@vincemakes/kiso-tools-node 0.34.0 → 0.36.0

package/dist/index.d.ts

@@ -100,6 +100,12 @@ export interface WorkspaceToolsOptions {
      * name — explicit beats the heuristic, as it does for MCP servers.
      */
     readonly shellEnv?: "inherit" | Readonly<Record<string, string>>;
+    /** Astra F7: the env var NAMES the configured profiles authenticate with.
+     *  The strip's suffix rules (`_API_KEY`, `_AUTH_TOKEN`) cannot see a name
+     *  like `REVIEW_PROVIDER_TOKEN`, and only the config knows which names are
+     *  secrets — so it says so. Ignored when `shellEnv` is "inherit", which is
+     *  an explicit opt-in to the whole environment. */
+    readonly secretEnvNames?: readonly string[];
     /**
      * DC-54 — the bounds that keep a tool call finite. Every field is
      * optional and defaults to the constant beside it; a host embedding
@@ -166,6 +172,7 @@ export declare function editFileTool(opts: WorkspaceToolsOptions): Tool<{
     }[];
     expectedRevision?: string;
 }>;
+export { SHELL_STRIP_EXACT, strippedShellEnv } from "./secret-env.js";
 export declare function shellTool(opts: WorkspaceToolsOptions): Tool<{
     command: string;
     timeoutMs?: number;

package/dist/index.js

@@ -27,6 +27,7 @@ import { tmpdir } from "node:os";
 import { basename, dirname, isAbsolute, join, relative, resolve } from "node:path";
 import { defineTool } from "@vincemakes/kiso-core";
 // WR-1/WR-1A — the revision-guard primitives (unit-tested in wr1a-coda):
+import { strippedShellEnv } from "./secret-env.js";
 import { contentRevision, normalizeRevision, postEffectEscape, precondition, publishNewFile, revalidateBeforeRename } from "./wr1.js";
 /**
  * TUI2-R1 (C) — THE SHELL PROGRESS SIDECAR.
@@ -995,37 +996,15 @@ export function editFileTool(opts) {
         },
     });
 }
-/**
- * bootstrap #3 (finding #7): the explicit credential list stripped from shell
- * children — the agent's own provider surface (both families' keys, base
- * URLs, and model choices) plus the generic API-key / auth-token patterns
- * that cover other providers. Everything else in the environment passes
- * through untouched.
- */
-const SHELL_STRIP_EXACT = new Set([
-    "ANTHROPIC_API_KEY",
-    "OPENAI_API_KEY",
-    "ANTHROPIC_BASE_URL",
-    "OPENAI_BASE_URL",
-    "ANTHROPIC_MODEL",
-    "OPENAI_MODEL",
-]);
-function strippedShellEnv(env) {
-    const out = {};
-    for (const [key, value] of Object.entries(env)) {
-        if (SHELL_STRIP_EXACT.has(key))
-            continue;
-        if (key.endsWith("_API_KEY") || key.endsWith("_AUTH_TOKEN"))
-            continue;
-        if (value !== undefined)
-            out[key] = value;
-    }
-    return out;
-}
+// Astra F7: the strip is ONE implementation, shared with the MCP
+// extension's stdio children (./secret-env.ts). It used to live here
+// with a hand-kept copy over there; the copy never learned the
+// declared names, which is how MCP children kept leaking.
+export { SHELL_STRIP_EXACT, strippedShellEnv } from "./secret-env.js";
 export function shellTool(opts) {
     return defineTool({
         name: "shell",
-        description: "Run a shell command with the workspace as the working directory. A side effect — approval required. Fails loudly on timeout or non-zero exit.",
+        description: "Run a shell command through /bin/sh with the workspace root as the working directory: builds, tests, git, package managers, curl for HTTP APIs, system queries. Side effects are real; the human may be asked to approve the run. Fails loudly on timeout or non-zero exit.",
         parameters: {
             type: "object",
             properties: {
@@ -1035,7 +1014,7 @@ export function shellTool(opts) {
             required: ["command"],
             additionalProperties: false,
         },
-        promptSnippet: "shell — real system commands only (builds, tests, git)",
+        promptSnippet: "shell — any command the task needs (builds, tests, git, curl, system queries)",
         promptGuidelines: ["commands run in the workspace root; on failure read the error and adjust — never repeat blindly"],
         execute: async ({ command, timeoutMs }, ctx) => {
             const timeout = timeoutMs ?? DEFAULT_SHELL_TIMEOUT_MS;
@@ -1058,7 +1037,7 @@ export function shellTool(opts) {
                     stdio: ["ignore", "pipe", "pipe"],
                     env: opts.shellEnv === "inherit"
                         ? process.env
-                        : { ...strippedShellEnv(process.env), ...(opts.shellEnv ?? {}) },
+                        : { ...strippedShellEnv(process.env, opts.secretEnvNames), ...(opts.shellEnv ?? {}) },
                 });
                 let stdout = "";
                 let stderr = "";

package/dist/secret-env.d.ts

@@ -0,0 +1,27 @@
+/**
+ * THE child-environment strip — ONE implementation, both children.
+ *
+ * bootstrap #3 (finding #7) established the rule for shell children: the
+ * agent's own provider surface (both families' keys, base URLs and model
+ * choices) plus the generic API-key / auth-token patterns that cover other
+ * providers. Everything else passes through untouched.
+ *
+ * Astra F7 then showed the rule was incomplete AND duplicated. Incomplete:
+ * a profile's `apiKeyEnv` can be ANY name — `REVIEW_PROVIDER_TOKEN` ends in
+ * neither suffix — so the key a profile authenticates with survived into
+ * the child. Duplicated: the MCP extension carried its own copy of the list
+ * with a "keep in sync" comment, and a comment is not a mechanism; the copy
+ * did not learn the declared names and MCP stdio children kept leaking.
+ *
+ * The names must come from the caller because only the config knows which
+ * env vars are secrets. No names declared = exactly the pre-F7 behaviour,
+ * which is what a standalone extension load gets.
+ *
+ * This module imports NOTHING on purpose: the MCP extension is an esbuild
+ * bundle, and a shared rule must not drag a package graph across with it.
+ */
+/** The explicit credential list stripped from every child. */
+export declare const SHELL_STRIP_EXACT: ReadonlySet<string>;
+/** The environment a child process may see: `env` minus the exact list,
+ *  minus every DECLARED secret name, minus the two suffix families. */
+export declare function strippedShellEnv(env: Record<string, string | undefined>, secretNames?: readonly string[]): Record<string, string | undefined>;

package/dist/secret-env.js

@@ -0,0 +1,48 @@
+/**
+ * THE child-environment strip — ONE implementation, both children.
+ *
+ * bootstrap #3 (finding #7) established the rule for shell children: the
+ * agent's own provider surface (both families' keys, base URLs and model
+ * choices) plus the generic API-key / auth-token patterns that cover other
+ * providers. Everything else passes through untouched.
+ *
+ * Astra F7 then showed the rule was incomplete AND duplicated. Incomplete:
+ * a profile's `apiKeyEnv` can be ANY name — `REVIEW_PROVIDER_TOKEN` ends in
+ * neither suffix — so the key a profile authenticates with survived into
+ * the child. Duplicated: the MCP extension carried its own copy of the list
+ * with a "keep in sync" comment, and a comment is not a mechanism; the copy
+ * did not learn the declared names and MCP stdio children kept leaking.
+ *
+ * The names must come from the caller because only the config knows which
+ * env vars are secrets. No names declared = exactly the pre-F7 behaviour,
+ * which is what a standalone extension load gets.
+ *
+ * This module imports NOTHING on purpose: the MCP extension is an esbuild
+ * bundle, and a shared rule must not drag a package graph across with it.
+ */
+/** The explicit credential list stripped from every child. */
+export const SHELL_STRIP_EXACT = new Set([
+    "ANTHROPIC_API_KEY",
+    "OPENAI_API_KEY",
+    "ANTHROPIC_BASE_URL",
+    "OPENAI_BASE_URL",
+    "ANTHROPIC_MODEL",
+    "OPENAI_MODEL",
+]);
+/** The environment a child process may see: `env` minus the exact list,
+ *  minus every DECLARED secret name, minus the two suffix families. */
+export function strippedShellEnv(env, secretNames = []) {
+    const declared = new Set(secretNames);
+    const out = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (SHELL_STRIP_EXACT.has(key))
+            continue;
+        if (declared.has(key))
+            continue;
+        if (key.endsWith("_API_KEY") || key.endsWith("_AUTH_TOKEN"))
+            continue;
+        if (value !== undefined)
+            out[key] = value;
+    }
+    return out;
+}

package/package.json

@@ -1,13 +1,17 @@
 {
 	"name": "@vincemakes/kiso-tools-node",
-	"version": "0.34.0",
-	"description": "kiso coding tools for Node hosts — read file, list directory, search text, write/edit file, shell command.",
+	"version": "0.36.0",
+	"description": "kiso coding tools for Node hosts \u2014 read file, list directory, search text, write/edit file, shell command.",
 	"type": "module",
 	"license": "MIT",
 	"exports": {
 		".": {
 			"types": "./dist/index.d.ts",
 			"default": "./dist/index.js"
+		},
+		"./secret-env": {
+			"types": "./dist/secret-env.d.ts",
+			"default": "./dist/secret-env.js"
 		}
 	},
 	"files": [
@@ -21,7 +25,7 @@
 		"test": "vitest run"
 	},
 	"dependencies": {
-		"@vincemakes/kiso-core": "0.34.0"
+		"@vincemakes/kiso-core": "0.36.0"
 	},
 	"devDependencies": {
 		"@types/node": "^26.1.2",