@burtson-labs/bandit-stealth-cli 1.7.333 → 1.7.334

package/dist/cli.js

@@ -1317,7 +1317,7 @@ ${w}
 ${w}
 `}return await l$e.promises.writeFile(u,P,"utf-8"),u}t(l5n,"appendMemory")});var Cwt=Lt(Z7=>{"use strict";var u5n=Z7&&Z7.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),f5n=Z7&&Z7.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),Swt=Z7&&Z7.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&u5n(s,i,u[l]);return f5n(s,i),s}})();Object.defineProperty(Z7,"__esModule",{value:!0});Z7.buildReadMemoryTool=p5n;var d5n=Swt(fo("fs")),bwt=Swt(fo("path")),ooe=J1e();function p5n(){return{name:"read_memory",description:'Read a single topic memory file by slug. Use this when MEMORY.md (shown in the system prompt) lists a topic whose hook matches the current task. The slug is the part after "memory/" in [Title](memory/<slug>.md) \u2014 without the .md suffix. Returns the full file content (capped at 32 KB).',parameters:[{name:"name",description:'Memory file slug (no `memory/` prefix, no `.md` suffix). Example: "auth-conventions" loads memory/auth-conventions.md.',required:!0}],async execute(r,i){let s=(r.name??"").trim();if(!s)return{output:"Error: name parameter is required.",isError:!0};if(s.includes("/")||s.includes("\\")||s.includes("..")||bwt.isAbsolute(s))return{output:`Error: name must be a plain slug like "auth-conventions", not a path. Got: "${s}"`,isError:!0};let u=s.replace(/\.md$/i,""),l=await(0,ooe.loadMemoryIndex)(i.workspaceRoot),m=l.entries.find(A=>A.name===u);if(!m){let A=l.entries.map(w=>w.name);return A.length===0?{output:`No memory index found. MEMORY.md is missing or has no entries at ${bwt.resolve(i.workspaceRoot,"MEMORY.md")}.`,isError:!0}:{output:`Memory slug "${u}" not found. Available: ${A.join(", ")}`,isError:!0}}try{let A=await d5n.promises.readFile(m.absPath),w=A.byteLength>ooe.MAX_MEMORY_FILE_BYTES,P=A.subarray(0,ooe.MAX_MEMORY_FILE_BYTES).toString("utf-8"),F=w?`${P}
 \u2026 (truncated \u2014 file exceeds ${ooe.MAX_MEMORY_FILE_BYTES} bytes)`:P;return{output:`<!-- source: ${m.relPath} -->
-${F}`,isError:!1}}catch(A){let w=A instanceof Error?A.message:String(A);return{output:`Could not read ${ooe.MEMORY_DIR}/${u}.md: ${w}`,isError:!0}}}}}t(p5n,"buildReadMemoryTool")});var wwt=Lt(nI=>{"use strict";var _5n=nI&&nI.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),m5n=nI&&nI.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),f$e=nI&&nI.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&_5n(s,i,u[l]);return m5n(s,i),s}})();Object.defineProperty(nI,"__esModule",{value:!0});nI.loadMcpServersConfig=Twt;nI.registerMcpServersFromDisk=y5n;nI.globalMcpServersPath=v5n;nI.addMcpServerToConfig=A5n;nI.persistMcpActivation=b5n;var N4=f$e(fo("fs")),Ewt=f$e(fo("os")),BJ=f$e(fo("path")),soe=BJ.join(Ewt.homedir(),".bandit","mcp-servers.json"),g5n=BJ.join(Ewt.homedir(),".bandit","config.json");async function h5n(){try{let r=await N4.promises.readFile(g5n,"utf-8"),s=JSON.parse(r).bandit?.apiKey?.trim();return s&&s.length>0?s:null}catch{return null}}t(h5n,"resolveBanditApiKey");async function Twt(r){let i={},s=[soe,BJ.resolve(r,".bandit","mcp-servers.json")];for(let l of s)try{let m=await N4.promises.readFile(l,"utf-8"),A=JSON.parse(m);if(A&&typeof A=="object"&&A.mcpServers)for(let[w,P]of Object.entries(A.mcpServers))P&&typeof P.command=="string"&&(i[w]=P)}catch{}let u=await h5n();if(u)for(let l of Object.values(i)){let m=l.env??{};m.BANDIT_API_KEY||(l.env={...m,BANDIT_API_KEY:u})}return i}t(Twt,"loadMcpServersConfig");async function y5n(r,i){let s=await Twt(r),u=0;for(let[l,m]of Object.entries(s))i.register(l,m),u++;return u}t(y5n,"registerMcpServersFromDisk");function v5n(){return soe}t(v5n,"globalMcpServersPath");async function A5n(r,i,s){let u=BJ.resolve(r,".bandit","mcp-servers.json"),l=u,m=!1;try{await N4.promises.access(u),m=!0}catch{m=!1}if(!m)try{await N4.promises.access(soe),l=soe}catch{l=u}let A;try{let P=await N4.promises.readFile(l,"utf-8"),F=JSON.parse(P);A={mcpServers:F.mcpServers&&typeof F.mcpServers=="object"?{...F.mcpServers}:{}}}catch{A={mcpServers:{}}}A.mcpServers[i]=s;let w=BJ.dirname(l);try{await N4.promises.mkdir(w,{recursive:!0})}catch{}return await N4.promises.writeFile(l,JSON.stringify(A,null,2)+`
+${F}`,isError:!1}}catch(A){let w=A instanceof Error?A.message:String(A);return{output:`Could not read ${ooe.MEMORY_DIR}/${u}.md: ${w}`,isError:!0}}}}}t(p5n,"buildReadMemoryTool")});var wwt=Lt(nI=>{"use strict";var _5n=nI&&nI.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),m5n=nI&&nI.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),f$e=nI&&nI.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&_5n(s,i,u[l]);return m5n(s,i),s}})();Object.defineProperty(nI,"__esModule",{value:!0});nI.loadMcpServersConfig=Twt;nI.registerMcpServersFromDisk=y5n;nI.globalMcpServersPath=v5n;nI.addMcpServerToConfig=A5n;nI.persistMcpActivation=b5n;var N4=f$e(fo("fs")),Ewt=f$e(fo("os")),BJ=f$e(fo("path")),soe=BJ.join(Ewt.homedir(),".bandit","mcp-servers.json"),g5n=BJ.join(Ewt.homedir(),".bandit","config.json");async function h5n(){try{let r=await N4.promises.readFile(g5n,"utf-8"),s=JSON.parse(r).bandit?.apiKey?.trim();return s&&s.length>0?s:null}catch{return null}}t(h5n,"resolveBanditApiKey");async function Twt(r){let i={},s=[soe,BJ.resolve(r,".bandit","mcp-servers.json")];for(let l of s)try{let m=await N4.promises.readFile(l,"utf-8"),A=JSON.parse(m);if(A&&typeof A=="object"&&A.mcpServers)for(let[w,P]of Object.entries(A.mcpServers)){if(!P||typeof P!="object")continue;let F=typeof P.command=="string",$=typeof P.url=="string";(F||$)&&(i[w]=P)}}catch{}let u=await h5n();if(u)for(let l of Object.values(i)){if(typeof l.url=="string")continue;let m=l.env??{};m.BANDIT_API_KEY||(l.env={...m,BANDIT_API_KEY:u})}return i}t(Twt,"loadMcpServersConfig");async function y5n(r,i){let s=await Twt(r),u=0;for(let[l,m]of Object.entries(s))i.register(l,m),u++;return u}t(y5n,"registerMcpServersFromDisk");function v5n(){return soe}t(v5n,"globalMcpServersPath");async function A5n(r,i,s){let u=BJ.resolve(r,".bandit","mcp-servers.json"),l=u,m=!1;try{await N4.promises.access(u),m=!0}catch{m=!1}if(!m)try{await N4.promises.access(soe),l=soe}catch{l=u}let A;try{let P=await N4.promises.readFile(l,"utf-8"),F=JSON.parse(P);A={mcpServers:F.mcpServers&&typeof F.mcpServers=="object"?{...F.mcpServers}:{}}}catch{A={mcpServers:{}}}A.mcpServers[i]=s;let w=BJ.dirname(l);try{await N4.promises.mkdir(w,{recursive:!0})}catch{}return await N4.promises.writeFile(l,JSON.stringify(A,null,2)+`
 `,"utf-8"),l}t(A5n,"addMcpServerToConfig");async function b5n(r,i,s){let u=BJ.resolve(r,".bandit","mcp-servers.json"),l=u;try{await N4.promises.access(u)}catch{l=soe}let m;try{let P=await N4.promises.readFile(l,"utf-8"),F=JSON.parse(P);m={mcpServers:F.mcpServers&&typeof F.mcpServers=="object"?{...F.mcpServers}:{}}}catch{m={mcpServers:{}}}let A=m.mcpServers[i];if(!A)throw new Error(`MCP server "${i}" not found in ${l}`);m.mcpServers[i]={...A,activation:s};let w=BJ.dirname(l);try{await N4.promises.mkdir(w,{recursive:!0})}catch{}return await N4.promises.writeFile(l,JSON.stringify(m,null,2)+`
 `,"utf-8"),l}t(b5n,"persistMcpActivation")});var xwt=Lt(qP=>{"use strict";Object.defineProperty(qP,"__esModule",{value:!0});qP.buildGitHubServerConfig=S5n;qP.looksLikeGitHubToken=C5n;qP.buildSlackServerConfig=E5n;qP.looksLikeSlackToken=T5n;qP.looksLikeSlackTeamId=w5n;qP.buildGitLabServerConfig=x5n;qP.looksLikeGitLabToken=k5n;qP.buildGmailServerConfig=I5n;qP.looksLikeGmailCredentialsPath=D5n;qP.buildCustomServerConfig=P5n;function S5n(r){let i=r.trim();if(!i)throw new Error("GitHub PAT is required");return{command:"npx",args:["-y","@modelcontextprotocol/server-github"],env:{GITHUB_PERSONAL_ACCESS_TOKEN:i},activation:"on-mention"}}t(S5n,"buildGitHubServerConfig");function C5n(r){let i=r.trim();return/^(ghp_|gho_|ghs_|ghu_|github_pat_)/.test(i)}t(C5n,"looksLikeGitHubToken");function E5n(r,i){let s=r.trim(),u=i.trim();if(!s)throw new Error("Slack bot token (xoxb-\u2026) is required");if(!u)throw new Error("Slack team ID (T\u2026) is required");return{command:"npx",args:["-y","@modelcontextprotocol/server-slack"],env:{SLACK_BOT_TOKEN:s,SLACK_TEAM_ID:u},activation:"on-mention"}}t(E5n,"buildSlackServerConfig");function T5n(r){return/^xox[bp]-/.test(r.trim())}t(T5n,"looksLikeSlackToken");function w5n(r){return/^T[A-Z0-9]+$/i.test(r.trim())}t(w5n,"looksLikeSlackTeamId");function x5n(r,i){let s=r.trim();if(!s)throw new Error("GitLab personal access token is required");let u={GITLAB_PERSONAL_ACCESS_TOKEN:s},l=(i??"").trim();return l&&(u.GITLAB_API_URL=l),{command:"npx",args:["-y","@modelcontextprotocol/server-gitlab"],env:u,activation:"on-mention"}}t(x5n,"buildGitLabServerConfig");function k5n(r){let i=r.trim();return i.startsWith("glpat-")?!0:i.length>=20&&/^[A-Za-z0-9_-]+$/.test(i)}t(k5n,"looksLikeGitLabToken");function I5n(r){let i=r.trim();if(!i)throw new Error("Path to Google OAuth credentials JSON is required");return{command:"npx",args:["-y","@gongrzhe/server-gmail-autoauth-mcp"],env:{GMAIL_OAUTH_PATH:i},activation:"on-mention"}}t(I5n,"buildGmailServerConfig");function D5n(r){let i=r.trim();return!i||!/\.json$/i.test(i)?!1:i.includes("/")||i.includes("\\")||i.startsWith("~")}t(D5n,"looksLikeGmailCredentialsPath");function P5n(r){let i=r.command.trim();if(!i)throw new Error("Command is required");let s={};if(r.envInput)for(let u of r.envInput.split(/\r?\n/)){let l=u.trim();if(!l||l.startsWith("#"))continue;let m=l.indexOf("=");if(m<=0)continue;let A=l.slice(0,m).trim(),P=l.slice(m+1).trim().replace(/^["']|["']$/g,"");s[A]=P}return{command:i,args:r.args&&r.args.length>0?r.args:void 0,env:Object.keys(s).length>0?s:void 0,activation:r.activation??"on-mention"}}t(P5n,"buildCustomServerConfig")});var Dwt=Lt(HP=>{"use strict";var N5n=HP&&HP.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),O5n=HP&&HP.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),p$e=HP&&HP.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&N5n(s,i,u[l]);return O5n(s,i),s}})();Object.defineProperty(HP,"__esModule",{value:!0});HP.loadApprovedMcpFingerprints=B5n;HP.approveMcpFingerprint=M5n;HP.revokeMcpFingerprint=F5n;HP.mcpTrustPath=L5n;var d$e=p$e(fo("fs")),R5n=p$e(fo("os")),kwt=p$e(fo("path")),H1e=kwt.join(R5n.homedir(),".bandit","mcp-trust.json");async function _$e(){try{let r=await d$e.promises.readFile(H1e,"utf-8"),i=JSON.parse(r);if(Array.isArray(i.approved))return{approved:i.approved.filter(s=>typeof s=="string")}}catch{}return{approved:[]}}t(_$e,"readTrustFile");async function Iwt(r){let i=kwt.dirname(H1e);try{await d$e.promises.mkdir(i,{recursive:!0})}catch{}await d$e.promises.writeFile(H1e,JSON.stringify(r,null,2),{encoding:"utf-8",mode:384})}t(Iwt,"writeTrustFile");async function B5n(){let r=await _$e();return new Set(r.approved)}t(B5n,"loadApprovedMcpFingerprints");async function M5n(r){let i=await _$e();i.approved.includes(r)||(i.approved.push(r),await Iwt(i))}t(M5n,"approveMcpFingerprint");async function F5n(r){let i=await _$e(),s=i.approved.filter(u=>u!==r);s.length!==i.approved.length&&await Iwt({approved:s})}t(F5n,"revokeMcpFingerprint");function L5n(){return H1e}t(L5n,"mcpTrustPath")});var Owt=Lt(GP=>{"use strict";var j5n=GP&&GP.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),$5n=GP&&GP.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),g$e=GP&&GP.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&j5n(s,i,u[l]);return $5n(s,i),s}})();Object.defineProperty(GP,"__esModule",{value:!0});GP.loadMcpToolCache=z5n;GP.saveMcpToolEntry=U5n;GP.pruneMcpToolCache=J5n;GP.mcpToolCachePath=q5n;var m$e=g$e(fo("fs")),Q5n=g$e(fo("os")),Pwt=g$e(fo("path"));function G1e(){return Pwt.join(Q5n.homedir(),".bandit","mcp-tool-cache.json")}t(G1e,"cacheFilePath");async function h$e(){try{let r=await m$e.promises.readFile(G1e(),"utf-8"),i=JSON.parse(r);if(i.version===1&&Array.isArray(i.entries))return{version:1,entries:i.entries.filter(s=>typeof s=="object"&&s!==null&&typeof s.fingerprint=="string"&&Array.isArray(s.tools))}}catch{}return{version:1,entries:[]}}t(h$e,"readCacheFile");async function Nwt(r){let i=Pwt.dirname(G1e());try{await m$e.promises.mkdir(i,{recursive:!0})}catch{}await m$e.promises.writeFile(G1e(),JSON.stringify(r,null,2),"utf-8")}t(Nwt,"writeCacheFile");async function z5n(){let r=await h$e(),i=new Map;for(let s of r.entries)i.set(s.fingerprint,s.tools);return i}t(z5n,"loadMcpToolCache");async function U5n(r,i,s){try{let l=(await h$e()).entries.filter(m=>m.fingerprint!==i);l.push({name:r,fingerprint:i,tools:s,updatedAt:new Date().toISOString()}),await Nwt({version:1,entries:l})}catch{}}t(U5n,"saveMcpToolEntry");async function J5n(r){try{let i=await h$e(),s=i.entries.filter(u=>r.has(u.fingerprint));if(s.length===i.entries.length)return;await Nwt({version:1,entries:s})}catch{}}t(J5n,"pruneMcpToolCache");function q5n(){return G1e()}t(q5n,"mcpToolCachePath")});var Bwt=Lt(O4=>{"use strict";var H5n=O4&&O4.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),G5n=O4&&O4.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),y$e=O4&&O4.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&H5n(s,i,u[l]);return G5n(s,i),s}})();Object.defineProperty(O4,"__esModule",{value:!0});O4.loadHookSettings=Z5n;O4.persistAllowEntry=K5n;O4.runHooks=Y5n;var V5n=y$e(fo("child_process")),V1e=y$e(fo("fs")),W1e=y$e(fo("path")),W5n=1e4;async function Z5n(r){let i=[W1e.resolve(r,".bandit/settings.json"),W1e.resolve(r,".bandit/settings.local.json")],s={hooks:{},permissions:{allow:[],deny:[],ask:[]}};for(let u of i)try{let l=await V1e.promises.readFile(u,"utf-8"),m=JSON.parse(l);if(m.hooks)for(let A of Object.keys(m.hooks))s.hooks[A]=[...s.hooks[A]??[],...m.hooks[A]??[]];m.permissions&&(s.permissions.allow=[...s.permissions.allow??[],...m.permissions.allow??[]],s.permissions.deny=[...s.permissions.deny??[],...m.permissions.deny??[]],s.permissions.ask=[...s.permissions.ask??[],...m.permissions.ask??[]])}catch{}return s}t(Z5n,"loadHookSettings");async function K5n(r,i){let s=W1e.resolve(r,".bandit"),u=W1e.resolve(s,"settings.json");await V1e.promises.mkdir(s,{recursive:!0});let l={};try{let m=await V1e.promises.readFile(u,"utf-8");l=JSON.parse(m)}catch{}l.permissions=l.permissions??{},l.permissions.allow=l.permissions.allow??[],l.permissions.allow.includes(i)||l.permissions.allow.push(i),await V1e.promises.writeFile(u,JSON.stringify(l,null,2)+`
 `,"utf-8")}t(K5n,"persistAllowEntry");async function Y5n(r,i,s,u){let l=i.hooks?.[r]??[];if(l.length===0)return[];let m=[];for(let A of l){if(A.match&&s.toolName&&!new RegExp(A.match).test(s.toolName))continue;let w=X5n(A.command,s);m.push(await eLn(w,u,A.timeout??W5n))}return m}t(Y5n,"runHooks");function X5n(r,i){return r.replace(/\{\{\s*name\s*\}\}/g,Rwt(i.toolName??"")).replace(/\{\{\s*primary\s*\}\}/g,Rwt(i.primary??"")).replace(/\{\{\s*duration\s*\}\}/g,String(i.durationMs??""))}t(X5n,"expand");function Rwt(r){return`'${r.replace(/'/g,"'\\''")}'`}t(Rwt,"shellEscape");function eLn(r,i,s){return new Promise(u=>{let l="",m="",A=V5n.spawn(r,{cwd:i,shell:!0,env:{...process.env}}),w=setTimeout(()=>{A.kill("SIGTERM")},s);A.stdout?.on("data",P=>{l+=P.toString()}),A.stderr?.on("data",P=>{m+=P.toString()}),A.on("close",P=>{clearTimeout(w),u({exitCode:P??0,stdout:l,stderr:m})}),A.on("error",P=>{clearTimeout(w),u({exitCode:1,stdout:"",stderr:P.message})})})}t(eLn,"runShell")});var jwt=Lt(K7=>{"use strict";var tLn=K7&&K7.__createBinding||(Object.create?(function(r,i,s,u){u===void 0&&(u=s);var l=Object.getOwnPropertyDescriptor(i,s);(!l||("get"in l?!i.__esModule:l.writable||l.configurable))&&(l={enumerable:!0,get:t(function(){return i[s]},"get")}),Object.defineProperty(r,u,l)}):(function(r,i,s,u){u===void 0&&(u=s),r[u]=i[s]})),nLn=K7&&K7.__setModuleDefault||(Object.create?(function(r,i){Object.defineProperty(r,"default",{enumerable:!0,value:i})}):function(r,i){r.default=i}),Lwt=K7&&K7.__importStar||(function(){var r=t(function(i){return r=Object.getOwnPropertyNames||function(s){var u=[];for(var l in s)Object.prototype.hasOwnProperty.call(s,l)&&(u[u.length]=l);return u},r(i)},"ownKeys");return function(i){if(i&&i.__esModule)return i;var s={};if(i!=null)for(var u=r(i),l=0;l<u.length;l++)u[l]!=="default"&&tLn(s,i,u[l]);return nLn(s,i),s}})();Object.defineProperty(K7,"__esModule",{value:!0});K7.expandMentions=cLn;var Mwt=Lwt(fo("fs")),v$e=Lwt(fo("path")),rLn=SZ(),iLn=/(?:^|\s)@([^\s@]+)/g;function aLn(r){return/^(1|true)$/i.test(process.env.BANDIT_NO_SECRET_REDACTION??"")||!r||r.length===0?r:(0,rLn.redactSecretsString)(r)}t(aLn,"applyMentionSecretRedaction");var Fwt=64*1024,oLn=8,sLn=/\.(?:png|jpe?g|gif|webp|heic|bmp)$/i;async function cLn(r,i){let s=[...r.matchAll(iLn)].slice(0,oLn);if(s.length===0)return{prompt:r,mentions:[],images:[]};let u=new Set,l=[],m=[],A=[];for(let P of s){let F=P[1];if(u.has(F))continue;u.add(F);let $=v$e.isAbsolute(F)?F:v$e.resolve(i,F);if(!$.startsWith(v$e.resolve(i))){m.push({path:F,bytes:0,ok:!1});continue}try{if(!(await Mwt.promises.stat($)).isFile()){m.push({path:F,bytes:0,ok:!1});continue}let Q=await Mwt.promises.readFile($);if(sLn.test(F)){A.push(Q.toString("base64")),l.push(`[Image attached: ${F} \u2014 ${Q.byteLength} bytes]`),m.push({path:F,bytes:Q.byteLength,ok:!0,kind:"image"});continue}let ce=Q.byteLength>Fwt,se=Q.subarray(0,Fwt).toString("utf-8"),ge=aLn(se),$e=ce?`
@@ -1777,7 +1777,7 @@ ${(()=>{let H=`Bandit insights \u2014 ${new Date(i).toISOString().slice(0,10)}`,
     <h1>You're signed in.</h1>
     <p>Bandit picked up your session. You can close this tab and return to your terminal.</p>
   </div>
-</body></html>`;t(Xjn,"startLoopbackListener");t(e9n,"openBrowser");t(t9n,"buildDefaultDeviceLabel");t(n9n,"runOAuthSignIn")});var rbe=Lt((zlr,r9n)=>{r9n.exports={name:"@burtson-labs/bandit-stealth-cli",version:"1.7.333",description:"Bandit \u2014 a local-first AI coding agent for your terminal. Same runtime as the Bandit Stealth VS Code / Cursor extension.",keywords:["ai","agent","cli","coding-agent","llm","ollama","local-first","bandit","burtson-labs","terminal","repl","developer-tools"],homepage:"https://burtson.ai",bugs:{url:"https://github.com/Burtson-Labs/bandit-agent-framework/issues",email:"team@burtson.ai"},license:"Apache-2.0",author:{name:"Burtson Labs",email:"team@burtson.ai",url:"https://burtson.ai"},repository:{type:"git",url:"git+https://github.com/Burtson-Labs/bandit-agent-framework.git",directory:"apps/bandit-cli"},type:"module",bin:{bandit:"./dist/cli.js"},main:"dist/cli.js",files:["dist/cli.js","README.md","LICENSE"],engines:{node:">=20"},publishConfig:{access:"public"},scripts:{test:"vitest run",typecheck:"tsc -p tsconfig.json --noEmit",build:"node build.mjs","build:publish":"node build.mjs --publish",dev:"node build.mjs --watch",start:"node dist/cli.js",smoke:"node build.mjs && node dist/__smoke__/smoke.js",integration:"node build.mjs && node dist/__integration__/ollama.js",eval:"node build.mjs && node dist/__eval__/eval.js",benchmark:"node build.mjs && node dist/__eval__/benchmark.js","gen-logo":"node scripts/gen-logo.mjs","preview-banner":"node scripts/preview-banner.mjs",clean:"rm -rf dist",prepack:"node scripts/prepack.mjs",postpack:"node scripts/postpack.mjs",prepublishOnly:"pnpm run clean && pnpm run typecheck && pnpm run build:publish"},dependencies:{"pdf-parse":"^2.4.5"},devDependencies:{"@burtson-labs/agent-core":"workspace:*","@burtson-labs/host-kit":"workspace:*","@burtson-labs/stealth-core-runtime":"workspace:*","@types/node":"^20.11.0","@types/pdf-parse":"^1.1.5","@types/pngjs":"^6.0.5","@types/react":"^19.2.2",esbuild:"^0.28.0",ink:"^7.0.4","ink-text-input":"^6.0.0",pngjs:"^7.0.0",react:"^19.2.0",typescript:"^5.4.0",vitest:"^4.0.10"}}});var z$e={};Rre(z$e,{resolveEditor:()=>Q$e,spawnEditorOnFile:()=>m9n});import{spawnSync as p9n,spawn as _9n}from"child_process";import*as qxt from"path";function Q$e(r=process.env){let i=(r.VISUAL??"").trim();if(i.length>0){let{cmd:u,args:l}=Uxt(i);return{label:`$VISUAL (${u})`,cmd:u,args:l}}let s=(r.EDITOR??"").trim();if(s.length>0){let{cmd:u,args:l}=Uxt(s);return{label:`$EDITOR (${u})`,cmd:u,args:l}}return r.TERM_PROGRAM==="vscode"&&Jxt("code",r)?{label:"code --wait (VS Code tab)",cmd:"code",args:["--wait"]}:process.platform==="win32"?{label:"notepad",cmd:"notepad.exe",args:[]}:Jxt("nano",r)?{label:"nano",cmd:"nano",args:[]}:null}async function m9n(r,i){let s=qxt.resolve(i);return new Promise(u=>{let l=_9n(r.cmd,[...r.args,s],{stdio:"inherit",shell:!1});l.on("exit",(m,A)=>{u({exitCode:typeof m=="number"?m:A?130:1})}),l.on("error",()=>u({exitCode:1}))})}function Uxt(r){let i=r.split(/\s+/).filter(Boolean);return{cmd:i[0]??"",args:i.slice(1)}}function Jxt(r,i){let s=process.platform==="win32"?"where":"which";return p9n(s,[r],{stdio:"ignore",env:i}).status===0}var abe=E8(()=>{"use strict";t(Q$e,"resolveEditor");t(m9n,"spawnEditorOnFile");t(Uxt,"splitEditorEnv");t(Jxt,"commandExists")});var Vxt={};Rre(Vxt,{PLAN_FILE:()=>Hxt,STAGING_DIR:()=>AK,loadPlan:()=>Gxt,runWizard:()=>g9n});import*as $J from"fs";import*as GR from"path";async function Gxt(r){let i=GR.join(r,AK,Hxt),s;try{s=await $J.promises.readFile(i,"utf-8")}catch{return null}try{let u=JSON.parse(s);return u.version!==1||!Array.isArray(u.entries)||u.entries.length===0?null:u}catch{return null}}async function g9n(r){let i=await Gxt(r.cwd);if(!i)return process.stdout.write(X.red("No migration plan found. ")+X.dim(`Run ${X.cyan("/memory migrate")} first to generate one, then ${X.cyan("/memory migrate apply")} to launch this wizard.
+</body></html>`;t(Xjn,"startLoopbackListener");t(e9n,"openBrowser");t(t9n,"buildDefaultDeviceLabel");t(n9n,"runOAuthSignIn")});var rbe=Lt((zlr,r9n)=>{r9n.exports={name:"@burtson-labs/bandit-stealth-cli",version:"1.7.334",description:"Bandit \u2014 a local-first AI coding agent for your terminal. Same runtime as the Bandit Stealth VS Code / Cursor extension.",keywords:["ai","agent","cli","coding-agent","llm","ollama","local-first","bandit","burtson-labs","terminal","repl","developer-tools"],homepage:"https://burtson.ai",bugs:{url:"https://github.com/Burtson-Labs/bandit-agent-framework/issues",email:"team@burtson.ai"},license:"Apache-2.0",author:{name:"Burtson Labs",email:"team@burtson.ai",url:"https://burtson.ai"},repository:{type:"git",url:"git+https://github.com/Burtson-Labs/bandit-agent-framework.git",directory:"apps/bandit-cli"},type:"module",bin:{bandit:"./dist/cli.js"},main:"dist/cli.js",files:["dist/cli.js","README.md","LICENSE"],engines:{node:">=20"},publishConfig:{access:"public"},scripts:{test:"vitest run",typecheck:"tsc -p tsconfig.json --noEmit",build:"node build.mjs","build:publish":"node build.mjs --publish",dev:"node build.mjs --watch",start:"node dist/cli.js",smoke:"node build.mjs && node dist/__smoke__/smoke.js",integration:"node build.mjs && node dist/__integration__/ollama.js",eval:"node build.mjs && node dist/__eval__/eval.js",benchmark:"node build.mjs && node dist/__eval__/benchmark.js","gen-logo":"node scripts/gen-logo.mjs","preview-banner":"node scripts/preview-banner.mjs",clean:"rm -rf dist",prepack:"node scripts/prepack.mjs",postpack:"node scripts/postpack.mjs",prepublishOnly:"pnpm run clean && pnpm run typecheck && pnpm run build:publish"},dependencies:{"pdf-parse":"^2.4.5"},devDependencies:{"@burtson-labs/agent-core":"workspace:*","@burtson-labs/host-kit":"workspace:*","@burtson-labs/stealth-core-runtime":"workspace:*","@types/node":"^20.11.0","@types/pdf-parse":"^1.1.5","@types/pngjs":"^6.0.5","@types/react":"^19.2.2",esbuild:"^0.28.0",ink:"^7.0.4","ink-text-input":"^6.0.0",pngjs:"^7.0.0",react:"^19.2.0",typescript:"^5.4.0",vitest:"^4.0.10"}}});var z$e={};Rre(z$e,{resolveEditor:()=>Q$e,spawnEditorOnFile:()=>m9n});import{spawnSync as p9n,spawn as _9n}from"child_process";import*as qxt from"path";function Q$e(r=process.env){let i=(r.VISUAL??"").trim();if(i.length>0){let{cmd:u,args:l}=Uxt(i);return{label:`$VISUAL (${u})`,cmd:u,args:l}}let s=(r.EDITOR??"").trim();if(s.length>0){let{cmd:u,args:l}=Uxt(s);return{label:`$EDITOR (${u})`,cmd:u,args:l}}return r.TERM_PROGRAM==="vscode"&&Jxt("code",r)?{label:"code --wait (VS Code tab)",cmd:"code",args:["--wait"]}:process.platform==="win32"?{label:"notepad",cmd:"notepad.exe",args:[]}:Jxt("nano",r)?{label:"nano",cmd:"nano",args:[]}:null}async function m9n(r,i){let s=qxt.resolve(i);return new Promise(u=>{let l=_9n(r.cmd,[...r.args,s],{stdio:"inherit",shell:!1});l.on("exit",(m,A)=>{u({exitCode:typeof m=="number"?m:A?130:1})}),l.on("error",()=>u({exitCode:1}))})}function Uxt(r){let i=r.split(/\s+/).filter(Boolean);return{cmd:i[0]??"",args:i.slice(1)}}function Jxt(r,i){let s=process.platform==="win32"?"where":"which";return p9n(s,[r],{stdio:"ignore",env:i}).status===0}var abe=E8(()=>{"use strict";t(Q$e,"resolveEditor");t(m9n,"spawnEditorOnFile");t(Uxt,"splitEditorEnv");t(Jxt,"commandExists")});var Vxt={};Rre(Vxt,{PLAN_FILE:()=>Hxt,STAGING_DIR:()=>AK,loadPlan:()=>Gxt,runWizard:()=>g9n});import*as $J from"fs";import*as GR from"path";async function Gxt(r){let i=GR.join(r,AK,Hxt),s;try{s=await $J.promises.readFile(i,"utf-8")}catch{return null}try{let u=JSON.parse(s);return u.version!==1||!Array.isArray(u.entries)||u.entries.length===0?null:u}catch{return null}}async function g9n(r){let i=await Gxt(r.cwd);if(!i)return process.stdout.write(X.red("No migration plan found. ")+X.dim(`Run ${X.cyan("/memory migrate")} first to generate one, then ${X.cyan("/memory migrate apply")} to launch this wizard.
 `)),{applied:0,skipped:0,edited:0,quit:!0,originalBackup:""};let s=Q$e();if(!s)return process.stdout.write(X.red("No editor available. ")+X.dim("Set $EDITOR (e.g. ")+X.cyan("EDITOR=code")+X.dim(") or ")+X.cyan("EDITOR=nano")+X.dim(" and rerun ")+X.cyan("/memory migrate apply")+X.dim(". ")+X.dim("You can also edit the files under ")+X.cyan(AK)+X.dim(` directly with any editor before running apply \u2014 the wizard reads them as-is.
 `)),{applied:0,skipped:0,edited:0,quit:!0,originalBackup:""};process.stdout.write(`
 `+X.bold("Memory migration \u2014 review proposals")+`

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@burtson-labs/bandit-stealth-cli",
-  "version": "1.7.333",
+  "version": "1.7.334",
   "description": "Bandit — a local-first AI coding agent for your terminal. Same runtime as the Bandit Stealth VS Code / Cursor extension.",
   "keywords": [
     "ai",