sessionpipe 0.4.0 → 0.5.0

package/dist/launcher.d.ts

@@ -0,0 +1,31 @@
+export declare const LAUNCHER = "sessionpipe-hook";
+export declare function dataDir(env?: NodeJS.ProcessEnv): string;
+export declare const launcherPath: (env?: NodeJS.ProcessEnv) => string;
+export declare const usesLauncher: (platform?: NodeJS.Platform) => boolean;
+/** The launcher, in sh. No node at all prints what Antigravity needs and exits 0: the
+ *  hook must stay invisible to the harness whatever is missing. */
+export declare function launcherScript(node: string, hook: string, version: string): string;
+/** Copy the hook and worker out of the npm install and (re)write the launcher. The
+ *  worker goes first, so a hook that starts mid-copy never spawns a missing one. */
+export declare function installLauncher(o: {
+    distDir: string;
+    node: string;
+    version: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    launcher: string;
+    changed: boolean;
+};
+export declare function removeLauncher(env?: NodeJS.ProcessEnv): void;
+export interface LauncherState {
+    file: string;
+    present: boolean;
+    /** The node the launcher names, and whether it can still run. */
+    node: string | null;
+    nodeOk: boolean;
+    version: string | null;
+    problems: string[];
+}
+/** What `doctor` says about the launcher. */
+export declare function launcherState(version: string, env?: NodeJS.ProcessEnv): LauncherState;
+//# sourceMappingURL=launcher.d.ts.map

package/dist/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../src/launcher.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,QAAQ,qBAAqB,CAAC;AAG3C,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGpE;AACD,eAAO,MAAM,YAAY,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MAA2C,CAAC;AAChH,eAAO,MAAM,YAAY,GAAI,WAAU,MAAM,CAAC,QAA2B,KAAG,OAA+B,CAAC;AAI5G;mEACmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CASlF;AAkBD;oFACoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG;IAC/G,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CASA;AAED,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEzE;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAwClG"}

package/dist/run.d.ts

@@ -20,7 +20,9 @@ export declare function sweepJobs(state: string, olderThanMs?: number, limit?: n
 export declare function log(state: string, line: string): void;
 /** <state>/facts/<harness>/<session>.json — what the machine learned about a session. */
 export declare function factsState(state: string): FactsState;
-export declare function buildSinks(sinks: SinkConfig[]): Sink[];
+export declare function buildSinks(sinks: SinkConfig[], o?: {
+    locked?: (name: string) => void;
+}): Sink[];
 /** Run one hook job end to end: events → outbox → sinks. Returns what happened. */
 export declare function runJob(job: Job, opts?: {
     state?: string;

package/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,UAAU,EAMf,MAAM,EAIN,KAAK,IAAI,EACT,KAAK,UAAU,EAOhB,MAAM,mBAAmB,CAAC;AAqB3B,QAAA,MAAM,OAAO,QAAkF,CAAC;AAEhG,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAM1D;AAED;;;2BAG2B;AAC3B,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,SAAO,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB9F;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASrD;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAkBpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAWtD;AAED,mFAAmF;AACnF,wBAAsB,MAAM,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA6GjE;AAKD;;;;;4DAK4D;AAC5D,wBAAsB,KAAK,CACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmEjC;AAaD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,WAAW,QAAO,MAAkC,CAAC;AAClE,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,MAAkC,CAAC;AAC3E,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,OAAqC,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,UAAU,EAMf,MAAM,EAIN,KAAK,IAAI,EACT,KAAK,UAAU,EAOhB,MAAM,mBAAmB,CAAC;AAsB3B,QAAA,MAAM,OAAO,QAAkF,CAAC;AAEhG,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAM1D;AAED;;;2BAG2B;AAC3B,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,SAAO,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB9F;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASrD;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAkBpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,IAAI,EAAE,CAkBnG;AAED,mFAAmF;AACnF,wBAAsB,MAAM,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA6GjE;AAKD;;;;;4DAK4D;AAC5D,wBAAsB,KAAK,CACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqEjC;AAaD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,WAAW,QAAO,MAAkC,CAAC;AAClE,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,MAAkC,CAAC;AAC3E,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,OAAqC,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,6 @@
+/** Homebrew's versioned Cellar path dies on `brew upgrade node`; its stable links survive. */
+export declare function stableNode(exe: string): string;
+export declare function viaNpx(distDir: string): boolean;
+/** Install the running version persistently and hand off the original command before side effects. */
+export declare function rerunGlobally(argv: string[], out: (s: string) => void): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAQA,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe9C;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAwC5E"}

package/dist/secrets.d.ts

@@ -0,0 +1,39 @@
+import { type SinkConfig } from "@sessionpipe/core";
+export type SecretStore = "keychain" | "secret-service";
+export type StoreName = SecretStore | "file";
+export type Runner = (cmd: string, args: string[], input?: string) => {
+    status: number | null;
+    stdout: string;
+};
+export declare const defaultRunner: Runner;
+/** A sink's item. The machine has one config, so a sink's name is enough — except
+ *  where SESSIONPIPE_CONFIG points at another (a second profile, a test): then the
+ *  item names that config too, so two configs' sinks of one name never share a key. */
+export declare const sinkAccount: (name: string, what?: "token" | "secret") => string;
+export declare const controlAccount: (machine: string) => string;
+export declare function secretGet(store: SecretStore, account: string, run?: Runner): string | null;
+export declare function secretSet(store: SecretStore, account: string, value: string, run?: Runner): boolean;
+export declare function secretDel(store: SecretStore, account: string, run?: Runner): void;
+/** Can this process write, read back and delete an item in the store right now? */
+export declare function probe(store: SecretStore, run?: Runner): boolean;
+/** The best place for secrets on this machine, from this session. SESSIONPIPE_SECRETS
+ *  (file | keychain | secret-service) overrides. The Secret Service is used only in a
+ *  desktop session: on a server its keyring is locked whenever nobody is logged in,
+ *  which is exactly when the daemon needs its token. */
+export declare function bestStore(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, run?: Runner): StoreName;
+export declare const storeLabel: (s: StoreName | undefined) => string;
+/** The sink with its token and secret filled in from its store. Null when they live in
+ *  a store this process can't read right now (a keychain locked in an ssh session):
+ *  the caller leaves the events in the outbox rather than sending them unsigned. */
+export declare function sinkWithSecrets(s: SinkConfig, run?: Runner): SinkConfig | null;
+/** Store a sink's secrets in `to` (or back in the file) and save the config. */
+export declare function moveSinkSecrets(to: StoreName, o?: {
+    run?: Runner;
+    file?: string;
+}): {
+    moved: string[];
+    kept: string[];
+};
+/** Forget a sink's secrets wherever they are (sink remove, uninstall). */
+export declare function dropSinkSecrets(s: SinkConfig, run?: Runner): void;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAcA,OAAO,EAA0B,KAAK,UAAU,EAAe,MAAM,mBAAmB,CAAC;AAEzF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,gBAAgB,CAAC;AACxD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAI7C,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAChH,eAAO,MAAM,aAAa,EAAE,MAQ3B,CAAC;AAEF;;uFAEuF;AACvF,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,OAAM,OAAO,GAAG,QAAkB,KAAG,MAK9E,CAAC;AACF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAA8B,CAAC;AAQhF,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAQzG;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAalH;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,IAAI,CAGhG;AAED,mFAAmF;AACnF,wBAAgB,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAK9E;AAED;;;wDAGwD;AACxD,wBAAgB,SAAS,CACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,GAAG,GAAE,MAAsB,GAC1B,SAAS,CAaX;AAED,eAAO,MAAM,UAAU,GAAI,GAAG,SAAS,GAAG,SAAS,KAAG,MAC2D,CAAC;AAElH;;oFAEoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,GAAE,MAAsB,GAAG,UAAU,GAAG,IAAI,CAM7F;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,CAAC,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA4CrC;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,GAAE,MAAsB,GAAG,IAAI,CAIhF"}

package/dist/worker.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// sessionpipe 0.4.0 · Apache-2.0 · https://sessionpipe.org
+// sessionpipe 0.5.0 · Apache-2.0 · https://sessionpipe.org
 
 // src/worker.ts
 import { readFileSync as readFileSync9, unlinkSync as unlinkSync5 } from "node:fs";
@@ -243,7 +243,7 @@ function readAntigravity(lines, from) {
 // ../core/src/adapters/claude-shaped.ts
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path3 from "node:path";
-var OURS = /sessionpipe[^"\n]*[\\/]hook\.js"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
+var OURS = /(?:sessionpipe[^"\n]*[\\/]hook\.js|[\\/]sessionpipe-hook)"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
 var isOurs = (h) => Array.isArray(h?.hooks) && h.hooks.some((x) => typeof x.command === "string" && OURS.test(x.command));
 function readJsonFile(file) {
   let raw;
@@ -1210,7 +1210,7 @@ import path6 from "node:path";
 // ../core/src/adapters/codex-config.ts
 var NOTIFY_LINE = /^[ \t]*notify[ \t]*=[ \t]*(\[.*\])[ \t]*(?:#.*)?$/m;
 var NOTIFY_KEY = /^[ \t]*notify[ \t]*=/m;
-var OURS2 = /hook\.js",\s*"codex",\s*"notify"/;
+var OURS2 = /(?:hook\.js|sessionpipe-hook)",\s*"codex",\s*"notify"/;
 function scan(line, st) {
   let i = 0;
   while (i < line.length) {
@@ -2618,6 +2618,37 @@ var HttpSink = class {
   }
 };
 
+// src/secrets.ts
+import { spawnSync } from "node:child_process";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+var SERVICE = "sessionpipe";
+var defaultRunner = (cmd, args, input) => {
+  const r = spawnSync(cmd, args, {
+    input: input ?? "",
+    encoding: "utf8",
+    timeout: 8e3,
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
+};
+var sinkAccount = (name, what = "token") => {
+  const scope = process.env.SESSIONPIPE_CONFIG ? `@${createHash4("sha256").update(configFile()).digest("hex").slice(0, 8)}` : "";
+  return `sink:${name}:${what}${scope}`;
+};
+function secretGet(store, account, run = defaultRunner) {
+  const r = store === "keychain" ? run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]) : run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+  if (r.status !== 0) return null;
+  const v = r.stdout.replace(/\r?\n$/, "");
+  return v || null;
+}
+function sinkWithSecrets(s, run = defaultRunner) {
+  if (!s.token_in) return s;
+  const token = secretGet(s.token_in, sinkAccount(s.name), run);
+  if (!token) return null;
+  const secret = secretGet(s.token_in, sinkAccount(s.name, "secret"), run);
+  return { ...s, token, ...secret ? { secret } : {} };
+}
+
 // src/run.ts
 async function tellDaemon(state, job2, session, transcript) {
   const sock = socketPath(state);
@@ -2698,10 +2729,15 @@ function factsState(state) {
     }
   };
 }
-function buildSinks(sinks) {
+function buildSinks(sinks, o = {}) {
   const out = [];
-  for (const s of sinks) {
-    if (s.paused) continue;
+  for (const raw of sinks) {
+    if (raw.paused) continue;
+    const s = sinkWithSecrets(raw);
+    if (!s) {
+      o.locked?.(raw.name);
+      continue;
+    }
     const tier = Math.min(s.tier, s.max_tier ?? 3);
     if (s.url === "stdout") out.push(new StdoutSink(s.name, tier, !!s.pii));
     else if (s.url.startsWith("file:"))
@@ -2810,7 +2846,9 @@ var BATCH = 50;
 var MAX_PER_RUN = 500;
 async function flush(state, sinkConfigs, outbox, first) {
   const delivered = {};
-  const sinks = buildSinks(sinkConfigs);
+  const sinks = buildSinks(sinkConfigs, {
+    locked: (name) => log(state, `sink ${name}: its token is in a keychain this process can't read; left for later`)
+  });
   const refs = outbox.sessions();
   if (first) {
     const k = `${first.harness}/${safeId(first.session)}`;