@nimbus-sh/cli 0.1.4 → 0.1.6

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Ashish Kumar Singh and Nimbus contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.

package/NOTICE.md

@@ -0,0 +1,4 @@
+# Notices
+
+This package is part of Nimbus. See the project notices at
+https://github.com/AshishKumar4/Nimbus/blob/main/NOTICE.md.

package/README.md

@@ -24,6 +24,9 @@ bun packages/cli/src/scaffold-bin.ts my-app
 ### `nimbus init [directory]`
 
 Scaffolds a Nimbus-powered Workers project. `.` uses the current directory.
+The generated app embeds the interactive Nimbus UI and enables the
+authenticated remote sandbox API. Add application-specific auth routes in
+`src/index.ts` when you are ready to mint user tokens from your backend.
 
 ```bash
 nimbus init my-nimbus
@@ -36,7 +39,8 @@ npx wrangler deploy
 
 ### `create-nimbus-app <name>`
 
-Scaffolds a new Nimbus-powered Workers project.
+Scaffolds a new Nimbus-powered Workers project with the same template as
+`nimbus init`.
 
 ```bash
 create-nimbus-app my-nimbus
@@ -93,6 +97,9 @@ Flags:
 | `--scopes <a,b>` | Comma-separated capability scopes. |
 | `--sid <id>` | Pin token to a specific session ID. |
 
+Use `--scopes sandbox:use --sid <sandbox-id>` for remote SDK calls through
+`Nimbus.connect(...)`.
+
 ### `nimbus token verify <token>`
 
 ```bash

package/dist/commands/runtime-sync.d.ts

@@ -10,14 +10,11 @@
  *     (`nimbus runtime sync python clang`) or comma-separated via
  *     `--runtimes python,clang`.
  *
- * Implementation: shells out to wrangler r2 object put for each blob
- * listed in `@nimbus-sh/worker`'s bundled `scripts/bundle-runtime.mjs`.
- * The actual fetch+verify+upload work lives in that script; this CLI
- * is a thin proxy.
+ * Implementation: shells out to the runtime bundling helper shipped in
+ * `@nimbus-sh/worker`. The CLI is the supported operator entrypoint.
  */
 /**
- * Sync runtime blobs to an R2 bucket via the bundled
- * `bundle-runtime.mjs` script.
+ * Sync runtime blobs to an R2 bucket via the bundled worker helper.
  *
  * @example
  * ```bash

package/dist/commands/runtime-sync.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"runtime-sync.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAeH;;;;;;;;;GASG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsClE;AAED,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE"}
+{"version":3,"file":"runtime-sync.d.ts","sourceRoot":"","sources":["../../src/commands/runtime-sync.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAcH;;;;;;;;GAQG;AACH,wBAAsB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAoClE;AAED,uEAAuE;AACvE,wBAAsB,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAUnE"}

package/dist/commands/runtime-sync.js

@@ -10,15 +10,12 @@
  *     (`nimbus runtime sync python clang`) or comma-separated via
  *     `--runtimes python,clang`.
  *
- * Implementation: shells out to wrangler r2 object put for each blob
- * listed in `@nimbus-sh/worker`'s bundled `scripts/bundle-runtime.mjs`.
- * The actual fetch+verify+upload work lives in that script; this CLI
- * is a thin proxy.
+ * Implementation: shells out to the runtime bundling helper shipped in
+ * `@nimbus-sh/worker`. The CLI is the supported operator entrypoint.
  */
 import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { dirname, join } from 'node:path';
 import { fileURLToPath } from 'node:url';
 const nodeRequire = createRequire(import.meta.url);
 const DEFAULT_RUNTIME_VERSIONS = {
@@ -27,8 +24,7 @@ const DEFAULT_RUNTIME_VERSIONS = {
     ruby: '3.3.4',
 };
 /**
- * Sync runtime blobs to an R2 bucket via the bundled
- * `bundle-runtime.mjs` script.
+ * Sync runtime blobs to an R2 bucket via the bundled worker helper.
  *
  * @example
  * ```bash
@@ -46,12 +42,10 @@ export async function syncRuntimes(args) {
         process.stderr.write('nimbus runtime sync: CLOUDFLARE_ACCOUNT_ID env var required\n');
         return 78;
     }
-    // Locate the bundle-runtime.mjs script in `@nimbus-sh/worker`. When
-    // installed via npm, resolve via require; in workspace dogfood, use
-    // a relative path.
+    // Locate the runtime sync helper in `@nimbus-sh/worker`.
     const scriptPath = resolveBundleRuntimeScript();
     if (!scriptPath) {
-        process.stderr.write('nimbus runtime sync: cannot locate @nimbus-sh/worker/scripts/bundle-runtime.mjs\n');
+        process.stderr.write('nimbus runtime sync: cannot locate Nimbus runtime sync helper\n');
         return 70;
     }
     process.stderr.write(`nimbus: syncing runtimes [${runtimes.join(', ')}] → r2://${bucket}\n`);
@@ -85,20 +79,16 @@ export async function listRuntimes(_args) {
 }
 // ── helpers ──────────────────────────────────────────────────────────
 function resolveBundleRuntimeScript() {
-    // 1. Try resolving via the @nimbus-sh/worker package (npm-installed).
     try {
-        const packageJson = nodeRequire.resolve('@nimbus-sh/worker/package.json');
-        const script = join(dirname(packageJson), 'scripts', 'bundle-runtime.mjs');
+        const script = nodeRequire.resolve('@nimbus-sh/worker/runtime-sync-helper');
         if (existsSync(script))
             return script;
     }
     catch {
-        // fallthrough
+        // Source-workspace mode can run before workspace packages are linked.
     }
-    // 2. Workspace dogfood — relative path inside the monorepo.
     try {
-        const wsUrl = new URL('../../../worker/scripts/bundle-runtime.mjs', import.meta.url);
-        const script = fileURLToPath(wsUrl);
+        const script = fileURLToPath(new URL('../../../worker/scripts/bundle-runtime.mjs', import.meta.url));
         return existsSync(script) ? script : null;
     }
     catch {

package/dist/commands/scaffold.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAsF9D"}
+{"version":3,"file":"scaffold.d.ts","sourceRoot":"","sources":["../../src/commands/scaffold.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAKH;;;;;;;GAOG;AACH,wBAAsB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAuF9D"}

package/dist/commands/scaffold.js

@@ -96,8 +96,9 @@ Next steps:
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
-Deploy will provision the Durable Object on first run. Visit the returned
-URL and hit "Launch" to mint a session.
+Deploy will provision the Durable Object on first use. Mint a token with
+\`nimbus token mint\` before attaching an interactive session or remote SDK
+sandbox.
 
 Docs: https://github.com/AshishKumar4/Nimbus#readme
 `);
@@ -124,8 +125,9 @@ function renderPackageJson(name) {
             typecheck: 'tsc --noEmit',
         },
         dependencies: {
-            '@nimbus-sh/worker': '^0.1.1',
-            '@nimbus-sh/sdk': '^0.1.1',
+            '@nimbus-sh/config': '^0.1.2',
+            '@nimbus-sh/worker': '^0.1.3',
+            '@nimbus-sh/sdk': '^0.1.3',
         },
         devDependencies: {
             '@cloudflare/workers-types': '^4.20250327.0',
@@ -146,7 +148,7 @@ function renderWranglerJsonc(name) {
   "assets": {
     "directory": "node_modules/@nimbus-sh/worker/public",
     "binding": "ASSETS",
-    "run_worker_first": ["/s/*", "/new"]
+    "run_worker_first": ["/api/*", "/s/*", "/new"]
   },
 
   // The Node-compat shims isomorphic-git + the npm installer need. Do
@@ -198,6 +200,7 @@ function renderIndexTs() {
   CirrusHmrRPC,
   createNimbusHandler,
 } from '@nimbus-sh/sdk/worker';
+import { defineNimbusConfig } from '@nimbus-sh/config';
 
 // Re-export the DO class + every RPC class so wrangler's
 // \`durable_objects.bindings[].class_name\` lookup + \`enable_ctx_exports\`
@@ -214,7 +217,26 @@ export {
   CirrusHmrRPC,
 };
 
-export default createNimbusHandler();
+const nimbusConfig = defineNimbusConfig({
+  sandboxes: {
+    default: {
+      root: '/home/user',
+      runtimes: {
+        preinstall: ['python'],
+        onDemand: true,
+        allow: ['node', 'bun', 'npm', 'git', 'python', 'ruby', 'clang', 'shell'],
+      },
+      tools: { namespace: 'sandbox', kind: 'sandbox' },
+    },
+  },
+});
+
+export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
+});
 `;
 }
 function renderTsconfig() {
@@ -246,19 +268,27 @@ npx wrangler secret put JWT_SECRET      # paste a 32+ char hex secret
 npx wrangler deploy
 \`\`\`
 
-Then visit the URL wrangler prints. Click "Launch" to mint a session.
+Then visit the URL wrangler prints.
 
 If setup reports Cloudflare R2 error 10042, enable R2 in the Cloudflare
 Dashboard once for this account, then rerun the setup command.
 
-## Custom auth
+## Tokens
 
-By default tokens are enforced (\`JWT_SECRET\` set). To mint:
+By default tokens are enforced because \`JWT_SECRET\` is set. Mint a token for
+an interactive session or remote SDK sandbox:
 
 \`\`\`bash
-JWT_SECRET=<your-secret> npx @nimbus-sh/cli token mint --tenant acme --sub alice
+JWT_SECRET=<your-secret> npx @nimbus-sh/cli token mint \\
+  --tenant acme \\
+  --sub alice \\
+  --scopes sandbox:use \\
+  --sid job-123
 \`\`\`
 
+Use the token with \`@nimbus-sh/react\`, \`sessionAttachUrl(...)\`, or
+\`Nimbus.connect({ endpoint, token })\`.
+
 Embed in a React app:
 
 \`\`\`tsx
@@ -274,15 +304,17 @@ import { NimbusTerminal } from '@nimbus-sh/react';
 
 ## Customize
 
-Edit \`src/index.ts\`:
+In \`src/index.ts\`, keep the generated exports and \`nimbusConfig\`, then
+replace the \`export default\` block:
 
 \`\`\`ts
-import { NimbusSession, createNimbusHandler } from '@nimbus-sh/sdk/worker';
 import { issueNimbusToken } from '@nimbus-sh/sdk/token';
 
-export { NimbusSession };
-
 export default createNimbusHandler({
+  sdk: {
+    remote: true,
+    config: nimbusConfig,
+  },
   hooks: {
     onSessionStart: ({ sessionId, tenantSegment }) => {
       console.log(\`session \${sessionId} for \${tenantSegment}\`);
@@ -290,8 +322,13 @@ export default createNimbusHandler({
   },
   routes: async (req, env) => {
     if (new URL(req.url).pathname === '/api/auth/mint') {
+      // Authenticate your application user before minting.
       const { tenant, sub } = await req.json();
-      const token = await issueNimbusToken(env, { tn: tenant, sub });
+      const token = await issueNimbusToken(env, {
+        tn: tenant,
+        sub,
+        scopes: ['sandbox:use'],
+      });
       return Response.json({ token });
     }
     return null;

package/dist/commands/session.js

@@ -8,7 +8,8 @@ export async function newSession(args) {
         ?? process.env.NIMBUS_ENDPOINT
         ?? 'http://127.0.0.1:8787';
     try {
-        const r = await fetch(`${endpoint.replace(/\/+$/, '')}/new`, {
+        const baseUrl = new URL(endpoint);
+        const r = await fetch(new URL('/new', baseUrl), {
             method: 'POST',
             redirect: 'manual',
         });
@@ -17,13 +18,12 @@ export async function newSession(args) {
             process.stderr.write(`nimbus session new: POST /new returned no Location (status ${r.status})\n`);
             return 70;
         }
-        const m = loc.match(/\/s\/([^/]+)/);
-        if (!m) {
+        const sessionId = sessionIdFromLocation(loc, baseUrl);
+        if (!sessionId) {
             process.stderr.write(`nimbus session new: unexpected Location: ${loc}\n`);
             return 70;
         }
-        const sessionId = m[1];
-        const url = `${endpoint.replace(/\/+$/, '')}/s/${sessionId}/`;
+        const url = new URL(`/s/${encodeURIComponent(sessionId)}/`, baseUrl).toString();
         process.stdout.write(JSON.stringify({ sessionId, url }) + '\n');
         return 0;
     }
@@ -43,3 +43,21 @@ function parseFlags(args) {
     }
     return out;
 }
+function sessionIdFromLocation(location, baseUrl) {
+    let url;
+    try {
+        url = new URL(location, baseUrl);
+    }
+    catch {
+        return null;
+    }
+    const segments = url.pathname.split('/').filter(Boolean);
+    if (segments.length < 2 || segments[0] !== 's')
+        return null;
+    try {
+        return decodeURIComponent(segments[1]);
+    }
+    catch {
+        return null;
+    }
+}

package/dist/version.d.ts

@@ -3,5 +3,5 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export declare const CLI_VERSION = "0.1.4";
+export declare const CLI_VERSION = "0.1.6";
 //# sourceMappingURL=version.d.ts.map

package/dist/version.js

@@ -3,4 +3,4 @@
  * `require('./package.json')` because that breaks under bun's
  * single-file binary mode.
  */
-export const CLI_VERSION = '0.1.4';
+export const CLI_VERSION = '0.1.6';

package/package.json

@@ -1,7 +1,14 @@
 {
   "name": "@nimbus-sh/cli",
-  "version": "0.1.4",
+  "version": "0.1.6",
   "description": "Nimbus CLI — `create-nimbus-app` scaffolder + `token mint` + `runtime sync`.",
+  "keywords": [
+    "cloudflare",
+    "workers",
+    "sandbox",
+    "cli",
+    "developer-environment"
+  ],
   "homepage": "https://github.com/AshishKumar4/Nimbus",
   "repository": {
     "type": "git",
@@ -12,9 +19,9 @@
   "license": "MIT",
   "type": "module",
   "bin": {
-    "cli": "./dist/bin.js",
-    "nimbus": "./dist/bin.js",
-    "create-nimbus-app": "./dist/scaffold-bin.js"
+    "cli": "dist/bin.js",
+    "nimbus": "dist/bin.js",
+    "create-nimbus-app": "dist/scaffold-bin.js"
   },
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -28,7 +35,9 @@
   },
   "files": [
     "dist",
-    "README.md"
+    "README.md",
+    "LICENSE",
+    "NOTICE.md"
   ],
   "scripts": {
     "build": "tsc -p tsconfig.json --noCheck --noEmit false --declaration true --declarationMap true --outDir dist --rootDir src && chmod +x dist/bin.js dist/scaffold-bin.js",
@@ -36,8 +45,8 @@
     "typecheck": "tsc --noEmit"
   },
   "dependencies": {
-    "@nimbus-sh/sdk": "^0.1.1",
-    "@nimbus-sh/worker": "^0.1.1"
+    "@nimbus-sh/sdk": "^0.1.3",
+    "@nimbus-sh/worker": "^0.1.3"
   },
   "engines": {
     "node": ">=20"