skillwiki 0.10.111 → 0.10.112

package/dist/{chunk-TDBUJUYH.js → chunk-25OXNFDV.js}

@@ -1,5 +1,9 @@
 #!/usr/bin/env node
 import {
+  atomicWriteText
+} from "./chunk-EE7W3GLA.js";
+import {
+  PRODUCTION_MIRROR_LABEL,
   PRODUCTION_WATCHER_LABEL,
   evidencePath,
   expandUserPath,
@@ -7,25 +11,22 @@ import {
   nestedOrEqual,
   resolveClipOutboxConfig,
   validateRuntime
-} from "./chunk-6OQLBNKR.js";
+} from "./chunk-ABRYBO4T.js";
 import {
   parseDotenvFile
-} from "./chunk-PYPPG7RF.js";
-import {
-  atomicWriteText
-} from "./chunk-GQWCTJTU.js";
+} from "./chunk-SKOLE6US.js";
 
 // src/clip-outbox/migrate.ts
 import { access, mkdir, readFile } from "fs/promises";
 import { constants } from "fs";
 import { basename, dirname, isAbsolute, join } from "path";
 import { execFileSync } from "child_process";
-var CLIP_MIGRATION_HINT = "Clip channel requires attended setup: run skillwiki clip-outbox install-or-migrate, then skillwiki doctor. Installation/update never sets clip_outbox.enabled=true or loads launchd. Prove deployed SeaweedFS If-None-Match:* create-only before operator enablement.";
+var CLIP_MIGRATION_HINT = "Clip channel requires attended setup: run skillwiki clip-outbox install-or-migrate, then skillwiki doctor. Installation/update never sets clip_outbox.enabled=true or loads launchd. Prove deployed SeaweedFS If-None-Match:* create-only before --load. Inbound SSE uses a separate --load-mirror and never watches ~/wiki as clip input.";
 var xml = (s) => s.replaceAll("&", "&amp;").replaceAll("<", "&lt;").replaceAll(">", "&gt;").replaceAll('"', "&quot;").replaceAll("'", "&apos;");
-async function packagedPlist() {
+async function packagedPlist(label = PRODUCTION_WATCHER_LABEL) {
   for (const rel of ["../templates/launchd/", "../../templates/launchd/"]) {
     try {
-      return await readFile(new URL(`${rel}${PRODUCTION_WATCHER_LABEL}.plist`, import.meta.url), "utf8");
+      return await readFile(new URL(`${rel}${label}.plist`, import.meta.url), "utf8");
     } catch {
     }
   }
@@ -48,6 +49,7 @@ async function migrateClipOutbox(input) {
   const resolved = resolveClipOutboxConfig(map, input.home);
   if (!resolved.ok) throw new Error(resolved.message);
   if (input.load && (!resolved.enabled || !input.conditionalCreateProven)) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
+  if (input.loadMirror && !resolved.enabled) throw new Error("--load-mirror requires existing clip_outbox.enabled=true; upgrades never auto-load the inbound SSE listener");
   if ((input.platform ?? process.platform) !== "darwin") throw new Error("clip launchd migration requires macOS");
   const rawRoot = map["clip_outbox.root"] ?? "~/Obsidian/clip-outbox";
   const root = resolved.enabled ? resolved.config.root : expandUserPath(rawRoot, input.home);
@@ -58,9 +60,16 @@ async function migrateClipOutbox(input) {
   if (!isAbsolute(binary) || !isAbsolute(input.nodePath ?? process.execPath)) throw new Error("absolute executable paths required");
   const logRoot = join(input.home, "Library", "Logs", "SkillWiki");
   const plistPath = join(input.home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);
-  const template = await packagedPlist();
-  let plist = template;
-  for (const [key, value] of Object.entries({ NODE_BINARY: input.nodePath ?? process.execPath, CLI_BINARY: binary, OUTBOX_ROOT: root, HOME: input.home, LOG_ROOT: logRoot })) plist = plist.replaceAll(`@${key}@`, xml(value));
+  const mirrorPlistPath = join(input.home, "Library", "LaunchAgents", `${PRODUCTION_MIRROR_LABEL}.plist`);
+  const replacements = { NODE_BINARY: input.nodePath ?? process.execPath, CLI_BINARY: binary, OUTBOX_ROOT: root, HOME: input.home, LOG_ROOT: logRoot };
+  const render = async (label) => {
+    let plist = await packagedPlist(label);
+    for (const [key, value] of Object.entries(replacements)) plist = plist.replaceAll(`@${key}@`, xml(value));
+    if (label === PRODUCTION_MIRROR_LABEL && plist.includes("<key>WatchPaths</key>")) throw new Error("inbound SSE plist must not watch the frozen mirror");
+    return plist;
+  };
+  const watcherPlist = await render(PRODUCTION_WATCHER_LABEL);
+  const mirrorPlist = await render(PRODUCTION_MIRROR_LABEL);
   if (input.load) {
     if (!resolved.enabled) throw new Error("--load requires existing clip_outbox.enabled=true and --conditional-create-proven after the operator's deployed create-only race test");
     const creds = await loadClipCredentials(input.home, resolved.config);
@@ -71,22 +80,37 @@ async function migrateClipOutbox(input) {
   }
   await mkdir(dirname(plistPath), { recursive: true });
   await mkdir(logRoot, { recursive: true });
-  const result = await atomicWriteText(plistPath, plist);
+  const result = await atomicWriteText(plistPath, watcherPlist);
   if (!result.ok) throw new Error("cannot refresh clip plist");
-  if (input.load) {
+  const mirrorResult = await atomicWriteText(mirrorPlistPath, mirrorPlist);
+  if (!mirrorResult.ok) throw new Error("cannot refresh inbound SSE plist");
+  const bootstrap = (label, path) => {
     if (typeof process.getuid !== "function") throw new Error("clip launchd load requires macOS");
     const domain = `gui/${process.getuid()}`;
     const launch = input.launch ?? ((args) => {
       execFileSync("launchctl", args, { stdio: "ignore", timeout: 5e3 });
     });
     try {
-      launch(["bootout", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
+      launch(["bootout", `${domain}/${label}`]);
     } catch {
     }
-    launch(["enable", `${domain}/${PRODUCTION_WATCHER_LABEL}`]);
-    launch(["bootstrap", domain, plistPath]);
-  }
-  return { plistPath, loaded: !!input.load, enabled: resolved.enabled, humanHint: `${result.data.changed ? "Refreshed" : "Current"} clip launchd plist: ${plistPath}. ${input.load ? "Operator-gated launchd bootstrap requested." : CLIP_MIGRATION_HINT}` };
+    launch(["enable", `${domain}/${label}`]);
+    launch(["bootstrap", domain, path]);
+  };
+  if (input.load) bootstrap(PRODUCTION_WATCHER_LABEL, plistPath);
+  if (input.loadMirror) bootstrap(PRODUCTION_MIRROR_LABEL, mirrorPlistPath);
+  const loadedBits = [
+    input.load ? "Operator-gated clip watcher bootstrap requested." : void 0,
+    input.loadMirror ? "Operator-gated inbound SSE bootstrap requested." : void 0
+  ].filter(Boolean).join(" ");
+  return {
+    plistPath,
+    mirrorPlistPath,
+    loaded: !!input.load,
+    mirrorLoaded: !!input.loadMirror,
+    enabled: resolved.enabled,
+    humanHint: `${result.data.changed ? "Refreshed" : "Current"} clip launchd plist: ${plistPath}. ${mirrorResult.data.changed ? "Refreshed" : "Current"} inbound SSE plist: ${mirrorPlistPath}. ${loadedBits || CLIP_MIGRATION_HINT}`
+  };
 }
 async function refreshInstalledClipPlist(home, opts) {
   const plistPath = join(home, "Library", "LaunchAgents", `${PRODUCTION_WATCHER_LABEL}.plist`);

package/dist/{chunk-6OQLBNKR.js → chunk-ABRYBO4T.js}

@@ -1,17 +1,22 @@
 #!/usr/bin/env node
+import {
+  defaultLookup
+} from "./chunk-LOVLZNLX.js";
 import {
   parseDotenvFile,
   resolveSkillwikiHome
-} from "./chunk-PYPPG7RF.js";
+} from "./chunk-SKOLE6US.js";
 import {
   CLIP_OUTBOX_DEFAULTS,
+  ipv4InCidr,
   isClipOutboxKey,
   parseClipOutboxKeyValue
-} from "./chunk-UIEQIJXP.js";
+} from "./chunk-7POLZOFY.js";
 
 // src/clip-outbox/runtime.ts
 import { existsSync as existsSync2 } from "fs";
 import { lstat, readFile } from "fs/promises";
+import { isIP } from "net";
 import { join as join2 } from "path";
 import { execFileSync } from "child_process";
 import { z } from "zod";
@@ -22,6 +27,7 @@ import { homedir } from "os";
 import { isAbsolute, join, resolve, sep } from "path";
 var CLIP_NOT_CONFIGURED = "clip channel not configured";
 var PRODUCTION_WATCHER_LABEL = CLIP_OUTBOX_DEFAULTS.watcher_label;
+var PRODUCTION_MIRROR_LABEL = "com.karlchow.skillwiki-mirror-sse";
 var RETIRED_WATCHER_LABELS = [
   "com.karlchow.wiki-dev-outbox",
   "com.karlchow.wiki-dev-sse",
@@ -188,6 +194,23 @@ async function loadClipOutboxConfig(home) {
 
 // src/clip-outbox/runtime.ts
 var s3Schema = z.object({ endpoint: z.string().url(), region: z.string().default("us-east-1"), accessKeyId: z.string().min(1), secretAccessKey: z.string().min(1), sessionToken: z.string().optional() }).strict();
+function isRfc1918OrLoopback(address) {
+  const version = isIP(address);
+  if (version === 4) {
+    return ipv4InCidr(address, "10.0.0.0", 8) || ipv4InCidr(address, "172.16.0.0", 12) || ipv4InCidr(address, "192.168.0.0", 16) || ipv4InCidr(address, "127.0.0.0", 8);
+  }
+  return version === 6 && address.toLowerCase() === "::1";
+}
+async function assertClipS3Endpoint(endpoint, lookup = defaultLookup) {
+  const url = new URL(endpoint);
+  if (url.username || url.password || url.search || url.hash) throw new Error("invalid clip S3 endpoint");
+  if (url.protocol === "https:") return;
+  if (url.protocol !== "http:") throw new Error("invalid clip S3 endpoint");
+  const addresses = isIP(url.hostname) ? [url.hostname] : await lookup(url.hostname);
+  if (addresses.length === 0 || !addresses.every(isRfc1918OrLoopback)) {
+    throw new Error("http clip S3 endpoint must resolve only to RFC1918 or loopback");
+  }
+}
 async function loadClipCredentials(home, config, env = process.env) {
   let providers = {};
   const path = join2(home, ".skillwiki", "clip-outbox-credentials.json");
@@ -201,8 +224,7 @@ async function loadClipCredentials(home, config, env = process.env) {
   try {
     const rawS3 = env[config.s3CredentialRef] ?? providers[config.s3CredentialRef];
     const s3 = s3Schema.parse(typeof rawS3 === "string" ? JSON.parse(rawS3) : rawS3);
-    const endpoint = new URL(s3.endpoint);
-    if (endpoint.protocol !== "https:" || endpoint.username || endpoint.password || endpoint.search || endpoint.hash) throw new Error();
+    await assertClipS3Endpoint(s3.endpoint);
     const hostConfig = await parseDotenvFile(join2(home, ".skillwiki", ".env"));
     const readyToken = env[config.readyCredentialRef] ?? providers[config.readyCredentialRef];
     if (typeof readyToken !== "string" || !readyToken || config.readyCredentialRef === "SKILLWIKI_MCP_TOKEN" || readyToken === env.SKILLWIKI_MCP_TOKEN || readyToken === hostConfig.SKILLWIKI_MCP_TOKEN || config.readyCredentialRef === config.s3CredentialRef) throw new Error();
@@ -238,11 +260,14 @@ async function validateRuntime(home, config, endpoint) {
 export {
   CLIP_NOT_CONFIGURED,
   PRODUCTION_WATCHER_LABEL,
+  PRODUCTION_MIRROR_LABEL,
   RETIRED_WATCHER_LABELS,
   expandUserPath,
   nestedOrEqual,
   resolveClipOutboxConfig,
   loadClipOutboxConfig,
+  isRfc1918OrLoopback,
+  assertClipS3Endpoint,
   loadClipCredentials,
   evidencePath,
   conditionalCreateProven,