@adrive/cli 0.2.1 → 0.3.0

package/dist/commands/pull.js

@@ -2,7 +2,7 @@ import { promises as fs } from 'node:fs';
 import kleur from 'kleur';
 import { CliApiClient } from '../lib/api-client.js';
 import { requireLogin } from '../lib/config.js';
-import { decryptContent, isEncrypted } from '../lib/crypto.js';
+import { decryptContentAsync, isEncrypted } from '../lib/crypto.js';
 export async function cmdPull(spec, opts = {}) {
     const cfg = await requireLogin();
     const client = new CliApiClient({
@@ -19,7 +19,7 @@ export async function cmdPull(spec, opts = {}) {
     const remotePath = spec.slice(slash + 1);
     const file = await client.readFileByPath(workspaceId, remotePath);
     const content = isEncrypted(file.content)
-        ? decryptContent(cfg.api_key, file.content)
+        ? await decryptContentAsync(cfg.api_key, file.content)
         : file.content;
     if (opts.out) {
         await fs.writeFile(opts.out, content, 'utf8');

package/dist/commands/push.js

@@ -3,7 +3,7 @@ import { basename } from 'node:path';
 import kleur from 'kleur';
 import { CliApiClient } from '../lib/api-client.js';
 import { requireLogin } from '../lib/config.js';
-import { encryptContent } from '../lib/crypto.js';
+import { encryptContentAsync } from '../lib/crypto.js';
 export async function cmdPush(localPath, opts = {}) {
     const cfg = await requireLogin();
     const client = new CliApiClient({
@@ -23,7 +23,7 @@ export async function cmdPush(localPath, opts = {}) {
         encrypt = false;
     else
         encrypt = cfg.preferences?.private_workspace ?? false;
-    const content = encrypt ? encryptContent(cfg.api_key, raw) : raw;
+    const content = encrypt ? await encryptContentAsync(cfg.api_key, raw) : raw;
     let workspaceId = opts.workspace ?? cfg.default_workspace;
     if (!workspaceId) {
         const list = await client.listWorkspaces();

package/dist/commands/transcripts.js

@@ -0,0 +1,210 @@
+import { promises as fs } from 'node:fs';
+import { homedir } from 'node:os';
+import { join, basename } from 'node:path';
+import kleur from 'kleur';
+import { CliApiClient } from '../lib/api-client.js';
+import { requireLogin, configDir } from '../lib/config.js';
+import { encryptContentAsync } from '../lib/crypto.js';
+import { redact, summarizeHits } from '../lib/redactor.js';
+function manifestPath() {
+    return join(configDir(), 'transcripts.manifest.json');
+}
+async function readManifest() {
+    try {
+        const raw = await fs.readFile(manifestPath(), 'utf8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { ingested: {} };
+    }
+}
+async function writeManifest(m) {
+    await fs.mkdir(configDir(), { recursive: true, mode: 0o700 });
+    await fs.writeFile(manifestPath(), JSON.stringify(m, null, 2), { encoding: 'utf8', mode: 0o600 });
+}
+async function findClaudeTranscripts() {
+    const projectsDir = join(homedir(), '.claude', 'projects');
+    let projects;
+    try {
+        projects = await fs.readdir(projectsDir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const p of projects) {
+        const pdir = join(projectsDir, p);
+        let files;
+        try {
+            files = await fs.readdir(pdir);
+        }
+        catch {
+            continue;
+        }
+        for (const f of files) {
+            if (!f.endsWith('.jsonl'))
+                continue;
+            const full = join(pdir, f);
+            let stat;
+            try {
+                stat = await fs.stat(full);
+            }
+            catch {
+                continue;
+            }
+            out.push({
+                sessionId: f.replace(/\.jsonl$/, ''),
+                path: full,
+                mtime: stat.mtime,
+                projectDir: p,
+            });
+        }
+    }
+    return out.sort((a, b) => b.mtime.getTime() - a.mtime.getTime());
+}
+function extractTurn(line) {
+    let obj;
+    try {
+        obj = JSON.parse(line);
+    }
+    catch {
+        return null;
+    }
+    const type = obj.type ?? '';
+    const ts = obj.timestamp ?? undefined;
+    if (type === 'user' || type === 'assistant') {
+        const msg = obj.message;
+        if (!msg)
+            return null;
+        const role = msg.role ?? type;
+        const content = msg.content;
+        let text = '';
+        if (typeof content === 'string') {
+            text = content;
+        }
+        else if (Array.isArray(content)) {
+            for (const part of content) {
+                if (typeof part === 'string')
+                    text += part;
+                else if (part && typeof part === 'object' && 'text' in part) {
+                    text += String(part.text);
+                }
+            }
+        }
+        if (!text.trim())
+            return null;
+        return { role, text, ts };
+    }
+    return null;
+}
+function formatTranscript(turns) {
+    const lines = [];
+    for (const t of turns) {
+        lines.push(`## ${t.role}${t.ts ? `  _(${t.ts})_` : ''}`);
+        lines.push('');
+        lines.push(t.text);
+        lines.push('');
+    }
+    return lines.join('\n');
+}
+export async function cmdTranscriptsIngest(opts = {}) {
+    const cfg = await requireLogin();
+    if (!cfg.preferences?.capture_transcripts && !opts.dryRun) {
+        process.stderr.write(`${kleur.yellow('[warn]')} Remember conversations is off in your preferences.\n` +
+            `       Enable with \`adrive privacy --capture-transcripts on\`,\n` +
+            `       or run a one-off dry-run with \`adrive transcripts ingest --dry-run\`.\n`);
+        process.exit(2);
+    }
+    const platform = opts.platform ?? 'claude-code';
+    if (platform !== 'claude-code') {
+        throw new Error(`Transcript ingestion for ${platform} is not implemented yet.`);
+    }
+    const all = await findClaudeTranscripts();
+    let entries = all;
+    if (opts.since) {
+        const since = new Date(opts.since);
+        if (Number.isNaN(since.getTime()))
+            throw new Error('Invalid --since date.');
+        entries = entries.filter((e) => e.mtime > since);
+    }
+    if (typeof opts.limit === 'number')
+        entries = entries.slice(0, opts.limit);
+    if (entries.length === 0) {
+        process.stdout.write('No transcripts found.\n');
+        return;
+    }
+    const manifest = await readManifest();
+    const client = new CliApiClient({
+        baseUrl: cfg.api_url,
+        apiKey: cfg.api_key,
+        agentPlatform: cfg.agent_platform ?? 'cli',
+        agentRole: cfg.agent_role,
+    });
+    let workspaceId = opts.workspace ?? cfg.default_workspace;
+    if (!workspaceId && !opts.dryRun) {
+        const list = await client.listWorkspaces();
+        if (list.length === 1)
+            workspaceId = list[0].id;
+        else if (list.length === 0)
+            throw new Error('No workspaces. Create one first.');
+        else
+            throw new Error('Multiple workspaces — specify --workspace <id>.');
+    }
+    const encrypt = !!cfg.preferences?.private_workspace;
+    process.stdout.write(`${kleur.bold(`Found ${entries.length} ${platform} transcripts.`)}\n`);
+    let ingested = 0;
+    let skipped = 0;
+    for (const e of entries) {
+        if (!opts.reingest && manifest.ingested[e.sessionId]) {
+            skipped++;
+            continue;
+        }
+        let raw;
+        try {
+            raw = await fs.readFile(e.path, 'utf8');
+        }
+        catch {
+            continue;
+        }
+        const turns = [];
+        for (const line of raw.split(/\r?\n/)) {
+            if (!line.trim())
+                continue;
+            const turn = extractTurn(line);
+            if (turn)
+                turns.push(turn);
+        }
+        if (turns.length === 0) {
+            skipped++;
+            continue;
+        }
+        const md = `# Transcript — ${platform} / ${e.sessionId}\n\n` +
+            `Project: ${e.projectDir}\nLast modified: ${e.mtime.toISOString()}\nTurns: ${turns.length}\n\n` +
+            formatTranscript(turns);
+        const { redacted, hits } = redact(md);
+        const remotePath = `transcripts/${platform}/${e.sessionId}.md`;
+        const tag = summarizeHits(hits);
+        if (opts.dryRun) {
+            process.stdout.write(`${kleur.dim('[dry]')} ${remotePath} ${kleur.dim(`(${turns.length} turns, redactor: ${tag})`)}\n`);
+            ingested++;
+            continue;
+        }
+        try {
+            const body = encrypt ? await encryptContentAsync(cfg.api_key, redacted) : redacted;
+            await client.writeFile(workspaceId, remotePath, body, `transcript ingest (${tag})`);
+            manifest.ingested[e.sessionId] = new Date().toISOString();
+            ingested++;
+            process.stdout.write(`${kleur.green('[ok]')}  ${remotePath}` +
+                (encrypt ? kleur.cyan(' (encrypted)') : '') +
+                (hits.length ? kleur.yellow(` (redacted: ${tag})`) : '') +
+                '\n');
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            process.stderr.write(`${kleur.red('[err]')} ${basename(e.path)}: ${msg}\n`);
+        }
+    }
+    if (!opts.dryRun)
+        await writeManifest(manifest);
+    process.stdout.write(`\nIngested ${ingested}, skipped ${skipped}.\n`);
+}

package/dist/commands/watch.js

@@ -0,0 +1,110 @@
+import { promises as fs } from 'node:fs';
+import { resolve, relative, sep, posix } from 'node:path';
+import { watch as chokidarWatch } from 'chokidar';
+import kleur from 'kleur';
+import { CliApiClient } from '../lib/api-client.js';
+import { requireLogin } from '../lib/config.js';
+import { encryptContentAsync } from '../lib/crypto.js';
+import { redact, summarizeHits } from '../lib/redactor.js';
+import { loadRules, shouldIgnore } from '../lib/ignore.js';
+function toPosix(p) {
+    return p.split(sep).join(posix.sep);
+}
+export async function cmdWatch(rawRoot, opts = {}) {
+    const root = resolve(rawRoot ?? process.cwd());
+    const cfg = await requireLogin();
+    if (!cfg.preferences?.capture_artifacts && !opts.dryRun) {
+        process.stderr.write(`${kleur.yellow('[warn]')} Capture artifacts is off in your preferences.\n` +
+            `       Either enable it with \`adrive privacy --capture-artifacts on\`\n` +
+            `       or run a one-off dry-run with \`adrive watch --dry-run\`.\n`);
+        process.exit(2);
+    }
+    const dryRun = !!opts.dryRun;
+    const encrypt = !opts.noEncrypt && !!cfg.preferences?.private_workspace;
+    const debounceMs = opts.debounce ?? 750;
+    const rules = await loadRules(root);
+    const client = new CliApiClient({
+        baseUrl: cfg.api_url,
+        apiKey: cfg.api_key,
+        agentPlatform: cfg.agent_platform ?? 'cli',
+        agentRole: cfg.agent_role,
+    });
+    let workspaceId = opts.workspace ?? cfg.default_workspace;
+    if (!workspaceId && !dryRun) {
+        const list = await client.listWorkspaces();
+        if (list.length === 1)
+            workspaceId = list[0].id;
+        else if (list.length === 0)
+            throw new Error('No workspaces. Create one first.');
+        else
+            throw new Error(`Multiple workspaces — specify --workspace <id>.`);
+    }
+    process.stdout.write(`${kleur.bold('AgentDrive watch')}\n`);
+    process.stdout.write(`  root:        ${root}\n`);
+    process.stdout.write(`  workspace:   ${workspaceId ?? kleur.dim('(dry-run, none)')}\n`);
+    process.stdout.write(`  mode:        ${dryRun ? kleur.yellow('dry-run — nothing uploads') : kleur.green('live')}\n`);
+    process.stdout.write(`  encryption:  ${encrypt ? kleur.cyan('end-to-end on your device') : 'off'}\n`);
+    process.stdout.write(`  redactor:    on (secrets are scrubbed before anything leaves)\n\n`);
+    const queue = new Map();
+    let timer;
+    async function flush() {
+        const pending = [...queue.values()];
+        queue.clear();
+        for (const item of pending) {
+            try {
+                const raw = await fs.readFile(item.abs, 'utf8');
+                const { redacted, hits } = redact(raw);
+                const remotePath = toPosix(item.rel);
+                const tag = summarizeHits(hits);
+                if (dryRun) {
+                    process.stdout.write(`${kleur.dim('[dry]')} ${item.reason.padEnd(6)} ${remotePath} ${kleur.dim(`(${raw.length}B, redactor: ${tag})`)}\n`);
+                    continue;
+                }
+                const body = encrypt ? await encryptContentAsync(cfg.api_key, redacted) : redacted;
+                const message = `adrive watch: ${item.reason}${hits.length ? ` (redacted ${tag})` : ''}`;
+                const result = await client.writeFile(workspaceId, remotePath, body, message);
+                process.stdout.write(`${kleur.green('[ok]')}  ${item.reason.padEnd(6)} ${remotePath} v${result.version}` +
+                    (encrypt ? kleur.cyan(' (encrypted)') : '') +
+                    (hits.length ? kleur.yellow(` (redacted: ${tag})`) : '') +
+                    '\n');
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                process.stderr.write(`${kleur.red('[err]')} ${item.rel}: ${msg}\n`);
+            }
+        }
+    }
+    function enqueue(absPath, reason) {
+        if (shouldIgnore(root, absPath, rules))
+            return;
+        const rel = relative(root, absPath);
+        queue.set(absPath, { abs: absPath, rel, reason });
+        if (timer)
+            clearTimeout(timer);
+        timer = setTimeout(() => {
+            void flush();
+        }, debounceMs);
+    }
+    const watcher = chokidarWatch(root, {
+        ignoreInitial: false,
+        persistent: true,
+        awaitWriteFinish: { stabilityThreshold: 200, pollInterval: 50 },
+        ignored: (p) => shouldIgnore(root, resolve(p), rules),
+    });
+    watcher.on('add', (p) => enqueue(resolve(p), 'add'));
+    watcher.on('change', (p) => enqueue(resolve(p), 'change'));
+    watcher.on('error', (err) => {
+        process.stderr.write(`${kleur.red('[err]')} watcher: ${String(err)}\n`);
+    });
+    const shutdown = async () => {
+        if (timer)
+            clearTimeout(timer);
+        await flush();
+        await watcher.close();
+        process.exit(0);
+    };
+    process.on('SIGINT', () => void shutdown());
+    process.on('SIGTERM', () => void shutdown());
+    // Resolve only when the user kills the process.
+    await new Promise(() => { });
+}

package/dist/index.js

@@ -15,6 +15,8 @@ import { cmdRunLog } from './commands/run-log.js';
 import { cmdBilling } from './commands/billing.js';
 import { cmdPlan } from './commands/plan.js';
 import { cmdPrivacy } from './commands/privacy.js';
+import { cmdWatch } from './commands/watch.js';
+import { cmdTranscriptsIngest } from './commands/transcripts.js';
 // Read from the bundled package.json so we never drift again.
 import { readFileSync } from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -127,6 +129,37 @@ program
     .command('plan')
     .description('Show current plan, usage, and quotas')
     .action(wrap(() => cmdPlan()));
+program
+    .command('watch [path]')
+    .description('Capture files your agents write under the given path (default: cwd)')
+    .option('-w, --workspace <id>', 'Workspace id (default: only workspace)')
+    .option('--dry-run', 'Print what would be uploaded; never write')
+    .option('--no-encrypt', 'Skip end-to-end encryption even when private workspace is on')
+    .option('--debounce <ms>', 'Coalesce changes within this window', (v) => Number(v))
+    .action(wrap((path, opts) => cmdWatch(path, {
+    workspace: opts.workspace,
+    dryRun: opts.dryRun,
+    noEncrypt: opts.encrypt === false,
+    debounce: opts.debounce,
+})));
+const transcripts = program.command('transcripts').description('Ingest chat transcripts from local agent hosts');
+transcripts
+    .command('ingest')
+    .description('Read recent transcripts, redact secrets, upload to AgentDrive')
+    .option('--platform <p>', 'Only ingest one platform (default: claude-code)', 'claude-code')
+    .option('-w, --workspace <id>', 'Target workspace id')
+    .option('--since <date>', 'Ignore transcripts older than this ISO date')
+    .option('--limit <n>', 'Cap how many to ingest', (v) => Number(v))
+    .option('--dry-run', 'Print what would be uploaded; never write')
+    .option('--reingest', 'Re-upload sessions already in the manifest')
+    .action(wrap((opts) => cmdTranscriptsIngest({
+    platform: opts.platform,
+    workspace: opts.workspace,
+    since: opts.since,
+    limit: opts.limit,
+    dryRun: opts.dryRun,
+    reingest: opts.reingest,
+})));
 program
     .command('privacy')
     .description('Show or change your privacy + memory preferences')

package/dist/lib/crypto.js

@@ -1,26 +1,26 @@
-import { createCipheriv, createDecipheriv, randomBytes, scryptSync, } from 'node:crypto';
-// AgentDrive private-workspace encryption.
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { loadDek } from './keychain.js';
+// AgentDrive private-workspace encryption (v1).
 //
-// Goal: a file uploaded with privacy on is opaque to the server. Even if our
-// storage is breached, the bytes are unreadable without the local key.
+// Sync API (`encryptContent` / `decryptContent`) keeps the legacy v0
+// derivation: scrypt(apiKey, fixedSalt). Used by tests + any caller that
+// can't await. The async API (`encryptContentAsync` / `decryptContentAsync`)
+// uses the keychain-stored DEK from lib/keychain.ts — that's the path the
+// real `adrive push` / `adrive pull` take.
 //
-// v0 derives the workspace data key from the API key with a scrypt KDF and a
-// fixed salt. That gives a single client-side key per principal — enough to
-// protect content from the server, not enough to protect content from a
-// compromised API key. v1 moves the master key into the OS keychain and uses
-// per-workspace data keys wrapped by it.
-const SALT = Buffer.from('agentdrive.privacy.v0', 'utf8');
-const KEY_LENGTH = 32; // AES-256
-const IV_LENGTH = 12; // GCM standard
-const TAG_LENGTH = 16; // GCM standard
+// Why two paths: a published v0.2.x ciphertext on disk should still decrypt
+// after the upgrade. The async path is opt-in and used for new writes.
+const LEGACY_SALT = Buffer.from('agentdrive.privacy.v0', 'utf8');
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const TAG_LENGTH = 16;
 const SCRYPT_COST = 1 << 14;
 const SCRYPT_MAXMEM = 64 * 1024 * 1024;
 const ENCRYPTED_PREFIX = 'agentdrive-encrypted:v0:';
 export function deriveWorkspaceKey(apiKey) {
-    return scryptSync(apiKey, SALT, KEY_LENGTH, { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM });
+    return scryptSync(apiKey, LEGACY_SALT, KEY_LENGTH, { N: SCRYPT_COST, maxmem: SCRYPT_MAXMEM });
 }
-export function encryptContent(apiKey, plaintext) {
-    const key = deriveWorkspaceKey(apiKey);
+function encryptWithKey(key, plaintext) {
     const iv = randomBytes(IV_LENGTH);
     const cipher = createCipheriv('aes-256-gcm', key, iv);
     const buf = typeof plaintext === 'string' ? Buffer.from(plaintext, 'utf8') : plaintext;
@@ -33,10 +33,7 @@ export function encryptContent(apiKey, plaintext) {
     };
     return ENCRYPTED_PREFIX + Buffer.from(JSON.stringify(payload), 'utf8').toString('base64');
 }
-export function isEncrypted(content) {
-    return typeof content === 'string' && content.startsWith(ENCRYPTED_PREFIX);
-}
-export function decryptContent(apiKey, encoded) {
+function decryptWithKey(key, encoded) {
     if (!isEncrypted(encoded)) {
         throw new Error('Content is not AgentDrive-encrypted.');
     }
@@ -47,9 +44,39 @@ export function decryptContent(apiKey, encoded) {
     if (iv.length !== IV_LENGTH || tag.length !== TAG_LENGTH) {
         throw new Error('Malformed encrypted payload.');
     }
-    const key = deriveWorkspaceKey(apiKey);
     const decipher = createDecipheriv('aes-256-gcm', key, iv);
     decipher.setAuthTag(tag);
     const ciphertext = Buffer.from(payload.ciphertext, 'base64');
     return Buffer.concat([decipher.update(ciphertext), decipher.final()]).toString('utf8');
 }
+export function encryptContent(apiKey, plaintext) {
+    return encryptWithKey(deriveWorkspaceKey(apiKey), plaintext);
+}
+export function decryptContent(apiKey, encoded) {
+    if (!isEncrypted(encoded)) {
+        throw new Error('Content is not AgentDrive-encrypted.');
+    }
+    return decryptWithKey(deriveWorkspaceKey(apiKey), encoded);
+}
+export async function encryptContentAsync(apiKey, plaintext) {
+    const dek = await loadDek(apiKey);
+    return encryptWithKey(dek, plaintext);
+}
+export async function decryptContentAsync(apiKey, encoded) {
+    const dek = await loadDek(apiKey);
+    try {
+        return decryptWithKey(dek, encoded);
+    }
+    catch (errKeychain) {
+        // Fallback for ciphertext written by v0 builds (pre-keychain).
+        try {
+            return decryptWithKey(deriveWorkspaceKey(apiKey), encoded);
+        }
+        catch {
+            throw errKeychain;
+        }
+    }
+}
+export function isEncrypted(content) {
+    return typeof content === 'string' && content.startsWith(ENCRYPTED_PREFIX);
+}

package/dist/lib/ignore.js

@@ -0,0 +1,137 @@
+import { promises as fs } from 'node:fs';
+import { join, relative, sep, posix } from 'node:path';
+// .adriveignore parser. Subset of gitignore semantics: blank lines and lines
+// starting with '#' are skipped; '!' negates a previous pattern; '/' anchors
+// to the project root; '**' matches across directories; '*' matches within a
+// segment.
+//
+// In addition we always layer a default-deny set on top so first-time users
+// don't accidentally upload .env / .ssh / .aws / node_modules even before
+// they edit the file.
+export const DEFAULT_DENY = [
+    '.git/',
+    'node_modules/',
+    '.next/',
+    '.open-next/',
+    '.turbo/',
+    'dist/',
+    'build/',
+    'coverage/',
+    '.cache/',
+    '.DS_Store',
+    '.env',
+    '.env.*',
+    '*.pem',
+    '*.key',
+    '*.p12',
+    '*.pfx',
+    '*.crt',
+    '.ssh/',
+    '.aws/',
+    '.gcp/',
+    '.kube/',
+    '.docker/config.json',
+    '.npmrc',
+    '.pypirc',
+    '.netrc',
+    'id_rsa',
+    'id_ed25519',
+    'credentials.json',
+    'serviceAccount.json',
+    '*.sqlite',
+    '*.sqlite3',
+    '*.db',
+    '__pycache__/',
+];
+function patternToRegex(raw) {
+    let pat = raw.trim();
+    const negate = pat.startsWith('!');
+    if (negate)
+        pat = pat.slice(1);
+    // Trailing slash means directory-only; treat it as match-anywhere-inside.
+    const dirOnly = pat.endsWith('/');
+    if (dirOnly)
+        pat = pat.slice(0, -1);
+    // Anchor to root if leading '/'.
+    const anchored = pat.startsWith('/');
+    if (anchored)
+        pat = pat.slice(1);
+    let re = '';
+    let i = 0;
+    while (i < pat.length) {
+        const c = pat[i];
+        if (c === '*') {
+            // '**' matches anything including slashes; single '*' matches within
+            // a path segment only.
+            if (pat[i + 1] === '*') {
+                re += '.*';
+                i += 2;
+                if (pat[i] === '/')
+                    i++;
+            }
+            else {
+                re += '[^/]*';
+                i++;
+            }
+        }
+        else if (c === '?') {
+            re += '[^/]';
+            i++;
+        }
+        else if ('.+^$()[]{}|\\'.includes(c)) {
+            re += '\\' + c;
+            i++;
+        }
+        else {
+            re += c;
+            i++;
+        }
+    }
+    // dirOnly: match the dir itself or anything under it.
+    if (dirOnly)
+        re += '(?:/.*)?';
+    // anchored = at root only; unanchored = at any depth.
+    const final = anchored ? `^${re}$` : `^(?:.*/)?${re}$`;
+    return { re: new RegExp(final), negate };
+}
+export function compileRules(lines) {
+    const rules = [];
+    for (const raw of lines) {
+        const line = raw.replace(/^\s+|\s+$/g, '');
+        if (!line || line.startsWith('#'))
+            continue;
+        const { re, negate } = patternToRegex(line);
+        rules.push({ pattern: line, negate, re });
+    }
+    return rules;
+}
+export async function loadRules(root) {
+    const candidates = [join(root, '.adriveignore'), join(root, '.gitignore')];
+    const lines = [...DEFAULT_DENY];
+    for (const c of candidates) {
+        try {
+            const raw = await fs.readFile(c, 'utf8');
+            lines.push(...raw.split(/\r?\n/));
+        }
+        catch {
+            // ignore missing
+        }
+    }
+    return compileRules(lines);
+}
+function normalizeRelative(root, path) {
+    const rel = relative(root, path);
+    return rel.split(sep).join(posix.sep);
+}
+export function shouldIgnore(root, path, rules) {
+    const rel = normalizeRelative(root, path);
+    if (!rel || rel.startsWith('..'))
+        return true;
+    let ignored = false;
+    for (const r of rules) {
+        if (r.re.test(rel)) {
+            ignored = !r.negate;
+        }
+    }
+    return ignored;
+}

package/dist/lib/keychain.js

@@ -0,0 +1,93 @@
+import { promises as fs } from 'node:fs';
+import { createCipheriv, createDecipheriv, randomBytes, scryptSync } from 'node:crypto';
+import { hostname, userInfo } from 'node:os';
+import { dirname, join } from 'node:path';
+import { configDir } from './config.js';
+// AgentDrive lightweight keychain (v1, software-only).
+//
+// Goal: a random 256-bit data-encryption key (DEK), persisted across runs,
+// wrapped with a key-encrypting key (KEK) derived from
+//   scrypt(host || user || api_key, salt).
+//
+// This is stronger than "derive DEK directly from API key" because:
+//   - Rotating the API key doesn't change the DEK, so old ciphertext is
+//     still decryptable after rotation (with the same KEK derivation).
+//   - The DEK is random, not derivable from the API key alone.
+//   - host+user binding means a stolen API key cannot decrypt files
+//     without also having access to the user's home + machine identity.
+//
+// v2 will replace the KEK derivation with the OS keychain
+// (Keychain.app / libsecret / DPAPI). The interface stays the same.
+const KEY_LENGTH = 32;
+const IV_LENGTH = 12;
+const SALT_LENGTH = 16;
+const TAG_LENGTH = 16;
+const SCRYPT_N = 1 << 14;
+const SCRYPT_MAXMEM = 64 * 1024 * 1024;
+const FILE_VERSION = 1;
+export function keychainPath(env = process.env) {
+    return join(configDir(env), 'keychain.bin');
+}
+function deriveKek(apiKey, salt) {
+    // Bind to the machine + user. A stolen API key alone won't unwrap the DEK.
+    const ident = `${hostname()}|${userInfo().username}|${apiKey}`;
+    return scryptSync(ident, salt, KEY_LENGTH, { N: SCRYPT_N, maxmem: SCRYPT_MAXMEM });
+}
+async function readBlob(path) {
+    try {
+        const raw = await fs.readFile(path, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (parsed.v !== FILE_VERSION)
+            return null;
+        return parsed;
+    }
+    catch (err) {
+        const e = err;
+        if (e.code === 'ENOENT')
+            return null;
+        return null;
+    }
+}
+async function writeBlob(path, blob) {
+    await fs.mkdir(dirname(path), { recursive: true, mode: 0o700 });
+    await fs.writeFile(path, JSON.stringify(blob), { encoding: 'utf8', mode: 0o600 });
+}
+export async function loadDek(apiKey, path = keychainPath()) {
+    const existing = await readBlob(path);
+    if (existing) {
+        const salt = Buffer.from(existing.salt, 'base64');
+        const iv = Buffer.from(existing.iv, 'base64');
+        const tag = Buffer.from(existing.tag, 'base64');
+        const ct = Buffer.from(existing.ct, 'base64');
+        const kek = deriveKek(apiKey, salt);
+        const dec = createDecipheriv('aes-256-gcm', kek, iv);
+        dec.setAuthTag(tag);
+        return Buffer.concat([dec.update(ct), dec.final()]);
+    }
+    // First use: create a fresh DEK and persist wrapped.
+    const dek = randomBytes(KEY_LENGTH);
+    const salt = randomBytes(SALT_LENGTH);
+    const iv = randomBytes(IV_LENGTH);
+    const kek = deriveKek(apiKey, salt);
+    const enc = createCipheriv('aes-256-gcm', kek, iv);
+    const ct = Buffer.concat([enc.update(dek), enc.final()]);
+    const tag = enc.getAuthTag();
+    if (tag.length !== TAG_LENGTH)
+        throw new Error('Unexpected GCM tag length');
+    await writeBlob(path, {
+        v: FILE_VERSION,
+        salt: salt.toString('base64'),
+        iv: iv.toString('base64'),
+        tag: tag.toString('base64'),
+        ct: ct.toString('base64'),
+    });
+    return dek;
+}
+export async function purgeKeychain(path = keychainPath()) {
+    try {
+        await fs.unlink(path);
+    }
+    catch {
+        // ignore
+    }
+}

package/dist/lib/redactor.js

@@ -0,0 +1,69 @@
+// Secret redactor. Runs on every payload before capture features upload
+// content. Patterns are intentionally conservative — false positives are
+// tagged and replaced with a safe marker; false negatives are the risk we
+// optimize against.
+//
+// IMPORTANT: redaction is best-effort, not a security boundary. It is one
+// layer in a defense-in-depth stack: .adriveignore for path-level deny,
+// redactor for content-level scrub, optional client-side encryption for
+// confidentiality.
+// Order matters: more specific patterns first so they win over the generic
+// high-entropy fallback.
+const PATTERNS = [
+    // Provider-specific keys
+    { kind: 'aws-access-key-id', re: /\bAKIA[0-9A-Z]{16}\b/g, marker: () => '[redacted:aws-access-key-id]' },
+    { kind: 'aws-secret', re: /\b(?:aws_secret_access_key|AWS_SECRET_ACCESS_KEY)[\s:=]+['"]?[A-Za-z0-9/+=]{40}['"]?/g, marker: () => '[redacted:aws-secret]' },
+    { kind: 'gcp-service-account', re: /"private_key":\s*"-----BEGIN PRIVATE KEY-----[\s\S]*?-----END PRIVATE KEY-----[^"]*"/g, marker: () => '"private_key":"[redacted:gcp-service-account]"' },
+    { kind: 'stripe-secret', re: /\bsk_(?:live|test)_[A-Za-z0-9]{16,99}\b/g, marker: () => '[redacted:stripe-secret]' },
+    { kind: 'stripe-restricted', re: /\brk_(?:live|test)_[A-Za-z0-9]{16,99}\b/g, marker: () => '[redacted:stripe-restricted]' },
+    { kind: 'github-token', re: /\bgh[pousr]_[A-Za-z0-9]{36,255}\b/g, marker: () => '[redacted:github-token]' },
+    { kind: 'github-fine-grained', re: /\bgithub_pat_[A-Za-z0-9_]{82}\b/g, marker: () => '[redacted:github-fine-grained]' },
+    { kind: 'anthropic-key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/g, marker: () => '[redacted:anthropic-key]' },
+    { kind: 'openai-key', re: /\bsk-(?:proj-)?[A-Za-z0-9_-]{20,}/g, marker: () => '[redacted:openai-key]' },
+    { kind: 'agentdrive-key', re: /\bagentdrive_live_[A-Za-z0-9]{16,}/g, marker: () => '[redacted:agentdrive-key]' },
+    { kind: 'slack-bot-token', re: /\bxox[abprs]-[A-Za-z0-9-]{10,}/g, marker: () => '[redacted:slack-token]' },
+    { kind: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g, marker: () => '[redacted:jwt]' },
+    // Private keys (PEM-style blocks). Match the whole block.
+    { kind: 'private-key-pem', re: /-----BEGIN (?:RSA |OPENSSH |EC |DSA |ENCRYPTED |PRIVATE)?PRIVATE KEY-----[\s\S]*?-----END (?:RSA |OPENSSH |EC |DSA |ENCRYPTED |PRIVATE)?PRIVATE KEY-----/g, marker: () => '[redacted:private-key]' },
+    // Generic high-entropy assignment forms: VAR=secret-looking-string
+    { kind: 'env-secret', re: /\b(?:[A-Z][A-Z0-9_]*_(?:KEY|SECRET|TOKEN|PASS(?:WORD)?|PWD|CREDENTIAL))\s*[:=]\s*['"]?([A-Za-z0-9+/_=-]{16,})['"]?/g, marker: (m) => m.replace(/(.*?[:=]\s*['"]?)([A-Za-z0-9+/_=-]{16,})(['"]?)/, '$1[redacted:env-secret]$3') },
+];
+function offsetToLineCol(text, offset) {
+    let line = 1;
+    let lastNewline = -1;
+    for (let i = 0; i < offset; i++) {
+        if (text.charCodeAt(i) === 10) {
+            line++;
+            lastNewline = i;
+        }
+    }
+    return { line, column: offset - lastNewline };
+}
+export function redact(input) {
+    let out = input;
+    const hits = [];
+    for (const p of PATTERNS) {
+        out = out.replace(p.re, (match, ..._args) => {
+            // Locate this match in the *original* input for line/col reporting.
+            // Using the original gives stable coordinates the user can verify.
+            const idx = input.indexOf(match);
+            if (idx >= 0) {
+                const { line, column } = offsetToLineCol(input, idx);
+                hits.push({ kind: p.kind, line, column, length: match.length });
+            }
+            return p.marker(match);
+        });
+    }
+    return { redacted: out, hits };
+}
+export function summarizeHits(hits) {
+    if (hits.length === 0)
+        return 'no secrets detected';
+    const counts = {};
+    for (const h of hits)
+        counts[h.kind] = (counts[h.kind] ?? 0) + 1;
+    return Object.entries(counts)
+        .sort(([, a], [, b]) => b - a)
+        .map(([k, n]) => `${k}×${n}`)
+        .join(', ');
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@adrive/cli",
-  "version": "0.2.1",
+  "version": "0.3.0",
   "description": "AgentDrive CLI — the persistent workspace your agents share across Claude Code, Codex, Cursor, and LangGraph.",
   "license": "Apache-2.0",
   "type": "module",
@@ -44,6 +44,7 @@
     "test": "vitest run"
   },
   "dependencies": {
+    "chokidar": "^5.0.0",
     "commander": "^12.1.0",
     "kleur": "^4.1.5",
     "open": "^10.1.0",