@lotics/cli 0.29.0 → 0.30.1

package/dist/src/args.d.ts

@@ -0,0 +1,32 @@
+/**
+ * CLI argument parser.
+ *
+ * Splits `process.argv.slice(2)` into a command / subcommand / positional
+ * (`toolArgs`) / remaining-positionals (`restArgs`) shape plus typed `flags`.
+ * Value-taking flags (`-m`, `--api-key`, …) consume the next token; boolean
+ * flags (`--force-workflow-sync`, `--json`, …) toggle. Anything not matching a
+ * known flag is positional.
+ *
+ * Lives apart from `cli.ts` so it can be unit-tested — `cli.ts` runs `main()`
+ * on import, so importing the parser from there would execute the CLI.
+ */
+export declare function parseArgs(argv: string[]): {
+    command?: string;
+    subcommand?: string;
+    toolArgs?: string;
+    restArgs: string[];
+    flags: {
+        json: boolean;
+        timeout?: number;
+        output?: string;
+        as?: string;
+        apiKey?: string;
+        name?: string;
+        timezone?: string;
+        message?: string;
+        forceWorkflowSync: boolean;
+        local: boolean;
+        version: boolean;
+        help: boolean;
+    };
+};

package/dist/src/args.js

@@ -0,0 +1,94 @@
+/**
+ * CLI argument parser.
+ *
+ * Splits `process.argv.slice(2)` into a command / subcommand / positional
+ * (`toolArgs`) / remaining-positionals (`restArgs`) shape plus typed `flags`.
+ * Value-taking flags (`-m`, `--api-key`, …) consume the next token; boolean
+ * flags (`--force-workflow-sync`, `--json`, …) toggle. Anything not matching a
+ * known flag is positional.
+ *
+ * Lives apart from `cli.ts` so it can be unit-tested — `cli.ts` runs `main()`
+ * on import, so importing the parser from there would execute the CLI.
+ */
+export function parseArgs(argv) {
+    const flags = {
+        json: false,
+        timeout: undefined,
+        output: undefined,
+        as: undefined,
+        apiKey: undefined,
+        name: undefined,
+        timezone: undefined,
+        message: undefined,
+        forceWorkflowSync: false,
+        local: false,
+        version: false,
+        help: false,
+    };
+    let command;
+    let subcommand;
+    let toolArgs;
+    const restArgs = [];
+    let i = 0;
+    while (i < argv.length) {
+        const arg = argv[i];
+        switch (arg) {
+            case "--json":
+                flags.json = true;
+                break;
+            case "--timeout":
+                flags.timeout = parseInt(argv[++i], 10);
+                break;
+            case "--output":
+            case "-o":
+                flags.output = argv[++i];
+                break;
+            case "--as":
+                flags.as = argv[++i];
+                break;
+            case "--api-key":
+                flags.apiKey = argv[++i];
+                break;
+            case "--name":
+                flags.name = argv[++i];
+                break;
+            case "--timezone":
+                flags.timezone = argv[++i];
+                break;
+            case "-m":
+            case "--message":
+                flags.message = argv[++i];
+                break;
+            case "--force-workflow-sync":
+                flags.forceWorkflowSync = true;
+                break;
+            case "--local":
+                flags.local = true;
+                break;
+            case "--version":
+            case "-v":
+                flags.version = true;
+                break;
+            case "--help":
+            case "-h":
+                flags.help = true;
+                break;
+            default:
+                if (!command) {
+                    command = arg;
+                }
+                else if (!subcommand) {
+                    subcommand = arg;
+                }
+                else if (!toolArgs) {
+                    toolArgs = arg;
+                }
+                else {
+                    restArgs.push(arg);
+                }
+                break;
+        }
+        i++;
+    }
+    return { command, subcommand, toolArgs, restArgs, flags };
+}

package/dist/src/args.test.d.ts

@@ -0,0 +1 @@
+export {};

package/dist/src/args.test.js

@@ -0,0 +1,37 @@
+import { describe, it, expect } from "vitest";
+import { parseArgs } from "./args.js";
+describe("parseArgs", () => {
+    it("splits command / subcommand / positional", () => {
+        const r = parseArgs(["app", "deploy", "my message"]);
+        expect(r.command).toBe("app");
+        expect(r.subcommand).toBe("deploy");
+        expect(r.toolArgs).toBe("my message");
+        expect(r.restArgs).toEqual([]);
+    });
+    // `app deploy` regression: `-m` and `--force-workflow-sync` must be parsed
+    // as flags, not silently consumed as the positional message.
+    it("parses -m as the message flag", () => {
+        const r = parseArgs(["app", "deploy", "-m", "a message"]);
+        expect(r.flags.message).toBe("a message");
+        expect(r.toolArgs).toBeUndefined();
+    });
+    it("parses --message as the message flag", () => {
+        const r = parseArgs(["app", "deploy", "--message", "a message"]);
+        expect(r.flags.message).toBe("a message");
+    });
+    it("parses --force-workflow-sync as a boolean flag", () => {
+        const r = parseArgs(["app", "deploy", "msg", "--force-workflow-sync"]);
+        expect(r.flags.forceWorkflowSync).toBe(true);
+        expect(r.toolArgs).toBe("msg");
+    });
+    it("parses --force-workflow-sync before -m without eating the message", () => {
+        const r = parseArgs(["app", "deploy", "--force-workflow-sync", "-m", "msg"]);
+        expect(r.flags.forceWorkflowSync).toBe(true);
+        expect(r.flags.message).toBe("msg");
+    });
+    it("defaults forceWorkflowSync to false and message to undefined", () => {
+        const r = parseArgs(["app", "deploy"]);
+        expect(r.flags.forceWorkflowSync).toBe(false);
+        expect(r.flags.message).toBeUndefined();
+    });
+});

package/dist/src/cli.js

@@ -6,6 +6,7 @@ import { LoticsClient, API_BASE_URL } from "./client.js";
 import { resolveAuth, loadConfig, saveConfig, deleteConfig, getConfigPath, checkForUpdate } from "./config.js";
 import { VERSION } from "./version.js";
 import { appCreate, appPull, appDeploy, appDev } from "./app_commands.js";
+import { parseArgs } from "./args.js";
 function printHelp() {
     console.log(`Lotics CLI v${VERSION} — AI agent interface for Lotics
 
@@ -114,79 +115,6 @@ else ~/.lotics/config.json. A per-directory config pins a project or worktree to
 its own account and workspace; --local creates one. Note: an exported
 LOTICS_API_KEY env var overrides the config file's key.`);
 }
-function parseArgs(argv) {
-    const flags = {
-        json: false,
-        timeout: undefined,
-        output: undefined,
-        as: undefined,
-        apiKey: undefined,
-        name: undefined,
-        timezone: undefined,
-        local: false,
-        version: false,
-        help: false,
-    };
-    let command;
-    let subcommand;
-    let toolArgs;
-    const restArgs = [];
-    let i = 0;
-    while (i < argv.length) {
-        const arg = argv[i];
-        switch (arg) {
-            case "--json":
-                flags.json = true;
-                break;
-            case "--timeout":
-                flags.timeout = parseInt(argv[++i], 10);
-                break;
-            case "--output":
-            case "-o":
-                flags.output = argv[++i];
-                break;
-            case "--as":
-                flags.as = argv[++i];
-                break;
-            case "--api-key":
-                flags.apiKey = argv[++i];
-                break;
-            case "--name":
-                flags.name = argv[++i];
-                break;
-            case "--timezone":
-                flags.timezone = argv[++i];
-                break;
-            case "--local":
-                flags.local = true;
-                break;
-            case "--version":
-            case "-v":
-                flags.version = true;
-                break;
-            case "--help":
-            case "-h":
-                flags.help = true;
-                break;
-            default:
-                if (!command) {
-                    command = arg;
-                }
-                else if (!subcommand) {
-                    subcommand = arg;
-                }
-                else if (!toolArgs) {
-                    toolArgs = arg;
-                }
-                else {
-                    restArgs.push(arg);
-                }
-                break;
-        }
-        i++;
-    }
-    return { command, subcommand, toolArgs, restArgs, flags };
-}
 function readStdin() {
     return new Promise((resolve, reject) => {
         const chunks = [];
@@ -546,13 +474,11 @@ async function main() {
             return;
         }
         if (subcommand === "deploy") {
-            // -m / --message can be passed via toolArgs or after a flag-like delimiter.
-            // Keep it simple: any positional arg after `deploy` is treated as the message.
-            // --force-workflow-sync is a separate flag captured upstream via restArgs
-            // because it has no value (boolean toggle).
-            const message = toolArgs;
-            const forceWorkflowSync = restArgs.includes("--force-workflow-sync");
-            await appDeploy(client, { message, forceWorkflowSync });
+            // The message is either `-m <message>` or a bare positional arg after
+            // `deploy`. `--force-workflow-sync` is a parsed boolean flag, valid in
+            // any position.
+            const message = flags.message ?? toolArgs;
+            await appDeploy(client, { message, forceWorkflowSync: flags.forceWorkflowSync });
             return;
         }
         if (subcommand === "dev") {

package/dist/src/dev/wrapper_page.d.ts

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }

package/dist/src/dev/wrapper_page.js

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }
@@ -53,12 +58,19 @@ export function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml(workspace_id)}</code></span>
     <span>RPC → <code>${escapeHtml(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts" allow="clipboard-write" src="${escapeAttr(vite_url)}"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin" allow="clipboard-write"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};
+      const VITE_URL = ${JSON.stringify(vite_url)};
+      const VITE_ORIGIN = new URL(VITE_URL).origin;
       const iframe = document.getElementById("app");
 
+      // Pass the wrapper's own origin to the app via ?lotics_host= so the app
+      // SDK can origin-lock its postMessage bridge.
+      iframe.src = VITE_URL + (VITE_URL.indexOf("?") >= 0 ? "&" : "?")
+        + "lotics_host=" + encodeURIComponent(window.location.origin);
+
       async function rpc(op, payload) {
         const res = await fetch("/_rpc", {
           method: "POST",
@@ -104,7 +116,7 @@ export function buildWrapperPage(args) {
       }
 
       window.addEventListener("message", async function (event) {
-        if (event.source !== iframe.contentWindow) return;
+        if (event.source !== iframe.contentWindow || event.origin !== VITE_ORIGIN) return;
         const msg = event.data;
         if (!msg || typeof msg.id !== "number" || typeof msg.op !== "string") return;
         const startedAt = performance.now();
@@ -114,13 +126,16 @@ export function buildWrapperPage(args) {
             : await rpc(msg.op, msg.payload);
           const ms = Math.round(performance.now() - startedAt);
           console.debug("[lotics-dev] " + msg.op + " " + ms + "ms", data);
-          iframe.contentWindow.postMessage({ id: msg.id, type: "result", data: data }, "*");
+          iframe.contentWindow.postMessage(
+            { id: msg.id, type: "result", data: data },
+            VITE_ORIGIN
+          );
         } catch (err) {
           const message = err && err.message ? err.message : String(err);
           console.error("[lotics-dev] " + msg.op + " failed:", message);
           iframe.contentWindow.postMessage(
             { id: msg.id, type: "error", message: message },
-            "*"
+            VITE_ORIGIN
           );
         }
       });
@@ -136,6 +151,3 @@ function escapeHtml(s) {
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;");
 }
-function escapeAttr(s) {
-    return escapeHtml(s).replace(/"/g, "&quot;");
-}

package/dist/src/generate_app_workflows_dts.js

@@ -111,6 +111,8 @@ function inputDeclToTsType(decl) {
         }
         case "date_range":
             return "{ start: string; end: string }";
+        case "file":
+            return "string";
         case "json":
             return "unknown";
         default:

package/dist/src/starter_template.js

@@ -50,7 +50,7 @@ export function buildStarterTemplate(args) {
                     test: "vitest run",
                 },
                 dependencies: {
-                    "@lotics/app-sdk": "^0.6.0",
+                    "@lotics/app-sdk": "^0.7.0",
                     "@lotics/ui": "^1.3.0",
                     "@react-native-picker/picker": "^2.7.0",
                     "expo-image": "~3.0.9",
@@ -155,6 +155,11 @@ export default defineConfig({
     // iframe loads modules from api.lotics.ai which already permits null
     // origin via CORS.
     cors: { origin: "*" },
+    // @lotics/ui/fonts.css references the API's /iframe/fonts/*.woff2 files
+    // by root-relative URL. A deployed app is served from the API origin so
+    // they resolve directly; under \`lotics app dev\` the app runs on
+    // localhost, so proxy /iframe to the API to load the real fonts.
+    proxy: { "/iframe": { target: "https://api.lotics.ai", changeOrigin: true } },
   },
   test: {
     environment: "jsdom",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.29.0",
+  "version": "0.30.1",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {