@chvor/cli 0.1.0

package/dist/lib/paths.js

@@ -0,0 +1,45 @@
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { mkdirSync } from "node:fs";
+let currentInstance = null;
+export function setInstance(name) {
+    currentInstance = name;
+}
+export function getInstance() {
+    return currentInstance;
+}
+export function getChvorHome() {
+    if (currentInstance) {
+        return join(homedir(), `.chvor-${currentInstance}`);
+    }
+    return join(homedir(), ".chvor");
+}
+export function getConfigPath() {
+    return join(getChvorHome(), "config.json");
+}
+export function getPidPath() {
+    return join(getChvorHome(), "chvor.pid");
+}
+export function getAppDir() {
+    // App binaries are shared across all instances
+    return join(homedir(), ".chvor", "app");
+}
+export function getDataDir() {
+    return join(getChvorHome(), "data");
+}
+export function getLogsDir() {
+    return join(getChvorHome(), "logs");
+}
+export function getDownloadsDir() {
+    // Downloads are shared across all instances
+    return join(homedir(), ".chvor", "downloads");
+}
+export function getSkillsDir() {
+    return join(getChvorHome(), "skills");
+}
+export function getToolsDir() {
+    return join(getChvorHome(), "tools");
+}
+export function ensureDir(dir) {
+    mkdirSync(dir, { recursive: true });
+}

package/dist/lib/platform.js

@@ -0,0 +1,28 @@
+export function getPlatform() {
+    switch (process.platform) {
+        case "linux":
+            return "linux";
+        case "darwin":
+            return "darwin";
+        case "win32":
+            return "win";
+        default:
+            throw new Error(`Unsupported platform: "${process.platform}". Chvor supports linux, darwin (macOS), and win32 (Windows).`);
+    }
+}
+export function getArch() {
+    switch (process.arch) {
+        case "x64":
+            return "x64";
+        case "arm64":
+            return "arm64";
+        default:
+            throw new Error(`Unsupported architecture: "${process.arch}". Chvor supports x64 and arm64.`);
+    }
+}
+export function getAssetName(version) {
+    const os = getPlatform();
+    const arch = getArch();
+    const ext = os === "win" ? "zip" : "tar.gz";
+    return `chvor-v${version}-${os}-${arch}.${ext}`;
+}

package/dist/lib/process.js

@@ -0,0 +1,220 @@
+import { spawn, execFileSync } from "node:child_process";
+import { readFileSync, writeFileSync, unlinkSync, existsSync, openSync, } from "node:fs";
+import { join } from "node:path";
+import { getAppDir, getDataDir, getLogsDir, getPidPath, getSkillsDir, getToolsDir, ensureDir, } from "./paths.js";
+import { readConfig } from "./config.js";
+function isProcessAlive(pid) {
+    if (process.platform === "win32") {
+        try {
+            const output = execFileSync("tasklist", ["/FI", `PID eq ${pid}`], {
+                encoding: "utf-8",
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+            return output.includes(String(pid));
+        }
+        catch {
+            return false;
+        }
+    }
+    else {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    }
+}
+export function isServerRunning() {
+    const pidPath = getPidPath();
+    if (!existsSync(pidPath)) {
+        return { running: false };
+    }
+    try {
+        const raw = readFileSync(pidPath, "utf-8").trim();
+        const pid = parseInt(raw, 10);
+        if (isNaN(pid)) {
+            return { running: false };
+        }
+        if (isProcessAlive(pid)) {
+            return { running: true, pid };
+        }
+        // Stale PID file — clean up
+        unlinkSync(pidPath);
+        return { running: false };
+    }
+    catch {
+        return { running: false };
+    }
+}
+export async function spawnServer(opts = {}) {
+    const config = readConfig();
+    const port = opts.port ?? config.port;
+    const token = config.token;
+    const status = isServerRunning();
+    if (status.running) {
+        console.log(`Chvor is already running (PID ${status.pid}).`);
+        console.log(`  http://localhost:${port}`);
+        return;
+    }
+    const serverEntry = join(getAppDir(), "apps", "server", "src", "index.ts");
+    if (!existsSync(serverEntry)) {
+        throw new Error(`Server entry point not found: ${serverEntry}\nRun "chvor install" first.`);
+    }
+    const dataDir = getDataDir();
+    ensureDir(dataDir);
+    // Build environment variables
+    const env = {
+        ...filterEnv(process.env),
+        PORT: port,
+        CHVOR_DATA_DIR: dataDir,
+        CHVOR_SKILLS_DIR: getSkillsDir(),
+        CHVOR_TOOLS_DIR: getToolsDir(),
+        NODE_ENV: "production",
+    };
+    if (token) {
+        env.CHVOR_TOKEN = token;
+    }
+    // Pass through common LLM API key env vars
+    const llmKeyVars = [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "GOOGLE_AI_API_KEY",
+        "MISTRAL_API_KEY",
+        "GROQ_API_KEY",
+        "TOGETHER_API_KEY",
+        "OPENROUTER_API_KEY",
+        "AZURE_OPENAI_API_KEY",
+        "AWS_ACCESS_KEY_ID",
+        "AWS_SECRET_ACCESS_KEY",
+        "AWS_REGION",
+    ];
+    for (const key of llmKeyVars) {
+        if (process.env[key] && !env[key]) {
+            env[key] = process.env[key];
+        }
+    }
+    if (opts.foreground) {
+        console.log(`Starting Chvor on port ${port} (foreground)...`);
+        const child = spawn("node", [serverEntry], {
+            env,
+            stdio: "inherit",
+        });
+        const pidPath = getPidPath();
+        writeFileSync(pidPath, String(child.pid), "utf-8");
+        child.on("exit", (code) => {
+            try {
+                unlinkSync(pidPath);
+            }
+            catch {
+                // ignore
+            }
+            if (code !== 0) {
+                console.error(`Chvor exited with code ${code}`);
+            }
+        });
+        // Wait for health
+        const healthy = await pollHealth(port, token);
+        if (healthy) {
+            console.log(`Chvor is ready at http://localhost:${port}`);
+        }
+        else {
+            console.warn("Chvor started but health check did not pass within timeout.");
+        }
+    }
+    else {
+        console.log(`Starting Chvor on port ${port} (background)...`);
+        const logsDir = getLogsDir();
+        ensureDir(logsDir);
+        const logPath = join(logsDir, "server.log");
+        const logFd = openSync(logPath, "a");
+        const child = spawn("node", [serverEntry], {
+            env,
+            stdio: ["ignore", logFd, logFd],
+            detached: true,
+        });
+        child.unref();
+        const pidPath = getPidPath();
+        writeFileSync(pidPath, String(child.pid), "utf-8");
+        console.log(`Chvor started (PID ${child.pid}). Logs: ${logPath}`);
+        const healthy = await pollHealth(port, token);
+        if (healthy) {
+            console.log(`Chvor is ready at http://localhost:${port}`);
+        }
+        else {
+            console.warn("Chvor started but health check did not pass within timeout.\n" +
+                `Check logs at ${logPath}`);
+        }
+    }
+}
+export async function stopServer() {
+    const pidPath = getPidPath();
+    if (!existsSync(pidPath)) {
+        console.log("Chvor is not running.");
+        return;
+    }
+    const raw = readFileSync(pidPath, "utf-8").trim();
+    const pid = parseInt(raw, 10);
+    if (isNaN(pid)) {
+        console.log("Invalid PID file. Cleaning up.");
+        unlinkSync(pidPath);
+        return;
+    }
+    try {
+        if (process.platform === "win32") {
+            execFileSync("taskkill", ["/PID", String(pid), "/T", "/F"], {
+                stdio: ["pipe", "pipe", "pipe"],
+            });
+        }
+        else {
+            process.kill(pid, "SIGTERM");
+        }
+    }
+    catch {
+        // Process may already be gone
+    }
+    try {
+        unlinkSync(pidPath);
+    }
+    catch {
+        // ignore
+    }
+    console.log("Chvor stopped.");
+}
+export async function pollHealth(port, token, timeoutMs = 15000, intervalMs = 500) {
+    const start = Date.now();
+    const url = `http://localhost:${port}/api/health`;
+    const headers = {};
+    if (token) {
+        headers["Authorization"] = `Bearer ${token}`;
+    }
+    while (Date.now() - start < timeoutMs) {
+        try {
+            const res = await fetch(url, { headers });
+            if (res.ok) {
+                const body = (await res.json());
+                if (body.ok === true) {
+                    return true;
+                }
+            }
+        }
+        catch {
+            // Connection refused or other error — server not ready yet
+        }
+        await sleep(intervalMs);
+    }
+    return false;
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+function filterEnv(env) {
+    const result = {};
+    for (const [key, value] of Object.entries(env)) {
+        if (value !== undefined) {
+            result[key] = value;
+        }
+    }
+    return result;
+}

package/dist/lib/registry-auth.js

@@ -0,0 +1,130 @@
+import { readFileSync, writeFileSync, existsSync, mkdirSync } from "node:fs";
+import { join, dirname } from "node:path";
+import { execFile } from "node:child_process";
+import { getChvorHome } from "./paths.js";
+function getAuthPath() {
+    return join(getChvorHome(), "data", "registry-auth.json");
+}
+function readAuth() {
+    const authPath = getAuthPath();
+    if (!existsSync(authPath))
+        return null;
+    try {
+        const data = JSON.parse(readFileSync(authPath, "utf8"));
+        // Check expiry
+        if (new Date(data.expiresAt) < new Date())
+            return null;
+        return data;
+    }
+    catch {
+        return null;
+    }
+}
+function writeAuth(auth) {
+    const authPath = getAuthPath();
+    mkdirSync(dirname(authPath), { recursive: true });
+    writeFileSync(authPath, JSON.stringify(auth, null, 2), { encoding: "utf8", mode: 0o600 });
+}
+export function getRegistryToken(registryUrl) {
+    const auth = readAuth();
+    if (!auth)
+        return null;
+    if (auth.registryUrl !== registryUrl)
+        return null;
+    return auth.token;
+}
+export function isAuthenticated(registryUrl) {
+    return getRegistryToken(registryUrl) !== null;
+}
+export function getUsername(registryUrl) {
+    const auth = readAuth();
+    if (!auth || auth.registryUrl !== registryUrl)
+        return null;
+    return auth.username;
+}
+export function logout() {
+    const authPath = getAuthPath();
+    if (existsSync(authPath)) {
+        writeFileSync(authPath, "{}", "utf8");
+    }
+}
+function openBrowser(url) {
+    try {
+        const platform = process.platform;
+        const cmd = platform === "darwin" ? "open" : platform === "win32" ? "start" : "xdg-open";
+        execFile(cmd, [url], () => { });
+    }
+    catch {
+        // Non-critical — user can open manually
+    }
+}
+/**
+ * Authenticate with the registry using GitHub device flow.
+ * Opens the user's browser to GitHub where they enter a code.
+ */
+export async function authenticate(registryUrl) {
+    // Step 1: Initiate device flow
+    console.log("Authenticating with the registry...\n");
+    const codeRes = await fetch(`${registryUrl}/auth/device/code`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+    });
+    if (!codeRes.ok) {
+        const body = await codeRes.text();
+        throw new Error(`Failed to initiate authentication: ${body}`);
+    }
+    const codeData = await codeRes.json();
+    // Step 2: Display instructions to user
+    console.log("To authenticate, visit:");
+    console.log(`\n  ${codeData.verification_uri}\n`);
+    console.log(`Enter code: ${codeData.user_code}\n`);
+    console.log("Waiting for authorization...");
+    // Try to open browser
+    openBrowser(codeData.verification_uri);
+    // Step 3: Poll for token
+    let interval = (codeData.interval || 5) * 1000;
+    const deadline = Date.now() + (codeData.expires_in || 900) * 1000;
+    while (Date.now() < deadline) {
+        await new Promise((resolve) => setTimeout(resolve, interval));
+        const tokenRes = await fetch(`${registryUrl}/auth/device/token`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json" },
+            body: JSON.stringify({ device_code: codeData.device_code }),
+        });
+        if (!tokenRes.ok) {
+            throw new Error(`Token exchange failed: HTTP ${tokenRes.status}`);
+        }
+        const tokenData = await tokenRes.json();
+        switch (tokenData.status) {
+            case "complete": {
+                if (!tokenData.token || !tokenData.username) {
+                    throw new Error("Received complete status but missing token/username");
+                }
+                // Store auth
+                const expiresAt = new Date(Date.now() + 7 * 24 * 60 * 60 * 1000).toISOString();
+                writeAuth({
+                    token: tokenData.token,
+                    username: tokenData.username,
+                    registryUrl,
+                    expiresAt,
+                });
+                console.log(`\nAuthenticated as ${tokenData.username}`);
+                return { token: tokenData.token, username: tokenData.username };
+            }
+            case "slow_down":
+                if (tokenData.interval)
+                    interval = tokenData.interval * 1000;
+                else
+                    interval += 5000;
+                break;
+            case "expired":
+                throw new Error("Device code expired. Please try again.");
+            case "pending":
+                // Keep polling
+                break;
+            default:
+                throw new Error(`Unexpected status: ${tokenData.status}`);
+        }
+    }
+    throw new Error("Authentication timed out. Please try again.");
+}

package/dist/lib/template-loader.js

@@ -0,0 +1,190 @@
+import { readFileSync, readdirSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { tmpdir } from "node:os";
+import { parse as parseYaml } from "yaml";
+import { getAppDir } from "./paths.js";
+const DEFAULT_REGISTRY_URL = "https://raw.githubusercontent.com/chvor-community/skill-registry/main";
+const FETCH_TIMEOUT_MS = 8_000;
+const SAFE_ENTRY_ID_RE = /^[a-z0-9][a-z0-9_-]*$/;
+/** Validates that a registry URL uses HTTPS (or localhost for development). */
+function assertValidRegistryUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Invalid registry URL: "${url}"`);
+    }
+    const isLocalhost = parsed.hostname === "localhost" || parsed.hostname === "127.0.0.1";
+    if (parsed.protocol !== "https:" && !(parsed.protocol === "http:" && isLocalhost)) {
+        throw new Error(`Registry URL must use HTTPS (got ${parsed.protocol}). HTTP is only allowed for localhost.`);
+    }
+}
+/** Validates that an entry ID is safe for use as a filename (no path traversal). */
+function assertSafeEntryId(id) {
+    if (!id || id.length > 100 || !SAFE_ENTRY_ID_RE.test(id)) {
+        throw new Error(`Invalid entry ID: "${id}" — must be lowercase alphanumeric with hyphens/underscores only`);
+    }
+}
+function getBundledTemplatesDir() {
+    return join(getAppDir(), "apps", "server", "data", "bundled-templates");
+}
+export function validateTemplate(manifest) {
+    if (!manifest || typeof manifest !== "object")
+        return false;
+    const m = manifest;
+    return (typeof m.name === "string" &&
+        typeof m.description === "string" &&
+        typeof m.version === "string");
+}
+export function loadTemplateFromPath(templateDir) {
+    const manifestPath = join(templateDir, "template.yaml");
+    if (!existsSync(manifestPath)) {
+        throw new Error(`No template.yaml found in ${templateDir}`);
+    }
+    const raw = readFileSync(manifestPath, "utf-8");
+    const manifest = parseYaml(raw);
+    if (!validateTemplate(manifest)) {
+        throw new Error(`Invalid template manifest in ${manifestPath}. Required fields: name, description, version`);
+    }
+    return manifest;
+}
+export function listBundledTemplates() {
+    const dir = getBundledTemplatesDir();
+    if (!existsSync(dir))
+        return [];
+    const entries = [];
+    const dirs = readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isDirectory());
+    for (const d of dirs) {
+        const templateDir = join(dir, d.name);
+        try {
+            const manifest = loadTemplateFromPath(templateDir);
+            entries.push({
+                id: d.name,
+                name: manifest.name,
+                description: manifest.description,
+                version: manifest.version,
+                author: manifest.author,
+                icon: manifest.icon,
+                tags: manifest.tags,
+                path: templateDir,
+            });
+        }
+        catch (err) {
+            console.warn(`  Warning: skipping invalid template in ${d.name}: ${err instanceof Error ? err.message : err}`);
+        }
+    }
+    return entries;
+}
+export function resolveBundledTemplate(nameOrId) {
+    const dir = getBundledTemplatesDir();
+    if (!existsSync(dir))
+        return null;
+    // Direct match by directory name
+    const directPath = join(dir, nameOrId);
+    if (existsSync(join(directPath, "template.yaml"))) {
+        return directPath;
+    }
+    // Search by manifest name
+    const dirs = readdirSync(dir, { withFileTypes: true })
+        .filter((d) => d.isDirectory());
+    for (const d of dirs) {
+        const templateDir = join(dir, d.name);
+        try {
+            const manifest = loadTemplateFromPath(templateDir);
+            if (manifest.name === nameOrId)
+                return templateDir;
+        }
+        catch {
+            // Skip — template may be invalid while searching by name
+        }
+    }
+    return null;
+}
+export function resolveTemplate(source) {
+    // Try as local path first
+    if (existsSync(join(source, "template.yaml"))) {
+        return { path: source, manifest: loadTemplateFromPath(source) };
+    }
+    // Try as bundled template name
+    const bundledPath = resolveBundledTemplate(source);
+    if (bundledPath) {
+        return { path: bundledPath, manifest: loadTemplateFromPath(bundledPath) };
+    }
+    throw new Error(`Template "${source}" not found. Use "chvor init" to see available templates.`);
+}
+export function getTemplateSkillsDir(templatePath) {
+    const dir = join(templatePath, "skills");
+    return existsSync(dir) ? dir : null;
+}
+export function getTemplateToolsDir(templatePath) {
+    const dir = join(templatePath, "tools");
+    return existsSync(dir) ? dir : null;
+}
+/**
+ * Resolve a template from the community registry.
+ * Fetches the template.yaml and any included skills/tools into a temp directory.
+ */
+export async function resolveRegistryTemplate(id) {
+    assertSafeEntryId(id);
+    const registryUrl = process.env.CHVOR_REGISTRY_URL || DEFAULT_REGISTRY_URL;
+    assertValidRegistryUrl(registryUrl);
+    // Fetch registry index
+    const indexRes = await fetch(`${registryUrl}/index.json`, {
+        signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+    });
+    if (!indexRes.ok) {
+        throw new Error(`Failed to fetch registry index (${indexRes.status})`);
+    }
+    const index = (await indexRes.json());
+    const entry = index.entries.find((e) => e.id === id && e.kind === "template");
+    if (!entry) {
+        throw new Error(`Template "${id}" not found in registry. Check the ID and try again.`);
+    }
+    // Fetch template.yaml
+    const yamlRes = await fetch(`${registryUrl}/templates/${encodeURIComponent(id)}/template.yaml`, { signal: AbortSignal.timeout(FETCH_TIMEOUT_MS) });
+    if (!yamlRes.ok) {
+        throw new Error(`Failed to fetch template "${id}" (${yamlRes.status})`);
+    }
+    const yamlContent = await yamlRes.text();
+    // Create temp directory and write manifest
+    const tempDir = join(tmpdir(), `chvor-template-${id}-${Date.now()}`);
+    mkdirSync(tempDir, { recursive: true });
+    writeFileSync(join(tempDir, "template.yaml"), yamlContent, "utf-8");
+    const manifest = parseYaml(yamlContent);
+    if (!validateTemplate(manifest)) {
+        throw new Error(`Invalid template manifest from registry for "${id}". Required fields: name, description, version`);
+    }
+    // Fetch included skills/tools
+    if (entry.includes?.length) {
+        for (const includedId of entry.includes) {
+            try {
+                assertSafeEntryId(includedId);
+            }
+            catch {
+                console.warn(`  Warning: included entry "${includedId}" has invalid ID, skipping.`);
+                continue;
+            }
+            const included = index.entries.find((e) => e.id === includedId);
+            if (!included || (included.kind !== "skill" && included.kind !== "tool")) {
+                console.warn(`  Warning: included entry "${includedId}" not found or unsupported kind in registry, skipping.`);
+                continue;
+            }
+            const contentUrl = `${registryUrl}/${included.kind}s/${encodeURIComponent(includedId)}/${included.kind}.md`;
+            const contentRes = await fetch(contentUrl, {
+                signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
+            });
+            if (!contentRes.ok) {
+                console.warn(`  Warning: failed to fetch included ${included.kind} "${includedId}" (${contentRes.status}), skipping.`);
+                continue;
+            }
+            const content = await contentRes.text();
+            const destDir = join(tempDir, included.kind === "skill" ? "skills" : "tools");
+            mkdirSync(destDir, { recursive: true });
+            writeFileSync(join(destDir, `${includedId}.md`), content, "utf-8");
+        }
+    }
+    // Note: caller is responsible for cleaning up tempDir after use
+    return { path: tempDir, manifest };
+}