@nac3/forge-cli 0.2.0-alpha.8 → 0.2.1-alpha.60

package/dist/core/atomic_write.js

@@ -0,0 +1,51 @@
+/**
+ * Atomic write helpers with Windows EPERM resilience.
+ *
+ * The "write tmp + rename" pattern is the canonical way to persist a
+ * file atomically: a process death between write and rename leaves
+ * the OLD file intact, and the rename is itself atomic at the
+ * filesystem layer on every supported platform.
+ *
+ * On Windows, however, `fs.rename` can fail with EPERM (or EBUSY,
+ * EACCES) under three common conditions:
+ *   1. Antivirus software briefly holds an exclusive handle on the
+ *      destination after a previous write (Windows Defender does this
+ *      on every newly-written file).
+ *   2. Another process on the same machine has the destination open
+ *      for read.
+ *   3. The filesystem indexer (Search) is mid-scan on the directory.
+ *
+ * The standard mitigation is to retry with a short exponential
+ * backoff. After 5 attempts (~310ms total) the operation is
+ * conclusively failing and we bubble the error.
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+const DEFAULT_RETRYABLE = new Set(['EPERM', 'EBUSY', 'EACCES', 'ENOENT']);
+/** Wrap any async fs op and retry on Windows handle-races.  */
+export async function withRenameRetry(op, opts = {}) {
+    const max = opts.maxRetries ?? 5;
+    const baseMs = opts.initialDelayMs ?? 10;
+    const retryOk = opts.retryableCodes ?? DEFAULT_RETRYABLE;
+    let attempt = 0;
+    for (;;) {
+        try {
+            return await op();
+        }
+        catch (err) {
+            const code = err.code;
+            if (!code || !retryOk.has(code) || attempt >= max)
+                throw err;
+            const delay = baseMs * Math.pow(2, attempt);
+            attempt += 1;
+            await new Promise((r) => setTimeout(r, delay));
+        }
+    }
+}
+/** Atomic rename with retry. The canonical replacement for raw
+ *  `fs.rename(tmp, target)` in persistence paths. */
+export async function renameWithRetry(src, dst, opts = {}) {
+    await withRenameRetry(() => fs.rename(src, dst), opts);
+}
+//# sourceMappingURL=atomic_write.js.map

package/dist/core/atomic_write.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomic_write.js","sourceRoot":"","sources":["../../src/core/atomic_write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AAczC,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;AAE1E,+DAA+D;AAC/D,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,EAAoB,EACpB,OAAkB,EAAE;IAEpB,MAAM,GAAG,GAAQ,IAAI,CAAC,UAAU,IAAI,CAAC,CAAC;IACtC,MAAM,MAAM,GAAK,IAAI,CAAC,cAAc,IAAI,EAAE,CAAC;IAC3C,MAAM,OAAO,GAAI,IAAI,CAAC,cAAc,IAAI,iBAAiB,CAAC;IAC1D,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,SAAS,CAAC;QACR,IAAI,CAAC;YACH,OAAO,MAAM,EAAE,EAAE,CAAC;QACpB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,GAAI,GAA6B,CAAC,IAAI,CAAC;YACjD,IAAI,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,GAAG;gBAAE,MAAM,GAAG,CAAC;YAC7D,MAAM,KAAK,GAAG,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YAC5C,OAAO,IAAI,CAAC,CAAC;YACb,MAAM,IAAI,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;QACjD,CAAC;IACH,CAAC;AACH,CAAC;AAED;qDACqD;AACrD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,GAAW,EAAE,GAAW,EAAE,OAAkB,EAAE;IAE9C,MAAM,eAAe,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC;AACzD,CAAC"}

package/dist/core/audit_log.d.ts

@@ -0,0 +1,43 @@
+export type AuditApprovalMode = 'auto_approved' | 'user_approved' | 'user_rejected' | 'danger_zone_bypass' | 'not_applicable';
+export interface AuditEntryBase {
+    ts: string;
+    kind: string;
+    summary: string;
+    approval_mode: AuditApprovalMode;
+}
+export interface ShellExecAudit extends AuditEntryBase {
+    kind: 'shell.exec';
+    command: string;
+    cwd: string;
+    risk_bucket: 'destructive' | 'elevation' | 'network' | 'safe';
+    risk_reasons: string[];
+    exit_code: number | null;
+    duration_ms: number;
+    killed: boolean;
+    stdout_bytes: number;
+    stderr_bytes: number;
+}
+export interface VerbInvokeAudit extends AuditEntryBase {
+    kind: 'verb.invoke';
+    verb_id: string;
+    args_redacted: Record<string, unknown>;
+    status: 'ok' | 'error';
+    error?: string;
+}
+export interface LifecycleAudit extends AuditEntryBase {
+    kind: 'fs.mkdir' | 'fs.move' | 'project.init' | 'project.set-root';
+    target_path: string;
+    details?: Record<string, unknown>;
+}
+export type AuditEntry = ShellExecAudit | VerbInvokeAudit | LifecycleAudit | AuditEntryBase;
+/** Append a single entry. Best-effort -- never throws. */
+export declare function recordAudit(entry: Partial<AuditEntry> & {
+    kind: string;
+    summary?: string;
+}): Promise<void>;
+/** Read recent entries (newest first). Used by the panel
+ *  audit-trail view + tests. */
+export declare function readRecentAudit(limit?: number): Promise<AuditEntry[]>;
+/** Test seam. */
+export declare function _auditLogPathForTest(): string;
+//# sourceMappingURL=audit_log.d.ts.map

package/dist/core/audit_log.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log.d.ts","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AA8BA,MAAM,MAAM,iBAAiB,GACzB,eAAe,GACf,eAAe,GACf,eAAe,GACf,oBAAoB,GACpB,gBAAgB,CAAC;AAErB,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAgB,MAAM,CAAC;IACzB,IAAI,EAAc,MAAM,CAAC;IACzB,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,iBAAiB,CAAC;CACrC;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,YAAY,CAAC;IAC/B,OAAO,EAAW,MAAM,CAAC;IACzB,GAAG,EAAe,MAAM,CAAC;IACzB,WAAW,EAAO,aAAa,GAAG,WAAW,GAAG,SAAS,GAAG,MAAM,CAAC;IACnE,YAAY,EAAM,MAAM,EAAE,CAAC;IAC3B,SAAS,EAAS,MAAM,GAAG,IAAI,CAAC;IAChC,WAAW,EAAO,MAAM,CAAC;IACzB,MAAM,EAAY,OAAO,CAAC;IAC1B,YAAY,EAAM,MAAM,CAAC;IACzB,YAAY,EAAM,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,eAAgB,SAAQ,cAAc;IACrD,IAAI,EAAc,aAAa,CAAC;IAChC,OAAO,EAAW,MAAM,CAAC;IACzB,aAAa,EAAK,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAC1C,MAAM,EAAY,IAAI,GAAG,OAAO,CAAC;IACjC,KAAK,CAAC,EAAY,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAe,SAAQ,cAAc;IACpD,IAAI,EAAc,UAAU,GAAG,SAAS,GAAG,cAAc,GAAG,kBAAkB,CAAC;IAC/E,WAAW,EAAO,MAAM,CAAC;IACzB,OAAO,CAAC,EAAU,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,UAAU,GAAG,cAAc,GAAG,eAAe,GAAG,cAAc,GAAG,cAAc,CAAC;AAQ5F,0DAA0D;AAC1D,wBAAsB,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,UAAU,CAAC,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAgBhH;AAED;gCACgC;AAChC,wBAAsB,eAAe,CAAC,KAAK,SAAM,GAAG,OAAO,CAAC,UAAU,EAAE,CAAC,CAaxE;AAED,iBAAiB;AACjB,wBAAgB,oBAAoB,IAAI,MAAM,CAE7C"}

package/dist/core/audit_log.js

@@ -0,0 +1,80 @@
+/**
+ * audit_log.ts -- append-only JSONL ledger of every approval-
+ * gated or side-effectful action Forge performs (alpha.59d).
+ *
+ * Pablo rule: TODO debe ser registrado en log de auditoria.
+ *
+ * Storage: $YF_CONFIG_DIR/cache/audit_log.jsonl. Append-only.
+ * Each line is a JSON object with at minimum:
+ *   { ts, kind, summary, ... }
+ *
+ * Failure mode: best-effort. recordAudit never throws -- losing
+ * an audit row is preferable to crashing the chat turn. (The
+ * worst real case is FS full; we surface that via a Logger
+ * warning but the chat keeps working.)
+ *
+ * Distinct from:
+ *   - brain_routing.jsonl (routing decisions per turn)
+ *   - nac3 dispatch log (verb invocations -- this complements
+ *     it with approval + danger zone + outcome).
+ *
+ * Future readers: docs/AUDIT_LOG_SCHEMA.md (TBD) will pin the
+ * shape. For now keep `kind` extensible -- new actions add new
+ * kinds without breaking old readers.
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+function auditLogPath() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const base = process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
+    return path.join(base, 'cache', 'audit_log.jsonl');
+}
+/** Append a single entry. Best-effort -- never throws. */
+export async function recordAudit(entry) {
+    try {
+        const p = auditLogPath();
+        await fs.mkdir(path.dirname(p), { recursive: true });
+        const full = {
+            ts: new Date().toISOString(),
+            summary: entry.summary ?? '',
+            approval_mode: entry.approval_mode ?? 'not_applicable',
+            ...entry,
+        };
+        await fs.appendFile(p, JSON.stringify(full) + '\n', 'utf-8');
+    }
+    catch (err) {
+        /* Best-effort: log to console but never crash the caller. */
+        try {
+            console.warn('[audit] append failed:', err instanceof Error ? err.message : String(err));
+        }
+        catch { /* console may itself be broken in extreme cases */ }
+    }
+}
+/** Read recent entries (newest first). Used by the panel
+ *  audit-trail view + tests. */
+export async function readRecentAudit(limit = 100) {
+    try {
+        const raw = await fs.readFile(auditLogPath(), 'utf-8');
+        const lines = raw.split('\n').filter((l) => l.trim() !== '');
+        const tail = lines.slice(-limit).reverse();
+        const out = [];
+        for (const l of tail) {
+            try {
+                out.push(JSON.parse(l));
+            }
+            catch { /* skip torn line */ }
+        }
+        return out;
+    }
+    catch {
+        return [];
+    }
+}
+/** Test seam. */
+export function _auditLogPathForTest() {
+    return auditLogPath();
+}
+//# sourceMappingURL=audit_log.js.map

package/dist/core/audit_log.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"audit_log.js","sourceRoot":"","sources":["../../src/core/audit_log.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AA6CzB,SAAS,YAAY;IACnB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,EAAE,iBAAiB,CAAC,CAAC;AACrD,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,KAA+D;IAC/F,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;QACzB,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACrD,MAAM,IAAI,GAAe;YACvB,EAAE,EAAc,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACxC,OAAO,EAAS,KAAK,CAAC,OAAO,IAAI,EAAE;YACnC,aAAa,EAAG,KAAK,CAAC,aAAa,IAAI,gBAAgB;YACvD,GAAG,KAAK;SACK,CAAC;QAChB,MAAM,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6DAA6D;QAC7D,IAAI,CAAC;YAAC,OAAO,CAAC,IAAI,CAAC,wBAAwB,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QAAC,CAAC;QACjG,MAAM,CAAC,CAAC,mDAAmD,CAAC,CAAC;IAC/D,CAAC;AACH,CAAC;AAED;gCACgC;AAChC,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAK,GAAG,GAAG;IAC/C,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,EAAE,OAAO,CAAC,CAAC;QACvD,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7D,MAAM,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;QAC3C,MAAM,GAAG,GAAiB,EAAE,CAAC;QAC7B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;YACrB,IAAI,CAAC;gBAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAe,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;QAC/E,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,iBAAiB;AACjB,MAAM,UAAU,oBAAoB;IAClC,OAAO,YAAY,EAAE,CAAC;AACxB,CAAC"}

package/dist/core/brain_config.d.ts

@@ -0,0 +1,50 @@
+/** Provider id matches the slot prefix in the vault
+ *  (byok_<provider>_api_key). */
+export type BrainProvider = 'anthropic' | 'openai' | 'google_ai' | 'deepseek' | 'xai' | 'mistral' | 'cohere' | 'yujin_managed';
+export declare const ALL_BRAIN_PROVIDERS: readonly BrainProvider[];
+/** Vault slot name a given provider stores its key under. The
+ *  yujin_managed virtual provider has no client-side key (the
+ *  worker holds the real provider key); the secret needed for
+ *  auth is the yf_server_api_key in the regular vault, not a
+ *  byok_ slot. We return a stable placeholder so callers that
+ *  query slot existence get a meaningful answer. */
+export declare function vaultSlotForProvider(p: BrainProvider): string;
+export interface TierBinding {
+    provider: BrainProvider;
+    model: string;
+}
+export interface BrainConfig {
+    version: 1;
+    eco: TierBinding;
+    frontier: TierBinding;
+    /** Default tier when the cost router cannot infer from
+     *  workflow state / verb_id. */
+    chat_default_tier: 'eco' | 'frontier';
+    /** PND-069 -- modo eco habilitado. Cuando es false, el router
+     *  sirve TODOS los turnos con frontier (algunos usuarios
+     *  prefieren el mejor modelo siempre y pagan el costo). El
+     *  override explicito /eco por turno sigue ganando. */
+    eco_enabled: boolean;
+    /** PND-069 -- modalidad de billing para el brain Anthropic:
+     *  'plan' = suscripcion Claude (subproceso claude-code-cli);
+     *  'console' = API key (Console). Solo aplica a providers con
+     *  ambas modalidades (hoy: anthropic). Prioridad de resolucion
+     *  en yf chat: flag --provider > este campo > wizard_state.
+     *  Cambiarlo requiere reabrir el panel. */
+    anthropic_mode?: 'plan' | 'console';
+    /** Startup tabs (dogfood 2026-06-10) -- al abrir Forge se
+     *  instancian 4 pestanas del pizarron (grafo grafico, grafo
+     *  semantico, pendings, workflow). Default true; el usuario lo
+     *  apaga con este switch en Ajustes. */
+    startup_tabs_enabled: boolean;
+}
+export declare function defaultBrainConfig(): BrainConfig;
+export declare function readBrainConfig(): Promise<BrainConfig>;
+export declare function writeBrainConfig(cfg: BrainConfig): Promise<void>;
+/** Mutate one tier without losing the other. */
+export declare function setTierBinding(tier: 'eco' | 'frontier', provider: BrainProvider, model: string): Promise<BrainConfig>;
+/** Set the default tier for chat turns the router cannot infer. */
+export declare function setChatDefaultTier(tier: 'eco' | 'frontier'): Promise<BrainConfig>;
+/** Reset to factory defaults. */
+export declare function resetBrainConfig(): Promise<BrainConfig>;
+//# sourceMappingURL=brain_config.d.ts.map

package/dist/core/brain_config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain_config.d.ts","sourceRoot":"","sources":["../../src/core/brain_config.ts"],"names":[],"mappings":"AA+BA;iCACiC;AACjC,MAAM,MAAM,aAAa,GACrB,WAAW,GACX,QAAQ,GACR,WAAW,GACX,UAAU,GACV,KAAK,GACL,SAAS,GACT,QAAQ,GAMR,eAAe,CAAC;AAEpB,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAGvD,CAAC;AAEF;;;;;oDAKoD;AACpD,wBAAgB,oBAAoB,CAAC,CAAC,EAAE,aAAa,GAAG,MAAM,CAW7D;AAED,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,aAAa,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,WAAW;IAC1B,OAAO,EAAE,CAAC,CAAC;IACX,GAAG,EAAE,WAAW,CAAC;IACjB,QAAQ,EAAE,WAAW,CAAC;IACtB;oCACgC;IAChC,iBAAiB,EAAE,KAAK,GAAG,UAAU,CAAC;IACtC;;;2DAGuD;IACvD,WAAW,EAAE,OAAO,CAAC;IACrB;;;;;+CAK2C;IAC3C,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC;;;4CAGwC;IACxC,oBAAoB,EAAE,OAAO,CAAC;CAC/B;AAED,wBAAgB,kBAAkB,IAAI,WAAW,CAShD;AA2BD,wBAAsB,eAAe,IAAI,OAAO,CAAC,WAAW,CAAC,CAyB5D;AAED,wBAAsB,gBAAgB,CAAC,GAAG,EAAE,WAAW,GAAG,OAAO,CAAC,IAAI,CAAC,CAMtE;AAED,gDAAgD;AAChD,wBAAsB,cAAc,CAClC,IAAI,EAAE,KAAK,GAAG,UAAU,EACxB,QAAQ,EAAE,aAAa,EACvB,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,WAAW,CAAC,CAKtB;AAED,mEAAmE;AACnE,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,WAAW,CAAC,CAKvF;AAED,iCAAiC;AACjC,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,WAAW,CAAC,CAI7D"}

package/dist/core/brain_config.js

@@ -0,0 +1,142 @@
+/**
+ * Brain config -- which provider + model serves each tier
+ * (alpha.51).
+ *
+ * Storage:
+ *   $YF_CONFIG_DIR/brain_config.json (or ~/.yujin-forge/brain_config.json)
+ *
+ * Shape:
+ *   {
+ *     "version": 1,
+ *     "eco":      { "provider": "google_ai", "model": "gemini-2.5-flash-lite" },
+ *     "frontier": { "provider": "anthropic", "model": "claude-opus-4-7" },
+ *     "chat_default_tier": "frontier"
+ *   }
+ *
+ * The API keys themselves live in the encrypted vault (see
+ * src/core/provider_keys.ts). This file ONLY records the
+ * provider+model selection per tier; the runtime cost router
+ * looks up the matching API key when it needs to invoke.
+ *
+ * Defaults (no file present):
+ *   eco       -> google_ai / gemini-2.5-flash-lite
+ *   frontier  -> anthropic / claude-opus-4-7
+ *   chat_default_tier -> 'frontier'
+ *
+ * ASCII-only.
+ */
+import { promises as fs } from 'node:fs';
+import path from 'node:path';
+import os from 'node:os';
+export const ALL_BRAIN_PROVIDERS = [
+    'anthropic', 'openai', 'google_ai', 'deepseek', 'xai', 'mistral', 'cohere',
+    'yujin_managed',
+];
+/** Vault slot name a given provider stores its key under. The
+ *  yujin_managed virtual provider has no client-side key (the
+ *  worker holds the real provider key); the secret needed for
+ *  auth is the yf_server_api_key in the regular vault, not a
+ *  byok_ slot. We return a stable placeholder so callers that
+ *  query slot existence get a meaningful answer. */
+export function vaultSlotForProvider(p) {
+    switch (p) {
+        case 'anthropic': return 'anthropic_api_key';
+        case 'openai': return 'openai_api_key';
+        case 'google_ai': return 'google_ai_key';
+        case 'deepseek': return 'deepseek_api_key';
+        case 'xai': return 'xai_api_key';
+        case 'mistral': return 'mistral_api_key';
+        case 'cohere': return 'cohere_api_key';
+        case 'yujin_managed': return 'yujin_managed';
+    }
+}
+export function defaultBrainConfig() {
+    return {
+        version: 1,
+        eco: { provider: 'google_ai', model: 'gemini-2.5-flash-lite' },
+        frontier: { provider: 'anthropic', model: 'claude-opus-4-7' },
+        chat_default_tier: 'frontier',
+        eco_enabled: true,
+        startup_tabs_enabled: true,
+    };
+}
+function brainConfigPath() {
+    const home = process.env.HOME || process.env.USERPROFILE || os.homedir();
+    const base = process.env.YF_CONFIG_DIR || path.join(home, '.yujin-forge');
+    return path.join(base, 'brain_config.json');
+}
+function normaliseProvider(v) {
+    if (typeof v !== 'string')
+        return null;
+    const lc = v.toLowerCase().trim();
+    return ALL_BRAIN_PROVIDERS.includes(lc) ? lc : null;
+}
+function normaliseTierBinding(v, fallback) {
+    if (!v || typeof v !== 'object')
+        return fallback;
+    const obj = v;
+    const provider = normaliseProvider(obj.provider);
+    const model = typeof obj.model === 'string' && obj.model.trim() !== ''
+        ? obj.model.trim()
+        : fallback.model;
+    return {
+        provider: provider ?? fallback.provider,
+        model,
+    };
+}
+export async function readBrainConfig() {
+    const def = defaultBrainConfig();
+    try {
+        const raw = await fs.readFile(brainConfigPath(), 'utf-8');
+        const j = JSON.parse(raw);
+        const cfg = {
+            version: 1,
+            eco: normaliseTierBinding(j.eco, def.eco),
+            frontier: normaliseTierBinding(j.frontier, def.frontier),
+            chat_default_tier: (j.chat_default_tier === 'eco' || j.chat_default_tier === 'frontier')
+                ? j.chat_default_tier
+                : def.chat_default_tier,
+            /* Archivos previos a PND-069 no tienen el campo: default
+             * true (comportamiento historico). */
+            eco_enabled: j.eco_enabled !== false,
+            startup_tabs_enabled: j.startup_tabs_enabled !== false,
+        };
+        if (j.anthropic_mode === 'plan' || j.anthropic_mode === 'console') {
+            cfg.anthropic_mode = j.anthropic_mode;
+        }
+        return cfg;
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return def;
+        throw err;
+    }
+}
+export async function writeBrainConfig(cfg) {
+    const p = brainConfigPath();
+    await fs.mkdir(path.dirname(p), { recursive: true });
+    const tmp = p + '.tmp';
+    await fs.writeFile(tmp, JSON.stringify(cfg, null, 2), 'utf-8');
+    await fs.rename(tmp, p);
+}
+/** Mutate one tier without losing the other. */
+export async function setTierBinding(tier, provider, model) {
+    const cfg = await readBrainConfig();
+    cfg[tier] = { provider, model };
+    await writeBrainConfig(cfg);
+    return cfg;
+}
+/** Set the default tier for chat turns the router cannot infer. */
+export async function setChatDefaultTier(tier) {
+    const cfg = await readBrainConfig();
+    cfg.chat_default_tier = tier;
+    await writeBrainConfig(cfg);
+    return cfg;
+}
+/** Reset to factory defaults. */
+export async function resetBrainConfig() {
+    const def = defaultBrainConfig();
+    await writeBrainConfig(def);
+    return def;
+}
+//# sourceMappingURL=brain_config.js.map

package/dist/core/brain_config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"brain_config.js","sourceRoot":"","sources":["../../src/core/brain_config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AAmBzB,MAAM,CAAC,MAAM,mBAAmB,GAA6B;IAC3D,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,UAAU,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ;IAC1E,eAAe;CAChB,CAAC;AAEF;;;;;oDAKoD;AACpD,MAAM,UAAU,oBAAoB,CAAC,CAAgB;IACnD,QAAQ,CAAC,EAAE,CAAC;QACV,KAAK,WAAW,CAAC,CAAO,OAAO,mBAAmB,CAAC;QACnD,KAAK,QAAQ,CAAC,CAAU,OAAO,gBAAgB,CAAC;QAChD,KAAK,WAAW,CAAC,CAAO,OAAO,eAAe,CAAC;QAC/C,KAAK,UAAU,CAAC,CAAQ,OAAO,kBAAkB,CAAC;QAClD,KAAK,KAAK,CAAC,CAAa,OAAO,aAAa,CAAC;QAC7C,KAAK,SAAS,CAAC,CAAS,OAAO,iBAAiB,CAAC;QACjD,KAAK,QAAQ,CAAC,CAAU,OAAO,gBAAgB,CAAC;QAChD,KAAK,eAAe,CAAC,CAAG,OAAO,eAAe,CAAC;IACjD,CAAC;AACH,CAAC;AAiCD,MAAM,UAAU,kBAAkB;IAChC,OAAO;QACL,OAAO,EAAE,CAAC;QACV,GAAG,EAAO,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,uBAAuB,EAAE;QACnE,QAAQ,EAAE,EAAE,QAAQ,EAAE,WAAW,EAAE,KAAK,EAAE,iBAAiB,EAAE;QAC7D,iBAAiB,EAAE,UAAU;QAC7B,WAAW,EAAE,IAAI;QACjB,oBAAoB,EAAE,IAAI;KAC3B,CAAC;AACJ,CAAC;AAED,SAAS,eAAe;IACtB,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,EAAE,CAAC,OAAO,EAAE,CAAC;IACzE,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC;IAC1E,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,mBAAmB,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,iBAAiB,CAAC,CAAU;IACnC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC;IAClC,OAAQ,mBAAyC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAE,EAAoB,CAAC,CAAC,CAAC,IAAI,CAAC;AAChG,CAAC;AAED,SAAS,oBAAoB,CAAC,CAAU,EAAE,QAAqB;IAC7D,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACjD,MAAM,GAAG,GAAG,CAA4B,CAAC;IACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACjD,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,KAAK,KAAK,QAAQ,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;QACpE,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE;QAClB,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC;IACnB,OAAO;QACL,QAAQ,EAAE,QAAQ,IAAI,QAAQ,CAAC,QAAQ;QACvC,KAAK;KACN,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe;IACnC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,eAAe,EAAE,EAAE,OAAO,CAAC,CAAC;QAC1D,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAyB,CAAC;QAClD,MAAM,GAAG,GAAgB;YACvB,OAAO,EAAE,CAAC;YACV,GAAG,EAAE,oBAAoB,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,CAAC,GAAG,CAAC;YACzC,QAAQ,EAAE,oBAAoB,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC;YACxD,iBAAiB,EAAE,CAAC,CAAC,CAAC,iBAAiB,KAAK,KAAK,IAAI,CAAC,CAAC,iBAAiB,KAAK,UAAU,CAAC;gBACtF,CAAC,CAAC,CAAC,CAAC,iBAAiB;gBACrB,CAAC,CAAC,GAAG,CAAC,iBAAiB;YACzB;kDACsC;YACtC,WAAW,EAAE,CAAC,CAAC,WAAW,KAAK,KAAK;YACpC,oBAAoB,EAAE,CAAC,CAAC,oBAAoB,KAAK,KAAK;SACvD,CAAC;QACF,IAAI,CAAC,CAAC,cAAc,KAAK,MAAM,IAAI,CAAC,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;YAClE,GAAG,CAAC,cAAc,GAAG,CAAC,CAAC,cAAc,CAAC;QACxC,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,GAAG,CAAC;QACjE,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,GAAgB;IACrD,MAAM,CAAC,GAAG,eAAe,EAAE,CAAC;IAC5B,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,MAAM,GAAG,GAAG,CAAC,GAAG,MAAM,CAAC;IACvB,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC/D,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;AAC1B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAwB,EACxB,QAAuB,EACvB,KAAa;IAEb,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,GAAG,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAChC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,IAAwB;IAC/D,MAAM,GAAG,GAAG,MAAM,eAAe,EAAE,CAAC;IACpC,GAAG,CAAC,iBAAiB,GAAG,IAAI,CAAC;IAC7B,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,iCAAiC;AACjC,MAAM,CAAC,KAAK,UAAU,gBAAgB;IACpC,MAAM,GAAG,GAAG,kBAAkB,EAAE,CAAC;IACjC,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAC5B,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/core/budget.d.ts

@@ -0,0 +1,96 @@
+export type PlanSlug = 'free' | 'starter' | 'pro' | 'pro_plus' | 'byok_only';
+interface PlanLimits {
+    /** Tokens in+out together per month. 0 = blocked, Infinity = unlimited. */
+    eco_tokens: number;
+    frontier_tokens: number;
+    label: string;
+    /** Storefront link when the user wants to buy an extension. */
+    extension_url?: string;
+}
+export interface BudgetOverrides {
+    version: 1;
+    /** Bought eco tokens added to plan baseline. */
+    eco_extra_tokens: number;
+    /** Bought frontier tokens added to plan baseline. */
+    frontier_extra_tokens: number;
+}
+/** Persist overrides (called after a successful purchase). */
+export declare function setBudgetOverrides(next: Partial<BudgetOverrides>): Promise<BudgetOverrides>;
+export declare function isPlanSlug(s: string): s is PlanSlug;
+export declare function listPlanSlugs(): readonly PlanSlug[];
+/** Persist a local plan override -- used by `yf brain config
+ *  --plan <slug>` and by tests. The license_sync still wins when
+ *  a valid license.json exists, EXCEPT if this override is
+ *  newer (so tests + dev can pretend to be on any plan). */
+export declare function setLocalPlanOverride(plan: PlanSlug | null): Promise<void>;
+export interface BudgetStatus {
+    plan: PlanSlug;
+    plan_label: string;
+    month: string;
+    renewal_at: string;
+    extension_url?: string;
+    /** alpha.59m -- where the numbers came from. 'server' is
+     *  billing-grade (worker KV); 'local' is the on-disk cost_meter
+     *  cache (used when offline / byok_only / no license). The UI
+     *  shows a chip so the user knows which one is in play. */
+    source?: 'local' | 'server';
+    /** When source='server', the server-reported plan slug (worker
+     *  vocabulary -- paid / trial / free-public / etc) so the UI
+     *  can label the chip with the actual billing plan, not the
+     *  local override. */
+    server_plan?: string;
+    eco: {
+        cap: number;
+        used: number;
+        remaining: number;
+        /** Percentage 0..100 (capped). Infinity caps -> 0 (no progress bar). */
+        used_pct: number;
+    };
+    frontier: {
+        cap: number;
+        used: number;
+        remaining: number;
+        used_pct: number;
+    };
+}
+/** Headline call: returns everything the UI needs to render the
+ *  budget card.
+ *
+ *  alpha.59m -- the source preference is now:
+ *    1. Server-side cost_meter (KV in the HITO 4 worker) when
+ *       readCostMeter() succeeds. This is billing-grade.
+ *    2. Local cost_meter.json fallback. Used when there is no
+ *       license / vault secret / network. NOT a "legacy fallback"
+ *       (forbidden by feedback_no_fallback_to_legacy) -- it is
+ *       the legitimate source for BYOK users.
+ *
+ *  Opt-out: YF_USE_HITO4_FLOWS=0 forces local.
+ */
+export declare function readBudgetStatus(): Promise<BudgetStatus>;
+/** Helpers for tests / debug. */
+export declare function _planDefaults(): Record<PlanSlug, PlanLimits>;
+export interface CapCheck {
+    /** True when the tier still has budget for the turn. */
+    allowed: boolean;
+    /** Tier the check was made against. */
+    tier: 'eco' | 'frontier';
+    /** Plan in effect. */
+    plan: PlanSlug;
+    /** Cap for the tier (Infinity for unlimited). */
+    cap: number;
+    /** Tokens consumed this month. */
+    used: number;
+    /** Remaining tokens (Infinity for unlimited). */
+    remaining: number;
+    /** Suggested upgrade URL when blocked. */
+    extension_url?: string;
+    /** Reason string for logs. */
+    reason: string;
+}
+/** Pre-flight check: would a turn at `tier` exceed the cap?
+ *  Returns {allowed:false} when used >= cap. The chat handler
+ *  responds with 429 plan_limit_exceeded and the panel surfaces
+ *  the cap modal. */
+export declare function checkCap(tier: 'eco' | 'frontier'): Promise<CapCheck>;
+export {};
+//# sourceMappingURL=budget.d.ts.map

package/dist/core/budget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.d.ts","sourceRoot":"","sources":["../../src/core/budget.ts"],"names":[],"mappings":"AA2BA,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,SAAS,GAAG,KAAK,GAAG,UAAU,GAAG,WAAW,CAAC;AAE7E,UAAU,UAAU;IAClB,2EAA2E;IAC3E,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;IACd,+DAA+D;IAC/D,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAeD,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,CAAC,CAAC;IACX,gDAAgD;IAChD,gBAAgB,EAAE,MAAM,CAAC;IACzB,qDAAqD;IACrD,qBAAqB,EAAE,MAAM,CAAC;CAC/B;AAuBD,8DAA8D;AAC9D,wBAAsB,kBAAkB,CAAC,IAAI,EAAE,OAAO,CAAC,eAAe,CAAC,GAAG,OAAO,CAAC,eAAe,CAAC,CAajG;AAUD,wBAAgB,UAAU,CAAC,CAAC,EAAE,MAAM,GAAG,CAAC,IAAI,QAAQ,CAEnD;AAED,wBAAgB,aAAa,IAAI,SAAS,QAAQ,EAAE,CAEnD;AAED;;;4DAG4D;AAC5D,wBAAsB,oBAAoB,CAAC,IAAI,EAAE,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAU/E;AA0ED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,QAAQ,CAAC;IACf,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,EAAE,MAAM,CAAC;IACnB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;+DAG2D;IAC3D,MAAM,CAAC,EAAE,OAAO,GAAG,QAAQ,CAAC;IAC5B;;;0BAGsB;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,GAAG,EAAE;QACH,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,wEAAwE;QACxE,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,QAAQ,EAAE;QACR,GAAG,EAAE,MAAM,CAAC;QACZ,IAAI,EAAE,MAAM,CAAC;QACb,SAAS,EAAE,MAAM,CAAC;QAClB,QAAQ,EAAE,MAAM,CAAC;KAClB,CAAC;CACH;AA0ED;;;;;;;;;;;;GAYG;AACH,wBAAsB,gBAAgB,IAAI,OAAO,CAAC,YAAY,CAAC,CA0C9D;AAED,iCAAiC;AACjC,wBAAgB,aAAa,IAAI,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,CAE5D;AAED,MAAM,WAAW,QAAQ;IACvB,wDAAwD;IACxD,OAAO,EAAE,OAAO,CAAC;IACjB,uCAAuC;IACvC,IAAI,EAAE,KAAK,GAAG,UAAU,CAAC;IACzB,sBAAsB;IACtB,IAAI,EAAE,QAAQ,CAAC;IACf,iDAAiD;IACjD,GAAG,EAAE,MAAM,CAAC;IACZ,kCAAkC;IAClC,IAAI,EAAE,MAAM,CAAC;IACb,iDAAiD;IACjD,SAAS,EAAE,MAAM,CAAC;IAClB,0CAA0C;IAC1C,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,8BAA8B;IAC9B,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;qBAGqB;AACrB,wBAAsB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,UAAU,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgB1E"}