@mrciphersmith/keryx 0.2.128 → 0.2.130

package/dist/cli.js

@@ -51085,7 +51085,7 @@ import path47 from "path";
 // package.json
 var package_default = {
   name: "@mrciphersmith/keryx",
-  version: "0.2.128",
+  version: "0.2.130",
   description: "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   private: false,
   publishConfig: {
@@ -85129,6 +85129,8 @@ function busInboxFullNotice(droppedTotal) {
   return `bus: inbox full \u2014 ${droppedTotal} older message(s) dropped
 `;
 }
+var BUS_WAKE_CAPPED_NOTICE = `\u25C7 a peer message arrived; automatic wakes are capped, so it will be delivered with your next message.
+`;
 function createLeaseHoldController(opts) {
   let wasHeld = false;
   return {
@@ -86977,7 +86979,8 @@ class SandboxedWebTransport {
       ...request.body !== undefined ? { body: request.body } : {},
       ...request.credential !== undefined ? { credential: request.credential } : {},
       ...request.signal !== undefined ? { signal: request.signal } : {},
-      localOnly: request.capability === "local-search"
+      localOnly: request.capability === "local-search",
+      browserHeaders: request.capability === "public-search"
     });
     if (!raw.ok) {
       return {
@@ -87024,7 +87027,8 @@ class SandboxedWebTransport {
         address: target.value.address,
         method: request.method,
         ...request.body !== undefined ? { body: request.body } : {},
-        ...request.credential !== undefined ? { credential: request.credential } : {}
+        ...request.credential !== undefined ? { credential: request.credential } : {},
+        ...request.browserHeaders === true ? { browserHeaders: true } : {}
       }, request.signal);
       if (!worker.ok)
         return worker;
@@ -87062,6 +87066,54 @@ import { existsSync as existsSync29 } from "fs";
 import { homedir as homedir7 } from "os";
 var WORKER_TIMEOUT_MS = 1e4;
 var MAX_WORKER_OUTPUT_BYTES = 192000;
+var BROWSER_USER_AGENTS = [
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Safari/537.36",
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:133.0) Gecko/20100101 Firefox/133.0",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:133.0) Gecko/20100101 Firefox/133.0",
+  "Mozilla/5.0 (X11; Linux x86_64; rv:132.0) Gecko/20100101 Firefox/132.0",
+  "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/18.1 Safari/605.1.15",
+  "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/131.0.0.0 Safari/537.36 Edg/131.0.0.0"
+];
+var BROWSER_ACCEPT_LANGUAGES = [
+  "en-US,en;q=0.9",
+  "en-US,en;q=0.9,ru;q=0.8",
+  "en-GB,en;q=0.9,en-US;q=0.8",
+  "ru-RU,ru;q=0.9,en-US;q=0.8,en;q=0.7",
+  "en-CA,en;q=0.9,en-US;q=0.8"
+];
+var BROWSER_ACCEPT = "text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8";
+var BROWSER_STATIC_HEADERS = {
+  "accept-encoding": "identity",
+  connection: "keep-alive",
+  "upgrade-insecure-requests": "1",
+  "sec-fetch-dest": "document",
+  "sec-fetch-mode": "navigate",
+  "sec-fetch-site": "none",
+  "sec-fetch-user": "?1",
+  "cache-control": "max-age=0"
+};
+var BROWSER_HEADERS_SOURCE = [
+  "(function (random) {",
+  "  var userAgents = " + JSON.stringify(BROWSER_USER_AGENTS) + ";",
+  "  var acceptLanguages = " + JSON.stringify(BROWSER_ACCEPT_LANGUAGES) + ";",
+  "  var staticHeaders = " + JSON.stringify(BROWSER_STATIC_HEADERS) + ";",
+  "  var pick = function (list) {",
+  "    var value = list[Math.floor(random() * list.length)];",
+  "    return value === undefined ? list[0] : value;",
+  "  };",
+  "  var headers = {",
+  "    accept: " + JSON.stringify(BROWSER_ACCEPT) + ",",
+  '    "accept-language": pick(acceptLanguages),',
+  '    "user-agent": pick(userAgents),',
+  "  };",
+  "  for (var name in staticHeaders) { headers[name] = staticHeaders[name]; }",
+  '  if (random() < 0.5) headers.dnt = "1";',
+  "  return headers;",
+  "})"
+].join(`
+`);
 var WORKER_SOURCE = String.raw`
 const { request: httpsRequest } = await import("node:https");
 const { request: httpRequest } = await import("node:http");
@@ -87070,7 +87122,10 @@ const input = JSON.parse(await Bun.stdin.text());
 const fail = () => process.stdout.write(JSON.stringify({ ok: false, reason: "request failed or timed out" }));
 try {
   const timer = setTimeout(() => req.destroy(new Error("timeout")), input.timeoutMs);
-  const headers = { accept: "text/html, text/plain, application/json, application/xml, application/xhtml+xml" };
+  const browserHeaders = ${BROWSER_HEADERS_SOURCE};
+  const headers = input.browserHeaders
+    ? browserHeaders(Math.random)
+    : { accept: "text/html, text/plain, application/json, application/xml, application/xhtml+xml" };
   const payload = input.body && typeof input.body === "object" ? { ...input.body } : undefined;
   if (input.credential && input.credential.injection === "header") headers[input.credential.name] = input.credential.value;
   if (input.credential && input.credential.injection === "json-body") {
@@ -87294,7 +87349,7 @@ function webSearchTool(service) {
       const response = await service.search(input.query.trim());
       if (!response.ok) {
         return {
-          output: response.reason === "no-active-provider" ? "web_search: no active connected provider. Use /search-provider to configure one, test it, then use /search-connect to select it." : response.reason === "search-failed" ? "web_search: search failed. Retry later; do not switch providers yourself." : "web_search: active provider is unavailable; reconnect it with /search-provider before retrying.",
+          output: response.reason === "no-active-provider" ? "web_search: no active connected provider. Use /search-provider to configure one, test it, then use /search-connect to select it." : response.reason === "search-failed" ? `web_search: search failed${response.detail !== undefined && response.detail.length > 0 ? ` (${response.detail})` : ""}. Wait a few minutes before trying again, and do not switch providers yourself.` : "web_search: active provider is unavailable; reconnect it with /search-provider before retrying.",
           isError: true
         };
       }
@@ -88096,7 +88151,7 @@ function rememberExactShellGrant(command, sessionAllow, options) {
   if (!offerExact) {
     return "";
   }
-  const stored = allowShellPattern(exact);
+  const stored = allowShellPattern(exact, options?.dir);
   if (stored.length > 0) {
     sessionAllow.add(stored);
   }
@@ -88250,8 +88305,14 @@ var ANOMALY_MARKERS = [
   "/anomaly.js",
   "Unfortunately, bots use DuckDuckGo too"
 ];
-var MIN_GAP_MS = 500;
-var MAX_GAP_MS = 2000;
+var MIN_GAP_MS = 4000;
+var MAX_GAP_MS = 8000;
+var DUCKDUCKGO_ANOMALY_BACKOFF_MS = [5000, 20000];
+var timing = {
+  minGapMs: MIN_GAP_MS,
+  maxGapMs: MAX_GAP_MS,
+  backoffMs: DUCKDUCKGO_ANOMALY_BACKOFF_MS
+};
 var lastSearchAt = 0;
 function duckduckgoLiteUrl(query) {
   return `${DUCKDUCKGO_LITE_ORIGIN}?q=${encodeURIComponent(query)}`;
@@ -88267,7 +88328,8 @@ async function maybeDelayDuckDuckGoSearch(signal) {
     lastSearchAt = now;
     return;
   }
-  const gap = MIN_GAP_MS + Math.floor(Math.random() * (MAX_GAP_MS - MIN_GAP_MS + 1));
+  const { minGapMs, maxGapMs } = timing;
+  const gap = minGapMs + Math.floor(Math.random() * Math.max(0, maxGapMs - minGapMs + 1));
   const wait = gap - (now - lastSearchAt);
   if (wait > 0)
     await sleep2(wait, signal);
@@ -88387,6 +88449,30 @@ function sleep2(ms, signal) {
     signal?.addEventListener("abort", onAbort, { once: true });
   });
 }
+async function waitDuckDuckGoBackoff(attempt, signal) {
+  const wait = timing.backoffMs[attempt];
+  if (wait === undefined)
+    return false;
+  if (wait > 0)
+    await sleep2(wait, signal);
+  return true;
+}
+
+// src/harness/search/connection-message.ts
+function describeConnectionFailure(reason) {
+  switch (reason) {
+    case "missing-credential":
+      return "missing credential";
+    case "rate-limited":
+      return "rate limited \u2014 the provider served its bot page to this machine; retrying will not help";
+    case "incompatible-response":
+      return "the endpoint answered, but not with search results";
+    case "transport-failed":
+    default:
+      return "connection validation failed";
+  }
+}
+var RATE_LIMITED_SEARCH_ERROR = "rate limited: DuckDuckGo served its bot-check page instead of results, even after retrying. Do not retry or rephrase; wait a few minutes or fetch a known URL directly";
 
 // src/harness/search/registry.ts
 var SEARXNG_DOCS_URL = "https://docs.searxng.org/admin/installation.html";
@@ -88497,29 +88583,31 @@ function createSearchProviderRegistry(transport, resolveCredential = () => {
         query: DUCKDUCKGO_HEALTHCHECK_QUERY
       });
       if (isDuckDuckGoAnomaly(response.status, response.text))
-        return { ok: false, reason: "transport-failed" };
+        return { ok: false, reason: "rate-limited" };
       if (!response.ok || response.status < 200 || response.status >= 300)
         return requestFailure(response);
       const parsed = duckduckgoSearchResponse(DUCKDUCKGO_HEALTHCHECK_QUERY, response.text);
-      return parsed.ok ? { ok: true } : { ok: false, reason: "transport-failed" };
+      return parsed.ok ? { ok: true } : { ok: false, reason: "rate-limited" };
     },
     async search(_fields, query, signal) {
-      await maybeDelayDuckDuckGoSearch(signal);
-      const response = await transport.request({
-        providerId: "duckduckgo",
-        capability: "public-search",
-        url: duckduckgoLiteUrl(query),
-        method: "GET",
-        query,
-        ...signal ? { signal } : {}
-      });
-      if (isDuckDuckGoAnomaly(response.status, response.text)) {
-        throw new Error("DuckDuckGo rate-limited this machine");
+      for (let attempt = 0;; attempt += 1) {
+        await maybeDelayDuckDuckGoSearch(signal);
+        const response = await transport.request({
+          providerId: "duckduckgo",
+          capability: "public-search",
+          url: duckduckgoLiteUrl(query),
+          method: "GET",
+          query,
+          ...signal ? { signal } : {}
+        });
+        const parsed = duckduckgoSearchResponse(query, response.text);
+        if (!isDuckDuckGoAnomaly(response.status, response.text) && parsed.ok) {
+          return parsed.value;
+        }
+        if (!await waitDuckDuckGoBackoff(attempt, signal)) {
+          throw new Error(RATE_LIMITED_SEARCH_ERROR);
+        }
       }
-      const parsed = duckduckgoSearchResponse(query, response.text);
-      if (!parsed.ok)
-        throw new Error("DuckDuckGo rate-limited this machine");
-      return parsed.value;
     }
   };
   const searxng = {
@@ -88751,8 +88839,12 @@ class SearchProviderController {
       return { ok: false, reason: "no-active-provider" };
     try {
       return { ok: true, value: await descriptor.search(stored?.fields ?? {}, query, signal) };
-    } catch {
-      return { ok: false, reason: "search-failed" };
+    } catch (error) {
+      return {
+        ok: false,
+        reason: "search-failed",
+        ...error instanceof Error && error.message.length > 0 ? { detail: error.message } : {}
+      };
     }
   }
   config() {
@@ -94114,6 +94206,15 @@ function mountEmptyTranscriptSplash(otui, r, transcript) {
     transcript.remove(box);
   };
 }
+function createSplashLifecycle(opts) {
+  let remove = opts.initialHistoryLength === 0 ? opts.mount() : undefined;
+  return {
+    removeIfShown() {
+      remove?.();
+      remove = undefined;
+    }
+  };
+}
 
 // src/tui/workspace-inspector.ts
 var WORKSPACE_COMMAND = "/workspace";
@@ -101903,6 +102004,44 @@ function parseBusCommand(line) {
   return { kind: "error", reason: `unknown /bus subcommand "${first}"` };
 }
 
+// src/tui/bus-join.ts
+function decideJoinAdoption(input) {
+  if (input.disabled)
+    return "off";
+  if (input.destroyed)
+    return "leave";
+  return "adopt";
+}
+function buildBusJoinCallbacks(deps) {
+  return {
+    onEvent: (event) => {
+      if (deps.isDestroyed())
+        return;
+      deps.onSystemLine(`${formatBusEventLine(event)}
+`);
+      deps.pushToInbox({ ...event, body: event.body ?? "" });
+      deps.markDelivered();
+    },
+    onPeers: (peers) => {
+      if (deps.isDestroyed())
+        return;
+      deps.setFleetPeers(peers.map((peer) => ({
+        name: peer.record.name,
+        state: peer.state,
+        status: peer.record.status,
+        activity: peer.record.activity
+      })));
+      deps.paintFleet();
+      deps.onInboxSizeObserved();
+      deps.paintHoldBanner();
+      deps.onLeaseHoldPoll();
+      const delivered = deps.getDelivered();
+      deps.onBusWakePoll(delivered);
+      deps.resetDelivered();
+    }
+  };
+}
+
 // src/tui/shell-exit.ts
 function leaveBusThenRelease(holder) {
   holder.leaveBus();
@@ -102090,6 +102229,9 @@ var SIDE_WORKER_DENIED_TOOL_NAMES = new Set([
   "shell_job_output",
   "bus_send"
 ]);
+function isToolAvailableToSideWorker(tool) {
+  return tool.definition.risk === "read" && !SIDE_WORKER_DENIED_TOOL_NAMES.has(tool.definition.name);
+}
 function parseGitHubRemote(remote) {
   const trimmed = remote.trim();
   if (trimmed.length === 0) {
@@ -103057,7 +103199,7 @@ function runSearchProviderTestStep(otui, target, controller, provider, fields, c
       }
       if (!tested.ok) {
         settled = "failure";
-        const reason = tested.reason === "missing-credential" ? "missing credential" : "connection validation failed";
+        const reason = describeConnectionFailure(tested.reason);
         status.content = otui.t`${otui.red("\u2717")} ${otui.bold(`'${provider.id}' test failed: ${reason}`)} ${otui.dim("(Esc to go back and retry)")}`;
         return;
       }
@@ -104521,11 +104663,10 @@ async function launchTuiAgentShell(opts) {
     };
     deps = { ...deps, onContextCompaction };
     liveDeps = deps;
-    let removeSplash;
+    let splash = undefined;
     const applyOpened = (opened, previewHistory) => {
       if (opened.history.length > 0) {
-        removeSplash?.();
-        removeSplash = undefined;
+        splash?.removeIfShown();
       }
       liveSession = opened.handle;
       history = previewHistory === true ? opened.history.slice(-SESSION_PREVIEW_MESSAGE_COUNT) : opened.history;
@@ -104683,17 +104824,37 @@ async function launchTuiAgentShell(opts) {
       return true;
     }
     bindSlateToLiveSession();
-    if (history.length === 0) {
-      removeSplash = mountEmptyTranscriptSplash(otui, r, transcript);
-    }
+    splash = createSplashLifecycle({
+      mount: () => mountEmptyTranscriptSplash(otui, r, transcript),
+      initialHistoryLength: history.length
+    });
     if (viewedReadOnly) {
-      removeSplash?.();
-      removeSplash = undefined;
+      splash.removeIfShown();
     }
     refreshWorkspaceSidebar();
     refreshReviewSidebar();
     (async () => {
       try {
+        const { onEvent, onPeers } = buildBusJoinCallbacks({
+          isDestroyed: () => destroyed,
+          onSystemLine: (line) => io.onSystem?.(line),
+          pushToInbox: (event) => busInbox.push(event),
+          markDelivered: () => {
+            busPollDeliveredEvent = true;
+          },
+          setFleetPeers: (peers) => {
+            busFleetPeers = peers;
+          },
+          paintFleet,
+          onInboxSizeObserved: () => busDropNotifier.onInboxSizeObserved(busInbox.size),
+          paintHoldBanner,
+          onLeaseHoldPoll: () => leaseHoldController?.onPoll(),
+          onBusWakePoll: (delivered) => busWakeController?.onPoll(delivered),
+          getDelivered: () => busPollDeliveredEvent,
+          resetDelivered: () => {
+            busPollDeliveredEvent = false;
+          }
+        });
         const joined = await joinBus({
           cwd: sessionCwd,
           sessionId: liveSession.summary.id,
@@ -104708,37 +104869,15 @@ async function launchTuiAgentShell(opts) {
           }),
           onError: makeBusErrorReporter((line) => io.onSystem?.(`${line}
 `)),
-          onEvent: (event) => {
-            if (destroyed)
-              return;
-            io.onSystem?.(`${formatBusEventLine(event)}
-`);
-            busInbox.push({ ...event, body: event.body ?? "" });
-            busPollDeliveredEvent = true;
-          },
-          onPeers: (peers) => {
-            if (destroyed)
-              return;
-            busFleetPeers = peers.map((peer) => ({
-              name: peer.record.name,
-              state: peer.state,
-              status: peer.record.status,
-              activity: peer.record.activity
-            }));
-            paintFleet();
-            busDropNotifier.onInboxSizeObserved(busInbox.size);
-            paintHoldBanner();
-            leaseHoldController?.onPoll();
-            busWakeController?.onPoll(busPollDeliveredEvent);
-            busPollDeliveredEvent = false;
-          }
+          onEvent,
+          onPeers
         });
         if ("disabled" in joined) {
           io.onSystem?.(`bus: off (${joined.disabled})
 `);
           return;
         }
-        if (destroyed) {
+        if (decideJoinAdoption({ destroyed, disabled: false }) === "leave") {
           joined.leave();
           return;
         }
@@ -105560,7 +105699,7 @@ Staying in the current session.
           let answer = "";
           try {
             const base = await opts.makeAgentDeps(currentSel, liveSlateSession, undefined);
-            const tools = base.tools.filter((t) => t.definition.risk === "read" && !SIDE_WORKER_DENIED_TOOL_NAMES.has(t.definition.name));
+            const tools = base.tools.filter(isToolAvailableToSideWorker);
             const sideDeps = {
               ...base,
               tools,
@@ -105636,8 +105775,7 @@ Staying in the current session.
       suggestionGate.cancel("new turn started");
       if (origin === "operator") {
         consecutiveAutoWakes = 0;
-        removeSplash?.();
-        removeSplash = undefined;
+        splash?.removeIfShown();
       }
       const displayLine = summarizeSubmittedLine(line);
       if (chrome.isBusy()) {
@@ -105988,7 +106126,7 @@ Staying in the current session.
             searchProviderController.configure(providerId, { ...descriptor.defaults, ...args.fields }, args.credential);
             const tested = await searchProviderController.test(providerId);
             if (!tested.ok) {
-              const reason = tested.reason === "missing-credential" ? "missing credential" : "connection validation failed";
+              const reason = describeConnectionFailure(tested.reason);
               io.onSystem?.(`Configured '${providerId}' but it is not connected yet: ${reason}. Run /search-provider ${providerId} key=<value> to re-test.
 `);
               return;
@@ -106491,8 +106629,7 @@ Usage: /reasoning <${REASONING_EFFORT_LEVELS.join("|")}>
       cap: () => resolveMaxAutoWake(),
       runWake: () => runLine("", "bus-message"),
       printCapped: () => {
-        io.onSystem?.(`\u25C7 a peer message arrived; automatic wakes are capped, so it will be delivered with your next message.
-`);
+        io.onSystem?.(BUS_WAKE_CAPPED_NOTICE);
       },
       hasBusDeps: () => deps.busInbox !== undefined
     });
@@ -107987,8 +108124,8 @@ async function runAgentRepl(lines, rich, deps, metaprojectPort, sessionOpts, ini
     }
   };
   const searchProviderController = createDefaultSearchProviderController();
-  const sessionShellAllow = new Set(loadShellPermissions().allow);
-  let fingerprintAtStart = shellPermissionsFingerprint();
+  const sessionShellAllow = new Set(loadShellPermissions(configDir).allow);
+  let fingerprintAtStart = shellPermissionsFingerprint(configDir);
   let permissionMigrationShown = false;
   let permissionTamperShown = false;
   const iterator = lines[Symbol.asyncIterator]();
@@ -108225,10 +108362,11 @@ ${GUTTER}${style.yellow(`Run: ${evaled.command}`)} ${style.dim(prompt)}`);
       const approved = always || /^y(es)?$/i.test(answer);
       if (always && approved) {
         const stored = rememberExactShellGrant(evaled.command, sessionShellAllow, {
-          publishLease: evaled.publishLease
+          publishLease: evaled.publishLease,
+          ...configDir !== undefined ? { dir: configDir } : {}
         });
         if (stored.length > 0) {
-          fingerprintAtStart = shellPermissionsFingerprint();
+          fingerprintAtStart = shellPermissionsFingerprint(configDir);
         }
         out(stored.length > 0 ? style.green(`approved \xB7 remembered \u201C${stored}\u201D
 `) : style.yellow(`approved once \xB7 pattern cannot be remembered
@@ -108825,7 +108963,7 @@ ${GUTTER}${turnSeparator()}
         searchProviderController.configure(providerId, { ...descriptor.defaults, ...args.fields }, args.credential);
         const tested = await searchProviderController.test(providerId);
         if (!tested.ok) {
-          const reason = tested.reason === "missing-credential" ? "missing credential" : "connection validation failed";
+          const reason = describeConnectionFailure(tested.reason);
           agentIo.onSystem?.(`Configured '${providerId}' but it is not connected yet: ${reason}. Run /search-provider ${providerId} key=<value> to re-test.
 `);
           continue;
@@ -111528,8 +111666,8 @@ async function runServe(args) {
         resolve();
       });
     };
-    process.once("SIGINT", finish);
-    process.once("SIGTERM", finish);
+    process.on("SIGINT", finish);
+    process.on("SIGTERM", finish);
   });
 }
 function overlay(stored, parsed, port, runtimeAck) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mrciphersmith/keryx",
-  "version": "0.2.128",
+  "version": "0.2.130",
   "description": "Version-controlled project context for AI coding agents: code graph, architecture wiki, project memory, relevant tests, quality signals, and task flows.",
   "private": false,
   "publishConfig": {