shortcutxl 0.2.21 → 0.2.22

package/CHANGELOG.md

@@ -1,10 +1,10 @@
 # Changelog
 
-## [0.2.21]
+## [0.2.22]
 
 - **Tool extensions** — Build custom tools that the agent can call.
 - **Sandbox hardening** — The sandbox now blocks more ways code could escape isolation. When you update ShortcutXL, the sandbox automatically updates itself too.
-- **Smaller package** — Removed ~290MB of accidentally bundled Python packages (cv2, pandas, numpy, etc.).
+- **Faster install** — Sandbox is now downloaded on demand instead of bundled.
 
 ## [0.2.19]
 

package/dist/config.js

@@ -288,9 +288,19 @@ export function getSessionsDir() {
 export function getWslDir() {
     return join(getAgentDir(), 'wsl');
 }
-/** Get path to the shipped Alpine rootfs tarball (bundled in the npm package) */
+/** Get path to the Alpine rootfs tarball. Prefers user-local (downloaded), falls back to package dir (local dev). */
 export function getAlpineRootfsPath() {
-    return join(getPackageDir(), 'wsl', 'alpine-minirootfs.tar.gz');
+    const userLocal = join(getWslDir(), 'alpine-minirootfs.tar.gz');
+    if (existsSync(userLocal))
+        return userLocal;
+    const shipped = join(getPackageDir(), 'wsl', 'alpine-minirootfs.tar.gz');
+    if (existsSync(shipped))
+        return shipped;
+    return userLocal; // canonical location — will be downloaded
+}
+/** GitHub Release download URL for the Alpine rootfs tarball (hosted on public repo). */
+export function getAlpineRootfsDownloadUrl(version) {
+    return `https://github.com/lyfegame/shortcutxl-releases/releases/download/v${version}/alpine-minirootfs.tar.gz`;
 }
 /** Get path to debug log file */
 export function getDebugLogPath() {

package/dist/custom/sandbox/lib/wsl-setup.js

@@ -6,8 +6,11 @@
  * this package has no opinion about where they live.
  */
 import { spawn, spawnSync } from 'child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'fs';
-import { join } from 'path';
+import { createWriteStream, existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'fs';
+import { dirname, join } from 'path';
+import { Readable } from 'stream';
+import { finished } from 'stream/promises';
+import { getAlpineRootfsDownloadUrl } from '../../../config.js';
 import { log } from '../../../utils/log.js';
 import { runSandboxSmokeTestAsync } from './smoke.js';
 import { clearDetectionCache, isDistroInstalled, isWsl2Available } from './wsl-detect.js';
@@ -42,9 +45,15 @@ export async function ensureWslSandbox(options) {
         }
         // Fall through to re-import
     }
-    // Import rootfs
+    // Download rootfs if not present locally, then import
     if (!existsSync(rootfsPath)) {
-        return { installed: false, error: `Rootfs not found at ${rootfsPath}` };
+        if (!version) {
+            return { installed: false, error: `Rootfs not found at ${rootfsPath}` };
+        }
+        const dlError = await downloadRootfs(rootfsPath, version);
+        if (dlError) {
+            return { installed: false, error: dlError };
+        }
     }
     const installDir = join(wslDir, distro);
     if (!existsSync(installDir)) {
@@ -94,6 +103,54 @@ export function enableWsl2() {
     }
     return { success: false, needsReboot: false, error: output || 'Failed to enable WSL2' };
 }
+/** Download the Alpine rootfs tarball from GitHub Releases. Returns null on success, error string on failure. */
+async function downloadRootfs(rootfsPath, version) {
+    if (process.env.SHORTCUT_OFFLINE === '1') {
+        return `Rootfs not found at ${rootfsPath} (offline mode — cannot download)`;
+    }
+    const url = getAlpineRootfsDownloadUrl(version);
+    const dir = dirname(rootfsPath);
+    mkdirSync(dir, { recursive: true });
+    const tmpPath = rootfsPath + '.downloading';
+    log.info('sandbox', `Downloading Alpine rootfs from ${url}`);
+    try {
+        const response = await fetch(url, { signal: AbortSignal.timeout(120_000) });
+        if (!response.ok) {
+            return `Failed to download rootfs: HTTP ${response.status} from ${url}`;
+        }
+        if (!response.body) {
+            return 'Failed to download rootfs: no response body';
+        }
+        const totalBytes = Number(response.headers.get('content-length') || 0);
+        let receivedBytes = 0;
+        let lastLoggedPct = -10;
+        const progress = new TransformStream({
+            transform(chunk, controller) {
+                receivedBytes += chunk.byteLength;
+                if (totalBytes > 0) {
+                    const pct = Math.floor((receivedBytes / totalBytes) * 100);
+                    if (pct - lastLoggedPct >= 10) {
+                        lastLoggedPct = pct;
+                        log.info('sandbox', `Download progress: ${pct}%`);
+                    }
+                }
+                controller.enqueue(chunk);
+            }
+        });
+        const fileStream = createWriteStream(tmpPath);
+        await finished(Readable.fromWeb(response.body.pipeThrough(progress)).pipe(fileStream));
+        renameSync(tmpPath, rootfsPath);
+        log.info('sandbox', 'Alpine rootfs downloaded successfully');
+        return null;
+    }
+    catch (err) {
+        try {
+            unlinkSync(tmpPath);
+        }
+        catch { /* ignore */ }
+        return `Failed to download rootfs: ${err instanceof Error ? err.message : String(err)}`;
+    }
+}
 function isRootfsStale(stampFile, currentVersion) {
     try {
         return !existsSync(stampFile) || readFileSync(stampFile, 'utf-8').trim() !== currentVersion;

package/dist/custom/sandbox/sandbox-command.js

@@ -7,6 +7,7 @@
 import { enableWsl2, ensureWslSandbox, isDistroInstalled, isWsl2Available } from './lib/index.js';
 import chalk from 'chalk';
 import { execSync } from 'node:child_process';
+import { existsSync } from 'node:fs';
 import { getAlpineRootfsPath, getSettingsPath, getWslDir, VERSION } from '../../config.js';
 import { SANDBOX_DISTRO } from './index.js';
 const WSL_INSTALL_HINT = '\n\n  To fix this:\n' +
@@ -37,7 +38,10 @@ export async function handleSandboxCommand(showStatus, select, input, settingsMa
         return true;
     }
     // Step 3: Not installed → set up
-    showStatus('Setting up sandbox (importing Alpine Linux + bubblewrap)...');
+    const rootfsExists = existsSync(getAlpineRootfsPath());
+    showStatus(rootfsExists
+        ? 'Setting up sandbox (importing Alpine Linux + bubblewrap)...'
+        : 'Downloading sandbox (~80 MB) and setting up...');
     const result = await ensureWslSandbox({
         distro: SANDBOX_DISTRO,
         wslDir: getWslDir(),

package/dist/main.js

@@ -7,6 +7,7 @@
 import { supportsXhigh } from '@mariozechner/pi-ai';
 import chalk from 'chalk';
 import { spawn } from 'child_process';
+import { existsSync } from 'fs';
 import { createInterface } from 'readline';
 import { parseArgs, printHelp } from './cli/args.js';
 import { selectConfig } from './cli/config-selector.js';
@@ -37,7 +38,6 @@ import { EXCEL_HTTP_URL, SHORTCUT_LLM_PROXY_URL } from './custom/constants.js';
 import { fetchWorkbookSummary, formatSummaryForLlm, parseWorkbookNames } from './custom/context/workbook-summary.js';
 import { fetchCreditBalance } from './custom/credits/shortcut-credits.js';
 import { startCronStatusPolling } from './custom/cron/status-line.js';
-import { log } from './utils/log.js';
 import { getTraceHooks } from './custom/dev/index.js';
 import { runPreflight } from './custom/preflight.js';
 import { SHORTCUT_PROVIDER_ID } from './custom/providers/provider-ids.js';
@@ -428,20 +428,30 @@ export async function main(args) {
     let sandboxAvailable = isWsl2Available() && isDistroInstalled(SANDBOX_DISTRO);
     // Auto-update sandbox rootfs if the package version changed.
     if (sandboxMode === 'enabled' && sandboxAvailable) {
+        const sandboxFrames = ['⠋', '⠙', '⠹', '⠸', '⠼', '⠴', '⠦', '⠧', '⠇', '⠏'];
+        let sandboxFrame = 0;
+        const needsDownload = !existsSync(getAlpineRootfsPath());
+        const spinnerMsg = needsDownload ? 'Downloading sandbox (~80 MB)...' : 'Checking sandbox...';
+        const sandboxSpinner = setInterval(() => {
+            process.stderr.write(`\r${sandboxFrames[sandboxFrame++ % sandboxFrames.length]} ${spinnerMsg}`);
+        }, 80);
         try {
-            log.info('sandbox', 'Checking sandbox rootfs version...');
             const result = await ensureWslSandbox({
                 distro: SANDBOX_DISTRO,
                 wslDir: getWslDir(),
                 rootfsPath: getAlpineRootfsPath(),
                 version: VERSION
             });
+            clearInterval(sandboxSpinner);
+            process.stderr.write('\r\x1b[K');
             if (!result.installed) {
                 sandboxAvailable = false;
                 startupWarnings.push(`Sandbox rootfs update failed: ${result.error}`);
             }
         }
         catch (err) {
+            clearInterval(sandboxSpinner);
+            process.stderr.write('\r\x1b[K');
             sandboxAvailable = false;
             startupWarnings.push(`Sandbox check failed: ${err instanceof Error ? err.message : String(err)}`);
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "shortcutxl",
-  "version": "0.2.21",
+  "version": "0.2.22",
   "type": "module",
   "exports": {
     ".": "./dist/index.js"
@@ -14,7 +14,6 @@
     "skills/",
     "agent-docs/",
     "xll/",
-    "wsl/",
     "CHANGELOG.md"
   ],
   "shortcutConfig": {
@@ -27,7 +26,7 @@
   "scripts": {
     "build": "tsc -b && npm run copy-assets",
     "vendor-alpine": "powershell -File ../build-scripts/vendor-alpine.ps1",
-    "prepublishOnly": "npm run vendor-alpine && npm run build",
+    "prepublishOnly": "npm run build",
     "sync-modules": "node -e \"require('fs').cpSync('../modules/shortcut_xl','xll/modules/shortcut_xl',{recursive:true,filter:s=>!s.includes('__pycache__')})\"",
     "copy-assets": "npm run sync-modules && cp -r src/tui dist/tui && cp src/modes/interactive/theme/*.json dist/modes/interactive/theme/ && cp src/core/export-html/*.{html,css,js} dist/core/export-html/ && cp src/core/export-html/vendor/*.js dist/core/export-html/vendor/ && cp ../../os/docs/generated/api-reference.json agent-docs/api-reference.json",
     "test-install": "npm uninstall -g shortcutxl & npm run build && npm pack && node -e \"const g=require('glob').globSync('shortcutxl-*.tgz')[0];require('child_process').execSync('npm install -g '+g,{stdio:'inherit'});require('fs').unlinkSync(g)\"",
@@ -42,7 +41,7 @@
     "format:check": "prettier --check 'src/**/*.{ts,tsx,js,json}'",
     "test": "vitest --run",
     "test:e2e": "vitest --run --config vitest.e2e.config.ts",
-    "release": "node -e \"const v=require('./package.json').version;const t='shortcutxl/v'+v;require('child_process').execSync('git tag '+t,{stdio:'inherit'});require('child_process').execSync('git push origin '+t,{stdio:'inherit'});console.log('Tagged and pushed '+t)\"",
+    "release": "node scripts/release.js",
     "test:watch": "vitest",
     "knip": "knip",
     "lint:python": "cd .. && uvx ruff check modules/ tests/",