agent-theatre 0.1.2 → 0.1.4

package/README.md

@@ -0,0 +1,47 @@
+# agent-theatre
+
+**Watch your coding agent work — as a film, not a log.**
+
+Agent Theatre turns a Claude Code session into an animated scene. Your repo becomes a stage — folders are districts, files are buildings, test files are beacons — and the agent is a character who walks to the files it reads, builds on the files it edits, runs tests at the beacons and chases gremlins when they fail. Twenty stages, a cast of twelve, every claim checked: **if the agent says it's done but no test has passed since the last edit, a gremlin hides behind it.**
+
+Site and playable episodes: **https://agenttheatre.dev**
+
+## Install
+
+```sh
+cd your-repo
+npx agent-theatre hooks install   # once: adds hooks to ~/.claude/settings.json (backup kept)
+npx agent-theatre                 # opens the stage for this repo; run Claude Code in another terminal
+```
+
+Node 22+. Works with the Claude Code CLI, desktop app and IDE extensions — anything that runs hooks. Hooks are picked up without restarting Claude Code.
+
+## Commands
+
+| Command | What it does |
+|---|---|
+| `agent-theatre` | Start the local server for the current repo and open the stage (live). `--port <n>`, `--no-open`, `--set <id>` |
+| `agent-theatre replay [session]` | Replay a past Claude Code session of this repo; no argument lists them, `--latest` picks the newest |
+| `agent-theatre hooks install` | Add the hooks to `~/.claude/settings.json` (non-destructive, backup at `settings.json.bak-agent-theatre`) |
+| `agent-theatre hooks uninstall` | Remove them, byte-for-byte |
+| `agent-theatre hooks status` | Show whether they are installed |
+
+Stage ids: `island orbit metropolis harbour observatory greenhouse workshop arcade kingdom outpost snowfield canopy lagoon volcano cloudtop reef bazaar monastery moonbase lanterns`. The picker suggests the ones that fit your repo.
+
+## Privacy
+
+Runs entirely on your machine and listens only on `127.0.0.1`. Events carry repo-relative paths, line counts, a command's first word and a classified intent — never file contents, prompts, command bodies or search queries. A test in the repo plants marker strings in all of those and asserts zero leaks. Paths outside the repo appear as `//ext/<name>`; your home directory as `~/`. The hook always exits 0 and never blocks a tool call.
+
+## VS Code
+
+The same stage inside the editor: the `.vsix` is attached to every [GitHub release](https://github.com/shreyassaw5394/agent-theatre/releases).
+
+## Library
+
+```ts
+import { Theatre, scanRepo, repoIdFor, listSessions, installHooks } from "agent-theatre";
+const t = new Theatre({ cwd, repoId: repoIdFor(cwd), files: scanRepo(cwd) });
+await t.listen(0); // t.url → http://127.0.0.1:<port>/
+```
+
+MIT · source: https://github.com/shreyassaw5394/agent-theatre

package/dist/cli.js

@@ -9,9 +9,9 @@ import pc from "picocolors";
 
 // src/server.ts
 import { createServer } from "http";
-import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync as readFileSync2, rmSync, writeFileSync, realpathSync } from "fs";
 import { homedir as homedir2 } from "os";
-import { join as join2, basename as basename2 } from "path";
+import { join as join2, basename as basename2, resolve, sep } from "path";
 import { Hono } from "hono";
 import { getRequestListener } from "@hono/node-server";
 import { WebSocketServer } from "ws";
@@ -1206,6 +1206,8 @@ var Theatre = class {
       } catch {
         return c.body(null, 204);
       }
+      const cwd = typeof payload?.cwd === "string" ? payload.cwd : "";
+      if (cwd && !isWithin(cwd, this.opts.cwd)) return c.body(null, 204);
       const { events } = hookPayloadToEvents(payload, { home: homedir2() });
       if (events.length) this.ingest(events);
       return c.body(null, 204);
@@ -1306,6 +1308,17 @@ var Theatre = class {
     return basename2(this.opts.cwd);
   }
 };
+function isWithin(dir, root) {
+  const norm3 = (p) => {
+    try {
+      return realpathSync(p);
+    } catch {
+      return resolve(p);
+    }
+  };
+  const d = norm3(dir), r = norm3(root);
+  return d === r || d.startsWith(r.endsWith(sep) ? r : r + sep);
+}
 
 // src/scan.ts
 import { readdirSync as readdirSync2, readFileSync as readFileSync3, statSync as statSync2 } from "fs";