myshell-tools 2.8.0 → 2.13.0

package/dist/commands/login.js

@@ -13,9 +13,11 @@
  *   - 'code':   a no-localhost flow that works anywhere.
  *       · claude → `claude setup-token`: prints a link; the user signs in at
  *         claude.ai, copies the authorization code, and pastes it back here.
- *         After the command exits, we prompt the user to paste the minted token
- *         (sk-ant-oat…), persist it, and inject it into process.env so that
- *         subsequent `claude auth status` and `claude -p …` calls see it.
+ *         We TEE the output so we can scan it for the minted token
+ *         (sk-ant-oat…) automatically. If auto-capture finds the token, it is
+ *         persisted immediately with no user action required. Otherwise we fall
+ *         back to prompting the user to paste it (up to 3 retries, with helpful
+ *         warnings for blank or wrong-type inputs).
  *       · codex  → `codex login --device-auth`: prints a URL + one-time code;
  *         the user authorizes their ChatGPT account on any device.
  *
@@ -23,14 +25,15 @@
  * to 'code' (so the localhost trap is avoided), everything else to 'browser'.
  *
  * Security: myshell-tools never stores raw API keys or passwords.  The Claude
- * OAuth token (sk-ant-oat…) is captured only after the user explicitly pastes
- * it and is stored in ~/.myshell-tools/credentials.json (mode 0o600).
+ * OAuth token (sk-ant-oat…) is either auto-captured from the tee'd output or
+ * captured after the user explicitly pastes it, and is stored in
+ * ~/.myshell-tools/credentials.json (mode 0o600).
  */
 import readline from 'node:readline';
 import { execa } from 'execa';
 import { detectProvider, getInstallCommand } from '../providers/detect.js';
-import { bold, dim, green, red } from '../ui/theme.js';
-import { extractClaudeToken, saveClaudeToken } from '../infra/credentials.js';
+import { bold, dim, green, red, yellow } from '../ui/theme.js';
+import { classifyPastedSecret, extractClaudeToken, saveClaudeToken, stripPastedSecretWrapper, } from '../infra/credentials.js';
 /** Each provider's default (browser/localhost) sign-in command. */
 const LOGIN_COMMAND = {
     claude: { bin: 'claude', args: ['auth', 'login'] },
@@ -50,7 +53,8 @@ const LOGIN_CODE_COMMAND = {
         guidance: 'A sign-in link will appear below.\n' +
             '  1. Open it in any browser and sign in at claude.ai.\n' +
             '  2. Copy the authorization code it shows you.\n' +
-            '  3. Paste the code back here at the prompt and press Enter.',
+            '  3. Paste the code back here at the prompt and press Enter.\n' +
+            '  We will capture the token automatically when possible.',
     },
     codex: {
         bin: 'codex',
@@ -142,28 +146,60 @@ export async function runLogin(out, providerArg, opts) {
         }
         // stdio:'inherit' hands the terminal to the provider CLI so its OAuth /
         // device / paste flow runs in place. reject:false so we report rather than throw.
+        //
+        // For the claude code method we use a special tee-capture approach: stdout
+        // and stderr are piped so we can scan for the token, but each line is also
+        // written verbatim to the real terminal so the user sees the flow live.
+        // stdin is still inherited so the user can interact (paste the auth code).
         let result;
-        if (method === 'code') {
+        let capturedOutput = '';
+        if (method === 'code' && id === 'claude') {
             const { bin, args, guidance } = LOGIN_CODE_COMMAND[id];
             out.write(bold(`\nSigning in to ${id} — code method (no localhost needed).\n`, out.color));
             out.write(dim(guidance + '\n', out.color));
-            result = await execa(bin, [...args], { stdio: 'inherit', reject: false });
+            capturedOutput = await runWithTeeCapture(bin, [...args]);
+            // We use a synthetic exit-code-0 result — tee-capture never throws, and
+            // we treat the flow as complete regardless of the subprocess exit code
+            // (the token presence is the real signal).
+            result = { exitCode: 0 };
+        }
+        else if (method === 'code') {
+            const { bin, args, guidance } = LOGIN_CODE_COMMAND[id];
+            out.write(bold(`\nSigning in to ${id} — code method (no localhost needed).\n`, out.color));
+            out.write(dim(guidance + '\n', out.color));
+            result = await execa(bin, [...args], { stdin: 'inherit', stdout: 'inherit', stderr: 'inherit', reject: false });
         }
         else {
             const { bin, args } = LOGIN_COMMAND[id];
             out.write(bold(`\nSigning in to ${id} — a browser window may open…\n`, out.color));
-            result = await execa(bin, [...args], { stdio: 'inherit', reject: false });
+            result = await execa(bin, [...args], { stdin: 'inherit', stdout: 'inherit', stderr: 'inherit', reject: false });
         }
         if (result.exitCode === 0) {
-            out.write(green(`✓ ${id} sign-in complete.\n`, out.color));
             // --- Claude code-method token capture -----------------------------------
             // `claude setup-token` mints a long-lived token (sk-ant-oat01-…) and PRINTS
-            // it to the terminal but does NOT persist it.  After the command exits we
-            // prompt the user to paste the token so we can store it and inject it into
-            // process.env — making `claude auth status` report loggedIn:true and making
-            // every subsequent `claude -p …` spawn work without manual env-var setup.
+            // it to the terminal. We tee'd the output above and scan it first.
+            // If auto-capture finds the token, we're done. Otherwise we fall back to
+            // the paste prompt (up to 3 retries) so the user can paste it manually.
             if (id === 'claude' && method === 'code') {
-                await captureClaudeToken(out, opts?.readLine);
+                const autoToken = extractClaudeToken(capturedOutput);
+                if (autoToken !== null) {
+                    try {
+                        await saveClaudeToken(autoToken);
+                        process.env['CLAUDE_CODE_OAUTH_TOKEN'] = autoToken;
+                        out.write(green('✓ Claude token captured and saved — claude is now ready.\n', out.color));
+                    }
+                    catch {
+                        out.write(dim('Could not save token to disk — re-run `myshell-tools login claude --code` later.\n', out.color));
+                    }
+                }
+                else {
+                    // Auto-capture found nothing — fall back to paste prompt.
+                    out.write(green(`✓ ${id} sign-in complete.\n`, out.color));
+                    await captureClaudeTokenWithPaste(out, opts?.readLine);
+                }
+            }
+            else {
+                out.write(green(`✓ ${id} sign-in complete.\n`, out.color));
             }
         }
         else {
@@ -179,45 +215,108 @@ export async function runLogin(out, providerArg, opts) {
     return 0;
 }
 // ---------------------------------------------------------------------------
-// Token capture helper (internal — exported for tests via credentials.ts)
+// Tee-capture helper (internal)
+// ---------------------------------------------------------------------------
+/**
+ * Run a command with stdout and stderr piped (tee'd to the real terminal) and
+ * stdin inherited. Returns the accumulated stdout+stderr text, or an empty
+ * string on spawn failure. Never throws.
+ *
+ * Uses execa v9's `all: true` option to merge stdout+stderr into one stream,
+ * then iterates it via `subprocess.iterable({ from: 'all', preserveNewlines: true })`
+ * while mirroring each chunk to `process.stdout` so the user sees the output
+ * live. stdin is inherited so the user can interact (e.g. paste an auth code).
+ */
+async function runWithTeeCapture(bin, args) {
+    try {
+        const subprocess = execa(bin, [...args], {
+            stdin: 'inherit',
+            stdout: 'pipe',
+            stderr: 'pipe',
+            all: true,
+            reject: false,
+            timeout: 300_000,
+        });
+        const chunks = [];
+        for await (const line of subprocess.iterable({ from: 'all', preserveNewlines: true })) {
+            const text = typeof line === 'string' ? line : String(line);
+            process.stdout.write(text);
+            chunks.push(text);
+        }
+        await subprocess; // wait for exit (already resolved by the iteration above)
+        return chunks.join('');
+    }
+    catch {
+        // Spawn error or unexpected failure — return empty so the caller falls back
+        // to the paste prompt.
+        return '';
+    }
+}
+// ---------------------------------------------------------------------------
+// Paste-fallback token capture helper (internal)
 // ---------------------------------------------------------------------------
 /**
  * Prompt the user to paste the token shown by `claude setup-token`, extract
  * it, persist it, and inject it into `process.env.CLAUDE_CODE_OAUTH_TOKEN`.
  *
+ * Retries up to 3 times:
+ *   - Blank input  → skip silently with a note.
+ *   - API key      → print a specific warning (that's sk-ant-api, not sk-ant-oat).
+ *   - Invalid      → warn and re-prompt.
+ *   - Valid token  → save and set env.
+ *
  * Uses the injected `readLine` when provided (menu shares its single readline
  * interface). Otherwise creates a temporary readline interface, reads ONE line,
  * and immediately closes it (so stdin is not held open).
  *
- * Never throws — a blank or invalid paste is reported as a dim advisory note.
+ * Never throws.
  */
-async function captureClaudeToken(out, readLine) {
-    out.write('\nPaste the token shown above (starts with sk-ant-oat) and press Enter' +
-        ' — or leave blank to skip:\n> ');
-    let pasted;
-    if (readLine !== undefined) {
-        // Menu injected its own reader — use it directly, do NOT create a second
-        // readline interface (that would double-consume stdin).
-        pasted = await readLine();
-    }
-    else {
-        // CLI direct path — create a temporary readline, read one line, close.
-        pasted = await readOneLineFromStdin();
-    }
-    const token = extractClaudeToken(pasted ?? '');
-    if (token !== null) {
-        try {
-            await saveClaudeToken(token);
-            process.env['CLAUDE_CODE_OAUTH_TOKEN'] = token;
-            out.write(green('✓ Claude token saved — claude is now ready.\n', out.color));
+async function captureClaudeTokenWithPaste(out, readLine) {
+    const MAX_RETRIES = 3;
+    for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+        out.write(`\nPaste the token shown above (starts with sk-ant-oat) and press Enter` +
+            ` — or leave blank to skip (attempt ${attempt}/${MAX_RETRIES}):\n> `);
+        let raw;
+        if (readLine !== undefined) {
+            // Menu injected its own reader — use it directly, do NOT create a second
+            // readline interface (that would double-consume stdin).
+            raw = await readLine();
+        }
+        else {
+            // CLI direct path — create a temporary readline, read one line, close.
+            raw = await readOneLineFromStdin();
         }
-        catch {
-            out.write(dim('Could not save token to disk — you can re-run `myshell-tools login claude --code` later.\n', out.color));
+        const normalised = stripPastedSecretWrapper(raw ?? '');
+        if (normalised === '') {
+            out.write(dim('Skipped — no token entered.\n', out.color));
+            return;
+        }
+        const kind = classifyPastedSecret(normalised);
+        if (kind === 'api-key') {
+            out.write(yellow('That looks like an Anthropic API key (sk-ant-api…), not the setup-token\n' +
+                'OAuth token. Please paste the sk-ant-oat… value instead.\n', out.color));
+            continue;
+        }
+        const token = extractClaudeToken(normalised);
+        if (token !== null) {
+            try {
+                await saveClaudeToken(token);
+                process.env['CLAUDE_CODE_OAUTH_TOKEN'] = token;
+                out.write(green('✓ Claude token saved — claude is now ready.\n', out.color));
+            }
+            catch {
+                out.write(dim('Could not save token to disk — you can re-run `myshell-tools login claude --code` later.\n', out.color));
+            }
+            return;
+        }
+        // Not a recognised token format.
+        if (attempt < MAX_RETRIES) {
+            out.write(dim('Token not recognised — expected sk-ant-oat… format. Please try again.\n', out.color));
+        }
+        else {
+            out.write(dim('Token not captured after 3 attempts. Re-run `myshell-tools login claude --code`\n' +
+                'and paste the sk-ant-oat… value (NOT an Anthropic API key starting with sk-ant-api).\n', out.color));
         }
-    }
-    else {
-        out.write(dim('Token not captured. Re-run `myshell-tools login claude --code` and paste the\n' +
-            'sk-ant-oat… value (NOT an Anthropic API key starting with sk-ant-api).\n', out.color));
     }
 }
 /**

package/dist/commands/login.js.map

@@ -1 +1 @@
-{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EAAE,kBAAkB,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAK9E,mEAAmE;AACnE,MAAM,aAAa,GAAmF;IACpG,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAClD,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE;IACxC,mFAAmF;IACnF,6EAA6E;IAC7E,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;CACvD,CAAC;AAEF;;;GAGG;AACH,MAAM,kBAAkB,GAGpB;IACF,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,CAAC,aAAa,CAAC;QACrB,QAAQ,EACN,qCAAqC;YACrC,yDAAyD;YACzD,kDAAkD;YAClD,8DAA8D;KACjE;IACD,KAAK,EAAE;QACL,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;QAChC,QAAQ,EACN,gDAAgD;YAChD,qCAAqC;YACrC,iEAAiE;YACjE,4DAA4D;KAC/D;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACvB,QAAQ,EACN,8BAA8B;YAC9B,iFAAiF;YACjF,gDAAgD;YAChD,qEAAqE;KACxE;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,IACE,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS;QAC5B,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS;QACtC,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS;QAC/B,GAAG,CAAC,qBAAqB,CAAC,KAAK,SAAS,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,QAAQ,KAAK,OAAO;QACpB,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvD,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAiC,EACjC,GAAsB,EACtB,QAAyB;IAEzB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAe,EACf,WAAoB,EACpB,IAAwE;IAExE,IAAI,OAAqB,CAAC;IAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,WAAW,uCAAuC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnG,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/E,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,GAAG,EAAE,6CAA6C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAC5F,CAAC;YACF,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,kFAAkF;QAClF,IAAI,MAAM,CAAC;QACX,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YACtB,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,iCAAiC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnF,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5E,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAE3D,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,2EAA2E;YAC3E,4EAA4E;YAC5E,0EAA0E;YAC1E,IAAI,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACzC,MAAM,kBAAkB,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;YAChD,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,KAAK,EAAE,mCAAmC,MAAM,CAAC,QAAQ,IAAI,SAAS,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAC7F,CAAC;YACF,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CACP,GAAG,CACD,sEAAsE;oBACpE,yBAAyB,EAAE,WAAW,EACxC,GAAG,CAAC,KAAK,CACV,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,KAAK,UAAU,kBAAkB,CAC/B,GAAe,EACf,QAAuC;IAEvC,GAAG,CAAC,KAAK,CACP,wEAAwE;QACtE,gCAAgC,CACnC,CAAC;IAEF,IAAI,MAAqB,CAAC;IAE1B,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,yEAAyE;QACzE,wDAAwD;QACxD,MAAM,GAAG,MAAM,QAAQ,EAAE,CAAC;IAC5B,CAAC;SAAM,CAAC;QACN,uEAAuE;QACvE,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC;IAE/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,IAAI,CAAC;YACH,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;YAC7B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC;YAC/C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;QAC/E,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,CAAC,KAAK,CACP,GAAG,CACD,4FAA4F,EAC5F,GAAG,CAAC,KAAK,CACV,CACF,CAAC;QACJ,CAAC;IACH,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,KAAK,CACP,GAAG,CACD,gFAAgF;YAC9E,0EAA0E,EAC5E,GAAG,CAAC,KAAK,CACV,CACF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YAC9B,QAAQ,GAAG,IAAI,CAAC;YAChB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,gFAAgF"}
+{"version":3,"file":"login.js","sourceRoot":"","sources":["../../src/commands/login.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AAEH,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,OAAO,CAAC;AAG9B,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAC3E,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EACL,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,wBAAwB,GACzB,MAAM,yBAAyB,CAAC;AAKjC,mEAAmE;AACnE,MAAM,aAAa,GAAmF;IACpG,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;IAClD,KAAK,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,OAAO,CAAC,EAAE;IACxC,mFAAmF;IACnF,6EAA6E;IAC7E,QAAQ,EAAE,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;CACvD,CAAC;AAEF;;;GAGG;AACH,MAAM,kBAAkB,GAGpB;IACF,MAAM,EAAE;QACN,GAAG,EAAE,QAAQ;QACb,IAAI,EAAE,CAAC,aAAa,CAAC;QACrB,QAAQ,EACN,qCAAqC;YACrC,yDAAyD;YACzD,kDAAkD;YAClD,gEAAgE;YAChE,0DAA0D;KAC7D;IACD,KAAK,EAAE;QACL,GAAG,EAAE,OAAO;QACZ,IAAI,EAAE,CAAC,OAAO,EAAE,eAAe,CAAC;QAChC,QAAQ,EACN,gDAAgD;YAChD,qCAAqC;YACrC,iEAAiE;YACjE,4DAA4D;KAC/D;IACD,QAAQ,EAAE;QACR,GAAG,EAAE,UAAU;QACf,IAAI,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QACvB,QAAQ,EACN,8BAA8B;YAC9B,iFAAiF;YACjF,gDAAgD;YAChD,qEAAqE;KACxE;CACF,CAAC;AAEF,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,OAAO,IAAI,KAAK,KAAK,UAAU,CAAC;AACzE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,aAAa,CAAC,GAAsB,EAAE,QAAyB;IAC7E,IACE,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS;QAC5B,GAAG,CAAC,mBAAmB,CAAC,KAAK,SAAS;QACtC,GAAG,CAAC,YAAY,CAAC,KAAK,SAAS;QAC/B,GAAG,CAAC,qBAAqB,CAAC,KAAK,SAAS,EACxC,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,GAAG,CAAC,gBAAgB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,EAAE,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IACE,QAAQ,KAAK,OAAO;QACpB,CAAC,GAAG,CAAC,SAAS,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;QACvD,CAAC,GAAG,CAAC,iBAAiB,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC,EACvE,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAiC,EACjC,GAAsB,EACtB,QAAyB;IAEzB,IAAI,QAAQ,KAAK,SAAS;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,aAAa,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,QAAQ,CAC5B,GAAe,EACf,WAAoB,EACpB,IAAwE;IAExE,IAAI,OAAqB,CAAC;IAC1B,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,IAAI,CAAC,YAAY,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,qBAAqB,WAAW,uCAAuC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnG,OAAO,CAAC,CAAC;QACX,CAAC;QACD,OAAO,GAAG,CAAC,WAAW,CAAC,CAAC;IAC1B,CAAC;SAAM,CAAC;QACN,OAAO,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAC,CAAC;IAC5C,CAAC;IAED,MAAM,MAAM,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAE/E,KAAK,MAAM,EAAE,IAAI,OAAO,EAAE,CAAC;QACzB,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,EAAE,CAAC,CAAC;QACxC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,GAAG,EAAE,6CAA6C,iBAAiB,CAAC,EAAE,CAAC,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAC5F,CAAC;YACF,SAAS;QACX,CAAC;QAED,wEAAwE;QACxE,kFAAkF;QAClF,EAAE;QACF,2EAA2E;QAC3E,2EAA2E;QAC3E,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,MAAM,CAAC;QACX,IAAI,cAAc,GAAG,EAAE,CAAC;QAExB,IAAI,MAAM,KAAK,MAAM,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;YACzC,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,cAAc,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC;YACzD,wEAAwE;YACxE,uEAAuE;YACvE,2CAA2C;YAC3C,MAAM,GAAG,EAAE,QAAQ,EAAE,CAAC,EAAW,CAAC;QACpC,CAAC;aAAM,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;YAC7B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,QAAQ,EAAE,GAAG,kBAAkB,CAAC,EAAE,CAAC,CAAC;YACvD,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,yCAAyC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3F,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,GAAG,IAAI,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3C,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClH,CAAC;aAAM,CAAC;YACN,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,aAAa,CAAC,EAAE,CAAC,CAAC;YACxC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,mBAAmB,EAAE,iCAAiC,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YACnF,MAAM,GAAG,MAAM,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC;QAClH,CAAC;QAED,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC1B,2EAA2E;YAC3E,4EAA4E;YAC5E,mEAAmE;YACnE,yEAAyE;YACzE,wEAAwE;YACxE,IAAI,EAAE,KAAK,QAAQ,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;gBACzC,MAAM,SAAS,GAAG,kBAAkB,CAAC,cAAc,CAAC,CAAC;gBACrD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;oBACvB,IAAI,CAAC;wBACH,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;wBACjC,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,SAAS,CAAC;wBACnD,GAAG,CAAC,KAAK,CACP,KAAK,CACH,4DAA4D,EAC5D,GAAG,CAAC,KAAK,CACV,CACF,CAAC;oBACJ,CAAC;oBAAC,MAAM,CAAC;wBACP,GAAG,CAAC,KAAK,CACP,GAAG,CACD,oFAAoF,EACpF,GAAG,CAAC,KAAK,CACV,CACF,CAAC;oBACJ,CAAC;gBACH,CAAC;qBAAM,CAAC;oBACN,0DAA0D;oBAC1D,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;oBAC3D,MAAM,2BAA2B,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;gBACzD,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,EAAE,sBAAsB,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC7D,CAAC;QACH,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,GAAG,CAAC,KAAK,EAAE,mCAAmC,MAAM,CAAC,QAAQ,IAAI,SAAS,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAC7F,CAAC;YACF,yEAAyE;YACzE,mEAAmE;YACnE,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,GAAG,CAAC,KAAK,CACP,GAAG,CACD,sEAAsE;oBACpE,yBAAyB,EAAE,WAAW,EACxC,GAAG,CAAC,KAAK,CACV,CACF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,CAAC,CAAC;AACX,CAAC;AAED,8EAA8E;AAC9E,gCAAgC;AAChC,8EAA8E;AAE9E;;;;;;;;;GASG;AACH,KAAK,UAAU,iBAAiB,CAAC,GAAW,EAAE,IAAuB;IACnE,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACvC,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,MAAM;YACd,MAAM,EAAE,MAAM;YACd,GAAG,EAAE,IAAI;YACT,MAAM,EAAE,KAAK;YACb,OAAO,EAAE,OAAO;SACjB,CAAC,CAAC;QAEH,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,KAAK,EAAE,MAAM,IAAI,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;YACtF,MAAM,IAAI,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;QAED,MAAM,UAAU,CAAC,CAAC,0DAA0D;QAC5E,OAAO,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,4EAA4E;QAC5E,uBAAuB;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,8EAA8E;AAC9E,iDAAiD;AACjD,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,KAAK,UAAU,2BAA2B,CACxC,GAAe,EACf,QAAuC;IAEvC,MAAM,WAAW,GAAG,CAAC,CAAC;IAEtB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,WAAW,EAAE,OAAO,EAAE,EAAE,CAAC;QACxD,GAAG,CAAC,KAAK,CACP,wEAAwE;YACtE,sCAAsC,OAAO,IAAI,WAAW,QAAQ,CACvE,CAAC;QAEF,IAAI,GAAkB,CAAC;QAEvB,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,yEAAyE;YACzE,wDAAwD;YACxD,GAAG,GAAG,MAAM,QAAQ,EAAE,CAAC;QACzB,CAAC;aAAM,CAAC;YACN,uEAAuE;YACvE,GAAG,GAAG,MAAM,oBAAoB,EAAE,CAAC;QACrC,CAAC;QAED,MAAM,UAAU,GAAG,wBAAwB,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC;QAEvD,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;YACtB,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,+BAA+B,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC3D,OAAO;QACT,CAAC;QAED,MAAM,IAAI,GAAG,oBAAoB,CAAC,UAAU,CAAC,CAAC;QAE9C,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,GAAG,CAAC,KAAK,CACP,MAAM,CACJ,2EAA2E;gBACzE,4DAA4D,EAC9D,GAAG,CAAC,KAAK,CACV,CACF,CAAC;YACF,SAAS;QACX,CAAC;QAED,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;QAE7C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;YACnB,IAAI,CAAC;gBACH,MAAM,eAAe,CAAC,KAAK,CAAC,CAAC;gBAC7B,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,GAAG,KAAK,CAAC;gBAC/C,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,+CAA+C,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;YAC/E,CAAC;YAAC,MAAM,CAAC;gBACP,GAAG,CAAC,KAAK,CACP,GAAG,CACD,4FAA4F,EAC5F,GAAG,CAAC,KAAK,CACV,CACF,CAAC;YACJ,CAAC;YACD,OAAO;QACT,CAAC;QAED,iCAAiC;QACjC,IAAI,OAAO,GAAG,WAAW,EAAE,CAAC;YAC1B,GAAG,CAAC,KAAK,CACP,GAAG,CACD,yEAAyE,EACzE,GAAG,CAAC,KAAK,CACV,CACF,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,KAAK,CACP,GAAG,CACD,mFAAmF;gBACjF,wFAAwF,EAC1F,GAAG,CAAC,KAAK,CACV,CACF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB;IAC3B,OAAO,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QAC5C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,QAAQ,EAAE,KAAK;SAChB,CAAC,CAAC;QAEH,IAAI,QAAQ,GAAG,KAAK,CAAC;QAErB,EAAE,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,GAAW,EAAE,EAAE;YAC9B,QAAQ,GAAG,IAAI,CAAC;YAChB,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACtB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE;YACpB,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,CAAC,IAAI,CAAC,CAAC;YAChB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,8EAA8E;AAC9E,gFAAgF"}

package/dist/core/classify.d.ts

@@ -2,17 +2,33 @@
  * src/core/classify.ts — pure task classification.
  *
  * Determines the orchestration tier and security risk level from a free-text
- * task description using keyword/regex signals. No I/O, no time, no randomness.
+ * task description using a multi-signal scoring approach. No I/O, no time,
+ * no randomness — pure function.
  *
  * Honesty Contract: no fabricated confidence numbers are produced here.
- * The rationale field names the matched signal so callers can audit decisions.
+ * The rationale field names the matched signals so callers can audit decisions.
+ *
+ * # Tier scoring model
+ *
+ * Each tier has a list of keyword patterns. The text is matched against all
+ * three lists and a score (count of matches) is accumulated per tier.
+ * Tie-break is deterministic: manager > ic > worker.
+ * Default when nothing matches: ic.
+ *
+ * # Risk model
+ *
+ * Priority cascade: critical > high > medium > low.
+ * Word boundaries prevent false positives (e.g. "keyboard" does not match
+ * the "key" critical signal).
  */
 import type { Classification } from './types.js';
 /**
  * Classify a free-text `task` string into a {@link Classification}.
  *
- * Tier priority: manager > worker > ic (ic is the default).
- * Risk priority: critical > high > medium > low (low is the default).
+ * Tier: multi-signal scoring; tie-break manager > ic > worker; default ic.
+ * Risk: priority cascade critical > high > medium > low; default low.
+ *
+ * Never throws — empty or whitespace input returns a safe default.
  *
  * @param task - The raw task description from the user.
  */

package/dist/core/classify.js

@@ -2,79 +2,277 @@
  * src/core/classify.ts — pure task classification.
  *
  * Determines the orchestration tier and security risk level from a free-text
- * task description using keyword/regex signals. No I/O, no time, no randomness.
+ * task description using a multi-signal scoring approach. No I/O, no time,
+ * no randomness — pure function.
  *
  * Honesty Contract: no fabricated confidence numbers are produced here.
- * The rationale field names the matched signal so callers can audit decisions.
+ * The rationale field names the matched signals so callers can audit decisions.
+ *
+ * # Tier scoring model
+ *
+ * Each tier has a list of keyword patterns. The text is matched against all
+ * three lists and a score (count of matches) is accumulated per tier.
+ * Tie-break is deterministic: manager > ic > worker.
+ * Default when nothing matches: ic.
+ *
+ * # Risk model
+ *
+ * Priority cascade: critical > high > medium > low.
+ * Word boundaries prevent false positives (e.g. "keyboard" does not match
+ * the "key" critical signal).
  */
 // ---------------------------------------------------------------------------
 // Tier signal tables
 // ---------------------------------------------------------------------------
-/** Words that signal a manager-tier task (review, planning, architecture, security). */
-const MANAGER_WORDS = /\b(review|plan|design|architect|audit|security|threat|evaluate|assess|complex)\b/i;
-/** Words that signal a worker-tier task (read-only lookups, searches). */
-const WORKER_WORDS = /\b(find|search|grep|locate|list|read[-\s]only|lookup|scan|what\s+is)\b/i;
+/**
+ * Manager-tier signals: review/planning/architecture/audit tasks that require
+ * high-level judgment across the codebase or system.
+ */
+const MANAGER_SIGNALS = [
+    /\breview\b/i,
+    /\bplan\b/i,
+    /\bdesign\b/i,
+    /\barchitect(?:ure)?\b/i,
+    /\baudit\b/i,
+    /\bsecurity\b/i,
+    /\bthreat\s+model\b/i,
+    /\bevaluate\b/i,
+    /\bassess\b/i,
+    /\bcompare\s+approaches?\b/i,
+    /\btrade[-\s]?offs?\b/i,
+    /\bwhich\s+approach\b/i,
+    /\bshould\s+we\b/i,
+    /\bstrategy\b/i,
+    /\bhigh[-\s]level\b/i,
+    /\bacross\s+the\s+(?:codebase|system)\b/i,
+    /\bend[-\s]to[-\s]end\b/i,
+    /\blarge\s+migration\b/i,
+    /\bcomplex(?:ity)?\b/i,
+    /\bcomplicated\b/i,
+];
+/**
+ * Worker-tier signals: pure read-only lookups, searches, and explanations —
+ * no file mutation implied.
+ */
+const WORKER_SIGNALS = [
+    /\bfind\b/i,
+    /\bsearch\b/i,
+    /\bgrep\b/i,
+    /\blocate\b/i,
+    /\blist\b/i,
+    /\bread[-\s]?only\b/i,
+    /\blookup\b/i,
+    /\bscan\b/i,
+    /\bshow\b/i,
+    /\bdisplay\b/i,
+    /\bprint\b/i,
+    /\bcount\b/i,
+    /\bwhat\s+(?:is|are)\b/i,
+    /\bwhere\s+(?:is|are)\b/i,
+    /\bwhich\s+(?:is|are)\b/i,
+    /\bwho\s+(?:is|are)\b/i,
+    /\bhow\s+does\b/i,
+    /\bexplain\b/i,
+    /\bdescribe\b/i,
+    /\bsummariz(?:e|ise)\b/i,
+    /\bwhat\s+does\b/i,
+];
+/**
+ * IC-tier signals: implementation and hands-on editing tasks.
+ * (Used for tie-breaking and direct scoring; ic is the default tier.)
+ */
+const IC_SIGNALS = [
+    /\bimplement\b/i,
+    /\bwrite\b/i,
+    /\badd\b/i,
+    /\bcreate\b/i,
+    /\bbuild\b/i,
+    /\bfix\b/i,
+    /\bdebug\b/i,
+    /\brefactor\b/i,
+    /\bupdate\b/i,
+    /\bmodify\b/i,
+    /\bchange\b/i,
+    /\brename\b/i,
+    /\bremove\b/i,
+    /\bdelete\b/i,
+    /\bmove\b/i,
+    /\brewrite\b/i,
+    /\boptimize\b/i,
+    /\bformat\b/i,
+    /\bwire\s+up\b/i,
+    /\bhook\s+up\b/i,
+    /\badd\s+tests?\b/i,
+];
+// ---------------------------------------------------------------------------
+// Risk signal tables — highest priority wins (critical > high > medium > low)
+// ---------------------------------------------------------------------------
+/**
+ * Critical: auth / secrets / credentials / encryption artefacts.
+ * Conservative: a security subject immediately elevates to critical.
+ */
+const CRITICAL_SIGNALS = [
+    /\bauth(?:entication|orization)?\b/i,
+    /\bcredential\b/i,
+    /\bsecret\b/i,
+    /\bpassword\b/i,
+    /\btoken\b/i,
+    /\bapi[-\s]?key\b/i,
+    /\bprivate[-\s]?key\b/i,
+    /\bencrypt(?:ion|ed)?\b/i,
+    /\bcertificate\b/i,
+    /\boauth\b/i,
+    /\bvault\b/i,
+    /\bsession\b/i,
+    /\bcookie\b/i,
+    /\bjwt\b/i,
+    /\.env\b/i,
+];
+/**
+ * High: payments, deploys, migrations, CI/CD, permissions, schema changes,
+ * production infrastructure.
+ */
+const HIGH_SIGNALS = [
+    /\blogin\b/i,
+    /\bpayment\b/i,
+    /\bbilling\b/i,
+    /\bdeploy(?:ment)?\b/i,
+    /\bmigration\b/i,
+    /\bci\/cd\b/i,
+    /\bpermission\b/i,
+    /\bschema\b/i,
+    /\bproduction\b/i,
+    /\bprod\b/i,
+    /\brelease\b/i,
+    /\brollback\b/i,
+    /\binfra(?:structure)?\b/i,
+    /\bterraform\b/i,
+    /\bkubernetes\b/i,
+    /\bk8s\b/i,
+    /\bdocker\b/i,
+    /\bdb\s+migration\b/i,
+    /\bdatabase\s+migration\b/i,
+];
+/**
+ * Medium: tests, configs, shared utilities, integrations, build/CI signals.
+ */
+const MEDIUM_SIGNALS = [
+    /\btests?\b/i,
+    /\bspecs?\b/i,
+    /\bconfig(?:uration)?\b/i,
+    /\bintegration\b/i,
+    /\bshared\b/i,
+    /\butil(?:ity|ities)?\b/i,
+    /\blib\b/i,
+    /\blint\b/i,
+    /\bci\b/i,
+    /\bbuild\b/i,
+    /\bdependenc(?:y|ies)\b/i,
+];
 // ---------------------------------------------------------------------------
-// Risk signal tables — highest match wins
+// Scoring helpers
 // ---------------------------------------------------------------------------
-/** Critical: auth / secrets / credentials / encryption artefacts. */
-const CRITICAL_RE = /\b(auth|credential|secret|password|token|key|encrypt|certificate)\b|\.env\b/i;
-/** High: payments, deploys, migrations, CI/CD, permissions, schema changes. */
-const HIGH_RE = /\b(login|payment|billing|deploy|migration|ci\/cd|permission|schema)\b/i;
-/** Medium: tests, configs, shared utilities, integrations. */
-const MEDIUM_RE = /\b(test|spec|config|integration|shared|util|lib)\b/i;
+/**
+ * Count how many patterns in `signals` match `text` (each pattern counts once).
+ * Returns matched signal labels (the matching portion of the first match) for
+ * rationale generation.
+ */
+function scoreSignals(text, signals) {
+    const matched = [];
+    for (const re of signals) {
+        const m = re.exec(text);
+        if (m !== null) {
+            matched.push(m[0].toLowerCase());
+        }
+    }
+    return matched;
+}
 // ---------------------------------------------------------------------------
 // Public API
 // ---------------------------------------------------------------------------
 /**
  * Classify a free-text `task` string into a {@link Classification}.
  *
- * Tier priority: manager > worker > ic (ic is the default).
- * Risk priority: critical > high > medium > low (low is the default).
+ * Tier: multi-signal scoring; tie-break manager > ic > worker; default ic.
+ * Risk: priority cascade critical > high > medium > low; default low.
+ *
+ * Never throws — empty or whitespace input returns a safe default.
  *
  * @param task - The raw task description from the user.
  */
 export function classify(task) {
-    // --- Tier ---
+    // Treat empty / whitespace as ic + low with a clear rationale.
+    if (!task || task.trim().length === 0) {
+        return {
+            tier: 'ic',
+            risk: 'low',
+            rationale: 'tier: ic (empty input — defaulting to ic); risk: low (no risk signals — defaulting to low)',
+        };
+    }
+    // --- Tier scoring ---
+    const managerMatches = scoreSignals(task, MANAGER_SIGNALS);
+    const icMatches = scoreSignals(task, IC_SIGNALS);
+    const workerMatches = scoreSignals(task, WORKER_SIGNALS);
+    const managerScore = managerMatches.length;
+    const icScore = icMatches.length;
+    const workerScore = workerMatches.length;
     let tier;
-    let tierSignal;
-    if (MANAGER_WORDS.test(task)) {
+    let tierSignals;
+    if (managerScore > 0 && managerScore >= icScore && managerScore >= workerScore) {
+        // Manager wins (or ties with any other tier — manager has highest priority)
         tier = 'manager';
-        const m = task.match(MANAGER_WORDS);
-        tierSignal = m ? `manager keyword '${m[0].toLowerCase()}'` : 'manager keyword';
+        tierSignals = managerMatches;
     }
-    else if (WORKER_WORDS.test(task)) {
+    else if (icScore > 0 && icScore >= workerScore) {
+        // IC wins over worker (ic has higher priority on tie)
+        tier = 'ic';
+        tierSignals = icMatches;
+    }
+    else if (workerScore > 0) {
         tier = 'worker';
-        const m = task.match(WORKER_WORDS);
-        tierSignal = m ? `worker keyword '${m[0].toLowerCase()}'` : 'worker keyword';
+        tierSignals = workerMatches;
     }
     else {
+        // Nothing matched — default to ic
         tier = 'ic';
-        tierSignal = 'no tier keyword matched — defaulting to ic';
+        tierSignals = [];
     }
-    // --- Risk ---
+    const tierRationale = tierSignals.length > 0
+        ? `tier: ${tier} (matched: ${tierSignals.join(', ')})`
+        : `tier: ${tier} (no tier keyword matched — defaulting to ic)`;
+    // --- Risk cascade (critical > high > medium > low) ---
     let risk;
-    let riskSignal;
-    if (CRITICAL_RE.test(task)) {
+    let riskSignals;
+    const criticalMatches = scoreSignals(task, CRITICAL_SIGNALS);
+    if (criticalMatches.length > 0) {
         risk = 'critical';
-        const m = task.match(CRITICAL_RE);
-        riskSignal = `critical keyword '${m ? m[0].toLowerCase() : 'unknown'}'`;
-    }
-    else if (HIGH_RE.test(task)) {
-        risk = 'high';
-        const m = task.match(HIGH_RE);
-        riskSignal = `high keyword '${m ? m[0].toLowerCase() : 'unknown'}'`;
-    }
-    else if (MEDIUM_RE.test(task)) {
-        risk = 'medium';
-        const m = task.match(MEDIUM_RE);
-        riskSignal = `medium keyword '${m ? m[0].toLowerCase() : 'unknown'}'`;
+        riskSignals = criticalMatches;
     }
     else {
-        risk = 'low';
-        riskSignal = 'no risk keyword matched — defaulting to low';
+        const highMatches = scoreSignals(task, HIGH_SIGNALS);
+        if (highMatches.length > 0) {
+            risk = 'high';
+            riskSignals = highMatches;
+        }
+        else {
+            const mediumMatches = scoreSignals(task, MEDIUM_SIGNALS);
+            if (mediumMatches.length > 0) {
+                risk = 'medium';
+                riskSignals = mediumMatches;
+            }
+            else {
+                risk = 'low';
+                riskSignals = [];
+            }
+        }
     }
-    const rationale = `tier: ${tierSignal}; risk: ${riskSignal}`;
-    return { tier, risk, rationale };
+    const riskRationale = riskSignals.length > 0
+        ? `risk: ${risk} (matched: ${riskSignals.join(', ')})`
+        : `risk: ${risk} (no risk keyword matched — defaulting to low)`;
+    return {
+        tier,
+        risk,
+        rationale: `${tierRationale}; ${riskRationale}`,
+    };
 }
 //# sourceMappingURL=classify.js.map