@nonbot/cli 0.9.13 → 0.10.1

package/dist/lib/daemon-lifecycle.js

@@ -9,6 +9,21 @@ function configDir() {
         return override;
     return path.join(homedir(), '.config', 'nonbot');
 }
+export function shutdownIssuedAt(signal) {
+    if (!signal)
+        return null;
+    for (const v of [signal.requestedAt, signal.issuedAt]) {
+        if (typeof v === 'number' && Number.isFinite(v))
+            return v;
+    }
+    return null;
+}
+export function shutdownPredatesDaemon(signal, daemonStartedAt) {
+    const issuedAt = shutdownIssuedAt(signal);
+    if (issuedAt === null)
+        return false;
+    return issuedAt < daemonStartedAt;
+}
 export function pidFilePath(dir = configDir()) {
     return path.join(dir, 'daemon.pid');
 }

package/dist/lib/exit-transcript.js

@@ -0,0 +1,74 @@
+import { captureSnapshotPane, scrubSnapshot, clampSnapshotTail, SNAPSHOT_MAX_BYTES, } from './snapshot.js';
+import { appendActivityLog } from './activity-log.js';
+export const EXIT_TRANSCRIPT_KIND = 'exit-transcript';
+export const EXIT_TRANSCRIPT_LINES = 200;
+export const EXIT_TRANSCRIPT_MAX_BYTES = SNAPSHOT_MAX_BYTES;
+export const EXIT_TRANSCRIPT_OPT_OUT_ENV = 'NONBOT_NO_EXIT_TRANSCRIPT';
+export function exitTranscriptDisabled(env = process.env) {
+    const v = env[EXIT_TRANSCRIPT_OPT_OUT_ENV];
+    if (typeof v !== 'string')
+        return false;
+    const t = v.trim().toLowerCase();
+    return t === '1' || t === 'true';
+}
+export function refreshPaneTails(opts) {
+    const now = opts.now ?? Date.now;
+    const maxLines = opts.maxLines ?? EXIT_TRANSCRIPT_LINES;
+    let refreshed = 0;
+    for (const [activationId, paneId] of opts.tracked) {
+        let raw = '';
+        try {
+            raw = captureSnapshotPane(paneId, maxLines, opts.spawnImpl);
+        }
+        catch {
+            raw = '';
+        }
+        if (raw === '')
+            continue;
+        const { text, truncated } = clampSnapshotTail(scrubSnapshot(raw), EXIT_TRANSCRIPT_MAX_BYTES);
+        opts.tails.set(activationId, {
+            text,
+            truncated,
+            capturedAt: now(),
+            lines: text.length === 0 ? 0 : text.split('\n').length,
+        });
+        refreshed++;
+    }
+    return refreshed;
+}
+export function buildExitTranscriptEntry(opts) {
+    return {
+        ts: opts.ts,
+        id: opts.id,
+        kind: EXIT_TRANSCRIPT_KIND,
+        status: opts.status,
+        profile: opts.profile,
+        capturedAt: opts.tail.capturedAt,
+        lines: opts.tail.lines,
+        truncated: opts.tail.truncated,
+        tail: opts.tail.text,
+    };
+}
+export async function flushExitTranscripts(opts) {
+    const now = opts.now ?? Date.now;
+    const append = opts.append ?? ((entry) => appendActivityLog(entry));
+    const written = [];
+    for (const [id, tail] of [...opts.tails.entries()]) {
+        if (opts.tracked.has(id))
+            continue;
+        const status = opts.statusFor(id);
+        const entry = buildExitTranscriptEntry({ id, tail, status, profile: opts.profile, ts: now() });
+        try {
+            await append(entry);
+            written.push(id);
+            opts.log?.(`· ${id} · exit transcript saved (${entry.lines} lines${entry.truncated ? ', clamped' : ''} · ${status}) → activations.log\n`);
+        }
+        catch {
+            opts.log?.(`⚠ ${id} · exit transcript not saved (activations.log write failed)\n`);
+        }
+        finally {
+            opts.tails.delete(id);
+        }
+    }
+    return written;
+}

package/dist/lib/machine.js

@@ -13,6 +13,13 @@ export function machineFilePath(dir = configDir()) {
     return path.join(dir, 'machine.json');
 }
 export function loadOrCreateMachineId(deps = {}) {
+    const env = deps.env ?? process.env;
+    const fromEnv = env.NONBOT_MACHINE_ID;
+    if (typeof fromEnv === 'string') {
+        const trimmed = fromEnv.trim();
+        if (trimmed.length > 0)
+            return trimmed.slice(0, 128);
+    }
     const fs = deps.fs ?? nodeFs;
     const uuid = deps.uuid ?? randomUUID;
     const dir = deps.dir ?? configDir();

package/dist/lib/payload-validator.js

@@ -14,6 +14,8 @@ const STORY_TITLE_MAX = 200;
 const AGENTS_MD_MAX = 24 * 1024;
 const REPO_PATH_MAX = 1024;
 const AGENTS_MD_HEREDOC_DELIMITER = 'NONBOT_AGENTS_EOF';
+const REPO_URL_MAX = 512;
+const REPO_REF_RE = /^[A-Za-z0-9._/-]{1,128}$/;
 const THEME_ID_MAX = 128;
 const THEME_NAME_MAX = 128;
 const THEME_TMUX_CONF_MAX = 8 * 1024;
@@ -50,6 +52,55 @@ export function validateRepoPath(s, opts = {}) {
     }
     return s;
 }
+export function validateRepoUrl(s) {
+    if (s === undefined || s === null || s === '')
+        return undefined;
+    if (typeof s !== 'string') {
+        throw new ValidationError('repoUrl', 'must be a string');
+    }
+    if (s.length > REPO_URL_MAX) {
+        throw new ValidationError('repoUrl', `exceeds ${REPO_URL_MAX} chars`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(s);
+    }
+    catch {
+        throw new ValidationError('repoUrl', 'must be a parseable absolute URL');
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new ValidationError('repoUrl', 'must use https');
+    }
+    if (parsed.username || parsed.password) {
+        throw new ValidationError('repoUrl', 'must not embed credentials');
+    }
+    if (/[\s'"`;|&<>\\\n\0$]/.test(s)) {
+        throw new ValidationError('repoUrl', 'contains shell metacharacters');
+    }
+    return s;
+}
+export function repoUrlLooksSafe(url) {
+    if (typeof url !== 'string' || url.length === 0)
+        return false;
+    try {
+        validateRepoUrl(url);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function validateRepoRef(s) {
+    if (s === undefined || s === null || s === '')
+        return undefined;
+    if (typeof s !== 'string') {
+        throw new ValidationError('repoRef', 'must be a string');
+    }
+    if (!REPO_REF_RE.test(s)) {
+        throw new ValidationError('repoRef', `must match /^[A-Za-z0-9._/-]{1,128}$/ (got ${JSON.stringify(s.slice(0, 64))})`);
+    }
+    return s;
+}
 export function validateStoryTitle(s) {
     if (s === undefined || s === null)
         return undefined;
@@ -96,7 +147,22 @@ const TMUX_SAFE_DIRECTIVES = new Set([
 ]);
 const TMUX_FORBIDDEN_OPTIONS = new Set([
     'default-command', 'default-shell', 'command-alias',
+    'lock-command', 'copy-command', 'editor',
+]);
+const TMUX_SAFE_OPTION_SUFFIXES = [
+    '-style', '-format', '-bg', '-fg', '-attr', '-colour', '-color', '-length',
+];
+const TMUX_SAFE_OPTION_NAMES = new Set([
+    'status', 'status-position', 'status-justify', 'status-interval',
+    'window-status-separator', 'pane-border-status', 'pane-border-indicators',
 ]);
+function isSafeTmuxOptionName(name) {
+    if (TMUX_FORBIDDEN_OPTIONS.has(name))
+        return false;
+    if (TMUX_SAFE_OPTION_NAMES.has(name))
+        return true;
+    return TMUX_SAFE_OPTION_SUFFIXES.some((suffix) => name.endsWith(suffix));
+}
 export function isSafeTmuxConf(conf) {
     for (const rawLine of conf.split(/\r?\n/)) {
         const line = rawLine.trim();
@@ -119,6 +185,9 @@ export function isSafeTmuxConf(conf) {
                 if (TMUX_FORBIDDEN_OPTIONS.has(tok))
                     return false;
             }
+            const optionName = tokens.slice(1).find((t) => !t.startsWith('-'));
+            if (!optionName || !isSafeTmuxOptionName(optionName))
+                return false;
         }
     }
     return true;

package/dist/lib/run-prompt.js

@@ -112,6 +112,24 @@ export async function reportPrompt(args) {
         return false;
     }
 }
+export function normalizeAnsweredPrompts(raw) {
+    if (!Array.isArray(raw))
+        return [];
+    const out = [];
+    for (const r of raw.slice(0, ANSWERED_MAX)) {
+        if (!r || typeof r.promptId !== 'string' || typeof r.activationId !== 'string')
+            continue;
+        out.push({
+            promptId: r.promptId,
+            activationId: r.activationId,
+            paneId: typeof r.paneId === 'string' && r.paneId.length > 0 ? r.paneId : null,
+            answerIndex: typeof r.answerIndex === 'number' ? r.answerIndex : null,
+            answerText: typeof r.answerText === 'string' ? r.answerText.slice(0, ANSWER_TEXT_MAX) : null,
+            answeredAt: typeof r.answeredAt === 'number' ? r.answeredAt : undefined,
+        });
+    }
+    return out;
+}
 export async function pollAnsweredPrompts(args) {
     const fetchImpl = args.fetchImpl ?? fetch;
     try {
@@ -126,22 +144,9 @@ export async function pollAnsweredPrompts(args) {
         if (!res.ok)
             return [];
         const data = (await res.json());
-        if (!data || !Array.isArray(data.prompts))
+        if (!data)
             return [];
-        const out = [];
-        for (const r of data.prompts.slice(0, ANSWERED_MAX)) {
-            if (!r || typeof r.promptId !== 'string' || typeof r.activationId !== 'string')
-                continue;
-            out.push({
-                promptId: r.promptId,
-                activationId: r.activationId,
-                paneId: typeof r.paneId === 'string' && r.paneId.length > 0 ? r.paneId : null,
-                answerIndex: typeof r.answerIndex === 'number' ? r.answerIndex : null,
-                answerText: typeof r.answerText === 'string' ? r.answerText.slice(0, ANSWER_TEXT_MAX) : null,
-                answeredAt: typeof r.answeredAt === 'number' ? r.answeredAt : undefined,
-            });
-        }
-        return out;
+        return normalizeAnsweredPrompts(data.prompts);
     }
     catch {
         return [];
@@ -166,12 +171,28 @@ export async function confirmDelivered(args) {
         return false;
     }
 }
+const ANSI_CSI_RE = /\x1B\[[0-?]*[ -/]*[@-~]/g;
+const ANSI_CSI8_RE = /\x9B[0-?]*[ -/]*[@-~]/g;
+const ANSI_OSC_RE = /\x1B\][^\x07\x1B]*(?:\x07|\x1B\\)?/g;
+const ANSI_ESC2_RE = /\x1B[@-~]/g;
+const CONTROL_BYTE_RE = /[\x00-\x1F\x7F-\x9F]/g;
+export function sanitizeAnswerText(text) {
+    if (typeof text !== 'string')
+        return '';
+    return text
+        .replace(ANSI_CSI_RE, '')
+        .replace(ANSI_CSI8_RE, '')
+        .replace(ANSI_OSC_RE, '')
+        .replace(ANSI_ESC2_RE, '')
+        .replace(CONTROL_BYTE_RE, ' ')
+        .trim();
+}
 export function injectAnswer(paneId, answerIndex, answerText, spawnImpl = nodeSpawnSync) {
     if (!PANE_ID_RE.test(paneId))
         return false;
     const keys = answerIndex !== null && Number.isFinite(answerIndex) && answerIndex >= 0
         ? String(answerIndex)
-        : answerText ?? '';
+        : sanitizeAnswerText(answerText ?? '');
     if (keys.length === 0)
         return false;
     try {
@@ -192,7 +213,7 @@ export function injectAnswer(paneId, answerIndex, answerText, spawnImpl = nodeSp
     }
 }
 export async function deliverAnsweredPrompts(opts) {
-    const answered = await pollAnsweredPrompts({
+    const answered = opts.prompts ?? await pollAnsweredPrompts({
         baseUrl: opts.baseUrl,
         pat: opts.pat,
         machineId: opts.machineId,

package/dist/lib/snapshot.js

@@ -27,22 +27,24 @@ export function captureSnapshotPane(paneId, maxLines = MAX_LINES_DEFAULT, spawnI
     }
 }
 const PAT_TOKEN_RE = /pat_[A-Za-z0-9_-]{8,}/g;
-const ENV_EXPORT_LINE_RE = /export NONBOT_(PAT|BASE_URL|RUN_ID|ROLE)=/;
+const ANTHROPIC_KEY_RE = /sk-ant-[A-Za-z0-9_-]{8,}/g;
+const GITHUB_TOKEN_RE = /(?:gh[pousr]_[A-Za-z0-9]{16,}|github_pat_[A-Za-z0-9_]{20,})/g;
+const ENV_ASSIGN_LINE_RE = /(?:^|\s|export )\w*(?:NONBOT_|TOKEN|API_KEY|SECRET)\w*=/;
 const AUTH_BEARER_RE = /Authorization: Bearer \S+/g;
+export function scrubLine(line) {
+    if (ENV_ASSIGN_LINE_RE.test(line) || line.includes('NONBOT_PAT')) {
+        return '[redacted env line]';
+    }
+    return line
+        .replace(GITHUB_TOKEN_RE, '[REDACTED-GIT-TOKEN]')
+        .replace(PAT_TOKEN_RE, 'pat_[REDACTED]')
+        .replace(ANTHROPIC_KEY_RE, 'sk-ant-[REDACTED]')
+        .replace(AUTH_BEARER_RE, 'Authorization: Bearer [REDACTED]');
+}
 export function scrubSnapshot(text) {
     if (typeof text !== 'string' || text.length === 0)
         return '';
-    return text
-        .split('\n')
-        .map((line) => {
-        if (ENV_EXPORT_LINE_RE.test(line) || line.includes('NONBOT_PAT')) {
-            return '[redacted env line]';
-        }
-        return line
-            .replace(PAT_TOKEN_RE, 'pat_[REDACTED]')
-            .replace(AUTH_BEARER_RE, 'Authorization: Bearer [REDACTED]');
-    })
-        .join('\n');
+    return text.split('\n').map(scrubLine).join('\n');
 }
 export function clampSnapshotTail(text, maxBytes = SNAPSHOT_MAX_BYTES) {
     const buf = Buffer.from(text, 'utf-8');

package/dist/lib/terminal.js

@@ -23,6 +23,10 @@ function toOsascriptArgs(lines) {
 export const TMUX_PRESS_KEY_TRAILER = "; printf '\\n%s\\n' 'Run finished — press enter to close'" +
     '; read _' +
     '; tmux kill-pane';
+export function tmuxCloudTrailer(exitFile) {
+    const safe = exitFile.replace(/'/g, `'\\''`);
+    return `; echo $? > '${safe}'`;
+}
 export const TERMINAL_PROFILES = [
     {
         id: 'terminal',
@@ -123,8 +127,9 @@ export const TERMINAL_PROFILES = [
         id: 'tmux',
         displayName: 'tmux pane',
         platform: 'darwin',
-        launch: (s) => {
+        launch: (s, opts) => {
             const safe = s.replace(/'/g, `'\\''`);
+            const trailer = opts?.cloudExitFile ? tmuxCloudTrailer(opts.cloudExitFile) : TMUX_PRESS_KEY_TRAILER;
             return {
                 cmd: 'tmux',
                 args: [
@@ -132,7 +137,7 @@ export const TERMINAL_PROFILES = [
                     '-P',
                     '-F',
                     '#{pane_id}',
-                    `bash '${safe}' 2>&1${TMUX_PRESS_KEY_TRAILER}`,
+                    `bash '${safe}' 2>&1${trailer}`,
                     ';',
                     'select-layout',
                     'tiled',
@@ -186,8 +191,9 @@ export const TERMINAL_PROFILES = [
         id: 'tmux',
         displayName: 'tmux pane',
         platform: 'linux',
-        launch: (s) => {
+        launch: (s, opts) => {
             const safe = s.replace(/'/g, `'\\''`);
+            const trailer = opts?.cloudExitFile ? tmuxCloudTrailer(opts.cloudExitFile) : TMUX_PRESS_KEY_TRAILER;
             return {
                 cmd: 'tmux',
                 args: [
@@ -195,7 +201,7 @@ export const TERMINAL_PROFILES = [
                     '-P',
                     '-F',
                     '#{pane_id}',
-                    `bash '${safe}' 2>&1${TMUX_PRESS_KEY_TRAILER}`,
+                    `bash '${safe}' 2>&1${trailer}`,
                     ';',
                     'select-layout',
                     'tiled',

package/dist/lib/update-check.js

@@ -0,0 +1,99 @@
+import { VERSION } from '../version.js';
+export const NPM_LATEST_URL = 'https://registry.npmjs.org/@nonbot/cli/latest';
+export const UPDATE_CHECK_TIMEOUT_MS = 3_000;
+export const UPDATE_CHECK_INTERVAL_MS = 24 * 60 * 60_000;
+export const UPDATE_CHECK_OPT_OUT_ENV = 'NONBOT_NO_UPDATE_CHECK';
+export function updateCheckDisabled(env = process.env) {
+    const v = env[UPDATE_CHECK_OPT_OUT_ENV];
+    if (typeof v !== 'string')
+        return false;
+    const t = v.trim().toLowerCase();
+    return t === '1' || t === 'true';
+}
+export function parseSemver(v) {
+    if (typeof v !== 'string')
+        return null;
+    const m = /^v?(\d{1,6})\.(\d{1,6})\.(\d{1,6})(?:[-+][0-9A-Za-z.-]{0,64})?$/.exec(v.trim());
+    if (!m)
+        return null;
+    return [Number(m[1]), Number(m[2]), Number(m[3])];
+}
+export function compareVersions(a, b) {
+    const pa = parseSemver(a);
+    const pb = parseSemver(b);
+    if (!pa || !pb)
+        return 0;
+    for (let i = 0; i < 3; i++) {
+        if (pa[i] > pb[i])
+            return 1;
+        if (pa[i] < pb[i])
+            return -1;
+    }
+    return 0;
+}
+export function isNewerVersion(latest, current) {
+    return compareVersions(latest, current) > 0;
+}
+export function updateAvailableLine(current, latest) {
+    return `Update available: @nonbot/cli ${current} → ${latest}  (npm i -g @nonbot/cli)`;
+}
+export async function fetchLatestVersion(opts = {}) {
+    const fetchImpl = opts.fetchImpl ?? fetch;
+    try {
+        const res = await fetchImpl(opts.url ?? NPM_LATEST_URL, {
+            method: 'GET',
+            headers: { Accept: 'application/json' },
+            signal: AbortSignal.timeout(opts.timeoutMs ?? UPDATE_CHECK_TIMEOUT_MS),
+        });
+        if (!res.ok)
+            return null;
+        const body = (await res.json());
+        const version = body?.version;
+        return parseSemver(version) ? String(version).trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
+export function createUpdateChecker(opts) {
+    const current = opts.current ?? VERSION;
+    const env = opts.env ?? process.env;
+    const now = opts.now ?? Date.now;
+    const intervalMs = opts.intervalMs ?? UPDATE_CHECK_INTERVAL_MS;
+    const fetchImpl = opts.fetchImpl === undefined ? fetch : opts.fetchImpl;
+    let lastCheckedAt = null;
+    let latestSeen = null;
+    return {
+        get lastCheckedAt() {
+            return lastCheckedAt;
+        },
+        get latestSeen() {
+            return latestSeen;
+        },
+        async maybeCheck() {
+            if (fetchImpl === null || updateCheckDisabled(env))
+                return false;
+            const t = now();
+            if (lastCheckedAt !== null && t - lastCheckedAt < intervalMs)
+                return false;
+            lastCheckedAt = t;
+            try {
+                const latest = await fetchLatestVersion({
+                    fetchImpl,
+                    timeoutMs: opts.timeoutMs,
+                    url: opts.url,
+                });
+                if (!latest)
+                    return false;
+                latestSeen = latest;
+                if (!isNewerVersion(latest, current))
+                    return false;
+                opts.log(updateAvailableLine(current, latest));
+                return true;
+            }
+            catch {
+                return false;
+            }
+        },
+    };
+}

package/dist/version.js

@@ -1 +1 @@
-export const VERSION = '0.9.13';
+export const VERSION = '0.10.1';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nonbot/cli",
-  "version": "0.9.13",
+  "version": "0.10.1",
   "type": "module",
   "description": "The local host for non.bot ▶ Run — opens a terminal on your machine and starts the work in your linked repo.",
   "license": "UNLICENSED",