@akanjs/devkit 3.0.0-beta.2 → 3.0.0-beta.20

package/cloud/globalConfig.ts

@@ -1,6 +1,7 @@
-import { chmod, mkdir } from "node:fs/promises";
+import { mkdir, rename, rm, writeFile } from "node:fs/promises";
 import dayjs from "dayjs";
 import { FileSys } from "../fileSys";
+import { ConfigLock } from "./configLock";
 import {
   type AccessToken,
   type AccessTokenDto,
@@ -12,6 +13,7 @@ import {
   type HostConfig,
   type HostConfigDto,
   type RemoteEnvServerConfig,
+  type TestTargetsConfig,
 } from "./constants";
 
 export class GlobalConfig {
@@ -27,58 +29,94 @@ export class GlobalConfig {
       ...akanConfig,
       cloudHost: akanConfig.cloudHost ?? defaultAkanGlobalConfig.cloudHost,
       remoteEnvServers: akanConfig.remoteEnvServers ?? defaultAkanGlobalConfig.remoteEnvServers,
+      testTargets: akanConfig.testTargets ?? defaultAkanGlobalConfig.testTargets,
     };
   }
-  /**
-   * This file holds the cloud jwt, a refresh token that does not expire, and the LLM api key, so it is
-   * written owner-only — the same `0600` the runtime gives its control socket. `Bun.write` takes no mode
-   * and lands on `0666 & ~umask` (0644 on a default shell), so the mode is applied after the write; an
-   * existing world-readable file is tightened by the next write rather than left as it was found.
-   */
+  // Holds the cloud jwt and refresh token, so owner-only 0600: written to a 0600 sibling and renamed over the file,
+  // which also replaces a world-readable one and never shows another CLI process a half-written file.
   static async #setAkanGlobalConfig(akanConfig: AkanGlobalConfig) {
     await mkdir(basePath, { recursive: true, mode: 0o700 });
-    await Bun.write(configPath, JSON.stringify(akanConfig, null, 2));
-    await chmod(configPath, 0o600);
+    const temp = `${configPath}.${process.pid}.${crypto.randomUUID()}.tmp`;
+    try {
+      await writeFile(temp, JSON.stringify(akanConfig, null, 2), { mode: 0o600 });
+      await rename(temp, configPath);
+    } catch (error) {
+      await rm(temp, { force: true });
+      throw error;
+    }
+  }
+  static readonly #lockPath = `${configPath}.lock`;
+  // Every write re-reads under the lock: one built on an earlier read could restore a rotated-away refresh token.
+  static async #update(mutate: (akanConfig: AkanGlobalConfig) => AkanGlobalConfig) {
+    await ConfigLock.run(GlobalConfig.#lockPath, async () => {
+      await GlobalConfig.#setAkanGlobalConfig(mutate(await GlobalConfig.#getAkanGlobalConfig()));
+    });
   }
   static async getHostConfig(host = GlobalConfig.akanCloudHost): Promise<HostConfig> {
     const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
     return GlobalConfig.toHostConfig(akanConfig.cloudHost[host] ?? getDefaultHostConfig(host));
   }
   static async setHostConfig(config: HostConfig = getDefaultHostConfig()) {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    akanConfig.cloudHost[config.host] = GlobalConfig.toHostConfigDto(config);
-    await GlobalConfig.#setAkanGlobalConfig(akanConfig);
+    await GlobalConfig.#update((akanConfig) => GlobalConfig.#withHost(akanConfig, config));
   }
-  static async getLlmConfig(): Promise<AkanGlobalConfig["llm"]> {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    return akanConfig.llm ?? null;
+  static #withHost(akanConfig: AkanGlobalConfig, config: HostConfig): AkanGlobalConfig {
+    return {
+      ...akanConfig,
+      cloudHost: { ...akanConfig.cloudHost, [config.host]: GlobalConfig.toHostConfigDto(config) },
+    };
   }
-  static async setLlmConfig(llmConfig: AkanGlobalConfig["llm"]) {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    await GlobalConfig.#setAkanGlobalConfig({ ...akanConfig, llm: llmConfig });
+  // The cloud rotates the refresh token and revokes every session of the account when one is presented twice, so it
+  // leaves the disk before it is sent: a refresh killed in flight leaves nothing to replay, only a sign-in to redo.
+  static async refreshHostAuth(host: string, refresh: (refreshToken: string) => Promise<AccessToken>) {
+    try {
+      return await ConfigLock.run(GlobalConfig.#lockPath, async () => {
+        const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
+        const current = GlobalConfig.toHostConfig(akanConfig.cloudHost[host] ?? getDefaultHostConfig(host));
+        const accessToken = current.auth?.accessToken;
+        const refreshToken = accessToken?.refreshToken;
+        if (!accessToken || !refreshToken || !GlobalConfig.needRefreshToken(accessToken)) return current;
+        const claimed: HostConfig = {
+          ...current,
+          auth: { ...current.auth, accessToken: { ...accessToken, refreshToken: null } },
+        };
+        await GlobalConfig.#setAkanGlobalConfig(GlobalConfig.#withHost(akanConfig, claimed));
+        const next = await refresh(refreshToken).catch(() => null);
+        if (!next?.jwt) return claimed;
+        const refreshed: HostConfig = { ...current, auth: { ...current.auth, accessToken: next } };
+        await GlobalConfig.#setAkanGlobalConfig(
+          GlobalConfig.#withHost(await GlobalConfig.#getAkanGlobalConfig(), refreshed),
+        );
+        return refreshed;
+      });
+    } catch {
+      // No lock, or a write that failed: what is stored is used as it is, and nothing is refreshed outside the lock.
+      return await GlobalConfig.getHostConfig(host);
+    }
   }
   static async getRemoteEnvServers(): Promise<AkanGlobalConfig["remoteEnvServers"]> {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    return akanConfig.remoteEnvServers;
+    return (await GlobalConfig.#getAkanGlobalConfig()).remoteEnvServers;
   }
   static async setRemoteEnvServer(name: string, config: RemoteEnvServerConfig) {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    await GlobalConfig.#setAkanGlobalConfig({
+    await GlobalConfig.#update((akanConfig) => ({
       ...akanConfig,
-      remoteEnvServers: {
-        ...akanConfig.remoteEnvServers,
-        [name]: config,
-      },
-    });
+      remoteEnvServers: { ...akanConfig.remoteEnvServers, [name]: config },
+    }));
   }
   static async removeRemoteEnvServer(name: string) {
-    const akanConfig = await GlobalConfig.#getAkanGlobalConfig();
-    const { [name]: _, ...remoteEnvServers } = akanConfig.remoteEnvServers;
-    await GlobalConfig.#setAkanGlobalConfig({
-      ...akanConfig,
-      remoteEnvServers,
+    await GlobalConfig.#update((akanConfig) => {
+      const { [name]: _, ...remoteEnvServers } = akanConfig.remoteEnvServers;
+      return { ...akanConfig, remoteEnvServers };
     });
   }
+  static async getTestTargets(): Promise<TestTargetsConfig> {
+    return (await GlobalConfig.#getAkanGlobalConfig()).testTargets;
+  }
+  static async setTestTargets(testTargets: TestTargetsConfig) {
+    await GlobalConfig.#update((akanConfig) => ({
+      ...akanConfig,
+      testTargets: { ...akanConfig.testTargets, ...testTargets },
+    }));
+  }
   static needRefreshToken(accessToken: AccessToken): boolean {
     return !!accessToken?.expiresAt?.isBefore(dayjs().add(1, "hour"));
   }

package/codeAgent/agent/AkanCodeServices.ts

@@ -0,0 +1,97 @@
+import { existsSync, mkdirSync, mkdtempSync } from "node:fs";
+import { tmpdir } from "node:os";
+import path from "node:path";
+import { type InlineExtension, ModelRuntime, SessionManager, SettingsManager } from "@earendil-works/pi-coding-agent";
+import type { CodeAgentProfile } from "akanjs/common";
+import { AkanEnvKeys } from "../tools/AkanEnvKeys";
+import { type AkanContextFile, AkanContextFiles } from "./AkanContextFiles";
+import { akanCodePaths } from "./akanCodePaths";
+import { akanSystemPrompt } from "./akanSystemPrompt";
+import type { CodeAgentProxy } from "./CodeAgentProxy";
+import { CodeSessionIndex } from "./CodeSessionIndex";
+
+export interface AkanCodeServicesOptions {
+  workspaceRoot: string;
+  cwd: string;
+  profile: CodeAgentProfile;
+  extensions: InlineExtension[];
+  sessionId?: string;
+}
+
+// All four engine services are injected explicitly: any one left out makes the engine fall back to `~/.pi/`.
+export class AkanCodeServices {
+  static settings() {
+    // In memory on purpose: file settings would be a second configuration surface beside the profile.
+    // `enableInstallTelemetry` defaults to true and adds pi-branded headers to OpenRouter/NVIDIA/Cloudflare calls.
+    return SettingsManager.inMemory({
+      enableInstallTelemetry: false,
+      enableAnalytics: false,
+      quietStartup: true,
+      // Twice the engine's 16,384: at 16k a reasoning model stops mid-thought at the compaction threshold,
+      // and the recovery re-sends a near-full window to retry the turn.
+      compaction: { reserveTokens: 32_768 },
+    });
+  }
+
+  // The engine locks and rewrites `authPath` itself, so two `akan code` refreshing a token at once cannot clobber it.
+  static async runtime(workspaceRoot: string, proxy: CodeAgentProxy | null = null) {
+    mkdirSync(akanCodePaths.globalDir(), { recursive: true, mode: 0o700 });
+    const runtime = await ModelRuntime.create({
+      //* Behind a proxy no real key may reach a request, so credentials live in a throwaway file.
+      authPath: proxy
+        ? path.join(mkdtempSync(path.join(tmpdir(), "akan-code-proxy-")), "auth.json")
+        : akanCodePaths.authFile(),
+      modelsPath: akanCodePaths.modelsFile(),
+    });
+    if (proxy) await proxy.apply(runtime);
+    else await AkanEnvKeys.apply(runtime, workspaceRoot);
+    return runtime;
+  }
+
+  static sessions(workspaceRoot: string, cwd: string, profile: CodeAgentProfile, resume?: string) {
+    //* `remote` has no store of its own yet, so it keeps a file session: a pod worker's suspended asks need it.
+    if (profile.session.store === "memory") return SessionManager.inMemory(cwd);
+    const dir = akanCodePaths.sessionsDir(workspaceRoot);
+    mkdirSync(dir, { recursive: true });
+    const manager = SessionManager.create(cwd, dir);
+    if (!resume) return manager;
+    const file = CodeSessionIndex.fileOf(dir, resume);
+    // A mistyped id that quietly opened a new session would look like a session that lost its history.
+    if (!file) throw new Error(`No stored session ${resume} in ${dir}`);
+    manager.setSessionFile(file);
+    return manager;
+  }
+
+  // Skills are text, never code that runs, so unlike extensions they may come from the home directory too.
+  static #skillPaths(profile: CodeAgentProfile, workspaceRoot: string) {
+    if (!profile.context.skills) return [];
+    const dirs = [
+      akanCodePaths.builtinSkillsDir(),
+      akanCodePaths.globalSkillsDir(),
+      akanCodePaths.skillsDir(workspaceRoot),
+    ];
+    return dirs.filter((dir): dir is string => !!dir && existsSync(dir));
+  }
+
+  static resourceOptions(options: AkanCodeServicesOptions) {
+    // A path that does not exist is reported as a load error rather than skipped, and these two are optional.
+    const present = (dir: string) => (existsSync(dir) ? [dir] : []);
+    return {
+      noExtensions: true,
+      // Disables only the engine's default skill locations (`~/.pi/skills`, `.pi/`); `additionalSkillPaths` merge.
+      noSkills: true,
+      noPromptTemplates: true,
+      noThemes: true,
+      noContextFiles: !options.profile.context.projectFiles,
+      agentsFilesOverride: ({ agentsFiles }: { agentsFiles: AkanContextFile[] }) => ({
+        agentsFiles: options.profile.context.projectFiles
+          ? AkanContextFiles.extend(agentsFiles, { workspaceRoot: options.workspaceRoot, cwd: options.cwd })
+          : agentsFiles,
+      }),
+      appendSystemPrompt: [akanSystemPrompt(options.profile)],
+      additionalExtensionPaths: present(akanCodePaths.extensionsDir(options.workspaceRoot)),
+      additionalSkillPaths: AkanCodeServices.#skillPaths(options.profile, options.workspaceRoot),
+      extensionFactories: options.extensions,
+    };
+  }
+}

package/codeAgent/agent/AkanContextFiles.ts

@@ -0,0 +1,94 @@
+import { existsSync, readdirSync, readFileSync, statSync } from "node:fs";
+import path from "node:path";
+
+export interface AkanContextFile {
+  path: string;
+  content: string;
+}
+
+export interface AkanContextFilesOptions {
+  workspaceRoot: string;
+  cwd: string;
+}
+
+// The engine takes only the first of `AGENTS.override.md · AGENTS.md · CLAUDE.md` per directory and never reads
+// `.cursor/rules`; this appends what it drops, after the engine's own list.
+export class AkanContextFiles {
+  /** Cursor's frontmatter block, which is metadata for its own rule picker and not instruction for a model. */
+  static readonly #frontmatter = /^---\r?\n([\s\S]*?)\r?\n---\r?\n?/;
+
+  static extend(base: AkanContextFile[], options: AkanContextFilesOptions): AkanContextFile[] {
+    const seen = new Set(base.map((file) => file.path));
+    // Keyed by content too: the usual way to carry both names is a symlink or a one-line pointer.
+    const contents = new Set(base.map((file) => file.content.trim()));
+    const added: AkanContextFile[] = [];
+    for (const file of [...AkanContextFiles.#claude(base), ...AkanContextFiles.#cursor(options)]) {
+      if (seen.has(file.path) || contents.has(file.content.trim()) || !file.content.trim()) continue;
+      seen.add(file.path);
+      contents.add(file.content.trim());
+      added.push(file);
+    }
+    return [...base, ...added];
+  }
+
+  // Not beside an `AGENTS.override.md`: that file exists to displace the others in its directory.
+  static #claude(base: AkanContextFile[]) {
+    const files: AkanContextFile[] = [];
+    for (const file of base) {
+      if (!/^AGENTS\.(md|MD)$/.test(path.basename(file.path))) continue;
+      for (const name of ["CLAUDE.md", "CLAUDE.MD"]) {
+        const candidate = path.join(path.dirname(file.path), name);
+        const content = AkanContextFiles.#read(candidate);
+        if (content !== undefined) files.push({ path: candidate, content });
+      }
+    }
+    return files;
+  }
+
+  // Only `alwaysApply: true` or frontmatter-less rules: Cursor's `globs`/`description`/manual kinds are scoped.
+  static #cursor(options: AkanContextFilesOptions) {
+    const files: AkanContextFile[] = [];
+    const roots = [...new Set([options.workspaceRoot, options.cwd])];
+    for (const root of roots) {
+      const legacy = AkanContextFiles.#read(path.join(root, ".cursorrules"));
+      if (legacy !== undefined) files.push({ path: path.join(root, ".cursorrules"), content: legacy });
+      for (const file of AkanContextFiles.#mdcFiles(path.join(root, ".cursor", "rules"))) {
+        const raw = AkanContextFiles.#read(file);
+        if (raw === undefined) continue;
+        const body = AkanContextFiles.#applied(raw);
+        if (body !== undefined) files.push({ path: file, content: body });
+      }
+    }
+    return files;
+  }
+
+  static #applied(raw: string) {
+    const match = AkanContextFiles.#frontmatter.exec(raw);
+    if (!match) return raw;
+    if (!/^\s*alwaysApply\s*:\s*true\s*$/m.test(match[1] ?? "")) return undefined;
+    return raw.slice(match[0].length);
+  }
+
+  /** Sorted, because the order rules reach the model in is otherwise the order a directory happens to list. */
+  static #mdcFiles(dir: string) {
+    if (!existsSync(dir)) return [];
+    try {
+      return readdirSync(dir, { recursive: true, withFileTypes: true })
+        .filter((entry) => entry.isFile() && entry.name.endsWith(".mdc"))
+        .map((entry) => path.join(entry.parentPath ?? dir, entry.name))
+        .sort();
+    } catch {
+      return [];
+    }
+  }
+
+  static #read(file: string) {
+    try {
+      if (!existsSync(file) || !statSync(file).isFile()) return undefined;
+      return readFileSync(file, "utf8").replace(/^/, "");
+    } catch {
+      // A rule file that cannot be read costs its own rules. It must not cost the session its start.
+      return undefined;
+    }
+  }
+}