kly 0.1.0

package/dist/mcp/server.mjs

@@ -0,0 +1,92 @@
+import { convertToJsonSchema } from "./schema-converter.mjs";
+import { Server } from "@modelcontextprotocol/sdk/server/index.js";
+import { StdioServerTransport } from "@modelcontextprotocol/sdk/server/stdio.js";
+import { CallToolRequestSchema, ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+
+//#region src/mcp/server.ts
+/**
+* Start an MCP server for a Kly app
+*
+* This makes all tools from the app available to Claude Desktop/Code via the MCP protocol.
+*
+* @param app - The Kly app instance returned by defineApp()
+*
+* @example
+* ```typescript
+* import { defineApp, tool, startMcpServer } from "kly"
+* import { z } from "zod"
+*
+* const app = defineApp({
+*   name: "my-app",
+*   version: "1.0.0",
+*   description: "My app",
+*   tools: [myTool],
+* })
+*
+* // In MCP mode, start the server
+* if (process.env.KLY_MCP_MODE === "true") {
+*   await startMcpServer(app)
+* }
+* ```
+*/
+async function startMcpServer(app) {
+	const { definition } = app;
+	const server = new Server({
+		name: definition.name,
+		version: definition.version
+	}, { capabilities: { tools: {} } });
+	server.setRequestHandler(ListToolsRequestSchema, async () => {
+		return { tools: definition.tools.map((tool) => ({
+			name: tool.name,
+			description: tool.description ?? `Execute ${tool.name}`,
+			inputSchema: convertToJsonSchema(tool.inputSchema)
+		})) };
+	});
+	server.setRequestHandler(CallToolRequestSchema, async (request) => {
+		const { name, arguments: args } = request.params;
+		try {
+			return {
+				content: formatToolResult(await app.execute(name, args)),
+				isError: false
+			};
+		} catch (error) {
+			return {
+				content: [{
+					type: "text",
+					text: `Error executing tool '${name}': ${error instanceof Error ? error.message : String(error)}`
+				}],
+				isError: true
+			};
+		}
+	});
+	server.onerror = (error) => {
+		console.error("[MCP Error]", error);
+	};
+	process.on("SIGINT", async () => {
+		await server.close();
+		process.exit(0);
+	});
+	const transport = new StdioServerTransport();
+	await server.connect(transport);
+}
+/**
+* Format tool result for MCP response
+*/
+function formatToolResult(result) {
+	if (result === void 0 || result === null) return [{
+		type: "text",
+		text: "Success"
+	}];
+	if (typeof result === "string") return [{
+		type: "text",
+		text: result
+	}];
+	return [{
+		type: "text",
+		text: JSON.stringify(result, null, 2)
+	}];
+}
+
+//#endregion
+export { startMcpServer };
+//# sourceMappingURL=server.mjs.map

package/dist/mcp/server.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"server.mjs","names":[],"sources":["../../src/mcp/server.ts"],"sourcesContent":["import { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport {\n  CallToolRequestSchema,\n  ListToolsRequestSchema,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport type { KlyApp } from \"../types\";\nimport { convertToJsonSchema } from \"./schema-converter\";\n\n/**\n * Start an MCP server for a Kly app\n *\n * This makes all tools from the app available to Claude Desktop/Code via the MCP protocol.\n *\n * @param app - The Kly app instance returned by defineApp()\n *\n * @example\n * ```typescript\n * import { defineApp, tool, startMcpServer } from \"kly\"\n * import { z } from \"zod\"\n *\n * const app = defineApp({\n *   name: \"my-app\",\n *   version: \"1.0.0\",\n *   description: \"My app\",\n *   tools: [myTool],\n * })\n *\n * // In MCP mode, start the server\n * if (process.env.KLY_MCP_MODE === \"true\") {\n *   await startMcpServer(app)\n * }\n * ```\n */\nexport async function startMcpServer(app: KlyApp): Promise<void> {\n  const { definition } = app;\n\n  // Create MCP server instance\n  const server = new Server(\n    {\n      name: definition.name,\n      version: definition.version,\n    },\n    {\n      capabilities: {\n        tools: {},\n      },\n    },\n  );\n\n  // Handle tools/list - enumerate all tools from the app\n  server.setRequestHandler(ListToolsRequestSchema, async () => {\n    const tools = definition.tools.map((tool) => ({\n      name: tool.name,\n      description: tool.description ?? `Execute ${tool.name}`,\n      inputSchema: convertToJsonSchema(tool.inputSchema),\n    }));\n\n    return { tools };\n  });\n\n  // Handle tools/call - execute a specific tool\n  server.setRequestHandler(CallToolRequestSchema, async (request) => {\n    const { name, arguments: args } = request.params;\n\n    try {\n      // Execute the tool through the app's execute method\n      const result = await app.execute(name, args as Record<string, unknown>);\n\n      // Convert result to MCP content format\n      const content = formatToolResult(result);\n\n      return {\n        content,\n        isError: false,\n      };\n    } catch (error) {\n      // Return error in MCP format\n      const errorMessage =\n        error instanceof Error ? error.message : String(error);\n\n      return {\n        content: [\n          {\n            type: \"text\",\n            text: `Error executing tool '${name}': ${errorMessage}`,\n          },\n        ],\n        isError: true,\n      };\n    }\n  });\n\n  // Error handling\n  server.onerror = (error) => {\n    console.error(\"[MCP Error]\", error);\n  };\n\n  process.on(\"SIGINT\", async () => {\n    await server.close();\n    process.exit(0);\n  });\n\n  // Start the server with stdio transport\n  const transport = new StdioServerTransport();\n  await server.connect(transport);\n\n  // Note: In MCP mode, we should not log to stdout as it interferes with JSON-RPC\n  // The SDK handles logging internally via stderr\n}\n\n/**\n * Format tool result for MCP response\n */\nfunction formatToolResult(\n  result: unknown,\n): Array<{ type: string; text: string }> {\n  if (result === undefined || result === null) {\n    return [\n      {\n        type: \"text\",\n        text: \"Success\",\n      },\n    ];\n  }\n\n  // If result is already a string, use it directly\n  if (typeof result === \"string\") {\n    return [\n      {\n        type: \"text\",\n        text: result,\n      },\n    ];\n  }\n\n  // Otherwise, stringify the result as JSON\n  return [\n    {\n      type: \"text\",\n      text: JSON.stringify(result, null, 2),\n    },\n  ];\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,eAAsB,eAAe,KAA4B;CAC/D,MAAM,EAAE,eAAe;CAGvB,MAAM,SAAS,IAAI,OACjB;EACE,MAAM,WAAW;EACjB,SAAS,WAAW;EACrB,EACD,EACE,cAAc,EACZ,OAAO,EAAE,EACV,EACF,CACF;AAGD,QAAO,kBAAkB,wBAAwB,YAAY;AAO3D,SAAO,EAAE,OANK,WAAW,MAAM,KAAK,UAAU;GAC5C,MAAM,KAAK;GACX,aAAa,KAAK,eAAe,WAAW,KAAK;GACjD,aAAa,oBAAoB,KAAK,YAAY;GACnD,EAAE,EAEa;GAChB;AAGF,QAAO,kBAAkB,uBAAuB,OAAO,YAAY;EACjE,MAAM,EAAE,MAAM,WAAW,SAAS,QAAQ;AAE1C,MAAI;AAOF,UAAO;IACL,SAHc,iBAHD,MAAM,IAAI,QAAQ,MAAM,KAAgC,CAG/B;IAItC,SAAS;IACV;WACM,OAAO;AAKd,UAAO;IACL,SAAS,CACP;KACE,MAAM;KACN,MAAM,yBAAyB,KAAK,KANxC,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;KAOnD,CACF;IACD,SAAS;IACV;;GAEH;AAGF,QAAO,WAAW,UAAU;AAC1B,UAAQ,MAAM,eAAe,MAAM;;AAGrC,SAAQ,GAAG,UAAU,YAAY;AAC/B,QAAM,OAAO,OAAO;AACpB,UAAQ,KAAK,EAAE;GACf;CAGF,MAAM,YAAY,IAAI,sBAAsB;AAC5C,OAAM,OAAO,QAAQ,UAAU;;;;;AASjC,SAAS,iBACP,QACuC;AACvC,KAAI,WAAW,UAAa,WAAW,KACrC,QAAO,CACL;EACE,MAAM;EACN,MAAM;EACP,CACF;AAIH,KAAI,OAAO,WAAW,SACpB,QAAO,CACL;EACE,MAAM;EACN,MAAM;EACP,CACF;AAIH,QAAO,CACL;EACE,MAAM;EACN,MAAM,KAAK,UAAU,QAAQ,MAAM,EAAE;EACtC,CACF"}

package/dist/permissions/index.mjs

@@ -0,0 +1,123 @@
+import { PATHS } from "../shared/constants.mjs";
+import { getLocalRef, getRemoteRef, isTrustAll } from "../shared/runtime-mode.mjs";
+import { isTTY } from "../ui/utils/tty.mjs";
+import { select } from "../ui/components/select.mjs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+
+//#region src/permissions/index.ts
+const CONFIG_DIR = join(homedir(), PATHS.CONFIG_DIR);
+const PERMISSIONS_FILE = join(CONFIG_DIR, PATHS.PERMISSIONS_FILE);
+/**
+* Get app identifier from script path
+*/
+function getAppIdentifier() {
+	const localRef = getLocalRef();
+	if (localRef) return localRef;
+	const remoteRef = getRemoteRef();
+	if (remoteRef) return remoteRef;
+	const scriptPath = process.argv[1] ?? "";
+	if (scriptPath.startsWith("/") || scriptPath.startsWith("C:\\")) return `local:${scriptPath}`;
+	return scriptPath || "unknown";
+}
+/**
+* Get friendly app name for display
+*/
+function getAppName(appId) {
+	if (appId.startsWith("local:")) {
+		const path = appId.slice(6);
+		const parts = path.split("/");
+		return parts[parts.length - 1] || path;
+	}
+	if (appId.startsWith("github.com/")) return appId.split("/").slice(1, 3).join("/");
+	return appId;
+}
+/**
+* Ensure permissions config directory exists
+*/
+function ensurePermissionsDir() {
+	if (!existsSync(CONFIG_DIR)) mkdirSync(CONFIG_DIR, { recursive: true });
+}
+/**
+* Load permissions configuration
+*/
+function loadPermissions() {
+	ensurePermissionsDir();
+	if (!existsSync(PERMISSIONS_FILE)) return { trustedApps: {} };
+	try {
+		const content = readFileSync(PERMISSIONS_FILE, "utf-8");
+		return JSON.parse(content);
+	} catch (error) {
+		console.error("Failed to parse permissions file:", error);
+		return { trustedApps: {} };
+	}
+}
+/**
+* Save permissions configuration
+*/
+function savePermissions(config) {
+	ensurePermissionsDir();
+	writeFileSync(PERMISSIONS_FILE, JSON.stringify(config, null, 2), "utf-8");
+}
+/**
+* Request permission from user with interactive prompt
+*/
+async function requestPermission(appId, appName) {
+	if (!isTTY()) {
+		console.error(`\nPermission required: App "${appName}" (${appId}) wants to access your API keys.`);
+		console.error("Set KLY_TRUST_ALL=true environment variable to grant access in non-interactive mode.");
+		return false;
+	}
+	console.log("");
+	console.log(`App "${appName}" is requesting access to your API keys.`);
+	console.log(`Source: ${appId}`);
+	console.log("");
+	console.log("This will allow the app to use your configured LLM models.");
+	console.log("");
+	const choice = await select({
+		prompt: "Do you want to allow this?",
+		options: [
+			{
+				name: "Allow once",
+				value: "once",
+				description: "Allow for this session only"
+			},
+			{
+				name: "Always allow",
+				value: "always",
+				description: "Remember this choice for future runs"
+			},
+			{
+				name: "Cancel",
+				value: "cancel",
+				description: "Cancel and exit"
+			}
+		]
+	});
+	if (choice === "cancel") return false;
+	if (choice === "always") {
+		const config = loadPermissions();
+		config.trustedApps[appId] = {
+			timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+			choice: "always"
+		};
+		savePermissions(config);
+		return true;
+	}
+	return true;
+}
+/**
+* Check if an app has permission to access API keys
+* If not, prompt user for permission (in interactive mode)
+*/
+async function checkApiKeyPermission(appId) {
+	if (isTrustAll()) return true;
+	const record = loadPermissions().trustedApps[appId];
+	if (record && record.choice === "always") return true;
+	return await requestPermission(appId, getAppName(appId));
+}
+
+//#endregion
+export { checkApiKeyPermission, getAppIdentifier };
+//# sourceMappingURL=index.mjs.map

package/dist/permissions/index.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/permissions/index.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport type { SandboxRuntimeConfig } from \"@anthropic-ai/sandbox-runtime\";\nimport { PATHS } from \"../shared/constants\";\nimport { getLocalRef, getRemoteRef, isTrustAll } from \"../shared/runtime-mode\";\nimport { select } from \"../ui\";\nimport { isTTY } from \"../ui/utils/tty\";\n\nconst CONFIG_DIR = join(homedir(), PATHS.CONFIG_DIR);\nconst PERMISSIONS_FILE = join(CONFIG_DIR, PATHS.PERMISSIONS_FILE);\n\n/**\n * Permission record for an app\n * Only \"always\" choices are stored\n */\ninterface PermissionRecord {\n  /** When the permission was granted */\n  timestamp: string;\n  /** User's choice: always \"always\" (only stored choice) */\n  choice: \"always\";\n  /** Sandbox configuration (optional, for sandboxed execution) */\n  sandboxConfig?: SandboxRuntimeConfig;\n}\n\n/**\n * Permissions configuration\n */\ninterface PermissionsConfig {\n  /** Trusted apps with their permissions */\n  trustedApps: Record<string, PermissionRecord>;\n}\n\n/**\n * Get app identifier from script path\n */\nexport function getAppIdentifier(): string {\n  // Check for explicit local file reference (set by kly run command)\n  const localRef = getLocalRef();\n  if (localRef) {\n    return localRef;\n  }\n\n  // Remote app (from environment variable set by remote loader)\n  const remoteRef = getRemoteRef();\n  if (remoteRef) {\n    return remoteRef;\n  }\n\n  // Fallback to script path for direct execution\n  const scriptPath = process.argv[1] ?? \"\";\n  if (scriptPath.startsWith(\"/\") || scriptPath.startsWith(\"C:\\\\\")) {\n    return `local:${scriptPath}`;\n  }\n\n  // Default to script path\n  return scriptPath || \"unknown\";\n}\n\n/**\n * Get friendly app name for display\n */\nexport function getAppName(appId: string): string {\n  if (appId.startsWith(\"local:\")) {\n    const path = appId.slice(6);\n    const parts = path.split(\"/\");\n    return parts[parts.length - 1] || path;\n  }\n\n  if (appId.startsWith(\"github.com/\")) {\n    const parts = appId.split(\"/\");\n    return parts.slice(1, 3).join(\"/\");\n  }\n\n  return appId;\n}\n\n/**\n * Ensure permissions config directory exists\n */\nfunction ensurePermissionsDir(): void {\n  if (!existsSync(CONFIG_DIR)) {\n    mkdirSync(CONFIG_DIR, { recursive: true });\n  }\n}\n\n/**\n * Load permissions configuration\n */\nexport function loadPermissions(): PermissionsConfig {\n  ensurePermissionsDir();\n\n  if (!existsSync(PERMISSIONS_FILE)) {\n    return { trustedApps: {} };\n  }\n\n  try {\n    const content = readFileSync(PERMISSIONS_FILE, \"utf-8\");\n    return JSON.parse(content);\n  } catch (error) {\n    console.error(\"Failed to parse permissions file:\", error);\n    return { trustedApps: {} };\n  }\n}\n\n/**\n * Save permissions configuration\n */\nexport function savePermissions(config: PermissionsConfig): void {\n  ensurePermissionsDir();\n  writeFileSync(PERMISSIONS_FILE, JSON.stringify(config, null, 2), \"utf-8\");\n}\n\n/**\n * Request permission from user with interactive prompt\n */\nasync function requestPermission(\n  appId: string,\n  appName: string,\n): Promise<boolean> {\n  // Check if running in TTY mode\n  if (!isTTY()) {\n    console.error(\n      `\\nPermission required: App \"${appName}\" (${appId}) wants to access your API keys.`,\n    );\n    console.error(\n      \"Set KLY_TRUST_ALL=true environment variable to grant access in non-interactive mode.\",\n    );\n    return false;\n  }\n\n  console.log(\"\");\n  console.log(`App \"${appName}\" is requesting access to your API keys.`);\n  console.log(`Source: ${appId}`);\n  console.log(\"\");\n  console.log(\"This will allow the app to use your configured LLM models.\");\n  console.log(\"\");\n\n  const choice = await select({\n    prompt: \"Do you want to allow this?\",\n    options: [\n      {\n        name: \"Allow once\",\n        value: \"once\",\n        description: \"Allow for this session only\",\n      },\n      {\n        name: \"Always allow\",\n        value: \"always\",\n        description: \"Remember this choice for future runs\",\n      },\n      { name: \"Cancel\", value: \"cancel\", description: \"Cancel and exit\" },\n    ],\n  });\n\n  // Cancel - don't save, just reject\n  if (choice === \"cancel\") {\n    return false;\n  }\n\n  // Always - save to config\n  if (choice === \"always\") {\n    const config = loadPermissions();\n    config.trustedApps[appId] = {\n      timestamp: new Date().toISOString(),\n      choice: \"always\",\n    };\n    savePermissions(config);\n    return true;\n  }\n\n  // Once - don't save, just allow for this run\n  return true;\n}\n\n/**\n * Check if an app has permission to access API keys\n * If not, prompt user for permission (in interactive mode)\n */\nexport async function checkApiKeyPermission(appId: string): Promise<boolean> {\n  // Allow bypass via environment variable (for CI/automation)\n  if (isTrustAll()) {\n    return true;\n  }\n\n  // Check stored permissions\n  const config = loadPermissions();\n  const record = config.trustedApps[appId];\n\n  // If record exists, it's always \"always allow\" (we only store grants)\n  if (record && record.choice === \"always\") {\n    return true;\n  }\n\n  // No stored permission - need to request\n  const appName = getAppName(appId);\n  return await requestPermission(appId, appName);\n}\n\n/**\n * Revoke permission for an app\n */\nexport function revokePermission(appId: string): void {\n  const config = loadPermissions();\n  delete config.trustedApps[appId];\n  savePermissions(config);\n}\n\n/**\n * List all granted permissions\n * Only \"always allow\" permissions are stored\n */\nexport function listPermissions(): Array<{\n  appId: string;\n  appName: string;\n  timestamp: string;\n  choice: string;\n}> {\n  const config = loadPermissions();\n\n  return Object.entries(config.trustedApps).map(([appId, record]) => ({\n    appId,\n    appName: getAppName(appId),\n    timestamp: record.timestamp,\n    choice: record.choice,\n  }));\n}\n\n/**\n * Request sandbox configuration from user interactively\n * Returns SandboxRuntimeConfig directly (no conversion needed)\n */\nasync function requestSandboxConfig(\n  appId: string,\n  appName: string,\n): Promise<SandboxRuntimeConfig | null> {\n  if (!isTTY()) {\n    console.error(`\\nSandbox permission required for: \"${appName}\" (${appId})`);\n    console.error(\n      \"Set KLY_TRUST_ALL=true environment variable to run without sandboxing in non-interactive mode.\",\n    );\n    return null;\n  }\n\n  const homeDir = homedir();\n  const currentDir = process.cwd();\n\n  console.log(\"\");\n  console.log(`🔐 Sandbox Permission Request from: ${appName}`);\n  console.log(\"\");\n\n  // Ask for filesystem read permissions\n  console.log(\"📂 Filesystem Read Access:\");\n  const fsReadChoice = await select({\n    prompt: \"Which files should be denied for reading?\",\n    options: [\n      {\n        name: \"Sensitive only\",\n        value: \"sensitive\",\n        description: \"Deny access to ~/.kly, ~/.ssh, ~/.aws, etc.\",\n      },\n      {\n        name: \"All home directory\",\n        value: \"all-home\",\n        description: \"Deny access to entire home directory\",\n      },\n      {\n        name: \"None (allow all)\",\n        value: \"none\",\n        description: \"No read restrictions (except ~/.kly)\",\n      },\n    ],\n  });\n\n  // Always deny reading sensitive directories (hardcoded for security)\n  let denyRead: string[] = [join(homeDir, \".kly\")];\n\n  if (fsReadChoice === \"sensitive\") {\n    denyRead = [\n      join(homeDir, \".kly\"),\n      join(homeDir, \".ssh\"),\n      join(homeDir, \".aws\"),\n      join(homeDir, \".gnupg\"),\n    ];\n  } else if (fsReadChoice === \"all-home\") {\n    denyRead = [homeDir];\n  }\n  // Note: Even if user chooses \"none\", .kly is still protected\n\n  // Ask for filesystem write permissions\n  console.log(\"\");\n  console.log(\"📝 Filesystem Write Access:\");\n  const fsWriteChoice = await select({\n    prompt: \"Which directories should be allowed for writing?\",\n    options: [\n      {\n        name: \"None\",\n        value: \"none\",\n        description: \"No write access\",\n      },\n      {\n        name: \"Current directory only\",\n        value: \"current\",\n        description: `Allow write to ${currentDir}`,\n      },\n      {\n        name: \"Temporary directory\",\n        value: \"temp\",\n        description: \"Allow write to system temp directory\",\n      },\n    ],\n  });\n\n  let allowWrite: string[] = [];\n  if (fsWriteChoice === \"current\") {\n    allowWrite = [currentDir];\n  } else if (fsWriteChoice === \"temp\") {\n    const tmpdir = process.env.TMPDIR || process.env.TEMP || \"/tmp\";\n    allowWrite = [tmpdir];\n  }\n\n  // Always deny writing to sensitive directories (hardcoded for security)\n  const denyWrite = [\n    join(homeDir, \".kly\"), // KLY config and permissions\n    join(homeDir, \".ssh\"), // SSH keys\n    join(homeDir, \".aws\"), // AWS credentials\n    join(homeDir, \".gnupg\"), // GPG keys\n  ];\n\n  // Ask for network permissions\n  console.log(\"\");\n  console.log(\"🌐 Network Access:\");\n  const networkChoice = await select({\n    prompt: \"Which network access should be allowed?\",\n    options: [\n      {\n        name: \"None\",\n        value: \"none\",\n        description: \"No network access\",\n      },\n      {\n        name: \"LLM APIs only\",\n        value: \"llm-apis\",\n        description: \"OpenAI, Anthropic, Google AI\",\n      },\n      {\n        name: \"Common APIs\",\n        value: \"common\",\n        description: \"LLM + GitHub, npm, etc.\",\n      },\n      {\n        name: \"All domains\",\n        value: \"all\",\n        description: \"Allow all network access\",\n      },\n    ],\n  });\n\n  let allowedDomains: string[] = [];\n  if (networkChoice === \"llm-apis\") {\n    allowedDomains = [\n      \"api.openai.com\",\n      \"*.anthropic.com\",\n      \"generativelanguage.googleapis.com\",\n    ];\n  } else if (networkChoice === \"common\") {\n    allowedDomains = [\n      \"api.openai.com\",\n      \"*.anthropic.com\",\n      \"generativelanguage.googleapis.com\",\n      \"*.github.com\",\n      \"registry.npmjs.org\",\n    ];\n  } else if (networkChoice === \"all\") {\n    allowedDomains = [\"*\"];\n  }\n\n  // Ask how long to remember this choice\n  console.log(\"\");\n  const duration = await select({\n    prompt: \"How long should these permissions last?\",\n    options: [\n      {\n        name: \"One time only\",\n        value: \"once\",\n        description: \"Ask again next time\",\n      },\n      {\n        name: \"Always allow\",\n        value: \"always\",\n        description: \"Remember for this app\",\n      },\n      {\n        name: \"Cancel\",\n        value: \"cancel\",\n        description: \"Cancel and exit\",\n      },\n    ],\n  });\n\n  // Cancel - don't save, just reject\n  if (duration === \"cancel\") {\n    return null;\n  }\n\n  // Construct SandboxRuntimeConfig directly\n  const sandboxConfig: SandboxRuntimeConfig = {\n    network: {\n      allowedDomains,\n      deniedDomains: [],\n    },\n    filesystem: {\n      denyRead,\n      allowWrite,\n      denyWrite,\n    },\n  };\n\n  // Save permission record only if \"always\"\n  if (duration === \"always\") {\n    const config = loadPermissions();\n    config.trustedApps[appId] = {\n      sandboxConfig,\n      timestamp: new Date().toISOString(),\n      choice: \"always\",\n    };\n    savePermissions(config);\n  }\n\n  console.log(\"\");\n  console.log(\"✅ Sandbox permissions granted!\");\n  return sandboxConfig;\n}\n\n/**\n * Get sandbox configuration for an app\n * Returns SandboxRuntimeConfig directly (no conversion needed)\n *\n * @param appId - App identifier\n * @returns SandboxRuntimeConfig or null if denied\n */\nexport async function getAppSandboxConfig(\n  appId: string,\n): Promise<SandboxRuntimeConfig | null> {\n  const homeDir = homedir();\n\n  // Check for trust-all bypass (for automation)\n  if (isTrustAll()) {\n    // Even in trust-all mode, protect sensitive directories\n    return {\n      network: { allowedDomains: [\"*\"], deniedDomains: [] },\n      filesystem: {\n        denyRead: [join(homeDir, \".kly\")], // ALWAYS deny reading KLY config\n        allowWrite: [\"*\"],\n        denyWrite: [\n          join(homeDir, \".kly\"), // KLY config and permissions\n          join(homeDir, \".ssh\"), // SSH keys\n          join(homeDir, \".aws\"), // AWS credentials\n          join(homeDir, \".gnupg\"), // GPG keys\n        ],\n      },\n    };\n  }\n\n  const config = loadPermissions();\n  const record = config.trustedApps[appId];\n\n  // If permission already granted as \"always\", return cached config\n  if (record?.choice === \"always\" && record.sandboxConfig) {\n    return record.sandboxConfig;\n  }\n\n  // Request new sandbox permissions\n  const appName = getAppName(appId);\n  return await requestSandboxConfig(appId, appName);\n}\n\n/**\n * Clear all permissions\n */\nexport function clearAllPermissions(): void {\n  savePermissions({ trustedApps: {} });\n}\n"],"mappings":";;;;;;;;;AASA,MAAM,aAAa,KAAK,SAAS,EAAE,MAAM,WAAW;AACpD,MAAM,mBAAmB,KAAK,YAAY,MAAM,iBAAiB;;;;AA0BjE,SAAgB,mBAA2B;CAEzC,MAAM,WAAW,aAAa;AAC9B,KAAI,SACF,QAAO;CAIT,MAAM,YAAY,cAAc;AAChC,KAAI,UACF,QAAO;CAIT,MAAM,aAAa,QAAQ,KAAK,MAAM;AACtC,KAAI,WAAW,WAAW,IAAI,IAAI,WAAW,WAAW,OAAO,CAC7D,QAAO,SAAS;AAIlB,QAAO,cAAc;;;;;AAMvB,SAAgB,WAAW,OAAuB;AAChD,KAAI,MAAM,WAAW,SAAS,EAAE;EAC9B,MAAM,OAAO,MAAM,MAAM,EAAE;EAC3B,MAAM,QAAQ,KAAK,MAAM,IAAI;AAC7B,SAAO,MAAM,MAAM,SAAS,MAAM;;AAGpC,KAAI,MAAM,WAAW,cAAc,CAEjC,QADc,MAAM,MAAM,IAAI,CACjB,MAAM,GAAG,EAAE,CAAC,KAAK,IAAI;AAGpC,QAAO;;;;;AAMT,SAAS,uBAA6B;AACpC,KAAI,CAAC,WAAW,WAAW,CACzB,WAAU,YAAY,EAAE,WAAW,MAAM,CAAC;;;;;AAO9C,SAAgB,kBAAqC;AACnD,uBAAsB;AAEtB,KAAI,CAAC,WAAW,iBAAiB,CAC/B,QAAO,EAAE,aAAa,EAAE,EAAE;AAG5B,KAAI;EACF,MAAM,UAAU,aAAa,kBAAkB,QAAQ;AACvD,SAAO,KAAK,MAAM,QAAQ;UACnB,OAAO;AACd,UAAQ,MAAM,qCAAqC,MAAM;AACzD,SAAO,EAAE,aAAa,EAAE,EAAE;;;;;;AAO9B,SAAgB,gBAAgB,QAAiC;AAC/D,uBAAsB;AACtB,eAAc,kBAAkB,KAAK,UAAU,QAAQ,MAAM,EAAE,EAAE,QAAQ;;;;;AAM3E,eAAe,kBACb,OACA,SACkB;AAElB,KAAI,CAAC,OAAO,EAAE;AACZ,UAAQ,MACN,+BAA+B,QAAQ,KAAK,MAAM,kCACnD;AACD,UAAQ,MACN,uFACD;AACD,SAAO;;AAGT,SAAQ,IAAI,GAAG;AACf,SAAQ,IAAI,QAAQ,QAAQ,0CAA0C;AACtE,SAAQ,IAAI,WAAW,QAAQ;AAC/B,SAAQ,IAAI,GAAG;AACf,SAAQ,IAAI,6DAA6D;AACzE,SAAQ,IAAI,GAAG;CAEf,MAAM,SAAS,MAAM,OAAO;EAC1B,QAAQ;EACR,SAAS;GACP;IACE,MAAM;IACN,OAAO;IACP,aAAa;IACd;GACD;IACE,MAAM;IACN,OAAO;IACP,aAAa;IACd;GACD;IAAE,MAAM;IAAU,OAAO;IAAU,aAAa;IAAmB;GACpE;EACF,CAAC;AAGF,KAAI,WAAW,SACb,QAAO;AAIT,KAAI,WAAW,UAAU;EACvB,MAAM,SAAS,iBAAiB;AAChC,SAAO,YAAY,SAAS;GAC1B,4BAAW,IAAI,MAAM,EAAC,aAAa;GACnC,QAAQ;GACT;AACD,kBAAgB,OAAO;AACvB,SAAO;;AAIT,QAAO;;;;;;AAOT,eAAsB,sBAAsB,OAAiC;AAE3E,KAAI,YAAY,CACd,QAAO;CAKT,MAAM,SADS,iBAAiB,CACV,YAAY;AAGlC,KAAI,UAAU,OAAO,WAAW,SAC9B,QAAO;AAKT,QAAO,MAAM,kBAAkB,OADf,WAAW,MAAM,CACa"}

package/dist/sandbox/bundled-executor.d.mts

@@ -0,0 +1,17 @@
+#!/usr/bin/env bun
+//#region src/sandbox/executor.d.ts
+/**
+ * Sandbox Executor - Entry point for sandboxed child process
+ * This file runs inside the sandbox and:
+ * 1. Receives initialization message from host via IPC
+ * 2. Loads and executes the user's script
+ * 3. Provides sandboxed context to the script
+ * 4. Sends execution results back to host
+ */
+/**
+ * Send IPC request to host and wait for response
+ */
+declare function sendIPCRequest<T>(type: string, payload: unknown): Promise<T>;
+//#endregion
+export { sendIPCRequest };
+//# sourceMappingURL=bundled-executor.d.mts.map

package/dist/sandbox/bundled-executor.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-executor.d.mts","names":[],"sources":["../../src/sandbox/executor.ts"],"sourcesContent":[],"mappings":";;;AAmEA;;;;;;;;;;iBAAgB,mDAAmD,QAAQ"}

package/dist/sandbox/bundled-executor.mjs

@@ -0,0 +1,175 @@
+#!/usr/bin/env bun
+//#region src/shared/constants.ts
+/**
+* Timeout values in milliseconds
+*/
+const TIMEOUTS = {
+	IPC_REQUEST: 3e4,
+	IPC_LONG_REQUEST: 6e4
+};
+
+//#endregion
+//#region src/shared/ipc-protocol.ts
+function isIPCResponse(msg) {
+	return typeof msg === "object" && msg !== null && "type" in msg && msg.type === "response" && "id" in msg && typeof msg.id === "string";
+}
+function isSandboxInitMessage(msg) {
+	return typeof msg === "object" && msg !== null && "type" in msg && msg.type === "init";
+}
+
+//#endregion
+//#region src/sandbox/sandboxed-context.ts
+/**
+* Create sandboxed models context that communicates with host via IPC
+* This context is injected into user tools running in the sandbox
+* All API key access is controlled by the host process
+*/
+function createSandboxedModelsContext() {
+	return {
+		list() {
+			throw new Error("Synchronous list() not supported in sandbox. Use async methods or move this logic to host.");
+		},
+		getCurrent() {
+			throw new Error("Synchronous getCurrent() not supported in sandbox. Use async methods or move this logic to host.");
+		},
+		get(_name) {
+			throw new Error("Synchronous get() not supported in sandbox. Use async methods or move this logic to host.");
+		},
+		async getConfigAsync(name) {
+			try {
+				const response = await sendIPCRequest("getModelConfig", { name });
+				if (!response) return null;
+				return {
+					provider: response.provider,
+					model: response.model,
+					apiKey: response.apiKey,
+					baseURL: response.baseURL
+				};
+			} catch (error) {
+				const message = error instanceof Error ? error.message : "Failed to get model config";
+				throw new Error(`Permission denied: ${message}`);
+			}
+		}
+	};
+}
+
+//#endregion
+//#region src/sandbox/executor.ts
+/**
+* Sandbox Executor - Entry point for sandboxed child process
+* This file runs inside the sandbox and:
+* 1. Receives initialization message from host via IPC
+* 2. Loads and executes the user's script
+* 3. Provides sandboxed context to the script
+* 4. Sends execution results back to host
+*/
+/**
+* Global state for the sandbox
+*/
+let initMessage = null;
+const pendingIPCResponses = /* @__PURE__ */ new Map();
+/**
+* Set up IPC communication
+*/
+function setupIPC() {
+	if (!process.send) throw new Error("IPC channel not available");
+	process.on("message", (message) => {
+		if (isSandboxInitMessage(message)) {
+			initMessage = message;
+			executeUserScript().catch((error) => {
+				sendExecutionComplete(false, void 0, error.message);
+				process.exit(1);
+			});
+			return;
+		}
+		if (isIPCResponse(message)) {
+			const pending = pendingIPCResponses.get(message.id);
+			if (pending) {
+				pendingIPCResponses.delete(message.id);
+				pending.resolve(message);
+			}
+			return;
+		}
+	});
+}
+/**
+* Send IPC request to host and wait for response
+*/
+function sendIPCRequest(type, payload) {
+	return new Promise((resolve, reject) => {
+		if (!process.send) {
+			reject(/* @__PURE__ */ new Error("IPC channel not available"));
+			return;
+		}
+		const id = `${type}-${Date.now()}-${Math.random()}`;
+		const request = {
+			type,
+			id,
+			payload
+		};
+		pendingIPCResponses.set(id, {
+			resolve: (response) => {
+				if (response.success) resolve(response.data);
+				else reject(new Error(response.error));
+			},
+			reject
+		});
+		process.send(request);
+		setTimeout(() => {
+			const pending = pendingIPCResponses.get(id);
+			if (pending) {
+				pendingIPCResponses.delete(id);
+				pending.reject(/* @__PURE__ */ new Error("IPC request timeout"));
+			}
+		}, TIMEOUTS.IPC_REQUEST);
+	});
+}
+/**
+* Execute the user's script
+*/
+async function executeUserScript() {
+	if (!initMessage) throw new Error("No initialization message received");
+	const { scriptPath, args } = initMessage;
+	try {
+		process.argv = [
+			"bun",
+			scriptPath,
+			...args
+		];
+		process.env.KLY_SANDBOX_MODE = "true";
+		global.__KLY_SANDBOXED_CONTEXT__ = { modelsContext: createSandboxedModelsContext() };
+		await import(scriptPath);
+		sendExecutionComplete(true);
+	} catch (error) {
+		sendExecutionComplete(false, void 0, error instanceof Error ? error.message : String(error));
+		throw error;
+	}
+}
+/**
+* Send execution complete message to host
+*/
+function sendExecutionComplete(success, result, error) {
+	if (!process.send) return;
+	const message = {
+		type: "complete",
+		success,
+		result,
+		error
+	};
+	process.send(message);
+}
+/**
+* Main entry point
+*/
+function main() {
+	if (process.env.KLY_SANDBOX_MODE !== "true") {
+		console.error("Error: This script must be run in sandbox mode");
+		process.exit(1);
+	}
+	setupIPC();
+}
+main();
+
+//#endregion
+export { sendIPCRequest };
+//# sourceMappingURL=bundled-executor.mjs.map

package/dist/sandbox/bundled-executor.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"bundled-executor.mjs","names":["initMessage: SandboxInitMessage | null","message: ExecutionCompleteMessage"],"sources":["../../src/shared/constants.ts","../../src/shared/ipc-protocol.ts","../../src/sandbox/sandboxed-context.ts","../../src/sandbox/executor.ts"],"sourcesContent":["/**\n * Centralized constants for the KLY project\n * Prevents magic strings and improves maintainability\n */\n\n/**\n * Environment variable names used throughout the application\n */\nexport const ENV_VARS = {\n  SANDBOX_MODE: \"KLY_SANDBOX_MODE\",\n  MCP_MODE: \"KLY_MCP_MODE\",\n  PROGRAMMATIC: \"KLY_PROGRAMMATIC\",\n  TRUST_ALL: \"KLY_TRUST_ALL\",\n  LOCAL_REF: \"KLY_LOCAL_REF\",\n  REMOTE_REF: \"KLY_REMOTE_REF\",\n} as const;\n\n/**\n * File and directory paths used for configuration and caching\n */\nexport const PATHS = {\n  CONFIG_DIR: \".kly\",\n  META_FILE: \".kly-meta.json\",\n  PERMISSIONS_FILE: \"permissions.json\",\n  CONFIG_FILE: \"config.json\",\n} as const;\n\n/**\n * Timeout values in milliseconds\n */\nexport const TIMEOUTS = {\n  /** Standard IPC request timeout (30 seconds) */\n  IPC_REQUEST: 30_000,\n  /** Long-running IPC request timeout (60 seconds) */\n  IPC_LONG_REQUEST: 60_000,\n} as const;\n\n/**\n * LLM API domains for network permission configuration\n */\nexport const LLM_API_DOMAINS = [\n  \"api.openai.com\",\n  \"*.anthropic.com\",\n  \"generativelanguage.googleapis.com\",\n  \"api.deepseek.com\",\n] as const;\n","import type { SandboxRuntimeConfig } from \"@anthropic-ai/sandbox-runtime\";\nimport type { ModelConfig } from \"../types\";\n\n/**\n * Message sent from Host to Sandbox on initialization\n */\nexport interface SandboxInitMessage {\n  type: \"init\";\n  scriptPath: string;\n  args: string[];\n  appId: string;\n  permissions: {\n    allowApiKey: boolean;\n    sandboxConfig: SandboxRuntimeConfig;\n  };\n}\n\n/**\n * Request types sent from Sandbox to Host\n */\nexport type IPCRequest =\n  | {\n      type: \"getModelConfig\";\n      id: string;\n      payload: { name?: string };\n    }\n  | {\n      type: \"listModels\";\n      id: string;\n      payload: Record<string, never>;\n    }\n  | {\n      type: \"log\";\n      id: string;\n      payload: { level: \"info\" | \"warn\" | \"error\"; message: string };\n    }\n  | {\n      type: \"prompt:input\";\n      id: string;\n      payload: {\n        prompt: string;\n        defaultValue?: string;\n        placeholder?: string;\n        maxLength?: number;\n      };\n    }\n  | {\n      type: \"prompt:select\";\n      id: string;\n      payload: {\n        prompt: string;\n        options: Array<{\n          name: string;\n          description?: string;\n          value: string;\n        }>;\n      };\n    }\n  | {\n      type: \"prompt:confirm\";\n      id: string;\n      payload: {\n        message: string;\n        defaultValue?: boolean;\n      };\n    }\n  | {\n      type: \"prompt:multiselect\";\n      id: string;\n      payload: {\n        prompt: string;\n        options: Array<{\n          name: string;\n          description?: string;\n          value: string;\n        }>;\n        required?: boolean;\n      };\n    }\n  | {\n      type: \"prompt:form\";\n      id: string;\n      payload: {\n        title?: string;\n        fields: Array<{\n          name: string;\n          label: string;\n          type: \"string\" | \"number\" | \"boolean\" | \"enum\";\n          required?: boolean;\n          defaultValue?: unknown;\n          description?: string;\n          enumValues?: string[];\n        }>;\n      };\n    };\n\n/**\n * Response types sent from Host to Sandbox\n */\nexport type IPCResponse<T = unknown> =\n  | {\n      type: \"response\";\n      id: string;\n      success: true;\n      data: T;\n    }\n  | {\n      type: \"response\";\n      id: string;\n      success: false;\n      error: string;\n    };\n\n/**\n * Model info response (without sensitive data)\n */\nexport interface ModelInfoResponse {\n  name: string;\n  provider: string;\n  model?: string;\n  isCurrent: boolean;\n}\n\n/**\n * Model config response (with sensitive data like API keys)\n */\nexport interface ModelConfigResponse extends ModelConfig {\n  provider: string;\n  model?: string;\n  apiKey?: string;\n  baseURL?: string;\n}\n\n/**\n * Message sent from Sandbox to Host when execution completes\n */\nexport interface ExecutionCompleteMessage {\n  type: \"complete\";\n  success: boolean;\n  result?: unknown;\n  error?: string;\n}\n\n/**\n * Type guard for IPC messages\n */\nexport function isIPCRequest(msg: unknown): msg is IPCRequest {\n  return (\n    typeof msg === \"object\" &&\n    msg !== null &&\n    \"type\" in msg &&\n    \"id\" in msg &&\n    typeof msg.id === \"string\"\n  );\n}\n\nexport function isIPCResponse(msg: unknown): msg is IPCResponse {\n  return (\n    typeof msg === \"object\" &&\n    msg !== null &&\n    \"type\" in msg &&\n    msg.type === \"response\" &&\n    \"id\" in msg &&\n    typeof msg.id === \"string\"\n  );\n}\n\nexport function isSandboxInitMessage(msg: unknown): msg is SandboxInitMessage {\n  return (\n    typeof msg === \"object\" &&\n    msg !== null &&\n    \"type\" in msg &&\n    msg.type === \"init\"\n  );\n}\n\nexport function isExecutionCompleteMessage(\n  msg: unknown,\n): msg is ExecutionCompleteMessage {\n  return (\n    typeof msg === \"object\" &&\n    msg !== null &&\n    \"type\" in msg &&\n    msg.type === \"complete\"\n  );\n}\n","import type { ModelConfigResponse } from \"../shared/ipc-protocol\";\nimport type { ModelConfig, ModelInfo, ModelsContext } from \"../types\";\nimport { sendIPCRequest } from \"./executor\";\n\n/**\n * Create sandboxed models context that communicates with host via IPC\n * This context is injected into user tools running in the sandbox\n * All API key access is controlled by the host process\n */\nexport function createSandboxedModelsContext(): ModelsContext {\n  return {\n    /**\n     * List available models (no permission required)\n     */\n    list(): ModelInfo[] {\n      throw new Error(\n        \"Synchronous list() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get current model info (no permission required)\n     */\n    getCurrent(): ModelInfo | null {\n      throw new Error(\n        \"Synchronous getCurrent() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get model info by name (no permission required)\n     */\n    get(_name: string): ModelInfo | null {\n      throw new Error(\n        \"Synchronous get() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get model config with API key (requires permission, enforced by host)\n     */\n    async getConfigAsync(name?: string): Promise<ModelConfig | null> {\n      try {\n        const response = await sendIPCRequest<ModelConfigResponse | null>(\n          \"getModelConfig\",\n          { name },\n        );\n\n        if (!response) {\n          return null;\n        }\n\n        return {\n          provider: response.provider,\n          model: response.model,\n          apiKey: response.apiKey,\n          baseURL: response.baseURL,\n        };\n      } catch (error) {\n        // Re-throw with clear error message\n        const message =\n          error instanceof Error ? error.message : \"Failed to get model config\";\n        throw new Error(`Permission denied: ${message}`);\n      }\n    },\n  };\n}\n\n/**\n * Get the sandboxed context from global scope\n * This is injected by the executor before loading user scripts\n */\nexport function getSandboxedContext(): {\n  modelsContext: ModelsContext;\n} {\n  const globalWithContext = global as {\n    __KLY_SANDBOXED_CONTEXT__?: {\n      modelsContext: ModelsContext;\n    };\n  };\n\n  if (!globalWithContext.__KLY_SANDBOXED_CONTEXT__) {\n    throw new Error(\n      \"Sandboxed context not available. This should only be called from within the sandbox.\",\n    );\n  }\n\n  return globalWithContext.__KLY_SANDBOXED_CONTEXT__;\n}\n","#!/usr/bin/env bun\n\n/**\n * Sandbox Executor - Entry point for sandboxed child process\n * This file runs inside the sandbox and:\n * 1. Receives initialization message from host via IPC\n * 2. Loads and executes the user's script\n * 3. Provides sandboxed context to the script\n * 4. Sends execution results back to host\n */\n\nimport { TIMEOUTS } from \"../shared/constants\";\nimport type {\n  ExecutionCompleteMessage,\n  IPCResponse,\n  SandboxInitMessage,\n} from \"../shared/ipc-protocol\";\nimport { isIPCResponse, isSandboxInitMessage } from \"../shared/ipc-protocol\";\nimport { createSandboxedModelsContext } from \"./sandboxed-context\";\n\n/**\n * Global state for the sandbox\n */\nlet initMessage: SandboxInitMessage | null = null;\nconst pendingIPCResponses = new Map<\n  string,\n  {\n    resolve: (value: IPCResponse) => void;\n    reject: (error: Error) => void;\n  }\n>();\n\n/**\n * Set up IPC communication\n */\nfunction setupIPC() {\n  if (!process.send) {\n    throw new Error(\"IPC channel not available\");\n  }\n\n  process.on(\"message\", (message: unknown) => {\n    // Handle init message\n    if (isSandboxInitMessage(message)) {\n      initMessage = message;\n      // Start execution once we receive init\n      executeUserScript().catch((error) => {\n        sendExecutionComplete(false, undefined, error.message);\n        process.exit(1);\n      });\n      return;\n    }\n\n    // Handle IPC responses\n    if (isIPCResponse(message)) {\n      const pending = pendingIPCResponses.get(message.id);\n      if (pending) {\n        pendingIPCResponses.delete(message.id);\n        pending.resolve(message);\n      }\n      return;\n    }\n  });\n}\n\n/**\n * Send IPC request to host and wait for response\n */\nexport function sendIPCRequest<T>(type: string, payload: unknown): Promise<T> {\n  return new Promise((resolve, reject) => {\n    if (!process.send) {\n      reject(new Error(\"IPC channel not available\"));\n      return;\n    }\n\n    const id = `${type}-${Date.now()}-${Math.random()}`;\n    const request = { type, id, payload };\n\n    // Store pending promise\n    pendingIPCResponses.set(id, {\n      resolve: (response: IPCResponse) => {\n        if (response.success) {\n          resolve(response.data as T);\n        } else {\n          reject(new Error(response.error));\n        }\n      },\n      reject,\n    });\n\n    // Send request\n    process.send(request);\n\n    // Timeout for standard IPC requests\n    setTimeout(() => {\n      const pending = pendingIPCResponses.get(id);\n      if (pending) {\n        pendingIPCResponses.delete(id);\n        pending.reject(new Error(\"IPC request timeout\"));\n      }\n    }, TIMEOUTS.IPC_REQUEST);\n  });\n}\n\n/**\n * Execute the user's script\n */\nasync function executeUserScript(): Promise<void> {\n  if (!initMessage) {\n    throw new Error(\"No initialization message received\");\n  }\n\n  const { scriptPath, args } = initMessage;\n\n  try {\n    // Set environment for the script\n    process.argv = [\"bun\", scriptPath, ...args];\n    process.env.KLY_SANDBOX_MODE = \"true\";\n\n    // Inject sandboxed context into global scope\n    // This allows defineApp to access the sandboxed context\n    (\n      global as { __KLY_SANDBOXED_CONTEXT__?: unknown }\n    ).__KLY_SANDBOXED_CONTEXT__ = {\n      modelsContext: createSandboxedModelsContext(),\n    };\n\n    // Import and execute the user's script\n    // The script should use defineApp which will auto-execute in CLI mode\n    await import(scriptPath);\n\n    // If we reach here without error, execution succeeded\n    sendExecutionComplete(true);\n  } catch (error) {\n    const errorMessage = error instanceof Error ? error.message : String(error);\n    sendExecutionComplete(false, undefined, errorMessage);\n    throw error;\n  }\n}\n\n/**\n * Send execution complete message to host\n */\nfunction sendExecutionComplete(\n  success: boolean,\n  result?: unknown,\n  error?: string,\n): void {\n  if (!process.send) {\n    return;\n  }\n\n  const message: ExecutionCompleteMessage = {\n    type: \"complete\",\n    success,\n    result,\n    error,\n  };\n\n  process.send(message);\n}\n\n/**\n * Main entry point\n */\nfunction main() {\n  // Ensure we're in sandbox mode\n  if (process.env.KLY_SANDBOX_MODE !== \"true\") {\n    console.error(\"Error: This script must be run in sandbox mode\");\n    process.exit(1);\n  }\n\n  // Setup IPC\n  setupIPC();\n\n  // Wait for init message (handled by IPC listener)\n}\n\n// Start the executor\nmain();\n"],"mappings":";;;;;AA8BA,MAAa,WAAW;CAEtB,aAAa;CAEb,kBAAkB;CACnB;;;;ACyHD,SAAgB,cAAc,KAAkC;AAC9D,QACE,OAAO,QAAQ,YACf,QAAQ,QACR,UAAU,OACV,IAAI,SAAS,cACb,QAAQ,OACR,OAAO,IAAI,OAAO;;AAItB,SAAgB,qBAAqB,KAAyC;AAC5E,QACE,OAAO,QAAQ,YACf,QAAQ,QACR,UAAU,OACV,IAAI,SAAS;;;;;;;;;;ACnKjB,SAAgB,+BAA8C;AAC5D,QAAO;EAIL,OAAoB;AAClB,SAAM,IAAI,MACR,6FACD;;EAMH,aAA+B;AAC7B,SAAM,IAAI,MACR,mGACD;;EAMH,IAAI,OAAiC;AACnC,SAAM,IAAI,MACR,4FACD;;EAMH,MAAM,eAAe,MAA4C;AAC/D,OAAI;IACF,MAAM,WAAW,MAAM,eACrB,kBACA,EAAE,MAAM,CACT;AAED,QAAI,CAAC,SACH,QAAO;AAGT,WAAO;KACL,UAAU,SAAS;KACnB,OAAO,SAAS;KAChB,QAAQ,SAAS;KACjB,SAAS,SAAS;KACnB;YACM,OAAO;IAEd,MAAM,UACJ,iBAAiB,QAAQ,MAAM,UAAU;AAC3C,UAAM,IAAI,MAAM,sBAAsB,UAAU;;;EAGrD;;;;;;;;;;;;;;;;AC1CH,IAAIA,cAAyC;AAC7C,MAAM,sCAAsB,IAAI,KAM7B;;;;AAKH,SAAS,WAAW;AAClB,KAAI,CAAC,QAAQ,KACX,OAAM,IAAI,MAAM,4BAA4B;AAG9C,SAAQ,GAAG,YAAY,YAAqB;AAE1C,MAAI,qBAAqB,QAAQ,EAAE;AACjC,iBAAc;AAEd,sBAAmB,CAAC,OAAO,UAAU;AACnC,0BAAsB,OAAO,QAAW,MAAM,QAAQ;AACtD,YAAQ,KAAK,EAAE;KACf;AACF;;AAIF,MAAI,cAAc,QAAQ,EAAE;GAC1B,MAAM,UAAU,oBAAoB,IAAI,QAAQ,GAAG;AACnD,OAAI,SAAS;AACX,wBAAoB,OAAO,QAAQ,GAAG;AACtC,YAAQ,QAAQ,QAAQ;;AAE1B;;GAEF;;;;;AAMJ,SAAgB,eAAkB,MAAc,SAA8B;AAC5E,QAAO,IAAI,SAAS,SAAS,WAAW;AACtC,MAAI,CAAC,QAAQ,MAAM;AACjB,0BAAO,IAAI,MAAM,4BAA4B,CAAC;AAC9C;;EAGF,MAAM,KAAK,GAAG,KAAK,GAAG,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ;EACjD,MAAM,UAAU;GAAE;GAAM;GAAI;GAAS;AAGrC,sBAAoB,IAAI,IAAI;GAC1B,UAAU,aAA0B;AAClC,QAAI,SAAS,QACX,SAAQ,SAAS,KAAU;QAE3B,QAAO,IAAI,MAAM,SAAS,MAAM,CAAC;;GAGrC;GACD,CAAC;AAGF,UAAQ,KAAK,QAAQ;AAGrB,mBAAiB;GACf,MAAM,UAAU,oBAAoB,IAAI,GAAG;AAC3C,OAAI,SAAS;AACX,wBAAoB,OAAO,GAAG;AAC9B,YAAQ,uBAAO,IAAI,MAAM,sBAAsB,CAAC;;KAEjD,SAAS,YAAY;GACxB;;;;;AAMJ,eAAe,oBAAmC;AAChD,KAAI,CAAC,YACH,OAAM,IAAI,MAAM,qCAAqC;CAGvD,MAAM,EAAE,YAAY,SAAS;AAE7B,KAAI;AAEF,UAAQ,OAAO;GAAC;GAAO;GAAY,GAAG;GAAK;AAC3C,UAAQ,IAAI,mBAAmB;AAI/B,EACE,OACA,4BAA4B,EAC5B,eAAe,8BAA8B,EAC9C;AAID,QAAM,OAAO;AAGb,wBAAsB,KAAK;UACpB,OAAO;AAEd,wBAAsB,OAAO,QADR,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM,CACtB;AACrD,QAAM;;;;;;AAOV,SAAS,sBACP,SACA,QACA,OACM;AACN,KAAI,CAAC,QAAQ,KACX;CAGF,MAAMC,UAAoC;EACxC,MAAM;EACN;EACA;EACA;EACD;AAED,SAAQ,KAAK,QAAQ;;;;;AAMvB,SAAS,OAAO;AAEd,KAAI,QAAQ,IAAI,qBAAqB,QAAQ;AAC3C,UAAQ,MAAM,iDAAiD;AAC/D,UAAQ,KAAK,EAAE;;AAIjB,WAAU;;AAMZ,MAAM"}

package/dist/sandbox/ipc-client.mjs

@@ -0,0 +1,40 @@
+import { TIMEOUTS } from "../shared/constants.mjs";
+
+//#region src/sandbox/ipc-client.ts
+/**
+* Send an IPC request to the host and wait for response
+* Used by UI components and other sandbox code to communicate with the host process
+*/
+async function sendIPCRequest(type, payload) {
+	if (!process.send) throw new Error("IPC not available - not running in sandbox mode");
+	return new Promise((resolve, reject) => {
+		const requestId = `${type}-${Date.now()}-${Math.random()}`;
+		const request = {
+			type,
+			id: requestId,
+			payload
+		};
+		const responseHandler = (message) => {
+			if (typeof message === "object" && message !== null && "type" in message && message.type === "response" && "id" in message && message.id === requestId) {
+				process.off("message", responseHandler);
+				const response = message;
+				if (response.success) resolve(response.data);
+				else reject(new Error(response.error));
+			}
+		};
+		process.on("message", responseHandler);
+		if (!process.send(request)) {
+			process.off("message", responseHandler);
+			reject(/* @__PURE__ */ new Error("Failed to send IPC message"));
+			return;
+		}
+		setTimeout(() => {
+			process.off("message", responseHandler);
+			reject(/* @__PURE__ */ new Error(`IPC request timeout: ${type}`));
+		}, TIMEOUTS.IPC_LONG_REQUEST);
+	});
+}
+
+//#endregion
+export { sendIPCRequest };
+//# sourceMappingURL=ipc-client.mjs.map

package/dist/sandbox/ipc-client.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ipc-client.mjs","names":["request: IPCRequest"],"sources":["../../src/sandbox/ipc-client.ts"],"sourcesContent":["import { TIMEOUTS } from \"../shared/constants\";\nimport type { IPCRequest, IPCResponse } from \"../shared/ipc-protocol\";\n\n/**\n * Send an IPC request to the host and wait for response\n * Used by UI components and other sandbox code to communicate with the host process\n */\nexport async function sendIPCRequest<T>(\n  type: IPCRequest[\"type\"],\n  payload: unknown,\n): Promise<T> {\n  if (!process.send) {\n    throw new Error(\"IPC not available - not running in sandbox mode\");\n  }\n\n  return new Promise((resolve, reject) => {\n    const requestId = `${type}-${Date.now()}-${Math.random()}`;\n\n    const request: IPCRequest = {\n      type,\n      id: requestId,\n      payload,\n    } as IPCRequest;\n\n    // Set up response listener\n    const responseHandler = (message: unknown) => {\n      if (\n        typeof message === \"object\" &&\n        message !== null &&\n        \"type\" in message &&\n        message.type === \"response\" &&\n        \"id\" in message &&\n        message.id === requestId\n      ) {\n        process.off(\"message\", responseHandler);\n\n        const response = message as IPCResponse<T>;\n        if (response.success) {\n          resolve(response.data);\n        } else {\n          reject(new Error(response.error));\n        }\n      }\n    };\n\n    process.on(\"message\", responseHandler);\n\n    // Send request\n    if (!process.send!(request)) {\n      // Send failed immediately\n      process.off(\"message\", responseHandler);\n      reject(new Error(\"Failed to send IPC message\"));\n      return;\n    }\n\n    // Timeout for long-running requests (prompts, etc.)\n    setTimeout(() => {\n      process.off(\"message\", responseHandler);\n      reject(new Error(`IPC request timeout: ${type}`));\n    }, TIMEOUTS.IPC_LONG_REQUEST);\n  });\n}\n"],"mappings":";;;;;;;AAOA,eAAsB,eACpB,MACA,SACY;AACZ,KAAI,CAAC,QAAQ,KACX,OAAM,IAAI,MAAM,kDAAkD;AAGpE,QAAO,IAAI,SAAS,SAAS,WAAW;EACtC,MAAM,YAAY,GAAG,KAAK,GAAG,KAAK,KAAK,CAAC,GAAG,KAAK,QAAQ;EAExD,MAAMA,UAAsB;GAC1B;GACA,IAAI;GACJ;GACD;EAGD,MAAM,mBAAmB,YAAqB;AAC5C,OACE,OAAO,YAAY,YACnB,YAAY,QACZ,UAAU,WACV,QAAQ,SAAS,cACjB,QAAQ,WACR,QAAQ,OAAO,WACf;AACA,YAAQ,IAAI,WAAW,gBAAgB;IAEvC,MAAM,WAAW;AACjB,QAAI,SAAS,QACX,SAAQ,SAAS,KAAK;QAEtB,QAAO,IAAI,MAAM,SAAS,MAAM,CAAC;;;AAKvC,UAAQ,GAAG,WAAW,gBAAgB;AAGtC,MAAI,CAAC,QAAQ,KAAM,QAAQ,EAAE;AAE3B,WAAQ,IAAI,WAAW,gBAAgB;AACvC,0BAAO,IAAI,MAAM,6BAA6B,CAAC;AAC/C;;AAIF,mBAAiB;AACf,WAAQ,IAAI,WAAW,gBAAgB;AACvC,0BAAO,IAAI,MAAM,wBAAwB,OAAO,CAAC;KAChD,SAAS,iBAAiB;GAC7B"}

package/dist/sandbox/sandboxed-context.mjs

@@ -0,0 +1,14 @@
+//#region src/sandbox/sandboxed-context.ts
+/**
+* Get the sandboxed context from global scope
+* This is injected by the executor before loading user scripts
+*/
+function getSandboxedContext() {
+	const globalWithContext = global;
+	if (!globalWithContext.__KLY_SANDBOXED_CONTEXT__) throw new Error("Sandboxed context not available. This should only be called from within the sandbox.");
+	return globalWithContext.__KLY_SANDBOXED_CONTEXT__;
+}
+
+//#endregion
+export { getSandboxedContext };
+//# sourceMappingURL=sandboxed-context.mjs.map

package/dist/sandbox/sandboxed-context.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sandboxed-context.mjs","names":[],"sources":["../../src/sandbox/sandboxed-context.ts"],"sourcesContent":["import type { ModelConfigResponse } from \"../shared/ipc-protocol\";\nimport type { ModelConfig, ModelInfo, ModelsContext } from \"../types\";\nimport { sendIPCRequest } from \"./executor\";\n\n/**\n * Create sandboxed models context that communicates with host via IPC\n * This context is injected into user tools running in the sandbox\n * All API key access is controlled by the host process\n */\nexport function createSandboxedModelsContext(): ModelsContext {\n  return {\n    /**\n     * List available models (no permission required)\n     */\n    list(): ModelInfo[] {\n      throw new Error(\n        \"Synchronous list() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get current model info (no permission required)\n     */\n    getCurrent(): ModelInfo | null {\n      throw new Error(\n        \"Synchronous getCurrent() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get model info by name (no permission required)\n     */\n    get(_name: string): ModelInfo | null {\n      throw new Error(\n        \"Synchronous get() not supported in sandbox. Use async methods or move this logic to host.\",\n      );\n    },\n\n    /**\n     * Get model config with API key (requires permission, enforced by host)\n     */\n    async getConfigAsync(name?: string): Promise<ModelConfig | null> {\n      try {\n        const response = await sendIPCRequest<ModelConfigResponse | null>(\n          \"getModelConfig\",\n          { name },\n        );\n\n        if (!response) {\n          return null;\n        }\n\n        return {\n          provider: response.provider,\n          model: response.model,\n          apiKey: response.apiKey,\n          baseURL: response.baseURL,\n        };\n      } catch (error) {\n        // Re-throw with clear error message\n        const message =\n          error instanceof Error ? error.message : \"Failed to get model config\";\n        throw new Error(`Permission denied: ${message}`);\n      }\n    },\n  };\n}\n\n/**\n * Get the sandboxed context from global scope\n * This is injected by the executor before loading user scripts\n */\nexport function getSandboxedContext(): {\n  modelsContext: ModelsContext;\n} {\n  const globalWithContext = global as {\n    __KLY_SANDBOXED_CONTEXT__?: {\n      modelsContext: ModelsContext;\n    };\n  };\n\n  if (!globalWithContext.__KLY_SANDBOXED_CONTEXT__) {\n    throw new Error(\n      \"Sandboxed context not available. This should only be called from within the sandbox.\",\n    );\n  }\n\n  return globalWithContext.__KLY_SANDBOXED_CONTEXT__;\n}\n"],"mappings":";;;;;AAwEA,SAAgB,sBAEd;CACA,MAAM,oBAAoB;AAM1B,KAAI,CAAC,kBAAkB,0BACrB,OAAM,IAAI,MACR,uFACD;AAGH,QAAO,kBAAkB"}

package/dist/shared/constants.mjs

@@ -0,0 +1,36 @@
+//#region src/shared/constants.ts
+/**
+* Centralized constants for the KLY project
+* Prevents magic strings and improves maintainability
+*/
+/**
+* Environment variable names used throughout the application
+*/
+const ENV_VARS = {
+	SANDBOX_MODE: "KLY_SANDBOX_MODE",
+	MCP_MODE: "KLY_MCP_MODE",
+	PROGRAMMATIC: "KLY_PROGRAMMATIC",
+	TRUST_ALL: "KLY_TRUST_ALL",
+	LOCAL_REF: "KLY_LOCAL_REF",
+	REMOTE_REF: "KLY_REMOTE_REF"
+};
+/**
+* File and directory paths used for configuration and caching
+*/
+const PATHS = {
+	CONFIG_DIR: ".kly",
+	META_FILE: ".kly-meta.json",
+	PERMISSIONS_FILE: "permissions.json",
+	CONFIG_FILE: "config.json"
+};
+/**
+* Timeout values in milliseconds
+*/
+const TIMEOUTS = {
+	IPC_REQUEST: 3e4,
+	IPC_LONG_REQUEST: 6e4
+};
+
+//#endregion
+export { ENV_VARS, PATHS, TIMEOUTS };
+//# sourceMappingURL=constants.mjs.map

package/dist/shared/constants.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"constants.mjs","names":[],"sources":["../../src/shared/constants.ts"],"sourcesContent":["/**\n * Centralized constants for the KLY project\n * Prevents magic strings and improves maintainability\n */\n\n/**\n * Environment variable names used throughout the application\n */\nexport const ENV_VARS = {\n  SANDBOX_MODE: \"KLY_SANDBOX_MODE\",\n  MCP_MODE: \"KLY_MCP_MODE\",\n  PROGRAMMATIC: \"KLY_PROGRAMMATIC\",\n  TRUST_ALL: \"KLY_TRUST_ALL\",\n  LOCAL_REF: \"KLY_LOCAL_REF\",\n  REMOTE_REF: \"KLY_REMOTE_REF\",\n} as const;\n\n/**\n * File and directory paths used for configuration and caching\n */\nexport const PATHS = {\n  CONFIG_DIR: \".kly\",\n  META_FILE: \".kly-meta.json\",\n  PERMISSIONS_FILE: \"permissions.json\",\n  CONFIG_FILE: \"config.json\",\n} as const;\n\n/**\n * Timeout values in milliseconds\n */\nexport const TIMEOUTS = {\n  /** Standard IPC request timeout (30 seconds) */\n  IPC_REQUEST: 30_000,\n  /** Long-running IPC request timeout (60 seconds) */\n  IPC_LONG_REQUEST: 60_000,\n} as const;\n\n/**\n * LLM API domains for network permission configuration\n */\nexport const LLM_API_DOMAINS = [\n  \"api.openai.com\",\n  \"*.anthropic.com\",\n  \"generativelanguage.googleapis.com\",\n  \"api.deepseek.com\",\n] as const;\n"],"mappings":";;;;;;;;AAQA,MAAa,WAAW;CACtB,cAAc;CACd,UAAU;CACV,cAAc;CACd,WAAW;CACX,WAAW;CACX,YAAY;CACb;;;;AAKD,MAAa,QAAQ;CACnB,YAAY;CACZ,WAAW;CACX,kBAAkB;CAClB,aAAa;CACd;;;;AAKD,MAAa,WAAW;CAEtB,aAAa;CAEb,kBAAkB;CACnB"}