@gajae-code/coding-agent 0.18.11 → 0.19.0

package/src/tools/report-issue.ts

@@ -0,0 +1,184 @@
+/**
+ * `report_issue` — local auto-QA for tool behavior.
+ *
+ * The model records a tool whose output contradicts that tool's own
+ * description. Reports are appended to a local SQLite database
+ * (`~/.gjc/tool-issues.db`); nothing leaves the machine. Inspect them with the
+ * read tool's SQLite support, e.g.
+ * `gjc read '~/.gjc/tool-issues.db?q=SELECT tool, count(*) FROM tool_issues GROUP BY tool'`.
+ *
+ * Inspired by oh-my-pi's `xd://report_issue` auto-QA device; collector push
+ * and consent prompts are intentionally not part of this local-only port.
+ */
+import { Database } from "bun:sqlite";
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import type { AgentTool, AgentToolResult } from "@gajae-code/agent-core";
+import { getToolIssuesDbPath, logger, prompt, VERSION } from "@gajae-code/utils";
+import * as z from "zod/v4";
+import reportIssueDescription from "../prompts/tools/report-issue.md" with { type: "text" };
+import type { ToolSession } from "./index";
+import { ToolError } from "./tool-errors";
+
+/** Upper bound on the stored tool name, in UTF-8 bytes. */
+const MAX_TOOL_BYTES = 128;
+/** Upper bound on the stored report body, in characters. */
+const MAX_REPORT_CHARS = 4_000;
+
+const reportIssueSchema = z.object({
+	tool: z.string().describe("name of the tool that misbehaved"),
+	report: z.string().describe("what was called, what was expected, what happened"),
+});
+
+export type ReportIssueToolInput = z.infer<typeof reportIssueSchema>;
+
+export interface ReportIssueToolDetails {
+	recorded: boolean;
+	tool: string;
+}
+
+export interface ToolIssueEntry {
+	tool: string;
+	report: string;
+	model: string | null;
+	sessionId: string | null;
+}
+
+/**
+ * Open the database for a single report. Reports are rare, so no connection is cached: a file the
+ * user deleted is recreated on the next report, and no handle keeps the file locked between reports.
+ */
+async function openToolIssueDb(dbPath: string): Promise<Database> {
+	// Only a directory created here gets 0700; an existing shared config/data root keeps its mode.
+	await fs.mkdir(path.dirname(dbPath), { recursive: true, mode: 0o700 });
+	// Create (or tighten) the database file before SQLite opens it. SQLite's unix VFS creates the
+	// WAL/SHM sidecars with the main file's permissions, so they are private from their first byte.
+	const handle = await fs.open(dbPath, "a", 0o600);
+	try {
+		if (process.platform !== "win32") await handle.chmod(0o600);
+	} finally {
+		await handle.close();
+	}
+	const db = new Database(dbPath);
+	try {
+		db.run(`
+			PRAGMA busy_timeout=5000;
+			PRAGMA journal_mode=WAL;
+			CREATE TABLE IF NOT EXISTS tool_issues (
+				id          INTEGER PRIMARY KEY AUTOINCREMENT,
+				created_at  TEXT    NOT NULL DEFAULT (strftime('%Y-%m-%dT%H:%M:%fZ', 'now')),
+				tool        TEXT    NOT NULL,
+				report      TEXT    NOT NULL,
+				model       TEXT,
+				gjc_version TEXT    NOT NULL,
+				session_id  TEXT
+			);
+			CREATE INDEX IF NOT EXISTS idx_tool_issues_tool_created ON tool_issues(tool, created_at);
+		`);
+	} catch (error) {
+		db.close();
+		throw error;
+	}
+	return db;
+}
+
+function truncateUtf8(text: string, maxBytes: number): string {
+	const bytes = Buffer.from(text, "utf8");
+	if (bytes.length <= maxBytes) return text;
+	// Decoding a cut multi-byte sequence yields U+FFFD; drop it.
+	return bytes
+		.subarray(0, maxBytes)
+		.toString("utf8")
+		.replace(/\uFFFD+$/u, "");
+}
+
+/**
+ * Truncate text by complete Unicode code points, avoiding incomplete surrogate pairs.
+ * JavaScript strings use UTF-16 encoding, where astral characters use two code units
+ * (high surrogate + low surrogate). We must count actual code points, not UTF-16 code units.
+ */
+function truncateByCodePoint(text: string, maxChars: number): string {
+	let codePointCount = 0;
+	let result = "";
+	// Iterate through actual code points using for-of, which handles surrogate pairs correctly
+	for (const codePoint of text) {
+		if (codePointCount >= maxChars) break;
+		result += codePoint;
+		codePointCount++;
+	}
+	return result;
+}
+
+function codePointLength(text: string): number {
+	let count = 0;
+	for (const _ of text) count++;
+	return count;
+}
+
+/** Normalize and clamp a report to the stored field limits. */
+export function normalizeToolIssue(tool: string, report: string): { tool: string; report: string } {
+	const normalizedTool = truncateUtf8(tool.trim(), MAX_TOOL_BYTES);
+	const trimmedReport = report.trim();
+	const normalizedReport =
+		codePointLength(trimmedReport) > MAX_REPORT_CHARS
+			? `${truncateByCodePoint(trimmedReport, MAX_REPORT_CHARS - 1)}…`
+			: trimmedReport;
+	return { tool: normalizedTool, report: normalizedReport };
+}
+
+/** Append one report to the tool-issue database at `dbPath`. */
+export async function recordToolIssue(dbPath: string, entry: ToolIssueEntry): Promise<void> {
+	const db = await openToolIssueDb(dbPath);
+	try {
+		db.run("INSERT INTO tool_issues (tool, report, model, gjc_version, session_id) VALUES (?, ?, ?, ?, ?)", [
+			entry.tool,
+			entry.report,
+			entry.model,
+			VERSION,
+			entry.sessionId,
+		]);
+	} finally {
+		db.close();
+	}
+}
+
+export class ReportIssueTool implements AgentTool<typeof reportIssueSchema, ReportIssueToolDetails> {
+	readonly name = "report_issue";
+	readonly label = "Report Issue";
+	readonly loadMode = "essential" as const;
+	readonly description = prompt.render(reportIssueDescription);
+	readonly parameters = reportIssueSchema;
+	readonly strict = true;
+	readonly intent = "omit" as const;
+	readonly #session: ToolSession;
+	readonly #dbPath: string;
+
+	constructor(session: ToolSession, dbPath: string = getToolIssuesDbPath()) {
+		this.#session = session;
+		this.#dbPath = dbPath;
+	}
+
+	async execute(_toolCallId: string, params: ReportIssueToolInput): Promise<AgentToolResult<ReportIssueToolDetails>> {
+		const { tool, report } = normalizeToolIssue(params.tool, params.report);
+		if (!tool) throw new ToolError("tool must name the tool that misbehaved.");
+		if (!report) throw new ToolError("report must describe the unexpected behavior.");
+		try {
+			await recordToolIssue(this.#dbPath, {
+				tool,
+				report,
+				model: this.#session.getActiveModelString?.() ?? null,
+				sessionId: this.#session.getSessionId?.() ?? null,
+			});
+		} catch (error) {
+			logger.warn("report_issue: failed to record tool issue", { error: String(error), dbPath: this.#dbPath });
+			return {
+				content: [{ type: "text", text: "Report could not be stored locally; continue the task." }],
+				details: { recorded: false, tool },
+			};
+		}
+		return {
+			content: [{ type: "text", text: "Recorded. Continue the task." }],
+			details: { recorded: true, tool },
+		};
+	}
+}

package/src/tools/search.ts

@@ -19,6 +19,7 @@ import {
 	openArchive,
 	parseArchivePathCandidates,
 } from "./archive-reader";
+import { wrapUntrustedContent } from "./fetch";
 import { createFileRecorder, formatResultPath } from "./file-recorder";
 import { formatGroupedFiles } from "./grouped-file-output";
 import { formatMatchLine } from "./match-line-format";
@@ -552,7 +553,7 @@ export class SearchTool implements AgentTool<typeof searchSchema, SearchToolDeta
 						missingPaths: missingPaths.length > 0 ? missingPaths : undefined,
 					};
 					const text = warningNote ? `No matches found\n${warningNote}` : "No matches found";
-					const noMatchResult = toolResult(details).text(text).done();
+					const noMatchResult = toolResult(details).text(wrapUntrustedContent(text)).done();
 					await cleanupArchiveScratch();
 					throwIfSearchCancelled();
 					return noMatchResult;
@@ -676,7 +677,7 @@ export class SearchTool implements AgentTool<typeof searchSchema, SearchToolDeta
 				if (truncation.truncated) details.truncation = truncation;
 				if (linesTruncated) details.linesTruncated = true;
 				const resultBuilder = toolResult(details)
-					.text(output)
+					.text(wrapUntrustedContent(output))
 					.limits({ columnMax: linesTruncated ? DEFAULT_MAX_COLUMN : undefined });
 				if (truncation.truncated) {
 					resultBuilder.truncation(truncation, { direction: "head" });

package/src/tools/ssh.ts

@@ -5,18 +5,35 @@ import { prompt } from "@gajae-code/utils";
 import * as z from "zod/v4";
 import type { SSHHost } from "../capability/ssh";
 import { sshCapability } from "../capability/ssh";
+import { getDefault, type Settings } from "../config/settings";
 import { loadCapability } from "../discovery";
 import type { RenderResultOptions } from "../extensibility/custom-tools/types";
 import type { Theme } from "../modes/theme/theme";
 import sshDescriptionBase from "../prompts/tools/ssh.md" with { type: "text" };
-import { DEFAULT_MAX_BYTES, streamTailUpdates, TailBuffer } from "../session/streaming-output";
+import type { SessionArtifactPublication } from "../session/session-manager";
+import {
+	DEFAULT_MAX_BYTES,
+	streamTailUpdates,
+	TailBuffer,
+	type TerminalArtifactPublisher,
+	type TruncationResult,
+	truncateMiddle,
+	truncateMiddleWindows,
+	truncateTail,
+} from "../session/streaming-output";
 import type { SSHHostInfo } from "../ssh/connection-manager";
 import { ensureHostInfo, getHostInfoForHost } from "../ssh/connection-manager";
-import { executeSSH } from "../ssh/ssh-executor";
+import { executeSSH, type SSHResult } from "../ssh/ssh-executor";
 import { renderStatusLine } from "../tui";
 import { CachedOutputBlock } from "../tui/output-block";
 import type { ToolSession } from ".";
-import { formatStyledTruncationWarning, type OutputMeta, stripOutputNotice } from "./output-meta";
+import { wrapUntrustedContent } from "./fetch";
+import {
+	formatArtifactReference,
+	formatStyledTruncationWarning,
+	type OutputMeta,
+	stripOutputNotice,
+} from "./output-meta";
 import { ToolError } from "./tool-errors";
 import { toolResult } from "./tool-result";
 import { clampTimeout } from "./tool-timeouts";
@@ -89,6 +106,181 @@ function quoteCmdPath(value: string): string {
 	return `"${escaped}"`;
 }
 
+const FENCE_OPEN = "<untrusted-content>\n";
+const FENCE_CLOSE = "\n</untrusted-content>";
+const UNTRUSTED_FENCE_OVERHEAD = Buffer.byteLength(`${FENCE_OPEN}${FENCE_CLOSE}`, "utf-8");
+const INLINE_MARKER_RESERVE = 256;
+/** `</untrusted-content>` grows when `wrapUntrustedContent` escapes it. */
+const CLOSER_RAW_BYTES = "</untrusted-content>".length;
+const CLOSER_ESCAPED_BYTES = "&lt;/untrusted-content&gt;".length;
+
+type OutputBudgetPath = "tools.maxInlineResultBytes" | "tools.artifactHeadBytes" | "tools.artifactTailLines";
+
+function settingNumber(settings: Settings | undefined, path: OutputBudgetPath): number {
+	return settings?.get(path) ?? getDefault(path);
+}
+
+type RemoteFrame = {
+	text: string;
+	truncation?: TruncationResult;
+	direction?: "head" | "tail" | "middle";
+	/** True only after the full remote text is already stored. */
+	shrunk: boolean;
+	visibleLines: number;
+	visibleBytes: number;
+};
+
+function inlineCapBytes(settings: Settings | undefined): number {
+	return settingNumber(settings, "tools.maxInlineResultBytes") * 1024;
+}
+
+function exceedsInlineCap(output: string, settings: Settings | undefined): boolean {
+	const cap = inlineCapBytes(settings);
+	if (cap <= 0) return false;
+	// Measure the escaped frame. A raw-size check misses closer expansion.
+	return Buffer.byteLength(wrapUntrustedContent(output), "utf-8") > cap;
+}
+
+function frameFullRemoteOutput(output: string): RemoteFrame {
+	return { text: wrapUntrustedContent(output), shrunk: false, visibleLines: 0, visibleBytes: 0 };
+}
+
+/**
+ * Cut to the inline window, then frame that excerpt. Call only when the full
+ * remote text is already stored, so a tail cut cannot drop the opening fence
+ * or the only copy of the output.
+ */
+function frameShrunkRemoteOutput(output: string, settings: Settings | undefined): RemoteFrame {
+	const cap = inlineCapBytes(settings);
+	const escapedRoom = Math.max(1, cap - UNTRUSTED_FENCE_OVERHEAD - INLINE_MARKER_RESERVE);
+	// Budget in remote-output bytes so framing and closer escaping cannot distort
+	// the source coordinates reported by truncation metadata.
+	let budget = Math.max(1, Math.floor((escapedRoom * CLOSER_RAW_BYTES) / CLOSER_ESCAPED_BYTES));
+	const headBytes = settingNumber(settings, "tools.artifactHeadBytes") * 1024;
+	const tailLines = settingNumber(settings, "tools.artifactTailLines");
+	const headBudget = Math.max(
+		1,
+		Math.floor((Math.min(headBytes, escapedRoom / 2) * CLOSER_RAW_BYTES) / CLOSER_ESCAPED_BYTES),
+	);
+	const cutRemoteOutput = (maxBytes: number) => {
+		if (headBytes > 0) {
+			const options = {
+				maxBytes,
+				maxLines: tailLines * 2,
+				maxHeadBytes: Math.min(headBudget, Math.floor(maxBytes / 2)),
+				maxHeadLines: tailLines,
+			};
+			return {
+				truncation: truncateMiddle(output, options),
+				windows: truncateMiddleWindows(output, options),
+			};
+		}
+		const options = { maxBytes, maxLines: tailLines };
+		return {
+			truncation: truncateTail(output, options),
+			windows: truncateMiddleWindows(output, { ...options, maxHeadBytes: 0, maxHeadLines: 0 }),
+		};
+	};
+	let { truncation, windows } = cutRemoteOutput(budget);
+	let excerpt = truncation.truncated ? truncation.content : output;
+	let text = wrapUntrustedContent(excerpt);
+	let textBytes = Buffer.byteLength(text, "utf-8");
+	while (textBytes > cap && budget > 1) {
+		const scaledBudget = Math.floor((budget * cap) / textBytes);
+		budget = Math.max(1, Math.min(budget - 1, scaledBudget));
+		({ truncation, windows } = cutRemoteOutput(budget));
+		excerpt = truncation.truncated ? truncation.content : output;
+		text = wrapUntrustedContent(excerpt);
+		textBytes = Buffer.byteLength(text, "utf-8");
+	}
+	if (text === wrapUntrustedContent(output)) return frameFullRemoteOutput(output);
+	if (windows.kind === "full") return frameFullRemoteOutput(output);
+	const direction = windows.kind === "middle" ? "middle" : windows.kind === "head-only" ? "head" : "tail";
+	return {
+		text,
+		truncation,
+		direction,
+		shrunk: true,
+		visibleLines: (windows.head?.lines ?? 0) + (windows.tail?.lines ?? 0),
+		visibleBytes: (windows.head?.bytes ?? 0) + (windows.tail?.bytes ?? 0),
+	};
+}
+
+/** Store the full remote text. Never write an already-shortened excerpt.
+ * The command has already finished, so a rejected reservation must not discard it.
+ */
+async function storeFullRemoteOutput(
+	session: ToolSession,
+	output: string,
+	artifactPublication: SessionArtifactPublication | undefined,
+): Promise<string | undefined> {
+	let allocated: { id?: string; path?: string } | undefined;
+	try {
+		allocated = await session.allocateOutputArtifact?.("ssh");
+	} catch {
+		allocated = undefined;
+	}
+	if (allocated?.path && allocated.id) {
+		try {
+			await Bun.write(allocated.path, output);
+			return allocated.id;
+		} catch {
+			// Fall through to the session-owned publisher when a writable path failed.
+		}
+	}
+	if (!artifactPublication) return undefined;
+	try {
+		return await artifactPublication(output, "ssh");
+	} catch {
+		return undefined;
+	}
+}
+
+function createSshArtifactPublisher(
+	artifactPublication: SessionArtifactPublication | undefined,
+): TerminalArtifactPublisher | undefined {
+	if (!artifactPublication) return undefined;
+	return async (content, info) => {
+		try {
+			const artifactId = await artifactPublication(content, "ssh");
+			if (!artifactId) return { status: "unavailable" };
+			return info.omittedBytes > 0
+				? { status: "published", artifactId, omittedBytes: info.omittedBytes }
+				: { status: "published", artifactId };
+		} catch (error) {
+			return { status: "failed", diagnostic: error instanceof Error ? error.message : String(error) };
+		}
+	};
+}
+
+function hasCompleteRemoteOutput(result: SSHResult, output: string): boolean {
+	return (
+		!result.truncated &&
+		result.outputBytes === result.totalBytes &&
+		Buffer.byteLength(output, "utf-8") === result.outputBytes
+	);
+}
+
+function incompleteOutputNotice(result: SSHResult, artifactId: string | undefined): string | undefined {
+	const retainedWindowIncomplete = result.truncated || result.outputBytes < result.totalBytes;
+	if (!retainedWindowIncomplete) return undefined;
+
+	const artifactIncomplete =
+		(result.artifactTruncatedBytes ?? 0) > 0 || result.artifactFailureDiagnostic !== undefined;
+	const completeArtifactAvailable = artifactId !== undefined && !artifactIncomplete;
+	if (completeArtifactAvailable) return undefined;
+
+	const notes = [`SSH output is incomplete: retained ${result.outputBytes} of ${result.totalBytes} bytes`];
+	notes.push("no complete output artifact is available");
+	if ((result.artifactTruncatedBytes ?? 0) > 0) {
+		notes.push(`artifact storage omitted at least ${result.artifactTruncatedBytes} bytes`);
+	}
+	if (result.artifactFailureDiagnostic) {
+		notes.push(`Artifact storage failed: ${result.artifactFailureDiagnostic}`);
+	}
+	return notes.join("; ");
+}
+
 function buildRemoteCommand(command: string, cwd: string | undefined, info: SSHHostInfo): string {
 	if (!cwd) return command;
 
@@ -161,6 +353,8 @@ export class SshTool implements AgentTool<typeof sshSchema, SSHToolDetails> {
 		// Clamp to reasonable range: 1s - 3600s (1 hour)
 		const timeoutSec = clampTimeout("ssh", rawTimeout);
 		const timeoutMs = timeoutSec * 1000;
+		const outputSettings = _ctx?.settings ?? this.session.settings;
+		const artifactPublication = this.session.captureArtifactPublication?.();
 
 		const tailBuffer = new TailBuffer(DEFAULT_MAX_BYTES);
 		const { path: artifactPath, id: artifactId } = (await this.session.allocateOutputArtifact?.("ssh")) ?? {};
@@ -172,22 +366,94 @@ export class SshTool implements AgentTool<typeof sshSchema, SSHToolDetails> {
 			compatEnabled: hostInfo.compatEnabled,
 			artifactPath,
 			artifactId,
+			artifactPublisher: createSshArtifactPublisher(artifactPublication),
 			onChunk: streamTailUpdates(tailBuffer, onUpdate),
 		});
 
+		const remote = result.output ?? "";
+		let storedArtifactId = result.artifactId;
+		let framed: RemoteFrame | undefined;
+		if (!remote) {
+			framed = undefined;
+		} else if (!exceedsInlineCap(remote, outputSettings)) {
+			framed = frameFullRemoteOutput(remote);
+		} else {
+			if (!storedArtifactId && hasCompleteRemoteOutput(result, remote)) {
+				storedArtifactId = await storeFullRemoteOutput(this.session, remote, artifactPublication);
+			}
+			framed = storedArtifactId ? frameShrunkRemoteOutput(remote, outputSettings) : frameFullRemoteOutput(remote);
+		}
+		// The artifact id stays in truncation metadata. A line after the closing
+		// fence makes the inline backstop drop the opening fence.
+		const modelText = framed?.text;
+		const storedNote =
+			(framed?.shrunk || result.truncated) && storedArtifactId
+				? `\n\n${formatArtifactReference(storedArtifactId, result.artifactTruncatedBytes)}`
+				: "";
+		const incompleteNote = incompleteOutputNotice(result, storedArtifactId);
+		const artifactFailureNote =
+			result.artifactFailureDiagnostic && !incompleteNote
+				? `SSH streaming artifact storage failed: ${result.artifactFailureDiagnostic}`
+				: undefined;
 		if (result.cancelled) {
-			throw new ToolError(result.output || "Command aborted");
+			const message = [
+				modelText || "Command aborted",
+				storedNote.trim() || undefined,
+				incompleteNote,
+				artifactFailureNote,
+			]
+				.filter((part): part is string => part !== undefined)
+				.join("\n\n");
+			throw new ToolError(message);
 		}
 
-		const outputText = result.output || "(no output)";
+		const outputText = modelText ?? "(no output)";
 		const details: SSHToolDetails = {};
-		const resultBuilder = toolResult(details).text(outputText).truncationFromSummary(result, { direction: "tail" });
+		const resultBuilder = toolResult(details).text(outputText);
+		if (framed?.shrunk && framed.truncation && storedArtifactId) {
+			resultBuilder.truncation(framed.truncation, {
+				direction: framed.direction ?? "tail",
+				artifactId: storedArtifactId,
+			});
+		} else {
+			resultBuilder.truncationFromSummary(result, { direction: "tail" });
+		}
 
 		if (result.exitCode !== 0 && result.exitCode !== undefined) {
-			throw new ToolError(`${outputText}\n\nCommand exited with code ${result.exitCode}`);
+			const message = [
+				outputText,
+				storedNote.trim() || undefined,
+				incompleteNote,
+				artifactFailureNote,
+				`Command exited with code ${result.exitCode}`,
+			]
+				.filter((part): part is string => part !== undefined)
+				.join("\n\n");
+			throw new ToolError(message);
 		}
 
-		return resultBuilder.done();
+		const built = resultBuilder.done();
+		const truncation = built.details?.meta?.truncation;
+		if (framed?.shrunk && truncation) {
+			// The cut is a window of an earlier excerpt. Keep the stream totals
+			// and do not present that window's coordinates as the original range.
+			truncation.totalLines = result.totalLines;
+			truncation.totalBytes = result.totalBytes;
+			truncation.outputLines = framed.visibleLines;
+			truncation.outputBytes = framed.visibleBytes;
+			truncation.artifactId = storedArtifactId;
+			truncation.artifactTruncatedBytes = result.artifactTruncatedBytes;
+			truncation.artifactFailureDiagnostic = result.artifactFailureDiagnostic;
+			delete truncation.shownRange;
+			delete truncation.headRange;
+			delete truncation.tailRange;
+			delete truncation.nextOffset;
+			if (framed.direction === "middle") {
+				truncation.elidedLines = Math.max(0, result.totalLines - framed.visibleLines);
+				truncation.elidedBytes = Math.max(0, result.totalBytes - framed.visibleBytes);
+			}
+		}
+		return built;
 	}
 }