@lasso-ai/cli 1.1.1 → 1.1.3

package/ARCHITECTURE.md

@@ -170,38 +170,46 @@ context (source + screenshot + instruction)
   │ Agent adapter  │   interface: given context, return old/new string pairs
   └───────┬───────┘
           │
-   ┌──────┼───────────────────┬─────────────────────┐
-   ▼      ▼                   ▼                      ▼
- Built-in   Claude Code        User's own CLI coding   Any future
- agent      (headless/         agent (Cursor CLI,      adapter
- (default)  `claude -p`)       Aider, etc.)
+   ┌──────┼──────────────┬─────────────────┐
+   ▼      ▼              ▼                 ▼
+ Hosted   Claude Code     Codex             OpenCode
+ model    `claude -p`     `codex exec`      `opencode run`
 ```
 
-- **Built-in agent** (`agent: "builtin"`): default path, zero setup, calls a hosted model
-  directly (`@anthropic-ai/sdk`) with the assembled context and the old/new-string contract
-  from §5.3.
-- **Claude Code passthrough** (`agent: "claude-code"`): the CLI shells out to Claude Code
-  in headless/print mode (`claude -p`), passing the assembled context as the prompt and
-  parsing its file edits back into the same diff-preview pipeline. This lets a user keep
-  using their existing Claude Code setup (subscription, project memory, MCP tools) while
-  still getting the point-and-select UX.
-- **Bring-your-own-agent** (`agent: "custom"`): define the adapter interface once (context
-  in, old/new-string pairs out) and let power users wire in whatever CLI coding tool they
-  already trust. Lasso's value in this mode is entirely the capture + context-assembly
-  pipeline (§4–5), not the model itself.
-
-Selection is a config choice, not an either/or product decision:
+- **Hosted model** (`anthropic` | `openai` | `google` | `ollama`): the default path when
+  no local CLI is selected. Lasso calls the provider SDK directly (`@anthropic-ai/sdk`)
+  with the assembled context and the old/new-string contract from §5.3. The provider and
+  key come from `LASSO_AGENT_PROVIDER` plus the matching `*_API_KEY`, read from the
+  process environment or the project `.env`.
+- **Claude Code passthrough** (`claude-code`): the CLI shells out to Claude Code in
+  headless/print mode (`claude -p … --permission-mode plan --output-format
+stream-json --max-turns 3`), passing the assembled context as the prompt and parsing
+  its output back into the same diff-preview pipeline. This lets a user keep using their
+  existing Claude Code setup (subscription, project memory, MCP tools) while still
+  getting the point-and-select UX.
+- **Codex passthrough** (`codex`): `codex exec --json --sandbox read-only
+--skip-git-repo-check`. Lasso passes the repository trust check itself, so Codex's own
+  check is skipped, and the read-only sandbox keeps it from writing.
+- **OpenCode passthrough** (`opencode`): `opencode run --format json --print-logs
+--log-level INFO --agent plan`. The `plan` agent is read-only; `--print-logs` is why
+  diagnostics reach the bridge, which classifies them rather than surfacing raw output.
+
+Every local agent is invoked read-only, so it can only propose a patch. Lasso writes
+nothing until the user accepts the diff. If an agent asks for approval or input, the
+child's stdin stays attached and the request is surfaced as a task-scoped overlay prompt.
+
+Availability is detected rather than configured: at bridge start Lasso runs `which` for
+`claude`, `codex`, and `opencode`, and only detected agents appear in the model picker.
+OpenCode's model list is discovered with `opencode models`.
+
+Selection happens in the overlay model picker, not in `lasso.config.json`. That file
+carries only the project `id` and local `domain`:
 
 ```json
-// lasso.config.json (before `lasso init`)
+// lasso.config.json — the only project fields
 {
-  "agent": "builtin" // | "claude-code" | "custom"
-}
-
-// lasso.config.json (after `lasso init` — id is the only project field)
-{
-  "agent": "builtin",
-  "id": "proj_3f2a9c…" // workspace-scoped; commit it so teammates share the session
+  "id": "proj_3f2a9c…", // workspace-scoped; commit it so teammates share the session
+  "domain": "my-project.lasso"
 }
 ```
 

package/README.md

@@ -373,51 +373,48 @@ inside the project and refuses to overwrite an existing file.
 
 ## Agent configuration
 
-Create `lasso.config.json` in your project root:
+You choose the coding agent in the overlay's model picker, not in a config file.
+`lasso.config.json` only records your project `id` and local `domain` — it has no
+agent field.
 
-```json
-{
-  "agent": "builtin"
-}
-```
+### Local CLI agents
 
-### Built-in agent
+Lasso shells out to a coding CLI installed on your machine. Each one appears as its own
+group in the model picker **only when its binary is on the `PATH` that `lasso dev`
+sees**, so install it before starting the dev server (or restart afterwards):
 
-```json
-{
-  "agent": "builtin"
-}
-```
+| Agent                                                        | Binary     | Lasso runs                                                                     |
+| ------------------------------------------------------------ | ---------- | ----------------------------------------------------------------------------- |
+| [Claude Code](https://lasso.byorello.space/docs/claude-code) | `claude`   | `claude -p … --permission-mode plan --output-format stream-json --max-turns 3` |
+| [Codex](https://lasso.byorello.space/docs/codex)             | `codex`    | `codex exec --json --sandbox read-only --skip-git-repo-check`                  |
+| [OpenCode](https://lasso.byorello.space/docs/opencode)       | `opencode` | `opencode run --format json --print-logs --agent plan`                         |
 
-Uses Lasso's built-in agent through the Anthropic SDK.
+All three run read-only, so the agent proposes a patch and never writes to your project.
+Sign each CLI in once in a real terminal; Lasso inherits the credentials it stores for
+your user.
 
-Requires:
+### Hosted agents
+
+To use a hosted model instead, set the provider and key in your shell or in the project
+`.env` before running `lasso dev`:
 
 ```bash
+export LASSO_AGENT_PROVIDER=anthropic   # or openai, google, ollama
 export ANTHROPIC_API_KEY=your_key
+export LASSO_AGENT_MODEL=...            # optional
 ```
 
-### Claude Code
-
-```json
-{
-  "agent": "claude-code"
-}
-```
-
-Lasso can delegate the coding task to Claude Code in headless mode while keeping the same selection → context → diff → accept workflow.
+Supported keys are `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`,
+`GOOGLE_GENERATIVE_AI_API_KEY` (or `GEMINI_API_KEY`), and `OLLAMA_BASE_URL` with
+`OLLAMA_MODEL`. If `LASSO_AGENT_PROVIDER` is unset, Lasso picks a provider from whichever
+key it finds, defaulting to `anthropic`.
 
-### Custom agent
-
-```json
-{
-  "agent": "custom"
-}
-```
+Hosted agents additionally require your Lasso key from `lasso auth login`, and the
+credentials are never written to `lasso.config.json`.
 
-Build your own adapter for another coding agent.
+### The adapter contract
 
-The adapter contract is intentionally simple:
+Whichever agent runs, the contract is the same:
 
 ```text
 Lasso context

package/dist/cli/agent.d.ts

@@ -45,7 +45,8 @@ export type AgentConfig = {
     baseUrl?: string;
 };
 export type LocalAgent = "claude-code" | "codex" | "opencode";
-export type AgentProgress = (message: string, detail?: string) => void;
+export type AgentProgressLevel = "working" | "error";
+export type AgentProgress = (message: string, detail?: string, level?: AgentProgressLevel) => void;
 export type AgentPrompt = {
     message: string;
     kind: "permission" | "input";

package/dist/cli/agent.js

@@ -37,7 +37,7 @@ async function detectLocalAgents() {
 const ignored = new Set(["node_modules", ".git", ".next", "dist", "build", ".turbo"]);
 const sourceExtensions = /\.(tsx?|jsx?|vue|svelte|css|scss|html)$/i;
 const sourceFileCache = new Map();
-async function sourceFiles(directory, budget = { remaining: 40 }) {
+async function sourceFiles(directory, budget = { remaining: 25 }) {
     if (budget.remaining <= 0)
         return [];
     const cached = sourceFileCache.get(directory);
@@ -63,7 +63,7 @@ async function sourceFiles(directory, budget = { remaining: 40 }) {
             budget.remaining -= 1;
         }
     }
-    sourceFileCache.set(directory, { expiresAt: Date.now() + 5000, files });
+    sourceFileCache.set(directory, { expiresAt: Date.now() + 30000, files });
     return files;
 }
 async function contextFor(cwd, element) {
@@ -95,7 +95,7 @@ async function contextFor(cwd, element) {
         try {
             const content = await promises_1.default.readFile(file, "utf8");
             if (!needle || (sourceFile && file.endsWith(sourceFile)) || content.includes(needle) || content.includes(element.label)) {
-                return `FILE: ${node_path_1.default.relative(cwd, file)}\n${content.slice(0, 8000)}`;
+                return `FILE: ${node_path_1.default.relative(cwd, file)}\n${content.slice(0, 6000)}`;
             }
         }
         catch {
@@ -104,7 +104,7 @@ async function contextFor(cwd, element) {
         return null;
     }));
     for (const result of results) {
-        if (result && snippets.length < 6)
+        if (result && snippets.length < 4)
             snippets.push(result);
     }
     return snippets.join("\n\n---\n\n");
@@ -560,9 +560,9 @@ function runLocalCommand(cwd, command, args, provider, signal, onProgress, taskI
                 else if (stream === "stderr" && line.trim()) {
                     const hint = agentFailureHint(line);
                     if (hint)
-                        onProgress?.(`${label} · ${hint}`);
+                        onProgress?.(`${label} · ${hint}`, undefined, "error");
                     if (provider === "opencode" && /quota exceeded|authentication failed|invalid api key|unauthorized|forbidden/i.test(line)) {
-                        onProgress?.("OpenCode · provider rejected the request; stopping this task…");
+                        onProgress?.("OpenCode · provider rejected the request; stopping this task…", undefined, "error");
                         child.kill("SIGTERM");
                     }
                 }
@@ -611,9 +611,9 @@ function runLocalCommand(cwd, command, args, provider, signal, onProgress, taskI
                 }
                 const hint = agentFailureHint(stderrTail);
                 if (hint)
-                    onProgress?.(`${label} · ${hint}`);
+                    onProgress?.(`${label} · ${hint}`, undefined, "error");
                 if (provider === "opencode" && /quota exceeded|authentication failed|invalid api key|unauthorized|forbidden/i.test(stderrTail)) {
-                    onProgress?.("OpenCode · provider rejected the request; stopping this task…");
+                    onProgress?.("OpenCode · provider rejected the request; stopping this task…", undefined, "error");
                 }
             }
             resolve({ stdout, stderr, exitCode: code ?? 1 });

package/dist/cli/bridge.js

@@ -118,7 +118,20 @@ function proposalMatchesCurrentSource(cwd, changes) {
     try {
         for (const change of changes) {
             const filePath = resolveProposedFile(cwd, change.filePath);
-            prepareChange(node_fs_1.default.readFileSync(filePath, "utf8"), change);
+            const content = node_fs_1.default.readFileSync(filePath, "utf8");
+            // Try exact match first
+            try {
+                prepareChange(content, change);
+            }
+            catch {
+                // If exact match fails, try with normalized whitespace
+                const normalizedContent = content.replace(/\s+/g, " ").trim();
+                const normalizedOldString = change.oldString.replace(/\s+/g, " ").trim();
+                const normalizedNewString = change.newString.replace(/\s+/g, " ").trim();
+                if (!normalizedContent.includes(normalizedOldString)) {
+                    throw new Error("Source content does not match proposed change (even with normalized whitespace)");
+                }
+            }
         }
         return true;
     }
@@ -308,9 +321,9 @@ function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort = expo
             if (socket.readyState === socket.OPEN) {
                 socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "working", message: statusMessage || "Working…" }));
             }
-            void (0, agent_1.proposeChanges)(cwd, request, config, controller.signal, (message, detail) => {
+            void (0, agent_1.proposeChanges)(cwd, request, config, controller.signal, (message, detail, level) => {
                 if (!controller.signal.aborted && socket.readyState === socket.OPEN) {
-                    socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "working", message, detail }));
+                    socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: level === "error" ? "error" : "working", message, detail }));
                 }
             }, (prompt) => {
                 if (!controller.signal.aborted && socket.readyState === socket.OPEN) {
@@ -322,21 +335,30 @@ function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort = expo
                     return;
                 if (!proposalMatchesCurrentSource(cwd, proposal.changes)) {
                     const refreshAttempts = reviewRefreshAttempts.get(request.taskId) || 0;
-                    if (refreshAttempts < 1) {
+                    const MAX_REFRESH_ATTEMPTS = 3;
+                    if (refreshAttempts < MAX_REFRESH_ATTEMPTS) {
                         reviewRefreshAttempts.set(request.taskId, refreshAttempts + 1);
-                        runEditReview(request, config, "The source changed while the proposal was being prepared. Refreshing the review…");
+                        setTimeout(() => {
+                            if (!controller.signal.aborted && socket.readyState === socket.OPEN) {
+                                runEditReview(request, config, `The source changed while the proposal was being prepared. Refreshing the review… (${refreshAttempts + 1}/${MAX_REFRESH_ATTEMPTS})`);
+                            }
+                        }, 500 * (refreshAttempts + 1));
                     }
                     else {
-                        socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "error", message: "The source is still changing. Stop the dev-server edit or try the request again." }));
+                        socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "error", message: "The source is still changing after multiple refresh attempts. Stop the dev-server edit or try the request again." }));
                     }
                     return;
                 }
                 socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "review", message: proposal.summary, changes: proposal.changes }));
             })
                 .catch((error) => {
-                if (!controller.signal.aborted && socket.readyState === socket.OPEN) {
-                    socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "error", message: error instanceof Error ? error.message : "The agent could not prepare a change." }));
+                if (socket.readyState !== socket.OPEN)
+                    return;
+                if (controller.signal.aborted) {
+                    socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "stopped", message: "Agent stopped." }));
+                    return;
                 }
+                socket.send(JSON.stringify({ type: "agent_status", taskId: request.taskId, status: "error", message: error instanceof Error ? error.message : "The agent could not prepare a change." }));
             })
                 .finally(() => {
                 if (taskControllers.get(request.taskId) === controller)
@@ -432,9 +454,9 @@ function startBridge(cwd = process.cwd(), collabConfig = null, bridgePort = expo
                     ? { provider: cliProvider, model: msg.model }
                     : { ...agentConfig, provider: (msg.provider || agentConfig.provider), model: msg.model };
                 socket.send(JSON.stringify({ type: "agent_status", taskId: msg.taskId, status: "working", message: "Working…" }));
-                void (0, agent_1.answerQuestion)(cwd, { taskId: msg.taskId, question: msg.question, context: msg.context, element: msg.element, messages: msg.messages }, selectedConfig, controller.signal, (message, detail) => {
+                void (0, agent_1.answerQuestion)(cwd, { taskId: msg.taskId, question: msg.question, context: msg.context, element: msg.element, messages: msg.messages }, selectedConfig, controller.signal, (message, detail, level) => {
                     if (!controller.signal.aborted && socket.readyState === socket.OPEN)
-                        socket.send(JSON.stringify({ type: "agent_status", taskId: msg.taskId, status: "working", message, detail }));
+                        socket.send(JSON.stringify({ type: "agent_status", taskId: msg.taskId, status: level === "error" ? "error" : "working", message, detail }));
                 }, (prompt) => {
                     if (!controller.signal.aborted && socket.readyState === socket.OPEN)
                         socket.send(JSON.stringify({ type: "agent_prompt", taskId: msg.taskId, prompt }));