@shipsafe/cli 0.1.0

package/dist/src/autofix/scaffolding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffolding.d.ts","sourceRoot":"","sources":["../../../src/autofix/scaffolding.ts"],"names":[],"mappings":"AAGA,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,sBAAsB,EAAE,CAAC;CAC3C;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EACA,gBAAgB,GAChB,cAAc,GACd,oBAAoB,GACpB,aAAa,GACb,oBAAoB,GACpB,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,GAAG,QAAQ,GAAG,KAAK,CAAC;CACrC;AAED,UAAU,WAAW;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC1C;AAED;;GAEG;AACH,wBAAgB,eAAe,CAAC,WAAW,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,CAavE;AA4MD;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC,CAmDjC"}

package/dist/src/autofix/scaffolding.js

@@ -0,0 +1,249 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+/**
+ * Detect the framework from package.json dependencies.
+ */
+export function detectFramework(packageJson) {
+    const allDeps = {
+        ...packageJson.dependencies,
+        ...packageJson.devDependencies,
+    };
+    // Order matters — more specific frameworks first
+    if (allDeps['next'])
+        return 'nextjs';
+    if (allDeps['hono'])
+        return 'hono';
+    if (allDeps['fastify'])
+        return 'fastify';
+    if (allDeps['express'])
+        return 'express';
+    return null;
+}
+/**
+ * Check if a package is present in the project dependencies.
+ */
+function hasDep(packageJson, name) {
+    return !!(packageJson.dependencies?.[name] || packageJson.devDependencies?.[name]);
+}
+/**
+ * Check if .env is listed in .gitignore.
+ */
+async function checkEnvInGitignore(projectDir) {
+    try {
+        const content = await fs.readFile(path.join(projectDir, '.gitignore'), 'utf-8');
+        return content.split('\n').some((line) => {
+            const trimmed = line.trim();
+            return trimmed === '.env' || trimmed === '.env*' || trimmed === '.env.*';
+        });
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Generate Express-specific security recommendations.
+ */
+function getExpressRecommendations(packageJson) {
+    const recs = [];
+    if (!hasDep(packageJson, 'helmet')) {
+        recs.push({
+            type: 'missing_helmet',
+            description: 'Express app is missing Helmet — HTTP headers are not secured against common attacks (XSS, clickjacking, MIME sniffing).',
+            fix: `// npm install helmet
+import helmet from 'helmet';
+app.use(helmet());`,
+            file: 'src/app.ts',
+            priority: 'high',
+        });
+    }
+    if (!hasDep(packageJson, 'cors')) {
+        recs.push({
+            type: 'missing_cors',
+            description: 'No CORS middleware detected. Without explicit CORS configuration, the API may reject legitimate cross-origin requests or allow unintended origins.',
+            fix: `// npm install cors
+import cors from 'cors';
+app.use(cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') ?? [] }));`,
+            file: 'src/app.ts',
+            priority: 'medium',
+        });
+    }
+    if (!hasDep(packageJson, 'express-rate-limit') && !hasDep(packageJson, 'rate-limiter-flexible')) {
+        recs.push({
+            type: 'missing_rate_limit',
+            description: 'No rate limiting middleware detected. API endpoints are vulnerable to brute-force and denial-of-service attacks.',
+            fix: `// npm install express-rate-limit
+import rateLimit from 'express-rate-limit';
+app.use(rateLimit({ windowMs: 15 * 60 * 1000, max: 100 }));`,
+            file: 'src/app.ts',
+            priority: 'high',
+        });
+    }
+    return recs;
+}
+/**
+ * Generate Next.js-specific security recommendations.
+ */
+function getNextjsRecommendations(packageJson) {
+    const recs = [];
+    // Next.js CSP headers
+    recs.push({
+        type: 'missing_csp',
+        description: 'No Content Security Policy headers detected. CSP prevents XSS, data injection, and other code-injection attacks.',
+        fix: `// In next.config.js or middleware.ts:
+const cspHeader = \`
+  default-src 'self';
+  script-src 'self';
+  style-src 'self';
+  img-src 'self' blob: data:;
+  font-src 'self';
+  connect-src 'self';
+  frame-ancestors 'none';
+\`;
+
+// next.config.js
+const nextConfig = {
+  async headers() {
+    return [{
+      source: '/(.*)',
+      headers: [{ key: 'Content-Security-Policy', value: cspHeader.replace(/\\n/g, '') }],
+    }];
+  },
+};`,
+        file: 'next.config.js',
+        priority: 'high',
+    });
+    if (!hasDep(packageJson, 'rate-limiter-flexible') && !hasDep(packageJson, '@upstash/ratelimit')) {
+        recs.push({
+            type: 'missing_rate_limit',
+            description: 'No rate limiting detected for API routes. Next.js API routes are vulnerable to abuse without rate limiting.',
+            fix: `// npm install @upstash/ratelimit @upstash/redis
+// In your API route or middleware:
+import { Ratelimit } from '@upstash/ratelimit';
+import { Redis } from '@upstash/redis';
+
+const ratelimit = new Ratelimit({
+  redis: Redis.fromEnv(),
+  limiter: Ratelimit.slidingWindow(10, '10 s'),
+});`,
+            file: 'src/middleware.ts',
+            priority: 'medium',
+        });
+    }
+    return recs;
+}
+/**
+ * Generate Fastify-specific security recommendations.
+ */
+function getFastifyRecommendations(packageJson) {
+    const recs = [];
+    if (!hasDep(packageJson, '@fastify/helmet')) {
+        recs.push({
+            type: 'missing_helmet',
+            description: 'Fastify app is missing @fastify/helmet — HTTP security headers are not configured.',
+            fix: `// npm install @fastify/helmet
+import helmet from '@fastify/helmet';
+await app.register(helmet);`,
+            file: 'src/app.ts',
+            priority: 'high',
+        });
+    }
+    if (!hasDep(packageJson, '@fastify/cors')) {
+        recs.push({
+            type: 'missing_cors',
+            description: 'No CORS plugin registered. Cross-origin requests may not be handled correctly.',
+            fix: `// npm install @fastify/cors
+import cors from '@fastify/cors';
+await app.register(cors, { origin: process.env.ALLOWED_ORIGINS?.split(',') ?? [] });`,
+            file: 'src/app.ts',
+            priority: 'medium',
+        });
+    }
+    if (!hasDep(packageJson, '@fastify/rate-limit')) {
+        recs.push({
+            type: 'missing_rate_limit',
+            description: 'No rate limiting plugin detected. API endpoints are vulnerable to brute-force attacks.',
+            fix: `// npm install @fastify/rate-limit
+import rateLimit from '@fastify/rate-limit';
+await app.register(rateLimit, { max: 100, timeWindow: '15 minutes' });`,
+            file: 'src/app.ts',
+            priority: 'high',
+        });
+    }
+    return recs;
+}
+/**
+ * Generate Hono-specific security recommendations.
+ */
+function getHonoRecommendations(packageJson) {
+    const recs = [];
+    recs.push({
+        type: 'missing_cors',
+        description: 'Ensure CORS middleware is configured for your Hono app to control cross-origin access.',
+        fix: `import { cors } from 'hono/cors';
+app.use('*', cors({ origin: process.env.ALLOWED_ORIGINS?.split(',') ?? [] }));`,
+        file: 'src/index.ts',
+        priority: 'medium',
+    });
+    recs.push({
+        type: 'missing_csp',
+        description: 'Add security headers middleware to protect against common web attacks.',
+        fix: `import { secureHeaders } from 'hono/secure-headers';
+app.use('*', secureHeaders());`,
+        file: 'src/index.ts',
+        priority: 'high',
+    });
+    return recs;
+}
+/**
+ * Detect the project framework and generate security recommendations.
+ * Returns null if the framework cannot be detected.
+ */
+export async function detectAndRecommend(projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const packageJsonPath = path.join(dir, 'package.json');
+    let packageJson;
+    try {
+        const raw = await fs.readFile(packageJsonPath, 'utf-8');
+        packageJson = JSON.parse(raw);
+    }
+    catch {
+        return null; // No package.json — can't detect framework
+    }
+    const framework = detectFramework(packageJson);
+    if (!framework)
+        return null;
+    // Get framework-specific recommendations
+    let recommendations;
+    switch (framework) {
+        case 'express':
+            recommendations = getExpressRecommendations(packageJson);
+            break;
+        case 'nextjs':
+            recommendations = getNextjsRecommendations(packageJson);
+            break;
+        case 'fastify':
+            recommendations = getFastifyRecommendations(packageJson);
+            break;
+        case 'hono':
+            recommendations = getHonoRecommendations(packageJson);
+            break;
+        default:
+            recommendations = [];
+    }
+    // Common check: .env in .gitignore
+    const hasEnvInGitignore = await checkEnvInGitignore(dir);
+    if (!hasEnvInGitignore) {
+        recommendations.push({
+            type: 'missing_env_config',
+            description: '.env file is not listed in .gitignore. Environment variables containing secrets may be committed to version control.',
+            fix: `# Add to .gitignore:
+.env
+.env.*
+.env.local`,
+            file: '.gitignore',
+            priority: 'high',
+        });
+    }
+    return { framework, recommendations };
+}
+//# sourceMappingURL=scaffolding.js.map

package/dist/src/autofix/scaffolding.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffolding.js","sourceRoot":"","sources":["../../../src/autofix/scaffolding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AA0BlC;;GAEG;AACH,MAAM,UAAU,eAAe,CAAC,WAAwB;IACtD,MAAM,OAAO,GAAG;QACd,GAAG,WAAW,CAAC,YAAY;QAC3B,GAAG,WAAW,CAAC,eAAe;KAC/B,CAAC;IAEF,iDAAiD;IACjD,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,QAAQ,CAAC;IACrC,IAAI,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACnC,IAAI,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,IAAI,OAAO,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAEzC,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,MAAM,CAAC,WAAwB,EAAE,IAAY;IACpD,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,YAAY,EAAE,CAAC,IAAI,CAAC,IAAI,WAAW,CAAC,eAAe,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC;AACrF,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,mBAAmB,CAAC,UAAkB;IACnD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,YAAY,CAAC,EAAE,OAAO,CAAC,CAAC;QAChF,OAAO,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;YAC5B,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,CAAC;QAC3E,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,WAAwB;IACzD,MAAM,IAAI,GAA6B,EAAE,CAAC;IAE1C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,gBAAgB;YACtB,WAAW,EACT,yHAAyH;YAC3H,GAAG,EAAE;;mBAEQ;YACb,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,MAAM,CAAC,EAAE,CAAC;QACjC,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,cAAc;YACpB,WAAW,EACT,oJAAoJ;YACtJ,GAAG,EAAE;;0EAE+D;YACpE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,kHAAkH;YACpH,GAAG,EAAE;;4DAEiD;YACtD,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,wBAAwB,CAAC,WAAwB;IACxD,MAAM,IAAI,GAA6B,EAAE,CAAC;IAE1C,sBAAsB;IACtB,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,aAAa;QACnB,WAAW,EACT,kHAAkH;QACpH,GAAG,EAAE;;;;;;;;;;;;;;;;;;;GAmBN;QACC,IAAI,EAAE,gBAAgB;QACtB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,uBAAuB,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAChG,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,6GAA6G;YAC/G,GAAG,EAAE;;;;;;;;IAQP;YACE,IAAI,EAAE,mBAAmB;YACzB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,yBAAyB,CAAC,WAAwB;IACzD,MAAM,IAAI,GAA6B,EAAE,CAAC;IAE1C,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,iBAAiB,CAAC,EAAE,CAAC;QAC5C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,gBAAgB;YACtB,WAAW,EACT,oFAAoF;YACtF,GAAG,EAAE;;4BAEiB;YACtB,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,eAAe,CAAC,EAAE,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,cAAc;YACpB,WAAW,EAAE,gFAAgF;YAC7F,GAAG,EAAE;;qFAE0E;YAC/E,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,QAAQ;SACnB,CAAC,CAAC;IACL,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAChD,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,wFAAwF;YAC1F,GAAG,EAAE;;uEAE4D;YACjE,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;GAEG;AACH,SAAS,sBAAsB,CAAC,WAAwB;IACtD,MAAM,IAAI,GAA6B,EAAE,CAAC;IAE1C,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,cAAc;QACpB,WAAW,EACT,wFAAwF;QAC1F,GAAG,EAAE;+EACsE;QAC3E,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,QAAQ;KACnB,CAAC,CAAC;IAEH,IAAI,CAAC,IAAI,CAAC;QACR,IAAI,EAAE,aAAa;QACnB,WAAW,EAAE,wEAAwE;QACrF,GAAG,EAAE;+BACsB;QAC3B,IAAI,EAAE,cAAc;QACpB,QAAQ,EAAE,MAAM;KACjB,CAAC,CAAC;IAEH,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,UAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAC;IAEvD,IAAI,WAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC,CAAC;QACxD,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC1D,CAAC;IAED,MAAM,SAAS,GAAG,eAAe,CAAC,WAAW,CAAC,CAAC;IAC/C,IAAI,CAAC,SAAS;QAAE,OAAO,IAAI,CAAC;IAE5B,yCAAyC;IACzC,IAAI,eAAyC,CAAC;IAC9C,QAAQ,SAAS,EAAE,CAAC;QAClB,KAAK,SAAS;YACZ,eAAe,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM;QACR,KAAK,QAAQ;YACX,eAAe,GAAG,wBAAwB,CAAC,WAAW,CAAC,CAAC;YACxD,MAAM;QACR,KAAK,SAAS;YACZ,eAAe,GAAG,yBAAyB,CAAC,WAAW,CAAC,CAAC;YACzD,MAAM;QACR,KAAK,MAAM;YACT,eAAe,GAAG,sBAAsB,CAAC,WAAW,CAAC,CAAC;YACtD,MAAM;QACR;YACE,eAAe,GAAG,EAAE,CAAC;IACzB,CAAC;IAED,mCAAmC;IACnC,MAAM,iBAAiB,GAAG,MAAM,mBAAmB,CAAC,GAAG,CAAC,CAAC;IACzD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QACvB,eAAe,CAAC,IAAI,CAAC;YACnB,IAAI,EAAE,oBAAoB;YAC1B,WAAW,EACT,sHAAsH;YACxH,GAAG,EAAE;;;WAGA;YACL,IAAI,EAAE,YAAY;YAClB,QAAQ,EAAE,MAAM;SACjB,CAAC,CAAC;IACL,CAAC;IAED,OAAO,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;AACxC,CAAC"}

package/dist/src/autofix/secret-fixer.d.ts

@@ -0,0 +1,27 @@
+import type { Finding } from '../types.js';
+export interface SecretFix {
+    file: string;
+    line: number;
+    secretType: string;
+    envVarName: string;
+    filesModified: string[];
+}
+/**
+ * Generate an appropriate env var name from the secret type and surrounding context.
+ */
+export declare function generateEnvVarName(secretType: string, context: string): string;
+/**
+ * Detect the type of secret from the value or context.
+ */
+export declare function detectSecretType(value: string, context: string): string;
+/**
+ * Ensure .env is in .gitignore. Creates .gitignore if it doesn't exist.
+ * Returns true if .gitignore was modified, false if .env was already present.
+ */
+export declare function ensureGitignoreHasEnv(projectDir?: string): Promise<boolean>;
+/**
+ * Detect and fix a hardcoded secret by moving it to .env and replacing
+ * the inline value with a process.env reference.
+ */
+export declare function fixHardcodedSecret(finding: Finding, projectDir?: string): Promise<SecretFix>;
+//# sourceMappingURL=secret-fixer.d.ts.map

package/dist/src/autofix/secret-fixer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-fixer.d.ts","sourceRoot":"","sources":["../../../src/autofix/secret-fixer.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,aAAa,CAAC;AAE3C,MAAM,WAAW,SAAS;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,EAAE,MAAM,EAAE,CAAC;CACzB;AAED;;GAEG;AACH,wBAAgB,kBAAkB,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAwB9E;AAED;;GAEG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAgBvE;AAED;;;GAGG;AACH,wBAAsB,qBAAqB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAwBjF;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,OAAO,EAChB,UAAU,CAAC,EAAE,MAAM,GAClB,OAAO,CAAC,SAAS,CAAC,CAkEpB"}

package/dist/src/autofix/secret-fixer.js

@@ -0,0 +1,138 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+/**
+ * Generate an appropriate env var name from the secret type and surrounding context.
+ */
+export function generateEnvVarName(secretType, context) {
+    // Combine type and context, remove non-alphanumeric chars, convert to UPPER_SNAKE_CASE
+    let raw = context || secretType;
+    // Remove common prefixes like 'const', 'let', 'var'
+    raw = raw.replace(/^(?:const|let|var)\s+/, '');
+    // Take just the first identifier if there's an assignment (include hyphens for kebab-case)
+    const identMatch = raw.match(/^([\w-]+)/);
+    if (identMatch) {
+        raw = identMatch[1];
+    }
+    // Convert camelCase / PascalCase to UPPER_SNAKE_CASE
+    const snaked = raw
+        .replace(/([a-z])([A-Z])/g, '$1_$2')
+        .replace(/([A-Z]+)([A-Z][a-z])/g, '$1_$2')
+        .replace(/[^a-zA-Z0-9]/g, '_')
+        .toUpperCase();
+    // Remove leading/trailing underscores
+    const cleaned = snaked.replace(/^_+|_+$/g, '').replace(/_+/g, '_');
+    return cleaned || 'SECRET_VALUE';
+}
+/**
+ * Detect the type of secret from the value or context.
+ */
+export function detectSecretType(value, context) {
+    const lower = (value + ' ' + context).toLowerCase();
+    if (/AKIA[0-9A-Z]{16}/.test(value))
+        return 'aws_access_key';
+    if (lower.includes('database') || lower.includes('postgres') || lower.includes('mysql'))
+        return 'database_url';
+    if (lower.includes('stripe') && lower.includes('sk_'))
+        return 'stripe_secret_key';
+    if (lower.includes('supabase'))
+        return 'supabase_key';
+    if (lower.includes('firebase'))
+        return 'firebase_key';
+    if (lower.includes('jwt') || lower.includes('token'))
+        return 'token';
+    if (lower.includes('password') || lower.includes('passwd'))
+        return 'password';
+    if (lower.includes('key') || lower.includes('apikey') || lower.includes('api_key'))
+        return 'api_key';
+    if (lower.includes('secret'))
+        return 'secret';
+    return 'api_key';
+}
+/**
+ * Ensure .env is in .gitignore. Creates .gitignore if it doesn't exist.
+ * Returns true if .gitignore was modified, false if .env was already present.
+ */
+export async function ensureGitignoreHasEnv(projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const gitignorePath = path.join(dir, '.gitignore');
+    let content = '';
+    try {
+        content = await fs.readFile(gitignorePath, 'utf-8');
+    }
+    catch {
+        // .gitignore doesn't exist — we'll create it
+    }
+    // Check if .env is already covered
+    const lines = content.split('\n');
+    const hasEnv = lines.some((line) => {
+        const trimmed = line.trim();
+        return trimmed === '.env' || trimmed === '.env*' || trimmed === '.env.*';
+    });
+    if (hasEnv)
+        return false;
+    // Append .env entry
+    const separator = content.length > 0 && !content.endsWith('\n') ? '\n' : '';
+    await fs.writeFile(gitignorePath, content + separator + '.env\n', 'utf-8');
+    return true;
+}
+/**
+ * Detect and fix a hardcoded secret by moving it to .env and replacing
+ * the inline value with a process.env reference.
+ */
+export async function fixHardcodedSecret(finding, projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const filePath = path.resolve(dir, finding.file);
+    const filesModified = [];
+    // 1. Read the file containing the hardcoded secret
+    const content = await fs.readFile(filePath, 'utf-8');
+    const lines = content.split('\n');
+    const targetLine = lines[finding.line - 1];
+    if (!targetLine) {
+        throw new Error(`Line ${finding.line} not found in ${finding.file}`);
+    }
+    // 2. Extract the secret value
+    const secretMatch = targetLine.match(/['"`]([A-Za-z0-9_\-./+=:@]{8,})['"`]/);
+    if (!secretMatch) {
+        throw new Error(`Could not extract secret value from line ${finding.line} in ${finding.file}`);
+    }
+    const secretValue = secretMatch[1];
+    // 3. Determine variable context
+    const varNameMatch = targetLine.match(/(?:const|let|var)\s+(\w+)|(\w+)\s*[:=]/);
+    const context = varNameMatch?.[1] ?? varNameMatch?.[2] ?? '';
+    // 4. Detect secret type
+    const secretType = detectSecretType(secretValue, context);
+    // 5. Generate env var name
+    const envVarName = generateEnvVarName(secretType, context);
+    // 6. Replace hardcoded value with process.env reference
+    const newLine = targetLine.replace(secretMatch[0], `process.env.${envVarName}`);
+    lines[finding.line - 1] = newLine;
+    await fs.writeFile(filePath, lines.join('\n'), 'utf-8');
+    filesModified.push(finding.file);
+    // 7. Append to .env
+    const envPath = path.join(dir, '.env');
+    let envContent = '';
+    try {
+        envContent = await fs.readFile(envPath, 'utf-8');
+    }
+    catch {
+        // .env doesn't exist yet — will be created
+    }
+    if (!envContent.includes(`${envVarName}=`)) {
+        const separator = envContent.length > 0 && !envContent.endsWith('\n') ? '\n' : '';
+        await fs.writeFile(envPath, envContent + separator + `${envVarName}=${secretValue}\n`, 'utf-8');
+        filesModified.push('.env');
+    }
+    // 8. Ensure .env is in .gitignore
+    const gitignoreModified = await ensureGitignoreHasEnv(dir);
+    if (gitignoreModified) {
+        filesModified.push('.gitignore');
+    }
+    return {
+        file: finding.file,
+        line: finding.line,
+        secretType,
+        envVarName,
+        filesModified,
+    };
+}
+//# sourceMappingURL=secret-fixer.js.map

package/dist/src/autofix/secret-fixer.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-fixer.js","sourceRoot":"","sources":["../../../src/autofix/secret-fixer.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAWlC;;GAEG;AACH,MAAM,UAAU,kBAAkB,CAAC,UAAkB,EAAE,OAAe;IACpE,uFAAuF;IACvF,IAAI,GAAG,GAAG,OAAO,IAAI,UAAU,CAAC;IAEhC,oDAAoD;IACpD,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,uBAAuB,EAAE,EAAE,CAAC,CAAC;IAE/C,2FAA2F;IAC3F,MAAM,UAAU,GAAG,GAAG,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC;IAC1C,IAAI,UAAU,EAAE,CAAC;QACf,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAC;IACtB,CAAC;IAED,qDAAqD;IACrD,MAAM,MAAM,GAAG,GAAG;SACf,OAAO,CAAC,iBAAiB,EAAE,OAAO,CAAC;SACnC,OAAO,CAAC,uBAAuB,EAAE,OAAO,CAAC;SACzC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,WAAW,EAAE,CAAC;IAEjB,sCAAsC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAEnE,OAAO,OAAO,IAAI,cAAc,CAAC;AACnC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa,EAAE,OAAe;IAC7D,MAAM,KAAK,GAAG,CAAC,KAAK,GAAG,GAAG,GAAG,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAEpD,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAC5D,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QACrF,OAAO,cAAc,CAAC;IACxB,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,OAAO,mBAAmB,CAAC;IAClF,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC;QAAE,OAAO,cAAc,CAAC;IACtD,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IACrE,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,UAAU,CAAC;IAC9E,IAAI,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC;QAChF,OAAO,SAAS,CAAC;IACnB,IAAI,KAAK,CAAC,QAAQ,CAAC,QAAQ,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE9C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,UAAmB;IAC7D,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,aAAa,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEnD,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,6CAA6C;IAC/C,CAAC;IAED,mCAAmC;IACnC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,OAAO,OAAO,KAAK,MAAM,IAAI,OAAO,KAAK,OAAO,IAAI,OAAO,KAAK,QAAQ,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,IAAI,MAAM;QAAE,OAAO,KAAK,CAAC;IAEzB,oBAAoB;IACpB,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,EAAE,CAAC,SAAS,CAAC,aAAa,EAAE,OAAO,GAAG,SAAS,GAAG,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC3E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAgB,EAChB,UAAmB;IAEnB,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,aAAa,GAAa,EAAE,CAAC;IAEnC,mDAAmD;IACnD,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC;IAE3C,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CAAC,QAAQ,OAAO,CAAC,IAAI,iBAAiB,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,8BAA8B;IAC9B,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC,sCAAsC,CAAC,CAAC;IAC7E,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,MAAM,IAAI,KAAK,CAAC,4CAA4C,OAAO,CAAC,IAAI,OAAO,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,WAAW,GAAG,WAAW,CAAC,CAAC,CAAC,CAAC;IAEnC,gCAAgC;IAChC,MAAM,YAAY,GAAG,UAAU,CAAC,KAAK,CAAC,wCAAwC,CAAC,CAAC;IAChF,MAAM,OAAO,GAAG,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,YAAY,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAE7D,wBAAwB;IACxB,MAAM,UAAU,GAAG,gBAAgB,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;IAE1D,2BAA2B;IAC3B,MAAM,UAAU,GAAG,kBAAkB,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAE3D,wDAAwD;IACxD,MAAM,OAAO,GAAG,UAAU,CAAC,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,eAAe,UAAU,EAAE,CAAC,CAAC;IAChF,KAAK,CAAC,OAAO,CAAC,IAAI,GAAG,CAAC,CAAC,GAAG,OAAO,CAAC;IAClC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;IACxD,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAEjC,oBAAoB;IACpB,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACvC,IAAI,UAAU,GAAG,EAAE,CAAC;IACpB,IAAI,CAAC;QACH,UAAU,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,2CAA2C;IAC7C,CAAC;IAED,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,GAAG,UAAU,GAAG,CAAC,EAAE,CAAC;QAC3C,MAAM,SAAS,GAAG,UAAU,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAClF,MAAM,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,GAAG,UAAU,IAAI,WAAW,IAAI,EAAE,OAAO,CAAC,CAAC;QAChG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAC7B,CAAC;IAED,kCAAkC;IAClC,MAAM,iBAAiB,GAAG,MAAM,qBAAqB,CAAC,GAAG,CAAC,CAAC;IAC3D,IAAI,iBAAiB,EAAE,CAAC;QACtB,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACnC,CAAC;IAED,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,UAAU;QACV,UAAU;QACV,aAAa;KACd,CAAC;AACJ,CAAC"}

package/dist/src/claude-md/manager.d.ts

@@ -0,0 +1,17 @@
+/**
+ * Injects or updates the ShipSafe instruction block in a project's CLAUDE.md file.
+ * - If CLAUDE.md doesn't exist, creates it with just the ShipSafe block.
+ * - If it exists but has no ShipSafe block, appends the block.
+ * - If it exists and has a ShipSafe block, replaces it with the latest template.
+ */
+export declare function injectClaudeMd(projectDir?: string): Promise<void>;
+/**
+ * Removes the ShipSafe block from CLAUDE.md, preserving the rest.
+ * Deletes the file if it would be empty after removal.
+ */
+export declare function removeClaudeMd(projectDir?: string): Promise<void>;
+/**
+ * Checks whether CLAUDE.md contains a ShipSafe instruction block.
+ */
+export declare function hasClaudeMdBlock(projectDir?: string): Promise<boolean>;
+//# sourceMappingURL=manager.d.ts.map

package/dist/src/claude-md/manager.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.d.ts","sourceRoot":"","sources":["../../../src/claude-md/manager.ts"],"names":[],"mappings":"AA0CA;;;;;GAKG;AACH,wBAAsB,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAmCvE;AAED;;;GAGG;AACH,wBAAsB,cAAc,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CvE;AAED;;GAEG;AACH,wBAAsB,gBAAgB,CAAC,UAAU,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAU5E"}

package/dist/src/claude-md/manager.js

@@ -0,0 +1,143 @@
+import * as fs from 'node:fs/promises';
+import * as path from 'node:path';
+import { CLAUDE_MD_START, CLAUDE_MD_END } from '../constants.js';
+const SHIPSAFE_TEMPLATE = `${CLAUDE_MD_START}
+# ShipSafe Security & Monitoring Agent
+
+## Session Start (MANDATORY)
+At the start of EVERY session, do the following:
+1. Ask the user: "ShipSafe is active on this project. Keep security protection enabled? (yes/no)"
+2. If yes: call the \`shipsafe_status\` tool to check project state and queued production errors
+3. If there are queued production errors, present them to the user and offer to fix them BEFORE starting new work
+4. Print the one-line status: "ShipSafe: [score] | [issue count] issues | [error count] production errors"
+
+## Rules (Active Copilot Mode - user said yes)
+
+### Pre-Commit
+- Before EVERY git commit, call \`shipsafe_scan\` and wait for results
+- If critical or high issues are found, fix them before committing. Do NOT commit with unresolved critical/high findings.
+- If medium/low issues are found, inform the user and let them decide
+
+### Security Practices
+- NEVER hardcode API keys, tokens, secrets, or credentials. Always use environment variables.
+- If you detect a hardcoded secret, move it to .env, add .env to .gitignore, and replace with process.env reference
+- When installing packages, call \`shipsafe_check_package\` to verify safety before installing
+- Use parameterized queries. Never concatenate user input into SQL strings.
+
+### Monitoring
+- If this project does not have the ShipSafe monitoring snippet installed and it is a deployable web application, add it
+- Do NOT remove or modify the ShipSafe monitoring snippet or git hooks
+
+### Production Errors
+- When production errors are delivered at session start, address them BEFORE working on new features
+- Use the full context provided (stack trace, root cause, suggested fix)
+- After fixing a production error, inform the user what was fixed and why
+
+## Rules (Silent Guardian Mode - user said no)
+- ShipSafe tools are available but do not proactively use them
+- Git hooks will still run on commit/push
+- Do NOT ask the user about ShipSafe again during this session
+${CLAUDE_MD_END}`;
+/**
+ * Injects or updates the ShipSafe instruction block in a project's CLAUDE.md file.
+ * - If CLAUDE.md doesn't exist, creates it with just the ShipSafe block.
+ * - If it exists but has no ShipSafe block, appends the block.
+ * - If it exists and has a ShipSafe block, replaces it with the latest template.
+ */
+export async function injectClaudeMd(projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const filePath = path.join(dir, 'CLAUDE.md');
+    let existing = null;
+    try {
+        existing = await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        // File doesn't exist
+    }
+    if (existing === null) {
+        // No file — create with just the block
+        await fs.writeFile(filePath, SHIPSAFE_TEMPLATE + '\n', 'utf-8');
+        return;
+    }
+    if (existing.includes(CLAUDE_MD_START)) {
+        // Replace existing block
+        const startIdx = existing.indexOf(CLAUDE_MD_START);
+        const endIdx = existing.indexOf(CLAUDE_MD_END);
+        if (endIdx === -1) {
+            // Malformed — has start but no end. Replace from start to EOF.
+            const before = existing.substring(0, startIdx);
+            await fs.writeFile(filePath, before + SHIPSAFE_TEMPLATE + '\n', 'utf-8');
+            return;
+        }
+        const before = existing.substring(0, startIdx);
+        const after = existing.substring(endIdx + CLAUDE_MD_END.length);
+        await fs.writeFile(filePath, before + SHIPSAFE_TEMPLATE + after, 'utf-8');
+    }
+    else {
+        // Append with blank line separator
+        const separator = existing.endsWith('\n') ? '\n' : '\n\n';
+        await fs.writeFile(filePath, existing + separator + SHIPSAFE_TEMPLATE + '\n', 'utf-8');
+    }
+}
+/**
+ * Removes the ShipSafe block from CLAUDE.md, preserving the rest.
+ * Deletes the file if it would be empty after removal.
+ */
+export async function removeClaudeMd(projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const filePath = path.join(dir, 'CLAUDE.md');
+    let content;
+    try {
+        content = await fs.readFile(filePath, 'utf-8');
+    }
+    catch {
+        // File doesn't exist — nothing to do
+        return;
+    }
+    if (!content.includes(CLAUDE_MD_START)) {
+        // No ShipSafe block — nothing to do
+        return;
+    }
+    const startIdx = content.indexOf(CLAUDE_MD_START);
+    const endIdx = content.indexOf(CLAUDE_MD_END);
+    if (endIdx === -1) {
+        // Malformed — has start but no end. Remove from start to EOF.
+        const before = content.substring(0, startIdx);
+        const trimmed = before.replace(/\n+$/, '');
+        if (trimmed.length === 0) {
+            await fs.unlink(filePath);
+        }
+        else {
+            await fs.writeFile(filePath, trimmed + '\n', 'utf-8');
+        }
+        return;
+    }
+    const before = content.substring(0, startIdx);
+    const after = content.substring(endIdx + CLAUDE_MD_END.length);
+    let result = before + after;
+    // Clean up multiple consecutive blank lines (3+ newlines -> 2 newlines)
+    result = result.replace(/\n{3,}/g, '\n\n');
+    // Trim trailing whitespace
+    result = result.replace(/\s+$/, '');
+    if (result.length === 0) {
+        await fs.unlink(filePath);
+    }
+    else {
+        await fs.writeFile(filePath, result + '\n', 'utf-8');
+    }
+}
+/**
+ * Checks whether CLAUDE.md contains a ShipSafe instruction block.
+ */
+export async function hasClaudeMdBlock(projectDir) {
+    const dir = projectDir ?? process.cwd();
+    const filePath = path.join(dir, 'CLAUDE.md');
+    try {
+        const content = await fs.readFile(filePath, 'utf-8');
+        return content.includes(CLAUDE_MD_START);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=manager.js.map

package/dist/src/claude-md/manager.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"manager.js","sourceRoot":"","sources":["../../../src/claude-md/manager.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACvC,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,eAAe,EAAE,aAAa,EAAE,MAAM,iBAAiB,CAAC;AAEjE,MAAM,iBAAiB,GAAG,GAAG,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAoC1C,aAAa,EAAE,CAAC;AAElB;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAmB;IACtD,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE7C,IAAI,QAAQ,GAAkB,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAClD,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IAED,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,uCAAuC;QACvC,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,iBAAiB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QAChE,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,yBAAyB;QACzB,MAAM,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;QACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAC/C,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;YAClB,+DAA+D;YAC/D,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;YAC/C,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;YACzE,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC/C,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;QAChE,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,iBAAiB,GAAG,KAAK,EAAE,OAAO,CAAC,CAAC;IAC5E,CAAC;SAAM,CAAC;QACN,mCAAmC;QACnC,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,iBAAiB,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACzF,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,UAAmB;IACtD,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE7C,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,qCAAqC;QACrC,OAAO;IACT,CAAC;IAED,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC;QACvC,oCAAoC;QACpC,OAAO;IACT,CAAC;IAED,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;IAC9C,IAAI,MAAM,KAAK,CAAC,CAAC,EAAE,CAAC;QAClB,8DAA8D;QAC9D,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAC3C,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QAC5B,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;QACxD,CAAC;QACD,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9C,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IAE/D,IAAI,MAAM,GAAG,MAAM,GAAG,KAAK,CAAC;IAE5B,wEAAwE;IACxE,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IAE3C,2BAA2B;IAC3B,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAEpC,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,MAAM,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IACvD,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,UAAmB;IACxD,MAAM,GAAG,GAAG,UAAU,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,WAAW,CAAC,CAAC;IAE7C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QACrD,OAAO,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/src/cli/activate.d.ts

@@ -0,0 +1,4 @@
+import { Command } from 'commander';
+export declare function handleActivateAction(licenseKey: string): Promise<void>;
+export declare function registerActivateCommand(program: Command): void;
+//# sourceMappingURL=activate.d.ts.map

package/dist/src/cli/activate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"activate.d.ts","sourceRoot":"","sources":["../../../src/cli/activate.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAIpC,wBAAsB,oBAAoB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAuD5E;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,OAAO,GAAG,IAAI,CAO9D"}