@parallel-cli/parallel 0.4.8 → 0.5.0

package/dist/agents/execution-policy.js

@@ -0,0 +1,58 @@
+export const EXECUTION_BUDGETS = {
+    quick: {
+        profile: 'quick',
+        maxRounds: 6,
+        maxToolCalls: 12,
+        maxShellCommands: 2,
+        maxInputTokens: 150_000,
+        maxResultChars: 8_000,
+        maxRecentMessages: 24,
+        convergenceAt: 0.7,
+    },
+    standard: {
+        profile: 'standard',
+        maxRounds: 16,
+        maxToolCalls: 32,
+        maxShellCommands: 6,
+        maxInputTokens: 600_000,
+        maxResultChars: 16_000,
+        maxRecentMessages: 42,
+        convergenceAt: 0.75,
+    },
+    deep: {
+        profile: 'deep',
+        maxRounds: 60,
+        maxToolCalls: 120,
+        maxShellCommands: 30,
+        maxInputTokens: 3_000_000,
+        maxResultChars: 32_000,
+        maxRecentMessages: 80,
+        convergenceAt: 0.82,
+    },
+};
+const COMPLEX = /\b(migrat|refactor|architecture|redesign|rewrite|exhaustive|end[- ]to[- ]end|across|monorepo|multi[- ]service|security audit|performance audit|release|deploy)\b/i;
+const SIMPLE = /\b(explain|find|locate|where|why|diagnos|inspect|verify|check|typo|rename|toggle|small|simple)\b/i;
+export function classifyExecutionProfile(task, mode, forced) {
+    if (forced)
+        return forced;
+    if (mode === 'plan')
+        return 'deep';
+    if (mode === 'ask')
+        return COMPLEX.test(task) || task.length > 1_200 ? 'standard' : 'quick';
+    const pathMentions = task.match(/\b[\w./-]+\.(?:ts|tsx|js|mjs|json|md|py|rs|go|java)\b/g)?.length ?? 0;
+    if (COMPLEX.test(task) || pathMentions > 3 || task.length > 1_600)
+        return 'standard';
+    if (SIMPLE.test(task) || pathMentions <= 1 || task.length < 500)
+        return 'quick';
+    return 'standard';
+}
+export function nextExecutionProfile(profile) {
+    if (profile === 'quick')
+        return 'standard';
+    if (profile === 'standard')
+        return 'deep';
+    return null;
+}
+export function shouldEscalateExecution(task, inspectedFiles, changedFiles) {
+    return COMPLEX.test(task) || inspectedFiles > 3 || changedFiles > 3;
+}

package/dist/agents/tools.js

@@ -2,6 +2,7 @@ import fs from 'node:fs';
 import path from 'node:path';
 import { exec } from 'node:child_process';
 import * as Diff from 'diff';
+import { appendFilePrivate, ensurePrivateDir, sanitizeTerminalText, writeFileAtomicPrivate } from '../security.js';
 const IGNORED = new Set(['node_modules', '.git', '.parallel', '.cursor', 'dist', '__pycache__', '.venv', 'venv']);
 const MAX_OUTPUT = 12_000;
 const MUTATING_TOOLS = new Set(['write_file', 'edit_file', 'claim_files', 'remember']);
@@ -15,6 +16,12 @@ function isMutatingShell(command) {
         return true;
     if (/[>|]\s*(sh|bash)\b/.test(c) || /\b(curl|wget)\b.*\|\s*(sh|bash)/.test(c))
         return true;
+    if (/\b(curl|wget)\b.*(&&|;)\s*(sh|bash|zsh|python|node)\b/.test(c))
+        return true;
+    if (/\b(nc|ncat|netcat|socat|telnet|ssh|scp|rsync)\b/.test(c))
+        return true;
+    if (/\b(bash|sh|zsh)\s+-c\b|\b(python|python3|node|perl|ruby)\s+(-c|-e)\b/.test(c))
+        return true;
     return false;
 }
 export const TOOL_DEFINITIONS = [
@@ -22,7 +29,7 @@ export const TOOL_DEFINITIONS = [
         type: 'function',
         function: {
             name: 'list_files',
-            description: 'List project files (recursive, ignores node_modules/.git/dist). Use it first to understand the structure.',
+            description: 'List project files (recursive, ignores node_modules/.git/dist). Use only when shared project context does not already identify the relevant area.',
             parameters: {
                 type: 'object',
                 properties: {
@@ -40,6 +47,8 @@ export const TOOL_DEFINITIONS = [
                 type: 'object',
                 properties: {
                     path: { type: 'string', description: 'Relative file path' },
+                    startLine: { type: 'integer', description: 'Optional first line, 1-based' },
+                    endLine: { type: 'integer', description: 'Optional last line, inclusive' },
                 },
                 required: ['path'],
             },
@@ -63,6 +72,22 @@ export const TOOL_DEFINITIONS = [
             },
         },
     },
+    {
+        type: 'function',
+        function: {
+            name: 'read_artifact',
+            description: 'Read a targeted line range from a long tool output previously stored as an artifact.',
+            parameters: {
+                type: 'object',
+                properties: {
+                    id: { type: 'string', description: 'Artifact id returned by a previous tool result' },
+                    startLine: { type: 'integer', description: 'First line, 1-based' },
+                    lineCount: { type: 'integer', description: 'Number of lines, max 200' },
+                },
+                required: ['id'],
+            },
+        },
+    },
     {
         type: 'function',
         function: {
@@ -113,7 +138,7 @@ export const TOOL_DEFINITIONS = [
         type: 'function',
         function: {
             name: 'inspect_project',
-            description: 'Batch read-only inspection: list files under paths and/or run several regex searches in one call. Prefer this over cascades of grep/head/tail/wc/awk for exploratory checks.',
+            description: 'Batch targeted read-only inspection: list files under task-relevant paths and/or run several regex searches in one call. Prefer this over generic repository exploration or cascades of grep/head/tail/wc/awk.',
             parameters: {
                 type: 'object',
                 properties: {
@@ -178,7 +203,7 @@ export const TOOL_DEFINITIONS = [
         type: 'function',
         function: {
             name: 'update_steps',
-            description: 'Update the visible Cursor-style task checklist. At task start create 3-6 concrete steps; during work keep exactly one active step and mark completed steps done.',
+            description: 'Update the visible Cursor-style task checklist. At task start create 3-6 outcome-oriented steps; do not add a generic project-exploration step when shared context already covers it. Keep exactly one active step.',
             parameters: {
                 type: 'object',
                 properties: {
@@ -308,12 +333,15 @@ export class ToolExecutor {
     requestQuestion;
     skills;
     mode;
+    onInspect;
+    profile;
+    maxOutput;
     /** Last content this agent has seen for each file — basis of adaptive merging. */
     lastRead = new Map();
     /** Questions already asked — capped at 3 per task. */
     questionsAsked = 0;
     planApproved = false;
-    constructor(board, agentId, agentName, projectRoot, requestApproval, requestQuestion, skills, mode = 'task') {
+    constructor(board, agentId, agentName, projectRoot, requestApproval, requestQuestion, skills, mode = 'task', onInspect, profile = 'standard', maxOutput = MAX_OUTPUT) {
         this.board = board;
         this.agentId = agentId;
         this.agentName = agentName;
@@ -322,6 +350,9 @@ export class ToolExecutor {
         this.requestQuestion = requestQuestion;
         this.skills = skills;
         this.mode = mode;
+        this.onInspect = onInspect;
+        this.profile = profile;
+        this.maxOutput = maxOutput;
     }
     resolve(rel) {
         const root = path.resolve(this.projectRoot);
@@ -337,6 +368,7 @@ export class ToolExecutor {
     }
     rememberRead(relPath, content) {
         this.lastRead.set(relPath, { content, revision: this.board.fileRevision(relPath) });
+        this.onInspect?.(this.agentId, relPath, content);
     }
     adaptationMessage(relPath, seen, current, verb = 'was modified') {
         this.board.recordConflict(relPath);
@@ -414,9 +446,11 @@ export class ToolExecutor {
                 case 'list_files':
                     return this.listFiles(args?.path ?? '.');
                 case 'read_file':
-                    return this.readFile(args.path);
+                    return this.readFile(args.path, args?.startLine, args?.endLine);
                 case 'read_many':
                     return this.readMany(args.paths);
+                case 'read_artifact':
+                    return this.readArtifact(args.id, args?.startLine, args?.lineCount);
                 case 'write_file':
                     return this.writeFile(args.path, args.content);
                 case 'edit_file':
@@ -540,12 +574,12 @@ export class ToolExecutor {
         if (!f)
             return 'ERROR: remember needs a non-empty fact.';
         const file = path.join(this.projectRoot, '.parallel', 'memory.md');
-        fs.mkdirSync(path.dirname(file), { recursive: true });
+        ensurePrivateDir(path.dirname(file));
         if (!fs.existsSync(file)) {
-            fs.writeFileSync(file, '# Project memory\n\nDurable facts agents recorded. Injected into every agent\'s system prompt.\n\n');
+            writeFileAtomicPrivate(file, '# Project memory\n\nDurable facts agents recorded. Injected into every agent\'s system prompt.\n\n');
         }
         const line = `- ${f} _(${this.agentName}, ${new Date().toISOString().slice(0, 10)})_\n`;
-        fs.appendFileSync(file, line);
+        appendFilePrivate(file, line);
         this.board.log(this.agentId, 'tool', `🧠 remember: ${f.slice(0, 80)}`);
         return 'Fact saved to the project memory. Every future agent will see it.';
     }
@@ -615,16 +649,18 @@ export class ToolExecutor {
             return '(empty folder)';
         return out.join('\n');
     }
-    readFile(rel) {
+    readFile(rel, requestedStart, requestedEnd) {
         const abs = this.resolve(rel);
         const relPath = this.relOf(rel);
         const content = fs.readFileSync(abs, 'utf8');
         this.rememberRead(relPath, content);
         this.board.resolveConflict(relPath);
         const lines = content.split('\n');
-        const numbered = lines.map((l, i) => `${String(i + 1).padStart(4)}|${l}`).join('\n');
-        return numbered.length > MAX_OUTPUT
-            ? numbered.slice(0, MAX_OUTPUT) + `\n... (truncated, ${lines.length} lines total)`
+        const start = Math.max(1, Math.floor(Number(requestedStart) || 1));
+        const end = Math.min(lines.length, Math.max(start, Math.floor(Number(requestedEnd) || lines.length)));
+        const numbered = lines.slice(start - 1, end).map((l, i) => `${String(start + i).padStart(4)}|${l}`).join('\n');
+        return numbered.length > this.maxOutput
+            ? numbered.slice(0, this.maxOutput) + `\n... (truncated; requested ${start}-${end}, ${lines.length} lines total)`
             : numbered;
     }
     readMany(paths) {
@@ -641,8 +677,9 @@ export class ToolExecutor {
                 this.board.resolveConflict(relPath);
                 const lines = content.split('\n');
                 const numbered = lines.map((l, i) => `${String(i + 1).padStart(4)}|${l}`).join('\n');
-                const body = numbered.length > Math.floor(MAX_OUTPUT / relPaths.length)
-                    ? numbered.slice(0, Math.floor(MAX_OUTPUT / relPaths.length)) + `\n... (truncated, ${lines.length} lines total)`
+                const perFile = Math.max(1_000, Math.floor(this.maxOutput / relPaths.length));
+                const body = numbered.length > perFile
+                    ? numbered.slice(0, perFile) + `\n... (truncated, ${lines.length} lines total)`
                     : numbered;
                 chunks.push(`--- ${relPath} (${lines.length} lines) ---\n${body}`);
             }
@@ -652,6 +689,19 @@ export class ToolExecutor {
         }
         return chunks.join('\n\n');
     }
+    readArtifact(id, requestedStart, requestedCount) {
+        const safeId = String(id ?? '');
+        if (!/^artifact-\d+\.txt$/.test(safeId))
+            return 'ERROR: invalid artifact id.';
+        const file = path.join(this.projectRoot, '.parallel', 'runs', this.agentId, 'artifacts', safeId);
+        if (!fs.existsSync(file))
+            return `ERROR: artifact not found: ${safeId}`;
+        const lines = fs.readFileSync(file, 'utf8').split('\n');
+        const start = Math.max(1, Math.floor(Number(requestedStart) || 1));
+        const count = Math.min(200, Math.max(1, Math.floor(Number(requestedCount) || 80)));
+        const end = Math.min(lines.length, start + count - 1);
+        return lines.slice(start - 1, end).map((line, index) => `${String(start + index).padStart(4)}|${line}`).join('\n');
+    }
     /**
      * Adaptive co-editing: writing is NEVER blocked by another agent.
      * But if the file changed under you since your last read, you first get
@@ -730,7 +780,8 @@ export class ToolExecutor {
         }
         const results = [];
         const walk = (dir, depth) => {
-            if (depth > 6 || results.length > 100)
+            const resultLimit = this.profile === 'quick' ? 40 : this.profile === 'standard' ? 80 : 150;
+            if (depth > 6 || results.length >= resultLimit)
                 return;
             let entries;
             try {
@@ -758,11 +809,15 @@ export class ToolExecutor {
                         continue;
                     }
                     const lines = content.split('\n');
-                    for (let i = 0; i < lines.length && results.length <= 100; i++) {
+                    let matched = false;
+                    for (let i = 0; i < lines.length && results.length < resultLimit; i++) {
                         if (re.test(lines[i])) {
+                            matched = true;
                             results.push(`${path.relative(this.projectRoot, full)}:${i + 1}: ${lines[i].trim().slice(0, 160)}`);
                         }
                     }
+                    if (matched)
+                        this.onInspect?.(this.agentId, path.relative(this.projectRoot, full), content);
                 }
             }
         };
@@ -822,12 +877,17 @@ export class ToolExecutor {
                 return;
             }
             const lines = content.split('\n');
+            let matched = false;
             for (let i = 0; i < lines.length && matches.length <= 200; i++) {
                 for (const { raw, re } of regexes) {
-                    if (re.test(lines[i]))
+                    if (re.test(lines[i])) {
+                        matched = true;
                         matches.push(`${raw} :: ${relPath}:${i + 1}: ${lines[i].trim().slice(0, 140)}`);
+                    }
                 }
             }
+            if (matched)
+                this.onInspect?.(this.agentId, relPath, content);
         };
         for (const rel of paths)
             visit(this.resolve(rel), 0);
@@ -849,18 +909,19 @@ export class ToolExecutor {
             exec(command, { cwd: this.projectRoot, timeout: 120_000, maxBuffer: 4 * 1024 * 1024 }, (err, stdout, stderr) => {
                 let out = '';
                 if (stdout)
-                    out += stdout;
+                    out += sanitizeTerminalText(stdout);
                 if (stderr)
-                    out += (out ? '\n--- stderr ---\n' : '') + stderr;
+                    out += (out ? '\n--- stderr ---\n' : '') + sanitizeTerminalText(stderr);
                 if (err && err.killed)
                     out += '\n(process killed: 120s timeout)';
                 else if (err)
                     out += `\n(exit code: ${err.code ?? 1})`;
-                if (out.length > MAX_OUTPUT)
-                    out = out.slice(0, MAX_OUTPUT) + '\n... (output truncated)';
                 const result = out || '(no output, success)';
                 const changed = this.recordShellMutations(before);
-                this.board.log(this.agentId, 'tool_result', result);
+                const logged = result.length > this.maxOutput
+                    ? `${result.slice(0, this.maxOutput)}\n... (${result.length.toLocaleString()} characters; full output retained as an agent artifact)`
+                    : result;
+                this.board.log(this.agentId, 'tool_result', logged);
                 resolve(changed > 0 ? `${result}\n\nTracked shell mutations: ${changed} file${changed === 1 ? '' : 's'}.` : result);
             });
         });

package/dist/commands.js

@@ -9,9 +9,9 @@ import { t } from './i18n.js';
 // inspect the session → git safety net → session & config → exit.
 export const COMMANDS = [
     // create agents
-    { name: '/ask', args: '[Name:] <question> [--model=m]', descKey: 'cmd.ask', group: 'modes', aliases: ['/a'] },
-    { name: '/task', args: '[Name:] <task> [--model=m] [#skill]', descKey: 'cmd.task', group: 'modes', aliases: ['/t'] },
-    { name: '/plan', args: '[Name:] <task> [--model=m]', descKey: 'cmd.plan', group: 'modes', aliases: ['/p'] },
+    { name: '/ask', args: '[Name:] <question> [--quick|--standard|--deep] [--model=m]', descKey: 'cmd.ask', group: 'modes', aliases: ['/a'] },
+    { name: '/task', args: '[Name:] <task> [--quick|--standard|--deep] [--model=m] [#skill]', descKey: 'cmd.task', group: 'modes', aliases: ['/t'] },
+    { name: '/plan', args: '[Name:] <task> [--quick|--standard|--deep] [--model=m]', descKey: 'cmd.plan', group: 'modes', aliases: ['/p'] },
     { name: '/review', args: '[agent|all] [prompt]', descKey: 'cmd.review', group: 'modes' },
     { name: '/issue', args: '<n>', descKey: 'cmd.issue', group: 'git' },
     { name: '/specialist', args: '<name> <task> | new <name> [global]', descKey: 'cmd.specialist', group: 'modes' },
@@ -39,6 +39,7 @@ export const COMMANDS = [
     { name: '/diff', args: '', descKey: 'cmd.diff', group: 'views' },
     { name: '/cost', args: '', descKey: 'cmd.cost', group: 'views' },
     { name: '/status', args: '', descKey: 'cmd.status', group: 'views' },
+    { name: '/memory', args: '[refresh]', descKey: 'cmd.memory', group: 'views' },
     // sessions
     { name: '/save', args: '[name]', descKey: 'cmd.save', group: 'git' },
     { name: '/sessions', args: '', descKey: 'cmd.sessions', group: 'git' },
@@ -165,8 +166,17 @@ async function doctorReport(ctl, ui) {
     }
     const sock = path.join(ctl.projectRoot, '.parallel', 'session.sock');
     lines.push(fs.existsSync(sock) ? t('m.doctorAttachOk') : t('m.doctorAttachMissing'));
+    for (const line of ctl.securityDiagnostics()) {
+        if (line.startsWith('warn') && level !== 'error')
+            level = 'warn';
+        lines.push(`security ${line}`);
+    }
     lines.push(commandExists('git') ? t('m.doctorGitOk') : t('m.doctorGitMissing'));
     lines.push(commandExists('gh') ? t('m.doctorGhOk') : t('m.doctorGhMissing'));
+    const memory = ctl.projectContextStatus();
+    if (['idle', 'fallback', 'error'].includes(memory.status) && level !== 'error')
+        level = 'warn';
+    lines.push(t('m.doctorMemory', { status: memory.status, date: memory.generatedAt ?? '—' }));
     ui.system(t('m.doctorReport', { lines: lines.join('\n') }), level);
 }
 /**
@@ -220,12 +230,21 @@ function spawnFrom(arg, ctl, ui, images, specialist, mode = 'task') {
     }
     // optional --model=xxx flag
     let model;
+    let profile;
     let task = arg;
     const mFlag = task.match(/\s--model=(\S+)/);
     if (mFlag) {
         model = mFlag[1];
         task = task.replace(mFlag[0], '').trim();
     }
+    for (const candidate of ['quick', 'standard', 'deep']) {
+        const flag = `--${candidate}`;
+        if (new RegExp(`(^|\\s)${flag}(?=\\s|$)`).test(task)) {
+            profile = candidate;
+            task = task.replace(new RegExp(`(^|\\s)${flag}(?=\\s|$)`), ' ').trim();
+            break;
+        }
+    }
     // optional #skill tokens → force-load these skills at the start of the task
     const forced = [];
     const available = ctl.getSkills();
@@ -244,11 +263,12 @@ function spawnFrom(arg, ctl, ui, images, specialist, mode = 'task') {
     // optional "Name:" prefix
     const named = task.match(/^([\p{L}\p{N}_-]{1,16}):\s+(.+)$/su);
     const finalTask = named ? named[2] : task;
-    const agent = ctl.spawnAgent(finalTask, named ? named[1] : undefined, model, images, specialist, undefined, mode);
+    const agent = ctl.spawnAgent(finalTask, named ? named[1] : undefined, model, images, specialist, undefined, mode, profile);
     if (!agent)
         return ui.system(specialist ? t('m.noSpecialist', { name: specialist }) : t('m.spawnFail'), 'error');
     ui.system(t('m.spawned', { name: agent.name, model: model ? ` (${model})` : '' }) +
         ` /${mode}` +
+        ` [${ctl.board.agents.get(agent.id)?.profile ?? profile ?? 'auto'}]` +
         (specialist ? ` 🎓${specialist}` : '') +
         (forced.length > 0 ? ` 🧩${forced.join(',')}` : ''), 'info');
 }
@@ -490,6 +510,34 @@ export function executeInput(raw, ctl, ui, images) {
         case '/cost':
             ui.setView('cost');
             return;
+        case '/memory': {
+            if (arg && arg !== 'refresh')
+                return ui.system(t('m.usageMemory'), 'warn');
+            if (arg === 'refresh') {
+                ui.system(t('memory.indexing'), 'info');
+                void ctl.refreshProjectContext().then(() => {
+                    const memory = ctl.projectContextStatus();
+                    ui.system(t('m.memoryStatus', {
+                        status: memory.status,
+                        date: memory.generatedAt ?? '—',
+                        model: memory.model ?? '—',
+                        tokens: memory.tokensIn + memory.tokensOut,
+                        cost: memory.cost === null ? '—' : memory.cost.toFixed(4),
+                    }), memory.status === 'ready' ? 'ok' : 'warn');
+                });
+                return;
+            }
+            const memory = ctl.projectContextStatus();
+            const index = ctl.projectIndexStatus();
+            ui.system(t('m.memoryStatus', {
+                status: memory.status,
+                date: memory.generatedAt ?? '—',
+                model: memory.model ?? '—',
+                tokens: memory.tokensIn + memory.tokensOut,
+                cost: memory.cost === null ? '—' : memory.cost.toFixed(4),
+            }) + ` · index ${index.files} files/${index.symbols} symbols`, memory.status === 'ready' ? 'ok' : memory.status === 'indexing' ? 'info' : 'warn');
+            return;
+        }
         case '/status': {
             const p = ctl.sessionProvider();
             const agents = [...ctl.board.agents.values()];
@@ -497,8 +545,22 @@ export function executeInput(raw, ctl, ui, images) {
             const cost = agents.reduce((s, a) => s + (a.cost ?? 0), 0);
             const changed = new Set(ctl.board.changes.map((c) => c.path)).size;
             const pm = p ? `${p.name}:${ctl.session.model}` : '-';
+            const memory = ctl.projectContextStatus();
+            const profiles = agents.reduce((counts, agent) => {
+                counts[agent.profile] = (counts[agent.profile] ?? 0) + 1;
+                return counts;
+            }, {});
             // Multiline: each metric on its own line for readability.
-            ui.system(t('m.status', { pm, approval: ctl.session.approvalMode, total: agents.length, active, changed, cost: cost.toFixed(3) }), 'info');
+            ui.system(t('m.status', {
+                pm,
+                approval: ctl.session.approvalMode,
+                total: agents.length,
+                active,
+                changed,
+                cost: cost.toFixed(3),
+                memory: memory.status,
+                memoryCost: memory.cost === null ? '—' : memory.cost.toFixed(4),
+            }) + `\nProfiles: ${Object.entries(profiles).map(([profile, count]) => `${profile}=${count}`).join(', ') || 'none'}`, 'info');
             return;
         }
         case '/raw':

package/dist/config.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import os from 'node:os';
+import { chmodPrivateTree, ensurePrivateDir, writeJsonAtomicPrivate } from './security.js';
 let configHomeOverride;
 export function setConfigHome(dir) {
     configHomeOverride = path.resolve(dir.replace(/^~(?=$|\/)/, os.homedir()));
@@ -360,6 +361,8 @@ function normalizeConfig(cfg) {
 export function loadConfig() {
     let cfg = { ...DEFAULTS, providers: [] };
     try {
+        ensurePrivateDir(configDir());
+        chmodPrivateTree(configDir());
         const file = configFile();
         if (fs.existsSync(file)) {
             const raw = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -414,8 +417,8 @@ export function loadConfig() {
 }
 export function saveConfig(cfg) {
     try {
-        fs.mkdirSync(configDir(), { recursive: true });
-        fs.writeFileSync(configFile(), JSON.stringify(cfg, null, 2));
+        ensurePrivateDir(configDir());
+        writeJsonAtomicPrivate(configFile(), cfg);
     }
     catch {
         // best effort