daycare-cli 2026.2.12 → 2026.2.23

package/dist/sandbox/sandboxPathDenyCheck.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Checks whether a target path is contained in any denied directory path.
+ * Expects: target and denyPaths are absolute or resolvable paths.
+ */
+export declare function sandboxPathDenyCheck(target: string, denyPaths: string[]): boolean;
+//# sourceMappingURL=sandboxPathDenyCheck.d.ts.map

package/dist/sandbox/sandboxPathDenyCheck.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.ts"],"names":[],"mappings":"AAKA;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,GAAG,OAAO,CAQjF"}

package/dist/sandbox/sandboxPathDenyCheck.js

@@ -0,0 +1,26 @@
+import fs from "node:fs";
+import path from "node:path";
+import { isWithinSecure } from "./pathResolveSecure.js";
+/**
+ * Checks whether a target path is contained in any denied directory path.
+ * Expects: target and denyPaths are absolute or resolvable paths.
+ */
+export function sandboxPathDenyCheck(target, denyPaths) {
+    const resolvedTarget = existingPathResolve(target);
+    for (const denyPath of denyPaths) {
+        if (isWithinSecure(existingPathResolve(denyPath), resolvedTarget)) {
+            return true;
+        }
+    }
+    return false;
+}
+function existingPathResolve(target) {
+    const resolved = path.resolve(target);
+    try {
+        return fs.realpathSync(resolved);
+    }
+    catch {
+        return resolved;
+    }
+}
+//# sourceMappingURL=sandboxPathDenyCheck.js.map

package/dist/sandbox/sandboxPathDenyCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAExD;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAc,EAAE,SAAmB;IACpE,MAAM,cAAc,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACnD,KAAK,MAAM,QAAQ,IAAI,SAAS,EAAE,CAAC;QAC/B,IAAI,cAAc,CAAC,mBAAmB,CAAC,QAAQ,CAAC,EAAE,cAAc,CAAC,EAAE,CAAC;YAChE,OAAO,IAAI,CAAC;QAChB,CAAC;IACL,CAAC;IACD,OAAO,KAAK,CAAC;AACjB,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAc;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC;QACD,OAAO,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,QAAQ,CAAC;IACpB,CAAC;AACL,CAAC"}

package/dist/sandbox/sandboxPathDenyCheck.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxPathDenyCheck.spec.d.ts.map

package/dist/sandbox/sandboxPathDenyCheck.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxPathDenyCheck.spec.js

@@ -0,0 +1,23 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { sandboxPathDenyCheck } from "./sandboxPathDenyCheck.js";
+describe("sandboxPathDenyCheck", () => {
+    it("returns true when target is inside a denied directory", () => {
+        const denied = ["/home/alice/.ssh", "/etc/ssh"];
+        const target = "/home/alice/.ssh/id_rsa";
+        expect(sandboxPathDenyCheck(target, denied)).toBe(true);
+    });
+    it("returns true when target matches a denied directory exactly", () => {
+        const target = path.resolve("/etc/ssh");
+        expect(sandboxPathDenyCheck(target, ["/etc/ssh"])).toBe(true);
+    });
+    it("returns false when target is outside denied directories", () => {
+        const target = "/home/alice/projects/daycare/readme.md";
+        expect(sandboxPathDenyCheck(target, ["/home/alice/.ssh", "/etc/ssh"])).toBe(false);
+    });
+    it("does not treat sibling directory names as contained", () => {
+        const target = "/home/alice/.ssh-backup/id_rsa";
+        expect(sandboxPathDenyCheck(target, ["/home/alice/.ssh"])).toBe(false);
+    });
+});
+//# sourceMappingURL=sandboxPathDenyCheck.spec.js.map

package/dist/sandbox/sandboxPathDenyCheck.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxPathDenyCheck.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxPathDenyCheck.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,oBAAoB,EAAE,MAAM,2BAA2B,CAAC;AAEjE,QAAQ,CAAC,sBAAsB,EAAE,GAAG,EAAE;IAClC,EAAE,CAAC,uDAAuD,EAAE,GAAG,EAAE;QAC7D,MAAM,MAAM,GAAG,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC;QAChD,MAAM,MAAM,GAAG,yBAAyB,CAAC;QAEzC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC5D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6DAA6D,EAAE,GAAG,EAAE;QACnE,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAExC,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,yDAAyD,EAAE,GAAG,EAAE;QAC/D,MAAM,MAAM,GAAG,wCAAwC,CAAC;QAExD,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,kBAAkB,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACvF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,qDAAqD,EAAE,GAAG,EAAE;QAC3D,MAAM,MAAM,GAAG,gCAAgC,CAAC;QAEhD,MAAM,CAAC,oBAAoB,CAAC,MAAM,EAAE,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.d.ts

@@ -0,0 +1,11 @@
+type SandboxSensitiveDenyPathsBuildInput = {
+    homeDir?: string;
+    platform?: NodeJS.Platform;
+};
+/**
+ * Builds the shared sensitive filesystem deny-list used by sandbox checks.
+ * Expects: homeDir, when provided, is an absolute or resolvable path.
+ */
+export declare function sandboxSensitiveDenyPathsBuild(input?: SandboxSensitiveDenyPathsBuildInput): string[];
+export {};
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.d.ts.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.ts"],"names":[],"mappings":"AAGA,KAAK,mCAAmC,GAAG;IACvC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC9B,CAAC;AA4CF;;;GAGG;AACH,wBAAgB,8BAA8B,CAAC,KAAK,GAAE,mCAAwC,GAAG,MAAM,EAAE,CAexG"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.js

@@ -0,0 +1,63 @@
+import os from "node:os";
+import path from "node:path";
+const COMMON_HOME_RELATIVE_DENY_PATHS = [
+    ".ssh",
+    ".gnupg",
+    ".aws",
+    ".kube",
+    ".docker",
+    ".config/gcloud",
+    ".config/gh",
+    ".config/op",
+    ".config/1Password",
+    ".local/share/keyrings",
+    ".npmrc",
+    ".pypirc",
+    ".netrc",
+    ".git-credentials"
+];
+const COMMON_SYSTEM_DENY_PATHS = [
+    "/etc/ssh",
+    "/etc/sudoers",
+    "/etc/sudoers.d",
+    "/etc/shadow",
+    "/etc/gshadow",
+    "/etc/ssl/private"
+];
+const DARWIN_HOME_RELATIVE_DENY_PATHS = [
+    "Library/Keychains",
+    "Library/Application Support/iCloud",
+    "Library/Application Support/com.apple.TCC",
+    "Library/Group Containers"
+];
+const DARWIN_SYSTEM_DENY_PATHS = [
+    "/private/etc/ssh",
+    "/private/etc/sudoers",
+    "/private/etc/sudoers.d",
+    "/private/etc/master.passwd"
+];
+const LINUX_SYSTEM_DENY_PATHS = ["/root/.ssh"];
+/**
+ * Builds the shared sensitive filesystem deny-list used by sandbox checks.
+ * Expects: homeDir, when provided, is an absolute or resolvable path.
+ */
+export function sandboxSensitiveDenyPathsBuild(input = {}) {
+    const platform = input.platform ?? process.platform;
+    const homeDir = path.resolve(input.homeDir ?? os.homedir());
+    const platformHomeDeny = platform === "darwin" ? DARWIN_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry)) : [];
+    const platformSystemDeny = platform === "darwin" ? DARWIN_SYSTEM_DENY_PATHS : platform === "linux" ? LINUX_SYSTEM_DENY_PATHS : [];
+    return dedupeResolvedPaths([
+        ...COMMON_HOME_RELATIVE_DENY_PATHS.map((entry) => path.resolve(homeDir, entry)),
+        ...platformHomeDeny,
+        ...COMMON_SYSTEM_DENY_PATHS,
+        ...platformSystemDeny
+    ]);
+}
+function dedupeResolvedPaths(values) {
+    const resolved = values
+        .map((entry) => entry.trim())
+        .filter((entry) => entry.length > 0)
+        .map((entry) => path.resolve(entry));
+    return Array.from(new Set(resolved));
+}
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.js.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAO7B,MAAM,+BAA+B,GAAG;IACpC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,OAAO;IACP,SAAS;IACT,gBAAgB;IAChB,YAAY;IACZ,YAAY;IACZ,mBAAmB;IACnB,uBAAuB;IACvB,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,kBAAkB;CACrB,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,UAAU;IACV,cAAc;IACd,gBAAgB;IAChB,aAAa;IACb,cAAc;IACd,kBAAkB;CACrB,CAAC;AAEF,MAAM,+BAA+B,GAAG;IACpC,mBAAmB;IACnB,oCAAoC;IACpC,2CAA2C;IAC3C,0BAA0B;CAC7B,CAAC;AAEF,MAAM,wBAAwB,GAAG;IAC7B,kBAAkB;IAClB,sBAAsB;IACtB,wBAAwB;IACxB,4BAA4B;CAC/B,CAAC;AAEF,MAAM,uBAAuB,GAAG,CAAC,YAAY,CAAC,CAAC;AAE/C;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAAC,QAA6C,EAAE;IAC1F,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IAE5D,MAAM,gBAAgB,GAClB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9G,MAAM,kBAAkB,GACpB,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,EAAE,CAAC;IAE3G,OAAO,mBAAmB,CAAC;QACvB,GAAG,+BAA+B,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC/E,GAAG,gBAAgB;QACnB,GAAG,wBAAwB;QAC3B,GAAG,kBAAkB;KACxB,CAAC,CAAC;AACP,CAAC;AAED,SAAS,mBAAmB,CAAC,MAAgB;IACzC,MAAM,QAAQ,GAAG,MAAM;SAClB,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;SAC5B,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC;SACnC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzC,CAAC"}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.spec.d.ts.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.spec.d.ts","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.spec.ts"],"names":[],"mappings":""}

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.js

@@ -0,0 +1,52 @@
+import path from "node:path";
+import { describe, expect, it } from "vitest";
+import { sandboxSensitiveDenyPathsBuild } from "./sandboxSensitiveDenyPathsBuild.js";
+describe("sandboxSensitiveDenyPathsBuild", () => {
+    it("includes common and linux-specific deny paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "linux",
+            homeDir: "/home/alice"
+        });
+        expect(result).toEqual(expect.arrayContaining([
+            path.resolve("/home/alice/.ssh"),
+            path.resolve("/home/alice/.gnupg"),
+            path.resolve("/home/alice/.config/gh"),
+            path.resolve("/home/alice/.git-credentials"),
+            path.resolve("/etc/ssh"),
+            path.resolve("/etc/sudoers"),
+            path.resolve("/etc/ssl/private"),
+            path.resolve("/root/.ssh")
+        ]));
+    });
+    it("includes common and macOS-specific deny paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "darwin",
+            homeDir: "/Users/alice"
+        });
+        expect(result).toEqual(expect.arrayContaining([
+            path.resolve("/Users/alice/.ssh"),
+            path.resolve("/Users/alice/Library/Keychains"),
+            path.resolve("/Users/alice/Library/Application Support/com.apple.TCC"),
+            path.resolve("/private/etc/master.passwd"),
+            path.resolve("/etc/ssh")
+        ]));
+    });
+    it("does not include platform-specific entries for unsupported platforms", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "win32",
+            homeDir: "/Users/alice"
+        });
+        expect(result).toContain(path.resolve("/Users/alice/.ssh"));
+        expect(result).not.toContain(path.resolve("/Users/alice/Library/Keychains"));
+        expect(result).not.toContain(path.resolve("/root/.ssh"));
+        expect(result).not.toContain(path.resolve("/private/etc/master.passwd"));
+    });
+    it("dedupes resolved paths", () => {
+        const result = sandboxSensitiveDenyPathsBuild({
+            platform: "linux",
+            homeDir: "/home/alice/."
+        });
+        expect(new Set(result).size).toBe(result.length);
+    });
+});
+//# sourceMappingURL=sandboxSensitiveDenyPathsBuild.spec.js.map

package/dist/sandbox/sandboxSensitiveDenyPathsBuild.spec.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxSensitiveDenyPathsBuild.spec.js","sourceRoot":"","sources":["../../sources/sandbox/sandboxSensitiveDenyPathsBuild.spec.ts"],"names":[],"mappings":"AAAA,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AAE9C,OAAO,EAAE,8BAA8B,EAAE,MAAM,qCAAqC,CAAC;AAErF,QAAQ,CAAC,gCAAgC,EAAE,GAAG,EAAE;IAC5C,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,aAAa;SACzB,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC;YAClC,IAAI,CAAC,OAAO,CAAC,wBAAwB,CAAC;YACtC,IAAI,CAAC,OAAO,CAAC,8BAA8B,CAAC;YAC5C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC;YAChC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC;SAC7B,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,+CAA+C,EAAE,GAAG,EAAE;QACrD,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,QAAQ;YAClB,OAAO,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,OAAO,CAClB,MAAM,CAAC,eAAe,CAAC;YACnB,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC;YACjC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC;YAC9C,IAAI,CAAC,OAAO,CAAC,wDAAwD,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC;YAC1C,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC;SAC3B,CAAC,CACL,CAAC;IACN,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sEAAsE,EAAE,GAAG,EAAE;QAC5E,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,cAAc;SAC1B,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,mBAAmB,CAAC,CAAC,CAAC;QAC5D,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,gCAAgC,CAAC,CAAC,CAAC;QAC7E,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC;QACzD,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,4BAA4B,CAAC,CAAC,CAAC;IAC7E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAC9B,MAAM,MAAM,GAAG,8BAA8B,CAAC;YAC1C,QAAQ,EAAE,OAAO;YACjB,OAAO,EAAE,eAAe;SAC3B,CAAC,CAAC;QAEH,MAAM,CAAC,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACrD,CAAC,CAAC,CAAC;AACP,CAAC,CAAC,CAAC"}

package/dist/skills/memory-document/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: memory-document
+description: Write docs like code — Minto pyramid, MECE sections, BFO ontology, Mermaid diagrams, ground truth sources. Applies to any .md file.
+version: "2.0.0"
+---
+
+## How to Write a Document
+
+Write docs like code. Fractal structure where each level is complete. No redundancy — reference, don't repeat. Every claim has a source.
+
+```mermaid
+graph TD
+    Thesis[Thesis: 1 sentence] --> Overview[Overview: 1 paragraph]
+    Overview --> Diagrams[Mermaid: TD + LR]
+    Diagrams --> Sections[MECE Sections 1.0–7.0]
+    Sections --> Details[¶1, ¶2, ¶3 per section]
+    Sources[Ground Truth] --> Sections
+    Sources --> Details
+```
+
+## 1.0 The Stack
+
+Six rules. Use internal names here for clarity — don't leak them into the actual doc output.
+
+¶1 **Minto** — top-down. Thesis → overview → sections → details. Reader gets the point before the evidence.
+
+¶2 **MECE** — sections don't overlap, but cover everything. 3–7 top-level sections. If you can't draw a clean boundary between two sections, merge them.
+
+¶3 **BFO** — separate what exists (continuants) from what happens (occurrents). TD diagrams for structure, LR diagrams for process. This isn't decoration — it forces you to find the real shape of your content.
+
+¶4 **Fractal** — each subsection mirrors the whole. Own thesis sentence, own diagram if needed, own numbered paragraphs. Expand only if it earns the depth.
+
+¶5 **DRY** — each fact once. Cross-reference with §X.Y, don't restate.
+
+¶6 **Ground truth** — every claim traces to a source. URL, file path, query, session ID, person. No source = no claim. See §4.0.
+
+## 2.0 Structure
+
+¶1 **Thesis** — one sentence. Specific outcome with who/what/when. Must preview the MECE sections that follow.
+
+¶2 **Overview** — one paragraph expanding the thesis. Introduces each major section like a function docstring listing its parameters.
+
+¶3 **Mermaid diagrams** — go right after the overview, before §1.0. Structure (TD) before process (LR). See §3.0.
+
+¶4 **Sections** — numbered 1.0, 2.0, 3.0. Subsections 1.1, 1.2. State ordering logic upfront (importance / chronology / dependency). Continuant sections get noun titles, occurrent sections get verb titles.
+
+¶5 **Paragraphs** — numbered ¶1, ¶2, ¶3 within each section. Order: general → specific, or problem → solution, or setup → action → result.
+
+¶6 **Coherence** — if thesis says "planning, execution, monitoring", the doc must have all three. No surprise sections, no missing ones.
+
+¶7 **Big docs** — over ~10 pages, split into linked files with proper relative paths.
+
+## 3.0 Mermaid Diagrams
+
+Every doc gets at least one diagram. Complex docs need both TD and LR.
+
+¶1 **Headers required** — every diagram gets a bold header before the code block. Format: `**[Specific Description] ([Type] - [Direction]):**`. "Skill Package Structure (Continuant - TD)" not "System Structure".
+
+¶2 **Continuant (TD/TB)** — what exists. Nodes are nouns (Database, API, User). Edges are "contains", "depends on", "is part of". Use for architecture, data models, component trees.
+
+¶3 **Occurrent (LR)** — what happens. Nodes are verbs or states (Extract, Validate, Deploy). Edges are temporal — "then", "triggers", "flows to". Use for pipelines, workflows, request flows.
+
+¶4 **Participation (optional)** — how continuants participate in occurrents. User triggers Pipeline which updates Database. TD or LR depending on emphasis.
+
+¶5 **Sizing** — 5–12 nodes per diagram. More than that, split. Short labels (1–3 words). Label edges only when the relationship isn't obvious.
+
+¶6 **Placement** — primary diagrams after overview, before §1.0. Section-level diagrams inline where needed. One diagram per abstraction level — deeper sections get smaller, focused diagrams.
+
+¶7 **Structure first** — when showing both, continuant (TD) before occurrent (LR).
+
+## 4.0 Ground Truth
+
+Every piece of information traces to its source. No exceptions.
+
+### Patterns
+
+¶1 **External** — `**Source:** [Title](URL) (accessed YYYY-MM-DD)`
+
+¶2 **Code** — `**Source:** path/to/file.py:123-145 (function calculate_metrics)`
+
+¶3 **Session** — `**Generated by:** Claude Code session abc123 by Name (YYYY-MM-DD)`
+
+¶4 **LLM reasoning** — `**LLM Analysis:** Based on ¶1 + ¶3` — flag synthesis explicitly, don't present it as source data.
+
+¶5 **Query** — `**Query:** SELECT ... (YYYY-MM-DD)` with result and date. Data changes; timestamp matters.
+
+¶6 **Human** — `**Expert input:** Name (Role), discussed YYYY-MM-DD`
+
+¶7 **Meeting** — `**Source:** Gong call gong_123456 with Client (YYYY-MM-DD)` with key takeaway.
+
+### Where to Put It
+
+¶1 **Doc-level** — primary source right after the thesis in the overview.
+
+¶2 **Section-level** — at top of section if the whole section comes from one source.
+
+¶3 **Inline** — next to specific claims: "churn is 12% (**Source:** `SELECT AVG(churn_rate)...` 2025-11-10)".
+
+¶4 **Mixed** — multiple sources in one paragraph, attribute each piece separately.
+
+### Rules
+
+- Dates mandatory. Always YYYY-MM-DD.
+- URLs must work. Use archive.org if original might vanish.
+- Code refs need line numbers or function names, not just file paths.
+- "Based on research" is not a source. Name it.
+- Synthesis presented as fact is a violation. Flag LLM reasoning.
+
+## Checklist
+
+Paste at doc end. Tick before shipping.
+
+**Structure:**
+- [ ] Thesis: one sentence previewing all sections
+- [ ] Overview: one paragraph introducing each section
+- [ ] Mermaid: at least one; complex docs get TD + LR
+- [ ] MECE: 3–7 sections, no overlap, full coverage
+- [ ] Ordering stated: ¶1 of each section explains sequence logic
+- [ ] Paragraph numbering: ¶1, ¶2, ¶3 throughout
+- [ ] Coherence: thesis matches actual sections
+
+**Content:**
+- [ ] DRY: each fact once, §X.Y cross-references elsewhere
+- [ ] Dense: no filler words, but enough to execute
+- [ ] Labels: noun titles for continuants, verb titles for occurrents
+
+**Ground Truth:**
+- [ ] Primary source in overview
+- [ ] Section sources attributed
+- [ ] Inline sources on specific claims
+- [ ] LLM reasoning flagged
+- [ ] Code refs have line numbers
+- [ ] All dates present
+- [ ] URLs tested

package/dist/skills/skills/memory-document/SKILL.md

@@ -0,0 +1,134 @@
+---
+name: memory-document
+description: Write docs like code — Minto pyramid, MECE sections, BFO ontology, Mermaid diagrams, ground truth sources. Applies to any .md file.
+version: "2.0.0"
+---
+
+## How to Write a Document
+
+Write docs like code. Fractal structure where each level is complete. No redundancy — reference, don't repeat. Every claim has a source.
+
+```mermaid
+graph TD
+    Thesis[Thesis: 1 sentence] --> Overview[Overview: 1 paragraph]
+    Overview --> Diagrams[Mermaid: TD + LR]
+    Diagrams --> Sections[MECE Sections 1.0–7.0]
+    Sections --> Details[¶1, ¶2, ¶3 per section]
+    Sources[Ground Truth] --> Sections
+    Sources --> Details
+```
+
+## 1.0 The Stack
+
+Six rules. Use internal names here for clarity — don't leak them into the actual doc output.
+
+¶1 **Minto** — top-down. Thesis → overview → sections → details. Reader gets the point before the evidence.
+
+¶2 **MECE** — sections don't overlap, but cover everything. 3–7 top-level sections. If you can't draw a clean boundary between two sections, merge them.
+
+¶3 **BFO** — separate what exists (continuants) from what happens (occurrents). TD diagrams for structure, LR diagrams for process. This isn't decoration — it forces you to find the real shape of your content.
+
+¶4 **Fractal** — each subsection mirrors the whole. Own thesis sentence, own diagram if needed, own numbered paragraphs. Expand only if it earns the depth.
+
+¶5 **DRY** — each fact once. Cross-reference with §X.Y, don't restate.
+
+¶6 **Ground truth** — every claim traces to a source. URL, file path, query, session ID, person. No source = no claim. See §4.0.
+
+## 2.0 Structure
+
+¶1 **Thesis** — one sentence. Specific outcome with who/what/when. Must preview the MECE sections that follow.
+
+¶2 **Overview** — one paragraph expanding the thesis. Introduces each major section like a function docstring listing its parameters.
+
+¶3 **Mermaid diagrams** — go right after the overview, before §1.0. Structure (TD) before process (LR). See §3.0.
+
+¶4 **Sections** — numbered 1.0, 2.0, 3.0. Subsections 1.1, 1.2. State ordering logic upfront (importance / chronology / dependency). Continuant sections get noun titles, occurrent sections get verb titles.
+
+¶5 **Paragraphs** — numbered ¶1, ¶2, ¶3 within each section. Order: general → specific, or problem → solution, or setup → action → result.
+
+¶6 **Coherence** — if thesis says "planning, execution, monitoring", the doc must have all three. No surprise sections, no missing ones.
+
+¶7 **Big docs** — over ~10 pages, split into linked files with proper relative paths.
+
+## 3.0 Mermaid Diagrams
+
+Every doc gets at least one diagram. Complex docs need both TD and LR.
+
+¶1 **Headers required** — every diagram gets a bold header before the code block. Format: `**[Specific Description] ([Type] - [Direction]):**`. "Skill Package Structure (Continuant - TD)" not "System Structure".
+
+¶2 **Continuant (TD/TB)** — what exists. Nodes are nouns (Database, API, User). Edges are "contains", "depends on", "is part of". Use for architecture, data models, component trees.
+
+¶3 **Occurrent (LR)** — what happens. Nodes are verbs or states (Extract, Validate, Deploy). Edges are temporal — "then", "triggers", "flows to". Use for pipelines, workflows, request flows.
+
+¶4 **Participation (optional)** — how continuants participate in occurrents. User triggers Pipeline which updates Database. TD or LR depending on emphasis.
+
+¶5 **Sizing** — 5–12 nodes per diagram. More than that, split. Short labels (1–3 words). Label edges only when the relationship isn't obvious.
+
+¶6 **Placement** — primary diagrams after overview, before §1.0. Section-level diagrams inline where needed. One diagram per abstraction level — deeper sections get smaller, focused diagrams.
+
+¶7 **Structure first** — when showing both, continuant (TD) before occurrent (LR).
+
+## 4.0 Ground Truth
+
+Every piece of information traces to its source. No exceptions.
+
+### Patterns
+
+¶1 **External** — `**Source:** [Title](URL) (accessed YYYY-MM-DD)`
+
+¶2 **Code** — `**Source:** path/to/file.py:123-145 (function calculate_metrics)`
+
+¶3 **Session** — `**Generated by:** Claude Code session abc123 by Name (YYYY-MM-DD)`
+
+¶4 **LLM reasoning** — `**LLM Analysis:** Based on ¶1 + ¶3` — flag synthesis explicitly, don't present it as source data.
+
+¶5 **Query** — `**Query:** SELECT ... (YYYY-MM-DD)` with result and date. Data changes; timestamp matters.
+
+¶6 **Human** — `**Expert input:** Name (Role), discussed YYYY-MM-DD`
+
+¶7 **Meeting** — `**Source:** Gong call gong_123456 with Client (YYYY-MM-DD)` with key takeaway.
+
+### Where to Put It
+
+¶1 **Doc-level** — primary source right after the thesis in the overview.
+
+¶2 **Section-level** — at top of section if the whole section comes from one source.
+
+¶3 **Inline** — next to specific claims: "churn is 12% (**Source:** `SELECT AVG(churn_rate)...` 2025-11-10)".
+
+¶4 **Mixed** — multiple sources in one paragraph, attribute each piece separately.
+
+### Rules
+
+- Dates mandatory. Always YYYY-MM-DD.
+- URLs must work. Use archive.org if original might vanish.
+- Code refs need line numbers or function names, not just file paths.
+- "Based on research" is not a source. Name it.
+- Synthesis presented as fact is a violation. Flag LLM reasoning.
+
+## Checklist
+
+Paste at doc end. Tick before shipping.
+
+**Structure:**
+- [ ] Thesis: one sentence previewing all sections
+- [ ] Overview: one paragraph introducing each section
+- [ ] Mermaid: at least one; complex docs get TD + LR
+- [ ] MECE: 3–7 sections, no overlap, full coverage
+- [ ] Ordering stated: ¶1 of each section explains sequence logic
+- [ ] Paragraph numbering: ¶1, ¶2, ¶3 throughout
+- [ ] Coherence: thesis matches actual sections
+
+**Content:**
+- [ ] DRY: each fact once, §X.Y cross-references elsewhere
+- [ ] Dense: no filler words, but enough to execute
+- [ ] Labels: noun titles for continuants, verb titles for occurrents
+
+**Ground Truth:**
+- [ ] Primary source in overview
+- [ ] Section sources attributed
+- [ ] Inline sources on specific claims
+- [ ] LLM reasoning flagged
+- [ ] Code refs have line numbers
+- [ ] All dates present
+- [ ] URLs tested

package/dist/storage/historyRepository.d.ts

@@ -8,7 +8,7 @@ export declare class HistoryRepository {
     private readonly db;
     constructor(db: DatabaseSync);
     findBySessionId(sessionId: string): Promise<AgentHistoryRecord[]>;
-    findByAgentId(agentId: string): Promise<AgentHistoryRecord[]>;
+    findByAgentId(agentId: string, limit?: number): Promise<AgentHistoryRecord[]>;
     /**
      * Appends a history record and returns the new auto-increment id.
      * Expects: sessionId references an existing session.

package/dist/storage/historyRepository.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"historyRepository.d.ts","sourceRoot":"","sources":["../../sources/storage/historyRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;;GAGG;AACH,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;gBAEtB,EAAE,EAAE,YAAY;IAItB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQjE,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAgBnE;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5E;;;OAGG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOpF;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAMzD"}
+{"version":3,"file":"historyRepository.d.ts","sourceRoot":"","sources":["../../sources/storage/historyRepository.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,SAAS,CAAC;AAGlD;;;GAGG;AACH,qBAAa,iBAAiB;IAC1B,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAe;gBAEtB,EAAE,EAAE,YAAY;IAItB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAQjE,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAcnF;;;OAGG;IACG,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,kBAAkB,GAAG,OAAO,CAAC,MAAM,CAAC;IAa5E;;;OAGG;IACG,WAAW,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,EAAE,CAAC;IAOpF;;;OAGG;IACG,KAAK,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;CAMzD"}

package/dist/storage/historyRepository.js

@@ -13,16 +13,16 @@ export class HistoryRepository {
             .all(sessionId);
         return rows.map((row) => historyParse(row)).filter((record) => record !== null);
     }
-    async findByAgentId(agentId) {
-        const rows = this.db
-            .prepare(`
+    async findByAgentId(agentId, limit) {
+        const sql = `
               SELECT h.*
               FROM session_history h
               INNER JOIN sessions s ON s.id = h.session_id
               WHERE s.agent_id = ?
               ORDER BY s.created_at ASC, h.id ASC
-            `)
-            .all(agentId);
+              ${limit !== undefined ? `LIMIT ${limit}` : ""}
+            `;
+        const rows = this.db.prepare(sql).all(agentId);
         return rows.map((row) => historyParse(row)).filter((record) => record !== null);
     }
     /**

package/dist/storage/historyRepository.js.map

@@ -1 +1 @@
-{"version":3,"file":"historyRepository.js","sourceRoot":"","sources":["../../sources/storage/historyRepository.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACT,EAAE,CAAe;IAElC,YAAY,EAAgB;QACxB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACf,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,SAAS,CAAgC,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACf,OAAO,CACJ;;;;;;aAMH,CACA;aACA,GAAG,CAAC,OAAO,CAAgC,CAAC;QAEjD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAA0B;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACJ;;;aAGH,CACA;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACf,OAAO,CAAC,+EAA+E,CAAC;aACxF,GAAG,CAAC,SAAS,EAAE,OAAO,CAAgC,CAAC;QAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aACd,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,SAAS,CAAuC,CAAC;QAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACJ;AAED,SAAS,YAAY,CAAC,GAA8B;IAChD,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;QAC7D,OAAO;YACH,IAAI,EAAE,GAAG,CAAC,IAAkC;YAC5C,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,IAAI;SACY,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}
+{"version":3,"file":"historyRepository.js","sourceRoot":"","sources":["../../sources/storage/historyRepository.ts"],"names":[],"mappings":"AAIA;;;GAGG;AACH,MAAM,OAAO,iBAAiB;IACT,EAAE,CAAe;IAElC,YAAY,EAAgB;QACxB,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;IACjB,CAAC;IAED,KAAK,CAAC,eAAe,CAAC,SAAiB;QACnC,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACf,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,SAAS,CAAgC,CAAC;QAEnD,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED,KAAK,CAAC,aAAa,CAAC,OAAe,EAAE,KAAc;QAC/C,MAAM,GAAG,GAAG;;;;;;gBAMJ,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE;aAC9C,CAAC;QACN,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,OAAO,CAAgC,CAAC;QAE9E,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,MAAM,CAAC,SAAiB,EAAE,MAA0B;QACtD,MAAM,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,MAAM,CAAC;QACrC,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;aACjB,OAAO,CACJ;;;aAGH,CACA;aACA,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;QACpD,OAAO,MAAM,CAAC,MAAM,CAAC,eAAe,CAAC,CAAC;IAC1C,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,WAAW,CAAC,SAAiB,EAAE,OAAe;QAChD,MAAM,IAAI,GAAG,IAAI,CAAC,EAAE;aACf,OAAO,CAAC,+EAA+E,CAAC;aACxF,GAAG,CAAC,SAAS,EAAE,OAAO,CAAgC,CAAC;QAC5D,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,EAAgC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAClH,CAAC;IAED;;;OAGG;IACH,KAAK,CAAC,KAAK,CAAC,SAAiB;QACzB,MAAM,GAAG,GAAG,IAAI,CAAC,EAAE;aACd,OAAO,CAAC,oEAAoE,CAAC;aAC7E,GAAG,CAAC,SAAS,CAAuC,CAAC;QAC1D,OAAO,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3D,CAAC;CACJ;AAED,SAAS,YAAY,CAAC,GAA8B;IAChD,IAAI,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAA4B,CAAC;QAC7D,OAAO;YACH,IAAI,EAAE,GAAG,CAAC,IAAkC;YAC5C,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,GAAG,IAAI;SACY,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACL,OAAO,IAAI,CAAC;IAChB,CAAC;AACL,CAAC"}

package/dist/storage/processesRepository.js

@@ -315,7 +315,8 @@ function processRecordClone(record) {
         allowedDomains: [...record.allowedDomains],
         permissions: {
             ...record.permissions,
-            writeDirs: [...record.permissions.writeDirs]
+            writeDirs: [...record.permissions.writeDirs],
+            readDirs: [...(record.permissions.readDirs ?? [])]
         },
         owner: record.owner ? { ...record.owner } : null
     };
@@ -354,15 +355,20 @@ function permissionsParse(raw) {
         if (typeof parsed.workingDir !== "string" || !Array.isArray(parsed.writeDirs)) {
             throw new Error("Invalid permissions");
         }
+        const readDirs = Array.isArray(parsed.readDirs)
+            ? parsed.readDirs.filter((entry) => typeof entry === "string")
+            : [];
         return {
             workingDir: parsed.workingDir,
-            writeDirs: parsed.writeDirs.filter((entry) => typeof entry === "string")
+            writeDirs: parsed.writeDirs.filter((entry) => typeof entry === "string"),
+            readDirs
         };
     }
     catch {
         return {
             workingDir: "/",
-            writeDirs: []
+            writeDirs: [],
+            readDirs: []
         };
     }
 }