@prompts-gpt/client 0.2.0 → 0.2.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (18) hide show
  1. package/CHANGELOG.md +67 -1
  2. package/LICENSE +75 -21
  3. package/README.md +82 -227
  4. package/dist/cli.js +1635 -142
  5. package/dist/cli.js.map +1 -1
  6. package/dist/index.d.ts +82 -25
  7. package/dist/index.d.ts.map +1 -1
  8. package/dist/index.js +745 -120
  9. package/dist/index.js.map +1 -1
  10. package/dist/runtime.d.ts +205 -0
  11. package/dist/runtime.d.ts.map +1 -0
  12. package/dist/runtime.js +1173 -0
  13. package/dist/runtime.js.map +1 -0
  14. package/dist/sweep.d.ts +174 -0
  15. package/dist/sweep.d.ts.map +1 -0
  16. package/dist/sweep.js +594 -0
  17. package/dist/sweep.js.map +1 -0
  18. package/package.json +9 -8
package/CHANGELOG.md CHANGED
@@ -1,5 +1,71 @@
1
1
  # Changelog
2
2
 
3
+ ## Unreleased
4
+
5
+ ### Security
6
+
7
+ - Validate `constraints` and `desiredOutput` length (max 1600 chars) client-side before network requests
8
+ - Validate token prefix (`pgpt_`) in `saveLocalCredentials` to reject malformed tokens at save time
9
+ - Sanitize Copilot prompt-file variable names to strip `$`, `{`, `}` injection characters
10
+ - Sanitize managed-block content to prevent marker injection via prompt content
11
+ - Validate API URL scheme (must be `https` or `http`) in `normalizeApiUrl`
12
+ - Auto-generate client-side request IDs (`pgcli_*`) when caller doesn't provide one for correlation
13
+
14
+ ### Fixed
15
+
16
+ - Fix package version mismatch between `package.json` (0.2.1) and CHANGELOG (0.2.2)
17
+ - Fix npm publish failure on unsupported CI providers by removing forced provenance from package metadata
18
+ - Fix race condition in file writes: use atomic `wx` flag with `EEXIST` catch instead of `existsSync` + `wx`
19
+ - Fix `formatPromptMarkdown` producing double blank lines when both `usageNotes` and `variables` are empty
20
+ - Fix `normalizeAgentTargets` deduplication when `all` is mixed with explicit targets (e.g. `all,codex`)
21
+ - Fix `normalizeAgentTargets` returning empty array for empty string input
22
+ - Fix `loadLocalCredentials` returning empty-string token instead of `null` for whitespace-only stored tokens
23
+ - Fix `safeSlug` for unicode-only input by normalizing NFKD and stripping combining marks
24
+ - Fix `ensureGitignoreEntry` to preserve CRLF line endings on Windows-style `.gitignore` files
25
+ - Fix `parseRetryAfterHeader` to cap parsed values at 10 minutes, preventing unbounded waits
26
+ - Fix `assertInside` / `assertSafeOutputDir` boundary comparison for paths at the project root
27
+ - Fix `writePromptIndex` to escape `[` and `]` in Markdown link text to prevent broken rendering
28
+ - Fix `yamlScalar` to handle multi-line strings by normalizing `\r\n` before quoting
29
+ - Serialize agent file writes sequentially to prevent concurrent write races on shared files
30
+
31
+ ### Improvements
32
+
33
+ - Add `--dry-run` flag to `sync` and `install-agents` commands for previewing changes
34
+ - Add dedicated CLI exit code `4` for rate-limit errors (HTTP 429)
35
+ - Use longer default timeout (60s) for prompt generation requests
36
+ - Add `DEFAULT_GENERATE_TIMEOUT_MS` constant for prompt generation timeout
37
+
38
+ ### Packaging
39
+
40
+ - Add npm `homepage` and `bugs.email` metadata so package consumers have a first-party support path from the registry page
41
+ - Clarify the project-local CLI install path and pre-publish `npm pack --dry-run` verification flow in the README
42
+
43
+ ## 0.2.2 (2026-05-16)
44
+
45
+ ### Local Sync
46
+
47
+ - Reject prompt filename collisions after slug normalization before writing local artifacts
48
+ - Respect each prompt pack's declared `agentTargets` when generating Codex, Cursor, VS Code, and Copilot files
49
+ - Skip existing non-managed agent files unless `--overwrite` is explicitly passed
50
+ - Expand `manifest.json` with agent targets, recommended path, and generated file locations for downstream discovery
51
+ - Emit GitHub Copilot prompt files in prompt-file format instead of generic prompt-pack Markdown
52
+ - Add `.github/instructions/prompts-gpt.instructions.md` so Copilot treats synced agent artifacts as generated files
53
+
54
+ ## 0.2.1 (2026-05-16)
55
+
56
+ ### Packaging
57
+
58
+ - Add an explicit `default` export target for better ESM consumer and bundler compatibility
59
+ - Enable npm provenance on publish for stronger package registry attestation
60
+ - Remove the redundant `typesVersions` entry and rely on the package `types` field plus export metadata
61
+
62
+ ### Documentation
63
+
64
+ - Replace stale `npx`-only examples with `npm exec` flows that pin to the latest published package
65
+ - Clarify that the importable SDK does not read `process.env` and requires explicit `fetch`
66
+ - Align CI/CD examples with the real CLI contract of passing tokens as flags instead of ambient env reads
67
+ - Document the packed artifact contents shipped to npm
68
+
3
69
  ## 0.2.0 (2026-05-16)
4
70
 
5
71
  ### Security
@@ -26,7 +92,7 @@
26
92
 
27
93
  ## 0.1.1 (2026-05-16)
28
94
 
29
- - Remove public GitHub repository, homepage, and bugs metadata from the npm package manifest.
95
+ - Remove public GitHub repository metadata from the npm package manifest while the source repository remains non-public.
30
96
  - Preserve executable permissions for the `prompts-gpt` CLI after package builds.
31
97
 
32
98
  ## 0.1.0 (2026-05-16)
package/LICENSE CHANGED
@@ -1,21 +1,75 @@
1
- MIT License
2
-
3
- Copyright (c) 2026 Prompts-GPT
4
-
5
- Permission is hereby granted, free of charge, to any person obtaining a copy
6
- of this software and associated documentation files (the "Software"), to deal
7
- in the Software without restriction, including without limitation the rights
8
- to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9
- copies of the Software, and to permit persons to whom the Software is
10
- furnished to do so, subject to the following conditions:
11
-
12
- The above copyright notice and this permission notice shall be included in all
13
- copies or substantial portions of the Software.
14
-
15
- THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16
- IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17
- FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18
- AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19
- LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20
- OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21
- SOFTWARE.
1
+ Prompts-GPT Source Available License
2
+ Version 1.0 — Effective 2026
3
+
4
+ Copyright (c) 2026 Prompts-GPT. All rights reserved.
5
+
6
+ Permission is hereby granted, free of charge, to any person or organization
7
+ ("Licensee") obtaining a copy of this software and associated documentation
8
+ files (the "Software"), to use the Software for personal and commercial
9
+ purposes, subject to the following conditions:
10
+
11
+ 1. GRANT OF LICENSE
12
+
13
+ Licensee may:
14
+
15
+ a) Use the Software without restriction for personal projects,
16
+ commercial products, internal development, CI/CD pipelines,
17
+ and production deployments.
18
+
19
+ b) Install the Software in any number of environments.
20
+
21
+ 2. RESTRICTIONS
22
+
23
+ Licensee shall NOT:
24
+
25
+ a) Redistribute the Software, in whole or in part, as a standalone
26
+ package, download, or bundled component of another software
27
+ distribution system.
28
+
29
+ b) Modify, adapt, translate, reverse engineer, decompile, or
30
+ create derivative works of the Software's source code or
31
+ compiled artifacts.
32
+
33
+ c) Sublicense, rent, lease, sell, or otherwise transfer the
34
+ Software or rights to it to any third party.
35
+
36
+ d) Remove, alter, or obscure any proprietary notices, attribution
37
+ markers, or license text embedded in the Software.
38
+
39
+ e) Use the Software to build a competing prompt management
40
+ platform, agent orchestration service, or equivalent product.
41
+
42
+ 3. ATTRIBUTION
43
+
44
+ Build artifacts and runtime telemetry may contain account attribution
45
+ metadata. Tampering with or removing attribution data is prohibited.
46
+
47
+ 4. INTELLECTUAL PROPERTY
48
+
49
+ The Software is and remains the exclusive property of Prompts-GPT.
50
+ No title or ownership is transferred to Licensee.
51
+
52
+ 5. WARRANTY DISCLAIMER
53
+
54
+ THE SOFTWARE IS PROVIDED "AS IS" WITHOUT WARRANTY OF ANY KIND,
55
+ EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES
56
+ OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, AND
57
+ NONINFRINGEMENT.
58
+
59
+ 6. LIMITATION OF LIABILITY
60
+
61
+ IN NO EVENT SHALL PROMPTS-GPT BE LIABLE FOR ANY INDIRECT,
62
+ INCIDENTAL, SPECIAL, CONSEQUENTIAL, OR PUNITIVE DAMAGES ARISING
63
+ OUT OF THE USE OR INABILITY TO USE THE SOFTWARE.
64
+
65
+ 7. TERMINATION
66
+
67
+ This license terminates automatically if Licensee breaches any
68
+ term. Upon termination, Licensee must stop using the Software.
69
+
70
+ 8. GOVERNING LAW
71
+
72
+ This agreement is governed by the laws of the State of Delaware,
73
+ USA, without regard to conflict of laws principles.
74
+
75
+ For licensing inquiries: licensing@prompts-gpt.com
package/README.md CHANGED
@@ -1,286 +1,141 @@
1
1
  # @prompts-gpt/client
2
2
 
3
- CLI and Node.js SDK for syncing [Prompts-GPT](https://prompts-gpt.com) prompt packs into any local project — with first-class integrations for **Codex**, **Cursor**, **VS Code**, and **GitHub Copilot**.
3
+ CLI and SDK for syncing [Prompts-GPT](https://prompts-gpt.com) prompt packs into any project — with integrations for **Codex**, **Claude Code**, **Cursor**, **VS Code**, **GitHub Copilot**, **Continue**, **Gemini CLI**, **Windsurf**, **Cline**, **Junie**, and **Amp**.
4
4
 
5
5
  ---
6
6
 
7
- ## Why
8
-
9
- AI coding agents work best when they have stable, discoverable instructions inside the repository. This package bridges Prompts-GPT's cloud prompt library with the local files each agent reads:
10
-
11
- | Agent | What gets written |
12
- |-------|-------------------|
13
- | **Codex** | `AGENTS.md` managed block |
14
- | **Cursor** | `.cursor/rules/prompts-gpt-*.mdc` |
15
- | **VS Code** | `.github/copilot-instructions.md` + `.vscode/*.code-snippets` |
16
- | **Copilot** | `.github/prompts/*.prompt.md` |
17
-
18
- Prompt Markdown files and a `manifest.json` are always written to `.prompts-gpt/` for discovery.
19
-
20
- ---
21
-
22
- ## Quick start
7
+ ## Get Started
23
8
 
24
9
  ```bash
25
- # 1. Initialize with a project token from the dashboard
26
- npx @prompts-gpt/client init --token <project-token>
10
+ # 1. Install
11
+ npm install -D @prompts-gpt/client
27
12
 
28
- # 2. Sync prompt packs + agent files in one command
29
- npx @prompts-gpt/client sync --agent all
13
+ # 2. Save your project token
14
+ npx prompts-gpt init --token-prompt
30
15
 
31
- # 3. Generate a project-aware prompt and sync it
32
- npx @prompts-gpt/client generate \
33
- --goal "Review this diff for security issues" \
34
- --context "Node.js API with PostgreSQL" \
35
- --agent codex,cursor,vscode
16
+ # 3. Sync prompts and run
17
+ npx prompts-gpt load-config
18
+ npx prompts-gpt run
36
19
  ```
37
20
 
38
- ---
39
-
40
- ## Install
41
-
42
- ```bash
43
- npm install @prompts-gpt/client
44
- ```
45
-
46
- Or run directly with `npx` — no install required:
47
-
48
- ```bash
49
- npx @prompts-gpt/client <command>
50
- ```
51
-
52
- **Requires** Node.js 18.18 or later.
21
+ **Requires** Node.js 18.18+.
53
22
 
54
23
  ---
55
24
 
56
- ## Authentication
25
+ ## What It Does
57
26
 
58
- Create a project token in the [Prompts-GPT dashboard](https://prompts-gpt.com/dashboard/agents), then:
27
+ Bridges the Prompts-GPT cloud library with the agent instruction files each tool reads:
59
28
 
60
- ```bash
61
- prompts-gpt init --token pgpt_your_token_here
62
- ```
63
-
64
- Credentials are saved to `.prompts-gpt/.credentials.json` with `0600` permissions and automatically added to `.gitignore`.
65
-
66
- For CI/CD, pass your secret through the shell instead of letting the package read environment variables directly:
67
-
68
- ```bash
69
- prompts-gpt sync --token "$PROMPTS_GPT_TOKEN" --agent all
70
- ```
29
+ | Agent | Written files |
30
+ |-------|--------------|
31
+ | Codex | `AGENTS.md` |
32
+ | Claude Code | `CLAUDE.md` |
33
+ | Cursor | `.cursor/rules/*.mdc` + `.cursor/commands/*.md` |
34
+ | VS Code | `.github/copilot-instructions.md` + `.vscode/*.code-snippets` |
35
+ | Copilot | `.github/prompts/*.prompt.md` |
36
+ | Continue | `.continue/rules/*.md` |
37
+ | Gemini CLI | `GEMINI.md` |
38
+ | Windsurf | `.windsurf/rules/*.md` |
39
+ | Cline | `.clinerules/*.md` |
40
+ | Junie | `.junie/guidelines.md` |
41
+ | Amp | `AGENT.md` |
71
42
 
72
43
  ---
73
44
 
74
- ## CLI reference
75
-
76
- ### `init` — Save credentials
45
+ ## Important Use Notes
77
46
 
78
- ```bash
79
- prompts-gpt init --token <token> [--api-url <url>] [--cwd <path>]
80
- ```
47
+ - `@prompts-gpt/client` is the published npm package. If you see examples that reference internal app modules such as `lib/sdk`, those are app-internal examples, not the public package import path.
48
+ - Local orchestration can send prompt text, code context, and repository files to third-party model providers and agent CLIs. Review each provider's terms, privacy settings, and permitted automation paths before using private or regulated data.
49
+ - Run artifacts are written locally and can include prompts, model output, logs, and worktree snapshots. Treat `.scripts/runs` as sensitive and do not commit or share it casually.
81
50
 
82
- ### `sync` — Pull + generate + write everything
51
+ ---
83
52
 
84
- ```bash
85
- prompts-gpt sync [--goal "..."] [--limit 25] [--agent all] [--overwrite]
86
- ```
53
+ ## CLI Commands
54
+
55
+ | Command | Description |
56
+ |---------|-------------|
57
+ | `init` | Save project token |
58
+ | `load-config` | Pull full config from Prompts Studio |
59
+ | `sync` | Pull + generate + write agent files |
60
+ | `run` | Execute one prompt with a local agent |
61
+ | `run-batch` | Execute multiple prompts |
62
+ | `sweep` | Multi-iteration execution |
63
+ | `setup` | Scaffold local config |
64
+ | `status` | Show workspace readiness |
65
+ | `list` | Show prompts, sweeps, agents |
66
+ | `providers` | Show detected CLIs |
67
+ | `doctor` | Validate prerequisites |
68
+ | `validate` | Check config for errors |
69
+
70
+ Run `prompts-gpt help <command>` for detailed options.
87
71
 
88
- The default workflow. Pulls library prompts, optionally generates one, writes Markdown files, agent integration files, and a manifest.
72
+ ---
89
73
 
90
- ### `pull` — Download prompt packs
74
+ ## Examples
91
75
 
92
76
  ```bash
93
- prompts-gpt pull [--query "repo audit"] [--category coding] [--tool Codex] [--limit 25] [--overwrite]
94
- ```
77
+ # Run a single prompt
78
+ prompts-gpt run --prompt-file .prompts-gpt/review.md --agent cursor
95
79
 
96
- ### `generate` — Create a project-aware prompt
80
+ # Run a sweep (multi-iteration)
81
+ prompts-gpt sweep --prompt-file .prompts-gpt/sweeps/design.md --iterations 3
97
82
 
98
- ```bash
99
- prompts-gpt generate --goal "Review this diff" [--context "Next.js app"] [--tool Codex] [--agent codex,cursor]
100
- ```
101
-
102
- ### `install-agents` — Write agent files only
83
+ # Sync from cloud
84
+ prompts-gpt sync --agent all
103
85
 
104
- ```bash
105
- prompts-gpt install-agents [--agent codex,cursor,vscode,copilot]
86
+ # CI/CD — pipe token from secret
87
+ printf '%s' "$PROMPTS_GPT_TOKEN" | prompts-gpt sync --token-stdin --agent all
106
88
  ```
107
89
 
108
- ### `project` — Print project info
90
+ ---
109
91
 
110
- ```bash
111
- prompts-gpt project
112
- ```
92
+ ## Configuration
113
93
 
114
- ### `version` / `help`
94
+ Create `.prompts-gpt/config.json` via `prompts-gpt setup`, or manually:
115
95
 
116
- ```bash
117
- prompts-gpt version
118
- prompts-gpt help
96
+ ```json
97
+ {
98
+ "providerOrder": ["codex", "cursor", "claude", "copilot"],
99
+ "defaultAgent": "router",
100
+ "timeoutSeconds": 900,
101
+ "artifactsDir": ".scripts/runs"
102
+ }
119
103
  ```
120
104
 
121
- ### Common flags
122
-
123
- | Flag | Description |
124
- |------|-------------|
125
- | `--token <token>` | Project API token |
126
- | `--api-url <url>` | Custom API base URL |
127
- | `--cwd <path>` | Target directory for config and generated files |
128
- | `--agent <targets>` | Comma-separated: `codex`, `cursor`, `vscode`, `copilot`, or `all` |
129
- | `--overwrite` | Replace existing files instead of skipping |
130
- | `--out <dir>` | Output directory (default: `.prompts-gpt`) |
131
-
132
- ### Supported tools
133
-
134
- Codex, Claude Code, Cursor, GitHub Copilot, ChatGPT, Gemini, Perplexity, Grok, DeepSeek, Claude.
105
+ All options can be overridden via environment variables. See `prompts-gpt help setup`.
135
106
 
136
107
  ---
137
108
 
138
- ## Programmatic SDK
109
+ ## SDK
139
110
 
140
111
  ```typescript
141
- import {
142
- PromptsGptClient,
143
- syncPrompts,
144
- writeAgentFiles,
145
- formatPromptMarkdown,
146
- } from "@prompts-gpt/client";
112
+ import { PromptsGptClient, syncPrompts } from "@prompts-gpt/client";
147
113
 
148
114
  const client = new PromptsGptClient({
149
- token: "pgpt_your_token_here",
115
+ token: "pgpt_your_token",
150
116
  apiUrl: "https://prompts-gpt.com",
151
117
  fetch,
152
118
  });
153
119
 
154
- // Fetch project context
155
- const project = await client.getProject();
156
- console.log(project.brandName, project.websiteUrl);
157
-
158
- // Pull prompt packs from the library
159
- const prompts = await client.pullPrompts({ limit: 10, tool: "Codex" });
160
-
161
- // Generate a project-aware prompt
162
- const generated = await client.generatePrompt({
163
- goal: "Review production diffs for security issues",
164
- context: "Node.js microservice with PostgreSQL",
165
- tool: "Codex",
166
- });
167
-
168
- // Sync everything to disk (Markdown + agent files + manifest)
169
- const result = await syncPrompts([...prompts, generated], {
170
- agent: "all",
171
- overwrite: true,
172
- });
173
-
174
- console.log(`Wrote ${result.markdown.written.length} prompts`);
175
- console.log(`Synced ${result.agents.written.length} agent files`);
176
- ```
177
-
178
- ### API methods
179
-
180
- | Method | Description |
181
- |--------|-------------|
182
- | `client.getProject()` | Returns project context (brand, competitors, keywords) |
183
- | `client.pullPrompts(query?)` | Fetches prompt packs from the library |
184
- | `client.generatePrompt(input)` | Generates a prompt using project context |
185
-
186
- ### File-writing utilities
187
-
188
- | Function | Description |
189
- |----------|-------------|
190
- | `syncPrompts(prompts, opts)` | Full sync: Markdown + agents + manifest |
191
- | `writePromptMarkdownFiles(prompts, opts)` | Write `.md` files only |
192
- | `writeAgentFiles(prompts, opts)` | Write agent integration files only |
193
- | `writePromptManifest(prompts, opts)` | Write `manifest.json` only |
194
- | `formatPromptMarkdown(prompt)` | Render a single prompt as Markdown |
195
- | `saveLocalCredentials(input)` | Save token to `.prompts-gpt/.credentials.json` |
196
- | `loadLocalCredentials(cwd?)` | Load saved credentials |
197
-
198
- ---
199
-
200
- ## Generated file structure
201
-
202
- After running `sync --agent all`, your repository will contain:
203
-
204
- ```
205
- .prompts-gpt/
206
- manifest.json # Machine-readable index
207
- README.md # Human-readable index
208
- senior-code-reviewer.md # Prompt pack (YAML frontmatter + Markdown)
209
- ...
210
-
211
- AGENTS.md # Codex: managed <!-- prompts-gpt:start --> block
212
-
213
- .cursor/rules/
214
- prompts-gpt-senior-code-reviewer.mdc # Cursor rule file
215
-
216
- .github/
217
- copilot-instructions.md # VS Code / Copilot shared instructions
218
- prompts/
219
- prompts-gpt-senior-code-reviewer.prompt.md # Copilot prompt file
220
-
221
- .vscode/
222
- prompts-gpt.code-snippets # VS Code snippets
223
- ```
224
-
225
- ---
226
-
227
- ## Environment variables
228
-
229
- | Variable | Description |
230
- |----------|-------------|
231
- | `PROMPTS_GPT_TOKEN` | Project API token (alternative to `init`) |
232
- | `PROMPTS_GPT_API_URL` | Custom API base URL for self-hosted instances |
233
-
234
- ---
235
-
236
- ## Error handling
237
-
238
- ```typescript
239
- import { PromptsGptApiError } from "@prompts-gpt/client";
240
-
241
- try {
242
- await client.pullPrompts();
243
- } catch (error) {
244
- if (error instanceof PromptsGptApiError) {
245
- console.error(error.message); // Human-readable message
246
- console.error(error.code); // Machine-readable code
247
- console.error(error.status); // HTTP status (e.g. 401, 429)
248
- console.error(error.recovery); // Suggested fix
249
- }
250
- }
251
- ```
252
-
253
- **Error codes:** `AUTH_ERROR`, `VALIDATION_ERROR`, `RATE_LIMIT_ERROR`, `TIMEOUT`, `NETWORK_ERROR`, `INVALID_RESPONSE`, `MISSING_FETCH`.
254
-
255
- The client automatically retries on `429`, `502`, `503`, and `504` responses with exponential backoff and jitter.
256
-
257
- ---
258
-
259
- ## CI/CD usage
260
-
261
- ```yaml
262
- # GitHub Actions example
263
- - name: Sync Prompts-GPT agent files
264
- env:
265
- PROMPTS_GPT_TOKEN: ${{ secrets.PROMPTS_GPT_TOKEN }}
266
- run: npx @prompts-gpt/client sync --agent all --overwrite
120
+ const prompts = await client.pullPrompts();
121
+ await syncPrompts(prompts, { agent: "all" });
267
122
  ```
268
123
 
269
124
  ---
270
125
 
271
126
  ## Security
272
127
 
273
- - Credentials stored with `0600` file permissions (owner read/write only)
274
- - Token prefix (`pgpt_`) validated before any network request
275
- - HTTPS enforced in production
276
- - Response content-type validated before JSON parsing
128
+ - Credentials stored with `0600` permissions
129
+ - Credentials added to `.gitignore`
130
+ - Token prefix (`pgpt_`) validated before requests
131
+ - HTTPS enforced for non-localhost
277
132
  - Path traversal blocked for all file writes
278
- - Control characters sanitized from CLI output
279
- - Retry delays capped to prevent abuse via `retry-after`
280
- - Context sent to `generate` is ephemeral — never persisted server-side
133
+ - Secret redaction in command previews and error output
134
+ - SIGINT/SIGTERM cleanup releases locks
135
+ - Run artifact directories are intended to stay local and may contain sensitive prompt, output, and diff data
281
136
 
282
137
  ---
283
138
 
284
139
  ## License
285
140
 
286
- [MIT](./LICENSE)
141
+ [Prompts-GPT Source Available License](./LICENSE) — free for personal and commercial use. Redistribution and modification of the package are not permitted.