@visual-z/xeno 0.8.4 → 0.9.0

package/src/apps/input.ts

@@ -1,312 +0,0 @@
-/**
- * Expand @file and !cmd in a user prompt before the line is sent.
- *
- * These are the user's own keystrokes, not the model's: a shared path with
- * the bash tool would either grant the model the user's authority or make
- * the user ask permission to run their own shell.
- *
- * Shell commands trigger only at line start. Explicit @ references may
- * occur inline; emails and code literals remain ordinary prompt text.
- */
-
-import { readFile } from "node:fs/promises";
-import { isAbsolute, relative, resolve, sep } from "node:path";
-import { fuzzyFilter } from "../tui/fuzzy.ts";
-import type { FileIndex } from "../store/file-index.ts";
-import { fileReferences } from "../core/file-references.ts";
-import type { ImageRef } from "../core/images.ts";
-
-/**
- * Per-file cap for @ expansion. Assumed, not measured: 256KB of one file
- * already crowds a turn; a silent half-file would let the model invent
- * the rest. Hitting it truncates and names the file.
- */
-export const MAX_EXPAND_FILE_BYTES = 256 * 1024;
-
-/**
- * Bound on captured command output. Assumed, not measured: a command that
- * dumps a build log would otherwise be an unbounded allocation. Truncated
- * output still carries the exit code -- the exit line is appended after
- * the body is capped, so a cut cannot hide whether the command passed.
- */
-export const MAX_COMMAND_OUTPUT_BYTES = 64 * 1024;
-
-/**
- * Timeout for !cmd. Assumed, not measured: long enough for a test suite,
- * short enough that a hung command cannot stall the editor. On expiry the
- * process is killed and the timeout is reported as a nonzero exit.
- */
-export const COMMAND_TIMEOUT_MS = 120_000;
-
-export interface ExpandContext {
-  readonly attachImage?: (path: string) => Promise<ImageRef | null>;
-  readonly workspace: string;
-  readonly index: FileIndex;
-  /** Terminal writer for !!cmd (and user-visible notices). */
-  readonly say: (text: string) => void;
-  readonly timeoutMs?: number;
-  readonly maxFileBytes?: number;
-  readonly maxCommandBytes?: number;
-}
-
-export interface ExpandResult {
-  readonly images?: readonly ImageRef[];
-  /** Text to send to the model. Empty when nothing should be sent. */
-  readonly message: string;
-  /** False when the input produced no model-facing text (a lone !!cmd). */
-  readonly send: boolean;
-}
-
-export function matchFiles(index: FileIndex, query: string): string[] {
-  return fuzzyFilter(index.paths, query);
-}
-
-export async function expandInput(text: string, ctx: ExpandContext): Promise<ExpandResult> {
-  const out: string[] = [];
-  const images: ImageRef[] = [];
-  const attachment = ctx.attachImage;
-  if (attachment) ctx = { ...ctx, attachImage: async path => { const image = await attachment(path); if (image) images.push(image); return image; } };
-  const refs = fileReferences(text);
-  let offset = 0;
-  for (const line of text.split(/\r?\n/)) {
-    const start = offset;
-    offset += line.length + (text.slice(offset + line.length).startsWith("\r\n") ? 2 : 1);
-    if (line.startsWith("!!")) {
-      ctx.say(await runUserCommand(line.slice(2), ctx));
-      continue;
-    }
-    if (line.startsWith("!")) {
-      const rendered = await runUserCommand(line.slice(1), ctx);
-      ctx.say(rendered);
-      out.push(rendered);
-      continue;
-    }
-    if (line.trim() === "@") {
-      out.push(skip(ctx, "@", "empty file reference"));
-      continue;
-    }
-    const here = refs.filter((ref) => ref.start >= start && ref.end <= start + line.length);
-    if (here.length === 0) { out.push(line); continue; }
-    let end = 0;
-    for (const ref of here) {
-      const prefix = line.slice(end, ref.start - start);
-      if (prefix.trim()) out.push(prefix.trimEnd());
-      out.push(await expandReference(ref.path, ctx));
-      end = ref.end - start;
-    }
-    if (line.slice(end).trim()) out.push(line.slice(end).trimStart());
-  }
-  const message = out.join("\n");
-  return { message, send: message.trim().length > 0 || images.length > 0, ...(images.length ? { images } : {}) };
-}
-
-async function expandReference(ref: string, ctx: ExpandContext): Promise<string> {
-  const abs = confine(ctx.workspace, ref);
-  if (abs === null) return skip(ctx, ref, "outside the workspace");
-
-  if (ctx.attachImage && /\.(png|jpe?g|gif|webp|bmp)$/i.test(abs)) {
-    const image = await ctx.attachImage(abs).catch(error => { if ((error as { code?: string }).code === "ENOENT") return null; throw error; });
-    if (image) return `[Image: ${image.name}, ${image.width}x${image.height}]`;
-  }
-
-  const got = await tryRead(abs);
-  if (got.status === "ok") return renderFile(posix(ref), got, ctx);
-  if (got.reason !== "not found") return skip(ctx, posix(ref), got.reason);
-
-  // Typed path missed; a unique fuzzy hit from the index is the query case.
-  const hits = matchFiles(ctx.index, ref);
-  if (hits.length === 1 && hits[0] !== posix(ref)) {
-    const path = hits[0]!;
-    const hitAbs = confine(ctx.workspace, path);
-    if (hitAbs === null) return skip(ctx, path, "outside the workspace");
-    if (ctx.attachImage && /\.(png|jpe?g|gif|webp|bmp)$/i.test(hitAbs)) {
-      const image = await ctx.attachImage(hitAbs);
-      if (image) return `[Image: ${image.name}, ${image.width}x${image.height}]`;
-    }
-    const hit = await tryRead(hitAbs);
-    if (hit.status === "ok") return renderFile(path, hit, ctx);
-    return skip(ctx, path, hit.reason);
-  }
-  if (hits.length > 1) return skip(ctx, ref, `ambiguous (${hits.length} matches)`);
-  return skip(ctx, posix(ref), got.reason);
-}
-
-function posix(rel: string): string {
-  return rel.split(sep).join("/");
-}
-
-function confine(workspace: string, rel: string): string | null {
-  if (rel.length === 0) return null;
-  const abs = resolve(workspace, rel);
-  const inside = relative(workspace, abs);
-  if (inside === "" || inside.startsWith(`..${sep}`) || inside === ".." || isAbsolute(inside)) {
-    return null;
-  }
-  return abs;
-}
-
-type ReadResult =
-  | { status: "ok"; text: string; bytes: number }
-  | { status: "skip"; reason: string };
-
-async function tryRead(abs: string): Promise<ReadResult> {
-  let buf: Buffer;
-  try {
-    buf = await readFile(abs);
-  } catch (err) {
-    const code = (err as { code?: string }).code;
-    if (code === "ENOENT") return { status: "skip", reason: "not found" };
-    if (code === "EACCES") return { status: "skip", reason: "permission denied" };
-    if (code === "EISDIR") return { status: "skip", reason: "is a directory" };
-    const message = err instanceof Error ? err.message : String(err);
-    return { status: "skip", reason: message };
-  }
-  try {
-    const text = new TextDecoder("utf-8", { fatal: true }).decode(buf);
-    return { status: "ok", text, bytes: buf.byteLength };
-  } catch {
-    return { status: "skip", reason: "not valid UTF-8" };
-  }
-}
-
-function renderFile(
-  path: string,
-  got: Extract<ReadResult, { status: "ok" }>,
-  ctx: ExpandContext,
-): string {
-  const cap = ctx.maxFileBytes ?? MAX_EXPAND_FILE_BYTES;
-  let content = got.text;
-  let truncated = false;
-  let omitted = 0;
-  if (got.bytes > cap) {
-    content = truncateUtf8(got.text, cap);
-    truncated = true;
-    omitted = Math.max(0, got.bytes - Buffer.byteLength(content, "utf8"));
-    ctx.say(`[truncated ${path}: ${omitted} bytes omitted]`);
-  }
-  const inner = truncated
-    ? `${content}\n[truncated: ${path} exceeded a size limit; ${omitted} bytes omitted]`
-    : content;
-  return `<file path="${escapeAttr(path)}">\n${inner}\n</file>`;
-}
-
-function skip(ctx: ExpandContext, path: string, reason: string): string {
-  const notice = `[skipped ${path}: ${reason}]`;
-  ctx.say(notice);
-  return notice;
-}
-
-function escapeAttr(value: string): string {
-  return value.replace(/&/g, "&amp;").replace(/"/g, "&quot;");
-}
-
-function truncateUtf8(text: string, maxBytes: number): string {
-  if (maxBytes <= 0) return "";
-  const buf = Buffer.from(text, "utf8");
-  if (buf.byteLength <= maxBytes) return text;
-  let end = maxBytes;
-  // Do not split a multibyte sequence: a dangling continuation byte is
-  // not valid UTF-8, and the model would see a replacement character.
-  while (end > 0 && (buf[end]! & 0xc0) === 0x80) end--;
-  return buf.subarray(0, end).toString("utf8");
-}
-
-async function runUserCommand(raw: string, ctx: ExpandContext): Promise<string> {
-  const cmd = raw.trim();
-  if (cmd.length === 0) return skip(ctx, "!", "empty command");
-
-  const timeoutMs = ctx.timeoutMs ?? COMMAND_TIMEOUT_MS;
-  const maxBytes = ctx.maxCommandBytes ?? MAX_COMMAND_OUTPUT_BYTES;
-
-  const proc = Bun.spawn(["bash", "-lc", cmd], {
-    cwd: ctx.workspace,
-    stdout: "pipe",
-    stderr: "pipe",
-    stdin: "ignore",
-  });
-
-  let timedOut = false;
-  let escalate: ReturnType<typeof setTimeout> | null = null;
-  const timer = setTimeout(() => {
-    timedOut = true;
-    proc.kill();
-    escalate = setTimeout(() => proc.kill("SIGKILL"), 1000);
-  }, timeoutMs);
-
-  let stdout = "";
-  let stderr = "";
-  let exit = 1;
-  try {
-    const [out, err] = await Promise.all([
-      readCapped(proc.stdout, maxBytes),
-      readCapped(proc.stderr, maxBytes),
-    ]);
-    stdout = out.text;
-    stderr = err.text;
-    if (out.truncated) stdout = `${stdout}\n[stdout truncated]`;
-    if (err.truncated) stderr = `${stderr}\n[stderr truncated]`;
-    const rawExit = await proc.exited;
-    exit = rawExit ?? 1;
-    // A kill that somehow reports success would put the model back to
-    // guessing. GNU timeout uses 124; never report 0 after a timeout.
-    if (timedOut && exit === 0) exit = 124;
-  } finally {
-    clearTimeout(timer);
-    if (escalate !== null) clearTimeout(escalate);
-  }
-
-  const parts: string[] = [`$ ${cmd}`];
-  if (stdout.length > 0) parts.push(stripTrailingNewline(stdout));
-  if (stderr.length > 0) parts.push(stripTrailingNewline(stderr));
-  if (timedOut) parts.push(`[timed out after ${timeoutMs}ms]`);
-  // Exit last so a capped body cannot cut the one number D11 needs.
-  parts.push(`exit ${exit}`);
-  return parts.join("\n");
-}
-
-function stripTrailingNewline(s: string): string {
-  return s.endsWith("\n") ? s.slice(0, -1) : s;
-}
-
-async function readCapped(
-  stream: ReadableStream<Uint8Array> | number | undefined | null,
-  max: number,
-): Promise<{ text: string; truncated: boolean }> {
-  if (stream === null || stream === undefined || typeof stream === "number") {
-    return { text: "", truncated: false };
-  }
-  const reader = stream.getReader();
-  const chunks: Uint8Array[] = [];
-  let n = 0;
-  let truncated = false;
-  while (true) {
-    const { done, value } = await reader.read();
-    if (done) break;
-    if (value === undefined) continue;
-    if (n >= max) {
-      truncated = true;
-      continue;
-    }
-    const take = Math.min(value.length, max - n);
-    chunks.push(take === value.length ? value : value.subarray(0, take));
-    n += take;
-    if (take < value.length) truncated = true;
-  }
-  const buf = new Uint8Array(n);
-  let off = 0;
-  for (const c of chunks) {
-    buf.set(c, off);
-    off += c.length;
-  }
-  return { text: new TextDecoder().decode(buf), truncated };
-}
-
-/** True when the whole submission is `@` or `@query`, so the TUI can pick. */
-export function bareAtQuery(text: string): string | null {
-  const m = /^@(\S*)$/.exec(text);
-  return m === null ? null : (m[1] ?? "");
-}
-
-export function isExactIndexedPath(index: FileIndex, query: string): boolean {
-  return query.length > 0 && index.paths.includes(query);
-}

package/src/apps/model-catalog.ts

@@ -1,69 +0,0 @@
-import { modelKey } from "../core/session-position.ts";
-import { asThinkingLevel, clampThinkingLevel, supportedThinkingLevels } from "../core/thinking.ts";
-import { createProvider, providerSessionId } from "../runtime/catalog.ts";
-import { scopedModels } from "../runtime/model-scope.ts";
-import { storedIsOAuth, type Resolved } from "../runtime/auth.ts";
-import { outputTokenBudget, type ModelSpec } from "../runtime/model.ts";
-import { providerAccess, setProviderAccess } from "../runtime/provider-access.ts";
-import { providerReplayKey } from "../runtime/model-replay.ts";
-import type { Provider, ProviderConfig } from "../runtime/provider.ts";
-import { retryHandler, type App } from "./startup.ts";
-
-export interface ModelCatalogStage {
-  readonly models: readonly ModelSpec[];
-  readonly config: ProviderConfig;
-  readonly credential: Resolved;
-  readonly next?: Provider;
-  readonly needsCut: boolean;
-  readonly warning?: string;
-}
-export interface ModelCatalogSelection {
-  readonly model?: string;
-  readonly provider?: string;
-  readonly thinking?: string;
-  readonly requireCredential?: boolean;
-  readonly providerFactory?: typeof createProvider;
-}
-
-/** Resolve and construct locally; publication and model requests belong to the checkpoint owner. */
-export function stageModelCatalog(app: App, models: readonly ModelSpec[], selection: ModelCatalogSelection = {}): ModelCatalogStage {
-  const previous = app.providerConfig.spec;
-  const requested = selection.model === undefined ? undefined : scopedModels([selection.model],
-    selection.provider ? models.filter(model => model.provider === selection.provider) : models, true).entries[0]?.model;
-  if (selection.model !== undefined && !requested) throw Error(`Unknown profile model: ${selection.provider ?? ""}/${selection.model}`);
-  const spec = requested ?? models.find(candidate => modelKey(candidate) === modelKey(previous));
-  if (!spec) {
-    const invalid = { ...previous }, warning = `${modelKey(previous)} is disabled or absent from the catalog; choose /model before sending`;
-    setProviderAccess(invalid, { invalid: warning });
-    return { models, config: { ...app.providerConfig, spec: invalid }, credential: { ok: false, reason: warning }, needsCut: false, warning };
-  }
-  const requestedThinking = selection.thinking ? asThinkingLevel(selection.thinking) : undefined;
-  if (selection.thinking && (!requestedThinking || !supportedThinkingLevels(spec).includes(requestedThinking))) throw Error(`thinking ${selection.thinking} is not supported by ${modelKey(spec)}`);
-  const effort = clampThinkingLevel(spec, requestedThinking ?? app.providerConfig.effort);
-  const unchanged = JSON.stringify([previous, providerAccess(previous)]) === JSON.stringify([spec, providerAccess(spec)]) && effort === app.providerConfig.effort;
-  const credential = selection.requireCredential || !unchanged ? app.credentialOf(spec) : app.credential;
-  if (selection.requireCredential && !credential.ok) throw Error(credential.reason);
-  if (unchanged) return { models, config: app.providerConfig, credential, needsCut: false };
-  const config = { ...app.providerConfig, spec, maxTokens: outputTokenBudget(spec), effort };
-  const next = (selection.providerFactory ?? createProvider)(config, credential.ok ? credential.key : "", retryHandler(app.io), {
-    sessionId: providerSessionId(app.session.config.logDir), effects: app.effects, oauth: !app.args.apiKey && storedIsOAuth(app.auth, spec.provider),
-  });
-  return { models, config, credential, next, needsCut: providerReplayKey(previous) !== providerReplayKey(spec) };
-}
-
-/** The caller has committed any required checkpoint before publishing these process-local views. */
-export function applyModelCatalog(app: App, stage: ModelCatalogStage): void {
-  if (stage.next) app.session.provider = stage.next;
-  app.providerConfig = stage.config; app.credential = stage.credential; app.catalog = stage.models;
-  if (stage.warning) app.io.say(app.io.palette.yellow(`  ${stage.warning}`));
-  if (app.ui) app.ui.settings = { ...app.ui.settings, thinking: stage.config.effort };
-}
-
-/** Publish the active profile with its directory after the shared staging path validates it. */
-export async function publishModelCatalog(app: App, models: readonly ModelSpec[], checkpointed = false): Promise<boolean> {
-  if (app.session.running) throw Error("cannot reload model configuration during a turn");
-  const stage = stageModelCatalog(app, models);
-  if (stage.next && stage.needsCut && !checkpointed) await app.session.switchModel(stage.next);
-  applyModelCatalog(app, stage);
-  return stage.needsCut && !checkpointed;
-}

package/src/apps/preferences.ts

@@ -1,20 +0,0 @@
-/** User intent owns personal defaults; CLI overrides and restored/extension state only own a session. */
-import { mergeSettings, type Settings } from "../core/settings.ts";
-import { writeUserSettings } from "../store/resources.ts";
-import { describeError } from "./render.ts";
-import type { App } from "./startup.ts";
-
-export type PreferenceOrigin = "user" | "session";
-
-export async function commitUserSettings(app: App, patch: Settings): Promise<boolean> {
-  const ui = app.ui;
-  if (!ui) return false;
-  ui.settings = mergeSettings({ builtin: ui.settings, user: patch });
-  try { await writeUserSettings(patch); }
-  catch (error) {
-    app.io.say(app.io.palette.yellow(`  The change is active in this session, but could not save settings for the next startup: ${describeError(error)}`));
-    return false;
-  }
-  ui.userOverrides = mergeSettings({ builtin: ui.userOverrides, user: patch });
-  return true;
-}

package/src/apps/project-trust.ts

@@ -1,9 +0,0 @@
-/** Project trust decisions; the picker itself is apps/ui/standalone.ts (startup) and apps/ui/app.ts (/trust). */
-import { dirname } from "node:path";
-import { saveTrust } from "../store/trust.ts";
-
-export type TrustChoice = "once" | "here" | "parent" | "never";
-export async function applyTrustChoice(workspace: string, choice: TrustChoice): Promise<boolean> {
-  if (choice !== "once") await saveTrust(choice === "parent" ? dirname(workspace) : workspace, choice !== "never");
-  return choice !== "never";
-}