@bike4mind/cli 3.4.0 → 4.0.0

package/dist/RemoteSkillSource-qTvRkaNA.mjs

@@ -0,0 +1,455 @@
+#!/usr/bin/env node
+import os from "os";
+import path from "path";
+import fs from "fs/promises";
+//#region src/config/commands.ts
+const COMMANDS = [
+	{
+		name: "help",
+		description: "Show this help message"
+	},
+	{
+		name: "exit",
+		description: "Exit the CLI",
+		aliases: ["quit"]
+	},
+	{
+		name: "login",
+		description: "Authenticate with your B4M account"
+	},
+	{
+		name: "logout",
+		description: "Clear authentication and sign out"
+	},
+	{
+		name: "whoami",
+		description: "Show current authenticated user"
+	},
+	{
+		name: "save",
+		description: "Save current session",
+		args: "<name>"
+	},
+	{
+		name: "resume",
+		description: "List and resume saved sessions",
+		aliases: ["sessions"]
+	},
+	{
+		name: "config",
+		description: "Open interactive configuration editor"
+	},
+	{
+		name: "model",
+		description: "Switch the active model (opens a picker, or matches an id/name argument)",
+		args: "[id-or-name]"
+	},
+	{
+		name: "set-api",
+		description: "Connect to self-hosted Bike4Mind instance",
+		args: "<url>"
+	},
+	{
+		name: "reset-api",
+		description: "Reset to Bike4Mind main service"
+	},
+	{
+		name: "api-info",
+		description: "Show current API configuration"
+	},
+	{
+		name: "trust",
+		description: "Trust a tool, or `folder` to trust this project's repo config/agents/skills/MCP",
+		args: "<tool-name|folder>"
+	},
+	{
+		name: "untrust",
+		description: "Remove a tool from the trusted list, or `folder` to revoke project trust",
+		args: "<tool-name|folder>"
+	},
+	{
+		name: "trusted",
+		description: "Show folder-trust status and list all trusted tools"
+	},
+	{
+		name: "usage",
+		description: "Show credit usage and balance"
+	},
+	{
+		name: "clear",
+		description: "Start a new session",
+		aliases: ["new"]
+	},
+	{
+		name: "rewind",
+		description: "Rewind conversation to a previous point"
+	},
+	{
+		name: "undo",
+		description: "Undo the last file change"
+	},
+	{
+		name: "checkpoints",
+		description: "List available file restore points"
+	},
+	{
+		name: "restore",
+		description: "Restore files to a specific checkpoint",
+		args: "<number>"
+	},
+	{
+		name: "diff",
+		description: "Show diff between current state and a checkpoint",
+		args: "[number]"
+	},
+	{
+		name: "project-config",
+		description: "Show merged project configuration"
+	},
+	{
+		name: "commands",
+		description: "List all custom commands"
+	},
+	{
+		name: "commands:new",
+		description: "Create a new custom command",
+		args: "<name>"
+	},
+	{
+		name: "commands:reload",
+		description: "Reload custom commands from disk"
+	},
+	{
+		name: "mcp",
+		description: "Show MCP server status and connected tools",
+		aliases: ["mcp:list"]
+	},
+	{
+		name: "agents",
+		description: "List all available agents",
+		aliases: ["agents:list"]
+	},
+	{
+		name: "agents:new",
+		description: "Create a new agent definition",
+		args: "<name>"
+	},
+	{
+		name: "agents:reload",
+		description: "Reload agent definitions from disk"
+	},
+	{
+		name: "context",
+		description: "Show context window usage"
+	},
+	{
+		name: "compact",
+		description: "Compact conversation into new session",
+		args: "[instructions]"
+	},
+	{
+		name: "sandbox",
+		description: "Show sandbox status and configuration"
+	},
+	{
+		name: "sandbox:enable",
+		description: "Enable OS-level sandbox for bash commands"
+	},
+	{
+		name: "sandbox:disable",
+		description: "Disable sandbox mode"
+	},
+	{
+		name: "sandbox:mode",
+		description: "Set sandbox mode (auto-allow or permissions)",
+		args: "<auto-allow|permissions>"
+	},
+	{
+		name: "sandbox:network",
+		description: "Toggle sandbox network egress (off is fail-closed default)",
+		args: "<on|off>"
+	},
+	{
+		name: "sandbox:trust-domain",
+		description: "Add domain(s) to the network proxy allowlist",
+		args: "<domain> [...]"
+	},
+	{
+		name: "sandbox:domains",
+		description: "Show network proxy allowed domains"
+	},
+	{
+		name: "sandbox:violations",
+		description: "Show recent sandbox violations",
+		args: "[count]"
+	},
+	{
+		name: "sandbox:violations:clear",
+		description: "Clear all recorded sandbox violations"
+	},
+	{
+		name: "terminal-setup",
+		description: "Configure Shift+Enter for multi-line input"
+	},
+	{
+		name: "add-dir",
+		description: "Add a directory for file access",
+		args: "<path>"
+	},
+	{
+		name: "remove-dir",
+		description: "Remove a directory from file access",
+		args: "<path>"
+	},
+	{
+		name: "dirs",
+		description: "List all accessible directories"
+	},
+	{
+		name: "workflow",
+		description: "Show workflow overview or a specific section (decisions, blockers, handoff, review-gates; `gates` alias accepted)",
+		args: "[decisions|blockers|handoff|review-gates]"
+	},
+	{
+		name: "decisions",
+		description: "Show decision log for current session (alias for /workflow decisions)"
+	},
+	{
+		name: "blockers",
+		description: "Show tracked blockers for current session (alias for /workflow blockers)"
+	},
+	{
+		name: "review-gates",
+		description: "Show review gates for current session (alias for /workflow review-gates)"
+	},
+	{
+		name: "handoff",
+		description: "Show or generate the session handoff for cross-session continuity. Use --local for an LLM-free snapshot (works when rate-limited or offline). Alias for /workflow handoff.",
+		args: "[generate|--local]"
+	}
+];
+/**
+* Get all command names including aliases
+*/
+function getAllCommandNames() {
+	const names = [];
+	for (const cmd of COMMANDS) {
+		names.push(cmd.name);
+		if (cmd.aliases) names.push(...cmd.aliases);
+	}
+	return names;
+}
+/**
+* Checks if a command name is a built-in command
+* @param name - Command name to check
+* @returns true if the command is built-in
+*/
+function isBuiltInCommand(name) {
+	return getAllCommandNames().includes(name);
+}
+/**
+* First-party feature-module slash commands (FeatureModuleRegistry). These are
+* registered at runtime, not part of COMMANDS, so isBuiltInCommand misses them -
+* yet a remote/custom skill that shadows one would hijack the feature. Kept as a
+* static list because RemoteSkillSource filters at fetch time, before any registry
+* is built. MUST STAY IN SYNC with the feature modules' getCommands() (tavern,
+* hearth); a drift guard in commands.test.ts derives the names from those modules
+* and fails if this list drifts.
+*/
+const RESERVED_FEATURE_COMMANDS = [
+	"tavern",
+	"quest",
+	"hearth"
+];
+/**
+* Checks if a command name is reserved (a built-in OR a first-party feature command).
+* Use this, not isBuiltInCommand, when deciding whether an external skill may register.
+*
+* `featureCommandNames` carries the LIVE feature/plugin command names from the
+* runtime FeatureModuleRegistry - a dynamic superset of the static
+* RESERVED_FEATURE_COMMANDS. Pass it so load, display, and dispatch share one
+* reserved-name source; a repo-planted command whose name matches a runtime
+* plugin command is otherwise hidden from display yet still loads and executes.
+*/
+function isReservedCommandName(name, featureCommandNames) {
+	return isBuiltInCommand(name) || RESERVED_FEATURE_COMMANDS.includes(name) || (featureCommandNames?.has(name) ?? false);
+}
+/**
+* Point a command store's reserved-name gate at a feature registry's live
+* command names, then prune any project command that loaded (pre-registry)
+* under a name the registry now owns. Both index.tsx wiring sites (bootstrap and
+* plugin hot-reload) call this, so load, display, and dispatch share one
+* reserved-name source and the wiring is unit-testable in isolation.
+*/
+function wireReservedCommandNames(store, registry) {
+	store.setReservedNameSource(() => new Set(registry.getAllCommands().map((c) => c.name)));
+	store.pruneReservedProjectCommands();
+}
+/**
+* Re-wire a CLI state's command store to a feature registry. Both index.tsx
+* wiring sites (bootstrap and plugin hot-reload) call this with the live `state`,
+* so the store-extraction step is pinned by a unit test instead of living
+* untested inline at each call site (no test imports index.tsx).
+*/
+function rewireReservedNames(state, registry) {
+	wireReservedCommandNames(state.customCommandStore, registry);
+}
+/**
+* Converts a CustomCommand to a CommandDefinition for unified handling
+* @param customCommand - Custom command to convert
+* @returns CommandDefinition compatible with autocomplete and help
+*/
+function customCommandToDefinition(customCommand) {
+	return {
+		name: customCommand.name,
+		description: customCommand.description,
+		args: customCommand.argumentHint,
+		source: customCommand.source
+	};
+}
+/**
+* Merges custom commands and feature module commands with built-in commands.
+* Built-in commands always take precedence (custom commands cannot override them).
+*
+* @param customCommands - Array of custom commands to merge
+* @param featureCommands - Optional array of feature module command definitions
+* @returns Combined array of all command definitions
+*/
+function mergeCommands(customCommands, featureCommands) {
+	const builtInCommands = COMMANDS.map((cmd) => ({
+		...cmd,
+		source: "built-in"
+	}));
+	const featureNames = new Set((featureCommands ?? []).map((cmd) => cmd.name));
+	const isReserved = (name) => isReservedCommandName(name, featureNames);
+	const customDefinitions = customCommands.filter((cmd) => !isReserved(cmd.name)).map(customCommandToDefinition);
+	const conflicts = customCommands.filter((cmd) => isReserved(cmd.name));
+	if (conflicts.length > 0) console.warn("Warning: The following custom commands have reserved names (a built-in or feature/plugin command) and will be ignored:", conflicts.map((cmd) => cmd.name).join(", "));
+	return [
+		...builtInCommands,
+		...featureCommands ?? [],
+		...customDefinitions
+	];
+}
+//#endregion
+//#region src/storage/RemoteSkillSource.ts
+const DEFAULT_FRESH_TTL_MS = 3e5;
+const DEFAULT_PAGE_LIMIT = 100;
+var RemoteSkillSource = class {
+	constructor(apiClient, options = {}) {
+		this.apiClient = apiClient;
+		this.forceNext = false;
+		this.cacheFilePath = options.cacheFilePath ?? path.join(os.homedir(), ".bike4mind", "cache", "remote-skills.json");
+		this.freshTtlMs = options.freshTtlMs ?? DEFAULT_FRESH_TTL_MS;
+		this.pageLimit = options.pageLimit ?? DEFAULT_PAGE_LIMIT;
+		this.includeImports = options.includeImports ?? false;
+	}
+	/** Make the next `fetchSkills` go to the network even inside the TTL. The cache stays as the
+	*  offline fallback. For a host that just changed the account's skills itself. */
+	invalidate() {
+		this.forceNext = true;
+	}
+	/**
+	* Returns the user's remote skills mapped to `CustomCommand`. Uses an
+	* in-memory + on-disk cache to avoid a network round-trip on every
+	* `/commands` invocation and to keep working offline.
+	*/
+	async fetchSkills() {
+		const cached = await this.readCache();
+		const forced = this.forceNext;
+		this.forceNext = false;
+		if (cached && !forced && this.isFresh(cached)) return this.mapAndFilter(cached.skills);
+		try {
+			const skills = (await this.apiClient.get(`/api/skills?limit=${this.pageLimit}`))?.data ?? [];
+			if (skills.length > 0 || !cached || cached.skills.length === 0) await this.writeCache({
+				fetchedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				skills
+			});
+			return this.mapAndFilter(skills);
+		} catch (error) {
+			if (process.env.BIKE4MIND_CLI_DEBUG) console.warn("[RemoteSkillSource] fetch failed, falling back to cache:", error instanceof Error ? error.message : String(error));
+			if (cached) return this.mapAndFilter(cached.skills);
+			return [];
+		}
+	}
+	/**
+	* Map server skills to `CustomCommand`, dropping any that must not register:
+	* - a name that shadows a built-in OR a first-party feature slash command
+	*   (tavern/quest/hearth), which would otherwise hijack the command, and
+	* - a foreign-owned skill (a `userId` other than the current user's), which is
+	*   only visible cross-account via `isGlobalRead`, and
+	* - a Skill Market import: the user owns the copy but someone else wrote it, and local commands run
+	*   as trusted instructions next to shell/file tools (the web app wraps it as untrusted instead).
+	*   With `includeImports` it is kept as `untrusted: true`, for a host that wraps it the same way.
+	* Own, system (no `userId`), and org-scoped (server-gated, no `userId`) skills pass.
+	*
+	* Unauthenticated contract (fail-closed, intentional): when getCurrentUser()
+	* returns null, currentUserId is undefined and every skill carrying a userId -
+	* including the user's OWN - is dropped. This over-restricts rather than risk
+	* registering a foreign skill against an unverifiable identity; own skills
+	* reappear once authenticated.
+	*/
+	async mapAndFilter(skills) {
+		const currentUserId = (await this.apiClient.getCurrentUser?.())?.id;
+		return skills.filter((skill) => {
+			if (isReservedCommandName(skill.name)) return false;
+			if (skill.userId && skill.userId !== currentUserId) return false;
+			if (skill.importedFrom && !this.includeImports) return false;
+			return true;
+		}).map((skill) => this.toCustomCommand(skill));
+	}
+	/** For tests and the `/commands:reload` handler - clears the on-disk cache. */
+	async clearCache() {
+		try {
+			await fs.unlink(this.cacheFilePath);
+		} catch (error) {
+			if (error.code !== "ENOENT") throw error;
+		}
+	}
+	isFresh(cache) {
+		const fetchedAt = Date.parse(cache.fetchedAt);
+		if (Number.isNaN(fetchedAt)) return false;
+		return Date.now() - fetchedAt < this.freshTtlMs;
+	}
+	async readCache() {
+		try {
+			const raw = await fs.readFile(this.cacheFilePath, "utf-8");
+			const parsed = JSON.parse(raw);
+			if (parsed && typeof parsed === "object" && "fetchedAt" in parsed && "skills" in parsed && Array.isArray(parsed.skills)) return parsed;
+			return null;
+		} catch (error) {
+			if (error.code === "ENOENT") return null;
+			if (process.env.BIKE4MIND_CLI_DEBUG) console.warn("[RemoteSkillSource] cache read failed:", error instanceof Error ? error.message : String(error));
+			return null;
+		}
+	}
+	async writeCache(snapshot) {
+		try {
+			await fs.mkdir(path.dirname(this.cacheFilePath), {
+				recursive: true,
+				mode: 448
+			});
+			await fs.writeFile(this.cacheFilePath, JSON.stringify(snapshot, null, 2), {
+				encoding: "utf-8",
+				mode: 384
+			});
+		} catch (error) {
+			if (process.env.BIKE4MIND_CLI_DEBUG) console.warn("[RemoteSkillSource] cache write failed:", error instanceof Error ? error.message : String(error));
+		}
+	}
+	toCustomCommand(skill) {
+		return {
+			name: skill.name,
+			description: skill.description,
+			body: skill.body,
+			argumentHint: skill.argumentHint,
+			allowedTools: skill.allowedTools,
+			disableModelInvocation: skill.disableModelInvocation,
+			...skill.importedFrom ? { untrusted: true } : {},
+			source: "remote",
+			filePath: `b4m:/api/skills/${skill.id}`
+		};
+	}
+};
+//#endregion
+export { rewireReservedNames as a, mergeCommands as i, COMMANDS as n, isReservedCommandName as r, RemoteSkillSource as t };

package/dist/{WorkItemsClient-SeNbzvEw.mjs → WorkItemsClient-CERTDrhT.mjs}

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { It as tokenEstimateMultiplier } from "./ConfigStore-CbVFLXMH.mjs";
+import { Vt as tokenEstimateMultiplier } from "./ConfigStore-BwqsQ0U9.mjs";
 import { v4 } from "uuid";
 import { get_encoding } from "tiktoken";
 //#region ../../b4m-core/utils/dist/calibratedTokenizer.mjs