@openape/apes 0.13.0 → 0.14.0

package/dist/cli.js

@@ -2468,15 +2468,19 @@ function defaultAuditPath() {
   const stateDir = xdg && xdg.length > 0 ? xdg : join2(homedir4(), ".local", "state");
   return join2(stateDir, "openape", "proxy-audit.jsonl");
 }
-function buildDefaultProxyConfigToml() {
+function buildDefaultProxyConfigToml(opts) {
   const auditPath = defaultAuditPath();
-  return `# Auto-generated by apes proxy -- (M1a). Do not edit; this file is
-# recreated for every \`apes proxy --\` invocation and deleted on exit.
+  const defaultAction = opts.mediated ? "request" : "allow";
+  const escEmail = opts.agentEmail.replace(/"/g, '\\"');
+  const escIdp = opts.idpUrl.replace(/"/g, '\\"');
+  return `# Auto-generated by \`apes proxy --\`. Do not edit; this file is
+# recreated for every invocation and deleted on exit.
+# Mode: ${opts.mediated ? "IdP-mediated (every unmatched host \u2192 grant flow)" : "transparent (default-allow + audit-only)"}.
 [proxy]
 listen = "127.0.0.1:0"
-idp_url = "https://id.openape.ai"
-agent_email = "ephemeral@apes-proxy.local"
-default_action = "allow"
+idp_url = "${escIdp}"
+agent_email = "${escEmail}"
+default_action = "${defaultAction}"
 audit_log = "${auditPath.replace(/"/g, '\\"')}"
 
 # Cloud / link-local metadata endpoints \u2014 never let agent traffic reach these
@@ -2596,6 +2600,19 @@ function waitForListenLine(child) {
 }
 
 // src/commands/proxy.ts
+function resolveProxyConfigOptions() {
+  const auth = loadAuth();
+  if (!auth?.email || !auth?.idp) {
+    throw new CliError(
+      "apes proxy requires `apes login` first.\n\nWithout a login the proxy has no agent identity to attribute grant\nrequests to, so the YOLO / Allow / Deny policy on id.openape.ai cannot\napply. Run:\n\n  apes login\n\nand re-run `apes proxy -- ...`.",
+      // 77 = EX_NOPERM from sysexits.h ("permission denied"); fits "user has\n'
+      // not authenticated to use this command" better than the default 1.
+      77
+    );
+  }
+  consola20.info(`[apes proxy] IdP-mediated mode \u2014 agent=${auth.email}, idp=${auth.idp}`);
+  return { agentEmail: auth.email, idpUrl: auth.idp, mediated: true };
+}
 var proxyCommand = defineCommand22({
   meta: {
     name: "proxy",
@@ -2620,16 +2637,23 @@ var proxyCommand = defineCommand22({
       proxyUrl = reuseUrl;
       consola20.info(`[apes proxy] reusing existing proxy at ${proxyUrl}`);
     } else {
-      const ephemeral = await startEphemeralProxy(buildDefaultProxyConfigToml());
+      const ephemeral = await startEphemeralProxy(buildDefaultProxyConfigToml(resolveProxyConfigOptions()));
       proxyUrl = ephemeral.url;
       close = ephemeral.close;
       consola20.info(`[apes proxy] started ephemeral proxy at ${proxyUrl}`);
     }
+    const noProxy = process.env.NO_PROXY ?? process.env.no_proxy ?? "127.0.0.1,localhost";
     const childEnv = {
       ...process.env,
       HTTPS_PROXY: proxyUrl,
+      https_proxy: proxyUrl,
       HTTP_PROXY: proxyUrl,
-      NO_PROXY: process.env.NO_PROXY ?? "127.0.0.1,localhost"
+      http_proxy: proxyUrl,
+      ALL_PROXY: proxyUrl,
+      all_proxy: proxyUrl,
+      NO_PROXY: noProxy,
+      no_proxy: noProxy,
+      NODE_USE_ENV_PROXY: "1"
     };
     const exitCode = await new Promise((resolveExit) => {
       const child = spawn2(wrapped[0], wrapped.slice(1), {
@@ -2929,7 +2953,7 @@ var mcpCommand = defineCommand27({
     if (transport !== "stdio" && transport !== "sse") {
       throw new Error('Transport must be "stdio" or "sse"');
     }
-    const { startMcpServer } = await import("./server-QGNNBQHT.js");
+    const { startMcpServer } = await import("./server-LU6IBZ76.js");
     await startMcpServer(transport, port);
   }
 });
@@ -3421,7 +3445,7 @@ async function bestEffortGrantCount(idp) {
   }
 }
 async function runHealth(args) {
-  const version = true ? "0.13.0" : "0.0.0";
+  const version = true ? "0.14.0" : "0.0.0";
   const auth = loadAuth();
   if (!auth) {
     throw new CliError("Not logged in. Run `apes login` first.", 1);
@@ -3623,10 +3647,10 @@ if (shellRewrite) {
   if (shellRewrite.action === "rewrite") {
     process.argv = shellRewrite.argv;
   } else if (shellRewrite.action === "version") {
-    console.log(`ape-shell ${"0.13.0"} (OpenApe DDISA shell wrapper)`);
+    console.log(`ape-shell ${"0.14.0"} (OpenApe DDISA shell wrapper)`);
     process.exit(0);
   } else if (shellRewrite.action === "help") {
-    console.log(`ape-shell ${"0.13.0"} \u2014 OpenApe DDISA shell wrapper`);
+    console.log(`ape-shell ${"0.14.0"} \u2014 OpenApe DDISA shell wrapper`);
     console.log("");
     console.log("Usage:");
     console.log("  ape-shell                 Start interactive grant-mediated REPL");
@@ -3684,7 +3708,7 @@ var configCommand = defineCommand34({
 var main = defineCommand34({
   meta: {
     name: "apes",
-    version: "0.13.0",
+    version: "0.14.0",
     description: "Unified CLI for OpenApe"
   },
   subCommands: {