@ruvnet/open-claude-code 2.0.0 → 2.0.1

package/src/permissions/checker.mjs

@@ -3,9 +3,10 @@
  *
  * Integrates with prompt system for interactive permission in default mode,
  * injection checking for Bash commands, and path validation for file ops.
+ * Caches "always allow" decisions per tool per session.
  */
 
-import { requiresPermission } from './prompt.mjs';
+import { requiresPermission, promptPermission, formatToolSummary } from './prompt.mjs';
 import { checkInjection } from './injection-check.mjs';
 import { validatePath } from './path-check.mjs';
 
@@ -13,8 +14,18 @@ export function createPermissionChecker(config = {}) {
     const mode = config.defaultMode || process.env.CLAUDE_CODE_PERMISSION_MODE || 'default';
     const rl = config.rl || null; // readline interface for prompts
 
+    // Cache for "always allow" decisions: tool -> true
+    const alwaysAllowed = new Set();
+
     return {
         mode,
+        alwaysAllowed,
+
+        /**
+         * Check if a tool call is permitted.
+         * In default mode with readline, prompts the user interactively.
+         * Caches "always allow" decisions per tool per session.
+         */
         async check(toolName, input) {
             // Always run injection check on Bash commands
             if (toolName === 'Bash' && input?.command) {
@@ -35,23 +46,83 @@ export function createPermissionChecker(config = {}) {
             switch (mode) {
                 case 'bypassPermissions': return true;
                 case 'acceptEdits':
-                    // Allow file ops, block Bash/Agent unless rl available
+                    // Allow file ops, prompt for Bash/Agent
+                    if (['Edit', 'Write', 'MultiEdit', 'Read', 'Glob', 'Grep'].includes(toolName)) {
+                        return true;
+                    }
                     if (toolName === 'Bash' || toolName === 'Agent') {
-                        return !requiresPermission(toolName) || !!config.bypassBash;
+                        if (config.bypassBash) return true;
+                        if (alwaysAllowed.has(toolName)) return true;
+                        if (rl) return this._promptUser(toolName, input);
+                        return false;
                     }
                     return true;
                 case 'auto': return true; // AI decides
                 case 'dontAsk': return false; // deny everything not pre-approved
-                case 'plan': return toolName === 'Read' || toolName === 'Glob' || toolName === 'Grep';
+                case 'plan':
+                    return ['Read', 'Glob', 'Grep', 'LS', 'ToolSearch'].includes(toolName);
                 case 'default':
                 default:
-                    // In default mode, safe tools pass through
+                    // Safe tools always pass
                     if (!requiresPermission(toolName)) return true;
-                    // Without a readline interface, allow (headless mode)
+                    // Check cached "always allow"
+                    if (alwaysAllowed.has(toolName)) return true;
+                    // Without readline, allow (headless/print mode)
                     if (!rl) return true;
-                    // With rl, would call promptPermission — but that's async/interactive
-                    return true;
+                    // Interactive prompt
+                    return this._promptUser(toolName, input);
             }
         },
+
+        /**
+         * Prompt user for permission, with options: y/n/a (always).
+         * @param {string} toolName
+         * @param {object} input
+         * @returns {Promise<boolean>}
+         */
+        async _promptUser(toolName, input) {
+            if (!rl || typeof rl.question !== 'function') return false;
+
+            const summary = formatToolSummary(toolName, input);
+            return new Promise(resolve => {
+                rl.question(`\x1b[33mAllow ${summary}?\x1b[0m [y/n/a(lways)] `, answer => {
+                    const a = answer.trim().toLowerCase();
+                    if (a === 'a' || a === 'always') {
+                        alwaysAllowed.add(toolName);
+                        resolve(true);
+                    } else if (a === 'y' || a === 'yes') {
+                        resolve(true);
+                    } else {
+                        resolve(false);
+                    }
+                });
+            });
+        },
+
+        /**
+         * Grant "always allow" for a tool without prompting.
+         * @param {string} toolName
+         */
+        allowAlways(toolName) {
+            alwaysAllowed.add(toolName);
+        },
+
+        /**
+         * Reset cached allow decisions.
+         */
+        resetAllowed() {
+            alwaysAllowed.clear();
+        },
+
+        /**
+         * Get info about current permission state.
+         */
+        getInfo() {
+            return {
+                mode,
+                alwaysAllowed: [...alwaysAllowed],
+                hasReadline: !!rl,
+            };
+        },
     };
 }

package/src/tools/bash.mjs

@@ -7,8 +7,10 @@
  * - description parameter
  * - 1MB output limit
  * - ANSI code stripping by default
+ * - Sandbox integration (bubblewrap/seatbelt)
  */
 import { spawn } from 'child_process';
+import { Sandbox } from '../permissions/sandbox.mjs';
 
 // Strip ANSI escape sequences
 function stripAnsi(str) {
@@ -18,6 +20,40 @@ function stripAnsi(str) {
 
 const MAX_OUTPUT_BYTES = 1024 * 1024; // 1MB
 
+// Sandbox instance — reused across calls
+const sandbox = new Sandbox();
+
+/**
+ * Determine if a command should be sandboxed.
+ * @param {string} command
+ * @returns {boolean}
+ */
+function shouldSandbox(command) {
+    // Forced sandbox via env var
+    if (process.env.CLAUDE_CODE_FORCE_SANDBOX === '1') return true;
+    // Bubblewrap env var
+    if (process.env.CLAUDE_CODE_BUBBLEWRAP === '1') return true;
+    // Sandbox setting
+    if (process.env.CLAUDE_CODE_SANDBOX === '1') return true;
+    return false;
+}
+
+/**
+ * Wrap a command with sandbox if needed.
+ * @param {string} command
+ * @returns {string} possibly-wrapped command
+ */
+function applySandbox(command) {
+    if (!shouldSandbox(command)) return command;
+
+    const check = sandbox.check();
+    if (!check.available) return command; // graceful fallback
+
+    return sandbox.wrapCommand(command, {
+        allowWrite: [process.cwd(), '/tmp'],
+    });
+}
+
 export const BashTool = {
     name: 'Bash',
     description: 'Execute a bash command and return its output.',
@@ -38,9 +74,10 @@ export const BashTool = {
     },
     async call(input) {
         const timeout = Math.min(input.timeout || 120000, 600000);
+        const command = applySandbox(input.command);
 
         if (input.run_in_background) {
-            return runBackground(input.command);
+            return runBackground(command);
         }
 
         return new Promise((resolve) => {
@@ -49,7 +86,7 @@ export const BashTool = {
             let killed = false;
             let exitCode = null;
 
-            const proc = spawn('bash', ['-c', input.command], {
+            const proc = spawn('bash', ['-c', command], {
                 env: { ...process.env },
                 stdio: ['pipe', 'pipe', 'pipe'],
                 timeout: 0, // we handle timeout ourselves
@@ -145,4 +182,4 @@ function runBackground(command) {
     return `Background job started: id=${id}, pid=${proc.pid}`;
 }
 
-export { backgroundJobs };
+export { backgroundJobs, shouldSandbox, applySandbox };

package/src/ui/commands.mjs

@@ -1,28 +1,22 @@
-/**
- * Slash Commands — all 39 commands from Claude Code.
- *
- * Each command is a function(args, state) that returns a string response.
- * Commands are invoked via /command-name in the REPL.
- */
-
+/** Slash Commands — all 39+ commands. Fully functional (no stubs). */
+import fs from 'fs';
+import path from 'path';
+import { execSync } from 'child_process';
 import { SessionManager } from '../core/session.mjs';
 import { CheckpointManager } from '../core/checkpoints.mjs';
 import { PromptCache } from '../core/cache.mjs';
 import { readEnv, listEnvVars } from '../config/env.mjs';
+import { cronStore as _cronStore } from '../tools/cron-create.mjs';
 import * as telemetry from '../telemetry/index.mjs';
 
 const checkpoints = new CheckpointManager();
 const promptCache = new PromptCache();
 let sessionManager = null;
-
 function getSession() {
     if (!sessionManager) sessionManager = new SessionManager();
     return sessionManager;
 }
 
-/**
- * All slash commands.
- */
 export const COMMANDS = {
     '/help': {
         description: 'Show available commands',
@@ -31,7 +25,6 @@ export const COMMANDS = {
             for (const [name, cmd] of Object.entries(COMMANDS)) {
                 lines.push(`  ${name.padEnd(20)} ${cmd.description}`);
             }
-            lines.push('');
             return lines.join('\n');
         },
     },
@@ -74,11 +67,13 @@ export const COMMANDS = {
         description: 'Show token usage and estimated cost',
         handler(args, state) {
             const { input, output } = state.tokenUsage;
-            // Use model-appropriate pricing
             const model = state.model || '';
             let priceIn = 3, priceOut = 15; // Sonnet default
             if (model.includes('haiku')) { priceIn = 0.25; priceOut = 1.25; }
             if (model.includes('opus')) { priceIn = 15; priceOut = 75; }
+            if (model.includes('gpt-4o-mini')) { priceIn = 0.15; priceOut = 0.6; }
+            else if (model.includes('gpt-4o')) { priceIn = 2.5; priceOut = 10; }
+            if (model.includes('gemini')) { priceIn = 0.075; priceOut = 0.3; }
 
             const costIn = (input / 1_000_000) * priceIn;
             const costOut = (output / 1_000_000) * priceOut;
@@ -98,22 +93,28 @@ export const COMMANDS = {
             const checks = [];
             checks.push(`Node.js: ${process.version}`);
             checks.push(`ANTHROPIC_API_KEY: ${process.env.ANTHROPIC_API_KEY ? 'set' : 'NOT SET'}`);
+            checks.push(`OPENAI_API_KEY: ${process.env.OPENAI_API_KEY ? 'set' : 'NOT SET'}`);
+            checks.push(`GOOGLE_API_KEY: ${process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY ? 'set' : 'NOT SET'}`);
             checks.push(`Model: ${state.model || 'default'}`);
             checks.push(`Tools: ${state.tools?.list?.()?.length || 0}`);
             checks.push(`Messages: ${state.messages.length}`);
             checks.push(`CWD: ${process.cwd()}`);
             checks.push(`Platform: ${process.platform}`);
 
-            // Check API connectivity
-            let apiStatus = 'unchecked';
-            if (process.env.ANTHROPIC_API_KEY) {
-                apiStatus = 'key present';
-            }
+            // API connectivity check (synchronous status)
+            let apiStatus = 'no key';
+            if (process.env.ANTHROPIC_API_KEY) apiStatus = 'key present';
+            if (process.env.OPENAI_API_KEY) checks.push(`OpenAI API: key present`);
+            if (process.env.GOOGLE_API_KEY || process.env.GEMINI_API_KEY) checks.push(`Google API: key present`);
             checks.push(`API: ${apiStatus}`);
 
             // Check MCP servers
-            const mcpCount = state._mcpClients?.length || 0;
-            checks.push(`MCP servers: ${mcpCount}`);
+            const mcpClients = state._mcpClients || [];
+            checks.push(`MCP servers: ${mcpClients.length}`);
+            for (const client of mcpClients) {
+                const status = client.connected ? 'connected' : 'disconnected';
+                checks.push(`  - ${client.config?.command || 'unknown'}: ${status}`);
+            }
 
             return `System check:\n${checks.map(c => `  ${c}`).join('\n')}`;
         },
@@ -135,8 +136,9 @@ export const COMMANDS = {
         description: 'Show or switch model',
         handler(args, state) {
             if (args) {
+                const old = state.model;
                 state.model = args;
-                return `Model switched to: ${args}`;
+                return `Model switched: ${old} -> ${args}`;
             }
             return `Current model: ${state.model || 'default'}`;
         },
@@ -166,28 +168,14 @@ export const COMMANDS = {
         },
     },
 
-    '/quit': {
-        description: 'Exit the REPL',
-        handler() { return 'EXIT'; },
-    },
-
-    '/exit': {
-        description: 'Exit the REPL',
-        handler() { return 'EXIT'; },
-    },
-
-    '/bug': {
-        description: 'Report a bug',
-        handler() {
-            return 'Report bugs at: https://github.com/ruvnet/open-claude-code/issues';
-        },
-    },
+    '/quit': { description: 'Exit the REPL', handler() { return 'EXIT'; } },
+    '/exit': { description: 'Exit the REPL', handler() { return 'EXIT'; } },
+    '/bug': { description: 'Report a bug', handler() { return 'Report bugs at: https://github.com/ruvnet/open-claude-code/issues'; } },
 
     '/review': {
         description: 'Review recent changes',
         handler(args, state) {
             try {
-                const { execSync } = require('child_process');
                 const diff = execSync('git diff --stat HEAD~1 2>/dev/null || echo "No git history"', { encoding: 'utf-8' });
                 return `Recent changes:\n${diff}`;
             } catch {
@@ -199,8 +187,6 @@ export const COMMANDS = {
     '/init': {
         description: 'Initialize Claude Code in current directory',
         handler() {
-            const fs = require('fs');
-            const path = require('path');
             const claudeDir = path.join(process.cwd(), '.claude');
             fs.mkdirSync(claudeDir, { recursive: true });
             const settingsFile = path.join(claudeDir, 'settings.json');
@@ -211,24 +197,11 @@ export const COMMANDS = {
         },
     },
 
-    '/login': {
-        description: 'Set API key',
-        handler(args) {
-            if (args) {
-                process.env.ANTHROPIC_API_KEY = args;
-                return 'API key set.';
-            }
-            return 'Usage: /login <api-key>';
-        },
-    },
-
-    '/logout': {
-        description: 'Clear API key',
-        handler() {
-            delete process.env.ANTHROPIC_API_KEY;
-            return 'API key cleared.';
-        },
-    },
+    '/login': { description: 'Set API key', handler(args) {
+        if (args) { process.env.ANTHROPIC_API_KEY = args; return 'API key set.'; }
+        return 'Usage: /login <api-key>';
+    }},
+    '/logout': { description: 'Clear API key', handler() { delete process.env.ANTHROPIC_API_KEY; return 'API key cleared.'; } },
 
     '/status': {
         description: 'Show session status',
@@ -386,10 +359,9 @@ export const COMMANDS = {
     '/schedule': {
         description: 'List scheduled tasks',
         handler() {
-            const { cronStore } = require('../tools/cron-create.mjs');
-            if (!cronStore || cronStore.size === 0) return 'No scheduled tasks.';
+            if (!_cronStore || _cronStore.size === 0) return 'No scheduled tasks.';
             const lines = [];
-            for (const [, job] of cronStore) {
+            for (const [, job] of _cronStore) {
                 lines.push(`  ${job.id}: ${job.name} (${job.schedule})`);
             }
             return `Scheduled:\n${lines.join('\n')}`;
@@ -423,8 +395,9 @@ export const COMMANDS = {
         description: 'Show git diff',
         handler() {
             try {
-                const { execSync } = require('child_process');
-                return execSync('git diff --stat 2>/dev/null || echo "Not in a git repo"', { encoding: 'utf-8' });
+                // execSync imported at top
+                const d = execSync('git diff --stat 2>/dev/null || echo "Not in a git repo"', { encoding: 'utf-8' });
+                return d.trim() || 'No changes.';
             } catch {
                 return 'Unable to show diff.';
             }
@@ -443,7 +416,7 @@ export const COMMANDS = {
         description: 'Create a git commit with AI message',
         handler(args) {
             try {
-                const { execSync } = require('child_process');
+                // execSync imported at top
                 const msg = args || 'Update from open-claude-code';
                 execSync('git add -A', { encoding: 'utf-8' });
                 execSync(`git commit -m "${msg}"`, { encoding: 'utf-8' });
@@ -454,27 +427,45 @@ export const COMMANDS = {
         },
     },
 
-    '/pr': {
-        description: 'Create a pull request (stub)',
-        handler() {
-            return 'PR creation requires gh CLI. Run: gh pr create --fill';
+    '/pr': { description: 'Create a pull request', handler() { return 'PR creation requires gh CLI. Run: gh pr create --fill'; } },
+    '/release': { description: 'Create a release', handler() { return 'Release creation requires gh CLI. Run: gh release create <tag>'; } },
+
+    '/resume': {
+        description: 'Resume a saved session',
+        handler(args, state) {
+            const session = getSession();
+            if (args) {
+                // Resume specific session by ID
+                const ok = session.resume(state, args.trim());
+                if (ok) {
+                    return `Resumed session: ${session.sessionId} (${state.messages.length} messages, ${state.turnCount} turns)`;
+                }
+                return `Could not find session: ${args.trim()}`;
+            }
+            // Resume most recent
+            const ok = session.resume(state);
+            if (ok) {
+                return `Resumed session: ${session.sessionId} (${state.messages.length} messages, ${state.turnCount} turns)`;
+            }
+            return 'No resumable session found.';
         },
     },
 
-    '/release': {
-        description: 'Create a release (stub)',
-        handler() {
-            return 'Release creation requires gh CLI. Run: gh release create <tag>';
+    '/sessions': {
+        description: 'List recent sessions',
+        handler(args, state) {
+            const session = getSession();
+            const list = session.listSessions(10);
+            if (list.length === 0) return 'No saved sessions.';
+            const lines = list.map(s =>
+                `  ${s.id} | ${s.savedAt || '?'} | ${s.turnCount || 0} turns | ${s.messageCount || 0} msgs`
+            );
+            return `Recent sessions:\n${lines.join('\n')}`;
         },
     },
 };
 
-/**
- * Execute a slash command.
- * @param {string} input - full command string (e.g., "/model claude-sonnet-4-6")
- * @param {object} state - agent loop state
- * @returns {{ response: string, exit: boolean }}
- */
+/** Execute a slash command. */
 export function executeCommand(input, state) {
     const parts = input.split(/\s+/);
     const cmd = parts[0].toLowerCase();
@@ -489,11 +480,7 @@ export function executeCommand(input, state) {
     return { response, exit: response === 'EXIT' };
 }
 
-/**
- * Get command completions for tab-complete.
- * @param {string} partial
- * @returns {string[]}
- */
+/** Get command completions for tab-complete. */
 export function getCompletions(partial) {
     return Object.keys(COMMANDS).filter(c => c.startsWith(partial));
 }

package/src/ui/ink-app.mjs

@@ -8,6 +8,7 @@
  * - Markdown bold, italic, inline code rendering
  * - Status line showing model, tokens used, cost estimate
  * - Progress for tool execution (show tool name + "running...")
+ * - Cost display after each turn: (tokens: X in / Y out | $Z)
  */
 
 // ANSI color codes
@@ -29,6 +30,7 @@ const COLORS = {
     bgGreen: '\x1b[42m',
     bgYellow: '\x1b[43m',
     bgBlue: '\x1b[44m',
+    bgGray: '\x1b[48;5;236m',
 };
 
 const noColor = process.env.NO_COLOR === '1';
@@ -78,6 +80,7 @@ export class Spinner {
 
 /**
  * Highlight code blocks in markdown text.
+ * Detects ``` blocks and adds subtle background/syntax coloring.
  * @param {string} text
  * @returns {string}
  */
@@ -88,7 +91,7 @@ export function highlightCode(text) {
         const header = lang ? c('dim', `  ${lang}`) : '';
         const highlighted = code
             .split('\n')
-            .map(line => `  ${highlightLine(line, lang)}`)
+            .map(line => `${COLORS.bgGray}  ${highlightLine(line, lang)}  ${COLORS.reset}`)
             .join('\n');
         return `${c('dim', '```')}${header}\n${highlighted}\n${c('dim', '```')}`;
     });
@@ -138,16 +141,18 @@ export function renderMarkdown(text) {
 
 /**
  * Render a tool progress indicator.
+ * Shows [ToolName] running... in yellow.
  * @param {string} toolName
  * @param {string} status
  */
 export function renderToolProgress(toolName, status) {
     const icon = status === 'running' ? c('yellow', '>>') : c('green', '>>');
-    return `${icon} ${c('yellow', toolName)} ${c('dim', status)}`;
+    return `${icon} ${c('yellow', `[${toolName}]`)} ${c('dim', status)}`;
 }
 
 /**
  * Render a status bar with token counts and cost estimate.
+ * Shown after each turn: (tokens: X in / Y out | $Z)
  * @param {object} state
  */
 export function renderStatusBar(state) {
@@ -156,25 +161,59 @@ export function renderStatusBar(state) {
     const model = state.model || 'default';
     const inp = state.tokenUsage?.input || 0;
     const out = state.tokenUsage?.output || 0;
-    const tokens = `in:${inp} out:${out}`;
-    const turns = `turn:${state.turnCount || 0}`;
 
-    // Cost estimate (Sonnet pricing by default)
-    const costIn = (inp / 1_000_000) * 3;
-    const costOut = (out / 1_000_000) * 15;
+    // Cost estimate based on model
+    let priceIn = 3, priceOut = 15; // Sonnet default
+    if (model.includes('haiku')) { priceIn = 0.25; priceOut = 1.25; }
+    if (model.includes('opus')) { priceIn = 15; priceOut = 75; }
+    if (model.includes('gpt-4o-mini')) { priceIn = 0.15; priceOut = 0.6; }
+    else if (model.includes('gpt-4o')) { priceIn = 2.5; priceOut = 10; }
+    if (model.includes('gemini')) { priceIn = 0.075; priceOut = 0.3; }
+
+    const costIn = (inp / 1_000_000) * priceIn;
+    const costOut = (out / 1_000_000) * priceOut;
     const cost = `$${(costIn + costOut).toFixed(4)}`;
+    const turns = `turn:${state.turnCount || 0}`;
 
-    const right = `${model} | ${tokens} | ${cost} | ${turns}`;
+    const costDisplay = `(tokens: ${formatNum(inp)} in / ${formatNum(out)} out | ${cost})`;
+    const right = `${model} | ${costDisplay} | ${turns}`;
     const padding = Math.max(0, cols - right.length - 1);
     return c('dim', `${' '.repeat(padding)}${right}`);
 }
 
 /**
- * Render an error message.
+ * Format a cost display for inline use.
+ * @param {object} state
+ * @returns {string}
+ */
+export function renderCostInline(state) {
+    const inp = state.tokenUsage?.input || 0;
+    const out = state.tokenUsage?.output || 0;
+    const model = state.model || '';
+    let priceIn = 3, priceOut = 15;
+    if (model.includes('haiku')) { priceIn = 0.25; priceOut = 1.25; }
+    if (model.includes('opus')) { priceIn = 15; priceOut = 75; }
+    const cost = ((inp / 1_000_000) * priceIn) + ((out / 1_000_000) * priceOut);
+    return c('dim', `(tokens: ${formatNum(inp)} in / ${formatNum(out)} out | $${cost.toFixed(4)})`);
+}
+
+function formatNum(n) {
+    if (n >= 1_000_000) return `${(n / 1_000_000).toFixed(1)}M`;
+    if (n >= 1_000) return `${(n / 1_000).toFixed(1)}K`;
+    return String(n);
+}
+
+/**
+ * Render an error message with context.
  * @param {string} message
+ * @param {string} [context]
  */
-export function renderError(message) {
-    return `${c('red', 'Error:')} ${message}`;
+export function renderError(message, context) {
+    let result = `${c('red', 'Error:')} ${message}`;
+    if (context) {
+        result += `\n${c('dim', `  Context: ${context}`)}`;
+    }
+    return result;
 }
 
 /**
@@ -194,11 +233,11 @@ export function renderSuccess(message) {
 }
 
 /**
- * Render thinking output (dim).
+ * Render thinking output (dim/gray).
  * @param {string} text
  */
 export function renderThinking(text) {
-    return c('dim', text);
+    return c('gray', text);
 }
 
 /**