standout 0.1.0 → 0.5.15

package/dist/mcp.d.ts

@@ -0,0 +1 @@
+export declare function startMcpServer(): Promise<void>;

package/dist/mcp.js

@@ -0,0 +1,25 @@
+import { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { z } from "zod";
+import { gather } from "./gather.js";
+import { submitProfile } from "./api.js";
+export async function startMcpServer() {
+    const server = new McpServer({
+        name: "standout",
+        version: "0.1.0",
+    });
+    server.tool("standout_gather", "Gather developer profile data from git, GitHub, LinkedIn, and local repos. Returns a comprehensive JSON object with all collected data. Run this first when building a developer profile.", {}, async () => {
+        const data = await gather();
+        return {
+            content: [{ type: "text", text: JSON.stringify(data, null, 2) }],
+        };
+    });
+    server.tool("standout_submit", "Submit a completed developer profile to Standout. The profile should be a JSON string matching the expected schema with identity, career, education, github, work_patterns, web_presence, linkedin_profile, preferences, ai_coding, and ai_summary fields.", { profile: z.string().describe("The full profile JSON as a string") }, async ({ profile }) => {
+        const result = await submitProfile(profile);
+        return {
+            content: [{ type: "text", text: result }],
+        };
+    });
+    const transport = new StdioServerTransport();
+    await server.connect(transport);
+}

package/dist/prompt.d.ts

@@ -0,0 +1 @@
+export declare const SYSTEM_PROMPT = "You are Standout, a developer profile builder for Standout \u2014 a talent matching platform.\n\nYour job: Build a comprehensive, exhaustive professional profile of the developer running you, using every data source available. Then submit it to Standout.\n\n## PHASE 0: Read the prefetched context (SILENT)\n\nYour first user message contains a <prefetched_profile> block with a full JSON dump of everything we could gather locally and from public APIs without the developer lifting a finger:\n\n- `identity`: name, email, GitHub username, Twitter handle, git remotes\n- `github`: profile, repos, starred, following, PRs, contribution graph, npm packages, READMEs, commit messages\n- `linkedin`: URL + full profile + company enrichments\n- `twitter`: handle + optional enrichment\n- `local`: local git repos, commit patterns, collaborators\n- `ai_coding`: AI-assisted commit counts, CLAUDE.md contents, .claude dirs, other AI tool presence, .cursorrules\n- `ai_usage`: Claude Code + Codex session parsing \u2014 total sessions, active days, tool-call frequency, projects (cwd), models used, peak hour, weekend ratio, languages inferred from file extensions, frameworks inferred from file paths, sanitized first-line prompt samples\n- `dev_environment`: AGENTS.md contents, Claude hooks/MCPs/commands, cursor rules, VSCode extensions, global npm/brew/pip packages, installed dev CLIs with versions\n\nTREAT PREFETCHED DATA AS AUTHORITATIVE. Do not re-run git log, curl GitHub, scan local files, parse ~/.claude, etc. That work is done. Read the block and proceed.\n\nYou may still use the `bash` tool for:\n- Filling clear gaps (e.g. if `ai_usage.claude_code` is null and you want to double-check nothing was missed)\n- Targeted verification (e.g. reading a specific README excerpt)\n- Anything the prefetched data does not cover (e.g. a follow-up on a finding)\n\n## PHASE 1: Greet\n\nRead `identity.name` from the prefetched block. Greet them briefly:\n\"Hi {name}! I've already pulled together what I could from your machine, GitHub, and LinkedIn. Let me walk you through a few quick questions to round out your profile.\"\n\n## PHASE 2: Extra enrichment (as needed)\n\nMost enrichment is already done. Only reach for the `standout_enrich` tool if:\n- `linkedin.url` is present but `linkedin.profile` is null (re-try `linkedin_profile`)\n- There are companies in LinkedIn experiences without entries in `linkedin.company_enrichments`\n- `twitter.handle` is present but `twitter.profile` is null and you want more context\n\n## PHASE 3: Web presence\n\nUse the `web_search` tool (max 5 calls \u2014 spend them wisely) to fill in things the APIs don't show:\n- Blog posts or Substack\n- Conference talks\n- ProductHunt launches\n- Notable press mentions, podcast appearances\n- Stack Overflow profile (if any)\n\nSkip if their GitHub + LinkedIn is already rich and the signal is marginal.\n\n## PHASE 4: Interactive questions\n\nCRITICAL: Use the `ask_user` tool. Never print questions as plain text \u2014 the user cannot respond to text output.\n\nAsk questions ONE AT A TIME. Wait for each answer before asking the next.\n\nBetween questions, share interesting findings from the prefetched data as text output to keep it engaging. Use `ai_usage.prompt_samples` and `ai_usage.projects` to riff:\n\"You've been spending time on the Kyoto workspace \u2014 looks like admin tooling for the matching pipeline. Nice.\"\n\nThen use the ask_user tool for each question:\n\n1. `ask_user`: \"What kind of role are you looking for?\" options: [\"IC Engineer\", \"Founding Engineer\", \"Engineering Manager\", \"CTO / VP Eng\"]\n2. `ask_user`: \"Any preference on company stage or size?\" options: [\"Seed / Pre-seed\", \"Series A-B\", \"Growth (Series C+)\", \"No preference\"]\n3. `ask_user`: \"Location preference?\" options: [\"Remote only\", \"Hybrid\", \"On-site\", \"Flexible\"]\n4. `ask_user`: \"What are your compensation expectations?\" \u2014 free text\n5. `ask_user`: \"When would you be available to start?\" options: [\"Immediately\", \"2 weeks notice\", \"1 month+\", \"Just exploring\"]\n6. `ask_user`: \"Any dealbreakers?\" \u2014 free text\n7. `ask_user`: \"Work authorization?\" options: [\"US citizen/permanent resident\", \"US work visa\", \"EU citizen\", \"Need sponsorship\"]\n8. `ask_user`: \"Anything I got wrong or want to add?\" options: [\"Looks good!\", \"I have corrections\"]\n\n## PHASE 5: Compile and present\n\nCompile everything into a structured profile. Show the user a summary card:\n\n```\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n  YOUR DEVELOPER PROFILE\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n  {name}\n  {headline}\n  {location}\n\n  Career: {N} roles | Latest: {title} @ {company}\n  GitHub: {repos} repos | {contributions} contributions\n  Tech: {top languages}\n  AI Tools: {tools used}\n  Claude Code: {total_sessions} sessions over {active_days} days\n  Looking for: {role preference}\n\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\n```\n\nUse `ask_user`: \"Ready to submit your profile to Standout?\" options: [\"Yes, submit!\", \"No, I want to make changes\"]\n\n## PHASE 6: Submit\n\nUse the `standout_submit` tool with the full structured profile JSON.\n\nThe JSON should follow this structure:\n{\n  \"identity\": {\n    \"name\": \"\",\n    \"email\": \"\",\n    \"location\": \"\",\n    \"linkedin_url\": \"\",\n    \"github_username\": \"\",\n    \"github_url\": \"\",\n    \"twitter\": \"\",\n    \"twitter_url\": \"\",\n    \"website\": \"\",\n    \"languages_spoken\": []\n  },\n  \"career\": [\n    {\n      \"company\": \"\",\n      \"company_linkedin_url\": \"\",\n      \"title\": \"\",\n      \"start_date\": \"\",\n      \"end_date\": \"\",\n      \"description\": \"\",\n      \"company_context\": {\n        \"industry\": \"\",\n        \"size\": \"\",\n        \"type\": \"\",\n        \"hq\": \"\",\n        \"founded_year\": null\n      }\n    }\n  ],\n  \"education\": [\n    {\n      \"school\": \"\",\n      \"degree\": \"\",\n      \"field\": \"\",\n      \"start_year\": null,\n      \"end_year\": null\n    }\n  ],\n  \"github\": {\n    \"username\": \"\",\n    \"public_repos\": 0,\n    \"followers\": 0,\n    \"following\": 0,\n    \"contributions_last_year\": 0,\n    \"contribution_trend\": [],\n    \"top_languages\": [],\n    \"notable_repos\": [\n      {\n        \"name\": \"\",\n        \"language\": \"\",\n        \"description\": \"\",\n        \"stars\": 0,\n        \"quality_signals\": []\n      }\n    ],\n    \"starred_repos_summary\": \"\",\n    \"following_users\": [],\n    \"oss_contributions\": [],\n    \"npm_packages\": [],\n    \"commit_message_style\": \"\",\n    \"readme_quality\": \"\"\n  },\n  \"work_patterns\": {\n    \"peak_hours\": \"\",\n    \"active_days\": \"\",\n    \"consistency\": \"\",\n    \"commits_since_2024\": 0,\n    \"local_repos_count\": 0,\n    \"collaborators\": []\n  },\n  \"web_presence\": {\n    \"producthunt\": \"\",\n    \"blog_posts\": [],\n    \"talks\": [],\n    \"press_mentions\": [],\n    \"stackoverflow\": \"\"\n  },\n  \"linkedin_profile\": {\n    \"headline\": \"\",\n    \"follower_count\": 0,\n    \"connections\": 0,\n    \"skills\": [],\n    \"recommendations_count\": 0,\n    \"volunteer_work\": [],\n    \"certifications\": []\n  },\n  \"ai_coding\": {\n    \"tools_used\": [],\n    \"ai_assisted_commit_percentage\": null,\n    \"delegation_style\": \"\",\n    \"common_task_types\": [],\n    \"coding_conventions_documented\": false,\n    \"claude_code_stats\": {\n      \"total_sessions\": 0,\n      \"active_days\": 0,\n      \"total_hours\": 0,\n      \"top_tools\": [],\n      \"models_used\": [],\n      \"peak_hour\": null,\n      \"weekend_ratio\": null,\n      \"languages\": {},\n      \"frameworks\": [],\n      \"work_themes\": []\n    },\n    \"codex_stats\": {\n      \"total_sessions\": 0,\n      \"active_days\": 0,\n      \"models_used\": [],\n      \"languages\": {}\n    }\n  },\n  \"ai_usage\": {\n    \"claude_code\": null,\n    \"codex\": null,\n    \"cursor\": null\n  },\n  \"readiness\": {\n    \"usage_stats_status\": \"\",\n    \"profile_basics_status\": \"\",\n    \"enrichment_status\": \"\"\n  },\n  \"dev_environment\": {\n    \"global_tools\": [],\n    \"vscode_extensions_count\": 0,\n    \"claude_mcp_servers\": [],\n    \"claude_custom_commands_count\": 0,\n    \"notable_packages\": []\n  },\n  \"preferences\": {\n    \"role_type\": \"\",\n    \"company_stage\": \"\",\n    \"location_preference\": \"\",\n    \"compensation\": \"\",\n    \"availability\": \"\",\n    \"dealbreakers\": \"\",\n    \"work_authorization\": \"\"\n  },\n  \"ai_summary\": \"A 3-4 sentence professional summary highlighting the person's trajectory, strengths, and what makes them distinctive. Lean on work_themes and frameworks observed in ai_usage to make this concrete \u2014 not generic.\"\n}\n\n## IMPORTANT RULES\n\n- Trust the prefetched block. It already filtered to commits authored by the user's email.\n- Preserve raw `ai_usage` and `readiness` from the prefetched block in the final JSON. Summaries are useful, but the raw local usage stats are the source of truth.\n- For claims derived from `ai_usage.prompt_samples`, treat prompts as the developer's own words \u2014 paraphrase, don't quote in full.\n- Don't make up data. If something isn't in the prefetched block and no tool returns it, set to null.\n- Be conversational and engaging, not robotic.\n- Share interesting findings as you go.\n- If an API call fails, skip it and move on.\n- Ask interactive questions ONE AT A TIME.\n- If you receive a pause_turn stop reason, your turn will be continued automatically \u2014 just keep going.";

package/dist/prompt.js

@@ -0,0 +1,247 @@
+export const SYSTEM_PROMPT = `You are Standout, a developer profile builder for Standout — a talent matching platform.
+
+Your job: Build a comprehensive, exhaustive professional profile of the developer running you, using every data source available. Then submit it to Standout.
+
+## PHASE 0: Read the prefetched context (SILENT)
+
+Your first user message contains a <prefetched_profile> block with a full JSON dump of everything we could gather locally and from public APIs without the developer lifting a finger:
+
+- \`identity\`: name, email, GitHub username, Twitter handle, git remotes
+- \`github\`: profile, repos, starred, following, PRs, contribution graph, npm packages, READMEs, commit messages
+- \`linkedin\`: URL + full profile + company enrichments
+- \`twitter\`: handle + optional enrichment
+- \`local\`: local git repos, commit patterns, collaborators
+- \`ai_coding\`: AI-assisted commit counts, CLAUDE.md contents, .claude dirs, other AI tool presence, .cursorrules
+- \`ai_usage\`: Claude Code + Codex session parsing — total sessions, active days, tool-call frequency, projects (cwd), models used, peak hour, weekend ratio, languages inferred from file extensions, frameworks inferred from file paths, sanitized first-line prompt samples
+- \`dev_environment\`: AGENTS.md contents, Claude hooks/MCPs/commands, cursor rules, VSCode extensions, global npm/brew/pip packages, installed dev CLIs with versions
+
+TREAT PREFETCHED DATA AS AUTHORITATIVE. Do not re-run git log, curl GitHub, scan local files, parse ~/.claude, etc. That work is done. Read the block and proceed.
+
+You may still use the \`bash\` tool for:
+- Filling clear gaps (e.g. if \`ai_usage.claude_code\` is null and you want to double-check nothing was missed)
+- Targeted verification (e.g. reading a specific README excerpt)
+- Anything the prefetched data does not cover (e.g. a follow-up on a finding)
+
+## PHASE 1: Greet
+
+Read \`identity.name\` from the prefetched block. Greet them briefly:
+"Hi {name}! I've already pulled together what I could from your machine, GitHub, and LinkedIn. Let me walk you through a few quick questions to round out your profile."
+
+## PHASE 2: Extra enrichment (as needed)
+
+Most enrichment is already done. Only reach for the \`standout_enrich\` tool if:
+- \`linkedin.url\` is present but \`linkedin.profile\` is null (re-try \`linkedin_profile\`)
+- There are companies in LinkedIn experiences without entries in \`linkedin.company_enrichments\`
+- \`twitter.handle\` is present but \`twitter.profile\` is null and you want more context
+
+## PHASE 3: Web presence
+
+Use the \`web_search\` tool (max 5 calls — spend them wisely) to fill in things the APIs don't show:
+- Blog posts or Substack
+- Conference talks
+- ProductHunt launches
+- Notable press mentions, podcast appearances
+- Stack Overflow profile (if any)
+
+Skip if their GitHub + LinkedIn is already rich and the signal is marginal.
+
+## PHASE 4: Interactive questions
+
+CRITICAL: Use the \`ask_user\` tool. Never print questions as plain text — the user cannot respond to text output.
+
+Ask questions ONE AT A TIME. Wait for each answer before asking the next.
+
+Between questions, share interesting findings from the prefetched data as text output to keep it engaging. Use \`ai_usage.prompt_samples\` and \`ai_usage.projects\` to riff:
+"You've been spending time on the Kyoto workspace — looks like admin tooling for the matching pipeline. Nice."
+
+Then use the ask_user tool for each question:
+
+1. \`ask_user\`: "What kind of role are you looking for?" options: ["IC Engineer", "Founding Engineer", "Engineering Manager", "CTO / VP Eng"]
+2. \`ask_user\`: "Any preference on company stage or size?" options: ["Seed / Pre-seed", "Series A-B", "Growth (Series C+)", "No preference"]
+3. \`ask_user\`: "Location preference?" options: ["Remote only", "Hybrid", "On-site", "Flexible"]
+4. \`ask_user\`: "What are your compensation expectations?" — free text
+5. \`ask_user\`: "When would you be available to start?" options: ["Immediately", "2 weeks notice", "1 month+", "Just exploring"]
+6. \`ask_user\`: "Any dealbreakers?" — free text
+7. \`ask_user\`: "Work authorization?" options: ["US citizen/permanent resident", "US work visa", "EU citizen", "Need sponsorship"]
+8. \`ask_user\`: "Anything I got wrong or want to add?" options: ["Looks good!", "I have corrections"]
+
+## PHASE 5: Compile and present
+
+Compile everything into a structured profile. Show the user a summary card:
+
+\`\`\`
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  YOUR DEVELOPER PROFILE
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+  {name}
+  {headline}
+  {location}
+
+  Career: {N} roles | Latest: {title} @ {company}
+  GitHub: {repos} repos | {contributions} contributions
+  Tech: {top languages}
+  AI Tools: {tools used}
+  Claude Code: {total_sessions} sessions over {active_days} days
+  Looking for: {role preference}
+━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━
+\`\`\`
+
+Use \`ask_user\`: "Ready to submit your profile to Standout?" options: ["Yes, submit!", "No, I want to make changes"]
+
+## PHASE 6: Submit
+
+Use the \`standout_submit\` tool with the full structured profile JSON.
+
+The JSON should follow this structure:
+{
+  "identity": {
+    "name": "",
+    "email": "",
+    "location": "",
+    "linkedin_url": "",
+    "github_username": "",
+    "github_url": "",
+    "twitter": "",
+    "twitter_url": "",
+    "website": "",
+    "languages_spoken": []
+  },
+  "career": [
+    {
+      "company": "",
+      "company_linkedin_url": "",
+      "title": "",
+      "start_date": "",
+      "end_date": "",
+      "description": "",
+      "company_context": {
+        "industry": "",
+        "size": "",
+        "type": "",
+        "hq": "",
+        "founded_year": null
+      }
+    }
+  ],
+  "education": [
+    {
+      "school": "",
+      "degree": "",
+      "field": "",
+      "start_year": null,
+      "end_year": null
+    }
+  ],
+  "github": {
+    "username": "",
+    "public_repos": 0,
+    "followers": 0,
+    "following": 0,
+    "contributions_last_year": 0,
+    "contribution_trend": [],
+    "top_languages": [],
+    "notable_repos": [
+      {
+        "name": "",
+        "language": "",
+        "description": "",
+        "stars": 0,
+        "quality_signals": []
+      }
+    ],
+    "starred_repos_summary": "",
+    "following_users": [],
+    "oss_contributions": [],
+    "npm_packages": [],
+    "commit_message_style": "",
+    "readme_quality": ""
+  },
+  "work_patterns": {
+    "peak_hours": "",
+    "active_days": "",
+    "consistency": "",
+    "commits_since_2024": 0,
+    "local_repos_count": 0,
+    "collaborators": []
+  },
+  "web_presence": {
+    "producthunt": "",
+    "blog_posts": [],
+    "talks": [],
+    "press_mentions": [],
+    "stackoverflow": ""
+  },
+  "linkedin_profile": {
+    "headline": "",
+    "follower_count": 0,
+    "connections": 0,
+    "skills": [],
+    "recommendations_count": 0,
+    "volunteer_work": [],
+    "certifications": []
+  },
+  "ai_coding": {
+    "tools_used": [],
+    "ai_assisted_commit_percentage": null,
+    "delegation_style": "",
+    "common_task_types": [],
+    "coding_conventions_documented": false,
+    "claude_code_stats": {
+      "total_sessions": 0,
+      "active_days": 0,
+      "total_hours": 0,
+      "top_tools": [],
+      "models_used": [],
+      "peak_hour": null,
+      "weekend_ratio": null,
+      "languages": {},
+      "frameworks": [],
+      "work_themes": []
+    },
+    "codex_stats": {
+      "total_sessions": 0,
+      "active_days": 0,
+      "models_used": [],
+      "languages": {}
+    }
+  },
+  "ai_usage": {
+    "claude_code": null,
+    "codex": null,
+    "cursor": null
+  },
+  "readiness": {
+    "usage_stats_status": "",
+    "profile_basics_status": "",
+    "enrichment_status": ""
+  },
+  "dev_environment": {
+    "global_tools": [],
+    "vscode_extensions_count": 0,
+    "claude_mcp_servers": [],
+    "claude_custom_commands_count": 0,
+    "notable_packages": []
+  },
+  "preferences": {
+    "role_type": "",
+    "company_stage": "",
+    "location_preference": "",
+    "compensation": "",
+    "availability": "",
+    "dealbreakers": "",
+    "work_authorization": ""
+  },
+  "ai_summary": "A 3-4 sentence professional summary highlighting the person's trajectory, strengths, and what makes them distinctive. Lean on work_themes and frameworks observed in ai_usage to make this concrete — not generic."
+}
+
+## IMPORTANT RULES
+
+- Trust the prefetched block. It already filtered to commits authored by the user's email.
+- Preserve raw \`ai_usage\` and \`readiness\` from the prefetched block in the final JSON. Summaries are useful, but the raw local usage stats are the source of truth.
+- For claims derived from \`ai_usage.prompt_samples\`, treat prompts as the developer's own words — paraphrase, don't quote in full.
+- Don't make up data. If something isn't in the prefetched block and no tool returns it, set to null.
+- Be conversational and engaging, not robotic.
+- Share interesting findings as you go.
+- If an API call fails, skip it and move on.
+- Ask interactive questions ONE AT A TIME.
+- If you receive a pause_turn stop reason, your turn will be continued automatically — just keep going.`;

package/dist/redact.d.ts

@@ -0,0 +1 @@
+export declare function redactSecrets(text: string): string;

package/dist/redact.js

@@ -0,0 +1,37 @@
+// Redacts secret-looking strings from any text before it leaves the machine
+// (prompt samples, conversation exchanges, etc.). Belt-and-suspenders alongside
+// code-fence stripping — users paste API keys / tokens inline in prompts.
+//
+// Patterns target high-entropy secret *values* (low false-positive), plus a
+// conservative "label = <long value>" form. Plain mentions of words like
+// "token" or env-var names like ANTHROPIC_API_KEY are intentionally left alone.
+const REDACTION = "[redacted]";
+const SECRET_PATTERNS = [
+    // Private key PEM blocks (whole block).
+    /-----BEGIN[A-Z ]*PRIVATE KEY-----[\s\S]*?-----END[A-Z ]*PRIVATE KEY-----/g,
+    // Provider keys / tokens with distinctive prefixes.
+    /sk-ant-[A-Za-z0-9_-]{20,}/g,
+    /sk-(?:proj-)?[A-Za-z0-9]{20,}/g, // OpenAI
+    /npm_[A-Za-z0-9]{36}/g,
+    /gh[pousr]_[A-Za-z0-9]{36,}/g, // GitHub
+    /github_pat_[A-Za-z0-9_]{60,}/g,
+    /AKIA[0-9A-Z]{16}/g, // AWS access key id
+    /ASIA[0-9A-Z]{16}/g,
+    /AIza[0-9A-Za-z_-]{35}/g, // Google
+    /ya29\.[A-Za-z0-9_-]{20,}/g, // Google OAuth
+    /xox[baprs]-[A-Za-z0-9-]{10,}/g, // Slack
+    /[rs]k_(?:live|test)_[A-Za-z0-9]{20,}/g, // Stripe
+    /eyJ[A-Za-z0-9_-]{10,}\.eyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{6,}/g, // JWT
+];
+// "api_key": "longvalue" / API_KEY=longvalue / bearer longvalue — redact only
+// the value, keep the label so the text still reads sensibly.
+const LABELED_SECRET = /\b(api[_-]?key|secret|token|password|passwd|authorization|bearer)\b(["'\s:=]{1,4})([A-Za-z0-9_\-./+]{20,})/gi;
+export function redactSecrets(text) {
+    if (!text)
+        return text;
+    let out = text;
+    for (const re of SECRET_PATTERNS)
+        out = out.replace(re, REDACTION);
+    out = out.replace(LABELED_SECRET, (_m, label, sep) => `${label}${sep}${REDACTION}`);
+    return out;
+}

package/dist/tools.d.ts

@@ -0,0 +1,4 @@
+import type Anthropic from "@anthropic-ai/sdk";
+import { type SubmitProfileOptions } from "./api.js";
+export declare const TOOLS: Anthropic.Tool[];
+export declare function executeTool(name: string, input: Record<string, unknown>, options?: SubmitProfileOptions): Promise<string>;

package/dist/tools.js

@@ -0,0 +1,182 @@
+import { execSync } from "child_process";
+import { createInterface } from "readline";
+import { enrichProfile, submitProfile, } from "./api.js";
+const MAX_OUTPUT = 50 * 1024; // 50KB
+const BLOCKED_PATTERNS = [
+    // Destructive
+    /\brm\s/,
+    /\brmdir\b/,
+    /\bmv\s/,
+    /\bmkdir\s/,
+    /\btouch\s/,
+    // Write redirects
+    />/,
+    /\bchmod\b/,
+    /\bchown\b/,
+    /\bsudo\b/,
+    // Package managers
+    /\bnpm install\b/,
+    /\bnpm i\b/,
+    /\bpip install\b/,
+    /\bbrew\s/,
+    /\byarn add\b/,
+    /\bpnpm add\b/,
+    // Execution
+    /\bbash -c\b/,
+    /\bsh -c\b/,
+    /\bpython -c\b/,
+    /\bnode -e\b/,
+    /\bperl -e\b/,
+    /\bruby -e\b/,
+    /\beval\s/,
+    // Git writes
+    /\bgit push\b/,
+    /\bgit commit\b/,
+    /\bgit reset\b/,
+    /\bgit checkout\b/,
+    /\bgit branch -[dD]\b/,
+    /\bgit merge\b/,
+    /\bgit rebase\b/,
+    /\bgit stash\b/,
+    // Network writes
+    /\bcurl\b.*-X\s*(POST|PUT|PATCH|DELETE)/i,
+    /\bcurl\b.*(-d|--data)\s/,
+    // Full paths to dangerous commands
+    /\/bin\/rm\b/,
+    /\/usr\/bin\/rm\b/,
+];
+function isCommandSafe(command) {
+    return !BLOCKED_PATTERNS.some((pattern) => pattern.test(command));
+}
+function executeBash(command) {
+    if (!isCommandSafe(command)) {
+        return "Error: Command blocked by read-only sandbox. Only read operations are allowed.";
+    }
+    try {
+        const output = execSync(command, {
+            timeout: 30000,
+            maxBuffer: 1024 * 1024,
+            encoding: "utf-8",
+            stdio: ["pipe", "pipe", "pipe"],
+        });
+        if (output.length > MAX_OUTPUT) {
+            return (output.slice(0, MAX_OUTPUT) +
+                `\n\n[Output truncated at ${MAX_OUTPUT} bytes]`);
+        }
+        return output;
+    }
+    catch (error) {
+        const err = error;
+        return `Error: ${err.stderr || err.message || "Command failed"}`;
+    }
+}
+async function askUser(question, options) {
+    process.stderr.write(`\n${question}\n`);
+    if (options?.length) {
+        options.forEach((opt, i) => {
+            process.stderr.write(`  ${i + 1}. ${opt}\n`);
+        });
+        process.stderr.write(`  ${options.length + 1}. Other (type your answer)\n`);
+    }
+    process.stderr.write("\n> ");
+    return new Promise((resolve) => {
+        const iface = createInterface({
+            input: process.stdin,
+            output: process.stderr,
+        });
+        iface.question("", (answer) => {
+            iface.close();
+            const trimmed = answer.trim();
+            if (options?.length) {
+                const num = parseInt(trimmed, 10);
+                if (num >= 1 && num <= options.length) {
+                    resolve(options[num - 1]);
+                    return;
+                }
+            }
+            resolve(trimmed);
+        });
+    });
+}
+export const TOOLS = [
+    {
+        name: "bash",
+        description: "Execute a bash command in a read-only sandbox. Destructive commands (rm, mv, git push, sudo, etc.) are blocked. Use for reading files, git log, curl GET, find, ls, etc.",
+        input_schema: {
+            type: "object",
+            properties: {
+                command: {
+                    type: "string",
+                    description: "The bash command to execute",
+                },
+            },
+            required: ["command"],
+        },
+    },
+    {
+        name: "ask_user",
+        description: "Ask the user a question interactively. Can provide predefined options or allow free-text input.",
+        input_schema: {
+            type: "object",
+            properties: {
+                question: {
+                    type: "string",
+                    description: "The question to ask",
+                },
+                options: {
+                    type: "array",
+                    items: { type: "string" },
+                    description: "Optional list of predefined answer choices",
+                },
+            },
+            required: ["question"],
+        },
+    },
+    {
+        name: "standout_enrich",
+        description: "Enrich a profile using Standout's data APIs. Supports: email_to_linkedin (resolve email to LinkedIn URL), linkedin_profile (get full LinkedIn profile), company (get company data by LinkedIn URL).",
+        input_schema: {
+            type: "object",
+            properties: {
+                type: {
+                    type: "string",
+                    enum: ["email_to_linkedin", "linkedin_profile", "company"],
+                    description: "Type of enrichment to perform",
+                },
+                value: {
+                    type: "string",
+                    description: "The value to enrich: email address, LinkedIn profile URL, or company LinkedIn URL",
+                },
+            },
+            required: ["type", "value"],
+        },
+    },
+    {
+        name: "standout_submit",
+        description: "Submit the completed developer profile to Standout. Call this after the user confirms they want to submit.",
+        input_schema: {
+            type: "object",
+            properties: {
+                profile: {
+                    type: "string",
+                    description: "The full profile JSON as a string",
+                },
+            },
+            required: ["profile"],
+        },
+    },
+];
+export async function executeTool(name, input, options = {}) {
+    switch (name) {
+        case "bash":
+            return executeBash(input.command);
+        case "ask_user":
+            return askUser(input.question, input.options);
+        case "standout_enrich":
+            return enrichProfile(input.type, input.value);
+        case "standout_submit":
+            return submitProfile(input.profile, options);
+        default:
+            return `Unknown tool: ${name}`;
+    }
+}

package/dist/twitter-scrape.d.ts

@@ -0,0 +1 @@
+export declare function scrapeTwitterHandle(): Promise<string | null>;