@bunshin-cc/bunshin 0.5.2 → 0.6.1

package/dist/claude-code-ui/README.md

@@ -3,7 +3,14 @@
 Bunshin's hooks talk to the model; this mod shows the person what they did. It draws the CLI's
 session feed (`.bunshin/v2/ui/<session>.json`, written by `packages/cli/src/v2/ui.ts`):
 
-- **above the prompt**: `◆ bunshin  show-me skill  picked by Jev (98%)   lib@207 · 3 served · 1 learned`
+- **above the prompt**: always one row, never wrapped. It shows the document served and why on the left, the
+  session's counts on the right, and reviews waiting in yellow:
+
+      ◆ bunshin  show-me skill  picked by Jev (98%)            lib@207 · 3 served · 1 learned
+      ◇ bunshin  maybe  agent-grid · manage-agent-fleet skill            lib@209 · 7 to review
+
+  On narrow terminals it drops whole pieces, least useful first: the counts, then the reason. It never drops
+  the reviews waiting, and only then trims the name with "…".
 - **`/bunshin`**: a pane with everything served this session and why, the lessons taken from it,
   recent events, and Learn now (`l`), Sync (`s`), Review (`r`)
 - **toasts**: library updates that reached the session, lessons learned, reviews waiting, the

package/dist/claude-code-ui/hooks/bunshin-ui.mjs

@@ -224,22 +224,69 @@ function counts(feed) {
   ].filter(Boolean);
 }
 
-/** The band above the prompt: ◆ bunshin  <latest served>  why · counts. One line, two when narrow. */
+/** The reason in the band's few columns: the feed's sentence, without its filler. */
+const shortWhy = (why) =>
+  String(why ?? "")
+    .replace(/^both embedders agree, and Jev$/, "embedders + Jev agree")
+    .replace(/^both embedders agree$/, "embedders agree")
+    .replace(/, over the embedders$/, "");
+
+/**
+ * The band above the prompt, always exactly one row (it never wraps into fragments):
+ *
+ *   ◆ bunshin  complete-ticket skill  embedders agree          lib@209 · 1 served · 7 to review
+ *   ◇ bunshin  maybe  agent-grid · manage-agent-fleet skill    lib@209 · 7 to review
+ *
+ * What does not fit is dropped whole, least useful first: the quiet counts, then the reason (never
+ * the reviews waiting, in yellow); only then does the name end in "…".
+ */
 function band(Box, Text, feed, columns) {
   const latest = feed.served.find((s) => s.how !== "hint");
   const hint = feed.served[0]?.how === "hint" ? feed.served.filter((s) => s.how === "hint" && s.at === feed.served[0].at) : [];
-  const meta = counts(feed).join(" · ");
-  const parts = [Text({ color: BRAND, bold: true, children: "◆ bunshin" })];
+  const served = feed.served.filter((s) => s.how !== "hint").length;
+  const quiet = [feed.library ? `lib@${feed.library}` : "", served ? `${served} served` : "", feed.lessons.length ? `${feed.lessons.length} learned` : ""].filter(Boolean).join(" · ");
+  const review = feed.review ? `${feed.review} to review` : "";
+  const name = latest ? label(latest) : hint.length ? `maybe  ${hint.map(label).join(" · ")}` : "listening";
+  const why = latest?.why ? `  ${shortWhy(latest.why)}` : "";
+  // The cells each piece takes: "◆ bunshin  " (11), the name, the reason; the counts plus a 2-cell gap.
+  const room = columns - 2;
+  const fits = (withWhy, withQuiet) => {
+    const right = [withQuiet ? quiet : "", review].filter(Boolean).join(" · ");
+    return 11 + name.length + (withWhy ? why.length : 0) + (right ? right.length + 2 : 0) <= room;
+  };
+  // Keep, in order: the name, the reviews waiting, the reason, the quiet counts.
+  const showWhy = !!why && fits(true, false);
+  const showQuiet = !!quiet && fits(showWhy, true);
+
+  const left = [];
   if (latest) {
-    parts.push(Text({ bold: true, children: `  ${clip(label(latest), 40)}` }));
-    if (columns >= 70) parts.push(Text({ dimColor: true, children: `  ${clip(latest.why, Math.max(12, columns - 70))}` }));
+    left.push(Text({ color: BRAND, bold: true, children: "◆ bunshin  " }));
+    left.push(Text({ bold: true, children: label(latest) }));
+    if (showWhy) left.push(Text({ dimColor: true, children: why }));
   } else if (hint.length) {
-    parts.push(Text({ dimColor: true, children: `  maybe: ${clip(hint.map(label).join(", "), Math.max(20, columns - 40))}` }));
+    left.push(Text({ color: BRAND, children: "◇ bunshin  " }));
+    left.push(Text({ dimColor: true, italic: true, children: "maybe  " }));
+    left.push(Text({ dimColor: true, children: hint.map(label).join(" · ") }));
   } else {
-    parts.push(Text({ dimColor: true, children: "  listening" }));
+    left.push(Text({ color: BRAND, children: "◇ bunshin  " }));
+    left.push(Text({ dimColor: true, italic: true, children: "listening" }));
+  }
+  const right = [];
+  if (showQuiet) right.push(Text({ dimColor: true, children: quiet }));
+  if (review) {
+    if (right.length) right.push(Text({ dimColor: true, children: " · " }));
+    right.push(Text({ color: "yellow", children: review }));
   }
-  if (meta && columns >= 50) parts.push(Text({ dimColor: true, children: `   ${meta}` }));
-  return Box({ flexDirection: "row", paddingX: 1, children: parts });
+  return Box({
+    flexDirection: "row",
+    justifyContent: "space-between",
+    width: columns,
+    paddingX: 1,
+    children: [
+      Box({ flexShrink: 1, flexGrow: 1, overflow: "hidden", children: [Text({ wrap: "truncate-end", children: left })] }),
+      ...(right.length ? [Box({ flexShrink: 0, marginLeft: 2, children: [Text({ wrap: "truncate-end", children: right })] })] : []),
+    ],
+  });
 }
 
 function plainSummary(feed) {
@@ -268,14 +315,16 @@ function pane({ Box, Text, Button }, feed, panel, columns, rows) {
     body.push(heading(Text, "Served this session"));
     const served = feed.served.slice(0, Math.max(3, Math.floor(rows / 3)));
     if (!served.length) body.push(Text({ dimColor: true, children: "  nothing yet" }));
+    // One line per row, never wrapped into fragments: time and how, the document, why.
     for (const s of served) {
       body.push(
-        Box({
-          flexDirection: "row",
+        Text({
+          wrap: "truncate-end",
           children: [
-            Text({ dimColor: true, children: `  ${hhmm(s.at)} ${s.how.padEnd(4)} ` }),
-            Text({ bold: s.how !== "hint", dimColor: s.how === "hint", children: clip(label(s), 36) }),
-            Text({ dimColor: true, children: `  ${clip(s.why, Math.max(10, width - 52))}` }),
+            Text({ dimColor: true, children: `  ${hhmm(s.at)}  ` }),
+            Text({ color: s.how === "hint" ? undefined : BRAND, dimColor: s.how === "hint", children: `${s.how === "hint" ? "◇" : "◆"} ` }),
+            Text({ bold: s.how !== "hint", dimColor: s.how === "hint", children: label(s) }),
+            Text({ dimColor: true, children: s.why ? `  ${shortWhy(s.why)}` : s.how === "hint" ? "  maybe" : "" }),
           ],
         }),
       );

package/dist/git-remote-bunshin.js

@@ -1,13 +1,25 @@
 #!/usr/bin/env node
 
 // src/v2/gitremote.ts
-import fs from "node:fs";
+import fs3 from "node:fs";
 import os from "node:os";
-import path from "node:path";
+import path2 from "node:path";
 import readline from "node:readline";
 import { spawnSync } from "node:child_process";
 
+// src/trust.ts
+import fs2 from "node:fs";
+import path from "node:path";
+
 // src/util.ts
+import fs from "node:fs";
+function readJson(file, fallback) {
+  try {
+    return JSON.parse(fs.readFileSync(file, "utf8"));
+  } catch {
+    return fallback;
+  }
+}
 var STOPWORDS = new Set(
   "a an the and or but if then else of to in on at for from by with without as is are was were be been being do does did done have has had can could should would will shall may might must this that these those it its i we you they he she them us our your my me not no yes so just also very really please now new use using make get set add fix run change update create write need want like about into over under out up down how what when where why which who whom there here some any all each every more most less least than too own same other".split(" ")
 );
@@ -15,6 +27,50 @@ function homeDir() {
   return process.env.HOME || process.env.USERPROFILE || "/";
 }
 
+// src/trust.ts
+var HOSTED_API = "https://api.bunshin.cc";
+var LOOPBACK = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]"]);
+var configDir = () => path.join(homeDir(), ".config/bunshin");
+var trustFile = () => path.join(configDir(), "trusted-stores.json");
+var credentialDir = () => path.join(configDir(), "credentials");
+function secureUrl(raw) {
+  try {
+    const url = new URL(raw ?? "");
+    return url.protocol === "https:" || url.protocol === "http:" && LOOPBACK.has(url.hostname);
+  } catch {
+    return false;
+  }
+}
+function urlOrigin(raw) {
+  try {
+    return new URL(raw ?? "").origin;
+  } catch {
+    return null;
+  }
+}
+function trustedStores() {
+  const list = readJson(trustFile(), {}).stores;
+  return Array.isArray(list) ? list.filter((x) => typeof x === "string") : [];
+}
+function trustedOrigins() {
+  const out = /* @__PURE__ */ new Set([HOSTED_API]);
+  for (const root of trustedStores()) {
+    const url = readJson(path.join(root, "config.json"), {}).apiUrl;
+    if (url) out.add(url);
+  }
+  for (const url of Object.keys(readJson(path.join(configDir(), "git-credentials.json"), {}))) out.add(url);
+  let files = [];
+  try {
+    files = fs2.readdirSync(credentialDir()).filter((f) => f.endsWith(".json"));
+  } catch {
+  }
+  for (const f of files) {
+    const url = readJson(path.join(credentialDir(), f), {}).apiUrl;
+    if (url) out.add(url);
+  }
+  return new Set([...out].map(urlOrigin).filter((x) => !!x));
+}
+
 // src/v2/gitremote.ts
 var ZERO_SHA = "0".repeat(40);
 var REMOTE_PATH = "/v1/git/repos/";
@@ -25,27 +81,30 @@ function parseRemoteUrl(url) {
   const apiUrl = raw.slice(0, i);
   const repo = decodeURIComponent(raw.slice(i + REMOTE_PATH.length));
   if (!/^https?:\/\//.test(apiUrl) || repo.split("/").length !== 2) throw new Error(`not a Bunshin repository address: ${url}`);
+  if (!secureUrl(apiUrl)) throw new Error(`refusing ${apiUrl}: Bunshin repositories need https (http only on localhost)`);
   return { apiUrl, repo };
 }
-var gitCredentialFile = () => path.join(homeDir(), ".config/bunshin/git-credentials.json");
+var gitCredentialFile = () => path2.join(homeDir(), ".config/bunshin/git-credentials.json");
 function resolveGitKey(apiUrl) {
   const base = apiUrl.replace(/\/$/, "");
-  if (process.env.BUNSHIN_API_KEY) return process.env.BUNSHIN_API_KEY;
+  if (!secureUrl(base)) return void 0;
+  const origin = urlOrigin(base);
+  if (process.env.BUNSHIN_API_KEY && origin && trustedOrigins().has(origin)) return process.env.BUNSHIN_API_KEY;
   try {
-    const all = JSON.parse(fs.readFileSync(gitCredentialFile(), "utf8"));
+    const all = JSON.parse(fs3.readFileSync(gitCredentialFile(), "utf8"));
     if (all[base]) return all[base];
   } catch {
   }
-  const dir = path.join(homeDir(), ".config/bunshin/credentials");
+  const dir = path2.join(homeDir(), ".config/bunshin/credentials");
   let files = [];
   try {
-    files = fs.readdirSync(dir).filter((f) => f.endsWith(".json"));
+    files = fs3.readdirSync(dir).filter((f) => f.endsWith(".json"));
   } catch {
     return void 0;
   }
   for (const f of files.sort()) {
     try {
-      const c = JSON.parse(fs.readFileSync(path.join(dir, f), "utf8"));
+      const c = JSON.parse(fs3.readFileSync(path2.join(dir, f), "utf8"));
       if (c.apiKey && c.apiUrl?.replace(/\/$/, "") === base) return c.apiKey;
     } catch {
     }
@@ -171,7 +230,7 @@ async function fetchObjects(client, repo, wanted, log = () => {
   const have = presentObjects([...new Set(meta.flatMap((b) => b.tips))]);
   const needed = meta.filter((b) => b.tips.some((t) => !have.has(t)));
   if (!needed.length) throw new Error("the server has no bundle with the missing objects");
-  const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "bunshin-git-"));
+  const tmp = fs3.mkdtempSync(path2.join(os.tmpdir(), "bunshin-git-"));
   try {
     let after = needed[0].seq - 1;
     const want = new Set(needed.map((b) => b.seq));
@@ -181,10 +240,10 @@ async function fetchObjects(client, repo, wanted, log = () => {
       for (const b of page.bundles) {
         after = b.seq;
         if (!want.has(b.seq) || !b.data) continue;
-        const file = path.join(tmp, `${b.seq}.bundle`);
-        fs.writeFileSync(file, Buffer.from(b.data, "base64"));
+        const file = path2.join(tmp, `${b.seq}.bundle`);
+        fs3.writeFileSync(file, Buffer.from(b.data, "base64"));
         git(["bundle", "unbundle", file]);
-        fs.rmSync(file, { force: true });
+        fs3.rmSync(file, { force: true });
         applied++;
       }
       if (!page.more || !page.bundles.length) break;
@@ -192,7 +251,7 @@ async function fetchObjects(client, repo, wanted, log = () => {
     log(`bunshin: applied ${applied} bundle${applied === 1 ? "" : "s"}
 `);
   } finally {
-    fs.rmSync(tmp, { recursive: true, force: true });
+    fs3.rmSync(tmp, { recursive: true, force: true });
   }
   const still = wanted.filter((s) => !presentObjects([s]).has(s));
   if (still.length) throw new Error(`objects still missing after fetch: ${still.slice(0, 3).join(", ")}`);
@@ -246,7 +305,7 @@ async function pushRefs(client, repo, specs) {
   const sends = updates.filter((u) => u.new !== ZERO_SHA);
   let bundle = null;
   if (sends.length) {
-    const tmp = fs.mkdtempSync(path.join(os.tmpdir(), "bunshin-git-"));
+    const tmp = fs3.mkdtempSync(path2.join(os.tmpdir(), "bunshin-git-"));
     const tmpRefs = [];
     try {
       sends.forEach((u, i) => {
@@ -255,9 +314,9 @@ async function pushRefs(client, repo, specs) {
         tmpRefs.push(ref);
       });
       const known = presentObjects([...new Set(remote.values())]);
-      const file = path.join(tmp, "push.bundle");
+      const file = path2.join(tmp, "push.bundle");
       const r = git(["bundle", "create", "--quiet", file, ...tmpRefs, ...[...known].map((k) => `^${k}`)], { allowFail: true });
-      if (r.ok) bundle = new Uint8Array(fs.readFileSync(file));
+      if (r.ok) bundle = new Uint8Array(fs3.readFileSync(file));
       else if (!/empty bundle/i.test(r.err)) throw new Error(r.err.trim() || "git bundle create failed");
       else {
         for (const u of sends) {
@@ -267,7 +326,7 @@ async function pushRefs(client, repo, specs) {
       }
     } finally {
       for (const ref of tmpRefs) git(["update-ref", "-d", ref], { allowFail: true });
-      fs.rmSync(tmp, { recursive: true, force: true });
+      fs3.rmSync(tmp, { recursive: true, force: true });
     }
   }
   if (updates.length) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunshin-cc/bunshin",
-  "version": "0.5.2",
+  "version": "0.6.1",
   "description": "Shared memory for company AI agents. Connect Codex, Claude Code, or Pi to Bunshin.",
   "type": "module",
   "bin": {
@@ -16,15 +16,15 @@
     "node": ">=20"
   },
   "dependencies": {
-    "@anthropic-ai/sdk": "^0.127.0",
+    "@anthropic-ai/sdk": "^0.129.0",
     "yaml": "^2.8.0"
   },
   "devDependencies": {
-    "@types/node": "^22.15.0",
+    "@types/node": "^26.6.3",
     "esbuild": "^0.28.1",
-    "tsx": "^4.20.0",
-    "typescript": "^5.8.0",
-    "vitest": "^3.2.0",
+    "tsx": "^4.23.15",
+    "typescript": "^7.0.2",
+    "vitest": "^5.0.2",
     "@bunshin/core": "0.1.0"
   },
   "license": "MIT",