ineedcodes 1.7.0 → 1.7.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "ineedcodes",
-  "version": "1.7.0",
+  "version": "1.7.2",
   "description": "Your terminal, now autonomous. Just say what you want, ineed does the rest.",
   "license": "MIT",
   "type": "module",

package/src/cli.js

@@ -3,6 +3,9 @@
 // First open asks for provider setup. After that, just say what you want.
 
 import { spawn } from 'node:child_process';
+import * as fs from 'node:fs';
+import * as os from 'node:os';
+import * as path from 'node:path';
 
 const [MAJOR] = process.versions.node.split('.').map(Number);
 if (!(MAJOR >= 20)) {
@@ -27,6 +30,7 @@ ${bold('ineed')} ${dim(`v${VERSION}`)} - your terminal, now autonomous
 
   ${green('ineed')}                        interactive session (first open: setup)
   ${green('ineed "fix the build errors"')}  one-shot task
+  ${green('ineed unlock')}                 enable gated skills on this machine
   ${green('ineed --reset')}                 redo provider setup
   ${green('ineed --version')}               show version
 
@@ -35,6 +39,34 @@ Inside a session, ${dim('/help')} lists the shortcuts. Or just talk to it.
   process.exit(0);
 }
 
+// unlock: store the developer keyword locally so gated security skills activate here
+if (args[0] === 'unlock') {
+  const readline = await import('node:readline');
+  const { makeInput, dim, gray } = await import('./ui.js');
+  const keywordDir = process.env.INEED_CONFIG_DIR || path.join(os.homedir(), '.ineedcodes');
+  const keywordFile = path.join(keywordDir, 'keyword');
+  const given = args[1];
+  let keyword = '';
+  if (given) {
+    keyword = given.trim();
+  } else {
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const ask = makeInput(rl);
+    keyword = (await ask('Developer keyword: ', { secret: true })).trim();
+    rl.close();
+  }
+  if (!keyword) {
+    console.error(red('No keyword given. Nothing saved.'));
+    process.exit(1);
+  }
+  fs.mkdirSync(keywordDir, { recursive: true });
+  fs.writeFileSync(keywordFile, keyword, { mode: 0o600 });
+  try { fs.chmodSync(keywordFile, 0o600); } catch {}
+  console.log(green('Gated skills unlocked on this machine.'));
+  console.log(dim('Saved to ' + keywordFile + ' (0600). Use them by mentioning the keyword in a task, e.g. /skills or "use the sqli skill".'));
+  process.exit(0);
+}
+
 // internal: one-shot worker. Spawned by the branch below, never run by users.
 if (args[0] === '--child') {
   const task = args.slice(1).join(' ');

package/src/session.js

@@ -12,7 +12,7 @@ import { saveSession, listSessions, loadSession } from './sessions.js';
 import * as boost from './boost.js';
 import { spawnSync } from 'node:child_process';
 import { mcpConfigured } from './mcp.js';
-import { listSkills, findSkill } from './skills.js';
+import { listSkills, findSkill, devKeyword } from './skills.js';
 
 function currentBranch(cwd) {
   const r = spawnSync('git', ['rev-parse', '--abbrev-ref', 'HEAD'], { cwd, encoding: 'utf8' });
@@ -477,17 +477,18 @@ export async function startSession(cfg, { fresh = false, resume = null } = {}) {
     }
     if (input === '/skills' || input.startsWith('/skills ')) {
       const arg = input.slice(7).trim();
-      const unlocked = input.includes('0xyas051191') || (history.some(m => String(m.content).includes('0xyas051191')) && input.includes('0xyas051191'));
       if (arg) {
         const s = findSkill(arg, process.cwd(), input);
         if (s) { say(box([bold(`Skill ${s.name}`) + dim(` (${s.scope}${s.gated ? ', gated' : ''})`), s.description, '', dim('Instructions:'), s.instructions.slice(0, 1_500)])); say(dim('Say "use ' + s.name + ' to ..." and the agent follows them.')); }
         else say(red(`No skill named ${arg}.`));
         return;
       }
-      const all = listSkills(process.cwd(), input);
-      const gated = all.filter(s => s.gated).length;
+      const machineUnlocked = devKeyword() !== '';
+      const all = listSkills(process.cwd(), machineUnlocked ? devKeyword() : input);
+      const gated = machineUnlocked ? all.filter(x => x.gated).length : -1;
       say(all.length ? all.map(s => `  ${cyan(s.name)} ${dim('(' + s.scope + ')')} ${s.description}`).join('\n') : yellow('No skills installed.'));
-      if (gated) say(dim(`  (+${gated} gated security skills: mention 0xyas051191 in a task to unlock)`));
+      if (gated > 0) say(dim(`  (+${gated} gated security skills unlocked on this machine)`));
+      else if (!machineUnlocked) say(dim(`  gated security skills are locked on this machine - run ${bold('ineed unlock')} to enable`));
       return;
     }
     if (input === '/new') {

package/src/skills.js

@@ -3,8 +3,9 @@
 // Frontmatter: name, description, tools (optional restriction), instructions body below.
 //
 // GATED SKILLS: SKILL.md files whose frontmatter carries "gated: true" stay invisible
-// unless the user includes the developer keyword 0xyas051191 in their message. The keyword
-// is checked against the raw objective text, so it never ships enabled by accident.
+// unless the objective text contains the developer keyword. The keyword itself lives
+// OUTSIDE this repository: in the INEED_DEV_KEYWORD environment variable or in
+// ~/.ineedcodes/keyword (chmod 600). A fresh install cannot unlock gated skills.
 
 import * as fs from 'node:fs';
 import * as path from 'node:path';
@@ -13,7 +14,12 @@ import { fileURLToPath } from 'node:url';
 import * as url from 'node:url';
 const PKG_SKILLS = path.join(path.dirname(url.fileURLToPath(import.meta.url)), '..', 'skills');
 
-export const DEV_KEYWORD = '0xyas051191';
+const KEYWORD_FILE = path.join(CONFIG_DIR, 'keyword');
+
+export function devKeyword() {
+  if (process.env.INEED_DEV_KEYWORD) return String(process.env.INEED_DEV_KEYWORD).trim();
+  try { return fs.readFileSync(KEYWORD_FILE, 'utf8').trim(); } catch { return ''; }
+}
 
 const BUILTIN = [
   {
@@ -28,9 +34,23 @@ function parseFrontmatter(raw) {
   const m = raw.match(/^---\n([\s\S]*?)\n---\n?([\s\S]*)$/);
   if (!m) return null;
   const meta = {};
-  for (const line of m[1].split('\n')) {
-    const kv = line.match(/^(\w+):\s*(.+)$/);
-    if (kv) meta[kv[1]] = kv[2].trim();
+  const lines = m[1].split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    const kv = lines[i].match(/^(\w+):\s*(.*)$/);
+    if (!kv) continue;
+    // folded scalar (>-, >): join the indented continuation lines into one paragraph
+    if (/^(description|summary)$/.test(kv[1]) && ['', '>-', '>', '|', '|-'].includes(kv[2])) {
+      const parts = [];
+      let j = i + 1;
+      for (; j < lines.length; j++) {
+        if (/^\S/.test(lines[j])) break;
+        parts.push(lines[j].trim());
+      }
+      meta[kv[1]] = parts.join(' ').trim();
+      i = j - 1;
+      continue;
+    }
+    meta[kv[1]] = kv[2].trim();
   }
   if (!meta.name) return null;
   return {
@@ -56,8 +76,9 @@ function loadDir(dir, scope, out, forceGated = false) {
 }
 
 function isUnlocked(objective) {
-  if (!objective) return false;
-  return String(objective).includes(DEV_KEYWORD);
+  const kw = devKeyword();
+  if (!kw || !objective) return false;
+  return String(objective).includes(kw);
 }
 
 export function listSkills(cwd, objective = '') {

package/src/ui.js

@@ -1,6 +1,6 @@
 // ui.js: terminal helpers. No dependencies, respects NO_COLOR and non-TTY.
 
-export const VERSION = '1.7.0';
+export const VERSION = '1.7.2';
 
 const USE_COLOR = process.stdout.isTTY && !process.env.NO_COLOR;
 const wrap = (code, t) => USE_COLOR ? `\x1b[${code}m${t}\x1b[0m` : String(t);