enclave-link 0.1.0 → 0.2.0

package/README.md

@@ -26,6 +26,8 @@ hex   saved Netflix: email, password
 
 It works out of the box with a hosted relay. No accounts, no keys to set up, nothing for the person to install.
 
+The vault also takes 2FA codes and passkeys. Bring in your whole [Proton Pass](#bring-your-proton-pass-vault) vault, and the agent types the current 2FA code or [signs in with a passkey](#passkeys) whose key never leaves the vault.
+
 ## Set up your agent
 
 **Agents with a shell** (Claude Code, Codex, Cursor, Gemini CLI, OpenCode and [30 more](https://github.com/vercel-labs/skills)) get it as a skill:
@@ -38,7 +40,7 @@ The skill teaches the agent to send a link instead of asking in chat, and runs e
 
 **Agents that use MCP** get the same thing as tools. Add the server below, and add this line to the agent's instructions, because tools alone don't stop a model from asking in chat:
 
-> Never ask for a password, API key or other secret in chat. Use the enclave tools.
+> When you need a password, API key or other secret, ask for it with the enclave tools rather than in chat.
 
 <details>
 <summary><b>Claude Code</b></summary>
@@ -63,7 +65,7 @@ claude mcp add enclave -- npx -y enclave-link mcp
 codex mcp add enclave -- npx -y enclave-link mcp
 ```
 
-Codex stops a tool after 60 seconds by default. To let `wait_for_secret` wait as long as the link lives, add this under `[mcp_servers.enclave]` in `~/.codex/config.toml`:
+Codex stops a tool after 60 seconds by default. `wait_for_secret` waits up to 25 minutes a call (the agent calls it again if the person needs longer), so add this under `[mcp_servers.enclave]` in `~/.codex/config.toml`:
 
 ```toml
 tool_timeout_sec = 1800
@@ -211,7 +213,7 @@ deletes the request ────────▶  gone
 ```
 
 - **The relay can't read anything.** The key it would need never leaves the agent's computer. The public key travels in the part of the link after `#`, which browsers don't send to servers, so the relay doesn't even learn what was asked for.
-- **Links work once and expire.** The first answer wins, and the request is deleted as soon as the agent picks it up, or after 30 minutes.
+- **Links work once and expire.** The first answer wins, and the request is deleted as soon as the agent picks it up, or after 24 hours.
 - **No polling.** `enclave wait` holds a live Convex subscription and wakes up the moment the answer lands.
 
 ## Using a secret without seeing it
@@ -232,11 +234,13 @@ A field named `passkey` holds a passkey, and the agent signs in with it in Chrom
 enclave passkey GitHub    # then click the site's passkey sign-in
 ```
 
-`enclave passkey` arms the passkey for one sign-in, for up to 5 minutes. When the site asks for a passkey, enclave's Chrome extension hands the request to `enclave sign`, which signs it inside the vault and disarms the passkey. The private key never enters Chrome. Run it in the background, since it waits for that sign-in.
+`enclave passkey` arms the passkey for one sign-in, for up to 5 minutes. When the site asks for a passkey, enclave's Chrome extension hands the request to `enclave sign`, which signs it inside the vault and disarms the passkey. The private key never enters Chrome.
 
 enclave signs the way Proton Pass does, with a signature counter of 0 every time. Sites read 0 as "this authenticator doesn't count", so a passkey keeps working from Proton and from enclave side by side.
 
-Install the extension once per machine. It's force-installed through Chrome's policy, so it loads in every profile:
+A passkey's private key never comes out: `enclave get` and `enclave run` refuse passkey fields, and only `enclave sign` uses them.
+
+Install the extension once per machine, from a clone of this repo, with Google Chrome on Linux. It's force-installed through Chrome's policy, so it loads in every profile:
 
 ```sh
 extension/install                                  # signs with enclave on this machine
@@ -246,12 +250,13 @@ extension/install ssh my-server enclave sign       # or with a vault on another
 ## Bring your Proton Pass vault
 
 ```sh
-enclave import proton <vault>
+enclave import proton            # every vault
+enclave import proton Work       # or just the ones you name
 ```
 
-copies every item in a [Proton Pass](https://proton.me/pass) vault in through [pass-cli](https://github.com/protonpass/pass-cli): logins, 2FA, passkeys, notes, cards, SSH keys and custom fields, one item per Proton item, named by its title. Proton keeps everything. Run it again to bring in what changed; it replaces items with the same name.
+copies [Proton Pass](https://proton.me/pass) in through [pass-cli](https://github.com/protonpass/pass-cli): logins, 2FA, passkeys, notes, cards, SSH keys and custom fields, one item per Proton item, named by its title (two items with the same title get the account or a number after it). Proton keeps everything. Run it again to bring in what changed: each Proton item keeps its name across imports, a renamed one follows its new title, one you deleted in Proton leaves enclave too, and items saved by link are left alone. `~/.enclave/proton.json` remembers which item is which, by Proton's IDs and names only.
 
-2FA comes in as a `totp` field, so `enclave get <name> totp` gives the current code. Passkeys come in as a `passkey` field: Proton keeps each passkey's private key in the item, and enclave unpacks it the way Proton's own [export code](https://github.com/protonpass/proton-pass-common/blob/main/proton-pass-common/src/cxf/credentials/passkey.rs) does. `ENCLAVE_PASS_CLI` names a different pass-cli, like one signed in as a Proton Pass agent.
+2FA comes in as a `totp` field, so `enclave get <name> totp` gives the current code. Passkeys come in as a `passkey` field: Proton keeps each passkey's private key in the item, and enclave unpacks it the way Proton's own [export code](https://github.com/protonpass/proton-pass-common/blob/main/proton-pass-common/src/cxf/credentials/passkey.rs) does.
 
 ## CLI
 
@@ -265,10 +270,11 @@ npm install -g enclave-link      # or run any of these with npx -y enclave-link
 | `enclave wait <name>` | Waits for the answer and saves it. Exits 1 if the link expires first. |
 | `enclave run VAR=<name>/<field>… <command…>` | Runs a command with secrets in its environment, hidden in its output. |
 | `enclave get <name> <field>` | Prints a saved value, for a pipe or `$(…)`. |
+| `enclave save <name> <field>` | Saves a value piped in, like a token the agent just made, without it passing through the chat. |
 | `enclave passkey <name> [field]` | Arms a saved passkey for the next sign-in on its site, through the extension. |
 | `enclave sign` | Signs a passkey request (JSON on stdin) with an armed passkey. The extension runs it. |
-| `enclave import proton <vault>` | Copies a Proton Pass vault in through pass-cli. |
-| `enclave list` | Saved names and their fields, never values. |
+| `enclave import proton [vault…]` | Copies Proton Pass in through pass-cli: every vault, or the ones named. |
+| `enclave list [search]` | Saved names and their fields, never values. A search matches names and websites. |
 | `enclave rm <name>` | Deletes a saved item. |
 | `enclave mcp` | Serves the tools below over MCP (stdio). |
 
@@ -282,7 +288,7 @@ npm install -g enclave-link      # or run any of these with npx -y enclave-link
 | `wait_for_secret` | Returns the moment the person taps Send, with the field names it saved. |
 | `run_with_secrets` | Runs a command with secrets in its environment and hides them in the output. |
 | `sign_in_with_passkey` | Arms a saved passkey for the next sign-in on its site, then returns so the agent can click sign in. |
-| `list_secrets` | Names and fields, never values. |
+| `list_secrets` | Names and fields, never values, optionally only those matching a name or website. |
 
 There's no tool that returns a secret's value.
 
@@ -301,7 +307,21 @@ await vault.run(["sh", "-c", 'curl -u "$EMAIL:$PASSWORD" https://example.com'],
 })
 ```
 
-`vault` reads `ENCLAVE_FROM`, `ENCLAVE_HOME` and `ENCLAVE_RELAY`. For anything else, `openVault({ from, home, relay })` makes one of your own. It also has `get`, `list` and `remove`, the same as the CLI.
+`vault` reads `ENCLAVE_FROM`, `ENCLAVE_HOME` and `ENCLAVE_RELAY`. For anything else, `openVault({ from, home, relay, store })` makes one of your own. It also has `get`, `list` and `remove`, the same as the CLI.
+
+Answers are saved to `~/.enclave` by default. To keep them somewhere else, pass a `store`: any object with `get`, `put`, `remove` and `names`, like your own database. For a one-time answer that's never written to disk, keep it in memory:
+
+```ts
+const answers = new Map()
+const oneTime = openVault({
+  store: {
+    get: async (name) => answers.get(name),
+    put: async (name, item) => void answers.set(name, item),
+    remove: async (name) => void answers.delete(name),
+    names: async () => [...answers.keys()],
+  },
+})
+```
 
 ## Security