sessionpipe 0.4.1 → 0.6.0

package/dist/index.js

@@ -1,4 +1,4 @@
-// sessionpipe 0.4.1 · Apache-2.0 · https://sessionpipe.org
+// sessionpipe 0.6.0 · Apache-2.0 · https://sessionpipe.org
 
 // src/http-sink.ts
 import { createHash, createHmac } from "node:crypto";
@@ -342,7 +342,7 @@ function readAntigravity(lines, from) {
 // ../core/src/adapters/claude-shaped.ts
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path3 from "node:path";
-var OURS = /sessionpipe[^"\n]*[\\/]hook\.js"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
+var OURS = /(?:sessionpipe[^"\n]*[\\/]hook\.js|[\\/]sessionpipe-hook)"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
 var isOurs = (h) => Array.isArray(h?.hooks) && h.hooks.some((x) => typeof x.command === "string" && OURS.test(x.command));
 function readJsonFile(file) {
   let raw;
@@ -1309,7 +1309,7 @@ import path6 from "node:path";
 // ../core/src/adapters/codex-config.ts
 var NOTIFY_LINE = /^[ \t]*notify[ \t]*=[ \t]*(\[.*\])[ \t]*(?:#.*)?$/m;
 var NOTIFY_KEY = /^[ \t]*notify[ \t]*=/m;
-var OURS2 = /hook\.js",\s*"codex",\s*"notify"/;
+var OURS2 = /(?:hook\.js|sessionpipe-hook)",\s*"codex",\s*"notify"/;
 function scan(line, st) {
   let i = 0;
   while (i < line.length) {
@@ -2614,6 +2614,37 @@ function ask(sock, req, timeoutMs) {
   });
 }
 
+// src/secrets.ts
+import { spawnSync } from "node:child_process";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+var SERVICE = "sessionpipe";
+var defaultRunner = (cmd, args, input) => {
+  const r = spawnSync(cmd, args, {
+    input: input ?? "",
+    encoding: "utf8",
+    timeout: 8e3,
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
+};
+var sinkAccount = (name, what = "token") => {
+  const scope = process.env.SESSIONPIPE_CONFIG ? `@${createHash4("sha256").update(configFile()).digest("hex").slice(0, 8)}` : "";
+  return `sink:${name}:${what}${scope}`;
+};
+function secretGet(store, account, run = defaultRunner) {
+  const r = store === "keychain" ? run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]) : run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+  if (r.status !== 0) return null;
+  const v = r.stdout.replace(/\r?\n$/, "");
+  return v || null;
+}
+function sinkWithSecrets(s, run = defaultRunner) {
+  if (!s.token_in) return s;
+  const token = secretGet(s.token_in, sinkAccount(s.name), run);
+  if (!token) return null;
+  const secret = secretGet(s.token_in, sinkAccount(s.name, "secret"), run);
+  return { ...s, token, ...secret ? { secret } : {} };
+}
+
 // src/run.ts
 async function tellDaemon(state, job, session, transcript) {
   const sock = socketPath(state);
@@ -2669,10 +2700,15 @@ function factsState(state) {
     }
   };
 }
-function buildSinks(sinks) {
+function buildSinks(sinks, o = {}) {
   const out = [];
-  for (const s of sinks) {
-    if (s.paused) continue;
+  for (const raw of sinks) {
+    if (raw.paused) continue;
+    const s = sinkWithSecrets(raw);
+    if (!s) {
+      o.locked?.(raw.name);
+      continue;
+    }
     const tier = Math.min(s.tier, s.max_tier ?? 3);
     if (s.url === "stdout") out.push(new StdoutSink(s.name, tier, !!s.pii));
     else if (s.url.startsWith("file:"))
@@ -2781,7 +2817,9 @@ var BATCH = 50;
 var MAX_PER_RUN = 500;
 async function flush(state, sinkConfigs, outbox, first) {
   const delivered = {};
-  const sinks = buildSinks(sinkConfigs);
+  const sinks = buildSinks(sinkConfigs, {
+    locked: (name) => log(state, `sink ${name}: its token is in a keychain this process can't read; left for later`)
+  });
   const refs = outbox.sessions();
   if (first) {
     const k = `${first.harness}/${safeId(first.session)}`;