aidevops 3.32.43 → 3.32.46

package/README.md

@@ -60,7 +60,7 @@ The result: an AI operations platform that manages projects across every busines
 [![Copyright](https://img.shields.io/badge/Copyright-Marcus%20Quinn%202025--2026-blue.svg)](https://github.com/marcusquinn)
 
 <!-- Release & Version Info -->
-[![Version](https://img.shields.io/badge/Version-3.32.43-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
+[![Version](https://img.shields.io/badge/Version-3.32.46-blue.svg)](https://github.com/marcusquinn/aidevops/releases)
 [![npm version](https://img.shields.io/npm/v/aidevops)](https://www.npmjs.com/package/aidevops)
 [![Homebrew](https://img.shields.io/badge/homebrew-marcusquinn%2Ftap-orange)](https://github.com/marcusquinn/homebrew-tap)
 [![GitHub repository](https://img.shields.io/badge/github-repository-181717.svg?logo=github)](https://github.com/marcusquinn/aidevops)

package/VERSION

@@ -1 +1 @@
-3.32.43
+3.32.46

package/aidevops.sh

@@ -5,7 +5,7 @@
 # AI DevOps Framework CLI
 # Usage: aidevops <command> [options]
 #
-# Version: 3.32.43
+# Version: 3.32.46
 
 set -euo pipefail
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aidevops",
-  "version": "3.32.43",
+  "version": "3.32.46",
   "description": "AI DevOps Framework - AI-assisted development workflows, code quality, and deployment automation",
   "type": "module",
   "workspaces": [

package/packages/gui-api/src/status-adapter.ts

@@ -42,6 +42,7 @@ import {
 import { readLocalReposSetupSummary } from "./status-local-repos";
 import { readManagedApps } from "./status-managed-apps";
 import { readPulseWorkersSummary } from "./status-pulse-workers";
+import { readSecretInventory } from "./status-inventory";
 import { readVaultSummary } from "./status-vault";
 
 export { readVaultSummary } from "./status-vault";
@@ -82,6 +83,7 @@ export function readStatus(
   const opencodeSessions = readOpenCodeSessions(opencodeDbPath, opencodeDbPathRef, localRepos.repos);
   const oauthPool = readOAuthPoolSummary(oauthPoolPath, oauthPoolPathRef);
   const vault = readVaultSummary(repoRoot);
+  const secretInventory = readSecretInventory(repoRoot, vault);
   const pulseWorkers = readPulseWorkersSummary({ observedAt: options.observedAt, oauthPoolPath, ...options.pulseWorkers });
   const notifications = buildStatusNotifications({
     aiApps,
@@ -153,7 +155,8 @@ export function readStatus(
     notifications,
     vault,
     pulse_workers: pulseWorkers.summary,
-    secrets: vault.unlocked ? statusFixture.secrets : [],
+    secrets: vault.unlocked ? secretInventory.secrets : [],
+    secret_backends: vault.unlocked ? secretInventory.backends : statusFixture.secret_backends,
   };
 
   const envelope = createEnvelope({

package/packages/gui-api/src/status-inventory.ts

@@ -0,0 +1,86 @@
+import { spawnSync } from "node:child_process";
+import { lstatSync } from "node:fs";
+import { join } from "node:path";
+import type { GuiSecretReference, GuiVaultStatusData } from "../../gui-shared/src";
+import { readVaultSummary } from "./status-vault";
+
+type BackendState = "available" | "missing" | "error";
+type SecretInventory = {
+  version: 1;
+  backends: { gopass: BackendState; credentials: BackendState };
+  secrets: GuiSecretReference[];
+};
+
+const EMPTY_INVENTORY: Omit<SecretInventory, "version"> = {
+  backends: { gopass: "missing", credentials: "missing" },
+  secrets: [],
+};
+const BACKEND_STATES = new Set<unknown>(["available", "missing", "error"]);
+
+export function readSecretInventory(repoRoot: string, vault: GuiVaultStatusData): Omit<SecretInventory, "version"> {
+  if (!isAuthoritativelyUnlocked(vault)) return EMPTY_INVENTORY;
+  const helperPath = join(repoRoot, ".agents", "scripts", "secret-helper.sh");
+  if (!isTrustedHelper(helperPath)) return EMPTY_INVENTORY;
+  const result = spawnSync("/bin/bash", [helperPath, "inventory"], {
+    encoding: "utf8",
+    env: inventoryEnvironment(),
+    maxBuffer: 65_536,
+    stdio: ["ignore", "pipe", "ignore"],
+    timeout: 300,
+  });
+  if (result.error !== undefined || result.signal !== null || result.status !== 0 || result.stdout.length > 65_535) return EMPTY_INVENTORY;
+  return parseUnlockedInventory(result.stdout, repoRoot);
+}
+
+function parseUnlockedInventory(output: string, repoRoot: string): Omit<SecretInventory, "version"> {
+  try {
+    const inventory: unknown = JSON.parse(output);
+    const confirmed = readVaultSummary(repoRoot);
+    return isInventory(inventory) && isAuthoritativelyUnlocked(confirmed)
+      ? { backends: inventory.backends, secrets: inventory.secrets }
+      : EMPTY_INVENTORY;
+  } catch {
+    return EMPTY_INVENTORY;
+  }
+}
+
+function isAuthoritativelyUnlocked(vault: GuiVaultStatusData): boolean {
+  return vault.status === "unlocked" && vault.unlocked && !vault.locked && vault.helper_status === "available";
+}
+
+function isTrustedHelper(path: string): boolean {
+  try {
+    const stat = lstatSync(path);
+    return stat.isFile() && !stat.isSymbolicLink() && stat.uid === process.getuid?.() && (stat.mode & 0o022) === 0;
+  } catch {
+    return false;
+  }
+}
+
+function isInventory(value: unknown): value is SecretInventory {
+  if (!isRecord(value) || value.version !== 1 || !Array.isArray(value.secrets) || value.secrets.length > 512) return false;
+  if (!isRecord(value.backends) || Object.keys(value).length !== 3 || Object.keys(value.backends).length !== 2) return false;
+  if (!BACKEND_STATES.has(value.backends.gopass) || !BACKEND_STATES.has(value.backends.credentials)) return false;
+  return value.secrets.every((secret, index) => isSecretReference(secret, index === 0 ? "" : value.secrets[index - 1]?.name));
+}
+
+function isSecretReference(value: unknown, previousName: string | undefined): value is GuiSecretReference {
+  if (!isRecord(value) || typeof value.name !== "string") return false;
+  return /^[A-Z][A-Z0-9_]{0,127}$/.test(value.name)
+    && value.status === "configured"
+    && value.name > (previousName ?? "")
+    && Object.keys(value).every((key) => key === "name" || key === "status");
+}
+
+function isRecord(value: unknown): value is Record<string, unknown> {
+  return typeof value === "object" && value !== null;
+}
+
+function inventoryEnvironment(): NodeJS.ProcessEnv {
+  const environment: NodeJS.ProcessEnv = { PATH: "/usr/bin:/bin:/usr/sbin:/sbin" };
+  for (const name of ["HOME", "XDG_CONFIG_HOME", "XDG_RUNTIME_DIR", "AIDEVOPS_VAULT_DIR", "AIDEVOPS_VAULT_RUNTIME_DIR", "AIDEVOPS_VAULT_PYTHON"]) {
+    const value = process.env[name];
+    if (value !== undefined) environment[name] = value;
+  }
+  return environment;
+}

package/packages/gui-desktop/scripts/install-macos-app.sh

@@ -202,9 +202,27 @@ run_vault_command() {
   local action="\$1"
   local command_name=""
   case "\$action" in
-    init|unlock|lock|status|lost-passphrase) command_name="\$action" ;;
+    init|unlock|lock) command_name="\$action" ;;
     *) printf 'Unsupported Vault action\n' >&2; return 2 ;;
   esac
+  local trusted_path=""
+  for trusted_path in \
+    "\${REPO_ROOT}/aidevops.sh" \
+    "\${REPO_ROOT}/.agents/scripts/vault-helper.sh" \
+    "\${REPO_ROOT}/.agents/scripts/vault_crypto_core.py"; do
+    if [[ ! -f "\${trusted_path}" || -L "\${trusted_path}" ]]; then
+      printf 'Untrusted Vault helper chain\n' >&2
+      return 2
+    fi
+    local owner_mode=""
+    owner_mode="\$(/usr/bin/stat -f '%u %Lp' "\${trusted_path}" 2>/dev/null)" || return 2
+    local owner="\${owner_mode%% *}"
+    local mode="\${owner_mode##* }"
+    if [[ "\${owner}" != "\$(/usr/bin/id -u)" || \$((8#\${mode} & 8#022)) -ne 0 ]]; then
+      printf 'Untrusted Vault helper chain\n' >&2
+      return 2
+    fi
+  done
   AIDEVOPS_SESSION_ID="gui-desktop" exec /bin/bash "\${REPO_ROOT}/aidevops.sh" vault "\$command_name"
   return 1
 }
@@ -451,6 +469,7 @@ write_webview_source() {
 
   cat > "$swift_source" <<'SWIFT'
 import AppKit
+import Darwin
 import WebKit
 
 final class DraggableTitlebarView: NSView {
@@ -477,10 +496,20 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
     private let serviceQueue = DispatchQueue(label: "sh.aidevops.gui.services")
     private var hasLoadedDashboard = false
     private var servicesStopped = false
+    private var vaultProcess: Process?
+    private var vaultMaster: FileHandle?
+    private var vaultSlaveFD: Int32 = -1
+    private var vaultOverlay: NSView?
+    private var vaultOutput: NSTextView?
+    private var vaultInput: NSSecureTextField?
+    private var vaultSubmit: NSButton?
+    private var vaultAllowsVisibleAcknowledgement = false
 
     func applicationDidFinishLaunching(_ notification: Notification) {
         configureMenu()
         configureWindow()
+        NSWorkspace.shared.notificationCenter.addObserver(self, selector: #selector(cancelVaultForSessionChange(_:)), name: NSWorkspace.sessionDidResignActiveNotification, object: nil)
+        NSWorkspace.shared.notificationCenter.addObserver(self, selector: #selector(cancelVaultForSessionChange(_:)), name: NSWorkspace.screensDidSleepNotification, object: nil)
         startServicesAndLoadApp()
     }
 
@@ -489,6 +518,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
     }
 
     func applicationShouldTerminate(_ sender: NSApplication) -> NSApplication.TerminateReply {
+        closeVaultTerminal(result: "cancelled")
         saveMainWindowFrame()
         stopServices()
         return .terminateNow
@@ -551,57 +581,198 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
         // action. The bundled launcher independently allowlists it and resolves
         // the repository CLI without PATH lookup.
         switch action {
-        case "init", "unlock", "lock", "status", "lost-passphrase": break
+        case "init", "unlock", "lock": break
         default: return
         }
+        presentVaultTerminal(action: action)
+    }
 
-        guard let helperPath = Bundle.main.path(forResource: "aidevops-gui-services", ofType: "sh") else {
-            NSSound.beep()
+    private func isTrustedVaultMessage(_ message: WKScriptMessage) -> Bool {
+        let origin = message.frameInfo.securityOrigin
+        return message.frameInfo.isMainFrame && origin.protocol == "http" && origin.host == "127.0.0.1" && origin.port == Int(webPort)
+    }
+
+    private func notifyVaultCommandResult(_ result: String) {
+        guard ["presented", "running", "succeeded", "failed", "cancelled"].contains(result) else { return }
+        let script = "window.dispatchEvent(new CustomEvent('aidevops:vault-command-result', { detail: '\(result)' }))"
+        webView.evaluateJavaScript(script, completionHandler: nil)
+    }
+
+    private func presentVaultTerminal(action: String) {
+        guard vaultProcess == nil, let contentView = window.contentView else {
             notifyVaultCommandResult("failed")
             return
         }
-        guard helperPath.rangeOfCharacter(from: .newlines) == nil else {
+        let helperPath = Bundle.main.path(forResource: "aidevops-gui-services", ofType: "sh") ?? ""
+        guard trustedVaultExecutable(path: helperPath) else {
             NSSound.beep()
             notifyVaultCommandResult("failed")
             return
         }
 
-        let command = "/bin/bash \(shellQuote(helperPath)) vault-command \(shellQuote(action))"
-        let source = "tell application \"Terminal\"\nactivate\ndo script \(appleScriptQuote(command))\nend tell"
-        guard let script = NSAppleScript(source: source) else {
-            NSSound.beep()
-            notifyVaultCommandResult("failed")
+        let overlay = NSVisualEffectView()
+        overlay.material = .hudWindow
+        overlay.blendingMode = .withinWindow
+        overlay.translatesAutoresizingMaskIntoConstraints = false
+        let title = NSTextField(labelWithString: "Secure Vault \(action)")
+        title.font = .boldSystemFont(ofSize: 18)
+        title.translatesAutoresizingMaskIntoConstraints = false
+        let scroll = NSScrollView()
+        scroll.hasVerticalScroller = true
+        scroll.translatesAutoresizingMaskIntoConstraints = false
+        let output = NSTextView()
+        output.isEditable = false
+        output.isSelectable = true
+        output.font = .monospacedSystemFont(ofSize: 13, weight: .regular)
+        output.string = "Starting fixed Vault action…\n"
+        scroll.documentView = output
+        let input = NSSecureTextField()
+        input.placeholderString = "Secure input becomes available when requested"
+        input.isEnabled = false
+        input.translatesAutoresizingMaskIntoConstraints = false
+        let submit = NSButton(title: "Submit", target: self, action: #selector(submitVaultInput(_:)))
+        submit.isEnabled = false
+        submit.translatesAutoresizingMaskIntoConstraints = false
+        let cancel = NSButton(title: "Cancel", target: self, action: #selector(cancelVaultTerminal(_:)))
+        cancel.keyEquivalent = "\u{1b}"
+        cancel.translatesAutoresizingMaskIntoConstraints = false
+        for view in [title, scroll, input, submit, cancel] { overlay.addSubview(view) }
+        contentView.addSubview(overlay)
+        NSLayoutConstraint.activate([
+            overlay.leadingAnchor.constraint(equalTo: contentView.leadingAnchor), overlay.trailingAnchor.constraint(equalTo: contentView.trailingAnchor),
+            overlay.topAnchor.constraint(equalTo: contentView.topAnchor), overlay.bottomAnchor.constraint(equalTo: contentView.bottomAnchor),
+            title.leadingAnchor.constraint(equalTo: overlay.leadingAnchor, constant: 32), title.topAnchor.constraint(equalTo: overlay.topAnchor, constant: 48),
+            scroll.leadingAnchor.constraint(equalTo: title.leadingAnchor), scroll.trailingAnchor.constraint(equalTo: overlay.trailingAnchor, constant: -32),
+            scroll.topAnchor.constraint(equalTo: title.bottomAnchor, constant: 18), scroll.bottomAnchor.constraint(equalTo: input.topAnchor, constant: -16),
+            input.leadingAnchor.constraint(equalTo: title.leadingAnchor), input.trailingAnchor.constraint(equalTo: submit.leadingAnchor, constant: -10), input.bottomAnchor.constraint(equalTo: overlay.bottomAnchor, constant: -32),
+            submit.trailingAnchor.constraint(equalTo: cancel.leadingAnchor, constant: -10), submit.centerYAnchor.constraint(equalTo: input.centerYAnchor),
+            cancel.trailingAnchor.constraint(equalTo: scroll.trailingAnchor), cancel.centerYAnchor.constraint(equalTo: input.centerYAnchor)
+        ])
+        vaultOverlay = overlay
+        vaultOutput = output
+        vaultInput = input
+        vaultSubmit = submit
+        window.sharingType = .none
+        titlebarCameraButton?.isEnabled = false
+        notifyVaultCommandResult("presented")
+        startVaultPTY(helperPath: helperPath, action: action)
+    }
+
+    private func trustedVaultExecutable(path: String) -> Bool {
+        guard !path.isEmpty, let attributes = try? FileManager.default.attributesOfItem(atPath: path),
+              let type = attributes[.type] as? FileAttributeType, type == .typeRegular,
+              let owner = attributes[.ownerAccountID] as? NSNumber, owner.uint32Value == getuid(),
+              let permissions = attributes[.posixPermissions] as? NSNumber, permissions.intValue & 0o022 == 0 else { return false }
+        let values = try? URL(fileURLWithPath: path).resourceValues(forKeys: [.isSymbolicLinkKey])
+        return values?.isSymbolicLink == false
+    }
+
+    private func startVaultPTY(helperPath: String, action: String) {
+        var master: Int32 = -1
+        var slave: Int32 = -1
+        guard openpty(&master, &slave, nil, nil, nil) == 0 else {
+            closeVaultTerminal(result: "failed")
             return
         }
-        var error: NSDictionary?
-        script.executeAndReturnError(&error)
-        if error != nil {
-            NSSound.beep()
-            notifyVaultCommandResult("failed")
-            return
+        vaultSlaveFD = slave
+        let masterHandle = FileHandle(fileDescriptor: master, closeOnDealloc: true)
+        let slaveHandle = FileHandle(fileDescriptor: slave, closeOnDealloc: false)
+        let process = Process()
+        process.executableURL = URL(fileURLWithPath: "/bin/bash")
+        process.arguments = [helperPath, "vault-command", action]
+        process.environment = ["HOME": FileManager.default.homeDirectoryForCurrentUser.path, "PATH": "/opt/homebrew/bin:/usr/local/bin:/usr/bin:/bin:/usr/sbin:/sbin", "AIDEVOPS_SESSION_ID": "gui-desktop-secure-pty", "TERM": "dumb"]
+        process.standardInput = slaveHandle
+        process.standardOutput = slaveHandle
+        process.standardError = slaveHandle
+        masterHandle.readabilityHandler = { [weak self] handle in
+            let data = handle.availableData
+            guard !data.isEmpty else { return }
+            DispatchQueue.main.async { self?.appendVaultOutput(data) }
+        }
+        process.terminationHandler = { [weak self] process in
+            DispatchQueue.main.async { self?.finishVaultTerminal(succeeded: process.terminationStatus == 0) }
+        }
+        vaultMaster = masterHandle
+        vaultProcess = process
+        do {
+            try process.run()
+            close(slave)
+            vaultSlaveFD = -1
+            notifyVaultCommandResult("running")
+        } catch {
+            closeVaultTerminal(result: "failed")
         }
-        notifyVaultCommandResult("opened")
-    }
-
-    private func isTrustedVaultMessage(_ message: WKScriptMessage) -> Bool {
-        let origin = message.frameInfo.securityOrigin
-        return message.frameInfo.isMainFrame && origin.protocol == "http" && origin.host == "127.0.0.1" && origin.port == Int(webPort)
-    }
-
-    private func shellQuote(_ value: String) -> String {
-        return "'" + value.replacingOccurrences(of: "'", with: "'\\''") + "'"
     }
 
-    private func appleScriptQuote(_ value: String) -> String {
-        let escaped = value
-            .replacingOccurrences(of: "\\", with: "\\\\")
-            .replacingOccurrences(of: "\"", with: "\\\"")
-        return "\"\(escaped)\""
+    private func appendVaultOutput(_ data: Data) {
+        guard let text = String(data: data, encoding: .utf8) else { return }
+        let sanitized = text.unicodeScalars.filter { scalar in scalar == "\n" || scalar == "\r" || scalar == "\t" || scalar.value >= 0x20 && scalar.value != 0x7f }.map(String.init).joined()
+        vaultOutput?.string.append(String(sanitized.suffix(16_384)))
+        vaultOutput?.scrollToEndOfDocument(nil)
+        var attributes = termios()
+        let echoDisabled = vaultMaster.map { tcgetattr($0.fileDescriptor, &attributes) == 0 && (attributes.c_lflag & tcflag_t(ECHO)) == 0 } ?? false
+        vaultAllowsVisibleAcknowledgement = !echoDisabled && sanitized.contains("I UNDERSTAND")
+        let acceptsInput = echoDisabled || vaultAllowsVisibleAcknowledgement
+        vaultInput?.isEnabled = acceptsInput
+        vaultSubmit?.isEnabled = acceptsInput
+        if acceptsInput { window.makeFirstResponder(vaultInput) }
+    }
+
+    @objc private func submitVaultInput(_ sender: Any?) {
+        guard let input = vaultInput, input.isEnabled, let master = vaultMaster else { return }
+        var attributes = termios()
+        let echoDisabled = tcgetattr(master.fileDescriptor, &attributes) == 0 && (attributes.c_lflag & tcflag_t(ECHO)) == 0
+        if !echoDisabled && (!vaultAllowsVisibleAcknowledgement || input.stringValue != "I UNDERSTAND") {
+            NSSound.beep()
+            return
+        }
+        var bytes = Array(input.stringValue.utf8)
+        input.stringValue = ""
+        vaultAllowsVisibleAcknowledgement = false
+        input.isEnabled = false
+        vaultSubmit?.isEnabled = false
+        guard !bytes.isEmpty else { return }
+        bytes.append(0x0a)
+        let data = Data(bytes)
+        do { try master.write(contentsOf: data) } catch { closeVaultTerminal(result: "failed") }
+        bytes.withUnsafeMutableBytes { buffer in
+            buffer.initializeMemory(as: UInt8.self, repeating: 0)
+        }
     }
 
-    private func notifyVaultCommandResult(_ result: String) {
-        let script = "window.dispatchEvent(new CustomEvent('aidevops:vault-command-result', { detail: '\(result)' }))"
-        webView.evaluateJavaScript(script, completionHandler: nil)
+    @objc private func cancelVaultTerminal(_ sender: Any?) {
+        closeVaultTerminal(result: "cancelled")
+    }
+
+    private func finishVaultTerminal(succeeded: Bool) {
+        let result = succeeded ? "succeeded" : "failed"
+        appendVaultOutput(Data("\nVault action \(result). Close this secure surface.\n".utf8))
+        vaultInput?.isEnabled = false
+        vaultSubmit?.isEnabled = false
+        notifyVaultCommandResult(result)
+        DispatchQueue.main.asyncAfter(deadline: .now() + 1.0) { [weak self] in self?.closeVaultTerminal(result: nil) }
+    }
+
+    private func closeVaultTerminal(result: String?) {
+        vaultProcess?.terminationHandler = nil
+        if vaultProcess?.isRunning == true { vaultProcess?.terminate() }
+        vaultMaster?.readabilityHandler = nil
+        try? vaultMaster?.close()
+        if vaultSlaveFD >= 0 { close(vaultSlaveFD) }
+        vaultInput?.stringValue = ""
+        vaultOutput?.string = ""
+        vaultOverlay?.removeFromSuperview()
+        vaultProcess = nil
+        vaultMaster = nil
+        vaultSlaveFD = -1
+        vaultInput = nil
+        vaultOutput = nil
+        vaultSubmit = nil
+        vaultOverlay = nil
+        vaultAllowsVisibleAcknowledgement = false
+        window?.sharingType = .readOnly
+        titlebarCameraButton?.isEnabled = true
+        if let result = result { notifyVaultCommandResult(result) }
     }
 
     private func revealFileURL(_ url: URL) -> Bool {
@@ -874,9 +1045,14 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
     }
 
     func windowWillClose(_ notification: Notification) {
+        closeVaultTerminal(result: "cancelled")
         saveMainWindowFrame()
     }
 
+    @objc private func cancelVaultForSessionChange(_ notification: Notification) {
+        closeVaultTerminal(result: "cancelled")
+    }
+
     @objc private func reloadPage(_ sender: Any?) {
         webView.reload()
     }
@@ -1131,6 +1307,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
     }
 
     @objc private func captureAppScreenshot(_ sender: Any?) {
+        guard vaultOverlay == nil else { NSSound.beep(); return }
         guard let contentView = window.contentView else {
             return
         }
@@ -1147,6 +1324,7 @@ final class AppDelegate: NSObject, NSApplicationDelegate, WKNavigationDelegate,
     }
 
     @objc private func capturePageScreenshot(_ sender: Any?) {
+        guard vaultOverlay == nil else { NSSound.beep(); return }
         let script = """
         (() => {
           const el = document.querySelector('.workspace-scroll');

package/packages/gui-shared/src/contracts.ts

@@ -648,6 +648,10 @@ export interface GuiStatusData {
   pulse_workers: GuiPulseWorkerSummary;
   capabilities: GuiCapabilitySummary[];
   secrets: GuiSecretReference[];
+  secret_backends: {
+    gopass: "available" | "missing" | "error";
+    credentials: "available" | "missing" | "error";
+  };
   placeholders: string[];
 }
 

package/packages/gui-shared/src/fixtures.ts

@@ -495,6 +495,7 @@ export const statusFixture: GuiStatusData = {
     },
   ],
   secrets: [],
+  secret_backends: { gopass: "missing", credentials: "missing" },
   placeholders: [
     "Settings, repos, routines, OpenCode sessions, and capabilities will be added as read-only adapters.",
   ],

package/packages/gui-web/src/SecuritySurface.tsx

@@ -47,6 +47,7 @@ export function SecuritySurface({ onVaultRequest, status }: {
         <SecretMetric detail={vault.unlocked ? "ready for dependent tools" : "visible after local unlock"} icon={<FiCheckCircle />} label="Configured" value={hiddenCount ?? String(configured)} />
         <SecretMetric detail={vault.unlocked ? "missing or not yet checked" : "visible after local unlock"} icon={<FiAlertTriangle />} label="Needs attention" value={hiddenCount ?? String(needsAttention)} />
         <SecretMetric detail="hidden local prompt only" icon={<FiTerminal />} label="Value custody" value="Write-only" />
+        <SecretMetric detail={`credentials: ${status.secret_backends.credentials}`} icon={<FiActivity />} label="gopass backend" value={vault.unlocked ? status.secret_backends.gopass : "Hidden"} />
       </div>
 
       {vault.unlocked ? (

package/packages/gui-web/src/VaultAccessModal.tsx

@@ -63,11 +63,11 @@ interface DialogContent {
 }
 
 const dialogContentFactories: Record<VaultDialogIntent, (vault: GuiVaultStatusData) => DialogContent> = {
-  lock: () => ({ action: "Open lock terminal", detail: "Locking forgets in-memory keys and hides protected previews again.", notice: "The fixed local command does not receive browser data or secret material.", title: "Lock local Vault" }),
-  recover: () => ({ action: "Open recovery guidance", detail: "Vault metadata appears damaged. Preserve existing encrypted data and review conservative recovery options.", notice: "Do not initialise with --force or overwrite the existing Vault.", title: "Review Vault recovery" }),
-  setup: () => ({ action: "Open setup terminal", detail: "Create this device's Vault once through the secure local helper.", notice: "Save the new passphrase in a trusted password manager. aidevops cannot recover it.", title: "Set up Vault" }),
+  lock: () => ({ action: "Lock Vault", detail: "Locking forgets in-memory keys and hides protected previews again.", notice: "The fixed native action does not receive browser data or secret material.", title: "Lock local Vault" }),
+  recover: () => ({ action: "Refresh status", detail: "Vault metadata appears damaged. Preserve existing encrypted data and use direct CLI recovery guidance.", notice: "Do not initialise with --force or overwrite the existing Vault.", title: "Review Vault recovery" }),
+  setup: () => ({ action: "Set up securely", detail: "Create this device's Vault in the native secure surface.", notice: "Save the new passphrase in a trusted password manager. aidevops cannot recover it.", title: "Set up Vault" }),
   unavailable: () => ({ action: "Retry status", detail: "Vault readiness is not authoritative, so setup and passphrase actions are disabled.", notice: "Check the local helper and crypto runtime, then retry. Existing encrypted data will not be reinitialised.", title: "Vault status unavailable" }),
-  unlock: (vault) => ({ action: "Open secure terminal", detail: "Unlock the existing Vault with the passphrase you already saved.", notice: vault.unlock_hint, title: "Unlock existing Vault" }),
+  unlock: () => ({ action: "Unlock securely", detail: "Unlock the existing Vault with the passphrase you already saved.", notice: "Passphrase input remains in the native secure surface and never enters the web view.", title: "Unlock existing Vault" }),
 };
 
 const dialogIcons: Record<VaultDialogIntent, IconType> = {
@@ -109,6 +109,8 @@ const launchStatusPresentation: Partial<Record<VaultLaunchStatus, { Icon: IconTy
   copied: { Icon: FiClipboard, className: "vault-valid", role: "status", text: "Command copied. Run it in your local terminal." },
   failed: { Icon: FiAlertTriangle, className: "vault-invalid", role: "alert", text: "Open a local terminal and run the displayed command." },
   opened: { Icon: FiCheckCircle, className: "vault-valid", role: "status", text: "Secure terminal opened. Return here after the command completes; status refreshes on focus." },
+  succeeded: { Icon: FiCheckCircle, className: "vault-valid", role: "status", text: "Vault action completed securely." },
+  cancelled: { Icon: FiAlertTriangle, className: "vault-invalid", role: "status", text: "Vault action cancelled and native buffers cleared." },
   requesting: { Icon: FiTerminal, className: "vault-valid", role: "status", text: "Requesting the secure local terminal…" },
 };
 

package/packages/gui-web/src/status-client.ts

@@ -99,6 +99,7 @@ function normalizeStatusEnvelope(envelope: GuiResponseEnvelope<Partial<GuiStatus
       pulse_workers: normalizePulseWorkers(data.pulse_workers),
       capabilities: data.capabilities ?? statusFixture.capabilities,
       secrets: visibleSecrets(vault, data.secrets),
+      secret_backends: vault.status === "unlocked" && vault.unlocked ? data.secret_backends ?? statusFixture.secret_backends : statusFixture.secret_backends,
       placeholders: data.placeholders ?? statusFixture.placeholders,
     },
   };

package/packages/gui-web/src/useVaultAccessDialog.ts

@@ -1,16 +1,23 @@
 import { type RefObject, useCallback, useEffect, useRef, useState } from "react";
 import type { VaultDialogIntent } from "./VaultBadges";
-import { type NativeVaultAction, postNativeVaultCommand, vaultCommandText } from "./vault-command-bridge";
+import { isNativeVaultResult, type NativeVaultAction, type NativeVaultResult, postNativeVaultCommand, vaultCommandText } from "./vault-command-bridge";
 
-export type VaultLaunchStatus = "idle" | "requesting" | "opened" | "copied" | "failed";
+export type VaultLaunchStatus = "idle" | "requesting" | "opened" | "copied" | "failed" | "succeeded" | "cancelled";
 
 const terminalActions: Record<VaultDialogIntent, NativeVaultAction | null> = {
   lock: "lock",
-  recover: "lost-passphrase",
+  recover: null,
   setup: "init",
   unavailable: null,
   unlock: "unlock",
 };
+const nativeResultStatuses: Record<NativeVaultResult, VaultLaunchStatus> = {
+  cancelled: "cancelled",
+  failed: "failed",
+  presented: "opened",
+  running: "opened",
+  succeeded: "succeeded",
+};
 
 export function terminalActionForIntent(intent: VaultDialogIntent): NativeVaultAction | null {
   return terminalActions[intent];
@@ -62,11 +69,12 @@ export function useVaultCommandLaunch({ intent, onRefresh, onTerminalLaunch }: {
     const handleNativeResult = (event: Event) => {
       clearNativeResultTimeout();
       const result = (event as CustomEvent<unknown>).detail;
-      setLaunchStatus(result === "opened" ? "opened" : "failed");
+      setLaunchStatus(isNativeVaultResult(result) ? nativeResultStatuses[result] : "failed");
+      if (result === "succeeded") void onRefresh();
     };
     window.addEventListener("aidevops:vault-command-result", handleNativeResult);
     return () => window.removeEventListener("aidevops:vault-command-result", handleNativeResult);
-  }, [clearNativeResultTimeout, setLaunchStatus]);
+  }, [clearNativeResultTimeout, onRefresh, setLaunchStatus]);
 
   useEffect(() => {
     if (timeoutIntent.current !== intent) {

package/packages/gui-web/src/vault-command-bridge.ts

@@ -1,4 +1,10 @@
-export type NativeVaultAction = "init" | "unlock" | "lock" | "status" | "lost-passphrase";
+export type NativeVaultAction = "init" | "unlock" | "lock";
+export type NativeVaultResult = "presented" | "running" | "succeeded" | "failed" | "cancelled";
+const NATIVE_VAULT_RESULTS = new Set<unknown>(["presented", "running", "succeeded", "failed", "cancelled"]);
+
+export function isNativeVaultResult(value: unknown): value is NativeVaultResult {
+  return NATIVE_VAULT_RESULTS.has(value);
+}
 
 interface WebKitVaultCommandWindow extends Window {
   webkit?: {

package/setup.sh

@@ -17,7 +17,7 @@ fi
 # AI Assistant Server Access Framework Setup Script
 # Helps developers set up the framework for their infrastructure
 #
-# Version: 3.32.43
+# Version: 3.32.46
 #
 # Quick Install:
 #   npm install -g aidevops && aidevops update          (recommended)