shortcutxl 0.2.19 → 0.2.21

package/xll/python/Lib/site-packages/pip-26.0.1.dist-info/RECORD

@@ -1,6 +1,6 @@
-../../Scripts/pip.exe,sha256=WUxPGfKVYqi6pL-dP6dmpiVGzK6S0_wAEp92hdMDPRM,108390
-../../Scripts/pip3.12.exe,sha256=WUxPGfKVYqi6pL-dP6dmpiVGzK6S0_wAEp92hdMDPRM,108390
-../../Scripts/pip3.exe,sha256=WUxPGfKVYqi6pL-dP6dmpiVGzK6S0_wAEp92hdMDPRM,108390
+../../Scripts/pip.exe,sha256=4_QS5yA5JhuG4MAWTsGrxamccPGe1rRH7tfxee6TXfI,108390
+../../Scripts/pip3.12.exe,sha256=4_QS5yA5JhuG4MAWTsGrxamccPGe1rRH7tfxee6TXfI,108390
+../../Scripts/pip3.exe,sha256=4_QS5yA5JhuG4MAWTsGrxamccPGe1rRH7tfxee6TXfI,108390
 pip-26.0.1.dist-info/INSTALLER,sha256=zuuue4knoyJ-UwPPXg8fezS7VCrXJQrAP7zeNuwvFQg,4
 pip-26.0.1.dist-info/METADATA,sha256=ZqIZuNGsG6l2gHiKlQjVQghFQhgSWfhEDHuCVPW3aN8,4675
 pip-26.0.1.dist-info/RECORD,,

package/dist/custom/ensure-excel.js

@@ -1,63 +0,0 @@
-/**
- * Ensure Excel is running with the ShortcutXL add-in loaded.
- *
- * 1. Ping the XLL HTTP server.
- * 2. If unreachable, launch Excel via COM (no splash screen) and register the XLL.
- * 3. Wait for the HTTP server to become available.
- */
-import { execSync } from 'child_process';
-import { existsSync } from 'fs';
-import { getXllPath } from '../config.js';
-import { EXCEL_HTTP_URL } from './constants.js';
-function resolveXllPath() {
-    const candidate = getXllPath();
-    return existsSync(candidate) ? candidate : null;
-}
-async function isXllReachable(url) {
-    try {
-        const res = await fetch(`${url}/ping`, { signal: AbortSignal.timeout(2000) });
-        return res.ok;
-    }
-    catch {
-        return false;
-    }
-}
-function launchExcelWithXll(xllPath) {
-    const script = [
-        '$xl = New-Object -ComObject Excel.Application',
-        '$xl.Visible = $true',
-        '$xl.Workbooks.Add() | Out-Null',
-        `$xl.RegisterXLL('${xllPath.replace(/'/g, "''")}') | Out-Null`
-    ].join('; ');
-    // Base64-encode the script to avoid all shell quoting issues.
-    const encoded = Buffer.from(script, 'utf16le').toString('base64');
-    execSync(`powershell -NoProfile -EncodedCommand ${encoded}`, {
-        stdio: 'ignore',
-        timeout: 30_000
-    });
-}
-/**
- * Ensure Excel + XLL are running. Returns true if the HTTP server is reachable
- * after this call, false if we couldn't start Excel.
- */
-export async function ensureExcel() {
-    if (await isXllReachable(EXCEL_HTTP_URL))
-        return true;
-    const xllPath = resolveXllPath();
-    if (!xllPath)
-        return false;
-    try {
-        launchExcelWithXll(xllPath);
-    }
-    catch {
-        return false;
-    }
-    // Wait for the HTTP server to come up (XLL init takes a moment)
-    for (let i = 0; i < 15; i++) {
-        await new Promise((r) => setTimeout(r, 1000));
-        if (await isXllReachable(EXCEL_HTTP_URL))
-            return true;
-    }
-    return false;
-}
-//# sourceMappingURL=ensure-excel.js.map

package/dist/custom/sandbox/network/index.js

@@ -1,8 +0,0 @@
-/**
- * Network proxy subsystem for the sandbox.
- *
- * Provides domain-level network control via an HTTP CONNECT proxy
- * running inside WSL, with interactive approval prompts.
- */
-export { startNetworkProxy, deployProxyWorker, isDomainAllowed } from './network-proxy.js';
-//# sourceMappingURL=index.js.map

package/dist/custom/sandbox/network/network-proxy.js

@@ -1,136 +0,0 @@
-/**
- * Network proxy manager for the sandbox.
- *
- * Spawns a proxy worker inside WSL that listens on a Unix socket.
- * Domain approval requests are forwarded to the agent process via IPC.
- */
-import { spawn, spawnSync } from 'child_process';
-import { readFileSync } from 'fs';
-import { createInterface } from 'readline';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-import { SANDBOX_DISTRO } from '../sandbox-config.js';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/**
- * Start the network proxy worker inside WSL.
- *
- * The worker runs outside bwrap (so it has network access) and listens
- * on a Unix socket that gets bind-mounted into the sandbox. Inside bwrap,
- * socat bridges the socket to TCP and HTTP_PROXY routes all traffic through it.
- */
-export function startNetworkProxy(config) {
-    return new Promise((resolve, reject) => {
-        const socketPath = `/tmp/shortcut-proxy-${process.pid}.sock`;
-        const allowedSet = new Set(config.allowedDomains);
-        // Spawn the Python proxy worker inside WSL (outside bwrap — full network access)
-        const child = spawn('wsl', ['-d', SANDBOX_DISTRO, '--', 'python3', '/tmp/shortcut-proxy-worker.py', socketPath], {
-            stdio: ['pipe', 'pipe', 'pipe'],
-            windowsHide: true
-        });
-        let settled = false;
-        const rl = createInterface({ input: child.stdout });
-        rl.on('line', async (line) => {
-            try {
-                const msg = JSON.parse(line);
-                if (msg.type === 'ready') {
-                    if (!settled) {
-                        settled = true;
-                        resolve({
-                            socketPath: msg.socket,
-                            stop: () => {
-                                child.kill('SIGTERM');
-                            }
-                        });
-                    }
-                }
-                else if (msg.type === 'error') {
-                    if (!settled) {
-                        settled = true;
-                        reject(new Error(`Proxy worker error: ${msg.message}`));
-                    }
-                }
-                else if (msg.type === 'check') {
-                    const domain = msg.domain;
-                    const id = msg.id;
-                    // Check allowlist first (exact match and wildcard)
-                    let allowed = isDomainAllowed(domain, allowedSet);
-                    if (!allowed) {
-                        const choice = await config.onDomainCheck(domain);
-                        allowed = choice !== false;
-                        if (choice === 'always') {
-                            // Add to runtime set so this session skips the prompt too
-                            allowedSet.add(domain);
-                        }
-                        // 'once' — allowed this request only, prompt again next time
-                    }
-                    // Send result back to worker
-                    const result = JSON.stringify({ type: 'result', id, allowed });
-                    child.stdin.write(result + '\n');
-                }
-            }
-            catch {
-                // Ignore malformed lines
-            }
-        });
-        child.on('error', (err) => {
-            if (!settled) {
-                settled = true;
-                reject(err);
-            }
-        });
-        child.on('close', (code) => {
-            if (!settled) {
-                settled = true;
-                reject(new Error(`Proxy worker exited with code ${code}`));
-            }
-        });
-        // Timeout
-        setTimeout(() => {
-            if (!settled) {
-                settled = true;
-                child.kill();
-                reject(new Error('Proxy worker startup timed out'));
-            }
-        }, 10000);
-    });
-}
-/** Domains that are always allowed without prompting (local machine traffic). */
-const ALWAYS_ALLOWED = new Set(['localhost', '127.0.0.1', '::1']);
-/** Check if a domain matches the allowlist (exact or wildcard). */
-export function isDomainAllowed(domain, allowed) {
-    if (ALWAYS_ALLOWED.has(domain))
-        return true;
-    if (allowed.has(domain))
-        return true;
-    // Check wildcard patterns (e.g., *.github.com)
-    for (const pattern of allowed) {
-        if (pattern.startsWith('*.')) {
-            const suffix = pattern.slice(1); // .github.com
-            if (domain.endsWith(suffix) || domain === pattern.slice(2)) {
-                return true;
-            }
-        }
-    }
-    return false;
-}
-/**
- * Deploy the proxy worker script into the WSL distro.
- * Called once during sandbox setup.
- */
-export function deployProxyWorker() {
-    const workerSource = join(__dirname, 'proxy-worker.py');
-    let script;
-    try {
-        script = readFileSync(workerSource, 'utf-8');
-    }
-    catch {
-        return false;
-    }
-    const result = spawnSync('wsl', ['-d', SANDBOX_DISTRO, '--', 'tee', '/tmp/shortcut-proxy-worker.py'], {
-        input: script,
-        timeout: 5000,
-        windowsHide: true
-    });
-    return result.status === 0;
-}
-//# sourceMappingURL=network-proxy.js.map

package/dist/custom/sandbox/network/proxy-worker.py

@@ -1,257 +0,0 @@
-#!/usr/bin/env python3
-"""
-Sandbox network proxy worker — runs inside WSL, outside bwrap.
-
-Listens on a Unix socket and proxies HTTP CONNECT requests.
-Domain approval is delegated to the parent process via stdin/stdout JSON IPC.
-
-Protocol:
-  Worker → Parent:  {"type":"check","id":"<uuid>","domain":"example.com"}
-  Parent → Worker:  {"type":"result","id":"<uuid>","allowed":true}
-  Worker → Parent:  {"type":"ready","socket":"<path>"}
-  Worker → Parent:  {"type":"error","message":"..."}
-"""
-
-import asyncio
-import json
-import os
-import signal
-import socket
-import sys
-import uuid
-
-SOCKET_PATH = sys.argv[1] if len(sys.argv) > 1 else "/tmp/shortcut-proxy.sock"
-
-
-def log(msg: str) -> None:
-    """Debug log to stderr (doesn't interfere with IPC on stdout)."""
-    print(f"[proxy] {msg}", file=sys.stderr, flush=True)
-
-# Pending domain checks: id → asyncio.Future
-pending: dict[str, asyncio.Future[bool]] = {}
-
-
-def send_msg(msg: dict) -> None:
-    """Send a JSON message to the parent process via stdout."""
-    sys.stdout.write(json.dumps(msg) + "\n")
-    sys.stdout.flush()
-
-
-async def read_stdin(loop: asyncio.AbstractEventLoop) -> None:
-    """Read approval results from parent via stdin."""
-    reader = asyncio.StreamReader()
-    transport, _ = await loop.connect_read_pipe(
-        lambda: asyncio.StreamReaderProtocol(reader), sys.stdin
-    )
-    try:
-        while True:
-            line = await reader.readline()
-            if not line:
-                log("stdin EOF — parent closed pipe")
-                break
-            try:
-                msg = json.loads(line)
-                log(f"stdin got: {msg}")
-                if msg.get("type") == "result" and msg.get("id") in pending:
-                    fut = pending.pop(msg["id"])
-                    if not fut.done():
-                        fut.set_result(bool(msg.get("allowed", False)))
-            except (json.JSONDecodeError, KeyError) as e:
-                log(f"stdin parse error: {e}")
-    except Exception as e:
-        log(f"stdin reader crashed: {e}")
-
-
-async def check_domain(domain: str, loop: asyncio.AbstractEventLoop) -> bool:
-    """Ask the parent process whether a domain is allowed."""
-    check_id = str(uuid.uuid4())
-    fut: asyncio.Future[bool] = loop.create_future()
-    pending[check_id] = fut
-    send_msg({"type": "check", "id": check_id, "domain": domain})
-    try:
-        return await asyncio.wait_for(fut, timeout=30.0)
-    except asyncio.TimeoutError:
-        pending.pop(check_id, None)
-        return False
-
-
-class ParsedRequest:
-    """Parsed proxy request — either CONNECT tunnel or plain HTTP forward."""
-    __slots__ = ("method", "host", "port", "is_connect", "raw_data")
-
-    def __init__(self, method: str, host: str, port: int, is_connect: bool, raw_data: bytes):
-        self.method = method
-        self.host = host
-        self.port = port
-        self.is_connect = is_connect
-        self.raw_data = raw_data
-
-
-def parse_proxy_request(data: bytes) -> ParsedRequest | None:
-    """Parse an HTTP proxy request (CONNECT or plain HTTP forward)."""
-    try:
-        first_line = data.split(b"\r\n")[0].decode("utf-8", errors="replace")
-        parts = first_line.split(" ")
-        method = parts[0]
-
-        if method == "CONNECT":
-            host_port = parts[1].split(":")
-            host = host_port[0]
-            port = int(host_port[1]) if len(host_port) > 1 else 443
-            return ParsedRequest(method, host, port, True, data)
-
-        # Plain HTTP: GET http://host/path HTTP/1.1
-        if len(parts) >= 2 and parts[1].startswith("http://"):
-            from urllib.parse import urlparse
-            url = urlparse(parts[1])
-            host = url.hostname or ""
-            port = url.port or 80
-            # Rewrite the request line to use relative path for the upstream server
-            relative_path = url.path or "/"
-            if url.query:
-                relative_path += "?" + url.query
-            rewritten_line = f"{method} {relative_path} {parts[2] if len(parts) > 2 else 'HTTP/1.1'}"
-            # Replace the first line in the raw data
-            rest = data.split(b"\r\n", 1)[1] if b"\r\n" in data else b""
-            rewritten = rewritten_line.encode() + b"\r\n" + rest
-            return ParsedRequest(method, host, port, False, rewritten)
-
-        return None
-    except (IndexError, ValueError):
-        return None
-
-
-async def pipe(reader: asyncio.StreamReader, writer: asyncio.StreamWriter) -> None:
-    """Pipe data from reader to writer until EOF or error."""
-    try:
-        while True:
-            data = await reader.read(65536)
-            if not data:
-                break
-            writer.write(data)
-            await writer.drain()
-    except (ConnectionError, OSError):
-        pass
-    finally:
-        try:
-            writer.close()
-        except OSError:
-            pass
-
-
-async def handle_client(
-    client_reader: asyncio.StreamReader,
-    client_writer: asyncio.StreamWriter,
-    loop: asyncio.AbstractEventLoop,
-) -> None:
-    """Handle a single proxy connection (CONNECT tunnel or plain HTTP forward)."""
-    try:
-        log("new connection")
-        data = await asyncio.wait_for(client_reader.read(8192), timeout=10.0)
-        if not data:
-            log("empty request, closing")
-            client_writer.close()
-            return
-
-        req = parse_proxy_request(data)
-        if req is None:
-            log(f"bad request: {data[:80]!r}")
-            client_writer.write(b"HTTP/1.1 400 Bad Request\r\n\r\n")
-            await client_writer.drain()
-            client_writer.close()
-            return
-
-        log(f"{req.method} {req.host}:{req.port} — checking domain")
-        allowed = await check_domain(req.host, loop)
-        log(f"{req.method} {req.host}:{req.port} — allowed={allowed}")
-        if not allowed:
-            client_writer.write(b"HTTP/1.1 403 Forbidden\r\n\r\nBlocked by sandbox policy\r\n")
-            await client_writer.drain()
-            client_writer.close()
-            return
-
-        # Connect to the target
-        try:
-            log(f"{req.method} {req.host}:{req.port} — opening connection")
-            target_reader, target_writer = await asyncio.wait_for(
-                asyncio.open_connection(req.host, req.port), timeout=10.0
-            )
-            log(f"{req.method} {req.host}:{req.port} — connected")
-        except (OSError, asyncio.TimeoutError) as e:
-            msg = str(e) if str(e) else "Connection failed"
-            log(f"{req.method} {req.host}:{req.port} — connect failed: {msg}")
-            client_writer.write(f"HTTP/1.1 502 Bad Gateway\r\n\r\n{msg}\r\n".encode())
-            await client_writer.drain()
-            client_writer.close()
-            return
-
-        if req.is_connect:
-            # CONNECT tunnel: send 200, then pipe bidirectionally
-            client_writer.write(b"HTTP/1.1 200 Connection Established\r\n\r\n")
-            await client_writer.drain()
-            log(f"CONNECT {req.host}:{req.port} — piping")
-            await asyncio.gather(
-                pipe(client_reader, target_writer),
-                pipe(target_reader, client_writer),
-                return_exceptions=True,
-            )
-        else:
-            # Plain HTTP: forward the rewritten request, pipe response back
-            target_writer.write(req.raw_data)
-            await target_writer.drain()
-            log(f"{req.method} {req.host}:{req.port} — forwarding request, piping response")
-            await asyncio.gather(
-                pipe(client_reader, target_writer),
-                pipe(target_reader, client_writer),
-                return_exceptions=True,
-            )
-
-        log(f"{req.method} {req.host}:{req.port} — done")
-    except (ConnectionError, OSError, asyncio.TimeoutError) as e:
-        log(f"error: {e}")
-    finally:
-        try:
-            client_writer.close()
-        except OSError:
-            pass
-
-
-async def main() -> None:
-    loop = asyncio.get_running_loop()
-
-    # Clean up stale socket
-    if os.path.exists(SOCKET_PATH):
-        try:
-            os.unlink(SOCKET_PATH)
-        except OSError:
-            pass
-
-    # Start reading stdin for approval results.
-    # Hold a reference to prevent GC from destroying the task.
-    stdin_task = asyncio.create_task(read_stdin(loop))
-
-    # Start Unix socket server
-    server = await asyncio.start_unix_server(
-        lambda r, w: handle_client(r, w, loop),
-        path=SOCKET_PATH,
-    )
-
-    send_msg({"type": "ready", "socket": SOCKET_PATH})
-    log(f"listening on {SOCKET_PATH}")
-
-    def cleanup() -> None:
-        server.close()
-        try:
-            os.unlink(SOCKET_PATH)
-        except OSError:
-            pass
-
-    for sig in (signal.SIGTERM, signal.SIGINT):
-        loop.add_signal_handler(sig, lambda: (cleanup(), loop.stop()))
-
-    async with server:
-        await server.serve_forever()
-
-
-if __name__ == "__main__":
-    asyncio.run(main())