shortcutxl 0.2.19 → 0.2.21

package/dist/custom/sandbox/sandbox-config.js

@@ -1,153 +0,0 @@
-/**
- * Bubblewrap argument builder for WSL2 sandbox.
- *
- * Resolves sandbox settings into concrete mount points and builds
- * the bwrap command-line arguments.
- */
-import { spawnSync } from 'child_process';
-import { join } from 'path';
-import { getAgentDir } from '../../config.js';
-import { toLinuxPath } from './sandbox-paths.js';
-/** Hardcoded WSL distro name for the sandbox. */
-export const SANDBOX_DISTRO = 'shortcutxl';
-/** /etc entries to individually bind-mount when network is enabled. */
-const ETC_ENTRIES = ['/etc/passwd', '/etc/group', '/etc/hosts', '/etc/ssl', '/etc/apk'];
-/**
- * Resolve sandbox settings + cwd into concrete sandbox state.
- *
- * Converts Windows paths to Linux /mnt/ paths and probes the WSL
- * filesystem so that `buildBwrapArgs` needs no I/O.
- */
-export function resolveSandboxConfig(settings, cwd) {
-    const distro = SANDBOX_DISTRO;
-    const cwdLinux = toLinuxPath(cwd);
-    // Settings must have concrete values — populated by migration or setSandboxMode.
-    const readMounts = (settings.readPaths ?? []).map(toLinuxPath);
-    const writeMounts = (settings.writePaths ?? []).map(toLinuxPath);
-    // pipDir is under getAgentDir() (covered by default writePaths) but we
-    // still need the concrete path for PYTHONUSERBASE / PATH env vars.
-    const pipDir = toLinuxPath(join(getAgentDir(), 'pip-packages'));
-    // Probe WSL filesystem once (cached per session) so buildBwrapArgs is pure
-    const networkMode = settings.network ?? 'none';
-    const needsNetwork = networkMode !== 'none';
-    return {
-        distro,
-        readMounts,
-        writeMounts,
-        workdir: cwdLinux,
-        pipDir,
-        networkMode,
-        hasLib64: existsInWsl(distro, '/lib64'),
-        resolvedResolvConf: needsNetwork ? resolveWslPath(distro, '/etc/resolv.conf') : null,
-        existingEtcEntries: needsNetwork ? ETC_ENTRIES.filter((e) => existsInWsl(distro, e)) : [],
-    };
-}
-/**
- * Build bwrap command-line arguments from sandbox state.
- * Pure function — all I/O was done at resolve time.
- */
-export function buildBwrapArgs(config) {
-    const args = [];
-    // System mounts (read-only)
-    args.push('--ro-bind', '/usr', '/usr');
-    args.push('--ro-bind', '/bin', '/bin');
-    args.push('--ro-bind', '/lib', '/lib');
-    if (config.hasLib64) {
-        args.push('--ro-bind', '/lib64', '/lib64');
-    }
-    // /etc handling: WSL auto-generates /etc/resolv.conf as a symlink to
-    // /mnt/wsl/resolv.conf. A plain --ro-bind /etc /etc mounts the static
-    // rootfs /etc which doesn't have the symlink target, breaking DNS.
-    // When network is needed, mount /etc as tmpfs and bind individual entries.
-    if (config.networkMode !== 'none') {
-        args.push('--tmpfs', '/etc');
-        for (const entry of config.existingEtcEntries) {
-            args.push('--ro-bind', entry, entry);
-        }
-        if (config.resolvedResolvConf) {
-            args.push('--ro-bind', config.resolvedResolvConf, '/etc/resolv.conf');
-        }
-    }
-    else {
-        args.push('--ro-bind', '/etc', '/etc');
-    }
-    // Kernel interfaces
-    args.push('--proc', '/proc');
-    args.push('--dev', '/dev');
-    args.push('--tmpfs', '/tmp');
-    // User-configured read-only mounts
-    for (const path of config.readMounts) {
-        args.push('--ro-bind', path, path);
-    }
-    // User-configured read-write mounts
-    for (const path of config.writeMounts) {
-        args.push('--bind', path, path);
-    }
-    // Network isolation
-    if (config.networkMode === 'none') {
-        args.push('--unshare-net');
-    }
-    else if (config.networkMode === 'proxy') {
-        // Proxy mode: fully isolated network namespace. The only way out is
-        // through the proxy socket, which is bind-mounted into the sandbox.
-        // socat inside bwrap bridges the socket to TCP, and HTTP_PROXY env
-        // vars route all traffic through it. DNS also goes through the proxy.
-        args.push('--unshare-net');
-        if (config.proxySocketPath) {
-            args.push('--bind', config.proxySocketPath, config.proxySocketPath);
-        }
-    }
-    // 'full' mode: no --unshare-net — full unrestricted network
-    // Python: user-install to persistent dir, bypass PEP 668 externally-managed check
-    // (safe — rootfs is read-only, packages go to our isolated PYTHONUSERBASE)
-    args.push('--setenv', 'PYTHONUSERBASE', config.pipDir);
-    args.push('--setenv', 'PIP_USER', '1');
-    args.push('--setenv', 'PIP_BREAK_SYSTEM_PACKAGES', '1');
-    args.push('--setenv', 'PATH', `${config.pipDir}/bin:/usr/local/bin:/usr/bin:/bin`);
-    // Cleanup on agent exit
-    args.push('--die-with-parent');
-    // Working directory
-    args.push('--chdir', config.workdir);
-    return args;
-}
-// Cache WSL path lookups — these don't change during a session
-const wslPathCache = new Map();
-/** Resolve a potentially-symlinked path inside the WSL distro to its real path. */
-function resolveWslPath(distro, path) {
-    const key = `resolve:${distro}:${path}`;
-    if (wslPathCache.has(key))
-        return wslPathCache.get(key);
-    try {
-        const result = spawnSync('wsl', ['-d', distro, '--', 'readlink', '-f', path], {
-            timeout: 3000,
-            encoding: 'utf-8',
-            windowsHide: true,
-        });
-        const resolved = result.status === 0 ? (result.stdout ?? '').trim() || null : null;
-        wslPathCache.set(key, resolved);
-        return resolved;
-    }
-    catch {
-        wslPathCache.set(key, null);
-        return null;
-    }
-}
-/** Check if a path exists (file or directory) inside the WSL distro. Cached per session. */
-function existsInWsl(distro, path) {
-    const key = `exists:${distro}:${path}`;
-    if (wslPathCache.has(key))
-        return wslPathCache.get(key) !== null;
-    try {
-        const result = spawnSync('wsl', ['-d', distro, '--', 'test', '-e', path], {
-            timeout: 3000,
-            windowsHide: true,
-        });
-        wslPathCache.set(key, result.status === 0 ? 'true' : null);
-        return result.status === 0;
-    }
-    catch {
-        wslPathCache.set(key, null);
-        return false;
-    }
-}
-//# sourceMappingURL=sandbox-config.js.map

package/dist/custom/sandbox/sandbox-smoke.js

@@ -1,49 +0,0 @@
-/**
- * Smoke test for the WSL2 sandbox distro.
- *
- * Verifies that all expected binaries and Python packages are available.
- * Runs after import and on every startup when sandbox is active.
- */
-import { spawnSync } from 'child_process';
-/** Binaries that must exist in the distro. */
-const REQUIRED_BINARIES = ['bwrap', 'bash', 'python3', 'pip', 'curl', 'socat'];
-/** Python packages that must be importable. */
-const REQUIRED_PYTHON_PACKAGES = ['openpyxl', 'httpx'];
-/**
- * Run a quick smoke test against the sandbox distro.
- * Each check is independent — all run even if earlier ones fail.
- */
-export function runSandboxSmokeTest(distro) {
-    const checks = [];
-    // Check binaries
-    for (const bin of REQUIRED_BINARIES) {
-        const result = spawnSync('wsl', ['-d', distro, '--', 'which', bin], {
-            timeout: 5000,
-            encoding: 'utf-8',
-            windowsHide: true
-        });
-        checks.push({
-            name: bin,
-            ok: result.status === 0,
-            detail: result.status === 0
-                ? (result.stdout ?? '').trim()
-                : `not found`
-        });
-    }
-    // Check each Python package individually for clear pass/fail per package
-    for (const pkg of REQUIRED_PYTHON_PACKAGES) {
-        const result = spawnSync('wsl', ['-d', distro, '--', 'python3', '-c', `import ${pkg}; print(${pkg}.__version__)`], { timeout: 5000, encoding: 'utf-8', windowsHide: true });
-        checks.push({
-            name: `python:${pkg}`,
-            ok: result.status === 0,
-            detail: result.status === 0
-                ? (result.stdout ?? '').trim()
-                : 'import failed'
-        });
-    }
-    return {
-        ok: checks.every(c => c.ok),
-        checks
-    };
-}
-//# sourceMappingURL=sandbox-smoke.js.map

package/dist/custom/sandbox/wsl-setup.js

@@ -1,92 +0,0 @@
-/**
- * WSL2 distro import and bubblewrap installation.
- *
- * Uses the Alpine rootfs tarball shipped in the npm package (agent/wsl/).
- * No downloads needed — everything is bundled.
- */
-import { existsSync, mkdirSync } from 'fs';
-import { join } from 'path';
-import { spawnSync } from 'child_process';
-import { getAlpineRootfsPath } from '../../config.js';
-import { isWsl2Available, isDistroInstalled, clearDetectionCache } from './wsl-detect.js';
-import { runSandboxSmokeTest } from './sandbox-smoke.js';
-/**
- * Ensure the WSL2 sandbox distro is ready.
- *
- * Steps:
- * 1. Verify WSL2 is available
- * 2. Check if distro already exists → smoke test
- * 3. Import shipped Alpine rootfs via `wsl --import` → smoke test
- *
- * The rootfs is pre-baked with all required packages (bwrap, python3, etc).
- * If the smoke test fails, the user should reinstall the package.
- */
-export async function ensureWslSandbox(options) {
-    const { distro, wslDir } = options;
-    // 1. Check WSL2
-    if (!isWsl2Available()) {
-        return { installed: false, error: 'WSL2 is not available' };
-    }
-    // 2. Already installed? Run smoke test to verify packages present.
-    if (isDistroInstalled(distro)) {
-        const smoke = runSandboxSmokeTest(distro);
-        if (smoke.ok) {
-            return { installed: true };
-        }
-        const failed = smoke.checks.filter(c => !c.ok).map(c => c.name);
-        return {
-            installed: false,
-            error: `Missing packages: ${failed.join(', ')}`
-        };
-    }
-    // 3. Import shipped rootfs
-    const rootfsPath = getAlpineRootfsPath();
-    if (!existsSync(rootfsPath)) {
-        return {
-            installed: false,
-            error: `Alpine rootfs not found at ${rootfsPath}`
-        };
-    }
-    const installDir = join(wslDir, distro);
-    if (!existsSync(installDir)) {
-        mkdirSync(installDir, { recursive: true });
-    }
-    const importResult = spawnSync('wsl', ['--import', distro, installDir, rootfsPath, '--version', '2'], { timeout: 60_000, encoding: 'utf-8', windowsHide: true });
-    if (importResult.status !== 0) {
-        return {
-            installed: false,
-            error: `WSL import failed: ${(importResult.stderr ?? '').replace(/\0/g, '')}`
-        };
-    }
-    clearDetectionCache();
-    // 4. Smoke test — baked rootfs should have everything
-    const smoke = runSandboxSmokeTest(distro);
-    if (smoke.ok) {
-        return { installed: true };
-    }
-    const failed = smoke.checks.filter(c => !c.ok).map(c => c.name);
-    return {
-        installed: false,
-        error: `Missing packages: ${failed.join(', ')}`
-    };
-}
-/**
- * Enable WSL2 on a machine that doesn't have it yet.
- * Requires admin privileges (will trigger UAC prompt).
- * Returns true if a reboot is needed.
- */
-export function enableWsl2() {
-    const result = spawnSync('wsl', ['--install', '--no-distribution'], { timeout: 120_000, encoding: 'utf-8', windowsHide: true });
-    const output = ((result.stdout ?? '') + (result.stderr ?? '')).replace(/\0/g, '');
-    if (result.status === 0) {
-        // Check if reboot is needed (WSL prints a message about it)
-        const needsReboot = /reboot|restart/i.test(output);
-        return { success: true, needsReboot };
-    }
-    return {
-        success: false,
-        needsReboot: false,
-        error: output || 'Failed to enable WSL2'
-    };
-}
-//# sourceMappingURL=wsl-setup.js.map

package/dist/custom/tools/task/agents.js

@@ -1,6 +0,0 @@
-/**
- * Re-exports — agent definitions now live in custom/agents/.
- */
-export { buildTaskToolDescription, getSubagent, getSubagentNames } from '../../agents/index.js';
-export { buildAgentArgs } from './subprocess.js';
-//# sourceMappingURL=agents.js.map