@b3labs/b3iq-cli 0.0.0-stage → 0.0.1

package/dist/lib/config.js

@@ -0,0 +1,85 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync, readFileSync, writeFileSync, chmodSync, existsSync, rmSync } from "node:fs";
+export const DEFAULT_API_URL = "https://control-plane.b3iq.org";
+const DEV_WORKER_PORT = 8787;
+const DEV_SPA_PORT = 5175;
+const DEV_SLOT_STRIDE = 10;
+const DEV_SLOT_COUNT = 10;
+export function localDashboardUrl(apiUrl) {
+    const offset = Number(apiUrl.port) - DEV_WORKER_PORT;
+    const slot = offset >= 0 && offset % DEV_SLOT_STRIDE === 0 && offset / DEV_SLOT_STRIDE < DEV_SLOT_COUNT ? offset / DEV_SLOT_STRIDE : 0;
+    return `http://127.0.0.1:${DEV_SPA_PORT + DEV_SLOT_STRIDE * slot}`;
+}
+export const configDir = () => process.env.B3IQ_CONFIG_DIR || join(homedir(), ".b3iq");
+const dir = configDir;
+const file = () => join(dir(), "config.json");
+export function readConfig() {
+    try {
+        return JSON.parse(readFileSync(file(), "utf8"));
+    }
+    catch {
+        return {};
+    }
+}
+export function writeConfig(patch) {
+    mkdirSync(dir(), { recursive: true, mode: 0o700 });
+    const next = { ...readConfig(), ...patch };
+    writeFileSync(file(), JSON.stringify(next, null, 2) + "\n", { mode: 0o600 });
+    chmodSync(file(), 0o600);
+    return next;
+}
+export function clearToken() {
+    const cfg = readConfig();
+    delete cfg.token;
+    delete cfg.expires_at;
+    delete cfg.pat_id;
+    delete cfg.org_id;
+    delete cfg.org_name;
+    if (Object.keys(cfg).length === 0) {
+        if (existsSync(file()))
+            rmSync(file());
+    }
+    else {
+        writeConfig({ ...cfg, token: undefined, expires_at: undefined, pat_id: undefined, org_id: undefined, org_name: undefined });
+    }
+}
+export const configPath = file;
+export function resolveSettings() {
+    const cfg = readConfig();
+    const envToken = process.env.B3IQ_TOKEN;
+    const savedOrgId = envToken ? undefined : cfg.org_id;
+    const orgId = process.env.B3IQ_ORG_ID || savedOrgId;
+    return {
+        apiUrl: (process.env.B3IQ_API_URL || cfg.api_url || DEFAULT_API_URL).replace(/\/+$/, ""),
+        token: envToken || cfg.token,
+        orgId,
+        orgName: orgId && orgId === savedOrgId ? cfg.org_name : undefined,
+        defaultMachine: cfg.default_machine,
+        savedExpiresAt: envToken ? undefined : cfg.expires_at,
+    };
+}
+const LOOPBACK_HOSTS = new Set(["localhost", "127.0.0.1", "[::1]"]);
+export const isLoopbackHost = (hostname) => LOOPBACK_HOSTS.has(hostname);
+export function loginApprovalUrl(serverUrl, userCode) {
+    let base = process.env.B3IQ_DASHBOARD_URL;
+    if (!base) {
+        try {
+            const apiUrl = new URL(resolveSettings().apiUrl);
+            if (isLoopbackHost(apiUrl.hostname))
+                base = localDashboardUrl(apiUrl);
+        }
+        catch {
+        }
+    }
+    if (!base)
+        return serverUrl;
+    return `${base.replace(/\/+$/, "")}/dashboard/cli-auth?code=${encodeURIComponent(userCode)}`;
+}
+export function orgLabel(orgId, orgName) {
+    return orgName ? `${orgName} (${orgId})` : orgId;
+}
+export function listedOrgLabel(orgId) {
+    const { orgId: savedId, orgName } = resolveSettings();
+    return orgLabel(orgId, savedId === orgId ? orgName : undefined);
+}

package/dist/lib/desktop-server-lifecycle.js

@@ -0,0 +1,19 @@
+export const DESKTOP_PERMISSIONS = {
+    sandbox_mode: "workspace-write",
+    approval_policy: "on-request",
+    network_access: false,
+};
+export const DESKTOP_SERVER_LIFECYCLE_INSTRUCTIONS = `Local servers and network in this desktop session:
+sandbox_mode stays workspace-write and approval_policy stays on-request. Leave those defaults in place. Do not switch sandbox_mode to danger-full-access. Do not set sandbox_permissions to require_escalated to obtain network access.
+
+sandbox_permissions use_default keeps the current sandbox. It does not leave the sandbox and it does not grant network access. with_additional_permissions also stays inside the sandbox. In this session it is not a substitute for an approved request_permissions result.
+
+Loopback stays blocked until network permission is granted. When curl reports Operation not permitted for 127.0.0.1, treat that as a sandbox denial, including when the exit code is 7. A listening server can still be up. That denial is separate from an inference transport failure.
+
+When a command needs loopback or other network access, call request_permissions with permissions.network.enabled set to true and a short reason that names the host. Wait for the tool result. Retry that same command only after the result grants network. If the result denies it, stop. Tell the user what was denied and that a later approval can be requested. Do not poll with write_stdin, restart the server, or try other ports to get around the denial.
+
+Before starting a server, inspect the listener on the intended port and its owning pid and working directory. If this task already owns that listener, reuse the pid and its URL. Do not start a second process. If another process owns the port, report the conflict, including the pid, and stop. Do not walk ports after EADDRINUSE.
+
+Start the server once, keep its pid and session id, and check that it is listening at most a few times within a bounded deadline. Stop only a process this task started. Never kill an unrelated or system listener.
+
+Verify with curl --show-error --silent --max-time 5 --fail-with-body. Do not pipe that command through head or another filter. Keep stderr and the exit status visible. Classify the result as process exit, port conflict, startup failure, sandbox denial, permission denial, connection refusal, timeout, or an HTTP status. HTTP 401, 403 and 500 mean the connection reached an application and the application returned that status. A sandbox denial, a refused connection, a timeout, and an inference transport error are different outcomes and need different next steps.`;