@synqa/cli 1.1.1 → 1.2.1

package/dist/main.js

@@ -1,14 +1,22 @@
 import { createInterface } from "node:readline/promises";
 import { runAgent } from "./agent.js";
-import { ApiError, checkKey } from "./api.js";
+import { AbortedError, ApiError, checkKey } from "./api.js";
 import { announceNotes, freshHistory, runCommand, statusParts } from "./commands.js";
                                                   
-import { looksLikeKey, readConfig, resolveApiKey, writeConfig, configPath } from "./config.js";
+import { API_BASE, looksLikeKey, readConfig, resolveApiKey, resolveProviderKey, writeConfig, configPath } from "./config.js";
 import { EditJournal } from "./journal.js";
 import { isHomeDir, isSensitivePath, unsafeStartDir } from "./paths.js";
                                              
                                   
 import { join } from "node:path";
+import { loadHooks, runHooks, toggleHook } from "./hooks.js";
+                                            
+import { MODE_LABEL, nextMode } from "./modes.js";
+import { providerDef, unlockGate } from "./providers.js";
+import { pickOne, readMasked, streamKeys } from "./select.js";
+                                                       
+import { bashEnv } from "./tools.js";
+import { checkForUpdate, runUpdate } from "./update.js";
 
 // A workspace inside a protected area (~/.dotfiles, ~/.config/nvim, ~/Library/...): every file is
 // refused there, so say why once at start-up instead of leaving the user with refusals.
@@ -18,9 +26,10 @@ export function protectedWorkspaceWarning(cwd        , home         )
 }
 
 // The start-up notes both the session banner and a one-shot run print.
-export function startWarnings(env                                    , cwd        , home         )           {
+// envInUse: false when a saved key is used and SYNQA_API_KEY is ignored (no warning then).
+export function startWarnings(env                                    , cwd        , home         , envInUse = true)           {
   const out           = [];
-  if (env.SYNQA_API_KEY?.trim()) out.push("using the key from SYNQA_API_KEY (not the one saved by synqa login)");
+  if (envInUse && env.SYNQA_API_KEY?.trim()) out.push("using the key from SYNQA_API_KEY (not the one saved by synqa login)");
   const inProtected = protectedWorkspaceWarning(cwd, home);
   if (inProtected) out.push(inProtected);
   return out;
@@ -99,7 +108,7 @@ import { CONTEXT_TOKENS, DEFAULT_TIER, findEffort, findTier, routingLabel } from
 import { accent, dim, stone } from "./theme.js";
                                         
 import { fetchAccount } from "./account.js";
-import { balanceFrom, formatFooter, makeUi, promptText, readVersion, renderBanner, renderStatusLines, Spinner, styleOf, textWidth, TurnRenderer } from "./ui.js";
+import { balanceFrom, formatFooter, makeUi, promptText, readVersion, renderBanner, renderStatusLines, Spinner, styleOf, textWidth, ToolProgressLine, TurnRenderer } from "./ui.js";
 import { PromptFrame } from "./prompt.js";
                                        
 
@@ -111,54 +120,31 @@ const BALANCE_TIMEOUT_MS = 2000;
 const HELP = `Usage:
   synqa                     interactive session in the current folder
   synqa "do something"      one-shot task
-  synqa login               save your API key
+  synqa login               save your Synqa API key
 Options:
   -y, --yes                 do not ask before ordinary file writes and edits
                             (shell commands always ask; not allowed in your home folder)
+  --env-key                 use SYNQA_API_KEY (and the other provider key variables)
+                            instead of a key saved by /login
   -m, --model <tier>        blink | sonata | aeon (default blink)
-  -e, --effort <level>      default | low | medium (default default)
+  -e, --effort <level>      default | low | medium | high (default default)
   -h, --help   -v, --version
-In a session, type / for the command menu (/model, /effort, /status, /init, /compact, /undo,
-/clear, /help, /exit).`;
+In a session, type / for the command menu (/model, /effort, /provider, /login, /logout, /status,
+/init, /compact, /undo, /hooks, /update, /clear, /help, /exit). Shift+Tab cycles the permission
+mode (ask before edits, auto-accept edits, plan only).`;
 
-// Said when SYNQA_API_KEY is set: it wins over the key that synqa login saved.
-export const ENV_KEY_NOTE = "SYNQA_API_KEY is set in this shell, so it is used instead of the key saved by synqa login. Remove it (unset SYNQA_API_KEY, and delete the line from ~/.zshrc or ~/.bash_profile) to use the saved key.";
+// Said when SYNQA_API_KEY is set in the shell but a key saved by synqa login or /login exists:
+// the saved key wins (since 1.2.0), so there is nothing to unset.
+export const ENV_KEY_NOTE = "SYNQA_API_KEY is set in this shell and takes effect only because the --env-key flag was passed or no key is saved. A key saved by synqa login or /login wins otherwise.";
 
-// Masked single-line input: nothing typed is echoed.
-export function readSecret(promptText        )                  {
-  return new Promise((resolve, reject) => {
-    const stdin = process.stdin;
-    if (!stdin.isTTY) {
-      reject(new Error("login needs an interactive terminal (or set SYNQA_API_KEY)"));
-      return;
-    }
-    process.stdout.write(promptText);
-    let value = "";
-    stdin.setRawMode(true);
-    stdin.resume();
-    stdin.setEncoding("utf8");
-    const onData = (chunk        ) => {
-      for (const ch of chunk) {
-        if (ch === "\r" || ch === "\n") {
-          stdin.setRawMode(false);
-          stdin.pause();
-          stdin.off("data", onData);
-          process.stdout.write("\n");
-          resolve(value.trim());
-          return;
-        }
-        if (ch === "\u0003") {
-          stdin.setRawMode(false);
-          process.stdout.write("\n");
-          reject(new Error("cancelled"));
-          return;
-        }
-        if (ch === "\u007f" || ch === "\b") value = value.slice(0, -1);
-        else if (ch >= " ") value += ch;
-      }
-    };
-    stdin.on("data", onData);
-  });
+// Masked single-line input on the process terminal: each character shows as a bullet.
+export async function readSecret(promptText        )                  {
+  const stdin = process.stdin;
+  if (!stdin.isTTY) throw new Error("login needs an interactive terminal (or set SYNQA_API_KEY)");
+  const v = await readMasked(promptText, { keys: streamKeys(stdin), out: process.stdout });
+  stdin.pause();
+  if (v === undefined) throw new Error("cancelled");
+  return v;
 }
 
 // The error text can come from the network, so it is sanitized before printing.
@@ -180,18 +166,17 @@ export async function login()                  {
   }
   const file = writeConfig({ ...readConfig(), apiKey: key });
   console.log(`Key verified and saved to ${file}`);
-  const fromEnv = process.env.SYNQA_API_KEY?.trim();
-  if (fromEnv && fromEnv !== key) console.error(`\nWarning: ${ENV_KEY_NOTE}`);
   return 0;
 }
 
-                                                                                                                                 
+                                                                                                                                                  
 
 export function parseArgs(argv          )       {
-  const a       = { allowHome: false, yes: false, model: "", effort: "", help: false, version: false, rest: [] };
+  const a       = { allowHome: false, yes: false, envKey: false, model: "", effort: "", help: false, version: false, rest: [] };
   for (let i = 0; i < argv.length; i++) {
     const t = argv[i]          ;
     if (t === "-y" || t === "--yes") a.yes = true;
+    else if (t === "--env-key") a.envKey = true;
     else if (t === "--allow-home") a.allowHome = true; // accepted and ignored since 1.1.1
     else if (t === "-h" || t === "--help") a.help = true;
     else if (t === "-v" || t === "--version") a.version = true;
@@ -202,6 +187,20 @@ export function parseArgs(argv          )       {
   return a;
 }
 
+// Where a session starts: the saved active provider if its credentials are still there, else Synqa Cloud.
+export function startProvider(synqaKey        , env                                    , envKey         )                                                                                                {
+  const cfg = readConfig(env);
+  const id = cfg.activeProvider;
+  const def = id ? providerDef(id) : undefined;
+  if (id && def && id !== "synqa") {
+    const entry = cfg.providers?.[id];
+    const key = resolveProviderKey(id, env, { envKey });
+    const base = id === "custom" ? entry?.baseUrl : def.baseUrl;
+    if (key && base) return { apiKey: key, providerId: def.id, baseUrl: base, modelId: entry?.model };
+  }
+  return { apiKey: synqaKey, providerId: "synqa", baseUrl: API_BASE };
+}
+
 // `input` is the key source; tests pass a stream that ends at once, like `< /dev/null`.
 export async function main(argv          , input            = process.stdin)                  {
   const args = parseArgs(argv);
@@ -216,8 +215,11 @@ export async function main(argv          , input            = process.stdin)
   }
   const yesRefused = homeYesRefusal(process.cwd(), args.yes);
   if (yesRefused) { console.error(yesRefused); return 1; }
-  const apiKey = resolveApiKey();
-  if (!apiKey) {
+  const interactive = Boolean(input.isTTY) && args.rest.length === 0;
+  const synqaKey0 = resolveApiKey(process.env, { envKey: args.envKey }) ?? "";
+  // A terminal session with no usable Synqa key shows the welcome screen and signs in first.
+  const needSignIn = interactive && !looksLikeKey(synqaKey0);
+  if (!synqaKey0 && !interactive) {
     console.error(`No API key. Run "synqa login" or set SYNQA_API_KEY. (config: ${configPath()})`);
     return 1;
   }
@@ -226,9 +228,8 @@ export async function main(argv          , input            = process.stdin)
   const tier = findTier(args.model || readConfig().tier || DEFAULT_TIER);
   if (!tier) { console.error(`Unknown tier "${args.model}". Use blink, sonata or aeon.`); return 1; }
   const effort = args.effort ? findEffort(args.effort) : "default";
-  if (!effort) { console.error(`Unknown effort "${args.effort}". Use default, low or medium.`); return 1; }
+  if (!effort) { console.error(`Unknown effort "${args.effort}". Use default, low, medium or high.`); return 1; }
 
-  const interactive = Boolean(input.isTTY) && args.rest.length === 0;
   // On a terminal the prompt frame reads the keys (for the / menu) and hands them to readline.
   const framed = interactive && ui.tty && ui.unicode;
   let statusLines                 = () => [];
@@ -241,45 +242,99 @@ export async function main(argv          , input            = process.stdin)
   // the plain text output they had before.
   const chrome = interactive && ui.tty;
   const spinner = new Spinner(process.stdout, { enabled: chrome, ui });
-  const renderer = new TurnRenderer(process.stdout, ui, spinner);
+  const progress = new ToolProgressLine(process.stdout, { enabled: chrome, ui });
+  const renderer = new TurnRenderer(process.stdout, ui, spinner, progress);
   const inCard = (t        ) => (chrome ? renderer.body(t) : t);
   // `detail` is the coloured diff the tools built; the question is sanitized, the diff is not
   // (the tools already escaped every file character in it).
   const confirm = async (q        , detail         )                   => {
     if (!input.isTTY) return false;
     spinner.stop();
+    progress.stop();
     if (detail) term.write(inCard(detail) + "\n"); // with the question, on the terminal
-    const ans = await rl.question(`${accent(style, "?")} ${sanitize(q)} [y/N] `);
+    // The turn lock lets keys through for the length of the question.
+    const ask = () => rl.question(`${accent(style, "?")} ${sanitize(q)} [y/N] `);
+    const ans = keys ? await keys.withKeys(ask) : await ask();
     return /^y(es)?$/i.test(ans.trim());
   };
 
+  // The arrow-key controls: every key goes to the selector or the masked prompt, none to readline.
+  const keySource                        = keys ?? (input.isTTY ? streamKeys(input) : undefined);
+  const pick = keySource
+    ?    (items                        , title         ) => pickOne(items, { keys: keySource, out: term, style, unicode: ui.unicode, title })
+    : undefined;
+  const secret = keySource ? (p        ) => readMasked(p, { keys: keySource, out: term, unicode: ui.unicode }) : undefined;
+  const ask = interactive ? async (p        )                              => { try { return (await rl.question(p)).trim(); } catch { return undefined; } } : undefined;
+
   const cwd = process.cwd();
+  const sp = startProvider(synqaKey0, process.env, args.envKey);
   const st               = {
-    apiKey, cwd, tier, effort, history: [], journal: new EditJournal(),
+    apiKey: sp.apiKey, cwd, tier, effort, history: [], journal: new EditJournal(),
     total: { prompt: 0, completion: 0 }, last: { prompt: 0, completion: 0 }, routing: "?", notesChars: 0, notesShown: 0,
+    providerId: sp.providerId, baseUrl: sp.baseUrl, modelId: sp.modelId, mode: "ask",
   };
   st.history = freshHistory(st);
-  const ctx = { cwd, confirm, yes: args.yes, color: style.color, journal: st.journal, show: (t        ) => say(inCard(t)), get notesLoaded() { return st.notesChars > 0; } };
+  const ctx = {
+    cwd, confirm, yes: args.yes, color: style.color, journal: st.journal, show: (t        ) => say(inCard(t)),
+    get notesLoaded() { return st.notesChars > 0; },
+    get mode() { return st.mode; },
+  };
+  const external = () => (st.providerId ?? "synqa") !== "synqa";
+  const providerInfo = () => (external() ? { name: providerDef(st.providerId          )?.name ?? "Custom endpoint", model: st.modelId } : undefined);
+
+  // Hooks: shell commands at SessionStart, PreToolUse, PostToolUse and Stop. They never print errors.
+  const fire = async (event           , payload                                              = {}) => {
+    if (st.mode === "plan" && (event === "PostToolUse" || event === "Stop")) return []; // plan mode runs nothing after the fact
+    try { return await runHooks(loadHooks(cwd), event, { cwd, ...payload }, cwd, { env: bashEnv(process.env) }); } catch { return []; }
+  };
+  const toolHooks = {
+    pre: async (name        , a        ) => {
+      const blocked = (await fire("PreToolUse", { tool: name, input: a.slice(0, 4000) })).find((h) => h.blocked);
+      return blocked ? blocked.reason ?? "stopped by a PreToolUse hook" : undefined;
+    },
+    post: async (name        , a        , result        ) => { await fire("PostToolUse", { tool: name, input: a.slice(0, 4000), result: result.slice(0, 4000) }); },
+  };
 
   // Known balance for the footer and status line; refreshed in the background after each turn.
   let balance          = { kind: "unavailable" };
+  let latestVersion                    ;
   // The status line under the input: only known values (tier, workspace, context, tokens, credit).
   statusLines = () => renderStatusLines({
     tier: st.tier, effort: st.effort, cwd, tokens: st.total.prompt + st.total.completion,
     contextTokens: st.last.prompt || undefined, contextMax: CONTEXT_TOKENS, routing: st.routing, balance,
+    provider: providerInfo(), mode: MODE_LABEL[st.mode ?? "ask"], updateHint: latestVersion ? `update ${latestVersion}: /update` : undefined,
   }, ui);
   const refresh = () => { frame?.redraw(); };
+  // Shift+Tab cycles the permission mode; the footer shows it.
+  if (keys) keys.onShiftTab = () => { st.mode = nextMode(st.mode ?? "ask"); };
   // Raw mode and bracketed paste are always switched off again, also after a crash.
   const { restore, done } = wireSession({ spinner, keys, rl, oneShot: !interactive });
-  process.stdout.on("resize", () => refresh());
-  const loadBalance = async ()                   => balanceFrom(await fetchAccount(apiKey, undefined, BALANCE_TIMEOUT_MS));
+  // 'resize' (not SIGWINCH) fires on Windows, macOS and Linux; a changed width redraws the frame.
+  process.stdout.on("resize", () => { if (frame) frame.onResize(); else refresh(); });
+  // The balance belongs to Synqa Cloud: it is never asked with a secondary provider's key.
+  const loadBalance = async ()                   => {
+    const key = resolveApiKey(process.env, { envKey: args.envKey });
+    return key ? balanceFrom(await fetchAccount(key, undefined, BALANCE_TIMEOUT_MS)) : { kind: "unavailable" };
+  };
   const refreshBalance = () => { void loadBalance().then((b) => { balance = b; }, () => {}); };
 
-  const turn = async (text        )                => {
+  // Returns true when the person stopped the turn with Esc or Ctrl+C.
+  const turn = async (text        )                   => {
     st.history.push({ role: "user", content: text });
+    const ac = new AbortController();
+    let stopped = false;
+    // While the turn runs the keyboard is locked: nothing typed is echoed; Esc or Ctrl+C stops the
+    // request. A second press, with the turn still not ended (a long shell command), leaves.
+    keys?.beginTurn(() => {
+      if (ac.signal.aborted) { restore(); process.exit(130); }
+      stopped = true;
+      ac.abort();
+    });
     try {
       const r = await runAgent({
-        apiKey, tier: st.tier, effort: st.effort, history: st.history, ctx,
+        apiKey: st.apiKey, tier: st.tier, effort: st.effort, history: st.history, ctx,
+        baseUrl: external() ? st.baseUrl : undefined, modelId: external() ? st.modelId : undefined, hooks: toolHooks,
+        signal: ac.signal,
         events: chrome
           ? {
             onRequest: () => renderer.requestStart(),
@@ -287,11 +342,14 @@ export async function main(argv          , input            = process.stdin)
             onTool: (name, a) => renderer.toolStart(name, a),
             onToolResult: (name, _a, result) => renderer.toolResult(name, result),
             onTurn: () => renderer.requestEnd(),
+            onToolProgress: (p) => renderer.toolProgress(p),
+            onNotice: (t) => { renderer.requestEnd(); say(dim(style, `[${t}]`)); },
           }
           : {
             onText: (t) => process.stdout.write(sanitize(t)),
             onTool: (name, a) => process.stdout.write(`\n${dim(style, `> ${sanitize(name)} ${sanitize(a.length > 120 ? a.slice(0, 117) + "..." : a)}`)}\n`),
             onTurn: () => {},
+            onNotice: (t) => console.error(`[${t}]`),
           },
       });
       st.total = { prompt: st.total.prompt + r.total.prompt, completion: st.total.completion + r.total.completion };
@@ -303,20 +361,51 @@ export async function main(argv          , input            = process.stdin)
         renderer.turnEnd();
         const footer = formatFooter({
           ttftMs: r.ttftMs, tokPerSec: r.tokPerSec, routing: st.routing,
-          creditLeft: balance.kind === "ok" ? balance.account.creditRemaining : undefined,
+          creditLeft: balance.kind === "ok" && !external() ? balance.account.creditRemaining : undefined,
         }, ui);
         if (footer) say(stone(style, footer));
-        refreshBalance();
+        if (!external()) refreshBalance();
       } else {
         process.stdout.write("\n");
       }
     } catch (err) {
-      spinner.stop();
-      const msg = sanitize(err instanceof Error ? err.message : String(err));
-      const envNote = err instanceof ApiError && err.status === 401 && process.env.SYNQA_API_KEY?.trim() ? `\n${ENV_KEY_NOTE}` : "";
-      console.error(`\n${chrome ? accent(style, "error") : "error"}: ${msg}${envNote}`);
+      spinner.stop(); // the thinking timer ends on an error or an abort too
+      if (chrome) renderer.turnEnd(); // progress line off, cursor at the start of a line
+      if (err instanceof AbortedError) {
+        console.error(`\n${dim(style, "interrupted")}`);
+      } else {
+        const msg = sanitize(err instanceof Error ? err.message : String(err));
+        const envNote = err instanceof ApiError && err.status === 401 && !external() && process.env.SYNQA_API_KEY?.trim() ? `\n${ENV_KEY_NOTE}` : "";
+        console.error(`\n${chrome ? accent(style, "error") : "error"}: ${msg}${envNote}`);
+      }
+    } finally {
+      keys?.endTurn(); // the keyboard is unlocked on every way out
+      progress.stop();
     }
+    await fire("Stop", { tokens: st.total.prompt + st.total.completion });
     refresh();
+    return stopped;
+  };
+
+  // Welcome screen and the Synqa-first gate: chat and every other provider stay locked until a
+  // valid Synqa Cloud key is saved. Returns false when the person cancels.
+  const bannerInfo = (locked         ) => ({ version: VERSION, tier: st.tier, effort: st.effort, cwd, notesChars: st.notesChars, balance, warnings: locked ? [] : startWarnings(process.env, cwd, undefined, apiKeyFromEnv()), provider: providerInfo(), locked });
+  const apiKeyFromEnv = () => {
+    const e = process.env.SYNQA_API_KEY?.trim();
+    return Boolean(e) && resolveApiKey(process.env, { envKey: args.envKey }) === e;
+  };
+  const signIn = async ()                   => {
+    if (!secret) return false;
+    say("");
+    for (const line of renderBanner(bannerInfo(true), ui)) say(line);
+    say("");
+    const key = await unlockGate({ secret, print: (m) => say(dim(style, m)) });
+    if (!key) return false;
+    const p = startProvider(key, process.env, args.envKey);
+    st.apiKey = p.apiKey; st.providerId = p.providerId; st.baseUrl = p.baseUrl; st.modelId = p.modelId;
+    st.history = freshHistory(st);
+    say(dim(style, "Signed in to Synqa Cloud."));
+    return true;
   };
 
   try {
@@ -324,20 +413,31 @@ export async function main(argv          , input            = process.stdin)
       const prompt = args.rest.join(" ");
       if (!prompt) { console.error("Nothing to do. Pass a task or run in a terminal."); return 1; }
       announceNotes(st, say);
-      for (const w of startWarnings(process.env, cwd)) console.error(`Warning: ${w}`);
-      await turn(prompt);
+      for (const w of startWarnings(process.env, cwd, undefined, apiKeyFromEnv())) console.error(`Warning: ${w}`);
+      await fire("SessionStart", { source: "one-shot" });
+      const stopped = await turn(prompt);
       say(dim(style, formatStatus(statusParts(st))));
-      return 0;
+      return stopped ? 130 : 0;
     }
 
+    if (needSignIn) {
+      if (!(await signIn())) { say(dim(style, "Not signed in. Run synqa again to sign in to Synqa Cloud.")); return 1; }
+    }
     // The balance may take a moment; the banner waits at most BALANCE_TIMEOUT_MS for it.
-    balance = await loadBalance();
-    const warnings = startWarnings(process.env, cwd);
+    if (!external()) balance = await loadBalance();
     say("");
-    for (const line of renderBanner({ version: VERSION, tier: st.tier, effort: st.effort, cwd, notesChars: st.notesChars, balance, warnings }, ui)) say(line);
+    if (!needSignIn) for (const line of renderBanner(bannerInfo(false), ui)) say(line);
     say("");
     if (!frame) say(dim(style, "Type /help for commands."));
     announceNotes(st, (t) => say(dim(style, t)));
+    await fire("SessionStart", { source: "startup" });
+    // A quiet, short check for a newer release; any failure is silent and nothing waits for it.
+    if (chrome && !process.env.SYNQA_NO_UPDATE_CHECK) void checkForUpdate(VERSION).then((v) => { latestVersion = v; if (v) refresh(); }, () => {});
+    const io = {
+      print: say, confirm, style, ui, pick, secret, ask, envKey: args.envKey,
+      hooks: { list: () => loadHooks(cwd), toggle: (id        ) => toggleHook(cwd, id) },
+      update: { current: VERSION, get latest() { return latestVersion; }, run: () => runUpdate() },
+    };
     for (;;) {
       // Without the frame the status is printed above each prompt instead.
       if (!frame) say(dim(style, formatStatus(statusParts(st))));
@@ -346,9 +446,14 @@ export async function main(argv          , input            = process.stdin)
         line = (frame ? await frame.ask(promptText(ui)) : keys ? await keys.askPlain(`${accent(style, ui.unicode ? "❯" : ">")} `) : await rl.question(`${accent(style, ui.unicode ? "❯" : ">")} `)).trim();
       } catch { break; }
       if (!line) continue;
-      const r = await runCommand(line, st, { print: say, confirm, style, ui });
+      const r = await runCommand(line, st, io);
       refresh();
       if (r.exit) break;
+      if (r.relogin) {
+        // A full logout locks the session: back to the sign-in prompt, nothing else works until then.
+        if (!(await signIn())) { say(dim(style, "Locked. Run synqa again to sign in.")); break; }
+        continue;
+      }
       if (!r.handled) await turn(line);
     }
     return 0;

package/dist/modes.js

@@ -0,0 +1,20 @@
+// Permission modes of the session, cycled with Shift+Tab at the prompt and shown in the footer.
+//   ask    every file write and edit asks first (the default)
+//   auto   file writes and edits inside the workspace are applied without a question, like --yes
+//          (shell commands, secret files and files that can run code later still ask)
+//   plan   no file is written and no command is run: the agent can only read and describe a plan
+export const MODES = ["ask", "auto", "plan"]         ;
+                                                    
+
+export const MODE_LABEL                                 = {
+  ask: "ask before edits",
+  auto: "auto-accept edits",
+  plan: "plan only",
+};
+
+export function nextMode(m                )                 {
+  return MODES[(MODES.indexOf(m) + 1) % MODES.length]                  ;
+}
+
+// Tools that change something; plan mode refuses them.
+export const MUTATING_TOOLS                    = ["write_file", "edit_file", "bash"];

package/dist/paths.js

@@ -135,13 +135,17 @@ function hasRun(parts          , run                   )          {
   return false;
 }
 
-const slashed = (p        ) => fold(p.split(sep).join("/")).replace(/\/+$/, "");
+// One slash form for every comparison. On win32 both separators count and the drive letter and
+// every name are folded, so a Windows AppData folder in any letter case matches. The platform is
+// a parameter so the Windows rules are tested on any machine.
+const slashed = (p        , platform         = process.platform) =>
+  fold(platform === "win32" ? p.replace(/\\/g, "/") : p.split(sep).join("/")).replace(/\/+$/, "");
 
 // The home folder, as given and with symlinks resolved, folded.
-function homeForms(home        )           {
-  const out = [slashed(home)];
+function homeForms(home        , platform         = process.platform)           {
+  const out = [slashed(home, platform)];
   try {
-    out.push(slashed(realpathSync(home)));
+    out.push(slashed(realpathSync(home), platform));
   } catch {
     // a home that does not exist is compared as given
   }
@@ -152,25 +156,28 @@ function homeForms(home        )           {
 // ~/.cargo/**, any tool's credential store, known or not) and everything under
 // ~/Library is protected. This is the structural rule: it does not depend on naming each store.
 // A project's own dot files (~/proj/.github, ~/proj/.eslintrc) are below a normal folder and stay usable.
-export function homeHidden(abs        , home         = homedir())          {
-  const norm = slashed(abs);
-  for (const h of homeForms(home)) {
+// On Windows the same rule covers AppData (browser profiles, tokens, credential stores) and the
+// per-user registry hive NTUSER.DAT with its log and backup files.
+export function homeHidden(abs        , home         = homedir(), platform         = process.platform)          {
+  const norm = slashed(abs, platform);
+  for (const h of homeForms(home, platform)) {
     if (!norm.startsWith(h + "/")) continue;
     const first = norm.slice(h.length + 1).split("/")[0] ?? "";
     if (first.startsWith(".") || first === "library") return true;
+    if (platform === "win32" && (first === "appdata" || first.startsWith("ntuser.dat") || first === "ntuser.ini")) return true;
   }
   return false;
 }
 
 // True when `cwd` is the home folder itself.
-export function isHomeDir(cwd        , home         = homedir())          {
-  let real = slashed(cwd);
+export function isHomeDir(cwd        , home         = homedir(), platform         = process.platform)          {
+  let real = slashed(cwd, platform);
   try {
-    real = slashed(realpathSync(cwd));
+    real = slashed(realpathSync(cwd), platform);
   } catch {
     // compared as given
   }
-  return homeForms(home).includes(real) || homeForms(home).includes(slashed(cwd));
+  return homeForms(home, platform).includes(real) || homeForms(home, platform).includes(slashed(cwd, platform));
 }
 
 // Files and folders that hold secrets: the home folder's dot entries and Library (homeHidden),
@@ -178,13 +185,13 @@ export function isHomeDir(cwd        , home         = homedir())          {
 // profiles, histories, and this CLI's own config (which holds the API key). Names only, no file is
 // opened. Every segment is folded first (see fold). read_file, write_file and edit_file refuse
 // these outright; grep and glob skip them.
-export function isSensitivePath(abs        , cfg         = configDir(), home         = homedir())          {
-  if (homeHidden(abs, home)) return true;
-  const norm = slashed(abs);
+export function isSensitivePath(abs        , cfg         = configDir(), home         = homedir(), platform         = process.platform)          {
+  if (homeHidden(abs, home, platform)) return true;
+  const norm = slashed(abs, platform);
   const parts = norm.split("/").filter(Boolean);
   if (parts.some((d) => DIR_SET.has(d))) return true;
   if (SENSITIVE_RUNS.some((run) => hasRun(parts, run))) return true;
-  const c = slashed(cfg);
+  const c = slashed(cfg, platform);
   if (c && (norm === c || norm.startsWith(c + "/"))) return true;
   const name = parts[parts.length - 1] ?? "";
   // Remotes can hold tokens: .git/config, .git/config.worktree, .git/worktrees/<name>/config, at any depth.