@nurix/nustack 0.25.5 → 0.26.0

package/dist/commands/doctor.js

@@ -85,7 +85,7 @@ export async function runDoctor(options) {
     }
     else {
         const stamp = store.db.prepare("PRAGMA user_version").get().user_version;
-        add("state", "Local store schema", "ok", `v${stamp}`);
+        add("state", "Local store schema", "ok", `schema ${stamp}`);
     }
     const repository = resolveRepositoryOrNull(cwd);
     if (!repository) {

package/dist/commands/store.js

@@ -9,7 +9,7 @@ import { countRecords, releaseUnboundRows } from "../lib/records/recordsTable.js
 import { drainSessionLegs } from "../lib/sessions/sessionEvents.js";
 import { pullAll, pullCursor, pushOutbox } from "../lib/sync/client.js";
 import { countOutbox, hasDueEntry, newestOutboxError } from "../lib/sync/outbox.js";
-import { cliVersion, machineStorePath, storeStampOf } from "../lib/store/open.js";
+import { cliVersion, machineSchemaVersion, machineStorePath } from "../lib/store/open.js";
 const CLIENT_OUTDATED = "CLIENT_OUTDATED";
 function answeredRefusal(command, options, summaries) {
     for (const summary of summaries) {
@@ -133,7 +133,7 @@ export async function runStoreStatus(options) {
         const result = {
             path: machineStorePath(),
             version: cliVersion(),
-            stamp: storeStampOf(cliVersion()),
+            stamp: machineSchemaVersion(),
             cursor: pullCursor(store),
             outbox: countOutbox(store.db, Date.now()),
             records: tableCount("harness_records"),

package/dist/lib/desktop_settings.js

@@ -1,5 +1,41 @@
 import { readFileSync } from "node:fs";
 import { desktopSettingsPath } from "./local_store/paths.js";
+export const CLASSIFIERS = ["laya", "jev"];
+export const TASK_KINDS = ["search", "explain", "review", "plan", "debug", "edit", "test", "docs", "run"];
+export const READ_ONLY_TASKS = ["search", "explain", "review", "plan", "debug"];
+export const ROUTE_MODES = ["auto", "local", "claude"];
+export const CLAUDE_MODELS = ["haiku", "sonnet", "opus", "fable"];
+export const DEFAULT_TASK_ROUTE = { mode: "auto", model: null };
+const CLASSIFIER_URL_MAX = 200;
+export function isLoopbackUrl(value) {
+    if (typeof value !== "string" || value.length > CLASSIFIER_URL_MAX || /\s/.test(value))
+        return false;
+    return ["http://127.0.0.1", "http://localhost", "http://[::1]"].some((host) => {
+        if (!value.startsWith(host))
+            return false;
+        const rest = value.slice(host.length);
+        return rest === "" || rest.startsWith(":") || rest.startsWith("/");
+    });
+}
+function taskRoutesOf(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return null;
+    const out = {};
+    for (const [key, raw] of Object.entries(value)) {
+        const kind = TASK_KINDS.find((known) => known === key);
+        if (kind === undefined || !raw || typeof raw !== "object")
+            return null;
+        const route = raw;
+        const mode = ROUTE_MODES.find((known) => known === route.mode);
+        if (mode === undefined || (mode === "local" && !READ_ONLY_TASKS.includes(kind)))
+            return null;
+        const model = route.model === undefined || route.model === null ? null : CLAUDE_MODELS.find((known) => known === route.model);
+        if (model === undefined)
+            return null;
+        out[kind] = { mode, model };
+    }
+    return out;
+}
 export const GATE_THRESHOLD_TOKENS_MIN = 1_000;
 export const GATE_THRESHOLD_TOKENS_MAX = 200_000;
 export const DIGEST_BUDGET_MS_MIN = 5_000;
@@ -17,7 +53,7 @@ function sectionOf(value) {
 export function readDesktopSettings() {
     const defaults = {
         placement: { memory: DEFAULT_PLACEMENT, securityFindings: DEFAULT_PLACEMENT },
-        routing: { localReader: false, gateThresholdTokens: null, digestBudgetMs: null, lane: false },
+        routing: { localReader: false, gateThresholdTokens: null, digestBudgetMs: null, lane: false, classifier: null, classifierUrl: null, taskRoutes: null },
     };
     let parsed;
     try {
@@ -40,6 +76,9 @@ export function readDesktopSettings() {
             gateThresholdTokens: boundedIntegerOf(routing.gateThresholdTokens, GATE_THRESHOLD_TOKENS_MIN, GATE_THRESHOLD_TOKENS_MAX),
             digestBudgetMs: boundedIntegerOf(routing.digestBudgetMs, DIGEST_BUDGET_MS_MIN, DIGEST_BUDGET_MS_MAX),
             lane: routing.lane === true,
+            classifier: CLASSIFIERS.find((known) => known === routing.classifier) ?? null,
+            classifierUrl: isLoopbackUrl(routing.classifierUrl) ? routing.classifierUrl : null,
+            taskRoutes: taskRoutesOf(routing.taskRoutes),
         },
     };
 }

package/dist/lib/gate/agentHook.js

@@ -6,6 +6,7 @@ import { readSettingsLayers } from "../lane/credential.js";
 import { LANE_AGENT_NAME, LANE_AGENT_ROUTE, LANE_MODEL_ID } from "../lane/install.js";
 import { isUnderPrefix, readProxy } from "../lane/proxyRecord.js";
 import { GateInputError } from "./readGate.js";
+import { classifyTask, destinationFor } from "./taskRouter.js";
 export const READ_ONLY_TOOLS = new Set(["Read", "Grep", "Glob", "LS", "NotebookRead"]);
 export const PASS_ON_AGENT_PERMISSION_RULE = true;
 function parseAgentCall(text) {
@@ -111,7 +112,8 @@ export async function answerAgentCall(text, env, home = os.homedir()) {
     const proxy = readProxy();
     if (!proxy.live || !isUnderPrefix(baseUrl, proxy.prefix))
         return null;
-    if (!readDesktopSettings().routing.lane)
+    const { routing } = readDesktopSettings();
+    if (!routing.lane)
         return null;
     const model = call.toolInput.model;
     if (model !== undefined && model !== null && model !== "haiku")
@@ -119,12 +121,27 @@ export async function answerAgentCall(text, env, home = os.homedir()) {
     const type = call.toolInput.subagent_type;
     if (typeof type !== "string")
         return null;
-    if (type !== "Explore" && !isReadOnlyDefinition(type, call.cwd, home))
+    const isRuleLocal = type === "Explore" || isReadOnlyDefinition(type, call.cwd, home);
+    if (routing.classifier === null && !isRuleLocal)
         return null;
     if (PASS_ON_AGENT_PERMISSION_RULE && hasAgentPermissionRule(readSettingsLayers({ env, cwd: call.cwd, home })))
         return null;
     if (await isLaneLatched(call.sessionId))
         return null;
-    const updatedInput = LANE_AGENT_ROUTE === "model" ? { ...call.toolInput, model: LANE_MODEL_ID } : { ...call.toolInput, subagent_type: LANE_AGENT_NAME };
+    if (routing.classifier !== null) {
+        const decision = await classifyTask(routing.classifier, routing.classifierUrl, taskState(call.toolInput), env);
+        if (decision === null)
+            return null;
+        const destination = destinationFor(decision, routing.taskRoutes);
+        if (destination.to === "local")
+            return allow({ ...call.toolInput, subagent_type: LANE_AGENT_NAME });
+        return destination.model !== null && (model === undefined || model === null) ? allow({ ...call.toolInput, model: destination.model }) : null;
+    }
+    return allow(LANE_AGENT_ROUTE === "model" ? { ...call.toolInput, model: LANE_MODEL_ID } : { ...call.toolInput, subagent_type: LANE_AGENT_NAME });
+}
+export function taskState(toolInput) {
+    return [toolInput.description, toolInput.prompt].filter((part) => typeof part === "string" && part !== "").join("\n\n");
+}
+function allow(updatedInput) {
     return `${JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "allow", updatedInput } })}\n`;
 }

package/dist/lib/gate/taskRouter.js

@@ -0,0 +1,106 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { DEFAULT_TASK_ROUTE, READ_ONLY_TASKS } from "../desktop_settings.js";
+const runFile = promisify(execFile);
+export const LAYA_DEFAULT_BASE_URL = "http://127.0.0.1:11435";
+export const JEV_BASE_URL = "https://api.typesafe.ai";
+export const CLASSIFIER_MODELS = { laya: "laya", jev: "jev-latest" };
+export const TASK_ROUTER_KEYCHAIN_SERVICE = "nustack-task-router";
+export const TASK_ROUTER_KEYCHAIN_ACCOUNT = "typesafe-api-key";
+export const CLASSIFY_TIMEOUT_MS = 1_500;
+export const MIN_CONFIDENCE = 0.5;
+export const STATE_MAX_CHARS = 4_000;
+export const LOCAL_OK_THRESHOLD = 0.5;
+export const TASK_KIND_CRITERIA = {
+    search: "Find files, code, symbols or usages in a codebase",
+    explain: "Read code or documents and explain or summarise them",
+    review: "Review or audit code for problems without changing it",
+    plan: "Design or plan a change before making it",
+    debug: "Diagnose why something fails, without fixing it",
+    edit: "Write, change, fix or refactor code or files",
+    test: "Write or update tests",
+    docs: "Write or update documentation",
+    run: "Run commands, builds, tests or scripts",
+};
+export function classifyRequest(classifier, state) {
+    return {
+        model: CLASSIFIER_MODELS[classifier],
+        state: state.slice(0, STATE_MAX_CHARS),
+        questions: {
+            task: { type: "choice", instructions: "What kind of work does this coding sub-agent task ask for?", criteria: TASK_KIND_CRITERIA },
+            local_ok: {
+                type: "noul",
+                instructions: "Could a small local model do this task well by reading files alone, with no edits and no commands?",
+                labels: { false: "needs Claude", true: "a small model can" },
+            },
+        },
+    };
+}
+export function readDecision(body) {
+    if (body === null || typeof body !== "object")
+        return null;
+    const answers = body.answers;
+    const answer = answers?.task;
+    if (!answer)
+        return null;
+    const kind = Object.keys(TASK_KIND_CRITERIA).find((known) => known === answer.choice);
+    const confidence = typeof answer.answer_confidence === "number" ? answer.answer_confidence : answer.confidence;
+    if (kind === undefined || typeof confidence !== "number" || confidence < MIN_CONFIDENCE)
+        return null;
+    const localOk = answers?.local_ok?.noul;
+    return { kind, confidence, localOk: typeof localOk === "number" ? localOk : null };
+}
+export function destinationFor(decision, routes) {
+    const route = routes?.[decision.kind] ?? DEFAULT_TASK_ROUTE;
+    const isReadOnly = READ_ONLY_TASKS.includes(decision.kind);
+    if (route.mode === "local" && isReadOnly)
+        return { to: "local" };
+    if (route.mode === "auto" && isReadOnly && (decision.localOk ?? 0) >= LOCAL_OK_THRESHOLD)
+        return { to: "local" };
+    return { to: "claude", model: route.model };
+}
+export async function readJevKey(env) {
+    const fromEnv = env.TYPESAFE_API_KEY?.trim();
+    if (fromEnv)
+        return fromEnv;
+    const bin = env.NUSTACK_KEYCHAIN_BIN?.trim() || (process.platform === "darwin" ? "/usr/bin/security" : null);
+    if (bin === null)
+        return null;
+    try {
+        const { stdout } = await runFile(bin, ["find-generic-password", "-s", TASK_ROUTER_KEYCHAIN_SERVICE, "-a", TASK_ROUTER_KEYCHAIN_ACCOUNT, "-w"], {
+            env,
+            timeout: 1_000,
+        });
+        return stdout.trim() || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function classifierBase(classifier, classifierUrl, env) {
+    const base = classifier === "laya" ? (classifierUrl ?? LAYA_DEFAULT_BASE_URL) : env.TYPESAFE_BASE_URL?.trim() || JEV_BASE_URL;
+    return base.replace(/\/+$/, "");
+}
+export async function classifyTask(classifier, classifierUrl, state, env) {
+    const headers = { "content-type": "application/json" };
+    if (classifier === "jev") {
+        const key = await readJevKey(env);
+        if (key === null)
+            return null;
+        headers.authorization = `Bearer ${key}`;
+    }
+    try {
+        const response = await fetch(`${classifierBase(classifier, classifierUrl, env)}/v1/systemone`, {
+            method: "POST",
+            headers,
+            body: JSON.stringify(classifyRequest(classifier, state)),
+            signal: AbortSignal.timeout(CLASSIFY_TIMEOUT_MS),
+        });
+        if (!response.ok)
+            return null;
+        return readDecision(await response.json());
+    }
+    catch {
+        return null;
+    }
+}

package/dist/lib/lane/decide.js

@@ -9,7 +9,7 @@ export const SUBAGENT_MODEL_ENV = "CLAUDE_CODE_SUBAGENT_MODEL";
 export const SUBAGENT_MODEL_OVERRIDES_ROUTE = false;
 export const LANE_SENTENCES = {
     unreleased: "The light-model lane is not released in this build.",
-    "switch-off": "The lane is switched off in NuStack's Routing & agents settings.",
+    "switch-off": "The lane is switched off in Settings → Desktop app → Local models.",
     "proxy-down": "NuStack's lane proxy is not running; open the NuStack desktop app.",
     "bedrock-or-vertex": "This session runs on Bedrock or Vertex, which the lane does not carry.",
     "subscription-credential": "This session signs in with a Claude subscription, which the lane never carries.",

package/dist/lib/local_store/device_state.js

@@ -1,4 +1,4 @@
-import { cliVersion, storeStampOf } from "../store/open.js";
+import { machineSchemaVersion } from "../store/open.js";
 import { withTransaction } from "./database.js";
 function mapRow(row) {
     return {
@@ -62,7 +62,7 @@ export function upsertDeviceState(store, patch) {
             active_organization_id: merged.activeOrganizationId,
             keychain_service: merged.keychainService,
             keychain_account: merged.keychainAccount,
-            schema_version: storeStampOf(cliVersion()),
+            schema_version: machineSchemaVersion(),
             last_auth_refresh_at_ms: merged.lastAuthRefreshAtMs,
             created_at_ms: merged.createdAtMs,
             updated_at_ms: now,

package/dist/lib/store/open.js

@@ -4,18 +4,17 @@ import os from "node:os";
 import path from "node:path";
 import { mkdirSecure } from "../secure_file.js";
 import { nustackHomeDir } from "../local_store/paths.js";
-import { StoreTooNewError, versionVerdict, wipeStaleStore } from "./wipe.js";
+import { StoreTooNewError, restoreHeldFolders, versionVerdict, wipeStaleStore } from "./wipe.js";
 export function machineStorePath(home = os.homedir()) {
     return path.join(home, ".nustack", "nustack.db");
 }
 export function databaseFiles(dbFile) {
     return [dbFile, `${dbFile}-wal`, `${dbFile}-shm`];
 }
-export function storeStampOf(version) {
-    const match = /^v?(\d+)\.(\d+)/.exec(version.trim());
-    if (!match)
-        throw new Error(`not a release number: ${version}`);
-    return Number(match[1]) * 1000 + Number(match[2]);
+let schemaVersionCache;
+export function machineSchemaVersion() {
+    schemaVersionCache ??= Number(readFileSync(new URL("../../../dist/machine.version", import.meta.url), "utf8").trim());
+    return schemaVersionCache;
 }
 let cliVersionCache;
 export function cliVersion() {
@@ -100,7 +99,8 @@ function settleSchema(db, stamp) {
 export async function openMachineDatabase(dbFile = machineStorePath()) {
     retireReplacedStores();
     await mkdirSecure(path.dirname(dbFile));
-    const stamp = storeStampOf(cliVersion());
+    const stamp = machineSchemaVersion();
+    let held = [];
     for (let attempt = 0; attempt < 2; attempt += 1) {
         const db = await withSuppressedSqliteWarning(() => openSqliteFile(dbFile));
         try {
@@ -108,6 +108,8 @@ export async function openMachineDatabase(dbFile = machineStorePath()) {
             db.exec("PRAGMA journal_mode = WAL");
             db.exec("PRAGMA foreign_keys = OFF");
             if (settleSchema(db, stamp)) {
+                if (held.length > 0)
+                    restoreHeldFolders(db, held);
                 await chmod(dbFile, 0o600).catch(() => { });
                 return db;
             }
@@ -116,7 +118,7 @@ export async function openMachineDatabase(dbFile = machineStorePath()) {
             db.close();
             throw error;
         }
-        await wipeStaleStore(db, dbFile);
+        held = await wipeStaleStore(db, dbFile);
     }
     throw new Error(`the machine store at ${dbFile} could not be recreated`);
 }
@@ -126,7 +128,7 @@ export async function openMachineDatabaseReadOnly(dbFile = machineStorePath()) {
     const db = await withSuppressedSqliteWarning(() => openSqliteFile(dbFile, { readOnly: true }));
     try {
         db.exec("PRAGMA busy_timeout = 2000");
-        if (userVersionOf(db) === storeStampOf(cliVersion()))
+        if (userVersionOf(db) === machineSchemaVersion())
             return db;
     }
     catch {

package/dist/lib/store/wipe.js

@@ -6,19 +6,32 @@ export function versionVerdict(found, own) {
         return "same";
     return found > own ? "newer" : "older";
 }
-const releaseOf = (stamp) => `${Math.floor(stamp / 1000)}.${stamp % 1000}`;
 export class StoreTooNewError extends Error {
     code = "STORE_TOO_NEW";
     foundStamp;
     ownStamp;
     constructor(foundStamp, ownStamp) {
-        super(`This machine's NuStack store was created by NuStack ${releaseOf(foundStamp)}, newer than this CLI (${releaseOf(ownStamp)}). Update NuStack: ${UPGRADE_COMMAND}`);
+        super(`This machine's NuStack store is schema ${foundStamp}, newer than this CLI reads (${ownStamp}). Update NuStack: ${UPGRADE_COMMAND}`);
         this.name = "StoreTooNewError";
         this.foundStamp = foundStamp;
         this.ownStamp = ownStamp;
     }
 }
+function heldFolders(db) {
+    try {
+        return db.prepare("SELECT path, label, project_id, added_at FROM folder_roster").all();
+    }
+    catch {
+        return [];
+    }
+}
+export function restoreHeldFolders(db, held) {
+    const insert = db.prepare("INSERT OR IGNORE INTO folder_roster (path, label, project_id, added_at) VALUES (?, ?, ?, ?)");
+    for (const row of held)
+        insert.run(row.path, row.label, row.project_id, row.added_at);
+}
 export async function wipeStaleStore(db, dbFile) {
+    const held = heldFolders(db);
     try {
         const pending = db.prepare("SELECT count(*) AS n FROM sync_outbox").get();
         if (Number(pending?.n ?? 0) > 0) {
@@ -31,4 +44,5 @@ export async function wipeStaleStore(db, dbFile) {
     db.close();
     for (const file of [dbFile, `${dbFile}-wal`, `${dbFile}-shm`])
         rmSync(file, { force: true });
+    return held;
 }

package/dist/machine.sql

@@ -108,6 +108,10 @@ CREATE TABLE `projects` (
     
     
     
+    `repository_name`      text,
+    
+    
+    
     
     
     
@@ -529,6 +533,8 @@ CREATE UNIQUE INDEX `projects_init_idempotency_key_unique` ON `projects` (`init_
 
 CREATE UNIQUE INDEX `projects_public_slug_unique` ON `projects` (`public_slug`) WHERE `public_slug` IS NOT NULL;
 
+CREATE UNIQUE INDEX `projects_repository_name_unique` ON `projects` (`repository_name`) WHERE `repository_name` IS NOT NULL;
+
 CREATE INDEX `projects_github_installation_repo_idx` ON `projects` (`github_installation_id`, `github_repo_full_name`);
 
 CREATE INDEX `projects_harness_idx` ON `projects` (`harness_id`);

package/dist/machine.version

@@ -0,0 +1 @@
+101

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.25.5",
+  "version": "0.26.0",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,
@@ -34,10 +34,10 @@
     "@types/node": "^22.19.20",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11",
+    "@nurix/contracts": "3.0.1",
     "@nurix/harness": "0.0.0",
     "@nurix/nustack.studio": "0.0.0",
-    "@nurix/nustack.ui": "0.0.0",
-    "@nurix/contracts": "3.0.1"
+    "@nurix/nustack.ui": "0.0.0"
   },
   "publishConfig": {
     "access": "public"