palmier 1.0.7 → 1.0.8

package/README.md

@@ -158,7 +158,7 @@ Revoking the linked device also clears the host's linked-device record; device c
 
 Palmier can store website passwords and PINs like a browser's password manager so agents can sign in to sites without ever seeing the credentials. When an agent driving a browser (via the `playwright-cli` skill) reaches a login or PIN field, it calls the `fill-password` tool with the page URL, the username, and the field's element ref. Palmier matches the saved secret by **origin**, fills it directly into the live browser session, and presses Enter to submit the form in the same step — so the plaintext secret sits on the page for as little time as possible and never enters the agent's context. If nothing is saved for that `(origin, username)`, Palmier prompts you in the app with a masked dialog. The dialog has a "Save for next time" checkbox (on by default): leave it checked to store the secret for reuse, or uncheck it to fill it just this once without saving. Either way it is filled into the page. The plaintext secret is never returned to the agent and is never written to task history.
 
-Saved passwords and PINs are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the host:
+Saved passwords and PINs are encrypted at rest with AES-256-GCM under a host-local key, both stored in `~/.config/palmier/` (`passwords.enc` and `password-key`). Manage them from the app via **Manage saved passwords** in the side panel (lists origin and username only, with per-entry delete), or from the host CLI:
 
 ```bash
 # List saved passwords (origin and username only — never the password)

package/dist/rpc-handler.js

@@ -10,6 +10,7 @@ import { getAgent, getPromptCommandLine, getNpmInstalledVersion } from "./agents
 import { validateClient, revokeClient } from "./client-store.js";
 import { publishHostEvent } from "./events.js";
 import { getLinkedDevice, setLinkedDevice, clearLinkedDevice, clearLinkedDeviceIfMatches } from "./linked-device.js";
+import { listPasswords, deletePassword } from "./password-store.js";
 import { currentVersion, performUpdate, performAgentUpdate } from "./update-checker.js";
 import { PLAYWRIGHT_CLI_PACKAGE, PLAYWRIGHT_CLI_LABEL } from "./playwright-cli.js";
 import { saveConfig } from "./config.js";
@@ -696,6 +697,15 @@ export function createRpcHandler(config, nc) {
                     clearLinkedDevice();
                 return { ok: true };
             }
+            case "passwords.list": {
+                return { passwords: listPasswords() };
+            }
+            case "passwords.delete": {
+                const params = request.params;
+                if (!params?.origin || !params?.username)
+                    return { error: "origin and username are required" };
+                return { ok: deletePassword(params.origin, params.username) };
+            }
             case "clients.revoke_self": {
                 const clientToken = request.clientToken ?? "";
                 if (!clientToken)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "palmier",
-  "version": "1.0.7",
+  "version": "1.0.8",
   "description": "Palmier host CLI - provisions, executes tasks, and serves NATS RPC",
   "license": "Apache-2.0",
   "author": "Hongxu Cai",