sliccy 3.39.2 → 3.40.0

package/dist/node-server/_shared/cdp-frame-unmask.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Pure, platform-agnostic helper that unmasks whole-token secret fields inside a
+ * parsed CDP command frame, gating on the target tab's hostname via the existing
+ * `SecretsPipeline` (no second masking implementation).
+ *
+ * Three CDP methods carry a single, whole masked token in one frame and are
+ * the only ones unmasked here (D1 in the feature spec):
+ *   - `Runtime.callFunctionOn` → string entries in `params.arguments[].value`
+ *   - `Runtime.evaluate`       → `params.expression`
+ *   - `Input.insertText`       → `params.text`
+ *
+ * Per-frame domain gating reuses `SecretsPipeline.unmaskBody` semantics:
+ * on a domain mismatch (or missing secret) the value is left verbatim (no
+ * forbidden surface — masked values in conversation context are harmless).
+ *
+ * Returns `{ frame, changed }`. When nothing applies the original frame
+ * reference is returned untouched (no clone, no mutation).
+ */
+import type { SecretsPipeline } from './secrets-pipeline.js';
+export interface CdpFrame {
+    method?: string;
+    params?: unknown;
+    [key: string]: unknown;
+}
+export interface UnmaskCdpFrameResult {
+    frame: CdpFrame;
+    changed: boolean;
+}
+export declare function unmaskCdpFrame(frame: CdpFrame, hostname: string, pipeline: SecretsPipeline): UnmaskCdpFrameResult;
+//# sourceMappingURL=cdp-frame-unmask.d.ts.map

package/dist/node-server/_shared/cdp-frame-unmask.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdp-frame-unmask.d.ts","sourceRoot":"","sources":["../src/cdp-frame-unmask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AAE7D,MAAM,WAAW,QAAQ;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,QAAQ,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAWD,wBAAgB,cAAc,CAC5B,KAAK,EAAE,QAAQ,EACf,QAAQ,EAAE,MAAM,EAChB,QAAQ,EAAE,eAAe,GACxB,oBAAoB,CAmDtB"}

package/dist/node-server/_shared/cdp-frame-unmask.js

@@ -0,0 +1,82 @@
+/**
+ * Pure, platform-agnostic helper that unmasks whole-token secret fields inside a
+ * parsed CDP command frame, gating on the target tab's hostname via the existing
+ * `SecretsPipeline` (no second masking implementation).
+ *
+ * Three CDP methods carry a single, whole masked token in one frame and are
+ * the only ones unmasked here (D1 in the feature spec):
+ *   - `Runtime.callFunctionOn` → string entries in `params.arguments[].value`
+ *   - `Runtime.evaluate`       → `params.expression`
+ *   - `Input.insertText`       → `params.text`
+ *
+ * Per-frame domain gating reuses `SecretsPipeline.unmaskBody` semantics:
+ * on a domain mismatch (or missing secret) the value is left verbatim (no
+ * forbidden surface — masked values in conversation context are harmless).
+ *
+ * Returns `{ frame, changed }`. When nothing applies the original frame
+ * reference is returned untouched (no clone, no mutation).
+ */
+function unmaskString(pipeline, hostname, value) {
+    const { text } = pipeline.unmaskBody(value, hostname);
+    return { text, changed: text !== value };
+}
+export function unmaskCdpFrame(frame, hostname, pipeline) {
+    if (!frame || typeof frame !== 'object')
+        return { frame, changed: false };
+    if (!pipeline.hasSecrets())
+        return { frame, changed: false };
+    const method = frame.method;
+    const params = frame.params;
+    if (!params || typeof params !== 'object')
+        return { frame, changed: false };
+    if (method === 'Runtime.evaluate') {
+        const p = params;
+        if (typeof p.expression !== 'string')
+            return { frame, changed: false };
+        const { text, changed } = unmaskString(pipeline, hostname, p.expression);
+        if (!changed)
+            return { frame, changed: false };
+        return {
+            frame: { ...frame, params: { ...p, expression: text } },
+            changed: true,
+        };
+    }
+    if (method === 'Input.insertText') {
+        const p = params;
+        if (typeof p.text !== 'string')
+            return { frame, changed: false };
+        const { text, changed } = unmaskString(pipeline, hostname, p.text);
+        if (!changed)
+            return { frame, changed: false };
+        return {
+            frame: { ...frame, params: { ...p, text } },
+            changed: true,
+        };
+    }
+    if (method === 'Runtime.callFunctionOn') {
+        const p = params;
+        if (!Array.isArray(p.arguments))
+            return { frame, changed: false };
+        let argsChanged = false;
+        const nextArgs = p.arguments.map((arg) => {
+            if (!arg || typeof arg !== 'object')
+                return arg;
+            const a = arg;
+            if (typeof a.value !== 'string')
+                return arg;
+            const { text, changed } = unmaskString(pipeline, hostname, a.value);
+            if (!changed)
+                return arg;
+            argsChanged = true;
+            return { ...a, value: text };
+        });
+        if (!argsChanged)
+            return { frame, changed: false };
+        return {
+            frame: { ...frame, params: { ...p, arguments: nextArgs } },
+            changed: true,
+        };
+    }
+    return { frame, changed: false };
+}
+//# sourceMappingURL=cdp-frame-unmask.js.map

package/dist/node-server/_shared/cdp-frame-unmask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cdp-frame-unmask.js","sourceRoot":"","sources":["../src/cdp-frame-unmask.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAeH,SAAS,YAAY,CACnB,QAAyB,EACzB,QAAgB,EAChB,KAAa;IAEb,MAAM,EAAE,IAAI,EAAE,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;IACtD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,EAAE,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,cAAc,CAC5B,KAAe,EACf,QAAgB,EAChB,QAAyB;IAEzB,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC1E,IAAI,CAAC,QAAQ,CAAC,UAAU,EAAE;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE7D,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5B,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAE5E,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAAkC,CAAC;QAC7C,IAAI,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACvE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,UAAU,CAAC,CAAC;QACzE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,EAAE;YACvD,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,kBAAkB,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,MAA4B,CAAC;QACvC,IAAI,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACjE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAC/C,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE;YAC3C,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,wBAAwB,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,MAAiC,CAAC;QAC5C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QAClE,IAAI,WAAW,GAAG,KAAK,CAAC;QACxB,MAAM,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;YACvC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAChD,MAAM,CAAC,GAAG,GAA0B,CAAC;YACrC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAAE,OAAO,GAAG,CAAC;YAC5C,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACpE,IAAI,CAAC,OAAO;gBAAE,OAAO,GAAG,CAAC;YACzB,WAAW,GAAG,IAAI,CAAC;YACnB,OAAO,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAC/B,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;QACnD,OAAO;YACL,KAAK,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,EAAE,GAAG,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE;YAC1D,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AACnC,CAAC"}

package/dist/node-server/_shared/index.d.ts

@@ -1,4 +1,6 @@
+export * from './cdp-frame-unmask.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './secret-masking.js';
 export * from './secrets-pipeline.js';
+export * from './session-secret-store.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/node-server/_shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC"}

package/dist/node-server/_shared/index.js

@@ -1,5 +1,7 @@
 // Re-exports added in Task 1.2 (secret-masking) and Task 1.3 (secrets-pipeline).
+export * from './cdp-frame-unmask.js';
 export * from './oauth-extra-domains-storage.js';
 export * from './secret-masking.js';
 export * from './secrets-pipeline.js';
+export * from './session-secret-store.js';
 //# sourceMappingURL=index.js.map

package/dist/node-server/_shared/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA,iFAAiF;AAEjF,cAAc,uBAAuB,CAAC;AACtC,cAAc,kCAAkC,CAAC;AACjD,cAAc,qBAAqB,CAAC;AACpC,cAAc,uBAAuB,CAAC;AACtC,cAAc,2BAA2B,CAAC"}

package/dist/node-server/_shared/secrets-pipeline.d.ts

@@ -1,3 +1,4 @@
+import type { SessionSecretStore } from './session-secret-store.js';
 export interface FetchProxySecretSource {
     get(name: string): Promise<string | undefined>;
     listAll(): Promise<{
@@ -35,6 +36,13 @@ export interface ExtractedUrlCreds {
 export interface SecretsPipelineOpts {
     sessionId: string;
     source: FetchProxySecretSource;
+    /**
+     * Optional in-memory session-secret store. Its entries are layered on top
+     * of `source` at every `reload()` so the fetch proxy can unmask session
+     * secrets like persisted ones. Persisted secrets win on a name collision
+     * (the agent cannot shadow a real persisted secret's masking).
+     */
+    sessionStore?: SessionSecretStore;
 }
 /**
  * Stateful unmask/scrub pipeline shared between node-server's /api/fetch-proxy
@@ -63,6 +71,7 @@ export interface SecretsPipelineOpts {
 export declare class SecretsPipeline {
     readonly sessionId: string;
     private readonly source;
+    private readonly sessionStore?;
     private maskedToSecret;
     private scrubber;
     constructor(opts: SecretsPipelineOpts);

package/dist/node-server/_shared/secrets-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-pipeline.d.ts","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAsCA,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;CAChC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAe;IAC1B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAsC;gBAE1C,IAAI,EAAE,mBAAmB;IAK/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAoBvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,UAAU,IAAI,OAAO;IAIrB,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAQnF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY;IAYpD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAU5D,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW;IA6B5E,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAkCjE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAerF,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE;IAY1E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAOvD"}
+{"version":3,"file":"secrets-pipeline.d.ts","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAiCpE,MAAM,WAAW,sBAAsB;IACrC,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC;IAC/C,OAAO,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,EAAE,CAAC,CAAC;CAC1E;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,iBAAiB;IAChC,GAAG,EAAE,MAAM,CAAC;IACZ,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,SAAS,CAAC,EAAE,aAAa,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,sBAAsB,CAAC;IAC/B;;;;;OAKG;IACH,YAAY,CAAC,EAAE,kBAAkB,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,qBAAa,eAAe;IAC1B,SAAgB,SAAS,EAAE,MAAM,CAAC;IAClC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAyB;IAChD,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAqB;IACnD,OAAO,CAAC,cAAc,CAAmC;IACzD,OAAO,CAAC,QAAQ,CAAsC;gBAE1C,IAAI,EAAE,mBAAmB;IAM/B,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC;IAyBvB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAI3D,UAAU,IAAI,OAAO;IAIrB,gBAAgB,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAQnF;;;OAGG;IACH,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,YAAY;IAYpD;;;OAGG;IACH,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE;IAU5D,wBAAwB,CAAC,WAAW,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,WAAW;IA6B5E,8BAA8B,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAkCjE;;;OAGG;IACH,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,MAAM,GAAG,mBAAmB;IAerF,eAAe,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,UAAU,CAAA;KAAE;IAY1E,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM;IAInC,kBAAkB,CAAC,KAAK,EAAE,UAAU,GAAG,UAAU;IAWjD,YAAY,CAAC,OAAO,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC;CAOvD"}

package/dist/node-server/_shared/secrets-pipeline.js

@@ -56,16 +56,23 @@ function replaceAllBytes(haystack, needle, replacement) {
 export class SecretsPipeline {
     sessionId;
     source;
+    sessionStore;
     maskedToSecret = new Map();
     scrubber = (t) => t;
     constructor(opts) {
         this.sessionId = opts.sessionId;
         this.source = opts.source;
+        this.sessionStore = opts.sessionStore;
     }
     async reload() {
         const all = await this.source.listAll();
+        // Layer session secrets on top of persisted ones; persisted wins on a
+        // name collision so a free session-set can't shadow a real secret.
+        const persistedNames = new Set(all.map((s) => s.name));
+        const session = (this.sessionStore?.listAll() ?? []).filter((s) => !persistedNames.has(s.name));
+        const merged = [...all, ...session];
         const next = new Map();
-        for (const s of all) {
+        for (const s of merged) {
             const maskedValue = await cryptoMask(this.sessionId, s.name, s.value);
             next.set(maskedValue, {
                 name: s.name,

package/dist/node-server/_shared/secrets-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"secrets-pipeline.js","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,IAAI,IAAI,UAAU,EAClB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAE7B,SAAS,YAAY,CAAC,QAAoB,EAAE,MAAkB,EAAE,IAAI,GAAG,CAAC;IACtE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,QAAoB,EACpB,MAAkB,EAClB,WAAuB;IAEvB,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AA4CD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,eAAe;IACV,SAAS,CAAS;IACjB,MAAM,CAAyB;IACxC,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,QAAQ,GAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEtD,YAAY,IAAyB;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;IAC5B,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;YACpB,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,WAAW;gBACX,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;QACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAAY,EAAE,QAAgB;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,QAAgB;QACvC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,wBAAwB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC7C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,8BAA8B,CAAC,MAAc;QAC3C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjE,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAA+B,EAAE,QAAgB;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,SAAS;oBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,IAAgB,EAAE,QAAgB;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,KAAiB;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}
+{"version":3,"file":"secrets-pipeline.js","sourceRoot":"","sources":["../src/secrets-pipeline.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,aAAa,EACb,IAAI,IAAI,UAAU,EAClB,cAAc,GAEf,MAAM,qBAAqB,CAAC;AAG7B,SAAS,YAAY,CAAC,QAAoB,EAAE,MAAkB,EAAE,IAAI,GAAG,CAAC;IACtE,KAAK,EAAE,KAAK,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,IAAI,QAAQ,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACvC,IAAI,QAAQ,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC;gBAAE,SAAS,KAAK,CAAC;QACpD,CAAC;QACD,OAAO,CAAC,CAAC;IACX,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC;AAED,SAAS,eAAe,CACtB,QAAoB,EACpB,MAAkB,EAClB,WAAuB;IAEvB,IAAI,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,QAAQ,CAAC;IACxD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,OAAO,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAC3B,MAAM,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;QAC9C,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACZ,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;YAChE,MAAM;QACR,CAAC;QACD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACpD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE;YAAE,GAAG,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC,GAAG,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC;AAC7B,CAAC;AAmDD;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,OAAO,eAAe;IACV,SAAS,CAAS;IACjB,MAAM,CAAyB;IAC/B,YAAY,CAAsB;IAC3C,cAAc,GAAG,IAAI,GAAG,EAAwB,CAAC;IACjD,QAAQ,GAA6B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAEtD,YAAY,IAAyB;QACnC,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC;QAChC,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;QAC1B,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,MAAM;QACV,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACxC,sEAAsE;QACtE,mEAAmE;QACnE,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;QAChG,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC;QACpC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAwB,CAAC;QAC7C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;YACtE,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,SAAS,EAAE,CAAC,CAAC,KAAK;gBAClB,WAAW;gBACX,OAAO,EAAE,CAAC,CAAC,OAAO;aACnB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAC3B,MAAM,KAAK,GAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YACjE,SAAS,EAAE,EAAE,CAAC,SAAS;YACvB,WAAW,EAAE,EAAE,CAAC,WAAW;SAC5B,CAAC,CAAC,CAAC;QACJ,IAAI,CAAC,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,IAAY,EAAE,KAAa;QACvC,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACjD,CAAC;IAED,UAAU;QACR,OAAO,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC;IACtC,CAAC;IAED,gBAAgB;QACd,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,EAAE,EAAE,CAAC,IAAI;YACb,WAAW,EAAE,EAAE,CAAC,WAAW;YAC3B,OAAO,EAAE,EAAE,CAAC,OAAO;SACpB,CAAC,CAAC,CAAC;IACN,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,IAAY,EAAE,QAAgB;QACnC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC1C,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;YAChE,CAAC;YACD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED;;;OAGG;IACH,UAAU,CAAC,IAAY,EAAE,QAAgB;QACvC,IAAI,MAAM,GAAG,IAAI,CAAC;QAClB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC;gBAAE,SAAS;YAC5C,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;IAC1B,CAAC;IAED,wBAAwB,CAAC,WAAmB,EAAE,QAAgB;QAC5D,MAAM,OAAO,GAAG,gBAAgB,CAAC;QACjC,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACxC,IAAI,CAAC,KAAK;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC1C,IAAI,OAAe,CAAC;QACpB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACnC,IAAI,KAAK,GAAG,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC7C,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACnC,IAAI,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;QACpC,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBAC1C,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,EAAE,CAAC;gBAC9E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC;oBAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;gBAClF,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;QACD,IAAI,CAAC,OAAO;YAAE,OAAO,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC;QAC5C,OAAO,EAAE,KAAK,EAAE,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,8BAA8B,CAAC,MAAc;QAC3C,IAAI,MAAW,CAAC;QAChB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC3B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QACzB,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ;YAAE,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC;QAEjE,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,IAAI,IAAI,GAAG,kBAAkB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC/C,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACzB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7D,IAAI,CAAC,cAAc,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,SAAS,EAAE,EAAE,UAAU,EAAE,EAAE,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,CAAC;gBAC7E,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,IAAI,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC/B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;oBAClD,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,SAAS,GAAG,OAAO,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,MAAM,CAAC,QAAQ,GAAG,EAAE,CAAC;QACrB,OAAO,EAAE,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,CAAC;IACvE,CAAC;IAED;;;OAGG;IACH,aAAa,CAAC,OAA+B,EAAE,QAAgB;QAC7D,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACjD,IAAI,GAAG,CAAC,WAAW,EAAE,KAAK,eAAe,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,IAAI,CAAC,wBAAwB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAC3D,IAAI,KAAK,CAAC,SAAS;oBAAE,OAAO,EAAE,SAAS,EAAE,KAAK,CAAC,SAAS,EAAE,CAAC;gBAC3D,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,KAAK,CAAC;gBAC3B,SAAS;YACX,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;YACvD,IAAI,SAAS;gBAAE,OAAO,EAAE,SAAS,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC;QACtB,CAAC;QACD,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,eAAe,CAAC,IAAgB,EAAE,QAAgB;QAChD,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,IAAI,CAAC,cAAc,CAAC,QAAQ,EAAE,EAAE,CAAC,OAAO,CAAC;gBAAE,SAAS;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YACvC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YAC7C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC;IACxB,CAAC;IAED,aAAa,CAAC,IAAY;QACxB,OAAO,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7B,CAAC;IAED,kBAAkB,CAAC,KAAiB;QAClC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,MAAM,GAAG,GAAG,IAAI,WAAW,EAAE,CAAC;QAC9B,KAAK,MAAM,CAAC,WAAW,EAAE,EAAE,CAAC,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACpD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,SAAS,CAAC,CAAC;YACxC,MAAM,WAAW,GAAG,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAC5C,GAAG,GAAG,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,WAAW,CAAC,CAAC;QAClD,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED,YAAY,CAAC,OAAgB;QAC3B,MAAM,GAAG,GAA2B,EAAE,CAAC;QACvC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvB,GAAG,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;QACH,OAAO,GAAG,CAAC;IACb,CAAC;CACF"}

package/dist/node-server/_shared/session-secret-store.d.ts

@@ -0,0 +1,48 @@
+/**
+ * In-memory, session-only secret store.
+ *
+ * Session secrets are set by the agent without approval and are NEVER
+ * persisted to disk / Keychain / chrome.storage — they live only for the
+ * lifetime of the process (node-server) or service-worker (extension) that
+ * owns the instance, and vanish on session end.
+ *
+ * The store is wired into {@link SecretsPipeline} (via `sessionStore`) so the
+ * fetch proxy can unmask session secrets exactly like persisted ones, while
+ * the `secret` shell command writes to it through the per-float transport.
+ */
+export interface SessionSecretRecord {
+    name: string;
+    value: string;
+    domains: string[];
+}
+export declare class SessionSecretStore {
+    private readonly entries;
+    /** Create or replace a session secret. Domains default to empty. */
+    set(name: string, value: string, domains?: string[]): void;
+    /** Real value for `name`, or undefined when absent. */
+    get(name: string): string | undefined;
+    /** Full record (value + domains) for `name`, or undefined when absent. */
+    getRecord(name: string): SessionSecretRecord | undefined;
+    has(name: string): boolean;
+    /** Replace the allowed domains of an existing secret. No-op when absent. */
+    setDomains(name: string, domains: string[]): boolean;
+    delete(name: string): boolean;
+    /** All records including values (for pipeline reload). */
+    listAll(): SessionSecretRecord[];
+    /** Names + domains only (no values) for listing/management surfaces. */
+    list(): Array<{
+        name: string;
+        domains: string[];
+    }>;
+    size(): number;
+}
+/**
+ * Build a partial, redacted preview of a secret value: the first and last
+ * `edge` characters with the middle elided. Always elides at least one
+ * character so the full value is never reconstructable from the preview.
+ *
+ *   previewSecret('sk-proj-ABCDEFGH1234')  → 'sk-p…1234'
+ *   previewSecret('short')                 → 's…t'
+ */
+export declare function previewSecret(value: string, edge?: number): string;
+//# sourceMappingURL=session-secret-store.d.ts.map

package/dist/node-server/_shared/session-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-secret-store.d.ts","sourceRoot":"","sources":["../src/session-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,EAAE,MAAM,EAAE,CAAC;CACnB;AAED,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA0C;IAElE,oEAAoE;IACpE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,GAAE,MAAM,EAAO,GAAG,IAAI;IAI9D,uDAAuD;IACvD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS;IAIrC,0EAA0E;IAC1E,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,mBAAmB,GAAG,SAAS;IAKxD,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B,4EAA4E;IAC5E,UAAU,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,OAAO;IAOpD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI7B,0DAA0D;IAC1D,OAAO,IAAI,mBAAmB,EAAE;IAQhC,wEAAwE;IACxE,IAAI,IAAI,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,CAAA;KAAE,CAAC;IAOlD,IAAI,IAAI,MAAM;CAGf;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,SAAI,GAAG,MAAM,CAM7D"}

package/dist/node-server/_shared/session-secret-store.js

@@ -0,0 +1,78 @@
+/**
+ * In-memory, session-only secret store.
+ *
+ * Session secrets are set by the agent without approval and are NEVER
+ * persisted to disk / Keychain / chrome.storage — they live only for the
+ * lifetime of the process (node-server) or service-worker (extension) that
+ * owns the instance, and vanish on session end.
+ *
+ * The store is wired into {@link SecretsPipeline} (via `sessionStore`) so the
+ * fetch proxy can unmask session secrets exactly like persisted ones, while
+ * the `secret` shell command writes to it through the per-float transport.
+ */
+export class SessionSecretStore {
+    entries = new Map();
+    /** Create or replace a session secret. Domains default to empty. */
+    set(name, value, domains = []) {
+        this.entries.set(name, { name, value, domains: [...domains] });
+    }
+    /** Real value for `name`, or undefined when absent. */
+    get(name) {
+        return this.entries.get(name)?.value;
+    }
+    /** Full record (value + domains) for `name`, or undefined when absent. */
+    getRecord(name) {
+        const r = this.entries.get(name);
+        return r ? { name: r.name, value: r.value, domains: [...r.domains] } : undefined;
+    }
+    has(name) {
+        return this.entries.has(name);
+    }
+    /** Replace the allowed domains of an existing secret. No-op when absent. */
+    setDomains(name, domains) {
+        const r = this.entries.get(name);
+        if (!r)
+            return false;
+        r.domains = [...domains];
+        return true;
+    }
+    delete(name) {
+        return this.entries.delete(name);
+    }
+    /** All records including values (for pipeline reload). */
+    listAll() {
+        return Array.from(this.entries.values()).map((r) => ({
+            name: r.name,
+            value: r.value,
+            domains: [...r.domains],
+        }));
+    }
+    /** Names + domains only (no values) for listing/management surfaces. */
+    list() {
+        return Array.from(this.entries.values()).map((r) => ({
+            name: r.name,
+            domains: [...r.domains],
+        }));
+    }
+    size() {
+        return this.entries.size;
+    }
+}
+/**
+ * Build a partial, redacted preview of a secret value: the first and last
+ * `edge` characters with the middle elided. Always elides at least one
+ * character so the full value is never reconstructable from the preview.
+ *
+ *   previewSecret('sk-proj-ABCDEFGH1234')  → 'sk-p…1234'
+ *   previewSecret('short')                 → 's…t'
+ */
+export function previewSecret(value, edge = 4) {
+    const len = value.length;
+    if (len === 0)
+        return '';
+    if (len <= 2)
+        return '…';
+    const e = Math.min(Math.max(1, edge), Math.floor((len - 1) / 2));
+    return `${value.slice(0, e)}…${value.slice(len - e)}`;
+}
+//# sourceMappingURL=session-secret-store.js.map

package/dist/node-server/_shared/session-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"session-secret-store.js","sourceRoot":"","sources":["../src/session-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAQH,MAAM,OAAO,kBAAkB;IACZ,OAAO,GAAG,IAAI,GAAG,EAA+B,CAAC;IAElE,oEAAoE;IACpE,GAAG,CAAC,IAAY,EAAE,KAAa,EAAE,UAAoB,EAAE;QACrD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,uDAAuD;IACvD,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACvC,CAAC;IAED,0EAA0E;IAC1E,SAAS,CAAC,IAAY;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IACnF,CAAC;IAED,GAAG,CAAC,IAAY;QACd,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChC,CAAC;IAED,4EAA4E;IAC5E,UAAU,CAAC,IAAY,EAAE,OAAiB;QACxC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QACrB,CAAC,CAAC,OAAO,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,CAAC,IAAY;QACjB,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACnC,CAAC;IAED,0DAA0D;IAC1D,OAAO;QACL,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,KAAK,EAAE,CAAC,CAAC,KAAK;YACd,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,wEAAwE;IACxE,IAAI;QACF,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACnD,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;SACxB,CAAC,CAAC,CAAC;IACN,CAAC;IAED,IAAI;QACF,OAAO,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;IAC3B,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,KAAa,EAAE,IAAI,GAAG,CAAC;IACnD,MAAM,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC;IACzB,IAAI,GAAG,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACzB,IAAI,GAAG,IAAI,CAAC;QAAE,OAAO,GAAG,CAAC;IACzB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACjE,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,EAAE,CAAC;AACxD,CAAC"}

package/dist/node-server/cdp-proxy/cdp-unmask.d.ts

@@ -0,0 +1,48 @@
+/**
+ * applyCdpUnmask — Client→Chrome leg unmask gate for the CDP proxy.
+ *
+ * Parses the outbound CDP frame, looks up the per-session current URL
+ * via `CdpSessionUrlTracker`, and delegates whole-token unmasking to
+ * the pure `unmaskCdpFrame` helper from @slicc/shared-ts.
+ *
+ * Security invariants (HARD requirements):
+ *   - Unmask is gated on the target tab's CURRENT URL. If the session's
+ *     URL is unknown OR its hostname can't be parsed → FAIL CLOSED:
+ *     forward the original bytes verbatim, no unmask.
+ *   - Domain mismatch is handled inside `unmaskCdpFrame.unmaskBody`:
+ *     the masked value passes through untouched.
+ *   - Frames larger than `CDP_CLIENT_FRAME_MAX_BYTES` are forwarded
+ *     verbatim — parsing a runaway frame to scan for secrets would
+ *     amplify the same feedback-loop pressure the Chrome→Client leg
+ *     already has to defend against.
+ *   - JSON parse errors → forward verbatim. The CDP wire format is
+ *     JSON-only in practice, but corrupted/non-JSON bytes are not the
+ *     unmasker's problem to surface.
+ */
+import { type SecretsPipeline } from '../_shared/index.js';
+import type { CdpSessionUrlTracker } from './session-url-tracker.js';
+/**
+ * Hard cap on client→Chrome frames we'll attempt to parse + unmask.
+ * Real CDP commands originating from the cone are tiny (a few KB at most
+ * for `Runtime.evaluate` payloads); the cap is generous to cover oversize
+ * `Runtime.callFunctionOn` argument lists without burning cycles on
+ * pathological inputs.
+ */
+export declare const CDP_CLIENT_FRAME_MAX_BYTES: number;
+export interface CdpUnmaskDeps {
+    tracker: CdpSessionUrlTracker;
+    pipeline: SecretsPipeline;
+}
+export interface CdpUnmaskResult {
+    /** Bytes to forward to Chrome. Same reference as `input` when nothing changed. */
+    output: string;
+    /** True iff the helper rewrote at least one whole-token field. */
+    changed: boolean;
+    /**
+     * Reason the frame was forwarded verbatim, when applicable. `undefined`
+     * means the frame was inspected (and possibly unmasked) successfully.
+     * Used by the proxy to emit a single deduped debug line per failure mode.
+     */
+    skipped?: 'oversized' | 'parse-error' | 'no-method' | 'no-hostname' | 'no-secrets';
+}
+export declare function applyCdpUnmask(input: string, deps: CdpUnmaskDeps): CdpUnmaskResult;

package/dist/node-server/cdp-proxy/cdp-unmask.js

@@ -0,0 +1,59 @@
+/**
+ * applyCdpUnmask — Client→Chrome leg unmask gate for the CDP proxy.
+ *
+ * Parses the outbound CDP frame, looks up the per-session current URL
+ * via `CdpSessionUrlTracker`, and delegates whole-token unmasking to
+ * the pure `unmaskCdpFrame` helper from @slicc/shared-ts.
+ *
+ * Security invariants (HARD requirements):
+ *   - Unmask is gated on the target tab's CURRENT URL. If the session's
+ *     URL is unknown OR its hostname can't be parsed → FAIL CLOSED:
+ *     forward the original bytes verbatim, no unmask.
+ *   - Domain mismatch is handled inside `unmaskCdpFrame.unmaskBody`:
+ *     the masked value passes through untouched.
+ *   - Frames larger than `CDP_CLIENT_FRAME_MAX_BYTES` are forwarded
+ *     verbatim — parsing a runaway frame to scan for secrets would
+ *     amplify the same feedback-loop pressure the Chrome→Client leg
+ *     already has to defend against.
+ *   - JSON parse errors → forward verbatim. The CDP wire format is
+ *     JSON-only in practice, but corrupted/non-JSON bytes are not the
+ *     unmasker's problem to surface.
+ */
+import { unmaskCdpFrame } from '../_shared/index.js';
+/**
+ * Hard cap on client→Chrome frames we'll attempt to parse + unmask.
+ * Real CDP commands originating from the cone are tiny (a few KB at most
+ * for `Runtime.evaluate` payloads); the cap is generous to cover oversize
+ * `Runtime.callFunctionOn` argument lists without burning cycles on
+ * pathological inputs.
+ */
+export const CDP_CLIENT_FRAME_MAX_BYTES = 4 * 1024 * 1024;
+export function applyCdpUnmask(input, deps) {
+    if (input.length > CDP_CLIENT_FRAME_MAX_BYTES) {
+        return { output: input, changed: false, skipped: 'oversized' };
+    }
+    if (!deps.pipeline.hasSecrets()) {
+        return { output: input, changed: false, skipped: 'no-secrets' };
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(input);
+    }
+    catch {
+        return { output: input, changed: false, skipped: 'parse-error' };
+    }
+    if (!parsed || typeof parsed !== 'object' || typeof parsed.method !== 'string') {
+        return { output: input, changed: false, skipped: 'no-method' };
+    }
+    const sessionId = typeof parsed.sessionId === 'string' ? parsed.sessionId : undefined;
+    const hostname = deps.tracker.getHostname(sessionId);
+    if (!hostname) {
+        // FAIL CLOSED — without a resolvable hostname we cannot enforce
+        // the per-tab domain gate, so unmasking is not safe.
+        return { output: input, changed: false, skipped: 'no-hostname' };
+    }
+    const { frame, changed } = unmaskCdpFrame(parsed, hostname, deps.pipeline);
+    if (!changed)
+        return { output: input, changed: false };
+    return { output: JSON.stringify(frame), changed: true };
+}

package/dist/node-server/cdp-proxy/session-url-tracker.d.ts

@@ -0,0 +1,27 @@
+/**
+ * CdpSessionUrlTracker — sniffs the Chrome→Client leg of the CDP WebSocket
+ * proxy and maintains a `sessionId -> currentUrl` map keyed the same way
+ * navigation-watcher.ts keys its session state. The map feeds the Client→
+ * Chrome unmask gate (cdp-unmask.ts) so per-frame unmasking is scoped to
+ * the target tab's actual current URL.
+ *
+ * Three CDP events feed the tracker:
+ *   - `Target.attachedToTarget`    → seed via `params.sessionId` + `params.targetInfo.url`
+ *   - `Target.targetInfoChanged`   → keyed by `params.targetInfo.targetId`; updates
+ *     every session pointing at that target
+ *   - `Page.frameNavigated` (root) → `sessionId` lives at the wire-frame top level;
+ *     only the root frame (no parentId) updates the session url
+ *
+ * `Target.detachedFromTarget` clears the entry. Everything else is a no-op.
+ *
+ * Hostname resolution is done lazily via `getHostname(sessionId)`. Empty,
+ * un-parseable, or `about:blank`-style URLs fail closed (return null).
+ */
+export interface CdpSessionUrlTracker {
+    observeChromeToClient(frame: unknown): void;
+    getHostname(sessionId: string | undefined): string | null;
+    getUrl(sessionId: string | undefined): string | null;
+    size(): number;
+    clear(): void;
+}
+export declare function createCdpSessionUrlTracker(): CdpSessionUrlTracker;