@clearlysh/beehaven 0.8.16

package/dist/bee/cloud-proxy.js

@@ -0,0 +1,130 @@
+// ============================================================================
+// Cloud Bee Proxy — Lightweight state holder for cloud-sourced bee status
+//
+// Replaces the local BeeAgent. Receives state updates from the BeeHive
+// Durable Object via WebSocket 'agent-status' messages and exposes a
+// getStatus() shape compatible with the DaemonRepl.
+// ============================================================================
+import { EventEmitter } from 'events';
+import { existsSync, readFileSync, readdirSync } from 'fs';
+import { join } from 'path';
+import { homedir } from 'os';
+const THOUGHTS_DIR = join(homedir(), 'beehaven', 'thoughts');
+// ── CloudBeeProxy ───────────────────────────────────────────────────────────
+export class CloudBeeProxy extends EventEmitter {
+    relay;
+    state = {
+        emotion: 'sleep',
+        mood: 'fine',
+        moodScore: 50,
+        phase: 'rest',
+        activeSession: null,
+        soulVersion: 0,
+        learnings: 0,
+        patterns: 0,
+        rhythmRunning: false,
+        energy: -1,
+        hunger: -1,
+        fun: -1,
+        social: -1,
+    };
+    constructor(relay) {
+        super();
+        this.relay = relay;
+    }
+    /** Update from an incoming agent-status message from the DO */
+    updateFromCloud(msg) {
+        const prevEmotion = this.state.emotion;
+        if (msg.emotion !== undefined)
+            this.state.emotion = msg.emotion;
+        if (msg.mood !== undefined)
+            this.state.mood = String(msg.mood);
+        if (msg.moodScore !== undefined)
+            this.state.moodScore = msg.moodScore;
+        if (msg.phase !== undefined)
+            this.state.phase = msg.phase;
+        if (msg.activeSession !== undefined)
+            this.state.activeSession = msg.activeSession;
+        if (msg.soulVersion !== undefined)
+            this.state.soulVersion = msg.soulVersion;
+        if (msg.learnings !== undefined)
+            this.state.learnings = msg.learnings;
+        if (msg.patterns !== undefined)
+            this.state.patterns = msg.patterns;
+        if (msg.rhythmRunning !== undefined)
+            this.state.rhythmRunning = msg.rhythmRunning;
+        if (msg.energy !== undefined)
+            this.state.energy = msg.energy;
+        if (msg.hunger !== undefined)
+            this.state.hunger = msg.hunger;
+        if (msg.fun !== undefined)
+            this.state.fun = msg.fun;
+        if (msg.social !== undefined)
+            this.state.social = msg.social;
+        if (msg.emotion && msg.emotion !== prevEmotion) {
+            this.emit('emotion', msg.emotion);
+        }
+        this.emit('status', this.state);
+    }
+    /** Shape-compatible with BeeAgent.getStatus() for the REPL */
+    getStatus() {
+        return {
+            emotion: this.state.emotion,
+            mood: this.state.mood,
+            moodScore: this.state.moodScore,
+            energy: this.state.energy,
+            hunger: this.state.hunger,
+            fun: this.state.fun,
+            social: this.state.social,
+            rhythmPhase: this.state.phase,
+            learnings: this.state.learnings,
+            patterns: this.state.patterns,
+            soulVersion: this.state.soulVersion,
+            sessionActive: this.state.activeSession !== null,
+            wakeTimerActive: false,
+            llmConfigured: true,
+            llmProvider: 'cloud',
+            llmDailyCost: 0,
+            llmCallsThisHour: 0,
+        };
+    }
+    /** Send a reflect command to the cloud via relay */
+    async forceReflect() {
+        if (this.relay?.wsSend) {
+            this.relay.wsSend({ type: 'command', text: '$ bee think' });
+            this.emit('thought', { type: 'observation', content: 'Reflection requested from cloud...' });
+        }
+        else {
+            this.emit('thought', { type: 'observation', content: 'Not connected to cloud.' });
+        }
+    }
+    /** No-op — lifecycle managed by cloud DO */
+    stop() {
+        /* no-op */
+    }
+}
+// ── Standalone utility (extracted from bee/llm.ts) ──────────────────────────
+/** Read recent thought files from ~/beehaven/thoughts/ */
+export function getRecentThoughts(count = 5) {
+    try {
+        if (!existsSync(THOUGHTS_DIR))
+            return [];
+        const files = readdirSync(THOUGHTS_DIR)
+            .filter((f) => f.endsWith('.md'))
+            .sort()
+            .slice(-count);
+        return files
+            .map((f) => {
+            try {
+                return readFileSync(join(THOUGHTS_DIR, f), 'utf8');
+            }
+            catch {
+                return '';
+            }
+        })
+            .filter(Boolean);
+    }
+    catch {
+        return [];
+    }
+}

package/dist/blocked-actions.js

@@ -0,0 +1,120 @@
+/**
+ * Spend confirmation for actions that cost real money.
+ *
+ * `beehaven call <action>` can reach ANY action mounted on the workspace DO — the action
+ * registry is looked up by name (`_actions.get`), so mounting an RPC for the web app also
+ * exposes it to the shell. For most actions that is the point. For actions that bill a paid
+ * model per invocation it is a footgun: a shell one-liner — or an agent driving this CLI —
+ * can run it in a loop with nothing between the keystroke and the charge.
+ *
+ * This used to be a HARD BLOCK on `studio-image-generate`, which was the wrong shape. It made
+ * the CLI — and every agent driving it — unable to do the product's core job (generate and
+ * vectorize) in order to prevent a cost problem that a confirmation prompt solves. Generation
+ * is now ALLOWED and CONFIRMED: interactive callers get a y/N prompt carrying the estimate,
+ * scripted and agent callers pass `--yes`, and free paths are never gated at all.
+ *
+ * Cost is assessed per-CALL, not per-action, because the same RPC is free or paid depending on
+ * its input: a hand-rolled SVG (`engine:'handroll'`, or `svgContent` supplied) runs no model,
+ * while the same action with a prompt bills a raster model plus a trace. Gating on the action
+ * name alone would prompt on the free path and teach people to reflex-pass `--yes` — which
+ * would cost more than it saved.
+ *
+ * This is a GUARDRAIL, not a security boundary. It lives in the CLI, so it stops accidental and
+ * automated spend through the supported path; it does not stop someone who edits this file or
+ * speaks the daemon protocol directly. The real ceiling is server-side — the composition
+ * pre-flight checks quota BEFORE dispatching, so an exhausted workspace is refused, not billed.
+ */
+export const COSTLY_ACTIONS = [
+    {
+        action: 'studio-image-generate',
+        estimate: '~$0.03–0.04',
+        what: 'a paid raster model, and/or a Recraft vectorize pass',
+    },
+    {
+        action: 'create',
+        estimate: '~$0.03–0.04',
+        what: 'a paid raster/video model, or a Recraft vectorize pass',
+    },
+    {
+        action: 'studio-video-generate',
+        estimate: '~$0.10+',
+        what: 'a paid video model',
+    },
+    {
+        action: 'recraft-vectorize',
+        estimate: '~$0.01',
+        what: 'a Recraft vectorize pass',
+    },
+];
+const BY_NAME = new Map(COSTLY_ACTIONS.map((b) => [b.action, b]));
+/** The cost entry for `action`, or null when the action never spends. */
+export function costlyAction(action) {
+    return BY_NAME.get(String(action || '').trim()) ?? null;
+}
+/**
+ * Does THIS call spend money? Input-aware, because the free and paid paths share an RPC.
+ *
+ * Free (returns null):
+ *   - `engine:'handroll'`, or any call supplying `svgContent` — the caller wrote the SVG, so
+ *     no model runs. This is the path agents should prefer and it must never prompt.
+ *   - `create` with a non-generating `kind` (document / spreadsheet), which is just a write.
+ */
+export function costOfCall(action, input) {
+    const entry = costlyAction(action);
+    if (!entry)
+        return null;
+    const i = input && typeof input === 'object' ? input : {};
+    // Hand-rolled vectors run no model, on either RPC.
+    if (i.engine === 'handroll' || (typeof i.svgContent === 'string' && i.svgContent.trim()))
+        return null;
+    if (entry.action === 'create') {
+        const kind = String(i.kind ?? 'vector').toLowerCase();
+        const PAID = new Set([
+            'image', 'video', 'clip', 'animation', 'movie',
+            'vectorize', 'trace', 'vector-trace', 'sticker-sheet',
+        ]);
+        // 'vector' is paid ONLY when the model has to build it — a call carrying svgContent
+        // already returned above. Every other kind (document, spreadsheet, …) is a plain write.
+        if (kind === 'vector')
+            return entry;
+        return PAID.has(kind) ? entry : null;
+    }
+    return entry;
+}
+/** Read a single y/N answer from the TTY. Resolves false on EOF or anything but y/yes. */
+async function askYesNo(question) {
+    const { createInterface } = await import('readline');
+    // Prompt on STDERR so a `--json` consumer piping stdout still gets clean JSON.
+    const rl = createInterface({ input: process.stdin, output: process.stderr });
+    try {
+        const answer = await new Promise((resolve) => rl.question(question, resolve));
+        return /^y(es)?$/i.test(String(answer).trim());
+    }
+    finally {
+        rl.close();
+    }
+}
+/**
+ * Confirm a spending call before it is dispatched; no-op for free calls.
+ *
+ * Non-interactive callers (agents, CI, pipes) MUST pass `yes` — we refuse rather than prompt
+ * into a void, and the refusal names the flag so the fix is one edit away.
+ */
+export async function assertActionAllowed(action, input, opts) {
+    const cost = costOfCall(action, input);
+    if (!cost)
+        return;
+    if (opts?.yes)
+        return;
+    if (!process.stdin.isTTY) {
+        console.error(`\n  \`${action}\` spends money (${cost.estimate} per call — ${cost.what}).`);
+        console.error(`  This shell is not interactive, so it cannot be confirmed here.`);
+        console.error(`  Re-run with --yes to authorize the spend.\n`);
+        process.exit(1);
+    }
+    const ok = await askYesNo(`\n  \`${action}\` will spend ${cost.estimate} (${cost.what}).\n  Continue? [y/N] `);
+    if (!ok) {
+        console.error('  Cancelled — nothing was spent.\n');
+        process.exit(1);
+    }
+}

package/dist/build-channel.js

@@ -0,0 +1,101 @@
+/**
+ * Which BUILD this is, and therefore whether Developer Mode may be turned on at all.
+ *
+ * ⚠⚠ DEVELOPER SCOPE IS NOT SOMETHING A PUBLIC INSTALL MAY OPT INTO. `HIVE_DEV_MODE=1` mints a
+ * second IPC token that unlocks `get-token` (exfiltrates the user's Firebase ID token),
+ * `daemon-fetch`, `shell`, `sql`, `marketplace:install` and the `admin:*` proxies — and the relay
+ * path additionally unlocks `bash` / `workspace-exec`, which its own comment calls "arbitrary local
+ * command execution" on a channel that is "unauthenticated per message". That is an internal
+ * operator surface. Shipping it to `curl … | sh` users behind one environment variable means the
+ * capability is one blog post away from being a supported feature.
+ *
+ * ⚠ THE DEFAULT IS THE *SOURCE* BUILD, so a checkout keeps working exactly as it does today and
+ * nobody has to remember a flag to develop. The PUBLISH path opts INTO being public — see
+ * `scripts/stamp-build-channel.mjs`, run by `npm run build` and stamped by
+ * `scripts/publish-beehaven-cli.sh`. Defaulting the other way would ship a dev build the first time
+ * somebody published without the flag, and that failure is silent.
+ *
+ * ⚠⚠ THIS IS A DISTRIBUTION BOUNDARY, NOT AN ACCESS-CONTROL ONE, and the difference matters. The
+ * file is JavaScript on the user's own disk and they can edit it; what it prevents is the
+ * capability being PRESENT and documented in a build we hand out. Real authorization is server-side
+ * — every `admin:*` RPC is gated on `ADMIN_USER_IDS` — and nothing here weakens or replaces that.
+ */
+/**
+ * `true` in a tarball produced by the publish script; `false` in a source checkout.
+ *
+ * ⚠ REWRITTEN IN `dist/` AT BUILD TIME. Read it through `devModeAvailable()` rather than importing
+ * it directly, so there is one place that decides and one place to look.
+ */
+export const PUBLIC_BUILD = true;
+/**
+ * WHICH BUILD THIS IS — a commit and a build time, stamped into `dist/` — CBH2-145.
+ *
+ * ⚠⚠ THE VERSION NUMBER CANNOT ANSWER THIS AND NEVER COULD. On 2026-09-06 two copies of the CLI
+ * on one machine both reported `0.8.2` and were DIFFERENT PROGRAMS: the Mac app's bundled
+ * `cli.js` (351,057 bytes) and the repo build (360,010). The bundled one answered "Unknown
+ * command: sprint" while the repo build listed the sprints, and nothing in `--version` said so.
+ * That is the same hazard the publish script already guards for the tarball — *"different bytes
+ * under one version is an error, not a silent default"* — on the copy that actually owns
+ * `~/.local/bin/beehaven`.
+ *
+ * ⚠⚠ NOT FIXED BY BUMPING THE PACKAGE VERSION, deliberately. That would make the number
+ * meaningless for releases AND still not help here: a dev build can be made at any commit, so two
+ * builds of one version are the NORMAL case on a developer's machine, not an anomaly.
+ *
+ * ⚠ TWO FIELDS BECAUSE THEY ANSWER TWO QUESTIONS. The sha says WHICH SOURCE; the timestamp says
+ * WHICH BUILD, and it is the half that still works when the sha cannot distinguish them — a build
+ * from a dirty tree, or from a tarball with no `.git` at all. Neither alone is sufficient.
+ *
+ * ⚠ `-dirty` IS SCOPED TO THIS PACKAGE, not to the monorepo — a repo this size is almost always
+ * dirty somewhere, and a marker that is always on says nothing. Scoped, it means exactly *"the sha
+ * above does not identify these bytes"*, which is the claim a reader needs.
+ *
+ * ⚠ REWRITTEN IN `dist/` AT BUILD TIME, like `PUBLIC_BUILD`. `unstamped` is what a source checkout
+ * carries and what `tsx`/`vitest` see, and it is honest: nothing has stamped them.
+ */
+export const BUILD_SHA = '6cab82f4d7e2';
+/** ISO-8601 minute precision, UTC. Rewritten in `dist/` by `scripts/stamp-build-channel.mjs`. */
+export const BUILD_TIME = '2026-09-27T06:05Z';
+/**
+ * The build identity as one short string, for `--version`.
+ *
+ * ⚠ ONE FORMATTER, so the version line and any guard read the same thing. Returns `''` when
+ * nothing is stamped rather than the word "unstamped" twice — a `tsx` run has no build to name,
+ * and printing placeholder noise on the one command people use to check a build is how the field
+ * gets ignored.
+ */
+export function buildLabel() {
+    const parts = [];
+    if (BUILD_SHA && BUILD_SHA !== 'unstamped')
+        parts.push(BUILD_SHA);
+    if (BUILD_TIME && BUILD_TIME !== 'unstamped')
+        parts.push(`built ${BUILD_TIME}`);
+    return parts.join('  ');
+}
+/**
+ * Is Developer Mode reachable in this build, and asked for?
+ *
+ * ⚠⚠ ONE PREDICATE, BECAUSE THERE WERE FOUR CHECKS AND THEY DID NOT AGREE. `daemon.ts` accepted
+ * `'1'` or `'true'`; `relay.ts` accepted only `'1'`; `cli.ts` accepted both again for the help
+ * text. So `HIVE_DEV_MODE=true` produced a daemon in developer mode whose relay path still refused
+ * `bash` — a state nothing reports and which reads as the gate being broken. Anything that gates on
+ * developer mode calls this.
+ */
+export function devModeAvailable(env = process.env) {
+    if (PUBLIC_BUILD)
+        return false;
+    const v = String(env.HIVE_DEV_MODE ?? '').trim().toLowerCase();
+    return v === '1' || v === 'true' || v === 'yes' || v === 'on';
+}
+/**
+ * Why Developer Mode is unavailable, for a message a person can act on.
+ *
+ * ⚠ THE TWO REASONS NEED DIFFERENT ANSWERS. "You did not switch it on" is fixed by setting the
+ * variable; "this build cannot" is not fixed by anything the user types, and telling them to set a
+ * variable that will be ignored is how a support thread starts.
+ */
+export function devModeRefusal(env = process.env) {
+    return PUBLIC_BUILD
+        ? 'Developer Mode is not available in a released build of the beehaven CLI.'
+        : 'Developer Mode is off. Start the daemon with HIVE_DEV_MODE=1 to enable it.';
+}