@respan/cli 0.17.1 → 0.17.2

package/dist/hooks/claude-code.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/claude-code.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -44,13 +66,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -61,14 +83,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -98,11 +121,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -122,36 +145,36 @@ function loadRespanConfig(configPath) {
   }
 }
 function loadState(statePath) {
-  if (!fs.existsSync(statePath)) return {};
+  if (!fs2.existsSync(statePath)) return {};
   try {
-    return JSON.parse(fs.readFileSync(statePath, "utf-8"));
+    return JSON.parse(fs2.readFileSync(statePath, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveState(statePath, state) {
-  const dir = path.dirname(statePath);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(statePath);
+  fs2.mkdirSync(dir, { recursive: true });
   const tmpPath = statePath + ".tmp." + process.pid;
   try {
-    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs.renameSync(tmpPath, statePath);
+    fs2.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs2.renameSync(tmpPath, statePath);
   } catch (e) {
     try {
-      fs.unlinkSync(tmpPath);
+      fs2.unlinkSync(tmpPath);
     } catch {
     }
-    fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    fs2.writeFileSync(statePath, JSON.stringify(state, null, 2));
   }
 }
 function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -360,9 +383,9 @@ async function sendSpans(spans, apiKey, baseUrl, context) {
   const spanNames = spans.map((s) => s.span_name);
   debug(`Sending ${spans.length} spans (${body.length} bytes) to ${url} for ${context}: ${spanNames.join(", ")}`);
   if (_debug) {
-    const debugDir = _logFile ? path.dirname(_logFile) : os.tmpdir();
-    const debugFile = path.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
-    fs.writeFileSync(debugFile, body);
+    const debugDir = _logFile ? path2.dirname(_logFile) : os2.tmpdir();
+    const debugFile = path2.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
+    fs2.writeFileSync(debugFile, body);
     debug(`Dumped OTLP payload to ${debugFile}`);
   }
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -403,10 +426,10 @@ function sleep(ms) {
 }
 
 // src/hooks/claude-code.ts
-var STATE_DIR = path2.join(os2.homedir(), ".claude", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var STATE_FILE = path2.join(STATE_DIR, "respan_state.json");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".claude", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var STATE_FILE = path3.join(STATE_DIR, "respan_state.json");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.CC_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.CC_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 initLogging(LOG_FILE, DEBUG_MODE);
@@ -730,7 +753,7 @@ function processTranscript(sessionId, transcriptFile, state, apiKey, baseUrl, co
   const sessionState = state[sessionId] ?? {};
   const lastLine = Number(sessionState.last_line ?? 0);
   const turnCount = Number(sessionState.turn_count ?? 0);
-  const content = fs2.readFileSync(transcriptFile, "utf-8");
+  const content = fs3.readFileSync(transcriptFile, "utf-8");
   const lines = content.trim().split("\n");
   const totalLines = lines.length;
   if (lastLine >= totalLines) {
@@ -831,13 +854,13 @@ function processTranscript(sessionId, transcriptFile, state, apiKey, baseUrl, co
 function readStdinPayload() {
   if (process.stdin.isTTY) return null;
   try {
-    const raw = fs2.readFileSync(0, "utf-8");
+    const raw = fs3.readFileSync(0, "utf-8");
     if (!raw.trim()) return null;
     const payload = JSON.parse(raw);
     const sessionId = String(payload.session_id ?? "");
     const transcriptPath = String(payload.transcript_path ?? "");
     if (!sessionId || !transcriptPath) return null;
-    if (!fs2.existsSync(transcriptPath)) return null;
+    if (!fs3.existsSync(transcriptPath)) return null;
     debug(`Got transcript from stdin: session=${sessionId}, path=${transcriptPath}`);
     return { sessionId, transcriptPath };
   } catch {
@@ -845,17 +868,17 @@ function readStdinPayload() {
   }
 }
 function findLatestTranscript() {
-  const projectsDir = path2.join(os2.homedir(), ".claude", "projects");
-  if (!fs2.existsSync(projectsDir)) return null;
+  const projectsDir = path3.join(os3.homedir(), ".claude", "projects");
+  if (!fs3.existsSync(projectsDir)) return null;
   let latestFile = null;
   let latestMtime = 0;
-  for (const projEntry of fs2.readdirSync(projectsDir)) {
-    const projDir = path2.join(projectsDir, projEntry);
-    if (!fs2.statSync(projDir).isDirectory()) continue;
-    for (const file of fs2.readdirSync(projDir)) {
+  for (const projEntry of fs3.readdirSync(projectsDir)) {
+    const projDir = path3.join(projectsDir, projEntry);
+    if (!fs3.statSync(projDir).isDirectory()) continue;
+    for (const file of fs3.readdirSync(projDir)) {
       if (!file.endsWith(".jsonl")) continue;
-      const full = path2.join(projDir, file);
-      const mtime = fs2.statSync(full).mtimeMs;
+      const full = path3.join(projDir, file);
+      const mtime = fs3.statSync(full).mtimeMs;
       if (mtime > latestMtime) {
         latestMtime = mtime;
         latestFile = full;
@@ -864,10 +887,10 @@ function findLatestTranscript() {
   }
   if (!latestFile) return null;
   try {
-    const firstLine = fs2.readFileSync(latestFile, "utf-8").split("\n")[0];
+    const firstLine = fs3.readFileSync(latestFile, "utf-8").split("\n")[0];
     if (!firstLine) return null;
     const firstMsg = JSON.parse(firstLine);
-    const sessionId = String(firstMsg.sessionId ?? path2.basename(latestFile, ".jsonl"));
+    const sessionId = String(firstMsg.sessionId ?? path3.basename(latestFile, ".jsonl"));
     return { sessionId, transcriptPath: latestFile };
   } catch {
     return null;
@@ -886,7 +909,7 @@ async function mainWorker() {
   debug(`Processing session: ${sessionId}`);
   let config = null;
   try {
-    const content = fs2.readFileSync(transcriptPath, "utf-8");
+    const content = fs3.readFileSync(transcriptPath, "utf-8");
     const lines = content.split("\n");
     let cwd = "";
     for (const line of lines.slice(0, 5)) {
@@ -901,7 +924,7 @@ async function mainWorker() {
       }
     }
     if (cwd) {
-      config = loadRespanConfig(path2.join(cwd, ".claude", "respan.json"));
+      config = loadRespanConfig(path3.join(cwd, ".claude", "respan.json"));
     }
   } catch {
   }

package/dist/hooks/codex-cli.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/codex-cli.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -44,13 +66,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -61,14 +83,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -98,11 +121,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -122,36 +145,36 @@ function loadRespanConfig(configPath) {
   }
 }
 function loadState(statePath) {
-  if (!fs.existsSync(statePath)) return {};
+  if (!fs2.existsSync(statePath)) return {};
   try {
-    return JSON.parse(fs.readFileSync(statePath, "utf-8"));
+    return JSON.parse(fs2.readFileSync(statePath, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveState(statePath, state) {
-  const dir = path.dirname(statePath);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(statePath);
+  fs2.mkdirSync(dir, { recursive: true });
   const tmpPath = statePath + ".tmp." + process.pid;
   try {
-    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs.renameSync(tmpPath, statePath);
+    fs2.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs2.renameSync(tmpPath, statePath);
   } catch (e) {
     try {
-      fs.unlinkSync(tmpPath);
+      fs2.unlinkSync(tmpPath);
     } catch {
     }
-    fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    fs2.writeFileSync(statePath, JSON.stringify(state, null, 2));
   }
 }
 function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -360,9 +383,9 @@ async function sendSpans(spans, apiKey, baseUrl, context) {
   const spanNames = spans.map((s) => s.span_name);
   debug(`Sending ${spans.length} spans (${body.length} bytes) to ${url} for ${context}: ${spanNames.join(", ")}`);
   if (_debug) {
-    const debugDir = _logFile ? path.dirname(_logFile) : os.tmpdir();
-    const debugFile = path.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
-    fs.writeFileSync(debugFile, body);
+    const debugDir = _logFile ? path2.dirname(_logFile) : os2.tmpdir();
+    const debugFile = path2.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
+    fs2.writeFileSync(debugFile, body);
     debug(`Dumped OTLP payload to ${debugFile}`);
   }
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -403,10 +426,10 @@ function sleep(ms) {
 }
 
 // src/hooks/codex-cli.ts
-var STATE_DIR = path2.join(os2.homedir(), ".codex", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var STATE_FILE = path2.join(STATE_DIR, "respan_state.json");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".codex", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var STATE_FILE = path3.join(STATE_DIR, "respan_state.json");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.CODEX_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.CODEX_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 initLogging(LOG_FILE, DEBUG_MODE);
@@ -656,13 +679,13 @@ function createSpans(sessionId, turnNum, turn, config) {
   return addDefaultsToAll(spans);
 }
 function findSessionFile(sessionId) {
-  const sessionsDir = path2.join(os2.homedir(), ".codex", "sessions");
-  if (!fs2.existsSync(sessionsDir)) return null;
+  const sessionsDir = path3.join(os3.homedir(), ".codex", "sessions");
+  if (!fs3.existsSync(sessionsDir)) return null;
   const walk = (dir) => {
-    const entries = fs2.readdirSync(dir).sort().reverse();
+    const entries = fs3.readdirSync(dir).sort().reverse();
     for (const entry of entries) {
-      const full = path2.join(dir, entry);
-      if (fs2.statSync(full).isDirectory()) {
+      const full = path3.join(dir, entry);
+      if (fs3.statSync(full).isDirectory()) {
         const result = walk(full);
         if (result) return result;
       } else if (entry.endsWith(".jsonl") && entry.includes(sessionId)) {
@@ -674,14 +697,14 @@ function findSessionFile(sessionId) {
   return walk(sessionsDir);
 }
 function findLatestSessionFile() {
-  const sessionsDir = path2.join(os2.homedir(), ".codex", "sessions");
-  if (!fs2.existsSync(sessionsDir)) return null;
+  const sessionsDir = path3.join(os3.homedir(), ".codex", "sessions");
+  if (!fs3.existsSync(sessionsDir)) return null;
   let latestFile = null;
   let latestMtime = 0;
   const walk = (dir) => {
-    for (const entry of fs2.readdirSync(dir)) {
-      const full = path2.join(dir, entry);
-      const stat = fs2.statSync(full);
+    for (const entry of fs3.readdirSync(dir)) {
+      const full = path3.join(dir, entry);
+      const stat = fs3.statSync(full);
       if (stat.isDirectory()) walk(full);
       else if (entry.endsWith(".jsonl") && stat.mtimeMs > latestMtime) {
         latestMtime = stat.mtimeMs;
@@ -692,11 +715,11 @@ function findLatestSessionFile() {
   walk(sessionsDir);
   if (!latestFile) return null;
   try {
-    const firstLine = fs2.readFileSync(latestFile, "utf-8").split("\n")[0];
+    const firstLine = fs3.readFileSync(latestFile, "utf-8").split("\n")[0];
     if (!firstLine) return null;
     const firstMsg = JSON.parse(firstLine);
     const payload = firstMsg.payload ?? {};
-    const sessionId = String(payload.id ?? path2.basename(latestFile, ".jsonl"));
+    const sessionId = String(payload.id ?? path3.basename(latestFile, ".jsonl"));
     return { sessionId, sessionFile: latestFile };
   } catch {
     return null;
@@ -713,7 +736,7 @@ async function mainWorker() {
     log("ERROR", "No API key");
     return;
   }
-  const config = cwd ? loadRespanConfig(path2.join(cwd, ".codex", "respan.json")) : null;
+  const config = cwd ? loadRespanConfig(path3.join(cwd, ".codex", "respan.json")) : null;
   const maxAttempts = 3;
   let turns = 0;
   try {
@@ -723,7 +746,7 @@ async function mainWorker() {
         const state = loadState(STATE_FILE);
         const sessionState = state[sessionId] ?? {};
         const lastTurnCount = Number(sessionState.turn_count ?? 0);
-        const lines = fs2.readFileSync(sessionFile, "utf-8").trim().split("\n");
+        const lines = fs3.readFileSync(sessionFile, "utf-8").trim().split("\n");
         const events = parseSession(lines);
         const allTurns = extractTurns(events);
         if (allTurns.length > lastTurnCount) {

package/dist/hooks/gemini-cli.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/gemini-cli.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -45,13 +67,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -62,14 +84,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -99,11 +122,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -126,10 +149,10 @@ function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -327,9 +350,9 @@ function toOtlpPayload(spans) {
 }
 
 // src/hooks/gemini-cli.ts
-var STATE_DIR = path2.join(os2.homedir(), ".gemini", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".gemini", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.GEMINI_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.GEMINI_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 var SEND_DELAY = parseInt(process.env.GEMINI_RESPAN_SEND_DELAY ?? "10", 10) || 10;
@@ -382,13 +405,13 @@ function formatToolInput(toolName, args) {
 }
 function statePath(sessionId) {
   const safeId = sessionId.replace(/[/\\]/g, "_").slice(0, 64);
-  return path2.join(STATE_DIR, `respan_stream_${safeId}.json`);
+  return path3.join(STATE_DIR, `respan_stream_${safeId}.json`);
 }
 function loadStreamState(sessionId) {
   const p = statePath(sessionId);
-  if (fs2.existsSync(p)) {
+  if (fs3.existsSync(p)) {
     try {
-      return JSON.parse(fs2.readFileSync(p, "utf-8"));
+      return JSON.parse(fs3.readFileSync(p, "utf-8"));
     } catch {
     }
   }
@@ -396,22 +419,22 @@ function loadStreamState(sessionId) {
 }
 function saveStreamState(sessionId, state) {
   const p = statePath(sessionId);
-  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs3.mkdirSync(path3.dirname(p), { recursive: true });
   const tmp = p + ".tmp." + process.pid;
   try {
-    fs2.writeFileSync(tmp, JSON.stringify(state));
-    fs2.renameSync(tmp, p);
+    fs3.writeFileSync(tmp, JSON.stringify(state));
+    fs3.renameSync(tmp, p);
   } catch {
     try {
-      fs2.unlinkSync(tmp);
+      fs3.unlinkSync(tmp);
     } catch {
     }
-    fs2.writeFileSync(p, JSON.stringify(state));
+    fs3.writeFileSync(p, JSON.stringify(state));
   }
 }
 function clearStreamState(sessionId) {
   try {
-    fs2.unlinkSync(statePath(sessionId));
+    fs3.unlinkSync(statePath(sessionId));
   } catch {
   }
 }
@@ -582,11 +605,11 @@ function sendSpansDetached(spans, apiKey, baseUrl) {
   const url = resolveTracingIngestEndpoint(baseUrl);
   debug(`Sending ${spans.length} span(s) to ${url}: ${spans.map((s) => s.span_name).join(", ")}`);
   if (DEBUG_MODE) {
-    const debugFile = path2.join(STATE_DIR, "respan_last_payload.json");
-    fs2.writeFileSync(debugFile, JSON.stringify(spans, null, 2));
+    const debugFile = path3.join(STATE_DIR, "respan_last_payload.json");
+    fs3.writeFileSync(debugFile, JSON.stringify(spans, null, 2));
   }
-  const payloadFile = path2.join(STATE_DIR, `respan_send_${process.pid}.json`);
-  fs2.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
+  const payloadFile = path3.join(STATE_DIR, `respan_send_${process.pid}.json`);
+  fs3.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
   const senderScript = `
 const fs = require('fs');
 const pf = ${JSON.stringify(payloadFile)};
@@ -626,14 +649,14 @@ try {
   } catch (e) {
     log("ERROR", `Failed to launch sender: ${e}`);
     try {
-      fs2.unlinkSync(payloadFile);
+      fs3.unlinkSync(payloadFile);
     } catch {
     }
   }
 }
 function launchDelayedSend(sessionId, sendVersion, spans, apiKey, baseUrl) {
-  const payloadFile = path2.join(STATE_DIR, `respan_delayed_${process.pid}.json`);
-  fs2.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
+  const payloadFile = path3.join(STATE_DIR, `respan_delayed_${process.pid}.json`);
+  fs3.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
   const stateFile = statePath(sessionId);
   const url = resolveTracingIngestEndpoint(baseUrl);
   const script = `
@@ -679,7 +702,7 @@ setTimeout(async () => {
   } catch (e) {
     log("ERROR", `Failed to launch delayed sender: ${e}`);
     try {
-      fs2.unlinkSync(payloadFile);
+      fs3.unlinkSync(payloadFile);
     } catch {
     }
   }
@@ -825,7 +848,7 @@ function processChunk(hookData) {
   const finalCompletion = completionTokens || state.last_tokens;
   const finalTotal = Number(usage.totalTokenCount ?? 0) || finalPrompt + finalCompletion;
   const tok = { prompt_tokens: finalPrompt, completion_tokens: finalCompletion, total_tokens: finalTotal };
-  const config = loadRespanConfig(path2.join(os2.homedir(), ".gemini", "respan.json"));
+  const config = loadRespanConfig(path3.join(os3.homedir(), ".gemini", "respan.json"));
   const spans = buildSpans(
     hookData,
     state.accumulated_text,
@@ -852,8 +875,8 @@ function processChunk(hookData) {
 }
 function processChunkInWorker(dataFile) {
   try {
-    const raw = fs2.readFileSync(dataFile, "utf-8");
-    fs2.unlinkSync(dataFile);
+    const raw = fs3.readFileSync(dataFile, "utf-8");
+    fs3.unlinkSync(dataFile);
     if (!raw.trim()) return;
     const hookData = JSON.parse(raw);
     const unlock = acquireLock(LOCK_PATH);
@@ -865,7 +888,7 @@ function processChunkInWorker(dataFile) {
   } catch (e) {
     log("ERROR", `Worker error: ${e}`);
     try {
-      fs2.unlinkSync(dataFile);
+      fs3.unlinkSync(dataFile);
     } catch {
     }
   }
@@ -878,7 +901,7 @@ function main() {
   }
   let raw = "";
   try {
-    raw = fs2.readFileSync(0, "utf-8");
+    raw = fs3.readFileSync(0, "utf-8");
   } catch {
   }
   process.stdout.write("{}\n");
@@ -897,9 +920,9 @@ function main() {
         unlock?.();
       }
     } else {
-      const dataFile = path2.join(STATE_DIR, `respan_chunk_${process.pid}.json`);
-      fs2.mkdirSync(STATE_DIR, { recursive: true });
-      fs2.writeFileSync(dataFile, raw);
+      const dataFile = path3.join(STATE_DIR, `respan_chunk_${process.pid}.json`);
+      fs3.mkdirSync(STATE_DIR, { recursive: true });
+      fs3.writeFileSync(dataFile, raw);
       try {
         const scriptPath = __filename || process.argv[1];
         const child = (0, import_node_child_process.execFile)("node", [scriptPath], {

package/dist/hooks/shared.js

@@ -7,6 +7,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { tightenCredentialPermissions } from '../lib/config.js';
 // Resolve the v2/traces endpoint (OTLP JSON format)
 export function resolveTracesEndpoint(baseUrl) {
     const DEFAULT = 'https://api.respan.ai/api/v2/traces';
@@ -46,6 +47,8 @@ export function resolveCredentials() {
     if (!apiKey) {
         const credsFile = path.join(os.homedir(), '.respan', 'credentials.json');
         if (fs.existsSync(credsFile)) {
+            // Hook-only users may never run the CLI again after logging in
+            tightenCredentialPermissions();
             try {
                 const creds = JSON.parse(fs.readFileSync(credsFile, 'utf-8'));
                 const configFile = path.join(os.homedir(), '.respan', 'config.json');

package/dist/lib/config.d.ts

@@ -15,6 +15,7 @@ export interface Config {
     activeProfile?: string;
     defaults?: Record<string, string>;
 }
+export declare function tightenCredentialPermissions(): void;
 export declare function getAllCredentials(): Record<string, Credential>;
 export declare function getCredential(profile?: string): Credential | undefined;
 export declare function setCredential(profile: string, credential: Credential): void;

package/dist/lib/config.js

@@ -4,11 +4,27 @@ import * as os from 'node:os';
 const CONFIG_DIR = path.join(os.homedir(), '.respan');
 const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
-function ensureConfigDir() {
-    if (!fs.existsSync(CONFIG_DIR)) {
-        fs.mkdirSync(CONFIG_DIR, { recursive: true });
+const CONFIG_DIR_MODE = 0o700;
+const CREDENTIALS_FILE_MODE = 0o600;
+// Removes group and other access, keeping the owner's bits. Best-effort: a path
+// we can't chmod (another owner, read-only mount) must stay usable, and Windows
+// doesn't map these modes to ACLs.
+function restrictToOwner(target) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        const mode = fs.statSync(target).mode & 0o777;
+        if (mode & 0o077)
+            fs.chmodSync(target, mode & 0o700);
+    }
+    catch {
+        // Missing, or not ours to change
     }
 }
+function ensureConfigDir() {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: CONFIG_DIR_MODE });
+    restrictToOwner(CONFIG_DIR);
+}
 function readJson(filePath, fallback) {
     try {
         if (!fs.existsSync(filePath))
@@ -20,12 +36,24 @@ function readJson(filePath, fallback) {
         return fallback;
     }
 }
-function writeJson(filePath, data) {
+function writeJson(filePath, data, mode = 0o666) {
     ensureConfigDir();
-    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf-8', mode });
 }
 // --- Credentials ---
+// Tightens files written by older CLI versions, which used the default modes.
+export function tightenCredentialPermissions() {
+    restrictToOwner(CONFIG_DIR);
+    restrictToOwner(CREDENTIALS_FILE);
+}
+function writeCredentials(creds) {
+    // writeFileSync's mode only applies when it creates the file, so tighten an
+    // existing one first: new secrets must not land in a world-readable file.
+    restrictToOwner(CREDENTIALS_FILE);
+    writeJson(CREDENTIALS_FILE, creds, CREDENTIALS_FILE_MODE);
+}
 export function getAllCredentials() {
+    tightenCredentialPermissions();
     return readJson(CREDENTIALS_FILE, {});
 }
 export function getCredential(profile) {
@@ -36,7 +64,7 @@ export function getCredential(profile) {
 export function setCredential(profile, credential) {
     const creds = getAllCredentials();
     creds[profile] = credential;
-    writeJson(CREDENTIALS_FILE, creds);
+    writeCredentials(creds);
     // Set active profile if this is the first credential
     const config = getConfig();
     if (!config.activeProfile) {
@@ -46,7 +74,7 @@ export function setCredential(profile, credential) {
 export function deleteCredential(profile) {
     const creds = getAllCredentials();
     delete creds[profile];
-    writeJson(CREDENTIALS_FILE, creds);
+    writeCredentials(creds);
 }
 // --- Config ---
 export function getConfig() {

package/oclif.manifest.json

@@ -914,16 +914,14 @@
         "set.js"
       ]
     },
-    "datasets:create-span": {
+    "demo:clear": {
       "aliases": [],
-      "args": {
-        "dataset-id": {
-          "description": "Dataset ID",
-          "name": "dataset-id",
-          "required": true
-        }
-      },
-      "description": "Create a span in a dataset",
+      "args": {},
+      "description": "Delete the sample prompts, datasets, and evaluators created by `respan demo`. Demo traces are left in place (each run is timestamped history). Idempotent — safe to re-run.",
+      "examples": [
+        "<%= config.bin %> demo clear",
+        "<%= config.bin %> demo clear --yes"
+      ],
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -966,18 +964,17 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "body": {
-          "description": "Span body as JSON string",
-          "name": "body",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
+        "yes": {
+          "char": "y",
+          "description": "Skip the confirmation prompt",
+          "name": "yes",
+          "allowNo": false,
+          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:create-span",
+      "id": "demo:clear",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -987,14 +984,17 @@
       "relativePath": [
         "dist",
         "commands",
-        "datasets",
-        "create-span.js"
+        "demo",
+        "clear.js"
       ]
     },
-    "datasets:create": {
+    "demo": {
       "aliases": [],
       "args": {},
-      "description": "Create a new dataset",
+      "description": "Seed your account with sample data (prompts and traces) so you have something to explore. Idempotent — safe to re-run.",
+      "examples": [
+        "<%= config.bin %> demo"
+      ],
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1036,26 +1036,11 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
-        },
-        "name": {
-          "description": "Dataset name",
-          "name": "name",
-          "required": true,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "description": {
-          "description": "Dataset description",
-          "name": "description",
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:create",
+      "id": "demo",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1065,25 +1050,20 @@
       "relativePath": [
         "dist",
         "commands",
-        "datasets",
-        "create.js"
+        "demo",
+        "index.js"
       ]
     },
-    "datasets:get-span": {
+    "datasets:create-span": {
       "aliases": [],
       "args": {
         "dataset-id": {
           "description": "Dataset ID",
           "name": "dataset-id",
           "required": true
-        },
-        "span-id": {
-          "description": "Span ID",
-          "name": "span-id",
-          "required": true
         }
       },
-      "description": "Get a specific span from a dataset",
+      "description": "Create a span in a dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1125,11 +1105,19 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
+        },
+        "body": {
+          "description": "Span body as JSON string",
+          "name": "body",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:get-span",
+      "id": "datasets:create-span",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1140,19 +1128,13 @@
         "dist",
         "commands",
         "datasets",
-        "get-span.js"
+        "create-span.js"
       ]
     },
-    "datasets:get": {
+    "datasets:create": {
       "aliases": [],
-      "args": {
-        "id": {
-          "description": "Dataset ID",
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Get a specific dataset",
+      "args": {},
+      "description": "Create a new dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1194,11 +1176,26 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
+        },
+        "name": {
+          "description": "Dataset name",
+          "name": "name",
+          "required": true,
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "description": {
+          "description": "Dataset description",
+          "name": "description",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:get",
+      "id": "datasets:create",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1209,13 +1206,24 @@
         "dist",
         "commands",
         "datasets",
-        "get.js"
+        "create.js"
       ]
     },
-    "datasets:list": {
+    "datasets:get-span": {
       "aliases": [],
-      "args": {},
-      "description": "List datasets",
+      "args": {
+        "dataset-id": {
+          "description": "Dataset ID",
+          "name": "dataset-id",
+          "required": true
+        },
+        "span-id": {
+          "description": "Span ID",
+          "name": "span-id",
+          "required": true
+        }
+      },
+      "description": "Get a specific span from a dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1257,27 +1265,11 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
-        },
-        "limit": {
-          "description": "Number of results per page",
-          "name": "limit",
-          "default": 50,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
-        },
-        "page": {
-          "description": "Page number",
-          "name": "page",
-          "default": 1,
-          "hasDynamicHelp": false,
-          "multiple": false,
-          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:list",
+      "id": "datasets:get-span",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1288,19 +1280,19 @@
         "dist",
         "commands",
         "datasets",
-        "list.js"
+        "get-span.js"
       ]
     },
-    "datasets:spans": {
+    "datasets:get": {
       "aliases": [],
       "args": {
-        "dataset-id": {
+        "id": {
           "description": "Dataset ID",
-          "name": "dataset-id",
+          "name": "id",
           "required": true
         }
       },
-      "description": "List spans in a dataset",
+      "description": "Get a specific dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1346,7 +1338,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:spans",
+      "id": "datasets:get",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1357,19 +1349,13 @@
         "dist",
         "commands",
         "datasets",
-        "spans.js"
+        "get.js"
       ]
     },
-    "datasets:update": {
+    "datasets:list": {
       "aliases": [],
-      "args": {
-        "id": {
-          "description": "Dataset ID",
-          "name": "id",
-          "required": true
-        }
-      },
-      "description": "Update a dataset",
+      "args": {},
+      "description": "List datasets",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1412,16 +1398,18 @@
           "allowNo": false,
           "type": "boolean"
         },
-        "name": {
-          "description": "Dataset name",
-          "name": "name",
+        "limit": {
+          "description": "Number of results per page",
+          "name": "limit",
+          "default": 50,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
         },
-        "description": {
-          "description": "Dataset description",
-          "name": "description",
+        "page": {
+          "description": "Page number",
+          "name": "page",
+          "default": 1,
           "hasDynamicHelp": false,
           "multiple": false,
           "type": "option"
@@ -1429,7 +1417,7 @@
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "datasets:update",
+      "id": "datasets:list",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1440,17 +1428,19 @@
         "dist",
         "commands",
         "datasets",
-        "update.js"
+        "list.js"
       ]
     },
-    "demo:clear": {
+    "datasets:spans": {
       "aliases": [],
-      "args": {},
-      "description": "Delete the sample prompts, datasets, and evaluators created by `respan demo`. Demo traces are left in place (each run is timestamped history). Idempotent — safe to re-run.",
-      "examples": [
-        "<%= config.bin %> demo clear",
-        "<%= config.bin %> demo clear --yes"
-      ],
+      "args": {
+        "dataset-id": {
+          "description": "Dataset ID",
+          "name": "dataset-id",
+          "required": true
+        }
+      },
+      "description": "List spans in a dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1492,18 +1482,11 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
-        },
-        "yes": {
-          "char": "y",
-          "description": "Skip the confirmation prompt",
-          "name": "yes",
-          "allowNo": false,
-          "type": "boolean"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "demo:clear",
+      "id": "datasets:spans",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1513,17 +1496,20 @@
       "relativePath": [
         "dist",
         "commands",
-        "demo",
-        "clear.js"
+        "datasets",
+        "spans.js"
       ]
     },
-    "demo": {
+    "datasets:update": {
       "aliases": [],
-      "args": {},
-      "description": "Seed your account with sample data (prompts and traces) so you have something to explore. Idempotent — safe to re-run.",
-      "examples": [
-        "<%= config.bin %> demo"
-      ],
+      "args": {
+        "id": {
+          "description": "Dataset ID",
+          "name": "id",
+          "required": true
+        }
+      },
+      "description": "Update a dataset",
       "flags": {
         "api-key": {
           "description": "API key (env: RESPAN_API_KEY)",
@@ -1565,11 +1551,25 @@
           "name": "verbose",
           "allowNo": false,
           "type": "boolean"
+        },
+        "name": {
+          "description": "Dataset name",
+          "name": "name",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
+        },
+        "description": {
+          "description": "Dataset description",
+          "name": "description",
+          "hasDynamicHelp": false,
+          "multiple": false,
+          "type": "option"
         }
       },
       "hasDynamicHelp": false,
       "hiddenAliases": [],
-      "id": "demo",
+      "id": "datasets:update",
       "pluginAlias": "@respan/cli",
       "pluginName": "@respan/cli",
       "pluginType": "core",
@@ -1579,8 +1579,8 @@
       "relativePath": [
         "dist",
         "commands",
-        "demo",
-        "index.js"
+        "datasets",
+        "update.js"
       ]
     },
     "eval": {
@@ -4285,5 +4285,5 @@
       ]
     }
   },
-  "version": "0.17.1"
+  "version": "0.17.2"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@respan/cli",
-  "version": "0.17.1",
+  "version": "0.17.2",
   "description": "Respan CLI - manage your LLM observability from the command line",
   "type": "module",
   "main": "dist/index.js",