0 Fork 0

mirror of https://github.com/Dvorinka/Primora.git synced 2026-10-28 07:41:23 +00:00

Files

T

Tomas DvorakandDevin 585bb04ab2 feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

Local vault (apps/cli): clean-room PRMVLT01 format — Argon2id →
XChaCha20-Poly1305, AEAD-bound header, atomic writes. vault:* / secrets:*
/ inject (primora:// refs) / agent credential broker (dummy tokens in the
child, real secret on the wire) / TTL sessions / stack:* operator group.

Project vault (backend): core.project_secrets, AES-256-GCM via the
platform encryptor. Metadata-only list, audit-logged reveal, and
secret://NAME refs resolved at job delivery — refs stored, values never.

Surfaces: dashboard Vault page (+ local-vault card under the Tauri
shell), desktop vault window via IPC to the primora binary,
secrets:* --remote CLI mode, metadata/write-only MCP tools so agents
consume secrets via secret:// refs without holding plaintext.

Authored By: TDvorak <[email protected]>

Generated with [Devin](https://devin.ai)

Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com>

2026-09-24 18:46:37 +02:00

src

feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

2026-09-24 18:46:37 +02:00

package.json

feat: phase 5 distribution — tauri shell, pwa, desktop release artifacts

2026-09-16 19:59:53 +02:00

README.md

feat: encrypted secrets vault across CLI, desktop, dashboard, and backend

2026-09-24 18:46:37 +02:00

tsconfig.json

feat: ship phase 1 surface area (v0.2.0)

2026-09-16 14:04:43 +02:00

README.md

@primora/mcp

Primora MCP stdio server - exposes the platform as primora_* tools to any MCP client (Claude Desktop, Cursor, etc.).

Build

npm run build --workspace @primora/mcp   # → dist/server.js

Configure

Point your MCP client at node dist/server.js. The server shares the CLI's config file - primora login once and both tools work. Env vars override: PRIMORA_BASE_URL, PRIMORA_API_KEY, PRIMORA_ORG, PRIMORA_PROJECT.

Tools

30+ primora_* tools covering organizations, projects, buckets, objects, collections, API keys, integrations, webhooks, scheduled jobs, telemetry, and audit: primora_whoami, primora_list_projects, primora_upload_object, primora_query_audit, primora_run_job, …

Secrets are agent-safe by design — values are never returned by any tool:

primora_vault_status / primora_vault_list — local-vault state and metadata (names/urls/notes only); requires primora vault unlock on the host.
primora_vault_exec — runs primora commands with a vault secret injected into the child's env; vault/secrets/inject/agent/login/use and keys:create are denied so no response can carry a credential.
primora_secrets_list / primora_secrets_set — project-vault metadata and write-only storage. No reveal or delete: agents consume secrets through secret://NAME references in job payloads, resolved server-side at delivery.