@bike4mind/cli 0.2.29-feat-cli-websocket-streaming.18881 → 0.2.29-feat-cli-sandbox.18927

package/dist/ViolationLogStore-RIIUVURH.js

@@ -0,0 +1,104 @@
+#!/usr/bin/env node
+
+// src/sandbox/logging/ViolationLogStore.ts
+import { promises as fs } from "fs";
+import path from "path";
+import { homedir } from "os";
+var MAX_VIOLATIONS = 5e3;
+var DEFAULT_PATH = path.join(homedir(), ".bike4mind", "violations.jsonl");
+var ViolationLogStore = class {
+  constructor(storePath) {
+    this.cache = null;
+    this.storePath = storePath ?? DEFAULT_PATH;
+  }
+  /** Ensure parent directory exists */
+  async init() {
+    const dir = path.dirname(this.storePath);
+    await fs.mkdir(dir, { recursive: true });
+  }
+  /** Load all entries from disk (newest first) */
+  async load() {
+    if (this.cache) {
+      return this.cache;
+    }
+    try {
+      const data = await fs.readFile(this.storePath, "utf-8");
+      const lines = data.trim().split("\n").filter((line) => line.length > 0);
+      const entries = lines.map((line) => {
+        try {
+          return JSON.parse(line);
+        } catch {
+          return null;
+        }
+      }).filter((entry) => entry !== null);
+      entries.sort((a, b) => b.timestamp - a.timestamp);
+      this.cache = entries;
+      return this.cache;
+    } catch (error) {
+      if (error.code === "ENOENT") {
+        this.cache = [];
+        return this.cache;
+      }
+      throw error;
+    }
+  }
+  /** Record a new violation (converts Date → epoch ms, appends JSONL) */
+  async record(violation) {
+    const entry = {
+      type: violation.type,
+      command: violation.command,
+      blockedBy: violation.blockedBy,
+      timestamp: violation.timestamp.getTime(),
+      ...violation.path && { path: violation.path },
+      ...violation.domain && { domain: violation.domain },
+      ...violation.detail && { detail: violation.detail }
+    };
+    await this.init();
+    const line = JSON.stringify(entry) + "\n";
+    await fs.appendFile(this.storePath, line, "utf-8");
+    this.cache = [entry, ...this.cache ?? []];
+    if (this.cache.length > MAX_VIOLATIONS) {
+      await this.trim();
+    }
+  }
+  /** Get recent violations (default 50) */
+  async getRecent(count = 50) {
+    const entries = await this.load();
+    return entries.slice(0, count);
+  }
+  /** Count violations by type */
+  async countByType() {
+    const entries = await this.load();
+    let filesystem = 0;
+    let network = 0;
+    for (const entry of entries) {
+      if (entry.type === "filesystem") filesystem++;
+      else if (entry.type === "network") network++;
+    }
+    return { filesystem, network };
+  }
+  /** Clear all violations */
+  async clear() {
+    try {
+      await fs.unlink(this.storePath);
+    } catch (error) {
+      if (error.code !== "ENOENT") {
+        throw error;
+      }
+    }
+    this.cache = [];
+  }
+  /** Trim to MAX_VIOLATIONS (rewrite file) */
+  async trim() {
+    if (!this.cache || this.cache.length <= MAX_VIOLATIONS) {
+      return;
+    }
+    const trimmed = this.cache.slice(0, MAX_VIOLATIONS);
+    const lines = [...trimmed].reverse().map((entry) => JSON.stringify(entry)).join("\n");
+    await fs.writeFile(this.storePath, lines + "\n", "utf-8");
+    this.cache = trimmed;
+  }
+};
+export {
+  ViolationLogStore
+};

package/dist/{artifactExtractor-SNWW3EVH.js → artifactExtractor-5KWVJRK7.js}

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 import {
   CurationArtifactType
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 
 // ../../b4m-core/packages/services/dist/src/notebookCurationService/artifactExtractor.js
 var ARTIFACT_TAG_REGEX = /<artifact\s+(.*?)>([\s\S]*?)<\/artifact>/gi;

package/dist/{chunk-QQL3OBKL.js → chunk-2OADXKGK.js}

@@ -6,12 +6,12 @@ import {
   getSettingsByNames,
   obfuscateApiKey,
   secureParameters
-} from "./chunk-TY6Z2UV2.js";
+} from "./chunk-Q7CVAY4M.js";
 import {
   ApiKeyType,
   MementoTier,
   isSupportedEmbeddingModel
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 
 // ../../b4m-core/packages/services/dist/src/apiKeyService/get.js
 import { z } from "zod";

package/dist/chunk-4BIBE3J7.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+// src/sandbox/types.ts
+var DEFAULT_SANDBOX_CONFIG = {
+  enabled: false,
+  mode: "disabled",
+  filesystem: {
+    writeOnlyToWorkingDir: true,
+    allowedReadPaths: ["$HOME/.gitconfig", "$HOME/.npmrc", "$HOME/.node_modules"],
+    deniedPaths: ["$HOME/.ssh", "$HOME/.aws", "$HOME/.gnupg", "$HOME/.env", "/etc/shadow", "/etc/passwd"]
+  },
+  network: {
+    enabled: false,
+    allowedDomains: [
+      "registry.npmjs.org",
+      "*.npmjs.org",
+      "pypi.org",
+      "*.pypi.org",
+      "files.pythonhosted.org",
+      "crates.io",
+      "*.crates.io",
+      "rubygems.org",
+      "github.com",
+      "*.github.com",
+      "gitlab.com",
+      "*.gitlab.com",
+      "bitbucket.org",
+      "*.bitbucket.org",
+      "*.githubusercontent.com",
+      "*.cloudflare.com"
+    ]
+  },
+  excludedCommands: ["docker", "watchman", "podman"],
+  allowUnsandboxedCommands: true,
+  platform: {
+    linux: {
+      runtime: "bubblewrap"
+    },
+    macos: {
+      runtime: "seatbelt",
+      profileTemplate: "default"
+    }
+  }
+};
+
+export {
+  DEFAULT_SANDBOX_CONFIG
+};

package/dist/{chunk-EC2VEDD2.js → chunk-5JTIPGUF.js}

@@ -7,11 +7,11 @@ import {
   getSettingsMap,
   getSettingsValue,
   secureParameters
-} from "./chunk-TY6Z2UV2.js";
+} from "./chunk-Q7CVAY4M.js";
 import {
   KnowledgeType,
   SupportedFabFileMimeTypes
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 
 // ../../b4m-core/packages/services/dist/src/fabFileService/create.js
 import { z } from "zod";

package/dist/{chunk-BXCARBUQ.js → chunk-CLA2MUX4.js}

@@ -2,7 +2,7 @@
 import {
   BadRequestError,
   secureParameters
-} from "./chunk-TY6Z2UV2.js";
+} from "./chunk-Q7CVAY4M.js";
 import {
   CompletionApiUsageTransaction,
   GenericCreditDeductTransaction,
@@ -12,7 +12,7 @@ import {
   TextGenerationUsageTransaction,
   TransferCreditTransaction,
   VideoGenerationUsageTransaction
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 
 // ../../b4m-core/packages/services/dist/src/creditService/subtractCredits.js
 import { z } from "zod";

package/dist/{chunk-KPOK6V6E.js → chunk-FKJTU7KU.js}

@@ -1012,29 +1012,6 @@ var VoiceSessionSendTranscriptAction = z10.object({
   conversationItemId: z10.string(),
   timestamp: z10.coerce.date().optional()
 });
-var CliCompletionRequestAction = z10.object({
-  action: z10.literal("cli_completion_request"),
-  accessToken: z10.string(),
-  requestId: z10.string().uuid(),
-  model: z10.string(),
-  messages: z10.array(z10.object({
-    role: z10.enum(["user", "assistant", "system"]),
-    content: z10.union([z10.string(), z10.array(z10.unknown())])
-  })),
-  options: z10.object({
-    temperature: z10.number().optional(),
-    maxTokens: z10.number().optional(),
-    stream: z10.boolean().optional(),
-    tools: z10.array(z10.unknown()).optional()
-  }).optional()
-});
-var CliToolRequestAction = z10.object({
-  action: z10.literal("cli_tool_request"),
-  accessToken: z10.string(),
-  requestId: z10.string().uuid(),
-  toolName: z10.string(),
-  input: z10.record(z10.unknown())
-});
 var VoiceSessionEndedAction = z10.object({
   action: z10.literal("voice_session_ended"),
   userId: z10.string(),
@@ -1281,36 +1258,6 @@ var ResearchModeStreamAction = z10.object({
     completionInfo: z10.any().optional()
   }).optional()
 });
-var CliCompletionChunkAction = z10.object({
-  action: z10.literal("cli_completion_chunk"),
-  requestId: z10.string(),
-  chunk: z10.object({
-    type: z10.enum(["content", "tool_use"]),
-    text: z10.string(),
-    tools: z10.array(z10.unknown()).optional(),
-    usage: z10.object({
-      inputTokens: z10.number().optional(),
-      outputTokens: z10.number().optional()
-    }).optional(),
-    thinking: z10.array(z10.unknown()).optional()
-  })
-});
-var CliCompletionDoneAction = z10.object({
-  action: z10.literal("cli_completion_done"),
-  requestId: z10.string()
-});
-var CliCompletionErrorAction = z10.object({
-  action: z10.literal("cli_completion_error"),
-  requestId: z10.string(),
-  error: z10.string()
-});
-var CliToolResponseAction = z10.object({
-  action: z10.literal("cli_tool_response"),
-  requestId: z10.string(),
-  success: z10.boolean(),
-  content: z10.unknown().optional(),
-  error: z10.string().optional()
-});
 var SessionCreatedAction = shareableDocumentSchema.extend({
   action: z10.literal("session.created"),
   id: z10.string(),
@@ -1345,9 +1292,7 @@ var MessageDataToServer = z10.discriminatedUnion("action", [
   DataUnsubscribeRequestAction,
   HeartbeatAction,
   VoiceSessionSendTranscriptAction,
-  VoiceSessionEndedAction,
-  CliCompletionRequestAction,
-  CliToolRequestAction
+  VoiceSessionEndedAction
 ]);
 var MessageDataToClient = z10.discriminatedUnion("action", [
   DataSubscriptionUpdateAction,
@@ -1369,11 +1314,7 @@ var MessageDataToClient = z10.discriminatedUnion("action", [
   SpiderProgressUpdateAction,
   SpiderCompleteAction,
   SpiderErrorAction,
-  SessionCreatedAction,
-  CliCompletionChunkAction,
-  CliCompletionDoneAction,
-  CliCompletionErrorAction,
-  CliToolResponseAction
+  SessionCreatedAction
 ]);
 
 // ../../b4m-core/packages/common/dist/src/schemas/cliCompletions.js
@@ -7840,6 +7781,12 @@ function buildSSEEvent(text, info) {
       outputTokens: info.outputTokens
     };
   }
+  if (info?.creditsUsed !== void 0 || info?.usdCost !== void 0) {
+    event.credits = {
+      used: info.creditsUsed,
+      usdCost: info.usdCost
+    };
+  }
   if (info?.thinking && info.thinking.length > 0) {
     event.thinking = info.thinking;
   }
@@ -7985,8 +7932,6 @@ export {
   DataUnsubscribeRequestAction,
   HeartbeatAction,
   VoiceSessionSendTranscriptAction,
-  CliCompletionRequestAction,
-  CliToolRequestAction,
   VoiceSessionEndedAction,
   DataSubscriptionUpdateAction,
   LLMStatusUpdateAction,
@@ -8007,10 +7952,6 @@ export {
   UpdateResearchTaskStatusAction,
   ImportHistoryJobProgressUpdateAction,
   ResearchModeStreamAction,
-  CliCompletionChunkAction,
-  CliCompletionDoneAction,
-  CliCompletionErrorAction,
-  CliToolResponseAction,
   SessionCreatedAction,
   MessageDataToServer,
   MessageDataToClient,

package/dist/{chunk-LBTTUQJM.js → chunk-M2AJGZSX.js}

@@ -1,4 +1,7 @@
 #!/usr/bin/env node
+import {
+  DEFAULT_SANDBOX_CONFIG
+} from "./chunk-4BIBE3J7.js";
 
 // src/utils/Logger.ts
 import fs from "fs/promises";
@@ -262,6 +265,59 @@ import path2 from "path";
 import { homedir } from "os";
 import { v4 as uuidv4 } from "uuid";
 import { z } from "zod";
+var SandboxFilesystemSchema = z.object({
+  allowedReadPaths: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.filesystem.allowedReadPaths),
+  deniedPaths: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.filesystem.deniedPaths),
+  writeOnlyToWorkingDir: z.boolean().default(true)
+});
+var SandboxNetworkSchema = z.object({
+  enabled: z.boolean().default(false),
+  allowedDomains: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.network.allowedDomains)
+});
+var SandboxPlatformSchema = z.object({
+  linux: z.object({
+    runtime: z.literal("bubblewrap").default("bubblewrap"),
+    seccompProfile: z.string().optional()
+  }).default({ runtime: "bubblewrap" }),
+  macos: z.object({
+    runtime: z.literal("seatbelt").default("seatbelt"),
+    profileTemplate: z.string().default("default")
+  }).default({ runtime: "seatbelt", profileTemplate: "default" })
+});
+var SandboxConfigSchema = z.object({
+  enabled: z.boolean().default(false),
+  mode: z.enum(["disabled", "auto-allow", "permissions"]).default("disabled"),
+  filesystem: SandboxFilesystemSchema.default(DEFAULT_SANDBOX_CONFIG.filesystem),
+  network: SandboxNetworkSchema.default(DEFAULT_SANDBOX_CONFIG.network),
+  excludedCommands: z.array(z.string()).default(DEFAULT_SANDBOX_CONFIG.excludedCommands),
+  allowUnsandboxedCommands: z.boolean().default(true),
+  platform: SandboxPlatformSchema.default(DEFAULT_SANDBOX_CONFIG.platform)
+}).refine(
+  (config) => {
+    if (config.enabled && config.mode === "disabled") return false;
+    if (!config.enabled && config.mode !== "disabled") return false;
+    return true;
+  },
+  {
+    message: 'Sandbox config inconsistency: enabled and mode must agree. If enabled=true, mode must be "auto-allow" or "permissions". If mode="disabled", enabled must be false.'
+  }
+);
+var PartialSandboxConfigSchema = z.object({
+  enabled: z.boolean().optional(),
+  mode: z.enum(["disabled", "auto-allow", "permissions"]).optional(),
+  filesystem: z.object({
+    allowedReadPaths: z.array(z.string()).optional(),
+    deniedPaths: z.array(z.string()).optional(),
+    writeOnlyToWorkingDir: z.boolean().optional()
+  }).optional(),
+  network: z.object({
+    enabled: z.boolean().optional(),
+    allowedDomains: z.array(z.string()).optional()
+  }).optional(),
+  excludedCommands: z.array(z.string()).optional(),
+  allowUnsandboxedCommands: z.boolean().optional(),
+  platform: SandboxPlatformSchema.optional()
+}).optional();
 var AuthTokensSchema = z.object({
   accessToken: z.string(),
   refreshToken: z.string(),
@@ -336,7 +392,8 @@ var CliConfigSchema = z.object({
     disabled: z.array(z.string()),
     config: z.record(z.any())
   }),
-  trustedTools: z.array(z.string()).optional().default([])
+  trustedTools: z.array(z.string()).optional().default([]),
+  sandbox: SandboxConfigSchema.optional()
 });
 var ProjectConfigSchema = z.object({
   tools: z.object({
@@ -354,7 +411,8 @@ var ProjectConfigSchema = z.object({
     theme: z.enum(["light", "dark"]).optional(),
     exportFormat: z.enum(["markdown", "json"]).optional(),
     enableSkillTool: z.boolean().optional()
-  }).optional()
+  }).optional(),
+  sandbox: PartialSandboxConfigSchema
 });
 var ProjectLocalConfigSchema = z.object({
   trustedTools: z.array(z.string()).optional(),
@@ -371,7 +429,8 @@ var ProjectLocalConfigSchema = z.object({
     exportFormat: z.enum(["markdown", "json"]).optional(),
     enableSkillTool: z.boolean().optional()
   }).optional(),
-  mcpServers: McpServersSchema.optional()
+  mcpServers: McpServersSchema.optional(),
+  sandbox: PartialSandboxConfigSchema
 });
 var DEFAULT_CONFIG = {
   version: "0.1.0",
@@ -496,6 +555,25 @@ function mergeMcpServers(...serverArrays) {
   }
   return Array.from(serverMap.values());
 }
+function mergeSandboxConfig(base, override) {
+  const resolved = base ?? DEFAULT_SANDBOX_CONFIG;
+  if (!override) return resolved;
+  return {
+    enabled: override.enabled ?? resolved.enabled,
+    mode: override.mode ?? resolved.mode,
+    filesystem: {
+      ...resolved.filesystem,
+      ...override.filesystem ?? {}
+    },
+    network: {
+      ...resolved.network,
+      ...override.network ?? {}
+    },
+    excludedCommands: override.excludedCommands ?? resolved.excludedCommands,
+    allowUnsandboxedCommands: override.allowUnsandboxedCommands ?? resolved.allowUnsandboxedCommands,
+    platform: override.platform ?? resolved.platform
+  };
+}
 function mergeConfigs(global, project, local) {
   const merged = { ...global };
   if (project) {
@@ -522,6 +600,9 @@ function mergeConfigs(global, project, local) {
     if (project.mcpServers) {
       merged.mcpServers = mergeMcpServers(merged.mcpServers, project.mcpServers);
     }
+    if (project.sandbox) {
+      merged.sandbox = mergeSandboxConfig(merged.sandbox, project.sandbox);
+    }
   }
   if (local) {
     if (local.trustedTools) {
@@ -543,6 +624,9 @@ function mergeConfigs(global, project, local) {
     if (local.mcpServers) {
       merged.mcpServers = mergeMcpServers(merged.mcpServers, local.mcpServers);
     }
+    if (local.sandbox) {
+      merged.sandbox = mergeSandboxConfig(merged.sandbox, local.sandbox);
+    }
   }
   return merged;
 }

package/dist/{chunk-TY6Z2UV2.js → chunk-Q7CVAY4M.js}

@@ -15,7 +15,7 @@ import {
   dayjsConfig_default,
   extractSnippetMeta,
   settingsMap
-} from "./chunk-KPOK6V6E.js";
+} from "./chunk-FKJTU7KU.js";
 import {
   Logger
 } from "./chunk-OCYRD7D6.js";
@@ -1797,7 +1797,6 @@ var ensureToolPairingIntegrity = (messages, logger) => {
     }
     logger.log(`Tool pairing integrity: removed ${parts.join(" and ")} after truncation`);
   }
-  let adjacencyStrippedCount = 0;
   for (let i = 0; i < result.length; i++) {
     const msg = result[i];
     if (msg.role !== "assistant" || !Array.isArray(msg.content))
@@ -1822,7 +1821,6 @@ var ensureToolPairingIntegrity = (messages, logger) => {
     const unmatchedSet = new Set(unmatchedIds);
     const filtered = content.filter((b) => {
       if (b.type === "tool_use" && "id" in b && unmatchedSet.has(b.id)) {
-        adjacencyStrippedCount++;
         return false;
       }
       return true;
@@ -7446,23 +7444,16 @@ var PipelineTimer = class {
   totalMs() {
     return Date.now() - this.start;
   }
-  /** Formatted multi-line summary table suitable for logging. */
+  /** Formatted single-line summary suitable for structured loggers that prefix each line. */
   summary() {
     const total = this.totalMs();
-    const lines = [];
-    lines.push("Phase                    Duration   % of Total");
-    lines.push("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+    const parts = [];
     for (const p of this.phases) {
       const dur = (p.end ?? Date.now()) - p.start;
       const pct = total > 0 ? (dur / total * 100).toFixed(1) : "0.0";
-      const name = p.name.padEnd(23);
-      const durStr = `${dur}ms`.padStart(9);
-      const pctStr = `${pct}%`.padStart(10);
-      lines.push(`${name}  ${durStr}  ${pctStr}`);
-    }
-    lines.push("\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500  \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
-    lines.push(`${"TOTAL".padEnd(23)}  ${`${total}ms`.padStart(9)}`);
-    return lines.join("\n");
+      parts.push(`${p.name}: ${dur}ms (${pct}%)`);
+    }
+    return `${parts.join(" | ")} | TOTAL: ${total}ms`;
   }
 };
 

package/dist/chunk-QWB6ZYY4.js

@@ -0,0 +1,48 @@
+#!/usr/bin/env node
+
+// src/sandbox/runtime/SandboxRuntimeAdapter.ts
+import os from "os";
+import { accessSync, constants } from "fs";
+import path from "path";
+function detectPlatform() {
+  const platform = os.platform();
+  if (platform === "darwin") return "darwin";
+  if (platform === "linux") return "linux";
+  return null;
+}
+function isBinaryAvailable(binary) {
+  const pathDirs = (process.env.PATH || "").split(path.delimiter);
+  for (const dir of pathDirs) {
+    try {
+      accessSync(path.join(dir, binary), constants.X_OK);
+      return true;
+    } catch {
+    }
+  }
+  return false;
+}
+function expandPath(pathStr) {
+  return pathStr.replace(/\$HOME/g, os.homedir()).replace(/\$USER/g, os.userInfo().username).replace(/~\//g, `${os.homedir()}/`);
+}
+async function createSandboxRuntime() {
+  const platform = detectPlatform();
+  if (!platform) return null;
+  if (platform === "darwin") {
+    const { SeatbeltRuntime } = await import("./SeatbeltRuntime-EE3TTLEP.js");
+    const runtime = new SeatbeltRuntime();
+    return runtime.isAvailable() ? runtime : null;
+  }
+  if (platform === "linux") {
+    const { BubblewrapRuntime } = await import("./BubblewrapRuntime-PMIOLWKR.js");
+    const runtime = new BubblewrapRuntime();
+    return runtime.isAvailable() ? runtime : null;
+  }
+  return null;
+}
+
+export {
+  detectPlatform,
+  isBinaryAvailable,
+  expandPath,
+  createSandboxRuntime
+};

package/dist/commands/mcpCommand.js

@@ -1,7 +1,8 @@
 #!/usr/bin/env node
 import {
   ConfigStore
-} from "../chunk-LBTTUQJM.js";
+} from "../chunk-M2AJGZSX.js";
+import "../chunk-4BIBE3J7.js";
 
 // src/commands/mcpCommand.ts
 async function handleMcpCommand(subcommand, argv) {

package/dist/{create-QOJPAIOR.js → create-BDV4MI3R.js}

@@ -2,9 +2,9 @@
 import {
   createFabFile,
   createFabFileSchema
-} from "./chunk-EC2VEDD2.js";
-import "./chunk-TY6Z2UV2.js";
-import "./chunk-KPOK6V6E.js";
+} from "./chunk-5JTIPGUF.js";
+import "./chunk-Q7CVAY4M.js";
+import "./chunk-FKJTU7KU.js";
 import "./chunk-OCYRD7D6.js";
 export {
   createFabFile,