@lasso-ai/cli 1.0.0

package/SECURITY.md

@@ -0,0 +1,65 @@
+# Security Policy
+
+Lasso runs locally on your machine and, by design, keeps your code on your machine: no
+telemetry, and your source files are only sent to whichever coding agent you configured.
+That trust model is the core of this project, and we treat anything that breaks it as a
+security bug.
+
+## Supported versions
+
+| Version | Supported          |
+| ------- | ------------------ |
+| 0.1.x   | :white_check_mark: |
+
+Older versions are not supported. If you are unable to upgrade, please still report the
+issue so we can decide whether a backport is warranted.
+
+## Reporting a vulnerability
+
+**Please do not open a public issue for security vulnerabilities.** Report them privately
+to the maintainers so we can fix the issue before it is disclosed.
+
+- [GitHub private vulnerability reporting](https://github.com/codewithdripzy/lasso/security/advisories/new)
+  (preferred).
+- Email the maintainer via the contact on [buymeacoffee.com/thecodeguyy](https://www.buymeacoffee.com/thecodeguyy)
+  if you cannot use GitHub.
+
+Please include:
+
+1. A description of the vulnerability and its impact (be specific about what an attacker
+   could and could not do).
+2. Steps to reproduce, or a minimal PoC. Prefer a dropped text file / script over a
+   screenshot.
+3. Affected versions and platform (OS, Node version, framework + version).
+4. Any suggested fix, if you have one.
+
+The report does **not** need to include your source code — and usually should not. If a
+bug requires an app to trigger it, provide the smallest synthetic repro you can.
+
+## What we care about most
+
+Things that break the local-first trust model:
+
+- Any path where a user's **source code or screenshots leak** beyond the configured agent.
+- Telemetry being **enabled without explicit consent**.
+- The overlay mutating the **live DOM** (a behavioral regression, but can become a security
+  issue via injected content from untrusted pages).
+- Arbitrary code execution through a malicious config / project — e.g. `lasso.config.json`,
+  a compromised agent adapter, or path traversal when resolving `data-source` attributes.
+- Diff application that writes outside the intended project directory.
+
+## Handling process
+
+1. You report privately; we acknowledge within **72 hours**.
+2. We reproduce, assess severity, and work on a fix on a private branch.
+3. We release a patched version, then coordinate disclosure with you (typical window:
+   7–14 days after the release).
+
+## Good-faith note
+
+For the code above that does not deal with other people's data, we are happy for you to do
+research against your own projects and report what you find. Please do not attack
+third-party apps running Lasso, and please do not test by attempting to exfiltrate others'
+source files.
+
+Thanks for helping keep a local-first tool local-first.

package/SUPPORT.md

@@ -0,0 +1,31 @@
+# Support
+
+Lasso is an open-source project maintained by volunteers. We're happy to help — here's the
+best place for each kind of question.
+
+## Bugs and feature requests
+
+- **Report a bug**: open a [GitHub issue](https://github.com/codewithdripzy/lasso/issues) with
+  the framework you're using, your Node version, and a minimal repro.
+- **Request a feature**: open an issue and label it `enhancement`. Existing roadmap items
+  and open design questions live at the bottom of [ARCHITECTURE.md](ARCHITECTURE.md).
+- **Security vulnerability**: do **not** open an issue — use the private contact in
+  [SECURITY.md](SECURITY.md).
+
+## Real-time help
+
+- [GitHub Discussions](https://github.com/codewithdripzy/lasso/discussions) for general
+  questions, "how do I…" help, and show-and-tell.
+- Product docs and guides: [lasso.byorello.space](https://lasso.byorello.space).
+
+## Getting help faster
+
+- Read [README.md](README.md) and [ARCHITECTURE.md](ARCHITECTURE.md) first; most
+  "why does it do that?" questions are answered there.
+- Search existing issues before opening a new one.
+- Include versions: `node --version`, the framework version, and Lasso (`npx lasso --version`).
+
+## No private support
+
+Please keep questions public so others can benefit from the answers. We don't provide
+private 1:1 support for the open-source version.

package/dist/cli/agent.d.ts

@@ -0,0 +1,61 @@
+export type SourceChange = {
+    filePath: string;
+    oldString: string;
+    newString: string;
+};
+type AgentInput = {
+    instruction: string;
+    model: string;
+    messages?: Array<{
+        role: string;
+        content: string;
+        createdAt?: string;
+    }>;
+    changesHistory?: Array<{
+        summary: string;
+        changes: SourceChange[];
+        createdAt?: string;
+    }>;
+    context?: {
+        selectionId?: string;
+        position?: Record<string, number>;
+        viewport?: Record<string, unknown>;
+        styles?: Record<string, string>;
+        attributes?: Record<string, string>;
+        runtimeErrors?: string[];
+        screenshots?: {
+            full?: string;
+            element?: string;
+        };
+        drag?: Record<string, any>;
+    };
+    element: {
+        tag: string;
+        group: string;
+        label: string;
+        html?: string;
+        sourceHint?: string;
+    };
+};
+export type AgentConfig = {
+    provider: "anthropic" | "openai" | "google" | "ollama" | "claude-code" | "codex" | "opencode";
+    apiKey?: string;
+    model?: string;
+    baseUrl?: string;
+};
+export type LocalAgent = "claude-code" | "codex" | "opencode";
+export type AgentProgress = (message: string) => void;
+export type AgentAnswer = {
+    question: string;
+    context?: AgentInput["context"];
+    element: AgentInput["element"];
+    messages?: AgentInput["messages"];
+};
+export declare function detectLocalAgents(): Promise<Set<LocalAgent>>;
+export declare function proposeChanges(cwd: string, input: AgentInput, config: AgentConfig, signal?: AbortSignal, onProgress?: AgentProgress): Promise<{
+    summary: string;
+    changes: SourceChange[];
+}>;
+export declare function answerQuestion(cwd: string, input: AgentAnswer, config: AgentConfig, signal?: AbortSignal, onProgress?: AgentProgress): Promise<string>;
+export declare function generateCommitMessage(cwd: string, status: string[], config: AgentConfig, signal?: AbortSignal, onProgress?: AgentProgress): Promise<string>;
+export {};

package/dist/cli/agent.js

@@ -0,0 +1,418 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectLocalAgents = detectLocalAgents;
+exports.proposeChanges = proposeChanges;
+exports.answerQuestion = answerQuestion;
+exports.generateCommitMessage = generateCommitMessage;
+const promises_1 = __importDefault(require("node:fs/promises"));
+const node_path_1 = __importDefault(require("node:path"));
+const node_child_process_1 = require("node:child_process");
+const node_util_1 = require("node:util");
+const execFileAsync = (0, node_util_1.promisify)(node_child_process_1.execFile);
+async function detectLocalAgents() {
+    const found = new Set();
+    for (const [name, command] of [["claude-code", "claude"], ["codex", "codex"], ["opencode", "opencode"]]) {
+        try {
+            await execFileAsync(process.platform === "win32" ? "where.exe" : "which", [command]);
+            found.add(name);
+        }
+        catch {
+            // Local coding CLIs are optional.
+        }
+    }
+    return found;
+}
+const ignored = new Set(["node_modules", ".git", ".next", "dist", "build", ".turbo"]);
+const sourceExtensions = /\.(tsx?|jsx?|vue|svelte|css|scss|html)$/i;
+async function sourceFiles(directory) {
+    const entries = await promises_1.default.readdir(directory, { withFileTypes: true });
+    const files = [];
+    for (const entry of entries) {
+        if (ignored.has(entry.name) || entry.name.startsWith("."))
+            continue;
+        const fullPath = node_path_1.default.join(directory, entry.name);
+        if (entry.isDirectory())
+            files.push(...(await sourceFiles(fullPath)));
+        else if (sourceExtensions.test(entry.name))
+            files.push(fullPath);
+        if (files.length >= 80)
+            break;
+    }
+    return files;
+}
+async function contextFor(cwd, element) {
+    const files = await sourceFiles(cwd);
+    const needle = element.sourceHint || element.label.replace(/^[^.#]+[.#]?/, "");
+    const sourceFile = element.sourceHint ? node_path_1.default.basename(element.sourceHint.split(":")[0]) : "";
+    const snippets = [];
+    for (const file of files) {
+        if (snippets.length >= 8)
+            break;
+        try {
+            const content = await promises_1.default.readFile(file, "utf8");
+            if (!needle || (sourceFile && file.endsWith(sourceFile)) || content.includes(needle) || content.includes(element.label)) {
+                snippets.push(`FILE: ${node_path_1.default.relative(cwd, file)}\n${content.slice(0, 12000)}`);
+            }
+        }
+        catch {
+            // A file can disappear while a dev server is rebuilding; skip it.
+        }
+    }
+    return snippets.join("\n\n---\n\n");
+}
+function jsonFrom(text) {
+    const fenced = text.match(/```(?:json)?\s*([\s\S]*?)```/i)?.[1] || text;
+    const parsed = JSON.parse(fenced.trim());
+    if (!Array.isArray(parsed.changes))
+        throw new Error("The agent returned no reviewable changes.");
+    for (const change of parsed.changes) {
+        if (!change.filePath || typeof change.oldString !== "string" || typeof change.newString !== "string") {
+            throw new Error("The agent returned an invalid file change.");
+        }
+    }
+    return { summary: parsed.summary || "The proposed source changes are ready for review.", changes: parsed.changes };
+}
+function extractLocalAgentText(raw, provider) {
+    if (provider === "claude-code") {
+        try {
+            const payload = JSON.parse(raw);
+            if (payload.result)
+                return payload.result;
+        }
+        catch {
+            // Stream-json output is handled below.
+        }
+        const results = [];
+        for (const line of raw.split(/\r?\n/)) {
+            try {
+                const event = JSON.parse(line);
+                if (typeof event.result === "string")
+                    results.push(event.result);
+                const message = event.message;
+                for (const part of message?.content || [])
+                    if (part.type === "text" && part.text)
+                        results.push(part.text);
+            }
+            catch {
+                // Ignore progress lines that are not JSON.
+            }
+        }
+        return results.at(-1) || raw;
+    }
+    const texts = [];
+    for (const line of raw.split(/\r?\n/)) {
+        try {
+            const event = JSON.parse(line);
+            const item = event.item;
+            const part = event.part;
+            const candidates = provider === "opencode"
+                ? [part?.type === "text" ? part.text : undefined, event.text, event.output_text]
+                : [event.text, event.output_text, item?.text, item?.output_text, item?.message];
+            for (const candidate of candidates) {
+                if (typeof candidate === "string" && candidate.trim())
+                    texts.push(candidate);
+            }
+        }
+        catch {
+            // Ignore non-JSON progress lines.
+        }
+    }
+    return texts.at(-1) || raw;
+}
+/** Truncate a detail string to a readable length. */
+function snippet(value, max = 80) {
+    const s = String(value ?? "").trim().replace(/\s+/g, " ");
+    return s.length > max ? `${s.slice(0, max)}…` : s;
+}
+function progressFromLine(raw, provider) {
+    try {
+        const event = JSON.parse(raw);
+        const item = event.item;
+        if (provider === "claude-code") {
+            if (event.type === "system")
+                return "Claude Code connected";
+            // tool_use blocks inside assistant messages
+            const toolBlock = event.message?.content?.find?.((p) => p.type === "tool_use");
+            if (toolBlock) {
+                const toolName = toolBlock.name || "tool";
+                const inp = toolBlock.input;
+                const detail = inp?.file_path ?? inp?.path ?? inp?.command ?? inp?.query ?? inp?.url ?? "";
+                return detail
+                    ? `Claude Code · ${toolName}  ${snippet(detail)}`
+                    : `Claude Code · ${toolName}`;
+            }
+            // thinking blocks inside assistant messages
+            const thinkBlock = event.message?.content?.find?.((p) => p.type === "thinking");
+            if (thinkBlock?.thinking) {
+                return `Claude Code · ${snippet(thinkBlock.thinking, 100)}`;
+            }
+            // top-level tool event fields (stream-json verbose format)
+            const tool = event.tool_name || event.name || event.tool?.name;
+            if (tool) {
+                const inp = event.tool_input;
+                const detail = inp?.file_path ?? inp?.path ?? inp?.command ?? inp?.query ?? inp?.url ?? "";
+                return detail
+                    ? `Claude Code · ${tool}  ${snippet(detail)}`
+                    : `Claude Code · ${tool}`;
+            }
+            if (event.type === "result" || event.result)
+                return "Claude Code · preparing the proposal";
+            if (event.type === "assistant")
+                return "Claude Code · reasoning about the change";
+        }
+        else if (provider === "codex") {
+            const type = item?.type || event.type || "";
+            if (type === "command_execution" || type === "command_execution_output") {
+                const cmd = item?.command || event.command || "";
+                return cmd ? `Codex · Bash  ${snippet(cmd)}` : "Codex · running a command";
+            }
+            if (type === "file_read" || type === "read_file") {
+                const fp = item?.path || event.path || "";
+                return fp ? `Codex · Read  ${snippet(fp)}` : "Codex · reading a file";
+            }
+            if (type === "agent_message" || type === "message")
+                return "Codex · drafting the proposal";
+            if (type === "reasoning") {
+                const text = item?.content || event.content || "";
+                return text ? `Codex · ${snippet(text, 100)}` : "Codex · reasoning";
+            }
+            if (type === "turn.started" || type === "turn_start")
+                return "Codex · starting a turn";
+            if (type === "turn.completed" || type === "turn_complete")
+                return "Codex · preparing the proposal";
+        }
+        else if (provider === "opencode") {
+            const part = event.part;
+            if (event.type === "step-start")
+                return "OpenCode · starting a step";
+            if (part?.type === "tool") {
+                const toolName = part.tool || "tool";
+                const inp = part.input;
+                const detail = inp?.file_path ?? inp?.path ?? inp?.command ?? inp?.query ?? inp?.url ?? "";
+                return detail
+                    ? `OpenCode · ${toolName}  ${snippet(detail)}`
+                    : `OpenCode · ${toolName}`;
+            }
+            if (part?.type === "text") {
+                const text = part.text || "";
+                return text ? `OpenCode · ${snippet(text, 100)}` : "OpenCode · drafting the response";
+            }
+            if (event.type === "step-finish")
+                return "OpenCode · finalizing the response";
+        }
+    }
+    catch {
+        // Progress output is best-effort; the final parser reports malformed output.
+    }
+    return null;
+}
+function localAgentError(command, stderr, exitCode) {
+    const output = stderr.trim();
+    if (command === "codex" && output.includes("missing field `base_instructions`")) {
+        return "Codex could not read its models cache because it uses an older cache format. Update Codex, then retry. Lasso already bypasses the repository trust check.";
+    }
+    if (command === "codex" && output.includes("mcp.canva.com") && output.includes("invalid_token")) {
+        return "Codex started, but the Canva MCP connection has an expired OAuth token. Re-authenticate or remove the Canva MCP server from Codex, then retry.";
+    }
+    return `${command} exited with code ${exitCode}${output ? `: ${output.slice(0, 500)}` : ""}`;
+}
+function localModel(provider, model) {
+    if (!model)
+        return undefined;
+    const prefix = `${provider}:`;
+    return model.startsWith(prefix) ? model.slice(prefix.length) : model;
+}
+function localCommand(provider, model, prompt) {
+    const selectedModel = localModel(provider, model);
+    if (provider === "claude-code") {
+        return { command: "claude", args: ["-p", prompt || "", "--output-format", "stream-json", "--verbose", "--permission-mode", "plan", "--max-turns", "3", ...(selectedModel ? ["--model", selectedModel] : [])] };
+    }
+    if (provider === "opencode") {
+        return { command: "opencode", args: ["run", "--format", "json", ...(selectedModel ? ["--model", selectedModel] : []), prompt || ""] };
+    }
+    return { command: "codex", args: ["exec", "--json", "--sandbox", "read-only", "--skip-git-repo-check", ...(selectedModel ? ["--model", selectedModel] : []), prompt || ""] };
+}
+async function proposeWithLocalAgent(cwd, instruction, context, config, signal, onProgress) {
+    const outputContract = `Return ONLY valid JSON in this exact shape: {"summary":"short explanation","changes":[{"filePath":"relative/path","oldString":"exact existing text","newString":"replacement text"}]}. Every oldString must occur exactly once. Do not edit files, run write commands, commit, or produce markdown fences.`;
+    const prompt = `${instruction}\n\n${outputContract}\n\nLasso has already assembled this source context:\n${context || "No matching source context was found."}`;
+    const local = localCommand(config.provider, config.model, prompt);
+    const command = local.command;
+    const args = local.args;
+    const child = (0, node_child_process_1.spawn)(command, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+    let stdout = "";
+    let stderr = "";
+    let pending = "";
+    const consume = (chunk) => {
+        pending += String(chunk);
+        const lines = pending.split(/\r?\n/);
+        pending = lines.pop() || "";
+        for (const line of lines) {
+            stdout += `${line}\n`;
+            const progress = progressFromLine(line, config.provider);
+            if (progress)
+                onProgress?.(progress);
+        }
+    };
+    child.stdout.on("data", consume);
+    child.stderr.on("data", (chunk) => {
+        stderr += String(chunk);
+    });
+    if (signal) {
+        if (signal.aborted)
+            child.kill("SIGTERM");
+        signal.addEventListener("abort", () => child.kill("SIGTERM"), { once: true });
+    }
+    const exitCode = await new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (code) => resolve(code ?? 1));
+    });
+    if (pending.trim()) {
+        stdout += pending;
+        const progress = progressFromLine(pending, config.provider);
+        if (progress)
+            onProgress?.(progress);
+    }
+    if (exitCode !== 0)
+        throw new Error(localAgentError(command, stderr, exitCode));
+    return jsonFrom(extractLocalAgentText(stdout, config.provider));
+}
+async function proposeChanges(cwd, input, config, signal, onProgress) {
+    const context = await contextFor(cwd, input.element);
+    const visualContext = input.context ? { ...input.context, screenshots: undefined } : undefined;
+    const history = input.messages?.map((message) => `${message.role}: ${message.content}`).join("\n") || input.instruction;
+    const priorChanges = input.changesHistory?.length ? JSON.stringify(input.changesHistory, null, 2) : "None";
+    const dragHint = input.context?.drag
+        ? `\n\nDRAG REPOSITIONING TASK:\nThe user dragged this element by dx: ${input.context.drag.delta?.dx ?? 0}px, dy: ${input.context.drag.delta?.dy ?? 0}px to target coordinates (left: ${input.context.drag.targetRect?.left ?? 0}px, top: ${input.context.drag.targetRect?.top ?? 0}px). Modify the source code (CSS classes, Tailwind classes, flex/grid alignment, margin offsets, or positioning properties) so the element is accurately rendered at this target position.`
+        : "";
+    const instruction = `Selection context:\n${JSON.stringify(input.element, null, 2)}\n${JSON.stringify(visualContext, null, 2)}\n\nConversation history:\n${history}\n\nPrevious change history for this selection:\n${priorChanges}\n\nRelevant source context:\n${context || "No matching source context was found. Ask for a more specific selection rather than inventing a file."}${dragHint}\n\nReturn ONLY JSON: {"summary":"short explanation","changes":[{"filePath":"relative/path","oldString":"exact text","newString":"replacement text"}]}`;
+    if (config.provider === "claude-code" || config.provider === "codex" || config.provider === "opencode") {
+        return proposeWithLocalAgent(cwd, instruction, context, config, signal, onProgress);
+    }
+    const system = "You are Lasso, a careful source-code editing agent. Return only valid JSON. Each oldString must occur exactly once in its file. Never rewrite whole files. Keep changes focused on the request.";
+    const model = config.model || (config.provider === "google" ? "gemini-2.5-flash" : config.provider === "openai" ? "gpt-4.1-mini" : config.provider === "ollama" ? "llama3.2" : "claude-sonnet-4-20250514");
+    const image = input.context?.screenshots?.element || input.context?.screenshots?.full;
+    const imageData = image?.replace(/^data:image\/[^;]+;base64,/, "");
+    const imageMime = image?.match(/^data:(image\/[^;]+);base64,/)?.[1] || "image/jpeg";
+    let response;
+    if (config.provider === "openai" || config.provider === "ollama") {
+        const content = image ? [{ type: "text", text: instruction }, { type: "image_url", image_url: { url: image } }] : instruction;
+        response = await fetch(`${config.baseUrl || "https://api.openai.com/v1"}/chat/completions`, {
+            method: "POST",
+            signal,
+            headers: { "content-type": "application/json", authorization: `Bearer ${config.apiKey || ""}` },
+            body: JSON.stringify({ model, temperature: 0.1, messages: [{ role: "system", content: system }, { role: "user", content }] }),
+        });
+    }
+    else if (config.provider === "google") {
+        const parts = [{ text: instruction }];
+        if (imageData)
+            parts.push({ inlineData: { mimeType: imageMime, data: imageData } });
+        response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${encodeURIComponent(config.apiKey || "")}`, {
+            method: "POST",
+            signal,
+            headers: { "content-type": "application/json" },
+            body: JSON.stringify({ systemInstruction: { parts: [{ text: system }] }, contents: [{ role: "user", parts }] }),
+        });
+    }
+    else {
+        const content = [{ type: "text", text: instruction }];
+        if (imageData)
+            content.push({ type: "image", source: { type: "base64", media_type: imageMime, data: imageData } });
+        response = await fetch("https://api.anthropic.com/v1/messages", {
+            method: "POST",
+            signal,
+            headers: { "content-type": "application/json", "x-api-key": config.apiKey || "", "anthropic-version": "2023-06-01" },
+            body: JSON.stringify({ model, max_tokens: 4096, system, messages: [{ role: "user", content }] }),
+        });
+    }
+    if (!response.ok)
+        throw new Error(`Agent request failed (${response.status}).`);
+    const payload = await response.json();
+    const text = config.provider === "openai"
+        ? payload.choices?.[0]?.message?.content
+        : config.provider === "google"
+            ? payload.candidates?.[0]?.content?.parts?.map((part) => part.text || "").join("")
+            : payload.content?.find((item) => item.type === "text")?.text;
+    if (!text)
+        throw new Error("The agent returned an empty response.");
+    return jsonFrom(text);
+}
+async function answerQuestion(cwd, input, config, signal, onProgress) {
+    const context = await contextFor(cwd, input.element);
+    const history = input.messages?.map((message) => `${message.role}: ${message.content}`).join("\n") || "None";
+    const prompt = `Answer the user's question conversationally and directly. Do not propose file changes and do not return JSON. If the question is about the selected UI, use the selection and source context below.\n\nUser question:\n${input.question}\n\nSelected element:\n${JSON.stringify(input.element, null, 2)}\n\nVisual context:\n${JSON.stringify({ ...input.context, screenshots: undefined }, null, 2)}\n\nConversation:\n${history}\n\nRelevant source context:\n${context || "No matching source context was found."}`;
+    if (config.provider === "claude-code" || config.provider === "codex" || config.provider === "opencode") {
+        const local = localCommand(config.provider, config.model, prompt);
+        const command = local.command;
+        const args = local.args;
+        const child = (0, node_child_process_1.spawn)(command, args, { cwd, stdio: ["ignore", "pipe", "pipe"] });
+        let output = "";
+        let pending = "";
+        let stderr = "";
+        const consume = (chunk) => {
+            pending += String(chunk);
+            const lines = pending.split(/\r?\n/);
+            pending = lines.pop() || "";
+            for (const line of lines) {
+                output += `${line}\n`;
+                const progress = progressFromLine(line, config.provider);
+                if (progress)
+                    onProgress?.(progress);
+            }
+        };
+        child.stdout.on("data", consume);
+        child.stderr.on("data", (chunk) => { stderr += String(chunk); });
+        if (signal)
+            signal.addEventListener("abort", () => child.kill("SIGTERM"), { once: true });
+        const code = await new Promise((resolve, reject) => {
+            child.once("error", reject);
+            child.once("close", (status) => resolve(status ?? 1));
+        });
+        if (pending.trim())
+            output += pending;
+        if (code !== 0)
+            throw new Error(localAgentError(command, stderr, code));
+        return extractLocalAgentText(output, config.provider).trim();
+    }
+    const model = config.model || (config.provider === "google" ? "gemini-2.5-flash" : config.provider === "openai" ? "gpt-4.1-mini" : config.provider === "ollama" ? "llama3.2" : "claude-sonnet-4-20250514");
+    let response;
+    if (config.provider === "openai" || config.provider === "ollama") {
+        response = await fetch(`${config.baseUrl || "https://api.openai.com/v1"}/chat/completions`, {
+            method: "POST", signal, headers: { "content-type": "application/json", authorization: `Bearer ${config.apiKey || ""}` },
+            body: JSON.stringify({ model, temperature: 0.2, messages: [{ role: "system", content: "Answer conversationally. Do not edit files or return JSON." }, { role: "user", content: prompt }] }),
+        });
+    }
+    else if (config.provider === "google") {
+        response = await fetch(`https://generativelanguage.googleapis.com/v1beta/models/${model}:generateContent?key=${encodeURIComponent(config.apiKey || "")}`, {
+            method: "POST", signal, headers: { "content-type": "application/json" },
+            body: JSON.stringify({ systemInstruction: { parts: [{ text: "Answer conversationally. Do not edit files or return JSON." }] }, contents: [{ role: "user", parts: [{ text: prompt }] }] }),
+        });
+    }
+    else {
+        response = await fetch("https://api.anthropic.com/v1/messages", {
+            method: "POST", signal, headers: { "content-type": "application/json", "x-api-key": config.apiKey || "", "anthropic-version": "2023-06-01" },
+            body: JSON.stringify({ model, max_tokens: 2048, system: "Answer conversationally. Do not edit files or return JSON.", messages: [{ role: "user", content: prompt }] }),
+        });
+    }
+    if (!response.ok)
+        throw new Error(`Agent request failed (${response.status}).`);
+    const payload = await response.json();
+    const answer = config.provider === "openai" || config.provider === "ollama"
+        ? payload.choices?.[0]?.message?.content
+        : config.provider === "google"
+            ? payload.candidates?.[0]?.content?.parts?.map((part) => part.text || "").join("")
+            : payload.content?.find((item) => item.type === "text")?.text;
+    if (!answer?.trim())
+        throw new Error("The agent returned an empty answer.");
+    return answer.trim();
+}
+async function generateCommitMessage(cwd, status, config, signal, onProgress) {
+    const answer = await answerQuestion(cwd, {
+        question: `Generate exactly one concise Conventional Commit message for these changes. Return only the commit subject line, no quotes, markdown, explanation, or body. Keep it under 100 characters.\n\nChanged files:\n${status.join("\n") || "No changed files listed."}`,
+        element: { tag: "git", group: "workspace", label: "Git working tree" },
+    }, config, signal, onProgress);
+    return answer.split(/\r?\n/).map((line) => line.replace(/^[-*]\s*/, "").replace(/^['"`]|['"`]$/g, "").trim()).find(Boolean)?.slice(0, 120) || "Update project files";
+}

package/dist/cli/auth.d.ts

@@ -0,0 +1,38 @@
+export interface CliCredentials {
+    apiKey: string;
+    keyId: string;
+    workspaceId: string;
+    workspaceName: string;
+    userName: string;
+    userEmail: string;
+    createdAt: string;
+}
+/**
+ * Base URL of the Lasso API (the main server, not the realtime server). The
+ * `lasso auth` flow lives here because the browser confirm needs the web session.
+ * Defaults to the local development port used by `server/` and `web/`.
+ */
+export declare function serverUrlFrom(fileEnv: Record<string, string>): string;
+export declare function fetchWithTimeout(url: string, init?: RequestInit, timeoutMs?: number): Promise<Response>;
+export declare function loadCredentials(): CliCredentials | null;
+export declare function saveCredentials(credentials: CliCredentials): void;
+export declare function clearCredentials(): void;
+/**
+ * `lasso auth login` — device-style OAuth. The CLI asks the server for a
+ * one-time code + verification URL, opens the browser, and polls the status
+ * endpoint until the logged-in dashboard user authorizes. On success the
+ * freshly minted API key is stored in ~/.lasso/credentials.json (0600).
+ */
+export declare function authLogin(cwd: string, fileEnv: Record<string, string>): Promise<{
+    ok: boolean;
+    error?: string;
+}>;
+export declare function authStatus(): CliCredentials | null;
+export declare function credentialSummary(credentials: CliCredentials): {
+    userEmail: string;
+    userName: string;
+    workspaceName: string;
+    workspaceId: string;
+    masked: string;
+};
+export declare function authLogout(): void;