diffbroker 0.13.1 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 9fc1c3a662ccc736b0c62b0d083dbac979f52cf13f1c15e7eb5e12c009bdefe5
-  data.tar.gz: a2b6d513455ba9439a99b67603b9507b83aa3e510c323b2c94cf8748b5157e96
+  metadata.gz: d1d00b5898842a32e456087716d26bdb5b1c28e35f04e44b9d73acf8726d78f7
+  data.tar.gz: 25464398637a5bcf58c4e85f8babb57134cd1d3463e0325bb445b983328c7e09
 SHA512:
-  metadata.gz: 4dde5f0960aa3d14efcdc9e8c301a997bce559dff9ff14e836c4af2cbb5d5dcd4b8c35892b88a354aa0d30c593158c217f0e5559cf18456bd5531b1a3523bd53
-  data.tar.gz: acd78b508a85c294dab674659e7ed72caa263f712e688ea6006169ea92293106f19136547b7aac70b1be437c60eff80357c8f89e182689e18888518821a60807
+  metadata.gz: 306e519a17b426111cfe62d5ea845abd4b2c1e77534749864cb6b44cb9dd802126d85ab1025a1a89e8ba26f0ff08591f701f13c7c05aba75de2985ea629c14f6
+  data.tar.gz: e7e2f33022fcbc9c670821bff1025709c86cd5900ba52e229150ce4847ff8403fc304888117d942e0c616256af1a6616060dd45d5fe4f0ddf041e963a3a47ed8

data/lib/diffbroker/access_help.rb

@@ -0,0 +1,35 @@
+# frozen_string_literal: true
+
+module Diffbroker
+  # What `diffbroker status` says about folders the scan was refused: the folders and, on macOS, the steps that give the
+  # program access (Full Disk Access). Devices says the same in the browser (devices/_scan_roots). Which program needs the
+  # grant depends on how the companion runs, so both are named: the Ruby that runs the background service and the terminal.
+  module AccessHelp
+    module_function
+
+    def lines(paths, macos: RbConfig::CONFIG["host_os"].to_s.include?("darwin"), ruby: ruby_path)
+      return [] if paths.empty?
+
+      lines = [ "Folders the system would not let the companion read (their repositories are not found):" ]
+      lines += paths.map { "  #{_1}" }
+      lines += macos ? macos_steps(ruby) : [ "  Check who may read them (`ls -ld <folder>`): the companion runs as #{ENV["USER"] || "your user"}." ]
+      lines
+    end
+
+    def macos_steps(ruby)
+      [
+        "To allow it (macOS):",
+        "  1. Open System Settings > Privacy & Security > Full Disk Access.",
+        "  2. Click + and add the program that runs the companion: #{ruby}",
+        "     (in the file picker press Cmd+Shift+G to type a path). A companion you start by hand in a terminal uses that",
+        "     terminal app's access instead: add the terminal there.",
+        "  3. Run `diffbroker restart`.",
+        "Or keep your code outside cloud folders (Dropbox, iCloud Drive), which macOS protects."
+      ]
+    end
+
+    def ruby_path = File.realpath(RbConfig.ruby)
+  rescue SystemCallError
+    RbConfig.ruby
+  end
+end

data/lib/diffbroker/agents/claude.rb

@@ -51,12 +51,16 @@ module Diffbroker
         event = parse_json(line) or return nil
 
         case event["type"]
-        when "system" then Progress.new(step: "starting", session_id: event["session_id"]) if event["subtype"] == "init"
+        when "system"
+          return unless event["subtype"] == "init"
+
+          @billing = billing_for(event["apiKeySource"])
+          Progress.new(step: "starting", session_id: event["session_id"])
         when "assistant"
           tool = Array(event.dig("message", "content")).reverse.find { _1.is_a?(Hash) && _1["type"] == "tool_use" }
           tool && Progress.new(step: step_for(tool["name"].to_s, tool["input"].is_a?(Hash) ? tool["input"] : {}), session_id: nil)
         when "result"
-          Result.new(cost_usd: event["total_cost_usd"], text: event["result"].to_s, error: event["is_error"] == true)
+          Result.new(cost_usd: event["total_cost_usd"], text: event["result"].to_s, error: event["is_error"] == true, billing: @billing)
         end
       end
 
@@ -74,6 +78,14 @@ module Diffbroker
 
       private
 
+      # The init event names where the credentials come from: "none" is the OAuth login of a Claude subscription, anything
+      # else (ANTHROPIC_API_KEY, apiKeyHelper, …) is pay-per-token. An event without the key says nothing.
+      def billing_for(source)
+        return unless source.is_a?(String) && !source.empty?
+
+        source == "none" ? "subscription" : "api"
+      end
+
       def log_block(block)
         return unless block.is_a?(Hash)
 

data/lib/diffbroker/agents/codex.rb

@@ -1,5 +1,8 @@
 # frozen_string_literal: true
 
+require "open3"
+require "timeout"
+
 module Diffbroker
   module Agents
     # Codex. Autonomous: `codex exec --json` in a workspace-write sandbox with network (spec §4.2 step 5); the MCP
@@ -9,6 +12,35 @@ module Diffbroker
     # TaskRunner never runs Codex headless on an untrusted head.
     class Codex < Base
       READ_ONLY_ARGS = %w[--sandbox read-only].freeze
+      STATUS_TIMEOUT = 10
+      @billing_cache = {}
+      @billing_lock = Mutex.new
+
+      class << self
+        # `codex login status` once per process and command: "Logged in using ChatGPT" is a subscription, "using an API key" is
+        # pay-per-token. Anything else, or a failure, is unknown.
+        def billing_for(command)
+          @billing_lock.synchronize { @billing_cache.fetch(command) { @billing_cache[command] = detect_billing(command) } }
+        end
+
+        def parse_login_status(text)
+          case text.to_s
+          when /logged in using chatgpt/i then "subscription"
+          when /logged in using an api key/i then "api"
+          end
+        end
+
+        def reset_billing_cache! = @billing_lock.synchronize { @billing_cache.clear }
+
+        private
+
+        def detect_billing(command)
+          out, = Timeout.timeout(STATUS_TIMEOUT) { Open3.capture2e(command, "login", "status", stdin_data: "") }
+          parse_login_status(out)
+        rescue StandardError, Timeout::Error
+          nil
+        end
+      end
 
       def name = "codex"
 
@@ -25,8 +57,8 @@ module Diffbroker
         case event["type"]
         when "thread.started" then Progress.new(step: "starting", session_id: event["thread_id"])
         when "item.started", "item.completed" then item(event["item"].is_a?(Hash) ? event["item"] : {})
-        when "turn.completed" then Result.new(cost_usd: nil, text: @last_message.to_s, error: false)
-        when "turn.failed", "error" then Result.new(cost_usd: nil, text: @last_message.to_s, error: true)
+        when "turn.completed" then Result.new(cost_usd: nil, text: @last_message.to_s, error: false, billing: billing)
+        when "turn.failed", "error" then Result.new(cost_usd: nil, text: @last_message.to_s, error: true, billing: billing)
         end
       end
 
@@ -47,6 +79,8 @@ module Diffbroker
 
       private
 
+      def billing = self.class.billing_for(@config.codex_command)
+
       def item(item)
         case item["type"]
         when "command_execution" then Progress.new(step: "running a command", session_id: nil)

data/lib/diffbroker/agents.rb

@@ -4,7 +4,10 @@ module Diffbroker
   # The user's own coding agents, run headless (autonomous) or interactively (terminal). Spec §4.2 steps 5–7.
   module Agents
     Progress = Data.define(:step, :session_id)
-    Result = Data.define(:cost_usd, :text, :error)
+    # billing: "subscription" or "api" when the agent's login says how the run was paid, else nil.
+    Result = Data.define(:cost_usd, :text, :error, :billing) do
+      def initialize(cost_usd:, text:, error:, billing: nil) = super
+    end
     # One line of the run for the user's own log (kind: text, thinking, tool, error or result). Tool results (file
     # contents) are never an entry.
     Entry = Data.define(:kind, :text)

data/lib/diffbroker/cli.rb

@@ -303,9 +303,11 @@ module Diffbroker
       @out.puts "Roots:      #{config.roots.join(", ")} (plus the projects Claude Code and Codex know)"
       @out.puts "Worktrees:  #{config.worktree_root}"
       @out.puts "Task worktrees: #{Worktree.new(root: config.worktree_root).list.size} (running or kept; `diffbroker clean` removes finished ones)"
-      repositories = config.repo_scanner.scan
+      scanner = config.repo_scanner
+      repositories = scanner.scan
       @out.puts "Repositories found: #{repositories.size}"
       repositories.each { @out.puts "  #{_1["full_name"]}  #{_1["path"]}" }
+      AccessHelp.lines(scanner.unreadable).each { @out.puts _1 }
     end
 
     # What the daemon wrote about itself (DaemonState), next to what this installed version and service would run.

data/lib/diffbroker/daemon.rb

@@ -242,7 +242,9 @@ module Diffbroker
     def rescan(client)
       @repositories = @scanner.scan
       @scanned_at = @clock.call
-      client.perform("repositories", "repositories" => @repositories)
+      payload = { "repositories" => @repositories }
+      payload["unreadable"] = @scanner.unreadable if @scanner.respond_to?(:unreadable) # Devices explains how to grant access
+      client.perform("repositories", payload)
     end
 
     # The plan limits change slowly and reading them can wait on the network, so: every few minutes, off the tick's thread.

data/lib/diffbroker/explain_verifier.rb

@@ -49,7 +49,8 @@ module Diffbroker
       when "cancelled" then [ "cancelled", "cancelled" ]
       else [ "failed", verify.error_code || "agent_failed" ]
       end
-      TaskRunner::Outcome.new(status, costs.empty? ? nil : costs.sum.round(6), code, verify.last_output || write.last_output)
+      TaskRunner::Outcome.new(status, costs.empty? ? nil : costs.sum.round(6), code, verify.last_output || write.last_output, false,
+                           [ write.billing, verify.billing ].include?("api") ? "api" : write.billing || verify.billing)
     end
   end
 end

data/lib/diffbroker/repo_scanner.rb

@@ -21,6 +21,11 @@ module Diffbroker
 
     # `exclude` (the task worktrees) is skipped everywhere. `ignored` (folders the user removed) is skipped by everything
     # found by itself; `explicit_roots` (folders the user added) are scanned even inside an ignored folder.
+    # Folders the last scan was refused (macOS answers EPERM for Dropbox, iCloud, Desktop and the like until the program has
+    # been given access; other systems say EACCES). Reported to the server so Devices can explain how to grant it.
+    MAX_UNREADABLE = 20
+    attr_reader :unreadable
+
     def initialize(roots:, depth: 3, exclude: [], hints: [], home: Dir.home, explicit_roots: [], ignored: [])
       @roots = roots
       @explicit_roots = explicit_roots
@@ -30,10 +35,12 @@ module Diffbroker
       @depth = depth
       @exclude = exclude.map { File.expand_path(_1) }
       @skip = @exclude + @ignored
+      @unreadable = []
     end
 
     def scan
       found = {}
+      @unreadable = []
       @roots.each { |root| walk(File.expand_path(root), 0, found, @depth, @skip) if File.directory?(root) }
       @explicit_roots.each { |root| walk(File.expand_path(root), 0, found, @depth, @exclude) if File.directory?(root) }
       parents = @hints.filter_map { |hint| add_hint(File.expand_path(hint), found) }.map { File.dirname(_1) }.uniq
@@ -79,8 +86,10 @@ module Diffbroker
         path = File.join(dir, child)
         walk(path, level + 1, found, limit, skip) if File.directory?(path) && !File.symlink?(path)
       end
+    rescue Errno::EPERM, Errno::EACCES
+      @unreadable << dir if @unreadable.size < MAX_UNREADABLE && !@unreadable.include?(dir)
     rescue SystemCallError
-      nil # a folder that cannot be listed (macOS answers EPERM for Dropbox, iCloud and other protected folders) holds nothing for us
+      nil # gone meanwhile, or not a folder: nothing to report
     end
 
     def remote_names(dir) = GitContext.remote_urls(dir).filter_map { |_name, url| self.class.full_name_from(url) }.uniq

data/lib/diffbroker/task_runner.rb

@@ -12,7 +12,7 @@ module Diffbroker
     PRINT_OUTPUT = 120
 
     Handle = Struct.new(:pid, :cancelled)
-    Outcome = Struct.new(:status, :cost_usd, :error_code, :last_output, :no_result)
+    Outcome = Struct.new(:status, :cost_usd, :error_code, :last_output, :no_result, :billing)
 
     def initialize(config:, report:, worktree: Worktree.new(root: config.worktree_root), neutralizer: Neutralizer.new,
                    gh_check: GhCheck.new, launcher: Launcher.new(name: config.terminal), out: $stdout, grace: CANCEL_GRACE,
@@ -146,7 +146,7 @@ module Diffbroker
       outcome = run_with_resume(task, agent, mcp_config, dir)
       outcome = verify_after_write(task, outcome, agent, mcp_config, dir) if ExplainVerifier.verified?(task) && outcome.status == "done"
       outcome = publish_branch(task, outcome, dir) if outcome.status == "done"
-      finished(id, outcome.status, outcome.cost_usd, outcome.error_code, outcome.last_output)
+      finished(id, outcome.status, outcome.cost_usd, outcome.error_code, outcome.last_output, outcome.billing)
     ensure
       @lock.synchronize do
         @running.delete(id)
@@ -184,7 +184,7 @@ module Diffbroker
       say(task["task_id"], result.message)
       return outcome unless result.failed?
 
-      Outcome.new("failed", outcome.cost_usd, "agent_failed", result.message)
+      Outcome.new("failed", outcome.cost_usd, "agent_failed", result.message, false, outcome.billing)
     end
 
     # The same push for a terminal run, executed by its script after the agent exits (`diffbroker publish-branch`).
@@ -204,9 +204,9 @@ module Diffbroker
       rescue Error => e
         # The explanation is written; keep its cost and let the server show it as not verified.
         say(id, "Verifier skipped: #{e.message}")
-        return Outcome.new("done", write.cost_usd, nil, "Verifier skipped: #{e.message}")
+        return Outcome.new("done", write.cost_usd, nil, "Verifier skipped: #{e.message}", false, write.billing)
       end
-      return Outcome.new("cancelled", write.cost_usd, "cancelled", write.last_output) if @lock.synchronize { @cancelled.include?(id) }
+      return Outcome.new("cancelled", write.cost_usd, "cancelled", write.last_output, false, write.billing) if @lock.synchronize { @cancelled.include?(id) }
 
       verify = run_process(task.merge("prompt" => prompt), agent, mcp_config, dir, step: "verifying", phase: "verifier")
       ExplainVerifier.combine(write, verify)
@@ -227,9 +227,9 @@ module Diffbroker
       # Only the agent's own result text: a raw stream-json line can carry file contents (spec §5.2).
       output = result&.text
 
-      if handle.cancelled then Outcome.new("cancelled", result&.cost_usd, "cancelled", output)
-      elsif status.success? && !result&.error then Outcome.new("done", result&.cost_usd, nil, output)
-      else Outcome.new("failed", result&.cost_usd, "agent_failed", output, result.nil?)
+      if handle.cancelled then Outcome.new("cancelled", result&.cost_usd, "cancelled", output, false, result&.billing)
+      elsif status.success? && !result&.error then Outcome.new("done", result&.cost_usd, nil, output, false, result&.billing)
+      else Outcome.new("failed", result&.cost_usd, "agent_failed", output, result.nil?, result&.billing)
       end
     ensure
       writer.close if writer && !writer.closed?
@@ -297,12 +297,14 @@ module Diffbroker
       say(id, "progress: #{step}") unless step == "starting"
     end
 
-    def finished(id, status, cost_usd, error_code, last_output)
+    def finished(id, status, cost_usd, error_code, last_output, billing = nil)
       return if @lock.synchronize { @interrupted }
 
       last = last_output.to_s.lines.last.to_s.strip
-      @report.call("finished", { "task_id" => id, "status" => status, "cost_usd" => cost_usd, "error_code" => error_code,
-                                 "last_output" => last[0, MAX_OUTPUT] })
+      payload = { "task_id" => id, "status" => status, "cost_usd" => cost_usd, "error_code" => error_code,
+                  "last_output" => last[0, MAX_OUTPUT] }
+      payload["billing"] = billing if %w[subscription api].include?(billing)
+      @report.call("finished", payload)
       summary = [ (error_code && error_code != status ? "#{status} (#{error_code})" : status), (format("$%.2f", cost_usd) if cost_usd&.positive?),
                   (last[0, PRINT_OUTPUT] unless last.empty?) ].compact.join(" · ")
       say(id, summary)

data/lib/diffbroker/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module Diffbroker
-  VERSION = "0.13.1"
+  VERSION = "0.15.0"
 end

data/lib/diffbroker.rb

@@ -32,6 +32,7 @@ module Diffbroker
   autoload :Launcher, File.expand_path("diffbroker/launcher", __dir__)
   autoload :Maintenance, File.expand_path("diffbroker/maintenance", __dir__)
   autoload :LocalRelay, File.expand_path("diffbroker/local_relay", __dir__)
+  autoload :AccessHelp, File.expand_path("diffbroker/access_help", __dir__)
   autoload :Login, File.expand_path("diffbroker/login", __dir__)
   autoload :Neutralizer, File.expand_path("diffbroker/neutralizer", __dir__)
   autoload :PlanUsage, File.expand_path("diffbroker/plan_usage", __dir__)

data/plugin/.claude-plugin/plugin.json

@@ -1,5 +1,5 @@
 {
   "name": "diffbroker",
-  "version": "0.13.1",
+  "version": "0.15.0",
   "description": "Skills for working on Diff Broker agent tasks: the diffbroker MCP tools, write rules and report_task."
 }

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: diffbroker
 version: !ruby/object:Gem::Version
-  version: 0.13.1
+  version: 0.15.0
 platform: ruby
 authors:
 - Yuri Sidorov (@newstler)
@@ -34,6 +34,7 @@ files:
 - LICENSE.txt
 - exe/diffbroker
 - lib/diffbroker.rb
+- lib/diffbroker/access_help.rb
 - lib/diffbroker/agent_projects.rb
 - lib/diffbroker/agents.rb
 - lib/diffbroker/agents/base.rb