@amirhosseinnateghi/vibed-cli 0.1.0 → 0.1.1

package/dist/index.js

@@ -6018,141 +6018,6 @@ import { dirname, extname, isAbsolute, join as join2, resolve } from "node:path"
 
 // ../sandbox/src/index.ts
 var import_node_html_parser = __toESM(require_dist(), 1);
-var FORBIDDEN_API_PATTERNS = [
-  { re: /getUserMedia/, name: "getUserMedia" },
-  { re: /navigator\s*\.\s*geolocation/, name: "geolocation" },
-  { re: /new\s+Notification|Notification\s*\.\s*requestPermission/, name: "Notification" },
-  { re: /serviceWorker/, name: "serviceWorker" },
-  { re: /openDatabase/, name: "openDatabase" },
-  { re: /PaymentRequest|navigator\s*\.\s*payments/, name: "PaymentRequest" },
-  { re: /navigator\s*\.\s*credentials|PublicKeyCredential|WebAuthn/, name: "WebAuthn" },
-  { re: /requestPointerLock/, name: "pointerLock" }
-  // allowed via gesture only; flag
-];
-var TOP_NAV_PATTERNS = [
-  /window\s*\.\s*top/,
-  /window\s*\.\s*parent\s*\.\s*location/,
-  /\btop\s*\.\s*location/,
-  /\bparent\s*\.\s*location/
-];
-var BRAND_NAMES = [
-  "google",
-  "gmail",
-  "apple",
-  "icloud",
-  "microsoft",
-  "outlook",
-  "paypal",
-  "facebook",
-  "instagram",
-  "telegram",
-  "whatsapp",
-  "metamask",
-  "binance",
-  "coinbase"
-];
-function extractExternalHosts(html) {
-  const scrubbed = html.replace(/\bxmlns(:[a-z0-9-]+)?\s*=\s*("[^"]*"|'[^']*')/gi, "").replace(/<!DOCTYPE[^>]*>/gi, "");
-  const hosts = /* @__PURE__ */ new Set();
-  const re = /https?:\/\/([a-z0-9.-]+)/gi;
-  let m;
-  while (m = re.exec(scrubbed)) {
-    const host = m[1]?.toLowerCase();
-    if (host) hosts.add(host);
-  }
-  return [...hosts];
-}
-function looksLikeHtml(root) {
-  const hasEl = root.querySelector("*") != null;
-  return hasEl;
-}
-function validate(html, opts) {
-  const errors = [];
-  const warnings = [];
-  const size = Buffer.byteLength(html, "utf8");
-  if (size > opts.maxBytes) {
-    errors.push({
-      code: "SIZE_EXCEEDED",
-      message: `Artifact is ${size} bytes; limit is ${opts.maxBytes}.`
-    });
-  }
-  const root = (0, import_node_html_parser.parse)(html, {
-    lowerCaseTagName: true,
-    comment: true,
-    voidTag: { closingSlash: true }
-  });
-  if (!looksLikeHtml(root)) {
-    errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
-    return { ok: false, errors, warnings };
-  }
-  if (root.querySelector("iframe, frame, object, embed")) {
-    errors.push({
-      code: "FRAME_TAG",
-      message: "Frames are not allowed (iframe/frame/object/embed)."
-    });
-  }
-  if (root.querySelector("base")) {
-    errors.push({ code: "BASE_TAG", message: "<base> tags are not allowed." });
-  }
-  for (const meta of root.querySelectorAll("meta")) {
-    if ((meta.getAttribute("http-equiv") || "").toLowerCase() === "refresh") {
-      errors.push({ code: "META_REFRESH", message: "meta-refresh redirects are not allowed." });
-      break;
-    }
-  }
-  for (const input of root.querySelectorAll("input")) {
-    if ((input.getAttribute("type") || "").toLowerCase() === "password") {
-      errors.push({
-        code: "PASSWORD_INPUT",
-        message: 'Password inputs are not allowed (<input type="password">).'
-      });
-      break;
-    }
-  }
-  for (const re of TOP_NAV_PATTERNS) {
-    if (re.test(html)) {
-      errors.push({
-        code: "TOP_NAVIGATION",
-        message: "Top-level navigation attempts are not allowed.",
-        detail: re.source
-      });
-      break;
-    }
-  }
-  for (const { re, name } of FORBIDDEN_API_PATTERNS) {
-    if (re.test(html)) {
-      errors.push({
-        code: "FORBIDDEN_API",
-        message: `Forbidden API used: ${name}.`,
-        detail: name
-      });
-    }
-  }
-  const hosts = extractExternalHosts(html);
-  const offending = hosts.filter(
-    (h) => !opts.allowedOrigins.some((allowed) => h === allowed || h.endsWith("." + allowed))
-  );
-  for (const host of offending) {
-    errors.push({
-      code: "EXTERNAL_URL",
-      message: `External URL not in allowlist: ${host}`,
-      detail: host
-    });
-  }
-  const lower = html.toLowerCase();
-  const hasCredField = root.querySelector('input[type="email"], input[type="text"], input[type="tel"]') != null && /(password|passcode|otp|verify|sign\s*in|log\s*in|account)/i.test(html);
-  if (hasCredField) {
-    const brand = BRAND_NAMES.find((b) => lower.includes(b));
-    if (brand) {
-      warnings.push({
-        code: "BRAND_CREDENTIAL",
-        message: `Possible phishing: brand "${brand}" near a credential field.`,
-        detail: brand
-      });
-    }
-  }
-  return { ok: errors.length === 0, errors, warnings };
-}
 
 // ../shared/src/constants.ts
 var CATEGORIES = [
@@ -6181,6 +6046,17 @@ var config = {
   MODERATION_AUTOPUBLISH: boolEnv("MODERATION_AUTOPUBLISH", true),
   BUILDER_MODE: strEnv("BUILDER_MODE", "mock"),
   // 'mock' | 'live'
+  // Builder LLM — non-secret routing only (this object ships to the client).
+  // The platform API key is read server-side from process.env.BUILDER_API_KEY.
+  // Which platform provider serves the builder: 'gapgpt' | 'openrouter'.
+  BUILDER_PROVIDER: strEnv("BUILDER_PROVIDER", "gapgpt"),
+  BUILDER_BASE_URL: strEnv("BUILDER_BASE_URL", "https://api.gapgpt.app/v1"),
+  BUILDER_MODEL: strEnv("BUILDER_MODEL", "claude-sonnet-4-20250514"),
+  // Light model that auto-tags the experience category. Falls back to a keyword
+  // heuristic if the call fails.
+  BUILDER_CLASSIFIER_MODEL: strEnv("BUILDER_CLASSIFIER_MODEL", "gemini-2.5-flash"),
+  BUILDER_MAX_TOKENS: intEnv("BUILDER_MAX_TOKENS", 8192),
+  BUILDER_MAX_MESSAGES: intEnv("BUILDER_MAX_MESSAGES", 30),
   DEFAULT_LOCALE: strEnv("DEFAULT_LOCALE", "en")
 };
 function strEnv(key, fallback) {
@@ -6203,6 +6079,37 @@ function boolEnv(key, fallback) {
   return v === "true" || v === "1";
 }
 
+// ../shared/src/policy.ts
+function boolEnv2(key, fallback) {
+  const v = typeof process !== "undefined" ? process.env[key] : void 0;
+  if (v == null || v === "") return fallback;
+  return v === "true" || v === "1";
+}
+var POST_RULES = [
+  { id: "size_limit", code: "SIZE_EXCEEDED", title: "Size limit", default: true, env: "RULE_SIZE_LIMIT" },
+  { id: "frames", code: "FRAME_TAG", title: "No frames", default: true, env: "RULE_FRAMES" },
+  { id: "base_tag", code: "BASE_TAG", title: "No <base> tag", default: true, env: "RULE_BASE_TAG" },
+  { id: "meta_refresh", code: "META_REFRESH", title: "No meta-refresh", default: true, env: "RULE_META_REFRESH" },
+  { id: "password_input", code: "PASSWORD_INPUT", title: "No password inputs", default: true, env: "RULE_PASSWORD_INPUT" },
+  { id: "top_navigation", code: "TOP_NAVIGATION", title: "No top-navigation", default: true, env: "RULE_TOP_NAVIGATION" },
+  { id: "forbidden_apis", code: "FORBIDDEN_API", title: "No forbidden APIs (payments, background, capture\u2026)", default: true, env: "RULE_FORBIDDEN_APIS" },
+  { id: "external_urls", code: "EXTERNAL_URL", title: "No off-allowlist external URLs", default: true, env: "RULE_EXTERNAL_URLS" },
+  { id: "external_scripts", code: "EXTERNAL_SCRIPT", title: "No creator-selected JS packages (external <script>)", default: false, env: "RULE_EXTERNAL_SCRIPTS" },
+  { id: "external_links", code: "EXTERNAL_LINK", title: "No direct external links (<a> off-site)", default: false, env: "RULE_EXTERNAL_LINKS" },
+  // Enforced by injecting a viewport clip at sanitize (not a reject) — a static
+  // scan can't tell whether a post actually scrolls, so we make it can't.
+  { id: "no_vertical_scroll", code: "SANITIZE_CLIP", title: "No vertical page scroll (fit the viewport)", default: true, env: "RULE_NO_VERTICAL_SCROLL" }
+];
+function resolvePolicy() {
+  const rules = {};
+  for (const r of POST_RULES) rules[r.id] = boolEnv2(r.env, r.default);
+  return { enabled: boolEnv2("POST_RESTRICTIONS_ENABLED", true), rules };
+}
+var postPolicy = resolvePolicy();
+function ruleActive(id, policy = postPolicy) {
+  return policy.enabled && policy.rules[id] === true;
+}
+
 // ../../node_modules/.pnpm/zod@3.25.76/node_modules/zod/v3/external.js
 var external_exports = {};
 __export(external_exports, {
@@ -10284,8 +10191,19 @@ var createBuildSchema = external_exports.object({
   mode: external_exports.enum(["ai", "remix"]),
   remixParentId: external_exports.string().uuid().optional()
 });
+var builderAttachmentSchema = external_exports.object({
+  kind: external_exports.enum(["image", "file"]),
+  name: external_exports.string().max(200),
+  dataUrl: external_exports.string().max(8e6).optional(),
+  // ~6MB image as base64 data URL
+  text: external_exports.string().max(5e4).optional()
+});
 var builderMessageSchema = external_exports.object({
-  content: external_exports.string().min(1).max(4e3)
+  content: external_exports.string().max(4e3).default(""),
+  attachments: external_exports.array(builderAttachmentSchema).max(6).optional(),
+  model: external_exports.string().max(100).optional()
+}).refine((v) => v.content.trim().length > 0 || (v.attachments?.length ?? 0) > 0, {
+  message: "Send a message or an attachment."
 });
 var importSchema = external_exports.object({
   html: external_exports.string().min(1).optional(),
@@ -10296,6 +10214,7 @@ var importSchema = external_exports.object({
 var saveSchema = external_exports.object({
   collectionId: external_exports.string().uuid().optional()
 });
+var AI_PROVIDERS = ["gapgpt", "moonshot", "openai", "openrouter"];
 var collectionSchema = external_exports.object({
   name: external_exports.string().min(1).max(60)
 });
@@ -10313,8 +10232,8 @@ var patchMeSchema = external_exports.object({
   // once
 });
 var aiConnectionSchema = external_exports.object({
-  provider: external_exports.enum(["openai", "anthropic"]),
-  apiKey: external_exports.string().min(8)
+  provider: external_exports.enum(AI_PROVIDERS),
+  apiKey: external_exports.string().trim().min(12).max(300)
 });
 var feedQuerySchema = external_exports.object({
   tab: external_exports.enum(["explore", "following"]).default("explore"),
@@ -10330,6 +10249,24 @@ var searchQuerySchema = external_exports.object({
   limit: external_exports.coerce.number().int().min(1).max(30).default(15)
 });
 
+// ../shared/src/models.ts
+var BUILDER_MODELS = [
+  // ── Free (selectable now) — good quality, reasonable price ─────────
+  { id: "claude-sonnet-4-20250514", label: "Claude Sonnet 4", tier: "free", note: "Best for polished HTML", vision: true },
+  { id: "gemini-2.5-flash", label: "Gemini 2.5 Flash", tier: "free", note: "Fast \xB7 great UI \xB7 cheap", vision: true },
+  { id: "gpt-4o-mini", label: "GPT-4o mini", tier: "free", note: "Cheap & reliable", vision: true },
+  { id: "gpt-5-mini", label: "GPT-5 mini", tier: "free", note: "Newer, capable", vision: true },
+  { id: "gpt-5.1-codex", label: "GPT-5.1 Codex", tier: "free", note: "Code specialist" },
+  { id: "deepseek-v4-pro", label: "DeepSeek V4 Pro", tier: "free", note: "Strong coder \xB7 great value" },
+  { id: "deepseek-v4-flash", label: "DeepSeek V4 Flash", tier: "free", note: "Fast \xB7 very cheap" },
+  { id: "gapgpt-qwen-3.6", label: "Qwen 3.6", tier: "free", note: "Good value" },
+  // ── Subscription (locked until billing is enabled) — premium ──────
+  { id: "claude-opus-4-8", label: "Claude Opus 4.8", tier: "subscription", note: "Top quality", vision: true },
+  { id: "gpt-5.2-pro", label: "GPT-5.2 Pro", tier: "subscription", note: "Premium" },
+  { id: "gemini-3-pro-preview", label: "Gemini 3 Pro", tier: "subscription", note: "Premium", vision: true }
+];
+var FREE_IDS = new Set(BUILDER_MODELS.filter((m) => m.tier === "free").map((m) => m.id));
+
 // ../shared/src/tokens.ts
 var colors = {
   brand: "#6C4CF1",
@@ -10361,6 +10298,175 @@ var toggle = {
   knobTo: "22px"
 };
 
+// ../sandbox/src/index.ts
+var FORBIDDEN_API_PATTERNS = [
+  { re: /getUserMedia/, name: "getUserMedia" },
+  { re: /navigator\s*\.\s*geolocation/, name: "geolocation" },
+  { re: /new\s+Notification|Notification\s*\.\s*requestPermission/, name: "Notification" },
+  { re: /serviceWorker/, name: "serviceWorker" },
+  { re: /openDatabase/, name: "openDatabase" },
+  { re: /PaymentRequest|navigator\s*\.\s*payments/, name: "PaymentRequest" },
+  { re: /navigator\s*\.\s*credentials|PublicKeyCredential|WebAuthn/, name: "WebAuthn" },
+  { re: /requestPointerLock/, name: "pointerLock" }
+  // allowed via gesture only; flag
+];
+var TOP_NAV_PATTERNS = [
+  /window\s*\.\s*top/,
+  /window\s*\.\s*parent\s*\.\s*location/,
+  /\btop\s*\.\s*location/,
+  /\bparent\s*\.\s*location/
+];
+var BRAND_NAMES = [
+  "google",
+  "gmail",
+  "apple",
+  "icloud",
+  "microsoft",
+  "outlook",
+  "paypal",
+  "facebook",
+  "instagram",
+  "telegram",
+  "whatsapp",
+  "metamask",
+  "binance",
+  "coinbase"
+];
+function extractExternalHosts(html) {
+  const scrubbed = html.replace(/\bxmlns(:[a-z0-9-]+)?\s*=\s*("[^"]*"|'[^']*')/gi, "").replace(/<!DOCTYPE[^>]*>/gi, "");
+  const hosts = /* @__PURE__ */ new Set();
+  const re = /https?:\/\/([a-z0-9.-]+)/gi;
+  let m;
+  while (m = re.exec(scrubbed)) {
+    const host = m[1]?.toLowerCase();
+    if (host) hosts.add(host);
+  }
+  return [...hosts];
+}
+function looksLikeHtml(root) {
+  const hasEl = root.querySelector("*") != null;
+  return hasEl;
+}
+function validate(html, opts) {
+  const errors = [];
+  const warnings = [];
+  const size = Buffer.byteLength(html, "utf8");
+  const policy = opts.policy ?? postPolicy;
+  const on = (id) => ruleActive(id, policy);
+  if (on("size_limit") && size > opts.maxBytes) {
+    errors.push({
+      code: "SIZE_EXCEEDED",
+      message: `Artifact is ${size} bytes; limit is ${opts.maxBytes}.`
+    });
+  }
+  const root = (0, import_node_html_parser.parse)(html, {
+    lowerCaseTagName: true,
+    comment: true,
+    voidTag: { closingSlash: true }
+  });
+  if (!looksLikeHtml(root)) {
+    errors.push({ code: "NOT_HTML", message: "Content is not parseable as HTML." });
+    return { ok: false, errors, warnings };
+  }
+  if (on("frames") && root.querySelector("iframe, frame, object, embed")) {
+    errors.push({
+      code: "FRAME_TAG",
+      message: "Frames are not allowed (iframe/frame/object/embed)."
+    });
+  }
+  if (on("base_tag") && root.querySelector("base")) {
+    errors.push({ code: "BASE_TAG", message: "<base> tags are not allowed." });
+  }
+  if (on("meta_refresh")) {
+    for (const meta of root.querySelectorAll("meta")) {
+      if ((meta.getAttribute("http-equiv") || "").toLowerCase() === "refresh") {
+        errors.push({ code: "META_REFRESH", message: "meta-refresh redirects are not allowed." });
+        break;
+      }
+    }
+  }
+  if (on("password_input")) {
+    for (const input of root.querySelectorAll("input")) {
+      if ((input.getAttribute("type") || "").toLowerCase() === "password") {
+        errors.push({
+          code: "PASSWORD_INPUT",
+          message: 'Password inputs are not allowed (<input type="password">).'
+        });
+        break;
+      }
+    }
+  }
+  if (on("top_navigation")) {
+    for (const re of TOP_NAV_PATTERNS) {
+      if (re.test(html)) {
+        errors.push({
+          code: "TOP_NAVIGATION",
+          message: "Top-level navigation attempts are not allowed.",
+          detail: re.source
+        });
+        break;
+      }
+    }
+  }
+  if (on("forbidden_apis")) {
+    for (const { re, name } of FORBIDDEN_API_PATTERNS) {
+      if (re.test(html)) {
+        errors.push({ code: "FORBIDDEN_API", message: `Forbidden API used: ${name}.`, detail: name });
+      }
+    }
+  }
+  if (on("external_urls")) {
+    const hosts = extractExternalHosts(html);
+    const offending = hosts.filter(
+      (h) => !opts.allowedOrigins.some((allowed) => h === allowed || h.endsWith("." + allowed))
+    );
+    for (const host of offending) {
+      errors.push({
+        code: "EXTERNAL_URL",
+        message: `External URL not in allowlist: ${host}`,
+        detail: host
+      });
+    }
+  }
+  if (on("external_scripts")) {
+    for (const s of root.querySelectorAll("script")) {
+      const src = s.getAttribute("src");
+      if (src && /^(https?:)?\/\//i.test(src.trim())) {
+        errors.push({
+          code: "EXTERNAL_SCRIPT",
+          message: `External script not allowed (inline your code): ${src}`,
+          detail: src
+        });
+      }
+    }
+  }
+  if (on("external_links")) {
+    for (const a of root.querySelectorAll("a")) {
+      const href = (a.getAttribute("href") || "").trim();
+      if (/^(https?:)?\/\//i.test(href)) {
+        errors.push({
+          code: "EXTERNAL_LINK",
+          message: `External link not allowed: ${href}`,
+          detail: href
+        });
+      }
+    }
+  }
+  const lower = html.toLowerCase();
+  const hasCredField = root.querySelector('input[type="email"], input[type="text"], input[type="tel"]') != null && /(password|passcode|otp|verify|sign\s*in|log\s*in|account)/i.test(html);
+  if (hasCredField) {
+    const brand = BRAND_NAMES.find((b) => lower.includes(b));
+    if (brand) {
+      warnings.push({
+        code: "BRAND_CREDENTIAL",
+        message: `Possible phishing: brand "${brand}" near a credential field.`,
+        detail: brand
+      });
+    }
+  }
+  return { ok: errors.length === 0, errors, warnings };
+}
+
 // src/bundle.ts
 var MIME = {
   ".css": "text/css",
@@ -10634,7 +10740,9 @@ var FIXES = {
   TOP_NAVIGATION: "Remove top-level navigation (window.top / parent.location). The artifact runs sandboxed and can't drive the page it's embedded in.",
   FORBIDDEN_API: "This browser API is blocked in the sandbox (e.g. getUserMedia, geolocation, serviceWorker, Notification, PaymentRequest, WebAuthn). Remove it or gate it behind a no-op fallback.",
   PASSWORD_INPUT: `Password inputs aren't allowed (anti-phishing). Remove <input type="password">.`,
-  EXTERNAL_URL: "References a host that isn't on the allowlist \u2014 often a call to your own backend/API or a third-party script. vibed artifacts are a single static file: inline the asset, drop the call, or move it to an allowlisted CDN (fonts.googleapis.com, cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, fonts.gstatic.com)."
+  EXTERNAL_URL: "References a host that isn't on the allowlist \u2014 often a call to your own backend/API or a third-party script. vibed artifacts are a single static file: inline the asset, drop the call, or move it to an allowlisted CDN (fonts.googleapis.com, cdn.jsdelivr.net, unpkg.com, cdnjs.cloudflare.com, fonts.gstatic.com).",
+  EXTERNAL_SCRIPT: "Loads JavaScript from an external <script src>. Creator-selected packages aren't allowed \u2014 inline the code you need directly into the file.",
+  EXTERNAL_LINK: "Links off the platform (<a href> to another site). Posts can't send viewers elsewhere \u2014 remove the link or make it in-page (e.g. an anchor to a section)."
 };
 var KB = 1024;
 function fmtSize(bytes) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@amirhosseinnateghi/vibed-cli",
-  "version": "0.1.0",
+  "version": "0.1.1",
   "description": "make it vibed — check, bundle, and publish a project to vibed from the terminal",
   "license": "MIT",
   "type": "module",
@@ -11,7 +11,10 @@
     ".": "./dist/index.js",
     "./lib": "./src/lib.ts"
   },
-  "files": ["dist", "README.md"],
+  "files": [
+    "dist",
+    "README.md"
+  ],
   "publishConfig": {
     "access": "public"
   },