@dashclaw/cli 0.7.6 → 0.8.0

package/lib/code/vendored.js

@@ -1,219 +0,0 @@
-// VENDORED from app/lib/claude-code/optimal-files/merge.js and
-// app/lib/claude-code/optimal-files/bundle.js.
-//
-// The CLI is a sibling package and can't import from app/lib/ without
-// monorepo tooling, but Phase 6's `dashclaw code apply` needs the
-// path-traversal guard and the markdown merge applier locally. Keep this
-// file in sync with the canonical source via
-// `node scripts/sync-cli-vendored-code.mjs`.
-//
-// Source of truth:
-//   app/lib/claude-code/optimal-files/merge.js
-//   app/lib/claude-code/optimal-files/bundle.js#absolutize
-//
-// Only `applyMerge`, `previewMerge`, the heading/bullet helpers, and the
-// `_ensureInsideProject` guard are vendored. Everything else stays on the
-// server side.
-
-import path from 'node:path';
-
-// --- _ensureInsideProject (originally from bundle.js#absolutize) ---------
-
-export function _ensureInsideProject(projectCwd, candidatePath) {
-  if (!projectCwd || !candidatePath) return null;
-  let abs;
-  if (path.isAbsolute(candidatePath)) {
-    abs = path.normalize(candidatePath);
-  } else {
-    abs = path.normalize(path.join(projectCwd, candidatePath));
-  }
-  const cwdNorm = path.normalize(projectCwd);
-  const ci = process.platform === 'win32';
-  const a = ci ? abs.toLowerCase() : abs;
-  const b = ci ? cwdNorm.toLowerCase() : cwdNorm;
-  if (a !== b && !a.startsWith(b + path.sep)) return null;
-  return abs;
-}
-
-// --- markdown merge (originally from merge.js) ---------------------------
-
-export function parseMarkdownSections(text) {
-  const lines = String(text || '').split(/\r?\n/);
-  const sections = [];
-  let cur = { level: 0, heading: '__preamble__', headingRaw: '', body: [] };
-  for (const line of lines) {
-    const m = line.match(/^(#{1,6})\s+(.+?)\s*$/);
-    if (m) {
-      sections.push(cur);
-      cur = { level: m[1].length, heading: normalizeHeading(m[2]), headingRaw: m[2], body: [] };
-    } else {
-      cur.body.push(line);
-    }
-  }
-  sections.push(cur);
-  return sections;
-}
-
-export function normalizeHeading(h) {
-  return String(h || '')
-    .toLowerCase()
-    .replace(/[`*_]/g, '')
-    .replace(/[^\w\s]+/g, ' ')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-function parseBullets(bodyLines) {
-  const bullets = [];
-  const other = [];
-  for (const line of bodyLines) {
-    if (/^\s*[-*]\s+/.test(line)) bullets.push({ raw: line, normalized: normalizeBullet(line) });
-    else other.push(line);
-  }
-  return { bullets, other };
-}
-
-function normalizeBullet(line) {
-  return String(line || '')
-    .replace(/^\s*[-*]\s+/, '')
-    .replace(/`[^`]*`/g, ' ')
-    .replace(/[^a-z0-9\s]+/gi, ' ')
-    .toLowerCase()
-    .trim()
-    .split(/\s+/)
-    .slice(0, 8)
-    .join(' ');
-}
-
-function bulletAlreadyPresent(generatedNorm, existingBullets) {
-  if (!generatedNorm) return true;
-  for (const b of existingBullets) {
-    if (!b.normalized) continue;
-    if (b.normalized.startsWith(generatedNorm)) return true;
-    if (generatedNorm.startsWith(b.normalized) && b.normalized.length >= 4) return true;
-    const aWords = generatedNorm.split(' ');
-    const bWords = b.normalized.split(' ');
-    let shared = 0;
-    for (let i = 0; i < Math.min(aWords.length, bWords.length); i++) {
-      if (aWords[i] === bWords[i]) shared++; else break;
-    }
-    if (shared >= 5) return true;
-  }
-  return false;
-}
-
-function isFooterSection(section) {
-  if (!section || !Array.isArray(section.body)) return false;
-  const joined = section.body.join('\n').toLowerCase();
-  return (joined.includes('generated by dashclaw') || joined.includes('generated by agentlens')) && joined.includes('review before committing');
-}
-
-function renderSection(section) {
-  return `## ${section.headingRaw}\n${section.body.join('\n')}`.replace(/\n+$/, '\n');
-}
-
-export function previewMerge(existing, generated) {
-  const ex = parseMarkdownSections(existing);
-  const gn = parseMarkdownSections(generated);
-  const exByHeading = new Map();
-  for (const s of ex) {
-    if (s.heading === '__preamble__') continue;
-    if (!exByHeading.has(s.heading)) exByHeading.set(s.heading, s);
-  }
-  const appendSections = [];
-  const sharedSections = [];
-  for (let i = 0; i < gn.length; i++) {
-    const s = gn[i];
-    if (s.heading === '__preamble__') continue;
-    if (isFooterSection(s)) continue;
-    if (s.level !== 2) continue;
-    const exSection = exByHeading.get(s.heading);
-    if (!exSection) {
-      appendSections.push({ heading: s.heading, headingRaw: s.headingRaw, bodyText: renderSection(s) });
-    } else {
-      const exBullets = parseBullets(exSection.body).bullets;
-      const genBullets = parseBullets(s.body).bullets;
-      const candidates = [];
-      for (const gb of genBullets) {
-        if (gb.normalized && !bulletAlreadyPresent(gb.normalized, exBullets)) {
-          candidates.push({ text: gb.raw.replace(/^\s*[-*]\s+/, '- ') });
-        }
-      }
-      if (candidates.length) {
-        sharedSections.push({
-          heading: s.heading,
-          headingRaw: s.headingRaw,
-          existingBulletCount: exBullets.length,
-          candidateBullets: candidates,
-        });
-      }
-    }
-  }
-  return {
-    appendSections,
-    sharedSections,
-    newSectionCount: appendSections.length,
-    sharedSectionCount: sharedSections.length,
-    candidateBulletCount: sharedSections.reduce((acc, s) => acc + s.candidateBullets.length, 0),
-  };
-}
-
-function trimTrailingBlanks(lines) {
-  const out = lines.slice();
-  while (out.length && out[out.length - 1].trim() === '') out.pop();
-  return out;
-}
-
-export function applyMerge(existing, generated, selection) {
-  const preview = previewMerge(existing, generated);
-  selection = selection || {};
-  const acceptedHeadings = new Set((selection.acceptedHeadings || []).map(h => normalizeHeading(h)));
-  const acceptedBulletsByHeading = new Map();
-  for (const b of (selection.acceptedBullets || [])) {
-    const k = normalizeHeading(b.heading);
-    if (!acceptedBulletsByHeading.has(k)) acceptedBulletsByHeading.set(k, []);
-    acceptedBulletsByHeading.get(k).push(b.text);
-  }
-  let merged = String(existing == null ? '' : existing);
-  if (merged && !merged.endsWith('\n')) merged += '\n';
-  if (acceptedBulletsByHeading.size) {
-    const sections = parseMarkdownSections(merged);
-    const rebuilt = [];
-    for (const s of sections) {
-      if (s.heading === '__preamble__') { rebuilt.push(s.body.join('\n')); continue; }
-      const headingLine = `${'#'.repeat(s.level)} ${s.headingRaw}`;
-      const accepted = acceptedBulletsByHeading.get(s.heading) || [];
-      if (accepted.length) {
-        const trimmedBody = trimTrailingBlanks(s.body);
-        rebuilt.push(headingLine);
-        rebuilt.push(trimmedBody.join('\n'));
-        rebuilt.push('');
-        rebuilt.push('<!-- dashclaw:merged-bullets -->');
-        for (const t of accepted) rebuilt.push(t.startsWith('- ') ? t : `- ${t}`);
-        rebuilt.push('<!-- /dashclaw:merged-bullets -->');
-        rebuilt.push('');
-      } else {
-        rebuilt.push(headingLine);
-        rebuilt.push(s.body.join('\n'));
-      }
-    }
-    merged = rebuilt.join('\n').replace(/\n+$/, '\n');
-  }
-  const wholeAdditions = preview.appendSections.filter(s => acceptedHeadings.has(s.heading));
-  if (wholeAdditions.length) {
-    if (!merged.endsWith('\n')) merged += '\n';
-    merged += '\n<!-- dashclaw:merged-sections -->\n\n';
-    for (const s of wholeAdditions) {
-      merged += s.bodyText.endsWith('\n') ? s.bodyText : s.bodyText + '\n';
-      merged += '\n';
-    }
-    merged += '<!-- /dashclaw:merged-sections -->\n';
-  }
-  return {
-    merged,
-    additions: {
-      sections: wholeAdditions.map(s => s.headingRaw),
-      bulletCount: [...acceptedBulletsByHeading.values()].reduce((acc, l) => acc + l.length, 0),
-    },
-  };
-}

package/lib/cost.js

@@ -1,108 +0,0 @@
-// cli/lib/cost.js
-//
-// `dashclaw cost [--lens fleet|claude-code] [--period 7d|30d|90d]` — terminal
-// readback over GET /api/finops/spend (the finops rollups). Defaults:
-// lens=claude-code, period=7d — the wedge user's own Claude Code spend.
-
-import { apiRequest } from './api.js';
-
-export const VALID_LENSES = ['fleet', 'claude-code'];
-export const VALID_PERIODS = ['7d', '30d', '90d'];
-export const USAGE =
-  'Usage: dashclaw cost [--lens fleet|claude-code] [--period 7d|30d|90d]\n' +
-  '  Defaults: --lens claude-code --period 7d';
-
-/** Validate flag values. Returns null when fine, or a usage-bearing message. */
-export function validateCostFlags({ lens, period }) {
-  if (!VALID_LENSES.includes(lens)) {
-    return `Invalid --lens "${lens}". Valid: ${VALID_LENSES.join(', ')}.\n${USAGE}`;
-  }
-  if (!VALID_PERIODS.includes(period)) {
-    return `Invalid --period "${period}". Valid: ${VALID_PERIODS.join(', ')}.\n${USAGE}`;
-  }
-  return null;
-}
-
-export async function fetchSpend(config, { lens, period }) {
-  return apiRequest(config, 'GET', '/api/finops/spend', { query: { lens, period } });
-}
-
-const money = (n) => '$' + Number(n || 0).toFixed(2);
-
-function table(rows) {
-  // rows: [label, value][] — right-pad labels so values align.
-  const width = Math.max(...rows.map(([label]) => label.length));
-  return rows.map(([label, value]) => `  ${label.padEnd(width + 2)}${value}`).join('\n');
-}
-
-function formatClaudeCode(data, period) {
-  const cs = data.code_sessions || {};
-  const total = Number(data.code_total_usd || 0);
-  const sessions = Number(cs.session_count || 0);
-  if (total === 0 && sessions === 0) {
-    return (
-      `No Claude Code spend recorded yet for ${period}.\n` +
-      'Sessions are captured by the Stop hook (on by default, metadata-only;\n' +
-      'opt-out: DASHCLAW_CODE_SESSIONS_ENABLED=0). Run a Claude Code session and check back.'
-    );
-  }
-  const lines = [
-    `Claude Code spend — last ${period}`,
-    '',
-    table([
-      ['Total', money(total)],
-      ['Sessions', String(sessions)],
-      ['Cache saved', money(cs.total_cache_savings_usd)],
-    ]),
-  ];
-  const projects = Array.isArray(cs.by_project) ? cs.by_project.filter((p) => Number(p.cost_usd || 0) > 0) : [];
-  if (projects.length > 0) {
-    lines.push('', '  By project:');
-    lines.push(table(projects.map((p) => [`  ${p.project_name || p.project_id || 'unknown'}`, money(p.cost_usd)])));
-  }
-  lines.push('', `Summary: ${money(total)} across ${sessions} session(s) in the last ${period}.`);
-  return lines.join('\n');
-}
-
-function formatFleet(data, period) {
-  const agent = Number(data.agent?.total_cost_usd || 0);
-  const x402 = Number(data.x402?.total_spend_usd || 0);
-  const total = Number(data.fleet_total_usd || 0);
-  if (total === 0) {
-    return (
-      `No fleet spend recorded yet for ${period}.\n` +
-      'Agent spend lands when governed actions report tokens_in/tokens_out + model.'
-    );
-  }
-  const lines = [
-    `Fleet spend — last ${period}`,
-    '',
-    table([
-      ['Agent LLM', money(agent)],
-      ['x402 purchases', money(x402)],
-      ['Total', money(total)],
-    ]),
-    '',
-    `Summary: ${money(total)} fleet spend in the last ${period} (LLM ${money(agent)} + x402 ${money(x402)}).`,
-  ];
-  return lines.join('\n');
-}
-
-export function formatSpend(data, { lens, period }) {
-  return lens === 'claude-code' ? formatClaudeCode(data, period) : formatFleet(data, period);
-}
-
-/**
- * Validate, fetch, format. Throws a usage-tagged Error on bad flags so the
- * caller prints usage and exits non-zero without a stack trace.
- */
-export async function runCost(config, { lens = 'claude-code', period = '7d' } = {}, { fetcher = fetchSpend } = {}) {
-  const invalid = validateCostFlags({ lens, period });
-  if (invalid) {
-    const err = new Error(invalid);
-    err.usage = true;
-    throw err;
-  }
-  const data = await fetcher(config, { lens, period });
-  return formatSpend(data, { lens, period });
-}

package/lib/env.js

@@ -1,69 +0,0 @@
-// cli/lib/env.js
-//
-// `dashclaw env [--agent <id>] [-- <command...>]` — fetch the delivery-enabled
-// managed-secret bundle from GET /api/secrets/env and inject it into a child
-// process environment MEMORY-ONLY. Secret VALUES are never written to disk,
-// never printed, and never echoed in error paths — only NAMES are ever shown.
-// Fail-closed: if the bundle fetch fails, the child command is NOT run.
-
-import { spawn } from 'node:child_process';
-import { apiRequest } from './api.js';
-import { dim } from './render.js';
-
-/** GET /api/secrets/env for one agent. Returns { env, count, delivered }. */
-export async function fetchAgentEnv(config, agentId) {
-  return apiRequest(config, 'GET', '/api/secrets/env', { query: { agent_id: agentId } });
-}
-
-/**
- * Split the CLI argv at the `--` separator.
- * Tokens before `--` are flags for `dashclaw env`; tokens after are the
- * child command + its args (left untouched, including any `--print`).
- */
-export function splitEnvArgv(argv) {
-  const sep = argv.indexOf('--');
-  if (sep === -1) return { flags: argv, command: [] };
-  return { flags: argv.slice(0, sep), command: argv.slice(sep + 1) };
-}
-
-/** Names-only listing — never values. */
-export function formatEnvNames(bundle) {
-  const names = Array.isArray(bundle.delivered) ? bundle.delivered : Object.keys(bundle.env || {});
-  const lines = [];
-  if (names.length === 0) {
-    lines.push(dim('  No delivery-enabled secrets for this agent.'));
-  } else {
-    for (const name of names) lines.push(`  ${name}`);
-  }
-  lines.push('');
-  lines.push(dim(`  ${names.length} secret(s). Values are never printed — run: dashclaw env -- <command>`));
-  return lines.join('\n');
-}
-
-/**
- * Spawn the child command with the secret bundle merged into its environment.
- * Memory-only: the merged env object lives only in this process and the
- * child's process table — nothing is written anywhere. Resolves with the
- * exit code to assign to process.exitCode (never calls process.exit — a hard
- * exit can trip a libuv teardown assert on Windows).
- */
-export function runWithEnv(bundle, commandArgv) {
-  const [cmd, ...cmdArgs] = commandArgv;
-  // No shell: args pass through verbatim (shell:true concatenates them
-  // unescaped — mangles quoted args and is deprecated, DEP0190).
-  const child = spawn(cmd, cmdArgs, {
-    stdio: 'inherit',
-    env: { ...process.env, ...(bundle.env || {}) },
-  });
-  return new Promise((resolve) => {
-    child.on('error', (err) => {
-      // err.message is a spawn error (ENOENT/EINVAL etc.) — never contains values.
-      console.error(`Error: could not start "${cmd}": ${err.message}`);
-      if (process.platform === 'win32' && (err.code === 'EINVAL' || err.code === 'ENOENT')) {
-        console.error(`Hint: Windows .cmd shims (npm, npx) cannot be spawned directly — try: dashclaw env -- cmd /c ${cmd} ...`);
-      }
-      resolve(1);
-    });
-    child.on('exit', (code, signal) => resolve(signal ? 1 : code ?? 1));
-  });
-}

package/lib/posture.js

@@ -1,45 +0,0 @@
-// cli/lib/posture.js
-//
-// Direct-API helpers for the `dashclaw posture` / `dashclaw next` commands.
-// Like the other CLI command groups, these call the live endpoints via
-// apiRequest (fetch + x-api-key) rather than the published SDK, so the CLI never
-// depends on a possibly-stale `dashclaw` package for newly-added routes.
-//
-// Resolve is DRAFT-ONLY: the CLI can create an inactive policy draft, snooze, or
-// accept risk — it can NEVER activate enforcement. An operator (or agent) can
-// prepare a fix; only a human activates it at /policies. Mirrors the API + MCP
-// ceiling so agents can never self-escalate their own governance.
-
-import { apiRequest } from './api.js';
-
-/** GET /api/posture — score + dimensions + findings + summary + trend. */
-export async function fetchPosture(config) {
-  return apiRequest(config, 'GET', '/api/posture');
-}
-
-/** GET /api/posture/findings — the prioritized queue (+ optional filters). */
-export async function fetchFindings(config, { status, dimension } = {}) {
-  return apiRequest(config, 'GET', '/api/posture/findings', { query: { status, dimension } });
-}
-
-/** The single top open finding (the `next` gap), or null when the queue is clear. */
-export async function fetchNext(config) {
-  const data = await fetchFindings(config);
-  return (data && Array.isArray(data.findings) && data.findings[0]) || null;
-}
-
-const RESOLVE_ACTIONS = new Set(['create_draft', 'snooze', 'accept_risk']);
-
-/**
- * POST /api/posture/findings/<key>/resolve — DRAFT-ONLY actions.
- * `create_draft` (default) inserts an inactive policy draft; snooze/accept_risk
- * record state. None of these activate enforcement.
- */
-export async function resolveFinding(config, key, action = 'create_draft', note) {
-  if (!RESOLVE_ACTIONS.has(action)) {
-    throw new Error(`Invalid resolve action "${action}". Draft-only: ${[...RESOLVE_ACTIONS].join(', ')}.`);
-  }
-  return apiRequest(config, 'POST', `/api/posture/findings/${encodeURIComponent(key)}/resolve`, {
-    body: { action, note },
-  });
-}