@getrift/rift 0.1.0-beta.0 → 0.1.0-beta.10

package/dist/src/cli/hooks-writers/claude-code-policy-script.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Source of truth for the Rift policy hook that ships into
+ * `~/.claude/hooks/rift-policy.mjs`.
+ *
+ * The script is a plain Node ESM module — no `jq`, no `@anthropic-ai`
+ * deps, just `node:fs` / `node:os` / `node:path`. Claude Code runs it
+ * via the matcher in `settings.json` and pipes the PreToolUse payload
+ * on stdin. We branch on `tool_name`:
+ *
+ *   - `mcp__rift__rift_context_pack`  → touch session marker, exit 0
+ *   - `mcp__rift__rift_search`        → require marker, else exit 2
+ *   - `mcp__rift__rift_conversations_search` → same
+ *   - anything else                   → exit 0 (defensive; matcher
+ *                                       should already exclude these)
+ *
+ * Disable knobs:
+ *   - `RIFT_POLICY_DISABLED=1` in env → script no-ops with exit 0
+ *   - Remove the matcher entry from `~/.claude/settings.json`
+ *
+ * The body is exported as a string so the writer can install it
+ * verbatim — keeping the bytes-on-disk identical to the bytes the
+ * tests assert against.
+ */
+export declare const CLAUDE_CODE_POLICY_SCRIPT = "#!/usr/bin/env node\n// Rift policy hook for Claude Code \u2014 managed by `rift hooks install --client claude-code`.\n// Enforces: rift_context_pack must be the first Rift retrieval call per session.\n// Disable: set RIFT_POLICY_DISABLED=1 in env, or remove the matcher entry\n// from ~/.claude/settings.json.\n//\n// DO NOT EDIT BY HAND \u2014 re-running `rift hooks install --client claude-code`\n// will overwrite local edits.\n\nimport fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nconst POLICY_MESSAGE =\n  \"Rift policy: call mcp__rift__rift_context_pack first (compact, pre-budgeted). \" +\n  \"Only fall back to rift_search/rift_conversations_search if the pack returns \" +\n  \"nothing useful, and start with top_k 3-5.\";\n\nif (process.env.RIFT_POLICY_DISABLED === \"1\") process.exit(0);\n\nconst chunks = [];\nfor await (const chunk of process.stdin) chunks.push(chunk);\nconst raw = Buffer.concat(chunks).toString(\"utf8\");\n\nlet payload;\ntry {\n  payload = raw.trim() === \"\" ? {} : JSON.parse(raw);\n} catch {\n  // Fail-open on malformed input so a future hook-payload schema change\n  // can never silently block legitimate tool calls.\n  process.exit(0);\n}\n\nconst tool = typeof payload.tool_name === \"string\" ? payload.tool_name : \"\";\nconst session =\n  typeof payload.session_id === \"string\" && payload.session_id !== \"\"\n    ? payload.session_id\n    : \"nosession\";\nconst marker = path.join(os.tmpdir(), `rift-pack-called-${session}`);\n\nif (tool === \"mcp__rift__rift_context_pack\") {\n  try {\n    fs.closeSync(fs.openSync(marker, \"a\"));\n  } catch {\n    // best-effort; missing marker only blocks the next search call.\n  }\n  process.exit(0);\n}\n\nif (\n  tool === \"mcp__rift__rift_search\" ||\n  tool === \"mcp__rift__rift_conversations_search\"\n) {\n  if (!fs.existsSync(marker)) {\n    process.stderr.write(POLICY_MESSAGE + \"\\n\");\n    process.exit(2);\n  }\n}\n\nprocess.exit(0);\n";
+//# sourceMappingURL=claude-code-policy-script.d.ts.map

package/dist/src/cli/hooks-writers/claude-code-policy-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-policy-script.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code-policy-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,eAAO,MAAM,yBAAyB,m8DA4DrC,CAAC"}

package/dist/src/cli/hooks-writers/claude-code-policy-script.js

@@ -0,0 +1,85 @@
+/**
+ * Source of truth for the Rift policy hook that ships into
+ * `~/.claude/hooks/rift-policy.mjs`.
+ *
+ * The script is a plain Node ESM module — no `jq`, no `@anthropic-ai`
+ * deps, just `node:fs` / `node:os` / `node:path`. Claude Code runs it
+ * via the matcher in `settings.json` and pipes the PreToolUse payload
+ * on stdin. We branch on `tool_name`:
+ *
+ *   - `mcp__rift__rift_context_pack`  → touch session marker, exit 0
+ *   - `mcp__rift__rift_search`        → require marker, else exit 2
+ *   - `mcp__rift__rift_conversations_search` → same
+ *   - anything else                   → exit 0 (defensive; matcher
+ *                                       should already exclude these)
+ *
+ * Disable knobs:
+ *   - `RIFT_POLICY_DISABLED=1` in env → script no-ops with exit 0
+ *   - Remove the matcher entry from `~/.claude/settings.json`
+ *
+ * The body is exported as a string so the writer can install it
+ * verbatim — keeping the bytes-on-disk identical to the bytes the
+ * tests assert against.
+ */
+export const CLAUDE_CODE_POLICY_SCRIPT = `#!/usr/bin/env node
+// Rift policy hook for Claude Code — managed by \`rift hooks install --client claude-code\`.
+// Enforces: rift_context_pack must be the first Rift retrieval call per session.
+// Disable: set RIFT_POLICY_DISABLED=1 in env, or remove the matcher entry
+// from ~/.claude/settings.json.
+//
+// DO NOT EDIT BY HAND — re-running \`rift hooks install --client claude-code\`
+// will overwrite local edits.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const POLICY_MESSAGE =
+  "Rift policy: call mcp__rift__rift_context_pack first (compact, pre-budgeted). " +
+  "Only fall back to rift_search/rift_conversations_search if the pack returns " +
+  "nothing useful, and start with top_k 3-5.";
+
+if (process.env.RIFT_POLICY_DISABLED === "1") process.exit(0);
+
+const chunks = [];
+for await (const chunk of process.stdin) chunks.push(chunk);
+const raw = Buffer.concat(chunks).toString("utf8");
+
+let payload;
+try {
+  payload = raw.trim() === "" ? {} : JSON.parse(raw);
+} catch {
+  // Fail-open on malformed input so a future hook-payload schema change
+  // can never silently block legitimate tool calls.
+  process.exit(0);
+}
+
+const tool = typeof payload.tool_name === "string" ? payload.tool_name : "";
+const session =
+  typeof payload.session_id === "string" && payload.session_id !== ""
+    ? payload.session_id
+    : "nosession";
+const marker = path.join(os.tmpdir(), \`rift-pack-called-\${session}\`);
+
+if (tool === "mcp__rift__rift_context_pack") {
+  try {
+    fs.closeSync(fs.openSync(marker, "a"));
+  } catch {
+    // best-effort; missing marker only blocks the next search call.
+  }
+  process.exit(0);
+}
+
+if (
+  tool === "mcp__rift__rift_search" ||
+  tool === "mcp__rift__rift_conversations_search"
+) {
+  if (!fs.existsSync(marker)) {
+    process.stderr.write(POLICY_MESSAGE + "\\n");
+    process.exit(2);
+  }
+}
+
+process.exit(0);
+`;
+//# sourceMappingURL=claude-code-policy-script.js.map

package/dist/src/cli/hooks-writers/claude-code-policy-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-policy-script.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code-policy-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA4DxC,CAAC"}

package/dist/src/cli/hooks-writers/claude-code.d.ts

@@ -0,0 +1,12 @@
+import type { HookWriteOutcome } from "./types.js";
+export interface ClaudeCodeHookWriteOpts {
+    /** Absolute path of the user's $HOME (test override). */
+    homeDir: string;
+    /** Print outcome only; do not touch disk. */
+    dryRun: boolean;
+    /** Test injection: stable timestamp for backup IDs. */
+    now?: () => Date;
+}
+export declare function writeClaudeCodeHook(opts: ClaudeCodeHookWriteOpts): HookWriteOutcome;
+export { HooksParseFailedError } from "./errors.js";
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/src/cli/hooks-writers/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code.ts"],"names":[],"mappings":"AA6BA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAQnD,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,6CAA6C;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAmIlB;AA2GD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/cli/hooks-writers/claude-code.js

@@ -0,0 +1,228 @@
+/**
+ * Writer for `rift hooks install --client claude-code`.
+ *
+ * Idempotent install of the Rift policy hook into Claude Code's
+ * `~/.claude/settings.json`. Mirrors the `mcp-config-writers/json-config`
+ * contract:
+ *
+ *   - Atomic settings.json write (tmp + rename).
+ *   - Backup the prior settings file to `<file>.bak.<id>` if it existed
+ *     and we're about to change anything; surface only an opaque ID.
+ *   - Refuse to overwrite when the file is not parseable JSON OR when
+ *     `hooks` is present but not an object — emit a redacted error
+ *     referring to the backup ID only.
+ *   - Detect an existing Rift policy entry by command substring
+ *     ("rift-policy.mjs"); rewrite it in place rather than appending a
+ *     duplicate.
+ *   - Preserve every other top-level key, every other hook event, every
+ *     other PreToolUse entry.
+ *
+ * Hook script lifecycle:
+ *   - Always installed at `<homeDir>/.claude/hooks/rift-policy.mjs`.
+ *   - Atomic write (tmp + rename), 0755 permissions.
+ *   - Re-running with the same package version is a no-op for the script.
+ */
+import fs from "node:fs";
+import path from "node:path";
+import { CLAUDE_CODE_POLICY_SCRIPT } from "./claude-code-policy-script.js";
+import { HooksParseFailedError } from "./errors.js";
+const RIFT_HOOK_MATCHER = "mcp__rift__rift_context_pack|mcp__rift__rift_search|mcp__rift__rift_conversations_search";
+const POLICY_SCRIPT_REL = path.join(".claude", "hooks", "rift-policy.mjs");
+const SETTINGS_REL = path.join(".claude", "settings.json");
+export function writeClaudeCodeHook(opts) {
+    const scriptPath = path.join(opts.homeDir, POLICY_SCRIPT_REL);
+    const settingsPath = path.join(opts.homeDir, SETTINGS_REL);
+    const now = opts.now ?? defaultNow;
+    // 1. Read settings (or treat missing/empty as `{}`).
+    const preexistingSettings = fs.existsSync(settingsPath);
+    let raw = "";
+    let parsed = {};
+    if (preexistingSettings) {
+        raw = fs.readFileSync(settingsPath, "utf8");
+        if (raw.trim() !== "") {
+            try {
+                const candidate = JSON.parse(raw);
+                if (typeof candidate !== "object" ||
+                    candidate === null ||
+                    Array.isArray(candidate)) {
+                    throw new SyntaxError("settings.json root must be a JSON object");
+                }
+                parsed = candidate;
+            }
+            catch (err) {
+                throw failParse(settingsPath, raw, now, err, opts.dryRun);
+            }
+        }
+    }
+    // 1b. Reject malformed `hooks` shape early — same backup contract as
+    //     the JSON parse failure path.
+    const hooksField = parsed["hooks"];
+    if (hooksField !== undefined &&
+        (typeof hooksField !== "object" ||
+            hooksField === null ||
+            Array.isArray(hooksField))) {
+        throw failParse(settingsPath, raw, now, new TypeError("settings.json `hooks` is present but not an object"), opts.dryRun);
+    }
+    // 2. Compare desired script content against on-disk content.
+    const desiredScript = CLAUDE_CODE_POLICY_SCRIPT;
+    const existingScript = fs.existsSync(scriptPath)
+        ? fs.readFileSync(scriptPath, "utf8")
+        : null;
+    const scriptUpdated = existingScript !== desiredScript;
+    // 3. Merge the policy entry into PreToolUse.
+    const merged = mergeRiftHookEntry(parsed, scriptPath);
+    const settingsChanged = merged.hookEntryAdded || merged.hookEntryReplaced;
+    const willTouchDisk = scriptUpdated || settingsChanged;
+    const backupId = preexistingSettings && settingsChanged ? formatBackupId(now) : null;
+    if (opts.dryRun || !willTouchDisk) {
+        return {
+            scriptPath,
+            settingsPath,
+            preexistingSettings,
+            backupId: null,
+            scriptUpdated,
+            hookEntryAdded: merged.hookEntryAdded,
+            hookEntryReplaced: merged.hookEntryReplaced,
+            dryRun: !!opts.dryRun,
+        };
+    }
+    // 4. Write the script atomically.
+    if (scriptUpdated) {
+        fs.mkdirSync(path.dirname(scriptPath), { recursive: true });
+        const tmpScript = `${scriptPath}.tmp.${process.pid}`;
+        fs.writeFileSync(tmpScript, desiredScript, {
+            encoding: "utf8",
+            mode: 0o755,
+        });
+        fs.renameSync(tmpScript, scriptPath);
+        fs.chmodSync(scriptPath, 0o755);
+    }
+    // 5. Backup + atomically write settings if it changed.
+    if (settingsChanged) {
+        if (preexistingSettings && backupId) {
+            fs.writeFileSync(`${settingsPath}.bak.${backupId}`, raw, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+        }
+        else {
+            fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+        }
+        const tmpSettings = `${settingsPath}.tmp.${process.pid}`;
+        try {
+            fs.writeFileSync(tmpSettings, JSON.stringify(merged.parsed, null, 2) + "\n", { encoding: "utf8", mode: 0o644 });
+            fs.renameSync(tmpSettings, settingsPath);
+        }
+        catch (err) {
+            try {
+                if (fs.existsSync(tmpSettings))
+                    fs.unlinkSync(tmpSettings);
+            }
+            catch {
+                // ignore
+            }
+            if (preexistingSettings && backupId) {
+                try {
+                    fs.copyFileSync(`${settingsPath}.bak.${backupId}`, settingsPath);
+                }
+                catch {
+                    // best-effort — the backup file is the recovery surface.
+                }
+            }
+            throw err;
+        }
+    }
+    return {
+        scriptPath,
+        settingsPath,
+        preexistingSettings,
+        backupId,
+        scriptUpdated,
+        hookEntryAdded: merged.hookEntryAdded,
+        hookEntryReplaced: merged.hookEntryReplaced,
+        dryRun: false,
+    };
+}
+function mergeRiftHookEntry(parsed, scriptPath) {
+    const next = { ...parsed };
+    const hooks = typeof next["hooks"] === "object" &&
+        next["hooks"] !== null &&
+        !Array.isArray(next["hooks"])
+        ? { ...next["hooks"] }
+        : {};
+    const preToolUse = Array.isArray(hooks["PreToolUse"])
+        ? [...hooks["PreToolUse"]]
+        : [];
+    // Quote the script path in case the user's $HOME contains spaces.
+    const desiredCommand = `node "${scriptPath}"`;
+    const desiredEntry = {
+        matcher: RIFT_HOOK_MATCHER,
+        hooks: [
+            {
+                type: "command",
+                command: desiredCommand,
+                timeout: 5,
+            },
+        ],
+    };
+    let hookEntryAdded = false;
+    let hookEntryReplaced = false;
+    let foundExisting = false;
+    const updated = preToolUse.map((entry) => {
+        if (!isRiftPolicyEntry(entry))
+            return entry;
+        foundExisting = true;
+        const before = JSON.stringify(entry);
+        const after = JSON.stringify(desiredEntry);
+        if (before !== after)
+            hookEntryReplaced = true;
+        return desiredEntry;
+    });
+    if (!foundExisting) {
+        updated.push(desiredEntry);
+        hookEntryAdded = true;
+    }
+    hooks["PreToolUse"] = updated;
+    next["hooks"] = hooks;
+    return { parsed: next, hookEntryAdded, hookEntryReplaced };
+}
+function isRiftPolicyEntry(entry) {
+    if (typeof entry !== "object" || entry === null || Array.isArray(entry)) {
+        return false;
+    }
+    const e = entry;
+    const innerHooks = Array.isArray(e["hooks"]) ? e["hooks"] : [];
+    return innerHooks.some((h) => {
+        if (typeof h !== "object" || h === null)
+            return false;
+        const cmd = h["command"];
+        return typeof cmd === "string" && cmd.includes("rift-policy.mjs");
+    });
+}
+function formatBackupId(now) {
+    return `rift-hooks-claude-code-${now()
+        .toISOString()
+        .replace(/\.\d{3}Z$/, "Z")
+        .replace(/:/g, "-")}`;
+}
+function defaultNow() {
+    return new Date();
+}
+function failParse(settingsPath, raw, now, cause, dryRun) {
+    const id = formatBackupId(now);
+    if (!dryRun) {
+        try {
+            fs.mkdirSync(path.dirname(settingsPath), { recursive: true });
+            fs.writeFileSync(`${settingsPath}.bak.${id}`, raw, {
+                encoding: "utf8",
+                mode: 0o600,
+            });
+        }
+        catch {
+            // best-effort; the operator-side recovery flow handles missing backups.
+        }
+    }
+    return new HooksParseFailedError("claude-code", id, cause);
+}
+export { HooksParseFailedError } from "./errors.js";
+//# sourceMappingURL=claude-code.js.map

package/dist/src/cli/hooks-writers/claude-code.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,yBAAyB,EAAE,MAAM,gCAAgC,CAAC;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AAGpD,MAAM,iBAAiB,GACrB,0FAA0F,CAAC;AAE7F,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAW3D,MAAM,UAAU,mBAAmB,CACjC,IAA6B;IAE7B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAC;IAC9D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC3D,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,UAAU,CAAC;IAEnC,qDAAqD;IACrD,MAAM,mBAAmB,GAAG,EAAE,CAAC,UAAU,CAAC,YAAY,CAAC,CAAC;IACxD,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,MAAM,GAA4B,EAAE,CAAC;IACzC,IAAI,mBAAmB,EAAE,CAAC;QACxB,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;QAC5C,IAAI,GAAG,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;YACtB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;gBAC7C,IACE,OAAO,SAAS,KAAK,QAAQ;oBAC7B,SAAS,KAAK,IAAI;oBAClB,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,EACxB,CAAC;oBACD,MAAM,IAAI,WAAW,CAAC,0CAA0C,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,GAAG,SAAoC,CAAC;YAChD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,SAAS,CAAC,YAAY,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YAC5D,CAAC;QACH,CAAC;IACH,CAAC;IAED,qEAAqE;IACrE,mCAAmC;IACnC,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACnC,IACE,UAAU,KAAK,SAAS;QACxB,CAAC,OAAO,UAAU,KAAK,QAAQ;YAC7B,UAAU,KAAK,IAAI;YACnB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,EAC5B,CAAC;QACD,MAAM,SAAS,CACb,YAAY,EACZ,GAAG,EACH,GAAG,EACH,IAAI,SAAS,CAAC,oDAAoD,CAAC,EACnE,IAAI,CAAC,MAAM,CACZ,CAAC;IACJ,CAAC;IAED,6DAA6D;IAC7D,MAAM,aAAa,GAAG,yBAAyB,CAAC;IAChD,MAAM,cAAc,GAAG,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;QAC9C,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC;QACrC,CAAC,CAAC,IAAI,CAAC;IACT,MAAM,aAAa,GAAG,cAAc,KAAK,aAAa,CAAC;IAEvD,6CAA6C;IAC7C,MAAM,MAAM,GAAG,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAEtD,MAAM,eAAe,GAAG,MAAM,CAAC,cAAc,IAAI,MAAM,CAAC,iBAAiB,CAAC;IAC1E,MAAM,aAAa,GAAG,aAAa,IAAI,eAAe,CAAC;IACvD,MAAM,QAAQ,GACZ,mBAAmB,IAAI,eAAe,CAAC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAEtE,IAAI,IAAI,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAClC,OAAO;YACL,UAAU;YACV,YAAY;YACZ,mBAAmB;YACnB,QAAQ,EAAE,IAAI;YACd,aAAa;YACb,cAAc,EAAE,MAAM,CAAC,cAAc;YACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;YAC3C,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,MAAM;SACtB,CAAC;IACJ,CAAC;IAED,kCAAkC;IAClC,IAAI,aAAa,EAAE,CAAC;QAClB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,MAAM,SAAS,GAAG,GAAG,UAAU,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACrD,EAAE,CAAC,aAAa,CAAC,SAAS,EAAE,aAAa,EAAE;YACzC,QAAQ,EAAE,MAAM;YAChB,IAAI,EAAE,KAAK;SACZ,CAAC,CAAC;QACH,EAAE,CAAC,UAAU,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;QACrC,EAAE,CAAC,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAClC,CAAC;IAED,uDAAuD;IACvD,IAAI,eAAe,EAAE,CAAC;QACpB,IAAI,mBAAmB,IAAI,QAAQ,EAAE,CAAC;YACpC,EAAE,CAAC,aAAa,CAAC,GAAG,YAAY,QAAQ,QAAQ,EAAE,EAAE,GAAG,EAAE;gBACvD,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAChE,CAAC;QACD,MAAM,WAAW,GAAG,GAAG,YAAY,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;QACzD,IAAI,CAAC;YACH,EAAE,CAAC,aAAa,CACd,WAAW,EACX,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAC7C,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;YACF,EAAE,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;QAC3C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CAAC;gBACH,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;oBAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;YAC7D,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;YACD,IAAI,mBAAmB,IAAI,QAAQ,EAAE,CAAC;gBACpC,IAAI,CAAC;oBACH,EAAE,CAAC,YAAY,CAAC,GAAG,YAAY,QAAQ,QAAQ,EAAE,EAAE,YAAY,CAAC,CAAC;gBACnE,CAAC;gBAAC,MAAM,CAAC;oBACP,yDAAyD;gBAC3D,CAAC;YACH,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,OAAO;QACL,UAAU;QACV,YAAY;QACZ,mBAAmB;QACnB,QAAQ;QACR,aAAa;QACb,cAAc,EAAE,MAAM,CAAC,cAAc;QACrC,iBAAiB,EAAE,MAAM,CAAC,iBAAiB;QAC3C,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAQD,SAAS,kBAAkB,CACzB,MAA+B,EAC/B,UAAkB;IAElB,MAAM,IAAI,GAAG,EAAE,GAAG,MAAM,EAAE,CAAC;IAC3B,MAAM,KAAK,GACT,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,QAAQ;QACjC,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI;QACtB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC3B,CAAC,CAAC,EAAE,GAAI,IAAI,CAAC,OAAO,CAA6B,EAAE;QACnD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,UAAU,GAAc,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9D,CAAC,CAAC,CAAC,GAAI,KAAK,CAAC,YAAY,CAAe,CAAC;QACzC,CAAC,CAAC,EAAE,CAAC;IAEP,kEAAkE;IAClE,MAAM,cAAc,GAAG,SAAS,UAAU,GAAG,CAAC;IAC9C,MAAM,YAAY,GAAG;QACnB,OAAO,EAAE,iBAAiB;QAC1B,KAAK,EAAE;YACL;gBACE,IAAI,EAAE,SAAkB;gBACxB,OAAO,EAAE,cAAc;gBACvB,OAAO,EAAE,CAAC;aACX;SACF;KACF,CAAC;IAEF,IAAI,cAAc,GAAG,KAAK,CAAC;IAC3B,IAAI,iBAAiB,GAAG,KAAK,CAAC;IAC9B,IAAI,aAAa,GAAG,KAAK,CAAC;IAE1B,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACvC,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC5C,aAAa,GAAG,IAAI,CAAC;QACrB,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrC,MAAM,KAAK,GAAG,IAAI,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;QAC3C,IAAI,MAAM,KAAK,KAAK;YAAE,iBAAiB,GAAG,IAAI,CAAC;QAC/C,OAAO,YAAY,CAAC;IACtB,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC3B,cAAc,GAAG,IAAI,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,GAAG,OAAO,CAAC;IAC9B,IAAI,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;IAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,iBAAiB,EAAE,CAAC;AAC7D,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAc;IACvC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACxE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,KAAgC,CAAC;IAC3C,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,OAAO,CAAe,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9E,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAC3B,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC;QACtD,MAAM,GAAG,GAAI,CAA6B,CAAC,SAAS,CAAC,CAAC;QACtD,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACpE,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,cAAc,CAAC,GAAe;IACrC,OAAO,0BAA0B,GAAG,EAAE;SACnC,WAAW,EAAE;SACb,OAAO,CAAC,WAAW,EAAE,GAAG,CAAC;SACzB,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;AAC1B,CAAC;AAED,SAAS,UAAU;IACjB,OAAO,IAAI,IAAI,EAAE,CAAC;AACpB,CAAC;AAED,SAAS,SAAS,CAChB,YAAoB,EACpB,GAAW,EACX,GAAe,EACf,KAAc,EACd,MAAe;IAEf,MAAM,EAAE,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC;IAC/B,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,IAAI,CAAC;YACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC9D,EAAE,CAAC,aAAa,CAAC,GAAG,YAAY,QAAQ,EAAE,EAAE,EAAE,GAAG,EAAE;gBACjD,QAAQ,EAAE,MAAM;gBAChB,IAAI,EAAE,KAAK;aACZ,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,wEAAwE;QAC1E,CAAC;IACH,CAAC;IACD,OAAO,IAAI,qBAAqB,CAAC,aAAa,EAAE,EAAE,EAAE,KAAK,CAAC,CAAC;AAC7D,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/cli/hooks-writers/errors.d.ts

@@ -0,0 +1,16 @@
+import type { HookClientId } from "./types.js";
+/**
+ * Thrown when a client settings file is malformed and we refuse to
+ * overwrite. Carries a backup ID the user can reference for recovery —
+ * the file's prior contents are saved to `<settings>.bak.<id>`.
+ *
+ * Message is path-free + content-free by construction so it can be
+ * emitted directly without leaking user data.
+ */
+export declare class HooksParseFailedError extends Error {
+    readonly client: HookClientId;
+    readonly backupId: string;
+    readonly cause?: unknown;
+    constructor(client: HookClientId, backupId: string, cause?: unknown);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/cli/hooks-writers/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/errors.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C;;;;;;;GAOG;AACH,qBAAa,qBAAsB,SAAQ,KAAK;IAC9C,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,SAAkB,KAAK,CAAC,EAAE,OAAO,CAAC;gBAEtB,MAAM,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO;CAWpE"}

package/dist/src/cli/hooks-writers/errors.js

@@ -0,0 +1,24 @@
+/**
+ * Thrown when a client settings file is malformed and we refuse to
+ * overwrite. Carries a backup ID the user can reference for recovery —
+ * the file's prior contents are saved to `<settings>.bak.<id>`.
+ *
+ * Message is path-free + content-free by construction so it can be
+ * emitted directly without leaking user data.
+ */
+export class HooksParseFailedError extends Error {
+    client;
+    backupId;
+    cause;
+    constructor(client, backupId, cause) {
+        super(`rift hooks install (${client}): existing settings file is not parseable. ` +
+            `Refusing to overwrite. A backup of the prior contents was saved (id: ${backupId}). ` +
+            `Repair the file by hand and re-run, or delete it and re-run for a fresh write.`);
+        this.name = "HooksParseFailedError";
+        this.client = client;
+        this.backupId = backupId;
+        if (cause !== undefined)
+            this.cause = cause;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/cli/hooks-writers/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/errors.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IACrC,MAAM,CAAe;IACrB,QAAQ,CAAS;IACR,KAAK,CAAW;IAElC,YAAY,MAAoB,EAAE,QAAgB,EAAE,KAAe;QACjE,KAAK,CACH,uBAAuB,MAAM,8CAA8C;YACzE,wEAAwE,QAAQ,KAAK;YACrF,gFAAgF,CACnF,CAAC;QACF,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;QACpC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;QACzB,IAAI,KAAK,KAAK,SAAS;YAAE,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;IAC9C,CAAC;CACF"}

package/dist/src/cli/hooks-writers/index.d.ts

@@ -0,0 +1,13 @@
+import type { HookClientId, HookWriteOutcome } from "./types.js";
+export declare const ALL_HOOK_CLIENTS: readonly HookClientId[];
+export interface HookDispatchOpts {
+    client: HookClientId;
+    homeDir: string;
+    dryRun: boolean;
+    now?: () => Date;
+}
+export declare function writeHookConfig(opts: HookDispatchOpts): HookWriteOutcome;
+export declare function isHookClientId(s: string): s is HookClientId;
+export { HooksParseFailedError } from "./errors.js";
+export type { HookClientId, HookWriteOutcome } from "./types.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/cli/hooks-writers/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAEjE,eAAO,MAAM,gBAAgB,EAAE,SAAS,YAAY,EAE1C,CAAC;AAEX,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,YAAY,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,OAAO,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;CAClB;AAED,wBAAgB,eAAe,CAAC,IAAI,EAAE,gBAAgB,GAAG,gBAAgB,CASxE;AAED,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,YAAY,CAE3D;AAED,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC;AACpD,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC"}

package/dist/src/cli/hooks-writers/index.js

@@ -0,0 +1,26 @@
+/**
+ * Hooks-writer dispatch.
+ *
+ * Currently routes only `claude-code` — kept as a dispatch surface so
+ * adding `cursor`, `codex-cli`, or future agents doesn't require
+ * reshaping the command layer.
+ */
+import { writeClaudeCodeHook } from "./claude-code.js";
+export const ALL_HOOK_CLIENTS = [
+    "claude-code",
+];
+export function writeHookConfig(opts) {
+    switch (opts.client) {
+        case "claude-code":
+            return writeClaudeCodeHook({
+                homeDir: opts.homeDir,
+                dryRun: opts.dryRun,
+                ...(opts.now ? { now: opts.now } : {}),
+            });
+    }
+}
+export function isHookClientId(s) {
+    return ALL_HOOK_CLIENTS.includes(s);
+}
+export { HooksParseFailedError } from "./errors.js";
+//# sourceMappingURL=index.js.map

package/dist/src/cli/hooks-writers/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAGvD,MAAM,CAAC,MAAM,gBAAgB,GAA4B;IACvD,aAAa;CACL,CAAC;AASX,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,QAAQ,IAAI,CAAC,MAAM,EAAE,CAAC;QACpB,KAAK,aAAa;YAChB,OAAO,mBAAmB,CAAC;gBACzB,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACvC,CAAC,CAAC;IACP,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,OAAQ,gBAAsC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}

package/dist/src/cli/hooks-writers/types.d.ts

@@ -0,0 +1,27 @@
+/**
+ * Types for `rift hooks install` writers.
+ *
+ * Currently only `claude-code` is supported. The shape mirrors
+ * `mcp-config-writers/types.ts` so we can extend to other agents later
+ * without reshuffling the dispatch surface.
+ */
+export type HookClientId = "claude-code";
+export interface HookWriteOutcome {
+    /** Absolute path of the policy script we manage. */
+    scriptPath: string;
+    /** Absolute path of the client settings file we touched. */
+    settingsPath: string;
+    /** Whether settingsPath existed before this run. */
+    preexistingSettings: boolean;
+    /** Opaque ID surfaced to the user when a backup was written. */
+    backupId: string | null;
+    /** Hook script was written or replaced this run. */
+    scriptUpdated: boolean;
+    /** Settings entry was newly added. */
+    hookEntryAdded: boolean;
+    /** Settings entry existed but its matcher/command shape changed. */
+    hookEntryReplaced: boolean;
+    /** True when no write touched disk. */
+    dryRun: boolean;
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/cli/hooks-writers/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,YAAY,GAAG,aAAa,CAAC;AAEzC,MAAM,WAAW,gBAAgB;IAC/B,oDAAoD;IACpD,UAAU,EAAE,MAAM,CAAC;IACnB,4DAA4D;IAC5D,YAAY,EAAE,MAAM,CAAC;IACrB,oDAAoD;IACpD,mBAAmB,EAAE,OAAO,CAAC;IAC7B,gEAAgE;IAChE,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,oDAAoD;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,sCAAsC;IACtC,cAAc,EAAE,OAAO,CAAC;IACxB,oEAAoE;IACpE,iBAAiB,EAAE,OAAO,CAAC;IAC3B,uCAAuC;IACvC,MAAM,EAAE,OAAO,CAAC;CACjB"}

package/dist/src/cli/hooks-writers/types.js

@@ -0,0 +1,9 @@
+/**
+ * Types for `rift hooks install` writers.
+ *
+ * Currently only `claude-code` is supported. The shape mirrors
+ * `mcp-config-writers/types.ts` so we can extend to other agents later
+ * without reshuffling the dispatch surface.
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/cli/hooks-writers/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG"}

package/dist/src/cli/http-client.d.ts

@@ -1,5 +1,5 @@
 import { type KeychainOps } from "../auth/keychain.js";
-export type CliErrorCode = "connection_refused" | "unauthorized" | "not_found" | "conflict" | "rate_limited" | "validation" | "server_error" | "unknown";
+export type CliErrorCode = "connection_refused" | "unauthorized" | "not_found" | "invalid" | "conflict" | "rate_limited" | "validation" | "server_error" | "unknown";
 export declare class CliError extends Error {
     readonly code: CliErrorCode;
     readonly statusCode?: number | undefined;
@@ -31,6 +31,61 @@ export interface HttpClient {
     }>;
 }
 export declare function createHttpClient(opts: HttpClientOpts): HttpClient;
+/**
+ * Single source of truth for "where is the config file?" — pure path
+ * resolution, no I/O. Per A-2.1 / A-2.2:
+ *   --config wins over RIFT_CONFIG wins over default
+ *   Empty / whitespace-only RIFT_CONFIG falls through to the default
+ *   Relative paths are resolved with path.resolve at call time
+ *
+ * Callers that need the file to actually exist should use
+ * `requireExistingConfigPath` instead, which also classifies missing
+ * vs invalid distinctly.
+ */
+export declare function resolveConfigPath(globalOpts: {
+    config?: string;
+}): string;
+/**
+ * For commands that need an existing, valid config (search, save,
+ * import, ingest, mcp install, feedback, capture, etc.). Throws a
+ * `CliError` with code "not_found" or "invalid", whose messages are
+ * distinct per A-2.3a / A-2.3c. Caller should let the exception
+ * propagate so the top-level CLI handler renders it.
+ */
+export declare function requireExistingConfigPath(globalOpts: {
+    config?: string;
+}): string;
+/**
+ * No-config, no-auth direct probe of the daemon's /health endpoint.
+ * Used by `rift status` only — every other command needs config and
+ * auth. Per A-2.3a/A-2.3b: `rift status` MUST NOT hard-fail when the
+ * config is absent; it renders "config missing" instead, with the
+ * daemon's actual up/down state taken from this probe.
+ */
+export declare function probeDefaultDaemonHealth(): Promise<{
+    up: boolean;
+    uptimeSeconds?: number;
+    voyageKeyPresent?: boolean;
+}>;
+/**
+ * resolveBaseUrl stays strict — only commands that actually need the
+ * daemon URL call it, and they all need a real config. Per A-2.3a:
+ * status's no-config branch MUST NOT route through here; it uses
+ * `probeDefaultDaemonHealth()` instead.
+ */
 export declare function resolveBaseUrl(configPath: string): string;
+/**
+ * Read the current auth token. Checks `~/.rift/token` first, then the
+ * macOS Keychain. Returns `null` only when no token has been issued —
+ * a real "not yet onboarded" state. A locked Keychain (typical over
+ * SSH or in CI without a GUI session) is a recoverable *failure*, not
+ * a missing token, so it surfaces as a typed `CliError` with the exact
+ * `security unlock-keychain` recovery command.
+ *
+ * Without this conversion, CLI commands that call `readToken()` would
+ * leak the raw `security find-generic-password` failure to the user.
+ * Confirmed live on `0.1.0-beta.6` against an SSH'd test user, post-
+ * publish, before this fix landed.
+ */
 export declare function readToken(keychain?: KeychainOps): Promise<string | null>;
 //# sourceMappingURL=http-client.d.ts.map

package/dist/src/cli/http-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAAe,KAAK,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAEpE,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAkDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAGzD;AAED,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAMxB"}
+{"version":3,"file":"http-client.d.ts","sourceRoot":"","sources":["../../../src/cli/http-client.ts"],"names":[],"mappings":"AAIA,OAAO,EAGL,KAAK,WAAW,EACjB,MAAM,qBAAqB,CAAC;AAG7B,MAAM,MAAM,YAAY,GACpB,oBAAoB,GACpB,cAAc,GACd,WAAW,GACX,SAAS,GACT,UAAU,GACV,cAAc,GACd,YAAY,GACZ,cAAc,GACd,SAAS,CAAC;AAEd,qBAAa,QAAS,SAAQ,KAAK;aAGf,IAAI,EAAE,YAAY;aAClB,UAAU,CAAC,EAAE,MAAM;aACnB,IAAI,CAAC,EAAE,OAAO;gBAH9B,OAAO,EAAE,MAAM,EACC,IAAI,EAAE,YAAY,EAClB,UAAU,CAAC,EAAE,MAAM,YAAA,EACnB,IAAI,CAAC,EAAE,OAAO,YAAA;CAKjC;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,MAAM,WAAW,UAAU;IACzB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACpC,IAAI,CACF,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,OAAO,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,aAAa,CACX,IAAI,EAAE,MAAM,EACZ,IAAI,EAAE,QAAQ,EACd,OAAO,CAAC,EAAE;QAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;KAAE,GAC7C,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC9C,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC/D;AAkDD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,cAAc,GAAG,UAAU,CAqGjE;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,CAezE;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,CAAC,UAAU,EAAE;IACpD,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,GAAG,MAAM,CAqBT;AAED;;;;;;GAMG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IACxD,EAAE,EAAE,OAAO,CAAC;IACZ,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B,CAAC,CAuBD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,UAAU,EAAE,MAAM,GAAG,MAAM,CAqBzD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,SAAS,CAC7B,QAAQ,GAAE,WAAyB,GAClC,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAqBxB"}