@mafdet/cli 0.3.0 → 0.4.0

package/dist/tui/tool-card.d.ts

@@ -0,0 +1,41 @@
+import { type TerminalCapabilities } from "./theme.js";
+export type ToolState = "queued" | "awaiting_approval" | "running" | "succeeded" | "refused" | "failed";
+export interface ToolCard {
+    readonly name: string;
+    readonly state: ToolState;
+    /** Trimmed, control-stripped rendering of the model's arguments. */
+    readonly arguments: string;
+    /** One line of outcome, once there is one. */
+    readonly detail?: string;
+}
+/**
+ * Render the model's arguments for display.
+ *
+ * Not `JSON.stringify` of the raw string: that would keep any control bytes
+ * the model put in a path, and a card is drawn straight to the terminal.
+ */
+export declare function summariseArguments(raw: string): string;
+/**
+ * Fold the agent's events into cards.
+ *
+ * A single tool call is one card that changes state, rather than several log
+ * lines: the point of the card is that "what is it doing right now" has one
+ * place to look.
+ */
+export declare class ToolCardLog {
+    private readonly cards;
+    /** Returns the card that changed, so a caller can redraw just that one. */
+    apply(event: {
+        type: string;
+        name?: string;
+        ok?: boolean;
+        detail?: string;
+        arguments?: string;
+        summary?: string;
+    }): ToolCard | undefined;
+    list(): readonly ToolCard[];
+    private lastOpen;
+    private replace;
+}
+export declare function renderCard(card: ToolCard, capabilities: TerminalCapabilities): string;
+//# sourceMappingURL=tool-card.d.ts.map

package/dist/tui/tool-card.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-card.d.ts","sourceRoot":"","sources":["../../src/tui/tool-card.ts"],"names":[],"mappings":"AAcA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,MAAM,SAAS,GACjB,QAAQ,GACR,mBAAmB,GACnB,SAAS,GACT,WAAW,GACX,SAAS,GACT,QAAQ,CAAC;AAEb,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,oEAAoE;IACpE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,8CAA8C;IAC9C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAcD;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAsBtD;AAQD;;;;;;GAMG;AACH,qBAAa,WAAW;IACtB,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAkB;IAExC,2EAA2E;IAC3E,KAAK,CAAC,KAAK,EAAE;QACX,IAAI,EAAE,MAAM,CAAC;QACb,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,EAAE,CAAC,EAAE,OAAO,CAAC;QACb,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,GAAG,QAAQ,GAAG,SAAS;IAkCxB,IAAI,IAAI,SAAS,QAAQ,EAAE;IAI3B,OAAO,CAAC,QAAQ;IAahB,OAAO,CAAC,OAAO;CAKhB;AAOD,wBAAgB,UAAU,CACxB,IAAI,EAAE,QAAQ,EACd,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAUR"}

package/dist/tui/tool-card.js

@@ -0,0 +1,132 @@
+// CLI-021 · Tool cards.
+//
+// One card per tool call, moving through the states the plan names:
+//
+//   queued -> awaiting_approval -> running -> succeeded
+//                              \-> refused
+//                               \-> failed
+//
+// The card shows what the tool was *asked* to do, trimmed. The arguments come
+// from the model, so they are untrusted text on their way to a terminal: every
+// value is stripped of control characters and cut to a line before it is
+// drawn. A file name is a perfectly good place to hide an escape sequence.
+import { stripAnsi } from "../agent/command-policy.js";
+import { palette } from "./theme.js";
+/** Longest argument rendering kept on a card. */
+const ARGUMENT_LIMIT = 96;
+const GLYPHS = {
+    queued: "  ",
+    awaiting_approval: "? ",
+    running: "> ",
+    succeeded: "ok",
+    refused: "no",
+    failed: "!!",
+};
+/**
+ * Render the model's arguments for display.
+ *
+ * Not `JSON.stringify` of the raw string: that would keep any control bytes
+ * the model put in a path, and a card is drawn straight to the terminal.
+ */
+export function summariseArguments(raw) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw || "{}");
+    }
+    catch {
+        return clip(stripAnsi(raw).replace(/\s+/g, " ").trim());
+    }
+    if (parsed === null || typeof parsed !== "object") {
+        return clip(stripAnsi(String(parsed)));
+    }
+    const parts = [];
+    for (const [key, value] of Object.entries(parsed)) {
+        const text = typeof value === "string"
+            ? value
+            : (JSON.stringify(value) ?? String(value));
+        parts.push(`${key}=${stripAnsi(text).replace(/\s+/g, " ").trim()}`);
+    }
+    return clip(parts.join(" "));
+}
+function clip(text) {
+    const chars = [...text];
+    if (chars.length <= ARGUMENT_LIMIT)
+        return text;
+    return chars.slice(0, ARGUMENT_LIMIT - 3).join("") + "...";
+}
+/**
+ * Fold the agent's events into cards.
+ *
+ * A single tool call is one card that changes state, rather than several log
+ * lines: the point of the card is that "what is it doing right now" has one
+ * place to look.
+ */
+export class ToolCardLog {
+    cards = [];
+    /** Returns the card that changed, so a caller can redraw just that one. */
+    apply(event) {
+        if (event.name === undefined)
+            return undefined;
+        if (event.type === "tool_started") {
+            const card = {
+                name: event.name,
+                state: "running",
+                arguments: summariseArguments(event.arguments ?? "{}"),
+            };
+            this.cards.push(card);
+            return card;
+        }
+        const open = this.lastOpen(event.name);
+        if (open === undefined)
+            return undefined;
+        if (event.type === "tool_awaiting_approval") {
+            return this.replace(open, {
+                state: "awaiting_approval",
+                detail: event.summary,
+            });
+        }
+        if (event.type === "declined") {
+            return this.replace(open, { state: "refused", detail: event.summary });
+        }
+        if (event.type === "tool") {
+            return this.replace(open, {
+                state: event.ok === true ? "succeeded" : "failed",
+                detail: firstLine(event.detail ?? ""),
+            });
+        }
+        return undefined;
+    }
+    list() {
+        return this.cards;
+    }
+    lastOpen(name) {
+        for (let i = this.cards.length - 1; i >= 0; i -= 1) {
+            const card = this.cards[i];
+            if (card.name === name &&
+                (card.state === "running" || card.state === "awaiting_approval")) {
+                return i;
+            }
+        }
+        return undefined;
+    }
+    replace(index, patch) {
+        const next = { ...this.cards[index], ...patch };
+        this.cards[index] = next;
+        return next;
+    }
+}
+function firstLine(text) {
+    const line = stripAnsi(text).split("\n")[0] ?? "";
+    return clip(line.trim());
+}
+export function renderCard(card, capabilities) {
+    const { dim, bold, accent } = palette(capabilities);
+    const glyph = GLYPHS[card.state];
+    const head = `  ${glyph}  ${bold(card.name)} ${dim(card.arguments)}`;
+    if (card.detail === undefined || card.detail.length === 0)
+        return `${head}\n`;
+    const detail = card.state === "failed" || card.state === "refused"
+        ? accent(card.detail)
+        : dim(card.detail);
+    return `${head}\n        ${detail}\n`;
+}

package/dist/tui/widgets.d.ts

@@ -0,0 +1,44 @@
+import type { Key } from "./keys.js";
+import { type TerminalCapabilities } from "./theme.js";
+/** Where a widget draws and how it hears about keys. */
+export interface WidgetIo {
+    write(text: string): void;
+    /** Resolves with the next chunk of keys, or undefined once input ends. */
+    nextKeys(): Promise<readonly Key[] | undefined>;
+    readonly capabilities: TerminalCapabilities;
+}
+export interface SelectItem<T> {
+    readonly value: T;
+    readonly label: string;
+    /** A second, dimmer line under the label. */
+    readonly detail?: string;
+}
+export interface SelectResult<T> {
+    readonly kind: "picked" | "cancelled";
+    readonly value?: T;
+}
+/**
+ * A vertical list. Arrow keys or j/k move, Enter picks, Ctrl+C and Escape
+ * cancel. Cancelling is a first-class outcome, not an exception: the caller
+ * decides whether it means "go back" or "quit".
+ */
+export declare function select<T>(io: WidgetIo, options: {
+    readonly title: string;
+    readonly items: readonly SelectItem<T>[];
+}): Promise<SelectResult<T>>;
+export interface SecretResult {
+    readonly kind: "entered" | "cancelled";
+    readonly value?: string;
+}
+/**
+ * A single-line input that never echoes what was typed.
+ *
+ * The value is returned to the caller and deliberately not retained here. The
+ * mask shows a count so a paste visibly registers, which matters because a
+ * silent field gives no way to tell a failed paste from a wrong key.
+ */
+export declare function secret(io: WidgetIo, options: {
+    readonly prompt: string;
+    readonly hint?: string;
+}): Promise<SecretResult>;
+//# sourceMappingURL=widgets.d.ts.map

package/dist/tui/widgets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"widgets.d.ts","sourceRoot":"","sources":["../../src/tui/widgets.ts"],"names":[],"mappings":"AAOA,OAAO,KAAK,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACrC,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAQhE,wDAAwD;AACxD,MAAM,WAAW,QAAQ;IACvB,KAAK,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,0EAA0E;IAC1E,QAAQ,IAAI,OAAO,CAAC,SAAS,GAAG,EAAE,GAAG,SAAS,CAAC,CAAC;IAChD,QAAQ,CAAC,YAAY,EAAE,oBAAoB,CAAC;CAC7C;AAyBD,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAC;IAClB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,6CAA6C;IAC7C,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,YAAY,CAAC,CAAC;IAC7B,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IACtC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;CACpB;AAED;;;;GAIG;AACH,wBAAsB,MAAM,CAAC,CAAC,EAC5B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,CAAC,CAAC,CAAC,EAAE,CAAA;CAAE,GAC5E,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAgD1B;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,WAAW,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;;GAMG;AACH,wBAAsB,MAAM,CAC1B,EAAE,EAAE,QAAQ,EACZ,OAAO,EAAE;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GAC3D,OAAO,CAAC,YAAY,CAAC,CAgDvB"}

package/dist/tui/widgets.js

@@ -0,0 +1,137 @@
+// CLI-019 · The two interactive widgets, over an append-only log.
+//
+// Per the ADR: no alternate screen, no full-screen repaint. A widget draws
+// itself, redraws in place while it has focus, and when it is done it leaves
+// one settled line behind so the transcript above it stays readable and
+// scrollback keeps working.
+import { palette } from "./theme.js";
+const ESC = String.fromCharCode(27);
+const CSI = `${ESC}[`;
+const CLEAR_LINE = `${CSI}2K`;
+const TO_COL_0 = `${CSI}G`;
+const up = (n) => (n > 0 ? `${CSI}${n}A` : "");
+/** Painter for a block of lines that is rewritten in place. */
+function inPlace(io) {
+    let painted = 0;
+    return {
+        paint(lines) {
+            const body = lines.map((line) => CLEAR_LINE + line).join("\n");
+            io.write(up(painted) + TO_COL_0 + body + "\n");
+            painted = lines.length;
+        },
+        /** Replace the block with a single settled line. */
+        settle(line) {
+            io.write(up(painted) + TO_COL_0);
+            // Erase the rest of what was drawn so nothing is left half-visible.
+            const blanks = Array.from({ length: painted }, () => CLEAR_LINE).join("\n");
+            if (painted > 0)
+                io.write(blanks + up(painted - 1) + TO_COL_0);
+            io.write(CLEAR_LINE + line + "\n");
+            painted = 0;
+        },
+    };
+}
+/**
+ * A vertical list. Arrow keys or j/k move, Enter picks, Ctrl+C and Escape
+ * cancel. Cancelling is a first-class outcome, not an exception: the caller
+ * decides whether it means "go back" or "quit".
+ */
+export async function select(io, options) {
+    const { bold, dim, accent } = palette(io.capabilities);
+    const painter = inPlace(io);
+    let index = 0;
+    const draw = () => {
+        const lines = [bold(options.title), ""];
+        options.items.forEach((item, i) => {
+            const selected = i === index;
+            lines.push(selected ? accent(`  > ${item.label}`) : `    ${item.label}`);
+            if (item.detail !== undefined)
+                lines.push(dim(`      ${item.detail}`));
+        });
+        lines.push("");
+        lines.push(dim("  up/down to move, Enter to select, Ctrl+C to cancel"));
+        painter.paint(lines);
+    };
+    draw();
+    for (;;) {
+        const keys = await io.nextKeys();
+        if (keys === undefined) {
+            painter.settle(dim(`${options.title} cancelled`));
+            return { kind: "cancelled" };
+        }
+        for (const key of keys) {
+            if (key.kind === "up" || (key.kind === "char" && key.value === "k")) {
+                index = index === 0 ? options.items.length - 1 : index - 1;
+            }
+            else if (key.kind === "down" ||
+                (key.kind === "char" && key.value === "j")) {
+                index = index === options.items.length - 1 ? 0 : index + 1;
+            }
+            else if (key.kind === "enter") {
+                const chosen = options.items[index];
+                painter.settle(`${dim(options.title)} ${bold(chosen.label)}`);
+                return { kind: "picked", value: chosen.value };
+            }
+            else if (key.kind === "interrupt" ||
+                key.kind === "escape" ||
+                key.kind === "eof") {
+                painter.settle(dim(`${options.title} cancelled`));
+                return { kind: "cancelled" };
+            }
+        }
+        draw();
+    }
+}
+/**
+ * A single-line input that never echoes what was typed.
+ *
+ * The value is returned to the caller and deliberately not retained here. The
+ * mask shows a count so a paste visibly registers, which matters because a
+ * silent field gives no way to tell a failed paste from a wrong key.
+ */
+export async function secret(io, options) {
+    const { bold, dim } = palette(io.capabilities);
+    const painter = inPlace(io);
+    let buffer = "";
+    const draw = () => {
+        const lines = [bold(options.prompt)];
+        if (options.hint !== undefined)
+            lines.push(dim(options.hint));
+        lines.push("");
+        // A count, not the characters: enough to see a paste land, nothing more.
+        lines.push(buffer.length === 0
+            ? dim("  (hidden - paste or type, then press Enter)")
+            : `  ${"*".repeat(Math.min(buffer.length, 32))} ${dim(`${buffer.length} characters`)}`);
+        painter.paint(lines);
+    };
+    draw();
+    for (;;) {
+        const keys = await io.nextKeys();
+        if (keys === undefined) {
+            painter.settle(dim(`${options.prompt} cancelled`));
+            return { kind: "cancelled" };
+        }
+        for (const key of keys) {
+            if (key.kind === "char") {
+                buffer += key.value;
+            }
+            else if (key.kind === "backspace") {
+                buffer = buffer.slice(0, -1);
+            }
+            else if (key.kind === "enter") {
+                const value = buffer;
+                buffer = "";
+                painter.settle(dim(`${options.prompt} received`));
+                return { kind: "entered", value };
+            }
+            else if (key.kind === "interrupt" ||
+                key.kind === "escape" ||
+                key.kind === "eof") {
+                buffer = "";
+                painter.settle(dim(`${options.prompt} cancelled`));
+                return { kind: "cancelled" };
+            }
+        }
+        draw();
+    }
+}

package/dist/tui/workspace-summary.d.ts

@@ -0,0 +1,10 @@
+import { type TerminalCapabilities } from "./theme.js";
+export interface WorkspaceFacts {
+    /** Resolved through symlinks; undefined when the directory is unusable. */
+    readonly root?: string;
+    readonly problem?: string;
+    readonly isGitRepository: boolean;
+}
+export declare function inspectWorkspace(cwd: string, exists: (path: string) => boolean): WorkspaceFacts;
+export declare function renderWorkspaceSummary(facts: WorkspaceFacts, capabilities: TerminalCapabilities): string;
+//# sourceMappingURL=workspace-summary.d.ts.map

package/dist/tui/workspace-summary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"workspace-summary.d.ts","sourceRoot":"","sources":["../../src/tui/workspace-summary.ts"],"names":[],"mappings":"AAUA,OAAO,EAAW,KAAK,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAEhE,MAAM,WAAW,cAAc;IAC7B,2EAA2E;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;CACnC;AAED,wBAAgB,gBAAgB,CAC9B,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,GAChC,cAAc,CAahB;AAED,wBAAgB,sBAAsB,CACpC,KAAK,EAAE,cAAc,EACrB,YAAY,EAAE,oBAAoB,GACjC,MAAM,CAgBR"}

package/dist/tui/workspace-summary.js

@@ -0,0 +1,49 @@
+// CLI-020 · What the session may touch, stated before anything is done.
+//
+// The path shown is the canonical one. A symlinked or relative cwd that
+// resolves elsewhere must be displayed as where it really is - telling
+// someone the agent is working in ~/project when it is really in /tmp is the
+// kind of small lie that makes a permission model useless.
+import { stripAnsi } from "../agent/command-policy.js";
+import { Workspace } from "../filesystem/workspace.js";
+import { redact } from "../security/redact.js";
+import { palette } from "./theme.js";
+export function inspectWorkspace(cwd, exists) {
+    try {
+        const workspace = Workspace.open(cwd);
+        return {
+            root: workspace.root,
+            isGitRepository: exists(`${workspace.root}/.git`),
+        };
+    }
+    catch (error) {
+        return {
+            problem: error instanceof Error ? error.message : String(error),
+            isGitRepository: false,
+        };
+    }
+}
+export function renderWorkspaceSummary(facts, capabilities) {
+    const { bold, dim } = palette(capabilities);
+    if (facts.root === undefined) {
+        return `  ${bold("workspace")}  unavailable: ${safe(facts.problem ?? "")}\n`;
+    }
+    const lines = [
+        `  ${bold("workspace")}  ${safe(facts.root)}`,
+        dim(`  ${facts.isGitRepository ? "a git repository" : "not a git repository"}`),
+        // Said up front, every session: the defaults are the permission model, and
+        // a user should not have to find them in a manual.
+        dim("  the agent starts read-only; writing and running commands are"),
+        dim("  opt-in per run and every change is shown before it is applied"),
+    ];
+    return lines.join("\n") + "\n";
+}
+/**
+ * A path is not trusted text. It comes from the filesystem, which a cloned
+ * repository can influence, and it is on a direct path to the terminal - so it
+ * is stripped of control sequences and passed through the redactor in case a
+ * directory name carries something that looks like a key.
+ */
+function safe(text) {
+    return redact(stripAnsi(text));
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mafdet/cli",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Mafdet AI command line — model calls, account queries, and a permissioned local agent.",
   "type": "module",
   "license": "MIT",