@kaitranntt/ccs 8.4.0-dev.9 → 8.5.0-dev.1

package/dist/commands/persist-command/secure-file.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Persist Command - Secure File I/O & Locking
+ *
+ * Hardened filesystem helpers for reading/writing ~/.claude/settings.json.
+ * Refuses to follow symlinks (TOCTOU mitigations), uses O_NOFOLLOW where
+ * available, writes via atomic temp-file + rename, and serializes concurrent
+ * persist operations via a proper-lockfile on the settings directory.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeClaudeSettings = exports.readClaudeSettings = exports.withPersistSettingsLock = exports.parseSettingsObject = exports.readFileUtf8NoFollow = exports.getNoFollowFlag = exports.isSymlinkAsync = exports.pathExists = exports.getClaudeSettingsDisplayPath = exports.formatDisplayPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const lockfile = __importStar(require("proper-lockfile"));
+const claude_config_path_1 = require("../../utils/claude-config-path");
+const types_1 = require("./types");
+function formatDisplayPath(filePath) {
+    const defaultClaudeDir = path.join(os.homedir(), '.claude');
+    const claudeDir = (0, claude_config_path_1.getClaudeConfigDir)();
+    // Keep real path when user overrides Claude directory.
+    if (path.resolve(claudeDir) !== path.resolve(defaultClaudeDir)) {
+        return filePath;
+    }
+    if (filePath === claudeDir) {
+        return '~/.claude';
+    }
+    const claudePrefix = `${claudeDir}${path.sep}`;
+    if (filePath.startsWith(claudePrefix)) {
+        return filePath.replace(claudePrefix, '~/.claude/');
+    }
+    return filePath;
+}
+exports.formatDisplayPath = formatDisplayPath;
+function getClaudeSettingsDisplayPath() {
+    return formatDisplayPath((0, claude_config_path_1.getClaudeSettingsPath)());
+}
+exports.getClaudeSettingsDisplayPath = getClaudeSettingsDisplayPath;
+async function pathExists(filePath) {
+    try {
+        await fs.promises.access(filePath, fs.constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+exports.pathExists = pathExists;
+async function isSymlinkAsync(filePath) {
+    try {
+        const stats = await fs.promises.lstat(filePath);
+        return stats.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+exports.isSymlinkAsync = isSymlinkAsync;
+function getNoFollowFlag() {
+    const candidate = fs.constants['O_NOFOLLOW'];
+    if (process.platform !== 'win32' && typeof candidate === 'number') {
+        return candidate;
+    }
+    return 0;
+}
+exports.getNoFollowFlag = getNoFollowFlag;
+function createSymlinkReadError(filePath) {
+    const error = new Error(`Refusing to read symlinked file for security: ${formatDisplayPath(filePath)}`);
+    error.code = 'ELOOP';
+    return error;
+}
+async function readFileUtf8NoFollow(filePath) {
+    if (await isSymlinkAsync(filePath)) {
+        throw createSymlinkReadError(filePath);
+    }
+    const noFollowFlag = getNoFollowFlag();
+    const flags = fs.constants.O_RDONLY | noFollowFlag;
+    const handle = await fs.promises.open(filePath, flags);
+    try {
+        // Best-effort fallback for platforms without O_NOFOLLOW (notably Windows).
+        // Re-check symlink status after open to reduce check-then-use windows.
+        if (noFollowFlag === 0 && (await isSymlinkAsync(filePath))) {
+            throw createSymlinkReadError(filePath);
+        }
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error('Path is not a regular file');
+        }
+        if (noFollowFlag === 0) {
+            const latestStats = await fs.promises.stat(filePath);
+            if (latestStats.dev !== stats.dev || latestStats.ino !== stats.ino) {
+                throw new Error('Path changed during secure read');
+            }
+        }
+        return await handle.readFile({ encoding: 'utf8' });
+    }
+    finally {
+        await handle.close();
+    }
+}
+exports.readFileUtf8NoFollow = readFileUtf8NoFollow;
+function parseSettingsObject(content, sourceLabel) {
+    if (!content.trim()) {
+        return {};
+    }
+    const parsed = JSON.parse(content);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`${sourceLabel} must contain a JSON object, not an array or primitive`);
+    }
+    return parsed;
+}
+exports.parseSettingsObject = parseSettingsObject;
+async function withPersistSettingsLock(operation) {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    const settingsDir = path.dirname(settingsPath);
+    await fs.promises.mkdir(settingsDir, { recursive: true });
+    let release;
+    try {
+        release = await lockfile.lock(settingsDir, {
+            stale: types_1.PERSIST_LOCK_STALE_MS,
+            retries: {
+                retries: types_1.PERSIST_LOCK_RETRIES,
+                minTimeout: types_1.PERSIST_LOCK_RETRY_MIN_MS,
+                maxTimeout: types_1.PERSIST_LOCK_RETRY_MAX_MS,
+            },
+            realpath: false,
+        });
+    }
+    catch (error) {
+        throw new Error(`Failed to lock Claude settings directory (${formatDisplayPath(settingsDir)}): ${error.message}`);
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch {
+                // Best-effort release.
+            }
+        }
+    }
+}
+exports.withPersistSettingsLock = withPersistSettingsLock;
+/** Read existing Claude settings.json with validation */
+async function readClaudeSettings() {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    try {
+        const content = await readFileUtf8NoFollow(settingsPath);
+        return parseSettingsObject(content, 'settings.json');
+    }
+    catch (error) {
+        const nodeError = error;
+        if (nodeError.code === 'ENOENT') {
+            return {};
+        }
+        if (nodeError.code === 'ELOOP') {
+            throw new Error('settings.json is a symlink - refusing to read for security');
+        }
+        throw new Error(`Failed to parse settings.json: ${error.message}`);
+    }
+}
+exports.readClaudeSettings = readClaudeSettings;
+/** Write settings back to settings.json with atomic replace semantics. */
+async function writeClaudeSettings(settings) {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    if (await isSymlinkAsync(settingsPath)) {
+        throw new Error('settings.json is a symlink - refusing to write for security');
+    }
+    const settingsDir = path.dirname(settingsPath);
+    await fs.promises.mkdir(settingsDir, { recursive: true });
+    const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    const tmpPath = path.join(settingsDir, `settings.json.tmp-${nonce}`);
+    const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | getNoFollowFlag();
+    let handle;
+    try {
+        handle = await fs.promises.open(tmpPath, flags, 0o600);
+        await handle.writeFile(JSON.stringify(settings, null, 2) + '\n', { encoding: 'utf8' });
+        await handle.sync();
+    }
+    finally {
+        if (handle) {
+            await handle.close();
+        }
+    }
+    try {
+        await fs.promises.rename(tmpPath, settingsPath);
+    }
+    catch (error) {
+        try {
+            await fs.promises.unlink(tmpPath);
+        }
+        catch {
+            // Best-effort cleanup.
+        }
+        throw error;
+    }
+    try {
+        await fs.promises.chmod(settingsPath, 0o600);
+    }
+    catch {
+        // Best-effort permission hardening.
+    }
+}
+exports.writeClaudeSettings = writeClaudeSettings;
+//# sourceMappingURL=secure-file.js.map

package/dist/commands/persist-command/secure-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-file.js","sourceRoot":"","sources":["../../../src/commands/persist-command/secure-file.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,0DAA4C;AAC5C,uEAA2F;AAC3F,mCAKiB;AAEjB,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAA,uCAAkB,GAAE,CAAC;IAEvC,uDAAuD;IACvD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAnBD,8CAmBC;AAED,SAAgB,4BAA4B;IAC1C,OAAO,iBAAiB,CAAC,IAAA,0CAAqB,GAAE,CAAC,CAAC;AACpD,CAAC;AAFD,oEAEC;AAEM,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAPD,gCAOC;AAEM,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAPD,wCAOC;AAED,SAAgB,eAAe;IAC7B,MAAM,SAAS,GAAI,EAAE,CAAC,SAAoC,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAND,0CAMC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,iDAAiD,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CACtD,CAAC;IAC3B,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,KAAK,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,YAAY,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AA/BD,oDA+BC;AAED,SAAgB,mBAAmB,CAAC,OAAe,EAAE,WAAmB;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,wDAAwD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AATD,kDASC;AAEM,KAAK,UAAU,uBAAuB,CAAI,SAA2B;IAC1E,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;YACzC,KAAK,EAAE,6BAAqB;YAC5B,OAAO,EAAE;gBACP,OAAO,EAAE,4BAAoB;gBAC7B,UAAU,EAAE,iCAAyB;gBACrC,UAAU,EAAE,iCAAyB;aACtC;YACD,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6CAA6C,iBAAiB,CAAC,WAAW,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAjCD,0DAiCC;AAED,yDAAyD;AAClD,KAAK,UAAU,kBAAkB;IACtC,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,KAA8B,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAmC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAfD,gDAeC;AAED,0EAA0E;AACnE,KAAK,UAAU,mBAAmB,CAAC,QAAiC;IACzE,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,IAAI,MAAM,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GACT,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;IAEzF,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAzCD,kDAyCC"}

package/dist/commands/persist-command/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Persist Command - Shared Types & Constants
+ *
+ * Shared interfaces, type aliases, and module constants used across the
+ * persist-command submodules. Keeping these in one place avoids circular
+ * imports between arg-parsing, receipt, secure-file, and handler modules.
+ */
+export interface PersistCommandArgs {
+    profile?: string;
+    yes?: boolean;
+    listBackups?: boolean;
+    restore?: string | boolean;
+    permissionMode?: PermissionMode;
+    dangerouslySkipPermissions?: boolean;
+    parseError?: string;
+}
+export interface ResolvedEnv {
+    env: Record<string, string>;
+    clearEnvKeys: string[];
+    profileType: string;
+    warnings?: string[];
+    notes?: string[];
+}
+export interface PersistReceipt {
+    clearedKeys: string[];
+    clearedCodexTranslatorUrlKeys: string[];
+    writtenKeys: string[];
+    unchangedWrittenKeys: string[];
+    writtenSettings: string[];
+    unchangedSettings: string[];
+    codexTranslatorUrlPaths: string[];
+}
+export declare const PERSIST_KNOWN_FLAGS: readonly ["--yes", "-y", "--list-backups", "--restore", "--permission-mode", "--dangerously-skip-permissions", "--auto-approve", "--help", "-h"];
+export declare const VALID_PERMISSION_MODES: readonly ["default", "plan", "acceptEdits", "bypassPermissions"];
+export declare const PERSIST_LOCK_STALE_MS = 10000;
+export declare const PERSIST_LOCK_RETRIES = 5;
+export declare const PERSIST_LOCK_RETRY_MIN_MS = 100;
+export declare const PERSIST_LOCK_RETRY_MAX_MS = 500;
+/** Native Codex target invocation hints surfaced in the persist receipt. */
+export declare const NATIVE_CODEX_TARGETS: string[];
+export type PermissionMode = (typeof VALID_PERMISSION_MODES)[number];
+//# sourceMappingURL=types.d.ts.map

package/dist/commands/persist-command/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/persist-command/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6BAA6B,EAAE,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,eAAO,MAAM,mBAAmB,kJAUtB,CAAC;AAEX,eAAO,MAAM,sBAAsB,kEAKzB,CAAC;AAEX,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,UAAwC,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/commands/persist-command/types.js

@@ -0,0 +1,34 @@
+"use strict";
+/**
+ * Persist Command - Shared Types & Constants
+ *
+ * Shared interfaces, type aliases, and module constants used across the
+ * persist-command submodules. Keeping these in one place avoids circular
+ * imports between arg-parsing, receipt, secure-file, and handler modules.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.NATIVE_CODEX_TARGETS = exports.PERSIST_LOCK_RETRY_MAX_MS = exports.PERSIST_LOCK_RETRY_MIN_MS = exports.PERSIST_LOCK_RETRIES = exports.PERSIST_LOCK_STALE_MS = exports.VALID_PERMISSION_MODES = exports.PERSIST_KNOWN_FLAGS = void 0;
+exports.PERSIST_KNOWN_FLAGS = [
+    '--yes',
+    '-y',
+    '--list-backups',
+    '--restore',
+    '--permission-mode',
+    '--dangerously-skip-permissions',
+    '--auto-approve',
+    '--help',
+    '-h',
+];
+exports.VALID_PERMISSION_MODES = [
+    'default',
+    'plan',
+    'acceptEdits',
+    'bypassPermissions',
+];
+exports.PERSIST_LOCK_STALE_MS = 10000;
+exports.PERSIST_LOCK_RETRIES = 5;
+exports.PERSIST_LOCK_RETRY_MIN_MS = 100;
+exports.PERSIST_LOCK_RETRY_MAX_MS = 500;
+/** Native Codex target invocation hints surfaced in the persist receipt. */
+exports.NATIVE_CODEX_TARGETS = ['ccsxp', 'ccs codex --target codex'];
+//# sourceMappingURL=types.js.map

package/dist/commands/persist-command/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/commands/persist-command/types.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AA8BU,QAAA,mBAAmB,GAAG;IACjC,OAAO;IACP,IAAI;IACJ,gBAAgB;IAChB,WAAW;IACX,mBAAmB;IACnB,gCAAgC;IAChC,gBAAgB;IAChB,QAAQ;IACR,IAAI;CACI,CAAC;AAEE,QAAA,sBAAsB,GAAG;IACpC,SAAS;IACT,MAAM;IACN,aAAa;IACb,mBAAmB;CACX,CAAC;AAEE,QAAA,qBAAqB,GAAG,KAAK,CAAC;AAC9B,QAAA,oBAAoB,GAAG,CAAC,CAAC;AACzB,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAChC,QAAA,yBAAyB,GAAG,GAAG,CAAC;AAE7C,4EAA4E;AAC/D,QAAA,oBAAoB,GAAG,CAAC,OAAO,EAAE,0BAA0B,CAAC,CAAC"}

package/dist/commands/persist-command.d.ts

@@ -6,7 +6,12 @@
  *
  * Supports API, CLIProxy, Copilot, account, and default flows
  * through the shared Claude extension setup resolver.
+ *
+ * NOTE: This file is a thin barrel. Implementation lives in focused
+ * submodules under ./persist-command/. Only `handlePersistCommand` is
+ * part of the public surface; everything else is module-private to
+ * the submodule that owns it.
  */
-/** Main persist command handler */
-export declare function handlePersistCommand(args: string[]): Promise<void>;
+export declare const VALID_PERMISSION_MODES: readonly ["default", "plan", "acceptEdits", "bypassPermissions"];
+export { handlePersistCommand } from './persist-command/handler';
 //# sourceMappingURL=persist-command.d.ts.map

package/dist/commands/persist-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"persist-command.d.ts","sourceRoot":"","sources":["../../src/commands/persist-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAm0BH,mCAAmC;AACnC,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkOxE"}
+{"version":3,"file":"persist-command.d.ts","sourceRoot":"","sources":["../../src/commands/persist-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAMH,eAAO,MAAM,sBAAsB,kEAKzB,CAAC;AAEX,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC"}