blyuecode 0.1.9 → 0.1.11

package/dist/core/agent.js

@@ -1,30 +1,54 @@
 import { Provider } from './provider.js';
 import { getToolDefs, executeTool } from './tools.js';
+import { loadSession, saveSession, clearSession } from './session.js';
+const SYSTEM_PROMPT = 'You are BLYUE, a coding assistant running in a terminal. ' +
+    'Use tools to read, write, and run commands. ' +
+    'If n8n tools are available, you can also manage n8n workflows. ' +
+    'Always explain what you are doing. Be concise.';
 export class Agent {
     provider = null;
+    messages;
+    constructor(resume = true) {
+        const sys = { role: 'system', content: SYSTEM_PROMPT };
+        const history = resume ? loadSession() : null;
+        if (history && history.length > 0) {
+            this.messages = [sys, ...history];
+        }
+        else {
+            this.messages = [sys];
+        }
+    }
     getProvider() {
         if (!this.provider)
             this.provider = new Provider();
         return this.provider;
     }
-    messages = [
-        {
-            role: 'system',
-            content: 'You are BLYUE, a coding assistant running in a terminal. ' +
-                'Use tools to read, write, and run commands. ' +
-                'If n8n tools are available, you can also manage n8n workflows. ' +
-                'Always explain what you are doing. Be concise.',
-        },
-    ];
+    persist() {
+        try {
+            saveSession(this.messages.slice(1)); // skip system prompt
+        }
+        catch { }
+    }
+    historySize() {
+        return this.messages.length - 1;
+    }
+    clear() {
+        this.messages = [{ role: 'system', content: SYSTEM_PROMPT }];
+        clearSession();
+    }
     async *run(userInput) {
         this.messages.push({ role: 'user', content: userInput });
+        this.persist();
         while (true) {
             const tools = getToolDefs();
             const res = await this.getProvider().chat(this.messages, tools);
-            if (res.content)
+            if (res.content) {
                 yield res.content;
-            if (res.toolCalls.length === 0)
+            }
+            if (res.toolCalls.length === 0) {
+                this.persist();
                 break;
+            }
             this.messages.push({
                 role: 'assistant',
                 content: res.content,
@@ -50,6 +74,7 @@ export class Agent {
                 const preview = result.length > 500 ? result.slice(0, 500) + '...' : result;
                 yield '[Result]: ' + preview + '\n';
             }
+            this.persist();
         }
     }
 }

package/dist/core/diff.js

@@ -0,0 +1,63 @@
+// Simple LCS-based line diff. Good enough for previews.
+export function lineDiff(oldText, newText) {
+    const a = oldText.length ? oldText.split('\n') : [];
+    const b = newText.length ? newText.split('\n') : [];
+    const m = a.length;
+    const n = b.length;
+    // LCS table
+    const dp = Array.from({ length: m + 1 }, () => new Array(n + 1).fill(0));
+    for (let i = m - 1; i >= 0; i--) {
+        for (let j = n - 1; j >= 0; j--) {
+            if (a[i] === b[j])
+                dp[i][j] = dp[i + 1][j + 1] + 1;
+            else
+                dp[i][j] = Math.max(dp[i + 1][j], dp[i][j + 1]);
+        }
+    }
+    const out = [];
+    let i = 0;
+    let j = 0;
+    while (i < m && j < n) {
+        if (a[i] === b[j]) {
+            out.push({ type: 'same', text: a[i] });
+            i++;
+            j++;
+        }
+        else if (dp[i + 1][j] >= dp[i][j + 1]) {
+            out.push({ type: 'remove', text: a[i] });
+            i++;
+        }
+        else {
+            out.push({ type: 'add', text: b[j] });
+            j++;
+        }
+    }
+    while (i < m)
+        out.push({ type: 'remove', text: a[i++] });
+    while (j < n)
+        out.push({ type: 'add', text: b[j++] });
+    return out;
+}
+// Compact display: only show changed regions with context
+export function compactDiff(diff, context = 2) {
+    const keep = new Set();
+    diff.forEach((d, idx) => {
+        if (d.type !== 'same') {
+            for (let k = Math.max(0, idx - context); k <= Math.min(diff.length - 1, idx + context); k++) {
+                keep.add(k);
+            }
+        }
+    });
+    const out = [];
+    let lastKept = -1;
+    for (let i = 0; i < diff.length; i++) {
+        if (keep.has(i)) {
+            if (lastKept !== -1 && i > lastKept + 1) {
+                out.push({ type: 'same', text: '…' });
+            }
+            out.push(diff[i]);
+            lastKept = i;
+        }
+    }
+    return out;
+}

package/dist/core/permission.js

@@ -0,0 +1,44 @@
+class PermissionBroker {
+    pending = null;
+    // Session-scoped "always allow" set (cleared on restart)
+    alwaysAllow = new Set();
+    listeners = new Set();
+    nextId = 0;
+    subscribe(fn) {
+        this.listeners.add(fn);
+        // Immediately notify with current state
+        fn(this.pending?.req ?? null);
+        return () => this.listeners.delete(fn);
+    }
+    notify(req) {
+        for (const fn of this.listeners)
+            fn(req);
+    }
+    isAlwaysAllowed(tool) {
+        return this.alwaysAllow.has(tool);
+    }
+    async ask(req) {
+        if (this.alwaysAllow.has(req.tool))
+            return 'yes';
+        const id = `p${++this.nextId}`;
+        const full = { ...req, id };
+        return new Promise((resolve) => {
+            this.pending = { req: full, resolve };
+            this.notify(full);
+        });
+    }
+    answer(a) {
+        if (!this.pending)
+            return;
+        const { req, resolve } = this.pending;
+        if (a === 'always')
+            this.alwaysAllow.add(req.tool);
+        this.pending = null;
+        this.notify(null);
+        resolve(a);
+    }
+    resetSession() {
+        this.alwaysAllow.clear();
+    }
+}
+export const permissions = new PermissionBroker();

package/dist/core/provider.js

@@ -1,4 +1,10 @@
 import OpenAI from 'openai';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { redact } from './redact.js';
+const DEBUG_DIR = path.join(os.homedir(), '.blyue');
+const LAST_REQUEST = path.join(DEBUG_DIR, 'last-request.json');
 export class Provider {
     client;
     model;
@@ -12,14 +18,46 @@ export class Provider {
             baseURL: process.env.OPENAI_BASE_URL,
         });
     }
+    sanitize(messages) {
+        let redactedCount = 0;
+        const out = messages.map((m) => {
+            if (typeof m.content !== 'string')
+                return m;
+            const { text, count } = redact(m.content);
+            redactedCount += count;
+            return { ...m, content: text };
+        });
+        return { messages: out, redactedCount };
+    }
+    writeDebug(payload) {
+        try {
+            if (!fs.existsSync(DEBUG_DIR))
+                fs.mkdirSync(DEBUG_DIR, { recursive: true });
+            fs.writeFileSync(LAST_REQUEST, JSON.stringify(payload, null, 2));
+        }
+        catch { }
+    }
     async chat(messages, tools) {
+        const { messages: safeMessages, redactedCount } = this.sanitize(messages);
         try {
             const res = await this.client.chat.completions.create({
                 model: this.model,
-                messages: messages,
+                messages: safeMessages,
                 tools,
                 tool_choice: 'auto',
             });
+            // Log debug info after successful call
+            const totalBytes = JSON.stringify(safeMessages).length;
+            this.writeDebug({
+                model: this.model,
+                baseUrl: process.env.OPENAI_BASE_URL || 'https://api.openai.com/v1',
+                messages: safeMessages,
+                approxTokens: Math.round(totalBytes / 4),
+                approxBytes: totalBytes,
+                messageCount: safeMessages.length,
+                redactedCount,
+                timestamp: new Date().toISOString(),
+            });
             const msg = res.choices[0].message;
             return {
                 content: msg.content,

package/dist/core/redact.js

@@ -0,0 +1,42 @@
+const PATTERNS = [
+    // OpenAI / OpenRouter
+    [/sk-or-v1-[a-zA-Z0-9]{32,}/g, 'sk-or-v1-***REDACTED***'],
+    [/sk-[a-zA-Z0-9]{20,}/g, 'sk-***REDACTED***'],
+    // Anthropic
+    [/sk-ant-[a-zA-Z0-9\-_]{20,}/g, 'sk-ant-***REDACTED***'],
+    // GitHub
+    [/ghp_[a-zA-Z0-9]{36,}/g, 'ghp_***REDACTED***'],
+    [/gho_[a-zA-Z0-9]{36,}/g, 'gho_***REDACTED***'],
+    [/ghs_[a-zA-Z0-9]{36,}/g, 'ghs_***REDACTED***'],
+    [/github_pat_[a-zA-Z0-9_]{60,}/g, 'github_pat_***REDACTED***'],
+    // AWS
+    [/AKIA[0-9A-Z]{16}/g, 'AKIA***REDACTED***'],
+    [/aws_secret_access_key\s*=\s*[A-Za-z0-9/+=]{40}/gi, 'aws_secret_access_key=***REDACTED***'],
+    // Google
+    [/AIza[0-9A-Za-z_\-]{35}/g, 'AIza***REDACTED***'],
+    // Slack
+    [/xox[baprs]-[a-zA-Z0-9-]{10,}/g, 'xox***REDACTED***'],
+    // Stripe
+    [/sk_live_[a-zA-Z0-9]{24,}/g, 'sk_live_***REDACTED***'],
+    [/pk_live_[a-zA-Z0-9]{24,}/g, 'pk_live_***REDACTED***'],
+    // JWT
+    [/eyJ[a-zA-Z0-9_\-]{10,}\.eyJ[a-zA-Z0-9_\-]{10,}\.[a-zA-Z0-9_\-]{10,}/g, '***REDACTED JWT***'],
+    // Bearer tokens
+    [/Bearer\s+[a-zA-Z0-9_\-\.]{20,}/g, 'Bearer ***REDACTED***'],
+    // PEM keys
+    [/-----BEGIN [A-Z ]+-----[\s\S]*?-----END [A-Z ]+-----/g, '-----***REDACTED KEY***-----'],
+    // Generic env-style secrets (password=, token=, secret=)
+    [/(password|passwd|pwd|secret|token|api_key|apikey)\s*[:=]\s*["']?([A-Za-z0-9_\-\.]{16,})["']?/gi,
+        '$1=***REDACTED***'],
+];
+export function redact(text) {
+    let out = text;
+    let count = 0;
+    for (const [re, replacement] of PATTERNS) {
+        const before = out;
+        out = out.replace(re, replacement);
+        if (out !== before)
+            count++;
+    }
+    return { text: out, count };
+}

package/dist/core/sandbox.js

@@ -0,0 +1,35 @@
+import path from 'path';
+import os from 'os';
+const BLOCKED_NAMES = [
+    '.env', '.env.local', '.env.production', '.env.staging',
+    'id_rsa', 'id_ed25519', 'id_dsa', 'id_ecdsa',
+    'credentials', 'secrets.json', 'secrets.yml', 'secrets.yaml',
+    '.git-credentials', '.npmrc', '.pypirc', '.netrc', '.htpasswd',
+    'known_hosts', 'authorized_keys',
+];
+const BLOCKED_EXTENSIONS = [
+    '.pem', '.key', '.p12', '.pfx', '.keystore', '.jks',
+];
+const BLOCKED_DIRS = [
+    '.ssh', '.aws', '.gnupg', '.gpg', '.kube',
+    '.docker', '.config/gcloud', '.password-store',
+];
+export function isBlocked(p) {
+    const abs = path.resolve(p);
+    const base = path.basename(abs).toLowerCase();
+    if (BLOCKED_NAMES.some((n) => base === n.toLowerCase())) {
+        return `"${path.basename(abs)}" is a sensitive file (blocked)`;
+    }
+    const ext = path.extname(abs).toLowerCase();
+    if (BLOCKED_EXTENSIONS.includes(ext)) {
+        return `"${path.basename(abs)}" has a sensitive extension (blocked)`;
+    }
+    const home = os.homedir();
+    for (const d of BLOCKED_DIRS) {
+        const target = path.join(home, d);
+        if (abs === target || abs.startsWith(target + path.sep)) {
+            return `Path is inside ~/${d} (blocked)`;
+        }
+    }
+    return null;
+}

package/dist/core/session.js

@@ -0,0 +1,57 @@
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import crypto from 'crypto';
+const SESSIONS_DIR = path.join(os.homedir(), '.blyue', 'sessions');
+export function sessionFile(cwd = process.cwd()) {
+    if (!fs.existsSync(SESSIONS_DIR))
+        fs.mkdirSync(SESSIONS_DIR, { recursive: true });
+    const hash = crypto.createHash('sha1').update(cwd).digest('hex').slice(0, 12);
+    return path.join(SESSIONS_DIR, `${hash}.json`);
+}
+export function loadSession(cwd = process.cwd()) {
+    const file = sessionFile(cwd);
+    if (!fs.existsSync(file))
+        return null;
+    try {
+        const data = JSON.parse(fs.readFileSync(file, 'utf8'));
+        return data.messages || null;
+    }
+    catch {
+        return null;
+    }
+}
+export function saveSession(messages, cwd = process.cwd()) {
+    const file = sessionFile(cwd);
+    const data = {
+        project: cwd,
+        updatedAt: Date.now(),
+        messages,
+    };
+    fs.writeFileSync(file, JSON.stringify(data, null, 2), { mode: 0o600 });
+}
+export function clearSession(cwd = process.cwd()) {
+    const file = sessionFile(cwd);
+    if (fs.existsSync(file))
+        fs.unlinkSync(file);
+}
+export function listSessions() {
+    if (!fs.existsSync(SESSIONS_DIR))
+        return [];
+    const out = [];
+    for (const f of fs.readdirSync(SESSIONS_DIR)) {
+        if (!f.endsWith('.json'))
+            continue;
+        try {
+            const data = JSON.parse(fs.readFileSync(path.join(SESSIONS_DIR, f), 'utf8'));
+            out.push({
+                file: f,
+                project: data.project,
+                updatedAt: data.updatedAt,
+                count: data.messages.length,
+            });
+        }
+        catch { }
+    }
+    return out.sort((a, b) => b.updatedAt - a.updatedAt);
+}

package/dist/core/tools.js

@@ -1,16 +1,19 @@
 import fs from 'fs/promises';
+import { existsSync, readFileSync } from 'fs';
 import { exec } from 'child_process';
 import { promisify } from 'util';
 import { hasN8n } from './config.js';
+import { permissions } from './permission.js';
+import { lineDiff, compactDiff } from './diff.js';
+import { isBlocked } from './sandbox.js';
 import { n8nListWorkflows, n8nTriggerWorkflow, n8nListExecutions, n8nGetWorkflow, n8nActivateWorkflow, n8nDeactivateWorkflow, } from './n8n.js';
 const execAsync = promisify(exec);
-// Base tools — always available
 const BASE_TOOLS = [
     {
         type: 'function',
         function: {
             name: 'read_file',
-            description: 'Read a file from disk',
+            description: 'Read a file from disk. Sensitive files (.env, .ssh, keys) are blocked.',
             parameters: {
                 type: 'object',
                 properties: { path: { type: 'string' } },
@@ -57,105 +60,102 @@ const BASE_TOOLS = [
         },
     },
 ];
-// n8n tools — only loaded when N8N_URL + N8N_API_KEY are set
 const N8N_TOOLS = [
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_list_workflows',
-            description: 'List all n8n workflows. Returns id, name, active status, updatedAt.',
-            parameters: { type: 'object', properties: {} },
-        },
-    },
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_get_workflow',
-            description: 'Get details of a specific n8n workflow by ID',
-            parameters: {
-                type: 'object',
-                properties: { id: { type: 'string' } },
-                required: ['id'],
-            },
-        },
-    },
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_trigger_workflow',
-            description: 'Trigger an n8n workflow via its webhook URL',
-            parameters: {
-                type: 'object',
-                properties: {
-                    workflowId: { type: 'string' },
-                    data: { type: 'object' },
-                },
-                required: ['workflowId'],
-            },
-        },
-    },
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_list_executions',
-            description: 'List recent n8n executions (runs)',
-            parameters: {
-                type: 'object',
-                properties: {
-                    workflowId: { type: 'string' },
-                    limit: { type: 'number' },
-                },
-            },
-        },
-    },
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_activate_workflow',
-            description: 'Activate an n8n workflow',
-            parameters: {
-                type: 'object',
-                properties: { id: { type: 'string' } },
-                required: ['id'],
-            },
-        },
-    },
-    {
-        type: 'function',
-        function: {
-            name: 'n8n_deactivate_workflow',
-            description: 'Deactivate an n8n workflow',
-            parameters: {
-                type: 'object',
-                properties: { id: { type: 'string' } },
-                required: ['id'],
-            },
-        },
-    },
+    { type: 'function', function: { name: 'n8n_list_workflows', description: 'List n8n workflows', parameters: { type: 'object', properties: {} } } },
+    { type: 'function', function: { name: 'n8n_get_workflow', description: 'Get n8n workflow by ID', parameters: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } } },
+    { type: 'function', function: { name: 'n8n_trigger_workflow', description: 'Trigger n8n workflow', parameters: { type: 'object', properties: { workflowId: { type: 'string' }, data: { type: 'object' } }, required: ['workflowId'] } } },
+    { type: 'function', function: { name: 'n8n_list_executions', description: 'List n8n executions', parameters: { type: 'object', properties: { workflowId: { type: 'string' }, limit: { type: 'number' } } } } },
+    { type: 'function', function: { name: 'n8n_activate_workflow', description: 'Activate n8n workflow', parameters: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } } },
+    { type: 'function', function: { name: 'n8n_deactivate_workflow', description: 'Deactivate n8n workflow', parameters: { type: 'object', properties: { id: { type: 'string' } }, required: ['id'] } } },
 ];
-// Dynamic — includes n8n tools only if configured
 export function getToolDefs() {
     return hasN8n() ? [...BASE_TOOLS, ...N8N_TOOLS] : [...BASE_TOOLS];
 }
-// For backwards compat if anything imports toolDefs directly
 export const toolDefs = BASE_TOOLS;
+const DANGER_PATTERNS = [
+    { re: /\brm\s+(-[a-z]*[rf][a-z]*\s+)?/, level: 'high' },
+    { re: /\bsudo\b/, level: 'high' },
+    { re: /\bmkfs\b|\bdd\s+if=/, level: 'high' },
+    { re: />\s*\/dev\//, level: 'high' },
+    { re: /:\(\)\s*\{/, level: 'high' },
+    { re: /\bchmod\s+(-R\s+)?777\b/, level: 'medium' },
+    { re: /\bgit\s+push\b/, level: 'medium' },
+    { re: /\bnpm\s+(publish|unpublish)\b/, level: 'medium' },
+    { re: /\bcurl\b.*\|\s*(sh|bash)\b/, level: 'high' },
+];
+function classify(cmd) {
+    for (const { re, level } of DANGER_PATTERNS) {
+        if (re.test(cmd))
+            return level;
+    }
+    return 'low';
+}
 export async function executeTool(name, args) {
     try {
         switch (name) {
-            case 'read_file':
+            case 'read_file': {
+                const blocked = isBlocked(args.path);
+                if (blocked)
+                    return `Blocked by sandbox: ${blocked}`;
                 return await fs.readFile(args.path, 'utf8');
-            case 'write_file':
-                await fs.writeFile(args.path, args.content, 'utf8');
-                return 'Wrote ' + args.path;
+            }
+            case 'write_file': {
+                const path = args.path;
+                const content = args.content;
+                const blockedWrite = isBlocked(path);
+                if (blockedWrite)
+                    return `Blocked by sandbox: ${blockedWrite}`;
+                const existed = existsSync(path);
+                let oldText = '';
+                if (existed) {
+                    try {
+                        oldText = readFileSync(path, 'utf8');
+                    }
+                    catch { }
+                }
+                if (!permissions.isAlwaysAllowed('write_file')) {
+                    const lines = content.split('\n');
+                    const body = [
+                        existed ? `Overwrite ${path}` : `Create ${path}`,
+                        `${lines.length} lines · ${content.length} bytes`,
+                    ];
+                    let diffPreview;
+                    if (existed && oldText !== content) {
+                        const d = compactDiff(lineDiff(oldText, content), 2);
+                        diffPreview = d.slice(0, 60);
+                    }
+                    const answer = await permissions.ask({
+                        tool: 'write_file',
+                        title: existed ? 'Write file' : 'Create file',
+                        body,
+                        diff: diffPreview,
+                        danger: existed ? 'medium' : 'low',
+                    });
+                    if (answer === 'no')
+                        return `Denied by user: write_file ${path}`;
+                }
+                await fs.writeFile(path, content, 'utf8');
+                return 'Wrote ' + path;
+            }
             case 'list_files': {
                 const dir = args.path || '.';
                 const entries = await fs.readdir(dir, { withFileTypes: true });
-                return entries
-                    .map((e) => (e.isDirectory() ? e.name + '/' : e.name))
-                    .join('\n');
+                return entries.map((e) => (e.isDirectory() ? e.name + '/' : e.name)).join('\n');
             }
             case 'run_command': {
-                const { stdout, stderr } = await execAsync(args.command, {
+                const cmd = args.command;
+                if (!permissions.isAlwaysAllowed('run_command')) {
+                    const danger = classify(cmd);
+                    const answer = await permissions.ask({
+                        tool: 'run_command',
+                        title: 'Run command',
+                        body: ['$ ' + cmd, `cwd: ${process.cwd()}`, `risk: ${danger}`],
+                        danger,
+                    });
+                    if (answer === 'no')
+                        return `Denied by user: run_command`;
+                }
+                const { stdout, stderr } = await execAsync(cmd, {
                     cwd: process.cwd(),
                     maxBuffer: 10 * 1024 * 1024,
                 });

package/dist/index.js

@@ -5,21 +5,27 @@ import { render, Box, Static } from 'ink';
 import { Setup } from './ui/Setup.js';
 import { Chat } from './ui/Chat.js';
 import { Banner } from './ui/Banner.js';
+import { Consent, hasConsented } from './ui/Consent.js';
 import { loadConfig, applyConfig } from './core/config.js';
+import { loadSession } from './core/session.js';
 const App = () => {
     const [ready, setReady] = useState(false);
+    const [resumedCount, setResumedCount] = useState(0);
+    const [consented, setConsented] = useState(hasConsented());
     useEffect(() => {
+        if (!consented)
+            return;
         const existing = loadConfig();
         if (existing) {
             applyConfig(existing);
+            const hist = loadSession();
+            setResumedCount(hist ? hist.length : 0);
             setReady(true);
         }
-    }, []);
-    return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Static, { items: ['banner'], children: () => _jsx(Banner, {}) }), ready ? _jsx(Chat, {}) : _jsx(Setup, { onDone: () => setReady(true) })] }));
+    }, [consented]);
+    return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsx(Static, { items: ['banner'], children: () => _jsx(Banner, {}) }), !consented ? (_jsx(Consent, { onAccept: () => setConsented(true) })) : ready ? (_jsx(Chat, { resumedCount: resumedCount })) : (_jsx(Setup, { onDone: () => setReady(true) }))] }));
 };
 render(_jsx(App, {}), {
-    // Prevent console.log interference from npm/openai warnings
     patchConsole: false,
-    // Only redraw when Ink state actually changes
     exitOnCtrlC: true,
 });

package/dist/ui/Chat.js

@@ -1,17 +1,18 @@
 import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
-import { useState } from 'react';
+import { useState, useEffect } from 'react';
 import { Box, Text, useInput, useStdout, Static } from 'ink';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
 import { Agent } from '../core/agent.js';
+import { permissions } from '../core/permission.js';
 import { InputBar } from './InputBar.js';
 import { ModelPicker } from './ModelPicker.js';
 import { Settings } from './Settings.js';
+import { PermissionPrompt } from './PermissionPrompt.js';
 import { theme } from './theme.js';
 let nextId = 0;
-const mkItem = (kind, text) => ({
-    kind,
-    text,
-    id: nextId++,
-});
+const mkItem = (kind, text) => ({ kind, text, id: nextId++ });
 const HistoryLine = ({ item }) => {
     if (item.kind === 'user') {
         return (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: theme.accent, bold: true, children: '❯ ' }), _jsx(Text, { color: theme.text, bold: true, children: item.text })] }));
@@ -24,16 +25,50 @@ const HistoryLine = ({ item }) => {
     }
     return (_jsx(Box, { marginTop: 1, children: _jsx(Text, { color: theme.text, children: item.text }) }));
 };
-export const Chat = () => {
+const DEBUG_FILE = path.join(os.homedir(), '.blyue', 'last-request.json');
+function readDebug() {
+    if (!fs.existsSync(DEBUG_FILE)) {
+        return ['No request sent yet in this session.'];
+    }
+    try {
+        const d = JSON.parse(fs.readFileSync(DEBUG_FILE, 'utf8'));
+        const kb = (d.approxBytes / 1024).toFixed(1);
+        return [
+            `Model:        ${d.model}`,
+            `Provider:     ${d.baseUrl}`,
+            `Messages:     ${d.messageCount}`,
+            `Approx size:  ~${d.approxTokens} tokens · ${kb} KB`,
+            `Redactions:   ${d.redactedCount || 0} secrets scrubbed`,
+            `Timestamp:    ${d.timestamp}`,
+            `Full payload: ${DEBUG_FILE}`,
+        ];
+    }
+    catch (e) {
+        return ['Debug file unreadable: ' + e.message];
+    }
+}
+export const Chat = ({ resumedCount = 0 }) => {
     const { stdout } = useStdout();
     const width = stdout?.columns ?? 80;
-    const [history, setHistory] = useState([]);
+    const [history, setHistory] = useState(() => {
+        if (resumedCount > 0) {
+            return [mkItem('tool', `(resumed session · ${resumedCount} prior messages)`)];
+        }
+        return [];
+    });
     const [input, setInput] = useState('');
     const [loading, setLoading] = useState(false);
     const [overlay, setOverlay] = useState('none');
+    const [permReq, setPermReq] = useState(null);
     const [currentModel, setCurrentModel] = useState(process.env.MODEL || '');
     const [agent, setAgent] = useState(() => new Agent());
+    useEffect(() => {
+        const unsub = permissions.subscribe((req) => setPermReq(req));
+        return unsub;
+    }, []);
     useInput((inputChar, key) => {
+        if (permReq)
+            return;
         if (key.ctrl && inputChar === 'p')
             setOverlay('model');
         if (key.ctrl && inputChar === 's')
@@ -53,13 +88,32 @@ export const Chat = () => {
             setOverlay('settings');
             return;
         }
+        if (trimmed === '/debug') {
+            setInput('');
+            const lines = readDebug();
+            setHistory((h) => [
+                ...h,
+                mkItem('tool', 'Last request to provider:'),
+                ...lines.map((l) => mkItem('tool', '  ' + l)),
+            ]);
+            return;
+        }
+        if (trimmed === '/clear') {
+            setInput('');
+            agent.clear();
+            permissions.resetSession();
+            setHistory([mkItem('tool', '(conversation cleared)')]);
+            return;
+        }
         if (trimmed === '/help') {
             setInput('');
             setHistory((h) => [
                 ...h,
                 mkItem('tool', 'Commands:'),
-                mkItem('tool', '  /model     switch model        (Ctrl+P)'),
-                mkItem('tool', '  /settings  open settings       (Ctrl+S)'),
+                mkItem('tool', '  /model     switch model            (Ctrl+P)'),
+                mkItem('tool', '  /settings  open settings           (Ctrl+S)'),
+                mkItem('tool', '  /debug     show last request to provider'),
+                mkItem('tool', '  /clear     clear session and permissions'),
                 mkItem('tool', '  /help      show this list'),
             ]);
             return;
@@ -85,6 +139,9 @@ export const Chat = () => {
         setAgent(new Agent());
         setHistory((h) => [...h, mkItem('tool', `model → ${id}`)]);
     };
+    if (permReq) {
+        return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: history, children: (item) => _jsx(HistoryLine, { item: item }, item.id) }), _jsx(Box, { marginTop: 1, children: _jsx(PermissionPrompt, { req: permReq }) })] }));
+    }
     if (overlay === 'model') {
         return (_jsx(Box, { flexDirection: "column", children: _jsx(ModelPicker, { current: currentModel, onSelect: handleModelSelect, onCancel: () => setOverlay('none') }) }));
     }
@@ -98,5 +155,5 @@ export const Chat = () => {
     const shortModel = currentModel.length > maxModelLen
         ? '…' + currentModel.slice(-(maxModelLen - 1))
         : currentModel || 'unset';
-    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: history, children: (item) => _jsx(HistoryLine, { item: item }, item.id) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(InputBar, { value: input, onChange: setInput, onSubmit: handleSubmit, loading: loading }), _jsxs(Text, { children: [_jsx(Text, { color: theme.accent, children: "  /model" }), _jsx(Text, { color: theme.muted, children: "  \u00B7  " }), _jsx(Text, { color: theme.accent, children: "/settings" }), _jsx(Text, { color: theme.muted, children: "  \u00B7  " }), _jsx(Text, { color: theme.text, children: shortModel })] })] })] }));
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsx(Static, { items: history, children: (item) => _jsx(HistoryLine, { item: item }, item.id) }), _jsxs(Box, { marginTop: 1, flexDirection: "column", children: [_jsx(InputBar, { value: input, onChange: setInput, onSubmit: handleSubmit, loading: loading }), _jsxs(Text, { children: [_jsx(Text, { color: theme.accent, children: "  /model" }), _jsx(Text, { color: theme.muted, children: "  \u00B7  " }), _jsx(Text, { color: theme.accent, children: "/settings" }), _jsx(Text, { color: theme.muted, children: "  \u00B7  " }), _jsx(Text, { color: theme.accent, children: "/debug" }), _jsx(Text, { color: theme.muted, children: "  \u00B7  " }), _jsx(Text, { color: theme.text, children: shortModel })] })] })] }));
 };

package/dist/ui/Consent.js

@@ -0,0 +1,26 @@
+import { jsx as _jsx, jsxs as _jsxs } from "react/jsx-runtime";
+import { Box, Text, useInput } from 'ink';
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { theme } from './theme.js';
+const FLAG = path.join(os.homedir(), '.blyue', '.consent');
+export function hasConsented() {
+    return fs.existsSync(FLAG);
+}
+export function markConsented() {
+    fs.mkdirSync(path.dirname(FLAG), { recursive: true });
+    fs.writeFileSync(FLAG, new Date().toISOString());
+}
+export const Consent = ({ onAccept }) => {
+    useInput((input) => {
+        if (input === 'y' || input === 'Y') {
+            markConsented();
+            onAccept();
+        }
+        else if (input === 'n' || input === 'N') {
+            process.exit(0);
+        }
+    });
+    return (_jsxs(Box, { flexDirection: "column", paddingX: 1, children: [_jsx(Text, { color: theme.warning, bold: true, children: "\u26A0  Privacy notice" }), _jsx(Text, { children: " " }), _jsx(Text, { color: theme.text, children: "BLYUE sends your prompts, file contents, and command output to your configured LLM provider so it can help you." }), _jsx(Text, { children: " " }), _jsx(Text, { color: theme.muted, children: "Do NOT run this on directories containing secrets, keys, or private data unless you trust the provider." }), _jsx(Text, { children: " " }), _jsx(Text, { color: theme.muted, children: "Built-in protections:" }), _jsx(Text, { color: theme.muted, children: '  · .env, .ssh, .aws, *.pem, *.key are blocked from reading' }), _jsx(Text, { color: theme.muted, children: '  · API keys and tokens are redacted before sending' }), _jsx(Text, { children: " " }), _jsxs(Text, { children: [_jsx(Text, { color: theme.success, bold: true, children: "  [y]" }), _jsx(Text, { color: theme.text, children: " I understand, continue" })] }), _jsxs(Text, { children: [_jsx(Text, { color: theme.error, bold: true, children: "  [n]" }), _jsx(Text, { color: theme.text, children: " Exit" })] })] }));
+};

package/dist/ui/PermissionPrompt.js

@@ -0,0 +1,34 @@
+import { jsx as _jsx, jsxs as _jsxs, Fragment as _Fragment } from "react/jsx-runtime";
+import { Box, Text, useInput, useStdout } from 'ink';
+import { permissions } from '../core/permission.js';
+import { theme } from './theme.js';
+export const PermissionPrompt = ({ req }) => {
+    const { stdout } = useStdout();
+    const width = Math.max(40, stdout?.columns ?? 60);
+    const inner = width - 4;
+    useInput((input, key) => {
+        if (input === 'y' || input === 'Y')
+            permissions.answer('yes');
+        else if (input === 'n' || input === 'N' || key.escape)
+            permissions.answer('no');
+        else if (input === 'a' || input === 'A')
+            permissions.answer('always');
+    });
+    const dangerColor = req.danger === 'high' ? theme.error :
+        req.danger === 'medium' ? theme.warning :
+            theme.accent;
+    const title = `${req.danger === 'high' ? '⚠  ' : ''}${req.title}`;
+    const topPad = Math.max(1, inner - title.length - 3);
+    return (_jsxs(Box, { flexDirection: "column", children: [_jsxs(Text, { children: [_jsx(Text, { color: theme.muted, children: '╭─ ' }), _jsx(Text, { color: dangerColor, bold: true, children: title }), _jsx(Text, { color: theme.muted, children: ' ' + '─'.repeat(topPad) + '╮' })] }), req.body.map((line, i) => {
+                const pad = Math.max(0, inner - line.length - 2);
+                return (_jsxs(Text, { children: [_jsx(Text, { color: theme.muted, children: '│ ' }), _jsx(Text, { color: theme.text, children: line }), _jsx(Text, { children: ' '.repeat(pad) })] }, i));
+            }), req.diff && req.diff.length > 0 && (_jsxs(_Fragment, { children: [_jsx(Text, { color: theme.muted, children: '│' }), req.diff.map((d, i) => {
+                        const sign = d.type === 'add' ? '+' : d.type === 'remove' ? '-' : ' ';
+                        const color = d.type === 'add' ? theme.success :
+                            d.type === 'remove' ? theme.error :
+                                theme.muted;
+                        const text = `${sign} ${d.text}`.slice(0, inner - 2);
+                        const pad = Math.max(0, inner - text.length - 2);
+                        return (_jsxs(Text, { children: [_jsx(Text, { color: theme.muted, children: '│ ' }), _jsx(Text, { color: color, children: text }), _jsx(Text, { children: ' '.repeat(pad) })] }, i));
+                    })] })), _jsx(Text, { color: theme.muted, children: '╰' + '─'.repeat(inner) + '╯' }), _jsxs(Text, { children: [_jsx(Text, { color: theme.success, bold: true, children: "  [y]" }), _jsx(Text, { color: theme.muted, children: " allow once   " }), _jsx(Text, { color: theme.accent, bold: true, children: "[a]" }), _jsx(Text, { color: theme.muted, children: " always (this session)   " }), _jsx(Text, { color: theme.error, bold: true, children: "[n]" }), _jsx(Text, { color: theme.muted, children: " deny" })] })] }));
+};

package/dist/ui/theme.js

@@ -1,8 +1,9 @@
 export const theme = {
-    accent: 'magentaBright', // the only non-neutral color
+    accent: 'cyan',
     text: 'white',
     muted: 'gray',
     dim: 'gray',
     error: 'red',
+    warning: 'yellow',
     success: 'green',
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "blyuecode",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "BLYUE Code — a coding agent by Lumen",
   "type": "module",
   "license": "MIT",