sessionlog 0.0.1

package/dist/utils/tree-ops.js

@@ -0,0 +1,145 @@
+/**
+ * Git Tree Manipulation
+ *
+ * Structured tree operations for building and modifying git tree objects.
+ * Provides higher-level abstractions over raw `git mktree` / `git ls-tree`.
+ *
+ * Ported from Go: checkpoint/parse_tree.go
+ */
+import { lsTree, mktree, hashObject } from '../git-operations.js';
+// ============================================================================
+// Tree Operations
+// ============================================================================
+/**
+ * Update (or create) a subtree at a given path within a root tree.
+ *
+ * @param rootTree - The root tree hash (or empty string for a new tree)
+ * @param subtreePath - The path to the subtree (e.g., "a3/b2c4d5e6f7")
+ * @param newSubtreeHash - The hash of the new subtree to place at path
+ * @param mergeMode - How to handle existing entries at the path
+ * @param cwd - Working directory for git commands
+ */
+export async function updateSubtree(rootTree, subtreePath, newSubtreeHash, mergeMode = 0 /* MergeMode.ReplaceAll */, cwd) {
+    const parts = subtreePath.split('/').filter(Boolean);
+    if (parts.length === 0)
+        return newSubtreeHash;
+    // Walk the tree path, collecting existing entries at each level
+    return updateSubtreeRecursive(rootTree, parts, 0, newSubtreeHash, mergeMode, cwd);
+}
+async function updateSubtreeRecursive(currentTree, pathParts, depth, newSubtreeHash, mergeMode, cwd) {
+    const targetName = pathParts[depth];
+    const isLeaf = depth === pathParts.length - 1;
+    // Get existing entries at this tree level
+    let existingEntries = [];
+    if (currentTree) {
+        try {
+            existingEntries = await lsTree(currentTree, undefined, cwd);
+        }
+        catch {
+            // Tree doesn't exist or is empty
+        }
+    }
+    if (isLeaf) {
+        let finalHash = newSubtreeHash;
+        // If merge mode, combine existing and new entries
+        if (mergeMode === 1 /* MergeMode.MergeKeepExisting */) {
+            const existingEntry = existingEntries.find((e) => e.name === targetName);
+            if (existingEntry && existingEntry.type === 'tree') {
+                finalHash = await mergeTreesKeepExisting(existingEntry.hash, newSubtreeHash, cwd);
+            }
+        }
+        // Replace or add the entry at this level
+        const filtered = existingEntries.filter((e) => e.name !== targetName);
+        filtered.push({
+            mode: '040000',
+            type: 'tree',
+            hash: finalHash,
+            name: targetName,
+        });
+        return mktree(filtered, cwd);
+    }
+    // Intermediate level: find or create the subtree
+    const existingEntry = existingEntries.find((e) => e.name === targetName);
+    const childTree = existingEntry?.hash ?? '';
+    const updatedChildHash = await updateSubtreeRecursive(childTree, pathParts, depth + 1, newSubtreeHash, mergeMode, cwd);
+    const filtered = existingEntries.filter((e) => e.name !== targetName);
+    filtered.push({
+        mode: '040000',
+        type: 'tree',
+        hash: updatedChildHash,
+        name: targetName,
+    });
+    return mktree(filtered, cwd);
+}
+/**
+ * Merge two trees, keeping existing entries when conflicts arise.
+ */
+async function mergeTreesKeepExisting(existingTreeHash, newTreeHash, cwd) {
+    const existingEntries = await lsTree(existingTreeHash, undefined, cwd);
+    const newEntries = await lsTree(newTreeHash, undefined, cwd);
+    const existingNames = new Set(existingEntries.map((e) => e.name));
+    const merged = [...existingEntries];
+    for (const entry of newEntries) {
+        if (!existingNames.has(entry.name)) {
+            merged.push(entry);
+        }
+    }
+    return mktree(merged, cwd);
+}
+/**
+ * Apply a batch of file-level changes to a tree.
+ * Returns the hash of the new root tree.
+ */
+export async function applyTreeChanges(rootTree, changes, cwd) {
+    if (changes.length === 0)
+        return rootTree;
+    // Get existing entries
+    let entries = [];
+    if (rootTree) {
+        try {
+            entries = await lsTree(rootTree, undefined, cwd);
+        }
+        catch {
+            // Empty tree
+        }
+    }
+    for (const change of changes) {
+        if (change.deleted) {
+            entries = entries.filter((e) => e.name !== change.path);
+        }
+        else {
+            const existing = entries.findIndex((e) => e.name === change.path);
+            const entry = {
+                mode: change.mode,
+                type: change.mode === '040000' ? 'tree' : 'blob',
+                hash: change.hash,
+                name: change.path,
+            };
+            if (existing >= 0) {
+                entries[existing] = entry;
+            }
+            else {
+                entries.push(entry);
+            }
+        }
+    }
+    return mktree(entries, cwd);
+}
+/**
+ * Create a tree from a map of file paths to content strings.
+ * Useful for building trees from scratch in tests.
+ */
+export async function createTreeFromMap(files, cwd) {
+    const entries = [];
+    for (const [name, content] of Object.entries(files)) {
+        const hash = await hashObject(content, cwd);
+        entries.push({
+            mode: '100644',
+            type: 'blob',
+            hash,
+            name,
+        });
+    }
+    return mktree(entries, cwd);
+}
+//# sourceMappingURL=tree-ops.js.map

package/dist/utils/tree-ops.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tree-ops.js","sourceRoot":"","sources":["../../src/utils/tree-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,sBAAsB,CAAC;AA2BlE,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,QAAgB,EAChB,WAAmB,EACnB,cAAsB,EACtB,wCAA2C,EAC3C,GAAY;IAEZ,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACrD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAE9C,gEAAgE;IAChE,OAAO,sBAAsB,CAAC,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,cAAc,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;AACpF,CAAC;AAED,KAAK,UAAU,sBAAsB,CACnC,WAAmB,EACnB,SAAmB,EACnB,KAAa,EACb,cAAsB,EACtB,SAAoB,EACpB,GAAY;IAEZ,MAAM,UAAU,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC;IACpC,MAAM,MAAM,GAAG,KAAK,KAAK,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;IAE9C,0CAA0C;IAC1C,IAAI,eAAe,GAAgB,EAAE,CAAC;IACtC,IAAI,WAAW,EAAE,CAAC;QAChB,IAAI,CAAC;YACH,eAAe,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QAC9D,CAAC;QAAC,MAAM,CAAC;YACP,iCAAiC;QACnC,CAAC;IACH,CAAC;IAED,IAAI,MAAM,EAAE,CAAC;QACX,IAAI,SAAS,GAAG,cAAc,CAAC;QAE/B,kDAAkD;QAClD,IAAI,SAAS,wCAAgC,EAAE,CAAC;YAC9C,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;YACzE,IAAI,aAAa,IAAI,aAAa,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;gBACnD,SAAS,GAAG,MAAM,sBAAsB,CAAC,aAAa,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,CAAC;YACpF,CAAC;QACH,CAAC;QAED,yCAAyC;QACzC,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;QACtE,QAAQ,CAAC,IAAI,CAAC;YACZ,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,MAAM;YACZ,IAAI,EAAE,SAAS;YACf,IAAI,EAAE,UAAU;SACjB,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAC/B,CAAC;IAED,iDAAiD;IACjD,MAAM,aAAa,GAAG,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACzE,MAAM,SAAS,GAAG,aAAa,EAAE,IAAI,IAAI,EAAE,CAAC;IAE5C,MAAM,gBAAgB,GAAG,MAAM,sBAAsB,CACnD,SAAS,EACT,SAAS,EACT,KAAK,GAAG,CAAC,EACT,cAAc,EACd,SAAS,EACT,GAAG,CACJ,CAAC;IAEF,MAAM,QAAQ,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,UAAU,CAAC,CAAC;IACtE,QAAQ,CAAC,IAAI,CAAC;QACZ,IAAI,EAAE,QAAQ;QACd,IAAI,EAAE,MAAM;QACZ,IAAI,EAAE,gBAAgB;QACtB,IAAI,EAAE,UAAU;KACjB,CAAC,CAAC;IAEH,OAAO,MAAM,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,sBAAsB,CACnC,gBAAwB,EACxB,WAAmB,EACnB,GAAY;IAEZ,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IACvE,MAAM,UAAU,GAAG,MAAM,MAAM,CAAC,WAAW,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;IAE7D,MAAM,aAAa,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAClE,MAAM,MAAM,GAAG,CAAC,GAAG,eAAe,CAAC,CAAC;IAEpC,KAAK,MAAM,KAAK,IAAI,UAAU,EAAE,CAAC;QAC/B,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACnC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC7B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,QAAgB,EAChB,OAAqB,EACrB,GAAY;IAEZ,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAE1C,uBAAuB;IACvB,IAAI,OAAO,GAAgB,EAAE,CAAC;IAC9B,IAAI,QAAQ,EAAE,CAAC;QACb,IAAI,CAAC;YACH,OAAO,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC;QACnD,CAAC;QAAC,MAAM,CAAC;YACP,aAAa;QACf,CAAC;IACH,CAAC;IAED,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC;aAAM,CAAC;YACN,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;YAClE,MAAM,KAAK,GAAc;gBACvB,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM;gBAChD,IAAI,EAAE,MAAM,CAAC,IAAI;gBACjB,IAAI,EAAE,MAAM,CAAC,IAAI;aAClB,CAAC;YACF,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;gBAClB,OAAO,CAAC,QAAQ,CAAC,GAAG,KAAK,CAAC;YAC5B,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtB,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CACrC,KAA6B,EAC7B,GAAY;IAEZ,MAAM,OAAO,GAAgB,EAAE,CAAC;IAEhC,KAAK,MAAM,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QAC5C,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ;YACd,IAAI,EAAE,MAAM;YACZ,IAAI;YACJ,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IAED,OAAO,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC"}

package/dist/utils/tty.d.ts

@@ -0,0 +1,25 @@
+/**
+ * TTY Interaction Helpers
+ *
+ * Utilities for detecting and interacting with a controlling terminal.
+ * Important for git hooks which need user confirmation even when stdin
+ * is redirected.
+ *
+ * Ported from Go: strategy/manual_commit_hooks.go
+ */
+/**
+ * Detect if a controlling terminal (TTY) is available.
+ *
+ * Respects environment variables:
+ * - `ENTIRE_TEST_TTY=1` forces TTY detection to true (for testing)
+ * - `GEMINI_CLI=1` forces TTY detection to false (Gemini runs non-interactively)
+ */
+export declare function hasTTY(): boolean;
+/**
+ * Prompt the user for yes/no confirmation via /dev/tty.
+ *
+ * This works even when stdin is redirected (important for git hooks).
+ * Returns false if no TTY is available or the user declines.
+ */
+export declare function askConfirmTTY(prompt: string): Promise<boolean>;
+//# sourceMappingURL=tty.d.ts.map

package/dist/utils/tty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.d.ts","sourceRoot":"","sources":["../../src/utils/tty.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAKH;;;;;;GAMG;AACH,wBAAgB,MAAM,IAAI,OAAO,CAahC;AAED;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CA8BpE"}

package/dist/utils/tty.js

@@ -0,0 +1,70 @@
+/**
+ * TTY Interaction Helpers
+ *
+ * Utilities for detecting and interacting with a controlling terminal.
+ * Important for git hooks which need user confirmation even when stdin
+ * is redirected.
+ *
+ * Ported from Go: strategy/manual_commit_hooks.go
+ */
+import * as fs from 'node:fs';
+import * as readline from 'node:readline';
+/**
+ * Detect if a controlling terminal (TTY) is available.
+ *
+ * Respects environment variables:
+ * - `ENTIRE_TEST_TTY=1` forces TTY detection to true (for testing)
+ * - `GEMINI_CLI=1` forces TTY detection to false (Gemini runs non-interactively)
+ */
+export function hasTTY() {
+    // Check environment overrides
+    if (process.env.ENTIRE_TEST_TTY === '1')
+        return true;
+    if (process.env.GEMINI_CLI === '1')
+        return false;
+    // Try opening /dev/tty — this works even when stdin is redirected
+    try {
+        const fd = fs.openSync('/dev/tty', 'r');
+        fs.closeSync(fd);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * Prompt the user for yes/no confirmation via /dev/tty.
+ *
+ * This works even when stdin is redirected (important for git hooks).
+ * Returns false if no TTY is available or the user declines.
+ */
+export async function askConfirmTTY(prompt) {
+    if (!hasTTY())
+        return false;
+    let ttyIn;
+    let ttyOut;
+    try {
+        ttyIn = fs.createReadStream('/dev/tty');
+        ttyOut = fs.createWriteStream('/dev/tty');
+        const rl = readline.createInterface({
+            input: ttyIn,
+            output: ttyOut,
+        });
+        const result = await new Promise((resolve) => {
+            rl.question(`${prompt} [y/N] `, (answer) => {
+                rl.close();
+                const normalized = answer.trim().toLowerCase();
+                resolve(normalized === 'y' || normalized === 'yes');
+            });
+        });
+        return result;
+    }
+    catch {
+        return false;
+    }
+    finally {
+        ttyIn?.destroy();
+        ttyOut?.destroy();
+    }
+}
+//# sourceMappingURL=tty.js.map

package/dist/utils/tty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.js","sourceRoot":"","sources":["../../src/utils/tty.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,QAAQ,MAAM,eAAe,CAAC;AAE1C;;;;;;GAMG;AACH,MAAM,UAAU,MAAM;IACpB,8BAA8B;IAC9B,IAAI,OAAO,CAAC,GAAG,CAAC,eAAe,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,OAAO,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IAEjD,kEAAkE;IAClE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,EAAE,CAAC,QAAQ,CAAC,UAAU,EAAE,GAAG,CAAC,CAAC;QACxC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QACjB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,MAAc;IAChD,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,KAAK,CAAC;IAE5B,IAAI,KAAgC,CAAC;IACrC,IAAI,MAAkC,CAAC;IAEvC,IAAI,CAAC;QACH,KAAK,GAAG,EAAE,CAAC,gBAAgB,CAAC,UAAU,CAAC,CAAC;QACxC,MAAM,GAAG,EAAE,CAAC,iBAAiB,CAAC,UAAU,CAAC,CAAC;QAE1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC;YAClC,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,MAAM;SACf,CAAC,CAAC;QAEH,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAU,CAAC,OAAO,EAAE,EAAE;YACpD,EAAE,CAAC,QAAQ,CAAC,GAAG,MAAM,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;gBACzC,EAAE,CAAC,KAAK,EAAE,CAAC;gBACX,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;gBAC/C,OAAO,CAAC,UAAU,KAAK,GAAG,IAAI,UAAU,KAAK,KAAK,CAAC,CAAC;YACtD,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QAEH,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;YAAS,CAAC;QACT,KAAK,EAAE,OAAO,EAAE,CAAC;QACjB,MAAM,EAAE,OAAO,EAAE,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/utils/validation.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Input Validation
+ *
+ * Validates user-supplied IDs to prevent path traversal attacks when
+ * IDs are used to construct file paths (session state, metadata, etc.).
+ *
+ * This module has no dependencies to avoid import cycles.
+ */
+/**
+ * Validate that a session ID doesn't contain path separators.
+ * Prevents path traversal when session IDs are used in file paths.
+ */
+export declare function validateSessionID(id: string): void;
+/**
+ * Validate that a tool use ID contains only safe characters for paths.
+ * Tool use IDs can be UUIDs or prefixed identifiers like "toolu_xxx".
+ * Empty is allowed (optional field).
+ */
+export declare function validateToolUseID(id: string): void;
+/**
+ * Validate that an agent ID contains only safe characters for paths.
+ * Empty is allowed (optional field).
+ */
+export declare function validateAgentID(id: string): void;
+/**
+ * Validate that an agent session ID contains only safe characters for paths.
+ * Agent session IDs can be UUIDs (Claude Code), test identifiers, or other
+ * formats depending on the agent.
+ */
+export declare function validateAgentSessionID(id: string): void;
+//# sourceMappingURL=validation.d.ts.map

package/dist/utils/validation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.d.ts","sourceRoot":"","sources":["../../src/utils/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAKH;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAOlD;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAOlD;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAKhD;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CASvD"}

package/dist/utils/validation.js

@@ -0,0 +1,59 @@
+/**
+ * Input Validation
+ *
+ * Validates user-supplied IDs to prevent path traversal attacks when
+ * IDs are used to construct file paths (session state, metadata, etc.).
+ *
+ * This module has no dependencies to avoid import cycles.
+ */
+/** Matches alphanumeric characters, underscores, and hyphens only. */
+const pathSafeRegex = /^[a-zA-Z0-9_-]+$/;
+/**
+ * Validate that a session ID doesn't contain path separators.
+ * Prevents path traversal when session IDs are used in file paths.
+ */
+export function validateSessionID(id) {
+    if (!id) {
+        throw new Error('session ID cannot be empty');
+    }
+    if (id.includes('/') || id.includes('\\')) {
+        throw new Error(`invalid session ID "${id}": contains path separators`);
+    }
+}
+/**
+ * Validate that a tool use ID contains only safe characters for paths.
+ * Tool use IDs can be UUIDs or prefixed identifiers like "toolu_xxx".
+ * Empty is allowed (optional field).
+ */
+export function validateToolUseID(id) {
+    if (!id)
+        return;
+    if (!pathSafeRegex.test(id)) {
+        throw new Error(`invalid tool use ID "${id}": must be alphanumeric with underscores/hyphens only`);
+    }
+}
+/**
+ * Validate that an agent ID contains only safe characters for paths.
+ * Empty is allowed (optional field).
+ */
+export function validateAgentID(id) {
+    if (!id)
+        return;
+    if (!pathSafeRegex.test(id)) {
+        throw new Error(`invalid agent ID "${id}": must be alphanumeric with underscores/hyphens only`);
+    }
+}
+/**
+ * Validate that an agent session ID contains only safe characters for paths.
+ * Agent session IDs can be UUIDs (Claude Code), test identifiers, or other
+ * formats depending on the agent.
+ */
+export function validateAgentSessionID(id) {
+    if (!id) {
+        throw new Error('agent session ID cannot be empty');
+    }
+    if (!pathSafeRegex.test(id)) {
+        throw new Error(`invalid agent session ID "${id}": must be alphanumeric with underscores/hyphens only`);
+    }
+}
+//# sourceMappingURL=validation.js.map

package/dist/utils/validation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"validation.js","sourceRoot":"","sources":["../../src/utils/validation.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,sEAAsE;AACtE,MAAM,aAAa,GAAG,kBAAkB,CAAC;AAEzC;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,IAAI,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC1C,MAAM,IAAI,KAAK,CAAC,uBAAuB,EAAE,6BAA6B,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iBAAiB,CAAC,EAAU;IAC1C,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,wBAAwB,EAAE,uDAAuD,CAClF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,eAAe,CAAC,EAAU;IACxC,IAAI,CAAC,EAAE;QAAE,OAAO;IAChB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CAAC,qBAAqB,EAAE,uDAAuD,CAAC,CAAC;IAClG,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,EAAU;IAC/C,IAAI,CAAC,EAAE,EAAE,CAAC;QACR,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,6BAA6B,EAAE,uDAAuD,CACvF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/utils/worktree.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Git Worktree Utilities
+ *
+ * Provides detection and identification of git worktrees.
+ * Linked worktrees have `.git` as a file pointing to the main repository,
+ * while the main worktree has `.git` as a directory.
+ */
+/**
+ * Get the internal git worktree identifier for the given path.
+ *
+ * - For the main worktree (where .git is a directory), returns empty string.
+ * - For linked worktrees (where .git is a file), extracts the name from
+ *   `.git/worktrees/<name>/` path. This name is stable across `git worktree move`.
+ */
+export declare function getWorktreeID(worktreePath: string): Promise<string>;
+//# sourceMappingURL=worktree.d.ts.map

package/dist/utils/worktree.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.d.ts","sourceRoot":"","sources":["../../src/utils/worktree.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAKH;;;;;;GAMG;AACH,wBAAsB,aAAa,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCzE"}

package/dist/utils/worktree.js

@@ -0,0 +1,50 @@
+/**
+ * Git Worktree Utilities
+ *
+ * Provides detection and identification of git worktrees.
+ * Linked worktrees have `.git` as a file pointing to the main repository,
+ * while the main worktree has `.git` as a directory.
+ */
+import * as fs from 'node:fs';
+import * as path from 'node:path';
+/**
+ * Get the internal git worktree identifier for the given path.
+ *
+ * - For the main worktree (where .git is a directory), returns empty string.
+ * - For linked worktrees (where .git is a file), extracts the name from
+ *   `.git/worktrees/<name>/` path. This name is stable across `git worktree move`.
+ */
+export async function getWorktreeID(worktreePath) {
+    const gitPath = path.join(worktreePath, '.git');
+    let stat;
+    try {
+        stat = await fs.promises.stat(gitPath);
+    }
+    catch {
+        throw new Error(`failed to stat .git: ${gitPath}`);
+    }
+    // Main worktree has .git as a directory
+    if (stat.isDirectory()) {
+        return '';
+    }
+    // Linked worktree has .git as a file with content: "gitdir: /path/to/.git/worktrees/<name>"
+    const content = await fs.promises.readFile(gitPath, 'utf-8');
+    const line = content.trim();
+    if (!line.startsWith('gitdir: ')) {
+        throw new Error(`invalid .git file format: ${line}`);
+    }
+    const gitdir = line.slice('gitdir: '.length);
+    // Extract worktree name from path like /repo/.git/worktrees/<name>
+    const marker = '.git/worktrees/';
+    const idx = gitdir.indexOf(marker);
+    if (idx === -1) {
+        throw new Error(`unexpected gitdir format (no worktrees): ${gitdir}`);
+    }
+    let worktreeID = gitdir.slice(idx + marker.length);
+    // Remove trailing slashes if any
+    if (worktreeID.endsWith('/')) {
+        worktreeID = worktreeID.slice(0, -1);
+    }
+    return worktreeID;
+}
+//# sourceMappingURL=worktree.js.map

package/dist/utils/worktree.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worktree.js","sourceRoot":"","sources":["../../src/utils/worktree.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,YAAoB;IACtD,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAEhD,IAAI,IAAc,CAAC;IACnB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,wBAAwB,OAAO,EAAE,CAAC,CAAC;IACrD,CAAC;IAED,wCAAwC;IACxC,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QACvB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,4FAA4F;IAC5F,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IAC7D,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAE5B,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;IAE7C,mEAAmE;IACnE,MAAM,MAAM,GAAG,iBAAiB,CAAC;IACjC,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACnC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,IAAI,KAAK,CAAC,4CAA4C,MAAM,EAAE,CAAC,CAAC;IACxE,CAAC;IAED,IAAI,UAAU,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IACnD,iCAAiC;IACjC,IAAI,UAAU,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7B,UAAU,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,UAAU,CAAC;AACpB,CAAC"}

package/package.json

@@ -0,0 +1,64 @@
+{
+  "name": "sessionlog",
+  "version": "0.0.1",
+  "description": "Session tracking and checkpoint management for AI coding agents",
+  "type": "module",
+  "main": "./dist/index.js",
+  "module": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "entire": "./dist/cli.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "scripts": {
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "prepublishOnly": "npm run build",
+    "version:patch": "npm version patch && git push && git push --tags",
+    "version:minor": "npm version minor && git push && git push --tags",
+    "version:major": "npm version major && git push && git push --tags",
+    "publish:npm": "npm run build && npm publish",
+    "lint": "eslint src/",
+    "lint:fix": "eslint src/ --fix",
+    "format": "prettier --write \"src/**/*.{ts,js,json}\"",
+    "format:check": "prettier --check \"src/**/*.{ts,js,json}\"",
+    "prepare": "husky"
+  },
+  "keywords": [
+    "entire",
+    "git",
+    "session-tracking",
+    "checkpoints",
+    "ai-agents"
+  ],
+  "author": "Alex Ngai",
+  "license": "MIT",
+  "devDependencies": {
+    "@eslint/js": "^9.39.2",
+    "@types/node": "^25.0.10",
+    "eslint": "^9.39.2",
+    "eslint-config-prettier": "^10.1.8",
+    "husky": "^9.1.7",
+    "lint-staged": "^15.5.2",
+    "prettier": "^3.8.1",
+    "typescript": "^5.3.0",
+    "typescript-eslint": "^8.55.0",
+    "vitest": "^4.0.18"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/alexngai/entire-cli.git"
+  }
+}