sessionpipe 0.4.1 → 0.6.0

package/dist/launcher.d.ts

@@ -0,0 +1,31 @@
+export declare const LAUNCHER = "sessionpipe-hook";
+export declare function dataDir(env?: NodeJS.ProcessEnv): string;
+export declare const launcherPath: (env?: NodeJS.ProcessEnv) => string;
+export declare const usesLauncher: (platform?: NodeJS.Platform) => boolean;
+/** The launcher, in sh. No node at all prints what Antigravity needs and exits 0: the
+ *  hook must stay invisible to the harness whatever is missing. */
+export declare function launcherScript(node: string, hook: string, version: string): string;
+/** Copy the hook and worker out of the npm install and (re)write the launcher. The
+ *  worker goes first, so a hook that starts mid-copy never spawns a missing one. */
+export declare function installLauncher(o: {
+    distDir: string;
+    node: string;
+    version: string;
+    env?: NodeJS.ProcessEnv;
+}): {
+    launcher: string;
+    changed: boolean;
+};
+export declare function removeLauncher(env?: NodeJS.ProcessEnv): void;
+export interface LauncherState {
+    file: string;
+    present: boolean;
+    /** The node the launcher names, and whether it can still run. */
+    node: string | null;
+    nodeOk: boolean;
+    version: string | null;
+    problems: string[];
+}
+/** What `doctor` says about the launcher. */
+export declare function launcherState(version: string, env?: NodeJS.ProcessEnv): LauncherState;
+//# sourceMappingURL=launcher.d.ts.map

package/dist/launcher.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"launcher.d.ts","sourceRoot":"","sources":["../src/launcher.ts"],"names":[],"mappings":"AAYA,eAAO,MAAM,QAAQ,qBAAqB,CAAC;AAG3C,wBAAgB,OAAO,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAGpE;AACD,eAAO,MAAM,YAAY,GAAI,MAAK,MAAM,CAAC,UAAwB,KAAG,MAA2C,CAAC;AAChH,eAAO,MAAM,YAAY,GAAI,WAAU,MAAM,CAAC,QAA2B,KAAG,OAA+B,CAAC;AAI5G;mEACmE;AACnE,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CASlF;AAkBD;oFACoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAAG;IAC/G,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,OAAO,CAAC;CAClB,CASA;AAED,wBAAgB,cAAc,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,IAAI,CAEzE;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,iEAAiE;IACjE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,6CAA6C;AAC7C,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,aAAa,CAwClG"}

package/dist/run.d.ts

@@ -20,7 +20,9 @@ export declare function sweepJobs(state: string, olderThanMs?: number, limit?: n
 export declare function log(state: string, line: string): void;
 /** <state>/facts/<harness>/<session>.json — what the machine learned about a session. */
 export declare function factsState(state: string): FactsState;
-export declare function buildSinks(sinks: SinkConfig[]): Sink[];
+export declare function buildSinks(sinks: SinkConfig[], o?: {
+    locked?: (name: string) => void;
+}): Sink[];
 /** Run one hook job end to end: events → outbox → sinks. Returns what happened. */
 export declare function runJob(job: Job, opts?: {
     state?: string;

package/dist/run.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,UAAU,EAMf,MAAM,EAIN,KAAK,IAAI,EACT,KAAK,UAAU,EAOhB,MAAM,mBAAmB,CAAC;AAqB3B,QAAA,MAAM,OAAO,QAAkF,CAAC;AAEhG,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAM1D;AAED;;;2BAG2B;AAC3B,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,SAAO,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB9F;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASrD;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAkBpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,GAAG,IAAI,EAAE,CAWtD;AAED,mFAAmF;AACnF,wBAAsB,MAAM,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA6GjE;AAKD;;;;;4DAK4D;AAC5D,wBAAsB,KAAK,CACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAmEjC;AAaD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,WAAW,QAAO,MAAkC,CAAC;AAClE,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,MAAkC,CAAC;AAC3E,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,OAAqC,CAAC"}
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../src/run.ts"],"names":[],"mappings":"AAeA,OAAO,EAGL,KAAK,KAAK,EACV,KAAK,UAAU,EAMf,MAAM,EAIN,KAAK,IAAI,EACT,KAAK,UAAU,EAOhB,MAAM,mBAAmB,CAAC;AAsB3B,QAAA,MAAM,OAAO,QAAkF,CAAC;AAEhG,MAAM,WAAW,GAAG;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,8EAA8E;AAC9E,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,GAAG,MAAM,CAM1D;AAED;;;2BAG2B;AAC3B,wBAAsB,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,WAAW,SAAO,EAAE,KAAK,SAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAuB9F;AAED,wBAAgB,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CASrD;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,UAAU,CAkBpD;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,CAAC,GAAE;IAAE,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;CAAO,GAAG,IAAI,EAAE,CAkBnG;AAED,mFAAmF;AACnF,wBAAsB,MAAM,CAC1B,GAAG,EAAE,GAAG,EACR,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,GAAG,CAAC,EAAE,MAAM,CAAA;CAAO,GAC1C,OAAO,CAAC;IAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,CAAC,CA6GjE;AAKD;;;;;4DAK4D;AAC5D,wBAAsB,KAAK,CACzB,KAAK,EAAE,MAAM,EACb,WAAW,EAAE,UAAU,EAAE,EACzB,MAAM,EAAE,MAAM,EACd,KAAK,CAAC,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAC3C,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAqEjC;AAaD,OAAO,EAAE,OAAO,EAAE,CAAC;AACnB,eAAO,MAAM,WAAW,QAAO,MAAkC,CAAC;AAClE,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,MAAkC,CAAC;AAC3E,eAAO,MAAM,OAAO,GAAI,OAAO,MAAM,KAAG,OAAqC,CAAC"}

package/dist/runtime.d.ts

@@ -0,0 +1,6 @@
+/** Homebrew's versioned Cellar path dies on `brew upgrade node`; its stable links survive. */
+export declare function stableNode(exe: string): string;
+export declare function viaNpx(distDir: string): boolean;
+/** Install the running version persistently and hand off the original command before side effects. */
+export declare function rerunGlobally(argv: string[], out: (s: string) => void): void;
+//# sourceMappingURL=runtime.d.ts.map

package/dist/runtime.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"runtime.d.ts","sourceRoot":"","sources":["../src/runtime.ts"],"names":[],"mappings":"AAQA,8FAA8F;AAC9F,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAe9C;AAED,wBAAgB,MAAM,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAE/C;AAED,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,IAAI,GAAG,IAAI,CAwC5E"}

package/dist/secrets.d.ts

@@ -0,0 +1,39 @@
+import { type SinkConfig } from "@sessionpipe/core";
+export type SecretStore = "keychain" | "secret-service";
+export type StoreName = SecretStore | "file";
+export type Runner = (cmd: string, args: string[], input?: string) => {
+    status: number | null;
+    stdout: string;
+};
+export declare const defaultRunner: Runner;
+/** A sink's item. The machine has one config, so a sink's name is enough — except
+ *  where SESSIONPIPE_CONFIG points at another (a second profile, a test): then the
+ *  item names that config too, so two configs' sinks of one name never share a key. */
+export declare const sinkAccount: (name: string, what?: "token" | "secret") => string;
+export declare const controlAccount: (machine: string) => string;
+export declare function secretGet(store: SecretStore, account: string, run?: Runner): string | null;
+export declare function secretSet(store: SecretStore, account: string, value: string, run?: Runner): boolean;
+export declare function secretDel(store: SecretStore, account: string, run?: Runner): void;
+/** Can this process write, read back and delete an item in the store right now? */
+export declare function probe(store: SecretStore, run?: Runner): boolean;
+/** The best place for secrets on this machine, from this session. SESSIONPIPE_SECRETS
+ *  (file | keychain | secret-service) overrides. The Secret Service is used only in a
+ *  desktop session: on a server its keyring is locked whenever nobody is logged in,
+ *  which is exactly when the daemon needs its token. */
+export declare function bestStore(env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform, run?: Runner): StoreName;
+export declare const storeLabel: (s: StoreName | undefined) => string;
+/** The sink with its token and secret filled in from its store. Null when they live in
+ *  a store this process can't read right now (a keychain locked in an ssh session):
+ *  the caller leaves the events in the outbox rather than sending them unsigned. */
+export declare function sinkWithSecrets(s: SinkConfig, run?: Runner): SinkConfig | null;
+/** Store a sink's secrets in `to` (or back in the file) and save the config. */
+export declare function moveSinkSecrets(to: StoreName, o?: {
+    run?: Runner;
+    file?: string;
+}): {
+    moved: string[];
+    kept: string[];
+};
+/** Forget a sink's secrets wherever they are (sink remove, uninstall). */
+export declare function dropSinkSecrets(s: SinkConfig, run?: Runner): void;
+//# sourceMappingURL=secrets.d.ts.map

package/dist/secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.d.ts","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAcA,OAAO,EAA0B,KAAK,UAAU,EAAe,MAAM,mBAAmB,CAAC;AAEzF,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,gBAAgB,CAAC;AACxD,MAAM,MAAM,SAAS,GAAG,WAAW,GAAG,MAAM,CAAC;AAI7C,MAAM,MAAM,MAAM,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,CAAC,EAAE,MAAM,KAAK;IAAE,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAChH,eAAO,MAAM,aAAa,EAAE,MAQ3B,CAAC;AAEF;;uFAEuF;AACvF,eAAO,MAAM,WAAW,GAAI,MAAM,MAAM,EAAE,OAAM,OAAO,GAAG,QAAkB,KAAG,MAK9E,CAAC;AACF,eAAO,MAAM,cAAc,GAAI,SAAS,MAAM,KAAG,MAA8B,CAAC;AAQhF,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,MAAM,GAAG,IAAI,CAQzG;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAalH;AAED,wBAAgB,SAAS,CAAC,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,GAAE,MAAsB,GAAG,IAAI,CAGhG;AAED,mFAAmF;AACnF,wBAAgB,KAAK,CAAC,KAAK,EAAE,WAAW,EAAE,GAAG,GAAE,MAAsB,GAAG,OAAO,CAK9E;AAED;;;wDAGwD;AACxD,wBAAgB,SAAS,CACvB,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,EAC5C,GAAG,GAAE,MAAsB,GAC1B,SAAS,CAaX;AAED,eAAO,MAAM,UAAU,GAAI,GAAG,SAAS,GAAG,SAAS,KAAG,MAC2D,CAAC;AAElH;;oFAEoF;AACpF,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,GAAE,MAAsB,GAAG,UAAU,GAAG,IAAI,CAM7F;AAED,gFAAgF;AAChF,wBAAgB,eAAe,CAC7B,EAAE,EAAE,SAAS,EACb,CAAC,GAAE;IAAE,GAAG,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAO,GACtC;IAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CA4CrC;AAED,0EAA0E;AAC1E,wBAAgB,eAAe,CAAC,CAAC,EAAE,UAAU,EAAE,GAAG,GAAE,MAAsB,GAAG,IAAI,CAIhF"}

package/dist/update.d.ts

@@ -0,0 +1,70 @@
+export declare const REGISTRY_LATEST = "https://registry.npmjs.org/sessionpipe/latest";
+/** Order two versions: <0, 0, >0, or null if either isn't one. A release sorts above
+ *  its own prereleases; prereleases compare by their tag. */
+export declare function compareVersions(a: string, b: string): number | null;
+/** `a` is a release newer than `b`. A prerelease is never offered as an update: the
+ *  `latest` dist-tag is a release, and anything else is someone's experiment. */
+export declare function isNewer(a: string, b: string): boolean;
+/** The registry's `latest` for sessionpipe: one GET, nothing sent but the request. */
+export declare function latestVersion(f?: typeof fetch, timeoutMs?: number): Promise<string>;
+/** The prefix a global npm install of sessionpipe lives under, from the running copy's
+ *  dist folder (`<prefix>/lib/node_modules/sessionpipe/dist`, on Windows
+ *  `<prefix>\node_modules\sessionpipe\dist`). */
+export declare function prefixOf(distDir: string, platform?: NodeJS.Platform): string | null;
+/** The npm prefix this copy was installed into with `npm install -g`, or null when it
+ *  isn't a global npm install (the npx cache, a git checkout, a project's
+ *  node_modules, a dev build). A global install always has its bin link in the prefix. */
+export declare function globalPrefix(distDir: string, platform?: NodeJS.Platform): string | null;
+/** Why npm can't write this prefix (installed with sudo, a read-only image), or null. */
+export declare function unwritable(prefix: string, platform?: NodeJS.Platform): string | null;
+/** npm, run by this very node: under launchd PATH is /usr/bin:/bin, so neither `npm`
+ *  nor the `node` its shebang asks for is on it. Its npm-cli.js sits beside the node
+ *  binary (nvm, Homebrew, the official builds, the node Docker images). */
+export declare function npmArgv(node: string, platform?: NodeJS.Platform): string[];
+export interface ExecResult {
+    code: number | null;
+    stdout: string;
+    stderr: string;
+    error?: string;
+}
+export type Exec = (argv: string[], o: {
+    env: NodeJS.ProcessEnv;
+    timeoutMs: number;
+}) => Promise<ExecResult>;
+/** Run a command to the end, keeping the tail of its output. */
+export declare const execCapture: Exec;
+export interface InstallOptions {
+    /** The node running this copy (process.execPath). */
+    node: string;
+    /** The running copy's dist folder: where the new one lands, under the same prefix. */
+    distDir: string;
+    /** Harnesses whose hooks to re-arm afterwards (config.harnesses that are enabled). */
+    harnesses: string[];
+    env?: NodeJS.ProcessEnv;
+    exec?: Exec;
+    platform?: NodeJS.Platform;
+}
+export type InstallResult = {
+    ok: true;
+    ms: number;
+    hooks: string;
+} | {
+    ok: false;
+    ms: number;
+    error: string;
+    stage: "prefix" | "npm" | "verify";
+};
+/** The version of the copy on disk (which may not be the one running). */
+export declare function installedVersion(o: {
+    node: string;
+    distDir: string;
+    env?: NodeJS.ProcessEnv;
+    exec?: Exec;
+}): Promise<string | null>;
+/** `npm install -g sessionpipe@<version>` into the prefix the running copy came from,
+ *  check the copy on disk says that version, then re-copy the hook launcher's files
+ *  (the hooks run copies in ~/.local/share/sessionpipe, which npm never touches) for
+ *  the harnesses already set up here. Lifecycle scripts are off: sessionpipe has none,
+ *  and an unattended install runs nothing it fetched. */
+export declare function installVersion(version: string, o: InstallOptions): Promise<InstallResult>;
+//# sourceMappingURL=update.d.ts.map

package/dist/update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.d.ts","sourceRoot":"","sources":["../src/update.ts"],"names":[],"mappings":"AAaA,eAAO,MAAM,eAAe,kDAAkD,CAAC;AAc/E;6DAC6D;AAC7D,wBAAgB,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CASnE;AAED;iFACiF;AACjF,wBAAgB,OAAO,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAKrD;AAED,sFAAsF;AACtF,wBAAsB,aAAa,CAAC,CAAC,GAAE,OAAO,KAAa,EAAE,SAAS,SAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAS9F;AAED;;iDAEiD;AACjD,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,GAAG,IAAI,CAIrG;AAED;;0FAE0F;AAC1F,wBAAgB,YAAY,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,GAAG,IAAI,CAMzG;AAED,yFAAyF;AACzF,wBAAgB,UAAU,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,GAAG,IAAI,CAQtG;AAED;;2EAE2E;AAC3E,wBAAgB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAAG,MAAM,EAAE,CAa5F;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AACD,MAAM,MAAM,IAAI,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,CAAC,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC,UAAU,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE7G,gEAAgE;AAChE,eAAO,MAAM,WAAW,EAAE,IAiCtB,CAAC;AAEL,MAAM,WAAW,cAAc;IAC7B,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,sFAAsF;IACtF,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,SAAS,EAAE,MAAM,EAAE,CAAC;IACpB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAED,MAAM,MAAM,aAAa,GACrB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,QAAQ,GAAG,KAAK,GAAG,QAAQ,CAAA;CAAE,CAAC;AAKjF,0EAA0E;AAC1E,wBAAsB,gBAAgB,CAAC,CAAC,EAAE;IACxC,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;IACxB,IAAI,CAAC,EAAE,IAAI,CAAC;CACb,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOzB;AAED;;;;yDAIyD;AACzD,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,cAAc,GAAG,OAAO,CAAC,aAAa,CAAC,CA8C/F"}

package/dist/worker.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-// sessionpipe 0.4.1 · Apache-2.0 · https://sessionpipe.org
+// sessionpipe 0.6.0 · Apache-2.0 · https://sessionpipe.org
 
 // src/worker.ts
 import { readFileSync as readFileSync9, unlinkSync as unlinkSync5 } from "node:fs";
@@ -243,7 +243,7 @@ function readAntigravity(lines, from) {
 // ../core/src/adapters/claude-shaped.ts
 import { existsSync, mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
 import path3 from "node:path";
-var OURS = /sessionpipe[^"\n]*[\\/]hook\.js"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
+var OURS = /(?:sessionpipe[^"\n]*[\\/]hook\.js|[\\/]sessionpipe-hook)"?\s+[a-z][a-z-]*\s+[A-Za-z]+\s*$/;
 var isOurs = (h) => Array.isArray(h?.hooks) && h.hooks.some((x) => typeof x.command === "string" && OURS.test(x.command));
 function readJsonFile(file) {
   let raw;
@@ -1210,7 +1210,7 @@ import path6 from "node:path";
 // ../core/src/adapters/codex-config.ts
 var NOTIFY_LINE = /^[ \t]*notify[ \t]*=[ \t]*(\[.*\])[ \t]*(?:#.*)?$/m;
 var NOTIFY_KEY = /^[ \t]*notify[ \t]*=/m;
-var OURS2 = /hook\.js",\s*"codex",\s*"notify"/;
+var OURS2 = /(?:hook\.js|sessionpipe-hook)",\s*"codex",\s*"notify"/;
 function scan(line, st) {
   let i = 0;
   while (i < line.length) {
@@ -2618,6 +2618,37 @@ var HttpSink = class {
   }
 };
 
+// src/secrets.ts
+import { spawnSync } from "node:child_process";
+import { createHash as createHash4, randomBytes as randomBytes2 } from "node:crypto";
+var SERVICE = "sessionpipe";
+var defaultRunner = (cmd, args, input) => {
+  const r = spawnSync(cmd, args, {
+    input: input ?? "",
+    encoding: "utf8",
+    timeout: 8e3,
+    stdio: ["pipe", "pipe", "ignore"]
+  });
+  return { status: r.error ? null : r.status, stdout: r.stdout ?? "" };
+};
+var sinkAccount = (name, what = "token") => {
+  const scope = process.env.SESSIONPIPE_CONFIG ? `@${createHash4("sha256").update(configFile()).digest("hex").slice(0, 8)}` : "";
+  return `sink:${name}:${what}${scope}`;
+};
+function secretGet(store, account, run = defaultRunner) {
+  const r = store === "keychain" ? run("security", ["find-generic-password", "-s", SERVICE, "-a", account, "-w"]) : run("secret-tool", ["lookup", "service", SERVICE, "account", account]);
+  if (r.status !== 0) return null;
+  const v = r.stdout.replace(/\r?\n$/, "");
+  return v || null;
+}
+function sinkWithSecrets(s, run = defaultRunner) {
+  if (!s.token_in) return s;
+  const token = secretGet(s.token_in, sinkAccount(s.name), run);
+  if (!token) return null;
+  const secret = secretGet(s.token_in, sinkAccount(s.name, "secret"), run);
+  return { ...s, token, ...secret ? { secret } : {} };
+}
+
 // src/run.ts
 async function tellDaemon(state, job2, session, transcript) {
   const sock = socketPath(state);
@@ -2698,10 +2729,15 @@ function factsState(state) {
     }
   };
 }
-function buildSinks(sinks) {
+function buildSinks(sinks, o = {}) {
   const out = [];
-  for (const s of sinks) {
-    if (s.paused) continue;
+  for (const raw of sinks) {
+    if (raw.paused) continue;
+    const s = sinkWithSecrets(raw);
+    if (!s) {
+      o.locked?.(raw.name);
+      continue;
+    }
     const tier = Math.min(s.tier, s.max_tier ?? 3);
     if (s.url === "stdout") out.push(new StdoutSink(s.name, tier, !!s.pii));
     else if (s.url.startsWith("file:"))
@@ -2810,7 +2846,9 @@ var BATCH = 50;
 var MAX_PER_RUN = 500;
 async function flush(state, sinkConfigs, outbox, first) {
   const delivered = {};
-  const sinks = buildSinks(sinkConfigs);
+  const sinks = buildSinks(sinkConfigs, {
+    locked: (name) => log(state, `sink ${name}: its token is in a keychain this process can't read; left for later`)
+  });
   const refs = outbox.sessions();
   if (first) {
     const k = `${first.harness}/${safeId(first.session)}`;