agent-nuvira 2.7.3 → 3.0.1

package/dist/skills/secret-capture.d.ts

@@ -28,7 +28,21 @@ export interface CaptureResult {
     setupSkipped: boolean;
     /** Vars that were successfully stored. */
     storedVars: string[];
+    /**
+     * Vars REFUSED because they are provider credentials (see
+     * `isProviderEnvBlocked`). Reported separately from `missingNames` so a
+     * caller can say *why* nothing was stored instead of silently looping.
+     */
+    blockedNames?: string[];
 }
+/** Why a save/delete did not take effect (absent when it succeeded). */
+export type SecretWriteReason = 
+/** The var is a provider credential — configure it as a provider instead. */
+'provider-credential'
+/** The name is not a valid env var identifier. */
+ | 'invalid-name'
+/** The write/read failed at the filesystem layer. */
+ | 'write-failed';
 /**
  * Load all env vars from the .env file.
  */
@@ -47,9 +61,39 @@ export declare function getEnvVarValue(varName: string): string;
  * Save or update a value in ~/.nuvira/.env (or ~/.nuvira/.env).
  * Preserves existing lines, adds new ones at the end.
  */
-export declare function saveEnvValue(key: string, value: string): {
+export declare function saveEnvValue(key: string, value: string, opts?: {
+    /**
+     * Permit storing a provider credential here. Defaults to FALSE: this is the
+     * SKILL-secret path, and a provider credential stored here would be
+     * advertised as available to skills while `skill-executor` deliberately
+     * blocks it from ever reaching them. Provider keys belong in provider
+     * setup (dashboard AdminPanel / `nuvira models`), where the router also
+     * learns the provider is credentialed.
+     */
+    allowProviderCredential?: boolean;
+}): {
     success: boolean;
     path: string;
+    reason?: SecretWriteReason;
+};
+/**
+ * Remove an env var from the .env file.
+ *
+ * Rewrites the file keeping every other line — comments, blank lines and
+ * ordering — byte-for-byte, so deleting one secret never reshuffles the file
+ * a user hand-edited. Removes `KEY=...` in both plain and `export KEY=` forms,
+ * and drops only the FIRST match (a duplicate later in the file is a different
+ * line, and removing it too would be surprising).
+ *
+ * A missing file, or a key that was never there, is a SUCCESS: the caller's
+ * intent ("this var should not be set") already holds, and reporting failure
+ * would make the dashboard surface a pointless error.
+ */
+export declare function deleteEnvValue(key: string): {
+    success: boolean;
+    path: string;
+    removed: boolean;
+    reason?: SecretWriteReason;
 };
 /**
  * Capture missing env vars interactively.

package/dist/skills/secret-capture.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-capture.d.ts","sourceRoot":"","sources":["../../src/skills/secret-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAUH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AA0CD;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAapD;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAoD3F;AA4CD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,WAAW,EAAE,EAC7B,OAAO,GAAE,KAAK,GAAG,WAAmB,GACnC,OAAO,CAAC,aAAa,CAAC,CAoExB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GACtG,WAAW,EAAE,CA2Bf;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,eAAe,EAAE,MAAM,EAAE,GACxB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAc7D"}
+{"version":3,"file":"secret-capture.d.ts","sourceRoot":"","sources":["../../src/skills/secret-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AASH,MAAM,WAAW,WAAW;IAC1B,8CAA8C;IAC9C,IAAI,EAAE,MAAM,CAAC;IACb,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,oDAAoD;IACpD,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,uCAAuC;IACvC,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,aAAa;IAC5B,qDAAqD;IACrD,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,iDAAiD;IACjD,YAAY,EAAE,OAAO,CAAC;IACtB,0CAA0C;IAC1C,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB;;;;OAIG;IACH,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AAED,wEAAwE;AACxE,MAAM,MAAM,iBAAiB;AAC3B,6EAA6E;AAC3E,qBAAqB;AACvB,kDAAkD;GAChD,cAAc;AAChB,qDAAqD;GACnD,cAAc,CAAC;AAwCnB;;GAEG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAapD;AAoBD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAO1D;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAItD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAC1B,GAAG,EAAE,MAAM,EACX,KAAK,EAAE,MAAM,EACb,IAAI,GAAE;IACJ;;;;;;;OAOG;IACH,uBAAuB,CAAC,EAAE,OAAO,CAAC;CAC9B,GACL;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,CA+DhE;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,CAAC,EAAE,iBAAiB,CAAA;CAAE,CAwC5H;AA4CD;;;;;;;GAOG;AACH,wBAAsB,cAAc,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,EAAE,WAAW,EAAE,EAC7B,OAAO,GAAE,KAAK,GAAG,WAAmB,GACnC,OAAO,CAAC,aAAa,CAAC,CA8ExB;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,CAChC,eAAe,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,GACtG,WAAW,EAAE,CA2Bf;AAED;;GAEG;AACH,wBAAgB,eAAe,CAC7B,eAAe,EAAE,MAAM,EAAE,GACxB,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC,CAc7D"}

package/dist/skills/secret-capture.js

@@ -12,25 +12,20 @@
  * Hermes reference: tools/skills_tool.py:_capture_required_environment_variables()
  */
 import { existsSync, readFileSync } from 'fs';
-import { envBuff, resolveNuviraHome } from '../config/paths.js';
-import { join } from 'path';
-import { homedir } from 'os';
+import { resolveNuviraEnvFile } from '../config/paths.js';
+import { isProviderEnvBlocked } from '../config/provider-env.js';
 import { logger } from '../utils/logger.js';
 // ─── Env File Resolution ──────────────────────────────────────────────────
 /**
  * Resolve the path to the .env file.
- * Priority: NUVIRA_ENV_FILE > NUVIRA_ENV_FILE > ~/.nuvira/.env > ~/.nuvira/.env
+ * Priority: NUVIRA_ENV_FILE / BUFF_ENV_FILE > <active config dir>/.env
+ *
+ * Delegates to the shared resolver so secret capture agrees with loadEnv() and
+ * honours `NUVIRA_CONFIG_DIR` — a hardcoded `~/.nuvira/.env` here meant an
+ * isolated process could read AND write the real profile's credentials.
  */
 function envFilePath() {
-    if (process.env.NUVIRA_ENV_FILE && process.env.NUVIRA_ENV_FILE.trim().length > 0)
-        return process.env.NUVIRA_ENV_FILE;
-    const override = envBuff('ENV_FILE');
-    if (override && override.trim().length > 0)
-        return override;
-    const nuviraEnv = join(homedir(), '.nuvira', '.env');
-    if (existsSync(nuviraEnv))
-        return nuviraEnv;
-    return join(resolveNuviraHome(), '.env');
+    return resolveNuviraEnvFile();
 }
 // ─── Core Functions ───────────────────────────────────────────────────────
 /**
@@ -124,13 +119,21 @@ export function getEnvVarValue(varName) {
  * Save or update a value in ~/.nuvira/.env (or ~/.nuvira/.env).
  * Preserves existing lines, adds new ones at the end.
  */
-export function saveEnvValue(key, value) {
+export function saveEnvValue(key, value, opts = {}) {
     const path = envFilePath();
     const cleaned = value.replace(/[\r\n]/g, '');
     // Validate env var name
     if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
         logger.error(`Invalid environment variable name: ${key}`);
-        return { success: false, path };
+        return { success: false, path, reason: 'invalid-name' };
+    }
+    // Provider credentials are refused unless a caller explicitly opts in.
+    // Without this the dashboard's 🔒 badge was decorative: the endpoint accepted
+    // the key and wrote it, so a "blocked" row could be saved through the API.
+    if (!opts.allowProviderCredential && isProviderEnvBlocked(key)) {
+        logger.warn(`Refusing to store ${key} as a skill secret — it is a provider credential. ` +
+            'Configure it through provider setup instead.');
+        return { success: false, path, reason: 'provider-credential' };
     }
     const ENV_LINE_RE = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
     const pending = new Map();
@@ -170,7 +173,57 @@ export function saveEnvValue(key, value) {
     }
     catch (err) {
         logger.error(`Failed to write env file: ${err}`);
-        return { success: false, path };
+        return { success: false, path, reason: 'write-failed' };
+    }
+}
+/**
+ * Remove an env var from the .env file.
+ *
+ * Rewrites the file keeping every other line — comments, blank lines and
+ * ordering — byte-for-byte, so deleting one secret never reshuffles the file
+ * a user hand-edited. Removes `KEY=...` in both plain and `export KEY=` forms,
+ * and drops only the FIRST match (a duplicate later in the file is a different
+ * line, and removing it too would be surprising).
+ *
+ * A missing file, or a key that was never there, is a SUCCESS: the caller's
+ * intent ("this var should not be set") already holds, and reporting failure
+ * would make the dashboard surface a pointless error.
+ */
+export function deleteEnvValue(key) {
+    const path = envFilePath();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(key)) {
+        return { success: false, path, removed: false, reason: 'invalid-name' };
+    }
+    if (!existsSync(path)) {
+        return { success: true, path, removed: false };
+    }
+    const ENV_LINE_RE = /^(export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/;
+    const lines = readFileSync(path, 'utf-8').split(/\r?\n/);
+    const kept = [];
+    let removed = false;
+    for (const rawLine of lines) {
+        const m = rawLine.match(ENV_LINE_RE);
+        if (!removed && m && m[2] === key) {
+            removed = true;
+            continue;
+        }
+        kept.push(rawLine);
+    }
+    if (!removed) {
+        return { success: true, path, removed: false };
+    }
+    try {
+        const { writeFileSync } = require('fs');
+        // Drop the trailing empty element left by the final newline, then re-add
+        // exactly one — matching saveEnvValue's file shape.
+        const body = kept.filter((l, i) => !(i === kept.length - 1 && l === '')).join('\n');
+        writeFileSync(path, body.length > 0 ? `${body}\n` : '', 'utf-8');
+        logger.debug(`Removed ${key} from ${path}`);
+        return { success: true, path, removed: true };
+    }
+    catch (err) {
+        logger.error(`Failed to write env file: ${err}`);
+        return { success: false, path, removed: false, reason: 'write-failed' };
     }
 }
 // ─── Interactive Capture ──────────────────────────────────────────────────
@@ -218,10 +271,11 @@ async function promptCli(entries) {
  */
 export async function captureSecrets(skillName, missingEntries, surface = 'cli') {
     if (missingEntries.length === 0) {
-        return { missingNames: [], setupSkipped: false, storedVars: [] };
+        return { missingNames: [], setupSkipped: false, storedVars: [], blockedNames: [] };
     }
     const storedVars = [];
     const missingNames = [];
+    const blockedNames = [];
     let setupSkipped = false;
     // Filter out optional vars that aren't set — we'll prompt but allow skip
     const requiredMissing = missingEntries.filter(e => !e.optional);
@@ -244,7 +298,16 @@ export async function captureSecrets(skillName, missingEntries, surface = 'cli')
         for (const entry of missingEntries) {
             const value = answers.get(entry.name);
             if (value && value.length > 0) {
-                saveEnvValue(entry.name, value);
+                const saved = saveEnvValue(entry.name, value);
+                if (!saved.success) {
+                    // Refused (provider credential / invalid name). Do not claim it was
+                    // stored, and do not silently set it in-process either — that would
+                    // make the refusal meaningless for this run.
+                    blockedNames.push(entry.name);
+                    missingNames.push(entry.name);
+                    logger.warn(`${entry.name} was not stored (${saved.reason ?? 'refused'})`);
+                    continue;
+                }
                 process.env[entry.name] = value; // Also set in current process
                 storedVars.push(entry.name);
                 logger.success(`Saved ${entry.name}`);
@@ -278,7 +341,7 @@ export async function captureSecrets(skillName, missingEntries, surface = 'cli')
             console.log('');
         }
     }
-    return { missingNames, setupSkipped, storedVars };
+    return { missingNames, setupSkipped, storedVars, blockedNames };
 }
 /**
  * Check which required env vars are missing for a skill.

package/dist/skills/secret-capture.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-capture.js","sourceRoot":"","sources":["../../src/skills/secret-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAC,OAAO,EAAE,iBAAiB,EAAC,MAAM,iBAAiB,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAwB5C,6EAA6E;AAE7E;;;GAGG;AACH,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC9E,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACrC,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACrD,IAAI,UAAU,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC5C,OAAO,IAAI,CAAC,iBAAiB,EAAE,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAED,6EAA6E;AAE7E;;GAEG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,2BAA2B;IAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,uBAAuB;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,+DAA+D;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW,EAAE,KAAa;IACrD,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,wBAAwB;IACxB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;IAED,MAAM,WAAW,GAAG,2CAA2C,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACrC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IAClC,CAAC;AACH,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,OAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,yCAAyC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAa,EAAE,EAAE;gBACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxC,OAAO,GAAG,KAAK,CAAC,IAAI,sDAAsD,CAAC;gBAC7E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,cAA6B,EAC7B,UAA+B,KAAK;IAEpC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,CAAC;IACnE,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yEAAyE;IACzE,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE/D,gCAAgC;IAChC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,aAAa,SAAS,mCAAmC,CAAC,CAAC;QACvE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;QAEhD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,8BAA8B;gBAC/D,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,wDAAwD;QACxD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,oBAAoB,GAAG,YAAY,CAAC,MAAM,CAC9C,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CACnD,CAAC;IACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,iDAAiD,SAAS,IAAI,CAAC,CAAC;YAC5E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,CAAC;AACpD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAAuG;IAEvG,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,IAAwB,CAAC;QAC7B,IAAI,QAAiB,CAAC;QAEtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,mBAAmB,IAAI,GAAG,CAAC;YACpC,IAAI,GAAG,SAAS,CAAC;YACjB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAClB,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,mBAAmB,IAAI,GAAG,CAAC;YACpD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAClB,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,eAAyB;IAEzB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,WAA+B,CAAC;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"secret-capture.js","sourceRoot":"","sources":["../../src/skills/secret-capture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAuC5C,6EAA6E;AAE7E;;;;;;;GAOG;AACH,SAAS,WAAW;IAClB,OAAO,oBAAoB,EAAE,CAAC;AAChC,CAAC;AAED,6EAA6E;AAE7E;;GAEG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACrD,MAAM,IAAI,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC;IACpF,MAAM,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC7B,IAAI,EAAE,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3B,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACrC,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtC,2BAA2B;IAC3B,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QACnD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC7B,CAAC;IACD,uBAAuB;IACvB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACjC,IAAI,IAAI,KAAK,CAAC,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACtB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW;IACzB,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM;gBAAE,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,OAAe;IACvC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACrC,IAAI,MAAM,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO;gBAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC;QACxD,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,+DAA+D;IAC/D,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,IAAI,CAAC;IACxD,2BAA2B;IAC3B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACtC,OAAO,OAAO,CAAC,QAAQ,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AAClD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,SAAS,KAAK,IAAI,IAAI,SAAS,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IAC7D,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;AACpC,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAC1B,GAAW,EACX,KAAa,EACb,OAUI,EAAE;IAEN,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IAE7C,wBAAwB;IACxB,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,MAAM,CAAC,KAAK,CAAC,sCAAsC,GAAG,EAAE,CAAC,CAAC;QAC1D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,CAAC;IAED,uEAAuE;IACvE,8EAA8E;IAC9E,2EAA2E;IAC3E,IAAI,CAAC,IAAI,CAAC,uBAAuB,IAAI,oBAAoB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/D,MAAM,CAAC,IAAI,CACT,qBAAqB,GAAG,oDAAoD;YAC5E,8CAA8C,CAC/C,CAAC;QACF,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,WAAW,GAAG,2CAA2C,CAAC;IAChE,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC1C,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAC1B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YACjE,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC;gBACN,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;gBACf,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;oBACnB,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;oBACrC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;oBAClB,SAAS;gBACX,CAAC;YACH,CAAC;YACD,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC1B,CAAC;IAED,0BAA0B;IAC1B,MAAM,EAAE,SAAS,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,EAAE,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS;IACX,CAAC;IAED,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACtD,MAAM,CAAC,KAAK,CAAC,SAAS,GAAG,OAAO,IAAI,EAAE,CAAC,CAAC;QACxC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1D,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,MAAM,IAAI,GAAG,WAAW,EAAE,CAAC;IAE3B,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1C,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1E,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IAED,MAAM,WAAW,GAAG,2CAA2C,CAAC;IAChE,MAAM,KAAK,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACzD,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,KAAK,MAAM,OAAO,IAAI,KAAK,EAAE,CAAC;QAC5B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;QACrC,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,GAAG,EAAE,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;YACf,SAAS;QACX,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACrB,CAAC;IAED,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACjD,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,aAAa,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QACxC,yEAAyE;QACzE,oDAAoD;QACpD,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpF,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,CAAC,KAAK,CAAC,WAAW,GAAG,SAAS,IAAI,EAAE,CAAC,CAAC;QAC5C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,6BAA6B,GAAG,EAAE,CAAC,CAAC;QACjD,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC1E,CAAC;AACH,CAAC;AAED,6EAA6E;AAE7E;;;GAGG;AACH,KAAK,UAAU,SAAS,CACtB,OAAsB;IAEtB,MAAM,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE1C,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU;YAC3C,IAAI,EAAE,KAAK,CAAC,IAAI;YAChB,OAAO,EAAE,KAAK,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,yCAAyC;YACzC,QAAQ,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAa,EAAE,EAAE;gBACxD,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;oBACxC,OAAO,GAAG,KAAK,CAAC,IAAI,sDAAsD,CAAC;gBAC7E,CAAC;gBACD,OAAO,IAAI,CAAC;YACd,CAAC;SACF,CAAC,CAAC,CAAC;QAEJ,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACxD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACjC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;QACH,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,gDAAgD;QAChD,MAAM,CAAC,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,SAAiB,EACjB,cAA6B,EAC7B,UAA+B,KAAK;IAEpC,IAAI,cAAc,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,EAAE,YAAY,EAAE,EAAE,EAAE,CAAC;IACrF,CAAC;IAED,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,MAAM,YAAY,GAAa,EAAE,CAAC;IAClC,IAAI,YAAY,GAAG,KAAK,CAAC;IAEzB,yEAAyE;IACzE,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAChE,MAAM,eAAe,GAAG,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IAE/D,gCAAgC;IAChC,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,MAAM,CAAC,IAAI,CAAC,aAAa,SAAS,mCAAmC,CAAC,CAAC;QACvE,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,GAAG,GAAG,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC;YACzD,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,CAAC,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtD,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;IAED,oBAAoB;IACpB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,OAAO,GAAG,MAAM,SAAS,CAAC,cAAc,CAAC,CAAC;QAEhD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACtC,IAAI,KAAK,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;gBAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;oBACnB,oEAAoE;oBACpE,oEAAoE;oBACpE,6CAA6C;oBAC7C,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC9B,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;oBAC9B,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,IAAI,oBAAoB,KAAK,CAAC,MAAM,IAAI,SAAS,GAAG,CAAC,CAAC;oBAC3E,SAAS;gBACX,CAAC;gBACD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC,8BAA8B;gBAC/D,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC5B,MAAM,CAAC,OAAO,CAAC,SAAS,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACxC,CAAC;iBAAM,IAAI,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC1B,sCAAsC;gBACtC,MAAM,CAAC,IAAI,CAAC,wBAAwB,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;YACpD,CAAC;iBAAM,CAAC;gBACN,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;SAAM,CAAC;QACN,iEAAiE;QACjE,wDAAwD;QACxD,KAAK,MAAM,KAAK,IAAI,cAAc,EAAE,CAAC;YACnC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,MAAM,oBAAoB,GAAG,YAAY,CAAC,MAAM,CAC9C,IAAI,CAAC,EAAE,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CACnD,CAAC;IACF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpC,YAAY,GAAG,IAAI,CAAC;QACpB,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,MAAM,CAAC,IAAI,CAAC,iDAAiD,SAAS,IAAI,CAAC,CAAC;YAC5E,KAAK,MAAM,IAAI,IAAI,oBAAoB,EAAE,CAAC;gBACxC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,YAAY,CAAC,CAAC;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAChC,eAAuG;IAEvG,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,KAAK,MAAM,KAAK,IAAI,eAAe,EAAE,CAAC;QACpC,IAAI,IAAY,CAAC;QACjB,IAAI,MAAc,CAAC;QACnB,IAAI,IAAwB,CAAC;QAC7B,IAAI,QAAiB,CAAC;QAEtB,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,IAAI,GAAG,KAAK,CAAC;YACb,MAAM,GAAG,mBAAmB,IAAI,GAAG,CAAC;YACpC,IAAI,GAAG,SAAS,CAAC;YACjB,QAAQ,GAAG,KAAK,CAAC;QACnB,CAAC;aAAM,CAAC;YACN,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAClB,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,mBAAmB,IAAI,GAAG,CAAC;YACpD,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;YAClB,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,KAAK,CAAC;QACrC,CAAC;QAED,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7B,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,eAAe,CAC7B,eAAyB;IAEzB,OAAO,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE;QAChC,MAAM,GAAG,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;QACpC,IAAI,WAA+B,CAAC;QACpC,IAAI,GAAG,EAAE,CAAC;YACR,MAAM,KAAK,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;YACnC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACrB,WAAW,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5D,CAAC;iBAAM,CAAC;gBACN,WAAW,GAAG,KAAK,CAAC;YACtB,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/skills/skill-env-inventory.d.ts

@@ -0,0 +1,79 @@
+/**
+ * Skill env-var inventory — the data behind the dashboard's environment
+ * variable editor.
+ *
+ * The editor (`web-dashboard/src/components/EnvVarEditor.tsx`) was written
+ * against exactly this shape (`name`, `value`, `isSet`, `requiredBy`,
+ * `description`, `isProviderCredential`) and had no producer: the write
+ * endpoint existed for skill secrets, but nothing ever reported which vars are
+ * wanted, which are set, or which rows are provider credentials. So the panel
+ * was unreachable and the credential boundary it draws was unenforced.
+ *
+ * ## The domain boundary (this is the supersede-or-extend decision)
+ *
+ * Three dashboard surfaces touch credentials and they do NOT overlap:
+ *
+ *   - `AdminPanel` / provider setup → **provider** credentials
+ *     (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, …). Writing one there is what
+ *     makes the router see the provider as credentialed.
+ *   - `PlatformsPage` / `PlatformConfigSection` → **platform** credentials
+ *     (Twilio/SMTP/…), sourced from `PLATFORM_ENV_VARS`.
+ *   - **this module** → **skill** env vars: the vars a skill declares it needs,
+ *     which are injected into a skill execution and nothing else.
+ *
+ * The boundary is enforced, not advisory: a provider credential is reported
+ * here with `isProviderCredential: true` (so the user understands why the row
+ * is locked) and `saveEnvValue` refuses to write it through the skill path.
+ * Platform-owned vars are excluded entirely — they are editable in the surface
+ * that owns their semantics.
+ */
+/** One row of the env-var editor. Structurally the component's `EnvVar`. */
+export interface SkillEnvVarRow {
+    /** Variable name. */
+    name: string;
+    /** Masked value when set ('' when unset — a real value never leaves here). */
+    value: string;
+    /** Whether a non-empty value is persisted or present in the environment. */
+    isSet: boolean;
+    /** Installed skill that declares this var (absent for a hand-set secret). */
+    requiredBy?: string;
+    /** Skill description, used as the row's help text. */
+    description?: string;
+    /** True for provider credentials — shown 🔒 and not editable in this editor. */
+    isProviderCredential?: boolean;
+}
+export interface SkillEnvInventoryOptions {
+    /** Project root to scan for `.agents/skills` (defaults to cwd). */
+    projectRoot?: string;
+    /** Home dir to scan for `~/.nuvira/skills` (defaults to the real home). */
+    home?: string;
+}
+/**
+ * Build the editor's row set:
+ *
+ *   1. Every var REQUIRED by an installed hub skill (set or not) — these are
+ *      the rows a user needs to act on, so an unset one must appear as ❌.
+ *   2. Every persisted .env var that is not a provider credential and not
+ *      platform-owned — hand-set skill secrets, which would otherwise be
+ *      invisible once written.
+ *   3. Provider credentials that are present in the file, flagged so the user
+ *      sees the boundary instead of silently wondering where the key went.
+ *
+ * Never throws: a missing skills root or unreadable .env simply contributes
+ * nothing, because a broken inventory must not blank the page.
+ */
+export declare function readSkillEnvInventory(opts?: SkillEnvInventoryOptions): SkillEnvVarRow[];
+/**
+ * Can a SKILL actually consume this variable right now?
+ *
+ * This is what the editor's "🧪 Test" button asks — not "is this API key
+ * valid" (which would need a paid provider call per keystroke), but the
+ * question the panel can answer truthfully: *will a skill run see this value?*
+ * That is exactly the set of conditions `skill-tool` checks before executing,
+ * so the verdict matches what execution will really do.
+ */
+export declare function probeSkillEnvVar(name: string): {
+    usable: boolean;
+    detail: string;
+};
+//# sourceMappingURL=skill-env-inventory.d.ts.map

package/dist/skills/skill-env-inventory.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-env-inventory.d.ts","sourceRoot":"","sources":["../../src/skills/skill-env-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAOH,4EAA4E;AAC5E,MAAM,WAAW,cAAc;IAC7B,qBAAqB;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,KAAK,EAAE,OAAO,CAAC;IACf,6EAA6E;IAC7E,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,sDAAsD;IACtD,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,gFAAgF;IAChF,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC;AAsBD,MAAM,WAAW,wBAAwB;IACvC,mEAAmE;IACnE,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,2EAA2E;IAC3E,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,qBAAqB,CACnC,IAAI,GAAE,wBAA6B,GAClC,cAAc,EAAE,CAgElB;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAyBlF"}

package/dist/skills/skill-env-inventory.js

@@ -0,0 +1,167 @@
+/**
+ * Skill env-var inventory — the data behind the dashboard's environment
+ * variable editor.
+ *
+ * The editor (`web-dashboard/src/components/EnvVarEditor.tsx`) was written
+ * against exactly this shape (`name`, `value`, `isSet`, `requiredBy`,
+ * `description`, `isProviderCredential`) and had no producer: the write
+ * endpoint existed for skill secrets, but nothing ever reported which vars are
+ * wanted, which are set, or which rows are provider credentials. So the panel
+ * was unreachable and the credential boundary it draws was unenforced.
+ *
+ * ## The domain boundary (this is the supersede-or-extend decision)
+ *
+ * Three dashboard surfaces touch credentials and they do NOT overlap:
+ *
+ *   - `AdminPanel` / provider setup → **provider** credentials
+ *     (`OPENAI_API_KEY`, `ANTHROPIC_API_KEY`, …). Writing one there is what
+ *     makes the router see the provider as credentialed.
+ *   - `PlatformsPage` / `PlatformConfigSection` → **platform** credentials
+ *     (Twilio/SMTP/…), sourced from `PLATFORM_ENV_VARS`.
+ *   - **this module** → **skill** env vars: the vars a skill declares it needs,
+ *     which are injected into a skill execution and nothing else.
+ *
+ * The boundary is enforced, not advisory: a provider credential is reported
+ * here with `isProviderCredential: true` (so the user understands why the row
+ * is locked) and `saveEnvValue` refuses to write it through the skill path.
+ * Platform-owned vars are excluded entirely — they are editable in the surface
+ * that owns their semantics.
+ */
+import { loadEnvFile, isEnvVarPersisted, getEnvVarValue } from './secret-capture.js';
+import { readHubCatalog } from '../learning/hub-skill-catalog.js';
+import { isProviderEnvBlocked } from '../config/provider-env.js';
+import { PLATFORM_ENV_VARS } from '../gateway/channel-directory.js';
+/** Every env var claimed by a messaging platform (owned by PlatformsPage). */
+function platformOwnedVars() {
+    const out = new Set();
+    for (const vars of Object.values(PLATFORM_ENV_VARS)) {
+        for (const v of vars)
+            out.add(v);
+    }
+    return out;
+}
+/**
+ * Mask a secret for display. Mirrors `redactValue`'s intent (first/last 4) but
+ * is deliberately stricter here: the dashboard only ever needs to prove a value
+ * EXISTS, and a 4-char prefix of an API key is already meaningful.
+ */
+function maskValue(value) {
+    if (value.length === 0)
+        return '';
+    if (value.length <= 8)
+        return '••••••••';
+    return `${value.slice(0, 3)}••••${value.slice(-2)}`;
+}
+/**
+ * Build the editor's row set:
+ *
+ *   1. Every var REQUIRED by an installed hub skill (set or not) — these are
+ *      the rows a user needs to act on, so an unset one must appear as ❌.
+ *   2. Every persisted .env var that is not a provider credential and not
+ *      platform-owned — hand-set skill secrets, which would otherwise be
+ *      invisible once written.
+ *   3. Provider credentials that are present in the file, flagged so the user
+ *      sees the boundary instead of silently wondering where the key went.
+ *
+ * Never throws: a missing skills root or unreadable .env simply contributes
+ * nothing, because a broken inventory must not blank the page.
+ */
+export function readSkillEnvInventory(opts = {}) {
+    const rows = new Map();
+    const platformOwned = platformOwnedVars();
+    const put = (row) => {
+        // First writer wins so a provider-credential flag survives a later skill
+        // row for the same name (the skill row carries no flag).
+        if (rows.has(row.name)) {
+            const existing = rows.get(row.name);
+            existing.requiredBy ??= row.requiredBy;
+            existing.description ??= row.description;
+            existing.isProviderCredential ||= row.isProviderCredential;
+            return;
+        }
+        rows.set(row.name, row);
+    };
+    // ── 1. Declared by installed skills ──────────────────────────────────────
+    try {
+        const catalog = readHubCatalog(opts.projectRoot ?? process.cwd(), opts.home);
+        for (const skill of catalog) {
+            for (const name of skill.requiredEnvVars ?? []) {
+                const isSet = isEnvVarPersisted(name);
+                put({
+                    name,
+                    value: isSet ? maskValue(getEnvVarValue(name)) : '',
+                    isSet,
+                    requiredBy: skill.name,
+                    description: skill.description,
+                    isProviderCredential: isProviderEnvBlocked(name) || undefined,
+                });
+            }
+        }
+    }
+    catch {
+        // Best-effort — an unreadable catalog contributes nothing.
+    }
+    // ── 2 + 3. What is actually in the env file ─────────────────────────────
+    try {
+        for (const [name, rawValue] of Object.entries(loadEnvFile())) {
+            if (platformOwned.has(name))
+                continue; // owned by PlatformsPage
+            if (isProviderEnvBlocked(name)) {
+                put({
+                    name,
+                    value: maskValue(rawValue),
+                    isSet: rawValue.length > 0,
+                    description: 'Provider credential — manage this in provider setup, not here.',
+                    isProviderCredential: true,
+                });
+                continue;
+            }
+            // `put` (not an unconditional set) so a skill-declared row keeps its
+            // `requiredBy` attribution.
+            put({
+                name,
+                value: maskValue(rawValue),
+                isSet: rawValue.length > 0,
+            });
+        }
+    }
+    catch {
+        // Best-effort.
+    }
+    return [...rows.values()].sort((a, b) => a.name.localeCompare(b.name));
+}
+/**
+ * Can a SKILL actually consume this variable right now?
+ *
+ * This is what the editor's "🧪 Test" button asks — not "is this API key
+ * valid" (which would need a paid provider call per keystroke), but the
+ * question the panel can answer truthfully: *will a skill run see this value?*
+ * That is exactly the set of conditions `skill-tool` checks before executing,
+ * so the verdict matches what execution will really do.
+ */
+export function probeSkillEnvVar(name) {
+    if (isProviderEnvBlocked(name)) {
+        return {
+            usable: false,
+            detail: `${name} is a provider credential and is blocked from skill execution by design. ` +
+                'Configure it in provider setup — skills never receive it.',
+        };
+    }
+    if (platformOwnedVars().has(name)) {
+        return {
+            usable: false,
+            detail: `${name} is a platform credential — configure it on the Platforms page.`,
+        };
+    }
+    if (!isEnvVarPersisted(name)) {
+        return {
+            usable: false,
+            detail: `${name} is not set. Add a value to make it available to skills.`,
+        };
+    }
+    return {
+        usable: true,
+        detail: `${name} is set and will be passed to skill executions that require it.`,
+    };
+}
+//# sourceMappingURL=skill-env-inventory.js.map

package/dist/skills/skill-env-inventory.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"skill-env-inventory.js","sourceRoot":"","sources":["../../src/skills/skill-env-inventory.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,WAAW,EAAE,iBAAiB,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrF,OAAO,EAAE,cAAc,EAAE,MAAM,kCAAkC,CAAC;AAClE,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AACjE,OAAO,EAAE,iBAAiB,EAAE,MAAM,iCAAiC,CAAC;AAkBpE,8EAA8E;AAC9E,SAAS,iBAAiB;IACxB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACpD,KAAK,MAAM,CAAC,IAAI,IAAI;YAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACnC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,KAAa;IAC9B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAClC,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC;QAAE,OAAO,UAAU,CAAC;IACzC,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtD,CAAC;AASD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CACnC,OAAiC,EAAE;IAEnC,MAAM,IAAI,GAAG,IAAI,GAAG,EAA0B,CAAC;IAC/C,MAAM,aAAa,GAAG,iBAAiB,EAAE,CAAC;IAE1C,MAAM,GAAG,GAAG,CAAC,GAAmB,EAAQ,EAAE;QACxC,yEAAyE;QACzE,yDAAyD;QACzD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC;YACrC,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC,UAAU,CAAC;YACvC,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,WAAW,CAAC;YACzC,QAAQ,CAAC,oBAAoB,KAAK,GAAG,CAAC,oBAAoB,CAAC;YAC3D,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1B,CAAC,CAAC;IAEF,4EAA4E;IAC5E,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,cAAc,CAAC,IAAI,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7E,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC5B,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,eAAe,IAAI,EAAE,EAAE,CAAC;gBAC/C,MAAM,KAAK,GAAG,iBAAiB,CAAC,IAAI,CAAC,CAAC;gBACtC,GAAG,CAAC;oBACF,IAAI;oBACJ,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;oBACnD,KAAK;oBACL,UAAU,EAAE,KAAK,CAAC,IAAI;oBACtB,WAAW,EAAE,KAAK,CAAC,WAAW;oBAC9B,oBAAoB,EAAE,oBAAoB,CAAC,IAAI,CAAC,IAAI,SAAS;iBAC9D,CAAC,CAAC;YACL,CAAC;QACH,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IAED,2EAA2E;IAC3E,IAAI,CAAC;QACH,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC7D,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,SAAS,CAAC,yBAAyB;YAChE,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC/B,GAAG,CAAC;oBACF,IAAI;oBACJ,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;oBAC1B,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;oBAC1B,WAAW,EAAE,gEAAgE;oBAC7E,oBAAoB,EAAE,IAAI;iBAC3B,CAAC,CAAC;gBACH,SAAS;YACX,CAAC;YACD,qEAAqE;YACrE,4BAA4B;YAC5B,GAAG,CAAC;gBACF,IAAI;gBACJ,KAAK,EAAE,SAAS,CAAC,QAAQ,CAAC;gBAC1B,KAAK,EAAE,QAAQ,CAAC,MAAM,GAAG,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IAED,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,IAAI,oBAAoB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EACJ,GAAG,IAAI,2EAA2E;gBAClF,2DAA2D;SAC9D,CAAC;IACJ,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,GAAG,IAAI,iEAAiE;SACjF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7B,OAAO;YACL,MAAM,EAAE,KAAK;YACb,MAAM,EAAE,GAAG,IAAI,0DAA0D;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,MAAM,EAAE,GAAG,IAAI,iEAAiE;KACjF,CAAC;AACJ,CAAC"}

package/dist/skills/skill-executor.d.ts

@@ -11,6 +11,8 @@
  * 3. Spawns a sandboxed process with API keys injected
  * 4. Captures output and returns it to the agent
  */
+import { PROVIDER_ENV_BLOCKLIST } from '../config/provider-env.js';
+export { PROVIDER_ENV_BLOCKLIST };
 export type SkillRuntime = 'python' | 'node' | 'shell' | 'ruby' | 'go' | 'rust' | 'auto';
 export interface SkillExecutionResult {
     success: boolean;

package/dist/skills/skill-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"skill-executor.d.ts","sourceRoot":"","sources":["../../src/skills/skill-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAWH,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID;;GAEG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,YAAY,CA2Dd;AAID;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAyG/B;AAoKD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAM/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBxB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAoB/B"}
+{"version":3,"file":"skill-executor.d.ts","sourceRoot":"","sources":["../../src/skills/skill-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAaH,OAAO,EAAE,sBAAsB,EAAqB,MAAM,2BAA2B,CAAC;AAEtF,OAAO,EAAE,sBAAsB,EAAE,CAAC;AAIlC,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,CAAC;AAEzF,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,YAAY,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,qBAAqB;IACpC,0CAA0C;IAC1C,GAAG,EAAE,MAAM,CAAC;IACZ,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,sCAAsC;IACtC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,6CAA6C;IAC7C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kDAAkD;IAClD,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,wDAAwD;IACxD,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAID;;GAEG;AACH,wBAAgB,aAAa,CAC3B,YAAY,EAAE,MAAM,EACpB,QAAQ,CAAC,EAAE,MAAM,GAChB,YAAY,CA2Dd;AAID;;;;;;;GAOG;AACH,wBAAsB,YAAY,CAChC,aAAa,EAAE,MAAM,EACrB,OAAO,EAAE,qBAAqB,EAC9B,QAAQ,CAAC,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,CAAC,CAkH/B;AAgJD;;GAEG;AACH,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,MAAM,EAAE,GAAG,IAAI,CAM/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CACvC,YAAY,EAAE,MAAM,EAAE,GACrB,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAkBxB;AAED;;GAEG;AACH,wBAAgB,mBAAmB,IAAI,IAAI,CAE1C;AAED;;GAEG;AACH,wBAAgB,uBAAuB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE7D;AAID;;;;;;;;;;GAUG;AACH,wBAAsB,uBAAuB,CAC3C,SAAS,EAAE,MAAM,EACjB,OAAO,EAAE,qBAAqB,GAC7B,OAAO,CAAC,oBAAoB,CAAC,CAoB/B"}

package/dist/skills/skill-executor.js

@@ -17,6 +17,12 @@ import { existsSync } from 'node:fs';
 import { join, extname } from 'node:path';
 import { tmpdir } from 'node:os';
 import { randomBytes } from 'node:crypto';
+// The provider-credential blocklist lives in a shared leaf module so the SAME
+// set also guards the skill-secret write path and the dashboard's env-var
+// editor. Two copies meant the editor could mark a key "blocked" while the
+// writer stored it anyway — a cosmetic invariant with no enforcement.
+import { PROVIDER_ENV_BLOCKLIST, isSensitiveEnvVar } from '../config/provider-env.js';
+export { PROVIDER_ENV_BLOCKLIST };
 // ─── Runtime Detection ───────────────────────────────────────────────────
 /**
  * Detect the runtime for a skill based on its content or file extension.
@@ -98,12 +104,21 @@ export async function executeSkill(scriptContent, context, filePath) {
     const runtime = detectRuntime(scriptContent, filePath);
     const timeoutMs = context.timeoutMs ?? 30_000;
     const maxOutputBytes = context.maxOutputBytes ?? 1_024 * 1024;
-    // Filter env vars: blocklist prevents automatic passthrough from process.env,
-    // but explicit caller-provided env vars are always allowed (caller knows what they're doing).
+    // Filter env vars: the blocklist prevents automatic passthrough from
+    // process.env, but explicit caller-provided env vars are always allowed
+    // (caller knows what they're doing).
+    //
+    // The automatic passthrough uses `isSensitiveEnvVar`, not just the provider
+    // list, because the provider list only knows OUR providers: a platform
+    // password (BUFF_SMTP_PASSWORD) or a user's own cloud credential in this
+    // process's environment was previously handed to every skill with a shell.
+    // Benign vars (PATH, HOME, LANG, …) still flow — see the shape-rule rationale
+    // in config/provider-env.ts.
     const filteredEnv = {};
-    // First, add process.env vars that are NOT in the blocklist
+    // First, add process.env vars that are neither provider credentials nor
+    // credential-shaped.
     for (const [key, value] of Object.entries(process.env)) {
-        if (value !== undefined && !PROVIDER_ENV_BLOCKLIST.has(key)) {
+        if (value !== undefined && !isSensitiveEnvVar(key)) {
             filteredEnv[key] = value;
         }
     }
@@ -303,26 +318,6 @@ async function spawnProcess(command, args, options) {
  * allowed to pass through to the sandbox, while provider credentials
  * (ANTHROPIC_API_KEY, OPENAI_API_KEY, etc.) are blocked for security.
  */
-/** Provider env vars that should NEVER be passed to skills */
-const PROVIDER_ENV_BLOCKLIST = new Set([
-    'ANTHROPIC_API_KEY',
-    'ANTHROPIC_TOKEN',
-    'OPENAI_API_KEY',
-    'OPENAI_TOKEN',
-    'GROQ_API_KEY',
-    'GEMINI_API_KEY',
-    'GOOGLE_API_KEY',
-    'MISTRAL_API_KEY',
-    'COHERE_API_KEY',
-    'TOGETHER_API_KEY',
-    'DEEPINFRA_API_KEY',
-    'FIREWORKS_API_KEY',
-    'OPENROUTER_API_KEY',
-    'AZURE_OPENAI_API_KEY',
-    'BEDROCK_ACCESS_KEY',
-    'BEDROCK_SECRET_KEY',
-    'NUVIRA_API_KEY', // Don't pass the agent's own key
-]);
 /** Session-scoped allowlist of env vars that can pass through */
 let sessionAllowlist = new Set();
 /**