@buildaharness/aielia 0.3.5 → 0.3.7

package/dist/cli-config.d.ts

@@ -18,10 +18,13 @@ export declare function isConfigKey(key: string): key is keyof AssistantConfig;
  * before this module existed (ASSISTANT_ENABLE_WEB/ASSISTANT_ENABLE_SHELL must be exactly "1").
  */
 export declare function envOverridesFromProcessEnv(env: NodeJS.ProcessEnv): Partial<AssistantConfig>;
+export declare function findInvalidNumericSettings(config: AssistantConfig): string[];
 /** Thrown by parseConfigValue on a value that doesn't fit the target key's type — cli.ts reports .message and leaves the config unchanged. */
 export declare class ConfigValueParseError extends Error {
 }
 /** Parses a raw `/config set <key> <value>` string into the type AssistantConfig[key] expects. */
 export declare function parseConfigValue(key: keyof AssistantConfig, raw: string): unknown;
+/** A URL with any user:password, and every query-string value, masked, so a credential embedded in proxyUrl is never printed. Text that is not a URL is returned unchanged. */
+export declare function redactUrlCredentials(text: string): string;
 /** Renders /config's full listing as a single multi-line string — cli.ts just console.logs the result. */
 export declare function formatConfigListing(config: AssistantConfig, overriddenKeys: ReadonlySet<keyof AssistantConfig>): string;

package/dist/cli-session.d.ts

@@ -7,11 +7,12 @@ import { GoalGraphState } from './goal-graph-service.js';
 import { UndoLogEntry } from './action-snapshot.js';
 import { UserFact } from './fact-extraction.js';
 /**
- * Pure formatting/logic backing cli.ts's session-level commands (/help, /status, /export,
- * /memory, /cost, /doctor) — split out so it's unit-testable without a real readline loop,
- * the same way cli-config.ts already is for the /config family. cli.ts stays thin glue
- * (reading live state, calling these, doing actual file I/O) on top of these functions.
+ * Text that came from the model, a tool result, a file or a web page must not reach the terminal raw: an
+ * embedded escape sequence can clear the screen, rewrite earlier lines (hiding what an approval prompt is
+ * really asking), set the window title or write the clipboard (OSC 52). Newlines and tabs survive; everything
+ * that could drive the terminal is removed. Plain text is returned unchanged.
  */
+export declare function stripTerminalControls(text: string): string;
 export interface CliCommandHelp {
     command: string;
     description: string;

package/dist/cli.d.ts

@@ -28,6 +28,12 @@ export interface RunCliOptions {
         id: string;
         status: TaskStatus;
     }[]) => void;
+    /**
+     * Called with true when a conversational turn starts being worked on and false when it has finished (in a
+     * `finally`, so also after an error) — including turns run as deferred follow-ups, which no `dispatchLine()`
+     * promise covers. The TUI's liveness indicator follows this rather than guessing from output events.
+     */
+    onTurnBusyChange?: (busy: boolean) => void;
     dataDir?: string;
     configStore?: ConfigStore;
     backend?: FsBackend;
@@ -97,6 +103,9 @@ export declare function runCli(options?: RunCliOptions): Promise<CliInstance>;
  * `runTuiApp` is imported dynamically so a disabled (the default) or non-TTY run never loads Ink
  * at all — `main()` behaves byte-for-byte as it does today in both those cases.
  */
+/** A reason the assistant refuses to start (invalid configuration, unusable environment): shown to the user verbatim, exit code 1. */
+export declare class StartupError extends Error {
+}
 export declare function main(argv?: readonly string[]): Promise<void>;
 /**
  * True when `entryArg` (a `process.argv[1]` value) refers to the same file as

package/dist/cli.js

@@ -1,3 +1,3 @@
 #!/usr/bin/env node
-import "./bin-CjKpxDxl.js";
+import "./bin-C_hgDdSf.js";
 //# sourceMappingURL=cli.js.map

package/dist/config.d.ts

@@ -141,7 +141,7 @@ export interface AssistantConfig {
      * Phase 4 of the internal plan — the rollout flag for the
      * Ink-driven pinned-bottom-input interactive shell (tui-app.ts's runTuiApp()). Undefined (the
      * default, for this plan's whole rollout window) means cli.ts's main() falls back to
-     * DEFAULT_TUI_MODE ('disabled') — today's plain readline-based REPL, byte-for-byte. Mirrors
+     * DEFAULT_TUI_MODE ('enabled'); 'disabled' is the plain readline-based REPL. Mirrors
      * oneLoopMode/askMode/planMode's exact chain: env override (ASSISTANT_TUI, cli-config.ts) and
      * a package-owned default kept out of DEFAULT_CONFIG so an unset value stays undefined. Unlike
      * those three, this has no chat-ui/desktop build-time counterpart — there's no terminal to pin
@@ -157,6 +157,8 @@ export interface AssistantConfig {
      * check, never the explicit `aielia update` command. CLI-only, like `tuiMode`.
      */
     updateCheck?: UpdateCheckMode;
+    /** Colour theme of the chat-ui/desktop window: 'system' (default, follows the OS), 'dark' or 'light'. The CLI ignores it. */
+    theme?: 'system' | 'dark' | 'light';
     /**
      * The project label newly captured project-scoped facts are tagged with, and the one
      * project-scoped facts are filtered against when building a turn's context (see

package/dist/debug-log.d.ts

@@ -5,12 +5,21 @@
  * caller opts into this explicitly (see PersonalAssistantOptions.onDebugLog) knowing it
  * carries real content, not just metadata.
  *
+ * `approval_request` is a state-changing action (write/shell/email) staged for the user's yes/no, and
+ * `approval_decision` is how that was resolved ('approved' or 'declined'); the executed result of an
+ * approved action is the separate `tool_call` entry, so a log reader can reconstruct the whole exchange.
+ *
+ * `next_steps` is the numbered list of suggestions printed under a reply (one entry per turn that produced any).
+ *
+ * `note` records a robustness action the loop took on its own (an empty final answer retried, or replaced by a
+ * deterministic fallback), so a log reader can see why a reply is not what the model first returned.
+ *
  * Split into its own file so both assistant.ts (user_message/assistant_reply kinds, emitted from
  * `turn()`) and agent-loop.ts (tool_call kind, emitted from the ReAct loop) can depend on it
  * without either owning the other.
  */
 export interface DebugLogEntry {
-    kind: 'user_message' | 'assistant_reply' | 'tool_call';
+    kind: 'user_message' | 'user_message_queued' | 'assistant_reply' | 'tool_call' | 'approval_request' | 'approval_decision' | 'note' | 'next_steps';
     sessionId: string;
     content: string;
 }

package/dist/email.d.ts

@@ -53,8 +53,10 @@ export interface ResendSenderOptions {
  */
 export declare function createResendSender(options: ResendSenderOptions): SendEmail;
 /**
- * One-line human-readable summary of a staged email, for the approval prompt and trace. Kept here
+ * Human-readable summary of a staged email, for the approval prompt and trace. Kept here
  * (not in agent-loop.ts) so the MCP server (file-tools-mcp-server.mjs) and the CLI can format the
- * same way without importing the loop.
+ * same way without importing the loop. The approver must see everything that will be sent: every
+ * recipient (Cc/Bcc included, since a hidden Bcc is a silent exfiltration channel) and the whole
+ * body, never a truncated preview.
  */
-export declare function formatEmailApprovalReason(message: Pick<EmailMessage, 'to' | 'subject' | 'body'>): string;
+export declare function formatEmailApprovalReason(message: Pick<EmailMessage, 'to' | 'subject' | 'body' | 'cc' | 'bcc'>): string;

package/dist/file-tools-mcp-server.mjs

@@ -86,7 +86,7 @@
  * logic without a real MCP client attached over stdio): node file-tools-mcp-server.mjs --test
  */
 
-import { readFile, writeFile, mkdir, readdir, realpath as fsRealpath, mkdtemp, rm } from 'node:fs/promises'
+import { readFile, writeFile, mkdir, readdir, realpath as fsRealpath, mkdtemp, rm, rename } from 'node:fs/promises'
 import { readFileSync } from 'node:fs'
 import { tmpdir } from 'node:os'
 import { randomUUID } from 'node:crypto'
@@ -111,10 +111,16 @@ export class PathOutsideWorkspaceError extends Error {
   }
 }
 
+// Mirrors file-tools.ts's normalizePath: splits on both `/` and `\`, and treats a Windows drive-letter
+// prefix as absolute — otherwise a backslash-style `..\..\x` is one opaque segment here that never
+// pops, yet the real OS resolves it as a traversal.
 function normalizePath(path) {
-  const absolute = path.startsWith('/')
+  const driveMatch = /^([A-Za-z]:)[\\/]/.exec(path)
+  const absolute = driveMatch !== null || path.startsWith('/') || path.startsWith('\\')
+  const prefix = driveMatch ? driveMatch[1] : ''
+  const rest = driveMatch ? path.slice(driveMatch[0].length) : path
   const segments = []
-  for (const part of path.split('/')) {
+  for (const part of rest.split(/[\\/]/)) {
     if (part === '' || part === '.') continue
     if (part === '..') {
       if (segments.length > 0 && segments[segments.length - 1] !== '..') segments.pop()
@@ -123,12 +129,13 @@ function normalizePath(path) {
       segments.push(part)
     }
   }
-  return (absolute ? '/' : '') + segments.join('/')
+  return prefix + (absolute ? '/' : '') + segments.join('/')
 }
 
 export function resolveInWorkspace(workspaceRoot, requestedPath) {
   const root = normalizePath(workspaceRoot)
-  const combined = requestedPath.startsWith('/') ? requestedPath : `${root}/${requestedPath}`
+  const requestedIsAbsolute = /^[A-Za-z]:[\\/]/.test(requestedPath) || requestedPath.startsWith('/') || requestedPath.startsWith('\\')
+  const combined = requestedIsAbsolute ? requestedPath : `${root}/${requestedPath}`
   const resolved = normalizePath(combined)
   if (resolved !== root && !resolved.startsWith(`${root}/`)) {
     throw new PathOutsideWorkspaceError(requestedPath)
@@ -176,7 +183,18 @@ function isEnoent(err) {
 // once the current one resolves, instead of dropping it.
 let lastStagedIdThisProcess
 
-export async function stagePendingAction(workspaceRoot, payload) {
+// Two staging calls in flight at once (a client may issue tool calls concurrently) would both read the same
+// `lastStagedIdThisProcess` and both link it forward, so one link overwrote the other and that action was never
+// surfaced for approval. Staging is therefore serialized.
+let stagingChain = Promise.resolve()
+
+export function stagePendingAction(workspaceRoot, payload) {
+  const run = stagingChain.then(() => stagePendingActionNow(workspaceRoot, payload))
+  stagingChain = run.then(() => undefined, () => undefined)
+  return run
+}
+
+async function stagePendingActionNow(workspaceRoot, payload) {
   const id = randomUUID()
   const dir = `${workspaceRoot}/${PENDING_ACTIONS_DIR}`
   await mkdir(dir, { recursive: true })
@@ -375,7 +393,18 @@ function doRequestToolGate(port, payload, options) {
 // ── Trust boundary for fetched content — mirrors trust-tagging.ts ──────────
 
 export function wrapUntrusted(text) {
-  return `<untrusted_external_content>\n${text}\n</untrusted_external_content>`
+  // Same defanging as trust-tagging.ts: content cannot close (or re-open) the boundary itself.
+  // String scan, not a regex: this is a structural delimiter check, not a natural-language gate.
+  const safe = text
+    .split('<')
+    .map((part, i) => {
+      if (i === 0) return part
+      let rest = part.trimStart()
+      if (rest.startsWith('/')) rest = rest.slice(1).trimStart()
+      return rest.toLowerCase().startsWith('untrusted_external_content') ? '&lt;' + part : '<' + part
+    })
+    .join('')
+  return `<untrusted_external_content>\n${safe}\n</untrusted_external_content>`
 }
 
 // Reads the same canonical JSON trust-tagging.ts's own INJECTION_PATTERNS compiles from
@@ -427,17 +456,46 @@ function isPrivateIPv4(ip) {
   if (a === 172 && b >= 16 && b <= 31) return true // RFC1918
   if (a === 192 && b === 168) return true // RFC1918
   if (a === 169 && b === 254) return true // link-local, includes the 169.254.169.254 cloud metadata endpoint
+  if (a === 100 && b >= 64 && b <= 127) return true // carrier-grade NAT
+  if (a === 198 && (b === 18 || b === 19)) return true // benchmarking
+  if (a >= 224) return true // multicast, reserved, broadcast
   if (a === 0) return true // "this network"
   return false
 }
 
+// Same logic as web-fetch-core.ts's ipv6Groups/isPrivateIPv6 (kept in sync by hand, see file header).
+// Notably URL parsing serialises `[::ffff:127.0.0.1]` as `::ffff:7f00:1`, which the old dotted-quad-only
+// regex never matched — a literal-IP fetch of a mapped loopback address got through.
+function ipv6Groups(ip) {
+  let text = ip
+  const v4 = /(\d+\.\d+\.\d+\.\d+)$/.exec(text)
+  if (v4) {
+    const octets = v4[1].split('.').map(Number)
+    if (octets.some((o) => o > 255)) return null
+    text = `${text.slice(0, -v4[1].length)}${((octets[0] << 8) | octets[1]).toString(16)}:${((octets[2] << 8) | octets[3]).toString(16)}`
+  }
+  const halves = text.split('::')
+  if (halves.length > 2) return null
+  const head = halves[0] === '' ? [] : halves[0].split(':')
+  const tail = halves.length === 2 && halves[1] !== '' ? halves[1].split(':') : []
+  const missing = 8 - head.length - tail.length
+  if (halves.length === 1 ? missing !== 0 : missing < 1) return null
+  const groups = [...head, ...Array(halves.length === 2 ? missing : 0).fill('0'), ...tail].map((g) => parseInt(g, 16))
+  if (groups.length !== 8 || groups.some((g) => Number.isNaN(g) || g < 0 || g > 0xffff)) return null
+  return groups
+}
+
 function isPrivateIPv6(ip) {
-  const normalized = ip.toLowerCase()
-  if (normalized === '::1' || normalized === '::') return true
-  if (normalized.startsWith('fe80:')) return true // link-local
-  if (normalized.startsWith('fc') || normalized.startsWith('fd')) return true // unique local, fc00::/7
-  const mapped = /^::ffff:(\d+\.\d+\.\d+\.\d+)$/.exec(normalized)
-  if (mapped) return isPrivateIPv4(mapped[1])
+  const groups = ipv6Groups(ip.toLowerCase().split('%')[0])
+  if (!groups) return true // unparseable: refuse rather than guess
+  const embeddedV4 = `${groups[6] >> 8}.${groups[6] & 0xff}.${groups[7] >> 8}.${groups[7] & 0xff}`
+  const firstFiveZero = groups.slice(0, 5).every((g) => g === 0)
+  if (firstFiveZero && groups[5] === 0 && groups[6] === 0 && (groups[7] === 0 || groups[7] === 1)) return true // :: and ::1
+  if (firstFiveZero && (groups[5] === 0xffff || groups[5] === 0)) return isPrivateIPv4(embeddedV4) // mapped / compatible
+  if (groups[0] === 0x64 && groups[1] === 0xff9b && groups.slice(2, 6).every((g) => g === 0)) return isPrivateIPv4(embeddedV4) // NAT64
+  if ((groups[0] & 0xffc0) === 0xfe80) return true // link-local fe80::/10
+  if ((groups[0] & 0xfe00) === 0xfc00) return true // unique local fc00::/7
+  if ((groups[0] & 0xff00) === 0xff00) return true // multicast
   return false
 }
 
@@ -457,6 +515,13 @@ export async function assertPublicHttpUrl(url) {
     throw new PrivateNetworkTargetError(url, `unsupported scheme "${parsed.protocol}"`)
   }
 
+  if (parsed.username || parsed.password) {
+    throw new PrivateNetworkTargetError(url, 'credentials in the URL are not allowed')
+  }
+  if (parsed.port && parsed.port !== '80' && parsed.port !== '443') {
+    throw new PrivateNetworkTargetError(url, `port "${parsed.port}" is not allowed (only 80/443)`)
+  }
+
   const hostname = stripBrackets(parsed.hostname)
   if (hostname === 'localhost') {
     throw new PrivateNetworkTargetError(url, '"localhost" resolves to a loopback address')
@@ -495,22 +560,72 @@ function truncateFetchedText(text) {
   return `${text.slice(0, MAX_FETCH_CHARS)}\n\n[... truncated at ${MAX_FETCH_CHARS} characters; the page is longer than shown here ...]`
 }
 
+const FETCH_TIMEOUT_MS = 10_000
+// Streamed-read ceiling (a lying/absent Content-Length must not force an unbounded download); mirrors
+// web-fetch-core.ts's DEFAULT_MAX_FETCH_BYTES.
+const MAX_FETCH_BYTES = 4 * MAX_FETCH_CHARS
+
+async function readCappedText(response, signal) {
+  const reader = response.body?.getReader()
+  if (!reader) return (await response.text()).slice(0, MAX_FETCH_BYTES)
+  const chunks = []
+  let total = 0
+  try {
+    while (total < MAX_FETCH_BYTES) {
+      if (signal.aborted) throw new Error('aborted')
+      const { done, value } = await new Promise((resolve, reject) => {
+        const onAbort = () => reject(new Error('aborted'))
+        signal.addEventListener('abort', onAbort, { once: true })
+        reader.read().then(
+          (r) => { signal.removeEventListener('abort', onAbort); resolve(r) },
+          (e) => { signal.removeEventListener('abort', onAbort); reject(e) },
+        )
+      })
+      if (done) break
+      chunks.push(value)
+      total += value.byteLength
+    }
+  } finally {
+    void reader.cancel().catch(() => {})
+  }
+  const merged = new Uint8Array(Math.min(total, MAX_FETCH_BYTES))
+  let offset = 0
+  for (const chunk of chunks) {
+    const room = merged.length - offset
+    if (room <= 0) break
+    merged.set(chunk.subarray(0, room), offset)
+    offset += Math.min(chunk.length, room)
+  }
+  return new TextDecoder('utf-8', { fatal: false }).decode(merged)
+}
+
 export async function fetchUrlSafely(url) {
   let currentUrl = url
   for (let redirect = 0; redirect <= MAX_REDIRECTS; redirect++) {
     await assertPublicHttpUrl(currentUrl)
-    const response = await fetch(currentUrl, { redirect: 'manual' })
-    if (response.status >= 300 && response.status < 400) {
-      const location = response.headers.get('location')
-      if (!location) throw new Error(`Redirect response from "${currentUrl}" had no Location header`)
-      currentUrl = new URL(location, currentUrl).toString()
-      continue
+    // One timer bounds the headers and the body read, as in web-fetch-core.ts.
+    const controller = new AbortController()
+    const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS)
+    try {
+      const response = await fetch(currentUrl, { redirect: 'manual', signal: controller.signal })
+      if (response.status >= 300 && response.status < 400) {
+        const location = response.headers.get('location')
+        await response.body?.cancel().catch(() => {})
+        if (!location) throw new Error(`Redirect response from "${currentUrl}" had no Location header`)
+        currentUrl = new URL(location, currentUrl).toString()
+        continue
+      }
+      const body = await readCappedText(response, controller.signal)
+      // Same rule as web-tools.ts's fetchUrlSafely: a 5xx is a server fault, not page content — an error the model and the
+      // parent's ControlState can see (a 4xx page stays content).
+      if (response.status >= 500) throw new Error(`HTTP ${response.status} from ${url}: ${body.slice(0, 200).trim()}`)
+      return truncateFetchedText(body)
+    } catch (err) {
+      if (controller.signal.aborted) throw new Error(`Timed out fetching "${currentUrl}" after ${FETCH_TIMEOUT_MS}ms`)
+      throw err
+    } finally {
+      clearTimeout(timer)
     }
-    const body = await response.text()
-    // Same rule as web-tools.ts's fetchUrlSafely: a 5xx is a server fault, not page content — an error the model and the
-    // parent's ControlState can see (a 4xx page stays content).
-    if (response.status >= 500) throw new Error(`HTTP ${response.status} from ${url}: ${body.slice(0, 200).trim()}`)
-    return truncateFetchedText(body)
   }
   throw new Error(`Too many redirects while fetching "${url}"`)
 }
@@ -623,14 +738,24 @@ async function readRemindersFile(remindersFile) {
 
 async function writeRemindersFile(remindersFile, reminders) {
   await mkdir(remindersFile.slice(0, remindersFile.lastIndexOf('/')), { recursive: true })
-  await writeFile(remindersFile, JSON.stringify({ key: REMINDERS_KEY, value: reminders }), 'utf-8')
+  // Write-then-rename so a crash mid-write cannot leave a truncated file that fails to parse on every later read.
+  const tmp = `${remindersFile}.tmp-${randomUUID()}`
+  await writeFile(tmp, JSON.stringify({ key: REMINDERS_KEY, value: reminders }), 'utf-8')
+  await rename(tmp, remindersFile)
 }
 
-export async function createReminder(remindersFile, rawText) {
-  const reminders = await readRemindersFile(remindersFile)
-  const record = { id: randomUUID(), rawText, createdAt: new Date().toISOString(), dueAt: null, done: false }
-  await writeRemindersFile(remindersFile, [...reminders, record])
-  return record
+// Concurrent create_reminder calls would each read the same list and the last write would drop the others.
+let reminderChain = Promise.resolve()
+
+export function createReminder(remindersFile, rawText) {
+  const run = reminderChain.then(async () => {
+    const reminders = await readRemindersFile(remindersFile)
+    const record = { id: randomUUID(), rawText, createdAt: new Date().toISOString(), dueAt: null, done: false }
+    await writeRemindersFile(remindersFile, [...reminders, record])
+    return record
+  })
+  reminderChain = run.then(() => undefined, () => undefined)
+  return run
 }
 
 async function main() {

package/dist/file-tools.d.ts

@@ -33,6 +33,8 @@ export declare function assertRealPathInWorkspace(backend: FsBackend, workspaceR
  * "nothing to diff against" signal `applyPendingAction`'s own `previousContent` uses.
  */
 export declare function readCurrentFileContent(backend: FsBackend, workspaceRoot: string, requestedPath: string): Promise<string | undefined>;
+/** A workspace file path in one comparable form: relative to the workspace root, no leading "./" or "/". Absolute paths inside the workspace and relative ones name the same file. */
+export declare function workspaceRelative(workspaceRoot: string, requestedPath: string): string;
 export declare const READ_FILE_TOOL: ToolDefinition;
 export declare const LIST_DIRECTORY_TOOL: ToolDefinition;
 export declare const WRITE_FILE_TOOL: ToolDefinition;

package/dist/git-exclude.d.ts

@@ -0,0 +1,9 @@
+/** Directories Aielia keeps inside the workspace for its own state. */
+export declare const AIELIA_STATE_DIRS: readonly [".pending-actions", ".undo-log", ".buildaharness"];
+/**
+ * Keeps Aielia's own state directories out of version control when the workspace is inside a git repo, by adding them to
+ * `<gitdir>/info/exclude` — the per-clone ignore file git itself provides for this. The user's tracked `.gitignore` is never
+ * touched, and a non-git directory is left exactly as it was. Idempotent and best-effort: returns the entries it added and
+ * never throws (a read-only .git must not stop the assistant from starting).
+ */
+export declare function excludeAieliaStateFromGit(workspaceRoot: string): string[];

package/dist/index.d.ts

@@ -34,7 +34,7 @@ export { braveSearch } from './web-search-provider.js';
 export type { BraveSearchOptions } from './web-search-provider.js';
 export { buildClaudePrompt, parseClaudeCliOutput, ALREADY_STAGED_ACTION_TOOL, stagedActionInput } from './claude-cli-prompt.js';
 export type { ParsedClaudeCliOutput } from './claude-cli-prompt.js';
-export { stripMcpToolPrefix, summarizeToolStep } from './tool-step.js';
+export { stripMcpToolPrefix, summarizeToolStep, summarizeSettledToolStep } from './tool-step.js';
 export type { AssistantToolStep } from './tool-step.js';
 export type { DecomposedTaskSpec } from './decomposition-classifier.js';
 export { detectHomogeneousBatchList } from './batch-list-detector.js';