@giovannijecha/jecode 0.8.2 → 0.8.4

package/dist/credentials.js

@@ -10,11 +10,11 @@
 // secret in the working tree is one `git add -A` from being published, which
 // is why "not in the repo" is a rule and not a preference.
 import { chmod, mkdir } from "node:fs/promises";
-import { readFileSync } from "node:fs";
 import * as path from "node:path";
 import { atomicWrite } from "./atomic.js";
 import { withStoreLock } from "./store-lock.js";
 import { legacyUserDataPath, userDataLabel, userDataPath } from "./user-data.js";
+import { assertStoreText, readBoundedJsonSync, USER_STORE_LIMITS } from "./user-store.js";
 /** Keys this session was given but not asked to keep. Dies with the window. */
 const held = new Map();
 /** The saved file, read once. `undefined` until the first look at it. */
@@ -58,6 +58,10 @@ export function hasSaved(name) {
 }
 /** Take a key for this session only. Nothing is written anywhere. */
 export function hold(name, value) {
+    assertCredential(name, value);
+    if (!held.has(name) && held.size >= USER_STORE_LIMITS.credentialEntries) {
+        throw new Error("too many session credentials");
+    }
     held.set(name, value);
 }
 /** Remove only the value held by this process. Saved and environment values remain. */
@@ -73,10 +77,14 @@ export function forgetSession(name) {
  * Windows ignores the mode and relies on the profile directory's own ACL.
  */
 export async function keep(name, value) {
+    assertCredential(name, value);
     const file = storePath();
     await prepare(file);
     return withStoreLock(file, async () => {
         const all = { ...readSavedStore(), [name]: value };
+        if (Object.keys(all).length > USER_STORE_LIMITS.credentialEntries) {
+            throw new Error("too many saved credentials");
+        }
         await persist(file, all);
         saved = all;
         // A newly saved replacement must become active immediately. Otherwise an
@@ -131,9 +139,14 @@ function readSavedStore() {
 }
 function readStore(file) {
     try {
-        const parsed = JSON.parse(readFileSync(file, "utf8"));
+        const parsed = readBoundedJsonSync(file, USER_STORE_LIMITS.credentialsBytes);
+        if (!record(parsed))
+            return {};
         // Anything that is not a string is not a key, whatever the file says.
-        return Object.fromEntries(Object.entries(parsed).filter((entry) => typeof entry[1] === "string"));
+        const entries = Object.entries(parsed);
+        if (entries.length > USER_STORE_LIMITS.credentialEntries)
+            return {};
+        return Object.fromEntries(entries.filter((entry) => credential(entry[0], entry[1])));
     }
     catch (error) {
         // Only a missing canonical file falls through to the legacy location. A
@@ -148,7 +161,22 @@ async function prepare(file) {
         await chmod(directory, 0o700);
 }
 async function persist(file, values) {
-    await atomicWrite(file, `${JSON.stringify(values, null, 2)}\n`, { mode: 0o600 });
+    const text = `${JSON.stringify(values, null, 2)}\n`;
+    assertStoreText(text, USER_STORE_LIMITS.credentialsBytes);
+    await atomicWrite(file, text, { mode: 0o600 });
+}
+function assertCredential(name, value) {
+    if (!credential(name, value))
+        throw new Error("invalid credential name or value");
+}
+function credential(name, value) {
+    return name.length > 0 && name.length <= USER_STORE_LIMITS.credentialName &&
+        /^[A-Za-z_][A-Za-z0-9_]*$/.test(name) &&
+        typeof value === "string" && value.length > 0 &&
+        value.length <= USER_STORE_LIMITS.credentialValue;
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 /** An empty variable is an unset variable — an exported "" is not a key. */
 function use(value) {

package/dist/input-boundary.js

@@ -0,0 +1,80 @@
+// One bounded ingress for text that can become a user prompt.
+import { Buffer } from "node:buffer";
+import { StringDecoder } from "node:string_decoder";
+import { MAX_TEXT_CODE_UNITS } from "./text-boundary.js";
+export const MAX_PROMPT_CODE_UNITS = MAX_TEXT_CODE_UNITS;
+export const PROMPT_LIMIT_MESSAGE = `Prompt cannot exceed ${MAX_PROMPT_CODE_UNITS.toLocaleString("en-US")} UTF-16 code units`;
+export class PromptLimitError extends Error {
+    constructor() {
+        super(PROMPT_LIMIT_MESSAGE);
+        this.name = "PromptLimitError";
+    }
+}
+export function assertPromptLength(length) {
+    if (length > MAX_PROMPT_CODE_UNITS)
+        throw new PromptLimitError();
+}
+export function assertPromptAppend(current, added) {
+    if (added > MAX_PROMPT_CODE_UNITS - current)
+        throw new PromptLimitError();
+}
+/**
+ * Split raw UTF-8 input without letting one unterminated line grow past the
+ * prompt boundary. Newline, CRLF, and a final line without a newline match the
+ * line semantics used by batch mode.
+ */
+export async function* boundedInputLines(source) {
+    const decoder = new StringDecoder("utf8");
+    let line = "";
+    let pendingCr = false;
+    const append = (text, from, to) => {
+        const length = to - from;
+        assertPromptAppend(line.length, length);
+        if (length > 0)
+            line += text.slice(from, to);
+    };
+    const consume = function* (text) {
+        if (text === "")
+            return;
+        let from = 0;
+        if (pendingCr) {
+            if (text.startsWith("\n"))
+                from = 1;
+            pendingCr = false;
+            yield line;
+            line = "";
+        }
+        while (from < text.length) {
+            const cr = text.indexOf("\r", from);
+            const lf = text.indexOf("\n", from);
+            const newline = cr === -1 ? lf : lf === -1 ? cr : Math.min(cr, lf);
+            if (newline === -1) {
+                append(text, from, text.length);
+                return;
+            }
+            append(text, from, newline);
+            if (text[newline] === "\r" && newline + 1 === text.length) {
+                pendingCr = true;
+                return;
+            }
+            yield line;
+            line = "";
+            from = text[newline] === "\r" && text[newline + 1] === "\n"
+                ? newline + 2
+                : newline + 1;
+        }
+    };
+    for await (const chunk of source) {
+        const text = typeof chunk === "string" ? chunk : decoder.write(Buffer.from(chunk));
+        yield* consume(text);
+    }
+    const tail = decoder.end();
+    if (tail !== "")
+        yield* consume(tail);
+    if (pendingCr) {
+        yield line;
+        line = "";
+    }
+    if (line !== "")
+        yield line;
+}

package/dist/main.js

@@ -1,7 +1,10 @@
 // Process entry point. The testable bootstrap lives in start.ts.
 import { start } from "./start.js";
+import { isProcessSignalError, withProcessShutdown } from "./process-shutdown.js";
 import { terminalText } from "./ui/terminal-text.js";
-start().catch((error) => {
+withProcessShutdown((signal) => start(process.argv.slice(2), { signal })).catch((error) => {
+    if (isProcessSignalError(error))
+        return;
     process.stderr.write(`jecode: ${terminalText(error.message)}\n`);
     process.exitCode = 1;
 });

package/dist/openai-oauth-callback.js

@@ -173,7 +173,7 @@ function resultPage(success) {
 let mascot;
 function mascotDataUri() {
     if (mascot === undefined) {
-        const file = new URL("../docs/assets/brand/jeco-256.png", import.meta.url);
+        const file = new URL("../assets/jeco-256.png", import.meta.url);
         mascot = `data:image/png;base64,${readFileSync(file).toString("base64")}`;
     }
     return mascot;

package/dist/process-shutdown.js

@@ -0,0 +1,52 @@
+// One process-wide cancellation boundary for operating-system signals.
+const SHUTDOWN_GRACE_MS = 2_000;
+const SIGNALS = [
+    ["SIGINT", 2],
+    ["SIGHUP", 1],
+    ["SIGTERM", 15],
+];
+export class ProcessSignalError extends Error {
+    signal;
+    exitCode;
+    constructor(signal, exitCode) {
+        super(`received ${signal}`);
+        this.name = "ProcessSignalError";
+        this.signal = signal;
+        this.exitCode = exitCode;
+    }
+}
+export function isProcessSignalError(error) {
+    return error instanceof ProcessSignalError;
+}
+/**
+ * Abort foreground work on the first fatal signal and reserve a bounded hard
+ * exit for work that ignores cancellation. A second signal exits immediately.
+ */
+export async function withProcessShutdown(work) {
+    const control = new AbortController();
+    let exitCode;
+    let forceTimer;
+    const listeners = [];
+    for (const [name, number] of SIGNALS) {
+        const listener = () => {
+            if (control.signal.aborted) {
+                process.exit(exitCode ?? 128 + number);
+            }
+            exitCode = 128 + number;
+            process.exitCode = exitCode;
+            control.abort(new ProcessSignalError(name, exitCode));
+            forceTimer = setTimeout(() => process.exit(exitCode), SHUTDOWN_GRACE_MS);
+        };
+        listeners.push([name, listener]);
+        process.on(name, listener);
+    }
+    try {
+        return await work(control.signal);
+    }
+    finally {
+        if (forceTimer !== undefined)
+            clearTimeout(forceTimer);
+        for (const [name, listener] of listeners)
+            process.off(name, listener);
+    }
+}

package/dist/provider-commands.js

@@ -15,28 +15,65 @@ export async function providersCommand(session, host) {
     const choose = chooser(host);
     if (choose === undefined)
         return;
-    let selected = Math.max(0, PROVIDERS.findIndex((provider) => provider.id === session.provider.id));
+    const groups = providerGroups();
+    let selected = Math.max(0, groups.findIndex((group) => group.providers.some((provider) => provider.id === session.provider.id)));
     while (true) {
         const index = await choose({
             title: [],
-            options: PROVIDERS.map((provider) => ({
+            options: groups.map((group) => ({
+                label: group.label,
+                value: providerCount(group.providers.length),
+            })),
+            index: selected,
+        });
+        if (index === undefined) {
+            throwIfAborted(host.signal);
+            return;
+        }
+        const group = groups[index];
+        if (group === undefined)
+            return;
+        selected = index;
+        await providerGroupCommand(group, session, host);
+        throwIfAborted(host.signal);
+    }
+}
+function providerGroups() {
+    return [
+        { label: "Account", providers: PROVIDERS.filter((provider) => provider.auth.kind === "oauth") },
+        { label: "API", providers: PROVIDERS.filter((provider) => provider.auth.kind !== "oauth") },
+    ];
+}
+async function providerGroupCommand(group, session, host) {
+    if (host.choose === undefined)
+        return;
+    let selected = Math.max(0, group.providers.findIndex((provider) => provider.id === session.provider.id));
+    while (true) {
+        const index = await host.choose({
+            title: heading(group.label, "provider access", session.palette),
+            options: group.providers.map((provider) => ({
                 label: providerLabel(provider.id),
                 value: providerAccessHint(provider),
             })),
             index: selected,
         });
-        if (index === undefined)
+        if (index === undefined) {
+            throwIfAborted(host.signal);
             return;
-        const provider = PROVIDERS[index];
+        }
+        const provider = group.providers[index];
         if (provider === undefined)
             return;
         selected = index;
         await manageProvider(provider, session, host);
-        // Esc closes only the nested provider flow. Ctrl+C also settles that
-        // picker, but aborts the command signal and must not reopen the parent.
+        // Esc closes only the provider-specific flow. Ctrl+C also settles that
+        // interaction, but aborts the command signal and must not reopen a menu.
         throwIfAborted(host.signal);
     }
 }
+function providerCount(count) {
+    return `${count} ${count === 1 ? "provider" : "providers"}`;
+}
 export function providerAccessHint(provider) {
     if (provider.id === "ollama") {
         const connection = ollamaConnection();

package/dist/provider-errors.js

@@ -1,11 +1,69 @@
 // Actionable provider failures for user-facing command and turn surfaces.
+import { redactCredentials } from "./credential-safety.js";
 import { providerLabel } from "./provider-label.js";
+import { leadingText } from "./text-boundary.js";
+import { terminalText } from "./ui/terminal-text.js";
 const CONNECTION_FAILURE = /network error calling|timed out waiting for response headers|response body was idle/i;
+const MAX_MESSAGE_CHARS = 1_000;
+const MAX_REASON_CHARS = 500;
+const HTML = /<!doctype\s|<\/?[a-z][^>]*>/i;
 export function providerFailure(provider, error, labelProvider = false) {
     if (provider.id === "ollama" && CONNECTION_FAILURE.test(error.message)) {
         return provider.location?.() === "local"
             ? "Ollama is not reachable on this computer · start Ollama or choose cloud in /providers"
             : "Ollama is not reachable · check its connection in /providers";
     }
-    return labelProvider ? `${providerLabel(provider.id)}: ${error.message}` : error.message;
+    const message = safeText(error.message, MAX_MESSAGE_CHARS) || "provider request failed";
+    const reason = providerReason(error);
+    const detail = reason !== undefined && !message.toLocaleLowerCase().includes(reason.toLocaleLowerCase())
+        ? ` · ${reason}`
+        : "";
+    const failure = `${message}${detail}`;
+    return labelProvider ? `${providerLabel(provider.id)}: ${failure}` : failure;
+}
+function providerReason(error) {
+    const body = error.body;
+    if (typeof body !== "string" || body.trim() === "")
+        return undefined;
+    let parsed;
+    try {
+        parsed = JSON.parse(body);
+    }
+    catch {
+        const raw = body.trim();
+        if (raw.startsWith("{") || raw.startsWith("[") || HTML.test(raw))
+            return undefined;
+        return safeReason(raw);
+    }
+    for (const candidate of reasonCandidates(parsed)) {
+        const reason = safeReason(candidate);
+        if (reason !== undefined)
+            return reason;
+    }
+    return undefined;
+}
+function reasonCandidates(value) {
+    if (typeof value === "string")
+        return [value];
+    if (!record(value))
+        return [];
+    const error = value["error"];
+    return [
+        record(error) ? error["message"] : undefined,
+        typeof error === "string" ? error : undefined,
+        value["message"],
+        value["detail"],
+    ].filter((candidate) => typeof candidate === "string");
+}
+function safeReason(text) {
+    if (HTML.test(text))
+        return undefined;
+    return safeText(text, MAX_REASON_CHARS) || undefined;
+}
+function safeText(text, max) {
+    const redacted = redactCredentials(text).trim().replace(/\s+/gu, " ");
+    return leadingText(terminalText(redacted), max);
+}
+function record(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
 }

package/dist/providers/anthropic-stream.js

@@ -6,11 +6,13 @@
 // beyond display: thinking blocks carry a signature and must be echoed back
 // byte-for-byte on the next request.
 import { addBounded, MAX_TOOL_ARGUMENT_CHARS } from "./stream-limits.js";
+import { toolInputFromJson } from "./tool-input.js";
 export async function assembleAnthropic(events, onStream) {
     const blocks = new Map();
     const partialJson = new Map();
     const announcedTools = new Set();
     const sizes = { toolArguments: 0 };
+    const toolInputErrors = {};
     let stopReason;
     let stopDetails;
     let usage;
@@ -46,7 +48,10 @@ export async function assembleAnthropic(events, onStream) {
                 const pending = partialJson.get(event.index);
                 const block = blocks.get(event.index);
                 if (pending !== undefined && block !== undefined) {
-                    block.input = parseJsonObject(pending);
+                    const parsed = toolInputFromJson(pending);
+                    block.input = parsed.input;
+                    if (parsed.inputError !== undefined)
+                        toolInputErrors[event.index] = parsed.inputError;
                     partialJson.delete(event.index);
                 }
                 break;
@@ -69,10 +74,24 @@ export async function assembleAnthropic(events, onStream) {
     }
     if (!complete)
         throw new Error("anthropic stream ended before message_stop");
-    const content = [...blocks.entries()]
-        .sort(([a], [b]) => a - b)
-        .map(([, block]) => block);
-    return { content, stop_reason: stopReason, stop_details: stopDetails, usage };
+    const ordered = [...blocks.entries()].sort(([a], [b]) => a - b);
+    const content = ordered.map(([, block]) => block);
+    const orderedInputErrors = {};
+    for (let index = 0; index < ordered.length; index++) {
+        const sourceIndex = ordered[index]?.[0];
+        if (sourceIndex === undefined || toolInputErrors[sourceIndex] === undefined)
+            continue;
+        orderedInputErrors[index] = toolInputErrors[sourceIndex];
+    }
+    return {
+        content,
+        stop_reason: stopReason,
+        stop_details: stopDetails,
+        usage,
+        ...(Object.keys(orderedInputErrors).length === 0
+            ? {}
+            : { toolInputErrors: orderedInputErrors }),
+    };
 }
 function mergeUsage(before, after) {
     return after === undefined ? before : { ...before, ...after };
@@ -108,18 +127,3 @@ function applyDelta(blocks, partialJson, sizes, index, delta, onStream) {
             return;
     }
 }
-// Tool arguments arrive as a stream of JSON fragments. An empty accumulation
-// is a call with no arguments, not a malformed one.
-function parseJsonObject(text) {
-    if (text.trim() === "")
-        return {};
-    try {
-        const parsed = JSON.parse(text);
-        return typeof parsed === "object" && parsed !== null
-            ? parsed
-            : {};
-    }
-    catch {
-        return {};
-    }
-}

package/dist/providers/anthropic-wire.js

@@ -1,5 +1,6 @@
 // Translation between the normalized vocabulary and the Anthropic wire shape.
 // Pure functions, no I/O — which is what makes them testable without a key.
+import { toolInputFromValue } from "./tool-input.js";
 import { wireTokenCount } from "./wire-usage.js";
 export function toWireTool(tool) {
     return { name: tool.name, description: tool.description, input_schema: tool.input };
@@ -45,7 +46,8 @@ export function fromWireResponse(data) {
     const raw = Array.isArray(data.content) ? data.content : [];
     const content = [];
     let suppressedToolCall = false;
-    for (const item of raw) {
+    for (let index = 0; index < raw.length; index++) {
+        const item = raw[index];
         const block = item;
         if (block.type === "text" && typeof block.text === "string") {
             content.push({ kind: "text", text: block.text });
@@ -54,11 +56,14 @@ export function fromWireResponse(data) {
             if (data.stop_reason === "tool_use" &&
                 typeof block.id === "string" &&
                 typeof block.name === "string") {
+                const parsed = toolInputFromValue(block.input ?? {});
+                const inputError = data.toolInputErrors?.[index] ?? parsed.inputError;
                 content.push({
                     kind: "tool_call",
                     id: block.id,
                     name: block.name,
-                    input: (block.input ?? {}),
+                    input: parsed.input,
+                    ...(inputError === undefined ? {} : { inputError }),
                 });
             }
             else {

package/dist/providers/http.js

@@ -40,7 +40,10 @@ export async function postSse(url, headers, body, maxOutputTokens, signal, onSta
     const res = await request(url, { accept: "text/event-stream", ...headers }, body, signal, onStatus);
     if (res.body === null)
         throw httpError(`${url} returned no body`, res.status);
-    return readSseJson(withIdleTimeout(url, res.body), maximumChars);
+    return readSseJson(res.body, maximumChars, {
+        milliseconds: BODY_IDLE_TIMEOUT_MS,
+        error: () => httpError(`${url} SSE stream was idle for ${BODY_IDLE_TIMEOUT_MS}ms without an event`, res.status),
+    });
 }
 async function request(url, headers, body, signal, onStatus) {
     const maxRetries = body === undefined ? GET_RETRIES : 0;
@@ -154,39 +157,6 @@ async function timedRead(url, reader) {
             clearTimeout(timer);
     }
 }
-function withIdleTimeout(url, body) {
-    const reader = body.getReader();
-    let released = false;
-    const release = () => {
-        if (released)
-            return;
-        released = true;
-        reader.releaseLock();
-    };
-    return new ReadableStream({
-        async pull(controller) {
-            try {
-                const { done, value } = await timedRead(url, reader);
-                if (done) {
-                    release();
-                    controller.close();
-                }
-                else {
-                    controller.enqueue(value);
-                }
-            }
-            catch (error) {
-                await reader.cancel(error).catch(() => undefined);
-                release();
-                controller.error(error);
-            }
-        },
-        async cancel(reason) {
-            await reader.cancel(reason).catch(() => undefined);
-            release();
-        },
-    });
-}
 function waitLabel(ms) {
     return ms < 1_000 ? `${ms}ms` : `${Math.ceil(ms / 1_000)}s`;
 }

package/dist/providers/ollama-wire.js

@@ -6,6 +6,7 @@
 // Chat Completions differs on two points that matter here — a tool result is a
 // message of its own with role "tool", not a block inside a user turn, and tool
 // arguments travel as a JSON string rather than an object.
+import { toolInputFromJson } from "./tool-input.js";
 import { wireTokenCount } from "./wire-usage.js";
 export function toWireTool(tool) {
     return {
@@ -63,7 +64,12 @@ export function fromWireReply(reply) {
     const acceptsToolCalls = reply.finishReason === "tool_calls";
     if (acceptsToolCalls) {
         for (const call of reply.toolCalls) {
-            content.push({ kind: "tool_call", id: call.id, name: call.name, input: parseArgs(call.args) });
+            content.push({
+                kind: "tool_call",
+                id: call.id,
+                name: call.name,
+                ...toolInputFromJson(call.args),
+            });
         }
     }
     const notice = stopNotice(reply);
@@ -104,17 +110,3 @@ export function stopNotice(reply) {
         ? "[truncated: hit the output limit — raise --max-tokens]"
         : undefined;
 }
-// A model that emits malformed JSON gets the empty object, which fails
-// validation in tools/args.ts with a message written for it to read. That is a
-// recoverable turn; throwing here would end the whole thing instead.
-function parseArgs(args) {
-    if (args.trim() === "")
-        return {};
-    try {
-        const parsed = JSON.parse(args);
-        return typeof parsed === "object" && parsed !== null ? parsed : {};
-    }
-    catch {
-        return {};
-    }
-}

package/dist/providers/ollama.js

@@ -90,6 +90,7 @@ export const ollama = {
             max_tokens: req.maxTokens,
             reasoning_effort: effort,
             stream: true,
+            stream_options: { include_usage: true },
         }, req.maxTokens, req.signal, req.onStatus);
         const reply = await assembleOllama(events, req.onStream);
         const notice = stopNotice(reply);

package/dist/providers/openai-codex.js

@@ -72,7 +72,7 @@ export const openaiCodex = {
                 include: ["reasoning.encrypted_content"],
                 prompt_cache_key: SESSION_ID,
             }, req.maxTokens, req.signal, req.onStatus);
-            const data = await assembleOpenAI(events, req.onStream);
+            const data = await assembleOpenAI(events, req.onStream, req.onStatus);
             const notice = stopNotice(data);
             if (notice !== undefined)
                 req.onStream?.({ kind: "text", text: `\n${notice}` });