cli-jaw 0.1.0

package/dist/src/routes/browser.js

@@ -0,0 +1,126 @@
+import * as browser from '../browser/index.js';
+import { ok } from '../http/response.js';
+import { settings } from '../core/config.js';
+const cdpPort = () => settings.browser?.cdpPort || 9240;
+export function registerBrowserRoutes(app) {
+    app.post('/api/browser/start', async (req, res) => {
+        try {
+            await browser.launchChrome(req.body?.port || cdpPort());
+            res.json(await browser.getBrowserStatus(cdpPort()));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/stop', async (_, res) => {
+        try {
+            await browser.closeBrowser();
+            res.json({ ok: true });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.get('/api/browser/status', async (_, res) => {
+        try {
+            res.json(await browser.getBrowserStatus(cdpPort()));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.get('/api/browser/snapshot', async (req, res) => {
+        try {
+            res.json({
+                nodes: await browser.snapshot(cdpPort(), {
+                    interactive: req.query.interactive === 'true',
+                })
+            });
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/screenshot', async (req, res) => {
+        try {
+            res.json(await browser.screenshot(cdpPort(), req.body));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/act', async (req, res) => {
+        try {
+            const { kind, ref, text, key, submit, doubleClick, x, y } = req.body;
+            let result;
+            switch (kind) {
+                case 'click':
+                    result = await browser.click(cdpPort(), ref, { doubleClick });
+                    break;
+                case 'mouse-click':
+                    result = await browser.mouseClick(cdpPort(), x, y, { doubleClick });
+                    break;
+                case 'type':
+                    result = await browser.type(cdpPort(), ref, text, { submit });
+                    break;
+                case 'press':
+                    result = await browser.press(cdpPort(), key);
+                    break;
+                case 'hover':
+                    result = await browser.hover(cdpPort(), ref);
+                    break;
+                default: return res.status(400).json({ error: `unknown action: ${kind}` });
+            }
+            res.json(result);
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/vision-click', async (req, res) => {
+        try {
+            const { target, provider, doubleClick } = req.body;
+            if (!target)
+                return res.status(400).json({ error: 'target required' });
+            const result = await browser.visionClick(cdpPort(), target, { provider, doubleClick });
+            res.json(result);
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.post('/api/browser/navigate', async (req, res) => {
+        try {
+            res.json(await browser.navigate(cdpPort(), req.body.url));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.get('/api/browser/tabs', async (_, res) => {
+        try {
+            ok(res, { tabs: await browser.listTabs(cdpPort()) });
+        }
+        catch (e) {
+            console.warn('[browser:tabs] failed', { error: e.message });
+            ok(res, { tabs: [] });
+        }
+    });
+    app.post('/api/browser/evaluate', async (req, res) => {
+        try {
+            res.json(await browser.evaluate(cdpPort(), req.body.expression));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+    app.get('/api/browser/text', async (req, res) => {
+        try {
+            res.json(await browser.getPageText(cdpPort(), req.query.format));
+        }
+        catch (e) {
+            res.status(500).json({ error: e.message });
+        }
+    });
+}
+//# sourceMappingURL=browser.js.map

package/dist/src/routes/browser.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser.js","sourceRoot":"","sources":["../../../src/routes/browser.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,OAAO,MAAM,qBAAqB,CAAC;AAC/C,OAAO,EAAE,EAAE,EAAE,MAAM,qBAAqB,CAAC;AACzC,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,OAAO,GAAG,GAAG,EAAE,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;AAExD,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAC9C,GAAG,CAAC,IAAI,CAAC,oBAAoB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACjE,IAAI,CAAC;YACD,MAAM,OAAO,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YACxD,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAU,EAAE,GAAa,EAAE,EAAE;QAC9D,IAAI,CAAC;YAAC,MAAM,OAAO,CAAC,YAAY,EAAE,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,qBAAqB,EAAE,KAAK,EAAE,CAAU,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QAAC,CAAC;QAC5D,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACnE,IAAI,CAAC;YACD,GAAG,CAAC,IAAI,CAAC;gBACL,KAAK,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE;oBACrC,WAAW,EAAE,GAAG,CAAC,KAAK,CAAC,WAAW,KAAK,MAAM;iBAChD,CAAC;aACL,CAAC,CAAC;QACP,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,yBAAyB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACtE,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;QAChE,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,kBAAkB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC;YACD,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACrE,IAAI,MAAM,CAAC;YACX,QAAQ,IAAI,EAAE,CAAC;gBACX,KAAK,OAAO;oBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAAC,MAAM;gBACnF,KAAK,aAAa;oBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;oBAAC,MAAM;gBAC/F,KAAK,MAAM;oBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;oBAAC,MAAM;gBAClF,KAAK,OAAO;oBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAClE,KAAK,OAAO;oBAAE,MAAM,GAAG,MAAM,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAClE,OAAO,CAAC,CAAC,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,mBAAmB,IAAI,EAAE,EAAE,CAAC,CAAC;YAC/E,CAAC;YACD,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACnF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,2BAA2B,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACxE,IAAI,CAAC;YACD,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,GAAG,CAAC,IAAI,CAAC;YACnD,IAAI,CAAC,MAAM;gBAAE,OAAO,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,iBAAiB,EAAE,CAAC,CAAC;YACvE,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;YACvF,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrB,CAAC;QAAC,OAAO,CAAU,EAAE,CAAC;YAClB,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QAClE,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,CAAU,EAAE,GAAa,EAAE,EAAE;QAC7D,IAAI,CAAC;YAAC,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;QAC7D,OAAO,CAAU,EAAE,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;YAAC,EAAE,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAAC,CAAC;IACzH,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QACpE,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,QAAQ,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;QAAC,CAAC;QACzE,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;IAEH,GAAG,CAAC,GAAG,CAAC,mBAAmB,EAAE,KAAK,EAAE,GAAY,EAAE,GAAa,EAAE,EAAE;QAC/D,IAAI,CAAC;YAAC,GAAG,CAAC,IAAI,CAAC,MAAM,OAAO,CAAC,WAAW,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,KAAK,CAAC,MAA4B,CAAC,CAAC,CAAC;QAAC,CAAC;QAC/F,OAAO,CAAU,EAAE,CAAC;YAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAG,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;QAAC,CAAC;IACjF,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/src/routes/quota.js

@@ -0,0 +1,94 @@
+// ─── Quota / Usage readers (extracted from server.js) ─────
+import { execSync } from 'child_process';
+import fs from 'fs';
+import os from 'os';
+import { join } from 'path';
+export function readClaudeCreds() {
+    try {
+        const raw = execSync('security find-generic-password -s "Claude Code-credentials" -w', { timeout: 3000, stdio: ['pipe', 'pipe', 'pipe'] }).toString().trim();
+        const oauth = JSON.parse(raw)?.claudeAiOauth;
+        if (!oauth?.accessToken)
+            return null;
+        return {
+            token: oauth.accessToken,
+            account: { type: oauth.subscriptionType ?? 'unknown', tier: oauth.rateLimitTier ?? null },
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export function readCodexTokens() {
+    try {
+        const authPath = join(os.homedir(), '.codex', 'auth.json');
+        const j = JSON.parse(fs.readFileSync(authPath, 'utf8'));
+        if (j?.tokens?.access_token)
+            return { access_token: j.tokens.access_token, account_id: j.tokens.account_id ?? '' };
+    }
+    catch (e) {
+        console.debug('[quota:codex] token read failed', e.message);
+    }
+    return null;
+}
+export async function fetchClaudeUsage(creds) {
+    if (!creds?.token)
+        return null;
+    try {
+        const resp = await fetch('https://api.anthropic.com/api/oauth/usage', {
+            headers: { 'Authorization': `Bearer ${creds.token}`, 'anthropic-beta': 'oauth-2025-04-20' },
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!resp.ok)
+            return null;
+        const data = await resp.json();
+        const windows = [];
+        const labelMap = { five_hour: '5-hour', seven_day: '7-day', seven_day_sonnet: '7-day Sonnet', seven_day_opus: '7-day Opus' };
+        for (const [key, label] of Object.entries(labelMap)) {
+            if (data[key]?.utilization != null) {
+                windows.push({ label, percent: Math.round(data[key].utilization), resetsAt: data[key].resets_at ?? null });
+            }
+        }
+        return { account: creds.account, windows, raw: data };
+    }
+    catch {
+        return null;
+    }
+}
+export async function fetchCodexUsage(tokens) {
+    if (!tokens)
+        return null;
+    try {
+        const resp = await fetch('https://chatgpt.com/backend-api/wham/usage', {
+            headers: { 'Authorization': `Bearer ${tokens.access_token}`, 'ChatGPT-Account-Id': tokens.account_id ?? '' },
+            signal: AbortSignal.timeout(8000),
+        });
+        if (!resp.ok)
+            return null;
+        const data = await resp.json();
+        const account = { email: data.email ?? null, plan: data.plan_type ?? null };
+        const windows = [];
+        if (data.rate_limit?.primary_window) {
+            windows.push({ label: '5-hour', percent: data.rate_limit.primary_window.used_percent ?? 0, resetsAt: data.rate_limit.primary_window.reset_at ? new Date(data.rate_limit.primary_window.reset_at * 1000).toISOString() : null });
+        }
+        if (data.rate_limit?.secondary_window) {
+            windows.push({ label: '7-day', percent: data.rate_limit.secondary_window.used_percent ?? 0, resetsAt: data.rate_limit.secondary_window.reset_at ? new Date(data.rate_limit.secondary_window.reset_at * 1000).toISOString() : null });
+        }
+        return { account, windows, raw: data };
+    }
+    catch {
+        return null;
+    }
+}
+export function readGeminiAccount() {
+    try {
+        const credsPath = join(os.homedir(), '.gemini', 'oauth_creds.json');
+        const creds = JSON.parse(fs.readFileSync(credsPath, 'utf8'));
+        if (creds?.id_token) {
+            const payload = JSON.parse(Buffer.from(creds.id_token.split('.')[1], 'base64url').toString());
+            return { account: { email: payload.email ?? null }, windows: [] };
+        }
+    }
+    catch { /* expected: gemini creds may not exist */ }
+    return null;
+}
+//# sourceMappingURL=quota.js.map

package/dist/src/routes/quota.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"quota.js","sourceRoot":"","sources":["../../../src/routes/quota.ts"],"names":[],"mappings":"AAAA,6DAA6D;AAC7D,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAE5B,MAAM,UAAU,eAAe;IAC3B,IAAI,CAAC;QACD,MAAM,GAAG,GAAG,QAAQ,CAChB,gEAAgE,EAChE,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CACrD,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC;QAC7C,IAAI,CAAC,KAAK,EAAE,WAAW;YAAE,OAAO,IAAI,CAAC;QACrC,OAAO;YACH,KAAK,EAAE,KAAK,CAAC,WAAW;YACxB,OAAO,EAAE,EAAE,IAAI,EAAE,KAAK,CAAC,gBAAgB,IAAI,SAAS,EAAE,IAAI,EAAE,KAAK,CAAC,aAAa,IAAI,IAAI,EAAE;SAC5F,CAAC;IACN,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,eAAe;IAC3B,IAAI,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC;QAC3D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,MAAM,EAAE,YAAY;YAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,CAAC,YAAY,EAAE,UAAU,EAAE,CAAC,CAAC,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE,CAAC;IACvH,CAAC;IAAC,OAAO,CAAU,EAAE,CAAC;QAAC,OAAO,CAAC,KAAK,CAAC,iCAAiC,EAAG,CAAW,CAAC,OAAO,CAAC,CAAC;IAAC,CAAC;IAChG,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,KAAU;IAC7C,IAAI,CAAC,KAAK,EAAE,KAAK;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,2CAA2C,EAAE;YAClE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,KAAK,CAAC,KAAK,EAAE,EAAE,gBAAgB,EAAE,kBAAkB,EAAE;YAC3F,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyB,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,CAAC;QAC7H,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;YAClD,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,WAAW,IAAI,IAAI,EAAE,CAAC;gBACjC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC;YAC/G,CAAC;QACL,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAW;IAC7C,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IACzB,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,4CAA4C,EAAE;YACnE,OAAO,EAAE,EAAE,eAAe,EAAE,UAAU,MAAM,CAAC,YAAY,EAAE,EAAE,oBAAoB,EAAE,MAAM,CAAC,UAAU,IAAI,EAAE,EAAE;YAC5G,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC;SACpC,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAyB,CAAC;QACtD,MAAM,OAAO,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,IAAI,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC;QAC5E,MAAM,OAAO,GAAG,EAAE,CAAC;QACnB,IAAI,IAAI,CAAC,UAAU,EAAE,cAAc,EAAE,CAAC;YAClC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,YAAY,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,cAAc,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACpO,CAAC;QACD,IAAI,IAAI,CAAC,UAAU,EAAE,gBAAgB,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,YAAY,IAAI,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;QACzO,CAAC;QACD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC7B,IAAI,CAAC;QACD,MAAM,SAAS,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,kBAAkB,CAAC,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,KAAK,EAAE,QAAQ,EAAE,CAAC;YAClB,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC9F,OAAO,EAAE,OAAO,EAAE,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,IAAI,IAAI,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QACtE,CAAC;IACL,CAAC;IAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IACtD,OAAO,IAAI,CAAC;AAChB,CAAC"}

package/dist/src/security/decode.js

@@ -0,0 +1,23 @@
+// ─── Security: Filename Decode ───────────────────────
+// Phase 9.1 — percent-encoding 안전 디코딩
+/**
+ * x-filename 헤더 등의 percent-encoded 파일명을 안전하게 디코딩
+ * @param {string|null|undefined} rawHeader
+ * @returns {string} decoded filename
+ * @throws 400 filename_too_long / invalid_percent_encoding
+ */
+export function decodeFilenameSafe(rawHeader) {
+    const raw = String(rawHeader || '').trim();
+    if (!raw)
+        return 'upload.bin';
+    if (raw.length > 200) {
+        throw Object.assign(new Error('filename_too_long'), { statusCode: 400 });
+    }
+    try {
+        return decodeURIComponent(raw);
+    }
+    catch {
+        throw Object.assign(new Error('invalid_percent_encoding'), { statusCode: 400 });
+    }
+}
+//# sourceMappingURL=decode.js.map

package/dist/src/security/decode.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"decode.js","sourceRoot":"","sources":["../../../src/security/decode.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,sCAAsC;AAEtC;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAoC;IACnE,MAAM,GAAG,GAAG,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAC3C,IAAI,CAAC,GAAG;QAAE,OAAO,YAAY,CAAC;IAC9B,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QACnB,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,mBAAmB,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IAC7E,CAAC;IACD,IAAI,CAAC;QACD,OAAO,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,0BAA0B,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;IACpF,CAAC;AACL,CAAC"}

package/dist/src/security/path-guards.js

@@ -0,0 +1,62 @@
+// ─── Security: Path Guards ───────────────────────────
+// Phase 9.1 — path traversal, id injection, filename abuse 방어
+import path from 'node:path';
+const SKILL_ID_RE = /^[a-z0-9][a-z0-9._-]*$/;
+const FILE_NAME_RE = /^[a-zA-Z0-9][a-zA-Z0-9._-]*$/;
+function badRequest(code) {
+    return Object.assign(new Error(code), { statusCode: 400 });
+}
+function forbidden(code) {
+    return Object.assign(new Error(code), { statusCode: 403 });
+}
+/**
+ * Skill ID 검증 — 소문자 영숫자 + 하이픈/점/밑줄만 허용
+ * @param {string} id
+ * @returns {string} trimmed id
+ * @throws 400 invalid_skill_id / path_segment_denied
+ */
+export function assertSkillId(id) {
+    const v = String(id || '').trim();
+    if (!SKILL_ID_RE.test(v))
+        throw badRequest('invalid_skill_id');
+    if (v.includes('..') || v.includes('/') || v.includes('\\'))
+        throw badRequest('path_segment_denied');
+    return v;
+}
+/**
+ * 파일명 검증 — 영숫자 시작, 확장자 제한
+ * @param {string} filename
+ * @param {object} opts
+ * @param {string[]} opts.allowExt - 허용 확장자 배열 (기본: ['.md'])
+ * @returns {string} trimmed filename
+ * @throws 400 invalid_filename / invalid_extension
+ */
+export function assertFilename(filename, { allowExt = ['.md'] } = {}) {
+    const v = String(filename || '').trim();
+    if (!v || v.length > 200)
+        throw badRequest('invalid_filename');
+    if (!FILE_NAME_RE.test(v))
+        throw badRequest('invalid_filename');
+    if (v.includes('..') || v.includes('/') || v.includes('\\'))
+        throw badRequest('invalid_filename');
+    const ext = path.extname(v).toLowerCase();
+    if (allowExt.length && !allowExt.includes(ext))
+        throw badRequest('invalid_extension');
+    return v;
+}
+/**
+ * baseDir 아래로 안전하게 resolve — 탈출 시 403
+ * @param {string} baseDir
+ * @param {string} unsafeName
+ * @returns {string} resolved absolute path
+ * @throws 403 path_escape
+ */
+export function safeResolveUnder(baseDir, unsafeName) {
+    const base = path.resolve(baseDir);
+    const resolved = path.resolve(base, unsafeName);
+    const pref = base.endsWith(path.sep) ? base : base + path.sep;
+    if (resolved !== base && !resolved.startsWith(pref))
+        throw forbidden('path_escape');
+    return resolved;
+}
+//# sourceMappingURL=path-guards.js.map

package/dist/src/security/path-guards.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"path-guards.js","sourceRoot":"","sources":["../../../src/security/path-guards.ts"],"names":[],"mappings":"AAAA,wDAAwD;AACxD,8DAA8D;AAC9D,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,MAAM,WAAW,GAAG,wBAAwB,CAAC;AAC7C,MAAM,YAAY,GAAG,8BAA8B,CAAC;AAEpD,SAAS,UAAU,CAAC,IAAY;IAC5B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,IAAY;IAC3B,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAU;IACpC,MAAM,CAAC,GAAG,MAAM,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,UAAU,CAAC,qBAAqB,CAAC,CAAC;IACrG,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAAgB,EAAE,EAAE,QAAQ,GAAG,CAAC,KAAK,CAAC,KAA8B,EAAE;IACjG,MAAM,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACxC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,GAAG;QAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAC/D,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAChE,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC;QAAE,MAAM,UAAU,CAAC,kBAAkB,CAAC,CAAC;IAClG,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;IAC1C,IAAI,QAAQ,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,MAAM,UAAU,CAAC,mBAAmB,CAAC,CAAC;IACtF,OAAO,CAAC,CAAC;AACb,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,UAAkB;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC;IAC9D,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;IACpF,OAAO,QAAQ,CAAC;AACpB,CAAC"}