@productbrain/cli 0.1.0-beta.1138 → 0.1.0-beta.11385

package/dist/lib/profiles.js

@@ -16,12 +16,23 @@ const ACTIVE_PROFILE_PATH = resolve(HOME_CONFIG_DIR, 'active-profile');
 const LEGACY_ENV_PATH = resolve(HOME_CONFIG_DIR, '.env');
 /** Profile name validation: lowercase alphanumeric + hyphens, 1-32 chars. */
 const PROFILE_NAME_RE = /^[a-z0-9][a-z0-9-]{0,31}$/;
-function validateProfileName(name) {
+/**
+ * Validate a profile name — lowercase alphanumeric + hyphens, 1-32 chars, no path
+ * separators. profilePath() runs it on every name, so no caller can turn an untrusted name
+ * (`PB_PROFILE`, a committed pin, the active-profile file) into a path outside the profiles
+ * folder (TEN-4503).
+ */
+export function validateProfileName(name) {
     if (!PROFILE_NAME_RE.test(name)) {
         throw new CLIError(`Invalid profile name "${name}". Must be 1-32 chars, lowercase alphanumeric + hyphens, starting with alphanumeric.`, { code: ErrorCode.PROFILE_NAME_INVALID, category: 'profile' });
     }
 }
-function profilePath(name) {
+/**
+ * The one place a profile name becomes a file path. It validates the name first, so
+ * `../x` or an absolute name is refused before any read or write (TEN-4503).
+ */
+export function profilePath(name) {
+    validateProfileName(name);
     return resolve(PROFILES_DIR, `${name}.env`);
 }
 function parseEnvFile(content) {
@@ -49,9 +60,12 @@ function readProfileFile(path) {
 /**
  * Auto-migrate legacy ~/.config/productbrain/.env to profiles/default.env.
  * Only runs if legacy file exists AND no profiles directory exists.
- * If profiles already exist, silently removes the legacy .env (TEN-1343).
+ * If profiles already exist, silently removes the legacy .env (TEN-1343) — so any caller
+ * that might CREATE the profiles dir before this runs (e.g. `pb connect`'s named-profile
+ * create path) must call this FIRST, or the legacy file is deleted, unmigrated (Codex
+ * review, WP-628 P1).
  */
-function autoMigrate() {
+export function autoMigrate() {
     if (existsSync(PROFILES_DIR)) {
         if (existsSync(LEGACY_ENV_PATH))
             unlinkSync(LEGACY_ENV_PATH);
@@ -92,12 +106,17 @@ export function getActiveProfile() {
         return envProfile;
     return getGlobalActiveProfile();
 }
-/** Create a new profile. */
-export function createProfile(name, apiKey, siteUrl) {
-    validateProfileName(name);
-    if (existsSync(profilePath(name))) {
-        throw new CLIError(`Profile "${name}" already exists.`, { code: ErrorCode.PROFILE_ALREADY_EXISTS, category: 'profile' });
-    }
+/**
+ * Create a new profile.
+ *
+ * TEN-2851: refuses to overwrite an existing profile file by default — a caller wanting to
+ * replace an occupied profile's credentials must pass `{ overwrite: true }` explicitly (the
+ * act stays deliberate at every call site, never a silent side-effect of a name collision).
+ * `pb connect` is the one caller that passes it, and only for the profile this folder's own
+ * pin already names — a key rotation (TASK-638, connect.ts saveKeyAsProfile).
+ */
+export function createProfile(name, apiKey, siteUrl, opts) {
+    const path = profilePath(name);
     mkdirSync(PROFILES_DIR, { recursive: true });
     const lines = [
         `# Product Brain CLI profile: ${name}`,
@@ -107,15 +126,41 @@ export function createProfile(name, apiKey, siteUrl) {
         lines.push(`CONVEX_SITE_URL=${siteUrl}`);
     }
     lines.push('');
-    writeFileSync(profilePath(name), lines.join('\n'), { mode: 0o600 });
-    // If this is the first profile, make it active
-    if (!existsSync(ACTIVE_PROFILE_PATH)) {
+    const content = lines.join('\n');
+    // TEN-2851 TOCTOU (Copilot review): an existsSync() pre-check followed by a plain 'w'
+    // write leaves a race window — a concurrent process can create the file between the
+    // check and the write, and 'w' would silently truncate it. When NOT overwriting, use the
+    // exclusive-create flag 'wx' so the filesystem is the atomic guard: EEXIST (whether from
+    // a pre-existing file or one created in the race window) surfaces as the SAME
+    // PROFILE_ALREADY_EXISTS error every existing caller already handles. `{ overwrite: true }`
+    // is an explicit replace of this folder's own profile (see connect.ts saveKeyAsProfile) and
+    // intentionally keeps the plain 'w' flag — it means to replace whatever is there.
+    if (opts?.overwrite) {
+        writeFileSync(path, content, { mode: 0o600 });
+    }
+    else {
+        try {
+            writeFileSync(path, content, { mode: 0o600, flag: 'wx' });
+        }
+        catch (err) {
+            if (err && typeof err === 'object' && 'code' in err && err.code === 'EEXIST') {
+                throw new CLIError(`Profile "${name}" already exists.`, { code: ErrorCode.PROFILE_ALREADY_EXISTS, category: 'profile' });
+            }
+            throw err;
+        }
+    }
+    // If this is the first profile, make it active. Scoped to !opts?.overwrite (Codex review,
+    // WP-628 P2): an overwrite call means the profile ALREADY existed — it can never be "the
+    // first profile ever created" — so it must never claim a missing active-profile marker.
+    // Without this guard, confirming an overwrite while that marker happens to be absent would
+    // silently activate the overwritten target globally, contradicting this function's own
+    // "does not activate globally" contract (connect.ts saveKeyAsProfile docstring).
+    if (!opts?.overwrite && !existsSync(ACTIVE_PROFILE_PATH)) {
         writeFileSync(ACTIVE_PROFILE_PATH, name, { mode: 0o600 });
     }
 }
 /** Switch the active profile. */
 export function useProfile(name) {
-    validateProfileName(name);
     if (!existsSync(profilePath(name))) {
         throw new CLIError(`Profile "${name}" does not exist.`, { code: ErrorCode.PROFILE_NOT_FOUND, category: 'profile' });
     }
@@ -124,7 +169,6 @@ export function useProfile(name) {
 }
 /** Delete a profile. Cannot delete the last profile or the active profile. */
 export function deleteProfile(name) {
-    validateProfileName(name);
     const path = profilePath(name);
     if (!existsSync(path)) {
         throw new CLIError(`Profile "${name}" does not exist.`, { code: ErrorCode.PROFILE_NOT_FOUND, category: 'profile' });
@@ -151,7 +195,7 @@ export function resolveProfileConfig() {
     if (envProfile) {
         const config = readProfileFile(profilePath(envProfile));
         if (config)
-            return config;
+            return { ...config, profileName: envProfile };
     }
     // 2. Check active-profile file
     if (existsSync(ACTIVE_PROFILE_PATH)) {
@@ -159,30 +203,37 @@ export function resolveProfileConfig() {
         if (name) {
             const config = readProfileFile(profilePath(name));
             if (config)
-                return config;
+                return { ...config, profileName: name };
         }
     }
     // 3. Check "default" profile
     {
         const config = readProfileFile(profilePath('default'));
         if (config)
-            return config;
+            return { ...config, profileName: 'default' };
     }
-    // 4. Fall back to legacy .env
+    // 4. Fall back to legacy .env — not a named profile, so no profileName.
     {
         const config = readProfileFile(LEGACY_ENV_PATH);
         if (config)
-            return config;
+            return { ...config, profileName: null };
     }
     return null;
 }
 /**
  * Resolve config for a specific named profile.
- * Returns null if the profile doesn't exist.
+ * Returns null both when the profile file is absent AND when it exists but fails to parse
+ * (missing/empty PRODUCTBRAIN_API_KEY) — those two cases are NOT the same thing to a caller
+ * deciding whether it's safe to create; use `profileFileExists()` to tell them apart
+ * (Codex review, WP-628 P2).
  */
 export function resolveNamedProfileConfig(name) {
     return readProfileFile(profilePath(name));
 }
+/** Does a profile FILE exist at this name, independent of whether it parses (see above). */
+export function profileFileExists(name) {
+    return existsSync(profilePath(name));
+}
 // Exported for testing
 export { PROFILES_DIR, ACTIVE_PROFILE_PATH, LEGACY_ENV_PATH, HOME_CONFIG_DIR };
 //# sourceMappingURL=profiles.js.map

package/dist/lib/profiles.js.map

@@ -1 +1 @@
-{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/lib/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACvE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAOpD,SAAS,mBAAmB,CAAC,IAAY;IACvC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAChB,yBAAyB,IAAI,sFAAsF,EACnH,EAAE,IAAI,EAAE,SAAS,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,WAAW,CAAC,IAAY;IAC/B,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,SAAS;KAC9C,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,WAAW;IAClB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,eAAe,CAAC;YAAE,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACtD,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,aAAa,CAAC,mBAAmB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,YAAY;IAC1B,WAAW,EAAE,CAAC;IACd,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB;IACpC,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED,4BAA4B;AAC5B,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,MAAc,EAAE,OAAgB;IAC1E,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClC,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC3H,CAAC;IAED,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG;QACZ,gCAAgC,IAAI,EAAE;QACtC,wBAAwB,MAAM,EAAE;KACjC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAEf,aAAa,CAAC,WAAW,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAEpE,+CAA+C;IAC/C,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACrC,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAE1B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,mCAAmC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,IAAI,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,6CAA6C,EAAE,CAAC,CAAC;IAC1N,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,WAAW,EAAE,CAAC;IAEd,8BAA8B;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,MAAM;gBAAE,OAAO,MAAM,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,8BAA8B;IAC9B,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,MAAM,CAAC;IAC5B,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,uBAAuB;AACvB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/lib/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,IAAI,CAAC;AACjG,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,MAAM,eAAe,GAAG,OAAO,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,cAAc,CAAC,CAAC;AACtE,MAAM,YAAY,GAAG,OAAO,CAAC,eAAe,EAAE,UAAU,CAAC,CAAC;AAC1D,MAAM,mBAAmB,GAAG,OAAO,CAAC,eAAe,EAAE,gBAAgB,CAAC,CAAC;AACvE,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;AAEzD,6EAA6E;AAC7E,MAAM,eAAe,GAAG,2BAA2B,CAAC;AAoBpD;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,QAAQ,CAChB,yBAAyB,IAAI,sFAAsF,EACnH,EAAE,IAAI,EAAE,SAAS,CAAC,oBAAoB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAC9D,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,OAAO,CAAC,YAAY,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,YAAY,CAAC,OAAe;IACnC,MAAM,IAAI,GAA2B,EAAE,CAAC;IACxC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC;YACN,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC;QAC9D,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,IAAY;IACnC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,MAAM,IAAI,GAAG,YAAY,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,sBAAsB,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,OAAO;QACL,MAAM;QACN,OAAO,EAAE,IAAI,CAAC,iBAAiB,CAAC,IAAI,SAAS;KAC9C,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW;IACzB,IAAI,UAAU,CAAC,YAAY,CAAC,EAAE,CAAC;QAC7B,IAAI,UAAU,CAAC,eAAe,CAAC;YAAE,UAAU,CAAC,eAAe,CAAC,CAAC;QAC7D,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,eAAe,CAAC;QAAE,OAAO,KAAK,CAAC;IAE/C,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,OAAO,GAAG,YAAY,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC;IACtD,aAAa,CAAC,WAAW,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChE,aAAa,CAAC,mBAAmB,EAAE,SAAS,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/D,UAAU,CAAC,eAAe,CAAC,CAAC;IAC5B,OAAO,IAAI,CAAC;AACd,CAAC;AAED,uCAAuC;AACvC,MAAM,UAAU,YAAY;IAC1B,WAAW,EAAE,CAAC;IACd,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,OAAO,EAAE,CAAC;IACzC,OAAO,WAAW,CAAC,YAAY,CAAC;SAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;SACjC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;SACnC,IAAI,EAAE,CAAC;AACZ,CAAC;AAED,qEAAqE;AACrE,MAAM,UAAU,sBAAsB;IACpC,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI;YAAE,OAAO,IAAI,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU;QAAE,OAAO,UAAU,CAAC;IAClC,OAAO,sBAAsB,EAAE,CAAC;AAClC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,aAAa,CAC3B,IAAY,EACZ,MAAc,EACd,OAAgB,EAChB,IAA8B;IAE9B,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,SAAS,CAAC,YAAY,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE7C,MAAM,KAAK,GAAG;QACZ,gCAAgC,IAAI,EAAE;QACtC,wBAAwB,MAAM,EAAE;KACjC,CAAC;IACF,IAAI,OAAO,EAAE,CAAC;QACZ,KAAK,CAAC,IAAI,CAAC,mBAAmB,OAAO,EAAE,CAAC,CAAC;IAC3C,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACf,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEjC,sFAAsF;IACtF,oFAAoF;IACpF,yFAAyF;IACzF,yFAAyF;IACzF,8EAA8E;IAC9E,4FAA4F;IAC5F,4FAA4F;IAC5F,kFAAkF;IAClF,IAAI,IAAI,EAAE,SAAS,EAAE,CAAC;QACpB,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAChD,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,aAAa,CAAC,IAAI,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAY,EAAE,CAAC;YACtB,IAAI,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,MAAM,IAAI,GAAG,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBACxG,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,sBAAsB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;YAC3H,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,0FAA0F;IAC1F,yFAAyF;IACzF,wFAAwF;IACxF,2FAA2F;IAC3F,uFAAuF;IACvF,iFAAiF;IACjF,IAAI,CAAC,IAAI,EAAE,SAAS,IAAI,CAAC,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACzD,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QACnC,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,SAAS,CAAC,eAAe,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAChD,aAAa,CAAC,mBAAmB,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED,8EAA8E;AAC9E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,QAAQ,CAAC,YAAY,IAAI,mBAAmB,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IACtH,CAAC;IAED,MAAM,QAAQ,GAAG,YAAY,EAAE,CAAC;IAChC,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,QAAQ,CAAC,mCAAmC,IAAI,IAAI,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,eAAe,EAAE,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC;IAC5H,CAAC;IAED,MAAM,MAAM,GAAG,gBAAgB,EAAE,CAAC;IAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,qCAAqC,IAAI,qCAAqC,EAAE,EAAE,IAAI,EAAE,SAAS,CAAC,iBAAiB,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,6CAA6C,EAAE,CAAC,CAAC;IAC1N,CAAC;IAED,UAAU,CAAC,IAAI,CAAC,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB;IAClC,WAAW,EAAE,CAAC;IAEd,8BAA8B;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC;IAClD,IAAI,UAAU,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,CAAC;QACxD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IAC5D,CAAC;IAED,+BAA+B;IAC/B,IAAI,UAAU,CAAC,mBAAmB,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,GAAG,YAAY,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;YAClD,IAAI,MAAM;gBAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;QACtD,CAAC;IACH,CAAC;IAED,6BAA6B;IAC7B,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;IAC3D,CAAC;IAED,wEAAwE;IACxE,CAAC;QACC,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,CAAC,CAAC;QAChD,IAAI,MAAM;YAAE,OAAO,EAAE,GAAG,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB,CAAC,IAAY;IACpD,OAAO,eAAe,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,OAAO,UAAU,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;AACvC,CAAC;AAED,uBAAuB;AACvB,OAAO,EAAE,YAAY,EAAE,mBAAmB,EAAE,eAAe,EAAE,eAAe,EAAE,CAAC"}

package/dist/lib/projectConfig.d.ts

@@ -0,0 +1,130 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem and git's index, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): its PRESENCE declares a Product Brain project. The CLI never reads
+ *   its siteUrl: a cloned repo controls that file, so it must not route a key (TEN-4500).
+ * - config.local.json (gitignored): profile pin, and an optional acting role (DEC-1961) —
+ *   machine-local, never committed; a copy git tracks is refused (TEN-4501). Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+/** Local project config shape — .productbrain/config.local.json (gitignored, machine-local) */
+export interface LocalProjectConfig {
+    profile?: string;
+    /** Direct preview API key — set by `npm run pb:preview`, cleared by `npm run pb:real`. */
+    apiKey?: string;
+    /**
+     * An `apiKey` was present but failed the `API_KEY_PREFIX` bar, so it was not loaded.
+     * Kept apart from `apiKey` so a malformed key can never bind, while diagnostics can still
+     * say "malformed" instead of misreporting it as absent.
+     */
+    apiKeyMalformed?: boolean;
+    /** Preview site URL — set alongside apiKey by `npm run pb:preview`. */
+    siteUrl?: string;
+    /** Marks this config as preview-bound; the CLI shows a loud banner on every command. */
+    preview?: boolean;
+    /** Human-readable preview workspace name for the banner (e.g. "Preview Workspace"). */
+    workspaceName?: string;
+    /**
+     * The key file `npm run pb:preview` bound and the facts it read from that file (TASK-809, TEN-4883).
+     * The stale-key refresh re-reads only this file, and only while it still says these facts.
+     */
+    previewKey?: PreviewKeyBinding;
+    /**
+     * The role this folder's sessions act as (DEC-1961, TASK-639): a role id such as ROL-12, added
+     * by hand beside `profile`. Optional; absent is the ordinary state. It only labels attribution,
+     * and the kernel decides whether the person holds it (RULE-128).
+     */
+    role?: string;
+    /** `role` was present but not a non-empty string. Kept apart so it can never bind a role. */
+    roleMalformed?: boolean;
+}
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed project declaration) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export declare function findProjectRoot(startDir: string): string | null;
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. A content reader
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export declare function projectConfigExists(): boolean;
+/**
+ * Is `<root>/<rel>` tracked in git's index? A TRACKED file is never ignored regardless of
+ * .gitignore. `git ls-files -- <path>` prints the path when tracked, nothing when not. Not a git
+ * work tree, or git unavailable → null. Never throws. Lives here, not in productbrain-files.ts
+ * (which re-exports it), so the pin reader can use it without an import cycle.
+ */
+export declare function makeGitTrackedChecker(root: string): (rel: string) => boolean | null;
+/**
+ * What `npm run pb:preview` recorded about the key file it bound (scripts/pb-binding.mjs writes it as
+ * previewKeyFile, previewPerson, previewWorkspaceSlug, previewRole, copied from that file).
+ */
+export interface PreviewKeyBinding {
+    file: string;
+    person: string;
+    workspaceSlug: string;
+    role: string;
+}
+/**
+ * TEN-4883: read the bound key file for the stale-key refresh, or null. The seed writes many
+ * preview-*.json sidecars for other people and workspaces (preview-chain.json, preview-readonly.json,
+ * …), so the file is accepted only while its person, workspaceSlug and role still equal what the
+ * binding recorded from it: a config naming another sidecar can never cross the person or workspace.
+ */
+export declare function readBoundPreviewKey(projectRoot: string, binding: PreviewKeyBinding): {
+    apiKey?: unknown;
+    siteUrl?: unknown;
+} | null;
+/**
+ * TEN-4501 (TASK-639): a config.local.json that git tracks is committed, so its pin, its preview
+ * key and its role travel to every clone. Refuse to read it. Only a confirmed `true` refuses:
+ * outside a git work tree there is no index for the file to be in. A tracked pin deleted from the
+ * working tree is refused too: the next pin write would recreate a committed file (TASK-648).
+ * pb connect calls this before its redeem for the folder it is about to pin (WP-810).
+ */
+export declare function refuseTrackedPin(projectRoot: string): void;
+/** The home folder is no project: a pin or hooks written there bind every folder under it (TASK-562). */
+export declare function isHomeFolder(folder: string, home?: string): boolean;
+/** The refusal pb connect gives in the home folder, pinned word for word by its test (RULE-662). */
+export declare const HOME_FOLDER_REFUSAL = "Run pb connect in your project folder, not your home folder.";
+/**
+ * TASK-562: a new terminal opens in the home folder, and a pin there binds every folder under it
+ * (findProjectRoot walks up to it). pb connect calls this before its redeem, so the token still works.
+ */
+export declare function refuseHomeFolder(folder: string): void;
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`), the optional hand-added `role` (DEC-1961), and any
+ * preview-binding fields (`apiKey`, `siteUrl`, `preview`, `workspaceName`, `previewKey`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON. Throws only when git tracks the file, even one deleted from the
+ * working tree (refuseTrackedPin).
+ */
+export declare function readLocalProjectConfig(): LocalProjectConfig | null;
+//# sourceMappingURL=projectConfig.d.ts.map

package/dist/lib/projectConfig.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.d.ts","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AASH,+FAA+F;AAC/F,MAAM,WAAW,kBAAkB;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;OAIG;IACH,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,wFAAwF;IACxF,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,uFAAuF;IACvF,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;OAGG;IACH,UAAU,CAAC,EAAE,iBAAiB,CAAC;IAC/B;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,6FAA6F;IAC7F,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,eAAe,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAgB/D;AAED;;;;;;;;;GASG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAI7C;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,IAAI,EAAE,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,GAAG,IAAI,CASnF;AAQD;;;GAGG;AACH,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;CACd;AAWD;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE,iBAAiB,GAAG;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,OAAO,CAAA;CAAE,GAAG,IAAI,CAYnI;AAKD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAY1D;AAKD,yGAAyG;AACzG,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE,MAAkB,GAAG,OAAO,CAE9E;AAED,oGAAoG;AACpG,eAAO,MAAM,mBAAmB,iEAAiE,CAAC;AAElG;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAOrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,IAAI,kBAAkB,GAAG,IAAI,CA6DlE"}

package/dist/lib/projectConfig.js

@@ -0,0 +1,252 @@
+/**
+ * The repo's own Product Brain config files — locating them and reading what they declare.
+ *
+ * Split out of config.ts under STD-2 / DEC-1504. The seam is deliberate and worth keeping:
+ * this module answers "what does THIS REPO say about itself" from the filesystem and git's index, while
+ * config.ts answers "which credential do we therefore use". Nothing here reads a credential
+ * store, an env var, or the global active profile — so it has no dependency on config.ts and
+ * cannot participate in an import cycle.
+ *
+ * Split config design:
+ * - config.json (committed): its PRESENCE declares a Product Brain project. The CLI never reads
+ *   its siteUrl: a cloned repo controls that file, so it must not route a key (TEN-4500).
+ * - config.local.json (gitignored): profile pin, and an optional acting role (DEC-1961) —
+ *   machine-local, never committed; a copy git tracks is refused (TEN-4501). Because it
+ *   is gitignored, a fresh clone or worktree does NOT inherit it (INS-2462) — the caller must
+ *   treat "no pin" as an explicit state, never as permission to guess a workspace.
+ */
+import { readFileSync, existsSync, realpathSync } from 'fs';
+import { resolve } from 'path';
+import { homedir } from 'os';
+import { execFileSync } from 'child_process';
+import { API_KEY_PREFIX } from './tokenConstants.js';
+import { CLIError, ErrorCode } from './errors.js';
+/**
+ * Walk up the directory tree (git-style) to find the nearest CLI project root.
+ *
+ * A `.productbrain/` directory only counts as a CLI project root when it carries
+ * CLI configuration — `config.json` (committed project declaration) or
+ * `config.local.json` (machine-local profile pin or preview binding). A
+ * projection-only `.productbrain/` written by `pb handshake` (briefing.md,
+ * context.md, rules/, etc.) does NOT count — otherwise a subrepo like
+ * `packages/cli/.productbrain/` would shadow the real configuring root and
+ * `npm run pb:preview` writes (which always land at the repo-root
+ * `.productbrain/`) would be invisible to commands run from the subrepo.
+ *
+ * Stops at home directory or filesystem root. Returns the directory containing
+ * a config-bearing `.productbrain/`, or null if not found.
+ */
+export function findProjectRoot(startDir) {
+    let dir = startDir;
+    const home = homedir();
+    while (true) {
+        const pbDir = resolve(dir, '.productbrain');
+        if (existsSync(pbDir) &&
+            (existsSync(resolve(pbDir, 'config.json')) ||
+                existsSync(resolve(pbDir, 'config.local.json')))) {
+            return dir;
+        }
+        const parent = resolve(dir, '..');
+        if (parent === dir || dir === home)
+            return null;
+        dir = parent;
+    }
+}
+/**
+ * Does the committed `.productbrain/config.json` EXIST, independent of whether it parses?
+ *
+ * The project's self-declaration is the file's PRESENCE, not its contents. A content reader
+ * returns null for a malformed or non-object file exactly as it does for an absent one, so a
+ * caller asking "is this a project" through that value reads a DAMAGED declaration as no
+ * declaration at all — and falls through to whatever workspace the global profile names. A
+ * corrupt committed file must not be a way out of the project's own tenant rules, so callers
+ * deciding whether a repo has declared itself ask this instead (Codex review, WP-694 S2).
+ */
+export function projectConfigExists() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return false;
+    return existsSync(resolve(projectRoot, '.productbrain', 'config.json'));
+}
+/**
+ * Is `<root>/<rel>` tracked in git's index? A TRACKED file is never ignored regardless of
+ * .gitignore. `git ls-files -- <path>` prints the path when tracked, nothing when not. Not a git
+ * work tree, or git unavailable → null. Never throws. Lives here, not in productbrain-files.ts
+ * (which re-exports it), so the pin reader can use it without an import cycle.
+ */
+export function makeGitTrackedChecker(root) {
+    return (rel) => {
+        try {
+            const out = execFileSync('git', ['ls-files', '--', rel], { cwd: root, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
+            return out.trim().length > 0;
+        }
+        catch {
+            return null; // not a git work tree, or git unavailable
+        }
+    };
+}
+/** A preview key file name the seed writes (preview.json, preview-founder.json, …): a bare name, no path. */
+const PREVIEW_KEY_FILE = /^preview(-[a-z]+)*\.json$/;
+/** A printed entry id, e.g. ROL-12: the only shape a pinned role may take. */
+const ROLE_ID = /^[A-Z]+-\d+$/;
+/** All four recorded binding facts, or null when any is missing or the wrong shape. */
+function parsePreviewKeyBinding(parsed) {
+    const { previewKeyFile: file, previewPerson: person, previewWorkspaceSlug: workspaceSlug, previewRole: role } = parsed;
+    if (typeof file !== 'string' || !PREVIEW_KEY_FILE.test(file))
+        return null;
+    if (typeof person !== 'string' || !person || typeof workspaceSlug !== 'string' || !workspaceSlug)
+        return null;
+    if (typeof role !== 'string' || !ROLE_ID.test(role))
+        return null;
+    return { file, person, workspaceSlug, role };
+}
+/**
+ * TEN-4883: read the bound key file for the stale-key refresh, or null. The seed writes many
+ * preview-*.json sidecars for other people and workspaces (preview-chain.json, preview-readonly.json,
+ * …), so the file is accepted only while its person, workspaceSlug and role still equal what the
+ * binding recorded from it: a config naming another sidecar can never cross the person or workspace.
+ */
+export function readBoundPreviewKey(projectRoot, binding) {
+    const path = resolve(projectRoot, '.productbrain', binding.file);
+    if (!existsSync(path))
+        return null;
+    try {
+        const parsed = JSON.parse(readFileSync(path, 'utf8'));
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed))
+            return null;
+        const { person, workspaceSlug, role } = parsed;
+        if (person !== binding.person || workspaceSlug !== binding.workspaceSlug || role !== binding.role)
+            return null;
+        return parsed;
+    }
+    catch {
+        return null;
+    }
+}
+/** Project roots whose pin git was asked about and does not track (one git spawn per root). */
+const untrackedPinRoots = new Set();
+/**
+ * TEN-4501 (TASK-639): a config.local.json that git tracks is committed, so its pin, its preview
+ * key and its role travel to every clone. Refuse to read it. Only a confirmed `true` refuses:
+ * outside a git work tree there is no index for the file to be in. A tracked pin deleted from the
+ * working tree is refused too: the next pin write would recreate a committed file (TASK-648).
+ * pb connect calls this before its redeem for the folder it is about to pin (WP-810).
+ */
+export function refuseTrackedPin(projectRoot) {
+    if (untrackedPinRoots.has(projectRoot))
+        return;
+    if (makeGitTrackedChecker(projectRoot)('.productbrain/config.local.json') === true) {
+        const pinPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+        const state = existsSync(pinPath) ? 'is tracked by git' : 'is deleted but still tracked by git';
+        throw new CLIError(`${pinPath} ${state}, so it is committed and every clone shares it. Refusing to use it.`, {
+            code: ErrorCode.CONFIG_INVALID,
+            category: 'config',
+            guidance: 'Untrack it with `git rm --cached .productbrain/config.local.json`, then run `pb files --fix` so git ignores it.',
+        });
+    }
+    untrackedPinRoots.add(projectRoot);
+}
+/** A symlinked home (macOS /tmp → /private/tmp) must still compare equal to its target. */
+const realPath = (p) => { try {
+    return realpathSync(p);
+}
+catch {
+    return resolve(p);
+} };
+/** The home folder is no project: a pin or hooks written there bind every folder under it (TASK-562). */
+export function isHomeFolder(folder, home = homedir()) {
+    return realPath(folder) === realPath(home);
+}
+/** The refusal pb connect gives in the home folder, pinned word for word by its test (RULE-662). */
+export const HOME_FOLDER_REFUSAL = 'Run pb connect in your project folder, not your home folder.';
+/**
+ * TASK-562: a new terminal opens in the home folder, and a pin there binds every folder under it
+ * (findProjectRoot walks up to it). pb connect calls this before its redeem, so the token still works.
+ */
+export function refuseHomeFolder(folder) {
+    if (!isHomeFolder(folder))
+        return;
+    throw new CLIError(HOME_FOLDER_REFUSAL, {
+        code: ErrorCode.VALIDATION_FAILED,
+        category: 'validation',
+        guidance: 'cd into your project, then run the same command. Your token still works.',
+    });
+}
+/**
+ * Read .productbrain/config.local.json from the walked-up project root.
+ * Returns the machine-local pin (`profile`), the optional hand-added `role` (DEC-1961), and any
+ * preview-binding fields (`apiKey`, `siteUrl`, `preview`, `workspaceName`, `previewKey`) written by
+ * `npm run pb:preview` — all gitignored, never committed.
+ * Returns null if file missing or project root not found.
+ * Warns to stderr on invalid JSON. Throws only when git tracks the file, even one deleted from the
+ * working tree (refuseTrackedPin).
+ */
+export function readLocalProjectConfig() {
+    const projectRoot = findProjectRoot(process.cwd());
+    if (!projectRoot)
+        return null;
+    const configPath = resolve(projectRoot, '.productbrain', 'config.local.json');
+    // Before the existence check (WP-810, TASK-648): a pin git still tracks but the working tree has
+    // deleted is refused too, or the next pin write (pb connect) would recreate a committed file.
+    refuseTrackedPin(projectRoot);
+    if (!existsSync(configPath))
+        return null;
+    try {
+        const raw = readFileSync(configPath, 'utf8');
+        const parsed = JSON.parse(raw);
+        if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+            process.stderr.write('Warning: .productbrain/config.local.json is not a JSON object, skipping.\n');
+            return null;
+        }
+        const result = {};
+        if (typeof parsed.profile === 'string' && parsed.profile) {
+            result.profile = parsed.profile;
+        }
+        // Preview binding fields — written by `npm run pb:preview`, cleared by `npm run pb:real`.
+        //
+        // Fail closed on ANY present-but-invalid apiKey, not just a wrong-prefix string: a number,
+        // an empty string, a boolean or an object is a corrupt or hand-written binding, and treating
+        // it as absent would let the caller skip the claimed binding and adopt a sibling profile pin
+        // — the workspace substitution this whole path exists to prevent. Only `undefined`/`null`
+        // count as absent: JSON `null` conventionally means "no value", and `npm run pb:real` strips
+        // the preview keys entirely rather than nulling them.
+        if (parsed.apiKey !== undefined && parsed.apiKey !== null) {
+            if (typeof parsed.apiKey === 'string' && parsed.apiKey.startsWith(API_KEY_PREFIX)) {
+                result.apiKey = parsed.apiKey;
+            }
+            else {
+                result.apiKeyMalformed = true;
+            }
+        }
+        if (typeof parsed.siteUrl === 'string' && parsed.siteUrl) {
+            result.siteUrl = parsed.siteUrl;
+        }
+        if (parsed.preview === true) {
+            result.preview = true;
+        }
+        if (typeof parsed.workspaceName === 'string' && parsed.workspaceName) {
+            result.workspaceName = parsed.workspaceName;
+        }
+        // The bound key file and its recorded facts hold together or not at all; without them the
+        // stale-key refresh reads no file (TEN-4883), so absent and malformed need no separate flag.
+        const previewKey = parsePreviewKeyBinding(parsed);
+        if (previewKey)
+            result.previewKey = previewKey;
+        // Same fail-closed rule as apiKey: a present-but-unusable role is flagged, never dropped, so a
+        // session start refuses instead of acting as some other role (RULE-632). Only the printed id
+        // shape (ROL-12) is a role: anything else would reach the kernel and be echoed back raw.
+        if (parsed.role !== undefined && parsed.role !== null) {
+            const role = typeof parsed.role === 'string' ? parsed.role.trim() : '';
+            if (ROLE_ID.test(role))
+                result.role = role;
+            else
+                result.roleMalformed = true;
+        }
+        return result;
+    }
+    catch {
+        process.stderr.write('Warning: .productbrain/config.local.json contains invalid JSON, skipping.\n');
+        return null;
+    }
+}
+//# sourceMappingURL=projectConfig.js.map

package/dist/lib/projectConfig.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"projectConfig.js","sourceRoot":"","sources":["../../src/lib/projectConfig.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAC5D,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAkClD;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,eAAe,CAAC,QAAgB;IAC9C,IAAI,GAAG,GAAG,QAAQ,CAAC;IACnB,MAAM,IAAI,GAAG,OAAO,EAAE,CAAC;IACvB,OAAO,IAAI,EAAE,CAAC;QACZ,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;QAC5C,IACE,UAAU,CAAC,KAAK,CAAC;YACjB,CAAC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,aAAa,CAAC,CAAC;gBACxC,UAAU,CAAC,OAAO,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAC,CAAC,EAClD,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;QAChD,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,mBAAmB;IACjC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,KAAK,CAAC;IAC/B,OAAO,UAAU,CAAC,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,aAAa,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,IAAY;IAChD,OAAO,CAAC,GAAW,EAAkB,EAAE;QACrC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;YAC3H,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC,CAAC,0CAA0C;QACzD,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAED,6GAA6G;AAC7G,MAAM,gBAAgB,GAAG,2BAA2B,CAAC;AAErD,8EAA8E;AAC9E,MAAM,OAAO,GAAG,cAAc,CAAC;AAa/B,uFAAuF;AACvF,SAAS,sBAAsB,CAAC,MAA+B;IAC7D,MAAM,EAAE,cAAc,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,oBAAoB,EAAE,aAAa,EAAE,WAAW,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;IACvH,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1E,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,MAAM,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa;QAAE,OAAO,IAAI,CAAC;IAC9G,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,WAAmB,EAAE,OAA0B;IACjF,MAAM,IAAI,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QACtD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,GAAG,MAAM,CAAC;QAC/C,IAAI,MAAM,KAAK,OAAO,CAAC,MAAM,IAAI,aAAa,KAAK,OAAO,CAAC,aAAa,IAAI,IAAI,KAAK,OAAO,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QAC/G,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+FAA+F;AAC/F,MAAM,iBAAiB,GAAG,IAAI,GAAG,EAAU,CAAC;AAE5C;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,IAAI,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC;QAAE,OAAO;IAC/C,IAAI,qBAAqB,CAAC,WAAW,CAAC,CAAC,iCAAiC,CAAC,KAAK,IAAI,EAAE,CAAC;QACnF,MAAM,OAAO,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,qCAAqC,CAAC;QAChG,MAAM,IAAI,QAAQ,CAAC,GAAG,OAAO,IAAI,KAAK,qEAAqE,EAAE;YAC3G,IAAI,EAAE,SAAS,CAAC,cAAc;YAC9B,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,iHAAiH;SAC5H,CAAC,CAAC;IACL,CAAC;IACD,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;AACrC,CAAC;AAED,2FAA2F;AAC3F,MAAM,QAAQ,GAAG,CAAC,CAAS,EAAU,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,OAAO,CAAC,CAAC,CAAC,CAAC;AAAC,CAAC,CAAC,CAAC,CAAC;AAEzG,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAAe,OAAO,EAAE;IACnE,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,oGAAoG;AACpG,MAAM,CAAC,MAAM,mBAAmB,GAAG,8DAA8D,CAAC;AAElG;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,IAAI,CAAC,YAAY,CAAC,MAAM,CAAC;QAAE,OAAO;IAClC,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE;QACtC,IAAI,EAAE,SAAS,CAAC,iBAAiB;QACjC,QAAQ,EAAE,YAAY;QACtB,QAAQ,EAAE,0EAA0E;KACrF,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,WAAW,GAAG,eAAe,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACnD,IAAI,CAAC,WAAW;QAAE,OAAO,IAAI,CAAC;IAC9B,MAAM,UAAU,GAAG,OAAO,CAAC,WAAW,EAAE,eAAe,EAAE,mBAAmB,CAAC,CAAC;IAC9E,iGAAiG;IACjG,8FAA8F;IAC9F,gBAAgB,CAAC,WAAW,CAAC,CAAC;IAC9B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;QAC7C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3E,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,4EAA4E,CAAC,CAAC;YACnG,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,MAAM,GAAuB,EAAE,CAAC;QACtC,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,0FAA0F;QAC1F,EAAE;QACF,2FAA2F;QAC3F,6FAA6F;QAC7F,6FAA6F;QAC7F,0FAA0F;QAC1F,6FAA6F;QAC7F,sDAAsD;QACtD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YAC1D,IAAI,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,cAAc,CAAC,EAAE,CAAC;gBAClF,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,MAAM,CAAC,eAAe,GAAG,IAAI,CAAC;YAChC,CAAC;QACH,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACzD,MAAM,CAAC,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC;QAClC,CAAC;QACD,IAAI,MAAM,CAAC,OAAO,KAAK,IAAI,EAAE,CAAC;YAC5B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;QACxB,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,aAAa,KAAK,QAAQ,IAAI,MAAM,CAAC,aAAa,EAAE,CAAC;YACrE,MAAM,CAAC,aAAa,GAAG,MAAM,CAAC,aAAa,CAAC;QAC9C,CAAC;QACD,0FAA0F;QAC1F,6FAA6F;QAC7F,MAAM,UAAU,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAClD,IAAI,UAAU;YAAE,MAAM,CAAC,UAAU,GAAG,UAAU,CAAC;QAC/C,+FAA+F;QAC/F,6FAA6F;QAC7F,yFAAyF;QACzF,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACtD,MAAM,IAAI,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACvE,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,MAAM,CAAC,IAAI,GAAG,IAAI,CAAC;;gBACtC,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;QACnC,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,6EAA6E,CAAC,CAAC;QACpG,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/lib/prompts.d.ts

@@ -12,6 +12,8 @@ export interface PromptOptions {
 export interface ConfirmOptions {
     message: string;
     initialValue?: boolean;
+    /** Returned on Esc / Ctrl+C instead of exiting, for a caller that must clean up first (TASK-641). */
+    cancelValue?: boolean;
 }
 export interface SelectOptions<T> {
     message: string;

package/dist/lib/prompts.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/lib/prompts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AA0CD,8EAA8E;AAC9E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,uCAAuC;AACvC,wBAAsB,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAU9D;AAED,mDAAmD;AACnD,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CAQpE;AAED,iDAAiD;AACjD,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASlE;AAED,wDAAwD;AACxD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAW9E;AAED,6EAA6E;AAC7E,wBAAgB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAG5C;AAED,6EAA6E;AAC7E,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,kFAAkF;AAClF,eAAO,MAAM,GAAG;gBACC,MAAM;mBACN,MAAM;gBACN,MAAM;iBACN,MAAM;gBACN,MAAM;oBACL,MAAM;CAGvB,CAAC"}
+{"version":3,"file":"prompts.d.ts","sourceRoot":"","sources":["../../src/lib/prompts.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAQH,MAAM,WAAW,aAAa;IAC5B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,qGAAqG;IACrG,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,WAAW,aAAa,CAAC,CAAC;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACvD;AAED,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,CAAC;CAClD;AA0CD,8EAA8E;AAC9E,wBAAgB,aAAa,IAAI,OAAO,CAEvC;AAED,uCAAuC;AACvC,wBAAsB,GAAG,CAAC,IAAI,EAAE,aAAa,GAAG,OAAO,CAAC,MAAM,CAAC,CAU9D;AAED,mDAAmD;AACnD,wBAAsB,OAAO,CAAC,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,OAAO,CAAC,CASpE;AAED,iDAAiD;AACjD,wBAAsB,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CASlE;AAED,wDAAwD;AACxD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CAQrE;AAED,MAAM,WAAW,kBAAkB,CAAC,CAAC;IACnC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE;QAAE,KAAK,EAAE,CAAC,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACtD,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,aAAa,CAAC,EAAE,CAAC,EAAE,CAAC;CACrB;AAED,qDAAqD;AACrD,wBAAsB,WAAW,CAAC,CAAC,EAAE,IAAI,EAAE,kBAAkB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,EAAE,CAAC,CAW9E;AAED,6EAA6E;AAC7E,wBAAgB,KAAK,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1C;AAED,uEAAuE;AACvE,wBAAgB,KAAK,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAG5C;AAED,6EAA6E;AAC7E,wBAAgB,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAG1D;AAED,kFAAkF;AAClF,eAAO,MAAM,GAAG;gBACC,MAAM;mBACN,MAAM;gBACN,MAAM;iBACN,MAAM;gBACN,MAAM;oBACL,MAAM;CAGvB,CAAC"}

package/dist/lib/prompts.js

@@ -63,6 +63,8 @@ export async function confirm(opts) {
         message: opts.message,
         initialValue: opts.initialValue,
     });
+    if (opts.cancelValue !== undefined && isCancelled(result))
+        return opts.cancelValue;
     handleCancel(result);
     return result;
 }