zelari-code 1.23.0 → 1.25.0

package/README.md

@@ -280,6 +280,9 @@ Disable auto-check: `ANATHEMA_DEV=1 zelari-code`
 - 🔌 **MCP** — external MCP servers via `.zelari/mcp.json` or `~/.zelari-code/mcp.json`; Desktop **Extensions** store for one-click install
 - 🔐 **SSH targets** — configure hosts for deploy/monitor (password, agent, or key); tools `ssh_status` / `ssh_run` with allowlist; `ZELARI_SSH=0` kill switch
 - 🖥️ **Zelari Desktop** — Tauri shell with chat UI, project tree, Settings, dual updates (app vs npm CLI), multi-turn history, optional overlay HUD
+- 📱 **Companion host + Android** — `zelari-code serve` (SSE over Tailscale/LAN) + Settings → Start companion serve; MVP app in `apps/companion-android/`
+- 🧩 **Skills store (Desktop)** — create/remove user & project `SKILL.md`; import skill from URL with the selected model; `/skills` picker in TUI
+- 📎 **@-tag paths** — tag workspace files/folders in Desktop composer and CLI prompts
 - ◇◆ **Plan / build phase** — `/plan` explores without project writes; `/build` implements with full tools (independent of agent/council/zelari mode)
 - 🆕 **Self-update** — `/update` slash command + silent registry check on startup
 

package/bin/zelari-code.js

@@ -33,25 +33,57 @@ const compiledMain = path.join(pkgRoot, 'dist', 'cli', 'main.js');
 const compiledApp = path.join(pkgRoot, 'dist', 'cli', 'app.js');
 const tsSource = path.join(pkgRoot, 'src', 'cli', 'main.ts');
 
-if (existsSync(compiledBundled)) {
-  // Production path: esbuild-bundled self-contained ESM (includes .tsx)
-  await import(toImportURL(compiledBundled));
-} else if (existsSync(compiledMain) && existsSync(compiledApp)) {
-  // Production path (legacy): tsc-only emit (only .ts, requires .tsx to be absent)
-  await import(toImportURL(compiledMain));
-} else if (existsSync(tsSource)) {
-  // Dev/source install path: use tsx
+/**
+ * Prefer TypeScript source only when explicitly requested.
+ *
+ * Do NOT key off ANATHEMA_DEV: Desktop always sets ANATHEMA_DEV=1 on CLI
+ * spawns (to skip background update checks). Forcing tsx there breaks
+ * get_app_config / --print-config at startup with "Failed to load provider
+ * config" when tsx is unavailable or cwd/node resolution differs.
+ *
+ * Stale-bundle risk (new flags missing) is handled by `desktop:dev` running
+ * `build:cli` first. Override with ZELARI_CLI_SOURCE=1 for pure source runs.
+ */
+function preferSourceOverDist() {
+  return (
+    process.env.ZELARI_CLI_SOURCE === '1' ||
+    process.env.ZELARI_CLI_SOURCE === 'true'
+  );
+}
+
+async function loadFromSource() {
   try {
     require('tsx/esm/api');
     await import(toImportURL(tsSource));
-  } catch {
+  } catch (err) {
+    // Fall back to dist if present — better than hard-fail for Desktop.
+    if (existsSync(compiledBundled)) {
+      console.error(
+        '[zelari-code] tsx source load failed; falling back to dist bundle.\n' +
+          (err instanceof Error ? err.message : String(err)),
+      );
+      await import(toImportURL(compiledBundled));
+      return;
+    }
     console.error(
-      '[zelari-code] Neither compiled dist nor tsx runtime found.\n' +
-        'Production install: run `npm run build:cli` before installing (requires esbuild + tsx).\n' +
-        'Source install: install `tsx` (npm i -g tsx) and run from source.',
+      '[zelari-code] Failed to load TypeScript source via tsx.\n' +
+        'Run `npm run build:cli` to use dist, or install tsx.\n' +
+        (err instanceof Error ? err.message : String(err)),
     );
     process.exit(1);
   }
+}
+
+if (preferSourceOverDist() && existsSync(tsSource)) {
+  await loadFromSource();
+} else if (existsSync(compiledBundled)) {
+  // Production / Desktop path: esbuild-bundled self-contained ESM
+  await import(toImportURL(compiledBundled));
+} else if (existsSync(compiledMain) && existsSync(compiledApp)) {
+  // Production path (legacy): tsc-only emit
+  await import(toImportURL(compiledMain));
+} else if (existsSync(tsSource)) {
+  await loadFromSource();
 } else {
   console.error(
     '[zelari-code] Cannot locate CLI entrypoint.\n' +

package/dist/cli/atMentions.js

@@ -0,0 +1,179 @@
+/**
+ * Expand @path tags in a user prompt into attached file/dir context.
+ *
+ * Tokens look like `@src/cli/main.ts` or `@apps/desktop` (relative to cwd).
+ * Skips email-like tokens (`user@host`) and pure `@` noise.
+ *
+ * Used by CLI free-form prompts and headless tasks so Desktop/CLI share
+ * the same @-tag semantics.
+ */
+import { existsSync, readFileSync, statSync } from 'node:fs';
+import { isAbsolute, relative, resolve, sep } from 'node:path';
+const ATTACH_TEXT_MAX = 48_000;
+const ATTACH_FILE_MAX_BYTES = 512_000;
+/** Match @path tokens: @foo, @foo/bar, @./x, @../y — not emails (word@word). */
+const AT_PATH_RE = /(^|[\s([{])@((?:\.{1,2}\/)?[A-Za-z0-9_.+-]+(?:[\\/][A-Za-z0-9_.+-]+)*)/g;
+function isProbablyText(name, head) {
+    if (/\.(txt|md|markdown|json|jsonc|ts|tsx|js|jsx|mjs|cjs|css|scss|html|htm|xml|yml|yaml|toml|ini|cfg|conf|rs|go|py|java|kt|swift|c|cc|cpp|h|hpp|cs|rb|php|sh|bash|zsh|ps1|sql|graphql|env|gitignore|dockerfile|makefile|cmake|lock|svg)$/i.test(name)) {
+        return true;
+    }
+    return !head.includes('\0') && /[\x09\x0a\x0d\x20-\x7e]/.test(head.slice(0, 200));
+}
+function underRoot(abs, root) {
+    const a = resolve(abs);
+    const r = resolve(root);
+    const prefix = r.endsWith(sep) ? r : r + sep;
+    return a === r || a.startsWith(prefix);
+}
+/**
+ * Extract unique @path tokens from text (order preserved).
+ */
+export function extractAtMentions(text) {
+    const out = [];
+    const seen = new Set();
+    AT_PATH_RE.lastIndex = 0;
+    let m;
+    while ((m = AT_PATH_RE.exec(text)) !== null) {
+        const token = (m[2] ?? '').trim();
+        if (!token || token.includes('@'))
+            continue;
+        // Skip email-like leftovers: if the char before @ was word char, the
+        // regex already requires whitespace/start — good.
+        const key = token.replace(/\\/g, '/').toLowerCase();
+        if (seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(token);
+    }
+    return out;
+}
+function resolveMention(token, cwd) {
+    const abs = isAbsolute(token) ? resolve(token) : resolve(cwd, token);
+    if (!underRoot(abs, cwd) && !isAbsolute(token)) {
+        // relative path that escapes cwd after resolve
+        if (!underRoot(abs, cwd)) {
+            return {
+                raw: token,
+                path: token,
+                absolute: abs,
+                isDir: false,
+                note: 'outside project root — skipped',
+            };
+        }
+    }
+    if (isAbsolute(token) && !underRoot(abs, cwd)) {
+        return {
+            raw: token,
+            path: token,
+            absolute: abs,
+            isDir: false,
+            note: 'outside project root — skipped',
+        };
+    }
+    if (!existsSync(abs)) {
+        return {
+            raw: token,
+            path: token,
+            absolute: abs,
+            isDir: false,
+            note: 'not found',
+        };
+    }
+    let st;
+    try {
+        st = statSync(abs);
+    }
+    catch {
+        return {
+            raw: token,
+            path: token,
+            absolute: abs,
+            isDir: false,
+            note: 'unreadable',
+        };
+    }
+    const rel = relative(cwd, abs).replace(/\\/g, '/') || '.';
+    if (st.isDirectory()) {
+        return {
+            raw: token,
+            path: rel,
+            absolute: abs,
+            isDir: true,
+            note: 'directory — list/read with tools as needed',
+        };
+    }
+    if (st.size > ATTACH_FILE_MAX_BYTES) {
+        return {
+            raw: token,
+            path: rel,
+            absolute: abs,
+            isDir: false,
+            note: `too large (${Math.round(st.size / 1024)} KB) — path only`,
+        };
+    }
+    try {
+        const buf = readFileSync(abs);
+        const head = buf.subarray(0, 800).toString('utf8');
+        if (!isProbablyText(abs, head)) {
+            return {
+                raw: token,
+                path: rel,
+                absolute: abs,
+                isDir: false,
+                note: 'binary — path only',
+            };
+        }
+        let text = buf.toString('utf8');
+        if (text.charCodeAt(0) === 0xfeff)
+            text = text.slice(1);
+        if (text.length > ATTACH_TEXT_MAX) {
+            text =
+                text.slice(0, ATTACH_TEXT_MAX) +
+                    `\n\n… [truncated, ${text.length - ATTACH_TEXT_MAX} more chars]`;
+        }
+        return { raw: token, path: rel, absolute: abs, isDir: false, text };
+    }
+    catch (err) {
+        return {
+            raw: token,
+            path: rel,
+            absolute: abs,
+            isDir: false,
+            note: err instanceof Error ? err.message : 'read failed',
+        };
+    }
+}
+/**
+ * Expand @path tags: keep user text, append [Tagged paths] blocks with
+ * content when available (mirrors Desktop attach format).
+ */
+export function expandAtMentions(userText, cwd = process.cwd()) {
+    const tokens = extractAtMentions(userText);
+    if (tokens.length === 0) {
+        return { text: userText, hits: [] };
+    }
+    const hits = [];
+    for (const t of tokens) {
+        const hit = resolveMention(t, cwd);
+        if (hit)
+            hits.push(hit);
+    }
+    if (hits.length === 0) {
+        return { text: userText, hits: [] };
+    }
+    const blocks = hits.map((h) => {
+        const label = h.path || h.raw;
+        if (h.text != null && h.text.length > 0) {
+            return `--- File: ${label} ---\n${h.text}\n--- End file ---`;
+        }
+        const extra = h.note ? ` (${h.note})` : '';
+        return `--- ${h.isDir ? 'Dir' : 'File'}: ${label}${extra} ---`;
+    });
+    const text = `${userText.trim()}\n\n[Tagged paths]\n${blocks.join('\n\n')}`;
+    return { text, hits };
+}
+/** True if the prompt contains at least one resolvable @path-looking token. */
+export function hasAtMentions(text) {
+    return extractAtMentions(text).length > 0;
+}
+//# sourceMappingURL=atMentions.js.map

package/dist/cli/atMentions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atMentions.js","sourceRoot":"","sources":["../../src/cli/atMentions.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC7D,OAAO,EAAE,UAAU,EAAQ,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAErE,MAAM,eAAe,GAAG,MAAM,CAAC;AAC/B,MAAM,qBAAqB,GAAG,OAAO,CAAC;AAEtC,gFAAgF;AAChF,MAAM,UAAU,GACd,yEAAyE,CAAC;AAW5E,SAAS,cAAc,CAAC,IAAY,EAAE,IAAY;IAChD,IACE,sOAAsO,CAAC,IAAI,CACzO,IAAI,CACL,EACD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,SAAS,CAAC,GAAW,EAAE,IAAY;IAC1C,MAAM,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;IACvB,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxB,MAAM,MAAM,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC;IAC7C,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC5C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,UAAU,CAAC,SAAS,GAAG,CAAC,CAAC;IACzB,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;QAClC,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5C,qEAAqE;QACrE,kDAAkD;QAClD,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;QACpD,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAC5B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CACrB,KAAa,EACb,GAAW;IAEX,MAAM,GAAG,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC/C,+CAA+C;QAC/C,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;YACzB,OAAO;gBACL,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,KAAK;gBACX,QAAQ,EAAE,GAAG;gBACb,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,gCAAgC;aACvC,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QAC9C,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,gCAAgC;SACvC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,WAAW;SAClB,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC;IACP,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,KAAK;YACX,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,YAAY;SACnB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,GAAG,CAAC;IAC1D,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;QACrB,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,IAAI;YACX,IAAI,EAAE,4CAA4C;SACnD,CAAC;IACJ,CAAC;IACD,IAAI,EAAE,CAAC,IAAI,GAAG,qBAAqB,EAAE,CAAC;QACpC,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,cAAc,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,GAAG,IAAI,CAAC,kBAAkB;SACjE,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;QAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QACnD,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,GAAG,EAAE,KAAK;gBACV,IAAI,EAAE,GAAG;gBACT,QAAQ,EAAE,GAAG;gBACb,KAAK,EAAE,KAAK;gBACZ,IAAI,EAAE,oBAAoB;aAC3B,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAChC,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,MAAM;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACxD,IAAI,IAAI,CAAC,MAAM,GAAG,eAAe,EAAE,CAAC;YAClC,IAAI;gBACF,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,eAAe,CAAC;oBAC9B,qBAAqB,IAAI,CAAC,MAAM,GAAG,eAAe,cAAc,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;IACtE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO;YACL,GAAG,EAAE,KAAK;YACV,IAAI,EAAE,GAAG;YACT,QAAQ,EAAE,GAAG;YACb,KAAK,EAAE,KAAK;YACZ,IAAI,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa;SACzD,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAAgB,EAChB,MAAc,OAAO,CAAC,GAAG,EAAE;IAE3B,MAAM,MAAM,GAAG,iBAAiB,CAAC,QAAQ,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAmB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,GAAG,GAAG,cAAc,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,GAAG;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1B,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;IACtC,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,GAAG,CAAC;QAC9B,IAAI,CAAC,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxC,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,IAAI,oBAAoB,CAAC;QAC/D,CAAC;QACD,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;QAC3C,OAAO,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,GAAG,KAAK,MAAM,CAAC;IACjE,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,GAAG,QAAQ,CAAC,IAAI,EAAE,uBAAuB,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;IAC5E,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AACxB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5C,CAAC"}

package/dist/cli/companion/config.js

@@ -0,0 +1,172 @@
+/**
+ * Companion host config + token (for Android / remote clients over Tailscale).
+ *
+ * Files under ~/.zelari-code/:
+ *   companion.json   — projects allowlist, bind/port defaults
+ *   companion.token  — bearer token (created on first serve if missing)
+ */
+import { existsSync, mkdirSync, readFileSync, writeFileSync, } from 'node:fs';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+import { createHash, randomBytes, timingSafeEqual } from 'node:crypto';
+export const DEFAULT_COMPANION_PORT = 7421;
+export const DEFAULT_COMPANION_BIND = '127.0.0.1';
+export function getZelariHome() {
+    return join(homedir(), '.zelari-code');
+}
+export function getCompanionConfigPath() {
+    return join(getZelariHome(), 'companion.json');
+}
+export function getCompanionTokenPath() {
+    return join(getZelariHome(), 'companion.token');
+}
+function ensureHome() {
+    const home = getZelariHome();
+    if (!existsSync(home)) {
+        mkdirSync(home, { recursive: true });
+    }
+}
+export function loadCompanionConfig() {
+    const path = getCompanionConfigPath();
+    if (!existsSync(path)) {
+        return { projects: [] };
+    }
+    try {
+        const raw = JSON.parse(readFileSync(path, 'utf8'));
+        const projects = Array.isArray(raw.projects)
+            ? raw.projects
+                .filter((p) => p &&
+                typeof p.path === 'string' &&
+                p.path.trim() &&
+                typeof (p.id ?? p.name) === 'string')
+                .map((p) => ({
+                id: String(p.id || p.name)
+                    .trim()
+                    .toLowerCase()
+                    .replace(/[^a-z0-9-_]+/g, '-')
+                    .slice(0, 64),
+                name: String(p.name || p.id || 'project').trim() || 'project',
+                path: String(p.path).trim(),
+            }))
+            : [];
+        return {
+            projects,
+            bind: typeof raw.bind === 'string' ? raw.bind : undefined,
+            port: typeof raw.port === 'number' ? raw.port : undefined,
+        };
+    }
+    catch {
+        return { projects: [] };
+    }
+}
+export function saveCompanionConfig(cfg) {
+    ensureHome();
+    writeFileSync(getCompanionConfigPath(), JSON.stringify({
+        bind: cfg.bind,
+        port: cfg.port,
+        projects: cfg.projects,
+    }, null, 2) + '\n', 'utf8');
+}
+/** Load token or create a new one (printed once by serve). */
+export function loadOrCreateToken(explicit) {
+    if (explicit && explicit.trim()) {
+        return { token: explicit.trim(), created: false };
+    }
+    ensureHome();
+    const path = getCompanionTokenPath();
+    if (existsSync(path)) {
+        const t = readFileSync(path, 'utf8').trim();
+        if (t)
+            return { token: t, created: false };
+    }
+    const token = randomBytes(24).toString('base64url');
+    writeFileSync(path, token + '\n', 'utf8');
+    try {
+        // Best-effort restrict (POSIX); ignored on Windows.
+        // eslint-disable-next-line @typescript-eslint/no-require-imports
+        const fs = require('node:fs');
+        fs.chmodSync?.(path, 0o600);
+    }
+    catch {
+        /* ignore */
+    }
+    return { token, created: true };
+}
+export function tokenMatches(expected, provided) {
+    if (!provided)
+        return false;
+    const a = createHash('sha256').update(expected).digest();
+    const b = createHash('sha256').update(provided).digest();
+    try {
+        return timingSafeEqual(a, b);
+    }
+    catch {
+        return false;
+    }
+}
+export function slugFromPath(p) {
+    const base = p.replace(/[/\\]+$/, '').split(/[/\\]/).pop() || 'project';
+    return base
+        .toLowerCase()
+        .replace(/[^a-z0-9-_]+/g, '-')
+        .replace(/^-+|-+$/g, '')
+        .slice(0, 48) || 'project';
+}
+/** Merge CLI --project paths into config (in-memory; optionally persist). */
+export function mergeProjects(cfg, extraPaths) {
+    const byId = new Map();
+    for (const p of cfg.projects) {
+        byId.set(p.id, p);
+    }
+    for (const raw of extraPaths) {
+        const path = raw.trim();
+        if (!path)
+            continue;
+        let id = slugFromPath(path);
+        let n = 2;
+        while (byId.has(id) && byId.get(id).path !== path) {
+            id = `${slugFromPath(path)}-${n++}`;
+        }
+        byId.set(id, {
+            id,
+            name: slugFromPath(path),
+            path,
+        });
+    }
+    return [...byId.values()];
+}
+export function resolveProjectPath(projects, cwdOrId) {
+    if (!projects.length) {
+        return {
+            ok: false,
+            error: 'No projects configured. Pass --project <path> or edit ~/.zelari-code/companion.json',
+        };
+    }
+    if (!cwdOrId || !String(cwdOrId).trim()) {
+        return { ok: true, project: projects[0] };
+    }
+    const key = String(cwdOrId).trim();
+    const byId = projects.find((p) => p.id === key || p.name === key);
+    if (byId)
+        return { ok: true, project: byId };
+    const norm = key.replace(/\\/g, '/').toLowerCase();
+    const byPath = projects.find((p) => p.path.replace(/\\/g, '/').toLowerCase() === norm);
+    if (byPath)
+        return { ok: true, project: byPath };
+    // Prefix match under an allowlisted root
+    const under = projects.find((p) => {
+        const root = p.path.replace(/\\/g, '/').toLowerCase().replace(/\/$/, '');
+        return norm === root || norm.startsWith(root + '/');
+    });
+    if (under) {
+        return {
+            ok: true,
+            project: { ...under, path: key },
+        };
+    }
+    return {
+        ok: false,
+        error: `cwd/project not in allowlist: ${key}. Allowed: ${projects.map((p) => p.id).join(', ')}`,
+    };
+}
+//# sourceMappingURL=config.js.map

package/dist/cli/companion/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../../src/cli/companion/config.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,aAAa,GACd,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAEvE,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC;AAC3C,MAAM,CAAC,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAclD,MAAM,UAAU,aAAa;IAC3B,OAAO,IAAI,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,sBAAsB;IACpC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,gBAAgB,CAAC,CAAC;AACjD,CAAC;AAED,MAAM,UAAU,qBAAqB;IACnC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,iBAAiB,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,SAAS,CAAC,IAAI,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACvC,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB;IACjC,MAAM,IAAI,GAAG,sBAAsB,EAAE,CAAC;IACtC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAwB,CAAC;QAC1E,MAAM,QAAQ,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,QAAQ,CAAC;YAC1C,CAAC,CAAC,GAAG,CAAC,QAAQ;iBACT,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC;gBACD,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ;gBAC1B,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE;gBACb,OAAO,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,QAAQ,CACvC;iBACA,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,EAAE,EAAE,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,IAAI,CAAC;qBACvB,IAAI,EAAE;qBACN,WAAW,EAAE;qBACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;qBAC7B,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,EAAE,IAAI,SAAS,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS;gBAC7D,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE;aAC5B,CAAC,CAAC;YACP,CAAC,CAAC,EAAE,CAAC;QACP,OAAO;YACL,QAAQ;YACR,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;YACzD,IAAI,EAAE,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;SAC1D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;IAC1B,CAAC;AACH,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,GAAwB;IAC1D,UAAU,EAAE,CAAC;IACb,aAAa,CACX,sBAAsB,EAAE,EACxB,IAAI,CAAC,SAAS,CACZ;QACE,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,QAAQ,EAAE,GAAG,CAAC,QAAQ;KACvB,EACD,IAAI,EACJ,CAAC,CACF,GAAG,IAAI,EACR,MAAM,CACP,CAAC;AACJ,CAAC;AAED,8DAA8D;AAC9D,MAAM,UAAU,iBAAiB,CAAC,QAAiB;IAIjD,IAAI,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,CAAC;QAChC,OAAO,EAAE,KAAK,EAAE,QAAQ,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACpD,CAAC;IACD,UAAU,EAAE,CAAC;IACb,MAAM,IAAI,GAAG,qBAAqB,EAAE,CAAC;IACrC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5C,IAAI,CAAC;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACpD,aAAa,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC;QACH,oDAAoD;QACpD,iEAAiE;QACjE,MAAM,EAAE,GAAG,OAAO,CAAC,SAAS,CAA6B,CAAC;QAC1D,EAAE,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,QAAuB;IACpE,IAAI,CAAC,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5B,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,MAAM,CAAC,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,MAAM,EAAE,CAAC;IACzD,IAAI,CAAC;QACH,OAAO,eAAe,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,CAAS;IACpC,MAAM,IAAI,GAAG,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,SAAS,CAAC;IACxE,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC;SAC7B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC;SACvB,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,SAAS,CAAC;AAC/B,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,aAAa,CAC3B,GAAwB,EACxB,UAAoB;IAEpB,MAAM,IAAI,GAAG,IAAI,GAAG,EAA4B,CAAC;IACjD,KAAK,MAAM,CAAC,IAAI,GAAG,CAAC,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,IAAI;YAAE,SAAS;QACpB,IAAI,EAAE,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,EAAE,CAAE,CAAC,IAAI,KAAK,IAAI,EAAE,CAAC;YACnD,EAAE,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACtC,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE;YACX,EAAE;YACF,IAAI,EAAE,YAAY,CAAC,IAAI,CAAC;YACxB,IAAI;SACL,CAAC,CAAC;IACL,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,kBAAkB,CAChC,QAA4B,EAC5B,OAAkC;IAElC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC;QACrB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,qFAAqF;SACxF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAE,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,CAAC;IACnC,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;IAClE,IAAI,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACnD,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,KAAK,IAAI,CACzD,CAAC;IACF,IAAI,MAAM;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACjD,yCAAyC;IACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;QAChC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzE,OAAO,IAAI,KAAK,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IACH,IAAI,KAAK,EAAE,CAAC;QACV,OAAO;YACL,EAAE,EAAE,IAAI;YACR,OAAO,EAAE,EAAE,GAAG,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE;SACjC,CAAC;IACJ,CAAC;IACD,OAAO;QACL,EAAE,EAAE,KAAK;QACT,KAAK,EAAE,iCAAiC,GAAG,cAAc,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;KAChG,CAAC;AACJ,CAAC"}