codeply-cli 0.1.1 → 0.3.0

package/lib/apply-limit.js

@@ -1,41 +1,33 @@
-/**
- * Codeply CLI — daily apply cap
- *
- * Reuses the EXACT same Supabase table/RPC the desktop app checks against
- * (apply_history + get_daily_apply_count(), see Codeply-App/supabase/
- * apply_limit.sql) — an apply from the CLI counts toward the same account's
- * 100/day cap as an apply from the desktop app, not a separate bucket.
- */
-const { getClient, getSession } = require('./auth');
-
-const DAILY_APPLY_LIMIT = 100;
-
-/** Returns { allowed, count, limit }. Fails OPEN on a DB hiccup, same as the desktop app. */
-async function checkApplyLimit() {
-  const session = await getSession();
-  if (!session) return { allowed: false, count: 0, limit: DAILY_APPLY_LIMIT, error: 'Not signed in. Run `codeply login` first.' };
-
-  const supabase = getClient();
-  try {
-    const { data, error } = await supabase.rpc('get_daily_apply_count');
-    if (error || typeof data !== 'number') throw error || new Error('unexpected response');
-    return { allowed: data < DAILY_APPLY_LIMIT, count: data, limit: DAILY_APPLY_LIMIT };
-  } catch (e) {
-    console.warn('[apply-limit] check failed, allowing:', e.message);
-    return { allowed: true, count: 0, limit: DAILY_APPLY_LIMIT };
-  }
-}
-
-/** Records one successful file write toward the daily cap. Fire-and-forget. */
-async function recordApplyEvent(filePath) {
-  const session = await getSession();
-  if (!session) return;
-  const supabase = getClient();
-  try {
-    await supabase.from('apply_history').insert({ user_id: session.user.id, file_path: filePath || '' });
-  } catch (e) {
-    console.warn('[apply-limit] record failed:', e.message);
-  }
-}
-
-module.exports = { DAILY_APPLY_LIMIT, checkApplyLimit, recordApplyEvent };
+/**
+ * Codeply CLI - apply accounting
+ *
+ * There are no paid plans or daily apply caps any more: checkApplyLimit()
+ * always allows the write. recordApplyEvent() still logs a successful write
+ * to the shared apply_history table (counts only, never file content) so the
+ * admin dashboard keeps its usage numbers. It is fire-and-forget - a slow or
+ * failing insert never holds up the agent.
+ */
+const { getClient, getSession } = require('./auth');
+
+/** Kept for API compatibility with older callers. Always allowed. */
+async function checkApplyLimit() {
+  return { allowed: true, count: 0, limit: Infinity };
+}
+
+async function recordApplyEvent(filePath, linesAdded = 0, linesRemoved = 0) {
+  try {
+    const session = await getSession();
+    if (!session) return;
+    const { error } = await getClient().from('apply_history').insert({
+      user_id: session.user.id,
+      file_path: filePath || '',
+      lines_added: linesAdded || 0,
+      lines_removed: linesRemoved || 0,
+    });
+    if (error) console.warn('[apply-limit] record failed:', error.message);
+  } catch (e) {
+    console.warn('[apply-limit] record failed:', e.message);
+  }
+}
+
+module.exports = { checkApplyLimit, recordApplyEvent };

package/lib/apply-patch.js

@@ -0,0 +1,217 @@
+/**
+ * The "apply_patch" format: several file changes (add, update, delete, move) in
+ * one block, as opencode's and Codex's apply_patch tools accept.
+ *
+ *   *** Begin Patch
+ *   *** Add File: src/new.js
+ *   +line one
+ *   *** Update File: src/app.js
+ *   *** Move to: src/main.js          (optional)
+ *   @@ function start()               (optional anchor line)
+ *    unchanged context
+ *   -old line
+ *   +new line
+ *   *** Delete File: old.txt
+ *   *** End Patch
+ *
+ * parsePatch() and planPatch() are pure (no disk writes) so a caller can show
+ * the user the whole change, ask, and only then write it.
+ */
+
+function normalize(s) {
+  return s.replace(/[‐-―−]/g, '-').replace(/[‘’]/g, "'").replace(/[“”]/g, '"').replace(/ /g, ' ');
+}
+
+/** @returns {{hunks: object[]}|{error: string}} */
+function parsePatch(text) {
+  let lines = String(text || '').replace(/\r\n/g, '\n').split('\n');
+  // Models sometimes wrap the patch in a heredoc or a code fence.
+  while (lines.length && !lines[0].trim()) lines.shift();
+  if (lines.length && /^(?:apply_patch\s*)?<<-?\s*['"]?\w+['"]?\s*$/.test(lines[0].trim())) lines.shift();
+  if (lines.length && /^```/.test(lines[0].trim())) lines.shift();
+  const begin = lines.findIndex((l) => l.trim() === '*** Begin Patch');
+  if (begin === -1) return { error: 'The patch must start with "*** Begin Patch" on its own line.' };
+  lines = lines.slice(begin + 1);
+  let end = lines.findIndex((l) => l.trim() === '*** End Patch');
+  if (end === -1) end = lines.length; // a missing footer is forgivable, the hunks are still complete lines
+  lines = lines.slice(0, end);
+
+  const hunks = [];
+  let i = 0;
+  const isHeader = (l) => /^\*\*\* (Add File|Update File|Delete File|Move to|End of File):?/.test(l);
+  while (i < lines.length) {
+    const line = lines[i];
+    if (!line.trim()) { i++; continue; }
+    let m;
+    if ((m = /^\*\*\* Add File:\s*(.+)$/.exec(line))) {
+      const body = [];
+      i++;
+      while (i < lines.length && !isHeader(lines[i]) ) {
+        if (lines[i].startsWith('+')) body.push(lines[i].slice(1));
+        else if (lines[i] === '') body.push('');
+        else return { error: `In "Add File: ${m[1].trim()}", every line must start with "+" (got: ${JSON.stringify(lines[i].slice(0, 60))}).` };
+        i++;
+      }
+      while (body.length > 1 && body[body.length - 1] === '') body.pop();
+      hunks.push({ type: 'add', path: m[1].trim(), contents: body.join('\n') + (body.length ? '\n' : '') });
+    } else if ((m = /^\*\*\* Delete File:\s*(.+)$/.exec(line))) {
+      hunks.push({ type: 'delete', path: m[1].trim() });
+      i++;
+    } else if ((m = /^\*\*\* Update File:\s*(.+)$/.exec(line))) {
+      const hunk = { type: 'update', path: m[1].trim(), movePath: null, chunks: [] };
+      i++;
+      if (i < lines.length && (m = /^\*\*\* Move to:\s*(.+)$/.exec(lines[i]))) { hunk.movePath = m[1].trim(); i++; }
+      let cur = null;
+      const flush = () => { if (cur && (cur.old.length || cur.new.length)) hunk.chunks.push(cur); cur = null; };
+      while (i < lines.length && !/^\*\*\* (Add File|Update File|Delete File)/.test(lines[i])) {
+        const l = lines[i];
+        if (l.startsWith('@@')) {
+          flush();
+          cur = { ctx: l.slice(2).trim(), old: [], new: [], eof: false };
+        } else if (l.trim() === '*** End of File') {
+          if (cur) cur.eof = true;
+        } else {
+          if (!cur) cur = { ctx: '', old: [], new: [], eof: false };
+          if (l.startsWith('+')) cur.new.push(l.slice(1));
+          else if (l.startsWith('-')) cur.old.push(l.slice(1));
+          else if (l.startsWith(' ')) { cur.old.push(l.slice(1)); cur.new.push(l.slice(1)); }
+          else if (l === '') { cur.old.push(''); cur.new.push(''); }
+          else return { error: `In "Update File: ${hunk.path}", a change line must start with " ", "-" or "+" (got: ${JSON.stringify(l.slice(0, 60))}).` };
+        }
+        i++;
+      }
+      flush();
+      if (!hunk.chunks.length && !hunk.movePath) return { error: `"Update File: ${hunk.path}" has no changes.` };
+      hunks.push(hunk);
+    } else {
+      return { error: `Unexpected line in the patch: ${JSON.stringify(line.slice(0, 80))}. Each section starts with "*** Add File:", "*** Update File:" or "*** Delete File:".` };
+    }
+  }
+  if (!hunks.length) return { error: 'The patch has no changes.' };
+  return { hunks };
+}
+
+/** Find `needle` (array of lines) in `hay` at or after `from`, loosening whitespace step by step. */
+function seek(hay, needle, from, eof) {
+  if (!needle.length) return from;
+  const passes = [
+    (s) => s,
+    (s) => s.replace(/\s+$/, ''),
+    (s) => s.trim(),
+    (s) => normalize(s).trim(),
+  ];
+  for (const f of passes) {
+    const start = eof ? Math.max(from, hay.length - needle.length) : from;
+    for (let a = start; a + needle.length <= hay.length; a++) {
+      let ok = true;
+      for (let b = 0; b < needle.length; b++) if (f(hay[a + b]) !== f(needle[b])) { ok = false; break; }
+      if (ok) return a;
+    }
+    if (eof) {
+      // The end-of-file marker is a hint, not a promise: fall back to searching everywhere.
+      for (let a = from; a + needle.length <= hay.length; a++) {
+        let ok = true;
+        for (let b = 0; b < needle.length; b++) if (f(hay[a + b]) !== f(needle[b])) { ok = false; break; }
+        if (ok) return a;
+      }
+    }
+  }
+  return -1;
+}
+
+function applyChunks(original, chunks, label) {
+  const crlf = /\r\n/.test(original);
+  const text = original.replace(/\r\n/g, '\n');
+  const hay = text.split('\n');
+  const trailingNewline = hay.length > 1 && hay[hay.length - 1] === '';
+  if (trailingNewline) hay.pop();
+
+  const replacements = [];
+  let cursor = 0;
+  for (const c of chunks) {
+    if (c.ctx) {
+      const at = seek(hay, [c.ctx], cursor, false);
+      if (at === -1) return { error: `${label}: could not find the anchor line "${c.ctx}". Copy it exactly from the file.` };
+      cursor = at + 1;
+    }
+    if (!c.old.length) {
+      // Pure insertion: at the end of the file, unless an anchor put us elsewhere.
+      const at = c.ctx ? cursor : hay.length;
+      replacements.push([at, 0, c.new]);
+      continue;
+    }
+    let old = c.old;
+    let neu = c.new;
+    let at = seek(hay, old, cursor, c.eof);
+    // A trailing blank line in the chunk often stands for the end of the file.
+    if (at === -1 && old[old.length - 1] === '') {
+      old = old.slice(0, -1);
+      neu = neu[neu.length - 1] === '' ? neu.slice(0, -1) : neu;
+      at = seek(hay, old, cursor, c.eof);
+    }
+    if (at === -1) {
+      return { error: `${label}: could not find these lines to replace:\n${c.old.slice(0, 6).map((l) => `  ${l}`).join('\n')}\nRead the file again and copy the lines exactly.` };
+    }
+    replacements.push([at, old.length, neu]);
+    cursor = at + old.length;
+  }
+  replacements.sort((a, b) => a[0] - b[0]);
+  const out = hay.slice();
+  for (let k = replacements.length - 1; k >= 0; k--) {
+    const [at, len, neu] = replacements[k];
+    out.splice(at, len, ...neu);
+  }
+  let result = out.join('\n') + (trailingNewline || !original ? '\n' : '');
+  if (crlf) result = result.replace(/\n/g, '\r\n');
+  return { content: result };
+}
+
+/**
+ * Work out what a patch would do, without touching the disk.
+ * @param {string} patchText
+ * @param {(path:string)=>string|null} readFile  current content of a project path, null if it doesn't exist
+ * @returns {{changes: Array<{kind:'add'|'update'|'delete'|'move', path:string, newPath?:string, before:string, after:string, added:number, removed:number}>}|{error:string}}
+ */
+function planPatch(patchText, readFile) {
+  const parsed = parsePatch(patchText);
+  if (parsed.error) return { error: parsed.error };
+  const changes = [];
+  const virtual = new Map(); // paths changed earlier in this same patch
+  const current = (p) => (virtual.has(p) ? virtual.get(p) : readFile(p));
+  for (const h of parsed.hunks) {
+    if (h.type === 'add') {
+      const existing = current(h.path);
+      if (existing != null && existing !== '') return { error: `Cannot add ${h.path}: it already exists. Use "*** Update File:" to change it.` };
+      changes.push({ kind: 'add', path: h.path, before: '', after: h.contents, added: h.contents.split('\n').length - 1, removed: 0 });
+      virtual.set(h.path, h.contents);
+    } else if (h.type === 'delete') {
+      const existing = current(h.path);
+      if (existing == null) return { error: `Cannot delete ${h.path}: no such file.` };
+      changes.push({ kind: 'delete', path: h.path, before: existing, after: '', added: 0, removed: existing.split('\n').length });
+      virtual.set(h.path, null);
+    } else {
+      const existing = current(h.path);
+      if (existing == null) return { error: `Cannot update ${h.path}: no such file.` };
+      let after = existing;
+      if (h.chunks.length) {
+        const r = applyChunks(existing, h.chunks, h.path);
+        if (r.error) return { error: r.error };
+        after = r.content;
+      }
+      const added = h.chunks.reduce((n, c) => n + c.new.length, 0);
+      const removed = h.chunks.reduce((n, c) => n + c.old.length, 0);
+      if (h.movePath) {
+        if (current(h.movePath) != null) return { error: `Cannot move ${h.path} to ${h.movePath}: that file already exists.` };
+        changes.push({ kind: 'move', path: h.path, newPath: h.movePath, before: existing, after, added, removed });
+        virtual.set(h.path, null);
+        virtual.set(h.movePath, after);
+      } else {
+        changes.push({ kind: 'update', path: h.path, before: existing, after, added, removed });
+        virtual.set(h.path, after);
+      }
+    }
+  }
+  return { changes };
+}
+
+module.exports = { parsePatch, planPatch };

package/lib/arity-table.json

@@ -0,0 +1,138 @@
+{
+ "cat": 1,
+ "cd": 1,
+ "chmod": 1,
+ "chown": 1,
+ "cp": 1,
+ "echo": 1,
+ "env": 1,
+ "export": 1,
+ "grep": 1,
+ "kill": 1,
+ "killall": 1,
+ "ln": 1,
+ "ls": 1,
+ "mkdir": 1,
+ "mv": 1,
+ "ps": 1,
+ "pwd": 1,
+ "rm": 1,
+ "rmdir": 1,
+ "sleep": 1,
+ "source": 1,
+ "tail": 1,
+ "touch": 1,
+ "unset": 1,
+ "which": 1,
+ "aws": 3,
+ "az": 3,
+ "bazel": 2,
+ "brew": 2,
+ "bun": 2,
+ "bun run": 3,
+ "bun x": 3,
+ "cargo": 2,
+ "cargo add": 3,
+ "cargo run": 3,
+ "cdk": 2,
+ "cf": 2,
+ "cmake": 2,
+ "composer": 2,
+ "consul": 2,
+ "consul kv": 3,
+ "crictl": 2,
+ "deno": 2,
+ "deno task": 3,
+ "doctl": 3,
+ "docker": 2,
+ "docker builder": 3,
+ "docker compose": 3,
+ "docker container": 3,
+ "docker image": 3,
+ "docker network": 3,
+ "docker volume": 3,
+ "eksctl": 2,
+ "eksctl create": 3,
+ "firebase": 2,
+ "flyctl": 2,
+ "gcloud": 3,
+ "gh": 3,
+ "git": 2,
+ "git config": 3,
+ "git remote": 3,
+ "git stash": 3,
+ "go": 2,
+ "gradle": 2,
+ "helm": 2,
+ "heroku": 2,
+ "hugo": 2,
+ "ip": 2,
+ "ip addr": 3,
+ "ip link": 3,
+ "ip netns": 3,
+ "ip route": 3,
+ "kind": 2,
+ "kind create": 3,
+ "kubectl": 2,
+ "kubectl kustomize": 3,
+ "kubectl rollout": 3,
+ "kustomize": 2,
+ "make": 2,
+ "mc": 2,
+ "mc admin": 3,
+ "minikube": 2,
+ "mongosh": 2,
+ "mysql": 2,
+ "mvn": 2,
+ "ng": 2,
+ "npm": 2,
+ "npm exec": 3,
+ "npm init": 3,
+ "npm run": 3,
+ "npm view": 3,
+ "nvm": 2,
+ "nx": 2,
+ "openssl": 2,
+ "openssl req": 3,
+ "openssl x509": 3,
+ "pip": 2,
+ "pipenv": 2,
+ "pnpm": 2,
+ "pnpm dlx": 3,
+ "pnpm exec": 3,
+ "pnpm run": 3,
+ "poetry": 2,
+ "podman": 2,
+ "podman container": 3,
+ "podman image": 3,
+ "psql": 2,
+ "pulumi": 2,
+ "pulumi stack": 3,
+ "pyenv": 2,
+ "python": 2,
+ "rake": 2,
+ "rbenv": 2,
+ "redis-cli": 2,
+ "rustup": 2,
+ "serverless": 2,
+ "sfdx": 3,
+ "skaffold": 2,
+ "sls": 2,
+ "sst": 2,
+ "swift": 2,
+ "systemctl": 2,
+ "terraform": 2,
+ "terraform workspace": 3,
+ "tmux": 2,
+ "turbo": 2,
+ "ufw": 2,
+ "vault": 2,
+ "vault auth": 3,
+ "vault kv": 3,
+ "vercel": 2,
+ "volta": 2,
+ "wp": 2,
+ "yarn": 2,
+ "yarn dlx": 3,
+ "yarn run": 3
+}

package/lib/arity.js

@@ -0,0 +1,70 @@
+/**
+ * How many words name a shell command, so "always allow" can be scoped to
+ * `npm run dev` or `git checkout` instead of every command there is.
+ *
+ * The ARITY table and the prefix() rule are from opencode
+ * (packages/opencode/src/permission/arity.ts), MIT License,
+ * Copyright (c) 2025 opencode - https://github.com/sst/opencode
+ * Command splitting and tokenizing below are Codeply's own.
+ */
+
+const ARITY = require('./arity-table.json');
+
+// "Always allow node" would allow every script there is. For interpreters the
+// script (or module) is part of the name: `node server.js`, `python app.py`.
+const INTERPRETERS = new Set(['node', 'python', 'python3', 'py', 'deno', 'bun', 'ruby', 'php', 'perl', 'bash', 'sh', 'zsh', 'powershell', 'pwsh', 'cmd', 'tsx', 'ts-node']);
+
+/** Longest listed prefix wins; unlisted commands are named by their first word. */
+function prefix(tokens) {
+  if (tokens.length && INTERPRETERS.has(tokens[0]) && !ARITY[tokens.slice(0, 2).join(' ')]) return tokens.slice(0, 2);
+  for (let len = tokens.length; len > 0; len--) {
+    const arity = ARITY[tokens.slice(0, len).join(' ')];
+    if (arity !== undefined) return tokens.slice(0, arity);
+  }
+  return tokens.slice(0, 1);
+}
+
+/** Split a command line into its separate commands (&&, ||, ;, |, newlines). Quotes are respected. */
+function splitCommands(line) {
+  const out = [];
+  let cur = '';
+  let quote = null;
+  for (let i = 0; i < line.length; i++) {
+    const c = line[i];
+    const n = line[i + 1];
+    if (quote) { cur += c; if (c === quote) quote = null; continue; }
+    if (c === '"' || c === "'") { quote = c; cur += c; continue; }
+    if ((c === '&' && n === '&') || (c === '|' && n === '|')) { out.push(cur); cur = ''; i++; continue; }
+    if (c === ';' || c === '|' || c === '\n' || c === '&') { out.push(cur); cur = ''; continue; }
+    cur += c;
+  }
+  out.push(cur);
+  return out.map((s) => s.trim()).filter(Boolean);
+}
+
+/** Words of one command, without leading VAR=value assignments or flags. */
+function tokenize(cmd) {
+  const words = cmd.match(/"[^"]*"|'[^']*'|\S+/g) || [];
+  const clean = words.map((w) => w.replace(/^["']|["']$/g, ''));
+  let i = 0;
+  while (i < clean.length && /^[A-Za-z_][A-Za-z0-9_]*=/.test(clean[i])) i++;
+  const rest = clean.slice(i).filter((w) => !w.startsWith('-'));
+  // A path to a program is still that program: C:\tools\git.exe -> git
+  if (rest.length) rest[0] = rest[0].split(/[\\/]/).pop().replace(/\.(exe|cmd|bat|ps1)$/i, '').toLowerCase();
+  return rest;
+}
+
+/**
+ * The permission patterns a command line needs, one per command in it:
+ *   'npm run dev && git status'  ->  ['npm run dev', 'git status']
+ * Subshells, backticks and redirections into files return null: too dynamic
+ * (or too destructive) to approve by name alone.
+ */
+function commandPatterns(line) {
+  const text = String(line || '');
+  if (/\$\(|`|>/.test(text)) return null;
+  const pats = splitCommands(text).map((c) => prefix(tokenize(c)).join(' ')).filter(Boolean);
+  return pats.length ? [...new Set(pats)] : null;
+}
+
+module.exports = { commandPatterns, prefix, tokenize, splitCommands };