@giovannijecha/jecode 0.8.4 → 0.8.5

package/README.md

@@ -37,11 +37,12 @@ follow tool calls and diffs, steer the model while it runs, and resume the same
 conversation later. One controller carries each turn from prompt to result—no
 delegated agents or hidden model workers.
 
-Choose Anthropic, OpenAI, an eligible ChatGPT account, or Ollama without
-changing the workflow. Jecode is written in TypeScript and released as plain
-JavaScript for Node.js, with no installation scripts and zero third-party
-runtime dependencies. The runtime stays small enough to inspect, understand,
-and change.
+Choose Anthropic API, OpenAI API, an eligible ChatGPT account, or Ollama without
+changing the workflow. API connections and account access stay separate, and
+the footer always names the route selected for the next request. Jecode is
+written in TypeScript and released as plain JavaScript for Node.js, with no
+installation scripts and zero third-party runtime dependencies. The runtime
+stays small enough to inspect, understand, and change.
 
 ## Quick start
 
@@ -71,7 +72,8 @@ jecode
 ```
 
 Jecode opens directly on an empty composer. Use `/providers` to connect a
-service, `/models` to choose a model, then describe the work you want done.
+service and `/models` to select both the model and the connection that will run
+it, then describe the work you want done.
 
 ```text
 Review this project, explain its architecture, and propose the smallest safe

package/dist/accounts.js

@@ -1,10 +1,10 @@
 // OAuth accounts persisted under ~/.jecode, apart from API keys.
-import { chmod, mkdir } from "node:fs/promises";
 import * as path from "node:path";
 import { atomicWrite } from "./atomic.js";
+import { assertDirectoryAnchor, captureDirectDirectorySync, preparePrivateDirectory, } from "./directory-anchor.js";
 import { withStoreLock } from "./store-lock.js";
 import { userDataLabel, userDataPath } from "./user-data.js";
-import { assertStoreText, readBoundedJsonSync, USER_STORE_LIMITS } from "./user-store.js";
+import { assertStoreText, readBoundedJsonForMutationSync, readBoundedJsonSync, USER_STORE_LIMITS, } from "./user-store.js";
 let cached;
 export function openAICodexAccount() {
     const account = store().accounts["openai-codex"];
@@ -33,11 +33,10 @@ export function accountsLabel() {
 export async function updateOpenAICodexAccount(change, signal) {
     const file = accountsPath();
     const directory = path.dirname(file);
-    await mkdir(directory, { recursive: true, mode: 0o700 });
-    if (process.platform !== "win32")
-        await chmod(directory, 0o700);
-    return withStoreLock(file, async () => {
-        const current = readStore(file);
+    const anchor = await preparePrivateDirectory(directory, "account store directory");
+    const anchoredFile = path.join(anchor.path, path.basename(file));
+    return withStoreLock(anchoredFile, async () => {
+        const current = readStoreForMutation(anchoredFile, anchor);
         const next = await change(current.accounts["openai-codex"]);
         const normalized = next === undefined ? undefined : normalizeOpenAI(next);
         if (next !== undefined && normalized === undefined)
@@ -50,10 +49,13 @@ export async function updateOpenAICodexAccount(change, signal) {
         const updated = { version: 1, accounts };
         const text = `${JSON.stringify(updated, null, 2)}\n`;
         assertStoreText(text, USER_STORE_LIMITS.accountsBytes);
-        await atomicWrite(file, text, { mode: 0o600 });
+        await atomicWrite(anchoredFile, text, {
+            mode: 0o600,
+            validate: async () => assertDirectoryAnchor(anchor),
+        });
         cached = updated;
         return normalized === undefined ? undefined : { ...normalized };
-    }, signal);
+    }, signal, async () => assertDirectoryAnchor(anchor));
 }
 export function reloadAccounts() {
     cached = undefined;
@@ -65,12 +67,43 @@ function store() {
 }
 function readStore(file) {
     try {
-        return normalize(readBoundedJsonSync(file, USER_STORE_LIMITS.accountsBytes));
+        const directory = captureDirectDirectorySync(path.dirname(file), "account store directory");
+        const anchoredFile = path.join(directory.path, path.basename(file));
+        return normalize(readBoundedJsonSync(anchoredFile, USER_STORE_LIMITS.accountsBytes, directory));
     }
     catch {
         return { version: 1, accounts: {} };
     }
 }
+function readStoreForMutation(file, directory) {
+    const value = readBoundedJsonForMutationSync(file, USER_STORE_LIMITS.accountsBytes, "account store", directory);
+    if (value === undefined)
+        return { version: 1, accounts: {} };
+    if (!record(value) || value["version"] !== 1 || !record(value["accounts"]) ||
+        hasUnknownKeys(value, ["version", "accounts"])) {
+        throw new Error("account store has an unsupported structure");
+    }
+    const accounts = value["accounts"];
+    if (Object.keys(accounts).some((name) => name !== "openai-codex")) {
+        throw new Error("account store has an unsupported structure");
+    }
+    const raw = accounts["openai-codex"];
+    if (raw === undefined)
+        return { version: 1, accounts: {} };
+    if (!record(raw) || hasUnknownKeys(raw, [
+        "accessToken",
+        "refreshToken",
+        "expiresAt",
+        "accountId",
+        "email",
+        "plan",
+    ]))
+        throw new Error("account store has an unsupported structure");
+    const account = normalizeOpenAI(raw);
+    if (account === undefined)
+        throw new Error("account store has an invalid OpenAI account");
+    return { version: 1, accounts: { "openai-codex": account } };
+}
 function normalize(value) {
     if (!record(value) || value["version"] !== 1 || !record(value["accounts"])) {
         return { version: 1, accounts: {} };
@@ -112,3 +145,7 @@ function nonempty(value, max) {
 function record(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+function hasUnknownKeys(value, known) {
+    const allowed = new Set(known);
+    return Object.keys(value).some((key) => !allowed.has(key));
+}

package/dist/atomic.js

@@ -1,8 +1,9 @@
-// Crash-safe replacement of one file, using a verified temporary sibling and
-// rename.
+// Process-crash-safe replacement of one file, using a verified temporary
+// sibling and rename. POSIX also receives a best-effort parent-directory sync.
 import { lstat, open, rename, rm, stat } from "node:fs/promises";
 import { randomUUID } from "node:crypto";
 import * as path from "node:path";
+import { fileIdentity, sameFileIdentity } from "./file-identity.js";
 export async function atomicWrite(file, content, options = {}) {
     const temporary = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.${randomUUID()}.tmp`);
     let handle;
@@ -14,7 +15,7 @@ export async function atomicWrite(file, content, options = {}) {
         const permissions = options.mode ?? (await existingMode(file));
         throwIfAborted(options.signal);
         handle = await open(temporary, "wx", permissions);
-        identity = fileIdentity(await handle.stat());
+        identity = fileIdentity(await handle.stat({ bigint: true }));
         throwIfAborted(options.signal);
         await options.validate?.("before-write");
         throwIfAborted(options.signal);
@@ -26,7 +27,7 @@ export async function atomicWrite(file, content, options = {}) {
         }
         await handle.sync();
         throwIfAborted(options.signal);
-        identity = fileIdentity(await handle.stat());
+        identity = fileIdentity(await handle.stat({ bigint: true }));
         await options.validate?.("before-rename");
         throwIfAborted(options.signal);
         await assertNamedFile(temporary, identity);
@@ -35,6 +36,7 @@ export async function atomicWrite(file, content, options = {}) {
         const completed = handle;
         handle = undefined;
         await completed.close().catch(() => undefined);
+        await syncParentDirectory(file);
     }
     catch (error) {
         if (handle !== undefined) {
@@ -47,14 +49,30 @@ export async function atomicWrite(file, content, options = {}) {
         throw error;
     }
 }
+async function syncParentDirectory(file) {
+    if (process.platform === "win32")
+        return;
+    let directory;
+    try {
+        directory = await open(path.dirname(file), "r");
+        await directory.sync();
+    }
+    catch {
+        // The rename is already committed and some filesystems do not support
+        // directory fsync. Do not report a successful replacement as failed.
+    }
+    finally {
+        await directory?.close().catch(() => undefined);
+    }
+}
 function throwIfAborted(signal) {
     if (signal?.aborted !== true)
         return;
     throw signal.reason instanceof Error ? signal.reason : new Error("interrupted");
 }
 async function assertNamedFile(file, expected) {
-    const details = await lstat(file);
-    if (details.isSymbolicLink() || !sameFile(expected, fileIdentity(details))) {
+    const details = await lstat(file, { bigint: true });
+    if (details.isSymbolicLink() || !sameFileIdentity(expected, fileIdentity(details))) {
         throw new Error("atomic write target changed during replacement");
     }
 }
@@ -70,14 +88,6 @@ async function removeTemporary(file, expected, validate) {
         // A changed path is no longer ours to remove.
     }
 }
-function fileIdentity(details) {
-    return { dev: details.dev, ino: details.ino, birthtimeMs: details.birthtimeMs };
-}
-function sameFile(left, right) {
-    if (left.dev !== right.dev || left.ino !== right.ino)
-        return false;
-    return left.ino !== 0 || left.birthtimeMs === right.birthtimeMs;
-}
 async function existingMode(file) {
     if (process.platform === "win32")
         return undefined;

package/dist/batch.js

@@ -5,6 +5,7 @@
 import { stdin, stdout } from "node:process";
 import { runTurn } from "./controller.js";
 import { resolveContextPolicy } from "./context/capacity.js";
+import { automaticCompactionGate, automaticCompactionKey, } from "./context/automatic.js";
 import { compactContext } from "./context/compactor.js";
 import { compactSession } from "./context/manual.js";
 import { isContextOverflow } from "./context/policy.js";
@@ -15,12 +16,15 @@ import { terminalText } from "./ui/terminal-text.js";
 import { recordAuxiliaryUsage, recordRequestInput, recordUsage } from "./usage.js";
 import { assertPromptLength, boundedInputLines } from "./input-boundary.js";
 import { providerFailure } from "./provider-errors.js";
+import { toolSpecs } from "./tools/index.js";
+import { requestIdentityForSession } from "./request-identity.js";
 export async function runBatch(session, environment = {}) {
     const write = environment.write ?? ((text) => stdout.write(text));
     const width = environment.width ?? columns();
     const signal = environment.signal;
     const source = environment.lines ?? boundedInputLines(stdin);
     const lines = abortableLines(source, signal);
+    const automaticCompaction = automaticCompactionGate();
     const emit = (block) => {
         for (const line of renderBatch(block, width, session.palette))
             write(`${line}\n`);
@@ -37,7 +41,15 @@ export async function runBatch(session, environment = {}) {
                 if ((await handleCommand(line, session, {
                     emit,
                     signal,
-                    compact: () => compactSession(session, { signal }),
+                    reset: () => {
+                        automaticCompaction.reset();
+                    },
+                    compact: async () => {
+                        const result = await compactSession(session, { signal });
+                        if (result === "compacted")
+                            automaticCompaction.reset();
+                        return result;
+                    },
                 })) === "exit")
                     break;
                 continue;
@@ -62,6 +74,7 @@ export async function runBatch(session, environment = {}) {
             history.push(user);
             modelHistory.push(structuredClone(user));
             const turn = events(emit, session);
+            const specs = toolSpecs(session.tools);
             const commit = (checkpoint, settlement) => {
                 session.conversation = session.conversation.commit({
                     ...(nodeId === undefined ? {} : { nodeId }),
@@ -83,7 +96,12 @@ export async function runBatch(session, environment = {}) {
                     (request.error === undefined || !isContextOverflow(request.error))) {
                     return undefined;
                 }
-                const force = request.reason === "overflow";
+                const force = request.reason === "overflow" || request.projectionSaturated;
+                const key = automaticCompactionKey(session.provider.id, session.model, nodeId ?? prospectiveNodeId, checkpoint.length);
+                const attempt = { key, reason: request.reason };
+                if (!automaticCompaction.allows(attempt))
+                    return undefined;
+                let attempted = false;
                 const result = await compactContext({
                     provider: session.provider,
                     model: session.model,
@@ -96,9 +114,22 @@ export async function runBatch(session, environment = {}) {
                     estimatedInputTokens: request.inputTokens,
                     force,
                     policy: request.policy,
+                    requestEnvelope: {
+                        system: session.system,
+                        tools: specs,
+                        maxOutputTokens: session.config.maxTokens,
+                    },
+                    requestIdentity: requestIdentityForSession(session),
+                    onBegin: () => {
+                        attempted = true;
+                    },
                 });
-                if (result === undefined)
+                if (result === undefined) {
+                    if (attempted && signal?.aborted !== true)
+                        automaticCompaction.failed(attempt);
                     return undefined;
+                }
+                automaticCompaction.succeeded(attempt);
                 context = result.anchor;
                 if (result.usage !== undefined)
                     recordAuxiliaryUsage(session.usage, result.usage);
@@ -111,6 +142,7 @@ export async function runBatch(session, environment = {}) {
                     reason: "budget",
                     policy: await policy(),
                     inputTokens: session.usage.lastInputTokens,
+                    projectionSaturated: false,
                 });
                 if (compacted !== undefined)
                     commit(checkpoint, settlement);
@@ -123,7 +155,7 @@ export async function runBatch(session, environment = {}) {
                 throwIfAborted(signal);
                 if (!(error instanceof Error))
                     throw error;
-                const message = providerFailure(session.provider, error);
+                const message = providerFailure(session.provider, error, true);
                 if (message === error.message)
                     throw error;
                 throw new Error(message, { cause: error });
@@ -186,6 +218,7 @@ function options(session, contextPolicy) {
         maxTokens: session.config.maxTokens,
         contextPolicy,
         effort: session.config.effort,
+        requestIdentity: requestIdentityForSession(session),
         maxModelRequests: session.config.maxModelRequests,
         toolContext: { root: session.config.root },
     };

package/dist/bounded-file.js

@@ -0,0 +1,212 @@
+// Descriptor-based reads for untrusted local files. Identity-sensitive
+// metadata stays bigint so NTFS file IDs cannot collide through rounding.
+import { constants } from "node:fs";
+import { closeSync, fstatSync, lstatSync, openSync, readSync, } from "node:fs";
+import { lstat, open } from "node:fs/promises";
+import { fileIdentity, sameFileIdentity } from "./file-identity.js";
+export class BoundedFileError extends Error {
+    kind;
+    constructor(kind, message) {
+        super(message);
+        this.name = "BoundedFileError";
+        this.kind = kind;
+    }
+}
+/**
+ * Run one reader against a verified regular-file descriptor, then confirm
+ * that the descriptor and named path still identify the same stable file.
+ */
+export async function withStableFile(file, options, reader) {
+    const label = options.label ?? "file";
+    requireOptionalLimit(options.maxBytes);
+    throwIfAborted(options.signal);
+    await options.validate?.();
+    const before = await lstat(file, { bigint: true });
+    requireRegular(before, label);
+    requireSize(before, options.maxBytes, label);
+    if (options.expected !== undefined && !sameExpectation(options.expected, before)) {
+        throw changed(label);
+    }
+    await options.beforeOpen?.();
+    await options.validate?.();
+    throwIfAborted(options.signal);
+    let handle;
+    try {
+        handle = await open(file, readFlags());
+    }
+    catch (error) {
+        if (unsafeOpenError(error))
+            throw changed(label);
+        throw error;
+    }
+    try {
+        const opened = await handle.stat({ bigint: true });
+        requireRegular(opened, label);
+        requireSize(opened, options.maxBytes, label);
+        if (!sameIdentity(before, opened))
+            throw changed(label);
+        await options.validate?.();
+        const value = await reader(handle, opened);
+        throwIfAborted(options.signal);
+        await options.validate?.();
+        const after = await handle.stat({ bigint: true });
+        let linked;
+        try {
+            linked = await lstat(file, { bigint: true });
+        }
+        catch (error) {
+            if (unsafeOpenError(error))
+                throw changed(label);
+            throw error;
+        }
+        if (!stableMetadata(opened, after) || !sameIdentity(opened, after) ||
+            linked.isSymbolicLink() || !linked.isFile() ||
+            !stableMetadata(opened, linked) || !sameIdentity(opened, linked))
+            throw changed(label);
+        await options.validate?.();
+        return value;
+    }
+    finally {
+        await handle.close();
+    }
+}
+/** Open, verify, and read one complete bounded regular file. */
+export async function readBoundedFile(file, maxBytes, options = {}) {
+    requireLimit(maxBytes);
+    return withStableFile(file, { ...options, maxBytes }, async (handle, opened) => {
+        const expected = Number(opened.size);
+        const capacity = Math.min(maxBytes + 1, Math.max(1, expected + 1));
+        const bytes = Buffer.allocUnsafe(capacity);
+        let offset = 0;
+        while (offset < capacity) {
+            throwIfAborted(options.signal);
+            const read = await handle.read(bytes, offset, capacity - offset, offset);
+            if (read.bytesRead === 0)
+                break;
+            offset += read.bytesRead;
+        }
+        if (offset > maxBytes || offset !== expected)
+            throw changed(options.label ?? "file");
+        return bytes.subarray(0, offset);
+    });
+}
+export async function readBoundedText(file, maxBytes, options = {}) {
+    return (await readBoundedFile(file, maxBytes, options)).toString("utf8");
+}
+export function stableFileExpectation(details) {
+    return Object.freeze({
+        identity: fileIdentity(details),
+        size: details.size,
+        mtimeNs: details.mtimeNs,
+        ctimeNs: details.ctimeNs,
+    });
+}
+/** Synchronous companion for tiny startup stores whose public APIs are sync. */
+export function readBoundedFileSync(file, maxBytes, options = "file") {
+    requireLimit(maxBytes);
+    const normalized = typeof options === "string" ? { label: options } : options;
+    const label = normalized.label ?? "file";
+    normalized.validate?.();
+    const before = lstatSync(file, { bigint: true });
+    requireRegular(before, label);
+    requireSize(before, maxBytes, label);
+    normalized.beforeOpen?.();
+    normalized.validate?.();
+    let descriptor;
+    try {
+        descriptor = openSync(file, readFlags());
+    }
+    catch (error) {
+        if (unsafeOpenError(error))
+            throw changed(label);
+        throw error;
+    }
+    try {
+        const opened = fstatSync(descriptor, { bigint: true });
+        requireRegular(opened, label);
+        requireSize(opened, maxBytes, label);
+        if (!sameIdentity(before, opened))
+            throw changed(label);
+        normalized.validate?.();
+        const expected = Number(opened.size);
+        const capacity = Math.min(maxBytes + 1, Math.max(1, expected + 1));
+        const bytes = Buffer.allocUnsafe(capacity);
+        let offset = 0;
+        while (offset < capacity) {
+            const count = readSync(descriptor, bytes, offset, capacity - offset, offset);
+            if (count === 0)
+                break;
+            offset += count;
+        }
+        normalized.afterRead?.();
+        const after = fstatSync(descriptor, { bigint: true });
+        let linked;
+        try {
+            linked = lstatSync(file, { bigint: true });
+        }
+        catch (error) {
+            if (unsafeOpenError(error))
+                throw changed(label);
+            throw error;
+        }
+        if (offset > maxBytes || offset !== expected ||
+            !stableMetadata(opened, after) || !sameIdentity(opened, after) ||
+            linked.isSymbolicLink() || !linked.isFile() ||
+            !stableMetadata(opened, linked) || !sameIdentity(opened, linked))
+            throw changed(label);
+        normalized.validate?.();
+        return bytes.subarray(0, offset);
+    }
+    finally {
+        closeSync(descriptor);
+    }
+}
+function readFlags() {
+    return process.platform === "win32"
+        ? "r"
+        : constants.O_RDONLY | (constants.O_NONBLOCK ?? 0) | (constants.O_NOFOLLOW ?? 0);
+}
+function requireRegular(details, label) {
+    if (details.isSymbolicLink() || !details.isFile()) {
+        throw new BoundedFileError("unsafe", `${label} must be a regular file`);
+    }
+}
+function requireSize(details, maxBytes, label) {
+    if (details.size < 0n || (maxBytes !== undefined && details.size > BigInt(maxBytes))) {
+        throw new BoundedFileError("too-large", `${label} exceeds ${maxBytes} bytes`);
+    }
+}
+function requireOptionalLimit(maxBytes) {
+    if (maxBytes !== undefined)
+        requireLimit(maxBytes);
+}
+function requireLimit(maxBytes) {
+    if (!Number.isSafeInteger(maxBytes) || maxBytes < 0 || maxBytes >= Number.MAX_SAFE_INTEGER) {
+        throw new RangeError("bounded file limit must be a non-negative safe integer");
+    }
+}
+function sameIdentity(left, right) {
+    return sameFileIdentity(fileIdentity(left), fileIdentity(right));
+}
+function stableMetadata(left, right) {
+    return left.size === right.size && left.mtimeNs === right.mtimeNs &&
+        left.ctimeNs === right.ctimeNs;
+}
+function sameExpectation(expected, current) {
+    return sameFileIdentity(expected.identity, fileIdentity(current)) &&
+        expected.size === current.size && expected.mtimeNs === current.mtimeNs &&
+        expected.ctimeNs === current.ctimeNs;
+}
+function unsafeOpenError(error) {
+    const code = error.code;
+    return code === "ENOENT" || code === "ELOOP" || code === "EISDIR" ||
+        code === "ENXIO" || code === "ENOTDIR";
+}
+function changed(label) {
+    return new BoundedFileError("changed", `${label} changed while it was being read`);
+}
+function throwIfAborted(signal) {
+    if (signal?.aborted !== true)
+        return;
+    throw signal.reason instanceof Error ? signal.reason : new Error("aborted");
+}

package/dist/commands.js

@@ -4,6 +4,7 @@
 // slash commands never become user messages. This file keeps discovery,
 // dispatch, and session operations outside the canonical transcript.
 import { ConversationTree } from "./conversation.js";
+import { resetRequestIdentity } from "./request-identity.js";
 import { modelsCommand } from "./model-command.js";
 import { providersCommand } from "./provider-commands.js";
 import { permissionsCommand } from "./permission-command.js";
@@ -48,6 +49,7 @@ export async function handleCommand(line, session, host) {
             return "exit";
         case "new":
             await host.reset?.();
+            resetRequestIdentity(session);
             session.conversation = ConversationTree.empty();
             session.usage = emptyUsage();
             host.emit({ kind: "notice", text: "new session", tone: "info" });

package/dist/config.js

@@ -36,7 +36,8 @@ export function loadConfig(argv, saved = readSettings()) {
             : { ollamaHost: parseOllamaEndpoint(ollamaHost).baseUrl }),
         reducedMotion: bool(flags["reduced-motion"], process.env.JECODE_REDUCED_MOTION, saved.reducedMotion ?? false),
         effort,
-        // Every request streams, so a large ceiling costs nothing in timeout risk.
+        // This is a ceiling, not a target. Request budgeting may lower it to fit
+        // the selected model, while provider rate and billing limits still apply.
         maxTokens: toInt(pick(flags["max-tokens"], process.env.JECODE_MAX_TOKENS, String(saved.maxTokens ?? 64000)), "max-tokens"),
         ...(maxModelRequests === undefined
             ? {}

package/dist/context/automatic.js

@@ -0,0 +1,35 @@
+// Process-local breaker for optional automatic compaction. It prevents an
+// unchanged provider projection from opening the same failing summary request
+// at consecutive checkpoint/request boundaries.
+const MAX_SETTLED_GENERATIONS = 4_096;
+export function automaticCompactionGate() {
+    const settled = new Set();
+    return Object.freeze({
+        allows(attempt) {
+            return !settled.has(settledKey(attempt));
+        },
+        failed(attempt) {
+            remember(settled, settledKey(attempt));
+        },
+        succeeded(attempt) {
+            remember(settled, settledKey(attempt));
+        },
+        reset() {
+            settled.clear();
+        },
+    });
+}
+function settledKey(attempt) {
+    return `${attempt.reason}\0${attempt.key}`;
+}
+function remember(settled, key) {
+    settled.add(key);
+    if (settled.size <= MAX_SETTLED_GENERATIONS)
+        return;
+    const oldest = settled.values().next().value;
+    if (oldest !== undefined)
+        settled.delete(oldest);
+}
+export function automaticCompactionKey(providerId, model, nodeId, canonicalMessages) {
+    return `${providerId}\0${model}\0${nodeId}\0${canonicalMessages}`;
+}