@gajae-code/coding-agent 0.11.11 → 0.12.1

package/src/web/search/providers/searxng.ts

@@ -25,7 +25,9 @@
  * Reference: https://docs.searxng.org/dev/search_api.html
  */
 
+import * as path from "node:path";
 import type { AuthStorage } from "@gajae-code/ai";
+import { $credentialEnv, parseEnvFile } from "@gajae-code/utils";
 
 import { settings } from "../../../config/settings";
 import type { SearchResponse, SearchSource } from "../../../web/search/types";
@@ -74,6 +76,47 @@ interface SearXNGAuth {
 }
 
 /** Find SearXNG endpoint from settings or environment. */
+/**
+ * SearXNG environment value, from trusted sources only, preserving an
+ * intentionally empty setting.
+ *
+ * These four names decide where search requests go and what credential they
+ * carry, and `$env` merges the caller's `cwd/.env` into `process.env`, so a
+ * repository could otherwise redirect the search and hand over the basic-auth
+ * material.
+ *
+ * `$credentialEnv` is the resolver for that boundary, but it collapses an empty
+ * value to `undefined` — and SearXNG basic auth treats "set but empty" as
+ * meaningful (`alice:` and `:s3cret` are both valid). So an empty value is
+ * recovered explicitly, and only when the project `.env` is not what set it.
+ */
+function trustedSearxngEnv(name: string): string | null {
+	const trusted = $credentialEnv(name);
+	if (trusted !== undefined) return trusted;
+
+	const raw = process.env[name];
+	if (raw === undefined || raw.trim().length > 0) return null;
+	// Empty-but-set. Honour it unless the project `.env` is the source.
+	const projectValue = parseEnvFile(path.join(process.cwd(), ".env"))[name];
+	if (projectValue !== undefined && projectValue.trim().length === 0) return null;
+	return "";
+}
+
+/** Test seam: the SearXNG endpoint and auth material as resolved from trusted env. */
+export function resolveSearxngConfigForTest(): {
+	endpoint: string | null;
+	token: string | null;
+	basicUsername: string | null;
+	basicPassword: string | null;
+} {
+	return {
+		endpoint: findEndpoint(),
+		token: findToken(),
+		basicUsername: findBasicUsername(),
+		basicPassword: findBasicPassword(),
+	};
+}
+
 function findEndpoint(): string | null {
 	try {
 		const endpoint = settings.get("searxng.endpoint");
@@ -81,7 +124,7 @@ function findEndpoint(): string | null {
 	} catch {
 		// Settings not initialized yet
 	}
-	return process.env.SEARXNG_ENDPOINT ?? null;
+	return trustedSearxngEnv("SEARXNG_ENDPOINT");
 }
 
 /** Find SearXNG bearer token from settings or environment. */
@@ -92,7 +135,7 @@ function findToken(): string | null {
 	} catch {
 		// Settings not initialized yet
 	}
-	return process.env.SEARXNG_TOKEN ?? null;
+	return trustedSearxngEnv("SEARXNG_TOKEN");
 }
 
 /** Find SearXNG Basic auth username from settings or environment. */
@@ -103,7 +146,7 @@ function findBasicUsername(): string | null {
 	} catch {
 		// Settings not initialized yet
 	}
-	return process.env.SEARXNG_BASIC_USERNAME ?? null;
+	return trustedSearxngEnv("SEARXNG_BASIC_USERNAME");
 }
 
 /** Find SearXNG Basic auth password from settings or environment. */
@@ -114,7 +157,7 @@ function findBasicPassword(): string | null {
 	} catch {
 		// Settings not initialized yet
 	}
-	return process.env.SEARXNG_BASIC_PASSWORD ?? null;
+	return trustedSearxngEnv("SEARXNG_BASIC_PASSWORD");
 }
 
 /** Build the RFC 7617 Basic auth credential using UTF-8 bytes. */

package/src/web/search/providers/xai.ts

@@ -5,7 +5,7 @@
  * Endpoint: POST https://api.x.ai/v1/responses
  */
 import type { AuthStorage } from "@gajae-code/ai";
-import { $env } from "@gajae-code/utils";
+import { $credentialEnv, $env } from "@gajae-code/utils";
 import type { SearchCitation, SearchResponse, SearchSource, SearchUsage } from "../../../web/search/types";
 import { SearchProviderError } from "../../../web/search/types";
 import type { SearchParams } from "./base";
@@ -71,8 +71,13 @@ function getModel(): string {
 	return asTrimmed($env.PI_XAI_WEB_SEARCH_MODEL) ?? asTrimmed($env.XAI_WEB_SEARCH_MODEL) ?? DEFAULT_MODEL;
 }
 
+/** Test seam: the xAI search base URL as resolved from trusted env. */
+export function resolveXaiSearchBaseUrlForTest(): string {
+	return getBaseUrl();
+}
+
 function getBaseUrl(): string {
-	return asTrimmed($env.XAI_SEARCH_BASE_URL) ?? DEFAULT_BASE_URL;
+	return asTrimmed($credentialEnv("XAI_SEARCH_BASE_URL")) ?? DEFAULT_BASE_URL;
 }
 
 function responsesEndpoint(): string {

package/dist/types/gjc-runtime/deep-interview-draft.d.ts

@@ -1,8 +0,0 @@
-import { type DeepInterviewDraftKind } from "./deep-interview-payload";
-export interface DeepInterviewDraftResult {
-    status: number;
-    stdout?: string;
-    stderr?: string;
-}
-export declare function runDeepInterviewDraftCommand(input: readonly string[], cwd: string): Promise<DeepInterviewDraftResult>;
-export declare function runDeepInterviewDraftInternalConsumeCommand(draftId: string, expectedDraftRevision: number, kind: DeepInterviewDraftKind, cwd: string): Promise<DeepInterviewDraftResult>;

package/dist/types/gjc-runtime/deep-interview-payload.d.ts

@@ -1,41 +0,0 @@
-import type { DeepInterviewRoundResultV1 } from "./deep-interview-state";
-export declare const DEEP_INTERVIEW_DRAFT_KINDS: readonly ["initialize-context", "confirm-topology", "record-answer", "apply-round-result"];
-export type DeepInterviewDraftKind = (typeof DEEP_INTERVIEW_DRAFT_KINDS)[number];
-export type DeepInterviewDraftPayload = Record<string, unknown>;
-export type DraftScalarType = "string" | "id" | "text" | "score" | "number" | "safe-int" | "boolean" | "enum";
-export interface DraftLeafDescriptor {
-    kind: "leaf";
-    type: DraftScalarType;
-    nullable?: boolean;
-    maxBytes?: number;
-    values?: readonly string[];
-    optional?: boolean;
-    dynamicMapValue?: boolean;
-}
-export interface DraftObjectDescriptor {
-    kind: "object";
-    fields: Record<string, DraftDescriptor>;
-    optional?: boolean;
-    dynamicMapValue?: boolean;
-    dynamicValue?: DraftLeafDescriptor;
-}
-export interface DraftArrayDescriptor {
-    kind: "array";
-    item: DraftLeafDescriptor | DraftObjectDescriptor;
-    maxItems: number;
-    optional?: boolean;
-}
-export type DraftDescriptor = DraftLeafDescriptor | DraftObjectDescriptor | DraftArrayDescriptor;
-export declare function deepInterviewDraftSchema(kind: DeepInterviewDraftKind): DraftObjectDescriptor;
-/** Shared strict payload decoders used by compatibility JSON and CLI-owned drafts. */
-export declare function decodeInitializeContextPayload(payload: unknown): Record<string, unknown>;
-export declare function decodeConfirmTopologyPayload(payload: unknown): Record<string, unknown>;
-export declare function decodeRecordAnswerPayload(payload: unknown): {
-    question: string;
-    answer: {
-        selected_options: string[];
-        custom_input: string | null;
-    };
-};
-export declare function decodeApplyRoundResultPayload(payload: unknown, state: Record<string, unknown>): DeepInterviewRoundResultV1;
-export declare function validateDraftPayload(kind: DeepInterviewDraftKind, payload: unknown, state?: Record<string, unknown>): void;

package/dist/types/gjc-runtime/deep-interview-repair.d.ts

@@ -1,17 +0,0 @@
-import { type DeepInterviewRoundResultV1 } from "./deep-interview-state";
-export interface DeepInterviewRepairResult {
-    status: number;
-    stdout?: string;
-    stderr?: string;
-}
-export declare const DEEP_INTERVIEW_REPAIR_VERBS: readonly ["initialize-context", "confirm-topology", "record-answer", "apply-round-result", "inspect", "sanity-check"];
-export type DeepInterviewRepairVerb = (typeof DEEP_INTERVIEW_REPAIR_VERBS)[number];
-export declare function isDeepInterviewRepairVerb(value: string): value is DeepInterviewRepairVerb;
-export declare function decodeDeepInterviewAnswerJson(value: unknown): {
-    selected_options: string[];
-    custom_input: string | null;
-};
-export declare function decodeDeepInterviewRoundResultJson(value: unknown, state: Record<string, unknown>): DeepInterviewRoundResultV1;
-export declare function decodeDeepInterviewSetupJson(value: unknown): Record<string, unknown>;
-export declare function decodeDeepInterviewTopologyJson(value: unknown): Record<string, unknown>;
-export declare function runDeepInterviewRepairCommand(args: readonly string[], cwd: string): Promise<DeepInterviewRepairResult>;

package/dist/types/gjc-runtime/ultragoal-pipeline.d.ts

@@ -1,23 +0,0 @@
-import { type JsonObject, type UltragoalGoal, type UltragoalPipelineOverlapReceipt, type UltragoalPlan } from "./ultragoal-runtime";
-export declare function requirePipelineStartable(plan: UltragoalPlan, prior: UltragoalGoal, next: UltragoalGoal): void;
-export declare function startUltragoalPipelineOverlap(input: {
-    cwd: string;
-    priorGoalId: string;
-    nextGoalId: string;
-    reviewHandles: JsonObject | JsonObject[];
-    qaHandles: JsonObject | JsonObject[];
-    implementationHandle: JsonObject;
-}): Promise<UltragoalPipelineOverlapReceipt>;
-export declare function joinUltragoalPipelineOverlap(input: {
-    cwd: string;
-    overlapId: string;
-    reviewResult: JsonObject;
-    qaResult: JsonObject;
-}): Promise<UltragoalPipelineOverlapReceipt>;
-export declare function rebaselineUltragoalPipelineOverlap(input: {
-    cwd: string;
-    overlapId: string;
-    goalId: string;
-    evidence: string;
-    targetState: JsonObject;
-}): Promise<UltragoalPipelineOverlapReceipt>;

package/src/defaults/gjc/skills/ultragoal/pipeline-validation-contracts.md

@@ -1,30 +0,0 @@
-# Ultragoal Pipeline & Validation-Batch Contracts Fragment
-
-Internal Ultragoal sub-skill fragment (`kind: "skill-fragment"`, parent skill `ultragoal`, installed at `skill-fragments/ultragoal/pipeline-validation-contracts.md`). The Ultragoal leader loads it on demand before operating a pipeline overlap or checkpointing a validation-batch member; it is never user-facing, not slash-command discoverable, and never resolvable through `skill://`. The runtime enforces every rule below verbatim and fails closed.
-
-## Runtime-backed pipeline overlap lifecycle
-
-Use the lifecycle commands exactly when runtime metadata proves safety:
-
-```sh
-gjc ultragoal start-pipeline-overlap --prior-goal-id G001 --next-goal-id G002 --review-handles-json '<json>' --qa-handles-json '<json>' --implementation-handle-json '<json>' --json
-gjc ultragoal join-pipeline-overlap --overlap-id <id> --review-result-json '<json>' --qa-result-json '<json>' --json
-gjc ultragoal rebaseline-pipeline-overlap --overlap-id <id> --goal-id G002 --evidence "<evidence>" --target-state-json '<json>' --json
-```
-
-Runtime-backed pipelining is deliberately narrow:
-
-- At most one eligible next goal may overlap the current goal's review/QA join window.
-- G(N) remains active until `join-pipeline-overlap` records a clean join; do not checkpoint G(N) complete before clean join evidence exists.
-- `start-pipeline-overlap` must fail closed for missing metadata, one-sided independence, shared target files/surfaces, stale metadata hashes, missing handles, another open overlap, or per-story mode.
-- `join-pipeline-overlap` must fail closed for missing lane evidence or unresolved blockers. Continue G(N+1) only when structured blocker footprints are disjoint from G(N+1) targets; otherwise quarantine and re-baseline with `rebaseline-pipeline-overlap` before G(N+1) can complete.
-- Complete checkpoints must fail closed for open overlaps, missing clean joins, stale metadata, quarantined next goals, shared or unattributable change-set paths, and any missing pipeline evidence.
-- After a crash or lost live handles, the leader reruns review/QA lanes and joins with replacement evidence when metadata hashes still match; otherwise quarantine and re-baseline. Ultragoal must not auto-start G(N+2) during recovery.
-
-## Validation-batch checkpoint contract
-
-- **Non-final members** checkpoint `complete` with a single top-level `deferredToBatch` quality gate (kind `validation-batch-deferred`): targeted verification, ai-slop-cleaner pass, and a rerun iteration, plus a cumulative-since-base change set. A `deferredToBatch` gate must NOT contain `architectReview`, `executorQa`, or `validationBatchClose` — deferring never manufactures fake review approvals.
-- **The final member** (`finalGoalId`) checkpoints `complete` with the normal full strict gate PLUS a top-level `validationBatchClose` proof that covers all member IDs, member metadata hashes, member receipt/checkpoint-ledger-event IDs, per-member change-set hashes, and union change-set coverage. The final close only starts once every non-final member is already `complete` with a structurally fresh deferred receipt (out-of-order close is rejected).
-- Close state is append-only proof: it lives in the final member's checkpoint receipt and matching `goal_checkpointed` ledger row only. Never stamp `closedReceiptId`/`closedAt` or any close-state field onto member goals, and never append a separate close ledger event.
-- Change sets are cumulative-since-base: each member's `changeSet.paths` is the whole-worktree diff vs base (`cumulativeFromBase: true`), `memberGoalId` is a label not a per-path attribution, and `unionChangeSet.paths` carries no per-goal attribution.
-- Batch invalidation is fail-closed: steering mutations that would invalidate a batch are rejected while any member holds a fresh deferred receipt.