@datasynx/agentic-ai-cartography 1.1.1 → 2.0.0

package/dist/chunk-CJ2PITFA.js

@@ -0,0 +1,785 @@
+#!/usr/bin/env node
+
+// src/bookmarks.ts
+import { tmpdir } from "os";
+import { existsSync as existsSync2, readFileSync, readdirSync, copyFileSync, statSync, unlinkSync } from "fs";
+import { join as join2 } from "path";
+
+// src/platform.ts
+import { homedir } from "os";
+import { join } from "path";
+import { execSync } from "child_process";
+import { existsSync } from "fs";
+
+// src/allowlist.ts
+var READONLY_BINARIES = /* @__PURE__ */ new Set([
+  // shell & text utilities
+  "echo",
+  "printf",
+  "true",
+  "false",
+  "test",
+  "cat",
+  "head",
+  "tail",
+  "grep",
+  "egrep",
+  "fgrep",
+  "awk",
+  "sed",
+  "cut",
+  "sort",
+  "uniq",
+  "wc",
+  "tr",
+  "xargs",
+  "tee",
+  "ls",
+  "find",
+  "which",
+  "command",
+  "type",
+  "basename",
+  "dirname",
+  "realpath",
+  "readlink",
+  "stat",
+  "file",
+  "printenv",
+  "date",
+  "hostname",
+  "uname",
+  "whoami",
+  "id",
+  "pwd",
+  "expr",
+  "seq",
+  "tac",
+  "rev",
+  "column",
+  "paste",
+  // network & process inspection (read-only)
+  "ss",
+  "netstat",
+  "lsof",
+  "ps",
+  "ip",
+  "ifconfig",
+  "arp",
+  "dig",
+  "nslookup",
+  "host",
+  // database clients (read-only usage is enforced separately for risky verbs)
+  "psql",
+  "mysql",
+  "mysqladmin",
+  "mongosh",
+  "redis-cli",
+  "sqlite3",
+  "pg_lsclusters",
+  "clickhouse-client",
+  // macOS
+  "mdfind"
+]);
+var CONDITIONAL_BINARIES = /* @__PURE__ */ new Set(["tee"]);
+var PKG_MANAGERS = /* @__PURE__ */ new Set(["dpkg", "rpm", "snap", "flatpak", "brew", "winget", "choco", "scoop", "apt-cache"]);
+var MUTATING_PKG = /^(install|uninstall|reinstall|remove|purge|erase|upgrade|update|add|delete|pin|enable|disable|-i|--install|-r|--remove|-P|--purge|-e|--erase|-U|--upgrade|-F|--freshen)$/i;
+var COMMAND_RUNNERS = /* @__PURE__ */ new Set(["xargs", "env", "nice", "nohup", "timeout", "time", "stdbuf", "watch", "sudo"]);
+var DANGEROUS_PS = /\b(Remove-Item|Remove-ItemProperty|Move-Item|Copy-Item|Rename-Item|New-Item|New-Service|Set-Content|Add-Content|Clear-Content|Out-File|Set-ItemProperty|Set-Service|Stop-Process|Stop-Service|Start-Service|Restart-Service|Stop-Computer|Restart-Computer|Format-Volume|Clear-Disk|Remove-\w+|Uninstall-\w+|Install-\w+|Set-\w+|New-\w+|Start-\w+|Stop-\w+|Restart-\w+|Invoke-Expression|iex|Invoke-WebRequest|Invoke-RestMethod|Invoke-Command|Start-Process|Register-\w+|Unregister-\w+|Disable-\w+|Enable-\w+|Reset-\w+|del|rmdir|rd)\b/i;
+var DANGEROUS_POSIX = /\b(rm|rmdir|mv|dd|mkfs|chmod|chown|chgrp|kill|killall|pkill|reboot|shutdown|poweroff|halt|truncate|shred|fdisk|parted)\b/i;
+var SUBCOMMAND_RULES = {
+  kubectl: (t) => allowFirstVerb(t, ["get", "describe", "top", "logs", "explain", "config", "version", "cluster-info", "api-resources", "api-versions", "auth"]),
+  docker: (t) => allowFirstVerb(t, ["ps", "images", "inspect", "version", "info", "logs", "stats", "top", "port", "history", "diff", "system", "context", "volume", "network", "image", "container"]) && !hasMutatingDockerVerb(t),
+  podman: (t) => SUBCOMMAND_RULES["docker"](t),
+  helm: (t) => allowFirstVerb(t, ["list", "ls", "status", "get", "show", "history", "version", "repo", "search", "env"]),
+  systemctl: (t) => allowFirstVerb(t, ["status", "show", "list-units", "list-unit-files", "list-sockets", "list-timers", "list-dependencies", "is-active", "is-enabled", "is-failed", "cat", "get-default", "show-environment"]),
+  service: (t) => t.some((x) => /^status$/i.test(x)),
+  // cloud CLIs: read-only actions only — must contain a read verb, never a mutating one
+  aws: (t) => containsAwsReadAction(t) && !hasMutatingCloudVerb(t),
+  gcloud: (t) => (hasToken(t, ["list", "describe"]) || isInfoOnly(t)) && !hasMutatingCloudVerb(t),
+  az: (t) => (hasToken(t, ["list", "show"]) || isInfoOnly(t)) && !hasMutatingCloudVerb(t),
+  // version control (read-only verbs only)
+  git: (t) => allowFirstVerb(t, ["status", "log", "show", "diff", "branch", "remote", "config", "rev-parse", "ls-files", "ls-remote", "describe", "tag", "shortlog", "cat-file", "symbolic-ref"]),
+  gh: (t) => allowFirstVerb(t, ["repo", "pr", "issue", "release", "api", "auth", "status"]) && hasToken(t, ["list", "view", "status", "get"])
+};
+var FETCH_RULES = {
+  curl: (t) => !t.some((x) => /^-X$/i.test(x) || /^--request$/i.test(x) || /^-[dF]$/.test(x) || /^--data/i.test(x) || /^--form$/i.test(x) || /^-[oO]$/.test(x) || /^--output$/i.test(x) || /^--upload-file$/i.test(x)),
+  wget: (t) => !t.some((x) => /^-O$/.test(x) || /^--output-document/i.test(x) || /^--post-data/i.test(x) || /^--method/i.test(x) || /^-i$/.test(x))
+};
+var READONLY_PS_VERBS = /* @__PURE__ */ new Set([
+  "get",
+  "select",
+  "where",
+  "measure",
+  "sort",
+  "format",
+  "out",
+  "convertto",
+  "convertfrom",
+  "compare",
+  "test",
+  "resolve",
+  "split",
+  "join",
+  "group",
+  "foreach",
+  "write",
+  "read",
+  "show",
+  "find",
+  "search",
+  "tee"
+]);
+var READONLY_PS_BARE = /* @__PURE__ */ new Set(["where", "select", "sort", "foreach", "ft", "fl", "gci", "gc", "gm", "gps", "gsv", "echo", "write-host", "write-output"]);
+function allowFirstVerb(tokens, verbs) {
+  const verb = tokens.find((t) => !t.startsWith("-"));
+  return verb !== void 0 && verbs.includes(verb.toLowerCase());
+}
+function hasToken(tokens, any) {
+  const lower = tokens.map((t) => t.toLowerCase());
+  return any.some((a) => lower.includes(a));
+}
+function isInfoOnly(tokens) {
+  return hasToken(tokens, ["config", "account", "version", "info"]);
+}
+var MUTATING_CLOUD = /^(create|delete|update|put|set|add|remove|deploy|run|start|stop|restart|reboot|terminate|modify|attach|detach|associate|disassociate|enable|disable|invoke|exec|apply|destroy|scale|patch|register|deregister|import|copy|move|rename|reset|rotate|revoke|grant)([-_].*)?$/i;
+function hasMutatingCloudVerb(tokens) {
+  return tokens.some((t) => !t.startsWith("-") && MUTATING_CLOUD.test(t));
+}
+function containsAwsReadAction(tokens) {
+  return tokens.some((t) => /^(describe|list|get|lookup|search|scan|view|ls)[-_a-z0-9]*$/i.test(t) || t.toLowerCase() === "ls");
+}
+function hasMutatingDockerVerb(tokens) {
+  return tokens.some((t) => /^(run|rm|rmi|exec|build|push|pull|start|stop|kill|create|commit|cp|save|load|tag|login|logout|prune|kill|restart|pause|unpause|rename|update|export|import)$/i.test(t));
+}
+function splitSegments(cmd) {
+  const segments = [];
+  let buf = "";
+  let quote = null;
+  for (let i = 0; i < cmd.length; i++) {
+    const c = cmd[i];
+    const next = cmd[i + 1];
+    if (quote) {
+      buf += c;
+      if (c === quote) quote = null;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      buf += c;
+      continue;
+    }
+    if (c === "|" && next === "|" || c === "&" && next === "&") {
+      segments.push(buf);
+      buf = "";
+      i++;
+      continue;
+    }
+    if (c === "|" || c === ";" || c === "\n") {
+      segments.push(buf);
+      buf = "";
+      continue;
+    }
+    buf += c;
+  }
+  segments.push(buf);
+  return segments.map((s) => s.trim()).filter(Boolean);
+}
+function tokenize(segment) {
+  const tokens = [];
+  let buf = "";
+  let quote = null;
+  let started = false;
+  const push = () => {
+    if (started) {
+      tokens.push(buf);
+      buf = "";
+      started = false;
+    }
+  };
+  for (let i = 0; i < segment.length; i++) {
+    const c = segment[i];
+    if (quote) {
+      if (c === quote) quote = null;
+      else buf += c;
+      started = true;
+      continue;
+    }
+    if (c === '"' || c === "'") {
+      quote = c;
+      started = true;
+      continue;
+    }
+    if (c === " " || c === "	") {
+      push();
+      continue;
+    }
+    buf += c;
+    started = true;
+  }
+  push();
+  return tokens;
+}
+function baseName(executable) {
+  const noPath = executable.split(/[\\/]/).pop() ?? executable;
+  return noPath.toLowerCase();
+}
+function findIsReadOnly(rest) {
+  return !rest.some((t) => /^-(exec|execdir|ok|okdir|delete|fprintf|fprint|fls)$/i.test(t));
+}
+function awkSedIsReadOnly(exe, rest) {
+  const program = rest.join(" ");
+  if (exe === "awk") return !/\bsystem\s*\(/.test(program) && !/\|\s*["']/.test(program) && !/print\s*>/.test(program);
+  return !/(^|;|\{|\s)e\b/.test(program) && !/s[^\s]*\/[a-z]*e[a-z]*\b/i.test(program) && !/\bw\s+\S/.test(program);
+}
+function isWriteRedirect(segment) {
+  const stripped = segment.replace(/\d?>>?\s*\/dev\/null/g, "").replace(/\d?>\s*&\s*\d/g, "").replace(/\d?>\s*\$null/gi, "");
+  return /(^|[^0-9&])>>?/.test(stripped);
+}
+function checkReadOnly(command, opts = {}) {
+  const cmd = command.trim();
+  if (!cmd) return { allowed: false, reason: "empty command" };
+  if (opts.shell === "powershell") {
+    if (isWriteRedirect(cmd)) return { allowed: false, reason: "file-writing redirect is not allowed" };
+    if (DANGEROUS_PS.test(cmd)) return { allowed: false, reason: "mutating PowerShell cmdlet is not allowed" };
+    if (DANGEROUS_POSIX.test(cmd)) return { allowed: false, reason: "destructive command is not allowed" };
+    return { allowed: true };
+  }
+  if (/\$\(|`/.test(cmd)) return { allowed: false, reason: "command substitution is not allowed" };
+  if (isWriteRedirect(cmd)) return { allowed: false, reason: "file-writing redirect is not allowed" };
+  for (const segment of splitSegments(cmd)) {
+    const r = checkSegment(segment);
+    if (!r.allowed) return r;
+  }
+  return { allowed: true };
+}
+function checkSegment(segment) {
+  let tokens = tokenize(segment).filter((t) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(t)).filter((t) => t !== "{" && t !== "}" && t !== "(" && t !== ")");
+  if (tokens.length === 0) return { allowed: true };
+  let exe = baseName(tokens[0]);
+  let rest = tokens.slice(1);
+  while (COMMAND_RUNNERS.has(exe)) {
+    const inner = [];
+    let i = 0;
+    for (; i < rest.length; i++) {
+      const t = rest[i];
+      if (t.startsWith("-")) {
+        if (/^-(I|n|L|P|d|s|E|u|g)$/.test(t)) i++;
+        continue;
+      }
+      inner.push(...rest.slice(i));
+      break;
+    }
+    if (inner.length === 0) return { allowed: true };
+    exe = baseName(inner[0]);
+    rest = inner.slice(1);
+  }
+  if (exe === "find") {
+    if (!findIsReadOnly(rest)) return { allowed: false, reason: "find: -exec/-delete is not allowed" };
+    return { allowed: true };
+  }
+  if (exe === "awk" || exe === "sed") {
+    if (!awkSedIsReadOnly(exe, rest)) return { allowed: false, reason: `${exe}: program may not shell out or write files` };
+    return { allowed: true };
+  }
+  if (PKG_MANAGERS.has(exe)) {
+    if (rest.some((t) => MUTATING_PKG.test(t))) return { allowed: false, reason: `${exe}: only list/query sub-commands are allowed` };
+    return { allowed: true };
+  }
+  if (FETCH_RULES[exe]) {
+    if (!FETCH_RULES[exe](rest)) return { allowed: false, reason: `${exe}: only read-only GET requests are allowed` };
+    return { allowed: true };
+  }
+  if (SUBCOMMAND_RULES[exe]) {
+    if (!SUBCOMMAND_RULES[exe](rest)) return { allowed: false, reason: `${exe}: sub-command is not read-only` };
+    return { allowed: true };
+  }
+  if (CONDITIONAL_BINARIES.has(exe)) {
+    if (rest.some((t) => !t.startsWith("-") && t !== "/dev/null")) return { allowed: false, reason: "tee may only write to /dev/null" };
+    return { allowed: true };
+  }
+  if (READONLY_BINARIES.has(exe)) return { allowed: true };
+  if (READONLY_PS_BARE.has(exe)) return { allowed: true };
+  if (exe.includes("-") && /^[a-z]+-[a-z]/.test(exe)) {
+    const verb = exe.split("-")[0];
+    if (READONLY_PS_VERBS.has(verb)) return { allowed: true };
+    return { allowed: false, reason: `PowerShell cmdlet not read-only: ${exe}` };
+  }
+  return { allowed: false, reason: `command not on read-only allowlist: ${exe}` };
+}
+
+// src/logger.ts
+var verboseMode = false;
+function setVerbose(v) {
+  verboseMode = v;
+}
+function log(level, message, context) {
+  if (level === "DEBUG" && !verboseMode) return;
+  const entry = {
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    level,
+    message,
+    ...context && Object.keys(context).length > 0 ? { context } : {}
+  };
+  process.stderr.write(JSON.stringify(entry) + "\n");
+}
+function logDebug(message, context) {
+  log("DEBUG", message, context);
+}
+function logInfo(message, context) {
+  log("INFO", message, context);
+}
+function logWarn(message, context) {
+  log("WARN", message, context);
+}
+function logError(message, context) {
+  log("ERROR", message, context);
+}
+
+// src/platform.ts
+var PLATFORM = process.platform;
+var IS_WIN = PLATFORM === "win32";
+var IS_MAC = PLATFORM === "darwin";
+var IS_LINUX = PLATFORM === "linux";
+var HOME = homedir();
+function platformShell() {
+  if (!IS_WIN) return "/bin/sh";
+  try {
+    execSync("pwsh -Version", { stdio: "pipe", timeout: 3e3 });
+    return "pwsh";
+  } catch {
+    return "powershell.exe";
+  }
+}
+var _shell;
+function getShell() {
+  if (!_shell) _shell = platformShell();
+  return _shell;
+}
+var SAFE_ENV_KEYS = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LANG",
+  "LC_ALL",
+  "TERM",
+  "SHELL",
+  "USERPROFILE",
+  "LOCALAPPDATA",
+  "APPDATA",
+  "PROGRAMFILES",
+  "XDG_CONFIG_HOME",
+  "XDG_DATA_HOME",
+  "XDG_RUNTIME_DIR",
+  "AWS_DEFAULT_REGION",
+  "AWS_PROFILE",
+  "AWS_CONFIG_FILE",
+  "KUBECONFIG",
+  "GOOGLE_APPLICATION_CREDENTIALS",
+  "AZURE_CONFIG_DIR"
+];
+function safeEnv() {
+  const env = {};
+  for (const key of SAFE_ENV_KEYS) {
+    if (process.env[key]) env[key] = process.env[key];
+  }
+  return env;
+}
+function run(cmd, opts = {}) {
+  const policy = checkReadOnly(cmd, { shell: IS_WIN ? "powershell" : "posix" });
+  if (!policy.allowed) {
+    logWarn(`Blocked non-read-only command: ${policy.reason}`);
+    return "";
+  }
+  try {
+    return execSync(cmd, {
+      stdio: "pipe",
+      timeout: opts.timeout ?? 1e4,
+      shell: getShell(),
+      env: opts.env ?? safeEnv()
+    }).toString().trim();
+  } catch {
+    return "";
+  }
+}
+function commandExists(cmd) {
+  if (IS_WIN) {
+    const r = run(`Get-Command ${cmd} -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source`, { timeout: 5e3 });
+    return r;
+  }
+  return run(`which ${cmd} 2>/dev/null`);
+}
+function userDataDir() {
+  if (IS_WIN) return process.env.APPDATA ?? join(HOME, "AppData", "Roaming");
+  if (IS_MAC) return join(HOME, "Library", "Application Support");
+  return process.env.XDG_DATA_HOME ?? join(HOME, ".local", "share");
+}
+function browserBasePaths() {
+  if (IS_WIN) {
+    const local = process.env.LOCALAPPDATA ?? join(HOME, "AppData", "Local");
+    return {
+      chrome: join(local, "Google", "Chrome", "User Data"),
+      chromium: join(local, "Chromium", "User Data"),
+      edge: join(local, "Microsoft", "Edge", "User Data"),
+      brave: join(local, "BraveSoftware", "Brave-Browser", "User Data"),
+      vivaldi: join(local, "Vivaldi", "User Data"),
+      opera: join(userDataDir(), "Opera Software", "Opera Stable")
+    };
+  }
+  if (IS_MAC) {
+    const lib = join(HOME, "Library", "Application Support");
+    return {
+      chrome: join(lib, "Google", "Chrome"),
+      chromium: join(lib, "Chromium"),
+      edge: join(lib, "Microsoft Edge"),
+      brave: join(lib, "BraveSoftware", "Brave-Browser"),
+      vivaldi: join(lib, "Vivaldi"),
+      opera: join(lib, "com.operasoftware.Opera")
+    };
+  }
+  return {
+    chrome: join(HOME, ".config", "google-chrome"),
+    chromium: join(HOME, ".config", "chromium"),
+    edge: join(HOME, ".config", "microsoft-edge"),
+    brave: join(HOME, ".config", "BraveSoftware", "Brave-Browser"),
+    vivaldi: join(HOME, ".config", "vivaldi"),
+    opera: join(HOME, ".config", "opera")
+  };
+}
+function firefoxBaseDirs() {
+  if (IS_WIN) {
+    const roaming = process.env.APPDATA ?? join(HOME, "AppData", "Roaming");
+    return [join(roaming, "Mozilla", "Firefox", "Profiles")];
+  }
+  if (IS_MAC) {
+    return [join(HOME, "Library", "Application Support", "Firefox", "Profiles")];
+  }
+  return [
+    join(HOME, ".mozilla", "firefox"),
+    join(HOME, "snap", "firefox", "common", ".mozilla", "firefox"),
+    join(HOME, ".var", "app", "org.mozilla.firefox", ".mozilla", "firefox")
+  ];
+}
+function dbScanDirs() {
+  const dirs = [];
+  if (IS_WIN) {
+    const local = process.env.LOCALAPPDATA ?? join(HOME, "AppData", "Local");
+    const roaming = process.env.APPDATA ?? join(HOME, "AppData", "Roaming");
+    dirs.push(local, roaming);
+    const pd = join(HOME, "AppData", "Local", "Programs");
+    if (existsSync(pd)) dirs.push(pd);
+  } else if (IS_MAC) {
+    dirs.push(join(HOME, "Library", "Application Support"));
+    if (existsSync("/var/lib")) dirs.push("/var/lib");
+  } else {
+    const configDir = join(HOME, ".config");
+    const dataDir = join(HOME, ".local", "share");
+    if (existsSync(configDir)) dirs.push(configDir);
+    if (existsSync(dataDir)) dirs.push(dataDir);
+    if (existsSync("/var/lib")) dirs.push("/var/lib");
+  }
+  return dirs.filter((d) => existsSync(d));
+}
+function findFiles(dirs, patterns, maxDepth, limit) {
+  if (dirs.length === 0) return "";
+  if (IS_WIN) {
+    const includes = patterns.map((p) => `'${p}'`).join(",");
+    const pathList = dirs.map((d) => `'${d}'`).join(",");
+    return run(
+      `Get-ChildItem -Path ${pathList} -Recurse -Depth ${maxDepth} -Include ${includes} -ErrorAction SilentlyContinue | Select-Object -First ${limit} -ExpandProperty FullName`,
+      { timeout: 15e3 }
+    );
+  }
+  const nameArgs = patterns.map((p) => `-name "${p}"`).join(" -o ");
+  const findCmds = dirs.map((d) => `find "${d}" -maxdepth ${maxDepth} \\( ${nameArgs} \\) 2>/dev/null`).join("; ");
+  return run(`{ ${findCmds}; } | head -${limit}`, { timeout: 15e3 });
+}
+function scanListeningPorts() {
+  if (IS_WIN) {
+    return run(
+      `Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; "$($_.LocalAddress):$($_.LocalPort) PID=$($_.OwningProcess) $($p.ProcessName)" } | Sort-Object -Unique`,
+      { timeout: 15e3 }
+    );
+  }
+  if (IS_MAC) {
+    return run("sudo lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null || lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null", { timeout: 15e3 });
+  }
+  return run("ss -tlnp 2>/dev/null", { timeout: 1e4 });
+}
+function scanWindowsPrograms() {
+  if (!IS_WIN) return "";
+  return run(
+    `$paths = @('HKLM:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKLM:\\Software\\Wow6432Node\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*','HKCU:\\Software\\Microsoft\\Windows\\CurrentVersion\\Uninstall\\*'); Get-ItemProperty $paths -ErrorAction SilentlyContinue | Where-Object { $_.DisplayName } | Select-Object -Property DisplayName, Publisher, DisplayVersion | Sort-Object DisplayName | Format-Table -AutoSize | Out-String -Width 300`,
+    { timeout: 2e4 }
+  );
+}
+function scanWindowsDbServices() {
+  if (!IS_WIN) return "";
+  return run(
+    `Get-Service | Where-Object { $_.Name -match 'postgres|mysql|mariadb|mongo|redis|MSSQL|elastic|clickhouse|cassandra' } | Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize`,
+    { timeout: 1e4 }
+  );
+}
+
+// src/bookmarks.ts
+function cleanupTempFiles() {
+  let cleaned = 0;
+  const tmp = tmpdir();
+  try {
+    for (const f of readdirSync(tmp)) {
+      if (f.startsWith("cartograph_") && f.endsWith(".sqlite")) {
+        try {
+          unlinkSync(join2(tmp, f));
+          cleaned++;
+        } catch {
+        }
+      }
+    }
+  } catch {
+  }
+  return cleaned;
+}
+function extractHost(rawUrl, source) {
+  try {
+    const u = new URL(rawUrl);
+    if (u.protocol !== "http:" && u.protocol !== "https:") return null;
+    const protocol = u.protocol === "https:" ? "https" : "http";
+    const port = u.port ? parseInt(u.port, 10) : protocol === "https" ? 443 : 80;
+    const hostname = u.hostname.toLowerCase();
+    if (!hostname || hostname === "localhost" || hostname === "127.0.0.1") return null;
+    return { hostname, port, protocol, source };
+  } catch {
+    return null;
+  }
+}
+function walkChrome(node, source, out) {
+  if (node.type === "url" && node.url) {
+    const h = extractHost(node.url, source);
+    if (h) out.push(h);
+  }
+  if (node.children) {
+    for (const child of node.children) walkChrome(child, source, out);
+  }
+}
+function readChromeLike(filePath, source) {
+  if (!existsSync2(filePath)) return [];
+  try {
+    const raw = JSON.parse(readFileSync(filePath, "utf8"));
+    const out = [];
+    for (const root of Object.values(raw.roots)) {
+      if (root) walkChrome(root, source, out);
+    }
+    return out;
+  } catch {
+    return [];
+  }
+}
+async function queryBrowserDb(srcPath, tmpPrefix, query) {
+  if (!existsSync2(srcPath)) return [];
+  const tmp = join2(tmpdir(), `cartograph_${tmpPrefix}_${Date.now()}.sqlite`);
+  try {
+    copyFileSync(srcPath, tmp);
+    const { default: Database } = await import("better-sqlite3");
+    const db = new Database(tmp, { readonly: true, fileMustExist: true });
+    try {
+      return db.prepare(query).all();
+    } finally {
+      db.close();
+    }
+  } catch {
+    return [];
+  } finally {
+    try {
+      unlinkSync(tmp);
+    } catch {
+    }
+  }
+}
+async function readFirefoxBookmarks(profileDir) {
+  const rows = await queryBrowserDb(
+    join2(profileDir, "places.sqlite"),
+    "ff_bm",
+    `SELECT DISTINCT p.url FROM moz_places p
+     JOIN moz_bookmarks b ON b.fk = p.id
+     WHERE b.type = 1 AND p.url NOT LIKE 'place:%' LIMIT 3000`
+  );
+  return rows.map((r) => extractHost(r.url, "firefox")).filter((h) => h !== null);
+}
+async function readFirefoxHistory(profileDir) {
+  const rows = await queryBrowserDb(
+    join2(profileDir, "places.sqlite"),
+    "ff_hist",
+    `SELECT url, visit_count FROM moz_places
+     WHERE url NOT LIKE 'place:%' AND visit_count > 0
+     ORDER BY visit_count DESC LIMIT 5000`
+  );
+  return rows.map((r) => {
+    const h = extractHost(r.url, "firefox");
+    return h ? { ...h, visitCount: r.visit_count } : null;
+  }).filter((h) => h !== null);
+}
+async function readChromiumHistory(historyPath, source) {
+  const rows = await queryBrowserDb(
+    historyPath,
+    "ch_hist",
+    `SELECT url, visit_count FROM urls
+     WHERE hidden = 0 AND visit_count > 0
+     ORDER BY visit_count DESC LIMIT 5000`
+  );
+  return rows.map((r) => {
+    const h = extractHost(r.url, source);
+    return h ? { ...h, visitCount: r.visit_count } : null;
+  }).filter((h) => h !== null);
+}
+var IS_LINUX2 = !IS_MAC && !IS_WIN;
+function chromeLikePaths(base) {
+  const paths = [];
+  const defaultPath = join2(base, "Default", "Bookmarks");
+  if (existsSync2(defaultPath)) paths.push(defaultPath);
+  if (existsSync2(base)) {
+    try {
+      for (const entry of readdirSync(base)) {
+        if (entry.startsWith("Profile ")) {
+          const p = join2(base, entry, "Bookmarks");
+          if (existsSync2(p)) paths.push(p);
+        }
+      }
+    } catch {
+    }
+  }
+  return paths;
+}
+function chromeLikeHistoryPaths(base) {
+  const paths = [];
+  const defaultPath = join2(base, "Default", "History");
+  if (existsSync2(defaultPath)) paths.push(defaultPath);
+  if (existsSync2(base)) {
+    try {
+      for (const entry of readdirSync(base)) {
+        if (entry.startsWith("Profile ")) {
+          const p = join2(base, entry, "History");
+          if (existsSync2(p)) paths.push(p);
+        }
+      }
+    } catch {
+    }
+  }
+  return paths;
+}
+var BROWSER_BASES = browserBasePaths();
+var CHROME_BASE = BROWSER_BASES.chrome;
+var CHROMIUM_BASE = BROWSER_BASES.chromium;
+var EDGE_BASE = BROWSER_BASES.edge;
+var BRAVE_BASE = BROWSER_BASES.brave;
+var VIVALDI_BASE = BROWSER_BASES.vivaldi;
+var OPERA_BASE = BROWSER_BASES.opera;
+var CHROMIUM_SNAP_BASE = join2(HOME, "snap", "chromium", "common", "chromium");
+var CHROMIUM_FLATPAK_BASE = join2(HOME, ".var", "app", "org.chromium.Chromium", "config", "chromium");
+var CHROME_FLATPAK_BASE = join2(HOME, ".var", "app", "com.google.Chrome", "config", "google-chrome");
+var BRAVE_FLATPAK_BASE = join2(HOME, ".var", "app", "com.brave.Browser", "config", "BraveSoftware", "Brave-Browser");
+var EDGE_FLATPAK_BASE = join2(HOME, ".var", "app", "com.microsoft.Edge", "config", "microsoft-edge");
+function firefoxProfileDirs() {
+  const bases = firefoxBaseDirs();
+  const dirs = [];
+  for (const base of bases) {
+    if (!existsSync2(base)) continue;
+    try {
+      for (const d of readdirSync(base)) {
+        const full = join2(base, d);
+        try {
+          if (statSync(full).isDirectory() && existsSync2(join2(full, "places.sqlite"))) {
+            dirs.push(full);
+          }
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  return dirs;
+}
+async function scanAllBookmarks() {
+  const all = [];
+  for (const p of chromeLikePaths(CHROME_BASE)) all.push(...readChromeLike(p, "chrome"));
+  for (const p of chromeLikePaths(CHROMIUM_BASE)) all.push(...readChromeLike(p, "chromium"));
+  for (const p of chromeLikePaths(EDGE_BASE)) all.push(...readChromeLike(p, "edge"));
+  for (const p of chromeLikePaths(BRAVE_BASE)) all.push(...readChromeLike(p, "brave"));
+  for (const p of chromeLikePaths(VIVALDI_BASE)) all.push(...readChromeLike(p, "vivaldi"));
+  for (const p of chromeLikePaths(OPERA_BASE)) all.push(...readChromeLike(p, "opera"));
+  if (IS_LINUX2) {
+    for (const p of chromeLikePaths(CHROMIUM_SNAP_BASE)) all.push(...readChromeLike(p, "chromium-snap"));
+    for (const p of chromeLikePaths(CHROMIUM_FLATPAK_BASE)) all.push(...readChromeLike(p, "chromium-flatpak"));
+    for (const p of chromeLikePaths(CHROME_FLATPAK_BASE)) all.push(...readChromeLike(p, "chrome-flatpak"));
+    for (const p of chromeLikePaths(BRAVE_FLATPAK_BASE)) all.push(...readChromeLike(p, "brave-flatpak"));
+    for (const p of chromeLikePaths(EDGE_FLATPAK_BASE)) all.push(...readChromeLike(p, "edge-flatpak"));
+  }
+  for (const dir of firefoxProfileDirs()) {
+    all.push(...await readFirefoxBookmarks(dir));
+  }
+  const seen = /* @__PURE__ */ new Set();
+  return all.filter((h) => {
+    if (seen.has(h.hostname)) return false;
+    seen.add(h.hostname);
+    return true;
+  });
+}
+async function scanAllHistory() {
+  const all = [];
+  for (const p of chromeLikeHistoryPaths(CHROME_BASE)) all.push(...await readChromiumHistory(p, "chrome"));
+  for (const p of chromeLikeHistoryPaths(CHROMIUM_BASE)) all.push(...await readChromiumHistory(p, "chromium"));
+  for (const p of chromeLikeHistoryPaths(EDGE_BASE)) all.push(...await readChromiumHistory(p, "edge"));
+  for (const p of chromeLikeHistoryPaths(BRAVE_BASE)) all.push(...await readChromiumHistory(p, "brave"));
+  for (const p of chromeLikeHistoryPaths(VIVALDI_BASE)) all.push(...await readChromiumHistory(p, "vivaldi"));
+  for (const p of chromeLikeHistoryPaths(OPERA_BASE)) all.push(...await readChromiumHistory(p, "opera"));
+  if (IS_LINUX2) {
+    for (const p of chromeLikeHistoryPaths(CHROMIUM_SNAP_BASE)) all.push(...await readChromiumHistory(p, "chromium-snap"));
+    for (const p of chromeLikeHistoryPaths(CHROMIUM_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, "chromium-flatpak"));
+    for (const p of chromeLikeHistoryPaths(CHROME_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, "chrome-flatpak"));
+    for (const p of chromeLikeHistoryPaths(BRAVE_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, "brave-flatpak"));
+    for (const p of chromeLikeHistoryPaths(EDGE_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, "edge-flatpak"));
+  }
+  for (const dir of firefoxProfileDirs()) {
+    all.push(...await readFirefoxHistory(dir));
+  }
+  const byHost = /* @__PURE__ */ new Map();
+  for (const h of all) {
+    const existing = byHost.get(h.hostname);
+    if (existing) {
+      existing.visitCount += h.visitCount;
+    } else {
+      byHost.set(h.hostname, { ...h });
+    }
+  }
+  return [...byHost.values()].sort((a, b) => b.visitCount - a.visitCount);
+}
+
+export {
+  checkReadOnly,
+  setVerbose,
+  logDebug,
+  logInfo,
+  logWarn,
+  logError,
+  PLATFORM,
+  IS_WIN,
+  IS_MAC,
+  IS_LINUX,
+  HOME,
+  run,
+  commandExists,
+  dbScanDirs,
+  findFiles,
+  scanListeningPorts,
+  scanWindowsPrograms,
+  scanWindowsDbServices,
+  cleanupTempFiles,
+  extractHost,
+  walkChrome,
+  readChromeLike,
+  readFirefoxHistory,
+  chromeLikePaths,
+  chromeLikeHistoryPaths,
+  scanAllBookmarks,
+  scanAllHistory
+};
+//# sourceMappingURL=chunk-CJ2PITFA.js.map