imperal-sdk 4.2.4__tar.gz → 4.2.6__tar.gz

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/CHANGELOG.md

@@ -2,6 +2,66 @@
 
 All notable changes to `imperal-sdk` are documented here.
 
+## 4.2.6 — 2026-05-13
+
+**New: `ui.Password` primitive + `ui.Input(type=)` kwarg**
+
+Adds a browser-blind credential-entry primitive for EXT-SECRETS-V1 Panel UIs.
+Renders as `<input type="password" autocomplete="new-password" spellcheck="false">`
+so values are visually masked while the user types and don't get saved into
+the browser's autofill database.
+
+### Added
+
+- **`ui.Password(placeholder=, on_submit=, value=, param_name=)`** — canonical
+  credential-entry component. Federal EXT-SECRETS-V1 entry surfaces (Dev Portal
+  Secrets tab, Panel SecretManagerCard equivalents) MUST use this instead of
+  `ui.Input` for write_mode='user'/'both' secrets.
+- **`ui.Input(type=)` kwarg** — accepts `"text"` (default), `"password"`,
+  `"email"`, `"number"`, `"url"`. Backward-compatible: existing `ui.Input(...)`
+  calls without `type=` continue rendering as text. The `type` prop is only
+  emitted into manifest when != `"text"`.
+
+### Panel rendering
+
+`DInput.tsx` now reads `type` from props and applies to the native
+`<input type={...}>` element. When `type === "password"` it also sets
+`autoComplete="new-password"` (suppresses browser autofill/save prompts) and
+`spellCheck={false}` (no red squiggle on opaque base64 / hex values).
+
+### Federal note
+
+`type="password"` is a defence against shoulder-surfing, not a security
+control. The plaintext still travels in the POST body to the server, which
+is the only correctness boundary. Audit chokepoint + Vault transit are what
+make this federal-grade — see EXT-SECRETS-V1 spec for the contract.
+
+## 4.2.5 — 2026-05-13
+
+**Fix: synthetic `__panel__*` tools excluded from validator tool_count + tests**
+
+v4.2.4 introduced an unconditional synthetic `secrets` panel via `Extension.__init__`,
+which auto-registers a `__panel__secrets` tool internally. The validator's `tool_count`
+logic was counting this synthetic tool as a user-authored tool, masking V3 ("at least
+one tool") error detection for extensions with zero user tools and inflating
+marketplace tool counts.
+
+### Fixed
+
+- **`validator.tool_count`** now excludes any tool whose name matches the
+  synthetic-prefix allowlist (`__panel__`, `__widget__`, `__tray__`, `__webhook__`).
+  These are platform-provided, not author-authored, and shouldn't count.
+- **`V3 "at least one tool"`** check now correctly fires for ext'ы with only
+  synthetic auto-registered tools.
+- `tests/test_panels.py::test_multiple_panels` updated to assert +1 for the
+  always-present synthetic `secrets` panel.
+
+### Notes
+
+- No behavior change for extensions with at least one real `@ext.tool` or
+  ChatExtension. Strict-tool-count-zero ext'ы now properly fail V3 again.
+- Marketplace tool counts shown to users no longer count synthetic panels.
+
 ## 4.2.4 — 2026-05-13
 
 **EXT-SECRETS-V1 — unconditional synthetic Secrets panel**

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: imperal-sdk
-Version: 4.2.4
+Version: 4.2.6
 Summary: SDK for building Imperal Cloud extensions
 Author: Valentin Scerbacov, Imperal, Inc.
 License-Expression: AGPL-3.0-or-later

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/src/imperal_sdk/__init__.py

@@ -39,7 +39,7 @@ from imperal_sdk.secrets import (
     SecretValueTooLarge, SecretDeclarationConflict,
 )
 
-__version__ = "4.2.4"
+__version__ = "4.2.6"
 
 __all__ = [
     # Core

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/src/imperal_sdk/ui/__init__.py

@@ -24,7 +24,7 @@ from .display import Text, Icon, Header, Image, Code, Markdown, Empty, Divider,
 from .interactive import Button, Card, Menu, Dialog, Tooltip, Link, SlideOver
 from .feedback import Alert, Progress, Chart, Loading, Error
 from .input_components import (
-    Input, Form, Select, MultiSelect, Toggle,
+    Input, Password, Form, Select, MultiSelect, Toggle,
     Slider, DatePicker, FileUpload, TextArea, RichEditor, TagInput,
 )
 from .graph import Graph
@@ -44,7 +44,7 @@ __all__ = [
     # Feedback
     "Alert", "Progress", "Chart", "Loading", "Error",
     # Input
-    "Input", "Form", "Select", "MultiSelect", "Toggle",
+    "Input", "Password", "Form", "Select", "MultiSelect", "Toggle",
     "Slider", "DatePicker", "FileUpload", "TextArea", "RichEditor", "TagInput",
     # Graph (Cytoscape-backed)
     "Graph",

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/src/imperal_sdk/ui/input_components.py

@@ -10,13 +10,52 @@ def Input(
     on_submit: UIAction | None = None,
     value: str = "",
     param_name: str = "value",
+    type: str = "text",
 ) -> UINode:
-    """Text input field. on_submit fires on Enter, value merged as param_name."""
+    """Text input field. on_submit fires on Enter, value merged as param_name.
+
+    ``type`` (v4.2.6+) is a hint to the Panel renderer for native HTML input
+    behaviour: ``"text"`` (default), ``"password"`` (browser-blind, no echo),
+    ``"email"``, ``"number"``, ``"url"``. Prefer ``ui.Password(...)`` for
+    credential entry — it's a thin convenience wrapper that pins type for
+    federal EXT-SECRETS-V1 UIs.
+    """
     props: dict[str, Any] = {"placeholder": placeholder, "value": value, "param_name": param_name}
+    if type and type != "text":
+        props["type"] = type
     if on_submit: props["on_submit"] = on_submit
     return UINode(type="Input", props=props)
 
 
+def Password(
+    placeholder: str = "paste value…",
+    on_submit: UIAction | None = None,
+    value: str = "",
+    param_name: str = "value",
+) -> UINode:
+    """Password input — browser-blind, no echo, autocomplete='new-password'.
+
+    EXT-SECRETS-V1 (federal v4.2.6+) — the canonical credential-entry primitive.
+    Renders as ``<input type="password" autocomplete="new-password">`` in the
+    Panel UI so values are visually masked while the user types. Submitted
+    value rides into the action as ``param_name`` (default ``"value"``); use
+    inside ``ui.Form(defaults={...})`` to attach hidden context fields like
+    ``app_id`` and ``name``.
+
+    Federal note: type=password is a defence against shoulder-surfing, NOT a
+    security control. The plaintext still travels in the POST body to the
+    server, which is the only correctness boundary. Audit chokepoint + Vault
+    transit are what make this federal-grade.
+    """
+    return Input(
+        placeholder=placeholder,
+        on_submit=on_submit,
+        value=value,
+        param_name=param_name,
+        type="password",
+    )
+
+
 def Form(
     children: list[UINode],
     action: str = "",

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/src/imperal_sdk/validator.py

@@ -145,8 +145,17 @@ def validate_extension(ext) -> ValidationReport:
             fix="Set version to a valid semver string",
         ))
 
-    # Count registered @ext.tool entries
-    tools = getattr(ext, "_tools", {})
+    # Count registered @ext.tool entries. Exclude synthetic tools that the
+    # SDK auto-registers internally (e.g. __panel__secrets from the
+    # EXT-SECRETS-V1 unconditional synthetic Secrets panel, v4.2.4) — those
+    # are platform-provided, not user-authored, and shouldn't count toward
+    # V3 "at least one tool" or marketplace tool counts.
+    _all_tools = getattr(ext, "_tools", {})
+    _SYNTHETIC_PREFIXES = ("__panel__", "__widget__", "__tray__", "__webhook__")
+    tools = {
+        name: t for name, t in _all_tools.items()
+        if not any(name.startswith(p) for p in _SYNTHETIC_PREFIXES)
+    }
     report.tool_count = len(tools)
 
     # Collect all ChatExtension instances registered on this extension

{imperal_sdk-4.2.4 → imperal_sdk-4.2.6}/tests/test_panels.py

@@ -34,9 +34,12 @@ class TestPanelDecorator:
         async def left(ctx): pass
         @ext.panel("stats", slot="right", title="Right")
         async def right(ctx): pass
-        assert len(ext.panels) == 2
+        # +1 for the synthetic 'secrets' panel auto-injected by Extension.__init__
+        # (EXT-SECRETS-V1 v4.2.4) — see Extension._auto_register_secrets_panel.
+        assert len(ext.panels) == 3
         assert "sidebar" in ext.panels
         assert "stats" in ext.panels
+        assert "secrets" in ext.panels
 
     def test_default_slot(self):
         ext = Extension("test-app")