hostwares-cli 2.4.1 → 2.4.2

package/dist/commands/chat.js

@@ -1,135 +0,0 @@
-import { runCliTurn } from "../agent/run.js";
-import { handleSlash, SLASH_NAMES } from "./slash.js";
-import { execShell, formatResult } from "@hostwares/agent-client";
-import { loadSession, newSession, saveSession, appendTurn } from "../session/store.js";
-import { createReplInterface, closeRepl } from "../ui/input.js";
-import { c, glyph } from "../ui/theme.js";
-import * as ui from "../ui/render.js";
-export async function startChat(opts = {}) {
-    const cwd = process.cwd();
-    const session = loadSession(cwd) ?? newSession(cwd);
-    // A session is resumed only when asked for. Silently continuing whatever this
-    // directory last discussed makes a new question inherit stale context; the
-    // banner says what is available and /resume picks it up.
-    if (!opts.resume)
-        session.conversationId = null;
-    if (opts.oneShot) {
-        const code = await sendOne(opts.oneShot, session);
-        return code;
-    }
-    if (opts.resume && session.conversationId) {
-        ui.note(`Continuing where you left off (${session.turns.length} turns). /new to start over.`);
-    }
-    else if (session.turns.length) {
-        ui.note(`${session.turns.length} earlier turns in this folder — /resume to continue one.`);
-    }
-    return repl(session);
-}
-async function sendOne(message, session) {
-    const controller = new AbortController();
-    const onSigint = () => controller.abort();
-    process.on("SIGINT", onSigint);
-    try {
-        const result = await runCliTurn({ message, session, signal: controller.signal });
-        persist(session, message, result.conversationId, result.creditsSpent);
-        return result.aborted ? 130 : 0;
-    }
-    finally {
-        process.off("SIGINT", onSigint);
-    }
-}
-async function repl(session) {
-    const prompt = `${c.green("you")} ${c.dim(glyph.arrow)} `;
-    const rl = createReplInterface(prompt);
-    let leaving = false;
-    let busy = null;
-    let sigintArmed = false;
-    const onSigint = () => {
-        if (busy) {
-            // Mid-reply: stop the work, keep the session. The abort propagates to
-            // fetch and to any permission prompt waiting on stdin.
-            busy.abort();
-            return;
-        }
-        if (sigintArmed) {
-            leaving = true;
-            rl.close();
-            return;
-        }
-        sigintArmed = true;
-        ui.line(c.dim("  (Ctrl-C again to leave, or type /exit)"));
-        rl.prompt();
-    };
-    // rl's own SIGINT event, not process's: readline captures the signal while
-    // terminal mode is on, so a process-level handler never fires here.
-    rl.on("SIGINT", onSigint);
-    rl.prompt();
-    for await (const raw of rl) {
-        const input = raw.trim();
-        sigintArmed = false;
-        if (!input) {
-            rl.prompt();
-            continue;
-        }
-        // Inline shell: the user typed it themselves, so it needs no permission
-        // prompt and never reaches the model.
-        if (input.startsWith("!")) {
-            const command = input.slice(1).trim();
-            if (command) {
-                ui.breakLine();
-                ui.line(formatResult(await execShell(command, { timeoutMs: 120_000 })));
-            }
-            rl.prompt();
-            continue;
-        }
-        if (input.startsWith("/")) {
-            const controller = new AbortController();
-            const result = await handleSlash(input, {
-                session,
-                quit: () => { leaving = true; rl.close(); },
-                signal: controller.signal,
-            });
-            if (result === "unknown") {
-                ui.line(c.dim(`  Unknown command. Try ${SLASH_NAMES.slice(0, 4).join(", ")} or /help`));
-            }
-            if (leaving)
-                break;
-            rl.prompt();
-            continue;
-        }
-        busy = new AbortController();
-        try {
-            ui.breakLine();
-            const result = await runCliTurn({ message: input, session, signal: busy.signal });
-            persist(session, input, result.conversationId, result.creditsSpent);
-        }
-        finally {
-            busy = null;
-        }
-        if (leaving)
-            break;
-        rl.prompt();
-    }
-    closeRepl();
-    saveSession(session);
-    if (session.turns.length) {
-        ui.line();
-        ui.line(c.dim(`  ${session.turns.filter(t => t.role === "user").length} messages · ${session.creditsSpent.toFixed(2)} credits this session`));
-    }
-    return 0;
-}
-/**
- * Record the turn locally.
- *
- * Only the user's side is stored: the assistant's reply already lives in the
- * server transcript, and duplicating it here would double the disk footprint of
- * every session for no benefit. What this file is really for is remembering
- * WHICH conversation this directory belongs to.
- */
-function persist(session, message, conversationId, credits) {
-    if (conversationId)
-        session.conversationId = conversationId;
-    appendTurn(session, "user", message);
-    session.creditsSpent += credits;
-    saveSession(session);
-}

package/dist/commands/slash.js

@@ -1,310 +0,0 @@
-import { listConversations } from "@hostwares/agent-client";
-import { generateSteering } from "@hostwares/agent-client";
-import { rewind, listCheckpoints } from "@hostwares/agent-client";
-import { reportError } from "../errors.js";
-import { setSessionTrust, isProjectTrusted, setProjectTrust, } from "../agent/permissions.js";
-import { LOCAL_TOOL_NAMES } from "@hostwares/agent-client";
-import { getConfig, saveConfig, clearConfig } from "../config.js";
-import { newSession, saveSession, listSessions } from "../session/store.js";
-import { c, glyph } from "../ui/theme.js";
-import * as ui from "../ui/render.js";
-const COMMANDS = [
-    { name: "/help", help: "Show this list" },
-    { name: "/new", help: "Start a fresh conversation" },
-    { name: "/resume", args: "[n]", help: "List recent conversations, or resume the nth" },
-    { name: "/chat", args: "resume", help: "Same as /resume" },
-    { name: "/sessions", help: "Show sessions saved on this machine" },
-    { name: "/context", help: "Context usage for this conversation" },
-    { name: "/tools", help: "Tools that run on this machine" },
-    { name: "/steering", help: "Create .hostwares/steering/*.md so HW knows this project" },
-    { name: "/rewind", args: "[n]", help: "Undo the last change (or the nth checkpoint). Lists them with no arg." },
-    { name: "/trust", help: "Stop asking permission this session" },
-    { name: "/untrust", help: "Ask permission again" },
-    { name: "/model", args: "[name]", help: "Show or set the model" },
-    { name: "/credits", help: "Credit balance" },
-    { name: "/login", help: "Sign in again" },
-    { name: "/logout", help: "Sign out on this machine" },
-    { name: "/exit", help: "Leave" },
-];
-export async function handleSlash(input, ctx) {
-    const [cmd, ...rest] = input.trim().split(/\s+/);
-    const arg = rest.join(" ");
-    switch (cmd) {
-        case "/help":
-            showHelp();
-            return "handled";
-        case "/exit":
-        case "/quit":
-            ctx.quit();
-            return "handled";
-        case "/new": {
-            const fresh = newSession(ctx.session.cwd);
-            ctx.session.conversationId = null;
-            ctx.session.turns = [];
-            ctx.session.createdAt = fresh.createdAt;
-            saveSession(ctx.session);
-            ui.line(c.dim("  Started a new conversation."));
-            return "handled";
-        }
-        case "/resume":
-        case "/chat": // `/chat resume` and `/chat` both land here
-            await resume(arg.replace(/^resume\s*/, ""), ctx);
-            return "handled";
-        case "/sessions":
-            showSessions();
-            return "handled";
-        case "/context":
-            showContext(ctx.session);
-            return "handled";
-        case "/tools":
-            showTools();
-            return "handled";
-        case "/steering":
-            scaffoldSteering(ctx.session.cwd);
-            return "handled";
-        case "/rewind":
-            rewindCheckpoint(ctx.session.cwd, arg);
-            return "handled";
-        case "/trust":
-            setSessionTrust(true);
-            ui.line(c.dim("  Won't ask again this session. Deletes, kills, pushes and SSH still ask."));
-            return "handled";
-        case "/untrust":
-            setSessionTrust(false);
-            if (isProjectTrusted()) {
-                setProjectTrust(false);
-                ui.line(c.dim(`  Will ask again, and removed the saved trust for ${process.cwd()}.`));
-            }
-            else {
-                ui.line(c.dim("  Will ask again."));
-            }
-            return "handled";
-        case "/model":
-            setModel(arg);
-            return "handled";
-        case "/credits":
-            await showCredits(ctx.signal);
-            return "handled";
-        case "/login":
-            // Imported lazily: pulling the auth module in at REPL start would run its
-            // browser-detection side effects for a command most sessions never use.
-            await (await import("../auth/device.js")).login({ signal: ctx.signal });
-            return "handled";
-        case "/logout":
-            clearConfig();
-            ui.line(c.dim("  Signed out. Run `hw login` to sign back in."));
-            ctx.quit();
-            return "handled";
-        default:
-            return "unknown";
-    }
-}
-function showHelp() {
-    ui.line();
-    for (const { name, args, help } of COMMANDS) {
-        const label = args ? `${name} ${c.dim(args)}` : name;
-        ui.line(`  ${c.green(label.padEnd(hasArgsPad(name, args)))}  ${c.dim(help)}`);
-    }
-    ui.line();
-    ui.line(c.dim(`  ${glyph.bullet} Start a line with ! to run a shell command directly`));
-    ui.line(c.dim(`  ${glyph.bullet} Ctrl-C stops the current reply, twice to leave`));
-    ui.line();
-}
-/** Pads the visible name, ignoring the colour codes in the dimmed args. */
-function hasArgsPad(name, args) {
-    return 22 + (args ? `${args}`.length + 9 : 0);
-}
-async function resume(arg, ctx) {
-    let rows;
-    try {
-        // This endpoint only became reachable from the CLI once it accepted Bearer
-        // auth - it was cookie-only, so `hw` could never list past conversations
-        // even though every one of them was stored server-side.
-        rows = await listConversations({ apiKey: getConfig().apiKey, baseUrl: getConfig().baseUrl }, { limit: 15, signal: ctx.signal });
-    }
-    catch (e) {
-        reportError(e);
-        return;
-    }
-    if (!rows.length) {
-        ui.line(c.dim("  No previous conversations."));
-        return;
-    }
-    const pick = Number(arg);
-    if (Number.isInteger(pick) && pick >= 1 && pick <= rows.length) {
-        const chosen = rows[pick - 1];
-        ctx.session.conversationId = chosen.id;
-        ctx.session.turns = [];
-        saveSession(ctx.session);
-        ui.line(c.dim(`  Resumed "${chosen.title}" (${chosen.messageCount} messages).`));
-        return;
-    }
-    ui.line();
-    rows.forEach((r, i) => {
-        const when = relativeTime(r.updatedAt);
-        ui.line(`  ${c.bold(String(i + 1).padStart(2))}  ${r.title.slice(0, 52).padEnd(52)} ${c.dim(`${r.messageCount} msg · ${when}`)}`);
-    });
-    ui.line();
-    ui.line(c.dim("  /resume <number> to continue one"));
-    ui.line();
-}
-function showSessions() {
-    const sessions = listSessions();
-    if (!sessions.length) {
-        ui.line(c.dim("  No saved sessions."));
-        return;
-    }
-    ui.line();
-    for (const s of sessions.slice(0, 20)) {
-        const here = s.cwd === process.cwd() ? c.green(` ${glyph.tick} here`) : "";
-        ui.line(`  ${s.cwd}${here}`);
-        ui.line(c.dim(`    ${s.turnCount} turns · ${s.creditsSpent.toFixed(2)} credits · ${relativeTime(s.updatedAt)}`));
-    }
-    ui.line();
-}
-/**
- * Context usage.
- *
- * The server owns the real transcript, so anything meaningful here is whatever
- * the last reply reported. Saying so is the point: the old `/context` invented
- * a number from the CLI's local array (characters ÷ 4 ÷ 180000), which excluded
- * the system prompt and tool schemas entirely and therefore always read 0%.
- */
-function showContext(session) {
-    ui.line();
-    ui.line(`  Conversation: ${session.conversationId ? c.dim(session.conversationId) : c.dim("not started yet")}`);
-    ui.line(`  Turns here:   ${session.turns.length}`);
-    ui.line(`  Project:      ${c.dim(session.cwd)}`);
-    ui.line();
-    ui.line(c.dim("  Context size is reported by the server after each reply — see the ctx"));
-    ui.line(c.dim("  figure in the status line. When a session grows past the window the"));
-    ui.line(c.dim("  earlier part is summarised automatically and work continues — you do"));
-    ui.line(c.dim("  not need to start over."));
-    ui.line();
-}
-function showTools() {
-    ui.line();
-    ui.line(`  ${c.bold(`${LOCAL_TOOL_NAMES.length} tools run on this machine:`)}`);
-    ui.line();
-    // Four columns, alphabetical, so the count is verifiable at a glance rather
-    // than asserted in prose that then drifts.
-    const sorted = [...LOCAL_TOOL_NAMES].sort();
-    const rows = Math.ceil(sorted.length / 4);
-    for (let r = 0; r < rows; r++) {
-        const cells = [0, 1, 2, 3]
-            .map(col => sorted[col * rows + r])
-            .filter(Boolean)
-            .map(n => c.dim(n.padEnd(20)));
-        ui.line(`  ${cells.join("")}`);
-    }
-    ui.line();
-    ui.line(c.dim("  Hostwares account tools (sites, databases, DNS, billing) run on the server."));
-    ui.line();
-}
-function scaffoldSteering(cwd) {
-    ui.line();
-    try {
-        const { created, skipped } = generateSteering(cwd);
-        if (created.length) {
-            ui.line(`  ${c.bold("Created steering files")} ${c.dim("in .hostwares/steering/")}`);
-            for (const f of created)
-                ui.line(`    ${c.green(glyph.tick)} ${f}`);
-            ui.line();
-            ui.line(c.dim("  Edit them to describe your project — they load into every session so HW"));
-            ui.line(c.dim("  stops re-deriving your conventions."));
-        }
-        if (skipped.length) {
-            ui.line(c.dim(`  Left alone (already exist): ${skipped.join(", ")}`));
-        }
-    }
-    catch (e) {
-        ui.line(`  ${c.red(glyph.warn)} Could not create steering files: ${e.message}`);
-    }
-    ui.line();
-}
-function rewindCheckpoint(cwd, arg) {
-    ui.line();
-    const checkpoints = listCheckpoints(cwd);
-    if (!checkpoints.length) {
-        ui.line(c.dim("  Nothing to rewind — no changes have been checkpointed in this project yet."));
-        ui.line();
-        return;
-    }
-    // No arg: list the checkpoints so the user can pick one.
-    if (!arg.trim()) {
-        ui.line(`  ${c.bold("Checkpoints")} ${c.dim("(newest first — /rewind undoes #1, /rewind N undoes the Nth)")}`);
-        ui.line();
-        checkpoints.slice(0, 10).forEach((cp, i) => {
-            const when = new Date(cp.createdAt).toLocaleString();
-            const note = cp.note ? ` — ${cp.note.slice(0, 50)}` : "";
-            ui.line(`    ${c.bold(String(i + 1))}. ${c.dim(`${cp.fileCount} file${cp.fileCount === 1 ? "" : "s"} · ${when}`)}${c.dim(note)}`);
-        });
-        ui.line();
-        return;
-    }
-    // Arg: rewind the Nth checkpoint (1-based), or the latest if not a number.
-    const n = parseInt(arg.trim(), 10);
-    const label = Number.isFinite(n) && n >= 1 && checkpoints[n - 1] ? checkpoints[n - 1].label : undefined;
-    const result = rewind(cwd, label);
-    if (result.ok) {
-        ui.line(`  ${c.green(glyph.tick)} ${result.message}`);
-        for (const f of result.restored)
-            ui.line(c.dim(`    restored ${f}`));
-        for (const f of result.deleted)
-            ui.line(c.dim(`    removed ${f}`));
-    }
-    else {
-        ui.line(`  ${c.red(glyph.warn)} ${result.message}`);
-    }
-    ui.line();
-}
-function setModel(arg) {
-    const ALLOWED = ["auto", "claude-sonnet-5", "claude-opus-5"];
-    if (!arg) {
-        ui.line(`  Model: ${c.bold(getConfig().model ?? "auto")}`);
-        ui.line(c.dim(`  Options: ${ALLOWED.join(", ")}`));
-        ui.line(c.dim("  auto picks per task — cheaper for lookups, stronger for debugging."));
-        return;
-    }
-    if (!ALLOWED.includes(arg)) {
-        ui.line(c.red(`  Unknown model "${arg}".`));
-        ui.line(c.dim(`  Options: ${ALLOWED.join(", ")}`));
-        return;
-    }
-    saveConfig({ model: arg });
-    ui.line(c.dim(`  Model set to ${arg}.`));
-    if (arg === "claude-opus-5")
-        ui.line(c.dim("  Opus needs a Business plan; other plans fall back to Sonnet."));
-}
-async function showCredits(signal) {
-    try {
-        const cfg = getConfig();
-        const r = await fetch(`${cfg.baseUrl}/api/credits`, {
-            headers: { Authorization: `Bearer ${cfg.apiKey}` }, signal,
-        });
-        const res = r.ok ? await r.json() : null;
-        const balance = res?.total ?? res?.balance;
-        if (typeof balance === "number")
-            ui.line(`  Credits: ${c.bold(balance.toFixed(2))}`);
-        else
-            ui.line(c.dim("  Could not read your balance."));
-    }
-    catch (e) {
-        reportError(e);
-    }
-}
-function relativeTime(iso) {
-    const diff = Date.now() - Date.parse(iso);
-    if (!Number.isFinite(diff))
-        return "unknown";
-    const mins = Math.floor(diff / 60_000);
-    if (mins < 1)
-        return "just now";
-    if (mins < 60)
-        return `${mins}m ago`;
-    const hours = Math.floor(mins / 60);
-    if (hours < 24)
-        return `${hours}h ago`;
-    return `${Math.floor(hours / 24)}d ago`;
-}
-export const SLASH_NAMES = COMMANDS.map(c => c.name);

package/dist/config.js

@@ -1,95 +0,0 @@
-import { homedir } from "os";
-import { join, dirname } from "path";
-import { existsSync, readFileSync, writeFileSync, mkdirSync, renameSync, chmodSync, unlinkSync, } from "fs";
-/**
- * On-disk configuration: the API key and which host to talk to.
- *
- * Two things this file is strict about, both of which the previous version got
- * wrong:
- *
- * 1. **Permissions.** The config holds a live API key with full account access.
- *    It was previously written at the process umask default (0644) - world
- *    readable on a shared machine. It is now created 0700/0600 and re-chmod'd
- *    on every write, because a file created before this change keeps its old
- *    mode forever otherwise.
- *
- * 2. **Atomicity.** A crash or a full disk mid-write used to leave a truncated
- *    config, which reads back as invalid JSON and logs the user out. Writes go
- *    to a temp file in the same directory and are renamed into place.
- */
-export const HW_DIR = join(homedir(), ".hostwares");
-const CONFIG_FILE = join(HW_DIR, "config.json");
-export const DEFAULT_BASE_URL = "https://hostwares.com";
-const EMPTY = { apiKey: "", baseUrl: DEFAULT_BASE_URL };
-let _cache = null;
-/** Read config from disk. Cached per-process; call `reloadConfig()` after a login. */
-export function getConfig() {
-    if (_cache)
-        return _cache;
-    _cache = readConfigFromDisk();
-    return _cache;
-}
-export function reloadConfig() {
-    _cache = readConfigFromDisk();
-    return _cache;
-}
-function readConfigFromDisk() {
-    if (!existsSync(CONFIG_FILE))
-        return { ...EMPTY };
-    try {
-        const parsed = JSON.parse(readFileSync(CONFIG_FILE, "utf8"));
-        return {
-            // A truncated or hand-edited config must degrade to "logged out", never
-            // to a crash on startup.
-            apiKey: typeof parsed.apiKey === "string" ? parsed.apiKey : "",
-            baseUrl: typeof parsed.baseUrl === "string" && parsed.baseUrl ? parsed.baseUrl : DEFAULT_BASE_URL,
-            trustedProjects: Array.isArray(parsed.trustedProjects)
-                ? parsed.trustedProjects.filter((p) => typeof p === "string")
-                : [],
-            model: typeof parsed.model === "string" ? parsed.model : undefined,
-        };
-    }
-    catch {
-        return { ...EMPTY };
-    }
-}
-export function saveConfig(patch) {
-    const next = { ...getConfig(), ...patch };
-    writeJsonSecure(CONFIG_FILE, next);
-    _cache = next;
-    return next;
-}
-export function clearConfig() {
-    try {
-        unlinkSync(CONFIG_FILE);
-    }
-    catch { /* already gone */ }
-    _cache = { ...EMPTY };
-}
-export function isAuthenticated() {
-    return Boolean(getConfig().apiKey);
-}
-/**
- * Write JSON atomically with owner-only permissions.
- *
- * Exported because the session store needs the identical guarantees - session
- * files carry conversation text, and a half-written one loses a session.
- */
-export function writeJsonSecure(file, value) {
-    const dir = dirname(file);
-    mkdirSync(dir, { recursive: true, mode: 0o700 });
-    // mkdir's mode is masked by umask and is a no-op if the directory already
-    // exists, so set it explicitly.
-    try {
-        chmodSync(dir, 0o700);
-    }
-    catch { /* not fatal */ }
-    // Same directory as the target: rename is only atomic within a filesystem.
-    const tmp = `${file}.${process.pid}.tmp`;
-    writeFileSync(tmp, JSON.stringify(value, null, 2), { mode: 0o600 });
-    try {
-        chmodSync(tmp, 0o600);
-    }
-    catch { /* not fatal */ }
-    renameSync(tmp, file);
-}

package/dist/errors.js

@@ -1,35 +0,0 @@
-import { ApiError } from "@hostwares/agent-client";
-import * as ui from "./ui/render.js";
-/**
- * Turn an error into one actionable line.
- *
- * Every branch says what the user can DO. "Request failed" plus a stack trace
- * is what the old client printed, and it left people with no next step.
- */
-export function reportError(e) {
-    ui.breakLine();
-    if (e instanceof ApiError) {
-        if (e.isOutOfCredits) {
-            ui.error("You're out of credits.");
-            ui.note("Ask me to buy credits — billing and support messages are free.");
-            return;
-        }
-        if (e.status === 429) {
-            ui.error("Too many requests in a row.");
-            ui.note("Wait a few seconds and try again.");
-            return;
-        }
-        if (e.code === "ai_terms_required") {
-            ui.error("You need to accept the AI agent terms before using this.");
-            ui.note(String(e.body.termsUrl ?? "https://hostwares.com/terms#ai-agent"));
-            return;
-        }
-        if (e.isAuthFailure) {
-            ui.error("Not signed in. Run `hw login`.");
-            return;
-        }
-        ui.error(e.message);
-        return;
-    }
-    ui.error(e instanceof Error ? e.message : String(e));
-}