selfguard 0.0.1 → 0.1.0

package/dist/osv.js

@@ -0,0 +1,142 @@
+/**
+ * Client for the OSV.dev API (https://google.github.io/osv.dev/api/).
+ * Only package names + versions are sent; nothing about your files or paths.
+ */
+import { join } from "node:path";
+import { atomicWrite, isObject, readJsonFile } from "./fsutil.js";
+import { vulnCacheDir } from "./paths.js";
+import { VERSION } from "./version.js";
+const API = process.env.SELFGUARD_OSV_API ?? "https://api.osv.dev/v1";
+const BATCH_SIZE = 1000; // documented max queries per querybatch request
+const TIMEOUT_MS = 30_000;
+const MAX_RESPONSE_BYTES = 64 * 1024 * 1024;
+const DETAIL_CONCURRENCY = 8;
+const ID_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/;
+async function request(method, path, body) {
+    const init = {
+        method,
+        headers: { "user-agent": `selfguard/${VERSION}`, accept: "application/json" },
+        signal: AbortSignal.timeout(TIMEOUT_MS),
+        redirect: "error",
+    };
+    if (body !== undefined) {
+        init.body = JSON.stringify(body);
+        init.headers["content-type"] = "application/json";
+    }
+    let lastErr;
+    for (let attempt = 0; attempt < 3; attempt++) {
+        try {
+            const res = await fetch(`${API}${path}`, init);
+            if (res.status === 429 || res.status >= 500)
+                throw new Error(`OSV API ${res.status}`);
+            if (!res.ok)
+                throw Object.assign(new Error(`OSV API ${res.status}`), { fatal: true });
+            const len = Number(res.headers.get("content-length") ?? 0);
+            if (len > MAX_RESPONSE_BYTES)
+                throw Object.assign(new Error("OSV response too large"), { fatal: true });
+            const text = await res.text();
+            if (text.length > MAX_RESPONSE_BYTES)
+                throw Object.assign(new Error("OSV response too large"), { fatal: true });
+            return JSON.parse(text);
+        }
+        catch (err) {
+            lastErr = err;
+            if (err.fatal)
+                break;
+            await new Promise((r) => setTimeout(r, 500 * 2 ** attempt));
+            init.signal = AbortSignal.timeout(TIMEOUT_MS);
+        }
+    }
+    throw lastErr instanceof Error ? lastErr : new Error(String(lastErr));
+}
+function readRefs(result) {
+    if (!isObject(result))
+        return { refs: [] };
+    const refs = [];
+    if (Array.isArray(result.vulns)) {
+        for (const v of result.vulns) {
+            if (isObject(v) && typeof v.id === "string" && ID_RE.test(v.id)) {
+                refs.push({ id: v.id, modified: typeof v.modified === "string" ? v.modified : "" });
+            }
+        }
+    }
+    const next = typeof result.next_page_token === "string" && result.next_page_token ? result.next_page_token : undefined;
+    return next ? { refs, next } : { refs };
+}
+/** Returns, for each input package (same order), the vulnerability ids OSV says affect it. */
+export async function queryBatch(pkgs) {
+    const out = pkgs.map(() => []);
+    for (let start = 0; start < pkgs.length; start += BATCH_SIZE) {
+        // indexes into `pkgs` still to query, with optional page tokens
+        let pending = [];
+        for (let i = start; i < Math.min(start + BATCH_SIZE, pkgs.length); i++)
+            pending.push({ i });
+        for (let page = 0; pending.length > 0 && page < 20; page++) {
+            const queries = pending.map(({ i, token }) => ({
+                package: { ecosystem: "npm", name: pkgs[i].name },
+                version: pkgs[i].version,
+                ...(token ? { page_token: token } : {}),
+            }));
+            const res = await request("POST", "/querybatch", { queries });
+            const results = isObject(res) && Array.isArray(res.results) ? res.results : [];
+            const next = [];
+            pending.forEach(({ i }, k) => {
+                const { refs, next: token } = readRefs(results[k]);
+                out[i].push(...refs);
+                if (token)
+                    next.push({ i, token });
+            });
+            pending = next;
+        }
+    }
+    return out;
+}
+function cachePath(id) {
+    return join(vulnCacheDir(), `${id}.json`);
+}
+function asVuln(data) {
+    if (!isObject(data) || typeof data.id !== "string" || !ID_RE.test(data.id))
+        return null;
+    return data;
+}
+export function getCachedVuln(id) {
+    if (!ID_RE.test(id))
+        return null;
+    return readJsonFile(cachePath(id))?.vuln ?? null;
+}
+/** Fetch full advisories, reusing the local cache when `modified` hasn't changed. */
+export async function getVulns(refs) {
+    const result = new Map();
+    const toFetch = [];
+    const seen = new Set();
+    for (const { id, modified } of refs) {
+        if (seen.has(id))
+            continue;
+        seen.add(id);
+        const cached = getCachedVuln(id);
+        if (cached && modified && cached.modified === modified)
+            result.set(id, cached);
+        else
+            toFetch.push(id);
+    }
+    let cursor = 0;
+    const worker = async () => {
+        while (cursor < toFetch.length) {
+            const id = toFetch[cursor++];
+            try {
+                const vuln = asVuln(await request("GET", `/vulns/${encodeURIComponent(id)}`));
+                if (!vuln || vuln.id !== id)
+                    continue;
+                atomicWrite(cachePath(id), JSON.stringify({ fetchedAt: new Date().toISOString(), vuln }));
+                result.set(id, vuln);
+            }
+            catch {
+                const stale = getCachedVuln(id); // offline / API hiccup: fall back to what we had
+                if (stale)
+                    result.set(id, stale);
+            }
+        }
+    };
+    await Promise.all(Array.from({ length: Math.min(DETAIL_CONCURRENCY, toFetch.length) }, worker));
+    return result;
+}

package/dist/paths.js

@@ -0,0 +1,13 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+/** Root of all local state. Override with SELFGUARD_HOME (used by tests). */
+export function stateRoot() {
+    const override = process.env.SELFGUARD_HOME;
+    if (override && override.trim() !== "")
+        return override;
+    return join(homedir(), ".selfguard");
+}
+export const reposDir = () => join(stateRoot(), "repos");
+export const vulnCacheDir = () => join(stateRoot(), "cache", "vulns");
+export const locksDir = () => join(stateRoot(), "locks");
+export const logFile = () => join(stateRoot(), "selfguard.log");

package/dist/repoid.js

@@ -0,0 +1,145 @@
+/**
+ * Identify which repository a project belongs to, so worktrees and separate clones of
+ * the same repo are grouped. Reads a few small files under .git as data; never runs git.
+ */
+import { closeSync, openSync, readSync, realpathSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from "node:path";
+const MAX_FILE = 64 * 1024;
+function readSmall(file) {
+    let fd;
+    try {
+        if (!statSync(file).isFile())
+            return null;
+        fd = openSync(file, "r");
+        const buf = Buffer.alloc(MAX_FILE);
+        const n = readSync(fd, buf, 0, MAX_FILE, 0);
+        return buf.subarray(0, n).toString("utf8");
+    }
+    catch {
+        return null;
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+}
+function isDir(p) {
+    try {
+        return statSync(p).isDirectory();
+    }
+    catch {
+        return false;
+    }
+}
+/** Normalize a git remote to "host/path" (lowercase host, no scheme/user/.git). */
+export function normalizeRemote(url) {
+    const u = url.trim();
+    let host;
+    let path;
+    const scp = /^(?:[^@/\s]+@)?([^:/\s]+):(?!\/)(.+)$/.exec(u); // git@host:owner/repo.git
+    if (scp && !/^[a-z]+:\/\//i.test(u)) {
+        host = scp[1];
+        path = scp[2];
+    }
+    else {
+        try {
+            const parsed = new URL(u);
+            if (!parsed.hostname)
+                return null;
+            host = parsed.hostname;
+            path = parsed.pathname;
+        }
+        catch {
+            return null;
+        }
+    }
+    path = path.replace(/^\/+/, "").replace(/\/+$/, "").replace(/\.git$/i, "");
+    if (!path)
+        return null;
+    return `${host.toLowerCase()}/${path}`;
+}
+/** Minimal INI read of [remote "origin"] url (falls back to the first remote). */
+export function remoteFromConfig(config) {
+    let section = "";
+    let first = null;
+    for (const raw of config.split(/\r?\n/)) {
+        const line = raw.trim();
+        const sec = /^\[\s*remote\s+"([^"]*)"\s*\]$/i.exec(line);
+        if (sec) {
+            section = sec[1];
+            continue;
+        }
+        if (line.startsWith("[")) {
+            section = "";
+            continue;
+        }
+        if (!section)
+            continue;
+        const kv = /^url\s*=\s*(.+)$/i.exec(line);
+        if (!kv)
+            continue;
+        const url = kv[1].trim().replace(/^"(.*)"$/, "$1");
+        if (section === "origin")
+            return url;
+        first ??= url;
+    }
+    return first;
+}
+function branchFrom(head) {
+    if (!head)
+        return null;
+    const ref = /^ref:\s*refs\/heads\/(.+)$/m.exec(head);
+    if (ref)
+        return ref[1].trim();
+    const sha = /^([0-9a-f]{7,64})\s*$/im.exec(head);
+    return sha ? sha[1].slice(0, 8) : null;
+}
+export function repoIdentity(projectRoot) {
+    const home = homedir();
+    let dir = resolve(projectRoot);
+    for (let i = 0; i < 40; i++) {
+        const dotgit = join(dir, ".git");
+        let gitDir = null;
+        let worktree = false;
+        if (isDir(dotgit)) {
+            gitDir = dotgit;
+        }
+        else {
+            const pointer = readSmall(dotgit);
+            const m = pointer ? /^gitdir:\s*(.+)$/m.exec(pointer) : null;
+            if (m) {
+                const target = m[1].trim();
+                gitDir = isAbsolute(target) ? target : resolve(dir, target);
+                worktree = true;
+            }
+        }
+        if (gitDir) {
+            // Linked worktrees point at <common>/.git/worktrees/<name>; "commondir" leads back.
+            const commondir = worktree ? readSmall(join(gitDir, "commondir"))?.trim() : undefined;
+            const commonDir = commondir ? resolve(gitDir, commondir) : gitDir;
+            const remote = remoteFromConfig(readSmall(join(commonDir, "config")) ?? "");
+            const normalized = remote ? normalizeRemote(remote) : null;
+            let base;
+            try {
+                base = normalized ?? `local:${realpathSync(commonDir)}`;
+            }
+            catch {
+                base = `local:${commonDir}`;
+            }
+            const sub = relative(dir, resolve(projectRoot)).split(sep).join("/");
+            const repoName = normalized ? normalized.slice(normalized.indexOf("/") + 1) : basename(dirname(commonDir));
+            return {
+                key: sub ? `${base}#${sub}` : base,
+                label: sub ? `${repoName}/${sub}` : repoName,
+                branch: branchFrom(readSmall(join(gitDir, "HEAD"))),
+                worktree,
+            };
+        }
+        const parent = dirname(dir);
+        if (parent === dir || dir === home)
+            return null;
+        dir = parent;
+    }
+    return null;
+}

package/dist/report.js

@@ -0,0 +1,126 @@
+import { homedir } from "node:os";
+import { severityRank } from "./match.js";
+import { compare, isValid } from "./semver.js";
+import { clean } from "./sanitize.js";
+function useColor(stream) {
+    return Boolean(stream.isTTY) && !process.env.NO_COLOR && process.env.TERM !== "dumb";
+}
+export function paint(stream) {
+    const on = useColor(stream);
+    const wrap = (open, close) => (s) => (on ? `\x1b[${open}m${s}\x1b[${close}m` : s);
+    return {
+        bold: wrap(1, 22),
+        dim: wrap(2, 22),
+        red: wrap(31, 39),
+        yellow: wrap(33, 39),
+        green: wrap(32, 39),
+        magenta: wrap(35, 39),
+        cyan: wrap(36, 39),
+        inverseRed: wrap(41, 49),
+    };
+}
+export function severityLabel(s, c) {
+    switch (s) {
+        case "malicious":
+            return c.inverseRed(c.bold(" MALICIOUS "));
+        case "critical":
+            return c.red(c.bold("CRITICAL"));
+        case "high":
+            return c.red("HIGH");
+        case "moderate":
+            return c.yellow("MODERATE");
+        case "low":
+            return c.dim("LOW");
+        default:
+            return c.dim("UNKNOWN");
+    }
+}
+export function tildify(p) {
+    const home = homedir();
+    return p === home || p.startsWith(`${home}/`) ? `~${p.slice(home.length)}` : p;
+}
+export function countBySeverity(findings) {
+    const counts = {};
+    for (const f of findings)
+        counts[f.severity] = (counts[f.severity] ?? 0) + 1;
+    return counts;
+}
+export function summarizeCounts(findings) {
+    const counts = countBySeverity(findings);
+    const order = ["malicious", "critical", "high", "moderate", "low", "unknown"];
+    return order
+        .filter((s) => counts[s])
+        .map((s) => `${counts[s]} ${s}`)
+        .join(", ");
+}
+export function renderFindings(rec, stream, verbose = false) {
+    const c = paint(stream);
+    const lines = [];
+    const title = `${c.bold(tildify(rec.path))}  ${c.dim(`${rec.deps.length} packages`)}`;
+    lines.push(title);
+    if (rec.error)
+        lines.push(`  ${c.yellow("!")} ${clean(rec.error)}`);
+    if (rec.skipped > 0)
+        lines.push(c.dim(`  ${rec.skipped} entries skipped (git/file/link deps)`));
+    if (rec.findings.length === 0) {
+        if (!rec.error)
+            lines.push(`  ${c.green("✓")} no known vulnerabilities`);
+        return lines.join("\n");
+    }
+    const groups = groupByPackage(rec.findings);
+    lines.push(`  ${groups.length} vulnerable package(s), ${rec.findings.length} advisories: ${summarizeCounts(rec.findings)}`);
+    for (const g of groups) {
+        const pkg = `${clean(g.name, 120)}@${clean(g.version, 60)}`;
+        const tags = [g.direct ? "direct" : "transitive", g.dev ? "dev" : ""].filter(Boolean).join(", ");
+        lines.push("");
+        lines.push(`  ${severityLabel(g.worst, c)} ${c.bold(pkg)} ${c.dim(`(${tags})`)}`);
+        if (g.worst === "malicious") {
+            lines.push(`    ${c.red("→ remove it now and rotate any credentials available on this machine/CI")}`);
+        }
+        else if (g.upgradeTo) {
+            const partial = g.unfixed > 0 ? c.yellow(` (${g.unfixed} advisory(ies) have no fix yet)`) : "";
+            lines.push(`    ${c.green(`→ upgrade to ${clean(g.upgradeTo, 60)} or later`)}${partial}`);
+        }
+        else {
+            lines.push(`    ${c.yellow("→ no fixed version published; consider replacing it")}`);
+        }
+        const shown = verbose ? g.findings : g.findings.slice(0, 3);
+        for (const f of shown) {
+            lines.push(`    ${c.dim("•")} ${clean(f.id, 64)} ${c.dim(f.severity)}${f.summary ? ` ${clean(f.summary, 90)}` : ""}`);
+        }
+        if (shown.length < g.findings.length)
+            lines.push(c.dim(`    • …and ${g.findings.length - shown.length} more (--verbose)`));
+    }
+    lines.push("");
+    lines.push(c.dim("  Details: https://osv.dev/vulnerability/<ID>"));
+    return lines.join("\n");
+}
+export function worstSeverity(findings) {
+    const order = ["malicious", "critical", "high", "moderate", "low", "unknown"];
+    for (const s of order)
+        if (findings.some((f) => f.severity === s))
+            return s;
+    return null;
+}
+export function groupByPackage(findings) {
+    const map = new Map();
+    for (const f of findings) {
+        const key = `${f.name}@${f.version}`;
+        let g = map.get(key);
+        if (!g) {
+            g = { name: f.name, version: f.version, direct: f.direct, dev: f.dev, worst: f.severity, findings: [], unfixed: 0 };
+            map.set(key, g);
+        }
+        g.findings.push(f);
+        if (severityRank(f.severity) < severityRank(g.worst))
+            g.worst = f.severity;
+        if (f.fixedIn && isValid(f.fixedIn)) {
+            if (!g.upgradeTo || compare(f.fixedIn, g.upgradeTo) > 0)
+                g.upgradeTo = f.fixedIn;
+        }
+        else {
+            g.unfixed++;
+        }
+    }
+    return [...map.values()].sort((a, b) => severityRank(a.worst) - severityRank(b.worst) || Number(b.direct) - Number(a.direct) || a.name.localeCompare(b.name));
+}

package/dist/sanitize.js

@@ -0,0 +1,12 @@
+/**
+ * Everything we print comes from untrusted sources (lockfiles, advisory text).
+ * Strip control characters so nobody can inject terminal escape sequences
+ * (cursor movement, OSC 8 links, title changes, clipboard writes...) and
+ * bidirectional overrides ("Trojan Source" style spoofing).
+ */
+const CONTROL = new RegExp("[\\u0000-\\u0008\\u000B-\\u001F\\u007F-\\u009F\\u200E\\u200F\\u202A-\\u202E\\u2066-\\u2069]", "g");
+export function clean(input, maxLen = 300, opts = {}) {
+    const stripped = String(input ?? "").replace(CONTROL, "");
+    const s = (opts.multiline ? stripped.replace(/\n{3,}/g, "\n\n") : stripped.replace(/\s*\n\s*/g, " ")).trim();
+    return s.length > maxLen ? `${s.slice(0, maxLen - 1)}…` : s;
+}

package/dist/scan.js

@@ -0,0 +1,168 @@
+import { readFileSync, statSync } from "node:fs";
+import { join } from "node:path";
+import { sha256 } from "./fsutil.js";
+import { isSupported, parseLockfile } from "./lockfile/index.js";
+import { evaluate, severityOf, severityRank } from "./match.js";
+import { getVulns, queryBatch } from "./osv.js";
+import { clean } from "./sanitize.js";
+import { findingKey, loadRepo } from "./store.js";
+const MAX_LOCKFILE_BYTES = 100 * 1024 * 1024;
+export function lockState(lockfile) {
+    try {
+        const st = statSync(lockfile);
+        if (!st.isFile() || st.size > MAX_LOCKFILE_BYTES)
+            return null;
+        return { hash: sha256(readFileSync(lockfile)), mtimeMs: st.mtimeMs, size: st.size };
+    }
+    catch {
+        return null;
+    }
+}
+/** Cheap check first (mtime+size), hash only if those changed. */
+export function lockChanged(rec, project) {
+    if (rec.lockfile !== project.lockfile)
+        return true;
+    if (!project.lockfile)
+        return false;
+    try {
+        const st = statSync(project.lockfile);
+        if (st.mtimeMs === rec.lockMtimeMs && st.size === rec.lockSize)
+            return false;
+    }
+    catch {
+        return true;
+    }
+    return lockState(project.lockfile)?.hash !== rec.lockHash;
+}
+/** Parse a project's lockfile into a fresh (findings-less) record. Never executes project code. */
+function inventory(project) {
+    const previous = loadRepo(project.root);
+    const now = new Date().toISOString();
+    const record = {
+        schema: 1,
+        path: project.root,
+        lockfile: project.lockfile,
+        lockType: project.lockType,
+        lockHash: null,
+        lockMtimeMs: null,
+        lockSize: null,
+        registeredAt: previous?.registeredAt ?? now,
+        scannedAt: null,
+        deps: [],
+        skipped: 0,
+        findings: [],
+    };
+    if (!project.lockfile || !project.lockType) {
+        record.error = "no lockfile found (run your package manager's install to create one)";
+        record.scannedAt = now;
+        return { record, previous };
+    }
+    const st = lockState(project.lockfile);
+    if (!st) {
+        record.error = "lockfile unreadable or too large";
+        record.scannedAt = now;
+        return { record, previous };
+    }
+    Object.assign(record, { lockHash: st.hash, lockMtimeMs: st.mtimeMs, lockSize: st.size });
+    if (!isSupported(project.lockType, project.lockfile)) {
+        record.error = "bun.lockb (binary) is not supported; run `bun install --save-text-lockfile` to create bun.lock";
+        record.scannedAt = now;
+        return { record, previous };
+    }
+    try {
+        let manifest;
+        try {
+            manifest = JSON.parse(readFileSync(join(project.root, "package.json"), "utf8"));
+        }
+        catch {
+            manifest = undefined;
+        }
+        const parsed = parseLockfile(project.lockType, readFileSync(project.lockfile, "utf8"), manifest);
+        record.deps = parsed.deps;
+        record.skipped = parsed.skipped;
+    }
+    catch (err) {
+        record.error = `could not parse lockfile: ${clean(err.message, 200)}`;
+        record.scannedAt = now;
+    }
+    return { record, previous };
+}
+function buildFindings(deps, refsPerDep, vulns, previous, now) {
+    const prevSeen = new Map((previous?.findings ?? []).map((f) => [findingKey(f), f.firstSeen]));
+    const findings = [];
+    for (const dep of deps) {
+        const ids = refsPerDep.get(`${dep.name}@${dep.version}`) ?? [];
+        const reported = new Set();
+        for (const id of ids) {
+            const vuln = vulns.get(id);
+            if (vuln?.withdrawn)
+                continue;
+            // Collapse duplicates published under several ids (e.g. GHSA + CVE alias).
+            if (vuln?.aliases?.some((a) => reported.has(a)) || reported.has(id))
+                continue;
+            reported.add(id);
+            const ev = vuln ? evaluate(vuln, dep.name, dep.version) : { affected: true };
+            const f = {
+                id,
+                aliases: (vuln?.aliases ?? []).map((a) => clean(a, 64)).slice(0, 10),
+                severity: vuln ? severityOf(vuln) : id.startsWith("MAL-") ? "malicious" : "unknown",
+                summary: clean(vuln?.summary ?? vuln?.details ?? "", 200),
+                name: dep.name,
+                version: dep.version,
+                direct: dep.direct,
+                dev: dep.dev,
+                firstSeen: "",
+            };
+            if (ev.fixedIn)
+                f.fixedIn = ev.fixedIn;
+            f.firstSeen = prevSeen.get(findingKey(f)) ?? now;
+            findings.push(f);
+        }
+    }
+    return findings.sort((a, b) => severityRank(a.severity) - severityRank(b.severity) || Number(b.direct) - Number(a.direct) || a.name.localeCompare(b.name));
+}
+/**
+ * Scan one or many projects with a single deduplicated OSV query.
+ * Records are returned, not saved: the caller decides.
+ */
+export async function scanProjects(projects) {
+    const inventories = projects.map(inventory);
+    const unique = new Map();
+    for (const { record } of inventories) {
+        if (record.error)
+            continue;
+        for (const d of record.deps)
+            unique.set(`${d.name}@${d.version}`, { name: d.name, version: d.version });
+    }
+    const queries = [...unique.values()];
+    let refsPerDep = new Map();
+    let vulns = new Map();
+    let networkError;
+    if (queries.length > 0) {
+        try {
+            const refs = await queryBatch(queries);
+            refsPerDep = new Map(queries.map((q, i) => [`${q.name}@${q.version}`, refs[i].map((r) => r.id)]));
+            vulns = await getVulns(refs.flat());
+        }
+        catch (err) {
+            networkError = `could not reach OSV: ${clean(err.message, 200)}`;
+        }
+    }
+    const now = new Date().toISOString();
+    return inventories.map(({ record, previous }) => {
+        if (networkError && !record.error) {
+            // Keep the last known findings rather than pretending everything is fine.
+            record.error = networkError;
+            record.findings = previous?.findings ?? [];
+            record.scannedAt = previous?.scannedAt ?? null;
+            return { record, newFindings: [], firstScan: previous === null };
+        }
+        if (!record.error) {
+            record.findings = buildFindings(record.deps, refsPerDep, vulns, previous, now);
+            record.scannedAt = now;
+        }
+        const before = new Set((previous?.findings ?? []).map(findingKey));
+        const newFindings = record.findings.filter((f) => !before.has(findingKey(f)));
+        return { record, newFindings, firstScan: previous === null };
+    });
+}

package/dist/schedule.js

@@ -0,0 +1,82 @@
+/** Periodic `selfguard sync` via a per-user launchd agent (macOS). */
+import { execFileSync } from "node:child_process";
+import { existsSync, rmSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { join } from "node:path";
+import { atomicWrite } from "./fsutil.js";
+import { cliEntry } from "./hook.js";
+import { logFile } from "./paths.js";
+const LABEL = "dev.selfguard.sync";
+const plistPath = () => join(homedir(), "Library", "LaunchAgents", `${LABEL}.plist`);
+const domain = () => `gui/${userInfo().uid}`;
+function xml(s) {
+    return s.replace(/&/g, "&amp;").replace(/</g, "&lt;").replace(/>/g, "&gt;").replace(/"/g, "&quot;");
+}
+export function parseInterval(input) {
+    const m = /^(\d+)\s*(m|h|d)$/.exec(input.trim());
+    if (!m)
+        throw new Error(`invalid interval "${input}" (use e.g. 30m, 6h, 1d)`);
+    const n = Number(m[1]) * { m: 60, h: 3600, d: 86400 }[m[2]];
+    if (n < 15 * 60)
+        throw new Error("minimum interval is 15m");
+    return n;
+}
+function assertMac() {
+    if (process.platform !== "darwin")
+        throw new Error("scheduling is only implemented for macOS (launchd) for now");
+}
+export function scheduleOn(seconds) {
+    assertMac();
+    const args = [process.execPath, cliEntry(), "sync", "--background"];
+    const plist = `<?xml version="1.0" encoding="UTF-8"?>
+<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
+<plist version="1.0">
+<dict>
+  <key>Label</key><string>${LABEL}</string>
+  <key>ProgramArguments</key>
+  <array>
+${args.map((a) => `    <string>${xml(a)}</string>`).join("\n")}
+  </array>
+  <key>StartInterval</key><integer>${seconds}</integer>
+  <key>RunAtLoad</key><true/>
+  <key>ProcessType</key><string>Background</string>
+  <key>LowPriorityIO</key><true/>
+  <key>StandardOutPath</key><string>${xml(logFile())}</string>
+  <key>StandardErrorPath</key><string>${xml(logFile())}</string>
+</dict>
+</plist>
+`;
+    try {
+        execFileSync("/bin/launchctl", ["bootout", `${domain()}/${LABEL}`], { stdio: "ignore" });
+    }
+    catch {
+        /* not loaded */
+    }
+    atomicWrite(plistPath(), plist);
+    execFileSync("/bin/launchctl", ["bootstrap", domain(), plistPath()], { stdio: "ignore" });
+    return plistPath();
+}
+export function scheduleOff() {
+    assertMac();
+    try {
+        execFileSync("/bin/launchctl", ["bootout", `${domain()}/${LABEL}`], { stdio: "ignore" });
+    }
+    catch {
+        /* not loaded */
+    }
+    const existed = existsSync(plistPath());
+    rmSync(plistPath(), { force: true });
+    return existed;
+}
+export function scheduleStatus() {
+    assertMac();
+    let loaded = false;
+    try {
+        execFileSync("/bin/launchctl", ["print", `${domain()}/${LABEL}`], { stdio: "ignore" });
+        loaded = true;
+    }
+    catch {
+        loaded = false;
+    }
+    return { installed: existsSync(plistPath()), loaded, plist: plistPath() };
+}