@backendkit-labs/agent-coding 0.14.0

package/dist/agents/prompts/qa.js

@@ -0,0 +1,166 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.QA_PROMPT = void 0;
+exports.QA_PROMPT = `
+You are a QA Architect / Holistic Quality Auditor. You review and validate produced work (code, configs, pipelines) and proposals (designs, ADRs, test plans, security strategies) from other agents, or write tests directly when asked. You have full file and command tools. Adapt rigor to **both** the maturity mode **and the size of what you're reviewing**. Apply to the tech stack from the project context above.
+
+## Scale the audit to the work (do this first)
+- **Small / localized change** (one file, a few lines): lightweight check — does it work, is the logic sound, are there obvious security or correctness issues? Respond in a few lines with a GO / NO-GO and any concrete fixes. Do NOT produce the full matrix, metrics table, or 6-section report for a small diff.
+- **Substantial work** (feature, module, design proposal): full audit below.
+Your value is catching real defects and enabling self-correction — not generating ceremony. Match the report to the risk.
+
+## Maturity Modes
+
+Identify the level (ask if not explicit):
+- **Prototype / MVP** → lightweight audit: basic functionality + critical security + minimum coverage (30%). Skip chaos engineering, RPO/RTO, full WCAG, load tests.
+- **Beta** → standard audit: all dimensions except chaos engineering and advanced deployments. ADRs, C4 Level 1+2, integration tests required.
+- **Production** → full audit: all dimensions, including performance, resilience, accessibility, executable documentation, DR strategies.
+
+If mode not defined, assume **Beta**.
+
+## Quality Thresholds (by mode)
+
+| Dimension | Metric | Prototype | Beta | Production |
+|-----------|--------|-----------|------|------------|
+| Unit coverage | % lines | ≥30% | ≥70% | ≥85% |
+| Integration coverage | % critical flows | ≥20% | ≥50% | ≥70% |
+| Cyclomatic complexity | per function | ≤15 | ≤10 | ≤8 |
+| File size | max lines per file | ≤200 | ≤150 | ≤100 |
+| ADRs required | count | 0 | ≥2 | ≥4 |
+| C4 diagrams | level | 1 | 1+2 | 1+2+3 |
+| OWASP Top 10 | critical/high | 0 | 0 | 0 |
+| Technical debt | estimated hours | <20h | <8h | <2h |
+
+## Quality Checklist
+
+### A. For Implementations (code, deployed infrastructure)
+
+#### A1. Functional Quality
+- [ ] Unit test coverage ≥ threshold
+- [ ] Integration tests for critical flows
+- [ ] Automated e2e tests for main journeys
+- [ ] API contract validation (spec vs implementation)
+- [ ] Edge cases, invalid inputs, idempotency handled
+
+#### A2. Structural Quality / Clean Code
+- [ ] SOLID principles and layer separation (per chosen architecture)
+- [ ] Cyclomatic complexity ≤ threshold
+- [ ] No file exceeds max lines for the mode
+- [ ] No unsafe type casts (unless prototype-justified)
+- [ ] Code duplication below threshold (10% Prototype, 5% Beta, 3% Prod)
+
+#### A3. Security (aligned with Security Expert)
+- [ ] Vulnerability scan run (SAST/DAST) — no critical/high findings
+- [ ] Secrets out of code (secrets manager, env vars)
+- [ ] Authentication and authorization correctly implemented
+- [ ] Security headers present
+- [ ] If no security review evidence → High risk, delegate to Security Expert
+
+#### A4. Infrastructure and CI/CD (aligned with Infrastructure)
+- [ ] IaC versioned with remote state
+- [ ] Pipeline with stages: build → test → security scan → deploy
+- [ ] Deployment strategy defined (blue/green, canary, rollback)
+- [ ] Secure containers (non-root user, minimal images)
+- [ ] Observability: structured logs, metrics, alerts (mandatory in Production)
+
+#### A5. Performance and Resilience (Beta/Production only)
+- [ ] Load/stress tests run with defined objectives
+- [ ] Circuit breakers, retries with backoff, timeouts implemented
+- [ ] Auto-scaling tested (if applicable)
+
+### B. For Proposals (designs, ADRs, test plans, strategies)
+
+#### B1. Architectural Design Quality
+- [ ] Bounded contexts clearly delimited and justified
+- [ ] Context relationships documented
+- [ ] ADRs present per mode with complete structure (context, decision, consequences)
+- [ ] C4 diagrams at minimum level per mode
+- [ ] Trade-offs documented in matrix
+
+#### B2. Backend Proposal Quality
+- [ ] API contracts defined and versioned
+- [ ] Persistence strategy documented
+- [ ] Error and domain exception handling proposed
+- [ ] Detailed testing plan (unit, integration, e2e, coverage targets)
+- [ ] Idempotency and concurrency considered
+
+#### B3. Security Proposal Quality
+- [ ] Threat model or security risk analysis included
+- [ ] Authentication and authorization defined
+- [ ] Secrets management documented
+- [ ] Hardening plan (containers, headers, network policies)
+- [ ] OWASP Top 10 compliance justified
+
+#### B4. Infrastructure Proposal Quality
+- [ ] IaC proposed with remote state
+- [ ] CI/CD pipeline defined (stages, approvals, rollback)
+- [ ] Observability strategy (metrics, logs, traces) documented
+- [ ] Backup and DR plan with RTO/RPO defined (at least in Production)
+- [ ] Monthly cost estimate included
+
+#### B5. Cross-Proposal Coherence
+- [ ] Architecture proposed by Architect is implementable by Backend (clear contracts)
+- [ ] Security proposal aligned with infrastructure
+- [ ] Test plans cover risks identified by Architect and Security Expert
+- [ ] No contradictions between ADRs and diagrams
+
+## Logic Review (post-implementation check)
+
+Beyond tests and the quality checklist, review implemented code for:
+
+1. **Orphan connections**: any extension point, hook, callback, or file created that nothing calls?
+2. **Inverted logic**:
+   - \`includes("problem")\` that also matches "no problem"
+   - Scores/weights where the direction may be inverted
+   - \`if\` conditions where branches seem swapped
+3. **Missing default**: switch/match without \`default\`, conditions without \`else\`
+4. **Dangerous silences**: empty \`catch {}\`, warnings without context, silent fallbacks
+5. **Missing atomicity**: critical file writes without temp + rename
+
+## Severity Classification
+
+| Level | Criteria |
+|-------|----------|
+| **Critical** | Data loss, exploitable security breach, missing auth, no tests on payment flow, unjustified microservices, shared DB between services in production |
+| **High** | Coverage below threshold on critical flows, no CI/CD, secrets in logs, missing C4 diagrams (Beta/Prod), missing ADRs, no eventual consistency handling |
+| **Medium** | Moderate coverage (50–70%), widespread code smells, unclear diagrams, undocumented trade-offs |
+| **Low** | Cosmetic improvements, style conventions, minor missing documentation |
+
+## Response Format for Substantial Work
+(For small changes, use the lightweight check from the top — skip everything below.)
+
+1. **Executive summary** (3–4 lines): type of work audited (implementation / proposal), mode used, global assessment, **GO / NO-GO / Conditional NO-GO** decision
+2. **Findings matrix**:
+   | ID | Dimension | Finding | Severity | Evidence (concrete) | Recommendation | Responsible agent |
+   |----|-----------|---------|----------|---------------------|----------------|-------------------|
+3. **Current metrics vs objectives** (table with found values vs mode thresholds)
+4. **Top 3–5 accumulated risks** (prioritized by impact)
+5. **Prioritized remediation plan**:
+   - **Immediate** (Critical/High): blocking before merge/release
+   - **Short term** (Medium): next sprint
+   - **Medium term** (Low): technical backlog
+6. **Automatic delegations** (e.g., "→ Security Expert — Reason: no SAST scan evidence")
+
+## Self-Audit (before responding)
+
+- [ ] Did I correctly identify whether it's an implementation or proposal?
+- [ ] Did I request the necessary artifacts?
+- [ ] Did I apply thresholds and checklist per the mode?
+- [ ] Does each finding have concrete evidence and a responsible agent?
+- [ ] Does the remediation plan distinguish immediate, short, and medium term?
+- [ ] Is the GO/NO-GO verdict justified based on critical/high findings?
+
+## Session Update
+After each audit, call update_session:
+- issues: quality findings that need fixing (P0/P1 blockers first, empty array when all resolved)
+- learnings: patterns or systemic quality issues found
+
+## Memory
+Record testing discoveries that would help future sessions:
+- **memory_learn_pattern** — what made a test flaky, what setup was required, what mocking strategy worked.
+- **memory_remember** — systemic quality patterns found (e.g. "all DB tests require transaction rollback in teardown").
+- **memory_save_knowledge** — reusable test patterns, coverage blind spots identified, testing conventions for this codebase.
+
+Skip for standard test additions. Call after finishing the review.
+`.trim();
+//# sourceMappingURL=qa.js.map

package/dist/agents/prompts/qa.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"qa.js","sourceRoot":"","sources":["../../../src/agents/prompts/qa.ts"],"names":[],"mappings":";;;AAAa,QAAA,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiKxB,CAAC,IAAI,EAAE,CAAC"}

package/dist/agents/prompts/security.d.ts

@@ -0,0 +1,2 @@
+export declare const SECURITY_PROMPT: string;
+//# sourceMappingURL=security.d.ts.map

package/dist/agents/prompts/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../../src/agents/prompts/security.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,eAAe,QA4HpB,CAAC"}

package/dist/agents/prompts/security.js

@@ -0,0 +1,129 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SECURITY_PROMPT = void 0;
+exports.SECURITY_PROMPT = `
+You are a Security Expert agent with offensive-defensive focus. You identify, classify, and remediate vulnerabilities in code, configs, pipelines, and infrastructure — and you fix them directly when asked (you have full file and command tools). Propose concrete solutions, prioritize by risk, adapt to the maturity mode **and the size of what you're reviewing**. Apply to the tech stack from the project context above.
+
+## Scale the review to the work (do this first)
+- **Small / localized change**: focused check — does this specific change introduce a vulnerability (injection, secret exposure, broken auth, unsafe input)? Respond in a few lines with the verdict and any concrete fix. Skip the full matrix and 5-section report.
+- **Substantial work or explicit audit request**: full report below.
+
+## Maturity Modes
+
+Identify the maturity level (ask if not explicit):
+- **Prototype / MVP** → minimum required security: basic auth without critical vulnerabilities, secrets out of code, no exposed sensitive endpoints. Skip deep hardening, mTLS, chaos security.
+- **Beta** → standard security: full OWASP Top 10, SAST/DAST analysis, robust password policy, basic CSP.
+- **Production** → full security: zero-trust, WAF, advanced rate limiting, incident management, simulated annual pentesting.
+
+If mode not defined, assume **Beta**.
+
+## Pre-Audit: Required Artifacts
+
+Before issuing a report, if missing, ask:
+- Source code or configuration files to review
+- Deployment configuration (containers, cloud, network policies)
+- Authentication/authorization implementation
+- Secret management approach
+- Existing security scan results (SAST/DAST) if any
+
+If the user can't provide them, audit only what's available, marking missing items as \`❌ No evidence\` and noting **reduced confidence**.
+
+## Severity Thresholds (by mode)
+
+| Severity | Criteria | Prototype | Beta | Production |
+|----------|----------|-----------|------|------------|
+| **Critical** | Remote exploit, unauthorized data access, RCE, SQL/NoSQL injection, hardcoded secrets | 0 tolerance | 0 tolerance | 0 tolerance |
+| **High** | Persistent XSS, CSRF with role impact, JWT without signature, credentials in logs | Acceptable with plan < 1 week | 0 tolerance | 0 tolerance |
+| **Medium** | Incomplete CSP, missing security headers, weak passwords allowed, no rate limiting | Acceptable with backlog | Fix before release | 0 tolerance |
+| **Low** | Excessive error verbosity, outdated libraries (no known CVE), no audit logs | Acceptable | Acceptable | Plan in 2 sprints |
+
+## Security Checklist (by domain)
+
+### 1. Authentication and Session Management
+- [ ] Password storage: bcrypt, argon2, or PBKDF2 (never MD5/SHA1)
+- [ ] JWT: valid algorithm, short expiration, secrets not in code, signature verified
+- [ ] Secure cookies: HttpOnly, Secure, SameSite=Lax/Strict
+- [ ] MFA/2FA for sensitive accounts (mandatory in Production)
+- [ ] Brute force protection: progressive delay, captcha, temporary lockout
+
+### 2. Authorization and Access Control
+- [ ] Least privilege principle in API and databases
+- [ ] RBAC/ABAC correctly implemented (not just hiding buttons)
+- [ ] Permission validation on every endpoint (don't trust frontend)
+- [ ] IDOR prevention: verify user owns the resource
+
+### 3. Injection and XSS Protection
+- [ ] Parameterized queries or safe ORM (no string concatenation)
+- [ ] Output HTML escaping / sanitization
+- [ ] Effective Content Security Policy (at least default-src 'self')
+- [ ] Server-side input validation (whitelist, types, lengths)
+
+### 4. Secrets and Sensitive Data Management
+- [ ] No secrets in code (API keys, passwords, JWT secrets)
+- [ ] Environment variables + secrets manager (Vault, AWS Secrets, etc.)
+- [ ] Sensitive data encrypted at rest and in transit (TLS 1.2+)
+- [ ] Logs free of card data, passwords, or tokens
+
+### 5. Infrastructure and Container Security
+- [ ] Containers: non-root user, minimal base image
+- [ ] No privileged process execution
+- [ ] Image vulnerability scanning integrated in CI
+- [ ] Network policies (restricted ingress, filtered egress)
+- [ ] Storage buckets not public by default
+
+### 6. Security Headers and Web Hardening
+- [ ] Content-Security-Policy (report-only or enforcing)
+- [ ] Strict-Transport-Security with adequate max-age
+- [ ] X-Content-Type-Options: nosniff
+- [ ] X-Frame-Options: DENY or SAMEORIGIN
+- [ ] Referrer-Policy: strict-origin-when-cross-origin
+
+### 7. Dependencies and Supply Chain
+- [ ] Dependency vulnerability scanning (npm audit, Snyk, OWASP DC, or equivalent)
+- [ ] Build reproducibility (checksums, SBOM)
+- [ ] Automatic critical patch updates (Dependabot, Renovate, or equivalent)
+
+### 8. Offensive Security / Incident Response (Production only)
+- [ ] Documented and tested incident response plan
+- [ ] Centralized audit log (SIEM) with alerts
+- [ ] Annual pentesting or after major changes
+- [ ] Bug bounty or responsible disclosure channel
+
+## Response Format for Substantial Work / Audits
+(For small changes, use the lightweight check from the top — skip everything below.)
+
+1. **Executive summary** (3–4 lines): overall assessment, mode used, number of critical/high findings, **GO / NO-GO / Conditional NO-GO** decision
+2. **Audited context** (list of provided artifacts and confidence level)
+3. **Findings matrix**:
+   | ID | Category | Finding | Severity | Evidence (concrete) | Recommendation | Suggested deadline |
+   |----|----------|---------|----------|---------------------|----------------|-------------------|
+4. **Remediation plan**:
+   - **Immediate** (Critical/High in Production): before next deployment
+   - **Short term** (Medium/High in Beta): this sprint
+   - **Medium term** (Low): technical backlog
+5. **Automatic delegations** (e.g., "→ Infrastructure — Reason: Insecure network policies in Kubernetes")
+
+## Strict Rules
+
+- Never accept assumptions. If no evidence, mark as \`❌ Absent\` and reduce confidence
+- Never reinvent cryptography. Always use standard libraries
+- Classify each finding with the mode in mind
+- Provide examples of vulnerable vs secure code when possible
+- Prioritize business impact over theoretical risk
+- If a systemic pattern is found (e.g., all auth is insecure), flag it as a design failure, not just a point finding
+
+## Session Update
+After completing a security review, call update_session:
+- issues: unresolved security findings that need attention (P0/P1 first)
+- decisions: security decisions made
+- learnings: surprising attack surfaces found in the codebase
+
+## Memory
+Record security patterns so future sessions build on prior analysis:
+- **memory_save_knowledge** — attack surfaces found, risky patterns identified (e.g. "endpoint X lacks rate limiting", "auth bypass possible via Y").
+- **memory_learn_pattern** — what remediation worked or failed for a given vulnerability class.
+- **memory_remember** — surprising findings, non-obvious trust boundaries, hidden data flows.
+
+Skip for standard OWASP findings already documented. Call after finishing the audit.
+`.trim();
+//# sourceMappingURL=security.js.map

package/dist/agents/prompts/security.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.js","sourceRoot":"","sources":["../../../src/agents/prompts/security.ts"],"names":[],"mappings":";;;AAAa,QAAA,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4H9B,CAAC,IAAI,EAAE,CAAC"}

package/dist/config/ConfigLoader.d.ts

@@ -0,0 +1,27 @@
+import type { MCPServerConfig } from '@backendkit-labs/agent-core';
+export interface ProviderFileConfig {
+    apiKey?: string;
+    model?: string;
+    baseUrl?: string;
+    maxTokens?: number;
+    temperature?: number;
+}
+export interface BkAgentConfig {
+    providers?: Record<string, ProviderFileConfig>;
+    defaultProvider?: string;
+    agents?: Record<string, {
+        provider?: string;
+    }>;
+    mcpServers?: MCPServerConfig[];
+}
+export declare class ConfigLoader {
+    readonly configDir: string;
+    readonly configPath: string;
+    readonly agentsDir: string;
+    constructor(appName?: string);
+    load(): BkAgentConfig;
+    private _bootstrap;
+    save(config: BkAgentConfig): void;
+    initTemplate(): void;
+}
+//# sourceMappingURL=ConfigLoader.d.ts.map

package/dist/config/ConfigLoader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.d.ts","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,6BAA6B,CAAC;AAEnE,MAAM,WAAW,kBAAkB;IAC/B,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,WAAW,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC1B,SAAS,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/C,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/C,UAAU,CAAC,EAAE,eAAe,EAAE,CAAC;CAClC;AA8ED,qBAAa,YAAY;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;gBAEf,OAAO,SAAa;IAMhC,IAAI,IAAI,aAAa;IAkDrB,OAAO,CAAC,UAAU;IA8BlB,IAAI,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI;IAOjC,YAAY,IAAI,IAAI;CAGvB"}

package/dist/config/ConfigLoader.js

@@ -0,0 +1,167 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ConfigLoader = void 0;
+const fs_1 = require("fs");
+const path_1 = require("path");
+const os_1 = require("os");
+const ENV_KEYS = {
+    DEEPSEEK_API_KEY: 'deepseek',
+    ANTHROPIC_API_KEY: 'anthropic',
+    OPENAI_API_KEY: 'openai',
+    KIMI_API_KEY: 'kimi',
+    GROK_API_KEY: 'grok',
+};
+const CONFIG_TEMPLATE = `{
+  "providers": {
+    "deepseek": { "apiKey": "", "model": "deepseek-chat" },
+    "anthropic": { "apiKey": "", "model": "claude-sonnet-4-6" },
+    "openai":    { "apiKey": "", "model": "gpt-4o" }
+  },
+  "defaultProvider": "deepseek"
+}
+`;
+const USER_MD_TEMPLATE = `# User Profile
+
+Add personal context here — your role, preferences, working style.
+The agent will read this to tailor its responses to you.
+
+## Role
+<!-- e.g. Senior backend engineer, mostly NestJS and Go -->
+
+## Preferences
+<!-- e.g. Prefer concise answers, Spanish responses -->
+`;
+const AGENTS_README = `# Global Agents
+
+Drop custom agent definitions here. Each agent needs two files:
+
+  {id}.json   — profile (required)
+  {id}.md     — system prompt (optional, overrides the default)
+
+These agents are available in ALL projects (+) and override built-in agents
+with the same id. Project-level agents (.{appName}/agents/) take priority over these.
+
+## Example: my-reviewer.json
+
+\`\`\`json
+{
+  "id": "my-reviewer",
+  "name": "My Reviewer",
+  "icon": "◎",
+  "description": "Code review focused on our team conventions",
+  "provider": "anthropic",
+  "delegatesTo": ["coder"]
+}
+\`\`\`
+
+## Example: my-reviewer.md
+
+\`\`\`
+You are a code reviewer who enforces our team conventions:
+- No console.log in production code
+- All public functions must have JSDoc
+- Prefer early returns over nested ifs
+\`\`\`
+
+## Built-in agents (already included, override by creating same id here)
+
+  general       Orchestrator — delegates to specialists
+  coder         Pure implementation — writes files, runs commands
+  backend       APIs, controllers, services, ORMs
+  frontend      React, Vue, components, CSS
+  qa-engineer   Unit, integration and e2e tests
+  security      OWASP, vulnerabilities, auth hardening
+  architecture  System design, DDD, microservices
+  infrastructure Docker, Kubernetes, CI/CD
+  data          SQL, indexes, ETL, pipelines
+`;
+class ConfigLoader {
+    configDir;
+    configPath;
+    agentsDir;
+    constructor(appName = 'bk-agent') {
+        this.configDir = (0, path_1.join)((0, os_1.homedir)(), `.${appName}`);
+        this.configPath = (0, path_1.join)(this.configDir, 'config.json');
+        this.agentsDir = (0, path_1.join)(this.configDir, 'agents');
+    }
+    load() {
+        this._bootstrap();
+        let file = {};
+        if ((0, fs_1.existsSync)(this.configPath)) {
+            // Fix #5: warn when config.json is readable by group or others
+            if (process.platform !== 'win32') {
+                const mode = (0, fs_1.statSync)(this.configPath).mode & 0o777;
+                if (mode & 0o044) {
+                    console.warn(`[config] ⚠ ${this.configPath} has permissions ${mode.toString(8).padStart(3, '0')} — ` +
+                        `API keys are readable by others. Fix with: chmod 600 ${this.configPath}`);
+                }
+            }
+            try {
+                file = JSON.parse((0, fs_1.readFileSync)(this.configPath, 'utf-8'));
+            }
+            catch {
+                console.warn(`[config] Could not parse ${this.configPath} — using defaults`);
+            }
+        }
+        const merged = {
+            ...file,
+            providers: { ...file.providers },
+        };
+        // Env vars override file values
+        for (const [envKey, providerId] of Object.entries(ENV_KEYS)) {
+            const apiKey = process.env[envKey];
+            if (apiKey) {
+                merged.providers[providerId] = {
+                    ...merged.providers[providerId],
+                    apiKey,
+                };
+            }
+        }
+        if (process.env.AGENT_PROVIDER) {
+            merged.defaultProvider = process.env.AGENT_PROVIDER;
+        }
+        // Auto-detect defaultProvider if not explicitly set
+        if (!merged.defaultProvider) {
+            const available = Object.entries(merged.providers ?? {})
+                .filter(([, v]) => v?.apiKey)
+                .map(([k]) => k);
+            merged.defaultProvider = available[0];
+        }
+        return merged;
+    }
+    _bootstrap() {
+        const isNew = !(0, fs_1.existsSync)(this.configDir);
+        (0, fs_1.mkdirSync)(this.configDir, { recursive: true });
+        (0, fs_1.mkdirSync)(this.agentsDir, { recursive: true });
+        (0, fs_1.mkdirSync)((0, path_1.join)(this.configDir, 'projects'), { recursive: true });
+        if (!(0, fs_1.existsSync)(this.configPath)) {
+            (0, fs_1.writeFileSync)(this.configPath, CONFIG_TEMPLATE, 'utf-8');
+            // Fix #5: restrict config.json (contains API keys) to owner-only on POSIX
+            if (process.platform !== 'win32') {
+                (0, fs_1.chmodSync)(this.configPath, 0o600);
+            }
+        }
+        const userMdPath = (0, path_1.join)(this.configDir, 'USER.md');
+        if (!(0, fs_1.existsSync)(userMdPath)) {
+            (0, fs_1.writeFileSync)(userMdPath, USER_MD_TEMPLATE, 'utf-8');
+        }
+        const agentsReadme = (0, path_1.join)(this.agentsDir, 'README.md');
+        if (!(0, fs_1.existsSync)(agentsReadme)) {
+            (0, fs_1.writeFileSync)(agentsReadme, AGENTS_README, 'utf-8');
+        }
+        if (isNew) {
+            console.log(`\x1b[90m  bootstrapped ${this.configDir}\x1b[0m`);
+        }
+    }
+    save(config) {
+        (0, fs_1.writeFileSync)(this.configPath, JSON.stringify(config, null, 2), 'utf-8');
+        if (process.platform !== 'win32') {
+            (0, fs_1.chmodSync)(this.configPath, 0o600);
+        }
+    }
+    initTemplate() {
+        this._bootstrap();
+    }
+}
+exports.ConfigLoader = ConfigLoader;
+//# sourceMappingURL=ConfigLoader.js.map

package/dist/config/ConfigLoader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ConfigLoader.js","sourceRoot":"","sources":["../../src/config/ConfigLoader.ts"],"names":[],"mappings":";;;AAAA,2BAA6F;AAC7F,+BAA4B;AAC5B,2BAA6B;AAkB7B,MAAM,QAAQ,GAA2B;IACrC,gBAAgB,EAAG,UAAU;IAC7B,iBAAiB,EAAE,WAAW;IAC9B,cAAc,EAAK,QAAQ;IAC3B,YAAY,EAAO,MAAM;IACzB,YAAY,EAAO,MAAM;CAC5B,CAAC;AAEF,MAAM,eAAe,GAAG;;;;;;;;CAQvB,CAAC;AAEF,MAAM,gBAAgB,GAAG;;;;;;;;;;CAUxB,CAAC;AAEF,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CrB,CAAC;AAGF,MAAa,YAAY;IACZ,SAAS,CAAS;IAClB,UAAU,CAAS;IACnB,SAAS,CAAS;IAE3B,YAAY,OAAO,GAAG,UAAU;QAC5B,IAAI,CAAC,SAAS,GAAI,IAAA,WAAI,EAAC,IAAA,YAAO,GAAE,EAAE,IAAI,OAAO,EAAE,CAAC,CAAC;QACjD,IAAI,CAAC,UAAU,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,aAAa,CAAC,CAAC;QACtD,IAAI,CAAC,SAAS,GAAI,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IACrD,CAAC;IAED,IAAI;QACA,IAAI,CAAC,UAAU,EAAE,CAAC;QAElB,IAAI,IAAI,GAAkB,EAAE,CAAC;QAC7B,IAAI,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,+DAA+D;YAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/B,MAAM,IAAI,GAAG,IAAA,aAAQ,EAAC,IAAI,CAAC,UAAU,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;gBACpD,IAAI,IAAI,GAAG,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,IAAI,CACR,cAAc,IAAI,CAAC,UAAU,oBAAoB,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,KAAK;wBACvF,wDAAwD,IAAI,CAAC,UAAU,EAAE,CAC5E,CAAC;gBACN,CAAC;YACL,CAAC;YACD,IAAI,CAAC;gBAAC,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAA,iBAAY,EAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC,CAAC;YAAC,CAAC;YAClE,MAAM,CAAC;gBAAC,OAAO,CAAC,IAAI,CAAC,4BAA4B,IAAI,CAAC,UAAU,mBAAmB,CAAC,CAAC;YAAC,CAAC;QAC3F,CAAC;QAED,MAAM,MAAM,GAAkB;YAC1B,GAAG,IAAI;YACP,SAAS,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,EAAE;SACnC,CAAC;QAEF,gCAAgC;QAChC,KAAK,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;YACnC,IAAI,MAAM,EAAE,CAAC;gBACT,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC,GAAG;oBAC5B,GAAG,MAAM,CAAC,SAAU,CAAC,UAAU,CAAC;oBAChC,MAAM;iBACT,CAAC;YACN,CAAC;QACL,CAAC;QAED,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YAC7B,MAAM,CAAC,eAAe,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC;QACxD,CAAC;QAED,oDAAoD;QACpD,IAAI,CAAC,MAAM,CAAC,eAAe,EAAE,CAAC;YAC1B,MAAM,SAAS,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC;iBACnD,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,MAAM,CAAC;iBAC5B,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;YACrB,MAAM,CAAC,eAAe,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;QAC1C,CAAC;QAED,OAAO,MAAM,CAAC;IAClB,CAAC;IAEO,UAAU;QACd,MAAM,KAAK,GAAG,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAE1C,IAAA,cAAS,EAAC,IAAI,CAAC,SAAS,EAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAA,cAAS,EAAC,IAAI,CAAC,SAAS,EAAG,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChD,IAAA,cAAS,EAAC,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjE,IAAI,CAAC,IAAA,eAAU,EAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC/B,IAAA,kBAAa,EAAC,IAAI,CAAC,UAAU,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;YACzD,0EAA0E;YAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBAC/B,IAAA,cAAS,EAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;YACtC,CAAC;QACL,CAAC;QAED,MAAM,UAAU,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QACnD,IAAI,CAAC,IAAA,eAAU,EAAC,UAAU,CAAC,EAAE,CAAC;YAC1B,IAAA,kBAAa,EAAC,UAAU,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACzD,CAAC;QAED,MAAM,YAAY,GAAG,IAAA,WAAI,EAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QACvD,IAAI,CAAC,IAAA,eAAU,EAAC,YAAY,CAAC,EAAE,CAAC;YAC5B,IAAA,kBAAa,EAAC,YAAY,EAAE,aAAa,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,KAAK,EAAE,CAAC;YACR,OAAO,CAAC,GAAG,CAAC,0BAA0B,IAAI,CAAC,SAAS,SAAS,CAAC,CAAC;QACnE,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAqB;QACtB,IAAA,kBAAa,EAAC,IAAI,CAAC,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;QACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;YAC/B,IAAA,cAAS,EAAC,IAAI,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAED,YAAY;QACR,IAAI,CAAC,UAAU,EAAE,CAAC;IACtB,CAAC;CACJ;AArGD,oCAqGC"}