@indecisivedev/openplan 0.2.0-alpha.2

package/dist/cli-program.js

@@ -0,0 +1,934 @@
+import { execFileSync } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { Command } from "commander";
+import { QuickstartError, runCelldQuickstart } from "./celld-quickstart.js";
+import { validateHtml } from "./html-policy.js";
+import { EndpointError, normalizeApiUrl, resolveConfiguredApiUrl as resolveEndpoint } from "./cli-endpoint.js";
+import { CredentialError, CredentialStore } from "./cli-credentials.js";
+import { ApiClientError, createAnonymousApiClient, createEnrollmentApiClient, createSavedApiClient } from "./cli-api-client.js";
+/** Run the shared CLI with metadata supplied by its registry-specific launcher. */
+export async function runCli(packageMetadata) {
+    class CliError extends Error {
+    }
+    const VERSION = packageMetadata.version;
+    const DEFAULT_API_URL = packageMetadata.openplan?.defaultApiUrl;
+    const OPENPLAN_DIR = path.join(os.homedir(), ".openplan");
+    const CONFIG_PATH = path.join(OPENPLAN_DIR, "config.json");
+    const credentialStore = new CredentialStore(os.homedir());
+    const DRAFTS_PATH = path.join(OPENPLAN_DIR, "drafts.json");
+    const INSTRUCTIONS_START = "<!-- openplan-celld:instructions:start -->";
+    const INSTRUCTIONS_END = "<!-- openplan-celld:instructions:end -->";
+    const program = new Command();
+    // Commander normally quotes unknown options/arguments. These may be a pasted key.
+    const ARGUMENT_ERROR = "Invalid command arguments. For secure key input use: openplan auth set --stdin [--api-url <origin>]. Run --help for usage.";
+    program.configureOutput({ outputError: () => { } });
+    // Set this before constructing subcommands so every parser inherits the safe boundary.
+    program.exitOverride();
+    program
+        .name("openplan")
+        .description("Upload static HTML drafts to Openplan.")
+        .version(VERSION);
+    const endpointCommand = program
+        .command("endpoint")
+        .description("Configure the Openplan API base URL used by future commands.");
+    endpointCommand
+        .command("set")
+        .argument("<url>", "Openplan API base URL")
+        .description("Persist the API base URL in ~/.openplan/config.json.")
+        .action((url) => {
+        const apiUrl = normalizeApiUrl(url, "API URL");
+        saveApiUrl(apiUrl);
+        console.log(`Openplan API URL saved: ${apiUrl}`);
+        if (process.env.OPENPLAN_API_URL) {
+            console.log("Note: OPENPLAN_API_URL is set and currently overrides the saved value.");
+        }
+    });
+    endpointCommand
+        .command("show")
+        .description("Show the effective API base URL and where it came from.")
+        .action(() => {
+        const resolved = resolveApiUrl();
+        console.log(`API URL: ${resolved.apiUrl}`);
+        console.log(`Source: ${resolved.source}`);
+        console.log(`Config file: ${CONFIG_PATH}`);
+    });
+    endpointCommand
+        .command("reset")
+        .description("Remove the saved URL and use another configured source, if available.")
+        .action(() => {
+        removeSavedApiUrl();
+        const resolved = resolveConfiguredApiUrl();
+        console.log("Saved Openplan API URL removed.");
+        if (resolved) {
+            console.log(`API URL: ${resolved.apiUrl}`);
+            console.log(`Source: ${resolved.source}`);
+        }
+        else {
+            console.log("No Openplan API URL is configured.");
+        }
+        if (process.env.OPENPLAN_API_URL) {
+            console.log("Note: OPENPLAN_API_URL remains active until it is unset in the environment.");
+        }
+    });
+    const instructionsCommand = program
+        .command("instructions")
+        .description("Manage Openplan instructions in AGENTS.md or CLAUDE.md.");
+    instructionsCommand
+        .command("print")
+        .description("Print the managed Openplan instruction block without changing a file.")
+        .option("--api-url <url>", "Use a specific Openplan API base URL in the instructions")
+        .option("--local", `Use this local CLI entry point instead of npx ${packageMetadata.name}`)
+        .action((options) => {
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        console.log(buildAgentInstructions(apiUrl, instructionCliCommand(options.local)));
+    });
+    instructionsCommand
+        .command("add")
+        .argument("[file]", "AGENTS.md or CLAUDE.md file to update", "AGENTS.md")
+        .description("Append or refresh an idempotent Openplan instruction block.")
+        .option("--api-url <url>", "Use a specific Openplan API base URL in the instructions")
+        .option("--local", `Use this local CLI entry point instead of npx ${packageMetadata.name}`)
+        .action((file, options) => {
+        const resolvedFile = resolveInstructionFile(file);
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        const block = buildAgentInstructions(apiUrl, instructionCliCommand(options.local));
+        const existing = fs.existsSync(resolvedFile) ? fs.readFileSync(resolvedFile, "utf8") : "";
+        const updated = upsertManagedInstructions(existing, block);
+        writeTextAtomic(resolvedFile, updated);
+        console.log(`Openplan instructions ${existing.includes(INSTRUCTIONS_START) ? "updated" : "added"}: ${resolvedFile}`);
+    });
+    instructionsCommand
+        .command("remove")
+        .argument("[file]", "AGENTS.md or CLAUDE.md file to update", "AGENTS.md")
+        .description("Remove the managed Openplan instruction block and preserve other content.")
+        .action((file) => {
+        const resolvedFile = resolveInstructionFile(file);
+        if (!fs.existsSync(resolvedFile)) {
+            console.log(`No Openplan instructions found: ${resolvedFile}`);
+            return;
+        }
+        const existing = fs.readFileSync(resolvedFile, "utf8");
+        const updated = removeManagedInstructions(existing);
+        if (updated === existing) {
+            console.log(`No Openplan instructions found: ${resolvedFile}`);
+            return;
+        }
+        writeTextAtomic(resolvedFile, updated);
+        console.log(`Openplan instructions removed: ${resolvedFile}`);
+    });
+    const celldCommand = program
+        .command("celld")
+        .description("Prepare, deploy, activate, and prove Openplan on a celld fleet.");
+    celldCommand
+        .command("deploy")
+        .description("Run the resumable Node.js-first dedicated-fleet quickstart.")
+        .option("--fleet-bucket <uri>", "Dedicated celld fleet bucket (s3://, gs://, or az://).")
+        .option("--public-url <url>", "Public Openplan URL.")
+        .option("--vars-file <path>", "Protected Worker variables file outside the checkout.")
+        .option("--state-file <path>", "Resumable non-secret state file outside the checkout.")
+        .option("--fleet-mode <mode>", "Fleet boundary: auto, dedicated, or shared.", "auto")
+        .option("--node <host>", "Remote celld node; repeat in restart order.", collectOption, [])
+        .option("--remote-host <host>", "Alias for one remote celld node.", collectOption, [])
+        .option("--remote-vars-file <path>", "Absolute protected variables path on each remote node.")
+        .option("--operator-url <url>", "celld 0.4 internal listener reachable from this CLI; repeat once per node.", collectOption, [])
+        .option("--restart-program <path>", "Restart executable; no local shell wrapper is used.")
+        .option("--restart-arg <arg>", "Restart executable argument; repeat as needed.", collectOption, [])
+        .option("--yes", "Skip the deployment confirmation prompt.")
+        .option("--dry-run", "Run checks and print mutations without changing the fleet.")
+        .option("--reset", "Discard the exact state file after reviewing its target.")
+        .option("--non-interactive", "Fail on missing inputs instead of prompting.")
+        .option("--command-timeout-ms <milliseconds>", "Timeout for celld, npm, SSH, and SCP commands.", parsePositiveInteger)
+        .option("--request-timeout-ms <milliseconds>", "Timeout for health, readiness, and API requests.", parsePositiveInteger)
+        .action(async (options) => {
+        const quickstartOptions = {
+            repoRoot: process.cwd(),
+            fleetMode: options.fleetMode,
+            nodes: options.node,
+            remoteHosts: options.remoteHost,
+            operatorUrls: options.operatorUrl,
+            restartArgs: options.restartArg,
+            cliVersion: VERSION
+        };
+        await runCelldQuickstart({
+            ...quickstartOptions,
+            ...(options.fleetBucket ? { fleetBucket: options.fleetBucket } : {}),
+            ...(options.publicUrl ? { publicUrl: options.publicUrl } : {}),
+            ...(options.varsFile ? { varsFile: options.varsFile } : {}),
+            ...(options.stateFile ? { stateFile: options.stateFile } : {}),
+            ...(options.remoteVarsFile ? { remoteVarsFile: options.remoteVarsFile } : {}),
+            ...(options.restartProgram ? { restartProgram: options.restartProgram } : {}),
+            ...(options.yes ? { yes: true } : {}),
+            ...(options.dryRun ? { dryRun: true } : {}),
+            ...(options.reset ? { reset: true } : {}),
+            ...(options.nonInteractive ? { nonInteractive: true } : {}),
+            ...(options.commandTimeoutMs ? { commandTimeoutMs: options.commandTimeoutMs } : {}),
+            ...(options.requestTimeoutMs ? { requestTimeoutMs: options.requestTimeoutMs } : {})
+        });
+    });
+    const authCommand = program.command("auth").description("Manage CLI authentication.");
+    authCommand
+        .command("set")
+        .description("Verify a freshly supplied key and save its origin binding (does not change the default endpoint).")
+        .option("--stdin", "Read the key from bounded standard input; never pass a key as an argument")
+        .option("--api-url <url>", "Select the origin for this key, without changing the default")
+        .action(async (options) => {
+        if (!options.stdin)
+            throw new CliError("Positional API keys are no longer accepted. Use: openplan auth set --stdin [--api-url <origin>]. Nothing saved.");
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        await enroll(apiUrl, true);
+    });
+    authCommand
+        .command("login")
+        .description("Verify a freshly supplied API key using masked terminal input. Works over SSH.")
+        .option("--stdin", "Read the key from bounded standard input instead of a terminal")
+        .option("--api-url <url>", "Select the origin for this key, without changing the default")
+        .action(async (options) => {
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        await enroll(apiUrl, Boolean(options.stdin));
+    });
+    authCommand
+        .command("status")
+        .description("Show local credential binding status, not server validity; use whoami for a remote check.")
+        .option("--api-url <url>", "Inspect a specific origin")
+        .action(async (options) => {
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        console.log(`API URL: ${apiUrl}`);
+        const status = await credentialStore.status(apiUrl);
+        console.log(`Credential source: ${status.source}`);
+        console.log(`Saved binding for this origin: ${status.hasSavedCredential ? "yes" : "no"}`);
+        if (status.metadata) {
+            if (status.metadata.accountName || status.metadata.accountId)
+                console.log(`Verified account: ${status.metadata.accountName ?? "unnamed"} (${status.metadata.accountId ?? "ID unavailable"})`);
+            if (status.metadata.apiKeyName || status.metadata.apiKeyId)
+                console.log(`Verified key identity: ${status.metadata.apiKeyName ?? "unnamed"} (${status.metadata.apiKeyId ?? "ID unavailable"})`);
+        }
+        if (status.source === "environment")
+            console.log("Environment credentials shadow the saved binding; they are not persisted.");
+        if (status.hasLegacyUnbound)
+            console.log("Legacy unbound credential retained but inactive. Reauthenticate explicitly; remove it with: openplan auth logout --legacy");
+        if (status.source === "none" || status.source === "legacy")
+            console.log("Login required: openplan auth login --api-url " + apiUrl);
+        console.log("Local status only; this does not check server revocation.");
+    });
+    authCommand
+        .command("logout")
+        .description("Remove only the selected origin's saved key; this does not revoke server keys.")
+        .option("--api-url <url>", "Remove the saved binding for a specific origin")
+        .option("--legacy", "Remove only the inactive unbound legacy record")
+        .action(async (options) => {
+        if (options.legacy && options.apiUrl !== undefined)
+            throw new CliError("--legacy and --api-url are mutually exclusive. Nothing removed.");
+        if (options.legacy) {
+            const result = await credentialStore.removeLegacy();
+            console.log(result.removed ? "Legacy unbound credential removed." : "No legacy unbound credential to remove.");
+        }
+        else {
+            const { apiUrl } = resolveApiUrl(options.apiUrl);
+            const result = await credentialStore.remove(apiUrl);
+            console.log(`${result.removed ? "Saved credential removed" : "No saved credential"} for ${apiUrl}.`);
+            if (result.hasLegacyUnbound)
+                console.log("Inactive legacy credential retained; remove separately with: openplan auth logout --legacy");
+        }
+        if (process.env.OPENPLAN_API_KEY !== undefined || process.env.OPENPLAN_API_KEY_ORIGIN !== undefined) {
+            console.log("Environment credential settings remain active; unset OPENPLAN_API_KEY and OPENPLAN_API_KEY_ORIGIN separately.");
+        }
+        console.log("Other origin bindings are unchanged. Server keys and backups are not revoked or erased.");
+    });
+    program
+        .command("whoami")
+        .description("Check the configured Openplan credentials.")
+        .option("--api-url <url>", "Override the configured Openplan API base URL")
+        .action(async (options) => {
+        const client = await authenticatedClient(options.apiUrl);
+        const body = await client.me();
+        console.log(`Account: ${body.accountName} (${body.accountId})`);
+        console.log(`API key: ${body.apiKeyName} (${body.apiKeyId})`);
+    });
+    program
+        .command("upload")
+        .argument("<file>", "HTML file path")
+        .option("--draft <draft-id>", "Update a specific draft")
+        .option("--new", "Always create a new draft")
+        .option("--description <text>", "Set a short description for the draft")
+        .option("--api-url <url>", "Override the default Openplan API base URL")
+        .option("--anonymous", "Explicitly upload without any credential lookup or Authorization header")
+        .description("Upload or update an HTML draft (authenticated unless --anonymous).")
+        .action(async (file, options) => {
+        const resolvedFile = path.resolve(file);
+        const { apiUrl } = resolveApiUrl(options.apiUrl);
+        const client = options.anonymous
+            ? createAnonymousApiClient(apiUrl, { userAgent: `openplan/${VERSION}` })
+            : await createSavedApiClient(apiUrl, credentialStore, { userAgent: `openplan/${VERSION}` });
+        if (!fs.existsSync(resolvedFile)) {
+            throw new CliError(`File does not exist: ${resolvedFile}`);
+        }
+        const html = fs.readFileSync(resolvedFile, "utf8");
+        const validation = validateHtml(html);
+        if (!validation.ok) {
+            throw new CliError(`HTML failed Openplan validation:\n- ${validation.errors.join("\n- ")}`);
+        }
+        const drafts = readDrafts();
+        const knownDraft = drafts.files?.[resolvedFile];
+        const knownDraftForEndpoint = knownDraft?.apiUrl === apiUrl ? knownDraft : undefined;
+        const draftId = options.new ? null : options.draft || knownDraftForEndpoint?.draftId || null;
+        const payload = {
+            html,
+            filename: path.basename(resolvedFile),
+            draftId,
+            description: options.description,
+            metadata: {
+                ...collectGitMetadata(path.dirname(resolvedFile)),
+                ...collectCiMetadata(),
+                cliVersion: VERSION,
+                fileSha256: sha256(html)
+            }
+        };
+        const body = await client.upload(payload);
+        drafts.files ||= {};
+        drafts.files[resolvedFile] = {
+            draftId: body.draftId,
+            apiUrl,
+            publicUrl: body.publicUrl,
+            rawUrl: body.rawUrl || `${body.publicUrl.replace(/\/+$/, "")}/raw`,
+            latestVersionNumber: body.versionNumber,
+            updatedAt: new Date().toISOString()
+        };
+        writeJson(DRAFTS_PATH, drafts, 0o600);
+        console.log(draftId ? "Updated draft" : "Uploaded draft");
+        console.log(`Current URL: ${body.publicUrl}`);
+        console.log(`Current raw HTML: ${body.rawUrl || `${body.publicUrl.replace(/\/+$/, "")}/raw`}`);
+        console.log(`Draft ID: ${body.draftId}`);
+        console.log(`Version: ${body.versionNumber}`);
+        if (body.versionUrl)
+            console.log(`Uploaded version URL: ${body.versionUrl}`);
+        if (body.versionRawUrl)
+            console.log(`Uploaded version raw HTML: ${body.versionRawUrl}`);
+        if (body.access?.mode) {
+            console.log(`Uploaded version access: ${body.access.mode}${body.access.inherited ? " (inherits plan default)" : ""}`);
+            if (body.planAccess?.mode)
+                console.log(`Plan default: ${body.planAccess.mode}`);
+            console.log("Access is a snapshot for the uploaded version, not the current URL; a newer version or later sharing change may differ.");
+            if (body.access.mode !== "public") {
+                console.log("The uploaded version is not public at upload completion. To change sharing, use the dashboard access settings.");
+            }
+        }
+        else {
+            console.log("Access: not reported by server; check the dashboard before sharing this URL.");
+        }
+        for (const warning of body.warnings || []) {
+            console.warn(`Warning: ${warning}`);
+        }
+    });
+    program
+        .command("list")
+        .description("List the drafts published to your account.")
+        .option("--api-url <url>", "Override the default Openplan API base URL")
+        .option("--json", "Print the raw JSON response")
+        .action(async (options) => {
+        const client = await authenticatedClient(options.apiUrl);
+        const body = await client.listDrafts();
+        const drafts = body.drafts || [];
+        if (options.json) {
+            console.log(JSON.stringify(drafts, null, 2));
+            return;
+        }
+        if (!drafts.length) {
+            console.log("No drafts yet. Publish one with: openplan upload <file>");
+            return;
+        }
+        console.log(`Drafts (${drafts.length})\n`);
+        for (const draft of drafts) {
+            const repo = draft.repoOrg && draft.repoName ? `${draft.repoOrg}/${draft.repoName}` : "no repo";
+            const version = draft.latestVersionNumber ? `v${draft.latestVersionNumber}` : "no versions";
+            const count = `${draft.versionCount} version${draft.versionCount === 1 ? "" : "s"}`;
+            const disabled = draft.disabled ? " · disabled" : "";
+            console.log(draft.title || "Untitled Draft");
+            console.log(`  ${repo} · ${version} · ${count} · updated ${timeAgo(draft.updatedAt)}${disabled}`);
+            console.log(`  ${draft.publicUrl}`);
+            if (draft.description) {
+                console.log(`  ${draft.description}`);
+            }
+            console.log("");
+        }
+    });
+    async function authenticatedClient(apiUrlOverride) {
+        const { apiUrl } = resolveApiUrl(apiUrlOverride);
+        return createSavedApiClient(apiUrl, credentialStore, { userAgent: `openplan/${VERSION}` });
+    }
+    // Enrollment is the only CLI boundary which handles freshly supplied secret input.
+    async function enroll(apiUrl, stdin) {
+        console.log(`Credential target: ${apiUrl}`);
+        if (!stdin)
+            console.log(`Generate a key in your browser: ${apiUrl}/cli/auth`);
+        await credentialStore.status(apiUrl, {});
+        const apiKey = stdin ? await readStdinKey() : await readMaskedKey();
+        const client = createEnrollmentApiClient(apiUrl, apiKey, { userAgent: `openplan/${VERSION}` });
+        const identity = await client.me();
+        const result = await credentialStore.save(apiUrl, apiKey, identity);
+        console.log(`Verified credential saved for ${apiUrl}.`);
+        if (result.hasLegacyUnbound)
+            console.log("A different legacy unbound credential was retained but remains inactive.");
+        console.log(`Default endpoint unchanged. To select this origin for future commands: openplan endpoint set ${apiUrl}`);
+    }
+    const MAX_KEY_BYTES = 8192;
+    function checkedKey(value) {
+        const key = value.trim();
+        if (!key || Buffer.byteLength(key) > MAX_KEY_BYTES || /[\s\x00-\x1f\x7f]/.test(key)) {
+            throw new CliError("Invalid or empty API key input. Supply one key only; nothing saved.");
+        }
+        return key;
+    }
+    function readStdinKey() {
+        return new Promise((resolve, reject) => {
+            const chunks = [];
+            let bytes = 0;
+            const timer = setTimeout(() => finish(new CliError("API key input timed out. Nothing saved.")), 60_000);
+            const finish = (error) => {
+                clearTimeout(timer);
+                process.stdin.off("data", data).off("end", end).off("error", failed);
+                process.stdin.pause();
+                if (error)
+                    return reject(error);
+                try {
+                    resolve(checkedKey(Buffer.concat(chunks).toString("utf8")));
+                }
+                catch (failure) {
+                    reject(failure);
+                }
+            };
+            const data = (chunk) => {
+                bytes += chunk.length;
+                if (bytes > MAX_KEY_BYTES)
+                    return finish(new CliError("API key input exceeds the size limit. Nothing saved."));
+                chunks.push(chunk);
+            };
+            const end = () => finish();
+            const failed = () => finish(new CliError("Unable to read API key input. Nothing saved."));
+            process.stdin.on("data", data).once("end", end).once("error", failed);
+            process.stdin.resume();
+        });
+    }
+    function readMaskedKey() {
+        if (!process.stdin.isTTY || !process.stdout.isTTY) {
+            throw new CliError("Masked login requires a terminal. Use: openplan auth set --stdin [--api-url <origin>]. Nothing saved.");
+        }
+        return new Promise((resolve, reject) => {
+            let value = "";
+            const wasRaw = process.stdin.isRaw;
+            const finish = (error) => {
+                process.stdin.off("data", data).off("end", aborted).off("error", aborted);
+                process.off("SIGTERM", aborted).off("SIGHUP", aborted).off("SIGINT", aborted);
+                process.stdin.setRawMode(wasRaw);
+                process.stdin.pause();
+                process.stdout.write("\n");
+                if (error)
+                    return reject(error);
+                try {
+                    resolve(checkedKey(value));
+                }
+                catch (failure) {
+                    reject(failure);
+                }
+            };
+            const aborted = () => finish(new CliError("API key input cancelled. Nothing saved."));
+            const data = (chunk) => {
+                for (const char of chunk.toString("utf8")) {
+                    if (char === "\r" || char === "\n") {
+                        finish();
+                        return;
+                    }
+                    if (char === "\u0003" || char === "\u0004") {
+                        aborted();
+                        return;
+                    }
+                    if (char === "\u007f" || char === "\b") {
+                        if (value) {
+                            value = value.slice(0, -1);
+                            process.stdout.write("\b \b");
+                        }
+                    }
+                    else if (char >= " " && char <= "~") {
+                        value += char;
+                        if (Buffer.byteLength(value) > MAX_KEY_BYTES) {
+                            finish(new CliError("API key input exceeds the size limit. Nothing saved."));
+                            return;
+                        }
+                        process.stdout.write("*");
+                    }
+                    else {
+                        finish(new CliError("Invalid API key input. Nothing saved."));
+                        return;
+                    }
+                }
+            };
+            process.stdin.setRawMode(true);
+            process.stdin.on("data", data).once("end", aborted).once("error", aborted);
+            process.once("SIGTERM", aborted).once("SIGHUP", aborted).once("SIGINT", aborted);
+            process.stdout.write("Paste your API key (masked): ");
+            process.stdin.resume();
+        });
+    }
+    function resolveApiUrl(apiUrlOverride) {
+        const resolved = resolveConfiguredApiUrl(apiUrlOverride);
+        if (resolved)
+            return resolved;
+        throw new CliError("No Openplan API URL is configured. Run: openplan endpoint set <url>");
+    }
+    function resolveConfiguredApiUrl(apiUrlOverride) {
+        const config = readConfig();
+        return resolveEndpoint({
+            ...(apiUrlOverride !== undefined ? { apiUrlOverride } : {}),
+            env: process.env,
+            ...(config.apiUrl !== undefined ? { savedApiUrl: config.apiUrl } : {}),
+            ...(DEFAULT_API_URL !== undefined ? { defaultApiUrl: DEFAULT_API_URL } : {})
+        });
+    }
+    // The shared nonsecret state uses the same Linux/private-file boundary as the
+    // credential backend. Instruction files deliberately use a separate writer.
+    function privateStateStat(stat, directory) {
+        if ((directory ? !stat.isDirectory() : !stat.isFile()) || stat.uid !== process.getuid?.() ||
+            (stat.mode & 0o077) !== 0 || (!directory && stat.nlink !== 1)) {
+            throw new CliError("Unsafe Openplan state ownership, permissions or file type. Inspect ~/.openplan and repair private modes without following links.");
+        }
+    }
+    function sameStateFile(a, b) {
+        return a.dev === b.dev && a.ino === b.ino;
+    }
+    function stateOsCode(error) {
+        return error?.code;
+    }
+    function stateAt(directory, name) {
+        return `/proc/self/fd/${directory}/${name}`;
+    }
+    function ensureStateDir(create) {
+        let parent;
+        let directory;
+        try {
+            // Walk using inspected directory descriptors. O_NOFOLLOW applies to every
+            // home component, not just .openplan, so a symlinked ancestor cannot redirect
+            // a later mkdir or open. Ancestors need not be private (e.g. /tmp).
+            const home = path.resolve(os.homedir());
+            parent = fs.openSync(path.parse(home).root, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+            for (const component of home.slice(path.parse(home).root.length).split(path.sep).filter(Boolean)) {
+                const next = fs.openSync(stateAt(parent, component), fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+                fs.closeSync(parent);
+                parent = next;
+            }
+            const location = stateAt(parent, ".openplan");
+            if (create) {
+                try {
+                    fs.mkdirSync(location, { mode: 0o700 });
+                    fs.fsyncSync(parent);
+                }
+                catch (error) {
+                    if (stateOsCode(error) !== "EEXIST")
+                        throw error;
+                }
+            }
+            let before;
+            try {
+                before = fs.lstatSync(location);
+            }
+            catch (error) {
+                if (!create && stateOsCode(error) === "ENOENT")
+                    return undefined;
+                throw error;
+            }
+            privateStateStat(before, true);
+            directory = fs.openSync(location, fs.constants.O_RDONLY | fs.constants.O_DIRECTORY | fs.constants.O_NOFOLLOW);
+            const after = fs.fstatSync(directory);
+            privateStateStat(after, true);
+            if (!sameStateFile(before, after))
+                throw new CliError("Openplan state directory changed during inspection. Nothing was written.");
+            const result = directory;
+            directory = undefined;
+            return result;
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError("Cannot safely access Openplan state. Inspect the home directory, ownership, private permissions and symlinks; no unsafe path was followed.");
+        }
+        finally {
+            if (directory !== undefined)
+                fs.closeSync(directory);
+            if (parent !== undefined)
+                fs.closeSync(parent);
+        }
+    }
+    function stateName(file) {
+        if (file === CONFIG_PATH)
+            return "config.json";
+        if (file === DRAFTS_PATH)
+            return "drafts.json";
+        throw new CliError("Unsupported Openplan state file.");
+    }
+    function inspectStateFile(directory, name) {
+        let stat;
+        try {
+            stat = fs.lstatSync(stateAt(directory, name));
+        }
+        catch (error) {
+            if (stateOsCode(error) === "ENOENT")
+                return undefined;
+            throw error;
+        }
+        privateStateStat(stat, false);
+        return stat;
+    }
+    function readStateJson(file) {
+        const name = stateName(file);
+        const directory = ensureStateDir(false);
+        if (directory === undefined)
+            return undefined;
+        let fd;
+        try {
+            const before = inspectStateFile(directory, name);
+            if (!before)
+                return undefined;
+            fd = fs.openSync(stateAt(directory, name), fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+            const after = fs.fstatSync(fd);
+            privateStateStat(after, false);
+            if (!sameStateFile(before, after))
+                throw new CliError("Openplan state file changed during inspection. Nothing was written.");
+            const limit = 8 * 1024 * 1024;
+            if (after.size > limit)
+                throw new CliError("Openplan state file exceeds the supported size limit; preserve it for inspection.");
+            const buffer = Buffer.alloc(limit + 1);
+            let length = 0;
+            while (length < buffer.length) {
+                const count = fs.readSync(fd, buffer, length, buffer.length - length, null);
+                if (!count)
+                    break;
+                length += count;
+            }
+            if (length > limit)
+                throw new CliError("Openplan state file exceeds the supported size limit; preserve it for inspection.");
+            try {
+                return JSON.parse(new TextDecoder("utf-8", { fatal: true }).decode(buffer.subarray(0, length)));
+            }
+            catch {
+                throw new CliError(`Openplan ${name === "config.json" ? "config" : "draft state"} is not valid JSON; preserve it for inspection.`);
+            }
+        }
+        catch (error) {
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError("Cannot safely read Openplan state; existing state was not replaced.");
+        }
+        finally {
+            if (fd !== undefined)
+                fs.closeSync(fd);
+            fs.closeSync(directory);
+        }
+    }
+    function saveApiUrl(apiUrl) {
+        writeJson(CONFIG_PATH, {
+            ...readConfig(),
+            apiUrl
+        });
+    }
+    function removeSavedApiUrl() {
+        const config = readConfig();
+        const { apiUrl: _removed, ...remaining } = config;
+        writeJson(CONFIG_PATH, remaining);
+    }
+    function readConfig() {
+        const parsed = readStateJson(CONFIG_PATH);
+        if (parsed === undefined)
+            return {};
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) {
+            throw new CliError(`Openplan config must contain a JSON object: ${CONFIG_PATH}`);
+        }
+        if ("apiUrl" in parsed && parsed.apiUrl !== undefined && typeof parsed.apiUrl !== "string") {
+            throw new CliError(`Openplan config apiUrl must be a string: ${CONFIG_PATH}`);
+        }
+        return parsed;
+    }
+    function readDrafts() {
+        const parsed = readStateJson(DRAFTS_PATH);
+        if (parsed === undefined)
+            return { files: {} };
+        if (!parsed || typeof parsed !== "object" || Array.isArray(parsed) ||
+            !("files" in parsed) || !parsed.files || typeof parsed.files !== "object" || Array.isArray(parsed.files)) {
+            throw new CliError("Openplan draft state must contain a files object; preserve it for inspection.");
+        }
+        for (const entry of Object.values(parsed.files)) {
+            if (!entry || typeof entry !== "object" || Array.isArray(entry) || typeof entry.draftId !== "string" ||
+                (entry.apiUrl !== undefined && typeof entry.apiUrl !== "string")) {
+                throw new CliError("Openplan draft state contains an invalid record; preserve it for inspection.");
+            }
+        }
+        return parsed;
+    }
+    function collectOption(value, previous) {
+        return [...previous, value];
+    }
+    function parsePositiveInteger(value) {
+        const parsed = Number(value);
+        if (!Number.isInteger(parsed) || parsed <= 0) {
+            throw new CliError("Expected a positive integer.");
+        }
+        return parsed;
+    }
+    function writeJson(file, value, _mode = 0o600) {
+        const name = stateName(file);
+        const directory = ensureStateDir(true);
+        let temporary;
+        let fd;
+        let committed = false;
+        try {
+            inspectStateFile(directory, name);
+            const serialized = `${JSON.stringify(value, null, 2)}\n`;
+            if (Buffer.byteLength(serialized) > 8 * 1024 * 1024)
+                throw new CliError("Openplan state update exceeds the supported size limit. Nothing was written.");
+            temporary = stateAt(directory, `.${name}-${randomUUID()}.tmp`);
+            fd = fs.openSync(temporary, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | fs.constants.O_NOFOLLOW, 0o600);
+            privateStateStat(fs.fstatSync(fd), false);
+            fs.writeFileSync(fd, serialized, "utf8");
+            fs.fsyncSync(fd);
+            fs.closeSync(fd);
+            fd = undefined;
+            // Recheck the destination after writing, then rename relative to the same
+            // descriptor. No chmod/repair or symlink traversal is ever performed.
+            inspectStateFile(directory, name);
+            fs.renameSync(temporary, stateAt(directory, name));
+            committed = true;
+            temporary = undefined;
+            fs.fsyncSync(directory);
+        }
+        catch (error) {
+            if (committed)
+                throw new CliError("Openplan state replacement occurred but durability could not be confirmed. Persistence is uncertain; inspect local state before retrying.");
+            if (error instanceof CliError)
+                throw error;
+            throw new CliError("Openplan state update failed before replacement; existing state was preserved. Inspect local state before retrying.");
+        }
+        finally {
+            if (fd !== undefined)
+                fs.closeSync(fd);
+            if (temporary) {
+                try {
+                    fs.unlinkSync(temporary);
+                }
+                catch { /* Do not obscure the original failure. */ }
+            }
+            fs.closeSync(directory);
+        }
+    }
+    function resolveInstructionFile(file) {
+        const resolved = path.resolve(file);
+        const basename = path.basename(resolved);
+        if (basename !== "AGENTS.md" && basename !== "CLAUDE.md") {
+            throw new CliError("Instruction file must be named AGENTS.md or CLAUDE.md.");
+        }
+        if (!fs.existsSync(path.dirname(resolved))) {
+            throw new CliError(`Instruction file directory does not exist: ${path.dirname(resolved)}`);
+        }
+        return resolved;
+    }
+    function instructionCliCommand(local) {
+        if (local && packageMetadata.localInstructionCommand)
+            return packageMetadata.localInstructionCommand;
+        if (!local && packageMetadata.instructionCommand)
+            return packageMetadata.instructionCommand;
+        if (!local)
+            return `npx ${packageMetadata.name}`;
+        const entryPoint = path.resolve(process.argv[1] || "dist/cli.js");
+        const loader = entryPoint.endsWith(".ts") ? " --import tsx" : "";
+        return `node${loader} ${JSON.stringify(entryPoint)}`;
+    }
+    function buildAgentInstructions(apiUrl, cliCommand) {
+        return `${INSTRUCTIONS_START}
+## Openplan
+
+Use Openplan when asked to publish a plan, proposal, brief, architecture note, or other static HTML artifact.
+
+Before uploading, select this repository's Openplan deployment (endpoint selection never moves credentials):
+
+\`\`\`sh
+${cliCommand} endpoint set ${apiUrl}
+${cliCommand} endpoint show
+\`\`\`
+
+Authenticate separately with \`${cliCommand} auth login --api-url ${apiUrl}\`. A key is verified and saved only for that exact origin; the default endpoint is unchanged. For automation use \`auth set --stdin\`, never a positional key. Uploads require authentication unless explicitly \`--anonymous\`.
+
+Create one complete, self-contained HTML document. CSS is allowed, but do not include JavaScript, scripts, inline event handlers, forms, iframes, embeds, meta-refresh redirects, secrets, tokens, or local filesystem paths.
+
+Upload the document with:
+
+\`\`\`sh
+${cliCommand} upload <file-path>
+\`\`\`
+
+The CLI prints a draft URL and a raw HTML URL. Return the draft URL to the user. Re-uploading the same local file updates its existing draft; use \`--new\` only when a separate draft is requested.
+${INSTRUCTIONS_END}`;
+    }
+    function upsertManagedInstructions(existing, block) {
+        const range = managedInstructionRange(existing);
+        if (!range) {
+            const prefix = existing.trimEnd();
+            return `${prefix ? `${prefix}\n\n` : ""}${block}\n`;
+        }
+        const prefix = existing.slice(0, range.start).trimEnd();
+        const suffix = existing.slice(range.end).trim();
+        return [prefix, block, suffix].filter(Boolean).join("\n\n") + "\n";
+    }
+    function removeManagedInstructions(existing) {
+        const range = managedInstructionRange(existing);
+        if (!range)
+            return existing;
+        const prefix = existing.slice(0, range.start).trimEnd();
+        const suffix = existing.slice(range.end).trim();
+        const remaining = [prefix, suffix].filter(Boolean).join("\n\n");
+        return remaining ? `${remaining}\n` : "";
+    }
+    function managedInstructionRange(content) {
+        const start = content.indexOf(INSTRUCTIONS_START);
+        const endMarkerStart = content.indexOf(INSTRUCTIONS_END);
+        if (start === -1 && endMarkerStart === -1)
+            return null;
+        if (start === -1 || endMarkerStart === -1 || endMarkerStart < start) {
+            throw new CliError("The Openplan instruction markers are incomplete or out of order.");
+        }
+        const duplicateStart = content.indexOf(INSTRUCTIONS_START, start + INSTRUCTIONS_START.length);
+        const duplicateEnd = content.indexOf(INSTRUCTIONS_END, endMarkerStart + INSTRUCTIONS_END.length);
+        if (duplicateStart !== -1 || duplicateEnd !== -1) {
+            throw new CliError("Multiple Openplan instruction blocks were found; remove duplicates manually.");
+        }
+        return { start, end: endMarkerStart + INSTRUCTIONS_END.length };
+    }
+    function writeTextAtomic(file, value) {
+        const existingMode = fs.existsSync(file) ? fs.statSync(file).mode & 0o777 : 0o644;
+        const temporaryFile = `${file}.${process.pid}.${Date.now()}.tmp`;
+        try {
+            fs.writeFileSync(temporaryFile, value, { mode: existingMode });
+            fs.chmodSync(temporaryFile, existingMode);
+            fs.renameSync(temporaryFile, file);
+        }
+        finally {
+            fs.rmSync(temporaryFile, { force: true });
+        }
+    }
+    function collectGitMetadata(cwd) {
+        const repoRoot = git(["rev-parse", "--show-toplevel"], cwd);
+        const remote = git(["config", "--get", "remote.origin.url"], cwd);
+        const parsedRemote = parseRemote(remote);
+        const status = git(["status", "--porcelain"], cwd);
+        return {
+            repoOrg: parsedRemote.org || inferOrgFromRoot(repoRoot),
+            repoName: parsedRemote.name || (repoRoot ? path.basename(repoRoot) : null),
+            repoHost: parsedRemote.host || null,
+            gitBranch: git(["rev-parse", "--abbrev-ref", "HEAD"], cwd),
+            gitCommitSha: git(["rev-parse", "HEAD"], cwd),
+            gitCommitSubject: git(["log", "-1", "--format=%s"], cwd),
+            // null when not a git repo; true/false when a working tree is present.
+            gitDirty: status === null ? null : status.length > 0
+        };
+    }
+    // Best-effort CI provenance. GitHub Actions is detected precisely (with a run
+    // URL); other CI systems are flagged generically. Nothing here is trusted for
+    // authorization — it is metadata for the dashboard and audit trail only.
+    function collectCiMetadata() {
+        const env = process.env;
+        if (env.GITHUB_ACTIONS === "true") {
+            const server = env.GITHUB_SERVER_URL || "https://github.com";
+            const repo = env.GITHUB_REPOSITORY;
+            const runId = env.GITHUB_RUN_ID;
+            return {
+                ciProvider: "github_actions",
+                ciRunUrl: repo && runId ? `${server}/${repo}/actions/runs/${runId}` : null,
+                ciActor: env.GITHUB_ACTOR || null
+            };
+        }
+        if (env.CI) {
+            return { ciProvider: "unknown" };
+        }
+        return {};
+    }
+    function git(args, cwd) {
+        try {
+            return execFileSync("git", args, {
+                cwd,
+                encoding: "utf8",
+                stdio: ["ignore", "pipe", "ignore"]
+            }).trim();
+        }
+        catch {
+            return null;
+        }
+    }
+    function parseRemote(remote) {
+        if (!remote)
+            return {};
+        const cleaned = remote.replace(/\.git$/, "");
+        const sshMatch = cleaned.match(/^[^@]+@([^:]+):([^/]+)\/(.+)$/);
+        if (sshMatch) {
+            return { host: sshMatch[1], org: sshMatch[2], name: path.basename(sshMatch[3]) };
+        }
+        try {
+            const url = new URL(cleaned);
+            const parts = url.pathname.split("/").filter(Boolean);
+            if (parts.length >= 2) {
+                return { host: url.hostname, org: parts[0], name: parts.at(-1) };
+            }
+        }
+        catch {
+            // Fall through to path parsing.
+        }
+        const parts = cleaned.split("/").filter(Boolean);
+        if (parts.length >= 2) {
+            return { org: parts.at(-2), name: parts.at(-1) };
+        }
+        return {};
+    }
+    function inferOrgFromRoot(repoRoot) {
+        if (!repoRoot)
+            return null;
+        return path.basename(path.dirname(repoRoot));
+    }
+    function sha256(value) {
+        return createHash("sha256").update(value).digest("hex");
+    }
+    function timeAgo(value) {
+        if (!value)
+            return "unknown";
+        if (!(typeof value === "string" || typeof value === "number" || value instanceof Date)) {
+            return "unknown";
+        }
+        const then = new Date(value).getTime();
+        if (Number.isNaN(then))
+            return "unknown";
+        const seconds = Math.max(0, Math.floor((Date.now() - then) / 1000));
+        const units = [
+            ["year", 31_536_000],
+            ["month", 2_592_000],
+            ["week", 604_800],
+            ["day", 86_400],
+            ["hour", 3_600],
+            ["minute", 60]
+        ];
+        for (const [name, secs] of units) {
+            const amount = Math.floor(seconds / secs);
+            if (amount >= 1)
+                return `${amount} ${name}${amount === 1 ? "" : "s"} ago`;
+        }
+        return "just now";
+    }
+    await program.parseAsync(process.argv).catch((error) => {
+        if (error instanceof CliError || error instanceof EndpointError || error instanceof CredentialError || error instanceof ApiClientError || error instanceof QuickstartError) {
+            console.error(error.message);
+            process.exit(1);
+        }
+        const commandError = error;
+        if (commandError.code === "commander.helpDisplayed" || commandError.code === "commander.version") {
+            process.exit(0);
+        }
+        console.error(commandError.code?.startsWith("commander.") ? ARGUMENT_ERROR : "Openplan operation failed. No diagnostic response body is displayed.");
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=cli-program.js.map