@sayknow-cli/coding-agent 0.4.7 → 0.5.1

package/src/utils/prompt-suggestion.ts

@@ -0,0 +1,265 @@
+/**
+ * Predict the user's likely next prompt after an agent turn using a smol,
+ * fast model. Native SKC port of the ghost-text prompt-suggestion behavior
+ * from Claude Code: the prediction renders as dim ghost text in the empty
+ * composer and Tab accepts it.
+ */
+import type { AgentMessage } from "@sayknow-cli/agent-core";
+import { type Api, type AssistantMessage, completeSimple, type Model } from "@sayknow-cli/ai";
+import { logger, prompt } from "@sayknow-cli/utils";
+import type { ModelRegistry } from "../config/model-registry";
+import { resolveRoleSelection } from "../config/model-resolver";
+import type { Settings } from "../config/settings";
+import suggestionSystemPrompt from "../prompts/system/prompt-suggestion-system.md" with { type: "text" };
+
+const SUGGESTION_SYSTEM_PROMPT = prompt.render(suggestionSystemPrompt);
+
+export const PROMPT_SUGGESTION_MAX_WORDS = 12;
+export const PROMPT_SUGGESTION_MAX_CHARS = 100;
+
+const SUGGESTION_MAX_TOKENS = 64;
+const REASONING_SAFE_MAX_TOKENS = 1024;
+const MAX_CONTEXT_MESSAGES = 12;
+const MAX_MESSAGE_CHARS = 1500;
+const MAX_CONTEXT_CHARS = 8000;
+
+/** Single words a user plausibly types on their own; anything else needs >= 2 words. */
+const SINGLE_WORD_ALLOWLIST = new Set([
+	"yes",
+	"yeah",
+	"yep",
+	"yea",
+	"yup",
+	"sure",
+	"ok",
+	"okay",
+	"push",
+	"commit",
+	"deploy",
+	"stop",
+	"continue",
+	"check",
+	"exit",
+	"quit",
+	"no",
+]);
+
+/** Model responses that are meta-statements about staying silent, not suggestions. */
+const META_TEXT_PATTERN = /\bsilence is\b|\bstay(s|ing)? silent\b/;
+
+/**
+ * Strip wrapper tags and label prefixes a model sometimes adds despite being
+ * told to reply with only the suggestion.
+ */
+export function sanitizePromptSuggestion(raw: string): string {
+	return raw
+		.trim()
+		.replace(/^<(suggestion|response|output|answer|result)>([\s\S]*)<\/\1>$/i, (match, tag: string, inner: string) =>
+			// Keep the original when the inner text itself contains the closing
+			// tag (nested/ambiguous markup) instead of producing a mangled strip.
+			inner.includes(`</${tag.toLowerCase()}>`) || inner.includes(`</${tag.toUpperCase()}>`) ? match : inner,
+		)
+		.replace(
+			/^\s*(suggested\s+(response|reply|input|prompt)|suggestion|response|reply|answer|output|result)\s*:\s*/i,
+			"",
+		)
+		.trim();
+}
+
+/**
+ * Heuristic gate rejecting model output that would make a bad ghost-text
+ * suggestion. Returns the rejection reason, or null when the text is usable.
+ */
+export function suppressPromptSuggestionReason(text: string): string | null {
+	if (!text) return "empty";
+	const lower = text.toLowerCase();
+	const wordCount = text.trim().split(/\s+/).length;
+
+	if (lower === "done") return "done";
+	if (
+		lower === "nothing found" ||
+		lower === "nothing found." ||
+		lower.startsWith("nothing to suggest") ||
+		lower.startsWith("no suggestion") ||
+		META_TEXT_PATTERN.test(lower) ||
+		/^\W*silence\W*$/.test(lower)
+	) {
+		return "meta_text";
+	}
+	if (/^\(.*\)$|^\[.*\]$/.test(text)) return "meta_wrapped";
+	if (
+		lower.startsWith("api error:") ||
+		lower.startsWith("prompt is too long") ||
+		lower.startsWith("request timed out") ||
+		lower.startsWith("invalid api key")
+	) {
+		return "error_message";
+	}
+	if (/^\w+:\s/.test(text)) return "prefixed_label";
+	if (wordCount < 2 && !text.startsWith("/") && !SINGLE_WORD_ALLOWLIST.has(lower)) return "too_few_words";
+	if (wordCount > PROMPT_SUGGESTION_MAX_WORDS) return "too_many_words";
+	if (text.length >= PROMPT_SUGGESTION_MAX_CHARS) return "too_long";
+	if (/[.!?]\s+[A-Z]/.test(text)) return "multiple_sentences";
+	if (/[\n*]|\*\*/.test(text)) return "has_formatting";
+	if (
+		/thanks|thank you|looks good|sounds good|that works|that worked|that's all|nice|great|perfect|makes sense|awesome|excellent/.test(
+			lower,
+		)
+	) {
+		return "evaluative";
+	}
+	if (
+		/^(let me|i'll|i've|i'm|i can|i would|i think|i notice|here's|here is|here are|that's|this is|this will|you can|you should|you could|sure,|of course|certainly)/i.test(
+			text,
+		)
+	) {
+		return "claude_voice";
+	}
+	return null;
+}
+
+function extractTranscriptEntry(message: AgentMessage): { role: "User" | "Assistant"; text: string } | null {
+	if (message.role === "user") {
+		const content = message.content;
+		const text =
+			typeof content === "string"
+				? content
+				: content
+						.filter(block => block.type === "text")
+						.map(block => block.text)
+						.join("\n");
+		const trimmed = text.trim();
+		return trimmed ? { role: "User", text: trimmed } : null;
+	}
+	if (message.role === "assistant") {
+		const text = (message as AssistantMessage).content
+			.filter(block => block.type === "text")
+			.map(block => block.text)
+			.join("\n")
+			.trim();
+		return text ? { role: "Assistant", text } : null;
+	}
+	return null;
+}
+
+/**
+ * Build a compact recent-conversation transcript for the prediction request.
+ * Returns null when there is no user message to predict from.
+ */
+export function buildPromptSuggestionContext(messages: AgentMessage[]): string | null {
+	const entries: { role: "User" | "Assistant"; text: string }[] = [];
+	let totalChars = 0;
+	for (let index = messages.length - 1; index >= 0 && entries.length < MAX_CONTEXT_MESSAGES; index--) {
+		const message = messages[index];
+		if (!message) continue;
+		const entry = extractTranscriptEntry(message);
+		if (!entry) continue;
+		const text = entry.text.length > MAX_MESSAGE_CHARS ? `${entry.text.slice(0, MAX_MESSAGE_CHARS)}…` : entry.text;
+		if (totalChars + text.length > MAX_CONTEXT_CHARS && entries.length > 0) break;
+		entries.push({ role: entry.role, text });
+		totalChars += text.length;
+	}
+	if (!entries.some(entry => entry.role === "User")) return null;
+	entries.reverse();
+	const transcript = entries.map(entry => `${entry.role}: ${entry.text}`).join("\n\n");
+	return `<conversation>\n${transcript}\n</conversation>\n\nPredict the user's next message.`;
+}
+
+function getSuggestionModel(
+	registry: ModelRegistry,
+	settings: Settings,
+	currentModel?: Model<Api>,
+): Model<Api> | undefined {
+	const availableModels = registry.getAvailable();
+	if (availableModels.length === 0) return undefined;
+	const model = resolveRoleSelection(["default"], settings, availableModels, registry)?.model;
+	if (model) return model;
+	return currentModel;
+}
+
+function extractSuggestionText(contentBlocks: AssistantMessage["content"]): string {
+	let text = "";
+	for (const content of contentBlocks) {
+		if (content.type === "text") {
+			text += content.text;
+		}
+	}
+	return text;
+}
+
+/**
+ * Generate a predicted next user prompt from the recent conversation.
+ * Returns null when no usable suggestion is produced (silence is the
+ * expected steady state).
+ */
+export async function generatePromptSuggestion(
+	messages: AgentMessage[],
+	registry: ModelRegistry,
+	settings: Settings,
+	sessionId?: string,
+	currentModel?: Model<Api>,
+	metadataResolver?: (provider: string) => Record<string, unknown> | undefined,
+): Promise<string | null> {
+	const context = buildPromptSuggestionContext(messages);
+	if (!context) return null;
+
+	const model = getSuggestionModel(registry, settings, currentModel);
+	if (!model) {
+		logger.debug("prompt-suggestion: no model available");
+		return null;
+	}
+
+	const apiKey = await registry.getApiKey(model, sessionId);
+	if (!apiKey) {
+		logger.debug("prompt-suggestion: no API key", { provider: model.provider, id: model.id });
+		return null;
+	}
+	// Resolve metadata after getApiKey so the session-sticky credential for
+	// this request is already recorded (same contract as title-generator).
+	const metadata = metadataResolver?.(model.provider);
+
+	// A suggestion is a 2-12 word task, but some reasoning backends ignore
+	// disableReasoning; reserve output room for the answer after any
+	// unavoidable thinking tokens.
+	const maxTokens = model.reasoning
+		? Math.max(SUGGESTION_MAX_TOKENS, REASONING_SAFE_MAX_TOKENS)
+		: SUGGESTION_MAX_TOKENS;
+
+	try {
+		const response = await completeSimple(
+			model,
+			{
+				systemPrompt: [SUGGESTION_SYSTEM_PROMPT],
+				messages: [{ role: "user", content: context, timestamp: Date.now() }],
+			},
+			{
+				apiKey,
+				maxTokens,
+				disableReasoning: true,
+				metadata,
+			},
+		);
+
+		if (response.stopReason === "error") {
+			logger.debug("prompt-suggestion: response error", {
+				model: `${model.provider}/${model.id}`,
+				errorMessage: response.errorMessage,
+			});
+			return null;
+		}
+
+		const suggestion = sanitizePromptSuggestion(extractSuggestionText(response.content));
+		const suppressReason = suppressPromptSuggestionReason(suggestion);
+		if (suppressReason) {
+			logger.debug("prompt-suggestion: suppressed", { reason: suppressReason });
+			return null;
+		}
+		return suggestion;
+	} catch (err) {
+		logger.debug("prompt-suggestion: error", {
+			model: `${model.provider}/${model.id}`,
+			error: err instanceof Error ? err.message : String(err),
+		});
+		return null;
+	}
+}

package/src/utils/shell-snapshot.ts

@@ -5,13 +5,15 @@
  * .bashrc/.zshrc, which can be sourced before each command to provide a familiar
  * shell experience.
  */
-import * as fs from "node:fs";
+import * as fs from "node:fs/promises";
 import * as os from "node:os";
 import * as path from "node:path";
 import { postmortem } from "@sayknow-cli/utils";
 
-const cachedSnapshotPaths = new Map<string, string>();
 const SNAPSHOT_TIMEOUT_MS = 2_000;
+const SNAPSHOT_ROOT_PREFIX = "skc-shell-snapshots-";
+const PRIVATE_DIRECTORY_MODE = 0o700;
+const PRIVATE_FILE_MODE = 0o600;
 
 function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<string, string | undefined> {
 	const sanitized = { ...env };
@@ -23,8 +25,7 @@ function sanitizeSnapshotEnv(env: Record<string, string | undefined>): Record<st
 /**
  * Get the user's shell config file path.
  */
-function getShellConfigFile(shell: string): string {
-	const home = os.homedir();
+function getShellConfigFile(shell: string, home: string): string {
 	if (shell.includes("zsh")) return path.join(home, ".zshrc");
 	if (shell.includes("bash")) return path.join(home, ".bashrc");
 	return path.join(home, ".profile");
@@ -35,8 +36,7 @@ function getShellConfigFile(shell: string): string {
  * This script sources the user's rc file and extracts functions, aliases, and options.
  * Matches Anthropic Code's snapshot generation logic.
  */
-function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: string): string {
-	const hasRcFile = fs.existsSync(rcFile);
+function generateSnapshotScript(shell: string, snapshotPath: string, rcFile: string, hasRcFile: boolean): string {
 	const isZsh = shell.includes("zsh");
 	const commonToolsRegex =
 		"^(ls|dir|vdir|cat|head|tail|less|more|grep|egrep|fgrep|rg|find|fd|locate|sed|awk|perl|cp|mv|rm|mkdir|rmdir|touch|chmod|chown|ln|pwd|readlink|stat|cut|sort|uniq|xargs|tee|tr|basename|dirname)$";
@@ -79,6 +79,7 @@ echo "shopt -s expand_aliases" >> "$SNAPSHOT_FILE"
 `;
 
 	return `
+umask 077
 SNAPSHOT_FILE='${escapedPath}'
 
 # Source user's rc file if it exists
@@ -114,74 +115,183 @@ fi
 `.trim();
 }
 
-/**
- * Create a shell snapshot, caching the result.
- * Returns the path to the snapshot file, or null if creation failed.
- */
-export async function getOrCreateSnapshot(
-	shell: string,
-	env: Record<string, string | undefined>,
-): Promise<string | null> {
-	const cacheKey = shell;
-	// Return cached snapshot if valid
-	const cached = cachedSnapshotPaths.get(cacheKey);
-	if (cached && fs.existsSync(cached)) {
-		return cached;
-	}
-	if (cached) {
-		cachedSnapshotPaths.delete(cacheKey);
-	}
+interface ShellSnapshotCacheOptions {
+	tempRoot: string;
+	home: string | (() => string);
+	platform: NodeJS.Platform;
+}
 
-	// Skip on Windows (no .bashrc in standard location)
-	if (process.platform === "win32") {
-		return null;
+function ownedByCurrentUser(uid: number): boolean {
+	return typeof process.getuid !== "function" || uid === process.getuid();
+}
+
+async function isTrustedSnapshot(snapshotPath: string): Promise<boolean> {
+	try {
+		const stat = await fs.lstat(snapshotPath);
+		return stat.isFile() && !stat.isSymbolicLink() && ownedByCurrentUser(stat.uid) && (stat.mode & 0o077) === 0;
+	} catch {
+		return false;
 	}
+}
 
-	const rcFile = getShellConfigFile(shell);
+function createShellSnapshotCache(options: ShellSnapshotCacheOptions) {
+	const cachedPaths = new Map<string, string>();
+	const inFlight = new Map<string, Promise<string | null>>();
+	let rootPath: string | null = null;
+	let rootInitialization: Promise<string> | null = null;
+	let cleanupAttempt: Promise<void> | null = null;
+	let cleaningUp = false;
+	let lifecycle = 0;
 
-	// Create snapshot directory
-	const snapshotDir = path.join(os.tmpdir(), "skc-shell-snapshots");
-	fs.mkdirSync(snapshotDir, { recursive: true });
+	async function initializeRoot(): Promise<string> {
+		const root = await fs.mkdtemp(path.join(options.tempRoot, SNAPSHOT_ROOT_PREFIX));
+		try {
+			await fs.chmod(root, PRIVATE_DIRECTORY_MODE);
+			const stat = await fs.lstat(root);
+			if (
+				!stat.isDirectory() ||
+				stat.isSymbolicLink() ||
+				!ownedByCurrentUser(stat.uid) ||
+				(stat.mode & 0o777) !== 0o700
+			) {
+				throw new Error("Shell snapshot root is not owner-private");
+			}
+			return root;
+		} catch (error) {
+			await fs.rm(root, { recursive: true, force: true }).catch(() => {});
+			throw error;
+		}
+	}
+
+	async function getRoot(): Promise<string> {
+		if (rootPath) return rootPath;
+		if (rootInitialization) return await rootInitialization;
+		const attempt = initializeRoot();
+		rootInitialization = attempt;
+		try {
+			rootPath = await attempt;
+			return rootPath;
+		} catch (error) {
+			if (rootInitialization === attempt) rootInitialization = null;
+			throw error;
+		}
+	}
 
-	// Generate unique snapshot path
-	const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
-	const snapshotPath = path.join(snapshotDir, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
+	async function createSnapshot(shell: string, env: Record<string, string | undefined>): Promise<string | null> {
+		const root = await getRoot();
+		const shellName = shell.includes("zsh") ? "zsh" : shell.includes("bash") ? "bash" : "sh";
+		const snapshotPath = path.join(root, `snapshot-${shellName}-${crypto.randomUUID()}.sh`);
+		let keep = false;
+		try {
+			const handle = await fs.open(snapshotPath, "wx", PRIVATE_FILE_MODE);
+			try {
+				await handle.chmod(PRIVATE_FILE_MODE);
+			} finally {
+				await handle.close();
+			}
 
-	// Generate and execute snapshot script
-	const script = generateSnapshotScript(shell, snapshotPath, rcFile);
+			const home = typeof options.home === "function" ? options.home() : options.home;
+			const rcFile = getShellConfigFile(shell, home);
+			const script = generateSnapshotScript(shell, snapshotPath, rcFile, await Bun.file(rcFile).exists());
+			const snapshotEnv = sanitizeSnapshotEnv(env);
+			const spawnEnv: Record<string, string> = {};
+			for (const [key, value] of Object.entries(snapshotEnv)) {
+				if (value !== undefined) spawnEnv[key] = value;
+			}
+			const child = Bun.spawn([shell, "-c", script], {
+				env: spawnEnv,
+				stdin: "ignore",
+				stdout: "ignore",
+				stderr: "ignore",
+				timeout: SNAPSHOT_TIMEOUT_MS,
+				killSignal: "SIGKILL",
+			});
 
-	try {
-		const snapshotEnv = sanitizeSnapshotEnv(env);
-		const spawnEnv: Record<string, string> = {};
-		for (const [key, value] of Object.entries(snapshotEnv)) {
-			if (value !== undefined) {
-				spawnEnv[key] = value;
+			await child.exited;
+			if (child.exitCode === 0 && (await isTrustedSnapshot(snapshotPath))) {
+				cachedPaths.set(shell, snapshotPath);
+				keep = true;
+				return snapshotPath;
 			}
+		} catch {
+			// Snapshot creation failed, proceed without it.
+		} finally {
+			if (!keep) await fs.unlink(snapshotPath).catch(() => {});
 		}
-		const child = Bun.spawn([shell, "-c", script], {
-			env: spawnEnv,
-			stdin: "ignore",
-			stdout: "ignore",
-			stderr: "ignore",
-			timeout: SNAPSHOT_TIMEOUT_MS,
-			killSignal: "SIGKILL",
-		});
-
-		await child.exited;
-		if (child.exitCode === 0 && fs.existsSync(snapshotPath)) {
-			cachedSnapshotPaths.set(cacheKey, snapshotPath);
-			return snapshotPath;
-		}
-	} catch {
-		// Snapshot creation failed, proceed without it
+		return null;
 	}
 
-	return null;
+	return {
+		async getOrCreateSnapshot(shell: string, env: Record<string, string | undefined>) {
+			if (options.platform === "win32" || cleaningUp) return null;
+			const currentLifecycle = lifecycle;
+			const cached = cachedPaths.get(shell);
+			if (cached && (await isTrustedSnapshot(cached))) {
+				return cleaningUp || lifecycle !== currentLifecycle ? null : cached;
+			}
+			if (cleaningUp || lifecycle !== currentLifecycle) return null;
+			if (cached) cachedPaths.delete(shell);
+			const pending = inFlight.get(shell);
+			if (pending) {
+				const snapshot = await pending;
+				return cleaningUp || lifecycle !== currentLifecycle ? null : snapshot;
+			}
+			const attempt = createSnapshot(shell, env);
+			inFlight.set(shell, attempt);
+			try {
+				const snapshot = await attempt;
+				return cleaningUp || lifecycle !== currentLifecycle ? null : snapshot;
+			} finally {
+				if (inFlight.get(shell) === attempt) inFlight.delete(shell);
+			}
+		},
+		async cleanup() {
+			if (cleanupAttempt) return await cleanupAttempt;
+			const attempt = (async () => {
+				cleaningUp = true;
+				lifecycle += 1;
+				try {
+					const pending: Promise<unknown>[] = [...inFlight.values()];
+					if (rootInitialization) pending.push(rootInitialization);
+					await Promise.allSettled(pending);
+					const root = rootPath ?? (await rootInitialization?.catch(() => null)) ?? null;
+					cachedPaths.clear();
+					inFlight.clear();
+					rootPath = null;
+					rootInitialization = null;
+					if (root) await fs.rm(root, { recursive: true, force: true });
+				} finally {
+					cleaningUp = false;
+				}
+			})();
+			cleanupAttempt = attempt;
+			try {
+				await attempt;
+			} finally {
+				if (cleanupAttempt === attempt) cleanupAttempt = null;
+			}
+		},
+	};
 }
 
-postmortem.register("shell-snapshot", () => {
-	for (const snapshotPath of cachedSnapshotPaths.values()) {
-		fs.unlinkSync(snapshotPath);
-	}
-	cachedSnapshotPaths.clear();
+/** @internal Test-only factory for isolated filesystem and platform assertions. */
+export const createShellSnapshotCacheForTesting = createShellSnapshotCache;
+
+const processSnapshotCache = createShellSnapshotCache({
+	tempRoot: os.tmpdir(),
+	home: () => os.homedir(),
+	platform: process.platform,
 });
+
+/**
+ * Create a shell snapshot, caching the result.
+ * Returns the path to the snapshot file, or null if creation failed.
+ */
+export async function getOrCreateSnapshot(
+	shell: string,
+	env: Record<string, string | undefined>,
+): Promise<string | null> {
+	return await processSnapshotCache.getOrCreateSnapshot(shell, env);
+}
+
+postmortem.register("shell-snapshot", () => processSnapshotCache.cleanup());

package/src/utils/sixel.ts

@@ -1,4 +1,4 @@
-import { $env, $flag } from "@sayknow-cli/utils";
+import { $pickenv, $pickflag } from "@sayknow-cli/utils";
 
 const SIXEL_START_REGEX = /\x1bP(?:[0-9;]*)q/u;
 const SIXEL_END_SEQUENCE = "\x1b\\";
@@ -14,8 +14,8 @@ const SIXEL_PLACEHOLDER_PREFIX = "__SKC_SIXEL_SEQUENCE_";
  * - PI_ALLOW_SIXEL_PASSTHROUGH=1
  */
 export function isSixelPassthroughEnabled(): boolean {
-	const forcedProtocol = $env.PI_FORCE_IMAGE_PROTOCOL?.trim().toLowerCase();
-	return forcedProtocol === "sixel" && $flag("PI_ALLOW_SIXEL_PASSTHROUGH");
+	const forcedProtocol = $pickenv("SKC_FORCE_IMAGE_PROTOCOL", "PI_FORCE_IMAGE_PROTOCOL")?.trim().toLowerCase();
+	return forcedProtocol === "sixel" && $pickflag("SKC_ALLOW_SIXEL_PASSTHROUGH", "PI_ALLOW_SIXEL_PASSTHROUGH");
 }
 /** Returns true when the text contains a SIXEL start sequence. */
 export function containsSixelSequence(text: string): boolean {

package/src/web/insane/bridge.ts

@@ -31,6 +31,7 @@ const KILL_GRACE_MS = 2_000;
 
 /** Stable note prefixes — tests assert on these without depending on full stderr. */
 export const INSANE_NOTES = {
+	securityDisabled: `insane fallback disabled: remote renderer cannot preserve validated network routing`,
 	guardBlocked: (reason: string) => `insane fallback blocked: target URL is not public HTTP(S): ${reason}`,
 	vendorMissing: `insane fallback unavailable: vendor engine missing at packages/coding-agent/vendor/insane-search`,
 	noPython: `insane fallback unavailable: python3 not found; install python3 and curl_cffi, then retry with web.insaneFallback=true`,
@@ -325,8 +326,11 @@ function mapEngineOutput(raw: EngineRawOutput, timeoutMs: number): InsaneBridgeR
  * (which MUST run before this is called). Never throws; always returns a result.
  */
 export async function tryInsaneFetch(url: string, options: TryInsaneFetchOptions = {}): Promise<InsaneBridgeResult> {
+	if (!options.runner) {
+		return { ok: false, reason: "disabled-security", notes: [INSANE_NOTES.securityDisabled] };
+	}
 	const prober = options.prober ?? probeInsaneDependencies;
-	const runner = options.runner ?? (inv => runEngineSubprocess(inv));
+	const runner = options.runner;
 	const limit = options.concurrencyLimit ?? DEFAULT_CONCURRENCY;
 
 	const deps = await prober();