ownkey 1.0.2 → 1.1.1

package/dist/commands/undo.js

@@ -1,10 +1,8 @@
 import { Command } from 'commander';
-import { BackupManager } from '../core/backup/index.js';
-import { dbClient } from '../db/client.js';
+import { BackupManager, rollbackBackup } from '../core/backup/index.js';
 import { logger } from '../utils/logger.js';
 import chalk from 'chalk';
 import inquirer from 'inquirer';
-import { localStorage } from '../storage/local.js';
 let assumeYes = false;
 /** Confirm, honouring --yes and refusing to hang when there is no terminal. */
 async function confirmOrYes(message) {
@@ -20,6 +18,7 @@ export const undoCommand = new Command('undo')
     .description('Undo a previously applied suggestion')
     .argument('[backup-id]', 'Backup ID to restore (optional)')
     .option('--list', 'List recent applies')
+    .option('--last', 'Undo the most recent apply')
     .option('--all', 'Undo all applies from today')
     .option('-y, --yes', 'Skip the confirmation prompt')
     .action(async (backupId, options) => {
@@ -36,6 +35,14 @@ export const undoCommand = new Command('undo')
             await undoAllToday(backupManager);
             return;
         }
+        if (options.last) {
+            const latest = (await backupManager.listBackups())[0];
+            if (!latest) {
+                console.log(chalk.yellow('\n  Nothing to undo.\n'));
+                return;
+            }
+            backupId = latest.id;
+        }
         // Undo specific backup
         if (backupId) {
             await undoBackup(backupManager, backupId);
@@ -98,12 +105,7 @@ async function undoBackup(backupManager, backupId) {
         return;
     }
     // Restore
-    await backupManager.restore(backupId);
-    await localStorage.clearApplied(backupId).catch(() => undefined);
-    // Update database if connected
-    if (dbClient.isConnected()) {
-        await markAsRolledBack(backupId);
-    }
+    await rollbackBackup(backupId, backupManager);
     logger.success('Files restored successfully!');
     console.log(chalk.green(`\n✓ Restored ${metadata.files.length + (metadata.created?.length ?? 0)} file(s) from backup\n`));
 }
@@ -135,11 +137,7 @@ async function undoAllToday(backupManager) {
     // Restore in reverse order (newest first)
     for (const backup of todayBackups) {
         console.log(chalk.gray(`\n  Restoring ${backup.id}...`));
-        await backupManager.restore(backup.id);
-        await localStorage.clearApplied(backup.id).catch(() => undefined);
-        if (dbClient.isConnected()) {
-            await markAsRolledBack(backup.id);
-        }
+        await rollbackBackup(backup.id, backupManager);
     }
     logger.success(`Restored ${todayBackups.length} backup(s)`);
 }
@@ -172,20 +170,6 @@ async function interactiveUndo(backupManager) {
     }
     await undoBackup(backupManager, selected);
 }
-/**
- * Mark apply as rolled back in database
- */
-async function markAsRolledBack(backupId) {
-    const sql = dbClient.getClient();
-    if (!sql) {
-        return;
-    }
-    await sql `
-        UPDATE applies
-        SET status = 'rolled_back'
-        WHERE backup_id = ${backupId}
-    `;
-}
 /**
  * Get human-readable time ago
  */

package/dist/commands/undo.js.map

@@ -1 +1 @@
-{"version":3,"file":"undo.js","sourceRoot":"","sources":["../../src/commands/undo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAEnD,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAAC,OAAe;IACvC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3G,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACzC,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,aAAa,EAAE,iCAAiC,CAAC;KAC1D,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KACvC,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;KAC9C,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;KACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QAE1C,YAAY;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YAClC,OAAO;QACX,CAAC;QAED,uBAAuB;QACvB,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QACD,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gBAAiB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,aAA4B;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACjD,OAAO;IACX,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CACP,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU,CACtF,CAAC;IACN,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,aAA4B,EAAE,QAAgB;IACpE,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAE3C,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,2BAA2B,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACX,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,sCAAsC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,UAAU;IACV,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,UAAU;IACV,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAEjE,+BAA+B;IAC/B,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;QACzB,MAAM,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IACrC,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,aAA4B;IACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;IACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAChE,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,YAAY,CAAC,MAAM,2BAA2B,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY,YAAY,CAAC,MAAM,cAAc,CAAC,CAAC;IAElF,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACvC,MAAM,YAAY,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAElE,IAAI,QAAQ,CAAC,WAAW,EAAE,EAAE,CAAC;YACzB,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QACtC,CAAC;IACL,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,YAAY,CAAC,MAAM,YAAY,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,aAA4B;IACvD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACrD,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU;QACpF,KAAK,EAAE,MAAM,CAAC,EAAE;KACnB,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACvC;YACI,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,2BAA2B;YACpC,OAAO;SACV;KACJ,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,QAAgB;IAC5C,MAAM,GAAG,GAAG,QAAQ,CAAC,SAAS,EAAE,CAAC;IACjC,IAAI,CAAC,GAAG,EAAE,CAAC;QACP,OAAO;IACX,CAAC;IAED,MAAM,GAAG,CAAA;;;4BAGe,QAAQ;KAC/B,CAAC;AACN,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAU;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,OAAO,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAC1C,OAAO,UAAU,CAAC;AACtB,CAAC"}
+{"version":3,"file":"undo.js","sourceRoot":"","sources":["../../src/commands/undo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,aAAa,EAAE,cAAc,EAAE,MAAM,yBAAyB,CAAC;AACxE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,QAAQ,MAAM,UAAU,CAAC;AAEhC,IAAI,SAAS,GAAG,KAAK,CAAC;AAEtB,+EAA+E;AAC/E,KAAK,UAAU,YAAY,CAAC,OAAe;IACvC,IAAI,SAAS;QAAE,OAAO,IAAI,CAAC;IAC3B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IACrE,CAAC;IACD,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3G,OAAO,OAAO,CAAC;AACnB,CAAC;AAED,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,OAAO,CAAC,MAAM,CAAC;KACzC,WAAW,CAAC,sCAAsC,CAAC;KACnD,QAAQ,CAAC,aAAa,EAAE,iCAAiC,CAAC;KAC1D,MAAM,CAAC,QAAQ,EAAE,qBAAqB,CAAC;KACvC,MAAM,CAAC,QAAQ,EAAE,4BAA4B,CAAC;KAC9C,MAAM,CAAC,OAAO,EAAE,6BAA6B,CAAC;KAC9C,MAAM,CAAC,WAAW,EAAE,8BAA8B,CAAC;KACnD,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,EAAE;IAChC,IAAI,CAAC;QACD,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACjC,MAAM,aAAa,GAAG,IAAI,aAAa,EAAE,CAAC;QAE1C,YAAY;QACZ,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QAED,gBAAgB;QAChB,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;YACd,MAAM,YAAY,CAAC,aAAa,CAAC,CAAC;YAClC,OAAO;QACX,CAAC;QAED,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;YACf,MAAM,MAAM,GAAG,CAAC,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,EAAE,CAAC;gBACV,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,wBAAwB,CAAC,CAAC,CAAC;gBACpD,OAAO;YACX,CAAC;YACD,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC;QACzB,CAAC;QAED,uBAAuB;QACvB,IAAI,QAAQ,EAAE,CAAC;YACX,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;YAC1C,OAAO;QACX,CAAC;QAED,mDAAmD;QACnD,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;YACvB,MAAM,iBAAiB,CAAC,aAAa,CAAC,CAAC;YACvC,OAAO;QACX,CAAC;QACD,MAAM,eAAe,CAAC,aAAa,CAAC,CAAC;IACzC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,KAAK,CAAC,gBAAiB,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;QACzD,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACzB,CAAC;AACL,CAAC,CAAC,CAAC;AAEP;;GAEG;AACH,KAAK,UAAU,iBAAiB,CAAC,aAA4B;IACzD,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wBAAwB,CAAC,CAAC,CAAC;IAElD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACjD,OAAO;IACX,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,OAAO,GAAG,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QAC7C,OAAO,CAAC,GAAG,CACP,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU,CACtF,CAAC;IACN,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,MAAM,YAAY,CAAC,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,wCAAwC,CAAC,CAAC,CAAC;AACtE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,UAAU,CAAC,aAA4B,EAAE,QAAgB;IACpE,MAAM,CAAC,IAAI,CAAC,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAE3C,sBAAsB;IACtB,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,MAAM,CAAC,KAAK,CAAC,qBAAqB,QAAQ,2BAA2B,CAAC,CAAC;QACvE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;QACrB,OAAO;IACX,CAAC;IAED,6BAA6B;IAC7B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,+BAA+B,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,OAAO,CAAC,GAAG,CAAC,uBAAuB,KAAK,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,KAAK,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,CAAC;IAC7C,CAAC;IACD,KAAK,MAAM,IAAI,IAAI,QAAQ,CAAC,OAAO,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,IAAI,sCAAsC,CAAC,CAAC,CAAC;IACjF,CAAC;IAED,UAAU;IACV,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,sBAAsB,CAAC,CAAC;IAE3D,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,UAAU;IACV,MAAM,cAAc,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IAE9C,MAAM,CAAC,OAAO,CAAC,8BAA8B,CAAC,CAAC;IAC/C,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,gBAAgB,QAAQ,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,IAAI,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC;AAC9H,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,YAAY,CAAC,aAA4B;IACpD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,KAAK,GAAG,IAAI,IAAI,EAAE,CAAC;IACzB,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAE3B,MAAM,YAAY,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE;QACtC,MAAM,UAAU,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACzC,UAAU,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QAChC,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,oCAAoC,CAAC,CAAC,CAAC;QAChE,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,YAAY,CAAC,MAAM,2BAA2B,CAAC,CAAC,CAAC;IACtF,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU,CAAC,CAAC;IAC5E,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,YAAY,YAAY,CAAC,MAAM,cAAc,CAAC,CAAC;IAElF,IAAI,CAAC,OAAO,EAAE,CAAC;QACX,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,0CAA0C;IAC1C,KAAK,MAAM,MAAM,IAAI,YAAY,EAAE,CAAC;QAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,iBAAiB,MAAM,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACzD,MAAM,cAAc,CAAC,MAAM,CAAC,EAAE,EAAE,aAAa,CAAC,CAAC;IACnD,CAAC;IAED,MAAM,CAAC,OAAO,CAAC,YAAY,YAAY,CAAC,MAAM,YAAY,CAAC,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,eAAe,CAAC,aAA4B;IACvD,MAAM,OAAO,GAAG,MAAM,aAAa,CAAC,WAAW,EAAE,CAAC;IAElD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,yBAAyB,CAAC,CAAC,CAAC;QACrD,OAAO;IACX,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,kCAAkC,CAAC,CAAC,CAAC;IAE5D,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAClD,IAAI,EAAE,GAAG,MAAM,CAAC,EAAE,MAAM,UAAU,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,MAAM,CAAC,SAAS,UAAU;QACpF,KAAK,EAAE,MAAM,CAAC,EAAE;KACnB,CAAC,CAAC,CAAC;IAEJ,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAE9D,MAAM,EAAE,QAAQ,EAAE,GAAG,MAAM,QAAQ,CAAC,MAAM,CAAC;QACvC;YACI,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,2BAA2B;YACpC,OAAO;SACV;KACJ,CAAC,CAAC;IAEH,IAAI,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,uBAAuB,CAAC,CAAC,CAAC;QACnD,OAAO;IACX,CAAC;IAED,MAAM,UAAU,CAAC,aAAa,EAAE,QAAQ,CAAC,CAAC;AAC9C,CAAC;AAED;;GAEG;AACH,SAAS,UAAU,CAAC,IAAU;IAC1B,MAAM,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;IACvB,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,GAAG,EAAE,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,EAAE,CAAC,CAAC;IAEpC,IAAI,IAAI,GAAG,CAAC;QAAE,OAAO,GAAG,IAAI,OAAO,CAAC;IACpC,IAAI,KAAK,GAAG,CAAC;QAAE,OAAO,GAAG,KAAK,OAAO,CAAC;IACtC,IAAI,OAAO,GAAG,CAAC;QAAE,OAAO,GAAG,OAAO,OAAO,CAAC;IAC1C,OAAO,UAAU,CAAC;AACtB,CAAC"}

package/dist/config/defaults.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAY,MAAM,mBAAmB,CAAC;AAErD,eAAO,MAAM,cAAc,EAAE,MAoB5B,CAAC;AAEF,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,SAAS,aAAa,CAAC;AACpC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAE/B,eAAO,MAAM,gBAAgB,UAgB5B,CAAC;AAEF,eAAO,MAAM,iBAAiB,UA8B7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,CAAC;AAE9C,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAC9C,eAAO,MAAM,oBAAoB,IAAI,CAAC"}
+{"version":3,"file":"defaults.d.ts","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAY,MAAM,mBAAmB,CAAC;AAGrD,eAAO,MAAM,cAAc,EAAE,MAoB5B,CAAC;AAEF,eAAO,MAAM,UAAU,YAAY,CAAC;AACpC,eAAO,MAAM,WAAW,gBAAgB,CAAC;AACzC,eAAO,MAAM,SAAS,aAAa,CAAC;AACpC,eAAO,MAAM,QAAQ,SAAS,CAAC;AAE/B,eAAO,MAAM,gBAAgB,UAgB5B,CAAC;AAEF,eAAO,MAAM,iBAAiB,UA8B7B,CAAC;AAEF,eAAO,MAAM,mBAAmB,QAAa,CAAC;AAE9C,eAAO,MAAM,gBAAgB,gBAAgB,CAAC;AAC9C,eAAO,MAAM,oBAAoB,IAAI,CAAC"}

package/dist/config/defaults.js

@@ -1,17 +1,18 @@
+import { DEFAULT_MODELS } from './models.js';
 export const DEFAULT_CONFIG = {
     providers: {
         openai: {
-            model: 'gpt-4-turbo',
+            model: DEFAULT_MODELS.openai,
         },
         anthropic: {
-            model: 'claude-opus-4-5-20251101',
+            model: DEFAULT_MODELS.anthropic,
         },
         gemini: {
-            model: 'gemini-2.5-pro',
+            model: DEFAULT_MODELS.gemini,
         },
         ollama: {
             endpoint: 'http://localhost:11434',
-            model: 'deepseek-coder:latest',
+            model: DEFAULT_MODELS.ollama,
         },
     },
     defaults: {

package/dist/config/defaults.js.map

@@ -1 +1 @@
-{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,cAAc,GAAW;IAClC,SAAS,EAAE;QACP,MAAM,EAAE;YACJ,KAAK,EAAE,aAAa;SACvB;QACD,SAAS,EAAE;YACP,KAAK,EAAE,0BAA0B;SACpC;QACD,MAAM,EAAE;YACJ,KAAK,EAAE,gBAAgB;SAC1B;QACD,MAAM,EAAE;YACJ,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,uBAAuB;SACjC;KACJ;IACD,QAAQ,EAAE;QACN,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,QAAoB;KACjC;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC;AACpC,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,UAAU;IACV,WAAW;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}
+{"version":3,"file":"defaults.js","sourceRoot":"","sources":["../../src/config/defaults.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,cAAc,EAAE,MAAM,aAAa,CAAC;AAE7C,MAAM,CAAC,MAAM,cAAc,GAAW;IAClC,SAAS,EAAE;QACP,MAAM,EAAE;YACJ,KAAK,EAAE,cAAc,CAAC,MAAM;SAC/B;QACD,SAAS,EAAE;YACP,KAAK,EAAE,cAAc,CAAC,SAAS;SAClC;QACD,MAAM,EAAE;YACJ,KAAK,EAAE,cAAc,CAAC,MAAM;SAC/B;QACD,MAAM,EAAE;YACJ,QAAQ,EAAE,wBAAwB;YAClC,KAAK,EAAE,cAAc,CAAC,MAAM;SAC/B;KACJ;IACD,QAAQ,EAAE;QACN,WAAW,EAAE,OAAO;QACpB,QAAQ,EAAE,QAAoB;KACjC;CACJ,CAAC;AAEF,MAAM,CAAC,MAAM,UAAU,GAAG,SAAS,CAAC;AACpC,MAAM,CAAC,MAAM,WAAW,GAAG,aAAa,CAAC;AACzC,MAAM,CAAC,MAAM,SAAS,GAAG,UAAU,CAAC;AACpC,MAAM,CAAC,MAAM,QAAQ,GAAG,MAAM,CAAC;AAE/B,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,MAAM;IACN,cAAc;IACd,MAAM;IACN,OAAO;IACP,QAAQ;IACR,KAAK;IACL,QAAQ;IACR,QAAQ;IACR,OAAO;IACP,OAAO;IACP,UAAU;IACV,MAAM;IACN,QAAQ;IACR,UAAU;IACV,WAAW;CACd,CAAC;AAEF,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,MAAM;IACN,KAAK;IACL,MAAM;IACN,KAAK;IACL,MAAM;IACN,MAAM;IACN,KAAK;IACL,QAAQ;IACR,MAAM;IACN,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;IACP,MAAM;IACN,OAAO;CACV,CAAC;AAEF,MAAM,CAAC,MAAM,mBAAmB,GAAG,GAAG,GAAG,IAAI,CAAC,CAAC,QAAQ;AAEvD,MAAM,CAAC,MAAM,gBAAgB,GAAG,aAAa,CAAC;AAC9C,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC"}

package/dist/config/keychain.d.ts

@@ -4,6 +4,11 @@ export declare class KeychainManager {
     private useKeychain;
     constructor();
     private ensureKeysDir;
+    /**
+     * Per-install random secret (32 bytes, file mode 0600) used to encrypt keys.enc.
+     * Created on first use; never leaves the machine.
+     */
+    private getMasterKey;
     setApiKey(provider: AIProvider, apiKey: string): Promise<void>;
     getApiKey(provider: AIProvider): Promise<string | null>;
     deleteApiKey(provider: AIProvider): Promise<void>;

package/dist/config/keychain.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/config/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAwB/C,qBAAa,eAAe;IACxB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAU;;YAOf,aAAa;IAOrB,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9D,SAAS,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyBvD,YAAY,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAmBzC,gBAAgB;YA0BhB,cAAc;CAK/B;AAED,eAAO,MAAM,eAAe,iBAAwB,CAAC"}
+{"version":3,"file":"keychain.d.ts","sourceRoot":"","sources":["../../src/config/keychain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AA2B/C,qBAAa,eAAe;IACxB,OAAO,CAAC,YAAY,CAAS;IAC7B,OAAO,CAAC,WAAW,CAAU;;YAOf,aAAa;IAO3B;;;OAGG;YACW,YAAY;IAYpB,SAAS,CAAC,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC;IAsB9D,SAAS,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC;IAyBvD,YAAY,CAAC,QAAQ,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC;YAmBzC,gBAAgB;YAqChB,cAAc;CAO/B;AAED,eAAO,MAAM,eAAe,iBAAwB,CAAC"}

package/dist/config/keychain.js

@@ -1,4 +1,5 @@
-import { readFile, writeFile, mkdir } from 'fs/promises';
+import { readFile, writeFile, mkdir, chmod } from 'fs/promises';
+import { randomBytes } from 'crypto';
 import { existsSync } from 'fs';
 import { join } from 'path';
 import { homedir } from 'os';
@@ -18,7 +19,9 @@ catch (error) {
     logger.verbose('Keytar not available, using encrypted file storage for API keys');
 }
 const SERVICE_NAME = 'ownkey-cli';
-const ENCRYPTION_PASSWORD = 'ownkey-local-encryption-key'; // In production, derive from machine ID
+// Keys written by OwnKey <= 1.0.2 used this fixed password. Read-only now, for one-time migration.
+const LEGACY_PASSWORD = 'ownkey-local-encryption-key';
+const MASTER_KEY_FILE = 'master.key';
 export class KeychainManager {
     keysFilePath;
     useKeychain;
@@ -29,9 +32,25 @@ export class KeychainManager {
     async ensureKeysDir() {
         const dir = join(homedir(), CONFIG_DIR);
         if (!existsSync(dir)) {
-            await mkdir(dir, { recursive: true });
+            await mkdir(dir, { recursive: true, mode: 0o700 });
         }
     }
+    /**
+     * Per-install random secret (32 bytes, file mode 0600) used to encrypt keys.enc.
+     * Created on first use; never leaves the machine.
+     */
+    async getMasterKey(create) {
+        const path = join(homedir(), CONFIG_DIR, MASTER_KEY_FILE);
+        if (existsSync(path)) {
+            return (await readFile(path, 'utf-8')).trim();
+        }
+        if (!create)
+            return null;
+        await this.ensureKeysDir();
+        const secret = randomBytes(32).toString('base64');
+        await writeFile(path, secret, { encoding: 'utf-8', mode: 0o600 });
+        return secret;
+    }
     async setApiKey(provider, apiKey) {
         const accountName = `${provider}-api-key`;
         if (this.useKeychain) {
@@ -108,20 +127,34 @@ export class KeychainManager {
             }
             return {};
         }
+        const encryptedData = await readFile(this.keysFilePath, 'utf-8');
+        const master = await this.getMasterKey(false);
+        if (master) {
+            try {
+                return JSON.parse(await Encryption.decrypt(encryptedData, master));
+            }
+            catch {
+                // fall through to legacy format
+            }
+        }
         try {
-            const encryptedData = await readFile(this.keysFilePath, 'utf-8');
-            const decrypted = await Encryption.decrypt(encryptedData, ENCRYPTION_PASSWORD);
-            return JSON.parse(decrypted);
+            const keys = JSON.parse(await Encryption.decrypt(encryptedData, LEGACY_PASSWORD));
+            // Migrate from the fixed legacy password to a per-install secret.
+            await this.saveKeysToFile(keys);
+            logger.verbose('Migrated keys file to per-install encryption');
+            return keys;
         }
-        catch (error) {
-            logger.warn('Failed to decrypt keys file, starting fresh');
+        catch {
+            logger.warn('Could not decrypt ~/.ownkey/keys.enc; run ownkey config to store your key again');
             return {};
         }
     }
     async saveKeysToFile(keys) {
-        const json = JSON.stringify(keys);
-        const encrypted = await Encryption.encrypt(json, ENCRYPTION_PASSWORD);
-        await writeFile(this.keysFilePath, encrypted, 'utf-8');
+        await this.ensureKeysDir();
+        const master = (await this.getMasterKey(true));
+        const encrypted = await Encryption.encrypt(JSON.stringify(keys), master);
+        await writeFile(this.keysFilePath, encrypted, { encoding: 'utf-8', mode: 0o600 });
+        await chmod(this.keysFilePath, 0o600).catch(() => undefined);
     }
 }
 export const keychainManager = new KeychainManager();

package/dist/config/keychain.js.map

@@ -1 +1 @@
-{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/config/keychain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtD,8DAA8D;AAC9D,0EAA0E;AAC1E,IAAI,MAAM,GAAQ,IAAI,CAAC;AACvB,IAAI,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAClC,MAAM,GAAG,GAAQ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IAChC,CAAC;AACL,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,MAAM,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,MAAM,mBAAmB,GAAG,6BAA6B,CAAC,CAAC,wCAAwC;AAEnG,MAAM,OAAO,eAAe;IAChB,YAAY,CAAS;IACrB,WAAW,CAAU;IAE7B;QACI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1C,CAAC;IACL,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAoB,EAAE,MAAc;QAChD,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,6BAA6B,CAAC,CAAC;gBAChE,OAAO;YACX,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;gBAC3E,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC7B,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QACxB,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,4BAA4B,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAoB;QAChC,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAChE,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,OAAO,CAAC,aAAa,QAAQ,+BAA+B,CAAC,CAAC;oBACrE,OAAO,GAAG,CAAC;gBACf,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBACvE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC7B,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,aAAa,QAAQ,8BAA8B,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAoB;QACnC,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBACvD,MAAM,CAAC,OAAO,CAAC,WAAW,QAAQ,+BAA+B,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,gBAAgB;YACpB,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,WAAW,QAAQ,8BAA8B,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,kCAAkC;YAClC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBAC9C,OAAO,EAAE,CAAC;gBACd,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,IAAI,CAAC;YACD,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;YACjE,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,mBAAmB,CAAC,CAAC;YAC/E,OAAO,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,6CAA6C,CAAC,CAAC;YAC3D,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAA4B;QACrD,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;QAClC,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;QACtE,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC3D,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC"}
+{"version":3,"file":"keychain.js","sourceRoot":"","sources":["../../src/config/keychain.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,QAAQ,CAAC;AACrC,OAAO,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAChC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,OAAO,EAAE,MAAM,IAAI,CAAC;AAC7B,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAC5C,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAEtD,8DAA8D;AAC9D,0EAA0E;AAC1E,IAAI,MAAM,GAAQ,IAAI,CAAC;AACvB,IAAI,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,kBAAkB,EAAE,CAAC;QAClC,MAAM,GAAG,GAAQ,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxC,MAAM,GAAG,GAAG,CAAC,OAAO,IAAI,GAAG,CAAC;IAChC,CAAC;AACL,CAAC;AAAC,OAAO,KAAK,EAAE,CAAC;IACb,MAAM,CAAC,OAAO,CAAC,iEAAiE,CAAC,CAAC;AACtF,CAAC;AAED,MAAM,YAAY,GAAG,YAAY,CAAC;AAClC,mGAAmG;AACnG,MAAM,eAAe,GAAG,6BAA6B,CAAC;AACtD,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,MAAM,OAAO,eAAe;IAChB,YAAY,CAAS;IACrB,WAAW,CAAU;IAE7B;QACI,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,WAAW,GAAG,MAAM,KAAK,IAAI,CAAC;IACvC,CAAC;IAEO,KAAK,CAAC,aAAa;QACvB,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACxC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YACnB,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;IACL,CAAC;IAED;;;OAGG;IACK,KAAK,CAAC,YAAY,CAAC,MAAe;QACtC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;QAC1D,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACnB,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,CAAC;QACD,IAAI,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QACzB,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;QAClD,MAAM,SAAS,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClE,OAAO,MAAM,CAAC;IAClB,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAoB,EAAE,MAAc;QAChD,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;gBAC5D,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,6BAA6B,CAAC,CAAC;gBAChE,OAAO;YACX,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,6DAA6D,CAAC,CAAC;gBAC3E,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC7B,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,CAAC,QAAQ,CAAC,GAAG,MAAM,CAAC;QACxB,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,UAAU,QAAQ,4BAA4B,CAAC,CAAC;IACnE,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,QAAoB;QAChC,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,WAAW,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBAChE,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,CAAC,OAAO,CAAC,aAAa,QAAQ,+BAA+B,CAAC,CAAC;oBACrE,OAAO,GAAG,CAAC;gBACf,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,yDAAyD,CAAC,CAAC;gBACvE,IAAI,CAAC,WAAW,GAAG,KAAK,CAAC;YAC7B,CAAC;QACL,CAAC;QAED,6BAA6B;QAC7B,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,IAAI,IAAI,CAAC;QACnC,IAAI,GAAG,EAAE,CAAC;YACN,MAAM,CAAC,OAAO,CAAC,aAAa,QAAQ,8BAA8B,CAAC,CAAC;QACxE,CAAC;QACD,OAAO,GAAG,CAAC;IACf,CAAC;IAED,KAAK,CAAC,YAAY,CAAC,QAAoB;QACnC,MAAM,WAAW,GAAG,GAAG,QAAQ,UAAU,CAAC;QAE1C,IAAI,IAAI,CAAC,WAAW,EAAE,CAAC;YACnB,IAAI,CAAC;gBACD,MAAM,MAAM,CAAC,cAAc,CAAC,YAAY,EAAE,WAAW,CAAC,CAAC;gBACvD,MAAM,CAAC,OAAO,CAAC,WAAW,QAAQ,+BAA+B,CAAC,CAAC;YACvE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACb,gBAAgB;YACpB,CAAC;QACL,CAAC;QAED,wBAAwB;QACxB,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC;QACtB,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;QAChC,MAAM,CAAC,OAAO,CAAC,WAAW,QAAQ,8BAA8B,CAAC,CAAC;IACtE,CAAC;IAEO,KAAK,CAAC,gBAAgB;QAC1B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;YACjC,kCAAkC;YAClC,MAAM,SAAS,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAC7D,IAAI,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;gBACxB,IAAI,CAAC;oBACD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;oBACnD,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;gBAC/B,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACb,MAAM,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;oBAC9C,OAAO,EAAE,CAAC;gBACd,CAAC;YACL,CAAC;YACD,OAAO,EAAE,CAAC;QACd,CAAC;QAED,MAAM,aAAa,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,YAAY,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,MAAM,EAAE,CAAC;YACT,IAAI,CAAC;gBACD,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,MAAM,CAAC,CAAC,CAAC;YACvE,CAAC;YAAC,MAAM,CAAC;gBACL,gCAAgC;YACpC,CAAC;QACL,CAAC;QACD,IAAI,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,UAAU,CAAC,OAAO,CAAC,aAAa,EAAE,eAAe,CAAC,CAAC,CAAC;YAClF,kEAAkE;YAClE,MAAM,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC;YAChC,MAAM,CAAC,OAAO,CAAC,8CAA8C,CAAC,CAAC;YAC/D,OAAO,IAAI,CAAC;QAChB,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,CAAC,IAAI,CAAC,iFAAiF,CAAC,CAAC;YAC/F,OAAO,EAAE,CAAC;QACd,CAAC;IACL,CAAC;IAEO,KAAK,CAAC,cAAc,CAAC,IAA4B;QACrD,MAAM,IAAI,CAAC,aAAa,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,CAAC,MAAM,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,CAAW,CAAC;QACzD,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,SAAS,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAClF,MAAM,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,CAAC;CACJ;AAED,MAAM,CAAC,MAAM,eAAe,GAAG,IAAI,eAAe,EAAE,CAAC"}

package/dist/config/models.d.ts

@@ -0,0 +1,12 @@
+import type { AIProvider } from '../types/index.js';
+/**
+ * Default model per provider. Users can set any model with `ownkey config --model`.
+ * Reviewed 2026-10: mid-tier models balance review quality and cost for bring-your-own-key use.
+ */
+export declare const DEFAULT_MODELS: Record<AIProvider, string>;
+/**
+ * OpenAI reasoning-era models (gpt-5+, o-series) reject `max_tokens` and custom `temperature`
+ * on Chat Completions.
+ */
+export declare function isOpenAIReasoningModel(model: string): boolean;
+//# sourceMappingURL=models.d.ts.map

package/dist/config/models.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.d.ts","sourceRoot":"","sources":["../../src/config/models.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,CAKrD,CAAC;AAEF;;;GAGG;AACH,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAG7D"}

package/dist/config/models.js

@@ -0,0 +1,19 @@
+/**
+ * Default model per provider. Users can set any model with `ownkey config --model`.
+ * Reviewed 2026-10: mid-tier models balance review quality and cost for bring-your-own-key use.
+ */
+export const DEFAULT_MODELS = {
+    openai: 'gpt-6.1-sol',
+    anthropic: 'claude-sonnet-5-5',
+    gemini: 'gemini-3.8-flash',
+    ollama: 'qwen2.5-coder:latest',
+};
+/**
+ * OpenAI reasoning-era models (gpt-5+, o-series) reject `max_tokens` and custom `temperature`
+ * on Chat Completions.
+ */
+export function isOpenAIReasoningModel(model) {
+    const id = model.toLowerCase().replace(/^openai\//, '');
+    return /^(gpt-([5-9]|\d{2,})|o\d)/.test(id);
+}
+//# sourceMappingURL=models.js.map

package/dist/config/models.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"models.js","sourceRoot":"","sources":["../../src/config/models.ts"],"names":[],"mappings":"AAEA;;;GAGG;AACH,MAAM,CAAC,MAAM,cAAc,GAA+B;IACtD,MAAM,EAAE,aAAa;IACrB,SAAS,EAAE,mBAAmB;IAC9B,MAAM,EAAE,kBAAkB;IAC1B,MAAM,EAAE,sBAAsB;CACjC,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAChD,MAAM,EAAE,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IACxD,OAAO,2BAA2B,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAChD,CAAC"}

package/dist/core/backup/index.d.ts

@@ -1,3 +1,4 @@
 export { BackupManager } from './manager.js';
 export type { BackupMetadata, BackupInfo } from './manager.js';
+export { rollbackBackup } from './rollback.js';
 //# sourceMappingURL=index.d.ts.map

package/dist/core/backup/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/backup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/core/backup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,YAAY,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/backup/index.js

@@ -1,2 +1,3 @@
 export { BackupManager } from './manager.js';
+export { rollbackBackup } from './rollback.js';
 //# sourceMappingURL=index.js.map

package/dist/core/backup/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/backup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/core/backup/index.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAE7C,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC"}

package/dist/core/backup/rollback.d.ts

@@ -0,0 +1,6 @@
+import { BackupManager } from './manager.js';
+/**
+ * Restore a backup and mark its suggestions as not applied (locally and in the optional database).
+ */
+export declare function rollbackBackup(backupId: string, backupManager?: BackupManager): Promise<void>;
+//# sourceMappingURL=rollback.d.ts.map

package/dist/core/backup/rollback.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.d.ts","sourceRoot":"","sources":["../../../src/core/backup/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAI7C;;GAEG;AACH,wBAAsB,cAAc,CAAC,QAAQ,EAAE,MAAM,EAAE,aAAa,GAAE,aAAmC,GAAG,OAAO,CAAC,IAAI,CAAC,CAOxH"}

package/dist/core/backup/rollback.js

@@ -0,0 +1,15 @@
+import { BackupManager } from './manager.js';
+import { localStorage } from '../../storage/local.js';
+import { dbClient } from '../../db/client.js';
+/**
+ * Restore a backup and mark its suggestions as not applied (locally and in the optional database).
+ */
+export async function rollbackBackup(backupId, backupManager = new BackupManager()) {
+    await backupManager.restore(backupId);
+    await localStorage.clearApplied(backupId).catch(() => undefined);
+    const sql = dbClient.isConnected() ? dbClient.getClient() : null;
+    if (sql) {
+        await sql `UPDATE applies SET status = 'rolled_back' WHERE backup_id = ${backupId}`.catch(() => undefined);
+    }
+}
+//# sourceMappingURL=rollback.js.map

package/dist/core/backup/rollback.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"rollback.js","sourceRoot":"","sources":["../../../src/core/backup/rollback.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAE9C;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,QAAgB,EAAE,gBAA+B,IAAI,aAAa,EAAE;IACrG,MAAM,aAAa,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjE,MAAM,GAAG,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IACjE,IAAI,GAAG,EAAE,CAAC;QACN,MAAM,GAAG,CAAA,+DAA+D,QAAQ,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9G,CAAC;AACL,CAAC"}

package/dist/core/persist.d.ts

@@ -0,0 +1,8 @@
+import { StoredSuggestion } from '../storage/local.js';
+import type { Suggestion } from '../types/index.js';
+/**
+ * Save suggestions locally (always; these IDs are what `apply` uses) and mirror them
+ * to the optional database for history.
+ */
+export declare function persistSuggestions(projectPath: string, projectName: string, suggestions: Suggestion[], runLabel: string): Promise<StoredSuggestion[]>;
+//# sourceMappingURL=persist.d.ts.map

package/dist/core/persist.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist.d.ts","sourceRoot":"","sources":["../../src/core/persist.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAErE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD;;;GAGG;AACH,wBAAsB,kBAAkB,CACpC,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,MAAM,EACnB,WAAW,EAAE,UAAU,EAAE,EACzB,QAAQ,EAAE,MAAM,GACjB,OAAO,CAAC,gBAAgB,EAAE,CAAC,CA6C7B"}

package/dist/core/persist.js

@@ -0,0 +1,56 @@
+import { dbOps } from '../db/operations.js';
+import { dbClient } from '../db/client.js';
+import { localStorage } from '../storage/local.js';
+import { logger } from '../utils/logger.js';
+/**
+ * Save suggestions locally (always; these IDs are what `apply` uses) and mirror them
+ * to the optional database for history.
+ */
+export async function persistSuggestions(projectPath, projectName, suggestions, runLabel) {
+    let localStored = [];
+    try {
+        // Re-running a review should not pile up duplicate pending suggestions: reuse a pending
+        // suggestion with the same file and change instead of storing it again.
+        const key = (s) => `${s.filePath}\u0000${(s.diff || '').trim() || s.content}`;
+        const pending = new Map((await localStorage.loadSuggestionsForProject(projectPath))
+            .filter((s) => !s.appliedAt)
+            .map((s) => [key(s), s]));
+        const fresh = suggestions.filter((s) => !pending.has(key(s)));
+        const saved = fresh.length ? await localStorage.saveSuggestions(projectPath, projectName, fresh) : [];
+        let next = 0;
+        localStored = suggestions.map((s) => pending.get(key(s)) ?? saved[next++]);
+    }
+    catch (error) {
+        logger.warn(`Failed to save suggestions locally: ${error.message}`);
+    }
+    if (dbClient.isConnected() && suggestions.length > 0) {
+        try {
+            let project = await dbOps.getProjectByPath(projectPath);
+            if (!project) {
+                project = await dbOps.createProject(projectName, projectPath);
+            }
+            if (project) {
+                const run = await dbOps.createRun(project.id, runLabel);
+                for (let i = 0; i < suggestions.length; i++) {
+                    if (localStored[i]?.dbId)
+                        continue; // already mirrored on an earlier run
+                    const stored = await dbOps.createSuggestion(project.id, suggestions[i]);
+                    if (stored && run)
+                        await dbOps.linkRunSuggestion(run.id, stored.id);
+                    if (stored && localStored[i]) {
+                        await localStorage.updateSuggestion(localStored[i].id, { dbId: stored.id });
+                    }
+                }
+                if (run) {
+                    await dbOps.updateRunStatus(run.id, 'completed', `Generated ${suggestions.length} suggestions`);
+                }
+                logger.verbose('Saved suggestions to database');
+            }
+        }
+        catch (error) {
+            logger.warn(`Database save failed (${error.message}); suggestions are saved locally.`);
+        }
+    }
+    return localStored;
+}
+//# sourceMappingURL=persist.js.map

package/dist/core/persist.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"persist.js","sourceRoot":"","sources":["../../src/core/persist.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,qBAAqB,CAAC;AAC5C,OAAO,EAAE,QAAQ,EAAE,MAAM,iBAAiB,CAAC;AAC3C,OAAO,EAAE,YAAY,EAAoB,MAAM,qBAAqB,CAAC;AACrE,OAAO,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAG5C;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,WAAmB,EACnB,WAAmB,EACnB,WAAyB,EACzB,QAAgB;IAEhB,IAAI,WAAW,GAAuB,EAAE,CAAC;IACzC,IAAI,CAAC;QACD,wFAAwF;QACxF,wEAAwE;QACxE,MAAM,GAAG,GAAG,CAAC,CAAa,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,OAAO,EAAE,CAAC;QAC1F,MAAM,OAAO,GAAG,IAAI,GAAG,CACnB,CAAC,MAAM,YAAY,CAAC,yBAAyB,CAAC,WAAW,CAAC,CAAC;aACtD,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;aAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAU,CAAC,CACxC,CAAC;QACF,MAAM,KAAK,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC9D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,eAAe,CAAC,WAAW,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtG,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,WAAW,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC/E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,MAAM,CAAC,IAAI,CAAC,uCAAwC,KAAe,CAAC,OAAO,EAAE,CAAC,CAAC;IACnF,CAAC;IAED,IAAI,QAAQ,CAAC,WAAW,EAAE,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACnD,IAAI,CAAC;YACD,IAAI,OAAO,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC;YACxD,IAAI,CAAC,OAAO,EAAE,CAAC;gBACX,OAAO,GAAG,MAAM,KAAK,CAAC,aAAa,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;YAClE,CAAC;YACD,IAAI,OAAO,EAAE,CAAC;gBACV,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;gBACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,WAAW,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;oBAC1C,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,IAAI;wBAAE,SAAS,CAAC,qCAAqC;oBACzE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC,EAAE,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC;oBACxE,IAAI,MAAM,IAAI,GAAG;wBAAE,MAAM,KAAK,CAAC,iBAAiB,CAAC,GAAG,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;oBACpE,IAAI,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC;wBAC3B,MAAM,YAAY,CAAC,gBAAgB,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC;oBAChF,CAAC;gBACL,CAAC;gBACD,IAAI,GAAG,EAAE,CAAC;oBACN,MAAM,KAAK,CAAC,eAAe,CAAC,GAAG,CAAC,EAAE,EAAE,WAAW,EAAE,aAAa,WAAW,CAAC,MAAM,cAAc,CAAC,CAAC;gBACpG,CAAC;gBACD,MAAM,CAAC,OAAO,CAAC,+BAA+B,CAAC,CAAC;YACpD,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACb,MAAM,CAAC,IAAI,CAAC,yBAA0B,KAAe,CAAC,OAAO,mCAAmC,CAAC,CAAC;QACtG,CAAC;IACL,CAAC;IACD,OAAO,WAAW,CAAC;AACvB,CAAC"}

package/dist/core/review/git.d.ts

@@ -0,0 +1,33 @@
+export type ReviewScope = {
+    kind: 'staged';
+} | {
+    kind: 'working';
+} | {
+    kind: 'base';
+    ref: string;
+    mergeBase: string;
+};
+export interface ChangeSet {
+    root: string;
+    scope: ReviewScope;
+    /** Changed files (added, copied, modified, renamed), relative to the repo root */
+    files: string[];
+    /** Unified diff of those files, used as review focus for the model */
+    patch: string;
+    /** Changed line ranges per file in the new version, for SARIF/inline locations */
+    changedLines: Map<string, Array<[number, number]>>;
+}
+export declare function gitRoot(cwd: string): string;
+/**
+ * Resolve what to review. Default: staged changes if any, otherwise uncommitted changes against HEAD.
+ */
+export declare function resolveScope(root: string, opts: {
+    staged?: boolean;
+    base?: string;
+}): ReviewScope;
+export declare function collectChanges(root: string, scope: ReviewScope): ChangeSet;
+/** Content of a file as it will be committed (index for staged reviews, working tree otherwise). */
+export declare function readForReview(root: string, scope: ReviewScope, file: string): string;
+export declare function describeScope(scope: ReviewScope): string;
+export declare function parseChangedLines(patch: string): Map<string, Array<[number, number]>>;
+//# sourceMappingURL=git.d.ts.map

package/dist/core/review/git.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.d.ts","sourceRoot":"","sources":["../../../src/core/review/git.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,WAAW,GACjB;IAAE,IAAI,EAAE,QAAQ,CAAA;CAAE,GAClB;IAAE,IAAI,EAAE,SAAS,CAAA;CAAE,GACnB;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAAC;AAEvD,MAAM,WAAW,SAAS;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,WAAW,CAAC;IACnB,kFAAkF;IAClF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAC;IACd,kFAAkF;IAClF,YAAY,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;CACtD;AAMD,wBAAgB,OAAO,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAM3C;AAaD;;GAEG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,WAAW,CAajG;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,GAAG,SAAS,CAO1E;AAED,oGAAoG;AACpG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAGpF;AAED,wBAAgB,aAAa,CAAC,KAAK,EAAE,WAAW,GAAG,MAAM,CASxD;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAkBrF"}

package/dist/core/review/git.js

@@ -0,0 +1,89 @@
+import { execFileSync } from 'child_process';
+import { readFileSync } from 'fs';
+import { join } from 'path';
+function git(cwd, args) {
+    return execFileSync('git', args, { cwd, encoding: 'utf-8', maxBuffer: 64 * 1024 * 1024, stdio: ['ignore', 'pipe', 'pipe'] });
+}
+export function gitRoot(cwd) {
+    try {
+        return git(cwd, ['rev-parse', '--show-toplevel']).trim();
+    }
+    catch {
+        throw new Error('Not a git repository. `ownkey review` reviews git changes; use `ownkey suggest` for any folder.');
+    }
+}
+function diffArgs(scope) {
+    switch (scope.kind) {
+        case 'staged':
+            return ['--cached'];
+        case 'working':
+            return ['HEAD'];
+        case 'base':
+            return [scope.mergeBase];
+    }
+}
+/**
+ * Resolve what to review. Default: staged changes if any, otherwise uncommitted changes against HEAD.
+ */
+export function resolveScope(root, opts) {
+    if (opts.base) {
+        let mergeBase;
+        try {
+            mergeBase = git(root, ['merge-base', opts.base, 'HEAD']).trim();
+        }
+        catch {
+            throw new Error(`Cannot find a merge base with "${opts.base}". Fetch it first (git fetch origin) or check the name.`);
+        }
+        return { kind: 'base', ref: opts.base, mergeBase };
+    }
+    if (opts.staged)
+        return { kind: 'staged' };
+    const staged = git(root, ['diff', '--cached', '--name-only']).trim();
+    return staged ? { kind: 'staged' } : { kind: 'working' };
+}
+export function collectChanges(root, scope) {
+    const args = diffArgs(scope);
+    const files = git(root, ['diff', ...args, '--name-only', '--diff-filter=ACMR', '-z'])
+        .split('\0')
+        .filter(Boolean);
+    const patch = files.length ? git(root, ['diff', ...args, '--diff-filter=ACMR', '--unified=3', '--no-color', '--', ...files]) : '';
+    return { root, scope, files, patch, changedLines: parseChangedLines(patch) };
+}
+/** Content of a file as it will be committed (index for staged reviews, working tree otherwise). */
+export function readForReview(root, scope, file) {
+    if (scope.kind === 'staged')
+        return git(root, ['show', `:${file}`]);
+    return readFileSync(join(root, file), 'utf-8');
+}
+export function describeScope(scope) {
+    switch (scope.kind) {
+        case 'staged':
+            return 'staged changes';
+        case 'working':
+            return 'uncommitted changes';
+        case 'base':
+            return `changes since ${scope.ref} (${scope.mergeBase.slice(0, 7)})`;
+    }
+}
+export function parseChangedLines(patch) {
+    const out = new Map();
+    let current = null;
+    for (const line of patch.split('\n')) {
+        if (line.startsWith('+++ ')) {
+            const p = line.slice(4).trim();
+            current = p === '/dev/null' ? null : p.replace(/^b\//, '');
+            if (current && !out.has(current))
+                out.set(current, []);
+            continue;
+        }
+        const m = /^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/.exec(line);
+        if (m && current) {
+            const start = parseInt(m[1], 10);
+            const count = m[2] === undefined ? 1 : parseInt(m[2], 10);
+            if (count > 0)
+                out.get(current).push([start, start + count - 1]);
+        }
+    }
+    return out;
+}
+//# sourceMappingURL=git.js.map

package/dist/core/review/git.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git.js","sourceRoot":"","sources":["../../../src/core/review/git.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,MAAM,IAAI,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAkB5B,SAAS,GAAG,CAAC,GAAW,EAAE,IAAc;IACpC,OAAO,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC,CAAC;AACjI,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,GAAW;IAC/B,IAAI,CAAC;QACD,OAAO,GAAG,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,KAAK,CAAC,iGAAiG,CAAC,CAAC;IACvH,CAAC;AACL,CAAC;AAED,SAAS,QAAQ,CAAC,KAAkB;IAChC,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACT,OAAO,CAAC,UAAU,CAAC,CAAC;QACxB,KAAK,SAAS;YACV,OAAO,CAAC,MAAM,CAAC,CAAC;QACpB,KAAK,MAAM;YACP,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACjC,CAAC;AACL,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,IAAyC;IAChF,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QACZ,IAAI,SAAiB,CAAC;QACtB,IAAI,CAAC;YACD,SAAS,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,YAAY,EAAE,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACL,MAAM,IAAI,KAAK,CAAC,kCAAkC,IAAI,CAAC,IAAI,yDAAyD,CAAC,CAAC;QAC1H,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,CAAC;IACvD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IAC3C,MAAM,MAAM,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,UAAU,EAAE,aAAa,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACrE,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,KAAkB;IAC3D,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7B,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,aAAa,EAAE,oBAAoB,EAAE,IAAI,CAAC,CAAC;SAChF,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,OAAO,CAAC,CAAC;IACrB,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,GAAG,IAAI,EAAE,oBAAoB,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClI,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;AACjF,CAAC;AAED,oGAAoG;AACpG,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,KAAkB,EAAE,IAAY;IACxE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC;IACpE,OAAO,YAAY,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;AACnD,CAAC;AAED,MAAM,UAAU,aAAa,CAAC,KAAkB;IAC5C,QAAQ,KAAK,CAAC,IAAI,EAAE,CAAC;QACjB,KAAK,QAAQ;YACT,OAAO,gBAAgB,CAAC;QAC5B,KAAK,SAAS;YACV,OAAO,qBAAqB,CAAC;QACjC,KAAK,MAAM;YACP,OAAO,iBAAiB,KAAK,CAAC,GAAG,KAAK,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC;IAC7E,CAAC;AACL,CAAC;AAED,MAAM,UAAU,iBAAiB,CAAC,KAAa;IAC3C,MAAM,GAAG,GAAG,IAAI,GAAG,EAAmC,CAAC;IACvD,IAAI,OAAO,GAAkB,IAAI,CAAC;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACnC,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YAC1B,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAC/B,OAAO,GAAG,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;YAC3D,IAAI,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACvD,SAAS;QACb,CAAC;QACD,MAAM,CAAC,GAAG,yCAAyC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC/D,IAAI,CAAC,IAAI,OAAO,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YACjC,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;YAC1D,IAAI,KAAK,GAAG,CAAC;gBAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,KAAK,GAAG,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC;QACtE,CAAC;IACL,CAAC;IACD,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/core/review/report.d.ts

@@ -0,0 +1,16 @@
+import type { Suggestion } from '../../types/index.js';
+export interface Finding extends Suggestion {
+    id?: string;
+    line: number;
+}
+/**
+ * Best line to anchor a finding on: the first added line of its diff, else the first
+ * changed line of its file in the review, else line 1.
+ */
+export declare function anchorLine(s: Suggestion, changed?: Array<[number, number]>): number;
+export declare function sortFindings(findings: Finding[]): Finding[];
+/** SARIF 2.1.0, accepted by GitHub code scanning (github/codeql-action/upload-sarif). */
+export declare function toSarif(findings: Finding[], version: string): object;
+/** Markdown summary suitable for a PR comment or job summary. */
+export declare function toMarkdown(findings: Finding[], scopeLabel: string, model: string): string;
+//# sourceMappingURL=report.d.ts.map

package/dist/core/review/report.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"report.d.ts","sourceRoot":"","sources":["../../../src/core/review/report.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAY,UAAU,EAAE,MAAM,sBAAsB,CAAC;AAEjE,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACvC,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CAChB;AAID;;;GAGG;AACH,wBAAgB,UAAU,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAgBnF;AAED,wBAAgB,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,GAAG,OAAO,EAAE,CAO3D;AAQD,yFAAyF;AACzF,wBAAgB,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAoCpE;AAED,iEAAiE;AACjE,wBAAgB,UAAU,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CA0BzF"}