@id-wispera/cli 0.1.0

package/dist/commands/import.js

@@ -0,0 +1,1166 @@
+/**
+ * Import command: idw import <file>
+ * Supports .env, .json, and OpenClaw format imports
+ */
+import { Command } from 'commander';
+import ora from 'ora';
+import { readFile, readdir, access, stat } from 'fs/promises';
+import { basename, extname, join, resolve, relative } from 'path';
+import { homedir } from 'os';
+import chalk from 'chalk';
+import { unlockVault, createPassport, detectCredentials, classifyCredential, vaultExists, getDefaultVaultPath, } from '@id-wispera/core';
+import { promptPassphrase, confirmImport } from '../utils/prompts.js';
+import { error, success, info, warning, maskCredential, title } from '../utils/display.js';
+import { walkDirectory, scanFile } from './scan.js';
+/**
+ * Parse .env file
+ */
+function parseEnvFile(content) {
+    const credentials = [];
+    const lines = content.split('\n');
+    for (let i = 0; i < lines.length; i++) {
+        const line = lines[i]?.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const match = line.match(/^([A-Z_][A-Z0-9_]*)=(.+)$/);
+        if (match) {
+            const [, name, value] = match;
+            if (name && value) {
+                // Remove quotes if present
+                const cleanValue = value.replace(/^["']|["']$/g, '');
+                // Check if it looks like a credential
+                const type = classifyCredential(cleanValue);
+                const looksLikeSecret = type !== 'custom' ||
+                    name.toLowerCase().includes('key') ||
+                    name.toLowerCase().includes('secret') ||
+                    name.toLowerCase().includes('token') ||
+                    name.toLowerCase().includes('password') ||
+                    name.toLowerCase().includes('api');
+                if (looksLikeSecret && cleanValue.length > 5) {
+                    credentials.push({
+                        name,
+                        type: type === 'custom' ? 'secret' : type,
+                        value: cleanValue,
+                        line: i + 1,
+                    });
+                }
+            }
+        }
+    }
+    return credentials;
+}
+/**
+ * Parse JSON config file
+ */
+function parseJsonFile(content, filename) {
+    const credentials = [];
+    try {
+        const json = JSON.parse(content);
+        function findCredentials(obj, path = '') {
+            for (const [key, value] of Object.entries(obj)) {
+                const currentPath = path ? `${path}.${key}` : key;
+                if (typeof value === 'string' && value.length > 5) {
+                    const type = classifyCredential(value);
+                    const looksLikeSecret = type !== 'custom' ||
+                        key.toLowerCase().includes('key') ||
+                        key.toLowerCase().includes('secret') ||
+                        key.toLowerCase().includes('token') ||
+                        key.toLowerCase().includes('password') ||
+                        key.toLowerCase().includes('api');
+                    if (looksLikeSecret) {
+                        credentials.push({
+                            name: currentPath,
+                            type: type === 'custom' ? 'secret' : type,
+                            value,
+                        });
+                    }
+                }
+                else if (typeof value === 'object' && value !== null) {
+                    findCredentials(value, currentPath);
+                }
+            }
+        }
+        findCredentials(json);
+    }
+    catch {
+        // Not valid JSON, try regex detection
+        const detected = detectCredentials(content);
+        for (const result of detected) {
+            credentials.push({
+                name: `${filename}:${result.line}`,
+                type: result.type,
+                value: result.value,
+                line: result.line,
+            });
+        }
+    }
+    return credentials;
+}
+/**
+ * Guess platform from credential name/value
+ */
+function guessPlatform(name, value) {
+    const nameLower = name.toLowerCase();
+    if (nameLower.includes('anthropic') || value.startsWith('sk-ant-'))
+        return 'anthropic';
+    if (nameLower.includes('openai') || value.startsWith('sk-'))
+        return 'openai';
+    if (nameLower.includes('github') || value.startsWith('ghp_') || value.startsWith('gho_'))
+        return 'github';
+    if (nameLower.includes('aws') || value.startsWith('AKIA'))
+        return 'aws';
+    if (nameLower.includes('azure'))
+        return 'azure-ai';
+    if (nameLower.includes('google') || value.startsWith('AIza'))
+        return 'google-a2a';
+    if (nameLower.includes('stripe') || value.startsWith('sk_live_') || value.startsWith('sk_test_'))
+        return 'custom';
+    return 'custom';
+}
+/**
+ * Capitalize first letter
+ */
+function capitalizeFirst(str) {
+    return str.charAt(0).toUpperCase() + str.slice(1);
+}
+/**
+ * Scan and collect all OpenClaw credentials
+ */
+async function scanOpenClawCredentials() {
+    const credentials = [];
+    const openclawPath = join(homedir(), '.openclaw');
+    try {
+        await access(openclawPath);
+    }
+    catch {
+        return credentials;
+    }
+    // Scan WhatsApp credentials
+    const whatsappPath = join(openclawPath, 'credentials', 'whatsapp');
+    try {
+        const accounts = await readdir(whatsappPath);
+        for (const accountId of accounts) {
+            const credsPath = join(whatsappPath, accountId, 'creds.json');
+            try {
+                const content = await readFile(credsPath, 'utf-8');
+                const data = JSON.parse(content);
+                credentials.push({
+                    name: `OpenClaw — WhatsApp Session (${accountId})`,
+                    type: 'session-keys',
+                    visaType: 'access',
+                    value: content,
+                    platforms: ['openclaw'],
+                    tags: ['openclaw', 'whatsapp', 'session', 'imported'],
+                    filePath: credsPath,
+                    metadata: { accountId, botName: data.me?.name },
+                });
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }
+    }
+    catch {
+        // WhatsApp dir doesn't exist
+    }
+    // Scan auth profiles (LLM API keys)
+    const agentsPath = join(openclawPath, 'agents');
+    try {
+        const agents = await readdir(agentsPath);
+        for (const agentId of agents) {
+            const authPath = join(agentsPath, agentId, 'agent', 'auth-profiles.json');
+            try {
+                const content = await readFile(authPath, 'utf-8');
+                const data = JSON.parse(content);
+                for (const [provider, profile] of Object.entries(data)) {
+                    if (profile.type === 'api-key' && profile.key) {
+                        credentials.push({
+                            name: `OpenClaw — ${capitalizeFirst(provider)} API Key`,
+                            type: 'api-key',
+                            visaType: 'privilege',
+                            value: profile.key,
+                            platforms: ['openclaw', 'mcp', provider].filter(Boolean),
+                            tags: ['openclaw', provider, 'api-key', 'llm', 'imported'],
+                            filePath: authPath,
+                            metadata: { agentId, provider, model: profile.model },
+                        });
+                    }
+                }
+            }
+            catch {
+                // Skip unreadable files
+            }
+        }
+    }
+    catch {
+        // Agents dir doesn't exist
+    }
+    // Scan OAuth tokens
+    const oauthPath = join(openclawPath, 'credentials', 'oauth.json');
+    try {
+        const content = await readFile(oauthPath, 'utf-8');
+        const data = JSON.parse(content);
+        for (const [provider, tokens] of Object.entries(data)) {
+            if (tokens.access_token) {
+                const expiresAt = tokens.expires_at ? new Date(tokens.expires_at * 1000) : undefined;
+                credentials.push({
+                    name: `OpenClaw — ${capitalizeFirst(provider)} OAuth Token`,
+                    type: 'oauth-token',
+                    visaType: 'access',
+                    value: tokens.access_token,
+                    platforms: ['openclaw'],
+                    tags: ['openclaw', provider, 'oauth', 'imported'],
+                    filePath: oauthPath,
+                    metadata: { provider, hasRefreshToken: !!tokens.refresh_token },
+                    expiresAt,
+                });
+            }
+        }
+    }
+    catch {
+        // OAuth file doesn't exist
+    }
+    // Scan openclaw.json for channel tokens
+    const configPath = join(openclawPath, 'openclaw.json');
+    try {
+        const content = await readFile(configPath, 'utf-8');
+        const data = JSON.parse(content);
+        // Telegram
+        if (data.channels?.telegram?.token) {
+            credentials.push({
+                name: 'OpenClaw — Telegram Bot Token',
+                type: 'bot-token',
+                visaType: 'access',
+                value: data.channels.telegram.token,
+                platforms: ['openclaw'],
+                tags: ['openclaw', 'telegram', 'bot-token', 'imported'],
+                filePath: configPath,
+                metadata: { channel: 'telegram' },
+            });
+        }
+        // Slack Bot Token
+        if (data.channels?.slack?.botToken) {
+            credentials.push({
+                name: 'OpenClaw — Slack Bot Token',
+                type: 'bot-token',
+                visaType: 'access',
+                value: data.channels.slack.botToken,
+                platforms: ['openclaw'],
+                tags: ['openclaw', 'slack', 'bot-token', 'imported'],
+                filePath: configPath,
+                metadata: { channel: 'slack' },
+            });
+        }
+        // Slack App Token
+        if (data.channels?.slack?.appToken) {
+            credentials.push({
+                name: 'OpenClaw — Slack App Token',
+                type: 'bot-token',
+                visaType: 'access',
+                value: data.channels.slack.appToken,
+                platforms: ['openclaw'],
+                tags: ['openclaw', 'slack', 'app-token', 'imported'],
+                filePath: configPath,
+                metadata: { channel: 'slack' },
+            });
+        }
+        // Discord
+        if (data.channels?.discord?.token) {
+            credentials.push({
+                name: 'OpenClaw — Discord Bot Token',
+                type: 'bot-token',
+                visaType: 'access',
+                value: data.channels.discord.token,
+                platforms: ['openclaw'],
+                tags: ['openclaw', 'discord', 'bot-token', 'imported'],
+                filePath: configPath,
+                metadata: { channel: 'discord' },
+            });
+        }
+        // Gateway token
+        if (data.gateway?.token) {
+            credentials.push({
+                name: 'OpenClaw — Gateway Token',
+                type: 'api-key',
+                visaType: 'privilege',
+                value: data.gateway.token,
+                platforms: ['openclaw'],
+                tags: ['openclaw', 'gateway', 'admin', 'imported'],
+                filePath: configPath,
+                metadata: { gatewayPort: data.gateway.port },
+            });
+        }
+    }
+    catch {
+        // Config file doesn't exist
+    }
+    // Scan allowlists
+    const credsPath = join(openclawPath, 'credentials');
+    try {
+        const files = await readdir(credsPath);
+        for (const file of files) {
+            if (file.endsWith('-allowFrom.json')) {
+                const filePath = join(credsPath, file);
+                try {
+                    const content = await readFile(filePath, 'utf-8');
+                    const data = JSON.parse(content);
+                    const channel = file.replace('-allowFrom.json', '');
+                    const pairedCount = Object.keys(data).length;
+                    credentials.push({
+                        name: `OpenClaw — ${capitalizeFirst(channel)} Pairing Allowlist`,
+                        type: 'custom',
+                        visaType: 'access',
+                        value: content,
+                        platforms: ['openclaw'],
+                        tags: ['openclaw', channel, 'allowlist', 'imported'],
+                        filePath,
+                        metadata: { channel, pairedCount },
+                    });
+                }
+                catch {
+                    // Skip unreadable files
+                }
+            }
+        }
+    }
+    catch {
+        // Credentials dir doesn't exist
+    }
+    return credentials;
+}
+/**
+ * Display OpenClaw credentials for selection
+ */
+function displayOpenClawCredentials(credentials) {
+    console.log();
+    title('OpenClaw Credentials Found');
+    console.log();
+    for (let i = 0; i < credentials.length; i++) {
+        const cred = credentials[i];
+        if (!cred)
+            continue;
+        const visaLabel = cred.visaType === 'privilege' ? chalk.red('Privilege') : chalk.green('Access');
+        const valuePreview = maskCredential(cred.value, 6);
+        console.log(`  ${chalk.cyan(`[${i + 1}]`)} ${cred.name}`);
+        console.log(`      Type: ${cred.type}  |  Visa: ${visaLabel}`);
+        console.log(`      Preview: ${chalk.dim(valuePreview)}`);
+        console.log(`      Source: ${chalk.dim(cred.filePath)}`);
+        console.log();
+    }
+}
+/**
+ * Discover .env files in a directory (non-recursive, top-level only)
+ */
+async function discoverEnvFiles(dir) {
+    const found = [];
+    try {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isFile() && (entry.name === '.env' || entry.name.startsWith('.env.'))) {
+                found.push(join(dir, entry.name));
+            }
+        }
+    }
+    catch {
+        // Directory not readable
+    }
+    return found.sort();
+}
+/**
+ * Discover JSON config files in a directory (non-recursive, top-level only)
+ * Excludes well-known non-credential files
+ */
+const JSON_SKIP = new Set([
+    'package.json',
+    'package-lock.json',
+    'tsconfig.json',
+    'tsconfig.base.json',
+    'tsconfig.build.json',
+    'turbo.json',
+    'lerna.json',
+    'nx.json',
+    'jest.config.json',
+    'biome.json',
+    '.eslintrc.json',
+    '.prettierrc.json',
+    'renovate.json',
+    'manifest.json',
+    'composer.json',
+]);
+async function discoverJsonFiles(dir) {
+    const found = [];
+    try {
+        const entries = await readdir(dir, { withFileTypes: true });
+        for (const entry of entries) {
+            if (entry.isFile() && entry.name.endsWith('.json') && !JSON_SKIP.has(entry.name)) {
+                found.push(join(dir, entry.name));
+            }
+        }
+    }
+    catch {
+        // Directory not readable
+    }
+    return found.sort();
+}
+export function createImportCommand() {
+    const command = new Command('import')
+        .description('Import credentials from files, directory scans, or OpenClaw')
+        .argument('[path]', 'File or directory to import from')
+        .option('--format <format>', 'Import format: env, json, openclaw')
+        .option('--all', 'Import all detected credentials from a directory scan')
+        .option('--min-confidence <level>', 'Minimum confidence threshold for scan import (0-1)')
+        .option('--owner <owner>', 'Human owner email')
+        .option('--auto-name', 'Auto-generate passport names')
+        .option('-y, --yes', 'Import all without confirmation')
+        .option('-p, --path <path>', 'Custom vault path')
+        .addHelpText('after', `
+Examples:
+  $ idw import .env                      # Import from a specific .env file
+  $ idw import config.json               # Import from a JSON config file
+  $ idw import --format env              # Auto-discover .env files in current directory
+  $ idw import --format json             # Auto-discover JSON config files in current directory
+  $ idw import --format openclaw         # Auto-scan ~/.openclaw credentials
+  $ idw import ./project --all           # Scan directory and import all detected credentials
+  $ idw import --all                     # Scan current directory for all credentials
+  $ idw import --min-confidence 0.9      # Only import high-confidence detections
+  $ idw import --format env -y           # Auto-discover .env files and import all without prompting
+`)
+        .action(async (file, options) => {
+        const vaultPath = options.path ?? getDefaultVaultPath();
+        // Check vault exists
+        if (!(await vaultExists(vaultPath))) {
+            error('Vault not found. Run `idw init` first.');
+            process.exit(1);
+        }
+        // Handle OpenClaw format
+        if (options.format === 'openclaw') {
+            console.log();
+            title('OpenClaw Credential Import');
+            console.log();
+            const spinner = ora('Scanning OpenClaw credentials...').start();
+            const openclawCreds = await scanOpenClawCredentials();
+            spinner.stop();
+            if (openclawCreds.length === 0) {
+                info('No OpenClaw credentials found at ~/.openclaw/');
+                return;
+            }
+            console.log(chalk.green(`Found ${openclawCreds.length} credential(s) in OpenClaw installation`));
+            // Display credentials
+            displayOpenClawCredentials(openclawCreds);
+            // Confirm import
+            let selectedIndexes;
+            if (options.yes) {
+                selectedIndexes = openclawCreds.map((_, i) => i);
+                console.log(chalk.yellow(`Importing all ${openclawCreds.length} credentials (--yes flag)`));
+            }
+            else {
+                const inquirer = await import('inquirer');
+                const { selected } = await inquirer.default.prompt([
+                    {
+                        type: 'checkbox',
+                        name: 'selected',
+                        message: 'Select credentials to import:',
+                        choices: openclawCreds.map((c, i) => ({
+                            name: `${c.name} (${c.type})`,
+                            value: i,
+                            checked: true,
+                        })),
+                    },
+                ]);
+                selectedIndexes = selected;
+            }
+            if (selectedIndexes.length === 0) {
+                console.log('No credentials selected for import.');
+                return;
+            }
+            // Get owner if not provided
+            let owner = options.owner;
+            if (!owner) {
+                const inquirer = await import('inquirer');
+                const { ownerEmail } = await inquirer.default.prompt([
+                    {
+                        type: 'input',
+                        name: 'ownerEmail',
+                        message: 'Human owner email (who is responsible for these credentials):',
+                        validate: (input) => input.includes('@') || 'Valid email required',
+                    },
+                ]);
+                owner = ownerEmail;
+            }
+            // Unlock vault
+            const passphrase = await promptPassphrase();
+            const unlockSpinner = ora('Unlocking vault...').start();
+            let vault;
+            try {
+                vault = await unlockVault(passphrase, vaultPath);
+                unlockSpinner.succeed('Vault unlocked');
+            }
+            catch (err) {
+                unlockSpinner.fail('Failed to unlock vault');
+                error(err instanceof Error ? err.message : 'Invalid passphrase');
+                process.exit(1);
+            }
+            // Import selected credentials
+            const importSpinner = ora('Importing credentials...').start();
+            let imported = 0;
+            let failed = 0;
+            for (const idx of selectedIndexes) {
+                const cred = openclawCreds[idx];
+                if (!cred)
+                    continue;
+                try {
+                    // Build delegation chain
+                    const delegationChain = [
+                        {
+                            from: owner,
+                            to: 'OpenClaw Instance',
+                            grantedAt: new Date().toISOString(),
+                            scope: ['*'],
+                        },
+                    ];
+                    if (cred.metadata?.agentId) {
+                        delegationChain.push({
+                            from: 'OpenClaw Instance',
+                            to: `Agent: ${cred.metadata.agentId}`,
+                            grantedAt: new Date().toISOString(),
+                            scope: ['*'],
+                        });
+                    }
+                    await createPassport(vault, {
+                        name: cred.name,
+                        credentialType: cred.type,
+                        credentialValue: cred.value,
+                        visaType: cred.visaType,
+                        issuingAuthority: 'OpenClaw (self-managed)',
+                        platforms: cred.platforms,
+                        scope: ['*'],
+                        validFrom: new Date().toISOString(),
+                        validUntil: cred.expiresAt?.toISOString(),
+                        delegationChain,
+                        humanOwner: owner,
+                        tags: cred.tags,
+                        notes: `Imported from OpenClaw: ${cred.filePath}`,
+                    });
+                    imported++;
+                }
+                catch (err) {
+                    failed++;
+                }
+            }
+            importSpinner.stop();
+            console.log();
+            if (imported > 0) {
+                success(`Imported ${imported} credential(s) as passports.`);
+            }
+            if (failed > 0) {
+                warning(`Failed to import ${failed} credential(s).`);
+            }
+            console.log();
+            info('Run `idw list --tag openclaw` to see your OpenClaw passports.');
+            warning('Source files still contain plaintext credentials. Consider securely deleting them.');
+            return;
+        }
+        // Auto-discovery for --format env (no path given)
+        if (options.format === 'env' && !file) {
+            const searchDir = resolve('.');
+            console.log();
+            title('Environment File Auto-Discovery');
+            console.log();
+            const spinner = ora('Searching for .env files...').start();
+            const envFiles = await discoverEnvFiles(searchDir);
+            spinner.stop();
+            if (envFiles.length === 0) {
+                info(`No .env files found in ${searchDir}`);
+                return;
+            }
+            console.log(chalk.green(`Found ${envFiles.length} .env file(s):`));
+            for (const f of envFiles) {
+                console.log(`  ${chalk.dim('•')} ${relative(searchDir, f) || basename(f)}`);
+            }
+            console.log();
+            // Parse all env files and combine credentials
+            const allDetected = [];
+            for (const envFile of envFiles) {
+                try {
+                    const content = await readFile(envFile, 'utf-8');
+                    const creds = parseEnvFile(content);
+                    for (const c of creds) {
+                        allDetected.push({ ...c, sourceFile: envFile });
+                    }
+                }
+                catch {
+                    warning(`Cannot read: ${relative(searchDir, envFile) || basename(envFile)}`);
+                }
+            }
+            if (allDetected.length === 0) {
+                info('No credentials detected in .env files.');
+                return;
+            }
+            info(`Found ${allDetected.length} potential credential(s)`);
+            console.log();
+            for (let i = 0; i < allDetected.length; i++) {
+                const d = allDetected[i];
+                if (!d)
+                    continue;
+                const relFile = relative(searchDir, d.sourceFile) || basename(d.sourceFile);
+                console.log(`  ${chalk.cyan(`[${i + 1}]`)} ${chalk.bold(d.name)}`);
+                console.log(`      File: ${chalk.dim(relFile)}${d.line ? `  |  Line: ${d.line}` : ''}`);
+                console.log(`      Type: ${d.type}  |  Value: ${chalk.dim(maskCredential(d.value, 4))}`);
+                console.log();
+            }
+            // Confirm import
+            let selectedIndexes;
+            if (options.yes) {
+                selectedIndexes = allDetected.map((_, i) => i);
+                console.log(chalk.yellow(`Importing all ${allDetected.length} credentials (--yes flag)`));
+            }
+            else {
+                const inquirer = await import('inquirer');
+                const { selected } = await inquirer.default.prompt([
+                    {
+                        type: 'checkbox',
+                        name: 'selected',
+                        message: 'Select credentials to import:',
+                        choices: allDetected.map((c, i) => ({
+                            name: `${c.name} (${c.type}) — ${relative(searchDir, c.sourceFile) || basename(c.sourceFile)}`,
+                            value: i,
+                            checked: true,
+                        })),
+                    },
+                ]);
+                selectedIndexes = selected;
+            }
+            if (selectedIndexes.length === 0) {
+                console.log('No credentials selected for import.');
+                return;
+            }
+            // Get owner if not provided
+            let envOwner = options.owner;
+            if (!envOwner) {
+                const inquirer = await import('inquirer');
+                const { ownerEmail } = await inquirer.default.prompt([
+                    {
+                        type: 'input',
+                        name: 'ownerEmail',
+                        message: 'Human owner email:',
+                        validate: (input) => input.includes('@') || 'Valid email required',
+                    },
+                ]);
+                envOwner = ownerEmail;
+            }
+            // Unlock vault
+            const envPassphrase = await promptPassphrase();
+            const unlockSpinner = ora('Unlocking vault...').start();
+            let envVault;
+            try {
+                envVault = await unlockVault(envPassphrase, vaultPath);
+                unlockSpinner.succeed('Vault unlocked');
+            }
+            catch (err) {
+                unlockSpinner.fail('Failed to unlock vault');
+                error(err instanceof Error ? err.message : 'Invalid passphrase');
+                process.exit(1);
+            }
+            // Import selected credentials
+            const importSpinner = ora('Importing credentials...').start();
+            let envImported = 0;
+            let envFailed = 0;
+            for (const idx of selectedIndexes) {
+                const cred = allDetected[idx];
+                if (!cred)
+                    continue;
+                try {
+                    const platform = guessPlatform(cred.name, cred.value);
+                    const sourceTag = basename(cred.sourceFile).replace(/\./g, '-');
+                    await createPassport(envVault, {
+                        name: options.autoName ? `${cred.name} (imported)` : cred.name,
+                        credentialType: cred.type,
+                        credentialValue: cred.value,
+                        visaType: 'access',
+                        platforms: [platform],
+                        scope: [],
+                        humanOwner: envOwner,
+                        tags: ['imported', sourceTag],
+                        notes: `Imported from ${cred.sourceFile}${cred.line ? ` (line ${cred.line})` : ''}`,
+                    });
+                    envImported++;
+                }
+                catch {
+                    envFailed++;
+                }
+            }
+            importSpinner.stop();
+            console.log();
+            if (envImported > 0) {
+                success(`Imported ${envImported} credential(s) as passports.`);
+            }
+            if (envFailed > 0) {
+                warning(`Failed to import ${envFailed} credential(s).`);
+            }
+            info('Run `idw list` to see your passports.');
+            warning('Source files still contain plaintext credentials. Consider securely deleting them.');
+            return;
+        }
+        // Auto-discovery for --format json (no path given)
+        if (options.format === 'json' && !file) {
+            const searchDir = resolve('.');
+            console.log();
+            title('JSON Config Auto-Discovery');
+            console.log();
+            const spinner = ora('Searching for JSON config files...').start();
+            const jsonFiles = await discoverJsonFiles(searchDir);
+            spinner.stop();
+            if (jsonFiles.length === 0) {
+                info(`No JSON config files found in ${searchDir}`);
+                return;
+            }
+            console.log(chalk.green(`Found ${jsonFiles.length} JSON file(s):`));
+            for (const f of jsonFiles) {
+                console.log(`  ${chalk.dim('•')} ${relative(searchDir, f) || basename(f)}`);
+            }
+            console.log();
+            // Parse all JSON files and combine credentials
+            const allDetected = [];
+            for (const jsonFile of jsonFiles) {
+                try {
+                    const content = await readFile(jsonFile, 'utf-8');
+                    const creds = parseJsonFile(content, basename(jsonFile));
+                    for (const c of creds) {
+                        allDetected.push({ ...c, sourceFile: jsonFile });
+                    }
+                }
+                catch {
+                    warning(`Cannot read: ${relative(searchDir, jsonFile) || basename(jsonFile)}`);
+                }
+            }
+            if (allDetected.length === 0) {
+                info('No credentials detected in JSON files.');
+                return;
+            }
+            info(`Found ${allDetected.length} potential credential(s)`);
+            console.log();
+            for (let i = 0; i < allDetected.length; i++) {
+                const d = allDetected[i];
+                if (!d)
+                    continue;
+                const relFile = relative(searchDir, d.sourceFile) || basename(d.sourceFile);
+                console.log(`  ${chalk.cyan(`[${i + 1}]`)} ${chalk.bold(d.name)}`);
+                console.log(`      File: ${chalk.dim(relFile)}${d.line ? `  |  Line: ${d.line}` : ''}`);
+                console.log(`      Type: ${d.type}  |  Value: ${chalk.dim(maskCredential(d.value, 4))}`);
+                console.log();
+            }
+            // Confirm import
+            let selectedIndexes;
+            if (options.yes) {
+                selectedIndexes = allDetected.map((_, i) => i);
+                console.log(chalk.yellow(`Importing all ${allDetected.length} credentials (--yes flag)`));
+            }
+            else {
+                const inquirer = await import('inquirer');
+                const { selected } = await inquirer.default.prompt([
+                    {
+                        type: 'checkbox',
+                        name: 'selected',
+                        message: 'Select credentials to import:',
+                        choices: allDetected.map((c, i) => ({
+                            name: `${c.name} (${c.type}) — ${relative(searchDir, c.sourceFile) || basename(c.sourceFile)}`,
+                            value: i,
+                            checked: true,
+                        })),
+                    },
+                ]);
+                selectedIndexes = selected;
+            }
+            if (selectedIndexes.length === 0) {
+                console.log('No credentials selected for import.');
+                return;
+            }
+            // Get owner if not provided
+            let jsonOwner = options.owner;
+            if (!jsonOwner) {
+                const inquirer = await import('inquirer');
+                const { ownerEmail } = await inquirer.default.prompt([
+                    {
+                        type: 'input',
+                        name: 'ownerEmail',
+                        message: 'Human owner email:',
+                        validate: (input) => input.includes('@') || 'Valid email required',
+                    },
+                ]);
+                jsonOwner = ownerEmail;
+            }
+            // Unlock vault
+            const jsonPassphrase = await promptPassphrase();
+            const unlockSpinner = ora('Unlocking vault...').start();
+            let jsonVault;
+            try {
+                jsonVault = await unlockVault(jsonPassphrase, vaultPath);
+                unlockSpinner.succeed('Vault unlocked');
+            }
+            catch (err) {
+                unlockSpinner.fail('Failed to unlock vault');
+                error(err instanceof Error ? err.message : 'Invalid passphrase');
+                process.exit(1);
+            }
+            // Import selected credentials
+            const importSpinner = ora('Importing credentials...').start();
+            let jsonImported = 0;
+            let jsonFailed = 0;
+            for (const idx of selectedIndexes) {
+                const cred = allDetected[idx];
+                if (!cred)
+                    continue;
+                try {
+                    const platform = guessPlatform(cred.name, cred.value);
+                    const sourceTag = basename(cred.sourceFile).replace(/\./g, '-');
+                    await createPassport(jsonVault, {
+                        name: options.autoName ? `${cred.name} (imported)` : cred.name,
+                        credentialType: cred.type,
+                        credentialValue: cred.value,
+                        visaType: 'access',
+                        platforms: [platform],
+                        scope: [],
+                        humanOwner: jsonOwner,
+                        tags: ['imported', sourceTag],
+                        notes: `Imported from ${cred.sourceFile}${cred.line ? ` (line ${cred.line})` : ''}`,
+                    });
+                    jsonImported++;
+                }
+                catch {
+                    jsonFailed++;
+                }
+            }
+            importSpinner.stop();
+            console.log();
+            if (jsonImported > 0) {
+                success(`Imported ${jsonImported} credential(s) as passports.`);
+            }
+            if (jsonFailed > 0) {
+                warning(`Failed to import ${jsonFailed} credential(s).`);
+            }
+            info('Run `idw list` to see your passports.');
+            warning('Source files still contain plaintext credentials. Consider securely deleting them.');
+            return;
+        }
+        // Scan-based import (--all or --min-confidence)
+        if (options.all || options.minConfidence) {
+            const scanPath = resolve(file || '.');
+            const minConf = options.all ? 0 : parseFloat(options.minConfidence);
+            console.log();
+            title('Scan-Based Import');
+            info(`Scanning: ${scanPath}`);
+            if (!options.all) {
+                info(`Minimum confidence: ${minConf}`);
+            }
+            console.log();
+            const spinner = ora('Scanning for credentials...').start();
+            const toLine = (r) => r.line ?? 0;
+            const toCol = (r) => r.column ?? 0;
+            const detections = [];
+            let filesScanned = 0;
+            try {
+                const pathStats = await stat(scanPath);
+                if (pathStats.isFile()) {
+                    filesScanned = 1;
+                    const results = await scanFile(scanPath);
+                    const fileName = basename(scanPath);
+                    for (const r of results) {
+                        if (r.confidence >= minConf) {
+                            detections.push({
+                                file: scanPath,
+                                name: `${r.pattern || r.type} in ${fileName}`,
+                                type: r.type,
+                                value: r.value,
+                                line: toLine(r),
+                                column: toCol(r),
+                                confidence: r.confidence,
+                                pattern: r.pattern || String(r.type),
+                                context: r.context,
+                            });
+                        }
+                    }
+                }
+                else {
+                    for await (const filePath of walkDirectory(scanPath)) {
+                        filesScanned++;
+                        if (filesScanned % 100 === 0) {
+                            spinner.text = `Scanned ${filesScanned} files...`;
+                        }
+                        const results = await scanFile(filePath);
+                        const fileName = basename(filePath);
+                        for (const r of results) {
+                            if (r.confidence >= minConf) {
+                                detections.push({
+                                    file: filePath,
+                                    name: `${r.pattern || r.type} in ${fileName}`,
+                                    type: r.type,
+                                    value: r.value,
+                                    line: toLine(r),
+                                    column: toCol(r),
+                                    confidence: r.confidence,
+                                    pattern: r.pattern || String(r.type),
+                                    context: r.context,
+                                });
+                            }
+                        }
+                    }
+                }
+            }
+            catch (err) {
+                spinner.fail('Scan failed');
+                error(err instanceof Error ? err.message : 'Cannot access path');
+                process.exit(1);
+            }
+            spinner.succeed(`Scanned ${filesScanned} file(s)`);
+            if (detections.length === 0) {
+                info('No credentials detected matching criteria.');
+                return;
+            }
+            console.log();
+            warning(`Found ${detections.length} credential(s):`);
+            console.log();
+            // Display detections
+            for (let i = 0; i < detections.length; i++) {
+                const d = detections[i];
+                if (!d)
+                    continue;
+                const confLabel = d.confidence >= 0.9 ? chalk.red('HIGH') :
+                    d.confidence >= 0.7 ? chalk.yellow('MEDIUM') :
+                        chalk.dim('LOW');
+                const relPath = relative(resolve(scanPath), d.file) || basename(d.file);
+                console.log(`  ${chalk.cyan(`[${i + 1}]`)} ${chalk.bold(d.pattern)}`);
+                console.log(`      File: ${chalk.dim(relPath)}`);
+                console.log(`      Line: ${d.line}  |  Confidence: ${confLabel} (${d.confidence.toFixed(2)})`);
+                console.log(`      Value: ${chalk.dim(maskCredential(d.value, 4))}`);
+                console.log();
+            }
+            // Confirm import
+            let scanSelectedIndexes;
+            if (options.yes) {
+                scanSelectedIndexes = detections.map((_, i) => i);
+                console.log(chalk.yellow(`Importing all ${detections.length} credentials (--yes flag)`));
+            }
+            else {
+                const inquirer = await import('inquirer');
+                const { selected } = await inquirer.default.prompt([
+                    {
+                        type: 'checkbox',
+                        name: 'selected',
+                        message: 'Select credentials to import:',
+                        choices: detections.map((d, i) => ({
+                            name: `${d.name} (confidence: ${d.confidence.toFixed(2)})`,
+                            value: i,
+                            checked: true,
+                        })),
+                    },
+                ]);
+                scanSelectedIndexes = selected;
+            }
+            if (scanSelectedIndexes.length === 0) {
+                console.log('No credentials selected for import.');
+                return;
+            }
+            // Get owner if not provided
+            let scanOwner = options.owner;
+            if (!scanOwner) {
+                const inquirer = await import('inquirer');
+                const { ownerEmail } = await inquirer.default.prompt([
+                    {
+                        type: 'input',
+                        name: 'ownerEmail',
+                        message: 'Human owner email:',
+                        validate: (input) => input.includes('@') || 'Valid email required',
+                    },
+                ]);
+                scanOwner = ownerEmail;
+            }
+            // Unlock vault
+            const scanPassphrase = await promptPassphrase();
+            const unlockSpinner = ora('Unlocking vault...').start();
+            let scanVault;
+            try {
+                scanVault = await unlockVault(scanPassphrase, vaultPath);
+                unlockSpinner.succeed('Vault unlocked');
+            }
+            catch (err) {
+                unlockSpinner.fail('Failed to unlock vault');
+                error(err instanceof Error ? err.message : 'Invalid passphrase');
+                process.exit(1);
+            }
+            // Import selected credentials
+            const importSpinner = ora('Importing credentials...').start();
+            let scanImported = 0;
+            let scanFailed = 0;
+            for (const idx of scanSelectedIndexes) {
+                const d = detections[idx];
+                if (!d)
+                    continue;
+                try {
+                    const platform = guessPlatform(d.pattern, d.value);
+                    const confLevel = d.confidence >= 0.9 ? 'high' : d.confidence >= 0.7 ? 'medium' : 'low';
+                    const fileTag = basename(d.file).replace(/\./g, '-');
+                    await createPassport(scanVault, {
+                        name: `${d.pattern} in ${basename(d.file)}`,
+                        credentialType: d.type,
+                        credentialValue: d.value,
+                        visaType: 'access',
+                        platforms: [platform],
+                        scope: [],
+                        humanOwner: scanOwner,
+                        tags: ['imported', 'scan', `confidence-${confLevel}`, fileTag],
+                        notes: `Detected in ${d.file} at line ${d.line}, col ${d.column}. Confidence: ${d.confidence.toFixed(2)}. Pattern: ${d.pattern}.`,
+                    });
+                    scanImported++;
+                }
+                catch {
+                    scanFailed++;
+                }
+            }
+            importSpinner.stop();
+            console.log();
+            if (scanImported > 0) {
+                success(`Imported ${scanImported} credential(s) as passports.`);
+            }
+            if (scanFailed > 0) {
+                warning(`Failed to import ${scanFailed} credential(s).`);
+            }
+            info('Run `idw list --tag scan` to see your scanned passports.');
+            warning('Source files still contain plaintext credentials. Consider securely deleting them.');
+            return;
+        }
+        // File-based import (existing behavior)
+        if (!file) {
+            error('No file path provided. Try one of these:');
+            console.log();
+            console.log(`  ${chalk.cyan('idw import .env')}                  Import a specific file`);
+            console.log(`  ${chalk.cyan('idw import --format env')}          Auto-discover .env files in current directory`);
+            console.log(`  ${chalk.cyan('idw import --format json')}         Auto-discover JSON config files`);
+            console.log(`  ${chalk.cyan('idw import --format openclaw')}     Auto-scan ~/.openclaw credentials`);
+            console.log(`  ${chalk.cyan('idw import --all')}                 Scan current directory for all credentials`);
+            console.log(`  ${chalk.cyan('idw import --min-confidence 0.9')}  Import only high-confidence detections`);
+            console.log();
+            process.exit(1);
+        }
+        // Read file
+        let content;
+        try {
+            content = await readFile(file, 'utf-8');
+        }
+        catch {
+            error(`Cannot read file: ${file}`);
+            process.exit(1);
+        }
+        // Parse credentials based on file type
+        const ext = extname(file).toLowerCase();
+        const filename = basename(file);
+        let detected;
+        if (ext === '.env' || filename.startsWith('.env')) {
+            detected = parseEnvFile(content);
+        }
+        else if (ext === '.json') {
+            detected = parseJsonFile(content, filename);
+        }
+        else {
+            // Generic detection
+            const results = detectCredentials(content);
+            detected = results.map(r => ({
+                name: `${filename}:${r.line}`,
+                type: r.type,
+                value: r.value,
+                line: r.line,
+            }));
+        }
+        if (detected.length === 0) {
+            info('No credentials detected in file.');
+            return;
+        }
+        console.log();
+        info(`Found ${detected.length} potential credential(s) in ${file}`);
+        console.log();
+        // Confirm import
+        let selectedIndexes;
+        if (options.yes) {
+            selectedIndexes = detected.map((_, i) => i.toString());
+        }
+        else {
+            selectedIndexes = await confirmImport(detected.map(c => ({
+                name: c.name,
+                type: c.type,
+                preview: maskCredential(c.value, 4),
+            })));
+        }
+        if (selectedIndexes.length === 0) {
+            console.log('No credentials selected for import.');
+            return;
+        }
+        // Get owner if not provided
+        let owner = options.owner;
+        if (!owner) {
+            const inquirer = await import('inquirer');
+            const { ownerEmail } = await inquirer.default.prompt([
+                {
+                    type: 'input',
+                    name: 'ownerEmail',
+                    message: 'Human owner email:',
+                    validate: (input) => input.includes('@') || 'Valid email required',
+                },
+            ]);
+            owner = ownerEmail;
+        }
+        // Unlock vault
+        const passphrase = await promptPassphrase();
+        const spinner = ora('Unlocking vault...').start();
+        let vault;
+        try {
+            vault = await unlockVault(passphrase, vaultPath);
+            spinner.succeed('Vault unlocked');
+        }
+        catch (err) {
+            spinner.fail('Failed to unlock vault');
+            error(err instanceof Error ? err.message : 'Invalid passphrase');
+            process.exit(1);
+        }
+        // Import selected credentials
+        spinner.start('Importing credentials...');
+        let imported = 0;
+        let failed = 0;
+        for (const idx of selectedIndexes) {
+            const cred = detected[parseInt(idx, 10)];
+            if (!cred)
+                continue;
+            try {
+                const platform = guessPlatform(cred.name, cred.value);
+                const passportName = options.autoName
+                    ? `${cred.name} (imported)`
+                    : cred.name;
+                await createPassport(vault, {
+                    name: passportName,
+                    credentialType: cred.type,
+                    credentialValue: cred.value,
+                    visaType: 'access',
+                    platforms: [platform],
+                    scope: [],
+                    humanOwner: owner,
+                    tags: ['imported', filename.replace(/\./g, '-')],
+                    notes: `Imported from ${file}${cred.line ? ` (line ${cred.line})` : ''}`,
+                });
+                imported++;
+            }
+            catch {
+                failed++;
+            }
+        }
+        spinner.stop();
+        console.log();
+        if (imported > 0) {
+            success(`Imported ${imported} credential(s) as passports.`);
+        }
+        if (failed > 0) {
+            warning(`Failed to import ${failed} credential(s).`);
+        }
+        info('Run `idw list` to see your passports.');
+        warning('Source file still contains plaintext credentials. Consider securely deleting it.');
+    });
+    return command;
+}
+//# sourceMappingURL=import.js.map