@mnemonik/shared 7.97.2 → 7.98.0

package/dist/projectIdentityFile.d.ts

@@ -0,0 +1,25 @@
+import type { RepositoryFingerprint } from './repositoryFingerprint.js';
+export declare const isCanonicalUuid: (value: unknown) => value is string;
+export interface ProjectIdentityFile {
+    schemaVersion: 1;
+    projectId: string;
+    projectName?: string;
+    repositoryFingerprint?: RepositoryFingerprint;
+}
+export type IdentityFileResult = {
+    kind: 'ok';
+    identity: ProjectIdentityFile;
+} | {
+    kind: 'unknown_version';
+    version: unknown;
+} | {
+    kind: 'malformed';
+    detail: string;
+} | {
+    kind: 'absent';
+};
+export declare function parseIdentityFile(text: string): Exclude<IdentityFileResult, {
+    kind: 'absent';
+}>;
+export declare function readIdentityFile(dir: string): Promise<IdentityFileResult>;
+//# sourceMappingURL=projectIdentityFile.d.ts.map

package/dist/projectIdentityFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectIdentityFile.d.ts","sourceRoot":"","sources":["../src/projectIdentityFile.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,4BAA4B,CAAC;AAGxE,eAAO,MAAM,eAAe,UAAW,OAAO,KAAG,KAAK,IAAI,MACD,CAAC;AAS1D,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,CAAC,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;CAC/C;AAED,MAAM,MAAM,kBAAkB,GAC1B;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,mBAAmB,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,iBAAiB,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,GAC7C;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACrC;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAEvB,wBAAgB,iBAAiB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC,CA0D/F;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAW/E"}

package/dist/projectIdentityFile.js

@@ -0,0 +1,87 @@
+import { lstat, readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+const CANONICAL_UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/;
+export const isCanonicalUuid = (value) => typeof value === 'string' && CANONICAL_UUID.test(value);
+const IDENTITY_KEYS = new Set([
+    'schemaVersion',
+    'projectId',
+    'projectName',
+    'repositoryFingerprint',
+]);
+const FINGERPRINT_KEYS = new Set(['algorithmVersion', 'hash']);
+export function parseIdentityFile(text) {
+    let value;
+    try {
+        value = JSON.parse(text);
+    }
+    catch (error) {
+        return { kind: 'malformed', detail: `unparseable JSON: ${error.message}` };
+    }
+    if (!value || typeof value !== 'object' || Array.isArray(value)) {
+        return { kind: 'malformed', detail: 'identity file must contain a JSON object' };
+    }
+    const record = value;
+    if (record.schemaVersion !== 1) {
+        return { kind: 'unknown_version', version: record.schemaVersion };
+    }
+    const unknownKey = Object.keys(record).find((key) => !IDENTITY_KEYS.has(key));
+    if (unknownKey)
+        return { kind: 'malformed', detail: `unknown key "${unknownKey}"` };
+    if (!isCanonicalUuid(record.projectId)) {
+        return { kind: 'malformed', detail: '"projectId" must be a canonical RFC 4122 UUID string' };
+    }
+    if ('projectName' in record && typeof record.projectName !== 'string') {
+        return { kind: 'malformed', detail: '"projectName" must be a string when present' };
+    }
+    if ('repositoryFingerprint' in record &&
+        (!record.repositoryFingerprint ||
+            typeof record.repositoryFingerprint !== 'object' ||
+            Array.isArray(record.repositoryFingerprint))) {
+        return { kind: 'malformed', detail: '"repositoryFingerprint" must be an object when present' };
+    }
+    const fingerprint = record.repositoryFingerprint;
+    const unknownFingerprintKey = fingerprint
+        ? Object.keys(fingerprint).find((key) => !FINGERPRINT_KEYS.has(key))
+        : undefined;
+    if (unknownFingerprintKey) {
+        return {
+            kind: 'malformed',
+            detail: `unknown repositoryFingerprint key "${unknownFingerprintKey}"`,
+        };
+    }
+    if (fingerprint && (fingerprint.algorithmVersion !== 1 || typeof fingerprint.hash !== 'string')) {
+        return {
+            kind: 'malformed',
+            detail: '"repositoryFingerprint" must contain algorithmVersion 1 and a string hash',
+        };
+    }
+    const repositoryFingerprint = fingerprint
+        ? { algorithmVersion: 1, hash: fingerprint.hash }
+        : undefined;
+    return {
+        kind: 'ok',
+        identity: {
+            schemaVersion: 1,
+            projectId: record.projectId,
+            ...(record.projectName === undefined ? {} : { projectName: record.projectName }),
+            ...(repositoryFingerprint ? { repositoryFingerprint } : {}),
+        },
+    };
+}
+export async function readIdentityFile(dir) {
+    const path = join(dir, '.mnemonik.json');
+    try {
+        const stat = await lstat(path);
+        if (stat.isSymbolicLink())
+            return { kind: 'malformed', detail: 'symlink' };
+        if (!stat.isFile())
+            return { kind: 'malformed', detail: 'identity path is not a regular file' };
+        return parseIdentityFile(await readFile(path, 'utf8'));
+    }
+    catch (error) {
+        if (error.code === 'ENOENT')
+            return { kind: 'absent' };
+        return { kind: 'malformed', detail: `cannot read identity file: ${error.message}` };
+    }
+}
+//# sourceMappingURL=projectIdentityFile.js.map

package/dist/projectIdentityFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectIdentityFile.js","sourceRoot":"","sources":["../src/projectIdentityFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AACnD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjC,MAAM,cAAc,GAAG,2EAA2E,CAAC;AACnG,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,KAAc,EAAmB,EAAE,CACjE,OAAO,KAAK,KAAK,QAAQ,IAAI,cAAc,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC;IAC5B,eAAe;IACf,WAAW;IACX,aAAa;IACb,uBAAuB;CACxB,CAAC,CAAC;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC,CAAC,kBAAkB,EAAE,MAAM,CAAC,CAAC,CAAC;AAe/D,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qBAAsB,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QAChE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,0CAA0C,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,MAAM,GAAG,KAAgC,CAAC;IAChD,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,CAAC,aAAa,EAAE,CAAC;IACpE,CAAC;IACD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IAC9E,IAAI,UAAU;QAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,gBAAgB,UAAU,GAAG,EAAE,CAAC;IACpF,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACvC,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,sDAAsD,EAAE,CAAC;IAC/F,CAAC;IACD,IAAI,aAAa,IAAI,MAAM,IAAI,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,EAAE,CAAC;QACtE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,6CAA6C,EAAE,CAAC;IACtF,CAAC;IACD,IACE,uBAAuB,IAAI,MAAM;QACjC,CAAC,CAAC,MAAM,CAAC,qBAAqB;YAC5B,OAAO,MAAM,CAAC,qBAAqB,KAAK,QAAQ;YAChD,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,qBAAqB,CAAC,CAAC,EAC9C,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,wDAAwD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,WAAW,GAAG,MAAM,CAAC,qBAA4D,CAAC;IACxF,MAAM,qBAAqB,GAAG,WAAW;QACvC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACpE,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,qBAAqB,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,sCAAsC,qBAAqB,GAAG;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,CAAC,WAAW,CAAC,gBAAgB,KAAK,CAAC,IAAI,OAAO,WAAW,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,CAAC;QAChG,OAAO;YACL,IAAI,EAAE,WAAW;YACjB,MAAM,EAAE,2EAA2E;SACpF,CAAC;IACJ,CAAC;IACD,MAAM,qBAAqB,GAAsC,WAAW;QAC1E,CAAC,CAAC,EAAE,gBAAgB,EAAE,CAAC,EAAE,IAAI,EAAE,WAAW,CAAC,IAAc,EAAE;QAC3D,CAAC,CAAC,SAAS,CAAC;IACd,OAAO;QACL,IAAI,EAAE,IAAI;QACV,QAAQ,EAAE;YACR,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,GAAG,CAAC,MAAM,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAqB,EAAE,CAAC;YAC1F,GAAG,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC5D;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAW;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;QAC/B,IAAI,IAAI,CAAC,cAAc,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;QAC3E,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,qCAAqC,EAAE,CAAC;QAChG,OAAO,iBAAiB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;QAClF,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,8BAA+B,KAAe,CAAC,OAAO,EAAE,EAAE,CAAC;IACjG,CAAC;AACH,CAAC"}

package/dist/projectSetupHandoff.d.ts

@@ -0,0 +1,24 @@
+export declare const PROJECT_SETUP_MANUAL = "Mnemonik project setup needs attention; ask the person to run `mnemonik project init` in this folder.";
+export declare function projectSetupActions(value: unknown): string;
+export interface ProjectSetupDiagnostic {
+    requestId?: string;
+    outcome: 'done' | 'ACTION_REQUIRED' | 'failed';
+    time: string;
+    rootHash: string | null;
+    action: string;
+    reason?: string;
+}
+/** Parse the native tool response, never tool arguments or agent-authored command fields. */
+export declare function setupResponse(value: unknown): Record<string, unknown> | undefined;
+export declare function handoffProjectSetup(input: {
+    response: unknown;
+    cwd: string | undefined;
+    host: 'claude_code' | 'cursor' | 'grok';
+    hostSessionId: string;
+    stateFile: string;
+    stateDir: string;
+    familyId: string | undefined;
+}): Promise<string | undefined>;
+/** Both doctor and status consume private per-session outcomes, scoped by root hash. */
+export declare function pendingProjectSetup(root: string): Promise<ProjectSetupDiagnostic[]>;
+//# sourceMappingURL=projectSetupHandoff.d.ts.map

package/dist/projectSetupHandoff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectSetupHandoff.d.ts","sourceRoot":"","sources":["../src/projectSetupHandoff.ts"],"names":[],"mappings":"AASA,eAAO,MAAM,oBAAoB,0GACwE,CAAC;AAK1G,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAE1D;AACD,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,QAAQ,CAAC;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAGD,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,CAkCjF;AA8CD,wBAAsB,mBAAmB,CAAC,KAAK,EAAE;IAC/C,QAAQ,EAAE,OAAO,CAAC;IAClB,GAAG,EAAE,MAAM,GAAG,SAAS,CAAC;IACxB,IAAI,EAAE,aAAa,GAAG,QAAQ,GAAG,MAAM,CAAC;IACxC,aAAa,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAuH9B;AAED,wFAAwF;AACxF,wBAAsB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAmCzF"}

package/dist/projectSetupHandoff.js

@@ -0,0 +1,249 @@
+import { protectWindowsDirectory } from './runtimeSigners.js';
+import { execFile } from 'node:child_process';
+import { constants } from 'node:fs';
+import { lstat, mkdir, open, readdir, realpath, rename, rm } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { dirname, join, relative } from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { RuntimeReader, hash } from './runtimeReader.js';
+export const PROJECT_SETUP_MANUAL = 'Mnemonik project setup needs attention; ask the person to run `mnemonik project init` in this folder.';
+const words = (value) => typeof value === 'string' && /^[a-z][a-z0-9_]{0,79}$/.test(value)
+    ? value.replaceAll('_', ' ')
+    : 'needs attention';
+export function projectSetupActions(value) {
+    return Array.isArray(value) ? value.slice(0, 20).map(words).join(', ') : 'retry, cancel';
+}
+const record = (value) => !!value && typeof value === 'object' && !Array.isArray(value);
+/** Parse the native tool response, never tool arguments or agent-authored command fields. */
+export function setupResponse(value) {
+    if (typeof value === 'string') {
+        if (value.length > 64 * 1024)
+            return;
+        try {
+            value = JSON.parse(value);
+        }
+        catch {
+            return;
+        }
+    }
+    if (!record(value))
+        return;
+    if (record(value.structuredContent))
+        value = value.structuredContent;
+    else {
+        // Claude supplies the server's tool_response directly, not model-authored text.
+        // Accept only the server envelope; no command/path extensions cross this boundary.
+        const keys = ['status', 'state', 'allowedActions', 'requestId', 'expiresAt'];
+        const envelope = value;
+        if (!keys.every((key) => Object.hasOwn(envelope, key)) ||
+            Object.keys(value).some((key) => ![...keys, 'manualAction'].includes(key)) ||
+            typeof value.state !== 'string' ||
+            !Array.isArray(value.allowedActions) ||
+            !value.allowedActions.every((action) => typeof action === 'string') ||
+            typeof value.requestId !== 'string' ||
+            !/^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i.test(value.requestId) ||
+            typeof value.expiresAt !== 'string' ||
+            !Number.isFinite(Date.parse(value.expiresAt)) ||
+            (Object.hasOwn(value, 'manualAction') && typeof value.manualAction !== 'string'))
+            return;
+    }
+    if (record(value) && value.status === 'project_setup_required')
+        return value;
+    return;
+}
+async function privateDirectory(path, session) {
+    const created = await mkdir(path, { recursive: true, mode: 0o700 });
+    const st = await lstat(path);
+    if (!st.isDirectory() ||
+        st.isSymbolicLink() ||
+        (process.getuid && (st.uid !== process.getuid() || st.mode & 0o077)))
+        throw new Error('diagnostic_unavailable');
+    if (process.platform === 'win32') {
+        await protectWindowsDirectory(path, created !== undefined, undefined, session);
+    }
+}
+async function readPrivate(path) {
+    const file = await open(path, constants.O_RDONLY | constants.O_NOFOLLOW);
+    try {
+        const st = await file.stat();
+        if (!st.isFile() ||
+            st.size > 64 * 1024 ||
+            (process.getuid && (st.uid !== process.getuid() || st.mode & 0o077)))
+            throw new Error('diagnostic_unavailable');
+        return await file.readFile('utf8');
+    }
+    finally {
+        await file.close();
+    }
+}
+async function writeDiagnostic(path, value) {
+    await privateDirectory(dirname(dirname(path)), dirname(path));
+    await privateDirectory(dirname(path), dirname(path));
+    const temp = `${path}.${randomUUID()}`;
+    try {
+        const file = await open(temp, 'wx', 0o600);
+        try {
+            await file.writeFile(JSON.stringify(value) + '\n');
+        }
+        finally {
+            await file.close();
+        }
+        await rename(temp, path);
+    }
+    finally {
+        await rm(temp, { force: true });
+    }
+}
+export async function handoffProjectSetup(input) {
+    const response = setupResponse(input.response);
+    if (!response)
+        return;
+    let root;
+    let action = PROJECT_SETUP_MANUAL;
+    let outcome = 'failed';
+    let reason = 'manual_setup_required';
+    const requestId = typeof response.requestId === 'string' && response.requestId.length <= 4096
+        ? response.requestId
+        : undefined;
+    try {
+        if (!input.cwd)
+            throw new Error('safe_cwd_unavailable');
+        // The binding receipt is private local state. No path from the response is read.
+        const cache = JSON.parse(await readPrivate(join(dirname(input.stateFile), 'bound-context.json')));
+        const [, family, body] = JSON.parse(cache.key);
+        if (!input.familyId ||
+            family !== input.familyId ||
+            body.host !== input.host ||
+            body.hostSessionId !== input.hostSessionId ||
+            cache.expiresAt <= Date.now() ||
+            !cache.canonicalRoot)
+            throw new Error('bound_context_unavailable');
+        root = await realpath(cache.canonicalRoot);
+        const { findProjectIdentityDetailed } = await import('./hookRuntime.js');
+        const identity = await findProjectIdentityDetailed(await realpath(input.cwd));
+        if (identity.kind === 'git_unavailable' || root !== (await realpath(identity.root)))
+            throw new Error('bound_root_changed');
+        if (!requestId)
+            throw new Error('manual_setup_required');
+        const runtime = await new RuntimeReader(input.stateDir).verifyRuntime('cli').catch(() => {
+            throw new Error('verified_cli_runtime_unavailable');
+        });
+        const bin = join(dirname(runtime.entry), 'bin.js');
+        if (!runtime.manifest.files[relative(runtime.directory, bin).replaceAll('\\', '/')])
+            throw new Error('verified_cli_bin_missing');
+        const result = await new Promise((resolve, reject) => {
+            const child = execFile(process.execPath, [bin, 'project', 'ensure', '--agent', '--json'], {
+                cwd: root,
+                shell: false,
+                timeout: 30_000,
+                killSignal: 'SIGKILL',
+                maxBuffer: 64 * 1024,
+                // Runtime injection variables and repository/PATH executables are not inherited.
+                env: Object.fromEntries([
+                    'HOME',
+                    'USERPROFILE',
+                    'LOCALAPPDATA',
+                    'XDG_STATE_HOME',
+                    'MNEMONIK_STATE_DIR',
+                    'MNEMONIK_SERVER',
+                    'MNEMONIK_API_RESOURCE',
+                    'MNEMONIK_OAUTH_ISSUER',
+                    'SYSTEMROOT',
+                    'TEMP',
+                    'TMP',
+                    'TMPDIR',
+                ].flatMap((key) => (process.env[key] === undefined ? [] : [[key, process.env[key]]]))),
+            }, (error, stdout) => {
+                if (error && (error.killed || error.code !== 3))
+                    return reject(new Error('helper_failed'));
+                try {
+                    resolve(JSON.parse(stdout));
+                }
+                catch {
+                    reject(new Error('helper_invalid_json'));
+                }
+            });
+            child.stdin?.on('error', () => { });
+            child.stdin?.end(JSON.stringify({ requestId }));
+        });
+        if (!record(result))
+            throw new Error('helper_invalid_json');
+        if (result.status === 'done') {
+            outcome = 'done';
+            reason = 'complete';
+            action = 'Mnemonik project setup is complete; call session_bootstrap again.';
+        }
+        else if (['ACTION_REQUIRED', 'action_required', 'project_setup_required'].includes(String(result.status))) {
+            outcome = 'ACTION_REQUIRED';
+            reason = 'choice_required';
+            action =
+                result.action === 'mnemonik auth renew' ||
+                    (Array.isArray(result.allowedActions) &&
+                        result.allowedActions.includes('mnemonik auth renew'))
+                    ? 'mnemonik auth renew'
+                    : result.allowedActions
+                        ? `Mnemonik project setup needs attention; allowed actions: ${projectSetupActions(result.allowedActions)}.`
+                        : PROJECT_SETUP_MANUAL;
+        }
+        else
+            throw new Error('helper_invalid_json');
+    }
+    catch (error) {
+        const code = error instanceof Error ? error.message : '';
+        reason = /^[a-z_]+$/.test(code) ? code : 'helper_unavailable';
+        process.stderr.write(`mnemonik-hook: project setup ${reason}; manual action required\n`);
+    }
+    try {
+        await writeDiagnostic(input.stateFile, {
+            requestId,
+            outcome,
+            time: new Date().toISOString(),
+            rootHash: root ? hash(root) : input.cwd ? hash(await realpath(input.cwd)) : null,
+            action,
+            reason,
+        });
+    }
+    catch {
+        process.stderr.write('mnemonik-hook: project setup diagnostic unavailable\n');
+    }
+    return action;
+}
+/** Both doctor and status consume private per-session outcomes, scoped by root hash. */
+export async function pendingProjectSetup(root) {
+    const rootHash = hash(await realpath(root));
+    const results = [];
+    const uid = process.getuid?.() ?? 'user';
+    for (const host of ['credit', 'cursor', 'grok']) {
+        const directory = join(tmpdir(), `mnemonik-${host}-${uid}`);
+        try {
+            const stat = await lstat(directory);
+            if (stat.isSymbolicLink() || !stat.isDirectory())
+                continue;
+            for (const name of await readdir(directory)) {
+                if (!/^[a-f0-9]{64}$/.test(name))
+                    continue;
+                try {
+                    if ((await lstat(join(directory, name))).isSymbolicLink())
+                        continue;
+                    const diagnostic = JSON.parse(await readPrivate(join(directory, name, 'project-setup.json')));
+                    if ((diagnostic.rootHash === rootHash || diagnostic.rootHash === null) &&
+                        ['done', 'ACTION_REQUIRED', 'failed'].includes(diagnostic.outcome) &&
+                        typeof diagnostic.action === 'string' &&
+                        diagnostic.action.length < 2000 &&
+                        Date.now() - Date.parse(diagnostic.time) < 24 * 60 * 60 * 1000)
+                        results.push(diagnostic);
+                }
+                catch {
+                    /* An incomplete or removed session is not a pending action. */
+                }
+            }
+        }
+        catch {
+            /* Host has no local sessions. */
+        }
+    }
+    // A later completion supersedes stale actions from another session in this root.
+    results.sort((a, b) => Date.parse(b.time) - Date.parse(a.time));
+    return results[0]?.outcome === 'done' ? [] : results.slice(0, 1);
+}
+//# sourceMappingURL=projectSetupHandoff.js.map

package/dist/projectSetupHandoff.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectSetupHandoff.js","sourceRoot":"","sources":["../src/projectSetupHandoff.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,MAAM,qBAAqB,CAAC;AAC9D,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AACpC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,kBAAkB,CAAC;AACrF,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AACpD,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAEzD,MAAM,CAAC,MAAM,oBAAoB,GAC/B,uGAAuG,CAAC;AAC1G,MAAM,KAAK,GAAG,CAAC,KAAc,EAAU,EAAE,CACvC,OAAO,KAAK,KAAK,QAAQ,IAAI,wBAAwB,CAAC,IAAI,CAAC,KAAK,CAAC;IAC/D,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;IAC5B,CAAC,CAAC,iBAAiB,CAAC;AACxB,MAAM,UAAU,mBAAmB,CAAC,KAAc;IAChD,OAAO,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC;AAC3F,CAAC;AASD,MAAM,MAAM,GAAG,CAAC,KAAc,EAAoC,EAAE,CAClE,CAAC,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAChE,6FAA6F;AAC7F,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,IAAI,KAAK,CAAC,MAAM,GAAG,EAAE,GAAG,IAAI;YAAE,OAAO;QACrC,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC5B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO;QACT,CAAC;IACH,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC;QAAE,OAAO;IAC3B,IAAI,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC;QAAE,KAAK,GAAG,KAAK,CAAC,iBAAiB,CAAC;SAChE,CAAC;QACJ,gFAAgF;QAChF,mFAAmF;QACnF,MAAM,IAAI,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,WAAW,CAAC,CAAC;QAC7E,MAAM,QAAQ,GAAG,KAAK,CAAC;QACvB,IACE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;YAClD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,EAAE,cAAc,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC1E,OAAO,KAAK,CAAC,KAAK,KAAK,QAAQ;YAC/B,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC;YACpC,CAAC,KAAK,CAAC,cAAc,CAAC,KAAK,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC;YACnE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,4EAA4E,CAAC,IAAI,CAChF,KAAK,CAAC,SAAS,CAChB;YACD,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;YACnC,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;YAC7C,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC,IAAI,OAAO,KAAK,CAAC,YAAY,KAAK,QAAQ,CAAC;YAEhF,OAAO;IACX,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,wBAAwB;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO;AACT,CAAC;AACD,KAAK,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe;IAC3D,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACpE,MAAM,EAAE,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,IACE,CAAC,EAAE,CAAC,WAAW,EAAE;QACjB,EAAE,CAAC,cAAc,EAAE;QACnB,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;QAEpE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,uBAAuB,CAAC,IAAI,EAAE,OAAO,KAAK,SAAS,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IACjF,CAAC;AACH,CAAC;AACD,KAAK,UAAU,WAAW,CAAC,IAAY;IACrC,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,CAAC,CAAC;IACzE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;QAC7B,IACE,CAAC,EAAE,CAAC,MAAM,EAAE;YACZ,EAAE,CAAC,IAAI,GAAG,EAAE,GAAG,IAAI;YACnB,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC;YAEpE,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;QAC5C,OAAO,MAAM,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;IACrB,CAAC;AACH,CAAC;AACD,KAAK,UAAU,eAAe,CAAC,IAAY,EAAE,KAA6B;IACxE,MAAM,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9D,MAAM,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IACrD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,UAAU,EAAE,EAAE,CAAC;IACvC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QAC3C,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,CAAC;QACrD,CAAC;gBAAS,CAAC;YACT,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QACrB,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAC3B,CAAC;YAAS,CAAC;QACT,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IAClC,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,KAQzC;IACC,MAAM,QAAQ,GAAG,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,CAAC,QAAQ;QAAE,OAAO;IACtB,IAAI,IAAwB,CAAC;IAC7B,IAAI,MAAM,GAAG,oBAAoB,CAAC;IAClC,IAAI,OAAO,GAAsC,QAAQ,CAAC;IAC1D,IAAI,MAAM,GAAG,uBAAuB,CAAC;IACrC,MAAM,SAAS,GACb,OAAO,QAAQ,CAAC,SAAS,KAAK,QAAQ,IAAI,QAAQ,CAAC,SAAS,CAAC,MAAM,IAAI,IAAI;QACzE,CAAC,CAAC,QAAQ,CAAC,SAAS;QACpB,CAAC,CAAC,SAAS,CAAC;IAChB,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,GAAG;YAAE,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QACxD,iFAAiF;QACjF,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CACtB,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,oBAAoB,CAAC,CAAC,CACxE,CAAC;QACF,MAAM,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/C,IACE,CAAC,KAAK,CAAC,QAAQ;YACf,MAAM,KAAK,KAAK,CAAC,QAAQ;YACzB,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI;YACxB,IAAI,CAAC,aAAa,KAAK,KAAK,CAAC,aAAa;YAC1C,KAAK,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE;YAC7B,CAAC,KAAK,CAAC,aAAa;YAEpB,MAAM,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;QAC/C,IAAI,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;QAC3C,MAAM,EAAE,2BAA2B,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;QACzE,MAAM,QAAQ,GAAG,MAAM,2BAA2B,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;QAC9E,IAAI,QAAQ,CAAC,IAAI,KAAK,iBAAiB,IAAI,IAAI,KAAK,CAAC,MAAM,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,IAAI,CAAC,SAAS;YAAE,MAAM,IAAI,KAAK,CAAC,uBAAuB,CAAC,CAAC;QACzD,MAAM,OAAO,GAAG,MAAM,IAAI,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE;YACtF,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;QACtD,CAAC,CAAC,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;YACjF,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YAC5D,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,CAAC,QAAQ,EAChB,CAAC,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,EAC/C;gBACE,GAAG,EAAE,IAAI;gBACT,KAAK,EAAE,KAAK;gBACZ,OAAO,EAAE,MAAM;gBACf,UAAU,EAAE,SAAS;gBACrB,SAAS,EAAE,EAAE,GAAG,IAAI;gBACpB,iFAAiF;gBACjF,GAAG,EAAE,MAAM,CAAC,WAAW,CACrB;oBACE,MAAM;oBACN,aAAa;oBACb,cAAc;oBACd,gBAAgB;oBAChB,oBAAoB;oBACpB,iBAAiB;oBACjB,uBAAuB;oBACvB,uBAAuB;oBACvB,YAAY;oBACZ,MAAM;oBACN,KAAK;oBACL,QAAQ;iBACT,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CACtF;aACF,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,EAAE;gBAChB,IAAI,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;oBAC7C,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,eAAe,CAAC,CAAC,CAAC;gBAC5C,IAAI,CAAC;oBACH,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;gBAC9B,CAAC;gBAAC,MAAM,CAAC;oBACP,MAAM,CAAC,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC,CAAC;gBAC3C,CAAC;YACH,CAAC,CACF,CAAC;YACF,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACnC,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;QAClD,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5D,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,OAAO,GAAG,MAAM,CAAC;YACjB,MAAM,GAAG,UAAU,CAAC;YACpB,MAAM,GAAG,mEAAmE,CAAC;QAC/E,CAAC;aAAM,IACL,CAAC,iBAAiB,EAAE,iBAAiB,EAAE,wBAAwB,CAAC,CAAC,QAAQ,CACvE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CACtB,EACD,CAAC;YACD,OAAO,GAAG,iBAAiB,CAAC;YAC5B,MAAM,GAAG,iBAAiB,CAAC;YAC3B,MAAM;gBACJ,MAAM,CAAC,MAAM,KAAK,qBAAqB;oBACvC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,cAAc,CAAC;wBACnC,MAAM,CAAC,cAAc,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;oBACtD,CAAC,CAAC,qBAAqB;oBACvB,CAAC,CAAC,MAAM,CAAC,cAAc;wBACrB,CAAC,CAAC,4DAA4D,mBAAmB,CAAC,MAAM,CAAC,cAAc,CAAC,GAAG;wBAC3G,CAAC,CAAC,oBAAoB,CAAC;QAC/B,CAAC;;YAAM,MAAM,IAAI,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzD,MAAM,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,oBAAoB,CAAC;QAC9D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,MAAM,4BAA4B,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,CAAC;QACH,MAAM,eAAe,CAAC,KAAK,CAAC,SAAS,EAAE;YACrC,SAAS;YACT,OAAO;YACP,IAAI,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YAC9B,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI;YAChF,MAAM;YACN,MAAM;SACP,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,uDAAuD,CAAC,CAAC;IAChF,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,wFAAwF;AACxF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,IAAY;IACpD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IAC5C,MAAM,OAAO,GAA6B,EAAE,CAAC;IAC7C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,EAAE,IAAI,MAAM,CAAC;IACzC,KAAK,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QAChD,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,EAAE,EAAE,YAAY,IAAI,IAAI,GAAG,EAAE,CAAC,CAAC;QAC5D,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,CAAC;YACpC,IAAI,IAAI,CAAC,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE;gBAAE,SAAS;YAC3D,KAAK,MAAM,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5C,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,SAAS;gBAC3C,IAAI,CAAC;oBACH,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE;wBAAE,SAAS;oBACpE,MAAM,UAAU,GAAG,IAAI,CAAC,KAAK,CAC3B,MAAM,WAAW,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,EAAE,oBAAoB,CAAC,CAAC,CAC/D,CAAC;oBACF,IACE,CAAC,UAAU,CAAC,QAAQ,KAAK,QAAQ,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,CAAC;wBAClE,CAAC,MAAM,EAAE,iBAAiB,EAAE,QAAQ,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,OAAO,CAAC;wBAClE,OAAO,UAAU,CAAC,MAAM,KAAK,QAAQ;wBACrC,UAAU,CAAC,MAAM,CAAC,MAAM,GAAG,IAAI;wBAC/B,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI;wBAE9D,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;gBAC7B,CAAC;gBAAC,MAAM,CAAC;oBACP,+DAA+D;gBACjE,CAAC;YACH,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IACD,iFAAiF;IACjF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAChE,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AACnE,CAAC"}

package/dist/protectedPaths.d.ts

@@ -0,0 +1,9 @@
+type Platform = NodeJS.Platform;
+/** Local state and credential locations that Mnemonik must never scan. */
+export declare function protectedLocalPaths(platform?: Platform, env?: NodeJS.ProcessEnv, home?: string): string[];
+/** True when candidate is the protected path itself or lies below it. */
+export declare function isProtectedLocalPath(candidate: string, protectedPaths?: readonly string[], platform?: Platform): boolean;
+/** Protected paths equal to or below root, for consent auto-exclusions. */
+export declare function protectedPathsWithinRoot(root: string, protectedPaths?: readonly string[], platform?: Platform): string[];
+export {};
+//# sourceMappingURL=protectedPaths.d.ts.map

package/dist/protectedPaths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedPaths.d.ts","sourceRoot":"","sources":["../src/protectedPaths.ts"],"names":[],"mappings":"AAGA,KAAK,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;AAMhC,0EAA0E;AAC1E,wBAAgB,mBAAmB,CACjC,QAAQ,GAAE,QAA2B,EACrC,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,GAAE,MAAkB,GACvB,MAAM,EAAE,CAwCV;AAQD,yEAAyE;AACzE,wBAAgB,oBAAoB,CAClC,SAAS,EAAE,MAAM,EACjB,cAAc,GAAE,SAAS,MAAM,EAA0B,EACzD,QAAQ,GAAE,QAA2B,GACpC,OAAO,CAWT;AAED,2EAA2E;AAC3E,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,cAAc,GAAE,SAAS,MAAM,EAA0B,EACzD,QAAQ,GAAE,QAA2B,GACpC,MAAM,EAAE,CAEV"}

package/dist/protectedPaths.js

@@ -0,0 +1,66 @@
+import { homedir } from 'node:os';
+import { posix, win32 } from 'node:path';
+function pathsFor(platform) {
+    return platform === 'win32' ? win32 : posix;
+}
+/** Local state and credential locations that Mnemonik must never scan. */
+export function protectedLocalPaths(platform = process.platform, env = process.env, home = homedir()) {
+    const path = pathsFor(platform);
+    const localAppData = env.LOCALAPPDATA || win32.join(home, 'AppData', 'Local');
+    const appData = env.APPDATA || win32.join(home, 'AppData', 'Roaming');
+    const state = env.MNEMONIK_STATE_DIR ||
+        (platform === 'win32'
+            ? win32.join(localAppData, 'Mnemonik')
+            : platform === 'darwin'
+                ? posix.join(home, 'Library', 'Application Support', 'Mnemonik')
+                : posix.join(env.XDG_STATE_HOME || posix.join(home, '.local', 'state'), 'mnemonik'));
+    const common = [
+        state,
+        path.join(home, '.mnemonik'),
+        path.join(home, '.claude', '.credentials.json'),
+        path.join(home, '.codex', 'auth.json'),
+        path.join(home, '.cursor', 'mcp.json'),
+        path.join(home, '.grok', 'mcp_credentials.json'),
+    ];
+    const osPaths = platform === 'darwin'
+        ? [path.join(home, 'Library', 'Keychains')]
+        : platform === 'win32'
+            ? [
+                win32.join(appData, 'Microsoft', 'Credentials'),
+                win32.join(localAppData, 'Microsoft', 'Credentials'),
+                win32.join(appData, 'Microsoft', 'Protect'),
+            ]
+            : [
+                path.join(home, '.local', 'share', 'keyrings'),
+                path.join(home, '.gnupg'),
+                path.join(home, '.ssh'),
+                path.join(home, '.aws'),
+                path.join(home, '.config', 'gcloud'),
+                path.join(home, '.docker', 'config.json'),
+                path.join(home, '.npmrc'),
+                path.join(home, '.netrc'),
+                path.join(home, '.pypirc'),
+            ];
+    return [...new Set([...common, ...osPaths])];
+}
+function comparable(value, platform) {
+    const path = pathsFor(platform);
+    const normalized = path.resolve(value);
+    return platform === 'win32' || platform === 'darwin' ? normalized.toLowerCase() : normalized;
+}
+/** True when candidate is the protected path itself or lies below it. */
+export function isProtectedLocalPath(candidate, protectedPaths = protectedLocalPaths(), platform = process.platform) {
+    const path = pathsFor(platform);
+    const target = comparable(candidate, platform);
+    return protectedPaths.some((protectedPath) => {
+        const parent = comparable(protectedPath, platform);
+        const relative = path.relative(parent, target);
+        return (relative === '' ||
+            (!relative.startsWith(`..${path.sep}`) && relative !== '..' && !path.isAbsolute(relative)));
+    });
+}
+/** Protected paths equal to or below root, for consent auto-exclusions. */
+export function protectedPathsWithinRoot(root, protectedPaths = protectedLocalPaths(), platform = process.platform) {
+    return protectedPaths.filter((candidate) => isProtectedLocalPath(candidate, [root], platform));
+}
+//# sourceMappingURL=protectedPaths.js.map

package/dist/protectedPaths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protectedPaths.js","sourceRoot":"","sources":["../src/protectedPaths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAqB,MAAM,WAAW,CAAC;AAI5D,SAAS,QAAQ,CAAC,QAAkB;IAClC,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,mBAAmB,CACjC,QAAQ,GAAa,OAAO,CAAC,QAAQ,EACrC,GAAG,GAAsB,OAAO,CAAC,GAAG,EACpC,IAAI,GAAW,OAAO,EAAE;IAExB,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,YAAY,GAAG,GAAG,CAAC,YAAY,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC9E,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC;IACtE,MAAM,KAAK,GACT,GAAG,CAAC,kBAAkB;QACtB,CAAC,QAAQ,KAAK,OAAO;YACnB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,UAAU,CAAC;YACtC,CAAC,CAAC,QAAQ,KAAK,QAAQ;gBACrB,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,qBAAqB,EAAE,UAAU,CAAC;gBAChE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,cAAc,IAAI,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG;QACb,KAAK;QACL,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,WAAW,CAAC;QAC5B,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC/C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,CAAC;QACtC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,sBAAsB,CAAC;KACjD,CAAC;IACF,MAAM,OAAO,GACX,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;QAC3C,CAAC,CAAC,QAAQ,KAAK,OAAO;YACpB,CAAC,CAAC;gBACE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,aAAa,CAAC;gBAC/C,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,WAAW,EAAE,aAAa,CAAC;gBACpD,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,EAAE,SAAS,CAAC;aAC5C;YACH,CAAC,CAAC;gBACE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC;gBAC9C,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC;gBACvB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,CAAC;gBACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,aAAa,CAAC;gBACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;gBACzB,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;aAC3B,CAAC;IACV,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,MAAM,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED,SAAS,UAAU,CAAC,KAAa,EAAE,QAAkB;IACnD,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACvC,OAAO,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC;AAC/F,CAAC;AAED,yEAAyE;AACzE,MAAM,UAAU,oBAAoB,CAClC,SAAiB,EACjB,cAAc,GAAsB,mBAAmB,EAAE,EACzD,QAAQ,GAAa,OAAO,CAAC,QAAQ;IAErC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,UAAU,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC/C,OAAO,cAAc,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,EAAE;QAC3C,MAAM,MAAM,GAAG,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;QACnD,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAC/C,OAAO,CACL,QAAQ,KAAK,EAAE;YACf,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAC3F,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB,CACtC,IAAY,EACZ,cAAc,GAAsB,mBAAmB,EAAE,EACzD,QAAQ,GAAa,OAAO,CAAC,QAAQ;IAErC,OAAO,cAAc,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,oBAAoB,CAAC,SAAS,EAAE,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC,CAAC;AACjG,CAAC"}