gooseworks 0.4.2 → 0.5.0-dev.3.8661ef81

package/README.md

@@ -4,27 +4,44 @@ Put your AI agent on the growth team. GooseWorks gives Claude Code, Cursor, and
 
 ## Install
 
-Pick your agent:
+**Paste this into your agent** (Claude Code, Cursor, Codex, or a chat app like Claude or ChatGPT):
+
+```text
+Install gooseworks: https://gooseworks.ai/install.md
+```
+
+Your agent reads that page and follows it. The page is short and you can read it too. It makes the agent:
+
+1. **Ask you first.** It says exactly what it will install and waits for your OK. The install touches your agent's skills folder, its MCP config and `~/.gooseworks/credentials.json`, nothing else, and only ever runs `npx gooseworks@latest …`.
+2. **Install** the GooseWorks skills and register the `gooseworks` MCP server with the right flag for your agent (`--claude`, `--cursor`, `--codex`), always with `--mcp`.
+3. **Sign you in** with Google in your browser (the URL is always printed too).
+4. **Check the install** with `npx gooseworks@latest doctor` and tell you to restart the agent so the MCP tools load.
+5. **Set up your company** after the restart: it asks for your website and saves what it learns as a reusable **Company Brain** that improves every later research, creative, and growth task.
+
+Want a specific skill too? Say so: `Install gooseworks: https://gooseworks.ai/install.md, including the goose-graphics skill.`
+
+If your agent cannot run terminal commands (claude.ai, ChatGPT), the page tells it to give you the MCP connector address (`https://mcp.gooseworks.ai/mcp`) instead.
+
+### Run it yourself
+
+Prefer the terminal? Pick your agent (keep `--mcp`; `--all` includes it):
 
 ```bash
 # Claude Code
-npx gooseworks install --claude --mcp
-npx gooseworks install --claude --mcp --with goose-graphics
+npx gooseworks@latest install --claude --mcp
+npx gooseworks@latest install --claude --mcp --with goose-graphics
 
 # Cursor
-npx gooseworks install --cursor --mcp
+npx gooseworks@latest install --cursor --mcp
 
 # Codex
-npx gooseworks install --codex --mcp
+npx gooseworks@latest install --codex --mcp
 
 # All detected agents
-npx gooseworks install --all
+npx gooseworks@latest install --all
 ```
 
-This does three things:
-1. Opens browser for Google sign-in
-2. Installs the GooseWorks skill into your coding agent
-3. You're ready — ask your agent to "scrape reddit", "find leads", "research competitors", or "create product photos"
+Restart your coding agent afterwards (MCP servers are only read at startup), then ask it to "scrape reddit", "find leads", "research competitors", or "create product photos".
 
 You do not need a special onboarding command. Ask GooseWorks to do a normal task, or say:
 
@@ -152,12 +169,20 @@ Credits: 847 available (500 subscription + 347 purchased)
 
 ### `update`
 
-Re-fetch the latest skill without re-authenticating.
+Refresh the entry instructions bundled in your installed CLI without re-authenticating.
+The command checks the published release first and refuses to reinstall a known older CLI
+bundle. Edited or untracked entry files and standalone recipe packages are preserved.
 
 ```bash
+npx gooseworks skills status
 npx gooseworks update
 ```
 
+Use `gooseworks skills status --json` for release, bundle and actual-file hashes. Upgrade an
+outdated CLI with `npm install -g gooseworks@latest` before updating its entries. Review and
+back up local edits before explicitly using `gooseworks update --overwrite-modified`.
+An unavailable release check means freshness is unknown, not current.
+
 ## How It Works
 
 1. **Install** — authenticates you and installs a master skill file into your coding agent
@@ -184,7 +209,7 @@ For focused creative work you can also use:
 
 - `/goose-ads` for static ads, ad research, and ad performance.
 - `/goose-product-photos` for studio, lifestyle, marketplace, social, and on-model product photography.
-- `/goose-video` to order a video ad in chat (renders on the GooseWorks server).
+- `/goose-video` to pick a video format and make the ad on this machine (Claude Code, Codex or Cursor).
 - `/goose-video-local` to render a video project you started in the app, on this machine.
 - `goose-graphics` for social graphics, carousels, slides, and branded visual content.
 - `animate-image` to turn an approved still into a short motion creative.
@@ -214,7 +239,7 @@ npx gooseworks call scrapecreators /v1/facebook/adLibrary/search/ads \
 
 We'd rather you know exactly what this CLI does before you run it:
 
-- **Skill scripts are open source and fetched at runtime.** `gooseworks fetch <slug>` (and the skills that call it) download skill content and Python scripts from the GooseWorks catalog on demand, save them under `/tmp/gooseworks-scripts/`, and run them on your machine. Every skill and its scripts live in the public, open-source [goose-skills repo](https://github.com/gooseworks-ai/goose-skills/tree/main/skills) — the catalog is synced from there — so the code is the same maintained, auditable source you can read on GitHub. They're served from the catalog (kept current) rather than pinned to the installed CLI version, so you always get the latest version of a skill.
+- **Skill scripts are open source and fetched at runtime.** `gooseworks fetch <slug>` (and the skills that call it) download skill content and Python scripts from the GooseWorks catalog on demand, save them under `/tmp/gooseworks-scripts/`, and run them on your machine. Every skill and its scripts live in the public, open-source [goose-skills repo](https://github.com/gooseworks-ai/goose-skills/tree/main/skills) — the catalog is synced from there — so the code is the same maintained, auditable source you can read on GitHub. They are served from the connected catalog rather than the installed CLI version. Saved copies retain the version/hash returned when fetched; compare them again for new work.
 - **The MCP server is opt-in.** It's only registered when you pass `--mcp` (or `--all`). When you do, the CLI adds a `gooseworks` entry to `~/.claude.json` (Claude Code) or `~/.codex/config.toml` (Codex) that includes your bearer token in an `Authorization` header — this is how every HTTP MCP server authenticates. Skip `--mcp` if you don't want the server registered as a live tool provider; shared onboarding and ads creation require it.
 - **Credentials are stored locally.** Your API key lives in `~/.gooseworks/credentials.json`, written with `0600` permissions in a `0700` directory. `gooseworks logout` deletes it.
 - **`gooseworks env` exposes your key.** `eval $(gooseworks env)` exports `GOOSEWORKS_API_KEY` into your shell environment, where any process you run can read it. Most commands (e.g. `gooseworks call`) load credentials on their own — only use `env` when a script genuinely needs the environment variable.
@@ -246,8 +271,8 @@ creative fatigue, CAC & lead quality, competitor ad intelligence, ad angles & ho
 `gooseworks` parent router also hands ad requests to it. Claude auto-loads whichever skill
 matches the task; the two are domain-scoped and never merged.
 
-> Renamed from `ads-remix`. Older installs get the stale `ads-remix` skill cleaned up
-> automatically on the next `install`.
+> Renamed from `ads-remix`. Install and update preserve legacy directories. If an
+> older `ads-remix` entry remains, review and back it up before removing it yourself.
 
 ```bash
 gooseworks install --claude --mcp
@@ -267,14 +292,37 @@ Generation is billed to your GooseWorks credits **server-side**: `submit_remix_b
 the estimated cost up front and bills only the images that complete. There's no separate
 ad-credit balance. Use `estimate_remix_batch` (cost preview) and `gooseworks credits` (balance).
 
+### Original videos and the shared harness
+
+The installed `make-custom-video` entry connects GooseWorks projects, authenticated
+script and ingredient approvals, budgets, media storage and delivery to the shared
+`video-production-harness` catalog skill. It contains no production playbook or
+assembly code. CLI, direct MCP and Growth fetch the same production package through
+the GooseWorks catalog; direct MCP clients do not need a local CLI.
+
+Production instructions are maintained in Goose Studio's existing control-plane
+harness. Tested Studio changes publish a generated package to `goose-skills`.
+Each run saves its fetched package in its durable workspace. Project metadata keeps
+only the version, hash and package location; resuming uses the saved package instead
+of changing instructions during production. An unavailable package blocks
+generation. New runs use the currently published catalog version.
+
 ### Keeping skills up to date
 
-- **Entry skills** (`gooseworks`, `goose-ads`) are vendored in the CLI. They're (re)installed
-  on `install`/`update`, and **refreshed on `login`** — but only when their content actually
-  changed (a content-hash stamp skips unchanged ones, so re-running is cheap). Bump the CLI
-  (`npx gooseworks@latest …`) to get new entry-skill content.
-- **Recipe skills** (e.g. ad-analytics like `meta-ads-analyzer`) are **fetched live** from
-  goose-skills each time they're used, so they're always current — nothing to update.
+- **Entry skills** are bundled in the CLI. `skills status` compares their actual installed bytes,
+  bundled bytes and the integrity-verified published npm package. Install/update/login warn
+  about an outdated CLI, different instructions, modified files or an unavailable release check.
+  They preserve edited or untracked files by default. A development build ahead of the release
+  is reported as unreleased; it is not silently downgraded.
+- **Saved recipe packages** use the connected catalog's `version` / `contentHash` and dependency
+  hashes. `gooseworks fetch <slug> --saved-package <json-file>` compares a saved fetch response
+  and returns the current package without replacing the file. Canonical MCP `catalog_fetch`
+  supports optional saved hashes when advertised; other hosts compare the returned hashes
+  themselves. The server cannot inspect a client's files, and reported hashes do not certify
+  later manual edits. Missing hashes mean unknown.
+- **Hosted snapshots** use the existing Skills Update action. Approved runs keep their recorded
+  package. Fetch into a new directory for new work; do not replace a running project's harness.
+  Updating skill content does not refresh a host's cached MCP tool schemas.
 
 ## File Layout
 

package/dist/agents/staging.d.ts

@@ -0,0 +1,38 @@
+export { stagingContent } from '../skills/staging-content';
+export type StagingAgent = 'claude' | 'codex';
+interface Manifest {
+    environment: 'staging';
+    project: string;
+    version: string;
+    sourceBranch: 'dev';
+    sourceRevision: string | null;
+    mcpEndpoint: string;
+    agents: StagingAgent[];
+    skills: Record<string, string>;
+}
+export declare function projectProfile(project: string): {
+    project: string;
+    root: string;
+    home: string;
+    manifest: string;
+};
+/** Project/parent customizations could reintroduce a production plugin or MCP. */
+export declare function assertCleanProject(project: string): void;
+export declare function installStagingProject(project: string, agents: string[]): Manifest;
+export declare function stagingLaunch(project: string, agent: string): {
+    command: string;
+    args: string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    manifest: Manifest;
+};
+/** Read Claude's startup event and stop before a model request (no provider credential needed). */
+export declare function inspectClaudeSkills(launch: ReturnType<typeof stagingLaunch>): Promise<string[]>;
+/** Real, free Codex discovery. Refuse incompatible versions before starting a session. */
+export declare function inspectCodexSkills(launch: ReturnType<typeof stagingLaunch>): Promise<Array<{
+    name: string;
+    path: string;
+    enabled: boolean;
+}>>;
+//# sourceMappingURL=staging.d.ts.map

package/dist/agents/staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.d.ts","sourceRoot":"","sources":["../../src/agents/staging.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC9C,UAAU,QAAQ;IAAG,WAAW,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAAE;AAGjN,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMjH;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAWxD;AAQD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CA+BjF;AAYD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CA0BxK;AAiBD,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2B/F;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CA8C7I"}

package/dist/agents/staging.js

@@ -0,0 +1,309 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stagingContent = void 0;
+exports.projectProfile = projectProfile;
+exports.assertCleanProject = assertCleanProject;
+exports.installStagingProject = installStagingProject;
+exports.stagingLaunch = stagingLaunch;
+exports.inspectClaudeSkills = inspectClaudeSkills;
+exports.inspectCodexSkills = inspectCodexSkills;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const credentials_1 = require("../auth/credentials");
+const environment_1 = require("../environment");
+const installer_1 = require("../skills/installer");
+const version_1 = require("../version");
+var staging_content_1 = require("../skills/staging-content");
+Object.defineProperty(exports, "stagingContent", { enumerable: true, get: function () { return staging_content_1.stagingContent; } });
+const hash = (value) => (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+function projectProfile(project) {
+    if (!project)
+        throw new Error('Staging requires --project <folder>');
+    const resolved = fs.realpathSync(path.resolve(project));
+    if (!fs.statSync(resolved).isDirectory())
+        throw new Error('--project must be a directory');
+    const root = path.join((0, environment_1.profileRoot)(), 'projects', hash(resolved).slice(0, 20));
+    return { project: resolved, root, home: path.join(root, 'home'), manifest: path.join(root, 'manifest.json') };
+}
+/** Project/parent customizations could reintroduce a production plugin or MCP. */
+function assertCleanProject(project) {
+    const userHome = fs.realpathSync(process.env.GOOSEWORKS_USER_HOME || os.homedir());
+    for (let dir = project;; dir = path.dirname(dir)) {
+        // User-global roots are excluded by the child home; they must stay installed.
+        if (dir !== userHome) {
+            for (const name of ['.claude', '.codex', '.agents', '.cursor', '.mcp.json']) {
+                if (fs.existsSync(path.join(dir, name)))
+                    throw new Error(`Staging cannot safely load project customization ${path.join(dir, name)}. Use a clean test folder outside that project tree.`);
+            }
+        }
+        if (path.dirname(dir) === dir)
+            break;
+    }
+}
+function privateWrite(file, body, mode = 0o600) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink())
+        throw new Error(`Refusing linked staging config: ${file}`);
+    fs.writeFileSync(file, body, { mode });
+    fs.chmodSync(file, mode);
+}
+function installStagingProject(project, agents) {
+    if ((0, environment_1.getEnvironment)() !== 'staging')
+        throw new Error('Project isolation is available with --env staging');
+    if (!agents.length || agents.some(agent => !['claude', 'codex'].includes(agent)))
+        throw new Error('Staging supports --claude and --codex. Cursor staging is refused until its skill isolation can be verified.');
+    const profile = projectProfile(project);
+    assertCleanProject(profile.project);
+    if (fs.existsSync(profile.manifest)) {
+        const previous = JSON.parse(fs.readFileSync(profile.manifest, 'utf8'));
+        for (const agent of previous.agents)
+            stagingLaunch(project, agent);
+    }
+    const credentials = (0, credentials_1.getCredentials)();
+    if (!credentials?.mcp_server_url)
+        throw new Error('Staging requires a staging GooseWorks login with an MCP connection. Run gooseworks --env staging login.');
+    const skills = {};
+    const source = (0, installer_1.getSkillsBasePath)();
+    for (const name of fs.readdirSync(source)) {
+        if (name.startsWith('.'))
+            continue;
+        const directory = path.join(source, name);
+        if (!fs.statSync(directory).isDirectory() || !fs.existsSync(path.join(directory, 'SKILL.md')))
+            continue;
+        if (fs.lstatSync(directory).isSymbolicLink())
+            throw new Error(`Linked staging package refused: ${name}`);
+        for (const agent of agents) {
+            const target = path.join(profile.home, `.${agent}`, 'skills', name);
+            // Refuse edits instead of silently destroying previously tested instructions.
+            if (fs.existsSync(target))
+                fs.rmSync(target, { recursive: true });
+            fs.cpSync(directory, target, { recursive: true, dereference: false });
+        }
+        skills[name] = treeHash(directory);
+    }
+    if (!skills.gooseworks)
+        throw new Error('Install the bundled staging entry skills first');
+    const pkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, '..', '..', 'package.json'), 'utf8'));
+    const manifest = { environment: 'staging', project: profile.project, version: (0, version_1.getVersion)(), sourceBranch: 'dev', sourceRevision: pkg.gooseworksRelease?.commit || null, mcpEndpoint: credentials.mcp_server_url, agents: agents, skills };
+    privateWrite(profile.manifest, JSON.stringify(manifest, null, 2) + '\n');
+    writeConnections(profile.home, credentials);
+    return manifest;
+}
+function writeConnections(home, credentials) {
+    const endpoint = credentials.mcp_server_url.replace(/\/$/, '');
+    const url = endpoint.endsWith('/mcp') ? endpoint : `${endpoint}/mcp`;
+    privateWrite(path.join(home, 'mcp.json'), JSON.stringify({ mcpServers: { 'gooseworks-staging': { type: 'http', url, headers: { Authorization: `Bearer ${credentials.api_key}` } } } }));
+    // Codex shells can otherwise filter custom environment variables or reset PATH.
+    const pinned = { HOME: home, GOOSEWORKS_USER_HOME: process.env.GOOSEWORKS_USER_HOME || os.homedir(), GOOSEWORKS_SESSION_ENV: 'staging', GOOSEWORKS_API_BASE: credentials.api_base, PATH: `${path.join(home, 'bin')}${path.delimiter}${process.env.PATH || ''}` };
+    const shell = Object.entries(pinned).map(([key, value]) => `${key} = ${JSON.stringify(value)}`).join('\n');
+    privateWrite(path.join(home, '.codex', 'config.toml'), `allow_login_shell = false\n[shell_environment_policy]\ninherit = "all"\n[shell_environment_policy.set]\n${shell}\n[mcp_servers.gooseworks-staging]\nurl = ${JSON.stringify(url)}\n[mcp_servers.gooseworks-staging.http_headers]\nAuthorization = ${JSON.stringify(`Bearer ${credentials.api_key}`)}\n`);
+}
+function stagingLaunch(project, agent) {
+    if (!['claude', 'codex'].includes(agent))
+        throw new Error('Use --agent claude or --agent codex for an isolated staging session');
+    const profile = projectProfile(project);
+    assertCleanProject(profile.project);
+    const manifest = JSON.parse(fs.readFileSync(profile.manifest, 'utf8'));
+    if (manifest.environment !== 'staging' || manifest.project !== profile.project || !manifest.agents.includes(agent))
+        throw new Error('Project/environment mismatch. Install staging for this project and agent first.');
+    const root = path.join(profile.home, `.${agent}`, 'skills');
+    const actual = fs.readdirSync(root).filter(name => !name.startsWith('.'));
+    if (actual.length !== Object.keys(manifest.skills).length)
+        throw new Error('Unexpected skill in staging profile; reinstall into a fresh test folder');
+    for (const [name, expected] of Object.entries(manifest.skills)) {
+        const file = path.join(root, name, 'SKILL.md');
+        if (treeHash(path.dirname(file)) !== expected)
+            throw new Error(`Staging skill changed or linked: ${name}. Review it and install into a fresh test folder.`);
+    }
+    const credentials = (0, credentials_1.getCredentials)();
+    if (!credentials?.mcp_server_url)
+        throw new Error('Sign in to staging again before launching');
+    writeConnections(profile.home, credentials);
+    const env = { ...process.env };
+    // Do not carry production Goose tokens, custom provider homes, or daemon handles.
+    for (const key of Object.keys(env))
+        if (/^(GOOSEWORKS_|CODEX_|CLAUDE_|CLAUDECODE$|CURSOR_|XDG_)/.test(key))
+            delete env[key];
+    Object.assign(env, { HOME: profile.home, USERPROFILE: profile.home, XDG_CONFIG_HOME: path.join(profile.home, '.config'), XDG_DATA_HOME: path.join(profile.home, '.local', 'share'), CODEX_HOME: path.join(profile.home, '.codex'), CLAUDE_CONFIG_DIR: path.join(profile.home, '.claude'), GOOSEWORKS_USER_HOME: process.env.GOOSEWORKS_USER_HOME || os.homedir(), GOOSEWORKS_SESSION_ENV: 'staging', GOOSEWORKS_API_BASE: credentials.api_base });
+    // Use this exact CLI build inside the agent, even if its PATH has an older global CLI.
+    const bin = path.join(profile.home, 'bin');
+    if (process.platform === 'win32')
+        throw new Error('Isolated staging launch currently requires macOS or Linux');
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    privateWrite(path.join(bin, 'gooseworks'), `#!/bin/sh\nGOOSEWORKS_SESSION_ENV=staging\nexport GOOSEWORKS_SESSION_ENV\nexec ${quote(process.execPath)} ${quote(path.resolve(__dirname, '..', 'index.js'))} "$@"\n`, 0o700);
+    env.PATH = `${bin}${path.delimiter}${process.env.PATH || ''}`;
+    return { command: agent, cwd: profile.project, env, home: profile.home, manifest, args: agent === 'claude' ? ['--setting-sources', 'user', '--strict-mcp-config', '--mcp-config', path.join(profile.home, 'mcp.json')] : ['--cd', profile.project] };
+}
+function treeHash(directory) {
+    const digest = (0, node_crypto_1.createHash)('sha256');
+    function visit(dir) {
+        for (const name of fs.readdirSync(dir).sort()) {
+            const file = path.join(dir, name);
+            const stat = fs.lstatSync(file);
+            if (stat.isSymbolicLink())
+                throw new Error(`Linked staging package file refused: ${file}`);
+            digest.update(path.relative(directory, file) + '\0');
+            if (stat.isDirectory())
+                visit(file);
+            else if (stat.isFile())
+                digest.update(fs.readFileSync(file));
+            else
+                throw new Error(`Unsupported staging package file: ${file}`);
+        }
+    }
+    visit(directory);
+    return digest.digest('hex');
+}
+/** Read Claude's startup event and stop before a model request (no provider credential needed). */
+function inspectClaudeSkills(launch) {
+    return new Promise((resolve, reject) => {
+        const env = { ...launch.env, ANTHROPIC_API_KEY: 'sk-ant-gooseworks-inventory-invalid-key' };
+        // Inventory must never use a real billable provider connection.
+        for (const key of Object.keys(env))
+            if (/^(ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_|AWS_|GOOGLE_|AZURE_)/.test(key))
+                delete env[key];
+        const child = (0, node_child_process_1.spawn)('claude', [...launch.args, '-p', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose'], { cwd: launch.cwd, env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let finished = false;
+        let buffer = '';
+        const finish = (error, skills) => { if (finished)
+            return; finished = true; clearTimeout(timer); child.kill(); error ? reject(error) : resolve(skills); };
+        const timer = setTimeout(() => finish(new Error('Claude startup inventory timed out; update Claude and retry')), 30000);
+        child.on('error', error => finish(error));
+        child.on('exit', () => { if (!finished)
+            finish(new Error('Claude did not provide its skill inventory; update Claude')); });
+        child.stderr.on('data', () => undefined);
+        child.stdout.on('data', data => {
+            buffer += data;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Invalid Claude startup event'));
+            let end;
+            while ((end = buffer.indexOf('\n')) >= 0) {
+                let message;
+                try {
+                    message = JSON.parse(buffer.slice(0, end));
+                }
+                catch {
+                    buffer = buffer.slice(end + 1);
+                    continue;
+                }
+                buffer = buffer.slice(end + 1);
+                if (message.type !== 'system' || message.subtype !== 'init')
+                    continue;
+                if (!Array.isArray(message.skills) || !Array.isArray(message.plugins) || !Array.isArray(message.mcp_servers))
+                    return finish(new Error('Incompatible Claude startup inventory'));
+                const expected = Object.keys(launch.manifest.skills);
+                if (expected.some(name => !message.skills.includes(name)) || message.skills.some((name) => /^(goose|make-custom-video)/.test(name) && !expected.includes(name)) || message.plugins.length || message.mcp_servers.some((server) => server.name !== 'gooseworks-staging'))
+                    return finish(new Error('Claude loaded an unexpected skill, plugin, or MCP. Staging launch refused.'));
+                finish(undefined, message.skills);
+            }
+        });
+        child.stdin.write(JSON.stringify({ type: 'user', message: { role: 'user', content: '/skills' } }) + '\n');
+    });
+}
+/** Real, free Codex discovery. Refuse incompatible versions before starting a session. */
+function inspectCodexSkills(launch) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)('codex', ['app-server'], { cwd: launch.cwd, env: launch.env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let buffer = '';
+        let finished = false;
+        let inventory;
+        let configVerified = false;
+        const finish = (error, skills) => { if (finished)
+            return; finished = true; clearTimeout(timer); child.kill(); error ? reject(error) : resolve(skills); };
+        const timer = setTimeout(() => finish(new Error('Codex skill isolation check timed out; update Codex and retry')), 15000);
+        child.on('error', error => finish(error));
+        child.on('exit', () => { if (!finished)
+            finish(new Error('Codex does not support the staging inventory check; update Codex')); });
+        child.stderr.on('data', () => undefined);
+        child.stdout.on('data', data => {
+            buffer += data;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Invalid Codex inventory response'));
+            let end;
+            while ((end = buffer.indexOf('\n')) >= 0) {
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                let message;
+                try {
+                    message = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (message.error)
+                    return finish(new Error('Codex rejected the staging inventory check; update Codex'));
+                if (message.id === 1) {
+                    child.stdin.write(JSON.stringify({ method: 'initialized' }) + '\n');
+                    child.stdin.write(JSON.stringify({ id: 2, method: 'skills/list', params: { cwds: [launch.cwd], forceReload: true } }) + '\n');
+                    child.stdin.write(JSON.stringify({ id: 3, method: 'config/read', params: { cwd: launch.cwd, includeLayers: false } }) + '\n');
+                }
+                if (message.id === 2) {
+                    const rows = message.result?.data;
+                    if (!Array.isArray(rows) || rows.some(row => row.errors?.length))
+                        return finish(new Error('Could not read the complete Codex skill inventory'));
+                    const skills = rows.flatMap(row => row.skills || []).filter(skill => skill.enabled);
+                    const allowed = fs.realpathSync(launch.home) + path.sep;
+                    if (skills.some(skill => !fs.realpathSync(skill.path).startsWith(allowed)))
+                        return finish(new Error('Codex discovered skills outside the staging profile. Launch refused.'));
+                    const names = new Set(skills.map(skill => skill.name));
+                    if (Object.keys(launch.manifest.skills).some(name => !names.has(name)))
+                        return finish(new Error('Codex did not load all staging skills. Launch refused.'));
+                    inventory = skills.map(skill => ({ name: skill.name, path: skill.path, enabled: skill.enabled }));
+                    if (configVerified)
+                        finish(undefined, inventory);
+                }
+                if (message.id === 3) {
+                    const servers = message.result?.config?.mcp_servers;
+                    const endpoint = launch.manifest.mcpEndpoint.replace(/\/$/, '');
+                    const expectedUrl = endpoint.endsWith('/mcp') ? endpoint : `${endpoint}/mcp`;
+                    if (!servers || Object.keys(servers).length !== 1 || !servers['gooseworks-staging'] || servers['gooseworks-staging'].url !== expectedUrl)
+                        return finish(new Error('Codex effective MCP configuration is not isolated to staging. Launch refused.'));
+                    const plugins = message.result?.config?.plugins;
+                    if (plugins && Object.values(plugins).some((plugin) => plugin?.enabled !== false))
+                        return finish(new Error('Codex loaded unexpected plugin configuration. Launch refused.'));
+                    configVerified = true;
+                    if (inventory)
+                        finish(undefined, inventory);
+                }
+            }
+        });
+        child.stdin.write(JSON.stringify({ id: 1, method: 'initialize', params: { clientInfo: { name: 'gooseworks-staging-check', version: (0, version_1.getVersion)() } } }) + '\n');
+    });
+}
+//# sourceMappingURL=staging.js.map

package/dist/agents/staging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.js","sourceRoot":"","sources":["../../src/agents/staging.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,wCAMC;AAGD,gDAWC;AAQD,sDA+BC;AAYD,sCA0BC;AAkBD,kDA2BC;AAGD,gDA8CC;AA9MD,4CAA8B;AAC9B,gDAAkC;AAClC,4CAA8B;AAC9B,6CAAyC;AACzC,2DAA2C;AAC3C,qDAAqD;AACrD,gDAA6D;AAC7D,mDAAwD;AACxD,wCAAwC;AACxC,6DAA2D;AAAlD,iHAAA,cAAc,OAAA;AAIvB,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1F,SAAgB,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAW,GAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kBAAkB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,KAAK,IAAI,GAAG,GAAG,OAAO,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,8EAA8E;QAC9E,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC3L,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,MAAM;IACvC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,KAAK;IAC5D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAChI,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAe,EAAE,MAAgB;IACrE,IAAI,IAAA,4BAAc,GAAE,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACjN,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM;YAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,4BAAc,GAAE,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7J,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAA,6BAAiB,GAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAAE,SAAS;QACxG,IAAI,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QACzG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpE,8EAA8E;YAC9E,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAa,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAA,oBAAU,GAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,MAAM,IAAI,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAwB,EAAE,MAAM,EAAE,CAAC;IACtQ,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,WAA2D;IACjG,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,MAAM,CAAC;IACrE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxL,gFAAgF;IAChF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;IACjQ,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,2GAA2G,KAAK,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oEAAoE,IAAI,CAAC,SAAS,CAAC,UAAU,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AAClW,CAAC;AAED,SAAgB,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAqB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACvO,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACtJ,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,mDAAmD,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,4BAAc,GAAE,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/F,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,kFAAkF;IAClF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5H,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClb,uFAAuF;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;IACvE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,kFAAkF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1N,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,EAAE,qBAAqB,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AACvP,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IACpC,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAC3F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;;gBACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,mGAAmG;AACnG,SAAgB,mBAAmB,CAAC,MAAwC;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAsB,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,EAAE,CAAC;QAC/G,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,iFAAiF,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrJ,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjM,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,MAAM,GAAG,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAiB,EAAE,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7K,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YAC7B,MAAM,IAAI,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YAC9G,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAY,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM;oBAAE,SAAS;gBACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAChL,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC,CAAC;gBAC7X,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAgB,kBAAkB,CAAC,MAAwC;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpH,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,SAA4B,CAAC;QAAC,IAAI,cAAc,GAAG,KAAK,CAAC;QACpG,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1K,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1H,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YAC7B,MAAM,IAAI,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAClH,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAClE,IAAI,OAAY,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,KAAK;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC,CAAC;gBACxG,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBACpE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9H,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChI,CAAC;gBACD,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;oBAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;oBAChJ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACpF,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;oBACxD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;oBAC7K,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;oBAC3J,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAClG,IAAI,cAAc;wBAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACnD,CAAC;gBACD,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;oBACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,MAAM,CAAC;oBAC7E,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,KAAK,WAAW;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC,CAAC;oBACpP,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;oBAChD,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,CAAC;oBAClL,cAAc,GAAG,IAAI,CAAC;oBACtB,IAAI,SAAS;wBAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAA,oBAAU,GAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/credentials.d.ts

@@ -11,6 +11,7 @@ export interface Credentials {
     /** Base URL for the GooseWorks MCP server (e.g. http://localhost:6200 in dev). */
     mcp_server_url?: string;
 }
+export declare function validateCredentials(creds: Credentials): void;
 export declare function getCredentials(): Credentials | null;
 export declare function saveCredentials(creds: Credentials): void;
 export declare function clearCredentials(): void;

package/dist/auth/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAcnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CASxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAGzC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAGnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAG5D;AAED,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAgBnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAcxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAUvC;AAED,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAGzC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAGnC"}

package/dist/auth/credentials.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCredentials = validateCredentials;
 exports.getCredentials = getCredentials;
 exports.saveCredentials = saveCredentials;
 exports.clearCredentials = clearCredentials;
@@ -42,35 +43,52 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const config_1 = require("../config");
-const CREDENTIALS_DIR = path.join(os.homedir(), '.gooseworks');
-const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
+const environment_1 = require("../environment");
+function credentialsFile() { return path.join((0, environment_1.profileRoot)(), 'credentials.json'); }
+const LEGACY_FILE = path.join(os.homedir(), '.gooseworks', 'credentials.json');
+function validateCredentials(creds) {
+    (0, environment_1.assertConnection)(creds.api_base, 'api');
+    if (creds.mcp_server_url)
+        (0, environment_1.assertConnection)(creds.mcp_server_url, 'mcp');
+}
 function getCredentials() {
+    let parsed;
     try {
-        if (!fs.existsSync(CREDENTIALS_FILE)) {
+        const file = fs.existsSync(credentialsFile()) ? credentialsFile()
+            : (0, environment_1.getEnvironment)() === 'production' && fs.existsSync(LEGACY_FILE) ? LEGACY_FILE : null;
+        if (!file)
             return null;
-        }
-        const raw = fs.readFileSync(CREDENTIALS_FILE, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (!parsed.api_key || !parsed.email || !parsed.agent_id) {
+        parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        if (!parsed.api_key || !parsed.email || !parsed.agent_id || !parsed.api_base) {
             return null;
         }
-        return parsed;
     }
     catch {
         return null;
     }
+    // A mismatched saved login is an error, never an excuse to use another profile.
+    validateCredentials(parsed);
+    return parsed;
 }
 function saveCredentials(creds) {
+    validateCredentials(creds);
+    const CREDENTIALS_DIR = (0, environment_1.profileRoot)();
+    const CREDENTIALS_FILE = credentialsFile();
     if (!fs.existsSync(CREDENTIALS_DIR)) {
         fs.mkdirSync(CREDENTIALS_DIR, { mode: 0o700, recursive: true });
     }
     fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    fs.chmodSync(CREDENTIALS_DIR, 0o700);
+    fs.chmodSync(CREDENTIALS_FILE, 0o600);
 }
 function clearCredentials() {
+    const CREDENTIALS_FILE = credentialsFile();
     try {
         if (fs.existsSync(CREDENTIALS_FILE)) {
             fs.unlinkSync(CREDENTIALS_FILE);
         }
+        if ((0, environment_1.getEnvironment)() === 'production' && fs.existsSync(LEGACY_FILE))
+            fs.unlinkSync(LEGACY_FILE);
     }
     catch {
         // Ignore errors during cleanup