@creativeintelligence/abbie 0.1.0

package/dist/lib/tmux/panes.js

@@ -0,0 +1,151 @@
+import { spawn } from "node:child_process";
+function isCsiFinalByte(code) {
+    return code >= 0x40 && code <= 0x7e;
+}
+function scanAnsiEscape(input, start) {
+    if (input[start] !== "\u001b")
+        return start;
+    const next = input[start + 1];
+    // CSI: ESC [ ... final
+    if (next === "[") {
+        let i = start + 2;
+        for (; i < input.length; i++) {
+            const code = input.charCodeAt(i);
+            if (isCsiFinalByte(code))
+                return i + 1;
+        }
+        return input.length;
+    }
+    // OSC: ESC ] ... BEL or ESC \
+    if (next === "]") {
+        let i = start + 2;
+        for (; i < input.length; i++) {
+            const code = input.charCodeAt(i);
+            if (code === 0x07 /* BEL */)
+                return i + 1;
+            if (input[i] === "\u001b" && input[i + 1] === "\\")
+                return i + 2;
+        }
+        return input.length;
+    }
+    return Math.min(input.length, start + 2);
+}
+function nextCodePoint(input, index) {
+    const cp = input.codePointAt(index) ?? 0;
+    const size = cp > 0xffff ? 2 : 1;
+    return { cp, size };
+}
+function markCursorAnsi(line, cursorX) {
+    // Best-effort: wrap the cursor cell with reverse-video toggles (7/27).
+    const x = Math.max(0, cursorX);
+    let out = "";
+    let visible = 0;
+    let i = 0;
+    while (i < line.length) {
+        if (line[i] === "\u001b") {
+            const end = scanAnsiEscape(line, i);
+            out += line.slice(i, end);
+            i = end;
+            continue;
+        }
+        const { cp, size } = nextCodePoint(line, i);
+        const ch = String.fromCodePoint(cp);
+        if (visible === x)
+            out += "\u001b[7m";
+        out += ch;
+        if (visible === x)
+            out += "\u001b[27m";
+        visible += 1;
+        i += size;
+    }
+    // If cursor is past EOL, render a reversed space.
+    if (x >= visible) {
+        out += "\u001b[7m \u001b[27m";
+    }
+    return out;
+}
+function runTmuxRaw(args) {
+    return new Promise((resolve, reject) => {
+        const proc = spawn("tmux", args, { stdio: ["ignore", "pipe", "pipe"] });
+        let stdout = "";
+        let stderr = "";
+        proc.stdout.on("data", (d) => {
+            stdout += d.toString("utf8");
+        });
+        proc.stderr.on("data", (d) => {
+            stderr += d.toString("utf8");
+        });
+        proc.on("close", (code) => {
+            if (code === 0)
+                resolve(stdout);
+            else
+                reject(new Error(stderr.trim() || `tmux ${args.join(" ")} exited ${code}`));
+        });
+        proc.on("error", reject);
+    });
+}
+export async function getPaneMetrics(paneId) {
+    try {
+        const out = await runTmuxRaw([
+            "display-message",
+            "-p",
+            "-t",
+            paneId,
+            "#{pane_width}\t#{pane_height}\t#{cursor_x}\t#{cursor_y}\t#{cursor_flag}\t#{pane_title}",
+        ]);
+        const [colsRaw, rowsRaw, cursorXRaw, cursorYRaw, cursorFlagRaw, titleRaw] = out
+            .trimEnd()
+            .split("\t");
+        const cols = Number.parseInt(colsRaw ?? "", 10);
+        const rows = Number.parseInt(rowsRaw ?? "", 10);
+        const cursorX = Number.parseInt(cursorXRaw ?? "", 10);
+        const cursorY = Number.parseInt(cursorYRaw ?? "", 10);
+        const cursorFlag = Number.parseInt(cursorFlagRaw ?? "", 10);
+        const title = titleRaw ?? "";
+        if (!Number.isFinite(cols) || !Number.isFinite(rows))
+            return null;
+        return { paneId, cols, rows, cursorX, cursorY, cursorFlag, title };
+    }
+    catch {
+        return null;
+    }
+}
+export async function capturePaneScreen(paneId, opts) {
+    const rows = Math.max(1, opts.rows);
+    const args = ["capture-pane", "-t", paneId, "-p"];
+    if (opts.ansi)
+        args.push("-e");
+    args.push("-S", `-${rows}`);
+    try {
+        // Preserve all whitespace; do not trim (important for full-screen apps).
+        const raw = await runTmuxRaw(args);
+        const cursor = opts.cursor;
+        if (!cursor || !cursor.visible)
+            return raw;
+        const lines = raw.replace(/\n$/, "").split("\n");
+        if (cursor.y < 0 || cursor.y >= lines.length)
+            return raw;
+        const target = lines[cursor.y] ?? "";
+        lines[cursor.y] = opts.ansi ? markCursorAnsi(target, cursor.x) : target;
+        return `${lines.join("\n")}\n`;
+    }
+    catch {
+        return "";
+    }
+}
+export async function ensurePipePane(paneId, shellCommand, opts) {
+    const args = ["pipe-pane", "-t", paneId];
+    if (opts.onlyIfUnset)
+        args.push("-o");
+    if (opts.bidirectional)
+        args.push("-I", "-O");
+    // If neither -I nor -O are specified, tmux defaults to -O (stdin connected).
+    args.push(shellCommand);
+    try {
+        await runTmuxRaw(args);
+        return { attached: true };
+    }
+    catch (err) {
+        return { attached: false, error: err instanceof Error ? err.message : String(err) };
+    }
+}

package/dist/lib/tmux/redaction.d.ts

@@ -0,0 +1,57 @@
+/**
+ * Redaction utilities for tmux context.
+ * Detects and redacts sensitive data like API keys, tokens, and credentials.
+ */
+export type RedactMode = "balanced" | "strict";
+/**
+ * Redact sensitive tokens within a string.
+ */
+export declare function redactTokens(text: string): string;
+/**
+ * Check if a line should be fully redacted.
+ */
+export declare function shouldRedactLine(line: string): boolean;
+/**
+ * Redact a single line of text.
+ */
+export declare function redactLine(line: string): string;
+/**
+ * Redact sensitive data from text content.
+ * In strict mode, redacts more aggressively.
+ */
+export declare function redactContent(text: string, _mode?: RedactMode): {
+    content: string;
+    wasRedacted: boolean;
+};
+/**
+ * Check if a command is considered sensitive.
+ */
+export declare function isSensitiveCommand(command: string): boolean;
+/**
+ * Filter patterns for deny/allow lists.
+ */
+export interface FilterConfig {
+    denySessions?: string[];
+    denyWindows?: string[];
+    denyPaths?: string[];
+    denyCommands?: string[];
+    includeSessions?: string[];
+    includeWindows?: string[];
+}
+/**
+ * Check if a session should be filtered out.
+ */
+export declare function shouldFilterSession(sessionName: string, config: FilterConfig): boolean;
+/**
+ * Check if a window should be filtered out.
+ */
+export declare function shouldFilterWindow(windowName: string, config: FilterConfig): boolean;
+/**
+ * Check if a path should be filtered out.
+ */
+export declare function shouldFilterPath(path: string, config: FilterConfig): boolean;
+/**
+ * Check if a command should be filtered out.
+ */
+export declare function shouldFilterCommand(command: string, config: FilterConfig): boolean;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/lib/tmux/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../../../src/lib/tmux/redaction.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAC;AAmD/C;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CASjD;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEtD;AAED;;GAEG;AACH,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAQ/C;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,UAAuB,GAC7B;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,OAAO,CAAA;CAAE,CAgB3C;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAYtF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAYpF;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAK5E;AAED;;GAEG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,YAAY,GAAG,OAAO,CAKlF"}

package/dist/lib/tmux/redaction.js

@@ -0,0 +1,152 @@
+/**
+ * Redaction utilities for tmux context.
+ * Detects and redacts sensitive data like API keys, tokens, and credentials.
+ */
+const REDACTED_MARKER = "***REDACTED***";
+/**
+ * Pattern definitions for sensitive data.
+ */
+const PATTERNS = {
+    // OpenAI/OpenRouter/Anthropic-style keys
+    openaiKey: /sk-[A-Za-z0-9_-]{16,}/g,
+    anthropicKey: /sk-ant-[A-Za-z0-9_-]{16,}/g,
+    // GitHub tokens
+    githubPat: /ghp_[A-Za-z0-9]{20,}/g,
+    githubPatNew: /github_pat_[A-Za-z0-9_]{20,}/g,
+    githubOther: /gh[ours]_[A-Za-z0-9]{20,}/g,
+    // Slack tokens
+    slackToken: /xox[baprs]-[A-Za-z0-9-]{10,}/g,
+    // URLs with user:pass
+    urlWithAuth: /https?:\/\/[^:]+:[^@]+@[^\s'"]+/g,
+    // PEM private keys (multiline)
+    pemKey: /-----BEGIN\s+(?:[A-Z\s]+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(?:[A-Z\s]+)?PRIVATE\s+KEY-----/g,
+    // AWS keys
+    awsAccessKey: /AKIA[A-Z0-9]{16}/g,
+    // Generic secret-looking patterns (base64-ish long strings after common key names)
+    genericSecret: /(?:api[_-]?key|secret[_-]?key|access[_-]?token|auth[_-]?token)\s*[:=]\s*["']?[A-Za-z0-9+/=_-]{20,}["']?/gi,
+};
+/**
+ * Line-level patterns that should cause entire line redaction.
+ */
+const LINE_PATTERNS = [
+    // Common secret assignments (case-insensitive)
+    // Matches: API_KEY=, SECRET=, SECRET_KEY=, PASSWORD=, AUTH_TOKEN=, PRIVATE_KEY=, etc.
+    /(?:\S*(?:API_KEY|SECRET|TOKEN|PASSWORD|PASS|PRIVATE_KEY)\S*)\s*=/i,
+    // export with secret names
+    /export\s+(?:\S*(?:KEY|TOKEN|SECRET|PASSWORD|PASS)\S*)\s*=/i,
+];
+/**
+ * Commands that typically contain sensitive output and should be fully redacted in strict mode.
+ */
+const SENSITIVE_COMMANDS = ["pass", "vault", "1password", "op", "aws configure"];
+/**
+ * Redact sensitive tokens within a string.
+ */
+export function redactTokens(text) {
+    let result = text;
+    // Apply all token patterns
+    for (const pattern of Object.values(PATTERNS)) {
+        result = result.replace(pattern, REDACTED_MARKER);
+    }
+    return result;
+}
+/**
+ * Check if a line should be fully redacted.
+ */
+export function shouldRedactLine(line) {
+    return LINE_PATTERNS.some((pattern) => pattern.test(line));
+}
+/**
+ * Redact a single line of text.
+ */
+export function redactLine(line) {
+    // First check if entire line should be redacted
+    if (shouldRedactLine(line)) {
+        return REDACTED_MARKER;
+    }
+    // Otherwise, apply token-level redaction
+    return redactTokens(line);
+}
+/**
+ * Redact sensitive data from text content.
+ * In strict mode, redacts more aggressively.
+ */
+export function redactContent(text, _mode = "balanced") {
+    const lines = text.split("\n");
+    let wasRedacted = false;
+    const redactedLines = lines.map((line) => {
+        const redacted = redactLine(line);
+        if (redacted !== line) {
+            wasRedacted = true;
+        }
+        return redacted;
+    });
+    return {
+        content: redactedLines.join("\n"),
+        wasRedacted,
+    };
+}
+/**
+ * Check if a command is considered sensitive.
+ */
+export function isSensitiveCommand(command) {
+    const lowerCmd = command.toLowerCase();
+    return SENSITIVE_COMMANDS.some((sc) => lowerCmd.includes(sc));
+}
+/**
+ * Check if a session should be filtered out.
+ */
+export function shouldFilterSession(sessionName, config) {
+    // If include list is specified, only include those
+    if (config.includeSessions?.length) {
+        return !config.includeSessions.some((pattern) => matchPattern(sessionName, pattern));
+    }
+    // Otherwise, check deny list
+    if (config.denySessions?.length) {
+        return config.denySessions.some((pattern) => matchPattern(sessionName, pattern));
+    }
+    return false;
+}
+/**
+ * Check if a window should be filtered out.
+ */
+export function shouldFilterWindow(windowName, config) {
+    // If include list is specified, only include those
+    if (config.includeWindows?.length) {
+        return !config.includeWindows.some((pattern) => matchPattern(windowName, pattern));
+    }
+    // Otherwise, check deny list
+    if (config.denyWindows?.length) {
+        return config.denyWindows.some((pattern) => matchPattern(windowName, pattern));
+    }
+    return false;
+}
+/**
+ * Check if a path should be filtered out.
+ */
+export function shouldFilterPath(path, config) {
+    if (config.denyPaths?.length) {
+        return config.denyPaths.some((pattern) => matchPattern(path, pattern));
+    }
+    return false;
+}
+/**
+ * Check if a command should be filtered out.
+ */
+export function shouldFilterCommand(command, config) {
+    if (config.denyCommands?.length) {
+        return config.denyCommands.some((pattern) => matchPattern(command, pattern));
+    }
+    return false;
+}
+/**
+ * Simple glob-like pattern matching (supports * wildcards).
+ */
+function matchPattern(value, pattern) {
+    // Convert glob pattern to regex
+    const regexPattern = pattern
+        .replace(/[.+^${}()|[\]\\]/g, "\\$&") // Escape special chars except *
+        .replace(/\*/g, ".*"); // Convert * to .*
+    const regex = new RegExp(`^${regexPattern}$`, "i");
+    return regex.test(value);
+}

package/dist/lib/tmux/redaction.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/lib/tmux/redaction.test.js

@@ -0,0 +1,183 @@
+import { describe, expect, test } from 'bun:test';
+import { redactTokens, redactLine, redactContent, shouldRedactLine, shouldFilterSession, shouldFilterWindow, shouldFilterPath, shouldFilterCommand, isSensitiveCommand, } from './redaction.js';
+describe('redactTokens', () => {
+    test('redacts OpenAI-style keys', () => {
+        expect(redactTokens('sk-abc123def456ghi789jkl012mno345pqr678stu901vwx')).toBe('***REDACTED***');
+        expect(redactTokens('key: sk-abcdefghijklmnop')).toBe('key: ***REDACTED***');
+    });
+    test('redacts Anthropic-style keys', () => {
+        expect(redactTokens('sk-ant-abc123def456ghi789jkl012mno345pqr678stu901')).toBe('***REDACTED***');
+    });
+    test('redacts GitHub PATs', () => {
+        expect(redactTokens('ghp_abc123def456ghi789jkl')).toBe('***REDACTED***');
+        expect(redactTokens('github_pat_abc123def456ghi789jkl012mno345')).toBe('***REDACTED***');
+        expect(redactTokens('gho_abc123def456ghi789jkl')).toBe('***REDACTED***');
+    });
+    test('redacts Slack tokens', () => {
+        expect(redactTokens('xoxb-123456789012-abcdefghij')).toBe('***REDACTED***');
+        expect(redactTokens('xoxp-123456789012-abcdefghij')).toBe('***REDACTED***');
+    });
+    test('redacts URLs with auth', () => {
+        expect(redactTokens('https://user:password@api.example.com/v1')).toBe('***REDACTED***');
+        expect(redactTokens('http://admin:secret123@localhost:8080')).toBe('***REDACTED***');
+    });
+    test('redacts AWS access keys', () => {
+        expect(redactTokens('AKIAIOSFODNN7EXAMPLE')).toBe('***REDACTED***');
+    });
+    test('redacts generic secret patterns', () => {
+        expect(redactTokens('api_key=abcdefghijklmnopqrstuvwxyz123456')).toBe('***REDACTED***');
+        expect(redactTokens('SECRET_KEY: "abcdefghijklmnopqrstuvwxyz"')).toBe('***REDACTED***');
+        expect(redactTokens("auth_token='abcdefghijklmnopqrstuvwxyz'")).toBe('***REDACTED***');
+    });
+    test('preserves non-sensitive content', () => {
+        expect(redactTokens('hello world')).toBe('hello world');
+        expect(redactTokens('const x = 42;')).toBe('const x = 42;');
+        expect(redactTokens('sk-short')).toBe('sk-short'); // Too short to be a key
+    });
+    test('handles multiple secrets in one line', () => {
+        const input = 'key1: sk-abc123def456ghi789jkl012mno345, key2: ghp_abc123def456ghi789jkl';
+        const output = redactTokens(input);
+        expect(output).toBe('key1: ***REDACTED***, key2: ***REDACTED***');
+    });
+});
+describe('shouldRedactLine', () => {
+    test('detects API_KEY assignments', () => {
+        expect(shouldRedactLine('API_KEY=abc123')).toBe(true);
+        expect(shouldRedactLine('export API_KEY="value"')).toBe(true);
+    });
+    test('detects TOKEN assignments', () => {
+        expect(shouldRedactLine('TOKEN=abc123')).toBe(true);
+        expect(shouldRedactLine('AUTH_TOKEN=abc123')).toBe(true);
+    });
+    test('detects SECRET assignments', () => {
+        expect(shouldRedactLine('SECRET=abc123')).toBe(true);
+        expect(shouldRedactLine('SECRET_KEY=abc123')).toBe(true);
+    });
+    test('detects PASSWORD assignments', () => {
+        expect(shouldRedactLine('PASSWORD=abc123')).toBe(true);
+        expect(shouldRedactLine('PASS=abc123')).toBe(true);
+        expect(shouldRedactLine('DB_PASSWORD=abc123')).toBe(true);
+    });
+    test('detects PRIVATE_KEY assignments', () => {
+        expect(shouldRedactLine('PRIVATE_KEY=abc123')).toBe(true);
+        expect(shouldRedactLine('SSH_PRIVATE_KEY=abc123')).toBe(true);
+    });
+    test('is case-insensitive', () => {
+        expect(shouldRedactLine('api_key=abc123')).toBe(true);
+        expect(shouldRedactLine('Api_Key=abc123')).toBe(true);
+    });
+    test('does not match non-sensitive lines', () => {
+        expect(shouldRedactLine('const x = 42;')).toBe(false);
+        expect(shouldRedactLine('echo "hello"')).toBe(false);
+        expect(shouldRedactLine('API_ENDPOINT=https://example.com')).toBe(false);
+    });
+});
+describe('redactLine', () => {
+    test('fully redacts sensitive assignment lines', () => {
+        expect(redactLine('API_KEY=sk-abc123def456ghi789jkl012')).toBe('***REDACTED***');
+    });
+    test('token-redacts lines with embedded secrets', () => {
+        expect(redactLine('Using token: ghp_abc123def456ghi789jkl')).toBe('Using token: ***REDACTED***');
+    });
+    test('preserves clean lines', () => {
+        expect(redactLine('echo "hello"')).toBe('echo "hello"');
+    });
+});
+describe('redactContent', () => {
+    test('redacts multiline content', () => {
+        const input = `
+echo "hello"
+API_KEY=secret
+Using ghp_abc123def456ghi789jkl
+const x = 42;
+`.trim();
+        const { content, wasRedacted } = redactContent(input);
+        expect(wasRedacted).toBe(true);
+        expect(content).toContain('echo "hello"');
+        expect(content).toContain('***REDACTED***');
+        expect(content).toContain('const x = 42;');
+        expect(content).not.toContain('API_KEY=secret');
+        expect(content).not.toContain('ghp_');
+    });
+    test('reports when no redaction occurred', () => {
+        const input = 'echo "hello"\nconst x = 42;';
+        const { content, wasRedacted } = redactContent(input);
+        expect(wasRedacted).toBe(false);
+        expect(content).toBe(input);
+    });
+});
+describe('isSensitiveCommand', () => {
+    test('detects pass command', () => {
+        expect(isSensitiveCommand('pass')).toBe(true);
+        expect(isSensitiveCommand('pass show github')).toBe(true);
+    });
+    test('detects vault command', () => {
+        expect(isSensitiveCommand('vault')).toBe(true);
+        expect(isSensitiveCommand('vault read secret/data')).toBe(true);
+    });
+    test('detects 1password/op', () => {
+        expect(isSensitiveCommand('1password')).toBe(true);
+        expect(isSensitiveCommand('op')).toBe(true);
+        expect(isSensitiveCommand('op get item github')).toBe(true);
+    });
+    test('detects aws configure', () => {
+        expect(isSensitiveCommand('aws configure')).toBe(true);
+        expect(isSensitiveCommand('aws configure list')).toBe(true);
+    });
+    test('does not match non-sensitive commands', () => {
+        expect(isSensitiveCommand('nvim')).toBe(false);
+        expect(isSensitiveCommand('zsh')).toBe(false);
+        expect(isSensitiveCommand('git status')).toBe(false);
+    });
+});
+describe('shouldFilterSession', () => {
+    test('filters by deny list', () => {
+        const config = { denySessions: ['secret*', 'private'] };
+        expect(shouldFilterSession('secret-work', config)).toBe(true);
+        expect(shouldFilterSession('secrets', config)).toBe(true);
+        expect(shouldFilterSession('private', config)).toBe(true);
+        expect(shouldFilterSession('work', config)).toBe(false);
+    });
+    test('filters by include list (overrides deny)', () => {
+        const config = {
+            denySessions: ['*'],
+            includeSessions: ['work', 'dev*']
+        };
+        expect(shouldFilterSession('work', config)).toBe(false);
+        expect(shouldFilterSession('dev-main', config)).toBe(false);
+        expect(shouldFilterSession('other', config)).toBe(true);
+    });
+    test('returns false when no filters', () => {
+        expect(shouldFilterSession('anything', {})).toBe(false);
+    });
+});
+describe('shouldFilterWindow', () => {
+    test('filters by deny list', () => {
+        const config = { denyWindows: ['credentials', 'pass*'] };
+        expect(shouldFilterWindow('credentials', config)).toBe(true);
+        expect(shouldFilterWindow('password', config)).toBe(true);
+        expect(shouldFilterWindow('work', config)).toBe(false);
+    });
+    test('filters by include list', () => {
+        const config = { includeWindows: ['main', 'editor*'] };
+        expect(shouldFilterWindow('main', config)).toBe(false);
+        expect(shouldFilterWindow('editor-1', config)).toBe(false);
+        expect(shouldFilterWindow('other', config)).toBe(true);
+    });
+});
+describe('shouldFilterPath', () => {
+    test('filters by deny list', () => {
+        const config = { denyPaths: ['*/secrets/*', '*.key'] };
+        expect(shouldFilterPath('/home/user/secrets/api.txt', config)).toBe(true);
+        expect(shouldFilterPath('/home/user/.ssh/id_rsa.key', config)).toBe(true);
+        expect(shouldFilterPath('/home/user/code/main.ts', config)).toBe(false);
+    });
+});
+describe('shouldFilterCommand', () => {
+    test('filters by deny list', () => {
+        const config = { denyCommands: ['pass', 'vault*'] };
+        expect(shouldFilterCommand('pass', config)).toBe(true);
+        expect(shouldFilterCommand('vault', config)).toBe(true);
+        expect(shouldFilterCommand('nvim', config)).toBe(false);
+    });
+});

package/dist/lib/triage-llm.d.ts

@@ -0,0 +1,23 @@
+import type { AgentCapability, Complexity, IssueType, LinearIssue } from "./triage.js";
+/**
+ * LLM classification result with full reasoning.
+ */
+export interface LLMClassification {
+    type: IssueType;
+    complexity: Complexity;
+    agent: AgentCapability;
+    confidence: number;
+    reasoning: string;
+    suggested_prompt: string;
+    tags: string[];
+    raw_response?: string;
+}
+/**
+ * Classify an issue using an LLM (gemini CLI preferred, fallback to copilot).
+ */
+export declare function classifyWithLLM(issue: LinearIssue): Promise<LLMClassification>;
+/**
+ * Batch classify multiple issues (sequentially to avoid rate limits).
+ */
+export declare function classifyBatch(issues: LinearIssue[], onProgress?: (current: number, total: number) => void): Promise<Map<string, LLMClassification>>;
+//# sourceMappingURL=triage-llm.d.ts.map

package/dist/lib/triage-llm.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"triage-llm.d.ts","sourceRoot":"","sources":["../../src/lib/triage-llm.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,eAAe,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAGvF;;GAEG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,SAAS,CAAC;IAChB,UAAU,EAAE,UAAU,CAAC;IACvB,KAAK,EAAE,eAAe,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,gBAAgB,EAAE,MAAM,CAAC;IACzB,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAyJD;;GAEG;AACH,wBAAsB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4EpF;AAuCD;;GAEG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,WAAW,EAAE,EACrB,UAAU,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,KAAK,IAAI,GACpD,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAiBzC"}