@polylogicai/polycode 1.1.5 → 1.1.6

package/bin/polycode.mjs

@@ -26,7 +26,10 @@ import { fileURLToPath } from 'node:url';
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
 const PACKAGE_JSON = JSON.parse(readFileSync(join(__dirname, '..', 'package.json'), 'utf8'));
-import * as readline from 'node:readline/promises';
+// node:readline is intentionally NOT imported. The REPL owns stdin via the
+// paste-aware reader in lib/paste-aware-prompt.mjs; slash commands that need
+// masked input call readMaskedInput in lib/key-store.mjs. Any readline
+// import here would reintroduce the v1.1.5 double-echo bug.
 import { stdin, stdout, exit, argv, env, cwd as getCwd } from 'node:process';
 import 'dotenv/config';
 
@@ -260,7 +263,12 @@ async function runOneShot(message, opts) {
 }
 
 async function runRepl(opts) {
-  const rl = readline.createInterface({ input: stdin, output: stdout });
+  // Single stdin owner. Do NOT create a readline interface here. The
+  // paste-aware reader (lib/paste-aware-prompt.mjs) owns stdin for the
+  // entire REPL lifetime, and slash commands that need line input fall
+  // through to the raw-mode readMaskedInput helper in lib/key-store.mjs.
+  // Running readline alongside a raw-mode consumer causes every keystroke
+  // to echo twice, which is the v1.1.5 double-echo bug this release fixes.
   stdout.write(BANNER + '\n');
   if (opts.hostedMode) {
     stdout.write(`${C.dim}hosted tier: 60 turns/hour via polylogicai.com. Set GROQ_API_KEY for unlimited use.${C.reset}\n`);
@@ -273,10 +281,6 @@ async function runRepl(opts) {
   }
   stdout.write(`${C.dim}type /help for commands. ctrl+c or /exit to leave.${C.reset}\n\n`);
 
-  // Enable bracketed paste so multi-line pastes collapse to [Pasted #N] in
-  // the display. The readline instance above is used only as an input owner
-  // for slash commands via rl.question; the main prompt uses the custom
-  // paste-aware reader.
   enableBracketedPaste();
 
   try {
@@ -288,7 +292,6 @@ async function runRepl(opts) {
         if (err && err.message === 'cancelled') break;
         throw err;
       }
-      const displayed = userInput.displayed;
       const content = userInput.content;
       if (!content.trim()) continue;
 
@@ -298,16 +301,13 @@ async function runRepl(opts) {
           state: opts.state,
           stdout,
           loop: opts.loop,
-          rl,
+          rl: null,
         });
         if (result.exit) break;
         stdout.write('\n');
         continue;
       }
 
-      // Telemetry-light logging of paste events so later /replay shows a
-      // human-readable trail. The full paste content still goes to the
-      // agent.
       if (userInput.pastes && userInput.pastes.length > 0) {
         for (const p of userInput.pastes) {
           opts.canon.append('paste', { ordinal: p.ordinal, lines: p.lines, bytes: p.bytes });
@@ -319,7 +319,6 @@ async function runRepl(opts) {
     }
   } finally {
     disableBracketedPaste();
-    rl.close();
   }
 }
 

package/lib/key-store.mjs

@@ -187,23 +187,14 @@ export async function readMaskedInput(prompt) {
 // Returns { ok: true, provider, path } on success, { ok: false, reason } on
 // failure. The caller renders the result to the user.
 //
-// If `rl` is passed (a readline.Interface from readline/promises), we use
-// rl.question for the prompt instead of attaching a raw stdin listener. That
-// path matters for the slash-command case inside the REPL where readline
-// already owns stdin; using rl.question avoids a race where readline eats
-// the key line before our masked reader can see it.
-export async function runInteractiveKeyFlow({ providerHint, stdout, rl } = {}) {
+// readMaskedInput handles both the TTY case (raw-mode masked echo) and the
+// non-TTY case (plain line read from piped stdin). The polycode REPL owns
+// stdin via readPasteAwareLine in the main loop; each slash-command call
+// acquires stdin via this helper, finishes its work, and cleans up so the
+// main loop can re-acquire.
+export async function runInteractiveKeyFlow({ providerHint, stdout } = {}) {
   const out = stdout || process.stdout;
-  let rawKey;
-  if (rl && typeof rl.question === 'function') {
-    // Inside the REPL: read through the active readline instance.
-    // Note: this path does not mask echo in the terminal. That is a
-    // deliberate trade-off for reliable input under the REPL. For a
-    // fully-masked prompt, use `polycode login` from the shell instead.
-    rawKey = (await rl.question('Paste your API key (or press Enter to cancel): ')).trim();
-  } else {
-    rawKey = (await readMaskedInput('Paste your API key (or press Enter to cancel): ')).trim();
-  }
+  const rawKey = (await readMaskedInput('Paste your API key (or press Enter to cancel): ')).trim();
   if (!rawKey) {
     return { ok: false, reason: 'cancelled' };
   }

package/lib/slash-commands.mjs

@@ -20,7 +20,10 @@ ${C.bold}polycode commands${C.reset}
   /exit, /quit                Leave polycode
 `;
 
-export async function dispatchSlash(line, { canon, state, stdout, loop, rl }) {
+export async function dispatchSlash(line, { canon, state, stdout, loop }) {
+  // Single stdin owner principle: no readline instance is passed in. Slash
+  // commands that need masked input fall through to the raw-mode helper
+  // in lib/key-store.mjs.
   const [cmd, ...rest] = line.slice(1).split(/\s+/);
   const args = rest.join(' ').trim();
 
@@ -37,7 +40,7 @@ export async function dispatchSlash(line, { canon, state, stdout, loop, rl }) {
         return { continue: true };
       }
       stdout.write(`${C.dim}Your key will be saved locally to ~/.polycode/secrets.env (chmod 600) and never sent to the model.${C.reset}\n`);
-      const result = await runInteractiveKeyFlow({ providerHint, stdout, rl });
+      const result = await runInteractiveKeyFlow({ providerHint, stdout });
       if (!result.ok) {
         if (result.reason === 'cancelled') {
           stdout.write(`${C.dim}cancelled${C.reset}\n`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@polylogicai/polycode",
-  "version": "1.1.5",
+  "version": "1.1.6",
   "description": "An agentic coding CLI. Runs on your machine with your keys. Every turn is appended to a SHA-256 chained session log, so your history is auditable, replayable, and portable.",
   "type": "module",
   "main": "bin/polycode.mjs",