project-athena 0.2.0 → 0.3.0

package/dist/chunk-GHFRQAYT.js

@@ -0,0 +1,112 @@
+#!/usr/bin/env node
+import {
+  readTextIfExists
+} from "./chunk-IQQBAWSM.js";
+
+// src/agents/common/hooks.ts
+import { promises as fs } from "fs";
+import path from "path";
+var ATHENA_MARK = "--athena-hook";
+function hookCommand() {
+  return process.env.ATHENA_HOOK_COMMAND?.trim() || "athena";
+}
+function hookArgs(agent, hook) {
+  return ["event", ATHENA_MARK, "--agent", agent, "--hook", hook];
+}
+async function readJsonFile(file) {
+  const text = await readTextIfExists(file);
+  if (text === null) return { data: {}, existed: false, malformed: false };
+  try {
+    const parsed = JSON.parse(text);
+    if (parsed && typeof parsed === "object" && !Array.isArray(parsed)) return { data: parsed, existed: true, malformed: false };
+    return { data: {}, existed: true, malformed: true };
+  } catch {
+    return { data: {}, existed: true, malformed: true };
+  }
+}
+function isAthenaEntry(entry) {
+  return JSON.stringify(entry ?? "").includes(ATHENA_MARK);
+}
+async function planJsonChange(root, rel, mutate) {
+  const file = path.join(root, rel);
+  const { data, existed, malformed } = await readJsonFile(file);
+  if (malformed) throw new Error(`${rel} is not valid JSON \u2014 fix it before configuring hooks`);
+  const before = JSON.stringify(data);
+  mutate(data);
+  const content = `${JSON.stringify(data, null, 2)}
+`;
+  return { path: rel, ownership: "block", action: !existed ? "create" : JSON.stringify(data) === before ? "unchanged" : "update", content };
+}
+async function removeJsonHooks(root, rel, strip, isEmpty) {
+  const file = path.join(root, rel);
+  const { data, existed, malformed } = await readJsonFile(file);
+  if (!existed || malformed) return false;
+  const before = JSON.stringify(data);
+  strip(data);
+  if (JSON.stringify(data) === before) return false;
+  if (isEmpty(data)) await fs.rm(file, { force: true });
+  else await fs.writeFile(file, `${JSON.stringify(data, null, 2)}
+`, "utf8");
+  return true;
+}
+function pruneEmpty(record, key) {
+  const value = record[key];
+  if (value && typeof value === "object" && !Array.isArray(value) && Object.keys(value).length === 0) delete record[key];
+  if (Array.isArray(value) && value.length === 0) delete record[key];
+}
+var SAFE_WORD = /^[A-Za-z0-9_@%+=:,./-]+$/;
+function shQuote(value) {
+  if (value.includes("\0")) throw new Error("Hook command contains a NUL byte");
+  if (value && SAFE_WORD.test(value)) return value;
+  return `'${value.replace(/'/g, `'\\''`)}'`;
+}
+function cmdQuote(value) {
+  if (/["\r\n\0]/.test(value)) throw new Error(`Hook command cannot be quoted safely for cmd.exe: ${JSON.stringify(value)}`);
+  const escaped = value.replace(/%/g, "%%");
+  if (value && /^[A-Za-z0-9_@+=:,./\\-]+$/.test(value)) return escaped;
+  return `"${escaped}"`;
+}
+function hookScript(agent, platform = process.platform) {
+  const command = hookCommand();
+  if (platform === "win32") {
+    return {
+      file: "athena-hook.cmd",
+      content: ["@echo off", "rem Generated by Athena: forwards agent hook payloads to `athena event`.", `${cmdQuote(command)} event ${ATHENA_MARK} --agent ${cmdQuote(agent)} --hook "%~1"`, "exit /b 0", ""].join("\r\n"),
+      mode: 420
+    };
+  }
+  return {
+    file: "athena-hook.sh",
+    content: ["#!/bin/sh", "# Generated by Athena: forwards agent hook payloads to `athena event`.", `exec ${shQuote(command)} event ${ATHENA_MARK} --agent ${shQuote(agent)} --hook "$1"`, ""].join("\n"),
+    mode: 493
+  };
+}
+function athenaMcpEntry() {
+  return { command: hookCommand(), args: ["mcp"] };
+}
+function mergeMcpServers(data) {
+  const servers = data.mcpServers && typeof data.mcpServers === "object" && !Array.isArray(data.mcpServers) ? data.mcpServers : {};
+  servers.athena = athenaMcpEntry();
+  data.mcpServers = servers;
+}
+function stripMcpServers(data) {
+  const servers = data.mcpServers;
+  if (!servers) return;
+  delete servers.athena;
+  pruneEmpty(data, "mcpServers");
+}
+
+export {
+  ATHENA_MARK,
+  hookCommand,
+  hookArgs,
+  readJsonFile,
+  isAthenaEntry,
+  planJsonChange,
+  removeJsonHooks,
+  pruneEmpty,
+  hookScript,
+  mergeMcpServers,
+  stripMcpServers
+};
+//# sourceMappingURL=chunk-GHFRQAYT.js.map

package/dist/chunk-GR4DL2VM.js

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+import {
+  API_SURFACE_PATH,
+  AUTH_PATH,
+  SCHEMA_RELATED_PATH,
+  TEST_FILE,
+  TEST_RUNNER_CONFIG
+} from "./chunk-ELKFRTZT.js";
+
+// src/core/impact/impact.ts
+var TESTS = new RegExp(`${TEST_FILE.source}|${TEST_RUNNER_CONFIG.source}`);
+var RULES = [
+  { match: /(^|\/)(package\.json|pyproject\.toml|requirements[^/]*\.txt|Pipfile|go\.mod|Cargo\.toml|pom\.xml|build\.gradle(\.kts)?|composer\.json|Gemfile|pubspec\.yaml|mix\.exs|[^/]+\.csproj)$/, docs: ["project", "architecture", "security", "testing"], reason: "dependency manifest" },
+  { match: /(^|\/)(package-lock\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|poetry\.lock|uv\.lock|Cargo\.lock|go\.sum|composer\.lock|Gemfile\.lock)$/, docs: ["project", "security"], reason: "lockfile" },
+  { match: /(^|\/)(pnpm-workspace\.yaml|turbo\.json|nx\.json|lerna\.json|go\.work|settings\.gradle(\.kts)?)$/, docs: ["project", "architecture"], reason: "workspace configuration" },
+  { match: SCHEMA_RELATED_PATH, docs: ["database", "performance", "code-review"], reason: "schema / migration" },
+  { match: API_SURFACE_PATH, docs: ["api", "security", "testing"], reason: "API surface" },
+  { match: AUTH_PATH, docs: ["auth", "security"], reason: "auth-related" },
+  { match: /(^|\/)(Dockerfile|Containerfile)[^/]*$|(^|\/)(docker-)?compose[^/]*\.ya?ml$/i, docs: ["deployment", "architecture", "security"], reason: "container configuration" },
+  { match: /^\.github\/workflows\/|(^|\/)(\.gitlab-ci\.yml|Jenkinsfile|azure-pipelines\.ya?ml|bitbucket-pipelines\.yml)$|^\.circleci\//, docs: ["deployment", "testing"], reason: "CI/CD" },
+  { match: /\.tf$|(^|\/)(vercel\.json|netlify\.toml|fly\.toml|render\.ya?ml|railway\.(json|toml)|Procfile|wrangler\.(toml|jsonc?)|serverless\.ya?ml|Chart\.yaml|kustomization\.ya?ml)$|(^|\/)(k8s|kubernetes|helm|deploy|infra)\//, docs: ["deployment", "architecture"], reason: "infrastructure" },
+  { match: /(^|\/)\.env\.(example|sample|template)$/, docs: ["deployment", "project"], reason: "environment template" },
+  { match: TESTS, docs: ["testing"], reason: "tests" },
+  { match: /(cache|redis|queue|worker|jobs?)\b/i, docs: ["performance"], reason: "caching / background work" },
+  { match: /(^|\/)(Makefile|justfile|Taskfile\.ya?ml)$/, docs: ["project", "debugging"], reason: "task runner" }
+];
+function impactOf(paths, opts = {}) {
+  const docs = /* @__PURE__ */ new Set();
+  const reasons = {};
+  const note = (doc, why) => {
+    docs.add(doc);
+    reasons[doc] ??= [];
+    if (!reasons[doc].includes(why)) reasons[doc].push(why);
+  };
+  for (const p of paths) {
+    if (p.startsWith(".athena/")) continue;
+    for (const r of RULES) if (r.match.test(p)) for (const d of r.docs) note(d, r.reason);
+  }
+  if (opts.structural?.some((p) => !p.startsWith(".athena/"))) note("project", "files added or removed");
+  const order = ["project", "architecture", "database", "api", "auth", "security", "testing", "debugging", "performance", "code-review", "deployment", "rules"];
+  return { docs: [...docs].sort((a, b) => order.indexOf(a) - order.indexOf(b)), reasons };
+}
+
+export {
+  impactOf
+};
+//# sourceMappingURL=chunk-GR4DL2VM.js.map

package/dist/chunk-INT3IGMQ.js

@@ -0,0 +1,111 @@
+#!/usr/bin/env node
+
+// src/agents/common/hook-events.ts
+import crypto from "crypto";
+var TEST_COMMAND = /\b(test|vitest|jest|pytest|go test|cargo test|mocha|rspec|phpunit|gradle test|mvn test|tox|playwright|cypress)\b/i;
+var REVIEW_COMMAND = /\b(lint|eslint|ruff|clippy|tsc|typecheck|type-check|mypy|flake8|rubocop|golangci-lint|audit)\b/i;
+var READ_TOOLS = /* @__PURE__ */ new Set(["read", "glob", "grep", "notebookread", "webfetch", "websearch", "ls", "searchreplace", "read_file", "read_many_files", "list_directory", "grep_search", "web_fetch", "google_web_search"]);
+var EDIT_TOOLS = /* @__PURE__ */ new Set(["edit", "write", "multiedit", "notebookedit", "applypatch", "apply_patch", "create_diff", "str_replace", "write_file", "replace"]);
+var SEARCH_TOOLS = /* @__PURE__ */ new Set(["grep", "glob", "grep_search"]);
+function truncate(s, n = 160) {
+  const one = s.replace(/\s+/g, " ").trim();
+  return one.length > n ? `${one.slice(0, n - 1)}\u2026` : one;
+}
+function asString(v) {
+  return typeof v === "string" && v.trim() ? v : null;
+}
+function filesFrom(input, payload) {
+  const out = [];
+  for (const source of [input, payload]) {
+    if (!source) continue;
+    for (const key of ["file_path", "filePath", "path", "notebook_path", "target_file"]) {
+      const v = asString(source[key]);
+      if (v) out.push(v);
+    }
+    const edits = source.edits;
+    if (Array.isArray(edits)) {
+      for (const e of edits) {
+        const v = e && typeof e === "object" ? asString(e.file_path) : null;
+        if (v) out.push(v);
+      }
+    }
+  }
+  return [...new Set(out)];
+}
+function patchFiles(patch) {
+  const out = [];
+  for (const m of patch.matchAll(/^\*\*\* (?:Add|Update|Delete) File: (.+)$|^\*\*\* Move to: (.+)$/gm)) {
+    const f = (m[1] ?? m[2]).trim();
+    if (f) out.push(f);
+  }
+  return [...new Set(out)];
+}
+function classifyTool(tool, command, files) {
+  const t = tool.toLowerCase().replace(/^mcp__/, "");
+  const where = files.length ? ` ${files.slice(0, 2).join(", ")}${files.length > 2 ? ` +${files.length - 2}` : ""}` : "";
+  if (EDIT_TOOLS.has(t)) return { kind: "edit", state: "CODING", message: `Editing${where || " files"}` };
+  if (READ_TOOLS.has(t)) return { kind: SEARCH_TOOLS.has(t) ? "search" : "read", state: "ANALYZING", message: `Reading${where || ` (${tool})`}` };
+  if (t === "bash" || t === "shell" || t === "powershell" || t === "run_shell_command" || t.includes("terminal")) {
+    if (command && TEST_COMMAND.test(command)) return { kind: "command", state: "TESTING", message: `Running tests: ${command}` };
+    if (command && REVIEW_COMMAND.test(command)) return { kind: "command", state: "REVIEWING", message: `Running checks: ${command}` };
+    return { kind: "command", state: "CODING", message: command ? `Running: ${command}` : "Running a shell command" };
+  }
+  if (t === "task" || t === "agent") return { kind: "subagent", state: "PLANNING", message: "Delegating to a subagent" };
+  if (t === "todowrite" || t === "exitplanmode" || t === "plan" || t === "update_plan" || t === "write_todos" || t === "enter_plan_mode" || t === "exit_plan_mode") return { kind: "tool", state: "PLANNING", message: "Updating its plan" };
+  return { kind: "tool", state: "CODING", message: `Using ${tool}` };
+}
+function normalizeHookEvent(agent, hookName, payload) {
+  const hook = hookName || asString(payload.hook_event_name) || "unknown";
+  const h = hook.toLowerCase();
+  const session = asString(payload.session_id) ?? asString(payload.conversation_id) ?? null;
+  const toolInput = payload.tool_input && typeof payload.tool_input === "object" ? payload.tool_input : null;
+  const tool = asString(payload.tool_name) ?? asString(payload.tool) ?? null;
+  const isPatch = tool?.toLowerCase() === "apply_patch";
+  const rawCommand = asString(toolInput?.command) ?? asString(payload.command);
+  const command = rawCommand && !isPatch ? truncate(rawCommand) : null;
+  const files = isPatch && rawCommand ? patchFiles(rawCommand) : filesFrom(toolInput, payload);
+  let c = null;
+  if (h === "sessionstart" || h === "workspaceopen") c = { kind: "session-start", state: "IDLE", message: "Session started" };
+  else if (h === "sessionend") c = { kind: "session-end", state: "IDLE", message: "Session ended" };
+  else if (h === "userpromptsubmit" || h === "beforesubmitprompt" || h === "beforeagent") c = { kind: "prompt", state: "PLANNING", message: "Received a new task from the developer" };
+  else if (h === "stop" || h === "afteragentresponse" || h === "afteragent") c = { kind: "stop", state: "SUCCESS", message: "Finished responding" };
+  else if (h === "subagentstart") c = { kind: "subagent", state: "PLANNING", message: "Subagent started" };
+  else if (h === "subagentstop") c = { kind: "subagent", state: "CODING", message: "Subagent finished" };
+  else if (h === "beforeshellexecution") c = classifyTool("bash", command, files);
+  else if (h === "aftershellexecution") return null;
+  else if (h === "beforereadfile" || h === "beforetabfileread") c = classifyTool("read", null, files);
+  else if (h === "afterfileedit" || h === "aftertabfileedit") c = classifyTool("edit", null, files);
+  else if (h === "pretooluse" || h === "permissionrequest" || h === "beforetool") c = tool ? classifyTool(tool, command, files) : null;
+  else if (h === "posttooluse" || h === "posttoolusefailure" || h === "aftertool") return null;
+  else if (h === "pretoolusefailure") return null;
+  else c = { kind: "other", state: "CODING", message: `Hook: ${hook}` };
+  if (!c) return null;
+  return {
+    id: crypto.randomUUID(),
+    ts: (/* @__PURE__ */ new Date()).toISOString(),
+    agent,
+    session,
+    hook,
+    kind: c.kind,
+    state: c.state,
+    message: c.message,
+    files: files.slice(0, 10),
+    command,
+    tool
+  };
+}
+var CLAUDE_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "Stop", "SessionEnd"];
+var CODEX_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "Stop", "SessionEnd"];
+var CURSOR_HOOK_EVENTS = ["sessionStart", "beforeSubmitPrompt", "beforeShellExecution", "afterFileEdit", "stop", "sessionEnd"];
+var COPILOT_HOOK_EVENTS = ["SessionStart", "UserPromptSubmit", "PreToolUse", "Stop"];
+var GEMINI_HOOK_EVENTS = ["SessionStart", "BeforeAgent", "BeforeTool", "AfterAgent", "SessionEnd"];
+
+export {
+  normalizeHookEvent,
+  CLAUDE_HOOK_EVENTS,
+  CODEX_HOOK_EVENTS,
+  CURSOR_HOOK_EVENTS,
+  COPILOT_HOOK_EVENTS,
+  GEMINI_HOOK_EVENTS
+};
+//# sourceMappingURL=chunk-INT3IGMQ.js.map

package/dist/chunk-IQQBAWSM.js

@@ -0,0 +1,90 @@
+#!/usr/bin/env node
+
+// src/core/util/fs.ts
+import { promises as fs } from "fs";
+import path from "path";
+import crypto from "crypto";
+async function writeFileAtomic(file, data) {
+  await fs.mkdir(path.dirname(file), { recursive: true });
+  const tmp = `${file}.${process.pid}.${crypto.randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await fs.writeFile(tmp, data, "utf8");
+    await fs.rename(tmp, file);
+  } catch (err) {
+    await fs.rm(tmp, { force: true }).catch(() => {
+    });
+    throw err;
+  }
+}
+async function exists(p) {
+  try {
+    await fs.access(p);
+    return true;
+  } catch {
+    return false;
+  }
+}
+async function readTextIfExists(p) {
+  try {
+    return await fs.readFile(p, "utf8");
+  } catch (err) {
+    if (err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+function sha256(data) {
+  return crypto.createHash("sha256").update(data).digest("hex");
+}
+async function readTextInsideRoot(root, rel, maxBytes) {
+  const abs = path.resolve(root, rel);
+  let realRoot;
+  try {
+    realRoot = await fs.realpath(root);
+  } catch {
+    return { ok: false, reason: "unreadable" };
+  }
+  const inside = (p) => {
+    const r = path.relative(realRoot, p);
+    return r === "" || !r.startsWith(`..${path.sep}`) && r !== ".." && !path.isAbsolute(r);
+  };
+  let target = abs;
+  try {
+    const st = await fs.lstat(abs);
+    if (st.isSymbolicLink() || !inside(await fs.realpath(path.dirname(abs)))) {
+      target = await fs.realpath(abs);
+      if (!inside(target)) return { ok: false, reason: "outside-root" };
+    }
+  } catch (err) {
+    return { ok: false, reason: err.code === "ENOENT" ? "missing" : "unreadable" };
+  }
+  let handle;
+  try {
+    handle = await fs.open(target, "r");
+    const st = await handle.stat();
+    if (!st.isFile()) return { ok: false, reason: "not-a-file" };
+    if (st.size > maxBytes) return { ok: false, reason: "too-large", bytes: st.size };
+    const buf = Buffer.alloc(maxBytes + 1);
+    let n = 0;
+    while (n < buf.length) {
+      const { bytesRead } = await handle.read(buf, n, buf.length - n, n);
+      if (!bytesRead) break;
+      n += bytesRead;
+    }
+    if (n > maxBytes) return { ok: false, reason: "too-large", bytes: n };
+    return { ok: true, text: buf.subarray(0, n).toString("utf8"), bytes: n };
+  } catch (err) {
+    return { ok: false, reason: err.code === "ENOENT" ? "missing" : "unreadable" };
+  } finally {
+    await handle?.close().catch(() => {
+    });
+  }
+}
+
+export {
+  writeFileAtomic,
+  exists,
+  readTextIfExists,
+  sha256,
+  readTextInsideRoot
+};
+//# sourceMappingURL=chunk-IQQBAWSM.js.map

package/dist/chunk-JCGDR4UV.js

@@ -0,0 +1,182 @@
+#!/usr/bin/env node
+
+// src/core/security/secrets.ts
+import crypto from "crypto";
+var MAX_GENERIC_LINE = 4096;
+var PRIVATE_KEY_WINDOW = 16 * 1024;
+var IDENTIFIER_LOOKBACK = 64;
+var PEM_LABEL = "(?:RSA |EC |DSA |OPENSSH |PGP |ENCRYPTED )?PRIVATE KEY(?: BLOCK)?-----";
+var PEM_BEGIN = new RegExp(`-----BEGIN ${PEM_LABEL}`, "g");
+var PEM_END = new RegExp(`-----END ${PEM_LABEL}`, "g");
+var GENERIC_KEYWORD = /password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|auth[_-]?key|client[_-]?secret|private[_-]?key/i;
+var ENV_KEYWORD = /PASSWORD|SECRET|TOKEN|API_KEY|APIKEY|ACCESS_KEY|PRIVATE_KEY|CLIENT_SECRET/;
+var SECRET_PATTERNS = [
+  // Matched in two steps (see matchPrivateKeys): this regex only finds the BEGIN header.
+  { id: "private-key", description: "Private key block", regex: PEM_BEGIN },
+  { id: "aws-access-key-id", description: "AWS access key ID", regex: /\b((?:AKIA|ASIA|ABIA|ACCA)[0-9A-Z]{16})\b/g, group: 1 },
+  { id: "aws-secret-access-key", description: "AWS secret access key", regex: /aws_?secret_?access_?key["']?[ \t]*[:=][ \t]*["']?([A-Za-z0-9/+=]{40})\b/gi, group: 1 },
+  { id: "gcp-service-account", description: "GCP service account private key", regex: /"private_key"[ \t]*:[ \t]*"(-----BEGIN PRIVATE KEY-----[^"]{1,16384})"/g, group: 1 },
+  { id: "azure-storage-key", description: "Azure storage connection string", regex: /(?<![A-Za-z0-9+/=])AccountKey=([A-Za-z0-9+/=]{60,1024})/g, group: 1 },
+  { id: "github-token", description: "GitHub token", regex: /(?<![A-Za-z0-9_])((?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36,255}|github_pat_[A-Za-z0-9_]{60,255})\b/g, group: 1 },
+  { id: "gitlab-token", description: "GitLab token", regex: /(?<![A-Za-z0-9_-])(glpat-[A-Za-z0-9_-]{20,255})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "slack-token", description: "Slack token", regex: /(?<![A-Za-z0-9_-])(xox[abprs]-[A-Za-z0-9-]{10,255})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "slack-webhook", description: "Slack webhook URL", regex: /(https:\/\/hooks\.slack\.com\/services\/[A-Za-z0-9/_-]{20,255})/g, group: 1 },
+  { id: "stripe-key", description: "Stripe secret key", regex: /(?<![A-Za-z0-9_])((?:sk|rk)_(?:live|test)_[A-Za-z0-9]{20,255})\b/g, group: 1 },
+  { id: "anthropic-key", description: "Anthropic API key", regex: /(?<![A-Za-z0-9_-])(sk-ant-[A-Za-z0-9_-]{20,255})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "openai-key", description: "OpenAI API key", regex: /(?<![A-Za-z0-9_-])(sk-(?:proj-|svcacct-)?[A-Za-z0-9_-]{32,255})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "google-api-key", description: "Google API key", regex: /(?<![A-Za-z0-9_-])(AIza[0-9A-Za-z_-]{35})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "sendgrid-key", description: "SendGrid API key", regex: /(?<![A-Za-z0-9_-])(SG\.[A-Za-z0-9_-]{22}\.[A-Za-z0-9_-]{43})(?![A-Za-z0-9_-])/g, group: 1 },
+  { id: "npm-token", description: "npm token", regex: /(?<![A-Za-z0-9_])(npm_[A-Za-z0-9]{36})\b/g, group: 1 },
+  { id: "jwt", description: "JSON Web Token", regex: /(?<![A-Za-z0-9_-])(eyJ[A-Za-z0-9_-]{10,4096}\.eyJ[A-Za-z0-9_-]{10,8192}\.[A-Za-z0-9_-]{10,4096})(?![A-Za-z0-9_-])/g, group: 1 },
+  {
+    id: "connection-string-credentials",
+    description: "Connection string with embedded password",
+    regex: /\b(?:postgres(?:ql)?|mysql|mariadb|mongodb(?:\+srv)?|redis|rediss|amqps?|mssql|sqlserver):\/\/[^\s:@/"'`]{1,256}:([^\s@/"'`]{3,256})@/gi,
+    group: 1
+  },
+  {
+    // Two-step, linear: find a bounded quoted value after ":" or "=", then check the
+    // identifier just before the operator for a keyword (see identifierBefore).
+    id: "generic-secret-assignment",
+    description: "Hardcoded secret-like assignment",
+    regex: /[:=][ \t]*["'`]([^"'`\s]{12,200})["'`]/g,
+    group: 1,
+    minEntropy: 3.5,
+    identifier: GENERIC_KEYWORD
+  },
+  {
+    id: "env-secret-assignment",
+    description: "Secret-like environment value",
+    regex: /^[ \t]*(?:export[ \t]+)?[A-Z0-9_]{1,128}[ \t]*=[ \t]*["']?([^\s"'#$]{8,512})["']?[ \t\r]*$/gm,
+    group: 1,
+    minEntropy: 3,
+    identifier: ENV_KEYWORD
+  }
+];
+var PLACEHOLDER_VALUE = /^(?:<.*>|\$\{.*\}|\{\{.*\}\}|x{4,}|\*{4,}|changeme|change[-_]?me|your[-_].*|example.*|placeholder.*|dummy.*|test.*|fake.*|replace[-_]?me|todo|null|none|undefined|password|secret|redacted)$/i;
+var PROCESS_KEY = crypto.randomBytes(32);
+var ephemeralFingerprint = (value) => crypto.createHmac("sha256", PROCESS_KEY).update(value).digest("hex").slice(0, 16);
+function shannonEntropy(s) {
+  if (!s) return 0;
+  const counts = /* @__PURE__ */ new Map();
+  for (const ch of s) counts.set(ch, (counts.get(ch) ?? 0) + 1);
+  let h = 0;
+  for (const c of counts.values()) {
+    const p = c / s.length;
+    h -= p * Math.log2(p);
+  }
+  return h;
+}
+function matchPrivateKeys(text) {
+  if (!text.includes("PRIVATE KEY")) return [];
+  const ends = [];
+  PEM_END.lastIndex = 0;
+  for (const m of text.matchAll(PEM_END)) ends.push([m.index, m.index + m[0].length]);
+  if (!ends.length) return [];
+  const out = [];
+  let e = 0;
+  PEM_BEGIN.lastIndex = 0;
+  for (const m of text.matchAll(PEM_BEGIN)) {
+    const bodyStart = m.index + m[0].length;
+    while (e < ends.length && ends[e][0] < bodyStart) e++;
+    if (e >= ends.length) break;
+    const [endStart, endEnd] = ends[e];
+    if (endStart - bodyStart > PRIVATE_KEY_WINDOW) continue;
+    out.push({ start: m.index, end: endEnd, value: text.slice(m.index, endEnd) });
+  }
+  return out;
+}
+var IDENT_CHAR = /[A-Za-z0-9_.-]/;
+function identifierBefore(text, opIndex) {
+  let i = opIndex - 1;
+  while (i >= 0 && (text[i] === " " || text[i] === "	")) i--;
+  if (i >= 0 && (text[i] === '"' || text[i] === "'")) i--;
+  const end = i + 1;
+  const floor = Math.max(0, end - IDENTIFIER_LOOKBACK);
+  while (i >= floor && IDENT_CHAR.test(text[i])) i--;
+  return text.slice(i + 1, end);
+}
+function lineLength(starts, line, textLength) {
+  const start = starts[line - 1];
+  const next = line < starts.length ? starts[line] : textLength + 1;
+  return next - 1 - start;
+}
+function scanText(text, opts = {}) {
+  const fingerprint = opts.fingerprint ?? ephemeralFingerprint;
+  const matches = [];
+  const taken = [];
+  const lineStarts = computeLineStarts(text);
+  if (opts.stats) {
+    for (let l = 1; l <= lineStarts.length; l++) if (lineLength(lineStarts, l, text.length) > MAX_GENERIC_LINE) opts.stats.skippedLongLines++;
+  }
+  const accept = (type, raw, line = lineAt(lineStarts, raw.start)) => {
+    if (taken.some(([s, e]) => raw.start < e && raw.end > s)) return;
+    taken.push([raw.start, raw.end]);
+    matches.push({ type, line, start: raw.start, end: raw.end, fingerprint: fingerprint(raw.value) });
+  };
+  for (const pattern of SECRET_PATTERNS) {
+    if (pattern.id === "private-key") {
+      for (const raw of matchPrivateKeys(text)) accept(pattern.id, raw);
+      continue;
+    }
+    pattern.regex.lastIndex = 0;
+    for (const m of text.matchAll(pattern.regex)) {
+      const group = pattern.group ?? 0;
+      const value = m[group];
+      if (!value || m.index === void 0) continue;
+      if (PLACEHOLDER_VALUE.test(value)) continue;
+      if (pattern.minEntropy !== void 0 && shannonEntropy(value) < pattern.minEntropy) continue;
+      const offsetInMatch = group === 0 ? 0 : m[0].lastIndexOf(value);
+      const start = m.index + Math.max(offsetInMatch, 0);
+      const line = lineAt(lineStarts, start);
+      if (pattern.identifier) {
+        if (lineLength(lineStarts, line, text.length) > MAX_GENERIC_LINE) continue;
+        const name = pattern.id === "env-secret-assignment" ? envName(m[0]) : identifierBefore(text, m.index);
+        if (!pattern.identifier.test(name)) continue;
+      }
+      accept(pattern.id, { start, end: start + value.length, value }, line);
+    }
+  }
+  return matches.sort((a, b) => a.start - b.start);
+}
+function envName(match) {
+  const eq = match.indexOf("=");
+  return match.slice(0, eq).replace(/^[ \t]*(?:export[ \t]+)?/, "").trim();
+}
+function redact(text, placeholder = "<redacted>") {
+  const matches = scanText(text);
+  if (!matches.length) return text;
+  let out = "";
+  let cursor = 0;
+  for (const m of matches) {
+    out += text.slice(cursor, m.start) + placeholder;
+    cursor = m.end;
+  }
+  return out + text.slice(cursor);
+}
+function computeLineStarts(text) {
+  const starts = [0];
+  for (let i = 0; i < text.length; i++) if (text.charCodeAt(i) === 10) starts.push(i + 1);
+  return starts;
+}
+function lineAt(starts, offset) {
+  let lo = 0;
+  let hi = starts.length - 1;
+  while (lo < hi) {
+    const mid = lo + hi + 1 >> 1;
+    if (starts[mid] <= offset) lo = mid;
+    else hi = mid - 1;
+  }
+  return lo + 1;
+}
+function isSecretLikeName(name) {
+  return /(PASSWORD|PASSWD|SECRET|TOKEN|API_?KEY|ACCESS_?KEY|PRIVATE_?KEY|CREDENTIAL|DATABASE_URL|DB_URL|CONNECTION_STRING|DSN|WEBHOOK)/i.test(name);
+}
+
+export {
+  ephemeralFingerprint,
+  scanText,
+  redact,
+  isSecretLikeName
+};
+//# sourceMappingURL=chunk-JCGDR4UV.js.map

package/dist/chunk-JY6BFIJJ.js

@@ -0,0 +1,95 @@
+#!/usr/bin/env node
+import {
+  readRecentEvents,
+  summarizeSessions
+} from "./chunk-65TSRDQ3.js";
+import {
+  ADAPTERS,
+  applyChanges,
+  resolveAdapters
+} from "./chunk-2RS6TA3D.js";
+import {
+  athenaDir,
+  readState,
+  writeState
+} from "./chunk-2DY4PUR4.js";
+import {
+  AthenaError
+} from "./chunk-AD4OZCU2.js";
+
+// src/services/agents.ts
+function resolve(names) {
+  try {
+    return names.length === 1 && names[0] === "all" ? ADAPTERS : resolveAdapters(names);
+  } catch (err) {
+    throw new AthenaError(err.message);
+  }
+}
+async function listAgents(root) {
+  const st = await readState(athenaDir(root));
+  const sessions = summarizeSessions(await readRecentEvents(root, 500));
+  const out = [];
+  for (const a of ADAPTERS) {
+    const presence = await a.detectPresence(root);
+    const s = st.kind === "ok" ? st.state.agents[a.id] : void 0;
+    const checks = s?.configured ? await a.check(root) : [];
+    const hooksInstalled = a.capabilities.hooks && checks.some((c) => c.ok && /hooks installed/i.test(c.message));
+    const mine = sessions.filter((x) => x.agent === a.id);
+    out.push({
+      id: a.id,
+      name: a.displayName,
+      configured: Boolean(s?.configured),
+      configuredAt: s?.configuredAt ?? null,
+      files: s?.files ?? [],
+      detectedInProject: presence.detectedInProject,
+      evidence: presence.evidence,
+      note: a.supportNote,
+      capabilities: a.capabilities,
+      checks,
+      activityObservation: !a.capabilities.hooks ? "unsupported" : hooksInstalled ? "hooks" : "not-configured",
+      lastActivityAt: mine[0]?.lastEventAt ?? null,
+      observedEvents: mine.reduce((n, x) => n + x.events, 0)
+    });
+  }
+  return out;
+}
+async function configureAgents(root, names) {
+  const st = await readState(athenaDir(root));
+  if (st.kind !== "ok") throw new AthenaError("state.json is missing or corrupted.", "Run `athena analyze` first.");
+  const adapters = resolve(names);
+  const results = [];
+  for (const a of adapters) {
+    const planned = await a.plan({ root, projectName: st.state.projectName });
+    await applyChanges(root, planned);
+    st.state.agents[a.id] = { configured: true, files: planned.map((p) => p.path), configuredAt: (/* @__PURE__ */ new Date()).toISOString() };
+    results.push({ id: a.id, files: planned.map((p) => ({ path: p.path, action: p.action })) });
+  }
+  await writeState(athenaDir(root), st.state);
+  return results;
+}
+async function removeAgents(root, names) {
+  const st = await readState(athenaDir(root));
+  const removed = [];
+  const targets = resolve(names);
+  for (const a of targets) {
+    removed.push(...await a.remove(root));
+    if (st.kind === "ok") delete st.state.agents[a.id];
+  }
+  if (st.kind === "ok") {
+    for (const a of ADAPTERS) {
+      const s = st.state.agents[a.id];
+      if (!s?.configured || targets.includes(a) || !s.files.some((f) => removed.includes(f))) continue;
+      const planned = await a.plan({ root, projectName: st.state.projectName });
+      await applyChanges(root, planned.filter((p) => removed.includes(p.path)));
+    }
+    await writeState(athenaDir(root), st.state);
+  }
+  return removed;
+}
+
+export {
+  listAgents,
+  configureAgents,
+  removeAgents
+};
+//# sourceMappingURL=chunk-JY6BFIJJ.js.map

package/dist/chunk-KBO7XRBW.js

@@ -0,0 +1,26 @@
+#!/usr/bin/env node
+import {
+  ATHENA_DIR
+} from "./chunk-EUPETUWA.js";
+
+// src/services/project.ts
+import { promises as fs } from "fs";
+import path from "path";
+async function findProjectRoot(start) {
+  let dir = start;
+  for (; ; ) {
+    try {
+      const st = await fs.stat(path.join(dir, ATHENA_DIR));
+      if (st.isDirectory()) return dir;
+    } catch {
+    }
+    const parent = path.dirname(dir);
+    if (parent === dir) return null;
+    dir = parent;
+  }
+}
+
+export {
+  findProjectRoot
+};
+//# sourceMappingURL=chunk-KBO7XRBW.js.map