castle-web-cli 0.4.106 → 0.4.107

package/dist/init.js

@@ -37,29 +37,16 @@ const DEFAULT_KIT = "physics-2d";
 // globally-installed castle-web (not from inside the workspace). Bumped
 // alongside cli/sdk version bumps.
 const PUBLISHED_SDK_VERSION = "0.4.11";
-// Never copied into a fresh deck: build/dependency junk. castle.json IS copied
-// (the kit ships a config-only one with the editor layout / file filters), but
-// `scaffoldFromKit` strips any identity fields off it first -- a fresh deck has
-// no deckId until its first save-deck, which owns those fields.
 // The account the first-party kits are (to be) published under, so a kit
 // imported from the CLI's copy is named the same as one fetched from the server.
 const KIT_AUTHOR = "castle";
+// Never copied into a deck's import: build/dependency junk.
 const KIT_COPY_EXCLUDE = new Set([
     "node_modules",
     ".castle",
     "dist",
     ".git",
 ]);
-// Identity fields owned by save-deck, never shipped in a kit's config-only
-// castle.json. Stripped from a copied castle.json (and absent from the bare
-// default) so a fresh deck has no deckId until its first save.
-const CASTLE_JSON_IDENTITY_FIELDS = [
-    "deckId",
-    "cardId",
-    "title",
-    "caption",
-    "visibility",
-];
 // The bare (`--kit none`) deck's default editor config: just the Files panel and
 // a Play panel. No file filtering -- a bare deck is hand-rolled, so the author
 // knows what's there; show everything for now.
@@ -70,22 +57,6 @@ const BARE_CASTLE_JSON = {
         visiblePaths: [],
     },
 };
-// Strip save-deck-owned identity fields from a copied kit castle.json, leaving
-// only its config (the editor block). No-op if the kit shipped no castle.json.
-function stripCastleJsonIdentity(projectDir) {
-    const castlePath = path.join(projectDir, "castle.json");
-    if (!fs.existsSync(castlePath))
-        return;
-    try {
-        const data = JSON.parse(fs.readFileSync(castlePath, "utf8"));
-        for (const field of CASTLE_JSON_IDENTITY_FIELDS)
-            delete data[field];
-        fs.writeFileSync(castlePath, JSON.stringify(data, null, 2) + "\n");
-    }
-    catch {
-        // kit shipped an unparseable castle.json -- leave it for the user to fix
-    }
-}
 // Resolve how a scaffolded deck should reference the sdk + cli. Both the bare
 // and kit scaffold paths go through here so they stay in sync.
 //   workspace mode (sdk/ sits next to cli/, i.e. running from a checkout):
@@ -354,7 +325,8 @@ function scaffoldFromKitImport(kit, projectDir) {
     });
     const kitConfig = readJsonFile(path.join(kitDir, "castle.json")) ?? {};
     const kitPkg = readJsonFile(path.join(kitDir, "package.json")) ?? {};
-    writeDeckIndexHtml(projectDir, alias, String(kitConfig.title ?? kit));
+    const title = typeof kitConfig.title === "string" ? kitConfig.title : kit;
+    writeDeckIndexHtml(projectDir, alias, title);
     writeStarterScene(projectDir, kitDir, alias);
     // The deck's own castle.json: the kit's editor config (panel layout, file
     // filters) as a starting point -- it is the deck's to edit from here -- plus
@@ -385,91 +357,6 @@ function scaffoldFromKitImport(kit, projectDir) {
     appendCommonInstructions(projectDir);
     lockImportTree(importDir);
 }
-function scaffoldFromKit(kit, projectDir) {
-    const kitDir = path.join(getKitsDir(), kit);
-    if (!fs.existsSync(kitDir) || !fs.statSync(kitDir).isDirectory()) {
-        console.error(`Kit "${kit}" not found at ${kitDir}.`);
-        console.error("Available kits:");
-        try {
-            const kits = fs
-                .readdirSync(getKitsDir())
-                .filter((name) => fs.statSync(path.join(getKitsDir(), name)).isDirectory());
-            if (kits.length)
-                for (const name of kits)
-                    console.error(`  ${name}`);
-            else
-                console.error("  (none)");
-        }
-        catch {
-            console.error("  (none — kits/ directory is missing)");
-        }
-        console.error("Or use `--kit none` for a bare code-only deck.");
-        process.exit(1);
-    }
-    fs.cpSync(kitDir, projectDir, {
-        recursive: true,
-        // Keep symlinks verbatim so the kit's AGENTS.md -> CLAUDE.md stays a link.
-        verbatimSymlinks: true,
-        filter: (src) => src === kitDir || !KIT_COPY_EXCLUDE.has(path.basename(src)),
-    });
-    // The kit ships a config-only castle.json (editor layout / file filters); keep
-    // its config but drop any identity fields so this fresh deck has no deckId
-    // until its first save-deck.
-    stripCastleJsonIdentity(projectDir);
-    // The kit's package.json carries the kit's name; rename it to the deck dir.
-    // Kit-relative refs to `../../sdk` and `../../cli/dist` only resolve when the
-    // deck lives at castle-experimental-web/decks/<name>/. Rewrite both to
-    // absolute paths so the scaffolded deck works anywhere -- including under
-    // /tmp where macOS's /tmp -> /private/tmp symlink breaks relative-path math.
-    const pkgPath = path.join(projectDir, "package.json");
-    if (fs.existsSync(pkgPath)) {
-        try {
-            const pkg = JSON.parse(fs.readFileSync(pkgPath, "utf8"));
-            pkg.name = path.basename(projectDir);
-            // Local-dev paths (`file:../../sdk` / `node ../../cli/dist/index.js`) only
-            // work when the deck lives inside the castle-experimental-web workspace.
-            // For a deck scaffolded from a globally-installed castle-web, rewrite to
-            // the published packages instead. Same workspace-vs-published resolution
-            // the bare scaffold path uses.
-            const { workspaceMode, sdkRef, cliDistAbs, sdkPathPosix } = resolveScaffoldRefs();
-            if (pkg.dependencies &&
-                typeof pkg.dependencies["castle-web-sdk"] === "string" &&
-                pkg.dependencies["castle-web-sdk"].startsWith("file:")) {
-                pkg.dependencies["castle-web-sdk"] = sdkRef;
-            }
-            if (pkg.scripts) {
-                for (const k of Object.keys(pkg.scripts)) {
-                    if (typeof pkg.scripts[k] !== "string")
-                        continue;
-                    if (workspaceMode) {
-                        pkg.scripts[k] = pkg.scripts[k]
-                            .replace(/\.\.\/\.\.\/cli\/dist/g, cliDistAbs)
-                            .replace(/\.\.\/\.\.\/sdk/g, sdkPathPosix);
-                    }
-                    else {
-                        // Globally-installed: route through the `castle-web` binary on PATH.
-                        pkg.scripts[k] = pkg.scripts[k]
-                            .replace(/node\s+\.\.\/\.\.\/cli\/dist\/index\.js/g, "castle-web")
-                            .replace(/await import\((['"])\.\.\/\.\.\/cli\/dist\/bundle\.js\1\)/g, "await import('castle-web-cli/dist/bundle.js')")
-                            .replace(/\.\.\/\.\.\/sdk/g, "");
-                    }
-                }
-            }
-            fs.writeFileSync(pkgPath, JSON.stringify(pkg, null, 2) + "\n");
-        }
-        catch {
-            // kit shipped an unparseable package.json — leave it for the user to fix
-        }
-    }
-    // Every deck needs a CLAUDE.md so coding agents know how castle-web works.
-    // Keep the kit's own if it ships one; otherwise generate from the upstream.
-    const claudePath = path.join(projectDir, "CLAUDE.md");
-    if (!fs.existsSync(claudePath)) {
-        fs.writeFileSync(claudePath, makeClaudeMd());
-    }
-    appendCommonInstructions(projectDir);
-    ensureAgentsSymlink(projectDir);
-}
 export async function init(dir, opts = {}) {
     const projectDir = path.resolve(dir);
     if (fs.existsSync(projectDir) && fs.readdirSync(projectDir).length > 0) {

package/dist/metering.d.ts

@@ -30,6 +30,13 @@ export declare function reportCursorRun(opts: {
     durationMs: number;
     ok: boolean;
 }): void;
+/**
+ * True when this serve runs inside a Castle sandbox -- i.e. the host injected the
+ * llm-proxy pair, which is what makes a run metered and limit-gated in the first
+ * place. Outside one there is no Castle budget being spent, so nothing to escape
+ * with a credential of your own; the CLIs just use whatever the host machine has.
+ */
+export declare function inCastleSandbox(): boolean;
 /** Mirrors `CastleBudgetResponse` in castle-sandboxes/shared. */
 export interface CastleBudget {
     usedMicros: number;

package/dist/metering.js

@@ -100,6 +100,15 @@ export function reportCursorRun(opts) {
         /* best-effort: metering must never surface in a finished run */
     });
 }
+/**
+ * True when this serve runs inside a Castle sandbox -- i.e. the host injected the
+ * llm-proxy pair, which is what makes a run metered and limit-gated in the first
+ * place. Outside one there is no Castle budget being spent, so nothing to escape
+ * with a credential of your own; the CLIs just use whatever the host machine has.
+ */
+export function inCastleSandbox() {
+    return Boolean(process.env.CASTLE_LLM_PROXY_URL && process.env.CASTLE_LLM_PROXY_TOKEN);
+}
 // Path on the proxy that reports this sandbox's daily budget. Must match
 // CASTLE_BUDGET_PATH in castle-sandboxes/shared/src/index.ts.
 const CASTLE_BUDGET_PATH = "/castle/budget";

package/dist/native/playtest-browser.js

@@ -79,7 +79,7 @@ function launchFailureMessage(err) {
     return `could not launch chromium: ${message}`;
 }
 async function loadPlaywrightReal() {
-    return (await import("playwright-core"));
+    return await import("playwright-core");
 }
 // playwright-core's exports map does NOT expose ./cli.js (verified against
 // 1.61: resolving it throws ERR_PACKAGE_PATH_NOT_EXPORTED), but it DOES

package/dist/native/tools.js

@@ -40,6 +40,18 @@ function resolveInDeck(deckDir, rawPath) {
         return null;
     return { abs, rel: rel.split(path.sep).join("/") };
 }
+function statFile(target) {
+    let stat;
+    try {
+        stat = fs.statSync(target.abs);
+    }
+    catch {
+        return { error: err(`no such file: ${target.rel}`) };
+    }
+    if (!stat.isFile())
+        return { error: err(`not a file: ${target.rel}`) };
+    return { stat };
+}
 // Sorted recursive file walk (deterministic order matters for grep/list_files
 // results and for tests), skipping IGNORED_DIRS at any depth. Capped as a
 // safety valve against pathological trees, not as a normal limit -- decks are
@@ -93,15 +105,10 @@ function readFileRun(args, ctx) {
     const resolved = resolveInDeck(ctx.deckDir, args.path);
     if (!resolved)
         return err(`path escapes the deck directory: ${String(args.path)}`);
-    let stat;
-    try {
-        stat = fs.statSync(resolved.abs);
-    }
-    catch {
-        return err(`no such file: ${resolved.rel}`);
-    }
-    if (!stat.isFile())
-        return err(`not a file: ${resolved.rel}`);
+    const statted = statFile(resolved);
+    if (statted.error)
+        return statted.error;
+    const stat = statted.stat;
     const ext = path.extname(resolved.rel).toLowerCase();
     if (BINARY_READ_EXTS.has(ext)) {
         return err(`${resolved.rel} is a binary/image file -- it cannot be read as text. Use the view_image tool to look at image files.`);
@@ -167,15 +174,10 @@ function viewImageRun(args, ctx) {
     if (!mime) {
         return err(`${resolved.rel} is not a viewable image -- view_image supports png/jpg/jpeg/gif/webp. SVG and other text formats can be read with read_file.`);
     }
-    let stat;
-    try {
-        stat = fs.statSync(resolved.abs);
-    }
-    catch {
-        return err(`no such file: ${resolved.rel}`);
-    }
-    if (!stat.isFile())
-        return err(`not a file: ${resolved.rel}`);
+    const statted = statFile(resolved);
+    if (statted.error)
+        return statted.error;
+    const stat = statted.stat;
     if (stat.size > VIEW_IMAGE_SIZE_CAP) {
         return err(`${resolved.rel} is too large to view (${(stat.size / (1024 * 1024)).toFixed(1)}MB > ${VIEW_IMAGE_SIZE_CAP / (1024 * 1024)}MB).`);
     }

package/dist/save-deck.js

@@ -96,11 +96,14 @@ export async function saveDeck(dir, opts = {}) {
         console.error('Not logged in. Run `castle-web login` first.');
         process.exit(1);
     }
-    const visibility = opts.visibility ?? 'unlisted';
-    if (visibility !== 'unlisted' && visibility !== 'private') {
-        console.error(`Invalid visibility "${visibility}". Use unlisted or private.`);
+    // `--visibility` arrives as an unchecked string from the command line, so the
+    // declared type is no guarantee -- widen to validate what actually came in.
+    const requested = opts.visibility ?? 'unlisted';
+    if (requested !== 'unlisted' && requested !== 'private') {
+        console.error(`Invalid visibility "${requested}". Use unlisted or private.`);
         process.exit(1);
     }
+    const visibility = requested;
     const projectDir = path.resolve(dir);
     if (!fs.existsSync(path.join(projectDir, 'index.html'))) {
         console.error(`No index.html found in ${projectDir}`);