@mafdet/cli 0.3.0

package/dist/agent/session.js

@@ -0,0 +1,290 @@
+import { createInterface } from "node:readline/promises";
+import { isAgentEligible } from "../api/models.js";
+import { formatUsd } from "../output/money.js";
+import { renderRecord } from "../output/format.js";
+import { runAgent } from "./loop.js";
+const HELP = `Session commands:
+  /model [id]     Show or switch the model
+  /permissions    Show what this session may do
+  /diff           Show uncommitted changes in the workspace
+  /cost           Tokens and spend so far
+  /compact        Shorten the conversation, keeping the goal and recent turns
+  /exit           End the session
+
+Anything else is sent to the model as the next goal.
+`;
+/**
+ * The interactive session (plan §4.4).
+ *
+ * One conversation across many goals, so the agent keeps what it learned. The
+ * session owns the history — which is what makes /compact possible — and the
+ * running totals, so /cost and the closing summary describe the whole session
+ * rather than the last question.
+ */
+export async function runSession(options) {
+    const history = [];
+    const summary = {
+        goals: 0,
+        turns: 0,
+        modelRequests: 0,
+        toolRuns: 0,
+        promptTokens: 0,
+        completionTokens: 0,
+        costMicroUsd: 0n,
+    };
+    let model = options.model;
+    let pricing = options.pricing;
+    const source = options.readLine
+        ? undefined
+        : lineSource(options.input ?? process.stdin, options.stderr);
+    const readLine = options.readLine ??
+        (() => {
+            options.stderr("\n> ");
+            return source.read();
+        });
+    options.stderr(`mafdet agent session - ${model} (${options.mode}). /help for commands, /exit to leave.\n`);
+    try {
+        for (;;) {
+            if (options.signal?.aborted)
+                break;
+            const raw = await readLine();
+            if (raw === undefined)
+                break; // Ctrl+D, or the input stream ended.
+            const line = raw.trim();
+            if (line.length === 0)
+                continue;
+            if (line.startsWith("/")) {
+                const done = await handleCommand(line, {
+                    options,
+                    history,
+                    summary,
+                    model,
+                    setModel: (next, nextPricing) => {
+                        model = next;
+                        pricing = nextPricing;
+                    },
+                });
+                if (done)
+                    break;
+                continue;
+            }
+            summary.goals += 1;
+            const report = await runAgent({
+                client: options.client,
+                model,
+                pricing,
+                goal: line,
+                systemPrompt: options.systemPrompt,
+                tools: options.tools,
+                toolContext: options.toolContext,
+                history,
+                approver: options.approver,
+                signal: options.signal,
+                onEvent: (event) => reportEvent(event, options),
+            });
+            summary.turns += report.turns;
+            summary.modelRequests += report.modelRequests;
+            summary.toolRuns += report.toolRuns.length;
+            summary.promptTokens += report.promptTokens;
+            summary.completionTokens += report.completionTokens;
+            summary.costMicroUsd += report.costMicroUsd;
+            if (report.finalText)
+                options.stdout(`${report.finalText}\n`);
+            if (report.stopReason !== "completed") {
+                options.stderr(`[${report.stopReason}${report.error ? `: ${report.error}` : ""}]\n`);
+            }
+            if (report.stopReason === "cancelled" && options.signal?.aborted)
+                break;
+        }
+    }
+    finally {
+        source?.close();
+    }
+    return summary;
+}
+/** @returns true when the session should end. */
+async function handleCommand(line, context) {
+    const [command, ...rest] = line.split(/\s+/);
+    const { options } = context;
+    switch (command) {
+        case "/exit":
+        case "/quit":
+            return true;
+        case "/help":
+            options.stderr(HELP);
+            return false;
+        case "/model": {
+            const requested = rest[0];
+            if (!requested) {
+                options.stderr(`model: ${context.model}\n`);
+                const eligible = options.catalog
+                    .filter((entry) => isAgentEligible(entry))
+                    .map((entry) => entry.modelId);
+                options.stderr(`agent-eligible: ${eligible.join(", ") || "(none)"}\n`);
+                return false;
+            }
+            const next = options.catalog.find((entry) => entry.modelId === requested);
+            // Switching mid-session must obey the same admission rule as starting:
+            // an unverified model would fail on its first tool call.
+            if (!next || !isAgentEligible(next)) {
+                options.stderr(`${requested} is not verified for tool calling; keeping ${context.model}\n`);
+                return false;
+            }
+            context.setModel(requested, next);
+            options.stderr(`model: ${requested}\n`);
+            return false;
+        }
+        case "/permissions":
+            options.stderr(renderRecord([
+                ["mode", options.mode],
+                ["workspace", options.toolContext.workspace.root],
+                ["tools", options.tools.map((tool) => tool.name).join(", ")],
+                [
+                    "pre-approved commands",
+                    options.allowedCommands.length > 0
+                        ? options.allowedCommands.join(", ")
+                        : "(none)",
+                ],
+            ]));
+            return false;
+        case "/diff": {
+            const gitDiff = options.tools.find((tool) => tool.name === "git_diff");
+            if (!gitDiff?.run) {
+                options.stderr("git_diff is not available in this session\n");
+                return false;
+            }
+            try {
+                options.stderr(`${gitDiff.run({}, options.toolContext)}\n`);
+            }
+            catch (error) {
+                options.stderr(`${error.message}\n`);
+            }
+            return false;
+        }
+        case "/cost":
+            options.stderr(renderRecord([
+                ["goals", `${context.summary.goals}`],
+                ["model requests", `${context.summary.modelRequests}`],
+                [
+                    "tokens",
+                    `${context.summary.promptTokens} in / ${context.summary.completionTokens} out`,
+                ],
+                ["cost", `~${formatUsd(context.summary.costMicroUsd)}`],
+            ]));
+            return false;
+        case "/compact": {
+            const before = context.history.length;
+            const removed = compactHistory(context.history);
+            options.stderr(removed === 0
+                ? `nothing to compact (${before} messages)\n`
+                : `compacted: ${before} -> ${context.history.length} messages\n`);
+            return false;
+        }
+        default:
+            options.stderr(`unknown command ${command}. /help for the list.\n`);
+            return false;
+    }
+}
+/**
+ * Shorten the conversation in place.
+ *
+ * This truncates rather than summarising: a summary would cost a model call
+ * and could quietly invent detail. It keeps the system prompt and the opening
+ * goal, then cuts to the most recent user message.
+ *
+ * The cut must land on a user message. An assistant turn that carries
+ * `tool_calls` and its matching `tool` results form one indivisible unit — cut
+ * between them and the next request is rejected for referencing a tool call
+ * that is no longer there.
+ *
+ * @returns how many messages were removed.
+ */
+export function compactHistory(history) {
+    if (history.length <= 3)
+        return 0;
+    const system = history[0]?.role === "system" ? history[0] : undefined;
+    const firstGoal = history.find((message) => message.role === "user");
+    // Find the last user message that is not the opening goal.
+    let cut = -1;
+    for (let i = history.length - 1; i > 0; i -= 1) {
+        if (history[i].role === "user" && history[i] !== firstGoal) {
+            cut = i;
+            break;
+        }
+    }
+    if (cut === -1)
+        return 0;
+    const kept = [];
+    if (system)
+        kept.push(system);
+    if (firstGoal && firstGoal !== history[cut])
+        kept.push(firstGoal);
+    kept.push(...history.slice(cut));
+    const removed = history.length - kept.length;
+    if (removed <= 0)
+        return 0;
+    history.length = 0;
+    history.push(...kept);
+    return removed;
+}
+/**
+ * Lines from the terminal, queued.
+ *
+ * readline's `question` drops whatever is already buffered when the stream
+ * ends, which loses every line after the first when input is pasted or piped
+ * — found by running a real session under a pty. Collecting `line` events into
+ * a queue keeps them, and end-of-input only reports undefined once the queue
+ * is actually empty.
+ */
+function lineSource(input, write) {
+    const rl = createInterface({
+        input,
+        output: process.stderr,
+        terminal: false,
+    });
+    const queue = [];
+    let waiting;
+    let closed = false;
+    rl.on("line", (line) => {
+        if (waiting) {
+            const resolve = waiting;
+            waiting = undefined;
+            resolve(line);
+        }
+        else {
+            queue.push(line);
+        }
+    });
+    rl.on("close", () => {
+        closed = true;
+        if (waiting) {
+            const resolve = waiting;
+            waiting = undefined;
+            resolve(undefined);
+        }
+    });
+    return {
+        read() {
+            if (queue.length > 0)
+                return Promise.resolve(queue.shift());
+            if (closed)
+                return Promise.resolve(undefined);
+            return new Promise((resolve) => {
+                waiting = resolve;
+            });
+        },
+        close: () => rl.close(),
+    };
+}
+function reportEvent(event, options) {
+    if (event.type === "tool") {
+        const first = event.detail.split("\n")[0].slice(0, 100);
+        options.stderr(`  ${event.ok ? "-" : "!"} ${event.name}: ${first}\n`);
+    }
+    else if (event.type === "declined") {
+        options.stderr(`  declined: ${event.summary}\n`);
+    }
+    else if (event.type === "rate_limited") {
+        options.stderr(`  rate limited, waiting ${event.waitMs}ms (attempt ${event.attempt})\n`);
+    }
+}

package/dist/agent/tools/read-only.d.ts

@@ -0,0 +1,15 @@
+import type { ToolDefinition } from "./types.js";
+/**
+ * Everything a tool returns passes through here before it reaches the model
+ * or the terminal: strip terminal control, redact, then cap the size.
+ *
+ * Truncation keeps one runaway file from eating the context window, and
+ * redaction matters more than usual: a repository can contain a key the
+ * sensitive-file policy did not recognise, and sending it upstream would be
+ * the CLI leaking it, not the user.
+ */
+export declare function finishOutput(text: string): string;
+/** A tiny glob: `*` within a segment, `**` across segments, `?` one character. */
+export declare function globToRegExp(glob: string): RegExp;
+export declare const READ_ONLY_TOOLS: ToolDefinition[];
+//# sourceMappingURL=read-only.d.ts.map

package/dist/agent/tools/read-only.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-only.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/read-only.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAe,cAAc,EAAE,MAAM,YAAY,CAAC;AAmB9D;;;;;;;;GAQG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAYjD;AAED,kFAAkF;AAClF,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBjD;AAmLD,eAAO,MAAM,eAAe,EAAE,cAAc,EAM3C,CAAC"}

package/dist/agent/tools/read-only.js

@@ -0,0 +1,254 @@
+import { execFileSync } from "node:child_process";
+import { readdirSync } from "node:fs";
+import { join, relative, sep } from "node:path";
+import { z } from "zod";
+import { MAX_TOOL_OUTPUT_BYTES, WorkspaceError, } from "../../filesystem/workspace.js";
+import { redact } from "../../security/redact.js";
+import { stripAnsi } from "../command-policy.js";
+/** Never walked: enormous, uninteresting, and full of other people's code. */
+const SKIPPED_DIRECTORIES = new Set([
+    ".git",
+    "node_modules",
+    ".turbo",
+    ".next",
+    "dist",
+    "build",
+    ".venv",
+    "__pycache__",
+]);
+const MAX_LISTED_FILES = 500;
+const MAX_SEARCH_RESULTS = 200;
+/** Git output is unbounded in principle; a diff of a vendored tree is huge. */
+const GIT_TIMEOUT_MS = 10_000;
+/**
+ * Everything a tool returns passes through here before it reaches the model
+ * or the terminal: strip terminal control, redact, then cap the size.
+ *
+ * Truncation keeps one runaway file from eating the context window, and
+ * redaction matters more than usual: a repository can contain a key the
+ * sensitive-file policy did not recognise, and sending it upstream would be
+ * the CLI leaking it, not the user.
+ */
+export function finishOutput(text) {
+    // Terminal control is stripped here, at the one boundary every tool result
+    // crosses. A repository file can contain raw escape bytes, and read_file
+    // echoes a preview of its result to the user's terminal - a file must not be
+    // able to clear the screen, retitle the window or hide what follows it.
+    const safe = redact(stripAnsi(text));
+    if (Buffer.byteLength(safe, "utf8") <= MAX_TOOL_OUTPUT_BYTES)
+        return safe;
+    const clipped = Buffer.from(safe, "utf8")
+        .subarray(0, MAX_TOOL_OUTPUT_BYTES)
+        .toString("utf8");
+    return `${clipped}\n[truncated at ${MAX_TOOL_OUTPUT_BYTES} bytes]`;
+}
+/** A tiny glob: `*` within a segment, `**` across segments, `?` one character. */
+export function globToRegExp(glob) {
+    let out = "";
+    for (let i = 0; i < glob.length; i += 1) {
+        const char = glob[i];
+        if (char === "*") {
+            if (glob[i + 1] === "*") {
+                // `**/` may also match zero directories, so `**/*.ts` finds `a.ts`.
+                if (glob[i + 2] === "/") {
+                    out += "(?:.*/)?";
+                    i += 2;
+                }
+                else {
+                    out += ".*";
+                    i += 1;
+                }
+            }
+            else {
+                out += "[^/]*";
+            }
+            continue;
+        }
+        if (char === "?")
+            out += "[^/]";
+        else
+            out += char.replace(/[.+^${}()|[\]\\]/g, "\\$&");
+    }
+    return new RegExp(`^${out}$`);
+}
+function walk(workspace, onFile) {
+    const stack = [workspace.root];
+    while (stack.length > 0) {
+        const current = stack.pop();
+        let entries;
+        try {
+            entries = readdirSync(current, { withFileTypes: true });
+        }
+        catch {
+            continue; // Unreadable directory: skip rather than abort the whole walk.
+        }
+        for (const entry of entries) {
+            const full = join(current, entry.name);
+            if (entry.isDirectory()) {
+                if (SKIPPED_DIRECTORIES.has(entry.name))
+                    continue;
+                stack.push(full);
+                continue;
+            }
+            if (!entry.isFile())
+                continue; // Sockets, fifos, dangling symlinks.
+            const rel = toPosix(relative(workspace.root, full));
+            // The sensitive policy applies to listing too: a secret's *name* is
+            // information, and offering it invites the model to ask for it.
+            if (!workspace.allows(rel))
+                continue;
+            if (!onFile(rel))
+                return;
+        }
+    }
+}
+const listFiles = {
+    name: "list_files",
+    description: "List files in the workspace, optionally filtered by a glob such as src/**/*.ts. Skips .git, node_modules and build output.",
+    autoApproved: true,
+    schema: z.object({
+        glob: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Glob relative to the workspace root, e.g. src/**/*.ts"),
+    }),
+    run(args, { workspace }) {
+        const pattern = args.glob ? globToRegExp(args.glob) : undefined;
+        const found = [];
+        walk(workspace, (rel) => {
+            if (!pattern || pattern.test(rel))
+                found.push(rel);
+            return found.length < MAX_LISTED_FILES;
+        });
+        if (found.length === 0)
+            return finishOutput("no files matched");
+        const suffix = found.length >= MAX_LISTED_FILES
+            ? `\n[stopped at ${MAX_LISTED_FILES} files]`
+            : "";
+        return finishOutput(found.sort().join("\n") + suffix);
+    },
+};
+const searchText = {
+    name: "search_text",
+    description: "Search the workspace for a literal string and return matching lines as path:line:text.",
+    autoApproved: true,
+    schema: z.object({
+        query: z
+            .string()
+            .min(1)
+            .describe("Literal text to find (not a regular expression)"),
+        glob: z
+            .string()
+            .min(1)
+            .optional()
+            .describe("Restrict the search to matching files"),
+    }),
+    run(args, { workspace }) {
+        const pattern = args.glob ? globToRegExp(args.glob) : undefined;
+        const hits = [];
+        walk(workspace, (rel) => {
+            if (pattern && !pattern.test(rel))
+                return true;
+            let content;
+            try {
+                // Reuse the reader so size, binary and sensitivity rules apply here
+                // too — a search must not become a way around read_file's limits.
+                content = workspace.readTextFile(rel).content;
+            }
+            catch {
+                return true;
+            }
+            const lines = content.split("\n");
+            for (let i = 0; i < lines.length; i += 1) {
+                if (!lines[i].includes(args.query))
+                    continue;
+                hits.push(`${rel}:${i + 1}:${lines[i].trim().slice(0, 300)}`);
+                if (hits.length >= MAX_SEARCH_RESULTS)
+                    return false;
+            }
+            return true;
+        });
+        if (hits.length === 0)
+            return finishOutput(`no matches for ${args.query}`);
+        const suffix = hits.length >= MAX_SEARCH_RESULTS
+            ? `\n[stopped at ${MAX_SEARCH_RESULTS} matches]`
+            : "";
+        return finishOutput(hits.join("\n") + suffix);
+    },
+};
+const readFile = {
+    name: "read_file",
+    description: "Read a UTF-8 text file from the workspace.",
+    autoApproved: true,
+    schema: z.object({
+        path: z
+            .string()
+            .min(1)
+            .describe("Workspace-relative path, e.g. src/index.ts"),
+    }),
+    run(args, { workspace }) {
+        const file = workspace.readTextFile(args.path);
+        return finishOutput(file.content);
+    },
+};
+const gitStatus = {
+    name: "git_status",
+    description: "Show the working tree status (porcelain format). Read-only.",
+    autoApproved: true,
+    schema: z.object({}),
+    run(_args, context) {
+        const out = git(["status", "--porcelain=v1", "--branch"], context);
+        return finishOutput(out.trim() || "clean working tree");
+    },
+};
+const gitDiff = {
+    name: "git_diff",
+    description: "Show uncommitted changes, optionally for one path. Read-only.",
+    autoApproved: true,
+    schema: z.object({
+        path: z.string().min(1).optional().describe("Limit the diff to this path"),
+    }),
+    run(args, context) {
+        const argv = ["diff", "--no-color"];
+        if (args.path) {
+            // Route it through the boundary: `git diff ../../etc` would otherwise
+            // read outside the workspace.
+            argv.push("--", context.workspace.resolvePath(args.path).relative);
+        }
+        const out = git(argv, context);
+        return finishOutput(out.trim() || "no uncommitted changes");
+    },
+};
+function git(args, context) {
+    if (context.runGit)
+        return context.runGit(args, context.workspace.root);
+    try {
+        return execFileSync("git", args, {
+            cwd: context.workspace.root,
+            encoding: "utf8",
+            timeout: GIT_TIMEOUT_MS,
+            maxBuffer: MAX_TOOL_OUTPUT_BYTES,
+            // The child gets no credentials: nothing here needs them, and a hook or
+            // an alias in the repository must not be handed the user's API key.
+            env: { PATH: process.env.PATH ?? "", HOME: process.env.HOME ?? "" },
+        });
+    }
+    catch (error) {
+        const message = error.message;
+        if (/not a git repository/i.test(message)) {
+            throw new WorkspaceError("this workspace is not a git repository");
+        }
+        throw new WorkspaceError(`git failed: ${message.split("\n")[0]}`);
+    }
+}
+export const READ_ONLY_TOOLS = [
+    listFiles,
+    searchText,
+    readFile,
+    gitStatus,
+    gitDiff,
+];
+function toPosix(value) {
+    return sep === "/" ? value : value.split(sep).join("/");
+}

package/dist/agent/tools/run-command.d.ts

@@ -0,0 +1,20 @@
+import type { ToolDefinition } from "./types.js";
+/** Plan §7.4: a single local command gets two minutes. */
+export declare const COMMAND_TIMEOUT_MS = 120000;
+export interface CommandResult {
+    code: number | null;
+    signal: string | null;
+    output: string;
+    timedOut: boolean;
+}
+/**
+ * Run one program, with no shell and nothing inherited that it does not need.
+ *
+ * `detached` puts the child in its own process group so a timeout can kill the
+ * whole tree. Killing only the parent leaves the grandchildren running — the
+ * failure mode where a "timed out" test run keeps holding a port.
+ */
+export declare function executeCommand(argv: readonly string[], cwd: string, timeoutMs?: number): Promise<CommandResult>;
+export declare const runCommandTool: ToolDefinition;
+export declare const COMMAND_TOOLS: ToolDefinition[];
+//# sourceMappingURL=run-command.d.ts.map

package/dist/agent/tools/run-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-command.d.ts","sourceRoot":"","sources":["../../../src/agent/tools/run-command.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAA+B,cAAc,EAAE,MAAM,YAAY,CAAC;AAE9E,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,SAAU,CAAC;AAG1C,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED;;;;;;GAMG;AACH,wBAAsB,cAAc,CAClC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,GAAG,EAAE,MAAM,EACX,SAAS,GAAE,MAA2B,GACrC,OAAO,CAAC,aAAa,CAAC,CAkDxB;AAwBD,eAAO,MAAM,cAAc,EAAE,cAmC5B,CAAC;AAEF,eAAO,MAAM,aAAa,EAAE,cAAc,EAAqB,CAAC"}