Serve node-launcher's hidden prompt, answering sealed to the asker, so a secret typed at the desk is never in the clear (hq ADR 0259 §10)

modules/rofi/cmd/rofi-tools/main.go

@@ -43,6 +43,30 @@ func tools() []stdio.Tool {
 				return Menu(q)
 			},
 		},
+		{
+			Name: "node-launcher.secret",
+			Description: fmt.Sprintf("Ask the operator for a value in a prompt that shows nothing of what is typed, "+
+				"and answer it sealed to the key seal_to names — never in the clear (novox/hq ADR 0259 §10): how the "+
+				"mesh takes a module's own secret at the desk. Answers sealed, or cancelled when the prompt was "+
+				"dismissed, answered empty or not answered within timeout_seconds (default and at most %d).", menuMost),
+			Input: map[string]any{
+				"type": "object",
+				"properties": map[string]any{
+					"prompt":          map[string]any{"type": "string", "description": "what the prompt asks"},
+					"message":         map[string]any{"type": "string", "description": "a line saying who asks and for what"},
+					"seal_to":         map[string]any{"type": "string", "description": "the asker's public sealing key, base64: the answer is sealed to it"},
+					"timeout_seconds": map[string]any{"type": "integer", "description": fmt.Sprintf("give up after this long (at most %d)", menuMost)},
+				},
+				"required": []string{"prompt", "seal_to"},
+			},
+			Run: func(args map[string]any) (any, error) {
+				q, err := secretQuestion(args)
+				if err != nil {
+					return nil, err
+				}
+				return Secret(q)
+			},
+		},
 		{
 			Name: "rofi_applications",
 			Description: "The desktop applications the launcher offers on this machine, from every desktop entry " +