onadit 0.0.1 → 1.0.0

package/dist/src/cli/feedback/feedback-status.js

@@ -0,0 +1,122 @@
+/**
+ * Build the sanitized status snapshot that ships with `--with-status`.
+ *
+ * The privacy contract restricts what may leave the machine: counts and
+ * booleans, no path strings, no error messages (errors can quote raw
+ * file paths from inside `~/`), no Voyage key bytes. This module is the
+ * sole authority on the snapshot shape — callers don't get to attach
+ * extra fields.
+ */
+import { readAutoCaptureRunSummary, } from "../../capture/observability.js";
+export async function buildStatusSnapshot(deps) {
+    const fetchFn = deps.fetchFn ?? fetch;
+    const timeoutMs = deps.timeoutMs ?? 2_000;
+    const health = await fetchHealth(deps.baseUrl, fetchFn, timeoutMs);
+    const build = await fetchBuild(deps.baseUrl, fetchFn, timeoutMs);
+    const auto = readAutoCaptureSafely(deps.dataDir);
+    return { health, build, auto_capture: auto };
+}
+async function fetchHealth(baseUrl, fetchFn, timeoutMs) {
+    if (!baseUrl) {
+        return { status: "unreachable", uptime_seconds: null, voyage_key_present: null };
+    }
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`${baseUrl}/health`, { signal: controller.signal });
+        if (!res.ok) {
+            return { status: "unreachable", uptime_seconds: null, voyage_key_present: null };
+        }
+        const data = (await res.json());
+        return {
+            status: "ok",
+            uptime_seconds: typeof data.uptime_seconds === "number" ? data.uptime_seconds : null,
+            voyage_key_present: typeof data.voyage_key_present === "boolean"
+                ? data.voyage_key_present
+                : null,
+        };
+    }
+    catch {
+        return { status: "unreachable", uptime_seconds: null, voyage_key_present: null };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function fetchBuild(baseUrl, fetchFn, timeoutMs) {
+    if (!baseUrl)
+        return null;
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), timeoutMs);
+    try {
+        const res = await fetchFn(`${baseUrl}/version`, { signal: controller.signal });
+        if (!res.ok)
+            return null;
+        const data = (await res.json());
+        if (typeof data.name !== "string" ||
+            typeof data.version !== "string" ||
+            typeof data.commit !== "string" ||
+            typeof data.node !== "string") {
+            return null;
+        }
+        return {
+            name: data.name,
+            version: data.version,
+            commit: data.commit,
+            node: data.node,
+        };
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function readAutoCaptureSafely(dataDir) {
+    let summary;
+    try {
+        summary = readAutoCaptureRunSummary(dataDir);
+    }
+    catch {
+        return blankAutoCapture();
+    }
+    const last = summary.last_run;
+    if (!last)
+        return blankAutoCapture();
+    const totals = totalsFromCounts(last);
+    return {
+        last_run_ts: last.timestamp,
+        last_run_ok: last.run_ok,
+        last_preflight_ok: last.preflight_ok,
+        last_run_error_count: last.errors.length,
+        last_run_saved: totals.saved,
+        last_run_review: totals.review,
+        last_run_discarded: totals.discarded,
+    };
+}
+function blankAutoCapture() {
+    return {
+        last_run_ts: null,
+        last_run_ok: null,
+        last_preflight_ok: null,
+        last_run_error_count: null,
+        last_run_saved: null,
+        last_run_review: null,
+        last_run_discarded: null,
+    };
+}
+function totalsFromCounts(record) {
+    let saved = 0;
+    let review = 0;
+    let discarded = 0;
+    for (const counts of Object.values(record.counts_by_source)) {
+        if (!counts)
+            continue;
+        saved += counts.saved;
+        review += counts.review;
+        discarded += counts.discarded;
+    }
+    return { saved, review, discarded };
+}
+//# sourceMappingURL=feedback-status.js.map

package/dist/src/cli/feedback/feedback-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"feedback-status.js","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-status.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,yBAAyB,GAE1B,MAAM,gCAAgC,CAAC;AAaxC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAuB;IAEvB,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,KAAK,CAAC;IACtC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACjE,MAAM,IAAI,GAAG,qBAAqB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACjD,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,KAAK,UAAU,WAAW,CACxB,OAAsB,EACtB,OAAqB,EACrB,SAAiB;IAEjB,IAAI,CAAC,OAAO,EAAE,CAAC;QACb,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,SAAS,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC9E,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;QACnF,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAG7B,CAAC;QACF,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,cAAc,EACZ,OAAO,IAAI,CAAC,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,IAAI;YACtE,kBAAkB,EAChB,OAAO,IAAI,CAAC,kBAAkB,KAAK,SAAS;gBAC1C,CAAC,CAAC,IAAI,CAAC,kBAAkB;gBACzB,CAAC,CAAC,IAAI;SACX,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,cAAc,EAAE,IAAI,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC;IACnF,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,OAAsB,EACtB,OAAqB,EACrB,SAAiB;IAEjB,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9D,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,OAAO,UAAU,EAAE,EAAE,MAAM,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAC/E,IAAI,CAAC,GAAG,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAuB,CAAC;QACtD,IACE,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YAC7B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ;YAChC,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ;YAC/B,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAC7B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;QACD,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,IAAI,EAAE,IAAI,CAAC,IAAI;SAChB,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;AACH,CAAC;AAED,SAAS,qBAAqB,CAC5B,OAAe;IAEf,IAAI,OAAO,CAAC;IACZ,IAAI,CAAC;QACH,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,gBAAgB,EAAE,CAAC;IAC5B,CAAC;IACD,MAAM,IAAI,GAAgC,OAAO,CAAC,QAAQ,CAAC;IAC3D,IAAI,CAAC,IAAI;QAAE,OAAO,gBAAgB,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACtC,OAAO;QACL,WAAW,EAAE,IAAI,CAAC,SAAS;QAC3B,WAAW,EAAE,IAAI,CAAC,MAAM;QACxB,iBAAiB,EAAE,IAAI,CAAC,YAAY;QACpC,oBAAoB,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM;QACxC,cAAc,EAAE,MAAM,CAAC,KAAK;QAC5B,eAAe,EAAE,MAAM,CAAC,MAAM;QAC9B,kBAAkB,EAAE,MAAM,CAAC,SAAS;KACrC,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB;IACvB,OAAO;QACL,WAAW,EAAE,IAAI;QACjB,WAAW,EAAE,IAAI;QACjB,iBAAiB,EAAE,IAAI;QACvB,oBAAoB,EAAE,IAAI;QAC1B,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,IAAI;QACrB,kBAAkB,EAAE,IAAI;KACzB,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA4B;IAKpD,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,KAAK,IAAI,MAAM,CAAC,KAAK,CAAC;QACtB,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC;QACxB,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC;IAChC,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACtC,CAAC"}

package/dist/src/cli/feedback/invite.d.ts

@@ -0,0 +1,17 @@
+export interface RiftInvite {
+    url: string;
+    secret: string;
+    label?: string;
+}
+/**
+ * Decode an invite code into its parts. Throws a `validation` CliError on any
+ * malformation (bad prefix, bad base64, bad JSON, missing/invalid fields) with
+ * one friend-facing message — never leaks the decode internals.
+ */
+export declare function parseInvite(raw: string): RiftInvite;
+/**
+ * Build an invite code from its parts. The operator-side counterpart to
+ * `parseInvite` (used to mint codes and to round-trip in tests).
+ */
+export declare function formatInvite(invite: RiftInvite): string;
+//# sourceMappingURL=invite.d.ts.map

package/dist/src/cli/feedback/invite.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/invite.ts"],"names":[],"mappings":"AAkCA,MAAM,WAAW,UAAU;IACzB,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAKD;;;;GAIG;AACH,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,UAAU,CAoBnD;AAED;;;GAGG;AACH,wBAAgB,YAAY,CAAC,MAAM,EAAE,UAAU,GAAG,MAAM,CAWvD"}

package/dist/src/cli/feedback/invite.js

@@ -0,0 +1,73 @@
+/**
+ * Feedback-relay invite codes.
+ *
+ * An invite is a single opaque string the operator hands a friend. It carries
+ * the relay URL + the HMAC secret so the friend never sees or types a raw
+ * secret — they paste ONE blob and Onadit does the rest (URL → config, secret →
+ * Keychain). Shape:
+ *
+ *   onadit-invite_<base64url(JSON)>   where JSON = { v: 1, url, secret, label? }
+ *
+ * A code issued before the product was renamed starts with `rift-invite_` and
+ * stays valid.
+ *
+ * NOTE (deferred, tracked): the invite embeds the *shared* beta secret, so it
+ * is only as revocable as that secret. Acceptable for beta (it signs feedback
+ * to Clem, low stakes); the revocable per-install token is the future upgrade.
+ */
+import { z } from "zod";
+import { CliError } from "../http-client.js";
+const INVITE_PREFIX = "onadit-invite_";
+/** The prefix of codes issued before the product was renamed. Still accepted. */
+const PREVIOUS_INVITE_PREFIX = "rift-invite_";
+const InvitePayloadSchema = z
+    .object({
+    v: z.literal(1),
+    url: z.string().url(),
+    secret: z.string().min(1),
+    label: z.string().min(1).optional(),
+})
+    .strict();
+const INVALID = "That invite code is not valid. Ask Clem for a fresh `onadit-invite_…` code.";
+/**
+ * Decode an invite code into its parts. Throws a `validation` CliError on any
+ * malformation (bad prefix, bad base64, bad JSON, missing/invalid fields) with
+ * one friend-facing message — never leaks the decode internals.
+ */
+export function parseInvite(raw) {
+    const code = raw.trim();
+    const prefix = [INVITE_PREFIX, PREVIOUS_INVITE_PREFIX].find((p) => code.startsWith(p));
+    if (!prefix) {
+        throw new CliError(INVALID, "validation");
+    }
+    const encoded = code.slice(prefix.length);
+    let json;
+    try {
+        const decoded = Buffer.from(encoded, "base64url").toString("utf8");
+        json = JSON.parse(decoded);
+    }
+    catch {
+        throw new CliError(INVALID, "validation");
+    }
+    const parsed = InvitePayloadSchema.safeParse(json);
+    if (!parsed.success) {
+        throw new CliError(INVALID, "validation");
+    }
+    const { url, secret, label } = parsed.data;
+    return { url, secret, ...(label ? { label } : {}) };
+}
+/**
+ * Build an invite code from its parts. The operator-side counterpart to
+ * `parseInvite` (used to mint codes and to round-trip in tests).
+ */
+export function formatInvite(invite) {
+    const payload = {
+        v: 1,
+        url: invite.url,
+        secret: invite.secret,
+        ...(invite.label ? { label: invite.label } : {}),
+    };
+    const encoded = Buffer.from(JSON.stringify(payload), "utf8").toString("base64url");
+    return `${INVITE_PREFIX}${encoded}`;
+}
+//# sourceMappingURL=invite.js.map

package/dist/src/cli/feedback/invite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"invite.js","sourceRoot":"","sources":["../../../../src/cli/feedback/invite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,QAAQ,EAAE,MAAM,mBAAmB,CAAC;AAE7C,MAAM,aAAa,GAAG,gBAAgB,CAAC;AACvC,iFAAiF;AACjF,MAAM,sBAAsB,GAAG,cAAc,CAAC;AAE9C,MAAM,mBAAmB,GAAG,CAAC;KAC1B,MAAM,CAAC;IACN,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IACf,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE;IACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAC;AAQZ,MAAM,OAAO,GACX,6EAA6E,CAAC;AAEhF;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW;IACrC,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,aAAa,EAAE,sBAAsB,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,IAAa,CAAC;IAClB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,MAAM,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;IAC5C,CAAC;IACD,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;IAC3C,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;AACtD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,YAAY,CAAC,MAAkB;IAC7C,MAAM,OAAO,GAAG;QACd,CAAC,EAAE,CAAU;QACb,GAAG,EAAE,MAAM,CAAC,GAAG;QACf,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjD,CAAC;IACF,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CACnE,WAAW,CACZ,CAAC;IACF,OAAO,GAAG,aAAa,GAAG,OAAO,EAAE,CAAC;AACtC,CAAC"}

package/dist/src/cli/feedback/relay-secret-store.d.ts

@@ -0,0 +1,32 @@
+/** Minimal shape of the promisified `execFile` we depend on (stdout only). */
+type ExecFn = (file: string, args: string[]) => Promise<{
+    stdout: string;
+}>;
+/**
+ * Storage for the relay HMAC secret. Abstracted so the feedback paths can be
+ * tested with an in-memory implementation that never shells out to `security`.
+ */
+export interface RelaySecretStore {
+    /** The stored secret, or null when none is set. */
+    read(): Promise<string | null>;
+    /** Write (or overwrite) the secret. */
+    write(secret: string): Promise<void>;
+    /** Remove the secret. No-op when already absent. */
+    delete(): Promise<void>;
+}
+/**
+ * Production store backed by the macOS `security` CLI. `exec` is injectable so
+ * tests can drive the error mapping (locked keychain, item-not-found) without
+ * a real Keychain. There is deliberately NO plaintext fallback — if the secret
+ * cannot be stored securely, relay signing is simply unavailable.
+ */
+export declare function createMacRelaySecretStore(exec?: ExecFn): RelaySecretStore;
+/** Production store backed by the real macOS `security` CLI. */
+export declare const macRelaySecretStore: RelaySecretStore;
+/**
+ * In-memory store for tests and any non-Keychain injection point. Holds the
+ * secret in a closure — never persisted. Production code never reaches for it.
+ */
+export declare function createInMemoryRelaySecretStore(initial?: string | null): RelaySecretStore;
+export {};
+//# sourceMappingURL=relay-secret-store.d.ts.map

package/dist/src/cli/feedback/relay-secret-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-secret-store.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/relay-secret-store.ts"],"names":[],"mappings":"AAmBA,8EAA8E;AAC9E,KAAK,MAAM,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC,CAAC;AA2C5E;;;GAGG;AACH,MAAM,WAAW,gBAAgB;IAC/B,mDAAmD;IACnD,IAAI,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IAC/B,uCAAuC;IACvC,KAAK,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACrC,oDAAoD;IACpD,MAAM,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,yBAAyB,CAAC,IAAI,GAAE,MAAoB,GAAG,gBAAgB,CAmDtF;AAED,gEAAgE;AAChE,eAAO,MAAM,mBAAmB,EAAE,gBAA8C,CAAC;AAEjF;;;GAGG;AACH,wBAAgB,8BAA8B,CAC5C,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GACtB,gBAAgB,CAalB"}

package/dist/src/cli/feedback/relay-secret-store.js

@@ -0,0 +1,137 @@
+/**
+ * Secure storage for the feedback-relay HMAC secret.
+ *
+ * The secret proves a feedback POST came from a configured Onadit install (the
+ * Cloudflare Worker validates the `X-Rift-Signature` HMAC). It is a real
+ * secret, so it must NOT sit in plaintext `feedback-config.json`. It lives in
+ * the macOS Keychain instead, under the same service as the daemon auth token
+ * (`com.getrift.daemon`) so all Onadit secrets share one keychain service.
+ *
+ * The store is an injectable interface: production uses the `security` CLI;
+ * tests inject `createInMemoryRelaySecretStore()` (no real Keychain, no GUI
+ * session) or `createMacRelaySecretStore(fakeExec)` to exercise the error
+ * mapping without shelling out.
+ */
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { LockedKeychainError } from "../../auth/keychain.js";
+const defaultExec = promisify(execFile);
+/** Same keychain service as the daemon auth token — one service per app. */
+const SERVICE = "com.getrift.daemon";
+/** Single (non-versioned) generic-password account for the relay secret. */
+const ACCOUNT = "RELAY_HMAC_SECRET";
+/** macOS `security` exit code for errSecItemNotFound — the only swallowed one. */
+const ERR_SEC_ITEM_NOT_FOUND = 44;
+/** Substring the `security` CLI emits when the login keychain is locked. */
+const LOCKED_KEYCHAIN_SUBSTRING = "User interaction is not allowed";
+// Predicates mirror the private helpers in ../../auth/keychain.ts. Kept local
+// (not exported from there) to avoid refactoring the heavily-tested auth path;
+// the auth token store remains the single owner of those internals.
+function isItemNotFound(err) {
+    if (!(err instanceof Error))
+        return false;
+    return err.code === ERR_SEC_ITEM_NOT_FOUND;
+}
+function isLockedKeychain(err) {
+    if (!(err instanceof Error))
+        return false;
+    if (err.message.includes(LOCKED_KEYCHAIN_SUBSTRING))
+        return true;
+    const stderr = err.stderr;
+    return typeof stderr === "string" && stderr.includes(LOCKED_KEYCHAIN_SUBSTRING);
+}
+/**
+ * Normalize a `security` failure: a locked keychain becomes the typed
+ * `LockedKeychainError` (so callers render the unlock hint instead of leaking
+ * raw `security` output); every other error propagates unchanged. Applied on
+ * EVERY path — read, write, and delete — so write failures during invite
+ * setup map the same way reads do.
+ */
+function rethrowKeychainError(err) {
+    if (isLockedKeychain(err)) {
+        throw new LockedKeychainError(err instanceof Error ? err.message : String(err));
+    }
+    throw err;
+}
+/**
+ * Production store backed by the macOS `security` CLI. `exec` is injectable so
+ * tests can drive the error mapping (locked keychain, item-not-found) without
+ * a real Keychain. There is deliberately NO plaintext fallback — if the secret
+ * cannot be stored securely, relay signing is simply unavailable.
+ */
+export function createMacRelaySecretStore(exec = defaultExec) {
+    return {
+        async read() {
+            try {
+                const { stdout } = await exec("security", [
+                    "find-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                    "-w",
+                ]);
+                return stdout.trim() || null;
+            }
+            catch (err) {
+                if (isItemNotFound(err))
+                    return null;
+                rethrowKeychainError(err);
+            }
+        },
+        async write(secret) {
+            try {
+                await exec("security", [
+                    "add-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                    "-w",
+                    secret,
+                    "-U", // update in place if it already exists
+                ]);
+            }
+            catch (err) {
+                rethrowKeychainError(err);
+            }
+        },
+        async delete() {
+            try {
+                await exec("security", [
+                    "delete-generic-password",
+                    "-a",
+                    ACCOUNT,
+                    "-s",
+                    SERVICE,
+                ]);
+            }
+            catch (err) {
+                if (isItemNotFound(err))
+                    return; // already gone — fine
+                rethrowKeychainError(err);
+            }
+        },
+    };
+}
+/** Production store backed by the real macOS `security` CLI. */
+export const macRelaySecretStore = createMacRelaySecretStore();
+/**
+ * In-memory store for tests and any non-Keychain injection point. Holds the
+ * secret in a closure — never persisted. Production code never reaches for it.
+ */
+export function createInMemoryRelaySecretStore(initial) {
+    let secret = initial ?? null;
+    return {
+        async read() {
+            return secret;
+        },
+        async write(value) {
+            secret = value;
+        },
+        async delete() {
+            secret = null;
+        },
+    };
+}
+//# sourceMappingURL=relay-secret-store.js.map

package/dist/src/cli/feedback/relay-secret-store.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"relay-secret-store.js","sourceRoot":"","sources":["../../../../src/cli/feedback/relay-secret-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAK7D,MAAM,WAAW,GAAG,SAAS,CAAC,QAAQ,CAAsB,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,OAAO,GAAG,oBAAoB,CAAC;AACrC,4EAA4E;AAC5E,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAEpC,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,EAAE,CAAC;AAClC,4EAA4E;AAC5E,MAAM,yBAAyB,GAAG,iCAAiC,CAAC;AAEpE,8EAA8E;AAC9E,+EAA+E;AAC/E,oEAAoE;AACpE,SAAS,cAAc,CAAC,GAAY;IAClC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,OAAQ,GAAyB,CAAC,IAAI,KAAK,sBAAsB,CAAC;AACpE,CAAC;AAED,SAAS,gBAAgB,CAAC,GAAY;IACpC,IAAI,CAAC,CAAC,GAAG,YAAY,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1C,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,MAAM,GAAI,GAA2B,CAAC,MAAM,CAAC;IACnD,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AAClF,CAAC;AAED;;;;;;GAMG;AACH,SAAS,oBAAoB,CAAC,GAAY;IACxC,IAAI,gBAAgB,CAAC,GAAG,CAAC,EAAE,CAAC;QAC1B,MAAM,IAAI,mBAAmB,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;IAClF,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAeD;;;;;GAKG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAe,WAAW;IAClE,OAAO;QACL,KAAK,CAAC,IAAI;YACR,IAAI,CAAC;gBACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE;oBACxC,uBAAuB;oBACvB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,IAAI;iBACL,CAAC,CAAC;gBACH,OAAO,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC;YAC/B,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,IAAI,CAAC;gBACrC,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,KAAK,CAAC,MAAM;YAChB,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,EAAE;oBACrB,sBAAsB;oBACtB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,MAAM;oBACN,IAAI,EAAE,uCAAuC;iBAC9C,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QAED,KAAK,CAAC,MAAM;YACV,IAAI,CAAC;gBACH,MAAM,IAAI,CAAC,UAAU,EAAE;oBACrB,yBAAyB;oBACzB,IAAI;oBACJ,OAAO;oBACP,IAAI;oBACJ,OAAO;iBACR,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,IAAI,cAAc,CAAC,GAAG,CAAC;oBAAE,OAAO,CAAC,sBAAsB;gBACvD,oBAAoB,CAAC,GAAG,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED,gEAAgE;AAChE,MAAM,CAAC,MAAM,mBAAmB,GAAqB,yBAAyB,EAAE,CAAC;AAEjF;;;GAGG;AACH,MAAM,UAAU,8BAA8B,CAC5C,OAAuB;IAEvB,IAAI,MAAM,GAAkB,OAAO,IAAI,IAAI,CAAC;IAC5C,OAAO;QACL,KAAK,CAAC,IAAI;YACR,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,KAAa;YACvB,MAAM,GAAG,KAAK,CAAC;QACjB,CAAC;QACD,KAAK,CAAC,MAAM;YACV,MAAM,GAAG,IAAI,CAAC;QAChB,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/src/cli/hooks-writers/claude-code-policy-script.d.ts

@@ -0,0 +1,35 @@
+/**
+ * Source of truth for the Onadit policy hook that ships into
+ * `~/.claude/hooks/rift-policy.mjs`.
+ *
+ * The script is a plain Node ESM module — no `jq`, no `@anthropic-ai`
+ * deps, just `node:fs` / `node:os` / `node:path`. Claude Code runs it
+ * via the matcher in `settings.json` and pipes the PreToolUse payload
+ * on stdin. We branch on `tool_name`:
+ *
+ *   - `mcp__onadit__onadit_context_pack`  → touch session marker, exit 0
+ *   - `mcp__onadit__onadit_search`        → require marker, else exit 2
+ *   - `mcp__onadit__onadit_conversations_search` → same
+ *   - anything else                   → exit 0 (defensive; matcher
+ *                                       should already exclude these)
+ *
+ * The server and its tools were called `rift` before the product was renamed,
+ * and a half-finished upgrade can pair either server name with either tool
+ * prefix. The script reads only which of the three tools is being called, so
+ * the policy holds in every pairing.
+ *
+ * Disable knobs:
+ *   - `RIFT_POLICY_DISABLED=1` in env → script no-ops with exit 0
+ *   - Remove the matcher entry from `~/.claude/settings.json`
+ *
+ * The body is exported as a string so the writer can install it
+ * verbatim — keeping the bytes-on-disk identical to the bytes the
+ * tests assert against.
+ */
+export declare const CLAUDE_CODE_POLICY_SCRIPT = "#!/usr/bin/env node\n// Onadit policy hook for Claude Code \u2014 managed by `onadit hooks install --client claude-code`.\n// Asks for onadit_context_pack (or a session-start brief) before open-ended\n// searches. Exact-id lookups and precise queries (identifiers, paths, quoted\n// phrases, long numbers) skip the ceremony: the pack would add a round trip\n// without helping a lookup the agent can already name.\n// Disable: set RIFT_POLICY_DISABLED=1 in env, or remove the matcher entry\n// from ~/.claude/settings.json.\n//\n// DO NOT EDIT BY HAND \u2014 re-running `onadit hooks install --client claude-code`\n// will overwrite local edits.\n\nimport fs from \"node:fs\";\nimport os from \"node:os\";\nimport path from \"node:path\";\n\nconst POLICY_MESSAGE =\n  \"Onadit policy: call mcp__onadit__onadit_context_pack first (compact, pre-budgeted). \" +\n  \"Only fall back to onadit_search/onadit_conversations_search if the pack returns \" +\n  \"nothing useful, and start with top_k 3-5.\";\n\nif (process.env.RIFT_POLICY_DISABLED === \"1\") process.exit(0);\n\nconst chunks = [];\nfor await (const chunk of process.stdin) chunks.push(chunk);\nconst raw = Buffer.concat(chunks).toString(\"utf8\");\n\nlet payload;\ntry {\n  payload = raw.trim() === \"\" ? {} : JSON.parse(raw);\n} catch {\n  // Fail-open on malformed input so a future hook-payload schema change\n  // can never silently block legitimate tool calls.\n  process.exit(0);\n}\n\nconst tool = typeof payload.tool_name === \"string\" ? payload.tool_name : \"\";\nconst session =\n  typeof payload.session_id === \"string\" && payload.session_id !== \"\"\n    ? payload.session_id\n    : \"nosession\";\nconst marker = path.join(os.tmpdir(), `rift-pack-called-${session}`);\n// Which of the three tools this is, under the server's current or earlier name.\nconst [, server = \"onadit\", prefix = \"onadit\", called = \"\"] =\n  /^mcp__(onadit|rift)__(onadit|rift)_(context_pack|search|conversations_search)$/.exec(tool) ?? [];\n\nif (called === \"context_pack\") {\n  try {\n    fs.closeSync(fs.openSync(marker, \"a\"));\n  } catch {\n    // best-effort; missing marker only blocks the next search call.\n  }\n  process.exit(0);\n}\n\nconst input =\n  payload.tool_input && typeof payload.tool_input === \"object\" ? payload.tool_input : {};\nconst query = typeof input.query === \"string\" ? input.query : \"\";\nconst PRECISE = [\n  /\"[^\"]{3,}\"/, // quoted phrase\n  /[\\w.-]+\\/[\\w.-]+/, // path\n  /\\b[\\w-]+\\.(?:ts|js|mjs|json|md|py|go|rs|swift|toml|ya?ml|sh)\\b/i, // file name\n  /\\b[A-Za-z][A-Za-z0-9]*_[A-Za-z0-9_]+\\b/, // snake / SCREAMING_SNAKE identifier\n  /\\b[a-z]+[A-Z][A-Za-z0-9]*\\b/, // camelCase identifier\n  /#\\d+/, // PR / issue number\n  /\\b[0-9a-f]{7,40}\\b/, // commit sha\n  /\\b\\d{4,}\\b/, // long number (ids, IDCC, amounts)\n];\nconst precise =\n  (typeof input.id === \"string\" && input.id !== \"\") || PRECISE.some((re) => re.test(query));\n\nif ((called === \"search\" || called === \"conversations_search\") && !precise) {\n  if (!fs.existsSync(marker)) {\n    // In the names of the connection that made the call: a connection made\n    // before the rename keeps the earlier ones, and the agent has only those.\n    const message = POLICY_MESSAGE.replaceAll(\"mcp__onadit__\", `mcp__${server}__`)\n      .replaceAll(\"MCP server onadit\", `MCP server ${server}`)\n      .replaceAll(\"onadit_\", `${prefix}_`);\n    process.stderr.write(message + \"\\n\");\n    process.exit(2);\n  }\n}\n\nprocess.exit(0);\n";
+/**
+ * The same script for Codex, which sends the same payload. Only the lines
+ * that name the host and where its entry lives differ.
+ */
+export declare const CODEX_POLICY_SCRIPT: string;
+//# sourceMappingURL=claude-code-policy-script.d.ts.map

package/dist/src/cli/hooks-writers/claude-code-policy-script.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-policy-script.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code-policy-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,eAAO,MAAM,yBAAyB,y8GAoFrC,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,mBAAmB,QAGwE,CAAC"}

package/dist/src/cli/hooks-writers/claude-code-policy-script.js

@@ -0,0 +1,122 @@
+/**
+ * Source of truth for the Onadit policy hook that ships into
+ * `~/.claude/hooks/rift-policy.mjs`.
+ *
+ * The script is a plain Node ESM module — no `jq`, no `@anthropic-ai`
+ * deps, just `node:fs` / `node:os` / `node:path`. Claude Code runs it
+ * via the matcher in `settings.json` and pipes the PreToolUse payload
+ * on stdin. We branch on `tool_name`:
+ *
+ *   - `mcp__onadit__onadit_context_pack`  → touch session marker, exit 0
+ *   - `mcp__onadit__onadit_search`        → require marker, else exit 2
+ *   - `mcp__onadit__onadit_conversations_search` → same
+ *   - anything else                   → exit 0 (defensive; matcher
+ *                                       should already exclude these)
+ *
+ * The server and its tools were called `rift` before the product was renamed,
+ * and a half-finished upgrade can pair either server name with either tool
+ * prefix. The script reads only which of the three tools is being called, so
+ * the policy holds in every pairing.
+ *
+ * Disable knobs:
+ *   - `RIFT_POLICY_DISABLED=1` in env → script no-ops with exit 0
+ *   - Remove the matcher entry from `~/.claude/settings.json`
+ *
+ * The body is exported as a string so the writer can install it
+ * verbatim — keeping the bytes-on-disk identical to the bytes the
+ * tests assert against.
+ */
+export const CLAUDE_CODE_POLICY_SCRIPT = `#!/usr/bin/env node
+// Onadit policy hook for Claude Code — managed by \`onadit hooks install --client claude-code\`.
+// Asks for onadit_context_pack (or a session-start brief) before open-ended
+// searches. Exact-id lookups and precise queries (identifiers, paths, quoted
+// phrases, long numbers) skip the ceremony: the pack would add a round trip
+// without helping a lookup the agent can already name.
+// Disable: set RIFT_POLICY_DISABLED=1 in env, or remove the matcher entry
+// from ~/.claude/settings.json.
+//
+// DO NOT EDIT BY HAND — re-running \`onadit hooks install --client claude-code\`
+// will overwrite local edits.
+
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const POLICY_MESSAGE =
+  "Onadit policy: call mcp__onadit__onadit_context_pack first (compact, pre-budgeted). " +
+  "Only fall back to onadit_search/onadit_conversations_search if the pack returns " +
+  "nothing useful, and start with top_k 3-5.";
+
+if (process.env.RIFT_POLICY_DISABLED === "1") process.exit(0);
+
+const chunks = [];
+for await (const chunk of process.stdin) chunks.push(chunk);
+const raw = Buffer.concat(chunks).toString("utf8");
+
+let payload;
+try {
+  payload = raw.trim() === "" ? {} : JSON.parse(raw);
+} catch {
+  // Fail-open on malformed input so a future hook-payload schema change
+  // can never silently block legitimate tool calls.
+  process.exit(0);
+}
+
+const tool = typeof payload.tool_name === "string" ? payload.tool_name : "";
+const session =
+  typeof payload.session_id === "string" && payload.session_id !== ""
+    ? payload.session_id
+    : "nosession";
+const marker = path.join(os.tmpdir(), \`rift-pack-called-\${session}\`);
+// Which of the three tools this is, under the server's current or earlier name.
+const [, server = "onadit", prefix = "onadit", called = ""] =
+  /^mcp__(onadit|rift)__(onadit|rift)_(context_pack|search|conversations_search)$/.exec(tool) ?? [];
+
+if (called === "context_pack") {
+  try {
+    fs.closeSync(fs.openSync(marker, "a"));
+  } catch {
+    // best-effort; missing marker only blocks the next search call.
+  }
+  process.exit(0);
+}
+
+const input =
+  payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : {};
+const query = typeof input.query === "string" ? input.query : "";
+const PRECISE = [
+  /"[^"]{3,}"/, // quoted phrase
+  /[\\w.-]+\\/[\\w.-]+/, // path
+  /\\b[\\w-]+\\.(?:ts|js|mjs|json|md|py|go|rs|swift|toml|ya?ml|sh)\\b/i, // file name
+  /\\b[A-Za-z][A-Za-z0-9]*_[A-Za-z0-9_]+\\b/, // snake / SCREAMING_SNAKE identifier
+  /\\b[a-z]+[A-Z][A-Za-z0-9]*\\b/, // camelCase identifier
+  /#\\d+/, // PR / issue number
+  /\\b[0-9a-f]{7,40}\\b/, // commit sha
+  /\\b\\d{4,}\\b/, // long number (ids, IDCC, amounts)
+];
+const precise =
+  (typeof input.id === "string" && input.id !== "") || PRECISE.some((re) => re.test(query));
+
+if ((called === "search" || called === "conversations_search") && !precise) {
+  if (!fs.existsSync(marker)) {
+    // In the names of the connection that made the call: a connection made
+    // before the rename keeps the earlier ones, and the agent has only those.
+    const message = POLICY_MESSAGE.replaceAll("mcp__onadit__", \`mcp__\${server}__\`)
+      .replaceAll("MCP server onadit", \`MCP server \${server}\`)
+      .replaceAll("onadit_", \`\${prefix}_\`);
+    process.stderr.write(message + "\\n");
+    process.exit(2);
+  }
+}
+
+process.exit(0);
+`;
+/**
+ * The same script for Codex, which sends the same payload. Only the lines
+ * that name the host and where its entry lives differ.
+ */
+export const CODEX_POLICY_SCRIPT = CLAUDE_CODE_POLICY_SCRIPT.replaceAll("--client claude-code", "--client codex")
+    .replaceAll("Claude Code", "Codex")
+    .replaceAll("~/.claude/settings.json", "~/.codex/hooks.json")
+    .replaceAll("mcp__onadit__onadit_context_pack first", "onadit_context_pack (MCP server onadit) first");
+//# sourceMappingURL=claude-code-policy-script.js.map

package/dist/src/cli/hooks-writers/claude-code-policy-script.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code-policy-script.js","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code-policy-script.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,MAAM,CAAC,MAAM,yBAAyB,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoFxC,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,yBAAyB,CAAC,UAAU,CAAC,sBAAsB,EAAE,gBAAgB,CAAC;KAC9G,UAAU,CAAC,aAAa,EAAE,OAAO,CAAC;KAClC,UAAU,CAAC,yBAAyB,EAAE,qBAAqB,CAAC;KAC5D,UAAU,CAAC,wCAAwC,EAAE,+CAA+C,CAAC,CAAC"}

package/dist/src/cli/hooks-writers/claude-code.d.ts

@@ -0,0 +1,63 @@
+import { type AgentHomeOpts } from "../agent-homes.js";
+import type { HookClientId, HookWriteOutcome } from "./types.js";
+export interface ClaudeCodeHookWriteOpts {
+    /** Absolute path of the user's $HOME (test override). */
+    homeDir: string;
+    /** Environment read for CLAUDE_CONFIG_DIR (test override). */
+    env?: NodeJS.ProcessEnv;
+    /** Print outcome only; do not touch disk. */
+    dryRun: boolean;
+    /** Test injection: stable timestamp for backup IDs. */
+    now?: () => Date;
+    /**
+     * Shell command that prints the Onadit project brief for a SessionStart hook
+     * (`onadit brief --hook`). Omitted → no SessionStart entry is written.
+     */
+    sessionStartCommand?: string;
+    /**
+     * Rewrite the entries that are already there and add none. A hook the
+     * person never turned on stays off.
+     */
+    existingOnly?: boolean;
+    /**
+     * Leave the PreToolUse matcher as it is. A refresh after an upgrade sets
+     * this: the connection has not changed names, so the matcher still fits,
+     * and Codex would stop running a hook whose matcher changed until the
+     * person reviewed it again.
+     */
+    keepMatcher?: boolean;
+}
+export declare function writeClaudeCodeHook(opts: ClaudeCodeHookWriteOpts): HookWriteOutcome;
+/** Where one agent keeps its hooks, and the policy script installed there. */
+export interface HookTarget {
+    client: HookClientId;
+    /** The agent's config home; the script goes in `<dir>/hooks/`. */
+    dir: string;
+    /** File in `dir` whose top-level `hooks` object lists the entries. */
+    settingsFile: string;
+    script: string;
+    /** Node that runs the policy script; `node` from PATH when absent. */
+    node?: string;
+}
+/**
+ * Claude Code (`settings.json`) and Codex (`hooks.json`) keep hooks in the
+ * same shape and send the same payloads, so one writer serves both. Script
+ * and settings live in the same agent home, so each account home is
+ * self-contained and removing one never breaks another.
+ */
+export declare function hookTarget(client: HookClientId, opts: AgentHomeOpts): HookTarget;
+export declare function writeAgentHook(target: HookTarget, opts: Pick<ClaudeCodeHookWriteOpts, "dryRun" | "now" | "sessionStartCommand" | "existingOnly" | "keepMatcher">): HookWriteOutcome;
+/** Substrings that identify Onadit's two commands across reinstalls. */
+export declare const POLICY_MARKER = "rift-policy.mjs";
+export declare const SESSION_START_MARKER = " brief --hook";
+/** True for one command of a group when it is Onadit's (its command holds the marker). */
+export declare function isRiftHandler(handler: unknown, marker: string): boolean;
+/** Where Onadit's command sits in an event's groups: the positions Codex keys its review on. */
+export declare function findRiftHandler(entries: unknown, marker: string): {
+    group: number;
+    handler: number;
+    matcher: unknown;
+    config: Record<string, unknown>;
+} | null;
+export { HooksParseFailedError } from "./errors.js";
+//# sourceMappingURL=claude-code.d.ts.map

package/dist/src/cli/hooks-writers/claude-code.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-code.d.ts","sourceRoot":"","sources":["../../../../src/cli/hooks-writers/claude-code.ts"],"names":[],"mappings":"AA4BA,OAAO,EAAiC,KAAK,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAGtF,OAAO,KAAK,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAOjE,MAAM,WAAW,uBAAuB;IACtC,yDAAyD;IACzD,OAAO,EAAE,MAAM,CAAC;IAChB,8DAA8D;IAC9D,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,6CAA6C;IAC7C,MAAM,EAAE,OAAO,CAAC;IAChB,uDAAuD;IACvD,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;OAGG;IACH,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B;;;OAGG;IACH,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB;;;;;OAKG;IACH,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,uBAAuB,GAC5B,gBAAgB,CAElB;AAED,8EAA8E;AAC9E,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,YAAY,CAAC;IACrB,kEAAkE;IAClE,GAAG,EAAE,MAAM,CAAC;IACZ,sEAAsE;IACtE,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,sEAAsE;IACtE,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED;;;;;GAKG;AACH,wBAAgB,UAAU,CAAC,MAAM,EAAE,YAAY,EAAE,IAAI,EAAE,aAAa,GAAG,UAAU,CAOhF;AAED,wBAAgB,cAAc,CAC5B,MAAM,EAAE,UAAU,EAClB,IAAI,EAAE,IAAI,CAAC,uBAAuB,EAAE,QAAQ,GAAG,KAAK,GAAG,qBAAqB,GAAG,cAAc,GAAG,aAAa,CAAC,GAC7G,gBAAgB,CAoJlB;AAQD,wEAAwE;AACxE,eAAO,MAAM,aAAa,oBAAoB,CAAC;AAC/C,eAAO,MAAM,oBAAoB,kBAAkB,CAAC;AAapD,0FAA0F;AAC1F,wBAAgB,aAAa,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAIvE;AAED,gGAAgG;AAChG,wBAAgB,eAAe,CAC7B,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,MAAM,GACb;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,GAAG,IAAI,CAU9F;AAqGD,OAAO,EAAE,qBAAqB,EAAE,MAAM,aAAa,CAAC"}