hive-intelligence 1.1.3 → 1.3.0

package/agent-skills/packs/hive-wallet-investigation/SKILL.md

@@ -1,42 +1,135 @@
 ---
 name: hive-wallet-investigation
-description: Use this skill for wallet, portfolio, holder, whale, transfer, PnL, NFT exposure, DeFi position, or notable on-chain activity investigations. Require wallet address and chain before executing Hive wallet tools.
+description: Use this skill whenever the user wants to look inside a wallet or address — portfolio, holdings, balances, transfers, PnL, NFT exposure, DeFi positions, whale moves, "what does this address hold", "trace this wallet's activity" — even if they just paste an address. Requires wallet address and chain before executing Hive wallet tools. For Solana wallets use hive-solana-analysis; for "is this address malicious" risk checks use hive-security-risk.
 license: MIT
 metadata:
   package: "@hiveintelligence/agent-skills"
   category: "wallet"
   requires_network: "true"
-version: 1.0.0
+version: 1.3.0
 ---
 
 # hive-wallet-investigation — Wallet Investigation
 
-Use this skill when the user asks to investigate a wallet, portfolio, holdings,
-transfers, PnL, NFT exposure, or DeFi positions.
+Investigate a wallet's balances, transfers, PnL, NFT exposure, DeFi positions,
+and notable activity with live Hive data, scoped to exactly what the user
+asked.
 
-## Task toolset
+## Task toolset and identifiers
 
-Use `wallet_investigation`.
+Toolset: `wallet_investigation`. Read
+`hive://toolsets/wallet_investigation` before execution; it is authoritative
+for the current output schema, material-call budget, phases, fallback
+condition, and stop conditions.
 
-Required identifiers: wallet address and chain.
+- Required: wallet address and chain/network — unless the user explicitly asks
+  for multi-chain.
+- Optional: time window, asset filter, counterparty, protocol, NFT collection.
 
-## Procedure
+Ask for the chain when an EVM address appears without context: the same
+address exists on every EVM chain with different state, so guessing the chain
+silently changes the answer. For Solana wallets, hand off to
+`hive-solana-analysis`.
+
+Before choosing endpoints, select exactly one matching entry from the exact
+workflow's routes[]. Follow its ordered steps, use a fallback only under that
+step's published condition, stop at four material calls, and preserve the
+selected route_id in the typed result. The broad coverageCatalog is discovery
+coverage, not an execution plan.
 
-Read `references/workflow.md` when the request needs multi-chain handling,
-activity triage, risk caveats, or a structured wallet investigation report.
+## Procedure
 
 1. Validate the address format for the requested chain.
-2. Start with balances and native balance.
-3. Add transfers, NFT holdings, DeFi positions, or PnL only when relevant.
-4. Summarize exposure, concentration, notable activity, and missing data.
+2. Call `search_tools` for wallet balance, native balance, transfer, NFT,
+   DeFi-position, and PnL capabilities as the question requires.
+3. Call `get_api_endpoint_schema` for each endpoint before calling it.
+4. Call `invoke_api_endpoint` with schema-valid, bounded arguments.
+5. Start with balances and native balance. Add transfers for activity
+   questions; add NFTs, DeFi positions, or PnL only when relevant.
+6. Summarize exposure, concentration, notable activity, and missing data.
+
+## Bounded calls
+
+- Use explicit `limit`, `page`, `per_page`, or time filters for transfers.
+- Do not fetch full history for a quick portfolio read.
+- Avoid mixing chains unless the user requested multi-chain analysis.
+
+## Worked example
+
+User: "What does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on Ethereum,
+and did anything big move this week?"
+
+1. `search_tools` → `{"query": "wallet token balances native balance transfers ethereum", "limit": 5}`
+2. `get_api_endpoint_schema` for the balance and transfer endpoints returned.
+3. `invoke_api_endpoint` for balances first, then transfers with a 7-day
+   window and an explicit limit — argument names come from the schema, not
+   from memory.
+4. Answer with the report template, flagging spam tokens and truncated
+   history.
+
+## Report template
+
+```markdown
+## Summary
+[Wallet posture and the most notable finding.]
 
-## Example
+## Calls made
+- Toolset: wallet_investigation
+- Endpoint(s): [exact endpoint names]
+- Identifiers: [chain, wallet, filters]
 
-If the user provides an EVM wallet but no chain, ask whether they want Ethereum,
-Base, Arbitrum, Polygon, or a multi-chain investigation.
+## Evidence
+- Balances: [native + top token holdings]
+- Activity: [transfers in window, counterparties]
+- Exposure: [NFTs, DeFi positions, PnL if requested]
+- Provenance: [provider, fetched_at, observed_at/cache_age_ms, runtime status per call]
+
+## Caveats
+[Missing chains, truncated history, unavailable enrichment, degraded providers.]
+
+## Next action
+[Chain expansion, transfer drilldown, risk check, or PnL detail — only if needed.]
+```
+
+## Gotchas
+
+- Wallet labels and owner identity are not guaranteed.
+- Token balances can include spam or illiquid assets — say so rather than
+  inflating portfolio value.
+- Absence of DeFi/NFT data may reflect provider coverage, not true absence.
+
+## Evidence receipt (required)
+
+End every Hive-backed answer with a compact receipt built from the `_hive`
+object on each material tool response:
+
+- `provider`, `tool`, `fetched_at`, `observed_at`, `cache_age_ms`, and `runtime_status`
+- `receipt_id`, `receipt_version`, server/build version, and SHA-256 input/result
+  digests when present (self-checks, not signatures)
+- `source`, `cache_status`, `truncated`, and any warnings
+- canonical chain/entity identifiers plus block, slot, transaction, or query ids
+  present in provider data
+- material provider disagreements and how they were handled
+- checks that were unavailable, gated, stale, truncated, or intentionally not run
+- a `claims[]` citation from each material statement to exact receipt IDs
+- one `coverage[]` entry for every canonical evidence phase, with each gap explained
+
+Never turn missing evidence into a clean result, silently merge conflicting
+provider values, or omit a degraded/fallback call from the receipt.
+`observed_at` is Hive's first-observation/original cache-population time, and
+`cache_age_ms: 0` only means newly retrieved by Hive. Use provider time, block,
+slot, transaction, or candle close for source recency; if absent, mark it
+unknown. Run `validate_task_result` before presenting the typed workflow result;
+it checks structure but cannot authenticate an invented receipt.
 
 ## Runtime status handling
 
-Classify provider failures as `missing_key`, `plan_required`, `rate_limited`,
-`degraded`, or `failing`. A single blocked enrichment tool should not suppress
+Classify provider failures as `invalid_input`, `missing_key`, `plan_required`,
+`rate_limited`, `degraded`, or `failing`. A single blocked enrichment tool should not suppress
 balances or transfers that did succeed.
+
+## Hand-offs
+
+- Solana wallet (base58 address) → `hive-solana-analysis`.
+- "Is this address dangerous / phishing / sanctioned" → `hive-security-risk`.
+- Token-specific deep dive on one holding → `hive-token-diligence`.

package/agent-skills/packs/hive-wallet-investigation/evals/evals.json

@@ -3,13 +3,15 @@
   "evals": [
     {
       "id": 1,
-      "prompt": "Investigate this Ethereum wallet's balances and recent transfers: 0x0000000000000000000000000000000000000000",
-      "expected_output": "Uses wallet_investigation, validates chain/address, starts with balances, adds bounded recent transfers, and reports source/freshness/runtime status.",
+      "prompt": "What does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on Ethereum, and did anything big move in the last week?",
+      "expected_output": "Uses wallet_investigation, validates chain/address, starts with balances, adds bounded recent transfers, and ends with a source/freshness/runtime receipt.",
       "files": [],
       "assertions": [
         "Chooses wallet_investigation.",
+        "Selects the matching portfolio_snapshot or recent_activity route and follows its ordered calls.",
         "Starts with balances/native balance.",
-        "Bounds transfer history."
+        "Bounds transfer history.",
+        "Includes receipt ids and missing evidence."
       ]
     },
     {

package/agent-skills/packs/hive-wallet-investigation/evals/triggers.json

@@ -0,0 +1,50 @@
+[
+  {
+    "query": "what does 0x28C6c06298d514Db089934071355E5743bf21d60 hold on ethereum",
+    "should_trigger": true
+  },
+  {
+    "query": "trace where this wallet's funds came from, it just sent me 2 eth",
+    "should_trigger": true
+  },
+  {
+    "query": "did this whale wallet dump any LINK this week? 0x… on mainnet",
+    "should_trigger": true
+  },
+  {
+    "query": "show me this address's defi positions and nft exposure",
+    "should_trigger": true
+  },
+  {
+    "query": "whats the realized pnl of this trader address",
+    "should_trigger": true
+  },
+  {
+    "query": "this EVM address might be active on several chains, can you inspect it",
+    "should_trigger": true
+  },
+  {
+    "query": "is this address that dm'd me flagged as a scammer or phishing",
+    "should_trigger": false
+  },
+  {
+    "query": "analyze this solana wallet 9WzDXwBbmkg8ZTbNMqUxvQRAyrZzDsGYdLVL9zYtAWWM",
+    "should_trigger": false
+  },
+  {
+    "query": "alert me whenever this wallet moves more than $50k",
+    "should_trigger": false
+  },
+  {
+    "query": "how do hd wallets derive addresses from a seed phrase",
+    "should_trigger": false
+  },
+  {
+    "query": "whats gas on mainnet right now",
+    "should_trigger": false
+  },
+  {
+    "query": "what tokens should i buy this week",
+    "should_trigger": false
+  }
+]

package/agent-skills/references/agents-routing.md

@@ -32,17 +32,29 @@ For live crypto intelligence, prefer Hive retrieval over model memory.
     `hive-network-infrastructure`
   - prediction markets, events, outcomes, traders:
     `hive-prediction-markets`
+- User asks Hive to remember, monitor, schedule, alert, or report crypto
+  intelligence across sessions: use `hive-stateful-monitoring`.
 - Setup, API key, CLI, or app integration:
   use `hive-mcp`, `hive-build-onboarding`, `hive-cli`, or `hive-build`.
 
 Default execution loop:
-1. Read `hive://toolsets` or call `search_tools`.
-2. Select one task toolset or exact endpoint.
-3. Call `get_api_endpoint_schema`.
-4. Execute through `invoke_api_endpoint` with bounded args.
-5. Report provider, source/freshness, fallback/cache/degraded state, and
-   runtime status (`ok`, `missing_key`, `plan_required`, `rate_limited`,
-   `degraded`, or `failing`).
+1. Read the compact `hive://toolsets` index or call `search_tools`.
+2. Select one task toolset and its best matching compact `routes[]` entry.
+   Preserve `route_id`; follow the ordered calls, conditional per-call
+   fallbacks, four-call cap, and stop condition. Use `coverageCatalog` only
+   for long-tail discovery.
+3. Call `get_api_endpoint_schema` and inspect `operation`/`callPattern`.
+4. Execute reads through `invoke_api_endpoint` with bounded args. Explain any
+   Hive state change, obtain explicit approval, then use
+   `invoke_stateful_endpoint`; never auto-approve it.
+5. Copy exact server-returned `_hive` blocks into the task receipt, cite exact
+   receipt IDs from `claims[]`, account for every canonical `coverage[]`
+   phase, include `route_id`, and call `validate_task_result` before presenting a structured
+   result.
+6. Report provider, source recency, fallback/cache/degraded state, and runtime
+   status (`ok`, `invalid_input`, `missing_key`, `plan_required`,
+   `rate_limited`, `degraded`, or `failing`). `observed_at` is Hive
+   first-observation/original cache time, not necessarily upstream event time.
 ```
 
 Keep this snippet short. The skill files carry the detailed workflow and should

package/agent-skills/scripts/validate-agent-skills-package.mjs

@@ -6,8 +6,8 @@ import { fileURLToPath } from "node:url";
 const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
 const packsRoot = join(root, "packs");
 const failures = [];
-
-const workflowReferenceSkills = new Set([
+const receiptSkills = new Set([
+  "hive-query",
   "hive-market-research",
   "hive-token-diligence",
   "hive-wallet-investigation",
@@ -18,16 +18,7 @@ const workflowReferenceSkills = new Set([
   "hive-solana-analysis",
   "hive-network-infrastructure",
   "hive-prediction-markets",
-]);
-
-const requiredTriggerCoverage = new Set([
-  "hive-query",
-  "hive-tool-discovery",
-  "hive-mcp",
-  "hive-build",
-  "hive-build-onboarding",
-  "hive-cli",
-  "hive-token-diligence",
+  "hive-stateful-monitoring",
 ]);
 
 function fail(message) {
@@ -90,8 +81,11 @@ for (const skillName of skillDirs) {
   const description = field(fm, "description");
 
   if (name !== skillName) fail(`${skillName} frontmatter name must match directory.`);
-  if (!description.startsWith("Use this skill")) {
-    fail(`${skillName} description must start with trigger language: "Use this skill".`);
+  const hasTriggerLanguage =
+    description.startsWith("Use this skill") ||
+    (skillName === "hive-query" && description.startsWith("Default entry point"));
+  if (!hasTriggerLanguage) {
+    fail(`${skillName} description must start with explicit trigger language.`);
   }
   if (description.includes(": ")) {
     fail(`${skillName} description contains ': ', which breaks some YAML parsers unless quoted.`);
@@ -105,6 +99,13 @@ for (const skillName of skillDirs) {
   if (!body.includes("## Runtime status handling")) {
     fail(`${skillName} must document runtime status handling.`);
   }
+  if (
+    receiptSkills.has(skillName) &&
+    (!body.includes("## Evidence receipt (required)") ||
+      !body.includes("`receipt_id`"))
+  ) {
+    fail(`${skillName} must require Hive evidence receipts.`);
+  }
 
   const evalFile = join(skillDir, "evals", "evals.json");
   if (!existsSync(evalFile)) {
@@ -123,11 +124,42 @@ for (const skillName of skillDirs) {
         fail(`${skillName} eval ${entry.id ?? "unknown"} needs assertions.`);
       }
     }
+    if (
+      receiptSkills.has(skillName) &&
+      !(evals?.evals ?? []).some((entry) =>
+        `${entry.expected_output ?? ""} ${(entry.assertions ?? []).join(" ")}`
+          .toLowerCase()
+          .includes("receipt"),
+      )
+    ) {
+      fail(`${skillName} evals must cover the evidence receipt contract.`);
+    }
   }
 
-  if (workflowReferenceSkills.has(skillName)) {
-    const workflow = join(skillDir, "references", "workflow.md");
-    if (!existsSync(workflow)) fail(`${skillName} is missing references/workflow.md.`);
+  const triggerFile = join(skillDir, "evals", "triggers.json");
+  if (!existsSync(triggerFile)) {
+    fail(`${skillName} is missing evals/triggers.json.`);
+  } else {
+    const triggers = readJson(triggerFile);
+    if (!Array.isArray(triggers) || triggers.length < 4) {
+      fail(`${skillName} must define at least four trigger evals.`);
+    } else {
+      if (!triggers.some((entry) => entry?.should_trigger === true)) {
+        fail(`${skillName} trigger evals need a positive example.`);
+      }
+      if (!triggers.some((entry) => entry?.should_trigger === false)) {
+        fail(`${skillName} trigger evals need a negative example.`);
+      }
+      for (const entry of triggers) {
+        if (
+          typeof entry?.query !== "string" ||
+          !entry.query.trim() ||
+          typeof entry?.should_trigger !== "boolean"
+        ) {
+          fail(`${skillName} has an invalid trigger eval entry.`);
+        }
+      }
+    }
   }
 
   const referenceMatches = [...body.matchAll(/`(references\/[^`]+)`/g)];
@@ -148,6 +180,72 @@ if (directoryManifest) {
   }
 }
 
+// Cross-manifest consistency: every pack on disk must also be installable via
+// the Claude plugin manifest and routed in the top-level SKILL.md. This guards
+// the drift mode where a pack ships with evals but is invisible to install and
+// routing (e.g. a skill missing from plugin.json never loads via plugin install).
+const pluginManifestPath = join(root, ".claude-plugin", "plugin.json");
+const packageManifest = readJson(join(root, "package.json"));
+if (!existsSync(pluginManifestPath)) {
+  fail("agent-skills/.claude-plugin/plugin.json is missing.");
+} else {
+  const pluginManifest = readJson(pluginManifestPath);
+  if (pluginManifest) {
+    if (packageManifest && pluginManifest.version !== packageManifest.version) {
+      fail(
+        `.claude-plugin/plugin.json version ${pluginManifest.version} must match package.json ${packageManifest.version}.`,
+      );
+    }
+    const pluginSkills = new Set((pluginManifest.skills ?? []).map((skill) => skill.name));
+    for (const skillName of skillDirs) {
+      if (!pluginSkills.has(skillName)) {
+        fail(`${skillName} is missing from .claude-plugin/plugin.json skills.`);
+      }
+    }
+    for (const entry of pluginManifest.skills ?? []) {
+      const referenced = entry.path ? join(root, ".claude-plugin", entry.path) : "";
+      if (!referenced || !existsSync(referenced)) {
+        fail(`plugin.json skill ${entry.name ?? "unknown"} path does not resolve: ${entry.path}`);
+      }
+    }
+    if (!pluginManifest.mcpServers) {
+      fail("plugin.json must declare mcpServers so installing the plugin also connects Hive MCP.");
+    } else if (typeof pluginManifest.mcpServers === "string") {
+      const mcpPath = join(root, pluginManifest.mcpServers);
+      if (!existsSync(mcpPath)) {
+        fail(`plugin.json mcpServers points to missing file ${pluginManifest.mcpServers}.`);
+      } else {
+        const mcp = readJson(mcpPath);
+        const hive = mcp?.mcpServers?.hive;
+        if (hive?.url !== "https://mcp.hiveintelligence.xyz/mcp") {
+          fail(`${pluginManifest.mcpServers} must define mcpServers.hive.url for the hosted Hive endpoint.`);
+        }
+        if (
+          JSON.stringify(hive) !==
+          JSON.stringify({
+            type: "http",
+            url: "https://mcp.hiveintelligence.xyz/mcp",
+          })
+        ) {
+          fail(`${pluginManifest.mcpServers} must be an exact URL-only interactive OAuth config.`);
+        }
+        if (/authorization|bearer|api.?key|token|secret|\$\{/i.test(JSON.stringify(hive))) {
+          fail(`${pluginManifest.mcpServers} must not contain credentials or placeholders.`);
+        }
+      }
+    }
+  }
+}
+
+const rootSkillBody = existsSync(join(root, "SKILL.md"))
+  ? readFileSync(join(root, "SKILL.md"), "utf8")
+  : "";
+for (const skillName of skillDirs) {
+  if (rootSkillBody && !rootSkillBody.includes(skillName)) {
+    fail(`${skillName} is not routed in the top-level SKILL.md.`);
+  }
+}
+
 const triggerQueries = readJson(join(root, "evals", "trigger-queries.json"));
 if (triggerQueries) {
   const triggerSkillNames = new Set();
@@ -164,7 +262,7 @@ if (triggerQueries) {
       }
     }
   }
-  for (const skillName of requiredTriggerCoverage) {
+  for (const skillName of skillDirs) {
     if (!triggerSkillNames.has(skillName)) {
       fail(`trigger-queries must include trigger coverage for ${skillName}.`);
     }

package/agent-skills/skills.sh.json

@@ -22,7 +22,7 @@
     },
     {
       "title": "Crypto Research Workflows",
-      "description": "Focused workflows for market, token, wallet, security, DEX, DeFi, NFT, Solana, network, and prediction-market analysis.",
+      "description": "Focused workflows for market, token, wallet, security, DEX, DeFi, NFT, Solana, network, prediction-market, and stateful monitoring analysis.",
       "skills": [
         "hive-market-research",
         "hive-token-diligence",
@@ -33,7 +33,8 @@
         "hive-nft-research",
         "hive-solana-analysis",
         "hive-network-infrastructure",
-        "hive-prediction-markets"
+        "hive-prediction-markets",
+        "hive-stateful-monitoring"
       ]
     }
   ]

package/bin/hive-mcp.js

@@ -4,14 +4,14 @@
 // In an ESM file (type:module), static imports are parsed before execution,
 // so a version check using `if (major < 20)` would never execute on old Node.
 // However, since this file IS ESM and uses import statements, the check below
-// is a best-effort guard for Node 20+ (which already supports ESM + TLA).
+// is a best-effort guard for Node 22.12+ (which supports the package runtime).
 // For Node <16, this file fails at parse time with a SyntaxError — engines
 // field in package.json is the primary enforcement mechanism.
 
-const major = parseInt(process.versions.node.split(".")[0], 10);
-if (major < 20) {
+const [major, minor] = process.versions.node.split(".").map(Number);
+if (major < 22 || (major === 22 && minor < 12)) {
   process.stderr.write(
-    `Error: hive requires Node.js 20 or later (found ${process.versions.node}).\n`,
+    `Error: hive requires Node.js 22.12 or later (found ${process.versions.node}).\n`,
   );
   process.exit(1);
 }
@@ -25,7 +25,7 @@ const cliPath = join(__dirname, "..", "build", "cli.js");
 
 if (!existsSync(cliPath)) {
   process.stderr.write(
-    "Error: build/cli.js not found. Run `npm run build` or `bun run build` first.\n",
+    "Error: build/cli.js not found. Run `npm run build` first.\n",
   );
   process.exit(1);
 }

package/build/{alias-CZ3DEYHF.js → alias-BKAVOYQV.js}

@@ -3,8 +3,8 @@ import {
   ensureConfigDir,
   getConfig,
   saveConfig
-} from "./chunk-V77LO4RO.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 
 // src/cli/alias.ts
 function getAliases() {
@@ -38,4 +38,3 @@ export {
   removeAlias,
   setAlias
 };
-//# sourceMappingURL=alias-CZ3DEYHF.js.map

package/build/{api-client-I23XLSHU.js → api-client-FTVDFW5V.js}

@@ -10,9 +10,10 @@ import {
   getUsage,
   listKeysApi,
   revokeKeyApi
-} from "./chunk-IZTN7WFH.js";
-import "./chunk-V77LO4RO.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-Q7VBYLX7.js";
+import "./chunk-ZXKFJQDE.js";
+import "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 export {
   authLogin,
   authMe,
@@ -25,4 +26,3 @@ export {
   listKeysApi,
   revokeKeyApi
 };
-//# sourceMappingURL=api-client-I23XLSHU.js.map

package/build/{auth-KKINNBXT.js → auth-EZFJ5RYB.js}

@@ -16,9 +16,9 @@ import {
   runWhoami,
   saveProfile,
   switchProfile
-} from "./chunk-RKICZ6DZ.js";
-import "./chunk-V77LO4RO.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-RUHO24SX.js";
+import "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 export {
   getActiveProfile,
   listProfiles,
@@ -37,4 +37,3 @@ export {
   saveProfile,
   switchProfile
 };
-//# sourceMappingURL=auth-KKINNBXT.js.map

package/build/{browser-auth-EEFGRHWY.js → browser-auth-OJSUNFBI.js}

@@ -1,9 +1,8 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
 import {
   browserLogin
-} from "./chunk-PGBVNMNZ.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-7GD2MFYI.js";
+import "./chunk-ILVPOLA7.js";
 export {
   browserLogin
 };
-//# sourceMappingURL=browser-auth-EEFGRHWY.js.map

package/build/{cache-EGNMENNA.js → cache-TBDQ7QBU.js}

@@ -4,8 +4,8 @@ import {
   getConfigDir,
   readJsonFile,
   writeJsonFile
-} from "./chunk-V77LO4RO.js";
-import "./chunk-KBVPIZS4.js";
+} from "./chunk-6PC3HUAK.js";
+import "./chunk-ILVPOLA7.js";
 
 // src/cli/cache.ts
 import { existsSync, unlinkSync } from "fs";
@@ -49,4 +49,3 @@ export {
   getCachedTools,
   setCachedTools
 };
-//# sourceMappingURL=cache-EGNMENNA.js.map

package/build/{chunk-V77LO4RO.js → chunk-6PC3HUAK.js}

@@ -1,7 +1,13 @@
 import { createRequire } from 'node:module'; const require = createRequire(import.meta.url);
 
 // src/cli/config-dir.ts
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  writeFileSync
+} from "fs";
 import { join } from "path";
 import { homedir } from "os";
 var DEFAULT_CONFIG = {
@@ -24,9 +30,9 @@ function getConfigDir() {
 }
 function ensureConfigDir() {
   const dir = getConfigDir();
-  if (!existsSync(dir)) mkdirSync(dir, { recursive: true });
+  if (!existsSync(dir)) mkdirSync(dir, { recursive: true, mode: 448 });
   const cacheDir = join(dir, "cache");
-  if (!existsSync(cacheDir)) mkdirSync(cacheDir, { recursive: true });
+  if (!existsSync(cacheDir)) mkdirSync(cacheDir, { recursive: true, mode: 448 });
 }
 function readJsonFile(filePath) {
   try {
@@ -41,6 +47,7 @@ function writeJsonFile(filePath, data) {
     encoding: "utf-8",
     mode: 384
   });
+  chmodSync(filePath, 384);
 }
 function getConfig() {
   const filePath = join(getConfigDir(), "config.json");
@@ -92,4 +99,3 @@ export {
   resolveApiKey,
   resolveApiUrl
 };
-//# sourceMappingURL=chunk-V77LO4RO.js.map