@withbuddi/buddi 0.1.0-pre.37 → 0.1.0-pre.38

package/node_modules/real-require/README.md

@@ -1,5 +1,9 @@
 # real-require
 
+[![Package Version](https://img.shields.io/npm/v/real-require.svg)](https://npm.im/real-require)
+[![Dependency Status](https://img.shields.io/librariesio/release/npm/real-require)](https://libraries.io/npm/real-require)
+[![Build](https://github.com/pinojs/real-require/workflows/CI/badge.svg)](https://github.com/pinojs/real-require/actions?query=workflow%3ACI)
+
 Keep require and import consistent after bundling or transpiling.
 
 ## Installation
@@ -12,13 +16,9 @@ npm install real-require
 
 ## Usage
 
-The package provides two drop-ins functions, `realRequire` and `realImport`,
-which can be used in scenarios where tools like transpilers or bundlers change
-the native `require` or `await import` calls.
+The package provides two drop-ins functions, `realRequire` and `realImport`, which can be used in scenarios where tools like transpilers or bundlers change the native `require` or `await import` calls.
 
-The current `realRequire` functions only handles webpack at the moment, wrapping
-the `__non_webpack__require__` implementation that webpack provides for the
-final bundle.
+The current `realRequire` functions only handles webpack at the moment, wrapping the `__non_webpack__require__` implementation that webpack provides for the final bundle.
 
 ### Example
 

package/node_modules/real-require/package.json

@@ -1,6 +1,6 @@
 {
   "name": "real-require",
-  "version": "1.0.0",
+  "version": "0.2.0",
   "description": "Keep require and import consistent after bundling or transpiling",
   "author": "Paolo Insogna <shogun@cowtech.it>",
   "homepage": "https://github.com/pinojs/real-require",
@@ -23,16 +23,27 @@
     "src"
   ],
   "scripts": {
-    "lint": "eslint .",
-    "lint:fix": "eslint --fix .",
-    "test": "c8 --reporter=text --reporter=html borp 'test/*.test.js'",
-    "test:ci": "c8 --reporter=text --reporter=json --check-coverage --branches 90 --functions 90 --lines 90 --statements 90 borp 'test/*.test.js'",
-    "ci": "npm run lint && npm run test:ci"
+    "format": "prettier -w src test",
+    "lint": "eslint src test",
+    "test": "c8 --reporter=text --reporter=html tap --reporter=spec --no-coverage test/*.test.js",
+    "test:watch": "tap --watch --reporter=spec --no-browser --coverage-report=text --coverage-report=html test/*.test.js",
+    "test:ci": "c8 --reporter=text --reporter=json --check-coverage --branches 90 --functions 90 --lines 90 --statements 90 tap --no-color --no-coverage test/*.test.js",
+    "ci": "npm run lint && npm run test:ci",
+    "prepublishOnly": "npm run ci",
+    "postpublish": "git push origin && git push origin -f --tags"
   },
   "devDependencies": {
-    "borp": "^1.0.0",
-    "c8": "^8.0.0",
-    "eslint": "^9.39.4",
-    "neostandard": "^0.13.0"
+    "eslint": "^7.12.0",
+    "eslint-config-standard": "^16.0.3",
+    "eslint-plugin-import": "^2.25.2",
+    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-promise": "^5.1.1",
+    "eslint-plugin-standard": "^5.0.0",
+    "c8": "^7.10.0",
+    "prettier": "^2.4.1",
+    "tap": "^16.0.0"
+  },
+  "engines": {
+    "node": ">= 12.13.0"
   }
 }

package/node_modules/real-require/src/index.js

@@ -1,9 +1,9 @@
-/* eslint-disable no-new-func */
+/* eslint-disable no-new-func, camelcase */
 /* globals __non_webpack__require__ */
 
 const realImport = new Function('modulePath', 'return import(modulePath)')
 
-function realRequire (modulePath) {
+function realRequire(modulePath) {
   if (typeof __non_webpack__require__ === 'function') {
     return __non_webpack__require__(modulePath)
   }

package/node_modules/thread-stream/node_modules/real-require/LICENSE.md

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2021 Paolo Insogna and the real-require contributors
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/node_modules/thread-stream/node_modules/real-require/README.md

@@ -0,0 +1,51 @@
+# real-require
+
+Keep require and import consistent after bundling or transpiling.
+
+## Installation
+
+Just run:
+
+```bash
+npm install real-require
+```
+
+## Usage
+
+The package provides two drop-ins functions, `realRequire` and `realImport`,
+which can be used in scenarios where tools like transpilers or bundlers change
+the native `require` or `await import` calls.
+
+The current `realRequire` functions only handles webpack at the moment, wrapping
+the `__non_webpack__require__` implementation that webpack provides for the
+final bundle.
+
+### Example
+
+```js
+// After bundling, real-require will be embedded in the bundle
+const { realImport, realRequire } = require('real-require')
+
+/*
+  By using realRequire, at build time the module will not be embedded and at runtime it will try to load path from the local filesytem.
+  This is useful in situations where the build tool does not support skipping modules to embed.
+*/
+const { join } = realRequire('path')
+
+async function main() {
+  // Similarly, this make sure the import call is not modified by the build tools
+  const localFunction = await realImport('./source.js')
+
+  localFunction()
+}
+
+main().catch(console.error)
+```
+
+## Contributing
+
+See [CONTRIBUTING.md](./CONTRIBUTING.md)
+
+## License
+
+Copyright Paolo Insogna and real-require contributors 2021. Licensed under the [MIT License](http://www.apache.org/licenses/MIT).

package/node_modules/thread-stream/node_modules/real-require/package.json

@@ -0,0 +1,38 @@
+{
+  "name": "real-require",
+  "version": "1.0.0",
+  "description": "Keep require and import consistent after bundling or transpiling",
+  "author": "Paolo Insogna <shogun@cowtech.it>",
+  "homepage": "https://github.com/pinojs/real-require",
+  "contributors": [
+    {
+      "name": "Paolo Insogna",
+      "url": "https://github.com/ShogunPanda"
+    }
+  ],
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/pinojs/real-require.git"
+  },
+  "bugs": {
+    "url": "https://github.com/pinojs/real-require/issues"
+  },
+  "main": "src/index.js",
+  "files": [
+    "src"
+  ],
+  "scripts": {
+    "lint": "eslint .",
+    "lint:fix": "eslint --fix .",
+    "test": "c8 --reporter=text --reporter=html borp 'test/*.test.js'",
+    "test:ci": "c8 --reporter=text --reporter=json --check-coverage --branches 90 --functions 90 --lines 90 --statements 90 borp 'test/*.test.js'",
+    "ci": "npm run lint && npm run test:ci"
+  },
+  "devDependencies": {
+    "borp": "^1.0.0",
+    "c8": "^8.0.0",
+    "eslint": "^9.39.4",
+    "neostandard": "^0.13.0"
+  }
+}

package/node_modules/thread-stream/node_modules/real-require/src/index.js

@@ -0,0 +1,14 @@
+/* eslint-disable no-new-func */
+/* globals __non_webpack__require__ */
+
+const realImport = new Function('modulePath', 'return import(modulePath)')
+
+function realRequire (modulePath) {
+  if (typeof __non_webpack__require__ === 'function') {
+    return __non_webpack__require__(modulePath)
+  }
+
+  return require(modulePath)
+}
+
+module.exports = { realImport, realRequire }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@withbuddi/buddi",
-  "version": "0.1.0-pre.37",
+  "version": "0.1.0-pre.38",
   "type": "module",
   "description": "Your personal agents, on your computer",
   "repository": {
@@ -17,7 +17,7 @@
     "buddi": "packages/install/dist/launcher.js"
   },
   "buddi": {
-    "notes": "### Added\n\n- Knowing you: Settings → Profile takes your full name, pronouns and birthday (day and month, the year optional) beside what the agents call you, and every agent is told them — and that today is your birthday when it is. On the day your front desk greets you first thing in your zone with a short note from the team, on Telegram and on Home under \"Happy birthday\", with a picture from your Illustrator when the image plugin has an account (on by default; the switch is on Missions).\n- People: the people in your life are their own kind of memory — who they are to you, how to address them, birthdays and anniversaries, a few notes — read by every agent in one line each and edited in Settings → Memory → People, with Forget and Undo. An agent keeps someone at once only when you told it about them in that message; otherwise you get a card to keep or discard. The people your existing notes already name are offered once, the same way. A person with a date can remind you a week before and on the day, with an offer to find something (off until you turn it on in their sheet).\n- The front desk and the Chief of Staff's morning brief read all-day \"Happy birthday!\", \"Anniversary\" and \"Marion's birthday\" events as occasions and say them in words, never as events with a time.\n- Agents decide when there is only one option and ask with buttons when there are a few: with one calendar they may change (or one mailbox, one account) they use it and say which; with two to six they ask with choices you tap in the chat, the corner chat or Telegram, never in prose; and they state the defaults they chose, such as two hours for a dinner, on the confirmation or the approval card. A question may now offer six choices.\n\n- Plugins can sign you in to an account with OAuth, starting with Google (host API 1.28): buddi opens Google's consent, catches the answer on this computer (or takes the address you paste back when your browser is on another one), keeps the tokens in Keys and secrets, renews them itself and sends them only to Google's API for that plugin. The plugin never sees a token; a sign-in Google stops accepting is reported as such.\n- Plugin pages can draw a choice per row (a segment such as Not linked · Read · Read and change, an option greyed with why), a grouped list whose heads carry the group's own actions, a row's colour as a dot, one button that opens a short menu of actions and forms, a card that finishes by itself once what it waits for arrives, and parts shown only when the dashboard is opened on this computer or only from elsewhere (host API 1.28). Settings → Calendar is the first page to use them.\n- A plugin's calendar page can open an event in a sheet on the right — when and how long, its calendar and colour, the place as a map link, the notes, a link to it in Google Calendar or iCloud — with Move or change… and Cancel…, which open the corner chat with the request written in for you to send; and it can say how many events the week holds beside its dates (host API 1.28).\n- Skills can be bundles: upload a `.zip` holding a SKILL.md with its scripts and assets (Agents → Skills → Upload). buddi checks it before keeping anything — 20 MB and 500 files at most, no paths that climb out, no links, nothing that runs outside `scripts/` — and shows what is inside, then the row says BUNDLE and who can run its scripts, and its sheet shows the files as a tree you can read (only SKILL.md is editable; Download gives the .zip back). Nothing in a bundle runs on upload. A script runs only when an agent holding host.exec runs it, never while the bundle is untrusted, asking you every time on a card that names the script, the bundle, the arguments, the working folder and what it may touch (Allow once only); it is confined (the macOS sandbox or bubblewrap on Linux): it writes only in its own folder, reads only the bundle, that folder and the system it runs on (nothing in your home), and has no network unless the bundle's SKILL.md says `network: true`, which its card then says. A shipped example, `examples/skills/letterhead`, shows a template bundle with no scripts.\n- The chat's composer styles what you type as you type it, and what is sent is the same plain Markdown: code and fenced blocks tinted with the block's language, bold, italic, headings, links and list markers. `@` in any chat offers who you can name with their faces (Agent Father borrowed for one message, or a teammate the agent asks for you; a group's members in a group) and draws the name as a chip; `/` at the start offers /use, /new, /stop and /quiet, then commands plugins add in their manifest (`commands`); lists carry on with Enter and indent with Tab; pasted code is fenced with Undo, and a paste over 4,000 characters becomes a file at once with \"Put it in the message\". On a phone the lists sit above the keyboard.\n\n- Agents try before they decline: every agent is told to look with the browser when it has one (your own browser where you are signed in, or buddi's with a login you stored in Keys and secrets, asking you to take over at a code it cannot answer), to hand a colleague's question to that colleague and relay the answer, and only then to say exactly what it lacks with one next step. An agent without the browser says it could look if you gave it browser control.\n- Catalogue agents can be given the browser's stored logins (`secret.list`, `secret.fill`) and colleagues to hand work to: a package's `delegates` resolve at install to the agents you have, an agent added later joins the lists that name it and the front desk's, and the approval card says who may ask whom.\n\n- A first run with no key at all: the **Ollama on this computer** card shows the command that installs Ollama (Homebrew or the app on a Mac, the official script on Linux; buddi never runs it), notices when Ollama starts, fetches the model your machine's memory suits (`qwen3:1.7b` to `qwen3:14b`) with a progress bar, makes the Ollama account and puts your assistant on it, so it answers before first run ends. It says plainly that a small local model is slower and weaker than Claude or ChatGPT, offers Ollama Cloud on a machine that would be slow, and Home's tip offers a stronger brain while any agent thinks with the local model.\n- `buddi doctor` has an `ollama` row: running with its version and models and which accounts use it, or a warning when an account uses it and Ollama is stopped or the account's model is not fetched.\n\n- Widgets in the market: Browse has a **Widgets** shelf beside All · Plugins · Agents with every widget a listed plugin brings, drawn as Home draws it from the plugin's sample data, and a listing's sheet shows each widget at every size it offers; Home's Add widgets and the lock screen's Add a widget end with **Get more widgets**. A plugin declares the sample as `preview` on a widget (one body, or one per size), `buddi plugins describe` now reports each widget (id, title, sizes, settings, preview) for the market's check, and a plugin that is only a widget is welcome.\n- A news edition in chat is drawn as an edition card: its name and time, the voice note as a waveform, its first sentence, each topic with its stories (the outlet's logo, the headline with Update or Opinion, Anchor's line, the outlet linked out and \"and N more\"), and the next edition's time. The text as sent is one tap away under \"Show as text\", and is what shows when News cannot read the edition back.\n\n- `pnpm review` for working on buddi: Codex reviews everything since the last release tag (from the Unreleased lines and a standard focus list) into a file, the script prints the brief for a second review agent, and `--merge` puts both reviews into one findings file.\n\n- Each story in a news edition card has its ways out under ⋯, as on the News page: Not interested, Mute an outlet, Quiet the topic for a week, Mute the topic. The story leaves a sentence and Undo in its place.\n\n### Changed\n\n…"
+    "notes": "- Development: the web test suite runs in a fifth of the time (nwsapi pinned to 2.2.28; its older versions recursed on every menu open under jsdom), which also unsticks the release gate.\n- Cloudflare setup: after the token is checked, type just the name and pick the domain from your Cloudflare zones; the full hostname is still accepted when the token lists none.\n- Cloudflare setup: the Done line says Cloudflare needs a minute or two before the first sign-in works, and to reload if its page can’t find the application.\n- Trusted access: the Cloudflare \"Open Cloudflare\" button opens the token form pre-filled with the four permissions buddi needs (Cloudflare template URL); the owner names and creates the token, then pastes it.\n\n### Added\n\n- Sign in from your own domain through Cloudflare: Settings → System → Sign in from elsewhere → Cloudflare Access walks you through a Cloudflare Tunnel with Cloudflare Access in front (install cloudflared, create the tunnel, point a hostname at the port the panel prints, add an Access application for your email, paste the team domain and AUD tag), with Test my setup and a status line. buddi verifies Access's signed JWT itself on every request — signature against your team's keys, issuer, audience, expiry, your email — never trusts a plain header, and gives the same remote session as Tailscale (12 hours idle, CSRF, approvals, the lock screen). cloudflared points at a separate loopback port that is always treated as a visit from elsewhere, and failed sign-ins there — a stale cookie, or an Access assertion that doesn't verify, counted per visitor address — are counted apart from this computer's and your tailnet's. `buddi doctor` has a `cloudflare access` row.\n- `buddi doctor browser` and `GET /api/browser/telemetry`: the last week's browser stops by cause, cards and routes, so flakiness can be seen to fall; `buddi doctor` has a browser line too.\n- Missions can browse while you are away, in buddi's own browser only (never your Chrome or apps), when their catalogue package says `\"browser\": \"own\"`; the install card says so. When a mission meets a sign-in, a human check, an uncertain click or its budget, it waits for you with the same card, sent to Telegram with its buttons and held on Home and Needs you; your answer carries the run on where it stopped (an answer given the moment the card arrives counts too; Take over makes the run wait until you give the page back, then it carries on), and with no answer within an hour (`missionWaitMinutes` in the browser settings) it stops and tells you in one line. Browser telemetry rows mark mission runs.\n- A colleague an agent asks for help may use the browser too, but only when you are in the asking conversation and a page is already open there; a mission's colleague never does.\n- Plugins can provide the apps route (host API 1.29: `routes` in the manifest, with health and look/do handlers, plus `reach` for the owner's list of apps, take-over without a remote hand, and native typing for `secret.type`). Tools may stop a run on a result that needs the owner (`waitsForOwner` as a function), declare their own budget (`ownBudget`), and put one card in front of the owner (`ctx.ask`).\n- Cloudflare Access can set itself up: Set it up for me (or `buddi access cloudflare setup --host <hostname>`) takes one Cloudflare API token, kept as an owner secret, and makes the tunnel, its route to this computer, the DNS record and the Access application with an Allow policy for your email, fills in the settings, shows the one `sudo cloudflared service install …` line to run (buddi never runs sudo), waits for the tunnel to connect and tests it. Running it again reuses what it made, by the ids it recorded; something of buddi's name it didn't make stops the run with Use it anyway (`--adopt`) instead of being taken silently; one setup or removal runs at a time, and a setup for another hostname waits until what buddi made for the first is removed; a missing token permission is named; Remove what buddi made (or `buddi access cloudflare remove`) deletes only the objects buddi recorded making. The install line only ever holds a well-formed connector token.\n\n### Changed\n\n- The Cloudflare Access form says what is missing in a plain line until you try to turn it on, and its row no longer says Needs setup while it is off.\n- Tailscale sign-in is now one row of Settings → System → Sign in from elsewhere, beside Cloudflare Access; the panel, its `tailscale serve` line and how it checks you are unchanged, and existing Tailscale sessions carry over. `GET/PUT /api/tailscale` stay for one release as aliases of `/api/access/tailscale`.\n- The browser picks where to look for you instead of asking you to pick a mode: buddi's own browser for every page, in the background (headless, seen on the Canvas); your Chrome for sites that need your sign-in, in background tabs, when you allow it and it is connected; your apps only for app jobs. When a route is not there it falls back without stopping, and the chat says one line when the page was not in buddi's own browser (\"I used your Chrome because Amazon needs your sign-in.\"). A login wall in buddi's browser moves to your Chrome when it can, unless the conversation, the agent or your default keeps it in buddi's browser (then the card offers Use my Chrome instead), and the site is remembered.\n- Settings → Computer & browser is now **Where agents may look**: one row per route instead of mode radios — buddi's own browser (always on; ready, Install · 150 MB, the Linux sandbox command to copy, installing), your Chrome (a switch once paired, connected or Chrome closed, Add to Chrome, the pairing code read from the extension in that browser so it pairs by itself, Pair again when Chrome forgot the pairing, Forget this Chrome; the sites that need your sign-in, yours and the ones buddi added itself, outlined dashed, each removable), your apps only when a plugin provides them (its health and fix, a switch, Settings › to the plugin's own page), a warning with Resume while a Stop holds, and Advanced: the first choice for every agent, the agents with their own rule, the sites that need your sign-in, how long Stop lasts, pages open at once, and showing buddi's browser as a window. No lock while a page is open. Your old choice is carried over: Your browser keeps your Chrome on; Use my apps keeps your apps on (and your Chrome when it is paired). A conversation can be pinned to a route (Use my Chrome under the composer, once your Chrome is paired), an agent too (its page → Tools → Where it may look, written as `browser:` in its agent.md), and Settings keeps a default.\n- Browser stops: you are asked on four occasions only, with one card in the chat, the corner chat and Telegram (one photo, then buttons): \"I’m not sure that went through. Look?\" (Carry on · Look), \"Keep going?\" (Stop here · Keep going), \"Amazon needs your sign-in\" (Save a login for next time · Use my Chrome · Take over) and \"This page asks for a human\" (Skip this site · Take over), each with one line of why; while a Stop holds, \"Browsing is paused since 10:12\" (Keep paused · Resume). A slow page, a stale target, a redirect or a closed tab is retried inside the tool, and every action returns the page as it is after it, so agents no longer \"observe again\" or wait for a paused page.\n- Budgets are 200 actions and an hour per task, renewed by any message or card tap of yours in that conversation, and browser steps no longer use up the agent's turns. Several agents can look at once: three own-browser pages by default (a fourth waits its turn; a page waiting on a card for you doesn't count), several Chrome tabs with one agent per site at a time, one page in your hands and one app job at a time.\n- Stop agents' browsing now expires after an hour (a setting; or until you say), and while it holds an agent shows one card with Resume instead of telling you to visit Settings. A Stop left from before is lifted an hour after it was pressed.\n\n…"
   },
   "files": [
     "packages",