ccprofiles-core 0.5.1 → 0.7.0

package/dist/manifest.js

@@ -1,9 +1,10 @@
 import { z } from 'zod';
 import YAML from 'yaml';
-import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { mkdir, readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { atomicWrite } from './fsutil.js';
 const exec = promisify(execFile);
 export class ManifestError extends Error {
 }
@@ -26,19 +27,39 @@ const ProfileSchema = z.object({
     settingsEnv: z.record(z.string()).default({}),
     skipPermissions: z.boolean().default(false),
     sharedSessions: z.boolean().default(false),
+    plugins: z.array(z.string()).default([]),
 });
+const MarketplaceSchema = z.object({ source: z.string().min(1) });
 const ManifestSchema = z.object({
     version: z.literal(1),
     hub: z.string().nullable(),
     profiles: z.array(ProfileSchema),
     mcpServers: z.record(McpServerSchema),
+    marketplaces: z.record(MarketplaceSchema).default({}),
 });
 // identifiers that get interpolated into shell launcher code must be injection-safe
-const SAFE_NAME = /^[A-Za-z0-9_-]+$/; // profile names, launcher names, secret refs
+// leading '-' is forbidden (but internal '-' still allowed) so a value can never be parsed as a
+// CLI flag when passed as a positional argv entry (e.g. `claude plugin install <id>`)
+const SAFE_NAME = /^[A-Za-z0-9_][A-Za-z0-9_-]*$/; // profile names, launcher names, secret refs
 const SAFE_ENV_KEY = /^[A-Za-z_][A-Za-z0-9_]*$/; // POSIX/PowerShell env var names
 const SAFE_LINK_ENTRY = /^[A-Za-z0-9._-]+$/; // one profile-dir child; never a path
+const SAFE_SOURCE = /^[A-Za-z0-9._@:/][A-Za-z0-9._/@:-]*$/; // marketplace source (interpolated into `claude plugin` shell-out); no leading '-'
 const SHELL_META = /["`$;|&()\n\r<>]/; // chars that could break out of a quoted shell context
 const SECRET_PREFIX = 'secret://';
+// plaintext provider tokens that must never be committed to manifest git history
+const PLAINTEXT_TOKEN = /sk-ant-[A-Za-z0-9_-]{8,}|sk-[A-Za-z0-9]{20,}|AKIA[0-9A-Z]{16}/;
+/**
+ * True if `yaml` (raw manifest.yaml text, or any string) contains a plaintext provider
+ * token. saveManifest() uses this to decide whether to skip the git commit; doctor checks
+ * (CLI + UI) use it to surface that skip as a visible problem instead of a stderr-only warning.
+ */
+export function manifestHasPlaintextSecret(yaml) {
+    return PLAINTEXT_TOKEN.test(yaml);
+}
+/** Reject any path with a literal `..` path-traversal segment, on either `/` or `\` separators. */
+function hasDotDotSegment(path) {
+    return path.split(/[/\\]/).includes('..');
+}
 /**
  * Reject manifests whose identifiers could break out of the shell launcher context.
  * Applies to every manifest — an untrusted bundle/peer manifest reaches this before
@@ -52,6 +73,8 @@ export function assertSafeManifest(m) {
             throw new ManifestError(`unsafe launcher name in profile "${p.name}": ${JSON.stringify(p.launcher)}`);
         if (SHELL_META.test(p.dir))
             throw new ManifestError(`unsafe profile dir in profile "${p.name}": ${JSON.stringify(p.dir)}`);
+        if (hasDotDotSegment(p.dir))
+            throw new ManifestError(`unsafe profile dir in profile "${p.name}": ${JSON.stringify(p.dir)} (must not contain a ".." segment)`);
         for (const [k, v] of Object.entries(p.env)) {
             if (!SAFE_ENV_KEY.test(k))
                 throw new ManifestError(`unsafe env var name in profile "${p.name}": ${JSON.stringify(k)}`);
@@ -75,6 +98,19 @@ export function assertSafeManifest(m) {
                 throw new ManifestError(`unsafe link entry in profile "${p.name}": ${JSON.stringify(entry)} (must be one file or directory name)`);
         }
     }
+    for (const [name, mk] of Object.entries(m.marketplaces ?? {})) {
+        if (!SAFE_NAME.test(name))
+            throw new ManifestError(`unsafe marketplace name: ${JSON.stringify(name)}`);
+        if (!SAFE_SOURCE.test(mk.source))
+            throw new ManifestError(`unsafe marketplace source for "${name}": ${JSON.stringify(mk.source)}`);
+    }
+    for (const p of m.profiles)
+        for (const id of p.plugins) {
+            const at = id.lastIndexOf('@');
+            const nm = at > 0 ? id.slice(0, at) : id, mkt = at > 0 ? id.slice(at + 1) : '';
+            if (!SAFE_NAME.test(nm) || !SAFE_NAME.test(mkt))
+                throw new ManifestError(`unsafe plugin id in profile "${p.name}": ${JSON.stringify(id)}`);
+        }
 }
 export function parseManifest(text) {
     let raw;
@@ -92,6 +128,13 @@ export function parseManifest(text) {
         for (const name of p.mcp)
             if (!m.mcpServers[name])
                 throw new ManifestError(`profile "${p.name}" references undefined mcp server "${name}"`);
+    for (const p of m.profiles)
+        for (const id of p.plugins) {
+            const at = id.lastIndexOf('@');
+            const mkt = at > 0 ? id.slice(at + 1) : '';
+            if (!mkt || !m.marketplaces[mkt])
+                throw new ManifestError(`profile "${p.name}" references undefined marketplace for plugin "${id}"`);
+        }
     assertSafeManifest(m);
     return m;
 }
@@ -104,12 +147,38 @@ export async function loadManifest(root) {
 export async function saveManifest(root, m) {
     const yaml = serializeManifest(m);
     parseManifest(yaml); // guard: never write a manifest that cannot be reloaded
-    await mkdir(root, { recursive: true });
-    await writeFile(join(root, 'manifest.yaml'), yaml, 'utf8');
+    // manifestRoot also holds secrets.enc/devices.json — lock it down here since this is often
+    // the first thing (adopt/manifest init) to create it.
+    await mkdir(root, { recursive: true, mode: 0o700 });
+    // settingsEnv can carry plaintext secrets until `secrets migrate` runs — write at 0600.
+    await atomicWrite(join(root, 'manifest.yaml'), yaml, { mode: 0o600 });
+    if (manifestHasPlaintextSecret(yaml)) {
+        // never let a plaintext token land in git history — the file is still written above
+        // (callers may still need it on disk), we just refuse to commit it.
+        process.stderr.write('warn: manifest contains a plaintext secret — skipping git commit; run: ccprofiles secrets migrate\n');
+        return;
+    }
     try {
         await exec('git', ['-C', root, 'rev-parse', '--git-dir']);
         await exec('git', ['-C', root, 'add', '-A']);
         await exec('git', ['-C', root, 'commit', '-m', 'ccprofiles: update manifest']);
     }
-    catch { /* not a repo or nothing to commit — fine */ }
+    catch (e) {
+        if (!isBenignGitError(e)) {
+            // manifest.yaml is already written above — don't throw, but don't silently drop history
+            // either. Anything other than "not a repo" / "nothing to commit" is a real failure
+            // (hook rejection, disk full, corrupt index, ...) the user should know about.
+            process.stderr.write(`warn: manifest.yaml written but git commit failed: ${gitErrorMessage(e)}\n`);
+        }
+        // else: not a git repo, or nothing changed to commit — expected, nothing to report
+    }
+}
+/** True for the two git outcomes saveManifest treats as expected/benign, not a real failure. */
+function isBenignGitError(e) {
+    const text = gitErrorMessage(e);
+    return /nothing to commit/i.test(text) || /not a git repository/i.test(text);
+}
+function gitErrorMessage(e) {
+    const err = e;
+    return [err?.stderr, err?.stdout, err?.message].filter(Boolean).join(' ').trim() || String(e);
 }

package/dist/platform.js

@@ -16,5 +16,12 @@ export function renderPath(template, p) {
 export function toTemplate(absPath, p) {
     const norm = absPath.replaceAll('\\', '/');
     const home = p.home.replaceAll('\\', '/');
-    return norm.startsWith(home) ? '{home}' + norm.slice(home.length) : norm;
+    // require a path-separator boundary — a raw startsWith would also match sibling dirs
+    // that merely share a string prefix with home (e.g. home "/Users/tm" matching
+    // "/Users/tmfadhlul-old/...")
+    if (norm === home)
+        return '{home}';
+    if (norm.startsWith(home + '/'))
+        return '{home}' + norm.slice(home.length);
+    return norm;
 }

package/dist/plugins.d.ts

@@ -0,0 +1,21 @@
+export interface PluginRunner {
+    marketplaceAdd(configDir: string, source: string): Promise<void>;
+    install(configDir: string, id: string): Promise<void>;
+    uninstall(configDir: string, id: string): Promise<void>;
+}
+export declare function marketplaceOf(id: string): string | null;
+export declare function planPluginReconcile(desired: string[], current: string[]): {
+    install: string[];
+    uninstall: string[];
+};
+export declare function reconcileProfilePlugins(opts: {
+    configDir: string;
+    desired: string[];
+    current: string[];
+    marketplaces: Record<string, {
+        source: string;
+    }>;
+    runner: PluginRunner;
+}): Promise<string[]>;
+/** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
+export declare function restoreLegacyPluginSymlink(pluginsDir: string): Promise<boolean>;

package/dist/plugins.js

@@ -0,0 +1,56 @@
+import { cp, lstat, mkdir, readlink, unlink } from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+export function marketplaceOf(id) {
+    const at = id.lastIndexOf('@');
+    return at > 0 ? id.slice(at + 1) : null;
+}
+export function planPluginReconcile(desired, current) {
+    const d = new Set(desired), c = new Set(current);
+    return { install: desired.filter(id => !c.has(id)), uninstall: current.filter(id => !d.has(id)) };
+}
+export async function reconcileProfilePlugins(opts) {
+    const log = [];
+    const { install, uninstall } = planPluginReconcile(opts.desired, opts.current);
+    for (const id of uninstall) {
+        await opts.runner.uninstall(opts.configDir, id);
+        log.push(`uninstall ${id}`);
+    }
+    const added = new Set();
+    for (const id of install) {
+        const mkt = marketplaceOf(id);
+        if (mkt && !added.has(mkt)) {
+            const src = opts.marketplaces[mkt]?.source;
+            if (src) {
+                await opts.runner.marketplaceAdd(opts.configDir, src);
+                added.add(mkt);
+                log.push(`add ${src}`);
+            }
+        }
+        await opts.runner.install(opts.configDir, id);
+        log.push(`install ${id}`);
+    }
+    return log;
+}
+/** If a profile's plugins/ is a legacy symlink into the old shared pool, restore it to a real dir. */
+export async function restoreLegacyPluginSymlink(pluginsDir) {
+    let st = null;
+    try {
+        st = await lstat(pluginsDir);
+    }
+    catch {
+        return false;
+    }
+    if (!st.isSymbolicLink())
+        return false;
+    const target = await readlink(pluginsDir);
+    // Never unlink-and-empty when the pool target is gone — that would silently leave the
+    // profile with a permanently empty plugins/ and no way to recover the original content.
+    // Leave the symlink in place and fail loudly instead.
+    if (!existsSync(target)) {
+        throw new Error(`cannot restore ${pluginsDir}: symlink target ${target} does not exist — leaving the symlink in place`);
+    }
+    await unlink(pluginsDir);
+    await mkdir(pluginsDir, { recursive: true });
+    await cp(target, pluginsDir, { recursive: true, force: false, errorOnExist: false });
+    return true;
+}

package/dist/provider.d.ts

@@ -0,0 +1,10 @@
+export type AnthropicAuthMode = 'login' | 'api-key' | 'auth-token';
+/** Derive the current Anthropic auth mode from a settingsEnv map. */
+export declare function anthropicAuthMode(env: Record<string, string>): AnthropicAuthMode;
+/**
+ * New settingsEnv with `mode` applied. Non-auth keys preserved. `login` removes
+ * both token vars; `api-key`/`auth-token` set that var to `tokenRef` and remove
+ * the other. Throws if env has a custom ANTHROPIC_BASE_URL (non-Anthropic provider)
+ * or if a token mode is chosen without a tokenRef.
+ */
+export declare function setAnthropicAuthMode(env: Record<string, string>, mode: AnthropicAuthMode, tokenRef?: string): Record<string, string>;

package/dist/provider.js

@@ -0,0 +1,30 @@
+const API_KEY = 'ANTHROPIC_API_KEY';
+const AUTH_TOKEN = 'ANTHROPIC_AUTH_TOKEN';
+const BASE_URL = 'ANTHROPIC_BASE_URL';
+/** Derive the current Anthropic auth mode from a settingsEnv map. */
+export function anthropicAuthMode(env) {
+    if (env[API_KEY] !== undefined)
+        return 'api-key';
+    if (env[AUTH_TOKEN] !== undefined)
+        return 'auth-token';
+    return 'login';
+}
+/**
+ * New settingsEnv with `mode` applied. Non-auth keys preserved. `login` removes
+ * both token vars; `api-key`/`auth-token` set that var to `tokenRef` and remove
+ * the other. Throws if env has a custom ANTHROPIC_BASE_URL (non-Anthropic provider)
+ * or if a token mode is chosen without a tokenRef.
+ */
+export function setAnthropicAuthMode(env, mode, tokenRef) {
+    if (env[BASE_URL] !== undefined && env[BASE_URL].trim())
+        throw new Error(`profile uses a custom provider base URL (${env[BASE_URL]}) — manage its token in the Provider editor, not as an Anthropic auth mode`);
+    const out = { ...env };
+    delete out[API_KEY];
+    delete out[AUTH_TOKEN];
+    if (mode === 'login')
+        return out;
+    if (!tokenRef || !tokenRef.trim())
+        throw new Error(`${mode} mode requires a token reference`);
+    out[mode === 'api-key' ? API_KEY : AUTH_TOKEN] = tokenRef.trim();
+    return out;
+}

package/dist/rcblock.js

@@ -18,6 +18,7 @@ function profileDirExpr(pr, p) {
 }
 function renderPosix(pr, p) {
     const lines = [`${pr.launcher}() {`];
+    lines.push(`  if [ "$1" = handoff ]; then shift; command ccprofiles handoff --from ${pr.name} --to "$1"; return; fi`);
     for (const [k, v] of Object.entries(pr.env)) {
         lines.push(v.startsWith(SECRET_PREFIX)
             ? `  export ${k}="$(ccprofiles secrets get ${v.slice(SECRET_PREFIX.length)})"`
@@ -32,6 +33,7 @@ function renderPosix(pr, p) {
 }
 function renderPwsh(pr, p) {
     const lines = [`function ${pr.launcher} {`];
+    lines.push(`  if ($args[0] -eq 'handoff') { ccprofiles handoff --from ${pr.name} --to $args[1]; return }`);
     for (const [k, v] of Object.entries(pr.env)) {
         lines.push(v.startsWith(SECRET_PREFIX)
             ? `  $env:${k} = (ccprofiles secrets get ${v.slice(SECRET_PREFIX.length)})`

package/dist/secrets.js

@@ -35,12 +35,12 @@ export class FileBackend {
         const c = createCipheriv('aes-256-gcm', this.key(f.salt), iv);
         const data = Buffer.concat([c.update(value, 'utf8'), c.final()]);
         f.entries[key] = { iv: iv.toString('base64'), tag: c.getAuthTag().toString('base64'), data: data.toString('base64') };
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
     async delete(key) {
         const f = await this.load();
         delete f.entries[key];
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
 }
 const realExec = promisify(execFile);
@@ -150,12 +150,12 @@ export class DpapiBackend {
     async set(key, value) {
         const f = await this.load();
         f.entries[key] = await this.crypt.protect(value);
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
     async delete(key) {
         const f = await this.load();
         delete f.entries[key];
-        await atomicWrite(this.filePath, JSON.stringify(f));
+        await atomicWrite(this.filePath, JSON.stringify(f), { mode: 0o600 });
     }
 }
 export class SecretsStore {
@@ -171,7 +171,7 @@ export class SecretsStore {
         return JSON.parse(await readFile(this.indexPath, 'utf8'));
     }
     async writeIndex(names) {
-        await atomicWrite(this.indexPath, JSON.stringify([...new Set(names)].sort()));
+        await atomicWrite(this.indexPath, JSON.stringify([...new Set(names)].sort()), { mode: 0o600 });
     }
     get backendName() { return this.backend.name; }
     async get(key) { return this.backend.get(key); }

package/dist/sessions.d.ts

@@ -6,6 +6,9 @@ export interface SessionMeta {
     gitBranch: string | null;
     model: string | null;
     sizeBytes: number;
+    /** true when the transcript was too large to fully scan (per-file cap) or the per-request
+     *  byte budget ran out before reaching it — metadata is best-effort / incomplete. */
+    truncated?: boolean;
 }
 export interface ProjectSessions {
     agent: 'claude' | 'codex';
@@ -13,6 +16,26 @@ export interface ProjectSessions {
     project: string;
     sessions: SessionMeta[];
 }
+export interface TranscriptEntry {
+    id: string;
+    role: 'user' | 'assistant' | 'tool';
+    text: string;
+    label: string | null;
+    timestamp: string | null;
+}
+export interface SessionTranscript {
+    id: string;
+    agent: 'claude' | 'codex';
+    scope: string;
+    project: string;
+    messages: TranscriptEntry[];
+}
+/** Test/observability hook: cumulative cache hit/miss counts across all scanSessions() calls
+ *  in this process. Not reset automatically — callers that need deltas should diff two reads. */
+export declare function sessionScanCacheStats(): {
+    hits: number;
+    misses: number;
+};
 /** Best-effort decode of Claude Code's project dir name (cwd from a record is preferred). */
 export declare function decodeProjectDir(name: string): string;
 export declare function scanSessions(opts: {
@@ -23,3 +46,15 @@ export declare function scanSessions(opts: {
         agent?: 'claude' | 'codex';
     }[];
 }): Promise<ProjectSessions[]>;
+/** Read visible conversation and tool activity for one known managed session. */
+export declare function readSessionTranscript(opts: {
+    sharedRoot: string;
+    profiles: {
+        name: string;
+        dir: string;
+        agent?: 'claude' | 'codex';
+    }[];
+    agent: 'claude' | 'codex';
+    scope: string;
+    id: string;
+}): Promise<SessionTranscript | null>;