@lattices/cli 0.3.0 → 0.4.0

package/bin/{lattices-app.js → lattices-app.ts}

@@ -1,23 +1,24 @@
-#!/usr/bin/env node
+#!/usr/bin/env bun
 
 import { execSync, spawn } from "node:child_process";
 import { existsSync, mkdirSync, chmodSync, createWriteStream } from "node:fs";
-import { resolve, dirname } from "node:path";
-import { fileURLToPath } from "node:url";
+import { resolve } from "node:path";
 import { get } from "node:https";
+import type { IncomingMessage } from "node:http";
 
-const __dirname = dirname(fileURLToPath(import.meta.url));
+const __dirname = import.meta.dir;
 const appDir = resolve(__dirname, "../app");
 const bundlePath = resolve(appDir, "Lattices.app");
 const binaryDir = resolve(bundlePath, "Contents/MacOS");
 const binaryPath = resolve(binaryDir, "Lattices");
+const entitlementsPath = resolve(__dirname, "../app/Lattices.entitlements");
 
 const REPO = "arach/lattices";
 const ASSET_NAME = "Lattices-macos-arm64";
 
 // ── Helpers ──────────────────────────────────────────────────────────
 
-function isRunning() {
+function isRunning(): boolean {
   try {
     execSync("pgrep -x Lattices", { stdio: "pipe" });
     return true;
@@ -26,7 +27,7 @@ function isRunning() {
   }
 }
 
-function quit() {
+function quit(): boolean {
   try {
     execSync("pkill -x Lattices", { stdio: "pipe" });
     // Wait briefly for process to exit
@@ -41,7 +42,7 @@ function quit() {
   }
 }
 
-function hasSwift() {
+function hasSwift(): boolean {
   try {
     execSync("which swift", { stdio: "pipe" });
     return true;
@@ -50,7 +51,7 @@ function hasSwift() {
   }
 }
 
-function launch(extraArgs = []) {
+function launch(extraArgs: string[] = []): void {
   if (isRunning()) {
     console.log("lattices app is already running.");
     return;
@@ -61,9 +62,45 @@ function launch(extraArgs = []) {
   console.log("lattices app launched.");
 }
 
+function resolveSigningIdentity(): string | null {
+  try {
+    const identities = execSync("security find-identity -v -p codesigning", { stdio: "pipe" }).toString();
+    return identities.match(/"(Developer ID Application:[^"]+)"/)?.[1]
+        || identities.match(/"(Apple Development:[^"]+)"/)?.[1]
+        || null;
+  } catch {
+    return null;
+  }
+}
+
+function signBundle(): void {
+  const identity = resolveSigningIdentity();
+  const entFlag = existsSync(entitlementsPath) ? ` --entitlements '${entitlementsPath}'` : "";
+
+  if (identity) {
+    console.log(`Signing with: ${identity}`);
+    try {
+      execSync(
+        `codesign --force --sign '${identity}'${entFlag} --identifier com.arach.lattices '${bundlePath}'`,
+        { stdio: "pipe" }
+      );
+      return;
+    } catch {
+      console.log(`Warning: signing with '${identity}' failed — falling back to ad-hoc.`);
+    }
+  } else {
+    console.log("Warning: no local signing identity found — falling back to ad-hoc.");
+  }
+
+  execSync(
+    `codesign --force --sign -${entFlag} --identifier com.arach.lattices '${bundlePath}'`,
+    { stdio: "pipe" }
+  );
+}
+
 // ── Build from source (current arch only) ────────────────────────────
 
-function buildFromSource() {
+function buildFromSource(): boolean {
   console.log("Building lattices app from source...");
   try {
     execSync("swift build -c release", {
@@ -80,6 +117,12 @@ function buildFromSource() {
   mkdirSync(binaryDir, { recursive: true });
   execSync(`cp '${builtPath}' '${binaryPath}'`);
 
+  // Copy Info.plist into bundle
+  const plistSrc = resolve(__dirname, "../app/Info.plist");
+  if (existsSync(plistSrc)) {
+    execSync(`cp '${plistSrc}' '${resolve(bundlePath, "Contents/Info.plist")}'`);
+  }
+
   // Copy app icon into bundle
   const iconSrc = resolve(__dirname, "../assets/AppIcon.icns");
   const resourcesDir = resolve(bundlePath, "Contents/Resources");
@@ -89,18 +132,10 @@ function buildFromSource() {
   }
 
   // Re-sign the bundle so macOS TCC recognizes a stable identity across rebuilds.
-  // Without this, each build gets a new ad-hoc signature and permission grants are lost.
+  // Prefer a real local signing identity; only fall back to ad-hoc when necessary.
   try {
-    // Prefer a real signing identity for stable TCC grants; fall back to ad-hoc with fixed identifier
-    const identities = execSync("security find-identity -v -p codesigning", { stdio: "pipe" }).toString();
-    const devId = identities.match(/"(Developer ID Application:[^"]+)"/)?.[1]
-               || identities.match(/"(Apple Development:[^"]+)"/)?.[1];
-    const signArg = devId ? `'${devId}'` : "-";
-    execSync(
-      `codesign --force --sign ${signArg} --identifier com.arach.lattices '${bundlePath}'`,
-      { stdio: "pipe" }
-    );
-  } catch (e) {
+    signBundle();
+  } catch {
     // Non-fatal — app still works, just permissions won't persist across rebuilds
     console.log("Warning: code signing failed — permissions may not persist across rebuilds.");
   }
@@ -112,10 +147,10 @@ function buildFromSource() {
 
 // ── Download from GitHub releases ────────────────────────────────────
 
-function httpsGet(url) {
+function httpsGet(url: string): Promise<IncomingMessage> {
   return new Promise((resolve, reject) => {
     get(url, { headers: { "User-Agent": "lattices" } }, (res) => {
-      if (res.statusCode >= 300 && res.statusCode < 400 && res.headers.location) {
+      if (res.statusCode! >= 300 && res.statusCode! < 400 && res.headers.location) {
         return httpsGet(res.headers.location).then(resolve, reject);
       }
       if (res.statusCode !== 200) {
@@ -128,24 +163,24 @@ function httpsGet(url) {
   });
 }
 
-async function download() {
+async function download(): Promise<boolean> {
   console.log("Downloading pre-built binary...");
 
   try {
     const apiUrl = `https://api.github.com/repos/${REPO}/releases/latest`;
     const apiRes = await httpsGet(apiUrl);
-    const chunks = [];
-    for await (const chunk of apiRes) chunks.push(chunk);
+    const chunks: Buffer[] = [];
+    for await (const chunk of apiRes) chunks.push(chunk as Buffer);
     const release = JSON.parse(Buffer.concat(chunks).toString());
 
-    const asset = release.assets?.find((a) => a.name === ASSET_NAME);
+    const asset = release.assets?.find((a: { name: string }) => a.name === ASSET_NAME);
     if (!asset) throw new Error("Binary not found in release assets");
 
     const dlRes = await httpsGet(asset.browser_download_url);
 
     mkdirSync(binaryDir, { recursive: true });
     const ws = createWriteStream(binaryPath);
-    await new Promise((resolve, reject) => {
+    await new Promise<void>((resolve, reject) => {
       dlRes.pipe(ws);
       ws.on("finish", resolve);
       ws.on("error", reject);
@@ -155,14 +190,14 @@ async function download() {
     console.log("Download complete.");
     return true;
   } catch (e) {
-    console.log(`Download failed: ${e.message}`);
+    console.log(`Download failed: ${(e as Error).message}`);
     return false;
   }
 }
 
 // ── Commands ─────────────────────────────────────────────────────────
 
-async function ensureBinary() {
+async function ensureBinary(): Promise<void> {
   if (existsSync(binaryPath)) return;
 
   // 1. Try local compile (fast, matches exact system)
@@ -179,15 +214,15 @@ async function ensureBinary() {
   console.error(
     "Could not build or download the lattices app.\n" +
     "Options:\n" +
-    "  • Install Xcode CLI tools:  xcode-select --install\n" +
-    "  • Download manually from:   https://github.com/" + REPO + "/releases"
+    "  \u2022 Install Xcode CLI tools:  xcode-select --install\n" +
+    "  \u2022 Download manually from:   https://github.com/" + REPO + "/releases"
   );
   process.exit(1);
 }
 
 const cmd = process.argv[2];
 const flags = process.argv.slice(3);
-const launchFlags = [];
+const launchFlags: string[] = [];
 if (flags.includes("--diagnostics") || flags.includes("-d")) launchFlags.push("--diagnostics");
 if (flags.includes("--screen-map") || flags.includes("-m")) launchFlags.push("--screen-map");
 

package/bin/lattices-dev

@@ -0,0 +1,160 @@
+#!/usr/bin/env bash
+# lattices-dev — convenience commands for Lattices development
+
+set -euo pipefail
+
+SCRIPT_PATH="$(readlink -f "$0" 2>/dev/null || python3 -c "import os,sys; print(os.path.realpath(sys.argv[1]))" "$0")"
+APP_DIR="$(cd "$(dirname "$SCRIPT_PATH")/../app" && pwd)"
+LOG_FILE="$HOME/.lattices/lattices.log"
+BINARY="$APP_DIR/.build/release/Lattices"
+BUNDLE="$APP_DIR/Lattices.app"
+BUNDLE_BIN="$BUNDLE/Contents/MacOS/Lattices"
+ENTITLEMENTS="$APP_DIR/Lattices.entitlements"
+
+red()   { printf "\033[31m%s\033[0m\n" "$*"; }
+green() { printf "\033[32m%s\033[0m\n" "$*"; }
+dim()   { printf "\033[2m%s\033[0m\n" "$*"; }
+
+select_sign_identity() {
+    local identities identity=""
+    identities="$(security find-identity -v -p codesigning 2>/dev/null || true)"
+    identity="$(printf '%s\n' "$identities" | sed -n 's/.*"\(Developer ID Application:[^"]*\)".*/\1/p' | head -n 1)"
+    if [ -z "$identity" ]; then
+        identity="$(printf '%s\n' "$identities" | sed -n 's/.*"\(Apple Development:[^"]*\)".*/\1/p' | head -n 1)"
+    fi
+    printf '%s' "$identity"
+}
+
+sign_bundle() {
+    local identity sign_status=0
+    local -a ent_flags=()
+
+    if [ -f "$ENTITLEMENTS" ]; then
+        ent_flags=(--entitlements "$ENTITLEMENTS")
+    fi
+
+    identity="$(select_sign_identity)"
+    if [ -n "$identity" ]; then
+        dim "Signing with: $identity"
+        if ! codesign --force --sign "$identity" "${ent_flags[@]}" --identifier com.arach.lattices "$BUNDLE"; then
+            red "Signing with '$identity' failed. Falling back to ad-hoc."
+            sign_status=1
+        fi
+    else
+        sign_status=1
+    fi
+
+    if [ "$sign_status" -ne 0 ]; then
+        dim "No usable signing identity found. Using ad-hoc signature."
+        codesign --force --sign - "${ent_flags[@]}" --identifier com.arach.lattices "$BUNDLE"
+    fi
+}
+
+cmd_build() {
+    echo "Building release..."
+    cd "$APP_DIR" && swift build -c release
+    # Copy into app bundle so it runs with the proper bundle ID
+    mkdir -p "$(dirname "$BUNDLE_BIN")" "$BUNDLE/Contents/Resources"
+    cp "$BINARY" "$BUNDLE_BIN"
+    cp "$APP_DIR/Info.plist" "$BUNDLE/Contents/Info.plist" 2>/dev/null || true
+    # Re-sign so TCC permissions persist across rebuilds
+    sign_bundle
+    green "Build complete."
+}
+
+cmd_restart() {
+    echo "Restarting Lattices..."
+    pkill -x Lattices 2>/dev/null && sleep 1 || true
+    cmd_build
+    open "$BUNDLE"
+    green "Lattices restarted."
+}
+
+cmd_quit() {
+    if pkill -x Lattices 2>/dev/null; then
+        green "Lattices stopped."
+    else
+        dim "Lattices is not running."
+    fi
+}
+
+cmd_launch() {
+    if pgrep -x Lattices >/dev/null 2>&1; then
+        dim "Lattices is already running."
+    else
+        open "$BUNDLE"
+        green "Lattices launched."
+    fi
+}
+
+cmd_logs() {
+    if [ -f "$LOG_FILE" ]; then
+        tail -f "$LOG_FILE"
+    else
+        red "No log file at $LOG_FILE"
+    fi
+}
+
+cmd_log() {
+    # Show last N lines (default 30)
+    local n="${1:-30}"
+    if [ -f "$LOG_FILE" ]; then
+        tail -n "$n" "$LOG_FILE"
+    else
+        red "No log file at $LOG_FILE"
+    fi
+}
+
+cmd_clear_logs() {
+    if [ -f "$LOG_FILE" ]; then
+        > "$LOG_FILE"
+        green "Logs cleared."
+    else
+        dim "No log file to clear."
+    fi
+}
+
+cmd_status() {
+    if pgrep -x Lattices >/dev/null 2>&1; then
+        local pid=$(pgrep -x Lattices)
+        green "Lattices running (pid $pid)"
+    else
+        dim "Lattices is not running."
+    fi
+    if [ -f "$LOG_FILE" ]; then
+        local lines=$(wc -l < "$LOG_FILE" | tr -d ' ')
+        local size=$(du -h "$LOG_FILE" | cut -f1 | tr -d ' ')
+        dim "Log: $lines lines, $size"
+    fi
+    if [ -f "$HOME/.lattices/advisor-learning.jsonl" ]; then
+        local entries=$(wc -l < "$HOME/.lattices/advisor-learning.jsonl" | tr -d ' ')
+        dim "Advisor learning: $entries entries"
+    fi
+}
+
+cmd_help() {
+    echo "lattices-dev — Lattices development commands"
+    echo ""
+    echo "  restart      Quit + rebuild + relaunch"
+    echo "  build        Build release binary"
+    echo "  quit         Stop the running app"
+    echo "  launch       Start the app (if not running)"
+    echo "  logs         Tail the log file (live)"
+    echo "  log [N]      Show last N log lines (default 30)"
+    echo "  clear-logs   Clear the log file"
+    echo "  status       Show running state and stats"
+    echo "  help         Show this help"
+}
+
+case "${1:-help}" in
+    restart)    cmd_restart ;;
+    build)      cmd_build ;;
+    quit|stop)  cmd_quit ;;
+    launch|start) cmd_launch ;;
+    logs)       cmd_logs ;;
+    log)        cmd_log "${2:-30}" ;;
+    clear-logs) cmd_clear_logs ;;
+    status)     cmd_status ;;
+    help|--help|-h) cmd_help ;;
+    *) red "Unknown command: $1"; cmd_help; exit 1 ;;
+esac