palmier 0.9.36 → 1.0.1

package/README.md

@@ -57,6 +57,7 @@ Palmier exposes an [MCP](https://modelcontextprotocol.io) server at `http://loca
 | `notify` | Send a push notification to the user's device |
 | `request-input` | Request input from the user (blocks until response) |
 | `request-confirmation` | Request confirmation from the user (blocks until response) |
+| `fill-password` | Fill a saved password into the active browser session, prompting the user if unknown (the password is never revealed to the agent) |
 | `device-geolocation` | Get GPS location of the user's mobile device |
 | `read-contacts` | Read the contact list from the user's device |
 | `create-contact` | Create a new contact on the user's device |
@@ -153,6 +154,26 @@ palmier clients revoke-all
 
 Revoking the linked device also clears the host's linked-device record; device capabilities stop working until another paired device is linked from its drawer.
 
+### Saved Passwords
+
+Palmier can store website passwords like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login form, it calls the `fill-password` tool with the page URL, the username, and the password field's element ref. Palmier matches the saved password by **origin** and fills it directly into the live browser session. If no password is saved for that `(origin, username)`, Palmier prompts you in the app with a masked password dialog, stores what you enter, and then fills it. The plaintext password is never returned to the agent and is never written to task history.
+
+Passwords are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the host:
+
+```bash
+# List saved passwords (origin and username only — never the password)
+palmier passwords list
+
+# Delete a specific saved password
+palmier passwords delete https://example.com alice
+
+# Delete every saved password for an origin
+palmier passwords delete https://example.com
+
+# Delete all saved passwords
+palmier passwords clear
+```
+
 ### The `init` Command
 
 The wizard:
@@ -198,6 +219,9 @@ The default network interface is detected once during `palmier init` and saved t
 | `palmier clients list` | List active client tokens |
 | `palmier clients revoke <token>` | Revoke a specific client token |
 | `palmier clients revoke-all` | Revoke all client tokens |
+| `palmier passwords list` | List saved passwords (origin and username only) |
+| `palmier passwords delete <origin> [username]` | Delete a saved password (omit username to delete all for the origin) |
+| `palmier passwords clear` | Delete all saved passwords |
 | `palmier info` | Show host connection info (address, mode) |
 | `palmier serve` | Run the persistent RPC handler (default command) |
 | `palmier restart` | Restart the palmier serve daemon |

package/dist/commands/passwords.d.ts

@@ -0,0 +1,3 @@
+export declare function passwordsListCommand(): Promise<void>;
+export declare function passwordsDeleteCommand(origin: string, username?: string): Promise<void>;
+export declare function passwordsClearCommand(): Promise<void>;

package/dist/commands/passwords.js

@@ -0,0 +1,25 @@
+import { listPasswords, deletePassword, clearPasswords, normalizeOrigin } from "../password-store.js";
+export async function passwordsListCommand() {
+    const entries = listPasswords();
+    if (entries.length === 0) {
+        console.log("No saved passwords.");
+        return;
+    }
+    console.log(`${entries.length} saved password(s):\n`);
+    for (const e of entries) {
+        console.log(`  ${e.origin}  ${e.username}`);
+    }
+}
+export async function passwordsDeleteCommand(origin, username) {
+    if (deletePassword(normalizeOrigin(origin), username)) {
+        console.log("Password deleted.");
+    }
+    else {
+        console.error("No matching saved password.");
+        process.exit(1);
+    }
+}
+export async function passwordsClearCommand() {
+    const count = clearPasswords();
+    console.log(`Cleared ${count} saved password(s).`);
+}

package/dist/index.js

@@ -11,6 +11,7 @@ import { serveCommand } from "./commands/serve.js";
 import { pairCommand } from "./commands/pair.js";
 import { restartCommand } from "./commands/restart.js";
 import { clientsListCommand, clientsRevokeCommand, clientsRevokeAllCommand } from "./commands/clients.js";
+import { passwordsListCommand, passwordsDeleteCommand, passwordsClearCommand } from "./commands/passwords.js";
 import { agentsCommand } from "./commands/agents.js";
 import { uninstallCommand } from "./commands/uninstall.js";
 const __dirname = dirname(fileURLToPath(import.meta.url));
@@ -77,6 +78,27 @@ clientsCmd
     .action(async () => {
     await clientsRevokeAllCommand();
 });
+const passwordsCmd = program
+    .command("passwords")
+    .description("Manage saved passwords");
+passwordsCmd
+    .command("list")
+    .description("List saved passwords (origin and username only)")
+    .action(async () => {
+    await passwordsListCommand();
+});
+passwordsCmd
+    .command("delete <origin> [username]")
+    .description("Delete a saved password (omit username to delete all for the origin)")
+    .action(async (origin, username) => {
+    await passwordsDeleteCommand(origin, username);
+});
+passwordsCmd
+    .command("clear")
+    .description("Delete all saved passwords")
+    .action(async () => {
+    await passwordsClearCommand();
+});
 program
     .command("agents")
     .description("List, install, and uninstall agent CLIs")

package/dist/mcp-tools.js

@@ -5,6 +5,8 @@ import { getLinkedDevice } from "./linked-device.js";
 import { getNotifications, onNotificationsChanged } from "./notification-store.js";
 import { getSmsMessages, onSmsChanged } from "./sms-store.js";
 import { getTaskDir, readHistory, spliceUserMessage } from "./task.js";
+import { lookupPassword, savePassword, normalizeOrigin } from "./password-store.js";
+import { fillPasswordInBrowser } from "./playwright-fill.js";
 export class ToolError extends Error {
     statusCode;
     constructor(message, statusCode = 500) {
@@ -177,6 +179,71 @@ const requestConfirmationTool = {
         return { confirmed };
     },
 };
+const fillPasswordTool = {
+    name: "fill-password",
+    description: [
+        "Fill the user's saved password into a password field in the active playwright-cli browser session.",
+        "Use this instead of typing a password yourself — the password is never revealed to you.",
+        "Provide the page URL, the username/login identifier, and the playwright-cli ref of the password field (and the session name if you opened a named session).",
+        "If a password for this (site, username) is already saved it is filled directly; otherwise the user is prompted to enter it, it is saved, then filled.",
+        'Response: `{"ok": true}` on success, or `{"aborted": true}` if the user declines to provide the password.',
+    ],
+    inputSchema: {
+        type: "object",
+        properties: {
+            url: { type: "string", description: "URL of the page with the login form" },
+            username: { type: "string", description: "Username / login identifier for this site" },
+            ref: { type: "string", description: 'playwright-cli ref of the password field (e.g. "e5")' },
+            session: { type: "string", description: "playwright-cli session name (omit for the default session)" },
+        },
+        required: ["url", "username", "ref"],
+    },
+    async handler(args, ctx) {
+        const { url, username, ref, session } = args;
+        if (!url || !username || !ref)
+            throw new ToolError("url, username, and ref are required", 400);
+        const origin = normalizeOrigin(url);
+        let password = lookupPassword(origin, username);
+        if (password === undefined) {
+            const question = `Password for ${username} on ${origin}`;
+            const description = `Enter the password to sign in as ${username} on ${origin}.`;
+            const pendingPromise = registerPending(ctx.sessionId, "input", [question], {
+                session_id: ctx.sessionId,
+                session_name: ctx.agentName,
+                description,
+                input_questions: [question],
+                secret: true,
+            });
+            await ctx.publishEvent("_input", {
+                event_type: "input-request",
+                host_id: ctx.config.hostId,
+                session_id: ctx.sessionId,
+                session_name: ctx.agentName,
+                description,
+                input_questions: [question],
+                secret: true,
+            });
+            const response = await pendingPromise;
+            const aborted = response.length === 1 && response[0] === "aborted";
+            await ctx.publishEvent("_input", {
+                event_type: "input-resolved", host_id: ctx.config.hostId,
+                session_id: ctx.sessionId, status: aborted ? "aborted" : "provided",
+            });
+            // Never record the secret to the task run file (unlike request-input).
+            if (aborted)
+                return { aborted: true };
+            password = response[0];
+            savePassword(origin, username, password);
+        }
+        try {
+            await fillPasswordInBrowser(ref, password, session);
+        }
+        catch (err) {
+            throw new ToolError(`Failed to fill password: ${err instanceof Error ? err.message : String(err)}`, 502);
+        }
+        return { ok: true };
+    },
+};
 const deviceGeolocationTool = {
     name: "device-geolocation",
     description: [
@@ -677,7 +744,7 @@ const sendEmailTool = {
         return result;
     },
 };
-export const agentTools = [notifyTool, requestInputTool, requestConfirmationTool, deviceGeolocationTool, readContactsTool, createContactTool, readCalendarTool, createCalendarEventTool, sendSmsTool, sendEmailTool, sendAlarmTool, readBatteryTool, setRingerModeTool];
+export const agentTools = [notifyTool, requestInputTool, requestConfirmationTool, fillPasswordTool, deviceGeolocationTool, readContactsTool, createContactTool, readCalendarTool, createCalendarEventTool, sendSmsTool, sendEmailTool, sendAlarmTool, readBatteryTool, setRingerModeTool];
 export const agentToolMap = new Map(agentTools.map((t) => [t.name, t]));
 const deviceNotificationsResource = {
     uri: "notifications://device",

package/dist/password-store.d.ts

@@ -0,0 +1,13 @@
+/** A stored credential without its secret — safe to display and log. */
+export interface PasswordIdentity {
+    origin: string;
+    username: string;
+}
+/** Collapse a login URL to its origin so all paths on a site share one entry. */
+export declare function normalizeOrigin(url: string): string;
+export declare function lookupPassword(origin: string, username: string): string | undefined;
+export declare function savePassword(origin: string, username: string, password: string): void;
+export declare function listPasswords(): PasswordIdentity[];
+/** Delete one (origin, username) entry, or every entry for an origin when username is omitted. */
+export declare function deletePassword(origin: string, username?: string): boolean;
+export declare function clearPasswords(): number;

package/dist/password-store.js

@@ -0,0 +1,96 @@
+import * as fs from "fs";
+import * as path from "path";
+import { createCipheriv, createDecipheriv, randomBytes } from "crypto";
+import { CONFIG_DIR } from "./config.js";
+const PASSWORDS_FILE = path.join(CONFIG_DIR, "passwords.enc");
+const KEY_FILE = path.join(CONFIG_DIR, "password-key");
+const ALGORITHM = "aes-256-gcm";
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
+function getOrCreateKey() {
+    try {
+        const existing = fs.readFileSync(KEY_FILE);
+        if (existing.length === KEY_LENGTH)
+            return existing;
+    }
+    catch { /* fall through to create */ }
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    const key = randomBytes(KEY_LENGTH);
+    fs.writeFileSync(KEY_FILE, key, { mode: 0o600 });
+    return key;
+}
+function encrypt(plaintext) {
+    const iv = randomBytes(IV_LENGTH);
+    const cipher = createCipheriv(ALGORITHM, getOrCreateKey(), iv);
+    const ciphertext = Buffer.concat([cipher.update(plaintext, "utf-8"), cipher.final()]);
+    return Buffer.concat([iv, cipher.getAuthTag(), ciphertext]);
+}
+function decrypt(blob) {
+    const iv = blob.subarray(0, IV_LENGTH);
+    const tag = blob.subarray(IV_LENGTH, IV_LENGTH + TAG_LENGTH);
+    const ciphertext = blob.subarray(IV_LENGTH + TAG_LENGTH);
+    const decipher = createDecipheriv(ALGORITHM, getOrCreateKey(), iv);
+    decipher.setAuthTag(tag);
+    return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString("utf-8");
+}
+function readFile() {
+    try {
+        if (!fs.existsSync(PASSWORDS_FILE))
+            return [];
+        const blob = fs.readFileSync(PASSWORDS_FILE);
+        if (blob.length === 0)
+            return [];
+        return JSON.parse(decrypt(blob));
+    }
+    catch {
+        return [];
+    }
+}
+function writeFile(entries) {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true });
+    fs.writeFileSync(PASSWORDS_FILE, encrypt(JSON.stringify(entries)), { mode: 0o600 });
+}
+/** Collapse a login URL to its origin so all paths on a site share one entry. */
+export function normalizeOrigin(url) {
+    try {
+        return new URL(url).origin;
+    }
+    catch {
+        try {
+            return new URL(`https://${url}`).origin;
+        }
+        catch {
+            return url;
+        }
+    }
+}
+export function lookupPassword(origin, username) {
+    return readFile().find((e) => e.origin === origin && e.username === username)?.password;
+}
+export function savePassword(origin, username, password) {
+    const entries = readFile();
+    const existing = entries.find((e) => e.origin === origin && e.username === username);
+    if (existing)
+        existing.password = password;
+    else
+        entries.push({ origin, username, password });
+    writeFile(entries);
+}
+export function listPasswords() {
+    return readFile().map(({ origin, username }) => ({ origin, username }));
+}
+/** Delete one (origin, username) entry, or every entry for an origin when username is omitted. */
+export function deletePassword(origin, username) {
+    const entries = readFile();
+    const remaining = entries.filter((e) => username === undefined ? e.origin !== origin : !(e.origin === origin && e.username === username));
+    if (remaining.length === entries.length)
+        return false;
+    writeFile(remaining);
+    return true;
+}
+export function clearPasswords() {
+    const entries = readFile();
+    writeFile([]);
+    return entries.length;
+}

package/dist/pending-requests.d.ts

@@ -7,6 +7,8 @@ export interface PendingRequestMeta {
     session_name?: string;
     description?: string;
     input_questions?: string[];
+    /** Render the input field(s) masked (password entry). */
+    secret?: boolean;
 }
 export interface PendingRequest {
     type: "confirmation" | "permission" | "input";

package/dist/playwright-fill.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Fill `password` into the `ref` element of the agent's live playwright-cli
+ * browser session. playwright-cli keeps a persistent server-side browser keyed
+ * by session name, so this lands on the same page the agent is driving.
+ *
+ * The password is passed as an argv element (no shell, so no history/injection),
+ * which leaves it briefly visible to other processes of the same user;
+ * playwright-cli's `fill` exposes no stdin/env input for the value.
+ */
+export declare function fillPasswordInBrowser(ref: string, password: string, session?: string): Promise<void>;

package/dist/playwright-fill.js

@@ -0,0 +1,41 @@
+import { spawnCommand } from "./spawn-command.js";
+let resolved;
+/**
+ * Prefer the global `playwright-cli`; fall back to the local `npx` shim when it
+ * isn't on PATH. Probed once and cached for the daemon's lifetime.
+ */
+async function resolvePlaywrightCli() {
+    if (resolved)
+        return resolved;
+    try {
+        await spawnCommand("playwright-cli", ["--version"], { cwd: process.cwd() });
+        resolved = { command: "playwright-cli", prefixArgs: [] };
+    }
+    catch {
+        resolved = { command: "npx", prefixArgs: ["--no-install", "playwright-cli"] };
+    }
+    return resolved;
+}
+/**
+ * Fill `password` into the `ref` element of the agent's live playwright-cli
+ * browser session. playwright-cli keeps a persistent server-side browser keyed
+ * by session name, so this lands on the same page the agent is driving.
+ *
+ * The password is passed as an argv element (no shell, so no history/injection),
+ * which leaves it briefly visible to other processes of the same user;
+ * playwright-cli's `fill` exposes no stdin/env input for the value.
+ */
+export async function fillPasswordInBrowser(ref, password, session) {
+    const { command, prefixArgs } = await resolvePlaywrightCli();
+    const args = [
+        ...prefixArgs,
+        ...(session ? [`-s=${session}`] : []),
+        "fill",
+        ref,
+        password,
+    ];
+    const { exitCode, output } = await spawnCommand(command, args, { cwd: process.cwd(), resolveOnFailure: true });
+    if (exitCode !== 0) {
+        throw new Error(output.trim() || `playwright-cli fill exited with code ${exitCode}`);
+    }
+}