ysagc-agent 0.2.0 → 0.4.0

package/README.md

@@ -1,90 +1,60 @@
 # ysagc-agent
 
-代码工作台本机代理：替浏览器在本机执行**文件 / Git / 终端**操作。只处理工作台发来的指令，不偷传数据、不常驻收集信息。
+一个在用户本机运行的**本地执行 Agent**：它通过 WebSocket 连接到平台后端，接收工具指令，在**授权根目录内**安全地读写文件、执行命令、联网检索，并把结果回传。它本身**无状态**——不保存余额、不做计费判断、不持有平台密钥。
 
-- 仅监听 `127.0.0.1`（浏览器可信源），HTTPS 页面不拦截
-- 通信：JSON-RPC 2.0 over WebSocket（控制通道）+ 二进制帧（终端通道）
-- 路径沙箱：只能操作 allowlist（用户显式添加的项目根目录）内路径
-- 终端：node-pty（Windows: PowerShell / macOS·Linux: 默认 shell），输入输出**不经过网站后端**
-- **免配对码**（v0.2.0）：浏览器打开网站「工作台」自动识别并连接本机代理，无需输入配对码、无需安装 exe
+A state-agnostic local execution agent: it connects to a platform backend over WebSocket, executes tool instructions inside an **authorization root**, and reports results back. It never stores balance, never makes billing decisions, and never holds platform secrets.
 
-## 安装（npm 方式，全球通用）
+---
 
-要求 Node.js ≥ 20（Windows / macOS / Linux 均可）。
+## 快速开始 / Quick Start
 
 ```bash
-# 方式一：免安装，直接跑（推荐，首次会下载依赖包）
-npx ysagc-agent
-
-# 方式二：全局安装后运行
 npm i -g ysagc-agent
-ysagc-agent
-```
-
-启动后终端会显示 `ysagc-agent 运行中: ws://127.0.0.1:37890`，保持该终端窗口开启即可（最小化没问题，不要关闭）。
-
-## 使用流程
-
-1. 打开终端执行 `npx ysagc-agent`（保持运行）。
-2. 打开网站「工作台」，点击「新增工作区」→ 选择本机文件夹。
-3. 在聊天中把话题「绑定工作区」后，AI 就能在对应文件夹里读文件、改代码、跑命令了。
-
-> 旧版（0.1.x）安装包渠道与配对码流程已不再需要；如需卸载：`npm rm -g ysagc-agent`。
-
-## 配置（agent.json）
-
-位置：`~/.ysagc-agent/agent.json`（Windows 为 `C:\Users\<你>\.ysagc-agent`）。非法 JSON 会自动备份恢复。
-
-```jsonc
-{
-  "port": 37890,               // 端口被占用自动 +1（最多 5 次）
-  "allowedRoots": [],          // 授权项目根目录（网站添加工作区时自动写入）
-  "deviceTokenWhitelist": [],  // 旧版配对令牌（sha256，兼容保留）
-  "originWhitelist": [],       // 允许直连的浏览器 Origin；留空=自动信任站点与 localhost
-  "trashEnabled": true,        // 删除进回收站
-  "trashRetentionDays": 7,
-  "enableTerminal": true,      // 终端开关
-  "terminalMaxSessions": 3,
-  "terminalIdleTimeoutMin": 30,
-  "terminalPermission": "ask", // ask=每次询问 / allow=始终允许 / deny=拒绝
-  "backendUrl": "https://chat.ysagc.top",
-  "logLevel": "info"
-}
+ysagc-agent --server ws://your-platform.com/agent \
+            --token YOUR_DEVICE_TOKEN \
+            --root "C:/Users/you/projects"
 ```
 
-## 常见问题
+## 配置 / Configuration（环境变量 / CLI）
 
-**Q：端口被占用怎么办？** 自动尝试 37891–37894；也可 `ysagc-agent --port <端口>` 指定。
+| 参数 | 环境变量 | 说明 |
+|---|---|---|
+| `--server` | `WS_URL` | 平台 WebSocket 地址（必填） |
+| `--token` | `YSAGC_TOKEN` | 设备/Agent 鉴权 token（必填） |
+| `--device-id` | `DEVICE_ID` | 设备标识 |
+| `--root` | `WORKSPACE_ROOT` | 授权根目录（文件操作必须在此之内） |
+| `--mode` | `PERMISSION_MODE` | `supervise`/`smart`/`auto`（默认 `smart`） |
+| `--web` | `--web` | 是否开启联网检索 |
+| `--timeout` | `--timeout` | 单条命令超时（毫秒，默认 120000） |
+| `--max-bytes` | `--max-bytes` | 单流输出上限（字节，默认 64000） |
+| `--selftest` |  | 运行本地自检并退出（0/1） |
 
-**Q：网页提示"未检测到本机代理"？** 确认 Agent 已在终端运行（能看到 `运行中: ws://127.0.0.1:37890`）；首次 `npx` 会先下载依赖，稍等片刻。
+## 工具 / Tools
 
-**Q：macOS 提示"无法打开"？** npm 方式无需处理；仅安装包渠道需要右键 → 打开。
+- `list_dir`（列目录）、`read_file`（读文件）、`write_file`（写文件）、`edit_file`（编辑文件）
+- `run_command`（运行命令，含超时/输出上限）、`git`（Git 包装）、`generate`（生成骨架）、`web_search`（联网检索，平台侧执行）
 
-**Q：日志在哪？** `~/.ysagc-agent/logs/agent.log`。日志**永不记录**密钥文件内容与 Git 凭证。
+每个工具都会：**规范化路径**、**断言在授权根内**、拒绝根外/敏感路径，并保证**幂等**（相同 `idempotencyKey` 不重复执行/不重复写）。
 
-**Q：Agent 会读取我电脑上的所有文件吗？** 不会。Agent 只能访问你在网站显式添加的工作区目录（allowlist），越界操作一律拒绝并记录审计；终端除外（终端等同于你的命令行，可操作整台电脑——首次使用会在网页端弹安全确认）。
+## 安全模型 / Security Model
 
-**Q：其他网站能控制我的 Agent 吗？** 不能。Agent 只信任站点域名与 localhost 来源（Origin 白名单），其他网页发起的连接会被拒绝。
+- **授权根**：文件操作只能发生在 `--root` 之内；根外与符号链接逃逸一律拒绝。
+- **危险命令**：`rm -rf`、`sudo`、`format`、`del /f`、`shutdown`、`git reset --hard` 等命中即按严重级别拦截（跨 bash / powershell / cmd）。
+- **敏感路径**：`/etc/passwd`、`~/.ssh`、含密钥的 `.env`、`.npmrc` 等一律拒绝。
+- **密钥脱敏**：所有日志/结果对 `sk-***`、token、密码打码。
+- **本地不存账**：不信任、不保存余额，一切余额/计费以平台下发为准。
 
-## 开发
+## 自检 / Self-test
 
 ```bash
-npm ci
-npm start            # 启动
-npm run smoke        # 冒烟测试（WS 鉴权 / RPC / 终端全链路）
-node scripts/smoke.js <token> <port>   # 自定义参数
+ysagc-agent --selftest
+# [PASS] ... 27/27 passed.
 ```
 
-打包（单文件，可选）：
-
-```bash
-npx @yao-pkg/pkg . --target node22-win-x64 --output dist/ysagc-agent.exe
-# 三平台（Linux 环境可交叉产出）：
-npx @yao-pkg/pkg . --target node22-win-x64,node22-macos-x64,node22-linux-x64 --output dist/ysagc-agent
-```
+## 协议 / Protocol
 
-CI：`.gitlab-ci.yml`（build 产物 + tag 触发发布到 Package Registry / npm）。
+WebSocket 上行 JSON 消息：`hello`、`pong`、`tool_result`、`status`；下行：`welcome`、`ping`、`tool_call`、`cancel`。心跳 + 指数退避自动重连。
 
-## 隐私
+## License
 
-Agent 与网站后端的交互仅限：设备自动注册、版本握手、审计元数据。**项目文件内容、终端输入输出、Git 凭证一律不经过网站后端**。
+MIT

package/dist/agent.d.ts

@@ -0,0 +1,17 @@
+import { type ClientState } from './protocol';
+import { type AgentConfig } from './config';
+/** Kept in sync with package.json. */
+export declare const AGENT_VERSION = "0.4.0";
+export interface AgentHandle {
+    stop(): void;
+}
+export interface AgentEvents {
+    /** Called when the agent transitions connectivity state. */
+    onState?: (state: ClientState) => void;
+}
+/** Start the local agent. Throws {@link ConfigError} for missing required
+ * config (no server/token/device-id) with a friendly message. */
+export declare function startAgent(config: AgentConfig, events?: AgentEvents): AgentHandle;
+/** Convenience wrapper that loads config from env/CLI and starts the agent. */
+export declare function startAgentFromEnv(overrides?: Partial<AgentConfig>): AgentHandle;
+//# sourceMappingURL=agent.d.ts.map

package/dist/agent.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.d.ts","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":"AACA,OAAO,EAWL,KAAK,WAAW,EACjB,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAgE,KAAK,WAAW,EAAE,MAAM,UAAU,CAAC;AAG1G,sCAAsC;AACtC,eAAO,MAAM,aAAa,UAAU,CAAC;AAQrC,MAAM,WAAW,WAAW;IAC1B,IAAI,IAAI,IAAI,CAAC;CACd;AAED,MAAM,WAAW,WAAW;IAC1B,4DAA4D;IAC5D,OAAO,CAAC,EAAE,CAAC,KAAK,EAAE,WAAW,KAAK,IAAI,CAAC;CACxC;AAyRD;iEACiE;AACjE,wBAAgB,UAAU,CAAC,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,WAAW,CAGjF;AAED,+EAA+E;AAC/E,wBAAgB,iBAAiB,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,GAAG,WAAW,CAG/E"}

package/dist/agent.js

@@ -0,0 +1,293 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AGENT_VERSION = void 0;
+exports.startAgent = startAgent;
+exports.startAgentFromEnv = startAgentFromEnv;
+const ws_1 = __importDefault(require("ws"));
+const protocol_1 = require("./protocol");
+const tools_1 = require("./tools");
+const config_1 = require("./config");
+/** Kept in sync with package.json. */
+exports.AGENT_VERSION = '0.4.0';
+const MAX_IDEMPOTENCY_ENTRIES = 512;
+const RECONNECT_BASE_MS = 1000;
+const RECONNECT_CAP_MS = 60000;
+const HEARTBEAT_MS = 30000;
+const READY_OPEN = 1; // ws.WebSocket.OPEN
+class Agent {
+    constructor(config, events) {
+        this.ws = null;
+        this.sessionId = '';
+        this.state = 'error';
+        this.stopped = false;
+        this.intentionalClose = false;
+        this.reconnectAttempt = 0;
+        this.jobs = new Map();
+        this.idempotencyCache = new Map();
+        this.config = config;
+        this.events = events;
+        this.log = (0, config_1.loggerFromConfig)(config);
+        this.registry = (0, tools_1.createToolRegistry)({
+            root: config.root,
+            mode: config.mode,
+            webEnabled: config.web,
+            timeoutMs: config.timeoutMs,
+            maxBytes: config.maxBytes,
+            logger: this.log.child('tools'),
+        });
+    }
+    start() {
+        (0, config_1.validateConfig)(this.config);
+        this.log.info('starting agent', (0, config_1.describeConfig)(this.config));
+        this.connect();
+        this.startHeartbeat();
+        return { stop: () => this.stop() };
+    }
+    connect() {
+        if (this.stopped)
+            return;
+        if (this.ws) {
+            this.log.debug('already connected, ignoring connect()');
+            return;
+        }
+        this.log.info('connecting', { url: this.config.server });
+        const ws = new ws_1.default(this.config.server, { handshakeTimeout: 15000, perMessageDeflate: false });
+        this.ws = ws;
+        ws.on('open', () => {
+            this.log.info('socket open; sending hello');
+            this.sendHello();
+        });
+        ws.on('message', (data) => {
+            this.handleMessage(data);
+        });
+        ws.on('pong', () => {
+            this.log.debug('pong received');
+        });
+        ws.on('unexpected-response', (_req, res) => {
+            this.log.warn('unexpected ws response', { status: res.statusCode });
+        });
+        ws.on('error', (err) => {
+            this.log.error('ws error', { error: err.message });
+        });
+        ws.on('close', (code, reason) => {
+            this.ws = null;
+            this.setStatus('error');
+            const reasonText = reason.toString();
+            this.log.warn('socket closed', { code, reason: reasonText });
+            if (this.intentionalClose || this.stopped)
+                return;
+            this.scheduleReconnect();
+        });
+    }
+    sendHello() {
+        const { token, deviceId, platform } = this.config;
+        this.send({
+            type: 'hello',
+            token,
+            deviceId,
+            version: exports.AGENT_VERSION,
+            platform,
+        });
+    }
+    send(msg) {
+        if (this.ws && this.ws.readyState === READY_OPEN) {
+            this.ws.send((0, protocol_1.encodeMessage)(msg));
+        }
+        else {
+            this.log.debug('dropping outbound message (socket not open)', { type: msg.type });
+        }
+    }
+    handleMessage(data) {
+        const text = rawToString(data);
+        const msg = (0, protocol_1.decodeMessage)(text);
+        if (!msg) {
+            this.log.warn('ignoring malformed frame');
+            return;
+        }
+        switch (msg.type) {
+            case 'welcome':
+                this.onWelcome(msg);
+                break;
+            case 'ping':
+                this.onPing(msg);
+                break;
+            case 'tool_call':
+                this.onToolCall(msg);
+                break;
+            case 'cancel':
+                this.onCancel(msg);
+                break;
+            default:
+                this.log.warn('unhandled message type', { type: msg.type });
+        }
+    }
+    onWelcome(msg) {
+        if (!(0, protocol_1.isWelcome)(msg))
+            return;
+        this.sessionId = msg.sessionId;
+        // A successful handshake resets the backoff ramp.
+        this.reconnectAttempt = 0;
+        this.setStatus('online');
+        this.log.info('welcomed', { sessionId: this.sessionId });
+    }
+    onPing(msg) {
+        if (!(0, protocol_1.isPing)(msg))
+            return;
+        this.send({ type: 'pong', t: msg.t });
+        this.log.debug('replied to ping');
+    }
+    async onToolCall(msg) {
+        if (!(0, protocol_1.isToolCall)(msg))
+            return;
+        const { jobId, tool, args, idempotencyKey } = msg;
+        const key = (0, protocol_1.computeIdempotencyKey)(tool, args ?? {}, idempotencyKey);
+        if (this.idempotencyCache.has(key)) {
+            const cached = this.idempotencyCache.get(key);
+            this.log.info('serving cached result', { jobId, tool });
+            this.sendResult({ ...cached, cached: true, durationMs: cached.durationMs }, jobId);
+            return;
+        }
+        this.setStatus('busy');
+        const controller = new AbortController();
+        this.jobs.set(jobId, controller);
+        this.log.info('running tool', { jobId, tool });
+        try {
+            const result = await this.registry.dispatch(tool, args ?? {}, controller.signal);
+            if (controller.signal.aborted) {
+                // The platform sent a cancel for this job; report it explicitly.
+                this.sendResult({ ok: false, error: 'Job cancelled by platform', durationMs: result.durationMs }, jobId);
+                return;
+            }
+            this.cacheResult(key, result);
+            this.sendResult(result, jobId);
+        }
+        finally {
+            this.jobs.delete(jobId);
+            if (this.jobs.size === 0)
+                this.setStatus('online');
+        }
+    }
+    onCancel(msg) {
+        if (!(0, protocol_1.isCancel)(msg))
+            return;
+        const controller = this.jobs.get(msg.jobId);
+        if (controller) {
+            controller.abort();
+            this.log.info('cancelled job', { jobId: msg.jobId });
+        }
+        else {
+            this.log.warn('cancel for unknown/job already finished', { jobId: msg.jobId });
+        }
+    }
+    sendResult(result, jobId) {
+        const message = {
+            type: 'tool_result',
+            jobId,
+            ok: result.ok,
+            durationMs: result.durationMs,
+            ...(result.result !== undefined ? { result: result.result } : {}),
+            ...(result.error !== undefined ? { error: result.error } : {}),
+            ...(result.cached ? { cached: true } : {}),
+        };
+        this.send(message);
+        if (result.ok) {
+            this.log.info('sent result', { jobId, ok: true, durationMs: result.durationMs, cached: !!result.cached });
+        }
+        else {
+            this.log.info('sent result', { jobId, ok: false, error: result.error, durationMs: result.durationMs });
+        }
+    }
+    cacheResult(key, result) {
+        if (this.idempotencyCache.size >= MAX_IDEMPOTENCY_ENTRIES) {
+            const oldest = this.idempotencyCache.keys().next().value;
+            if (oldest !== undefined)
+                this.idempotencyCache.delete(oldest);
+        }
+        this.idempotencyCache.set(key, result);
+    }
+    setStatus(state) {
+        if (this.state === state)
+            return;
+        this.state = state;
+        this.send({ type: 'status', state, ...(this.sessionId ? { sessionId: this.sessionId } : {}), ts: Date.now() });
+        this.events?.onState?.(state);
+        this.log.info('status', { state });
+    }
+    startHeartbeat() {
+        if (this.heartbeatTimer)
+            return;
+        this.heartbeatTimer = setInterval(() => {
+            if (!this.stopped && this.state !== 'error' && this.ws) {
+                this.send({ type: 'status', state: this.state, ...(this.sessionId ? { sessionId: this.sessionId } : {}), ts: Date.now() });
+            }
+        }, HEARTBEAT_MS);
+        this.heartbeatTimer.unref?.();
+    }
+    scheduleReconnect() {
+        if (this.stopped)
+            return;
+        if (this.reconnectTimer)
+            return;
+        const delay = Math.min(RECONNECT_CAP_MS, RECONNECT_BASE_MS * Math.pow(2, this.reconnectAttempt));
+        this.reconnectAttempt += 1;
+        this.log.info('reconnecting', { delayMs: delay, attempt: this.reconnectAttempt });
+        this.reconnectTimer = setTimeout(() => {
+            this.reconnectTimer = undefined;
+            this.connect();
+        }, delay);
+        this.reconnectTimer.unref?.();
+    }
+    stop() {
+        this.log.info('stopping agent');
+        this.stopped = true;
+        this.intentionalClose = true;
+        if (this.reconnectTimer) {
+            clearTimeout(this.reconnectTimer);
+            this.reconnectTimer = undefined;
+        }
+        if (this.heartbeatTimer) {
+            clearInterval(this.heartbeatTimer);
+            this.heartbeatTimer = undefined;
+        }
+        for (const controller of this.jobs.values())
+            controller.abort();
+        this.jobs.clear();
+        if (this.ws) {
+            try {
+                this.ws.close(1000, 'agent stopping');
+            }
+            catch {
+                /* ignore */
+            }
+            this.ws = null;
+        }
+    }
+}
+/** Convert a ws RawData frame into a UTF-8 string. */
+function rawToString(data) {
+    if (typeof data === 'string')
+        return data;
+    if (Array.isArray(data)) {
+        return Buffer.concat(data).toString('utf8');
+    }
+    if (data instanceof ArrayBuffer) {
+        return Buffer.from(data).toString('utf8');
+    }
+    // Buffer (or other Uint8Array)
+    return Buffer.from(data).toString('utf8');
+}
+/** Start the local agent. Throws {@link ConfigError} for missing required
+ * config (no server/token/device-id) with a friendly message. */
+function startAgent(config, events) {
+    const agent = new Agent(config, events);
+    return agent.start();
+}
+/** Convenience wrapper that loads config from env/CLI and starts the agent. */
+function startAgentFromEnv(overrides) {
+    const config = (0, config_1.loadConfig)(overrides);
+    return startAgent(config);
+}
+//# sourceMappingURL=agent.js.map

package/dist/agent.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent.js","sourceRoot":"","sources":["../src/agent.ts"],"names":[],"mappings":";;;;;;AA6TA,gCAGC;AAGD,8CAGC;AAtUD,4CAA6C;AAC7C,yCAYoB;AACpB,mCAA8D;AAC9D,qCAA0G;AAG1G,sCAAsC;AACzB,QAAA,aAAa,GAAG,OAAO,CAAC;AAErC,MAAM,uBAAuB,GAAG,GAAG,CAAC;AACpC,MAAM,iBAAiB,GAAG,IAAK,CAAC;AAChC,MAAM,gBAAgB,GAAG,KAAM,CAAC;AAChC,MAAM,YAAY,GAAG,KAAM,CAAC;AAC5B,MAAM,UAAU,GAAG,CAAC,CAAC,CAAC,oBAAoB;AAW1C,MAAM,KAAK;IAgBT,YAAY,MAAmB,EAAE,MAAoB;QAb7C,OAAE,GAAqB,IAAI,CAAC;QAC5B,cAAS,GAAG,EAAE,CAAC;QACf,UAAK,GAAgB,OAAO,CAAC;QAC7B,YAAO,GAAG,KAAK,CAAC;QAChB,qBAAgB,GAAG,KAAK,CAAC;QACzB,qBAAgB,GAAG,CAAC,CAAC;QAGZ,SAAI,GAAG,IAAI,GAAG,EAA2B,CAAC;QAC1C,qBAAgB,GAAG,IAAI,GAAG,EAAsB,CAAC;QAKhE,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,GAAG,GAAG,IAAA,yBAAgB,EAAC,MAAM,CAAC,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,IAAA,0BAAkB,EAAC;YACjC,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,IAAI,EAAE,MAAM,CAAC,IAAI;YACjB,UAAU,EAAE,MAAM,CAAC,GAAG;YACtB,SAAS,EAAE,MAAM,CAAC,SAAS;YAC3B,QAAQ,EAAE,MAAM,CAAC,QAAQ;YACzB,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC;SAChC,CAAC,CAAC;IACL,CAAC;IAED,KAAK;QACH,IAAA,uBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAA,uBAAc,EAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAC7D,IAAI,CAAC,OAAO,EAAE,CAAC;QACf,IAAI,CAAC,cAAc,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,CAAC;IACrC,CAAC;IAEO,OAAO;QACb,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,uCAAuC,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,EAAE,EAAE,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QACzD,MAAM,EAAE,GAAG,IAAI,YAAS,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,gBAAgB,EAAE,KAAM,EAAE,iBAAiB,EAAE,KAAK,EAAE,CAAC,CAAC;QACrG,IAAI,CAAC,EAAE,GAAG,EAAE,CAAC;QAEb,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;YAC5C,IAAI,CAAC,SAAS,EAAE,CAAC;QACnB,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE;YACxB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3B,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;QAClC,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,qBAAqB,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE;YACzC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC;QACtE,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACrB,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACrD,CAAC,CAAC,CAAC;QAEH,EAAE,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;YAC9B,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;YACf,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;YACxB,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;YAC7D,IAAI,IAAI,CAAC,gBAAgB,IAAI,IAAI,CAAC,OAAO;gBAAE,OAAO;YAClD,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3B,CAAC,CAAC,CAAC;IACL,CAAC;IAEO,SAAS;QACf,MAAM,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,GAAG,IAAI,CAAC,MAAM,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC;YACR,IAAI,EAAE,OAAO;YACb,KAAK;YACL,QAAQ;YACR,OAAO,EAAE,qBAAa;YACtB,QAAQ;SACT,CAAC,CAAC;IACL,CAAC;IAEO,IAAI,CAAC,GAAkB;QAC7B,IAAI,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC,UAAU,KAAK,UAAU,EAAE,CAAC;YACjD,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAA,wBAAa,EAAC,GAAG,CAAC,CAAC,CAAC;QACnC,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,6CAA6C,EAAE,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC;QACpF,CAAC;IACH,CAAC;IAEO,aAAa,CAAC,IAAa;QACjC,MAAM,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,IAAA,wBAAa,EAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,GAAG,EAAE,CAAC;YACT,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,0BAA0B,CAAC,CAAC;YAC1C,OAAO;QACT,CAAC;QACD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,SAAS;gBACZ,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACpB,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;gBACjB,MAAM;YACR,KAAK,WAAW;gBACd,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC;gBACrB,MAAM;YACR,KAAK,QAAQ;gBACX,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;gBACnB,MAAM;YACR;gBACE,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,wBAAwB,EAAE,EAAE,IAAI,EAAG,GAAqB,CAAC,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;IACH,CAAC;IAEO,SAAS,CAAC,GAAwC;QACxD,IAAI,CAAC,IAAA,oBAAS,EAAC,GAAG,CAAC;YAAE,OAAO;QAC5B,IAAI,CAAC,SAAS,GAAG,GAAG,CAAC,SAAS,CAAC;QAC/B,kDAAkD;QAClD,IAAI,CAAC,gBAAgB,GAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACzB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;IAC3D,CAAC;IAEO,MAAM,CAAC,GAAqC;QAClD,IAAI,CAAC,IAAA,iBAAM,EAAC,GAAG,CAAC;YAAE,OAAO;QACzB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;QACtC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,iBAAiB,CAAC,CAAC;IACpC,CAAC;IAEO,KAAK,CAAC,UAAU,CAAC,GAA0C;QACjE,IAAI,CAAC,IAAA,qBAAU,EAAC,GAAG,CAAC;YAAE,OAAO;QAC7B,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,GAAG,CAAC;QAElD,MAAM,GAAG,GAAG,IAAA,gCAAqB,EAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,cAAc,CAAC,CAAC;QACpE,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAE,CAAC;YAC/C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;YACxD,IAAI,CAAC,UAAU,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC;YACnF,OAAO;QACT,CAAC;QAED,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACvB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACjC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAE/C,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YACjF,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC9B,iEAAiE;gBACjE,IAAI,CAAC,UAAU,CACb,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,2BAA2B,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,EAChF,KAAK,CACN,CAAC;gBACF,OAAO;YACT,CAAC;YACD,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YAC9B,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;QACjC,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACxB,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;gBAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAEO,QAAQ,CAAC,GAAuC;QACtD,IAAI,CAAC,IAAA,mBAAQ,EAAC,GAAG,CAAC;YAAE,OAAO;QAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5C,IAAI,UAAU,EAAE,CAAC;YACf,UAAU,CAAC,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,eAAe,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,yCAAyC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC;QACjF,CAAC;IACH,CAAC;IAEO,UAAU,CAAC,MAAkB,EAAE,KAAa;QAClD,MAAM,OAAO,GAAsB;YACjC,IAAI,EAAE,aAAa;YACnB,KAAK;YACL,EAAE,EAAE,MAAM,CAAC,EAAE;YACb,UAAU,EAAE,MAAM,CAAC,UAAU;YAC7B,GAAG,CAAC,MAAM,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACjE,GAAG,CAAC,MAAM,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9D,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3C,CAAC;QACF,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACnB,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;YACd,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5G,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,aAAa,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACzG,CAAC;IACH,CAAC;IAEO,WAAW,CAAC,GAAW,EAAE,MAAkB;QACjD,IAAI,IAAI,CAAC,gBAAgB,CAAC,IAAI,IAAI,uBAAuB,EAAE,CAAC;YAC1D,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YACzD,IAAI,MAAM,KAAK,SAAS;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjE,CAAC;QACD,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,CAAC;IAEO,SAAS,CAAC,KAAkB;QAClC,IAAI,IAAI,CAAC,KAAK,KAAK,KAAK;YAAE,OAAO;QACjC,IAAI,CAAC,KAAK,GAAG,KAAK,CAAC;QACnB,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QAC/G,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,CAAC;IACrC,CAAC;IAEO,cAAc;QACpB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,IAAI,CAAC,cAAc,GAAG,WAAW,CAAC,GAAG,EAAE;YACrC,IAAI,CAAC,IAAI,CAAC,OAAO,IAAI,IAAI,CAAC,KAAK,KAAK,OAAO,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;gBACvD,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC7H,CAAC;QACH,CAAC,EAAE,YAAY,CAAC,CAAC;QACjB,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;IAChC,CAAC;IAEO,iBAAiB;QACvB,IAAI,IAAI,CAAC,OAAO;YAAE,OAAO;QACzB,IAAI,IAAI,CAAC,cAAc;YAAE,OAAO;QAChC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,cAAc,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,gBAAgB,EAAE,CAAC,CAAC;QAClF,IAAI,CAAC,cAAc,GAAG,UAAU,CAAC,GAAG,EAAE;YACpC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;YAChC,IAAI,CAAC,OAAO,EAAE,CAAC;QACjB,CAAC,EAAE,KAAK,CAAC,CAAC;QACV,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,EAAE,CAAC;IAChC,CAAC;IAEO,IAAI;QACV,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,GAAG,IAAI,CAAC;QACpB,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC;QAC7B,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,YAAY,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YAClC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,IAAI,IAAI,CAAC,cAAc,EAAE,CAAC;YACxB,aAAa,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACnC,IAAI,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,CAAC;QACD,KAAK,MAAM,UAAU,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,UAAU,CAAC,KAAK,EAAE,CAAC;QAChE,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;QAClB,IAAI,IAAI,CAAC,EAAE,EAAE,CAAC;YACZ,IAAI,CAAC;gBACH,IAAI,CAAC,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;YACxC,CAAC;YAAC,MAAM,CAAC;gBACP,YAAY;YACd,CAAC;YACD,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;CACF;AAED,sDAAsD;AACtD,SAAS,WAAW,CAAC,IAAa;IAChC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACxB,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC;IACD,IAAI,IAAI,YAAY,WAAW,EAAE,CAAC;QAChC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IACD,+BAA+B;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC5C,CAAC;AAED;iEACiE;AACjE,SAAgB,UAAU,CAAC,MAAmB,EAAE,MAAoB;IAClE,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACxC,OAAO,KAAK,CAAC,KAAK,EAAE,CAAC;AACvB,CAAC;AAED,+EAA+E;AAC/E,SAAgB,iBAAiB,CAAC,SAAgC;IAChE,MAAM,MAAM,GAAG,IAAA,mBAAU,EAAC,SAAS,CAAC,CAAC;IACrC,OAAO,UAAU,CAAC,MAAM,CAAC,CAAC;AAC5B,CAAC"}

package/dist/cli.d.ts

@@ -0,0 +1,14 @@
+#!/usr/bin/env node
+export interface SelfTest {
+    name: string;
+    ok: boolean;
+    details?: string;
+    error?: string;
+}
+/**
+ * Run a local smoke test of path safety, danger-command detection, sensitive
+ * path detection, secret masking and the tool registry. Returns structured
+ * PASS/FAIL results; the CLI prints them and picks the exit code.
+ */
+export declare function runSelfTest(): Promise<SelfTest[]>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAYA,MAAM,WAAW,QAAQ;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,EAAE,EAAE,OAAO,CAAC;IACZ,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AA0FD;;;;GAIG;AACH,wBAAsB,WAAW,IAAI,OAAO,CAAC,QAAQ,EAAE,CAAC,CA0IvD"}