@hasna/instructions 0.4.42 → 0.5.0

package/dist/mcp/index.js

@@ -99,17 +99,17 @@ var init_retired_storage_mode = __esm(() => {
 
 // src/lib/raw-store-root.ts
 import { homedir } from "os";
-import { join, resolve } from "path";
+import { join as join2, resolve } from "path";
 function getRawStoreRoot() {
-  return resolve(process.env[RAW_STORE_ROOT_ENV] || join(process.env["HOME"] || homedir(), ".hasna", "instructions"));
+  return resolve(process.env[RAW_STORE_ROOT_ENV] || join2(process.env["HOME"] || homedir(), ".hasna", "instructions"));
 }
 var RAW_STORE_ROOT_ENV = "HASNA_CONFIGS_HOME";
 var init_raw_store_root = () => {};
 
 // src/db/database.ts
 import { Database } from "bun:sqlite";
-import { existsSync, mkdirSync, rmSync } from "fs";
-import { join as join2 } from "path";
+import { existsSync as existsSync2, mkdirSync, rmSync } from "fs";
+import { join as join3 } from "path";
 import { randomUUID } from "crypto";
 function getDbPath() {
   if (process.env["HASNA_INSTRUCTIONS_DB_PATH"]) {
@@ -117,7 +117,7 @@ function getDbPath() {
   }
   const dir = getRawStoreRoot();
   mkdirSync(dir, { recursive: true });
-  return join2(dir, "instructions.db");
+  return join3(dir, "instructions.db");
 }
 function uuid() {
   return randomUUID();
@@ -158,7 +158,7 @@ function resetLocalDatabase() {
   if (dbPath === ":memory:")
     return;
   for (const p of [dbPath, `${dbPath}-wal`, `${dbPath}-shm`]) {
-    if (existsSync(p))
+    if (existsSync2(p))
       rmSync(p);
   }
 }
@@ -596,8 +596,8 @@ var init_template = __esm(() => {
 
 // src/lib/machine.ts
 import { arch as currentArch, homedir as homedir2, hostname as currentHostname, type as currentOsType } from "os";
-import { existsSync as existsSync2 } from "fs";
-import { join as join3 } from "path";
+import { existsSync as existsSync3 } from "fs";
+import { join as join4 } from "path";
 function normalizeOsFamily(os) {
   const value = (os ?? "").trim().toLowerCase();
   if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
@@ -612,8 +612,8 @@ function detectMachineContext(overrides = {}) {
   const homeDir = overrides.home_dir ?? process.env["CONFIGS_HOME"] ?? process.env["HOME"] ?? homedir2();
   const os = overrides.os ?? currentOsType();
   const osFamily = normalizeOsFamily(os);
-  const bunBinDir = overrides.bun_bin_dir ?? join3(homeDir, ".bun", "bin");
-  const defaultBunPath = osFamily === "macos" && existsSync2(BREW_BUN_PATH) ? BREW_BUN_PATH : join3(bunBinDir, "bun");
+  const bunBinDir = overrides.bun_bin_dir ?? join4(homeDir, ".bun", "bin");
+  const defaultBunPath = osFamily === "macos" && existsSync3(BREW_BUN_PATH) ? BREW_BUN_PATH : join4(bunBinDir, "bun");
   return {
     id: "current-machine",
     hostname: overrides.hostname ?? currentHostname(),
@@ -623,10 +623,10 @@ function detectMachineContext(overrides = {}) {
     created_at: "",
     os_family: osFamily,
     home_dir: homeDir,
-    workspace_root: overrides.workspace_root ?? join3(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
+    workspace_root: overrides.workspace_root ?? join4(homeDir, osFamily === "macos" ? "Workspace" : "workspace"),
     bun_bin_dir: bunBinDir,
     bun_path: overrides.bun_path ?? defaultBunPath,
-    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join3("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
+    path_prefix: overrides.path_prefix ?? (osFamily === "macos" ? `${join4("/opt", "homebrew", "bin")}:${bunBinDir}` : bunBinDir)
   };
 }
 function machineContextToVariables(machine) {
@@ -5115,7 +5115,7 @@ var init_session_render_contract = __esm(() => {
 });
 
 // src/lib/project-context.ts
-import { basename, dirname, isAbsolute, join as join4, parse, relative, resolve as resolve2 } from "path";
+import { basename, dirname as dirname2, isAbsolute, join as join5, parse, relative, resolve as resolve2 } from "path";
 function revisionKey(value) {
   const sequence = value.match(/^(?:rev-)?([0-9]+)$/);
   if (sequence)
@@ -5678,7 +5678,7 @@ var init_asset_plan = __esm(() => {
 // src/lib/cursor-authority.ts
 import { createHash } from "crypto";
 import { homedir as homedir3 } from "os";
-import { join as join5, resolve as resolve3 } from "path";
+import { join as join6, resolve as resolve3 } from "path";
 function sha256(content) {
   return createHash("sha256").update(content).digest("hex");
 }
@@ -5686,7 +5686,7 @@ function homeDir() {
   return process.env["HOME"] || homedir3();
 }
 function isCursorGlobalAuthorityPath(path) {
-  return resolve3(path) === resolve3(join5(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
+  return resolve3(path) === resolve3(join6(homeDir(), CURSOR_GLOBAL_AUTHORITY_RELATIVE_PATH));
 }
 function stampCursorGlobalAuthorityMarker(content) {
   if (CURSOR_GLOBAL_AUTHORITY_MARKER_PATTERN.test(content))
@@ -6884,8 +6884,8 @@ var init_config_store = __esm(() => {
 });
 
 // src/lib/session-render-ownership.ts
-import { existsSync as existsSync3, readFileSync, statSync } from "fs";
-import { dirname as dirname2, join as join6, parse as parse2, relative as relative2, sep } from "path";
+import { existsSync as existsSync4, readFileSync as readFileSync2, statSync } from "fs";
+import { dirname as dirname3, join as join7, parse as parse2, relative as relative2, sep } from "path";
 function toSegments(absolutePath2) {
   return absolutePath2.replaceAll("\\", "/").split("/").filter(Boolean);
 }
@@ -6904,19 +6904,19 @@ function pathIsSessionRenderManagedDir(absolutePath2) {
 function readManifestRelativePaths(manifestPath) {
   let stats;
   try {
-    if (!existsSync3(manifestPath))
+    if (!existsSync4(manifestPath))
       return null;
     stats = statSync(manifestPath);
   } catch {
     return null;
   }
-  const cached = manifestCache.get(manifestPath);
-  if (cached && cached.mtimeMs === stats.mtimeMs && cached.size === stats.size) {
-    return cached.relativePaths;
+  const cached2 = manifestCache.get(manifestPath);
+  if (cached2 && cached2.mtimeMs === stats.mtimeMs && cached2.size === stats.size) {
+    return cached2.relativePaths;
   }
   let manifest;
   try {
-    manifest = JSON.parse(readFileSync(manifestPath, "utf-8"));
+    manifest = JSON.parse(readFileSync2(manifestPath, "utf-8"));
   } catch {
     return null;
   }
@@ -6931,16 +6931,16 @@ function readManifestRelativePaths(manifestPath) {
 }
 function sessionRenderManifestClaimsPath(absolutePath2) {
   const root = parse2(absolutePath2).root;
-  let home = dirname2(absolutePath2);
+  let home = dirname3(absolutePath2);
   for (let depth = 0;depth < MANIFEST_ANCESTOR_LIMIT; depth += 1) {
-    const manifestPath = join6(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
+    const manifestPath = join7(home, ...SESSION_RENDER_MANIFEST_RELATIVE_PATH.split("/"));
     const relativePaths = readManifestRelativePaths(manifestPath);
     if (relativePaths) {
       const claimed = relative2(home, absolutePath2).split(sep).join("/");
       if (relativePaths.has(claimed))
         return true;
     }
-    const parent = dirname2(home);
+    const parent = dirname3(home);
     if (parent === home || home === root)
       break;
     home = parent;
@@ -6968,8 +6968,8 @@ __export(exports_apply, {
   applyConfigs: () => applyConfigs,
   applyConfig: () => applyConfig
 });
-import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync2, realpathSync, writeFileSync } from "fs";
-import { basename as basename3, dirname as dirname3, join as join7, resolve as resolve4 } from "path";
+import { existsSync as existsSync5, mkdirSync as mkdirSync2, readFileSync as readFileSync3, realpathSync, writeFileSync } from "fs";
+import { basename as basename3, dirname as dirname4, join as join8, resolve as resolve4 } from "path";
 import { homedir as homedir4 } from "os";
 function getConfigHome() {
   return process.env["CONFIGS_HOME"] || process.env["HOME"] || homedir4();
@@ -6988,14 +6988,14 @@ function normalizeTargetPath(p) {
     let current = expanded;
     const missingSegments = [];
     while (true) {
-      if (existsSync4(current)) {
+      if (existsSync5(current)) {
         try {
           return resolve4(realpathSync(current), ...missingSegments);
         } catch {
           return expanded;
         }
       }
-      const parent = dirname3(current);
+      const parent = dirname4(current);
       const name = basename3(current);
       if (parent === current)
         return expanded;
@@ -7019,11 +7019,11 @@ async function writeConfigResult(config, targetPath, content, opts, meta = {}) {
   }
   const path = expandPath(renderedTargetPath);
   const renderedForTarget = isCursorGlobalAuthorityPath(path) ? stampCursorGlobalAuthorityMarker(renderedContent) : renderedContent;
-  const previousContent = existsSync4(path) ? readFileSync2(path, "utf-8") : null;
+  const previousContent = existsSync5(path) ? readFileSync3(path, "utf-8") : null;
   const changed = previousContent !== renderedForTarget;
   if (!opts.dryRun) {
-    const dir = dirname3(path);
-    if (!existsSync4(dir)) {
+    const dir = dirname4(path);
+    if (!existsSync5(dir)) {
       mkdirSync2(dir, { recursive: true });
     }
     if (previousContent !== null && changed) {
@@ -7057,9 +7057,9 @@ function wouldDestroyACredential(targetPath, renderedContent, format) {
   let current;
   try {
     const path = expandPath(targetPath);
-    if (!existsSync4(path))
+    if (!existsSync5(path))
       return [];
-    current = readFileSync2(path, "utf-8");
+    current = readFileSync3(path, "utf-8");
   } catch {
     return secretTokens;
   }
@@ -7147,7 +7147,7 @@ async function applyPreparedConfig(config, opts) {
       changed: outputResults.some((output) => output.changed)
     };
   }
-  if (!opts.dryRun) {
+  if (!opts.dryRun && result.changed) {
     await store.updateConfig(config.id, { synced_at: new Date().toISOString() });
   }
   return result;
@@ -7383,7 +7383,7 @@ function sessionRendererOwnsCanonicalTarget(normalized, opts) {
     getConfigHome(),
     opts.vars?.["HOME_DIR"]
   ].filter((home) => typeof home === "string" && home.length > 0));
-  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join7(home, ...relativePath.split("/"))))))
+  if ([...homes].some((home) => SESSION_RENDER_OWNED_CONFIG_TARGETS.some((relativePath) => normalized === normalizeTargetPath(join8(home, ...relativePath.split("/"))))))
     return true;
   return sessionRenderOwnsPath(normalized);
 }
@@ -7416,8 +7416,8 @@ __export(exports_sync, {
   KNOWN_CONFIGS: () => KNOWN_CONFIGS,
   CLAUDE_PROMPT_OUTPUTS: () => CLAUDE_PROMPT_OUTPUTS
 });
-import { existsSync as existsSync5, readdirSync, readFileSync as readFileSync3 } from "fs";
-import { basename as basename4, extname as extname2, join as join8 } from "path";
+import { existsSync as existsSync6, readdirSync, readFileSync as readFileSync4 } from "fs";
+import { basename as basename4, extname as extname2, join as join9 } from "path";
 function claudeRuleOutputs(fileName) {
   const stem = basename4(fileName, extname2(fileName));
   return [
@@ -7456,7 +7456,7 @@ function isGeneratedOutputTarget2(config, owners) {
   return !!ownerIds && !ownerIds.has(config.id);
 }
 function hasClaudePromptSource() {
-  return existsSync5(expandPath("~/.claude/CLAUDE.md"));
+  return existsSync6(expandPath("~/.claude/CLAUDE.md"));
 }
 function hasClaudeRuleSourceForCursorTarget(targetPath) {
   const absoluteTargetPath = expandPath(targetPath);
@@ -7464,7 +7464,7 @@ function hasClaudeRuleSourceForCursorTarget(targetPath) {
   if (!absoluteTargetPath.startsWith(`${absolutePrefix}/`) || !absoluteTargetPath.endsWith(".mdc"))
     return false;
   const stem = basename4(absoluteTargetPath, ".mdc");
-  return existsSync5(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync5(expandPath(`~/.claude/rules/${stem}.mdc`));
+  return existsSync6(expandPath(`~/.claude/rules/${stem}.md`)) || existsSync6(expandPath(`~/.claude/rules/${stem}.mdc`));
 }
 function isKnownGeneratedTargetPath(targetPath) {
   const normalizedTargetPath = normalizeTargetPath(targetPath);
@@ -7481,11 +7481,11 @@ async function syncProject(opts) {
   const allConfigs = await store.listConfigs();
   const machine = detectMachineContext();
   for (const pf of PROJECT_CONFIG_FILES) {
-    const abs = join8(absDir, pf.file);
-    if (!existsSync5(abs))
+    const abs = join9(absDir, pf.file);
+    if (!existsSync6(abs))
       continue;
     try {
-      const rawContent = readFileSync3(abs, "utf-8");
+      const rawContent = readFileSync4(abs, "utf-8");
       if (rawContent.length > 500000) {
         result.skipped.push(pf.file);
         continue;
@@ -7514,20 +7514,20 @@ async function syncProject(opts) {
     }
   }
   for (const ruleDir of [
-    { dir: join8(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
-    { dir: join8(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
-    { dir: join8(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
-    { dir: join8(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
-    { dir: join8(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
-    { dir: join8(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
-    { dir: join8(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
+    { dir: join9(absDir, ".claude", "rules"), agent: "claude", namePrefix: "rules" },
+    { dir: join9(absDir, ".agents", "rules"), agent: "antigravity", namePrefix: "antigravity-rules" },
+    { dir: join9(absDir, ".cursor", "rules"), agent: "cursor", namePrefix: "cursor-rules" },
+    { dir: join9(absDir, ".github", "instructions"), agent: "copilot", namePrefix: "copilot-instructions" },
+    { dir: join9(absDir, ".devin", "rules"), agent: "devin", namePrefix: "devin-rules" },
+    { dir: join9(absDir, ".windsurf", "rules"), agent: "windsurf-legacy", namePrefix: "windsurf-rules" },
+    { dir: join9(absDir, ".clinerules"), agent: "cline", namePrefix: "cline-rules" }
   ]) {
-    if (!existsSync5(ruleDir.dir))
+    if (!existsSync6(ruleDir.dir))
       continue;
     const mdFiles = readdirSync(ruleDir.dir).filter((f) => f.endsWith(".md") || f.endsWith(".mdc"));
     for (const f of mdFiles) {
-      const abs = join8(ruleDir.dir, f);
-      const raw = readFileSync3(abs, "utf-8");
+      const abs = join9(ruleDir.dir, f);
+      const raw = readFileSync4(abs, "utf-8");
       const redacted = redactContent(raw, "markdown");
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
@@ -7566,20 +7566,20 @@ async function syncKnown(opts = {}) {
   for (const known of targets) {
     if (known.rulesDir) {
       const absDir = expandPath(known.rulesDir);
-      if (!existsSync5(absDir)) {
+      if (!existsSync6(absDir)) {
         result.skipped.push(known.rulesDir);
         continue;
       }
       const extensions = known.rulesExtensions ?? [".md", ".mdc"];
       const ruleFiles = readdirSync(absDir).filter((f) => extensions.some((ext) => f.endsWith(ext)));
       for (const f of ruleFiles) {
-        const abs2 = join8(absDir, f);
+        const abs2 = join9(absDir, f);
         const targetPath = abs2.replace(home, "~");
         if (existingOutputOwners.has(normalizeTargetPath(targetPath)) || isKnownGeneratedTargetPath(targetPath)) {
           result.skipped.push(`${targetPath} (generated output)`);
           continue;
         }
-        const raw = readFileSync3(abs2, "utf-8");
+        const raw = readFileSync4(abs2, "utf-8");
         const redacted = redactContent(raw, "markdown");
         const machineAware = templateizeMachineContent(redacted.content, machine);
         const content = machineAware.content;
@@ -7607,18 +7607,18 @@ async function syncKnown(opts = {}) {
       continue;
     }
     const abs = expandPath(known.path);
-    if (!existsSync5(abs)) {
+    if (!existsSync6(abs)) {
       result.skipped.push(known.path);
       continue;
     }
     try {
-      const rawContent = normalizeKnownConfigSource(known, readFileSync3(abs, "utf-8"));
+      const rawContent = normalizeKnownConfigSource(known, readFileSync4(abs, "utf-8"));
       if (rawContent.length > 500000) {
         result.skipped.push(known.path + " (too large)");
         continue;
       }
       const fmt = known.format ?? detectFormat(abs);
-      const redacted = redactContent(rawContent, fmt);
+      const redacted = redactContent(rawContent, redactFormatForTarget(abs, fmt));
       const machineAware = templateizeMachineContent(redacted.content, machine);
       const content = machineAware.content;
       const isTemplate2 = redacted.isTemplate || machineAware.changed;
@@ -7713,9 +7713,9 @@ function storedPlaceholderIsLiteralOnDisk(storedLine, diskLine) {
 }
 function buildDiff(expectedContent, targetPath, storedFormat, showSecrets) {
   const path = expandPath(targetPath);
-  if (!existsSync5(path))
+  if (!existsSync6(path))
     return `(file not found on disk: ${path})`;
-  const diskContent = readFileSync3(path, "utf-8");
+  const diskContent = readFileSync4(path, "utf-8");
   if (diskContent === expectedContent)
     return "(no diff \u2014 identical)";
   const format = redactFormatForTarget(targetPath, storedFormat);
@@ -7943,8 +7943,8 @@ var init_sync = __esm(() => {
 });
 
 // src/lib/sync-dir.ts
-import { existsSync as existsSync6, readdirSync as readdirSync2, readFileSync as readFileSync4, statSync as statSync2 } from "fs";
-import { join as join9, relative as relative3 } from "path";
+import { existsSync as existsSync7, readdirSync as readdirSync2, readFileSync as readFileSync5, statSync as statSync2 } from "fs";
+import { join as join10, relative as relative3 } from "path";
 import { homedir as homedir5 } from "os";
 function shouldSkip(p) {
   return SKIP.some((s) => p.includes(s));
@@ -7952,9 +7952,9 @@ function shouldSkip(p) {
 async function syncFromDir(dir, opts = {}) {
   const store = opts.store ?? resolveConfigStore();
   const absDir = expandPath(dir);
-  if (!existsSync6(absDir))
+  if (!existsSync7(absDir))
     return { added: 0, updated: 0, unchanged: 0, skipped: [`Not found: ${absDir}`] };
-  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync2(absDir).map((f) => join9(absDir, f)).filter((f) => statSync2(f).isFile());
+  const files = opts.recursive !== false ? walkDir(absDir) : readdirSync2(absDir).map((f) => join10(absDir, f)).filter((f) => statSync2(f).isFile());
   const result = { added: 0, updated: 0, unchanged: 0, skipped: [] };
   const home = homedir5();
   const allConfigs = await store.listConfigs();
@@ -7964,20 +7964,21 @@ async function syncFromDir(dir, opts = {}) {
       continue;
     }
     try {
-      const content = readFileSync4(file, "utf-8");
+      const content = readFileSync5(file, "utf-8");
       if (content.length > 500000) {
         result.skipped.push(file + " (too large)");
         continue;
       }
       const targetPath = file.replace(home, "~");
+      const redacted = redactContent(content, redactFormatForTarget(targetPath, detectFormat(file)));
       const existing = allConfigs.find((c) => c.target_path === targetPath);
       if (!existing) {
         if (!opts.dryRun)
-          await store.createConfig({ name: relative3(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content });
+          await store.createConfig({ name: relative3(absDir, file), category: detectCategory(file), agent: detectAgent(file), target_path: targetPath, format: detectFormat(file), content: redacted.content });
         result.added++;
-      } else if (existing.content !== content) {
+      } else if (existing.content !== redacted.content) {
         if (!opts.dryRun)
-          await store.updateConfig(existing.id, { content });
+          await store.updateConfig(existing.id, { content: redacted.content });
         result.updated++;
       } else {
         result.unchanged++;
@@ -8014,7 +8015,7 @@ async function syncToDir(dir, opts = {}) {
 }
 function walkDir(dir, files = []) {
   for (const entry of readdirSync2(dir, { withFileTypes: true })) {
-    const full = join9(dir, entry.name);
+    const full = join10(dir, entry.name);
     if (shouldSkip(full))
       continue;
     if (entry.isDirectory())
@@ -8029,6 +8030,7 @@ var init_sync_dir = __esm(() => {
   init_config_store();
   init_apply();
   init_sync();
+  init_redact();
   SKIP = [".db", ".db-shm", ".db-wal", ".log", ".lock", ".DS_Store", "node_modules", ".git"];
 });
 
@@ -8036,7 +8038,7 @@ var init_sync_dir = __esm(() => {
 var require_package = __commonJS((exports, module) => {
   module.exports = {
     name: "@hasna/instructions",
-    version: "0.4.42",
+    version: "0.5.0",
     description: "AI coding agent instruction & configuration manager \u2014 store, version, apply, and share all your AI coding configs. CLI + MCP + HTTP API (instructions-serve) + generated SDK + Dashboard.",
     type: "module",
     main: "dist/index.js",
@@ -8112,7 +8114,7 @@ var require_package = __commonJS((exports, module) => {
     author: "Andrei Hasna <andrei@hasna.com>",
     license: "Apache-2.0",
     dependencies: {
-      "@hasna/contracts": "0.13.3",
+      "@hasna/contracts": "0.14.0",
       "@hasna/events": "^0.1.16",
       "@modelcontextprotocol/sdk": "^1.12.1",
       chalk: "^5.4.1",
@@ -8136,6 +8138,35 @@ var require_package = __commonJS((exports, module) => {
 // src/mcp/index.ts
 import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
 
+// src/lib/package-version.ts
+import { existsSync, readFileSync } from "fs";
+import { dirname, join } from "path";
+import { fileURLToPath } from "url";
+var cached = null;
+function getPackageVersion() {
+  if (cached)
+    return cached;
+  try {
+    let dir = dirname(fileURLToPath(import.meta.url));
+    for (let i = 0;i < 8; i++) {
+      const pkgPath = join(dir, "package.json");
+      if (existsSync(pkgPath)) {
+        const pkg = JSON.parse(readFileSync(pkgPath, "utf8"));
+        if (pkg.name === "@hasna/instructions" && pkg.version) {
+          cached = pkg.version;
+          return cached;
+        }
+      }
+      const parent = dirname(dir);
+      if (parent === dir)
+        break;
+      dir = parent;
+    }
+  } catch {}
+  cached = "0.0.0";
+  return cached;
+}
+
 // src/mcp/server.ts
 init_config_store();
 init_apply();
@@ -8374,7 +8405,7 @@ function buildServer() {
           const allConfigs = await store.listConfigs({ kind: "file" });
           const { existsSync: ex, readFileSync: rf } = await import("fs");
           const { expandPath: expandPath2 } = await Promise.resolve().then(() => (init_apply(), exports_apply));
-          const { redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
+          const { redactContent: redactContent2, redactFormatForTarget: redactFormatForTarget2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
           let drifted = 0, missing = 0, templates = 0;
           const driftedSlugs = [];
           for (const c of allConfigs) {
@@ -8388,7 +8419,7 @@ function buildServer() {
               continue;
             }
             const disk = rf(abs, "utf-8");
-            const { content: redactedDisk } = redactContent2(disk, c.format);
+            const { content: redactedDisk } = redactContent2(disk, redactFormatForTarget2(c.target_path, c.format));
             if (redactedDisk !== c.content) {
               drifted++;
               driftedSlugs.push(c.slug);
@@ -8435,11 +8466,11 @@ function buildServer() {
           return ok({ rendered, config_id: config.id, slug: config.slug });
         }
         case "scan_secrets": {
-          const { scanSecrets: scanSecrets2, redactContent: redactContent2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
+          const { scanSecrets: scanSecrets2, redactContent: redactContent2, redactFormatForTarget: redactFormatForTarget2 } = await Promise.resolve().then(() => (init_redact(), exports_redact));
           const configs = args["id_or_slug"] ? [await store.getConfig(args["id_or_slug"])] : await store.listConfigs({ kind: "file" });
           const findings = [];
           for (const c of configs) {
-            const fmt = c.format;
+            const fmt = redactFormatForTarget2(c.target_path ?? "", c.format);
             const secrets = scanSecrets2(c.content, fmt);
             if (secrets.length > 0) {
               findings.push({ slug: c.slug, secrets: secrets.length, vars: secrets.map((s) => s.varName) });
@@ -8587,6 +8618,24 @@ async function startMcpHttpServer(port) {
 // src/mcp/index.ts
 async function main() {
   const argv = process.argv.slice(2);
+  if (argv.includes("--version") || argv.includes("-V")) {
+    console.log(getPackageVersion());
+    return;
+  }
+  if (argv.includes("--help") || argv.includes("-h")) {
+    console.log(`Usage: configs-mcp [options]
+
+MCP server for @hasna/instructions (Streamable HTTP by default; --stdio to select stdio).
+
+Options:
+  -V, --version  output the version number
+  -h, --help     display help for command
+  --claude       register with Claude Code (stdio, user scope)
+  --http         explicitly select Streamable HTTP transport
+  --stdio        explicitly select stdio transport
+  --port <n>     HTTP port (default: 8853)`);
+    return;
+  }
   if (argv.includes("--claude")) {
     const proc = Bun.spawn(["claude", "mcp", "add", "--transport", "stdio", "--scope", "user", "configs", "--", "configs-mcp"], { stdout: "inherit", stderr: "inherit" });
     await proc.exited;

package/dist/mcp/server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CAyVpC"}
+{"version":3,"file":"server.d.ts","sourceRoot":"","sources":["../../src/mcp/server.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,MAAM,EAAE,MAAM,2CAA2C,CAAC;AA4EnE,wBAAgB,WAAW,IAAI,MAAM,CA+VpC"}

package/dist/server/cloud.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/server/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,UAAU,EAAE,KAAK,cAAc,EAAE,WAAW,EAAwB,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAI1G,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAQhG;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO7F;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEtF;AA0BD,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,eAAe,CAEhD;AAkBD,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAejD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAUvD;AAQD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAmB7F;AAED,iEAAiE;AACjE,wBAAsB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAIlD;AAED,4BAA4B;AAC5B,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAMhD"}
+{"version":3,"file":"cloud.d.ts","sourceRoot":"","sources":["../../src/server/cloud.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAgB,UAAU,EAAE,KAAK,cAAc,EAAE,WAAW,EAAwB,MAAM,uBAAuB,CAAC;AACzH,OAAO,EAAmC,KAAK,eAAe,EAAE,MAAM,mCAAmC,CAAC;AAI1G,eAAO,MAAM,qBAAqB,iBAAiB,CAAC;AAEpD,oFAAoF;AACpF,wBAAgB,uBAAuB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAQhG;AAED,+DAA+D;AAC/D,wBAAgB,oBAAoB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,GAAG,SAAS,CAO7F;AAED,wFAAwF;AACxF,wBAAgB,wBAAwB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,OAAO,CAEtF;AA0BD,+EAA+E;AAC/E,wBAAgB,cAAc,IAAI,eAAe,CAEhD;AAkBD,wBAAgB,cAAc,IAAI,WAAW,CAI5C;AAED;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,IAAI,cAAc,CAejD;AAED;;;;GAIG;AACH,wBAAsB,iBAAiB,IAAI,OAAO,CAAC,IAAI,CAAC,CAkBvD;AAQD,wBAAgB,qBAAqB,CAAC,cAAc,EAAE,MAAM,EAAE,GAAG,UAAU,CAAC,OAAO,UAAU,CAAC,CAmB7F;AAED,iEAAiE;AACjE,wBAAsB,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC,CAIlD;AAED,4BAA4B;AAC5B,wBAAsB,UAAU,IAAI,OAAO,CAAC,IAAI,CAAC,CAMhD"}

package/dist/server/early-args.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=early-args.test.d.ts.map

package/dist/server/early-args.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"early-args.test.d.ts","sourceRoot":"","sources":["../../src/server/early-args.test.ts"],"names":[],"mappings":""}

package/dist/server/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";;;;;;AAiJA,wBAAgE"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/server/index.ts"],"names":[],"mappings":";;;;;;AAsKA,wBAAgE"}

package/dist/server/index.js

@@ -2779,7 +2779,10 @@ async function ensureCloudSchema() {
       await client.execute(sql);
     }
     await getApiKeyStore().ensureSchema();
-  })();
+  })().catch((e) => {
+    schemaEnsured = null;
+    throw e;
+  });
   return schemaEnsured;
 }
 var honoMiddlewareCache = new Map;
@@ -2865,6 +2868,18 @@ function boundedReadPage(items, total, options = {}) {
   };
 }
 
+// src/lib/machine.ts
+function normalizeOsFamily(os) {
+  const value = (os ?? "").trim().toLowerCase();
+  if (value === "darwin" || value === "macos" || value === "mac" || value === "osx")
+    return "macos";
+  if (value === "linux")
+    return "linux";
+  if (value === "windows_nt" || value === "windows" || value === "win32")
+    return "windows";
+  return value || "unknown";
+}
+
 // src/lib/provider-version.ts
 function providerVersionSatisfies(version, range) {
   const current = parseProviderVersion(version);
@@ -8161,6 +8176,7 @@ async function resolveProfileForMachineRead2(client, machine, options = {}) {
   const { limit } = normalizeBoundedReadOptions(options);
   const host = (machine.hostname ?? "").trim().toLowerCase();
   const os = (machine.os ?? "").trim().toLowerCase();
+  const osFamily = normalizeOsFamily(machine.os);
   const arch = (machine.arch ?? "").trim().toLowerCase();
   let cursor = 0;
   let scanned = 0;
@@ -8174,7 +8190,10 @@ async function resolveProfileForMachineRead2(client, machine, options = {}) {
       if (!profileHasSelectors(p.selectors))
         continue;
       const s = p.selectors;
-      const osOk = !s.os?.length || s.os.some((c) => c.trim().toLowerCase() === os);
+      const osOk = !s.os?.length || s.os.some((c) => {
+        const value = c.trim().toLowerCase();
+        return value === os || normalizeOsFamily(c) === osFamily;
+      });
       const archOk = !s.arch?.length || s.arch.some((c) => c.trim().toLowerCase() === arch);
       const hostOk = !s.hostnames?.length || s.hostnames.some((c) => c.trim().toLowerCase() === host);
       if (!osOk || !archOk || !hostOk)
@@ -9108,6 +9127,23 @@ if (process.argv.includes("--version") || process.argv.includes("-V")) {
   console.log(getPackageVersion());
   process.exit(0);
 }
+if (process.argv.includes("--help") || process.argv.includes("-h")) {
+  console.log(`Usage: instructions-serve [options]
+
+HTTP API server for @hasna/instructions (backend: sqlite or postgresql).
+
+Options:
+  -V, --version  output the version number
+  -h, --help     display help for command
+  migrate        apply the schema migration to the configured database and exit
+
+Environment:
+  PORT / INSTRUCTIONS_PORT        HTTP port (default: 3457)
+  HOST / INSTRUCTIONS_HOST        bind host (default: localhost)
+  HASNA_INSTRUCTIONS_DATABASE_URL / INSTRUCTIONS_DATABASE_URL / DATABASE_URL
+                                  postgresql backend URL (enables the cloud backend)`);
+  process.exit(0);
+}
 var PORT = Number(process.env["PORT"] ?? process.env["INSTRUCTIONS_PORT"] ?? 3457);
 var app = new Hono2;
 app.use("*", cors());

package/dist/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAW9E,KAAK,WAAW,GAAG,4BAA4B,GAAG,IAAI,CAAC;AACvD,KAAK,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;AACtC,KAAK,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,SAAS,CAAC;IACnB,aAAa,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,EAAE;QACH,QAAQ,EAAE;YACR,OAAO,EAAE,4BAA4B,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC;YACpB,IAAI,EAAE,YAAY,CAAC;SACpB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC;YAClB,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE;YACpB,aAAa,EAAE,MAAM,CAAC;YACtB,OAAO,EAAE,MAAM,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,cAAc,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,wBAAwB,EAAE,MAAM,CAAC;QACjC,gBAAgB,EAAE,MAAM,CAAC;QACzB,2BAA2B,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,8BAA8B,EAAE,OAAO,CAAC;KACzC,CAAC;IACF,MAAM,EAAE;QACN,oBAAoB,EAAE,KAAK,CAAC;QAC5B,oBAAoB,EAAE,KAAK,CAAC;QAC5B,iBAAiB,EAAE,KAAK,CAAC;QACzB,oBAAoB,EAAE,KAAK,CAAC;QAC5B,0BAA0B,EAAE,IAAI,CAAC;KAClC,CAAC;CACH;AAsBD,wBAAsB,gBAAgB,CACpC,KAAK,GAAE,WAAkC,EACzC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,OAAO,CAAC,qBAAqB,CAAC,CAmIhC"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../src/status.ts"],"names":[],"mappings":"AACA,OAAO,EAAsB,KAAK,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAW9E,KAAK,WAAW,GAAG,4BAA4B,GAAG,IAAI,CAAC;AACvD,KAAK,YAAY,GAAG,QAAQ,GAAG,MAAM,CAAC;AACtC,KAAK,cAAc,GAAG,IAAI,GAAG,MAAM,CAAC;AAEpC,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,SAAS,CAAC;IACnB,aAAa,EAAE,KAAK,CAAC;IACrB,OAAO,EAAE;QACP,IAAI,EAAE,MAAM,CAAC;QACb,OAAO,EAAE,MAAM,CAAC;KACjB,CAAC;IACF,GAAG,EAAE;QACH,QAAQ,EAAE;YACR,OAAO,EAAE,4BAA4B,CAAC;YACtC,MAAM,EAAE,WAAW,CAAC;YACpB,IAAI,EAAE,YAAY,CAAC;SACpB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,OAAO,EAAE;YACP,KAAK,EAAE,MAAM,CAAC;YACd,IAAI,EAAE,MAAM,CAAC;YACb,SAAS,EAAE,MAAM,CAAC;YAClB,SAAS,EAAE,MAAM,CAAC;YAClB,gBAAgB,EAAE,MAAM,CAAC;SAC1B,CAAC;QACF,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAChC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QACjC,QAAQ,EAAE,MAAM,CAAC;QACjB,YAAY,EAAE,MAAM,CAAC;QACrB,QAAQ,EAAE,MAAM,CAAC;QACjB,SAAS,EAAE,MAAM,CAAC;QAClB,YAAY,EAAE,MAAM,CAAC;QACrB,oBAAoB,EAAE;YACpB,aAAa,EAAE,MAAM,CAAC;YACtB,OAAO,EAAE,MAAM,CAAC;YAChB,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;KACH,CAAC;IACF,MAAM,EAAE;QACN,MAAM,EAAE,cAAc,CAAC;QACvB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,cAAc,EAAE,MAAM,CAAC;QACvB,cAAc,EAAE,MAAM,CAAC;QACvB,wBAAwB,EAAE,MAAM,CAAC;QACjC,gBAAgB,EAAE,MAAM,CAAC;QACzB,2BAA2B,EAAE,MAAM,CAAC;QACpC,QAAQ,EAAE,OAAO,CAAC;QAClB,iBAAiB,EAAE,OAAO,CAAC;QAC3B,oBAAoB,EAAE,OAAO,CAAC;QAC9B,mBAAmB,EAAE,OAAO,CAAC;QAC7B,8BAA8B,EAAE,OAAO,CAAC;KACzC,CAAC;IACF,MAAM,EAAE;QACN,oBAAoB,EAAE,KAAK,CAAC;QAC5B,oBAAoB,EAAE,KAAK,CAAC;QAC5B,iBAAiB,EAAE,KAAK,CAAC;QACzB,oBAAoB,EAAE,KAAK,CAAC;QAC5B,0BAA0B,EAAE,IAAI,CAAC;KAClC,CAAC;CACH;AAsBD,wBAAsB,gBAAgB,CACpC,KAAK,GAAE,WAAkC,EACzC,OAAO,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,oBAAoB,CAAC,EAAE,MAAM,CAAA;CAAO,GAChE,OAAO,CAAC,qBAAqB,CAAC,CA0IhC"}