oh-my-design-cli 1.8.6 → 1.9.0

package/dist/bin/oh-my-design.js

@@ -23,18 +23,21 @@ function readPackageVersion() {
   return "0.0.0";
 }
 var program = new Command();
-program.name("oh-my-design").description("Bootstrap oh-my-design skills + agents into your project. After install, talk to your agent in natural language \u2014 no other CLI commands.").version(readPackageVersion()).showSuggestionAfterError(true).showHelpAfterError(true);
-program.command("install-skills").description("Install omd skill files + canonical agents into agent directories (.claude/, .codex/, .opencode/). Interactive multiselect TUI by default \u2014 picks which skills + sub-agents to install.").option("--dir <path>", "Project root (defaults to cwd)").option("--agent <name...>", "Restrict to specific channels (claude-code | codex | opencode | cursor)").option("--force", "Overwrite existing files even without the omd marker").option("--all", "Skip the interactive TUI and install every shipped skill + agent (use in CI)").option("--skills <names>", "Comma-separated skill names to install (overrides TUI)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--agents-only <names>", "Comma-separated agent names to install (overrides TUI). Use --agents-only to disambiguate from --agent (channel selector).", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--skills-only", "Install only the named skill files \u2014 skip sub-agents, hooks, and settings.json (minimal single-skill install, e.g. --skills claude-design --skills-only)").option("--global", "Install to the user-level dir (~/.claude/skills, available in every project) instead of this project. Writes skills + sub-agents; never touches global hooks/settings.").action(
+program.name("oh-my-design").description("Install and diagnose the oh-my-design skill bundle. After setup, design work happens through natural-language prompts in your coding agent.").version(readPackageVersion()).showSuggestionAfterError(true).showHelpAfterError(true);
+program.action(async () => {
+  const { runInstallSkills } = await import("../install-skills-ZZFNJ2II.js");
+  const code = await runInstallSkills();
+  if (code !== 0) process.exit(code);
+});
+program.command("install-skills").description("Install OmD skills, specialist roles, and the reference catalog into the selected coding-agent channels.").option("--dir <path>", "Project root (defaults to cwd)").option("--agent <name...>", "Restrict to specific channels (claude-code | codex | opencode | cursor)").option("--force", "Overwrite existing files even without the omd marker").option("--repair-hooks", "Refresh the managed Claude hook bundle without overwriting other unmarked files").option("--all", "Skip the interactive TUI and install every shipped skill + agent (use in CI)").option("--skills <names>", "Comma-separated skill names to install (overrides TUI)", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--agents-only <names>", "Comma-separated agent names to install (overrides TUI). Use --agents-only to disambiguate from --agent (channel selector).", (v) => v.split(",").map((s) => s.trim()).filter(Boolean)).option("--skills-only", "Install only the named skill files \u2014 skip sub-agents, hooks, and settings.json (minimal single-skill install, e.g. --skills claude-design --skills-only)").option("--global", "Install to each channel's user-level discovery directory instead of this project. Writes skills + sub-agents + catalog; never touches global hooks/settings.").action(
   async (opts) => {
-    const { runInstallSkills } = await import("../install-skills-7UUDOLG2.js");
-    const validAgents = ["claude-code", "codex", "opencode", "cursor"];
-    const agents = opts.agent ? opts.agent.filter(
-      (a) => validAgents.includes(a)
-    ) : void 0;
+    const { runInstallSkills } = await import("../install-skills-ZZFNJ2II.js");
+    const agents = opts.agent;
     const code = await runInstallSkills({
       dir: opts.dir,
       agents,
       force: opts.force,
+      repairHooks: opts.repairHooks,
       all: opts.all,
       skillsFilter: opts.skills,
       agentsFilter: opts.agentsOnly,
@@ -44,5 +47,10 @@ program.command("install-skills").description("Install omd skill files + canonic
     if (code !== 0) process.exit(code);
   }
 );
-program.parse();
+program.command("doctor").description("Check whether skills, sub-agents, references, and DESIGN.md are ready; print the exact next action.").option("--dir <path>", "Project root (defaults to cwd)").option("--global", "Check the user-level installation instead of this project").option("--json", "Print a machine-readable report").action(async (opts) => {
+  const { runDoctor } = await import("../doctor-LDWSFM3I.js");
+  const code = await runDoctor(opts);
+  if (code !== 0) process.exit(code);
+});
+await program.parseAsync();
 //# sourceMappingURL=oh-my-design.js.map

package/dist/bin/oh-my-design.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../../bin/oh-my-design.ts"],"sourcesContent":["import { Command } from 'commander';\nimport { readFileSync, existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nfunction readPackageVersion(): string {\n  let cur = dirname(fileURLToPath(import.meta.url));\n  for (let i = 0; i < 8; i++) {\n    const pkg = join(cur, 'package.json');\n    if (existsSync(pkg)) {\n      try {\n        return JSON.parse(readFileSync(pkg, 'utf8')).version ?? '0.0.0';\n      } catch {\n        return '0.0.0';\n      }\n    }\n    const parent = dirname(cur);\n    if (parent === cur) break;\n    cur = parent;\n  }\n  return '0.0.0';\n}\n\nconst program = new Command();\n\nprogram\n  .name('oh-my-design')\n  .description('Bootstrap oh-my-design skills + agents into your project. After install, talk to your agent in natural language — no other CLI commands.')\n  .version(readPackageVersion())\n  .showSuggestionAfterError(true)\n  .showHelpAfterError(true);\n\nprogram\n  .command('install-skills')\n  .description('Install omd skill files + canonical agents into agent directories (.claude/, .codex/, .opencode/). Interactive multiselect TUI by default — picks which skills + sub-agents to install.')\n  .option('--dir <path>', 'Project root (defaults to cwd)')\n  .option('--agent <name...>', 'Restrict to specific channels (claude-code | codex | opencode | cursor)')\n  .option('--force', 'Overwrite existing files even without the omd marker')\n  .option('--all', 'Skip the interactive TUI and install every shipped skill + agent (use in CI)')\n  .option('--skills <names>', 'Comma-separated skill names to install (overrides TUI)', (v) => v.split(',').map((s) => s.trim()).filter(Boolean))\n  .option('--agents-only <names>', 'Comma-separated agent names to install (overrides TUI). Use --agents-only to disambiguate from --agent (channel selector).', (v) => v.split(',').map((s) => s.trim()).filter(Boolean))\n  .option('--skills-only', 'Install only the named skill files — skip sub-agents, hooks, and settings.json (minimal single-skill install, e.g. --skills claude-design --skills-only)')\n  .option('--global', 'Install to the user-level dir (~/.claude/skills, available in every project) instead of this project. Writes skills + sub-agents; never touches global hooks/settings.')\n  .action(\n    async (opts: {\n      dir?: string;\n      agent?: string[];\n      force?: boolean;\n      all?: boolean;\n      skills?: string[];\n      agentsOnly?: string[];\n      skillsOnly?: boolean;\n      global?: boolean;\n    }) => {\n      const { runInstallSkills } = await import('../src/cli/install-skills.js');\n      const validAgents = ['claude-code', 'codex', 'opencode', 'cursor'] as const;\n      type Agent = (typeof validAgents)[number];\n      const agents = opts.agent\n        ? (opts.agent.filter((a): a is Agent =>\n            (validAgents as readonly string[]).includes(a)\n          ) as Agent[])\n        : undefined;\n      const code = await runInstallSkills({\n        dir: opts.dir,\n        agents,\n        force: opts.force,\n        all: opts.all,\n        skillsFilter: opts.skills,\n        agentsFilter: opts.agentsOnly,\n        skillsOnly: opts.skillsOnly,\n        global: opts.global,\n      });\n      if (code !== 0) process.exit(code);\n    }\n  );\n\nprogram.parse();\n"],"mappings":";;;AAAA,SAAS,eAAe;AACxB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAE9B,SAAS,qBAA6B;AACpC,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,KAAK,cAAc;AACpC,QAAI,WAAW,GAAG,GAAG;AACnB,UAAI;AACF,eAAO,KAAK,MAAM,aAAa,KAAK,MAAM,CAAC,EAAE,WAAW;AAAA,MAC1D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,cAAc,EACnB,YAAY,+IAA0I,EACtJ,QAAQ,mBAAmB,CAAC,EAC5B,yBAAyB,IAAI,EAC7B,mBAAmB,IAAI;AAE1B,QACG,QAAQ,gBAAgB,EACxB,YAAY,8LAAyL,EACrM,OAAO,gBAAgB,gCAAgC,EACvD,OAAO,qBAAqB,yEAAyE,EACrG,OAAO,WAAW,sDAAsD,EACxE,OAAO,SAAS,8EAA8E,EAC9F,OAAO,oBAAoB,0DAA0D,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,EAC7I,OAAO,yBAAyB,8HAA8H,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,EACtN,OAAO,iBAAiB,+JAA0J,EAClL,OAAO,YAAY,wKAAwK,EAC3L;AAAA,EACC,OAAO,SASD;AACJ,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,+BAA8B;AACxE,UAAM,cAAc,CAAC,eAAe,SAAS,YAAY,QAAQ;AAEjE,UAAM,SAAS,KAAK,QACf,KAAK,MAAM;AAAA,MAAO,CAAC,MACjB,YAAkC,SAAS,CAAC;AAAA,IAC/C,IACA;AACJ,UAAM,OAAO,MAAM,iBAAiB;AAAA,MAClC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,KAAK,KAAK;AAAA,MACV,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,QAAI,SAAS,EAAG,SAAQ,KAAK,IAAI;AAAA,EACnC;AACF;AAEF,QAAQ,MAAM;","names":[]}
+{"version":3,"sources":["../../bin/oh-my-design.ts"],"sourcesContent":["import { Command } from 'commander';\nimport { readFileSync, existsSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nfunction readPackageVersion(): string {\n  let cur = dirname(fileURLToPath(import.meta.url));\n  for (let i = 0; i < 8; i++) {\n    const pkg = join(cur, 'package.json');\n    if (existsSync(pkg)) {\n      try {\n        return JSON.parse(readFileSync(pkg, 'utf8')).version ?? '0.0.0';\n      } catch {\n        return '0.0.0';\n      }\n    }\n    const parent = dirname(cur);\n    if (parent === cur) break;\n    cur = parent;\n  }\n  return '0.0.0';\n}\n\nconst program = new Command();\n\nprogram\n  .name('oh-my-design')\n  .description('Install and diagnose the oh-my-design skill bundle. After setup, design work happens through natural-language prompts in your coding agent.')\n  .version(readPackageVersion())\n  .showSuggestionAfterError(true)\n  .showHelpAfterError(true);\n\nprogram.action(async () => {\n  const { runInstallSkills } = await import('../src/cli/install-skills.js');\n  const code = await runInstallSkills();\n  if (code !== 0) process.exit(code);\n});\n\nprogram\n  .command('install-skills')\n  .description('Install OmD skills, specialist roles, and the reference catalog into the selected coding-agent channels.')\n  .option('--dir <path>', 'Project root (defaults to cwd)')\n  .option('--agent <name...>', 'Restrict to specific channels (claude-code | codex | opencode | cursor)')\n  .option('--force', 'Overwrite existing files even without the omd marker')\n  .option('--repair-hooks', 'Refresh the managed Claude hook bundle without overwriting other unmarked files')\n  .option('--all', 'Skip the interactive TUI and install every shipped skill + agent (use in CI)')\n  .option('--skills <names>', 'Comma-separated skill names to install (overrides TUI)', (v) => v.split(',').map((s) => s.trim()).filter(Boolean))\n  .option('--agents-only <names>', 'Comma-separated agent names to install (overrides TUI). Use --agents-only to disambiguate from --agent (channel selector).', (v) => v.split(',').map((s) => s.trim()).filter(Boolean))\n  .option('--skills-only', 'Install only the named skill files — skip sub-agents, hooks, and settings.json (minimal single-skill install, e.g. --skills claude-design --skills-only)')\n  .option('--global', 'Install to each channel\\'s user-level discovery directory instead of this project. Writes skills + sub-agents + catalog; never touches global hooks/settings.')\n  .action(\n    async (opts: {\n      dir?: string;\n      agent?: string[];\n      force?: boolean;\n      repairHooks?: boolean;\n      all?: boolean;\n      skills?: string[];\n      agentsOnly?: string[];\n      skillsOnly?: boolean;\n      global?: boolean;\n    }) => {\n      const { runInstallSkills } = await import('../src/cli/install-skills.js');\n      type Agent = 'claude-code' | 'codex' | 'opencode' | 'cursor';\n      // Keep raw values until runInstallSkills validates them. Silently\n      // filtering an invalid channel used to produce a successful 0-file install.\n      const agents = opts.agent as Agent[] | undefined;\n      const code = await runInstallSkills({\n        dir: opts.dir,\n        agents,\n        force: opts.force,\n        repairHooks: opts.repairHooks,\n        all: opts.all,\n        skillsFilter: opts.skills,\n        agentsFilter: opts.agentsOnly,\n        skillsOnly: opts.skillsOnly,\n        global: opts.global,\n      });\n      if (code !== 0) process.exit(code);\n    }\n  );\n\nprogram\n  .command('doctor')\n  .description('Check whether skills, sub-agents, references, and DESIGN.md are ready; print the exact next action.')\n  .option('--dir <path>', 'Project root (defaults to cwd)')\n  .option('--global', 'Check the user-level installation instead of this project')\n  .option('--json', 'Print a machine-readable report')\n  .action(async (opts: { dir?: string; global?: boolean; json?: boolean }) => {\n    const { runDoctor } = await import('../src/cli/doctor.js');\n    const code = await runDoctor(opts);\n    if (code !== 0) process.exit(code);\n  });\n\nawait program.parseAsync();\n"],"mappings":";;;AAAA,SAAS,eAAe;AACxB,SAAS,cAAc,kBAAkB;AACzC,SAAS,SAAS,YAAY;AAC9B,SAAS,qBAAqB;AAE9B,SAAS,qBAA6B;AACpC,MAAI,MAAM,QAAQ,cAAc,YAAY,GAAG,CAAC;AAChD,WAAS,IAAI,GAAG,IAAI,GAAG,KAAK;AAC1B,UAAM,MAAM,KAAK,KAAK,cAAc;AACpC,QAAI,WAAW,GAAG,GAAG;AACnB,UAAI;AACF,eAAO,KAAK,MAAM,aAAa,KAAK,MAAM,CAAC,EAAE,WAAW;AAAA,MAC1D,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,IAAM,UAAU,IAAI,QAAQ;AAE5B,QACG,KAAK,cAAc,EACnB,YAAY,6IAA6I,EACzJ,QAAQ,mBAAmB,CAAC,EAC5B,yBAAyB,IAAI,EAC7B,mBAAmB,IAAI;AAE1B,QAAQ,OAAO,YAAY;AACzB,QAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,+BAA8B;AACxE,QAAM,OAAO,MAAM,iBAAiB;AACpC,MAAI,SAAS,EAAG,SAAQ,KAAK,IAAI;AACnC,CAAC;AAED,QACG,QAAQ,gBAAgB,EACxB,YAAY,0GAA0G,EACtH,OAAO,gBAAgB,gCAAgC,EACvD,OAAO,qBAAqB,yEAAyE,EACrG,OAAO,WAAW,sDAAsD,EACxE,OAAO,kBAAkB,iFAAiF,EAC1G,OAAO,SAAS,8EAA8E,EAC9F,OAAO,oBAAoB,0DAA0D,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,EAC7I,OAAO,yBAAyB,8HAA8H,CAAC,MAAM,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,CAAC,EACtN,OAAO,iBAAiB,+JAA0J,EAClL,OAAO,YAAY,8JAA+J,EAClL;AAAA,EACC,OAAO,SAUD;AACJ,UAAM,EAAE,iBAAiB,IAAI,MAAM,OAAO,+BAA8B;AAIxE,UAAM,SAAS,KAAK;AACpB,UAAM,OAAO,MAAM,iBAAiB;AAAA,MAClC,KAAK,KAAK;AAAA,MACV;AAAA,MACA,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,KAAK,KAAK;AAAA,MACV,cAAc,KAAK;AAAA,MACnB,cAAc,KAAK;AAAA,MACnB,YAAY,KAAK;AAAA,MACjB,QAAQ,KAAK;AAAA,IACf,CAAC;AACD,QAAI,SAAS,EAAG,SAAQ,KAAK,IAAI;AAAA,EACnC;AACF;AAEF,QACG,QAAQ,QAAQ,EAChB,YAAY,qGAAqG,EACjH,OAAO,gBAAgB,gCAAgC,EACvD,OAAO,YAAY,2DAA2D,EAC9E,OAAO,UAAU,iCAAiC,EAClD,OAAO,OAAO,SAA6D;AAC1E,QAAM,EAAE,UAAU,IAAI,MAAM,OAAO,uBAAsB;AACzD,QAAM,OAAO,MAAM,UAAU,IAAI;AACjC,MAAI,SAAS,EAAG,SAAQ,KAAK,IAAI;AACnC,CAAC;AAEH,MAAM,QAAQ,WAAW;","names":[]}

package/dist/chunk-UJIHCEYF.js

@@ -0,0 +1,99 @@
+#!/usr/bin/env node
+
+// src/cli/hook-contract.ts
+import { createHash } from "crypto";
+var CLAUDE_HOOK_PATHS = [
+  "skill-activation.cjs",
+  "session-state-loader.cjs",
+  "post-edit-watch.cjs",
+  "session-end-foldin.cjs",
+  "lib/preferences-parser.cjs",
+  "lib/preferences-writer.cjs"
+];
+var MARKER_RE = /^\/\/ omd:installed-hook sha256=([0-9a-f]{64})\r?$/m;
+var LEGACY_HOOK_HASHES = {
+  "skill-activation.cjs": [
+    "2231898cfa1f187abe96dea3f1c32b1be522eefe6f13fc5cd887e8745da2aff7",
+    "3ac226a3cd7d9579d44c0d760fbb5a0b806208132e546c35c0d226dda3552338",
+    "94521f10970b5fcf408fb3aa363a896d00328b045f687aa34d3fc93783f1bb9d",
+    "e6e551bfdd46906bdd6b4ef955c3152f1b88b10010519d8d7886f39c052834a3"
+  ],
+  "session-state-loader.cjs": [
+    "06f12167efb4fbd56dde586c0cc4a181f873b8e98da986aed2fe67b3eb14a9e6",
+    "757860c1ab47e3a74465b51c53438b9a1f964b63ae904699e12a28f20b0db1e2",
+    "8982eff72fc5bd4ab78ba152609560d96aaccde1add1506833ca0d47916369f6",
+    "e5c62304db69247f7deb2237b9b4c559b65e56c0b9d2a9f095f41fa6598d4f4c"
+  ],
+  "post-edit-watch.cjs": [
+    "6209bd47f9403ec158cfebd66d3e9a00ec19024d62cbac590cf3a977ddf099a1",
+    "8f675e4e4b33ac648fca29a934fb2365608c8d8b738a8848e9fafa01ab99cbf5",
+    "f471b2b322fbbedf5a1a311819827a55aedcc1cd660617df2b2d130153467974",
+    "f9e2f5ba7287405505c8c9d871a10e8c15c37a403dcff4501f72e25b5c0213e2"
+  ],
+  "session-end-foldin.cjs": [
+    "2bc5b9656c2e3891c68c9bb3213af770002727fd354273fbe4b3158c9dd92968",
+    "c3055666d94fd6861f8324275ab89477af1c9edce32562a18ebd36e13600db15",
+    "c53779b4806cd5d96851f28fc6db6951d3e34713f2439f38048a892c1fb182b5"
+  ],
+  "lib/preferences-parser.cjs": [
+    "44ceaf346dc7238f92f127699d9b985940f77c68a461752d15f10b930ecea4ca",
+    "d11bd77a840ff1173299ae573061c3519e9dc728a53ce20c07348717091c2bf1"
+  ],
+  "lib/preferences-writer.cjs": [
+    "f539948ceb96797081ba2669c7820149a7b1784659b5f950d1b08f2a9945b30e"
+  ]
+};
+function sha256(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function stripManagedHookMarker(content) {
+  return content.replace(/^\/\/ omd:installed-hook sha256=[0-9a-f]{64}\r?\n/m, "");
+}
+function renderManagedHook(source) {
+  const raw = stripManagedHookMarker(source);
+  const marker = `// omd:installed-hook sha256=${sha256(raw)}`;
+  const shebangEnd = raw.startsWith("#!") ? raw.indexOf("\n") : -1;
+  return shebangEnd >= 0 ? `${raw.slice(0, shebangEnd + 1)}${marker}
+${raw.slice(shebangEnd + 1)}` : `${marker}
+${raw}`;
+}
+function isCurrentManagedHook(content, source) {
+  return content === renderManagedHook(source);
+}
+function isSelfConsistentManagedHook(content) {
+  const declared = MARKER_RE.exec(content)?.[1];
+  return Boolean(declared && declared === sha256(stripManagedHookMarker(content)));
+}
+function isKnownLegacyHook(path, content) {
+  return !MARKER_RE.test(content) && LEGACY_HOOK_HASHES[path].includes(sha256(content));
+}
+
+// src/cli/install-path.ts
+import { existsSync, lstatSync } from "fs";
+import { isAbsolute, join, relative, resolve, sep } from "path";
+function unsafeManagedPath(installRoot, destination) {
+  const root = resolve(installRoot);
+  const target = resolve(destination);
+  const rel = relative(root, target);
+  if (rel === ".." || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {
+    return "destination escapes the selected install root";
+  }
+  let current = root;
+  for (const segment of rel.split(sep).filter(Boolean)) {
+    current = join(current, segment);
+    if (existsSync(current) && lstatSync(current).isSymbolicLink()) {
+      return `symlinked managed path: ${relative(root, current)}`;
+    }
+  }
+  return null;
+}
+
+export {
+  CLAUDE_HOOK_PATHS,
+  renderManagedHook,
+  isCurrentManagedHook,
+  isSelfConsistentManagedHook,
+  isKnownLegacyHook,
+  unsafeManagedPath
+};
+//# sourceMappingURL=chunk-UJIHCEYF.js.map

package/dist/chunk-UJIHCEYF.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/cli/hook-contract.ts","../src/cli/install-path.ts"],"sourcesContent":["import { createHash } from 'node:crypto';\n\nexport const CLAUDE_HOOK_PATHS = [\n  'skill-activation.cjs',\n  'session-state-loader.cjs',\n  'post-edit-watch.cjs',\n  'session-end-foldin.cjs',\n  'lib/preferences-parser.cjs',\n  'lib/preferences-writer.cjs',\n] as const;\n\nconst MARKER_RE = /^\\/\\/ omd:installed-hook sha256=([0-9a-f]{64})\\r?$/m;\n\nconst LEGACY_HOOK_HASHES: Record<(typeof CLAUDE_HOOK_PATHS)[number], readonly string[]> = {\n  'skill-activation.cjs': [\n    '2231898cfa1f187abe96dea3f1c32b1be522eefe6f13fc5cd887e8745da2aff7',\n    '3ac226a3cd7d9579d44c0d760fbb5a0b806208132e546c35c0d226dda3552338',\n    '94521f10970b5fcf408fb3aa363a896d00328b045f687aa34d3fc93783f1bb9d',\n    'e6e551bfdd46906bdd6b4ef955c3152f1b88b10010519d8d7886f39c052834a3',\n  ],\n  'session-state-loader.cjs': [\n    '06f12167efb4fbd56dde586c0cc4a181f873b8e98da986aed2fe67b3eb14a9e6',\n    '757860c1ab47e3a74465b51c53438b9a1f964b63ae904699e12a28f20b0db1e2',\n    '8982eff72fc5bd4ab78ba152609560d96aaccde1add1506833ca0d47916369f6',\n    'e5c62304db69247f7deb2237b9b4c559b65e56c0b9d2a9f095f41fa6598d4f4c',\n  ],\n  'post-edit-watch.cjs': [\n    '6209bd47f9403ec158cfebd66d3e9a00ec19024d62cbac590cf3a977ddf099a1',\n    '8f675e4e4b33ac648fca29a934fb2365608c8d8b738a8848e9fafa01ab99cbf5',\n    'f471b2b322fbbedf5a1a311819827a55aedcc1cd660617df2b2d130153467974',\n    'f9e2f5ba7287405505c8c9d871a10e8c15c37a403dcff4501f72e25b5c0213e2',\n  ],\n  'session-end-foldin.cjs': [\n    '2bc5b9656c2e3891c68c9bb3213af770002727fd354273fbe4b3158c9dd92968',\n    'c3055666d94fd6861f8324275ab89477af1c9edce32562a18ebd36e13600db15',\n    'c53779b4806cd5d96851f28fc6db6951d3e34713f2439f38048a892c1fb182b5',\n  ],\n  'lib/preferences-parser.cjs': [\n    '44ceaf346dc7238f92f127699d9b985940f77c68a461752d15f10b930ecea4ca',\n    'd11bd77a840ff1173299ae573061c3519e9dc728a53ce20c07348717091c2bf1',\n  ],\n  'lib/preferences-writer.cjs': [\n    'f539948ceb96797081ba2669c7820149a7b1784659b5f950d1b08f2a9945b30e',\n  ],\n};\n\nfunction sha256(content: string): string {\n  return createHash('sha256').update(content).digest('hex');\n}\n\nexport function stripManagedHookMarker(content: string): string {\n  return content.replace(/^\\/\\/ omd:installed-hook sha256=[0-9a-f]{64}\\r?\\n/m, '');\n}\n\nexport function renderManagedHook(source: string): string {\n  const raw = stripManagedHookMarker(source);\n  const marker = `// omd:installed-hook sha256=${sha256(raw)}`;\n  const shebangEnd = raw.startsWith('#!') ? raw.indexOf('\\n') : -1;\n  return shebangEnd >= 0\n    ? `${raw.slice(0, shebangEnd + 1)}${marker}\\n${raw.slice(shebangEnd + 1)}`\n    : `${marker}\\n${raw}`;\n}\n\nexport function isCurrentManagedHook(content: string, source: string): boolean {\n  return content === renderManagedHook(source);\n}\n\nexport function isSelfConsistentManagedHook(content: string): boolean {\n  const declared = MARKER_RE.exec(content)?.[1];\n  return Boolean(declared && declared === sha256(stripManagedHookMarker(content)));\n}\n\nexport function isKnownLegacyHook(\n  path: (typeof CLAUDE_HOOK_PATHS)[number],\n  content: string,\n): boolean {\n  return !MARKER_RE.test(content) && LEGACY_HOOK_HASHES[path].includes(sha256(content));\n}\n","import { existsSync, lstatSync } from 'node:fs';\nimport { isAbsolute, join, relative, resolve, sep } from 'node:path';\n\n/**\n * Managed installer writes must never traverse a symlink below the user-selected\n * install root. Besides protecting project files, this prevents a repository\n * from redirecting `--force` or `--repair-hooks` writes outside its boundary.\n * The install root itself may be a symlink because users commonly open projects\n * through a symlinked workspace path.\n */\nexport function unsafeManagedPath(\n  installRoot: string,\n  destination: string,\n): string | null {\n  const root = resolve(installRoot);\n  const target = resolve(destination);\n  const rel = relative(root, target);\n  if (rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {\n    return 'destination escapes the selected install root';\n  }\n\n  let current = root;\n  for (const segment of rel.split(sep).filter(Boolean)) {\n    current = join(current, segment);\n    if (existsSync(current) && lstatSync(current).isSymbolicLink()) {\n      return `symlinked managed path: ${relative(root, current)}`;\n    }\n  }\n  return null;\n}\n"],"mappings":";;;AAAA,SAAS,kBAAkB;AAEpB,IAAM,oBAAoB;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,YAAY;AAElB,IAAM,qBAAoF;AAAA,EACxF,wBAAwB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,4BAA4B;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,uBAAuB;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,0BAA0B;AAAA,IACxB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,8BAA8B;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAAA,EACA,8BAA8B;AAAA,IAC5B;AAAA,EACF;AACF;AAEA,SAAS,OAAO,SAAyB;AACvC,SAAO,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AAC1D;AAEO,SAAS,uBAAuB,SAAyB;AAC9D,SAAO,QAAQ,QAAQ,sDAAsD,EAAE;AACjF;AAEO,SAAS,kBAAkB,QAAwB;AACxD,QAAM,MAAM,uBAAuB,MAAM;AACzC,QAAM,SAAS,gCAAgC,OAAO,GAAG,CAAC;AAC1D,QAAM,aAAa,IAAI,WAAW,IAAI,IAAI,IAAI,QAAQ,IAAI,IAAI;AAC9D,SAAO,cAAc,IACjB,GAAG,IAAI,MAAM,GAAG,aAAa,CAAC,CAAC,GAAG,MAAM;AAAA,EAAK,IAAI,MAAM,aAAa,CAAC,CAAC,KACtE,GAAG,MAAM;AAAA,EAAK,GAAG;AACvB;AAEO,SAAS,qBAAqB,SAAiB,QAAyB;AAC7E,SAAO,YAAY,kBAAkB,MAAM;AAC7C;AAEO,SAAS,4BAA4B,SAA0B;AACpE,QAAM,WAAW,UAAU,KAAK,OAAO,IAAI,CAAC;AAC5C,SAAO,QAAQ,YAAY,aAAa,OAAO,uBAAuB,OAAO,CAAC,CAAC;AACjF;AAEO,SAAS,kBACd,MACA,SACS;AACT,SAAO,CAAC,UAAU,KAAK,OAAO,KAAK,mBAAmB,IAAI,EAAE,SAAS,OAAO,OAAO,CAAC;AACtF;;;AC7EA,SAAS,YAAY,iBAAiB;AACtC,SAAS,YAAY,MAAM,UAAU,SAAS,WAAW;AASlD,SAAS,kBACd,aACA,aACe;AACf,QAAM,OAAO,QAAQ,WAAW;AAChC,QAAM,SAAS,QAAQ,WAAW;AAClC,QAAM,MAAM,SAAS,MAAM,MAAM;AACjC,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,KAAK,WAAW,GAAG,GAAG;AACjE,WAAO;AAAA,EACT;AAEA,MAAI,UAAU;AACd,aAAW,WAAW,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACpD,cAAU,KAAK,SAAS,OAAO;AAC/B,QAAI,WAAW,OAAO,KAAK,UAAU,OAAO,EAAE,eAAe,GAAG;AAC9D,aAAO,2BAA2B,SAAS,MAAM,OAAO,CAAC;AAAA,IAC3D;AAAA,EACF;AACA,SAAO;AACT;","names":[]}