palmier 1.0.2 → 1.0.3

package/README.md

@@ -57,7 +57,7 @@ Palmier exposes an [MCP](https://modelcontextprotocol.io) server at `http://loca
 | `notify` | Send a push notification to the user's device |
 | `request-input` | Request input from the user (blocks until response) |
 | `request-confirmation` | Request confirmation from the user (blocks until response) |
-| `fill-password` | Fill a saved password into the active browser session, prompting the user if unknown (the password is never revealed to the agent) |
+| `fill-password` | Fill a saved password or PIN into the active browser session, prompting the user if unknown (the secret is never revealed to the agent) |
 | `device-geolocation` | Get GPS location of the user's mobile device |
 | `read-contacts` | Read the contact list from the user's device |
 | `create-contact` | Create a new contact on the user's device |
@@ -156,9 +156,9 @@ Revoking the linked device also clears the host's linked-device record; device c
 
 ### Saved Passwords
 
-Palmier can store website passwords like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login form, it calls the `fill-password` tool with the page URL, the username, and the password field's element ref. Palmier matches the saved password by **origin** and fills it directly into the live browser session. If no password is saved for that `(origin, username)`, Palmier prompts you in the app with a masked password dialog. The dialog has a "Save this password" checkbox (on by default): leave it checked to store the password for next time, or uncheck it to fill it just this once without saving. Either way the password is filled into the page. The plaintext password is never returned to the agent and is never written to task history.
+Palmier can store website passwords and PINs like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login or PIN field, it calls the `fill-password` tool with the page URL, the username, and the field's element ref. Palmier matches the saved secret by **origin** and fills it directly into the live browser session. If nothing is saved for that `(origin, username)`, Palmier prompts you in the app with a masked dialog. The dialog has a "Save for next time" checkbox (on by default): leave it checked to store the secret for reuse, or uncheck it to fill it just this once without saving. Either way it is filled into the page. The plaintext secret is never returned to the agent and is never written to task history.
 
-Passwords are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the host:
+Saved passwords and PINs are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the host:
 
 ```bash
 # List saved passwords (origin and username only — never the password)

package/dist/mcp-tools.js

@@ -182,11 +182,11 @@ const requestConfirmationTool = {
 const fillPasswordTool = {
     name: "fill-password",
     description: [
-        "Fill the user's saved password into a password field in the active playwright-cli browser session.",
-        "Use this instead of typing a password yourself — the password is never revealed to you.",
-        "Provide the page URL, the username/login identifier, and the playwright-cli ref of the password field (and the session name if you opened a named session).",
-        "If a password for this (site, username) is already saved it is filled directly; otherwise the user is prompted to enter it, it is saved, then filled.",
-        'Response: `{"ok": true}` on success, or `{"aborted": true}` if the user declines to provide the password.',
+        "Fill the user's saved password or PIN into a credential field in the active playwright-cli browser session.",
+        "Use this instead of typing a password or PIN yourself — the secret is never revealed to you.",
+        "Provide the page URL, the username/login identifier, and the playwright-cli ref of the field (and the session name if you opened a named session).",
+        "If a secret for this (site, username) is already saved it is filled directly; otherwise the user is prompted to enter it, it is saved, then filled.",
+        'Response: `{"ok": true}` on success, or `{"aborted": true}` if the user declines to provide it.',
     ],
     inputSchema: {
         type: "object",
@@ -205,8 +205,8 @@ const fillPasswordTool = {
         const origin = normalizeOrigin(url);
         let password = lookupPassword(origin, username);
         if (password === undefined) {
-            const question = `Password for ${username} on ${origin}`;
-            const description = `Enter the password to sign in as ${username} on ${origin}.`;
+            const question = `Password or PIN for ${username} on ${origin}`;
+            const description = `Enter the password or PIN to sign in as ${username} on ${origin}.`;
             const pendingPromise = registerPending(ctx.sessionId, "input", [question], {
                 session_id: ctx.sessionId,
                 session_name: ctx.agentName,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "1.0.2",
+  "version": "1.0.3",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "Apache-2.0",
   "author": "Hongxu Cai",