@s-gw/s-gw 0.1.0

package/dist/mcp-server.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { executeApprovedRequest } from "./executor.js";
+import { buildEnvCommandAction, buildSshSessionAction, scanLocalFile, scanLocalText } from "./gateway.js";
+import { SecretStore } from "./store.js";
+import { defaultSshInjectEnv } from "./ssh.js";
+const store = new SecretStore();
+const server = new McpServer({
+    name: "s-gw",
+    version: "0.1.0"
+});
+function mcpAgentContext() {
+    return { mcpClientName: server.server.getClientVersion()?.name };
+}
+server.registerTool("sgw_scan_file", {
+    title: "Scan Local File",
+    description: "Scan a local file for secrets and return tokenized text plus local handles. Raw values are not returned.",
+    inputSchema: {
+        path: z.string().min(1),
+        persist: z.boolean().optional()
+    }
+}, async ({ path, persist }) => asText(await scanLocalFile(store, path, { persist: persist ?? true })));
+server.registerTool("sgw_scan_text", {
+    title: "Scan Text",
+    description: "Scan supplied text and return tokenized text. Persist=false previews handles without enrolling secrets.",
+    inputSchema: {
+        text: z.string(),
+        persist: z.boolean().optional(),
+        source: z.string().optional()
+    }
+}, async ({ text, persist, source }) => asText(await scanLocalText(store, text, { persist: persist === true, source })));
+server.registerTool("sgw_list_handles", {
+    title: "List Handles",
+    description: "List known local secret handles and non-secret metadata.",
+    inputSchema: {}
+}, async () => asText(await store.listHandles()));
+server.registerTool("sgw_describe_handle", {
+    title: "Describe Handle",
+    description: "Show non-secret metadata for one local secret handle.",
+    inputSchema: {
+        handle: z.string().min(1)
+    }
+}, async ({ handle }) => asText(await store.getHandle(handle) ?? { error: "unknown_handle", handle }));
+server.registerTool("sgw_request_execution", {
+    title: "Request Secret-Backed Execution",
+    description: "Create a pending local manifest for a command that needs one secret injected as an environment variable.",
+    inputSchema: {
+        handle: z.string().min(1),
+        command: z.string().min(1),
+        args: z.array(z.string()).optional(),
+        injectEnv: z.string().min(1),
+        env: z.array(z.object({
+            handle: z.string().min(1),
+            injectEnv: z.string().min(1)
+        })).optional(),
+        workingDir: z.string().optional(),
+        timeoutMs: z.number().int().nonnegative().optional(),
+        reason: z.string().optional()
+    }
+}, async ({ handle, command, args, injectEnv, env, workingDir, timeoutMs, reason }) => {
+    const action = buildEnvCommandAction({ command, args, injectEnv, env, workingDir, timeoutMs });
+    const request = await store.createRequest(handle, action, reason || "Agent requested local secret-backed execution.", mcpAgentContext());
+    return asText({
+        approvalRequired: request.state !== "approved",
+        localApprovalCommand: request.state === "approved" ? undefined : `s-gw approve ${request.id}`,
+        request
+    });
+});
+server.registerTool("sgw_request_ssh_session", {
+    title: "Request s-gw-Owned SSH Session",
+    description: "Create a local approval request for an SSH command that s-gw will run over its own persistent ControlMaster session.",
+    inputSchema: {
+        handle: z.string().min(1),
+        target: z.string().min(1),
+        port: z.number().int().positive().optional(),
+        args: z.array(z.string()).optional(),
+        injectEnv: z.string().optional(),
+        workingDir: z.string().optional(),
+        timeoutMs: z.number().int().nonnegative().optional(),
+        reason: z.string().optional()
+    }
+}, async ({ handle, target, port, args, injectEnv, workingDir, timeoutMs, reason }) => {
+    const secret = await store.getSecretRecord(handle);
+    const action = buildSshSessionAction({
+        target,
+        port,
+        args,
+        injectEnv: injectEnv || defaultSshInjectEnv(secret),
+        workingDir,
+        timeoutMs
+    });
+    const request = await store.createRequest(handle, action, reason || "Agent requested s-gw-owned SSH access.", mcpAgentContext());
+    return asText({
+        approvalRequired: request.state !== "approved",
+        localApprovalCommand: request.state === "approved" ? undefined : `s-gw approve ${request.id}`,
+        request
+    });
+});
+server.registerTool("sgw_execute_request", {
+    title: "Execute Approved Request",
+    description: "Execute a previously approved local request and return sanitized output.",
+    inputSchema: {
+        requestId: z.string().min(1)
+    }
+}, async ({ requestId }) => asText(await executeApprovedRequest(store, requestId)));
+function asText(value) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(value, null, 2)
+            }
+        ]
+    };
+}
+await server.connect(new StdioServerTransport());
+//# sourceMappingURL=mcp-server.js.map

package/dist/onepassword.d.ts

@@ -0,0 +1,48 @@
+import type { SecretType } from "./types.js";
+export interface OnePasswordStatus {
+    available: boolean;
+    command: string;
+    version?: string;
+    serviceAccountConfigured: boolean;
+    connectConfigured: boolean;
+    error?: string;
+}
+export interface OnePasswordSecretReference {
+    vault: string;
+    itemId: string;
+    itemTitle: string;
+    itemCategory?: string;
+    fieldId: string;
+    fieldLabel: string;
+    fieldType?: string;
+    fieldPurpose?: string;
+    reference: string;
+    secretType: SecretType;
+    suggestedEnv?: string;
+    companionFields?: OnePasswordCompanionField[];
+}
+export interface OnePasswordCompanionField {
+    vault: string;
+    itemId: string;
+    itemTitle: string;
+    itemCategory?: string;
+    fieldId: string;
+    fieldLabel: string;
+    fieldType?: string;
+    fieldPurpose?: string;
+    reference: string;
+    secretType: SecretType;
+    suggestedEnv?: string;
+}
+export interface CreateOnePasswordSecretInput {
+    vault?: string;
+    title: string;
+    type: SecretType;
+    value: string;
+    notes?: string;
+}
+export declare function normalizeOnePasswordReference(reference: string): string;
+export declare function onePasswordStatus(): OnePasswordStatus;
+export declare function listOnePasswordSecretReferences(vault?: string): Promise<OnePasswordSecretReference[]>;
+export declare function createOnePasswordSecretReference(input: CreateOnePasswordSecretInput): Promise<OnePasswordSecretReference>;
+export declare function readOnePasswordReference(reference: string): Promise<string>;

package/dist/onepassword.js

@@ -0,0 +1,412 @@
+import { spawn, spawnSync } from "node:child_process";
+import { accessSync, constants } from "node:fs";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
+import os from "node:os";
+import path from "node:path";
+export function normalizeOnePasswordReference(reference) {
+    const trimmed = reference.trim();
+    if (!trimmed) {
+        throw new Error("1Password reference is required.");
+    }
+    if (trimmed.includes("\0") || /[\r\n]/.test(trimmed)) {
+        throw new Error("1Password reference cannot contain control characters.");
+    }
+    if (!/^op:\/\/[^/]+\/[^/]+\/.+/.test(trimmed)) {
+        throw new Error("1Password reference must look like op://vault/item/field.");
+    }
+    return trimmed;
+}
+export function onePasswordStatus() {
+    const command = resolveOpCommand();
+    const result = spawnSync(command, ["--version"], {
+        encoding: "utf8",
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    return {
+        available: result.status === 0,
+        command,
+        version: result.status === 0 ? result.stdout.trim() : undefined,
+        serviceAccountConfigured: Boolean(process.env.OP_SERVICE_ACCOUNT_TOKEN),
+        connectConfigured: Boolean(process.env.OP_CONNECT_HOST && process.env.OP_CONNECT_TOKEN),
+        error: result.status === 0 ? undefined : (result.stderr.trim() || result.stdout.trim() || "op CLI is not available")
+    };
+}
+export async function listOnePasswordSecretReferences(vault = "Dev") {
+    const normalizedVault = normalizeVaultName(vault);
+    const items = await runOpJson(["item", "list", "--vault", normalizedVault, "--format", "json"]);
+    const refs = [];
+    for (const item of items) {
+        if (!item.id) {
+            continue;
+        }
+        const detail = await runOpJson(["item", "get", item.id, "--vault", normalizedVault, "--format", "json"]);
+        const fields = detail.fields || [];
+        const companionFields = fields
+            .map((field) => companionForField(normalizedVault, detail, field))
+            .filter((field) => Boolean(field));
+        for (const field of fields) {
+            const candidate = referenceForField(normalizedVault, detail, field, companionFields);
+            if (candidate) {
+                refs.push(candidate);
+            }
+        }
+    }
+    refs.sort((a, b) => {
+        const title = a.itemTitle.localeCompare(b.itemTitle);
+        if (title !== 0) {
+            return title;
+        }
+        return a.fieldLabel.localeCompare(b.fieldLabel);
+    });
+    return refs;
+}
+export async function createOnePasswordSecretReference(input) {
+    const vault = normalizeVaultName(input.vault || "Dev");
+    const title = normalizeItemTitle(input.title);
+    if (!input.value) {
+        throw new Error("Cannot create an empty 1Password secret.");
+    }
+    const tmpDir = await mkdtemp(path.join(os.tmpdir(), "sgw-op-create-"));
+    const templatePath = path.join(tmpDir, "item.json");
+    try {
+        await writeFile(templatePath, JSON.stringify(onePasswordTemplate(title, input.value, input.notes), null, 2), {
+            mode: 0o600
+        });
+        const created = await runOpJson([
+            "item",
+            "create",
+            "--vault",
+            vault,
+            "--template",
+            templatePath,
+            "--format",
+            "json"
+        ]);
+        const field = (created.fields || []).find((item) => item.id === "credential" || item.label === "credential");
+        if (!field) {
+            throw new Error("1Password did not return the created credential field.");
+        }
+        const fieldId = field.id?.trim() || "credential";
+        return {
+            vault,
+            itemId: created.id,
+            itemTitle: created.title || title,
+            itemCategory: created.category,
+            fieldId,
+            fieldLabel: field.label?.trim() || fieldId,
+            fieldType: field.type,
+            fieldPurpose: field.purpose,
+            reference: normalizeOnePasswordReference(field.reference || buildReference(vault, created.id, fieldId)),
+            secretType: input.type
+        };
+    }
+    finally {
+        await rm(tmpDir, { recursive: true, force: true });
+    }
+}
+export async function readOnePasswordReference(reference) {
+    const normalized = normalizeOnePasswordReference(reference);
+    const command = resolveOpCommand();
+    const timeoutMs = timeoutFromEnv();
+    const child = spawn(command, ["read", normalized], {
+        env: process.env,
+        shell: false,
+        stdio: ["ignore", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let killTimer;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+        killTimer = setTimeout(() => child.kill("SIGKILL"), 1_500);
+    }, timeoutMs);
+    child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString("utf8");
+    });
+    const status = await new Promise((resolve) => {
+        child.on("error", (error) => resolve({ code: null, error }));
+        child.on("close", (code) => resolve({ code }));
+    });
+    clearTimeout(timeout);
+    if (killTimer) {
+        clearTimeout(killTimer);
+    }
+    if (timedOut) {
+        throw new Error(`Timed out reading 1Password reference after ${timeoutMs}ms.`);
+    }
+    if (status.error) {
+        throw new Error(`Failed to run ${command}: ${status.error.message}`);
+    }
+    if (status.code !== 0) {
+        const message = stderr.trim() || stdout.trim() || `${command} read failed.`;
+        throw new Error(`1Password read failed: ${message}`);
+    }
+    if (!stdout) {
+        throw new Error("1Password returned an empty secret.");
+    }
+    return stdout.replace(/\r?\n$/, "");
+}
+async function runOpJson(args, input) {
+    const output = await runOp(args, input);
+    try {
+        return JSON.parse(output);
+    }
+    catch (error) {
+        throw new Error(`1Password returned invalid JSON for op ${args.join(" ")}.`);
+    }
+}
+async function runOp(args, input) {
+    const command = resolveOpCommand();
+    const timeoutMs = timeoutFromEnv();
+    const child = spawn(command, args, {
+        env: process.env,
+        shell: false,
+        stdio: [input === undefined ? "ignore" : "pipe", "pipe", "pipe"]
+    });
+    let stdout = "";
+    let stderr = "";
+    let timedOut = false;
+    let killTimer;
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        child.kill("SIGTERM");
+        killTimer = setTimeout(() => child.kill("SIGKILL"), 1_500);
+    }, timeoutMs);
+    if (input !== undefined && child.stdin) {
+        child.stdin.end(input);
+    }
+    child.stdout?.on("data", (chunk) => {
+        stdout += chunk.toString("utf8");
+    });
+    child.stderr?.on("data", (chunk) => {
+        stderr += chunk.toString("utf8");
+    });
+    const status = await new Promise((resolve) => {
+        child.on("error", (error) => resolve({ code: null, error }));
+        child.on("close", (code) => resolve({ code }));
+    });
+    clearTimeout(timeout);
+    if (killTimer) {
+        clearTimeout(killTimer);
+    }
+    if (timedOut) {
+        throw new Error(`Timed out running 1Password CLI after ${timeoutMs}ms.`);
+    }
+    if (status.error) {
+        throw new Error(`Failed to run ${command}: ${status.error.message}`);
+    }
+    if (status.code !== 0) {
+        const message = stderr.trim() || stdout.trim() || `${command} ${args.join(" ")} failed.`;
+        throw new Error(`1Password command failed: ${message}`);
+    }
+    return stdout;
+}
+function resolveOpCommand() {
+    if (process.env.SGW_OP_CLI) {
+        return process.env.SGW_OP_CLI;
+    }
+    const realOp = process.env.SGW_REAL_OP_PATH || "/opt/homebrew/Caskroom/1password-cli/2.32.0/op.sgw-real";
+    try {
+        accessSync(realOp, constants.X_OK);
+        return realOp;
+    }
+    catch {
+        return "op";
+    }
+}
+function onePasswordTemplate(title, value, notes) {
+    return {
+        title,
+        category: "API_CREDENTIAL",
+        fields: [
+            {
+                id: "notesPlain",
+                type: "STRING",
+                purpose: "NOTES",
+                label: "notesPlain",
+                value: notes || "Created by s-gw."
+            },
+            {
+                id: "username",
+                type: "STRING",
+                label: "username",
+                value: ""
+            },
+            {
+                id: "credential",
+                type: "CONCEALED",
+                label: "credential",
+                value
+            },
+            {
+                id: "type",
+                type: "MENU",
+                label: "type",
+                value: "API Key"
+            },
+            {
+                id: "filename",
+                type: "STRING",
+                label: "filename",
+                value: ""
+            },
+            {
+                id: "validFrom",
+                type: "DATE",
+                label: "valid from",
+                value: ""
+            },
+            {
+                id: "expires",
+                type: "DATE",
+                label: "expires",
+                value: ""
+            },
+            {
+                id: "hostname",
+                type: "STRING",
+                label: "hostname",
+                value: ""
+            }
+        ]
+    };
+}
+function referenceForField(vault, item, field, companionFields = []) {
+    const label = field.label?.trim() || field.id?.trim() || "";
+    const id = field.id?.trim() || label;
+    if (!id || !isSecretLikeField(field, label)) {
+        return undefined;
+    }
+    const reference = normalizeOnePasswordReference(field.reference || buildReference(vault, item.id, id));
+    return {
+        vault,
+        itemId: item.id,
+        itemTitle: item.title,
+        itemCategory: item.category,
+        fieldId: id,
+        fieldLabel: label || id,
+        fieldType: field.type,
+        fieldPurpose: field.purpose,
+        reference,
+        secretType: secretTypeFor(item, field, label),
+        suggestedEnv: suggestedEnvForField(item, field, label, true),
+        companionFields: companionFields.filter((companion) => companion.fieldId !== id)
+    };
+}
+function companionForField(vault, item, field) {
+    const label = field.label?.trim() || field.id?.trim() || "";
+    const id = field.id?.trim() || label;
+    if (!id || !isCompanionField(item, field, label)) {
+        return undefined;
+    }
+    const reference = normalizeOnePasswordReference(field.reference || buildReference(vault, item.id, id));
+    return {
+        vault,
+        itemId: item.id,
+        itemTitle: item.title,
+        itemCategory: item.category,
+        fieldId: id,
+        fieldLabel: label || id,
+        fieldType: field.type,
+        fieldPurpose: field.purpose,
+        reference,
+        secretType: companionSecretTypeFor(item, field, label),
+        suggestedEnv: suggestedEnvForField(item, field, label, false)
+    };
+}
+function normalizeItemTitle(title) {
+    const trimmed = title.trim();
+    if (!trimmed || trimmed.includes("\0") || /[\r\n]/.test(trimmed)) {
+        throw new Error("1Password item title is required.");
+    }
+    return trimmed.slice(0, 180);
+}
+function isSecretLikeField(field, label) {
+    const type = field.type?.toUpperCase() || "";
+    const purpose = field.purpose?.toUpperCase() || "";
+    const visibleLabel = label.toLowerCase();
+    if (type === "OTP") {
+        return false;
+    }
+    if (type === "CONCEALED" || purpose === "PASSWORD") {
+        return true;
+    }
+    return /(password|passphrase|token|secret|credential|api.?key|access.?key|private.?key|client.?secret)/i.test(visibleLabel);
+}
+function isCompanionField(item, field, label) {
+    const type = field.type?.toUpperCase() || "";
+    if (type === "OTP" || type === "CONCEALED" || isSecretLikeField(field, label)) {
+        return false;
+    }
+    const visibleLabel = `${item.title} ${item.category || ""} ${label} ${field.id || ""}`.toLowerCase();
+    return /(username|user name|access.?key.?id|key.?id|account.?id|client.?id|tenant.?id)/i.test(visibleLabel);
+}
+function secretTypeFor(item, field, label) {
+    const text = `${item.title} ${item.category || ""} ${label} ${field.id || ""}`.toLowerCase();
+    if (text.includes("private key") || text.includes("ssh")) {
+        return "private-key";
+    }
+    if (text.includes("password") || text.includes("passphrase")) {
+        return "password";
+    }
+    if (text.includes("access key")) {
+        return "access-key";
+    }
+    if (text.includes("token") || text.includes("api key") || text.includes("apikey")) {
+        return "api-token";
+    }
+    if (text.includes("credential") || text.includes("secret")) {
+        return "credential";
+    }
+    return "unknown";
+}
+function companionSecretTypeFor(item, field, label) {
+    const text = `${item.title} ${item.category || ""} ${label} ${field.id || ""}`.toLowerCase();
+    if (text.includes("access key") || text.includes("aws")) {
+        return "access-key";
+    }
+    if (text.includes("client id") || text.includes("username") || text.includes("user name")) {
+        return "credential";
+    }
+    return "unknown";
+}
+function suggestedEnvForField(item, field, label, secretField) {
+    const text = `${item.title} ${item.category || ""} ${label} ${field.id || ""}`.toLowerCase();
+    if (text.includes("aws")) {
+        return secretField ? "AWS_SECRET_ACCESS_KEY" : "AWS_ACCESS_KEY_ID";
+    }
+    if (secretField && /(token|api.?key)/i.test(text)) {
+        return "API_TOKEN";
+    }
+    return undefined;
+}
+function buildReference(vault, itemId, fieldId) {
+    return `op://${encodeRefSegment(vault)}/${encodeRefSegment(itemId)}/${encodeRefSegment(fieldId)}`;
+}
+function encodeRefSegment(value) {
+    return value.replaceAll("/", "%2F");
+}
+function normalizeVaultName(vault) {
+    const trimmed = vault.trim();
+    if (!trimmed || trimmed.includes("\0") || /[\r\n]/.test(trimmed)) {
+        throw new Error("1Password vault name is required.");
+    }
+    return trimmed;
+}
+function timeoutFromEnv() {
+    const raw = process.env.SGW_ONEPASSWORD_TIMEOUT_MS;
+    if (!raw) {
+        return 30_000;
+    }
+    const parsed = Number(raw);
+    if (!Number.isFinite(parsed) || parsed <= 0) {
+        return 30_000;
+    }
+    return Math.min(Math.floor(parsed), 300_000);
+}
+//# sourceMappingURL=onepassword.js.map

package/dist/paths.d.ts

@@ -0,0 +1,4 @@
+export declare function expandHome(inputPath: string): string;
+export declare function getSgwHome(): string;
+export declare function getStorePath(home?: string): string;
+export declare function ensureSgwHome(home?: string): Promise<void>;

package/dist/paths.js

@@ -0,0 +1,22 @@
+import os from "node:os";
+import path from "node:path";
+import { mkdir } from "node:fs/promises";
+export function expandHome(inputPath) {
+    if (inputPath === "~") {
+        return os.homedir();
+    }
+    if (inputPath.startsWith("~/")) {
+        return path.join(os.homedir(), inputPath.slice(2));
+    }
+    return inputPath;
+}
+export function getSgwHome() {
+    return path.resolve(expandHome(process.env.SGW_HOME || "~/.s-gw"));
+}
+export function getStorePath(home = getSgwHome()) {
+    return path.join(home, "store.json");
+}
+export async function ensureSgwHome(home = getSgwHome()) {
+    await mkdir(home, { recursive: true, mode: 0o700 });
+}
+//# sourceMappingURL=paths.js.map

package/dist/s-gw Menu Bar.app/Contents/Info.plist

@@ -0,0 +1,28 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>CFBundleExecutable</key>
+  <string>s-gw-menu-bar-helper</string>
+  <key>CFBundleIdentifier</key>
+  <string>com.s-gw.sgw.menu-bar</string>
+  <key>CFBundleIconFile</key>
+  <string>AppIcon</string>
+  <key>CFBundleName</key>
+  <string>s-gw Menu Bar</string>
+  <key>CFBundleDisplayName</key>
+  <string>s-gw</string>
+  <key>CFBundlePackageType</key>
+  <string>APPL</string>
+  <key>CFBundleShortVersionString</key>
+  <string>0.1.0</string>
+  <key>CFBundleVersion</key>
+  <string>1</string>
+  <key>LSMinimumSystemVersion</key>
+  <string>13.0</string>
+  <key>LSUIElement</key>
+  <true/>
+  <key>NSPrincipalClass</key>
+  <string>NSApplication</string>
+</dict>
+</plist>

package/dist/s-gw Menu Bar.app/Contents/Resources/Lucide-bot.svg

@@ -0,0 +1,8 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M12 8V4H8"/>
+  <rect width="16" height="12" x="4" y="8" rx="2"/>
+  <path d="M2 14h2"/>
+  <path d="M20 14h2"/>
+  <path d="M15 13v2"/>
+  <path d="M9 13v2"/>
+</svg>

package/dist/s-gw Menu Bar.app/Contents/Resources/Lucide-monitor.svg

@@ -0,0 +1,5 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect width="20" height="14" x="2" y="3" rx="2"/>
+  <line x1="8" x2="16" y1="21" y2="21"/>
+  <line x1="12" x2="12" y1="17" y2="21"/>
+</svg>

package/dist/s-gw Menu Bar.app/Contents/Resources/Lucide-server.svg

@@ -0,0 +1,6 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <rect width="20" height="8" x="2" y="2" rx="2"/>
+  <rect width="20" height="8" x="2" y="14" rx="2"/>
+  <line x1="6" x2="6.01" y1="6" y2="6"/>
+  <line x1="6" x2="6.01" y1="18" y2="18"/>
+</svg>

package/dist/s-gw Menu Bar.app/Contents/Resources/Lucide-terminal.svg

@@ -0,0 +1,4 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="#000" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
+  <path d="M12 19h8"/>
+  <path d="m4 17 6-6-6-6"/>
+</svg>