claudenv 1.2.5 → 1.3.1

package/src/memory.js

@@ -0,0 +1,111 @@
+/**
+ * CLI: `claudenv memory init/index/show/edit`
+ *
+ * Owns the user-facing surface for the global ~/.claudenv/memories/ layout.
+ * Reuses regen-index for `index` so there's one canonical regeneration path.
+ */
+
+import { mkdir, readFile, writeFile, stat } from 'node:fs/promises';
+import { join, dirname, resolve } from 'node:path';
+import { spawnSync } from 'node:child_process';
+import {
+  claudenvHome,
+  memoriesDir,
+  globalDecisionsDir,
+  canonIndexPath,
+  userPrefsPath,
+  indexMdPath,
+} from './memory-paths.js';
+import { regenIndex } from './hooks/regen-index.js';
+
+/**
+ * `claudenv memory init` — create the global memory layout if absent.
+ * Idempotent; never overwrites existing files.
+ */
+export async function memoryInit() {
+  const created = [];
+  const skipped = [];
+
+  // Layout
+  const dirs = [
+    memoriesDir(),
+    globalDecisionsDir(),
+    join(memoriesDir(), 'canon'),
+    join(memoriesDir(), 'user'),
+  ];
+  for (const d of dirs) {
+    await mkdir(d, { recursive: true });
+  }
+
+  // Seed files
+  const seeds = [
+    {
+      path: indexMdPath(),
+      content:
+        '# claudenv memory — INDEX\n\n> Auto-generated by `claudenv memory index`. Hand-edits will be overwritten.\n\n## Recent decisions\n\n_No decisions yet — vibe-decisions will log here._\n',
+    },
+    {
+      path: canonIndexPath(),
+      content:
+        '# Личный канон. Добавляйте через: claudenv canon add <topic> <url> --why "<reason>"\n',
+    },
+    {
+      path: join(claudenvHome(), '.gitignore'),
+      content: 'sessions/\n*.log\n.log/\nkeys/private*\n*.local.*\n*.secret.*\n',
+    },
+  ];
+
+  for (const { path, content } of seeds) {
+    try {
+      await stat(path);
+      skipped.push(path);
+    } catch {
+      await mkdir(dirname(path), { recursive: true });
+      await writeFile(path, content, 'utf-8');
+      created.push(path);
+    }
+  }
+
+  return { created, skipped };
+}
+
+/**
+ * `claudenv memory index` — regenerate INDEX.md from current decisions + prefs.
+ */
+export async function memoryIndex({ cwd } = {}) {
+  return await regenIndex({ cwd: cwd || process.cwd() });
+}
+
+/**
+ * `claudenv memory show <relpath>` — print a file from memories/.
+ * Path is interpreted relative to ~/.claudenv/memories/.
+ */
+export async function memoryShow(relPath) {
+  if (!relPath) throw new Error('Usage: claudenv memory show <path>');
+  const full = resolve(memoriesDir(), relPath);
+  if (!full.startsWith(memoriesDir())) {
+    throw new Error('Path escapes memories root');
+  }
+  return await readFile(full, 'utf-8');
+}
+
+/**
+ * `claudenv memory edit <relpath>` — open a memory file in $EDITOR (or vi).
+ * Creates the file if missing.
+ */
+export async function memoryEdit(relPath) {
+  if (!relPath) throw new Error('Usage: claudenv memory edit <path>');
+  const full = resolve(memoriesDir(), relPath);
+  if (!full.startsWith(memoriesDir())) {
+    throw new Error('Path escapes memories root');
+  }
+  await mkdir(dirname(full), { recursive: true });
+  try {
+    await stat(full);
+  } catch {
+    await writeFile(full, '', 'utf-8');
+  }
+  const editor = process.env.EDITOR || 'vi';
+  const result = spawnSync(editor, [full], { stdio: 'inherit' });
+  return { path: full, exitCode: result.status ?? 0 };
+}

package/src/sources.js

@@ -0,0 +1,78 @@
+/**
+ * CLI: `claudenv source list|show`
+ *
+ * Connectors are knowledge records (params + provenance) stored in the ACTIVE
+ * workspace: ~/.claudenv/workspaces/<id>/memories/connectors/<name>.md.
+ *
+ * Records hold connection metadata and secret_refs (env-var NAMES) only.
+ * Actual secret values live in <project>/.env.local and must never appear here.
+ * The skill `source-connector` is the primary author; CLI is for listing and
+ * for the doctor leak-lint.
+ */
+
+import { readFile, readdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { workspaceConnectorsDir, activeWorkspaceId, parseFrontmatter } from './memory-paths.js';
+
+export async function listConnectors() {
+  const id = activeWorkspaceId();
+  if (!id) return { workspace: null, connectors: [] };
+  let files;
+  try {
+    files = (await readdir(workspaceConnectorsDir(id))).filter((f) => f.endsWith('.md'));
+  } catch {
+    return { workspace: id, connectors: [] };
+  }
+  const connectors = [];
+  for (const f of files) {
+    let fm = null;
+    try {
+      fm = parseFrontmatter(await readFile(join(workspaceConnectorsDir(id), f), 'utf-8'));
+    } catch { /* skip unreadable */ }
+    connectors.push({
+      name: (fm && fm.name) || f.replace(/\.md$/, ''),
+      type: (fm && fm.type) || '?',
+      status: (fm && fm.status) || '?',
+      host: (fm && fm.host) || '',
+    });
+  }
+  return { workspace: id, connectors };
+}
+
+export async function showConnector(name) {
+  const id = activeWorkspaceId();
+  if (!id) return null;
+  try {
+    return await readFile(join(workspaceConnectorsDir(id), `${name}.md`), 'utf-8');
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Heuristic leak scan for the doctor. Flags lines that look like a secret VALUE
+ * rather than a reference. Connector records should only carry env-var names.
+ *
+ * Returns an array of { line, reason } findings (empty = clean).
+ */
+export function scanForSecretLeaks(text) {
+  const findings = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const line = lines[i];
+    // secret_refs хранит ИМЕНА env-переменных по определению - не сканируем
+    if (/secret_refs/i.test(line)) continue;
+    // `password: <value>` / `token: <value>` with a non-placeholder, non-env value
+    const m = /\b(password|passwd|pwd|secret|token|api[_-]?key|access[_-]?key)\b\s*[:=]\s*(\S+)/i.exec(line);
+    if (m) {
+      // снять кавычки и хвостовую пунктуацию inline-структур ({ } , ; )
+      const val = m[2].replace(/['"]/g, '').replace(/[},;)]+$/, '');
+      const placeholder = /^(<.*>|\.\.\.|x+|\*+|null|none|env:|\$\{|secret_refs)/i.test(val);
+      const looksEnvName = /^[A-Z][A-Z0-9_]*$/.test(val) || /_(env|token|login|password)$/i.test(val);
+      if (!placeholder && !looksEnvName && val.length >= 6) {
+        findings.push({ line: i + 1, reason: `похоже на значение секрета: ${m[1]}` });
+      }
+    }
+  }
+  return findings;
+}

package/src/workspaces.js

@@ -0,0 +1,129 @@
+/**
+ * CLI: `claudenv workspace add|list|use|show`
+ *
+ * Workspaces are isolated per-company/context memory spaces under
+ * ~/.claudenv/workspaces/<id>/. Only the ACTIVE workspace is ever loaded -
+ * this is the isolation barrier that prevents access/context from one company
+ * leaking into another project on the same device.
+ *
+ * Secrets NEVER live here - they belong in <project>/.env.local (gitignored).
+ * Workspace memory holds connector metadata + provenance only.
+ */
+
+import { readFile, writeFile, mkdir, readdir, stat } from 'node:fs/promises';
+import {
+  workspacesDir,
+  workspaceDir,
+  workspaceManifestPath,
+  workspaceConnectorsDir,
+  workspaceContextDir,
+  activeWorkspaceFile,
+  activeWorkspaceId,
+} from './memory-paths.js';
+
+const SLUG_RE = /^[a-z0-9][a-z0-9_-]*$/;
+
+export function validateId(id) {
+  if (!id || !SLUG_RE.test(id)) {
+    throw new Error(`Invalid workspace id "${id}" - use lowercase letters, digits, - or _`);
+  }
+  return id;
+}
+
+/**
+ * Render a flat workspace.yaml. Minimal by design (human-editable), like canon.
+ */
+function renderManifest({ name, description, paths }) {
+  const lines = [];
+  lines.push(`name: ${name || ''}`);
+  lines.push(`description: ${description || ''}`);
+  lines.push('paths:');
+  for (const p of paths || []) lines.push(`  - ${p}`);
+  return lines.join('\n') + '\n';
+}
+
+/** Tolerant parser for the flat workspace.yaml above. */
+function parseManifest(text) {
+  const out = { name: '', description: '', paths: [] };
+  let inPaths = false;
+  for (const raw of text.split('\n')) {
+    const line = raw.replace(/\s+$/, '');
+    if (!line || line.startsWith('#')) continue;
+    const kv = /^([a-zA-Z_]+):\s*(.*)$/.exec(line);
+    if (kv && kv[1] === 'paths') { inPaths = true; continue; }
+    if (kv) {
+      inPaths = false;
+      if (kv[1] === 'name') out.name = kv[2];
+      else if (kv[1] === 'description') out.description = kv[2];
+      continue;
+    }
+    const item = /^\s+-\s+(.*)$/.exec(line);
+    if (item && inPaths) out.paths.push(item[1].trim());
+  }
+  return out;
+}
+
+export async function createWorkspace(id, { name, description, paths } = {}) {
+  validateId(id);
+  const dir = workspaceDir(id);
+  try {
+    await stat(dir);
+    throw new Error(`Workspace "${id}" already exists`);
+  } catch (e) {
+    if (e.code !== 'ENOENT') throw e;
+  }
+  await mkdir(workspaceConnectorsDir(id), { recursive: true });
+  await mkdir(workspaceContextDir(id), { recursive: true });
+  await writeFile(
+    workspaceManifestPath(id),
+    renderManifest({ name: name || id, description, paths }),
+    'utf-8'
+  );
+  // секреты сюда не кладём - явный gitignore на случай, если папку положат в git
+  await writeFile(workspaceDir(id) + '/.gitignore', '.env\n.env.local\n*.secret\n', 'utf-8');
+  return dir;
+}
+
+export async function listWorkspaces() {
+  let entries;
+  try {
+    entries = await readdir(workspacesDir(), { withFileTypes: true });
+  } catch {
+    return [];
+  }
+  const active = activeWorkspaceId();
+  const result = [];
+  for (const ent of entries) {
+    if (!ent.isDirectory()) continue;
+    let manifest = { name: ent.name, description: '', paths: [] };
+    try {
+      manifest = parseManifest(await readFile(workspaceManifestPath(ent.name), 'utf-8'));
+    } catch { /* нет манифеста - покажем по id */ }
+    result.push({ id: ent.name, active: ent.name === active, ...manifest });
+  }
+  return result;
+}
+
+export async function useWorkspace(id) {
+  validateId(id);
+  try {
+    await stat(workspaceDir(id));
+  } catch {
+    throw new Error(`Workspace "${id}" does not exist - create it with 'claudenv workspace add ${id}'`);
+  }
+  await writeFile(activeWorkspaceFile(), id + '\n', 'utf-8');
+  return id;
+}
+
+export async function showActive() {
+  const id = activeWorkspaceId();
+  if (!id) return null;
+  let manifest = { name: id, description: '', paths: [] };
+  try {
+    manifest = parseManifest(await readFile(workspaceManifestPath(id), 'utf-8'));
+  } catch { /* активный указан, но манифеста нет */ }
+  const source = process.env.CLAUDENV_WORKSPACE ? 'env CLAUDENV_WORKSPACE' : 'active-workspace file';
+  return { id, source, ...manifest };
+}
+
+export { parseManifest };

package/templates/connector-mssql.ejs

@@ -0,0 +1,62 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Коннектор к MSSQL: <%= name %> (host <%= host %>, db <%= database %>).
+Сгенерирован claudenv (skill source-connector).
+
+Креды читаются из .env.local (gitignored), НЕ хардкодятся:
+  <%= userEnv %>=<логин>
+  <%= passwordEnv %>=<пароль>
+
+Зависимости: pip install pymssql sqlalchemy pandas
+"""
+
+import os
+import sys
+from urllib.parse import quote_plus
+
+import pandas as pd
+from sqlalchemy import create_engine
+
+HOST = os.getenv("<%= name.toUpperCase().replace(/[^A-Z0-9]/g, '_') %>_HOST", "<%= host %>")
+PORT = os.getenv("<%= name.toUpperCase().replace(/[^A-Z0-9]/g, '_') %>_PORT", "<%= port || 1433 %>")
+DATABASE = os.getenv("<%= name.toUpperCase().replace(/[^A-Z0-9]/g, '_') %>_DB", "<%= database %>")
+
+
+def load_env_local(path=".env.local"):
+    env = {}
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as fh:
+            for line in fh:
+                line = line.strip()
+                if line and not line.startswith("#") and "=" in line:
+                    k, _, v = line.partition("=")
+                    env[k.strip()] = v.strip()
+    return env
+
+
+_env = load_env_local()
+USER = _env.get("<%= userEnv %>") or os.getenv("<%= userEnv %>")
+PASSWORD = _env.get("<%= passwordEnv %>") or os.getenv("<%= passwordEnv %>")
+
+if not USER or not PASSWORD:
+    sys.exit("Нет кред в .env.local: <%= userEnv %> / <%= passwordEnv %>")
+
+
+def engine():
+    # пароль экранируем - в нём могут быть спецсимволы (@ : ~ и т.п.)
+    url = f"mssql+pymssql://{quote_plus(USER)}:{quote_plus(PASSWORD)}@{HOST}:{PORT}/{DATABASE}"
+    return create_engine(url)
+
+
+def query(sql):
+    """Выполнить SELECT, вернуть DataFrame."""
+    return pd.read_sql(sql, engine())
+
+
+if __name__ == "__main__":
+    sql = sys.argv[1] if len(sys.argv) > 1 else "SELECT 1 AS ok"
+    df = query(sql)
+    print(f"Строк: {len(df)}")
+    with pd.option_context("display.max_columns", None, "display.width", 200):
+        print(df.head(20).to_string(index=False))

package/templates/connector-rest.ejs

@@ -0,0 +1,59 @@
+#!/usr/bin/env python3
+# -*- coding: utf-8 -*-
+"""
+Коннектор к REST API: <%= name %> (base <%= host %>).
+Сгенерирован claudenv (skill source-connector).
+
+Токен читается из .env.local (gitignored), НЕ хардкодится:
+  <%= tokenEnv %>=<токен>
+
+Зависимости: pip install requests
+"""
+
+import os
+import sys
+
+import requests
+
+BASE = os.getenv("<%= name.toUpperCase().replace(/[^A-Z0-9]/g, '_') %>_BASE", "<%= host %>")
+
+
+def load_env_local(path=".env.local"):
+    env = {}
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as fh:
+            for line in fh:
+                line = line.strip()
+                if line and not line.startswith("#") and "=" in line:
+                    k, _, v = line.partition("=")
+                    env[k.strip()] = v.strip()
+    return env
+
+
+_env = load_env_local()
+TOKEN = _env.get("<%= tokenEnv %>") or os.getenv("<%= tokenEnv %>")
+
+if not TOKEN:
+    sys.exit("Нет токена в .env.local: <%= tokenEnv %>")
+
+
+def client():
+    s = requests.Session()
+    s.headers.update({
+        "Authorization": f"Bearer {TOKEN}",
+        "Accept": "application/json",
+    })
+    return s
+
+
+def get(path, **params):
+    """GET к API, вернуть JSON. path - относительный (/api/...)."""
+    r = client().get(f"{BASE}{path}", params=params, timeout=30)
+    r.raise_for_status()
+    return r.json()
+
+
+if __name__ == "__main__":
+    path = sys.argv[1] if len(sys.argv) > 1 else "/"
+    import json
+    print(json.dumps(get(path), ensure_ascii=False, indent=2)[:2000])