@within-7/minto 0.1.6 → 0.2.0

package/dist/utils/secureKeyStorage.js

@@ -0,0 +1,312 @@
+import { spawnSync } from "child_process";
+import {
+  existsSync,
+  readFileSync,
+  writeFileSync,
+  mkdirSync,
+  unlinkSync
+} from "fs";
+import { join } from "path";
+import { homedir, hostname, platform } from "os";
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  scryptSync,
+  createHash
+} from "crypto";
+const SERVICE_NAME = "com.minto.cli";
+const ENCRYPTED_KEYS_DIR = join(homedir(), ".minto", "secure");
+const ENCRYPTED_KEYS_FILE = join(ENCRYPTED_KEYS_DIR, "keys.enc");
+function isMacOSWithKeychain() {
+  if (platform() !== "darwin") return false;
+  try {
+    const result = spawnSync("security", ["help"], {
+      encoding: "utf-8",
+      timeout: 5e3
+    });
+    return result.status === 0 || result.status === 1;
+  } catch {
+    return false;
+  }
+}
+function getMachineKey() {
+  const machineId = getMachineId();
+  const combined = `${hostname()}-${machineId}-minto-secure-storage`;
+  return createHash("sha256").update(combined).digest();
+}
+function getMachineId() {
+  const sources = [
+    // macOS - use spawnSync instead of execSync for safety
+    () => {
+      if (platform() === "darwin") {
+        try {
+          const result = spawnSync(
+            "ioreg",
+            ["-rd1", "-c", "IOPlatformExpertDevice"],
+            {
+              encoding: "utf-8",
+              timeout: 5e3
+            }
+          );
+          if (result.status === 0 && result.stdout) {
+            const match = result.stdout.match(
+              /"IOPlatformUUID"\s*=\s*"([^"]+)"/
+            );
+            if (match) return match[1];
+          }
+        } catch {
+        }
+      }
+      return null;
+    },
+    // Linux - read from file directly (no shell needed)
+    () => {
+      if (platform() === "linux") {
+        try {
+          if (existsSync("/etc/machine-id")) {
+            return readFileSync("/etc/machine-id", "utf-8").trim();
+          }
+          if (existsSync("/var/lib/dbus/machine-id")) {
+            return readFileSync("/var/lib/dbus/machine-id", "utf-8").trim();
+          }
+        } catch {
+        }
+      }
+      return null;
+    },
+    // Fallback: use hostname hash
+    () => {
+      return createHash("sha256").update(hostname()).digest("hex").slice(0, 32);
+    }
+  ];
+  for (const source of sources) {
+    const id = source();
+    if (id) return id;
+  }
+  return "minto-default-machine-id";
+}
+function encrypt(data, key) {
+  const iv = randomBytes(16);
+  const salt = randomBytes(32);
+  const derivedKey = scryptSync(key, salt, 32);
+  const cipher = createCipheriv("aes-256-gcm", derivedKey, iv);
+  const encrypted = Buffer.concat([
+    cipher.update(data, "utf-8"),
+    cipher.final()
+  ]);
+  const authTag = cipher.getAuthTag();
+  return [
+    salt.toString("base64"),
+    iv.toString("base64"),
+    authTag.toString("base64"),
+    encrypted.toString("base64")
+  ].join(":");
+}
+function decrypt(encryptedData, key) {
+  const parts = encryptedData.split(":");
+  if (parts.length !== 4) {
+    throw new Error("Invalid encrypted data format");
+  }
+  const [saltB64, ivB64, authTagB64, encryptedB64] = parts;
+  const salt = Buffer.from(saltB64, "base64");
+  const iv = Buffer.from(ivB64, "base64");
+  const authTag = Buffer.from(authTagB64, "base64");
+  const encrypted = Buffer.from(encryptedB64, "base64");
+  const derivedKey = scryptSync(key, salt, 32);
+  const decipher = createDecipheriv("aes-256-gcm", derivedKey, iv);
+  decipher.setAuthTag(authTag);
+  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(
+    "utf-8"
+  );
+}
+function storeInKeychain(keyName, value) {
+  try {
+    spawnSync(
+      "security",
+      ["delete-generic-password", "-s", SERVICE_NAME, "-a", keyName],
+      { timeout: 5e3 }
+    );
+    const result = spawnSync(
+      "security",
+      [
+        "add-generic-password",
+        "-s",
+        SERVICE_NAME,
+        "-a",
+        keyName,
+        "-w",
+        value,
+        "-U"
+        // Update if exists
+      ],
+      { timeout: 5e3 }
+    );
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+function getFromKeychain(keyName) {
+  try {
+    const result = spawnSync(
+      "security",
+      [
+        "find-generic-password",
+        "-s",
+        SERVICE_NAME,
+        "-a",
+        keyName,
+        "-w"
+        // Output password only
+      ],
+      {
+        encoding: "utf-8",
+        timeout: 5e3
+      }
+    );
+    if (result.status === 0 && result.stdout) {
+      return result.stdout.trim();
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+function deleteFromKeychain(keyName) {
+  try {
+    const result = spawnSync(
+      "security",
+      ["delete-generic-password", "-s", SERVICE_NAME, "-a", keyName],
+      { timeout: 5e3 }
+    );
+    return result.status === 0;
+  } catch {
+    return false;
+  }
+}
+function loadEncryptedKeys() {
+  if (!existsSync(ENCRYPTED_KEYS_FILE)) {
+    return {};
+  }
+  try {
+    const encryptedContent = readFileSync(ENCRYPTED_KEYS_FILE, "utf-8");
+    const machineKey = getMachineKey();
+    const decrypted = decrypt(encryptedContent, machineKey);
+    return JSON.parse(decrypted);
+  } catch {
+    return {};
+  }
+}
+function saveEncryptedKeys(keys) {
+  if (!existsSync(ENCRYPTED_KEYS_DIR)) {
+    mkdirSync(ENCRYPTED_KEYS_DIR, { recursive: true, mode: 448 });
+  }
+  const machineKey = getMachineKey();
+  const encrypted = encrypt(JSON.stringify(keys), machineKey);
+  writeFileSync(ENCRYPTED_KEYS_FILE, encrypted, { mode: 384 });
+}
+function storeApiKey(keyName, value) {
+  if (!keyName || !value) {
+    return false;
+  }
+  if (isMacOSWithKeychain()) {
+    if (storeInKeychain(keyName, value)) {
+      return true;
+    }
+  }
+  try {
+    const keys = loadEncryptedKeys();
+    keys[keyName] = value;
+    saveEncryptedKeys(keys);
+    return true;
+  } catch {
+    return false;
+  }
+}
+function getApiKey(keyName) {
+  if (!keyName) {
+    return null;
+  }
+  if (isMacOSWithKeychain()) {
+    const value = getFromKeychain(keyName);
+    if (value) {
+      return value;
+    }
+  }
+  try {
+    const keys = loadEncryptedKeys();
+    return keys[keyName] || null;
+  } catch {
+    return null;
+  }
+}
+function deleteApiKey(keyName) {
+  if (!keyName) {
+    return false;
+  }
+  let success = false;
+  if (isMacOSWithKeychain()) {
+    if (deleteFromKeychain(keyName)) {
+      success = true;
+    }
+  }
+  try {
+    const keys = loadEncryptedKeys();
+    if (keys[keyName]) {
+      delete keys[keyName];
+      saveEncryptedKeys(keys);
+      success = true;
+    }
+  } catch {
+  }
+  return success;
+}
+function hasApiKey(keyName) {
+  return getApiKey(keyName) !== null;
+}
+function listApiKeyNames() {
+  const names = /* @__PURE__ */ new Set();
+  try {
+    const keys = loadEncryptedKeys();
+    for (const name of Object.keys(keys)) {
+      names.add(name);
+    }
+  } catch {
+  }
+  return Array.from(names);
+}
+function migrateApiKeyToSecure(keyName, plainTextValue) {
+  if (!plainTextValue) {
+    return false;
+  }
+  if (storeApiKey(keyName, plainTextValue)) {
+    return true;
+  }
+  return false;
+}
+function getStorageBackendInfo() {
+  if (isMacOSWithKeychain()) {
+    return { backend: "keychain", available: true };
+  }
+  return { backend: "encrypted-file", available: true };
+}
+function clearAllApiKeys() {
+  if (existsSync(ENCRYPTED_KEYS_FILE)) {
+    try {
+      unlinkSync(ENCRYPTED_KEYS_FILE);
+    } catch {
+    }
+  }
+}
+export {
+  clearAllApiKeys,
+  deleteApiKey,
+  getApiKey,
+  getStorageBackendInfo,
+  hasApiKey,
+  listApiKeyNames,
+  migrateApiKeyToSecure,
+  storeApiKey
+};
+//# sourceMappingURL=secureKeyStorage.js.map

package/dist/utils/secureKeyStorage.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../src/utils/secureKeyStorage.ts"],
+  "sourcesContent": ["/**\n * Secure Key Storage\n *\n * Provides secure storage for API keys using system keychain on macOS\n * and encrypted file storage on other platforms.\n *\n * Security features:\n * - Uses macOS Keychain via `security` command when available\n * - Falls back to AES-256-GCM encrypted file storage\n * - Encryption key derived from machine-specific data\n * - Keys never stored in plain text in config files\n */\n\nimport { spawnSync } from 'child_process'\nimport {\n  existsSync,\n  readFileSync,\n  writeFileSync,\n  mkdirSync,\n  unlinkSync,\n} from 'fs'\nimport { join } from 'path'\nimport { homedir, hostname, platform } from 'os'\nimport {\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n  scryptSync,\n  createHash,\n} from 'crypto'\n\nconst SERVICE_NAME = 'com.minto.cli'\nconst ENCRYPTED_KEYS_DIR = join(homedir(), '.minto', 'secure')\nconst ENCRYPTED_KEYS_FILE = join(ENCRYPTED_KEYS_DIR, 'keys.enc')\n\n/**\n * Check if we're running on macOS with Keychain available\n */\nfunction isMacOSWithKeychain(): boolean {\n  if (platform() !== 'darwin') return false\n\n  try {\n    const result = spawnSync('security', ['help'], {\n      encoding: 'utf-8',\n      timeout: 5000,\n    })\n    return result.status === 0 || result.status === 1 // security help returns 1\n  } catch {\n    return false\n  }\n}\n\n/**\n * Get machine-specific key for encryption\n * Combines hostname and a stable machine identifier\n */\nfunction getMachineKey(): Buffer {\n  const machineId = getMachineId()\n  const combined = `${hostname()}-${machineId}-minto-secure-storage`\n  return createHash('sha256').update(combined).digest()\n}\n\n/**\n * Get a stable machine identifier using safe methods only\n */\nfunction getMachineId(): string {\n  // Try to get machine ID from various sources\n  const sources = [\n    // macOS - use spawnSync instead of execSync for safety\n    () => {\n      if (platform() === 'darwin') {\n        try {\n          const result = spawnSync(\n            'ioreg',\n            ['-rd1', '-c', 'IOPlatformExpertDevice'],\n            {\n              encoding: 'utf-8',\n              timeout: 5000,\n            },\n          )\n          if (result.status === 0 && result.stdout) {\n            const match = result.stdout.match(\n              /\"IOPlatformUUID\"\\s*=\\s*\"([^\"]+)\"/,\n            )\n            if (match) return match[1]\n          }\n        } catch {}\n      }\n      return null\n    },\n    // Linux - read from file directly (no shell needed)\n    () => {\n      if (platform() === 'linux') {\n        try {\n          if (existsSync('/etc/machine-id')) {\n            return readFileSync('/etc/machine-id', 'utf-8').trim()\n          }\n          if (existsSync('/var/lib/dbus/machine-id')) {\n            return readFileSync('/var/lib/dbus/machine-id', 'utf-8').trim()\n          }\n        } catch {}\n      }\n      return null\n    },\n    // Fallback: use hostname hash\n    () => {\n      return createHash('sha256').update(hostname()).digest('hex').slice(0, 32)\n    },\n  ]\n\n  for (const source of sources) {\n    const id = source()\n    if (id) return id\n  }\n\n  // Should never reach here due to fallback\n  return 'minto-default-machine-id'\n}\n\n/**\n * Encrypt data using AES-256-GCM\n */\nfunction encrypt(data: string, key: Buffer): string {\n  const iv = randomBytes(16)\n  const salt = randomBytes(32)\n  const derivedKey = scryptSync(key, salt, 32)\n\n  const cipher = createCipheriv('aes-256-gcm', derivedKey, iv)\n  const encrypted = Buffer.concat([\n    cipher.update(data, 'utf-8'),\n    cipher.final(),\n  ])\n  const authTag = cipher.getAuthTag()\n\n  // Format: salt:iv:authTag:encrypted (all base64)\n  return [\n    salt.toString('base64'),\n    iv.toString('base64'),\n    authTag.toString('base64'),\n    encrypted.toString('base64'),\n  ].join(':')\n}\n\n/**\n * Decrypt data using AES-256-GCM\n */\nfunction decrypt(encryptedData: string, key: Buffer): string {\n  const parts = encryptedData.split(':')\n  if (parts.length !== 4) {\n    throw new Error('Invalid encrypted data format')\n  }\n\n  const [saltB64, ivB64, authTagB64, encryptedB64] = parts\n  const salt = Buffer.from(saltB64, 'base64')\n  const iv = Buffer.from(ivB64, 'base64')\n  const authTag = Buffer.from(authTagB64, 'base64')\n  const encrypted = Buffer.from(encryptedB64, 'base64')\n\n  const derivedKey = scryptSync(key, salt, 32)\n  const decipher = createDecipheriv('aes-256-gcm', derivedKey, iv)\n  decipher.setAuthTag(authTag)\n\n  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(\n    'utf-8',\n  )\n}\n\n/**\n * Store API key in macOS Keychain\n */\nfunction storeInKeychain(keyName: string, value: string): boolean {\n  try {\n    // First try to delete existing entry\n    spawnSync(\n      'security',\n      ['delete-generic-password', '-s', SERVICE_NAME, '-a', keyName],\n      { timeout: 5000 },\n    )\n\n    // Add new entry\n    const result = spawnSync(\n      'security',\n      [\n        'add-generic-password',\n        '-s',\n        SERVICE_NAME,\n        '-a',\n        keyName,\n        '-w',\n        value,\n        '-U', // Update if exists\n      ],\n      { timeout: 5000 },\n    )\n\n    return result.status === 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Retrieve API key from macOS Keychain\n */\nfunction getFromKeychain(keyName: string): string | null {\n  try {\n    const result = spawnSync(\n      'security',\n      [\n        'find-generic-password',\n        '-s',\n        SERVICE_NAME,\n        '-a',\n        keyName,\n        '-w', // Output password only\n      ],\n      {\n        encoding: 'utf-8',\n        timeout: 5000,\n      },\n    )\n\n    if (result.status === 0 && result.stdout) {\n      return result.stdout.trim()\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Delete API key from macOS Keychain\n */\nfunction deleteFromKeychain(keyName: string): boolean {\n  try {\n    const result = spawnSync(\n      'security',\n      ['delete-generic-password', '-s', SERVICE_NAME, '-a', keyName],\n      { timeout: 5000 },\n    )\n\n    return result.status === 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Load encrypted keys from file\n */\nfunction loadEncryptedKeys(): Record<string, string> {\n  if (!existsSync(ENCRYPTED_KEYS_FILE)) {\n    return {}\n  }\n\n  try {\n    const encryptedContent = readFileSync(ENCRYPTED_KEYS_FILE, 'utf-8')\n    const machineKey = getMachineKey()\n    const decrypted = decrypt(encryptedContent, machineKey)\n    return JSON.parse(decrypted)\n  } catch {\n    // If decryption fails (e.g., machine key changed), return empty\n    return {}\n  }\n}\n\n/**\n * Save encrypted keys to file\n */\nfunction saveEncryptedKeys(keys: Record<string, string>): void {\n  // Ensure directory exists\n  if (!existsSync(ENCRYPTED_KEYS_DIR)) {\n    mkdirSync(ENCRYPTED_KEYS_DIR, { recursive: true, mode: 0o700 })\n  }\n\n  const machineKey = getMachineKey()\n  const encrypted = encrypt(JSON.stringify(keys), machineKey)\n  writeFileSync(ENCRYPTED_KEYS_FILE, encrypted, { mode: 0o600 })\n}\n\n/**\n * Store an API key securely\n */\nexport function storeApiKey(keyName: string, value: string): boolean {\n  // Validate input\n  if (!keyName || !value) {\n    return false\n  }\n\n  // Try macOS Keychain first\n  if (isMacOSWithKeychain()) {\n    if (storeInKeychain(keyName, value)) {\n      return true\n    }\n  }\n\n  // Fall back to encrypted file storage\n  try {\n    const keys = loadEncryptedKeys()\n    keys[keyName] = value\n    saveEncryptedKeys(keys)\n    return true\n  } catch {\n    return false\n  }\n}\n\n/**\n * Retrieve an API key securely\n */\nexport function getApiKey(keyName: string): string | null {\n  if (!keyName) {\n    return null\n  }\n\n  // Try macOS Keychain first\n  if (isMacOSWithKeychain()) {\n    const value = getFromKeychain(keyName)\n    if (value) {\n      return value\n    }\n  }\n\n  // Fall back to encrypted file storage\n  try {\n    const keys = loadEncryptedKeys()\n    return keys[keyName] || null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Delete an API key\n */\nexport function deleteApiKey(keyName: string): boolean {\n  if (!keyName) {\n    return false\n  }\n\n  let success = false\n\n  // Try macOS Keychain\n  if (isMacOSWithKeychain()) {\n    if (deleteFromKeychain(keyName)) {\n      success = true\n    }\n  }\n\n  // Also remove from encrypted file\n  try {\n    const keys = loadEncryptedKeys()\n    if (keys[keyName]) {\n      delete keys[keyName]\n      saveEncryptedKeys(keys)\n      success = true\n    }\n  } catch {}\n\n  return success\n}\n\n/**\n * Check if an API key exists\n */\nexport function hasApiKey(keyName: string): boolean {\n  return getApiKey(keyName) !== null\n}\n\n/**\n * List all stored API key names (not values)\n */\nexport function listApiKeyNames(): string[] {\n  const names = new Set<string>()\n\n  // From encrypted file\n  try {\n    const keys = loadEncryptedKeys()\n    for (const name of Object.keys(keys)) {\n      names.add(name)\n    }\n  } catch {}\n\n  return Array.from(names)\n}\n\n/**\n * Migrate API key from plain text config to secure storage\n * Returns true if migration was successful or key was already secure\n */\nexport function migrateApiKeyToSecure(\n  keyName: string,\n  plainTextValue: string,\n): boolean {\n  if (!plainTextValue) {\n    return false\n  }\n\n  // Store in secure storage\n  if (storeApiKey(keyName, plainTextValue)) {\n    return true\n  }\n\n  return false\n}\n\n/**\n * Get storage backend info (for debugging)\n */\nexport function getStorageBackendInfo(): {\n  backend: 'keychain' | 'encrypted-file'\n  available: boolean\n} {\n  if (isMacOSWithKeychain()) {\n    return { backend: 'keychain', available: true }\n  }\n  return { backend: 'encrypted-file', available: true }\n}\n\n/**\n * Clear all stored API keys (use with caution)\n */\nexport function clearAllApiKeys(): void {\n  // Clear encrypted file\n  if (existsSync(ENCRYPTED_KEYS_FILE)) {\n    try {\n      unlinkSync(ENCRYPTED_KEYS_FILE)\n    } catch {}\n  }\n\n  // Note: We don't clear Keychain entries automatically\n  // as that could affect other applications\n}\n"],
+  "mappings": "AAaA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY;AACrB,SAAS,SAAS,UAAU,gBAAgB;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,qBAAqB,KAAK,QAAQ,GAAG,UAAU,QAAQ;AAC7D,MAAM,sBAAsB,KAAK,oBAAoB,UAAU;AAK/D,SAAS,sBAA+B;AACtC,MAAI,SAAS,MAAM,SAAU,QAAO;AAEpC,MAAI;AACF,UAAM,SAAS,UAAU,YAAY,CAAC,MAAM,GAAG;AAAA,MAC7C,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,WAAO,OAAO,WAAW,KAAK,OAAO,WAAW;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,gBAAwB;AAC/B,QAAM,YAAY,aAAa;AAC/B,QAAM,WAAW,GAAG,SAAS,CAAC,IAAI,SAAS;AAC3C,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO;AACtD;AAKA,SAAS,eAAuB;AAE9B,QAAM,UAAU;AAAA;AAAA,IAEd,MAAM;AACJ,UAAI,SAAS,MAAM,UAAU;AAC3B,YAAI;AACF,gBAAM,SAAS;AAAA,YACb;AAAA,YACA,CAAC,QAAQ,MAAM,wBAAwB;AAAA,YACvC;AAAA,cACE,UAAU;AAAA,cACV,SAAS;AAAA,YACX;AAAA,UACF;AACA,cAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,kBAAM,QAAQ,OAAO,OAAO;AAAA,cAC1B;AAAA,YACF;AACA,gBAAI,MAAO,QAAO,MAAM,CAAC;AAAA,UAC3B;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,aAAO;AAAA,IACT;AAAA;AAAA,IAEA,MAAM;AACJ,UAAI,SAAS,MAAM,SAAS;AAC1B,YAAI;AACF,cAAI,WAAW,iBAAiB,GAAG;AACjC,mBAAO,aAAa,mBAAmB,OAAO,EAAE,KAAK;AAAA,UACvD;AACA,cAAI,WAAW,0BAA0B,GAAG;AAC1C,mBAAO,aAAa,4BAA4B,OAAO,EAAE,KAAK;AAAA,UAChE;AAAA,QACF,QAAQ;AAAA,QAAC;AAAA,MACX;AACA,aAAO;AAAA,IACT;AAAA;AAAA,IAEA,MAAM;AACJ,aAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,aAAW,UAAU,SAAS;AAC5B,UAAM,KAAK,OAAO;AAClB,QAAI,GAAI,QAAO;AAAA,EACjB;AAGA,SAAO;AACT;AAKA,SAAS,QAAQ,MAAc,KAAqB;AAClD,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,OAAO,YAAY,EAAE;AAC3B,QAAM,aAAa,WAAW,KAAK,MAAM,EAAE;AAE3C,QAAM,SAAS,eAAe,eAAe,YAAY,EAAE;AAC3D,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,MAAM,OAAO;AAAA,IAC3B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,UAAU,OAAO,WAAW;AAGlC,SAAO;AAAA,IACL,KAAK,SAAS,QAAQ;AAAA,IACtB,GAAG,SAAS,QAAQ;AAAA,IACpB,QAAQ,SAAS,QAAQ;AAAA,IACzB,UAAU,SAAS,QAAQ;AAAA,EAC7B,EAAE,KAAK,GAAG;AACZ;AAKA,SAAS,QAAQ,eAAuB,KAAqB;AAC3D,QAAM,QAAQ,cAAc,MAAM,GAAG;AACrC,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AAEA,QAAM,CAAC,SAAS,OAAO,YAAY,YAAY,IAAI;AACnD,QAAM,OAAO,OAAO,KAAK,SAAS,QAAQ;AAC1C,QAAM,KAAK,OAAO,KAAK,OAAO,QAAQ;AACtC,QAAM,UAAU,OAAO,KAAK,YAAY,QAAQ;AAChD,QAAM,YAAY,OAAO,KAAK,cAAc,QAAQ;AAEpD,QAAM,aAAa,WAAW,KAAK,MAAM,EAAE;AAC3C,QAAM,WAAW,iBAAiB,eAAe,YAAY,EAAE;AAC/D,WAAS,WAAW,OAAO;AAE3B,SAAO,OAAO,OAAO,CAAC,SAAS,OAAO,SAAS,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAAA,IACnE;AAAA,EACF;AACF;AAKA,SAAS,gBAAgB,SAAiB,OAAwB;AAChE,MAAI;AAEF;AAAA,MACE;AAAA,MACA,CAAC,2BAA2B,MAAM,cAAc,MAAM,OAAO;AAAA,MAC7D,EAAE,SAAS,IAAK;AAAA,IAClB;AAGA,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,MACF;AAAA,MACA,EAAE,SAAS,IAAK;AAAA,IAClB;AAEA,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,gBAAgB,SAAgC;AACvD,MAAI;AACF,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,MACF;AAAA,MACA;AAAA,QACE,UAAU;AAAA,QACV,SAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,aAAO,OAAO,OAAO,KAAK;AAAA,IAC5B;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,SAA0B;AACpD,MAAI;AACF,UAAM,SAAS;AAAA,MACb;AAAA,MACA,CAAC,2BAA2B,MAAM,cAAc,MAAM,OAAO;AAAA,MAC7D,EAAE,SAAS,IAAK;AAAA,IAClB;AAEA,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,oBAA4C;AACnD,MAAI,CAAC,WAAW,mBAAmB,GAAG;AACpC,WAAO,CAAC;AAAA,EACV;AAEA,MAAI;AACF,UAAM,mBAAmB,aAAa,qBAAqB,OAAO;AAClE,UAAM,aAAa,cAAc;AACjC,UAAM,YAAY,QAAQ,kBAAkB,UAAU;AACtD,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AAEN,WAAO,CAAC;AAAA,EACV;AACF;AAKA,SAAS,kBAAkB,MAAoC;AAE7D,MAAI,CAAC,WAAW,kBAAkB,GAAG;AACnC,cAAU,oBAAoB,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EAChE;AAEA,QAAM,aAAa,cAAc;AACjC,QAAM,YAAY,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU;AAC1D,gBAAc,qBAAqB,WAAW,EAAE,MAAM,IAAM,CAAC;AAC/D;AAKO,SAAS,YAAY,SAAiB,OAAwB;AAEnE,MAAI,CAAC,WAAW,CAAC,OAAO;AACtB,WAAO;AAAA,EACT;AAGA,MAAI,oBAAoB,GAAG;AACzB,QAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,SAAK,OAAO,IAAI;AAChB,sBAAkB,IAAI;AACtB,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,UAAU,SAAgC;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAGA,MAAI,oBAAoB,GAAG;AACzB,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,OAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,WAAO,KAAK,OAAO,KAAK;AAAA,EAC1B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKO,SAAS,aAAa,SAA0B;AACrD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AAGd,MAAI,oBAAoB,GAAG;AACzB,QAAI,mBAAmB,OAAO,GAAG;AAC/B,gBAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,QAAI,KAAK,OAAO,GAAG;AACjB,aAAO,KAAK,OAAO;AACnB,wBAAkB,IAAI;AACtB,gBAAU;AAAA,IACZ;AAAA,EACF,QAAQ;AAAA,EAAC;AAET,SAAO;AACT;AAKO,SAAS,UAAU,SAA0B;AAClD,SAAO,UAAU,OAAO,MAAM;AAChC;AAKO,SAAS,kBAA4B;AAC1C,QAAM,QAAQ,oBAAI,IAAY;AAG9B,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,eAAW,QAAQ,OAAO,KAAK,IAAI,GAAG;AACpC,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF,QAAQ;AAAA,EAAC;AAET,SAAO,MAAM,KAAK,KAAK;AACzB;AAMO,SAAS,sBACd,SACA,gBACS;AACT,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAGA,MAAI,YAAY,SAAS,cAAc,GAAG;AACxC,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAKO,SAAS,wBAGd;AACA,MAAI,oBAAoB,GAAG;AACzB,WAAO,EAAE,SAAS,YAAY,WAAW,KAAK;AAAA,EAChD;AACA,SAAO,EAAE,SAAS,kBAAkB,WAAW,KAAK;AACtD;AAKO,SAAS,kBAAwB;AAEtC,MAAI,WAAW,mBAAmB,GAAG;AACnC,QAAI;AACF,iBAAW,mBAAmB;AAAA,IAChC,QAAQ;AAAA,IAAC;AAAA,EACX;AAIF;",
+  "names": []
+}

package/dist/utils/session/sessionPlugins.js

@@ -0,0 +1,67 @@
+let sessionPlugins = [];
+function setSessionPlugins(next) {
+  sessionPlugins = next;
+}
+function getSessionPlugins() {
+  return sessionPlugins;
+}
+function clearSessionPlugins() {
+  sessionPlugins = [];
+}
+function addSessionPlugin(plugin) {
+  sessionPlugins = sessionPlugins.filter((p) => p.name !== plugin.name);
+  sessionPlugins.push(plugin);
+}
+function removeSessionPlugin(name) {
+  const initialLength = sessionPlugins.length;
+  sessionPlugins = sessionPlugins.filter((p) => p.name !== name);
+  return sessionPlugins.length < initialLength;
+}
+function getSessionPlugin(name) {
+  return sessionPlugins.find((p) => p.name === name);
+}
+function hasSessionPlugin(name) {
+  return sessionPlugins.some((p) => p.name === name);
+}
+function getAllPluginAgentDirs() {
+  return sessionPlugins.flatMap((p) => p.agentsDirs);
+}
+function getAllPluginCommandDirs() {
+  return sessionPlugins.flatMap((p) => p.commandsDirs);
+}
+function getAllPluginSkillDirs() {
+  return sessionPlugins.flatMap((p) => p.skillsDirs);
+}
+function getAllPluginHooksFiles() {
+  return sessionPlugins.flatMap((p) => p.hooksFiles);
+}
+function getAllPluginMcpConfigFiles() {
+  return sessionPlugins.flatMap((p) => p.mcpConfigFiles);
+}
+function getAllPluginLspConfigFiles() {
+  return sessionPlugins.flatMap((p) => p.lspConfigFiles);
+}
+function getAllPluginOutputStyleDirs() {
+  return sessionPlugins.flatMap((p) => p.outputStylesDirs);
+}
+function __resetSessionPluginsForTests() {
+  sessionPlugins = [];
+}
+export {
+  __resetSessionPluginsForTests,
+  addSessionPlugin,
+  clearSessionPlugins,
+  getAllPluginAgentDirs,
+  getAllPluginCommandDirs,
+  getAllPluginHooksFiles,
+  getAllPluginLspConfigFiles,
+  getAllPluginMcpConfigFiles,
+  getAllPluginOutputStyleDirs,
+  getAllPluginSkillDirs,
+  getSessionPlugin,
+  getSessionPlugins,
+  hasSessionPlugin,
+  removeSessionPlugin,
+  setSessionPlugins
+};
+//# sourceMappingURL=sessionPlugins.js.map

package/dist/utils/session/sessionPlugins.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/utils/session/sessionPlugins.ts"],
+  "sourcesContent": ["/**\n * Session Plugin State Management\n *\n * Manages the plugins loaded in the current session.\n * Compatible with Claude Code CLI session plugins specification.\n */\n\nimport type { SessionPlugin } from '@minto-types/plugin'\n\n/**\n * Current session plugins\n */\nlet sessionPlugins: SessionPlugin[] = []\n\n/**\n * Set the session plugins\n */\nexport function setSessionPlugins(next: SessionPlugin[]): void {\n  sessionPlugins = next\n}\n\n/**\n * Get the current session plugins\n */\nexport function getSessionPlugins(): SessionPlugin[] {\n  return sessionPlugins\n}\n\n/**\n * Clear all session plugins\n */\nexport function clearSessionPlugins(): void {\n  sessionPlugins = []\n}\n\n/**\n * Add a single plugin to the session\n */\nexport function addSessionPlugin(plugin: SessionPlugin): void {\n  // Remove existing plugin with same name if present\n  sessionPlugins = sessionPlugins.filter(p => p.name !== plugin.name)\n  sessionPlugins.push(plugin)\n}\n\n/**\n * Remove a plugin from the session by name\n */\nexport function removeSessionPlugin(name: string): boolean {\n  const initialLength = sessionPlugins.length\n  sessionPlugins = sessionPlugins.filter(p => p.name !== name)\n  return sessionPlugins.length < initialLength\n}\n\n/**\n * Get a plugin by name\n */\nexport function getSessionPlugin(name: string): SessionPlugin | undefined {\n  return sessionPlugins.find(p => p.name === name)\n}\n\n/**\n * Check if a plugin is loaded\n */\nexport function hasSessionPlugin(name: string): boolean {\n  return sessionPlugins.some(p => p.name === name)\n}\n\n/**\n * Get all agent directories from loaded plugins\n */\nexport function getAllPluginAgentDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.agentsDirs)\n}\n\n/**\n * Get all command directories from loaded plugins\n */\nexport function getAllPluginCommandDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.commandsDirs)\n}\n\n/**\n * Get all skill directories from loaded plugins\n */\nexport function getAllPluginSkillDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.skillsDirs)\n}\n\n/**\n * Get all hooks files from loaded plugins\n */\nexport function getAllPluginHooksFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.hooksFiles)\n}\n\n/**\n * Get all MCP config files from loaded plugins\n */\nexport function getAllPluginMcpConfigFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.mcpConfigFiles)\n}\n\n/**\n * Get all LSP config files from loaded plugins\n */\nexport function getAllPluginLspConfigFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.lspConfigFiles)\n}\n\n/**\n * Get all output style directories from loaded plugins\n */\nexport function getAllPluginOutputStyleDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.outputStylesDirs)\n}\n\n/**\n * Reset session plugins (for testing)\n */\nexport function __resetSessionPluginsForTests(): void {\n  sessionPlugins = []\n}\n"],
+  "mappings": "AAYA,IAAI,iBAAkC,CAAC;AAKhC,SAAS,kBAAkB,MAA6B;AAC7D,mBAAiB;AACnB;AAKO,SAAS,oBAAqC;AACnD,SAAO;AACT;AAKO,SAAS,sBAA4B;AAC1C,mBAAiB,CAAC;AACpB;AAKO,SAAS,iBAAiB,QAA6B;AAE5D,mBAAiB,eAAe,OAAO,OAAK,EAAE,SAAS,OAAO,IAAI;AAClE,iBAAe,KAAK,MAAM;AAC5B;AAKO,SAAS,oBAAoB,MAAuB;AACzD,QAAM,gBAAgB,eAAe;AACrC,mBAAiB,eAAe,OAAO,OAAK,EAAE,SAAS,IAAI;AAC3D,SAAO,eAAe,SAAS;AACjC;AAKO,SAAS,iBAAiB,MAAyC;AACxE,SAAO,eAAe,KAAK,OAAK,EAAE,SAAS,IAAI;AACjD;AAKO,SAAS,iBAAiB,MAAuB;AACtD,SAAO,eAAe,KAAK,OAAK,EAAE,SAAS,IAAI;AACjD;AAKO,SAAS,wBAAkC;AAChD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,0BAAoC;AAClD,SAAO,eAAe,QAAQ,OAAK,EAAE,YAAY;AACnD;AAKO,SAAS,wBAAkC;AAChD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,yBAAmC;AACjD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,6BAAuC;AACrD,SAAO,eAAe,QAAQ,OAAK,EAAE,cAAc;AACrD;AAKO,SAAS,6BAAuC;AACrD,SAAO,eAAe,QAAQ,OAAK,EAAE,cAAc;AACrD;AAKO,SAAS,8BAAwC;AACtD,SAAO,eAAe,QAAQ,OAAK,EAAE,gBAAgB;AACvD;AAKO,SAAS,gCAAsC;AACpD,mBAAiB,CAAC;AACpB;",
+  "names": []
+}

package/dist/utils/taskDisplayUtils.js

@@ -0,0 +1,257 @@
+import { getAgentTranscript, getAgentIdByToolUseId } from "./agentTranscripts.js";
+import { SEMANTIC_COLORS } from "../constants/colors.js";
+import { SYMBOLS } from "../constants/symbols.js";
+function getLatestOutput(transcript) {
+  const messages = transcript.messages;
+  for (let i = messages.length - 1; i >= 0; i--) {
+    const msg = messages[i];
+    if (msg.type === "assistant") {
+      const content = msg.message.content;
+      if (!content || !Array.isArray(content)) continue;
+      const textBlock = content.find((b) => b.type === "text");
+      if (textBlock && "text" in textBlock) {
+        return textBlock.text;
+      }
+    }
+  }
+  return "";
+}
+function getNestedTasks(transcript) {
+  const nested = [];
+  for (const msg of transcript.messages) {
+    if (msg.type === "assistant") {
+      const content = msg.message.content;
+      if (!content || !Array.isArray(content)) continue;
+      for (const block of content) {
+        if (block.type === "tool_use" && block.name === "Task") {
+          const toolUse = block;
+          const nestedAgentId = getAgentIdByToolUseId(toolUse.id);
+          if (nestedAgentId) {
+            const nestedTranscript = getAgentTranscript(nestedAgentId);
+            if (nestedTranscript) {
+              nested.push(nestedTranscript);
+            }
+          }
+        }
+      }
+    }
+  }
+  return nested;
+}
+function truncate(text, maxLength) {
+  if (!text) return "";
+  const cleaned = text.trim().replace(/\n+/g, " ").replace(/\s+/g, " ");
+  if (cleaned.length <= maxLength) return cleaned;
+  return cleaned.slice(0, maxLength - 3) + "...";
+}
+function getTaskDisplayContent(transcript, config) {
+  const nestedTasks = getNestedTasks(transcript);
+  if (nestedTasks.length === 0) {
+    const latestOutput = getLatestOutput(transcript);
+    return {
+      type: "simple",
+      content: truncate(latestOutput, config.maxCharsWithoutChildren)
+    };
+  }
+  const tasksToShow = config.showAllChildren ? nestedTasks : nestedTasks.slice(-config.maxRecentChildren);
+  const children = tasksToShow.map((task) => ({
+    description: task.description,
+    status: task.status,
+    content: truncate(getLatestOutput(task), config.maxCharsPerChild)
+  }));
+  return {
+    type: "nested",
+    children,
+    hiddenCount: nestedTasks.length - tasksToShow.length
+  };
+}
+function getStatusIcon(status) {
+  switch (status) {
+    case "pending":
+      return "\u25CB";
+    // 空心圆 - pending
+    case "running":
+      return SYMBOLS.TOOL_RUNNING;
+    // ◐ 半圆 - in progress
+    case "completed":
+      return "\u25CF";
+    // 实心圆 - completed (视觉进度: ○→◐→●)
+    case "failed":
+      return SYMBOLS.TOOL_ERROR;
+    // ✗ - failed
+    case "interrupted":
+      return "\u2298";
+    default:
+      return "\u25CB";
+  }
+}
+function getStatusColor(status) {
+  switch (status) {
+    case "pending":
+      return SEMANTIC_COLORS.dim;
+    case "running":
+      return SEMANTIC_COLORS.running;
+    case "completed":
+      return SEMANTIC_COLORS.success;
+    case "failed":
+      return SEMANTIC_COLORS.error;
+    case "interrupted":
+      return SEMANTIC_COLORS.dim;
+    default:
+      return SEMANTIC_COLORS.dim;
+  }
+}
+function formatDuration(durationMs) {
+  if (durationMs === void 0 || durationMs === null) {
+    return "--";
+  }
+  const seconds = durationMs / 1e3;
+  if (seconds < 60) {
+    return `${seconds.toFixed(1)}s`;
+  }
+  const minutes = Math.floor(seconds / 60);
+  const remainingSeconds = Math.floor(seconds % 60);
+  return `${minutes}m ${remainingSeconds}s`;
+}
+function formatModelName(model) {
+  if (!model) return "";
+  if (model.includes("opus")) return "opus";
+  if (model.includes("sonnet")) return "sonnet";
+  if (model.includes("haiku")) return "haiku";
+  const parts = model.split("-");
+  if (parts.length > 2 && model.length > 15) {
+    return parts.slice(0, 2).join("-");
+  }
+  return model;
+}
+function formatTimestamp(timestamp) {
+  if (!timestamp) return "";
+  const date = timestamp instanceof Date ? timestamp : new Date(timestamp);
+  const hours = date.getHours();
+  const minutes = date.getMinutes().toString().padStart(2, "0");
+  return `${hours}:${minutes}`;
+}
+function formatMetaInfo(meta) {
+  const parts = [];
+  if (meta.duration !== void 0 && meta.duration !== null) {
+    parts.push(formatDuration(meta.duration));
+  }
+  const modelName = formatModelName(meta.model);
+  if (modelName) {
+    parts.push(modelName);
+  }
+  const time = formatTimestamp(meta.timestamp);
+  if (time) {
+    parts.push(time);
+  }
+  return parts.join(" \xB7 ");
+}
+function getToolUseHistory(transcript) {
+  const history = [];
+  const completedToolIds = /* @__PURE__ */ new Set();
+  for (const msg of transcript.messages) {
+    if (msg.type === "user") {
+      const content = msg.message.content;
+      if (!Array.isArray(content)) continue;
+      for (const block of content) {
+        if (block.type === "tool_result" && "tool_use_id" in block) {
+          completedToolIds.add(block.tool_use_id);
+        }
+      }
+    }
+  }
+  for (let i = 0; i < transcript.messages.length; i++) {
+    const msg = transcript.messages[i];
+    if (msg.type === "assistant") {
+      const content = msg.message.content;
+      if (!content || !Array.isArray(content)) continue;
+      for (const block of content) {
+        if (block.type === "tool_use") {
+          const toolUse = block;
+          const description = getToolUseDescription(toolUse);
+          const isExecuting = !completedToolIds.has(toolUse.id);
+          history.push({
+            name: toolUse.name,
+            id: toolUse.id,
+            description,
+            messageIndex: i,
+            isExecuting
+          });
+        }
+      }
+    }
+  }
+  return history;
+}
+function getFileName(filePath) {
+  const parts = filePath.split("/");
+  return parts[parts.length - 1] || filePath;
+}
+const TOOL_DISPLAY_NAMES = {
+  View: "Read"
+  // Add more mappings as needed
+};
+function getToolDisplayName(internalName) {
+  return TOOL_DISPLAY_NAMES[internalName] || internalName;
+}
+function getToolUseDescription(toolUse) {
+  const input = toolUse.input;
+  switch (toolUse.name) {
+    case "Read":
+    case "View":
+      return input.file_path ? getFileName(String(input.file_path)) : "file";
+    case "Write":
+      return input.file_path ? getFileName(String(input.file_path)) : "file";
+    case "Edit":
+      return input.file_path ? getFileName(String(input.file_path)) : "file";
+    case "Glob":
+      return input.pattern ? String(input.pattern) : "files";
+    case "Grep":
+      return input.pattern ? `"${input.pattern}"` : "content";
+    case "Bash":
+      return input.command ? String(input.command).slice(0, 50) + (String(input.command).length > 50 ? "..." : "") : "command";
+    case "Task":
+      return input.description ? String(input.description) : "sub-task";
+    case "WebFetch":
+      return input.url ? String(input.url) : "URL";
+    case "WebSearch":
+      return input.query ? String(input.query) : "web";
+    default:
+      if (input.file_path) return getFileName(String(input.file_path));
+      if (input.path) return getFileName(String(input.path));
+      if (input.query) return String(input.query);
+      if (input.pattern) return String(input.pattern);
+      return "";
+  }
+}
+function getToolUseHistoryForDisplay(transcript, config) {
+  const allTools = getToolUseHistory(transcript);
+  if (config.showAllChildren) {
+    return { tools: allTools, hiddenCount: 0 };
+  }
+  const maxTools = config.maxRecentChildren;
+  if (allTools.length <= maxTools) {
+    return { tools: allTools, hiddenCount: 0 };
+  }
+  const recentTools = allTools.slice(-maxTools);
+  return {
+    tools: recentTools,
+    hiddenCount: allTools.length - maxTools
+  };
+}
+export {
+  formatDuration,
+  formatMetaInfo,
+  formatModelName,
+  formatTimestamp,
+  getLatestOutput,
+  getNestedTasks,
+  getStatusColor,
+  getStatusIcon,
+  getTaskDisplayContent,
+  getToolDisplayName,
+  getToolUseHistory,
+  getToolUseHistoryForDisplay,
+  truncate
+};
+//# sourceMappingURL=taskDisplayUtils.js.map