clabox 0.0.1 → 0.1.0

package/lib/app-CieBa29D.js

@@ -0,0 +1,246 @@
+import { i as expandHome } from "./config-BQ44iVWT.js";
+import { a as bundleId, i as buildLauncherSource, t as appBundlePath } from "./ghostty-Ca0g9P9P.js";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+import os from "node:os";
+//#region src/init/app.ts
+function run(cmd, args) {
+	execFileSync(cmd, args, { stdio: [
+		"ignore",
+		"ignore",
+		"pipe"
+	] });
+}
+function has(bin) {
+	try {
+		execFileSync("command", ["-v", bin], {
+			shell: "/bin/sh",
+			stdio: "ignore"
+		});
+		return true;
+	} catch {
+		return false;
+	}
+}
+/** True when the host can build apps (macOS with the donor app + a C compiler). */
+function canBuildApps(builder) {
+	if (process.platform !== "darwin") return {
+		ok: false,
+		reason: "not macOS"
+	};
+	if (!fs.existsSync(expandHome(builder.ghosttyApp))) return {
+		ok: false,
+		reason: `Ghostty not found at ${builder.ghosttyApp}`
+	};
+	if (!has("cc")) return {
+		ok: false,
+		reason: "no C compiler (cc) — install Xcode CLT"
+	};
+	return { ok: true };
+}
+/** Extract the donor app's entitlements to a tmp file, or null if it has none. */
+function extractEntitlements(ghosttyApp, tmpDir) {
+	let xml;
+	try {
+		xml = execFileSync("codesign", [
+			"-d",
+			"--entitlements",
+			"-",
+			"--xml",
+			ghosttyApp
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		});
+	} catch {
+		return null;
+	}
+	const start = xml.indexOf("<?xml");
+	if (start < 0) return null;
+	const file = path.join(tmpDir, "entitlements.xml");
+	fs.writeFileSync(file, xml.slice(start));
+	return file;
+}
+/** Name of the icon resource referenced by the bundle (default Ghostty.icns). */
+function iconResourceName(plist) {
+	try {
+		const name = execFileSync("plutil", [
+			"-extract",
+			"CFBundleIconFile",
+			"raw",
+			plist
+		], {
+			encoding: "utf8",
+			stdio: [
+				"ignore",
+				"pipe",
+				"ignore"
+			]
+		}).trim();
+		return name.endsWith(".icns") ? name : `${name}.icns`;
+	} catch {
+		return "Ghostty.icns";
+	}
+}
+/** Convert a PNG into a multi-resolution .icns at `out`. */
+function pngToIcns(png, out, tmpDir) {
+	const iconset = path.join(tmpDir, "icon.iconset");
+	fs.mkdirSync(iconset, { recursive: true });
+	for (const size of [
+		16,
+		32,
+		128,
+		256,
+		512
+	]) {
+		run("sips", [
+			"-z",
+			`${size}`,
+			`${size}`,
+			png,
+			"--out",
+			path.join(iconset, `icon_${size}x${size}.png`)
+		]);
+		const d = size * 2;
+		run("sips", [
+			"-z",
+			`${d}`,
+			`${d}`,
+			png,
+			"--out",
+			path.join(iconset, `icon_${size}x${size}@2x.png`)
+		]);
+	}
+	run("iconutil", [
+		"-c",
+		"icns",
+		iconset,
+		"-o",
+		out
+	]);
+}
+/** Install the box icon into the cloned bundle, if `app.icon` is set. */
+function installIcon(app, appPath, tmpDir) {
+	if (!app.icon) return;
+	const icon = expandHome(app.icon);
+	if (!fs.existsSync(icon)) throw new Error(`icon not found: ${app.icon}`);
+	const dest = path.join(appPath, "Contents", "Resources", iconResourceName(path.join(appPath, "Contents", "Info.plist")));
+	if (icon.endsWith(".icns")) fs.copyFileSync(icon, dest);
+	else if (icon.endsWith(".png")) pngToIcns(icon, dest, tmpDir);
+	else throw new Error(`unsupported icon type (need .icns/.png): ${app.icon}`);
+}
+/**
+* Build the standalone Ghostty app for a box. Throws on any failure (the caller
+* decides whether to abort or carry on with the other boxes).
+*/
+function buildApp(opts) {
+	const { app, builder, boxName, configPath } = opts;
+	const check = canBuildApps(builder);
+	if (!check.ok) throw new Error(`cannot build app: ${check.reason}`);
+	const ghosttyApp = expandHome(builder.ghosttyApp);
+	const appsDir = expandHome(builder.appsDir);
+	const appPath = appBundlePath(appsDir, app);
+	const plist = path.join(appPath, "Contents", "Info.plist");
+	const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), "clabox-app-"));
+	try {
+		const entitlements = extractEntitlements(ghosttyApp, tmpDir);
+		fs.mkdirSync(appsDir, { recursive: true });
+		fs.rmSync(appPath, {
+			recursive: true,
+			force: true
+		});
+		run("cp", [
+			"-R",
+			ghosttyApp,
+			appPath
+		]);
+		run("plutil", [
+			"-replace",
+			"CFBundleIdentifier",
+			"-string",
+			bundleId(boxName, app),
+			plist
+		]);
+		run("plutil", [
+			"-replace",
+			"CFBundleName",
+			"-string",
+			app.name,
+			plist
+		]);
+		run("plutil", [
+			"-replace",
+			"CFBundleDisplayName",
+			"-string",
+			app.name,
+			plist
+		]);
+		run("plutil", [
+			"-replace",
+			"CFBundleExecutable",
+			"-string",
+			"ghostty",
+			plist
+		]);
+		run("plutil", [
+			"-replace",
+			"SUEnableAutomaticChecks",
+			"-bool",
+			"NO",
+			plist
+		]);
+		try {
+			run("plutil", [
+				"-replace",
+				"SUFeedURL",
+				"-string",
+				"",
+				plist
+			]);
+		} catch {}
+		const bin = path.join(appPath, "Contents", "MacOS", "ghostty");
+		fs.renameSync(bin, `${bin}.real`);
+		const src = path.join(tmpDir, "launcher.c");
+		fs.writeFileSync(src, buildLauncherSource(configPath));
+		run("cc", [
+			"-o",
+			bin,
+			src
+		]);
+		installIcon(app, appPath, tmpDir);
+		const signId = builder.signId;
+		const entArgs = entitlements ? ["--entitlements", entitlements] : [];
+		const idArgs = signId ? ["--sign", signId] : ["--sign", "-"];
+		run("codesign", [
+			"--force",
+			...idArgs,
+			...entArgs,
+			`${bin}.real`
+		]);
+		run("codesign", [
+			"--force",
+			"--deep",
+			...idArgs,
+			...entArgs,
+			appPath
+		]);
+		return {
+			appPath,
+			signed: signId ? "identity" : "adhoc"
+		};
+	} finally {
+		fs.rmSync(tmpDir, {
+			recursive: true,
+			force: true
+		});
+	}
+}
+//#endregion
+export { canBuildApps as n, buildApp as t };
+
+//# sourceMappingURL=app-CieBa29D.js.map

package/lib/app-CieBa29D.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app-CieBa29D.js","names":[],"sources":["../src/init/app.ts"],"sourcesContent":["// I/O for the `clabox init` Ghostty-app builder (macOS-only).\n//\n// Clones Ghostty.app into `<appsDir>/<name>.app`, swaps the binary for a tiny\n// compiled launcher that bakes in `--config-file=<config>`, sets the icon,\n// disables Sparkle, and re-signs. Mirrors the old ghostty-app-builder.sh. The\n// pure text builders live in init/ghostty.ts.\n\nimport { execFileSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { type AppBuilderConfig, type AppConfig, expandHome } from '../utils/config.js';\nimport { appBundlePath, buildLauncherSource, bundleId } from './ghostty.js';\n\n/** Inputs for {@link buildApp}. */\nexport interface BuildAppOptions {\n  /** The `-b` box name (drives the default bundle id). */\n  boxName: string;\n  app: AppConfig;\n  builder: AppBuilderConfig;\n  /** Absolute path to the already-written Ghostty config to bake in. */\n  configPath: string;\n}\n\n/** Result of a successful {@link buildApp}. */\nexport interface BuildAppResult {\n  appPath: string;\n  signed: 'identity' | 'adhoc';\n}\n\nfunction run(cmd: string, args: string[]): void {\n  execFileSync(cmd, args, { stdio: ['ignore', 'ignore', 'pipe'] });\n}\n\nfunction has(bin: string): boolean {\n  try {\n    execFileSync('command', ['-v', bin], { shell: '/bin/sh', stdio: 'ignore' });\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** True when the host can build apps (macOS with the donor app + a C compiler). */\nexport function canBuildApps(builder: AppBuilderConfig): { ok: boolean; reason?: string } {\n  if (process.platform !== 'darwin') return { ok: false, reason: 'not macOS' };\n  if (!fs.existsSync(expandHome(builder.ghosttyApp))) {\n    return { ok: false, reason: `Ghostty not found at ${builder.ghosttyApp}` };\n  }\n  if (!has('cc')) return { ok: false, reason: 'no C compiler (cc) — install Xcode CLT' };\n  return { ok: true };\n}\n\n/** Extract the donor app's entitlements to a tmp file, or null if it has none. */\nfunction extractEntitlements(ghosttyApp: string, tmpDir: string): string | null {\n  let xml: string;\n  try {\n    xml = execFileSync('codesign', ['-d', '--entitlements', '-', '--xml', ghosttyApp], {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    });\n  } catch {\n    return null;\n  }\n  const start = xml.indexOf('<?xml');\n  if (start < 0) return null;\n  const file = path.join(tmpDir, 'entitlements.xml');\n  fs.writeFileSync(file, xml.slice(start));\n  return file;\n}\n\n/** Name of the icon resource referenced by the bundle (default Ghostty.icns). */\nfunction iconResourceName(plist: string): string {\n  try {\n    const name = execFileSync('plutil', ['-extract', 'CFBundleIconFile', 'raw', plist], {\n      encoding: 'utf8',\n      stdio: ['ignore', 'pipe', 'ignore'],\n    }).trim();\n    return name.endsWith('.icns') ? name : `${name}.icns`;\n  } catch {\n    return 'Ghostty.icns';\n  }\n}\n\n/** Convert a PNG into a multi-resolution .icns at `out`. */\nfunction pngToIcns(png: string, out: string, tmpDir: string): void {\n  const iconset = path.join(tmpDir, 'icon.iconset');\n  fs.mkdirSync(iconset, { recursive: true });\n  for (const size of [16, 32, 128, 256, 512]) {\n    run('sips', [\n      '-z',\n      `${size}`,\n      `${size}`,\n      png,\n      '--out',\n      path.join(iconset, `icon_${size}x${size}.png`),\n    ]);\n    const d = size * 2;\n    run('sips', [\n      '-z',\n      `${d}`,\n      `${d}`,\n      png,\n      '--out',\n      path.join(iconset, `icon_${size}x${size}@2x.png`),\n    ]);\n  }\n  run('iconutil', ['-c', 'icns', iconset, '-o', out]);\n}\n\n/** Install the box icon into the cloned bundle, if `app.icon` is set. */\nfunction installIcon(app: AppConfig, appPath: string, tmpDir: string): void {\n  if (!app.icon) return;\n  const icon = expandHome(app.icon);\n  if (!fs.existsSync(icon)) throw new Error(`icon not found: ${app.icon}`);\n  const dest = path.join(\n    appPath,\n    'Contents',\n    'Resources',\n    iconResourceName(path.join(appPath, 'Contents', 'Info.plist')),\n  );\n  if (icon.endsWith('.icns')) fs.copyFileSync(icon, dest);\n  else if (icon.endsWith('.png')) pngToIcns(icon, dest, tmpDir);\n  else throw new Error(`unsupported icon type (need .icns/.png): ${app.icon}`);\n}\n\n/**\n * Build the standalone Ghostty app for a box. Throws on any failure (the caller\n * decides whether to abort or carry on with the other boxes).\n */\nexport function buildApp(opts: BuildAppOptions): BuildAppResult {\n  const { app, builder, boxName, configPath } = opts;\n  const check = canBuildApps(builder);\n  if (!check.ok) throw new Error(`cannot build app: ${check.reason}`);\n\n  const ghosttyApp = expandHome(builder.ghosttyApp);\n  const appsDir = expandHome(builder.appsDir);\n  const appPath = appBundlePath(appsDir, app);\n  const plist = path.join(appPath, 'Contents', 'Info.plist');\n  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'clabox-app-'));\n\n  try {\n    const entitlements = extractEntitlements(ghosttyApp, tmpDir);\n\n    // Full clone (cp -R keeps bundle symlinks/frameworks intact).\n    fs.mkdirSync(appsDir, { recursive: true });\n    fs.rmSync(appPath, { recursive: true, force: true });\n    run('cp', ['-R', ghosttyApp, appPath]);\n\n    // Identity.\n    run('plutil', ['-replace', 'CFBundleIdentifier', '-string', bundleId(boxName, app), plist]);\n    run('plutil', ['-replace', 'CFBundleName', '-string', app.name, plist]);\n    run('plutil', ['-replace', 'CFBundleDisplayName', '-string', app.name, plist]);\n    run('plutil', ['-replace', 'CFBundleExecutable', '-string', 'ghostty', plist]);\n\n    // Disable Sparkle auto-update (would clobber the clone).\n    run('plutil', ['-replace', 'SUEnableAutomaticChecks', '-bool', 'NO', plist]);\n    try {\n      run('plutil', ['-replace', 'SUFeedURL', '-string', '', plist]);\n    } catch {\n      // donor app may not define SUFeedURL — ignore\n    }\n\n    // Swap the binary for a launcher that prepends --config-file.\n    const bin = path.join(appPath, 'Contents', 'MacOS', 'ghostty');\n    fs.renameSync(bin, `${bin}.real`);\n    const src = path.join(tmpDir, 'launcher.c');\n    fs.writeFileSync(src, buildLauncherSource(configPath));\n    run('cc', ['-o', bin, src]);\n\n    installIcon(app, appPath, tmpDir);\n\n    // Re-sign: inner real binary first, then the whole bundle.\n    const signId = builder.signId;\n    const entArgs = entitlements ? ['--entitlements', entitlements] : [];\n    const idArgs = signId ? ['--sign', signId] : ['--sign', '-'];\n    run('codesign', ['--force', ...idArgs, ...entArgs, `${bin}.real`]);\n    run('codesign', ['--force', '--deep', ...idArgs, ...entArgs, appPath]);\n\n    return { appPath, signed: signId ? 'identity' : 'adhoc' };\n  } finally {\n    fs.rmSync(tmpDir, { recursive: true, force: true });\n  }\n}\n"],"mappings":";;;;;;;AA8BA,SAAS,IAAI,KAAa,MAAsB;CAC9C,aAAa,KAAK,MAAM,EAAE,OAAO;EAAC;EAAU;EAAU;CAAM,EAAE,CAAC;AACjE;AAEA,SAAS,IAAI,KAAsB;CACjC,IAAI;EACF,aAAa,WAAW,CAAC,MAAM,GAAG,GAAG;GAAE,OAAO;GAAW,OAAO;EAAS,CAAC;EAC1E,OAAO;CACT,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAgB,aAAa,SAA6D;CACxF,IAAI,QAAQ,aAAa,UAAU,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAY;CAC3E,IAAI,CAAC,GAAG,WAAW,WAAW,QAAQ,UAAU,CAAC,GAC/C,OAAO;EAAE,IAAI;EAAO,QAAQ,wBAAwB,QAAQ;CAAa;CAE3E,IAAI,CAAC,IAAI,IAAI,GAAG,OAAO;EAAE,IAAI;EAAO,QAAQ;CAAyC;CACrF,OAAO,EAAE,IAAI,KAAK;AACpB;;AAGA,SAAS,oBAAoB,YAAoB,QAA+B;CAC9E,IAAI;CACJ,IAAI;EACF,MAAM,aAAa,YAAY;GAAC;GAAM;GAAkB;GAAK;GAAS;EAAU,GAAG;GACjF,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACpC,CAAC;CACH,QAAQ;EACN,OAAO;CACT;CACA,MAAM,QAAQ,IAAI,QAAQ,OAAO;CACjC,IAAI,QAAQ,GAAG,OAAO;CACtB,MAAM,OAAO,KAAK,KAAK,QAAQ,kBAAkB;CACjD,GAAG,cAAc,MAAM,IAAI,MAAM,KAAK,CAAC;CACvC,OAAO;AACT;;AAGA,SAAS,iBAAiB,OAAuB;CAC/C,IAAI;EACF,MAAM,OAAO,aAAa,UAAU;GAAC;GAAY;GAAoB;GAAO;EAAK,GAAG;GAClF,UAAU;GACV,OAAO;IAAC;IAAU;IAAQ;GAAQ;EACpC,CAAC,CAAC,CAAC,KAAK;EACR,OAAO,KAAK,SAAS,OAAO,IAAI,OAAO,GAAG,KAAK;CACjD,QAAQ;EACN,OAAO;CACT;AACF;;AAGA,SAAS,UAAU,KAAa,KAAa,QAAsB;CACjE,MAAM,UAAU,KAAK,KAAK,QAAQ,cAAc;CAChD,GAAG,UAAU,SAAS,EAAE,WAAW,KAAK,CAAC;CACzC,KAAK,MAAM,QAAQ;EAAC;EAAI;EAAI;EAAK;EAAK;CAAG,GAAG;EAC1C,IAAI,QAAQ;GACV;GACA,GAAG;GACH,GAAG;GACH;GACA;GACA,KAAK,KAAK,SAAS,QAAQ,KAAK,GAAG,KAAK,KAAK;EAC/C,CAAC;EACD,MAAM,IAAI,OAAO;EACjB,IAAI,QAAQ;GACV;GACA,GAAG;GACH,GAAG;GACH;GACA;GACA,KAAK,KAAK,SAAS,QAAQ,KAAK,GAAG,KAAK,QAAQ;EAClD,CAAC;CACH;CACA,IAAI,YAAY;EAAC;EAAM;EAAQ;EAAS;EAAM;CAAG,CAAC;AACpD;;AAGA,SAAS,YAAY,KAAgB,SAAiB,QAAsB;CAC1E,IAAI,CAAC,IAAI,MAAM;CACf,MAAM,OAAO,WAAW,IAAI,IAAI;CAChC,IAAI,CAAC,GAAG,WAAW,IAAI,GAAG,MAAM,IAAI,MAAM,mBAAmB,IAAI,MAAM;CACvE,MAAM,OAAO,KAAK,KAChB,SACA,YACA,aACA,iBAAiB,KAAK,KAAK,SAAS,YAAY,YAAY,CAAC,CAC/D;CACA,IAAI,KAAK,SAAS,OAAO,GAAG,GAAG,aAAa,MAAM,IAAI;MACjD,IAAI,KAAK,SAAS,MAAM,GAAG,UAAU,MAAM,MAAM,MAAM;MACvD,MAAM,IAAI,MAAM,4CAA4C,IAAI,MAAM;AAC7E;;;;;AAMA,SAAgB,SAAS,MAAuC;CAC9D,MAAM,EAAE,KAAK,SAAS,SAAS,eAAe;CAC9C,MAAM,QAAQ,aAAa,OAAO;CAClC,IAAI,CAAC,MAAM,IAAI,MAAM,IAAI,MAAM,qBAAqB,MAAM,QAAQ;CAElE,MAAM,aAAa,WAAW,QAAQ,UAAU;CAChD,MAAM,UAAU,WAAW,QAAQ,OAAO;CAC1C,MAAM,UAAU,cAAc,SAAS,GAAG;CAC1C,MAAM,QAAQ,KAAK,KAAK,SAAS,YAAY,YAAY;CACzD,MAAM,SAAS,GAAG,YAAY,KAAK,KAAK,GAAG,OAAO,GAAG,aAAa,CAAC;CAEnE,IAAI;EACF,MAAM,eAAe,oBAAoB,YAAY,MAAM;EAG3D,GAAG,UAAU,SAAS,EAAE,WAAW,KAAK,CAAC;EACzC,GAAG,OAAO,SAAS;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;EACnD,IAAI,MAAM;GAAC;GAAM;GAAY;EAAO,CAAC;EAGrC,IAAI,UAAU;GAAC;GAAY;GAAsB;GAAW,SAAS,SAAS,GAAG;GAAG;EAAK,CAAC;EAC1F,IAAI,UAAU;GAAC;GAAY;GAAgB;GAAW,IAAI;GAAM;EAAK,CAAC;EACtE,IAAI,UAAU;GAAC;GAAY;GAAuB;GAAW,IAAI;GAAM;EAAK,CAAC;EAC7E,IAAI,UAAU;GAAC;GAAY;GAAsB;GAAW;GAAW;EAAK,CAAC;EAG7E,IAAI,UAAU;GAAC;GAAY;GAA2B;GAAS;GAAM;EAAK,CAAC;EAC3E,IAAI;GACF,IAAI,UAAU;IAAC;IAAY;IAAa;IAAW;IAAI;GAAK,CAAC;EAC/D,QAAQ,CAER;EAGA,MAAM,MAAM,KAAK,KAAK,SAAS,YAAY,SAAS,SAAS;EAC7D,GAAG,WAAW,KAAK,GAAG,IAAI,MAAM;EAChC,MAAM,MAAM,KAAK,KAAK,QAAQ,YAAY;EAC1C,GAAG,cAAc,KAAK,oBAAoB,UAAU,CAAC;EACrD,IAAI,MAAM;GAAC;GAAM;GAAK;EAAG,CAAC;EAE1B,YAAY,KAAK,SAAS,MAAM;EAGhC,MAAM,SAAS,QAAQ;EACvB,MAAM,UAAU,eAAe,CAAC,kBAAkB,YAAY,IAAI,CAAC;EACnE,MAAM,SAAS,SAAS,CAAC,UAAU,MAAM,IAAI,CAAC,UAAU,GAAG;EAC3D,IAAI,YAAY;GAAC;GAAW,GAAG;GAAQ,GAAG;GAAS,GAAG,IAAI;EAAM,CAAC;EACjE,IAAI,YAAY;GAAC;GAAW;GAAU,GAAG;GAAQ,GAAG;GAAS;EAAO,CAAC;EAErE,OAAO;GAAE;GAAS,QAAQ,SAAS,aAAa;EAAQ;CAC1D,UAAU;EACR,GAAG,OAAO,QAAQ;GAAE,WAAW;GAAM,OAAO;EAAK,CAAC;CACpD;AACF"}

package/lib/app-CpuMtOoj.d.ts

@@ -0,0 +1,30 @@
+import { n as AppConfig, t as AppBuilderConfig } from "./config-DQWueb4a.js";
+
+//#region src/init/app.d.ts
+/** Inputs for {@link buildApp}. */
+interface BuildAppOptions {
+  /** The `-b` box name (drives the default bundle id). */
+  boxName: string;
+  app: AppConfig;
+  builder: AppBuilderConfig;
+  /** Absolute path to the already-written Ghostty config to bake in. */
+  configPath: string;
+}
+/** Result of a successful {@link buildApp}. */
+interface BuildAppResult {
+  appPath: string;
+  signed: 'identity' | 'adhoc';
+}
+/** True when the host can build apps (macOS with the donor app + a C compiler). */
+declare function canBuildApps(builder: AppBuilderConfig): {
+  ok: boolean;
+  reason?: string;
+};
+/**
+ * Build the standalone Ghostty app for a box. Throws on any failure (the caller
+ * decides whether to abort or carry on with the other boxes).
+ */
+declare function buildApp(opts: BuildAppOptions): BuildAppResult;
+//#endregion
+export { canBuildApps as i, BuildAppResult as n, buildApp as r, BuildAppOptions as t };
+//# sourceMappingURL=app-CpuMtOoj.d.ts.map

package/lib/cli.d.ts

@@ -0,0 +1 @@
+export { };

package/lib/cli.js

@@ -0,0 +1,71 @@
+#!/usr/bin/env node
+import { l as resolveBox, s as loadConfig } from "./config-BQ44iVWT.js";
+import { n as runInit } from "./scaffold-CRzC5KYe.js";
+import { a as runClaude, i as resolveProjectDir, n as generateProfile, r as profilePath } from "./run-CNehSQ-S.js";
+import path from "node:path";
+import yargs from "yargs";
+import { hideBin } from "yargs/helpers";
+//#region src/cli.ts
+/** Pick the explicit config path: a `--box <name>` wins over `--config <path>`. */
+function explicitConfig(argv) {
+	if (argv.box) return resolveBox(argv.box);
+	return argv.config ?? void 0;
+}
+await yargs(hideBin(process.argv)).scriptName("clabox").parserConfiguration({ "unknown-options-as-args": true }).option("config", {
+	type: "string",
+	describe: "Path to a JS config file (overrides CLABOX_CONFIG)"
+}).option("box", {
+	alias: "b",
+	type: "string",
+	describe: "Run a named config from ~/.config/clabox/configs/<name>.config.mjs"
+}).command(["run [claudeArgs..]", "$0 [claudeArgs..]"], "Generate the profile and run claude inside the sandbox (default)", (y) => y.positional("claudeArgs", {
+	describe: "Arguments passed through to claude",
+	array: true,
+	default: []
+}), async (argv) => {
+	const { config, configFile } = await loadConfig(explicitConfig(argv));
+	const code = runClaude(config, argv.claudeArgs ?? [], { configFile });
+	process.exit(code);
+}).command("generate", "Build the sandbox profile only and print its path", (y) => y, async (argv) => {
+	const { config } = await loadConfig(explicitConfig(argv));
+	console.log(generateProfile(config));
+}).command("profile", "Print the sandbox profile path (no build)", (y) => y, async (argv) => {
+	const { config } = await loadConfig(explicitConfig(argv));
+	console.log(profilePath(resolveProjectDir(config)));
+}).command("init", "Generate clabox-<name> shell aliases and build Ghostty apps for `app` boxes", (y) => y.option("dir", {
+	type: "string",
+	describe: "Base dir holding configs/ and scripts/ (default: ./__)"
+}).option("apps", {
+	type: "boolean",
+	default: true,
+	describe: "Build Ghostty apps for `app` boxes (use --no-apps to skip)"
+}).option("app", {
+	type: "string",
+	describe: "Build only this app box (by box name or app display name)"
+}), async (argv) => {
+	const { profiles, indexFile, written, apps, raycastCommands, warnings } = await runInit({
+		baseDir: argv.dir,
+		buildApps: argv.apps,
+		only: argv.app ?? null
+	});
+	console.log(`clabox init: ${profiles.length} profile(s) → ${profiles.join(", ")}`);
+	for (const f of written) console.log(`  ${path.basename(f)}`);
+	for (const a of apps) console.log(`  📦 ${a.appPath} (${a.signed})`);
+	for (const r of raycastCommands) console.log(`  🚀 ${r}`);
+	for (const w of warnings) console.warn(`  ⚠️  ${w}`);
+	console.log(`\nAdd to ~/.zshrc:  source ${indexFile}`);
+	if (raycastCommands.length > 0) console.log(`Add to Raycast (Script Commands dir):  ${path.dirname(raycastCommands[0])}`);
+}).example("$0 run --dangerously-skip-permissions", "YOLO mode inside the sandbox").example("$0 -b ax-root", "Run the ~/.config/clabox/configs/ax-root.config.mjs box").example("$0 init", "Generate shell aliases from __/configs/*.config.mjs").example("$0 --config ./my.clabox.mjs run", "Use a specific JS config file").example("CLAUDE_CONFIG_DIR=~/.claude_work $0 run", "Use a different Claude profile").epilogue([
+	"Config (later wins): defaults -> env vars -> JS config file.",
+	"File: ./clabox.config.mjs or ~/.config/clabox/config.mjs",
+	"(or --config /path, or CLABOX_CONFIG=/path).",
+	"Named boxes: -b <name> -> ~/.config/clabox/configs/<name>.config.mjs",
+	"(dir overridable via CLABOX_CONFIGS_DIR)."
+].join("\n")).version(false).help().alias("h", "help").fail((msg, err) => {
+	console.error(`Error: ${err?.message ?? msg}`);
+	process.exit(1);
+}).parseAsync();
+//#endregion
+export {};
+
+//# sourceMappingURL=cli.js.map

package/lib/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","names":[],"sources":["../src/cli.ts"],"sourcesContent":["#!/usr/bin/env node\n// clabox — run Claude Code in a sandbox for super-safe YOLO mode.\n// SPDX-License-Identifier: MIT\n//\n// Configure in plain JS: clabox.config.mjs (CWD) or\n// ~/.config/clabox/config.mjs. See clabox.config.example.mjs.\n\nimport path from 'node:path';\nimport yargs from 'yargs';\nimport { hideBin } from 'yargs/helpers';\nimport { runInit } from './init/scaffold.js';\nimport { generateProfile, profilePath, resolveProjectDir, runClaude } from './sandbox/run.js';\nimport { loadConfig, resolveBox } from './utils/config.js';\n\n/** Pick the explicit config path: a `--box <name>` wins over `--config <path>`. */\n// Index signature so any yargs argv (incl. commands with an empty builder)\n// is assignable — `box`/`config` are global options, present on every command.\nfunction explicitConfig(argv: {\n  box?: unknown;\n  config?: unknown;\n  [k: string]: unknown;\n}): string | undefined {\n  if (argv.box) return resolveBox(argv.box as string);\n  return (argv.config as string | undefined) ?? undefined;\n}\n\nawait yargs(hideBin(process.argv))\n  .scriptName('clabox')\n  // Keep unknown flags (e.g. --dangerously-skip-permissions) as positionals so\n  // they pass straight through to claude instead of erroring out.\n  .parserConfiguration({ 'unknown-options-as-args': true })\n  // clabox-owned flag: a config-file path that wins over CLABOX_CONFIG.\n  .option('config', {\n    type: 'string',\n    describe: 'Path to a JS config file (overrides CLABOX_CONFIG)',\n  })\n  // clabox-owned flag: run a named config from the global configs dir.\n  // (`-p` is left for claude's --print; `-c/-r/-d/-v` are claude flags too.)\n  .option('box', {\n    alias: 'b',\n    type: 'string',\n    describe: 'Run a named config from ~/.config/clabox/configs/<name>.config.mjs',\n  })\n  .command(\n    ['run [claudeArgs..]', '$0 [claudeArgs..]'],\n    'Generate the profile and run claude inside the sandbox (default)',\n    (y) =>\n      y.positional('claudeArgs', {\n        describe: 'Arguments passed through to claude',\n        array: true,\n        default: [] as string[],\n      }),\n    async (argv) => {\n      const { config, configFile } = await loadConfig(explicitConfig(argv));\n      const claudeArgs = (argv.claudeArgs ?? []) as string[];\n      const code = runClaude(config, claudeArgs, { configFile });\n      process.exit(code);\n    },\n  )\n  .command(\n    'generate',\n    'Build the sandbox profile only and print its path',\n    (y) => y,\n    async (argv) => {\n      const { config } = await loadConfig(explicitConfig(argv));\n      console.log(generateProfile(config));\n    },\n  )\n  .command(\n    'profile',\n    'Print the sandbox profile path (no build)',\n    (y) => y,\n    async (argv) => {\n      const { config } = await loadConfig(explicitConfig(argv));\n      console.log(profilePath(resolveProjectDir(config)));\n    },\n  )\n  .command(\n    'init',\n    'Generate clabox-<name> shell aliases and build Ghostty apps for `app` boxes',\n    (y) =>\n      y\n        .option('dir', {\n          type: 'string',\n          describe: 'Base dir holding configs/ and scripts/ (default: ./__)',\n        })\n        .option('apps', {\n          type: 'boolean',\n          default: true,\n          describe: 'Build Ghostty apps for `app` boxes (use --no-apps to skip)',\n        })\n        .option('app', {\n          type: 'string',\n          describe: 'Build only this app box (by box name or app display name)',\n        }),\n    async (argv) => {\n      const { profiles, indexFile, written, apps, raycastCommands, warnings } = await runInit({\n        baseDir: argv.dir as string | undefined,\n        buildApps: argv.apps as boolean,\n        only: (argv.app as string | undefined) ?? null,\n      });\n      console.log(`clabox init: ${profiles.length} profile(s) → ${profiles.join(', ')}`);\n      for (const f of written) console.log(`  ${path.basename(f)}`);\n      for (const a of apps) console.log(`  📦 ${a.appPath} (${a.signed})`);\n      for (const r of raycastCommands) console.log(`  🚀 ${r}`);\n      for (const w of warnings) console.warn(`  ⚠️  ${w}`);\n      console.log(`\\nAdd to ~/.zshrc:  source ${indexFile}`);\n      if (raycastCommands.length > 0) {\n        console.log(`Add to Raycast (Script Commands dir):  ${path.dirname(raycastCommands[0])}`);\n      }\n    },\n  )\n  .example('$0 run --dangerously-skip-permissions', 'YOLO mode inside the sandbox')\n  .example('$0 -b ax-root', 'Run the ~/.config/clabox/configs/ax-root.config.mjs box')\n  .example('$0 init', 'Generate shell aliases from __/configs/*.config.mjs')\n  .example('$0 --config ./my.clabox.mjs run', 'Use a specific JS config file')\n  .example('CLAUDE_CONFIG_DIR=~/.claude_work $0 run', 'Use a different Claude profile')\n  .epilogue(\n    [\n      'Config (later wins): defaults -> env vars -> JS config file.',\n      'File: ./clabox.config.mjs or ~/.config/clabox/config.mjs',\n      '(or --config /path, or CLABOX_CONFIG=/path).',\n      'Named boxes: -b <name> -> ~/.config/clabox/configs/<name>.config.mjs',\n      '(dir overridable via CLABOX_CONFIGS_DIR).',\n    ].join('\\n'),\n  )\n  .version(false)\n  .help()\n  .alias('h', 'help')\n  .fail((msg, err) => {\n    console.error(`Error: ${err?.message ?? msg}`);\n    process.exit(1);\n  })\n  .parseAsync();\n"],"mappings":";;;;;;;;;AAiBA,SAAS,eAAe,MAID;CACrB,IAAI,KAAK,KAAK,OAAO,WAAW,KAAK,GAAa;CAClD,OAAQ,KAAK,UAAiC,KAAA;AAChD;AAEA,MAAM,MAAM,QAAQ,QAAQ,IAAI,CAAC,CAAC,CAC/B,WAAW,QAAQ,CAAC,CAGpB,oBAAoB,EAAE,2BAA2B,KAAK,CAAC,CAAC,CAExD,OAAO,UAAU;CAChB,MAAM;CACN,UAAU;AACZ,CAAC,CAAC,CAGD,OAAO,OAAO;CACb,OAAO;CACP,MAAM;CACN,UAAU;AACZ,CAAC,CAAC,CACD,QACC,CAAC,sBAAsB,mBAAmB,GAC1C,qEACC,MACC,EAAE,WAAW,cAAc;CACzB,UAAU;CACV,OAAO;CACP,SAAS,CAAC;AACZ,CAAC,GACH,OAAO,SAAS;CACd,MAAM,EAAE,QAAQ,eAAe,MAAM,WAAW,eAAe,IAAI,CAAC;CAEpE,MAAM,OAAO,UAAU,QADH,KAAK,cAAc,CAAC,GACG,EAAE,WAAW,CAAC;CACzD,QAAQ,KAAK,IAAI;AACnB,CACF,CAAC,CACA,QACC,YACA,sDACC,MAAM,GACP,OAAO,SAAS;CACd,MAAM,EAAE,WAAW,MAAM,WAAW,eAAe,IAAI,CAAC;CACxD,QAAQ,IAAI,gBAAgB,MAAM,CAAC;AACrC,CACF,CAAC,CACA,QACC,WACA,8CACC,MAAM,GACP,OAAO,SAAS;CACd,MAAM,EAAE,WAAW,MAAM,WAAW,eAAe,IAAI,CAAC;CACxD,QAAQ,IAAI,YAAY,kBAAkB,MAAM,CAAC,CAAC;AACpD,CACF,CAAC,CACA,QACC,QACA,gFACC,MACC,EACG,OAAO,OAAO;CACb,MAAM;CACN,UAAU;AACZ,CAAC,CAAC,CACD,OAAO,QAAQ;CACd,MAAM;CACN,SAAS;CACT,UAAU;AACZ,CAAC,CAAC,CACD,OAAO,OAAO;CACb,MAAM;CACN,UAAU;AACZ,CAAC,GACL,OAAO,SAAS;CACd,MAAM,EAAE,UAAU,WAAW,SAAS,MAAM,iBAAiB,aAAa,MAAM,QAAQ;EACtF,SAAS,KAAK;EACd,WAAW,KAAK;EAChB,MAAO,KAAK,OAA8B;CAC5C,CAAC;CACD,QAAQ,IAAI,gBAAgB,SAAS,OAAO,gBAAgB,SAAS,KAAK,IAAI,GAAG;CACjF,KAAK,MAAM,KAAK,SAAS,QAAQ,IAAI,KAAK,KAAK,SAAS,CAAC,GAAG;CAC5D,KAAK,MAAM,KAAK,MAAM,QAAQ,IAAI,QAAQ,EAAE,QAAQ,IAAI,EAAE,OAAO,EAAE;CACnE,KAAK,MAAM,KAAK,iBAAiB,QAAQ,IAAI,QAAQ,GAAG;CACxD,KAAK,MAAM,KAAK,UAAU,QAAQ,KAAK,SAAS,GAAG;CACnD,QAAQ,IAAI,8BAA8B,WAAW;CACrD,IAAI,gBAAgB,SAAS,GAC3B,QAAQ,IAAI,0CAA0C,KAAK,QAAQ,gBAAgB,EAAE,GAAG;AAE5F,CACF,CAAC,CACA,QAAQ,yCAAyC,8BAA8B,CAAC,CAChF,QAAQ,iBAAiB,yDAAyD,CAAC,CACnF,QAAQ,WAAW,qDAAqD,CAAC,CACzE,QAAQ,mCAAmC,+BAA+B,CAAC,CAC3E,QAAQ,2CAA2C,gCAAgC,CAAC,CACpF,SACC;CACE;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,IAAI,CACb,CAAC,CACA,QAAQ,KAAK,CAAC,CACd,KAAK,CAAC,CACN,MAAM,KAAK,MAAM,CAAC,CAClB,MAAM,KAAK,QAAQ;CAClB,QAAQ,MAAM,UAAU,KAAK,WAAW,KAAK;CAC7C,QAAQ,KAAK,CAAC;AAChB,CAAC,CAAC,CACD,WAAW"}

package/lib/config-BQ44iVWT.js

@@ -0,0 +1,155 @@
+import path from "node:path";
+import fs from "node:fs";
+import os from "node:os";
+import { pathToFileURL } from "node:url";
+//#region src/utils/config.ts
+const HOME = os.homedir();
+/** Expand a leading `~` / `~/` to the user's home directory. */
+function expandHome(p) {
+	if (!p) return p;
+	if (p === "~") return HOME;
+	if (p.startsWith("~/")) return path.join(HOME, p.slice(2));
+	return p;
+}
+const env = process.env;
+/** Built-in defaults. Everything here is meant to be overridable. */
+const defaultConfig = {
+	cwd: env.CLABOX_CWD ?? null,
+	claudeBin: env.CLABOX_CLAUDE_BIN ?? null,
+	configDir: env.CLAUDE_CONFIG_DIR ?? "~/.claude",
+	claudeArgs: ["--settings", "{\"includeCoAuthoredBy\": false}"],
+	bot: {
+		name: env.CLABOX_BOT_NAME ?? "claudeBOT",
+		email: env.CLABOX_BOT_EMAIL ?? "bot@example.com",
+		sshDir: env.CLABOX_BOT_SSH_DIR ?? "~/.ssh/claudebot"
+	},
+	env: {},
+	network: true,
+	ulimitProcs: 1024,
+	hooksDir: env.CLABOX_HOOKS_DIR ?? null,
+	paths: {
+		readWrite: [],
+		readOnly: [],
+		exec: [],
+		deny: []
+	},
+	denyHome: [
+		"Documents",
+		"Desktop",
+		"Downloads",
+		"Pictures",
+		"Movies",
+		"Music"
+	],
+	denyDotConfigs: [
+		"aws",
+		"gnupg",
+		"kube",
+		"docker",
+		"config"
+	],
+	appBuilder: {
+		ghosttyApp: env.CLABOX_GHOSTTY_APP ?? "/Applications/Ghostty.app",
+		appsDir: env.CLABOX_APPS_DIR ?? "~/Applications",
+		signId: env.CLABOX_SIGN_ID ?? null,
+		baseGhosttyConfig: env.CLABOX_GHOSTTY_BASE_CONFIG ?? null,
+		claboxBin: env.CLABOX_CLABOX_BIN ?? null
+	}
+};
+function isPlainObject(v) {
+	return v != null && typeof v === "object" && !Array.isArray(v);
+}
+/** Shallow-deep merge: nested plain objects merge, everything else replaces. */
+function deepMerge(base, override) {
+	const out = { ...base };
+	for (const [key, val] of Object.entries(override)) {
+		if (val === void 0) continue;
+		const baseVal = base[key];
+		out[key] = isPlainObject(val) && isPlainObject(baseVal) ? deepMerge(baseVal, val) : val;
+	}
+	return out;
+}
+/** Merge a (partial) override over a full config, returning a new config. */
+function mergeConfig(base, override) {
+	if (!isPlainObject(override)) return base;
+	return deepMerge(base, override);
+}
+/**
+* Locate a config file: explicit (CLI arg, then `CLABOX_CONFIG` env),
+* then CWD, then ~/.config. The CLI arg wins over the env var.
+*/
+function findConfigFile(explicit) {
+	const chosen = explicit ?? env.CLABOX_CONFIG;
+	if (chosen) return expandHome(chosen);
+	return [
+		path.join(process.cwd(), "clabox.config.mjs"),
+		path.join(process.cwd(), "clabox.config.js"),
+		path.join(HOME, ".config", "clabox", "config.mjs")
+	].find((c) => fs.existsSync(c)) ?? null;
+}
+/**
+* Global directory holding named "box" configs (`<name>.config.mjs`), used by
+* the `clabox --box <name>` / `-b` flag. Override with `CLABOX_CONFIGS_DIR`.
+*/
+function configsDir() {
+	return expandHome(env.CLABOX_CONFIGS_DIR ?? "~/.config/clabox/configs");
+}
+const BOX_SUFFIXES = [".config.mjs", ".mjs"];
+/** Candidate file paths for a box name, in resolution order. */
+function boxCandidates(name, dir) {
+	return BOX_SUFFIXES.map((s) => path.join(dir, `${name}${s}`));
+}
+/** Named box configs (sorted, de-duplicated) available in {@link configsDir}. */
+function listBoxes(dir = configsDir()) {
+	let entries;
+	try {
+		entries = fs.readdirSync(dir);
+	} catch {
+		return [];
+	}
+	const names = /* @__PURE__ */ new Set();
+	for (const f of entries) {
+		if (f.startsWith("_")) continue;
+		const suffix = BOX_SUFFIXES.find((s) => f.endsWith(s));
+		if (suffix) names.add(f.slice(0, -suffix.length));
+	}
+	return [...names].sort();
+}
+/**
+* Resolve a box name to its config file in {@link configsDir}, preferring
+* `<name>.config.mjs` over a bare `<name>.mjs`.
+*
+* @throws if no matching file exists (the message lists the available boxes).
+*/
+function resolveBox(name, dir = configsDir()) {
+	if (!name.startsWith("_")) {
+		const found = boxCandidates(name, dir).find((c) => fs.existsSync(c));
+		if (found) return found;
+	}
+	const available = listBoxes(dir);
+	const hint = available.length ? `available: ${available.join(", ")}` : `none found in ${dir}`;
+	throw new Error(`clabox: box '${name}' not found in ${dir} (${hint})`);
+}
+/**
+* Build the effective config: defaults ⊕ env ⊕ config file.
+*
+* @param explicitConfig optional config-file path (e.g. from `--config`);
+*   takes precedence over `CLABOX_CONFIG` and the default lookup locations.
+*/
+async function loadConfig(explicitConfig) {
+	let cfg = defaultConfig;
+	const file = findConfigFile(explicitConfig);
+	if (file) {
+		const mod = await import(pathToFileURL(file).href);
+		const exported = mod.default ?? mod.config ?? mod;
+		cfg = mergeConfig(defaultConfig, typeof exported === "function" ? await exported(defaultConfig) : exported);
+	}
+	return {
+		config: cfg,
+		configFile: file
+	};
+}
+//#endregion
+export { findConfigFile as a, mergeConfig as c, expandHome as i, resolveBox as l, configsDir as n, listBoxes as o, defaultConfig as r, loadConfig as s, HOME as t };
+
+//# sourceMappingURL=config-BQ44iVWT.js.map

package/lib/config-BQ44iVWT.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-BQ44iVWT.js","names":[],"sources":["../src/utils/config.ts"],"sourcesContent":["// Configuration: sane defaults, env overrides, and an optional JS config file.\n//\n// Resolution order (later wins):\n//   1. defaultConfig (below)\n//   2. env vars (CLAUDE_CONFIG_DIR, CLABOX_*, …)\n//   3. a JS config file (see loadConfig)\n//\n// A config file default-exports either a plain object (merged over the defaults)\n// or a function `(defaults) => config` for full programmatic control.\n\nimport fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nexport const HOME = os.homedir();\n\n/** Expand a leading `~` / `~/` to the user's home directory. */\nexport function expandHome(p: string): string {\n  if (!p) return p;\n  if (p === '~') return HOME;\n  if (p.startsWith('~/')) return path.join(HOME, p.slice(2));\n  return p;\n}\n\nconst env = process.env;\n\n/** Dedicated git/ssh identity for commits made from inside the sandbox. */\nexport interface BotConfig {\n  name: string;\n  email: string;\n  /** If `${sshDir}/id_ed25519` exists, git ssh is pinned to it. */\n  sshDir: string;\n}\n\n/**\n * Opt-in marker that turns a box into a standalone Ghostty app. When a box\n * config carries an `app`, `clabox init` generates a Ghostty config for it and\n * builds a cloned `<appsDir>/<name>.app` that launches `clabox -b <box>`.\n */\nexport interface AppConfig {\n  /** App display name → `<appsDir>/<name>.app` + CFBundleName. */\n  name: string;\n  /** Ghostty window title. Defaults to {@link AppConfig.name}. */\n  title?: string;\n  /** Emoji for the generated Raycast command. Default: the title's leading emoji. */\n  emoji?: string;\n  /** Path to a `.icns`/`.png` icon for the .app. `.png` is converted. `~` ok. */\n  icon?: string;\n  /** Ghostty built-in `macos-icon` (e.g. `retro`, `holographic`). */\n  macosIcon?: string;\n  /** Extra raw `key = value` lines appended to the generated Ghostty config. */\n  ghostty?: Record<string, string>;\n  /** Bundle id. Default: `com.ghostty.custom.<name dot-joined>`. */\n  bundleId?: string;\n}\n\n/** Machine-wide settings for the `clabox init` Ghostty-app builder. */\nexport interface AppBuilderConfig {\n  /** Donor app to clone. `~` is expanded. */\n  ghosttyApp: string;\n  /** Where built apps land. `~` is expanded. */\n  appsDir: string;\n  /** codesign identity. null → ad-hoc (`codesign -s -`). */\n  signId: string | null;\n  /** Optional base Ghostty config emitted as a leading `config-file = …`. */\n  baseGhosttyConfig: string | null;\n  /** `clabox` binary baked into the generated `command`. null → autodetect. */\n  claboxBin: string | null;\n}\n\n/** Extra rules layered on top of the built-in base profile. */\nexport interface PathRules {\n  /** RW subpaths (beyond project dir + configDir + /tmp). */\n  readWrite: string[];\n  /** RO subpaths. */\n  readOnly: string[];\n  /** process-exec subpaths. */\n  exec: string[];\n  /** explicit deny subpaths (read + write). */\n  deny: string[];\n}\n\n/** Effective clabox configuration. */\nexport interface Config {\n  /**\n   * Working directory to run `claude` in (and grant RW as the project dir).\n   * null → the shell's CWD. Handy for named boxes that always target one\n   * project regardless of where `clabox` is invoked from. `~` is expanded.\n   */\n  cwd: string | null;\n  /** Path to the `claude` binary. null → autodetect (PATH, then ~/.local/bin). */\n  claudeBin: string | null;\n  /** Claude config/profile directory — supports multiple accounts. */\n  configDir: string;\n  /** Extra args always passed to `claude`, before any args from the CLI. */\n  claudeArgs: string[];\n  bot: BotConfig;\n  /**\n   * Extra environment variables forced onto the sandboxed `claude` process,\n   * layered over the inherited shell env and after the built-in hardening vars\n   * (so a key set here wins). Use it to pass secrets like `GITHUB_TOKEN`.\n   */\n  env: Record<string, string>;\n  /** Allow outbound network. `false` → no `(allow network*)` line. */\n  network: boolean;\n  /** Cap the process table inside the sandbox (fork-bomb guard). 0 → skip. */\n  ulimitProcs: number;\n  /** Extra directory granted read + execute inside the sandbox. null → disabled. */\n  hooksDir: string | null;\n  paths: PathRules;\n  /** Home subdirectories denied entirely (read + write). */\n  denyHome: string[];\n  /** Dotfile config dirs under $HOME denied entirely. */\n  denyDotConfigs: string[];\n  /**\n   * Opt-in: build a standalone Ghostty app for this box during `clabox init`.\n   * Absent → the box only gets a shell alias (the default).\n   */\n  app?: AppConfig;\n  /** Machine-wide settings for the `clabox init` Ghostty-app builder. */\n  appBuilder: AppBuilderConfig;\n}\n\n/** Built-in defaults. Everything here is meant to be overridable. */\nexport const defaultConfig: Config = {\n  cwd: env.CLABOX_CWD ?? null,\n  claudeBin: env.CLABOX_CLAUDE_BIN ?? null,\n  configDir: env.CLAUDE_CONFIG_DIR ?? '~/.claude',\n  claudeArgs: ['--settings', '{\"includeCoAuthoredBy\": false}'],\n  bot: {\n    name: env.CLABOX_BOT_NAME ?? 'claudeBOT',\n    email: env.CLABOX_BOT_EMAIL ?? 'bot@example.com',\n    sshDir: env.CLABOX_BOT_SSH_DIR ?? '~/.ssh/claudebot',\n  },\n  env: {},\n  network: true,\n  ulimitProcs: 1024,\n  hooksDir: env.CLABOX_HOOKS_DIR ?? null,\n  paths: {\n    readWrite: [],\n    readOnly: [],\n    exec: [],\n    deny: [],\n  },\n  denyHome: ['Documents', 'Desktop', 'Downloads', 'Pictures', 'Movies', 'Music'],\n  // `.config/git` is always carved back out for git RO config in the profile.\n  denyDotConfigs: ['aws', 'gnupg', 'kube', 'docker', 'config'],\n  // `app` is opt-in per box, so there's no default — it stays undefined.\n  appBuilder: {\n    ghosttyApp: env.CLABOX_GHOSTTY_APP ?? '/Applications/Ghostty.app',\n    appsDir: env.CLABOX_APPS_DIR ?? '~/Applications',\n    signId: env.CLABOX_SIGN_ID ?? null,\n    baseGhosttyConfig: env.CLABOX_GHOSTTY_BASE_CONFIG ?? null,\n    claboxBin: env.CLABOX_CLABOX_BIN ?? null,\n  },\n};\n\ntype Plain = Record<string, unknown>;\n\nfunction isPlainObject(v: unknown): v is Plain {\n  return v != null && typeof v === 'object' && !Array.isArray(v);\n}\n\n/** Shallow-deep merge: nested plain objects merge, everything else replaces. */\nfunction deepMerge(base: Plain, override: Plain): Plain {\n  const out: Plain = { ...base };\n  for (const [key, val] of Object.entries(override)) {\n    if (val === undefined) continue;\n    const baseVal = base[key];\n    out[key] = isPlainObject(val) && isPlainObject(baseVal) ? deepMerge(baseVal, val) : val;\n  }\n  return out;\n}\n\n/** Merge a (partial) override over a full config, returning a new config. */\nexport function mergeConfig(base: Config, override: unknown): Config {\n  if (!isPlainObject(override)) return base;\n  return deepMerge(base as unknown as Plain, override) as unknown as Config;\n}\n\n/**\n * Locate a config file: explicit (CLI arg, then `CLABOX_CONFIG` env),\n * then CWD, then ~/.config. The CLI arg wins over the env var.\n */\nexport function findConfigFile(explicit?: string | null): string | null {\n  const chosen = explicit ?? env.CLABOX_CONFIG;\n  if (chosen) return expandHome(chosen);\n  const candidates = [\n    path.join(process.cwd(), 'clabox.config.mjs'),\n    path.join(process.cwd(), 'clabox.config.js'),\n    path.join(HOME, '.config', 'clabox', 'config.mjs'),\n  ];\n  return candidates.find((c) => fs.existsSync(c)) ?? null;\n}\n\n/**\n * Global directory holding named \"box\" configs (`<name>.config.mjs`), used by\n * the `clabox --box <name>` / `-b` flag. Override with `CLABOX_CONFIGS_DIR`.\n */\nexport function configsDir(): string {\n  return expandHome(env.CLABOX_CONFIGS_DIR ?? '~/.config/clabox/configs');\n}\n\nconst BOX_SUFFIXES = ['.config.mjs', '.mjs'];\n\n/** Candidate file paths for a box name, in resolution order. */\nfunction boxCandidates(name: string, dir: string): string[] {\n  return BOX_SUFFIXES.map((s) => path.join(dir, `${name}${s}`));\n}\n\n/** Named box configs (sorted, de-duplicated) available in {@link configsDir}. */\nexport function listBoxes(dir: string = configsDir()): string[] {\n  let entries: string[];\n  try {\n    entries = fs.readdirSync(dir);\n  } catch {\n    return [];\n  }\n  const names = new Set<string>();\n  for (const f of entries) {\n    // `_`-prefixed files are shared partials (e.g. `_presets.mjs`), not boxes.\n    if (f.startsWith('_')) continue;\n    const suffix = BOX_SUFFIXES.find((s) => f.endsWith(s));\n    if (suffix) names.add(f.slice(0, -suffix.length));\n  }\n  return [...names].sort();\n}\n\n/**\n * Resolve a box name to its config file in {@link configsDir}, preferring\n * `<name>.config.mjs` over a bare `<name>.mjs`.\n *\n * @throws if no matching file exists (the message lists the available boxes).\n */\nexport function resolveBox(name: string, dir: string = configsDir()): string {\n  // `_`-prefixed files are shared partials (e.g. `_presets.mjs`), not boxes —\n  // keep them un-resolvable so `-b` matches what `listBoxes` advertises.\n  if (!name.startsWith('_')) {\n    const found = boxCandidates(name, dir).find((c) => fs.existsSync(c));\n    if (found) return found;\n  }\n  const available = listBoxes(dir);\n  const hint = available.length ? `available: ${available.join(', ')}` : `none found in ${dir}`;\n  throw new Error(`clabox: box '${name}' not found in ${dir} (${hint})`);\n}\n\n/** Result of {@link loadConfig}: the effective config and the file it came from. */\nexport interface LoadedConfig {\n  config: Config;\n  configFile: string | null;\n}\n\n/**\n * Build the effective config: defaults ⊕ env ⊕ config file.\n *\n * @param explicitConfig optional config-file path (e.g. from `--config`);\n *   takes precedence over `CLABOX_CONFIG` and the default lookup locations.\n */\nexport async function loadConfig(explicitConfig?: string | null): Promise<LoadedConfig> {\n  let cfg: Config = defaultConfig;\n  const file = findConfigFile(explicitConfig);\n  if (file) {\n    const mod = await import(pathToFileURL(file).href);\n    const exported = mod.default ?? mod.config ?? mod;\n    const resolved = typeof exported === 'function' ? await exported(defaultConfig) : exported;\n    cfg = mergeConfig(defaultConfig, resolved);\n  }\n  return { config: cfg, configFile: file };\n}\n"],"mappings":";;;;;AAeA,MAAa,OAAO,GAAG,QAAQ;;AAG/B,SAAgB,WAAW,GAAmB;CAC5C,IAAI,CAAC,GAAG,OAAO;CACf,IAAI,MAAM,KAAK,OAAO;CACtB,IAAI,EAAE,WAAW,IAAI,GAAG,OAAO,KAAK,KAAK,MAAM,EAAE,MAAM,CAAC,CAAC;CACzD,OAAO;AACT;AAEA,MAAM,MAAM,QAAQ;;AAoGpB,MAAa,gBAAwB;CACnC,KAAK,IAAI,cAAc;CACvB,WAAW,IAAI,qBAAqB;CACpC,WAAW,IAAI,qBAAqB;CACpC,YAAY,CAAC,cAAc,kCAAgC;CAC3D,KAAK;EACH,MAAM,IAAI,mBAAmB;EAC7B,OAAO,IAAI,oBAAoB;EAC/B,QAAQ,IAAI,sBAAsB;CACpC;CACA,KAAK,CAAC;CACN,SAAS;CACT,aAAa;CACb,UAAU,IAAI,oBAAoB;CAClC,OAAO;EACL,WAAW,CAAC;EACZ,UAAU,CAAC;EACX,MAAM,CAAC;EACP,MAAM,CAAC;CACT;CACA,UAAU;EAAC;EAAa;EAAW;EAAa;EAAY;EAAU;CAAO;CAE7E,gBAAgB;EAAC;EAAO;EAAS;EAAQ;EAAU;CAAQ;CAE3D,YAAY;EACV,YAAY,IAAI,sBAAsB;EACtC,SAAS,IAAI,mBAAmB;EAChC,QAAQ,IAAI,kBAAkB;EAC9B,mBAAmB,IAAI,8BAA8B;EACrD,WAAW,IAAI,qBAAqB;CACtC;AACF;AAIA,SAAS,cAAc,GAAwB;CAC7C,OAAO,KAAK,QAAQ,OAAO,MAAM,YAAY,CAAC,MAAM,QAAQ,CAAC;AAC/D;;AAGA,SAAS,UAAU,MAAa,UAAwB;CACtD,MAAM,MAAa,EAAE,GAAG,KAAK;CAC7B,KAAK,MAAM,CAAC,KAAK,QAAQ,OAAO,QAAQ,QAAQ,GAAG;EACjD,IAAI,QAAQ,KAAA,GAAW;EACvB,MAAM,UAAU,KAAK;EACrB,IAAI,OAAO,cAAc,GAAG,KAAK,cAAc,OAAO,IAAI,UAAU,SAAS,GAAG,IAAI;CACtF;CACA,OAAO;AACT;;AAGA,SAAgB,YAAY,MAAc,UAA2B;CACnE,IAAI,CAAC,cAAc,QAAQ,GAAG,OAAO;CACrC,OAAO,UAAU,MAA0B,QAAQ;AACrD;;;;;AAMA,SAAgB,eAAe,UAAyC;CACtE,MAAM,SAAS,YAAY,IAAI;CAC/B,IAAI,QAAQ,OAAO,WAAW,MAAM;CAMpC,OAAO;EAJL,KAAK,KAAK,QAAQ,IAAI,GAAG,mBAAmB;EAC5C,KAAK,KAAK,QAAQ,IAAI,GAAG,kBAAkB;EAC3C,KAAK,KAAK,MAAM,WAAW,UAAU,YAAY;CAEnC,CAAC,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC,KAAK;AACrD;;;;;AAMA,SAAgB,aAAqB;CACnC,OAAO,WAAW,IAAI,sBAAsB,0BAA0B;AACxE;AAEA,MAAM,eAAe,CAAC,eAAe,MAAM;;AAG3C,SAAS,cAAc,MAAc,KAAuB;CAC1D,OAAO,aAAa,KAAK,MAAM,KAAK,KAAK,KAAK,GAAG,OAAO,GAAG,CAAC;AAC9D;;AAGA,SAAgB,UAAU,MAAc,WAAW,GAAa;CAC9D,IAAI;CACJ,IAAI;EACF,UAAU,GAAG,YAAY,GAAG;CAC9B,QAAQ;EACN,OAAO,CAAC;CACV;CACA,MAAM,wBAAQ,IAAI,IAAY;CAC9B,KAAK,MAAM,KAAK,SAAS;EAEvB,IAAI,EAAE,WAAW,GAAG,GAAG;EACvB,MAAM,SAAS,aAAa,MAAM,MAAM,EAAE,SAAS,CAAC,CAAC;EACrD,IAAI,QAAQ,MAAM,IAAI,EAAE,MAAM,GAAG,CAAC,OAAO,MAAM,CAAC;CAClD;CACA,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,KAAK;AACzB;;;;;;;AAQA,SAAgB,WAAW,MAAc,MAAc,WAAW,GAAW;CAG3E,IAAI,CAAC,KAAK,WAAW,GAAG,GAAG;EACzB,MAAM,QAAQ,cAAc,MAAM,GAAG,CAAC,CAAC,MAAM,MAAM,GAAG,WAAW,CAAC,CAAC;EACnE,IAAI,OAAO,OAAO;CACpB;CACA,MAAM,YAAY,UAAU,GAAG;CAC/B,MAAM,OAAO,UAAU,SAAS,cAAc,UAAU,KAAK,IAAI,MAAM,iBAAiB;CACxF,MAAM,IAAI,MAAM,gBAAgB,KAAK,iBAAiB,IAAI,IAAI,KAAK,EAAE;AACvE;;;;;;;AAcA,eAAsB,WAAW,gBAAuD;CACtF,IAAI,MAAc;CAClB,MAAM,OAAO,eAAe,cAAc;CAC1C,IAAI,MAAM;EACR,MAAM,MAAM,MAAM,OAAO,cAAc,IAAI,CAAC,CAAC;EAC7C,MAAM,WAAW,IAAI,WAAW,IAAI,UAAU;EAE9C,MAAM,YAAY,eADD,OAAO,aAAa,aAAa,MAAM,SAAS,aAAa,IAAI,QACzC;CAC3C;CACA,OAAO;EAAE,QAAQ;EAAK,YAAY;CAAK;AACzC"}