framer-dalton 0.0.28 → 0.0.29

package/README.md

@@ -7,7 +7,7 @@ CLI and agent skills for interacting with Framer projects via the Framer Server
 Install or refresh the globally available skills:
 
 ```bash
-npx framer-dalton@latest setup
+npx @framer/agent@latest setup
 ```
 
 That installs skills into `~/.agents/skills` and `~/.claude/skills`.
@@ -20,9 +20,9 @@ The CLI and the installed skills are meant to work together. There are three ski
 - `framer-code-components` - explains specific prompts for how to write code components and provides examples.
 - `framer-project-<project id>` - a dynamically-created skill for interacting with a specific project.
 
-1. Running `npx framer-dalton@latest setup` will install the base `framer` and `framer-code-components` skills.
+1. Running `npx @framer/agent@latest setup` will install the base `framer` and `framer-code-components` skills.
 2. The frontmatter of `framer-code-components` tells agents to always load `framer` and the generated project skill first.
-3. The frontmatter of `framer` tells agents to run `npx framer-dalton@latest setup` BEFORE loading the skill. This command will auto-update the cli and update the skill files.
+3. The frontmatter of `framer` tells agents to run `npx @framer/agent@latest setup` BEFORE loading the skill. This command will auto-update the cli and update the skill files.
 4. Creating a new session for a project will create a `framer-project-<project id>` file. This file contains the latest agent system prompt from `framer.agent.getSystemPrompt` and the latest project context from `framer.agent.getContext`. Agents must load this project-specific skill immediately after creating a session before doing any connected-project work.
 
 ## Local Development

package/dist/cli.js

@@ -12,12 +12,12 @@ import net from 'net';
 import { fileURLToPath } from 'url';
 import { createTRPCClient, httpLink } from '@trpc/client';
 
-/* @framer/ai CLI v0.0.28 */
+/* @framer/ai CLI v0.0.29 */
 var __defProp = Object.defineProperty;
 var __name = (target, value) => __defProp(target, "name", { value, configurable: true });
 
 // package.json
-var name = "framer-dalton";
+var name = "@framer/agent";
 
 // src/check-node-version.ts
 var MINIMUM_NODE_VERSION = 22;
@@ -375,7 +375,7 @@ __name(markTelemetryNoticeShown, "markTelemetryNoticeShown");
 // src/version.ts
 var VERSION = (
   // typeof is used to ensure this can be used just via tsx or node etc. without build
-  "0.0.28" 
+  "0.0.29" 
 );
 var trackingEndpoint = "https://events.framer.com/track";
 var inProgressTrackings = /* @__PURE__ */ new Set();
@@ -592,7 +592,7 @@ function formatErrorForUser(error, opts) {
   const rehydrated = rehydrateFramerAPIError(error);
   if (rehydrated) return rehydrated.toString();
   if (!opts?.fromExecResult && isRelayConnectionLost(error))
-    return "Connection to the Framer server was lost. Run `framer session new` to reconnect.";
+    return "Connection to the Framer server was lost. Run `npx @framer/agent@latest session new` to reconnect.";
   const ref = getErrorRef(error);
   return ref ? `${error.message} [ref: ${ref}]` : error.message;
 }
@@ -855,7 +855,7 @@ function runBrowserAuthFlow(options) {
       printError(`  1. Open Site Settings \u2192 General: ${settingsUrl}`);
       printError("  2. Scroll to API Keys and create a new key");
       printError(
-        `  3. In another terminal, run: framer project auth ${pollProjectId} <your-api-key>`
+        `  3. In another terminal, run: npx @framer/agent@latest project auth ${pollProjectId} <your-api-key>`
       );
       print("");
       print("Waiting for authorization in browser...");
@@ -869,7 +869,7 @@ function runBrowserAuthFlow(options) {
         });
         reject(
           new Error(
-            pollProjectId ? "Browser authorization timed out. Use `framer project auth <projectUrlOrId> <apiKey>` instead." : "Browser authorization timed out."
+            pollProjectId ? "Browser authorization timed out. Use `npx @framer/agent@latest project auth <projectUrlOrId> <apiKey>` instead." : "Browser authorization timed out."
           )
         );
       });
@@ -16197,7 +16197,7 @@ function renderDocs(queries) {
         const suggestion = findClosestMatch(query, methodNames);
         const hint = suggestion ? ` Did you mean '${suggestion}'?` : "";
         errors.push(
-          `Method '${query}' not found.${hint} Use 'framer docs' to list all.`
+          `Method '${query}' not found.${hint} Use 'npx @framer/agent@latest docs' to list all.`
         );
         return { lines, errors };
       }
@@ -16246,7 +16246,7 @@ ${typeDef}`);
           const suggestion = findClosestMatch(query, bareNames);
           const hint = suggestion ? ` Did you mean '${suggestion}'?` : "";
           errors.push(
-            `'${query}' not found.${hint} Use 'framer docs' to list all.`
+            `'${query}' not found.${hint} Use 'npx @framer/agent@latest docs' to list all.`
           );
           return { lines, errors };
         }
@@ -16639,7 +16639,7 @@ function installSkills(options = { type: "base" }) {
 __name(installSkills, "installSkills");
 
 // src/cli.ts
-var PROGRAM_NAME = "framer-dalton";
+var PROGRAM_NAME = "@framer/agent";
 var program = new Command();
 program.name(PROGRAM_NAME).version(VERSION).description("Framer Server API CLI").option("--debug", "Enable debug logging").hook("preAction", (thisCommand) => {
   const opts = thisCommand.opts();

package/dist/start-relay-server.js

@@ -1,6 +1,6 @@
 import fs4 from 'fs';
 import os5 from 'os';
-import path from 'path';
+import path5 from 'path';
 import { execFileSync } from 'child_process';
 import 'net';
 import { fileURLToPath } from 'url';
@@ -14,7 +14,7 @@ import { z } from 'zod';
 import { createRequire } from 'module';
 import * as vm from 'vm';
 
-/* @framer/ai relay server v0.0.28 */
+/* @framer/ai relay server v0.0.29 */
 var __defProp = Object.defineProperty;
 var __knownSymbol = (name2, symbol) => (symbol = Symbol[name2]) ? symbol : /* @__PURE__ */ Symbol.for("Symbol." + name2);
 var __typeError = (msg) => {
@@ -60,7 +60,7 @@ var __callDispose = (stack, error, hasError) => {
 };
 
 // package.json
-var name = "framer-dalton";
+var name = "@framer/agent";
 
 // src/check-node-version.ts
 var MINIMUM_NODE_VERSION = 22;
@@ -79,16 +79,16 @@ var maxLogFileBytes = DEFAULT_MAX_LOG_FILE_BYTES;
 var retainedLogFileBytes = DEFAULT_RETAINED_LOG_FILE_BYTES;
 function getLogPath() {
   if (process.env.XDG_STATE_HOME) {
-    return path.join(process.env.XDG_STATE_HOME, "framer", "relay.log");
+    return path5.join(process.env.XDG_STATE_HOME, "framer", "relay.log");
   }
   if (process.platform === "win32") {
-    return path.join(
+    return path5.join(
       process.env.APPDATA || os5.homedir(),
       "framer",
       "relay.log"
     );
   }
-  return path.join(os5.homedir(), ".local", "state", "framer", "relay.log");
+  return path5.join(os5.homedir(), ".local", "state", "framer", "relay.log");
 }
 __name(getLogPath, "getLogPath");
 var logPath = getLogPath();
@@ -96,7 +96,7 @@ var initialized = false;
 var logEntriesSinceTrimCheck = LOG_TRIM_CHECK_INTERVAL - 1;
 function ensureLogDir() {
   if (initialized) return;
-  const dir = path.dirname(logPath);
+  const dir = path5.dirname(logPath);
   fs4.mkdirSync(dir, { recursive: true });
   initialized = true;
 }
@@ -143,12 +143,12 @@ function log(message) {
 __name(log, "log");
 function getConfigDir() {
   if (process.env.XDG_CONFIG_HOME) {
-    return path.join(process.env.XDG_CONFIG_HOME, "framer");
+    return path5.join(process.env.XDG_CONFIG_HOME, "framer");
   }
   if (process.platform === "win32") {
-    return path.join(process.env.APPDATA || os5.homedir(), "framer");
+    return path5.join(process.env.APPDATA || os5.homedir(), "framer");
   }
-  return path.join(os5.homedir(), ".config", "framer");
+  return path5.join(os5.homedir(), ".config", "framer");
 }
 __name(getConfigDir, "getConfigDir");
 function ensureConfigDir() {
@@ -159,7 +159,7 @@ __name(ensureConfigDir, "ensureConfigDir");
 
 // src/config/relay-token.ts
 function getRelayTokenPath() {
-  return path.join(getConfigDir(), "relay-token");
+  return path5.join(getConfigDir(), "relay-token");
 }
 __name(getRelayTokenPath, "getRelayTokenPath");
 function generateRelayToken() {
@@ -199,12 +199,12 @@ __name(debug, "debug");
 // src/version.ts
 var VERSION = (
   // typeof is used to ensure this can be used just via tsx or node etc. without build
-  "0.0.28" 
+  "0.0.29" 
 );
 
 // src/relay-client.ts
 var __filename$1 = fileURLToPath(import.meta.url);
-path.dirname(__filename$1);
+path5.dirname(__filename$1);
 var RELAY_PORT = Number(process.env.FRAMER_CLI_PORT) || 19988;
 createTRPCClient({
   links: [
@@ -303,30 +303,74 @@ var ScopedFS = class {
   static {
     __name(this, "ScopedFS");
   }
-  allowedDirs;
+  allowedRoots;
   constructor(allowedDirs) {
     const defaultDirs = [process.cwd(), "/tmp", os5.tmpdir()];
     const dirs = allowedDirs ?? defaultDirs;
-    this.allowedDirs = [...new Set(dirs.map((d) => path.resolve(d)))];
+    this.allowedRoots = [
+      ...new Set(dirs.map((dir) => this.canonicalizePath(dir)))
+    ];
   }
-  isPathAllowed(resolved) {
-    return this.allowedDirs.some((dir) => {
-      return resolved === dir || resolved.startsWith(dir + path.sep);
+  isPathAllowed(candidatePath) {
+    return this.allowedRoots.some((allowedRoot) => {
+      return candidatePath === allowedRoot || candidatePath.startsWith(allowedRoot + path5.sep);
     });
   }
   resolvePath(filePath) {
-    const resolved = path.resolve(filePath);
-    if (!this.isPathAllowed(resolved)) {
-      const error = new Error(
-        `EPERM: operation not permitted, access outside allowed directories: ${filePath}`
-      );
-      error.code = "EPERM";
-      error.errno = -1;
-      error.syscall = "access";
-      error.path = filePath;
+    const resolvedPath = path5.resolve(filePath);
+    const canonicalPath = this.canonicalizePath(resolvedPath);
+    if (!this.isPathAllowed(canonicalPath)) {
+      this.throwOutsideAllowedRoots(filePath);
+    }
+    return resolvedPath;
+  }
+  canonicalizePath(inputPath) {
+    const resolvedPath = path5.resolve(inputPath);
+    const missingSegments = [];
+    let ancestorPath = resolvedPath;
+    while (true) {
+      const realPath = this.resolveRealPath(ancestorPath);
+      if (realPath !== null) {
+        return path5.resolve(realPath, ...missingSegments);
+      }
+      if (this.isSymbolicLink(ancestorPath)) {
+        this.throwOutsideAllowedRoots(inputPath);
+      }
+      const parentPath = path5.dirname(ancestorPath);
+      if (parentPath === ancestorPath) {
+        return resolvedPath;
+      }
+      missingSegments.unshift(path5.basename(ancestorPath));
+      ancestorPath = parentPath;
+    }
+  }
+  resolveRealPath(targetPath) {
+    try {
+      return path5.resolve(fs4.realpathSync.native(targetPath));
+    } catch (error) {
+      const errnoError = error;
+      if (errnoError.code === "ENOENT") {
+        return null;
+      }
       throw error;
     }
-    return resolved;
+  }
+  isSymbolicLink(targetPath) {
+    try {
+      return fs4.lstatSync(targetPath).isSymbolicLink();
+    } catch {
+      return false;
+    }
+  }
+  throwOutsideAllowedRoots(filePath) {
+    const error = new Error(
+      `EPERM: operation not permitted, access outside allowed directories: ${filePath}`
+    );
+    error.code = "EPERM";
+    error.errno = -1;
+    error.syscall = "access";
+    error.path = filePath;
+    throw error;
   }
   // Sync methods
   readFileSync = /* @__PURE__ */ __name((filePath, options) => {
@@ -776,7 +820,7 @@ var SettingsFileSchema = z.object({
   telemetryNoticeShown: z.boolean().optional()
 });
 function getSettingsPath() {
-  return path.join(getConfigDir(), "settings.json");
+  return path5.join(getConfigDir(), "settings.json");
 }
 __name(getSettingsPath, "getSettingsPath");
 var settings;

package/docs/skills/framer-project.md

@@ -1,7 +1,7 @@
 ---
 name: {{SKILL_NAME}}
 description: "Project-scoped Framer skill for project {{PROJECT_ID}}. Covers project reads, edits, change review, publishing, image sourcing, component operations, and canvas editing. Very important: never load this skill without having already read the `framer` skill and without having already run `session new`, which will dynamically update this skill."
-allowed-tools: ["Bash(npx framer-dalton:*)", "Bash(npx framer-dalton@latest:*)", "Read({{FRAMER_TEMPORARY_DIR}}/*)", "Write({{FRAMER_TEMPORARY_DIR}}/*)"]
+allowed-tools: ["Bash(npx @framer/agent:*)", "Bash(npx @framer/agent@latest:*)", "Read({{FRAMER_TEMPORARY_DIR}}/*)", "Write({{FRAMER_TEMPORARY_DIR}}/*)"]
 ---
 
 ## Project Scope
@@ -15,11 +15,11 @@ Every connected-project task follows these steps:
 
 ### 1. Look up the API (before EVERY new use of an API method)
 
-**You MUST run `npx framer-dalton docs` before writing any code.** Do not guess method names or signatures.
+**You MUST run `npx @framer/agent@latest docs` before writing any code.** Do not guess method names or signatures.
 
 ```bash
-npx framer-dalton docs Collection           # What methods exist?
-npx framer-dalton docs Collection.getItems  # What are the parameters and return type?
+npx @framer/agent@latest docs Collection           # What methods exist?
+npx @framer/agent@latest docs Collection.getItems  # What are the parameters and return type?
 ```
 
 ### 2. Execute code
@@ -27,7 +27,7 @@ npx framer-dalton docs Collection.getItems  # What are the parameters and return
 Only after checking docs, use your write tool to write your code to a unique file under `{{FRAMER_TEMPORARY_DIR}}/`, then execute it with `-f`. Do not create code files with shell heredocs or `cat`. Name each file `<sessionId>-<short-summary>.js` where `<short-summary>` is a brief kebab-case description (e.g., `1-read-collections.js`, `1-add-team-member.js`).
 
 ```bash
-npx framer-dalton exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-read-collections.js
+npx @framer/agent@latest exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-read-collections.js
 ```
 
 ### 3. Store results in `state`
@@ -38,7 +38,7 @@ Always save results you'll need again. Don't repeat API calls.
 
 Choose the highest-priority interface available for the task:
 
-1. Subcommands, such as `framer-dalton read-project` and `framer-dalton apply-changes`
+1. Subcommands, such as `npx @framer/agent@latest read-project` and `npx @framer/agent@latest apply-changes`
 2. Agent-specific methods, such as `framer.agent.readProject`, `framer.agent.applyChanges`, and `framer.agent.publish`
 3. Generic plugin API methods, such as top-level `framer.*` methods
 
@@ -87,7 +87,7 @@ state.collections = await framer.getCollections();
 ```
 
 ```bash
-npx framer-dalton exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-get-collections.js
+npx @framer/agent@latest exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-get-collections.js
 ```
 
 ```js
@@ -97,7 +97,7 @@ console.log(state.teamItems.length);
 ```
 
 ```bash
-npx framer-dalton exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-get-team-items.js
+npx @framer/agent@latest exec -s 1 -f {{FRAMER_TEMPORARY_DIR}}/1-get-team-items.js
 ```
 
 Store anything you'll reference again.
@@ -141,7 +141,7 @@ Prompting may take a while to complete, so set the command timeout to 10 minutes
 Prefer using your write tool to write code to a unique file under `{{FRAMER_TEMPORARY_DIR}}/` and executing it with `-f`. Do not create code files with shell heredocs or `cat`:
 
 ```bash
-npx framer-dalton exec -s <sessionId> -f {{FRAMER_TEMPORARY_DIR}}/<sessionId>-<short-summary>.js
+npx @framer/agent@latest exec -s <sessionId> -f {{FRAMER_TEMPORARY_DIR}}/<sessionId>-<short-summary>.js
 ```
 
 For short snippets, `exec` also accepts `-e <code>` or code piped on stdin.
@@ -154,24 +154,24 @@ In Windows PowerShell, if an argument contains nested quotes, use a single-quote
 $value = @'
 [{"key":"value","filter":["text","$rect"]}]
 '@
-npx framer-dalton <command> --option $value
+npx @framer/agent@latest <command> --option $value
 ```
 
 ## API Documentation
 
 ```bash
-npx framer-dalton docs                            # List all available methods
-npx framer-dalton docs framer.getCollections      # Show top level method
-npx framer-dalton docs Collection                 # Show class with all method signatures
-npx framer-dalton docs Collection.addItems        # Show method + recursively expand all referenced types
-npx framer-dalton docs ScreenshotOptions          # Show type + recursively expand all referenced types
+npx @framer/agent@latest docs                            # List all available methods
+npx @framer/agent@latest docs framer.getCollections      # Show top level method
+npx @framer/agent@latest docs Collection                 # Show class with all method signatures
+npx @framer/agent@latest docs Collection.addItems        # Show method + recursively expand all referenced types
+npx @framer/agent@latest docs ScreenshotOptions          # Show type + recursively expand all referenced types
 ```
 
 `docs` with no arguments lists available methods. Looking up a class shows its full definition without expanding referenced types. Looking up a specific method or type automatically expands all referenced types recursively.
 
 ## API Examples
 
-**STOP: These are patterns only. Before using any method below, run `npx framer-dalton docs <ClassName>` to verify the current signature.**
+**STOP: These are patterns only. Before using any method below, run `npx @framer/agent@latest docs <ClassName>` to verify the current signature.**
 
 ### Working with Collections (CMS)
 

package/docs/skills/framer.md

@@ -2,13 +2,13 @@
 name: framer
 description: >
   Use when the user wants to design, edit, or publish a website or web page — creating layouts, editing sections, updating text or images, managing CMS collections and content, syncing external data, creating or modifying code components, managing color and text styles, handling localization, or publishing deployments. Trigger when the user mentions Framer, references their website or web pages, asks to edit designs, update site content, or work with any Framer project — even if they don't explicitly say 'Framer'.
-  **Mandatory precondition**: run `npx framer-dalton@latest setup` and let it complete **BEFORE** loading this skill.
-allowed-tools: ["Bash(npx framer-dalton:*)", "Bash(npx framer-dalton@latest:*)", "Read({{FRAMER_TEMPORARY_DIR}}/*)", "Write({{FRAMER_TEMPORARY_DIR}}/*)"]
+  **Mandatory precondition**: run `npx @framer/agent@latest setup` and let it complete **BEFORE** loading this skill.
+allowed-tools: ["Bash(npx @framer/agent:*)", "Bash(npx @framer/agent@latest:*)", "Read({{FRAMER_TEMPORARY_DIR}}/*)", "Write({{FRAMER_TEMPORARY_DIR}}/*)"]
 ---
 
 If you didn't run this command before loading the skill, run it now:
 ```bash
-npx framer-dalton@latest setup
+npx @framer/agent@latest setup
 ```
 
 ## Capabilities
@@ -29,14 +29,14 @@ What you can do with the Framer CLI:
 
 ### Permissions
 
-The Framer CLI requires network access (to download packages and connect to Framer servers) and file-system access outside the project directory (to install skills into `~/.agents/skills/` and `~/.claude/skills/`). In sandboxed environments, you must execute `npx framer-dalton` commands with elevated permissions from the get-go. Do not try to execute them with the default sandboxed permissions; they will hang or fail.
+The Framer CLI requires network access (to download packages and connect to Framer servers) and file-system access outside the project directory (to install skills into `~/.agents/skills/` and `~/.claude/skills/`). In sandboxed environments, you must execute `npx @framer/agent@latest` commands with elevated permissions from the get-go. Do not try to execute them with the default sandboxed permissions; they will hang or fail.
 
 ### Session Management
 
 If the user refers to a project by name or description rather than giving a URL, first inspect the recent projects:
 
 ```bash
-npx framer-dalton project list
+npx @framer/agent@latest project list
 ```
 
 Use that list to infer the likely project from the names and recency. If the right project is already known, use its project ID with `session new`. If there are multiple possible matches, clarify with the user. Only ask the user for a Project URL if there is no clear match. Avoid talking about the technical contents of returned data like IDs.
@@ -46,7 +46,7 @@ Each session maintains a persistent connection to a Framer project. Use sessions
 Create a session against an existing project:
 
 ```bash
-npx framer-dalton session new "<url or id>"
+npx @framer/agent@latest session new "<url or id>"
 ```
 
 This prints the session ID. You must always use that session ID with `-s <id>` for all subsequent commands. Using the same session preserves your `state` between calls.
@@ -54,15 +54,15 @@ This prints the session ID. You must always use that session ID with `-s <id>` f
 To create a brand new empty project and connect to it:
 
 ```bash
-npx framer-dalton project new
-npx framer-dalton session new "<returned project id>"
+npx @framer/agent@latest project new
+npx @framer/agent@latest session new "<returned project id>"
 ```
 
 To remix (duplicate) an existing project and connect to the copy:
 
 ```bash
-npx framer-dalton project remix "<url, project id, or remix link>"
-npx framer-dalton session new "<returned project id>"
+npx @framer/agent@latest project remix "<url, project id, or remix link>"
+npx @framer/agent@latest session new "<returned project id>"
 ```
 
 Note that during beta, you cannot connect to non-beta projects. If creating a session errors with a message about this, you need to move your project to beta.
@@ -70,7 +70,7 @@ Note that during beta, you cannot connect to non-beta projects. If creating a se
 List active sessions:
 
 ```bash
-npx framer-dalton session list
+npx @framer/agent@latest session list
 ```
 
 ## Project-scoped skill

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "framer-dalton",
-  "version": "0.0.28",
+  "version": "0.0.29",
   "type": "module",
   "bin": "./dist/cli.js",
   "main": "./dist/cli.js",