@polylogicai/polycode 1.1.2 → 1.1.4

package/README.md

@@ -1,27 +1,45 @@
 # polycode
 
-An agentic coding CLI. Runs on your machine with your keys. Every turn is appended to a SHA-256 chained session log on disk, so your history is auditable, replayable, and portable across machines.
+An agentic coding CLI. Runs on your machine, writes a SHA-256 chained session log to disk, and ships with a free hosted tier so you can start in one command. Your history is auditable, replayable, and portable across machines.
 
-## Install
+## Install and run
+
+One command, no setup, any platform:
 
 ```bash
-npm install -g @polylogicai/polycode
+npx @polylogicai/polycode@latest
 ```
 
-## Quick start
+That is the entire install. The first run provisions a per-install ID under `~/.polycode/` and opens an interactive session. On the free hosted tier you get 60 turns per hour for free, routed through `polylogicai.com/api/polycode/inference`. For unlimited use, set `GROQ_API_KEY` (see below) and polycode will talk to Groq directly and skip the proxy.
+
+For repeated use, install globally:
 
 ```bash
-export GROQ_API_KEY=gsk_...
+npm install -g @polylogicai/polycode
 polycode
 ```
 
-That opens an interactive session. For one-shot mode, pass your prompt as an argument:
+## One-shot mode
+
+Pass your prompt as an argument:
 
 ```bash
-polycode "read README.md and summarize it in one sentence"
+npx @polylogicai/polycode@latest "read README.md and summarize it in one sentence"
 ```
 
-A free Groq API key is available at `console.groq.com`.
+## Unlimited use with your own key
+
+Grab a free key from `console.groq.com`, then:
+
+```bash
+# macOS and Linux
+export GROQ_API_KEY=gsk_...
+npx @polylogicai/polycode@latest
+
+# Windows PowerShell
+$env:GROQ_API_KEY = "gsk_..."
+npx @polylogicai/polycode@latest
+```
 
 ## Configuration
 
@@ -29,8 +47,8 @@ polycode reads configuration from environment variables and optionally from a `~
 
 | Variable | Purpose | Required |
 |---|---|---|
-| `GROQ_API_KEY` | Primary inference key for tool-use and reasoning | yes |
-| `ANTHROPIC_API_KEY` | Optional high-quality tier for long sessions | no |
+| `GROQ_API_KEY` | Direct Groq access, unlimited. If unset, polycode uses the hosted tier. | no |
+| `ANTHROPIC_API_KEY` | Optional higher-quality compile tier for long sessions | no |
 | `POLYCODE_MODEL` | Override the default model | no |
 | `POLYCODE_CWD` | Override the working directory | no |
 
@@ -92,8 +110,8 @@ Rules live in `~/.polycode/rules.yaml`. You can add your own.
 ## Requirements
 
 - Node.js 20 or newer
-- macOS or Linux
-- A Groq API key
+- macOS, Linux, or Windows
+- No API key required for the free hosted tier. Set `GROQ_API_KEY` for unlimited use.
 
 ## Documentation and support
 

package/bin/polycode.mjs

@@ -161,8 +161,8 @@ ${C.bold}Usage${C.reset}
   polycode --verify                 Verify session history integrity
 
 ${C.bold}Environment${C.reset}
-  GROQ_API_KEY                Required (free tier at console.groq.com)
-  ANTHROPIC_API_KEY           Optional high-quality tier for long sessions
+  GROQ_API_KEY                Optional. If unset, polycode uses the free hosted tier (60 turns/hour) via polylogicai.com. Set a free key from console.groq.com for unlimited use.
+  ANTHROPIC_API_KEY           Optional higher-quality compile tier for long sessions
   POLYCODE_MODEL              Override the default model
   POLYCODE_CWD                Override the working directory
 
@@ -259,6 +259,9 @@ async function runOneShot(message, opts) {
 async function runRepl(opts) {
   const rl = readline.createInterface({ input: stdin, output: stdout });
   stdout.write(BANNER + '\n');
+  if (opts.hostedMode) {
+    stdout.write(`${C.dim}hosted tier: 60 turns/hour via polylogicai.com. Set GROQ_API_KEY for unlimited use.${C.reset}\n`);
+  }
   if (opts.projectContextPath) {
     stdout.write(`${C.dim}project context: ${opts.projectContextPath}${C.reset}\n`);
   }
@@ -298,11 +301,12 @@ async function main() {
 
   const configDir = resolveConfigDir();
 
-  const apiKey = env.GROQ_API_KEY;
-  if (!apiKey) {
-    stdout.write(`${C.red}polycode error${C.reset}: GROQ_API_KEY is not set.\n`);
-    exit(1);
-  }
+  // Zero-config mode: if no GROQ_API_KEY is present, run through the Polylogic
+  // hosted inference proxy at polylogicai.com/api/polycode/inference. Users
+  // who want unlimited access or their own billing can set GROQ_API_KEY to a
+  // free key from console.groq.com and the CLI will talk to Groq directly.
+  const apiKey = env.GROQ_API_KEY || '';
+  const hostedMode = !apiKey;
 
   const rules = loadRules();
   const model = env.POLYCODE_MODEL || 'moonshotai/kimi-k2-instruct';
@@ -356,10 +360,10 @@ async function main() {
     canon_path: canonFile,
   }, hookDir);
 
-  const loop = new AgenticLoop({ apiKey, model, rules, projectContext });
+  const loop = new AgenticLoop({ apiKey, model, rules, projectContext, hostedMode, version: VERSION });
   const renderer = createRenderer(stdout, { verbose });
   const state = { lastTurnTokens: 0, lastCompiler: null };
-  const opts = { loop, canon, cwd, renderer, state, sessionId, hookDir, verbose, projectContextPath };
+  const opts = { loop, canon, cwd, renderer, state, sessionId, hookDir, verbose, projectContextPath, hostedMode };
 
   const positional = args.filter((a) => !a.startsWith('--') && args[args.indexOf(a) - 1] !== '--packet');
   if (positional.length > 0) {

package/lib/agentic.mjs

@@ -13,11 +13,62 @@ import Groq from 'groq-sdk';
 import { promises as fs } from 'node:fs';
 import { exec } from 'node:child_process';
 import { promisify } from 'node:util';
-import { resolve, relative, sep, dirname } from 'node:path';
+import { resolve, relative, sep, dirname, join, basename } from 'node:path';
 import { compilePacket } from './compiler.mjs';
 import { mintCommitment } from './commitment.mjs';
 import { ensureActiveIntent } from './intent.mjs';
 import { scrubSecrets } from './witness/secret-scrubber.mjs';
+import { createHostedClient } from './polycode-hosted-client.mjs';
+
+// Cross-platform directory walker. Pure Node.js, no shell-out. Skips common
+// noise directories (node_modules, .git, etc.) by default. Yields absolute
+// file paths as an async iterator so callers can bail out early.
+export const DEFAULT_SKIP_DIRS = new Set(['node_modules', '.git', '.svn', '.hg', 'dist', 'build', '.next', '.nuxt']);
+
+export async function* walkFiles(root, skipDirs = DEFAULT_SKIP_DIRS) {
+  let entries;
+  try {
+    entries = await fs.readdir(root, { withFileTypes: true });
+  } catch {
+    return;
+  }
+  for (const entry of entries) {
+    if (skipDirs.has(entry.name) || entry.name.startsWith('.DS_Store')) continue;
+    const fullPath = join(root, entry.name);
+    if (entry.isDirectory()) {
+      yield* walkFiles(fullPath, skipDirs);
+    } else if (entry.isFile()) {
+      yield fullPath;
+    }
+  }
+}
+
+// Minimal glob-to-regex converter. Supports ** (any depth), * (any chars
+// except /), ? (one char). Anchors the pattern with ^ and $ so callers get
+// full-string matching.
+export function globToRegex(pattern) {
+  const escaped = pattern
+    .replace(/[.+^${}()|[\]\\]/g, '\\$&')
+    .replace(/\*\*\//g, '\u0001')
+    .replace(/\*\*/g, '\u0001')
+    .replace(/\*/g, '[^/]*')
+    .replace(/\?/g, '[^/]')
+    .replace(/\u0001/g, '(?:.*/)?');
+  return new RegExp('^' + escaped + '$');
+}
+
+// Normalize a filesystem path to forward slashes so glob matching and output
+// formatting behave the same on every platform.
+export function toPosix(p) {
+  return sep === '/' ? p : p.split(sep).join('/');
+}
+
+// Detect whether a file buffer is likely binary by looking for a NUL byte in
+// the first kilobyte. Used by the grep tool to skip binary files.
+export function looksBinary(content) {
+  const head = content.slice(0, 1024);
+  return head.indexOf('\u0000') !== -1;
+}
 
 const execAsync = promisify(exec);
 
@@ -95,7 +146,7 @@ const TOOL_SCHEMAS = [
     type: 'function',
     function: {
       name: 'bash',
-      description: 'Run a shell command in the working directory. 30 second timeout. Output truncated at 3200 bytes.',
+      description: 'Run a shell command in the working directory. Uses the system default shell, so assume POSIX tools on macOS and Linux and cmd.exe on Windows. Prefer read_file, write_file, edit_file, glob, and grep for file operations; reserve this tool for real commands like running tests or git. 30 second timeout. Output truncated at 3200 bytes.',
       parameters: {
         type: 'object',
         properties: { command: { type: 'string' } },
@@ -239,23 +290,57 @@ async function runTool(name, args, cwd) {
       }
     }
     case 'glob': {
-      const pattern = String(args.pattern ?? '').replace(/'/g, "'\\''");
+      const pattern = String(args.pattern ?? '').trim();
+      if (!pattern) return '(no pattern)';
       try {
-        const { stdout } = await execAsync(`find . -type f -name '${pattern}' 2>/dev/null | head -200`, { cwd });
-        return truncateStr(stdout || '(no matches)');
+        const regex = globToRegex(pattern);
+        const matches = [];
+        for await (const fullPath of walkFiles(cwd)) {
+          const rel = toPosix(relative(cwd, fullPath));
+          if (regex.test(rel) || regex.test(basename(fullPath))) {
+            matches.push('./' + rel);
+            if (matches.length >= 200) break;
+          }
+        }
+        if (matches.length === 0) return '(no matches)';
+        return truncateStr(matches.join('\n'));
       } catch (err) {
         return `error: ${err.message}`;
       }
     }
     case 'grep': {
-      const pattern = String(args.pattern ?? '').replace(/'/g, "'\\''");
-      const glob = String(args.glob ?? '').replace(/'/g, "'\\''");
+      const pattern = String(args.pattern ?? '').trim();
+      if (!pattern) return '(no pattern)';
+      let regex;
       try {
-        const cmd = glob
-          ? `grep -rn --include='${glob}' -E '${pattern}' . 2>/dev/null | head -100`
-          : `grep -rn -E '${pattern}' . 2>/dev/null | head -100`;
-        const { stdout } = await execAsync(cmd, { cwd });
-        return truncateStr(stdout || '(no matches)');
+        regex = new RegExp(pattern);
+      } catch (err) {
+        return `error: invalid regex: ${err.message}`;
+      }
+      const globPattern = String(args.glob ?? '').trim();
+      const globRegex = globPattern ? globToRegex(globPattern) : null;
+      const matches = [];
+      try {
+        outer: for await (const fullPath of walkFiles(cwd)) {
+          const rel = toPosix(relative(cwd, fullPath));
+          if (globRegex && !(globRegex.test(rel) || globRegex.test(basename(fullPath)))) continue;
+          let content;
+          try {
+            content = await fs.readFile(fullPath, 'utf8');
+          } catch {
+            continue;
+          }
+          if (looksBinary(content)) continue;
+          const lines = content.split('\n');
+          for (let i = 0; i < lines.length; i++) {
+            if (regex.test(lines[i])) {
+              matches.push(`./${rel}:${i + 1}:${lines[i].slice(0, 200)}`);
+              if (matches.length >= 100) break outer;
+            }
+          }
+        }
+        if (matches.length === 0) return '(no matches)';
+        return truncateStr(matches.join('\n'));
       } catch (err) {
         return `error: ${err.message}`;
       }
@@ -279,17 +364,21 @@ function recoverInlineToolCalls(content) {
 }
 
 export class AgenticLoop {
-  constructor({ apiKey, model, logger, rules, projectContext } = {}) {
+  constructor({ apiKey, model, logger, rules, projectContext, hostedMode, version } = {}) {
     this.apiKey = apiKey;
     this.defaultModel = model || DEFAULT_MODEL;
     this.logger = logger || console;
     this.rules = rules || {};
     this.systemPrompt = buildSystemPrompt(projectContext);
+    this.hostedMode = Boolean(hostedMode) || !(apiKey || process.env.GROQ_API_KEY);
+    this.version = version || 'unknown';
   }
 
   async runTurn({ canon, userMessage, cwd, onEvent, maxIterations }) {
     const start = Date.now();
-    const groq = new Groq({ apiKey: this.apiKey || process.env.GROQ_API_KEY });
+    const groq = this.hostedMode
+      ? createHostedClient({ version: this.version })
+      : new Groq({ apiKey: this.apiKey || process.env.GROQ_API_KEY });
     let model = this.defaultModel;
     let didFallback = false;
     const limit = maxIterations || DEFAULT_MAX_ITERATIONS;

package/lib/hooks.mjs

@@ -72,11 +72,17 @@ export async function fireHook(eventName, payload, hookDir) {
   const isShell = hookPath.endsWith('.sh') || !hookPath.includes('.');
   const isNode = hookPath.endsWith('.mjs') || hookPath.endsWith('.js');
 
+  // On Windows we cannot spawn sh for POSIX shell hooks. Skip with a clear
+  // reason so the caller knows the hook did not run. Node hooks are portable.
+  if (isShell && process.platform === 'win32') {
+    return { action: 'allow', reason: 'shell hooks not supported on Windows; use .mjs' };
+  }
+
   return new Promise((resolveHook) => {
     let child;
     try {
       child = isNode
-        ? spawn('node', [hookPath], { stdio: ['pipe', 'pipe', 'pipe'] })
+        ? spawn(process.execPath, [hookPath], { stdio: ['pipe', 'pipe', 'pipe'] })
         : spawn('sh', [hookPath], { stdio: ['pipe', 'pipe', 'pipe'] });
     } catch (err) {
       resolveHook({ action: 'allow', reason: `spawn failed: ${err.message}` });

package/lib/polycode-hosted-client.mjs

@@ -0,0 +1,100 @@
+// lib/polycode-hosted-client.mjs
+// Hosted inference client for users who have not provided a GROQ_API_KEY.
+// Posts chat-completions requests to the Polylogic proxy at
+// polylogicai.com/api/polycode/inference, which forwards them to Groq using
+// a server-side key. Rate limited to 60 turns per install per hour. Power
+// users can skip the proxy by setting GROQ_API_KEY, in which case the agent
+// talks to Groq directly.
+//
+// The returned object mimics the subset of the groq-sdk surface that the
+// agentic loop uses (chat.completions.create), so the call sites do not need
+// to know which backend is in play.
+
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { join } from 'node:path';
+import { randomUUID } from 'node:crypto';
+
+const DEFAULT_PROXY_URL = 'https://polylogicai.com/api/polycode/inference';
+const CONFIG_DIR = join(homedir(), '.polycode');
+const INSTALL_ID_PATH = join(CONFIG_DIR, 'install_id');
+
+// Produce a stable per-install identifier. Created on first run, persisted
+// to ~/.polycode/install_id so subsequent runs reuse the same ID for rate
+// limiting. The file contains a bare UUID with no PII.
+export function getOrCreateInstallId() {
+  try {
+    if (existsSync(INSTALL_ID_PATH)) {
+      const existing = readFileSync(INSTALL_ID_PATH, 'utf8').trim();
+      if (/^[A-Za-z0-9_-]{8,64}$/.test(existing)) return existing;
+    }
+  } catch {
+    // fall through and regenerate
+  }
+  if (!existsSync(CONFIG_DIR)) {
+    mkdirSync(CONFIG_DIR, { recursive: true });
+  }
+  const fresh = randomUUID();
+  try {
+    writeFileSync(INSTALL_ID_PATH, fresh + '\n', { mode: 0o600 });
+  } catch {
+    // non-fatal; rate limiting will fall back to per-IP
+  }
+  return fresh;
+}
+
+// Minimal Groq-SDK-shaped client that posts every request to the Polylogic
+// proxy. The shape matches what lib/agentic.mjs calls: an object with a
+// `chat.completions.create(payload)` method returning an OpenAI-compatible
+// chat completion object.
+export function createHostedClient({ version, proxyUrl } = {}) {
+  const url = proxyUrl || process.env.POLYCODE_PROXY_URL || DEFAULT_PROXY_URL;
+  const installId = getOrCreateInstallId();
+  const headers = {
+    'Content-Type': 'application/json',
+    'X-Polycode-Install-ID': installId,
+    'X-Polycode-Version': version || 'unknown',
+  };
+
+  async function createCompletion(payload) {
+    let res;
+    try {
+      res = await fetch(url, {
+        method: 'POST',
+        headers,
+        body: JSON.stringify(payload),
+      });
+    } catch (err) {
+      const msg = err instanceof Error ? err.message : String(err);
+      const wrapped = new Error(
+        `polycode hosted inference unreachable at ${url}: ${msg}. Set GROQ_API_KEY to a free key from console.groq.com to bypass the proxy.`
+      );
+      wrapped.cause = err;
+      throw wrapped;
+    }
+
+    const text = await res.text();
+    if (!res.ok) {
+      let parsed;
+      try { parsed = JSON.parse(text); } catch { parsed = null; }
+      const serverMsg = parsed?.error || text || `HTTP ${res.status}`;
+      throw new Error(`polycode hosted inference error (${res.status}): ${serverMsg}`);
+    }
+
+    try {
+      return JSON.parse(text);
+    } catch (err) {
+      throw new Error(`polycode hosted inference returned non-JSON body: ${text.slice(0, 200)}`);
+    }
+  }
+
+  return {
+    chat: {
+      completions: {
+        create: createCompletion,
+      },
+    },
+    _proxyUrl: url,
+    _installId: installId,
+  };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polylogicai/polycode",
-  "version": "1.1.2",
+  "version": "1.1.4",
   "description": "An agentic coding CLI. Runs on your machine with your keys. Every turn is appended to a SHA-256 chained session log, so your history is auditable, replayable, and portable.",
   "type": "module",
   "main": "bin/polycode.mjs",