@hivecommons/promptargs 0.7.0 → 0.9.0

package/dist/ui.html

@@ -1,6 +1,8 @@
 <title>promptargs builder</title>
 <meta charset="utf-8">
 <meta name="viewport" content="width=device-width, initial-scale=1">
+<!-- The page URL carries the per-run access token; never send it as a Referer. -->
+<meta name="referrer" content="no-referrer">
 <style>
   * { margin: 0; padding: 0; box-sizing: border-box; }
 
@@ -749,7 +751,12 @@ import { cartesian as sharedCartesian, zip as sharedZip } from './iterate.js';
 
   function syncVarsFromTemplate() {
     const text = tmpl.value;
-    const parsed = parseVars(text);
+    let parsed;
+    try {
+      parsed = parseVars(text);
+    } catch {
+      return; // update() reports the parse error in the preview
+    }
     const existing = getRowData();
     const existingNames = new Set(existing.map(r => r.name));
 
@@ -828,7 +835,7 @@ import { cartesian as sharedCartesian, zip as sharedZip } from './iterate.js';
     }
 
     const arrayVars = [];
-    const scalarValues = {};
+    const scalarValues = Object.create(null);
 
     for (const row of rows) {
       const vals = splitValues(row.values, row.source);
@@ -849,10 +856,18 @@ import { cartesian as sharedCartesian, zip as sharedZip } from './iterate.js';
     }
 
     const results = [];
-    for (const combo of combos) {
-      const vals = { ...scalarValues };
-      arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
-      results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
+    try {
+      for (const combo of combos) {
+        const vals = Object.assign(Object.create(null), scalarValues);
+        arrayVars.forEach((v, i) => { vals[v.name] = combo[i]; });
+        results.push({ values: { ...vals }, expanded: sharedExpand(text, vals) });
+      }
+    } catch (err) {
+      previewBody.innerHTML = `<span class="preview-empty">${escHtml(err instanceof Error ? err.message : String(err))}</span>`;
+      previewCount.textContent = 'error';
+      previewCount.className = 'preview-count empty';
+      cliText.innerHTML = '<span class="dollar">$</span>promptargs';
+      return;
     }
 
     const count = results.length;

package/dist/ui.js

@@ -1,8 +1,10 @@
 import { createServer } from 'node:http';
+import { randomBytes, timingSafeEqual } from 'node:crypto';
 import { readFileSync } from 'node:fs';
 import { join, dirname } from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { autodetect, isSensitiveEnvName, isSensitiveEnvValue, AUTODETECT_VARS } from './autodetect.js';
+import { diag, classifyError, jsonLogEnabled, logRequest } from './log.js';
 const DEFAULT_PORT = 3700;
 const OPEN_DELAY_MS = 500;
 const DIFF_PREVIEW_MAX_CHARS = 60;
@@ -50,7 +52,9 @@ export function buildUIHtml(rawHtml, envVars) {
     // Escape "<" so env values cannot break out of the script tag (e.g. "</script>").
     const envJson = JSON.stringify(envVars).replace(/</g, '\\u003c');
     const envScript = `<script>window.__PROMPTARGS_ENV__ = ${envJson};</script>`;
-    return rawHtml.replace('<script>', envScript + '\n<script>');
+    // Function replacer: a replacement *string* would expand `$&`, "$`" and "$'"
+    // found in env values into surrounding raw HTML, undoing the escaping above.
+    return rawHtml.replace(/<script\b/, (match) => `${envScript}\n${match}`);
 }
 // Browser-facing modules the builder UI imports directly instead of
 // hand-reimplementing their logic (see buildUIHtml / ui.html). Serving the
@@ -60,6 +64,34 @@ const STATIC_JS_ROUTES = {
     '/iterate.js': 'iterate.js',
     '/mustache.mjs': 'mustache.mjs',
 };
+// Query parameter carrying the per-run access token (see startUI).
+export const UI_TOKEN_PARAM = 't';
+const UI_TOKEN_BYTES = 16;
+// The page embeds environment data and is reached through a tokened URL, so
+// the browser must not keep a copy on disk after the server exits, and must
+// not send that URL as the Referer when the page's outbound links are followed.
+export const PAGE_HEADERS = Object.freeze({
+    'Content-Type': 'text/html; charset=utf-8',
+    'Cache-Control': 'no-store',
+    'Referrer-Policy': 'no-referrer',
+    'X-Content-Type-Options': 'nosniff',
+});
+export function requestCarriesToken(url, token) {
+    if (!url)
+        return false;
+    let supplied;
+    try {
+        supplied = new URL(url, 'http://localhost').searchParams.get(UI_TOKEN_PARAM);
+    }
+    catch {
+        return false;
+    }
+    if (supplied === null)
+        return false;
+    const a = Buffer.from(supplied, 'utf8');
+    const b = Buffer.from(token, 'utf8');
+    return a.length === b.length && timingSafeEqual(a, b);
+}
 export function startUI(port = DEFAULT_PORT, options = {}) {
     const __dirname = dirname(fileURLToPath(import.meta.url));
     const htmlPath = join(__dirname, 'ui.html');
@@ -68,18 +100,30 @@ export function startUI(port = DEFAULT_PORT, options = {}) {
         rawHtml = readFileSync(htmlPath, 'utf-8');
     }
     catch {
-        console.error('UI file not found. Reinstall @hivecommons/promptargs.');
+        diag('ui_start_error', { error_class: 'not_found' }, 'UI file not found. Reinstall @hivecommons/promptargs.');
         process.exit(1);
     }
     const html = buildUIHtml(rawHtml, collectEnvVars());
-    const ALLOWED_HOSTS = new Set([
-        `localhost:${port}`,
-        `127.0.0.1:${port}`,
-        `[::1]:${port}`,
-    ]);
+    // Filled once the server is bound, because port 0 means the OS picks one.
+    const ALLOWED_HOSTS = new Set();
+    // Loopback is shared by every account on the machine, so the Host check
+    // alone still lets another local user read the embedded environment. The
+    // page is only served to a client presenting this per-run random token,
+    // which reaches the user's browser solely through the printed/opened URL.
+    const token = randomBytes(UI_TOKEN_BYTES).toString('hex');
+    let rejectedHosts = 0;
+    let rejectedTokens = 0;
     const server = createServer((req, res) => {
+        if (jsonLogEnabled()) {
+            const startedAt = process.hrtime.bigint();
+            res.on('finish', () => logRequest(res.statusCode, startedAt));
+        }
         // Reject non-local Host headers to block DNS-rebinding reads of env data.
         if (!req.headers.host || !ALLOWED_HOSTS.has(req.headers.host)) {
+            // Never log the Host header or URL: both are attacker-controlled.
+            if (rejectedHosts++ === 0) {
+                diag('ui_host_rejected', { status: 403 }, 'promptargs: rejected request with unexpected Host header (further rejections suppressed)');
+            }
             res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
             res.end('Forbidden');
             return;
@@ -91,19 +135,34 @@ export function startUI(port = DEFAULT_PORT, options = {}) {
                 res.writeHead(200, { 'Content-Type': 'text/javascript; charset=utf-8' });
                 res.end(js);
             }
-            catch {
+            catch (err) {
+                diag('ui_asset_error', { status: 404, error_class: classifyError(err) }, `promptargs: failed to load static asset ${req.url} (${err.code ?? 'unknown'})`);
                 res.writeHead(404, { 'Content-Type': 'text/plain; charset=utf-8' });
                 res.end('Not found');
             }
             return;
         }
-        res.writeHead(200, { 'Content-Type': 'text/html; charset=utf-8' });
+        // Only the page embeds environment data; the module routes above are
+        // public package code and stay reachable for the page's relative imports.
+        if (!requestCarriesToken(req.url, token)) {
+            if (rejectedTokens++ === 0) {
+                diag('ui_token_rejected', { status: 403 }, 'promptargs: rejected request without the access token printed at startup (further rejections suppressed)');
+            }
+            res.writeHead(403, { 'Content-Type': 'text/plain; charset=utf-8' });
+            res.end('Forbidden');
+            return;
+        }
+        res.writeHead(200, PAGE_HEADERS);
         res.end(html);
     });
     // Bind loopback only: the page embeds environment variables and must never
     // be reachable from other machines on the network.
     server.listen(port, '127.0.0.1', () => {
-        const url = `http://localhost:${port}`;
+        const boundPort = server.address().port;
+        ALLOWED_HOSTS.add(`localhost:${boundPort}`);
+        ALLOWED_HOSTS.add(`127.0.0.1:${boundPort}`);
+        ALLOWED_HOSTS.add(`[::1]:${boundPort}`);
+        const url = `http://localhost:${boundPort}/?${UI_TOKEN_PARAM}=${token}`;
         console.log(`promptargs builder running at ${url}`);
         console.log('Press Ctrl+C to stop.\n');
         if (options.openBrowser ?? true) {
@@ -111,14 +170,32 @@ export function startUI(port = DEFAULT_PORT, options = {}) {
                 import('node:child_process').then(({ exec }) => {
                     const cmd = process.platform === 'darwin' ? 'open' :
                         process.platform === 'win32' ? 'start' : 'xdg-open';
-                    exec(`${cmd} ${url}`);
+                    // The URL is program-generated (digits and hex only) but carries a
+                    // "?", so quote it for the shell; `start` reads its first quoted
+                    // argument as a window title, hence the empty one on Windows.
+                    const command = cmd === 'start' ? `start "" "${url}"` : `${cmd} "${url}"`;
+                    exec(command, err => {
+                        if (!err)
+                            return;
+                        // Through a shell, a missing opener surfaces as exit status 127 rather than ENOENT.
+                        const why = err.code === 127 ? 'not found' : String(err.code ?? err.message);
+                        diag('ui_browser_open_failed', { error_class: classifyError(err) }, `promptargs: could not open a browser (${cmd}: ${why}); open ${url} manually`);
+                    });
                 });
             }, OPEN_DELAY_MS);
         }
     });
+    server.on('close', () => {
+        if (rejectedHosts > 1) {
+            diag('ui_host_rejected_total', { count: rejectedHosts }, `promptargs: rejected ${rejectedHosts} requests with unexpected Host headers in total`);
+        }
+        if (rejectedTokens > 1) {
+            diag('ui_token_rejected_total', { count: rejectedTokens }, `promptargs: rejected ${rejectedTokens} requests without the access token in total`);
+        }
+    });
     server.on('error', (err) => {
         if (err.code === 'EADDRINUSE') {
-            console.error(`Port ${port} is in use. Try: promptargs ui --port=${port + 1}`);
+            diag('ui_start_error', { error_class: 'port_in_use' }, `Port ${port} is in use. Try: promptargs ui --port=${port + 1}`);
             process.exit(1);
         }
         throw err;

package/dist/ui.js.map

@@ -1 +1 @@
-{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEvG,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,uCAAuC,OAAO,YAAY,CAAC;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,SAAS,GAAG,YAAY,CAAC,CAAC;AAC/D,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,WAAW;IACzB,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY,EAAE,UAA0B,EAAE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;QACvE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;QAC5B,aAAa,IAAI,EAAE;QACnB,aAAa,IAAI,EAAE;QACnB,SAAS,IAAI,EAAE;KAChB,CAAC,CAAC;IAEH,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,0EAA0E;QAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;QACnE,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,MAAM,GAAG,GAAG,oBAAoB,IAAI,EAAE,CAAC;QACvC,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;oBAChE,IAAI,CAAC,GAAG,GAAG,IAAI,GAAG,EAAE,CAAC,CAAC;gBACxB,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,OAAO,CAAC,KAAK,CAAC,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YAC/E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"ui.js","sourceRoot":"","sources":["../src/ui.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAe,MAAM,WAAW,CAAC;AAEtD,OAAO,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAC3D,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AACvG,OAAO,EAAE,IAAI,EAAE,aAAa,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAE3E,MAAM,YAAY,GAAG,IAAI,CAAC;AAC1B,MAAM,aAAa,GAAG,GAAG,CAAC;AAC1B,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,MAAM,yBAAyB,GAAG,EAAE,CAAC;AAErC,MAAM,iBAAiB,GAAG;IACxB,MAAM,EAAE,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB;IAC3E,cAAc,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACvE,UAAU,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG;CACrE,CAAC;AAEF,MAAM,cAAc,GAAG,IAAI,GAAG,CAAC;IAC7B,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU;IACtE,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,eAAe,EAAE,cAAc;IAC1E,sBAAsB,EAAE,iBAAiB,EAAE,4BAA4B;IACvE,gBAAgB,EAAE,8BAA8B,EAAE,aAAa;CAChE,CAAC,CAAC;AAEH,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,cAAc,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,GAAW;IACpD,OAAO,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC;AAC5D,CAAC;AAOD,MAAM,UAAU,cAAc;IAC5B,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,IAAI,IAAI,eAAe,EAAE,CAAC;QACnC,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,KAAK,MAAM;gBACzB,CAAC,CAAC,aAAa,CAAC,KAAK,EAAE,sBAAsB,CAAC;gBAC9C,CAAC,CAAC,KAAK,CAAC;QACZ,CAAC;IACH,CAAC;IAED,MAAM,QAAQ,GAA2B,EAAE,CAAC;IAC5C,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QACrD,0EAA0E;QAC1E,eAAe;QACf,IAAI,CAAC,GAAG,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,kBAAkB,CAAC,GAAG,CAAC,IAAI,mBAAmB,CAAC,GAAG,CAAC;YAAE,SAAS;QAChG,QAAQ,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,GAAG,EAAE,yBAAyB,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC;AAC3B,CAAC;AAMD,MAAM,UAAU,WAAW,CAAC,OAAe,EAAE,OAAgB;IAC3D,kFAAkF;IAClF,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,SAAS,GAAG,uCAAuC,OAAO,YAAY,CAAC;IAC7E,6EAA6E;IAC7E,6EAA6E;IAC7E,OAAO,OAAO,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,SAAS,KAAK,KAAK,EAAE,CAAC,CAAC;AAC3E,CAAC;AAED,oEAAoE;AACpE,2EAA2E;AAC3E,0EAA0E;AAC1E,MAAM,gBAAgB,GAA2B;IAC/C,YAAY,EAAE,WAAW;IACzB,aAAa,EAAE,YAAY;IAC3B,eAAe,EAAE,cAAc;CAChC,CAAC;AAEF,mEAAmE;AACnE,MAAM,CAAC,MAAM,cAAc,GAAG,GAAG,CAAC;AAClC,MAAM,cAAc,GAAG,EAAE,CAAC;AAE1B,4EAA4E;AAC5E,4EAA4E;AAC5E,gFAAgF;AAChF,MAAM,CAAC,MAAM,YAAY,GAAqC,MAAM,CAAC,MAAM,CAAC;IAC1E,cAAc,EAAE,0BAA0B;IAC1C,eAAe,EAAE,UAAU;IAC3B,iBAAiB,EAAE,aAAa;IAChC,wBAAwB,EAAE,SAAS;CACpC,CAAC,CAAC;AAEH,MAAM,UAAU,mBAAmB,CAAC,GAAuB,EAAE,KAAa;IACxE,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,IAAI,QAAuB,CAAC;IAC5B,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,GAAG,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,cAAc,CAAC,CAAC;IAC/E,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,KAAK,CAAC;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACxC,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IACrC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,MAAM,IAAI,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAI,GAAG,YAAY,EAAE,UAA0B,EAAE;IACvE,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;IAC5C,IAAI,OAAe,CAAC;IAEpB,IAAI,CAAC;QACH,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,WAAW,EAAE,EAAE,uDAAuD,CAAC,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,EAAE,cAAc,EAAE,CAAC,CAAC;IAEpD,0EAA0E;IAC1E,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;IAExC,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,0EAA0E;IAC1E,MAAM,KAAK,GAAG,WAAW,CAAC,cAAc,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAE1D,IAAI,aAAa,GAAG,CAAC,CAAC;IACtB,IAAI,cAAc,GAAG,CAAC,CAAC;IAEvB,MAAM,MAAM,GAAG,YAAY,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACvC,IAAI,cAAc,EAAE,EAAE,CAAC;YACrB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;YAC1C,GAAG,CAAC,EAAE,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;QAChE,CAAC;QAED,0EAA0E;QAC1E,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9D,kEAAkE;YAClE,IAAI,aAAa,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC1B,IAAI,CAAC,kBAAkB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,0FAA0F,CAAC,CAAC;YACxI,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7D,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;gBACxD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,gCAAgC,EAAE,CAAC,CAAC;gBACzE,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,CAAC,gBAAgB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EACrE,2CAA2C,GAAG,CAAC,GAAG,KAAM,GAA6B,CAAC,IAAI,IAAI,SAAS,GAAG,CAAC,CAAC;gBAC9G,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;gBACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;YACD,OAAO;QACT,CAAC;QAED,qEAAqE;QACrE,0EAA0E;QAC1E,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,CAAC;YACzC,IAAI,cAAc,EAAE,KAAK,CAAC,EAAE,CAAC;gBAC3B,IAAI,CAAC,mBAAmB,EAAE,EAAE,MAAM,EAAE,GAAG,EAAE,EAAE,0GAA0G,CAAC,CAAC;YACzJ,CAAC;YACD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,2BAA2B,EAAE,CAAC,CAAC;YACpE,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACrB,OAAO;QACT,CAAC;QAED,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;QACjC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,GAAG,EAAE;QACpC,MAAM,SAAS,GAAI,MAAM,CAAC,OAAO,EAAkB,CAAC,IAAI,CAAC;QACzD,aAAa,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,aAAa,SAAS,EAAE,CAAC,CAAC;QAC5C,aAAa,CAAC,GAAG,CAAC,SAAS,SAAS,EAAE,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,oBAAoB,SAAS,KAAK,cAAc,IAAI,KAAK,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,iCAAiC,GAAG,EAAE,CAAC,CAAC;QACpD,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,CAAC;QAEvC,IAAI,OAAO,CAAC,WAAW,IAAI,IAAI,EAAE,CAAC;YAChC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,oBAAoB,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE;oBAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACxC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC;oBAChE,mEAAmE;oBACnE,iEAAiE;oBACjE,8DAA8D;oBAC9D,MAAM,OAAO,GAAG,GAAG,KAAK,OAAO,CAAC,CAAC,CAAC,aAAa,GAAG,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,KAAK,GAAG,GAAG,CAAC;oBAC1E,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE;wBAClB,IAAI,CAAC,GAAG;4BAAE,OAAO;wBACjB,oFAAoF;wBACpF,MAAM,GAAG,GAAI,GAAG,CAAC,IAAgB,KAAK,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;wBAC1F,IAAI,CAAC,wBAAwB,EAAE,EAAE,WAAW,EAAE,aAAa,CAAC,GAAG,CAAC,EAAE,EAChE,yCAAyC,GAAG,KAAK,GAAG,WAAW,GAAG,WAAW,CAAC,CAAC;oBACnF,CAAC,CAAC,CAAC;gBACL,CAAC,CAAC,CAAC;YACL,CAAC,EAAE,aAAa,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;QACtB,IAAI,aAAa,GAAG,CAAC,EAAE,CAAC;YACtB,IAAI,CAAC,wBAAwB,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,EAAE,wBAAwB,aAAa,iDAAiD,CAAC,CAAC;QACnJ,CAAC;QACD,IAAI,cAAc,GAAG,CAAC,EAAE,CAAC;YACvB,IAAI,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,cAAc,EAAE,EAAE,wBAAwB,cAAc,6CAA6C,CAAC,CAAC;QAClJ,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAA0B,EAAE,EAAE;QAChD,IAAI,GAAG,CAAC,IAAI,KAAK,YAAY,EAAE,CAAC;YAC9B,IAAI,CAAC,gBAAgB,EAAE,EAAE,WAAW,EAAE,aAAa,EAAE,EAAE,QAAQ,IAAI,yCAAyC,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC;YACxH,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@hivecommons/promptargs",
-  "version": "0.7.0",
-  "description": "Template arguments for AI prompts — variable substitution for Claude Code, Copilot, and more",
+  "version": "0.9.0",
+  "description": "Template arguments for AI prompts — variable substitution for Claude Code, Copilot, Goose, Bob, and more",
   "type": "module",
   "main": "dist/index.js",
   "bin": {
@@ -21,7 +21,12 @@
     "claude",
     "copilot",
     "args",
-    "cli"
+    "cli",
+    "claude-code",
+    "goose",
+    "bob",
+    "agent-skills",
+    "prompt-templates"
   ],
   "author": "hivecommons",
   "license": "Apache-2.0",
@@ -34,10 +39,14 @@
   },
   "homepage": "https://github.com/hivecommons/promptargs#readme",
   "engines": {
-    "node": ">=18"
+    "node": ">=22"
   },
   "files": [
     "dist",
+    "!dist/**/*.test.js",
+    "!dist/**/*.test.js.map",
+    "!dist/**/*.test.d.ts",
+    "!dist/ui-harness.*",
     "README.md",
     "LICENSE"
   ],

package/dist/autodetect.test.d.ts

@@ -1 +0,0 @@
-export {};

package/dist/autodetect.test.js

@@ -1,207 +0,0 @@
-import { describe, it, before, after } from 'node:test';
-import assert from 'node:assert';
-import { execSync } from 'node:child_process';
-import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
-import { join, delimiter } from 'node:path';
-import { tmpdir } from 'node:os';
-import { autodetect, autodetectAll, isSensitiveEnvName, isSensitiveEnvValue, AUTODETECT_VARS } from './autodetect.js';
-// git-backed detectors read the process cwd, so run them inside a scratch
-// repo with a known origin remote (each test file is its own process).
-let repo;
-let prevCwd;
-before(() => {
-    prevCwd = process.cwd();
-    repo = mkdtempSync(join(process.cwd(), '.pa-auto-'));
-    process.chdir(repo);
-    const run = (cmd) => execSync(cmd, { stdio: 'pipe' });
-    run('git init -q -b pa-test-branch');
-    run('git config user.email pa@test.local');
-    run('git config user.name "PA Tester"');
-    run('git remote add origin https://github.com/pa-test-org/pa-test-repo.git');
-    run('git commit -q --allow-empty -m init');
-});
-after(() => {
-    process.chdir(prevCwd);
-    rmSync(repo, { recursive: true, force: true });
-});
-describe('git detectors', () => {
-    it('detects the current branch', () => {
-        assert.strictEqual(autodetect('branch'), 'pa-test-branch');
-    });
-    it('detects repo name from the origin remote, stripping .git', () => {
-        assert.strictEqual(autodetect('repo'), 'pa-test-repo');
-    });
-    it('detects the org from the origin remote', () => {
-        assert.strictEqual(autodetect('org'), 'pa-test-org');
-    });
-    it('detects repo/org from ssh-style remotes', () => {
-        execSync('git remote set-url origin git@github.com:ssh-org/ssh-repo.git', { stdio: 'pipe' });
-        try {
-            assert.strictEqual(autodetect('repo'), 'ssh-repo');
-            assert.strictEqual(autodetect('org'), 'ssh-org');
-        }
-        finally {
-            execSync('git remote set-url origin https://github.com/pa-test-org/pa-test-repo.git', { stdio: 'pipe' });
-        }
-    });
-    it('detects the git user name', () => {
-        assert.strictEqual(autodetect('user'), 'PA Tester');
-    });
-    it('returns undefined for branch on a detached HEAD', () => {
-        // `git branch --show-current` exits 0 and prints nothing when detached;
-        // that must not become an empty value that beats the template default.
-        execSync('git checkout -q --detach', { stdio: 'pipe' });
-        try {
-            assert.strictEqual(autodetect('branch'), undefined);
-            assert.ok(!('branch' in autodetectAll(['branch'])));
-        }
-        finally {
-            execSync('git checkout -q pa-test-branch', { stdio: 'pipe' });
-        }
-    });
-    it('returns undefined for diff on a clean tree and the diff once there is one', () => {
-        assert.strictEqual(autodetect('diff'), undefined);
-        writeFileSync(join(repo, 'tracked.txt'), 'one\n');
-        execSync('git add tracked.txt && git commit -q -m add', { stdio: 'pipe' });
-        writeFileSync(join(repo, 'tracked.txt'), 'two\n');
-        try {
-            assert.match(autodetect('diff') ?? '', /^diff --git a\/tracked\.txt/);
-        }
-        finally {
-            execSync('git checkout -q -- tracked.txt', { stdio: 'pipe' });
-        }
-    });
-});
-describe('date detector', () => {
-    it('returns an ISO date (YYYY-MM-DD)', () => {
-        assert.match(autodetect('date'), /^\d{4}-\d{2}-\d{2}$/);
-    });
-});
-describe('environment fallback', () => {
-    it('falls back to environment variables for unknown names', () => {
-        process.env.pa_custom_var = 'env-value';
-        try {
-            assert.strictEqual(autodetect('pa_custom_var'), 'env-value');
-        }
-        finally {
-            delete process.env.pa_custom_var;
-        }
-    });
-    it('returns undefined for unknown names not in the environment', () => {
-        assert.strictEqual(autodetect('pa_definitely_not_set'), undefined);
-    });
-    it('never expands credential-looking env vars', () => {
-        process.env.PA_TEST_TOKEN = 'sekrit';
-        process.env.PA_TEST_API_KEY = 'sekrit';
-        try {
-            assert.strictEqual(autodetect('PA_TEST_TOKEN'), undefined);
-            assert.strictEqual(autodetect('PA_TEST_API_KEY'), undefined);
-        }
-        finally {
-            delete process.env.PA_TEST_TOKEN;
-            delete process.env.PA_TEST_API_KEY;
-        }
-    });
-    it('never expands credential-shaped values under innocuous names', () => {
-        process.env.PA_TEST_DATABASE_URL = 'postgres://app:hunter2@db.internal/app';
-        process.env.PA_TEST_PLAIN_URL = 'postgres://db.internal/app';
-        try {
-            assert.strictEqual(autodetect('PA_TEST_DATABASE_URL'), undefined);
-            assert.strictEqual(autodetect('PA_TEST_PLAIN_URL'), 'postgres://db.internal/app');
-        }
-        finally {
-            delete process.env.PA_TEST_DATABASE_URL;
-            delete process.env.PA_TEST_PLAIN_URL;
-        }
-    });
-});
-describe('isSensitiveEnvName', () => {
-    it('flags credential-looking names', () => {
-        for (const name of [
-            'GITHUB_TOKEN', 'GH_TOKEN', 'NPM_TOKEN', 'MY_SECRET', 'DB_PASSWORD',
-            'PGPASSWD', 'AWS_SECRET_ACCESS_KEY', 'OPENAI_API_KEY', 'APIKEY',
-            'GOOGLE_APPLICATION_CREDENTIALS', 'SSH_PRIVATE_KEY', 'AUTH_HEADER',
-            'X_AUTH', 'SESSION_COOKIE', 'BEARER_VALUE', 'gh_token',
-            // Suffix conventions outside API_/ACCESS_/PRIVATE_KEY
-            'OPENAI_KEY', 'STRIPE_KEY', 'SIGNING_KEY', 'ENCRYPTION_KEY', 'HIVE_HEARTBEAT_KEY',
-            'LICENSE_KEY', 'SSH_KEYS', 'KEY', 'MYSQL_PWD', 'ORACLE_PWD', 'GITHUB_PAT', 'AZURE_DEVOPS_PAT',
-            'PAT', 'GIT_PASS', 'SSH_PASSPHRASE', 'SLACK_WEBHOOK_URL', 'DISCORD_WEBHOOK', 'SENTRY_DSN',
-            'DB_CONNECTION_STRING', 'AZURE_CONN_STR', 'JWT_SIGNING', 'HMAC_VALUE', 'OAUTH_CLIENT_ID',
-        ]) {
-            assert.strictEqual(isSensitiveEnvName(name), true, `should flag ${name}`);
-        }
-    });
-    it('does not flag ordinary names', () => {
-        for (const name of [
-            'EDITOR', 'PATH', 'GOPATH', 'AUTHOR', 'AUTHORIZED_USERS_FILE', 'branch', 'KEYBOARD',
-            'PWD', 'OLDPWD', 'PATTERN', 'PATCH_LEVEL', 'PASSENGER_COUNT', 'MONKEY', 'DSNAME', 'COMPASS',
-        ]) {
-            assert.strictEqual(isSensitiveEnvName(name), false, `should not flag ${name}`);
-        }
-    });
-});
-describe('isSensitiveEnvValue', () => {
-    it('flags credential-shaped values regardless of name', () => {
-        for (const value of [
-            'postgres://app:hunter2@db.internal:5432/app',
-            'redis://:p4ss@cache.internal/0',
-            'mongodb+srv://user:pw@cluster0.example.net/db',
-            '-----BEGIN OPENSSH PRIVATE KEY-----\nabc',
-            'eyJhbGciOiJIUzI1NiJ9.eyJzdWIiOiIxIn0.sig',
-            'ghp_' + 'A'.repeat(36),
-            'github_pat_' + 'A'.repeat(22) + '_' + 'b'.repeat(59),
-            'glpat-' + 'x'.repeat(20),
-            'sk-' + 'x'.repeat(48),
-            'sk_live_' + 'x'.repeat(24),
-            'xoxb-' + '1'.repeat(12) + '-abc',
-            'AKIA' + 'A'.repeat(16),
-            'AIza' + 'a'.repeat(35),
-            'npm_' + 'a'.repeat(36),
-            'hvs.' + 'a'.repeat(24),
-        ]) {
-            assert.strictEqual(isSensitiveEnvValue(value), true, `should flag ${value.slice(0, 12)}...`);
-        }
-    });
-    it('does not flag ordinary values', () => {
-        for (const value of [
-            'main', '/usr/local/bin:/usr/bin', 'https://github.com/hivecommons/promptargs',
-            'postgres://db.internal/app', 'https://user@example.com/path', 'user@example.com',
-            'skills', 'sk-short', 'eyJ-not-a-jwt', 'AKIA-nope', 'Hello, world', '42',
-        ]) {
-            assert.strictEqual(isSensitiveEnvValue(value), false, `should not flag ${value}`);
-        }
-    });
-});
-describe('autodetectAll', () => {
-    it('collects only detectable values', () => {
-        const result = autodetectAll(['branch', 'pa_definitely_not_set', 'date']);
-        assert.strictEqual(result.branch, 'pa-test-branch');
-        assert.ok('date' in result);
-        assert.ok(!('pa_definitely_not_set' in result));
-    });
-    it('AUTODETECT_VARS lists the built-in detectors', () => {
-        for (const name of ['branch', 'repo', 'org', 'diff', 'pr', 'user', 'date']) {
-            assert.ok(AUTODETECT_VARS.includes(name), `missing ${name}`);
-        }
-    });
-});
-describe('pr detector', () => {
-    it('returns undefined when gh exits 0 with empty output', t => {
-        // A branch with no PR: gh succeeds but prints nothing, so the detector
-        // must map '' to undefined rather than returning an empty value.
-        if (process.platform === 'win32')
-            return t.skip('POSIX shim script');
-        const shim = mkdtempSync(join(tmpdir(), 'pa-gh-shim-'));
-        writeFileSync(join(shim, 'gh'), '#!/bin/sh\nexit 0\n', { mode: 0o755 });
-        const prevPath = process.env.PATH;
-        process.env.PATH = `${shim}${delimiter}${prevPath ?? ''}`;
-        try {
-            assert.strictEqual(autodetect('pr'), undefined);
-        }
-        finally {
-            process.env.PATH = prevPath;
-            rmSync(shim, { recursive: true, force: true });
-        }
-    });
-});
-//# sourceMappingURL=autodetect.test.js.map

package/dist/autodetect.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"autodetect.test.js","sourceRoot":"","sources":["../src/autodetect.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AACxD,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAC5C,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAEtH,0EAA0E;AAC1E,uEAAuE;AACvE,IAAI,IAAY,CAAC;AACjB,IAAI,OAAe,CAAC;AAEpB,MAAM,CAAC,GAAG,EAAE;IACV,OAAO,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IACxB,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC;IACrD,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,MAAM,GAAG,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC9D,GAAG,CAAC,+BAA+B,CAAC,CAAC;IACrC,GAAG,CAAC,qCAAqC,CAAC,CAAC;IAC3C,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACxC,GAAG,CAAC,uEAAuE,CAAC,CAAC;IAC7E,GAAG,CAAC,qCAAqC,CAAC,CAAC;AAC7C,CAAC,CAAC,CAAC;AAEH,KAAK,CAAC,GAAG,EAAE;IACT,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACvB,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,4BAA4B,EAAE,GAAG,EAAE;QACpC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,0DAA0D,EAAE,GAAG,EAAE;QAClE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,cAAc,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,CAAC;IACvD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACjD,QAAQ,CAAC,+DAA+D,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC7F,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,UAAU,CAAC,CAAC;YACnD,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,SAAS,CAAC,CAAC;QACnD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,2EAA2E,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3G,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2BAA2B,EAAE,GAAG,EAAE;QACnC,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,wEAAwE;QACxE,uEAAuE;QACvE,QAAQ,CAAC,0BAA0B,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QACxD,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,SAAS,CAAC,CAAC;YACpD,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;QACtD,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2EAA2E,EAAE,GAAG,EAAE;QACnF,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,SAAS,CAAC,CAAC;QAClD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,QAAQ,CAAC,6CAA6C,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAC3E,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC;YACH,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,6BAA6B,CAAC,CAAC;QACxE,CAAC;gBAAS,CAAC;YACT,QAAQ,CAAC,gCAAgC,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;QAChE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,kCAAkC,EAAE,GAAG,EAAE;QAC1C,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAE,EAAE,qBAAqB,CAAC,CAAC;IAC3D,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IACpC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC/D,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,WAAW,CAAC;QACxC,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,WAAW,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QACnC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4DAA4D,EAAE,GAAG,EAAE;QACpE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,uBAAuB,CAAC,EAAE,SAAS,CAAC,CAAC;IACrE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACnD,OAAO,CAAC,GAAG,CAAC,aAAa,GAAG,QAAQ,CAAC;QACrC,OAAO,CAAC,GAAG,CAAC,eAAe,GAAG,QAAQ,CAAC;QACvC,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,SAAS,CAAC,CAAC;YAC3D,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,iBAAiB,CAAC,EAAE,SAAS,CAAC,CAAC;QAC/D,CAAC;gBAAS,CAAC;YACT,OAAO,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;YACjC,OAAO,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8DAA8D,EAAE,GAAG,EAAE;QACtE,OAAO,CAAC,GAAG,CAAC,oBAAoB,GAAG,wCAAwC,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,4BAA4B,CAAC;QAC7D,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,sBAAsB,CAAC,EAAE,SAAS,CAAC,CAAC;YAClE,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,4BAA4B,CAAC,CAAC;QACpF,CAAC;gBAAS,CAAC;YACT,OAAO,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;YACxC,OAAO,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC;QACvC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,oBAAoB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,gCAAgC,EAAE,GAAG,EAAE;QACxC,KAAK,MAAM,IAAI,IAAI;YACjB,cAAc,EAAE,UAAU,EAAE,WAAW,EAAE,WAAW,EAAE,aAAa;YACnE,UAAU,EAAE,uBAAuB,EAAE,gBAAgB,EAAE,QAAQ;YAC/D,gCAAgC,EAAE,iBAAiB,EAAE,aAAa;YAClE,QAAQ,EAAE,gBAAgB,EAAE,cAAc,EAAE,UAAU;YACtD,sDAAsD;YACtD,YAAY,EAAE,YAAY,EAAE,aAAa,EAAE,gBAAgB,EAAE,oBAAoB;YACjF,aAAa,EAAE,UAAU,EAAE,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,kBAAkB;YAC7F,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,iBAAiB,EAAE,YAAY;YACzF,sBAAsB,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,iBAAiB;SACzF,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,IAAI,EAAE,CAAC,CAAC;QAC5E,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8BAA8B,EAAE,GAAG,EAAE;QACtC,KAAK,MAAM,IAAI,IAAI;YACjB,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,uBAAuB,EAAE,QAAQ,EAAE,UAAU;YACnF,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,iBAAiB,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS;SAC5F,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,qBAAqB,EAAE,GAAG,EAAE;IACnC,EAAE,CAAC,mDAAmD,EAAE,GAAG,EAAE;QAC3D,KAAK,MAAM,KAAK,IAAI;YAClB,6CAA6C;YAC7C,gCAAgC;YAChC,+CAA+C;YAC/C,0CAA0C;YAC1C,0CAA0C;YAC1C,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,aAAa,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACrD,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACzB,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACtB,UAAU,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,OAAO,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,MAAM;YACjC,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YACvB,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;SACxB,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,IAAI,EAAE,eAAe,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC;QAC/F,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+BAA+B,EAAE,GAAG,EAAE;QACvC,KAAK,MAAM,KAAK,IAAI;YAClB,MAAM,EAAE,yBAAyB,EAAE,2CAA2C;YAC9E,4BAA4B,EAAE,+BAA+B,EAAE,kBAAkB;YACjF,QAAQ,EAAE,UAAU,EAAE,eAAe,EAAE,WAAW,EAAE,cAAc,EAAE,IAAI;SACzE,EAAE,CAAC;YACF,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,mBAAmB,KAAK,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,eAAe,EAAE,GAAG,EAAE;IAC7B,EAAE,CAAC,iCAAiC,EAAE,GAAG,EAAE;QACzC,MAAM,MAAM,GAAG,aAAa,CAAC,CAAC,QAAQ,EAAE,uBAAuB,EAAE,MAAM,CAAC,CAAC,CAAC;QAC1E,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,MAAM,IAAI,MAAM,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,uBAAuB,IAAI,MAAM,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;YAC3E,MAAM,CAAC,EAAE,CAAC,eAAe,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC;AAEH,QAAQ,CAAC,aAAa,EAAE,GAAG,EAAE;IAC3B,EAAE,CAAC,qDAAqD,EAAE,CAAC,CAAC,EAAE;QAC5D,uEAAuE;QACvE,iEAAiE;QACjE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;YAAE,OAAO,CAAC,CAAC,IAAI,CAAC,mBAAmB,CAAC,CAAC;QACrE,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,aAAa,CAAC,CAAC,CAAC;QACxD,aAAa,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,qBAAqB,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAClC,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,GAAG,SAAS,GAAG,QAAQ,IAAI,EAAE,EAAE,CAAC;QAC1D,IAAI,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,SAAS,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,OAAO,CAAC,GAAG,CAAC,IAAI,GAAG,QAAQ,CAAC;YAC5B,MAAM,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACjD,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/cli.test.d.ts

@@ -1 +0,0 @@
-export {};