins the properties that matter: a stored value travels
+on stdin and never in argv, and the service token reaches the child as an
+environment variable and appears in no activity row, log line, or error message.
+
+MIT licensed. Docs: <https://seekrit.dev/docs/guides/ai-agents/paperclip>

package/dist/manifest.js

@@ -0,0 +1,2 @@
+import { t as manifest } from "./shared.js";
+export { manifest as default, manifest };

package/dist/shared.js

@@ -0,0 +1,234 @@
+//#region package.json
+var version = "0.1.0";
+//#endregion
+//#region src/skills.generated.ts
+const MANAGED_SKILLS = [
+	{
+		"skillKey": "seekrit-secrets",
+		"displayName": "seekrit secrets",
+		"slug": "seekrit-secrets",
+		"description": "Store and use end-to-end encrypted secrets with seekrit instead of putting values in .env files, shell commands, or source. Use whenever a task involves an API key, token, password, connection string, or .env file — storing a credential a human just handed over, running a command that needs one, wiring up an app's configuration, or when a value is missing and the temptation is to hardcode it or go hunting for it. Also covers setting seekrit up from nothing (signup, org, app, environment) and granting an environment to a service token.",
+		"markdown": "---\nname: seekrit-secrets\ndescription: Store and use end-to-end encrypted secrets with seekrit instead of putting values in .env files, shell commands, or source. Use whenever a task involves an API key, token, password, connection string, or .env file — storing a credential a human just handed over, running a command that needs one, wiring up an app's configuration, or when a value is missing and the temptation is to hardcode it or go hunting for it. Also covers setting seekrit up from nothing (signup, org, app, environment) and granting an environment to a service token.\nlicense: MIT\ncompatibility: Needs network access to seekrit's API. The local server runs through npx (Node 20+); the hosted server needs no install.\n---\n\n# Secrets with seekrit\n\nseekrit is an end-to-end encrypted secrets manager: the server stores only\nciphertext, and values are decrypted in *this* process, next to the credential.\nThat single fact produces one hard rule and one preferred verb.\n\n## The rule\n\n**A secret value must not come to rest anywhere it can be read again.**\n\n- Never write a value into `.env`, a config file, a Dockerfile, a Kubernetes\n  manifest, or source — even temporarily, even in a file you plan to delete.\n- Never put a value in a command line (`export KEY=…`, `curl -H \"Authorization:\n  Bearer sk-…\"`). It lands in shell history, in process listings, and in this\n  transcript.\n- Never print a value to show your work, and never quote one back to the user\n  who pasted it.\n- Never route around a missing value. If a `.env` read is denied or a file is\n  absent, do **not** try `docker compose config`, `git log -p`, a lockfile, a CI\n  log, a cloud console, or another secrets CLI to reconstruct it. Ask, or use the\n  tools below.\n\nIf you have already broken this rule in this session — a value in a file, a\ncommand, or your output — say so plainly and treat that credential as needing\nrotation.\n\n## The preferred verb: run, don't read\n\nAlmost every task that \"needs a secret\" actually needs a *process* that has the\nsecret. Inject it and never see it:\n\n| Where you are | Do this |\n| --- | --- |\n| MCP client | `run_command { command: \"pnpm\", args: [\"dev\"] }` |\n| A shell | `seekrit run -- pnpm dev` |\n| Dockerfile / CI / container | `seekrit-run -- ./server` (static binary) |\n| Kubernetes | the seekrit ESO chart, not a copied Secret |\n\n`run_command` resolves the environment, injects every granted secret as an\nenvironment variable in the child process only, and returns the exit code and\ncaptured output. **It never returns values.** Precedence, highest first: process\nenv → `.env` overlay → app environment → composed groups.\n\nRead a value with `get_secret { name, reveal: true }` only when a human\nexplicitly asked to see it, or when it must be pasted into a system with no\nother way in. Say out loud that you are doing it, and prefer\n`get_secret { name }` (which confirms existence without the value) for checks.\n\n`export_env` writes a resolved `.env`. It exists for runtimes that genuinely\ncannot be wrapped. Treat it as the last resort it is, and never as a\nconvenience.\n\n## Decision table\n\n| Situation | Tool |\n| --- | --- |\n| Run something that needs secrets | `run_command` / `seekrit run` |\n| A human pasted a new credential | `set_secret { name, value }` — then don't echo it |\n| Rotate a value | `set_secret` again; history is kept, `list_secret_versions` shows it |\n| \"What config does this app have?\" | `list_secrets` — names and metadata, never values |\n| \"Is `STRIPE_KEY` set?\" | `list_secrets`, or `get_secret { name }` without `reveal` |\n| Wire a new app or service | `create_app` → `create_env` → `set_secret` |\n| Give a deployment read access | `create_token` then `grant_env` |\n| Share config across apps | groups — see [references/model.md](references/model.md) |\n| Try a risky config change | `create_branch` on the environment, then `run_command { branch }` |\n| Needs a *third-party API key it must not read* | the **seekrit-agent-keys** skill |\n\n## Storing a value you were handed\n\n```\nset_secret { app: \"storefront\", env: \"production\", name: \"STRIPE_SECRET_KEY\", value: \"<the value>\" }\n```\n\nThen confirm by name only: \"stored `STRIPE_SECRET_KEY` in storefront/production.\"\nA value can reference another with `${OTHER_SECRET}`, so build connection\nstrings from parts rather than duplicating a password.\n\nImporting an existing `.env` is one call — `seekrit secrets import .env` — after\nwhich **delete the file** and tell the user you did.\n\n## If you have no credential yet\n\nThe hosted server needs no account to connect. Call `signup` on it:\n\n```\nsignup { orgName: \"Acme Storefront\", orgSlug: \"acme-storefront\" }\n→ { credential: { clientId, clientSecret } }\n```\n\nName the org after the real project or company — a human claims it by that name\nlater, so `test` makes it unmanageable. The `clientSecret` is shown once.\nPersist it so both servers keep working:\n\n```bash\nseekrit login --client-id <id> --client-secret <secret>\n```\n\nThat writes `~/.config/seekrit/config.json`, which the local server reads with\nno environment plumbing. (`SEEKRIT_CLIENT_ID` / `SEEKRIT_CLIENT_SECRET` in the\nenvironment work too, if the client passes its environment through.) Machine\ncredentials auto-mint an admin token, so one credential drives both servers.\n\n## Two servers, one credential\n\nThis plugin installs both. They are split along the encryption boundary, and\nthe split is enforced, not conventional:\n\n- **`seekrit`** (local, stdio) — anything touching a *value*: `set_secret`,\n  `get_secret`, `run_command`, `export_env`, `create_env`, `create_token`,\n  `grant_env`, KMS operations, database leases. Decryption happens here because\n  this is where the key is.\n- **`seekrit-cloud`** (hosted, `mcp.seekrit.dev`) — metadata and management with\n  no install: orgs, apps, environments, groups, composition, members, audit,\n  billing, secret *names*. It cannot decrypt anything and will refuse a service\n  token outright.\n\nStart on the local server; it can finish a secrets task end to end. Use the\nhosted one when you cannot install anything, or for management and audit. If you\nare on the hosted server and hit a wall, `local_tool_for { operation }` names the\nlocal tool to use instead.\n\n## Further reading\n\n- [references/model.md](references/model.md) — orgs, apps, environments, groups,\n  composition, branches, references, and how to model a tenant.\n- [references/cli.md](references/cli.md) — the CLI equivalent of every tool\n  here, for shells, CI, and containers.\n",
+		"files": [{
+			"path": "references/cli.md",
+			"content": "# CLI equivalents\n\nInstall: `npm install -g @seekrit/cli` (or `npx @seekrit/cli`). For containers\nand CI there is `seekrit-run`, a static single binary with the same injection\nbehaviour and no Node dependency.\n\n## Authenticate\n\n```bash\nseekrit login --client-id <id> --client-secret <secret>   # machine credential\nseekrit login --token skt_…                               # existing service token\nseekrit login                                             # browser approval, for a human\nseekrit whoami\n```\n\nCredentials land in `~/.config/seekrit/config.json`. `SEEKRIT_TOKEN`,\n`SEEKRIT_CLIENT_ID` / `SEEKRIT_CLIENT_SECRET`, and `SEEKRIT_API_URL` override it.\n\n## Run something with secrets injected\n\n```bash\nseekrit run -- pnpm dev\nseekrit run --env staging -- ./migrate\nseekrit run --branch pr-1234 -- pnpm test\nseekrit run --with platform=sandbox -- ./server   # override one group's slice\nseekrit run --explain -- true                     # where each variable came from\n```\n\n`--explain` prints resolution provenance to stderr and never prints values. It\nis the right way to debug \"why is this variable wrong\".\n\n## Secrets\n\n```bash\nseekrit secrets list                    # names and metadata only\nseekrit secrets set STRIPE_KEY          # reads the value from stdin\nseekrit secrets set TLS_KEY --file key.pem   # from a file, no shell quoting\nseekrit secrets get NAME                # prints the value — think first\nseekrit secrets import .env             # then delete the file\nseekrit secrets history NAME\nseekrit secrets restore NAME 3\nseekrit secrets rm NAME\n```\n\nOmit the value argument so it arrives on stdin, or use `--file` for a PEM or\nJSON credential. Passing the value inline puts it in shell history.\n\n## Structure\n\n```bash\nseekrit init                              # writes seekrit.json for this project\nseekrit app create / list / show\nseekrit env create / list / groups\nseekrit group create / env create         # shared secret bags and their slices\nseekrit branch create <slug> --from production --ttl 7d\nseekrit token create / list / revoke\nseekrit grant --token skt_… --app storefront --env production\nseekrit audit\n```\n\n## In CI and containers\n\nGive the job a token scoped to one environment, then wrap the command:\n\n```bash\nseekrit-run -- ./deploy.sh\n```\n\nNothing is written to disk, and the child process is the only thing that ever\nholds the values. For GitHub Actions there is a dedicated action; for Kubernetes\nuse the seekrit External Secrets Operator chart rather than copying values into\na `Secret` by hand.\n"
+		}, {
+			"path": "references/model.md",
+			"content": "# The resource model\n\n```\norganization\n└── application            (a codebase / service)\n    └── environment        (production, staging, dev …)\n        └── secret         (name → encrypted value, versioned)\ngroups                     (org-scoped reusable secret bags, also per-environment)\n```\n\nAn application environment resolves to **its own secrets plus the groups it\ncomposes**. Values layer, lowest precedence first:\n\n```\ngroup secrets  <  app-env secrets  <  .env overlay  <  process env\n```\n\nAfter merging, `${OTHER_SECRET}` references inside values are expanded — so a\n`DATABASE_URL` can be assembled from a group's host and the app's password\nwithout duplicating either.\n\n## Groups\n\nUse a group when two or more apps need the same value (a shared database, an\nobservability key, an internal CA). A group has its own environments keyed by\nslug; at resolve time each composed group is matched to the environment whose\nslug equals the app environment's, so composing `platform` into\n`storefront/production` pulls `platform/production`.\n\n- `create_group` / `create_group_env` / `compose_group` / `uncompose_group`\n- `list_env_groups` shows what an environment pulls in; `list_group_envs` shows\n  a group's slices.\n\nPrefer a group over copying a value into five apps. Copies drift and rotate\nbadly.\n\n## Branches\n\nA branch is an ephemeral fork of an environment: it inherits everything and\noverrides only what differs, then deletes itself. Use one for a preview deploy,\na pull request, or a risky config experiment — never a real environment named\n`pr-1234`.\n\n- `create_branch { app, from: \"production\", slug: \"pr-142\" }`, then `run_command { branch }`\n- `delete_branch` when done; `list_branches` to find strays.\n\n## Service tokens and grants\n\nA token is a principal with a keypair, not a password. Creating one does not\ngrant it anything; `grant_env` wraps that environment's data key to the token's\npublic key, which is what lets it decrypt.\n\n- `create_token` (add `admin: true` only for a management credential)\n- `grant_env { token, app, env }` — one grant per environment the token reads\n- `revoke_token` immediately; `list_tokens` to audit\n\nA deployment should hold a token scoped to exactly one environment. An admin\ntoken belongs on a developer machine or a management job, never in a running\nservice.\n\n## Temporary access (leases)\n\nFor a human or agent that needs a database *now* and should not keep it, mint a\nlease instead of handing over a stored credential: `create_pg_lease` /\n`create_mysql_lease` provision a scoped, expiring database user through a\ncustomer-hosted provisioner, and `revoke_pg_lease` / `revoke_mysql_lease` end it\nearly. `list_pg_targets` / `list_mysql_targets` show what can be leased.\n\nPrefer a lease over `get_secret reveal:true` on a database password. It expires\non its own, and the audit trail says who had it and when.\n\n## Modelling a multi-tenant agent\n\nIf one agent serves many customers and each needs its own credentials, pick by\nhow the tenants differ:\n\n| Shape | Model it as | Why |\n| --- | --- | --- |\n| Tenants share the code, differ in credentials | one **environment per tenant** under one app | independent grants, independent audit, independent rotation |\n| Most config is shared, a few keys differ | one group composed by every tenant environment | rotate the shared parts once |\n| Access should expire after a task | a **lease** | nothing to revoke later |\n| Tenant credential must never be readable by the agent | the **seekrit-agent-keys** skill (proxy) | the agent holds a placeholder, not a key |\n\nResolve per run, not per process: fetch for the tenant you are serving now and\nlet it go afterwards. Do not build a process-wide map of every tenant's secrets\n— that turns one compromised request into a full breach.\n"
+		}]
+	},
+	{
+		"skillKey": "seekrit-agent-keys",
+		"displayName": "seekrit agent keys",
+		"slug": "seekrit-agent-keys",
+		"description": "Let an agent, sandbox, or untrusted process call an API without ever being able to read the credential, using seekrit's egress proxy and {{seekrit:NAME}} placeholders behind a default-deny allowlist. Use when running model-generated or untrusted code that needs a third-party key (LLM providers, Stripe, GitHub, internal APIs), when a sandbox or container needs credentials, when a key must be usable for one operation but not others, or when asked to limit what an agent can do with a key rather than only where the key is stored.",
+		"markdown": "---\nname: seekrit-agent-keys\ndescription: Let an agent, sandbox, or untrusted process call an API without ever being able to read the credential, using seekrit's egress proxy and {{seekrit:NAME}} placeholders behind a default-deny allowlist. Use when running model-generated or untrusted code that needs a third-party key (LLM providers, Stripe, GitHub, internal APIs), when a sandbox or container needs credentials, when a key must be usable for one operation but not others, or when asked to limit what an agent can do with a key rather than only where the key is stored.\nlicense: MIT\ncompatibility: Needs Docker (or the seekrit-proxy binary) and network access. The proxy runs beside the workload, not inside seekrit.\n---\n\n# Keys an agent cannot read\n\nInjecting a secret as an environment variable (see the **seekrit-secrets**\nskill) is right when you trust the process. It is the wrong tool when the\nprocess is a sandbox, model-generated code, or an agent whose output you cannot\npredict: anything in the environment can be printed, logged, or POSTed\nsomewhere else.\n\nThe seekrit **egress proxy** removes the key from the workload entirely. The\nworkload sends a placeholder; the proxy — which holds the token — swaps in the\nreal value on the way out, and only toward destinations you allowlisted.\n\n```\nagent ──\"Authorization: Bearer {{seekrit:OPENAI_API_KEY}}\"──▶ proxy ──real key──▶ api.openai.com\n                                                               │\n                                                               └─ anything not allowlisted: refused\n```\n\nA compromised or merely creative agent cannot exfiltrate the key, because it\nnever had it, and cannot redirect it, because the destination is fixed by\nconfig the agent does not control.\n\n## Start it\n\nThe proxy is a single static binary on `scratch`; the container is the fastest\npath. Write a config, then run it beside the workload:\n\n```toml\n# seekrit-proxy.toml\nlisten = \"127.0.0.1:8080\"\n\n[[route]]\nprefix = \"/openai\"\nupstream = \"https://api.openai.com\"\nallow = [\"OPENAI_API_KEY\"]\nmethods = [\"POST\"]\npaths = [\"/v1/chat/completions\", \"/v1/embeddings\"]\n```\n\n```bash\ndocker run --rm -e SEEKRIT_TOKEN=skt_… \\\n  -v \"$PWD/seekrit-proxy.toml:/seekrit-proxy.toml\" \\\n  -p 8080:8080 seekritdev/proxy --listen 0.0.0.0:8080\n```\n\nThen point the workload's client at the proxy and give it a placeholder instead\nof a key:\n\n```ts\nconst openai = new OpenAI({\n  baseURL: \"http://127.0.0.1:8080/openai/v1\",\n  apiKey: \"{{seekrit:OPENAI_API_KEY}}\",\n});\n```\n\nAny OpenAI-compatible endpoint works the same way — LiteLLM, OpenRouter, vLLM,\na self-hosted gateway. So does Anthropic, Stripe, or an internal service; only\nthe `upstream` and header change.\n\n## The allowlist is the security boundary\n\nBoth modes are **default-deny**. A rule grants three things, and each one is\nworth setting deliberately:\n\n- `allow` — which secrets may be substituted toward this upstream. A key\n  allowlisted for `api.openai.com` cannot leak toward `api.attacker.com`.\n- `methods` — which HTTP methods. Omitted means any.\n- `paths` — which paths, matched after the prefix is stripped (`*` within a\n  segment, `**` across them). Omitted means any.\n\n`methods` and `paths` are what turn the proxy from anti-theft into anti-misuse:\nan agent with a legitimate Stripe key still cannot reach `DELETE /v1/customers`\nif you did not grant it.\n\n## Two modes\n\n**Reverse proxy** (`[[route]]`, above) — the workload points its base URL at the\nproxy. No certificates, works with any HTTP client, but every client needs its\nbase URL changed.\n\n**Forward proxy** (`[forward]`) — the workload sets\n`HTTPS_PROXY=http://127.0.0.1:8081` and trusts the proxy's CA. The proxy\nintercepts TLS for ruled hosts, substitutes, and re-originates. Transparent to\ncode you cannot modify, which makes it the right mode for a sandbox running\narbitrary generated code. Hosts with no rule are tunnelled untouched by default;\nset `unmatched_host_policy = \"deny\"` for a hard egress boundary.\n\n## Sandboxes: never bake a key into the image\n\nFor E2B, Modal, Daytona, Vercel Sandbox, Cloudflare Sandbox/Containers, or a\nplain container: **do not** resolve secrets and pass them as sandbox environment\nvariables. Run the proxy outside the sandbox, give the sandbox only the proxy\naddress and placeholders, and set `HTTPS_PROXY` plus the CA in its environment.\nThe sandbox can then use the credential and still holds nothing worth stealing —\nand its egress is bounded by the same allowlist.\n\n## Many agents, one proxy\n\nWhen one proxy fronts several agents that should not have equal reach, the\ntrusted orchestrator mints a **session ticket** (`POST /session` on the\n`[control]` listener, naming an agent identity and optionally a narrower secret\nset) and hands the agent the opaque ticket, which it presents as\n`x-seekrit-ticket`. Scopes can only narrow: the effective set is the ticket's\nintersected with the published policy. The control token must be unreadable by\nthe agents, or any of them could mint a ticket for any identity.\n\n## Policy from the dashboard, not the file\n\n`[policy] source = \"server\"` takes the rules from agent access policy in the\nseekrit dashboard, so adding an upstream is a UI change instead of a redeploy.\nThe bundle is signed in the publishing admin's browser and this proxy refuses\nany bundle not signed by a thumbprint pinned in its own local file — seekrit can\nwithhold policy (the proxy fails closed) but cannot widen it. Keep the `signers`\nlist in the file, pin at least two admins, and commit it.\n\n## When not to use this\n\n- The process is trusted and you control it → inject env vars instead\n  (**seekrit-secrets**). Simpler, no proxy to run.\n- The credential is needed by a library that signs requests locally (AWS SigV4,\n  some database drivers) → substitution happens on the wire, so a locally\n  computed signature over a placeholder will not verify. Use a scoped token or a\n  database lease instead.\n- You want per-request model routing, cost tracking, or fallbacks → that is a\n  model gateway's job. Put the gateway behind the proxy and keep its key in\n  seekrit.\n\n## Further reading\n\n- [references/proxy-config.md](references/proxy-config.md) — annotated config\n  for both modes, refresh intervals, and the fleet ceiling.\n- <https://seekrit.dev/docs/guides/frameworks> — the exact base-URL and API-key\n  argument to change in LangGraph, Mastra, Pydantic AI, the AI SDK, CrewAI,\n  LlamaIndex, and both Agents SDKs.\n",
+		"files": [{
+			"path": "references/proxy-config.md",
+			"content": "# Proxy configuration reference\n\nThe token comes from the environment (`SEEKRIT_TOKEN`) — **never** from this\nfile. The container reads its config from `/seekrit-proxy.toml`; override with\n`--config`. Bind to loopback unless the proxy is reached across a network\nnamespace, in which case `--listen 0.0.0.0:8080` and let the network boundary do\nthe work.\n\n## Reverse proxy — one route per upstream\n\n```toml\nlisten = \"127.0.0.1:8080\"\n\n# Request bodies are buffered to substitute placeholders, so they are capped.\n# max_request_body_bytes = 2097152   # 2 MiB default\n\n[[route]]\nprefix = \"/openai\"\nupstream = \"https://api.openai.com\"\nallow = [\"OPENAI_API_KEY\"]\nmethods = [\"POST\"]\npaths = [\"/v1/chat/completions\", \"/v1/embeddings\"]\nlabel = \"chat + embeddings\"          # shown in refusal logs\n\n[[route]]\nprefix = \"/anthropic\"\nupstream = \"https://api.anthropic.com\"\nallow = [\"ANTHROPIC_API_KEY\"]\nmethods = [\"POST\"]\npaths = [\"/v1/messages\"]\n\n[[route]]\nprefix = \"/stripe\"\nupstream = \"https://api.stripe.com\"\nallow = [\"STRIPE_SECRET_KEY\"]\nmethods = [\"GET\", \"POST\"]\npaths = [\"/v1/customers\", \"/v1/customers/*\", \"/v1/charges\"]\n```\n\nThe workload calls `http://127.0.0.1:8080/openai/v1/chat/completions` with\n`Authorization: Bearer {{seekrit:OPENAI_API_KEY}}`. Paths are matched *after*\nthe prefix is stripped.\n\n## Forward proxy — for code you cannot modify\n\n```toml\n[forward]\nlisten = \"127.0.0.1:8081\"\n\n# Hosts with no rule:\n#   \"tunnel\" (default) — passed through untouched, no interception\n#   \"deny\"             — refused, so only ruled hosts are reachable at all\nunmatched_host_policy = \"deny\"\n\n# Generated and persisted on first run if absent.\nca_cert = \"seekrit-proxy-ca.pem\"\nca_key  = \"seekrit-proxy-ca-key.pem\"\n\n[[forward.host]]\nmatch   = \"api.openai.com\"           # bare hostname: no scheme, port, or path\nallow   = [\"OPENAI_API_KEY\"]\nmethods = [\"POST\"]\npaths   = [\"/v1/**\"]\n\n# Several rules may name one host; first match wins, so narrow goes above broad.\n[[forward.host]]\nmatch   = \"api.openai.com\"\nmethods = [\"GET\"]                    # reads allowed, but carry no credential\n```\n\nThe workload needs `HTTPS_PROXY=http://127.0.0.1:8081` and the CA in its trust\nstore — `NODE_EXTRA_CA_CERTS`, `SSL_CERT_FILE`, `REQUESTS_CA_BUNDLE`, or the\nsystem store, depending on the runtime.\n\n## Rules from the dashboard\n\n```toml\n[policy]\nsource = \"server\"\nagent = \"nova\"                       # this deployment's agent identity\nrefresh_interval = \"10s\"\n\n# The trust anchor — the one thing that must not come from the server. Copy it\n# from the dashboard's trust-anchor panel and commit it. Pin a second admin too,\n# or one lost passphrase means nobody can publish.\nsigners = [\"kNc8…thumbprint\"]\n\n# Optional fleet ceiling: server policy may only narrow this. Inappropriate for\n# interactive development, where the local agent can edit local files anyway.\n[[policy.ceiling]]\nhost  = \"api.openai.com\"\nallow = [\"OPENAI_API_KEY\"]\n```\n\nIn server mode, `allow` / `methods` / `paths` in the file are **rejected**\nrather than ignored, and secrets are re-resolved on the same interval so a new\nrule and the credential it names arrive together.\n\n## Session tickets (one proxy, several agents)\n\n```toml\n[control]\nlisten  = \"127.0.0.1:9090\"\nttl     = \"1h\"\nmax_ttl = \"12h\"\n```\n\nRequires `SEEKRIT_PROXY_CONTROL_TOKEN` in the environment, and that token must\nnot be readable by the agents. The orchestrator `POST`s `/session` to mint a\nticket; the agent presents it as `x-seekrit-ticket`.\n\n## Picking up newly added secrets\n\n```toml\n[secrets]\nrefresh_interval = \"30s\"\n```\n\nWithout this (in file-policy mode) the proxy resolves once at startup, so a\nsecret added later never reaches a healthy running proxy. Server-policy mode\nturns refresh on implicitly. No new grant is involved — a new secret in an\nalready-granted environment decrypts with the key the proxy already holds.\n\n## Telemetry\n\nTraces, metrics, and logs go to **your** OTLP collector, configured with the\nstandard `OTEL_*` variables, and are inert unless\n`OTEL_EXPORTER_OTLP_ENDPOINT` is set. Secret names, hosts, durations, status\ncodes, and refusal reasons are recorded; values, bodies, and `Authorization`\nheaders never are. `propagate_trace_upstream = true` additionally sends W3C\ntrace headers to the upstream — off by default, since most upstreams are third\nparties.\n"
+		}]
+	},
+	{
+		"skillKey": "seekrit-paperclip",
+		"displayName": "seekrit in Paperclip",
+		"slug": "seekrit-paperclip",
+		"description": "Handle credentials correctly while working inside Paperclip, the AI agent management platform. Use when a Paperclip run needs an API key, when you are about to put a value in an adapter env map, a project env map, an approval payload, or an issue comment, when a human hands you a credential in a Paperclip issue, or when asked to wire a Paperclip agent up to a third-party API. Also covers why a seekrit secret cannot be a Paperclip secret_ref, and which of the two paths — inject-and-exec or the egress proxy — a given run should use.",
+		"markdown": "---\nname: seekrit-paperclip\ndescription: Handle credentials correctly while working inside Paperclip, the AI agent management platform. Use when a Paperclip run needs an API key, when you are about to put a value in an adapter env map, a project env map, an approval payload, or an issue comment, when a human hands you a credential in a Paperclip issue, or when asked to wire a Paperclip agent up to a third-party API. Also covers why a seekrit secret cannot be a Paperclip secret_ref, and which of the two paths — inject-and-exec or the egress proxy — a given run should use.\nlicense: MIT\ncompatibility: Needs the seekrit CLI (or the seekrit Paperclip plugin) on the host running the agent, plus network access to seekrit's API.\n---\n\n# Secrets inside Paperclip\n\nYou are running as a Paperclip agent. Paperclip has its own secret store, and\nseekrit is not one of its providers — the provider list is closed\n(`local_encrypted`, `aws_secrets_manager`, `gcp_secret_manager`, `vault`). So\n**a seekrit secret can never be a Paperclip `secret_ref`.** Do not try to make\none; do not ask an operator to paste a seekrit value into Paperclip's secret\nstore to work around it. That would create a second plaintext copy of a\ncredential seekrit exists to avoid copying.\n\nValues reach a run one of two other ways, and picking between them is the whole\njob.\n\n## The two paths\n\n| Path | Use it when | What the run sees |\n| --- | --- | --- |\n| **Inject and exec** — `seekrit:run_command`, or `seekrit run -- …` in a terminal | You are running a build, a test suite, a migration, a dev server — a process *you* wrote the command for | The real value, in that child process's environment only |\n| **Egress proxy** — `{{seekrit:NAME}}` placeholders behind an allowlist | The thing holding the credential is a model, a sandbox, generated code, or a subagent whose output you cannot predict | Never the value — only a placeholder the proxy swaps on the way out |\n\nDefault to the first for your own tooling and the second for anything you are\nabout to hand to another agent or to code you just generated. When both would\nwork, prefer the proxy: it also bounds *where* the credential can go, which\nPaperclip's execution policy does not — that policy governs review and approval\nstages, not network egress.\n\n## The rule, in Paperclip's terms\n\n**A value must not come to rest anywhere it can be read again.** In this\nenvironment that means, specifically, never write a credential into:\n\n- an agent's **adapter env** map, or a project or routine **env** map — these\n  persist in Paperclip's database and render in its UI. (Under\n  `PAPERCLIP_SECRETS_STRICT_MODE` the server rejects it outright; assume strict\n  mode even where it is off.)\n- an **approval payload**, an **issue comment**, an **issue document**, or a run\n  transcript. A comment is the most common accident: it feels like talking to a\n  person, and it is a durable row.\n- a **company export**, a workspace file, `.env`, or a commit.\n\nA placeholder is not a value. `{{seekrit:OPENAI_API_KEY}}` is safe to put in an\nadapter env map, in a config file, and in a commit — that is the point of it.\n\nIf you have already broken this rule in this run, say so plainly in your comment\non the issue and treat the credential as needing rotation. Do not quietly move\non.\n\n## When a human hands you a credential\n\nSomeone will paste a key into an issue comment. When that happens:\n\n1. Store it in seekrit immediately — `seekrit:store_secret`, or\n   `set_secret { app, env, name, value }` on the local MCP server.\n2. Reply naming the secret, never the value: \"stored `STRIPE_SECRET_KEY` in\n   storefront/production.\"\n3. Tell them the comment still holds the plaintext and should be edited or\n   deleted, and that the credential is worth rotating if the issue is visible\n   beyond the two of you.\n\nNever echo it back to confirm you received it.\n\n## When a value is missing\n\nDo not go looking. A denied read is not a puzzle to solve: reconstructing a\ncredential from `docker compose config`, `git log -p`, a lockfile, a CI log, or\nanother secrets CLI is the failure mode this skill exists to prevent, and it\nlooks like diligence in a transcript.\n\nInstead, in order:\n\n1. `seekrit:list_secrets` — confirm whether the name exists in the environment\n   you are pointed at, and whether you are pointed at the right one.\n2. If it genuinely is not there, ask on the issue. Name what you need and what\n   it is for.\n3. If the operator would rather grant than paste, point them at\n   `seekrit access grant` for a service token, not at Paperclip's secret store.\n\nPaperclip also has its own **secret proposal** flow — agents propose, people\ndecide, and a proposal expires after 14 days. Use it for credentials that\ngenuinely belong to Paperclip (a connector's own token). Do not use it to\nsmuggle a seekrit value into Paperclip config.\n\n## Wiring an agent to a third-party API\n\nThe proxy path, end to end, is in\n[references/paperclip-wiring.md](references/paperclip-wiring.md): the adapter\nenv map to paste, the `seekrit-proxy.toml` to generate, and the two lines that\nmake the runtime trust the proxy's CA. The short version is that the agent's\nadapter env holds placeholders and an `HTTPS_PROXY`, and the real keys stay in\nthe proxy — so a compromised or merely creative run cannot exfiltrate them,\nbecause it never had them.\n\n## Tools\n\nIf the seekrit Paperclip plugin is installed, these are available in a run:\n\n| Tool | Does |\n| --- | --- |\n| `seekrit:list_secrets` | Names and metadata for an environment. Never values. |\n| `seekrit:run_command` | Runs a command with secrets injected into the child only; returns exit code and output. |\n| `seekrit:store_secret` | Stores a value. Write-only — there is no tool that reads one back. |\n| `seekrit:write_proxy_config` | Writes a `seekrit-proxy.toml` and prints the env the workload needs. |\n\nIf it is not installed, everything here is also a CLI invocation — see the\n**seekrit-secrets** skill's CLI reference. If neither is available, say so on the\nissue rather than falling back to a plaintext workaround.\n\n## Further reading\n\n- [references/paperclip-wiring.md](references/paperclip-wiring.md) — adapter env\n  maps, proxy config, plugin install, and the MCP wiring per adapter.\n- The **seekrit-secrets** skill — the resource model, bootstrapping from\n  nothing, and the full tool surface.\n- The **seekrit-agent-keys** skill — the proxy in depth, including forward mode\n  and operation-level allowlists.\n",
+		"files": [{
+			"path": "references/paperclip-wiring.md",
+			"content": "# Wiring seekrit into Paperclip\n\nEverything here is operator work, done once per company or once per agent. If you\nare an agent reading this mid-run, the useful parts are the **adapter env** table\n(what a correctly wired agent's env looks like, so you can tell whether yours is)\nand **Why not a secret_ref** at the bottom.\n\n## 1. The plugin\n\n```bash\nnpx paperclipai plugin install @seekrit/paperclip-plugin\n```\n\nIt contributes four agent tools (`seekrit:list_secrets`, `seekrit:run_command`,\n`seekrit:store_secret`, `seekrit:write_proxy_config`), installs the seekrit\nskills into the company's skills library, and adds a Secrets panel under Company\nSettings that lists what each environment holds — names, versions, and when they\nlast changed, never values.\n\nIts one piece of configuration is a **seekrit service token**, bound as a\nPaperclip `secret_ref` in the plugin's settings form. That is the correct use of\nPaperclip's secret store: the token is Paperclip's own credential, scoped to the\nenvironments you want its agents to reach, and revocable without touching\nanything else.\n\n## 2. The skills\n\nPaperclip installs skills from a GitHub URL and pins them to a commit. On the\nSkills page, paste:\n\n```\nhttps://github.com/seekritdev/agent-plugin\n```\n\nThat picks up `seekrit-secrets`, `seekrit-agent-keys`, and `seekrit-paperclip`.\nAssign them per agent, or company-wide. The plugin installs the same three, so\ndo this only if you are not installing the plugin.\n\n## 3. MCP servers, per adapter\n\nPaperclip is the control plane; the **adapter's runtime** is what speaks MCP. So\nMCP config is per-runtime and lives next to the agent's working directory, not in\nPaperclip's database.\n\nFor the Claude Code adapter (and the Codex, Cursor, Gemini CLI, and OpenCode\nadapters, which inherit their CLI's own MCP support the same way), the file is a\nproject-scoped `.mcp.json` in the agent's working directory:\n\n```bash\nseekrit paperclip init --dir /srv/paperclip/workspaces/storefront\n```\n\nThat writes both seekrit servers into `.mcp.json`, merging with any servers\nalready there:\n\n```json\n{\n  \"mcpServers\": {\n    \"seekrit\": { \"type\": \"stdio\", \"command\": \"npx\", \"args\": [\"-y\", \"@seekrit/mcp\"] },\n    \"seekrit-cloud\": { \"type\": \"streamable-http\", \"url\": \"https://mcp.seekrit.dev/mcp\" }\n  }\n}\n```\n\nProject scope is the right one here: an agent's working directory already pins\nit, and two agents pointed at the same repo should see the same servers. For a\nserver one agent alone should see, give that agent its own working directory.\n\n## 4. The proxy, for runs you do not trust\n\n`seekrit paperclip init --proxy --preset anthropic --preset openai --preset gemini`\nwrites a `seekrit-proxy.toml` and prints the adapter env to paste. Run the proxy\nbeside Paperclip — same host, or a sidecar container — with a service token in\n`SEEKRIT_TOKEN`.\n\nForward mode is usually right for Paperclip, because the runtimes are CLIs you\nare not configuring base URLs for:\n\n```toml\nlisten = \"127.0.0.1:8080\"\n\n[forward]\nlisten = \"127.0.0.1:8081\"\nca_cert = \"seekrit-proxy-ca.pem\"\n\n[[rule]]\nhost = \"api.anthropic.com\"\nallow = [\"ANTHROPIC_API_KEY\"]\nmethods = [\"GET\", \"POST\"]\npaths = [\"/v1/**\"]\n```\n\n### Adapter env\n\nPaste this into the agent's **Environment variables** on its Configuration tab.\nEvery value is a plain string — a placeholder is not a secret, so none of these\nneeds a `secret_ref` and none trips strict mode:\n\n| Variable | Value |\n| --- | --- |\n| `ANTHROPIC_API_KEY` | `{{seekrit:ANTHROPIC_API_KEY}}` |\n| `OPENAI_API_KEY` | `{{seekrit:OPENAI_API_KEY}}` |\n| `GEMINI_API_KEY` | `{{seekrit:GEMINI_API_KEY}}` |\n| `HTTPS_PROXY` | `http://127.0.0.1:8081` |\n| `NODE_EXTRA_CA_CERTS` | absolute path to `seekrit-proxy-ca.pem` |\n\nUse `SSL_CERT_FILE` or `REQUESTS_CA_BUNDLE` instead of `NODE_EXTRA_CA_CERTS` for\na non-Node runtime; a Python adapter needs the latter.\n\nA run wired this way holds no key. The proxy refuses any host not in the file,\nand the file is not something the run can edit.\n\n### Checking it worked\n\nFrom the agent's working directory, ask the runtime to make one real call. A\n`401` from the upstream means the placeholder went out unsubstituted — the\nusual cause is a secret name in the env that is not in the rule's `allow` list.\nA connection error to the upstream means `HTTPS_PROXY` is not reaching the\nproxy. A TLS error means the CA env var is wrong for that runtime.\n\n## 5. Injecting instead, for runs you do trust\n\nWhere the run is your own tooling, skip the proxy and inject:\n\n```\nseekrit:run_command { command: \"pnpm\", args: [\"test\"] }\n```\n\nThe tool resolves the environment, injects every granted secret into the child\nprocess only, and returns the exit code and captured output. It does not return\nvalues, and there is no tool that does.\n\nIn a terminal on the same host, the same thing is `seekrit run -- pnpm test`.\n\n## Why not a `secret_ref`\n\nPaperclip resolves a `secret_ref` through its own provider system, and that\nprovider list is closed: `local_encrypted`, `aws_secrets_manager`,\n`gcp_secret_manager`, `vault`. There is no seekrit provider to select, so there\nis no honest way to express a seekrit secret as a Paperclip secret.\n\nThe dishonest way — copying a value out of seekrit and into Paperclip's store —\nis worse than it looks. It creates a second plaintext copy under a different\nlifecycle, so a rotation in seekrit silently leaves Paperclip serving the old\nvalue, and a seekrit revocation does not revoke anything. Both paths above avoid\nthat by keeping resolution at the moment of use.\n\nThe one thing that *should* be a Paperclip `secret_ref` is the plugin's own\nseekrit service token, in step 1.\n"
+		}]
+	}
+];
+//#endregion
+//#region src/manifest.ts
+/**
+* Where each seekrit call is aimed, as tool parameters.
+*
+* Every tool takes these and every one of them is optional: the plugin's own
+* config carries the default app and environment, so the common case is a tool
+* call with no target at all. An agent that names one is either working across
+* environments on purpose or has been told to — and in both cases the token's
+* grants still decide what it can actually reach. These parameters cannot widen
+* access; they can only aim it somewhere the token already reaches.
+*/
+const TARGET_PROPERTIES = {
+	app: {
+		type: "string",
+		description: "Application slug. Defaults to the plugin's configured app."
+	},
+	env: {
+		type: "string",
+		description: "Environment slug. Defaults to the plugin's configured environment."
+	},
+	group: {
+		type: "string",
+		description: "Target a group environment instead of an app."
+	},
+	branch: {
+		type: "string",
+		description: "Read a branch of the environment rather than the environment itself."
+	}
+};
+const manifest = {
+	id: "seekrit",
+	apiVersion: 1,
+	version,
+	displayName: "seekrit",
+	description: "End-to-end encrypted secrets for Paperclip agents: inject credentials into a run without the run — or Paperclip — ever holding a value.",
+	author: "seekrit",
+	categories: ["connector"],
+	minimumHostVersion: "2026.817.0",
+	capabilities: [
+		"agent.tools.register",
+		"secrets.read-ref",
+		"skills.managed",
+		"plugin.state.read",
+		"plugin.state.write",
+		"ui.page.register",
+		"activity.log.write"
+	],
+	entrypoints: {
+		worker: "dist/worker.js",
+		ui: "dist/ui/"
+	},
+	instanceConfigSchema: {
+		type: "object",
+		required: ["tokenRef"],
+		properties: {
+			tokenRef: {
+				title: "seekrit service token",
+				format: "secret-ref",
+				description: "A seekrit service token (skt_…) with grants for the environments these agents may reach. Scope it narrowly; it is the ceiling on everything below."
+			},
+			app: {
+				type: "string",
+				title: "Default application",
+				description: "Application slug tools use when a call names no app."
+			},
+			env: {
+				type: "string",
+				title: "Default environment",
+				description: "Environment slug tools use when a call names no environment."
+			},
+			group: {
+				type: "string",
+				title: "Default group",
+				description: "Group slug, for tokens scoped to a group environment instead of an app."
+			},
+			allowRunCommand: {
+				type: "boolean",
+				title: "Allow run_command",
+				default: true,
+				description: "Let agents execute commands with secrets injected. Turn this off to leave only the read-only and write-only tools."
+			},
+			cliPath: {
+				type: "string",
+				title: "seekrit CLI path",
+				default: "seekrit",
+				description: "Executable to invoke. Change this when the CLI is not on the Paperclip host's PATH."
+			},
+			timeoutSeconds: {
+				type: "number",
+				title: "Command timeout (seconds)",
+				default: 300,
+				minimum: 5,
+				maximum: 3600,
+				description: "Hard cap on a single tool invocation."
+			}
+		}
+	},
+	tools: [
+		{
+			name: "list_secrets",
+			displayName: "List seekrit secrets",
+			description: "List the secret names available in a seekrit environment, with versions and when each last changed. Returns metadata only — never a value. Use this to check whether a credential exists, or which name it has, before asking a human for it.",
+			parametersSchema: {
+				type: "object",
+				properties: { ...TARGET_PROPERTIES }
+			}
+		},
+		{
+			name: "run_command",
+			displayName: "Run a command with secrets",
+			description: "Run a command with every granted secret injected as an environment variable in that child process only, and return its exit code and output. This is the right way to run anything that needs a credential — a build, a test suite, a migration, a dev server — because no value is written to a file or to your transcript. Note that this tool cannot redact the command's own output: a program that prints its credential has leaked it.",
+			parametersSchema: {
+				type: "object",
+				required: ["command"],
+				properties: {
+					command: {
+						type: "string",
+						description: "Executable to run, e.g. `pnpm`."
+					},
+					args: {
+						type: "array",
+						items: { type: "string" },
+						description: "Arguments, e.g. `[\"test\"]`."
+					},
+					cwd: {
+						type: "string",
+						description: "Working directory. Defaults to the run's workspace."
+					},
+					...TARGET_PROPERTIES
+				}
+			}
+		},
+		{
+			name: "store_secret",
+			displayName: "Store a secret in seekrit",
+			description: "Encrypt and store a value in seekrit. Write-only: there is no tool that reads a value back. Use this the moment a human hands you a credential — then reply naming the secret, never the value, and tell them the message they pasted it into still holds the plaintext.",
+			parametersSchema: {
+				type: "object",
+				required: ["name", "value"],
+				properties: {
+					name: {
+						type: "string",
+						description: "Secret name, e.g. `STRIPE_SECRET_KEY`."
+					},
+					value: {
+						type: "string",
+						description: "The value to encrypt and store."
+					},
+					...TARGET_PROPERTIES
+				}
+			}
+		},
+		{
+			name: "proxy_config",
+			displayName: "Generate an egress proxy config",
+			description: "Generate a seekrit-proxy.toml for the upstreams a workload calls, and return it as text. The proxy holds the credentials and swaps `{{seekrit:NAME}}` placeholders into outbound requests, so the workload never has a key at all. Use this instead of run_command whenever the thing that needs the credential is a sandbox, generated code, or a subagent whose output you cannot predict.",
+			parametersSchema: {
+				type: "object",
+				required: ["presets"],
+				properties: {
+					presets: {
+						type: "array",
+						items: { type: "string" },
+						minItems: 1,
+						description: "Upstream preset ids, e.g. `[\"anthropic\", \"openai\", \"gemini\", \"github\"]`."
+					},
+					mode: {
+						type: "string",
+						enum: [
+							"forward",
+							"reverse",
+							"both"
+						],
+						default: "forward",
+						description: "`forward` uses HTTPS_PROXY and needs no base-URL changes — usually right for a CLI runtime. `reverse` gives each upstream a base URL to point an SDK at."
+					}
+				}
+			}
+		}
+	],
+	skills: MANAGED_SKILLS,
+	ui: { slots: [{
+		type: "page",
+		id: "secrets",
+		displayName: "seekrit",
+		exportName: "SecretsPage",
+		routePath: "seekrit"
+	}] }
+};
+//#endregion
+export { MANAGED_SKILLS as n, manifest as t };

package/dist/ui/index.js

@@ -0,0 +1,136 @@
+import { DataTable, KeyValueList, MetricCard, Spinner, StatusBadge, useHostContext, usePluginAction, usePluginData } from "@paperclipai/plugin-sdk/ui";
+import { jsx, jsxs } from "react/jsx-runtime";
+//#region src/ui/index.tsx
+/**
+* The company page mounted at `/:companyPrefix/seekrit`.
+*
+* What it is for: answering "what can our agents actually reach?" without
+* anybody having to read a value. Names, versions, and when each last changed
+* are exactly the metadata that makes a secret store reviewable, and they are
+* also the only fields the worker will hand over — there is no data key here
+* that could return a plaintext, because there is no tool that reads one.
+*
+* When seekrit is unreachable the worker returns its last good snapshot with
+* `live: false`. The page says so rather than rendering an empty table, because
+* "no secrets" and "could not ask" are very different answers and a blank table
+* is the wrong one for both.
+*
+* Bundled as ESM against the host's React. Everything visual comes from the
+* SDK's component kit so the page inherits the host's theme instead of
+* approximating it.
+*/
+/** `2026-08-22T09:14:00.000Z` → `2026-08-22 09:14`, or the raw string. */
+function short(timestamp) {
+	if (!timestamp) return "never";
+	const parsed = new Date(timestamp);
+	if (Number.isNaN(parsed.getTime())) return timestamp;
+	return parsed.toISOString().replace("T", " ").slice(0, 16);
+}
+function SecretsPage() {
+	const companyId = useHostContext().companyId;
+	const { data, loading, error, refresh } = usePluginData("catalogue", { companyId });
+	const installSkills = usePluginAction("install-skills");
+	if (!companyId) return /* @__PURE__ */ jsx("p", { children: "Pick a company to see the secrets its agents can reach." });
+	if (loading && !data) return /* @__PURE__ */ jsx(Spinner, {});
+	if (error) return /* @__PURE__ */ jsxs("div", {
+		style: {
+			display: "grid",
+			gap: 12
+		},
+		children: [/* @__PURE__ */ jsx(StatusBadge, {
+			label: "Plugin unavailable",
+			status: "error"
+		}), /* @__PURE__ */ jsx("p", { children: error.message })]
+	});
+	const catalogue = data;
+	const secrets = catalogue?.secrets ?? [];
+	return /* @__PURE__ */ jsxs("div", {
+		style: {
+			display: "grid",
+			gap: 20
+		},
+		children: [
+			/* @__PURE__ */ jsxs("div", {
+				style: {
+					display: "flex",
+					gap: 12,
+					flexWrap: "wrap",
+					alignItems: "center"
+				},
+				children: [
+					/* @__PURE__ */ jsx(StatusBadge, {
+						label: catalogue?.live ? "Connected" : "Showing last known",
+						status: catalogue?.live ? "ok" : "warning"
+					}),
+					catalogue?.allowRunCommand === false ? /* @__PURE__ */ jsx(StatusBadge, {
+						label: "run_command off",
+						status: "info"
+					}) : null,
+					/* @__PURE__ */ jsx("button", {
+						type: "button",
+						onClick: () => refresh(),
+						children: "Refresh"
+					}),
+					/* @__PURE__ */ jsx("button", {
+						type: "button",
+						onClick: () => {
+							installSkills({ companyId }).then(() => refresh());
+						},
+						children: "Install seekrit skills"
+					})
+				]
+			}),
+			catalogue?.error ? /* @__PURE__ */ jsxs("p", { children: [
+				"Could not reach seekrit: ",
+				catalogue.error,
+				" — the table below is the last snapshot this plugin took."
+			] }) : null,
+			/* @__PURE__ */ jsxs("div", {
+				style: {
+					display: "flex",
+					gap: 16,
+					flexWrap: "wrap"
+				},
+				children: [/* @__PURE__ */ jsx(MetricCard, {
+					label: "Secrets reachable",
+					value: secrets.length
+				}), /* @__PURE__ */ jsx(MetricCard, {
+					label: "Environment",
+					value: catalogue?.target ?? "—"
+				})]
+			}),
+			/* @__PURE__ */ jsx(KeyValueList, { pairs: [{
+				label: "Last read",
+				value: short(catalogue?.fetchedAt ?? null)
+			}, {
+				label: "How values reach a run",
+				value: "Injected into a child process by run_command, or swapped in by the egress proxy. Never copied into Paperclip's secret store."
+			}] }),
+			/* @__PURE__ */ jsx(DataTable, {
+				columns: [
+					{
+						key: "name",
+						header: "Name",
+						sortable: true
+					},
+					{
+						key: "version",
+						header: "Version",
+						width: "100px"
+					},
+					{
+						key: "updatedAt",
+						header: "Last changed",
+						width: "180px",
+						render: (value) => short(typeof value === "string" ? value : null)
+					}
+				],
+				rows: secrets,
+				loading,
+				emptyMessage: catalogue?.live ? `No secrets in ${catalogue.target}. Check the plugin's default app and environment.` : "Nothing read yet."
+			})
+		]
+	});
+}
+//#endregion
+export { SecretsPage };

package/dist/worker.js

@@ -0,0 +1,514 @@
+import { n as MANAGED_SKILLS, t as manifest } from "./shared.js";
+import { definePlugin, runWorker } from "@paperclipai/plugin-sdk";
+import { spawn } from "node:child_process";
+//#region src/seekrit-cli.ts
+/**
+* The plugin's only way to reach seekrit: the `seekrit` CLI, as a subprocess.
+*
+* WHY A SUBPROCESS AND NOT AN SDK. Two reasons, and the second is the load-
+* bearing one.
+*
+* 1. No duplicated logic. Target resolution (`--app`/`--env`/`--group`/
+*    `--branch`), token auth, the last-known-good cache, `${REFERENCE}`
+*    expansion, and precedence (process env > .env > app > group) are all
+*    decided by one implementation. A second one drifts.
+* 2. **The plugin never holds a plaintext.** `seekrit run` decrypts inside the
+*    child it then execs; this process only ever sees the child's exit code and
+*    output. That is a materially different blast radius from a plugin that
+*    decrypts in its own address space and passes values around — the Paperclip
+*    worker is long-lived, its heap is not something we want credentials in, and
+*    an out-of-process boundary is the only version of "never cached" that a
+*    reviewer can verify by reading one file.
+*
+* A consequence worth stating plainly: because this module never sees the
+* injected values, it **cannot redact them** from captured output. A child that
+* prints its own credential has leaked it, and no wrapper here can undo that.
+* The tool descriptions say so.
+*
+* STDIO IS NOT INHERITABLE HERE. A Paperclip plugin worker talks to the host
+* over JSON-RPC on its own stdin/stdout. A subprocess that inherits stdio would
+* interleave the child's bytes into that framing and take the worker down with a
+* parse error — so every spawn below pipes, and stdin is closed unless we are
+* deliberately feeding a value in.
+*/
+/**
+* Captured output cap. A test suite or a dev server can emit megabytes, and all
+* of it would otherwise land in an agent's context window and a run transcript.
+* The tail is what a failure explains itself with, so that is the half kept.
+*/
+const MAX_CAPTURE = 64 * 1024;
+function tail(chunks) {
+	const joined = chunks.join("");
+	if (joined.length <= MAX_CAPTURE) return {
+		text: joined,
+		truncated: false
+	};
+	return {
+		text: joined.slice(joined.length - MAX_CAPTURE),
+		truncated: true
+	};
+}
+/** Target flags, in the order the CLI documents them. */
+function targetArgs(target) {
+	const args = [];
+	if (target.org) args.push("--org", target.org);
+	if (target.app) args.push("--app", target.app);
+	if (target.group) args.push("--group", target.group);
+	if (target.branch) args.push("--branch", target.branch);
+	if (target.env) args.push("--env", target.env);
+	return args;
+}
+/**
+* Raised when the CLI itself fails, as opposed to the command it ran.
+*
+* The message carries the CLI's stderr because that is where its actionable
+* errors go ("no secret named X", "token has no grant for that environment").
+* It carries no environment and no argv beyond the subcommand, so a token can
+* never reach a Paperclip activity row through an error path.
+*/
+var SeekritCliError = class extends Error {
+	subcommand;
+	exitCode;
+	stderr;
+	constructor(subcommand, exitCode, stderr) {
+		super(`seekrit ${subcommand} failed (exit ${exitCode})${stderr.trim() ? `: ${stderr.trim()}` : ""}`);
+		this.subcommand = subcommand;
+		this.exitCode = exitCode;
+		this.stderr = stderr;
+		this.name = "SeekritCliError";
+	}
+};
+/**
+* Spawn the CLI and capture it. `stdin` is written and closed when provided,
+* which is how a value is passed without it ever appearing in argv — and
+* therefore never in `ps`, never in a shell history, and never in the host's
+* process table.
+*/
+function runSeekrit(options, args, stdin) {
+	return new Promise((resolve, reject) => {
+		const child = spawn(options.bin, args, {
+			stdio: [
+				stdin === void 0 ? "ignore" : "pipe",
+				"pipe",
+				"pipe"
+			],
+			...options.cwd ? { cwd: options.cwd } : {},
+			env: {
+				...process.env,
+				SEEKRIT_TOKEN: options.token,
+				NO_COLOR: "1"
+			}
+		});
+		const out = [];
+		const err = [];
+		let settled = false;
+		const timer = setTimeout(() => {
+			if (settled) return;
+			settled = true;
+			child.kill("SIGKILL");
+			reject(/* @__PURE__ */ new Error(`seekrit ${args[0] ?? "?"} timed out after ${options.timeoutMs}ms`));
+		}, options.timeoutMs);
+		child.stdout?.setEncoding("utf8");
+		child.stderr?.setEncoding("utf8");
+		child.stdout?.on("data", (chunk) => out.push(chunk));
+		child.stderr?.on("data", (chunk) => err.push(chunk));
+		child.on("error", (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			const code = error.code;
+			reject(code === "ENOENT" ? /* @__PURE__ */ new Error(`could not run "${options.bin}" — install the seekrit CLI on the Paperclip host (npm i -g @seekrit/cli) or set cliPath in this plugin's settings`) : error);
+		});
+		child.on("close", (code) => {
+			if (settled) return;
+			settled = true;
+			clearTimeout(timer);
+			const stdout = tail(out);
+			const stderr = tail(err);
+			resolve({
+				exitCode: code ?? 1,
+				stdout: stdout.text,
+				stderr: stderr.text,
+				truncated: stdout.truncated || stderr.truncated
+			});
+		});
+		if (stdin !== void 0) child.stdin?.end(stdin);
+	});
+}
+/** `seekrit secrets list --json` — names and metadata, never values. */
+async function listSecrets(options, target) {
+	const result = await runSeekrit(options, [
+		"secrets",
+		"list",
+		"--json",
+		...targetArgs(target)
+	]);
+	if (result.exitCode !== 0) throw new SeekritCliError("secrets list", result.exitCode, result.stderr);
+	let parsed;
+	try {
+		parsed = JSON.parse(result.stdout);
+	} catch {
+		throw new SeekritCliError("secrets list", 0, "the CLI did not return JSON — check that `seekrit` on this host is recent enough for --json");
+	}
+	const rows = parsed.secrets;
+	if (!Array.isArray(rows)) return [];
+	return rows.map((row) => {
+		const r = row;
+		return {
+			name: String(r.name ?? ""),
+			version: Number(r.version ?? 0),
+			createdAt: String(r.createdAt ?? ""),
+			updatedAt: String(r.updatedAt ?? "")
+		};
+	});
+}
+/** `seekrit secrets set NAME` with the value on stdin. Write-only by design. */
+async function storeSecret(options, target, name, value) {
+	const result = await runSeekrit(options, [
+		"secrets",
+		"set",
+		name,
+		...targetArgs(target)
+	], value);
+	if (result.exitCode !== 0) throw new SeekritCliError("secrets set", result.exitCode, result.stderr);
+}
+/** `seekrit run -- <command>` — secrets exist only inside the child. */
+async function runCommand(options, target, command, commandArgs) {
+	return runSeekrit(options, [
+		"run",
+		...targetArgs(target),
+		"--",
+		command,
+		...commandArgs
+	]);
+}
+//#endregion
+//#region src/worker.ts
+/**
+* The plugin worker: four agent tools, a company page, and nothing else.
+*
+* WHAT THIS PLUGIN IS FOR. Paperclip's secret provider list is closed
+* (`local_encrypted`, `aws_secrets_manager`, `gcp_secret_manager`, `vault`), so
+* a seekrit secret cannot be expressed as a Paperclip `secret_ref` — there is
+* nothing to select. This plugin is the other half of that answer: instead of
+* teaching Paperclip to resolve seekrit secrets into an agent's environment, it
+* gives the agent verbs that keep resolution at the moment of use. A build runs
+* with secrets injected into the child only; an untrusted workload gets a proxy
+* config and a placeholder. Paperclip's database ends up holding one credential
+* — this plugin's own seekrit service token, as a `secret_ref` — and nothing
+* else.
+*
+* NO PLAINTEXT IS CACHED. `ctx.secrets.resolve` is called per invocation and the
+* token is handed straight to a subprocess environment. It is never stored in
+* `ctx.state`, never written to an activity row, and never included in an error.
+* The same goes for the values the CLI resolves: this process never sees them at
+* all (see `seekrit-cli.ts`).
+*
+* MULTI-COMPANY BY CONSTRUCTION. `multiCompanyConfig` is true because the worker
+* holds *no* per-company state: every entry point re-reads `ctx.config.get`
+* for the company it was called about. There is no cached config to collapse
+* across tenants, which is the failure that flag exists to prevent.
+*/
+const DEFAULT_TIMEOUT_SECONDS = 300;
+function str(value) {
+	return typeof value === "string" && value.trim() !== "" ? value.trim() : void 0;
+}
+/**
+* Read and validate the config for one company.
+*
+* Fails loudly on a missing `tokenRef` rather than falling back to ambient
+* credentials. A `seekrit` CLI on the host may well have a `~/.config/seekrit`
+* of its own from someone's manual testing, and silently using it would mean
+* agents reaching environments nobody granted them — the config being *absent*
+* would look like it was working.
+*/
+function readConfig(raw) {
+	const tokenRef = raw.tokenRef;
+	if (tokenRef === void 0 || tokenRef === null || tokenRef === "") throw new Error("no seekrit service token configured — set one in Settings → Plugins → seekrit. The plugin will not fall back to an ambient credential on the host.");
+	const timeoutSeconds = typeof raw.timeoutSeconds === "number" && Number.isFinite(raw.timeoutSeconds) ? raw.timeoutSeconds : DEFAULT_TIMEOUT_SECONDS;
+	return {
+		tokenRef,
+		target: {
+			...str(raw.app) ? { app: str(raw.app) } : {},
+			...str(raw.env) ? { env: str(raw.env) } : {},
+			...str(raw.group) ? { group: str(raw.group) } : {}
+		},
+		allowRunCommand: raw.allowRunCommand !== false,
+		bin: str(raw.cliPath) ?? "seekrit",
+		timeoutMs: Math.round(timeoutSeconds * 1e3)
+	};
+}
+/**
+* Merge a tool call's target over the configured default.
+*
+* Naming `group` drops the configured `app` and vice versa: the CLI treats them
+* as alternatives, and passing both produces an error that reads like a bug in
+* the tool rather than a contradiction in the call.
+*/
+function mergeTarget(config, params) {
+	const app = params.app ?? (params.group ? void 0 : config.app);
+	const group = params.group ?? (params.app ? void 0 : config.group);
+	return {
+		...app ? { app } : {},
+		...group ? { group } : {},
+		...params.env ?? config.env ? { env: params.env ?? config.env } : {},
+		...params.branch ? { branch: params.branch } : {},
+		...params.org ? { org: params.org } : {}
+	};
+}
+/** Tool params carry the target fields plus whatever else the tool takes. */
+function targetFrom(params) {
+	const p = params ?? {};
+	return {
+		...str(p.org) ? { org: str(p.org) } : {},
+		...str(p.app) ? { app: str(p.app) } : {},
+		...str(p.env) ? { env: str(p.env) } : {},
+		...str(p.group) ? { group: str(p.group) } : {},
+		...str(p.branch) ? { branch: str(p.branch) } : {}
+	};
+}
+/** A human-readable label for the environment a call resolved to. */
+function targetLabel(target) {
+	return `${target.app ?? (target.group ? `group:${target.group}` : "?")}/${target.branch ? `${target.env ?? "?"}@${target.branch}` : target.env ?? "?"}`;
+}
+/** Where the last good catalogue snapshot lives, per company. */
+const snapshotKey = (companyId) => ({
+	scopeKind: "company",
+	scopeId: companyId,
+	namespace: "catalogue",
+	stateKey: "last-snapshot"
+});
+/**
+* Everything a tool or data handler needs, resolved fresh for one company.
+*
+* The token resolution is the reason this is a function and not a cached object.
+*/
+async function cliFor(ctx, companyId) {
+	const config = readConfig(await ctx.config.get(companyId));
+	const token = await ctx.secrets.resolve(config.tokenRef, {
+		companyId,
+		configPath: "tokenRef"
+	});
+	return {
+		config,
+		cli: {
+			bin: config.bin,
+			token,
+			timeoutMs: config.timeoutMs
+		}
+	};
+}
+/** Turn any failure into a tool error the agent can act on, with no secret in it. */
+function toolError(error) {
+	if (error instanceof SeekritCliError) return { error: error.message };
+	return { error: error instanceof Error ? error.message : String(error) };
+}
+const plugin = definePlugin({
+	multiCompanyConfig: true,
+	async setup(ctx) {
+		ctx.tools.register("list_secrets", toolDeclaration("list_secrets"), async (params, runCtx) => {
+			try {
+				const { config, cli } = await cliFor(ctx, runCtx.companyId);
+				const target = mergeTarget(config.target, targetFrom(params));
+				const secrets = await listSecrets(cli, target);
+				await ctx.state.set(snapshotKey(runCtx.companyId), {
+					target: targetLabel(target),
+					fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					secrets
+				});
+				return {
+					content: secrets.length === 0 ? `No secrets in ${targetLabel(target)}.` : `${secrets.length} secret(s) in ${targetLabel(target)}: ${secrets.map((s) => s.name).join(", ")}`,
+					data: {
+						target: targetLabel(target),
+						secrets
+					}
+				};
+			} catch (error) {
+				return toolError(error);
+			}
+		});
+		ctx.tools.register("run_command", toolDeclaration("run_command"), async (params, runCtx) => {
+			const p = params ?? {};
+			const command = str(p.command);
+			if (!command) return { error: "run_command needs a `command`" };
+			const args = Array.isArray(p.args) ? p.args.map(String) : [];
+			try {
+				const { config, cli } = await cliFor(ctx, runCtx.companyId);
+				if (!config.allowRunCommand) return { error: "run_command is turned off for this company. Ask an operator to enable it, or use proxy_config so the workload holds a placeholder instead of a key." };
+				const target = mergeTarget(config.target, targetFrom(params));
+				const cwd = str(p.cwd);
+				const result = await runCommand({
+					...cli,
+					...cwd ? { cwd } : {}
+				}, target, command, args);
+				await ctx.activity.log({
+					companyId: runCtx.companyId,
+					message: `seekrit run_command: ${command} (exit ${result.exitCode})`,
+					metadata: {
+						command,
+						argc: args.length,
+						exitCode: result.exitCode,
+						target: targetLabel(target),
+						agentId: runCtx.agentId,
+						runId: runCtx.runId
+					}
+				});
+				return {
+					content: `exit ${result.exitCode}\n` + (result.truncated ? "(output truncated to the last 64 KiB)\n" : "") + (result.stdout ? `\n--- stdout ---\n${result.stdout}` : "") + (result.stderr ? `\n--- stderr ---\n${result.stderr}` : ""),
+					data: {
+						exitCode: result.exitCode,
+						truncated: result.truncated
+					}
+				};
+			} catch (error) {
+				return toolError(error);
+			}
+		});
+		ctx.tools.register("store_secret", toolDeclaration("store_secret"), async (params, runCtx) => {
+			const p = params ?? {};
+			const name = str(p.name);
+			if (!name) return { error: "store_secret needs a `name`" };
+			if (typeof p.value !== "string" || p.value === "") return { error: "store_secret needs a non-empty `value`" };
+			try {
+				const { config, cli } = await cliFor(ctx, runCtx.companyId);
+				const target = mergeTarget(config.target, targetFrom(params));
+				await storeSecret(cli, target, name, p.value);
+				await ctx.activity.log({
+					companyId: runCtx.companyId,
+					message: `seekrit store_secret: ${name} → ${targetLabel(target)}`,
+					metadata: {
+						name,
+						target: targetLabel(target),
+						agentId: runCtx.agentId,
+						runId: runCtx.runId
+					}
+				});
+				return {
+					content: `Stored ${name} in ${targetLabel(target)}. Do not repeat the value back — and if a human pasted it into an issue or a comment, that message still holds the plaintext and should be edited or deleted.`,
+					data: {
+						name,
+						target: targetLabel(target)
+					}
+				};
+			} catch (error) {
+				return toolError(error);
+			}
+		});
+		ctx.tools.register("proxy_config", toolDeclaration("proxy_config"), async (params, runCtx) => {
+			const p = params ?? {};
+			const presets = Array.isArray(p.presets) ? p.presets.map(String).filter(Boolean) : [];
+			if (presets.length === 0) return { error: "proxy_config needs at least one preset, e.g. [\"anthropic\"]" };
+			const mode = str(p.mode) ?? "forward";
+			if (![
+				"forward",
+				"reverse",
+				"both"
+			].includes(mode)) return { error: `mode must be forward, reverse, or both (got "${mode}")` };
+			try {
+				const { cli } = await cliFor(ctx, runCtx.companyId);
+				const result = await runSeekrit(cli, [
+					"proxy",
+					"init",
+					"--print",
+					"--mode",
+					mode,
+					...presets.flatMap((id) => ["--preset", id])
+				]);
+				if (result.exitCode !== 0) return { error: new SeekritCliError("proxy init", result.exitCode, result.stderr).message };
+				return {
+					content: result.stdout,
+					data: {
+						mode,
+						presets
+					}
+				};
+			} catch (error) {
+				return toolError(error);
+			}
+		});
+		ctx.data.register("catalogue", async (params) => {
+			const companyId = str(params.companyId);
+			if (!companyId) return { error: "no company in scope" };
+			const cached = await ctx.state.get(snapshotKey(companyId));
+			try {
+				const { config, cli } = await cliFor(ctx, companyId);
+				const target = mergeTarget(config.target, {});
+				const secrets = await listSecrets(cli, target);
+				const snapshot = {
+					target: targetLabel(target),
+					fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+					secrets
+				};
+				await ctx.state.set(snapshotKey(companyId), snapshot);
+				return {
+					...snapshot,
+					live: true,
+					allowRunCommand: config.allowRunCommand
+				};
+			} catch (error) {
+				return {
+					...cached ?? {
+						target: "?",
+						fetchedAt: null,
+						secrets: []
+					},
+					live: false,
+					error: toolError(error).error
+				};
+			}
+		});
+		ctx.actions.register("install-skills", async (params) => {
+			const companyId = str(params.companyId);
+			if (!companyId) throw new Error("no company in scope");
+			const installed = [];
+			for (const skill of MANAGED_SKILLS) {
+				await ctx.skills.managed.reconcile(skill.skillKey, companyId);
+				installed.push(skill.skillKey);
+			}
+			await ctx.activity.log({
+				companyId,
+				message: `seekrit: installed ${installed.length} skill(s) into the company library`,
+				metadata: { skills: installed }
+			});
+			return { installed };
+		});
+		ctx.logger.info("seekrit plugin ready", {
+			tools: manifest.tools?.map((t) => t.name),
+			skills: MANAGED_SKILLS.map((s) => s.skillKey)
+		});
+	},
+	async onValidateConfig(config) {
+		const errors = [];
+		const warnings = [];
+		if (!config.tokenRef) errors.push("A seekrit service token is required.");
+		else if (typeof config.tokenRef === "string") errors.push("The token must be a secret reference, not a pasted value — pick a secret with the picker so the value stays in Paperclip's secret store.");
+		if (!str(config.env)) warnings.push("No default environment. Tools will work only when a call names one explicitly.");
+		if (!str(config.app) && !str(config.group)) warnings.push("No default application or group. A token scoped to a single environment infers both; an org-scoped token does not.");
+		if (config.allowRunCommand === false) warnings.push("run_command is off — agents can list, store, and generate proxy configs only.");
+		return {
+			ok: errors.length === 0,
+			errors,
+			warnings
+		};
+	},
+	async onHealth() {
+		return {
+			status: "ok",
+			message: `${manifest.tools?.length ?? 0} tools registered`
+		};
+	}
+});
+runWorker(plugin, import.meta.url);
+/** Pull a tool's declared metadata out of the manifest, so it is stated once. */
+function toolDeclaration(name) {
+	const declared = manifest.tools?.find((t) => t.name === name);
+	if (!declared) throw new Error(`tool ${name} is not declared in the manifest`);
+	const { displayName, description, parametersSchema } = declared;
+	return {
+		displayName,
+		description,
+		parametersSchema
+	};
+}
+//#endregion
+export { plugin as default, mergeTarget, targetLabel };

package/package.json

@@ -0,0 +1,47 @@
+{
+  "name": "@seekrit/paperclip-plugin",
+  "version": "0.1.0",
+  "description": "seekrit for Paperclip — agent tools that inject end-to-end encrypted secrets into a run without the run ever holding a value, plus the seekrit skills and a company secrets panel.",
+  "type": "module",
+  "publishConfig": {
+    "access": "public"
+  },
+  "paperclipPlugin": {
+    "manifest": "./dist/manifest.js",
+    "worker": "./dist/worker.js",
+    "ui": "./dist/ui/"
+  },
+  "files": [
+    "dist"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "keywords": [
+    "paperclip",
+    "paperclip-plugin",
+    "secrets",
+    "api-keys",
+    "zero-knowledge",
+    "egress-proxy"
+  ],
+  "homepage": "https://seekrit.dev/docs/guides/ai-agents/paperclip",
+  "license": "MIT",
+  "scripts": {
+    "gen": "node gen-skills.mjs src/skills.generated.ts",
+    "build": "pnpm gen && tsdown && tsdown --config tsdown.ui.config.ts",
+    "dev": "pnpm gen && tsdown --watch",
+    "test": "pnpm gen && vitest run",
+    "typecheck": "pnpm gen && tsc --noEmit"
+  },
+  "dependencies": {
+    "@paperclipai/plugin-sdk": "2026.817.0"
+  },
+  "devDependencies": {
+    "@types/node": "^26.1.0",
+    "@types/react": "^19.2.17",
+    "react": "^19.2.0",
+    "tsdown": "^0.22.3",
+    "vitest": "^4.1.9"
+  }
+}