@alisio/core 0.1.0-alpha.10

package/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Gustavo Gutiérrez
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/README.md

@@ -0,0 +1,25 @@
+# @alisio/core
+
+Embeddable core of [Alisio](https://github.com/GustavoGutierrez/alisio): the agent tool loop, structured
+context compaction, the OpenAI-compatible provider (Chat Completions and Responses), local tools with
+explicit permissions, the MCP client, the plugin host (with hook timeouts and failure isolation) and a
+SQLite session store. Runs on Node.js >= 22.16 (`node:sqlite` with FTS5) and on Bun.
+
+```ts
+import { createApplication } from "@alisio/core";
+
+const app = await createApplication({ config: "./alisio.json", readOnly: true });
+try {
+  const session = app.store.create(app.workspace, app.provider.id, app.provider.model);
+  const { text } = await app.runner.run(session.id, "Summarize this repository");
+  console.log(text);
+} finally {
+  await app.close();
+}
+```
+
+Built-in plugins are opt-in for embedders: pass `builtins` (the `alisio` CLI wires
+`@alisio/plugin-memory`). See the [architecture](https://gustavogutierrez.github.io/alisio/architecture) and
+[configuration](https://gustavogutierrez.github.io/alisio/configuration) docs.
+
+Maintainer: Gustavo Gutiérrez · License: MIT

package/dist/application.d.ts

@@ -0,0 +1,225 @@
+import type { AvailableProviderModel, ModelInfo, ModelProvider, Plugin, PluginCategory, ProviderConfigurationValue, ResolvedProviderModel, RunEvent } from "@alisio/sdk";
+import { type SettableSettingKey } from "./config.ts";
+import type { ApprovalHandler } from "./core/contracts.ts";
+import { ToolRegistry } from "./core/registry.ts";
+import { AgentRunner } from "./core/runner.ts";
+import { HerdrBridge } from "./integrations/herdr.ts";
+import { McpConnector } from "./mcp/connector.ts";
+import { PluginHost } from "./plugins/host.ts";
+import { ActiveProvider, ProviderRegistry } from "./providers/registry.ts";
+import { ProviderSettingsStore } from "./providers/settings.ts";
+import { ProjectContext } from "./resources/context.ts";
+import { Skills } from "./resources/skills.ts";
+import { SQLiteStore } from "./runtime/store.ts";
+export interface AppOptions {
+    cwd?: string;
+    config?: string;
+    trustProject?: boolean;
+    plugin?: string[];
+    allowWrite?: boolean;
+    allowProcess?: boolean;
+    /** Allow network tools (webfetch, websearch) and a provider-native search tool. */
+    allowExternal?: boolean;
+    allowMcp?: boolean;
+    readOnly?: boolean;
+    allowAgents?: boolean;
+    noHerdr?: boolean;
+    model?: string;
+    baseURL?: string;
+    apiMode?: string;
+    db?: string;
+    provider?: ModelProvider;
+    onEvent?: (event: RunEvent) => void;
+    /** First-party plugins activated through the trusted path (the CLI passes its registry). */
+    builtins?: BuiltinPlugin[];
+    /** Prompt templates shipped by the embedder (lowest precedence). */
+    builtinPrompts?: Array<{
+        name: string;
+        text: string;
+    }>;
+    /** Names templates may not take (e.g. the UI's own slash commands). */
+    reservedPromptNames?: string[];
+    /** Options merged over `builtinPlugins.<id>` from the configuration (e.g. CLI flags). */
+    pluginOptions?: Record<string, Record<string, unknown>>;
+    /** Built-in plugin ids to disable (e.g. `memory`). */
+    disablePlugins?: string[];
+    /** Interactive approval for write/process tools; ignored in read-only mode. */
+    approve?: ApprovalHandler;
+}
+export interface BuiltinContext {
+    workspace: string;
+    cwd: string;
+    stateHome: string;
+    configHome: string;
+    home: string;
+    /** Project-level resources may load (--trust-project or an explicit --config). */
+    trusted: boolean;
+    /** Directory of the configuration file, for relative paths in plugin options. */
+    configDir: string;
+}
+export interface BuiltinPlugin {
+    id: string;
+    name?: string;
+    description: string;
+    categories?: PluginCategory[];
+    /** Marks the initial provider plugin used for legacy root provider configuration. */
+    defaultProvider?: boolean;
+    /** `options` is the raw `builtinPlugins.<id>` object; the plugin validates it. */
+    create(options: unknown, context: BuiltinContext): Plugin;
+}
+export type PluginCatalogStatus = "active" | "inactive" | "failed" | "restart-required";
+export interface PluginCatalogEntry {
+    id: string;
+    name: string;
+    description: string;
+    version?: string;
+    categories: PluginCategory[];
+    builtin: boolean;
+    source: string;
+    status: PluginCatalogStatus;
+    enabled: boolean;
+    manageable: boolean;
+    diagnostic?: string;
+}
+export interface ConfiguredProviderCatalog {
+    profile: string;
+    provider: string;
+    title: string;
+    configuredModel: string;
+    models: ModelInfo[];
+    unavailable: boolean;
+}
+/** A built-in runs unless its config sets `enabled: false` or it is disabled by id. */
+export declare function enabledBuiltins(available: BuiltinPlugin[], config: Record<string, {
+    enabled?: boolean;
+} & Record<string, unknown>>, disabled?: string[]): BuiltinPlugin[];
+export declare function createApplication(options?: AppOptions): Promise<{
+    workspace: string;
+    config: import("./config.ts").LoadedConfig;
+    prompts: {
+        templates: Map<string, import("./index.ts").PromptTemplate>;
+        diagnostics: import("./index.ts").PromptDiagnostic[];
+    };
+    expandPrompt: (input: string) => {
+        name: string;
+        args: string;
+        display: string;
+        text: string;
+        template: import("./index.ts").PromptTemplate;
+    } | undefined;
+    store: SQLiteStore;
+    registry: ToolRegistry;
+    context: ProjectContext;
+    skills: Skills;
+    /** Path- and content-safe metadata for the interactive skills manager. */
+    skillCatalog(): {
+        name: string;
+        id: string;
+        effectiveId: string;
+        displayId: string;
+        description: string;
+        scope: import("./index.ts").SkillScope;
+        source: string;
+        owner?: {
+            id: string;
+            name: string;
+        };
+        manageable: boolean;
+        locked: boolean;
+        enabled: boolean;
+        effective: boolean;
+        shadowedBy?: string;
+        approximateTokens: number;
+    }[];
+    /** Persist a project-local override and apply it to model-visible skills immediately. */
+    setSkillEnabled(id: string, enabled: boolean): Promise<import("./index.ts").Skill>;
+    plugins: PluginHost;
+    /** Credential- and path-safe catalog for the current resolved plugin set. */
+    pluginCatalog(): PluginCatalogEntry[];
+    /** Persist a project-local override. Runtime registrations intentionally change on restart. */
+    setPluginEnabled(id: string, enabled: boolean, lifecycle?: {
+        liveSession?: boolean;
+    }): Promise<PluginCatalogEntry>;
+    mcp: McpConnector;
+    /** Current-process MCP grant; deliberately independent from persisted server enablement. */
+    mcpRuntimePermission(): "granted" | "not-granted" | "read-only";
+    /** Whether global MCP consent (`mcp.allow`) is persisted for this user right now. */
+    mcpAllowPersisted(): boolean;
+    /**
+     * Sanitized per-server failures collected while auto-connecting enabled servers at startup
+     * (only when runtime permission was granted). Never includes credentials or command paths.
+     */
+    mcpStartupFailures(): string[];
+    /** Host-owned interactive consent boundary. Headless callers remain blocked unless flagged. */
+    grantMcpRuntimePermission(request: {
+        source: "interactive-tui";
+        confirmed: boolean;
+    }): "granted" | "not-granted" | "read-only";
+    /** Persist global consent atomically, then grant runtime permission for this process. */
+    rememberGlobalMcpConsent(): Promise<void>;
+    /**
+     * Clear the persisted global consent atomically and drop the runtime permission (disconnecting
+     * servers as cleanup does). An explicit this-run `--allow-mcp` flag keeps the grant alive.
+     */
+    revokeGlobalMcpConsent(): Promise<void>;
+    /** Persist an MCP toggle in its defining layer, then safely update this process. */
+    setMcpEnabled(id: string, enabled: boolean, connect?: boolean): Promise<import("./index.ts").McpServerInfo>;
+    /**
+     * Persist one user-facing setting to the GLOBAL user config (`<config home>/config.json`)
+     * and apply it to this process where the value can change live. Compaction and limits land
+     * in the runner (honored by the next run/compact), `context.*` lands in the project context
+     * (next instructions load), `websearch.provider` mutates the shared config object the search
+     * chain reads per call, `pluginHooks.timeoutMs` lands in the plugin host (next hook call),
+     * and `tui.*` is persisted for the host to apply. Nothing in this set requires a restart.
+     * `mcp.allow` is deliberately not routed here: it flows through
+     * `rememberGlobalMcpConsent`/`revokeGlobalMcpConsent` instead.
+     * Throws under `--read-only`. Returns the written config file.
+     */
+    updateSetting(key: SettableSettingKey, value: unknown): Promise<string>;
+    provider: ActiveProvider;
+    providers: ProviderRegistry;
+    providerSettings: ProviderSettingsStore;
+    readonly providerError: string | undefined;
+    readonly providerInfo: {
+        id: string;
+        profile: Record<string, ProviderConfigurationValue>;
+        persisted: boolean;
+        profileName: string;
+    } | {
+        id: string;
+        profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>;
+        persisted: boolean;
+        profileName: undefined;
+    } | undefined;
+    runner: AgentRunner;
+    herdr: HerdrBridge;
+    contextWindow: (model: string) => number | undefined;
+    /** Effective context budget + compaction point shared by the runner and the TUI bar. */
+    contextBudget: (model: string) => {
+        total?: number;
+        basis: "window" | "unknown";
+        compactionAt: number;
+    };
+    loadModels: (signal: AbortSignal) => Promise<ModelInfo[]>;
+    /** Creates a provider for validation/model discovery without changing the active provider. */
+    probeProvider(id: string, profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>, credentials: Record<string, string>, signal: AbortSignal): Promise<ModelInfo[]>;
+    /** Lists every plugin-configured profile without returning credentials or provider errors. */
+    configuredProviderCatalogs(signal: AbortSignal): Promise<ConfiguredProviderCatalog[]>;
+    /** Lists credential-free models from globally configured `/connect` profiles. */
+    listAvailableModels: (signal?: AbortSignal) => Promise<AvailableProviderModel[]>;
+    /** Resolves `provider/model` or a unique bare model id without exposing credentials. */
+    resolveModel: (reference: string, signal?: AbortSignal) => Promise<ResolvedProviderModel>;
+    /** Creates and binds a fresh session to an optional configured model selector. */
+    createSession(reference?: string): Promise<import("./index.ts").Session>;
+    /** Persists and activates only after construction succeeds; programmatic overrides stay fixed. */
+    activateProvider(id: string, profile: Record<string, import("@alisio/sdk").ProviderConfigurationValue>, credentials: Record<string, string>, model: string, profileName?: string): Promise<void>;
+    /** Activates a stored profile without exposing its credentials. Returns false for a no-op. */
+    activateProviderProfile(name: string, model: string): Promise<boolean>;
+    /** Resolves, globally activates, and creates the fresh session required by a main switch. */
+    switchModel(reference: string): Promise<import("./index.ts").Session | undefined>;
+    /** Runs session-end plugin hooks (bounded by the host timeout). */
+    endSession(sessionId: string, reason: "clear" | "exit"): Promise<{
+        failures: import("./index.ts").HookFailure[];
+    }>;
+    close(): Promise<void>;
+}>;