@geminixiang/mikan 0.2.0 → 0.2.1

package/dist/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IAGzB,OAAO,CAAC,cAAc,CAA6B;IAEnD,YAAY,MAAM,EAAE,kBAAkB,EAMrC;IAED;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIvC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMrE;IAED;;;OAGG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACpF,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CA+BvB;IAED;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CA8B5E;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBjD;YAKa,kBAAkB;CAoBjC","sourcesContent":["import { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport { ensureDirExists, isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    ensureDirExists(this.workingDir);\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    ensureDirExists(channelDir);\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment | null>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachment(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);\n            return null;\n          }),\n      );\n    }\n\n    const attachments = await Promise.all(downloads);\n    return attachments.filter((attachment): attachment is Attachment => attachment !== null);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    const content = readTextFileIfExists(logPath);\n    if (content === undefined) {\n      return null;\n    }\n\n    try {\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = parseJsonValue(\n        lastLine,\n        (value): value is LoggedMessage => isRecord(value) && typeof value.ts === \"string\",\n        (detail) => (detail === \"unexpected JSON shape\" ? \"log entry missing timestamp\" : detail),\n      );\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    ensureDirExists(parentDir);\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,UAAU;IACzB,QAAQ,EAAE,MAAM,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,UAAU,EAAE,CAAC;IAC1B,KAAK,EAAE,OAAO,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,kBAAkB;IACjC,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;CAClB;AAgBD,qBAAa,YAAY;IACvB,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,QAAQ,CAAS;IAGzB,OAAO,CAAC,cAAc,CAA6B;IAEnD,YAAY,MAAM,EAAE,kBAAkB,EAMrC;IAED;;OAEG;IACH,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAIvC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAY,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,MAAM,CAMrE;IAED;;;OAGG;IACG,kBAAkB,CACtB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,KAAK,CAAC;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;QAAC,WAAW,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,EACpF,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,UAAU,EAAE,CAAC,CA8BvB;IAED;;;OAGG;IACG,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CA+B5E;IAED;;OAEG;IACG,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAS/E;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAsBjD;YAKa,2BAA2B;YAQ3B,kBAAkB;CAuBjC","sourcesContent":["import { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport { ensureDirExists, isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport { withRetry } from \"./adapters/shared.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nclass AttachmentDownloadHttpError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n  ) {\n    super(message);\n  }\n}\n\nfunction isRetryableAttachmentDownloadError(error: unknown): boolean {\n  if (!(error instanceof AttachmentDownloadHttpError)) return true;\n  return error.status === 408 || error.status === 429 || error.status >= 500;\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    ensureDirExists(this.workingDir);\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    ensureDirExists(channelDir);\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        throw new Error(`Attachment missing name for URL: ${url}`);\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachmentWithRetry(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            throw new Error(`Failed to download attachment ${localPath}: ${errorMsg}`, {\n              cause: error,\n            });\n          }),\n      );\n    }\n\n    return Promise.all(downloads);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n\n    // Mark as logged only after the append succeeds. Otherwise a transient\n    // write failure can make retries look like duplicates and drop messages.\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    const content = readTextFileIfExists(logPath);\n    if (content === undefined) {\n      return null;\n    }\n\n    try {\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = parseJsonValue(\n        lastLine,\n        (value): value is LoggedMessage => isRecord(value) && typeof value.ts === \"string\",\n        (detail) => (detail === \"unexpected JSON shape\" ? \"log entry missing timestamp\" : detail),\n      );\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachmentWithRetry(localPath: string, url: string): Promise<void> {\n    await withRetry(() => this.downloadAttachment(localPath, url), {\n      maxAttempts: 3,\n      baseDelayMs: 250,\n      isRateLimited: isRetryableAttachmentDownloadError,\n    });\n  }\n\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    ensureDirExists(parentDir);\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new AttachmentDownloadHttpError(\n        `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n      );\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}

package/dist/store.js

@@ -1,7 +1,18 @@
 import { appendFile, writeFile } from "fs/promises";
 import { join } from "path";
 import { ensureDirExists, isRecord, parseJsonValue, readTextFileIfExists } from "./file-guards.js";
-import * as log from "./log.js";
+import { withRetry } from "./adapters/shared.js";
+class AttachmentDownloadHttpError extends Error {
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+    }
+}
+function isRetryableAttachmentDownloadError(error) {
+    if (!(error instanceof AttachmentDownloadHttpError))
+        return true;
+    return error.status === 408 || error.status === 429 || error.status >= 500;
+}
 export class ChannelStore {
     constructor(config) {
         // Track recently logged message timestamps to prevent duplicates
@@ -41,8 +52,7 @@ export class ChannelStore {
             if (!url)
                 continue;
             if (!file.name) {
-                log.logWarning("Attachment missing name, skipping", url);
-                continue;
+                throw new Error(`Attachment missing name for URL: ${url}`);
             }
             const filename = this.generateLocalFilename(file.name, timestamp);
             const localPath = `${channelId}/attachments/${filename}`;
@@ -50,16 +60,16 @@ export class ChannelStore {
                 original: file.name,
                 localPath,
             };
-            downloads.push(this.downloadAttachment(localPath, url)
+            downloads.push(this.downloadAttachmentWithRetry(localPath, url)
                 .then(() => attachment)
                 .catch((error) => {
                 const errorMsg = error instanceof Error ? error.message : String(error);
-                log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);
-                return null;
+                throw new Error(`Failed to download attachment ${localPath}: ${errorMsg}`, {
+                    cause: error,
+                });
             }));
         }
-        const attachments = await Promise.all(downloads);
-        return attachments.filter((attachment) => attachment !== null);
+        return Promise.all(downloads);
     }
     /**
      * Log a message to the channel's log.jsonl
@@ -71,9 +81,6 @@ export class ChannelStore {
         if (this.recentlyLogged.has(dedupeKey)) {
             return false; // Already logged
         }
-        // Mark as logged and schedule cleanup after 60 seconds
-        this.recentlyLogged.set(dedupeKey, Date.now());
-        setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);
         const logPath = join(this.getChannelDir(channelId), "log.jsonl");
         // Ensure message has a date field
         if (!message.date) {
@@ -91,6 +98,10 @@ export class ChannelStore {
         }
         const line = `${JSON.stringify(message)}\n`;
         await appendFile(logPath, line, "utf-8");
+        // Mark as logged only after the append succeeds. Otherwise a transient
+        // write failure can make retries look like duplicates and drop messages.
+        this.recentlyLogged.set(dedupeKey, Date.now());
+        setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);
         return true;
     }
     /**
@@ -132,6 +143,13 @@ export class ChannelStore {
     /**
      * Download a single attachment
      */
+    async downloadAttachmentWithRetry(localPath, url) {
+        await withRetry(() => this.downloadAttachment(localPath, url), {
+            maxAttempts: 3,
+            baseDelayMs: 250,
+            isRateLimited: isRetryableAttachmentDownloadError,
+        });
+    }
     async downloadAttachment(localPath, url) {
         const filePath = join(this.workingDir, localPath);
         // Ensure directory exists
@@ -143,7 +161,7 @@ export class ChannelStore {
             },
         });
         if (!response.ok) {
-            throw new Error(`HTTP ${response.status}: ${response.statusText}`);
+            throw new AttachmentDownloadHttpError(`HTTP ${response.status}: ${response.statusText}`, response.status);
         }
         const buffer = await response.arrayBuffer();
         await writeFile(filePath, Buffer.from(buffer));

package/dist/store.js.map

@@ -1 +1 @@
-{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,KAAK,GAAG,MAAM,UAAU,CAAC;AAwBhC,MAAM,OAAO,YAAY;IAOvB,YAAY,MAA0B;QAJtC,iEAAiE;QACjE,iEAAiE;QACzD,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGjD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,kCAAkC;QAClC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;QAC3D,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,yDAAyD;QACzD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,KAAoF,EACpF,SAAiB;QAEjB,MAAM,SAAS,GAAsC,EAAE,CAAC;QAExD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,GAAG,CAAC,UAAU,CAAC,mCAAmC,EAAE,GAAG,CAAC,CAAC;gBACzD,SAAS;YACX,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,GAAG,SAAS,gBAAgB,QAAQ,EAAE,CAAC;YACzD,MAAM,UAAU,GAAe;gBAC7B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC;YAEF,SAAS,CAAC,IAAI,CACZ,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC;iBACpC,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;iBACtB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,GAAG,CAAC,UAAU,CAAC,+BAA+B,EAAE,GAAG,SAAS,KAAK,QAAQ,EAAE,CAAC,CAAC;gBAC7E,OAAO,IAAI,CAAC;YACd,CAAC,CAAC,CACL,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QACjD,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC,UAAU,EAA4B,EAAE,CAAC,UAAU,KAAK,IAAI,CAAC,CAAC;IAC3F,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAsB;QACxD,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,iBAAiB;QACjC,CAAC;QAED,uDAAuD;QACvD,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAE/D,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,8BAA8B;YAC9B,IAAI,IAAU,CAAC;YACf,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,6CAA6C;gBAC7C,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,qBAAqB;gBACrB,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QACzC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,EAAE;YACF,IAAI,EAAE,KAAK;YACX,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,cAAc,CAC5B,QAAQ,EACR,CAAC,KAAK,EAA0B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAClF,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAC1F,CAAC;YACF,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,GAAW;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElD,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,eAAe,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;aACzC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,KAAK,CAAC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport { ensureDirExists, isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport * as log from \"./log.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    ensureDirExists(this.workingDir);\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    ensureDirExists(channelDir);\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment | null>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        log.logWarning(\"Attachment missing name, skipping\", url);\n        continue;\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachment(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            log.logWarning(`Failed to download attachment`, `${localPath}: ${errorMsg}`);\n            return null;\n          }),\n      );\n    }\n\n    const attachments = await Promise.all(downloads);\n    return attachments.filter((attachment): attachment is Attachment => attachment !== null);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    // Mark as logged and schedule cleanup after 60 seconds\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    const content = readTextFileIfExists(logPath);\n    if (content === undefined) {\n      return null;\n    }\n\n    try {\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = parseJsonValue(\n        lastLine,\n        (value): value is LoggedMessage => isRecord(value) && typeof value.ts === \"string\",\n        (detail) => (detail === \"unexpected JSON shape\" ? \"log entry missing timestamp\" : detail),\n      );\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    ensureDirExists(parentDir);\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new Error(`HTTP ${response.status}: ${response.statusText}`);\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}
+{"version":3,"file":"store.js","sourceRoot":"","sources":["../src/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACpD,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,QAAQ,EAAE,cAAc,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AACnG,OAAO,EAAE,SAAS,EAAE,MAAM,sBAAsB,CAAC;AAwBjD,MAAM,2BAA4B,SAAQ,KAAK;IAC7C,YACE,OAAe,EACN,MAAc;QAEvB,KAAK,CAAC,OAAO,CAAC,CAAC;sBAFN,MAAM;IAGjB,CAAC;CACF;AAED,SAAS,kCAAkC,CAAC,KAAc;IACxD,IAAI,CAAC,CAAC,KAAK,YAAY,2BAA2B,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,IAAI,GAAG,CAAC;AAC7E,CAAC;AAED,MAAM,OAAO,YAAY;IAOvB,YAAY,MAA0B;QAJtC,iEAAiE;QACjE,iEAAiE;QACzD,mBAAc,GAAG,IAAI,GAAG,EAAkB,CAAC;QAGjD,IAAI,CAAC,UAAU,GAAG,MAAM,CAAC,UAAU,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QAEhC,kCAAkC;QAClC,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACnC,CAAC;IAED;;OAEG;IACH,aAAa,CAAC,SAAiB;QAC7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QACpD,eAAe,CAAC,UAAU,CAAC,CAAC;QAC5B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,YAAoB,EAAE,SAAiB;QAC3D,8DAA8D;QAC9D,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC;QACpD,yDAAyD;QACzD,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC;QAChE,OAAO,GAAG,EAAE,IAAI,SAAS,EAAE,CAAC;IAC9B,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,kBAAkB,CACtB,SAAiB,EACjB,KAAoF,EACpF,SAAiB;QAEjB,MAAM,SAAS,GAA+B,EAAE,CAAC;QAEjD,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;YACzB,MAAM,GAAG,GAAG,IAAI,CAAC,oBAAoB,IAAI,IAAI,CAAC,WAAW,CAAC;YAC1D,IAAI,CAAC,GAAG;gBAAE,SAAS;YACnB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;gBACf,MAAM,IAAI,KAAK,CAAC,oCAAoC,GAAG,EAAE,CAAC,CAAC;YAC7D,CAAC;YAED,MAAM,QAAQ,GAAG,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,SAAS,GAAG,GAAG,SAAS,gBAAgB,QAAQ,EAAE,CAAC;YACzD,MAAM,UAAU,GAAe;gBAC7B,QAAQ,EAAE,IAAI,CAAC,IAAI;gBACnB,SAAS;aACV,CAAC;YAEF,SAAS,CAAC,IAAI,CACZ,IAAI,CAAC,2BAA2B,CAAC,SAAS,EAAE,GAAG,CAAC;iBAC7C,IAAI,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC;iBACtB,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE;gBACf,MAAM,QAAQ,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBACxE,MAAM,IAAI,KAAK,CAAC,iCAAiC,SAAS,KAAK,QAAQ,EAAE,EAAE;oBACzE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC,CAAC,CACL,CAAC;QACJ,CAAC;QAED,OAAO,OAAO,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,UAAU,CAAC,SAAiB,EAAE,OAAsB;QACxD,iDAAiD;QACjD,MAAM,SAAS,GAAG,GAAG,SAAS,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;QAC/C,IAAI,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,KAAK,CAAC,CAAC,iBAAiB;QACjC,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,SAAS,CAAC,EAAE,WAAW,CAAC,CAAC;QAEjE,kCAAkC;QAClC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;YAClB,8BAA8B;YAC9B,IAAI,IAAU,CAAC;YACf,IAAI,OAAO,CAAC,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC7B,6CAA6C;gBAC7C,IAAI,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;YACjD,CAAC;iBAAM,CAAC;gBACN,qBAAqB;gBACrB,IAAI,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;YAC5C,CAAC;YACD,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,IAAI,CAAC;QAC5C,MAAM,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;QAEzC,uEAAuE;QACvE,yEAAyE;QACzE,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;QAC/C,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,KAAK,CAAC,CAAC;QAC/D,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,SAAiB,EAAE,IAAY,EAAE,EAAU;QAC9D,MAAM,IAAI,CAAC,UAAU,CAAC,SAAS,EAAE;YAC/B,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,EAAE;YACF,IAAI,EAAE,KAAK;YACX,IAAI;YACJ,WAAW,EAAE,EAAE;YACf,KAAK,EAAE,IAAI;SACZ,CAAC,CAAC;IACL,CAAC;IAED;;;OAGG;IACH,gBAAgB,CAAC,SAAiB;QAChC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAC9C,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,IAAI,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YACzC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;gBAC1C,OAAO,IAAI,CAAC;YACd,CAAC;YACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YACzC,MAAM,OAAO,GAAG,cAAc,CAC5B,QAAQ,EACR,CAAC,KAAK,EAA0B,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,CAAC,EAAE,KAAK,QAAQ,EAClF,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,KAAK,uBAAuB,CAAC,CAAC,CAAC,6BAA6B,CAAC,CAAC,CAAC,MAAM,CAAC,CAC1F,CAAC;YACF,OAAO,OAAO,CAAC,EAAE,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;OAEG;IACK,KAAK,CAAC,2BAA2B,CAAC,SAAiB,EAAE,GAAW;QACtE,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,kBAAkB,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE;YAC7D,WAAW,EAAE,CAAC;YACd,WAAW,EAAE,GAAG;YAChB,aAAa,EAAE,kCAAkC;SAClD,CAAC,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,kBAAkB,CAAC,SAAiB,EAAE,GAAW;QAC7D,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;QAElD,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,SAAS,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QAC5F,eAAe,CAAC,SAAS,CAAC,CAAC;QAE3B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YAChC,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,IAAI,CAAC,QAAQ,EAAE;aACzC;SACF,CAAC,CAAC;QAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;YACjB,MAAM,IAAI,2BAA2B,CACnC,QAAQ,QAAQ,CAAC,MAAM,KAAK,QAAQ,CAAC,UAAU,EAAE,EACjD,QAAQ,CAAC,MAAM,CAChB,CAAC;QACJ,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,WAAW,EAAE,CAAC;QAC5C,MAAM,SAAS,CAAC,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IACjD,CAAC;CACF","sourcesContent":["import { appendFile, writeFile } from \"fs/promises\";\nimport { join } from \"path\";\nimport { ensureDirExists, isRecord, parseJsonValue, readTextFileIfExists } from \"./file-guards.js\";\nimport { withRetry } from \"./adapters/shared.js\";\n\nexport interface Attachment {\n  original: string; // original filename from uploader\n  localPath: string; // path relative to working dir (e.g., \"C12345/attachments/1732531234567_file.png\")\n}\n\nexport interface LoggedMessage {\n  date: string; // ISO 8601 date (e.g., \"2025-11-26T10:44:00.000Z\") for easy grepping\n  ts: string; // slack timestamp or epoch ms\n  user: string; // user ID (or \"bot\" for bot responses)\n  userName?: string; // handle (e.g., \"mario\")\n  displayName?: string; // display name (e.g., \"Mario Zechner\")\n  text: string;\n  attachments: Attachment[];\n  isBot: boolean;\n  threadTs?: string; // slack thread timestamp (root message ts)\n}\n\nexport interface ChannelStoreConfig {\n  workingDir: string;\n  botToken: string; // needed for authenticated file downloads\n}\n\nclass AttachmentDownloadHttpError extends Error {\n  constructor(\n    message: string,\n    readonly status: number,\n  ) {\n    super(message);\n  }\n}\n\nfunction isRetryableAttachmentDownloadError(error: unknown): boolean {\n  if (!(error instanceof AttachmentDownloadHttpError)) return true;\n  return error.status === 408 || error.status === 429 || error.status >= 500;\n}\n\nexport class ChannelStore {\n  private workingDir: string;\n  private botToken: string;\n  // Track recently logged message timestamps to prevent duplicates\n  // Key: \"channelId:ts\", automatically cleaned up after 60 seconds\n  private recentlyLogged = new Map<string, number>();\n\n  constructor(config: ChannelStoreConfig) {\n    this.workingDir = config.workingDir;\n    this.botToken = config.botToken;\n\n    // Ensure working directory exists\n    ensureDirExists(this.workingDir);\n  }\n\n  /**\n   * Get or create the directory for a channel/DM\n   */\n  getChannelDir(channelId: string): string {\n    const channelDir = join(this.workingDir, channelId);\n    ensureDirExists(channelDir);\n    return channelDir;\n  }\n\n  /**\n   * Generate a unique local filename for an attachment\n   */\n  generateLocalFilename(originalName: string, timestamp: string): string {\n    // Convert slack timestamp (1234567890.123456) to milliseconds\n    const ts = Math.floor(parseFloat(timestamp) * 1000);\n    // Sanitize original name (remove problematic characters)\n    const sanitized = originalName.replace(/[^a-zA-Z0-9._-]/g, \"_\");\n    return `${ts}_${sanitized}`;\n  }\n\n  /**\n   * Process attachments from a Slack message event.\n   * Downloads files before returning so callers only receive readable paths.\n   */\n  async processAttachments(\n    channelId: string,\n    files: Array<{ name?: string; url_private_download?: string; url_private?: string }>,\n    timestamp: string,\n  ): Promise<Attachment[]> {\n    const downloads: Array<Promise<Attachment>> = [];\n\n    for (const file of files) {\n      const url = file.url_private_download || file.url_private;\n      if (!url) continue;\n      if (!file.name) {\n        throw new Error(`Attachment missing name for URL: ${url}`);\n      }\n\n      const filename = this.generateLocalFilename(file.name, timestamp);\n      const localPath = `${channelId}/attachments/${filename}`;\n      const attachment: Attachment = {\n        original: file.name,\n        localPath,\n      };\n\n      downloads.push(\n        this.downloadAttachmentWithRetry(localPath, url)\n          .then(() => attachment)\n          .catch((error) => {\n            const errorMsg = error instanceof Error ? error.message : String(error);\n            throw new Error(`Failed to download attachment ${localPath}: ${errorMsg}`, {\n              cause: error,\n            });\n          }),\n      );\n    }\n\n    return Promise.all(downloads);\n  }\n\n  /**\n   * Log a message to the channel's log.jsonl\n   * Returns false if message was already logged (duplicate)\n   */\n  async logMessage(channelId: string, message: LoggedMessage): Promise<boolean> {\n    // Check for duplicate (same channel + timestamp)\n    const dedupeKey = `${channelId}:${message.ts}`;\n    if (this.recentlyLogged.has(dedupeKey)) {\n      return false; // Already logged\n    }\n\n    const logPath = join(this.getChannelDir(channelId), \"log.jsonl\");\n\n    // Ensure message has a date field\n    if (!message.date) {\n      // Parse timestamp to get date\n      let date: Date;\n      if (message.ts.includes(\".\")) {\n        // Slack timestamp format (1234567890.123456)\n        date = new Date(parseFloat(message.ts) * 1000);\n      } else {\n        // Epoch milliseconds\n        date = new Date(parseInt(message.ts, 10));\n      }\n      message.date = date.toISOString();\n    }\n\n    const line = `${JSON.stringify(message)}\\n`;\n    await appendFile(logPath, line, \"utf-8\");\n\n    // Mark as logged only after the append succeeds. Otherwise a transient\n    // write failure can make retries look like duplicates and drop messages.\n    this.recentlyLogged.set(dedupeKey, Date.now());\n    setTimeout(() => this.recentlyLogged.delete(dedupeKey), 60000);\n    return true;\n  }\n\n  /**\n   * Log a bot response\n   */\n  async logBotResponse(channelId: string, text: string, ts: string): Promise<void> {\n    await this.logMessage(channelId, {\n      date: new Date().toISOString(),\n      ts,\n      user: \"bot\",\n      text,\n      attachments: [],\n      isBot: true,\n    });\n  }\n\n  /**\n   * Get the timestamp of the last logged message for a channel\n   * Returns null if no log exists\n   */\n  getLastTimestamp(channelId: string): string | null {\n    const logPath = join(this.workingDir, channelId, \"log.jsonl\");\n    const content = readTextFileIfExists(logPath);\n    if (content === undefined) {\n      return null;\n    }\n\n    try {\n      const lines = content.trim().split(\"\\n\");\n      if (lines.length === 0 || lines[0] === \"\") {\n        return null;\n      }\n      const lastLine = lines[lines.length - 1];\n      const message = parseJsonValue(\n        lastLine,\n        (value): value is LoggedMessage => isRecord(value) && typeof value.ts === \"string\",\n        (detail) => (detail === \"unexpected JSON shape\" ? \"log entry missing timestamp\" : detail),\n      );\n      return message.ts;\n    } catch {\n      return null;\n    }\n  }\n\n  /**\n   * Download a single attachment\n   */\n  private async downloadAttachmentWithRetry(localPath: string, url: string): Promise<void> {\n    await withRetry(() => this.downloadAttachment(localPath, url), {\n      maxAttempts: 3,\n      baseDelayMs: 250,\n      isRateLimited: isRetryableAttachmentDownloadError,\n    });\n  }\n\n  private async downloadAttachment(localPath: string, url: string): Promise<void> {\n    const filePath = join(this.workingDir, localPath);\n\n    // Ensure directory exists\n    const parentDir = join(this.workingDir, localPath.substring(0, localPath.lastIndexOf(\"/\")));\n    ensureDirExists(parentDir);\n\n    const response = await fetch(url, {\n      headers: {\n        Authorization: `Bearer ${this.botToken}`,\n      },\n    });\n\n    if (!response.ok) {\n      throw new AttachmentDownloadHttpError(\n        `HTTP ${response.status}: ${response.statusText}`,\n        response.status,\n      );\n    }\n\n    const buffer = await response.arrayBuffer();\n    await writeFile(filePath, Buffer.from(buffer));\n  }\n}\n"]}

package/dist/vault.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAOxD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAaD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAAC;IAC3E,gDAAgD;IAChD,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,4CAA4C;IAC5C,SAAS,IAAI,OAAO,CAAC;IACrB,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,6DAA6D;IAC7D,gBAAgB,IAAI,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,wEAAwE;IACxE,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BpE;AAID,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAUhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAQzE;IAED,IAAI,IAAI,aAAa,EAAE,CAOtB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcxD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAmBxF;IAID,OAAO,CAAC,aAAa;CA6BtB;AAuFD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE","sourcesContent":["import {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  rmSync,\n  writeFileSync,\n} from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport { readTextFileIfExists } from \"./file-guards.js\";\nimport type { SandboxConfig } from \"./sandbox/index.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    return copyVaultDir(sourceDir, targetDir);\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    if (baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n      };\n    }\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (entry.isDirectory()) keys.add(entry.name);\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    if (existsSync(filePath)) {\n      writeFileSync(filePath, content, { mode: 0o600 });\n      chmodSync(filePath, 0o600);\n    } else {\n      atomicWritePrivateFile(filePath, content);\n    }\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    const mounts = inferMountsFromDir(dir);\n\n    let env: Record<string, string> = {};\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    if (envContent !== undefined) {\n      try {\n        env = parseEnvFile(envContent);\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"parse_env\",\n          severity: \"warning\",\n          context: { vaultKey: key, fatal: false },\n        });\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n}\n\nfunction inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const target = inferredVaultTargetPath(entry.name);\n    if (!target) continue;\n    mounts.push({ source, target });\n  }\n  return mounts;\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction copyVaultDir(\n  sourceDir: string,\n  targetDir: string,\n): {\n  filesCopied: number;\n  envKeysCopied: number;\n} {\n  let filesCopied = 0;\n  let envKeysCopied = 0;\n\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const sourcePath = join(sourceDir, entry.name);\n    const targetPath = join(targetDir, entry.name);\n\n    if (entry.name === \"env\" && entry.isFile()) {\n      const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n      const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n      const merged = { ...targetEnv, ...sourceEnv };\n      const content =\n        Object.entries(merged)\n          .toSorted(([left], [right]) => left.localeCompare(right))\n          .map(([envKey, value]) => `${envKey}=${value}`)\n          .join(\"\\n\") + \"\\n\";\n      atomicWritePrivateFile(targetPath, content);\n      envKeysCopied += Object.keys(sourceEnv).length;\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      ensurePrivateDir(targetPath);\n      const nested = copyVaultDir(sourcePath, targetPath);\n      filesCopied += nested.filesCopied;\n      envKeysCopied += nested.envKeysCopied;\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    copyFileSync(sourcePath, targetPath);\n    chmodSync(targetPath, 0o600);\n    filesCopied++;\n  }\n\n  return { filesCopied, envKeysCopied };\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \"gcloud-adc.json\") {\n    return \"/root/.config/gcloud/application_default_credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}
+{"version":3,"file":"vault.d.ts","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAOxD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIzE;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG/D;AAaD,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,8CAA8C;AAC9C,MAAM,WAAW,aAAa;IAC5B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,uCAAuC;IACvC,GAAG,EAAE,MAAM,CAAC;IACZ,2BAA2B;IAC3B,MAAM,EAAE,kBAAkB,EAAE,CAAC;IAC7B,2BAA2B;IAC3B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,oEAAoE;IACpE,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAAC;IACnD,8DAA8D;IAC9D,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAAC;IAC3E,gDAAgD;IAChD,IAAI,IAAI,aAAa,EAAE,CAAC;IACxB,4CAA4C;IAC5C,SAAS,IAAI,OAAO,CAAC;IACrB,kFAAkF;IAClF,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAAC;IAC1D,yFAAyF;IACzF,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1F,6DAA6D;IAC7D,gBAAgB,IAAI,MAAM,EAAE,CAAC;IAC7B,+EAA+E;IAC/E,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;IACzC,wEAAwE;IACxE,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;CACnD;AAID;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA2BpE;AAID,qBAAa,gBAAiB,YAAW,YAAY;IACnD,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IAEnC,YAAY,QAAQ,EAAE,MAAM,EAE3B;IAED,SAAS,IAAI,OAAO,CAEnB;IAED,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAE7B;IAED,gBAAgB,IAAI,MAAM,EAAE,CAO3B;IAED,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvC;IAED,iBAAiB,CACf,IAAI,EAAE,MAAM,EACZ,SAAS,EAAE,MAAM,GAChB;QAAE,WAAW,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAUhD;IAED,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAIjD;IAED,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,aAAa,GAAG,aAAa,CAQzE;IAED,IAAI,IAAI,aAAa,EAAE,CAOtB;IAED,SAAS,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAcxD;IAED,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAcxF;IAID,OAAO,CAAC,aAAa;CA6BtB;AAuFD,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAGnE","sourcesContent":["import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport { readTextFileIfExists } from \"./file-guards.js\";\nimport type { SandboxConfig } from \"./sandbox/index.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    return copyVaultDir(sourceDir, targetDir);\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    if (baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n      };\n    }\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (entry.isDirectory()) keys.add(entry.name);\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    const mounts = inferMountsFromDir(dir);\n\n    let env: Record<string, string> = {};\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    if (envContent !== undefined) {\n      try {\n        env = parseEnvFile(envContent);\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"parse_env\",\n          severity: \"warning\",\n          context: { vaultKey: key, fatal: false },\n        });\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n}\n\nfunction inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const target = inferredVaultTargetPath(entry.name);\n    if (!target) continue;\n    mounts.push({ source, target });\n  }\n  return mounts;\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction copyVaultDir(\n  sourceDir: string,\n  targetDir: string,\n): {\n  filesCopied: number;\n  envKeysCopied: number;\n} {\n  let filesCopied = 0;\n  let envKeysCopied = 0;\n\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const sourcePath = join(sourceDir, entry.name);\n    const targetPath = join(targetDir, entry.name);\n\n    if (entry.name === \"env\" && entry.isFile()) {\n      const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n      const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n      const merged = { ...targetEnv, ...sourceEnv };\n      const content =\n        Object.entries(merged)\n          .toSorted(([left], [right]) => left.localeCompare(right))\n          .map(([envKey, value]) => `${envKey}=${value}`)\n          .join(\"\\n\") + \"\\n\";\n      atomicWritePrivateFile(targetPath, content);\n      envKeysCopied += Object.keys(sourceEnv).length;\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      ensurePrivateDir(targetPath);\n      const nested = copyVaultDir(sourcePath, targetPath);\n      filesCopied += nested.filesCopied;\n      envKeysCopied += nested.envKeysCopied;\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    copyFileSync(sourcePath, targetPath);\n    chmodSync(targetPath, 0o600);\n    filesCopied++;\n  }\n\n  return { filesCopied, envKeysCopied };\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \"gcloud-adc.json\") {\n    return \"/root/.config/gcloud/application_default_credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}

package/dist/vault.js

@@ -1,4 +1,4 @@
-import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync, writeFileSync, } from "fs";
+import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from "fs";
 import { dirname, isAbsolute, join, normalize, sep } from "path";
 import { readTextFileIfExists } from "./file-guards.js";
 import { atomicWritePrivateFile } from "./fs-atomic.js";
@@ -144,13 +144,7 @@ export class FileVaultManager {
         const parentDir = dirname(filePath);
         if (parentDir !== dir)
             ensurePrivateDir(parentDir);
-        if (existsSync(filePath)) {
-            writeFileSync(filePath, content, { mode: 0o600 });
-            chmodSync(filePath, 0o600);
-        }
-        else {
-            atomicWritePrivateFile(filePath, content);
-        }
+        atomicWritePrivateFile(filePath, content);
     }
     // ── private ────────────────────────────────────────────────────────────────
     buildResolved(key) {

package/dist/vault.js.map

@@ -1 +1 @@
-{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,YAAY,EACZ,UAAU,EACV,SAAS,EACT,WAAW,EACX,MAAM,EACN,aAAa,GACd,MAAM,IAAI,CAAC;AACZ,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,SAAS,CACxC,CAAC;AACJ,CAAC;AA+CD,kFAAkF;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEvC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,gBAAgB;IAG3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAyB;QACxD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE;aAC5E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE3C,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YACzB,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAClD,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;QAC7B,CAAC;aAAM,CAAC;YACN,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,8EAA8E;IAEtE,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,GAAG,GAA2B,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpE,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,WAAW;oBACtB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,SAAiB,EACjB,SAAiB;IAKjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;iBACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACpD,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YAClC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,SAAS,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACrC,OAAO,2DAA2D,CAAC;IACrE,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import {\n  chmodSync,\n  copyFileSync,\n  existsSync,\n  mkdirSync,\n  readdirSync,\n  rmSync,\n  writeFileSync,\n} from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport { readTextFileIfExists } from \"./file-guards.js\";\nimport type { SandboxConfig } from \"./sandbox/index.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    return copyVaultDir(sourceDir, targetDir);\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    if (baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n      };\n    }\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (entry.isDirectory()) keys.add(entry.name);\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    if (existsSync(filePath)) {\n      writeFileSync(filePath, content, { mode: 0o600 });\n      chmodSync(filePath, 0o600);\n    } else {\n      atomicWritePrivateFile(filePath, content);\n    }\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    const mounts = inferMountsFromDir(dir);\n\n    let env: Record<string, string> = {};\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    if (envContent !== undefined) {\n      try {\n        env = parseEnvFile(envContent);\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"parse_env\",\n          severity: \"warning\",\n          context: { vaultKey: key, fatal: false },\n        });\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n}\n\nfunction inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const target = inferredVaultTargetPath(entry.name);\n    if (!target) continue;\n    mounts.push({ source, target });\n  }\n  return mounts;\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction copyVaultDir(\n  sourceDir: string,\n  targetDir: string,\n): {\n  filesCopied: number;\n  envKeysCopied: number;\n} {\n  let filesCopied = 0;\n  let envKeysCopied = 0;\n\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const sourcePath = join(sourceDir, entry.name);\n    const targetPath = join(targetDir, entry.name);\n\n    if (entry.name === \"env\" && entry.isFile()) {\n      const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n      const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n      const merged = { ...targetEnv, ...sourceEnv };\n      const content =\n        Object.entries(merged)\n          .toSorted(([left], [right]) => left.localeCompare(right))\n          .map(([envKey, value]) => `${envKey}=${value}`)\n          .join(\"\\n\") + \"\\n\";\n      atomicWritePrivateFile(targetPath, content);\n      envKeysCopied += Object.keys(sourceEnv).length;\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      ensurePrivateDir(targetPath);\n      const nested = copyVaultDir(sourcePath, targetPath);\n      filesCopied += nested.filesCopied;\n      envKeysCopied += nested.envKeysCopied;\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    copyFileSync(sourcePath, targetPath);\n    chmodSync(targetPath, 0o600);\n    filesCopied++;\n  }\n\n  return { filesCopied, envKeysCopied };\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \"gcloud-adc.json\") {\n    return \"/root/.config/gcloud/application_default_credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}
+{"version":3,"file":"vault.js","sourceRoot":"","sources":["../src/vault.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AACzF,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,MAAM,MAAM,CAAC;AACjE,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAEpD,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAC/B,MAAM,gBAAgB,GAAG,QAAQ,CAAC;AAElC,MAAM,UAAU,wBAAwB,CAAC,IAAY;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,mCAAmC,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACzE,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY;IACzC,MAAM,UAAU,GAAG,wBAAwB,CAAC,IAAI,CAAC,CAAC;IAClD,OAAO,UAAU,CAAC,CAAC,CAAC,GAAG,gBAAgB,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;AACtE,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,OAAO,CACL,KAAK;SACF,WAAW,EAAE;SACb,OAAO,CAAC,cAAc,EAAE,GAAG,CAAC;SAC5B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,SAAS,CACxC,CAAC;AACJ,CAAC;AA+CD,kFAAkF;AAElF;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,OAAe;IAC1C,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAE9E,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAElD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,OAAO,KAAK,CAAC,CAAC;YAAE,SAAS;QAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,IAAI,CAAC,GAAG;YAAE,SAAS;QAEnB,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;QAEvC,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QAED,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,kFAAkF;AAElF,MAAM,OAAO,gBAAgB;IAG3B,YAAY,QAAgB;QAC1B,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC;IAC5C,CAAC;IAED,SAAS;QACP,OAAO,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACpC,CAAC;IAED,QAAQ,CAAC,GAAW;QAClB,OAAO,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;IAC/C,CAAC;IAED,gBAAgB;QACd,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,gBAAgB,CAAC,CAAC;QACzD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACtC,OAAO,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;aACnD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC;aAC7F,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC;aAC1B,QAAQ,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IAC1D,CAAC;IAED,iBAAiB,CAAC,IAAY;QAC5B,MAAM,GAAG,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACvE,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,iBAAiB,CACf,IAAY,EACZ,SAAiB;QAEjB,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QAC7E,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,kBAAkB,CAAC,CAAC;QAE5F,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAClD,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,SAAS,CAAC,CAAC;QAC5B,OAAO,YAAY,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,CAAC;IAED,OAAO,CAAC,MAAc;QACpB,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,OAAO,SAAS,CAAC;QACvC,OAAO,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,gBAAgB,CAAC,MAAc,EAAE,UAAyB;QACxD,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YACrC,OAAO;gBACL,IAAI,EAAE,YAAY;gBAClB,SAAS,EAAE,GAAG,UAAU,CAAC,SAAS,IAAI,2BAA2B,CAAC,MAAM,CAAC,EAAE;aAC5E,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI;QACF,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACzE,IAAI,KAAK,CAAC,WAAW,EAAE;gBAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;IAC5D,CAAC;IAED,SAAS,CAAC,GAAW,EAAE,GAA2B;QAChD,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACjC,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,eAAe,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,eAAe,CAAC,CAAC,CAAC,YAAY,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtE,MAAM,MAAM,GAAG,EAAE,GAAG,QAAQ,EAAE,GAAG,GAAG,EAAE,CAAC;QACvC,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;aACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;aACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;aAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;QACvB,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC3C,CAAC;IAED,UAAU,CAAC,GAAW,EAAE,YAAoB,EAAE,OAAe,EAAE,UAAmB;QAChF,MAAM,cAAc,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;QAChE,IAAI,CAAC,cAAc,IAAI,CAAC,UAAU,KAAK,SAAS,IAAI,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAC3F,MAAM,IAAI,KAAK,CAAC,iDAAiD,GAAG,MAAM,YAAY,EAAE,CAAC,CAAC;QAC5F,CAAC;QAED,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;QAE3C,gBAAgB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACjC,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACtB,MAAM,SAAS,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;QACpC,IAAI,SAAS,KAAK,GAAG;YAAE,gBAAgB,CAAC,SAAS,CAAC,CAAC;QACnD,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAED,8EAA8E;IAEtE,aAAa,CAAC,GAAW;QAC/B,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAEvC,IAAI,GAAG,GAA2B,EAAE,CAAC;QACrC,MAAM,UAAU,GAAG,oBAAoB,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1D,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,IAAI,CAAC;gBACH,GAAG,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;YACjC,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,KAAK,CAAC,wCAAwC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC;gBACpE,qBAAqB,CAAC,GAAG,EAAE;oBACzB,MAAM,EAAE,SAAS;oBACjB,OAAO,EAAE,iBAAiB;oBAC1B,SAAS,EAAE,WAAW;oBACtB,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE;iBACzC,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO;YACL,MAAM,EAAE,GAAG;YACX,WAAW,EAAE,GAAG;YAChB,GAAG;YACH,MAAM;YACN,GAAG;SACJ,CAAC;IACJ,CAAC;CACF;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IAEhC,MAAM,MAAM,GAAyB,EAAE,CAAC;IACxC,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,GAAG,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9D,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK;YAAE,SAAS;QACnC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACrC,MAAM,MAAM,GAAG,uBAAuB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC;IAClC,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,CAAC,CAAC;IAC7D,SAAS,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CACnB,SAAiB,EACjB,SAAiB;IAKjB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,aAAa,GAAG,CAAC,CAAC;IAEtB,KAAK,MAAM,KAAK,IAAI,WAAW,CAAC,SAAS,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QAE/C,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,IAAI,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC3C,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,SAAS,GAAG,YAAY,CAAC,oBAAoB,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,EAAE,GAAG,SAAS,EAAE,GAAG,SAAS,EAAE,CAAC;YAC9C,MAAM,OAAO,GACX,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;iBACnB,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;iBACxD,GAAG,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,MAAM,IAAI,KAAK,EAAE,CAAC;iBAC9C,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;YACvB,sBAAsB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;YAC5C,aAAa,IAAI,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC;YAC/C,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;YACxB,gBAAgB,CAAC,UAAU,CAAC,CAAC;YAC7B,MAAM,MAAM,GAAG,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;YACpD,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC;YAClC,aAAa,IAAI,MAAM,CAAC,aAAa,CAAC;YACtC,SAAS;QACX,CAAC;QAED,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE;YAAE,SAAS;QAC9B,YAAY,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;QACrC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;QAC7B,WAAW,EAAE,CAAC;IAChB,CAAC;IAED,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,0BAA0B,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,CAAC;IACpC,IAAI,CAAC,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IAEtD,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,CAAC,UAAU,IAAI,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7F,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,wBAAwB,CAAC,UAAmB;IACnD,IAAI,UAAU,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAE/C,MAAM,OAAO,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAC;IAE3D,MAAM,UAAU,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3D,OAAO,UAAU,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,YAAoB;IACzD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,SAAS,UAAU,EAAE,CAAC;AAC/B,CAAC;AAED,SAAS,uBAAuB,CAAC,YAAoB;IACnD,MAAM,UAAU,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAC;IAC5D,IAAI,CAAC,UAAU;QAAE,OAAO,SAAS,CAAC;IAElC,IAAI,UAAU,KAAK,UAAU,EAAE,CAAC;QAC9B,OAAO,oCAAoC,CAAC;IAC9C,CAAC;IACD,IAAI,UAAU,KAAK,iBAAiB,EAAE,CAAC;QACrC,OAAO,2DAA2D,CAAC;IACrE,CAAC;IACD,IAAI,UAAU,KAAK,MAAM,IAAI,UAAU,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5D,OAAO,YAAY,CAAC;IACtB,CAAC;IACD,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC9D,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,UAAU,KAAK,YAAY,IAAI,UAAU,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,CAAC;QACxE,OAAO,kBAAkB,CAAC;IAC5B,CAAC;IAED,OAAO,sBAAsB,CAAC,UAAU,CAAC,CAAC;AAC5C,CAAC","sourcesContent":["import { chmodSync, copyFileSync, existsSync, mkdirSync, readdirSync, rmSync } from \"fs\";\nimport { dirname, isAbsolute, join, normalize, sep } from \"path\";\nimport { readTextFileIfExists } from \"./file-guards.js\";\nimport type { SandboxConfig } from \"./sandbox/index.js\";\nimport { atomicWritePrivateFile } from \"./fs-atomic.js\";\nimport { reportUserFacingError } from \"./sentry.js\";\n\nconst PRIVATE_DIR_MODE = 0o700;\nconst SHARED_VAULT_DIR = \"shared\";\n\nexport function normalizeSharedVaultName(name: string): string | undefined {\n  const trimmed = name.trim();\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(trimmed)) return undefined;\n  return trimmed;\n}\n\nexport function sharedVaultKey(name: string): string | undefined {\n  const normalized = normalizeSharedVaultName(name);\n  return normalized ? `${SHARED_VAULT_DIR}/${normalized}` : undefined;\n}\n\nfunction sanitizeCloudflareSandboxId(value: string): string {\n  return (\n    value\n      .toLowerCase()\n      .replace(/[^a-z0-9-]+/g, \"-\")\n      .replace(/^-+|-+$/g, \"\") || \"unknown\"\n  );\n}\n\n// ── Types ──────────────────────────────────────────────────────────────────────\n\nexport interface ResolvedVaultMount {\n  source: string;\n  target: string;\n}\n\n/** Resolved vault ready for use at runtime */\nexport interface ResolvedVault {\n  userId: string;\n  displayName: string;\n  /** Absolute path to vault directory */\n  dir: string;\n  /** Absolute mount specs */\n  mounts: ResolvedVaultMount[];\n  /** Parsed from env file */\n  env: Record<string, string>;\n}\n\nexport interface VaultManager {\n  /** Return true when a vault directory exists for this exact key. */\n  hasEntry(key: string): boolean;\n  /** Resolve vault for a user; returns undefined when no directory exists. */\n  resolve(userId: string): ResolvedVault | undefined;\n  /** Get sandbox config with credential injection for a user */\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig;\n  /** List all vaults discovered under vaults/. */\n  list(): ResolvedVault[];\n  /** Check if the vaults directory exists. */\n  isEnabled(): boolean;\n  /** Merge environment variables into vaults/<key>/env and persist them to disk. */\n  upsertEnv(key: string, env: Record<string, string>): void;\n  /** Write a private file into vaults/<key>/ and ensure it is mounted into the sandbox. */\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void;\n  /** List named shared login profiles under vaults/shared/. */\n  listSharedVaults(): string[];\n  /** Delete a shared login profile's directory. Returns true when it existed. */\n  deleteSharedVault(name: string): boolean;\n  /** Copy a shared login profile's files into another vault directory. */\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number };\n}\n\n// ── parseEnvFile ───────────────────────────────────────────────────────────────\n\n/**\n * Parse a KEY=VALUE env file. Supports:\n * - Lines starting with # are comments\n * - Empty lines are skipped\n * - Values can be quoted with single or double quotes (quotes are stripped)\n * - No variable expansion\n * - The value is everything after the first `=` to end of line (no inline comments)\n */\nexport function parseEnvFile(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  const lines = content.replace(/\\r\\n/g, \"\\n\").replace(/\\r/g, \"\\n\").split(\"\\n\");\n\n  for (const line of lines) {\n    const trimmed = line.trim();\n    if (!trimmed || trimmed.startsWith(\"#\")) continue;\n\n    const eqIndex = trimmed.indexOf(\"=\");\n    if (eqIndex === -1) continue;\n\n    const key = trimmed.slice(0, eqIndex).trim();\n    if (!key) continue;\n\n    let value = trimmed.slice(eqIndex + 1);\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    env[key] = value;\n  }\n\n  return env;\n}\n\n// ── FileVaultManager ───────────────────────────────────────────────────────────\n\nexport class FileVaultManager implements VaultManager {\n  private readonly vaultsDir: string;\n\n  constructor(stateDir: string) {\n    this.vaultsDir = join(stateDir, \"vaults\");\n  }\n\n  isEnabled(): boolean {\n    return existsSync(this.vaultsDir);\n  }\n\n  hasEntry(key: string): boolean {\n    return existsSync(join(this.vaultsDir, key));\n  }\n\n  listSharedVaults(): string[] {\n    const sharedDir = join(this.vaultsDir, SHARED_VAULT_DIR);\n    if (!existsSync(sharedDir)) return [];\n    return readdirSync(sharedDir, { withFileTypes: true })\n      .filter((entry) => entry.isDirectory() && normalizeSharedVaultName(entry.name) === entry.name)\n      .map((entry) => entry.name)\n      .toSorted((left, right) => left.localeCompare(right));\n  }\n\n  deleteSharedVault(name: string): boolean {\n    const key = sharedVaultKey(name);\n    if (!key) throw new Error(`vault: invalid shared login name: ${name}`);\n    const dir = join(this.vaultsDir, key);\n    const existed = existsSync(dir);\n    rmSync(dir, { recursive: true, force: true });\n    return existed;\n  }\n\n  copySharedVaultTo(\n    name: string,\n    targetKey: string,\n  ): { filesCopied: number; envKeysCopied: number } {\n    const sourceKey = sharedVaultKey(name);\n    if (!sourceKey) throw new Error(`vault: invalid shared login name: ${name}`);\n    const sourceDir = join(this.vaultsDir, sourceKey);\n    if (!existsSync(sourceDir)) throw new Error(`vault: shared login \"${name}\" does not exist`);\n\n    const targetDir = join(this.vaultsDir, targetKey);\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(targetDir);\n    return copyVaultDir(sourceDir, targetDir);\n  }\n\n  resolve(userId: string): ResolvedVault | undefined {\n    const dir = join(this.vaultsDir, userId);\n    if (!existsSync(dir)) return undefined;\n    return this.buildResolved(userId);\n  }\n\n  getSandboxConfig(userId: string, baseConfig: SandboxConfig): SandboxConfig {\n    if (baseConfig.type === \"cloudflare\") {\n      return {\n        type: \"cloudflare\",\n        sandboxId: `${baseConfig.sandboxId}-${sanitizeCloudflareSandboxId(userId)}`,\n      };\n    }\n    return baseConfig;\n  }\n\n  list(): ResolvedVault[] {\n    if (!existsSync(this.vaultsDir)) return [];\n    const keys = new Set<string>();\n    for (const entry of readdirSync(this.vaultsDir, { withFileTypes: true })) {\n      if (entry.isDirectory()) keys.add(entry.name);\n    }\n    return Array.from(keys, (key) => this.buildResolved(key));\n  }\n\n  upsertEnv(key: string, env: Record<string, string>): void {\n    const dir = join(this.vaultsDir, key);\n    const envPath = join(dir, \"env\");\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const existingContent = readTextFileIfExists(envPath);\n    const existing = existingContent ? parseEnvFile(existingContent) : {};\n    const merged = { ...existing, ...env };\n    const content =\n      Object.entries(merged)\n        .toSorted(([left], [right]) => left.localeCompare(right))\n        .map(([envKey, value]) => `${envKey}=${value}`)\n        .join(\"\\n\") + \"\\n\";\n    atomicWritePrivateFile(envPath, content);\n  }\n\n  upsertFile(key: string, relativePath: string, content: string, targetPath?: string): void {\n    const normalizedPath = normalizeVaultRelativePath(relativePath);\n    if (!normalizedPath || (targetPath !== undefined && !normalizeVaultTargetPath(targetPath))) {\n      throw new Error(`vault: invalid relative secret file path for \"${key}\": ${relativePath}`);\n    }\n\n    const dir = join(this.vaultsDir, key);\n    const filePath = join(dir, normalizedPath);\n\n    ensurePrivateDir(this.vaultsDir);\n    ensurePrivateDir(dir);\n    const parentDir = dirname(filePath);\n    if (parentDir !== dir) ensurePrivateDir(parentDir);\n    atomicWritePrivateFile(filePath, content);\n  }\n\n  // ── private ────────────────────────────────────────────────────────────────\n\n  private buildResolved(key: string): ResolvedVault {\n    const dir = join(this.vaultsDir, key);\n    const mounts = inferMountsFromDir(dir);\n\n    let env: Record<string, string> = {};\n    const envContent = readTextFileIfExists(join(dir, \"env\"));\n    if (envContent !== undefined) {\n      try {\n        env = parseEnvFile(envContent);\n      } catch (err) {\n        console.error(`vault: failed to parse env file for \"${key}\":`, err);\n        reportUserFacingError(err, {\n          domain: \"sandbox\",\n          surface: \"vault_injection\",\n          operation: \"parse_env\",\n          severity: \"warning\",\n          context: { vaultKey: key, fatal: false },\n        });\n      }\n    }\n\n    return {\n      userId: key,\n      displayName: key,\n      dir,\n      mounts,\n      env,\n    };\n  }\n}\n\nfunction inferMountsFromDir(dir: string): ResolvedVaultMount[] {\n  if (!existsSync(dir)) return [];\n\n  const mounts: ResolvedVaultMount[] = [];\n  for (const entry of readdirSync(dir, { withFileTypes: true })) {\n    if (entry.name === \"env\") continue;\n    const source = join(dir, entry.name);\n    const target = inferredVaultTargetPath(entry.name);\n    if (!target) continue;\n    mounts.push({ source, target });\n  }\n  return mounts;\n}\n\nfunction ensurePrivateDir(path: string): void {\n  mkdirSync(path, { recursive: true, mode: PRIVATE_DIR_MODE });\n  chmodSync(path, PRIVATE_DIR_MODE);\n}\n\nfunction copyVaultDir(\n  sourceDir: string,\n  targetDir: string,\n): {\n  filesCopied: number;\n  envKeysCopied: number;\n} {\n  let filesCopied = 0;\n  let envKeysCopied = 0;\n\n  for (const entry of readdirSync(sourceDir, { withFileTypes: true })) {\n    const sourcePath = join(sourceDir, entry.name);\n    const targetPath = join(targetDir, entry.name);\n\n    if (entry.name === \"env\" && entry.isFile()) {\n      const sourceEnv = parseEnvFile(readTextFileIfExists(sourcePath) ?? \"\");\n      const targetEnv = parseEnvFile(readTextFileIfExists(targetPath) ?? \"\");\n      const merged = { ...targetEnv, ...sourceEnv };\n      const content =\n        Object.entries(merged)\n          .toSorted(([left], [right]) => left.localeCompare(right))\n          .map(([envKey, value]) => `${envKey}=${value}`)\n          .join(\"\\n\") + \"\\n\";\n      atomicWritePrivateFile(targetPath, content);\n      envKeysCopied += Object.keys(sourceEnv).length;\n      continue;\n    }\n\n    if (entry.isDirectory()) {\n      ensurePrivateDir(targetPath);\n      const nested = copyVaultDir(sourcePath, targetPath);\n      filesCopied += nested.filesCopied;\n      envKeysCopied += nested.envKeysCopied;\n      continue;\n    }\n\n    if (!entry.isFile()) continue;\n    copyFileSync(sourcePath, targetPath);\n    chmodSync(targetPath, 0o600);\n    filesCopied++;\n  }\n\n  return { filesCopied, envKeysCopied };\n}\n\nfunction normalizeVaultRelativePath(relativePath: string): string | undefined {\n  const trimmed = relativePath.trim();\n  if (!trimmed || isAbsolute(trimmed)) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  if (!normalized || normalized === \".\" || normalized === \"..\" || normalized.startsWith(\"../\")) {\n    return undefined;\n  }\n  return normalized;\n}\n\nfunction normalizeVaultTargetPath(targetPath?: string): string | undefined {\n  if (targetPath === undefined) return undefined;\n\n  const trimmed = targetPath.trim();\n  if (!trimmed || !trimmed.startsWith(\"/\")) return undefined;\n\n  const normalized = normalize(trimmed).split(sep).join(\"/\");\n  return normalized.startsWith(\"/\") ? normalized : undefined;\n}\n\nexport function defaultVaultTargetPath(relativePath: string): string {\n  const normalized = normalizeVaultRelativePath(relativePath) ?? relativePath.replace(/^\\/+/, \"\");\n  return `/root/${normalized}`;\n}\n\nfunction inferredVaultTargetPath(relativePath: string): string | undefined {\n  const normalized = normalizeVaultRelativePath(relativePath);\n  if (!normalized) return undefined;\n\n  if (normalized === \"gws.json\") {\n    return \"/root/.config/gws/credentials.json\";\n  }\n  if (normalized === \"gcloud-adc.json\") {\n    return \"/root/.config/gcloud/application_default_credentials.json\";\n  }\n  if (normalized === \".ssh\" || normalized.startsWith(\".ssh/\")) {\n    return \"/root/.ssh\";\n  }\n  if (normalized === \".kube\" || normalized.startsWith(\".kube/\")) {\n    return \"/root/.kube\";\n  }\n  if (normalized === \".config/gh\" || normalized.startsWith(\".config/gh/\")) {\n    return \"/root/.config/gh\";\n  }\n\n  return defaultVaultTargetPath(normalized);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@geminixiang/mikan",
-  "version": "0.2.0",
+  "version": "0.2.1",
   "description": "Multi-platform AI coding agent for Slack, Telegram, and Discord",
   "keywords": [
     "agent",