ctx-sync 1.0.0

package/dist/commands/track.js

@@ -0,0 +1,406 @@
+/**
+ * `ctx-sync track` command.
+ *
+ * Detects the current project's Git state, validates the path,
+ * encrypts the project entry, and writes it to `state.age`.
+ *
+ * Phase 16 enhancements: Step-by-step wizard with auto-detection,
+ * .env import, Docker tracking, mental context, and summary.
+ * `--yes` flag skips interactive confirmations (but NOT restore commands).
+ *
+ * @module commands/track
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import * as crypto from 'node:crypto';
+import { STATE_FILES } from '@ctx-sync/shared';
+import { identityToRecipient } from 'age-encryption';
+import { validateProjectPath } from '../core/path-validator.js';
+import { loadKey } from '../core/key-store.js';
+import { readState, writeState } from '../core/state-manager.js';
+import { commitState } from '../core/git-sync.js';
+import { getConfigDir, getSyncDir } from './init.js';
+import { withErrorHandler } from '../utils/errors.js';
+/**
+ * Detect Git information for a project directory.
+ *
+ * @param projectPath - Absolute path to the project directory.
+ * @returns Git metadata (branch, remote, uncommitted, stash count).
+ */
+export async function detectGitInfo(projectPath) {
+    const defaultGit = {
+        branch: 'unknown',
+        remote: '',
+        hasUncommitted: false,
+        stashCount: 0,
+    };
+    const gitDir = path.join(projectPath, '.git');
+    if (!fs.existsSync(gitDir)) {
+        return defaultGit;
+    }
+    try {
+        const { simpleGit } = await import('simple-git');
+        const git = simpleGit(projectPath);
+        // Branch
+        const branchResult = await git.branch();
+        const branch = branchResult.current || 'unknown';
+        // Remote
+        const remotes = await git.getRemotes(true);
+        const origin = remotes.find((r) => r.name === 'origin');
+        const remote = origin?.refs?.fetch ?? '';
+        // Uncommitted changes
+        const status = await git.status();
+        const hasUncommitted = !status.isClean();
+        // Stash count
+        let stashCount = 0;
+        try {
+            const stashList = await git.stashList();
+            stashCount = stashList.total;
+        }
+        catch {
+            // stash list can fail on repos with no stashes — that's fine
+        }
+        return { branch, remote, hasUncommitted, stashCount };
+    }
+    catch {
+        return defaultGit;
+    }
+}
+/**
+ * Auto-detect project name from Git remote URL or directory name.
+ *
+ * Priority:
+ *   1. Explicit `--name` flag.
+ *   2. Repository name from Git remote URL (e.g., `origin`).
+ *   3. Directory name.
+ *
+ * @param projectPath - Absolute path to the project directory.
+ * @param gitRemote - The Git remote fetch URL (empty if none).
+ * @returns The detected project name.
+ */
+export function detectProjectName(projectPath, gitRemote) {
+    // Try to extract repo name from Git remote URL
+    if (gitRemote) {
+        // SSH format: git@github.com:user/repo-name.git
+        const sshMatch = /\/([^/]+?)(?:\.git)?$/.exec(gitRemote);
+        if (sshMatch?.[1]) {
+            return sshMatch[1];
+        }
+        // HTTPS format: https://github.com/user/repo-name.git
+        const httpsMatch = /\/([^/]+?)(?:\.git)?$/.exec(gitRemote);
+        if (httpsMatch?.[1]) {
+            return httpsMatch[1];
+        }
+    }
+    // Fall back to directory name
+    return path.basename(projectPath);
+}
+/**
+ * Derive the machine ID for the current host.
+ *
+ * Uses hostname as a simple machine identifier.
+ * A more robust approach (hardware ID) can be added later.
+ */
+function getMachineInfo() {
+    const hostname = os.hostname();
+    return {
+        id: crypto.createHash('sha256').update(hostname).digest('hex').slice(0, 16),
+        hostname,
+    };
+}
+/**
+ * Run the interactive wizard to collect user choices.
+ *
+ * @param context - Information about the detected project state.
+ * @returns User's wizard answers.
+ */
+async function runWizard(context) {
+    const Enquirer = (await import('enquirer')).default;
+    const enquirer = new Enquirer();
+    const answers = {
+        importEnv: false,
+        trackDocker: false,
+        currentTask: '',
+        nextSteps: [],
+        confirmCommit: true,
+    };
+    // Step 1: Confirm or change project name (already auto-detected)
+    // This is shown via console output, not a prompt
+    // Step 2: .env import prompt
+    if (context.envFileFound) {
+        const envResponse = await enquirer.prompt({
+            type: 'confirm',
+            name: 'importEnv',
+            message: 'Found .env file. Import environment variables?',
+            initial: true,
+        });
+        const envVal = String(envResponse.importEnv ?? '');
+        answers.importEnv = envVal === 'true' || envVal.toLowerCase() === 'yes';
+    }
+    // Step 3: Docker tracking prompt
+    if (context.dockerComposeFound) {
+        const dockerResponse = await enquirer.prompt({
+            type: 'confirm',
+            name: 'trackDocker',
+            message: 'Found Docker Compose. Track Docker services?',
+            initial: true,
+        });
+        const dVal = String(dockerResponse.trackDocker ?? '');
+        answers.trackDocker = dVal === 'true' || dVal.toLowerCase() === 'yes';
+    }
+    // Step 4: Mental context — current task
+    const taskResponse = await enquirer.prompt({
+        type: 'input',
+        name: 'currentTask',
+        message: 'What are you working on? (press Enter to skip)',
+    });
+    if (taskResponse.currentTask?.trim()) {
+        answers.currentTask = taskResponse.currentTask.trim();
+    }
+    // Step 5: Mental context — next steps
+    if (answers.currentTask) {
+        const stepsResponse = await enquirer.prompt({
+            type: 'input',
+            name: 'nextSteps',
+            message: 'Next steps? (comma-separated, or press Enter to skip)',
+        });
+        if (stepsResponse.nextSteps?.trim()) {
+            answers.nextSteps = stepsResponse.nextSteps
+                .split(',')
+                .map((s) => s.trim())
+                .filter(Boolean);
+        }
+    }
+    // Step 6: Summary and confirmation
+    answers.confirmCommit = true;
+    return answers;
+}
+/**
+ * Execute the track command logic.
+ *
+ * 1. Resolve and validate the project path.
+ * 2. Auto-detect project name from Git remote / directory.
+ * 3. Detect Git info, .env, docker-compose.
+ * 4. Run interactive wizard (if not --yes or --no-interactive).
+ * 5. Build or update the Project entry.
+ * 6. Optionally import .env, track Docker, set mental context.
+ * 7. Encrypt and write state.age.
+ * 8. Optionally commit to the sync repo.
+ *
+ * @param options - Track command options.
+ * @returns Track result including the project entry.
+ */
+export async function executeTrack(options) {
+    // 1. Resolve and validate path
+    const rawPath = options.path ?? process.cwd();
+    const projectPath = validateProjectPath(rawPath);
+    // 2. Load key and derive public key
+    const configDir = getConfigDir();
+    const syncDir = getSyncDir();
+    const privateKey = loadKey(configDir);
+    const publicKey = await identityToRecipient(privateKey);
+    // 3. Detect Git info
+    const gitInfo = await detectGitInfo(projectPath);
+    // 4. Auto-detect project name
+    const projectName = options.name ?? detectProjectName(projectPath, gitInfo.remote);
+    // 5. Check for .env and docker-compose
+    const envFileFound = fs.existsSync(path.join(projectPath, '.env'));
+    const dockerComposeFound = fs.existsSync(path.join(projectPath, 'docker-compose.yml')) ||
+        fs.existsSync(path.join(projectPath, 'docker-compose.yaml')) ||
+        fs.existsSync(path.join(projectPath, 'compose.yml')) ||
+        fs.existsSync(path.join(projectPath, 'compose.yaml'));
+    // 6. Read existing state (or create new)
+    const existingState = await readState(syncDir, privateKey, 'state');
+    const machine = getMachineInfo();
+    const state = existingState ?? {
+        machine,
+        projects: [],
+    };
+    // Ensure machine info is current
+    state.machine = machine;
+    // 7. Find or create project entry
+    const existingIndex = state.projects.findIndex((p) => p.path === projectPath);
+    const isNew = existingIndex === -1;
+    const existingProject = isNew ? undefined : state.projects[existingIndex];
+    const project = {
+        id: existingProject?.id ?? crypto.randomUUID(),
+        name: projectName,
+        path: projectPath,
+        git: gitInfo,
+        lastAccessed: new Date().toISOString(),
+    };
+    if (isNew) {
+        state.projects.push(project);
+    }
+    else {
+        state.projects[existingIndex] = project;
+    }
+    // 8. Run wizard (unless --yes or --no-interactive)
+    let wizardAnswers = null;
+    let envVarsImported = 0;
+    let dockerServicesTracked = 0;
+    let mentalContextSet = false;
+    const isInteractive = !options.yes && !options.noInteractive;
+    const autoAcceptAll = options.yes === true;
+    if (options.wizardPromptFn) {
+        // Testing override
+        wizardAnswers = await options.wizardPromptFn({
+            projectName,
+            projectPath,
+            gitBranch: gitInfo.branch,
+            envFileFound,
+            dockerComposeFound,
+            isNew,
+        });
+    }
+    else if (isInteractive && isNew) {
+        // Interactive wizard for new projects only
+        wizardAnswers = await runWizard({
+            projectName,
+            projectPath,
+            gitBranch: gitInfo.branch,
+            envFileFound,
+            dockerComposeFound,
+            isNew,
+        });
+    }
+    else if (autoAcceptAll) {
+        // --yes mode: auto-accept .env import and Docker tracking, skip mental context
+        wizardAnswers = {
+            importEnv: envFileFound,
+            trackDocker: dockerComposeFound,
+            currentTask: '',
+            nextSteps: [],
+            confirmCommit: true,
+        };
+    }
+    // 9. Process wizard answers — import .env
+    if (wizardAnswers?.importEnv && envFileFound) {
+        try {
+            const envFilePath = path.join(projectPath, '.env');
+            const content = fs.readFileSync(envFilePath, 'utf-8');
+            const { parseEnvFile, importEnvVars } = await import('../core/env-handler.js');
+            const vars = parseEnvFile(content);
+            envVarsImported = await importEnvVars(projectName, vars, syncDir, publicKey, privateKey);
+        }
+        catch {
+            // .env import failure is non-fatal
+        }
+    }
+    // 10. Process wizard answers — track Docker
+    if (wizardAnswers?.trackDocker && dockerComposeFound) {
+        try {
+            const { buildDockerStateEntry, saveDockerState } = await import('../core/docker-handler.js');
+            const entry = buildDockerStateEntry(projectName, projectPath);
+            if (entry) {
+                await saveDockerState(syncDir, projectName, entry, publicKey, privateKey);
+                dockerServicesTracked = entry.services.length;
+            }
+        }
+        catch {
+            // Docker tracking failure is non-fatal
+        }
+    }
+    // 11. Process wizard answers — set mental context
+    if (wizardAnswers?.currentTask) {
+        try {
+            const { mergeContext } = await import('./note.js');
+            const existingMentalContext = await readState(syncDir, privateKey, 'mental-context');
+            const mcData = existingMentalContext ?? {};
+            const existing = mcData[projectName] ?? null;
+            const merged = mergeContext(existing, {
+                currentTask: wizardAnswers.currentTask,
+                nextSteps: wizardAnswers.nextSteps,
+            });
+            mcData[projectName] = merged;
+            await writeState(syncDir, mcData, publicKey, 'mental-context');
+            mentalContextSet = true;
+        }
+        catch {
+            // Mental context failure is non-fatal
+        }
+    }
+    // 12. Write encrypted state
+    await writeState(syncDir, state, publicKey, 'state');
+    // 13. Collect all files that need committing
+    const filesToCommit = [STATE_FILES.STATE, STATE_FILES.MANIFEST];
+    if (envVarsImported > 0) {
+        filesToCommit.push(STATE_FILES.ENV_VARS);
+    }
+    if (dockerServicesTracked > 0) {
+        filesToCommit.push(STATE_FILES.DOCKER_STATE);
+    }
+    if (mentalContextSet) {
+        filesToCommit.push(STATE_FILES.MENTAL_CONTEXT);
+    }
+    // 14. Optionally commit
+    if (!options.noSync && (wizardAnswers?.confirmCommit !== false)) {
+        await commitState(syncDir, filesToCommit, `feat: ${isNew ? 'track' : 'update'} project ${projectName}`);
+    }
+    return {
+        project,
+        isNew,
+        envFileFound,
+        dockerComposeFound,
+        envVarsImported,
+        dockerServicesTracked,
+        mentalContextSet,
+    };
+}
+/**
+ * Register the `track` command on the given Commander program.
+ */
+export function registerTrackCommand(program) {
+    program
+        .command('track')
+        .description('Track the current project directory')
+        .option('-n, --name <name>', 'Project name (default: auto-detect from Git remote)')
+        .option('-p, --path <path>', 'Project path (default: current directory)')
+        .option('--no-sync', 'Skip syncing to Git after tracking')
+        .option('-y, --yes', 'Accept all defaults without prompting')
+        .option('--no-interactive', 'Skip all interactive prompts')
+        .action(withErrorHandler(async (opts) => {
+        const options = {
+            name: opts['name'],
+            path: opts['path'],
+            noSync: opts['sync'] === false,
+            yes: opts['yes'],
+            noInteractive: opts['interactive'] === false,
+        };
+        const result = await executeTrack(options);
+        const chalk = (await import('chalk')).default;
+        if (result.isNew) {
+            console.log(chalk.green('✅ Tracking project: ') + result.project.name);
+        }
+        else {
+            console.log(chalk.green('✅ Updated project: ') + result.project.name);
+        }
+        console.log(`   Path: ${result.project.path}`);
+        console.log(`   Branch: ${result.project.git.branch}`);
+        if (result.project.git.hasUncommitted) {
+            console.log(chalk.yellow('   ⚠ Uncommitted changes detected'));
+        }
+        if (result.project.git.stashCount > 0) {
+            console.log(chalk.yellow(`   ⚠ ${result.project.git.stashCount} stash(es)`));
+        }
+        // Wizard results
+        if (result.envVarsImported > 0) {
+            console.log(chalk.green(`   ✅ Imported ${result.envVarsImported} env vars (all encrypted)`));
+        }
+        else if (result.envFileFound) {
+            console.log(chalk.cyan('   ℹ .env file found — use `ctx-sync env import` to track environment variables'));
+        }
+        if (result.dockerServicesTracked > 0) {
+            console.log(chalk.green(`   ✅ Tracking ${result.dockerServicesTracked} Docker service(s)`));
+        }
+        else if (result.dockerComposeFound) {
+            console.log(chalk.cyan('   ℹ Docker Compose found — use `ctx-sync docker track` to track services'));
+        }
+        if (result.mentalContextSet) {
+            console.log(chalk.green('   ✅ Mental context saved'));
+        }
+        console.log(chalk.dim('\n   State encrypted and saved to state.age'));
+    }));
+}
+//# sourceMappingURL=track.js.map

package/dist/commands/track.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"track.js","sourceRoot":"","sources":["../../src/commands/track.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,MAAM,MAAM,aAAa,CAAC;AAGtC,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AAC/C,OAAO,EAAE,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACrD,OAAO,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,sBAAsB,CAAC;AAC/C,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,0BAA0B,CAAC;AACjE,OAAO,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAClD,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACrD,OAAO,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AA4DtD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,MAAM,UAAU,GAAmB;QACjC,MAAM,EAAE,SAAS;QACjB,MAAM,EAAE,EAAE;QACV,cAAc,EAAE,KAAK;QACrB,UAAU,EAAE,CAAC;KACd,CAAC;IAEF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;IAC9C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3B,OAAO,UAAU,CAAC;IACpB,CAAC;IAED,IAAI,CAAC;QACH,MAAM,EAAE,SAAS,EAAE,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,GAAG,GAAG,SAAS,CAAC,WAAW,CAAC,CAAC;QAEnC,SAAS;QACT,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,IAAI,SAAS,CAAC;QAEjD,SAAS;QACT,MAAM,OAAO,GAAG,MAAM,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAC3C,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC;QACxD,MAAM,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;QAEzC,sBAAsB;QACtB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,cAAc,GAAG,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QAEzC,cAAc;QACd,IAAI,UAAU,GAAG,CAAC,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,SAAS,EAAE,CAAC;YACxC,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC;QAC/B,CAAC;QAAC,MAAM,CAAC;YACP,6DAA6D;QAC/D,CAAC;QAED,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,UAAU,EAAE,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,UAAU,CAAC;IACpB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,iBAAiB,CAAC,WAAmB,EAAE,SAAiB;IACtE,+CAA+C;IAC/C,IAAI,SAAS,EAAE,CAAC;QACd,gDAAgD;QAChD,MAAM,QAAQ,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QACzD,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAClB,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;QACrB,CAAC;QAED,sDAAsD;QACtD,MAAM,UAAU,GAAG,uBAAuB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACpB,OAAO,UAAU,CAAC,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC;IAED,8BAA8B;IAC9B,OAAO,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc;IACrB,MAAM,QAAQ,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC;IAC/B,OAAO;QACL,EAAE,EAAE,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3E,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,SAAS,CAAC,OAAsB;IAC7C,MAAM,QAAQ,GAAG,CAAC,MAAM,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACpD,MAAM,QAAQ,GAAG,IAAI,QAAQ,EAA0B,CAAC;IAExD,MAAM,OAAO,GAAkB;QAC7B,SAAS,EAAE,KAAK;QAChB,WAAW,EAAE,KAAK;QAClB,WAAW,EAAE,EAAE;QACf,SAAS,EAAE,EAAE;QACb,aAAa,EAAE,IAAI;KACpB,CAAC;IAEF,iEAAiE;IACjE,iDAAiD;IAEjD,6BAA6B;IAC7B,IAAI,OAAO,CAAC,YAAY,EAAE,CAAC;QACzB,MAAM,WAAW,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YACxC,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,gDAAgD;YACzD,OAAO,EAAE,IAAI;SAC2B,CAAC,CAAC;QAC5C,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,SAAS,GAAG,MAAM,KAAK,MAAM,IAAI,MAAM,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IAC1E,CAAC;IAED,iCAAiC;IACjC,IAAI,OAAO,CAAC,kBAAkB,EAAE,CAAC;QAC/B,MAAM,cAAc,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAC3C,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,aAAa;YACnB,OAAO,EAAE,8CAA8C;YACvD,OAAO,EAAE,IAAI;SAC2B,CAAC,CAAC;QAC5C,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC;QACtD,OAAO,CAAC,WAAW,GAAG,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC;IACxE,CAAC;IAED,wCAAwC;IACxC,MAAM,YAAY,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACzC,IAAI,EAAE,OAAO;QACb,IAAI,EAAE,aAAa;QACnB,OAAO,EAAE,gDAAgD;KACjB,CAAC,CAAC;IAC5C,IAAI,YAAY,CAAC,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC;QACrC,OAAO,CAAC,WAAW,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;IACxD,CAAC;IAED,sCAAsC;IACtC,IAAI,OAAO,CAAC,WAAW,EAAE,CAAC;QACxB,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;YAC1C,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,WAAW;YACjB,OAAO,EAAE,uDAAuD;SACxB,CAAC,CAAC;QAC5C,IAAI,aAAa,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,CAAC;YACpC,OAAO,CAAC,SAAS,GAAG,aAAa,CAAC,SAAS;iBACxC,KAAK,CAAC,GAAG,CAAC;iBACV,GAAG,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;iBAC5B,MAAM,CAAC,OAAO,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,mCAAmC;IACnC,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC;IAE7B,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,OAAqB;IACtD,+BAA+B;IAC/B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IAC9C,MAAM,WAAW,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IAEjD,oCAAoC;IACpC,MAAM,SAAS,GAAG,YAAY,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,UAAU,EAAE,CAAC;IAC7B,MAAM,UAAU,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC;IACtC,MAAM,SAAS,GAAG,MAAM,mBAAmB,CAAC,UAAU,CAAC,CAAC;IAExD,qBAAqB;IACrB,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IAEjD,8BAA8B;IAC9B,MAAM,WAAW,GAAG,OAAO,CAAC,IAAI,IAAI,iBAAiB,CAAC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;IAEnF,uCAAuC;IACvC,MAAM,YAAY,GAAG,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC;IACnE,MAAM,kBAAkB,GACtB,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,oBAAoB,CAAC,CAAC;QAC3D,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,qBAAqB,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;QACpD,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;IAExD,yCAAyC;IACzC,MAAM,aAAa,GAAG,MAAM,SAAS,CAAY,OAAO,EAAE,UAAU,EAAE,OAAO,CAAC,CAAC;IAC/E,MAAM,OAAO,GAAG,cAAc,EAAE,CAAC;IAEjC,MAAM,KAAK,GAAc,aAAa,IAAI;QACxC,OAAO;QACP,QAAQ,EAAE,EAAE;KACb,CAAC;IAEF,iCAAiC;IACjC,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC;IAExB,kCAAkC;IAClC,MAAM,aAAa,GAAG,KAAK,CAAC,QAAQ,CAAC,SAAS,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAC9B,CAAC;IACF,MAAM,KAAK,GAAG,aAAa,KAAK,CAAC,CAAC,CAAC;IAEnC,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAC;IAE1E,MAAM,OAAO,GAAY;QACvB,EAAE,EAAE,eAAe,EAAE,EAAE,IAAI,MAAM,CAAC,UAAU,EAAE;QAC9C,IAAI,EAAE,WAAW;QACjB,IAAI,EAAE,WAAW;QACjB,GAAG,EAAE,OAAO;QACZ,YAAY,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACvC,CAAC;IAEF,IAAI,KAAK,EAAE,CAAC;QACV,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,QAAQ,CAAC,aAAa,CAAC,GAAG,OAAO,CAAC;IAC1C,CAAC;IAED,mDAAmD;IACnD,IAAI,aAAa,GAAyB,IAAI,CAAC;IAC/C,IAAI,eAAe,GAAG,CAAC,CAAC;IACxB,IAAI,qBAAqB,GAAG,CAAC,CAAC;IAC9B,IAAI,gBAAgB,GAAG,KAAK,CAAC;IAE7B,MAAM,aAAa,GAAG,CAAC,OAAO,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,aAAa,CAAC;IAC7D,MAAM,aAAa,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;IAE3C,IAAI,OAAO,CAAC,cAAc,EAAE,CAAC;QAC3B,mBAAmB;QACnB,aAAa,GAAG,MAAM,OAAO,CAAC,cAAc,CAAC;YAC3C,WAAW;YACX,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,MAAM;YACzB,YAAY;YACZ,kBAAkB;YAClB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,aAAa,IAAI,KAAK,EAAE,CAAC;QAClC,2CAA2C;QAC3C,aAAa,GAAG,MAAM,SAAS,CAAC;YAC9B,WAAW;YACX,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,MAAM;YACzB,YAAY;YACZ,kBAAkB;YAClB,KAAK;SACN,CAAC,CAAC;IACL,CAAC;SAAM,IAAI,aAAa,EAAE,CAAC;QACzB,+EAA+E;QAC/E,aAAa,GAAG;YACd,SAAS,EAAE,YAAY;YACvB,WAAW,EAAE,kBAAkB;YAC/B,WAAW,EAAE,EAAE;YACf,SAAS,EAAE,EAAE;YACb,aAAa,EAAE,IAAI;SACpB,CAAC;IACJ,CAAC;IAED,0CAA0C;IAC1C,IAAI,aAAa,EAAE,SAAS,IAAI,YAAY,EAAE,CAAC;QAC7C,IAAI,CAAC;YACH,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC;YACnD,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACtD,MAAM,EAAE,YAAY,EAAE,aAAa,EAAE,GAAG,MAAM,MAAM,CAAC,wBAAwB,CAAC,CAAC;YAC/E,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;YACnC,eAAe,GAAG,MAAM,aAAa,CACnC,WAAW,EACX,IAAI,EACJ,OAAO,EACP,SAAS,EACT,UAAU,CACX,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,mCAAmC;QACrC,CAAC;IACH,CAAC;IAED,4CAA4C;IAC5C,IAAI,aAAa,EAAE,WAAW,IAAI,kBAAkB,EAAE,CAAC;QACrD,IAAI,CAAC;YACH,MAAM,EAAE,qBAAqB,EAAE,eAAe,EAAE,GAC9C,MAAM,MAAM,CAAC,2BAA2B,CAAC,CAAC;YAC5C,MAAM,KAAK,GAAG,qBAAqB,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAC9D,IAAI,KAAK,EAAE,CAAC;gBACV,MAAM,eAAe,CAAC,OAAO,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;gBAC1E,qBAAqB,GAAG,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;IACH,CAAC;IAED,kDAAkD;IAClD,IAAI,aAAa,EAAE,WAAW,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,CAAC;YACnD,MAAM,qBAAqB,GAAG,MAAM,SAAS,CAC3C,OAAO,EACP,UAAU,EACV,gBAAgB,CACjB,CAAC;YACF,MAAM,MAAM,GAAkB,qBAAqB,IAAI,EAAE,CAAC;YAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;YAC7C,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,EAAE;gBACpC,WAAW,EAAE,aAAa,CAAC,WAAW;gBACtC,SAAS,EAAE,aAAa,CAAC,SAAS;aACnC,CAAC,CAAC;YACH,MAAM,CAAC,WAAW,CAAC,GAAG,MAAM,CAAC;YAC7B,MAAM,UAAU,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,gBAAgB,CAAC,CAAC;YAC/D,gBAAgB,GAAG,IAAI,CAAC;QAC1B,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;IACH,CAAC;IAED,4BAA4B;IAC5B,MAAM,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAErD,6CAA6C;IAC7C,MAAM,aAAa,GAAa,CAAC,WAAW,CAAC,KAAK,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC1E,IAAI,eAAe,GAAG,CAAC,EAAE,CAAC;QACxB,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;IAC3C,CAAC;IACD,IAAI,qBAAqB,GAAG,CAAC,EAAE,CAAC;QAC9B,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;IAC/C,CAAC;IACD,IAAI,gBAAgB,EAAE,CAAC;QACrB,aAAa,CAAC,IAAI,CAAC,WAAW,CAAC,cAAc,CAAC,CAAC;IACjD,CAAC;IAED,wBAAwB;IACxB,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,aAAa,EAAE,aAAa,KAAK,KAAK,CAAC,EAAE,CAAC;QAChE,MAAM,WAAW,CACf,OAAO,EACP,aAAa,EACb,SAAS,KAAK,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,QAAQ,YAAY,WAAW,EAAE,CAC7D,CAAC;IACJ,CAAC;IAED,OAAO;QACL,OAAO;QACP,KAAK;QACL,YAAY;QACZ,kBAAkB;QAClB,eAAe;QACf,qBAAqB;QACrB,gBAAgB;KACjB,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAgB;IACnD,OAAO;SACJ,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CAAC,qCAAqC,CAAC;SAClD,MAAM,CAAC,mBAAmB,EAAE,qDAAqD,CAAC;SAClF,MAAM,CAAC,mBAAmB,EAAE,2CAA2C,CAAC;SACxE,MAAM,CAAC,WAAW,EAAE,oCAAoC,CAAC;SACzD,MAAM,CAAC,WAAW,EAAE,uCAAuC,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,8BAA8B,CAAC;SAC1D,MAAM,CAAC,gBAAgB,CAAC,KAAK,EAAE,IAA6B,EAAE,EAAE;QAC/D,MAAM,OAAO,GAAiB;YAC5B,IAAI,EAAE,IAAI,CAAC,MAAM,CAAuB;YACxC,IAAI,EAAE,IAAI,CAAC,MAAM,CAAuB;YACxC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,KAAK;YAC9B,GAAG,EAAE,IAAI,CAAC,KAAK,CAAwB;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa,CAAC,KAAK,KAAK;SAC7C,CAAC;QAEF,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,OAAO,CAAC,CAAC;QAC3C,MAAM,KAAK,GAAG,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC;QAE9C,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;YACjB,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,sBAAsB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAC1D,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,qBAAqB,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CACzD,CAAC;QACJ,CAAC;QAED,OAAO,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/C,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QAEvD,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,mCAAmC,CAAC,CAAC,CAAC;QACjE,CAAC;QAED,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;YACtC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,MAAM,CAAC,QAAQ,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,YAAY,CAAC,CAChE,CAAC;QACJ,CAAC;QAED,iBAAiB;QACjB,IAAI,MAAM,CAAC,eAAe,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,eAAe,2BAA2B,CAAC,CAChF,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,iFAAiF,CAClF,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,KAAK,CAAC,iBAAiB,MAAM,CAAC,qBAAqB,oBAAoB,CAAC,CAC/E,CAAC;QACJ,CAAC;aAAM,IAAI,MAAM,CAAC,kBAAkB,EAAE,CAAC;YACrC,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,IAAI,CACR,2EAA2E,CAC5E,CACF,CAAC;QACJ,CAAC;QAED,IAAI,MAAM,CAAC,gBAAgB,EAAE,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,2BAA2B,CAAC,CAAC,CAAC;QACxD,CAAC;QAED,OAAO,CAAC,GAAG,CACT,KAAK,CAAC,GAAG,CAAC,6CAA6C,CAAC,CACzD,CAAC;IACJ,CAAC,CAAC,CAAC,CAAC;AACR,CAAC"}

package/dist/core/command-validator.d.ts

@@ -0,0 +1,100 @@
+/**
+ * Command validator module.
+ *
+ * Validates shell commands for suspicious patterns before execution.
+ * Used by the `restore` command to prevent remote code execution (RCE)
+ * via a compromised Git repo injecting malicious commands into the
+ * encrypted state.
+ *
+ * **Critical security property:** No command is ever executed without
+ * explicit user confirmation. There is no `--yes` or `--no-confirm`
+ * flag — command confirmation cannot be bypassed.
+ *
+ * @module core/command-validator
+ */
+/** Result of command validation */
+export interface ValidationResult {
+    /** Whether the command matches a suspicious pattern */
+    suspicious: boolean;
+    /** Human-readable reason why the command is suspicious (empty if safe) */
+    reason: string;
+}
+/** A command pending approval, with metadata for display */
+export interface PendingCommand {
+    /** The shell command string */
+    command: string;
+    /** Display label for the command category (e.g. "Docker service", "Auto-start service") */
+    label: string;
+    /** Optional working directory */
+    cwd?: string;
+    /** Optional port */
+    port?: number;
+    /** Optional Docker image name */
+    image?: string;
+}
+/** Result of presenting commands for approval */
+export interface ApprovalResult {
+    /** Commands that were approved */
+    approved: PendingCommand[];
+    /** Commands that were rejected */
+    rejected: PendingCommand[];
+    /** Whether all commands were skipped (non-interactive mode) */
+    skippedAll: boolean;
+}
+/**
+ * Validate a shell command for suspicious patterns.
+ *
+ * Checks the command string against known dangerous patterns. This is a
+ * defence-in-depth measure — the primary protection is the mandatory
+ * user confirmation before any command executes.
+ *
+ * @param cmd - The shell command string to validate.
+ * @returns Validation result with suspicious flag and reason.
+ */
+export declare function validateCommand(cmd: string): ValidationResult;
+/**
+ * Validate a Docker image name for suspicious patterns.
+ *
+ * Flags images from unofficial registries or suspicious names.
+ * Trusted images come from well-known publishers (e.g. `postgres`,
+ * `redis`, `node`) without a registry prefix, or from trusted registries
+ * like `docker.io`.
+ *
+ * @param image - The Docker image name (e.g. 'postgres:15', 'evil.com/malware:latest').
+ * @returns Validation result with warning flag and reason.
+ */
+export declare function validateDockerImage(image: string): ValidationResult;
+/**
+ * Format commands for display to the user before execution.
+ *
+ * Groups commands by category (Docker services, auto-start services)
+ * and adds warning indicators for suspicious commands.
+ *
+ * @param commands - The list of commands pending approval.
+ * @returns Formatted string for terminal display.
+ */
+export declare function formatCommandsForDisplay(commands: PendingCommand[]): string;
+/**
+ * Present commands for user approval.
+ *
+ * In interactive mode, displays commands and prompts the user to approve
+ * all, reject all, or select individually.
+ *
+ * In non-interactive mode, displays commands but does NOT execute any —
+ * this is the safe default.
+ *
+ * **Security:** There is no `--yes` or `--no-confirm` flag. Command
+ * confirmation cannot be bypassed programmatically.
+ *
+ * @param commands - The list of commands to present.
+ * @param options - Display options.
+ * @param options.interactive - Whether to prompt for approval (false = show only).
+ * @param options.promptFn - Optional override for the approval prompt (for testing).
+ * @returns The approval result (which commands were approved/rejected).
+ */
+export declare function presentCommandsForApproval(commands: PendingCommand[], options?: {
+    interactive?: boolean;
+    promptFn?: (commands: PendingCommand[]) => Promise<'all' | 'none' | 'select'>;
+    selectFn?: (cmd: PendingCommand, index: number) => Promise<boolean>;
+}): Promise<ApprovalResult>;
+//# sourceMappingURL=command-validator.d.ts.map

package/dist/core/command-validator.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command-validator.d.ts","sourceRoot":"","sources":["../../src/core/command-validator.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAEH,mCAAmC;AACnC,MAAM,WAAW,gBAAgB;IAC/B,uDAAuD;IACvD,UAAU,EAAE,OAAO,CAAC;IACpB,0EAA0E;IAC1E,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,4DAA4D;AAC5D,MAAM,WAAW,cAAc;IAC7B,+BAA+B;IAC/B,OAAO,EAAE,MAAM,CAAC;IAChB,2FAA2F;IAC3F,KAAK,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,oBAAoB;IACpB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,iCAAiC;IACjC,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,iDAAiD;AACjD,MAAM,WAAW,cAAc;IAC7B,kCAAkC;IAClC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,kCAAkC;IAClC,QAAQ,EAAE,cAAc,EAAE,CAAC;IAC3B,+DAA+D;IAC/D,UAAU,EAAE,OAAO,CAAC;CACrB;AAiGD;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,gBAAgB,CAc7D;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,gBAAgB,CAoCnE;AAED;;;;;;;;GAQG;AACH,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,cAAc,EAAE,GAAG,MAAM,CAsD3E;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,cAAc,EAAE,EAC1B,OAAO,GAAE;IACP,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,EAAE,CAAC,QAAQ,EAAE,cAAc,EAAE,KAAK,OAAO,CAAC,KAAK,GAAG,MAAM,GAAG,QAAQ,CAAC,CAAC;IAC9E,QAAQ,CAAC,EAAE,CAAC,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CAChE,GACL,OAAO,CAAC,cAAc,CAAC,CAyDzB"}