@whisperr/wizard 0.7.2 → 0.7.3

package/dist/index.js

@@ -11,7 +11,7 @@ import open2 from "open";
 
 // src/core/config.ts
 var DEFAULT_API_BASE = "https://api.whisperr.net";
-var DEFAULT_MODEL = "claude-sonnet-5";
+var DEFAULT_MODEL = "claude-opus-5";
 var DEFAULT_PLANNER_MODEL = "claude-opus-5";
 var DEFAULT_EFFORT = "high";
 var EFFORT_LEVELS = ["low", "medium", "high", "xhigh", "max"];
@@ -2063,11 +2063,14 @@ var SURVEY_SYSTEM_PROMPT = [
   "",
   "Report, in plain markdown:",
   "1. Stack: frameworks, package manager, app entry point file.",
-  "2. Feature areas: name, root directory, and the 1-3 files where committed user actions happen.",
+  "2. Feature areas: name, root directory, and every relevant file containing",
+  "   committed end-user actions or meaningful lifecycle transitions.",
   "3. The end-user identify() anchor: the login/signup success and session-restore call sites for the",
   "   PAYING end user \u2014 never admin, staff, operator, or seller paths.",
   "4. Existing analytics calls, if any.",
-  "5. Committed-action call sites worth instrumenting: file, function/symbol, and what the user just did.",
+  "5. Exhaustive inventory of integratable call sites: file, function/symbol,",
+  "   confirmed outcome or state transition, available non-PII payload fields,",
+  "   and whether similar paths exist elsewhere.",
   "Cite concrete file paths for every claim. Do not propose event names yet."
 ].join("\n");
 function surveyUserPrompt(repoPath, onboardingContext) {
@@ -2090,9 +2093,20 @@ var SELECTION_SYSTEM_PROMPT = [
   "  streak_broken) \u2014 the server derives those later.",
   "- Emit after confirmed outcomes, not intent: a purchase event fires on confirmed success, not on",
   "  button tap; denied permissions are not grants.",
-  "- Importance is anchored in the business context: the activation moment, churn-risk and healthy",
-  "  signals, and how the product charges. A handful of load-bearing events beats wide coverage.",
-  "- An empty or small set is a valid outcome. There is no quota. Never invent events to look thorough.",
+  "- Aim for comprehensive coverage of the product\u2019s observable end-user lifecycle.",
+  "  Inspect every meaningful feature area and propose every distinct, concretely",
+  "  integratable event that could contribute to activation, engagement, retention,",
+  "  monetization, or churn analysis.",
+  "- Prefer complete coverage over a short curated list. Include distinct successful",
+  "  outcomes, failures, cancellations, retries, state transitions, and meaningful",
+  "  feature usage when each has its own concrete call site and analytical value.",
+  "- Let the product\u2019s actual complexity determine the count. A feature-rich product",
+  "  may legitimately produce roughly 100\u2013200 events, while a smaller product may",
+  "  produce fewer. Do not stop after finding only the most obvious events, and do",
+  "  not invent events merely to reach a number.",
+  "- Before finishing, systematically revisit every surveyed feature area and confirm",
+  "  that all meaningful committed actions and lifecycle transitions have either",
+  "  been proposed or deliberately excluded with a reason.",
   "- Codes are lowercase snake_case, named for what happened (checkout_completed, not do_checkout).",
   "- payloadSchema lists the fields worth capturing with a short description of each \u2014 the important",
   "  info only. NEVER include personal identifiers: no email, phone, names, addresses, birth dates,",
@@ -3183,7 +3197,7 @@ function coverageNote(coverage) {
 
 // src/core/toolPolicy.ts
 import { isAbsolute, relative, resolve } from "path";
-var SECRET_MATERIAL_DENIAL = "blocked: secret material - reference the variable name in .env.example instead of reading the real file";
+var SECRET_MATERIAL_DENIAL = "blocked: secret material must not be accessed";
 var WRITE_OUTSIDE_REPO_DENIAL = "blocked: writes must stay inside the target repository";
 var SENSITIVE_WRITE_DENIAL = "blocked: refusing to write CI/git configuration";
 var BASH_ALLOWLIST_DENIAL = "blocked: command is outside the Bash allowlist - use package install/add commands, mkdir, or git status/diff/log only";
@@ -3194,9 +3208,24 @@ function engineMcpToolName(toolName) {
 function trustedEngineMcpTools(tools) {
   return new Set(tools.map((tool2) => engineMcpToolName(tool2.name)));
 }
-var ENV_EXAMPLES = /* @__PURE__ */ new Set([".env.example", ".env.sample", ".env.template"]);
-var SECRET_DIRECTORIES = /* @__PURE__ */ new Set([".aws", ".ssh", ".gnupg"]);
-var SECRET_EXACT_FILES = /* @__PURE__ */ new Set([".netrc", ".npmrc", ".pypirc"]);
+var SECRET_DIRECTORIES = /* @__PURE__ */ new Set([
+  ".aws",
+  ".ssh",
+  ".gnupg",
+  ".azure",
+  ".docker",
+  ".kube",
+  ".secrets",
+  "secrets"
+]);
+var SECRET_EXACT_FILES = /* @__PURE__ */ new Set([
+  ".netrc",
+  ".npmrc",
+  ".pypirc",
+  "auth.json",
+  "google-services.json",
+  "googleservice-info.plist"
+]);
 var SENSITIVE_WRITE_DIRECTORIES = /* @__PURE__ */ new Set([".git", ".circleci", ".buildkite"]);
 var SENSITIVE_WRITE_EXACT_FILES = /* @__PURE__ */ new Set([
   ".gitlab-ci.yml",
@@ -3212,6 +3241,7 @@ var SECRET_SUFFIXES = [
   ".pfx",
   ".jks",
   ".keystore",
+  ".kdbx",
   ".tfvars"
 ];
 var JS_PACKAGE_MANAGERS = /* @__PURE__ */ new Set(["npm", "pnpm", "yarn", "bun"]);
@@ -3245,7 +3275,6 @@ function isSecretPathLike(value) {
   for (const rawPart of parts) {
     const part = stripOuterQuotes(rawPart.trim().toLowerCase());
     if (!part || part === "." || part === "**") continue;
-    if (ENV_EXAMPLES.has(part)) continue;
     if (SECRET_DIRECTORIES.has(part)) return true;
     if (SECRET_EXACT_FILES.has(part)) return true;
     if (part === ".env" || part === ".envrc" || part.startsWith(".env.") || part.startsWith(".env*")) {
@@ -3256,6 +3285,7 @@ function isSecretPathLike(value) {
     }
     if (part.includes("credentials")) return true;
     if (part.startsWith("secrets.")) return true;
+    if (part.startsWith("service-account") && part.endsWith(".json")) return true;
     if (SECRET_SUFFIXES.some((suffix) => part.endsWith(suffix))) return true;
   }
   return false;
@@ -3291,6 +3321,9 @@ function evaluateWrite(input, context) {
   if (!isPathInsideRepo(pathValue, context.repoPath)) {
     return { behavior: "deny", message: WRITE_OUTSIDE_REPO_DENIAL };
   }
+  if (isSecretPathLike(pathValue)) {
+    return { behavior: "deny", message: SECRET_MATERIAL_DENIAL };
+  }
   if (isSensitiveWritePath(pathValue, context.repoPath)) {
     return { behavior: "deny", message: SENSITIVE_WRITE_DENIAL };
   }
@@ -4349,6 +4382,10 @@ function short(s, max = 60) {
 // src/engine/providers/claude.ts
 var READ_ONLY_TOOLS2 = ["Read", "Glob", "Grep"];
 var EDIT_TOOLS = ["Read", "Edit", "Write", "Bash", "Glob", "Grep"];
+var FAST_MODE_MODELS = /* @__PURE__ */ new Set(["claude-opus-5", "claude-opus-4-8"]);
+function supportsClaudeFastMode(model) {
+  return FAST_MODE_MODELS.has(model);
+}
 function createClaudeProvider(config, session) {
   return {
     name: "claude",
@@ -4384,6 +4421,7 @@ function createClaudeProvider(config, session) {
             hooks: buildToolPolicyHooks(invocation.cwd, trustedTools),
             canUseTool: createToolPermissionCallback(invocation.cwd, trustedTools),
             maxTurns: roleConfig.maxTurns,
+            ...supportsClaudeFastMode(roleConfig.model) ? { settings: { fastMode: true } } : {},
             ...invocation.resumeSessionId ? { resume: invocation.resumeSessionId } : {},
             settingSources: []
           }
@@ -4444,6 +4482,18 @@ function jailedPath(cwd, candidate) {
   }
   return resolved;
 }
+function guardedPath(cwd, toolName, candidate) {
+  const path = jailedPath(cwd, candidate);
+  const decision = evaluateToolUse(
+    toolName,
+    toolName === "Glob" ? { path: candidate, pattern: "*" } : { file_path: candidate },
+    { repoPath: cwd }
+  );
+  if (decision.behavior === "deny") {
+    throw new Error(decision.message);
+  }
+  return path;
+}
 function fileTools(cwd, allowWrite) {
   const tools = [
     {
@@ -4456,7 +4506,8 @@ function fileTools(cwd, allowWrite) {
         required: ["path"]
       },
       handler: async (input) => {
-        const content = readFileSync3(jailedPath(cwd, String(input.path ?? "")), "utf8");
+        const path = guardedPath(cwd, "Read", String(input.path ?? ""));
+        const content = readFileSync3(path, "utf8");
         return { content: content.slice(0, 4e4) };
       }
     },
@@ -4470,8 +4521,8 @@ function fileTools(cwd, allowWrite) {
         required: ["path"]
       },
       handler: async (input) => {
-        const target9 = jailedPath(cwd, String(input.path ?? "."));
-        const entries = readdirSync(target9).map((entry) => {
+        const target9 = guardedPath(cwd, "Glob", String(input.path ?? "."));
+        const entries = readdirSync(target9).filter((entry) => !isSecretPathLike(entry)).map((entry) => {
           const kind = statSync(join8(target9, entry)).isDirectory() ? "dir" : "file";
           return `${kind}:${entry}`;
         });
@@ -4491,7 +4542,8 @@ function fileTools(cwd, allowWrite) {
           required: ["path", "content"]
         },
         handler: async (input) => {
-          writeFileSync2(jailedPath(cwd, String(input.path ?? "")), String(input.content ?? ""));
+          const path = guardedPath(cwd, "Write", String(input.path ?? ""));
+          writeFileSync2(path, String(input.content ?? ""));
           return { ok: true };
         }
       },
@@ -4509,7 +4561,7 @@ function fileTools(cwd, allowWrite) {
           required: ["path", "oldText", "newText"]
         },
         handler: async (input) => {
-          const path = jailedPath(cwd, String(input.path ?? ""));
+          const path = guardedPath(cwd, "Edit", String(input.path ?? ""));
           const content = readFileSync3(path, "utf8");
           const oldText = String(input.oldText ?? "");
           if (!content.includes(oldText)) {
@@ -4679,7 +4731,7 @@ var MINUTE = 6e4;
 function engineModelConfig(config) {
   const model = (role, fallback) => process.env[`WHISPERR_WIZARD_ENGINE_${role.toUpperCase()}_MODEL`]?.trim() || fallback;
   return {
-    survey: { model: model("survey", "claude-sonnet-5"), effort: "medium", maxTurns: 40, maxMs: 12 * MINUTE },
+    survey: { model: model("survey", config.model), effort: "medium", maxTurns: 40, maxMs: 12 * MINUTE },
     design: { model: model("design", config.plannerModel), effort: "high", maxTurns: 40, maxMs: 15 * MINUTE },
     edit: { model: model("edit", config.model), effort: config.effort, maxTurns: 50, maxMs: 15 * MINUTE },
     review: { model: model("review", config.model), effort: "medium", maxTurns: 15, maxMs: 8 * MINUTE }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@whisperr/wizard",
-  "version": "0.7.2",
+  "version": "0.7.3",
   "description": "Whisperr Wizard \u2014 one command to integrate the Whisperr SDK into your app. Authenticates with your onboarded account and uses an AI coding agent to wire up identify() and your business events automatically.",
   "repository": {
     "type": "git",