@fusionkit/cli 0.1.4 → 0.1.5

package/dist/commands/lifecycle.js

@@ -1,124 +0,0 @@
-import { readFileSync, writeFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { verifyReceiptBundle } from "@fusionkit/protocol";
-import { pullRun } from "@fusionkit/workspace";
-import { loadHome } from "../config.js";
-import { renderReceipt, renderRunList } from "../render.js";
-import { clientFor, resolveDir, waitForTerminal } from "../shared/plane.js";
-export function registerLifecycle(program) {
-    const dirOf = () => resolveDir(program.opts().dir);
-    program
-        .command("runs")
-        .description("list runs")
-        .action(async () => {
-        const { runs } = await clientFor(dirOf()).listRuns();
-        console.log(renderRunList(runs));
-    });
-    program
-        .command("approve <runId>")
-        .description("grant required consent")
-        .action(async (runId) => {
-        const dir = dirOf();
-        const home = loadHome(dir);
-        const result = await clientFor(dir).approve(runId, {
-            kind: "human",
-            id: home.config.requestedBy
-        });
-        console.log(`run ${result.runId} [${result.status}]`);
-    });
-    program
-        .command("cancel <runId>")
-        .description("cancel an unclaimed run")
-        .action(async (runId) => {
-        const dir = dirOf();
-        const home = loadHome(dir);
-        const result = await clientFor(dir).cancel(runId, {
-            kind: "human",
-            id: home.config.requestedBy
-        });
-        console.log(`run ${result.runId} [${result.status}]`);
-    });
-    program
-        .command("watch <runId>")
-        .description("stream run status")
-        .action(async (runId) => {
-        const status = await waitForTerminal(clientFor(dirOf()), runId, (s) => console.log(s));
-        console.log(`final: ${status}`);
-    });
-    program
-        .command("receipt <runId>")
-        .description("one screen, five questions")
-        .action(async (runId) => {
-        console.log(renderReceipt(await clientFor(dirOf()).getBundle(runId)));
-    });
-    program
-        .command("bundle <runId>")
-        .description("save offline-verifiable bundle")
-        .option("--out <file>", "output path")
-        .action(async (runId, opts) => {
-        const bundle = await clientFor(dirOf()).getBundle(runId);
-        const out = opts.out ?? `${runId}.bundle.json`;
-        writeFileSync(out, JSON.stringify(bundle, null, 2));
-        console.log(`bundle written to ${out}`);
-    });
-    program
-        .command("verify <file>")
-        .description("verify a bundle offline")
-        .action((file) => {
-        const bundle = JSON.parse(readFileSync(file, "utf8"));
-        const result = verifyReceiptBundle(bundle);
-        if (result.ok) {
-            console.log("VERIFIED: signatures, event chain, and linkage all check out");
-            return;
-        }
-        console.error("VERIFICATION FAILED:");
-        for (const problem of result.problems)
-            console.error(`  - ${problem}`);
-        process.exit(1);
-    });
-    program
-        .command("pull <runId>")
-        .description("divergence-safe pull of results")
-        .option("--repo <dir>", "workspace repository", ".")
-        .action(async (runId, opts) => {
-        const client = clientFor(dirOf());
-        const bundle = await client.getBundle(runId);
-        const diffHash = bundle.receipt.workspaceOut.diffHash;
-        if (!diffHash) {
-            console.log("run produced no workspace changes; nothing to pull");
-            return;
-        }
-        const diff = await client.getBlob(diffHash);
-        const result = pullRun(resolve(opts.repo), runId, bundle.contract.workspace.baseRef, diff);
-        switch (result.mode) {
-            case "applied":
-                console.log("applied run output to the working tree (clean fast path)");
-                break;
-            case "branch":
-                console.log(`local workspace diverged from the contract base; results are on branch ${result.branch}`);
-                break;
-            case "empty":
-                console.log("run produced no workspace changes; nothing to pull");
-                break;
-            default: {
-                const exhausted = result;
-                throw new Error(`unreachable: ${String(exhausted)}`);
-            }
-        }
-    });
-    program
-        .command("export")
-        .description("audit JSONL export")
-        .option("--since <iso>", "only export events at or after this timestamp")
-        .action(async (opts) => {
-        process.stdout.write(await clientFor(dirOf()).exportJsonl(opts.since));
-    });
-    program
-        .command("ui")
-        .description("control panel URL and login token")
-        .action(() => {
-        const home = loadHome(dirOf());
-        console.log(`control panel: ${home.config.planeUrl}/ui/`);
-        console.log(`login token:   ${home.config.adminToken}`);
-    });
-}

package/dist/commands/plane.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from "commander";
-export declare function registerPlane(program: Command): void;

package/dist/commands/plane.js

@@ -1,38 +0,0 @@
-import { join } from "node:path";
-import { Plane, startPlaneServer } from "@fusionkit/plane";
-import { loadHome, secretStoreFor } from "../config.js";
-import { resolveDir } from "../shared/plane.js";
-import { createPortlessSession } from "../shared/portless.js";
-export function registerPlane(program) {
-    const plane = program.command("plane").description("control plane + control panel");
-    plane
-        .command("start")
-        .description("start the control plane + control panel")
-        .option("--port <n>", "bind port")
-        .option("--host <host>", "bind host")
-        .action(async (opts) => {
-        const dir = resolveDir(program.opts().dir);
-        const home = loadHome(dir);
-        const planeInstance = new Plane({
-            dataDir: join(dir, "data"),
-            policy: home.policy,
-            planePrivateKeyPem: home.planePrivateKeyPem,
-            planePublicKeyPem: home.planePublicKeyPem,
-            adminToken: home.config.adminToken,
-            enrollToken: home.config.enrollToken,
-            secretStore: secretStoreFor(home)
-        });
-        const port = opts.port ? Number(opts.port) : home.config.port;
-        const host = opts.host ?? home.config.host;
-        const started = await startPlaneServer(planeInstance, { port, host });
-        // Register a stable portless name for the control panel (enabled unless
-        // PORTLESS=0 or no proxy is detected; falls back to the loopback URL).
-        const portless = await createPortlessSession({
-            enabled: process.env.PORTLESS !== "0",
-            log: (line) => console.error(line)
-        });
-        const baseUrl = portless.register("plane", started.port);
-        console.log(`warrant plane listening on ${baseUrl}`);
-        console.log(`control panel: ${baseUrl}/ui/`);
-    });
-}

package/dist/commands/run.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from "commander";
-export declare function registerRun(program: Command): void;

package/dist/commands/run.js

@@ -1,149 +0,0 @@
-import { readFileSync } from "node:fs";
-import { resolve } from "node:path";
-import { agents, handoff, targets } from "@fusionkit/handoff";
-import { AGENT_KINDS } from "@fusionkit/protocol";
-import { captureWorkspace } from "@fusionkit/workspace";
-import { loadHome } from "../config.js";
-import { renderDisclosure, renderReceipt, renderTrace } from "../render.js";
-import { fail } from "../shared/errors.js";
-import { collect, isolationFlag } from "../shared/options.js";
-import { CONTINUE_WAIT_TIMEOUT_MS, clientFor, resolveDir, waitForTerminal } from "../shared/plane.js";
-function agentSpecFor(kind) {
-    switch (kind) {
-        case "claude-code":
-            return agents.claudeCode();
-        case "codex":
-            return agents.codex();
-        case "pi":
-            return agents.pi();
-        case "mock":
-            return agents.mock();
-        case "command":
-            return agents.command();
-        default:
-            fail(`unknown agent kind "${kind}" (expected ${AGENT_KINDS.join(" | ")})`);
-    }
-}
-function addRunOptions(cmd) {
-    return cmd
-        .option("--agent <kind>", `agent kind (${AGENT_KINDS.join(" | ")})`)
-        .option("--pool <pool>", "runner pool", "default")
-        .option("--secret <name>", "release a secret into the session (repeatable)", collect)
-        .option("--allow-host <host>", "allow egress to host (repeatable)", collect)
-        .option("--allow-untracked <glob>", "include untracked files matching glob (repeatable)", collect)
-        .option("--repo <dir>", "workspace repository", ".")
-        .option("--isolation <tier>", "session isolation: process | hermetic | vercel-sandbox")
-        .option("--dry-run", "show what would move; move nothing")
-        .option("--no-watch", "do not wait for completion");
-}
-export function registerRun(program) {
-    addRunOptions(program
-        .command("run")
-        .description("request a governed run")
-        .argument("[task...]", "task prompt")).action(async (task, opts) => {
-        const dir = resolveDir(program.opts().dir);
-        if (!opts.agent)
-            fail(`--agent is required (${AGENT_KINDS.join(" | ")})`);
-        const prompt = task.join(" ").trim();
-        if (!prompt)
-            fail("a task prompt is required");
-        const home = loadHome(dir);
-        const client = clientFor(dir);
-        const repoDir = resolve(opts.repo);
-        const captured = captureWorkspace(repoDir, {
-            allowUntracked: opts.allowUntracked ?? []
-        });
-        const isolation = isolationFlag(opts.isolation);
-        const request = {
-            requestedBy: { kind: "human", id: home.config.requestedBy },
-            agentKind: opts.agent,
-            prompt,
-            pool: opts.pool,
-            secretNames: opts.secret ?? [],
-            workspace: captured.manifest,
-            network: {
-                defaultDeny: home.policy.network.defaultDeny,
-                allowHosts: opts.allowHost ?? []
-            },
-            budget: {},
-            disclosure: "minimal-context",
-            ...(isolation ? { isolation } : {})
-        };
-        if (opts.dryRun) {
-            const report = await client.dryRun(request);
-            console.log(renderDisclosure(report));
-            return;
-        }
-        await client.putBlob(captured.bundle);
-        if (captured.dirtyDiff)
-            await client.putBlob(captured.dirtyDiff);
-        for (const file of captured.untracked)
-            await client.putBlob(file.content);
-        const created = await client.requestRun(request);
-        console.log(`run ${created.runId} [${created.status}]`);
-        if (!opts.watch)
-            return;
-        const status = await waitForTerminal(client, created.runId, (s) => console.log(`  ${s}`));
-        if (status === "completed" || status === "failed") {
-            const bundle = await client.getBundle(created.runId);
-            console.log("");
-            console.log(renderReceipt(bundle));
-        }
-    });
-    addRunOptions(program
-        .command("continue")
-        .description("hand local work to a governed runner")
-        .argument("[task...]", "task prompt"))
-        .option("--transcript <file>", "carry a session transcript as semantic state")
-        .option("--reason <text>", "why the runtime boundary changes")
-        .action(async (task, opts) => {
-        const dir = resolveDir(program.opts().dir);
-        if (!opts.agent)
-            fail(`--agent is required (${AGENT_KINDS.join(" | ")})`);
-        const prompt = task.join(" ").trim();
-        if (!prompt)
-            fail("a task prompt is required");
-        const home = loadHome(dir);
-        const repoDir = resolve(opts.repo);
-        const target = targets.pool(opts.pool);
-        const transcript = opts.transcript ? readFileSync(opts.transcript, "utf8") : undefined;
-        const h = handoff({
-            workspace: repoDir,
-            plane: { url: home.config.planeUrl, adminToken: home.config.adminToken },
-            actor: { kind: "human", id: home.config.requestedBy },
-            agent: agentSpecFor(opts.agent),
-            secrets: opts.secret ?? [],
-            allowHosts: opts.allowHost ?? [],
-            allowUntracked: opts.allowUntracked ?? []
-        });
-        const isolation = isolationFlag(opts.isolation);
-        const continueOptions = {
-            task: prompt,
-            ...(opts.reason ? { reason: opts.reason } : {}),
-            ...(transcript !== undefined ? { transcript } : {}),
-            ...(isolation ? { session: isolation } : {})
-        };
-        if (opts.dryRun) {
-            const { report } = await h.dryRun(target, continueOptions);
-            console.log(renderDisclosure(report));
-            return;
-        }
-        const run = await h.continueIn(target, continueOptions);
-        console.log(`continuation ${run.envelope.envelopeId} → ${target.id} as run ${run.runId}`);
-        if (!opts.watch)
-            return;
-        const outcome = await run.wait({ timeoutMs: CONTINUE_WAIT_TIMEOUT_MS });
-        if (outcome.status === "awaiting_approval") {
-            console.log(`awaiting approval (${outcome.consentRequirements.join("; ")}) — run: warrant approve ${run.runId}`);
-            return;
-        }
-        console.log("");
-        console.log(renderTrace(h.trace()));
-        if (outcome.status === "completed" || outcome.status === "failed") {
-            console.log("");
-            console.log(renderReceipt(await run.receipt()));
-            console.log("");
-            console.log(`pull results: warrant pull ${run.runId}`);
-        }
-    });
-}

package/dist/commands/runner.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from "commander";
-export declare function registerRunner(program: Command): void;

package/dist/commands/runner.js

@@ -1,33 +0,0 @@
-import { resolve } from "node:path";
-import { Runner } from "@fusionkit/runner";
-import { loadHome } from "../config.js";
-import { resolveDir } from "../shared/plane.js";
-export function registerRunner(program) {
-    const runner = program.command("runner").description("outbound-only execution runner");
-    runner
-        .command("start")
-        .description("start an outbound-only runner")
-        .option("--pool <pool>", "runner pool", "default")
-        .option("--plane <url>", "plane URL")
-        .option("--enroll-token <token>", "enrollment token")
-        .option("--data-dir <dir>", "runner data directory")
-        .action(async (opts) => {
-        const dir = resolveDir(program.opts().dir);
-        let planeUrl = opts.plane;
-        let enrollToken = opts.enrollToken;
-        if (!planeUrl || !enrollToken) {
-            const home = loadHome(dir);
-            planeUrl = planeUrl ?? home.config.planeUrl;
-            enrollToken = enrollToken ?? home.config.enrollToken;
-        }
-        const instance = new Runner({
-            planeUrl,
-            pool: opts.pool,
-            dataDir: resolve(opts.dataDir ?? ".warrant-runner"),
-            enrollToken
-        });
-        const identity = await instance.ensureEnrolled();
-        console.log(`runner ${identity.runnerId} polling pool "${identity.pool}" (outbound-only)`);
-        await instance.start();
-    });
-}

package/dist/commands/secrets.d.ts

@@ -1,2 +0,0 @@
-import type { Command } from "commander";
-export declare function registerSecrets(program: Command): void;

package/dist/commands/secrets.js

@@ -1,21 +0,0 @@
-import { loadHome, secretStoreFor } from "../config.js";
-import { resolveDir } from "../shared/plane.js";
-export function registerSecrets(program) {
-    const secrets = program.command("secrets").description("org secret store");
-    secrets
-        .command("set <name> <value>")
-        .description("store a secret in the org store")
-        .action((name, value) => {
-        const home = loadHome(resolveDir(program.opts().dir));
-        secretStoreFor(home).set(name, value);
-        console.log(`secret "${name}" stored (value encrypted at rest)`);
-    });
-    secrets
-        .command("list")
-        .description("list stored secret names")
-        .action(() => {
-        const home = loadHome(resolveDir(program.opts().dir));
-        const names = secretStoreFor(home).names();
-        console.log(names.length > 0 ? names.join("\n") : "no secrets stored");
-    });
-}