@withtruing/companion 0.13.2 → 0.14.0

package/README.md

@@ -175,8 +175,8 @@ your Claude subscription, not a separate API key.
 ## No code on your computer?
 
 If you can open the repo on GitHub but don't keep the code on this computer, the companion can
-keep its own copy for you. You need Git installed (https://git-scm.com/downloads) and, for
-`--backend cli`, Claude Code. Then run one command from any folder:
+access it temporarily when work needs it. You need Git installed (https://git-scm.com/downloads)
+and, for `--backend cli`, Claude Code. Then run one command from any folder:
 
 ```bash
 truing connect \
@@ -190,24 +190,26 @@ truing connect \
 `--branch <name>` to follow a branch other than the repo's main one.
 
 - **GitHub access.** If the repo was connected with **Connect GitHub** in the Console, the
-  companion uses that connection. It asks for a fresh, short-lived access pass just before each
-  download and never saves it on your computer. Otherwise, a browser window asks you to sign in
-  to GitHub on this computer and the companion uses that sign-in.
-- **You never touch the copy.** It lives in a hidden folder
-  (`~/.product-console-companion/repos/`). The companion brings it up to date before every check.
-  You don't need to open it, edit it or pull it.
-- **If GitHub stops accepting the sign-in**, `status` and the companion's log say "GitHub sign-in
-  needed". Fix it with:
+  companion asks for a fresh access pass for each operation and never saves it on your computer.
+  The connection is validated before it is saved.
+- **No permanent code copy.** When the Console enables temporary repository access, each task gets
+  an isolated copy that is removed when the task ends. `status` shows the repository identity,
+  not a folder. A Console that has not enabled the rollout continues using the earlier managed-copy
+  behavior until it is upgraded.
+- **If GitHub access stops working**, reconnect GitHub in the Console, then check it with:
 
   ```bash
   truing signin
   ```
 
-  This asks GitHub for the latest code with the sign-in window allowed, so you can sign in again.
-  The running companion picks it up on its own; no restart needed. Add `--repo owner/name` to
-  do just one repo.
-- **Disconnecting deletes the copy.** `disconnect` removes the companion's copy of every repo it
-  connected this way. Folders you made yourself are never deleted.
+  For a temporary connection this performs a bounded access check and stores no source. Add
+  `--repo owner/name` to check just one repo. Legacy managed copies retain their existing sign-in
+  flow while the rollout is off.
+- **Disconnecting removes the pairing.** Temporary connections have no code folder to remove.
+  When the rollout is enabled, an older companion-managed copy is removed after its repository
+  identity and ownership records are verified. Developer folders, foreign folders, linked paths,
+  and copies still referenced by a legacy pairing are never removed. Locked copies stay marked
+  `cleanup_pending` and are retried when the companion restarts.
 
 ## ChatGPT subscription through Codex CLI
 
@@ -215,7 +217,7 @@ truing connect \
 the companion's own Codex home. This is separate from your normal Codex login:
 
 ```powershell
-New-Item -ItemType Directory -Force "$HOME\.product-console-companion\codex-home" | Out-Null; $env:CODEX_HOME="$HOME\.product-console-companion\codex-home"; codex login; Remove-Item Env:CODEX_HOME
+New-Item -ItemType Directory -Force "$HOME\.product-console-companion\codex-home" | Out-Null; $env:CODEX_HOME="$HOME\.product-console-companion\codex-home"; codex.cmd login; Remove-Item Env:CODEX_HOME
 ```
 
 ```bash
@@ -321,13 +323,10 @@ The package's `publishConfig` makes this a public scoped-package publish. Then,
 GitHub Actions** for this repo (`fynchconsulting/product-console`) and the exact workflow filename
 `publish-companion.yml`, with no environment. No npm token is generated, pasted, or stored.
 
-After that, releases use `.github/workflows/publish-companion.yml` as before: bump the version in
-`package.json` in a normal PR, merge it, then either
-
-```bash
-git tag companion-v<the new version> && git push --tags
-```
-
-or trigger the workflow manually (Actions tab, or `gh workflow run publish-companion.yml`). Either
-way it publishes whatever's currently in `package.json` at that point — there's no separate
-"which version" input to get wrong.
+After that, releases are automatic (TRUING.md §9): any PR that changes `companion/` bumps the
+version in `companion/package.json` (`npm version patch --no-git-tag-version` in `companion/`, or
+`minor`), and CI fails the PR if it doesn't. Merging it to main runs
+`.github/workflows/publish-companion.yml`, which publishes that version to npm and tags the commit
+`companion-v<version>`. If the version is already on npm the publish is skipped. The workflow can
+also be run by hand (Actions tab, or `gh workflow run publish-companion.yml`) to recover from a
+failed run; it publishes whatever is in `package.json` at that point.

package/dist/anthropic-output-schema.js

@@ -0,0 +1,41 @@
+const REJECTED_ANTHROPIC_KEYWORDS = new Set([
+    'minimum',
+    'maximum',
+    'exclusiveMinimum',
+    'exclusiveMaximum',
+    'multipleOf',
+    'minLength',
+    'maxLength',
+    'minItems',
+    'maxItems',
+    'pattern',
+    'format',
+]);
+const SCHEMA_MAP_KEYWORDS = new Set(['properties', 'patternProperties', '$defs', 'definitions', 'dependentSchemas']);
+function converted(value, preserveKeys = false) {
+    if (Array.isArray(value))
+        return value.map((item) => converted(item));
+    if (value === null || typeof value !== 'object')
+        return value;
+    const convertedNode = Object.fromEntries(Object.entries(value)
+        .filter(([key]) => preserveKeys || !REJECTED_ANTHROPIC_KEYWORDS.has(key))
+        .map(([key, child]) => [key, converted(child, SCHEMA_MAP_KEYWORDS.has(key))]));
+    const type = value.type;
+    const enumValues = value.enum;
+    if (Array.isArray(type) && type.length === 2 && Array.isArray(enumValues) && enumValues.includes(null)) {
+        const nonNullType = type.find((item) => item !== 'null');
+        if (typeof nonNullType === 'string' && type.includes('null')) {
+            const annotations = Object.fromEntries(Object.entries(convertedNode)
+                .filter(([key]) => key !== 'type' && key !== 'enum'));
+            const nonNullEnum = enumValues.filter((item) => item !== null).map((item) => converted(item));
+            return nonNullEnum.length === 0
+                ? { ...annotations, type: 'null' }
+                : { ...annotations, anyOf: [{ type: nonNullType, enum: nonNullEnum }, { type: 'null' }] };
+        }
+    }
+    return convertedNode;
+}
+/** Keep this provider-boundary copy in sync with server/anthropic-output-schema.ts. */
+export function toAnthropicOutputSchema(schema) {
+    return converted(schema);
+}

package/dist/api-key-caller.js

@@ -11,18 +11,25 @@
  * two in sync by hand if either changes.
  */
 import Anthropic from '@anthropic-ai/sdk';
+import { toAnthropicOutputSchema } from './anthropic-output-schema.js';
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { buildLocalDesignContext } from './design-context.js';
 import { buildLocalRepoContext, listRepoFiles } from './local-scan.js';
 import { appendDiffToVolatile, prepareShipmentAnalysis } from './shipment.js';
-import { replyText, streamWithFallback } from './text-model.js';
+import { anthropicTextModel, replyText, streamWithFallback, } from './text-model.js';
 const MAX_CANDIDATE_FILES = 8;
 /** A skip threshold, not a truncation — a file over this is left OUT of what's read entirely
  *  (with a note in the log), rather than read and cut off partway through. The whole point of
  *  this backend is that what IS read is never truncated; this only guards against an
  *  accidentally-selected generated/binary/data file blowing up the prompt. */
 const MAX_FILE_BYTES = 512 * 1024;
+/** Dedicated whole-read entry point; the optional safe-mode contract cannot be omitted here. */
+export async function runWholeReadModelCall(client, request) {
+    if (!request.wholeRead)
+        throw new TypeError('whole_read_context_required');
+    return anthropicTextModel(client)(request);
+}
 /** Structured model-only call used by the investigation reader. The reader, not this call and
  * not the model, owns every repository read and evidence id. */
 export async function runStructuredModelCall(client, request) {
@@ -32,7 +39,7 @@ export async function runStructuredModelCall(client, request) {
         thinking: { type: 'adaptive' },
         output_config: {
             effort: request.effort,
-            format: { type: 'json_schema', schema: request.schema },
+            format: { type: 'json_schema', schema: toAnthropicOutputSchema(request.schema) },
         },
         system: request.system,
         messages: [{ role: 'user', content: request.prompt }],

package/dist/claude-cli-caller.js

@@ -20,7 +20,8 @@ import { assertSingleLineArguments } from './cli-arguments.js';
 import { spawnClaude } from './claude-binary.js';
 import { gitErrorMessage } from './sandbox.js';
 import { appendDiffToVolatile, prepareShipmentAnalysis } from './shipment.js';
-import { ModelRefusalError } from './text-model.js';
+import { ModelRefusalError, WholeReadTransportError, } from './text-model.js';
+import { isUsageLimitError, parseUsageLimitReset } from './usage-limit.js';
 /** Independent of --max-budget-usd — a dollar cap doesn't prevent a network-stall hang. No
  *  automatic retry on top of this (see cli.ts): auto-retry would risk double-spending the
  *  customer's own subscription/API quota. */
@@ -69,6 +70,51 @@ function promptWriteFailure(error) {
     wrapped.syscall = error.syscall;
     return wrapped;
 }
+function numericUsage(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return null;
+    const result = {};
+    for (const [key, candidate] of Object.entries(value)) {
+        if (typeof candidate === 'number' && Number.isFinite(candidate))
+            result[key] = candidate;
+    }
+    return Object.keys(result).length ? result : null;
+}
+function claudeMetadata(envelope, fallbackStopReason) {
+    const reportedModels = envelope.modelUsage ? Object.keys(envelope.modelUsage) : [];
+    const model = typeof envelope.model === 'string'
+        ? envelope.model
+        : reportedModels.length === 1 ? reportedModels[0] : null;
+    const usage = numericUsage(envelope.usage)
+        ?? (model && envelope.modelUsage ? numericUsage(envelope.modelUsage[model]) : null);
+    return { usage, metadata: {
+            finishReason: envelope.stop_reason ?? fallbackStopReason,
+            model,
+            usageAvailable: usage !== null,
+        } };
+}
+function safeClaudeFailure(envelope) {
+    const raw = `${envelope.subtype ?? ''} ${envelope.terminal_reason ?? ''} ${envelope.errors?.join(' ') ?? ''} ${envelope.result}`;
+    if (isUsageLimitError(raw) || envelope.terminal_reason === 'budget_exhausted'
+        || envelope.subtype === 'error_max_budget_usd') {
+        const reset = parseUsageLimitReset(raw);
+        return new WholeReadTransportError('usage_limit', 'claude_cli', reset?.toISOString());
+    }
+    if (/billing|credit|payment required/i.test(raw)) {
+        return new WholeReadTransportError('billing_exhausted', 'claude_cli');
+    }
+    if (/rate_limit_error|http 429|too many requests|overloaded/i.test(raw)) {
+        return new WholeReadTransportError('provider_rate_limit', 'claude_cli');
+    }
+    return new WholeReadTransportError('capability_failure', 'claude_cli');
+}
+async function terminateAndWait(child) {
+    if (child.exitCode !== null || child.signalCode !== null)
+        return;
+    const closed = new Promise((resolve) => child.once('close', () => resolve()));
+    child.kill();
+    await closed;
+}
 /** The model sometimes emits an absolute path matching the sandbox root, sometimes a
  *  POSIX-flavoured path as if --add-dir were mounted at "/" — normalize both down to a
  *  repo-relative path, matching api-key-caller.ts's own filesRead convention. */
@@ -81,7 +127,7 @@ function normalizeToRepoRelative(filePath, root) {
  *  sandbox as `repoPath`; connection-less calls grant no tools and need no sandbox.
  *  Returns whatever structured_output the model produced plus every file it actually read via
  *  the Read tool. Every exported per-kind function below is a thin wrapper over this. */
-async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
+async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false, wholeRead) {
     if (spec.stableDocumentBase64) {
         throw new Error("This task includes a PDF PRD, which the cli backend can't read yet. Pair with " +
             '--backend api-key instead, or re-upload the PRD as .md/.txt/.docx.');
@@ -89,7 +135,7 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
     const sandboxPath = connectionless ? tmpdir() : repoPath;
     let systemPromptDir = null;
     try {
-        systemPromptDir = await mkdtemp(join(tmpdir(), 'product-console-claude-system-'));
+        systemPromptDir = await mkdtemp(join(wholeRead?.attemptDirectory ?? tmpdir(), 'product-console-claude-system-'));
         const systemPromptPath = join(systemPromptDir, 'prompt.txt');
         await writeFile(systemPromptPath, spec.system, { encoding: 'utf8', mode: 0o600 });
         const emptyMcpConfigPath = await getEmptyMcpConfigPath();
@@ -140,7 +186,7 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
         // default here, so both are always real streams in practice; the ! just satisfies the type.
         const stdoutDecoder = new StringDecoder('utf8');
         const recordStdout = (text) => {
-            if (!text)
+            if (!text || wholeRead)
                 return;
             if (stdoutFirst.length < STDOUT_SAMPLE_CHARS) {
                 stdoutFirst += text.slice(0, STDOUT_SAMPLE_CHARS - stdoutFirst.length);
@@ -157,7 +203,8 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             child.kill();
         });
         child.stderr.on('data', (chunk) => {
-            stderrTail = (stderrTail + chunk.toString()).slice(-2000);
+            if (!wholeRead)
+                stderrTail = (stderrTail + chunk.toString()).slice(-2000);
         });
         const rl = createInterface({ input: child.stdout });
         const timer = setTimeout(() => {
@@ -172,7 +219,7 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             }
             catch {
                 unparseableLines++;
-                if (firstUnparseableLineLength === null) {
+                if (!wholeRead && firstUnparseableLineLength === null) {
                     firstUnparseableLineLength = line.length;
                     firstUnparseableLineFirst = line.slice(0, UNPARSEABLE_LINE_SAMPLE_CHARS);
                     firstUnparseableLineLast = line.slice(-UNPARSEABLE_LINE_SAMPLE_CHARS);
@@ -204,6 +251,12 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             child.on('error', reject); // e.g. ENOENT — claude isn't installed / not on PATH
             child.on('close', (code) => resolvePromise(code ?? 1));
         });
+        const unregisterReader = wholeRead?.registerReader({ cancel: () => terminateAndWait(child) });
+        const abort = () => { void terminateAndWait(child); };
+        if (wholeRead?.signal.aborted)
+            abort();
+        else
+            wholeRead?.signal.addEventListener('abort', abort, { once: true });
         try {
             if (spec.stableText)
                 child.stdin.write(spec.stableText + '\n\n');
@@ -214,13 +267,24 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             stdinError ??= error;
             child.kill();
         }
-        const exitCode = await exitPromise;
-        clearTimeout(timer);
+        let exitCode;
+        try {
+            exitCode = await exitPromise;
+        }
+        finally {
+            clearTimeout(timer);
+            wholeRead?.signal.removeEventListener('abort', abort);
+            unregisterReader?.();
+        }
+        if (wholeRead?.signal.aborted)
+            throw new WholeReadTransportError('cancelled', 'claude_cli');
         if (!resultEnvelope && timedOut) {
             throw new Error(`claude CLI took longer than ${WALL_CLOCK_TIMEOUT_MS / 60_000} minutes and was killed.`);
         }
         const capturedStdinError = stdinError;
         if (!resultEnvelope) {
+            if (wholeRead)
+                throw new WholeReadTransportError('capability_failure', 'claude_cli');
             if (capturedStdinError) {
                 throw promptWriteFailure(capturedStdinError);
             }
@@ -244,6 +308,25 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
                 `types: ${types}; raw stdout: ${stdoutSample}${unparseableSample}`);
         }
         const envelope = resultEnvelope;
+        if (wholeRead) {
+            if (envelope.is_error || envelope.terminal_reason === 'budget_exhausted'
+                || envelope.subtype === 'error_max_budget_usd')
+                throw safeClaudeFailure(envelope);
+            const metadata = claudeMetadata(envelope, lastStopReason);
+            if (metadata.metadata.finishReason === 'max_tokens') {
+                throw new WholeReadTransportError('output_truncated', 'claude_cli');
+            }
+            if (metadata.metadata.finishReason === 'refusal') {
+                throw new WholeReadTransportError('model_declined', 'claude_cli');
+            }
+            if (capturedStdinError)
+                throw new WholeReadTransportError('capability_failure', 'claude_cli');
+            const text = envelope.structured_output === undefined
+                ? envelope.result
+                : JSON.stringify(envelope.structured_output);
+            return { result: envelope.structured_output ?? envelope.result, filesRead: [],
+                reply: { text, usage: metadata.usage, metadata: metadata.metadata } };
+        }
         if (envelope.terminal_reason === 'budget_exhausted' || envelope.subtype === 'error_max_budget_usd') {
             throw new Error(`Exceeded the $${maxBudgetUsd.toFixed(2)} budget for this task (spent $${envelope.total_cost_usd.toFixed(4)} before stopping).`);
         }
@@ -271,6 +354,22 @@ async function runViaCli(spec, maxBudgetUsd, repoPath, connectionless = false) {
             await rm(systemPromptDir, { recursive: true, force: true });
     }
 }
+/** Whole-read model-only entry point: no tools, no raw child diagnostics, attempt-owned files. */
+export async function runWholeReadModelCallViaCli(request) {
+    if (!request.wholeRead)
+        throw new TypeError('whole_read_context_required');
+    const outcome = await runViaCli({
+        kind: 'whole-read',
+        model: request.model,
+        effort: request.effort,
+        maxTokens: request.maxTokens,
+        system: request.system,
+        stableText: request.stableText,
+        volatileText: request.text,
+        schema: request.schema,
+    }, INVESTIGATION_CALL_BUDGET_USD, request.wholeRead.attemptDirectory, true, request.wholeRead);
+    return outcome.reply;
+}
 /** The CLI is only a structured-output model transport for investigations. It gets no tools and
  * no repository directory; all evidence reads happen in investigation-reader.ts first. */
 export async function runStructuredModelCallViaCli(request) {