@sayknow-cli/coding-agent 0.4.7 → 0.5.0

package/src/capability/index.ts

@@ -41,6 +41,8 @@ const disabledProviders = new Set<string>();
 
 /** Settings manager for persistence (if set) */
 let settings: Settings | null = null;
+/** Session-local settings keyed by normalized working directory. */
+const settingsByCwd = new Map<string, Settings>();
 
 // =============================================================================
 // Registration API
@@ -208,8 +210,9 @@ async function loadImpl<T>(
  * Filter providers based on options and disabled state.
  */
 function filterProviders<T>(capability: Capability<T>, options: LoadOptions): Provider<T>[] {
-	let providers = (capability.providers as Provider<T>[]).filter(p => !disabledProviders.has(p.id));
-
+	const activeSettings = options.settings ?? settingsByCwd.get(path.normalize(options.cwd ?? getProjectDir()));
+	const activeDisabledProviders = new Set(activeSettings?.get("disabledProviders") ?? disabledProviders);
+	let providers = (capability.providers as Provider<T>[]).filter(p => !activeDisabledProviders.has(p.id));
 	if (options.providers) {
 		const allowed = new Set(options.providers);
 		providers = providers.filter(p => allowed.has(p.id));
@@ -249,63 +252,76 @@ export async function loadCapability<T>(capabilityId: string, options: LoadOptio
  * Call this once on startup to enable persistent provider state.
  */
 export function initializeWithSettings(activeSettings: Settings): void {
+	settingsByCwd.set(path.normalize(activeSettings.getCwd()), activeSettings);
 	settings = activeSettings;
-	// Load disabled providers from settings
-	const disabled = settings.get("disabledProviders");
+	const disabled = activeSettings.get("disabledProviders");
 	disabledProviders.clear();
-	for (const id of disabled) {
-		disabledProviders.add(id);
-	}
+	for (const id of disabled) disabledProviders.add(id);
 }
 
+function assertDisabledProvidersWritable(activeSettings: Settings): void {
+	if (!activeSettings.canWriteDurableConfig()) {
+		throw new Error(
+			"Cannot change settings while config.yml has invalid YAML syntax. Repair config.yml and reload settings.",
+		);
+	}
+}
 /**
  * Persist current disabled providers to settings.
  */
-function persistDisabledProviders(): void {
-	if (settings) {
-		settings.set("disabledProviders", Array.from(disabledProviders));
-	}
+function persistDisabledProviders(activeSettings: Settings, providers: ReadonlySet<string>): void {
+	assertDisabledProvidersWritable(activeSettings);
+	activeSettings.set("disabledProviders", Array.from(providers));
 }
 
-/**
- * Disable a provider globally (across all capabilities).
- */
-export function disableProvider(providerId: string): void {
-	disabledProviders.add(providerId);
-	persistDisabledProviders();
+/** Disable a provider for the supplied session settings. */
+export function disableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.add(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Enable a previously disabled provider.
- */
-export function enableProvider(providerId: string): void {
-	disabledProviders.delete(providerId);
-	persistDisabledProviders();
+/** Enable a provider for the supplied session settings. */
+export function enableProvider(
+	providerId: string,
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	const providers = new Set(activeSettings.get("disabledProviders"));
+	providers.delete(providerId);
+	persistDisabledProviders(activeSettings, providers);
 }
 
-/**
- * Check if a provider is enabled.
- */
-export function isProviderEnabled(providerId: string): boolean {
-	return !disabledProviders.has(providerId);
+/** Check whether a provider is enabled by the supplied session settings. */
+export function isProviderEnabled(
+	providerId: string,
+	activeSettings: Settings | undefined = settings ?? undefined,
+): boolean {
+	return !new Set(activeSettings?.get("disabledProviders") ?? disabledProviders).has(providerId);
 }
 
-/**
- * Get list of all disabled provider IDs.
- */
-export function getDisabledProviders(): string[] {
-	return Array.from(disabledProviders);
+/** Get disabled providers from the supplied session settings. */
+export function getDisabledProviders(activeSettings: Settings | undefined = settings ?? undefined): string[] {
+	return [...(activeSettings?.get("disabledProviders") ?? disabledProviders)];
 }
 
-/**
- * Set disabled providers from a list (replaces current set).
- */
-export function setDisabledProviders(providerIds: string[]): void {
-	disabledProviders.clear();
-	for (const id of providerIds) {
-		disabledProviders.add(id);
-	}
-	persistDisabledProviders();
+/** Replace disabled providers for the supplied session settings. */
+export function setDisabledProviders(
+	providerIds: string[],
+	activeSettings: Settings = settings ??
+		(() => {
+			throw new Error("Capability settings unavailable");
+		})(),
+): void {
+	persistDisabledProviders(activeSettings, new Set(providerIds));
 }
 
 // =============================================================================

package/src/capability/types.ts

@@ -6,6 +6,7 @@
  * and get back a unified array of MCP servers.
  */
 
+import type { Settings } from "../config/settings";
 /**
  * Context passed to every provider loader.
  */
@@ -72,6 +73,8 @@ export interface LoadOptions {
 	includeDisabled?: boolean;
 	/** Explicit disabled extension IDs to apply instead of settings. */
 	disabledExtensions?: string[];
+	/** Session settings whose provider policy applies to this load. */
+	settings?: Settings;
 }
 
 /**

package/src/cli/args.ts

@@ -1,11 +1,10 @@
 /**
- * CLI argument parsing and help display
+ * CLI argument parsing
  */
 import * as path from "node:path";
 import { type Effort, THINKING_EFFORTS } from "@sayknow-cli/ai";
-import { APP_NAME, CONFIG_DIR_NAME, logger } from "@sayknow-cli/utils";
+import { logger } from "@sayknow-cli/utils";
 import { CliParseError } from "@sayknow-cli/utils/cli";
-import chalk from "chalk";
 import { parseEffort } from "../thinking";
 import { BUILTIN_TOOLS } from "../tools";
 
@@ -206,17 +205,23 @@ export function parseArgs(args: string[]): Args {
 				}
 			}
 			result.tools = validTools;
-		} else if (arg === "--thinking" && i + 1 < args.length) {
+		} else if (arg === "--thinking") {
+			// Match --credential / --mcp-config: a missing value or a following flag is
+			// a usage error, not a silent no-op / accidental consumption of `-p`.
+			const next = args[i + 1];
+			if (!next || next.startsWith("-")) {
+				throw new CliParseError(`--thinking requires <level> (${THINKING_EFFORTS.join(", ")})`);
+			}
 			const rawThinking = args[++i];
 			const thinking = parseEffort(rawThinking);
-			if (thinking !== undefined) {
-				result.thinking = thinking;
-			} else {
-				logger.warn("Invalid thinking level passed to --thinking", {
-					level: rawThinking,
-					validThinkingLevels: THINKING_EFFORTS,
-				});
+			if (thinking === undefined) {
+				// Fail closed: a silent ignore left users believing `ultra` (or any typo)
+				// was applied. Help / Flags.options advertise the real Effort enum.
+				throw new CliParseError(
+					`Invalid --thinking level "${rawThinking}". Expected one of: ${THINKING_EFFORTS.join(", ")}`,
+				);
 			}
+			result.thinking = thinking;
 		} else if (arg === "--print" || arg === "-p") {
 			result.print = true;
 		} else if (arg === "--export" && i + 1 < args.length) {
@@ -253,92 +258,3 @@ export function parseArgs(args: string[]): Args {
 
 	return result;
 }
-
-export function getExtraHelpText(): string {
-	return `${chalk.bold("Environment Variables:")}
-  ${chalk.dim("# Core Providers")}
-  ANTHROPIC_API_KEY          - Anthropic Claude models
-  ANTHROPIC_OAUTH_TOKEN      - Anthropic OAuth (takes precedence over API key)
-  CLAUDE_CODE_USE_FOUNDRY    - Enable Anthropic Foundry mode (uses Foundry endpoint + mTLS)
-  FOUNDRY_BASE_URL           - Anthropic Foundry base URL (e.g., https://<foundry-host>)
-  ANTHROPIC_FOUNDRY_API_KEY  - Anthropic token used as Authorization: Bearer <token> in Foundry mode
-  ANTHROPIC_CUSTOM_HEADERS   - Extra Foundry headers (e.g., "user-id: USERNAME")
-  CLAUDE_CODE_CLIENT_CERT    - Client certificate (PEM path or inline PEM) for mTLS
-  CLAUDE_CODE_CLIENT_KEY     - Client private key (PEM path or inline PEM) for mTLS
-  NODE_EXTRA_CA_CERTS        - CA bundle path (or inline PEM) for server certificate validation
-  OPENAI_API_KEY             - OpenAI GPT models
-  GEMINI_API_KEY             - Google Gemini models
-  GITHUB_TOKEN               - GitHub Copilot (or GH_TOKEN, COPILOT_GITHUB_TOKEN)
-
-  ${chalk.dim("# Additional LLM Providers")}
-  AZURE_OPENAI_API_KEY       - Azure OpenAI models
-  GROQ_API_KEY               - Groq models
-  CEREBRAS_API_KEY           - Cerebras models
-  XAI_API_KEY                - xAI Grok models
-  OPENROUTER_API_KEY         - OpenRouter aggregated models
-  KILO_API_KEY               - Kilo Gateway models
-  MISTRAL_API_KEY            - Mistral models
-  ZAI_API_KEY                - z.ai models (ZhipuAI/GLM)
-  MINIMAX_API_KEY            - MiniMax models
-  OPENCODE_API_KEY           - OpenCode Zen/OpenCode Go models
-  CURSOR_ACCESS_TOKEN        - Cursor AI models
-  AI_GATEWAY_API_KEY         - Vercel AI Gateway
-
-  ${chalk.dim("# Cloud Providers")}
-  AWS_PROFILE                - AWS Bedrock (or AWS_ACCESS_KEY_ID + AWS_SECRET_ACCESS_KEY)
-  GOOGLE_CLOUD_PROJECT       - Google Vertex AI (requires GOOGLE_CLOUD_LOCATION)
-  GOOGLE_APPLICATION_CREDENTIALS - Service account for Vertex AI
-
-  ${chalk.dim("# Search & Tools")}
-  EXA_API_KEY                - Exa web search
-  BRAVE_API_KEY              - Brave web search
-  PERPLEXITY_API_KEY         - Perplexity web search (API)
-  PERPLEXITY_COOKIES         - Perplexity web search (session cookie)
-  TAVILY_API_KEY             - Tavily web search
-  ANTHROPIC_SEARCH_API_KEY   - Anthropic search provider
-
-  ${chalk.dim("# Configuration")}
-  SKC_CODING_AGENT_DIR       - Session storage directory (default: ~/${CONFIG_DIR_NAME}/agent)
-  SKC_PACKAGE_DIR            - Override package directory (for Nix/Guix store paths)
-  SKC_SMOL_MODEL              - Override smol/fast model (see --smol)
-  SKC_SLOW_MODEL              - Override slow/reasoning model (see --slow)
-  SKC_PLAN_MODEL              - Override planning model (see --plan)
-  SKC_NO_PTY                  - Disable PTY-based interactive bash execution
-  --tmux                       - Launch interactive startup inside a fresh tmux session
-  skc session                  - List, inspect, create, remove, or attach tagged SKC-managed tmux sessions
-  SKC_LAUNCH_POLICY           - Launch policy for --tmux startup: tmux or direct
-  SKC_TMUX_SESSION            - Explicit tmux session name override for --tmux startup
-  SKC_TMUX_PROFILE            - Apply SKC tmux scroll/mouse/clipboard profile to --tmux sessions (set 0/off to skip)
-  SKC_MOUSE                   - Mouse-wheel scroll in --tmux sessions (set 0/off to let the host terminal scroll)
-
-  For complete environment variable reference, see:
-  ${chalk.dim("docs/environment-variables.md")}
-${chalk.bold("Available Tools (default-enabled unless noted):")}
-  read          - Read file contents
-  bash          - Execute bash commands
-  edit          - Edit files with find/replace
-  write         - Write files (creates/overwrites)
-  grep          - Search file contents
-  find          - Find files by glob pattern
-  lsp           - Language server protocol (code intelligence)
-  python        - Execute Python code (requires: ${APP_NAME} setup python)
-  notebook      - Edit Jupyter notebooks
-  browser       - Browser automation (Puppeteer)
-  task          - Launch sub-agents for parallel tasks
-  todo_write    - Manage todo/task lists
-  web_search    - Search the web
-  ask           - Ask user questions (interactive mode only)
-
-${chalk.bold("Useful Commands:")}
-  ${APP_NAME} --list-models        - List configured provider models
-  ${APP_NAME} --help               - Show this help`;
-}
-
-export function printHelp(): void {
-	process.stdout.write(
-		`${chalk.bold(APP_NAME)} - red-octopus AI coding assistant\n\n` +
-			`Run ${APP_NAME} --help for full command and option details.\n` +
-			`Run ${APP_NAME} <command> --help for command-specific help.\n\n` +
-			`${getExtraHelpText()}\n`,
-	);
-}

package/src/cli/fast-help.ts

@@ -84,7 +84,7 @@ Environment Variables:
   SKC_LAUNCH_POLICY           - Launch policy for --tmux startup: tmux or direct
   SKC_TMUX_SESSION            - Explicit tmux session name override for --tmux startup
   SKC_TMUX_PROFILE            - Apply SKC tmux scroll/mouse/clipboard profile to --tmux sessions (set 0/off to skip)
-  SKC_MOUSE                   - Mouse-wheel scroll in --tmux sessions (set 0/off to let the host terminal scroll)
+  SKC_MOUSE                   - Apply tmux copy-mode mouse capture in --tmux sessions (set 0/off to skip)
 
   For complete environment variable reference, see:
   docs/environment-variables.md

package/src/cli/mcp-cli.ts

@@ -6,6 +6,7 @@
  */
 import { getMCPConfigPath, getProjectDir } from "@sayknow-cli/utils";
 import { getMCPServer, readMCPConfigFile, removeMCPServer, upsertMCPServer } from "../runtime-mcp/config-writer";
+import { redactMCPEndpoint } from "../runtime-mcp/redaction";
 import type { MCPConfigFile, MCPServerConfig } from "../runtime-mcp/types";
 
 export type MCPAction = "add" | "list" | "remove";
@@ -141,24 +142,6 @@ function redactRecord(
 	);
 }
 
-function redactUrl(value: string | undefined): string | undefined {
-	if (!value) return value;
-	try {
-		const url = new URL(value);
-		if (url.username) url.username = REDACTED;
-		if (url.password) url.password = REDACTED;
-		if (url.search) {
-			for (const key of Array.from(url.searchParams.keys())) {
-				url.searchParams.set(key, REDACTED);
-			}
-		}
-		url.hash = "";
-		return url.toString();
-	} catch {
-		return SENSITIVE_KEY_PATTERN.test(value) ? REDACTED : value;
-	}
-}
-
 function redactArgs(args: string[] | undefined): string[] | undefined {
 	if (!args) return undefined;
 	const redacted: string[] = [];
@@ -196,7 +179,7 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 		if (headers) redacted.headers = headers;
 	}
 	if ("url" in redacted) {
-		const url = redactUrl(redacted.url);
+		const url = redactMCPEndpoint(redacted.url);
 		if (url) redacted.url = url;
 	}
 	if ("args" in redacted) {
@@ -207,7 +190,7 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 		redacted.auth = {
 			type: redacted.auth.type,
 			credentialId: redacted.auth.credentialId ? REDACTED : undefined,
-			tokenUrl: redactUrl(redacted.auth.tokenUrl),
+			tokenUrl: redactMCPEndpoint(redacted.auth.tokenUrl),
 			clientId: redacted.auth.clientId ? REDACTED : undefined,
 			clientSecret: redacted.auth.clientSecret ? REDACTED : undefined,
 		};
@@ -216,7 +199,7 @@ export function redactMCPServerConfig(config: MCPServerConfig): MCPServerConfig
 		redacted.oauth = {
 			clientId: redacted.oauth.clientId ? REDACTED : undefined,
 			clientSecret: redacted.oauth.clientSecret ? REDACTED : undefined,
-			redirectUri: redactUrl(redacted.oauth.redirectUri),
+			redirectUri: redactMCPEndpoint(redacted.oauth.redirectUri),
 			callbackPort: redacted.oauth.callbackPort,
 			callbackPath: redacted.oauth.callbackPath,
 		};

package/src/cli/notify-cli.ts

@@ -7,7 +7,6 @@ import { createInterface } from "node:readline/promises";
 import { APP_NAME } from "@sayknow-cli/utils/dirs";
 import chalk from "chalk";
 import { Settings, type SettingsAtomicPatch } from "../config/settings";
-import { isProcessIncarnation, processIncarnation } from "../sdk/broker/process-incarnation";
 import { type EnsureChatDaemonResult, ensureDiscordDaemon, ensureSlackDaemon } from "../sdk/bus/chat-daemon-control";
 import { getNotificationConfig, maskToken, tokenFingerprint } from "../sdk/bus/config";
 import {
@@ -33,7 +32,7 @@ import {
 import {
 	type EnsureTelegramDaemonDetailedResult,
 	ensureTelegramDaemonRunningDetailed,
-	readDaemonState,
+	resolveTelegramSetupPreflight,
 } from "../sdk/bus/telegram-daemon";
 import { runDaemonInternal } from "../sdk/bus/telegram-daemon-cli";
 import {
@@ -414,6 +413,7 @@ async function runTelegramSetup(cmd: NotifyCommandArgs, deps: NotifyCommandDeps)
 								settings,
 								cwd: process.cwd(),
 								sessionId: `notify-cli-${process.pid}`,
+								registerRoot: false,
 							}),
 				persistInactive: async marker => await persistTelegramActivationMarker(settings, marker),
 				clearInactive: async marker => await clearTelegramActivationMarker(settings, marker),
@@ -458,42 +458,10 @@ function proposedIdentityFromSetupPreflight(
 
 async function resolveSetupPreflight(settings: Settings, deps: NotifyCommandDeps): Promise<TelegramSetupPreflight> {
 	if (deps.setupPreflight) return deps.setupPreflight;
-	const cfg = getNotificationConfig(settings);
-	try {
-		const state = await readDaemonState(settings);
-		if (!state) return { storedChatId: cfg.chatId };
-		const validPid = Number.isSafeInteger(state.pid) && state.pid > 0;
-		if (!validPid || !(deps.setupPidAlive ?? daemonPidAlive)(state.pid)) return { storedChatId: cfg.chatId };
-		const persistedIncarnation = state.incarnation;
-		const currentIncarnation = (deps.setupPidIncarnation ?? processIncarnation)(state.pid);
-		if (
-			!isProcessIncarnation(persistedIncarnation) ||
-			!isProcessIncarnation(currentIncarnation) ||
-			persistedIncarnation !== currentIncarnation
-		)
-			return { storedChatId: cfg.chatId };
-		return {
-			storedChatId: cfg.chatId,
-			daemon: {
-				live: true,
-				tokenFingerprint: typeof state.tokenFingerprint === "string" ? state.tokenFingerprint : undefined,
-				chatId: typeof state.chatId === "string" ? state.chatId : undefined,
-			},
-		};
-	} catch {
-		// A state read failure is not proof of a live daemon; proceed normally. The
-		// daemon's own 409 handling remains the backstop against poller contention.
-		return { storedChatId: cfg.chatId };
-	}
-}
-
-function daemonPidAlive(pid: number): boolean {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch (error) {
-		return (error as NodeJS.ErrnoException).code === "EPERM";
-	}
+	return await resolveTelegramSetupPreflight(settings, {
+		pidAlive: deps.setupPidAlive,
+		pidIncarnation: deps.setupPidIncarnation,
+	});
 }
 
 type TokenPromptInput = NodeJS.ReadStream & {

package/src/cli/read-cli.ts

@@ -15,6 +15,7 @@ import { renderError } from "../tools/tool-errors";
 
 export interface ReadCommandArgs {
 	path: string;
+	truncation?: "head" | "last" | "both";
 }
 
 export async function runReadCommand(cmd: ReadCommandArgs): Promise<void> {
@@ -37,7 +38,7 @@ export async function runReadCommand(cmd: ReadCommandArgs): Promise<void> {
 	const tool = wrapToolWithMetaNotice(new ReadTool(session));
 
 	try {
-		const result = await tool.execute("skc-read", { path: cmd.path });
+		const result = await tool.execute("skc-read", { path: cmd.path, truncation: cmd.truncation });
 
 		for (const block of result.content) {
 			if (block.type === "text") {

package/src/cli/setup-cli.ts

@@ -18,7 +18,11 @@ import {
 } from "../hooks/codex-native-hooks-config";
 import { theme } from "../modes/theme/theme";
 import { formatCredentialAutoImportResult, runExternalCredentialAutoImport } from "../setup/credential-auto-import";
-import { filterAutoImportOAuthCredentials, formatDiscoverySummary } from "../setup/credential-import";
+import {
+	formatDiscoverySummary,
+	getAutoImportOAuthCredentialSkips,
+	isAutoImportOAuthCredential,
+} from "../setup/credential-import";
 import {
 	formatHermesSetupResult,
 	type HermesSetupFlags,
@@ -596,8 +600,10 @@ export async function handleCredentialsSetup(
 			trigger: "setup-cli",
 		});
 		const result = preview.discovery ?? { importable: [], skipped: [], environment: [] };
-		const candidates = filterAutoImportOAuthCredentials(result.importable);
-		const filteredResult = { ...result, importable: candidates };
+		const now = Date.now();
+		const candidates = result.importable.filter(credential => isAutoImportOAuthCredential(credential, now));
+		const autoImportSkips = getAutoImportOAuthCredentialSkips(result.importable, now);
+		const filteredResult = { ...result, importable: candidates, skipped: [...result.skipped, ...autoImportSkips] };
 		const redactedPlan = {
 			importable: candidates.map(c => ({
 				provider: c.provider,
@@ -607,7 +613,7 @@ export async function handleCredentialsSetup(
 				expiresAt: c.expiresAt,
 				redactedToken: c.redactedToken,
 			})),
-			skipped: result.skipped,
+			skipped: filteredResult.skipped,
 			environment: result.environment,
 			keychainChecked: flags.keychain === true,
 		};