profclaw 0.0.1-beta.1

package/dist/cli/utils/output.d.ts

@@ -0,0 +1,58 @@
+import Table from 'cli-table3';
+import { Ora } from 'ora';
+export declare const statusColors: Record<string, (s: string) => string>;
+/**
+ * Format a status with color
+ */
+export declare function formatStatus(status: string): string;
+/**
+ * Format a date for display
+ */
+export declare function formatDate(date: Date | string | null | undefined): string;
+/**
+ * Format a relative time (e.g., "2m ago")
+ */
+export declare function formatRelativeTime(date: Date | string | null | undefined): string;
+/**
+ * Create a styled table
+ */
+export declare function createTable(headers: string[]): InstanceType<typeof Table>;
+/**
+ * Print success message
+ */
+export declare function success(message: string): void;
+/**
+ * Print error message
+ */
+export declare function error(message: string): void;
+/**
+ * Print warning message
+ */
+export declare function warn(message: string): void;
+/**
+ * Print info message
+ */
+export declare function info(message: string): void;
+/**
+ * Create a spinner
+ */
+export declare function spinner(text: string): Ora;
+/**
+ * Output data in JSON or table format
+ */
+export declare function output(data: unknown, options: {
+    json?: boolean;
+}): void;
+/**
+ * Truncate a string with ellipsis
+ */
+export declare function truncate(str: string, maxLength: number): string;
+/**
+ * Format a cost value
+ */
+export declare function formatCost(amount: number): string;
+/**
+ * Format a token count
+ */
+export declare function formatTokens(count: number): string;
+//# sourceMappingURL=output.d.ts.map

package/dist/cli/utils/output.js

@@ -0,0 +1,148 @@
+import chalk from 'chalk';
+import Table from 'cli-table3';
+import ora from 'ora';
+// Status colors
+export const statusColors = {
+    pending: chalk.yellow,
+    queued: chalk.blue,
+    running: chalk.cyan,
+    completed: chalk.green,
+    failed: chalk.red,
+    cancelled: chalk.gray,
+};
+/**
+ * Format a status with color
+ */
+export function formatStatus(status) {
+    const colorFn = statusColors[status] || chalk.white;
+    return colorFn(status.toUpperCase());
+}
+/**
+ * Format a date for display
+ */
+export function formatDate(date) {
+    if (!date)
+        return chalk.dim('-');
+    const d = typeof date === 'string' ? new Date(date) : date;
+    return d.toLocaleString();
+}
+/**
+ * Format a relative time (e.g., "2m ago")
+ */
+export function formatRelativeTime(date) {
+    if (!date)
+        return chalk.dim('-');
+    const d = typeof date === 'string' ? new Date(date) : date;
+    const now = Date.now();
+    const diff = now - d.getTime();
+    if (diff < 60000)
+        return 'just now';
+    if (diff < 3600000)
+        return `${Math.floor(diff / 60000)}m ago`;
+    if (diff < 86400000)
+        return `${Math.floor(diff / 3600000)}h ago`;
+    return `${Math.floor(diff / 86400000)}d ago`;
+}
+/**
+ * Create a styled table
+ */
+export function createTable(headers) {
+    return new Table({
+        head: headers.map((h) => chalk.bold.white(h)),
+        style: {
+            head: [],
+            border: ['dim'],
+        },
+        chars: {
+            'top': '─',
+            'top-mid': '┬',
+            'top-left': '┌',
+            'top-right': '┐',
+            'bottom': '─',
+            'bottom-mid': '┴',
+            'bottom-left': '└',
+            'bottom-right': '┘',
+            'left': '│',
+            'left-mid': '├',
+            'mid': '─',
+            'mid-mid': '┼',
+            'right': '│',
+            'right-mid': '┤',
+            'middle': '│',
+        },
+    });
+}
+/**
+ * Print success message
+ */
+export function success(message) {
+    console.log(chalk.green('✓') + ' ' + message);
+}
+/**
+ * Print error message
+ */
+export function error(message) {
+    console.error(chalk.red('✗') + ' ' + message);
+}
+/**
+ * Print warning message
+ */
+export function warn(message) {
+    console.log(chalk.yellow('⚠') + ' ' + message);
+}
+/**
+ * Print info message
+ */
+export function info(message) {
+    console.log(chalk.blue('ℹ') + ' ' + message);
+}
+/**
+ * Create a spinner
+ */
+export function spinner(text) {
+    return ora({
+        text,
+        spinner: 'dots',
+    });
+}
+/**
+ * Output data in JSON or table format
+ */
+export function output(data, options) {
+    if (options.json) {
+        console.log(JSON.stringify(data, null, 2));
+    }
+    else if (Array.isArray(data)) {
+        console.log(data);
+    }
+    else {
+        console.log(data);
+    }
+}
+/**
+ * Truncate a string with ellipsis
+ */
+export function truncate(str, maxLength) {
+    if (!str)
+        return '';
+    if (str.length <= maxLength)
+        return str;
+    return str.slice(0, maxLength - 3) + '...';
+}
+/**
+ * Format a cost value
+ */
+export function formatCost(amount) {
+    return `$${amount.toFixed(4)}`;
+}
+/**
+ * Format a token count
+ */
+export function formatTokens(count) {
+    if (count >= 1000000)
+        return `${(count / 1000000).toFixed(1)}M`;
+    if (count >= 1000)
+        return `${(count / 1000).toFixed(1)}K`;
+    return count.toString();
+}
+//# sourceMappingURL=output.js.map

package/dist/core/deployment.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Deployment Mode System
+ *
+ * Controls which features are available based on PROFCLAW_MODE env var.
+ * Modes: pico (minimal), mini (dashboard), pro (everything).
+ */
+export type DeploymentMode = 'pico' | 'mini' | 'pro';
+export type Capability = 'agent' | 'tools' | 'chat_cli' | 'chat_channels' | 'web_ui' | 'redis' | 'bullmq' | 'cron' | 'cron_full' | 'integrations' | 'integrations_full' | 'browser_tools' | 'plugins' | 'sandbox' | 'sandbox_full' | 'sync_engine' | 'webhook_queue' | 'notifications';
+/**
+ * Get the current deployment mode from PROFCLAW_MODE env var.
+ * Defaults to 'mini' if not set.
+ */
+export declare function getMode(): DeploymentMode;
+/** Check if the current mode has a specific capability. */
+export declare function hasCapability(cap: Capability): boolean;
+/** Check if an explicit mode has a specific capability. */
+export declare function hasCapabilityForMode(mode: DeploymentMode, cap: Capability): boolean;
+/** Get all capabilities for the current mode. */
+export declare function getCapabilities(): Capability[];
+/** Get max allowed chat channels for the current mode. */
+export declare function getChannelLimit(): number;
+/** Get max concurrent task executions for the current mode. */
+export declare function getConcurrency(): number;
+/** Check if Redis should be used (pro mode, or explicitly configured). */
+export declare function shouldUseRedis(): boolean;
+/** Human-readable mode label for logs. */
+export declare function getModeLabel(): string;
+/** Reset cached mode (for testing). */
+export declare function resetMode(): void;
+//# sourceMappingURL=deployment.d.ts.map

package/dist/core/deployment.js

@@ -0,0 +1,114 @@
+/**
+ * Deployment Mode System
+ *
+ * Controls which features are available based on PROFCLAW_MODE env var.
+ * Modes: pico (minimal), mini (dashboard), pro (everything).
+ */
+const MODE_CAPABILITIES = {
+    pico: new Set([
+        'agent',
+        'tools',
+        'chat_cli',
+    ]),
+    mini: new Set([
+        'agent',
+        'tools',
+        'chat_cli',
+        'chat_channels',
+        'web_ui',
+        'cron',
+        'integrations',
+        'sandbox',
+        'notifications',
+    ]),
+    pro: new Set([
+        'agent',
+        'tools',
+        'chat_cli',
+        'chat_channels',
+        'web_ui',
+        'redis',
+        'bullmq',
+        'cron',
+        'cron_full',
+        'integrations',
+        'integrations_full',
+        'browser_tools',
+        'plugins',
+        'sandbox',
+        'sandbox_full',
+        'sync_engine',
+        'webhook_queue',
+        'notifications',
+    ]),
+};
+/** Max chat channels per mode */
+const MODE_CHANNEL_LIMITS = {
+    pico: 1,
+    mini: 3,
+    pro: Infinity,
+};
+/** Max concurrent task executions per mode */
+const MODE_CONCURRENCY = {
+    pico: 1,
+    mini: 3,
+    pro: parseInt(process.env.POOL_MAX_CONCURRENT || '50', 10),
+};
+let cachedMode = null;
+/**
+ * Get the current deployment mode from PROFCLAW_MODE env var.
+ * Defaults to 'mini' if not set.
+ */
+export function getMode() {
+    if (cachedMode)
+        return cachedMode;
+    const raw = process.env.PROFCLAW_MODE?.toLowerCase().trim();
+    if (raw === 'pico' || raw === 'mini' || raw === 'pro') {
+        cachedMode = raw;
+    }
+    else {
+        cachedMode = 'mini';
+    }
+    return cachedMode;
+}
+/** Check if the current mode has a specific capability. */
+export function hasCapability(cap) {
+    return MODE_CAPABILITIES[getMode()].has(cap);
+}
+/** Check if an explicit mode has a specific capability. */
+export function hasCapabilityForMode(mode, cap) {
+    return MODE_CAPABILITIES[mode].has(cap);
+}
+/** Get all capabilities for the current mode. */
+export function getCapabilities() {
+    return [...MODE_CAPABILITIES[getMode()]];
+}
+/** Get max allowed chat channels for the current mode. */
+export function getChannelLimit() {
+    return MODE_CHANNEL_LIMITS[getMode()];
+}
+/** Get max concurrent task executions for the current mode. */
+export function getConcurrency() {
+    return MODE_CONCURRENCY[getMode()];
+}
+/** Check if Redis should be used (pro mode, or explicitly configured). */
+export function shouldUseRedis() {
+    // Explicit override: if REDIS_URL is set, try to use Redis regardless of mode
+    if (process.env.REDIS_URL)
+        return true;
+    return hasCapability('redis');
+}
+/** Human-readable mode label for logs. */
+export function getModeLabel() {
+    const labels = {
+        pico: 'Pico (minimal)',
+        mini: 'Mini (dashboard)',
+        pro: 'Pro (full)',
+    };
+    return labels[getMode()];
+}
+/** Reset cached mode (for testing). */
+export function resetMode() {
+    cachedMode = null;
+}
+//# sourceMappingURL=deployment.js.map

package/dist/core/sandbox-config.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Sandbox Security Configuration
+ *
+ * Defines security presets per deployment mode.
+ * The config specifies WHAT restrictions to apply; enforcement
+ * depends on the execution environment (Docker, native, etc.).
+ */
+export type SandboxSecurityLevel = 'permissive' | 'standard' | 'strict';
+export interface SandboxSecurityConfig {
+    /** Security level name */
+    level: SandboxSecurityLevel;
+    /** Allow outbound network access */
+    allowNetwork: boolean;
+    /** Mount filesystem as read-only outside workspace */
+    readOnlyFs: boolean;
+    /** Max memory in megabytes (0 = no limit) */
+    maxMemoryMb: number;
+    /** Max CPU usage as a percentage 0–100 (0 = no limit) */
+    maxCpuPercent: number;
+    /** Execution timeout in milliseconds */
+    timeoutMs: number;
+    /**
+     * Allowlist of shell command prefixes.
+     * Empty array means all commands are allowed.
+     * Enforcement is advisory — the execution environment decides.
+     */
+    allowedCommands: string[];
+    /**
+     * Paths that must not be mounted or accessed.
+     * Enforcement is advisory — the execution environment decides.
+     */
+    blockedPaths: string[];
+}
+/**
+ * Resolve the active sandbox security level.
+ *
+ * Priority:
+ *   1. `PROFCLAW_SANDBOX_LEVEL` env var (explicit override)
+ *   2. Default for the current deployment mode
+ */
+export declare function getSecurityLevel(): SandboxSecurityLevel;
+/**
+ * Return the full security config for the current deployment mode.
+ * Respects `PROFCLAW_SANDBOX_LEVEL` override when set.
+ */
+export declare function getSandboxConfig(): SandboxSecurityConfig;
+/**
+ * Return the security config for a specific level, ignoring env overrides.
+ * Useful for introspection and tests.
+ */
+export declare function getSandboxConfigForLevel(level: SandboxSecurityLevel): SandboxSecurityConfig;
+/**
+ * Convert maxMemoryMb to a Docker-compatible memory limit string.
+ * Returns undefined when no limit is configured (0).
+ */
+export declare function toDockerMemoryLimit(maxMemoryMb: number): string | undefined;
+/**
+ * Convert maxCpuPercent to a Docker-compatible CPU limit string (fractional cores).
+ * Assumes a single-core equivalent at 100%.
+ * Returns undefined when no limit is configured (0).
+ */
+export declare function toDockerCpuLimit(maxCpuPercent: number): string | undefined;
+//# sourceMappingURL=sandbox-config.d.ts.map

package/dist/core/sandbox-config.js

@@ -0,0 +1,148 @@
+/**
+ * Sandbox Security Configuration
+ *
+ * Defines security presets per deployment mode.
+ * The config specifies WHAT restrictions to apply; enforcement
+ * depends on the execution environment (Docker, native, etc.).
+ */
+import { getMode } from './deployment.js';
+// Presets per deployment mode
+/**
+ * pico — single-user, trusted machine.
+ * Minimal restrictions; mirrors running directly on the host.
+ */
+const PERMISSIVE_PRESET = {
+    level: 'permissive',
+    allowNetwork: true,
+    readOnlyFs: false,
+    maxMemoryMb: 0,
+    maxCpuPercent: 0,
+    timeoutMs: parseInt(process.env.SANDBOX_TIMEOUT_MS || '300000', 10),
+    allowedCommands: [],
+    blockedPaths: [],
+};
+/**
+ * mini — shared or semi-trusted environment.
+ * FS outside the workspace is read-only; network off by default.
+ */
+const STANDARD_PRESET = {
+    level: 'standard',
+    allowNetwork: false,
+    readOnlyFs: true,
+    maxMemoryMb: parseInt(process.env.SANDBOX_MAX_MEMORY_MB || '512', 10),
+    maxCpuPercent: parseInt(process.env.SANDBOX_MAX_CPU_PERCENT || '80', 10),
+    timeoutMs: parseInt(process.env.SANDBOX_TIMEOUT_MS || '120000', 10),
+    allowedCommands: [
+        'node', 'npm', 'npx', 'pnpm',
+        'python', 'python3', 'pip', 'pip3',
+        'sh', 'bash',
+        'git',
+        'ls', 'cat', 'cp', 'mv', 'mkdir', 'rm', 'touch',
+        'grep', 'sed', 'awk', 'sort', 'uniq', 'wc',
+        'jq', 'curl',
+    ],
+    blockedPaths: [
+        '/etc/shadow',
+        '/etc/sudoers',
+        '/root',
+        '/proc',
+        '/sys',
+        '/dev',
+        '/run/secrets',
+    ],
+};
+/**
+ * pro — multi-tenant or public-facing deployment.
+ * Full network isolation, tight resource caps.
+ * All limits are configurable via env vars.
+ */
+const STRICT_PRESET = {
+    level: 'strict',
+    allowNetwork: process.env.SANDBOX_ALLOW_NETWORK === 'true',
+    readOnlyFs: true,
+    maxMemoryMb: parseInt(process.env.SANDBOX_MAX_MEMORY_MB || '256', 10),
+    maxCpuPercent: parseInt(process.env.SANDBOX_MAX_CPU_PERCENT || '50', 10),
+    timeoutMs: parseInt(process.env.SANDBOX_TIMEOUT_MS || '60000', 10),
+    allowedCommands: [
+        'node', 'npm', 'npx',
+        'python', 'python3',
+        'sh', 'bash',
+        'git',
+        'ls', 'cat', 'cp', 'mv', 'mkdir', 'rm', 'touch',
+        'grep', 'sed', 'awk',
+        'jq',
+    ],
+    blockedPaths: [
+        '/etc/shadow',
+        '/etc/sudoers',
+        '/etc/passwd',
+        '/root',
+        '/proc',
+        '/sys',
+        '/dev',
+        '/run',
+        '/var/run',
+        '/tmp',
+        '/home',
+    ],
+};
+// Map deployment mode -> default security level
+const MODE_SECURITY_LEVEL = {
+    pico: 'permissive',
+    mini: 'standard',
+    pro: 'strict',
+};
+const LEVEL_PRESETS = {
+    permissive: PERMISSIVE_PRESET,
+    standard: STANDARD_PRESET,
+    strict: STRICT_PRESET,
+};
+// Public API
+/**
+ * Resolve the active sandbox security level.
+ *
+ * Priority:
+ *   1. `PROFCLAW_SANDBOX_LEVEL` env var (explicit override)
+ *   2. Default for the current deployment mode
+ */
+export function getSecurityLevel() {
+    const override = process.env.PROFCLAW_SANDBOX_LEVEL?.toLowerCase().trim();
+    if (override === 'permissive' || override === 'standard' || override === 'strict') {
+        return override;
+    }
+    return MODE_SECURITY_LEVEL[getMode()];
+}
+/**
+ * Return the full security config for the current deployment mode.
+ * Respects `PROFCLAW_SANDBOX_LEVEL` override when set.
+ */
+export function getSandboxConfig() {
+    return LEVEL_PRESETS[getSecurityLevel()];
+}
+/**
+ * Return the security config for a specific level, ignoring env overrides.
+ * Useful for introspection and tests.
+ */
+export function getSandboxConfigForLevel(level) {
+    return LEVEL_PRESETS[level];
+}
+/**
+ * Convert maxMemoryMb to a Docker-compatible memory limit string.
+ * Returns undefined when no limit is configured (0).
+ */
+export function toDockerMemoryLimit(maxMemoryMb) {
+    if (maxMemoryMb <= 0)
+        return undefined;
+    return `${maxMemoryMb}m`;
+}
+/**
+ * Convert maxCpuPercent to a Docker-compatible CPU limit string (fractional cores).
+ * Assumes a single-core equivalent at 100%.
+ * Returns undefined when no limit is configured (0).
+ */
+export function toDockerCpuLimit(maxCpuPercent) {
+    if (maxCpuPercent <= 0)
+        return undefined;
+    return (maxCpuPercent / 100).toFixed(2);
+}
+//# sourceMappingURL=sandbox-config.js.map

package/dist/costs/budget.d.ts

@@ -0,0 +1,28 @@
+export interface BudgetConfig {
+    dailyLimit: number;
+    monthlyLimit: number;
+    alerts: number[];
+}
+/**
+ * Check if the budget has been exceeded or alert thresholds hit
+ */
+export declare function checkBudget(): {
+    exceeded: boolean;
+    thresholds: number[];
+};
+/**
+ * Set a new budget configuration
+ */
+export declare function setBudget(config: Partial<BudgetConfig>): void;
+/**
+ * Get current budget configuration and status
+ */
+export declare function getBudgetStatus(): {
+    config: BudgetConfig;
+    currentUsage: {
+        daily: number;
+        dailyPercent: string;
+    };
+    isExceeded: boolean;
+};
+//# sourceMappingURL=budget.d.ts.map

package/dist/costs/budget.js

@@ -0,0 +1,57 @@
+import { getUsageSummary } from './token-tracker.js';
+import { logger } from '../utils/logger.js';
+import { loadConfig } from '../utils/config-loader.js';
+// Load dynamic config
+const budgetYaml = loadConfig('budget.yml');
+let currentBudget = {
+    dailyLimit: parseFloat(process.env.DAILY_BUDGET_LIMIT || '') || budgetYaml.budget?.dailyLimit || 50.00,
+    monthlyLimit: parseFloat(process.env.MONTHLY_BUDGET_LIMIT || '') || budgetYaml.budget?.monthlyLimit || 500.00,
+    alerts: budgetYaml.alerts?.thresholds || [50, 80, 90, 100],
+};
+const triggeredAlerts = new Set();
+/**
+ * Check if the budget has been exceeded or alert thresholds hit
+ */
+export function checkBudget() {
+    const summary = getUsageSummary();
+    const dailyPercent = (summary.totalCost / currentBudget.dailyLimit) * 100;
+    const hitThresholds = [];
+    for (const threshold of currentBudget.alerts) {
+        const alertKey = `daily-${threshold}`;
+        if (dailyPercent >= threshold && !triggeredAlerts.has(alertKey)) {
+            hitThresholds.push(threshold);
+            triggeredAlerts.add(alertKey);
+            logger.warn(`Budget alert: Daily limit hit ${threshold}%`, {
+                currentCost: summary.totalCost.toFixed(6),
+                limit: currentBudget.dailyLimit,
+                percentage: dailyPercent.toFixed(2),
+            });
+        }
+    }
+    return {
+        exceeded: summary.totalCost >= currentBudget.dailyLimit,
+        thresholds: hitThresholds,
+    };
+}
+/**
+ * Set a new budget configuration
+ */
+export function setBudget(config) {
+    currentBudget = { ...currentBudget, ...config };
+    triggeredAlerts.clear(); // Reset alerts when budget changes
+}
+/**
+ * Get current budget configuration and status
+ */
+export function getBudgetStatus() {
+    const summary = getUsageSummary();
+    return {
+        config: currentBudget,
+        currentUsage: {
+            daily: summary.totalCost,
+            dailyPercent: ((summary.totalCost / currentBudget.dailyLimit) * 100).toFixed(2),
+        },
+        isExceeded: summary.totalCost >= currentBudget.dailyLimit,
+    };
+}
+//# sourceMappingURL=budget.js.map