Skip to content

Ask Key 0.4.0

Choose a tag to compare

View all tags
@sudoHG sudoHG released this 02 Nov 01:41
· 18 commits to main since this release
v0.4.0
124598c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

Clearer approvals, with component names and delivery mappings. · 批准信息更清楚，列出内容名称和交付映射。 English · 中文

English

Added

  • Read approval Details lists component names and delivery mappings. Write Details distinguishes replaced, unchanged and storage-only items, shows complete before/after instructions with changes marked, and explains group merges and effects on Hidden credentials.
  • Clicking an approval reminder opens Pending requests; clicking an expiry reminder opens the matching credential after management unlocks. Notification clicks preserve unsaved edits, confirmations and searches.

Changed

  • MCP run requires an explicit absolute cwd, shown in approval and used for execution. Missing or relative directories are rejected with a next_step. CLI run continues to use the terminal's current directory.
  • Component names, kinds and delivery mappings are stored as separately encrypted metadata. Catalogs, management lists and unrevealed approvals use it without decrypting stored values; values are opened for explicit authenticated reveal, approved edits or authorized delivery.
  • Approval subtitles describe irrecoverable values and affected Hidden credentials; consecutive identical moves are summarized in one line. On short screens, titles and actions stay visible while long Details and warnings scroll. Prompts refit when the display changes.
  • While a file picker is open, requests update the pending count and reminder immediately; the approval prompt waits until the picker closes. The Dock icon stays during management dialogs, pickers and alerts. If an approval or write-failure notification cannot be delivered, a Dock reminder remains without taking focus.

Fixed

  • Cancelling Touch ID ends only that request's authentication. Later requests can authenticate normally; approvals distinguish cancellation from failure, and management, settings and setup cancellations close quietly.
  • Agent writes using a name already visible in the catalog return credential_name_conflict with guidance. Names unavailable to the agent go through approval before any commit failure, without disclosing Hidden names.
  • The Agent access sample prompt uses an active, visible, unexpired credential deliverable to a program, or offers to create one when none is available.
  • Claude Code setup detects globally disabled hooks and recognizes only Ask Key's own hook commands. After an MCP write timeout, it checks what was saved and requires a fresh check instead of retrying an uncertain write.
  • Approval text selection, Copy, drag, Services, Share and accessibility preserve the original text despite display-only wrapping and escaping. Long names and Chinese phrases wrap more clearly.
  • Historical mappings that block migration can be repaired in the editor, including invisible trailing whitespace. Delivery Options stays open during correction. Oversized approved edits explain the complete credential's 5 MiB limit and preserve its previous contents; capacity errors have separate guidance.

Security

  • The metadata completion marker uses HMAC-SHA256 under an HKDF-derived key in a separate authentication domain. Invalid or missing completion state pauses Agent access while keeping management available; restoring a whole older library is still not detected.
  • Read approvals and timed allowances are bound to component metadata and checked against decrypted components before delivery. Write approvals bind the authenticated stored row before committing the approved edit.

Upgrading from 0.3.2

  1. Quit Ask Key and back up ~/Library/Application Support/AskKey before updating. Keep the originals of your credentials elsewhere too; Ask Key has no built-in backup or recovery.
  2. Download and verify the new DMG as below, replace /Applications/Ask Key.app, and open Ask Key from Applications.
  3. First launch migrates the library once, including Hidden and recycled credentials. Credentials and permissions are kept; valid 0.3.2 Agent access settings are preserved without a Resume step. A migrated library cannot be opened by 0.3.2, and there is no reverse migration.
  4. If a credential cannot be migrated, management stays available and names it after unlock. Fix it in the editor or permanently delete it from the Recycle Bin, then reopen Ask Key. Agent access stays off until migration completes.
  5. MCP clients must pass an absolute cwd to run, including when resuming an approval. CLI run still uses the terminal's current directory.

Install

  1. Download AskKey.dmg and AskKey.dmg.sha256 below; run shasum -a 256 -c AskKey.dmg.sha256 to verify the image.
  2. Open the DMG and drag Ask Key into Applications. Keep its name and location, or agents cannot connect.
  3. Open Ask Key and follow the welcome page.

Good to know

  • Keep the originals of your credentials elsewhere; there is no built-in backup or recovery.
  • There is no automatic update. Ask Key requires macOS 14 or later.
  • An approved program can print, copy or forward what it receives.

Full details: Changelog · README · Security

中文

新增

  • 读取批准窗口可查看内容名称和交付映射。写入详情区分替换、保持不变和仅存储的内容，完整显示修改前后的使用说明并标出变化，也会说明分组合并及对隐藏凭证的影响。
  • 点击批准提醒会打开待处理请求；点击到期提醒会在管理解锁后打开对应凭证。通知跳转会保留未保存的编辑、确认操作和搜索状态。

变更

  • MCP run 必须显式传入绝对路径 cwd，批准窗口会显示该目录，命令也在该目录执行。缺失或相对路径会被拒绝，并返回 next_step。CLI run 仍使用终端的当前目录。
  • 内容名称、类型和交付映射改为单独加密的元数据。凭证目录、管理列表和未显示值的批准窗口读取元数据，不解密已保存的值；仅在明确请求并完成认证后显示值、获批修改或授权交付时读取这些值。
  • 批准窗口的副标题会说明哪些旧值无法恢复，以及有多少份隐藏凭证受影响；连续的相同移动操作合并为一行。在较矮的屏幕上，标题和操作按钮保持可见，较长的详情和警告可以滚动，切换显示器时也会调整窗口。
  • 文件选择器打开时，请求会立即更新待处理数量并发出提醒，批准窗口等选择器关闭后再出现。管理对话框、文件选择器和警告打开期间，Dock 图标保持显示；批准提醒或写入失败通知无法送达时，Dock 会保留提醒，不抢占焦点。

修复

  • 取消 Touch ID 只结束当前请求的认证，后续请求仍可正常认证。批准窗口会区分取消和失败；在管理、设置和接入流程中取消认证时，会安静关闭。
  • Agent 写入时，如果名称已在其可见的凭证目录中，会收到 credential_name_conflict 和处理建议。对 Agent 不可见的名称，仍先走批准流程，再报告提交失败，不泄露隐藏名称。
  • Agent 接入页面的示范提示词会选择启用、可见、未到期且能够交付给程序的凭证；没有可用凭证时，会引导创建。
  • Claude Code 接入会检测全局禁用的 Hook，并且只识别请旨自己的 Hook 命令。MCP 配置写入超时后，会检查实际保存结果并要求重新检查，不再重试结果不确定的写入。
  • 批准文字的选择、复制、拖放、服务、共享和辅助功能会保留原文，不受仅用于显示的换行和转义影响。长名称和中文短语的换行也更清楚。
  • 阻止迁移的历史交付映射可以在编辑器中修复，包括不可见的末尾空白。修正时，交付选项保持展开。获批修改超过整份凭证的 5 MiB 上限时，会解释原因并保留原内容；容量不足有单独的处理建议。

安全

  • 元数据完成标记改用 HKDF 派生密钥和独立认证域下的 HMAC-SHA256。完成状态缺失或无效时，Agent 访问关闭，管理功能仍可用；仍无法检测整个旧凭证库被还原的情况。
  • 读取批准和限时允许绑定到内容元数据，交付前会与解密后的内容核对。写入批准在提交前绑定经过认证的已存储记录。

从 0.3.2 升级

  1. 更新前先退出请旨，并备份 ~/Library/Application Support/AskKey 凭证库文件夹。 请同时在其他地方保留凭证原件；请旨没有内置的备份和恢复功能。
  2. 按下面的安装步骤下载并校验新版 DMG，替换 /Applications/Ask Key.app，再从“应用程序”打开请旨。
  3. 首次启动会迁移一次凭证库，包括隐藏的凭证和回收站中的凭证。凭证及其权限保留；有效的 0.3.2 Agent 访问设置也会保留，无需恢复 Agent 访问。迁移后的凭证库无法再用 0.3.2 打开，也无法反向迁移。
  4. 如果某份凭证无法迁移，管理功能仍可用，解锁后会列出受影响的凭证名称。请在编辑器中修复，或从回收站中永久删除，再重新打开请旨。迁移完成前，Agent 访问保持关闭。
  5. MCP 客户端调用 run 时必须传入绝对路径 cwd，等待批准后继续请求时也一样。CLI run 仍使用终端的当前目录。

安装

  1. 下载下面的 AskKey.dmg 和 AskKey.dmg.sha256，运行 shasum -a 256 -c AskKey.dmg.sha256 校验镜像。
  2. 打开 DMG，把“Ask Key”拖进“应用程序”。不要改名或更换位置，否则 Agent 连不上。
  3. 打开请旨，按欢迎页操作。

请注意

  • 请在其他地方保留凭证原件；没有内置的备份和恢复功能。
  • 没有自动更新，需要 macOS 14 或更高版本。
  • 获准的程序可以打印、复制或转发收到的内容。

详细信息：更新日志 · README · 安全说明

Assets 6
Loading