agen-vektor 0.3.21 → 0.3.23

package/README.md

@@ -359,6 +359,7 @@ Every shell command is classified:
 | `vector-tui.methatech.eu.org` (VectorHead Free gateway) | Only if you pick the free tier; the shared provider key stays server-side, users never see it |
 | Brave / Exa / Serper | Only when you use the web-search tool with your own key |
 | `vector-tui.methatech.eu.org/v1/web-search` | Web search when you have NO search key of your own — the query is relayed by the gateway; your own key, when set, always takes precedence and bypasses the relay |
+| `vector-tui.methatech.eu.org/v1/e2b/run` | `e2b_run` tool — run a command in a disposable cloud sandbox (E2B VM) when the local machine is too weak/restricted; relayed by the gateway, no E2B key needed client-side |
 | Raw model catalog (public JSON) | To populate the free-tier model list |
 
 **Stored locally** (all in `~/.vector/`): `config.json` (preferences, no secrets), `credentials.json` (only keys *you* enter, file mode 0600), sessions, memory, logs. Nothing else is written anywhere.

package/dist/agent/agent.js

@@ -8,6 +8,7 @@ const search_1 = require("../tools/search");
 const shell_1 = require("../tools/shell");
 const git_1 = require("../tools/git");
 const web_1 = require("../tools/web");
+const e2b_1 = require("../tools/e2b");
 const extras_1 = require("../tools/extras");
 const apply_patch_1 = require("../tools/apply-patch");
 const permissions_1 = require("../security/permissions");
@@ -59,6 +60,9 @@ class Agent {
             (0, shell_1.createShellTool)(),
             (0, git_1.createGitTool)(),
             ...(0, web_1.createWebTools)(),
+            // E2B cloud sandbox (via gateway relay): e2b_run / e2b_status —
+            // eksekusi di VM cloud utk perangkat lemah, zero-config (key di gateway).
+            ...(0, e2b_1.createE2bTools)(),
             // Freebuff-style extras: glob, read_subtree, task_completed,
             // suggest_followups, render_ui.
             ...(0, extras_1.createExtrasTools)(),

package/dist/config/free-tier.js

@@ -59,16 +59,16 @@ function freeTierEnabled() {
 /** Provider id used in config.provider / providers map. */
 exports.FREE_PROVIDER_ID = 'vectorhead-free';
 /**
- * Default free model (cheap, gateway allowlist-friendly). 2026-09-07: BACK
- * to `glm-5.3-flash` — the gateway allowlist flipped back from the 7-model
- * Claude window to the api.b.ai set: live GET /v1/models now serves hy3,
- * glm-5.3-flash, qwen3.8-max, mimo-v2.5, so `claude-sonnet-4-6` (the
- * 2026-09-06-malam default) is the id that would 404 on fresh installs.
- * glm-5.3-flash verified live end-to-end via the relay (chat 200). History
- * of the same trap: `deepseek-ai/DeepSeek-V4-Flash` (first default), then
- * claude-sonnet-4-6, now glm-5.3-flash again.
+ * Default free model (cheap, gateway allowlist-friendly). 2026-09-13:
+ * `kilo-auto/free` — gateway di-cutover ke Kilo Code (sesi "pindahkan
+ * provider di dashboard admin pilih kilo code"); id lama `glm-5.3-flash`
+ * TIDAK ada di katalog Kilo → onboarding user baru 404 "model not found"
+ * (ketemu via smoke test 0.3.22). Router Kilo terverifikasi live end-to-end
+ * (chat 200, dijawab dots-3-note-preview:free). Riwayat trap yang sama:
+ * `deepseek-ai/DeepSeek-V4-Flash` → `claude-sonnet-4-6` → `glm-5.3-flash`
+ * (dua flip 2026-09-06/07) → sekarang kilo-auto/free.
  */
-exports.FREE_DEFAULT_MODEL = 'glm-5.3-flash';
+exports.FREE_DEFAULT_MODEL = 'kilo-auto/free';
 /** The providers-map entry for the free tier (idempotent — same shape always). */
 function freeProviderDef() {
     // When a catalog has been fetched in this process, the gateway URL and
@@ -94,18 +94,21 @@ function freeProviderDef() {
         },
         model: exports.FREE_DEFAULT_MODEL,
         models: Object.keys(models).length > 0 ? models : {
-            [exports.FREE_DEFAULT_MODEL]: { name: 'GLM 5.3 Flash (free)' },
+            [exports.FREE_DEFAULT_MODEL]: { name: 'Kilo Auto (free)' },
         },
     };
 }
 /**
  * Stale first-run defaults — migrated to FREE_DEFAULT_MODEL once on
  * ensureFreeProvider (only while the free provider is active). glm-5.3-flash
- * itself was legacy during the 2026-09-06 Claude window; since 2026-09-07 it
- * is the default again, so the stale set is the original deepseek default
- * plus that window's claude default (no longer in the gateway allowlist).
+ * jadi legacy 2026-09-13 (cutover Kilo — id tidak ada di katalog Kilo);
+ * deepseek default pertama; claude-sonnet-4-6 window 2026-09-06.
  */
-exports.FREE_LEGACY_MODELS = ['deepseek-ai/DeepSeek-V4-Flash', 'claude-sonnet-4-6'];
+exports.FREE_LEGACY_MODELS = [
+    'deepseek-ai/DeepSeek-V4-Flash',
+    'claude-sonnet-4-6',
+    'glm-5.3-flash',
+];
 /**
  * Ensure the free provider entry exists in the config's providers map
  * (create or repair — never touches unrelated providers). Also migrates an

package/dist/tools/e2b.js

@@ -0,0 +1,144 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.createE2bTools = createE2bTools;
+const credentials_1 = require("../config/credentials");
+const free_tier_1 = require("../config/free-tier");
+const GW_BASE = free_tier_1.FREE_GATEWAY_URL.replace(/\/v1$/, '');
+// Poll interval env-overridable (test memakai VECTOR_E2B_POLL_MS=10).
+const POLL_INTERVAL_MS = Math.max(10, Number(process.env.VECTOR_E2B_POLL_MS) || 3_000);
+const POLL_MAX_MS = 320_000; // > E2B_MAX_TIMEOUT_MS worker (300s) + margin
+const OUT_CAP = 20_000;
+async function postRun(command, timeoutMs) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 30_000);
+    try {
+        const res = await fetch(GW_BASE + '/v1/e2b/run', {
+            method: 'POST',
+            signal: controller.signal,
+            headers: { 'Content-Type': 'application/json', 'User-Agent': 'VectorHead-AI-Agent/0.1' },
+            body: JSON.stringify({ command, timeout_ms: timeoutMs }),
+        });
+        const data = (await res.json().catch(() => null));
+        return { res, data };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+async function fetchStatus(id) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), 20_000);
+    try {
+        const res = await fetch(GW_BASE + '/v1/e2b/status?id=' + encodeURIComponent(id), {
+            signal: controller.signal,
+            headers: { 'User-Agent': 'VectorHead-AI-Agent/0.1' },
+        });
+        const data = (await res.json().catch(() => null));
+        return { res, data };
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function formatResult(s) {
+    const exit = s.exitCode === null || s.exitCode === undefined ? '?' : s.exitCode;
+    let out = `exit ${exit}`;
+    if (s.stdout)
+        out += '\n' + s.stdout.slice(0, OUT_CAP);
+    if (s.stderr)
+        out += (s.stdout ? '\n[stderr]\n' : '') + s.stderr.slice(0, Math.min(OUT_CAP, 10_000));
+    return out;
+}
+async function pollUntilDone(id) {
+    const deadline = Date.now() + POLL_MAX_MS;
+    let last = null;
+    while (Date.now() < deadline) {
+        await new Promise((r) => setTimeout(r, POLL_INTERVAL_MS));
+        const { res, data } = await fetchStatus(id);
+        if (!res.ok || !data)
+            continue; // gesit — coba lagi sampai deadline
+        last = data;
+        if (data.status === 'done' || data.status === 'error')
+            return data;
+    }
+    return last;
+}
+function createE2bTools() {
+    return [
+        {
+            definition: {
+                name: 'e2b_run',
+                description: 'Run a shell command inside a disposable cloud sandbox (E2B VM via the VectorHead gateway relay) and wait for the result. Use when the local machine is too weak/restricted for a task — builds, installs, or tests that do not fit locally. Network is available in the sandbox. Returns exit code + stdout/stderr (this tool blocks until the command finishes; timeout default 120s, max 300s). Destructive commands (mkfs, fork bombs, pipe-to-shell) are rejected by the relay policy.',
+                parameters: {
+                    type: 'object',
+                    properties: {
+                        command: { type: 'string', description: 'The shell command to run in the sandbox (bash -lc; use && to chain)' },
+                        timeout_ms: { type: 'number', description: 'Timeout in ms (default 120000, max 300000)' },
+                    },
+                    required: ['command'],
+                },
+            },
+            async execute(args, ctx) {
+                const command = String(args.command || '').trim();
+                if (!command)
+                    return { output: 'ERROR: provide a "command"' };
+                const timeoutMs = Math.min(300_000, Math.max(5_000, Number(args.timeout_ms) || 120_000));
+                ctx.onActivity?.('e2b', `sandbox: ${command.slice(0, 80)}`);
+                const { res, data } = await postRun(command, timeoutMs);
+                if (!res.ok || !data || !data.id) {
+                    const why = data?.error ? ` — ${(0, credentials_1.redact)(data.error)}` : '';
+                    return { output: `ERROR: e2b relay HTTP ${res.status}${why}`, summary: 'e2b relay error' };
+                }
+                const done = await pollUntilDone(data.id);
+                if (!done) {
+                    return {
+                        output: `ERROR: e2b job ${data.id} belum selesai dan polling kehabisan waktu — cek manual: curl '${GW_BASE}/v1/e2b/status?id=${data.id}'`,
+                        summary: 'e2b polling timeout',
+                        data: { id: data.id },
+                    };
+                }
+                if (done.status === 'error') {
+                    return {
+                        output: `ERROR: e2b job failed${done.error ? ': ' + (0, credentials_1.redact)(done.error) : ''}`,
+                        summary: 'e2b job error',
+                        data: { id: data.id },
+                    };
+                }
+                const out = formatResult(done);
+                return {
+                    output: out,
+                    summary: `e2b sandbox → exit ${done.exitCode ?? '?'}`,
+                    data: { id: data.id, exitCode: done.exitCode, stdout: done.stdout, stderr: done.stderr },
+                };
+            },
+        },
+        {
+            definition: {
+                name: 'e2b_status',
+                description: 'Check the result of an E2B sandbox job by id (from e2b_run): status (running|done|error), exit code, stdout/stderr. Only needed when you kept an id and want the latest state without polling yourself.',
+                parameters: {
+                    type: 'object',
+                    properties: {
+                        id: { type: 'string', description: 'Job id returned by e2b_run' },
+                    },
+                    required: ['id'],
+                },
+            },
+            async execute(args) {
+                const id = String(args.id || '').trim();
+                if (!/^[A-Za-z0-9-]{8,80}$/.test(id))
+                    return { output: 'ERROR: invalid job id' };
+                const { res, data } = await fetchStatus(id);
+                if (!res.ok || !data) {
+                    const why = data?.error ? ` — ${(0, credentials_1.redact)(data.error)}` : '';
+                    return { output: `ERROR: e2b status HTTP ${res.status}${why}`, summary: 'e2b status error' };
+                }
+                return {
+                    output: data.status === 'done' || data.status === 'error' ? formatResult(data) : `status: ${data.status}`,
+                    summary: `e2b job ${id}: ${data.status}`,
+                    data,
+                };
+            },
+        },
+    ];
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agen-vektor",
-  "version": "0.3.21",
+  "version": "0.3.23",
   "description": "VectorHead (agen-vektor) — AI Coding Agent CLI/TUI for Linux & Termux. Multi-provider, tool calling, session, permission system.",
   "type": "commonjs",
   "bin": {