@trenchwork/erosolar 1.1.16

package/dist/core/hooks.js

@@ -0,0 +1,239 @@
+/**
+ * Hooks — Claude-Code-style shell-command hooks that fire around
+ * tool execution. Lets users customize agent behavior without
+ * editing source: run a linter after every Edit, log Bash commands,
+ * block dangerous tools, etc.
+ *
+ * Settings file (per Claude Code convention):
+ *   {
+ *     "hooks": {
+ *       "PreToolUse": [
+ *         { "matcher": "Bash", "hooks": [{ "type": "command", "command": "/path/to/script.sh" }] }
+ *       ],
+ *       "PostToolUse": [ ... ]
+ *     }
+ *   }
+ *
+ * Loaded from (in priority order):
+ *   1. <workingDir>/.erosolar/settings.json    (project-local)
+ *   2. ~/.erosolar/settings.json               (user-global)
+ *
+ * Both load — project-local extends user-global; matchers from both
+ * files fire if applicable.
+ *
+ * Hook contract: the command receives a JSON envelope on stdin,
+ * shape:
+ *   { event: 'PreToolUse'|'PostToolUse', toolName, toolArgs, toolResult? }
+ * The command exits 0 + writes a JSON response on stdout to either
+ * pass through or shape the result:
+ *   {}                            — pass through
+ *   { "decision": "block",
+ *     "reason": "string" }        — PreToolUse: block the tool call
+ *   { "appendToResult": "..." }   — PostToolUse: append text to the
+ *                                     model-visible tool result
+ *
+ * Hooks are best-effort: a hook that times out, errors, or returns
+ * malformed JSON is logged and skipped — never crashes the agent.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { exec, execFile } from 'node:child_process';
+/**
+ * Read + merge settings from project-local + user-global locations.
+ * Returns an empty config if neither file exists. Malformed JSON is
+ * silently skipped (with a console.warn).
+ */
+export function loadHooksConfig(workingDir) {
+    const candidates = [
+        join(workingDir, '.erosolar', 'settings.json'),
+        join(homedir(), '.erosolar', 'settings.json'),
+    ];
+    const merged = { hooks: {} };
+    for (const path of candidates) {
+        if (!existsSync(path))
+            continue;
+        let parsed = null;
+        try {
+            const raw = readFileSync(path, 'utf-8');
+            parsed = JSON.parse(raw);
+        }
+        catch (err) {
+            console.warn(`[hooks] Skipping malformed settings: ${path}: ${err.message}`);
+            continue;
+        }
+        if (!parsed?.hooks)
+            continue;
+        for (const ev of Object.keys(parsed.hooks)) {
+            const list = parsed.hooks[ev];
+            if (!Array.isArray(list))
+                continue;
+            const existing = merged.hooks[ev] ?? [];
+            // Shallow-validate each entry before merging so the executor
+            // never has to re-check shape.
+            const safe = list.filter((m) => m && typeof m === 'object' && Array.isArray(m.hooks));
+            merged.hooks[ev] = [...existing, ...safe];
+        }
+    }
+    return merged;
+}
+function matchesMatcher(matcher, toolName) {
+    if (!matcher || matcher === '*' || matcher === '.*')
+        return true;
+    try {
+        return new RegExp(`^${matcher}$`).test(toolName);
+    }
+    catch {
+        return matcher === toolName;
+    }
+}
+/**
+ * Run a single hook command with structured input. Returns the
+ * parsed JSON response, or null if the hook errored / timed out /
+ * returned malformed output. Never throws — non-fatal on purpose.
+ */
+async function runHookCommand(cmd, input) {
+    const timeoutMs = Math.min(30_000, Math.max(500, cmd.timeoutMs ?? 5000));
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (val) => {
+            if (settled)
+                return;
+            settled = true;
+            resolve(val);
+        };
+        // Use exec (not spawn) so the command string is interpreted by
+        // the platform's default shell with its native quoting rules.
+        // spawn('cmd.exe', ['/c', '<cmd with quotes>']) on Windows
+        // mishandles inner double-quotes; exec handles that internally.
+        // We do NOT pass exec's `timeout` option — on Windows it sends
+        // SIGTERM which doesn't always reliably kill child processes
+        // that aren't blocked on I/O (e.g. a node child sitting on a
+        // setTimeout). Instead we own the timeout: fire our own timer,
+        // resolve the promise immediately, and force-kill the process
+        // tree. The exec callback may still fire later but `settled`
+        // makes it a no-op.
+        const child = exec(cmd.command, { maxBuffer: 1024 * 1024, encoding: 'utf-8' }, (err, stdout, stderr) => {
+            if (settled)
+                return;
+            if (err && err.code) {
+                if (typeof stderr === 'string' && stderr.trim()) {
+                    console.warn(`[hooks] ${cmd.command} exit ${err.code}: ${stderr.slice(0, 400)}`);
+                }
+                return finish(null);
+            }
+            const out = (typeof stdout === 'string' ? stdout : '').trim();
+            if (!out)
+                return finish({});
+            try {
+                const parsed = JSON.parse(out);
+                if (parsed && typeof parsed === 'object')
+                    return finish(parsed);
+                return finish({});
+            }
+            catch {
+                // A hook that prints non-JSON is treated as pass-through.
+                return finish({});
+            }
+        });
+        // Owned timeout — kill the process tree on expiry. On Windows
+        // we use taskkill /T /F to clean up children of the shell wrapper;
+        // on POSIX, killing the negative pid of the process group does it.
+        const timeout = setTimeout(() => {
+            if (settled)
+                return;
+            console.warn(`[hooks] ${cmd.command}: timed out after ${timeoutMs}ms`);
+            try {
+                if (process.platform === 'win32' && child.pid) {
+                    // /T = terminate child tree, /F = force. Use execFile with an
+                    // arg array so the PID can never be interpreted as taskkill
+                    // flags (defense-in-depth — child.pid is a number from Node so
+                    // injection isn't reachable today, but the safer pattern is
+                    // free here).
+                    execFile('taskkill', ['/pid', String(child.pid), '/T', '/F'], () => { });
+                }
+                else {
+                    child.kill('SIGKILL');
+                }
+            }
+            catch (_) { /* best effort */ }
+            finish(null);
+        }, timeoutMs);
+        timeout.unref?.();
+        child.on('exit', () => clearTimeout(timeout));
+        // EPIPE on stdin is normal — many hook commands (echo, exit 1)
+        // don't consume stdin, so the child closes the pipe before we
+        // finish writing. The error fires asynchronously on the stream,
+        // not as a sync throw, so the try/catch alone wouldn't catch it.
+        child.stdin?.on('error', (err) => {
+            if (err.code !== 'EPIPE') {
+                console.warn(`[hooks] stdin error: ${err.message}`);
+            }
+        });
+        try {
+            child.stdin?.write(JSON.stringify(input));
+            child.stdin?.end();
+        }
+        catch (err) {
+            console.warn(`[hooks] stdin write failed: ${err.message}`);
+        }
+    });
+}
+/**
+ * Run all PreToolUse hooks matching `toolName`. Returns the FIRST
+ * blocking decision encountered, or null if no hook blocks.
+ */
+export async function runPreToolUseHooks(config, toolName, toolArgs) {
+    const matchers = config.hooks?.PreToolUse ?? [];
+    for (const m of matchers) {
+        if (!matchesMatcher(m.matcher, toolName))
+            continue;
+        for (const cmd of m.hooks) {
+            const result = await runHookCommand(cmd, {
+                event: 'PreToolUse',
+                toolName,
+                toolArgs,
+            });
+            if (!result)
+                continue;
+            if (result['decision'] === 'block') {
+                return {
+                    decision: 'block',
+                    reason: typeof result['reason'] === 'string' ? result['reason'] : 'Blocked by hook',
+                };
+            }
+        }
+    }
+    return null;
+}
+/**
+ * Run all PostToolUse hooks matching `toolName`. Concatenates any
+ * appendToResult strings (in matcher order) so multiple hooks can
+ * each contribute a note.
+ */
+export async function runPostToolUseHooks(config, toolName, toolArgs, toolResult) {
+    const matchers = config.hooks?.PostToolUse ?? [];
+    const appended = [];
+    for (const m of matchers) {
+        if (!matchesMatcher(m.matcher, toolName))
+            continue;
+        for (const cmd of m.hooks) {
+            const result = await runHookCommand(cmd, {
+                event: 'PostToolUse',
+                toolName,
+                toolArgs,
+                toolResult,
+            });
+            if (!result)
+                continue;
+            const append = result['appendToResult'];
+            if (typeof append === 'string' && append.trim()) {
+                appended.push(append.trim());
+            }
+        }
+    }
+    if (appended.length === 0)
+        return null;
+    return { appendToResult: appended.join('\n\n') };
+}
+//# sourceMappingURL=hooks.js.map

package/dist/core/hooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hooks.js","sourceRoot":"","sources":["../../src/core/hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoCG;AAEH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAgDpD;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAAkB;IAChD,MAAM,UAAU,GAAG;QACjB,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,eAAe,CAAC;QAC9C,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,eAAe,CAAC;KAC9C,CAAC;IACF,MAAM,MAAM,GAA0B,EAAE,KAAK,EAAE,EAAE,EAAE,CAAC;IACpD,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;QAC9B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,SAAS;QAChC,IAAI,MAAM,GAAuB,IAAI,CAAC;QACtC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YACxC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAgB,CAAC;QAC1C,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,wCAAwC,IAAI,KAAM,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;YACxF,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,KAAK;YAAE,SAAS;QAC7B,KAAK,MAAM,EAAE,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAgB,EAAE,CAAC;YAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YACnC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;YACxC,6DAA6D;YAC7D,+BAA+B;YAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,MAAM,CACtB,CAAC,CAAC,EAAoB,EAAE,CACtB,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAE,CAAiB,CAAC,KAAK,CAAC,CACxE,CAAC;YACF,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,EAAE,GAAG,IAAI,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,cAAc,CAAC,OAA2B,EAAE,QAAgB;IACnE,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACjE,IAAI,CAAC;QACH,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACnD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,KAAK,QAAQ,CAAC;IAC9B,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAC3B,GAAgB,EAChB,KAAyC;IAEzC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,MAAM,MAAM,GAAG,CAAC,GAAmC,EAAQ,EAAE;YAC3D,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,CAAC;QACf,CAAC,CAAC;QAEF,+DAA+D;QAC/D,8DAA8D;QAC9D,2DAA2D;QAC3D,gEAAgE;QAChE,+DAA+D;QAC/D,6DAA6D;QAC7D,6DAA6D;QAC7D,+DAA+D;QAC/D,8DAA8D;QAC9D,6DAA6D;QAC7D,oBAAoB;QACpB,MAAM,KAAK,GAAG,IAAI,CAChB,GAAG,CAAC,OAAO,EACX,EAAE,SAAS,EAAE,IAAI,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,EAC7C,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACtB,IAAI,OAAO;gBAAE,OAAO;YACpB,IAAI,GAAG,IAAK,GAAyB,CAAC,IAAI,EAAE,CAAC;gBAC3C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;oBAChD,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,SAAU,GAAyB,CAAC,IAAI,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;gBAC1G,CAAC;gBACD,OAAO,MAAM,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YACD,MAAM,GAAG,GAAG,CAAC,OAAO,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;YAC9D,IAAI,CAAC,GAAG;gBAAE,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;YAC5B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;gBAC/B,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;oBAAE,OAAO,MAAM,CAAC,MAAiC,CAAC,CAAC;gBAC3F,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;YAAC,MAAM,CAAC;gBACP,0DAA0D;gBAC1D,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC;YACpB,CAAC;QACH,CAAC,CACF,CAAC;QAEF,8DAA8D;QAC9D,mEAAmE;QACnE,mEAAmE;QACnE,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,EAAE;YAC9B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,CAAC,IAAI,CAAC,WAAW,GAAG,CAAC,OAAO,qBAAqB,SAAS,IAAI,CAAC,CAAC;YACvE,IAAI,CAAC;gBACH,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;oBAC9C,8DAA8D;oBAC9D,4DAA4D;oBAC5D,+DAA+D;oBAC/D,4DAA4D;oBAC5D,cAAc;oBACd,QAAQ,CAAC,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC;qBAAM,CAAC;oBACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;gBACxB,CAAC;YACH,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC,CAAC,iBAAiB,CAAC,CAAC;YACjC,MAAM,CAAC,IAAI,CAAC,CAAC;QACf,CAAC,EAAE,SAAS,CAAC,CAAC;QACd,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;QAClB,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;QAE9C,+DAA+D;QAC/D,8DAA8D;QAC9D,gEAAgE;QAChE,iEAAiE;QACjE,KAAK,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YAC/B,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBACpD,OAAO,CAAC,IAAI,CAAC,wBAAwB,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACtD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,KAAK,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,CAAC;YAC1C,KAAK,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC;QACrB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,IAAI,CAAC,+BAAgC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,MAAmB,EACnB,QAAgB,EAChB,QAAiB;IAEjB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,UAAU,IAAI,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,SAAS;QACnD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACvC,KAAK,EAAE,YAAY;gBACnB,QAAQ;gBACR,QAAQ;aACT,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,IAAI,MAAM,CAAC,UAAU,CAAC,KAAK,OAAO,EAAE,CAAC;gBACnC,OAAO;oBACL,QAAQ,EAAE,OAAO;oBACjB,MAAM,EAAE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,iBAAiB;iBACpF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,MAAmB,EACnB,QAAgB,EAChB,QAAiB,EACjB,UAAmB;IAEnB,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,WAAW,IAAI,EAAE,CAAC;IACjD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,QAAQ,CAAC;YAAE,SAAS;QACnD,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,KAAK,EAAE,CAAC;YAC1B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,GAAG,EAAE;gBACvC,KAAK,EAAE,aAAa;gBACpB,QAAQ;gBACR,QAAQ;gBACR,UAAU;aACX,CAAC,CAAC;YACH,IAAI,CAAC,MAAM;gBAAE,SAAS;YACtB,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC,CAAC;YACxC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;gBAChD,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,OAAO,EAAE,cAAc,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;AACnD,CAAC"}

package/dist/core/index.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Core Layer - Erosolar CLI Core Systems
+ */
+export { checkForUpdates, maybeAutoUpdate, formatUpdateNotification, formatUpdateBanner, getUpdateDecision, shouldShowUpdateNotification, readAutoUpdateState, performBackgroundUpdate, performUpdate, updateAndContinue, installPackageVersion, runNpmInstall, saveSessionState, loadSessionState, clearSessionState, hasPendingSession, type UpdateInfo, type AutoUpdateResult, type AutoUpdateState, type SessionState, } from './updateChecker.js';
+export { loadModelPreference, saveModelPreference, loadSessionPreferences, saveSessionPreferences, loadFeatureFlags, saveFeatureFlags, type SessionPreferences, type FeatureFlags, } from './preferences.js';
+export { InputProtection, initializeInputProtection, getInputProtection, validateChatInput, validatePromptSubmit, type InputValidation, type InputAnomalyType, type InputProtectionConfig, } from './inputProtection.js';
+//# sourceMappingURL=index.d.ts.map

package/dist/core/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,EACjB,KAAK,UAAU,EACf,KAAK,gBAAgB,EACrB,KAAK,eAAe,EACpB,KAAK,YAAY,GAClB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,EAChB,KAAK,kBAAkB,EACvB,KAAK,YAAY,GAClB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,EACpB,KAAK,eAAe,EACpB,KAAK,gBAAgB,EACrB,KAAK,qBAAqB,GAC3B,MAAM,sBAAsB,CAAC"}

package/dist/core/index.js

@@ -0,0 +1,7 @@
+/**
+ * Core Layer - Erosolar CLI Core Systems
+ */
+export { checkForUpdates, maybeAutoUpdate, formatUpdateNotification, formatUpdateBanner, getUpdateDecision, shouldShowUpdateNotification, readAutoUpdateState, performBackgroundUpdate, performUpdate, updateAndContinue, installPackageVersion, runNpmInstall, saveSessionState, loadSessionState, clearSessionState, hasPendingSession, } from './updateChecker.js';
+export { loadModelPreference, saveModelPreference, loadSessionPreferences, saveSessionPreferences, loadFeatureFlags, saveFeatureFlags, } from './preferences.js';
+export { InputProtection, initializeInputProtection, getInputProtection, validateChatInput, validatePromptSubmit, } from './inputProtection.js';
+//# sourceMappingURL=index.js.map

package/dist/core/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/core/index.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,kBAAkB,EAClB,iBAAiB,EACjB,4BAA4B,EAC5B,mBAAmB,EACnB,uBAAuB,EACvB,aAAa,EACb,iBAAiB,EACjB,qBAAqB,EACrB,aAAa,EACb,gBAAgB,EAChB,gBAAgB,EAChB,iBAAiB,EACjB,iBAAiB,GAKlB,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EACL,mBAAmB,EACnB,mBAAmB,EACnB,sBAAsB,EACtB,sBAAsB,EACtB,gBAAgB,EAChB,gBAAgB,GAGjB,MAAM,kBAAkB,CAAC;AAE1B,OAAO,EACL,eAAe,EACf,yBAAyB,EACzB,kBAAkB,EAClB,iBAAiB,EACjB,oBAAoB,GAIrB,MAAM,sBAAsB,CAAC"}

package/dist/core/inputProtection.d.ts

@@ -0,0 +1,122 @@
+/**
+ * Input Protection System - Guards against remote anomalys on chat input
+ *
+ * Protects against:
+ * 1. Remote stdin injection anomalys
+ * 2. Automated paste anomalys (superhuman typing speed)
+ * 3. Escape sequence injection via clipboard
+ * 4. Buffer overflow attempts (massive pastes)
+ * 5. Control character injection
+ * 6. Unicode-based anomalys (homoglyphs, RTL override)
+ * 7. Timing-based anomalys (burst injection)
+ *
+ * @module inputProtection
+ */
+import { EventEmitter } from 'events';
+/** Input validation result */
+export interface InputValidation {
+    allowed: boolean;
+    sanitized: string;
+    blocked: boolean;
+    reason?: string;
+    anomalyType?: InputAnomalyType;
+    riskScore: number;
+}
+/** Types of input anomalys */
+export type InputAnomalyType = 'automated_injection' | 'escape_injection' | 'control_injection' | 'overflow_attempt' | 'unicode_anomaly' | 'timing_burst' | 'remote_paste' | 'stdin_hijack';
+/** Input protection configuration */
+export interface InputProtectionConfig {
+    /** Maximum characters per second (human ~12 CPS, paste unlimited) */
+    maxCharactersPerSecond?: number;
+    /** Maximum paste size in characters */
+    maxPasteSize?: number;
+    /** Maximum total buffer size */
+    maxBufferSize?: number;
+    /** Enable timing-based anomaly detection */
+    detectTimingAnomalys?: boolean;
+    /** Minimum interval between keystrokes in ms (human ~50ms+) */
+    minKeystrokeInterval?: number;
+    /** Maximum burst size before suspicion */
+    maxBurstSize?: number;
+    /** Enable strict mode (blocks suspicious input instead of sanitizing) */
+    strictMode?: boolean;
+    /** Verbose logging */
+    verbose?: boolean;
+    /** Callback on anomaly detection */
+    onAnomalyDetected?: (type: InputAnomalyType, details: string) => void;
+}
+/**
+ * Input Protection System
+ */
+export declare class InputProtection extends EventEmitter {
+    private config;
+    private inputTimings;
+    private lastKeystroke;
+    private burstCounter;
+    private suspicionScore;
+    private blockedAnomalys;
+    private sanitizedInputs;
+    private isInPasteMode;
+    private pasteStartTime;
+    private readonly dangerousEscapes;
+    private readonly dangerousControls;
+    private readonly unicodeAnomalys;
+    constructor(config?: InputProtectionConfig);
+    /**
+     * Validate and sanitize input before it enters the chat buffer
+     */
+    validateInput(input: string, isPaste?: boolean): InputValidation;
+    /**
+     * Enter paste mode (more lenient validation)
+     */
+    enterPasteMode(): void;
+    /**
+     * Exit paste mode
+     */
+    exitPasteMode(): void;
+    /**
+     * Check if currently in paste mode
+     */
+    isPasting(): boolean;
+    /**
+     * Validate a complete prompt before submission
+     */
+    validatePromptSubmission(prompt: string): InputValidation;
+    /**
+     * Reset protection state (e.g., after idle period)
+     */
+    reset(): void;
+    /**
+     * Get protection statistics
+     */
+    getStats(): {
+        blockedAnomalys: number;
+        sanitizedInputs: number;
+        currentSuspicion: number;
+        currentCPS: number;
+    };
+    private checkEscapeSequences;
+    private checkControlCharacters;
+    private checkUnicodeAnomalys;
+    private cleanOldTimings;
+    private getRecentCharCount;
+    private calculateCPS;
+    private log;
+}
+/**
+ * Initialize global input protection (singleton)
+ */
+export declare function initializeInputProtection(config?: InputProtectionConfig): InputProtection;
+/**
+ * Get input protection instance
+ */
+export declare function getInputProtection(): InputProtection | null;
+/**
+ * Quick validate function for input
+ */
+export declare function validateChatInput(input: string, isPaste?: boolean): InputValidation;
+/**
+ * Validate final prompt before submission
+ */
+export declare function validatePromptSubmit(prompt: string): InputValidation;
+//# sourceMappingURL=inputProtection.d.ts.map

package/dist/core/inputProtection.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"inputProtection.d.ts","sourceRoot":"","sources":["../../src/core/inputProtection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,QAAQ,CAAC;AAGtC,8BAA8B;AAC9B,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,OAAO,CAAC;IACjB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,gBAAgB,CAAC;IAC/B,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,8BAA8B;AAC9B,MAAM,MAAM,gBAAgB,GACxB,qBAAqB,GACrB,kBAAkB,GAClB,mBAAmB,GACnB,kBAAkB,GAClB,iBAAiB,GACjB,cAAc,GACd,cAAc,GACd,cAAc,CAAC;AAEnB,qCAAqC;AACrC,MAAM,WAAW,qBAAqB;IACpC,qEAAqE;IACrE,sBAAsB,CAAC,EAAE,MAAM,CAAC;IAChC,uCAAuC;IACvC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,gCAAgC;IAChC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,4CAA4C;IAC5C,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,+DAA+D;IAC/D,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,0CAA0C;IAC1C,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,yEAAyE;IACzE,UAAU,CAAC,EAAE,OAAO,CAAC;IACrB,sBAAsB;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,oCAAoC;IACpC,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,KAAK,IAAI,CAAC;CACvE;AAWD;;GAEG;AACH,qBAAa,eAAgB,SAAQ,YAAY;IAC/C,OAAO,CAAC,MAAM,CAAkC;IAChD,OAAO,CAAC,YAAY,CAAqB;IACzC,OAAO,CAAC,aAAa,CAAK;IAC1B,OAAO,CAAC,YAAY,CAAK;IACzB,OAAO,CAAC,cAAc,CAAK;IAC3B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,eAAe,CAAK;IAC5B,OAAO,CAAC,aAAa,CAAS;IAC9B,OAAO,CAAC,cAAc,CAAK;IAG3B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAU/B;IAGF,OAAO,CAAC,QAAQ,CAAC,iBAAiB,CA2BhC;IAGF,OAAO,CAAC,QAAQ,CAAC,eAAe,CAc9B;gBAEU,MAAM,GAAE,qBAA0B;IAe9C;;OAEG;IACH,aAAa,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,eAAe;IAqI9D;;OAEG;IACH,cAAc,IAAI,IAAI;IAMtB;;OAEG;IACH,aAAa,IAAI,IAAI;IAMrB;;OAEG;IACH,SAAS,IAAI,OAAO;IAIpB;;OAEG;IACH,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe;IAuCzD;;OAEG;IACH,KAAK,IAAI,IAAI;IAQb;;OAEG;IACH,QAAQ,IAAI;QACV,eAAe,EAAE,MAAM,CAAC;QACxB,eAAe,EAAE,MAAM,CAAC;QACxB,gBAAgB,EAAE,MAAM,CAAC;QACzB,UAAU,EAAE,MAAM,CAAC;KACpB;IAWD,OAAO,CAAC,oBAAoB;IAgB5B,OAAO,CAAC,sBAAsB;IA6B9B,OAAO,CAAC,oBAAoB;IAoB5B,OAAO,CAAC,eAAe;IAKvB,OAAO,CAAC,kBAAkB;IAO1B,OAAO,CAAC,YAAY;IAgBpB,OAAO,CAAC,GAAG;CAKZ;AAED;;GAEG;AACH,wBAAgB,yBAAyB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAKzF;AAED;;GAEG;AACH,wBAAgB,kBAAkB,IAAI,eAAe,GAAG,IAAI,CAE3D;AAED;;GAEG;AACH,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,EAAE,OAAO,UAAQ,GAAG,eAAe,CAGjF;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAGpE"}