shortcutxl 0.2.0

package/dist/custom/auth/shortcut-oauth.js

@@ -0,0 +1,145 @@
+/**
+ * Shortcut OAuth Provider for the agent.
+ *
+ * Implements the pi-ai OAuthProviderInterface using Shortcut's Device Code Flow (RFC 8628).
+ * Users run `/login`, get a code, open browser to authorize, and the agent polls for tokens.
+ *
+ * Token refresh uses Shortcut's `POST /auth/refresh` endpoint with body mode (token_delivery: "body").
+ */
+import { SHORTCUT_AUTH_URL as AUTH_SERVICE_URL } from '../constants.js';
+const PLATFORM = 'agent-cli';
+// Refresh tokens 2 minutes before expiry to avoid mid-request failures.
+// The web client uses 5 min, but the agent only refreshes reactively (on getApiKey),
+// so we use a shorter buffer — just enough to cover an in-flight streaming request.
+const REFRESH_BUFFER_MS = 2 * 60 * 1000;
+// PKCE utilities (inlined to avoid cross-package import issues)
+const BASE64URL_CHARSET = 'ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_';
+function generateCodeVerifier() {
+    const array = new Uint8Array(64);
+    crypto.getRandomValues(array);
+    return Array.from(array, (byte) => BASE64URL_CHARSET[byte % 64]).join('');
+}
+async function generateCodeChallenge(codeVerifier) {
+    const data = new TextEncoder().encode(codeVerifier);
+    const hashBuffer = await crypto.subtle.digest('SHA-256', data);
+    const hashArray = new Uint8Array(hashBuffer);
+    const base64 = btoa(String.fromCharCode(...hashArray));
+    return base64.replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+/**
+ * Shortcut OAuth provider config (without `id` — pi-ai adds that from the provider name).
+ */
+export const shortcutOAuth = {
+    name: 'Shortcut',
+    usesCallbackServer: false,
+    async login(callbacks) {
+        // 1. Initiate device code flow
+        const codeVerifier = generateCodeVerifier();
+        const codeChallenge = await generateCodeChallenge(codeVerifier);
+        const codeResponse = await fetch(`${AUTH_SERVICE_URL}/auth/device/code`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                code_challenge: codeChallenge,
+                platform: PLATFORM
+            }),
+            signal: callbacks.signal
+        });
+        if (!codeResponse.ok) {
+            const data = await codeResponse.json().catch(() => ({}));
+            throw new Error(data.error ?? `Failed to initiate device code: ${codeResponse.status}`);
+        }
+        const deviceCode = await codeResponse.json();
+        // 2. Tell the user to open the browser
+        callbacks.onAuth({
+            url: deviceCode.verification_uri_complete,
+            instructions: `Your code is: ${deviceCode.user_code}`
+        });
+        // 3. Poll for authorization
+        let interval = deviceCode.interval ?? 5;
+        const deadline = Date.now() + deviceCode.expires_in * 1000;
+        while (Date.now() < deadline) {
+            if (callbacks.signal?.aborted) {
+                throw new Error('Login cancelled');
+            }
+            await new Promise((resolve, reject) => {
+                const timeoutId = setTimeout(resolve, interval * 1000);
+                if (callbacks.signal) {
+                    callbacks.signal.addEventListener('abort', () => {
+                        clearTimeout(timeoutId);
+                        reject(new Error('Login cancelled'));
+                    }, { once: true });
+                }
+            });
+            let response;
+            try {
+                response = await fetch(`${AUTH_SERVICE_URL}/auth/device/token`, {
+                    method: 'POST',
+                    headers: { 'Content-Type': 'application/json' },
+                    body: JSON.stringify({
+                        device_code: deviceCode.device_code,
+                        code_verifier: codeVerifier,
+                        grant_type: 'urn:ietf:params:oauth:grant-type:device_code'
+                    }),
+                    signal: callbacks.signal
+                });
+            }
+            catch {
+                // Network error — keep polling
+                continue;
+            }
+            if (response.ok) {
+                const tokens = await response.json();
+                return {
+                    access: tokens.accessToken,
+                    refresh: tokens.refreshToken,
+                    expires: tokens.accessExpiresAt - REFRESH_BUFFER_MS
+                };
+            }
+            const errorData = await response.json().catch(() => ({ error: 'unknown' }));
+            const errorType = errorData.error;
+            if (errorType === 'authorization_pending') {
+                continue;
+            }
+            else if (errorType === 'slow_down') {
+                interval = errorData.interval ?? interval + 5;
+                continue;
+            }
+            else if (errorType === 'expired_token') {
+                throw new Error('Device code expired. Please try /login again.');
+            }
+            else if (errorType === 'access_denied') {
+                throw new Error('Authorization denied.');
+            }
+            else {
+                throw new Error(errorData.error_description ?? errorData.error ?? 'Login failed');
+            }
+        }
+        throw new Error('Device code expired. Please try /login again.');
+    },
+    async refreshToken(credentials) {
+        const response = await fetch(`${AUTH_SERVICE_URL}/auth/refresh`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({
+                refreshToken: credentials.refresh,
+                token_delivery: 'body',
+                platform: PLATFORM
+            })
+        });
+        if (!response.ok) {
+            const data = await response.json().catch(() => ({}));
+            throw new Error(data.error ?? `Token refresh failed: ${response.status}`);
+        }
+        const tokens = await response.json();
+        return {
+            access: tokens.accessToken,
+            refresh: tokens.refreshToken,
+            expires: tokens.accessExpiresAt - REFRESH_BUFFER_MS
+        };
+    },
+    getApiKey(credentials) {
+        return credentials.access;
+    }
+};
+//# sourceMappingURL=shortcut-oauth.js.map

package/dist/custom/constants.js

@@ -0,0 +1,21 @@
+/**
+ * Shortcut production constants.
+ *
+ * These are the defaults when no .env file is present (i.e. installed product).
+ * For local development, create a .env file to override — see .env.development.
+ *
+ * Every env var listed here can be overridden via process.env.
+ */
+// -- Shortcut infrastructure URLs ------------------------------------------
+/** LLM proxy — routes LLM calls through the Python backend (auth, credits, model allowlist). */
+export const SHORTCUT_LLM_PROXY_URL = process.env.SHORTCUT_LLM_PROXY_URL ?? 'https://agent.shortcut.ai';
+/** Auth service — device code OAuth flow, token refresh. */
+export const SHORTCUT_AUTH_URL = process.env.SHORTCUT_AUTH_URL ?? 'https://auth.shortcut.ai';
+/** API service — credit balance, billing. */
+export const SHORTCUT_API_URL = process.env.SHORTCUT_API_URL ?? 'https://api.shortcut.ai';
+// -- Dev mode --------------------------------------------------------------
+// DEV_MODE lives in config.ts (layer-0) so modes/ can import it without boundary violations.
+// -- Excel XLL -------------------------------------------------------------
+/** ShortcutXL HTTP server (always localhost — runs in-process with Excel). */
+export const EXCEL_HTTP_URL = process.env.EXCEL_HTTP_URL ?? 'http://127.0.0.1:8080';
+//# sourceMappingURL=constants.js.map

package/dist/custom/context/workbook-summary.js

@@ -0,0 +1,73 @@
+/**
+ * Fetch a workbook summary from the running Excel instance via ShortcutXL.
+ *
+ * POSTs a small Python snippet to the XLL /exec endpoint that reads:
+ * - All open workbooks (not just the active one)
+ * - All sheet names with their used ranges per workbook
+ * - Which workbook and sheet are currently active
+ *
+ * Output format: first line is comma-separated workbook names (for easy parsing),
+ * followed by the full summary for the LLM.
+ */
+import { EXCEL_HTTP_URL } from '../constants.js';
+const SUMMARY_CODE = `
+from shortcut_xl import xl_app
+app = xl_app()
+if app.Workbooks.Count == 0:
+    print("")
+else:
+    active_wb = app.ActiveWorkbook
+    active_ws = app.ActiveSheet
+    active_wb_name = active_wb.Name if active_wb else None
+    active_ws_name = active_ws.Name if active_ws else None
+    names = [wb.Name for wb in app.Workbooks]
+    print(",".join(names))
+    for wb in app.Workbooks:
+        wb_marker = " (active)" if wb.Name == active_wb_name else ""
+        print(f"Workbook: {wb.Name}{wb_marker}")
+        print("Sheets and their used ranges:")
+        for ws in wb.Worksheets:
+            used = ws.UsedRange
+            addr = used.Address.replace("$", "")
+            ws_marker = " (active)" if wb.Name == active_wb_name and ws.Name == active_ws_name else ""
+            print(f"  {ws.Name}: {addr}{ws_marker}")
+`.trim();
+/**
+ * Fetch the current workbook summary from Excel.
+ * Returns the raw summary string or null if unavailable.
+ * First line is comma-separated workbook names; rest is the full summary.
+ */
+export async function fetchWorkbookSummary(httpUrl) {
+    const baseUrl = httpUrl ?? EXCEL_HTTP_URL;
+    try {
+        const response = await fetch(`${baseUrl}/exec`, {
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json' },
+            body: JSON.stringify({ code: SUMMARY_CODE }),
+            signal: AbortSignal.timeout(3000)
+        });
+        const result = (await response.json());
+        const output = result.ok ? result.output?.trim() : '';
+        return output || null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Extract workbook names from the first line of a summary. */
+export function parseWorkbookNames(summary) {
+    const firstLine = summary.split('\n')[0];
+    return firstLine
+        ? firstLine
+            .split(',')
+            .map((n) => n.trim())
+            .filter(Boolean)
+        : [];
+}
+/** Format summary as an LLM context block (strips the names header line). */
+export function formatSummaryForLlm(summary) {
+    const lines = summary.split('\n');
+    const body = lines.slice(1).join('\n');
+    return `\n\n# Brief summary of the current open workbooks and sheets *(NOT an attachment)*\n\n${body}`;
+}
+//# sourceMappingURL=workbook-summary.js.map

package/dist/custom/credits/shortcut-credits.js

@@ -0,0 +1,29 @@
+/**
+ * Shortcut credit balance fetcher.
+ *
+ * Fetches the user's remaining credits from the Shortcut API
+ * and exposes them for display in the footer.
+ */
+import { SHORTCUT_API_URL as API_BASE_URL } from '../constants.js';
+/**
+ * Fetch the current credit balance for a Shortcut-authenticated user.
+ * Returns null on any failure (network, auth, etc.) — never throws.
+ */
+export async function fetchCreditBalance(accessToken) {
+    try {
+        const response = await fetch(`${API_BASE_URL}/api/credits/balance`, {
+            headers: { Authorization: `Bearer ${accessToken}` }
+        });
+        if (!response.ok)
+            return null;
+        const data = await response.json();
+        return {
+            creditsRemaining: data.creditsRemaining ?? 0,
+            isUnlimited: data.isUnlimited ?? false
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=shortcut-credits.js.map

package/dist/custom/cron/cron-daemon-entry.js

@@ -0,0 +1,18 @@
+/**
+ * Cron daemon entry point.
+ *
+ * Called via `node dist/cli.js cron-daemon` (dispatched from main.ts).
+ * Minimal startup: auth refresh + daemon tick loop. No TUI, no tools.
+ */
+import { AuthStorage } from '../../core/auth-storage.js';
+import { startProactiveRefresh } from '../auth/refresh-timer.js';
+import { SHORTCUT_PROVIDER_ID } from '../providers/provider-ids.js';
+import { startDaemonLoop } from './daemon.js';
+export async function runCronDaemon() {
+    // Keep OAuth tokens fresh for spawned agent processes
+    const authStorage = AuthStorage.create();
+    startProactiveRefresh(authStorage, SHORTCUT_PROVIDER_ID);
+    // Start the tick loop (runs forever until SIGTERM)
+    await startDaemonLoop();
+}
+//# sourceMappingURL=cron-daemon-entry.js.map

package/dist/custom/cron/daemon-ipc.js

@@ -0,0 +1,131 @@
+/**
+ * Daemon IPC — start, stop, and query the cron daemon process.
+ *
+ * The daemon is a detached child process that outlives the parent.
+ * Communication is via PID file + signals (no sockets needed).
+ */
+import { spawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveOwnBinary } from '../../config.js';
+import { getCronDir } from './store.js';
+export function getDaemonPidPath() {
+    return path.join(getCronDir(), 'daemon.pid');
+}
+function getDaemonLogPath() {
+    return path.join(getCronDir(), 'daemon.log');
+}
+/** Check if the daemon is alive by reading the PID file and pinging the process. */
+export function getDaemonStatus() {
+    let pid;
+    try {
+        const raw = fs.readFileSync(getDaemonPidPath(), 'utf-8').trim();
+        pid = parseInt(raw, 10);
+        if (!Number.isFinite(pid) || pid <= 0)
+            return { running: false };
+    }
+    catch {
+        return { running: false };
+    }
+    try {
+        process.kill(pid, 0); // signal 0 = existence check
+        return { running: true, pid };
+    }
+    catch {
+        // Stale PID file — process is gone
+        cleanupPidFile();
+        return { running: false };
+    }
+}
+export function isDaemonRunning() {
+    return getDaemonStatus().running;
+}
+// ---------------------------------------------------------------------------
+// Start
+// ---------------------------------------------------------------------------
+/** Spawn the daemon as a detached background process. Returns the PID. */
+export async function startDaemon() {
+    const status = getDaemonStatus();
+    if (status.running && status.pid) {
+        return { pid: status.pid, alreadyRunning: true };
+    }
+    await fs.promises.mkdir(getCronDir(), { recursive: true, mode: 0o700 });
+    const [cmd, ...args] = resolveOwnBinary();
+    // Wrap fd in try/finally to prevent leak on spawn error
+    const logFd = fs.openSync(getDaemonLogPath(), 'a');
+    let child;
+    try {
+        child = spawn(cmd, [...args, 'cron-daemon'], {
+            detached: true,
+            stdio: ['ignore', logFd, logFd],
+            cwd: process.env.HOME ?? process.cwd()
+        });
+    }
+    finally {
+        fs.closeSync(logFd);
+    }
+    // Guard against undefined pid (spawn failure)
+    if (!child.pid) {
+        throw new Error('Failed to spawn cron daemon process');
+    }
+    const pid = child.pid;
+    child.unref();
+    // PID file is written by the daemon itself (daemon.ts startDaemonLoop).
+    // Poll briefly for it to appear so callers get an accurate status.
+    for (let i = 0; i < 20; i++) {
+        await new Promise((r) => setTimeout(r, 50));
+        try {
+            fs.accessSync(getDaemonPidPath());
+            break;
+        }
+        catch {
+            // Not yet
+        }
+    }
+    return { pid, alreadyRunning: false };
+}
+// ---------------------------------------------------------------------------
+// Stop
+// ---------------------------------------------------------------------------
+/** Stop the daemon by sending SIGTERM. Returns true if the daemon was running. */
+export async function stopDaemon() {
+    const status = getDaemonStatus();
+    if (!status.running || !status.pid)
+        return false;
+    try {
+        process.kill(status.pid, 'SIGTERM');
+    }
+    catch {
+        // Process already gone
+    }
+    // Wait for process to exit before cleaning up PID file
+    const pid = status.pid;
+    let exited = false;
+    for (let i = 0; i < 20; i++) {
+        await new Promise((r) => setTimeout(r, 50));
+        try {
+            process.kill(pid, 0);
+        }
+        catch {
+            exited = true;
+            break;
+        }
+    }
+    if (exited) {
+        cleanupPidFile();
+    }
+    // If not exited after 1s, leave PID file so isDaemonRunning() still reports true
+    return true;
+}
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+function cleanupPidFile() {
+    try {
+        fs.unlinkSync(getDaemonPidPath());
+    }
+    catch {
+        // Best effort
+    }
+}
+//# sourceMappingURL=daemon-ipc.js.map

package/dist/custom/cron/daemon.js

@@ -0,0 +1,224 @@
+/**
+ * Cron daemon — background timer loop that executes due jobs.
+ *
+ * Runs as a detached Node process (spawned via daemon-ipc.ts).
+ * On each tick: load store → find due jobs → execute sequentially → save.
+ */
+import { spawn as nodeSpawn } from 'node:child_process';
+import fs from 'node:fs';
+import path from 'node:path';
+import { resolveOwnBinary } from '../../config.js';
+import { getDaemonPidPath } from './daemon-ipc.js';
+import { applyJobResult, isJobDue, normalizeJobState } from './jobs.js';
+import { appendRunLog, truncateRunOutput } from './run-log.js';
+import { clearStoreCache, getCronStorePath, loadCronStore, saveCronStore } from './store.js';
+// ---------------------------------------------------------------------------
+// Constants
+// ---------------------------------------------------------------------------
+/** Tick interval — poll this often. */
+const TICK_INTERVAL_MS = 60_000;
+/** Timeout for a single job execution. */
+const JOB_TIMEOUT_MS = 10 * 60_000; // 10 minutes
+/** Max captured output per stream (stdout/stderr) to prevent OOM. */
+const MAX_OUTPUT_BYTES = 1024 * 1024; // 1 MB
+// ---------------------------------------------------------------------------
+// State
+// ---------------------------------------------------------------------------
+let tickTimer = null;
+let stopping = false;
+let activeChild = null;
+// ---------------------------------------------------------------------------
+// Job execution
+// ---------------------------------------------------------------------------
+/** Spawn the agent binary in print mode for a job's payload. */
+function spawnAgentForJob(job) {
+    return new Promise((resolve) => {
+        const [cmd, ...baseArgs] = resolveOwnBinary();
+        const args = [
+            ...baseArgs,
+            '-p',
+            '--no-session',
+            ...(job.payload.model ? ['--model', job.payload.model] : []),
+            job.payload.message
+        ];
+        let stdout = '';
+        let stderr = '';
+        let settled = false;
+        const child = nodeSpawn(cmd, args, {
+            stdio: ['ignore', 'pipe', 'pipe'],
+            cwd: process.env.HOME ?? process.cwd()
+        });
+        activeChild = child;
+        child.stdout?.on('data', (chunk) => {
+            if (stdout.length < MAX_OUTPUT_BYTES)
+                stdout += chunk.toString();
+        });
+        child.stderr?.on('data', (chunk) => {
+            if (stderr.length < MAX_OUTPUT_BYTES)
+                stderr += chunk.toString();
+        });
+        let escalation = null;
+        const timeout = setTimeout(() => {
+            child.kill('SIGTERM');
+            stderr += '\n[daemon] Job timed out';
+            // Escalate to SIGKILL if process doesn't exit within 5s
+            escalation = setTimeout(() => child.kill('SIGKILL'), 5_000);
+            escalation.unref();
+        }, JOB_TIMEOUT_MS);
+        child.on('close', (code) => {
+            if (settled)
+                return;
+            settled = true;
+            activeChild = null;
+            clearTimeout(timeout);
+            if (escalation)
+                clearTimeout(escalation);
+            resolve({
+                exitCode: code ?? 1,
+                output: stdout.trim(),
+                error: stderr.trim()
+            });
+        });
+        child.on('error', (err) => {
+            if (settled)
+                return;
+            settled = true;
+            activeChild = null;
+            clearTimeout(timeout);
+            if (escalation)
+                clearTimeout(escalation);
+            resolve({
+                exitCode: 1,
+                output: '',
+                error: err.message
+            });
+        });
+    });
+}
+async function executeJob(job, storePath) {
+    const startedAt = Date.now();
+    log(`Executing job "${job.name}" (${job.id})`);
+    const { exitCode, output, error } = await spawnAgentForJob(job);
+    const endedAt = Date.now();
+    const result = {
+        status: exitCode === 0 ? 'ok' : 'error',
+        error: exitCode !== 0 ? error || `exit code ${exitCode}` : undefined,
+        startedAt,
+        endedAt
+    };
+    const shouldDelete = applyJobResult(job, result);
+    // Reload store before saving to pick up any concurrent changes
+    clearStoreCache();
+    const store = await loadCronStore(storePath);
+    const storeJob = store.jobs.find((j) => j.id === job.id);
+    if (storeJob) {
+        // Selectively merge only fields that applyJobResult modifies,
+        // preserving any concurrent user changes to other state fields
+        storeJob.state.runningAtMs = job.state.runningAtMs;
+        storeJob.state.lastRunAtMs = job.state.lastRunAtMs;
+        storeJob.state.lastRunStatus = job.state.lastRunStatus;
+        storeJob.state.lastDurationMs = job.state.lastDurationMs;
+        storeJob.state.lastError = job.state.lastError;
+        storeJob.state.consecutiveErrors = job.state.consecutiveErrors;
+        storeJob.state.nextRunAtMs = job.state.nextRunAtMs;
+        storeJob.enabled = job.enabled;
+        storeJob.updatedAtMs = job.updatedAtMs;
+        if (shouldDelete) {
+            store.jobs = store.jobs.filter((j) => j.id !== job.id);
+        }
+    }
+    await saveCronStore(storePath, store);
+    await appendRunLog({
+        jobId: job.id,
+        jobName: job.name,
+        startedAtMs: startedAt,
+        endedAtMs: endedAt,
+        durationMs: endedAt - startedAt,
+        status: result.status,
+        error: result.error,
+        output: output ? truncateRunOutput(output) : undefined
+    });
+    const statusMsg = result.status === 'ok' ? `completed in ${endedAt - startedAt}ms` : `failed: ${result.error}`;
+    log(`Job "${job.name}" ${statusMsg}`);
+}
+// ---------------------------------------------------------------------------
+// Tick loop
+// ---------------------------------------------------------------------------
+async function tick(storePath) {
+    if (stopping)
+        return;
+    try {
+        clearStoreCache();
+        const store = await loadCronStore(storePath);
+        const now = Date.now();
+        // Normalize all jobs (clear stuck runs, repair missing schedules)
+        let storeChanged = false;
+        for (const job of store.jobs) {
+            if (normalizeJobState(job, now))
+                storeChanged = true;
+        }
+        if (storeChanged) {
+            await saveCronStore(storePath, store);
+        }
+        // Find and execute due jobs sequentially
+        const dueJobs = store.jobs.filter((j) => isJobDue(j, now));
+        for (const job of dueJobs) {
+            if (stopping)
+                break;
+            // Mark as running
+            job.state.runningAtMs = Date.now();
+            await saveCronStore(storePath, store);
+            await executeJob(job, storePath);
+        }
+    }
+    catch (err) {
+        log(`Tick error: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    armTimer(storePath);
+}
+function armTimer(storePath) {
+    if (stopping)
+        return;
+    if (tickTimer)
+        clearTimeout(tickTimer);
+    tickTimer = setTimeout(() => void tick(storePath), TICK_INTERVAL_MS);
+    tickTimer.unref();
+}
+// ---------------------------------------------------------------------------
+// Lifecycle
+// ---------------------------------------------------------------------------
+function log(msg) {
+    const ts = new Date().toISOString();
+    process.stdout.write(`[${ts}] ${msg}\n`);
+}
+/** Start the daemon tick loop. Call from the daemon entry point. */
+export async function startDaemonLoop(storePath = getCronStorePath()) {
+    log('Cron daemon starting');
+    // Write PID file
+    await fs.promises.mkdir(path.dirname(getDaemonPidPath()), { recursive: true, mode: 0o700 });
+    await fs.promises.writeFile(getDaemonPidPath(), String(process.pid), { mode: 0o600 });
+    // Handle shutdown signals
+    const shutdown = () => {
+        log('Cron daemon shutting down');
+        stopping = true;
+        if (tickTimer) {
+            clearTimeout(tickTimer);
+            tickTimer = null;
+        }
+        if (activeChild) {
+            activeChild.kill('SIGTERM');
+        }
+        try {
+            fs.unlinkSync(getDaemonPidPath());
+        }
+        catch {
+            // best effort
+        }
+        process.exit(0);
+    };
+    process.on('SIGTERM', shutdown);
+    process.on('SIGINT', shutdown);
+    // Run first tick immediately
+    await tick(storePath);
+}
+//# sourceMappingURL=daemon.js.map