@kodax-ai/kodax 0.7.76 → 0.7.78

package/config-templates/config.example.jsonc

@@ -1,33 +1,115 @@
+// Split configs: ~/.kodax/integrations/mcp.json, extensions.json, and a2a.json.
 // KodaX core configuration template.
 // Copy only the fields you need to ~/.kodax/config.json (strict JSON).
 // MCP, A2A, and Extensions live in ~/.kodax/integrations/*.json; use
-// `kodax integrations migrate --dry-run` for legacy declarations.
+// `kodax integrations migrate` to preview legacy declarations.
 {
+  // Active provider alias and optional model override. Run `kodax setup` or
+  // `/model` instead of editing these manually when possible.
   // "provider": "deepseek",
-  // "model": "deepseek-v4",
+  // "model": "deepseek-v4-flash",
+  // Add or reorder model ids shown by `/model` for a provider.
+  // "providerModels": {
+  //   "deepseek": ["deepseek-v4-flash", "deepseek-v4-pro"]
+  // },
+
+  // Interactive Runtime hosting: "embedded" (this process) or "daemon".
   // "runtimeMode": "embedded",
+
+  // Native model reasoning. `effort` is the preferred explicit depth;
+  // `reasoningCeiling` is the session ceiling. `reasoningMode` and `thinking`
+  // remain accepted for backward compatibility.
   // "effort": "high",
+  // "planModeEffort": "high",
+  // "reasoningCeiling": "auto",
+  // "reasoningMode": "auto",
+  // "thinking": true,
+
+  // Agent harness: "ama" enables adaptive multi-agent use; "sa" forces one
+  // agent. Permission mode is "plan", "accept-edits", or classifier-backed
+  // "auto".
   // "agentMode": "ama",
   // "permissionMode": "accept-edits",
+  // User-level Bash allow patterns. Project additions belong in
+  // <project>/.kodax/config.local.json. Broad Bash(*) is rejected.
+  // "alwaysAllowTools": ["Bash(npm test)", "Bash(git status:*)"],
+  // "autoMode": {
+  //   "engine": "llm",
+  //   "classifierModel": "provider:model",
+  //   "timeoutMs": 20000,
+  //   "speculativeWindowMs": 500
+  // },
+
+  // UI/manual locale.
   // "locale": "zh",
+
+  // Custom providers store public connection metadata only. Put the actual
+  // credential in the named environment variable, never in this file. Use
+  // `kodax setup --custom` for the guided writer.
   // "customProviders": [
   //   {
   //     "name": "my-relay",
-  //     "protocol": "openai",
+  //     "protocol": "openai",
   //     "baseUrl": "https://api.example.com/v1",
   //     "apiKeyEnv": "MY_RELAY_API_KEY",
   //     "model": "provider/model",
-  //     "reasoning": { "efforts": ["off", "low", "high"], "default": "high" }
+  //     "models": ["provider/model", "provider/fast-model"],
+  //     "reasoning": { "efforts": ["off", "low", "high"], "default": "high" },
+  //     "userAgentMode": "compat",
+  //     "contextWindow": 128000,
+  //     "maxOutputTokens": 8192,
+  //     "thinkingBudgetCap": 32000,
+  //     "promptCacheAffinity": false,
+  //     "replayReasoningContent": false,
+  //     "strictThinkingSignature": false,
+  //     "streamMaxDurationMs": 300000,
+  //     "verifyStrategy": "models-list"
   //   }
   // ],
+
+  // Repository intelligence. Mode: "auto", "full", "light", or "off".
   // "repoIntelligenceMode": "auto",
+  // "repoIntelligenceTrace": false,
+  // "repoIntelligence": {
+  //   "toolWaitMs": 250,
+  //   "workerTimeoutMs": 30000,
+  //   "workerOldSpaceMb": 1024,
+  //   "storageDir": "~/.kodax/repo-intelligence"
+  // },
+
+  // Runtime/provider diagnostics and timeouts.
+  // "streamIdleTimeoutMs": 120000,
+  // "verifierLog": false,
+  // "stallLog": false,
+
+  // Ordered provider fallback for child tasks and optional model tiers used by
+  // workflow/dispatch model hints.
+  // "fallbackProviders": ["ark-coding", "kimi-code"],
+  // "fastProvider": "openai",
+  // "fastModel": "gpt-5-mini",
+  // "deepProvider": "anthropic",
+  // "deepModel": "claude-opus-4-6",
+
+  // Provider/LSP/ACP process settings.
+  // "maxOutputTokens": 8192,
+  // "disablePromptCache": false,
+  // "lsp": true,
+  // "lspAutoDownload": false,
+  // "acpLogLevel": "info",
+
   // Automatic large compaction is always enabled. Percentage defaults to 75
   // and is clamped to 15..90. A missing/zero absolute threshold is inactive;
   // otherwise the smaller percentage, absolute, and physical limit wins.
   // "compaction": {
+  //   "enabled": true,
+  //   "contextWindow": 128000,
   //   "triggerPercent": 75,
   //   "triggerTokens": 0
   // },
+
+  // 0 disables automatic session pruning.
   // "sessionRetentionDays": 0,
+
+  // Workflow host concurrency. The Runtime still applies its system cap.
   // "workflow": { "maxConcurrency": 8 }
 }

package/config-templates/integrations/a2a.example.jsonc

@@ -1,98 +1,98 @@
-// Bidirectional A2A configuration: ~/.kodax/integrations/a2a.json.
-// `agents` calls many third-party Agents. The optional singleton `server`
-// exposes exactly one KodaX general task Agent; ACP remains the coding/editor
-// protocol. Uncomment only the entries you need; no token value belongs here.
-// Legacy version 1 files remain readable. Non-empty files require an explicit
-// stopped-daemon migration; new/empty files and every later write use version 2.
-{
-  "version": 2,
-
-  // Create this inbound block with `kodax a2a expose`; config never starts a
-  // listener by itself. Do not copy private Agent instructions, Runtime Skills,
-  // model names, or local paths into the public `published.skills` list.
-  // Managed workspaces default below
-  // ~/kodax_a2a_server_workspace/<runtime-profile>/contexts/<context-key>/.
-  // Native read/grep/glob remains available according to workspace access.
-  // Arbitrary shell is never exposed. Skill instructions/assets need no
-  // process authority. An exact checked-in scripts/... entry requires
-  // process="isolated", skillScripts admission, and `kodax sandbox doctor`.
-  // ASRT receives no KodaX credentials or ambient ~/.srt-settings.json and its
-  // script quota is observed; hostile tenants also require an outer container/VM.
-  //
-  // "server": {
-  //   "execution": {
-  //     "kind": "local-agent",
-  //     "agentRef": { "source": "markdown:user", "name": "report-agent" },
-  //     "workspace": { "mode": "managed" },
-  //     "toolPolicy": {
-  //       "workspace": "write",
-  //       "process": "deny",
-  //       "network": { "mode": "deny" },
-  //       "tools": [],
-  //       "mcp": {},
-  //       "skillScripts": {},
-  //       "subagents": "deny"
-  //     }
-  //   },
-  //   "published": {
-  //     "name": "KodaX Agent",
-  //     "description": "Completes approved general tasks.",
-  //     "version": "0.7.71",
-  //     "skills": [{ "id": "general", "name": "General", "description": "Complete general tasks.", "tags": [] }],
-  //     "inputModes": ["text/plain"],
-  //     "outputModes": ["text/plain"]
-  //   },
-  //   "authentication": { "type": "bearer-env", "tokenEnv": "KODAX_A2A_TOKEN", "principalId": "configured-client" },
-  //   "dataDir": "~/.kodax/a2a/tasks"
-  // },
-
-  // Production OAuth2 resource-server alternative for the server above. The
-  // external Authorization Server issues access tokens and, for JWT tokens,
-  // signs them. KodaX holds no issuer signing key; it validates RFC 9068 tokens
-  // against the issuer's rotating JWKS, audience, expiry, subject, and scopes.
-  // Replace the server.authentication value above with:
-  // {
-  //   "type": "oauth2-jwt",
-  //   "scheme": "enterprise-oauth",
-  //   "issuer": "https://identity.example.com",
-  //   "audience": "https://agent.example.com/a2a",
-  //   "jwksUrl": "https://identity.example.com/.well-known/jwks.json",
-  //   "tokenUrl": "https://identity.example.com/oauth/token",
-  //   "metadataUrl": "https://identity.example.com/.well-known/oauth-authorization-server",
-  //   "requiredScopes": ["a2a.invoke"]
-  // }
-
-  "agents": {
-    // Fixed Bearer compatibility example. `enabled` is hot desired state:
-    // disabled Agents remain configured but are not candidates for new
-    // orchestration, while already admitted remote tasks may finish.
-    // "reporting": {
-    //   "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
-    //   "enabled": true,
-    //   "credentialEnv": "REPORTING_A2A_TOKEN",
-    //   "effect": "read"
-    // },
-
-    // Standards-based machine-to-machine OAuth2 example. The external
-    // Authorization Server issues access tokens; KodaX obtains and caches them
-    // only in process memory. `tokenUrl` must exactly match the selected Card
-    // OAuth2 clientCredentials flow. Use `kodax a2a enable|disable <name>` to
-    // mutate `enabled` atomically; the owning Runtime applies it asynchronously.
-    // "reviewer": {
-    //   "cardUrl": "https://reviewer.example.com/.well-known/agent-card.json",
-    //   "enabled": false,
-    //   "effect": "read",
-    //   "authentication": {
-    //     "type": "oauth2-client-credentials",
-    //     "scheme": "enterprise-oauth",
-    //     "issuer": "https://identity.example.com",
-    //     "tokenUrl": "https://identity.example.com/oauth/token",
-    //     "clientId": "kodax-reviewer",
-    //     "clientSecretEnv": "REVIEWER_CLIENT_SECRET",
-    //     "scopes": ["a2a.invoke"],
-    //     "resource": "https://reviewer.example.com/",
-    //     "clientAuthentication": "client-secret-basic"
-    //   }
-    // }
-  }
-}
+// Bidirectional A2A configuration: ~/.kodax/integrations/a2a.json.
+// `agents` calls many third-party Agents. The optional singleton `server`
+// exposes exactly one KodaX general task Agent; ACP remains the coding/editor
+// protocol. Uncomment only the entries you need; no token value belongs here.
+// Legacy version 1 files remain readable. Non-empty files require an explicit
+// stopped-daemon migration; new/empty files and every later write use version 2.
+{
+  "version": 2,
+
+  // Create this inbound block with `kodax a2a expose`; config never starts a
+  // listener by itself. Do not copy private Agent instructions, Runtime Skills,
+  // model names, or local paths into the public `published.skills` list.
+  // Managed workspaces default below
+  // ~/kodax_a2a_server_workspace/<runtime-profile>/contexts/<context-key>/.
+  // Native read/grep/glob remains available according to workspace access.
+  // Arbitrary shell is never exposed. Skill instructions/assets need no
+  // process authority. An exact checked-in scripts/... entry requires
+  // process="isolated", skillScripts admission, and `kodax sandbox doctor`.
+  // ASRT receives no KodaX credentials or ambient ~/.srt-settings.json and its
+  // script quota is observed; hostile tenants also require an outer container/VM.
+  //
+  // "server": {
+  //   "execution": {
+  //     "kind": "local-agent",
+  //     "agentRef": { "source": "markdown:user", "name": "report-agent" },
+  //     "workspace": { "mode": "managed" },
+  //     "toolPolicy": {
+  //       "workspace": "write",
+  //       "process": "deny",
+  //       "network": { "mode": "deny" },
+  //       "tools": [],
+  //       "mcp": {},
+  //       "skillScripts": {},
+  //       "subagents": "deny"
+  //     }
+  //   },
+  //   "published": {
+  //     "name": "KodaX Agent",
+  //     "description": "Completes approved general tasks.",
+  //     "version": "0.7.71",
+  //     "skills": [{ "id": "general", "name": "General", "description": "Complete general tasks.", "tags": [] }],
+  //     "inputModes": ["text/plain"],
+  //     "outputModes": ["text/plain"]
+  //   },
+  //   "authentication": { "type": "bearer-env", "tokenEnv": "KODAX_A2A_TOKEN", "principalId": "configured-client" },
+  //   "dataDir": "~/.kodax/a2a/tasks"
+  // },
+
+  // Production OAuth2 resource-server alternative for the server above. The
+  // external Authorization Server issues access tokens and, for JWT tokens,
+  // signs them. KodaX holds no issuer signing key; it validates RFC 9068 tokens
+  // against the issuer's rotating JWKS, audience, expiry, subject, and scopes.
+  // Replace the server.authentication value above with:
+  // {
+  //   "type": "oauth2-jwt",
+  //   "scheme": "enterprise-oauth",
+  //   "issuer": "https://identity.example.com",
+  //   "audience": "https://agent.example.com/a2a",
+  //   "jwksUrl": "https://identity.example.com/.well-known/jwks.json",
+  //   "tokenUrl": "https://identity.example.com/oauth/token",
+  //   "metadataUrl": "https://identity.example.com/.well-known/oauth-authorization-server",
+  //   "requiredScopes": ["a2a.invoke"]
+  // }
+
+  "agents": {
+    // Fixed Bearer compatibility example. `enabled` is hot desired state:
+    // disabled Agents remain configured but are not candidates for new
+    // orchestration, while already admitted remote tasks may finish.
+    // "reporting": {
+    //   "cardUrl": "https://agents.example.com/.well-known/agent-card.json",
+    //   "enabled": true,
+    //   "credentialEnv": "REPORTING_A2A_TOKEN",
+    //   "effect": "read"
+    // },
+
+    // Standards-based machine-to-machine OAuth2 example. The external
+    // Authorization Server issues access tokens; KodaX obtains and caches them
+    // only in process memory. `tokenUrl` must exactly match the selected Card
+    // OAuth2 clientCredentials flow. Use `kodax a2a enable|disable <name>` to
+    // mutate `enabled` atomically; the owning Runtime applies it asynchronously.
+    // "reviewer": {
+    //   "cardUrl": "https://reviewer.example.com/.well-known/agent-card.json",
+    //   "enabled": false,
+    //   "effect": "read",
+    //   "authentication": {
+    //     "type": "oauth2-client-credentials",
+    //     "scheme": "enterprise-oauth",
+    //     "issuer": "https://identity.example.com",
+    //     "tokenUrl": "https://identity.example.com/oauth/token",
+    //     "clientId": "kodax-reviewer",
+    //     "clientSecretEnv": "REVIEWER_CLIENT_SECRET",
+    //     "scopes": ["a2a.invoke"],
+    //     "resource": "https://reviewer.example.com/",
+    //     "clientAuthentication": "client-secret-basic"
+    //   }
+    // }
+  }
+}

package/config-templates/integrations/extensions.example.jsonc

@@ -1,7 +1,7 @@
-// Trusted user Extension paths: ~/.kodax/integrations/extensions.json.
-// Extensions are host code. Reload is whole-domain atomic; use MCP for
-// capabilities that should remain outside the KodaX process.
-{
-  "version": 1,
-  "paths": []
-}
+// Trusted user Extension paths: ~/.kodax/integrations/extensions.json.
+// Extensions are host code. Reload is whole-domain atomic; use MCP for
+// capabilities that should remain outside the KodaX process.
+{
+  "version": 1,
+  "paths": []
+}

package/config-templates/integrations/mcp.example.jsonc

@@ -1,16 +1,16 @@
-// User MCP declarations: ~/.kodax/integrations/mcp.json (strict JSON).
-// The whole file hot-reloads; healthy entries remain active if one new entry
-// fails to prepare. Keep credentials in ${env:NAME} references.
-{
-  "version": 1,
-  "servers": {}
-  // Example:
-  // "servers": {
-  //   "reporting": {
-  //     "type": "streamable-http",
-  //     "url": "https://mcp.example.com",
-  //     "headers": { "Authorization": "Bearer ${env:REPORTING_MCP_TOKEN}" },
-  //     "connect": "lazy"
-  //   }
-  // }
-}
+// User MCP declarations: ~/.kodax/integrations/mcp.json (strict JSON).
+// The whole file hot-reloads; healthy entries remain active if one new entry
+// fails to prepare. Keep credentials in ${env:NAME} references.
+{
+  "version": 1,
+  "servers": {}
+  // Example:
+  // "servers": {
+  //   "reporting": {
+  //     "type": "streamable-http",
+  //     "url": "https://mcp.example.com",
+  //     "headers": { "Authorization": "Bearer ${env:REPORTING_MCP_TOKEN}" },
+  //     "connect": "lazy"
+  //   }
+  // }
+}

package/dist/builtin/code-review/SKILL.md

@@ -58,25 +58,25 @@ compatibility: "Works best in a git repository or when the review target is prov
 
 ## 使用示例
 
-- `/code-review src/auth.ts` - 审查单个文件
-- `/code-review packages/coding/src/` - 审查目录
-- `/code-review` - 审查当前 git 变更
-
-## Lean Review Lens
-
-When the user asks for lean review, minimal diff, YAGNI, over-engineering, or
-native/stdlib replacement opportunities, add this lens after correctness and
-security findings:
-
-- Look for code, files, abstractions, dependencies, configuration, or workflow
-  changes that can be deleted without losing requested behavior.
-- Prefer existing repository code, stdlib/native platform features, or an
-  already-installed dependency when that is verifiably simpler than new custom
-  code.
-- Do not recommend cutting trust-boundary validation, security checks,
-  data-loss protection, accessibility basics, observability needed for safety,
-  or explicitly requested behavior.
-- Do not present optional cleanup as a high-severity finding. Put non-blocking
-  deletion/replacement ideas under `## Lean Suggestions`.
-- For each lean suggestion, explain what can be skipped or removed and when it
-  should be added back.
+- `/code-review src/auth.ts` - 审查单个文件
+- `/code-review packages/coding/src/` - 审查目录
+- `/code-review` - 审查当前 git 变更
+
+## Lean Review Lens
+
+When the user asks for lean review, minimal diff, YAGNI, over-engineering, or
+native/stdlib replacement opportunities, add this lens after correctness and
+security findings:
+
+- Look for code, files, abstractions, dependencies, configuration, or workflow
+  changes that can be deleted without losing requested behavior.
+- Prefer existing repository code, stdlib/native platform features, or an
+  already-installed dependency when that is verifiably simpler than new custom
+  code.
+- Do not recommend cutting trust-boundary validation, security checks,
+  data-loss protection, accessibility basics, observability needed for safety,
+  or explicitly requested behavior.
+- Do not present optional cleanup as a high-severity finding. Put non-blocking
+  deletion/replacement ideas under `## Lean Suggestions`.
+- For each lean suggestion, explain what can be skipped or removed and when it
+  should be added back.

package/dist/builtin/skill-creator/scripts/aggregate-benchmark.d.ts

@@ -1,46 +1,46 @@
-export interface BenchmarkRun {
-  eval_id: string | number;
-  run_id: string;
-  pass_rate: number;
-  passed: number;
-  failed: number;
-  total: number;
-  time_seconds: number;
-  tokens: number;
-  tool_calls: number;
-  errors: number;
-  expectations: Array<Record<string, unknown>>;
-  notes: string[];
-}
-
-export interface StatsSummary {
-  mean: number;
-  stddev: number;
-  min: number;
-  max: number;
-}
-
-export interface BenchmarkDocument {
-  skill_name: string;
-  generated_at: string;
-  workspace: string;
-  configs: Record<string, {
-    pass_rate: StatsSummary;
-    time_seconds: StatsSummary;
-    tokens: StatsSummary;
-  }>;
-  delta: {
-    pass_rate: string;
-    time_seconds: string;
-    tokens: string;
-  };
-  runs: Record<string, BenchmarkRun[]>;
-}
-
-export function loadRunResults(iterationDir: string): Promise<Record<string, BenchmarkRun[]>>;
-export function buildBenchmarkDocument(
-  iterationDir: string,
-  skillName: string,
-  configRuns: Record<string, BenchmarkRun[]>
-): BenchmarkDocument;
-export function renderBenchmarkMarkdown(benchmark: BenchmarkDocument): string;
+export interface BenchmarkRun {
+  eval_id: string | number;
+  run_id: string;
+  pass_rate: number;
+  passed: number;
+  failed: number;
+  total: number;
+  time_seconds: number;
+  tokens: number;
+  tool_calls: number;
+  errors: number;
+  expectations: Array<Record<string, unknown>>;
+  notes: string[];
+}
+
+export interface StatsSummary {
+  mean: number;
+  stddev: number;
+  min: number;
+  max: number;
+}
+
+export interface BenchmarkDocument {
+  skill_name: string;
+  generated_at: string;
+  workspace: string;
+  configs: Record<string, {
+    pass_rate: StatsSummary;
+    time_seconds: StatsSummary;
+    tokens: StatsSummary;
+  }>;
+  delta: {
+    pass_rate: string;
+    time_seconds: string;
+    tokens: string;
+  };
+  runs: Record<string, BenchmarkRun[]>;
+}
+
+export function loadRunResults(iterationDir: string): Promise<Record<string, BenchmarkRun[]>>;
+export function buildBenchmarkDocument(
+  iterationDir: string,
+  skillName: string,
+  configRuns: Record<string, BenchmarkRun[]>
+): BenchmarkDocument;
+export function renderBenchmarkMarkdown(benchmark: BenchmarkDocument): string;

package/dist/builtin/skill-creator/scripts/analyze-benchmark.d.ts

@@ -1,46 +1,46 @@
-export interface AnalyzeBenchmarkOptions {
-  workspaceDir: string;
-  benchmarkPath?: string;
-  outputPath?: string;
-  markdownPath?: string;
-  skillName?: string;
-  provider?: string;
-  model?: string;
-  reasoningMode?: string;
-  maxIter?: number;
-  cwd?: string;
-}
-
-export interface BenchmarkAnalysis {
-  skill_name: string;
-  generated_at: string;
-  workspace: string;
-  verdict: 'improves' | 'regresses' | 'mixed' | 'inconclusive';
-  release_readiness: 'ready' | 'needs_iteration' | 'needs_manual_review';
-  recommendation: string;
-  key_findings: string[];
-  variance_hotspots: string[];
-  suggested_actions: string[];
-  watchouts: string[];
-  supporting_metrics: {
-    pass_rate_delta: string;
-    time_seconds_delta: string;
-    tokens_delta: string;
-  };
-  failure_clusters: Record<string, unknown>;
-}
-
-export function buildAnalysisPrompt(input: Record<string, unknown>): string;
-
-export function renderAnalysisMarkdown(analysis: Record<string, any>): string;
-
-export function analyzeBenchmark(
-  options: AnalyzeBenchmarkOptions,
-  runner?: (prompt: string, options: Record<string, unknown>) => Promise<string>
-): Promise<{
-  analysis: BenchmarkAnalysis;
-  prompt: string;
-  rawResponse: string;
-  analysisJsonPath: string;
-  analysisMdPath: string;
-}>;
+export interface AnalyzeBenchmarkOptions {
+  workspaceDir: string;
+  benchmarkPath?: string;
+  outputPath?: string;
+  markdownPath?: string;
+  skillName?: string;
+  provider?: string;
+  model?: string;
+  reasoningMode?: string;
+  maxIter?: number;
+  cwd?: string;
+}
+
+export interface BenchmarkAnalysis {
+  skill_name: string;
+  generated_at: string;
+  workspace: string;
+  verdict: 'improves' | 'regresses' | 'mixed' | 'inconclusive';
+  release_readiness: 'ready' | 'needs_iteration' | 'needs_manual_review';
+  recommendation: string;
+  key_findings: string[];
+  variance_hotspots: string[];
+  suggested_actions: string[];
+  watchouts: string[];
+  supporting_metrics: {
+    pass_rate_delta: string;
+    time_seconds_delta: string;
+    tokens_delta: string;
+  };
+  failure_clusters: Record<string, unknown>;
+}
+
+export function buildAnalysisPrompt(input: Record<string, unknown>): string;
+
+export function renderAnalysisMarkdown(analysis: Record<string, any>): string;
+
+export function analyzeBenchmark(
+  options: AnalyzeBenchmarkOptions,
+  runner?: (prompt: string, options: Record<string, unknown>) => Promise<string>
+): Promise<{
+  analysis: BenchmarkAnalysis;
+  prompt: string;
+  rawResponse: string;
+  analysisJsonPath: string;
+  analysisMdPath: string;
+}>;