@sayknow-cli/coding-agent 0.4.7 → 0.5.0

package/dist/types/tools/resource-gc.d.ts

@@ -1,4 +1,6 @@
+import type { WindowsJobMemoryProbeResult } from "@sayknow-cli/natives";
 import type { Settings } from "../config/settings";
+import type { MemoryGuardWorkerSample } from "../runtime/memory-guard-contract";
 import { type TabGcSnapshot } from "./browser/tab-supervisor";
 export interface BrowserGcPolicy {
     enabled: boolean;
@@ -16,7 +18,10 @@ export declare function resolveSweepIntervalMs(settings: Settings): number;
 /** Injectable seams so the controller is fully testable without real browsers/filesystem/RSS. */
 export interface ResourceGcDeps {
     now: () => number;
+    monotonicNow: () => number;
     rssBytes: () => number;
+    memorySnapshot: () => Promise<MemoryPressureSnapshot>;
+    runGc: () => void;
     logWarn: (msg: string, meta?: Record<string, unknown>) => void;
     listTabs: () => TabGcSnapshot[];
     releaseTab: (name: string, policy: {
@@ -31,10 +36,13 @@ export interface ResourceGcDeps {
         removed: number;
     }>;
     screenshotArmed: () => boolean;
+    listTeamWorkers?: (cwd: string, sessionId: string) => Promise<MemoryGuardWorkerSample[]>;
+    applyTeamWorkerGuard?: (cwd: string, sessionId: string, workerId: string, excessBytes: number, incidentId: string) => Promise<void>;
 }
 export interface ResourceGcRegistration {
     sessionId: string;
     settings: Settings;
+    cwd?: string | (() => string);
 }
 /**
  * Register a session with the resource GC. Starts the single shared timer on the first
@@ -43,6 +51,21 @@ export interface ResourceGcRegistration {
  */
 export declare function registerResourceGcSession(reg: ResourceGcRegistration): () => void;
 export declare function sweepOnce(d?: ResourceGcDeps): Promise<void>;
+export interface MemoryPressureDomain {
+    hardCapBytes: number;
+    totalUsageBytes: number;
+    source: MemoryPressureSnapshot["source"];
+}
+export interface MemoryPressureSnapshot {
+    hardCapBytes: number;
+    totalUsageBytes: number;
+    parentBytes: number;
+    source: "host" | "linux_cgroup_v2" | "linux_cgroup_v1" | "windows_job" | "windows_process_job_limit";
+    domains?: MemoryPressureDomain[];
+}
+export declare function __sampleLinuxCgroupHierarchyForTest(mountInfo: string, membership: string, fsType: "cgroup" | "cgroup2", hostBytes: number, parentBytes: number): Promise<MemoryPressureSnapshot | null>;
+export declare function __sampleWindowsJobMemoryForTest(hostBytes: number, parentBytes: number, probeResult?: WindowsJobMemoryProbeResult): MemoryPressureSnapshot | null;
+export declare function __selectMemoryPressureDomainForTest(snapshot: MemoryPressureSnapshot, policyLimitBytes: number | null): MemoryPressureSnapshot;
 export declare function __setResourceGcDepsForTest(overrides: Partial<ResourceGcDeps>): void;
 export declare function __setResourceGcSchedulerNowForTest(now: () => number): void;
 export declare function __runResourceGcTickForTest(): Promise<void>;

package/dist/types/tools/skill-discovery.d.ts

@@ -15,6 +15,13 @@ export type SkillDiscoveryToolInput = z.infer<typeof skillDiscoverySchema>;
 export interface SkillDiscoveryToolDetails {
     candidates: RuntimeSkillDiscoveryCandidate[];
     count: number;
+    /**
+     * Present only when zero candidates were returned AND discovery config gates
+     * (`skills.enabled` / `skills.enablePiProject` / `skills.enablePiUser`)
+     * prevented some or all of the requested scope from being searched. Without
+     * this, a disabled config is indistinguishable from "no skills exist".
+     */
+    notice?: string;
 }
 export declare class SkillDiscoveryTool implements AgentTool<typeof skillDiscoverySchema, SkillDiscoveryToolDetails> {
     #private;

package/dist/types/tools/sqlite-reader.d.ts

@@ -32,6 +32,13 @@ export type SqliteRowLookup = {
 } | {
     kind: "rowid";
 };
+/**
+ * Keep raw reads deliberately narrower than SQLite's full grammar. Comments are
+ * rejected, and a statement terminator is accepted only as the final
+ * non-whitespace character. Quoted semicolons remain ordinary query data.
+ */
+export declare function validateSqliteReadQuery(sql: string): string;
+export declare function enforceSqliteQueryOnly(db: Database): void;
 export declare function parseSqlitePathCandidates(filePath: string): SqlitePathCandidate[];
 export declare function isSqliteFile(absolutePath: string): Promise<boolean>;
 export declare function parseSqliteSelector(subPath: string, queryString: string): SqliteSelector;

package/dist/types/tools/tool-result.d.ts

@@ -1,6 +1,6 @@
 import type { AgentToolResult } from "@sayknow-cli/agent-core";
 import type { ImageContent, TextContent } from "@sayknow-cli/ai";
-import type { OutputSummary, TruncationResult } from "../session/streaming-output";
+import type { OutputSummary, ReadWindow, TruncationResult } from "../session/streaming-output";
 import type { OutputMeta, TruncationOptions, TruncationSummaryOptions, TruncationTextOptions } from "./output-meta";
 type ToolContent = Array<TextContent | ImageContent>;
 type DetailsWithMeta = {
@@ -12,6 +12,12 @@ export declare class ToolResultBuilder<TDetails extends DetailsWithMeta> {
     text(text: string): this;
     content(content: ToolContent): this;
     truncation(result: TruncationResult, options: TruncationOptions): this;
+    truncationWindows(windows: ReadWindow, options?: {
+        artifactId?: string;
+        noticeOwner?: "body";
+        maxBytes?: number;
+        rangeBase?: "file" | "window";
+    }): this;
     truncationFromSummary(summary: OutputSummary, options: TruncationSummaryOptions): this;
     truncationFromText(text: string, options: TruncationTextOptions): this;
     limits(limits: {

package/dist/types/utils/prompt-suggestion.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Predict the user's likely next prompt after an agent turn using a smol,
+ * fast model. Native SKC port of the ghost-text prompt-suggestion behavior
+ * from Claude Code: the prediction renders as dim ghost text in the empty
+ * composer and Tab accepts it.
+ */
+import type { AgentMessage } from "@sayknow-cli/agent-core";
+import { type Api, type Model } from "@sayknow-cli/ai";
+import type { ModelRegistry } from "../config/model-registry";
+import type { Settings } from "../config/settings";
+export declare const PROMPT_SUGGESTION_MAX_WORDS = 12;
+export declare const PROMPT_SUGGESTION_MAX_CHARS = 100;
+/**
+ * Strip wrapper tags and label prefixes a model sometimes adds despite being
+ * told to reply with only the suggestion.
+ */
+export declare function sanitizePromptSuggestion(raw: string): string;
+/**
+ * Heuristic gate rejecting model output that would make a bad ghost-text
+ * suggestion. Returns the rejection reason, or null when the text is usable.
+ */
+export declare function suppressPromptSuggestionReason(text: string): string | null;
+/**
+ * Build a compact recent-conversation transcript for the prediction request.
+ * Returns null when there is no user message to predict from.
+ */
+export declare function buildPromptSuggestionContext(messages: AgentMessage[]): string | null;
+/**
+ * Generate a predicted next user prompt from the recent conversation.
+ * Returns null when no usable suggestion is produced (silence is the
+ * expected steady state).
+ */
+export declare function generatePromptSuggestion(messages: AgentMessage[], registry: ModelRegistry, settings: Settings, sessionId?: string, currentModel?: Model<Api>, metadataResolver?: (provider: string) => Record<string, unknown> | undefined): Promise<string | null>;

package/dist/types/utils/shell-snapshot.d.ts

@@ -1,5 +1,17 @@
+interface ShellSnapshotCacheOptions {
+    tempRoot: string;
+    home: string | (() => string);
+    platform: NodeJS.Platform;
+}
+declare function createShellSnapshotCache(options: ShellSnapshotCacheOptions): {
+    getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null>;
+    cleanup(): Promise<void>;
+};
+/** @internal Test-only factory for isolated filesystem and platform assertions. */
+export declare const createShellSnapshotCacheForTesting: typeof createShellSnapshotCache;
 /**
  * Create a shell snapshot, caching the result.
  * Returns the path to the snapshot file, or null if creation failed.
  */
 export declare function getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null>;
+export {};

package/dist/types/web/insane/bridge.d.ts

@@ -16,6 +16,7 @@ import { spawn as nodeSpawn } from "node:child_process";
 export declare const INSANE_VENDOR_DIR: string;
 /** Stable note prefixes — tests assert on these without depending on full stderr. */
 export declare const INSANE_NOTES: {
+    readonly securityDisabled: "insane fallback disabled: remote renderer cannot preserve validated network routing";
     readonly guardBlocked: (reason: string) => string;
     readonly vendorMissing: "insane fallback unavailable: vendor engine missing at packages/coding-agent/vendor/insane-search";
     readonly noPython: "insane fallback unavailable: python3 not found; install python3 and curl_cffi, then retry with web.insaneFallback=true";

package/dist/types/web/insane/url-guard.d.ts

@@ -10,6 +10,18 @@ export interface PublicUrlRejected {
 export type PublicUrlResult = PublicUrlAccepted | PublicUrlRejected;
 /** Resolver seam so tests can inject DNS results without real lookups. */
 export type AddressResolver = (hostname: string) => Promise<string[]>;
+type ProxyEnvironment = Record<string, string | undefined>;
+export type GuardedPublicFetchResult = {
+    ok: true;
+    response: Response;
+    logicalUrl: URL;
+    wireUrl: URL;
+} | {
+    ok: false;
+    reason: string;
+    logicalUrl: string;
+};
+export declare function hasConfiguredProxy(env: ProxyEnvironment): boolean;
 /** True for any address that is not a routable public unicast address. */
 export declare function isPrivateOrSpecialAddress(address: string): boolean;
 /**
@@ -19,7 +31,12 @@ export declare function isPrivateOrSpecialAddress(address: string): boolean;
  */
 export declare function validatePublicHttpUrl(rawUrl: string, options?: {
     resolver?: AddressResolver;
+    signal?: AbortSignal;
 }): Promise<PublicUrlResult>;
+export declare function guardedPublicFetch(rawUrl: string, init?: BunFetchRequestInit, options?: {
+    resolver?: AddressResolver;
+}): Promise<GuardedPublicFetchResult>;
 export declare function validatePublicHttpUrlForInsane(rawUrl: string, options?: {
     resolver?: AddressResolver;
 }): Promise<PublicUrlResult>;
+export {};

package/package.json

@@ -1,7 +1,7 @@
 {
 	"type": "module",
 	"name": "@sayknow-cli/coding-agent",
-	"version": "0.4.7",
+	"version": "0.5.0",
 	"description": "Sayknow-CLI CLI with read, bash, edit, write tools and session management",
 	"homepage": "https://sayknow-cli.com",
 	"author": "jaybeyond",
@@ -49,15 +49,15 @@
 		"verify:insane-vendor": "bun scripts/verify-insane-vendor.ts"
 	},
 	"dependencies": {
-		"@agentclientprotocol/sdk": "1.2.1",
+		"@agentclientprotocol/sdk": "1.3.0",
 		"@babel/parser": "^7.29.3",
 		"@mozilla/readability": "^0.6.0",
-		"@sayknow-cli/stats": "0.4.7",
-		"@sayknow-cli/agent-core": "0.4.7",
-		"@sayknow-cli/ai": "0.4.7",
-		"@sayknow-cli/natives": "0.4.7",
-		"@sayknow-cli/tui": "0.4.7",
-		"@sayknow-cli/utils": "0.4.7",
+		"@sayknow-cli/stats": "0.5.0",
+		"@sayknow-cli/agent-core": "0.5.0",
+		"@sayknow-cli/ai": "0.5.0",
+		"@sayknow-cli/natives": "0.5.0",
+		"@sayknow-cli/tui": "0.5.0",
+		"@sayknow-cli/utils": "0.5.0",
 		"@puppeteer/browsers": "^2.13.0",
 		"@types/turndown": "5.0.6",
 		"@xterm/headless": "^6.0.0",
@@ -308,10 +308,6 @@
 			"types": "./dist/types/extensibility/custom-commands/bundled/ci-green/index.d.ts",
 			"import": "./src/extensibility/custom-commands/bundled/ci-green/index.ts"
 		},
-		"./extensibility/custom-commands/bundled/review": {
-			"types": "./dist/types/extensibility/custom-commands/bundled/review/index.d.ts",
-			"import": "./src/extensibility/custom-commands/bundled/review/index.ts"
-		},
 		"./extensibility/custom-tools": {
 			"types": "./dist/types/extensibility/custom-tools/index.d.ts",
 			"import": "./src/extensibility/custom-tools/index.ts"

package/scripts/benchmark-sticky-viewport-pr1.ts

@@ -0,0 +1,239 @@
+import * as fs from "node:fs/promises";
+import * as path from "node:path";
+import { Container, renderMetrics, Text, TUI } from "@sayknow-cli/tui";
+import { VirtualTerminal } from "../../tui/test/virtual-terminal";
+import {
+	__ircSidebarPerfCounters,
+	type IrcSidebarTheme,
+	IrcSplitViewComponent,
+} from "../src/modes/components/irc-sidebar";
+import { __ircLedgerPerfCounters, IrcObservationLedger } from "../src/modes/irc-observation-ledger";
+
+const SCHEMA_VERSION = 1;
+const WIDTH = 80;
+const HEIGHTS = [1, 3, 10] as const;
+const TRANSCRIPT_ROWS = [10_000, 100_000] as const;
+const STICKY_SUFFIX_WORKLOAD_NAMES = [
+	"sticky-suffix-10000-rows-height-1",
+	"sticky-suffix-10000-rows-height-3",
+	"sticky-suffix-10000-rows-height-10",
+	"sticky-suffix-100000-rows-height-1",
+	"sticky-suffix-100000-rows-height-3",
+	"sticky-suffix-100000-rows-height-10",
+] as const;
+
+const stickySuffixMatrix = TRANSCRIPT_ROWS.flatMap(transcriptRows =>
+	HEIGHTS.map(height => ({
+		transcriptRows,
+		height,
+		name: `sticky-suffix-${transcriptRows}-rows-height-${height}`,
+	})),
+);
+
+function assertStickySuffixMatrix(): void {
+	const names = stickySuffixMatrix.map(workload => workload.name);
+	if (JSON.stringify(names) !== JSON.stringify(STICKY_SUFFIX_WORKLOAD_NAMES))
+		throw new Error("sticky suffix workload matrix changed");
+}
+
+const sidebarTheme = {
+	fg: (_color: "dim" | "accent", text: string) => text,
+	bold: (text: string) => text,
+	boxSharp: { vertical: "|" },
+} satisfies IrcSidebarTheme;
+
+type HardCounters = Readonly<Record<string, number | boolean>>;
+type WorkloadResult = Readonly<{ name: string; hard: HardCounters; advisory: Record<string, number> }>;
+export type StickyViewportPr1Benchmark = Readonly<{
+	schemaVersion: number;
+	workloads: readonly WorkloadResult[];
+	advisory: {
+		readonly timingAndMemoryOnly: true;
+		readonly wallMs: number;
+		readonly cpuUserMicros: number;
+		readonly cpuSystemMicros: number;
+		readonly rssBytes: number;
+	};
+}>;
+
+function rows(count: number, prefix: string): Text[] {
+	return Array.from({ length: count }, (_, index) => new Text(`${prefix}-${index}`, 0, 0));
+}
+
+async function settle(terminal: VirtualTerminal): Promise<void> {
+	await terminal.waitForRender();
+	await Promise.resolve();
+}
+
+async function stickySuffixWorkload(transcriptRows: number, height: number): Promise<WorkloadResult> {
+	renderMetrics.reset();
+	const terminal = new VirtualTerminal(WIDTH, height, { isProcessTerminal: true });
+	const tui = new TUI(terminal);
+	const transcript = new Container();
+	for (const row of rows(transcriptRows, "transcript")) transcript.addChild(row);
+	const status = new Text("status: pinned", 0, 0);
+	const suffix = Array.from({ length: height + 3 }, (_value, index) => new Text(`suffix-${index}`, 0, 0));
+	tui.addChild(transcript);
+	tui.addChild(status);
+	for (const row of suffix) tui.addChild(row);
+	tui.setBottomPinnedComponent(status);
+	const flatFrameRows = transcriptRows + suffix.length + 1;
+	const originalSlice = Array.prototype.slice;
+	let flatFrameSlices = 0;
+	let negativeControlSlices = 0;
+	const isLargeFlatFrame = (receiver: unknown[]): boolean =>
+		receiver.length === flatFrameRows &&
+		receiver[0] === "transcript-0" &&
+		receiver[transcriptRows - 1] === `transcript-${transcriptRows - 1}`;
+	try {
+		Array.prototype.slice = function <T>(this: T[], start?: number, end?: number): T[] {
+			if (isLargeFlatFrame(this)) flatFrameSlices++;
+			return originalSlice.call(this, start, end);
+		};
+		const negativeControl = Array.from({ length: flatFrameRows }, (_value, index) =>
+			index < transcriptRows ? `transcript-${index}` : "suffix",
+		);
+		negativeControl.slice(0, 1);
+		negativeControlSlices = flatFrameSlices;
+		flatFrameSlices = 0;
+		tui.start();
+		await settle(terminal);
+		const structural = renderMetrics.snapshot().structuralCounters;
+		const selected = structural.pinnedSuffixSelectedRows ?? 0;
+		const overflowFrames = structural.pinnedSuffixOverflowFrames ?? 0;
+		if (flatFrameSlices !== 0) throw new Error("pinned suffix sliced the large transcript frame");
+		if (negativeControlSlices !== 1) throw new Error("large-frame slice detector did not count its negative control");
+		if (selected > height) throw new Error("pinned suffix selected rows exceed terminal height");
+		if (overflowFrames !== 1 || selected === 0) throw new Error("pinned suffix overflow workload did not execute");
+		return {
+			name: `sticky-suffix-${transcriptRows}-rows-height-${height}`,
+			hard: {
+				largeFlatFrameSliceCalls: flatFrameSlices,
+				pinnedSuffixOverflowFrames: overflowFrames,
+				pinnedSuffixSelectedRows: selected,
+			},
+			advisory: { renderCount: renderMetrics.snapshot().renderCount },
+		};
+	} finally {
+		Array.prototype.slice = originalSlice;
+		tui.stop();
+	}
+}
+
+async function equalOutputSourceWorkload(): Promise<WorkloadResult> {
+	renderMetrics.reset();
+	const terminal = new VirtualTerminal(WIDTH, 10);
+	const tui = new TUI(terminal);
+	try {
+		tui.addChild(new Text("output", 0, 0));
+		tui.setViewportOutputSource({ identity: "pr1-equal", revision: 1n });
+		tui.start();
+		await settle(terminal);
+		const before = renderMetrics.snapshot().renderCount;
+		for (let index = 0; index < 1_000; index++) tui.setViewportOutputSource({ identity: "pr1-equal", revision: 1n });
+		await Promise.resolve();
+		const snapshot = renderMetrics.snapshot();
+		const equalNoops = snapshot.structuralCounters.viewportOutputSourceEqualNoops ?? 0;
+		if (snapshot.renderCount !== before || equalNoops !== 1_000)
+			throw new Error("equal output source requested a render");
+		return {
+			name: "equal-output-source-1000",
+			hard: { equalNoops, renderRequests: snapshot.renderCount - before },
+			advisory: {},
+		};
+	} finally {
+		tui.stop();
+	}
+}
+
+function addObservation(ledger: IrcObservationLedger, id: string): void {
+	ledger.observe(
+		{ observationId: id, kind: "incoming", from: "peer", to: "you", text: `observation ${id}`, timestamp: 0 },
+		false,
+	);
+}
+
+function sidebarCacheWorkload(): WorkloadResult {
+	__ircSidebarPerfCounters.reset();
+	__ircSidebarPerfCounters.enable();
+	__ircLedgerPerfCounters.reset();
+	__ircLedgerPerfCounters.enable();
+	const ledger = new IrcObservationLedger();
+	for (let index = 0; index < 9_999; index++) addObservation(ledger, `history-${index}`);
+	const split = new IrcSplitViewComponent(new Text("left pane", 0, 0), ledger, sidebarTheme);
+	split.setVisible(true);
+	for (let index = 0; index < 100; index++) split.render(WIDTH);
+	const stable = __ircSidebarPerfCounters.snapshot();
+	addObservation(ledger, "mutation");
+	split.render(WIDTH);
+	const final = __ircSidebarPerfCounters.snapshot();
+	const ledgerCounters = __ircLedgerPerfCounters.snapshot();
+	if (stable.projectionMemoMisses !== 1 || stable.styledCacheMisses !== 1 || stable.wrapCalls === 0)
+		throw new Error("unchanged sidebar did not reuse caches");
+	if (stable.projectionMemoHits !== 99 || stable.styledCacheHits !== 99)
+		throw new Error("unchanged sidebar cache counts changed");
+	if (final.wrapCalls <= stable.wrapCalls || final.projectionMemoMisses !== 2 || final.styledCacheMisses !== 2)
+		throw new Error("sidebar mutation did not reproject once");
+	return {
+		name: "irc-sidebar-near-cap-cache",
+		hard: {
+			ledgerEpochAdvances: ledgerCounters.epochAdvances,
+			unchangedProjectionMisses: stable.projectionMemoMisses,
+			unchangedProjectionHits: stable.projectionMemoHits,
+			unchangedStyledMisses: stable.styledCacheMisses,
+			unchangedStyledHits: stable.styledCacheHits,
+			unchangedWrapCalls: stable.wrapCalls,
+			mutationProjectionMisses: final.projectionMemoMisses,
+			mutationStyledMisses: final.styledCacheMisses,
+			mutationWrapCalls: final.wrapCalls,
+		},
+		advisory: {},
+	};
+}
+
+export async function runStickyViewportPr1Benchmark(): Promise<StickyViewportPr1Benchmark> {
+	const cpu = process.cpuUsage();
+	const started = performance.now();
+	const wasEnabled = renderMetrics.enabled;
+	renderMetrics.enable();
+	try {
+		assertStickySuffixMatrix();
+		const workloads: WorkloadResult[] = [];
+		for (const workload of stickySuffixMatrix)
+			workloads.push(await stickySuffixWorkload(workload.transcriptRows, workload.height));
+		workloads.push(await equalOutputSourceWorkload(), sidebarCacheWorkload());
+		const usage = process.cpuUsage(cpu);
+		return {
+			schemaVersion: SCHEMA_VERSION,
+			workloads,
+			advisory: {
+				timingAndMemoryOnly: true,
+				wallMs: performance.now() - started,
+				cpuUserMicros: usage.user,
+				cpuSystemMicros: usage.system,
+				rssBytes: process.memoryUsage().rss,
+			},
+		};
+	} finally {
+		renderMetrics.reset();
+		__ircSidebarPerfCounters.disable();
+		__ircLedgerPerfCounters.disable();
+		if (!wasEnabled) renderMetrics.disable();
+	}
+}
+
+function outputPath(args: readonly string[]): string | undefined {
+	const index = args.indexOf("--out");
+	if (index < 0 || !args[index + 1]) return undefined;
+	return args[index + 1];
+}
+
+if (import.meta.main) {
+	const benchmark = await runStickyViewportPr1Benchmark();
+	const output = `${JSON.stringify(benchmark, null, 2)}\n`;
+	const destination = outputPath(process.argv.slice(2));
+	if (destination) {
+		await fs.mkdir(path.dirname(destination), { recursive: true });
+		await Bun.write(destination, output);
+	} else process.stdout.write(output);
+}