@everywheredev/cli 0.0.1-5.1

package/package.json

@@ -0,0 +1,68 @@
+{
+  "name": "@everywheredev/cli",
+  "version": "0.0.1-5.1",
+  "description": "PocketDev CLI — a Claude-Code-style TypeScript thin client for the PocketDev host (FULL-REMOTE Hydra OAuth2).",
+  "type": "module",
+  "license": "UNLICENSED",
+  "bin": {
+    "pocketdev": "bin/pocketdev.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/vectorkub/pocketdev.git",
+    "directory": "cli"
+  },
+  "homepage": "https://github.com/vectorkub/pocketdev/tree/main/cli#readme",
+  "bugs": {
+    "url": "https://github.com/vectorkub/pocketdev/issues"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "bin/",
+    "dist/",
+    "scripts/",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json --noEmit && node scripts/build.mjs",
+    "build:watch": "tsc -p tsconfig.json --watch",
+    "dev": "node --import tsx ./src/index.ts",
+    "test": "vitest run --passWithNoTests",
+    "test:watch": "vitest",
+    "typecheck": "tsc -p tsconfig.json --noEmit",
+    "smoke": "node scripts/smoke.mjs",
+    "prepare": "npm run build",
+    "postinstall": "node scripts/ensure-node-pty.mjs"
+  },
+  "dependencies": {
+    "chalk": "^5.3.0",
+    "chokidar": "^4.0.3",
+    "gradient-string": "^2.0.2",
+    "ignore": "^5.3.2",
+    "ink": "^5.0.1",
+    "jose": "^5.9.6",
+    "keytar": "^7.9.0",
+    "node-pty": "^1.0.0",
+    "puppeteer-core": "^23.11.1",
+    "react": "^18.3.1",
+    "reflect-metadata": "^0.2.2",
+    "tsyringe": "^4.8.0",
+    "ws": "^8.18.0",
+    "zod": "^3.23.8"
+  },
+  "devDependencies": {
+    "@types/gradient-string": "^1.1.6",
+    "@types/node": "^20.14.0",
+    "@types/react": "^18.3.3",
+    "@types/ws": "^8.5.12",
+    "esbuild": "^0.24.0",
+    "tsx": "^4.16.0",
+    "typescript": "^5.5.0",
+    "vitest": "^2.0.0"
+  }
+}

package/scripts/build.mjs

@@ -0,0 +1,68 @@
+// Bundles the CLI into a single minified dist/index.js so the published package
+// is not trivially readable (the source repo stays private; only this bundle ships).
+//
+// Why esbuild-direct-from-src is safe: src/ uses no decorators and DI is wired with
+// manual factories (src/di/container.ts), so esbuild not emitting decorator metadata
+// is irrelevant. Type-checking is enforced separately via `tsc --noEmit` (see the
+// "build" script in package.json).
+
+import { rm } from "node:fs/promises";
+import { fileURLToPath } from "node:url";
+import { dirname, resolve } from "node:path";
+import { build } from "esbuild";
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), "..");
+
+// Clear stale per-file tsc output so only the single bundle ships.
+await rm(resolve(root, "dist"), { recursive: true, force: true });
+
+await build({
+  absWorkingDir: root,
+  entryPoints: ["src/index.ts"],
+  outfile: "dist/index.js", // keep this path: bin/pocketdev.js and scripts/smoke.mjs import ../dist/index.js
+  bundle: true,
+  minify: true,
+  platform: "node",
+  format: "esm", // package is "type":"module"; preserves import.meta.url for createRequire
+  target: "node20",
+  legalComments: "none",
+  // ESM output has no `require`/__dirname/__filename globals, but bundled CJS deps (e.g. ws calling
+  // require("events")) and node-pty's createRequire path rely on them. Define them at the top of the
+  // bundle from import.meta.url so those calls resolve against the real Node module system.
+  banner: {
+    js: [
+      "import { createRequire as __everywhere_createRequire } from 'node:module';",
+      "import { fileURLToPath as __everywhere_fileURLToPath } from 'node:url';",
+      "import { dirname as __everywhere_dirname } from 'node:path';",
+      "const require = __everywhere_createRequire(import.meta.url);",
+      "const __filename = __everywhere_fileURLToPath(import.meta.url);",
+      "const __dirname = __everywhere_dirname(__filename);",
+    ].join("\n"),
+  },
+  // Native addons + dynamic-import natives stay external (resolved from node_modules at runtime).
+  // node-pty/puppeteer-core/ignore load via createRequire (not followed by the bundler), but we
+  // list them for clarity; keytar loads via dynamic import() which esbuild WOULD bundle otherwise.
+  // These are real `dependencies` installed in the user's node_modules; keep them external so the
+  // native/dynamic loaders (createRequire / dynamic import()) resolve them at runtime.
+  external: ["node-pty", "keytar", "puppeteer-core", "ignore"],
+  plugins: [
+    // ink statically imports react-devtools-core (only used when ink's DEV devtools are enabled).
+    // It isn't a dependency, so we can't externalize it (an external ESM import resolves eagerly at
+    // load and would crash). Stub it to an empty module — the devtools code path never runs for users.
+    {
+      name: "stub-react-devtools",
+      setup(b) {
+        b.onResolve({ filter: /^react-devtools-core$/ }, () => ({
+          path: "react-devtools-core",
+          namespace: "stub-react-devtools",
+        }));
+        b.onLoad({ filter: /.*/, namespace: "stub-react-devtools" }, () => ({
+          contents: "export default {};",
+          loader: "js",
+        }));
+      },
+    },
+  ],
+});
+
+process.stdout.write("built dist/index.js\n");

package/scripts/ensure-node-pty.mjs

@@ -0,0 +1,52 @@
+// Postinstall guard for node-pty's native binaries.
+//
+// node-pty execs a bundled `spawn-helper` to allocate the PTY on macOS/Linux. npm frequently extracts it
+// WITHOUT the executable bit, which makes every PTY spawn fail with "posix_spawnp failed" → the device
+// terminal exits 1 instantly. This runs after install to (1) confirm the prebuild for this platform/arch
+// exists and (2) restore +x on the helper. It is best-effort and NEVER fails the install (exit 0 always),
+// since the runtime also self-heals (src/transport/device-terminal.ts:ensureSpawnHelperExecutable).
+
+import { chmodSync, existsSync, readdirSync } from "node:fs";
+import { createRequire } from "node:module";
+import { dirname, join } from "node:path";
+
+try {
+  const require = createRequire(import.meta.url);
+  const root = dirname(require.resolve("node-pty/package.json"));
+  const tag = `${process.platform}-${process.arch}`; // e.g. darwin-arm64, linux-x64
+
+  let fixed = 0;
+  const helpers = [
+    join(root, "build", "Release", "spawn-helper"), // built-from-source layout
+  ];
+  const prebuilds = join(root, "prebuilds");
+  if (existsSync(prebuilds)) {
+    for (const d of readdirSync(prebuilds)) {
+      helpers.push(join(prebuilds, d, "spawn-helper"));
+    }
+  }
+  for (const h of helpers) {
+    if (existsSync(h)) {
+      try {
+        chmodSync(h, 0o755);
+        fixed++;
+      } catch {
+        /* not our file / read-only fs */
+      }
+    }
+  }
+
+  // Warn (don't fail) if there's no prebuild for this platform — node-pty would need a build toolchain.
+  const ptyNode = join(prebuilds, tag, "pty.node");
+  const builtNode = join(root, "build", "Release", "pty.node");
+  if (!existsSync(ptyNode) && !existsSync(builtNode)) {
+    console.warn(
+      `[pocketdev] node-pty has no prebuilt binary for ${tag}; dashboard terminal sharing may be off. ` +
+        `Install a build toolchain (python3 + a C++ compiler) and run \`npm rebuild node-pty\`.`,
+    );
+  } else if (fixed > 0) {
+    console.log(`[pocketdev] node-pty ready (${tag}); ensured spawn-helper is executable.`);
+  }
+} catch {
+  // node-pty not installed yet / layout differs — the runtime self-heal covers it.
+}

package/scripts/smoke.mjs

@@ -0,0 +1,52 @@
+// Cross-OS smoke test for the published CLI shape.
+//
+// The CLI has no offline `--help`/`--version` — every invocation routes to the `session` command,
+// which needs auth + a running host. So we can't prove "this OS is supported" by running the binary.
+// Instead we directly load the two NATIVE addons (the real per-OS/arch risk) and the compiled entry:
+//   - require("node-pty") / require("keytar") loads the native binary for this platform/arch. `require`
+//     does NOT touch the OS secret service or spawn a PTY, so it is safe headless/CI.
+//   - import("../dist/index.js") proves the built JS + its full dependency graph resolve here.
+//
+// Ships in `files` (scripts/), so it runs identically from a source checkout and from an installed
+// tarball: `node scripts/smoke.mjs` (cwd = package root) or
+// `node node_modules/@pocketdev/cli/scripts/smoke.mjs` (from a consumer install).
+
+import { createRequire } from "node:module";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { dirname, join } from "node:path";
+
+const require = createRequire(import.meta.url);
+const here = dirname(fileURLToPath(import.meta.url));
+
+let failed = false;
+const ok = (m) => console.log(`ok: ${m}`);
+const fail = (m, e) => {
+  failed = true;
+  console.error(`FAIL: ${m}: ${e?.stack ?? e}`);
+};
+
+console.log(`[smoke] ${process.platform}-${process.arch} node ${process.version}`);
+
+for (const mod of ["node-pty", "keytar"]) {
+  try {
+    require(mod);
+    ok(`native addon "${mod}" loaded`);
+  } catch (e) {
+    fail(`native addon "${mod}"`, e);
+  }
+}
+
+try {
+  // scripts/ -> ../dist/index.js  (pathToFileURL handles Windows drive paths correctly)
+  await import(pathToFileURL(join(here, "..", "dist", "index.js")).href);
+  ok("dist/index.js loaded");
+} catch (e) {
+  fail("dist/index.js", e);
+}
+
+if (failed) {
+  console.error("[smoke] FAILED");
+  process.exitCode = 1;
+} else {
+  console.log("[smoke] OK — all native addons + compiled entry load on this platform");
+}