@respan/cli 0.17.1 → 0.17.3

package/dist/hooks/claude-code.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/claude-code.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -44,13 +66,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -61,14 +83,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -98,11 +121,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -122,36 +145,36 @@ function loadRespanConfig(configPath) {
   }
 }
 function loadState(statePath) {
-  if (!fs.existsSync(statePath)) return {};
+  if (!fs2.existsSync(statePath)) return {};
   try {
-    return JSON.parse(fs.readFileSync(statePath, "utf-8"));
+    return JSON.parse(fs2.readFileSync(statePath, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveState(statePath, state) {
-  const dir = path.dirname(statePath);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(statePath);
+  fs2.mkdirSync(dir, { recursive: true });
   const tmpPath = statePath + ".tmp." + process.pid;
   try {
-    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs.renameSync(tmpPath, statePath);
+    fs2.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs2.renameSync(tmpPath, statePath);
   } catch (e) {
     try {
-      fs.unlinkSync(tmpPath);
+      fs2.unlinkSync(tmpPath);
     } catch {
     }
-    fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    fs2.writeFileSync(statePath, JSON.stringify(state, null, 2));
   }
 }
 function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -360,9 +383,9 @@ async function sendSpans(spans, apiKey, baseUrl, context) {
   const spanNames = spans.map((s) => s.span_name);
   debug(`Sending ${spans.length} spans (${body.length} bytes) to ${url} for ${context}: ${spanNames.join(", ")}`);
   if (_debug) {
-    const debugDir = _logFile ? path.dirname(_logFile) : os.tmpdir();
-    const debugFile = path.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
-    fs.writeFileSync(debugFile, body);
+    const debugDir = _logFile ? path2.dirname(_logFile) : os2.tmpdir();
+    const debugFile = path2.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
+    fs2.writeFileSync(debugFile, body);
     debug(`Dumped OTLP payload to ${debugFile}`);
   }
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -403,10 +426,10 @@ function sleep(ms) {
 }
 
 // src/hooks/claude-code.ts
-var STATE_DIR = path2.join(os2.homedir(), ".claude", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var STATE_FILE = path2.join(STATE_DIR, "respan_state.json");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".claude", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var STATE_FILE = path3.join(STATE_DIR, "respan_state.json");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.CC_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.CC_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 initLogging(LOG_FILE, DEBUG_MODE);
@@ -730,7 +753,7 @@ function processTranscript(sessionId, transcriptFile, state, apiKey, baseUrl, co
   const sessionState = state[sessionId] ?? {};
   const lastLine = Number(sessionState.last_line ?? 0);
   const turnCount = Number(sessionState.turn_count ?? 0);
-  const content = fs2.readFileSync(transcriptFile, "utf-8");
+  const content = fs3.readFileSync(transcriptFile, "utf-8");
   const lines = content.trim().split("\n");
   const totalLines = lines.length;
   if (lastLine >= totalLines) {
@@ -831,13 +854,13 @@ function processTranscript(sessionId, transcriptFile, state, apiKey, baseUrl, co
 function readStdinPayload() {
   if (process.stdin.isTTY) return null;
   try {
-    const raw = fs2.readFileSync(0, "utf-8");
+    const raw = fs3.readFileSync(0, "utf-8");
     if (!raw.trim()) return null;
     const payload = JSON.parse(raw);
     const sessionId = String(payload.session_id ?? "");
     const transcriptPath = String(payload.transcript_path ?? "");
     if (!sessionId || !transcriptPath) return null;
-    if (!fs2.existsSync(transcriptPath)) return null;
+    if (!fs3.existsSync(transcriptPath)) return null;
     debug(`Got transcript from stdin: session=${sessionId}, path=${transcriptPath}`);
     return { sessionId, transcriptPath };
   } catch {
@@ -845,17 +868,17 @@ function readStdinPayload() {
   }
 }
 function findLatestTranscript() {
-  const projectsDir = path2.join(os2.homedir(), ".claude", "projects");
-  if (!fs2.existsSync(projectsDir)) return null;
+  const projectsDir = path3.join(os3.homedir(), ".claude", "projects");
+  if (!fs3.existsSync(projectsDir)) return null;
   let latestFile = null;
   let latestMtime = 0;
-  for (const projEntry of fs2.readdirSync(projectsDir)) {
-    const projDir = path2.join(projectsDir, projEntry);
-    if (!fs2.statSync(projDir).isDirectory()) continue;
-    for (const file of fs2.readdirSync(projDir)) {
+  for (const projEntry of fs3.readdirSync(projectsDir)) {
+    const projDir = path3.join(projectsDir, projEntry);
+    if (!fs3.statSync(projDir).isDirectory()) continue;
+    for (const file of fs3.readdirSync(projDir)) {
       if (!file.endsWith(".jsonl")) continue;
-      const full = path2.join(projDir, file);
-      const mtime = fs2.statSync(full).mtimeMs;
+      const full = path3.join(projDir, file);
+      const mtime = fs3.statSync(full).mtimeMs;
       if (mtime > latestMtime) {
         latestMtime = mtime;
         latestFile = full;
@@ -864,10 +887,10 @@ function findLatestTranscript() {
   }
   if (!latestFile) return null;
   try {
-    const firstLine = fs2.readFileSync(latestFile, "utf-8").split("\n")[0];
+    const firstLine = fs3.readFileSync(latestFile, "utf-8").split("\n")[0];
     if (!firstLine) return null;
     const firstMsg = JSON.parse(firstLine);
-    const sessionId = String(firstMsg.sessionId ?? path2.basename(latestFile, ".jsonl"));
+    const sessionId = String(firstMsg.sessionId ?? path3.basename(latestFile, ".jsonl"));
     return { sessionId, transcriptPath: latestFile };
   } catch {
     return null;
@@ -886,7 +909,7 @@ async function mainWorker() {
   debug(`Processing session: ${sessionId}`);
   let config = null;
   try {
-    const content = fs2.readFileSync(transcriptPath, "utf-8");
+    const content = fs3.readFileSync(transcriptPath, "utf-8");
     const lines = content.split("\n");
     let cwd = "";
     for (const line of lines.slice(0, 5)) {
@@ -901,7 +924,7 @@ async function mainWorker() {
       }
     }
     if (cwd) {
-      config = loadRespanConfig(path2.join(cwd, ".claude", "respan.json"));
+      config = loadRespanConfig(path3.join(cwd, ".claude", "respan.json"));
     }
   } catch {
   }

package/dist/hooks/codex-cli.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/codex-cli.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -44,13 +66,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -61,14 +83,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -98,11 +121,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -122,36 +145,36 @@ function loadRespanConfig(configPath) {
   }
 }
 function loadState(statePath) {
-  if (!fs.existsSync(statePath)) return {};
+  if (!fs2.existsSync(statePath)) return {};
   try {
-    return JSON.parse(fs.readFileSync(statePath, "utf-8"));
+    return JSON.parse(fs2.readFileSync(statePath, "utf-8"));
   } catch {
     return {};
   }
 }
 function saveState(statePath, state) {
-  const dir = path.dirname(statePath);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(statePath);
+  fs2.mkdirSync(dir, { recursive: true });
   const tmpPath = statePath + ".tmp." + process.pid;
   try {
-    fs.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
-    fs.renameSync(tmpPath, statePath);
+    fs2.writeFileSync(tmpPath, JSON.stringify(state, null, 2));
+    fs2.renameSync(tmpPath, statePath);
   } catch (e) {
     try {
-      fs.unlinkSync(tmpPath);
+      fs2.unlinkSync(tmpPath);
     } catch {
     }
-    fs.writeFileSync(statePath, JSON.stringify(state, null, 2));
+    fs2.writeFileSync(statePath, JSON.stringify(state, null, 2));
   }
 }
 function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -360,9 +383,9 @@ async function sendSpans(spans, apiKey, baseUrl, context) {
   const spanNames = spans.map((s) => s.span_name);
   debug(`Sending ${spans.length} spans (${body.length} bytes) to ${url} for ${context}: ${spanNames.join(", ")}`);
   if (_debug) {
-    const debugDir = _logFile ? path.dirname(_logFile) : os.tmpdir();
-    const debugFile = path.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
-    fs.writeFileSync(debugFile, body);
+    const debugDir = _logFile ? path2.dirname(_logFile) : os2.tmpdir();
+    const debugFile = path2.join(debugDir, `respan_spans_${context.replace(/\s+/g, "_")}.json`);
+    fs2.writeFileSync(debugFile, body);
     debug(`Dumped OTLP payload to ${debugFile}`);
   }
   for (let attempt = 0; attempt < 3; attempt++) {
@@ -403,10 +426,10 @@ function sleep(ms) {
 }
 
 // src/hooks/codex-cli.ts
-var STATE_DIR = path2.join(os2.homedir(), ".codex", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var STATE_FILE = path2.join(STATE_DIR, "respan_state.json");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".codex", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var STATE_FILE = path3.join(STATE_DIR, "respan_state.json");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.CODEX_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.CODEX_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 initLogging(LOG_FILE, DEBUG_MODE);
@@ -656,13 +679,13 @@ function createSpans(sessionId, turnNum, turn, config) {
   return addDefaultsToAll(spans);
 }
 function findSessionFile(sessionId) {
-  const sessionsDir = path2.join(os2.homedir(), ".codex", "sessions");
-  if (!fs2.existsSync(sessionsDir)) return null;
+  const sessionsDir = path3.join(os3.homedir(), ".codex", "sessions");
+  if (!fs3.existsSync(sessionsDir)) return null;
   const walk = (dir) => {
-    const entries = fs2.readdirSync(dir).sort().reverse();
+    const entries = fs3.readdirSync(dir).sort().reverse();
     for (const entry of entries) {
-      const full = path2.join(dir, entry);
-      if (fs2.statSync(full).isDirectory()) {
+      const full = path3.join(dir, entry);
+      if (fs3.statSync(full).isDirectory()) {
         const result = walk(full);
         if (result) return result;
       } else if (entry.endsWith(".jsonl") && entry.includes(sessionId)) {
@@ -674,14 +697,14 @@ function findSessionFile(sessionId) {
   return walk(sessionsDir);
 }
 function findLatestSessionFile() {
-  const sessionsDir = path2.join(os2.homedir(), ".codex", "sessions");
-  if (!fs2.existsSync(sessionsDir)) return null;
+  const sessionsDir = path3.join(os3.homedir(), ".codex", "sessions");
+  if (!fs3.existsSync(sessionsDir)) return null;
   let latestFile = null;
   let latestMtime = 0;
   const walk = (dir) => {
-    for (const entry of fs2.readdirSync(dir)) {
-      const full = path2.join(dir, entry);
-      const stat = fs2.statSync(full);
+    for (const entry of fs3.readdirSync(dir)) {
+      const full = path3.join(dir, entry);
+      const stat = fs3.statSync(full);
       if (stat.isDirectory()) walk(full);
       else if (entry.endsWith(".jsonl") && stat.mtimeMs > latestMtime) {
         latestMtime = stat.mtimeMs;
@@ -692,11 +715,11 @@ function findLatestSessionFile() {
   walk(sessionsDir);
   if (!latestFile) return null;
   try {
-    const firstLine = fs2.readFileSync(latestFile, "utf-8").split("\n")[0];
+    const firstLine = fs3.readFileSync(latestFile, "utf-8").split("\n")[0];
     if (!firstLine) return null;
     const firstMsg = JSON.parse(firstLine);
     const payload = firstMsg.payload ?? {};
-    const sessionId = String(payload.id ?? path2.basename(latestFile, ".jsonl"));
+    const sessionId = String(payload.id ?? path3.basename(latestFile, ".jsonl"));
     return { sessionId, sessionFile: latestFile };
   } catch {
     return null;
@@ -713,7 +736,7 @@ async function mainWorker() {
     log("ERROR", "No API key");
     return;
   }
-  const config = cwd ? loadRespanConfig(path2.join(cwd, ".codex", "respan.json")) : null;
+  const config = cwd ? loadRespanConfig(path3.join(cwd, ".codex", "respan.json")) : null;
   const maxAttempts = 3;
   let turns = 0;
   try {
@@ -723,7 +746,7 @@ async function mainWorker() {
         const state = loadState(STATE_FILE);
         const sessionState = state[sessionId] ?? {};
         const lastTurnCount = Number(sessionState.turn_count ?? 0);
-        const lines = fs2.readFileSync(sessionFile, "utf-8").trim().split("\n");
+        const lines = fs3.readFileSync(sessionFile, "utf-8").trim().split("\n");
         const events = parseSession(lines);
         const allTurns = extractTurns(events);
         if (allTurns.length > lastTurnCount) {