@chibitek/chibi 0.1.155 → 0.1.158

package/dist-server/server/vault/store.js

@@ -0,0 +1,177 @@
+// Native Vault persistence. No API/OAuth credentials are stored here.
+// The caller supplies a key from the trusted runtime; this module never
+// creates a plaintext key file or returns stored secrets to a model.
+import { createCipheriv, createDecipheriv, randomBytes, randomUUID } from "node:crypto";
+import { lstatSync, mkdirSync, readFileSync, rmdirSync } from "node:fs";
+import { join } from "node:path";
+import { z } from "zod";
+import { vaultInputSchema, vaultMetadata } from "../../shared/vault.js";
+import { writeFileAtomic } from "../atomic.js";
+const MAX_BYTES = 16 * 1024 * 1024;
+const MAX_ITEMS = 1000;
+const AAD = Buffer.from("atomic-native-vault:v1");
+const identity = z.string().uuid();
+const metadataSchema = z.object({
+    id: identity, ownerId: identity, createdAt: z.number().int().nonnegative(), updatedAt: z.number().int().nonnegative(),
+});
+const envelopeSchema = z.object({
+    version: z.literal(1), iv: z.string().regex(/^[0-9a-f]{24}$/),
+    tag: z.string().regex(/^[0-9a-f]{32}$/), data: z.string().regex(/^(?:[A-Za-z0-9+/]{4})*(?:[A-Za-z0-9+/]{2}==|[A-Za-z0-9+/]{3}=)?$/),
+}).strict();
+export class VaultError extends Error {
+}
+function owner(value) {
+    if (!identity.safeParse(value).success)
+        throw new VaultError("Invalid Vault owner.");
+}
+export class VaultStore {
+    #directory;
+    #file;
+    #key;
+    constructor(directory, key) {
+        if (key.length !== 32)
+            throw new VaultError("Vault encryption is unavailable.");
+        this.#directory = directory;
+        this.#file = join(directory, "vault.enc");
+        this.#key = Buffer.from(key);
+    }
+    read() {
+        try {
+            let stat;
+            try {
+                stat = lstatSync(this.#file);
+            }
+            catch (error) {
+                if (error.code === "ENOENT")
+                    return [];
+                throw error;
+            }
+            if (!stat.isFile() || stat.isSymbolicLink() || stat.size > MAX_BYTES)
+                throw new Error();
+            const envelope = envelopeSchema.parse(JSON.parse(readFileSync(this.#file, "utf8")));
+            const decipher = createDecipheriv("aes-256-gcm", this.#key, Buffer.from(envelope.iv, "hex"));
+            decipher.setAAD(AAD);
+            decipher.setAuthTag(Buffer.from(envelope.tag, "hex"));
+            const plain = Buffer.concat([decipher.update(Buffer.from(envelope.data, "base64")), decipher.final()]);
+            try {
+                // Separate metadata before the strict input schema validates each item.
+                const raw = JSON.parse(plain.toString("utf8"));
+                if (!Array.isArray(raw) || raw.length > MAX_ITEMS)
+                    throw new Error();
+                const items = raw.map((value) => {
+                    if (!value || typeof value !== "object" || Array.isArray(value))
+                        throw new Error();
+                    const { id, ownerId, createdAt, updatedAt, ...input } = value;
+                    const metadata = metadataSchema.parse({ id, ownerId, createdAt, updatedAt });
+                    return { ...vaultInputSchema.parse(input), ...metadata };
+                });
+                if (new Set(items.map((item) => item.id)).size !== items.length)
+                    throw new Error();
+                return items;
+            }
+            finally {
+                plain.fill(0);
+            }
+        }
+        catch {
+            throw new VaultError("Vault is locked or unreadable.");
+        }
+    }
+    write(items) {
+        const iv = randomBytes(12);
+        const cipher = createCipheriv("aes-256-gcm", this.#key, iv);
+        cipher.setAAD(AAD);
+        const plain = Buffer.from(JSON.stringify(items));
+        try {
+            const encrypted = Buffer.concat([cipher.update(plain), cipher.final()]);
+            const envelope = JSON.stringify({ version: 1, iv: iv.toString("hex"), tag: cipher.getAuthTag().toString("hex"), data: encrypted.toString("base64") });
+            if (Buffer.byteLength(envelope) > MAX_BYTES)
+                throw new VaultError("Vault has reached its size limit.");
+            writeFileAtomic(this.#file, envelope, { mode: 0o600 });
+        }
+        finally {
+            plain.fill(0);
+        }
+    }
+    /** Cross-process writes refuse contention instead of losing an update.
+     * A crash leaves the lock in place for explicit recovery, never guessing
+     * that an older process has stopped writing. */
+    mutate(fn) {
+        const lock = join(this.#directory, "write.lock");
+        try {
+            mkdirSync(this.#directory, { recursive: true, mode: 0o700 });
+        }
+        catch {
+            throw new VaultError("Vault could not be saved.");
+        }
+        try {
+            mkdirSync(lock, { mode: 0o700 });
+        }
+        catch {
+            throw new VaultError("Vault is busy or needs recovery.");
+        }
+        try {
+            const items = this.read();
+            const result = fn(items);
+            this.write(items);
+            return result;
+        }
+        catch (error) {
+            if (error instanceof VaultError)
+                throw error;
+            throw new VaultError("Vault could not be saved.");
+        }
+        finally {
+            rmdirSync(lock);
+        }
+    }
+    list(ownerId) {
+        owner(ownerId);
+        return this.read().filter((item) => item.ownerId === ownerId).map(vaultMetadata);
+    }
+    create(ownerId, input) {
+        owner(ownerId);
+        const parsed = vaultInputSchema.safeParse(input);
+        if (!parsed.success)
+            throw new VaultError("Invalid Vault item.");
+        return this.mutate((items) => {
+            if (items.length >= MAX_ITEMS)
+                throw new VaultError("Vault has reached its item limit.");
+            const now = Date.now();
+            const item = { ...parsed.data, id: randomUUID(), ownerId, createdAt: now, updatedAt: now };
+            items.push(item);
+            return vaultMetadata(item);
+        });
+    }
+    update(ownerId, id, input) {
+        owner(ownerId);
+        if (!input || typeof input !== "object" || Array.isArray(input))
+            throw new VaultError("Invalid Vault item.");
+        return this.mutate((items) => {
+            const index = items.findIndex((item) => item.id === id && item.ownerId === ownerId);
+            const current = items[index];
+            if (!current)
+                throw new VaultError("Vault item is unavailable.");
+            const { id: _id, ownerId: _owner, createdAt: _created, updatedAt: _updated, ...previous } = current;
+            // A blank password is invalid; omission preserves it, so metadata can
+            // be edited without ever reading the saved secret back to the UI.
+            const parsed = vaultInputSchema.safeParse({ ...previous, ...input });
+            if (!parsed.success)
+                throw new VaultError("Invalid Vault item.");
+            if (current.kind !== parsed.data.kind)
+                throw new VaultError("A Vault item's category cannot change.");
+            const item = { ...parsed.data, id, ownerId, createdAt: current.createdAt, updatedAt: Date.now() };
+            items[index] = item;
+            return vaultMetadata(item);
+        });
+    }
+    remove(ownerId, id) {
+        owner(ownerId);
+        this.mutate((items) => {
+            const index = items.findIndex((item) => item.id === id && item.ownerId === ownerId);
+            if (index < 0)
+                throw new VaultError("Vault item is unavailable.");
+            items.splice(index, 1);
+        });
+    }
+}

package/dist-server/shared/desktop-private-port.js

@@ -0,0 +1 @@
+export {};

package/dist-server/shared/engine-choices.js

@@ -295,6 +295,21 @@ export function choiceFor(choices, engine, instanceId, model) {
     }
     return mine.find((choice) => !choice.host) ?? mine[0];
 }
+/** Back to "any account of this provider": the rung names the driver again
+ * (a ladder rung may name a driver kind), keeping the rung's model when the
+ * driver still offers it. When that exact route is already on the ladder,
+ * the driver's first model no rung uses takes its place; undefined when no
+ * free route is left, which leaves the rung unchanged. */
+export function anyAccountEntry(entry, engine, others) {
+    if (!engine)
+        return undefined;
+    const used = (model) => others.some((other) => other.engine === engine.driverKind && other.model === model);
+    const keep = entry.model && engine.models.some((model) => model.id === entry.model) ? entry.model : undefined;
+    if (!used(keep))
+        return keep ? { engine: engine.driverKind, model: keep } : { engine: engine.driverKind };
+    const alternate = engine.models.map((model) => model.id).find((id) => !used(id));
+    return alternate ? { engine: engine.driverKind, model: alternate } : undefined;
+}
 /** Providers with accounts the person should name: brand and how many accounts it has. */
 export function accountsToName(choices) {
     const out = new Map();

package/dist-server/shared/engine-tiers.js

@@ -29,6 +29,77 @@ export function toModelClass(value) {
 /** The class one below, or undefined for Añejo. */
 export const classBelow = (modelClass) => MODEL_CLASSES[MODEL_CLASSES.indexOf(modelClass) + 1];
 export const DEFAULT_CLASS_BANDS = { Mezcal: 50, Plata: 44, Reposado: 38 };
+/** Hand-written ladders, used only when no model has a class yet (the
+ * server always has the bundled baseline, so in practice the generated
+ * ladders below apply). Pay-per-token engines need no rung: they form the
+ * automatic last band of every ladder (resolveLadder).
+ *
+ * Erick's own ladders (2026-10-25), each per-install instance id
+ * ("claude-<uuid>") reduced to its driver kind so a fresh install matches
+ * whatever account it has (matchesEngine); the exact engine+model
+ * duplicates that collapse created are dropped. */
+export const DEFAULT_LADDERS = {
+    orchestrator: [
+        { engine: "claudeAgent", model: "claude-opus-5-5", modelClass: "Plata" },
+        { engine: "codex", model: "gpt-6-sol" },
+        { engine: "opencodeGo", model: "opencode-go/gemini-4-argon" },
+        { engine: "hermes", model: "nous:x-ai/grok-4.6" },
+        { engine: "ollamaCloud", model: "glm-5.3" },
+        { engine: "museCode", model: "muse-spark-1.2" },
+        { engine: "hermesAgent", model: "openai-codex:gpt-6-sol", modelClass: "Plata" },
+        { engine: "antigravity", model: "gemini-3.8-flash-medium" },
+        { engine: "cursorAgent", model: "auto" },
+        { engine: "hermesAgent", model: "huggingface:deepseek-ai/DeepSeek-R1-0528", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "opencode-go:deepseek-v4-flash", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "deepinfra:anthropic/claude-opus-5", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "nous:meta/muse-spark-1.3", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "openrouter:openai/gpt-6-sol", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "openai-codex:gpt-6.1-sol", modelClass: "Plata" },
+    ],
+    engineering: [
+        { engine: "codex", model: "gpt-6-astra", modelClass: "Mezcal" },
+        { engine: "claude", model: "claude-opus-5-5" },
+        { engine: "claudeAgent", model: "claude-opus-5-5" },
+        { engine: "opencodeGo", model: "opencode-go/gemini-4-argon" },
+        { engine: "ollamaCloud", model: "kimi-k3" },
+        { engine: "hermesAgent", model: "openai-codex:gpt-6-astra", modelClass: "Mezcal" },
+        { engine: "grok", model: "grok-4.7" },
+        { engine: "grokAgent", model: "grok-4.7" },
+        { engine: "kimi", model: "kimi-code/k3" },
+        { engine: "openai-compat", model: "qwen3.7-plus" },
+        { engine: "hermesAgent", model: "nous:anthropic/claude-opus-5.5" },
+        { engine: "hermesAgent", model: "opencode-zen:claude-fable-5-1", modelClass: "Mezcal" },
+        { engine: "cursorAgent", model: "auto" },
+    ],
+    research: [
+        { engine: "openai-compat", model: "MiniMax-M2.5" },
+        { engine: "vibe", model: "mistral-medium-3.5" },
+        { engine: "antigravityAgent", model: "gemini-3.8-flash-low" },
+        { engine: "cursorAgent", model: "auto" },
+        { engine: "hermesAgent", model: "openrouter:x-ai/grok-4.7", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "custom:local-(localhost:11434):deepseek-v4-pro:cloud" },
+        { engine: "hermesAgent", model: "openrouter:meta/muse-spark-1.3", modelClass: "Plata" },
+        { engine: "hermesAgent", model: "opencode-zen:muse-spark-1.3", modelClass: "Plata" },
+        { engine: "claudeAgent", model: "claude-opus-5", modelClass: "Plata" },
+        { engine: "cursorAgent", model: "claude-opus-5-high", modelClass: "Plata" },
+        { engine: "opencodeGo", model: "opencode/claude-opus-5", modelClass: "Plata" },
+    ],
+    writing: [
+        { engine: "claudeAgent", model: "claude-sonnet-5-5" },
+        { engine: "claude", model: "claude-sonnet-5-5" },
+        { engine: "codex", model: "gpt-5.6-luna" },
+        { engine: "antigravity", model: "gemini-3.8-flash-high" },
+        { engine: "antigravityAgent", model: "gemini-3.8-flash-high" },
+        { engine: "hermes", model: "nous:moonshotai/kimi-k3" },
+    ],
+    routine: [
+        { engine: "antigravityAgent", model: "gemini-3.8-flash-low" },
+        { engine: "antigravity", model: "gemini-3.8-flash-low" },
+        { engine: "openai-compat", model: "MiniMax-M2.5" },
+        { engine: "cursor", model: "auto" },
+        { engine: "mistral", model: "mistral-medium", modelClass: "Añejo" },
+    ],
+};
 export function classForScore(score, bands = DEFAULT_CLASS_BANDS) {
     if (score >= bands.Mezcal)
         return "Mezcal";
@@ -45,9 +116,10 @@ export const DEFAULT_TIER_CLASSES = {
     // puts Claude's rungs first in its ladder.
     orchestrator: "Plata",
     engineering: "Mezcal",
-    research: "Plata",
+    // Research and Routine ask for the cheapest class (Erick, 2026-10-25).
+    research: "Añejo",
     writing: "Plata",
-    routine: "Reposado",
+    routine: "Añejo",
 };
 /** A person's class choice at an API boundary: a class, or null for
  * "Automatic (by tier)"; undefined when the value is neither. */

package/dist-server/shared/local-models.js

@@ -53,9 +53,7 @@ export const LIGHT_LOCAL_MODEL = "gemma4:e2b-it-qat";
 const SIXTEEN_GB = 15.5 * GB;
 const EIGHT_GB = 7.5 * GB;
 export function recommendLocalModel(machine) {
-    if (machine.platform !== "darwin")
-        return { kind: "none", reason: "notMac" };
-    if (machine.arch !== "arm64")
+    if (machine.platform === "darwin" && machine.arch !== "arm64")
         return { kind: "none", reason: "intel" };
     const model = (tag) => SUGGESTED_LOCAL_MODELS.find((entry) => entry.tag === tag);
     if (machine.memoryBytes >= SIXTEEN_GB)

package/dist-server/shared/personal-goal.js

@@ -0,0 +1,43 @@
+export function parseGoalCommand(text) {
+    const match = /^\/goal(?:\s+([\s\S]*))?$/i.exec(text.trim());
+    if (!match)
+        return null;
+    let rest = (match[1] ?? "").trim();
+    const action = /^(status|pause|resume|stop|help)(?:\s|$)/i.exec(rest);
+    if (action)
+        rest = rest.slice(action[0].length).trim();
+    let maxTurns;
+    let tokenBudget;
+    const criteria = [];
+    while (rest.startsWith("--")) {
+        const flag = /^--(turns|tokens|done)\s+(?:"([^"\n]+)"|'([^'\n]+)'|(\S+))(?:\s|$)/.exec(rest);
+        if (!flag)
+            throw new Error('Use --turns N, --tokens N, or --done "completion criterion" before the objective.');
+        const value = flag[2] ?? flag[3] ?? flag[4];
+        if (flag[1] === "done")
+            criteria.push(value);
+        else {
+            const number = Number(value);
+            if (!/^\d+$/.test(value) || !Number.isSafeInteger(number) || number < 1 || (flag[1] === "turns" && number > 1000)) {
+                throw new Error("Budgets must be positive whole numbers; the turn limit cannot exceed 1000.");
+            }
+            if (flag[1] === "turns")
+                maxTurns = number;
+            else
+                tokenBudget = number;
+        }
+        rest = rest.slice(flag[0].length).trim();
+    }
+    if (action) {
+        if (rest || criteria.length || (action[1].toLowerCase() !== "resume" && (maxTurns || tokenBudget))) {
+            throw new Error("Only /goal resume accepts --turns and --tokens; other controls take no arguments.");
+        }
+        return { action: action[1].toLowerCase(), maxTurns, tokenBudget };
+    }
+    if (!rest)
+        return { action: "help" };
+    if (rest.length > 20_000 || criteria.length > 20 || criteria.some((item) => item.length > 2000))
+        throw new Error("Goal or completion criteria are too long.");
+    return { action: "start", objective: rest, maxTurns: maxTurns ?? 20, tokenBudget, criteria };
+}
+export const GOAL_HELP = 'Start: /goal [--turns 20] [--tokens N] [--done "criterion"] objective\nControls: /goal status, /goal pause, /goal resume [--turns N] [--tokens N], /goal stop. Resume budgets are total ceilings, not additional allowances. Token limits are checked between turns; a running turn can exceed the limit.';

package/dist-server/shared/subscription-bots.js

@@ -88,6 +88,9 @@ export function subscriptionProviderForEngine(engine) {
 export function isProviderModel(provider, model) {
     return provider.ownModels ? provider.ownModels.test(model) : true;
 }
+/** Turns one conversation of a company subscription bot may run on another
+ * provider's subscription when its own has no account free (server/session-fallback.ts). */
+export const SESSION_FALLBACK_TURNS = 50;
 export function isSubscriptionBot(bot) {
     const value = bot?.subscription;
     return Boolean(value && typeof value.instanceId === "string" && subscriptionProvider(value.provider));

package/dist-server/shared/vault.js

@@ -0,0 +1,59 @@
+import { z } from "zod";
+/** Only absolute HTTPS origins can receive a saved item. Paths never broaden
+ * authority to sibling domains, frames, ports or subdomains. */
+export function vaultOrigin(raw) {
+    if (raw.length > 2048 || [...raw].some((c) => c.charCodeAt(0) <= 32 || c.charCodeAt(0) === 127) || raw.includes("\\"))
+        return null;
+    try {
+        const url = new URL(raw);
+        if (url.protocol !== "https:" || !url.hostname || url.username || url.password || url.hostname.endsWith("."))
+            return null;
+        return url.origin;
+    }
+    catch {
+        return null;
+    }
+}
+const text = (max) => z.string().max(max);
+const origin = z.string().refine((value) => vaultOrigin(value) !== null).transform((value) => vaultOrigin(value));
+const address = z.object({
+    name: text(200), line1: text(300), line2: text(300), city: text(200),
+    region: text(200), postalCode: text(40), country: text(100),
+}).strict();
+const base = {
+    label: z.string().trim().min(1).max(200), hints: text(1000),
+    botIds: z.array(z.string().uuid()).max(100).refine((ids) => new Set(ids).size === ids.length),
+    expiresAt: z.number().int().positive().max(Number.MAX_SAFE_INTEGER).nullable(),
+};
+/** Reject unknown fields rather than accidentally persisting secrets in
+ * metadata. CVC is deliberately absent: it belongs to a single secure use. */
+export const vaultInputSchema = z.discriminatedUnion("kind", [
+    z.object({ ...base, kind: z.literal("login"), website: origin,
+        username: z.string().min(1).max(320), password: z.string().min(1).max(4096),
+    }).strict(),
+    z.object({ ...base, kind: z.literal("card"), origins: z.array(origin).min(1).max(50),
+        number: z.string().regex(/^\d{12,19}$/), expiryMonth: z.number().int().min(1).max(12),
+        expiryYear: z.number().int().min(2000).max(9999), billing: address,
+    }).strict(),
+    z.object({ ...base, kind: z.literal("contact"), origins: z.array(origin).min(1).max(50),
+        address, email: z.union([z.literal(""), z.string().email().max(320)]), phone: text(80),
+    }).strict(),
+]);
+/** Explicit allowlist. Never spread a stored item into a response. */
+export function vaultMetadata(item) {
+    return {
+        id: item.id, kind: item.kind, label: item.label, hints: item.hints,
+        botIds: [...item.botIds], expiresAt: item.expiresAt,
+        origins: item.kind === "login" ? [item.website] : [...item.origins],
+        ...(item.kind === "login" ? { username: item.username } : {}),
+        ...(item.kind === "card" ? { lastFour: item.number.slice(-4), expiryMonth: item.expiryMonth, expiryYear: item.expiryYear, billing: { ...item.billing } } : {}),
+        ...(item.kind === "contact" ? { address: { ...item.address }, email: item.email, phone: item.phone } : {}),
+        createdAt: item.createdAt, updatedAt: item.updatedAt,
+    };
+}
+export function vaultUseAllowed(item, actor, now) {
+    const destination = vaultOrigin(actor.destination);
+    return Number.isSafeInteger(now) && now >= 0 && item.ownerId === actor.ownerId && item.botIds.includes(actor.botId)
+        && (item.expiresAt === null || now < item.expiresAt) && destination !== null
+        && (item.kind === "login" ? item.website === destination : item.origins.includes(destination));
+}

package/dist-server/vps-container-mcp.js

@@ -1016,9 +1016,12 @@ function runMcpBridge(options) {
 
 // server/container-computer.ts
 import { execFile as execFile3 } from "node:child_process";
-import { dirname as dirname4, join as join5, resolve, win32 as win323 } from "node:path";
+import { dirname as dirname4, join as join5, resolve } from "node:path";
 import { promisify } from "node:util";
 
+// server/colima-docker.ts
+var COLIMA_START_TIMEOUT_MS = 4 * 6e4;
+
 // server/config.ts
 import { homedir as homedir2 } from "node:os";
 import { join as join3 } from "node:path";
@@ -17187,7 +17190,6 @@ var CUA_SOCKET = "/run/user/1000/openmausbot-cua.sock";
 var CUA_EXECUTABLE = "/usr/local/libexec/openmausbot/cua-driver";
 var MEMORY_BYTES = 4 * 1024 * 1024 * 1024;
 var SHM_BYTES = 512 * 1024 * 1024;
-var COLIMA_START_TIMEOUT_MS = 4 * 6e4;
 function cuaExecArgs(args2, options = {}) {
   return [
     "exec",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@chibitek/chibi",
-  "version": "0.1.155",
+  "version": "0.1.158",
   "description": "Atomic by Chibitek: run your AI team's server anywhere and pair your devices to it",
   "license": "Apache-2.0",
   "type": "module",

package/dist/assets/channel-GBaPOaz-.js

@@ -1 +0,0 @@
-import{U as a,C as n}from"./mermaid.core-Sn2sv0Ti.js";const t=(r,o)=>a.lang.round(n.parse(r)[o]);export{t as c};