@hncode/hncode 0.3.4 → 0.3.5

package/README.md

@@ -118,12 +118,13 @@ Special thanks to the communities behind these projects for pushing the boundari
 
 ## 📄 License
 
-This project is licensed under the [GNU General Public License v3.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE).
+This project is licensed under the [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE).
 
 **In short:**
-1. ✅ You can freely use, modify, and share this code
-2. ✅ Must retain author attribution (NiceHello666) and link back to this repository
-3. ❌ Cannot be used for commercial purposes (e.g., selling, as part of paid products)
+1. ✅ Free for noncommercial use — personal projects, learning, research, hobby work, and noncommercial organizations
+2. ✅ You may modify and share it, provided you keep the license text and the noncommercial notice with any copy
+3. ❌ No commercial use of any kind (selling it, shipping it inside a paid product, or using it to run a commercial service)
+4. ℹ️ This is *not* a copyleft license: your own additions do not have to be published. Commercial use requires a separate license from the author.
 
 ---
 

package/README_CN.md

@@ -75,12 +75,13 @@ hncode 从以下几个优秀项目中汲取了灵感：
 
 ## 📄 许可证
 
-本项目的许可受 [GNU General Public License v3.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE) 保护。
+本项目的许可受 [PolyForm Noncommercial License 1.0.0](https://github.com/NiceHello666/hncode/blob/main/LICENSE) 保护。
 
 **简单来说:**
-1. ✅ 你可以自由使用、修改和分享此代码
-2. ✅ 必须保留原作者署名（NiceHello666）并链接回此仓库
-3. ❌ 不得用于商业目的（例如出售、作为付费产品的一部分）
+1. ✅ 非商业用途免费——个人项目、学习、研究、业余爱好，以及非商业组织
+2. ✅ 可以修改和分享，但任何副本都必须附带许可证全文和「不得商用」的声明
+3. ❌ 禁止任何形式的商业使用（出售、作为付费产品的一部分、或用于运营商业服务）
+4. ℹ️ 这**不是** copyleft 许可：你自己新增的部分无需开源。商业使用需向作者单独获取授权。
 
 ---
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hncode/hncode",
-  "version": "0.3.4",
+  "version": "0.3.5",
   "description": "hncode — A cyan-blue TUI AI coding agent with zero runtime dependencies.",
   "type": "module",
   "main": "src/index.js",
@@ -22,7 +22,7 @@
   "engines": {
     "node": ">=20"
   },
-  "license": "GPL-3.0-only",
+  "license": "PolyForm-Noncommercial-1.0.0",
   "author": "NiceHello666",
   "keywords": [
     "cli",

package/src/config.js

@@ -383,7 +383,7 @@ export function setConfigString(key, value) {
       const opensMultiline = /^"""|^'''/.test(rest) && !/^"""[\s\S]*"""\s*$/.test(rest);
       if (opensMultiline) skipping = true;
       if (!replaced && value !== '' && value != null) {
-        out.push(...renderTomlString(key, String(value)));
+        out.push(...renderTomlString(key, String(value)).split('\n'));
         replaced = true;
       }
       continue;
@@ -392,9 +392,9 @@ export function setConfigString(key, value) {
   }
   while (out.length && out[out.length - 1].trim() === '') out.pop();
   if (!replaced && value !== '' && value != null) {
-    // Insert new root-level keys BEFORE the first [table] section so they
-    // are parsed as root keys, not assigned to a table.
-    const rendered = renderTomlString(key, String(value));
+    // Insert new root-level keys BEFORE the first [table] section so they are
+    // parsed as root keys, not assigned to a table.
+    const rendered = renderTomlString(key, String(value)).split('\n');
     if (firstTableIdx >= 0) {
       out.splice(firstTableIdx, 0, '', ...rendered);
     } else {
@@ -409,13 +409,26 @@ export function setConfigString(key, value) {
 
 // Render `key = <value>` as TOML. Uses a multi-line basic string when the value
 // contains newlines (readable, and TOML-valid), a plain one otherwise.
+//
+// Layout matters: TOML DISCARDS the newline immediately after `"""`, so the
+// value begins on the following line and the closing `"""` must butt up against
+// the last character. The previous form (""" + \n + body + \n + """) parsed back
+// as `value + '\n'`, and because setConfigString writes back whatever it read,
+// every read→write cycle appended another newline (a system prompt gained a
+// blank line per edit).
+//
+//   key = """
+//   <value, verbatim>
+//   """
 function renderTomlString(key, value) {
   if (value.includes('\n')) {
     // Inside """…""" a backslash must be escaped; quotes are fine unless tripled.
     const body = value.replace(/\\/g, '\\\\').replace(/"""/g, '\\"\\"\\"');
-    return [`${key} = """`, ...body.split('\n'), '"""'];
+    // `"""` then a newline (discarded by the parser), then the value, then the
+    // closing delimiter on the same line as the value's last line.
+    return [`${key} = """`, ...body.split('\n')].join('\n') + '"""';
   }
-  return [`${key} = "${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`];
+  return `${key} = "${value.replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
 }
 
 // Append (or replace) a [providers.<name>] table in config.toml without
@@ -425,21 +438,30 @@ export function addProvider(name, { base_url, api_key, protocol } = {}) {
   let text = '';
   try { text = fs.readFileSync(file, 'utf8'); } catch { /* new file */ }
   const lines = text.split(/\r?\n/);
-  // drop any existing [providers.<name>] block (and its key lines) so we replace it
+  // Drop any existing [providers.<name>] block (and its key lines) so it is
+  // replaced rather than duplicated. Accepts the BARE and QUOTED header forms
+  // (this function writes the quoted one) and unescapes before comparing.
+  const unq = (s) => String(s).replace(/\\(.)/g, '$1');
+  const provRe = /^\s*\[providers\.\s*(?:"((?:[^"\\]|\\.)*)"|([^\]]+))\s*\]\s*$/;
   const out = [];
   let skipping = false;
   for (const ln of lines) {
-    const m = /^\s*\[providers\.([^\]]+)\]\s*$/.exec(ln);
-    if (m) { skipping = m[1] === name; if (skipping) continue; }
+    const m = provRe.exec(ln);
+    if (m) { skipping = unq(m[1] !== undefined ? m[1] : m[2]) === name; if (skipping) continue; }
     else if (/^\s*\[/.test(ln)) skipping = false;
     if (!skipping) out.push(ln);
   }
   while (out.length && out[out.length - 1].trim() === '') out.pop();
   out.push('');
-  out.push(`[providers.${name}]`);
-  if (base_url) out.push(`base_url = "${String(base_url).replace(/"/g, '\\"')}"`);
-  if (api_key) out.push(`api_key = "${String(api_key).replace(/"/g, '\\"')}"`);
-  if (protocol) out.push(`protocol = "${String(protocol).replace(/"/g, '\\"')}"`);
+  // Escape backslashes BEFORE quotes (the other order double-escapes), and quote
+  // the table key too. Raw interpolation meant a provider name or URL holding a
+  // backslash or a quote wrote invalid TOML and broke the ENTIRE config file —
+  // every later launch failed until it was repaired by hand.
+  const q = (v) => `"${String(v).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+  out.push(`[providers.${q(name)}]`);
+  if (base_url) out.push(`base_url = ${q(base_url)}`);
+  if (api_key) out.push(`api_key = ${q(api_key)}`);
+  if (protocol) out.push(`protocol = ${q(protocol)}`);
   fs.mkdirSync(path.dirname(file), { recursive: true });
   fs.writeFileSync(file, out.join('\n') + '\n', 'utf8');
   return file;
@@ -455,15 +477,25 @@ export function removeProvider(name) {
   const lines = text.split(/\r?\n/);
   const out = [];
   let skipping = false;
+  // Table headers may be BARE (`[providers.p]`) or QUOTED (`[providers."p"]`) —
+  // addProvider now quotes them so a name containing a quote or backslash stays
+  // valid TOML. Match both and unescape before comparing: with the quoted form
+  // the old bare-only regex captured `"p"` (quotes included), `=== name` never
+  // held, and removeProvider silently deleted nothing.
+  const unq = (s) => String(s).replace(/\\(.)/g, '$1');
+  const provRe = /^\s*\[providers\.\s*(?:"((?:[^"\\]|\\.)*)"|([^\]]+))\s*\]\s*$/;
   // A models key is `[models."provider/modelId"]`; match the provider prefix.
-  const modelRe = /^\s*\[models\."([^"]+)"\]\s*$/;
+  const modelRe = /^\s*\[models\.\s*"((?:[^"\\]|\\.)*)"\s*\]\s*$/;
   for (const ln of lines) {
-    const pm = /^\s*\[providers\.([^\]]+)\]\s*$/.exec(ln);
-    if (pm) { skipping = pm[1] === name; if (skipping) continue; }
+    const pm = provRe.exec(ln);
+    if (pm) {
+      skipping = unq(pm[1] !== undefined ? pm[1] : pm[2]) === name;
+      if (skipping) continue;
+    }
     const mm = modelRe.exec(ln);
     if (mm) {
       // The model key starts with `<provider>/`; skip it if it is this provider's.
-      const keyProvider = mm[1].split('/')[0];
+      const keyProvider = unq(mm[1]).split('/')[0];
       skipping = keyProvider === name;
       if (skipping) continue;
     } else if (/^\s*\[/.test(ln)) {
@@ -490,8 +522,14 @@ export function addModel(provider, modelId, opts = {}) {
   try { text = fs.readFileSync(file, 'utf8'); } catch {}
   const key = modelKey(provider, modelId);
   if (new RegExp(`^\\s*\\[models\\."${escapeRe(key)}"\\]`, 'm').test(text)) return file; // already there
-  const lines = [`[models."${key}"]`, `provider = "${provider}"`, `model = "${modelId}"`];
-  if (opts.display_name) lines.push(`display_name = "${String(opts.display_name).replace(/"/g, '\\"')}"`);
+  // EVERY interpolated string is escaped. These were written raw, so a model id
+  // (or provider) containing a quote or backslash produced malformed TOML and
+  // the ENTIRE config file stopped parsing — every later launch then failed
+  // until the file was repaired by hand. Provider ids and model ids come from
+  // remote APIs, so they are not trusted input.
+  const q = (v) => `"${String(v).replace(/\\/g, '\\\\').replace(/"/g, '\\"')}"`;
+  const lines = [`[models.${q(key)}]`, `provider = ${q(provider)}`, `model = ${q(modelId)}`];
+  if (opts.display_name) lines.push(`display_name = ${q(opts.display_name)}`);
   // Persist the context window discovered from /v1/models so resolveConfig can
   // size the context bar per model (not a global 128k).
   if (opts.contextLength) lines.push(`context_length = ${Number(opts.contextLength)}`);

package/src/llm.js

@@ -12,7 +12,9 @@ import { effortWire } from './config.js';
 import { applyPromptCache } from './cache.js';
 
 export function openAiToolDefs(tools) {
-  return tools.map((t) => ({
+  // Guard: a caller that passes null/undefined (e.g. setToolsList(null)) used to
+  // throw on `.map`, failing the whole request. An empty tool list is valid.
+  return (Array.isArray(tools) ? tools : []).map((t) => ({
     type: 'function',
     function: {
       name: t.name,
@@ -23,7 +25,7 @@ export function openAiToolDefs(tools) {
 }
 
 export function anthropicToolDefs(tools) {
-  return tools.map((t) => ({
+  return (Array.isArray(tools) ? tools : []).map((t) => ({
     name: t.name,
     description: t.description,
     input_schema: t.parameters,
@@ -120,7 +122,9 @@ function buildBody(cfg, messages, streaming = true) {
 
 // tool list used for defs (injected via setTools)
 let llmToolsList = [];
-export function setToolsList(list) { llmToolsList = list; }
+// Only ever store an array: `null`/undefined here would make every later request
+// throw when the defs are built.
+export function setToolsList(list) { llmToolsList = Array.isArray(list) ? list : []; }
 
 export class LLM {
   constructor(cfg) {

package/src/plugin.js

@@ -152,17 +152,19 @@ export async function loadPlugins(dir) {
         continue;
       }
 
-      // Metadata comes from the default export. `name` there is a plain STRING
-      // (`export default { name: 'recorder' }`), so reading `meta.name` off it
-      // returned undefined and the plugin showed up as its FILENAME with version
-      // 0.0.0 — /plugins listed every plugin under the wrong name. Accept both
-      // shapes: a string name, or an object carrying { name, version }.
+      // Metadata can arrive three ways, and all three are in the wild:
+      //   export default { name: 'x', version: '1' }   (object)
+      //   export default 'x'                            (plain string)
+      //   export const meta = { name: 'x' }             (named export)
+      // Only the default export used to be read, so a plugin using the named form
+      // showed up as its FILENAME with version 0.0.0 in /plugins. Check them all.
       const def = (mod && mod.default) || {};
-      const meta = typeof def === 'string' ? { name: def } : def;
+      const defMeta = typeof def === 'string' ? { name: def } : def;
+      const namedMeta = (mod && mod.meta) || {};
       const plugin = {
         id: f,
-        name: meta.name || meta.meta?.name || f,
-        version: meta.version || meta.meta?.version || '0.0.0',
+        name: defMeta.name || defMeta.meta?.name || namedMeta.name || namedMeta.meta?.name || f,
+        version: defMeta.version || defMeta.meta?.version || namedMeta.version || namedMeta.meta?.version || '0.0.0',
       };
       loadedPlugins.push(plugin);
       installFn(API);

package/src/term.js

@@ -50,13 +50,47 @@ export function strWidth(s) {
 // renders East Asian / wide / some symbol glyphs as 2 columns. Must be used for any
 // cursor positioning and line wrapping so an I-shaped (insert) caret lines up.
 // Source of truth: Unicode wide ranges + a small set of CJK-fused symbol glyphs.
+//
+// PERFORMANCE (this is the hottest function in the whole TUI — a profile of a
+// 500-message transcript streaming markdown put ~48% of samples in this plus
+// clusterWidth/clusterGlyphWidth/isWideByDefault):
+//   * a printable-ASCII fast path returns the length immediately. Agent output
+//     is overwhelmingly ASCII, and measuring it cost ~30 range comparisons per
+//     character for nothing. 1MB of ASCII went from 219ms to ~0.
+//   * everything else is memoised (see WIDTH_CACHE_MAX). Rows are re-measured
+//     every frame while a reply streams, and the same substrings come back
+//     again and again.
 export function visualWidth(s) {
   if (!s) return 0;
-  // Measured per GRAPHEME CLUSTER (see clusterWidth): summing charWidth per
-  // codepoint made a ZWJ emoji sequence count 8 columns instead of 2.
-  return clusterWidth(s);
+  const str = typeof s === 'string' ? s : String(s);
+  // Fast path: printable ASCII measures exactly its length.
+  if (isPrintableAscii(str)) return str.length;
+  const hit = widthCache.get(str);
+  if (hit !== undefined) return hit;
+  const w = clusterWidth(str);
+  if (widthCache.size >= WIDTH_CACHE_MAX) {
+    // Cheap eviction: drop the oldest insertion (Map preserves order).
+    const oldest = widthCache.keys().next().value;
+    if (oldest !== undefined) widthCache.delete(oldest);
+  }
+  widthCache.set(str, w);
+  return w;
+}
+
+// All code units printable ASCII? `\t`/newline/escape all fail, which is what we
+// want: those have their own width rules (tab = 4, ESC starts an ANSI sequence).
+function isPrintableAscii(str) {
+  for (let i = 0; i < str.length; i++) {
+    const c = str.charCodeAt(i);
+    if (c < 0x20 || c > 0x7e) return false;
+  }
+  return true;
 }
 
+const WIDTH_CACHE_MAX = 4096;
+const widthCache = new Map();
+
+
 // ---- East Asian Width tables (Unicode 15) --------------------------------
 // Wide/Fullwidth ranges -> 2 columns. Everything else is 1 unless it is a
 // zero-width character (see ZERO_WIDTH) or emoji presentation (see below).
@@ -151,69 +185,69 @@ export function charWidth(ch) {
   // Tab renders as 4 spaces in most terminals.
   if (c === 0x09) return 4;
   if (c < 0x20 || c === 0x7F) return 0;
+  // FAST PATH: plain printable ASCII is exactly one cell wide. Without this each
+  // ASCII character paid for isZeroWidth + isWideByDefault (≈30 range tests) + a
+  // binary search, which is most of what made width measurement the hottest
+  // function in the TUI.
+  if (c >= 0x20 && c <= 0x7e) return 1;
   if (isZeroWidth(c)) return 0;
   if (isWideByDefault(c)) return 2;
   if (inRanges(c, WIDE)) return 2;
   return 1;
 }
 
-// Split a string into grapheme clusters that a terminal renders as ONE glyph.
-// Minimal but covers what actually appears in agent output: ZWJ sequences
-// (👨‍👩‍👧), variation selectors (❤️), and flag pairs (🇺🇸).
-function nextCluster(s, i) {
-  // NOTE: every offset here is a UTF-16 INDEX (what slice() consumes). Mixing
-  // in codepoint offsets desynced the scan across surrogate pairs, so a ZWJ
-  // family measured 5 columns instead of 2.
-  const at = (idx) => s.codePointAt(idx);
-  const len = (cp) => cp > 0xFFFF ? 2 : 1;
-
-  const firstCp = at(i);
-  let end = i + len(firstCp);
-  const startedRegional = isRegional(firstCp);
-
-  for (;;) {
-    if (end >= s.length) break;
-    const cp = at(end);
-    if (cp === 0x200D) {                       // ZWJ: absorb the next base too
-      end += 1;
-      if (end >= s.length) break;
-      end += len(at(end));
-      continue;
-    }
-    if (isZeroWidth(cp) || cp === 0xFE0F) { end += len(cp); continue; }
-    // A regional-indicator PAIR forms one flag glyph.
-    if (startedRegional && isRegional(cp)) { end += len(cp); break; }
-    break;
-  }
-  return { text: s.slice(i, end), next: end };
-}
+// Shared native segmenter. `Intl.Segmenter` implements the full Unicode
+// grapheme-break algorithm in native code, so it is both more correct than the
+// hand-rolled scanner it replaces (ZWJ families, flags, combining marks) and
+// much cheaper — that scanner allocated a `{text, next}` object per character,
+// which showed up as GC pressure in profiles.
+const graphemeSegmenter = typeof Intl !== 'undefined' && typeof Intl.Segmenter === 'function'
+  ? new Intl.Segmenter(undefined, { granularity: 'grapheme' })
+  : null;
 
 // Width of a whole string measured by GRAPHEME CLUSTER: a ZWJ sequence or a
 // flag counts 2 columns total, not the sum of its codepoints (which used to
 // make 👨‍👩‍👧 measure 8 columns and break every row it appeared on).
 export function clusterWidth(s) {
   const str = String(s || '');
+  if (!str) return 0;
   let w = 0;
-  for (let i = 0; i < str.length;) {
-    const { text, next } = nextCluster(str, i);
-    i = next;
-    if (!text) { i++; continue; }
-    w += clusterGlyphWidth(text);
+  if (graphemeSegmenter) {
+    // NOTE: an "ASCII runs are free" split was tried here and made things WORSE
+    // (a 500KB markdown string went 97ms -> 544ms): slicing the string into a
+    // run per CJK character costs far more than handing the whole thing to the
+    // native segmenter. The real win is the printable-ASCII fast path in
+    // visualWidth() plus the memo cache, not micro-splitting here.
+    for (const { segment } of graphemeSegmenter.segment(str)) w += clusterGlyphWidth(segment);
+    return w;
   }
+  // Fallback for a runtime without Intl.Segmenter: per code point.
+  for (const ch of str) w += clusterGlyphWidth(ch);
   return w;
 }
+// Width of one grapheme cluster. Allocation-free on the common path: a
 
+// Width of one grapheme cluster. Allocation-free on the common path: a
+// single-code-point cluster (every ASCII character, most CJK) returns
+// charWidth directly instead of first building an array of code points.
 function clusterGlyphWidth(cluster) {
-  const cps = [...cluster].map((c) => c.codePointAt(0));
+  const first = cluster.codePointAt(0);
+  if (first === undefined) return 0;
+  if (cluster.length <= (first > 0xFFFF ? 2 : 1)) return charWidth(cluster);
+
+  const cps = [];
+  for (let i = 0; i < cluster.length;) {
+    const cp = cluster.codePointAt(i);
+    cps.push(cp);
+    i += cp > 0xFFFF ? 2 : 1;
+  }
   // ZWJ sequence / flag pair / VS16-presented symbol => 2 columns.
   if (cps.includes(0x200D)) return 2;
-  if (cps.filter(isRegional).length >= 1) return 2;
-  const base = cps[0];
+  if (cps.some(isRegional)) return 2;
   if (cps.includes(0xFE0F)) return 2;          // explicit emoji presentation
-  const baseW = charWidth(String.fromCodePoint(base));
-  let extra = 0;
-  for (let k = 1; k < cps.length; k++) extra += charWidth(String.fromCodePoint(cps[k]));
-  return baseW + extra;
+  let width = charWidth(String.fromCodePoint(cps[0]));
+  for (let k = 1; k < cps.length; k++) width += charWidth(String.fromCodePoint(cps[k]));
+  return width;
 }
 
 // Estimate the LLM token count of a plain string, matching kimi-code's
@@ -264,7 +298,11 @@ export function expandTabs(s, tabSize = 8) {
       continue;
     }
     out += ch;
-    col += clusterWidth(ch);
+    // Per CHARACTER, `charWidth` is the right measure and is far cheaper than
+    // clusterWidth here: the loop already iterates code points (so a surrogate
+    // pair arrives as a single `ch`), and clusterWidth would spin up the
+    // segmenter for every single character.
+    col += charWidth(ch);
   }
   return out;
 }