claude-code-modes 0.2.2 → 0.2.3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-code-modes",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "description": "Behaviorally-tuned system prompts for Claude Code",
   "license": "MIT",
   "type": "module",

package/src/config.ts

@@ -3,8 +3,13 @@ import { join, dirname, resolve, isAbsolute } from "node:path";
 import { homedir } from "node:os";
 import { PRESET_NAMES, BUILTIN_MODIFIER_NAMES, AXIS_BUILTINS, BUILTIN_BASE_NAMES, isBuiltinModifier, isPresetName, isBuiltinBase, isBuiltinAxisValue } from "./types.js";
 
-/** Matches paths that reference potentially sensitive files (SSH keys, credentials, etc.) */
-const SUSPICIOUS_PATH_PATTERN = /\.(ssh|env|gnupg|aws|kube|docker|pgpass)|\.npmrc|\.netrc|id_rsa|id_ed25519|id_ecdsa|credentials|secret|token|password|private/i;
+/**
+ * Matches paths that reference potentially sensitive files (SSH keys, credentials, etc.).
+ * Note: bare "private" was removed — it false-positives on macOS where resolved paths
+ * go through /private/var/folders/... Instead we match ".private/" (hidden directory)
+ * and "private_key"/"private-key" (common key naming patterns).
+ */
+const SUSPICIOUS_PATH_PATTERN = /\.(ssh|env|gnupg|aws|kube|docker|pgpass)|\.npmrc|\.netrc|id_rsa|id_ed25519|id_ecdsa|credentials|secret|token|password|\.private[/]|private[_-]?key/i;
 
 /**
  * Validates a file path defined in a config file.

package/src/inspect.ts

@@ -5,6 +5,7 @@ import { loadConfig, resolveConfigPath, type LoadedConfig } from "./config.js";
 import { resolveConfig } from "./resolve.js";
 import { getFragmentOrder } from "./assemble.js";
 import { detectEnv, buildTemplateVars } from "./env.js";
+import { EMBEDDED_PROMPTS } from "./embedded-prompts.js";
 import type { TemplateVars } from "./types.js";
 
 const PROVENANCE_VALUES = ["built-in", "config-defined", "cli-path"] as const;
@@ -43,7 +44,13 @@ interface InspectResult {
   verbose: boolean;
 }
 
-const SUSPICIOUS_PATTERN = /\.(ssh|env|gnupg|aws|kube|docker|pgpass)|\.npmrc|\.netrc|id_rsa|id_ed25519|id_ecdsa|credentials|secret|token|password|private/i;
+/**
+ * Matches paths that reference potentially sensitive files (SSH keys, credentials, etc.).
+ * Note: bare "private" was removed — it false-positives on macOS where resolved paths
+ * go through /private/var/folders/... Instead we match ".private/" (hidden directory)
+ * and "private_key"/"private-key" (common key naming patterns).
+ */
+const SUSPICIOUS_PATTERN = /\.(ssh|env|gnupg|aws|kube|docker|pgpass)|\.npmrc|\.netrc|id_rsa|id_ed25519|id_ecdsa|credentials|secret|token|password|\.private[/]|private[_-]?key/i;
 
 /** Builds a Set of all absolute paths that config definitions could resolve to. */
 function collectConfigDefinedPaths(loadedConfig: LoadedConfig | null): Set<string> {
@@ -118,8 +125,9 @@ function detectWarnings(
 
   for (const frag of fragments) {
     if (frag.provenance === "built-in") {
-      // Only check existence for built-in fragments
-      if (!existsSync(frag.resolvedPath)) {
+      // Built-in fragments: check embedded prompts first, then disk
+      const embedded = frag.path in EMBEDDED_PROMPTS;
+      if (!embedded && !existsSync(frag.resolvedPath)) {
         warnings.push({
           fragmentIndex: frag.index,
           fragmentPath: frag.path,
@@ -264,8 +272,12 @@ function formatInspectOutput(result: InspectResult): string {
   return lines.join("\n") + "\n";
 }
 
-/** Reads a fragment file, returning its content or null if missing. */
-function readFragmentContent(resolvedPath: string): string | null {
+/** Reads a fragment, checking embedded prompts first for built-in fragments. */
+function readFragmentContent(fragPath: string, resolvedPath: string): string | null {
+  // Built-in fragments: check embedded prompts first (required for compiled binary)
+  if (!isAbsolute(fragPath) && fragPath in EMBEDDED_PROMPTS) {
+    return EMBEDDED_PROMPTS[fragPath];
+  }
   try {
     return readFileSync(resolvedPath, "utf8");
   } catch {
@@ -303,7 +315,7 @@ export function runInspectCommand(argv: string[], promptsDir: string): void {
   const fragmentContents = new Map<number, string | null>();
   if (verbose) {
     for (const frag of fragments) {
-      fragmentContents.set(frag.index, readFragmentContent(frag.resolvedPath));
+      fragmentContents.set(frag.index, readFragmentContent(frag.path, frag.resolvedPath));
     }
   }