@wix/himalaya-cli 0.1118.0 → 0.1120.0

package/dist/cli.mjs

@@ -6762,7 +6762,6 @@ function walk(node, registry, path2, out2) {
 var SYSTEM_FONT_FAMILY, TONAL_ELEVATION_ALPHA;
 var init_tokens = __esm({
   "../../core/ts/src/tokens.ts"() {
-    "use strict";
     SYSTEM_FONT_FAMILY = "$system";
     TONAL_ELEVATION_ALPHA = [0, 0.05, 0.08, 0.11, 0.12, 0.14];
   }
@@ -49227,6 +49226,7 @@ function readInitWatch(dir) {
     const r = JSON.parse(readFileSync52(file, "utf8"));
     if (r.v !== 1 || typeof r.pid !== "number" || !Number.isInteger(r.pid) || r.pid < 1) return null;
     if (typeof r.url !== "string" || !/^http:\/\/127\.0\.0\.1:\d+\//.test(r.url) || typeof r.board !== "string" || typeof r.log !== "string" || typeof r.startedAt !== "string") return null;
+    if (r.root !== runRootId(dir)) return null;
     return r;
   } catch {
     return null;
@@ -49324,7 +49324,7 @@ async function startWatchAtInit(dir, opts) {
     });
     child.unref();
     if (!child.pid) return { skipped: "the live preview did not start (no process) \u2014 start it yourself: `himi run --watch --content <dir> &`" };
-    const record2 = { v: 1, pid: child.pid, url, board, log: WATCH_LOG, startedAt: now.toISOString() };
+    const record2 = { v: 1, pid: child.pid, root: runRootId(dir), url, board, log: WATCH_LOG, startedAt: now.toISOString() };
     if (realDirIn(dir, ".himi")) writeFileAtomic(join46(dir, INIT_WATCH_FILE), `${JSON.stringify(record2, null, 2)}
 `);
     return { started: true, pid: child.pid, url, board, log: WATCH_LOG };
@@ -49384,6 +49384,7 @@ var init_milestones = __esm({
   "src/milestones.ts"() {
     init_app_source();
     init_preview();
+    init_run_identity();
     init_progress();
     init_shell_quote();
     init_studio_reel();
@@ -54035,6 +54036,15 @@ function symlinkComponent(base, abs) {
   }
   return void 0;
 }
+function workspaceRefusal(root, target) {
+  const r = resolve45(root);
+  const t = resolve45(r, target);
+  if (!existsSync54(r)) return `the workspace folder ${r} does not exist`;
+  if (!within(r, t) || !within(realpathSync7(r), realish(t))) return `"${target}" is outside the workspace folder ${r}`;
+  const link = symlinkComponent(r, t);
+  if (link) return `"${link}" is a symlink \u2014 paths must stay in real folders inside the workspace`;
+  return null;
+}
 async function confinedAppDir(args, deps) {
   const root = resolve45(await deps.defaultDir());
   const dir = typeof args.dir === "string" && args.dir ? resolve45(root, args.dir) : root;
@@ -54305,6 +54315,15 @@ function guarded(h) {
   return async (args, deps) => {
     const bad2 = flagShapedInputs(args);
     if (bad2.length) return text6(`refused: ${bad2.join(", ")} may not start with "-" (it would be read as a himi flag)`, true);
+    if (deps.workspaceBoundary) {
+      const base = await deps.defaultDir();
+      for (const k of PATH_ARGS) {
+        const v = args[k];
+        if (typeof v !== "string" || !v) continue;
+        const why = workspaceRefusal(deps.workspaceBoundary, resolve46(base, v));
+        if (why) return text6(`refused: ${k} ${why}`, true);
+      }
+    }
     return h(args, deps);
   };
 }
@@ -54557,7 +54576,7 @@ ${log}` : ""}`, true);
     }
   ];
 }
-var MAX_TEXT2, clip, text6, json3, opt, sw, DIR2, LEARN, CHECK, LOCAL_WRITE, PUBLISH, PREVIEW_HINT, LOGIN_HINT;
+var MAX_TEXT2, clip, text6, json3, opt, sw, DIR2, LEARN, CHECK, LOCAL_WRITE, PUBLISH, PREVIEW_HINT, LOGIN_HINT, PATH_ARGS;
 var init_tools = __esm({
   "src/mcp/tools.ts"() {
     init_file_tools();
@@ -54575,6 +54594,7 @@ var init_tools = __esm({
     PUBLISH = { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true };
     PREVIEW_HINT = "The preview is already running: open `url` in your built-in browser \u2014 Claude Code desktop's browser pane, Cursor's Browser tool, the Browser in Codex inside the ChatGPT desktop app, VS Code's integrated browser. Do not also start the `himi-preview` launch configuration: it serves the same port, and is the way to start a preview only when none is running. A terminal-only agent should show the owner `himi_render` PNGs instead. `board` (when present) is the build board on the same origin.";
     LOGIN_HINT = "Not signed in to the himi serve plane. Call himi_login: it opens a browser window where the user signs in to Wix (this server never sees the credential). A user with a terminal can run `himi login --browser` instead. Then retry.";
+    PATH_ARGS = ["dir", "parentDir", "file"];
   }
 });
 
@@ -54715,7 +54735,8 @@ async function startMcpServer(opts) {
       stop: (dir) => stopPreview(dir, previewDeps)
     },
     readFile: (p) => readFileSync60(p),
-    login: createLoginSession({ ...defaultLoginDeps, selfCommand: previewDeps.selfCommand, ...opts.login })
+    login: createLoginSession({ ...defaultLoginDeps, selfCommand: previewDeps.selfCommand, ...opts.login }),
+    ...opts.workspace ? { workspaceBoundary: opts.workspace } : {}
   };
   const closed = new Promise((resolve54) => {
     stdin.once("end", resolve54);
@@ -57667,6 +57688,7 @@ __export(run_watch_exports, {
   isEmptyDiff: () => isEmptyDiff,
   rebuildBlocker: () => rebuildBlocker,
   reloadEvents: () => reloadEvents,
+  removeInitWatchRecord: () => removeInitWatchRecord,
   removeRunRecord: () => removeRunRecord,
   serialize: () => serialize,
   watchContent: () => watchContent,
@@ -57836,6 +57858,24 @@ function removeRunRecord(dir, owner) {
   }
   rmSync15(join59(root, "run.json"), { force: true });
 }
+function removeInitWatchRecord(dir, owner) {
+  const root = join59(dir, ".himi");
+  try {
+    if (!lstatSync13(root).isDirectory()) return;
+  } catch {
+    return;
+  }
+  const bytes2 = readConfined(root, "watch.json");
+  if (!bytes2) return;
+  let pid;
+  try {
+    pid = JSON.parse(bytes2.toString("utf8")).pid;
+  } catch {
+    return;
+  }
+  if (pid !== owner) return;
+  rmSync15(join59(root, "watch.json"), { force: true });
+}
 function boardFile(dir, pathname) {
   if (pathname === RUN_IDENTITY_PATH) {
     return new Response(JSON.stringify(runIdentity(dir)), { status: 200, headers: { "content-type": "application/json", "cache-control": "no-store" } });
@@ -77537,9 +77577,30 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
         let browserCopy = null;
         let servedMissing = [];
         const fromContent = !source;
+        let dropEarlySignals;
+        let dropInitRecord;
         try {
           if (!source) {
             const dir2 = contentDir(flags);
+            if (watch2) {
+              const { removeInitWatchRecord: removeInitWatchRecord2 } = await Promise.resolve().then(() => (init_run_watch(), run_watch_exports));
+              dropInitRecord = () => removeInitWatchRecord2(dir2, process.pid);
+              const onExit = () => dropInitRecord?.();
+              process.once("exit", onExit);
+              const early = [["SIGINT", 130], ["SIGTERM", 143], ["SIGHUP", 129]].map(([sig, code]) => {
+                const onEarly = () => {
+                  dropInitRecord?.();
+                  process.exit(code);
+                };
+                process.once(sig, onEarly);
+                return [sig, onEarly];
+              });
+              dropEarlySignals = () => {
+                for (const [sig, onEarly] of early) process.removeListener(sig, onEarly);
+                process.removeListener("exit", onExit);
+                dropEarlySignals = void 0;
+              };
+            }
             const app = await appId(dir2);
             const { buildContentBundles: buildContentBundles2, buildReleaseFromContent: buildReleaseFromContent2, bundleOutDir: bundleOutDir2 } = await loadAuthoring();
             const bres = await buildContentBundles2(dir2, { resolution: resolutionFlag(flags) });
@@ -77573,7 +77634,10 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           let startedAt = "";
           const record2 = (served2, build2) => {
             try {
-              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, ...served2.lanUrl ? { lanUrl: served2.lanUrl } : {}, pid: process.pid, startedAt, watching: watch2, build: build2 })) recorded = true;
+              if (recordKit?.writeRunRecord(dir, { url: served2.url, port: served2.port, ...served2.lanUrl ? { lanUrl: served2.lanUrl } : {}, pid: process.pid, startedAt, watching: watch2, build: build2 })) {
+                recorded = true;
+                if (watch2) recordKit.removeInitWatchRecord(dir, process.pid);
+              }
               return null;
             } catch (e) {
               return e.message;
@@ -77610,6 +77674,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               const stop = () => {
                 void retract().catch((e) => io.error(JSON.stringify({ run: "stop_cleanup_failed", message: e.message }))).finally(() => run2.close().finally(() => resolve54()));
               };
+              dropEarlySignals?.();
               process.once("SIGINT", stop);
               process.once("SIGTERM", stop);
             });
@@ -77755,6 +77820,7 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
               }
             };
             const onSignal = () => void stop();
+            dropEarlySignals?.();
             for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.once(sig, onSignal);
             stopNow = (why) => void stop(why);
             armIdle();
@@ -77764,6 +77830,8 @@ default (no --glyph): ${DEFAULT_GLYPH2} \u2014 a mark that claims nothing, so th
           io.error(JSON.stringify({ error: e.message }));
           return 1;
         } finally {
+          dropEarlySignals?.();
+          dropInitRecord?.();
           if (temp) rmSync16(temp, { recursive: true, force: true });
           if (served) rmSync16(served, { recursive: true, force: true });
           if (browserCopy) rmSync16(browserCopy, { recursive: true, force: true });

package/guides/himi-mcp.md

@@ -90,7 +90,9 @@ without following links. They judge the deny-list in every spelling, because mac
 write or delete anything the source deny-list keeps off the machine: `.env` files, the `.himi/`
 secret store, MCP host configs with their keys, key files, and `node_modules`, `dist` and `.git`
 at any depth. When the host names
-no workspace, `HIMI_WORKSPACE` sets the folder. Coding agents edit files themselves, so the flag is
+no workspace, `HIMI_WORKSPACE` sets the folder. It is then a hard boundary for EVERY tool: a
+`dir`, `parentDir` or `file` argument outside it, or through a symlink, is refused. That covers the
+publish and share tools, not only the file tools. Coding agents edit files themselves, so the flag is
 off by default.
 
 **What the tools will not do:** make a release live, build store binaries, touch secrets, write to a

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@wix/himalaya-cli",
-  "version": "0.1118.0",
+  "version": "0.1120.0",
   "type": "module",
   "description": "himi — the Himalaya authoring CLI. Build a Tier-5 content package on your own machine, push it to the production serve as a draft, preview it on web + Himi Player, and read worker logs back — the remote dev loop. Wraps @himalaya/serve-cli for transport.",
   "keywords": [
@@ -67,5 +67,5 @@
       "artifactId": "himalaya-cli"
     }
   },
-  "falconPackageHash": "0784e4485922664a2162f44a261e577db768d5fea176a56d70f0803f"
+  "falconPackageHash": "98cf64fc20ceea962129bd83a948d2491f2a9672af068c757d9ca1d3"
 }