clabox 0.0.1 → 0.1.0

package/lib/run-CNehSQ-S.js

@@ -0,0 +1,113 @@
+import { i as expandHome, t as HOME } from "./config-BQ44iVWT.js";
+import { n as detectPackagePaths, t as buildProfile } from "./profile-DM6NAgb-.js";
+import path from "node:path";
+import { execFileSync, spawnSync } from "node:child_process";
+import fs from "node:fs";
+import crypto from "node:crypto";
+//#region src/sandbox/run.ts
+const TMPDIR = (process.env.TMPDIR || "/tmp").replace(/\/$/, "");
+/** Deterministic per-project profile path under TMPDIR. */
+function profilePath(projectDir = process.cwd()) {
+	const hash = crypto.createHash("sha256").update(projectDir).digest("hex").slice(0, 8);
+	return path.join(TMPDIR, `clabox-${path.basename(projectDir)}-${hash}.sb`);
+}
+/**
+* Effective project dir: `config.cwd` (with `~` expanded, resolved to an
+* absolute path so SBPL `subpath` rules stay valid) if set, else the shell CWD.
+*/
+function resolveProjectDir(config) {
+	return config.cwd ? path.resolve(expandHome(config.cwd)) : process.cwd();
+}
+function which(bin) {
+	try {
+		return execFileSync("command", ["-v", bin], {
+			shell: "/bin/sh",
+			encoding: "utf8"
+		}).trim() || null;
+	} catch {
+		return null;
+	}
+}
+function requireSandboxExec() {
+	if (!which("sandbox-exec")) throw new Error("sandbox-exec not found. This tool requires macOS with sandbox-exec.");
+}
+function resolveClaudeBin(config) {
+	const candidate = config.claudeBin || which("claude") || path.join(HOME, ".local/bin/claude");
+	if (!candidate || !fs.existsSync(candidate)) throw new Error(`claude not found at '${candidate}'`);
+	return candidate;
+}
+/** Generate the profile file for the current project, return its path. */
+function generateProfile(config, projectDir = resolveProjectDir(config)) {
+	requireSandboxExec();
+	const file = profilePath(projectDir);
+	const text = buildProfile(config, {
+		projectDir,
+		detectedPaths: detectPackagePaths()
+	});
+	fs.writeFileSync(file, text);
+	return file;
+}
+/** Build the `env KEY=VALUE …` argument list forced onto the sandboxed claude. */
+function buildEnvArgs(config) {
+	const sshDir = expandHome(config.bot.sshDir);
+	const botKey = path.join(sshDir, "id_ed25519");
+	const botCfg = path.join(sshDir, "config");
+	const args = [
+		`PATH=${path.join(HOME, ".local/bin")}:${process.env.PATH || ""}`,
+		`CLAUDE_CONFIG_DIR=${expandHome(config.configDir)}`,
+		`GIT_AUTHOR_NAME=${config.bot.name}`,
+		`GIT_AUTHOR_EMAIL=${config.bot.email}`,
+		`GIT_COMMITTER_NAME=${config.bot.name}`,
+		`GIT_COMMITTER_EMAIL=${config.bot.email}`,
+		"GIT_CONFIG_COUNT=2",
+		"GIT_CONFIG_KEY_0=commit.gpgsign",
+		"GIT_CONFIG_VALUE_0=false",
+		"GIT_CONFIG_KEY_1=tag.gpgsign",
+		"GIT_CONFIG_VALUE_1=false"
+	];
+	if (fs.existsSync(botKey)) args.push(`GIT_SSH_COMMAND=ssh -F ${botCfg} -i ${botKey} -o IdentitiesOnly=yes -o IdentityAgent=none`);
+	for (const [key, value] of Object.entries(config.env ?? {})) args.push(`${key}=${value}`);
+	return args;
+}
+/** Generate the profile and exec claude under sandbox-exec. Returns exit code. */
+function runClaude(config, claudeArgs, { configFile } = {}) {
+	const projectDir = resolveProjectDir(config);
+	const claudeBin = resolveClaudeBin(config);
+	const profileFile = generateProfile(config, projectDir);
+	if (process.env.CLABOX_DEBUG) {
+		console.error(`→ Running Claude Code sandboxed in:  ${projectDir}`);
+		console.error(`→ Profile: ${profileFile}`);
+		console.error(`→ Config:  ${expandHome(config.configDir)}`);
+		if (configFile) console.error(`→ Config file: ${configFile}`);
+	}
+	const title = projectDir.startsWith(HOME) ? `~${projectDir.slice(HOME.length)}` : projectDir;
+	process.stdout.write(`\x1b]0;${title}\x07`);
+	const envArgs = buildEnvArgs(config);
+	const defaultArgs = Array.isArray(config.claudeArgs) ? config.claudeArgs : [];
+	const inner = [
+		"sandbox-exec",
+		"-f",
+		profileFile,
+		"env",
+		...envArgs,
+		claudeBin,
+		...defaultArgs,
+		...claudeArgs
+	];
+	const res = spawnSync("/bin/sh", [
+		"-c",
+		`${config.ulimitProcs > 0 ? `ulimit -u ${config.ulimitProcs} 2>/dev/null; ` : ""}exec "$@"`,
+		"sh",
+		...inner
+	], {
+		cwd: projectDir,
+		stdio: "inherit"
+	});
+	if (res.error) throw res.error;
+	if (res.signal) return 1;
+	return res.status ?? 0;
+}
+//#endregion
+export { runClaude as a, resolveProjectDir as i, generateProfile as n, profilePath as r, buildEnvArgs as t };
+
+//# sourceMappingURL=run-CNehSQ-S.js.map

package/lib/run-CNehSQ-S.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-CNehSQ-S.js","names":[],"sources":["../src/sandbox/run.ts"],"sourcesContent":["// Profile materialization + launching `claude` under sandbox-exec.\n\nimport { execFileSync, spawnSync } from 'node:child_process';\nimport crypto from 'node:crypto';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { type Config, expandHome, HOME } from '../utils/config.js';\nimport { buildProfile, detectPackagePaths } from './profile.js';\n\nconst TMPDIR = (process.env.TMPDIR || '/tmp').replace(/\\/$/, '');\n\n/** Deterministic per-project profile path under TMPDIR. */\nexport function profilePath(projectDir: string = process.cwd()): string {\n  const hash = crypto.createHash('sha256').update(projectDir).digest('hex').slice(0, 8);\n  return path.join(TMPDIR, `clabox-${path.basename(projectDir)}-${hash}.sb`);\n}\n\n/**\n * Effective project dir: `config.cwd` (with `~` expanded, resolved to an\n * absolute path so SBPL `subpath` rules stay valid) if set, else the shell CWD.\n */\nexport function resolveProjectDir(config: Config): string {\n  return config.cwd ? path.resolve(expandHome(config.cwd)) : process.cwd();\n}\n\nfunction which(bin: string): string | null {\n  try {\n    return (\n      execFileSync('command', ['-v', bin], { shell: '/bin/sh', encoding: 'utf8' }).trim() || null\n    );\n  } catch {\n    return null;\n  }\n}\n\nfunction requireSandboxExec(): void {\n  if (!which('sandbox-exec')) {\n    throw new Error('sandbox-exec not found. This tool requires macOS with sandbox-exec.');\n  }\n}\n\nfunction resolveClaudeBin(config: Config): string {\n  const candidate = config.claudeBin || which('claude') || path.join(HOME, '.local/bin/claude');\n  if (!candidate || !fs.existsSync(candidate)) {\n    throw new Error(`claude not found at '${candidate}'`);\n  }\n  return candidate;\n}\n\n/** Generate the profile file for the current project, return its path. */\nexport function generateProfile(\n  config: Config,\n  projectDir: string = resolveProjectDir(config),\n): string {\n  requireSandboxExec();\n  const file = profilePath(projectDir);\n  const text = buildProfile(config, { projectDir, detectedPaths: detectPackagePaths() });\n  fs.writeFileSync(file, text);\n  return file;\n}\n\n/** Build the `env KEY=VALUE …` argument list forced onto the sandboxed claude. */\nexport function buildEnvArgs(config: Config): string[] {\n  const sshDir = expandHome(config.bot.sshDir);\n  const botKey = path.join(sshDir, 'id_ed25519');\n  const botCfg = path.join(sshDir, 'config');\n  const args = [\n    `PATH=${path.join(HOME, '.local/bin')}:${process.env.PATH || ''}`,\n    `CLAUDE_CONFIG_DIR=${expandHome(config.configDir)}`,\n    `GIT_AUTHOR_NAME=${config.bot.name}`,\n    `GIT_AUTHOR_EMAIL=${config.bot.email}`,\n    `GIT_COMMITTER_NAME=${config.bot.name}`,\n    `GIT_COMMITTER_EMAIL=${config.bot.email}`,\n    'GIT_CONFIG_COUNT=2',\n    'GIT_CONFIG_KEY_0=commit.gpgsign',\n    'GIT_CONFIG_VALUE_0=false',\n    'GIT_CONFIG_KEY_1=tag.gpgsign',\n    'GIT_CONFIG_VALUE_1=false',\n  ];\n  // Pin git ssh to the bot key only when it actually exists, so the sandbox\n  // stays usable without a dedicated bot key configured.\n  if (fs.existsSync(botKey)) {\n    args.push(\n      `GIT_SSH_COMMAND=ssh -F ${botCfg} -i ${botKey} -o IdentitiesOnly=yes -o IdentityAgent=none`,\n    );\n  }\n  // User-declared extras go last so they win over the built-in vars above\n  // (duplicate keys: `env` keeps the last assignment).\n  for (const [key, value] of Object.entries(config.env ?? {})) {\n    args.push(`${key}=${value}`);\n  }\n  return args;\n}\n\n/** Options accepted by {@link runClaude}. */\nexport interface RunOptions {\n  configFile?: string | null;\n}\n\n/** Generate the profile and exec claude under sandbox-exec. Returns exit code. */\nexport function runClaude(\n  config: Config,\n  claudeArgs: string[],\n  { configFile }: RunOptions = {},\n): number {\n  const projectDir = resolveProjectDir(config);\n  const claudeBin = resolveClaudeBin(config);\n  const profileFile = generateProfile(config, projectDir);\n\n  if (process.env.CLABOX_DEBUG) {\n    console.error(`→ Running Claude Code sandboxed in:  ${projectDir}`);\n    console.error(`→ Profile: ${profileFile}`);\n    console.error(`→ Config:  ${expandHome(config.configDir)}`);\n    if (configFile) console.error(`→ Config file: ${configFile}`);\n  }\n\n  // Terminal title = cwd (with ~ for $HOME), matching the bash version.\n  const title = projectDir.startsWith(HOME) ? `~${projectDir.slice(HOME.length)}` : projectDir;\n  process.stdout.write(`\\x1b]0;${title}\\x07`);\n\n  const envArgs = buildEnvArgs(config);\n  const defaultArgs = Array.isArray(config.claudeArgs) ? config.claudeArgs : [];\n  const inner = [\n    'sandbox-exec',\n    '-f',\n    profileFile,\n    'env',\n    ...envArgs,\n    claudeBin,\n    ...defaultArgs,\n    ...claudeArgs,\n  ];\n\n  // `ulimit` is a shell builtin; run the whole thing under sh so we can set it.\n  // `exec \"$@\"` keeps argv intact without re-quoting (args start after $0=sh).\n  const ulimit = config.ulimitProcs > 0 ? `ulimit -u ${config.ulimitProcs} 2>/dev/null; ` : '';\n  const res = spawnSync('/bin/sh', ['-c', `${ulimit}exec \"$@\"`, 'sh', ...inner], {\n    cwd: projectDir,\n    stdio: 'inherit',\n  });\n  if (res.error) throw res.error;\n  if (res.signal) return 1;\n  return res.status ?? 0;\n}\n"],"mappings":";;;;;;;AASA,MAAM,UAAU,QAAQ,IAAI,UAAU,OAAA,CAAQ,QAAQ,OAAO,EAAE;;AAG/D,SAAgB,YAAY,aAAqB,QAAQ,IAAI,GAAW;CACtE,MAAM,OAAO,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC;CACpF,OAAO,KAAK,KAAK,QAAQ,UAAU,KAAK,SAAS,UAAU,EAAE,GAAG,KAAK,IAAI;AAC3E;;;;;AAMA,SAAgB,kBAAkB,QAAwB;CACxD,OAAO,OAAO,MAAM,KAAK,QAAQ,WAAW,OAAO,GAAG,CAAC,IAAI,QAAQ,IAAI;AACzE;AAEA,SAAS,MAAM,KAA4B;CACzC,IAAI;EACF,OACE,aAAa,WAAW,CAAC,MAAM,GAAG,GAAG;GAAE,OAAO;GAAW,UAAU;EAAO,CAAC,CAAC,CAAC,KAAK,KAAK;CAE3F,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,qBAA2B;CAClC,IAAI,CAAC,MAAM,cAAc,GACvB,MAAM,IAAI,MAAM,qEAAqE;AAEzF;AAEA,SAAS,iBAAiB,QAAwB;CAChD,MAAM,YAAY,OAAO,aAAa,MAAM,QAAQ,KAAK,KAAK,KAAK,MAAM,mBAAmB;CAC5F,IAAI,CAAC,aAAa,CAAC,GAAG,WAAW,SAAS,GACxC,MAAM,IAAI,MAAM,wBAAwB,UAAU,EAAE;CAEtD,OAAO;AACT;;AAGA,SAAgB,gBACd,QACA,aAAqB,kBAAkB,MAAM,GACrC;CACR,mBAAmB;CACnB,MAAM,OAAO,YAAY,UAAU;CACnC,MAAM,OAAO,aAAa,QAAQ;EAAE;EAAY,eAAe,mBAAmB;CAAE,CAAC;CACrF,GAAG,cAAc,MAAM,IAAI;CAC3B,OAAO;AACT;;AAGA,SAAgB,aAAa,QAA0B;CACrD,MAAM,SAAS,WAAW,OAAO,IAAI,MAAM;CAC3C,MAAM,SAAS,KAAK,KAAK,QAAQ,YAAY;CAC7C,MAAM,SAAS,KAAK,KAAK,QAAQ,QAAQ;CACzC,MAAM,OAAO;EACX,QAAQ,KAAK,KAAK,MAAM,YAAY,EAAE,GAAG,QAAQ,IAAI,QAAQ;EAC7D,qBAAqB,WAAW,OAAO,SAAS;EAChD,mBAAmB,OAAO,IAAI;EAC9B,oBAAoB,OAAO,IAAI;EAC/B,sBAAsB,OAAO,IAAI;EACjC,uBAAuB,OAAO,IAAI;EAClC;EACA;EACA;EACA;EACA;CACF;CAGA,IAAI,GAAG,WAAW,MAAM,GACtB,KAAK,KACH,0BAA0B,OAAO,MAAM,OAAO,6CAChD;CAIF,KAAK,MAAM,CAAC,KAAK,UAAU,OAAO,QAAQ,OAAO,OAAO,CAAC,CAAC,GACxD,KAAK,KAAK,GAAG,IAAI,GAAG,OAAO;CAE7B,OAAO;AACT;;AAQA,SAAgB,UACd,QACA,YACA,EAAE,eAA2B,CAAC,GACtB;CACR,MAAM,aAAa,kBAAkB,MAAM;CAC3C,MAAM,YAAY,iBAAiB,MAAM;CACzC,MAAM,cAAc,gBAAgB,QAAQ,UAAU;CAEtD,IAAI,QAAQ,IAAI,cAAc;EAC5B,QAAQ,MAAM,wCAAwC,YAAY;EAClE,QAAQ,MAAM,cAAc,aAAa;EACzC,QAAQ,MAAM,cAAc,WAAW,OAAO,SAAS,GAAG;EAC1D,IAAI,YAAY,QAAQ,MAAM,kBAAkB,YAAY;CAC9D;CAGA,MAAM,QAAQ,WAAW,WAAW,IAAI,IAAI,IAAI,WAAW,MAAM,KAAK,MAAM,MAAM;CAClF,QAAQ,OAAO,MAAM,UAAU,MAAM,KAAK;CAE1C,MAAM,UAAU,aAAa,MAAM;CACnC,MAAM,cAAc,MAAM,QAAQ,OAAO,UAAU,IAAI,OAAO,aAAa,CAAC;CAC5E,MAAM,QAAQ;EACZ;EACA;EACA;EACA;EACA,GAAG;EACH;EACA,GAAG;EACH,GAAG;CACL;CAKA,MAAM,MAAM,UAAU,WAAW;EAAC;EAAM,GADzB,OAAO,cAAc,IAAI,aAAa,OAAO,YAAY,kBAAkB,GACxC;EAAY;EAAM,GAAG;CAAK,GAAG;EAC7E,KAAK;EACL,OAAO;CACT,CAAC;CACD,IAAI,IAAI,OAAO,MAAM,IAAI;CACzB,IAAI,IAAI,QAAQ,OAAO;CACvB,OAAO,IAAI,UAAU;AACvB"}

package/lib/run-Cx8cuTh5.d.ts

@@ -0,0 +1,25 @@
+import { i as Config } from "./config-DQWueb4a.js";
+
+//#region src/sandbox/run.d.ts
+/** Deterministic per-project profile path under TMPDIR. */
+declare function profilePath(projectDir?: string): string;
+/**
+ * Effective project dir: `config.cwd` (with `~` expanded, resolved to an
+ * absolute path so SBPL `subpath` rules stay valid) if set, else the shell CWD.
+ */
+declare function resolveProjectDir(config: Config): string;
+/** Generate the profile file for the current project, return its path. */
+declare function generateProfile(config: Config, projectDir?: string): string;
+/** Build the `env KEY=VALUE …` argument list forced onto the sandboxed claude. */
+declare function buildEnvArgs(config: Config): string[];
+/** Options accepted by {@link runClaude}. */
+interface RunOptions {
+  configFile?: string | null;
+}
+/** Generate the profile and exec claude under sandbox-exec. Returns exit code. */
+declare function runClaude(config: Config, claudeArgs: string[], {
+  configFile
+}?: RunOptions): number;
+//#endregion
+export { resolveProjectDir as a, profilePath as i, buildEnvArgs as n, runClaude as o, generateProfile as r, RunOptions as t };
+//# sourceMappingURL=run-Cx8cuTh5.d.ts.map

package/lib/sandbox/profile.d.ts

@@ -0,0 +1,2 @@
+import { a as ipcName, c as regex, i as globalName, l as subpath, n as buildProfile, o as literal, r as detectPackagePaths, s as reEscape, t as ProfileContext } from "../profile-BeM41NXc.js";
+export { ProfileContext, buildProfile, detectPackagePaths, globalName, ipcName, literal, reEscape, regex, subpath };

package/lib/sandbox/profile.js

@@ -0,0 +1,2 @@
+import { a as literal, c as subpath, i as ipcName, n as detectPackagePaths, o as reEscape, r as globalName, s as regex, t as buildProfile } from "../profile-DM6NAgb-.js";
+export { buildProfile, detectPackagePaths, globalName, ipcName, literal, reEscape, regex, subpath };

package/lib/sandbox/run.d.ts

@@ -0,0 +1,2 @@
+import { a as resolveProjectDir, i as profilePath, n as buildEnvArgs, o as runClaude, r as generateProfile, t as RunOptions } from "../run-Cx8cuTh5.js";
+export { RunOptions, buildEnvArgs, generateProfile, profilePath, resolveProjectDir, runClaude };

package/lib/sandbox/run.js

@@ -0,0 +1,2 @@
+import { a as runClaude, i as resolveProjectDir, n as generateProfile, r as profilePath, t as buildEnvArgs } from "../run-CNehSQ-S.js";
+export { buildEnvArgs, generateProfile, profilePath, resolveProjectDir, runClaude };

package/lib/scaffold-ByIbYAeS.d.ts

@@ -0,0 +1,46 @@
+//#region src/init/scaffold.d.ts
+/**
+ * Box names (sorted, de-duplicated) discovered in `<configsDir>` via the same
+ * rules as `-b`: both `<name>.mjs` and `<name>.config.mjs`, `_`-prefixed
+ * shared partials (e.g. `_presets.mjs`) skipped.
+ */
+declare function discoverProfiles(configsDir: string): string[];
+/** Options for {@link runInit}. */
+interface InitOptions {
+  /** Base dir holding `configs/` and `scripts/`. Default: `<cwd>/__`. */
+  baseDir?: string;
+  /** Build the Ghostty apps for `app` boxes. Default: true. */
+  buildApps?: boolean;
+  /** Limit app building to a single box (by box name or app display name). */
+  only?: string | null;
+}
+/** A standalone Ghostty app built by `clabox init`. */
+interface BuiltApp {
+  box: string;
+  appPath: string;
+  signed: 'identity' | 'adhoc';
+}
+/** Result of {@link runInit}. */
+interface InitResult {
+  profiles: string[];
+  scriptsDir: string;
+  indexFile: string;
+  written: string[];
+  /** Apps successfully built. */
+  apps: BuiltApp[];
+  /** Generated Ghostty config files. */
+  ghosttyConfigs: string[];
+  /** Generated Raycast command scripts. */
+  raycastCommands: string[];
+  /** Non-fatal issues (e.g. app build skipped/failed). */
+  warnings: string[];
+}
+/** Scan the configs dir, (re)write the alias scripts, and build `app` apps. */
+declare function runInit({
+  baseDir,
+  buildApps,
+  only
+}?: InitOptions): Promise<InitResult>;
+//#endregion
+export { runInit as a, discoverProfiles as i, InitOptions as n, InitResult as r, BuiltApp as t };
+//# sourceMappingURL=scaffold-ByIbYAeS.d.ts.map

package/lib/scaffold-CRzC5KYe.js

@@ -0,0 +1,141 @@
+import { i as expandHome, l as resolveBox, o as listBoxes, s as loadConfig } from "./config-BQ44iVWT.js";
+import { n as buildAliasFiles } from "./aliases-DKGcMHHe.js";
+import { r as buildGhosttyConfig, t as appBundlePath } from "./ghostty-Ca0g9P9P.js";
+import { n as canBuildApps, t as buildApp } from "./app-CieBa29D.js";
+import { t as buildRaycastCommand } from "./raycast-BCdO2Se1.js";
+import path from "node:path";
+import { execFileSync } from "node:child_process";
+import fs from "node:fs";
+//#region src/init/scaffold.ts
+/**
+* Box names (sorted, de-duplicated) discovered in `<configsDir>` via the same
+* rules as `-b`: both `<name>.mjs` and `<name>.config.mjs`, `_`-prefixed
+* shared partials (e.g. `_presets.mjs`) skipped.
+*/
+function discoverProfiles(configsDir) {
+	if (!fs.existsSync(configsDir)) throw new Error(`clabox init: configs dir not found: ${configsDir}`);
+	const names = listBoxes(configsDir);
+	if (names.length === 0) throw new Error(`clabox init: no box configs (*.mjs) in ${configsDir}`);
+	return names;
+}
+/** Remove previously generated artifacts (`index.sh`, `clabox-*.sh`). */
+function pruneGenerated(scriptsDir) {
+	if (!fs.existsSync(scriptsDir)) return;
+	for (const f of fs.readdirSync(scriptsDir)) if (f === "index.sh" || f.startsWith("clabox-") && f.endsWith(".sh")) fs.rmSync(path.join(scriptsDir, f), { force: true });
+}
+/** Remove files in `dir` whose name ends with `ext` (a no-op if dir is absent). */
+function pruneByExt(dir, ext) {
+	if (!fs.existsSync(dir)) return;
+	for (const f of fs.readdirSync(dir)) if (f.endsWith(ext)) fs.rmSync(path.join(dir, f), { force: true });
+}
+/** Locate the `clabox` binary to bake into the generated Ghostty `command`. */
+function resolveClaboxBin(configured) {
+	if (configured) return expandHome(configured);
+	try {
+		const found = execFileSync("command", ["-v", "clabox"], {
+			shell: "/bin/sh",
+			encoding: "utf8"
+		}).trim();
+		if (found) return found;
+	} catch {}
+	return "clabox";
+}
+/** Generate the Ghostty configs and build the apps for every `app` box. */
+async function buildAppArtifacts(base, configsDir, profiles, only, result) {
+	const appBoxes = [];
+	for (const name of profiles) {
+		const { config } = await loadConfig(resolveBox(name, configsDir));
+		if (!config.app) continue;
+		if (only && name !== only && config.app.name !== only) continue;
+		appBoxes.push({
+			name,
+			config
+		});
+	}
+	if (appBoxes.length === 0) return;
+	const ghosttyDir = path.join(base, "ghostty");
+	const raycastDir = path.join(base, "raycast");
+	fs.mkdirSync(ghosttyDir, { recursive: true });
+	fs.mkdirSync(raycastDir, { recursive: true });
+	if (!only) {
+		pruneByExt(ghosttyDir, ".config");
+		pruneByExt(raycastDir, ".sh");
+	}
+	for (const { name, config } of appBoxes) {
+		const app = config.app;
+		if (!app) continue;
+		const configPath = path.join(ghosttyDir, `${name}.config`);
+		const projectDir = config.cwd ? path.resolve(expandHome(config.cwd)) : null;
+		const baseGhostty = config.appBuilder.baseGhosttyConfig ? expandHome(config.appBuilder.baseGhosttyConfig) : null;
+		fs.writeFileSync(configPath, buildGhosttyConfig({
+			app,
+			boxName: name,
+			projectDir,
+			configsDir,
+			claboxBin: resolveClaboxBin(config.appBuilder.claboxBin),
+			baseGhosttyConfig: baseGhostty
+		}));
+		result.ghosttyConfigs.push(configPath);
+		const appPath = appBundlePath(expandHome(config.appBuilder.appsDir), app);
+		const raycastPath = path.join(raycastDir, `${name}.sh`);
+		fs.writeFileSync(raycastPath, buildRaycastCommand({
+			app,
+			appPath
+		}));
+		fs.chmodSync(raycastPath, 493);
+		result.raycastCommands.push(raycastPath);
+		const check = canBuildApps(config.appBuilder);
+		if (!check.ok) {
+			result.warnings.push(`${name}: app not built (${check.reason})`);
+			continue;
+		}
+		try {
+			const built = buildApp({
+				boxName: name,
+				app,
+				builder: config.appBuilder,
+				configPath
+			});
+			result.apps.push({
+				box: name,
+				appPath: built.appPath,
+				signed: built.signed
+			});
+		} catch (e) {
+			result.warnings.push(`${name}: app build failed — ${e.message}`);
+		}
+	}
+}
+/** Scan the configs dir, (re)write the alias scripts, and build `app` apps. */
+async function runInit({ baseDir, buildApps = true, only = null } = {}) {
+	const base = path.resolve(baseDir ?? path.join(process.cwd(), "__"));
+	const configsDir = path.join(base, "configs");
+	const scriptsDir = path.join(base, "scripts");
+	const profiles = discoverProfiles(configsDir);
+	fs.mkdirSync(scriptsDir, { recursive: true });
+	pruneGenerated(scriptsDir);
+	const files = buildAliasFiles(profiles, {
+		configsDir,
+		scriptsDir
+	});
+	for (const f of files) {
+		fs.writeFileSync(f.path, f.content);
+		if (f.executable) fs.chmodSync(f.path, 493);
+	}
+	const result = {
+		profiles,
+		scriptsDir,
+		indexFile: path.join(scriptsDir, "index.sh"),
+		written: files.map((f) => f.path),
+		apps: [],
+		ghosttyConfigs: [],
+		raycastCommands: [],
+		warnings: []
+	};
+	if (buildApps) await buildAppArtifacts(base, configsDir, profiles, only, result);
+	return result;
+}
+//#endregion
+export { runInit as n, discoverProfiles as t };
+
+//# sourceMappingURL=scaffold-CRzC5KYe.js.map

package/lib/scaffold-CRzC5KYe.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"scaffold-CRzC5KYe.js","names":[],"sources":["../src/init/scaffold.ts"],"sourcesContent":["// I/O for `clabox init`: discover the box configs in `<base>/configs/`,\n// (re)write the shell aliases into `<base>/scripts/`, and — for boxes that opt\n// in via `app` — generate a Ghostty config in `<base>/ghostty/` and build a\n// standalone `<appsDir>/<name>.app` (see init/app.ts).\n\nimport { execFileSync } from 'node:child_process';\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { type Config, expandHome, listBoxes, loadConfig, resolveBox } from '../utils/config.js';\nimport { buildAliasFiles } from './aliases.js';\nimport { buildApp, canBuildApps } from './app.js';\nimport { appBundlePath, buildGhosttyConfig } from './ghostty.js';\nimport { buildRaycastCommand } from './raycast.js';\n\n/**\n * Box names (sorted, de-duplicated) discovered in `<configsDir>` via the same\n * rules as `-b`: both `<name>.mjs` and `<name>.config.mjs`, `_`-prefixed\n * shared partials (e.g. `_presets.mjs`) skipped.\n */\nexport function discoverProfiles(configsDir: string): string[] {\n  if (!fs.existsSync(configsDir)) {\n    throw new Error(`clabox init: configs dir not found: ${configsDir}`);\n  }\n  const names = listBoxes(configsDir);\n  if (names.length === 0) {\n    throw new Error(`clabox init: no box configs (*.mjs) in ${configsDir}`);\n  }\n  return names;\n}\n\n/** Remove previously generated artifacts (`index.sh`, `clabox-*.sh`). */\nfunction pruneGenerated(scriptsDir: string): void {\n  if (!fs.existsSync(scriptsDir)) return;\n  for (const f of fs.readdirSync(scriptsDir)) {\n    if (f === 'index.sh' || (f.startsWith('clabox-') && f.endsWith('.sh'))) {\n      fs.rmSync(path.join(scriptsDir, f), { force: true });\n    }\n  }\n}\n\n/** Remove files in `dir` whose name ends with `ext` (a no-op if dir is absent). */\nfunction pruneByExt(dir: string, ext: string): void {\n  if (!fs.existsSync(dir)) return;\n  for (const f of fs.readdirSync(dir)) {\n    if (f.endsWith(ext)) fs.rmSync(path.join(dir, f), { force: true });\n  }\n}\n\n/** Locate the `clabox` binary to bake into the generated Ghostty `command`. */\nfunction resolveClaboxBin(configured: string | null): string {\n  if (configured) return expandHome(configured);\n  try {\n    const found = execFileSync('command', ['-v', 'clabox'], {\n      shell: '/bin/sh',\n      encoding: 'utf8',\n    }).trim();\n    if (found) return found;\n  } catch {\n    // fall through\n  }\n  return 'clabox';\n}\n\n/** Options for {@link runInit}. */\nexport interface InitOptions {\n  /** Base dir holding `configs/` and `scripts/`. Default: `<cwd>/__`. */\n  baseDir?: string;\n  /** Build the Ghostty apps for `app` boxes. Default: true. */\n  buildApps?: boolean;\n  /** Limit app building to a single box (by box name or app display name). */\n  only?: string | null;\n}\n\n/** A standalone Ghostty app built by `clabox init`. */\nexport interface BuiltApp {\n  box: string;\n  appPath: string;\n  signed: 'identity' | 'adhoc';\n}\n\n/** Result of {@link runInit}. */\nexport interface InitResult {\n  profiles: string[];\n  scriptsDir: string;\n  indexFile: string;\n  written: string[];\n  /** Apps successfully built. */\n  apps: BuiltApp[];\n  /** Generated Ghostty config files. */\n  ghosttyConfigs: string[];\n  /** Generated Raycast command scripts. */\n  raycastCommands: string[];\n  /** Non-fatal issues (e.g. app build skipped/failed). */\n  warnings: string[];\n}\n\n/** Generate the Ghostty configs and build the apps for every `app` box. */\nasync function buildAppArtifacts(\n  base: string,\n  configsDir: string,\n  profiles: string[],\n  only: string | null,\n  result: InitResult,\n): Promise<void> {\n  // Load each box config; keep the ones that opt into an app (and match `only`).\n  const appBoxes: { name: string; config: Config }[] = [];\n  for (const name of profiles) {\n    const { config } = await loadConfig(resolveBox(name, configsDir));\n    if (!config.app) continue;\n    if (only && name !== only && config.app.name !== only) continue;\n    appBoxes.push({ name, config });\n  }\n  if (appBoxes.length === 0) return;\n\n  const ghosttyDir = path.join(base, 'ghostty');\n  const raycastDir = path.join(base, 'raycast');\n  fs.mkdirSync(ghosttyDir, { recursive: true });\n  fs.mkdirSync(raycastDir, { recursive: true });\n  // Only prune on a full run — with `only` we'd orphan other apps' artifacts.\n  if (!only) {\n    pruneByExt(ghosttyDir, '.config');\n    pruneByExt(raycastDir, '.sh');\n  }\n\n  for (const { name, config } of appBoxes) {\n    const app = config.app;\n    if (!app) continue; // narrowed above; keeps the type checker happy\n    const configPath = path.join(ghosttyDir, `${name}.config`);\n    const projectDir = config.cwd ? path.resolve(expandHome(config.cwd)) : null;\n    const baseGhostty = config.appBuilder.baseGhosttyConfig\n      ? expandHome(config.appBuilder.baseGhosttyConfig)\n      : null;\n    fs.writeFileSync(\n      configPath,\n      buildGhosttyConfig({\n        app,\n        boxName: name,\n        projectDir,\n        configsDir,\n        claboxBin: resolveClaboxBin(config.appBuilder.claboxBin),\n        baseGhosttyConfig: baseGhostty,\n      }),\n    );\n    result.ghosttyConfigs.push(configPath);\n\n    // Raycast command that opens the (to be) built bundle.\n    const appPath = appBundlePath(expandHome(config.appBuilder.appsDir), app);\n    const raycastPath = path.join(raycastDir, `${name}.sh`);\n    fs.writeFileSync(raycastPath, buildRaycastCommand({ app, appPath }));\n    fs.chmodSync(raycastPath, 0o755);\n    result.raycastCommands.push(raycastPath);\n\n    const check = canBuildApps(config.appBuilder);\n    if (!check.ok) {\n      result.warnings.push(`${name}: app not built (${check.reason})`);\n      continue;\n    }\n    try {\n      const built = buildApp({ boxName: name, app, builder: config.appBuilder, configPath });\n      result.apps.push({ box: name, appPath: built.appPath, signed: built.signed });\n    } catch (e) {\n      result.warnings.push(`${name}: app build failed — ${(e as Error).message}`);\n    }\n  }\n}\n\n/** Scan the configs dir, (re)write the alias scripts, and build `app` apps. */\nexport async function runInit({\n  baseDir,\n  buildApps = true,\n  only = null,\n}: InitOptions = {}): Promise<InitResult> {\n  const base = path.resolve(baseDir ?? path.join(process.cwd(), '__'));\n  const configsDir = path.join(base, 'configs');\n  const scriptsDir = path.join(base, 'scripts');\n  const profiles = discoverProfiles(configsDir);\n\n  fs.mkdirSync(scriptsDir, { recursive: true });\n  pruneGenerated(scriptsDir);\n\n  const files = buildAliasFiles(profiles, { configsDir, scriptsDir });\n  for (const f of files) {\n    fs.writeFileSync(f.path, f.content);\n    if (f.executable) fs.chmodSync(f.path, 0o755);\n  }\n\n  const result: InitResult = {\n    profiles,\n    scriptsDir,\n    indexFile: path.join(scriptsDir, 'index.sh'),\n    written: files.map((f) => f.path),\n    apps: [],\n    ghosttyConfigs: [],\n    raycastCommands: [],\n    warnings: [],\n  };\n\n  if (buildApps) {\n    await buildAppArtifacts(base, configsDir, profiles, only, result);\n  }\n  return result;\n}\n"],"mappings":";;;;;;;;;;;;;;AAmBA,SAAgB,iBAAiB,YAA8B;CAC7D,IAAI,CAAC,GAAG,WAAW,UAAU,GAC3B,MAAM,IAAI,MAAM,uCAAuC,YAAY;CAErE,MAAM,QAAQ,UAAU,UAAU;CAClC,IAAI,MAAM,WAAW,GACnB,MAAM,IAAI,MAAM,0CAA0C,YAAY;CAExE,OAAO;AACT;;AAGA,SAAS,eAAe,YAA0B;CAChD,IAAI,CAAC,GAAG,WAAW,UAAU,GAAG;CAChC,KAAK,MAAM,KAAK,GAAG,YAAY,UAAU,GACvC,IAAI,MAAM,cAAe,EAAE,WAAW,SAAS,KAAK,EAAE,SAAS,KAAK,GAClE,GAAG,OAAO,KAAK,KAAK,YAAY,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC;AAGzD;;AAGA,SAAS,WAAW,KAAa,KAAmB;CAClD,IAAI,CAAC,GAAG,WAAW,GAAG,GAAG;CACzB,KAAK,MAAM,KAAK,GAAG,YAAY,GAAG,GAChC,IAAI,EAAE,SAAS,GAAG,GAAG,GAAG,OAAO,KAAK,KAAK,KAAK,CAAC,GAAG,EAAE,OAAO,KAAK,CAAC;AAErE;;AAGA,SAAS,iBAAiB,YAAmC;CAC3D,IAAI,YAAY,OAAO,WAAW,UAAU;CAC5C,IAAI;EACF,MAAM,QAAQ,aAAa,WAAW,CAAC,MAAM,QAAQ,GAAG;GACtD,OAAO;GACP,UAAU;EACZ,CAAC,CAAC,CAAC,KAAK;EACR,IAAI,OAAO,OAAO;CACpB,QAAQ,CAER;CACA,OAAO;AACT;;AAoCA,eAAe,kBACb,MACA,YACA,UACA,MACA,QACe;CAEf,MAAM,WAA+C,CAAC;CACtD,KAAK,MAAM,QAAQ,UAAU;EAC3B,MAAM,EAAE,WAAW,MAAM,WAAW,WAAW,MAAM,UAAU,CAAC;EAChE,IAAI,CAAC,OAAO,KAAK;EACjB,IAAI,QAAQ,SAAS,QAAQ,OAAO,IAAI,SAAS,MAAM;EACvD,SAAS,KAAK;GAAE;GAAM;EAAO,CAAC;CAChC;CACA,IAAI,SAAS,WAAW,GAAG;CAE3B,MAAM,aAAa,KAAK,KAAK,MAAM,SAAS;CAC5C,MAAM,aAAa,KAAK,KAAK,MAAM,SAAS;CAC5C,GAAG,UAAU,YAAY,EAAE,WAAW,KAAK,CAAC;CAC5C,GAAG,UAAU,YAAY,EAAE,WAAW,KAAK,CAAC;CAE5C,IAAI,CAAC,MAAM;EACT,WAAW,YAAY,SAAS;EAChC,WAAW,YAAY,KAAK;CAC9B;CAEA,KAAK,MAAM,EAAE,MAAM,YAAY,UAAU;EACvC,MAAM,MAAM,OAAO;EACnB,IAAI,CAAC,KAAK;EACV,MAAM,aAAa,KAAK,KAAK,YAAY,GAAG,KAAK,QAAQ;EACzD,MAAM,aAAa,OAAO,MAAM,KAAK,QAAQ,WAAW,OAAO,GAAG,CAAC,IAAI;EACvE,MAAM,cAAc,OAAO,WAAW,oBAClC,WAAW,OAAO,WAAW,iBAAiB,IAC9C;EACJ,GAAG,cACD,YACA,mBAAmB;GACjB;GACA,SAAS;GACT;GACA;GACA,WAAW,iBAAiB,OAAO,WAAW,SAAS;GACvD,mBAAmB;EACrB,CAAC,CACH;EACA,OAAO,eAAe,KAAK,UAAU;EAGrC,MAAM,UAAU,cAAc,WAAW,OAAO,WAAW,OAAO,GAAG,GAAG;EACxE,MAAM,cAAc,KAAK,KAAK,YAAY,GAAG,KAAK,IAAI;EACtD,GAAG,cAAc,aAAa,oBAAoB;GAAE;GAAK;EAAQ,CAAC,CAAC;EACnE,GAAG,UAAU,aAAa,GAAK;EAC/B,OAAO,gBAAgB,KAAK,WAAW;EAEvC,MAAM,QAAQ,aAAa,OAAO,UAAU;EAC5C,IAAI,CAAC,MAAM,IAAI;GACb,OAAO,SAAS,KAAK,GAAG,KAAK,mBAAmB,MAAM,OAAO,EAAE;GAC/D;EACF;EACA,IAAI;GACF,MAAM,QAAQ,SAAS;IAAE,SAAS;IAAM;IAAK,SAAS,OAAO;IAAY;GAAW,CAAC;GACrF,OAAO,KAAK,KAAK;IAAE,KAAK;IAAM,SAAS,MAAM;IAAS,QAAQ,MAAM;GAAO,CAAC;EAC9E,SAAS,GAAG;GACV,OAAO,SAAS,KAAK,GAAG,KAAK,uBAAwB,EAAY,SAAS;EAC5E;CACF;AACF;;AAGA,eAAsB,QAAQ,EAC5B,SACA,YAAY,MACZ,OAAO,SACQ,CAAC,GAAwB;CACxC,MAAM,OAAO,KAAK,QAAQ,WAAW,KAAK,KAAK,QAAQ,IAAI,GAAG,IAAI,CAAC;CACnE,MAAM,aAAa,KAAK,KAAK,MAAM,SAAS;CAC5C,MAAM,aAAa,KAAK,KAAK,MAAM,SAAS;CAC5C,MAAM,WAAW,iBAAiB,UAAU;CAE5C,GAAG,UAAU,YAAY,EAAE,WAAW,KAAK,CAAC;CAC5C,eAAe,UAAU;CAEzB,MAAM,QAAQ,gBAAgB,UAAU;EAAE;EAAY;CAAW,CAAC;CAClE,KAAK,MAAM,KAAK,OAAO;EACrB,GAAG,cAAc,EAAE,MAAM,EAAE,OAAO;EAClC,IAAI,EAAE,YAAY,GAAG,UAAU,EAAE,MAAM,GAAK;CAC9C;CAEA,MAAM,SAAqB;EACzB;EACA;EACA,WAAW,KAAK,KAAK,YAAY,UAAU;EAC3C,SAAS,MAAM,KAAK,MAAM,EAAE,IAAI;EAChC,MAAM,CAAC;EACP,gBAAgB,CAAC;EACjB,iBAAiB,CAAC;EAClB,UAAU,CAAC;CACb;CAEA,IAAI,WACF,MAAM,kBAAkB,MAAM,YAAY,UAAU,MAAM,MAAM;CAElE,OAAO;AACT"}

package/lib/utils/config.d.ts

@@ -0,0 +1,2 @@
+import { a as HOME, c as configsDir, d as findConfigFile, f as listBoxes, h as resolveBox, i as Config, l as defaultConfig, m as mergeConfig, n as AppConfig, o as LoadedConfig, p as loadConfig, r as BotConfig, s as PathRules, t as AppBuilderConfig, u as expandHome } from "../config-DQWueb4a.js";
+export { AppBuilderConfig, AppConfig, BotConfig, Config, HOME, LoadedConfig, PathRules, configsDir, defaultConfig, expandHome, findConfigFile, listBoxes, loadConfig, mergeConfig, resolveBox };

package/lib/utils/config.js

@@ -0,0 +1,2 @@
+import { a as findConfigFile, c as mergeConfig, i as expandHome, l as resolveBox, n as configsDir, o as listBoxes, r as defaultConfig, s as loadConfig, t as HOME } from "../config-BQ44iVWT.js";
+export { HOME, configsDir, defaultConfig, expandHome, findConfigFile, listBoxes, loadConfig, mergeConfig, resolveBox };

package/package.json

@@ -1,12 +1,146 @@
 {
   "name": "clabox",
-  "version": "0.0.1",
-  "description": "",
-  "main": "index.js",
+  "version": "0.1.0",
+  "description": "Run Claude Code in a sandbox for super-safe YOLO mode",
+  "type": "module",
+  "author": "Igor Suvorov",
+  "license": "MIT",
+  "bin": {
+    "clabox": "lib/cli.js"
+  },
+  "main": "lib/index.js",
+  "types": "lib/index.d.ts",
+  "exports": {
+    ".": {
+      "import": "./lib/index.js",
+      "types": "./lib/index.d.ts",
+      "default": "./lib/index.js"
+    },
+    "./cli": {
+      "import": "./lib/cli.js",
+      "types": "./lib/cli.d.ts",
+      "default": "./lib/cli.js"
+    },
+    "./config": {
+      "import": "./lib/utils/config.js",
+      "types": "./lib/utils/config.d.ts",
+      "default": "./lib/utils/config.js"
+    },
+    "./profile": {
+      "import": "./lib/sandbox/profile.js",
+      "types": "./lib/sandbox/profile.d.ts",
+      "default": "./lib/sandbox/profile.js"
+    },
+    "./run": {
+      "import": "./lib/sandbox/run.js",
+      "types": "./lib/sandbox/run.d.ts",
+      "default": "./lib/sandbox/run.js"
+    },
+    "./*": "./lib/*"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "files": [
+    "lib",
+    "docs",
+    "clabox.config.example.mjs",
+    "README.md",
+    "LICENSE"
+  ],
   "scripts": {
-    "test": "echo \"Error: no test specified\" && exit 1"
+    "build:tsdown": "tsdown",
+    "build:tsdown:release": "tsdown --out-dir lib",
+    "build": "bun run build:tsdown:release",
+    "dev": "tsdown --watch",
+    "cli": "bun run src/cli.ts",
+    "generate": "bun run src/cli.ts generate",
+    "test:unit": "bun test",
+    "test:unit:coverage": "bun test --coverage",
+    "test:unit:watch": "bun test --watch",
+    "test:types": "tsc --noEmit",
+    "test:lint": "biome lint",
+    "test:size": "size-limit",
+    "test": "bun run test:lint && bun run test:types && bun run test:unit && bun run test:size",
+    "fix:lint": "biome check --write",
+    "fix:lint:unsafe": "biome check --write --unsafe",
+    "fix": "bun run fix:lint",
+    "version:release": "semantic-release --no-ci --dry-run",
+    "release": "bun run build && bun run test && bun run version:release && npm publish"
+  },
+  "size-limit": [
+    {
+      "path": "lib/index.js",
+      "limit": "10 kb",
+      "ignore": [
+        "node:*"
+      ]
+    }
+  ],
+  "dependencies": {
+    "yargs": "^17.7.2"
+  },
+  "release": {
+    "branches": [
+      "main"
+    ],
+    "plugins": [
+      "@semantic-release/commit-analyzer",
+      "@semantic-release/release-notes-generator",
+      "@semantic-release/changelog",
+      [
+        "@semantic-release/npm",
+        {
+          "npmPublish": true
+        }
+      ],
+      "@semantic-release/github",
+      [
+        "@semantic-release/git",
+        {
+          "assets": [
+            "package.json",
+            "CHANGELOG.md",
+            "bun.lock"
+          ],
+          "message": "chore(release): ${nextRelease.version} [skip ci]\n\n${nextRelease.notes}"
+        }
+      ]
+    ]
+  },
+  "publishConfig": {
+    "access": "public",
+    "provenance": true
+  },
+  "keywords": [
+    "claude",
+    "claude-code",
+    "sandbox",
+    "seatbelt",
+    "sandbox-exec",
+    "macos",
+    "security",
+    "cli"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/ycmds/clabox.git"
+  },
+  "homepage": "https://github.com/ycmds/clabox#readme",
+  "bugs": {
+    "url": "https://github.com/ycmds/clabox/issues"
   },
-  "keywords": [],
-  "author": "",
-  "license": "ISC"
+  "devDependencies": {
+    "@biomejs/biome": "^2.5.0",
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/git": "^10.0.1",
+    "@size-limit/preset-small-lib": "^12.1.0",
+    "@types/bun": "^1.3.14",
+    "@types/node": "^26.0.0",
+    "@types/yargs": "^17.0.35",
+    "semantic-release": "^25.0.5",
+    "size-limit": "^12.1.0",
+    "tsdown": "^0.22.3",
+    "typescript": "^6.0.3"
+  }
 }