@planningo/duul 1.0.0 → 1.1.0

package/build/services/filesystem.d.ts

@@ -36,6 +36,26 @@ export declare function resolveWorkspaceScope(input: {
     tracked_only?: boolean;
 }): WorkspaceScope | null;
 export declare function readProjectFile(projectRoot: string, filePath: string, scope?: WorkspaceScope | null): Promise<string>;
+/**
+ * Resolve a large text argument that may be supplied inline OR via a file path.
+ *
+ * Large MCP tool arguments (full plan/code markdown) are the single input that
+ * tool-calling models most often fail to serialize: when the intended value is
+ * big, the model can emit an empty `{}` for the whole argument object, which the
+ * MCP SDK then rejects with a `-32602` validation error — and the caller loops.
+ * Writing the content to a file with a normal Write call (a small, reliable
+ * tool schema) and passing a short relative path here sidesteps that failure.
+ *
+ * Returns the resolved text, or undefined when neither source yields content.
+ * Throws (with a labelled message) only when a file path was given but could
+ * not be read — the tool handler converts that into actionable retry guidance.
+ */
+export declare function resolveInlineOrFile(opts: {
+    inline?: string | null;
+    file?: string | null;
+    scope: WorkspaceScope | null;
+    label: string;
+}): Promise<string | undefined>;
 export declare function listProjectDirectory(projectRoot: string, dirPath: string, scope?: WorkspaceScope | null): Promise<string>;
 /**
  * Search for a pattern in files using rg (preferred), git grep, or grep fallback.

package/build/services/filesystem.js

@@ -71,23 +71,27 @@ async function safePath(projectRoot, requestedPath, workingDirectories) {
     if (realRel.startsWith('..')) {
         throw new Error(`Symlink escape detected: ${requestedPath} resolves outside project root`);
     }
-    // Block sensitive files
-    const lower = rel.toLowerCase();
-    if (lower.includes('.env') && !lower.endsWith('.example')) {
-        throw new Error(`Access denied (sensitive file): ${requestedPath}`);
-    }
-    if (rel === 'node_modules' || rel.startsWith('node_modules/') || rel.startsWith('node_modules\\')) {
-        throw new Error('Access denied: node_modules');
-    }
-    // Block additional paths (.git, build, dist)
-    const topSegment = rel.split('/')[0].split('\\')[0];
-    if (BLOCKED_PATHS.includes(topSegment)) {
-        throw new Error(`Access denied: ${topSegment}`);
-    }
-    // Block large file extensions (.log)
-    if (BLOCKED_EXTENSIONS.some((ext) => lower.endsWith(ext))) {
-        throw new Error(`Access denied (blocked extension): ${requestedPath}`);
-    }
+    // Block sensitive files — checked against BOTH the logical requested path and
+    // the symlink-resolved real path, so an in-root symlink with an innocuous name
+    // cannot point at an in-root secret (e.g. innocent.txt -> .env, gitcfg.txt -> .git/config).
+    const assertNotSensitive = (candidate) => {
+        const low = candidate.toLowerCase();
+        if (low.includes('.env') && !low.endsWith('.example')) {
+            throw new Error(`Access denied (sensitive file): ${requestedPath}`);
+        }
+        if (candidate === 'node_modules' || candidate.startsWith('node_modules/') || candidate.startsWith('node_modules\\')) {
+            throw new Error('Access denied: node_modules');
+        }
+        const topSegment = candidate.split('/')[0].split('\\')[0];
+        if (BLOCKED_PATHS.includes(topSegment)) {
+            throw new Error(`Access denied: ${topSegment}`);
+        }
+        if (BLOCKED_EXTENSIONS.some((ext) => low.endsWith(ext))) {
+            throw new Error(`Access denied (blocked extension): ${requestedPath}`);
+        }
+    };
+    assertNotSensitive(rel);
+    assertNotSensitive(realRel);
     return realResolved;
 }
 /**
@@ -247,6 +251,36 @@ export async function readProjectFile(projectRoot, filePath, scope) {
     }
     return readFile(resolved, 'utf-8');
 }
+/**
+ * Resolve a large text argument that may be supplied inline OR via a file path.
+ *
+ * Large MCP tool arguments (full plan/code markdown) are the single input that
+ * tool-calling models most often fail to serialize: when the intended value is
+ * big, the model can emit an empty `{}` for the whole argument object, which the
+ * MCP SDK then rejects with a `-32602` validation error — and the caller loops.
+ * Writing the content to a file with a normal Write call (a small, reliable
+ * tool schema) and passing a short relative path here sidesteps that failure.
+ *
+ * Returns the resolved text, or undefined when neither source yields content.
+ * Throws (with a labelled message) only when a file path was given but could
+ * not be read — the tool handler converts that into actionable retry guidance.
+ */
+export async function resolveInlineOrFile(opts) {
+    const { inline, file, scope, label } = opts;
+    if (typeof inline === 'string' && inline.trim().length > 0) {
+        return inline;
+    }
+    if (typeof file === 'string' && file.trim().length > 0) {
+        if (!scope) {
+            throw new Error(`${label}_file was provided ("${file}") but no workspace_root (or project_root) is set. ` +
+                'Pass workspace_root so the file can be read.');
+        }
+        // Bypass tracked_only: the *_file artifact is the caller's own scratch file
+        // (e.g. .duul/plan.md), which is typically untracked by git.
+        return readProjectFile(scope.root, file, { ...scope, trackedOnly: false });
+    }
+    return undefined;
+}
 export async function listProjectDirectory(projectRoot, dirPath, scope) {
     const resolved = await resolveToolPath(projectRoot, dirPath, scope ?? null);
     const stats = await lstat(resolved);

package/build/services/providers/anthropic.js

@@ -1,5 +1,5 @@
 import { validateProjectRoot } from '../filesystem.js';
-import { executeFilesystemTool } from '../filesystem-tools.js';
+import { executeFilesystemTool, createReviewerByteBudget } from '../filesystem-tools.js';
 import { estimateCost } from '../pricing.js';
 const MAX_INPUT_CHARS = 400_000;
 const MAX_TOOL_ROUNDS = 10;
@@ -129,7 +129,8 @@ export class AnthropicProvider {
     capabilities = {
         structuredOutputs: false,
         toolCalling: true,
-        previousResponseId: true, // simulated via conversation history
+        previousResponseId: false, // no native chaining — continuity via replay
+        conversationReplay: true,
         jsonSchemaStrict: false,
     };
     apiKey;
@@ -249,6 +250,7 @@ export class AnthropicProvider {
             };
             const toolCache = new Map();
             const callCounts = new Map();
+            const byteBudget = createReviewerByteBudget();
             for (let round = 0; round < MAX_TOOL_ROUNDS; round++) {
                 const toolUses = body.content.filter((b) => b.type === 'tool_use');
                 if (toolUses.length === 0 || body.stop_reason !== 'tool_use')
@@ -275,7 +277,7 @@ export class AnthropicProvider {
                         toolResults.push({ type: 'tool_result', tool_use_id: call.id, content: budgetMessage(call.name, currentLevel) });
                         continue;
                     }
-                    const result = await executeFilesystemTool(effectiveRoot, call.name, args, workspaceScope);
+                    const result = await executeFilesystemTool(effectiveRoot, call.name, args, workspaceScope, byteBudget);
                     toolCache.set(cacheKey, result);
                     allUsedTools.push(`${call.name}(${argSummary})`);
                     accumulatedToolChars += result.length;

package/build/services/providers/codex-auth.d.ts

@@ -0,0 +1,51 @@
+/** ChatGPT-login base URL for the Responses API (POST {base}/responses). */
+export declare const CHATGPT_BASE_URL = "https://chatgpt.com/backend-api/codex";
+export interface CodexTokens {
+    id_token?: string;
+    access_token?: string;
+    refresh_token?: string;
+    account_id?: string;
+}
+export interface CodexAuth {
+    auth_mode?: string;
+    OPENAI_API_KEY?: string | null;
+    tokens?: CodexTokens;
+    last_refresh?: string;
+}
+export type CodexCredential = {
+    mode: 'apikey';
+    apiKey: string;
+} | {
+    mode: 'chatgpt';
+    accessToken: string;
+    accountId: string;
+    refresh: () => Promise<string>;
+};
+/** Resolve the Codex home directory ($CODEX_HOME or ~/.codex). */
+export declare function codexHome(): string;
+/** Read and parse auth.json. Returns null when the file is missing or unparsable. */
+export declare function loadCodexAuth(): CodexAuth | null;
+/**
+ * Decode the `exp` (seconds since epoch) claim from a JWT without verifying it.
+ * Returns null when the token is not a decodable JWT.
+ */
+export declare function jwtExp(token: string): number | null;
+/**
+ * True when the token is expired or within EXPIRY_SKEW_SECONDS of expiring.
+ * Unknown expiry is treated as "not expired" so we don't refresh needlessly.
+ */
+export declare function isTokenExpired(token: string, nowSeconds?: number): boolean;
+/**
+ * Exchange the stored refresh_token for a fresh access token via the OpenAI
+ * OAuth endpoint, then persist the rotated tokens back to auth.json.
+ * Returns the updated CodexAuth. Throws on network/HTTP failure.
+ */
+export declare function refreshCodexToken(auth: CodexAuth): Promise<CodexAuth>;
+/**
+ * Resolve a usable credential from the Codex CLI login, or null when the CLI
+ * is not logged in. Refreshes an expired ChatGPT access token up front.
+ *
+ * The returned `refresh` callback (chatgpt mode) re-reads auth.json and rotates
+ * the token, so a provider can recover from a mid-review 401.
+ */
+export declare function resolveCodexCredential(): Promise<CodexCredential | null>;

package/build/services/providers/codex-auth.js

@@ -0,0 +1,178 @@
+/**
+ * Codex CLI login support.
+ *
+ * Lets DUUL reuse the credentials produced by `codex login` (the OpenAI Codex
+ * CLI) instead of requiring a raw OPENAI_API_KEY. Two auth modes are handled:
+ *
+ *   1. "apikey"  — auth.json carries an OPENAI_API_KEY; we just use it.
+ *   2. "chatgpt" — Sign in with ChatGPT (Plus/Pro/Team). auth.json carries an
+ *                  OAuth access token + account id. Requests go to the ChatGPT
+ *                  backend Responses endpoint with a bearer token; the token is
+ *                  refreshed via the OpenAI OAuth endpoint when near expiry.
+ *
+ * Credential file: $CODEX_HOME/auth.json (defaults to ~/.codex/auth.json).
+ *
+ * Protocol constants mirror the openai/codex `codex-rs` client so DUUL speaks
+ * the same dialect the CLI does.
+ */
+import { readFileSync, writeFileSync, chmodSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+/** ChatGPT-login base URL for the Responses API (POST {base}/responses). */
+export const CHATGPT_BASE_URL = 'https://chatgpt.com/backend-api/codex';
+/** OAuth token endpoint used to refresh a ChatGPT access token. */
+const OAUTH_TOKEN_URL = process.env.CODEX_REFRESH_TOKEN_URL_OVERRIDE ?? 'https://auth.openai.com/oauth/token';
+/** Public OAuth client id the Codex CLI registers under. */
+const OAUTH_CLIENT_ID = process.env.CODEX_APP_SERVER_LOGIN_CLIENT_ID ?? 'app_EMoamEEZ73f0CkXaXp7hrann';
+/** Refresh the access token when it has this many seconds (or fewer) of life left. */
+const EXPIRY_SKEW_SECONDS = 5 * 60;
+/** Resolve the Codex home directory ($CODEX_HOME or ~/.codex). */
+export function codexHome() {
+    return process.env.CODEX_HOME ?? join(homedir(), '.codex');
+}
+function authPath() {
+    return join(codexHome(), 'auth.json');
+}
+/** Read and parse auth.json. Returns null when the file is missing or unparsable. */
+export function loadCodexAuth() {
+    try {
+        const raw = readFileSync(authPath(), 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Decode the `exp` (seconds since epoch) claim from a JWT without verifying it.
+ * Returns null when the token is not a decodable JWT.
+ */
+export function jwtExp(token) {
+    const parts = token.split('.');
+    if (parts.length < 2)
+        return null;
+    try {
+        let payload = parts[1].replace(/-/g, '+').replace(/_/g, '/');
+        payload += '='.repeat((4 - (payload.length % 4)) % 4);
+        const claims = JSON.parse(Buffer.from(payload, 'base64').toString('utf-8'));
+        return typeof claims.exp === 'number' ? claims.exp : null;
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * True when the token is expired or within EXPIRY_SKEW_SECONDS of expiring.
+ * Unknown expiry is treated as "not expired" so we don't refresh needlessly.
+ */
+export function isTokenExpired(token, nowSeconds = Math.floor(Date.now() / 1000)) {
+    const exp = jwtExp(token);
+    if (exp === null)
+        return false;
+    return exp - nowSeconds <= EXPIRY_SKEW_SECONDS;
+}
+/**
+ * Exchange the stored refresh_token for a fresh access token via the OpenAI
+ * OAuth endpoint, then persist the rotated tokens back to auth.json.
+ * Returns the updated CodexAuth. Throws on network/HTTP failure.
+ */
+export async function refreshCodexToken(auth) {
+    const refreshToken = auth.tokens?.refresh_token;
+    if (!refreshToken) {
+        throw new Error('Codex auth has no refresh_token; run `codex login` again.');
+    }
+    const res = await fetch(OAUTH_TOKEN_URL, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            client_id: OAUTH_CLIENT_ID,
+            grant_type: 'refresh_token',
+            refresh_token: refreshToken,
+        }),
+    });
+    if (!res.ok) {
+        const body = await res.text().catch(() => '');
+        throw new Error(`Codex token refresh failed (${res.status}): ${body.slice(0, 200)}`);
+    }
+    const data = (await res.json());
+    const updated = {
+        ...auth,
+        tokens: {
+            ...auth.tokens,
+            ...(data.access_token ? { access_token: data.access_token } : {}),
+            ...(data.id_token ? { id_token: data.id_token } : {}),
+            // Refresh tokens rotate; keep the old one only if none is returned.
+            ...(data.refresh_token ? { refresh_token: data.refresh_token } : {}),
+        },
+        last_refresh: new Date().toISOString(),
+    };
+    try {
+        const path = authPath();
+        writeFileSync(path, JSON.stringify(updated, null, 2), { mode: 0o600 });
+        // `mode` only applies when the file is created; force 0600 on overwrite so a
+        // pre-existing, loosely-permissioned auth.json can't keep the refreshed token
+        // world/group readable.
+        chmodSync(path, 0o600);
+    }
+    catch (error) {
+        // Non-fatal: we can still use the refreshed token in-memory this run.
+        console.error(`[duul] Warning: could not persist refreshed Codex token: ${error instanceof Error ? error.message : error}`);
+    }
+    return updated;
+}
+/**
+ * Resolve a usable credential from the Codex CLI login, or null when the CLI
+ * is not logged in. Refreshes an expired ChatGPT access token up front.
+ *
+ * The returned `refresh` callback (chatgpt mode) re-reads auth.json and rotates
+ * the token, so a provider can recover from a mid-review 401.
+ */
+export async function resolveCodexCredential() {
+    const auth = loadCodexAuth();
+    if (!auth)
+        return null;
+    const tokens = auth.tokens;
+    const chatgptCapable = !!(tokens?.access_token && tokens?.account_id);
+    const preferChatgpt = auth.auth_mode === 'chatgpt' || (!auth.OPENAI_API_KEY && chatgptCapable);
+    if (preferChatgpt && chatgptCapable) {
+        let accessToken = tokens.access_token;
+        if (isTokenExpired(accessToken)) {
+            // Token expired: refresh if possible, otherwise fall back to a stored API
+            // key rather than handing back a credential that will immediately 401.
+            if (tokens.refresh_token) {
+                try {
+                    const refreshed = await refreshCodexToken(auth);
+                    accessToken = refreshed.tokens?.access_token ?? accessToken;
+                }
+                catch (error) {
+                    console.error(`[duul] Codex token refresh failed: ${error instanceof Error ? error.message : error}`);
+                    if (auth.OPENAI_API_KEY)
+                        return { mode: 'apikey', apiKey: auth.OPENAI_API_KEY };
+                    throw error;
+                }
+            }
+            else if (auth.OPENAI_API_KEY) {
+                return { mode: 'apikey', apiKey: auth.OPENAI_API_KEY };
+            }
+            // else: no refresh path and no key — proceed with the expired token so the
+            // provider surfaces a clear auth error (better than a silent null).
+        }
+        return {
+            mode: 'chatgpt',
+            accessToken,
+            accountId: tokens.account_id,
+            refresh: async () => {
+                const current = loadCodexAuth() ?? auth;
+                const refreshed = await refreshCodexToken(current);
+                const next = refreshed.tokens?.access_token;
+                if (!next)
+                    throw new Error('Codex token refresh returned no access_token');
+                return next;
+            },
+        };
+    }
+    if (auth.OPENAI_API_KEY) {
+        return { mode: 'apikey', apiKey: auth.OPENAI_API_KEY };
+    }
+    return null;
+}

package/build/services/providers/google.js

@@ -1,5 +1,5 @@
 import { validateProjectRoot } from '../filesystem.js';
-import { executeFilesystemTool } from '../filesystem-tools.js';
+import { executeFilesystemTool, createReviewerByteBudget } from '../filesystem-tools.js';
 import { estimateCost } from '../pricing.js';
 const MAX_INPUT_CHARS = 400_000;
 const MAX_TOOL_ROUNDS = 10;
@@ -122,6 +122,7 @@ export class GoogleProvider {
         structuredOutputs: false,
         toolCalling: true,
         previousResponseId: false,
+        conversationReplay: false,
         jsonSchemaStrict: false,
     };
     apiKey;
@@ -209,6 +210,7 @@ export class GoogleProvider {
             };
             const toolCache = new Map();
             const callCounts = new Map();
+            const byteBudget = createReviewerByteBudget();
             for (let round = 0; round < MAX_TOOL_ROUNDS; round++) {
                 const parts = body.candidates?.[0]?.content?.parts ?? [];
                 const functionCalls = parts.filter((p) => 'functionCall' in p);
@@ -239,7 +241,7 @@ export class GoogleProvider {
                         responseParts.push({ functionResponse: { name, response: { output: budgetMessage(name, currentLevel) } } });
                         continue;
                     }
-                    const result = await executeFilesystemTool(effectiveRoot, name, args, workspaceScope);
+                    const result = await executeFilesystemTool(effectiveRoot, name, args, workspaceScope, byteBudget);
                     toolCache.set(cacheKey, result);
                     allUsedTools.push(`${name}(${argSummary})`);
                     accumulatedToolChars += result.length;

package/build/services/providers/openai.d.ts

@@ -1,5 +1,15 @@
 import type { z } from 'zod';
 import type { ReviewerProvider, ReviewCallOptions, ReviewCallResult, ProviderCapabilities } from './types.js';
+/**
+ * ChatGPT-login (Codex CLI) credentials. When present the provider talks to the
+ * ChatGPT backend Responses endpoint with a bearer token instead of an API key.
+ */
+export interface ChatgptAuth {
+    accessToken: string;
+    accountId: string;
+    /** Rotate the token (e.g. after a 401). Returns a fresh access token. */
+    refresh?: () => Promise<string>;
+}
 export declare class OpenAIProvider implements ReviewerProvider {
     readonly name = "openai";
     readonly capabilities: ProviderCapabilities;
@@ -7,15 +17,38 @@ export declare class OpenAIProvider implements ReviewerProvider {
     private model;
     private temperature;
     private topP;
+    /**
+     * ChatGPT-backend mode. The endpoint is stateless (`store: false`): it does
+     * not support `previous_response_id`, `temperature`/`top_p`, or
+     * `max_output_tokens`, and it streams. We resend the full input each turn.
+     */
+    private readonly stateless;
+    private readonly baseURL?;
+    private readonly defaultHeaders?;
+    private readonly refresh?;
+    private readonly reasoningEffort;
     constructor(config?: {
         apiKey?: string;
         baseUrl?: string;
         model?: string;
         temperature?: number;
         topP?: number;
+        chatgpt?: ChatgptAuth;
     });
+    private buildClient;
     review<T extends z.ZodType>(options: ReviewCallOptions<T>): Promise<ReviewCallResult<z.infer<T>>>;
     private apiCallWithRetry;
+    /**
+     * Aggregate a streamed Responses call into a Response object.
+     *
+     * The ChatGPT backend delivers completed output items via
+     * `response.output_item.done` events and returns an EMPTY `output` array on
+     * `response.completed`, so we collect items from the stream ourselves. Usage
+     * and id come from `response.completed` (falling back to `response.created`).
+     */
+    private aggregateStream;
+    /** Return the first output_text string in the response, or null. */
+    private getOutputText;
     private extractStructuredOutput;
     private hasPendingFunctionCalls;
     private getFunctionCalls;