@giovannijecha/jecode 0.8.1 → 0.8.3

package/dist/providers/openai-wire.js

@@ -1,6 +1,7 @@
 // Translation between the normalized vocabulary and the OpenAI Responses wire
 // shape: a flat `input` list where tool calls and their outputs are top-level
 // items keyed by `call_id`, rather than blocks nested inside a message.
+import { toolInputFromJson } from "./tool-input.js";
 import { wireTokenCount } from "./wire-usage.js";
 export function toWireTool(tool) {
     return {
@@ -73,7 +74,7 @@ export function fromWireResponse(data, providerId = "openai") {
                     kind: "tool_call",
                     id: item.call_id,
                     name: item.name,
-                    input: parseArguments(item.arguments),
+                    ...toolInputFromJson(item.arguments),
                 });
             }
             else {
@@ -106,18 +107,3 @@ function normalizeUsage(data) {
         reasoningTokens: wireTokenCount(usage.output_tokens_details?.reasoning_tokens),
     };
 }
-// Arguments arrive as a JSON string and models vary in how they escape it, so
-// this always goes through a real parse — never string matching.
-function parseArguments(text) {
-    if (text === undefined || text === "")
-        return {};
-    try {
-        const parsed = JSON.parse(text);
-        return typeof parsed === "object" && parsed !== null
-            ? parsed
-            : {};
-    }
-    catch {
-        return {};
-    }
-}

package/dist/providers/tool-input.js

@@ -0,0 +1,17 @@
+// Provider-neutral validation for tool arguments crossing a wire boundary.
+export function toolInputFromJson(text) {
+    if (text === undefined || text.trim() === "")
+        return { input: {} };
+    try {
+        return toolInputFromValue(JSON.parse(text));
+    }
+    catch {
+        return { input: {}, inputError: "tool arguments were not valid JSON" };
+    }
+}
+export function toolInputFromValue(value) {
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return { input: value };
+    }
+    return { input: {}, inputError: "tool arguments must be a JSON object" };
+}

package/dist/sessions/codec.js

@@ -3,9 +3,10 @@
 // can become conversation or provider input.
 import { Buffer } from "node:buffer";
 import { CONTEXT_LIMITS } from "../context/projection.js";
+import { MAX_TEXT_CODE_UNITS } from "../text-boundary.js";
 export const SESSION_SCHEMA = 4;
 export const SESSION_FILE_LIMITS = Object.freeze({
-    text: 1_048_576,
+    text: MAX_TEXT_CODE_UNITS,
     metadataBytes: 64 * 1_024,
     nodeBytes: 20 * 1_024 * 1_024,
     jsonDepth: 24,

package/dist/sessions/lease.js

@@ -9,6 +9,13 @@ export function sessionLease(id, file, token) {
     let closed = false;
     return Object.freeze({
         id,
+        assertOwned: async () => {
+            if (closed)
+                throw new Error("session lease is closed");
+            const current = await readLease(file);
+            if (current !== token)
+                throw new Error("session lease is no longer owned by this process");
+        },
         close: async () => {
             if (closed)
                 return;

package/dist/sessions/runtime.js

@@ -8,11 +8,13 @@ export class SessionPersistence {
     #store;
     #sessionId;
     #lease;
+    #snapshot;
     #failure;
-    constructor(store, sessionId, lease) {
+    constructor(store, sessionId, lease, snapshot) {
         this.#store = store;
         this.#sessionId = sessionId;
         this.#lease = lease;
+        this.#snapshot = snapshot;
     }
     static fresh(store) {
         return new SessionPersistence(store, null);
@@ -26,7 +28,7 @@ export class SessionPersistence {
                 throw new Error("session has no resumable turn");
             return Object.freeze({
                 conversation,
-                persistence: new SessionPersistence(store, id, lease),
+                persistence: new SessionPersistence(store, id, lease, snapshot),
             });
         }
         catch (error) {
@@ -51,9 +53,14 @@ export class SessionPersistence {
                 const published = await this.#store.publish(conversation, true);
                 this.#lease = published.lease;
                 this.#sessionId = published.meta.id;
+                this.#snapshot = published;
                 return;
             }
-            await this.#store.checkpoint(this.#sessionId, conversation);
+            if (this.#lease === undefined || this.#snapshot === undefined) {
+                throw new Error("session persistence has no verified owner snapshot");
+            }
+            await this.#lease.assertOwned();
+            this.#snapshot = await this.#store.checkpoint(this.#snapshot, conversation);
         }
         catch (error) {
             this.#failure = error;
@@ -64,6 +71,7 @@ export class SessionPersistence {
         await this.#lease?.close();
         this.#lease = undefined;
         this.#sessionId = null;
+        this.#snapshot = undefined;
         this.#failure = undefined;
     }
     async close() {

package/dist/sessions/store.js

@@ -16,6 +16,7 @@ const DIRECTORY_MODE = 0o700;
 const FILE_MODE = 0o600;
 const MAX_CATALOG_ENTRIES = 4_096;
 const CATALOG_READ_CONCURRENCY = 8;
+const NODE_READ_CONCURRENCY = 4;
 const SESSION_NAME = /^[a-zA-Z0-9][a-zA-Z0-9._-]{0,127}$/;
 const NODE_NAME = /^(\d{6})\.json$/;
 const ATOMIC_NODE_TEMP = /^\.\d{6}\.json\.\d+\.[a-f0-9-]+\.tmp$/;
@@ -104,15 +105,18 @@ export class DurableSessionStore {
             if (!replacesHead && !extendsTree) {
                 throw new Error("session checkpoint cannot be recovered safely");
             }
-            head = {
+            head = Object.freeze({
                 version: SESSION_SCHEMA,
                 sequence: candidate.sequence,
                 nodeId: candidate.node.id,
                 parentId: candidate.node.parentId,
                 revision: candidate.node.revision,
                 updatedAt: candidate.updatedAt,
-            };
-            await atomicWrite(path.join(directory, "head.json"), encodeHead(head), { mode: FILE_MODE });
+            });
+            await atomicWrite(path.join(directory, "head.json"), encodeHead(head), {
+                mode: FILE_MODE,
+                validate: async () => assertDirectory(directory),
+            });
         }
         const nodes = stored.map((entry) => entry.node);
         const conversation = ConversationTree.restore(nodes, head.nodeId);
@@ -128,21 +132,21 @@ export class DurableSessionStore {
         const token = claim === true ? leaseToken() : undefined;
         const temporary = path.join(this.#bucket, `.${id}.${randomUUID()}.tmp`);
         const target = this.#sessionDirectory(id);
-        const meta = {
+        const meta = Object.freeze({
             version: SESSION_SCHEMA,
             id,
             workspaceRoot: this.workspaceRoot,
             workspaceDigest: this.workspaceDigest,
             createdAt: now,
-        };
-        const head = {
+        });
+        const head = Object.freeze({
             version: SESSION_SCHEMA,
             sequence: conversation.nodes.length,
             nodeId: active.id,
             parentId: active.parentId,
             revision: active.revision,
             updatedAt: now,
-        };
+        });
         try {
             await makePrivateDirectory(temporary);
             const nodes = path.join(temporary, "nodes");
@@ -168,12 +172,26 @@ export class DurableSessionStore {
         const lease = sessionLease(id, path.join(target, "active"), token);
         return Object.freeze({ ...snapshot, lease });
     }
-    async checkpoint(id, conversation) {
-        const previous = await this.load(id);
+    async checkpoint(previous, conversation) {
+        assertSnapshot(previous, this.workspaceRoot, this.workspaceDigest);
+        const id = previous.meta.id;
+        const directory = this.#sessionDirectory(id);
+        await assertDirectory(directory);
+        const nodesDirectory = path.join(directory, "nodes");
+        const validateNodesDirectory = async () => {
+            await assertDirectory(directory);
+            await assertDirectory(nodesDirectory);
+        };
+        await validateNodesDirectory();
+        const currentHead = decodeHead(await readJson(path.join(directory, "head.json"), SESSION_FILE_LIMITS.metadataBytes));
+        if (!sameHead(currentHead, previous.head)) {
+            throw new Error("session head changed after its verified snapshot");
+        }
         const active = conversation.activeNode;
         if (active === undefined)
             throw new Error("an empty conversation cannot be checkpointed");
-        if (sameNode(active, previous.conversation.activeNode)) {
+        if (active === previous.conversation.activeNode &&
+            conversation.nodes === previous.conversation.nodes) {
             return Object.freeze({ ...previous, conversation });
         }
         const replacesHead = active.id === previous.head.nodeId &&
@@ -186,18 +204,23 @@ export class DurableSessionStore {
             throw new Error("session checkpoint does not extend its durable tree");
         }
         assertSharedNodes(previous.conversation, conversation, replacesHead ? active.id : undefined);
+        if (extendsTree) {
+            await assertMissingNode(path.join(nodesDirectory, nodeName(active.id)));
+        }
         const now = new Date().toISOString();
-        const head = {
+        const head = Object.freeze({
             version: SESSION_SCHEMA,
             sequence: previous.head.sequence + 1,
             nodeId: active.id,
             parentId: active.parentId,
             revision: active.revision,
             updatedAt: now,
-        };
-        const directory = this.#sessionDirectory(id);
-        await atomicWrite(path.join(directory, "nodes", nodeName(active.id)), encodeNode(active, head.sequence, now), { mode: FILE_MODE });
-        await atomicWrite(path.join(directory, "head.json"), encodeHead(head), { mode: FILE_MODE });
+        });
+        await atomicWrite(path.join(nodesDirectory, nodeName(active.id)), encodeNode(active, head.sequence, now), { mode: FILE_MODE, validate: async () => validateNodesDirectory() });
+        await atomicWrite(path.join(directory, "head.json"), encodeHead(head), {
+            mode: FILE_MODE,
+            validate: async () => assertDirectory(directory),
+        });
         return Object.freeze({ meta: previous.meta, head, conversation });
     }
     async claim(id) {
@@ -270,17 +293,44 @@ function assertSharedNodes(previous, next, replacedId) {
         if (node.id === replacedId)
             continue;
         const candidate = next.node(node.id);
-        if (candidate === undefined || normalizedNode(candidate) !== normalizedNode(node)) {
+        if (candidate !== node) {
             throw new Error("session checkpoint rewrites prior conversation history");
         }
     }
 }
-function normalizedNode(node) {
-    const encoded = JSON.parse(encodeNode(node, 1, "2026-01-01T00:00:00.000Z"));
-    return JSON.stringify(encoded.node);
+function assertSnapshot(snapshot, workspaceRoot, workspaceDigest) {
+    encodeMeta(snapshot.meta);
+    encodeHead(snapshot.head);
+    assertSessionId(snapshot.meta.id);
+    if (snapshot.meta.workspaceDigest !== workspaceDigest ||
+        workspaceKey(snapshot.meta.workspaceRoot) !== workspaceKey(workspaceRoot))
+        throw new Error("session snapshot belongs to a different workspace");
+    const active = snapshot.conversation.activeNode;
+    if (active === undefined ||
+        active.id !== snapshot.head.nodeId ||
+        active.parentId !== snapshot.head.parentId ||
+        active.revision !== snapshot.head.revision ||
+        snapshot.head.sequence < snapshot.conversation.nodes.length)
+        throw new Error("session snapshot does not match its verified head");
 }
-function sameNode(left, right) {
-    return right !== undefined && normalizedNode(left) === normalizedNode(right);
+function sameHead(left, right) {
+    return left.version === right.version &&
+        left.sequence === right.sequence &&
+        left.nodeId === right.nodeId &&
+        left.parentId === right.parentId &&
+        left.revision === right.revision &&
+        left.updatedAt === right.updatedAt;
+}
+async function assertMissingNode(file) {
+    try {
+        await lstat(file);
+    }
+    catch (error) {
+        if (error.code === "ENOENT")
+            return;
+        throw error;
+    }
+    throw new Error("session has an incomplete node outside its verified snapshot");
 }
 async function readNodes(directory) {
     await assertDirectory(directory);
@@ -296,17 +346,26 @@ async function readNodes(directory) {
     }
     const stored = [];
     const sequences = new Set();
-    for (let index = 0; index < names.length; index++) {
-        const name = names[index];
-        const id = Number(NODE_NAME.exec(name)?.[1]);
-        if (id !== index + 1)
-            throw new Error("session conversation nodes are not contiguous");
-        const decoded = decodeNode(await readJson(path.join(directory, name), SESSION_FILE_LIMITS.nodeBytes));
-        if (decoded.node.id !== id || sequences.has(decoded.sequence)) {
-            throw new Error("session conversation node identity is invalid");
+    for (let start = 0; start < names.length; start += NODE_READ_CONCURRENCY) {
+        const decoded = await Promise.all(names.slice(start, start + NODE_READ_CONCURRENCY)
+            .map(async (name, offset) => {
+            const id = Number(NODE_NAME.exec(name)?.[1]);
+            if (id !== start + offset + 1) {
+                throw new Error("session conversation nodes are not contiguous");
+            }
+            const entry = decodeNode(await readJson(path.join(directory, name), SESSION_FILE_LIMITS.nodeBytes));
+            if (entry.node.id !== id) {
+                throw new Error("session conversation node identity is invalid");
+            }
+            return entry;
+        }));
+        for (const entry of decoded) {
+            if (sequences.has(entry.sequence)) {
+                throw new Error("session conversation node identity is invalid");
+            }
+            sequences.add(entry.sequence);
+            stored.push(entry);
         }
-        sequences.add(decoded.sequence);
-        stored.push(decoded);
     }
     return stored;
 }

package/dist/settings.js

@@ -1,5 +1,4 @@
 // Persistent, non-secret defaults for interactive and batch sessions.
-import { readFileSync } from "node:fs";
 import { chmod, mkdir } from "node:fs/promises";
 import * as path from "node:path";
 import { atomicWrite } from "./atomic.js";
@@ -9,6 +8,7 @@ import { providerNames } from "./providers/index.js";
 import { parseOllamaEndpoint } from "./providers/ollama-endpoint.js";
 import { withStoreLock } from "./store-lock.js";
 import { userDataLabel, userDataPath } from "./user-data.js";
+import { assertStoreText, readBoundedJsonSync, USER_STORE_LIMITS } from "./user-store.js";
 export { EFFORTS } from "./effort.js";
 let saved;
 export function readSettings() {
@@ -24,7 +24,9 @@ export async function updateSettings(patch) {
         await chmod(directory, 0o700);
     return withStoreLock(file, async () => {
         const next = normalize({ ...readStore(file), ...patch });
-        await atomicWrite(file, `${JSON.stringify(next, null, 2)}\n`, { mode: 0o600 });
+        const text = `${JSON.stringify(next, null, 2)}\n`;
+        assertStoreText(text, USER_STORE_LIMITS.settingsBytes);
+        await atomicWrite(file, text, { mode: 0o600 });
         saved = next;
         return file;
     });
@@ -41,7 +43,7 @@ export function reloadSettings() {
 }
 function readStore(file = settingsPath()) {
     try {
-        return normalize(JSON.parse(readFileSync(file, "utf8")));
+        return normalize(readBoundedJsonSync(file, USER_STORE_LIMITS.settingsBytes));
     }
     catch {
         // Missing, unreadable, and malformed stores all fall back safely. A bad
@@ -73,14 +75,14 @@ function normalize(value) {
 function modelsOf(value, providers) {
     if (!record(value))
         return undefined;
-    const models = Object.fromEntries(Object.entries(value).filter((entry) => providers.includes(entry[0]) && typeof entry[1] === "string" && entry[1].trim() !== ""));
+    const models = Object.fromEntries(Object.entries(value).filter((entry) => providers.includes(entry[0]) && boundedNonempty(entry[1], USER_STORE_LIMITS.model)));
     return Object.keys(models).length === 0 ? undefined : models;
 }
 function member(value, values) {
     return typeof value === "string" && values.includes(value) ? value : undefined;
 }
 function endpoint(value) {
-    if (typeof value !== "string")
+    if (!boundedNonempty(value, USER_STORE_LIMITS.endpoint))
         return undefined;
     try {
         return parseOllamaEndpoint(value).baseUrl;
@@ -89,6 +91,9 @@ function endpoint(value) {
         return undefined;
     }
 }
+function boundedNonempty(value, max) {
+    return typeof value === "string" && value.length <= max && value.trim() !== "";
+}
 function positiveInteger(value) {
     return typeof value === "number" && Number.isSafeInteger(value) && value > 0 ? value : undefined;
 }

package/dist/start.js

@@ -76,14 +76,24 @@ export async function start(args = process.argv.slice(2), environment = {}) {
             }
         }
         try {
-            await (environment.runInteractive ?? runApp)(session, transcriptRoot);
+            if (environment.runInteractive === undefined) {
+                await runApp(session, transcriptRoot, { shutdownSignal: environment.signal });
+            }
+            else {
+                await environment.runInteractive(session, transcriptRoot, environment.signal);
+            }
         }
         finally {
             await session.persistence?.close();
         }
     }
     else {
-        await (environment.runNonInteractive ?? runBatch)(session);
+        if (environment.runNonInteractive === undefined) {
+            await runBatch(session, { signal: environment.signal });
+        }
+        else {
+            await environment.runNonInteractive(session, environment.signal);
+        }
     }
 }
 function applyResumedSession(session, conversation, persistence) {

package/dist/text-boundary.js

@@ -1,5 +1,7 @@
 // Shared grapheme boundaries for every projection of user-visible text.
 const SEGMENTER = new Intl.Segmenter(undefined, { granularity: "grapheme" });
+/** Shared persisted-text and user-prompt boundary, measured like String.length. */
+export const MAX_TEXT_CODE_UNITS = 1_048_576;
 export function segmentGraphemes(text) {
     return SEGMENTER.segment(text);
 }

package/dist/tui/app-input.js

@@ -1,4 +1,5 @@
 // Keyboard and pointer intent for the TUI shell.
+import { PROMPT_LIMIT_MESSAGE, PromptLimitError } from "../input-boundary.js";
 import { activate as activateCompletion, move as moveCompletion, selected as selectedCompletion, } from "./complete.js";
 import * as edit from "./editor.js";
 import { turnBlocker } from "./feedback.js";
@@ -21,6 +22,13 @@ export function appInput(options) {
         }
         if (state.feedback !== undefined)
             feedback.dismiss();
+        if (key.name === "input_limit") {
+            if (state.open === undefined)
+                rejectPrompt();
+            else
+                showInputLimit();
+            return;
+        }
         // Detail expansion remains available while an approval is open. A large
         // diff may be compacted, but the user must be able to inspect it before
         // answering the permission prompt.
@@ -33,6 +41,8 @@ export function appInput(options) {
         if (state.open !== undefined) {
             const outcome = overlay.handle(state.open, key);
             state.open = outcome.open;
+            if (outcome.inputLimit === true)
+                showInputLimit();
             if (outcome.abort === true)
                 state.activity?.control.abort(new Error("interrupted"));
             if (outcome.quit === true)
@@ -61,8 +71,10 @@ export function appInput(options) {
             case "enter": {
                 if (state.completing !== undefined) {
                     const completed = selectedCompletion(state.completing);
-                    if (completed !== undefined)
+                    if (completed !== undefined) {
                         state.editor = edit.of(completed);
+                        state.promptRejected = false;
+                    }
                     state.completing = undefined;
                 }
                 submit();
@@ -75,6 +87,7 @@ export function appInput(options) {
                 const completed = completion === undefined ? undefined : selectedCompletion(completion);
                 if (completed !== undefined) {
                     state.editor = edit.of(completed);
+                    state.promptRejected = false;
                     state.completing = undefined;
                 }
                 return;
@@ -106,16 +119,26 @@ export function appInput(options) {
             options.invalidate();
             return;
         }
-        const edited = applyKey(state.editor, key);
-        if (edited !== undefined) {
-            state.editor = edited;
-            state.completing = state.activity === undefined ? activateCompletion(edited.text) : undefined;
+        try {
+            const edited = applyKey(state.editor, key);
+            if (edited !== undefined) {
+                if (edited.text !== state.editor.text)
+                    state.promptRejected = false;
+                state.editor = edited;
+                state.completing = state.activity === undefined ? activateCompletion(edited.text) : undefined;
+            }
+        }
+        catch (error) {
+            if (!(error instanceof PromptLimitError))
+                throw error;
+            rejectPrompt();
         }
     }
     function recall(step) {
         if (state.past.length === 0)
             return;
         state.completing = undefined;
+        state.promptRejected = false;
         if (state.recall === -1) {
             if (step > 0)
                 return;
@@ -132,6 +155,10 @@ export function appInput(options) {
         state.editor = edit.of(state.past[state.recall]);
     }
     function submit() {
+        if (state.promptRejected) {
+            keep(PROMPT_LIMIT_MESSAGE);
+            return;
+        }
         const text = state.editor.text.trim();
         if (text === "")
             return;
@@ -171,6 +198,7 @@ export function appInput(options) {
         state.recall = -1;
         state.draft = "";
         state.completing = undefined;
+        state.promptRejected = false;
         state.past.push(text);
         state.scroll = 0;
         state.follow = true;
@@ -179,5 +207,12 @@ export function appInput(options) {
     function keep(text) {
         feedback.show({ text: `${text} · prompt kept`, tone: "warn", timeoutMs: 4_000 });
     }
+    function rejectPrompt() {
+        state.promptRejected = true;
+        keep(PROMPT_LIMIT_MESSAGE);
+    }
+    function showInputLimit() {
+        feedback.show({ text: PROMPT_LIMIT_MESSAGE, tone: "warn", timeoutMs: 4_000 });
+    }
     return { handle };
 }

package/dist/tui/app-state.js

@@ -13,5 +13,6 @@ export function appState() {
         draft: "",
         closeWhenIdle: false,
         committedNodeId: 0,
+        promptRejected: false,
     };
 }

package/dist/tui/app-workflows.js

@@ -212,6 +212,7 @@ export function appWorkflows(options) {
                 nodeId: nodeId ?? prospectiveNodeId,
                 coveredMessages: context?.messageCount ?? 0,
                 lastInputTokens: Math.max(session.usage.lastInputTokens, request.inputTokens),
+                estimatedInputTokens: request.inputTokens,
                 signal: activity.control.signal,
                 force,
                 policy: request.policy,

package/dist/tui/app.js

@@ -42,6 +42,7 @@ export async function runApp(session, transcriptRoot, environment = {}) {
     let escapeTimer;
     let stopResize = () => { };
     let stopInput = () => { };
+    let stopShutdown = () => { };
     let failure;
     let activeWorkflow;
     // Timers outlive the teardown they were scheduled before. Painting after the
@@ -158,6 +159,7 @@ export async function runApp(session, transcriptRoot, environment = {}) {
         live = false;
         safely(stopInput);
         safely(stopResize);
+        safely(stopShutdown);
         if (activityTimer !== undefined)
             clearInterval(activityTimer);
         if (frameTimer !== undefined)
@@ -194,15 +196,15 @@ export async function runApp(session, transcriptRoot, environment = {}) {
         activeWorkflow = tracked;
         return tracked;
     }
-    function requestQuit() {
+    function requestQuit(reason = new Error("interrupted")) {
+        state.open = overlay.cancel(state.open);
         const activity = state.activity;
         if (activity === undefined) {
             quit();
             return;
         }
         state.closeWhenIdle = true;
-        state.open = overlay.cancel(state.open);
-        activity.control.abort(new Error("interrupted"));
+        activity.control.abort(reason);
     }
     function startActivity(kind, label) {
         if (state.activity !== undefined)
@@ -305,6 +307,12 @@ export async function runApp(session, transcriptRoot, environment = {}) {
         }
     }
     try {
+        const shutdownSignal = environment.shutdownSignal;
+        const onShutdown = () => requestQuit(shutdownSignal?.reason);
+        if (shutdownSignal?.aborted === true)
+            return;
+        shutdownSignal?.addEventListener("abort", onShutdown, { once: true });
+        stopShutdown = () => shutdownSignal?.removeEventListener("abort", onShutdown);
         terminal.enter(session.config.reducedMotion);
         stopResize = terminal.onResize(() => guard(() => {
             paint.invalidate();

package/dist/tui/blocks.js

@@ -11,12 +11,10 @@ export function render(block, width, pal, context = {}) {
         case "reasoning":
             return renderReasoning(block, width, pal, {
                 continues: context.previous?.kind === "reasoning",
-                followsTool: context.previous?.kind === "tool",
             });
         case "tool":
             return renderTool(block, width, pal, {
-                continues: context.previous?.kind === "tool" || context.previous?.kind === "reasoning",
-                followsReasoning: context.previous?.kind === "reasoning",
+                continues: context.previous?.kind === "tool",
                 now: context.now,
                 motion: context.motion,
                 reducedMotion: context.reducedMotion,