gooseworks 0.4.4 → 0.4.5-dev.15.facf60fb

package/README.md

@@ -4,27 +4,44 @@ Put your AI agent on the growth team. GooseWorks gives Claude Code, Cursor, and
 
 ## Install
 
-Pick your agent:
+**Paste this into your agent** (Claude Code, Cursor, Codex, or a chat app like Claude or ChatGPT):
+
+```text
+Install gooseworks: https://gooseworks.ai/install.md
+```
+
+Your agent reads that page and follows it. The page is short and you can read it too. It makes the agent:
+
+1. **Ask you first.** It says exactly what it will install and waits for your OK. The install touches your agent's skills folder, its MCP config and `~/.gooseworks/credentials.json`, nothing else, and only ever runs `npx gooseworks@latest …`.
+2. **Install** the GooseWorks skills and register the `gooseworks` MCP server with the right flag for your agent (`--claude`, `--cursor`, `--codex`), always with `--mcp`.
+3. **Sign you in** with Google in your browser (the URL is always printed too).
+4. **Check the install** with `npx gooseworks@latest doctor` and tell you to restart the agent so the MCP tools load.
+5. **Set up your company** after the restart: it asks for your website and saves what it learns as a reusable **Company Brain** that improves every later research, creative, and growth task.
+
+Want a specific skill too? Say so: `Install gooseworks: https://gooseworks.ai/install.md, including the goose-graphics skill.`
+
+If your agent cannot run terminal commands (claude.ai, ChatGPT), the page tells it to give you the MCP connector address (`https://mcp.gooseworks.ai/mcp`) instead.
+
+### Run it yourself
+
+Prefer the terminal? Pick your agent (keep `--mcp`; `--all` includes it):
 
 ```bash
 # Claude Code
-npx gooseworks install --claude --mcp
-npx gooseworks install --claude --mcp --with goose-graphics
+npx gooseworks@latest install --claude --mcp
+npx gooseworks@latest install --claude --mcp --with goose-graphics
 
 # Cursor
-npx gooseworks install --cursor --mcp
+npx gooseworks@latest install --cursor --mcp
 
 # Codex
-npx gooseworks install --codex --mcp
+npx gooseworks@latest install --codex --mcp
 
 # All detected agents
-npx gooseworks install --all
+npx gooseworks@latest install --all
 ```
 
-This does three things:
-1. Opens browser for Google sign-in
-2. Installs the GooseWorks skill into your coding agent
-3. You're ready — ask your agent to "scrape reddit", "find leads", "research competitors", or "create product photos"
+Restart your coding agent afterwards (MCP servers are only read at startup), then ask it to "scrape reddit", "find leads", "research competitors", or "create product photos".
 
 You do not need a special onboarding command. Ask GooseWorks to do a normal task, or say:
 
@@ -90,7 +107,9 @@ npx gooseworks login
 3. You sign in with Google
 4. Token saved to `~/.gooseworks/credentials.json`
 
-Timeout: 120 seconds. If the browser doesn't complete, re-run the command.
+Timeout: 5 minutes. The sign-in link is always printed, so you can open it yourself if no browser opens.
+
+**Cloud agents, SSH and CI** (the browser is on another device): run `npx gooseworks login --device`. It prints a link and a code; open the link on any device, sign in and tap **Approve**, and the CLI finishes on its own. The CLI picks this mode by itself over SSH, in CI, in containers and on Linux with no display (`--browser` forces the browser flow). Agents whose shell only shows output when a command exits should add `--no-wait`: it prints the link and exits, and the next `gooseworks login` or `gooseworks install --skills-only` finishes the sign-in once you approve.
 
 ### `logout`
 
@@ -218,6 +237,18 @@ npx gooseworks call scrapecreators /v1/facebook/adLibrary/search/ads \
   --body='{"query":"running shoes","country":"US"}'
 ```
 
+### `tool`
+
+Call any GooseWorks tool (the same tools the GooseWorks MCP connector gives an agent) with your saved sign-in. It's meant for agents that have a shell but no connector, such as a cloud sandbox in ChatGPT agent, Meta AI or Grok:
+
+```bash
+npx gooseworks tool --list                                  # the server's rules + every tool
+npx gooseworks tool brand_onboarding --schema               # one tool's arguments
+npx gooseworks tool brand_onboarding '{"action":"status"}'  # call it
+```
+
+The result prints as JSON (`--json` prints the raw MCP result). Arguments can also come from a file (`--file args.json`) or stdin (`-`). It exits 1 when the tool reports an error. Paid tools follow the same rules as over the connector.
+
 ## Security & data handling
 
 We'd rather you know exactly what this CLI does before you run it:

package/dist/agents/staging.d.ts

@@ -0,0 +1,38 @@
+export { stagingContent } from '../skills/staging-content';
+export type StagingAgent = 'claude' | 'codex';
+interface Manifest {
+    environment: 'staging';
+    project: string;
+    version: string;
+    sourceBranch: 'dev';
+    sourceRevision: string | null;
+    mcpEndpoint: string;
+    agents: StagingAgent[];
+    skills: Record<string, string>;
+}
+export declare function projectProfile(project: string): {
+    project: string;
+    root: string;
+    home: string;
+    manifest: string;
+};
+/** Project/parent customizations could reintroduce a production plugin or MCP. */
+export declare function assertCleanProject(project: string): void;
+export declare function installStagingProject(project: string, agents: string[]): Manifest;
+export declare function stagingLaunch(project: string, agent: string): {
+    command: string;
+    args: string[];
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+    home: string;
+    manifest: Manifest;
+};
+/** Read Claude's startup event and stop before a model request (no provider credential needed). */
+export declare function inspectClaudeSkills(launch: ReturnType<typeof stagingLaunch>): Promise<string[]>;
+/** Real, free Codex discovery. Refuse incompatible versions before starting a session. */
+export declare function inspectCodexSkills(launch: ReturnType<typeof stagingLaunch>): Promise<Array<{
+    name: string;
+    path: string;
+    enabled: boolean;
+}>>;
+//# sourceMappingURL=staging.d.ts.map

package/dist/agents/staging.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.d.ts","sourceRoot":"","sources":["../../src/agents/staging.ts"],"names":[],"mappings":"AASA,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAE3D,MAAM,MAAM,YAAY,GAAG,QAAQ,GAAG,OAAO,CAAC;AAC9C,UAAU,QAAQ;IAAG,WAAW,EAAE,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,YAAY,EAAE,KAAK,CAAC;IAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAAE;AAGjN,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CAMjH;AAED,kFAAkF;AAClF,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAWxD;AAQD,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,QAAQ,CA+BjF;AAYD,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,QAAQ,CAAA;CAAE,CA0BxK;AAiBD,mGAAmG;AACnG,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,CAAC,CA2B/F;AAED,0FAA0F;AAC1F,wBAAgB,kBAAkB,CAAC,MAAM,EAAE,UAAU,CAAC,OAAO,aAAa,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAAC,CAAC,CA8C7I"}

package/dist/agents/staging.js

@@ -0,0 +1,309 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.stagingContent = void 0;
+exports.projectProfile = projectProfile;
+exports.assertCleanProject = assertCleanProject;
+exports.installStagingProject = installStagingProject;
+exports.stagingLaunch = stagingLaunch;
+exports.inspectClaudeSkills = inspectClaudeSkills;
+exports.inspectCodexSkills = inspectCodexSkills;
+const fs = __importStar(require("node:fs"));
+const path = __importStar(require("node:path"));
+const os = __importStar(require("node:os"));
+const node_crypto_1 = require("node:crypto");
+const node_child_process_1 = require("node:child_process");
+const credentials_1 = require("../auth/credentials");
+const environment_1 = require("../environment");
+const installer_1 = require("../skills/installer");
+const version_1 = require("../version");
+var staging_content_1 = require("../skills/staging-content");
+Object.defineProperty(exports, "stagingContent", { enumerable: true, get: function () { return staging_content_1.stagingContent; } });
+const hash = (value) => (0, node_crypto_1.createHash)('sha256').update(value).digest('hex');
+function projectProfile(project) {
+    if (!project)
+        throw new Error('Staging requires --project <folder>');
+    const resolved = fs.realpathSync(path.resolve(project));
+    if (!fs.statSync(resolved).isDirectory())
+        throw new Error('--project must be a directory');
+    const root = path.join((0, environment_1.profileRoot)(), 'projects', hash(resolved).slice(0, 20));
+    return { project: resolved, root, home: path.join(root, 'home'), manifest: path.join(root, 'manifest.json') };
+}
+/** Project/parent customizations could reintroduce a production plugin or MCP. */
+function assertCleanProject(project) {
+    const userHome = fs.realpathSync(process.env.GOOSEWORKS_USER_HOME || os.homedir());
+    for (let dir = project;; dir = path.dirname(dir)) {
+        // User-global roots are excluded by the child home; they must stay installed.
+        if (dir !== userHome) {
+            for (const name of ['.claude', '.codex', '.agents', '.cursor', '.mcp.json']) {
+                if (fs.existsSync(path.join(dir, name)))
+                    throw new Error(`Staging cannot safely load project customization ${path.join(dir, name)}. Use a clean test folder outside that project tree.`);
+            }
+        }
+        if (path.dirname(dir) === dir)
+            break;
+    }
+}
+function privateWrite(file, body, mode = 0o600) {
+    fs.mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });
+    if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink())
+        throw new Error(`Refusing linked staging config: ${file}`);
+    fs.writeFileSync(file, body, { mode });
+    fs.chmodSync(file, mode);
+}
+function installStagingProject(project, agents) {
+    if ((0, environment_1.getEnvironment)() !== 'staging')
+        throw new Error('Project isolation is available with --env staging');
+    if (!agents.length || agents.some(agent => !['claude', 'codex'].includes(agent)))
+        throw new Error('Staging supports --claude and --codex. Cursor staging is refused until its skill isolation can be verified.');
+    const profile = projectProfile(project);
+    assertCleanProject(profile.project);
+    if (fs.existsSync(profile.manifest)) {
+        const previous = JSON.parse(fs.readFileSync(profile.manifest, 'utf8'));
+        for (const agent of previous.agents)
+            stagingLaunch(project, agent);
+    }
+    const credentials = (0, credentials_1.getCredentials)();
+    if (!credentials?.mcp_server_url)
+        throw new Error('Staging requires a staging GooseWorks login with an MCP connection. Run gooseworks --env staging login.');
+    const skills = {};
+    const source = (0, installer_1.getSkillsBasePath)();
+    for (const name of fs.readdirSync(source)) {
+        if (name.startsWith('.'))
+            continue;
+        const directory = path.join(source, name);
+        if (!fs.statSync(directory).isDirectory() || !fs.existsSync(path.join(directory, 'SKILL.md')))
+            continue;
+        if (fs.lstatSync(directory).isSymbolicLink())
+            throw new Error(`Linked staging package refused: ${name}`);
+        for (const agent of agents) {
+            const target = path.join(profile.home, `.${agent}`, 'skills', name);
+            // Refuse edits instead of silently destroying previously tested instructions.
+            if (fs.existsSync(target))
+                fs.rmSync(target, { recursive: true });
+            fs.cpSync(directory, target, { recursive: true, dereference: false });
+        }
+        skills[name] = treeHash(directory);
+    }
+    if (!skills.gooseworks)
+        throw new Error('Install the bundled staging entry skills first');
+    const pkg = JSON.parse(fs.readFileSync(path.resolve(__dirname, '..', '..', 'package.json'), 'utf8'));
+    const manifest = { environment: 'staging', project: profile.project, version: (0, version_1.getVersion)(), sourceBranch: 'dev', sourceRevision: pkg.gooseworksRelease?.commit || null, mcpEndpoint: credentials.mcp_server_url, agents: agents, skills };
+    privateWrite(profile.manifest, JSON.stringify(manifest, null, 2) + '\n');
+    writeConnections(profile.home, credentials);
+    return manifest;
+}
+function writeConnections(home, credentials) {
+    const endpoint = credentials.mcp_server_url.replace(/\/$/, '');
+    const url = endpoint.endsWith('/mcp') ? endpoint : `${endpoint}/mcp`;
+    privateWrite(path.join(home, 'mcp.json'), JSON.stringify({ mcpServers: { 'gooseworks-staging': { type: 'http', url, headers: { Authorization: `Bearer ${credentials.api_key}` } } } }));
+    // Codex shells can otherwise filter custom environment variables or reset PATH.
+    const pinned = { HOME: home, GOOSEWORKS_USER_HOME: process.env.GOOSEWORKS_USER_HOME || os.homedir(), GOOSEWORKS_SESSION_ENV: 'staging', GOOSEWORKS_API_BASE: credentials.api_base, PATH: `${path.join(home, 'bin')}${path.delimiter}${process.env.PATH || ''}` };
+    const shell = Object.entries(pinned).map(([key, value]) => `${key} = ${JSON.stringify(value)}`).join('\n');
+    privateWrite(path.join(home, '.codex', 'config.toml'), `allow_login_shell = false\n[shell_environment_policy]\ninherit = "all"\n[shell_environment_policy.set]\n${shell}\n[mcp_servers.gooseworks-staging]\nurl = ${JSON.stringify(url)}\n[mcp_servers.gooseworks-staging.http_headers]\nAuthorization = ${JSON.stringify(`Bearer ${credentials.api_key}`)}\n`);
+}
+function stagingLaunch(project, agent) {
+    if (!['claude', 'codex'].includes(agent))
+        throw new Error('Use --agent claude or --agent codex for an isolated staging session');
+    const profile = projectProfile(project);
+    assertCleanProject(profile.project);
+    const manifest = JSON.parse(fs.readFileSync(profile.manifest, 'utf8'));
+    if (manifest.environment !== 'staging' || manifest.project !== profile.project || !manifest.agents.includes(agent))
+        throw new Error('Project/environment mismatch. Install staging for this project and agent first.');
+    const root = path.join(profile.home, `.${agent}`, 'skills');
+    const actual = fs.readdirSync(root).filter(name => !name.startsWith('.'));
+    if (actual.length !== Object.keys(manifest.skills).length)
+        throw new Error('Unexpected skill in staging profile; reinstall into a fresh test folder');
+    for (const [name, expected] of Object.entries(manifest.skills)) {
+        const file = path.join(root, name, 'SKILL.md');
+        if (treeHash(path.dirname(file)) !== expected)
+            throw new Error(`Staging skill changed or linked: ${name}. Review it and install into a fresh test folder.`);
+    }
+    const credentials = (0, credentials_1.getCredentials)();
+    if (!credentials?.mcp_server_url)
+        throw new Error('Sign in to staging again before launching');
+    writeConnections(profile.home, credentials);
+    const env = { ...process.env };
+    // Do not carry production Goose tokens, custom provider homes, or daemon handles.
+    for (const key of Object.keys(env))
+        if (/^(GOOSEWORKS_|CODEX_|CLAUDE_|CLAUDECODE$|CURSOR_|XDG_)/.test(key))
+            delete env[key];
+    Object.assign(env, { HOME: profile.home, USERPROFILE: profile.home, XDG_CONFIG_HOME: path.join(profile.home, '.config'), XDG_DATA_HOME: path.join(profile.home, '.local', 'share'), CODEX_HOME: path.join(profile.home, '.codex'), CLAUDE_CONFIG_DIR: path.join(profile.home, '.claude'), GOOSEWORKS_USER_HOME: process.env.GOOSEWORKS_USER_HOME || os.homedir(), GOOSEWORKS_SESSION_ENV: 'staging', GOOSEWORKS_API_BASE: credentials.api_base });
+    // Use this exact CLI build inside the agent, even if its PATH has an older global CLI.
+    const bin = path.join(profile.home, 'bin');
+    if (process.platform === 'win32')
+        throw new Error('Isolated staging launch currently requires macOS or Linux');
+    const quote = (value) => `'${value.replaceAll("'", "'\\''")}'`;
+    privateWrite(path.join(bin, 'gooseworks'), `#!/bin/sh\nGOOSEWORKS_SESSION_ENV=staging\nexport GOOSEWORKS_SESSION_ENV\nexec ${quote(process.execPath)} ${quote(path.resolve(__dirname, '..', 'index.js'))} "$@"\n`, 0o700);
+    env.PATH = `${bin}${path.delimiter}${process.env.PATH || ''}`;
+    return { command: agent, cwd: profile.project, env, home: profile.home, manifest, args: agent === 'claude' ? ['--setting-sources', 'user', '--strict-mcp-config', '--mcp-config', path.join(profile.home, 'mcp.json')] : ['--cd', profile.project] };
+}
+function treeHash(directory) {
+    const digest = (0, node_crypto_1.createHash)('sha256');
+    function visit(dir) {
+        for (const name of fs.readdirSync(dir).sort()) {
+            const file = path.join(dir, name);
+            const stat = fs.lstatSync(file);
+            if (stat.isSymbolicLink())
+                throw new Error(`Linked staging package file refused: ${file}`);
+            digest.update(path.relative(directory, file) + '\0');
+            if (stat.isDirectory())
+                visit(file);
+            else if (stat.isFile())
+                digest.update(fs.readFileSync(file));
+            else
+                throw new Error(`Unsupported staging package file: ${file}`);
+        }
+    }
+    visit(directory);
+    return digest.digest('hex');
+}
+/** Read Claude's startup event and stop before a model request (no provider credential needed). */
+function inspectClaudeSkills(launch) {
+    return new Promise((resolve, reject) => {
+        const env = { ...launch.env, ANTHROPIC_API_KEY: 'sk-ant-gooseworks-inventory-invalid-key' };
+        // Inventory must never use a real billable provider connection.
+        for (const key of Object.keys(env))
+            if (/^(ANTHROPIC_AUTH_TOKEN|ANTHROPIC_BASE_URL|CLAUDE_CODE_USE_|AWS_|GOOGLE_|AZURE_)/.test(key))
+                delete env[key];
+        const child = (0, node_child_process_1.spawn)('claude', [...launch.args, '-p', '--input-format', 'stream-json', '--output-format', 'stream-json', '--verbose'], { cwd: launch.cwd, env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let finished = false;
+        let buffer = '';
+        const finish = (error, skills) => { if (finished)
+            return; finished = true; clearTimeout(timer); child.kill(); error ? reject(error) : resolve(skills); };
+        const timer = setTimeout(() => finish(new Error('Claude startup inventory timed out; update Claude and retry')), 30000);
+        child.on('error', error => finish(error));
+        child.on('exit', () => { if (!finished)
+            finish(new Error('Claude did not provide its skill inventory; update Claude')); });
+        child.stderr.on('data', () => undefined);
+        child.stdout.on('data', data => {
+            buffer += data;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Invalid Claude startup event'));
+            let end;
+            while ((end = buffer.indexOf('\n')) >= 0) {
+                let message;
+                try {
+                    message = JSON.parse(buffer.slice(0, end));
+                }
+                catch {
+                    buffer = buffer.slice(end + 1);
+                    continue;
+                }
+                buffer = buffer.slice(end + 1);
+                if (message.type !== 'system' || message.subtype !== 'init')
+                    continue;
+                if (!Array.isArray(message.skills) || !Array.isArray(message.plugins) || !Array.isArray(message.mcp_servers))
+                    return finish(new Error('Incompatible Claude startup inventory'));
+                const expected = Object.keys(launch.manifest.skills);
+                if (expected.some(name => !message.skills.includes(name)) || message.skills.some((name) => /^(goose|make-custom-video)/.test(name) && !expected.includes(name)) || message.plugins.length || message.mcp_servers.some((server) => server.name !== 'gooseworks-staging'))
+                    return finish(new Error('Claude loaded an unexpected skill, plugin, or MCP. Staging launch refused.'));
+                finish(undefined, message.skills);
+            }
+        });
+        child.stdin.write(JSON.stringify({ type: 'user', message: { role: 'user', content: '/skills' } }) + '\n');
+    });
+}
+/** Real, free Codex discovery. Refuse incompatible versions before starting a session. */
+function inspectCodexSkills(launch) {
+    return new Promise((resolve, reject) => {
+        const child = (0, node_child_process_1.spawn)('codex', ['app-server'], { cwd: launch.cwd, env: launch.env, stdio: ['pipe', 'pipe', 'pipe'] });
+        let buffer = '';
+        let finished = false;
+        let inventory;
+        let configVerified = false;
+        const finish = (error, skills) => { if (finished)
+            return; finished = true; clearTimeout(timer); child.kill(); error ? reject(error) : resolve(skills); };
+        const timer = setTimeout(() => finish(new Error('Codex skill isolation check timed out; update Codex and retry')), 15000);
+        child.on('error', error => finish(error));
+        child.on('exit', () => { if (!finished)
+            finish(new Error('Codex does not support the staging inventory check; update Codex')); });
+        child.stderr.on('data', () => undefined);
+        child.stdout.on('data', data => {
+            buffer += data;
+            if (buffer.length > 2 * 1024 * 1024)
+                return finish(new Error('Invalid Codex inventory response'));
+            let end;
+            while ((end = buffer.indexOf('\n')) >= 0) {
+                const line = buffer.slice(0, end);
+                buffer = buffer.slice(end + 1);
+                let message;
+                try {
+                    message = JSON.parse(line);
+                }
+                catch {
+                    continue;
+                }
+                if (message.error)
+                    return finish(new Error('Codex rejected the staging inventory check; update Codex'));
+                if (message.id === 1) {
+                    child.stdin.write(JSON.stringify({ method: 'initialized' }) + '\n');
+                    child.stdin.write(JSON.stringify({ id: 2, method: 'skills/list', params: { cwds: [launch.cwd], forceReload: true } }) + '\n');
+                    child.stdin.write(JSON.stringify({ id: 3, method: 'config/read', params: { cwd: launch.cwd, includeLayers: false } }) + '\n');
+                }
+                if (message.id === 2) {
+                    const rows = message.result?.data;
+                    if (!Array.isArray(rows) || rows.some(row => row.errors?.length))
+                        return finish(new Error('Could not read the complete Codex skill inventory'));
+                    const skills = rows.flatMap(row => row.skills || []).filter(skill => skill.enabled);
+                    const allowed = fs.realpathSync(launch.home) + path.sep;
+                    if (skills.some(skill => !fs.realpathSync(skill.path).startsWith(allowed)))
+                        return finish(new Error('Codex discovered skills outside the staging profile. Launch refused.'));
+                    const names = new Set(skills.map(skill => skill.name));
+                    if (Object.keys(launch.manifest.skills).some(name => !names.has(name)))
+                        return finish(new Error('Codex did not load all staging skills. Launch refused.'));
+                    inventory = skills.map(skill => ({ name: skill.name, path: skill.path, enabled: skill.enabled }));
+                    if (configVerified)
+                        finish(undefined, inventory);
+                }
+                if (message.id === 3) {
+                    const servers = message.result?.config?.mcp_servers;
+                    const endpoint = launch.manifest.mcpEndpoint.replace(/\/$/, '');
+                    const expectedUrl = endpoint.endsWith('/mcp') ? endpoint : `${endpoint}/mcp`;
+                    if (!servers || Object.keys(servers).length !== 1 || !servers['gooseworks-staging'] || servers['gooseworks-staging'].url !== expectedUrl)
+                        return finish(new Error('Codex effective MCP configuration is not isolated to staging. Launch refused.'));
+                    const plugins = message.result?.config?.plugins;
+                    if (plugins && Object.values(plugins).some((plugin) => plugin?.enabled !== false))
+                        return finish(new Error('Codex loaded unexpected plugin configuration. Launch refused.'));
+                    configVerified = true;
+                    if (inventory)
+                        finish(undefined, inventory);
+                }
+            }
+        });
+        child.stdin.write(JSON.stringify({ id: 1, method: 'initialize', params: { clientInfo: { name: 'gooseworks-staging-check', version: (0, version_1.getVersion)() } } }) + '\n');
+    });
+}
+//# sourceMappingURL=staging.js.map

package/dist/agents/staging.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"staging.js","sourceRoot":"","sources":["../../src/agents/staging.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,wCAMC;AAGD,gDAWC;AAQD,sDA+BC;AAYD,sCA0BC;AAkBD,kDA2BC;AAGD,gDA8CC;AA9MD,4CAA8B;AAC9B,gDAAkC;AAClC,4CAA8B;AAC9B,6CAAyC;AACzC,2DAA2C;AAC3C,qDAAqD;AACrD,gDAA6D;AAC7D,mDAAwD;AACxD,wCAAwC;AACxC,6DAA2D;AAAlD,iHAAA,cAAc,OAAA;AAIvB,MAAM,IAAI,GAAG,CAAC,KAAsB,EAAE,EAAE,CAAC,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAE1F,SAAgB,cAAc,CAAC,OAAe;IAC5C,IAAI,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC;IACxD,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,+BAA+B,CAAC,CAAC;IAC3F,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAW,GAAE,EAAE,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IAC/E,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC,EAAE,CAAC;AAChH,CAAC;AAED,kFAAkF;AAClF,SAAgB,kBAAkB,CAAC,OAAe;IAChD,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,KAAK,IAAI,GAAG,GAAG,OAAO,GAAI,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC;QAClD,8EAA8E;QAC9E,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;YACrB,KAAK,MAAM,IAAI,IAAI,CAAC,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,CAAC,EAAE,CAAC;gBAC5E,IAAI,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,sDAAsD,CAAC,CAAC;YAC3L,CAAC;QACH,CAAC;QACD,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,GAAG;YAAE,MAAM;IACvC,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY,EAAE,IAAI,GAAG,KAAK;IAC5D,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnE,IAAI,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IAChI,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;IAAC,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,qBAAqB,CAAC,OAAe,EAAE,MAAgB;IACrE,IAAI,IAAA,4BAAc,GAAE,KAAK,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzG,IAAI,CAAC,MAAM,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6GAA6G,CAAC,CAAC;IACjN,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,IAAI,EAAE,CAAC,UAAU,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC;QACpC,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;QACjF,KAAK,MAAM,KAAK,IAAI,QAAQ,CAAC,MAAM;YAAE,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,4BAAc,GAAE,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7J,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,MAAM,MAAM,GAAG,IAAA,6BAAiB,GAAE,CAAC;IACnC,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1C,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QACnC,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YAAE,SAAS;QACxG,IAAI,EAAE,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE;YAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QACzG,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;YACpE,8EAA8E;YAC9E,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;gBAAE,EAAE,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAClE,EAAE,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;IAC1F,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACrG,MAAM,QAAQ,GAAa,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,OAAO,EAAE,IAAA,oBAAU,GAAE,EAAE,YAAY,EAAE,KAAK,EAAE,cAAc,EAAE,GAAG,CAAC,iBAAiB,EAAE,MAAM,IAAI,IAAI,EAAE,WAAW,EAAE,WAAW,CAAC,cAAc,EAAE,MAAM,EAAE,MAAwB,EAAE,MAAM,EAAE,CAAC;IACtQ,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC;IACzE,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY,EAAE,WAA2D;IACjG,MAAM,QAAQ,GAAG,WAAW,CAAC,cAAe,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAChE,MAAM,GAAG,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,MAAM,CAAC;IACrE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,UAAU,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,UAAU,EAAE,EAAE,oBAAoB,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,WAAW,CAAC,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC;IACxL,gFAAgF;IAChF,MAAM,MAAM,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,IAAI,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,EAAE,CAAC;IACjQ,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC3G,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,aAAa,CAAC,EAAE,2GAA2G,KAAK,6CAA6C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,oEAAoE,IAAI,CAAC,SAAS,CAAC,UAAU,WAAW,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,CAAC;AAClW,CAAC;AAED,SAAgB,aAAa,CAAC,OAAe,EAAE,KAAa;IAC1D,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,qEAAqE,CAAC,CAAC;IACjI,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,CAAC;IAAC,kBAAkB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7E,MAAM,QAAQ,GAAa,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IACjF,IAAI,QAAQ,CAAC,WAAW,KAAK,SAAS,IAAI,QAAQ,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAqB,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iFAAiF,CAAC,CAAC;IACvO,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,KAAK,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC;IAC1E,IAAI,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,yEAAyE,CAAC,CAAC;IACtJ,KAAK,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC/D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC;QAC/C,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,QAAQ;YAAE,MAAM,IAAI,KAAK,CAAC,oCAAoC,IAAI,mDAAmD,CAAC,CAAC;IAC9J,CAAC;IACD,MAAM,WAAW,GAAG,IAAA,4BAAc,GAAE,CAAC;IACrC,IAAI,CAAC,WAAW,EAAE,cAAc;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,CAAC,CAAC;IAC/F,gBAAgB,CAAC,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,GAAG,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAClD,kFAAkF;IAClF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,IAAI,wDAAwD,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5H,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,IAAI,EAAE,eAAe,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC,EAAE,iBAAiB,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,oBAAoB,EAAE,OAAO,CAAC,GAAG,CAAC,oBAAoB,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,sBAAsB,EAAE,SAAS,EAAE,mBAAmB,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;IAClb,uFAAuF;IACvF,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC3C,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC;IAC/G,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;IACvE,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,EAAE,kFAAkF,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,CAAC,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAC1N,GAAG,CAAC,IAAI,GAAG,GAAG,GAAG,GAAG,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,CAAC;IAC9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,OAAO,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,mBAAmB,EAAE,MAAM,EAAE,qBAAqB,EAAE,cAAc,EAAE,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;AACvP,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB;IACjC,MAAM,MAAM,GAAG,IAAA,wBAAU,EAAC,QAAQ,CAAC,CAAC;IACpC,SAAS,KAAK,CAAC,GAAW;QACxB,KAAK,MAAM,IAAI,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAAC,MAAM,IAAI,GAAG,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YACnE,IAAI,IAAI,CAAC,cAAc,EAAE;gBAAE,MAAM,IAAI,KAAK,CAAC,wCAAwC,IAAI,EAAE,CAAC,CAAC;YAC3F,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,EAAE,IAAI,CAAC,GAAG,IAAI,CAAC,CAAC;YACrD,IAAI,IAAI,CAAC,WAAW,EAAE;gBAAE,KAAK,CAAC,IAAI,CAAC,CAAC;iBAC/B,IAAI,IAAI,CAAC,MAAM,EAAE;gBAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;;gBACxD,MAAM,IAAI,KAAK,CAAC,qCAAqC,IAAI,EAAE,CAAC,CAAC;QACpE,CAAC;IACH,CAAC;IACD,KAAK,CAAC,SAAS,CAAC,CAAC;IAAC,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChD,CAAC;AAED,mGAAmG;AACnG,SAAgB,mBAAmB,CAAC,MAAwC;IAC1E,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,GAAG,GAAsB,EAAE,GAAG,MAAM,CAAC,GAAG,EAAE,iBAAiB,EAAE,yCAAyC,EAAE,CAAC;QAC/G,gEAAgE;QAChE,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,IAAI,iFAAiF,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;QACrJ,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,QAAQ,EAAE,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,gBAAgB,EAAE,aAAa,EAAE,iBAAiB,EAAE,aAAa,EAAE,WAAW,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACjM,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,MAAM,GAAG,EAAE,CAAC;QACtC,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAiB,EAAE,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7K,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QACxH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3H,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YAC7B,MAAM,IAAI,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC,CAAC;YAC9G,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,IAAI,OAAY,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzH,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAC/B,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM;oBAAE,SAAS;gBACtE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,uCAAuC,CAAC,CAAC,CAAC;gBAChL,MAAM,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;gBACrD,IAAI,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,IAAY,EAAE,EAAE,CAAC,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,oBAAoB,CAAC;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,4EAA4E,CAAC,CAAC,CAAC;gBAC7X,MAAM,CAAC,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACpC,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0FAA0F;AAC1F,SAAgB,kBAAkB,CAAC,MAAwC;IACzE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,IAAA,0BAAK,EAAC,OAAO,EAAE,CAAC,YAAY,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,KAAK,EAAE,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;QACpH,IAAI,MAAM,GAAG,EAAE,CAAC;QAAC,IAAI,QAAQ,GAAG,KAAK,CAAC;QAAC,IAAI,SAA4B,CAAC;QAAC,IAAI,cAAc,GAAG,KAAK,CAAC;QACpG,MAAM,MAAM,GAAG,CAAC,KAAa,EAAE,MAAc,EAAE,EAAE,GAAG,IAAI,QAAQ;YAAE,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1K,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1H,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;QAC1C,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,QAAQ;YAAE,MAAM,CAAC,IAAI,KAAK,CAAC,kEAAkE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAClI,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,EAAE;YAC7B,MAAM,IAAI,IAAI,CAAC;YAAC,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI;gBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC,CAAC;YAClH,IAAI,GAAW,CAAC;YAChB,OAAO,CAAC,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzC,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;gBAAC,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;gBAClE,IAAI,OAAY,CAAC;gBAAC,IAAI,CAAC;oBAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC;oBAAC,SAAS;gBAAC,CAAC;gBACzE,IAAI,OAAO,CAAC,KAAK;oBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,0DAA0D,CAAC,CAAC,CAAC;gBACxG,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBACpE,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;oBAC9H,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,MAAM,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;gBAChI,CAAC;gBACD,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC;oBAClC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC,CAAC;oBAChJ,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACpF,MAAM,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;oBACxD,IAAI,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAC,CAAC;oBAC7K,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;oBACvD,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC,CAAC;oBAC3J,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,OAAO,EAAE,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;oBAClG,IAAI,cAAc;wBAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBACnD,CAAC;gBACD,IAAI,OAAO,CAAC,EAAE,KAAK,CAAC,EAAE,CAAC;oBACrB,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,WAAW,CAAC;oBACpD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBAChE,MAAM,WAAW,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,MAAM,CAAC;oBAC7E,IAAI,CAAC,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,oBAAoB,CAAC,IAAI,OAAO,CAAC,oBAAoB,CAAC,CAAC,GAAG,KAAK,WAAW;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,+EAA+E,CAAC,CAAC,CAAC;oBACpP,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,EAAE,MAAM,EAAE,OAAO,CAAC;oBAChD,IAAI,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,MAAW,EAAE,EAAE,CAAC,MAAM,EAAE,OAAO,KAAK,KAAK,CAAC;wBAAE,OAAO,MAAM,CAAC,IAAI,KAAK,CAAC,+DAA+D,CAAC,CAAC,CAAC;oBAClL,cAAc,GAAG,IAAI,CAAC;oBACtB,IAAI,SAAS;wBAAE,MAAM,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;gBAC9C,CAAC;YACH,CAAC;QACH,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,EAAE,UAAU,EAAE,EAAE,IAAI,EAAE,0BAA0B,EAAE,OAAO,EAAE,IAAA,oBAAU,GAAE,EAAE,EAAE,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC;IACjK,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/auth/credentials.d.ts

@@ -11,6 +11,7 @@ export interface Credentials {
     /** Base URL for the GooseWorks MCP server (e.g. http://localhost:6200 in dev). */
     mcp_server_url?: string;
 }
+export declare function validateCredentials(creds: Credentials): void;
 export declare function getCredentials(): Credentials | null;
 export declare function saveCredentials(creds: Credentials): void;
 export declare function clearCredentials(): void;

package/dist/auth/credentials.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAcnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CASxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAQvC;AAED,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAGzC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAGnC"}
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":"AAMA,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,gGAAgG;IAChG,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,wDAAwD;IACxD,UAAU,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC9B,oEAAoE;IACpE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAKD,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAG5D;AAED,wBAAgB,cAAc,IAAI,WAAW,GAAG,IAAI,CAgBnD;AAED,wBAAgB,eAAe,CAAC,KAAK,EAAE,WAAW,GAAG,IAAI,CAcxD;AAED,wBAAgB,gBAAgB,IAAI,IAAI,CAUvC;AAED,wBAAgB,SAAS,IAAI,MAAM,GAAG,IAAI,CAGzC;AAED,wBAAgB,UAAU,IAAI,MAAM,CAGnC"}

package/dist/auth/credentials.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.validateCredentials = validateCredentials;
 exports.getCredentials = getCredentials;
 exports.saveCredentials = saveCredentials;
 exports.clearCredentials = clearCredentials;
@@ -42,35 +43,52 @@ const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const os = __importStar(require("os"));
 const config_1 = require("../config");
-const CREDENTIALS_DIR = path.join(os.homedir(), '.gooseworks');
-const CREDENTIALS_FILE = path.join(CREDENTIALS_DIR, 'credentials.json');
+const environment_1 = require("../environment");
+function credentialsFile() { return path.join((0, environment_1.profileRoot)(), 'credentials.json'); }
+const LEGACY_FILE = path.join(os.homedir(), '.gooseworks', 'credentials.json');
+function validateCredentials(creds) {
+    (0, environment_1.assertConnection)(creds.api_base, 'api');
+    if (creds.mcp_server_url)
+        (0, environment_1.assertConnection)(creds.mcp_server_url, 'mcp');
+}
 function getCredentials() {
+    let parsed;
     try {
-        if (!fs.existsSync(CREDENTIALS_FILE)) {
+        const file = fs.existsSync(credentialsFile()) ? credentialsFile()
+            : (0, environment_1.getEnvironment)() === 'production' && fs.existsSync(LEGACY_FILE) ? LEGACY_FILE : null;
+        if (!file)
             return null;
-        }
-        const raw = fs.readFileSync(CREDENTIALS_FILE, 'utf-8');
-        const parsed = JSON.parse(raw);
-        if (!parsed.api_key || !parsed.email || !parsed.agent_id) {
+        parsed = JSON.parse(fs.readFileSync(file, 'utf-8'));
+        if (!parsed.api_key || !parsed.email || !parsed.agent_id || !parsed.api_base) {
             return null;
         }
-        return parsed;
     }
     catch {
         return null;
     }
+    // A mismatched saved login is an error, never an excuse to use another profile.
+    validateCredentials(parsed);
+    return parsed;
 }
 function saveCredentials(creds) {
+    validateCredentials(creds);
+    const CREDENTIALS_DIR = (0, environment_1.profileRoot)();
+    const CREDENTIALS_FILE = credentialsFile();
     if (!fs.existsSync(CREDENTIALS_DIR)) {
         fs.mkdirSync(CREDENTIALS_DIR, { mode: 0o700, recursive: true });
     }
     fs.writeFileSync(CREDENTIALS_FILE, JSON.stringify(creds, null, 2) + '\n', { mode: 0o600 });
+    fs.chmodSync(CREDENTIALS_DIR, 0o700);
+    fs.chmodSync(CREDENTIALS_FILE, 0o600);
 }
 function clearCredentials() {
+    const CREDENTIALS_FILE = credentialsFile();
     try {
         if (fs.existsSync(CREDENTIALS_FILE)) {
             fs.unlinkSync(CREDENTIALS_FILE);
         }
+        if ((0, environment_1.getEnvironment)() === 'production' && fs.existsSync(LEGACY_FILE))
+            fs.unlinkSync(LEGACY_FILE);
     }
     catch {
         // Ignore errors during cleanup

package/dist/auth/credentials.js.map

@@ -1 +1 @@
-{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAsBA,wCAcC;AAED,0CASC;AAED,4CAQC;AAED,8BAGC;AAED,gCAGC;AAnED,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,sCAAqC;AAgBrC,MAAM,eAAe,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,CAAC,CAAC;AAC/D,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,eAAe,EAAE,kBAAkB,CAAC,CAAC;AAExE,SAAgB,cAAc;IAC5B,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACrC,OAAO,IAAI,CAAC;QACd,CAAC;QACD,MAAM,GAAG,GAAG,EAAE,CAAC,YAAY,CAAC,gBAAgB,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YACzD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO,MAAqB,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAgB,eAAe,CAAC,KAAkB;IAChD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,EAAE,CAAC,aAAa,CACd,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACrC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;AACJ,CAAC;AAED,SAAgB,gBAAgB;IAC9B,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,SAAgB,SAAS;IACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,KAAK,EAAE,QAAQ,IAAI,iBAAQ,CAAC;AACrC,CAAC"}
+{"version":3,"file":"credentials.js","sourceRoot":"","sources":["../../src/auth/credentials.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAuBA,kDAGC;AAED,wCAgBC;AAED,0CAcC;AAED,4CAUC;AAED,8BAGC;AAED,gCAGC;AAlFD,uCAAyB;AACzB,2CAA6B;AAC7B,uCAAyB;AACzB,sCAAqC;AACrC,gDAA+E;AAgB/E,SAAS,eAAe,KAAa,OAAO,IAAI,CAAC,IAAI,CAAC,IAAA,yBAAW,GAAE,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC;AAC3F,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,aAAa,EAAE,kBAAkB,CAAC,CAAC;AAE/E,SAAgB,mBAAmB,CAAC,KAAkB;IACpD,IAAA,8BAAgB,EAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;IACxC,IAAI,KAAK,CAAC,cAAc;QAAE,IAAA,8BAAgB,EAAC,KAAK,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;AAC1E,CAAC;AAED,SAAgB,cAAc;IAC5B,IAAI,MAAmB,CAAC;IACxB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC,CAAC,CAAC,CAAC,eAAe,EAAE;YAC/D,CAAC,CAAC,IAAA,4BAAc,GAAE,KAAK,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC;QACzF,IAAI,CAAC,IAAI;YAAE,OAAO,IAAI,CAAC;QACvB,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC7E,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,gFAAgF;IAChF,mBAAmB,CAAC,MAAM,CAAC,CAAC;IAC5B,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAgB,eAAe,CAAC,KAAkB;IAChD,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC3B,MAAM,eAAe,GAAG,IAAA,yBAAW,GAAE,CAAC;IACtC,MAAM,gBAAgB,GAAG,eAAe,EAAE,CAAC;IAC3C,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,EAAE,CAAC;QACpC,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAClE,CAAC;IACD,EAAE,CAAC,aAAa,CACd,gBAAgB,EAChB,IAAI,CAAC,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EACrC,EAAE,IAAI,EAAE,KAAK,EAAE,CAChB,CAAC;IACF,EAAE,CAAC,SAAS,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC;IACrC,EAAE,CAAC,SAAS,CAAC,gBAAgB,EAAE,KAAK,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,gBAAgB;IAC9B,MAAM,gBAAgB,GAAG,eAAe,EAAE,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,EAAE,CAAC;YACpC,EAAE,CAAC,UAAU,CAAC,gBAAgB,CAAC,CAAC;QAClC,CAAC;QACD,IAAI,IAAA,4BAAc,GAAE,KAAK,YAAY,IAAI,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC;YAAE,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;IAClG,CAAC;IAAC,MAAM,CAAC;QACP,+BAA+B;IACjC,CAAC;AACH,CAAC;AAED,SAAgB,SAAS;IACvB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,KAAK,EAAE,OAAO,IAAI,IAAI,CAAC;AAChC,CAAC;AAED,SAAgB,UAAU;IACxB,MAAM,KAAK,GAAG,cAAc,EAAE,CAAC;IAC/B,OAAO,KAAK,EAAE,QAAQ,IAAI,iBAAQ,CAAC;AACrC,CAAC"}