kumo-cli 1.1.0 → 1.2.0

package/dist/transport/wsClient.js.map

@@ -1 +1 @@
-{"version":3,"file":"wsClient.js","sourceRoot":"","sources":["../../src/transport/wsClient.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAI9C,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,IAAa;IAC/B,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACrE,MAAM,GAAG,GAAG,IAA+B,CAAC;IAC5C,OAAO,gBAAgB,CAAC;QACtB,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC;QACjB,SAAS,EAAE,GAAG,CAAC,WAAW,CAAC;QAC3B,UAAU,EAAE,GAAG,CAAC,YAAY,CAAC;QAC7B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC;QACrB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC,CAAC,MAAM;KACpC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,OAAO,QAAQ;IAMT;IACA;IACA;IAPF,EAAE,GAAqB,IAAI,CAAC;IAC5B,cAAc,GAA0B,IAAI,CAAC;IAC7C,YAAY,GAA0B,IAAI,CAAC;IAEnD,YACU,MAAkC,EAClC,SAA2B,EAC3B,OAAoB;QAFpB,WAAM,GAAN,MAAM,CAA4B;QAClC,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAa;IAC3B,CAAC;IAEJ,IAAI,CAAC,IAAY;QACf,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvC,GAAG,CAAC,iBAAiB,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;YACzC,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACxB,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI,CAAC,EAAE,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC;QACrC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACtB,GAAG,CAAC,qBAAqB,SAAS,EAAE,EAAE,CAAC,CAAC;YACxC,IAAI,IAAI,CAAC,YAAY;gBAAE,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YACxD,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC,GAAG,EAAE;gBACnC,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;oBACrD,IAAI,CAAC,EAAE,CAAC,IAAI,EAAE,CAAC;oBACf,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,eAAe,EAAE,CAAC,CAAC;gBACvC,CAAC;YACH,CAAC,EAAE,IAAI,CAAC,CAAC;YACT,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;gBAC9D,GAAG,CAAC,iBAAiB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;gBAC3C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,GAAG,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACvB,GAAG,CAAC,uCAAuC,CAAC,CAAC;YAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;gBAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;gBAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;YAAC,CAAC;YACtF,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,CAAC;QAC/D,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAChC,CAAC;IAED,KAAK;QACH,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAAC,CAAC;QAC3F,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAAC,CAAC;QACtF,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAClC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;CACF"}
+{"version":3,"file":"wsClient.js","sourceRoot":"","sources":["../../src/transport/wsClient.ts"],"names":[],"mappings":"AAAA,OAAO,SAAS,MAAM,IAAI,CAAC;AAC3B,OAAO,EAAE,GAAG,EAAE,MAAM,mBAAmB,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAI9C,SAAS,gBAAgB,CAAC,IAAa;IACrC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC3F,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,iBAAiB,EAAE,gBAAgB,CAAC,CAAC,CAAC;AAEhE,iEAAiE;AACjE,SAAS,QAAQ,CAAC,SAAkC,EAAE,GAA4B,EAAE,IAAY;IAC9F,IAAI,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO;IAC9C,MAAM,MAAM,GAAG,CAAC,WAAW,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;IACzI,GAAG,CAAC,QAAQ,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC;AAC7E,CAAC;AAED,oFAAoF;AACpF,MAAM,sBAAsB,GAAG,MAAM,CAAC;AACtC,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,CAAC;AAC3C,gGAAgG;AAChG,MAAM,iBAAiB,GAAG,IAAI,CAAC;AAC/B,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,GAAG,CAAC,CAAC,EAAE,gBAAgB,CAAC,CAAC;IAC5F,OAAO,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,KAAK,GAAG,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,MAAM,OAAO,QAAQ;IAST;IACA;IACA;IAVF,EAAE,GAAqB,IAAI,CAAC;IAC5B,cAAc,GAA0B,IAAI,CAAC;IAC7C,YAAY,GAA0B,IAAI,CAAC;IAC3C,QAAQ,GAAG,CAAC,CAAC;IACrB,4CAA4C;IACpC,MAAM,GAAG,KAAK,CAAC;IAEvB,YACU,MAAkC,EAClC,SAA2B,EAC3B,OAAoB;QAFpB,WAAM,GAAN,MAAM,CAA4B;QAClC,cAAS,GAAT,SAAS,CAAkB;QAC3B,YAAO,GAAP,OAAO,CAAa;IAC3B,CAAC;IAEJ,IAAI,CAAC,IAAY;QACf,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,SAAS,CAAC,IAAI,EAAE,CAAC;YACrD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;YACvC,QAAQ,CAAC,UAAU,EAAE,IAA+B,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;YACtE,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO;QACT,CAAC;QACD,yDAAyD;QACzD,GAAG,CAAC,gBAAgB,MAAM,CAAE,IAAgC,CAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IAC9F,CAAC;IAED,OAAO;QACL,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC;QACpB,MAAM,EAAE,GAAG,IAAI,SAAS,CAAC,SAAS,EAAE,EAAE,EAAE,UAAU,EAAE,iBAAiB,EAAE,CAAC,CAAC;QACzE,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QACb,4FAA4F;QAC5F,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,IAAI,CAAC,YAAY,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,sBAAsB,CAAC,CAAC;QAC/E,CAAC,CAAC;QACF,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;YAClB,GAAG,CAAC,qBAAqB,SAAS,EAAE,EAAE,CAAC,CAAC;YACxC,WAAW,EAAE,CAAC;YACd,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC;QAC3E,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;QAC3B,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,GAAG,EAAE,EAAE;YACvB,MAAM,OAAO,GAAG,GAAG,CAAC,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC;gBACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAA4B,CAAC;gBAC9D,QAAQ,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC;gBAC7C,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACzB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBAAC,GAAG,CAAC,8BAA8B,KAAK,EAAE,CAAC,CAAC;YAAC,CAAC;QACjE,CAAC,CAAC,CAAC;QACH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YAClB,IAAI,CAAC,aAAa,EAAE,CAAC;YACrB,2EAA2E;YAC3E,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,EAAE,KAAK,EAAE;gBAAE,OAAO;YAC1C,MAAM,KAAK,GAAG,cAAc,CAAC,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC9C,GAAG,CAAC,sCAAsC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;YACvE,IAAI,CAAC,OAAO,EAAE,EAAE,CAAC;YACjB,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,KAAK,CAAC,CAAC;QAChE,CAAC,CAAC,CAAC;QACH,uEAAuE;QACvE,kFAAkF;QAClF,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,eAAe,KAAK,CAAC,OAAO,IAAK,KAA+B,CAAC,IAAI,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACxH,CAAC;IAED,KAAK;QACH,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC;QACnB,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAAC,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC;QAAC,CAAC;QAC3F,IAAI,CAAC,aAAa,EAAE,CAAC;QACrB,IAAI,CAAC;YAAC,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAA,CAAC;QAClC,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;IACjB,CAAC;IAEO,aAAa;QACnB,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;YAAC,YAAY,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;YAAC,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC;QAAC,CAAC;IACvF,CAAC;CACF"}

package/dist/utils/json.js

@@ -0,0 +1,7 @@
+// readers for untyped json from claude's stream and the app: a wrong type reads as empty
+export const str = (value) => (typeof value === 'string' ? value : '');
+export const obj = (value) => value && typeof value === 'object' && !Array.isArray(value) ? value : {};
+export const list = (value) => (Array.isArray(value) ? value.map(obj) : []);
+// the keys of source that hold a value
+export const pick = (source, keys) => Object.fromEntries(keys.filter((key) => source[key] !== undefined && source[key] !== null).map((key) => [key, source[key]]));
+//# sourceMappingURL=json.js.map

package/dist/utils/json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"json.js","sourceRoot":"","sources":["../../src/utils/json.ts"],"names":[],"mappings":"AAEA,yFAAyF;AAEzF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAU,EAAE,CAAC,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAExF,MAAM,CAAC,MAAM,GAAG,GAAG,CAAC,KAAc,EAAc,EAAE,CAChD,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAE,KAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;AAE3F,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,KAAc,EAAgB,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAEnG,uCAAuC;AACvC,MAAM,CAAC,MAAM,IAAI,GAAG,CAAC,MAAkB,EAAE,IAAc,EAAc,EAAE,CACrE,MAAM,CAAC,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,SAAS,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC"}

package/dist/utils/localHost.js

@@ -0,0 +1,17 @@
+// loopback and private-network hosts, where plain http stays on this machine or the lan
+export function isLocalHost(hostname) {
+    const host = hostname.replace(/^\[|\]$/g, '').toLowerCase();
+    return host === 'localhost' || host.endsWith('.local') || host === '::1'
+        || /^127\./.test(host) || /^10\./.test(host) || /^192\.168\./.test(host) || /^172\.(1[6-9]|2\d|3[01])\./.test(host);
+}
+// whether a url sends its traffic in the clear to a host outside this machine and the lan
+export function isCleartextRemote(rawUrl) {
+    try {
+        const url = new URL(rawUrl);
+        return (url.protocol === 'http:' || url.protocol === 'ws:') && !isLocalHost(url.hostname);
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=localHost.js.map

package/dist/utils/localHost.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"localHost.js","sourceRoot":"","sources":["../../src/utils/localHost.ts"],"names":[],"mappings":"AAAA,wFAAwF;AACxF,MAAM,UAAU,WAAW,CAAC,QAAgB;IAC1C,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;IAC5D,OAAO,IAAI,KAAK,WAAW,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,IAAI,KAAK,KAAK;WACnE,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,4BAA4B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxH,CAAC;AAED,0FAA0F;AAC1F,MAAM,UAAU,iBAAiB,CAAC,MAAc;IAC9C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,QAAQ,KAAK,OAAO,IAAI,GAAG,CAAC,QAAQ,KAAK,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/utils/safePath.js

@@ -1,7 +1,29 @@
 import fs from 'node:fs';
-import os from 'node:os';
 import path from 'node:path';
-// resolve a user-supplied path safely, allowing absolute paths and blocking traversal for relative ones.
+// whether target lies outside root (root itself counts as inside)
+function isOutside(root, target) {
+    const relative = path.relative(root, target);
+    return relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative);
+}
+// real location of a path that may not exist yet: resolve its nearest existing ancestor
+function realpathLoose(target) {
+    let existing = target;
+    const tail = [];
+    for (;;) {
+        try {
+            return path.join(fs.realpathSync.native(existing), ...tail.reverse());
+        }
+        catch {
+            const parent = path.dirname(existing);
+            if (parent === existing)
+                return target;
+            tail.push(path.basename(existing));
+            existing = parent;
+        }
+    }
+}
+// resolve a user-supplied path inside root, absolute or relative; symlinks and junctions
+// are followed so a link cannot lead out of the root.
 // handles msys2/git-bash style paths like /e/Data/... → E:\Data\... on windows.
 export function safePath(requestedPath, root = process.cwd()) {
     let p = requestedPath || '.';
@@ -13,12 +35,24 @@ export function safePath(requestedPath, root = process.cwd()) {
     const normalized = path.normalize(p);
     const projectRoot = path.resolve(root);
     const resolved = path.isAbsolute(normalized) ? path.resolve(normalized) : path.resolve(projectRoot, normalized);
-    const relative = path.relative(projectRoot, resolved);
-    if (relative === '..' || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative)) {
+    if (isOutside(projectRoot, resolved) || isOutside(realpathLoose(projectRoot), realpathLoose(resolved))) {
         throw new Error('path traversal blocked');
     }
     return resolved;
 }
+// the project root a request works in: the cli's own folder, or a folder inside it
+export function projectRootOf(cwd) {
+    return typeof cwd === 'string' && cwd ? safePath(cwd) : process.cwd();
+}
+// a path a mutating op may touch: given, inside root and not the root itself
+export function mutablePath(requestedPath, root) {
+    if (typeof requestedPath !== 'string' || !requestedPath.trim())
+        throw new Error('path is required');
+    const resolved = safePath(requestedPath, root);
+    if (path.relative(path.resolve(root), resolved) === '')
+        throw new Error('refusing to modify the project root');
+    return resolved;
+}
 export function safeCwd(requestedCwd) {
     if (!requestedCwd)
         return process.cwd();
@@ -32,24 +66,21 @@ export function safeCwd(requestedCwd) {
         return process.cwd();
     }
 }
-// recursively copy a file or directory tree
+// recursively copy a file or directory tree; links are copied as links, and a folder cannot be copied into itself
 export function copyRecursive(src, dest) {
-    const stat = fs.statSync(src);
-    if (stat.isDirectory()) {
-        fs.mkdirSync(dest, { recursive: true });
-        for (const child of fs.readdirSync(src)) {
-            copyRecursive(path.join(src, child), path.join(dest, child));
-        }
-    }
-    else {
-        fs.copyFileSync(src, dest);
-    }
+    fs.cpSync(src, dest, { recursive: true, verbatimSymlinks: true });
 }
-// claude-cli encodes a cwd into a folder name by replacing separators, colons and underscores with dashes
+// claude code's folder name for a project, as its own code makes it: every character but
+// a-z, A-Z and 0-9 becomes "-", and a name past 200 characters is cut and ends in a hash of
+// the cwd. any other spelling misses the folder of a cwd with a dot, a space or an accent
+const MAX_PROJECT_FOLDER = 200;
 export function cwdToProjectFolder(cwd) {
-    if (os.platform() === 'win32') {
-        return cwd.replace(/:/g, '-').replace(/[\\/]/g, '-').replace(/_/g, '-');
-    }
-    return cwd.replace(/\//g, '-').replace(/_/g, '-');
+    const name = cwd.replace(/[^a-zA-Z0-9]/g, '-');
+    if (name.length <= MAX_PROJECT_FOLDER)
+        return name;
+    let hash = 0;
+    for (let i = 0; i < cwd.length; i++)
+        hash = ((hash << 5) - hash + cwd.charCodeAt(i)) | 0;
+    return `${name.slice(0, MAX_PROJECT_FOLDER)}-${Math.abs(hash).toString(36)}`;
 }
 //# sourceMappingURL=safePath.js.map

package/dist/utils/safePath.js.map

@@ -1 +1 @@
-{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,yGAAyG;AACzG,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,aAAqB,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAClE,IAAI,CAAC,GAAG,aAAa,IAAI,GAAG,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAChH,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;IACtD,IAAI,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,YAAqB;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY;IACrD,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC9B,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxC,KAAK,MAAM,KAAK,IAAI,EAAE,CAAC,WAAW,CAAC,GAAG,CAAC,EAAE,CAAC;YACxC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,EAAE,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC7B,CAAC;AACH,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,IAAI,EAAE,CAAC,QAAQ,EAAE,KAAK,OAAO,EAAE,CAAC;QAC9B,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC"}
+{"version":3,"file":"safePath.js","sourceRoot":"","sources":["../../src/utils/safePath.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,kEAAkE;AAClE,SAAS,SAAS,CAAC,IAAY,EAAE,MAAc;IAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IAC7C,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AAChG,CAAC;AAED,wFAAwF;AACxF,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,QAAQ,GAAG,MAAM,CAAC;IACtB,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QACxE,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;YACtC,IAAI,MAAM,KAAK,QAAQ;gBAAE,OAAO,MAAM,CAAC;YACvC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;YACnC,QAAQ,GAAG,MAAM,CAAC;QACpB,CAAC;IACH,CAAC;AACH,CAAC;AAED,yFAAyF;AACzF,sDAAsD;AACtD,gFAAgF;AAChF,MAAM,UAAU,QAAQ,CAAC,aAAqB,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,EAAE;IAClE,IAAI,CAAC,GAAG,aAAa,IAAI,GAAG,CAAC;IAC7B,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;QAC5C,IAAI,IAAI;YAAE,CAAC,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;IAC7E,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACrC,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,QAAQ,GAAG,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,UAAU,CAAC,CAAC;IAChH,IAAI,SAAS,CAAC,WAAW,EAAE,QAAQ,CAAC,IAAI,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,aAAa,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QACvG,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,mFAAmF;AACnF,MAAM,UAAU,aAAa,CAAC,GAAa;IACzC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;AACxE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,WAAW,CAAC,aAAsB,EAAE,IAAY;IAC9D,IAAI,OAAO,aAAa,KAAK,QAAQ,IAAI,CAAC,aAAa,CAAC,IAAI,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC;IACpG,MAAM,QAAQ,GAAG,QAAQ,CAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,KAAK,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IAC/G,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,YAAqB;IAC3C,IAAI,CAAC,YAAY;QAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;QACxC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE;YAAE,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;QAC3F,OAAO,QAAQ,CAAC;IAClB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,OAAO,CAAC,GAAG,EAAE,CAAC;IACvB,CAAC;AACH,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,IAAY;IACrD,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED,yFAAyF;AACzF,4FAA4F;AAC5F,0FAA0F;AAC1F,MAAM,kBAAkB,GAAG,GAAG,CAAC;AAE/B,MAAM,UAAU,kBAAkB,CAAC,GAAW;IAC5C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,MAAM,IAAI,kBAAkB;QAAE,OAAO,IAAI,CAAC;IACnD,IAAI,IAAI,GAAG,CAAC,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE;QAAE,IAAI,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,IAAI,GAAG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACzF,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,kBAAkB,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;AAC/E,CAAC"}

package/package.json

@@ -1,62 +1,62 @@
-{
-  "name": "kumo-cli",
-  "version": "1.1.0",
-  "description": "Kumo CLI — where your code drifts between devices, softly. A pairing-based companion for the Kumo app that bridges your terminal sessions to remote devices.",
-  "type": "module",
-  "bin": {
-    "kumo": "dist/index.js"
-  },
-  "main": "dist/index.js",
-  "files": [
-    "dist",
-    "README.md",
-    "LICENSE"
-  ],
-  "scripts": {
-    "dev": "node --no-deprecation --import tsx src/index.ts --env-file ../.env",
-    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
-    "lint": "tsc --noEmit",
-    "test": "node ./scripts/run-tests.mjs",
-    "test:cov": "node ./scripts/run-tests.mjs --coverage",
-    "start": "node dist/index.js",
-    "prepublishOnly": "npm run build"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "license": "MIT",
-  "author": "Kumo",
-  "homepage": "https://github.com/kumo-app/kumo#readme",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/kumo-app/kumo.git",
-    "directory": "cli"
-  },
-  "bugs": {
-    "url": "https://github.com/kumo-app/kumo/issues"
-  },
-  "keywords": [
-    "kumo",
-    "cli",
-    "claude",
-    "claude-code",
-    "pty",
-    "remote",
-    "pairing",
-    "terminal",
-    "websocket"
-  ],
-  "dependencies": {
-    "claude-adapter": "^2.1.1",
-    "fastify": "^5.8.5",
-    "node-pty": "^1.1.0",
-    "openai": "^6.39.1",
-    "ws": "^8.18.0"
-  },
-  "devDependencies": {
-    "@types/node": "^22.0.0",
-    "@types/ws": "^8.5.12",
-    "tsx": "^4.19.2",
-    "typescript": "^5.6.0"
-  }
-}
+{
+  "name": "kumo-cli",
+  "version": "1.2.0",
+  "description": "Kumo CLI — where your code drifts between devices, softly. A pairing-based companion for the Kumo app that bridges your terminal sessions to remote devices.",
+  "type": "module",
+  "bin": {
+    "kumo": "dist/index.js"
+  },
+  "main": "dist/index.js",
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "scripts": {
+    "dev": "node --no-deprecation --import tsx src/index.ts --env-file ../.env",
+    "build": "node -e \"require('fs').rmSync('dist',{recursive:true,force:true})\" && tsc -p tsconfig.build.json",
+    "lint": "tsc --noEmit",
+    "test": "node ./scripts/run-tests.mjs",
+    "test:cov": "node ./scripts/run-tests.mjs --coverage",
+    "start": "node dist/index.js",
+    "prepublishOnly": "npm run build"
+  },
+  "engines": {
+    "node": ">=20"
+  },
+  "license": "MIT",
+  "author": "Kumo",
+  "homepage": "https://kumocli.com",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/tungnguyensnk/kumo.git",
+    "directory": "cli"
+  },
+  "bugs": {
+    "url": "https://github.com/tungnguyensnk/kumo/issues"
+  },
+  "keywords": [
+    "kumo",
+    "cli",
+    "claude",
+    "claude-code",
+    "pty",
+    "remote",
+    "pairing",
+    "terminal",
+    "websocket"
+  ],
+  "dependencies": {
+    "claude-adapter": "^2.1.1",
+    "fastify": "^5.8.5",
+    "node-pty": "^1.1.0",
+    "openai": "^6.39.1",
+    "ws": "^8.18.0"
+  },
+  "devDependencies": {
+    "@types/node": "^22.0.0",
+    "@types/ws": "^8.5.12",
+    "tsx": "^4.19.2",
+    "typescript": "^5.6.0"
+  }
+}