create-claude-cabinet 0.34.0 → 0.34.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "create-claude-cabinet",
-  "version": "0.34.0",
+  "version": "0.34.1",
   "description": "Claude Cabinet — opinionated process scaffolding for Claude Code projects",
   "bin": {
     "create-claude-cabinet": "bin/create-claude-cabinet.js"

package/templates/engagement/secure-input-dialog.swift

@@ -0,0 +1,72 @@
+import Cocoa
+
+class InputDialog: NSObject {
+    func run(prompt: String) -> String? {
+        let alert = NSAlert()
+        alert.messageText = prompt
+        alert.addButton(withTitle: "OK")
+        alert.addButton(withTitle: "Cancel")
+
+        let stack = NSStackView(frame: NSRect(x: 0, y: 0, width: 300, height: 50))
+        stack.orientation = .vertical
+        stack.spacing = 8
+
+        let secureField = NSSecureTextField(frame: NSRect(x: 0, y: 0, width: 300, height: 24))
+        secureField.placeholderString = "Enter passphrase"
+        let plainField = NSTextField(frame: NSRect(x: 0, y: 0, width: 300, height: 24))
+        plainField.placeholderString = "Enter passphrase"
+        plainField.isHidden = true
+
+        let toggle = NSButton(checkboxWithTitle: "Show passphrase", target: nil, action: nil)
+
+        class ToggleHandler: NSObject {
+            let secureField: NSSecureTextField
+            let plainField: NSTextField
+            let toggle: NSButton
+            init(s: NSSecureTextField, p: NSTextField, t: NSButton) {
+                secureField = s; plainField = p; toggle = t
+            }
+            @objc func toggled(_ sender: Any?) {
+                if toggle.state == .on {
+                    plainField.stringValue = secureField.stringValue
+                    secureField.isHidden = true
+                    plainField.isHidden = false
+                    plainField.becomeFirstResponder()
+                } else {
+                    secureField.stringValue = plainField.stringValue
+                    plainField.isHidden = true
+                    secureField.isHidden = false
+                    secureField.becomeFirstResponder()
+                }
+            }
+        }
+        let handler = ToggleHandler(s: secureField, p: plainField, t: toggle)
+        toggle.target = handler
+        toggle.action = #selector(ToggleHandler.toggled(_:))
+
+        stack.addArrangedSubview(secureField)
+        stack.addArrangedSubview(plainField)
+        stack.addArrangedSubview(toggle)
+
+        alert.accessoryView = stack
+        alert.window.initialFirstResponder = secureField
+
+        let response = alert.runModal()
+        if response == .alertFirstButtonReturn {
+            return toggle.state == .on ? plainField.stringValue : secureField.stringValue
+        }
+        return nil
+    }
+}
+
+let app = NSApplication.shared
+app.setActivationPolicy(.accessory)
+
+let dialog = InputDialog()
+let prompt = CommandLine.arguments.count > 1 ? CommandLine.arguments[1] : "Enter passphrase"
+if let value = dialog.run(prompt: prompt) {
+    print(value)
+} else {
+    fputs("CANCELLED\n", stderr)
+    exit(1)
+}

package/templates/engagement/secure-input.mjs

@@ -1,7 +1,11 @@
 import { execFile } from 'node:child_process';
 import { promisify } from 'node:util';
+import { existsSync, mkdirSync } from 'node:fs';
+import { join, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
 
 const execFileAsync = promisify(execFile);
+const __dirname = dirname(fileURLToPath(import.meta.url));
 
 export class DialogCancelledError extends Error {
   constructor() { super('User cancelled dialog'); this.code = 'CANCELLED'; }
@@ -27,7 +31,34 @@ function escapeAppleScript(str) {
   return str.replace(/\\/g, '\\\\').replace(/"/g, '\\"');
 }
 
-async function captureViaMacOS(prompt) {
+async function ensureNativeDialog() {
+  const cacheDir = join(process.env.HOME || '/tmp', '.claude-cabinet', 'bin');
+  const binPath = join(cacheDir, 'secure-input-dialog');
+  if (existsSync(binPath)) return binPath;
+
+  const srcPath = join(__dirname, 'secure-input-dialog.swift');
+  if (!existsSync(srcPath)) return null;
+
+  mkdirSync(cacheDir, { recursive: true });
+  try {
+    await execFileAsync('swiftc', ['-o', binPath, srcPath], { timeout: 30000 });
+    return binPath;
+  } catch {
+    return null;
+  }
+}
+
+async function captureViaNativeDialog(prompt, binPath) {
+  try {
+    const { stdout } = await execFileAsync(binPath, [prompt], { timeout: 120000 });
+    return stdout.trim();
+  } catch (err) {
+    if (err.stderr?.includes('CANCELLED')) throw new DialogCancelledError();
+    throw err;
+  }
+}
+
+async function captureViaAppleScript(prompt) {
   const escaped = escapeAppleScript(prompt);
   const script = `display dialog "${escaped}" with hidden answer default answer ""`;
   try {
@@ -43,6 +74,12 @@ async function captureViaMacOS(prompt) {
   }
 }
 
+async function captureViaMacOS(prompt) {
+  const binPath = await ensureNativeDialog();
+  if (binPath) return captureViaNativeDialog(prompt, binPath);
+  return captureViaAppleScript(prompt);
+}
+
 async function captureViaZenity(prompt) {
   try {
     const { stdout } = await execFileAsync('zenity', ['--password', '--title', prompt]);
@@ -83,6 +120,12 @@ async function captureViaPowerShell(prompt) {
 
 /**
  * Capture a secret via a secure OS dialog.
+ *
+ * On macOS: uses a native Cocoa dialog with a "Show passphrase" toggle
+ * checkbox (compiled from secure-input-dialog.swift on first use, cached
+ * at ~/.claude-cabinet/bin/). Falls back to AppleScript (masked, no toggle)
+ * if Swift compilation fails.
+ *
  * @param {string} prompt - what to ask
  * @param {{ requireSecure?: boolean }} opts
  *   requireSecure (default false): when true, REFUSE to fall back to the
@@ -100,7 +143,7 @@ export async function captureSecureInput(prompt, { requireSecure = false } = {})
         return await captureViaZenity(prompt);
       } catch (err) {
         if (err instanceof DialogUnavailableError) {
-          if (requireSecure) throw err; // fail closed for credentials
+          if (requireSecure) throw err;
           return captureViaTerminal(prompt);
         }
         throw err;