@respan/cli 0.17.1 → 0.17.3

package/dist/hooks/gemini-cli.cjs

@@ -23,15 +23,37 @@ var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__ge
 ));
 
 // src/hooks/gemini-cli.ts
+var fs3 = __toESM(require("node:fs"), 1);
+var os3 = __toESM(require("node:os"), 1);
+var path3 = __toESM(require("node:path"), 1);
+var import_node_child_process = require("node:child_process");
+
+// src/hooks/shared.ts
 var fs2 = __toESM(require("node:fs"), 1);
 var os2 = __toESM(require("node:os"), 1);
 var path2 = __toESM(require("node:path"), 1);
-var import_node_child_process = require("node:child_process");
 
-// src/hooks/shared.ts
+// src/lib/config.ts
 var fs = __toESM(require("node:fs"), 1);
-var os = __toESM(require("node:os"), 1);
 var path = __toESM(require("node:path"), 1);
+var os = __toESM(require("node:os"), 1);
+var CONFIG_DIR = path.join(os.homedir(), ".respan");
+var CREDENTIALS_FILE = path.join(CONFIG_DIR, "credentials.json");
+var CONFIG_FILE = path.join(CONFIG_DIR, "config.json");
+function restrictToOwner(target) {
+  if (process.platform === "win32") return;
+  try {
+    const mode = fs.statSync(target).mode & 511;
+    if (mode & 63) fs.chmodSync(target, mode & 448);
+  } catch {
+  }
+}
+function tightenCredentialPermissions() {
+  restrictToOwner(CONFIG_DIR);
+  restrictToOwner(CREDENTIALS_FILE);
+}
+
+// src/hooks/shared.ts
 function resolveTracesEndpoint(baseUrl) {
   const DEFAULT = "https://api.respan.ai/api/v2/traces";
   if (!baseUrl) return DEFAULT;
@@ -45,13 +67,13 @@ var _debug = false;
 function initLogging(logFile, debug2) {
   _logFile = logFile;
   _debug = debug2;
-  const dir = path.dirname(logFile);
-  fs.mkdirSync(dir, { recursive: true });
+  const dir = path2.dirname(logFile);
+  fs2.mkdirSync(dir, { recursive: true });
 }
 function log(level, message) {
   if (!_logFile) return;
   const ts = (/* @__PURE__ */ new Date()).toISOString().replace("T", " ").slice(0, 19);
-  fs.appendFileSync(_logFile, `${ts} [${level}] ${message}
+  fs2.appendFileSync(_logFile, `${ts} [${level}] ${message}
 `);
 }
 function debug(message) {
@@ -62,14 +84,15 @@ function resolveCredentials() {
   let apiKey = process.env.RESPAN_API_KEY ?? "";
   let baseUrl = process.env.RESPAN_BASE_URL ?? DEFAULT_BASE_URL;
   if (!apiKey) {
-    const credsFile = path.join(os.homedir(), ".respan", "credentials.json");
-    if (fs.existsSync(credsFile)) {
+    const credsFile = path2.join(os2.homedir(), ".respan", "credentials.json");
+    if (fs2.existsSync(credsFile)) {
+      tightenCredentialPermissions();
       try {
-        const creds = JSON.parse(fs.readFileSync(credsFile, "utf-8"));
-        const configFile = path.join(os.homedir(), ".respan", "config.json");
+        const creds = JSON.parse(fs2.readFileSync(credsFile, "utf-8"));
+        const configFile = path2.join(os2.homedir(), ".respan", "config.json");
         let profile = "default";
-        if (fs.existsSync(configFile)) {
-          const cfg = JSON.parse(fs.readFileSync(configFile, "utf-8"));
+        if (fs2.existsSync(configFile)) {
+          const cfg = JSON.parse(fs2.readFileSync(configFile, "utf-8"));
           profile = cfg.activeProfile ?? "default";
         }
         const cred = creds[profile] ?? {};
@@ -99,11 +122,11 @@ var KNOWN_CONFIG_KEYS = /* @__PURE__ */ new Set([
   "project_id"
 ]);
 function loadRespanConfig(configPath) {
-  if (!fs.existsSync(configPath)) {
+  if (!fs2.existsSync(configPath)) {
     return { fields: {}, properties: {} };
   }
   try {
-    const raw = JSON.parse(fs.readFileSync(configPath, "utf-8"));
+    const raw = JSON.parse(fs2.readFileSync(configPath, "utf-8"));
     if (typeof raw !== "object" || raw === null || Array.isArray(raw)) {
       return { fields: {}, properties: {} };
     }
@@ -126,10 +149,10 @@ function acquireLock(lockPath, timeoutMs = 5e3) {
   const deadline = Date.now() + timeoutMs;
   while (Date.now() < deadline) {
     try {
-      fs.mkdirSync(lockPath);
+      fs2.mkdirSync(lockPath);
       return () => {
         try {
-          fs.rmdirSync(lockPath);
+          fs2.rmdirSync(lockPath);
         } catch {
         }
       };
@@ -327,9 +350,9 @@ function toOtlpPayload(spans) {
 }
 
 // src/hooks/gemini-cli.ts
-var STATE_DIR = path2.join(os2.homedir(), ".gemini", "state");
-var LOG_FILE = path2.join(STATE_DIR, "respan_hook.log");
-var LOCK_PATH = path2.join(STATE_DIR, "respan_hook.lock");
+var STATE_DIR = path3.join(os3.homedir(), ".gemini", "state");
+var LOG_FILE = path3.join(STATE_DIR, "respan_hook.log");
+var LOCK_PATH = path3.join(STATE_DIR, "respan_hook.lock");
 var DEBUG_MODE = (process.env.GEMINI_RESPAN_DEBUG ?? "").toLowerCase() === "true";
 var MAX_CHARS = parseInt(process.env.GEMINI_RESPAN_MAX_CHARS ?? "4000", 10) || 4e3;
 var SEND_DELAY = parseInt(process.env.GEMINI_RESPAN_SEND_DELAY ?? "10", 10) || 10;
@@ -382,13 +405,13 @@ function formatToolInput(toolName, args) {
 }
 function statePath(sessionId) {
   const safeId = sessionId.replace(/[/\\]/g, "_").slice(0, 64);
-  return path2.join(STATE_DIR, `respan_stream_${safeId}.json`);
+  return path3.join(STATE_DIR, `respan_stream_${safeId}.json`);
 }
 function loadStreamState(sessionId) {
   const p = statePath(sessionId);
-  if (fs2.existsSync(p)) {
+  if (fs3.existsSync(p)) {
     try {
-      return JSON.parse(fs2.readFileSync(p, "utf-8"));
+      return JSON.parse(fs3.readFileSync(p, "utf-8"));
     } catch {
     }
   }
@@ -396,22 +419,22 @@ function loadStreamState(sessionId) {
 }
 function saveStreamState(sessionId, state) {
   const p = statePath(sessionId);
-  fs2.mkdirSync(path2.dirname(p), { recursive: true });
+  fs3.mkdirSync(path3.dirname(p), { recursive: true });
   const tmp = p + ".tmp." + process.pid;
   try {
-    fs2.writeFileSync(tmp, JSON.stringify(state));
-    fs2.renameSync(tmp, p);
+    fs3.writeFileSync(tmp, JSON.stringify(state));
+    fs3.renameSync(tmp, p);
   } catch {
     try {
-      fs2.unlinkSync(tmp);
+      fs3.unlinkSync(tmp);
     } catch {
     }
-    fs2.writeFileSync(p, JSON.stringify(state));
+    fs3.writeFileSync(p, JSON.stringify(state));
   }
 }
 function clearStreamState(sessionId) {
   try {
-    fs2.unlinkSync(statePath(sessionId));
+    fs3.unlinkSync(statePath(sessionId));
   } catch {
   }
 }
@@ -582,11 +605,11 @@ function sendSpansDetached(spans, apiKey, baseUrl) {
   const url = resolveTracingIngestEndpoint(baseUrl);
   debug(`Sending ${spans.length} span(s) to ${url}: ${spans.map((s) => s.span_name).join(", ")}`);
   if (DEBUG_MODE) {
-    const debugFile = path2.join(STATE_DIR, "respan_last_payload.json");
-    fs2.writeFileSync(debugFile, JSON.stringify(spans, null, 2));
+    const debugFile = path3.join(STATE_DIR, "respan_last_payload.json");
+    fs3.writeFileSync(debugFile, JSON.stringify(spans, null, 2));
   }
-  const payloadFile = path2.join(STATE_DIR, `respan_send_${process.pid}.json`);
-  fs2.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
+  const payloadFile = path3.join(STATE_DIR, `respan_send_${process.pid}.json`);
+  fs3.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
   const senderScript = `
 const fs = require('fs');
 const pf = ${JSON.stringify(payloadFile)};
@@ -626,14 +649,14 @@ try {
   } catch (e) {
     log("ERROR", `Failed to launch sender: ${e}`);
     try {
-      fs2.unlinkSync(payloadFile);
+      fs3.unlinkSync(payloadFile);
     } catch {
     }
   }
 }
 function launchDelayedSend(sessionId, sendVersion, spans, apiKey, baseUrl) {
-  const payloadFile = path2.join(STATE_DIR, `respan_delayed_${process.pid}.json`);
-  fs2.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
+  const payloadFile = path3.join(STATE_DIR, `respan_delayed_${process.pid}.json`);
+  fs3.writeFileSync(payloadFile, JSON.stringify(toOtlpPayload(spans)));
   const stateFile = statePath(sessionId);
   const url = resolveTracingIngestEndpoint(baseUrl);
   const script = `
@@ -679,7 +702,7 @@ setTimeout(async () => {
   } catch (e) {
     log("ERROR", `Failed to launch delayed sender: ${e}`);
     try {
-      fs2.unlinkSync(payloadFile);
+      fs3.unlinkSync(payloadFile);
     } catch {
     }
   }
@@ -825,7 +848,7 @@ function processChunk(hookData) {
   const finalCompletion = completionTokens || state.last_tokens;
   const finalTotal = Number(usage.totalTokenCount ?? 0) || finalPrompt + finalCompletion;
   const tok = { prompt_tokens: finalPrompt, completion_tokens: finalCompletion, total_tokens: finalTotal };
-  const config = loadRespanConfig(path2.join(os2.homedir(), ".gemini", "respan.json"));
+  const config = loadRespanConfig(path3.join(os3.homedir(), ".gemini", "respan.json"));
   const spans = buildSpans(
     hookData,
     state.accumulated_text,
@@ -852,8 +875,8 @@ function processChunk(hookData) {
 }
 function processChunkInWorker(dataFile) {
   try {
-    const raw = fs2.readFileSync(dataFile, "utf-8");
-    fs2.unlinkSync(dataFile);
+    const raw = fs3.readFileSync(dataFile, "utf-8");
+    fs3.unlinkSync(dataFile);
     if (!raw.trim()) return;
     const hookData = JSON.parse(raw);
     const unlock = acquireLock(LOCK_PATH);
@@ -865,7 +888,7 @@ function processChunkInWorker(dataFile) {
   } catch (e) {
     log("ERROR", `Worker error: ${e}`);
     try {
-      fs2.unlinkSync(dataFile);
+      fs3.unlinkSync(dataFile);
     } catch {
     }
   }
@@ -878,7 +901,7 @@ function main() {
   }
   let raw = "";
   try {
-    raw = fs2.readFileSync(0, "utf-8");
+    raw = fs3.readFileSync(0, "utf-8");
   } catch {
   }
   process.stdout.write("{}\n");
@@ -897,9 +920,9 @@ function main() {
         unlock?.();
       }
     } else {
-      const dataFile = path2.join(STATE_DIR, `respan_chunk_${process.pid}.json`);
-      fs2.mkdirSync(STATE_DIR, { recursive: true });
-      fs2.writeFileSync(dataFile, raw);
+      const dataFile = path3.join(STATE_DIR, `respan_chunk_${process.pid}.json`);
+      fs3.mkdirSync(STATE_DIR, { recursive: true });
+      fs3.writeFileSync(dataFile, raw);
       try {
         const scriptPath = __filename || process.argv[1];
         const child = (0, import_node_child_process.execFile)("node", [scriptPath], {

package/dist/hooks/shared.d.ts

@@ -34,7 +34,6 @@ export interface SpanData {
     completion_message?: Record<string, unknown> | null;
     warnings?: string;
     encoding_format?: string;
-    disable_fallback?: boolean;
     respan_params?: Record<string, unknown>;
     field_name?: string;
     delimiter?: string;

package/dist/hooks/shared.js

@@ -7,6 +7,7 @@
 import * as fs from 'node:fs';
 import * as os from 'node:os';
 import * as path from 'node:path';
+import { tightenCredentialPermissions } from '../lib/config.js';
 // Resolve the v2/traces endpoint (OTLP JSON format)
 export function resolveTracesEndpoint(baseUrl) {
     const DEFAULT = 'https://api.respan.ai/api/v2/traces';
@@ -46,6 +47,8 @@ export function resolveCredentials() {
     if (!apiKey) {
         const credsFile = path.join(os.homedir(), '.respan', 'credentials.json');
         if (fs.existsSync(credsFile)) {
+            // Hook-only users may never run the CLI again after logging in
+            tightenCredentialPermissions();
             try {
                 const creds = JSON.parse(fs.readFileSync(credsFile, 'utf-8'));
                 const configFile = path.join(os.homedir(), '.respan', 'config.json');

package/dist/lib/config.d.ts

@@ -15,6 +15,7 @@ export interface Config {
     activeProfile?: string;
     defaults?: Record<string, string>;
 }
+export declare function tightenCredentialPermissions(): void;
 export declare function getAllCredentials(): Record<string, Credential>;
 export declare function getCredential(profile?: string): Credential | undefined;
 export declare function setCredential(profile: string, credential: Credential): void;

package/dist/lib/config.js

@@ -4,11 +4,27 @@ import * as os from 'node:os';
 const CONFIG_DIR = path.join(os.homedir(), '.respan');
 const CREDENTIALS_FILE = path.join(CONFIG_DIR, 'credentials.json');
 const CONFIG_FILE = path.join(CONFIG_DIR, 'config.json');
-function ensureConfigDir() {
-    if (!fs.existsSync(CONFIG_DIR)) {
-        fs.mkdirSync(CONFIG_DIR, { recursive: true });
+const CONFIG_DIR_MODE = 0o700;
+const CREDENTIALS_FILE_MODE = 0o600;
+// Removes group and other access, keeping the owner's bits. Best-effort: a path
+// we can't chmod (another owner, read-only mount) must stay usable, and Windows
+// doesn't map these modes to ACLs.
+function restrictToOwner(target) {
+    if (process.platform === 'win32')
+        return;
+    try {
+        const mode = fs.statSync(target).mode & 0o777;
+        if (mode & 0o077)
+            fs.chmodSync(target, mode & 0o700);
+    }
+    catch {
+        // Missing, or not ours to change
     }
 }
+function ensureConfigDir() {
+    fs.mkdirSync(CONFIG_DIR, { recursive: true, mode: CONFIG_DIR_MODE });
+    restrictToOwner(CONFIG_DIR);
+}
 function readJson(filePath, fallback) {
     try {
         if (!fs.existsSync(filePath))
@@ -20,12 +36,24 @@ function readJson(filePath, fallback) {
         return fallback;
     }
 }
-function writeJson(filePath, data) {
+function writeJson(filePath, data, mode = 0o666) {
     ensureConfigDir();
-    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', 'utf-8');
+    fs.writeFileSync(filePath, JSON.stringify(data, null, 2) + '\n', { encoding: 'utf-8', mode });
 }
 // --- Credentials ---
+// Tightens files written by older CLI versions, which used the default modes.
+export function tightenCredentialPermissions() {
+    restrictToOwner(CONFIG_DIR);
+    restrictToOwner(CREDENTIALS_FILE);
+}
+function writeCredentials(creds) {
+    // writeFileSync's mode only applies when it creates the file, so tighten an
+    // existing one first: new secrets must not land in a world-readable file.
+    restrictToOwner(CREDENTIALS_FILE);
+    writeJson(CREDENTIALS_FILE, creds, CREDENTIALS_FILE_MODE);
+}
 export function getAllCredentials() {
+    tightenCredentialPermissions();
     return readJson(CREDENTIALS_FILE, {});
 }
 export function getCredential(profile) {
@@ -36,7 +64,7 @@ export function getCredential(profile) {
 export function setCredential(profile, credential) {
     const creds = getAllCredentials();
     creds[profile] = credential;
-    writeJson(CREDENTIALS_FILE, creds);
+    writeCredentials(creds);
     // Set active profile if this is the first credential
     const config = getConfig();
     if (!config.activeProfile) {
@@ -46,7 +74,7 @@ export function setCredential(profile, credential) {
 export function deleteCredential(profile) {
     const creds = getAllCredentials();
     delete creds[profile];
-    writeJson(CREDENTIALS_FILE, creds);
+    writeCredentials(creds);
 }
 // --- Config ---
 export function getConfig() {

package/dist/lib/demo/prompt-fixtures.d.ts

@@ -37,7 +37,6 @@ export interface DemoPromptVersion {
     stream?: boolean;
     thinking?: Record<string, unknown>;
     variables?: Record<string, unknown>;
-    load_balance_models?: Record<string, unknown>[];
     tools?: Record<string, unknown>[];
     tool_choice?: string | Record<string, unknown>;
     response_format?: Record<string, unknown>;