@within-7/minto 0.4.2 → 0.4.3

package/dist/utils/secureKeyStorage.js

@@ -1,341 +0,0 @@
-import { spawnSync } from "child_process";
-import {
-  existsSync,
-  readFileSync,
-  writeFileSync,
-  mkdirSync,
-  unlinkSync
-} from "fs";
-import { join } from "path";
-import { homedir, hostname, platform } from "os";
-import {
-  createCipheriv,
-  createDecipheriv,
-  randomBytes,
-  scryptSync,
-  createHash
-} from "crypto";
-import { debug as debugLogger } from "./debugLogger.js";
-const SERVICE_NAME = "com.minto.cli";
-const ENCRYPTED_KEYS_DIR = join(homedir(), ".minto", "secure");
-const ENCRYPTED_KEYS_FILE = join(ENCRYPTED_KEYS_DIR, "keys.enc");
-function isMacOSWithKeychain() {
-  if (platform() !== "darwin") return false;
-  try {
-    const result = spawnSync("security", ["help"], {
-      encoding: "utf-8",
-      timeout: 5e3
-    });
-    return result.status === 0 || result.status === 1;
-  } catch {
-    return false;
-  }
-}
-function getMachineKey() {
-  const machineId = getMachineId();
-  const combined = `${hostname()}-${machineId}-minto-secure-storage`;
-  return createHash("sha256").update(combined).digest();
-}
-function getMachineId() {
-  const sources = [
-    // macOS - use spawnSync instead of execSync for safety
-    () => {
-      if (platform() === "darwin") {
-        try {
-          const result = spawnSync(
-            "ioreg",
-            ["-rd1", "-c", "IOPlatformExpertDevice"],
-            {
-              encoding: "utf-8",
-              timeout: 5e3
-            }
-          );
-          if (result.status === 0 && result.stdout) {
-            const match = result.stdout.match(
-              /"IOPlatformUUID"\s*=\s*"([^"]+)"/
-            );
-            if (match) return match[1];
-          }
-        } catch (e) {
-          debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-            phase: "getMachineId.darwin",
-            error: e
-          });
-        }
-      }
-      return null;
-    },
-    // Linux - read from file directly (no shell needed)
-    () => {
-      if (platform() === "linux") {
-        try {
-          if (existsSync("/etc/machine-id")) {
-            return readFileSync("/etc/machine-id", "utf-8").trim();
-          }
-          if (existsSync("/var/lib/dbus/machine-id")) {
-            return readFileSync("/var/lib/dbus/machine-id", "utf-8").trim();
-          }
-        } catch (e) {
-          debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-            phase: "getMachineId.linux",
-            error: e
-          });
-        }
-      }
-      return null;
-    },
-    // Fallback: use hostname hash
-    () => {
-      return createHash("sha256").update(hostname()).digest("hex").slice(0, 32);
-    }
-  ];
-  for (const source of sources) {
-    const id = source();
-    if (id) return id;
-  }
-  return "minto-default-machine-id";
-}
-function encrypt(data, key) {
-  const iv = randomBytes(16);
-  const salt = randomBytes(32);
-  const derivedKey = scryptSync(key, salt, 32);
-  const cipher = createCipheriv("aes-256-gcm", derivedKey, iv);
-  const encrypted = Buffer.concat([
-    cipher.update(data, "utf-8"),
-    cipher.final()
-  ]);
-  const authTag = cipher.getAuthTag();
-  return [
-    salt.toString("base64"),
-    iv.toString("base64"),
-    authTag.toString("base64"),
-    encrypted.toString("base64")
-  ].join(":");
-}
-function decrypt(encryptedData, key) {
-  const parts = encryptedData.split(":");
-  if (parts.length !== 4) {
-    throw new Error("Invalid encrypted data format");
-  }
-  const [saltB64, ivB64, authTagB64, encryptedB64] = parts;
-  const salt = Buffer.from(saltB64, "base64");
-  const iv = Buffer.from(ivB64, "base64");
-  const authTag = Buffer.from(authTagB64, "base64");
-  const encrypted = Buffer.from(encryptedB64, "base64");
-  const derivedKey = scryptSync(key, salt, 32);
-  const decipher = createDecipheriv("aes-256-gcm", derivedKey, iv);
-  decipher.setAuthTag(authTag);
-  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(
-    "utf-8"
-  );
-}
-function storeInKeychain(keyName, value) {
-  try {
-    spawnSync(
-      "security",
-      ["delete-generic-password", "-s", SERVICE_NAME, "-a", keyName],
-      { timeout: 5e3 }
-    );
-    const result = spawnSync(
-      "security",
-      [
-        "add-generic-password",
-        "-s",
-        SERVICE_NAME,
-        "-a",
-        keyName,
-        "-w",
-        value,
-        "-U"
-        // Update if exists
-      ],
-      { timeout: 5e3 }
-    );
-    return result.status === 0;
-  } catch {
-    return false;
-  }
-}
-function getFromKeychain(keyName) {
-  try {
-    const result = spawnSync(
-      "security",
-      [
-        "find-generic-password",
-        "-s",
-        SERVICE_NAME,
-        "-a",
-        keyName,
-        "-w"
-        // Output password only
-      ],
-      {
-        encoding: "utf-8",
-        timeout: 5e3
-      }
-    );
-    if (result.status === 0 && result.stdout) {
-      return result.stdout.trim();
-    }
-    return null;
-  } catch {
-    return null;
-  }
-}
-function deleteFromKeychain(keyName) {
-  try {
-    const result = spawnSync(
-      "security",
-      ["delete-generic-password", "-s", SERVICE_NAME, "-a", keyName],
-      { timeout: 5e3 }
-    );
-    return result.status === 0;
-  } catch {
-    return false;
-  }
-}
-function loadEncryptedKeys() {
-  if (!existsSync(ENCRYPTED_KEYS_FILE)) {
-    return {};
-  }
-  try {
-    const encryptedContent = readFileSync(ENCRYPTED_KEYS_FILE, "utf-8");
-    const machineKey = getMachineKey();
-    const decrypted = decrypt(encryptedContent, machineKey);
-    return JSON.parse(decrypted);
-  } catch {
-    return {};
-  }
-}
-function saveEncryptedKeys(keys) {
-  if (!existsSync(ENCRYPTED_KEYS_DIR)) {
-    mkdirSync(ENCRYPTED_KEYS_DIR, { recursive: true, mode: 448 });
-  }
-  const machineKey = getMachineKey();
-  const encrypted = encrypt(JSON.stringify(keys), machineKey);
-  writeFileSync(ENCRYPTED_KEYS_FILE, encrypted, { mode: 384 });
-}
-function storeApiKey(keyName, value) {
-  if (!keyName || !value) {
-    return false;
-  }
-  if (isMacOSWithKeychain()) {
-    if (storeInKeychain(keyName, value)) {
-      return true;
-    }
-  }
-  try {
-    const keys = loadEncryptedKeys();
-    keys[keyName] = value;
-    saveEncryptedKeys(keys);
-    return true;
-  } catch (e) {
-    debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-      phase: "storeApiKey",
-      error: e
-    });
-    return false;
-  }
-}
-function getApiKey(keyName) {
-  if (!keyName) {
-    return null;
-  }
-  if (isMacOSWithKeychain()) {
-    const value = getFromKeychain(keyName);
-    if (value) {
-      return value;
-    }
-  }
-  try {
-    const keys = loadEncryptedKeys();
-    return keys[keyName] || null;
-  } catch (e) {
-    debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-      phase: "getApiKey",
-      error: e
-    });
-    return null;
-  }
-}
-function deleteApiKey(keyName) {
-  if (!keyName) {
-    return false;
-  }
-  let success = false;
-  if (isMacOSWithKeychain()) {
-    if (deleteFromKeychain(keyName)) {
-      success = true;
-    }
-  }
-  try {
-    const keys = loadEncryptedKeys();
-    if (keys[keyName]) {
-      delete keys[keyName];
-      saveEncryptedKeys(keys);
-      success = true;
-    }
-  } catch (e) {
-    debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-      phase: "deleteApiKey",
-      error: e
-    });
-  }
-  return success;
-}
-function hasApiKey(keyName) {
-  return getApiKey(keyName) !== null;
-}
-function listApiKeyNames() {
-  const names = /* @__PURE__ */ new Set();
-  try {
-    const keys = loadEncryptedKeys();
-    for (const name of Object.keys(keys)) {
-      names.add(name);
-    }
-  } catch (e) {
-    debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-      phase: "listApiKeyNames",
-      error: e
-    });
-  }
-  return Array.from(names);
-}
-function migrateApiKeyToSecure(keyName, plainTextValue) {
-  if (!plainTextValue) {
-    return false;
-  }
-  if (storeApiKey(keyName, plainTextValue)) {
-    return true;
-  }
-  return false;
-}
-function getStorageBackendInfo() {
-  if (isMacOSWithKeychain()) {
-    return { backend: "keychain", available: true };
-  }
-  return { backend: "encrypted-file", available: true };
-}
-function clearAllApiKeys() {
-  if (existsSync(ENCRYPTED_KEYS_FILE)) {
-    try {
-      unlinkSync(ENCRYPTED_KEYS_FILE);
-    } catch (e) {
-      debugLogger.trace("SECURE_KEY_STORAGE_ERROR", {
-        phase: "clearAllApiKeys",
-        error: e
-      });
-    }
-  }
-}
-export {
-  clearAllApiKeys,
-  deleteApiKey,
-  getApiKey,
-  getStorageBackendInfo,
-  hasApiKey,
-  listApiKeyNames,
-  migrateApiKeyToSecure,
-  storeApiKey
-};
-//# sourceMappingURL=secureKeyStorage.js.map

package/dist/utils/secureKeyStorage.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/utils/secureKeyStorage.ts"],
-  "sourcesContent": ["/**\n * Secure Key Storage\n *\n * Provides secure storage for API keys using system keychain on macOS\n * and encrypted file storage on other platforms.\n *\n * Security features:\n * - Uses macOS Keychain via `security` command when available\n * - Falls back to AES-256-GCM encrypted file storage\n * - Encryption key derived from machine-specific data\n * - Keys never stored in plain text in config files\n */\n\nimport { spawnSync } from 'child_process'\nimport {\n  existsSync,\n  readFileSync,\n  writeFileSync,\n  mkdirSync,\n  unlinkSync,\n} from 'fs'\nimport { join } from 'path'\nimport { homedir, hostname, platform } from 'os'\nimport {\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n  scryptSync,\n  createHash,\n} from 'crypto'\nimport { debug as debugLogger } from './debugLogger'\n\nconst SERVICE_NAME = 'com.minto.cli'\nconst ENCRYPTED_KEYS_DIR = join(homedir(), '.minto', 'secure')\nconst ENCRYPTED_KEYS_FILE = join(ENCRYPTED_KEYS_DIR, 'keys.enc')\n\n/**\n * Check if we're running on macOS with Keychain available\n */\nfunction isMacOSWithKeychain(): boolean {\n  if (platform() !== 'darwin') return false\n\n  try {\n    const result = spawnSync('security', ['help'], {\n      encoding: 'utf-8',\n      timeout: 5000,\n    })\n    return result.status === 0 || result.status === 1 // security help returns 1\n  } catch {\n    return false\n  }\n}\n\n/**\n * Get machine-specific key for encryption\n * Combines hostname and a stable machine identifier\n */\nfunction getMachineKey(): Buffer {\n  const machineId = getMachineId()\n  const combined = `${hostname()}-${machineId}-minto-secure-storage`\n  return createHash('sha256').update(combined).digest()\n}\n\n/**\n * Get a stable machine identifier using safe methods only\n */\nfunction getMachineId(): string {\n  // Try to get machine ID from various sources\n  const sources = [\n    // macOS - use spawnSync instead of execSync for safety\n    () => {\n      if (platform() === 'darwin') {\n        try {\n          const result = spawnSync(\n            'ioreg',\n            ['-rd1', '-c', 'IOPlatformExpertDevice'],\n            {\n              encoding: 'utf-8',\n              timeout: 5000,\n            },\n          )\n          if (result.status === 0 && result.stdout) {\n            const match = result.stdout.match(\n              /\"IOPlatformUUID\"\\s*=\\s*\"([^\"]+)\"/,\n            )\n            if (match) return match[1]\n          }\n        } catch (e) {\n          debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n            phase: 'getMachineId.darwin',\n            error: e,\n          })\n        }\n      }\n      return null\n    },\n    // Linux - read from file directly (no shell needed)\n    () => {\n      if (platform() === 'linux') {\n        try {\n          if (existsSync('/etc/machine-id')) {\n            return readFileSync('/etc/machine-id', 'utf-8').trim()\n          }\n          if (existsSync('/var/lib/dbus/machine-id')) {\n            return readFileSync('/var/lib/dbus/machine-id', 'utf-8').trim()\n          }\n        } catch (e) {\n          debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n            phase: 'getMachineId.linux',\n            error: e,\n          })\n        }\n      }\n      return null\n    },\n    // Fallback: use hostname hash\n    () => {\n      return createHash('sha256').update(hostname()).digest('hex').slice(0, 32)\n    },\n  ]\n\n  for (const source of sources) {\n    const id = source()\n    if (id) return id\n  }\n\n  // Should never reach here due to fallback\n  return 'minto-default-machine-id'\n}\n\n/**\n * Encrypt data using AES-256-GCM\n */\nfunction encrypt(data: string, key: Buffer): string {\n  const iv = randomBytes(16)\n  const salt = randomBytes(32)\n  const derivedKey = scryptSync(key, salt, 32)\n\n  const cipher = createCipheriv('aes-256-gcm', derivedKey, iv)\n  const encrypted = Buffer.concat([\n    cipher.update(data, 'utf-8'),\n    cipher.final(),\n  ])\n  const authTag = cipher.getAuthTag()\n\n  // Format: salt:iv:authTag:encrypted (all base64)\n  return [\n    salt.toString('base64'),\n    iv.toString('base64'),\n    authTag.toString('base64'),\n    encrypted.toString('base64'),\n  ].join(':')\n}\n\n/**\n * Decrypt data using AES-256-GCM\n */\nfunction decrypt(encryptedData: string, key: Buffer): string {\n  const parts = encryptedData.split(':')\n  if (parts.length !== 4) {\n    throw new Error('Invalid encrypted data format')\n  }\n\n  const [saltB64, ivB64, authTagB64, encryptedB64] = parts\n  const salt = Buffer.from(saltB64, 'base64')\n  const iv = Buffer.from(ivB64, 'base64')\n  const authTag = Buffer.from(authTagB64, 'base64')\n  const encrypted = Buffer.from(encryptedB64, 'base64')\n\n  const derivedKey = scryptSync(key, salt, 32)\n  const decipher = createDecipheriv('aes-256-gcm', derivedKey, iv)\n  decipher.setAuthTag(authTag)\n\n  return Buffer.concat([decipher.update(encrypted), decipher.final()]).toString(\n    'utf-8',\n  )\n}\n\n/**\n * Store API key in macOS Keychain\n */\nfunction storeInKeychain(keyName: string, value: string): boolean {\n  try {\n    // First try to delete existing entry\n    spawnSync(\n      'security',\n      ['delete-generic-password', '-s', SERVICE_NAME, '-a', keyName],\n      { timeout: 5000 },\n    )\n\n    // Add new entry\n    const result = spawnSync(\n      'security',\n      [\n        'add-generic-password',\n        '-s',\n        SERVICE_NAME,\n        '-a',\n        keyName,\n        '-w',\n        value,\n        '-U', // Update if exists\n      ],\n      { timeout: 5000 },\n    )\n\n    return result.status === 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Retrieve API key from macOS Keychain\n */\nfunction getFromKeychain(keyName: string): string | null {\n  try {\n    const result = spawnSync(\n      'security',\n      [\n        'find-generic-password',\n        '-s',\n        SERVICE_NAME,\n        '-a',\n        keyName,\n        '-w', // Output password only\n      ],\n      {\n        encoding: 'utf-8',\n        timeout: 5000,\n      },\n    )\n\n    if (result.status === 0 && result.stdout) {\n      return result.stdout.trim()\n    }\n    return null\n  } catch {\n    return null\n  }\n}\n\n/**\n * Delete API key from macOS Keychain\n */\nfunction deleteFromKeychain(keyName: string): boolean {\n  try {\n    const result = spawnSync(\n      'security',\n      ['delete-generic-password', '-s', SERVICE_NAME, '-a', keyName],\n      { timeout: 5000 },\n    )\n\n    return result.status === 0\n  } catch {\n    return false\n  }\n}\n\n/**\n * Load encrypted keys from file\n */\nfunction loadEncryptedKeys(): Record<string, string> {\n  if (!existsSync(ENCRYPTED_KEYS_FILE)) {\n    return {}\n  }\n\n  try {\n    const encryptedContent = readFileSync(ENCRYPTED_KEYS_FILE, 'utf-8')\n    const machineKey = getMachineKey()\n    const decrypted = decrypt(encryptedContent, machineKey)\n    return JSON.parse(decrypted)\n  } catch {\n    // If decryption fails (e.g., machine key changed), return empty\n    return {}\n  }\n}\n\n/**\n * Save encrypted keys to file\n */\nfunction saveEncryptedKeys(keys: Record<string, string>): void {\n  // Ensure directory exists\n  if (!existsSync(ENCRYPTED_KEYS_DIR)) {\n    mkdirSync(ENCRYPTED_KEYS_DIR, { recursive: true, mode: 0o700 })\n  }\n\n  const machineKey = getMachineKey()\n  const encrypted = encrypt(JSON.stringify(keys), machineKey)\n  writeFileSync(ENCRYPTED_KEYS_FILE, encrypted, { mode: 0o600 })\n}\n\n/**\n * Store an API key securely\n */\nexport function storeApiKey(keyName: string, value: string): boolean {\n  // Validate input\n  if (!keyName || !value) {\n    return false\n  }\n\n  // Try macOS Keychain first\n  if (isMacOSWithKeychain()) {\n    if (storeInKeychain(keyName, value)) {\n      return true\n    }\n  }\n\n  // Fall back to encrypted file storage\n  try {\n    const keys = loadEncryptedKeys()\n    keys[keyName] = value\n    saveEncryptedKeys(keys)\n    return true\n  } catch (e) {\n    debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n      phase: 'storeApiKey',\n      error: e,\n    })\n    return false\n  }\n}\n\n/**\n * Retrieve an API key securely\n */\nexport function getApiKey(keyName: string): string | null {\n  if (!keyName) {\n    return null\n  }\n\n  // Try macOS Keychain first\n  if (isMacOSWithKeychain()) {\n    const value = getFromKeychain(keyName)\n    if (value) {\n      return value\n    }\n  }\n\n  // Fall back to encrypted file storage\n  try {\n    const keys = loadEncryptedKeys()\n    return keys[keyName] || null\n  } catch (e) {\n    debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n      phase: 'getApiKey',\n      error: e,\n    })\n    return null\n  }\n}\n\n/**\n * Delete an API key\n */\nexport function deleteApiKey(keyName: string): boolean {\n  if (!keyName) {\n    return false\n  }\n\n  let success = false\n\n  // Try macOS Keychain\n  if (isMacOSWithKeychain()) {\n    if (deleteFromKeychain(keyName)) {\n      success = true\n    }\n  }\n\n  // Also remove from encrypted file\n  try {\n    const keys = loadEncryptedKeys()\n    if (keys[keyName]) {\n      delete keys[keyName]\n      saveEncryptedKeys(keys)\n      success = true\n    }\n  } catch (e) {\n    debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n      phase: 'deleteApiKey',\n      error: e,\n    })\n  }\n\n  return success\n}\n\n/**\n * Check if an API key exists\n */\nexport function hasApiKey(keyName: string): boolean {\n  return getApiKey(keyName) !== null\n}\n\n/**\n * List all stored API key names (not values)\n */\nexport function listApiKeyNames(): string[] {\n  const names = new Set<string>()\n\n  // From encrypted file\n  try {\n    const keys = loadEncryptedKeys()\n    for (const name of Object.keys(keys)) {\n      names.add(name)\n    }\n  } catch (e) {\n    debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n      phase: 'listApiKeyNames',\n      error: e,\n    })\n  }\n\n  return Array.from(names)\n}\n\n/**\n * Migrate API key from plain text config to secure storage\n * Returns true if migration was successful or key was already secure\n */\nexport function migrateApiKeyToSecure(\n  keyName: string,\n  plainTextValue: string,\n): boolean {\n  if (!plainTextValue) {\n    return false\n  }\n\n  // Store in secure storage\n  if (storeApiKey(keyName, plainTextValue)) {\n    return true\n  }\n\n  return false\n}\n\n/**\n * Get storage backend info (for debugging)\n */\nexport function getStorageBackendInfo(): {\n  backend: 'keychain' | 'encrypted-file'\n  available: boolean\n} {\n  if (isMacOSWithKeychain()) {\n    return { backend: 'keychain', available: true }\n  }\n  return { backend: 'encrypted-file', available: true }\n}\n\n/**\n * Clear all stored API keys (use with caution)\n */\nexport function clearAllApiKeys(): void {\n  // Clear encrypted file\n  if (existsSync(ENCRYPTED_KEYS_FILE)) {\n    try {\n      unlinkSync(ENCRYPTED_KEYS_FILE)\n    } catch (e) {\n      debugLogger.trace('SECURE_KEY_STORAGE_ERROR', {\n        phase: 'clearAllApiKeys',\n        error: e,\n      })\n    }\n  }\n\n  // Note: We don't clear Keychain entries automatically\n  // as that could affect other applications\n}\n"],
-  "mappings": "AAaA,SAAS,iBAAiB;AAC1B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,YAAY;AACrB,SAAS,SAAS,UAAU,gBAAgB;AAC5C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS,mBAAmB;AAErC,MAAM,eAAe;AACrB,MAAM,qBAAqB,KAAK,QAAQ,GAAG,UAAU,QAAQ;AAC7D,MAAM,sBAAsB,KAAK,oBAAoB,UAAU;AAK/D,SAAS,sBAA+B;AACtC,MAAI,SAAS,MAAM,SAAU,QAAO;AAEpC,MAAI;AACF,UAAM,SAAS,UAAU,YAAY,CAAC,MAAM,GAAG;AAAA,MAC7C,UAAU;AAAA,MACV,SAAS;AAAA,IACX,CAAC;AACD,WAAO,OAAO,WAAW,KAAK,OAAO,WAAW;AAAA,EAClD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMA,SAAS,gBAAwB;AAC/B,QAAM,YAAY,aAAa;AAC/B,QAAM,WAAW,GAAG,SAAS,CAAC,IAAI,SAAS;AAC3C,SAAO,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO;AACtD;AAKA,SAAS,eAAuB;AAE9B,QAAM,UAAU;AAAA;AAAA,IAEd,MAAM;AACJ,UAAI,SAAS,MAAM,UAAU;AAC3B,YAAI;AACF,gBAAM,SAAS;AAAA,YACb;AAAA,YACA,CAAC,QAAQ,MAAM,wBAAwB;AAAA,YACvC;AAAA,cACE,UAAU;AAAA,cACV,SAAS;AAAA,YACX;AAAA,UACF;AACA,cAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,kBAAM,QAAQ,OAAO,OAAO;AAAA,cAC1B;AAAA,YACF;AACA,gBAAI,MAAO,QAAO,MAAM,CAAC;AAAA,UAC3B;AAAA,QACF,SAAS,GAAG;AACV,sBAAY,MAAM,4BAA4B;AAAA,YAC5C,OAAO;AAAA,YACP,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA;AAAA,IAEA,MAAM;AACJ,UAAI,SAAS,MAAM,SAAS;AAC1B,YAAI;AACF,cAAI,WAAW,iBAAiB,GAAG;AACjC,mBAAO,aAAa,mBAAmB,OAAO,EAAE,KAAK;AAAA,UACvD;AACA,cAAI,WAAW,0BAA0B,GAAG;AAC1C,mBAAO,aAAa,4BAA4B,OAAO,EAAE,KAAK;AAAA,UAChE;AAAA,QACF,SAAS,GAAG;AACV,sBAAY,MAAM,4BAA4B;AAAA,YAC5C,OAAO;AAAA,YACP,OAAO;AAAA,UACT,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO;AAAA,IACT;AAAA;AAAA,IAEA,MAAM;AACJ,aAAO,WAAW,QAAQ,EAAE,OAAO,SAAS,CAAC,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AAAA,IAC1E;AAAA,EACF;AAEA,aAAW,UAAU,SAAS;AAC5B,UAAM,KAAK,OAAO;AAClB,QAAI,GAAI,QAAO;AAAA,EACjB;AAGA,SAAO;AACT;AAKA,SAAS,QAAQ,MAAc,KAAqB;AAClD,QAAM,KAAK,YAAY,EAAE;AACzB,QAAM,OAAO,YAAY,EAAE;AAC3B,QAAM,aAAa,WAAW,KAAK,MAAM,EAAE;AAE3C,QAAM,SAAS,eAAe,eAAe,YAAY,EAAE;AAC3D,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,MAAM,OAAO;AAAA,IAC3B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,UAAU,OAAO,WAAW;AAGlC,SAAO;AAAA,IACL,KAAK,SAAS,QAAQ;AAAA,IACtB,GAAG,SAAS,QAAQ;AAAA,IACpB,QAAQ,SAAS,QAAQ;AAAA,IACzB,UAAU,SAAS,QAAQ;AAAA,EAC7B,EAAE,KAAK,GAAG;AACZ;AAKA,SAAS,QAAQ,eAAuB,KAAqB;AAC3D,QAAM,QAAQ,cAAc,MAAM,GAAG;AACrC,MAAI,MAAM,WAAW,GAAG;AACtB,UAAM,IAAI,MAAM,+BAA+B;AAAA,EACjD;AAEA,QAAM,CAAC,SAAS,OAAO,YAAY,YAAY,IAAI;AACnD,QAAM,OAAO,OAAO,KAAK,SAAS,QAAQ;AAC1C,QAAM,KAAK,OAAO,KAAK,OAAO,QAAQ;AACtC,QAAM,UAAU,OAAO,KAAK,YAAY,QAAQ;AAChD,QAAM,YAAY,OAAO,KAAK,cAAc,QAAQ;AAEpD,QAAM,aAAa,WAAW,KAAK,MAAM,EAAE;AAC3C,QAAM,WAAW,iBAAiB,eAAe,YAAY,EAAE;AAC/D,WAAS,WAAW,OAAO;AAE3B,SAAO,OAAO,OAAO,CAAC,SAAS,OAAO,SAAS,GAAG,SAAS,MAAM,CAAC,CAAC,EAAE;AAAA,IACnE;AAAA,EACF;AACF;AAKA,SAAS,gBAAgB,SAAiB,OAAwB;AAChE,MAAI;AAEF;AAAA,MACE;AAAA,MACA,CAAC,2BAA2B,MAAM,cAAc,MAAM,OAAO;AAAA,MAC7D,EAAE,SAAS,IAAK;AAAA,IAClB;AAGA,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,MACF;AAAA,MACA,EAAE,SAAS,IAAK;AAAA,IAClB;AAEA,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,gBAAgB,SAAgC;AACvD,MAAI;AACF,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA;AAAA,MACF;AAAA,MACA;AAAA,QACE,UAAU;AAAA,QACV,SAAS;AAAA,MACX;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,KAAK,OAAO,QAAQ;AACxC,aAAO,OAAO,OAAO,KAAK;AAAA,IAC5B;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,mBAAmB,SAA0B;AACpD,MAAI;AACF,UAAM,SAAS;AAAA,MACb;AAAA,MACA,CAAC,2BAA2B,MAAM,cAAc,MAAM,OAAO;AAAA,MAC7D,EAAE,SAAS,IAAK;AAAA,IAClB;AAEA,WAAO,OAAO,WAAW;AAAA,EAC3B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,SAAS,oBAA4C;AACnD,MAAI,CAAC,WAAW,mBAAmB,GAAG;AACpC,WAAO,CAAC;AAAA,EACV;AAEA,MAAI;AACF,UAAM,mBAAmB,aAAa,qBAAqB,OAAO;AAClE,UAAM,aAAa,cAAc;AACjC,UAAM,YAAY,QAAQ,kBAAkB,UAAU;AACtD,WAAO,KAAK,MAAM,SAAS;AAAA,EAC7B,QAAQ;AAEN,WAAO,CAAC;AAAA,EACV;AACF;AAKA,SAAS,kBAAkB,MAAoC;AAE7D,MAAI,CAAC,WAAW,kBAAkB,GAAG;AACnC,cAAU,oBAAoB,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAAA,EAChE;AAEA,QAAM,aAAa,cAAc;AACjC,QAAM,YAAY,QAAQ,KAAK,UAAU,IAAI,GAAG,UAAU;AAC1D,gBAAc,qBAAqB,WAAW,EAAE,MAAM,IAAM,CAAC;AAC/D;AAKO,SAAS,YAAY,SAAiB,OAAwB;AAEnE,MAAI,CAAC,WAAW,CAAC,OAAO;AACtB,WAAO;AAAA,EACT;AAGA,MAAI,oBAAoB,GAAG;AACzB,QAAI,gBAAgB,SAAS,KAAK,GAAG;AACnC,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,SAAK,OAAO,IAAI;AAChB,sBAAkB,IAAI;AACtB,WAAO;AAAA,EACT,SAAS,GAAG;AACV,gBAAY,MAAM,4BAA4B;AAAA,MAC5C,OAAO;AAAA,MACP,OAAO;AAAA,IACT,CAAC;AACD,WAAO;AAAA,EACT;AACF;AAKO,SAAS,UAAU,SAAgC;AACxD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAGA,MAAI,oBAAoB,GAAG;AACzB,UAAM,QAAQ,gBAAgB,OAAO;AACrC,QAAI,OAAO;AACT,aAAO;AAAA,IACT;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,WAAO,KAAK,OAAO,KAAK;AAAA,EAC1B,SAAS,GAAG;AACV,gBAAY,MAAM,4BAA4B;AAAA,MAC5C,OAAO;AAAA,MACP,OAAO;AAAA,IACT,CAAC;AACD,WAAO;AAAA,EACT;AACF;AAKO,SAAS,aAAa,SAA0B;AACrD,MAAI,CAAC,SAAS;AACZ,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AAGd,MAAI,oBAAoB,GAAG;AACzB,QAAI,mBAAmB,OAAO,GAAG;AAC/B,gBAAU;AAAA,IACZ;AAAA,EACF;AAGA,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,QAAI,KAAK,OAAO,GAAG;AACjB,aAAO,KAAK,OAAO;AACnB,wBAAkB,IAAI;AACtB,gBAAU;AAAA,IACZ;AAAA,EACF,SAAS,GAAG;AACV,gBAAY,MAAM,4BAA4B;AAAA,MAC5C,OAAO;AAAA,MACP,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,SAAO;AACT;AAKO,SAAS,UAAU,SAA0B;AAClD,SAAO,UAAU,OAAO,MAAM;AAChC;AAKO,SAAS,kBAA4B;AAC1C,QAAM,QAAQ,oBAAI,IAAY;AAG9B,MAAI;AACF,UAAM,OAAO,kBAAkB;AAC/B,eAAW,QAAQ,OAAO,KAAK,IAAI,GAAG;AACpC,YAAM,IAAI,IAAI;AAAA,IAChB;AAAA,EACF,SAAS,GAAG;AACV,gBAAY,MAAM,4BAA4B;AAAA,MAC5C,OAAO;AAAA,MACP,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,SAAO,MAAM,KAAK,KAAK;AACzB;AAMO,SAAS,sBACd,SACA,gBACS;AACT,MAAI,CAAC,gBAAgB;AACnB,WAAO;AAAA,EACT;AAGA,MAAI,YAAY,SAAS,cAAc,GAAG;AACxC,WAAO;AAAA,EACT;AAEA,SAAO;AACT;AAKO,SAAS,wBAGd;AACA,MAAI,oBAAoB,GAAG;AACzB,WAAO,EAAE,SAAS,YAAY,WAAW,KAAK;AAAA,EAChD;AACA,SAAO,EAAE,SAAS,kBAAkB,WAAW,KAAK;AACtD;AAKO,SAAS,kBAAwB;AAEtC,MAAI,WAAW,mBAAmB,GAAG;AACnC,QAAI;AACF,iBAAW,mBAAmB;AAAA,IAChC,SAAS,GAAG;AACV,kBAAY,MAAM,4BAA4B;AAAA,QAC5C,OAAO;AAAA,QACP,OAAO;AAAA,MACT,CAAC;AAAA,IACH;AAAA,EACF;AAIF;",
-  "names": []
-}

package/dist/utils/sensitiveFiles.js

@@ -1,125 +0,0 @@
-const YOLO_WARNING_PATTERNS = [
-  // Environment files
-  "**/.env",
-  "**/.env.*",
-  // Credential files
-  "**/credentials.json",
-  "**/secrets.*",
-  // Private keys and certificates
-  "**/*.pem",
-  "**/*.key",
-  "**/*.p12",
-  "**/*.pfx",
-  // Package manager auth
-  "**/.npmrc",
-  "**/.pypirc",
-  // SSH keys
-  "**/id_rsa",
-  "**/id_ed25519",
-  "**/id_ecdsa",
-  "**/id_dsa",
-  // Other auth files
-  "**/.netrc",
-  "**/.pgpass",
-  "**/config/secrets.*",
-  // AWS credentials
-  "**/.aws/credentials",
-  "**/.aws/config",
-  // Google Cloud
-  "**/service-account*.json",
-  "**/gcloud/credentials.db",
-  // Docker secrets
-  "**/.docker/config.json",
-  // Kubernetes secrets
-  "**/kubeconfig",
-  "**/.kube/config"
-];
-function isSensitiveFile(filePath) {
-  const normalizedPath = filePath.replace(/\\/g, "/");
-  const fileName = normalizedPath.split("/").pop() || "";
-  for (const pattern of YOLO_WARNING_PATTERNS) {
-    if (pattern.startsWith("**/")) {
-      const filePattern = pattern.slice(3);
-      if (filePattern.includes("/")) {
-        if (matchPathSuffix(normalizedPath, filePattern)) {
-          return true;
-        }
-      } else {
-        if (matchFilePattern(fileName, filePattern)) {
-          return true;
-        }
-      }
-    } else {
-      if (matchFilePattern(normalizedPath, pattern)) {
-        return true;
-      }
-    }
-  }
-  return false;
-}
-function matchPathSuffix(path, suffixPattern) {
-  const regexPattern = suffixPattern.replace(/\./g, "\\.").replace(/\*/g, ".*").replace(/\?/g, ".");
-  const regex = new RegExp(`(^|/)${regexPattern}$`);
-  return regex.test(path);
-}
-function matchFilePattern(str, pattern) {
-  const regexPattern = pattern.replace(/\./g, "\\.").replace(/\*\*/g, "\xA7\xA7").replace(/\*/g, "[^/]*").replace(/§§/g, ".*").replace(/\?/g, ".");
-  const regex = new RegExp(`^${regexPattern}$`);
-  return regex.test(str);
-}
-function getSensitiveFileReason(filePath) {
-  const normalizedPath = filePath.replace(/\\/g, "/").toLowerCase();
-  const fileName = normalizedPath.split("/").pop() || "";
-  if (fileName === ".env" || fileName.startsWith(".env.")) {
-    return "Environment variables file - may contain API keys and secrets";
-  }
-  if (fileName === "credentials.json") {
-    return "Credentials file - may contain authentication tokens";
-  }
-  if (fileName.startsWith("secrets.") || fileName.includes("/secrets.")) {
-    return "Secrets file - may contain sensitive configuration";
-  }
-  if (fileName.endsWith(".pem") || fileName.endsWith(".key")) {
-    return "Private key file - cryptographic key material";
-  }
-  if (fileName.endsWith(".p12") || fileName.endsWith(".pfx")) {
-    return "Certificate file - may contain private keys";
-  }
-  if (fileName === ".npmrc") {
-    return "npm configuration - may contain registry tokens";
-  }
-  if (fileName === ".pypirc") {
-    return "PyPI configuration - may contain upload tokens";
-  }
-  if (fileName === "id_rsa" || fileName === "id_ed25519" || fileName === "id_ecdsa" || fileName === "id_dsa") {
-    return "SSH private key - authentication key";
-  }
-  if (fileName === ".netrc") {
-    return "Netrc file - may contain login credentials";
-  }
-  if (fileName === ".pgpass") {
-    return "PostgreSQL password file";
-  }
-  if (normalizedPath.includes("/.aws/")) {
-    return "AWS configuration - may contain access keys";
-  }
-  if (fileName.startsWith("service-account") && fileName.endsWith(".json")) {
-    return "Service account key - cloud authentication";
-  }
-  if (normalizedPath.includes("/.docker/config.json")) {
-    return "Docker configuration - may contain registry credentials";
-  }
-  if (fileName === "kubeconfig" || normalizedPath.includes("/.kube/config")) {
-    return "Kubernetes configuration - cluster access credentials";
-  }
-  if (isSensitiveFile(filePath)) {
-    return "May contain sensitive information";
-  }
-  return void 0;
-}
-export {
-  YOLO_WARNING_PATTERNS,
-  getSensitiveFileReason,
-  isSensitiveFile
-};
-//# sourceMappingURL=sensitiveFiles.js.map

package/dist/utils/sensitiveFiles.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../src/utils/sensitiveFiles.ts"],
-  "sourcesContent": ["/**\n * Sensitive File Detection Utility\n *\n * Provides detection for files that may contain sensitive information\n * (API keys, credentials, private keys, etc.).\n *\n * Used in YOLO mode to display informational warnings without blocking operations.\n */\n\n/**\n * Patterns for files that should trigger warnings in YOLO mode.\n * These files commonly contain sensitive information like:\n * - API keys and tokens\n * - Database credentials\n * - Private keys and certificates\n * - Authentication secrets\n */\nexport const YOLO_WARNING_PATTERNS = [\n  // Environment files\n  '**/.env',\n  '**/.env.*',\n\n  // Credential files\n  '**/credentials.json',\n  '**/secrets.*',\n\n  // Private keys and certificates\n  '**/*.pem',\n  '**/*.key',\n  '**/*.p12',\n  '**/*.pfx',\n\n  // Package manager auth\n  '**/.npmrc',\n  '**/.pypirc',\n\n  // SSH keys\n  '**/id_rsa',\n  '**/id_ed25519',\n  '**/id_ecdsa',\n  '**/id_dsa',\n\n  // Other auth files\n  '**/.netrc',\n  '**/.pgpass',\n  '**/config/secrets.*',\n\n  // AWS credentials\n  '**/.aws/credentials',\n  '**/.aws/config',\n\n  // Google Cloud\n  '**/service-account*.json',\n  '**/gcloud/credentials.db',\n\n  // Docker secrets\n  '**/.docker/config.json',\n\n  // Kubernetes secrets\n  '**/kubeconfig',\n  '**/.kube/config',\n] as const\n\n/**\n * Check if a file path matches sensitive file patterns.\n * Returns true if the file should trigger a warning (but not block) in YOLO mode.\n *\n * @param filePath - The file path to check (absolute or relative)\n * @returns true if the file matches a sensitive file pattern\n *\n * @example\n * ```typescript\n * isSensitiveFile('/path/to/.env') // true\n * isSensitiveFile('/path/to/config.ts') // false\n * isSensitiveFile('credentials.json') // true\n * isSensitiveFile('/home/user/.aws/credentials') // true\n * ```\n */\nexport function isSensitiveFile(filePath: string): boolean {\n  // Normalize path separators (Windows backslashes to forward slashes)\n  const normalizedPath = filePath.replace(/\\\\/g, '/')\n\n  // Extract the file name for patterns that only match file names\n  const fileName = normalizedPath.split('/').pop() || ''\n\n  for (const pattern of YOLO_WARNING_PATTERNS) {\n    // Handle ** prefix (any directory depth)\n    if (pattern.startsWith('**/')) {\n      const filePattern = pattern.slice(3)\n\n      // Check if the pattern itself contains path separators (like .aws/credentials)\n      if (filePattern.includes('/')) {\n        // Match against the full path suffix\n        if (matchPathSuffix(normalizedPath, filePattern)) {\n          return true\n        }\n      } else {\n        // Match just the filename\n        if (matchFilePattern(fileName, filePattern)) {\n          return true\n        }\n      }\n    } else {\n      // Direct pattern match against the full path\n      if (matchFilePattern(normalizedPath, pattern)) {\n        return true\n      }\n    }\n  }\n\n  return false\n}\n\n/**\n * Check if a path ends with a given suffix pattern.\n * Handles glob patterns like .aws/credentials or config/secrets.*\n *\n * @param path - The full normalized path\n * @param suffixPattern - The pattern to match at the end of the path\n */\nfunction matchPathSuffix(path: string, suffixPattern: string): boolean {\n  // Build regex from the suffix pattern\n  const regexPattern = suffixPattern\n    .replace(/\\./g, '\\\\.')\n    .replace(/\\*/g, '.*')\n    .replace(/\\?/g, '.')\n\n  // Match at the end of the path (with optional leading /)\n  const regex = new RegExp(`(^|/)${regexPattern}$`)\n  return regex.test(path)\n}\n\n/**\n * Match a string against a glob-like pattern.\n * Supports * (any characters) and ? (single character) wildcards.\n *\n * @param str - The string to test\n * @param pattern - The glob pattern (e.g., \"*.pem\", \".env.*\")\n */\nfunction matchFilePattern(str: string, pattern: string): boolean {\n  // Convert glob pattern to regex\n  const regexPattern = pattern\n    .replace(/\\./g, '\\\\.')\n    .replace(/\\*\\*/g, '\u00A7\u00A7') // Temporarily replace ** to avoid double processing\n    .replace(/\\*/g, '[^/]*') // * matches anything except path separator\n    .replace(/\u00A7\u00A7/g, '.*') // ** matches anything including path separators\n    .replace(/\\?/g, '.')\n\n  const regex = new RegExp(`^${regexPattern}$`)\n  return regex.test(str)\n}\n\n/**\n * Get a human-readable description of why a file is considered sensitive.\n *\n * @param filePath - The file path to describe\n * @returns A description string or undefined if not sensitive\n */\nexport function getSensitiveFileReason(filePath: string): string | undefined {\n  const normalizedPath = filePath.replace(/\\\\/g, '/').toLowerCase()\n  const fileName = normalizedPath.split('/').pop() || ''\n\n  // Check specific patterns and return appropriate descriptions\n  if (fileName === '.env' || fileName.startsWith('.env.')) {\n    return 'Environment variables file - may contain API keys and secrets'\n  }\n\n  if (fileName === 'credentials.json') {\n    return 'Credentials file - may contain authentication tokens'\n  }\n\n  if (fileName.startsWith('secrets.') || fileName.includes('/secrets.')) {\n    return 'Secrets file - may contain sensitive configuration'\n  }\n\n  if (fileName.endsWith('.pem') || fileName.endsWith('.key')) {\n    return 'Private key file - cryptographic key material'\n  }\n\n  if (fileName.endsWith('.p12') || fileName.endsWith('.pfx')) {\n    return 'Certificate file - may contain private keys'\n  }\n\n  if (fileName === '.npmrc') {\n    return 'npm configuration - may contain registry tokens'\n  }\n\n  if (fileName === '.pypirc') {\n    return 'PyPI configuration - may contain upload tokens'\n  }\n\n  if (\n    fileName === 'id_rsa' ||\n    fileName === 'id_ed25519' ||\n    fileName === 'id_ecdsa' ||\n    fileName === 'id_dsa'\n  ) {\n    return 'SSH private key - authentication key'\n  }\n\n  if (fileName === '.netrc') {\n    return 'Netrc file - may contain login credentials'\n  }\n\n  if (fileName === '.pgpass') {\n    return 'PostgreSQL password file'\n  }\n\n  if (normalizedPath.includes('/.aws/')) {\n    return 'AWS configuration - may contain access keys'\n  }\n\n  if (fileName.startsWith('service-account') && fileName.endsWith('.json')) {\n    return 'Service account key - cloud authentication'\n  }\n\n  if (normalizedPath.includes('/.docker/config.json')) {\n    return 'Docker configuration - may contain registry credentials'\n  }\n\n  if (fileName === 'kubeconfig' || normalizedPath.includes('/.kube/config')) {\n    return 'Kubernetes configuration - cluster access credentials'\n  }\n\n  // Generic fallback for files that match patterns but don't have specific descriptions\n  if (isSensitiveFile(filePath)) {\n    return 'May contain sensitive information'\n  }\n\n  return undefined\n}\n"],
-  "mappings": "AAiBO,MAAM,wBAAwB;AAAA;AAAA,EAEnC;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA,EACA;AAAA;AAAA,EAGA;AAAA;AAAA,EAGA;AAAA,EACA;AACF;AAiBO,SAAS,gBAAgB,UAA2B;AAEzD,QAAM,iBAAiB,SAAS,QAAQ,OAAO,GAAG;AAGlD,QAAM,WAAW,eAAe,MAAM,GAAG,EAAE,IAAI,KAAK;AAEpD,aAAW,WAAW,uBAAuB;AAE3C,QAAI,QAAQ,WAAW,KAAK,GAAG;AAC7B,YAAM,cAAc,QAAQ,MAAM,CAAC;AAGnC,UAAI,YAAY,SAAS,GAAG,GAAG;AAE7B,YAAI,gBAAgB,gBAAgB,WAAW,GAAG;AAChD,iBAAO;AAAA,QACT;AAAA,MACF,OAAO;AAEL,YAAI,iBAAiB,UAAU,WAAW,GAAG;AAC3C,iBAAO;AAAA,QACT;AAAA,MACF;AAAA,IACF,OAAO;AAEL,UAAI,iBAAiB,gBAAgB,OAAO,GAAG;AAC7C,eAAO;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AASA,SAAS,gBAAgB,MAAc,eAAgC;AAErE,QAAM,eAAe,cAClB,QAAQ,OAAO,KAAK,EACpB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,GAAG;AAGrB,QAAM,QAAQ,IAAI,OAAO,QAAQ,YAAY,GAAG;AAChD,SAAO,MAAM,KAAK,IAAI;AACxB;AASA,SAAS,iBAAiB,KAAa,SAA0B;AAE/D,QAAM,eAAe,QAClB,QAAQ,OAAO,KAAK,EACpB,QAAQ,SAAS,UAAI,EACrB,QAAQ,OAAO,OAAO,EACtB,QAAQ,OAAO,IAAI,EACnB,QAAQ,OAAO,GAAG;AAErB,QAAM,QAAQ,IAAI,OAAO,IAAI,YAAY,GAAG;AAC5C,SAAO,MAAM,KAAK,GAAG;AACvB;AAQO,SAAS,uBAAuB,UAAsC;AAC3E,QAAM,iBAAiB,SAAS,QAAQ,OAAO,GAAG,EAAE,YAAY;AAChE,QAAM,WAAW,eAAe,MAAM,GAAG,EAAE,IAAI,KAAK;AAGpD,MAAI,aAAa,UAAU,SAAS,WAAW,OAAO,GAAG;AACvD,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,oBAAoB;AACnC,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,WAAW,UAAU,KAAK,SAAS,SAAS,WAAW,GAAG;AACrE,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,SAAS,MAAM,KAAK,SAAS,SAAS,MAAM,GAAG;AAC1D,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,SAAS,MAAM,KAAK,SAAS,SAAS,MAAM,GAAG;AAC1D,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,UAAU;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,WAAW;AAC1B,WAAO;AAAA,EACT;AAEA,MACE,aAAa,YACb,aAAa,gBACb,aAAa,cACb,aAAa,UACb;AACA,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,UAAU;AACzB,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,WAAW;AAC1B,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,SAAS,QAAQ,GAAG;AACrC,WAAO;AAAA,EACT;AAEA,MAAI,SAAS,WAAW,iBAAiB,KAAK,SAAS,SAAS,OAAO,GAAG;AACxE,WAAO;AAAA,EACT;AAEA,MAAI,eAAe,SAAS,sBAAsB,GAAG;AACnD,WAAO;AAAA,EACT;AAEA,MAAI,aAAa,gBAAgB,eAAe,SAAS,eAAe,GAAG;AACzE,WAAO;AAAA,EACT;AAGA,MAAI,gBAAgB,QAAQ,GAAG;AAC7B,WAAO;AAAA,EACT;AAEA,SAAO;AACT;",
-  "names": []
-}

package/dist/utils/session/sessionPlugins.js

@@ -1,67 +0,0 @@
-let sessionPlugins = [];
-function setSessionPlugins(next) {
-  sessionPlugins = next;
-}
-function getSessionPlugins() {
-  return sessionPlugins;
-}
-function clearSessionPlugins() {
-  sessionPlugins = [];
-}
-function addSessionPlugin(plugin) {
-  sessionPlugins = sessionPlugins.filter((p) => p.name !== plugin.name);
-  sessionPlugins.push(plugin);
-}
-function removeSessionPlugin(name) {
-  const initialLength = sessionPlugins.length;
-  sessionPlugins = sessionPlugins.filter((p) => p.name !== name);
-  return sessionPlugins.length < initialLength;
-}
-function getSessionPlugin(name) {
-  return sessionPlugins.find((p) => p.name === name);
-}
-function hasSessionPlugin(name) {
-  return sessionPlugins.some((p) => p.name === name);
-}
-function getAllPluginAgentDirs() {
-  return sessionPlugins.flatMap((p) => p.agentsDirs);
-}
-function getAllPluginCommandDirs() {
-  return sessionPlugins.flatMap((p) => p.commandsDirs);
-}
-function getAllPluginSkillDirs() {
-  return sessionPlugins.flatMap((p) => p.skillsDirs);
-}
-function getAllPluginHooksFiles() {
-  return sessionPlugins.flatMap((p) => p.hooksFiles);
-}
-function getAllPluginMcpConfigFiles() {
-  return sessionPlugins.flatMap((p) => p.mcpConfigFiles);
-}
-function getAllPluginLspConfigFiles() {
-  return sessionPlugins.flatMap((p) => p.lspConfigFiles);
-}
-function getAllPluginOutputStyleDirs() {
-  return sessionPlugins.flatMap((p) => p.outputStylesDirs);
-}
-function __resetSessionPluginsForTests() {
-  sessionPlugins = [];
-}
-export {
-  __resetSessionPluginsForTests,
-  addSessionPlugin,
-  clearSessionPlugins,
-  getAllPluginAgentDirs,
-  getAllPluginCommandDirs,
-  getAllPluginHooksFiles,
-  getAllPluginLspConfigFiles,
-  getAllPluginMcpConfigFiles,
-  getAllPluginOutputStyleDirs,
-  getAllPluginSkillDirs,
-  getSessionPlugin,
-  getSessionPlugins,
-  hasSessionPlugin,
-  removeSessionPlugin,
-  setSessionPlugins
-};
-//# sourceMappingURL=sessionPlugins.js.map

package/dist/utils/session/sessionPlugins.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../src/utils/session/sessionPlugins.ts"],
-  "sourcesContent": ["/**\n * Session Plugin State Management\n *\n * Manages the plugins loaded in the current session.\n * Compatible with Claude Code CLI session plugins specification.\n */\n\nimport type { SessionPlugin } from '@minto-types/plugin'\n\n/**\n * Current session plugins\n */\nlet sessionPlugins: SessionPlugin[] = []\n\n/**\n * Set the session plugins\n */\nexport function setSessionPlugins(next: SessionPlugin[]): void {\n  sessionPlugins = next\n}\n\n/**\n * Get the current session plugins\n */\nexport function getSessionPlugins(): SessionPlugin[] {\n  return sessionPlugins\n}\n\n/**\n * Clear all session plugins\n */\nexport function clearSessionPlugins(): void {\n  sessionPlugins = []\n}\n\n/**\n * Add a single plugin to the session\n */\nexport function addSessionPlugin(plugin: SessionPlugin): void {\n  // Remove existing plugin with same name if present\n  sessionPlugins = sessionPlugins.filter(p => p.name !== plugin.name)\n  sessionPlugins.push(plugin)\n}\n\n/**\n * Remove a plugin from the session by name\n */\nexport function removeSessionPlugin(name: string): boolean {\n  const initialLength = sessionPlugins.length\n  sessionPlugins = sessionPlugins.filter(p => p.name !== name)\n  return sessionPlugins.length < initialLength\n}\n\n/**\n * Get a plugin by name\n */\nexport function getSessionPlugin(name: string): SessionPlugin | undefined {\n  return sessionPlugins.find(p => p.name === name)\n}\n\n/**\n * Check if a plugin is loaded\n */\nexport function hasSessionPlugin(name: string): boolean {\n  return sessionPlugins.some(p => p.name === name)\n}\n\n/**\n * Get all agent directories from loaded plugins\n */\nexport function getAllPluginAgentDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.agentsDirs)\n}\n\n/**\n * Get all command directories from loaded plugins\n */\nexport function getAllPluginCommandDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.commandsDirs)\n}\n\n/**\n * Get all skill directories from loaded plugins\n */\nexport function getAllPluginSkillDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.skillsDirs)\n}\n\n/**\n * Get all hooks files from loaded plugins\n */\nexport function getAllPluginHooksFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.hooksFiles)\n}\n\n/**\n * Get all MCP config files from loaded plugins\n */\nexport function getAllPluginMcpConfigFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.mcpConfigFiles)\n}\n\n/**\n * Get all LSP config files from loaded plugins\n */\nexport function getAllPluginLspConfigFiles(): string[] {\n  return sessionPlugins.flatMap(p => p.lspConfigFiles)\n}\n\n/**\n * Get all output style directories from loaded plugins\n */\nexport function getAllPluginOutputStyleDirs(): string[] {\n  return sessionPlugins.flatMap(p => p.outputStylesDirs)\n}\n\n/**\n * Reset session plugins (for testing)\n */\nexport function __resetSessionPluginsForTests(): void {\n  sessionPlugins = []\n}\n"],
-  "mappings": "AAYA,IAAI,iBAAkC,CAAC;AAKhC,SAAS,kBAAkB,MAA6B;AAC7D,mBAAiB;AACnB;AAKO,SAAS,oBAAqC;AACnD,SAAO;AACT;AAKO,SAAS,sBAA4B;AAC1C,mBAAiB,CAAC;AACpB;AAKO,SAAS,iBAAiB,QAA6B;AAE5D,mBAAiB,eAAe,OAAO,OAAK,EAAE,SAAS,OAAO,IAAI;AAClE,iBAAe,KAAK,MAAM;AAC5B;AAKO,SAAS,oBAAoB,MAAuB;AACzD,QAAM,gBAAgB,eAAe;AACrC,mBAAiB,eAAe,OAAO,OAAK,EAAE,SAAS,IAAI;AAC3D,SAAO,eAAe,SAAS;AACjC;AAKO,SAAS,iBAAiB,MAAyC;AACxE,SAAO,eAAe,KAAK,OAAK,EAAE,SAAS,IAAI;AACjD;AAKO,SAAS,iBAAiB,MAAuB;AACtD,SAAO,eAAe,KAAK,OAAK,EAAE,SAAS,IAAI;AACjD;AAKO,SAAS,wBAAkC;AAChD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,0BAAoC;AAClD,SAAO,eAAe,QAAQ,OAAK,EAAE,YAAY;AACnD;AAKO,SAAS,wBAAkC;AAChD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,yBAAmC;AACjD,SAAO,eAAe,QAAQ,OAAK,EAAE,UAAU;AACjD;AAKO,SAAS,6BAAuC;AACrD,SAAO,eAAe,QAAQ,OAAK,EAAE,cAAc;AACrD;AAKO,SAAS,6BAAuC;AACrD,SAAO,eAAe,QAAQ,OAAK,EAAE,cAAc;AACrD;AAKO,SAAS,8BAAwC;AACtD,SAAO,eAAe,QAAQ,OAAK,EAAE,gBAAgB;AACvD;AAKO,SAAS,gCAAsC;AACpD,mBAAiB,CAAC;AACpB;",
-  "names": []
-}