@wenrwa/marketplace-cli 0.3.0 → 0.4.0

package/dist/bridge/mcpRegister.js

@@ -0,0 +1,35 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MCP_SERVER_NAME = void 0;
+exports.redactToken = redactToken;
+exports.registerMcpServer = registerMcpServer;
+exports.MCP_SERVER_NAME = 'wenrwa-marketplace';
+/** Connect Tokens must never appear in output — redact before printing. */
+function redactToken(text) {
+    return text.replace(/wm_ct_[0-9a-f]+/g, 'wm_ct_…<redacted>');
+}
+async function registerMcpServer(opts) {
+    let listOutput;
+    try {
+        const list = await opts.run('claude', ['mcp', 'list']);
+        listOutput = list.stdout;
+    }
+    catch {
+        return { action: 'claude-not-found' };
+    }
+    const exists = listOutput.includes(exports.MCP_SERVER_NAME);
+    if (exists && !opts.forceUpdate) {
+        return { action: 'already-registered' };
+    }
+    if (exists && opts.forceUpdate) {
+        await opts.run('claude', ['mcp', 'remove', exports.MCP_SERVER_NAME]);
+    }
+    const args = [
+        'mcp', 'add', exports.MCP_SERVER_NAME,
+        '-e', `WENRWA_CONNECT_TOKEN=${opts.connectToken}`,
+        '-e', `MARKETPLACE_API_URL=${opts.apiUrl}`,
+        '--', 'npx', '@wenrwa/marketplace-mcp',
+    ];
+    await opts.run('claude', args);
+    return { action: exists ? 're-registered' : 'registered', command: `claude ${args.join(' ')}` };
+}

package/dist/bridge/realPty.d.ts

@@ -0,0 +1,2 @@
+import { PtyFactory } from './sessionManager';
+export declare function realPtyFactory(): PtyFactory;

package/dist/bridge/realPty.js

@@ -0,0 +1,88 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.realPtyFactory = realPtyFactory;
+/**
+ * bct-05 — real PTY factory (node-pty). Kept in its own module so every
+ * other bridge module stays testable with fakes; this file is the only one
+ * that touches node-pty and is exercised in bct-10's manual pass, not CI.
+ */
+const os = __importStar(require("os"));
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+/**
+ * npm's prebuild extraction can drop the execute bit on node-pty's
+ * darwin spawn-helper, which surfaces as an opaque "posix_spawnp failed."
+ * on every session open (found in the bct-10 pre-flight). Self-heal it.
+ */
+function ensureSpawnHelperExecutable() {
+    try {
+        const helper = path.join(path.dirname(require.resolve('node-pty/package.json')), 'prebuilds', `${os.platform()}-${os.arch()}`, 'spawn-helper');
+        if (fs.existsSync(helper)) {
+            const mode = fs.statSync(helper).mode;
+            if ((mode & 0o111) === 0)
+                fs.chmodSync(helper, mode | 0o755);
+        }
+    }
+    catch {
+        /* best effort — spawn will surface any real failure */
+    }
+}
+function realPtyFactory() {
+    // Lazy require: node-pty is a native module; loading it at import time
+    // would make every CLI command pay for it (or crash on a broken build).
+    ensureSpawnHelperExecutable();
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    const pty = require('node-pty');
+    const shell = process.env.SHELL || (os.platform() === 'win32' ? 'powershell.exe' : '/bin/bash');
+    return {
+        spawn: ({ cols, rows }) => {
+            const proc = pty.spawn(shell, [], {
+                name: 'xterm-256color',
+                cols,
+                rows,
+                cwd: os.homedir(),
+                env: process.env,
+            });
+            return {
+                write: (data) => proc.write(data),
+                resize: (cols2, rows2) => proc.resize(cols2, rows2),
+                kill: () => proc.kill(),
+                onData: (cb) => proc.onData(cb),
+                onExit: (cb) => proc.onExit(({ exitCode }) => cb(exitCode)),
+            };
+        },
+    };
+}

package/dist/bridge/server.d.ts

@@ -0,0 +1,14 @@
+import { SessionManager } from './sessionManager';
+export interface BridgeServerOpts {
+    sessionToken: string;
+    allowedOrigin: string;
+    sessions: SessionManager;
+    /** 0 (default) = ephemeral port. */
+    port?: number;
+}
+export interface BridgeServerHandle {
+    port: number;
+    address: string;
+    close(): Promise<void>;
+}
+export declare function startBridgeServer(opts: BridgeServerOpts): Promise<BridgeServerHandle>;

package/dist/bridge/server.js

@@ -0,0 +1,182 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.startBridgeServer = startBridgeServer;
+/**
+ * bct-05 — Terminal Bridge WebSocket server.
+ *
+ * Loopback-only by construction: the listener binds 127.0.0.1 and there is
+ * deliberately no host option. Two gates guard every connection:
+ *   1. Origin pinned to the arena origin (browsers always send it) — any
+ *      other site, including LAN hosts, is closed with 4403.
+ *   2. A per-run session token in the first frame ({v:1, token}) — mismatch
+ *      closes with 4401. The token lives in the discovery file that only the
+ *      local user can read (config.ts).
+ *
+ * Input frames are routed through the SessionManager attachment handle of
+ * the sending connection, so a superseded (taken-over) connection's input is
+ * structurally inert — see sessionManager.ts and ADR-0028.
+ */
+const http = __importStar(require("http"));
+const ws_1 = require("ws");
+const PROTOCOL_VERSION = 1;
+function send(ws, frame) {
+    if (ws.readyState === ws_1.WebSocket.OPEN)
+        ws.send(JSON.stringify(frame));
+}
+function startBridgeServer(opts) {
+    // HTTP layer exists for one endpoint: GET /discovery. Browsers cannot read
+    // the discovery FILE, so the pane fetches the session token from here —
+    // response is CORS-pinned to the arena origin, so no other website can
+    // read it. (Same-machine cross-user curl with a forged Origin remains
+    // possible; documented as out of scope for v1 in PROTOCOL.md.)
+    const httpServer = http.createServer((req, res) => {
+        if (req.method === 'GET' && req.url === '/discovery') {
+            if (req.headers.origin !== opts.allowedOrigin) {
+                res.writeHead(403).end();
+                return;
+            }
+            res.writeHead(200, {
+                'content-type': 'application/json',
+                'access-control-allow-origin': opts.allowedOrigin,
+            });
+            res.end(JSON.stringify({ v: PROTOCOL_VERSION, token: opts.sessionToken }));
+            return;
+        }
+        res.writeHead(404).end();
+    });
+    const wss = new ws_1.WebSocketServer({ server: httpServer });
+    wss.on('connection', (ws, req) => {
+        if (req.headers.origin !== opts.allowedOrigin) {
+            ws.close(4403, 'origin not allowed');
+            return;
+        }
+        let authed = false;
+        const handles = new Map();
+        const attachTo = (sessionId) => {
+            const handle = opts.sessions.attach(sessionId, (frame) => {
+                if (frame.t === 'data')
+                    send(ws, { t: 'data', sessionId, data: frame.data });
+                else if (frame.t === 'takeover')
+                    send(ws, { t: 'takeover', sessionId });
+            });
+            handles.set(sessionId, handle);
+            return handle;
+        };
+        ws.on('message', (raw) => {
+            let frame;
+            try {
+                frame = JSON.parse(String(raw));
+            }
+            catch {
+                send(ws, { t: 'error', message: 'invalid frame' });
+                return;
+            }
+            if (!authed) {
+                if ('v' in frame && frame.v === PROTOCOL_VERSION && frame.token === opts.sessionToken) {
+                    authed = true;
+                    return;
+                }
+                send(ws, { t: 'error', message: 'authentication required' });
+                ws.close(4401, 'unauthenticated');
+                return;
+            }
+            if (!('t' in frame)) {
+                send(ws, { t: 'error', message: 'invalid frame' });
+                return;
+            }
+            try {
+                switch (frame.t) {
+                    case 'open': {
+                        const sessionId = opts.sessions.open({ cols: frame.cols, rows: frame.rows });
+                        attachTo(sessionId);
+                        send(ws, { t: 'opened', sessionId });
+                        break;
+                    }
+                    case 'attach': {
+                        const handle = attachTo(frame.sessionId);
+                        send(ws, { t: 'replay', sessionId: frame.sessionId, data: handle.replay });
+                        break;
+                    }
+                    case 'input':
+                        handles.get(frame.sessionId)?.write(frame.data);
+                        break;
+                    case 'resize':
+                        handles.get(frame.sessionId)?.resize(frame.cols, frame.rows);
+                        break;
+                    case 'detach':
+                        handles.get(frame.sessionId)?.detach();
+                        handles.delete(frame.sessionId);
+                        break;
+                    case 'close':
+                        handles.delete(frame.sessionId);
+                        opts.sessions.close(frame.sessionId);
+                        break;
+                    default:
+                        send(ws, { t: 'error', message: 'unknown frame type' });
+                }
+            }
+            catch (err) {
+                send(ws, { t: 'error', message: err instanceof Error ? err.message : 'bridge error' });
+            }
+        });
+        ws.on('close', () => {
+            for (const handle of handles.values())
+                handle.detach();
+            handles.clear();
+        });
+    });
+    return new Promise((resolve, reject) => {
+        httpServer.once('error', reject);
+        httpServer.listen(opts.port ?? 0, '127.0.0.1', () => {
+            const addr = httpServer.address();
+            if (addr === null || typeof addr === 'string') {
+                reject(new Error('bridge server failed to bind'));
+                return;
+            }
+            resolve({
+                port: addr.port,
+                address: addr.address,
+                close: () => new Promise((res, rej) => {
+                    for (const client of wss.clients)
+                        client.terminate();
+                    wss.close(() => {
+                        httpServer.close((err) => (err ? rej(err) : res()));
+                    });
+                }),
+            });
+        });
+    });
+}

package/dist/bridge/sessionManager.d.ts

@@ -0,0 +1,42 @@
+export interface PtyLike {
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    kill(): void;
+    onData(cb: (data: string) => void): void;
+    onExit(cb: (code: number) => void): void;
+}
+export interface PtyFactory {
+    spawn(opts: {
+        cols: number;
+        rows: number;
+    }): PtyLike;
+}
+export type SinkFrame = {
+    t: 'data';
+    data: string;
+} | {
+    t: 'takeover';
+};
+export type Sink = (frame: SinkFrame) => void;
+export interface AttachmentHandle {
+    /** Scrollback accumulated while detached (and before), replayed once. */
+    replay: string;
+    write(data: string): void;
+    resize(cols: number, rows: number): void;
+    detach(): void;
+}
+export declare class SessionManager {
+    private factory;
+    private sessions;
+    private scrollbackLimit;
+    constructor(factory: PtyFactory, opts?: {
+        scrollbackLimit?: number;
+    });
+    open(opts: {
+        cols: number;
+        rows: number;
+    }): string;
+    attach(sessionId: string, sink: Sink): AttachmentHandle;
+    close(sessionId: string): void;
+    list(): string[];
+}

package/dist/bridge/sessionManager.js

@@ -0,0 +1,79 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SessionManager = void 0;
+/**
+ * bct-05 — Terminal Bridge session manager.
+ *
+ * Owns the PTYs on the user's machine. Transport-agnostic: the WebSocket
+ * server (server.ts) attaches sinks and drives writes exclusively through
+ * the AttachmentHandle returned by attach(). That handle is the ONLY write
+ * path to a PTY (ADR-0028: no platform surface may inject input) — a handle
+ * superseded by a later attach (last-attach-wins) or detached becomes inert.
+ *
+ * Sessions survive detach: output keeps accumulating in a bounded scrollback
+ * buffer and is replayed on the next attach, so a browser refresh never
+ * kills the user's Claude Code run.
+ */
+const crypto_1 = __importDefault(require("crypto"));
+const DEFAULT_SCROLLBACK_LIMIT = 500_000; // ~500KB per session
+class SessionManager {
+    factory;
+    sessions = new Map();
+    scrollbackLimit;
+    constructor(factory, opts = {}) {
+        this.factory = factory;
+        this.scrollbackLimit = opts.scrollbackLimit ?? DEFAULT_SCROLLBACK_LIMIT;
+    }
+    open(opts) {
+        const id = crypto_1.default.randomBytes(8).toString('hex');
+        const pty = this.factory.spawn(opts);
+        const session = { pty, scrollback: '', sink: null, attachEpoch: 0, exited: false };
+        pty.onData((data) => {
+            session.scrollback = (session.scrollback + data).slice(-this.scrollbackLimit);
+            session.sink?.({ t: 'data', data });
+        });
+        pty.onExit(() => {
+            session.exited = true;
+            session.sink = null;
+            this.sessions.delete(id);
+        });
+        this.sessions.set(id, session);
+        return id;
+    }
+    attach(sessionId, sink) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            throw new Error(`Unknown session: ${sessionId}`);
+        // Last-attach-wins: notify and supersede any prior attachment.
+        session.sink?.({ t: 'takeover' });
+        session.attachEpoch += 1;
+        const epoch = session.attachEpoch;
+        session.sink = sink;
+        const live = () => this.sessions.get(sessionId) === session && session.attachEpoch === epoch;
+        return {
+            replay: session.scrollback,
+            write: (data) => { if (live())
+                session.pty.write(data); },
+            resize: (cols, rows) => { if (live())
+                session.pty.resize(cols, rows); },
+            detach: () => {
+                if (live())
+                    session.sink = null;
+            },
+        };
+    }
+    close(sessionId) {
+        const session = this.sessions.get(sessionId);
+        if (!session)
+            return;
+        session.pty.kill();
+        this.sessions.delete(sessionId);
+    }
+    list() {
+        return [...this.sessions.keys()];
+    }
+}
+exports.SessionManager = SessionManager;

package/dist/commands/agent.js

@@ -27,9 +27,10 @@ exports.agentCommand
             console.log('No agents found.');
             return;
         }
-        console.log((0, format_1.makeTable)(['Wallet', 'Name', 'Reputation', 'Capabilities', 'Status'], agents.map((a) => [
+        console.log((0, format_1.makeTable)(['Wallet', 'Name', 'Points', 'Reputation', 'Capabilities', 'Status'], agents.map((a) => [
             (0, format_1.shorten)(a.wallet_pubkey),
             a.name || '—',
+            String(a.points ?? 0),
             a.weighted_reputation != null ? Number(a.weighted_reputation).toFixed(2) : '—',
             (a.capabilities || []).slice(0, 3).join(', '),
             a.status || 'active',
@@ -53,6 +54,7 @@ exports.agentCommand
         console.log(`  Description:    ${agent.description || '—'}`);
         console.log(`  Capabilities:   ${(agent.capabilities || []).join(', ')}`);
         console.log(`  Status:         ${agent.status || 'active'}`);
+        console.log(`  Points:         ${agent.points ?? 0}`);
         console.log(`  Reputation:     ${agent.weighted_reputation != null ? Number(agent.weighted_reputation).toFixed(2) : '—'}`);
         console.log(`  Completed:      ${agent.completed_count ?? 0}`);
         console.log(`  Failed:         ${agent.failed_count ?? 0}`);
@@ -111,3 +113,98 @@ exports.agentCommand
         process.exit(0);
     });
 });
+exports.agentCommand
+    .command('register')
+    .description('Register as an agent on the marketplace')
+    .requiredOption('--name <name>', 'Agent name')
+    .option('--model <model>', 'AI model identifier')
+    .option('--capabilities <caps>', 'Comma-separated capabilities')
+    .action(async (opts) => {
+    try {
+        const client = (0, client_1.getClient)();
+        const body = { name: opts.name };
+        if (opts.model)
+            body.model = opts.model;
+        if (opts.capabilities)
+            body.capabilities = opts.capabilities.split(',').map((c) => c.trim());
+        const data = await client.post('/agents/register', body);
+        (0, format_1.heading)('Agent Registered');
+        console.log(`  Wallet: ${data.agent.wallet_pubkey}`);
+        console.log(`  Name:   ${data.agent.name}`);
+        if (data.agent.model)
+            console.log(`  Model:  ${data.agent.model}`);
+        if (data.agent.capabilities?.length)
+            console.log(`  Caps:   ${data.agent.capabilities.join(', ')}`);
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});
+exports.agentCommand
+    .command('update')
+    .description('Update your agent profile')
+    .option('--name <name>', 'New display name')
+    .option('--model <model>', 'New model identifier')
+    .option('--description <desc>', 'New description')
+    .option('--capabilities <caps>', 'Comma-separated capabilities (replaces existing)')
+    .action(async (opts) => {
+    try {
+        const body = {};
+        if (opts.name)
+            body.name = opts.name;
+        if (opts.model)
+            body.model = opts.model;
+        if (opts.description)
+            body.description = opts.description;
+        if (opts.capabilities)
+            body.capabilities = opts.capabilities.split(',').map((c) => c.trim());
+        if (Object.keys(body).length === 0) {
+            (0, format_1.error)('Provide at least one field to update (--name, --model, --description, --capabilities)');
+            return;
+        }
+        const client = (0, client_1.getClient)();
+        const data = await client.patch('/agents/me', body);
+        (0, format_1.heading)('Agent Updated');
+        console.log(`  Name:   ${data.agent.name}`);
+        if (data.agent.model)
+            console.log(`  Model:  ${data.agent.model}`);
+        if (data.agent.description)
+            console.log(`  Desc:   ${data.agent.description}`);
+        if (data.agent.capabilities?.length)
+            console.log(`  Caps:   ${data.agent.capabilities.join(', ')}`);
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});
+exports.agentCommand
+    .command('github-status')
+    .description('Check if your GitHub account is connected')
+    .action(async () => {
+    try {
+        const client = (0, client_1.getClient)();
+        const data = await client.get('/auth/github/status');
+        if (data.connected) {
+            console.log(chalk_1.default.green('Connected') + ` — @${data.username}`);
+        }
+        else {
+            console.log(chalk_1.default.dim('Not connected'));
+        }
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});
+exports.agentCommand
+    .command('github-disconnect')
+    .description('Disconnect your GitHub account from the marketplace')
+    .action(async () => {
+    try {
+        const client = (0, client_1.getClient)();
+        await client.del('/me/github');
+        console.log(chalk_1.default.green('GitHub account disconnected.'));
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});

package/dist/commands/apps.js

@@ -198,3 +198,56 @@ exports.appsCommand
         (0, format_1.error)(err.message);
     }
 });
+exports.appsCommand
+    .command('hosting')
+    .description('Show hosting subscription status for all apps')
+    .action(async () => {
+    try {
+        const client = (0, client_1.getClient)();
+        const data = await client.get('/me/hosting-subscriptions');
+        const subs = data.subscriptions || [];
+        if (subs.length === 0) {
+            console.log('No hosting subscriptions. Deploy an app first.');
+            return;
+        }
+        console.log((0, format_1.makeTable)(['Project', 'Slug', 'Status', 'Credits/mo', 'Next Billing', 'URL'], subs.map((s) => [
+            s.project_title?.slice(0, 20) || (0, format_1.shorten)(s.project_id),
+            s.project_slug ? `${s.project_slug}.wenrwa.app` : '—',
+            (0, format_1.statusColor)(s.status),
+            s.credits_per_month?.toLocaleString() || '—',
+            s.next_billing_at ? (0, format_1.formatTimeAgo)(s.next_billing_at) : '—',
+            s.deployed_url || '—',
+        ])));
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});
+exports.appsCommand
+    .command('reactivate')
+    .argument('<project-id>', 'Project ID to reactivate')
+    .description('Reactivate an archived hosted app')
+    .action(async (projectId) => {
+    try {
+        const client = (0, client_1.getClient)();
+        await client.post(`/projects/${projectId}/reactivate`);
+        console.log(chalk_1.default.green(`Hosting reactivated for project ${projectId}`));
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});
+exports.appsCommand
+    .command('cancel-hosting')
+    .argument('<project-id>', 'Project ID to cancel hosting for')
+    .description('Cancel hosting for a hosted app')
+    .action(async (projectId) => {
+    try {
+        const client = (0, client_1.getClient)();
+        await client.post(`/projects/${projectId}/cancel-hosting`);
+        console.log(chalk_1.default.green(`Hosting cancelled for project ${projectId}`));
+    }
+    catch (err) {
+        (0, format_1.error)(err.message);
+    }
+});