@ghostlytools/cli 1.3.3 → 1.3.5

package/README.md

@@ -115,7 +115,7 @@ The rows are in alphabetical order of their first command, and every command of
 | `chat wait <chat> [--until live\|text\|paired] [--timeout s]` | Wait for a chat to go live, carry text, or see its contact. Live means a session that exists now, in this run of the daemon: a chat that was live before a restart counts once its contact answers again |
 | `daemon [--detach] [--timeout s]`, `daemon status`, `daemon stop [--timeout s]`, `daemon restart [--timeout s]` | Keep the profile online; `status` names its version and its socket (`socket`, for the [socket API](#the-socket-api)); `restart` stops it and starts this release's code in the background ([After an upgrade](#after-an-upgrade)). Ctrl-C, SIGTERM and the terminal closing (SIGHUP) stop it cleanly |
 | `edit <chat> <message> [text… \| --text <text> \| --stdin] [--force] [--wait none\|confirmed] [--timeout s]` | Replace the text of a message you sent (1:1 chats, `group edit` for a group; `<message>` is the `messageId` `send` gave, or its wire id). The contact sees it in place, marked edited; `--wait confirmed` waits for its app to confirm (the default without a daemon). At most 100 edits a message, no time limit; an older contact app gets it once it shows edits |
-| `engine <method> [json \| -] [--confirm-real] [--show-secret]`, `engine --list` | Any call of the app's engine |
+| `engine <method> [json \| -] [--confirm-real] [--show-secret] [--force]`, `engine --list` | Any call of the app's engine |
 | `events [--since seq]` | What the event journal holds, without following |
 | `file list <chat\|group>`, `file accept\|decline\|pause\|resume\|cancel [<chat>] <file>` | Transfers; a file over 25 MiB waits for `file accept` (files/3), and so does a group's file that did not come by itself (over 8 MiB). A file's id names its chat or its group, so `<chat>` may be left out |
 | `file resend [<chat>] <file>`, `file request [<chat>] <file>` | A file that stopped moving: sent again from here, or asked for again from the contact (a group's file: from whoever holds it); either goes on from the bytes the receiver holds (files/3) |

package/SKILL.md

@@ -358,7 +358,8 @@ proof needs a person who holds the key: leave that to the owner.
 
 - Output is JSON. A failure is `{"error":{"code","message"}}` with exit 1 (failed), 2 (usage), 3 (not found),
   4 (timed out) or 5 (needs `--force`, `--yes` or `--confirm-real`).
-- `send` refuses text that looks like a recovery phrase, a private key or a Cashu token unless `--force`.
+- `send` (and `ghostly engine sendMessage` and the other sends through `engine`) refuses text that looks like a recovery
+  phrase, a private key or a Cashu token unless `--force`.
 - Spending real money (Mainnet) needs `--confirm-real`.
 - Seeds, keys and backups are never printed without `--show-secret`; `group show` and `group list` hide entry links, and
   `chat list` and `chat show` a pending chat's invite code.

package/dist/assets/{api-Bg7bh_6E.js → api-CgPyYfjH.js}

@@ -1,3 +1,3 @@
-import { a as findChat, s as findGroup } from "./apiKit-BsUZPHLn.js";
-import { a as hideStateSecrets, i as groupSendRefused, n as SETTABLE, o as mentionsFor, r as callApi, s as redactSettings, t as API_METHODS } from "./api-B1fADtqd.js";
+import { a as findChat, s as findGroup } from "./apiKit-eh5qBKIl.js";
+import { a as hideStateSecrets, i as groupSendRefused, n as SETTABLE, o as mentionsFor, r as callApi, s as redactSettings, t as API_METHODS } from "./api-Do7NjRg2.js";
 export { API_METHODS, SETTABLE, callApi, findChat, findGroup, groupSendRefused, hideStateSecrets, mentionsFor, redactSettings };

package/dist/assets/{api-B1fADtqd.js → api-Do7NjRg2.js}

@@ -1,14 +1,14 @@
-import { $n as GROUP_FILE_LIMITS, Bo as GhostlyHttpError, Cl as randomBytes$1, Fo as AWAITING_PEER_MS, Hr as TYPING_REFRESH_MS, Qa as appCardId, Sc as ownInviteRefusal, Vr as TYPING_KINDS, Wo as LIMITS, Wr as sanitizeTypingStatus, Xi as identityStatement, Za as STATUS_CARD_LIMITS, _a as VOICE_LIMITS, _l as MAX_AVATAR_LENGTH, _o as isAppRef, at as groupName, ba as parseVoiceMeta, bc as inviteLink, ci as APP_DATA_MAX_BYTES, eo as cardLine, ga as PLAYABLE_AUDIO, ha as sanitizeMime, m as APP_PERMISSIONS, ma as sanitizeFileName, no as checkStatusCard, po as appRef, va as baseMime, vl as sanitizeAvatar, wa as readImageMeta, wl as toBase64Url, xa as voicePeaksOf, y as isAppUrl } from "./src-D7gcJElT.js";
+import { $n as GROUP_FILE_LIMITS, Bo as GhostlyHttpError, Cl as randomBytes$1, Fo as AWAITING_PEER_MS, Hr as TYPING_REFRESH_MS, Qa as appCardId, Sc as ownInviteRefusal, Vr as TYPING_KINDS, Wo as LIMITS, Wr as sanitizeTypingStatus, Xi as identityStatement, Za as STATUS_CARD_LIMITS, _a as VOICE_LIMITS, _l as MAX_AVATAR_LENGTH, _o as isAppRef, at as groupName, ba as parseVoiceMeta, bc as inviteLink, ci as APP_DATA_MAX_BYTES, eo as cardLine, ga as PLAYABLE_AUDIO, ha as sanitizeMime, m as APP_PERMISSIONS, ma as sanitizeFileName, no as checkStatusCard, po as appRef, va as baseMime, vl as sanitizeAvatar, wa as readImageMeta, wl as toBase64Url, xa as voicePeaksOf, y as isAppUrl } from "./src-BLzG4Sfv.js";
 import { c as fileStore } from "./idb-B5L8wuOm.js";
-import { O as waitingGroupFile, T as removeStored, U as iceServerProblem, W as iceServerSetting, i as groupOfFile, l as replyRef, n as groupFileId, v as paymentNetwork } from "./groupFiles-6qnLCnOm.js";
+import { O as waitingGroupFile, T as removeStored, U as iceServerProblem, W as iceServerSetting, i as groupOfFile, l as replyRef, n as groupFileId, v as paymentNetwork } from "./groupFiles-Cfrjo3YS.js";
 import { f as FILE_BYTES_STEP, o as fileBytes, s as fileBytesOf } from "./fileBytes-Di7VZtmU.js";
-import { t as IDENTITY_PROVIDERS } from "./registry-CoLHpxkb.js";
-import { a as waitForEdit, c as findSecret, i as pressable, n as buttonsCard, o as waitForGroupFrame, s as waitForMessage, t as BUTTON_METHODS } from "./buttons-DS1iURp8.js";
-import { i as ENGINE_READS, n as withStoredIds, r as ENGINE_METHODS } from "./turnRefs-PN644M9o.js";
+import { t as IDENTITY_PROVIDERS } from "./registry-BptCF3tL.js";
+import { a as waitForEdit, c as findSecret, i as pressable, n as buttonsCard, o as waitForGroupFrame, s as waitForMessage, t as BUTTON_METHODS } from "./buttons-CUKHafux.js";
+import { i as ENGINE_READS, n as withStoredIds, r as ENGINE_METHODS } from "./turnRefs-ClWSgjb0.js";
 import { i as localFileError, r as asCliError, t as CliError } from "./errors-B-zMxbcd.js";
-import { _ as str, a as findChat, c as groupOf, d as messageOf, f as node, g as state, h as sentAt, i as chatOrGroup, l as inviteTaken, m as oneOf, n as bool, o as findChatOrGroup, p as num, r as chatOf, s as findGroup, u as list, v as waitForState } from "./apiKit-BsUZPHLn.js";
-import { t as BACKUP_METHODS } from "./backup-Bbz3lyC5.js";
-import { o as checkedBundle } from "./apps-BaUNt-5c.js";
+import { _ as str, a as findChat, c as groupOf, d as messageOf, f as node, g as state, h as sentAt, i as chatOrGroup, l as inviteTaken, m as oneOf, n as bool, o as findChatOrGroup, p as num, r as chatOf, s as findGroup, u as list, v as waitForState } from "./apiKit-eh5qBKIl.js";
+import { t as BACKUP_METHODS } from "./backup-BjZcDFjL.js";
+import { o as checkedBundle } from "./apps-Cl9MtELY.js";
 import { generateMnemonic } from "@scure/bip39";
 import { wordlist } from "@scure/bip39/wordlists/english.js";
 import { openAsBlob, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -999,6 +999,17 @@ function cardTexts(value, out = []) {
 	return out;
 }
 /**
+* The first text in `value` (a card's fields, a message's text…) that looks like a seed, a private key or a Cashu token,
+* read as given and as a card carries it (`cardLine`).
+*/
+function secretIn(value) {
+	for (const text of cardTexts(value)) {
+		const secret = findSecret(text) ?? findSecret(cardLine(text, Infinity) ?? "");
+		if (secret) return secret;
+	}
+	return null;
+}
+/**
 * The secret guard `send` has (docs/CLI.md § Safety): a card whose text looks like a seed, a private key or a Cashu
 * token goes only with `--force`. `fields` are what this command gives (an update's own, not the card it merges over).
 * A card's text is read as given and as the card carries it (`cardLine`): a line loses its invisible characters on the
@@ -4061,6 +4072,7 @@ var METHODS = {
 		if (raw !== void 0 && (raw === null || typeof raw !== "object" || Array.isArray(raw))) throw new CliError("bad_request", "params must be an object");
 		let args = raw;
 		if (args && "confirmedReal" in args && !bool(params, "confirmReal")) throw new CliError("confirm", `${method} spends real money: pass --confirm-real (confirmReal: true over the socket) to confirm it`);
+		if (args && ENGINE_SENDS.has(method) && !bool(params, "force")) await guardEngineSend(ctx, method, args);
 		if (method === "getMessages") return node(ctx).getMessages(str(args ?? {}, "linkId", true));
 		if (method === "getState") return state(ctx);
 		if (method === "setActiveLink") inviteShown.get(ctx)?.();
@@ -4070,6 +4082,29 @@ var METHODS = {
 		return await target.call(node(ctx), args) ?? null;
 	}
 };
+/**
+* The engine's calls that send a text this side writes: `engine.call` runs the secret guard of `send`, `edit` and
+* `forward` on them too (docs/CLI.md § Safety), so a raw call is no way around it. `force: true` (`--force`) sends it.
+*/
+var ENGINE_SENDS = /* @__PURE__ */ new Set([
+	"sendMessage",
+	"sendGroupMessage",
+	"editMessage",
+	"forwardMessages"
+]);
+async function guardEngineSend(ctx, method, args) {
+	let texts = [args.text, args.card];
+	if (method === "forwardMessages") {
+		const ids = Array.isArray(args.messageIds) ? args.messageIds.filter((id) => typeof id === "string") : [];
+		const linkId = args.linkId;
+		texts = typeof linkId === "string" && linkId ? await Promise.all(ids.map(async (id) => {
+			const message = await node(ctx).getMessage(linkId, id);
+			return message && !message.file ? message.text : null;
+		})) : [];
+	}
+	const secret = secretIn(texts);
+	if (secret) throw new CliError("confirm", `The text looks like ${secret.kind === "cashu" ? "a Cashu token (money anyone who reads it can take)" : "a secret (a seed or a private key)"}; call ${method} with --force if you mean to`, { kind: secret.kind });
+}
 /** Reacts to a message of a chat or a group (`group:<id>`): `emoji`, or `remove` for "" (WISP 400 § Reactions). */
 async function react(ctx, linkId, params) {
 	const messageId = str(params, "message", true);
@@ -4214,4 +4249,4 @@ async function callApi(ctx, method, params = {}) {
 //#endregion
 export { flushCardUpdates as _, hideStateSecrets as a, paymentJson as c, nodeLocalFetch as d, chatJson as f, resumeHolds as g, groupMessageJson as h, groupSendRefused as i, reportAppFrames as l, groupJson as m, SETTABLE as n, mentionsFor as o, chatMessageJson as p, callApi as r, redactSettings as s, API_METHODS as t, servedApps as u };
 
-//# sourceMappingURL=api-B1fADtqd.js.map
+//# sourceMappingURL=api-Do7NjRg2.js.map