@bonyadnouri/autoend 0.1.0 → 0.1.2

package/dist/run/sensitive-env.d.ts

@@ -0,0 +1,24 @@
+/**
+ * Guardrail for the verify-by-running trust boundary (ADR-0002, issue #3).
+ *
+ * Discovered and replayed Flow scripts are LLM-authored and run in-process via
+ * dynamic import(), so they inherit the Run's full Node authority — including
+ * whatever secrets `.env` loaded into `process.env` (notably CURSOR_API_KEY).
+ * A flow script never needs those secrets: it only drives a Playwright `page`.
+ *
+ * `withoutSensitiveEnv` removes secret-looking variables from `process.env`
+ * for the duration of a callback and restores them afterward, so a malicious or
+ * buggy generated script can't read them. It is a defense-in-depth mitigation,
+ * not a sandbox — full isolation (running scripts in a locked-down child
+ * process) is tracked separately.
+ *
+ * IMPORTANT: `process.env` is process-global, so wrap a whole batch of script
+ * executions in one call rather than each script — never run agent creation
+ * (which needs the key) concurrently inside the callback.
+ */
+export declare function isSensitiveEnvName(name: string): boolean;
+/**
+ * Run `fn` with secret-looking `process.env` entries temporarily removed,
+ * restoring the exact prior environment in a `finally` (even on throw).
+ */
+export declare function withoutSensitiveEnv<T>(fn: () => Promise<T>): Promise<T>;

package/dist/run/sensitive-env.js

@@ -0,0 +1,45 @@
+/**
+ * Guardrail for the verify-by-running trust boundary (ADR-0002, issue #3).
+ *
+ * Discovered and replayed Flow scripts are LLM-authored and run in-process via
+ * dynamic import(), so they inherit the Run's full Node authority — including
+ * whatever secrets `.env` loaded into `process.env` (notably CURSOR_API_KEY).
+ * A flow script never needs those secrets: it only drives a Playwright `page`.
+ *
+ * `withoutSensitiveEnv` removes secret-looking variables from `process.env`
+ * for the duration of a callback and restores them afterward, so a malicious or
+ * buggy generated script can't read them. It is a defense-in-depth mitigation,
+ * not a sandbox — full isolation (running scripts in a locked-down child
+ * process) is tracked separately.
+ *
+ * IMPORTANT: `process.env` is process-global, so wrap a whole batch of script
+ * executions in one call rather than each script — never run agent creation
+ * (which needs the key) concurrently inside the callback.
+ */
+/** A variable is treated as a secret when its name matches this pattern. */
+const SENSITIVE_ENV_PATTERN = /(KEY|TOKEN|SECRET|PASSWORD|PASSWD|CREDENTIAL|AUTH|PRIVATE)/i;
+export function isSensitiveEnvName(name) {
+    return SENSITIVE_ENV_PATTERN.test(name);
+}
+/**
+ * Run `fn` with secret-looking `process.env` entries temporarily removed,
+ * restoring the exact prior environment in a `finally` (even on throw).
+ */
+export async function withoutSensitiveEnv(fn) {
+    const removed = {};
+    for (const [name, value] of Object.entries(process.env)) {
+        if (value !== undefined && isSensitiveEnvName(name)) {
+            removed[name] = value;
+            delete process.env[name];
+        }
+    }
+    try {
+        return await fn();
+    }
+    finally {
+        for (const [name, value] of Object.entries(removed)) {
+            process.env[name] = value;
+        }
+    }
+}
+//# sourceMappingURL=sensitive-env.js.map

package/dist/run/sensitive-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sensitive-env.js","sourceRoot":"","sources":["../../src/run/sensitive-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,4EAA4E;AAC5E,MAAM,qBAAqB,GAAG,6DAA6D,CAAC;AAE5F,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,OAAO,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1C,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAI,EAAoB;IAC/D,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,IAAI,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YACtB,OAAO,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,OAAO,MAAM,EAAE,EAAE,CAAC;IACpB,CAAC;YAAS,CAAC;QACT,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YACpD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/setup/wizard.js

@@ -2,6 +2,8 @@ import * as p from '@clack/prompts';
 import pc from 'picocolors';
 import { appendDotEnv, ensureGitignore, loadDotEnv, saveConfig } from '../config.js';
 import { EFFORT_BUDGETS } from '../run/effort.js';
+/** How users must invoke us via npx — bare "autoend" is npm-blocked (see README). */
+const PACKAGE = '@bonyadnouri/autoend';
 const EFFORT_CHOICES = [
     { value: 'low', label: 'low', hint: 'quick pass · ~1-2 min' },
     { value: 'mid', label: 'mid', hint: 'everyday runs · ~2-3 min' },
@@ -63,9 +65,9 @@ export async function runSetupWizard(repoRoot) {
         : 'Config written');
     const budget = EFFORT_BUDGETS[effort];
     p.note([
-        `${pc.cyan('npx autoend')}            run with your defaults`,
-        `${pc.cyan('npx autoend <url>')}      run against another target`,
-        `${pc.cyan('npx autoend -e high')}    push harder for one run`,
+        `${pc.cyan(`npx ${PACKAGE}`)}            run with your defaults`,
+        `${pc.cyan(`npx ${PACKAGE} <url>`)}      run against another target`,
+        `${pc.cyan(`npx ${PACKAGE} -e high`)}    push harder for one run`,
         '',
         pc.dim(`Defaults: ${target} · effort ${effort} (${budget.explorers} explorers, ${budget.seconds}s exploration)`),
         pc.dim(`Commit ${pc.reset(pc.dim('.autoend/flows/'))} — it is your team's shared baseline.`),

package/dist/setup/wizard.js.map

@@ -1 +1 @@
-{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../src/setup/wizard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAE/D,MAAM,cAAc,GAA0D;IAC5E,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC7D,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAChE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACjE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACvE,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;IAE7F,CAAC,CAAC,IAAI,CACJ;QACE,0DAA0D;QAC1D,EAAE;QACF,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD;QAChE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD;QACtE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,cAAc,CACf,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,uBAAuB;QACpC,YAAY,EAAE,uBAAuB;QACrC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,8CAA8C,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAS;QACpC,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,CAAC;IAEb,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;YAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE;YAC1E,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,CAAC;SACpH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAG,GAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAgB,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,0CAA0C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC9D,CAAC,CAAC,gBAAgB,CACrB,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAgB,CAAC,CAAC;IAChD,CAAC,CAAC,IAAI,CACJ;QACE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,oCAAoC;QAC7D,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,kCAAkC;QACjE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,6BAA6B;QAC9D,EAAE;QACF,EAAE,CAAC,GAAG,CAAC,aAAa,MAAgB,aAAa,MAAgB,KAAK,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,OAAO,gBAAgB,CAAC;QACpI,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,uCAAuC,CAAC;KAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,aAAa,CACd,CAAC;IACF,CAAC,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}
+{"version":3,"file":"wizard.js","sourceRoot":"","sources":["../../src/setup/wizard.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,gBAAgB,CAAC;AACpC,OAAO,EAAE,MAAM,YAAY,CAAC;AAC5B,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AACrF,OAAO,EAAE,cAAc,EAAe,MAAM,kBAAkB,CAAC;AAE/D,qFAAqF;AACrF,MAAM,OAAO,GAAG,sBAAsB,CAAC;AAEvC,MAAM,cAAc,GAA0D;IAC5E,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,uBAAuB,EAAE;IAC7D,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,0BAA0B,EAAE;IAChE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,yBAAyB,EAAE;IACjE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE;IACtE,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,4BAA4B,EAAE;CACvE,CAAC;AAEF,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,OAAO,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;IAE7F,CAAC,CAAC,IAAI,CACJ;QACE,0DAA0D;QAC1D,EAAE;QACF,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,iDAAiD;QAChE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,uDAAuD;QACtE,GAAG,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,wDAAwD;KACxE,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,cAAc,CACf,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC;QAC1B,OAAO,EAAE,0BAA0B;QACnC,WAAW,EAAE,uBAAuB;QACpC,YAAY,EAAE,uBAAuB;QACrC,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE;YAClB,IAAI,CAAC;gBACH,IAAI,GAAG,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;gBACrB,OAAO,SAAS,CAAC;YACnB,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,8CAA8C,CAAC;YACxD,CAAC;QACH,CAAC;KACF,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,CAAC;IAEb,MAAM,MAAM,GAAG,MAAM,CAAC,CAAC,MAAM,CAAS;QACpC,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,cAAc;QACvB,YAAY,EAAE,KAAK;KACpB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,CAAC;IAEb,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAC;IAC3B,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;QAC/B,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,mDAAmD,CAAC,CAAC;IACrE,CAAC;SAAM,CAAC;QACN,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,QAAQ,CAAC;YAC3B,OAAO,EAAE,kBAAkB,EAAE,CAAC,GAAG,CAAC,qCAAqC,CAAC,EAAE;YAC1E,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,8CAA8C,CAAC;SACpH,CAAC,CAAC;QACH,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,MAAM,YAAY,CAAC,QAAQ,EAAE,gBAAgB,EAAG,GAAc,CAAC,IAAI,EAAE,CAAC,CAAC;QACvE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IACjC,CAAC;IAED,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;IAC5B,OAAO,CAAC,KAAK,CAAC,uBAAuB,CAAC,CAAC;IACvC,MAAM,UAAU,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,MAAgB,EAAE,MAAM,EAAE,MAAgB,EAAE,CAAC,CAAC;IACnF,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,QAAQ,EAAE,CAAC,gBAAgB,EAAE,MAAM,CAAC,CAAC,CAAC;IAC1E,OAAO,CAAC,IAAI,CACV,KAAK,CAAC,MAAM,GAAG,CAAC;QACd,CAAC,CAAC,0CAA0C,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;QAC9D,CAAC,CAAC,gBAAgB,CACrB,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,MAAgB,CAAC,CAAC;IAChD,CAAC,CAAC,IAAI,CACJ;QACE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,EAAE,CAAC,oCAAoC;QAChE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,QAAQ,CAAC,kCAAkC;QACpE,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,OAAO,UAAU,CAAC,6BAA6B;QACjE,EAAE;QACF,EAAE,CAAC,GAAG,CAAC,aAAa,MAAgB,aAAa,MAAgB,KAAK,MAAM,CAAC,SAAS,eAAe,MAAM,CAAC,OAAO,gBAAgB,CAAC;QACpI,EAAE,CAAC,GAAG,CAAC,UAAU,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,uCAAuC,CAAC;KAC7F,CAAC,IAAI,CAAC,IAAI,CAAC,EACZ,aAAa,CACd,CAAC;IACF,CAAC,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,IAAI,CAAC,KAAc;IAC1B,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;QACtB,CAAC,CAAC,MAAM,CAAC,sCAAsC,CAAC,CAAC;QACjD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;AACH,CAAC"}