@swarmify/agents-cli 1.11.3 → 1.13.0

package/dist/lib/secrets-bundles.d.ts

@@ -0,0 +1,38 @@
+/**
+ * Secret bundles -- named sets of keychain-backed environment variables.
+ *
+ * Each bundle is a YAML file in ~/.agents/secrets/ declaring key names.
+ * Values live in the macOS Keychain and are injected into the agent's
+ * environment at spawn time via `agents run --secrets <bundle>`.
+ */
+import { type BundleValue, type SecretRef } from './secrets.js';
+/** A named set of environment variable definitions backed by various secret providers. */
+export interface SecretsBundle {
+    name: string;
+    description?: string;
+    allow_exec?: boolean;
+    vars: Record<string, BundleValue>;
+}
+/** Validate a bundle name against the allowed pattern. Throws on invalid input. */
+export declare function validateBundleName(name: string): void;
+export declare function validateEnvKey(key: string): void;
+export declare function bundleExists(name: string): boolean;
+export declare function readBundle(name: string): SecretsBundle;
+export declare function writeBundle(bundle: SecretsBundle): void;
+export declare function deleteBundle(name: string): boolean;
+export declare function listBundles(): SecretsBundle[];
+export interface BundleEntryInfo {
+    key: string;
+    kind: 'literal' | 'keychain' | 'env' | 'file' | 'exec';
+    detail: string;
+}
+export declare function describeBundle(bundle: SecretsBundle): BundleEntryInfo[];
+export declare function resolveBundleEnv(bundle: SecretsBundle): Record<string, string>;
+export declare function keychainRef(key: string): string;
+export declare function keychainItemsForBundle(bundle: SecretsBundle): Array<{
+    key: string;
+    item: string;
+}>;
+export declare function parseDotenv(content: string): Record<string, string>;
+export type { SecretRef };
+//# sourceMappingURL=secrets-bundles.d.ts.map

package/dist/lib/secrets-bundles.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-bundles.d.ts","sourceRoot":"","sources":["../../src/lib/secrets-bundles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAMH,OAAO,EAIL,KAAK,WAAW,EAChB,KAAK,SAAS,EACf,MAAM,cAAc,CAAC;AAEtB,0FAA0F;AAC1F,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;CACnC;AAKD,mFAAmF;AACnF,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAIrD;AAED,wBAAgB,cAAc,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,CAIhD;AAMD,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAElD;AAED,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,aAAa,CAqBtD;AAED,wBAAgB,WAAW,CAAC,MAAM,EAAE,aAAa,GAAG,IAAI,CAiBvD;AAED,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMlD;AAED,wBAAgB,WAAW,IAAI,aAAa,EAAE,CAc7C;AAGD,MAAM,WAAW,eAAe;IAC9B,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,SAAS,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;IACvD,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,wBAAgB,cAAc,CAAC,MAAM,EAAE,aAAa,GAAG,eAAe,EAAE,CAWvE;AAMD,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,aAAa,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAwB9E;AAGD,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE/C;AAGD,wBAAgB,sBAAsB,CAAC,MAAM,EAAE,aAAa,GAAG,KAAK,CAAC;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CASlG;AAGD,wBAAgB,WAAW,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAqBnE;AAED,YAAY,EAAE,SAAS,EAAE,CAAC"}

package/dist/lib/secrets-bundles.js

@@ -0,0 +1,176 @@
+/**
+ * Secret bundles -- named sets of keychain-backed environment variables.
+ *
+ * Each bundle is a YAML file in ~/.agents/secrets/ declaring key names.
+ * Values live in the macOS Keychain and are injected into the agent's
+ * environment at spawn time via `agents run --secrets <bundle>`.
+ */
+import * as fs from 'fs';
+import * as path from 'path';
+import * as yaml from 'yaml';
+import { getSecretsDir } from './state.js';
+import { parseBundleValue, resolveRef, secretsKeychainItem, } from './secrets.js';
+const BUNDLE_NAME_PATTERN = /^[a-z0-9][a-z0-9-_]{0,48}$/i;
+const ENV_KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;
+/** Validate a bundle name against the allowed pattern. Throws on invalid input. */
+export function validateBundleName(name) {
+    if (!BUNDLE_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid bundle name '${name}'. Use letters, digits, dash, underscore (max 48 chars).`);
+    }
+}
+export function validateEnvKey(key) {
+    if (!ENV_KEY_PATTERN.test(key)) {
+        throw new Error(`Invalid environment variable name '${key}'. Must match [A-Za-z_][A-Za-z0-9_]*.`);
+    }
+}
+function bundlePath(name) {
+    return path.join(getSecretsDir(), `${name}.yml`);
+}
+export function bundleExists(name) {
+    return fs.existsSync(bundlePath(name));
+}
+export function readBundle(name) {
+    validateBundleName(name);
+    const file = bundlePath(name);
+    if (!fs.existsSync(file)) {
+        throw new Error(`Secrets bundle '${name}' not found.`);
+    }
+    const raw = fs.readFileSync(file, 'utf-8');
+    const parsed = yaml.parse(raw);
+    if (!parsed || typeof parsed !== 'object') {
+        throw new Error(`Bundle '${name}' is malformed.`);
+    }
+    const bundle = {
+        name: parsed.name || name,
+        description: parsed.description,
+        allow_exec: Boolean(parsed.allow_exec),
+        vars: parsed.vars && typeof parsed.vars === 'object' ? parsed.vars : {},
+    };
+    for (const key of Object.keys(bundle.vars)) {
+        validateEnvKey(key);
+    }
+    return bundle;
+}
+export function writeBundle(bundle) {
+    validateBundleName(bundle.name);
+    for (const key of Object.keys(bundle.vars)) {
+        validateEnvKey(key);
+    }
+    const dir = getSecretsDir();
+    fs.mkdirSync(dir, { recursive: true });
+    const body = yaml.stringify({
+        name: bundle.name,
+        description: bundle.description,
+        allow_exec: bundle.allow_exec ? true : undefined,
+        vars: bundle.vars,
+    });
+    const file = bundlePath(bundle.name);
+    const tmp = `${file}.tmp-${process.pid}`;
+    fs.writeFileSync(tmp, body, 'utf-8');
+    fs.renameSync(tmp, file);
+}
+export function deleteBundle(name) {
+    validateBundleName(name);
+    const file = bundlePath(name);
+    if (!fs.existsSync(file))
+        return false;
+    fs.unlinkSync(file);
+    return true;
+}
+export function listBundles() {
+    const dir = getSecretsDir();
+    if (!fs.existsSync(dir))
+        return [];
+    const entries = fs.readdirSync(dir).filter((f) => f.endsWith('.yml') || f.endsWith('.yaml'));
+    const bundles = [];
+    for (const entry of entries) {
+        const name = entry.replace(/\.(yml|yaml)$/, '');
+        try {
+            bundles.push(readBundle(name));
+        }
+        catch {
+            // Skip malformed bundles; surfaced via `agents secrets view <name>`.
+        }
+    }
+    return bundles.sort((a, b) => a.name.localeCompare(b.name));
+}
+export function describeBundle(bundle) {
+    const out = [];
+    for (const [key, raw] of Object.entries(bundle.vars)) {
+        const parsed = parseBundleValue(raw);
+        if ('literal' in parsed) {
+            out.push({ key, kind: 'literal', detail: '' });
+        }
+        else {
+            out.push({ key, kind: parsed.ref.provider, detail: parsed.ref.value });
+        }
+    }
+    return out;
+}
+// Walk the bundle and produce a flat env map. Keychain refs are translated via
+// the bundle-scoped naming scheme so two bundles with the same short ID never
+// collide. Throws on the first missing secret so `agents run` fails loudly
+// rather than silently injecting empty strings.
+export function resolveBundleEnv(bundle) {
+    const env = {};
+    for (const [key, raw] of Object.entries(bundle.vars)) {
+        const parsed = parseBundleValue(raw);
+        if ('literal' in parsed) {
+            env[key] = parsed.literal;
+            continue;
+        }
+        try {
+            env[key] = resolveRef(parsed.ref, {
+                allowExec: bundle.allow_exec,
+                keychainItemFor: (shortId) => secretsKeychainItem(bundle.name, shortId),
+            });
+        }
+        catch (err) {
+            const msg = err.message;
+            if (parsed.ref.provider === 'keychain' && /not found/.test(msg)) {
+                throw new Error(`${msg} Run: agents secrets set ${bundle.name} ${key}`);
+            }
+            throw new Error(`Bundle '${bundle.name}' key '${key}': ${msg}`);
+        }
+    }
+    return env;
+}
+// Build a keychain ref expression from a bundle+key pair, for storage in YAML.
+export function keychainRef(key) {
+    return `keychain:${key}`;
+}
+// Iterate all keychain-backed keys in a bundle for cleanup on rm/unset.
+export function keychainItemsForBundle(bundle) {
+    const items = [];
+    for (const [key, raw] of Object.entries(bundle.vars)) {
+        const parsed = parseBundleValue(raw);
+        if ('ref' in parsed && parsed.ref.provider === 'keychain') {
+            items.push({ key, item: secretsKeychainItem(bundle.name, parsed.ref.value) });
+        }
+    }
+    return items;
+}
+// Parse a dotenv string into key=value pairs, preserving last-wins on duplicates.
+export function parseDotenv(content) {
+    const out = {};
+    for (const raw of content.split('\n')) {
+        const line = raw.trim();
+        if (!line || line.startsWith('#'))
+            continue;
+        const stripped = line.startsWith('export ') ? line.slice('export '.length) : line;
+        const eq = stripped.indexOf('=');
+        if (eq <= 0)
+            continue;
+        const key = stripped.slice(0, eq).trim();
+        let value = stripped.slice(eq + 1).trim();
+        if ((value.startsWith('"') && value.endsWith('"')) ||
+            (value.startsWith("'") && value.endsWith("'"))) {
+            value = value.slice(1, -1);
+        }
+        if (ENV_KEY_PATTERN.test(key)) {
+            out[key] = value;
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=secrets-bundles.js.map

package/dist/lib/secrets-bundles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-bundles.js","sourceRoot":"","sources":["../../src/lib/secrets-bundles.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,YAAY,CAAC;AAC3C,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,mBAAmB,GAGpB,MAAM,cAAc,CAAC;AAUtB,MAAM,mBAAmB,GAAG,6BAA6B,CAAC;AAC1D,MAAM,eAAe,GAAG,0BAA0B,CAAC;AAEnD,mFAAmF;AACnF,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,IAAI,KAAK,CAAC,wBAAwB,IAAI,0DAA0D,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,GAAW;IACxC,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,sCAAsC,GAAG,uCAAuC,CAAC,CAAC;IACpG,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,IAAI,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,GAAG,IAAI,MAAM,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,OAAO,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,IAAY;IACrC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,cAAc,CAAC,CAAC;IACzD,CAAC;IACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA2B,CAAC;IACzD,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,WAAW,IAAI,iBAAiB,CAAC,CAAC;IACpD,CAAC;IACD,MAAM,MAAM,GAAkB;QAC5B,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,IAAI;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;QACtC,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE;KACxE,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,MAAqB;IAC/C,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAChC,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3C,cAAc,CAAC,GAAG,CAAC,CAAC;IACtB,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC;QAC1B,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;QAChD,IAAI,EAAE,MAAM,CAAC,IAAI;KAClB,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,UAAU,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IACrC,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAC;IACrC,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3B,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAY;IACvC,kBAAkB,CAAC,IAAI,CAAC,CAAC;IACzB,MAAM,IAAI,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACvC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACpB,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,WAAW;IACzB,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,CAAC;IACnC,MAAM,OAAO,GAAG,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC;IAC7F,MAAM,OAAO,GAAoB,EAAE,CAAC;IACpC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;QACjC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;QACvE,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;AAC9D,CAAC;AASD,MAAM,UAAU,cAAc,CAAC,MAAqB;IAClD,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC,CAAC;QACjD,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACzE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,2EAA2E;AAC3E,gDAAgD;AAChD,MAAM,UAAU,gBAAgB,CAAC,MAAqB;IACpD,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,SAAS,IAAI,MAAM,EAAE,CAAC;YACxB,GAAG,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC;YAC1B,SAAS;QACX,CAAC;QACD,IAAI,CAAC;YACH,GAAG,CAAC,GAAG,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,GAAG,EAAE;gBAChC,SAAS,EAAE,MAAM,CAAC,UAAU;gBAC5B,eAAe,EAAE,CAAC,OAAe,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC;aAChF,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,GAAG,GAAI,GAAa,CAAC,OAAO,CAAC;YACnC,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU,IAAI,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;gBAChE,MAAM,IAAI,KAAK,CACb,GAAG,GAAG,4BAA4B,MAAM,CAAC,IAAI,IAAI,GAAG,EAAE,CACvD,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,KAAK,CAAC,WAAW,MAAM,CAAC,IAAI,UAAU,GAAG,MAAM,GAAG,EAAE,CAAC,CAAC;QAClE,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,OAAO,YAAY,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,MAAqB;IAC1D,MAAM,KAAK,GAAyC,EAAE,CAAC;IACvD,KAAK,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,KAAK,IAAI,MAAM,IAAI,MAAM,CAAC,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,CAAC;YAC1D,KAAK,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,WAAW,CAAC,OAAe;IACzC,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,GAAG,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAClF,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,EAAE,IAAI,CAAC;YAAE,SAAS;QACtB,MAAM,GAAG,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QACzC,IAAI,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC1C,IACE,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;YAC9C,CAAC,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,EAC9C,CAAC;YACD,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC7B,CAAC;QACD,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAC9B,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QACnB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/lib/secrets.d.ts

@@ -0,0 +1,53 @@
+/**
+ * macOS Keychain integration for secure credential storage.
+ *
+ * Wraps the `security` command to store and retrieve API keys and tokens
+ * in the system keychain rather than environment variables or plaintext files.
+ */
+/** Supported secret resolution backends. */
+export type SecretProvider = 'keychain' | 'env' | 'file' | 'exec';
+/** A typed reference to a secret, consisting of a provider and a provider-specific value. */
+export interface SecretRef {
+    provider: SecretProvider;
+    value: string;
+}
+/**
+ * A bundle YAML value: either a string (literal or provider-prefixed ref) or
+ * an object `{value: string}` used to escape a literal that would otherwise
+ * be parsed as a ref (e.g. a URL that happens to start with 'env:').
+ */
+export type BundleValue = string | {
+    value: string;
+};
+/** Parse a bundle YAML value into either a literal string or a typed secret ref. */
+export declare function parseBundleValue(raw: BundleValue): {
+    literal: string;
+} | {
+    ref: SecretRef;
+};
+/** Serialize a secret ref back to its `provider:value` string form. */
+export declare function serializeRef(ref: SecretRef): string;
+/** Build the keychain item name for a profile provider token. */
+export declare function profileKeychainItem(provider: string): string;
+/** Build the keychain item name for a secrets-bundle key. */
+export declare function secretsKeychainItem(bundle: string, key: string): string;
+/** Check if a keychain item exists (macOS only). */
+export declare function hasKeychainToken(item: string): boolean;
+/** Retrieve a secret value from the macOS Keychain. Throws if not found. */
+export declare function getKeychainToken(item: string): string;
+/** Store or update a secret value in the macOS Keychain. */
+export declare function setKeychainToken(item: string, value: string): void;
+/** Delete a keychain item. Returns true if it existed. */
+export declare function deleteKeychainToken(item: string): boolean;
+/** Options controlling how secret refs are resolved. */
+export interface ResolveOptions {
+    /** Translate a short keychain ID to a fully namespaced item name. */
+    keychainItemFor?: (shortId: string) => string;
+    /** Allow exec: refs. When false (default), exec refs throw. */
+    allowExec?: boolean;
+    /** Restrict env: refs to this allowlist. When undefined, any env var may be read. */
+    envAllowlist?: string[];
+}
+/** Resolve a secret ref to its plaintext value using the appropriate provider. */
+export declare function resolveRef(ref: SecretRef, opts?: ResolveOptions): string;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/lib/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AASH,4CAA4C;AAC5C,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,KAAK,GAAG,MAAM,GAAG,MAAM,CAAC;AAElE,6FAA6F;AAC7F,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,cAAc,CAAC;IACzB,KAAK,EAAE,MAAM,CAAC;CACf;AAID;;;;GAIG;AACH,MAAM,MAAM,WAAW,GAAG,MAAM,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD,oFAAoF;AACpF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG;IAAE,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,GAAG,EAAE,SAAS,CAAA;CAAE,CAU3F;AAED,uEAAuE;AACvE,wBAAgB,YAAY,CAAC,GAAG,EAAE,SAAS,GAAG,MAAM,CAEnD;AAQD,iEAAiE;AACjE,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,CAE5D;AAED,6DAA6D;AAC7D,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAEvE;AAED,oDAAoD;AACpD,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAMtD;AAED,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAiBrD;AAED,4DAA4D;AAC5D,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAclE;AAED,0DAA0D;AAC1D,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAQzD;AAED,wDAAwD;AACxD,MAAM,WAAW,cAAc;IAC7B,qEAAqE;IACrE,eAAe,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC;IAC9C,+DAA+D;IAC/D,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,qFAAqF;IACrF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;CACzB;AASD,kFAAkF;AAClF,wBAAgB,UAAU,CAAC,GAAG,EAAE,SAAS,EAAE,IAAI,GAAE,cAAmB,GAAG,MAAM,CA4C5E"}

package/dist/lib/secrets.js

@@ -0,0 +1,140 @@
+/**
+ * macOS Keychain integration for secure credential storage.
+ *
+ * Wraps the `security` command to store and retrieve API keys and tokens
+ * in the system keychain rather than environment variables or plaintext files.
+ */
+import { execFileSync, spawnSync } from 'child_process';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+const SERVICE_PREFIX = 'agents-cli';
+const REF_PATTERN = /^(keychain|env|file|exec):(.+)$/s;
+/** Parse a bundle YAML value into either a literal string or a typed secret ref. */
+export function parseBundleValue(raw) {
+    if (typeof raw === 'object' && raw !== null && typeof raw.value === 'string') {
+        return { literal: raw.value };
+    }
+    if (typeof raw !== 'string') {
+        throw new Error(`Invalid bundle value (expected string or {value: string}): ${JSON.stringify(raw)}`);
+    }
+    const match = REF_PATTERN.exec(raw);
+    if (!match)
+        return { literal: raw };
+    return { ref: { provider: match[1], value: match[2] } };
+}
+/** Serialize a secret ref back to its `provider:value` string form. */
+export function serializeRef(ref) {
+    return `${ref.provider}:${ref.value}`;
+}
+function assertMacOS() {
+    if (process.platform !== 'darwin') {
+        throw new Error('Keychain auth is macOS-only for now. Linux/Windows support is planned.');
+    }
+}
+/** Build the keychain item name for a profile provider token. */
+export function profileKeychainItem(provider) {
+    return `${SERVICE_PREFIX}.${provider}.token`;
+}
+/** Build the keychain item name for a secrets-bundle key. */
+export function secretsKeychainItem(bundle, key) {
+    return `${SERVICE_PREFIX}.secrets.${bundle}.${key}`;
+}
+/** Check if a keychain item exists (macOS only). */
+export function hasKeychainToken(item) {
+    assertMacOS();
+    const result = spawnSync('security', ['find-generic-password', '-a', os.userInfo().username, '-s', item, '-w'], {
+        stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    return result.status === 0;
+}
+/** Retrieve a secret value from the macOS Keychain. Throws if not found. */
+export function getKeychainToken(item) {
+    assertMacOS();
+    try {
+        const token = execFileSync('security', ['find-generic-password', '-a', os.userInfo().username, '-s', item, '-w'], {
+            encoding: 'utf-8',
+            stdio: ['ignore', 'pipe', 'pipe'],
+        }).trim();
+        if (!token) {
+            throw new Error(`Keychain item '${item}' exists but is empty.`);
+        }
+        return token;
+    }
+    catch (err) {
+        if (err.status === 44 || /could not be found/i.test(err.stderr?.toString() || '')) {
+            throw new Error(`Keychain item '${item}' not found.`);
+        }
+        throw new Error(`Failed to read keychain item '${item}': ${err.message}`);
+    }
+}
+/** Store or update a secret value in the macOS Keychain. */
+export function setKeychainToken(item, value) {
+    assertMacOS();
+    if (!value || !value.trim()) {
+        throw new Error('Secret value is empty.');
+    }
+    const user = os.userInfo().username;
+    const result = spawnSync('security', ['add-generic-password', '-a', user, '-s', item, '-w', value, '-U'], { stdio: ['ignore', 'pipe', 'pipe'] });
+    if (result.status !== 0) {
+        throw new Error(`Failed to write keychain item '${item}': ${result.stderr.toString()}`);
+    }
+}
+/** Delete a keychain item. Returns true if it existed. */
+export function deleteKeychainToken(item) {
+    assertMacOS();
+    const result = spawnSync('security', ['delete-generic-password', '-a', os.userInfo().username, '-s', item], { stdio: ['ignore', 'pipe', 'pipe'] });
+    return result.status === 0;
+}
+function expandHome(p) {
+    if (p.startsWith('~/') || p === '~') {
+        return path.join(os.homedir(), p.slice(1));
+    }
+    return p;
+}
+/** Resolve a secret ref to its plaintext value using the appropriate provider. */
+export function resolveRef(ref, opts = {}) {
+    switch (ref.provider) {
+        case 'keychain': {
+            const item = opts.keychainItemFor ? opts.keychainItemFor(ref.value) : ref.value;
+            return getKeychainToken(item);
+        }
+        case 'env': {
+            const name = ref.value;
+            if (opts.envAllowlist && !opts.envAllowlist.includes(name)) {
+                throw new Error(`env: ref '${name}' not in allowlist.`);
+            }
+            const val = process.env[name];
+            if (val === undefined) {
+                throw new Error(`env: ref '${name}' not set in parent environment.`);
+            }
+            return val;
+        }
+        case 'file': {
+            const target = expandHome(ref.value);
+            if (!fs.existsSync(target)) {
+                throw new Error(`file: ref '${ref.value}' does not exist.`);
+            }
+            return fs.readFileSync(target, 'utf-8').trim();
+        }
+        case 'exec': {
+            if (!opts.allowExec) {
+                throw new Error(`exec: ref '${ref.value}' blocked. Set 'allow_exec: true' in the bundle to enable.`);
+            }
+            // shell: false — the bundle author controls the command; no injection
+            // from secret identifiers. Parse a simple space-separated command.
+            const parts = ref.value.match(/(?:[^\s"]+|"[^"]*")+/g)?.map((p) => p.replace(/^"|"$/g, '')) || [];
+            if (parts.length === 0) {
+                throw new Error(`exec: ref '${ref.value}' is empty.`);
+            }
+            const [cmd, ...args] = parts;
+            try {
+                return execFileSync(cmd, args, { encoding: 'utf-8', stdio: ['ignore', 'pipe', 'pipe'] }).trim();
+            }
+            catch (err) {
+                throw new Error(`exec: ref '${ref.value}' failed: ${err.message}`);
+            }
+        }
+    }
+}
+//# sourceMappingURL=secrets.js.map

package/dist/lib/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../../src/lib/secrets.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACxD,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAE7B,MAAM,cAAc,GAAG,YAAY,CAAC;AAWpC,MAAM,WAAW,GAAG,kCAAkC,CAAC;AASvD,oFAAoF;AACpF,MAAM,UAAU,gBAAgB,CAAC,GAAgB;IAC/C,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAQ,GAAW,CAAC,KAAK,KAAK,QAAQ,EAAE,CAAC;QACtF,OAAO,EAAE,OAAO,EAAG,GAAyB,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,8DAA8D,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvG,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IACpC,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAmB,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,YAAY,CAAC,GAAc;IACzC,OAAO,GAAG,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;AACxC,CAAC;AAED,SAAS,WAAW;IAClB,IAAI,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAClC,MAAM,IAAI,KAAK,CAAC,wEAAwE,CAAC,CAAC;IAC5F,CAAC;AACH,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,mBAAmB,CAAC,QAAgB;IAClD,OAAO,GAAG,cAAc,IAAI,QAAQ,QAAQ,CAAC;AAC/C,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,mBAAmB,CAAC,MAAc,EAAE,GAAW;IAC7D,OAAO,GAAG,cAAc,YAAY,MAAM,IAAI,GAAG,EAAE,CAAC;AACtD,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,WAAW,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;QAC9G,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;KAClC,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,gBAAgB,CAAC,IAAY;IAC3C,WAAW,EAAE,CAAC;IACd,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,YAAY,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE;YAChH,QAAQ,EAAE,OAAO;YACjB,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;SAClC,CAAC,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,wBAAwB,CAAC,CAAC;QAClE,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,IAAI,GAAG,CAAC,MAAM,KAAK,EAAE,IAAI,qBAAqB,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YAClF,MAAM,IAAI,KAAK,CAAC,kBAAkB,IAAI,cAAc,CAAC,CAAC;QACxD,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,iCAAiC,IAAI,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,WAAW,EAAE,CAAC;IACd,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,EACnE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAC1F,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,mBAAmB,CAAC,IAAY;IAC9C,WAAW,EAAE,CAAC;IACd,MAAM,MAAM,GAAG,SAAS,CACtB,UAAU,EACV,CAAC,yBAAyB,EAAE,IAAI,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,IAAI,CAAC,EACrE,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACtC,CAAC;IACF,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC;AAC7B,CAAC;AAYD,SAAS,UAAU,CAAC,CAAS;IAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;QACpC,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,kFAAkF;AAClF,MAAM,UAAU,UAAU,CAAC,GAAc,EAAE,OAAuB,EAAE;IAClE,QAAQ,GAAG,CAAC,QAAQ,EAAE,CAAC;QACrB,KAAK,UAAU,CAAC,CAAC,CAAC;YAChB,MAAM,IAAI,GAAG,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;YAChF,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;QAChC,CAAC;QACD,KAAK,KAAK,CAAC,CAAC,CAAC;YACX,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC;YACvB,IAAI,IAAI,CAAC,YAAY,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC3D,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,qBAAqB,CAAC,CAAC;YAC1D,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YAC9B,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;gBACtB,MAAM,IAAI,KAAK,CAAC,aAAa,IAAI,kCAAkC,CAAC,CAAC;YACvE,CAAC;YACD,OAAO,GAAG,CAAC;QACb,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;YACrC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;gBAC3B,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,KAAK,mBAAmB,CAAC,CAAC;YAC9D,CAAC;YACD,OAAO,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;QACjD,CAAC;QACD,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;gBACpB,MAAM,IAAI,KAAK,CACb,cAAc,GAAG,CAAC,KAAK,4DAA4D,CACpF,CAAC;YACJ,CAAC;YACD,sEAAsE;YACtE,mEAAmE;YACnE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,uBAAuB,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClG,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,KAAK,aAAa,CAAC,CAAC;YACxD,CAAC;YACD,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,KAAK,CAAC;YAC7B,IAAI,CAAC;gBACH,OAAO,YAAY,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAClG,CAAC;YAAC,OAAO,GAAQ,EAAE,CAAC;gBAClB,MAAM,IAAI,KAAK,CAAC,cAAc,GAAG,CAAC,KAAK,aAAa,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACrE,CAAC;QACH,CAAC;IACH,CAAC;AACH,CAAC"}

package/dist/lib/session/__tests__/db.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=db.test.d.ts.map

package/dist/lib/session/__tests__/db.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.test.d.ts","sourceRoot":"","sources":["../../../../src/lib/session/__tests__/db.test.ts"],"names":[],"mappings":""}

package/dist/lib/session/__tests__/db.test.js

@@ -0,0 +1,54 @@
+import { afterAll, beforeAll, describe, expect, it, vi } from 'vitest';
+import * as fs from 'fs';
+const { TEST_HOME } = vi.hoisted(() => {
+    const nodeOs = require('os');
+    const nodeFs = require('fs');
+    const nodePath = require('path');
+    return {
+        TEST_HOME: nodeFs.mkdtempSync(nodePath.join(nodeOs.tmpdir(), 'agents-cli-db-test-')),
+    };
+});
+vi.mock('os', async () => {
+    const actual = await vi.importActual('os');
+    return { ...actual, homedir: () => TEST_HOME };
+});
+// Import AFTER the mock so db.ts captures TEST_HOME as its base dir.
+const { getDB, querySessions, closeDB } = await import('../db.js');
+function seed(id, version, timestamp) {
+    const db = getDB();
+    db.prepare(`
+    INSERT INTO sessions (
+      id, short_id, agent, version, timestamp, project, cwd,
+      file_path, file_mtime_ms, file_size, scanned_at, is_team_origin
+    ) VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, 0)
+  `).run(id, id.slice(0, 8), 'claude', version, timestamp, 'agents-cli', '/tmp/test', `/tmp/test/${id}.jsonl`, 0, 0, 0);
+}
+describe('querySessions version filter', () => {
+    beforeAll(() => {
+        seed('s1-older', '2.1.111', '2026-04-19T10:00:00.000Z');
+        seed('s2-newer', '2.1.112', '2026-04-19T11:00:00.000Z');
+        seed('s3-same', '2.1.112', '2026-04-19T12:00:00.000Z');
+        seed('s4-null', null, '2026-04-19T13:00:00.000Z');
+    });
+    afterAll(() => {
+        closeDB();
+        fs.rmSync(TEST_HOME, { recursive: true, force: true });
+    });
+    it('returns only sessions matching the requested version', () => {
+        const rows = querySessions({ version: '2.1.112' });
+        expect(rows.map(r => r.id).sort()).toEqual(['s2-newer', 's3-same']);
+    });
+    it('returns no sessions for an unknown version', () => {
+        const rows = querySessions({ version: '99.99.99' });
+        expect(rows).toEqual([]);
+    });
+    it('returns all sessions when version is omitted', () => {
+        const rows = querySessions({});
+        expect(rows.map(r => r.id).sort()).toEqual(['s1-older', 's2-newer', 's3-same', 's4-null']);
+    });
+    it('filters by version even when agent is also set', () => {
+        const rows = querySessions({ agent: 'claude', version: '2.1.111' });
+        expect(rows.map(r => r.id)).toEqual(['s1-older']);
+    });
+});
+//# sourceMappingURL=db.test.js.map

package/dist/lib/session/__tests__/db.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"db.test.js","sourceRoot":"","sources":["../../../../src/lib/session/__tests__/db.test.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACvE,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AAIzB,MAAM,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE;IACpC,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACjC,OAAO;QACL,SAAS,EAAE,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,qBAAqB,CAAC,CAAC;KACrF,CAAC;AACJ,CAAC,CAAC,CAAC;AAEH,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,IAAI,EAAE;IACvB,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,YAAY,CAAY,IAAI,CAAC,CAAC;IACtD,OAAO,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AACjD,CAAC,CAAC,CAAC;AAEH,qEAAqE;AACrE,MAAM,EAAE,KAAK,EAAE,aAAa,EAAE,OAAO,EAAE,GAAG,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC;AAEnE,SAAS,IAAI,CAAC,EAAU,EAAE,OAAsB,EAAE,SAAiB;IACjE,MAAM,EAAE,GAAG,KAAK,EAAE,CAAC;IACnB,EAAE,CAAC,OAAO,CAAC;;;;;GAKV,CAAC,CAAC,GAAG,CACJ,EAAE,EACF,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,EACd,QAAQ,EACR,OAAO,EACP,SAAS,EACT,YAAY,EACZ,WAAW,EACX,aAAa,EAAE,QAAQ,EACvB,CAAC,EACD,CAAC,EACD,CAAC,CACF,CAAC;AACJ,CAAC;AAED,QAAQ,CAAC,8BAA8B,EAAE,GAAG,EAAE;IAC5C,SAAS,CAAC,GAAG,EAAE;QACb,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACxD,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAG,SAAS,EAAE,0BAA0B,CAAC,CAAC;QACxD,IAAI,CAAC,SAAS,EAAG,IAAI,EAAO,0BAA0B,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;IAEH,QAAQ,CAAC,GAAG,EAAE;QACZ,OAAO,EAAE,CAAC;QACV,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACzD,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAC9D,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACnD,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,4CAA4C,EAAE,GAAG,EAAE;QACpD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,OAAO,EAAE,UAAU,EAAE,CAAC,CAAC;QACpD,MAAM,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,8CAA8C,EAAE,GAAG,EAAE;QACtD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;QAC/B,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC;IAC7F,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,gDAAgD,EAAE,GAAG,EAAE;QACxD,MAAM,IAAI,GAAG,aAAa,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAC;QACpE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}