skydive-cli 0.5.0-beta.5 → 0.5.0-beta.52

package/dist/js/client-Dd5sMXPv.mjs

@@ -1,620 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import os from "node:os";
-import { z } from "zod";
-import { execFile, spawn } from "node:child_process";
-import { WebSocket } from "ws";
-
-//#region ../portal-daemon/src/machine.ts
-/**
-* Identity this machine registers under on the portal.
-*
-* One device row per (org, user, machine): the daemon owns the host's single
-* portal connection, and every surface (CLI, TUI, desktop app) shares that
-* row, so a grant applies to the machine no matter which surface the user
-* shared from. The name must therefore match what the desktop app registers —
-* on macOS that is `scutil --get LocalHostName` (the Rust client's own
-* derivation, stabler than the network-assigned hostname), with the plain
-* hostname as the fallback for other platforms or a failed read.
-*
-* Historically the CLI suffixed `-cli` to keep a device distinct from the
-* desktop's; `unifyLegacyCliGrants` migrates grants off those rows.
-*/
-async function resolveMachineIdentity() {
-	const fallback = fallbackHost();
-	if (process.platform !== "darwin") return {
-		machineName: fallback,
-		friendlyName: fallback
-	};
-	const local = await scutilRead("LocalHostName") ?? fallback;
-	return {
-		machineName: local,
-		friendlyName: await scutilRead("ComputerName") ?? local
-	};
-}
-function fallbackHost() {
-	return (os.hostname() || "machine").trim().replace(/\.local$/i, "") || "machine";
-}
-function scutilRead(key) {
-	return new Promise((resolve) => {
-		execFile("/usr/sbin/scutil", ["--get", key], { timeout: 2e3 }, (error, stdout) => {
-			if (error) {
-				resolve(null);
-				return;
-			}
-			const value = stdout.trim();
-			resolve(value.length > 0 ? value : null);
-		});
-	});
-}
-const INHERITED_ENV = [
-	"HOME",
-	"USER",
-	"LOGNAME",
-	"SHELL",
-	"LANG",
-	"LC_ALL",
-	"TMPDIR",
-	"TERM",
-	"PATH"
-];
-const DARWIN_PATH_PREPEND = ["/opt/homebrew/bin", "/usr/local/bin"];
-function buildEnv(extra) {
-	const env = {};
-	for (const key of INHERITED_ENV) {
-		const value = process.env[key];
-		if (value !== void 0) env[key] = value;
-	}
-	if (process.platform === "darwin") {
-		const current = env.PATH ? env.PATH.split(":") : [];
-		const missing = DARWIN_PATH_PREPEND.filter((dir) => !current.includes(dir));
-		if (missing.length > 0) env.PATH = [...missing, ...current].join(":");
-	}
-	if (extra) for (const [key, value] of Object.entries(extra)) env[key] = value;
-	return env;
-}
-/**
-* Build the desktop-portal WebSocket URL from the chat origin. Mirrors the Rust
-* desktop client: http→ws, https→wss, scheme-less defaults to wss, and the
-* machine/label ride as query pairs (percent-encoded by URL).
-*/
-function portalWsUrl(appUrl, machine, label) {
-	const base = appUrl.replace(/\/+$/, "");
-	let wsBase;
-	if (base.startsWith("https://")) wsBase = `wss://${base.slice(8)}`;
-	else if (base.startsWith("http://")) wsBase = `ws://${base.slice(7)}`;
-	else wsBase = `wss://${base}`;
-	const url = new URL(`${wsBase}/api/v1/portal/desktop`);
-	url.searchParams.set("machine", machine);
-	url.searchParams.set("label", label);
-	return url.toString();
-}
-
-//#endregion
-//#region ../portal-daemon/src/util.ts
-/** Narrowing helper for the unknown JSON payloads the daemon reads (persisted
-* state, wire frames). A type predicate (not an `as` cast), so call sites can
-* read properties without asserting. */
-function isRecord(value) {
-	return typeof value === "object" && value !== null && !Array.isArray(value);
-}
-/** Best-effort message from an unknown thrown value. */
-function errorMessage(err) {
-	return err instanceof Error ? err.message : String(err);
-}
-
-//#endregion
-//#region ../portal-protocol/src/index.ts
-const MAX_WS_FRAME_BYTES = 16 * 1024 * 1024;
-const T_DATA = 1;
-const T_CTRL = 2;
-const STREAM = {
-	stdout: 0,
-	stderr: 1,
-	stdin: 2
-};
-const uuidToBytes = (id) => Buffer.from(id.replace(/-/g, ""), "hex");
-const bytesToUuid = (b) => {
-	const h = b.toString("hex");
-	return `${h.slice(0, 8)}-${h.slice(8, 12)}-${h.slice(12, 16)}-${h.slice(16, 20)}-${h.slice(20, 32)}`;
-};
-function encodeData(id, stream, seq, payload) {
-	const head = Buffer.allocUnsafe(22);
-	head[0] = T_DATA;
-	uuidToBytes(id).copy(head, 1);
-	head[17] = stream;
-	head.writeUInt32BE(seq >>> 0, 18);
-	return Buffer.concat([head, payload]);
-}
-const ctrlMessageSchema = z.discriminatedUnion("t", [
-	z.object({
-		t: z.literal("open"),
-		argv: z.array(z.string()),
-		env: z.record(z.string()).nullable(),
-		conversationId: z.string().nullable().optional()
-	}),
-	z.object({ t: z.literal("stdin_eof") }),
-	z.object({ t: z.literal("pause") }),
-	z.object({ t: z.literal("resume") }),
-	z.object({ t: z.literal("cancel") }),
-	z.object({
-		t: z.literal("close"),
-		exitCode: z.number(),
-		frames: z.number().int().nonnegative().optional()
-	}),
-	z.object({
-		t: z.literal("error"),
-		message: z.string()
-	})
-]);
-function encodeCtrl(id, obj) {
-	const head = Buffer.allocUnsafe(17);
-	head[0] = T_CTRL;
-	uuidToBytes(id).copy(head, 1);
-	return Buffer.concat([head, Buffer.from(JSON.stringify(obj), "utf8")]);
-}
-function decodeFrame(frame) {
-	const id = bytesToUuid(frame.subarray(1, 17));
-	if (frame[0] === T_DATA) return {
-		kind: "data",
-		id,
-		stream: frame[17] ?? 0,
-		seq: frame.readUInt32BE(18),
-		payload: frame.subarray(22)
-	};
-	return {
-		kind: "ctrl",
-		id,
-		obj: ctrlMessageSchema.parse(JSON.parse(frame.subarray(17).toString("utf8")))
-	};
-}
-
-//#endregion
-//#region ../portal-daemon/src/exec.ts
-/**
-* Runs portal `exec` directives locally. Each `open` spawns a child process
-* whose stdout/stderr stream back as data frames and whose stdin is fed by
-* inbound data frames, with pause/resume backpressure and cancel/teardown that
-* kill the child. This is the TypeScript counterpart of the desktop's Rust
-* `portal/mod.rs` job machinery, minus the connection supervision (which lives
-* in the client).
-*/
-var JobManager = class {
-	jobs = /* @__PURE__ */ new Map();
-	constructor(opts) {
-		this.opts = opts;
-	}
-	handleFrame(raw) {
-		let decoded;
-		try {
-			decoded = decodeFrame(raw);
-		} catch (_error) {
-			return;
-		}
-		if (decoded.kind === "ctrl") this.handleCtrl(decoded.id, decoded.obj);
-		else if (decoded.stream === STREAM.stdin) this.jobs.get(decoded.id)?.child.stdin.write(decoded.payload);
-	}
-	killAll() {
-		for (const job of this.jobs.values()) {
-			job.settled = true;
-			job.child.kill("SIGKILL");
-		}
-		this.jobs.clear();
-	}
-	handleCtrl(id, msg) {
-		switch (msg.t) {
-			case "open":
-				this.startJob(id, msg.argv, msg.env, msg.conversationId ?? null);
-				return;
-			case "stdin_eof":
-				this.jobs.get(id)?.child.stdin.end();
-				return;
-			case "pause":
-				this.setPaused(id, true);
-				return;
-			case "resume":
-				this.setPaused(id, false);
-				return;
-			case "cancel":
-				this.jobs.get(id)?.child.kill("SIGKILL");
-				return;
-			case "close":
-			case "error": return;
-			default: return msg;
-		}
-	}
-	setPaused(id, paused) {
-		const job = this.jobs.get(id);
-		if (!job) return;
-		if (paused) {
-			job.child.stdout.pause();
-			job.child.stderr.pause();
-		} else {
-			job.child.stdout.resume();
-			job.child.stderr.resume();
-		}
-	}
-	startJob(id, argv, env, conversationId) {
-		const [program, ...args] = argv;
-		if (!program) {
-			this.opts.send(encodeCtrl(id, {
-				t: "error",
-				message: "empty argv"
-			}));
-			return;
-		}
-		let child;
-		try {
-			child = spawn(program, args, {
-				cwd: this.opts.resolveCwd(conversationId),
-				env: buildEnv(env),
-				stdio: [
-					"pipe",
-					"pipe",
-					"pipe"
-				]
-			});
-		} catch (err) {
-			this.opts.send(encodeCtrl(id, {
-				t: "error",
-				message: `spawn failed: ${errorMessage(err)}`
-			}));
-			return;
-		}
-		const job = {
-			child,
-			seq: 0,
-			settled: false
-		};
-		this.jobs.set(id, job);
-		child.on("error", (err) => {
-			if (job.settled) return;
-			job.settled = true;
-			this.jobs.delete(id);
-			this.opts.send(encodeCtrl(id, {
-				t: "error",
-				message: `spawn failed: ${errorMessage(err)}`
-			}));
-		});
-		child.stdout.on("data", (chunk) => this.sendData(job, id, STREAM.stdout, chunk));
-		child.stderr.on("data", (chunk) => this.sendData(job, id, STREAM.stderr, chunk));
-		child.on("close", (code) => {
-			if (job.settled) return;
-			job.settled = true;
-			this.jobs.delete(id);
-			this.opts.send(encodeCtrl(id, {
-				t: "close",
-				exitCode: code ?? -1,
-				frames: job.seq
-			}));
-		});
-	}
-	sendData(job, id, stream, chunk) {
-		if (job.settled) return;
-		this.opts.send(encodeData(id, stream, job.seq, chunk));
-		job.seq = job.seq + 1 >>> 0;
-	}
-};
-
-//#endregion
-//#region ../portal-daemon/src/api.ts
-/**
-* The portal's session-authed REST surface, shared by `PortalClient` (the
-* TUI/`portal open` connection) and the `skydive portal` management
-* commands, so the endpoint contracts and response schemas live in exactly
-* one place.
-*/
-const deviceSchema = z.object({
-	id: z.string(),
-	machineName: z.string(),
-	friendlyName: z.string(),
-	connected: z.boolean(),
-	lastSeen: z.string().nullable(),
-	grantedAgentIds: z.array(z.string())
-});
-const devicesResponseSchema = z.object({
-	devices: z.array(deviceSchema),
-	agents: z.array(z.object({
-		id: z.string(),
-		name: z.string()
-	}))
-});
-const deviceTokenSchema = z.object({ token: z.string().min(1) });
-async function portalFetch(auth, path, init) {
-	const res = await fetch(`${auth.appUrl}${path}`, {
-		method: init.method,
-		headers: {
-			authorization: `Bearer ${auth.sessionToken}`,
-			accept: "application/json",
-			...init.body ? { "content-type": "application/json" } : {}
-		},
-		...init.body ? { body: init.body } : {}
-	});
-	if (!res.ok) {
-		const body = await res.text().catch(() => "");
-		throw new HttpError(res.status, body);
-	}
-	return res.json();
-}
-async function fetchPortalDevices(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", { method: "GET" });
-	return devicesResponseSchema.parse(json);
-}
-const registerResponseSchema = z.object({ device: z.object({ id: z.string() }) });
-/**
-* Register this machine's device row without connecting. Connecting registers
-* as a side effect; this covers granting an agent on a machine that has never
-* shared yet (the grant references the device row).
-*/
-async function registerPortalDevice(auth, { machineName, friendlyName }) {
-	const json = await portalFetch(auth, "/api/v1/portal/devices", {
-		method: "POST",
-		body: JSON.stringify({
-			machineName,
-			friendlyName
-		})
-	});
-	return registerResponseSchema.parse(json).device;
-}
-/** Short-lived token the machine presents when dialing the portal WebSocket. */
-async function mintPortalDeviceToken(auth) {
-	const json = await portalFetch(auth, "/api/v1/portal/device-token", { method: "POST" });
-	return deviceTokenSchema.parse(json).token;
-}
-async function grantPortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants`, {
-		method: "POST",
-		body: JSON.stringify({ agentId })
-	});
-}
-async function revokePortalAccess(auth, { deviceId, agentId }) {
-	await portalFetch(auth, `/api/v1/portal/devices/${encodeURIComponent(deviceId)}/grants/${encodeURIComponent(agentId)}`, { method: "DELETE" });
-}
-/**
-* The device row for a given machine identity. Matching is by `machineName`
-* equality — the stable handle the machine registers under, not the display
-* label.
-*/
-function findThisDevice(devices, machineName) {
-	return devices.find((device) => device.machineName === machineName) ?? null;
-}
-/**
-* One-time grant migration onto the merged device. Earlier CLI builds
-* registered a separate `<machineName>-cli` device, so a user's existing
-* approvals hang off that row; the merged device would start with zero grants
-* and every already-authorized agent would ask again. Copy any grant the
-* merged device is missing (the grant endpoint upserts, so re-runs are
-* no-ops). The legacy row is left in place — an old CLI build may still
-* connect under it. Returns how many grants were copied.
-*/
-async function unifyLegacyCliGrants(auth, machineName) {
-	const { devices } = await fetchPortalDevices(auth);
-	const merged = findThisDevice(devices, machineName);
-	const legacy = findThisDevice(devices, `${machineName}-cli`);
-	if (!merged || !legacy) return 0;
-	const have = new Set(merged.grantedAgentIds);
-	const missing = legacy.grantedAgentIds.filter((id) => !have.has(id));
-	for (const agentId of missing) await grantPortalAccess(auth, {
-		deviceId: merged.id,
-		agentId
-	});
-	return missing.length;
-}
-
-//#endregion
-//#region ../portal-daemon/src/client.ts
-const INITIAL_BACKOFF_MS = 500;
-const MAX_BACKOFF_MS = 1e4;
-/**
-* Shares the local machine with agents over the portal: dials OUT to the api's
-* desktop-portal WebSocket (authenticating with a short-lived device token
-* minted from the CLI session), then runs inbound `exec` directives via a
-* `JobManager`. Reconnects with backoff while enabled; disabling drops presence
-* and kills any in-flight children. No inbound port is ever opened.
-*
-* Access stays default-deny: connecting only makes the machine reachable — an
-* agent can't run anything until the user grants it (`grantAgent`).
-*/
-var PortalClient = class {
-	enabled = false;
-	disposed = false;
-	ws = null;
-	jobs = null;
-	status = "off";
-	error = null;
-	deviceId = null;
-	granted = /* @__PURE__ */ new Set();
-	machineName = "";
-	friendlyName = "";
-	legacyGrantsChecked = false;
-	constructor(opts) {
-		this.opts = opts;
-	}
-	isEnabled() {
-		return this.enabled;
-	}
-	isGranted(agentId) {
-		return this.granted.has(agentId);
-	}
-	/** Agents currently authorized on this machine (last known server state). */
-	grantedAgentIds() {
-		return [...this.granted];
-	}
-	enable() {
-		if (this.enabled || this.disposed) return;
-		this.enabled = true;
-		this.error = null;
-		this.connectLoop();
-	}
-	disable() {
-		if (!this.enabled) return;
-		this.enabled = false;
-		this.jobs?.killAll();
-		this.ws?.close();
-		this.ws = null;
-		this.deviceId = null;
-		this.granted = /* @__PURE__ */ new Set();
-		this.setStatus("off");
-	}
-	/**
-	* Tear down for good (app quit). Kills children synchronously and closes the
-	* socket so it stops holding the event loop open — otherwise the process
-	* would hang after the TUI is destroyed.
-	*/
-	dispose() {
-		this.disposed = true;
-		this.enabled = false;
-		this.jobs?.killAll();
-		this.jobs = null;
-		this.ws?.close();
-		this.ws = null;
-	}
-	/** Grant one agent access to this machine (default-deny; user-initiated). */
-	async grantAgent(agentId) {
-		const auth = this.sessionAuth();
-		if (!auth) throw new Error("granting needs a signed-in CLI session on this machine (the desktop connection alone cannot manage grants)");
-		await grantPortalAccess(auth, {
-			deviceId: await this.ensureDeviceId(),
-			agentId
-		});
-		this.granted.add(agentId);
-		this.emit();
-	}
-	/** Session-authed REST auth, or null when only a device token is held. */
-	sessionAuth() {
-		const { sessionToken } = this.opts.credentials();
-		return sessionToken ? {
-			appUrl: this.opts.appUrl,
-			sessionToken
-		} : null;
-	}
-	/**
-	* The bearer token for the portal WebSocket dial: minted from the session
-	* when one is held, otherwise the pre-minted device token as-is.
-	*/
-	async wsToken() {
-		const creds = this.opts.credentials();
-		if (creds.sessionToken) return mintPortalDeviceToken({
-			appUrl: this.opts.appUrl,
-			sessionToken: creds.sessionToken
-		});
-		if (creds.deviceToken) return creds.deviceToken;
-		throw new Error("no portal credentials (not signed in)");
-	}
-	setStatus(status, error = null) {
-		this.status = status;
-		this.error = error;
-		this.emit();
-	}
-	emit() {
-		this.opts.onState({
-			status: this.status,
-			machineName: this.machineName,
-			friendlyName: this.friendlyName,
-			error: this.error,
-			grantedAgentIds: [...this.granted]
-		});
-	}
-	async connectLoop() {
-		if (!this.machineName) {
-			const identity = await resolveMachineIdentity();
-			this.machineName = identity.machineName;
-			this.friendlyName = identity.friendlyName;
-		}
-		let backoff = INITIAL_BACKOFF_MS;
-		while (this.enabled && !this.disposed) {
-			this.setStatus("connecting");
-			try {
-				const token = await this.wsToken();
-				await this.runConnection(token);
-				backoff = INITIAL_BACKOFF_MS;
-			} catch (err) {
-				if (!this.enabled || this.disposed) break;
-				this.setStatus("error", errorMessage(err));
-			}
-			if (!this.enabled || this.disposed) break;
-			await sleep(backoff);
-			backoff = Math.min(backoff * 2, MAX_BACKOFF_MS);
-		}
-	}
-	runConnection(token) {
-		return new Promise((resolve) => {
-			const ws = new WebSocket(portalWsUrl(this.opts.appUrl, this.machineName, this.friendlyName), {
-				headers: { authorization: `Bearer ${token}` },
-				maxPayload: MAX_WS_FRAME_BYTES
-			});
-			this.ws = ws;
-			const jobs = new JobManager({
-				resolveCwd: this.opts.resolveCwd,
-				send: (frame) => {
-					if (ws.readyState === WebSocket.OPEN) ws.send(frame);
-				}
-			});
-			this.jobs = jobs;
-			ws.on("open", () => {
-				this.setStatus("connected");
-				this.syncDeviceState();
-			});
-			ws.on("message", (data, isBinary) => {
-				if (isBinary) jobs.handleFrame(toBuffer(data));
-			});
-			ws.on("error", (err) => {
-				this.error = errorMessage(err);
-			});
-			ws.on("close", () => {
-				jobs.killAll();
-				if (this.jobs === jobs) this.jobs = null;
-				if (this.ws === ws) this.ws = null;
-				resolve();
-			});
-		});
-	}
-	async ensureDeviceId() {
-		if (this.deviceId) return this.deviceId;
-		for (let attempt = 0; attempt < 10; attempt += 1) {
-			await this.refreshDevice();
-			if (this.deviceId) return this.deviceId;
-			await sleep(300);
-		}
-		throw new Error("this machine is not connected yet");
-	}
-	async refreshDevice() {
-		const auth = this.sessionAuth();
-		if (!auth) return;
-		try {
-			const { devices } = await fetchPortalDevices(auth);
-			const mine = findThisDevice(devices, this.machineName);
-			if (!mine) return;
-			this.deviceId = mine.id;
-			this.granted = new Set(mine.grantedAgentIds);
-			this.emit();
-		} catch (_error) {}
-	}
-	/**
-	* Post-connect device sync: read our row, then (once per process) copy any
-	* grants still hanging off the legacy `<host>-cli` device onto this one so
-	* agents the user already approved keep their access under the merged
-	* identity.
-	*/
-	async syncDeviceState() {
-		await this.refreshDevice();
-		if (this.legacyGrantsChecked) return;
-		const auth = this.sessionAuth();
-		if (!auth) return;
-		this.legacyGrantsChecked = true;
-		try {
-			if (await unifyLegacyCliGrants(auth, this.machineName) > 0) await this.refreshDevice();
-		} catch (_error) {}
-	}
-};
-function toBuffer(data) {
-	if (Buffer.isBuffer(data)) return data;
-	if (Array.isArray(data)) return Buffer.concat(data);
-	return Buffer.from(data);
-}
-function sleep(ms) {
-	return new Promise((resolve) => setTimeout(resolve, ms));
-}
-
-//#endregion
-export { registerPortalDevice as a, resolveMachineIdentity as c, grantPortalAccess as i, fetchPortalDevices as n, revokePortalAccess as o, findThisDevice as r, isRecord as s, PortalClient as t };

package/dist/js/daemon-CjzrUvXx.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import "./client-Dd5sMXPv.mjs";
-import { a as runPortalDaemon, i as queryDaemonStatus, n as ensureDaemonRunning, o as startPortalDaemon, r as isDaemonListening, s as stopDaemon, t as PortalDaemon } from "./daemon-BhArnzeW.mjs";
-
-export { runPortalDaemon };

package/dist/js/daemon-client-D8bNXTxu.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import "./client-Dd5sMXPv.mjs";
-import "./daemon-BhArnzeW.mjs";
-import { t as PortalDaemonClient } from "./daemon-client-DcuD4v12.mjs";
-
-export { PortalDaemonClient };

package/dist/js/raw-pty-3EkG-jjH.mjs

@@ -1,5 +0,0 @@
-#!/usr/bin/env node
-import "./client-Cn2af31H.mjs";
-import { t as runRawPtyPassthrough } from "./raw-pty-B6mAroiI.mjs";
-
-export { runRawPtyPassthrough };

package/dist/js/rest-DADJh0bi.mjs

@@ -1,6 +0,0 @@
-#!/usr/bin/env node
-import { t as HttpError } from "./http-error-DzyrsLAZ.mjs";
-import { n as errorDetail, r as sendErrorMessage, t as createRestClient } from "./rest-BY2nADw5.mjs";
-import "./billing-blocked-2wju4gC_.mjs";
-
-export { createRestClient };