skillscript-runtime 0.25.2 → 0.25.3

package/dist/secrets.js

@@ -147,6 +147,60 @@ onResolve) {
     }
     return text.replace(SECRET_MARKER, (_m, name) => resolved.get(name));
 }
+// ─── author-template-only resolution (mask → substitute → splice) ───────────
+// A secret must resolve ONLY when its marker is literally in the AUTHORED op
+// template — never when `{{secret.X}}` text arrives at the sink via `${VAR}`
+// runtime data (that would be a data-borne injection: untrusted input naming a
+// declared secret could exfiltrate it). The runtime therefore masks author
+// markers to opaque sentinels BEFORE `${VAR}` substitution, then splices the
+// resolved values LAST. Consequence: (a) data/var-borne marker text is inert
+// (it's never a sentinel), (b) secret values are never re-templated by a later
+// substitution pass, (c) the value exists only at the final splice, at the sink.
+/** Opaque sentinel for a masked author marker. NUL-delimited so it survives
+ * `${VAR}` substitution (no `$`/`{{`), shell tokenization (no spaces/quotes),
+ * and won't occur in skill source or substituted data. */
+const secretSentinel = (i) => `secret:${i}`;
+const SECRET_SENTINEL_RE = /secret:(\d+)/g;
+/**
+ * Replace each author-written `{{secret.NAME}}` in `tpl` with an opaque
+ * sentinel, calling `onName(name)` per marker (the caller enforces
+ * declare-before-spend there). Only well-formed static markers match — a
+ * dynamic/malformed `{{secret.${VAR}}}` is left as-is (caught by lint; inert at
+ * runtime since it never becomes a sentinel). Returns the masked text + the
+ * ordered names for {@link spliceSecrets}.
+ */
+export function maskAuthorSecrets(tpl, onName) {
+    const names = [];
+    const masked = tpl.replace(SECRET_MARKER, (_m, name) => {
+        onName(name);
+        const i = names.length;
+        names.push(name);
+        return secretSentinel(i);
+    });
+    return { masked, names };
+}
+/**
+ * Replace sentinels in `text` with resolved secret values — the final step,
+ * at the sink boundary. Resolution (the provider call) happens HERE, so the
+ * value's lifetime is the single dispatch. `names` comes from the mask step.
+ * `onResolve` collects values for redaction. No-op when `names` is empty.
+ */
+export async function spliceSecrets(text, names, provider, ctx, onResolve) {
+    if (names.length === 0)
+        return text;
+    const resolved = new Map();
+    for (const name of new Set(names)) {
+        const value = await provider.resolve(name, ctx);
+        resolved.set(name, value);
+        onResolve?.(name, value);
+    }
+    return text.replace(SECRET_SENTINEL_RE, (_m, idx) => resolved.get(names[Number(idx)]));
+}
+/** Replace sentinels with their `{{secret.NAME}}` marker form (for previews /
+ * mechanical mode — shows the marker, never the value, never the raw sentinel). */
+export function unmaskSecretSentinels(text, names) {
+    return text.replace(SECRET_SENTINEL_RE, (_m, idx) => `{{secret.${names[Number(idx)]}}}`);
+}
 /**
  * {@link expandSecretMarkers} over a list (the `shell(...)` argv form, where
  * each element is substituted independently). Markerless elements pass

package/dist/secrets.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,8EAA8E;AAC9E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEhC;IAEA;IAHlB,YACkB,UAAkB;IAClC,yDAAyD;IACzC,WAAmB;QAEnC,KAAK,CAAC,WAAW,UAAU,wCAAwC,WAAW,EAAE,CAAC,CAAC;QAJlE,eAAU,GAAV,UAAU,CAAQ;QAElB,gBAAW,GAAX,WAAW,CAAQ;QAGnC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAIC;IAH7B,kEAAkE;IAClE,MAAM,CAAU,MAAM,GAAG,qBAAqB,CAAC;IAE/C,YAA6B,MAAyB,OAAO,CAAC,GAAG;QAApC,QAAG,GAAH,GAAG,CAAiC;IAAG,CAAC;IAErE,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAsB;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CACjC,IAAI,EACJ,OAAO,GAAG,6EAA6E;gBACrF,uGAAuG,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;2EAG2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,8EAA8E;IAC9E,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,QAAwB,EACxB,GAAqB;AACrB;;yCAEyC;AACzC,SAAiD;IAEjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC;AAChF,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAe,EACf,QAAwB,EACxB,GAAqB,EACrB,SAAiD;IAEjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AA6BH,8EAA8E;AAC9E,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IAEhC;IAEA;IAHlB,YACkB,UAAkB;IAClC,yDAAyD;IACzC,WAAmB;QAEnC,KAAK,CAAC,WAAW,UAAU,wCAAwC,WAAW,EAAE,CAAC,CAAC;QAJlE,eAAU,GAAV,UAAU,CAAQ;QAElB,gBAAW,GAAX,WAAW,CAAQ;QAGnC,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;IAC1C,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAIC;IAH7B,kEAAkE;IAClE,MAAM,CAAU,MAAM,GAAG,qBAAqB,CAAC;IAE/C,YAA6B,MAAyB,OAAO,CAAC,GAAG;QAApC,QAAG,GAAH,GAAG,CAAiC;IAAG,CAAC;IAErE,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,IAAsB;QAChD,MAAM,GAAG,GAAG,iBAAiB,CAAC,MAAM,GAAG,IAAI,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACxC,MAAM,IAAI,yBAAyB,CACjC,IAAI,EACJ,OAAO,GAAG,6EAA6E;gBACrF,uGAAuG,CAC1G,CAAC;QACJ,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;;AAGH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAEtE;;;;;;GAMG;AACH,MAAM,aAAa,GAAG,uCAAuC,CAAC;AAE9D,sEAAsE;AACtE,MAAM,UAAU,eAAe,CAAC,IAAY;IAC1C,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,OAAO,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAClC,CAAC;AAED;;;2EAG2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IACpC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,6EAA6E;IAC7E,6EAA6E;IAC7E,uCAAuC;IACvC,aAAa,CAAC,SAAS,GAAG,CAAC,CAAC;IAC5B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,aAAa,CAAC;QAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC;AACpB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAY;IACrD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,8EAA8E;IAC9E,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACzC,IAAI,CAAC,sCAAsC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACzE,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAY,EACZ,QAAwB,EACxB,GAAqB;AACrB;;yCAEyC;AACzC,SAAiD;IAEjD,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACxC,sEAAsE;IACtE,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAE,CAAC,CAAC;AAChF,CAAC;AAED,+EAA+E;AAC/E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,6EAA6E;AAC7E,+EAA+E;AAC/E,iFAAiF;AAEjF;;0DAE0D;AAC1D,MAAM,cAAc,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC;AAC9D,MAAM,kBAAkB,GAAG,iBAAiB,CAAC;AAS7C;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAA8B;IAC3E,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,aAAa,EAAE,CAAC,EAAE,EAAE,IAAY,EAAE,EAAE;QAC7D,MAAM,CAAC,IAAI,CAAC,CAAC;QACb,MAAM,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC;QACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACjB,OAAO,cAAc,CAAC,CAAC,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IACH,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;AAC3B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,IAAY,EACZ,KAAe,EACf,QAAwB,EACxB,GAAqB,EACrB,SAAiD;IAEjD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAkB,CAAC;IAC3C,KAAK,MAAM,IAAI,IAAI,IAAI,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAChD,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAE,CAAE,CAAC,CAAC;AACnG,CAAC;AAED;mFACmF;AACnF,MAAM,UAAU,qBAAqB,CAAC,IAAY,EAAE,KAAe;IACjE,OAAO,IAAI,CAAC,OAAO,CAAC,kBAAkB,EAAE,CAAC,EAAE,EAAE,GAAW,EAAE,EAAE,CAAC,YAAY,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAE,IAAI,CAAC,CAAC;AACpG,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,yBAAyB,CAC7C,KAAe,EACf,QAAwB,EACxB,GAAqB,EACrB,SAAiD;IAEjD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,IAAI,IAAI,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,MAAM,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;IAC9F,OAAO,GAAG,CAAC;AACb,CAAC"}

package/examples/skillscripts/hello-world.skill.provenance.json

@@ -2,7 +2,7 @@
   "provenance_version": "1.0",
   "language_version": "1.0",
   "compiler_version": "0.1.0-dev",
-  "compiled_at": "2026-06-28T20:20:49.698Z",
+  "compiled_at": "2026-06-28T21:34:32.766Z",
   "source_skill": {
     "name": "hello-world"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "skillscript-runtime",
-  "version": "0.25.2",
+  "version": "0.25.3",
   "description": "Runtime, compiler, lint, CLI, and dashboard for Skillscript — a small declarative language for authoring agent workflows.",
   "license": "MIT",
   "author": "Scott Shwarts <scotts@pobox.com>",