@letterblack/lbe-exec 1.2.13 → 1.2.15

package/dist/cli.js

@@ -2686,11 +2686,10 @@ switch (cmd) {
     const existing = process.env.NODE_OPTIONS || "";
     const hookFlag = "--require " + hookPath;
     const nodeOptions = existing.includes(hookFlag) ? existing : (existing + " " + hookFlag).trim();
-    const npmArgs = rest;
-    const isWindows = process.platform === "win32";
-    const child = spawn(isWindows ? "npm.cmd" : "npm", npmArgs, {
+    const npmArgs = rest.filter((v) => !v.startsWith("--mode") && v !== opts.mode);
+    const child = spawn("npm", npmArgs, {
       stdio: "inherit",
-      shell: false,
+      shell: true,
       env: { ...process.env, NODE_OPTIONS: nodeOptions, LBE_MODE: opts.mode || "observe", LBE_ROOT: process.cwd() }
     });
     child.on("close", (code) => process.exit(code ?? 0));
@@ -2736,6 +2735,19 @@ switch (cmd) {
         console.log("  " + (active ? "\u2713" : "\u2013") + " " + fn);
       }
     }
+    const activationFile = path15.join(process.cwd(), ".lbe", "activation.json");
+    const sessionActive = (process.env.NODE_OPTIONS || "").includes("register.cjs");
+    if (fs14.existsSync(activationFile)) {
+      try {
+        const act = JSON.parse(fs14.readFileSync(activationFile, "utf8"));
+        console.log("\nactivation:  " + (act.permanent ? "permanent" : "session") + " (" + act.mode + ")" + (sessionActive ? "  NODE_OPTIONS \u2713" : "  restart terminal to apply"));
+      } catch (_) {
+      }
+    } else if (sessionActive) {
+      console.log("\nactivation:  session active  NODE_OPTIONS \u2713");
+    } else {
+      console.log("\nactivation:  none \u2014 run: lbe-exec activate");
+    }
     console.log("\nevents log:  .lbe/events.jsonl");
     break;
   }
@@ -2778,6 +2790,129 @@ switch (cmd) {
       process.exit(1);
     });
     break;
+  case "activate": {
+    const hookPath = findHookPath();
+    if (!fs14.existsSync(hookPath)) {
+      console.error("Hook not found: " + hookPath + "\nRun: npm install @letterblack/lbe-exec");
+      process.exit(1);
+    }
+    const mode = opts.mode || "observe";
+    const root = process.cwd();
+    const reqFlag = '--require "' + hookPath + '"';
+    const lbeDir = path15.join(root, ".lbe");
+    fs14.mkdirSync(lbeDir, { recursive: true });
+    fs14.writeFileSync(path15.join(lbeDir, "activation.json"), JSON.stringify({
+      activated: true,
+      activatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+      hookPath,
+      mode,
+      root,
+      permanent: !!opts.permanent
+    }, null, 2) + "\n");
+    if (opts.permanent) {
+      if (process.platform === "win32") {
+        const psRead = spawnSync2("powershell.exe", [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          '[System.Environment]::GetEnvironmentVariable("NODE_OPTIONS","User")'
+        ], { encoding: "utf8" });
+        const current = (psRead.stdout || "").trim();
+        const merged = current.includes(hookPath) ? current : (current + " " + reqFlag).trim();
+        spawnSync2("powershell.exe", [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          `[System.Environment]::SetEnvironmentVariable('NODE_OPTIONS','${merged}','User');[System.Environment]::SetEnvironmentVariable('LBE_ROOT','${root}','User');[System.Environment]::SetEnvironmentVariable('LBE_MODE','${mode}','User')`
+        ], { stdio: "inherit" });
+        console.log("\n\u2713 LBE permanently activated \u2014 Windows user environment updated.");
+        console.log("  Restart your terminal or IDE to apply.\n");
+        console.log("  Every node / npm / npx process will be governed automatically.");
+      } else {
+        const home = process.env.HOME || "";
+        const rcFiles = [".bashrc", ".zshrc"].map((f) => path15.join(home, f)).filter((f) => fs14.existsSync(f));
+        const block = `
+# LBE Agent Governance
+export NODE_OPTIONS='${reqFlag}'
+export LBE_ROOT="${root}"
+export LBE_MODE="${mode}"
+`;
+        for (const rc of rcFiles) {
+          fs14.appendFileSync(rc, block);
+          console.log("\u2713 Appended to " + rc);
+        }
+        if (!rcFiles.length) console.log("No .bashrc/.zshrc found \u2014 add these manually:\n" + block);
+        console.log("  Run: source ~/.bashrc  (or restart terminal)");
+      }
+    } else {
+      console.log("\u2500\u2500 LBE Workspace Activation \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500");
+      console.log("workspace: " + root);
+      console.log("hook:      " + hookPath);
+      console.log("mode:      " + mode);
+      console.log("\nCopy and run in your terminal to arm this session:\n");
+      if (process.platform === "win32") {
+        console.log("# PowerShell:");
+        console.log(`$env:NODE_OPTIONS='--require "` + hookPath + `"'`);
+        console.log('$env:LBE_ROOT="' + root + '"');
+        console.log('$env:LBE_MODE="' + mode + '"');
+        console.log("\n# cmd.exe:");
+        console.log('set NODE_OPTIONS=--require "' + hookPath + '"');
+        console.log("set LBE_ROOT=" + root);
+        console.log("set LBE_MODE=" + mode);
+      } else {
+        console.log(`export NODE_OPTIONS='--require "` + hookPath + `"'`);
+        console.log('export LBE_ROOT="' + root + '"');
+        console.log('export LBE_MODE="' + mode + '"');
+      }
+      console.log("\nAfter running: every node / npm / npx command in this session is governed.");
+      console.log("To persist across all terminals:  lbe-exec activate --permanent");
+    }
+    break;
+  }
+  case "deactivate": {
+    const activationFile = path15.join(process.cwd(), ".lbe", "activation.json");
+    if (fs14.existsSync(activationFile)) fs14.unlinkSync(activationFile);
+    if (opts.permanent) {
+      if (process.platform === "win32") {
+        const hookPath = findHookPath();
+        const psRead = spawnSync2("powershell.exe", [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          '[System.Environment]::GetEnvironmentVariable("NODE_OPTIONS","User")'
+        ], { encoding: "utf8" });
+        const current = (psRead.stdout || "").trim();
+        const cleaned = current.replace('--require "' + hookPath + '"', "").replace("--require " + hookPath, "").trim();
+        spawnSync2("powershell.exe", [
+          "-NoProfile",
+          "-NonInteractive",
+          "-Command",
+          (cleaned ? `[System.Environment]::SetEnvironmentVariable('NODE_OPTIONS','${cleaned}','User');` : `[System.Environment]::SetEnvironmentVariable('NODE_OPTIONS',$null,'User');`) + `[System.Environment]::SetEnvironmentVariable('LBE_ROOT',$null,'User');[System.Environment]::SetEnvironmentVariable('LBE_MODE',$null,'User')`
+        ], { stdio: "inherit" });
+        console.log("\u2713 LBE deactivated \u2014 user environment cleared. Restart terminal to apply.");
+      } else {
+        console.log("Remove these lines from your shell RC file (.bashrc / .zshrc):");
+        console.log("  export NODE_OPTIONS=... (the --require lbe line)");
+        console.log("  export LBE_ROOT=...");
+        console.log("  export LBE_MODE=...");
+      }
+    } else {
+      console.log("Run these commands to disarm this session:\n");
+      if (process.platform === "win32") {
+        console.log("# PowerShell:");
+        console.log("Remove-Item Env:NODE_OPTIONS -ErrorAction SilentlyContinue");
+        console.log("Remove-Item Env:LBE_ROOT    -ErrorAction SilentlyContinue");
+        console.log("Remove-Item Env:LBE_MODE    -ErrorAction SilentlyContinue");
+        console.log("\n# cmd.exe:");
+        console.log("set NODE_OPTIONS=");
+        console.log("set LBE_ROOT=");
+        console.log("set LBE_MODE=");
+      } else {
+        console.log("unset NODE_OPTIONS LBE_ROOT LBE_MODE");
+      }
+    }
+    break;
+  }
   case "observe":
   case "enforce":
     policyModeCommand(cmd, opts).catch((e) => {
@@ -2829,6 +2964,10 @@ switch (cmd) {
     console.log("  status              Show workspace, mode, hook state, patched functions");
     console.log("  audit               Show unified event log (.lbe/events.jsonl)");
     console.log("  policy              List active policy rules");
+    console.log("  activate            Arm workspace \u2014 every node/npm/npx is governed");
+    console.log("    [--mode observe|enforce] [--permanent]");
+    console.log("  deactivate          Disarm workspace");
+    console.log("    [--permanent]");
     console.log("  observe             Switch to observer mode (log only, nothing blocked)");
     console.log("  enforce             Switch to enforcement mode (violations blocked)");
     console.log("  execute             Send a JSON request from stdin or --input file");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@letterblack/lbe-exec",
-  "version": "1.2.13",
+  "version": "1.2.15",
   "description": "Local host-signed execution layer for LetterBlack LBE.",
   "type": "module",
   "main": "dist/index.js",