shadok-ai 0.15.56 → 0.15.58

package/README.md

@@ -906,7 +906,12 @@ mode a neutral near-black.
 Light/dark **mode** is an orthogonal, **per-browser** choice in the same menu
 (default dark; stored in `localStorage`, applied before first paint) and needs no
 endpoint — the accent is the instance's shared identity, the mode is personal),
-`/profiles`, `/secrets`, `/telegram`, `/defaults`, `/first-agent` (GET —
+`/profiles`, `/secrets`, `/secrets/audit` (GET, **admin only** — the secret
+audit log: who created/updated/deleted a secret, which profile it was attached
+to, and which agent **received** it at spawn or in a cron guard, with the person
+or door that caused it; names only, never a value; filters `secret`, `action`,
+`actor`, `agent`, `since`, `limit`. Also in the vault panel → *Audit log*, and
+🕘 on each secret), `/telegram`, `/defaults`, `/first-agent` (GET —
 `{pending, reason}`: whether this instance's lead agent is being started
 right now), `/version`, `/autoupdate`,
 `/update-channel` (POST `{channel}` — `alpha` or `beta`), `/permission-mode`, `/tweak/prepare` (POST — clone/refresh shadok-ai's own source,

package/dist/secret-audit.d.ts

@@ -0,0 +1,80 @@
+export type SecretAuditAction = "created" | "updated" | "deleted" | "attached" | "detached" | "injected" | "cron-check";
+export declare const SECRET_AUDIT_ACTIONS: SecretAuditAction[];
+/** Through which door the action came. */
+export type SecretAuditVia = "web" | "agent" | "telegram" | "cron" | "peer" | "api" | "system";
+export interface SecretAuditRow {
+    at: number;
+    action: SecretAuditAction;
+    /** Vault NAMES concerned — never values. */
+    secrets: string[];
+    /** Who did it: an account name, `agent <id8>`, a Telegram sender, `cron <id8>`… */
+    actor: string;
+    via: SecretAuditVia;
+    /** The agent concerned (the one that received it, or the one that acted). */
+    agent?: string;
+    agentName?: string;
+    profile?: string;
+    /** Launch dir of the instance that wrote the row. */
+    instance: string;
+    detail?: string;
+}
+/** Rotate past this size, keeping exactly one previous file. */
+export declare const AUDIT_ROTATE_BYTES: number;
+/** Build a row, or null when there is nothing to record (no secret named). An
+ *  agent spawned with no secret received none, and a row saying so is noise. */
+export declare function auditRow(r: Omit<SecretAuditRow, "at" | "secrets"> & {
+    secrets: (string | undefined | null)[];
+}, now: number): SecretAuditRow | null;
+/**
+ * Who started (or restarted) an agent, from what the WebSocket connection
+ * knows. The ORDER is the point: the most specific principal wins. A peer
+ * names a remote instance; a parent names the agent that delegated (pilotctl
+ * connects as the bootstrap admin, so the account alone would credit a person
+ * who did nothing); a cron or Telegram origin names a door with no account of
+ * its own. Only a plain web client is credited to its signed-in account.
+ */
+export declare function spawnActor(c: {
+    account?: string | null;
+    origin?: string | null;
+    peer?: string | null;
+    parent?: string | null;
+    from?: string | null;
+}): {
+    actor: string;
+    via: SecretAuditVia;
+};
+/** Who made an HTTP call: an agent by its session key beats the account it
+ *  authenticates as (which is the bootstrap admin for every agent). */
+export declare function httpActor(c: {
+    agentId?: string | null;
+    account?: string | null;
+    browser: boolean;
+}): {
+    actor: string;
+    via: SecretAuditVia;
+    agent?: string;
+};
+/** Names a profile write adds and removes. */
+export declare function profileSecretDiff(before: string[] | undefined, after: string[] | undefined): {
+    added: string[];
+    removed: string[];
+};
+/** Parse JSONL, skipping any line that is not a row (a torn write, a hand edit). */
+export declare function parseAudit(text: string): SecretAuditRow[];
+export interface AuditQuery {
+    secret?: string;
+    actor?: string;
+    agent?: string;
+    action?: string;
+    since?: number;
+    limit?: number;
+}
+/** Newest first, narrowed. `secret` is exact (it is a name); `actor`/`agent`
+ *  are substrings, since a person searches by a fragment of a name or an id. */
+export declare function filterAudit(rows: SecretAuditRow[], q: AuditQuery): SecretAuditRow[];
+/** Append one row. Never throws: losing an audit line must not fail the
+ *  action it describes — but it says so, since a silent gap is the failure an
+ *  audit exists to rule out. */
+export declare function recordSecretAudit(r: Parameters<typeof auditRow>[0], file?: string): SecretAuditRow | null;
+/** Every row we still hold (the rotated file first, so order is preserved). */
+export declare function readSecretAudit(file?: string): SecretAuditRow[];

package/dist/secret-audit.js

@@ -0,0 +1,156 @@
+/**
+ * The secret AUDIT log: who wrote, attached, and above all USED which vault
+ * secret — "which agent, started by which person, received which credential".
+ *
+ * Names only, never a value: the log is read by people who must not learn the
+ * credentials from it, and a value written here would be a second copy of the
+ * vault with none of its care.
+ *
+ * Global, like the vault it describes (`~/.shadok-ai/secret-audit.jsonl`, 600),
+ * with the launch dir on every row: several instances share one vault, and an
+ * audit split per instance would hide the one that touched it. Append-only
+ * JSONL — one `appendFileSync` per row, so two instances writing at once never
+ * rewrite each other's lines the way a read-modify-write JSON file would.
+ * Bounded by rotation (one `.1` kept), not by pruning rows in place: an audit
+ * trail that edits its own past is not one.
+ *
+ * "Use" means INJECTION, which is the only moment shadok hands a value to a
+ * process: an agent's spawn (env of `claude`) and a cron guard's run (env of
+ * `sh -c`). What the process does with the value afterwards is outside what
+ * shadok can see — the log says who RECEIVED a secret, and says so.
+ *
+ * Pure cores (`auditRow`, `spawnActor`, `httpActor`, `profileSecretDiff`,
+ * `parseAudit`, `filterAudit`) are tested; the file I/O is the thin part.
+ */
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+export const SECRET_AUDIT_ACTIONS = [
+    "created", "updated", "deleted", "attached", "detached", "injected", "cron-check",
+];
+const FILE = path.join(os.homedir(), ".shadok-ai", "secret-audit.jsonl");
+/** Rotate past this size, keeping exactly one previous file. */
+export const AUDIT_ROTATE_BYTES = 8 * 1024 * 1024;
+// ── Pure core ────────────────────────────────────────────────────────────
+/** Build a row, or null when there is nothing to record (no secret named). An
+ *  agent spawned with no secret received none, and a row saying so is noise. */
+export function auditRow(r, now) {
+    const secrets = [...new Set(r.secrets.filter((s) => typeof s === "string" && !!s.trim()).map((s) => s.trim()))].sort();
+    if (!secrets.length)
+        return null;
+    const row = { at: now, action: r.action, secrets, actor: r.actor || "unknown", via: r.via, instance: r.instance };
+    if (r.agent)
+        row.agent = r.agent;
+    if (r.agentName)
+        row.agentName = r.agentName;
+    if (r.profile)
+        row.profile = r.profile;
+    if (r.detail)
+        row.detail = r.detail;
+    return row;
+}
+/**
+ * Who started (or restarted) an agent, from what the WebSocket connection
+ * knows. The ORDER is the point: the most specific principal wins. A peer
+ * names a remote instance; a parent names the agent that delegated (pilotctl
+ * connects as the bootstrap admin, so the account alone would credit a person
+ * who did nothing); a cron or Telegram origin names a door with no account of
+ * its own. Only a plain web client is credited to its signed-in account.
+ */
+export function spawnActor(c) {
+    if (c.peer)
+        return { actor: `peer ${c.peer}`, via: "peer" };
+    if (c.parent)
+        return { actor: `agent ${c.parent.slice(0, 8)}`, via: "agent" };
+    if (c.origin === "cron")
+        return { actor: "cron", via: "cron" };
+    if (c.origin === "telegram")
+        return { actor: c.from ? `telegram ${c.from}` : "telegram", via: "telegram" };
+    if (c.origin === "web")
+        return { actor: c.account || "unknown", via: "web" };
+    return { actor: c.account || c.origin || "unknown", via: c.origin ? "api" : "system" };
+}
+/** Who made an HTTP call: an agent by its session key beats the account it
+ *  authenticates as (which is the bootstrap admin for every agent). */
+export function httpActor(c) {
+    if (c.agentId)
+        return { actor: `agent ${c.agentId.slice(0, 8)}`, via: "agent", agent: c.agentId };
+    return { actor: c.account || "unknown", via: c.browser ? "web" : "api" };
+}
+/** Names a profile write adds and removes. */
+export function profileSecretDiff(before, after) {
+    const b = new Set(before ?? []);
+    const a = new Set(after ?? []);
+    return { added: [...a].filter((n) => !b.has(n)).sort(), removed: [...b].filter((n) => !a.has(n)).sort() };
+}
+/** Parse JSONL, skipping any line that is not a row (a torn write, a hand edit). */
+export function parseAudit(text) {
+    const out = [];
+    for (const line of text.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            const r = JSON.parse(line);
+            if (r && typeof r.at === "number" && typeof r.action === "string" && Array.isArray(r.secrets))
+                out.push(r);
+        }
+        catch {
+            /* torn line */
+        }
+    }
+    return out;
+}
+/** Newest first, narrowed. `secret` is exact (it is a name); `actor`/`agent`
+ *  are substrings, since a person searches by a fragment of a name or an id. */
+export function filterAudit(rows, q) {
+    const actor = q.actor?.toLowerCase();
+    const agent = q.agent?.toLowerCase();
+    const out = rows.filter((r) => (!q.secret || r.secrets.includes(q.secret)) &&
+        (!q.action || r.action === q.action) &&
+        (!q.since || r.at >= q.since) &&
+        (!actor || r.actor.toLowerCase().includes(actor)) &&
+        (!agent || (r.agent ?? "").toLowerCase().includes(agent) || (r.agentName ?? "").toLowerCase().includes(agent)));
+    out.sort((a, b) => b.at - a.at);
+    return q.limit && q.limit > 0 ? out.slice(0, q.limit) : out;
+}
+// ── Storage ──────────────────────────────────────────────────────────────
+/** Append one row. Never throws: losing an audit line must not fail the
+ *  action it describes — but it says so, since a silent gap is the failure an
+ *  audit exists to rule out. */
+export function recordSecretAudit(r, file = FILE) {
+    const row = auditRow(r, Date.now());
+    if (!row)
+        return null;
+    try {
+        fs.mkdirSync(path.dirname(file), { recursive: true });
+        try {
+            if (fs.statSync(file).size > AUDIT_ROTATE_BYTES)
+                fs.renameSync(file, file + ".1");
+        }
+        catch {
+            /* no file yet */
+        }
+        fs.appendFileSync(file, JSON.stringify(row) + "\n", { mode: 0o600 });
+        fs.chmodSync(file, 0o600);
+        console.log(`secret-audit: ${row.action} [${row.secrets.join(",")}] by ${row.actor}${row.agent ? ` → ${row.agent.slice(0, 8)}` : ""}`);
+        return row;
+    }
+    catch (err) {
+        console.log(`secret-audit: could not record ${row.action} [${row.secrets.join(",")}] — ${err.message}`);
+        return null;
+    }
+}
+/** Every row we still hold (the rotated file first, so order is preserved). */
+export function readSecretAudit(file = FILE) {
+    let text = "";
+    for (const f of [file + ".1", file]) {
+        try {
+            text += fs.readFileSync(f, "utf8") + "\n";
+        }
+        catch {
+            /* absent */
+        }
+    }
+    return parseAudit(text);
+}
+//# sourceMappingURL=secret-audit.js.map

package/dist/secret-audit.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-audit.js","sourceRoot":"","sources":["../src/secret-audit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAW7B,MAAM,CAAC,MAAM,oBAAoB,GAAwB;IACvD,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,UAAU,EAAE,UAAU,EAAE,UAAU,EAAE,YAAY;CAClF,CAAC;AAsBF,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,oBAAoB,CAAC,CAAC;AACzE,gEAAgE;AAChE,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAElD,4EAA4E;AAE5E;gFACgF;AAChF,MAAM,UAAU,QAAQ,CACtB,CAAsF,EACtF,GAAW;IAEX,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACpI,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,GAAG,GAAmB,EAAE,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC;IAClI,IAAI,CAAC,CAAC,KAAK;QAAE,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC;IACjC,IAAI,CAAC,CAAC,SAAS;QAAE,GAAG,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IAC7C,IAAI,CAAC,CAAC,OAAO;QAAE,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC;IACvC,IAAI,CAAC,CAAC,MAAM;QAAE,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;IACpC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CAAC,CAM1B;IACC,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAC5D,IAAI,CAAC,CAAC,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC;IAC9E,IAAI,CAAC,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;IAC/D,IAAI,CAAC,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC;IAC3G,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC;IAC7E,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,CAAC,MAAM,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC;AACzF,CAAC;AAED;uEACuE;AACvE,MAAM,UAAU,SAAS,CAAC,CAIzB;IACC,IAAI,CAAC,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;IAClG,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,OAAO,IAAI,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AAC3E,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,iBAAiB,CAAC,MAA4B,EAAE,KAA2B;IACzF,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAChC,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAC/B,OAAO,EAAE,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;AAC5G,CAAC;AAED,oFAAoF;AACpF,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,MAAM,GAAG,GAAqB,EAAE,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAS;QAC3B,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,IAAI,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7G,CAAC;QAAC,MAAM,CAAC;YACP,eAAe;QACjB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAWD;gFACgF;AAChF,MAAM,UAAU,WAAW,CAAC,IAAsB,EAAE,CAAa;IAC/D,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACrC,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC;IACrC,MAAM,GAAG,GAAG,IAAI,CAAC,MAAM,CACrB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC3C,CAAC,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,CAAC;QACpC,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC;QAC7B,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QACjD,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CACjH,CAAC;IACF,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IAChC,OAAO,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAC9D,CAAC;AAED,4EAA4E;AAE5E;;gCAEgC;AAChC,MAAM,UAAU,iBAAiB,CAC/B,CAAiC,EACjC,IAAI,GAAW,IAAI;IAEnB,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IACpC,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACtD,IAAI,CAAC;YACH,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,kBAAkB;gBAAE,EAAE,CAAC,UAAU,CAAC,IAAI,EAAE,IAAI,GAAG,IAAI,CAAC,CAAC;QACpF,CAAC;QAAC,MAAM,CAAC;YACP,iBAAiB;QACnB,CAAC;QACD,EAAE,CAAC,cAAc,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACrE,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QACvI,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,kCAAkC,GAAG,CAAC,MAAM,KAAK,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,OAAQ,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACnH,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAAC,IAAI,GAAW,IAAI;IACjD,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC;YACH,IAAI,IAAI,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/server.js

@@ -51,6 +51,7 @@ import { rowKind } from "../context/ledger-skill/ledger-core.mjs";
 import { linkRefusal, markAgentPrompt, notificationText, } from "./kinship.js";
 import { loadConfig, saveConfig, telegramConfig, applyTelegramPatch, titleForCwd, setTitleForCwd, themeForCwd, setThemeForCwd, twoFactorForCwd, setTwoFactorForCwd, backendForCwd, setBackendForCwd, } from "./config.js";
 import { secretsFor, secretNames, setSecret, deleteSecret, secretWriteVerdict, recordOrigin, originProfile, } from "./secrets.js";
+import { recordSecretAudit, readSecretAudit, filterAudit, spawnActor, httpActor, profileSecretDiff, } from "./secret-audit.js";
 import { getProfile, profileArgs, permissionModeArgs, isPermissionMode, isEffortLevel, envVarsNote, seedDefaultProfiles, migrateToTracking, seedTweakProfile, loadProfiles, upsertProfile, removeProfile, promptEditVerdict, secretAttachVerdict, READONLY_DENY, TWEAK_PROFILE_NAME, promptOrigin, effectiveProfile, shippedProfile, } from "./profiles.js";
 import { BOOTSTRAP_ADMIN, loadAccounts, verifyPassword, sessionSecret, signSession, readSessionFull, sessionAlive, saveAccounts, userWriteVerdict, newInvite, inviteVerdict, hashPassword, promptAuthor, signSessionKey, readSessionKey, } from "./accounts.js";
 import { admins2fa, authenticationOptions, enrollCodeVerdict, isInternalClient, keepsTwoAdminsVerdict, loginNext, newEnrollCode, publicPasskey, putChallenge, readPending, registrationOptions, resetVerdict, signPending, takeChallenge, twoFactorEnableVerdict, verifyAuthentication, verifyRegistration, PENDING_TTL_MS, } from "./twofactor.js";
@@ -280,7 +281,18 @@ function runCronCheck(c, target) {
         return Promise.resolve({ kind: "quiet" }); // no guard → the agent always runs
     return new Promise((resolve) => {
         const profile = target.profile ? getProfile(target.profile) : undefined;
-        const env = { ...process.env, ...secretsFor(profile?.secrets) };
+        const secretEnv = secretsFor(profile?.secrets);
+        const env = { ...process.env, ...secretEnv };
+        recordSecretAudit({
+            action: "cron-check",
+            secrets: Object.keys(secretEnv),
+            actor: `cron ${c.id.slice(0, 8)}`,
+            via: "cron",
+            agent: c.sessionId,
+            agentName: loadChannels().find((ch) => ch.sessionId === c.sessionId)?.name,
+            ...(target.profile ? { profile: target.profile } : {}),
+            instance: process.cwd(),
+        });
         execFile("sh", ["-c", c.check], { cwd: target.cwd, env, timeout: 2 * 60_000, maxBuffer: 1 << 20 }, (err, stdout, stderr) => {
             const out = (stdout || "").trim();
             if (out)
@@ -957,6 +969,21 @@ function callerOf(req) {
     const profile = sessions.get(id)?.profile ?? loadChannels().find((c) => c.sessionId === id)?.profile ?? null;
     return { id, profile };
 }
+/** Who an HTTP call to the vault/profile routes is, for the secret audit log. */
+function auditActorOf(req) {
+    return httpActor({
+        agentId: callerOf(req).id,
+        account: currentAccount(req)?.name ?? null,
+        browser: requestFromBrowser(req),
+    });
+}
+/** One audit row per direction of a profile's secret list change. */
+function auditProfileSecrets(req, profile, diff, detail) {
+    const who = auditActorOf(req);
+    const base = { ...who, profile, instance: process.cwd(), ...(detail ? { detail } : {}) };
+    recordSecretAudit({ action: "attached", secrets: diff.added, ...base });
+    recordSecretAudit({ action: "detached", secrets: diff.removed, ...base });
+}
 /** A browser on our own origin — the only caller allowed to change guardrails. */
 function requestFromBrowser(req) {
     return browserOrigin(req.headers.origin, req.headers.host, EXTRA_ORIGINS);
@@ -1725,6 +1752,7 @@ app.put("/secrets", (req, res) => {
     if (verdict === "refused")
         return res.status(409).json({ error: "exists", name: key });
     setSecret(key, value);
+    recordSecretAudit({ action: verdict, secrets: [key], ...auditActorOf(req), instance: process.cwd() });
     // Remember WHO created it, so the agent can later attach it to its own
     // profile (`PUT /profiles/secret`). Only on a creation: recording an
     // overwrite too would let an agent clobber a human's secret to become its
@@ -1736,10 +1764,33 @@ app.put("/secrets", (req, res) => {
     }
     res.json({ names: secretNames(), result: verdict });
 });
+// Who wrote, attached and RECEIVED which secret (names only). Admin only: it
+// maps every credential to the agents and people that held it. See
+// src/secret-audit.ts.
+app.get("/secrets/audit", (req, res) => {
+    if (currentAccount(req)?.role !== "admin")
+        return res.status(403).json({ error: "admins only" });
+    const q = req.query;
+    const str = (v) => (typeof v === "string" && v.trim() ? v.trim() : undefined);
+    const limit = Math.min(Math.max(Number(q.limit) || 500, 1), 5000);
+    const since = Number(q.since) || undefined;
+    res.json({
+        rows: filterAudit(readSecretAudit(), {
+            secret: str(q.secret),
+            actor: str(q.actor),
+            agent: str(q.agent),
+            action: str(q.action),
+            since,
+            limit,
+        }),
+    });
+});
 app.delete("/secrets", (req, res) => {
     const name = String(req.query.name ?? req.body?.name ?? "").trim();
-    if (name)
+    if (name && secretNames().includes(name)) {
         deleteSecret(name);
+        recordSecretAudit({ action: "deleted", secrets: [name], ...auditActorOf(req), instance: process.cwd() });
+    }
     res.json({ names: secretNames() });
 });
 // Agent profiles (global): role + permission guardrails + referenced secrets,
@@ -2461,7 +2512,9 @@ app.put("/profiles", (req, res) => {
     };
     if (b.effort !== undefined && b.effort !== "" && !isEffortLevel(b.effort))
         return res.status(400).json({ error: `unknown effort level: ${String(b.effort)}` });
+    const secretDiff = profileSecretDiff(getProfile(name)?.secrets, p.secrets);
     upsertProfile(p);
+    auditProfileSecrets(req, name, secretDiff);
     res.json(loadProfiles().map((x) => ({ ...x, origin: promptOrigin(x, shippedProfile(x.name)) })));
 });
 /**
@@ -2538,6 +2591,8 @@ app.put("/profiles/secret", (req, res) => {
     const secrets = [...new Set([...(existing.secrets ?? []), name])];
     upsertProfile({ ...existing, secrets });
     console.log(`profile-secret: ${caller} += ${name}`);
+    if (!(existing.secrets ?? []).includes(name))
+        recordSecretAudit({ action: "attached", secrets: [name], ...auditActorOf(req), profile: caller, instance: process.cwd() });
     res.json({
         ok: true,
         profile: caller,
@@ -2564,14 +2619,17 @@ app.post("/reload", (req, res) => {
     // new process is ready so it carries on. Scoped to the SELF-reload only — not
     // the GUI reload, restart-all, or an auto-update respawn (those touch many/all
     // agents at once, and waking every idle one would be a token storm).
-    void restartSession(s)
+    void restartSession(s, { actor: `agent ${id.slice(0, 8)}`, via: "agent" })
         .then(() => continueAfterReload(s.id))
         .catch(() => { });
 });
 app.delete("/profiles", (req, res) => {
     const name = String(req.query.name ?? req.body?.name ?? "").trim();
-    if (name)
+    if (name) {
+        const before = getProfile(name)?.secrets;
         removeProfile(name);
+        auditProfileSecrets(req, name, profileSecretDiff(before, []), "profile deleted");
+    }
     res.json(loadProfiles());
 });
 /** Build the /telegram state view (token is never included). */
@@ -2773,14 +2831,14 @@ app.post("/autoupdate", (req, res) => {
  * await the loop: a caller (the toggle, the button) must not hang for minutes
  * while a big fleet cycles.
  */
-function restartAllSessions(ids) {
+function restartAllSessions(ids, by = SYSTEM_SPAWN) {
     // A subset (e.g. only the agents flagged as needing a Claude Code reload) when
     // `ids` is given, all live sessions otherwise. Same one-at-a-time discipline.
     const wanted = ids && ids.length ? new Set(ids) : null;
     const live = [...sessions.values()].filter((s) => !wanted || wanted.has(s.id));
     void (async () => {
         for (const s of live)
-            await restartSession(s).catch(() => { });
+            await restartSession(s, by).catch(() => { });
     })();
     return live.length;
 }
@@ -2793,7 +2851,7 @@ app.post("/restart-all", (req, res) => {
     const ids = Array.isArray(req.body?.sessions)
         ? req.body.sessions.filter((x) => typeof x === "string" && !!x)
         : undefined;
-    const restarted = restartAllSessions(ids);
+    const restarted = restartAllSessions(ids, auditActorOf(req));
     console.log(`restart-all: respawning ${restarted} agent(s)${ids ? " (filtered)" : ""}, one at a time`);
     res.json({ restarted });
 });
@@ -3030,7 +3088,7 @@ app.post("/ledger", (req, res) => {
     cfg.ledgerEnabled = ledgerEnabled;
     saveConfig(cfg);
     broadcastAll(versionMessage());
-    const restarted = changed ? restartAllSessions() : 0;
+    const restarted = changed ? restartAllSessions(undefined, auditActorOf(req)) : 0;
     res.json({ ledgerEnabled, restarted });
 });
 /**
@@ -3384,7 +3442,7 @@ function broadcast(s, msg, except) {
  * preserved (resume reads the transcript); every attached client keeps its ref.
  * Shared by the `restart` message and by `set-profile` with `restart: true`.
  */
-async function restartSession(s) {
+async function restartSession(s, by = SYSTEM_SPAWN) {
     s.restarting = true;
     // The raw pipe is bound to the pilot we're about to replace — close it;
     // clients re-attach on the next "ready" if the terminal is open.
@@ -3445,6 +3503,7 @@ async function restartSession(s) {
     // A restart spawns a brand-new process, so its anchor is current: re-record
     // it (clearing `legacy`), which is what makes the reload indicator go dark.
     recordSpawnFingerprint(s);
+    recordSecretInjection(s, by, "restart");
     s.lastStaleSig = undefined;
     // `lastTurnMs`, like the connect-path `ready`: the transient "working" above
     // started the client's turn timer, and this "ready" is what stops it — without
@@ -3492,19 +3551,27 @@ function profileMessage(s) {
 function broadcastProfile(s) {
     broadcast(s, profileMessage(s));
 }
-// ── Reload indicator: is a running agent behind what a fresh spawn gives? ────
-//
-// The signal is version-INDEPENDENT (see `stalenessReasons`): it compares what
-// the RUNNING process actually received against what shadok injects now. The
-// anchor is DURABLE (the channel on disk, `spawnFp`/`spawnAt`/`spawnClaudeVer`)
-// because the in-memory `prepromptById` snapshot is reset to "current" whenever
-// a surviving tmux pane is re-adopted after a server restart — which is exactly
-// the moment a shadok auto-update changes the prompt under a live agent, so an
-// in-memory anchor would hide the very drift this detects.
-/** Record this agent's spawn fingerprint — but ONLY for a process we actually
- *  spawned. An adopted pane is the OLD process: its stored fingerprint must be
- *  left alone (or seeded as `legacy` the first time, so a pre-feature agent
- *  reads as stale until reloaded). Called once after `attachPilot`. */
+const SYSTEM_SPAWN = { actor: "system", via: "system" };
+/**
+ * Audit which vault secrets a FRESH process just received. An adopted tmux
+ * pane got its env when it was first spawned (already logged then), so a
+ * reattach records nothing — it hands no value to anyone.
+ */
+function recordSecretInjection(s, by, detail) {
+    if (s.pilot instanceof TmuxPilot && s.pilot.attached)
+        return;
+    const profile = s.profile ? getProfile(s.profile) : undefined;
+    recordSecretAudit({
+        action: "injected",
+        secrets: Object.keys(secretsFor(profile?.secrets)),
+        ...by,
+        agent: s.id,
+        agentName: loadChannels().find((c) => c.sessionId === s.id)?.name,
+        ...(s.profile ? { profile: s.profile } : {}),
+        instance: process.cwd(),
+        detail,
+    });
+}
 function recordSpawnFingerprint(s) {
     const adopted = s.pilot instanceof TmuxPilot && s.pilot.attached;
     if (adopted) {
@@ -3690,7 +3757,7 @@ function ensureClaudeOnce(revalidate = true) {
         claudeReady = null; });
     return p;
 }
-async function createSession(id, cwd, args, worktree = null, profile = null, model = null, effort = null) {
+async function createSession(id, cwd, args, worktree = null, profile = null, model = null, effort = null, by = SYSTEM_SPAWN) {
     const pilot = makePilot(id, cwd, args, profile, model, effort);
     // Resumed sessions start with what the transcript already consumed.
     const seededUsage = scanUsage(sessionFilePath(cwd, id));
@@ -3739,6 +3806,7 @@ async function createSession(id, cwd, args, worktree = null, profile = null, mod
     // tell whether it drifted. No-op-safe for an adopted pane (keeps the old
     // anchor); seeds `legacy` the first time a pre-feature agent is adopted.
     recordSpawnFingerprint(s);
+    recordSecretInjection(s, by, args.includes("--resume") ? "resume" : "spawn");
     return s;
 }
 /**
@@ -4383,6 +4451,9 @@ wss.on("connection", (ws, req) => {
     // profile's `deny` (measured), so pilotctl and the agents, which connect with
     // no Origin at all (invariant 11), must not be able to reach it.
     const fromBrowser = requestFromBrowser(req);
+    // Who a respawn asked from this socket is credited to in the secret audit
+    // log. A function, not a value: `origin` is only known once `start` arrives.
+    const wsBy = () => spawnActor({ account: me?.name, origin, peer: callerPeer });
     let session = null;
     // Where does this client come from? Declared at `start` (web, cron, telegram,
     // cli…), it travels with the prompt echo: other clients must be able to SAY
@@ -4663,7 +4734,7 @@ wss.on("connection", (ws, req) => {
                     const initialName = !resumed && typeof msg.name === "string" && msg.name.trim()
                         ? msg.name.trim().slice(0, 80)
                         : undefined;
-                    session = await createSession(id, effectiveCwd, args, worktree, profile, model, effort);
+                    session = await createSession(id, effectiveCwd, args, worktree, profile, model, effort, spawnActor({ account: me?.name, origin: msg.origin, peer: callerPeer, parent: parentAtStart }));
                     session.clients.add(ws);
                     if (resumed) {
                         const turns = historyWithOffers(loadHistory(effectiveCwd, id), id);
@@ -5086,7 +5157,7 @@ wss.on("connection", (ws, req) => {
                 case "restart": {
                     if (!session)
                         return fail("no session started");
-                    await restartSession(session);
+                    await restartSession(session, wsBy());
                     break;
                 }
                 case "set-profile": {
@@ -5105,7 +5176,7 @@ wss.on("connection", (ws, req) => {
                     upsertChannel({ sessionId: s.id, profile: name });
                     broadcastProfile(s); // even without a restart: the gap shows everywhere
                     if (msg.restart)
-                        await restartSession(s);
+                        await restartSession(s, wsBy());
                     break;
                 }
                 case "set-model": {
@@ -5120,7 +5191,7 @@ wss.on("connection", (ws, req) => {
                     const model = msg.model?.trim() || null;
                     s.model = model ?? undefined;
                     upsertChannel({ sessionId: s.id, model });
-                    await restartSession(s); // respawns with the new --model (s.model)
+                    await restartSession(s, wsBy()); // respawns with the new --model (s.model)
                     broadcastProfile(s); // running == desired now
                     break;
                 }
@@ -5140,7 +5211,7 @@ wss.on("connection", (ws, req) => {
                         return fail(`unknown effort level: ${wanted}`);
                     s.effort = wanted ?? undefined;
                     upsertChannel({ sessionId: s.id, effort: wanted });
-                    await restartSession(s); // respawns with the new --effort
+                    await restartSession(s, wsBy()); // respawns with the new --effort
                     broadcastProfile(s); // running == desired now
                     break;
                 }