@knowzai/cli 0.1.0 → 0.2.0

package/dist/lib/attach.js

@@ -0,0 +1,91 @@
+import { closeSync } from 'node:fs';
+import { basename } from 'node:path';
+import { logger, exitCodeForError, ExitCode } from '@knowzai/core';
+import { openSafeFile, assertSafeFiles, MAX_SAFE_UPLOAD_BYTES } from './safe-file.js';
+/**
+ * Fail before any network call when a path is unreadable, and name every offender.
+ *
+ * H7 — this now delegates to the shared safe-file gate, so an attachment is held
+ * to the same denied-path/symlink/size policy as `knowledge create --file`,
+ * `ingest add`, and `index scan`. The size ceiling is the streaming one: the
+ * uploader never holds a whole attachment in memory.
+ */
+export function assertReadableFiles(paths) {
+    assertSafeFiles(paths, { operation: 'attach', maxBytes: MAX_SAFE_UPLOAD_BYTES });
+}
+function renderProgress(label, p) {
+    const pct = p.totalBytes ? Math.round((p.bytesSent / p.totalBytes) * 100) : 100;
+    process.stderr.write(`\r${label} ${pct}% (chunk ${p.chunkIndex + 1}/${p.totalChunks})`);
+}
+function clearProgress() {
+    process.stderr.write('\r\u001b[K'); // erase the redraw line
+}
+/**
+ * Upload each file and link it to `knowledgeId`. Every file is independent: one
+ * failure does not stop the run, and a file whose bytes landed but whose link
+ * failed reports its fileRecordId so the upload is recoverable (R9).
+ *
+ * H7 (TOCTOU) — the batch pre-flight above runs once, before the first byte
+ * moves; a ten-file run can spend minutes between that check and the last
+ * upload. So each file is re-judged with `O_NOFOLLOW` + `fstat` immediately
+ * before it is uploaded, and — this is the part that closes the race rather
+ * than merely narrowing it — the APPROVED DESCRIPTOR is what gets handed to the
+ * uploader. Re-checking the path and then passing the path still left a window:
+ * `initialize` round-trips to the server before the first byte is read, and a
+ * path swapped for a symlink to a credential file during that round trip would
+ * have been re-opened and uploaded. Nothing downstream re-resolves the path now,
+ * so the file that was judged is the file whose bytes are sent.
+ */
+export async function uploadAndAttach(client, knowledgeId, paths, opts = {}) {
+    const showProgress = opts.progress ?? Boolean(process.stderr.isTTY);
+    const results = [];
+    for (const [index, path] of paths.entries()) {
+        const label = `[${index + 1}/${paths.length}] ${basename(path)}`;
+        let fileRecordId;
+        try {
+            const approved = openSafeFile(path, { operation: 'attach', maxBytes: MAX_SAFE_UPLOAD_BYTES });
+            let uploadedId;
+            try {
+                uploadedId = (await client.files.upload({
+                    path,
+                    // The judged descriptor, not the path — see the note above.
+                    fd: approved.fd,
+                    contentType: opts.contentType,
+                    // R3 — keeps the parent's AwaitingAttachments window open across the run.
+                    parentKnowledgeId: knowledgeId,
+                    onProgress: showProgress ? (p) => renderProgress(label, p) : undefined,
+                })).fileRecordId;
+            }
+            finally {
+                // We opened it, so we close it — the uploader only borrows.
+                closeSync(approved.fd);
+            }
+            fileRecordId = uploadedId;
+            await client.knowledge.attachFile(knowledgeId, fileRecordId);
+            if (showProgress)
+                clearProgress();
+            logger.info(`${label} attached (${fileRecordId})`);
+            results.push({ file: path, ok: true, fileRecordId });
+        }
+        catch (e) {
+            if (showProgress)
+                clearProgress();
+            const message = e instanceof Error ? e.message : String(e);
+            logger.error(fileRecordId
+                ? `${label} uploaded as ${fileRecordId} but could not be attached: ${message}`
+                : `${label} failed: ${message}`);
+            results.push({ file: path, ok: false, fileRecordId, error: message, exitCode: exitCodeForError(e) });
+        }
+    }
+    return results;
+}
+/**
+ * Exit non-zero when any file failed, without discarding the payload that names
+ * the recoverable fileRecordIds — `--json` still emits exactly one document (R9/R10).
+ */
+export function applyAttachExitCode(results) {
+    const failed = results.find((r) => !r.ok);
+    if (failed)
+        process.exitCode = failed.exitCode ?? ExitCode.Api;
+}
+//# sourceMappingURL=attach.js.map

package/dist/lib/attach.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"attach.js","sourceRoot":"","sources":["../../src/lib/attach.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAE,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAsB,MAAM,eAAe,CAAC;AAEvF,OAAO,EAAE,YAAY,EAAE,eAAe,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AAkBtF;;;;;;;GAOG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAe;IACjD,eAAe,CAAC,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,cAAc,CAAC,KAAa,EAAE,CAAiB;IACtD,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,UAAU,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;IAChF,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,GAAG,YAAY,CAAC,CAAC,UAAU,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,CAAC;AAC1F,CAAC;AAED,SAAS,aAAa;IACpB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,wBAAwB;AAC9D,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,MAAsB,EACtB,WAAmB,EACnB,KAAe,EACf,OAAsB,EAAE;IAExB,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACpE,MAAM,OAAO,GAAmB,EAAE,CAAC;IAEnC,KAAK,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QACjE,IAAI,YAAgC,CAAC;QACrC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,qBAAqB,EAAE,CAAC,CAAC;YAC9F,IAAI,UAAkB,CAAC;YACvB,IAAI,CAAC;gBACH,UAAU,GAAG,CAAC,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;oBACtC,IAAI;oBACJ,4DAA4D;oBAC5D,EAAE,EAAE,QAAQ,CAAC,EAAE;oBACf,WAAW,EAAE,IAAI,CAAC,WAAW;oBAC7B,0EAA0E;oBAC1E,iBAAiB,EAAE,WAAW;oBAC9B,UAAU,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS;iBACvE,CAAC,CAAC,CAAC,YAAY,CAAC;YACnB,CAAC;oBAAS,CAAC;gBACT,4DAA4D;gBAC5D,SAAS,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YACzB,CAAC;YACD,YAAY,GAAG,UAAU,CAAC;YAC1B,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC,WAAW,EAAE,YAAY,CAAC,CAAC;YAC7D,IAAI,YAAY;gBAAE,aAAa,EAAE,CAAC;YAClC,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,cAAc,YAAY,GAAG,CAAC,CAAC;YACnD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC,CAAC;QACvD,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,YAAY;gBAAE,aAAa,EAAE,CAAC;YAClC,MAAM,OAAO,GAAG,CAAC,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;YAC3D,MAAM,CAAC,KAAK,CACV,YAAY;gBACV,CAAC,CAAC,GAAG,KAAK,gBAAgB,YAAY,+BAA+B,OAAO,EAAE;gBAC9E,CAAC,CAAC,GAAG,KAAK,YAAY,OAAO,EAAE,CAClC,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvG,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,mBAAmB,CAAC,OAAuB;IACzD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,IAAI,QAAQ,CAAC,GAAG,CAAC;AACjE,CAAC"}

package/dist/lib/chat-render.d.ts

@@ -0,0 +1,39 @@
+export interface ChatSource {
+    knowledgeId?: string;
+    title: string;
+    relevance: number;
+}
+/**
+ * Collapse repeats of the same knowledge item.
+ *
+ * The server emits one `sources` entry per retrieved CHUNK, so a single item can
+ * appear many times over — a real answer has been observed listing the same GUID
+ * five times. Keyed on `knowledgeId`, falling back to the title when an entry
+ * carries no id. First-seen order is preserved (that is retrieval order, which is
+ * meaningful); only the relevance is upgraded when a later duplicate scores higher.
+ */
+export declare function dedupeSources(sources: ChatSource[]): ChatSource[];
+/**
+ * Render the source list: deduped, capped, and silent when there is nothing to
+ * show. Returns lines rather than printing so it stays testable and so callers
+ * decide the stream.
+ */
+export declare function formatSourceLines(sources: ChatSource[], opts: {
+    limit: number;
+    showIds?: boolean;
+}): string[];
+export interface StatusLine {
+    update(message: string): void;
+    clear(): void;
+}
+/**
+ * A single self-overwriting progress line on stderr.
+ *
+ * The pipeline emits several near-duplicate status messages per turn ("Searching
+ * knowledge base…" then "Searching…"). Printing one line each leaves a stack of
+ * stale progress above the answer, so this redraws in place and erases itself
+ * before the answer is written. Off entirely when stderr is not a TTY — the same
+ * rule the upload progress follows, so redirected output stays clean.
+ */
+export declare function createStatusLine(stream: NodeJS.WriteStream): StatusLine;
+//# sourceMappingURL=chat-render.d.ts.map

package/dist/lib/chat-render.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-render.d.ts","sourceRoot":"","sources":["../../src/lib/chat-render.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,UAAU;IACzB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,EAAE,MAAM,CAAC;CACnB;AAKD;;;;;;;;GAQG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,UAAU,EAAE,GAAG,UAAU,EAAE,CASjE;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,UAAU,EAAE,EACrB,IAAI,EAAE;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GACzC,MAAM,EAAE,CAiBV;AAED,MAAM,WAAW,UAAU;IACzB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,KAAK,IAAI,IAAI,CAAC;CACf;AAED;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,CAAC,WAAW,GAAG,UAAU,CAmBvE"}

package/dist/lib/chat-render.js

@@ -0,0 +1,77 @@
+import chalk from 'chalk';
+/** Erase the current line and return the cursor to its start. */
+const ERASE_LINE = '\r\u001b[K';
+/**
+ * Collapse repeats of the same knowledge item.
+ *
+ * The server emits one `sources` entry per retrieved CHUNK, so a single item can
+ * appear many times over — a real answer has been observed listing the same GUID
+ * five times. Keyed on `knowledgeId`, falling back to the title when an entry
+ * carries no id. First-seen order is preserved (that is retrieval order, which is
+ * meaningful); only the relevance is upgraded when a later duplicate scores higher.
+ */
+export function dedupeSources(sources) {
+    const byKey = new Map();
+    for (const s of sources) {
+        const key = s.knowledgeId ?? `title:${s.title}`;
+        const seen = byKey.get(key);
+        if (!seen)
+            byKey.set(key, { ...s });
+        else if (s.relevance > seen.relevance)
+            seen.relevance = s.relevance;
+    }
+    return [...byKey.values()];
+}
+/**
+ * Render the source list: deduped, capped, and silent when there is nothing to
+ * show. Returns lines rather than printing so it stays testable and so callers
+ * decide the stream.
+ */
+export function formatSourceLines(sources, opts) {
+    const unique = dedupeSources(sources);
+    if (!unique.length)
+        return [];
+    const showIds = opts.showIds ?? true;
+    const shown = unique.slice(0, opts.limit);
+    const lines = [chalk.dim('sources:')];
+    for (const s of shown) {
+        lines.push(showIds && s.knowledgeId
+            ? `  - ${s.title} ${chalk.dim(`(${s.knowledgeId})`)}`
+            : `  - ${s.title}`);
+    }
+    const withheld = unique.length - shown.length;
+    if (withheld > 0)
+        lines.push(chalk.dim(`  … ${withheld} more — /sources for the full list`));
+    return lines;
+}
+/**
+ * A single self-overwriting progress line on stderr.
+ *
+ * The pipeline emits several near-duplicate status messages per turn ("Searching
+ * knowledge base…" then "Searching…"). Printing one line each leaves a stack of
+ * stale progress above the answer, so this redraws in place and erases itself
+ * before the answer is written. Off entirely when stderr is not a TTY — the same
+ * rule the upload progress follows, so redirected output stays clean.
+ */
+export function createStatusLine(stream) {
+    const enabled = Boolean(stream.isTTY);
+    let drawn = false;
+    let last;
+    return {
+        update(message) {
+            if (!enabled || !message || message === last)
+                return;
+            stream.write(`${ERASE_LINE}${chalk.dim(`  · ${message}`)}`);
+            drawn = true;
+            last = message;
+        },
+        clear() {
+            if (!enabled || !drawn)
+                return;
+            stream.write(ERASE_LINE);
+            drawn = false;
+            last = undefined;
+        },
+    };
+}
+//# sourceMappingURL=chat-render.js.map

package/dist/lib/chat-render.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chat-render.js","sourceRoot":"","sources":["../../src/lib/chat-render.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,MAAM,OAAO,CAAC;AAQ1B,iEAAiE;AACjE,MAAM,UAAU,GAAG,YAAY,CAAC;AAEhC;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAAC,OAAqB;IACjD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC5C,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,MAAM,GAAG,GAAG,CAAC,CAAC,WAAW,IAAI,SAAS,CAAC,CAAC,KAAK,EAAE,CAAC;QAChD,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,CAAC,IAAI;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;aAC/B,IAAI,CAAC,CAAC,SAAS,GAAG,IAAI,CAAC,SAAS;YAAE,IAAI,CAAC,SAAS,GAAG,CAAC,CAAC,SAAS,CAAC;IACtE,CAAC;IACD,OAAO,CAAC,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAC/B,OAAqB,EACrB,IAA0C;IAE1C,MAAM,MAAM,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC;IACtC,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,KAAK,CAAC,IAAI,CACR,OAAO,IAAI,CAAC,CAAC,WAAW;YACtB,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,IAAI,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,WAAW,GAAG,CAAC,EAAE;YACrD,CAAC,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,CACrB,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC9C,IAAI,QAAQ,GAAG,CAAC;QAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,OAAO,QAAQ,oCAAoC,CAAC,CAAC,CAAC;IAC7F,OAAO,KAAK,CAAC;AACf,CAAC;AAOD;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAA0B;IACzD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,IAAwB,CAAC;IAE7B,OAAO;QACL,MAAM,CAAC,OAAe;YACpB,IAAI,CAAC,OAAO,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,IAAI;gBAAE,OAAO;YACrD,MAAM,CAAC,KAAK,CAAC,GAAG,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;YAC5D,KAAK,GAAG,IAAI,CAAC;YACb,IAAI,GAAG,OAAO,CAAC;QACjB,CAAC;QACD,KAAK;YACH,IAAI,CAAC,OAAO,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC/B,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;YACzB,KAAK,GAAG,KAAK,CAAC;YACd,IAAI,GAAG,SAAS,CAAC;QACnB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/cmek-guard.d.ts

@@ -0,0 +1,52 @@
+import type { ContentEncryptor } from '@knowzai/local-store';
+/**
+ * CLI_SecurityReleaseReadiness H4 — CMEK must hold on EVERY cloud write path,
+ * not just `knowz sync push`.
+ *
+ * Model-3 CMEK promises the cloud only ever stores ciphertext. Before this
+ * guard, `sync push`/`sync run`/`capture seal` honoured it, but three sibling
+ * paths wrote to the same API without an encryptor:
+ *
+ *  - `knowledge create` / `knowledge update` call `client.knowledge.*` directly
+ *  - `repo setup --sync` / `repo index --push` build a `SyncEngine` with no
+ *    encryptor, so repository source is pushed as plaintext (and pulled content
+ *    is stored locally as undecrypted ciphertext)
+ *  - file attachments upload raw bytes, for which no envelope format exists
+ *  - `knowledge amend` asks the CLOUD to rewrite stored content it cannot read
+ *
+ * The first two are fixed by threading the profile's encryptor through. The
+ * last two cannot be fixed by encrypting. For attachments: the chunked-upload protocol is a byte
+ * stream with a server-computed SHA-256, and there is no file-envelope contract
+ * to carry the CMEK header. Inventing one here would produce files the server,
+ * the web client, and every other consumer could not read. So it fails CLOSED —
+ * a refusal the user can see beats a silent plaintext upload under a feature
+ * whose entire promise is that plaintext never leaves the machine.
+ */
+/** Encrypt outbound content when the profile has CMEK enabled. */
+export declare function encryptOutboundContent(encryptor: ContentEncryptor | undefined, content: string | undefined): string | undefined;
+/** Decrypt content fetched from the cloud when it carries a CMEK envelope. */
+export declare function decryptInboundContent(encryptor: ContentEncryptor | undefined, content: string | undefined): string | undefined;
+/**
+ * Fail closed on CLOUD-SIDE CONTENT MUTATION while CMEK is enabled.
+ *
+ * `knowledge create`/`update` are safe under CMEK because the CLI encrypts the
+ * content before it leaves the machine — the cloud only ever holds ciphertext.
+ * `knowledge amend` is a different shape: it ships a natural-language
+ * instruction that the SERVER applies to the stored content. Under CMEK the
+ * server holds ciphertext and has no KEK, so it cannot read what it is being
+ * asked to amend, let alone re-encrypt the result. There is no
+ * encrypted-amendment envelope, so the only outcomes available are a failed
+ * amendment or — worse — one that decrypts nothing, rewrites the record in
+ * plaintext, and quietly ends the ciphertext-only guarantee.
+ *
+ * So it refuses, for the same reason `assertNoRawUploadUnderCmek` does: a
+ * refusal the user can see beats a silent downgrade of the feature's entire
+ * promise.
+ */
+export declare function assertNoCloudAmendUnderCmek(encryptor: ContentEncryptor | undefined, operation: string): void;
+/**
+ * Fail closed on raw-byte cloud writes while CMEK is enabled. `operation` names
+ * the user-facing action so the refusal explains itself.
+ */
+export declare function assertNoRawUploadUnderCmek(encryptor: ContentEncryptor | undefined, operation: string): void;
+//# sourceMappingURL=cmek-guard.d.ts.map

package/dist/lib/cmek-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmek-guard.d.ts","sourceRoot":"","sources":["../../src/lib/cmek-guard.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,wBAAgB,sBAAsB,CACpC,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,GAAG,SAAS,CAGpB;AAED,8EAA8E;AAC9E,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,OAAO,EAAE,MAAM,GAAG,SAAS,GAC1B,MAAM,GAAG,SAAS,CAGpB;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,2BAA2B,CACzC,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,SAAS,EAAE,MAAM,GAChB,IAAI,CASN;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CACxC,SAAS,EAAE,gBAAgB,GAAG,SAAS,EACvC,SAAS,EAAE,MAAM,GAChB,IAAI,CAQN"}

package/dist/lib/cmek-guard.js

@@ -0,0 +1,73 @@
+import { ExitCode, KnowzError } from '@knowzai/core';
+/**
+ * CLI_SecurityReleaseReadiness H4 — CMEK must hold on EVERY cloud write path,
+ * not just `knowz sync push`.
+ *
+ * Model-3 CMEK promises the cloud only ever stores ciphertext. Before this
+ * guard, `sync push`/`sync run`/`capture seal` honoured it, but three sibling
+ * paths wrote to the same API without an encryptor:
+ *
+ *  - `knowledge create` / `knowledge update` call `client.knowledge.*` directly
+ *  - `repo setup --sync` / `repo index --push` build a `SyncEngine` with no
+ *    encryptor, so repository source is pushed as plaintext (and pulled content
+ *    is stored locally as undecrypted ciphertext)
+ *  - file attachments upload raw bytes, for which no envelope format exists
+ *  - `knowledge amend` asks the CLOUD to rewrite stored content it cannot read
+ *
+ * The first two are fixed by threading the profile's encryptor through. The
+ * last two cannot be fixed by encrypting. For attachments: the chunked-upload protocol is a byte
+ * stream with a server-computed SHA-256, and there is no file-envelope contract
+ * to carry the CMEK header. Inventing one here would produce files the server,
+ * the web client, and every other consumer could not read. So it fails CLOSED —
+ * a refusal the user can see beats a silent plaintext upload under a feature
+ * whose entire promise is that plaintext never leaves the machine.
+ */
+/** Encrypt outbound content when the profile has CMEK enabled. */
+export function encryptOutboundContent(encryptor, content) {
+    if (content == null || !encryptor)
+        return content;
+    return encryptor.encrypt(content);
+}
+/** Decrypt content fetched from the cloud when it carries a CMEK envelope. */
+export function decryptInboundContent(encryptor, content) {
+    if (content == null || !encryptor)
+        return content;
+    return encryptor.isEncrypted(content) ? encryptor.decrypt(content) : content;
+}
+/**
+ * Fail closed on CLOUD-SIDE CONTENT MUTATION while CMEK is enabled.
+ *
+ * `knowledge create`/`update` are safe under CMEK because the CLI encrypts the
+ * content before it leaves the machine — the cloud only ever holds ciphertext.
+ * `knowledge amend` is a different shape: it ships a natural-language
+ * instruction that the SERVER applies to the stored content. Under CMEK the
+ * server holds ciphertext and has no KEK, so it cannot read what it is being
+ * asked to amend, let alone re-encrypt the result. There is no
+ * encrypted-amendment envelope, so the only outcomes available are a failed
+ * amendment or — worse — one that decrypts nothing, rewrites the record in
+ * plaintext, and quietly ends the ciphertext-only guarantee.
+ *
+ * So it refuses, for the same reason `assertNoRawUploadUnderCmek` does: a
+ * refusal the user can see beats a silent downgrade of the feature's entire
+ * promise.
+ */
+export function assertNoCloudAmendUnderCmek(encryptor, operation) {
+    if (!encryptor)
+        return;
+    throw new KnowzError(`${operation} is blocked while CMEK is enabled for this profile: the amendment is applied by the cloud, ` +
+        'which holds only ciphertext and no key, and there is no encrypted-amendment envelope format yet — ' +
+        'so the amendment would either fail or store plaintext in the cloud. ' +
+        'Edit the content locally and run `knowz knowledge update` instead, or run this on a profile without CMEK.', ExitCode.Usage);
+}
+/**
+ * Fail closed on raw-byte cloud writes while CMEK is enabled. `operation` names
+ * the user-facing action so the refusal explains itself.
+ */
+export function assertNoRawUploadUnderCmek(encryptor, operation) {
+    if (!encryptor)
+        return;
+    throw new KnowzError(`${operation} is blocked while CMEK is enabled for this profile: file attachments are uploaded as raw bytes ` +
+        'and there is no encrypted-file envelope format yet, so the upload would store plaintext in the cloud. ' +
+        'Attach the content as knowledge text instead, or run this on a profile without CMEK.', ExitCode.Usage);
+}
+//# sourceMappingURL=cmek-guard.js.map

package/dist/lib/cmek-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cmek-guard.js","sourceRoot":"","sources":["../../src/lib/cmek-guard.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAGrD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,kEAAkE;AAClE,MAAM,UAAU,sBAAsB,CACpC,SAAuC,EACvC,OAA2B;IAE3B,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;AACpC,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,qBAAqB,CACnC,SAAuC,EACvC,OAA2B;IAE3B,IAAI,OAAO,IAAI,IAAI,IAAI,CAAC,SAAS;QAAE,OAAO,OAAO,CAAC;IAClD,OAAO,SAAS,CAAC,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;AAC/E,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CACzC,SAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,IAAI,UAAU,CAClB,GAAG,SAAS,6FAA6F;QACvG,oGAAoG;QACpG,sEAAsE;QACtE,2GAA2G,EAC7G,QAAQ,CAAC,KAAK,CACf,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,0BAA0B,CACxC,SAAuC,EACvC,SAAiB;IAEjB,IAAI,CAAC,SAAS;QAAE,OAAO;IACvB,MAAM,IAAI,UAAU,CAClB,GAAG,SAAS,iGAAiG;QAC3G,wGAAwG;QACxG,sFAAsF,EACxF,QAAQ,CAAC,KAAK,CACf,CAAC;AACJ,CAAC"}

package/dist/lib/content.d.ts

@@ -1,6 +1,13 @@
 /**
  * Resolve knowledge content from (in priority order): --content, --file, or
  * piped stdin. Returns undefined if none provided.
+ *
+ * H7 — `--file` is gated by the shared safe-file policy AT THE READ. oclif's
+ * `exists: true` only proves the path resolves; it says nothing about whether the
+ * file is a credential store, a symlink pointing at one, or large enough to
+ * exhaust memory when read whole. `readSafeFile` judges and consumes one
+ * `O_NOFOLLOW` descriptor, so the file that passed the policy is the file whose
+ * bytes become knowledge content.
  */
 export declare function resolveContentInput(opts: {
     content?: string;

package/dist/lib/content.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/lib/content.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU9B"}
+{"version":3,"file":"content.d.ts","sourceRoot":"","sources":["../../src/lib/content.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;GAUG;AACH,wBAAsB,mBAAmB,CAAC,IAAI,EAAE;IAC9C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAU9B"}

package/dist/lib/content.js

@@ -1,13 +1,20 @@
-import { readFileSync } from 'node:fs';
+import { readSafeFile } from './safe-file.js';
 /**
  * Resolve knowledge content from (in priority order): --content, --file, or
  * piped stdin. Returns undefined if none provided.
+ *
+ * H7 — `--file` is gated by the shared safe-file policy AT THE READ. oclif's
+ * `exists: true` only proves the path resolves; it says nothing about whether the
+ * file is a credential store, a symlink pointing at one, or large enough to
+ * exhaust memory when read whole. `readSafeFile` judges and consumes one
+ * `O_NOFOLLOW` descriptor, so the file that passed the policy is the file whose
+ * bytes become knowledge content.
  */
 export async function resolveContentInput(opts) {
     if (opts.content !== undefined)
         return opts.content;
     if (opts.file)
-        return readFileSync(opts.file, 'utf8');
+        return readSafeFile(opts.file, { operation: '--file' }).content;
     if (!process.stdin.isTTY) {
         const chunks = [];
         for await (const chunk of process.stdin)

package/dist/lib/content.js.map

@@ -1 +1 @@
-{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/lib/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEvC;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAGzC;IACC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}
+{"version":3,"file":"content.js","sourceRoot":"","sources":["../../src/lib/content.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAE9C;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAGzC;IACC,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC,OAAO,CAAC;IACpD,IAAI,IAAI,CAAC,IAAI;QAAE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC,OAAO,CAAC;IAC/E,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,OAAO,CAAC,KAAK;YAAE,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC;QACtE,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACpD,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IACxC,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/lib/credential-purge.d.ts

@@ -0,0 +1,52 @@
+import type { CredentialStore, KnowzConfig } from '@knowzai/core';
+/**
+ * CLI_SecurityReleaseReadiness H6 — remove EVERY stored credential before the
+ * local configuration is deleted.
+ *
+ * Uninstall previously ran `platform destroy --yes --purge-profile`, which
+ * deletes exactly one profile's secret, and then `rm -rf ~/.knowz`. Every other
+ * profile's API key stayed in the OS keychain — and, because the profile index
+ * that makes keychain entries enumerable lives inside `~/.knowz`, deleting the
+ * config directory made those leftovers unreachable by the CLI: they can then
+ * only be found and removed by hand, in Keychain Access / Credential Manager.
+ *
+ * Ordering is therefore load-bearing: enumerate and delete credentials FIRST,
+ * local state SECOND. `purgeAllCredentials` returns what it removed so the
+ * caller can report it honestly rather than claiming a clean uninstall.
+ */
+export interface CredentialPurgeResult {
+    /** Profiles whose credential was deleted (best-effort union of index + config). */
+    profiles: string[];
+    /** Which store the credentials lived in — surfaced so a failure is diagnosable. */
+    backend: string;
+}
+export interface CredentialPurgeDeps {
+    loadConfig: () => KnowzConfig;
+    saveConfig: (cfg: KnowzConfig) => void;
+    credentialStore: () => Promise<CredentialStore>;
+}
+/**
+ * Delete every credential the store knows about, then drop the profiles from
+ * config. Profiles are collected from BOTH the credential index and the config
+ * file: either one can have entries the other lost, and a purge that misses an
+ * orphan is exactly the failure this closes.
+ *
+ * FAILS CLOSED on an unreadable index. `listProfiles()` is the ONLY way to
+ * discover OS-keychain entries — the keychain cannot be enumerated, so the
+ * index inside `~/.knowz` is the map to them. If that read throws, the map is
+ * gone, and continuing would delete the local config (making the leftovers
+ * unreachable by the CLI forever) while reporting a clean uninstall. So the
+ * error propagates untouched and `credential-index.json` is left exactly as it
+ * was: it is the recovery artifact, and truncating it is the one irreversible
+ * move available here.
+ *
+ * Each credential is deleted EXACTLY ONCE. `deleteAll()` plus a per-profile
+ * pass was a double delete: `deleteAll()` iterates the same index, so every
+ * indexed profile was deleted twice, and the second attempt hit an entry the
+ * OS keychain no longer has. That only looked harmless because the union pass
+ * covers everything `deleteAll()` would have.
+ */
+export declare function purgeAllCredentials(deps: CredentialPurgeDeps, opts?: {
+    removeProfiles?: boolean;
+}): Promise<CredentialPurgeResult>;
+//# sourceMappingURL=credential-purge.d.ts.map

package/dist/lib/credential-purge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-purge.d.ts","sourceRoot":"","sources":["../../src/lib/credential-purge.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,eAAe,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAElE;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,qBAAqB;IACpC,mFAAmF;IACnF,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,mFAAmF;IACnF,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,mBAAmB;IAClC,UAAU,EAAE,MAAM,WAAW,CAAC;IAC9B,UAAU,EAAE,CAAC,GAAG,EAAE,WAAW,KAAK,IAAI,CAAC;IACvC,eAAe,EAAE,MAAM,OAAO,CAAC,eAAe,CAAC,CAAC;CACjD;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,mBAAmB,EACzB,IAAI,GAAE;IAAE,cAAc,CAAC,EAAE,OAAO,CAAA;CAAO,GACtC,OAAO,CAAC,qBAAqB,CAAC,CAgBhC"}

package/dist/lib/credential-purge.js

@@ -0,0 +1,37 @@
+/**
+ * Delete every credential the store knows about, then drop the profiles from
+ * config. Profiles are collected from BOTH the credential index and the config
+ * file: either one can have entries the other lost, and a purge that misses an
+ * orphan is exactly the failure this closes.
+ *
+ * FAILS CLOSED on an unreadable index. `listProfiles()` is the ONLY way to
+ * discover OS-keychain entries — the keychain cannot be enumerated, so the
+ * index inside `~/.knowz` is the map to them. If that read throws, the map is
+ * gone, and continuing would delete the local config (making the leftovers
+ * unreachable by the CLI forever) while reporting a clean uninstall. So the
+ * error propagates untouched and `credential-index.json` is left exactly as it
+ * was: it is the recovery artifact, and truncating it is the one irreversible
+ * move available here.
+ *
+ * Each credential is deleted EXACTLY ONCE. `deleteAll()` plus a per-profile
+ * pass was a double delete: `deleteAll()` iterates the same index, so every
+ * indexed profile was deleted twice, and the second attempt hit an entry the
+ * OS keychain no longer has. That only looked harmless because the union pass
+ * covers everything `deleteAll()` would have.
+ */
+export async function purgeAllCredentials(deps, opts = {}) {
+    const store = await deps.credentialStore();
+    const cfg = deps.loadConfig();
+    const indexed = await store.listProfiles();
+    const profiles = [...new Set([...indexed, ...Object.keys(cfg.profiles ?? {})])].sort();
+    for (const profile of profiles)
+        await store.deleteSecret(profile);
+    if (opts.removeProfiles !== false) {
+        for (const profile of Object.keys(cfg.profiles ?? {}))
+            delete cfg.profiles[profile];
+        cfg.activeProfile = 'dev';
+        deps.saveConfig(cfg);
+    }
+    return { profiles, backend: store.backend() };
+}
+//# sourceMappingURL=credential-purge.js.map

package/dist/lib/credential-purge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-purge.js","sourceRoot":"","sources":["../../src/lib/credential-purge.ts"],"names":[],"mappings":"AA8BA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAyB,EACzB,OAAqC,EAAE;IAEvC,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,eAAe,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,UAAU,EAAE,CAAC;IAE9B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,YAAY,EAAE,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAEvF,KAAK,MAAM,OAAO,IAAI,QAAQ;QAAE,MAAM,KAAK,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;IAElE,IAAI,IAAI,CAAC,cAAc,KAAK,KAAK,EAAE,CAAC;QAClC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;YAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC;QACpF,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC;QAC1B,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;AAChD,CAAC"}

package/dist/lib/ingest.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../src/lib/ingest.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAKtD,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,OAAO,CAAC,YAAY,CAAC,CAsBvB"}
+{"version":3,"file":"ingest.d.ts","sourceRoot":"","sources":["../../src/lib/ingest.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAkB,MAAM,kBAAkB,CAAC;AACrE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAGvD,MAAM,MAAM,UAAU,GAAG,MAAM,GAAG,UAAU,GAAG,MAAM,CAAC;AAKtD,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,UAAU,CAKlD;AAED,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,UAAU,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAC9B,OAAO,EAAE,iBAAiB,EAC1B,KAAK,EAAE,UAAU,EACjB,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,CAAC,EAAE,UAAU,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAO,GAClF,OAAO,CAAC,YAAY,CAAC,CA0BvB"}

package/dist/lib/ingest.js

@@ -1,6 +1,6 @@
-import { readFileSync, statSync } from 'node:fs';
 import { createHash } from 'node:crypto';
 import { grammarForPath } from '@knowzai/indexer';
+import { readSafeFile } from './safe-file.js';
 const DOC_EXT = new Set(['md', 'markdown', 'txt', 'rst', 'adoc', 'text']);
 const NON_CODE_GRAMMARS = new Set(['json', 'yaml', 'yml', 'toml', 'html', 'css']);
 /** Infer a knowledge type from the file extension. */
@@ -18,7 +18,12 @@ export function inferType(path) {
  * it. The foundation for richer ingestion sources (email/web/watch) later.
  */
 export async function ingestFile(indexer, store, path, opts = {}) {
-    const content = readFileSync(path, 'utf8');
+    // H7 — an ingested file becomes a knowledge item that `sync push` ships to the
+    // cloud, so the same denied-path/symlink/size policy applies here as anywhere
+    // else the CLI reads a user-named file. The policy check and the read share
+    // one `O_NOFOLLOW` descriptor, and the recorded file state comes from that
+    // descriptor's `fstat` rather than a second, re-resolving `statSync`.
+    const { content, stat: st } = readSafeFile(path, { operation: 'ingest' });
     const res = await indexer.indexFile(path, content);
     const type = opts.type ?? inferType(path);
     res.item.type = type;
@@ -30,7 +35,6 @@ export async function ingestFile(indexer, store, path, opts = {}) {
     res.item.syncState = 'new';
     await store.upsertItem(res.item);
     await store.putChunks(res.item.id, res.chunks, res.vectors);
-    const st = statSync(path);
     await store.setFileState({
         path,
         hash: createHash('sha256').update(content).digest('hex'),

package/dist/lib/ingest.js.map

@@ -1 +1 @@
-{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../../src/lib/ingest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAqB,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAKrE,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAElF,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B,EAC1B,KAAiB,EACjB,IAAY,EACZ,OAAiF,EAAE;IAEnF,MAAM,OAAO,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAE3B,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,EAAE,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC1B,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QACnB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACrG,CAAC"}
+{"version":3,"file":"ingest.js","sourceRoot":"","sources":["../../src/lib/ingest.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAqB,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAErE,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAI9C,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAC1E,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC,CAAC;AAElF,sDAAsD;AACtD,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACvD,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,MAAM,CAAC;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IACxC,OAAO,MAAM,CAAC;AAChB,CAAC;AAUD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,OAA0B,EAC1B,KAAiB,EACjB,IAAY,EACZ,OAAiF,EAAE;IAEnF,+EAA+E;IAC/E,8EAA8E;IAC9E,4EAA4E;IAC5E,2EAA2E;IAC3E,sEAAsE;IACtE,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,YAAY,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC;IAC1C,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACrB,IAAI,IAAI,CAAC,KAAK;QAAE,GAAG,CAAC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IAC5C,GAAG,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/E,IAAI,IAAI,CAAC,OAAO;QAAE,GAAG,CAAC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC;IAClD,GAAG,CAAC,IAAI,CAAC,SAAS,GAAG,KAAK,CAAC;IAE3B,MAAM,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACjC,MAAM,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,MAAM,KAAK,CAAC,YAAY,CAAC;QACvB,IAAI;QACJ,IAAI,EAAE,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;QACxD,OAAO,EAAE,EAAE,CAAC,OAAO;QACnB,IAAI,EAAE,EAAE,CAAC,IAAI;QACb,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE;QACnB,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACxC,CAAC,CAAC;IACH,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;AACrG,CAAC"}