rudel 0.2.0 → 0.2.2

package/dist/cli.js

@@ -1,5 +1,4 @@
 #!/usr/bin/env node
-import { createRequire } from "node:module";
 var __create = Object.create;
 var __getProtoOf = Object.getPrototypeOf;
 var __defProp = Object.defineProperty;
@@ -26,7 +25,6 @@ var __export = (target, all) => {
       set: (newValue) => all[name] = () => newValue
     });
 };
-var __require = /* @__PURE__ */ createRequire(import.meta.url);
 
 // ../../node_modules/sisteransi/src/index.js
 var require_src = __commonJS((exports, module) => {
@@ -1889,7 +1887,7 @@ async function run(app, inputs, context) {
 // package.json
 var package_default = {
   name: "rudel",
-  version: "0.2.0",
+  version: "0.2.2",
   type: "module",
   description: "CLI for the Coding Agent Analytics Platform rudel.ai",
   license: "MIT",
@@ -7795,7 +7793,8 @@ function exec(cmd, args) {
 
 // src/lib/git-info.ts
 function normalizeRemoteUrl(url) {
-  return url.replace(/^(https?:\/\/|git@|ssh:\/\/)/, "").replace(/:/, "/").replace(/\.git$/, "");
+  const sanitizedUrl = url.replace(/^([a-z][a-z\d+.-]*:\/\/)[^/]+@/i, "$1");
+  return sanitizedUrl.replace(/^(https?:\/\/|git@|ssh:\/\/)/, "").replace(/:/, "/").replace(/\.git$/, "");
 }
 async function getGitInfo(cwd) {
   const [remoteUrl, branch, sha, packageInfo] = await Promise.all([
@@ -7919,15 +7918,43 @@ async function getGitSha(cwd) {
 
 // src/lib/remote-cache.ts
 import { existsSync as existsSync5, readFileSync as readFileSync4 } from "node:fs";
-import { mkdir, writeFile } from "node:fs/promises";
+import { join as join8 } from "node:path";
+
+// src/lib/local-state.ts
+import { chmod, mkdir, writeFile } from "node:fs/promises";
 import { homedir as homedir5 } from "node:os";
 import { dirname as dirname3, join as join7 } from "node:path";
-var CACHE_PATH = join7(homedir5(), ".rudel", "remote-cache.json");
+var PRIVATE_DIRECTORY_MODE = 448;
+var PRIVATE_FILE_MODE = 384;
+function getRudelConfigDir() {
+  return process.env.RUDEL_CONFIG_DIR ?? join7(homedir5(), ".rudel");
+}
+async function ensurePrivateFile(filePath, configDir) {
+  await secureDirectory(configDir);
+  const fileDirectory = dirname3(filePath);
+  if (fileDirectory !== configDir) {
+    await secureDirectory(fileDirectory);
+  }
+  await writeFile(filePath, "", { flag: "a", mode: PRIVATE_FILE_MODE });
+  await chmod(filePath, PRIVATE_FILE_MODE);
+}
+async function writePrivateFile(filePath, content, configDir) {
+  await ensurePrivateFile(filePath, configDir);
+  await writeFile(filePath, content, "utf8");
+}
+async function secureDirectory(path) {
+  await mkdir(path, { recursive: true, mode: PRIVATE_DIRECTORY_MODE });
+  await chmod(path, PRIVATE_DIRECTORY_MODE);
+}
+
+// src/lib/remote-cache.ts
 async function getRemoteCache() {
   try {
-    if (!existsSync5(CACHE_PATH))
+    const path = getRemoteCachePath();
+    if (!existsSync5(path))
       return {};
-    return JSON.parse(readFileSync4(CACHE_PATH, "utf-8"));
+    await ensurePrivateFile(path, getRudelConfigDir());
+    return JSON.parse(readFileSync4(path, "utf-8"));
   } catch {
     return {};
   }
@@ -7940,10 +7967,12 @@ function cacheRemote(cache, encodedDir, normalizedRemote) {
 }
 async function cacheRemotes(cache) {
   try {
-    await mkdir(dirname3(CACHE_PATH), { recursive: true });
-    await writeFile(CACHE_PATH, JSON.stringify(cache));
+    await writePrivateFile(getRemoteCachePath(), JSON.stringify(cache), getRudelConfigDir());
   } catch {}
 }
+function getRemoteCachePath() {
+  return join8(getRudelConfigDir(), "remote-cache.json");
+}
 
 // src/lib/project-grouping.ts
 async function scanAndGroupProjects(cwd = process.cwd()) {
@@ -10992,7 +11021,6 @@ var SessionAnalyticsSchema = exports_external.object({
   skills: exports_external.array(exports_external.string()),
   slash_commands: exports_external.array(exports_external.string()),
   has_commit: exports_external.boolean(),
-  session_archetype: exports_external.string(),
   model_used: exports_external.string(),
   used_plan_mode: exports_external.boolean(),
   source: SourceSchema.optional()
@@ -11015,6 +11043,8 @@ var SessionAnalyticsSummaryComparisonSchema = exports_external.object({
   })
 });
 var SessionListInputSchema = DaysInputSchema.extend({
+  startDate: exports_external.string().date().optional(),
+  endDate: exports_external.string().date().optional(),
   userId: exports_external.string().max(MAX_ID_FILTER_LENGTH).optional(),
   projectPath: exports_external.string().max(MAX_PATH_FILTER_LENGTH).optional(),
   repository: exports_external.string().max(MAX_PATH_FILTER_LENGTH).optional(),
@@ -11028,7 +11058,6 @@ var VALID_DIMENSIONS = [
   "user_id",
   "project_path",
   "repository",
-  "session_archetype",
   "model_used",
   "has_commit",
   "used_plan_mode",
@@ -11082,7 +11111,6 @@ var SessionDetailSchema = exports_external.object({
   success_score: exports_external.number().optional(),
   duration_min: exports_external.number().optional(),
   total_interactions: exports_external.number().optional(),
-  session_archetype: exports_external.string().optional(),
   model_used: exports_external.string().optional(),
   source: SourceSchema.optional()
 });
@@ -11819,43 +11847,77 @@ var contract = {
 };
 
 // src/lib/credentials.ts
+import { randomUUID } from "node:crypto";
 import {
+  chmodSync,
   existsSync as existsSync6,
   mkdirSync as mkdirSync2,
   readFileSync as readFileSync5,
+  renameSync,
   rmSync,
+  statSync,
   writeFileSync as writeFileSync3
 } from "node:fs";
 import { homedir as homedir7 } from "node:os";
-import { join as join8 } from "node:path";
+import { join as join9 } from "node:path";
+var PRIVATE_DIRECTORY_MODE2 = 448;
+var PRIVATE_FILE_MODE2 = 384;
 function getConfigDir() {
-  return process.env.RUDEL_CONFIG_DIR ?? join8(homedir7(), ".rudel");
-}
-function getCredentialsPath() {
-  return join8(getConfigDir(), "credentials.json");
+  return process.env.RUDEL_CONFIG_DIR ?? join9(homedir7(), ".rudel");
 }
 function saveCredentials(credentials) {
   const dir = getConfigDir();
-  if (!existsSync6(dir)) {
-    mkdirSync2(dir, { recursive: true, mode: 448 });
+  const path = getCredentialsPath(dir);
+  const content = JSON.stringify(credentials, null, 2);
+  mkdirSync2(dir, { recursive: true, mode: PRIVATE_DIRECTORY_MODE2 });
+  enforcePrivateMode(dir, PRIVATE_DIRECTORY_MODE2);
+  if (existsSync6(path)) {
+    enforcePrivateMode(path, PRIVATE_FILE_MODE2);
   }
-  writeFileSync3(getCredentialsPath(), JSON.stringify(credentials, null, 2), {
-    mode: 384
-  });
+  replaceCredentialsFile(path, content);
 }
 function loadCredentials() {
-  const path = getCredentialsPath();
+  const dir = getConfigDir();
+  const path = getCredentialsPath(dir);
   if (!existsSync6(path))
     return null;
+  enforcePrivateMode(dir, PRIVATE_DIRECTORY_MODE2);
+  enforcePrivateMode(path, PRIVATE_FILE_MODE2);
   const content = readFileSync5(path, "utf-8");
   return JSON.parse(content);
 }
 function clearCredentials() {
-  const path = getCredentialsPath();
+  const path = getCredentialsPath(getConfigDir());
   if (existsSync6(path)) {
     rmSync(path);
   }
 }
+function getCredentialsPath(configDir) {
+  return join9(configDir, "credentials.json");
+}
+function replaceCredentialsFile(path, content) {
+  const temporaryPath = `${path}.${process.pid}.${randomUUID()}.tmp`;
+  try {
+    writeFileSync3(temporaryPath, content, {
+      encoding: "utf8",
+      flag: "wx",
+      mode: PRIVATE_FILE_MODE2
+    });
+    enforcePrivateMode(temporaryPath, PRIVATE_FILE_MODE2);
+    renameSync(temporaryPath, path);
+    enforcePrivateMode(path, PRIVATE_FILE_MODE2);
+  } finally {
+    rmSync(temporaryPath, { force: true });
+  }
+}
+function enforcePrivateMode(path, mode) {
+  if (process.platform === "win32")
+    return;
+  chmodSync(path, mode);
+  if ((statSync(path).mode & 511) !== mode) {
+    throw new Error("Unable to establish private credential permissions");
+  }
+}
 
 // src/lib/insecure-url-opt-in.ts
 var TRUTHY_ENV_VALUES = ["1", "true", "yes", "on"];
@@ -13875,12 +13937,9 @@ var pMapSkip = Symbol("skip");
 
 // src/lib/failed-uploads.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "node:fs";
-import { mkdir as mkdir2, writeFile as writeFile2 } from "node:fs/promises";
-import { homedir as homedir8 } from "node:os";
-import { dirname as dirname4, join as join9 } from "node:path";
+import { join as join10 } from "node:path";
 function getFailedUploadsPath() {
-  const configDir = process.env.RUDEL_CONFIG_DIR ?? join9(homedir8(), ".rudel");
-  return join9(configDir, "failed-uploads.json");
+  return join10(getRudelConfigDir(), "failed-uploads.json");
 }
 function normalizeSource(raw) {
   if (typeof raw !== "string")
@@ -13894,6 +13953,7 @@ async function loadFailedUploads() {
     const path = getFailedUploadsPath();
     if (!existsSync7(path))
       return [];
+    await ensurePrivateFile(path, getRudelConfigDir());
     const data = JSON.parse(readFileSync6(path, "utf-8"));
     return data.failures.map((f) => ({
       ...f,
@@ -13906,9 +13966,8 @@ async function loadFailedUploads() {
 async function saveFailedUploads(failures) {
   try {
     const path = getFailedUploadsPath();
-    await mkdir2(dirname4(path), { recursive: true });
     const data = { failures };
-    await writeFile2(path, JSON.stringify(data, null, 2));
+    await writePrivateFile(path, JSON.stringify(data, null, 2), getRudelConfigDir());
   } catch {}
 }
 async function recordFailedUpload(failure) {
@@ -14390,13 +14449,13 @@ function renderBatchSummary(summary, options) {
 }
 
 // src/lib/product-analytics.ts
-import { randomUUID } from "node:crypto";
+import { randomUUID as randomUUID2 } from "node:crypto";
 import { existsSync as existsSync8, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync4 } from "node:fs";
-import { homedir as homedir9 } from "node:os";
-import { join as join10 } from "node:path";
+import { homedir as homedir8 } from "node:os";
+import { join as join11 } from "node:path";
 
 // ../../node_modules/posthog-node/dist/extensions/error-tracking/modifiers/module.node.mjs
-import { dirname as dirname5, posix, sep } from "path";
+import { dirname as dirname4, posix, sep } from "path";
 function createModulerModifier() {
   const getModuleFromFileName = createGetModuleFromFilename();
   return async (frames) => {
@@ -14405,7 +14464,7 @@ function createModulerModifier() {
     return frames;
   };
 }
-function createGetModuleFromFilename(basePath = process.argv[1] ? dirname5(process.argv[1]) : process.cwd(), isWindows = sep === "\\") {
+function createGetModuleFromFilename(basePath = process.argv[1] ? dirname4(process.argv[1]) : process.cwd(), isWindows = sep === "\\") {
   const normalizedBase = isWindows ? normalizeWindowsPath(basePath) : basePath;
   return (filename) => {
     if (!filename)
@@ -18865,10 +18924,10 @@ function getClient() {
   return client;
 }
 function getConfigDir2() {
-  return process.env.RUDEL_CONFIG_DIR ?? join10(homedir9(), ".rudel");
+  return process.env.RUDEL_CONFIG_DIR ?? join11(homedir8(), ".rudel");
 }
 function getAnalyticsStatePath() {
-  return join10(getConfigDir2(), ANALYTICS_STATE_FILE);
+  return join11(getConfigDir2(), ANALYTICS_STATE_FILE);
 }
 function readAnalyticsState() {
   const statePath = getAnalyticsStatePath();
@@ -18912,7 +18971,7 @@ function getOrCreateCliInstallationId() {
   if (typeof state.cli_installation_id === "string") {
     return state.cli_installation_id;
   }
-  const cliInstallationId = randomUUID();
+  const cliInstallationId = randomUUID2();
   writeAnalyticsState({
     ...state,
     cli_installation_id: cliInstallationId
@@ -19021,30 +19080,37 @@ function getBaseCliEventPayload() {
 var CliProductAnalyticsEvents = PRODUCT_ANALYTICS_EVENTS;
 
 // src/lib/project-config.ts
-import { existsSync as existsSync9, mkdirSync as mkdirSync4, readFileSync as readFileSync8, writeFileSync as writeFileSync5 } from "node:fs";
-import { homedir as homedir10 } from "node:os";
-import { join as join11 } from "node:path";
+import {
+  chmodSync as chmodSync2,
+  existsSync as existsSync9,
+  mkdirSync as mkdirSync4,
+  readFileSync as readFileSync8,
+  writeFileSync as writeFileSync5
+} from "node:fs";
+import { homedir as homedir9 } from "node:os";
+import { join as join12 } from "node:path";
 function getConfigDir3() {
-  return process.env.RUDEL_CONFIG_DIR ?? join11(homedir10(), ".rudel");
+  return process.env.RUDEL_CONFIG_DIR ?? join12(homedir9(), ".rudel");
 }
 function getProjectsConfigPath() {
-  return join11(getConfigDir3(), "projects.json");
+  return join12(getConfigDir3(), "projects.json");
 }
 function loadProjectsConfig() {
   const path = getProjectsConfigPath();
   if (!existsSync9(path))
     return { projects: {} };
+  chmodSync2(getConfigDir3(), 448);
+  chmodSync2(path, 384);
   const content = readFileSync8(path, "utf-8");
   return JSON.parse(content);
 }
 function saveProjectsConfig(config) {
   const dir = getConfigDir3();
-  if (!existsSync9(dir)) {
-    mkdirSync4(dir, { recursive: true, mode: 448 });
-  }
-  writeFileSync5(getProjectsConfigPath(), JSON.stringify(config, null, 2), {
-    mode: 384
-  });
+  mkdirSync4(dir, { recursive: true, mode: 448 });
+  chmodSync2(dir, 448);
+  const path = getProjectsConfigPath();
+  writeFileSync5(path, JSON.stringify(config, null, 2), { mode: 384 });
+  chmodSync2(path, 384);
 }
 async function getProjectKey(cwd) {
   try {
@@ -19057,7 +19123,9 @@ async function getProjectKey(cwd) {
     ]);
     if (result.exitCode === 0) {
       const url = result.stdout.trim();
-      return url.replace(/^(https?:\/\/|git@|ssh:\/\/)/, "").replace(/:/, "/").replace(/\.git$/, "");
+      if (url.length > 0) {
+        return normalizeRemoteUrl(url);
+      }
     }
   } catch {}
   try {
@@ -20919,8 +20987,7 @@ async function reportHookUploadFailure(logger2, result, failure) {
 }
 
 // src/logging.ts
-import { homedir as homedir11 } from "node:os";
-import { join as join13 } from "node:path";
+import { join as join14 } from "node:path";
 
 // ../../node_modules/@logtape/file/dist/filesink.base.js
 var AdaptiveFlushStrategy = class {
@@ -21186,7 +21253,7 @@ function getBaseFileSink(path, options) {
 
 // ../../node_modules/@logtape/file/dist/filesink.node.js
 import fs from "node:fs";
-import { join as join12 } from "node:path";
+import { join as join13 } from "node:path";
 import { promisify } from "node:util";
 var nodeDriver = {
   openSync(path) {
@@ -21226,14 +21293,14 @@ var nodeTimeDriver = {
   readdirSync: fs.readdirSync,
   unlinkSync: fs.unlinkSync,
   mkdirSync: fs.mkdirSync,
-  joinPath: join12
+  joinPath: join13
 };
 var nodeAsyncTimeDriver = {
   ...nodeAsyncDriver,
   readdirSync: fs.readdirSync,
   unlinkSync: fs.unlinkSync,
   mkdirSync: fs.mkdirSync,
-  joinPath: join12
+  joinPath: join13
 };
 function getFileSink(path, options = {}) {
   if (options.nonBlocking)
@@ -21248,14 +21315,13 @@ function getFileSink(path, options = {}) {
 }
 
 // src/logging.ts
-var LOG_DIR = join13(homedir11(), ".rudel", "logs");
-var LOG_FILE = join13(LOG_DIR, "hook-upload.log");
 async function setupHookLogging() {
-  const { mkdir: mkdir3 } = await import("node:fs/promises");
-  await mkdir3(LOG_DIR, { recursive: true }).catch(() => {});
+  const configDir = getRudelConfigDir();
+  const logFile = join14(configDir, "logs", "hook-upload.log");
+  await ensurePrivateFile(logFile, configDir);
   await configure({
     sinks: {
-      file: getFileSink(LOG_FILE)
+      file: getFileSink(logFile)
     },
     loggers: [
       {
@@ -21924,9 +21990,9 @@ function execWithStdin(cmd, args, stdin) {
 
 // src/lib/session-resolver.ts
 import { access, readdir as readdir3 } from "node:fs/promises";
-import { homedir as homedir12 } from "node:os";
-import { basename, dirname as dirname6, join as join14 } from "node:path";
-var SESSIONS_BASE_DIR3 = join14(homedir12(), ".claude", "projects");
+import { homedir as homedir10 } from "node:os";
+import { basename, dirname as dirname5, join as join15 } from "node:path";
+var SESSIONS_BASE_DIR3 = join15(homedir10(), ".claude", "projects");
 async function resolveSession(input) {
   const isPath = input.includes("/") || input.endsWith(".jsonl");
   if (isPath) {
@@ -21943,7 +22009,7 @@ async function resolveFromPath(filePath) {
     throw new Error(`Session file not found: ${filePath}`);
   }
   const sessionId = filename.replace(/\.jsonl$/, "");
-  const sessionDir = dirname6(filePath);
+  const sessionDir = dirname5(filePath);
   const parentDir = basename(sessionDir);
   const projectPath = await decodeProjectPath(parentDir);
   return { transcriptPath: filePath, projectPath, sessionDir, sessionId };
@@ -21958,11 +22024,11 @@ async function resolveFromId(sessionId) {
     throw new Error(`Session not found: ${sessionId}`);
   }
   for (const projectDir of projectDirs) {
-    const sessionDir = join14(SESSIONS_BASE_DIR3, projectDir);
+    const sessionDir = join15(SESSIONS_BASE_DIR3, projectDir);
     try {
       const files = await readdir3(sessionDir);
       if (files.includes(sessionFileName)) {
-        const transcriptPath = join14(sessionDir, sessionFileName);
+        const transcriptPath = join15(sessionDir, sessionFileName);
         const projectPath = await decodeProjectPath(projectDir);
         return {
           transcriptPath,

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "rudel",
-	"version": "0.2.0",
+	"version": "0.2.2",
 	"type": "module",
 	"description": "CLI for the Coding Agent Analytics Platform rudel.ai",
 	"license": "MIT",