kward 0.77.0 → 0.78.0

data/lib/kward/model/client.rb

@@ -6,6 +6,7 @@ require_relative "../auth/github_oauth"
 require_relative "../auth/openai_oauth"
 require_relative "../cancellation"
 require_relative "../config_files"
+require_relative "../http"
 require_relative "../openrouter_model_cache"
 require_relative "context_overflow"
 require_relative "copilot_models"
@@ -35,6 +36,7 @@ module Kward
     DEFAULT_OPENAI_MODEL = ModelInfo::DEFAULT_OPENAI_MODEL
     DEFAULT_REASONING_EFFORT = ModelInfo::DEFAULT_REASONING_EFFORT
     RETRY_DELAYS = [1, 2].freeze
+    DEFAULT_STREAM_IDLE_TIMEOUT_SECONDS = 120
     NON_RETRYABLE_PROVIDER_LIMIT_PATTERNS = [
       /GoUsageLimitError/i,
       /FreeUsageLimitError/i,
@@ -335,7 +337,7 @@ module Kward
     end
 
     def chat_anthropic_provider(url:, token:, request_body:, current_model:, on_reasoning_delta:, on_assistant_delta:, cancellation:)
-      request = Net::HTTP::Post.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Post.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["Content-Type"] = "application/json"
       request["Accept"] = "text/event-stream"
@@ -343,7 +345,7 @@ module Kward
       request.body = request_body
 
       message = nil
-      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: nil) do |http|
+      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: stream_idle_timeout_seconds) do |http|
         cancellation&.on_cancel { close_http(http) }
         cancellation&.raise_if_cancelled!
         http.request(request) do |response|
@@ -361,7 +363,7 @@ module Kward
     end
 
     def chat_openrouter_provider(url:, token:, request_body:, current_model:, on_assistant_delta:, cancellation:)
-      request = Net::HTTP::Post.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Post.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["Content-Type"] = "application/json"
       request.body = request_body
@@ -547,7 +549,7 @@ module Kward
       return [] if token.empty?
 
       url = URI("#{@github_oauth.base_url}/models")
-      request = Net::HTTP::Get.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Get.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["Accept"] = "application/json"
       copilot_headers([]).each { |key, value| request[key] = value }
@@ -577,7 +579,7 @@ module Kward
 
     def copilot_responses_chat(token, request_body:, on_assistant_delta: nil, cancellation: nil)
       url = URI("#{@github_oauth.base_url}/responses")
-      request = Net::HTTP::Post.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Post.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["Content-Type"] = "application/json"
       request["Accept"] = "text/event-stream"
@@ -585,7 +587,7 @@ module Kward
       request.body = request_body
 
       message = nil
-      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: nil) do |http|
+      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: stream_idle_timeout_seconds) do |http|
         cancellation&.on_cancel { close_http(http) }
         cancellation&.raise_if_cancelled!
         http.request(request) do |response|
@@ -603,7 +605,7 @@ module Kward
     end
 
     def copilot_chat(url, token, messages, tools, request_body: nil, on_assistant_delta: nil, cancellation: nil)
-      request = Net::HTTP::Post.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Post.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["Content-Type"] = "application/json"
       request["Accept"] = "text/event-stream"
@@ -633,7 +635,6 @@ module Kward
         "anthropic-version" => "2023-06-01",
         "anthropic-beta" => "claude-code-20250219,oauth-2025-04-20",
         "anthropic-dangerous-direct-browser-access" => "true",
-        "user-agent" => "claude-cli/2.1.75",
         "x-app" => "cli"
       }
     end
@@ -653,16 +654,16 @@ module Kward
     end
 
     def codex_chat(url, token, account_id, messages, tools, request_body: nil, on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil, cancellation: nil, max_tokens: nil)
-      request = Net::HTTP::Post.new(url)
+      request = Http.apply_user_agent(Net::HTTP::Post.new(url))
       request["Authorization"] = "Bearer #{token}"
       request["ChatGPT-Account-Id"] = account_id if account_id
       request["Content-Type"] = "application/json"
       request["Accept"] = "text/event-stream"
-      request["originator"] = "codex_cli_rs"
       request.body = request_body || JSON.dump(codex_payload(messages, tools, max_tokens: max_tokens))
+      apply_codex_identity(request, luna: luna_request?(request.body))
 
       message = nil
-      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: nil) do |http|
+      Net::HTTP.start(url.hostname, url.port, use_ssl: true, read_timeout: stream_idle_timeout_seconds) do |http|
         cancellation&.on_cancel { close_http(http) }
         cancellation&.raise_if_cancelled!
         http.request(request) do |response|
@@ -684,6 +685,22 @@ module Kward
       raise e
     end
 
+    def apply_codex_identity(request, luna:)
+      request["originator"] = "kward"
+      return unless luna
+
+      # TODO: Remove this Luna-specific Responses Lite workaround when Codex accepts Kward's own client identity.
+      request["originator"] = "codex_cli_rs"
+      request["User-Agent"] = "codex_cli_rs/0.144.1"
+      request["x-openai-internal-codex-responses-lite"] = "true"
+    end
+
+    def luna_request?(request_body)
+      JSON.parse(request_body)["model"] == "gpt-5.6-luna"
+    rescue JSON::ParserError
+      false
+    end
+
     def parse_codex_sse(body, on_reasoning_delta: nil, on_reasoning_boundary: nil, on_assistant_delta: nil)
       ModelStreamParser.parse_codex_sse(body, on_reasoning_delta: on_reasoning_delta, on_reasoning_boundary: on_reasoning_boundary, on_assistant_delta: on_assistant_delta, show_raw_reasoning: codex_show_raw_reasoning?, usage_normalizer: method(:normalized_usage), request_error_class: RequestError)
     end
@@ -842,6 +859,11 @@ module Kward
       @config["codex_show_raw_reasoning"] == true
     end
 
+    def stream_idle_timeout_seconds
+      value = @config["stream_idle_timeout_seconds"].to_i
+      value.positive? ? value : DEFAULT_STREAM_IDLE_TIMEOUT_SECONDS
+    end
+
     def load_config
       ConfigFiles.read_config(@config_path)
     end

data/lib/kward/model/payloads.rb

@@ -126,7 +126,12 @@ module Kward
         store: false,
         include: []
       }
-      payload[:reasoning] = { effort: reasoning || reasoning_effort("Codex"), summary: "auto" } unless reasoning == false
+      unless reasoning == false
+        effort = reasoning || reasoning_effort("Codex")
+        payload[:reasoning] = { effort: effort, summary: "auto" }
+        # TODO: Remove this Luna-specific Responses Lite workaround when Codex accepts Kward's own client identity.
+        payload[:reasoning][:context] = "all_turns" if parts[:model] == "gpt-5.6-luna"
+      end
       payload
     end
 

data/lib/kward/openrouter_model_cache.rb

@@ -4,6 +4,7 @@ require "net/http"
 require "time"
 require "uri"
 require_relative "config_files"
+require_relative "http"
 require_relative "private_file"
 
 # Namespace for the Kward CLI agent runtime.
@@ -71,7 +72,7 @@ module Kward
     private
 
     def refresh_request
-      Net::HTTP::Get.new(MODELS_URL).tap do |request|
+      Http.apply_user_agent(Net::HTTP::Get.new(MODELS_URL)).tap do |request|
         request["Authorization"] = "Bearer #{@api_key}"
         request["Accept"] = "application/json"
       end

data/lib/kward/permissions/policy.rb

@@ -0,0 +1,171 @@
+require "uri"
+
+# Namespace for Kward's permission-policy runtime.
+module Kward
+  module Permissions
+    # Evaluates the opt-in permission policy for model-requested tool calls.
+    #
+    # The policy is intentionally a decision layer, not a process sandbox. It
+    # can prevent Kward from starting a tool, but it cannot constrain a shell
+    # command after it has begun. OS-enforced sandboxing belongs at a lower
+    # process boundary.
+    class Policy
+      MODES = %w[ask read-only workspace-write deny-by-default].freeze
+      NETWORK_TOOLS = %w[web_search fetch_content fetch_raw].freeze
+      FILE_CHANGE_TOOLS = %w[write_file edit_file].freeze
+
+      Decision = Struct.new(:action, :reason, keyword_init: true) do
+        def allowed?
+          action == :allow
+        end
+
+        def approval_required?
+          action == :ask
+        end
+
+        def denied?
+          action == :deny
+        end
+      end
+
+      def self.from_config(config)
+        permissions = config["permissions"].is_a?(Hash) ? config["permissions"] : {}
+        new(
+          enabled: permissions["enabled"] == true,
+          mode: permissions["mode"],
+          allow: permissions["allow"],
+          ask: permissions["ask"],
+          deny: permissions["deny"],
+          write_scopes: permissions.key?("write_scopes") ? permissions["write_scopes"] : nil
+        )
+      end
+
+      def initialize(enabled: false, mode: "ask", allow: [], ask: [], deny: [], write_scopes: nil)
+        @enabled = enabled == true
+        @mode = normalize_mode(mode)
+        @allow = normalize_rules(allow)
+        @ask = normalize_rules(ask)
+        @deny = normalize_rules(deny)
+        @write_scopes = normalize_scopes(write_scopes)
+        @session_allowed_tools = {}
+      end
+
+      def enabled?
+        @enabled
+      end
+
+      # Allows this model tool for the remaining lifetime of this policy object.
+      # A matching deny or ask rule still takes precedence over this temporary grant.
+      def allow_for_session!(tool_name)
+        @session_allowed_tools[tool_name.to_s] = true
+      end
+
+      def decision_for(tool_name, arguments, source: nil)
+        return Decision.new(action: :allow, reason: "permissions disabled") unless enabled?
+
+        request = request_for(tool_name, arguments, source: source)
+        return Decision.new(action: :deny, reason: "matched deny rule") if matches?(@deny, request)
+        return Decision.new(action: :ask, reason: "matched ask rule") if matches?(@ask, request)
+        return Decision.new(action: :allow, reason: "matched allow rule") if matches?(@allow, request)
+        return Decision.new(action: :allow, reason: "allowed for this session") if @session_allowed_tools[request.fetch("tool")]
+
+        default_decision(request)
+      end
+
+      private
+
+      def normalize_mode(mode)
+        value = mode.to_s
+        MODES.include?(value) ? value : "ask"
+      end
+
+      def normalize_rules(rules)
+        Array(rules).filter_map do |rule|
+          next unless rule.is_a?(Hash)
+
+          rule.transform_keys(&:to_s).slice("tool", "path", "host", "command", "source")
+        end
+      end
+
+      def normalize_scopes(scopes)
+        return nil if scopes.nil?
+
+        Array(scopes).map(&:to_s).reject(&:empty?)
+      end
+
+      def request_for(tool_name, arguments, source:)
+        name = tool_name.to_s
+        args = arguments.to_h
+        {
+          "tool" => name,
+          "path" => args["path"] || args[:path],
+          "host" => request_host(name, args),
+          "command" => args["command"] || args[:command],
+          "source" => source.to_s
+        }.compact.transform_values(&:to_s)
+      end
+
+      def request_host(name, arguments)
+        return nil unless %w[fetch_content fetch_raw].include?(name)
+
+        URI.parse((arguments["url"] || arguments[:url]).to_s).host
+      rescue URI::InvalidURIError
+        nil
+      end
+
+      def matches?(rules, request)
+        rules.any? { |rule| rule_matches?(rule, request) }
+      end
+
+      def rule_matches?(rule, request)
+        return false if rule.empty?
+
+        rule.all? do |field, pattern|
+          value = request[field]
+          value && glob_match?(pattern.to_s, value)
+        end
+      end
+
+      def glob_match?(pattern, value)
+        expression = Regexp.escape(pattern).gsub("\\*\\*", ".*").gsub("\\*", "[^/]*")
+        Regexp.new("\\A#{expression}\\z").match?(value)
+      end
+
+      def default_decision(request)
+        return Decision.new(action: :deny, reason: "read-only mode") if @mode == "read-only" && risky?(request)
+        return Decision.new(action: :deny, reason: "deny-by-default mode") if @mode == "deny-by-default" && risky?(request)
+
+        if file_change?(request) && outside_write_scopes?(request)
+          return Decision.new(action: :deny, reason: "path outside write scopes")
+        end
+
+        if @mode == "workspace-write" && file_change?(request)
+          return Decision.new(action: :allow, reason: "workspace write mode")
+        end
+
+        return Decision.new(action: :allow, reason: "read-only tool") unless risky?(request)
+
+        Decision.new(action: :ask, reason: "#{request.fetch("tool")} requires approval")
+      end
+
+      def file_change?(request)
+        FILE_CHANGE_TOOLS.include?(request.fetch("tool"))
+      end
+
+      def network?(request)
+        NETWORK_TOOLS.include?(request.fetch("tool")) || request["source"] == "mcp"
+      end
+
+      def risky?(request)
+        file_change?(request) || request.fetch("tool") == "run_shell_command" || network?(request)
+      end
+
+      def outside_write_scopes?(request)
+        return false if @write_scopes.nil?
+
+        path = request["path"]
+        path.nil? || !@write_scopes.any? { |scope| glob_match?(scope, path) }
+      end
+    end
+  end
+end

data/lib/kward/plugin_registry.rb

@@ -34,6 +34,10 @@ module Kward
       end
     end
 
+    # Registered plugin-owned tab runtime. Its factory receives a
+    # `PluginTabHost` and its persisted descriptor, then returns a driver.
+    TabType = Struct.new(:id, :name, :title, :singleton, :rpc, :transcript_events, :path, :handler, keyword_init: true)
+
     # Read-only event passed to plugin transcript observers.
     TranscriptEvent = Struct.new(:type, :payload, keyword_init: true) do
       def to_h
@@ -264,6 +268,23 @@ module Kward
       def interactive_command(name, rows:, fps: 30, description: "", argument_hint: "", &block)
         @registry.register_interactive_command(name, rows: rows, fps: fps, description: description, argument_hint: argument_hint, path: @path, &block)
       end
+
+      # Registers a plugin-owned tab type for the interactive CLI. `id` is a
+      # durable identifier used in persisted tab layouts and must not change.
+      # The factory receives a `PluginTabHost` and a descriptor hash.
+      #
+      # @param name [String] command name used by `/tab open <name>`
+      # @param id [String] stable persisted tab type identifier
+      # @param title [String] default tab label
+      # @param singleton [Symbol] `:global` for one shared plugin runtime
+      # @param transcript_events [Boolean] allow global transcript observers to receive this tab's events
+      # @yieldparam host [PluginTabHost] supported host dependencies
+      # @yieldparam descriptor [Hash] persisted tab descriptor
+      # @return [void]
+      # @api public
+      def tab_type(name, id:, title: nil, singleton: nil, rpc: false, transcript_events: false, &block)
+        @registry.register_tab_type(name, id: id, title: title, singleton: singleton, rpc: rpc, transcript_events: transcript_events, path: @path, &block)
+      end
     end
 
     # Mutable singleton guard used while loading trusted plugin files.
@@ -282,6 +303,8 @@ module Kward
       @reserved_commands = reserved_commands.map(&:to_s)
       @commands = {}
       @interactive_commands = {}
+      @tab_types = {}
+      @tab_types_by_id = {}
       @footer = nil
       @footer_path = nil
       @transcript_event_handlers = []
@@ -312,6 +335,18 @@ module Kward
       @interactive_commands[name.to_s]
     end
 
+    def tab_types
+      @tab_types.values
+    end
+
+    def tab_type_for(name)
+      @tab_types[name.to_s]
+    end
+
+    def tab_type_for_id(id)
+      @tab_types_by_id[id.to_s]
+    end
+
     def footer_renderer
       @footer
     end
@@ -429,6 +464,23 @@ module Kward
       )
     end
 
+    def register_tab_type(name, id:, title: nil, singleton: nil, rpc: false, transcript_events: false, path: nil, &handler)
+      name = name.to_s
+      id = id.to_s
+      raise "Plugin tab type name is invalid: #{name}" unless name.match?(COMMAND_NAME_PATTERN)
+      raise "Plugin tab type id is required" if id.empty?
+      raise "Plugin tab type #{name} requires a handler" unless handler
+
+      if @tab_types.key?(name) || @tab_types_by_id.key?(id)
+        warn "Warning: skipping duplicate Kward plugin tab type #{id}: #{path}"
+        return nil
+      end
+
+      tab_type = TabType.new(id: id, name: name, title: title.to_s.empty? ? name.capitalize : title.to_s, singleton: singleton&.to_sym, rpc: rpc == true, transcript_events: transcript_events == true, path: path, handler: handler)
+      @tab_types[name] = tab_type
+      @tab_types_by_id[id] = tab_type
+    end
+
     def register_footer(path: nil, &renderer)
       raise "Plugin footer requires a renderer" unless renderer
 
@@ -500,7 +552,7 @@ module Kward
       end
     end
 
-    def transcript_event(type, payload)
+    def transcript_event(type, payload = {})
       TranscriptEvent.new(
         type: type,
         payload: DeepCopy.freeze(DeepCopy.dup(payload))

data/lib/kward/prompt_interface/approval_prompt.rb

@@ -0,0 +1,62 @@
+require "json"
+
+# Namespace for the Kward CLI agent runtime.
+module Kward
+  class PromptInterface
+    # Tool-approval overlay built on the structured question modal.
+    module ApprovalPrompt
+      # Asks the captain to approve a model-requested tool call. Cancellation is
+      # intentionally a denial so a closed or interrupted overlay never permits
+      # a side effect.
+      def ask_tool_approval(tool_name:, args:, reason: nil)
+        summary, details = tool_approval_details(tool_name, args)
+        question = (["The agent wants to #{summary}."] + Array(details) + [reason.to_s].reject(&:empty?)).join("\n")
+        answers = ask_user_question([
+          {
+            header: "Approval required · #{tool_approval_title(tool_name)}",
+            question: question,
+            options: [
+              { label: "Allow once", description: "Run this tool call." },
+              { label: "Allow this tool for this session", description: "Run this call and future calls to #{tool_name}." },
+              { label: "Deny", description: "Do not run this tool call." }
+            ]
+          }
+        ])
+        answer = answers&.first
+        return { denied_message: answer[:answer] } if answer&.fetch(:custom, false) && !answer[:answer].to_s.empty?
+
+        case answer&.fetch(:answer, nil)
+        when "Allow once" then true
+        when "Allow this tool for this session" then :allow_for_session
+        else false
+        end
+      end
+
+      private
+
+      def tool_approval_title(tool_name)
+        case tool_name.to_s
+        when "run_shell_command" then "Shell command"
+        when "write_file" then "Write file"
+        when "edit_file" then "Edit file"
+        when "fetch_content", "fetch_raw" then "Network request"
+        when "web_search" then "Web search"
+        else tool_name.to_s.tr("_", " ").capitalize
+        end
+      end
+
+      def tool_approval_details(tool_name, args)
+        action = case tool_name.to_s
+                 when "run_shell_command" then "run this shell command"
+                 when "write_file" then "write this file"
+                 when "edit_file" then "edit this file"
+                 when "read_file", "read_skill" then "read these resources"
+                 when "fetch_content", "fetch_raw" then "make this network request"
+                 when "web_search" then "search the web"
+                 else "use #{tool_name}"
+                 end
+        [action, ["Arguments:\n#{JSON.pretty_generate(args.to_h)}"]]
+      end
+    end
+  end
+end

data/lib/kward/prompt_interface/question_prompt.rb

@@ -337,11 +337,12 @@ module Kward
 
       def question_overlay_rows(width)
         title = "Question #{@question_state[:index]}/#{@question_state[:total]} · #{@question_state[:header]}"
-        lines = [
-          overlay_text_line(@question_state[:question].to_s, :bold),
+        content_width = [overlay_card_width(width) - 4, 1].max
+        lines = question_text_rows(@question_state[:question], content_width, :bold)
+        lines.concat([
           overlay_text_line("↑/↓ select · Enter choose · Esc cancel", :muted),
           overlay_blank_line
-        ]
+        ])
         question_choices.each_with_index do |choice, index|
           selected = index == question_selection_index
           lines << overlay_choice_line(choice_text(choice, selected: selected), selected: selected)
@@ -349,6 +350,14 @@ module Kward
         overlay_card_rows(title, lines, width)
       end
 
+      def question_text_rows(text, width, style)
+        text.to_s.split("\n", -1).flat_map do |line|
+          wrapped = ANSI.wrap_visible(line, width)
+          wrapped = [""] if wrapped.empty?
+          wrapped.map { |row| overlay_text_line(row, style) }
+        end
+      end
+
       def choice_text(choice, selected: false)
         if choice[:custom]
           selected ? "Type a custom answer below." : "Type something."

data/lib/kward/prompt_interface.rb

@@ -25,6 +25,7 @@ require_relative "prompt_interface/file_overlay"
 require_relative "prompt_interface/project_browser"
 require_relative "prompt_interface/selection_prompt"
 require_relative "prompt_interface/question_prompt"
+require_relative "prompt_interface/approval_prompt"
 require_relative "prompt_interface/git_prompt"
 require_relative "prompt_interface/overlay_renderer"
 require_relative "prompt_interface/editor/renderer"
@@ -75,6 +76,7 @@ module Kward
     include ProjectBrowser
     include SelectionPrompt
     include QuestionPrompt
+    include ApprovalPrompt
     include GitPrompt
     include OverlayRenderer
     include EditorRenderer