@build-astron-co/nimbus 0.4.1 → 0.4.3

package/dist/src/agent/context-manager.js

@@ -188,8 +188,9 @@ export class ContextManager {
         const tcIds = msg.toolCalls?.map(tc => tc.id).join(',') ?? '';
         const key = `${msg.role}:${contentLen}:${tcCount}:${tcIds}`;
         const cached = this._tokenCache.get(key);
-        if (cached !== undefined)
+        if (cached !== undefined) {
             return cached;
+        }
         const val = estimateMessageTokens(msg);
         this._tokenCache.set(key, val);
         return val;

package/dist/src/agent/expand-files.js

@@ -24,8 +24,9 @@ const SENSITIVE_FILE_RE = /(\.env|\.pem|\.key|\.p12|\.pfx|id_rsa|id_ed25519|cred
  */
 export function expandFileReferences(text, cwd = process.cwd()) {
     const fileRefs = text.match(/@([\w./_-]+)/g);
-    if (!fileRefs)
+    if (!fileRefs) {
         return text;
+    }
     let expanded = text;
     // G22: Handle @workspace special token — concatenate all .tf files
     if (expanded.includes('@workspace')) {

package/dist/src/agent/loop.js

@@ -27,6 +27,7 @@ import { maskSecrets } from '../audit/security-scanner';
 import { classifyTaskComplexity, routeModel } from '../llm/router';
 import { mkdirSync as _cpMkdirSync, writeFileSync as _cpWriteFileSync } from 'node:fs';
 import { homedir as _cpHomedir } from 'node:os';
+import { authStore } from '../auth/store';
 // ---------------------------------------------------------------------------
 // C2: Infra state checkpoint helper
 // ---------------------------------------------------------------------------
@@ -58,7 +59,7 @@ function writeInfraCheckpoint(tool, action, input) {
             cwd: process.cwd(),
             workdir: input.workdir ?? undefined,
         };
-        const fileName = timestamp.replace(/[:.]/g, '-') + '.json';
+        const fileName = `${timestamp.replace(/[:.]/g, '-')}.json`;
         _cpWriteFileSync(join(checkpointsDir, fileName), JSON.stringify(checkpoint, null, 2), 'utf-8');
     }
     catch { /* non-critical */ }
@@ -274,11 +275,13 @@ function isRetryableStreamError(err) {
         const e = err;
         const status = (typeof e.status === 'number' ? e.status : undefined) ??
             (typeof e.statusCode === 'number' ? e.statusCode : undefined);
-        if (status === 429 || (status !== undefined && status >= 500 && status < 600))
+        if (status === 429 || (status !== undefined && status >= 500 && status < 600)) {
             return true;
+        }
         const msg = typeof e.message === 'string' ? e.message : '';
-        if (/rate.?limit|429|too many requests|overloaded|503/i.test(msg))
+        if (/rate.?limit|429|too many requests|overloaded|503/i.test(msg)) {
             return true;
+        }
     }
     return false;
 }
@@ -319,12 +322,15 @@ function extractCostHintFromToolOutput(toolName, input, output) {
             const changed = Number(m[2]);
             const destroyed = Number(m[3]);
             const parts = [];
-            if (added > 0)
+            if (added > 0) {
                 parts.push(`+${added} resources created`);
-            if (changed > 0)
+            }
+            if (changed > 0) {
                 parts.push(`${changed} updated`);
-            if (destroyed > 0)
+            }
+            if (destroyed > 0) {
                 parts.push(`${destroyed} destroyed`);
+            }
             return parts.length > 0
                 ? `${parts.join(', ')} — run "nimbus cost" for monthly cost estimate`
                 : null;
@@ -352,11 +358,13 @@ function trackAndPersistError(toolName, errorHint, cwd) {
             const { existsSync, readFileSync, writeFileSync, appendFileSync } = require('node:fs');
             const { join } = require('node:path');
             const nimbusPath = join(cwd, 'NIMBUS.md');
-            if (!existsSync(nimbusPath))
+            if (!existsSync(nimbusPath)) {
                 return;
+            }
             const existing = readFileSync(nimbusPath, 'utf-8');
-            if (existing.includes(errorHint.slice(0, 40)))
-                return; // already recorded
+            if (existing.includes(errorHint.slice(0, 40))) {
+                return;
+            } // already recorded
             const entry = `- ${toolName}: ${errorHint}\n`;
             if (existing.includes('## Observed Issues')) {
                 writeFileSync(nimbusPath, existing.replace('## Observed Issues\n', `## Observed Issues\n${entry}`));
@@ -394,8 +402,9 @@ function cacheTerraformPlan(workdir, output) {
 /** Retrieve a cached terraform plan for a workdir, or null if expired/missing. */
 function getCachedTerraformPlan(workdir) {
     const entry = terraformPlanCache.get(workdir);
-    if (!entry)
+    if (!entry) {
         return null;
+    }
     if (Date.now() - entry.timestamp > PLAN_CACHE_TTL_MS) {
         terraformPlanCache.delete(workdir);
         return null;
@@ -561,6 +570,8 @@ export async function runAgentLoop(userMessage, history, options) {
             // A1: Retry on transient errors (rate-limit / 5xx) with exponential backoff
             const MAX_STREAM_RETRIES = 2;
             let streamAttempt = 0;
+            // Flag to prevent infinite 401-retry loops (attempt re-init only once per turn)
+            let _401RecoveryAttempted = false;
             while (true) {
                 // A2: Silence timeout — abort if no chunk arrives (G21: configurable)
                 const STREAM_SILENCE_MS = options.streamSilenceTimeoutMs ?? 60_000;
@@ -611,13 +622,30 @@ export async function runAgentLoop(userMessage, history, options) {
                         responseUsage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
                         continue;
                     }
-                    // G24: Graceful network error message instead of raw Node.js error
+                    // 401 auto-recovery: reinitialize providers in case credentials were just updated
                     const streamErrObj = streamErr;
+                    const is401 = streamErrObj?.status === 401 || streamErrObj?.statusCode === 401
+                        || /401|Invalid API Key|Unauthorized|authentication_error/i.test(streamErrObj?.message ?? '');
+                    if (is401 && !_401RecoveryAttempted) {
+                        _401RecoveryAttempted = true;
+                        try {
+                            authStore.reload();
+                            router.reinitializeProviders();
+                        }
+                        catch { /* non-critical */ }
+                        // Reset partial accumulation and retry once
+                        responseContent = '';
+                        responseToolCalls = undefined;
+                        responseUsage = { promptTokens: 0, completionTokens: 0, totalTokens: 0 };
+                        continue;
+                    }
+                    // G24: Graceful network error message instead of raw Node.js error
                     const isNetworkError = /ECONNREFUSED|ETIMEDOUT|ENOTFOUND|fetch failed|network/i.test(streamErrObj?.message ?? '');
                     if (isNetworkError) {
                         const netMsg = '\n[!!] Network unreachable — cannot reach the LLM API.\nCheck your internet connection and API key validity, then try again.\n';
-                        if (onText)
+                        if (onText) {
                             onText(netMsg);
+                        }
                         // Re-throw a specially-marked error so the outer turn catch block can handle it
                         const netErr = new Error(netMsg);
                         netErr._nimbusNetworkError = true;
@@ -651,8 +679,9 @@ export async function runAgentLoop(userMessage, history, options) {
             // G16: Cost budget enforcement — stop if cumulative cost exceeds the limit
             if (options.costBudgetUSD !== undefined && totalCost >= options.costBudgetUSD) {
                 const budgetMsg = `\n\n[!!] Cost budget of $${options.costBudgetUSD.toFixed(2)} reached (used: $${totalCost.toFixed(3)}). Stopping to prevent overspend.\n`;
-                if (onText)
+                if (onText) {
                     onText(budgetMsg);
+                }
                 messages.push({ role: 'assistant', content: budgetMsg });
                 break;
             }
@@ -747,7 +776,7 @@ export async function runAgentLoop(userMessage, history, options) {
                     if (destructiveWarning) {
                         messages.push({
                             role: 'tool',
-                            toolCallId: toolCall.id + '-guard',
+                            toolCallId: `${toolCall.id}-guard`,
                             name: toolCall.function.name,
                             content: `[SAFETY] ${destructiveWarning}`,
                         });
@@ -798,11 +827,11 @@ export async function runAgentLoop(userMessage, history, options) {
                             }
                             const refreshMsg = [
                                 '[!!] Credential expired. Run: nimbus auth-refresh',
-                                '[Nimbus] Credential error detected on tool: ' + toolCall.function.name,
+                                `[Nimbus] Credential error detected on tool: ${toolCall.function.name}`,
                                 'Run "nimbus auth-refresh" to refresh cloud credentials, then retry.',
                             ].join('\n');
-                            toolContent += '\n\n' + refreshMsg;
-                            result.output += '\n\n' + refreshMsg;
+                            toolContent += `\n\n${refreshMsg}`;
+                            result.output += `\n\n${refreshMsg}`;
                         }
                     }
                     else if (DEVOPS_TOOL_NAMES.has(toolCall.function.name)) {
@@ -884,7 +913,7 @@ export async function runAgentLoop(userMessage, history, options) {
                             cwd: options.cwd ?? process.cwd(),
                             timestamp: new Date().toISOString(),
                         });
-                        appendFileSync(join(auditDir, 'audit.jsonl'), event + '\n', 'utf-8');
+                        appendFileSync(join(auditDir, 'audit.jsonl'), `${event}\n`, 'utf-8');
                     }
                     catch { /* audit logging is non-critical */ }
                 }
@@ -927,8 +956,9 @@ export async function runAgentLoop(userMessage, history, options) {
                                 const batchFiles = buildFileDiffBatchFromPlan({ changes });
                                 for (const file of batchFiles) {
                                     const decision = await options.requestFileDiff(file.filePath, file.toolName ?? 'terraform', file.diff ?? '');
-                                    if (decision === 'reject-all')
+                                    if (decision === 'reject-all') {
                                         break;
+                                    }
                                 }
                             }
                         }
@@ -1016,13 +1046,13 @@ export async function runAgentLoop(userMessage, history, options) {
                         const outFile = join(outDir, `${Date.now()}-${toolCall.function.name}.log`);
                         _writeFileSync(outFile, toolContent, 'utf-8');
                         toolContent = omitted > 0
-                            ? `${head}${tail ? '\n\n... [' + omitted + ' lines omitted — full output saved to ' + outFile + '] ...\n\n' + tail : '\n\n... [full output saved to ' + outFile + ']'}`
-                            : `${head}${tail ? '\n\n' + tail : ''}`;
+                            ? `${head}${tail ? `\n\n... [${omitted} lines omitted — full output saved to ${outFile}] ...\n\n${tail}` : `\n\n... [full output saved to ${outFile}]`}`
+                            : `${head}${tail ? `\n\n${tail}` : ''}`;
                     }
                     catch {
                         toolContent = omitted > 0
-                            ? `${head}${tail ? '\n\n... [' + omitted + ' lines omitted — output too large for context] ...\n\n' + tail : '\n\n... [' + omitted + ' lines omitted]'}`
-                            : `${head}${tail ? '\n\n' + tail : ''}`;
+                            ? `${head}${tail ? `\n\n... [${omitted} lines omitted — output too large for context] ...\n\n${tail}` : `\n\n... [${omitted} lines omitted]`}`
+                            : `${head}${tail ? `\n\n${tail}` : ''}`;
                     }
                 }
                 messages.push({
@@ -1112,14 +1142,17 @@ export async function runAgentLoop(userMessage, history, options) {
             const kubectl = allToolCalls.filter(c => c.name === 'kubectl');
             const helm = allToolCalls.filter(c => c.name === 'helm');
             const summaryLines = ['---', '**Session Summary**'];
-            if (terraform.length)
+            if (terraform.length) {
                 summaryLines.push(`• Terraform: ${terraform.map(c => String(c.input.action ?? '')).join(', ')}`);
-            if (kubectl.length)
+            }
+            if (kubectl.length) {
                 summaryLines.push(`• Kubectl: ${kubectl.map(c => String(c.input.action ?? '')).join(', ')}`);
-            if (helm.length)
+            }
+            if (helm.length) {
                 summaryLines.push(`• Helm: ${helm.map(c => String(c.input.action ?? '')).join(', ')}`);
+            }
             if (summaryLines.length > 2) {
-                options.onText('\n\n' + summaryLines.join('\n'));
+                options.onText(`\n\n${summaryLines.join('\n')}`);
             }
         }
     }
@@ -1178,8 +1211,9 @@ async function computeProposedDiff(toolName, args) {
     try {
         const { readFile } = await import('node:fs/promises');
         const path = args.path;
-        if (!path)
+        if (!path) {
             return null;
+        }
         const currentContent = await readFile(path, 'utf-8').catch(() => '');
         let proposed = currentContent;
         if (toolName === 'edit_file') {
@@ -1196,8 +1230,9 @@ async function computeProposedDiff(toolName, args) {
         else if (toolName === 'write_file') {
             proposed = args.content;
         }
-        if (proposed === currentContent)
-            return null; // no change
+        if (proposed === currentContent) {
+            return null;
+        } // no change
         return generateUnifiedDiff(path, currentContent, proposed);
     }
     catch {
@@ -1328,8 +1363,9 @@ async function executeToolCall(toolCall, registry, onStart, onEnd, checkPermissi
                 error: undefined,
                 isError: false,
             };
-            if (onEnd)
+            if (onEnd) {
                 onEnd(callInfo, rejResult);
+            }
             return rejResult;
         }
         const diff = await computeProposedDiff(toolName, parsedArgs);
@@ -1342,8 +1378,9 @@ async function executeToolCall(toolCall, registry, onStart, onEnd, checkPermissi
                     error: undefined,
                     isError: false,
                 };
-                if (onEnd)
+                if (onEnd) {
                     onEnd(callInfo, rejResult);
+                }
                 return rejResult;
             }
             if (decision === 'reject-all') {
@@ -1355,8 +1392,9 @@ async function executeToolCall(toolCall, registry, onStart, onEnd, checkPermissi
                     error: undefined,
                     isError: false,
                 };
-                if (onEnd)
+                if (onEnd) {
                     onEnd(callInfo, rejResult);
+                }
                 return rejResult;
             }
             if (decision === 'apply-all' && skipRemainingDiffPrompts) {

package/dist/src/agent/permissions.js

@@ -131,8 +131,9 @@ export function checkPermission(tool, input, sessionState, config, autoApprove /
 ) {
     // H2: When running in CI / --auto-approve / --non-interactive mode,
     // bypass all tier logic and immediately allow the tool call.
-    if (autoApprove)
+    if (autoApprove) {
         return 'allow';
+    }
     // 1. Check user overrides first
     if (config?.toolOverrides?.[tool.name]) {
         const overrideTier = config.toolOverrides[tool.name];
@@ -362,8 +363,9 @@ function checkHelmPermission(input, _sessionState) {
  * @returns `'block'` if forbidden, `null` otherwise.
  */
 export function checkForbiddenPatterns(toolName, input, forbiddenRules) {
-    if (forbiddenRules.length === 0)
+    if (forbiddenRules.length === 0) {
         return null;
+    }
     const inputStr = JSON.stringify(input ?? {}).toLowerCase();
     const toolLower = toolName.toLowerCase();
     for (const rule of forbiddenRules) {

package/dist/src/agent/system-prompt.js

@@ -100,19 +100,24 @@ export function buildSystemPrompt(options) {
     if (options.infraContext) {
         const ic = options.infraContext;
         const lines = ['## Current Infrastructure Context'];
-        if (ic.terraformWorkspace)
+        if (ic.terraformWorkspace) {
             lines.push(`- Terraform workspace: ${ic.terraformWorkspace}`);
-        if (ic.kubectlContext)
+        }
+        if (ic.kubectlContext) {
             lines.push(`- kubectl context: ${ic.kubectlContext}`);
+        }
         if (ic.helmReleases && ic.helmReleases.length > 0) {
             lines.push(`- Active Helm releases: ${ic.helmReleases.slice(0, 5).join(', ')}`);
         }
-        if (ic.awsAccount)
+        if (ic.awsAccount) {
             lines.push(`- AWS account: ${ic.awsAccount}`);
-        if (ic.awsRegion)
+        }
+        if (ic.awsRegion) {
             lines.push(`- AWS region: ${ic.awsRegion}`);
-        if (ic.gcpProject)
+        }
+        if (ic.gcpProject) {
             lines.push(`- GCP project: ${ic.gcpProject}`);
+        }
         parts.push(lines.join('\n'));
         // H3: Inject known resource inventory for better tool call accuracy.
         // Lists exact names for contexts, releases, workspaces, and cloud accounts
@@ -478,11 +483,13 @@ export function getPrunedHeuristics(mode) {
             .filter(line => {
             const l = line.toLowerCase();
             // Remove deploy-specific execution requirements (plan mode cannot apply)
-            if (l.includes('in deploy mode:') || l.includes('deploy_preview before'))
+            if (l.includes('in deploy mode:') || l.includes('deploy_preview before')) {
                 return false;
+            }
             // Remove tool selection items for deploy-only tools
-            if (l.includes('use drift_detect') || l.includes('use cost_estimate'))
+            if (l.includes('use drift_detect') || l.includes('use cost_estimate')) {
                 return false;
+            }
             return true;
         })
             .join('\n');
@@ -493,8 +500,9 @@ export function getPrunedHeuristics(mode) {
             .filter(line => {
             const l = line.toLowerCase();
             // Remove plan-mode-only readonly enforcement lines
-            if (l.includes('in plan mode:') || l.includes('never apply, apply'))
+            if (l.includes('in plan mode:') || l.includes('never apply, apply')) {
                 return false;
+            }
             return true;
         })
             .join('\n');
@@ -666,11 +674,13 @@ export function extractForbiddenRules(nimbusContent) {
         }
         if (inForbidden) {
             // Stop at any new ## section
-            if (/^##\s/.test(trimmed))
+            if (/^##\s/.test(trimmed)) {
                 break;
+            }
             // Skip blank lines and HTML comments
-            if (!trimmed || trimmed.startsWith('<!--'))
+            if (!trimmed || trimmed.startsWith('<!--')) {
                 continue;
+            }
             // Collect bullet items
             if (trimmed.startsWith('-') || trimmed.startsWith('*')) {
                 const rule = trimmed.replace(/^[-*]\s*/, '').trim();
@@ -781,8 +791,9 @@ function buildEnvironmentContext(cwd) {
     // Kubernetes context
     try {
         const ctx = execSync('kubectl config current-context', { timeout: 2000, encoding: 'utf-8' }).trim();
-        if (ctx)
+        if (ctx) {
             parts.push(`- Kubernetes context: ${ctx}`);
+        }
     }
     catch { /* ignore */ }
     // Terraform workspace (only if .terraform dir exists)
@@ -791,8 +802,9 @@ function buildEnvironmentContext(cwd) {
             const ws = execSync('terraform workspace show', {
                 cwd: effectiveCwd, timeout: 5000, encoding: 'utf-8',
             }).trim();
-            if (ws)
+            if (ws) {
                 parts.push(`- Terraform workspace: ${ws}`);
+            }
         }
         catch { /* ignore */ }
     }
@@ -808,12 +820,14 @@ function buildEnvironmentContext(cwd) {
         catch { /* ignore */ }
         try {
             const region = execSync('aws configure get region', { timeout: 2000, encoding: 'utf-8' }).trim();
-            if (region)
+            if (region) {
                 parts.push(`- AWS region: ${region}`);
+            }
         }
         catch {
-            if (process.env.AWS_DEFAULT_REGION)
+            if (process.env.AWS_DEFAULT_REGION) {
                 parts.push(`- AWS region: ${process.env.AWS_DEFAULT_REGION}`);
+            }
         }
     }
     // GCP project (only if gcloud available)
@@ -821,8 +835,9 @@ function buildEnvironmentContext(cwd) {
         const proj = execSync('gcloud config get-value project 2>/dev/null', {
             timeout: 3000, encoding: 'utf-8',
         }).trim();
-        if (proj && proj !== '(unset)')
+        if (proj && proj !== '(unset)') {
             parts.push(`- GCP project: ${proj}`);
+        }
     }
     catch { /* ignore */ }
     return parts.join('\n');
@@ -840,13 +855,15 @@ function buildEnvironmentContext(cwd) {
 function buildPrimaryCloudSection() {
     try {
         const configPath = path.join(homedir(), '.nimbus', 'config.json');
-        if (!fs.existsSync(configPath))
+        if (!fs.existsSync(configPath)) {
             return null;
+        }
         const raw = fs.readFileSync(configPath, 'utf-8');
         const config = JSON.parse(raw);
         const clouds = config.primaryClouds;
-        if (!Array.isArray(clouds) || clouds.length === 0)
+        if (!Array.isArray(clouds) || clouds.length === 0) {
             return null;
+        }
         const cloudNames = clouds.map(c => c.toUpperCase()).join(', ');
         return [
             '# Primary Cloud Providers',

package/dist/src/app.js

@@ -41,7 +41,7 @@ export async function initApp() {
                 '',
                 '\x1b[2mRun `nimbus doctor` for detailed diagnosis.\x1b[0m',
             ];
-            process.stderr.write(lines.join('\n') + '\n');
+            process.stderr.write(`${lines.join('\n')}\n`);
             process.exit(1);
         }
         startupWarnings = issues.warnings;

package/dist/src/auth/keychain.js

@@ -13,8 +13,9 @@ const SERVICE = 'nimbus-ai';
 /** Lazy-loaded keytar module. null = checked and unavailable. */
 let keytarModule = undefined; // undefined = not yet checked
 async function loadKeytar() {
-    if (keytarModule !== undefined)
+    if (keytarModule !== undefined) {
         return keytarModule;
+    }
     try {
         // Dynamic import — keytar is an optional peer dependency
         // eslint-disable-next-line @typescript-eslint/no-var-requires
@@ -38,8 +39,9 @@ export async function isKeychainAvailable() {
  */
 export async function keychainGet(account) {
     const kt = await loadKeytar();
-    if (!kt)
+    if (!kt) {
         return null;
+    }
     try {
         return await kt.getPassword(SERVICE, account);
     }
@@ -53,8 +55,9 @@ export async function keychainGet(account) {
  */
 export async function keychainSet(account, secret) {
     const kt = await loadKeytar();
-    if (!kt)
+    if (!kt) {
         return;
+    }
     try {
         await kt.setPassword(SERVICE, account, secret);
     }
@@ -68,8 +71,9 @@ export async function keychainSet(account, secret) {
  */
 export async function keychainDelete(account) {
     const kt = await loadKeytar();
-    if (!kt)
+    if (!kt) {
         return;
+    }
     try {
         await kt.deletePassword(SERVICE, account);
     }