commandmate 0.1.7 → 0.1.8

package/dist/cli/commands/start.d.ts

@@ -1,11 +1,13 @@
 /**
  * Start Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getEnvPath and getPidFilePath for correct path resolution
  * Start CommandMate server
  */
 import { StartOptions } from '../types';
 /**
  * Execute start command
+ * Issue #125: Use getEnvPath and getPidFilePath for correct path resolution
  */
 export declare function startCommand(options: StartOptions): Promise<void>;
 //# sourceMappingURL=start.d.ts.map

package/dist/cli/commands/start.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAKH,OAAO,EAAE,YAAY,EAAY,MAAM,UAAU,CAAC;AASlD;;GAEG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAuHvE"}
+{"version":3,"file":"start.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/start.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,YAAY,EAA6B,MAAM,UAAU,CAAC;AASnE;;;GAGG;AACH,wBAAsB,YAAY,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,IAAI,CAAC,CAyHvE"}

package/dist/cli/commands/start.js

@@ -2,34 +2,36 @@
 /**
  * Start Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getEnvPath and getPidFilePath for correct path resolution
  * Start CommandMate server
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.startCommand = startCommand;
 const fs_1 = require("fs");
 const child_process_1 = require("child_process");
-const path_1 = require("path");
 const types_1 = require("../types");
 const logger_1 = require("../utils/logger");
 const daemon_1 = require("../utils/daemon");
 const security_logger_1 = require("../utils/security-logger");
 const paths_1 = require("../utils/paths");
+const env_setup_1 = require("../utils/env-setup");
 const logger = new logger_1.CLILogger();
-const PID_FILE = (0, path_1.join)(process.cwd(), '.commandmate.pid');
 /**
  * Execute start command
+ * Issue #125: Use getEnvPath and getPidFilePath for correct path resolution
  */
 async function startCommand(options) {
     try {
-        // Check for .env file
-        const envPath = (0, path_1.join)(process.cwd(), '.env');
+        // Issue #125: Check for .env file at correct location
+        const envPath = (0, env_setup_1.getEnvPath)();
+        const pidFilePath = (0, env_setup_1.getPidFilePath)();
         if (!(0, fs_1.existsSync)(envPath)) {
-            logger.error('.env file not found');
+            logger.error(`.env file not found at ${envPath}`);
             logger.info('Run "commandmate init" to create a configuration file');
             process.exit(types_1.ExitCode.CONFIG_ERROR);
             return;
         }
-        const daemonManager = new daemon_1.DaemonManager(PID_FILE);
+        const daemonManager = new daemon_1.DaemonManager(pidFilePath);
         // Daemon mode
         if (options.daemon) {
             // Check if already running
@@ -59,7 +61,7 @@ async function startCommand(options) {
                 process.exit(types_1.ExitCode.SUCCESS);
             }
             catch (error) {
-                const message = error instanceof Error ? error.message : String(error);
+                const message = (0, types_1.getErrorMessage)(error);
                 logger.error(`Failed to start daemon: ${message}`);
                 (0, security_logger_1.logSecurityEvent)({
                     timestamp: new Date().toISOString(),
@@ -107,7 +109,7 @@ async function startCommand(options) {
         });
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = (0, types_1.getErrorMessage)(error);
         logger.error(`Start failed: ${message}`);
         (0, security_logger_1.logSecurityEvent)({
             timestamp: new Date().toISOString(),

package/dist/cli/commands/status.d.ts

@@ -1,10 +1,12 @@
 /**
  * Status Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getPidFilePath and load .env for correct settings display
  * Display CommandMate server status
  */
 /**
  * Execute status command
+ * Issue #125: Use getPidFilePath and load .env for correct settings display
  */
 export declare function statusCommand(): Promise<void>;
 //# sourceMappingURL=status.d.ts.map

package/dist/cli/commands/status.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAUH;;GAEG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CA6CnD"}
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/status.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAUH;;;GAGG;AACH,wBAAsB,aAAa,IAAI,OAAO,CAAC,IAAI,CAAC,CAoDnD"}

package/dist/cli/commands/status.js

@@ -2,22 +2,29 @@
 /**
  * Status Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getPidFilePath and load .env for correct settings display
  * Display CommandMate server status
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.statusCommand = statusCommand;
-const path_1 = require("path");
+const dotenv_1 = require("dotenv");
 const types_1 = require("../types");
 const logger_1 = require("../utils/logger");
 const daemon_1 = require("../utils/daemon");
+const env_setup_1 = require("../utils/env-setup");
 const logger = new logger_1.CLILogger();
-const PID_FILE = (0, path_1.join)(process.cwd(), '.commandmate.pid');
 /**
  * Execute status command
+ * Issue #125: Use getPidFilePath and load .env for correct settings display
  */
 async function statusCommand() {
     try {
-        const daemonManager = new daemon_1.DaemonManager(PID_FILE);
+        // Issue #125: Get PID file path and load .env for correct settings
+        const pidFilePath = (0, env_setup_1.getPidFilePath)();
+        const envPath = (0, env_setup_1.getEnvPath)();
+        // Load .env so getStatus() can access correct CM_PORT and CM_BIND values
+        (0, dotenv_1.config)({ path: envPath });
+        const daemonManager = new daemon_1.DaemonManager(pidFilePath);
         const status = await daemonManager.getStatus();
         console.log('');
         console.log('CommandMate Status');
@@ -48,7 +55,7 @@ async function statusCommand() {
         process.exit(types_1.ExitCode.SUCCESS);
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = (0, types_1.getErrorMessage)(error);
         logger.error(`Status check failed: ${message}`);
         process.exit(types_1.ExitCode.UNEXPECTED_ERROR);
     }

package/dist/cli/commands/stop.d.ts

@@ -1,11 +1,13 @@
 /**
  * Stop Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getPidFilePath for correct path resolution
  * Stop CommandMate server
  */
 import { StopOptions } from '../types';
 /**
  * Execute stop command
+ * Issue #125: Use getPidFilePath for correct path resolution
  */
 export declare function stopCommand(options: StopOptions): Promise<void>;
 //# sourceMappingURL=stop.d.ts.map

package/dist/cli/commands/stop.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,WAAW,EAAY,MAAM,UAAU,CAAC;AAQjD;;GAEG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAuErE"}
+{"version":3,"file":"stop.d.ts","sourceRoot":"","sources":["../../../src/cli/commands/stop.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,WAAW,EAA6B,MAAM,UAAU,CAAC;AAQlE;;;GAGG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAyErE"}

package/dist/cli/commands/stop.js

@@ -2,23 +2,26 @@
 /**
  * Stop Command
  * Issue #96: npm install CLI support
+ * Issue #125: Use getPidFilePath for correct path resolution
  * Stop CommandMate server
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.stopCommand = stopCommand;
-const path_1 = require("path");
 const types_1 = require("../types");
 const logger_1 = require("../utils/logger");
 const daemon_1 = require("../utils/daemon");
 const security_logger_1 = require("../utils/security-logger");
+const env_setup_1 = require("../utils/env-setup");
 const logger = new logger_1.CLILogger();
-const PID_FILE = (0, path_1.join)(process.cwd(), '.commandmate.pid');
 /**
  * Execute stop command
+ * Issue #125: Use getPidFilePath for correct path resolution
  */
 async function stopCommand(options) {
     try {
-        const daemonManager = new daemon_1.DaemonManager(PID_FILE);
+        // Issue #125: Get PID file path from correct location
+        const pidFilePath = (0, env_setup_1.getPidFilePath)();
+        const daemonManager = new daemon_1.DaemonManager(pidFilePath);
         // Check if running
         if (!(await daemonManager.isRunning())) {
             const status = await daemonManager.getStatus();
@@ -69,7 +72,7 @@ async function stopCommand(options) {
         }
     }
     catch (error) {
-        const message = error instanceof Error ? error.message : String(error);
+        const message = (0, types_1.getErrorMessage)(error);
         logger.error(`Stop failed: ${message}`);
         (0, security_logger_1.logSecurityEvent)({
             timestamp: new Date().toISOString(),

package/dist/cli/types/index.d.ts

@@ -139,4 +139,12 @@ export interface ConfirmOptions {
     /** Default value if user presses Enter (true = Y, false = N) */
     default?: boolean;
 }
+/**
+ * Extract error message from unknown error
+ * Issue #125: DRY - centralized error message extraction
+ *
+ * @param error - Unknown error object
+ * @returns Error message string
+ */
+export declare function getErrorMessage(error: unknown): string;
 //# sourceMappingURL=index.d.ts.map

package/dist/cli/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,oBAAY,QAAQ;IAClB,OAAO,IAAI;IACX,gBAAgB,IAAI;IACpB,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,gBAAgB,KAAK;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB,CAAC;IAC9C,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/cli/types/index.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH;;;GAGG;AACH,oBAAY,QAAQ;IAClB,OAAO,IAAI;IACX,gBAAgB,IAAI;IACpB,YAAY,IAAI;IAChB,YAAY,IAAI;IAChB,WAAW,IAAI;IACf,gBAAgB,KAAK;CACtB;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2CAA2C;IAC3C,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,uCAAuC;IACvC,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,gCAAgC;IAChC,GAAG,CAAC,EAAE,OAAO,CAAC;IACd,wBAAwB;IACxB,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,2BAA2B;IAC3B,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;GAEG;AACH,MAAM,WAAW,WAAW;IAC1B,2BAA2B;IAC3B,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,YAAY;IAC3B,oCAAoC;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,8BAA8B;IAC9B,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,+BAA+B;IAC/B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,qCAAqC;IACrC,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,mBAAmB;IACnB,IAAI,EAAE,MAAM,CAAC;IACb,uBAAuB;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,8BAA8B;IAC9B,UAAU,EAAE,MAAM,CAAC;IACnB,0CAA0C;IAC1C,QAAQ,EAAE,OAAO,CAAC;IAClB,iCAAiC;IACjC,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,sBAAsB;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mBAAmB;IACnB,MAAM,EAAE,IAAI,GAAG,SAAS,GAAG,kBAAkB,CAAC;IAC9C,sCAAsC;IACtC,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,sDAAsD;IACtD,OAAO,EAAE,OAAO,CAAC;IACjB,oCAAoC;IACpC,OAAO,EAAE,gBAAgB,EAAE,CAAC;CAC7B;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;CACvB;AAED;;GAEG;AACH,MAAM,WAAW,eAAe;IAC9B,oCAAoC;IACpC,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,kDAAkD;IAClD,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;GAEG;AACH,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;GAGG;AACH,MAAM,WAAW,aAAa;IAC5B,0CAA0C;IAC1C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,mEAAmE;IACnE,QAAQ,CAAC,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CAC7C;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,gEAAgE;IAChE,OAAO,CAAC,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAKtD"}

package/dist/cli/types/index.js

@@ -5,6 +5,7 @@
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.ExitCode = void 0;
+exports.getErrorMessage = getErrorMessage;
 /**
  * Exit codes for CLI commands
  * NTH-4: DRY - centralized exit code definitions
@@ -18,3 +19,16 @@ var ExitCode;
     ExitCode[ExitCode["STOP_FAILED"] = 4] = "STOP_FAILED";
     ExitCode[ExitCode["UNEXPECTED_ERROR"] = 99] = "UNEXPECTED_ERROR";
 })(ExitCode || (exports.ExitCode = ExitCode = {}));
+/**
+ * Extract error message from unknown error
+ * Issue #125: DRY - centralized error message extraction
+ *
+ * @param error - Unknown error object
+ * @returns Error message string
+ */
+function getErrorMessage(error) {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}

package/dist/cli/utils/daemon.d.ts

@@ -1,6 +1,7 @@
 /**
  * Daemon Process Manager
  * Issue #96: npm install CLI support
+ * Issue #125: Added .env loading and security warnings
  * SF-1: SRP - Process management only (PID handling delegated to PidManager)
  */
 import { DaemonStatus, StartOptions } from '../types';
@@ -9,9 +10,11 @@ import { DaemonStatus, StartOptions } from '../types';
  */
 export declare class DaemonManager {
     private pidManager;
+    private logger;
     constructor(pidFilePath: string);
     /**
      * Start daemon process
+     * Issue #125: Load .env file and add security warnings
      * @returns Process ID of the started daemon
      * @throws Error if already running
      */

package/dist/cli/utils/daemon.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/daemon.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAItD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAa;gBAEnB,WAAW,EAAE,MAAM;IAI/B;;;;OAIG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA8CnD;;;;OAIG;IACG,IAAI,CAAC,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BpD;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA6B/C;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAInC;;OAEG;YACW,WAAW;CAiB1B"}
+{"version":3,"file":"daemon.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/daemon.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAIH,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAMtD;;GAEG;AACH,qBAAa,aAAa;IACxB,OAAO,CAAC,UAAU,CAAa;IAC/B,OAAO,CAAC,MAAM,CAAY;gBAEd,WAAW,EAAE,MAAM;IAK/B;;;;;OAKG;IACG,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC;IA8EnD;;;;OAIG;IACG,IAAI,CAAC,KAAK,GAAE,OAAe,GAAG,OAAO,CAAC,OAAO,CAAC;IA8BpD;;;OAGG;IACG,SAAS,IAAI,OAAO,CAAC,YAAY,GAAG,IAAI,CAAC;IA6B/C;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,OAAO,CAAC;IAInC;;OAEG;YACW,WAAW;CAiB1B"}

package/dist/cli/utils/daemon.js

@@ -2,23 +2,30 @@
 /**
  * Daemon Process Manager
  * Issue #96: npm install CLI support
+ * Issue #125: Added .env loading and security warnings
  * SF-1: SRP - Process management only (PID handling delegated to PidManager)
  */
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.DaemonManager = void 0;
 const child_process_1 = require("child_process");
+const dotenv_1 = require("dotenv");
 const pid_manager_1 = require("./pid-manager");
 const paths_1 = require("./paths");
+const env_setup_1 = require("./env-setup");
+const logger_1 = require("./logger");
 /**
  * Daemon manager for background server process
  */
 class DaemonManager {
     pidManager;
+    logger;
     constructor(pidFilePath) {
         this.pidManager = new pid_manager_1.PidManager(pidFilePath);
+        this.logger = new logger_1.CLILogger();
     }
     /**
      * Start daemon process
+     * Issue #125: Load .env file and add security warnings
      * @returns Process ID of the started daemon
      * @throws Error if already running
      */
@@ -32,11 +39,36 @@ class DaemonManager {
         const npmScript = options.dev ? 'dev' : 'start';
         // Use package installation directory, not current working directory
         const packageRoot = (0, paths_1.getPackageRoot)();
-        // Build environment
-        const env = { ...process.env };
+        // Issue #125: Load .env file from correct location
+        const envPath = (0, env_setup_1.getEnvPath)();
+        const envResult = (0, dotenv_1.config)({ path: envPath });
+        // Handle .env loading errors with fallback (Stage 2 review: MF-2)
+        if (envResult.error) {
+            this.logger.warn(`Failed to load .env file at ${envPath}: ${envResult.error.message}`);
+            this.logger.info('Continuing with existing environment variables');
+        }
+        // Build environment by merging process.env with .env values
+        const env = {
+            ...process.env,
+            ...(envResult.parsed || {}),
+        };
+        // Command line options override .env values
         if (options.port) {
             env.CM_PORT = String(options.port);
         }
+        // Issue #125: Security warnings for external access (Stage 4 review: MF-2)
+        const bindAddress = env.CM_BIND || '127.0.0.1';
+        const authToken = env.CM_AUTH_TOKEN;
+        const port = env.CM_PORT || '3000';
+        if (bindAddress === '0.0.0.0') {
+            this.logger.warn('WARNING: Server is accessible from external networks (CM_BIND=0.0.0.0)');
+            if (!authToken) {
+                this.logger.warn('SECURITY WARNING: No authentication token configured. External access is not recommended without CM_AUTH_TOKEN.');
+                this.logger.info('Run "commandmate init" to configure a secure authentication token.');
+            }
+        }
+        // Log startup with accurate settings (Stage 4 review: MF-2)
+        this.logger.info(`Starting server at http://${bindAddress}:${port}`);
         // Spawn detached process
         const child = (0, child_process_1.spawn)('npm', ['run', npmScript], {
             cwd: packageRoot,

package/dist/cli/utils/env-setup.d.ts

@@ -33,13 +33,31 @@ export declare function isGlobalInstall(): boolean;
  * @returns Path to .env file
  */
 export declare function getEnvPath(): string;
+/**
+ * Resolve path securely by resolving symlinks and verifying within allowed directory
+ * Issue #125: Path traversal protection (OWASP A01:2021 - Broken Access Control)
+ *
+ * @param targetPath - The path to resolve and verify
+ * @param allowedBaseDir - The base directory that targetPath must be within
+ * @returns The resolved real path
+ * @throws Error if path resolves outside allowed directory
+ */
+export declare function resolveSecurePath(targetPath: string, allowedBaseDir: string): string;
 /**
  * Get the config directory path
  * Issue #119: Returns ~/.commandmate for global, cwd for local
+ * Issue #125: Added symlink resolution for security (path traversal protection)
  *
- * @returns Path to config directory
+ * @returns Path to config directory (absolute, with symlinks resolved)
  */
 export declare function getConfigDir(): string;
+/**
+ * Get the PID file path based on install type
+ * Issue #125: DRY principle - centralized PID file path resolution
+ *
+ * @returns Path to PID file (uses getConfigDir for consistency)
+ */
+export declare function getPidFilePath(): string;
 /**
  * Sanitize input by removing control characters
  * SF-SEC-3: Input sanitization

package/dist/cli/utils/env-setup.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"env-setup.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/env-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAYH,OAAO,EACL,SAAS,EACT,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAYzC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAcnC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAKrC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACG,aAAa,CACjB,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC;IAiChB;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY9C;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB;CAoCpD"}
+{"version":3,"file":"env-setup.d.ts","sourceRoot":"","sources":["../../../src/cli/utils/env-setup.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAaH,OAAO,EACL,SAAS,EACT,eAAe,EACf,gBAAgB,EACjB,MAAM,UAAU,CAAC;AAElB;;;GAGG;AACH,eAAO,MAAM,YAAY;;;;;;CAMf,CAAC;AAEX;;GAEG;AACH,eAAO,MAAM,gBAAgB,QAA2B,CAAC;AAEzD;;;;;GAKG;AACH,wBAAgB,eAAe,IAAI,OAAO,CAYzC;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,IAAI,MAAM,CAcnC;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,MAAM,CASpF;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,IAAI,MAAM,CAqBrC;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAED;;;GAGG;AACH,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAGlD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAMlD;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAUpD;AAED;;GAEG;AACH,qBAAa,QAAQ;IACnB,OAAO,CAAC,OAAO,CAAS;gBAEZ,OAAO,CAAC,EAAE,MAAM;IAI5B;;;OAGG;IACG,aAAa,CACjB,MAAM,EAAE,SAAS,EACjB,OAAO,GAAE,eAAoB,GAC5B,OAAO,CAAC,IAAI,CAAC;IAiChB;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAY9C;;OAEG;IACH,iBAAiB,IAAI,MAAM;IAI3B;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,SAAS,GAAG,gBAAgB;CAoCpD"}

package/dist/cli/utils/env-setup.js

@@ -8,7 +8,9 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.EnvSetup = exports.DEFAULT_ROOT_DIR = exports.ENV_DEFAULTS = void 0;
 exports.isGlobalInstall = isGlobalInstall;
 exports.getEnvPath = getEnvPath;
+exports.resolveSecurePath = resolveSecurePath;
 exports.getConfigDir = getConfigDir;
+exports.getPidFilePath = getPidFilePath;
 exports.sanitizeInput = sanitizeInput;
 exports.sanitizePath = sanitizePath;
 exports.validatePort = validatePort;
@@ -67,17 +69,57 @@ function getEnvPath() {
     // Local install - use current working directory
     return (0, path_1.join)(process.cwd(), '.env');
 }
+/**
+ * Resolve path securely by resolving symlinks and verifying within allowed directory
+ * Issue #125: Path traversal protection (OWASP A01:2021 - Broken Access Control)
+ *
+ * @param targetPath - The path to resolve and verify
+ * @param allowedBaseDir - The base directory that targetPath must be within
+ * @returns The resolved real path
+ * @throws Error if path resolves outside allowed directory
+ */
+function resolveSecurePath(targetPath, allowedBaseDir) {
+    const realPath = (0, fs_1.realpathSync)(targetPath);
+    const realBaseDir = (0, fs_1.realpathSync)(allowedBaseDir);
+    if (!realPath.startsWith(realBaseDir)) {
+        throw new Error(`Path traversal detected: ${targetPath} resolves outside of ${allowedBaseDir}`);
+    }
+    return realPath;
+}
 /**
  * Get the config directory path
  * Issue #119: Returns ~/.commandmate for global, cwd for local
+ * Issue #125: Added symlink resolution for security (path traversal protection)
  *
- * @returns Path to config directory
+ * @returns Path to config directory (absolute, with symlinks resolved)
  */
 function getConfigDir() {
     if (isGlobalInstall()) {
-        return (0, path_1.join)((0, os_1.homedir)(), '.commandmate');
+        const configDir = (0, path_1.join)((0, os_1.homedir)(), '.commandmate');
+        // Verify config directory is within home directory (security check)
+        // Only validate if the directory exists (it may not exist yet during init)
+        if ((0, fs_1.existsSync)(configDir)) {
+            const realPath = (0, fs_1.realpathSync)(configDir);
+            const realHome = (0, fs_1.realpathSync)((0, os_1.homedir)());
+            if (!realPath.startsWith(realHome)) {
+                throw new Error(`Security error: Config directory ${configDir} is outside home directory`);
+            }
+            return realPath;
+        }
+        return configDir;
     }
-    return process.cwd();
+    // Local install - resolve symlinks in cwd
+    const cwd = process.cwd();
+    return (0, fs_1.realpathSync)(cwd);
+}
+/**
+ * Get the PID file path based on install type
+ * Issue #125: DRY principle - centralized PID file path resolution
+ *
+ * @returns Path to PID file (uses getConfigDir for consistency)
+ */
+function getPidFilePath() {
+    return (0, path_1.join)(getConfigDir(), '.commandmate.pid');
 }
 /**
  * Sanitize input by removing control characters

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "commandmate",
-  "version": "0.1.7",
+  "version": "0.1.8",
   "description": "Git worktree management with Claude CLI and tmux sessions",
   "repository": {
     "type": "git",
@@ -41,6 +41,7 @@
     "better-sqlite3": "^12.4.1",
     "commander": "^14.0.2",
     "date-fns": "^4.1.0",
+    "dotenv": "^17.2.3",
     "gray-matter": "^4.0.3",
     "http-proxy": "^1.18.1",
     "isomorphic-dompurify": "^2.35.0",