@kaitranntt/ccs 8.4.0 → 8.5.0-dev.1

package/dist/commands/persist-command/help.js

@@ -0,0 +1,86 @@
+"use strict";
+/**
+ * Persist Command - Help Text
+ *
+ * Owns the `ccs persist --help` output. Pure presentation module; no
+ * filesystem or profile-resolution side effects.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.showHelp = void 0;
+const ui_1 = require("../../utils/ui");
+const secure_file_1 = require("./secure-file");
+/** Show help for persist command */
+async function showHelp() {
+    await (0, ui_1.initUI)();
+    console.log((0, ui_1.header)('CCS Persist Command'));
+    console.log('');
+    console.log((0, ui_1.subheader)('Usage'));
+    console.log(`  ${(0, ui_1.color)('ccs persist', 'command')} <profile> [options]`);
+    console.log(`  ${(0, ui_1.color)('ccs persist', 'command')} --list-backups`);
+    console.log(`  ${(0, ui_1.color)('ccs persist', 'command')} --restore [timestamp]`);
+    console.log('');
+    console.log((0, ui_1.subheader)('Description'));
+    console.log("  Writes a profile's Claude setup directly to");
+    console.log(`  ${(0, secure_file_1.getClaudeSettingsDisplayPath)()} for native Claude Code usage.`);
+    console.log('');
+    console.log('  This is the preferred shared-settings path for Claude Code');
+    console.log('  and the Claude IDE extension when you want one profile everywhere.');
+    console.log('');
+    console.log((0, ui_1.subheader)('Options'));
+    console.log(`  ${(0, ui_1.color)('--yes, -y', 'command')}         Skip confirmation prompts (auto-backup)`);
+    console.log(`  ${(0, ui_1.color)('--permission-mode <mode>', 'command')}  Set default permission mode in settings.json`);
+    console.log(`  ${(0, ui_1.color)('--dangerously-skip-permissions', 'command')}  Persist auto-approve (bypassPermissions)`);
+    console.log(`  ${(0, ui_1.color)('--auto-approve', 'command')}  Alias for --dangerously-skip-permissions`);
+    console.log(`  ${(0, ui_1.color)('--help, -h', 'command')}        Show this help message`);
+    console.log('');
+    console.log((0, ui_1.subheader)('Backup Management'));
+    console.log(`  ${(0, ui_1.color)('--list-backups', 'command')}    List available backup files`);
+    console.log(`  ${(0, ui_1.color)('--restore', 'command')}         Restore from the most recent backup`);
+    console.log(`  ${(0, ui_1.color)('--restore <ts>', 'command')}    Restore from specific backup (e.g., 20260110_205324)`);
+    console.log('');
+    console.log((0, ui_1.subheader)('Supported Profile Types'));
+    console.log(`  ${(0, ui_1.color)('API profiles', 'command')}      glm, km, custom API profiles`);
+    console.log(`  ${(0, ui_1.color)('CLIProxy', 'command')}          gemini, agy, qwen, kiro, ghcp`);
+    console.log(`  ${(0, ui_1.color)('Copilot', 'command')}           copilot (requires copilot-api daemon)`);
+    console.log(`  ${(0, ui_1.color)('Account profiles', 'command')}  work, personal, client (persists CLAUDE_CONFIG_DIR)`);
+    console.log(`  ${(0, ui_1.color)('default', 'command')}           Clears CCS-managed overrides or inherits mapped continuity`);
+    console.log('');
+    console.log((0, ui_1.subheader)('Examples'));
+    console.log(`  ${(0, ui_1.dim)('# Persist GLM profile')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist glm', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Persist with auto-confirmation')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist gemini --yes', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Persist with default permission mode')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist glm --permission-mode acceptEdits', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Persist with auto-approve enabled')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist glm --dangerously-skip-permissions', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Persist an account profile for IDE/native Claude use')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist work --yes', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Reset to native Claude defaults (clear CCS-managed overrides)')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist default --yes', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# List all backups')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist --list-backups', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Restore latest backup')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist --restore', 'command')}`);
+    console.log('');
+    console.log(`  ${(0, ui_1.dim)('# Restore specific backup')}`);
+    console.log(`  ${(0, ui_1.color)('ccs persist --restore 20260110_205324', 'command')}`);
+    console.log('');
+    console.log((0, ui_1.subheader)('Notes'));
+    console.log('  [i] CLIProxy profiles require the proxy to be running.');
+    console.log('  [i] Codex CLIProxy profiles are native Codex-only: use ccsxp or ccs codex --target codex.');
+    console.log('  [i] Copilot profiles require copilot-api daemon.');
+    console.log('  [i] Account/default flows remove stale ANTHROPIC_* overrides before applying new setup.');
+    console.log('  [i] For IDE-local settings.json snippets, use: ccs env <profile> --format claude-extension');
+    console.log(`  [i] Backups are saved as ${(0, secure_file_1.getClaudeSettingsDisplayPath)()}.backup.YYYYMMDD_HHMMSS`);
+    console.log('');
+}
+exports.showHelp = showHelp;
+//# sourceMappingURL=help.js.map

package/dist/commands/persist-command/help.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/commands/persist-command/help.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,uCAAuE;AACvE,+CAA6D;AAE7D,oCAAoC;AAC7B,KAAK,UAAU,QAAQ;IAC5B,MAAM,IAAA,WAAM,GAAE,CAAC;IACf,OAAO,CAAC,GAAG,CAAC,IAAA,WAAM,EAAC,qBAAqB,CAAC,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,OAAO,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,aAAa,EAAE,SAAS,CAAC,sBAAsB,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,aAAa,EAAE,SAAS,CAAC,iBAAiB,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,aAAa,EAAE,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC1E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,aAAa,CAAC,CAAC,CAAC;IACtC,OAAO,CAAC,GAAG,CAAC,+CAA+C,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,0CAA4B,GAAE,gCAAgC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,8DAA8D,CAAC,CAAC;IAC5E,OAAO,CAAC,GAAG,CAAC,sEAAsE,CAAC,CAAC;IACpF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,SAAS,CAAC,CAAC,CAAC;IAClC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,WAAW,EAAE,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAClG,OAAO,CAAC,GAAG,CACT,KAAK,IAAA,UAAK,EAAC,0BAA0B,EAAE,SAAS,CAAC,gDAAgD,CAClG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,IAAA,UAAK,EAAC,gCAAgC,EAAE,SAAS,CAAC,4CAA4C,CACpG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,gBAAgB,EAAE,SAAS,CAAC,4CAA4C,CAAC,CAAC;IACjG,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,YAAY,EAAE,SAAS,CAAC,gCAAgC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,mBAAmB,CAAC,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,gBAAgB,EAAE,SAAS,CAAC,iCAAiC,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,WAAW,EAAE,SAAS,CAAC,8CAA8C,CAAC,CAAC;IAC9F,OAAO,CAAC,GAAG,CACT,KAAK,IAAA,UAAK,EAAC,gBAAgB,EAAE,SAAS,CAAC,0DAA0D,CAClG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,yBAAyB,CAAC,CAAC,CAAC;IAClD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,cAAc,EAAE,SAAS,CAAC,oCAAoC,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,UAAU,EAAE,SAAS,CAAC,yCAAyC,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,SAAS,EAAE,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CACT,KAAK,IAAA,UAAK,EAAC,kBAAkB,EAAE,SAAS,CAAC,uDAAuD,CACjG,CAAC;IACF,OAAO,CAAC,GAAG,CACT,KAAK,IAAA,UAAK,EAAC,SAAS,EAAE,SAAS,CAAC,uEAAuE,CACxG,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,UAAU,CAAC,CAAC,CAAC;IACnC,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,uBAAuB,CAAC,EAAE,CAAC,CAAC;IACjD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,iBAAiB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACxD,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,0BAA0B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACjE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,wCAAwC,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,+CAA+C,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,qCAAqC,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,gDAAgD,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACvF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,wDAAwD,CAAC,EAAE,CAAC,CAAC;IAClF,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,wBAAwB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,iEAAiE,CAAC,EAAE,CAAC,CAAC;IAC3F,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,2BAA2B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,4BAA4B,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACnE,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,yBAAyB,CAAC,EAAE,CAAC,CAAC;IACnD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,uBAAuB,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9D,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,QAAG,EAAC,2BAA2B,CAAC,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,KAAK,IAAA,UAAK,EAAC,uCAAuC,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IAC9E,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,OAAO,CAAC,CAAC,CAAC;IAChC,OAAO,CAAC,GAAG,CAAC,0DAA0D,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CACT,6FAA6F,CAC9F,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,oDAAoD,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CACT,2FAA2F,CAC5F,CAAC;IACF,OAAO,CAAC,GAAG,CACT,8FAA8F,CAC/F,CAAC;IACF,OAAO,CAAC,GAAG,CACT,8BAA8B,IAAA,0CAA4B,GAAE,yBAAyB,CACtF,CAAC;IACF,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAClB,CAAC;AAzFD,4BAyFC"}

package/dist/commands/persist-command/receipt.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Persist Command - Receipt Building & Profile Resolution
+ *
+ * Computes the post-write receipt (cleared/written/unchanged env keys and
+ * settings) and resolves a profile's extension env vars via the shared
+ * Claude extension setup resolver.
+ */
+import { type PersistReceipt, type PermissionMode, type ResolvedEnv } from './types';
+export declare function buildPersistReceipt(existingEnv: Record<string, string>, existingSettings: Record<string, unknown>, mergedSettings: Record<string, unknown>, resolved: ResolvedEnv, resolvedPermissionMode?: PermissionMode): PersistReceipt;
+export declare function printPersistReceipt(receipt: PersistReceipt): void;
+/** Resolve shared Claude settings payload for a profile */
+export declare function resolveProfileEnvVars(profileName: string): Promise<ResolvedEnv>;
+//# sourceMappingURL=receipt.d.ts.map

package/dist/commands/persist-command/receipt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.d.ts","sourceRoot":"","sources":["../../../src/commands/persist-command/receipt.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAUH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,WAAW,EACjB,MAAM,SAAS,CAAC;AAEjB,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EACnC,gBAAgB,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACzC,cAAc,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EACvC,QAAQ,EAAE,WAAW,EACrB,sBAAsB,CAAC,EAAE,cAAc,GACtC,cAAc,CA8ChB;AAMD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,cAAc,GAAG,IAAI,CA8BjE;AAED,2DAA2D;AAC3D,wBAAsB,qBAAqB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,WAAW,CAAC,CAiBrF"}

package/dist/commands/persist-command/receipt.js

@@ -0,0 +1,102 @@
+"use strict";
+/**
+ * Persist Command - Receipt Building & Profile Resolution
+ *
+ * Computes the post-write receipt (cleared/written/unchanged env keys and
+ * settings) and resolves a profile's extension env vars via the shared
+ * Claude extension setup resolver.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.resolveProfileEnvVars = exports.printPersistReceipt = exports.buildPersistReceipt = void 0;
+const claude_extension_setup_1 = require("../../shared/claude-extension-setup");
+const stale_codex_translator_settings_1 = require("../../shared/stale-codex-translator-settings");
+const ui_1 = require("../../utils/ui");
+const secure_file_1 = require("./secure-file");
+const types_1 = require("./types");
+function buildPersistReceipt(existingEnv, existingSettings, mergedSettings, resolved, resolvedPermissionMode) {
+    const mergedEnv = typeof mergedSettings.env === 'object' &&
+        mergedSettings.env !== null &&
+        !Array.isArray(mergedSettings.env)
+        ? mergedSettings.env
+        : {};
+    const clearedKeys = resolved.clearEnvKeys.filter((key) => Object.prototype.hasOwnProperty.call(existingEnv, key) && mergedEnv[key] === undefined);
+    const clearedCodexTranslatorUrlKeys = clearedKeys.filter((key) => (0, stale_codex_translator_settings_1.findCodexTranslatorUrlPaths)(existingEnv[key]).length > 0);
+    const writtenKeys = Object.entries(resolved.env)
+        .filter(([key, value]) => existingEnv[key] !== value)
+        .map(([key]) => key)
+        .sort((left, right) => left.localeCompare(right));
+    const unchangedWrittenKeys = Object.entries(resolved.env)
+        .filter(([key, value]) => existingEnv[key] === value)
+        .map(([key]) => key)
+        .sort((left, right) => left.localeCompare(right));
+    const existingPermissions = typeof existingSettings.permissions === 'object' &&
+        existingSettings.permissions !== null &&
+        !Array.isArray(existingSettings.permissions)
+        ? existingSettings.permissions
+        : {};
+    const writtenSettings = resolvedPermissionMode && existingPermissions.defaultMode !== resolvedPermissionMode
+        ? ['permissions.defaultMode']
+        : [];
+    const unchangedSettings = resolvedPermissionMode && existingPermissions.defaultMode === resolvedPermissionMode
+        ? ['permissions.defaultMode']
+        : [];
+    return {
+        clearedKeys,
+        clearedCodexTranslatorUrlKeys,
+        writtenKeys,
+        unchangedWrittenKeys,
+        writtenSettings,
+        unchangedSettings,
+        codexTranslatorUrlPaths: (0, stale_codex_translator_settings_1.findCodexTranslatorUrlPaths)(mergedSettings),
+    };
+}
+exports.buildPersistReceipt = buildPersistReceipt;
+function formatKeyList(keys) {
+    return keys.length > 0 ? keys.join(', ') : 'none';
+}
+function printPersistReceipt(receipt) {
+    console.log((0, ui_1.subheader)('Config Receipt'));
+    console.log(`  Settings: ${(0, secure_file_1.getClaudeSettingsDisplayPath)()}`);
+    console.log(`  Cleared managed keys: ${formatKeyList(receipt.clearedKeys)}`);
+    console.log(`  Written/rewritten managed keys: ${formatKeyList(receipt.writtenKeys)}`);
+    if (receipt.unchangedWrittenKeys.length > 0) {
+        console.log(`  Already current keys: ${formatKeyList(receipt.unchangedWrittenKeys)}`);
+    }
+    if (receipt.writtenSettings.length > 0 || receipt.unchangedSettings.length > 0) {
+        console.log(`  Written/rewritten managed settings: ${formatKeyList(receipt.writtenSettings)}`);
+        if (receipt.unchangedSettings.length > 0) {
+            console.log(`  Already current settings: ${formatKeyList(receipt.unchangedSettings)}`);
+        }
+    }
+    const hadCodexTranslatorCleanup = receipt.clearedCodexTranslatorUrlKeys.length > 0;
+    if (receipt.codexTranslatorUrlPaths.length > 0) {
+        console.log((0, ui_1.warn)(`  Codex translator URL: still found at ${(0, stale_codex_translator_settings_1.formatSettingsPathList)(receipt.codexTranslatorUrlPaths)} (${stale_codex_translator_settings_1.CODEX_TRANSLATOR_URL_MARKER})`));
+    }
+    else {
+        console.log((0, ui_1.ok)('  Codex translator URL: not found'));
+    }
+    if (hadCodexTranslatorCleanup || receipt.codexTranslatorUrlPaths.length > 0) {
+        console.log(`  Native Codex target: ${types_1.NATIVE_CODEX_TARGETS.join(' or ')}`);
+    }
+}
+exports.printPersistReceipt = printPersistReceipt;
+/** Resolve shared Claude settings payload for a profile */
+async function resolveProfileEnvVars(profileName) {
+    const setup = await (0, claude_extension_setup_1.resolveClaudeExtensionSetup)(profileName);
+    const typeLabel = {
+        settings: 'API',
+        cliproxy: 'CLIProxy',
+        copilot: 'Copilot',
+        account: 'Account',
+        default: 'Default',
+    };
+    return {
+        env: setup.extensionEnv,
+        clearEnvKeys: setup.removeEnvKeys,
+        profileType: typeLabel[setup.profileType] ?? setup.profileType,
+        warnings: setup.warnings,
+        notes: setup.notes,
+    };
+}
+exports.resolveProfileEnvVars = resolveProfileEnvVars;
+//# sourceMappingURL=receipt.js.map

package/dist/commands/persist-command/receipt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"receipt.js","sourceRoot":"","sources":["../../../src/commands/persist-command/receipt.ts"],"names":[],"mappings":";AAAA;;;;;;GAMG;;;AAEH,gFAAkF;AAClF,kGAIsD;AACtD,uCAAqD;AACrD,+CAA6D;AAC7D,mCAKiB;AAEjB,SAAgB,mBAAmB,CACjC,WAAmC,EACnC,gBAAyC,EACzC,cAAuC,EACvC,QAAqB,EACrB,sBAAuC;IAEvC,MAAM,SAAS,GACb,OAAO,cAAc,CAAC,GAAG,KAAK,QAAQ;QACtC,cAAc,CAAC,GAAG,KAAK,IAAI;QAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,cAAc,CAAC,GAAG,CAAC;QAChC,CAAC,CAAE,cAAc,CAAC,GAA8B;QAChD,CAAC,CAAC,EAAE,CAAC;IAET,MAAM,WAAW,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAC9C,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS,CAChG,CAAC;IACF,MAAM,6BAA6B,GAAG,WAAW,CAAC,MAAM,CACtD,CAAC,GAAG,EAAE,EAAE,CAAC,IAAA,6DAA2B,EAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAClE,CAAC;IACF,MAAM,WAAW,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;SAC7C,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,oBAAoB,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;SACtD,MAAM,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC;SACpD,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC;SACnB,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;IACpD,MAAM,mBAAmB,GACvB,OAAO,gBAAgB,CAAC,WAAW,KAAK,QAAQ;QAChD,gBAAgB,CAAC,WAAW,KAAK,IAAI;QACrC,CAAC,KAAK,CAAC,OAAO,CAAC,gBAAgB,CAAC,WAAW,CAAC;QAC1C,CAAC,CAAE,gBAAgB,CAAC,WAAuC;QAC3D,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,eAAe,GACnB,sBAAsB,IAAI,mBAAmB,CAAC,WAAW,KAAK,sBAAsB;QAClF,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,iBAAiB,GACrB,sBAAsB,IAAI,mBAAmB,CAAC,WAAW,KAAK,sBAAsB;QAClF,CAAC,CAAC,CAAC,yBAAyB,CAAC;QAC7B,CAAC,CAAC,EAAE,CAAC;IAET,OAAO;QACL,WAAW;QACX,6BAA6B;QAC7B,WAAW;QACX,oBAAoB;QACpB,eAAe;QACf,iBAAiB;QACjB,uBAAuB,EAAE,IAAA,6DAA2B,EAAC,cAAc,CAAC;KACrE,CAAC;AACJ,CAAC;AApDD,kDAoDC;AAED,SAAS,aAAa,CAAC,IAAc;IACnC,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AACpD,CAAC;AAED,SAAgB,mBAAmB,CAAC,OAAuB;IACzD,OAAO,CAAC,GAAG,CAAC,IAAA,cAAS,EAAC,gBAAgB,CAAC,CAAC,CAAC;IACzC,OAAO,CAAC,GAAG,CAAC,eAAe,IAAA,0CAA4B,GAAE,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,2BAA2B,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IAC7E,OAAO,CAAC,GAAG,CAAC,qCAAqC,aAAa,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5C,OAAO,CAAC,GAAG,CAAC,2BAA2B,aAAa,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,CAAC,CAAC;IACxF,CAAC;IACD,IAAI,OAAO,CAAC,eAAe,CAAC,MAAM,GAAG,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,yCAAyC,aAAa,CAAC,OAAO,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;QAC/F,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,GAAG,CAAC,+BAA+B,aAAa,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;IACH,CAAC;IAED,MAAM,yBAAyB,GAAG,OAAO,CAAC,6BAA6B,CAAC,MAAM,GAAG,CAAC,CAAC;IACnF,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,IAAA,SAAI,EACF,0CAA0C,IAAA,wDAAsB,EAC9D,OAAO,CAAC,uBAAuB,CAChC,KAAK,6DAA2B,GAAG,CACrC,CACF,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,IAAA,OAAE,EAAC,mCAAmC,CAAC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,yBAAyB,IAAI,OAAO,CAAC,uBAAuB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5E,OAAO,CAAC,GAAG,CAAC,0BAA0B,4BAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC7E,CAAC;AACH,CAAC;AA9BD,kDA8BC;AAED,2DAA2D;AACpD,KAAK,UAAU,qBAAqB,CAAC,WAAmB;IAC7D,MAAM,KAAK,GAAG,MAAM,IAAA,oDAA2B,EAAC,WAAW,CAAC,CAAC;IAC7D,MAAM,SAAS,GAA2B;QACxC,QAAQ,EAAE,KAAK;QACf,QAAQ,EAAE,UAAU;QACpB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,SAAS;KACnB,CAAC;IAEF,OAAO;QACL,GAAG,EAAE,KAAK,CAAC,YAAY;QACvB,YAAY,EAAE,KAAK,CAAC,aAAa;QACjC,WAAW,EAAE,SAAS,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,KAAK,CAAC,WAAW;QAC9D,QAAQ,EAAE,KAAK,CAAC,QAAQ;QACxB,KAAK,EAAE,KAAK,CAAC,KAAK;KACnB,CAAC;AACJ,CAAC;AAjBD,sDAiBC"}

package/dist/commands/persist-command/secret-detection.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Persist Command - Secret Detection & Masking
+ *
+ * Identifies sensitive env var names (TOKEN/KEY/SECRET/etc.) so the persist
+ * preview can mask their values before printing to the terminal.
+ */
+/** Mask API key for display (show first 4 and last 4 chars) */
+export declare function maskApiKey(key: string): string;
+export declare function splitSensitiveKeyParts(key: string): string[];
+export declare function isSensitiveEnvKey(key: string): boolean;
+//# sourceMappingURL=secret-detection.d.ts.map

package/dist/commands/persist-command/secret-detection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection.d.ts","sourceRoot":"","sources":["../../../src/commands/persist-command/secret-detection.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,+DAA+D;AAC/D,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAK9C;AAgBD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAM5D;AAED,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAgBtD"}

package/dist/commands/persist-command/secret-detection.js

@@ -0,0 +1,54 @@
+"use strict";
+/**
+ * Persist Command - Secret Detection & Masking
+ *
+ * Identifies sensitive env var names (TOKEN/KEY/SECRET/etc.) so the persist
+ * preview can mask their values before printing to the terminal.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.isSensitiveEnvKey = exports.splitSensitiveKeyParts = exports.maskApiKey = void 0;
+/** Mask API key for display (show first 4 and last 4 chars) */
+function maskApiKey(key) {
+    if (key.length <= 12) {
+        return '****';
+    }
+    return `${key.slice(0, 4)}...${key.slice(-4)}`;
+}
+exports.maskApiKey = maskApiKey;
+const SENSITIVE_ENV_PARTS = new Set([
+    'TOKEN',
+    'KEY',
+    'SECRET',
+    'PASSWORD',
+    'PASS',
+    'AUTH',
+    'CREDENTIAL',
+    'PRIVATE',
+    'ACCESS',
+    'REFRESH',
+    'APIKEY',
+]);
+function splitSensitiveKeyParts(key) {
+    const withCamelCaseBoundaries = key.replace(/([a-z0-9])([A-Z])/g, '$1_$2');
+    return withCamelCaseBoundaries
+        .toUpperCase()
+        .split(/[^A-Z0-9]+/)
+        .filter(Boolean);
+}
+exports.splitSensitiveKeyParts = splitSensitiveKeyParts;
+function isSensitiveEnvKey(key) {
+    const parts = splitSensitiveKeyParts(key);
+    if (parts.some((part) => SENSITIVE_ENV_PARTS.has(part))) {
+        return true;
+    }
+    const compact = parts.join('');
+    return (compact.includes('TOKEN') ||
+        compact.includes('APIKEY') ||
+        compact.includes('ACCESSKEY') ||
+        compact.includes('AUTHKEY') ||
+        compact.includes('SECRET') ||
+        compact.includes('PASSWORD') ||
+        compact.includes('CREDENTIAL'));
+}
+exports.isSensitiveEnvKey = isSensitiveEnvKey;
+//# sourceMappingURL=secret-detection.js.map

package/dist/commands/persist-command/secret-detection.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-detection.js","sourceRoot":"","sources":["../../../src/commands/persist-command/secret-detection.ts"],"names":[],"mappings":";AAAA;;;;;GAKG;;;AAEH,+DAA+D;AAC/D,SAAgB,UAAU,CAAC,GAAW;IACpC,IAAI,GAAG,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;QACrB,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACjD,CAAC;AALD,gCAKC;AAED,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,OAAO;IACP,KAAK;IACL,QAAQ;IACR,UAAU;IACV,MAAM;IACN,MAAM;IACN,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAEH,SAAgB,sBAAsB,CAAC,GAAW;IAChD,MAAM,uBAAuB,GAAG,GAAG,CAAC,OAAO,CAAC,oBAAoB,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,uBAAuB;SAC3B,WAAW,EAAE;SACb,KAAK,CAAC,YAAY,CAAC;SACnB,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAND,wDAMC;AAED,SAAgB,iBAAiB,CAAC,GAAW;IAC3C,MAAM,KAAK,GAAG,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC1C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACxD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/B,OAAO,CACL,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC;QACzB,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QAC7B,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC;QAC3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAC1B,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC;QAC5B,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAC,CAC/B,CAAC;AACJ,CAAC;AAhBD,8CAgBC"}

package/dist/commands/persist-command/secure-file.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Persist Command - Secure File I/O & Locking
+ *
+ * Hardened filesystem helpers for reading/writing ~/.claude/settings.json.
+ * Refuses to follow symlinks (TOCTOU mitigations), uses O_NOFOLLOW where
+ * available, writes via atomic temp-file + rename, and serializes concurrent
+ * persist operations via a proper-lockfile on the settings directory.
+ */
+export declare function formatDisplayPath(filePath: string): string;
+export declare function getClaudeSettingsDisplayPath(): string;
+export declare function pathExists(filePath: string): Promise<boolean>;
+export declare function isSymlinkAsync(filePath: string): Promise<boolean>;
+export declare function getNoFollowFlag(): number;
+export declare function readFileUtf8NoFollow(filePath: string): Promise<string>;
+export declare function parseSettingsObject(content: string, sourceLabel: string): Record<string, unknown>;
+export declare function withPersistSettingsLock<T>(operation: () => Promise<T>): Promise<T>;
+/** Read existing Claude settings.json with validation */
+export declare function readClaudeSettings(): Promise<Record<string, unknown>>;
+/** Write settings back to settings.json with atomic replace semantics. */
+export declare function writeClaudeSettings(settings: Record<string, unknown>): Promise<void>;
+//# sourceMappingURL=secure-file.d.ts.map

package/dist/commands/persist-command/secure-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-file.d.ts","sourceRoot":"","sources":["../../../src/commands/persist-command/secure-file.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAcH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAmB1D;AAED,wBAAgB,4BAA4B,IAAI,MAAM,CAErD;AAED,wBAAsB,UAAU,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOnE;AAED,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAOvE;AAED,wBAAgB,eAAe,IAAI,MAAM,CAMxC;AAUD,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA+B5E;AAED,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CASjG;AAED,wBAAsB,uBAAuB,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAiCxF;AAED,yDAAyD;AACzD,wBAAsB,kBAAkB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAe3E;AAED,0EAA0E;AAC1E,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAyC1F"}

package/dist/commands/persist-command/secure-file.js

@@ -0,0 +1,231 @@
+"use strict";
+/**
+ * Persist Command - Secure File I/O & Locking
+ *
+ * Hardened filesystem helpers for reading/writing ~/.claude/settings.json.
+ * Refuses to follow symlinks (TOCTOU mitigations), uses O_NOFOLLOW where
+ * available, writes via atomic temp-file + rename, and serializes concurrent
+ * persist operations via a proper-lockfile on the settings directory.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || function (mod) {
+    if (mod && mod.__esModule) return mod;
+    var result = {};
+    if (mod != null) for (var k in mod) if (k !== "default" && Object.prototype.hasOwnProperty.call(mod, k)) __createBinding(result, mod, k);
+    __setModuleDefault(result, mod);
+    return result;
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.writeClaudeSettings = exports.readClaudeSettings = exports.withPersistSettingsLock = exports.parseSettingsObject = exports.readFileUtf8NoFollow = exports.getNoFollowFlag = exports.isSymlinkAsync = exports.pathExists = exports.getClaudeSettingsDisplayPath = exports.formatDisplayPath = void 0;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const os = __importStar(require("os"));
+const lockfile = __importStar(require("proper-lockfile"));
+const claude_config_path_1 = require("../../utils/claude-config-path");
+const types_1 = require("./types");
+function formatDisplayPath(filePath) {
+    const defaultClaudeDir = path.join(os.homedir(), '.claude');
+    const claudeDir = (0, claude_config_path_1.getClaudeConfigDir)();
+    // Keep real path when user overrides Claude directory.
+    if (path.resolve(claudeDir) !== path.resolve(defaultClaudeDir)) {
+        return filePath;
+    }
+    if (filePath === claudeDir) {
+        return '~/.claude';
+    }
+    const claudePrefix = `${claudeDir}${path.sep}`;
+    if (filePath.startsWith(claudePrefix)) {
+        return filePath.replace(claudePrefix, '~/.claude/');
+    }
+    return filePath;
+}
+exports.formatDisplayPath = formatDisplayPath;
+function getClaudeSettingsDisplayPath() {
+    return formatDisplayPath((0, claude_config_path_1.getClaudeSettingsPath)());
+}
+exports.getClaudeSettingsDisplayPath = getClaudeSettingsDisplayPath;
+async function pathExists(filePath) {
+    try {
+        await fs.promises.access(filePath, fs.constants.F_OK);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+exports.pathExists = pathExists;
+async function isSymlinkAsync(filePath) {
+    try {
+        const stats = await fs.promises.lstat(filePath);
+        return stats.isSymbolicLink();
+    }
+    catch {
+        return false;
+    }
+}
+exports.isSymlinkAsync = isSymlinkAsync;
+function getNoFollowFlag() {
+    const candidate = fs.constants['O_NOFOLLOW'];
+    if (process.platform !== 'win32' && typeof candidate === 'number') {
+        return candidate;
+    }
+    return 0;
+}
+exports.getNoFollowFlag = getNoFollowFlag;
+function createSymlinkReadError(filePath) {
+    const error = new Error(`Refusing to read symlinked file for security: ${formatDisplayPath(filePath)}`);
+    error.code = 'ELOOP';
+    return error;
+}
+async function readFileUtf8NoFollow(filePath) {
+    if (await isSymlinkAsync(filePath)) {
+        throw createSymlinkReadError(filePath);
+    }
+    const noFollowFlag = getNoFollowFlag();
+    const flags = fs.constants.O_RDONLY | noFollowFlag;
+    const handle = await fs.promises.open(filePath, flags);
+    try {
+        // Best-effort fallback for platforms without O_NOFOLLOW (notably Windows).
+        // Re-check symlink status after open to reduce check-then-use windows.
+        if (noFollowFlag === 0 && (await isSymlinkAsync(filePath))) {
+            throw createSymlinkReadError(filePath);
+        }
+        const stats = await handle.stat();
+        if (!stats.isFile()) {
+            throw new Error('Path is not a regular file');
+        }
+        if (noFollowFlag === 0) {
+            const latestStats = await fs.promises.stat(filePath);
+            if (latestStats.dev !== stats.dev || latestStats.ino !== stats.ino) {
+                throw new Error('Path changed during secure read');
+            }
+        }
+        return await handle.readFile({ encoding: 'utf8' });
+    }
+    finally {
+        await handle.close();
+    }
+}
+exports.readFileUtf8NoFollow = readFileUtf8NoFollow;
+function parseSettingsObject(content, sourceLabel) {
+    if (!content.trim()) {
+        return {};
+    }
+    const parsed = JSON.parse(content);
+    if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+        throw new Error(`${sourceLabel} must contain a JSON object, not an array or primitive`);
+    }
+    return parsed;
+}
+exports.parseSettingsObject = parseSettingsObject;
+async function withPersistSettingsLock(operation) {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    const settingsDir = path.dirname(settingsPath);
+    await fs.promises.mkdir(settingsDir, { recursive: true });
+    let release;
+    try {
+        release = await lockfile.lock(settingsDir, {
+            stale: types_1.PERSIST_LOCK_STALE_MS,
+            retries: {
+                retries: types_1.PERSIST_LOCK_RETRIES,
+                minTimeout: types_1.PERSIST_LOCK_RETRY_MIN_MS,
+                maxTimeout: types_1.PERSIST_LOCK_RETRY_MAX_MS,
+            },
+            realpath: false,
+        });
+    }
+    catch (error) {
+        throw new Error(`Failed to lock Claude settings directory (${formatDisplayPath(settingsDir)}): ${error.message}`);
+    }
+    try {
+        return await operation();
+    }
+    finally {
+        if (release) {
+            try {
+                await release();
+            }
+            catch {
+                // Best-effort release.
+            }
+        }
+    }
+}
+exports.withPersistSettingsLock = withPersistSettingsLock;
+/** Read existing Claude settings.json with validation */
+async function readClaudeSettings() {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    try {
+        const content = await readFileUtf8NoFollow(settingsPath);
+        return parseSettingsObject(content, 'settings.json');
+    }
+    catch (error) {
+        const nodeError = error;
+        if (nodeError.code === 'ENOENT') {
+            return {};
+        }
+        if (nodeError.code === 'ELOOP') {
+            throw new Error('settings.json is a symlink - refusing to read for security');
+        }
+        throw new Error(`Failed to parse settings.json: ${error.message}`);
+    }
+}
+exports.readClaudeSettings = readClaudeSettings;
+/** Write settings back to settings.json with atomic replace semantics. */
+async function writeClaudeSettings(settings) {
+    const settingsPath = (0, claude_config_path_1.getClaudeSettingsPath)();
+    if (await isSymlinkAsync(settingsPath)) {
+        throw new Error('settings.json is a symlink - refusing to write for security');
+    }
+    const settingsDir = path.dirname(settingsPath);
+    await fs.promises.mkdir(settingsDir, { recursive: true });
+    const nonce = `${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 10)}`;
+    const tmpPath = path.join(settingsDir, `settings.json.tmp-${nonce}`);
+    const flags = fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL | getNoFollowFlag();
+    let handle;
+    try {
+        handle = await fs.promises.open(tmpPath, flags, 0o600);
+        await handle.writeFile(JSON.stringify(settings, null, 2) + '\n', { encoding: 'utf8' });
+        await handle.sync();
+    }
+    finally {
+        if (handle) {
+            await handle.close();
+        }
+    }
+    try {
+        await fs.promises.rename(tmpPath, settingsPath);
+    }
+    catch (error) {
+        try {
+            await fs.promises.unlink(tmpPath);
+        }
+        catch {
+            // Best-effort cleanup.
+        }
+        throw error;
+    }
+    try {
+        await fs.promises.chmod(settingsPath, 0o600);
+    }
+    catch {
+        // Best-effort permission hardening.
+    }
+}
+exports.writeClaudeSettings = writeClaudeSettings;
+//# sourceMappingURL=secure-file.js.map

package/dist/commands/persist-command/secure-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-file.js","sourceRoot":"","sources":["../../../src/commands/persist-command/secure-file.ts"],"names":[],"mappings":";AAAA;;;;;;;GAOG;;;;;;;;;;;;;;;;;;;;;;;;;;AAEH,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,0DAA4C;AAC5C,uEAA2F;AAC3F,mCAKiB;AAEjB,SAAgB,iBAAiB,CAAC,QAAgB;IAChD,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC5D,MAAM,SAAS,GAAG,IAAA,uCAAkB,GAAE,CAAC;IAEvC,uDAAuD;IACvD,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,KAAK,IAAI,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC/D,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC/C,IAAI,QAAQ,CAAC,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QACtC,OAAO,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,YAAY,CAAC,CAAC;IACtD,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAnBD,8CAmBC;AAED,SAAgB,4BAA4B;IAC1C,OAAO,iBAAiB,CAAC,IAAA,0CAAqB,GAAE,CAAC,CAAC;AACpD,CAAC;AAFD,oEAEC;AAEM,KAAK,UAAU,UAAU,CAAC,QAAgB;IAC/C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QACtD,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAPD,gCAOC;AAEM,KAAK,UAAU,cAAc,CAAC,QAAgB;IACnD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChD,OAAO,KAAK,CAAC,cAAc,EAAE,CAAC;IAChC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAPD,wCAOC;AAED,SAAgB,eAAe;IAC7B,MAAM,SAAS,GAAI,EAAE,CAAC,SAAoC,CAAC,YAAY,CAAC,CAAC;IACzE,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClE,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAND,0CAMC;AAED,SAAS,sBAAsB,CAAC,QAAgB;IAC9C,MAAM,KAAK,GAAG,IAAI,KAAK,CACrB,iDAAiD,iBAAiB,CAAC,QAAQ,CAAC,EAAE,CACtD,CAAC;IAC3B,KAAK,CAAC,IAAI,GAAG,OAAO,CAAC;IACrB,OAAO,KAAK,CAAC;AACf,CAAC;AAEM,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IACzD,IAAI,MAAM,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QACnC,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,MAAM,YAAY,GAAG,eAAe,EAAE,CAAC;IACvC,MAAM,KAAK,GAAG,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,YAAY,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACvD,IAAI,CAAC;QACH,2EAA2E;QAC3E,uEAAuE;QACvE,IAAI,YAAY,KAAK,CAAC,IAAI,CAAC,MAAM,cAAc,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;YAC3D,MAAM,sBAAsB,CAAC,QAAQ,CAAC,CAAC;QACzC,CAAC;QAED,MAAM,KAAK,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;QAChD,CAAC;QAED,IAAI,YAAY,KAAK,CAAC,EAAE,CAAC;YACvB,MAAM,WAAW,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;YACrD,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,IAAI,WAAW,CAAC,GAAG,KAAK,KAAK,CAAC,GAAG,EAAE,CAAC;gBACnE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;YACrD,CAAC;QACH,CAAC;QAED,OAAO,MAAM,MAAM,CAAC,QAAQ,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IACrD,CAAC;YAAS,CAAC;QACT,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AA/BD,oDA+BC;AAED,SAAgB,mBAAmB,CAAC,OAAe,EAAE,WAAmB;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,KAAK,CAAC,GAAG,WAAW,wDAAwD,CAAC,CAAC;IAC1F,CAAC;IACD,OAAO,MAAiC,CAAC;AAC3C,CAAC;AATD,kDASC;AAEM,KAAK,UAAU,uBAAuB,CAAI,SAA2B;IAC1E,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,IAAI,OAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,WAAW,EAAE;YACzC,KAAK,EAAE,6BAAqB;YAC5B,OAAO,EAAE;gBACP,OAAO,EAAE,4BAAoB;gBAC7B,UAAU,EAAE,iCAAyB;gBACrC,UAAU,EAAE,iCAAyB;aACtC;YACD,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CACb,6CAA6C,iBAAiB,CAAC,WAAW,CAAC,MAAO,KAAe,CAAC,OAAO,EAAE,CAC5G,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,OAAO,MAAM,SAAS,EAAE,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,IAAI,OAAO,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,MAAM,OAAO,EAAE,CAAC;YAClB,CAAC;YAAC,MAAM,CAAC;gBACP,uBAAuB;YACzB,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC;AAjCD,0DAiCC;AAED,yDAAyD;AAClD,KAAK,UAAU,kBAAkB;IACtC,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACzD,OAAO,mBAAmB,CAAC,OAAO,EAAE,eAAe,CAAC,CAAC;IACvD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,SAAS,GAAG,KAA8B,CAAC;QACjD,IAAI,SAAS,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAChC,OAAO,EAAE,CAAC;QACZ,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CAAC,4DAA4D,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,kCAAmC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAfD,gDAeC;AAED,0EAA0E;AACnE,KAAK,UAAU,mBAAmB,CAAC,QAAiC;IACzE,MAAM,YAAY,GAAG,IAAA,0CAAqB,GAAE,CAAC;IAC7C,IAAI,MAAM,cAAc,CAAC,YAAY,CAAC,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1D,MAAM,KAAK,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;IACxF,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,KAAK,EAAE,CAAC,CAAC;IACrE,MAAM,KAAK,GACT,EAAE,CAAC,SAAS,CAAC,QAAQ,GAAG,EAAE,CAAC,SAAS,CAAC,OAAO,GAAG,EAAE,CAAC,SAAS,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;IAEzF,IAAI,MAA0C,CAAC;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACvF,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACtB,CAAC;YAAS,CAAC;QACT,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACvB,CAAC;IACH,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpC,CAAC;QAAC,MAAM,CAAC;YACP,uBAAuB;QACzB,CAAC;QACD,MAAM,KAAK,CAAC;IACd,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,oCAAoC;IACtC,CAAC;AACH,CAAC;AAzCD,kDAyCC"}

package/dist/commands/persist-command/types.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Persist Command - Shared Types & Constants
+ *
+ * Shared interfaces, type aliases, and module constants used across the
+ * persist-command submodules. Keeping these in one place avoids circular
+ * imports between arg-parsing, receipt, secure-file, and handler modules.
+ */
+export interface PersistCommandArgs {
+    profile?: string;
+    yes?: boolean;
+    listBackups?: boolean;
+    restore?: string | boolean;
+    permissionMode?: PermissionMode;
+    dangerouslySkipPermissions?: boolean;
+    parseError?: string;
+}
+export interface ResolvedEnv {
+    env: Record<string, string>;
+    clearEnvKeys: string[];
+    profileType: string;
+    warnings?: string[];
+    notes?: string[];
+}
+export interface PersistReceipt {
+    clearedKeys: string[];
+    clearedCodexTranslatorUrlKeys: string[];
+    writtenKeys: string[];
+    unchangedWrittenKeys: string[];
+    writtenSettings: string[];
+    unchangedSettings: string[];
+    codexTranslatorUrlPaths: string[];
+}
+export declare const PERSIST_KNOWN_FLAGS: readonly ["--yes", "-y", "--list-backups", "--restore", "--permission-mode", "--dangerously-skip-permissions", "--auto-approve", "--help", "-h"];
+export declare const VALID_PERMISSION_MODES: readonly ["default", "plan", "acceptEdits", "bypassPermissions"];
+export declare const PERSIST_LOCK_STALE_MS = 10000;
+export declare const PERSIST_LOCK_RETRIES = 5;
+export declare const PERSIST_LOCK_RETRY_MIN_MS = 100;
+export declare const PERSIST_LOCK_RETRY_MAX_MS = 500;
+/** Native Codex target invocation hints surfaced in the persist receipt. */
+export declare const NATIVE_CODEX_TARGETS: string[];
+export type PermissionMode = (typeof VALID_PERMISSION_MODES)[number];
+//# sourceMappingURL=types.d.ts.map

package/dist/commands/persist-command/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/commands/persist-command/types.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC;IAC3B,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0BAA0B,CAAC,EAAE,OAAO,CAAC;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,WAAW;IAC1B,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,EAAE,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,6BAA6B,EAAE,MAAM,EAAE,CAAC;IACxC,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,oBAAoB,EAAE,MAAM,EAAE,CAAC;IAC/B,eAAe,EAAE,MAAM,EAAE,CAAC;IAC1B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,uBAAuB,EAAE,MAAM,EAAE,CAAC;CACnC;AAED,eAAO,MAAM,mBAAmB,kJAUtB,CAAC;AAEX,eAAO,MAAM,sBAAsB,kEAKzB,CAAC;AAEX,eAAO,MAAM,qBAAqB,QAAQ,CAAC;AAC3C,eAAO,MAAM,oBAAoB,IAAI,CAAC;AACtC,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAC7C,eAAO,MAAM,yBAAyB,MAAM,CAAC;AAE7C,4EAA4E;AAC5E,eAAO,MAAM,oBAAoB,UAAwC,CAAC;AAE1E,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,sBAAsB,CAAC,CAAC,MAAM,CAAC,CAAC"}