kly 0.3.0 → 0.3.1

package/README.md

@@ -2,8 +2,20 @@
 
 [![NPM version](https://img.shields.io/npm/v/kly?color=a1b858&label=)](https://www.npmjs.com/package/kly)
 
-```ts
-const a = 1
+A CLI framework with sandbox isolation and MCP support.
+
+## Install
+
+```bash
+bun install -g kly
+```
+
+## Usage
+
+```bash
+kly run ./app.ts        # Run local app
+kly run user/repo       # Run remote app
+kly mcp ./app.ts        # Run as MCP server
 ```
 
 ## License

package/dist/ai/context.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"context.mjs","names":[],"sources":["../../src/ai/context.ts"],"sourcesContent":["import { checkApiKeyPermission, getAppIdentifier } from \"../permissions\";\nimport type { ModelConfig, ModelInfo, ModelsContext } from \"../types\";\nimport { getCurrentModelConfig, listModels } from \"./storage\";\n\n/**\n * Create models context for ExecuteContext\n * Provides access to configured LLM models and their credentials (with permission checks)\n */\nexport function createModelsContext(): ModelsContext {\n  // Track if permission has been checked in this process\n  let permissionChecked = false;\n  let permissionGranted = false;\n\n  /**\n   * Check permission before allowing access to API keys\n   */\n  async function ensurePermission(): Promise<void> {\n    if (permissionChecked) {\n      if (!permissionGranted) {\n        throw new Error(\n          \"Permission denied: This app does not have permission to access API keys.\",\n        );\n      }\n      return;\n    }\n\n    const appId = getAppIdentifier();\n    permissionGranted = await checkApiKeyPermission(appId);\n    permissionChecked = true;\n\n    if (!permissionGranted) {\n      throw new Error(\n        \"Permission denied: This app does not have permission to access API keys.\",\n      );\n    }\n  }\n\n  return {\n    list(): ModelInfo[] {\n      return listModels().map((m) => ({\n        name: m.name,\n        provider: m.config.provider,\n        model: m.config.model,\n        isCurrent: m.isCurrent,\n      }));\n    },\n\n    getCurrent(): ModelInfo | null {\n      const models = listModels();\n      const current = models.find((m) => m.isCurrent);\n      if (!current) return null;\n\n      return {\n        name: current.name,\n        provider: current.config.provider,\n        model: current.config.model,\n        isCurrent: true,\n      };\n    },\n\n    get(name: string): ModelInfo | null {\n      const models = listModels();\n      const found = models.find((m) => m.name === name);\n      if (!found) return null;\n\n      return {\n        name: found.name,\n        provider: found.config.provider,\n        model: found.config.model,\n        isCurrent: found.isCurrent,\n      };\n    },\n\n    async getConfigAsync(name?: string): Promise<ModelConfig | null> {\n      // Check permission first\n      await ensurePermission();\n\n      if (name) {\n        const models = listModels();\n        const found = models.find((m) => m.name === name);\n        if (!found) return null;\n\n        return {\n          provider: found.config.provider,\n          model: found.config.model,\n          apiKey: found.config.apiKey,\n          baseURL: found.config.baseURL,\n        };\n      }\n\n      const current = getCurrentModelConfig();\n      if (!current) return null;\n\n      return {\n        provider: current.provider,\n        model: current.model,\n        apiKey: current.apiKey,\n        baseURL: current.baseURL,\n      };\n    },\n  };\n}\n"],"mappings":";;;;;;;;AAQA,SAAgB,sBAAqC;CAEnD,IAAI,oBAAoB;CACxB,IAAI,oBAAoB;;;;CAKxB,eAAe,mBAAkC;AAC/C,MAAI,mBAAmB;AACrB,OAAI,CAAC,kBACH,OAAM,IAAI,MACR,2EACD;AAEH;;AAIF,sBAAoB,MAAM,sBADZ,kBAAkB,CACsB;AACtD,sBAAoB;AAEpB,MAAI,CAAC,kBACH,OAAM,IAAI,MACR,2EACD;;AAIL,QAAO;EACL,OAAoB;AAClB,UAAO,YAAY,CAAC,KAAK,OAAO;IAC9B,MAAM,EAAE;IACR,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE;IACd,EAAE;;EAGL,aAA+B;GAE7B,MAAM,UADS,YAAY,CACJ,MAAM,MAAM,EAAE,UAAU;AAC/C,OAAI,CAAC,QAAS,QAAO;AAErB,UAAO;IACL,MAAM,QAAQ;IACd,UAAU,QAAQ,OAAO;IACzB,OAAO,QAAQ,OAAO;IACtB,WAAW;IACZ;;EAGH,IAAI,MAAgC;GAElC,MAAM,QADS,YAAY,CACN,MAAM,MAAM,EAAE,SAAS,KAAK;AACjD,OAAI,CAAC,MAAO,QAAO;AAEnB,UAAO;IACL,MAAM,MAAM;IACZ,UAAU,MAAM,OAAO;IACvB,OAAO,MAAM,OAAO;IACpB,WAAW,MAAM;IAClB;;EAGH,MAAM,eAAe,MAA4C;AAE/D,SAAM,kBAAkB;AAExB,OAAI,MAAM;IAER,MAAM,QADS,YAAY,CACN,MAAM,MAAM,EAAE,SAAS,KAAK;AACjD,QAAI,CAAC,MAAO,QAAO;AAEnB,WAAO;KACL,UAAU,MAAM,OAAO;KACvB,OAAO,MAAM,OAAO;KACpB,QAAQ,MAAM,OAAO;KACrB,SAAS,MAAM,OAAO;KACvB;;GAGH,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,QAAS,QAAO;AAErB,UAAO;IACL,UAAU,QAAQ;IAClB,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IAClB;;EAEJ"}
+{"version":3,"file":"context.mjs","names":[],"sources":["../../src/ai/context.ts"],"sourcesContent":["import { checkApiKeyPermission, getAppIdentifier } from \"../permissions\";\nimport type { ModelConfig, ModelInfo, ModelsContext } from \"../types\";\nimport { getCurrentModelConfig, listModels } from \"./storage\";\n\n/**\n * Create models context for ExecuteContext\n * Provides access to configured LLM models and their credentials (with permission checks)\n */\nexport function createModelsContext(): ModelsContext {\n  // Track if permission has been checked in this process\n  let permissionChecked = false;\n  let permissionGranted = false;\n\n  /**\n   * Check permission before allowing access to API keys\n   */\n  async function ensurePermission(): Promise<void> {\n    if (permissionChecked) {\n      if (!permissionGranted) {\n        throw new Error(\"Permission denied: This app does not have permission to access API keys.\");\n      }\n      return;\n    }\n\n    const appId = getAppIdentifier();\n    permissionGranted = await checkApiKeyPermission(appId);\n    permissionChecked = true;\n\n    if (!permissionGranted) {\n      throw new Error(\"Permission denied: This app does not have permission to access API keys.\");\n    }\n  }\n\n  return {\n    list(): ModelInfo[] {\n      return listModels().map((m) => ({\n        name: m.name,\n        provider: m.config.provider,\n        model: m.config.model,\n        isCurrent: m.isCurrent,\n      }));\n    },\n\n    getCurrent(): ModelInfo | null {\n      const models = listModels();\n      const current = models.find((m) => m.isCurrent);\n      if (!current) return null;\n\n      return {\n        name: current.name,\n        provider: current.config.provider,\n        model: current.config.model,\n        isCurrent: true,\n      };\n    },\n\n    get(name: string): ModelInfo | null {\n      const models = listModels();\n      const found = models.find((m) => m.name === name);\n      if (!found) return null;\n\n      return {\n        name: found.name,\n        provider: found.config.provider,\n        model: found.config.model,\n        isCurrent: found.isCurrent,\n      };\n    },\n\n    async getConfigAsync(name?: string): Promise<ModelConfig | null> {\n      // Check permission first\n      await ensurePermission();\n\n      if (name) {\n        const models = listModels();\n        const found = models.find((m) => m.name === name);\n        if (!found) return null;\n\n        return {\n          provider: found.config.provider,\n          model: found.config.model,\n          apiKey: found.config.apiKey,\n          baseURL: found.config.baseURL,\n        };\n      }\n\n      const current = getCurrentModelConfig();\n      if (!current) return null;\n\n      return {\n        provider: current.provider,\n        model: current.model,\n        apiKey: current.apiKey,\n        baseURL: current.baseURL,\n      };\n    },\n  };\n}\n"],"mappings":";;;;;;;;AAQA,SAAgB,sBAAqC;CAEnD,IAAI,oBAAoB;CACxB,IAAI,oBAAoB;;;;CAKxB,eAAe,mBAAkC;AAC/C,MAAI,mBAAmB;AACrB,OAAI,CAAC,kBACH,OAAM,IAAI,MAAM,2EAA2E;AAE7F;;AAIF,sBAAoB,MAAM,sBADZ,kBAAkB,CACsB;AACtD,sBAAoB;AAEpB,MAAI,CAAC,kBACH,OAAM,IAAI,MAAM,2EAA2E;;AAI/F,QAAO;EACL,OAAoB;AAClB,UAAO,YAAY,CAAC,KAAK,OAAO;IAC9B,MAAM,EAAE;IACR,UAAU,EAAE,OAAO;IACnB,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE;IACd,EAAE;;EAGL,aAA+B;GAE7B,MAAM,UADS,YAAY,CACJ,MAAM,MAAM,EAAE,UAAU;AAC/C,OAAI,CAAC,QAAS,QAAO;AAErB,UAAO;IACL,MAAM,QAAQ;IACd,UAAU,QAAQ,OAAO;IACzB,OAAO,QAAQ,OAAO;IACtB,WAAW;IACZ;;EAGH,IAAI,MAAgC;GAElC,MAAM,QADS,YAAY,CACN,MAAM,MAAM,EAAE,SAAS,KAAK;AACjD,OAAI,CAAC,MAAO,QAAO;AAEnB,UAAO;IACL,MAAM,MAAM;IACZ,UAAU,MAAM,OAAO;IACvB,OAAO,MAAM,OAAO;IACpB,WAAW,MAAM;IAClB;;EAGH,MAAM,eAAe,MAA4C;AAE/D,SAAM,kBAAkB;AAExB,OAAI,MAAM;IAER,MAAM,QADS,YAAY,CACN,MAAM,MAAM,EAAE,SAAS,KAAK;AACjD,QAAI,CAAC,MAAO,QAAO;AAEnB,WAAO;KACL,UAAU,MAAM,OAAO;KACvB,OAAO,MAAM,OAAO;KACpB,QAAQ,MAAM,OAAO;KACrB,SAAS,MAAM,OAAO;KACvB;;GAGH,MAAM,UAAU,uBAAuB;AACvC,OAAI,CAAC,QAAS,QAAO;AAErB,UAAO;IACL,UAAU,QAAQ;IAClB,OAAO,QAAQ;IACf,QAAQ,QAAQ;IAChB,SAAS,QAAQ;IAClB;;EAEJ"}

package/dist/ai/storage.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"storage.mjs","names":[],"sources":["../../src/ai/storage.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { error } from \"../ui\";\nimport type { LLMConfig, LLMProvider } from \"./types\";\n\nconst CONFIG_DIR = join(homedir(), \".kly\");\nconst CONFIG_FILE = join(CONFIG_DIR, \"config.json\");\n\nexport interface KlyConfig {\n  currentModel?: string;\n  models: Record<string, LLMConfig>;\n}\n\n/**\n * Ensure config directory exists\n */\nfunction ensureConfigDir(): void {\n  if (!existsSync(CONFIG_DIR)) {\n    mkdirSync(CONFIG_DIR, { recursive: true });\n  }\n}\n\n/**\n * Load configuration from ~/.kly/config.json\n */\nexport function loadConfig(): KlyConfig {\n  ensureConfigDir();\n\n  if (!existsSync(CONFIG_FILE)) {\n    return { models: {} };\n  }\n\n  try {\n    const content = readFileSync(CONFIG_FILE, \"utf-8\");\n    return JSON.parse(content);\n  } catch (err) {\n    error(`Failed to parse config file: ${err}`);\n    return { models: {} };\n  }\n}\n\n/**\n * Save configuration to ~/.kly/config.json\n */\nexport function saveConfig(config: KlyConfig): void {\n  ensureConfigDir();\n  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), \"utf-8\");\n}\n\n/**\n * Get current active model configuration\n */\nexport function getCurrentModelConfig(): LLMConfig | null {\n  const config = loadConfig();\n\n  if (!config.currentModel) {\n    return null;\n  }\n\n  return config.models[config.currentModel] || null;\n}\n\n/**\n * Set a model as current\n */\nexport function setCurrentModel(modelName: string): void {\n  const config = loadConfig();\n\n  if (!config.models[modelName]) {\n    throw new Error(`Model '${modelName}' not found in config`);\n  }\n\n  config.currentModel = modelName;\n  saveConfig(config);\n}\n\n/**\n * Add or update a model configuration\n */\nexport function saveModelConfig(\n  modelName: string,\n  modelConfig: LLMConfig,\n): void {\n  const config = loadConfig();\n\n  config.models[modelName] = modelConfig;\n\n  // Set as current if it's the first model\n  if (!config.currentModel) {\n    config.currentModel = modelName;\n  }\n\n  saveConfig(config);\n}\n\n/**\n * Remove a model configuration\n */\nexport function removeModelConfig(modelName: string): void {\n  const config = loadConfig();\n\n  delete config.models[modelName];\n\n  // Clear current if it was removed\n  if (config.currentModel === modelName) {\n    config.currentModel = undefined;\n  }\n\n  saveConfig(config);\n}\n\n/**\n * List all configured models\n */\nexport function listModels(): Array<{\n  name: string;\n  config: LLMConfig;\n  isCurrent: boolean;\n}> {\n  const config = loadConfig();\n\n  return Object.entries(config.models).map(([name, modelConfig]) => ({\n    name,\n    config: modelConfig,\n    isCurrent: name === config.currentModel,\n  }));\n}\n\n/**\n * Get provider display name\n */\nexport function getProviderDisplayName(provider: LLMProvider): string {\n  const displayNames: Record<LLMProvider, string> = {\n    openai: \"OpenAI\",\n    anthropic: \"Anthropic\",\n    google: \"Google\",\n    deepseek: \"DeepSeek\",\n    ollama: \"Ollama\",\n    groq: \"Groq\",\n    mistral: \"Mistral\",\n    cohere: \"Cohere\",\n    \"openai-compatible\": \"OpenAI Compatible\",\n  };\n  return displayNames[provider];\n}\n"],"mappings":";;;;;;AAMA,MAAM,aAAa,KAAK,SAAS,EAAE,OAAO;AAC1C,MAAM,cAAc,KAAK,YAAY,cAAc;;;;AAUnD,SAAS,kBAAwB;AAC/B,KAAI,CAAC,WAAW,WAAW,CACzB,WAAU,YAAY,EAAE,WAAW,MAAM,CAAC;;;;;AAO9C,SAAgB,aAAwB;AACtC,kBAAiB;AAEjB,KAAI,CAAC,WAAW,YAAY,CAC1B,QAAO,EAAE,QAAQ,EAAE,EAAE;AAGvB,KAAI;EACF,MAAM,UAAU,aAAa,aAAa,QAAQ;AAClD,SAAO,KAAK,MAAM,QAAQ;UACnB,KAAK;AACZ,QAAM,gCAAgC,MAAM;AAC5C,SAAO,EAAE,QAAQ,EAAE,EAAE;;;;;;AAezB,SAAgB,wBAA0C;CACxD,MAAM,SAAS,YAAY;AAE3B,KAAI,CAAC,OAAO,aACV,QAAO;AAGT,QAAO,OAAO,OAAO,OAAO,iBAAiB;;;;;AAuD/C,SAAgB,aAIb;CACD,MAAM,SAAS,YAAY;AAE3B,QAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,kBAAkB;EACjE;EACA,QAAQ;EACR,WAAW,SAAS,OAAO;EAC5B,EAAE"}
+{"version":3,"file":"storage.mjs","names":[],"sources":["../../src/ai/storage.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { error } from \"../ui\";\nimport type { LLMConfig, LLMProvider } from \"./types\";\n\nconst CONFIG_DIR = join(homedir(), \".kly\");\nconst CONFIG_FILE = join(CONFIG_DIR, \"config.json\");\n\nexport interface KlyConfig {\n  currentModel?: string;\n  models: Record<string, LLMConfig>;\n}\n\n/**\n * Ensure config directory exists\n */\nfunction ensureConfigDir(): void {\n  if (!existsSync(CONFIG_DIR)) {\n    mkdirSync(CONFIG_DIR, { recursive: true });\n  }\n}\n\n/**\n * Load configuration from ~/.kly/config.json\n */\nexport function loadConfig(): KlyConfig {\n  ensureConfigDir();\n\n  if (!existsSync(CONFIG_FILE)) {\n    return { models: {} };\n  }\n\n  try {\n    const content = readFileSync(CONFIG_FILE, \"utf-8\");\n    return JSON.parse(content);\n  } catch (err) {\n    error(`Failed to parse config file: ${err}`);\n    return { models: {} };\n  }\n}\n\n/**\n * Save configuration to ~/.kly/config.json\n */\nexport function saveConfig(config: KlyConfig): void {\n  ensureConfigDir();\n  writeFileSync(CONFIG_FILE, JSON.stringify(config, null, 2), \"utf-8\");\n}\n\n/**\n * Get current active model configuration\n */\nexport function getCurrentModelConfig(): LLMConfig | null {\n  const config = loadConfig();\n\n  if (!config.currentModel) {\n    return null;\n  }\n\n  return config.models[config.currentModel] || null;\n}\n\n/**\n * Set a model as current\n */\nexport function setCurrentModel(modelName: string): void {\n  const config = loadConfig();\n\n  if (!config.models[modelName]) {\n    throw new Error(`Model '${modelName}' not found in config`);\n  }\n\n  config.currentModel = modelName;\n  saveConfig(config);\n}\n\n/**\n * Add or update a model configuration\n */\nexport function saveModelConfig(modelName: string, modelConfig: LLMConfig): void {\n  const config = loadConfig();\n\n  config.models[modelName] = modelConfig;\n\n  // Set as current if it's the first model\n  if (!config.currentModel) {\n    config.currentModel = modelName;\n  }\n\n  saveConfig(config);\n}\n\n/**\n * Remove a model configuration\n */\nexport function removeModelConfig(modelName: string): void {\n  const config = loadConfig();\n\n  delete config.models[modelName];\n\n  // Clear current if it was removed\n  if (config.currentModel === modelName) {\n    config.currentModel = undefined;\n  }\n\n  saveConfig(config);\n}\n\n/**\n * List all configured models\n */\nexport function listModels(): Array<{\n  name: string;\n  config: LLMConfig;\n  isCurrent: boolean;\n}> {\n  const config = loadConfig();\n\n  return Object.entries(config.models).map(([name, modelConfig]) => ({\n    name,\n    config: modelConfig,\n    isCurrent: name === config.currentModel,\n  }));\n}\n\n/**\n * Get provider display name\n */\nexport function getProviderDisplayName(provider: LLMProvider): string {\n  const displayNames: Record<LLMProvider, string> = {\n    openai: \"OpenAI\",\n    anthropic: \"Anthropic\",\n    google: \"Google\",\n    deepseek: \"DeepSeek\",\n    ollama: \"Ollama\",\n    groq: \"Groq\",\n    mistral: \"Mistral\",\n    cohere: \"Cohere\",\n    \"openai-compatible\": \"OpenAI Compatible\",\n  };\n  return displayNames[provider];\n}\n"],"mappings":";;;;;;AAMA,MAAM,aAAa,KAAK,SAAS,EAAE,OAAO;AAC1C,MAAM,cAAc,KAAK,YAAY,cAAc;;;;AAUnD,SAAS,kBAAwB;AAC/B,KAAI,CAAC,WAAW,WAAW,CACzB,WAAU,YAAY,EAAE,WAAW,MAAM,CAAC;;;;;AAO9C,SAAgB,aAAwB;AACtC,kBAAiB;AAEjB,KAAI,CAAC,WAAW,YAAY,CAC1B,QAAO,EAAE,QAAQ,EAAE,EAAE;AAGvB,KAAI;EACF,MAAM,UAAU,aAAa,aAAa,QAAQ;AAClD,SAAO,KAAK,MAAM,QAAQ;UACnB,KAAK;AACZ,QAAM,gCAAgC,MAAM;AAC5C,SAAO,EAAE,QAAQ,EAAE,EAAE;;;;;;AAezB,SAAgB,wBAA0C;CACxD,MAAM,SAAS,YAAY;AAE3B,KAAI,CAAC,OAAO,aACV,QAAO;AAGT,QAAO,OAAO,OAAO,OAAO,iBAAiB;;;;;AAoD/C,SAAgB,aAIb;CACD,MAAM,SAAS,YAAY;AAE3B,QAAO,OAAO,QAAQ,OAAO,OAAO,CAAC,KAAK,CAAC,MAAM,kBAAkB;EACjE;EACA,QAAQ;EACR,WAAW,SAAS,OAAO;EAC5B,EAAE"}

package/dist/bin/bin-registry-Cj1PddZ1.mjs

@@ -0,0 +1,3 @@
+import { A as writeRegistry, C as removeShim, D as listCommands, E as getRegistryPath, M as isCommandAvailable, O as readRegistry, S as getShimDir, T as getCommand, _ as autoRegisterBins, b as createShim, g as setupPath, h as isKlyBinInPath, j as detectBins, k as removeCommand, m as getShellConfigFile, p as checkPathSetup, v as shouldReregisterLocal, w as addCommand, x as generateShimPath, y as unregisterCommand } from "./kly.mjs";
+
+export { autoRegisterBins };

package/dist/bin/kly.mjs

@@ -619,7 +619,7 @@ async function fetchModelsDevData(forceRefresh = false) {
 	if (!forceRefresh && existsSync(CACHE_FILE)) try {
 		const cached = JSON.parse(readFileSync(CACHE_FILE, "utf-8"));
 		if (Date.now() - cached.timestamp < CACHE_TTL) return cached;
-	} catch (_error) {}
+	} catch {}
 	try {
 		const response = await fetch(MODELS_DEV_API);
 		if (!response.ok) return null;
@@ -629,9 +629,9 @@ async function fetchModelsDevData(forceRefresh = false) {
 		};
 		try {
 			writeFileSync(CACHE_FILE, JSON.stringify(cachedData, null, 2), "utf-8");
-		} catch (_error) {}
+		} catch {}
 		return cachedData;
-	} catch (_error) {
+	} catch {
 		if (existsSync(CACHE_FILE)) try {
 			return JSON.parse(readFileSync(CACHE_FILE, "utf-8"));
 		} catch {}
@@ -2270,7 +2270,7 @@ async function checkForUpdates(ref, metadata) {
 //#region src/remote/index.ts
 init_parser();
 /** Current kly CLI version */
-const KLY_VERSION = "0.3.0";
+const KLY_VERSION = "0.3.1";
 /**
 * Run a remote GitHub repository as a kly app
 */
@@ -2302,7 +2302,7 @@ async function runRemote(input, options = {}) {
 			await installDependencies(repoPath);
 		}
 		if (!options.skipRegister) {
-			const { autoRegisterBins: autoRegisterBins$1 } = await import("./bin-registry-DOBspniG.mjs");
+			const { autoRegisterBins: autoRegisterBins$1 } = await import("./bin-registry-Cj1PddZ1.mjs");
 			await autoRegisterBins$1(repoPath, {
 				type: "remote",
 				remoteRef: formatRepoUrl(ref),
@@ -2455,10 +2455,10 @@ async function executeApp(ref, repoPath, args$1, mcp) {
 	const prevRemoteRef = process.env[ENV_VARS.REMOTE_REF];
 	process.env[ENV_VARS.REMOTE_REF] = remoteRef;
 	try {
-		const { getAppIdentifier: getAppIdentifier$1, checkApiKeyPermission: checkApiKeyPermission$1, getAppSandboxConfig: getAppSandboxConfig$1 } = await import("./permissions-D7-M2lRi.mjs");
-		const { launchSandbox: launchSandbox$1 } = await import("./launcher-DD6vpEFb.mjs");
-		const { buildSandboxConfig: buildSandboxConfig$1, formatPermissionsSummary: formatPermissionsSummary$1 } = await import("./config-builder-VSUaGlaV.mjs");
-		const { extractAppPermissions: extractAppPermissions$1 } = await import("./permissions-extractor-ySRyhQut.mjs");
+		const { getAppIdentifier: getAppIdentifier$1, checkApiKeyPermission: checkApiKeyPermission$1, getAppSandboxConfig: getAppSandboxConfig$1 } = await import("./permissions-DOOzghc5.mjs");
+		const { launchSandbox: launchSandbox$1 } = await import("./launcher-CSdy4_ZV.mjs");
+		const { buildSandboxConfig: buildSandboxConfig$1, formatPermissionsSummary: formatPermissionsSummary$1 } = await import("./config-builder-CkkAqWMY.mjs");
+		const { extractAppPermissions: extractAppPermissions$1 } = await import("./permissions-extractor-B3XI8JLv.mjs");
 		const appId = getAppIdentifier$1();
 		const declaredPermissions = await extractAppPermissions$1(absoluteEntryPath);
 		if (declaredPermissions) {
@@ -2505,6 +2505,7 @@ async function executeApp(ref, repoPath, args$1, mcp) {
 
 //#endregion
 //#region src/bin-registry/commands.ts
+init_parser();
 async function installCommand(args$1) {
 	const target = args$1[0];
 	if (!target) throw new ExitError("Missing target\nUsage: kly install <file|user/repo[@ref]>\n   or: kly install --setup-path");
@@ -2512,13 +2513,11 @@ async function installCommand(args$1) {
 		await setupPath();
 		return;
 	}
-	if (isRemoteRef(target)) {
-		const { runRemote: runRemote$1 } = await import("./remote-tQeFZX9o.mjs");
-		await runRemote$1(target, {
-			args: args$1.slice(1),
-			skipRegister: false
-		});
-	} else {
+	if (isRemoteRef(target)) await runRemote(target, {
+		args: args$1.slice(1),
+		skipRegister: false
+	});
+	else {
 		const absolutePath = resolve(process.cwd(), target);
 		const detection = detectBins(absolutePath);
 		if (!detection.hasBin) {
@@ -2541,17 +2540,34 @@ async function uninstallCommand(args$1) {
 	await unregisterCommand(commandName, { skipConfirm: false });
 }
 async function linkCommand(args$1) {
-	const targetPath = args$1[0] || process.cwd();
-	const absolutePath = resolve(process.cwd(), targetPath);
-	const detection = detectBins(absolutePath);
-	if (!detection.hasBin) throw new ExitError("No bin field found in package.json");
-	log.step(`Linking ${detection.projectName}...`);
-	await autoRegisterBins(absolutePath, {
-		type: "local",
-		force: true,
-		skipConfirm: true
-	});
-	log.success("Linked successfully!");
+	const target = args$1[0] || process.cwd();
+	if (isRemoteRef(target)) {
+		const ref = parseRemoteRef(target);
+		if (!ref) throw new ExitError(`Invalid remote reference: ${target}`);
+		const repoPath = getRepoCachePath(ref);
+		if (!checkCache(ref).valid) throw new ExitError(`Remote package not cached. Run 'kly run ${target}' first to download it.`);
+		const detection = detectBins(repoPath);
+		if (!detection.hasBin) throw new ExitError("No bin field found in package.json");
+		log.step(`Linking ${detection.projectName}...`);
+		await autoRegisterBins(repoPath, {
+			type: "remote",
+			remoteRef: target,
+			force: true,
+			skipConfirm: true
+		});
+		log.success("Linked successfully!");
+	} else {
+		const absolutePath = resolve(process.cwd(), target);
+		const detection = detectBins(absolutePath);
+		if (!detection.hasBin) throw new ExitError("No bin field found in package.json");
+		log.step(`Linking ${detection.projectName}...`);
+		await autoRegisterBins(absolutePath, {
+			type: "local",
+			force: true,
+			skipConfirm: true
+		});
+		log.success("Linked successfully!");
+	}
 }
 async function listCommand() {
 	const commands = listCommands();
@@ -3382,7 +3398,8 @@ function buildSandboxConfig(permissions) {
 		const userSandbox = permissions.sandbox;
 		if (userSandbox.network?.allowedDomains) {
 			const domains = userSandbox.network.allowedDomains.filter((d) => d !== void 0);
-			allowedDomains = [...allowedDomains, ...domains];
+			if (domains.includes("*")) allowedDomains = void 0;
+			else allowedDomains = [...allowedDomains ?? [], ...domains];
 		}
 		if (userSandbox.filesystem) {
 			if (userSandbox.filesystem.allowWrite) allowWrite = userSandbox.filesystem.allowWrite.map(resolveFilesystemPath).filter((p$1) => p$1 !== void 0);
@@ -3393,7 +3410,7 @@ function buildSandboxConfig(permissions) {
 		}
 	}
 	return {
-		network: {
+		network: allowedDomains === void 0 ? { deniedDomains: [] } : {
 			allowedDomains,
 			deniedDomains: []
 		},
@@ -3414,10 +3431,11 @@ function formatPermissionsSummary(permissions) {
 	if (permissions?.apiKeys) summary.push("• API Keys access (to call LLM APIs)");
 	const config = buildSandboxConfig(permissions);
 	const currentDir = process.cwd();
-	if (config.network.allowedDomains.length > 0) if (config.network.allowedDomains.includes("*")) summary.push("• Network: All domains");
-	else {
-		const domains = config.network.allowedDomains.slice(0, 3).join(", ");
-		const more = config.network.allowedDomains.length > 3 ? ` +${config.network.allowedDomains.length - 3} more` : "";
+	const allowedDomains = config.network.allowedDomains;
+	if (allowedDomains === void 0) summary.push("• Network: All domains (unrestricted)");
+	else if (allowedDomains.length > 0) {
+		const domains = allowedDomains.slice(0, 3).join(", ");
+		const more = allowedDomains.length > 3 ? ` +${allowedDomains.length - 3} more` : "";
 		summary.push(`• Network: ${domains}${more}`);
 	}
 	if (config.filesystem.allowWrite.length > 1 || config.filesystem.allowWrite.length === 1 && config.filesystem.allowWrite[0] !== currentDir) {
@@ -3467,7 +3485,8 @@ async function extractAppPermissions(scriptPath) {
 */
 function needsPermissionPrompt(permissions, sandboxConfig) {
 	if (permissions?.apiKeys) return true;
-	if (sandboxConfig.network.allowedDomains.length > 0) return true;
+	const allowedDomains = sandboxConfig.network.allowedDomains;
+	if (allowedDomains === void 0 || allowedDomains.length > 0) return true;
 	if (permissions?.sandbox?.filesystem) return true;
 	return false;
 }
@@ -3542,7 +3561,7 @@ function checkStoredPermission(appId) {
 const args = process.argv.slice(2);
 const command = args[0];
 async function main() {
-	intro(`${colors.bgHex("#dc7702")(colors.black(` Kly ${colors.italic("0.3.0")} `))}`);
+	intro(`${colors.bgHex("#dc7702")(colors.black(` Kly ${colors.italic("0.3.1")} `))}`);
 	if (!command || command === "--help" || command === "-h") {
 		showHelp();
 		return;
@@ -3714,7 +3733,7 @@ Examples:
   kly install --setup-path`);
 }
 function showVersion() {
-	log.message("0.3.0");
+	log.message("0.3.1");
 }
 main().then(() => {
 	outro(`ヾ(￣▽￣)Bye~`);
@@ -3731,5 +3750,5 @@ main().then(() => {
 });
 
 //#endregion
-export { getRegistryPath as A, unregisterCommand as C, removeShim as D, getShimDir as E, detectBins as F, isCommandAvailable as I, log as L, readRegistry as M, removeCommand as N, addCommand as O, writeRegistry as P, shouldReregisterLocal as S, generateShimPath as T, checkPathSetup as _, getAppIdentifier as a, setupPath as b, listPermissions as c, savePermissions as d, launchSandbox as f, parseRemoteRef as g, isRemoteRef as h, clearAllPermissions as i, listCommands as j, getCommand as k, loadPermissions as l, invalidateCache as m, formatPermissionsSummary as n, getAppName as o, runRemote as p, checkApiKeyPermission as r, getAppSandboxConfig as s, buildSandboxConfig as t, revokePermission as u, getShellConfigFile as v, createShim as w, autoRegisterBins as x, isKlyBinInPath as y };
+export { writeRegistry as A, removeShim as C, listCommands as D, getRegistryPath as E, isCommandAvailable as M, log as N, readRegistry as O, getShimDir as S, getCommand as T, autoRegisterBins as _, getAppIdentifier as a, createShim as b, listPermissions as c, savePermissions as d, launchSandbox as f, setupPath as g, isKlyBinInPath as h, clearAllPermissions as i, detectBins as j, removeCommand as k, loadPermissions as l, getShellConfigFile as m, formatPermissionsSummary as n, getAppName as o, checkPathSetup as p, checkApiKeyPermission as r, getAppSandboxConfig as s, buildSandboxConfig as t, revokePermission as u, shouldReregisterLocal as v, addCommand as w, generateShimPath as x, unregisterCommand as y };
 //# sourceMappingURL=kly.mjs.map