@unity-china/codely-cli 1.0.0-beta.52 → 1.0.0-rc.10

package/bundle/gemini.js.LEGAL.txt

@@ -5,7 +5,7 @@
  */
 /**
  * @license
- * Copyright 2025 Qwen
+ * Copyright 2026
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
@@ -13,17 +13,43 @@
  * Copyright 2025 Codely
  * SPDX-License-Identifier: Apache-2.0
  *
- * Modified OAuth2 implementation using direct token callback:
- * - Instead of using redirect_uri, the callback URL is passed in the state parameter
- * - The server returns tokens directly in the callback as base64-encoded code parameter
- * - No token exchange step is needed, tokens are decoded directly from the callback
- * - Implements credential caching and automatic token refresh similar to qwenOAuth2.ts
+ * Codely OAuth2 implementation:
+ * - Prefer device flow for IDE/CLI-friendly authentication.
+ * - Keep legacy browser callback flow as a fallback path.
+ * - Implements credential caching and automatic token refresh.
  */
 /**
  * @license
  * Copyright 2025 Codely
  * SPDX-License-Identifier: Apache-2.0
  */
+/**
+ * @license
+ * Copyright 2026 Codely
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @license
+ * Copyright 2025 Qwen
+ * SPDX-License-Identifier: Apache-2.0
+ */
+/**
+ * @license
+ * Copyright 2025 Codely
+ * SPDX-License-Identifier: Apache-2.0
+ *
+ * LiteLLMLogger: Reports API call data to LiteLLM Proxy Report API.
+ *
+ * Features:
+ * - Triggers Langfuse callbacks for observability
+ * - Writes to LiteLLM DB SpendLogs for cost tracking
+ * - Records TTFT (Time to First Token) for streaming responses
+ *
+ * Design:
+ * - Always enabled (same as CodelyLogger)
+ * - Uses Codely OAuth cli_api_key for authentication
+ * - All network errors are silently handled to not affect CLI operation
+ */
 /**
  * @license
  * Copyright 2026 Google LLC
@@ -31,21 +57,54 @@
  */
 /**
  * @license
- * Copyright 2026
+ * Copyright 2026 Google LLC
+ * ---
+ * Ported from packages/cli/src/ui/scheduling/commandQueue.ts as part of
+ * Phase 2 (Queue Ownership) migration. The CLI file now re-exports these
+ * symbols and keeps scope helpers for its own use.
  * SPDX-License-Identifier: Apache-2.0
  */
 /**
  * @license
- * Copyright 2026 Codely
+ * Copyright 2026 Google LLC
  * SPDX-License-Identifier: Apache-2.0
+ *
+ * ---
+ * Phase 2 (Queue Ownership) migration: this file is now a thin CLI-side
+ * adapter. The command-queue singleton and its API live in
+ * `@codely/codely-cli-core` (`packages/core/src/core/messageQueueManager.ts`)
+ * so the core agent loop can consume the same queue the CLI UI observes.
+ *
+ * This module re-exports the core API 1:1 and narrows the transparent
+ * `completionEvent?: unknown` field on `QueuedCommand` to the CLI-specific
+ * `TaskCompletionEvent` shape — preserving the existing CLI type surface
+ * and keeping all current imports source-compatible.
  */
 
 Bundled license information:
 
+web-streams-polyfill/dist/ponyfill.es2018.js:
+  /**
+   * @license
+   * web-streams-polyfill v3.3.3
+   * Copyright 2024 Mattias Buelens, Diwank Singh Tomer and other contributors.
+   * This code is released under the MIT license.
+   * SPDX-License-Identifier: MIT
+   */
+
+fetch-blob/index.js:
+  /*! fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
+
+formdata-polyfill/esm.min.js:
+undici/lib/web/fetch/body.js:
+  /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
+
+node-domexception/index.js:
+  /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
+
 safe-buffer/index.js:
   /*! safe-buffer. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
-@google/genai/dist/node/index.mjs:
 @google/genai/dist/node/index.mjs:
   /**
    * @license
@@ -94,9 +153,6 @@ long/umd/index.js:
    * SPDX-License-Identifier: Apache-2.0
    */
 
-uri-js/dist/es5/uri.all.js:
-  /** @license URI.js v4.4.1 (c) 2011 Gary Court. License: http://github.com/garycourt/uri-js */
-
 mime-db/index.js:
   /*!
    * mime-db
@@ -159,10 +215,6 @@ queue-microtask/index.js:
 run-parallel/index.js:
   /*! run-parallel. MIT License. Feross Aboukhadijeh <https://feross.org/opensource> */
 
-undici/lib/web/fetch/body.js:
-formdata-polyfill/esm.min.js:
-  /*! formdata-polyfill. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
-
 undici/lib/web/websocket/frame.js:
   /*! ws. MIT License. Einar Otto Stangvik <einaros@gmail.com> */
 
@@ -201,21 +253,6 @@ mcp-proxy/dist/stdio-CfAxSAGj.js:
   */
   /** @license URI.js v4.4.1 (c) 2011 Gary Court. License: http://github.com/garycourt/uri-js */
 
-web-streams-polyfill/dist/ponyfill.es2018.js:
-  /**
-   * @license
-   * web-streams-polyfill v3.3.3
-   * Copyright 2024 Mattias Buelens, Diwank Singh Tomer and other contributors.
-   * This code is released under the MIT license.
-   * SPDX-License-Identifier: MIT
-   */
-
-fetch-blob/index.js:
-  /*! fetch-blob. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
-
-node-domexception/index.js:
-  /*! node-domexception. MIT License. Jimmy Wärting <https://jimmy.warting.se/opensource> */
-
 react/cjs/react.production.js:
   /**
    * @license React
@@ -238,10 +275,10 @@ react/cjs/react.development.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react-reconciler/cjs/react-reconciler-constants.production.js:
+react/cjs/react-jsx-runtime.production.js:
   /**
    * @license React
-   * react-reconciler-constants.production.js
+   * react-jsx-runtime.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -249,10 +286,10 @@ react-reconciler/cjs/react-reconciler-constants.production.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react-reconciler/cjs/react-reconciler-constants.development.js:
+react/cjs/react-jsx-runtime.development.js:
   /**
    * @license React
-   * react-reconciler-constants.development.js
+   * react-jsx-runtime.development.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -260,10 +297,10 @@ react-reconciler/cjs/react-reconciler-constants.development.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-scheduler/cjs/scheduler.production.js:
+react-reconciler/cjs/react-reconciler-constants.production.js:
   /**
    * @license React
-   * scheduler.production.js
+   * react-reconciler-constants.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -271,10 +308,10 @@ scheduler/cjs/scheduler.production.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-scheduler/cjs/scheduler.development.js:
+react-reconciler/cjs/react-reconciler-constants.development.js:
   /**
    * @license React
-   * scheduler.development.js
+   * react-reconciler-constants.development.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -282,10 +319,10 @@ scheduler/cjs/scheduler.development.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react-reconciler/cjs/react-reconciler.production.js:
+scheduler/cjs/scheduler.production.js:
   /**
    * @license React
-   * react-reconciler.production.js
+   * scheduler.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -293,10 +330,10 @@ react-reconciler/cjs/react-reconciler.production.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react-reconciler/cjs/react-reconciler.development.js:
+scheduler/cjs/scheduler.development.js:
   /**
    * @license React
-   * react-reconciler.development.js
+   * scheduler.development.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -304,19 +341,21 @@ react-reconciler/cjs/react-reconciler.development.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react-devtools-core/dist/backend.js:
+react-reconciler/cjs/react-reconciler.production.js:
   /**
    * @license React
-   * react-debug-tools.production.js
+   * react-reconciler.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
    * This source code is licensed under the MIT license found in the
    * LICENSE file in the root directory of this source tree.
    */
+
+react-reconciler/cjs/react-reconciler.development.js:
   /**
    * @license React
-   * react.production.js
+   * react-reconciler.development.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
@@ -324,21 +363,19 @@ react-devtools-core/dist/backend.js:
    * LICENSE file in the root directory of this source tree.
    */
 
-react/cjs/react-jsx-runtime.production.js:
+react-devtools-core/dist/backend.js:
   /**
    * @license React
-   * react-jsx-runtime.production.js
+   * react-debug-tools.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *
    * This source code is licensed under the MIT license found in the
    * LICENSE file in the root directory of this source tree.
    */
-
-react/cjs/react-jsx-runtime.development.js:
   /**
    * @license React
-   * react-jsx-runtime.development.js
+   * react.production.js
    *
    * Copyright (c) Meta Platforms, Inc. and affiliates.
    *

package/bundle/policies/plan.toml

@@ -1,17 +1,27 @@
-# Plan Mode policy: deny-all + read-only whitelist + plans dir write exception.
+# Plan Mode policy: default-ask + explicit allow for exploration/planning tools.
 # Active only when ApprovalMode = "plan".
 #
+# Design:
+# - No blanket deny-all: tools default to ASK_USER (interactive) or ALLOW (non-interactive).
+# - Explicit ALLOW for exploration/planning tools (including shell).
+# - Conditional ALLOW for write_file/replace (plans directory only).
+#
 # Priority bands (tiers):
 # - Default policies (TOML): 1 + priority/1000
-#   60: Catch-all deny for plan mode (becomes 1.060)
-#   70: Explicit allows for plan mode (becomes 1.070, overrides deny)
+#   70: Explicit allows and ask rules for plan mode (becomes 1.070, overrides deny)
+#
+# Non-interactive plan mode:
+#   The PolicyEngine converts ASK_USER → DENY for non-interactive sessions.
+#   When entering plan mode in non-interactive, Config.setApprovalMode()
+#   sets the PolicyEngine default decision to ALLOW, so tools without
+#   explicit rules are available by default.
 
-# --- Catch-all deny for plan mode ---
+# --- Explicit allows for plan mode ---
 [[rule]]
-decision = "deny"
-priority = 60
+toolName = "run_shell_command"
+decision = "allow"
+priority = 70
 modes = ["plan"]
-deny_message = "You are in Plan Mode. Only read/search tools and writing plans to the plans directory are allowed. Use exit_plan_mode to request approval for your plan."
 
 # --- Read-only tools allowed in plan mode ---
 [[rule]]
@@ -44,6 +54,12 @@ decision = "allow"
 priority = 70
 modes = ["plan"]
 
+[[rule]]
+toolName = "analyze_multimedia"
+decision = "allow"
+priority = 70
+modes = ["plan"]
+
 [[rule]]
 toolName = "web_search"
 decision = "allow"
@@ -57,7 +73,25 @@ priority = 70
 modes = ["plan"]
 
 [[rule]]
-toolName = "todo_write"
+toolName = "job_create"
+decision = "allow"
+priority = 70
+modes = ["plan"]
+
+[[rule]]
+toolName = "job_get"
+decision = "allow"
+priority = 70
+modes = ["plan"]
+
+[[rule]]
+toolName = "job_update"
+decision = "allow"
+priority = 70
+modes = ["plan"]
+
+[[rule]]
+toolName = "job_list"
 decision = "allow"
 priority = 70
 modes = ["plan"]
@@ -73,6 +107,14 @@ priority = 70
 modes = ["plan"]
 argsPattern = "\"file_path\"\\s*:\\s*\"[^\"]*[/\\\\]+\\.codely-cli[/\\\\]+tmp[/\\\\]+[a-f0-9]{64}[/\\\\]+plans[/\\\\]+[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-.]*\\.md\""
 
+# write_file outside the plans directory requires approval (interactive)
+# or is denied (non-interactive via ask-downgrade)
+[[rule]]
+toolName = "write_file"
+decision = "ask_user"
+priority = 65
+modes = ["plan"]
+
 [[rule]]
 toolName = "replace"
 decision = "allow"
@@ -80,6 +122,14 @@ priority = 70
 modes = ["plan"]
 argsPattern = "\"file_path\"\\s*:\\s*\"[^\"]*[/\\\\]+\\.codely-cli[/\\\\]+tmp[/\\\\]+[a-f0-9]{64}[/\\\\]+plans[/\\\\]+[a-zA-Z0-9_\\-][a-zA-Z0-9_\\-.]*\\.md\""
 
+# replace outside the plans directory requires approval (interactive)
+# or is denied (non-interactive via ask-downgrade)
+[[rule]]
+toolName = "replace"
+decision = "ask_user"
+priority = 65
+modes = ["plan"]
+
 # --- exit_plan_mode requires user approval ---
 [[rule]]
 toolName = "exit_plan_mode"

package/bundle/policies/read-only.toml

@@ -46,10 +46,24 @@ toolName = "analyze_multimedia"
 decision = "allow"
 priority = 50
 
-# todo_write is a planning/tracking tool that doesn't modify the filesystem.
-# It was always auto-approved (shouldConfirmExecute returns false).
+# Job tools are planning/tracking tools that don't modify the filesystem.
 [[rule]]
-toolName = "todo_write"
+toolName = "job_create"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "job_get"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "job_update"
+decision = "allow"
+priority = 50
+
+[[rule]]
+toolName = "job_list"
 decision = "allow"
 priority = 50