@vizuh/sabi 0.1.2 → 0.1.4

package/README.md

@@ -1,7 +1,12 @@
-# @vizuh/sabi
+# @vizuh/sabi: Command Code adapter
+
+This npm artifact is one Sabi adapter, not the whole Sabi product. Sabi also supports a local
+OpenAI-compatible proxy for OpenCode, Hermes, Prime Agent, Kilo and other clients, plus an
+experimental controller surface for Claude Code, Codex and Orca. See the
+[adapter directory](../../../docs/adapters/README.md) for the product map and evidence boundaries.
 
 Adaptive inference scheduling for [Command Code](https://commandcode.ai): a mod that plans each
-continuing round — model and reasoning effort — from the trajectory's own state (tool calls and
+continuing round, including model and reasoning effort, from the trajectory's own state (tool calls and
 their results, failure evidence, context size). Round 1 always runs on your session model; from
 round 2 on, a read round goes cheap, edits and tests go mid, and a failing tool escalates.
 
@@ -10,15 +15,16 @@ lives in the [repository](https://github.com/vizuh/sabi).
 
 The two paths are independent:
 
-- **Command Code mod:** no Sabi provider key and no proxy; it routes the subscription already
+- The Command Code mod needs no Sabi provider key or proxy. It routes the subscription already
   available to Command Code.
-- **Local proxy:** works with OpenCode, Hermes, Kilo and other OpenAI-compatible clients, using
-  OpenRouter, Ollama or another configured upstream.
+- The local proxy works with OpenCode, Hermes, Kilo, and other OpenAI-compatible clients. It uses
+  OpenRouter, Ollama, or another configured upstream.
 
 For the proxy, Sabi loads only the credential names referenced by `sabi.config.json`. Existing
 environment variables win, followed by `SABI_SECRETS_FILE`, the nearest workspace `secrets/.env`,
-and `~/.config/sabi/secrets.env` or `~/.config/sabi/.env`. It never copies secret values into a
-harness config, terminal, worktree, log or Git. Users who do not use Jev can set `judge.enabled` to
+and `~/.config/sabi/secrets.env` or `~/.config/sabi/.env`. It does not copy loaded values into generated harness configuration or logs. If you use a workspace
+secrets/.env, that source file is already in the worktree: keep it out of version control, add it to
+.gitignore, and protect its file permissions. Users who do not use Jev can set `judge.enabled` to
 `false`; users without a central secrets file can keep exporting provider variables normally.
 
 ## Install
@@ -43,7 +49,7 @@ cmd mods remove sabi
 
 The package ships a default `sabi.config.json` next to the bundle, so it works with no setup.
 To change tiers, policy or telemetry, put your own `sabi.config.json` in the project you run in,
-or at `~/.config/sabi/sabi.config.json` — both take precedence over the shipped default (or set
+or at `~/.config/sabi/sabi.config.json`; both take precedence over the shipped default (or set
 `SABI_CONFIG` to point at one explicitly).
 
 `harness.tiers` defaults to the strongest Command Code ids available from the Go plan up. A model

package/mod/sabi.mjs

@@ -1,4 +1,4 @@
-// @vizuh/sabi 0.1.2 — generated by pack.mjs from packages/adapters/command-code/mod/sabi.ts.
+// @vizuh/sabi 0.1.4 — generated by pack.mjs from packages/adapters/command-code/mod/sabi.ts.
 // Source and docs: https://github.com/vizuh/sabi
 
 // packages/core/src/state.ts
@@ -331,8 +331,8 @@ function servesInputModalities(declared, required) {
   return required.every((modality) => declared.includes(modality));
 }
 function firstServingTier(tiers, required, declared) {
-  for (const [name, tier] of Object.entries(tiers)) {
-    if (servesInputModalities(declared(tier), required)) return name;
+  for (const name of Object.keys(tiers).sort()) {
+    if (servesInputModalities(declared(tiers[name]), required)) return name;
   }
   return void 0;
 }
@@ -441,6 +441,9 @@ function validateModelMetadata(value, label) {
       if (!Array.isArray(items) || items.some((item) => typeof item !== "string" || !item.trim())) {
         fail(`capabilities.${field}`, "must be an array of nonempty strings");
       }
+      if ((field === "inputModalities" || field === "outputModalities") && items.length === 0) {
+        fail(`capabilities.${field}`, "must not be empty");
+      }
       const strings = items;
       if (new Set(strings).size !== strings.length) fail(`capabilities.${field}`, "must not contain duplicates");
       const allowed = field.endsWith("Modalities") ? MODALITIES : field === "structuredOutput" ? ["json_object", "json_schema"] : void 0;
@@ -530,11 +533,30 @@ function validateConfig(value, source = "<inline>") {
       throw new Error(`Sabi config ${source}: alias '${alias}' targets unknown tier '${target}'`);
     }
   }
+  const knownRules = new Set(POLICY_ORDER);
   for (const [condition, tier] of Object.entries(policy)) {
+    if (!knownRules.has(condition)) {
+      throw new Error(`Sabi config ${source}: policy rule '${condition}' is not a known rule (${POLICY_ORDER.join(", ")})`);
+    }
     if (typeof tier !== "string" || tier !== "off" && !Object.hasOwn(models, tier)) {
       throw new Error(`Sabi config ${source}: policy rule '${condition}' targets unknown tier '${tier}'`);
     }
   }
+  if (Object.values(aliases).includes("auto")) {
+    const fallbackTier = typeof policy.unclassified === "string" && policy.unclassified !== "off" ? policy.unclassified : "cheap";
+    if (!Object.hasOwn(models, fallbackTier)) {
+      throw new Error(`Sabi config ${source}: policy.unclassified must resolve to a declared tier (got '${String(policy.unclassified)}')`);
+    }
+  }
+  const transportFallback = config.transportFallback;
+  if (transportFallback !== void 0) {
+    if (!isObject(transportFallback)) {
+      throw new Error(`Sabi config ${source}: transportFallback must be an object`);
+    }
+    if (transportFallback.enabled !== void 0 && typeof transportFallback.enabled !== "boolean") {
+      throw new Error(`Sabi config ${source}: transportFallback.enabled must be a boolean`);
+    }
+  }
   const judge = config.judge;
   if (judge !== void 0) {
     if (typeof judge !== "object" || judge === null || typeof judge.enabled !== "boolean") {
@@ -556,6 +578,14 @@ function validateConfig(value, source = "<inline>") {
         if (!Array.isArray(judge.callOn) || judge.callOn.some((rule) => typeof rule !== "string")) {
           throw new Error(`Sabi config ${source}: judge.callOn must be an array of policy rule names`);
         }
+        for (const rule of judge.callOn) {
+          if (!knownRules.has(rule)) {
+            throw new Error(`Sabi config ${source}: judge.callOn rule '${rule}' is not a known rule (${POLICY_ORDER.join(", ")})`);
+          }
+        }
+      }
+      if (judge.includeSnippets !== void 0 && typeof judge.includeSnippets !== "boolean") {
+        throw new Error(`Sabi config ${source}: judge.includeSnippets must be a boolean`);
       }
       for (const [name, value2] of Object.entries(judge.thresholds ?? {})) {
         if (typeof value2 !== "number" || value2 < 0 || value2 > 1) {
@@ -589,6 +619,31 @@ function validateConfig(value, source = "<inline>") {
       throw new Error(`Sabi config ${source}: telemetry.captureChars must be a positive number`);
     }
   }
+  const controller = config.controller;
+  if (controller !== void 0) {
+    if (!isObject(controller)) throw new Error(`Sabi config ${source}: controller must be an object`);
+    const controllerFields = /* @__PURE__ */ new Set(["preferredHarnesses", "harnesses"]);
+    for (const field of Object.keys(controller)) {
+      if (!controllerFields.has(field)) throw new Error(`Sabi config ${source}: controller.${field} is not a supported field`);
+    }
+    const validateStrings = (value2, label) => {
+      if (!Array.isArray(value2) || value2.some((item) => typeof item !== "string" || !item.trim())) {
+        throw new Error(`Sabi config ${source}: ${label} must be an array of nonempty strings`);
+      }
+      if (new Set(value2).size !== value2.length) throw new Error(`Sabi config ${source}: ${label} must not contain duplicates`);
+    };
+    if (controller.preferredHarnesses !== void 0) validateStrings(controller.preferredHarnesses, "controller.preferredHarnesses");
+    if (controller.harnesses !== void 0) {
+      if (!isObject(controller.harnesses)) throw new Error(`Sabi config ${source}: controller.harnesses must be an object`);
+      for (const [harnessName, settings] of Object.entries(controller.harnesses)) {
+        if (!isObject(settings)) throw new Error(`Sabi config ${source}: controller.harnesses.${harnessName} must be an object`);
+        for (const field of Object.keys(settings)) {
+          if (field !== "preferredModels") throw new Error(`Sabi config ${source}: controller.harnesses.${harnessName}.${field} is not a supported field`);
+        }
+        if (settings.preferredModels !== void 0) validateStrings(settings.preferredModels, `controller.harnesses.${harnessName}.preferredModels`);
+      }
+    }
+  }
   const harness = config.harness;
   if (harness !== void 0) {
     if (typeof harness !== "object" || harness === null) {
@@ -607,11 +662,131 @@ function validateConfig(value, source = "<inline>") {
       if (tier.minPlan !== void 0 && typeof tier.minPlan !== "string") {
         throw new Error(`Sabi config ${source}: harness.tiers.${tierName}.minPlan must be a string`);
       }
+      if (tier.inputModalities !== void 0) {
+        if (!Array.isArray(tier.inputModalities) || tier.inputModalities.length === 0 || tier.inputModalities.some((modality) => typeof modality !== "string" || !MODALITIES.includes(modality))) {
+          throw new Error(`Sabi config ${source}: harness.tiers.${tierName}.inputModalities must be a nonempty array of: ${MODALITIES.join(", ")}`);
+        }
+        if (new Set(tier.inputModalities).size !== tier.inputModalities.length) {
+          throw new Error(`Sabi config ${source}: harness.tiers.${tierName}.inputModalities must not contain duplicates`);
+        }
+      }
+      if (tier.contextWindow !== void 0 && (typeof tier.contextWindow !== "number" || !Number.isSafeInteger(tier.contextWindow) || tier.contextWindow < 1)) {
+        throw new Error(`Sabi config ${source}: harness.tiers.${tierName}.contextWindow must be a safe integer >= 1`);
+      }
     }
   }
   return { ...config, upstreams, models, aliases, policy };
 }
 
+// packages/core/src/log.ts
+import { appendFileSync, chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
+import { createHmac, randomBytes, randomUUID } from "node:crypto";
+import os2 from "node:os";
+import path2 from "node:path";
+function defaultLogPath() {
+  return process.env.SABI_LOG?.trim() || path2.join(process.cwd(), ".sabi", "decisions.jsonl");
+}
+function appendPrivateLine(logFile, line) {
+  const dir = path2.dirname(logFile);
+  mkdirSync(dir, { recursive: true, mode: 448 });
+  appendFileSync(logFile, line, { mode: 384 });
+  if (process.platform !== "win32") {
+    chmodSync(dir, 448);
+    chmodSync(logFile, 384);
+  }
+}
+function identitySaltPath(env = process.env) {
+  const override = env.SABI_ID_SALT_FILE?.trim();
+  if (override) return override;
+  const base = env.XDG_CONFIG_HOME?.trim() || path2.join(os2.homedir(), ".config");
+  return path2.join(base, "sabi", ".identity-salt");
+}
+var cachedSalt;
+var cachedSaltSource;
+var ephemeralSaltWarned = false;
+function loadOrCreateSalt(source) {
+  try {
+    if (existsSync2(source)) {
+      const stored = readFileSync2(source, "utf8").trim();
+      if (stored.length >= 16) return stored;
+    }
+    const fresh = randomBytes(32).toString("hex");
+    mkdirSync(path2.dirname(source), { recursive: true });
+    writeFileSync(source, `${fresh}
+`, { mode: 384 });
+    try {
+      chmodSync(source, 384);
+    } catch {
+    }
+    return fresh;
+  } catch {
+    return void 0;
+  }
+}
+function getIdentitySalt(env = process.env) {
+  const override = env.SABI_ID_SALT?.trim();
+  if (override) return override;
+  const source = identitySaltPath(env);
+  if (cachedSalt !== void 0 && cachedSaltSource === source) return cachedSalt;
+  const salt = loadOrCreateSalt(source);
+  if (salt === void 0) {
+    if (!ephemeralSaltWarned) {
+      ephemeralSaltWarned = true;
+      console.warn(`Sabi: identity salt at ${source} is unreadable \u2014 using an ephemeral per-process salt`);
+    }
+    cachedSalt = randomBytes(32).toString("hex");
+    cachedSaltSource = source;
+    return cachedSalt;
+  }
+  cachedSalt = salt;
+  cachedSaltSource = source;
+  return salt;
+}
+var logWriteFailures = 0;
+var warnedLogFiles = /* @__PURE__ */ new Set();
+function logWriteFailurePath(logFile) {
+  return `${logFile}.write-failures.json`;
+}
+function recordLogWriteFailure(logFile, error) {
+  logWriteFailures += 1;
+  if (!warnedLogFiles.has(logFile)) {
+    warnedLogFiles.add(logFile);
+    console.warn(`Sabi: could not append to the decision log at ${logFile}: ${error?.message ?? error} (telemetry degraded, will retry next round)`);
+  }
+  try {
+    const sidecar = logWriteFailurePath(logFile);
+    let failures = 0;
+    try {
+      const prior = JSON.parse(readFileSync2(sidecar, "utf8"));
+      if (typeof prior.failures === "number" && Number.isFinite(prior.failures)) failures = Math.floor(prior.failures);
+    } catch {
+    }
+    const state = {
+      failures: failures + 1,
+      lastTs: (/* @__PURE__ */ new Date()).toISOString(),
+      lastError: String(error?.message ?? error).slice(0, 120)
+    };
+    mkdirSync(path2.dirname(sidecar), { recursive: true });
+    writeFileSync(sidecar, `${JSON.stringify(state)}
+`);
+  } catch {
+  }
+}
+function appendDecision(record, logFile = defaultLogPath()) {
+  try {
+    appendPrivateLine(logFile, `${JSON.stringify(record)}
+`);
+  } catch (error) {
+    recordLogWriteFailure(logFile, error);
+  }
+}
+function hashIdentity(kind, ...parts) {
+  return createHmac("sha256", getIdentitySalt()).update(JSON.stringify([kind, ...parts])).digest("hex");
+}
+function sessionIdFor(session, client = "unknown") {
+  return session === void 0 ? randomUUID() : hashIdentity("session", client, session);
+}
+
 // packages/core/src/harness.ts
 function roundKindOf(round, calls) {
   if (round.assistantTurns === 0 || round.lastRole === "user") return "first-turn";
@@ -733,8 +908,10 @@ function sanitizeReason(reason, policy) {
 import * as readline from "node:readline/promises";
 
 // packages/adapters/command-code/mod/sabi.ts
+import path3 from "node:path";
 var MOD_ID = "sabi";
 var DECISION_TYPE = "sabi/decision";
+var CLIENT_ID = "command-code";
 function readLedger(state) {
   const raw = state.modState?.[MOD_ID] ?? {};
   return {
@@ -746,7 +923,8 @@ function readLedger(state) {
     toolNames: Array.isArray(raw.toolNames) ? raw.toolNames : [],
     hasTools: raw.hasTools === true,
     lastModel: raw.lastModel,
-    lastUsage: raw.lastUsage
+    lastUsage: raw.lastUsage,
+    sessionId: typeof raw.sessionId === "string" ? raw.sessionId : void 0
   };
 }
 function writeLedger(state, ledger) {
@@ -755,6 +933,29 @@ function writeLedger(state, ledger) {
 function compactedSince(ledger, stats) {
   return ledger.messageCount > 0 && stats.messageCount > 0 && stats.messageCount < ledger.messageCount;
 }
+function hashedToolNames(names) {
+  return names.map((name) => hashIdentity("tool", name));
+}
+function toUsageTotals(usage) {
+  if (!usage) return void 0;
+  const validTokens = (value) => typeof value === "number" && Number.isSafeInteger(value) && value >= 0;
+  if (!validTokens(usage.inputTokens) || !validTokens(usage.outputTokens)) return void 0;
+  const cachedTokens = usage.cachedInputTokens === void 0 ? 0 : usage.cachedInputTokens;
+  if (!validTokens(cachedTokens) || cachedTokens > usage.inputTokens) return void 0;
+  const promptTokens = usage.inputTokens;
+  const completionTokens = usage.outputTokens;
+  const totalTokens = promptTokens + completionTokens;
+  if (!Number.isSafeInteger(totalTokens)) return void 0;
+  return {
+    promptTokens,
+    completionTokens,
+    cachedTokens,
+    totalTokens
+  };
+}
+function logPathFor(ctx) {
+  return ctx?.cwd?.trim() ? path3.join(ctx.cwd, ".sabi", "decisions.jsonl") : void 0;
+}
 function sabi(cmd) {
   let config;
   try {
@@ -785,6 +986,9 @@ function sabi(cmd) {
       nextPlan = void 0;
       servedBy = void 0;
       const ledger = readLedger(state);
+      if (!ledger.sessionId) {
+        ledger.sessionId = sessionIdFor(void 0, CLIENT_ID);
+      }
       return writeLedger(state, { ...ledger, rounds: turnNumber });
     },
     // Sabi observes tool outcomes and never rewrites what the model sees.
@@ -847,7 +1051,7 @@ function sabi(cmd) {
         lastUsage: usedThisTurn ? usage : void 0
       };
       previousFailure = adopted ? { failure: adopted.state.failure, failureEvidence: adopted.state.failureEvidence } : void 0;
-      recordDecision(ctx, {
+      recordCustomEntry(ctx, {
         turn: turnNumber,
         planned: servingPlan ? {
           tier: servingPlan.tier,
@@ -869,11 +1073,49 @@ function sabi(cmd) {
         // Decision records never embed raw tool output by default; snippet capture is opt-in.
         captureSnippets: telemetry.captureSnippets
       });
+      if (servingPlan) {
+        const sessionId = ledger.sessionId ?? sessionIdFor(void 0, CLIENT_ID);
+        const usageTotals = toUsageTotals(usage);
+        const decision = {
+          ts: (/* @__PURE__ */ new Date()).toISOString(),
+          sessionId,
+          // sessionKnown stays false: the host does not expose a real session ID to the mod.
+          client: CLIENT_ID,
+          turnId: hashIdentity("turn", sessionId, String(turnNumber)),
+          servedModel: servedBy ?? void 0,
+          alias: "sabi-code",
+          mode: "auto",
+          rule: servingPlan.rule,
+          tier: servingPlan.tier,
+          reason: sanitizeReason(String(servingPlan.reason ?? ""), telemetry),
+          // This is the host adapter, not a provider entitlement claim.
+          upstream: CLIENT_ID,
+          upstreamModel: servingPlan.model,
+          stream: false,
+          state: {
+            ...servingPlan.state,
+            // Hash tool names; never persist raw tool outputs or args.
+            toolNames: hashedToolNames(servingPlan.state.toolNames),
+            lastToolNames: hashedToolNames(servingPlan.state.lastToolNames)
+          },
+          sessionKnown: false,
+          ...usageTotals ? { usage: usageTotals } : {},
+          // outcome means the model request round completed, not that the whole task succeeded.
+          outcome: "ok"
+        };
+        const logFile = logPathFor(ctx);
+        if (logFile) {
+          try {
+            appendDecision(decision, logFile);
+          } catch {
+          }
+        }
+      }
       return writeLedger(state, next);
     }
   });
 }
-function recordDecision(ctx, data) {
+function recordCustomEntry(ctx, data) {
   ctx?.session?.appendCustomEntry({ customType: DECISION_TYPE, data });
 }
 export {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizuh/sabi",
-  "version": "0.1.2",
+  "version": "0.1.4",
   "description": "Adaptive inference scheduling for Command Code: one bundled mod that routes each continuing round by model, effort and trajectory state.",
   "type": "module",
   "license": "MIT",

package/sabi.config.json

@@ -1,5 +1,5 @@
 {
-  "provenance": "Model ids, context windows and prices verified live from https://openrouter.ai/api/v1/models on 2026-09-18; input modalities for the same ids verified from the same endpoint the same day (`architecture.input_modalities`). Prices are USD per 1M tokens. Declared modalities are enforced: an undeclared capability is unknown, a declared one is binding.",
+  "provenance": "Model ids, context windows, output limits and prices verified live from https://openrouter.ai/api/v1/models on 2026-09-20; input modalities for the same ids verified from the same endpoint. Prices are USD per 1M tokens. Declared modalities are enforced: an undeclared capability is unknown, a declared one is binding.",
   "server": { "host": "127.0.0.1", "port": 8787 },
   "upstreams": {
     "openrouter": {
@@ -22,6 +22,7 @@
       "upstream": "openrouter",
       "model": "deepseek/deepseek-v4-flash-0731",
       "contextWindow": 1310720,
+      "maxOutputTokens": 943718,
       "capabilities": { "inputModalities": ["text"] },
       "cost": { "input": 0.06, "output": 0.12, "cacheRead": 0.012 }
     },
@@ -29,6 +30,7 @@
       "upstream": "openrouter",
       "model": "openai/gpt-5.6-luna",
       "contextWindow": 1050000,
+      "maxOutputTokens": 128000,
       "capabilities": { "inputModalities": ["text", "image", "file"] },
       "cost": { "input": 0.2, "output": 1.2, "cacheRead": 0.02 }
     },
@@ -36,6 +38,7 @@
       "upstream": "openrouter",
       "model": "anthropic/claude-sonnet-5",
       "contextWindow": 1000000,
+      "maxOutputTokens": 128000,
       "capabilities": { "inputModalities": ["text", "image", "file"] },
       "cost": { "input": 2, "output": 10, "cacheRead": 0.2 }
     },
@@ -65,11 +68,21 @@
     "exploration": "cheap",
     "unclassified": "cheap"
   },
+  "transportFallback": {
+    "enabled": false
+  },
   "telemetry": {
     "allowlistOnly": true,
     "captureSnippets": false,
     "captureChars": 800
   },
+  "controller": {
+    "preferredHarnesses": ["opencode", "command-code", "claude", "codex", "hermes"],
+    "harnesses": {
+      "command-code": { "preferredModels": ["moonshotai/kimi-k3"] },
+      "opencode": { "preferredModels": ["opencode-go/kimi-k3"] }
+    }
+  },
   "judge": {
     "enabled": true,
     "baseURL": "https://api.typesafe.ai/v1",