agentd 0.9.2__tar.gz → 0.9.3__tar.gz

{agentd-0.9.2 → agentd-0.9.3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: agentd
-Version: 0.9.2
+Version: 0.9.3
 Summary: agent daemon
 License-File: LICENSE
 Requires-Python: >=3.10

{agentd-0.9.2 → agentd-0.9.3}/agentd/devices/browser.py

@@ -50,6 +50,7 @@ from pathlib import Path
 from typing import Any
 from urllib.parse import urlsplit
 
+from agentd import fnox
 from agentd import secrets as host_secrets
 
 CHROME_PATHS = (
@@ -260,13 +261,47 @@ class Browser:
             return {"status": "allowed"}
         if self.approvals is None:
             raise BrowserAccessError("logins need an approver (none is configured)")
-        conf = self.logins[site]
+        names = self._login_secrets(site)
+        missing = self._uncached(names)  # locked in fnox: approving will need the master password
         approval = self.approvals.request("browser_login", "", {
-            "site": site, "host": hosts[0], "hosts": hosts,
-            "secrets": [conf[k] for k in ("username", "password", "totp") if conf.get(k)]}, reason)
+            "site": site, "host": hosts[0], "hosts": hosts, "secrets": names}, reason,
+            unlock=(missing, self._fill) if missing else None)
         self._login_pending[site] = approval.id
         return {"id": approval.id, "status": approval.status}
 
+    def _login_secrets(self, site: str) -> list[str]:
+        conf = self.logins[site]
+        return [conf[k] for k in ("username", "password", "totp") if conf.get(k)]
+
+    def _fnox_dir(self) -> Path:
+        return Path(self.fnox_cwd or os.getcwd()).resolve()
+
+    def _uncached(self, names: list[str]) -> list[str]:
+        return fnox.uncached(names, self._fnox_dir())
+
+    def _fill(self, names: list[str], password: bytearray) -> dict[str, str]:
+        return fnox.fill(names, password, cwd=self._fnox_dir())
+
+    async def _ensure_unlocked(self, site: str) -> None:
+        """A login approved earlier (always, session, by host code) whose secrets are locked in
+        fnox asks for an unlock (the human's master password) and waits for it."""
+        missing = await asyncio.to_thread(self._uncached, self._login_secrets(site))
+        if not missing:
+            return
+        if self.approvals is None:
+            raise BrowserAccessError(f"{site}'s credentials ({', '.join(missing)}) are locked in fnox, "
+                                     "and no approver is configured to unlock them")
+        approval = self.approvals.request("unlock", "", {"site": site, "host": self._login_hosts(site)[0],
+                                                         "secrets": missing}, f"log in to {site}",
+                                          unlock=(missing, self._fill))
+        status = await self.approvals.wait(approval.id)
+        if status not in ("once", "session", "always"):
+            raise BrowserAccessError(f"{site}'s credentials are locked in fnox: unlock approval {approval.id} is "
+                                     f"{status}" + ("" if status == "deny" else "; call browser_login again once "
+                                                    "it's approved"))
+        if await asyncio.to_thread(self._uncached, missing):
+            raise BrowserAccessError(f"{site}'s credentials are still locked in fnox")
+
     def _use_login(self, site: str, spend: bool = True) -> None:
         """Raise unless ``site``'s login is approved; a 'once' approval is spent here (with ``spend``)."""
         if self._login_granted(site):
@@ -486,6 +521,7 @@ class Browser:
         """Fill and submit a site's login form from fnox, on the host (only on its login hosts)."""
         await self._ready()
         self._use_login(site, spend=False)  # a 'once' is spent only when credentials are typed
+        await self._ensure_unlocked(site)
         conf = self.logins[site]
         kw = {"cwd": self.fnox_cwd} if self.fnox_cwd else {}
         # Already on the site's login form (the agent got there itself): stay. Otherwise

{agentd-0.9.2 → agentd-0.9.3}/agentd/egress/__init__.py

@@ -17,10 +17,12 @@ from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 
+from agentd import fnox
 from agentd.egress.ca import SessionCA
 from agentd.egress.policy import (Allow, Policy, SecretRule, fnox_config_files, fnox_get, load_rules,
                                   load_secret_names, make_placeholder, opaque_placeholder)
 from agentd.egress.proxy import EgressProxy
+from agentd.fnox import SecretMissing
 from agentd.sandbox.base import DEFAULT_HOME
 
 logger = logging.getLogger(__name__)
@@ -84,13 +86,18 @@ class EgressSession:
             self.config_files = await asyncio.to_thread(
                 fnox_config_files, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
             rules = load_rules(self.config_files)
+            locked: set[str] = set()
             for name in dict.fromkeys(r.secret for r in rules):
+                # Read now only what fnox has unlocked (for format-preserving placeholders);
+                # a locked secret is read, or unlocked, when a request first needs it.
                 try:
                     secrets[name] = await asyncio.to_thread(
                         fnox_get, name, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
+                except SecretMissing:
+                    locked.add(name)
                 except (RuntimeError, OSError) as err:
                     logger.warning("egress: %s (its rules are disabled)", err)
-            rules = [r for r in rules if r.secret in secrets]
+            rules = [r for r in rules if r.secret in secrets or r.secret in locked]
             # Every other secret the sandbox may ask for gets a placeholder now; its
             # value is read from fnox only once a rule or approval lets it be sent.
             names = load_secret_names(self.config_files, e.fnox_profile)
@@ -98,7 +105,8 @@ class EgressSession:
                 self.descriptions[name] = names[name]
         for r in rules:
             if r.secret not in self.placeholders:
-                ph = r.placeholder or make_placeholder(secrets[r.secret])
+                ph = r.placeholder or (make_placeholder(secrets[r.secret]) if r.secret in secrets
+                                       else opaque_placeholder())
                 self.placeholders[r.secret] = ph
             self.descriptions.setdefault(r.secret, "")
         for name in self.descriptions:
@@ -113,7 +121,8 @@ class EgressSession:
         await self.proxy.start()
 
     async def _load(self, name: str) -> None:
-        """Read a secret from fnox for the proxy, the first time it may be sent."""
+        """Read a secret from fnox for the proxy, the first time it may be sent
+        (:class:`SecretMissing` if it's locked in fnox)."""
         e = self.egress
         try:
             value = await asyncio.to_thread(fnox_get, name, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
@@ -123,6 +132,19 @@ class EgressSession:
         if self.proxy is not None:
             self.proxy.add_secret(name, value)
 
+    def loaded(self, name: str) -> bool:
+        return self.proxy is not None and name in self.proxy.secrets
+
+    def uncached(self, names: list[str]) -> list[str]:
+        """Which of ``names`` fnox can't read without an unlock (blocking)."""
+        e = self.egress
+        return fnox.uncached(names, self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile) if e.fnox else []
+
+    def fill(self, names: list[str], password: bytearray) -> dict[str, str]:
+        """Unlock ``names`` in fnox with the master password (blocking; zeroes it)."""
+        e = self.egress
+        return fnox.fill(names, password, cwd=self.workspace, fnox=e.fnox_bin, profile=e.fnox_profile)
+
     def list_secrets(self) -> list[dict[str, Any]]:
         """What the sandbox can use or ask for: names, descriptions, env vars and rules (never values)."""
         policy = self.proxy.policy if self.proxy is not None else Policy()

{agentd-0.9.2 → agentd-0.9.3}/agentd/egress/approvals.py

@@ -10,11 +10,19 @@ sha256=<HMAC of the body>``). The proxy holds the request for ``hold``
 seconds: approved in time, it goes through; otherwise the agent gets a 403
 saying the approval is pending (``id``, ``retry_after``) and retries later.
 
+Secrets locked in fnox (a vault whose master password fnox's daemon doesn't
+have yet) are listed in the approval's ``details["unlock"]``; allowing it then
+needs the master password (``{"decision": ..., "password": ...}``), which
+unlocks them (:func:`agentd.fnox.fill`) before the decision applies. A wrong
+password leaves the approval pending. A pre-approved use that finds its secret
+locked asks with an approval of kind ``unlock``.
+
 Decisions (``agentd serve``: ``POST /v1/approvals/{id}``, or :meth:`decide`):
 ``once`` (the held request, or if none is held, the next matching one),
 ``session`` (until the sandbox stops), ``always``
-(persisted: secret rules into the fnox config they came from, host
-allowances and browser logins into ``~/.agentd/egress/allow.toml``), or ``deny``.
+(persisted in ``~/.agentd/egress/allow.toml``: host allowances, secret rules
+and browser logins; not in the fnox config, whose contents are part of fnox's
+cache key, so editing it would re-lock every unlocked secret), or ``deny``.
 """
 from __future__ import annotations
 
@@ -27,9 +35,10 @@ import os
 import time
 from dataclasses import asdict, dataclass, field
 from pathlib import Path
-from typing import TYPE_CHECKING, Any
+from typing import TYPE_CHECKING, Any, Callable
 
-from agentd.egress.policy import Allow, Policy, SecretRule, add_rule_to_fnox
+from agentd import fnox
+from agentd.egress.policy import Allow, Policy, SecretRule
 from agentd.sandbox.base import DEFAULT_HOME
 
 if TYPE_CHECKING:
@@ -44,7 +53,7 @@ DECISIONS = ("once", "session", "always", "deny")
 @dataclass
 class Approval:
     id: str
-    kind: str                         # "connect" | "secret"
+    kind: str                         # connect | secret | unlock | browser | browser_login | device
     session: str
     details: dict[str, Any]
     reason: str = ""
@@ -71,12 +80,13 @@ class Approvals:
         self._holding: dict[str, int] = {}  # approval id -> requests held for it right now
         self._sessions: dict[str, tuple["EgressSession", Policy]] = {}
         self._dedupe: dict[tuple, str] = {}
+        self._fillers: dict[str, Callable[[list[str], bytearray], dict[str, str]]] = {}  # approval id -> unlock
 
     # ------------------------------------------------------------------ #
-    # Persistent allowances (host grants that fnox can't hold)
+    # Persistent grants ("always")
     # ------------------------------------------------------------------ #
 
-    def _saved(self) -> dict[str, list[str]]:
+    def _saved(self) -> dict[str, list]:
         try:
             import tomllib
         except ModuleNotFoundError:
@@ -94,14 +104,27 @@ class Approvals:
         """Browser logins approved "always", as ``site@host``."""
         return self._saved().get("browser_logins", [])
 
-    def _save(self, key: str, value: str) -> None:
+    def saved_rules(self) -> list[SecretRule]:
+        """Secret rules approved "always" (``[[secret_rules]]``: secret, domain, header, methods, paths)."""
+        rules = []
+        for r in self._saved().get("secret_rules", []):
+            if isinstance(r, dict) and r.get("secret") and r.get("domain"):
+                rules.append(SecretRule(secret=r["secret"], domain=str(r["domain"]).lower(),
+                                        header=str(r.get("header", "authorization")).lower(),
+                                        methods=tuple(r.get("methods") or ()), paths=tuple(r.get("paths") or ())))
+        return rules
+
+    def _save(self, key: str, value: str | dict) -> None:
         saved = self._saved()
         if value in saved.get(key, []):
             return
         saved.setdefault(key, []).append(value)
+        lists = [f"{k} = [" + ", ".join(json.dumps(s) for s in v) + "]\n"
+                 for k, v in saved.items() if all(isinstance(s, str) for s in v)]
+        tables = [f"\n[[{k}]]\n" + "".join(f"{f} = {json.dumps(x)}\n" for f, x in t.items())
+                  for k, v in saved.items() if not all(isinstance(s, str) for s in v) for t in v]
         self.allow_file.parent.mkdir(parents=True, exist_ok=True)
-        self.allow_file.write_text("".join(f"{k} = [" + ", ".join(json.dumps(s) for s in v) + "]\n"
-                                           for k, v in saved.items()))
+        self.allow_file.write_text("".join(lists + tables))
 
     def _save_allow(self, spec: str) -> None:
         self._save("allow", spec)
@@ -114,9 +137,18 @@ class Approvals:
         """The proxy's hook for one session: ``await ask(kind, **details) -> (approved, approval id, status)``."""
         self._sessions[egress.session] = (egress, policy)
         policy.allows.extend(Allow.parse(s) for s in self.saved_allows())
+        policy.rules.extend(r for r in self.saved_rules() if r.secret in egress.placeholders)
 
         async def ask(kind: str, **details: Any) -> tuple[bool, str]:
-            approval = self.request(kind, egress.session, details)
+            names = details.get("secrets") if kind == "unlock" else \
+                [details["secret"]] if kind == "secret" and details.get("secret") else []
+            unlock = None
+            if names:
+                missing = await asyncio.to_thread(egress.uncached, [n for n in names if not egress.loaded(n)])
+                if kind == "unlock" and not missing:
+                    return True, "", "unlocked"  # unlocked meanwhile: nothing to ask
+                unlock = (missing, egress.fill) if missing else None
+            approval = self.request(kind, egress.session, details, unlock=unlock)
             if approval.status != "pending":
                 return approval.status != "deny", approval.id, approval.status
             fut = self._waiters.setdefault(approval.id, asyncio.get_running_loop().create_future())
@@ -140,9 +172,15 @@ class Approvals:
     # Requests and decisions
     # ------------------------------------------------------------------ #
 
-    def request(self, kind: str, session: str, details: dict[str, Any], reason: str = "") -> Approval:
-        """A pending approval (an identical pending one is reused) announced to the webhook."""
+    def request(self, kind: str, session: str, details: dict[str, Any], reason: str = "",
+                unlock: tuple[list[str], Callable[[list[str], bytearray], dict[str, str]]] | None = None) -> Approval:
+        """A pending approval (an identical pending one is reused) announced to the webhook.
+
+        ``unlock``: (secret names locked in fnox, a function that unlocks them with
+        the master password); allowing the approval will need that password."""
         self._expire_old()
+        if unlock and unlock[0]:
+            details = {**details, "unlock": list(unlock[0])}
         key = (kind, session, json.dumps(details, sort_keys=True))
         existing = self._dedupe.get(key)
         if existing and existing in self.items and self.items[existing].status == "pending":
@@ -151,10 +189,43 @@ class Approvals:
                             reason=reason)
         self.items[approval.id] = approval
         self._dedupe[key] = approval.id
+        if unlock and unlock[0]:
+            self._fillers[approval.id] = unlock[1]
         self._notify(approval)
         return approval
 
-    def decide(self, approval_id: str, decision: str, by: str = "local") -> Approval:
+    def unlock(self, approval_id: str, password: bytearray | str) -> None:
+        """Unlock the approval's locked secrets with the master password (zeroed afterwards).
+
+        The approval stays pending if it fails: :class:`agentd.fnox.WrongPassword` (a
+        ValueError: ask again) or :class:`agentd.fnox.UnlockFailed` (unlocked, but fnox
+        couldn't read a secret: fix the vault or the fnox config, or deny). Blocking:
+        fnox derives the vault key per secret; agentd serve runs it in a thread."""
+        pw = password if isinstance(password, bytearray) else bytearray(str(password).encode())
+        try:
+            approval = self.items.get(approval_id)
+            if approval is None:
+                raise KeyError(approval_id)
+            names = approval.details.get("unlock") or []
+            if not names:
+                return
+            failed = self._fillers[approval_id](names, pw)
+            if any(why == fnox.WRONG_PASSWORD for why in failed.values()):
+                raise fnox.WrongPassword("master password didn't unlock the vault")
+            if failed:
+                raise fnox.UnlockFailed("the vault unlocked, but fnox couldn't read "
+                                        + "; ".join(f"{name}: {why}" for name, why in failed.items())
+                                        + " (renamed or deleted in the vault? fix it there or in the fnox config, "
+                                        "or deny)")
+            approval.details["unlock"] = []
+            self._fillers.pop(approval_id, None)
+        finally:
+            for i in range(len(pw)):
+                pw[i] = 0
+
+    def decide(self, approval_id: str, decision: str, by: str = "local",
+               password: bytearray | str | None = None) -> Approval:
+        """Decide an approval. One that lists secrets to unlock needs ``password`` to be allowed."""
         if decision not in DECISIONS:
             raise ValueError(f"decision must be one of {DECISIONS}")
         approval = self.items.get(approval_id)
@@ -162,6 +233,13 @@ class Approvals:
             raise KeyError(approval_id)
         if approval.status != "pending":
             return approval
+        if decision != "deny" and approval.details.get("unlock"):
+            if password is None:
+                raise ValueError(f"approving this unlocks {', '.join(approval.details['unlock'])} in fnox: "
+                                 "it needs the master password")
+            self.unlock(approval_id, password)
+        elif isinstance(password, bytearray):
+            password[:] = bytes(len(password))
         approval.status, approval.decided_by, approval.decided = decision, by, time.time()
         if decision in ("session", "always"):
             self._grant(approval, persist=decision == "always")
@@ -195,9 +273,9 @@ class Approvals:
             for egress, policy in targets:
                 if rule.secret in egress.placeholders:
                     (policy.once_rules if once else policy.rules).append(rule)
-                    if persist and egress.config_files:
-                        add_rule_to_fnox(egress.config_files[-1], rule)
-                        persist = False  # once
+            if persist:
+                self._save("secret_rules", {"secret": rule.secret, "domain": rule.domain, "header": rule.header,
+                                            "methods": list(rule.methods), "paths": list(rule.paths)})
 
     def _expire_old(self) -> None:
         now = time.time()
@@ -349,7 +427,11 @@ async def request_access(host: str, reason: str, port: int = 443, secret: str =
     if secret:
         details = {"secret": secret, "host": host.lower(), "method": method.upper(), "path": path,
                    "header": "authorization"}
-        approval = _ACTIVE.request("secret", session, details, reason)
+        unlock = None
+        if egress is not None and not egress.loaded(secret):
+            missing = await asyncio.to_thread(egress.uncached, [secret])
+            unlock = (missing, egress.fill) if missing else None
+        approval = _ACTIVE.request("secret", session, details, reason, unlock=unlock)
     else:
         approval = _ACTIVE.request("connect", session, {"host": host.lower(), "ip": "", "port": port}, reason)
     return {"id": approval.id, "status": await _ACTIVE.wait(approval.id)}

{agentd-0.9.2 → agentd-0.9.3}/agentd/egress/policy.py

@@ -124,14 +124,9 @@ class Policy:
 
 def fnox_config_files(cwd: Path, *, fnox: str = "fnox", profile: str | None = None) -> list[Path]:
     """The config files fnox would load from ``cwd`` (its own discovery)."""
-    argv = [fnox] + (["-P", profile] if profile else []) + ["config-files"]
-    try:
-        r = subprocess.run(argv, cwd=cwd, capture_output=True, text=True, timeout=30)
-    except (OSError, subprocess.SubprocessError):
-        return []
-    if r.returncode != 0:
-        return []
-    return [Path(line.strip()) for line in r.stdout.splitlines() if line.strip().endswith(".toml")]
+    from agentd import fnox as _fnox
+
+    return _fnox.config_files(cwd, fnox=fnox, profile=profile)
 
 
 def load_rules(files: list[Path]) -> list[SecretRule]:
@@ -175,13 +170,10 @@ def load_secret_names(files: list[Path], profile: str | None = None) -> dict[str
 
 
 def fnox_get(name: str, cwd: Path, *, fnox: str = "fnox", profile: str | None = None) -> str:
-    """One secret's value, from fnox on the host (no prompts)."""
-    argv = [fnox, "--non-interactive"] + (["-P", profile] if profile else []) + ["get", name]
-    r = subprocess.run(argv, cwd=cwd, capture_output=True, text=True, timeout=60,
-                       env={**os.environ, "FNOX_NON_INTERACTIVE": "1"})
-    if r.returncode != 0:
-        raise RuntimeError(f"fnox couldn't get {name}: {(r.stderr or r.stdout).strip()[:300]}")
-    return r.stdout.rstrip("\n")
+    """One secret's value, from fnox on the host (no prompts; :class:`agentd.fnox.SecretMissing` if locked)."""
+    from agentd import fnox as _fnox
+
+    return _fnox.get(name, cwd, fnox=fnox, profile=profile)
 
 
 def make_placeholder(value: str) -> str:
@@ -201,23 +193,6 @@ def opaque_placeholder() -> str:
     return "agentd_ph_" + "".join(_secrets.choice(alphabet) for _ in range(24))
 
 
-def add_rule_to_fnox(config: Path, rule: SecretRule) -> None:
-    """Append a rule to a fnox config ("always" grants live in fnox's config)."""
-    def q(s: str) -> str:
-        return '"' + s.replace("\\", "\\\\").replace('"', '\\"') + '"'
-
-    lines = ["", "[[proxy.rules]]", f"secret = {q(rule.secret)}", f"domain = {q(rule.domain)}",
-             f"header = {q(rule.header)}"]
-    if rule.methods:
-        lines.append("methods = [" + ", ".join(q(m) for m in rule.methods) + "]")
-    if rule.paths:
-        lines.append("paths = [" + ", ".join(q(p) for p in rule.paths) + "]")
-    if rule.placeholder:
-        lines.append(f"placeholder = {q(rule.placeholder)}")
-    with open(config, "a") as f:
-        f.write("\n".join(lines) + "\n")
-
-
 def rules_summary(rules: list[SecretRule]) -> list[dict[str, Any]]:
     return [{"secret": r.secret, "domain": r.domain, "header": r.header, "methods": list(r.methods) or ["*"],
              "paths": list(r.paths) or ["*"]} for r in rules]

{agentd-0.9.2 → agentd-0.9.3}/agentd/egress/proxy.py

@@ -131,12 +131,31 @@ class EgressProxy:
         self.masks: dict[bytes, bytes] = {}
         for name, value in secrets.items():
             self._mask(name, value)
+        self._loop: asyncio.AbstractEventLoop | None = None
+        if load is not None:
+            from agentd import fnox
+
+            fnox.on_clear(self)  # a vault changed: read again (or unlock) on next use
         self._server: asyncio.base_events.Server | None = None
 
     def _mask(self, name: str, value: str) -> None:
         ph = self.placeholders.get(name, "")
         self.masks[value.encode()] = ph.encode() if len(ph) == len(value) else b"*" * len(value)
 
+    def forget_secrets(self) -> None:
+        """Drop the values read so far (fnox.clear(): the vault changed). Masks stay, so
+        responses are still scrubbed of old values."""
+        loop = self._loop
+        if loop is not None and loop.is_running():
+            try:
+                running = asyncio.get_running_loop()
+            except RuntimeError:
+                running = None
+            if running is not loop:
+                loop.call_soon_threadsafe(self.secrets.clear)
+                return
+        self.secrets.clear()
+
     def add_secret(self, name: str, value: str) -> None:
         """A secret read after the session started (responses are scrubbed of it from now on)."""
         self.secrets[name] = value
@@ -147,6 +166,7 @@ class EgressProxy:
     async def start(self) -> None:
         self.socket_path.parent.mkdir(parents=True, exist_ok=True)
         self.socket_path.unlink(missing_ok=True)
+        self._loop = asyncio.get_running_loop()
         self._server = await asyncio.start_unix_server(self._on_stream, path=str(self.socket_path))
         self.socket_path.chmod(0o600)
 
@@ -322,7 +342,10 @@ class EgressProxy:
 
     async def _load_needed(self, host: str, method: str, path: str, headers: list[tuple[bytes, bytes]],
                            once: frozenset[str] = frozenset()) -> None:
-        """Read from fnox the secrets this request may send that weren't read yet."""
+        """Read from fnox the secrets this request may send that weren't read yet. One locked in
+        fnox is asked about (an ``unlock`` approval: the human's master password unlocks it)."""
+        from agentd.fnox import SecretMissing
+
         if self.load is None:
             return
         rules = self.policy.rules_for(host)
@@ -331,9 +354,29 @@ class EgressProxy:
             for secret, ph in list(self.placeholders.items()):
                 if secret in self.secrets or not ph or ph.encode() not in value:
                     continue
-                if secret in once or any(r.secret == secret and r.header == lname and r.matches(method, path)
-                                         for r in rules):
+                if not (secret in once or any(r.secret == secret and r.header == lname and r.matches(method, path)
+                                              for r in rules)):
+                    continue
+                try:
                     await self.load(secret)
+                    continue
+                except SecretMissing:
+                    pass
+                detail = {"secret": secret, "host": host, "method": method, "path": path, "header": lname,
+                          "locked": True}
+                message = f"agentd egress: {secret} is locked in fnox"
+                if self.ask is None:
+                    raise Refused(message + " (and no approver is configured to unlock it)", detail)
+                approved, approval_id, status = await self.ask("unlock", secrets=[secret], host=host)
+                if approved:
+                    try:
+                        await self.load(secret)
+                        continue
+                    except SecretMissing:
+                        pass
+                e = Refused(message, detail)
+                e.approval_id, e.approval_status = approval_id, status
+                raise e
 
     async def inject_or_ask(self, host: str, method: str, path: str, headers: list[tuple[bytes, bytes]]):
         """inject(), and when refused, hold for an approval: (headers, used) or Refused (with .approval_id