@remixmate/cli 0.9.71 → 0.9.73

package/LICENSE

@@ -1,21 +1,45 @@
-MIT License
-
-Copyright (c) 2026 aibearer
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in all
-copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-SOFTWARE.
+Remixmate Commercial License
+
+Copyright (c) 2026 Remixmate. All rights reserved.
+
+This software, including its source code, object code, skill definitions,
+scripts and documentation (the "Software"), is proprietary to Remixmate and is
+protected by copyright law. The Software is licensed, not sold.
+
+1. Grant of use. Subject to these terms and to the Remixmate Terms of Service
+   (https://www.remixmate.ai), Remixmate grants you a limited, non-exclusive,
+   non-transferable, non-sublicensable, revocable license to install and run
+   the Software, unmodified, solely to access Remixmate services with a valid
+   Remixmate account.
+
+2. Restrictions. Except as expressly permitted above or required by applicable
+   law, you may not:
+   (a) copy, modify, translate or create derivative works of the Software;
+   (b) redistribute, sell, rent, lease, sublicense, publish or otherwise make
+       the Software available to any third party, including as part of another
+       product or service;
+   (c) reverse engineer, decompile, disassemble, deobfuscate or otherwise
+       attempt to derive the source code, algorithms or internal logic of the
+       Software;
+   (d) use the Software, or any part of it, to build a competing product or
+       service, or to access Remixmate services other than through the
+       interfaces the Software provides;
+   (e) remove or alter any copyright, license or proprietary notice.
+
+3. Ownership. Remixmate retains all right, title and interest in and to the
+   Software. No rights are granted other than those expressly stated here.
+
+4. Termination. This license terminates automatically if you breach any of its
+   terms or your Remixmate account is terminated. On termination you must stop
+   using and delete all copies of the Software.
+
+5. Disclaimer. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,
+   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF
+   MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT.
+
+6. Limitation of liability. TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT
+   SHALL REMIXMATE BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
+   IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
+   CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+
+For licensing inquiries, contact Remixmate via https://www.remixmate.ai.

package/README.md

@@ -316,4 +316,4 @@ remixmate template-registry --list-templates
 
 ## License
 
-MIT
+Commercial license, all rights reserved. You may install and run it unmodified with a valid Remixmate account; copying, modification, redistribution and reverse engineering are not permitted. See [LICENSE](./LICENSE).

package/README.zh-CN.md

@@ -256,4 +256,4 @@ remixmate template-registry --list-templates
 
 ## 许可证
 
-MIT
+商业许可，保留所有权利。仅允许在持有有效 Remixmate 账号的前提下安装并原样使用，禁止复制、修改、再分发和逆向工程。详见 [LICENSE](./LICENSE)。

package/dist/argv.js

@@ -1,51 +1 @@
-/**
- * Argv parser shared by cli.ts and python passthrough.
- *
- * Convention (matches ab-agent's buildCliArgs):
- *   --foo-bar value     →  foo_bar: 'value'
- *   --foo-bar           →  foo_bar: true
- *   --foo-bar a --foo-bar b → foo_bar: ['a', 'b']
- *   -p value            →  short flags also supported as-is (kebab → snake)
- *
- * Booleans are detected when the next token starts with '--' or is absent.
- * Negative number values (-1.5) are NOT supported as flag values in this
- * parser — Python skills handle them via argparse downstream when needed.
- */
-function flagToKey(flag) {
-    return flag.replace(/^--?/, '').replace(/-/g, '_');
-}
-export function parseArgv(argv) {
-    const out = {};
-    let i = 0;
-    while (i < argv.length) {
-        const token = argv[i];
-        if (!token.startsWith('-')) {
-            i++;
-            continue;
-        }
-        const key = flagToKey(token);
-        const next = argv[i + 1];
-        if (next === undefined || next.startsWith('--')) {
-            out[key] = true;
-            i++;
-            continue;
-        }
-        // Treat next token as value.
-        const existing = out[key];
-        if (existing === undefined) {
-            out[key] = next;
-        }
-        else if (Array.isArray(existing)) {
-            existing.push(next);
-        }
-        else if (typeof existing === 'string') {
-            out[key] = [existing, next];
-        }
-        else {
-            // Was boolean — overwrite (last write wins; unusual case)
-            out[key] = next;
-        }
-        i += 2;
-    }
-    return out;
-}
+var f=Object.defineProperty;var o=(t,e)=>f(t,"name",{value:e,configurable:!0});function u(t){return t.replace(/^--?/,"").replace(/-/g,"_")}o(u,"flagToKey");function a(t){const e={};let n=0;for(;n<t.length;){const c=t[n];if(!c.startsWith("-")){n++;continue}const s=u(c),i=t[n+1];if(i===void 0||i.startsWith("--")){e[s]=!0,n++;continue}const r=e[s];r===void 0?e[s]=i:Array.isArray(r)?r.push(i):typeof r=="string"?e[s]=[r,i]:e[s]=i,n+=2}return e}o(a,"parseArgv");export{a as parseArgv};

package/dist/auth/auth-lock.js

@@ -1,100 +1 @@
-/**
- * Cross-process file lock for the auto device-login flow.
- *
- * When several skill processes start without a token at the same time, only one
- * should drive the Device Flow (= open one browser). The rest wait for the
- * winner to write the credential, then read it. This lock coordinates that.
- *
- * The lock file lives next to the credential store, contains only non-secret
- * metadata, and self-heals: a lock left behind by a crashed process is reclaimed
- * once it is older than `staleMs` (Requirement 3.1/3.4/3.5).
- */
-import { createHash } from 'node:crypto';
-import { promises as fs } from 'node:fs';
-import { join } from 'node:path';
-import { CRED_DIR, getCredential } from './credential-store.js';
-/** Stable short hash so different apiBaseUrls never block each other. */
-function lockPathFor(apiBaseUrl) {
-    const hash = createHash('sha256').update(apiBaseUrl).digest('hex').slice(0, 12);
-    return join(CRED_DIR, `auth-${hash}.lock`);
-}
-const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-async function writeLockFile(lockPath) {
-    const payload = { pid: process.pid, createdAt: Date.now() };
-    // `wx` fails if the file already exists → atomic acquire.
-    await fs.writeFile(lockPath, JSON.stringify(payload), { flag: 'wx', mode: 0o600 });
-}
-/** Best-effort removal; never throws. */
-async function safeUnlink(lockPath) {
-    try {
-        await fs.unlink(lockPath);
-    }
-    catch {
-        // already gone / not ours — nothing to do
-    }
-}
-/**
- * Try to acquire the auth lock for `apiBaseUrl`.
- *   - Returns a handle when acquired.
- *   - Returns null when another live process holds it.
- *   - Reclaims a stale lock (older than `staleMs`) and retries once.
- */
-export async function acquireLock(apiBaseUrl, staleMs) {
-    await fs.mkdir(CRED_DIR, { recursive: true, mode: 0o700 });
-    const lockPath = lockPathFor(apiBaseUrl);
-    try {
-        await writeLockFile(lockPath);
-        return makeHandle(lockPath);
-    }
-    catch {
-        // Lock exists — decide whether it is stale.
-    }
-    let stale = false;
-    try {
-        const stat = await fs.stat(lockPath);
-        stale = Date.now() - stat.mtimeMs > staleMs;
-    }
-    catch {
-        // Disappeared between the failed create and the stat → treat as free.
-        stale = true;
-    }
-    if (!stale)
-        return null;
-    // Reclaim the stale lock and retry exactly once.
-    await safeUnlink(lockPath);
-    try {
-        await writeLockFile(lockPath);
-        return makeHandle(lockPath);
-    }
-    catch {
-        // Someone else won the race after we cleared it.
-        return null;
-    }
-}
-function makeHandle(lockPath) {
-    let released = false;
-    return {
-        async release() {
-            if (released)
-                return;
-            released = true;
-            await safeUnlink(lockPath);
-        },
-    };
-}
-/**
- * Poll the credential store until a usable credential for `apiBaseUrl` appears
- * or `timeoutMs` elapses. Used by processes that did NOT win the lock.
- */
-export async function waitForCredential(apiBaseUrl, timeoutMs) {
-    const deadline = Date.now() + timeoutMs;
-    const intervalMs = 1_000;
-    while (Date.now() < deadline) {
-        const cred = await getCredential(apiBaseUrl);
-        if (cred && cred.privToken.trim())
-            return true;
-        await sleep(intervalMs);
-    }
-    const cred = await getCredential(apiBaseUrl);
-    return !!(cred && cred.privToken.trim());
-}
+var m=Object.defineProperty;var r=(t,e)=>m(t,"name",{value:e,configurable:!0});import{createHash as d}from"node:crypto";import{promises as o}from"node:fs";import{join as p}from"node:path";import{CRED_DIR as s,getCredential as l}from"./credential-store.js";function h(t){const e=d("sha256").update(t).digest("hex").slice(0,12);return p(s,`auth-${e}.lock`)}r(h,"lockPathFor");const k=r(t=>new Promise(e=>setTimeout(e,t)),"sleep");async function u(t){const e={pid:process.pid,createdAt:Date.now()};await o.writeFile(t,JSON.stringify(e),{flag:"wx",mode:384})}r(u,"writeLockFile");async function w(t){try{await o.unlink(t)}catch{}}r(w,"safeUnlink");async function F(t,e){await o.mkdir(s,{recursive:!0,mode:448});const a=h(t);try{return await u(a),f(a)}catch{}let n=!1;try{const i=await o.stat(a);n=Date.now()-i.mtimeMs>e}catch{n=!0}if(!n)return null;await w(a);try{return await u(a),f(a)}catch{return null}}r(F,"acquireLock");function f(t){let e=!1;return{async release(){e||(e=!0,await w(t))}}}r(f,"makeHandle");async function C(t,e){const a=Date.now()+e,n=1e3;for(;Date.now()<a;){const c=await l(t);if(c&&c.privToken.trim())return!0;await k(n)}const i=await l(t);return!!(i&&i.privToken.trim())}r(C,"waitForCredential");export{F as acquireLock,C as waitForCredential};

package/dist/auth/auto-login.js

@@ -1,75 +1,7 @@
-/**
- * Automatic Device Flow orchestration triggered when a skill call finds no
- * token. Only ever invoked AFTER resolvePrivToken() has confirmed all three
- * sources (flag / env / credential store) are empty, so the env-injected
- * (cloud) path never reaches this module — guaranteeing zero regression there.
- *
- * Flow (see design.md):
- *   canAutoAuth gate → acquire lock
- *     ├─ won  : runDeviceFlow(short wait) → on approval re-read the store
- *     └─ lost : wait for whoever holds the lock to write a credential
- *
- * Always bounded by `maxWaitMs` so it can never block a host tool call forever.
- */
-import { resolvePrivToken } from './resolve.js';
-import { canAutoAuth } from './environment.js';
-import { acquireLock, waitForCredential } from './auth-lock.js';
-import { runDeviceFlow } from './device-flow-runner.js';
-/**
- * How long a skill call waits for the user to approve in the browser.
- *
- * 90s, not 25s: when an agent host relays the link into a chat, the clock
- * includes the user reading the message, switching to a browser and clicking —
- * 25s reliably expired before a human could react. The ceiling is set by the
- * host's own tool-call timeout (Claude Code's Bash tool defaults to 120s), so
- * this must stay comfortably under that or the wait gets truncated anyway.
- */
-const DEFAULT_WAIT_MS = 90_000;
-/** Extra slack on top of the wait window before a held lock is considered stale. */
-const STALE_SLACK_MS = 10_000;
-/** Resolve the short-wait window from env, falling back to the default. */
-function waitMs() {
-    const raw = Number(process.env.REMIXMATE_AUTH_WAIT_SECONDS);
-    return Number.isFinite(raw) && raw > 0 ? raw * 1000 : DEFAULT_WAIT_MS;
-}
-/**
- * Attempt to obtain a token via automatic browser authorization. Returns the
- * resolved token on success, or null when auto auth is not applicable / did not
- * complete in time (callers then fail fast with NOT_AUTHENTICATED_HINT).
- */
-export async function attemptAutoLogin(apiBaseUrl) {
-    if (!canAutoAuth())
-        return null;
-    const max = waitMs();
-    const lock = await acquireLock(apiBaseUrl, max + STALE_SLACK_MS);
-    if (!lock) {
-        // Another process is driving the Device Flow — wait for its credential.
-        process.stderr.write('ℹ️  另一个进程正在授权，等待其完成…\n');
-        const ok = await waitForCredential(apiBaseUrl, max);
-        return ok ? resolvePrivToken({ apiBaseUrl }) : null;
-    }
-    try {
-        const outcome = await runDeviceFlow(apiBaseUrl, { maxWaitMs: max });
-        switch (outcome.status) {
-            case 'approved':
-                process.stderr.write(`✅ 授权成功：${outcome.userLabel ?? ''}\n`);
-                return resolvePrivToken({ apiBaseUrl });
-            case 'timeout':
-                process.stderr.write('⏳ 已打开授权页但未在等待窗口内完成。请在浏览器完成授权后重跑同一命令。\n');
-                return null;
-            case 'denied':
-                process.stderr.write('❌ 授权被拒绝。\n');
-                return null;
-            case 'expired':
-                process.stderr.write('❌ 设备码已过期，请重跑命令重新授权。\n');
-                return null;
-            case 'error':
-            default:
-                process.stderr.write(`❌ 自动授权失败：${'message' in outcome ? outcome.message : '未知错误'}\n`);
-                return null;
-        }
-    }
-    finally {
-        await lock.release();
-    }
-}
+var i=Object.defineProperty;var n=(r,e)=>i(r,"name",{value:e,configurable:!0});import{resolvePrivToken as o}from"./resolve.js";import{canAutoAuth as c}from"./environment.js";import{acquireLock as u,waitForCredential as a}from"./auth-lock.js";import{runDeviceFlow as l}from"./device-flow-runner.js";const m=9e4,w=1e4;function d(){const r=Number(process.env.REMIXMATE_AUTH_WAIT_SECONDS);return Number.isFinite(r)&&r>0?r*1e3:m}n(d,"waitMs");async function L(r){if(!c())return null;const e=d(),s=await u(r,e+w);if(!s)return process.stderr.write(`ℹ️  另一个进程正在授权，等待其完成…
+`),await a(r,e)?o({apiBaseUrl:r}):null;try{const t=await l(r,{maxWaitMs:e});switch(t.status){case"approved":return process.stderr.write(`✅ 授权成功：${t.userLabel??""}
+`),o({apiBaseUrl:r});case"timeout":return process.stderr.write(`⏳ 已打开授权页但未在等待窗口内完成。请在浏览器完成授权后重跑同一命令。
+`),null;case"denied":return process.stderr.write(`❌ 授权被拒绝。
+`),null;case"expired":return process.stderr.write(`❌ 设备码已过期，请重跑命令重新授权。
+`),null;default:return process.stderr.write(`❌ 自动授权失败：${"message"in t?t.message:"未知错误"}
+`),null}}finally{await s.release()}}n(L,"attemptAutoLogin");export{L as attemptAutoLogin};