palmier 1.0.6 → 1.0.8

package/README.md

@@ -57,7 +57,7 @@ Palmier exposes an [MCP](https://modelcontextprotocol.io) server at `http://loca
 | `notify` | Send a push notification to the user's device |
 | `request-input` | Request input from the user (blocks until response) |
 | `request-confirmation` | Request confirmation from the user (blocks until response) |
-| `fill-password` | Fill a saved password or PIN into the active browser session, prompting the user if unknown (the secret is never revealed to the agent) |
+| `fill-password` | Fill a saved password or PIN into the active browser session and submit the form, prompting the user if unknown (the secret is never revealed to the agent) |
 | `device-geolocation` | Get GPS location of the user's mobile device |
 | `read-contacts` | Read the contact list from the user's device |
 | `create-contact` | Create a new contact on the user's device |
@@ -156,9 +156,9 @@ Revoking the linked device also clears the host's linked-device record; device c
 
 ### Saved Passwords
 
-Palmier can store website passwords and PINs like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login or PIN field, it calls the `fill-password` tool with the page URL, the username, and the field's element ref. Palmier matches the saved secret by **origin** and fills it directly into the live browser session. If nothing is saved for that `(origin, username)`, Palmier prompts you in the app with a masked dialog. The dialog has a "Save for next time" checkbox (on by default): leave it checked to store the secret for reuse, or uncheck it to fill it just this once without saving. Either way it is filled into the page. The plaintext secret is never returned to the agent and is never written to task history.
+Palmier can store website passwords and PINs like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login or PIN field, it calls the `fill-password` tool with the page URL, the username, and the field's element ref. Palmier matches the saved secret by **origin**, fills it directly into the live browser session, and presses Enter to submit the form in the same step — so the plaintext secret sits on the page for as little time as possible and never enters the agent's context. If nothing is saved for that `(origin, username)`, Palmier prompts you in the app with a masked dialog. The dialog has a "Save for next time" checkbox (on by default): leave it checked to store the secret for reuse, or uncheck it to fill it just this once without saving. Either way it is filled into the page. The plaintext secret is never returned to the agent and is never written to task history.
 
-Saved passwords and PINs are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the host:
+Saved passwords and PINs are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the app via **Manage saved passwords** in the side panel (lists origin and username only, with per-entry delete), or from the host CLI:
 
 ```bash
 # List saved passwords (origin and username only — never the password)

package/dist/mcp-tools.js

@@ -182,8 +182,9 @@ const requestConfirmationTool = {
 const fillPasswordTool = {
     name: "fill-password",
     description: [
-        "Fill the user's saved password or PIN into a credential field in the active playwright-cli browser session.",
+        "Fill the user's saved password or PIN into a credential field and submit the form, in the active playwright-cli browser session.",
         "Use this instead of typing a password or PIN yourself — the secret is never revealed to you.",
+        "After filling, it immediately presses Enter to submit, so the secret stays on the page for as little time as possible. Call this only once the field is the last thing left to fill before submitting.",
         "Provide the page URL, the username/login identifier, and the playwright-cli ref of the field (and the session name if you opened a named session).",
         "If a secret for this (site, username) is already saved it is filled directly; otherwise the user is prompted to enter it, it is saved, then filled.",
         'Response: `{"ok": true}` on success, or `{"aborted": true}` if the user declines to provide it.',

package/dist/playwright-fill.d.ts

@@ -1,7 +1,9 @@
 /**
  * Fill `password` into the `ref` element of the agent's live playwright-cli
- * browser session. playwright-cli keeps a persistent server-side browser keyed
- * by session name, so this lands on the same page the agent is driving.
+ * browser session and submit (Enter) in the same invocation. playwright-cli
+ * keeps a persistent server-side browser keyed by session name, so this lands
+ * on the same page the agent is driving. Filling and submitting in one call
+ * keeps the plaintext secret on the page for as short a window as possible.
  *
  * The password is passed as an argv element (no shell, so no history/injection),
  * which leaves it briefly visible to other processes of the same user;

package/dist/playwright-fill.js

@@ -18,8 +18,10 @@ async function resolvePlaywrightCli() {
 }
 /**
  * Fill `password` into the `ref` element of the agent's live playwright-cli
- * browser session. playwright-cli keeps a persistent server-side browser keyed
- * by session name, so this lands on the same page the agent is driving.
+ * browser session and submit (Enter) in the same invocation. playwright-cli
+ * keeps a persistent server-side browser keyed by session name, so this lands
+ * on the same page the agent is driving. Filling and submitting in one call
+ * keeps the plaintext secret on the page for as short a window as possible.
  *
  * The password is passed as an argv element (no shell, so no history/injection),
  * which leaves it briefly visible to other processes of the same user;
@@ -33,6 +35,7 @@ export async function fillPasswordInBrowser(ref, password, session) {
         "fill",
         ref,
         password,
+        "--submit",
     ];
     const { exitCode, output } = await spawnCommand(command, args, { cwd: process.cwd(), resolveOnFailure: true });
     if (exitCode !== 0) {

package/dist/rpc-handler.js

@@ -10,6 +10,7 @@ import { getAgent, getPromptCommandLine, getNpmInstalledVersion } from "./agents
 import { validateClient, revokeClient } from "./client-store.js";
 import { publishHostEvent } from "./events.js";
 import { getLinkedDevice, setLinkedDevice, clearLinkedDevice, clearLinkedDeviceIfMatches } from "./linked-device.js";
+import { listPasswords, deletePassword } from "./password-store.js";
 import { currentVersion, performUpdate, performAgentUpdate } from "./update-checker.js";
 import { PLAYWRIGHT_CLI_PACKAGE, PLAYWRIGHT_CLI_LABEL } from "./playwright-cli.js";
 import { saveConfig } from "./config.js";
@@ -696,6 +697,15 @@ export function createRpcHandler(config, nc) {
                     clearLinkedDevice();
                 return { ok: true };
             }
+            case "passwords.list": {
+                return { passwords: listPasswords() };
+            }
+            case "passwords.delete": {
+                const params = request.params;
+                if (!params?.origin || !params?.username)
+                    return { error: "origin and username are required" };
+                return { ok: deletePassword(params.origin, params.username) };
+            }
             case "clients.revoke_self": {
                 const clientToken = request.clientToken ?? "";
                 if (!clientToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "1.0.6",
+  "version": "1.0.8",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "Apache-2.0",
   "author": "Hongxu Cai",