@bike4mind/cli 0.2.63 → 0.2.64-chore-7507-migrate-tsdown.21816

package/bin/bike4mind-cli.mjs

@@ -149,7 +149,7 @@ if (argv['ollama-host']) {
 }
 
 // Auto-detect environment: prefer production mode when dist exists
-const distPath = join(__dirname, '../dist/index.js');
+const distPath = join(__dirname, '../dist/index.mjs');
 const srcPath = join(__dirname, '../src/index.tsx');
 const hasSource = existsSync(srcPath);
 const hasDist = existsSync(distPath);
@@ -176,7 +176,7 @@ if (argv.prompt !== undefined) {
       const module = await import('../src/commands/headlessCommand.ts');
       handleHeadlessCommand = module.handleHeadlessCommand;
     } else {
-      const module = await import('../dist/commands/headlessCommand.js');
+      const module = await import('../dist/commands/headlessCommand.mjs');
       handleHeadlessCommand = module.handleHeadlessCommand;
     }
 
@@ -211,7 +211,7 @@ if (argv._[0] === 'mcp') {
       handleMcpCommand = module.handleMcpCommand;
     } else {
       // Production: import compiled JavaScript
-      const module = await import('../dist/commands/mcpCommand.js');
+      const module = await import('../dist/commands/mcpCommand.mjs');
       handleMcpCommand = module.handleMcpCommand;
     }
 
@@ -234,7 +234,7 @@ if (argv._[0] === 'update') {
       const module = await import('../src/commands/updateCommand.ts');
       handleUpdateCommand = module.handleUpdateCommand;
     } else {
-      const module = await import('../dist/commands/updateCommand.js');
+      const module = await import('../dist/commands/updateCommand.mjs');
       handleUpdateCommand = module.handleUpdateCommand;
     }
 
@@ -257,7 +257,7 @@ if (argv._[0] === 'doctor') {
       const module = await import('../src/commands/doctorCommand.ts');
       handleDoctorCommand = module.handleDoctorCommand;
     } else {
-      const module = await import('../dist/commands/doctorCommand.js');
+      const module = await import('../dist/commands/doctorCommand.mjs');
       handleDoctorCommand = module.handleDoctorCommand;
     }
 
@@ -287,7 +287,7 @@ if (isDev) {
 } else {
   // Production: run compiled JavaScript
   try {
-    await import(join(__dirname, '../dist/index.js'));
+    await import(join(__dirname, '../dist/index.mjs'));
   } catch (error) {
     console.error('Failed to start CLI:', error);
     console.error('\nTry running: pnpm build');

package/dist/BubblewrapRuntime-BHbtqvLx.mjs

@@ -0,0 +1,72 @@
+#!/usr/bin/env node
+import { i as isBinaryAvailable, r as expandPath } from "./SandboxRuntimeAdapter-C1B4t20N.mjs";
+import os from "os";
+//#region src/sandbox/runtime/BubblewrapRuntime.ts
+/**
+* Linux Bubblewrap (bwrap) runtime implementation.
+*
+* Uses bubblewrap to create a sandboxed environment with:
+* - Read-only system paths (/usr, /lib, /bin, etc.)
+* - Read-write access only to the working directory
+* - Denied paths mounted as empty tmpfs
+* - Process namespace isolation
+*/
+/** System paths to bind read-only into the sandbox */
+const SYSTEM_RO_BINDS = [
+	"/usr",
+	"/bin",
+	"/lib",
+	"/lib64",
+	"/sbin",
+	"/etc"
+];
+/** Paths that need special handling (dev, proc, tmp) */
+const SPECIAL_MOUNTS = {
+	dev: "/dev",
+	proc: "/proc",
+	tmp: "/tmp"
+};
+var BubblewrapRuntime = class {
+	constructor() {
+		this.platform = "linux";
+		this.name = "bubblewrap";
+	}
+	isAvailable() {
+		return isBinaryAvailable("bwrap");
+	}
+	wrapCommand(options) {
+		const { command, cwd, filesystemConfig, env } = options;
+		const expandedDenied = filesystemConfig.deniedPaths.map(expandPath);
+		const expandedAllowed = filesystemConfig.allowedReadPaths.map(expandPath);
+		const args = [];
+		for (const sysPath of SYSTEM_RO_BINDS) args.push("--ro-bind-try", sysPath, sysPath);
+		args.push("--dev", SPECIAL_MOUNTS.dev);
+		args.push("--proc", SPECIAL_MOUNTS.proc);
+		args.push("--tmpfs", SPECIAL_MOUNTS.tmp);
+		args.push("--bind", cwd, cwd);
+		const homeDir = os.homedir();
+		args.push("--ro-bind", homeDir, homeDir);
+		for (const allowedPath of expandedAllowed) if (!allowedPath.startsWith(homeDir)) args.push("--ro-bind-try", allowedPath, allowedPath);
+		for (const deniedPath of expandedDenied) args.push("--tmpfs", deniedPath);
+		args.push("--unshare-all");
+		args.push("--share-net");
+		args.push("--die-with-parent");
+		if (options.seccompProfile) args.push("--seccomp", options.seccompProfile);
+		for (const [key, value] of Object.entries(env ?? {})) args.push("--setenv", key, value);
+		args.push("--chdir", cwd);
+		args.push("bash", "-c", command);
+		const commandString = ["bwrap", ...args.map(shellEscape)].join(" ");
+		return {
+			executable: "bwrap",
+			args,
+			env: env ?? {},
+			commandString
+		};
+	}
+};
+function shellEscape(str) {
+	if (/^[a-zA-Z0-9._/=:-]+$/.test(str)) return str;
+	return `'${str.replace(/'/g, "'\\''")}'`;
+}
+//#endregion
+export { BubblewrapRuntime };