coolhand-cli 0.9.0 → 0.11.0

package/README.md

@@ -37,7 +37,7 @@ See [Session capture](./docs/session-capture.md) for capture logic, duplicate-av
 
 ## Wildcard (agent complaint box)
 
-When an agent is blocked because a capability does not exist in its environment, it can record the blocker and get back an unambiguous "stop and move on" response:
+When an agent is blocked — because a capability does not exist in its environment, or because a task would take too long to complete — it can record the blocker and get back an unambiguous "stop and move on" response:
 
 ```bash
 coolhand wildcard \
@@ -46,7 +46,7 @@ coolhand wildcard \
   --thinking "I attempted to connect to localhost:5432 but got connection refused. I checked for a running postgres process and found none. Without a live database I cannot apply or validate the migration."
 ```
 
-The command records the complaint as feedback tagged `creator_type: agent`, prints a terminal de-loop message, and exits `0` so the agent stops and moves on. The de-loop always fires — even if the feedback could not be recorded (not logged in or a server error) — because the missing capability is real regardless of whether the server was reachable, and a logged-out agent in a sandbox is exactly who this command is for. When recording fails the message says so plainly and a warning is logged, so the failure still surfaces without trapping the agent in the retry loop the command exists to break. When no API key is available, the feedback is saved locally to `~/.coolhand/pending/` and will be uploaded automatically the next time you run `coolhand login`.
+The command records the complaint as feedback tagged `creator_type: agent`, prints a terminal de-loop message, and exits `0` so the agent stops and moves on. The de-loop always fires — even if the feedback could not be recorded (not logged in or a server error) — because the blocker (a missing capability, or a task that would take too long) is real regardless of whether the server was reachable, and a logged-out agent in a sandbox is exactly who this command is for. When recording fails the message says so plainly and a warning is logged, so the failure still surfaces without trapping the agent in the retry loop the command exists to break. When no API key is available, the feedback is saved locally to `~/.coolhand/pending/` and will be uploaded automatically the next time you run `coolhand login`.
 
 Set `COOLHAND_AGENT_NAME` to avoid passing `--agent-name` on every call. Optional `--thinking` attaches the reasoning that led to the blocker; `--log-id` ties it to a specific LLM request log.
 
@@ -83,6 +83,8 @@ coolhand close-optimization opt-123 "Added the suggested index; verified query l
 | `coolhand list-workloads` | List workloads with optional search and pagination |
 | `coolhand get-workload` | Fetch a single workload by ID |
 | `coolhand update-workload` | Update a workload's name and/or description |
+| `coolhand search-templates` | List and search LLM request templates |
+| `coolhand get-template` | Fetch a single template by ID, with its prompt patterns |
 | `coolhand search-optimizations` | List and filter optimization records |
 | `coolhand get-optimization` | Fetch a single optimization by ID |
 | `coolhand update-optimization` | Update an optimization's fields |
@@ -91,7 +93,12 @@ coolhand close-optimization opt-123 "Added the suggested index; verified query l
 | `coolhand get-feedback` | Fetch a single feedback record by ID |
 | `coolhand fetch-log` | Fetch the input/output content of a single LLM request log |
 | `coolhand search-logs` | Search LLM request logs with flexible filters |
+| `coolhand search-referenced-files` | List a client's referenced files, aggregated and ranked by reference count |
+| `coolhand list-referenced-file-sessions` | List the raw sessions that referenced one exact file path |
 | `coolhand analyze-claude-sessions` | Submit Claude sessions for pattern and cost analysis |
+| `coolhand map-claude-projects` | Upload a file-tree map (names + metadata only) of every folder named "claude" |
+| `coolhand upload-client-file` | Upload a local file to Coolhand as a client file |
+| `coolhand sync-skills` | Upload locally-built Claude skills (SKILL.md files) to Coolhand as client files |
 | `coolhand wildcard` | Record an agent blocker and exit cleanly |
 
 See [docs/commands.md](./docs/commands.md) for full flag reference and usage notes.
@@ -99,6 +106,7 @@ See [docs/commands.md](./docs/commands.md) for full flag reference and usage not
 ## Security
 
 - The callback listener binds to `127.0.0.1` only — never reachable from the LAN.
+- The MITM proxy started by `coolhand claude`/`coolhand monitor` also binds to `127.0.0.1` only — never reachable from the LAN.
 - Tokens are delivered through a one-shot localhost redirect; subsequent calls to the listener get `410 Gone`.
 - CSRF protection: every login generates a random `state` value verified with `crypto.timingSafeEqual` before any token is accepted.
 - `~/.coolhand/config.json` is written atomically with mode `0o600`; the parent directory is `0o700`.
@@ -163,6 +171,7 @@ Located at `$HOME/.coolhand/config.json` (override with `COOLHAND_CONFIG_DIR` fo
 - [Auth Flow](./docs/auth-flow.md) — browser-callback sequence, state machine, timeout and error paths
 - [Configuration File](./docs/config-file.md) — full config schema, multi-client model, `COOLHAND_CONFIG_DIR` override
 - [Session Capture](./docs/session-capture.md) — session scanning, envelope format, deduplication, scope and limitations
+- [Skill Capture](./docs/skill-capture.md) — skill discovery, dedup, and incremental upload logic for `sync-skills`
 
 ## About Coolhand Labs
 

package/dist/api/last-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"last-sync.d.ts","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAmE1F"}
+{"version":3,"file":"last-sync.d.ts","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;;;;;;;;GAkBG;AACH,wBAAsB,aAAa,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC,CAmE1F"}

package/dist/api/last-sync.js

@@ -1,4 +1,5 @@
 import { loadConfig, getClient } from '../config.js';
+import { isAllowedBaseUrlScheme } from '../base-url.js';
 import { DEFAULT_BASE_URL } from '../types.js';
 /**
  * Ask the server for the timestamp of the most recent Claude Code log it already holds, so
@@ -37,7 +38,7 @@ export async function fetchLastSync(opts = {}) {
     let url;
     try {
         const parsedBaseUrl = new URL(baseUrl);
-        if (parsedBaseUrl.protocol !== 'http:' && parsedBaseUrl.protocol !== 'https:') {
+        if (!isAllowedBaseUrlScheme(parsedBaseUrl)) {
             return null;
         }
         const endpoint = new URL('/api/v2/llm_request_logs', parsedBaseUrl);

package/dist/api/last-sync.js.map

@@ -1 +1 @@
-{"version":3,"file":"last-sync.js","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B,EAAE;IAClE,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,aAAa,CAAC,QAAQ,KAAK,OAAO,IAAI,aAAa,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC9E,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;QACpE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAmC,CAAC,UAAU,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}
+{"version":3,"file":"last-sync.js","sourceRoot":"","sources":["../../src/api/last-sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AACrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AACxD,OAAO,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAE/C;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAA8B,EAAE;IAClE,IAAI,MAA0B,CAAC;IAC/B,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC7C,MAAM,GAAG,MAAM,EAAE,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACjE,OAAO,GAAG,MAAM,EAAE,QAAQ,IAAI,gBAAgB,CAAC;IACjD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,CAAC,sBAAsB,CAAC,aAAa,CAAC,EAAE,CAAC;YAC3C,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,0BAA0B,EAAE,aAAa,CAAC,CAAC;QACpE,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,oBAAoB,EAAE,aAAa,CAAC,CAAC;QAC/D,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,iBAAiB,CAAC,CAAC;QACrD,QAAQ,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QACtC,GAAG,GAAG,QAAQ,CAAC,QAAQ,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE;YACrB,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,EAAE;SAC7D,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;QAC5C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;QACZ,6EAA6E;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,8EAA8E;IAC9E,wCAAwC;IACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACvB,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAI,MAAmC,CAAC,UAAU,CAAC;IAClE,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,IAAI,CAAC,SAAS,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACpD,CAAC"}

package/dist/api/llm-reference-client.d.ts

@@ -0,0 +1,25 @@
+import { Coolhand } from 'coolhand-node';
+import { CliError } from '../errors.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchReferencedFiles`/`listReferencedFileSessions` require the private key —
+ * the public key used for LLM capture is write-only on this API and 401s here.
+ */
+export declare function getLlmReferenceClient(opts?: {
+    clientId?: string;
+}): Promise<Coolhand>;
+/**
+ * Maps an error thrown by `Coolhand#searchReferencedFiles`/`listReferencedFileSessions` to a
+ * `CliError` — a 401 means the stored private key was rejected (mirrors `log-client.ts`'s hint), a
+ * 504 means the query exceeded the backend's statement timeout and is retryable, not a bug. Any
+ * other status (e.g. 422 for an unrecognized filter or non-scalar param) surfaces the server's own
+ * message rather than swallowing it.
+ *
+ * Both endpoints can 504 — `searchReferencedFiles` on its GROUP BY aggregate, and
+ * `listReferencedFileSessions` on the pagination `COUNT(*)` for a very hot `file_path` — but they
+ * have different flags to retry with, so `timeoutHint` is caller-supplied (same shape as
+ * `mapFeedbackHttpError`'s `notFoundMessage`). Suggesting a flag the invoking command doesn't
+ * define would be a silent no-op: the arg parser accepts unknown flags without complaint.
+ */
+export declare function mapLlmReferenceHttpError(err: unknown, timeoutHint: string): CliError;
+//# sourceMappingURL=llm-reference-client.d.ts.map

package/dist/api/llm-reference-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-reference-client.d.ts","sourceRoot":"","sources":["../../src/api/llm-reference-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;;;;GAIG;AACH,wBAAsB,qBAAqB,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoB/F;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,wBAAwB,CAAC,GAAG,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,GAAG,QAAQ,CAkBpF"}

package/dist/api/llm-reference-client.js

@@ -0,0 +1,49 @@
+import { Coolhand, HttpError } from 'coolhand-node';
+import { CliError } from '../errors.js';
+import { loadConfig, resolveClient } from '../config.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchReferencedFiles`/`listReferencedFileSessions` require the private key —
+ * the public key used for LLM capture is write-only on this API and 401s here.
+ */
+export async function getLlmReferenceClient(opts = {}) {
+    const cfg = await loadConfig();
+    const client = await resolveClient(cfg, opts.clientId);
+    if (!client.private_key) {
+        throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+    }
+    try {
+        // Coolhand validates baseUrl in its constructor (https required; http only for localhost).
+        return new Coolhand({ apiKey: client.private_key, baseUrl: client.base_url, silent: true });
+    }
+    catch (err) {
+        throw new CliError('INVALID_BASE_URL', `Invalid base_url for client: ${client.base_url} (${err.message})`);
+    }
+}
+/**
+ * Maps an error thrown by `Coolhand#searchReferencedFiles`/`listReferencedFileSessions` to a
+ * `CliError` — a 401 means the stored private key was rejected (mirrors `log-client.ts`'s hint), a
+ * 504 means the query exceeded the backend's statement timeout and is retryable, not a bug. Any
+ * other status (e.g. 422 for an unrecognized filter or non-scalar param) surfaces the server's own
+ * message rather than swallowing it.
+ *
+ * Both endpoints can 504 — `searchReferencedFiles` on its GROUP BY aggregate, and
+ * `listReferencedFileSessions` on the pagination `COUNT(*)` for a very hot `file_path` — but they
+ * have different flags to retry with, so `timeoutHint` is caller-supplied (same shape as
+ * `mapFeedbackHttpError`'s `notFoundMessage`). Suggesting a flag the invoking command doesn't
+ * define would be a silent no-op: the arg parser accepts unknown flags without complaint.
+ */
+export function mapLlmReferenceHttpError(err, timeoutHint) {
+    if (err instanceof HttpError) {
+        if (err.status === 401) {
+            return new CliError('LLM_REFERENCE_ERROR', "The stored private key was rejected. Run 'coolhand login --scope private' to re-authenticate.");
+        }
+        if (err.status === 504) {
+            return new CliError('LLM_REFERENCE_ERROR', `Referenced file request timed out (504): the query exceeded the backend's statement ` +
+                `timeout. This is retryable — ${timeoutHint}.`);
+        }
+        return new CliError('LLM_REFERENCE_ERROR', `Referenced file request failed (${err.status}): ${err.message}`);
+    }
+    return new CliError('LLM_REFERENCE_ERROR', `Referenced file request failed: ${err.message}`);
+}
+//# sourceMappingURL=llm-reference-client.js.map

package/dist/api/llm-reference-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"llm-reference-client.js","sourceRoot":"","sources":["../../src/api/llm-reference-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAC,OAA8B,EAAE;IAC1E,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,2FAA2F;QAC3F,OAAO,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,gCAAgC,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAY,EAAE,WAAmB;IACxE,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,qBAAqB,EACrB,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,qBAAqB,EACrB,sFAAsF;gBACpF,gCAAgC,WAAW,GAAG,CACjD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,mCAAmC,GAAG,CAAC,MAAM,MAAM,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,qBAAqB,EAAE,mCAAoC,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1G,CAAC"}

package/dist/api/template-client.d.ts

@@ -0,0 +1,19 @@
+import { Coolhand } from 'coolhand-node';
+import { CliError } from '../errors.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchTemplates`/`getTemplate` require the private key — the public key used by
+ * `monitor`/`logRequest` is write-only on this API and will 401 here.
+ */
+export declare function getTemplateClient(opts?: {
+    clientId?: string;
+}): Promise<Coolhand>;
+/**
+ * Maps an error thrown by `Coolhand#searchTemplates`/`getTemplate` to a `CliError`.
+ *
+ * A `504` is not a crash: both endpoints aggregate `log_count` over `llm_request_logs` under a
+ * 10-second statement timeout, so a slow aggregate is expected and retryable. `timeoutHint` is the
+ * caller's advice for making the same call cheaper, which differs between list and show.
+ */
+export declare function mapTemplateHttpError(err: unknown, notFoundMessage: string, timeoutHint: string): CliError;
+//# sourceMappingURL=template-client.d.ts.map

package/dist/api/template-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-client.d.ts","sourceRoot":"","sources":["../../src/api/template-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAa,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAGxC;;;;GAIG;AACH,wBAAsB,iBAAiB,CAAC,IAAI,GAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CAoB3F;AAED;;;;;;GAMG;AACH,wBAAgB,oBAAoB,CAClC,GAAG,EAAE,OAAO,EACZ,eAAe,EAAE,MAAM,EACvB,WAAW,EAAE,MAAM,GAClB,QAAQ,CAsBV"}

package/dist/api/template-client.js

@@ -0,0 +1,47 @@
+import { Coolhand, HttpError } from 'coolhand-node';
+import { CliError } from '../errors.js';
+import { loadConfig, resolveClient } from '../config.js';
+/**
+ * Resolves the CLI's stored client and returns a `Coolhand` instance authenticated with its
+ * *private* key. `searchTemplates`/`getTemplate` require the private key — the public key used by
+ * `monitor`/`logRequest` is write-only on this API and will 401 here.
+ */
+export async function getTemplateClient(opts = {}) {
+    const cfg = await loadConfig();
+    const client = await resolveClient(cfg, opts.clientId);
+    if (!client.private_key) {
+        throw new CliError('NO_PRIVATE_KEY', "No private key configured. Run 'coolhand login --scope private' first.");
+    }
+    try {
+        // Coolhand validates baseUrl in its constructor (https required; http only for localhost).
+        return new Coolhand({ apiKey: client.private_key, baseUrl: client.base_url, silent: true });
+    }
+    catch (err) {
+        throw new CliError('INVALID_BASE_URL', `Invalid base_url for client: ${client.base_url} (${err.message})`);
+    }
+}
+/**
+ * Maps an error thrown by `Coolhand#searchTemplates`/`getTemplate` to a `CliError`.
+ *
+ * A `504` is not a crash: both endpoints aggregate `log_count` over `llm_request_logs` under a
+ * 10-second statement timeout, so a slow aggregate is expected and retryable. `timeoutHint` is the
+ * caller's advice for making the same call cheaper, which differs between list and show.
+ */
+export function mapTemplateHttpError(err, notFoundMessage, timeoutHint) {
+    if (err instanceof HttpError) {
+        if (err.status === 401) {
+            return new CliError('TEMPLATE_ERROR', "The stored private key was rejected. Run 'coolhand login --scope private' to re-authenticate.");
+        }
+        if (err.status === 404) {
+            return new CliError('TEMPLATE_ERROR', notFoundMessage);
+        }
+        if (err.status === 504) {
+            return new CliError('TEMPLATE_ERROR', `The server timed out counting logs (log_count) for this request. ${timeoutHint}`);
+        }
+        // coolhand-node already formats this as `Template request failed (<status>): <body>`;
+        // re-prefixing it here would print the status twice.
+        return new CliError('TEMPLATE_ERROR', err.message);
+    }
+    return new CliError('TEMPLATE_ERROR', `Template request failed: ${err.message}`);
+}
+//# sourceMappingURL=template-client.js.map

package/dist/api/template-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"template-client.js","sourceRoot":"","sources":["../../src/api/template-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AACpD,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAEzD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAA8B,EAAE;IACtE,MAAM,GAAG,GAAG,MAAM,UAAU,EAAE,CAAC;IAC/B,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IAEvD,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,IAAI,QAAQ,CAChB,gBAAgB,EAChB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IAED,IAAI,CAAC;QACH,2FAA2F;QAC3F,OAAO,IAAI,QAAQ,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC9F,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,QAAQ,CAChB,kBAAkB,EAClB,gCAAgC,MAAM,CAAC,QAAQ,KAAM,GAAa,CAAC,OAAO,GAAG,CAC9E,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,oBAAoB,CAClC,GAAY,EACZ,eAAuB,EACvB,WAAmB;IAEnB,IAAI,GAAG,YAAY,SAAS,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,gBAAgB,EAChB,+FAA+F,CAChG,CAAC;QACJ,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,eAAe,CAAC,CAAC;QACzD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;YACvB,OAAO,IAAI,QAAQ,CACjB,gBAAgB,EAChB,oEAAoE,WAAW,EAAE,CAClF,CAAC;QACJ,CAAC;QACD,sFAAsF;QACtF,qDAAqD;QACrD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,QAAQ,CAAC,gBAAgB,EAAE,4BAA6B,GAAa,CAAC,OAAO,EAAE,CAAC,CAAC;AAC9F,CAAC"}

package/dist/auth/open-browser.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAGtC,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA0BxF"}
+{"version":3,"file":"open-browser.d.ts","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAItC,UAAU,eAAe;IACvB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,OAAO,CAAC,EAAE,OAAO,KAAK,CAAC;CACxB;AAED,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CA4BxF"}

package/dist/auth/open-browser.js

@@ -1,5 +1,6 @@
 import { spawn } from 'child_process';
 import { logger } from '../logger.js';
+import { resolveWrapSpawn } from '../win-spawn.js';
 export async function openBrowser(url, deps = {}) {
     const platform = deps.platform ?? process.platform;
     const spawnFn = deps.spawnFn ?? spawn;
@@ -17,8 +18,9 @@ export async function openBrowser(url, deps = {}) {
         command = 'xdg-open';
         args = [url];
     }
+    const { cmd, spawnArgs, windowsVerbatimArguments } = resolveWrapSpawn(command, args, platform);
     try {
-        const child = spawnFn(command, args, { detached: true, stdio: 'ignore' });
+        const child = spawnFn(cmd, spawnArgs, { detached: true, stdio: 'ignore', windowsVerbatimArguments });
         child.on('error', (err) => {
             logger.warn(`Failed to open browser (${command}): ${err.message}. Open the URL manually.`);
         });

package/dist/auth/open-browser.js.map

@@ -1 +1 @@
-{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AAOtC,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QAC1E,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,MAAM,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,MAAO,GAAa,CAAC,OAAO,0BAA0B,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}
+{"version":3,"file":"open-browser.js","sourceRoot":"","sources":["../../src/auth/open-browser.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,gBAAgB,EAAE,MAAM,iBAAiB,CAAC;AAOnD,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,OAAwB,EAAE;IACvE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACnD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IAEtC,IAAI,OAAe,CAAC;IACpB,IAAI,IAAc,CAAC;IACnB,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC1B,OAAO,GAAG,MAAM,CAAC;QACjB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;SAAM,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChC,OAAO,GAAG,KAAK,CAAC;QAChB,IAAI,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACpC,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,UAAU,CAAC;QACrB,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACf,CAAC;IAED,MAAM,EAAE,GAAG,EAAE,SAAS,EAAE,wBAAwB,EAAE,GAAG,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IAE/F,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,wBAAwB,EAAE,CAAC,CAAC;QACrG,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACxB,MAAM,CAAC,IAAI,CAAC,2BAA2B,OAAO,MAAM,GAAG,CAAC,OAAO,0BAA0B,CAAC,CAAC;QAC7F,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,EAAE,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,6BAA6B,OAAO,MAAO,GAAa,CAAC,OAAO,0BAA0B,CAAC,CAAC;IAC1G,CAAC;AACH,CAAC"}

package/dist/base-url.d.ts

@@ -0,0 +1,7 @@
+/**
+ * Mirrors the scheme rule coolhand-node's `BaseService` enforces on `baseUrl`:
+ * https:// is always allowed; http:// only for localhost/127.0.0.1/[::1].
+ */
+export declare function isLoopbackHostname(hostname: string): boolean;
+export declare function isAllowedBaseUrlScheme(url: URL): boolean;
+//# sourceMappingURL=base-url.d.ts.map

package/dist/base-url.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-url.d.ts","sourceRoot":"","sources":["../src/base-url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAE5D;AAED,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,GAAG,GAAG,OAAO,CAKxD"}

package/dist/base-url.js

@@ -0,0 +1,14 @@
+/**
+ * Mirrors the scheme rule coolhand-node's `BaseService` enforces on `baseUrl`:
+ * https:// is always allowed; http:// only for localhost/127.0.0.1/[::1].
+ */
+export function isLoopbackHostname(hostname) {
+    return hostname === 'localhost' || hostname === '127.0.0.1' || hostname === '[::1]';
+}
+export function isAllowedBaseUrlScheme(url) {
+    if (url.protocol === 'https:') {
+        return true;
+    }
+    return url.protocol === 'http:' && isLoopbackHostname(url.hostname);
+}
+//# sourceMappingURL=base-url.js.map

package/dist/base-url.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"base-url.js","sourceRoot":"","sources":["../src/base-url.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAgB;IACjD,OAAO,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,OAAO,CAAC;AACtF,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,GAAQ;IAC7C,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,kBAAkB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;AACtE,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA+CA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AAuTD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AAokBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CA0IzD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":"AA6DA,UAAU,UAAU;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,GAAG,MAAM,EAAE,CAAC,CAAC;CACpD;AAmZD;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG;IAAE,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAgE7F;AAED,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,UAAU,CAiDpD;AA6xBD,wBAAsB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAwJzD"}