@selesai/code 0.13.39 → 0.14.0

package/dist/core/auth-storage.d.ts

@@ -2,7 +2,7 @@
  * CredentialStore implementation backed by auth.json.
  * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import type { Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
+import type { AuthOperationOptions, Credential, CredentialInfo, CredentialStore } from "@earendil-works/pi-ai";
 type AuthStorageData = Record<string, Credential>;
 type LockResult<T> = {
     result: T;
@@ -10,7 +10,7 @@ type LockResult<T> = {
 };
 export interface AuthStorageBackend {
     withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
-    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
+    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>, options?: AuthOperationOptions): Promise<T>;
 }
 export declare class FileAuthStorageBackend implements AuthStorageBackend {
     private authPath;
@@ -19,39 +19,49 @@ export declare class FileAuthStorageBackend implements AuthStorageBackend {
     private ensureFileExists;
     private acquireLockSyncWithRetry;
     withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
-    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
+    private acquireLockAsync;
+    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>, options?: AuthOperationOptions): Promise<T>;
+}
+export declare class ReadOnlyAuthStorage implements CredentialStore {
+    private readonly authPath;
+    private data;
+    constructor(authPath?: string);
+    private load;
+    read(providerId: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
+    modify(_providerId: string, _fn: (current: Credential | undefined) => Promise<Credential | undefined>, _options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(_providerId: string, _options?: AuthOperationOptions): Promise<void>;
 }
 export declare class InMemoryAuthStorageBackend implements AuthStorageBackend {
     private value;
+    private asyncChain;
     withLock<T>(fn: (current: string | undefined) => LockResult<T>): T;
-    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>): Promise<T>;
+    withLockAsync<T>(fn: (current: string | undefined) => Promise<LockResult<T>>, options?: AuthOperationOptions): Promise<T>;
 }
 /**
  * Credential storage backed by a JSON file.
  */
 export declare class AuthStorage implements CredentialStore {
-    private data;
     private storage;
+    private authPath;
+    private readState;
     private constructor();
     static create(authPath?: string): AuthStorage;
     static fromStorage(storage: AuthStorageBackend): AuthStorage;
     static inMemory(data?: AuthStorageData): AuthStorage;
     private parseStorageData;
+    private updateReadState;
     /**
      * Reload credentials from storage.
      */
     reload(): void;
-    /** Legacy synchronous accessor retained for bundled extensions. */
-    get(provider: string): Credential | undefined;
-    /** Legacy synchronous writer retained for bundled extensions. */
-    set(provider: string, credential: Credential): void;
-    /** Legacy synchronous deleter retained for bundled extensions. */
-    remove(provider: string): void;
-    read(provider: string): Promise<Credential | undefined>;
-    modify(provider: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>): Promise<Credential | undefined>;
-    delete(provider: string): Promise<void>;
+    private reloadFromStorageAsync;
+    private readLatestData;
+    read(provider: string, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    modify(provider: string, fn: (current: Credential | undefined) => Promise<Credential | undefined>, options?: AuthOperationOptions): Promise<Credential | undefined>;
+    delete(provider: string, options?: AuthOperationOptions): Promise<void>;
     /** List credential metadata without resolving configured key values. */
-    list(): Promise<readonly CredentialInfo[]>;
+    list(options?: AuthOperationOptions): Promise<readonly CredentialInfo[]>;
 }
 /**
  * One-off synchronous read of a stored credential from an auth.json file,

package/dist/core/auth-storage.js

@@ -2,13 +2,18 @@
  * CredentialStore implementation backed by auth.json.
  * Provider auth orchestration belongs to ModelRuntime and pi-ai Models.
  */
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "fs";
 import { dirname, join } from "path";
 import lockfile from "proper-lockfile";
+import { setTimeout as sleep } from "timers/promises";
 import { getAgentDir } from "../config.js";
-import { normalizePath } from "../utils/paths.js";
-import { resolveConfigValue } from "./resolve-config-value.js";
+import { raceWithAbortSignal } from "../utils/abort.js";
+import { getFileRevision, normalizePath } from "../utils/paths.js";
+import { stripBom } from "../utils/text.js";
+import { isCommandConfigValue, resolveConfigValue } from "./resolve-config-value.js";
+// The mode applies only on creation so administrator-managed modes and ACLs remain intact.
 const AUTH_FILE_WRITE_OPTIONS = { encoding: "utf-8", mode: 0o600 };
+let sharedAuthFileReadState;
 export class FileAuthStorageBackend {
     authPath;
     constructor(authPath = join(getAgentDir(), "auth.json")) {
@@ -23,7 +28,6 @@ export class FileAuthStorageBackend {
     ensureFileExists() {
         if (!existsSync(this.authPath)) {
             writeFileSync(this.authPath, "{}", AUTH_FILE_WRITE_OPTIONS);
-            chmodSync(this.authPath, 0o600);
         }
     }
     acquireLockSyncWithRetry(path) {
@@ -60,7 +64,6 @@ export class FileAuthStorageBackend {
             const { result, next } = fn(current);
             if (next !== undefined) {
                 writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
-                chmodSync(this.authPath, 0o600);
             }
             return result;
         }
@@ -70,7 +73,48 @@ export class FileAuthStorageBackend {
             }
         }
     }
-    async withLockAsync(fn) {
+    async acquireLockAsync(signal, onCompromised) {
+        const staleMs = 30_000;
+        const maxDelayMs = 2_000;
+        const deadline = Date.now() + staleMs;
+        let retry = 0;
+        while (true) {
+            signal?.throwIfAborted();
+            let release;
+            try {
+                release = await lockfile.lock(this.authPath, {
+                    realpath: false,
+                    retries: 0,
+                    stale: staleMs,
+                    onCompromised,
+                });
+            }
+            catch (error) {
+                signal?.throwIfAborted();
+                const code = typeof error === "object" && error !== null && "code" in error
+                    ? String(error.code)
+                    : undefined;
+                const remainingMs = deadline - Date.now();
+                if (code !== "ELOCKED" || remainingMs <= 0)
+                    throw error;
+                const baseDelayMs = Math.min(10 * 2 ** retry, maxDelayMs / 2);
+                retry++;
+                const delayMs = Math.min(Math.round(baseDelayMs * (1 + Math.random())), remainingMs);
+                if (signal)
+                    await sleep(delayMs, undefined, { signal });
+                else
+                    await sleep(delayMs);
+                continue;
+            }
+            if (signal?.aborted) {
+                await release();
+                signal.throwIfAborted();
+            }
+            return release;
+        }
+    }
+    async withLockAsync(fn, options) {
+        options?.signal?.throwIfAborted();
         this.ensureParentDir();
         this.ensureFileExists();
         let release;
@@ -82,27 +126,18 @@ export class FileAuthStorageBackend {
             }
         };
         try {
-            release = await lockfile.lock(this.authPath, {
-                retries: {
-                    retries: 10,
-                    factor: 2,
-                    minTimeout: 100,
-                    maxTimeout: 10000,
-                    randomize: true,
-                },
-                stale: 30000,
-                onCompromised: (err) => {
-                    lockCompromised = true;
-                    lockCompromisedError = err;
-                },
+            release = await this.acquireLockAsync(options?.signal, (error) => {
+                lockCompromised = true;
+                lockCompromisedError = error;
             });
             throwIfCompromised();
+            options?.signal?.throwIfAborted();
             const current = existsSync(this.authPath) ? readFileSync(this.authPath, "utf-8") : undefined;
             const { result, next } = await fn(current);
             throwIfCompromised();
+            options?.signal?.throwIfAborted();
             if (next !== undefined) {
                 writeFileSync(this.authPath, next, AUTH_FILE_WRITE_OPTIONS);
-                chmodSync(this.authPath, 0o600);
             }
             throwIfCompromised();
             return result;
@@ -119,8 +154,86 @@ export class FileAuthStorageBackend {
         }
     }
 }
+export class ReadOnlyAuthStorage {
+    authPath;
+    data;
+    constructor(authPath = join(getAgentDir(), "auth.json")) {
+        this.authPath = normalizePath(authPath);
+    }
+    load() {
+        if (this.data)
+            return this.data;
+        let parsed;
+        try {
+            parsed = JSON.parse(stripBom(readFileSync(this.authPath, "utf-8")));
+        }
+        catch (error) {
+            if (error.code === "ENOENT") {
+                this.data = {};
+                return this.data;
+            }
+            throw new Error(`Failed to read auth.json: ${error instanceof Error ? error.message : String(error)}`);
+        }
+        if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+            throw new Error("Invalid auth.json: expected an object");
+        }
+        for (const [providerId, credential] of Object.entries(parsed)) {
+            if (typeof credential !== "object" || credential === null || Array.isArray(credential)) {
+                throw new Error(`Invalid auth.json credential for provider "${providerId}"`);
+            }
+            const value = credential;
+            if (value.type === "api_key") {
+                const validKey = value.key === undefined || typeof value.key === "string";
+                const validEnv = value.env === undefined ||
+                    (typeof value.env === "object" &&
+                        value.env !== null &&
+                        !Array.isArray(value.env) &&
+                        Object.values(value.env).every((entry) => typeof entry === "string"));
+                if (validKey && validEnv)
+                    continue;
+            }
+            else if (value.type === "oauth" &&
+                typeof value.access === "string" &&
+                typeof value.refresh === "string" &&
+                typeof value.expires === "number" &&
+                Number.isFinite(value.expires)) {
+                continue;
+            }
+            throw new Error(`Invalid auth.json credential for provider "${providerId}"`);
+        }
+        this.data = parsed;
+        return this.data;
+    }
+    async read(providerId, options) {
+        options?.signal?.throwIfAborted();
+        const credential = this.load()[providerId];
+        options?.signal?.throwIfAborted();
+        if (!credential)
+            return undefined;
+        if (credential.type !== "api_key" || !credential.key || isCommandConfigValue(credential.key)) {
+            return structuredClone(credential);
+        }
+        return { ...credential, key: resolveConfigValue(credential.key, credential.env) };
+    }
+    async list(options) {
+        options?.signal?.throwIfAborted();
+        const credentials = Object.entries(this.load()).map(([providerId, credential]) => ({
+            providerId,
+            type: credential.type,
+        }));
+        options?.signal?.throwIfAborted();
+        return credentials;
+    }
+    async modify(_providerId, _fn, _options) {
+        throw new Error("Read-only credential storage cannot modify auth.json");
+    }
+    async delete(_providerId, _options) {
+        throw new Error("Read-only credential storage cannot modify auth.json");
+    }
+}
 export class InMemoryAuthStorageBackend {
     value;
+    asyncChain = Promise.resolve();
     withLock(fn) {
         const { result, next } = fn(this.value);
         if (next !== undefined) {
@@ -128,26 +241,47 @@ export class InMemoryAuthStorageBackend {
         }
         return result;
     }
-    async withLockAsync(fn) {
-        const { result, next } = await fn(this.value);
-        if (next !== undefined) {
-            this.value = next;
-        }
-        return result;
+    withLockAsync(fn, options) {
+        const previous = this.asyncChain;
+        const operation = (async () => {
+            await previous.catch(() => { });
+            options?.signal?.throwIfAborted();
+            const { result, next } = await fn(this.value);
+            options?.signal?.throwIfAborted();
+            if (next !== undefined) {
+                this.value = next;
+            }
+            return result;
+        })();
+        this.asyncChain = operation.catch(() => { });
+        return raceWithAbortSignal(operation, options?.signal);
     }
 }
 /**
  * Credential storage backed by a JSON file.
  */
 export class AuthStorage {
-    data = {};
     storage;
-    constructor(storage) {
+    authPath;
+    readState;
+    constructor(storage, authPath) {
         this.storage = storage;
+        this.authPath = authPath;
+        this.readState =
+            authPath && sharedAuthFileReadState?.authPath === authPath ? sharedAuthFileReadState.readState : { data: {} };
+        if (authPath && !sharedAuthFileReadState) {
+            sharedAuthFileReadState = { authPath, readState: this.readState };
+        }
+        if (authPath) {
+            const revision = getFileRevision(authPath);
+            if (revision !== undefined && revision === this.readState.revision)
+                return;
+        }
         this.reload();
     }
-    static create(authPath) {
-        return new AuthStorage(new FileAuthStorageBackend(authPath ?? join(getAgentDir(), "auth.json")));
+    static create(authPath = join(getAgentDir(), "auth.json")) {
+        const normalizedAuthPath = normalizePath(authPath);
+        return new AuthStorage(new FileAuthStorageBackend(normalizedAuthPath), normalizedAuthPath);
     }
     static fromStorage(storage) {
         return new AuthStorage(storage);
@@ -161,77 +295,119 @@ export class AuthStorage {
         if (!content) {
             return {};
         }
-        return JSON.parse(content);
+        return JSON.parse(stripBom(content));
+    }
+    updateReadState(data, revision) {
+        this.readState.data = data;
+        this.readState.revision = revision;
     }
     /**
      * Reload credentials from storage.
      */
     reload() {
         let content;
+        let revision;
         try {
             this.storage.withLock((current) => {
                 content = current;
+                revision = this.authPath ? getFileRevision(this.authPath) : undefined;
                 return { result: undefined };
             });
-            this.data = this.parseStorageData(content);
+            this.updateReadState(this.parseStorageData(content), revision);
         }
         catch {
             // Preserve the last valid in-memory snapshot.
         }
     }
-    /** Legacy synchronous accessor retained for bundled extensions. */
-    get(provider) {
-        return this.data[provider];
-    }
-    /** Legacy synchronous writer retained for bundled extensions. */
-    set(provider, credential) {
-        this.storage.withLock((content) => {
-            const next = { ...this.parseStorageData(content), [provider]: credential };
-            this.data = next;
-            return { result: undefined, next: JSON.stringify(next, null, 2) };
-        });
-    }
-    /** Legacy synchronous deleter retained for bundled extensions. */
-    remove(provider) {
-        this.storage.withLock((content) => {
-            const next = this.parseStorageData(content);
-            delete next[provider];
-            this.data = next;
-            return { result: undefined, next: JSON.stringify(next, null, 2) };
-        });
-    }
-    async read(provider) {
-        const credential = this.data[provider];
+    async reloadFromStorageAsync(options) {
+        return this.storage.withLockAsync(async (content) => {
+            const currentData = this.parseStorageData(content);
+            const revision = this.authPath ? getFileRevision(this.authPath) : undefined;
+            this.updateReadState(currentData, revision);
+            return { result: currentData };
+        }, options);
+    }
+    async readLatestData(options) {
+        options?.signal?.throwIfAborted();
+        if (!this.authPath) {
+            const reload = this.reloadFromStorageAsync(options);
+            return options?.signal ? reload : reload.catch(() => this.readState.data);
+        }
+        const revision = getFileRevision(this.authPath);
+        if (revision !== undefined && revision === this.readState.revision)
+            return this.readState.data;
+        if (!this.readState.reload) {
+            const controller = new AbortController();
+            const reload = {
+                controller,
+                promise: this.reloadFromStorageAsync({ signal: controller.signal }),
+                readers: 0,
+            };
+            this.readState.reload = reload;
+            void reload.promise.then(() => {
+                if (this.readState.reload === reload)
+                    this.readState.reload = undefined;
+            }, () => {
+                if (this.readState.reload === reload)
+                    this.readState.reload = undefined;
+            });
+        }
+        const reload = this.readState.reload;
+        reload.readers++;
+        try {
+            const result = raceWithAbortSignal(reload.promise, options?.signal);
+            return options?.signal ? await result : await result.catch(() => this.readState.data);
+        }
+        finally {
+            reload.readers--;
+            if (reload.readers === 0 && this.readState.reload === reload) {
+                this.readState.reload = undefined;
+                reload.controller.abort();
+            }
+        }
+    }
+    async read(provider, options) {
+        const credential = (await this.readLatestData(options))[provider];
+        options?.signal?.throwIfAborted();
         if (credential?.type !== "api_key")
             return credential;
         if (credential.key === undefined)
             return credential;
         return { ...credential, key: resolveConfigValue(credential.key, credential.env) };
     }
-    async modify(provider, fn) {
-        return this.storage.withLockAsync(async (content) => {
+    async modify(provider, fn, options) {
+        let latestData = this.readState.data;
+        let revision;
+        const result = await this.storage.withLockAsync(async (content) => {
             const currentData = this.parseStorageData(content);
             const next = await fn(currentData[provider]);
             if (next === undefined) {
-                this.data = currentData;
+                latestData = currentData;
+                revision = this.authPath ? getFileRevision(this.authPath) : undefined;
                 return { result: currentData[provider] };
             }
             const merged = { ...currentData, [provider]: next };
-            this.data = merged;
+            latestData = merged;
             return { result: next, next: JSON.stringify(merged, null, 2) };
-        });
+        }, options);
+        this.updateReadState(latestData, revision);
+        return result;
     }
-    async delete(provider) {
+    async delete(provider, options) {
+        let latestData = this.readState.data;
         await this.storage.withLockAsync(async (content) => {
             const currentData = this.parseStorageData(content);
             delete currentData[provider];
-            this.data = currentData;
+            latestData = currentData;
             return { result: undefined, next: JSON.stringify(currentData, null, 2) };
-        });
+        }, options);
+        this.updateReadState(latestData);
     }
     /** List credential metadata without resolving configured key values. */
-    async list() {
-        return Object.entries(this.data).map(([providerId, credential]) => ({ providerId, type: credential.type }));
+    async list(options) {
+        const entries = Object.entries(await this.readLatestData(options));
+        options?.signal?.throwIfAborted();
+        return entries.map(([providerId, credential]) => ({ providerId, type: credential.type }));
     }
 }
 /**
@@ -240,7 +416,7 @@ export class AuthStorage {
  */
 export function readStoredCredential(providerId, authPath = join(getAgentDir(), "auth.json")) {
     try {
-        const data = JSON.parse(readFileSync(normalizePath(authPath), "utf-8"));
+        const data = JSON.parse(stripBom(readFileSync(normalizePath(authPath), "utf-8")));
         return data[providerId];
     }
     catch {

package/dist/core/bash-executor.js

@@ -5,11 +5,8 @@
  * - AgentSession.executeBash() for interactive and RPC modes
  * - Direct calls from modes that need bash execution
  */
-import { randomBytes } from "node:crypto";
-import { createWriteStream } from "node:fs";
-import { tmpdir } from "node:os";
-import { join } from "node:path";
-import { stripAnsi } from "../utils/ansi.js";
+import { splitIncompleteAnsiSuffix, stripAnsi } from "../utils/ansi.js";
+import { createOutputFileStream } from "../utils/output-files.js";
 import { sanitizeBinaryOutput } from "../utils/shell.js";
 import { DEFAULT_MAX_BYTES, truncateTail } from "./tools/truncate.js";
 // ============================================================================
@@ -30,18 +27,20 @@ export async function executeBashWithOperations(command, cwd, operations, option
         if (tempFilePath) {
             return;
         }
-        const id = randomBytes(8).toString("hex");
-        tempFilePath = join(tmpdir(), `pi-bash-${id}.log`);
-        tempFileStream = createWriteStream(tempFilePath);
+        ({ path: tempFilePath, stream: tempFileStream } = createOutputFileStream("pi-bash", ".log"));
         for (const chunk of outputChunks) {
             tempFileStream.write(chunk);
         }
     };
     const decoder = new TextDecoder();
-    const onData = (data) => {
-        totalBytes += data.length;
+    // Unfinished escape sequence at the end of the previous chunk, completed by the next chunk.
+    let pendingAnsi = "";
+    const appendText = (rawText) => {
         // Sanitize: strip ANSI, replace binary garbage, normalize newlines
-        const text = sanitizeBinaryOutput(stripAnsi(decoder.decode(data, { stream: true }))).replace(/\r/g, "");
+        const text = sanitizeBinaryOutput(stripAnsi(rawText)).replace(/\r/g, "");
+        if (!text) {
+            return;
+        }
         // Start writing to temp file if exceeds threshold
         if (totalBytes > DEFAULT_MAX_BYTES) {
             ensureTempFile();
@@ -61,50 +60,41 @@ export async function executeBashWithOperations(command, cwd, operations, option
             options.onChunk(text);
         }
     };
+    const onData = (data) => {
+        totalBytes += data.length;
+        const { complete, pending } = splitIncompleteAnsiSuffix(pendingAnsi + decoder.decode(data, { stream: true }));
+        pendingAnsi = pending;
+        appendText(complete);
+    };
+    const flushOutput = () => {
+        const rest = pendingAnsi + decoder.decode();
+        pendingAnsi = "";
+        appendText(rest);
+    };
+    let exitCode = null;
     try {
-        const result = await operations.exec(command, cwd, {
-            onData,
-            signal: options?.signal,
-        });
-        const fullOutput = outputChunks.join("");
-        const truncationResult = truncateTail(fullOutput);
-        if (truncationResult.truncated) {
-            ensureTempFile();
-        }
-        if (tempFileStream) {
-            tempFileStream.end();
-        }
-        const cancelled = options?.signal?.aborted ?? false;
-        return {
-            output: truncationResult.truncated ? truncationResult.content : fullOutput,
-            exitCode: cancelled ? undefined : (result.exitCode ?? undefined),
-            cancelled,
-            truncated: truncationResult.truncated,
-            fullOutputPath: tempFilePath,
-        };
+        ({ exitCode } = await operations.exec(command, cwd, { onData, signal: options?.signal }));
     }
     catch (err) {
-        // Check if it was an abort
-        if (options?.signal?.aborted) {
-            const fullOutput = outputChunks.join("");
-            const truncationResult = truncateTail(fullOutput);
-            if (truncationResult.truncated) {
-                ensureTempFile();
-            }
-            if (tempFileStream) {
-                tempFileStream.end();
-            }
-            return {
-                output: truncationResult.truncated ? truncationResult.content : fullOutput,
-                exitCode: undefined,
-                cancelled: true,
-                truncated: truncationResult.truncated,
-                fullOutputPath: tempFilePath,
-            };
+        // An aborted command still returns the output it produced so far
+        if (!options?.signal?.aborted) {
+            tempFileStream?.end();
+            throw err;
         }
-        if (tempFileStream) {
-            tempFileStream.end();
-        }
-        throw err;
     }
+    flushOutput();
+    const fullOutput = outputChunks.join("");
+    const truncationResult = truncateTail(fullOutput);
+    if (truncationResult.truncated) {
+        ensureTempFile();
+    }
+    tempFileStream?.end();
+    const cancelled = options?.signal?.aborted ?? false;
+    return {
+        output: truncationResult.truncated ? truncationResult.content : fullOutput,
+        exitCode: cancelled ? undefined : (exitCode ?? undefined),
+        cancelled,
+        truncated: truncationResult.truncated,
+        fullOutputPath: tempFilePath,
+    };
 }

package/dist/core/bug-report.js

@@ -49,7 +49,7 @@ export function redactJsonValue(value) {
     }));
 }
 function redactSettings(settings) {
-    const { trackingId: _trackingId, ...rest } = settings;
+    const { trackingId: _trackingId, deviceId: _deviceId, ...rest } = settings;
     return redactJsonValue(rest);
 }
 function collectEnvironment() {

package/dist/core/cache-warmer.d.ts

@@ -91,6 +91,7 @@ export declare class CacheWarmer {
     private stop;
     private schedule;
     private refresh;
+    private refreshDeadlineMissed;
     private validateRun;
     private getModeStopReason;
     private evaluate;