natureco-cli 5.63.0 → 5.64.0

package/src/utils/coding-session.js

@@ -0,0 +1,54 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const TB = require('./token-budget');
+const { writeFileAtomicSync } = require('./atomic-file');
+
+class CodingSession {
+  constructor(options = {}) {
+    this.maxSnapshots = options.maxSnapshots || 20;
+    this.snapshots = [];
+    this.lastUserMessage = null;
+  }
+
+  rememberUserMessage(message) { if (message && !message.startsWith('/')) this.lastUserMessage = message; }
+  retryMessage() { return this.lastUserMessage; }
+
+  capture(filePath) {
+    if (!filePath) return null;
+    const target = path.resolve(filePath);
+    const existed = fs.existsSync(target);
+    const content = existed ? fs.readFileSync(target) : null;
+    const snapshot = { path: target, existed, content, capturedAt: Date.now() };
+    this.snapshots.push(snapshot);
+    if (this.snapshots.length > this.maxSnapshots) this.snapshots.shift();
+    return snapshot;
+  }
+
+  undo() {
+    const snapshot = this.snapshots.pop();
+    if (!snapshot) return { ok: false, error: 'Geri alınacak değişiklik yok.' };
+    if (snapshot.existed) writeFileAtomicSync(snapshot.path, snapshot.content);
+    else if (fs.existsSync(snapshot.path)) fs.unlinkSync(snapshot.path);
+    return { ok: true, path: snapshot.path, restored: snapshot.existed };
+  }
+
+  compact(messages) {
+    const before = messages.length;
+    const compacted = TB.smartTrim(messages);
+    return { messages: compacted, before, after: compacted.length, removed: before - compacted.length };
+  }
+
+  riskSummary(toolCall) {
+    const name = toolCall?.name || '';
+    const args = toolCall?.input || {};
+    const risks = [];
+    if (name === 'write_file' || name === 'edit_file') risks.push('filesystem-write');
+    if (name === 'bash' || name === 'shell_command') risks.push('command-execution');
+    if (/\b(rm|delete|drop|truncate|chmod|chown)\b/i.test(args.command || '')) risks.push('destructive');
+    return { level: risks.includes('destructive') ? 'high' : risks.length ? 'medium' : 'low', risks };
+  }
+}
+
+module.exports = { CodingSession };

package/src/utils/delivery-store.js

@@ -0,0 +1,34 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { writeJsonAtomicSync, readJsonSafeSync } = require('./atomic-file');
+
+class DeliveryStore {
+  constructor(options = {}) {
+    this.file = options.file || path.join(os.homedir(), '.natureco', 'delivery-queue.json');
+    this.maxItems = options.maxItems || 10000;
+  }
+
+  load() {
+    const data = readJsonSafeSync(this.file, { version: 1, queue: [], deadLetters: [] });
+    return {
+      version: 1,
+      queue: Array.isArray(data.queue) ? data.queue.slice(0, this.maxItems) : [],
+      deadLetters: Array.isArray(data.deadLetters) ? data.deadLetters.slice(-this.maxItems) : [],
+    };
+  }
+
+  save(state) {
+    fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 });
+    writeJsonAtomicSync(this.file, {
+      version: 1,
+      savedAt: new Date().toISOString(),
+      queue: (state.queue || []).slice(0, this.maxItems),
+      deadLetters: (state.deadLetters || []).slice(-this.maxItems),
+    }, { mode: 0o600 });
+  }
+}
+
+module.exports = { DeliveryStore };

package/src/utils/i18n.js

@@ -92,4 +92,10 @@ function t(key, vars) {
   return s;
 }
 
-module.exports = { t, getLang, setLangCache, MESSAGES };
+function validateCatalogParity(catalog = MESSAGES) {
+  const tr = Object.keys(catalog.tr || {}).sort();
+  const en = Object.keys(catalog.en || {}).sort();
+  return { ok: tr.length === en.length && tr.every((key, index) => key === en[index]), trOnly: tr.filter(key => !en.includes(key)), enOnly: en.filter(key => !tr.includes(key)), keys: tr.length };
+}
+
+module.exports = { t, getLang, setLangCache, MESSAGES, validateCatalogParity };

package/src/utils/json-schema.js

@@ -0,0 +1,43 @@
+'use strict';
+
+function valueType(value) {
+  if (Array.isArray(value)) return 'array';
+  if (value === null) return 'null';
+  if (Number.isInteger(value)) return 'integer';
+  return typeof value;
+}
+
+function validateJsonSchema(schema, value, at = '$') {
+  const errors = [];
+  if (!schema || typeof schema !== 'object') return { valid: true, errors };
+  const allowedTypes = Array.isArray(schema.type) ? schema.type : schema.type ? [schema.type] : [];
+  const actual = valueType(value);
+  if (allowedTypes.length && !allowedTypes.includes(actual) && !(actual === 'integer' && allowedTypes.includes('number'))) {
+    return { valid: false, errors: [`${at}: expected ${allowedTypes.join('|')}, got ${actual}`] };
+  }
+  if (schema.enum && !schema.enum.some(item => Object.is(item, value))) {
+    errors.push(`${at}: value is not in enum`);
+  }
+  if (actual === 'object' && value !== null) {
+    for (const key of schema.required || []) {
+      if (!Object.prototype.hasOwnProperty.call(value, key)) errors.push(`${at}.${key}: required`);
+    }
+    for (const [key, child] of Object.entries(schema.properties || {})) {
+      if (Object.prototype.hasOwnProperty.call(value, key)) {
+        errors.push(...validateJsonSchema(child, value[key], `${at}.${key}`).errors);
+      }
+    }
+    if (schema.additionalProperties === false) {
+      const known = new Set(Object.keys(schema.properties || {}));
+      for (const key of Object.keys(value)) if (!known.has(key)) errors.push(`${at}.${key}: additional property`);
+    }
+  }
+  if (actual === 'array') {
+    if (schema.minItems != null && value.length < schema.minItems) errors.push(`${at}: minItems ${schema.minItems}`);
+    if (schema.maxItems != null && value.length > schema.maxItems) errors.push(`${at}: maxItems ${schema.maxItems}`);
+    if (schema.items) value.forEach((item, index) => errors.push(...validateJsonSchema(schema.items, item, `${at}[${index}]`).errors));
+  }
+  return { valid: errors.length === 0, errors };
+}
+
+module.exports = { validateJsonSchema };

package/src/utils/lsp-client.js

@@ -0,0 +1,129 @@
+'use strict';
+
+const { spawn } = require('child_process');
+const { EventEmitter } = require('events');
+const path = require('path');
+const { pathToFileURL } = require('url');
+
+class LspClient extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    this.command = options.command;
+    this.args = options.args || [];
+    this.cwd = options.cwd || process.cwd();
+    this.timeoutMs = options.timeoutMs || 10000;
+    this.spawnFn = options.spawnFn || spawn;
+    this.process = null;
+    this.buffer = Buffer.alloc(0);
+    this.nextId = 1;
+    this.pending = new Map();
+  }
+
+  start() {
+    if (this.process) return this;
+    if (!this.command) throw new Error('LSP command is required');
+    this.process = this.spawnFn(this.command, this.args, {
+      cwd: this.cwd, stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true, shell: false,
+    });
+    this.process.stdout.on('data', chunk => this._onData(chunk));
+    this.process.stderr?.on('data', chunk => this.emit('stderr', chunk.toString()));
+    this.process.on('error', error => this._failAll(error));
+    this.process.on('exit', code => { this._failAll(new Error(`LSP exited (${code})`)); this.process = null; });
+    return this;
+  }
+
+  async initialize(capabilities = {}) {
+    this.start();
+    const rootUri = pathToFileURL(path.resolve(this.cwd)).href;
+    const result = await this.request('initialize', {
+      processId: process.pid, rootUri, capabilities,
+      workspaceFolders: [{ uri: rootUri, name: path.basename(this.cwd) }],
+    });
+    this.notify('initialized', {});
+    return result;
+  }
+
+  request(method, params, timeoutMs = this.timeoutMs) {
+    this.start();
+    const id = this.nextId++;
+    this._send({ jsonrpc: '2.0', id, method, params });
+    return new Promise((resolve, reject) => {
+      const timer = setTimeout(() => {
+        this.pending.delete(id);
+        reject(new Error(`LSP request timed out: ${method}`));
+      }, timeoutMs);
+      this.pending.set(id, { resolve, reject, timer, method });
+    });
+  }
+
+  notify(method, params) { this.start(); this._send({ jsonrpc: '2.0', method, params }); }
+
+  definition(filePath, line, character) {
+    return this.request('textDocument/definition', {
+      textDocument: { uri: pathToFileURL(path.resolve(filePath)).href },
+      position: { line, character },
+    });
+  }
+
+  references(filePath, line, character, includeDeclaration = true) {
+    return this.request('textDocument/references', {
+      textDocument: { uri: pathToFileURL(path.resolve(filePath)).href },
+      position: { line, character }, context: { includeDeclaration },
+    });
+  }
+
+  async stop() {
+    if (!this.process) return;
+    try { await this.request('shutdown', null, 2000); } catch {}
+    try { this.notify('exit', null); } catch {}
+    this.process.kill();
+    this.process = null;
+  }
+
+  _send(message) {
+    const body = Buffer.from(JSON.stringify(message), 'utf8');
+    this.process.stdin.write(Buffer.concat([Buffer.from(`Content-Length: ${body.length}\r\n\r\n`), body]));
+  }
+
+  _onData(chunk) {
+    this.buffer = Buffer.concat([this.buffer, Buffer.from(chunk)]);
+    while (true) {
+      const headerEnd = this.buffer.indexOf('\r\n\r\n');
+      if (headerEnd === -1) return;
+      const header = this.buffer.slice(0, headerEnd).toString('ascii');
+      const match = header.match(/Content-Length:\s*(\d+)/i);
+      if (!match) { this.buffer = this.buffer.slice(headerEnd + 4); continue; }
+      const length = Number(match[1]);
+      const bodyStart = headerEnd + 4;
+      if (this.buffer.length < bodyStart + length) return;
+      const body = this.buffer.slice(bodyStart, bodyStart + length).toString('utf8');
+      this.buffer = this.buffer.slice(bodyStart + length);
+      try { this._handle(JSON.parse(body)); } catch (error) { this.emit('protocolError', error); }
+    }
+  }
+
+  _handle(message) {
+    if (message.id != null && this.pending.has(message.id)) {
+      const pending = this.pending.get(message.id);
+      clearTimeout(pending.timer);
+      this.pending.delete(message.id);
+      if (message.error) pending.reject(new Error(message.error.message || 'LSP error'));
+      else pending.resolve(message.result);
+    } else this.emit('notification', message);
+  }
+
+  _failAll(error) {
+    for (const pending of this.pending.values()) { clearTimeout(pending.timer); pending.reject(error); }
+    this.pending.clear();
+  }
+}
+
+const DEFAULT_SERVERS = {
+  javascript: { command: 'typescript-language-server', args: ['--stdio'] },
+  typescript: { command: 'typescript-language-server', args: ['--stdio'] },
+  python: { command: 'pyright-langserver', args: ['--stdio'] },
+  rust: { command: 'rust-analyzer', args: [] },
+  go: { command: 'gopls', args: [] },
+};
+
+module.exports = { LspClient, DEFAULT_SERVERS };

package/src/utils/memory-record.js

@@ -0,0 +1,49 @@
+'use strict';
+
+const crypto = require('crypto');
+
+function clamp(value, min, max) { return Math.min(max, Math.max(min, value)); }
+function factKey(value, category = 'general') {
+  const text = String(value || '').trim().toLowerCase();
+  const subject = text.includes(':') ? text.split(':', 1)[0] : text.split(/\s+(?:is|=|likes?|prefers?|seviyor|yaşıyor)\s+/i, 1)[0];
+  return `${category}:${subject.trim()}`;
+}
+
+function createMemoryRecord(input = {}, now = new Date()) {
+  const createdAt = now.toISOString();
+  const ttlMs = input.ttlMs == null ? null : Math.max(0, Number(input.ttlMs));
+  return {
+    id: input.id || `mem_${crypto.randomBytes(8).toString('hex')}`,
+    value: String(input.value || '').trim(), category: input.category || 'general',
+    score: clamp(Number(input.score ?? 5), 0, 10),
+    source: input.source || 'unknown', confidence: clamp(Number(input.confidence ?? 0.5), 0, 1),
+    createdAt: input.createdAt || createdAt, updatedAt: createdAt,
+    lastVerifiedAt: input.lastVerifiedAt || (input.verified ? createdAt : null),
+    expiresAt: ttlMs == null ? null : new Date(now.getTime() + ttlMs).toISOString(),
+    status: input.status || 'active', userConfirmed: input.userConfirmed === true,
+  };
+}
+
+function isActive(record, now = new Date()) {
+  if (!record || record.status === 'rejected' || record.status === 'superseded') return false;
+  return !record.expiresAt || new Date(record.expiresAt).getTime() > now.getTime();
+}
+
+function resolveConflict(existing, incoming) {
+  if (!existing) return { winner: incoming, loser: null, reason: 'new' };
+  if (existing.value === incoming.value) {
+    const merged = { ...existing, ...incoming, id: existing.id, createdAt: existing.createdAt, confidence: Math.max(existing.confidence || 0, incoming.confidence || 0) };
+    return { winner: merged, loser: null, reason: 'same-value' };
+  }
+  const existingWeight = (existing.userConfirmed ? 2 : 0) + (existing.confidence || 0);
+  const incomingWeight = (incoming.userConfirmed ? 2 : 0) + (incoming.confidence || 0);
+  if (incomingWeight > existingWeight) return { winner: incoming, loser: { ...existing, status: 'superseded' }, reason: 'higher-confidence' };
+  return { winner: existing, loser: { ...incoming, status: 'rejected' }, reason: 'existing-preferred' };
+}
+
+function promoteCandidate(record, approval) {
+  if (!approval?.approved) return { ok: false, error: 'user approval required' };
+  return { ok: true, record: { ...record, status: 'active', userConfirmed: true, lastVerifiedAt: new Date().toISOString(), confidence: Math.max(record.confidence || 0, 0.9) } };
+}
+
+module.exports = { createMemoryRecord, isActive, resolveConflict, promoteCandidate, factKey };

package/src/utils/pairing-store.js

@@ -0,0 +1,55 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const { writeJsonAtomicSync, readJsonSafeSync } = require('./atomic-file');
+
+const PAIRINGS_FILE = path.join(os.homedir(), '.natureco', 'pairings.json');
+
+function loadPairings() {
+  const value = readJsonSafeSync(PAIRINGS_FILE, []);
+  return Array.isArray(value) ? value : [];
+}
+
+function savePairings(pairings) {
+  fs.mkdirSync(path.dirname(PAIRINGS_FILE), { recursive: true, mode: 0o700 });
+  writeJsonAtomicSync(PAIRINGS_FILE, pairings, { mode: 0o600 });
+}
+
+function genCode() {
+  return Date.now().toString(36) + Math.random().toString(36).slice(2, 8).toUpperCase();
+}
+
+function findPairing(pairings, channel, senderId, status) {
+  const sender = String(senderId);
+  return pairings.find(item => item.channel === channel && String(item.senderId) === sender && item.status === status);
+}
+
+function createPairingEntry(channel, senderId) {
+  const sender = String(senderId);
+  return {
+    id: `pair_${Date.now().toString(36)}_${Math.random().toString(36).slice(2, 6)}`,
+    code: genCode(), channel, senderId: sender, nodeName: `${channel}:${sender}`,
+    status: 'pending', createdAt: new Date().toISOString(),
+  };
+}
+
+function ensurePendingPairing(channel, senderId) {
+  const pairings = loadPairings();
+  const existing = findPairing(pairings, channel, senderId, 'pending');
+  if (existing) return existing;
+  const entry = createPairingEntry(channel, senderId);
+  pairings.push(entry);
+  savePairings(pairings);
+  return entry;
+}
+
+function isPaired(channel, senderId) {
+  return !!findPairing(loadPairings(), channel, senderId, 'approved');
+}
+
+module.exports = {
+  PAIRINGS_FILE, loadPairings, savePairings, genCode, ensurePendingPairing, isPaired,
+  _internals: { findPairing, createPairingEntry },
+};

package/src/utils/pattern-detector.js

@@ -265,10 +265,20 @@ function acceptProposal(proposalId) {
   if (fs.existsSync(skillDir)) {
     return { success: false, reason: `Skill zaten var: ${proposal.suggestedName}` };
   }
-  fs.mkdirSync(skillDir, { recursive: true });
-
   const skillMd = generateSkillMd(proposal);
-  fs.writeFileSync(path.join(skillDir, 'SKILL.md'), skillMd, 'utf8');
+  const { SkillLifecycle } = require('./skill-lifecycle');
+  const lifecycle = new SkillLifecycle(userSkillsDir);
+  const staged = lifecycle.stage({ name: proposal.suggestedName, content: skillMd, source: 'repeated-pattern', evidence: { hash: proposal.hash, count: proposal.count } });
+  if (!staged.ok) return { success: false, reason: staged.error };
+  // This function is only reached through the explicit `skills accept` command.
+  // Promotion stays synchronous here because validation is deterministic.
+  const candidate = staged.candidate;
+  fs.mkdirSync(skillDir, { recursive: true });
+  fs.writeFileSync(path.join(skillDir, 'SKILL.md'), candidate.content, 'utf8');
+  fs.writeFileSync(path.join(skillDir, 'lifecycle.json'), JSON.stringify({
+    currentVersion: 1,
+    versions: [{ version: 1, candidateId: candidate.id, source: candidate.source, evidence: candidate.evidence, approvedBy: 'cli-user', approvedAt: new Date().toISOString(), validation: { ok: true, type: 'frontmatter' } }],
+  }, null, 2), 'utf8');
 
   proposals[idx].status = 'accepted';
   proposals[idx].acceptedAt = new Date().toISOString();

package/src/utils/plugin-registry.js

@@ -1,7 +1,7 @@
 const fs = require('fs');
 const path = require('path');
 const os = require('os');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 const { PluginError, handleError } = require('./errors');
 
 const PLUGINS_DIR = path.join(os.homedir(), '.natureco', 'plugins');
@@ -122,7 +122,7 @@ function installFromNpm(pkg) {
   const tmpDir = path.join(os.tmpdir(), `nc-plugin-${Date.now()}`);
   ensureDir(tmpDir);
   try {
-    execSync(`npm install ${pkg} --prefix "${tmpDir}" --no-save --ignore-scripts --no-audit --no-fund`, { stdio: 'pipe', timeout: 120000 });
+    execFileSync('npm', ['install', pkg, '--prefix', tmpDir, '--no-save', '--ignore-scripts', '--no-audit', '--no-fund'], { stdio: 'pipe', timeout: 120000, shell: false });
     const pkgDir = path.join(tmpDir, 'node_modules', pkg.split('/').pop());
     const scopedPkgDir = pkg.startsWith('@') ? path.join(tmpDir, 'node_modules', pkg) : null;
     const srcDir = scopedPkgDir && fs.existsSync(scopedPkgDir) ? scopedPkgDir : (fs.existsSync(pkgDir) ? pkgDir : null);
@@ -155,7 +155,7 @@ function installFromGit(spec) {
   const tmpDir = path.join(os.tmpdir(), `nc-plugin-git-${Date.now()}`);
   ensureDir(tmpDir);
   try {
-    execSync(`git clone --depth 1 "${repoUrl}" "${tmpDir}"`, { stdio: 'pipe', timeout: 60000 });
+    execFileSync('git', ['clone', '--depth', '1', repoUrl, tmpDir], { stdio: 'pipe', timeout: 60000, shell: false });
     const slug = spec.split('/').pop().replace(/\.git$/, '');
     const dest = path.join(PLUGINS_DIR, slug);
     if (fs.existsSync(dest)) fs.rmSync(dest, { recursive: true, force: true });

package/src/utils/process-errors.js

@@ -21,7 +21,17 @@ const os = require('os');
 const ERROR_LOG_PATH = path.join(os.homedir(), '.natureco', 'logs', 'crash.log');
 
 let _installed = false;
-let _registered = { rejection: null, exception: null, warning: null };
+let _registered = { rejection: null, exception: null, streamError: null };
+
+function _removeRegisteredHandlers() {
+  if (_registered.rejection) process.off('unhandledRejection', _registered.rejection);
+  if (_registered.exception) process.off('uncaughtException', _registered.exception);
+  if (_registered.streamError) {
+    process.stdout.off('error', _registered.streamError);
+    process.stderr.off('error', _registered.streamError);
+  }
+  _registered = { rejection: null, exception: null, streamError: null };
+}
 
 function _defaultAudit() {
   try {
@@ -63,8 +73,7 @@ function install(opts = {}) {
   const stderr = opts.stderr || ((msg) => process.stderr.write(msg));
 
   // Replace any previous handlers (idempotency for tests).
-  if (_registered.rejection) process.off('unhandledRejection', _registered.rejection);
-  if (_registered.exception) process.off('uncaughtException', _registered.exception);
+  _removeRegisteredHandlers();
 
   const onRejection = (reason) => {
     const payload = { kind: 'unhandledRejection', error: _serializeError(reason) };
@@ -106,13 +115,11 @@ function install(opts = {}) {
 
   process.on('unhandledRejection', onRejection);
   process.on('uncaughtException', onException);
-  _registered = { rejection: onRejection, exception: onException, warning: null };
+  _registered = { rejection: onRejection, exception: onException, streamError: onStreamError };
   _installed = true;
 
   return function uninstall() {
-    if (_registered.rejection) process.off('unhandledRejection', _registered.rejection);
-    if (_registered.exception) process.off('uncaughtException', _registered.exception);
-    _registered = { rejection: null, exception: null, warning: null };
+    _removeRegisteredHandlers();
     _installed = false;
   };
 }

package/src/utils/runtime-health.js

@@ -0,0 +1,28 @@
+'use strict';
+
+const fs = require('fs');
+const { execFileSync } = require('child_process');
+
+function checkPidFile(pidFile, processKill = process.kill) {
+  if (!fs.existsSync(pidFile)) return { ok: false, status: 'stopped', reason: 'pid-file-missing' };
+  const pid = Number(fs.readFileSync(pidFile, 'utf8').trim());
+  if (!Number.isInteger(pid) || pid <= 0) return { ok: false, status: 'invalid', reason: 'invalid-pid' };
+  try { processKill(pid, 0); return { ok: true, status: 'running', pid }; }
+  catch { return { ok: false, status: 'stale', reason: 'process-not-running', pid }; }
+}
+
+function checkDockerContainer(name = 'natureco-sandbox', execFile = execFileSync) {
+  try {
+    const output = execFile('docker', ['inspect', '--format', '{{json .State}}', name], { encoding: 'utf8', stdio: 'pipe', timeout: 5000 });
+    const state = JSON.parse(output.trim());
+    return { ok: state.Running === true && state.Health?.Status !== 'unhealthy', status: state.Health?.Status || (state.Running ? 'running' : 'stopped'), running: !!state.Running, restartCount: state.RestartCount || 0 };
+  } catch (error) { return { ok: false, status: 'unavailable', reason: error.code === 'ENOENT' ? 'docker-not-installed' : 'container-not-found' }; }
+}
+
+function aggregateRuntimeHealth(parts) {
+  const entries = Object.entries(parts || {});
+  const failed = entries.filter(([, value]) => !value?.ok).map(([name]) => name);
+  return { ok: failed.length === 0, status: failed.length === 0 ? 'healthy' : failed.length === entries.length ? 'down' : 'degraded', failed, checks: parts };
+}
+
+module.exports = { checkPidFile, checkDockerContainer, aggregateRuntimeHealth };

package/src/utils/secret-store.js

@@ -0,0 +1,90 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const os = require('os');
+const crypto = require('crypto');
+const { execFileSync } = require('child_process');
+const { writeJsonAtomicSync, readJsonSafeSync } = require('./atomic-file');
+
+class MacKeychainBackend {
+  constructor(service = 'natureco-cli', execFile = execFileSync) { this.service = service; this.execFile = execFile; }
+  set(key, value) { this.execFile('security', ['add-generic-password', '-U', '-a', key, '-s', this.service, '-w', value], { stdio: 'pipe' }); }
+  get(key) { try { return this.execFile('security', ['find-generic-password', '-a', key, '-s', this.service, '-w'], { encoding: 'utf8', stdio: 'pipe' }).trim(); } catch { return null; } }
+  delete(key) { try { this.execFile('security', ['delete-generic-password', '-a', key, '-s', this.service], { stdio: 'pipe' }); return true; } catch { return false; } }
+}
+
+class LinuxSecretServiceBackend {
+  constructor(service = 'natureco-cli', execFile = execFileSync) { this.service = service; this.execFile = execFile; }
+  set(key, value) { this.execFile('secret-tool', ['store', '--label', `NatureCo ${key}`, 'service', this.service, 'account', key], { input: value, stdio: ['pipe', 'pipe', 'pipe'] }); }
+  get(key) { try { return this.execFile('secret-tool', ['lookup', 'service', this.service, 'account', key], { encoding: 'utf8', stdio: 'pipe' }).trim() || null; } catch { return null; } }
+  delete(key) { try { this.execFile('secret-tool', ['clear', 'service', this.service, 'account', key], { stdio: 'pipe' }); return true; } catch { return false; } }
+}
+
+class WindowsDpapiBackend {
+  constructor(options = {}) { this.file = options.file || path.join(os.homedir(), '.natureco', 'secrets.dpapi.json'); this.execFile = options.execFile || execFileSync; }
+  _run(script, input) {
+    const encoded = Buffer.from(script, 'utf16le').toString('base64');
+    return this.execFile('powershell.exe', ['-NoProfile', '-NonInteractive', '-EncodedCommand', encoded], { input, encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'], windowsHide: true }).trim();
+  }
+  _load() { return readJsonSafeSync(this.file, { version: 1, entries: {} }); }
+  _save(data) { fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 }); writeJsonAtomicSync(this.file, data, { mode: 0o600 }); }
+  set(name, value) {
+    const script = '$v=[Console]::In.ReadToEnd();$b=[Text.Encoding]::UTF8.GetBytes($v);$p=[Security.Cryptography.ProtectedData]::Protect($b,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Convert]::ToBase64String($p)';
+    const data = this._load(); data.entries[name] = { data: this._run(script, String(value)), updatedAt: new Date().toISOString() }; this._save(data);
+  }
+  get(name) {
+    const entry = this._load().entries[name]; if (!entry) return null;
+    try {
+      const script = '$v=[Console]::In.ReadToEnd();$p=[Convert]::FromBase64String($v);$b=[Security.Cryptography.ProtectedData]::Unprotect($p,$null,[Security.Cryptography.DataProtectionScope]::CurrentUser);[Text.Encoding]::UTF8.GetString($b)';
+      return this._run(script, entry.data);
+    } catch { return null; }
+  }
+  delete(name) { const data = this._load(); if (!data.entries[name]) return false; delete data.entries[name]; this._save(data); return true; }
+}
+
+class EncryptedFileBackend {
+  constructor(options = {}) {
+    if (!options.masterKey) throw new Error('NATURECO_MASTER_KEY is required for encrypted file secret storage');
+    this.file = options.file || path.join(os.homedir(), '.natureco', 'secrets.enc.json');
+    this.key = crypto.scryptSync(String(options.masterKey), 'natureco-secret-store-v1', 32);
+  }
+  _load() { return readJsonSafeSync(this.file, { version: 1, entries: {} }); }
+  _save(data) { fs.mkdirSync(path.dirname(this.file), { recursive: true, mode: 0o700 }); writeJsonAtomicSync(this.file, data, { mode: 0o600 }); }
+  set(name, value) {
+    const iv = crypto.randomBytes(12); const cipher = crypto.createCipheriv('aes-256-gcm', this.key, iv);
+    const encrypted = Buffer.concat([cipher.update(String(value), 'utf8'), cipher.final()]);
+    const data = this._load();
+    data.entries[name] = { iv: iv.toString('base64'), tag: cipher.getAuthTag().toString('base64'), data: encrypted.toString('base64'), updatedAt: new Date().toISOString() };
+    this._save(data);
+  }
+  get(name) {
+    const entry = this._load().entries[name]; if (!entry) return null;
+    try {
+      const decipher = crypto.createDecipheriv('aes-256-gcm', this.key, Buffer.from(entry.iv, 'base64'));
+      decipher.setAuthTag(Buffer.from(entry.tag, 'base64'));
+      return Buffer.concat([decipher.update(Buffer.from(entry.data, 'base64')), decipher.final()]).toString('utf8');
+    } catch { return null; }
+  }
+  delete(name) { const data = this._load(); if (!data.entries[name]) return false; delete data.entries[name]; this._save(data); return true; }
+}
+
+class SecretStore {
+  constructor(backend) { if (!backend) throw new Error('secret store backend is required'); this.backend = backend; }
+  _name(name) { if (!/^[A-Za-z0-9_.-]{1,128}$/.test(name || '')) throw new Error('invalid secret name'); return name; }
+  set(name, value) { if (value == null || value === '') throw new Error('secret value cannot be empty'); this.backend.set(this._name(name), String(value)); return { ok: true, name }; }
+  get(name) { const value = this.backend.get(this._name(name)); return value == null ? { ok: false, error: 'secret not found' } : { ok: true, value }; }
+  delete(name) { return { ok: this.backend.delete(this._name(name)) }; }
+}
+
+function createSecretStore(options = {}) {
+  if (options.backend) return new SecretStore(options.backend);
+  if (process.platform === 'darwin') return new SecretStore(new MacKeychainBackend(options.service, options.execFile));
+  if (process.platform === 'win32') return new SecretStore(new WindowsDpapiBackend({ file: options.file, execFile: options.execFile }));
+  if (process.platform === 'linux' && options.useSecretService !== false) return new SecretStore(new LinuxSecretServiceBackend(options.service, options.execFile));
+  const masterKey = options.masterKey || process.env.NATURECO_MASTER_KEY;
+  if (!masterKey) throw new Error('No OS keychain backend available. Set NATURECO_MASTER_KEY for encrypted fallback.');
+  return new SecretStore(new EncryptedFileBackend({ masterKey, file: options.file }));
+}
+
+module.exports = { SecretStore, MacKeychainBackend, LinuxSecretServiceBackend, WindowsDpapiBackend, EncryptedFileBackend, createSecretStore };