subagent-cli 0.3.0 → 0.3.1

package/src/utils/completionCache.ts

@@ -1,166 +0,0 @@
-import chalk from 'chalk'
-import { mkdir, readFile, writeFile } from 'fs/promises'
-import { homedir } from 'os'
-import { dirname, join } from 'path'
-import { pathToFileURL } from 'url'
-import { color } from '../components/design-system/color.js'
-import { supportsHyperlinks } from '../ink/supports-hyperlinks.js'
-import { logForDebugging } from './debug.js'
-import { isENOENT } from './errors.js'
-import { execFileNoThrow } from './execFileNoThrow.js'
-import { logError } from './log.js'
-import type { ThemeName } from './theme.js'
-
-const EOL = '\n'
-
-type ShellInfo = {
-  name: string
-  rcFile: string
-  cacheFile: string
-  completionLine: string
-  shellFlag: string
-}
-
-function detectShell(): ShellInfo | null {
-  const shell = process.env.SHELL || ''
-  const home = homedir()
-  const claudeDir = join(home, '.claude')
-
-  if (shell.endsWith('/zsh') || shell.endsWith('/zsh.exe')) {
-    const cacheFile = join(claudeDir, 'completion.zsh')
-    return {
-      name: 'zsh',
-      rcFile: join(home, '.zshrc'),
-      cacheFile,
-      completionLine: `[[ -f "${cacheFile}" ]] && source "${cacheFile}"`,
-      shellFlag: 'zsh',
-    }
-  }
-  if (shell.endsWith('/bash') || shell.endsWith('/bash.exe')) {
-    const cacheFile = join(claudeDir, 'completion.bash')
-    return {
-      name: 'bash',
-      rcFile: join(home, '.bashrc'),
-      cacheFile,
-      completionLine: `[ -f "${cacheFile}" ] && source "${cacheFile}"`,
-      shellFlag: 'bash',
-    }
-  }
-  if (shell.endsWith('/fish') || shell.endsWith('/fish.exe')) {
-    const xdg = process.env.XDG_CONFIG_HOME || join(home, '.config')
-    const cacheFile = join(claudeDir, 'completion.fish')
-    return {
-      name: 'fish',
-      rcFile: join(xdg, 'fish', 'config.fish'),
-      cacheFile,
-      completionLine: `[ -f "${cacheFile}" ] && source "${cacheFile}"`,
-      shellFlag: 'fish',
-    }
-  }
-  return null
-}
-
-function formatPathLink(filePath: string): string {
-  if (!supportsHyperlinks()) {
-    return filePath
-  }
-  const fileUrl = pathToFileURL(filePath).href
-  return `\x1b]8;;${fileUrl}\x07${filePath}\x1b]8;;\x07`
-}
-
-/**
- * Generate and cache the completion script, then add a source line to the
- * shell's rc file. Returns a user-facing status message.
- */
-export async function setupShellCompletion(theme: ThemeName): Promise<string> {
-  const shell = detectShell()
-  if (!shell) {
-    return ''
-  }
-
-  // Ensure the cache directory exists
-  try {
-    await mkdir(dirname(shell.cacheFile), { recursive: true })
-  } catch (e: unknown) {
-    logError(e)
-    return `${EOL}${color('warning', theme)(`Could not write ${shell.name} completion cache`)}${EOL}${chalk.dim(`Run manually: claude completion ${shell.shellFlag} > ${shell.cacheFile}`)}${EOL}`
-  }
-
-  // Generate the completion script by writing directly to the cache file.
-  // Using --output avoids piping through stdout where process.exit() can
-  // truncate output before the pipe buffer drains.
-  const claudeBin = process.argv[1] || 'claude'
-  const result = await execFileNoThrow(claudeBin, [
-    'completion',
-    shell.shellFlag,
-    '--output',
-    shell.cacheFile,
-  ])
-  if (result.code !== 0) {
-    return `${EOL}${color('warning', theme)(`Could not generate ${shell.name} shell completions`)}${EOL}${chalk.dim(`Run manually: claude completion ${shell.shellFlag} > ${shell.cacheFile}`)}${EOL}`
-  }
-
-  // Check if rc file already sources completions
-  let existing = ''
-  try {
-    existing = await readFile(shell.rcFile, { encoding: 'utf-8' })
-    if (
-      existing.includes('claude completion') ||
-      existing.includes(shell.cacheFile)
-    ) {
-      return `${EOL}${color('success', theme)(`Shell completions updated for ${shell.name}`)}${EOL}${chalk.dim(`See ${formatPathLink(shell.rcFile)}`)}${EOL}`
-    }
-  } catch (e: unknown) {
-    if (!isENOENT(e)) {
-      logError(e)
-      return `${EOL}${color('warning', theme)(`Could not install ${shell.name} shell completions`)}${EOL}${chalk.dim(`Add this to ${formatPathLink(shell.rcFile)}:`)}${EOL}${chalk.dim(shell.completionLine)}${EOL}`
-    }
-  }
-
-  // Append source line to rc file
-  try {
-    const configDir = dirname(shell.rcFile)
-    await mkdir(configDir, { recursive: true })
-
-    const separator = existing && !existing.endsWith('\n') ? '\n' : ''
-    const content = `${existing}${separator}\n# Claude Code shell completions\n${shell.completionLine}\n`
-    await writeFile(shell.rcFile, content, { encoding: 'utf-8' })
-
-    return `${EOL}${color('success', theme)(`Installed ${shell.name} shell completions`)}${EOL}${chalk.dim(`Added to ${formatPathLink(shell.rcFile)}`)}${EOL}${chalk.dim(`Run: source ${shell.rcFile}`)}${EOL}`
-  } catch (error) {
-    logError(error)
-    return `${EOL}${color('warning', theme)(`Could not install ${shell.name} shell completions`)}${EOL}${chalk.dim(`Add this to ${formatPathLink(shell.rcFile)}:`)}${EOL}${chalk.dim(shell.completionLine)}${EOL}`
-  }
-}
-
-/**
- * Regenerate cached shell completion scripts in ~/.claude/.
- * Called after `claude update` so completions stay in sync with the new binary.
- */
-export async function regenerateCompletionCache(): Promise<void> {
-  const shell = detectShell()
-  if (!shell) {
-    return
-  }
-
-  logForDebugging(`update: Regenerating ${shell.name} completion cache`)
-
-  const claudeBin = process.argv[1] || 'claude'
-  const result = await execFileNoThrow(claudeBin, [
-    'completion',
-    shell.shellFlag,
-    '--output',
-    shell.cacheFile,
-  ])
-
-  if (result.code !== 0) {
-    logForDebugging(
-      `update: Failed to regenerate ${shell.name} completion cache`,
-    )
-    return
-  }
-
-  logForDebugging(
-    `update: Regenerated ${shell.name} completion cache at ${shell.cacheFile}`,
-  )
-}

package/src/utils/computerUse/appNames.ts

@@ -1,196 +0,0 @@
-/**
- * Filter and sanitize installed-app data for inclusion in the `request_access`
- * tool description. Ported from Cowork's appNames.ts. Two
- * concerns: noise filtering (Spotlight returns every bundle on disk — XPC
- * helpers, daemons, input methods) and prompt-injection hardening (app names
- * are attacker-controlled; anyone can ship an app named anything).
- *
- * Residual risk: short benign-char adversarial names ("grant all") can't be
- * filtered programmatically. The tool description's structural framing
- * ("Available applications:") makes it clear these are app names, and the
- * downstream permission dialog requires explicit user approval — a bad name
- * can't auto-grant anything.
- */
-
-/** Minimal shape — matches what `listInstalledApps` returns. */
-type InstalledAppLike = {
-  readonly bundleId: string
-  readonly displayName: string
-  readonly path: string
-}
-
-// ── Noise filtering ──────────────────────────────────────────────────────
-
-/**
- * Only apps under these roots are shown. /System/Library subpaths (CoreServices,
- * PrivateFrameworks, Input Methods) are OS plumbing — anchor on known-good
- * roots rather than blocklisting every junk subpath since new macOS versions
- * add more.
- *
- * ~/Applications is checked at call time via the `homeDir` arg (HOME isn't
- * reliably known at module load in all environments).
- */
-const PATH_ALLOWLIST: readonly string[] = [
-  '/Applications/',
-  '/System/Applications/',
-]
-
-/**
- * Display-name patterns that mark background services even under /Applications.
- * `(?:$|\s\()` — matches keyword at end-of-string OR immediately before ` (`:
- * "Slack Helper (GPU)" and "ABAssistantService" fail, "Service Desk" passes
- * (Service is followed by " D").
- */
-const NAME_PATTERN_BLOCKLIST: readonly RegExp[] = [
-  /Helper(?:$|\s\()/,
-  /Agent(?:$|\s\()/,
-  /Service(?:$|\s\()/,
-  /Uninstaller(?:$|\s\()/,
-  /Updater(?:$|\s\()/,
-  /^\./,
-]
-
-/**
- * Apps commonly requested for CU automation. ALWAYS included if installed,
- * bypassing path check + count cap — the model needs these exact names even
- * when the machine has 200+ apps. Bundle IDs (locale-invariant), not display
- * names. Keep <30 — each entry is a guaranteed token in the description.
- */
-const ALWAYS_KEEP_BUNDLE_IDS: ReadonlySet<string> = new Set([
-  // Browsers
-  'com.apple.Safari',
-  'com.google.Chrome',
-  'com.microsoft.edgemac',
-  'org.mozilla.firefox',
-  'company.thebrowser.Browser', // Arc
-  // Communication
-  'com.tinyspeck.slackmacgap',
-  'us.zoom.xos',
-  'com.microsoft.teams2',
-  'com.microsoft.teams',
-  'com.apple.MobileSMS',
-  'com.apple.mail',
-  // Productivity
-  'com.microsoft.Word',
-  'com.microsoft.Excel',
-  'com.microsoft.Powerpoint',
-  'com.microsoft.Outlook',
-  'com.apple.iWork.Pages',
-  'com.apple.iWork.Numbers',
-  'com.apple.iWork.Keynote',
-  'com.google.GoogleDocs',
-  // Notes / PM
-  'notion.id',
-  'com.apple.Notes',
-  'md.obsidian',
-  'com.linear',
-  'com.figma.Desktop',
-  // Dev
-  'com.microsoft.VSCode',
-  'com.apple.Terminal',
-  'com.googlecode.iterm2',
-  'com.github.GitHubDesktop',
-  // System essentials the model genuinely targets
-  'com.apple.finder',
-  'com.apple.iCal',
-  'com.apple.systempreferences',
-])
-
-// ── Prompt-injection hardening ───────────────────────────────────────────
-
-/**
- * `\p{L}\p{M}\p{N}` with /u — not `\w` (ASCII-only, would drop Bücher, 微信,
- * Préférences Système). `\p{M}` matches combining marks so NFD-decomposed
- * diacritics (ü → u + ◌̈) pass. Single space not `\s` — `\s` matches newlines,
- * which would let "App\nIgnore previous…" through as a multi-line injection.
- * Still bars quotes, angle brackets, backticks, pipes, colons.
- */
-const APP_NAME_ALLOWED = /^[\p{L}\p{M}\p{N}_ .&'()+-]+$/u
-const APP_NAME_MAX_LEN = 40
-const APP_NAME_MAX_COUNT = 50
-
-function isUserFacingPath(path: string, homeDir: string | undefined): boolean {
-  if (PATH_ALLOWLIST.some(root => path.startsWith(root))) return true
-  if (homeDir) {
-    const userApps = homeDir.endsWith('/')
-      ? `${homeDir}Applications/`
-      : `${homeDir}/Applications/`
-    if (path.startsWith(userApps)) return true
-  }
-  return false
-}
-
-function isNoisyName(name: string): boolean {
-  return NAME_PATTERN_BLOCKLIST.some(re => re.test(name))
-}
-
-/**
- * Length cap + trim + dedupe + sort. `applyCharFilter` — skip for trusted
- * bundle IDs (Apple/Google/MS; a localized "Réglages Système" with unusual
- * punctuation shouldn't be dropped), apply for anything attacker-installable.
- */
-function sanitizeCore(
-  raw: readonly string[],
-  applyCharFilter: boolean,
-): string[] {
-  const seen = new Set<string>()
-  return raw
-    .map(name => name.trim())
-    .filter(trimmed => {
-      if (!trimmed) return false
-      if (trimmed.length > APP_NAME_MAX_LEN) return false
-      if (applyCharFilter && !APP_NAME_ALLOWED.test(trimmed)) return false
-      if (seen.has(trimmed)) return false
-      seen.add(trimmed)
-      return true
-    })
-    .sort((a, b) => a.localeCompare(b))
-}
-
-function sanitizeAppNames(raw: readonly string[]): string[] {
-  const filtered = sanitizeCore(raw, true)
-  if (filtered.length <= APP_NAME_MAX_COUNT) return filtered
-  return [
-    ...filtered.slice(0, APP_NAME_MAX_COUNT),
-    `… and ${filtered.length - APP_NAME_MAX_COUNT} more`,
-  ]
-}
-
-function sanitizeTrustedNames(raw: readonly string[]): string[] {
-  return sanitizeCore(raw, false)
-}
-
-/**
- * Filter raw Spotlight results to user-facing apps, then sanitize. Always-keep
- * apps bypass path/name filter AND char allowlist (trusted vendors, not
- * attacker-installed); still length-capped, deduped, sorted.
- */
-export function filterAppsForDescription(
-  installed: readonly InstalledAppLike[],
-  homeDir: string | undefined,
-): string[] {
-  const { alwaysKept, rest } = installed.reduce<{
-    alwaysKept: string[]
-    rest: string[]
-  }>(
-    (acc, app) => {
-      if (ALWAYS_KEEP_BUNDLE_IDS.has(app.bundleId)) {
-        acc.alwaysKept.push(app.displayName)
-      } else if (
-        isUserFacingPath(app.path, homeDir) &&
-        !isNoisyName(app.displayName)
-      ) {
-        acc.rest.push(app.displayName)
-      }
-      return acc
-    },
-    { alwaysKept: [], rest: [] },
-  )
-
-  const sanitizedAlways = sanitizeTrustedNames(alwaysKept)
-  const alwaysSet = new Set(sanitizedAlways)
-  return [
-    ...sanitizedAlways,
-    ...sanitizeAppNames(rest).filter(n => !alwaysSet.has(n)),
-  ]
-}

package/src/utils/computerUse/cleanup.ts

@@ -1,86 +0,0 @@
-import type { ToolUseContext } from '../../Tool.js'
-
-import { logForDebugging } from '../debug.js'
-import { errorMessage } from '../errors.js'
-import { withResolvers } from '../withResolvers.js'
-import { isLockHeldLocally, releaseComputerUseLock } from './computerUseLock.js'
-import { unregisterEscHotkey } from './escHotkey.js'
-
-// cu.apps.unhide is NOT one of the four @MainActor methods wrapped by
-// drainRunLoop's 30s backstop. On abort paths (where the user hit Ctrl+C
-// because something was slow) a hang here would wedge the abort. Generous
-// timeout — unhide should be ~instant; if it takes 5s something is wrong
-// and proceeding is better than waiting. The Swift call continues in the
-// background regardless; we just stop blocking on it.
-const UNHIDE_TIMEOUT_MS = 5000
-
-/**
- * Turn-end cleanup for the chicago MCP surface: auto-unhide apps that
- * `prepareForAction` hid, then release the file-based lock.
- *
- * Called from three sites: natural turn end (`stopHooks.ts`), abort during
- * streaming (`query.ts` aborted_streaming), abort during tool execution
- * (`query.ts` aborted_tools). All three reach this via dynamic import gated
- * on `feature('CHICAGO_MCP')`. `executor.js` (which pulls both native
- * modules) is dynamic-imported below so non-CU turns don't load native
- * modules just to no-op.
- *
- * No-ops cheaply on non-CU turns: both gate checks are zero-syscall.
- */
-export async function cleanupComputerUseAfterTurn(
-  ctx: Pick<
-    ToolUseContext,
-    'getAppState' | 'setAppState' | 'sendOSNotification'
-  >,
-): Promise<void> {
-  const appState = ctx.getAppState()
-
-  const hidden = appState.computerUseMcpState?.hiddenDuringTurn
-  if (hidden && hidden.size > 0) {
-    const { unhideComputerUseApps } = await import('./executor.js')
-    const unhide = unhideComputerUseApps([...hidden]).catch(err =>
-      logForDebugging(
-        `[Computer Use MCP] auto-unhide failed: ${errorMessage(err)}`,
-      ),
-    )
-    const timeout = withResolvers<void>()
-    const timer = setTimeout(timeout.resolve, UNHIDE_TIMEOUT_MS)
-    await Promise.race([unhide, timeout.promise]).finally(() =>
-      clearTimeout(timer),
-    )
-    ctx.setAppState(prev =>
-      prev.computerUseMcpState?.hiddenDuringTurn === undefined
-        ? prev
-        : {
-            ...prev,
-            computerUseMcpState: {
-              ...prev.computerUseMcpState,
-              hiddenDuringTurn: undefined,
-            },
-          },
-    )
-  }
-
-  // Zero-syscall pre-check so non-CU turns don't touch disk. Release is still
-  // idempotent (returns false if already released or owned by another session).
-  if (!isLockHeldLocally()) return
-
-  // Unregister before lock release so the pump-retain drops as soon as the
-  // CU session ends. Idempotent — no-ops if registration failed at acquire.
-  // Swallow throws so a NAPI unregister error never prevents lock release —
-  // a held lock blocks the next CU session with "in use by another session".
-  try {
-    unregisterEscHotkey()
-  } catch (err) {
-    logForDebugging(
-      `[Computer Use MCP] unregisterEscHotkey failed: ${errorMessage(err)}`,
-    )
-  }
-
-  if (await releaseComputerUseLock()) {
-    ctx.sendOSNotification?.({
-      message: 'Claude is done using your computer',
-      notificationType: 'computer_use_exit',
-    })
-  }
-}

package/src/utils/computerUse/common.ts

@@ -1,61 +0,0 @@
-import { normalizeNameForMCP } from '../../services/mcp/normalization.js'
-import { env } from '../env.js'
-
-export const COMPUTER_USE_MCP_SERVER_NAME = 'computer-use'
-
-/**
- * Sentinel bundle ID for the frontmost gate. Claude Code is a terminal — it has
- * no window. This never matches a real `NSWorkspace.frontmostApplication`, so
- * the package's "host is frontmost" branch (mouse click-through exemption,
- * keyboard safety-net) is dead code for us. `prepareForAction`'s "exempt our
- * own window" is likewise a no-op — there is no window to exempt.
- */
-export const CLI_HOST_BUNDLE_ID = 'com.anthropic.claude-code.cli-no-window'
-
-/**
- * Fallback `env.terminal` → bundleId map for when `__CFBundleIdentifier` is
- * unset. Covers the macOS terminals we can distinguish — Linux entries
- * (konsole, gnome-terminal, xterm) are deliberately absent since
- * `createCliExecutor` is darwin-guarded.
- */
-const TERMINAL_BUNDLE_ID_FALLBACK: Readonly<Record<string, string>> = {
-  'iTerm.app': 'com.googlecode.iterm2',
-  Apple_Terminal: 'com.apple.Terminal',
-  ghostty: 'com.mitchellh.ghostty',
-  kitty: 'net.kovidgoyal.kitty',
-  WarpTerminal: 'dev.warp.Warp-Stable',
-  vscode: 'com.microsoft.VSCode',
-}
-
-/**
- * Bundle ID of the terminal emulator we're running inside, so `prepareDisplay`
- * can exempt it from hiding and `captureExcluding` can keep it out of
- * screenshots. Returns null when undetectable (ssh, cleared env, unknown
- * terminal) — caller must handle the null case.
- *
- * `__CFBundleIdentifier` is set by LaunchServices when a .app bundle spawns a
- * process and is inherited by children. It's the exact bundleId, no lookup
- * needed — handles terminals the fallback table doesn't know about. Under
- * tmux/screen it reflects the terminal that started the SERVER, which may
- * differ from the attached client. That's harmless here: we exempt A
- * terminal window, and the screenshots exclude it regardless.
- */
-export function getTerminalBundleId(): string | null {
-  const cfBundleId = process.env.__CFBundleIdentifier
-  if (cfBundleId) return cfBundleId
-  return TERMINAL_BUNDLE_ID_FALLBACK[env.terminal ?? ''] ?? null
-}
-
-/**
- * Static capabilities for macOS CLI. `hostBundleId` is not here — it's added
- * by `executor.ts` per `ComputerExecutor.capabilities`. `buildComputerUseTools`
- * takes this shape (no `hostBundleId`, no `teachMode`).
- */
-export const CLI_CU_CAPABILITIES = {
-  screenshotFiltering: 'native' as const,
-  platform: 'darwin' as const,
-}
-
-export function isComputerUseMCPServer(name: string): boolean {
-  return normalizeNameForMCP(name) === COMPUTER_USE_MCP_SERVER_NAME
-}