@nimbus-sh/cli 0.1.3 → 0.1.5

package/README.md

@@ -24,6 +24,9 @@ bun packages/cli/src/scaffold-bin.ts my-app
 ### `nimbus init [directory]`
 
 Scaffolds a Nimbus-powered Workers project. `.` uses the current directory.
+The generated app embeds the interactive Nimbus UI and enables the
+authenticated remote sandbox API. Add application-specific auth routes in
+`src/index.ts` when you are ready to mint user tokens from your backend.
 
 ```bash
 nimbus init my-nimbus
@@ -36,7 +39,8 @@ npx wrangler deploy
 
 ### `create-nimbus-app <name>`
 
-Scaffolds a new Nimbus-powered Workers project.
+Scaffolds a new Nimbus-powered Workers project with the same template as
+`nimbus init`.
 
 ```bash
 create-nimbus-app my-nimbus
@@ -93,6 +97,9 @@ Flags:
 | `--scopes <a,b>` | Comma-separated capability scopes. |
 | `--sid <id>` | Pin token to a specific session ID. |
 
+Use `--scopes sandbox:use --sid <sandbox-id>` for remote SDK calls through
+`Nimbus.connect(...)`.
+
 ### `nimbus token verify <token>`
 
 ```bash

package/dist/commands/runtime-sync.d.ts

@@ -10,14 +10,11 @@
  *     (`nimbus runtime sync python clang`) or comma-separated via
  *     `--runtimes python,clang`.
  *
- * Implementation: shells out to wrangler r2 object put for each blob
- * listed in `@nimbus-sh/worker`'s bundled `scripts/bundle-runtime.mjs`.
- * The actual fetch+verify+upload work lives in that script; this CLI
- * is a thin proxy.
+ * Implementation: shells out to the runtime bundling helper shipped in
+ * `@nimbus-sh/worker`. The CLI is the supported operator entrypoint.
  */
 /**
- * Sync runtime blobs to an R2 bucket via the bundled
- * `bundle-runtime.mjs` script.
+ * Sync runtime blobs to an R2 bucket via the bundled worker helper.
  *
  * @example
  * ```bash

package/dist/commands/runtime-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-sync.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsClE;AAED,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE"}
+{"version":3,"file":"runtime-sync.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoClE;AAED,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE"}

package/dist/commands/runtime-sync.js

@@ -10,15 +10,12 @@
  *     (`nimbus runtime sync python clang`) or comma-separated via
  *     `--runtimes python,clang`.
  *
- * Implementation: shells out to wrangler r2 object put for each blob
- * listed in `@nimbus-sh/worker`'s bundled `scripts/bundle-runtime.mjs`.
- * The actual fetch+verify+upload work lives in that script; this CLI
- * is a thin proxy.
+ * Implementation: shells out to the runtime bundling helper shipped in
+ * `@nimbus-sh/worker`. The CLI is the supported operator entrypoint.
  */
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const nodeRequire = createRequire(import.meta.url);
 const DEFAULT_RUNTIME_VERSIONS = {
@@ -27,8 +24,7 @@ const DEFAULT_RUNTIME_VERSIONS = {
     ruby: '3.3.4',
 };
 /**
- * Sync runtime blobs to an R2 bucket via the bundled
- * `bundle-runtime.mjs` script.
+ * Sync runtime blobs to an R2 bucket via the bundled worker helper.
  *
  * @example
  * ```bash
@@ -46,12 +42,10 @@ export async function syncRuntimes(args) {
         process.stderr.write('nimbus runtime sync: CLOUDFLARE_ACCOUNT_ID env var required\n');
         return 78;
     }
-    // Locate the bundle-runtime.mjs script in `@nimbus-sh/worker`. When
-    // installed via npm, resolve via require; in workspace dogfood, use
-    // a relative path.
+    // Locate the runtime sync helper in `@nimbus-sh/worker`.
     const scriptPath = resolveBundleRuntimeScript();
     if (!scriptPath) {
-        process.stderr.write('nimbus runtime sync: cannot locate @nimbus-sh/worker/scripts/bundle-runtime.mjs\n');
+        process.stderr.write('nimbus runtime sync: cannot locate Nimbus runtime sync helper\n');
         return 70;
     }
     process.stderr.write(`nimbus: syncing runtimes [${runtimes.join(', ')}] → r2://${bucket}\n`);
@@ -85,20 +79,16 @@ export async function listRuntimes(_args) {
 }
 // ── helpers ──────────────────────────────────────────────────────────
 function resolveBundleRuntimeScript() {
-    // 1. Try resolving via the @nimbus-sh/worker package (npm-installed).
     try {
-        const packageJson = nodeRequire.resolve('@nimbus-sh/worker/package.json');
-        const script = join(dirname(packageJson), 'scripts', 'bundle-runtime.mjs');
+        const script = nodeRequire.resolve('@nimbus-sh/worker/runtime-sync-helper');
         if (existsSync(script))
             return script;
     }
     catch {
-        // fallthrough
+        // Source-workspace mode can run before workspace packages are linked.
     }
-    // 2. Workspace dogfood — relative path inside the monorepo.
     try {
-        const wsUrl = new URL('../../../worker/scripts/bundle-runtime.mjs', import.meta.url);
-        const script = fileURLToPath(wsUrl);
+        const script = fileURLToPath(new URL('../../../worker/scripts/bundle-runtime.mjs', import.meta.url));
         return existsSync(script) ? script : null;
     }
     catch {

package/dist/commands/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF9D"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuF9D"}

package/dist/commands/scaffold.js

@@ -16,7 +16,7 @@
  * print the exact commands to run as a "next steps" trailer.
  */
 import { mkdirSync, writeFileSync, existsSync } from 'node:fs';
-import { resolve, join, basename } from 'node:path';
+import { resolve, join, basename, relative } from 'node:path';
 /**
  * Scaffold a new Nimbus project at the given directory.
  *
@@ -41,15 +41,16 @@ Options:
         return 0;
     }
     const rawProjectName = args[0];
-    const projectName = rawProjectName === '.'
-        ? basename(process.cwd())
-        : rawProjectName;
-    if (!projectName || projectName.startsWith('-')) {
+    if (!rawProjectName || rawProjectName.startsWith('-')) {
         process.stderr.write('create-nimbus-app: <project-name> required\n');
         process.stderr.write('Usage: create-nimbus-app my-app [--name my-worker] [--force]\n');
         return 64;
     }
     const parsed = parseFlags(args.slice(1));
+    const target = rawProjectName === '.'
+        ? process.cwd()
+        : resolve(process.cwd(), rawProjectName);
+    const projectName = basename(target);
     const wranglerName = parsed['--name'] || projectName;
     const force = '--force' in parsed;
     const template = parsed['--template'] || 'worker-only';
@@ -57,9 +58,6 @@ Options:
         process.stderr.write(`create-nimbus-app: unknown template "${template}". Only "worker-only" ships in v0.1.\n`);
         return 64;
     }
-    const target = rawProjectName === '.'
-        ? process.cwd()
-        : resolve(process.cwd(), projectName);
     if (existsSync(target) && !force) {
         process.stderr.write(`create-nimbus-app: directory exists: ${target} (use --force to overwrite)\n`);
         return 73;
@@ -72,12 +70,13 @@ Options:
     writeFileSync(join(target, 'README.md'), renderReadme(projectName, wranglerName));
     writeFileSync(join(target, '.gitignore'), '.wrangler\nnode_modules\ndist\n');
     writeFileSync(join(target, 'tsconfig.json'), renderTsconfig());
+    const cdTarget = renderCdTarget(target);
     // Stdout — JSON for machine, friendly stderr for humans.
     process.stdout.write(JSON.stringify({
         ok: true,
         path: target,
         nextSteps: [
-            `cd ${projectName}`,
+            `cd ${cdTarget}`,
             'npm install',
             `CLOUDFLARE_ACCOUNT_ID=<account-id> npx @nimbus-sh/cli setup cloudflare --name ${wranglerName}`,
             'npx wrangler secret put JWT_SECRET',
@@ -88,7 +87,7 @@ Options:
 ✨ Scaffolded ${projectName} at ${target}
 
 Next steps:
-  cd ${projectName}
+  cd ${cdTarget}
   npm install
   CLOUDFLARE_ACCOUNT_ID=<account-id> npx @nimbus-sh/cli setup cloudflare --name ${wranglerName}
   npx wrangler secret put JWT_SECRET       # paste a 32+ char hex secret
@@ -97,14 +96,23 @@ Next steps:
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
-Deploy will provision the Durable Object on first run. Visit the returned
-URL and hit "Launch" to mint a session.
+Deploy will provision the Durable Object on first use. Mint a token with
+\`nimbus token mint\` before attaching an interactive session or remote SDK
+sandbox.
 
 Docs: https://github.com/AshishKumar4/Nimbus#readme
 `);
     return 0;
 }
 // ── template renderers ──────────────────────────────────────────────
+function renderCdTarget(target) {
+    const rel = relative(process.cwd(), target);
+    if (!rel)
+        return '.';
+    if (!rel.startsWith('..') && !rel.startsWith('/'))
+        return rel;
+    return target;
+}
 function renderPackageJson(name) {
     return JSON.stringify({
         name,
@@ -117,8 +125,9 @@ function renderPackageJson(name) {
             typecheck: 'tsc --noEmit',
         },
         dependencies: {
-            '@nimbus-sh/worker': '^0.1.1',
-            '@nimbus-sh/sdk': '^0.1.1',
+            '@nimbus-sh/config': '^0.1.1',
+            '@nimbus-sh/worker': '^0.1.2',
+            '@nimbus-sh/sdk': '^0.1.2',
         },
         devDependencies: {
             '@cloudflare/workers-types': '^4.20250327.0',
@@ -139,7 +148,7 @@ function renderWranglerJsonc(name) {
   "assets": {
     "directory": "node_modules/@nimbus-sh/worker/public",
     "binding": "ASSETS",
-    "run_worker_first": ["/s/*", "/new"]
+    "run_worker_first": ["/api/*", "/s/*", "/new"]
   },
 
   // The Node-compat shims isomorphic-git + the npm installer need. Do
@@ -191,6 +200,7 @@ function renderIndexTs() {
   CirrusHmrRPC,
   createNimbusHandler,
 } from '@nimbus-sh/sdk/worker';
+import { defineNimbusConfig } from '@nimbus-sh/config';
 
 // Re-export the DO class + every RPC class so wrangler's
 // \`durable_objects.bindings[].class_name\` lookup + \`enable_ctx_exports\`
@@ -207,7 +217,26 @@ export {
   CirrusHmrRPC,
 };
 
-export default createNimbusHandler();
+const nimbusConfig = defineNimbusConfig({
+  sandboxes: {
+    default: {
+      root: '/home/user',
+      runtimes: {
+        preinstall: ['python'],
+        onDemand: true,
+        allow: ['node', 'bun', 'npm', 'git', 'python', 'ruby', 'clang', 'shell'],
+      },
+      tools: { namespace: 'sandbox', kind: 'sandbox' },
+    },
+  },
+});
+
+export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
+});
 `;
 }
 function renderTsconfig() {
@@ -239,19 +268,27 @@ npx wrangler secret put JWT_SECRET      # paste a 32+ char hex secret
 npx wrangler deploy
 \`\`\`
 
-Then visit the URL wrangler prints. Click "Launch" to mint a session.
+Then visit the URL wrangler prints.
 
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
-## Custom auth
+## Tokens
 
-By default tokens are enforced (\`JWT_SECRET\` set). To mint:
+By default tokens are enforced because \`JWT_SECRET\` is set. Mint a token for
+an interactive session or remote SDK sandbox:
 
 \`\`\`bash
-JWT_SECRET=<your-secret> npx @nimbus-sh/cli token mint --tenant acme --sub alice
+JWT_SECRET=<your-secret> npx @nimbus-sh/cli token mint \\
+  --tenant acme \\
+  --sub alice \\
+  --scopes sandbox:use \\
+  --sid job-123
 \`\`\`
 
+Use the token with \`@nimbus-sh/react\`, \`sessionAttachUrl(...)\`, or
+\`Nimbus.connect({ endpoint, token })\`.
+
 Embed in a React app:
 
 \`\`\`tsx
@@ -267,15 +304,17 @@ import { NimbusTerminal } from '@nimbus-sh/react';
 
 ## Customize
 
-Edit \`src/index.ts\`:
+In \`src/index.ts\`, keep the generated exports and \`nimbusConfig\`, then
+replace the \`export default\` block:
 
 \`\`\`ts
-import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
 import { issueNimbusToken } from '@nimbus-sh/sdk/token';
 
-export { NimbusSession };
-
 export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
   hooks: {
     onSessionStart: ({ sessionId, tenantSegment }) => {
       console.log(\`session \${sessionId} for \${tenantSegment}\`);
@@ -283,8 +322,13 @@ export default createNimbusHandler({
   },
   routes: async (req, env) => {
     if (new URL(req.url).pathname === '/api/auth/mint') {
+      // Authenticate your application user before minting.
       const { tenant, sub } = await req.json();
-      const token = await issueNimbusToken(env, { tn: tenant, sub });
+      const token = await issueNimbusToken(env, {
+        tn: tenant,
+        sub,
+        scopes: ['sandbox:use'],
+      });
       return Response.json({ token });
     }
     return null;

package/dist/commands/session.js

@@ -8,7 +8,8 @@ export async function newSession(args) {
         ?? process.env.NIMBUS_ENDPOINT
         ?? 'http://127.0.0.1:8787';
     try {
-        const r = await fetch(`${endpoint.replace(/\/+$/, '')}/new`, {
+        const baseUrl = new URL(endpoint);
+        const r = await fetch(new URL('/new', baseUrl), {
             method: 'POST',
             redirect: 'manual',
         });
@@ -17,13 +18,12 @@ export async function newSession(args) {
             process.stderr.write(`nimbus session new: POST /new returned no Location (status ${r.status})\n`);
             return 70;
         }
-        const m = loc.match(/\/s\/([^/]+)/);
-        if (!m) {
+        const sessionId = sessionIdFromLocation(loc, baseUrl);
+        if (!sessionId) {
             process.stderr.write(`nimbus session new: unexpected Location: ${loc}\n`);
             return 70;
         }
-        const sessionId = m[1];
-        const url = `${endpoint.replace(/\/+$/, '')}/s/${sessionId}/`;
+        const url = new URL(`/s/${encodeURIComponent(sessionId)}/`, baseUrl).toString();
         process.stdout.write(JSON.stringify({ sessionId, url }) + '\n');
         return 0;
     }
@@ -43,3 +43,21 @@ function parseFlags(args) {
     }
     return out;
 }
+function sessionIdFromLocation(location, baseUrl) {
+    let url;
+    try {
+        url = new URL(location, baseUrl);
+    }
+    catch {
+        return null;
+    }
+    const segments = url.pathname.split('/').filter(Boolean);
+    if (segments.length < 2 || segments[0] !== 's')
+        return null;
+    try {
+        return decodeURIComponent(segments[1]);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export declare const CLI_VERSION = "0.1.3";
+export declare const CLI_VERSION = "0.1.5";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,4 +3,4 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export const CLI_VERSION = '0.1.3';
+export const CLI_VERSION = '0.1.5';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-sh/cli",
-  "version": "0.1.3",
+  "version": "0.1.5",
   "description": "Nimbus CLI — `create-nimbus-app` scaffolder + `token mint` + `runtime sync`.",
   "homepage": "https://github.com/AshishKumar4/Nimbus",
   "repository": {
@@ -12,9 +12,9 @@
   "license": "MIT",
   "type": "module",
   "bin": {
-    "cli": "./dist/bin.js",
-    "nimbus": "./dist/bin.js",
-    "create-nimbus-app": "./dist/scaffold-bin.js"
+    "cli": "dist/bin.js",
+    "nimbus": "dist/bin.js",
+    "create-nimbus-app": "dist/scaffold-bin.js"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -36,8 +36,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/sdk": "^0.1.1",
-    "@nimbus-sh/worker": "^0.1.1"
+    "@nimbus-sh/sdk": "^0.1.2",
+    "@nimbus-sh/worker": "^0.1.2"
   },
   "engines": {
     "node": ">=20"