carthagent 1.0.7 → 1.1.0-beta.2

package/docs/source-preview.md

@@ -0,0 +1,120 @@
+# Projects sidebar source preview
+
+This preview runs the redesigned Projects sidebar from OpenCode source plus the
+Carthagent plugin in this checkout. It is a development preview. Nothing here
+builds, publishes, installs, or changes the published `ctg` runtime.
+
+## What is pinned where
+
+| Purpose | Patch | Recipe | Hash reference |
+| --- | --- | --- | --- |
+| Published runtime (preview.13) | `docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch` | `script/ctg/build-owned-runtime.sh`, publish workflow | `CTG_RUNTIME_PATCH_SHA256`, `lib/opencode/runtime-release.json` |
+| Source preview (development) | `docs/patches/opencode-v2.0.32-session-ui-combined-v5.patch` | `script/ctg/prepare-development-runtime.sh` | `CTG_DEVELOPMENT_RUNTIME_PATCH_SHA256` |
+
+Both patches apply to clean upstream `https://github.com/anomalyco/opencode` at
+`843a6c514e606b436a7fe713422ace0a93ad3d61`. v5 is a replacement patch: it
+contains everything in v4 plus the sidebar, folder browser and new-session
+setup sources and their tests under `packages/tui/test/sidebar`. Do not apply
+v4 first.
+
+## Setup
+
+1. `npm ci` in this checkout (the plugin runs from `plugins/carthagent`).
+2. Clone upstream into a new directory, check out the pinned commit, and run
+   `script/ctg/prepare-development-runtime.sh <checkout>`. The script refuses a
+   different commit, a dirty checkout or a patch with the wrong SHA-256, then
+   runs `git apply --check` and `git apply`. It does not install or compile.
+3. Run `bun install` with Bun 1.4.2 in the prepared checkout.
+
+## Launch
+
+```sh
+script/ctg/source-preview.sh --source DIR --profile DIR --bun PATH [--workspace DIR] [-- ARGS...]
+```
+
+- All three of `--source`, `--profile` and `--bun` are required. Relative
+  paths resolve against your current directory, so you can launch from
+  anywhere. Paths with spaces work when quoted.
+- The launcher checks that `packages/cli/src/index.ts` and `node_modules`
+  exist and that `bun --version` matches the checkout's `packageManager` pin.
+  It fails before touching the profile when a prerequisite is missing.
+- It runs Bun with `--no-env-file` from `<source>/packages/cli` (required for
+  JSX resolution) under `env -i`. Only these variables reach OpenCode: `HOME`,
+  `PATH` (Bun's directory, Node's directory if found, `/usr/bin`, `/bin`),
+  `TERM`, `COLORTERM`, `TMPDIR`, the four `XDG_*` directories,
+  `OPENCODE_CONFIG_DIR`, `OPENCODE_TEST_HOME`,
+  `OPENCODE_DISABLE_PROJECT_CONFIG=1`, `OPENCODE_DISABLE_AUTOUPDATE=1` and
+  `BUN_RUNTIME_TRANSPILER_CACHE_PATH=0`. Provider API-key variables are never
+  passed through.
+- First launch creates the profile (0700) with `config/opencode/opencode.json`
+  (the plugin path), `cli.json` (Carthage theme) and `themes/carthage.json`
+  (all 0600). Each file is created only if absent; existing configuration,
+  sessions and authentication are left untouched. If an existing
+  `opencode.json` does not list the plugin, the launcher prints a warning and
+  still leaves the file alone.
+- `--standalone` is always used, so the CLI starts its own private server on
+  a loopback ephemeral port (`--port 0`) that exits with the TUI. `--server`
+  is rejected. Without `--`, the workspace (default: current directory) is
+  opened. With `--`, the remaining arguments run another CLI command in the
+  same profile, for example `-- auth login`.
+
+## Use
+
+- **Folder card** (top of Projects): current folder, abbreviated path (click
+  for the full path), Browse, New session and the model action. Narrow layouts
+  show compact `⌕` search, `▤` Browse and `◇` model controls.
+- **Browse** (`/browse`, palette “Browse folders”): Filter and Path inputs
+  (Tab switches), Up/Down select, Enter opens, Alt+Left/Right/Up for
+  Back/Forward/Up, Alt+H for Home, Ctrl+S confirms, Escape cancels.
+- **New session** (`Ctrl+X N`, `/new`, palette “New session” or “New session
+  in folder…”, folder card, compact `+`, folder right-click menu): choose the
+  folder, then the model. Global entries start at the folder a plain new
+  session would use; project entries start at that project's folder. Nothing
+  is created until the first message is sent; cancelling leaves the current
+  session, draft and model unchanged. The new session keeps the agent you were
+  using and, when you keep the same model, its variant (including the default).
+  If the chosen agent or model is not available at the folder when you send,
+  the send is blocked with your text kept and no session created; pick another
+  agent (`Shift+Tab`) or model (`/model`, `Ctrl+X M`) and send again. There is
+  no automatic fallback to another model. `/model` also works before a session
+  exists. The model step inside setup has no integration shortcut; connect
+  integrations from the standalone model picker (`Ctrl+X M`).
+- **Exit**: `/exit` or palette “Exit the app”. The private server exits with
+  the TUI.
+- **Resume**: relaunch with the same `--profile` and select the session in
+  Projects. Automatic resume is not part of this preview.
+
+## Tests
+
+Run serially. Close the preview first.
+
+```sh
+# Product (from this checkout)
+node --test --test-concurrency=1 tests/source-preview.test.mjs tests/native-ship-plan.test.mjs tests/native-model-command.test.mjs
+npx eslint . && npm run typecheck
+
+# Native (from <source>/packages/tui, using the same isolated variables as the launcher)
+bun --no-env-file test --timeout 30000 test/navigation-rail.test.tsx \
+  test/component/session-tabs-rail.test.tsx test/context/session-tabs-model.test.ts \
+  test/ui/layout.test.ts test/sidebar
+```
+
+`tests/source-preview.test.mjs` uses a Bun test double and synthetic profiles,
+so it proves argument handling, isolation and config preservation, not a real
+launch. It runs the launcher with `/bin/sh` on Linux and macOS and is skipped
+on native Windows, where the POSIX launcher is not supported.
+
+## Limits
+
+- Source preview only. No native binary, package or release includes these
+  changes, and the published runtime remains v4.
+- The launcher is a POSIX `sh` script for Linux and macOS (GNU and BSD
+  utilities). Native Windows is not supported.
+- Real launches were verified on Linux with Bun 1.4.2. No cross-platform
+  launch matrix was run.
+- The native type checker (`tsgo`) and native build are not part of this
+  workflow; Bun tests compile the changed modules but are not a full static
+  type check.
+- Some native tests outside the focused list fail in the same way on the
+  pre-change sources (for example missing `ToastProvider` in
+  `session-tabs-status` harnesses).

package/evaluate.mjs

@@ -23,7 +23,33 @@ const { values: args } = parseArgs({ options: {
   timeout: { type: 'string', default: '600' }, 'max-turns': { type: 'string', default: '100' }, 'max-cost': { type: 'string', default: '3' },
   python: { type: 'string' }, 'seed-from': { type: 'string' }, 'allow-live': { type: 'boolean', default: false },
   'dry-run': { type: 'boolean', default: false },
+  help: { type: 'boolean', short: 'h', default: false },
 } });
+if (args.help) {
+  console.log(`Usage: ctg eval [options]
+
+Opt-in live A/B evaluation of baseline vs custom configurations against a
+scenario manifest under scenarios/<name>/. Live calls spend API credit and
+generated code runs with your permissions, so a run must be explicit.
+
+Options:
+  --mode baseline|custom|both   What to evaluate (default both)
+  --task <name>                  Scenario short name (default cli)
+  --scenario <name>              Scenario directory (overrides --task)
+  --model <id>                   Model id
+  --provider <name>              Provider name; needs <PROVIDER>_API_KEY
+  --thinking <level>             Thinking level (default medium)
+  --timeout <seconds>            Per-run timeout, max 3600 (default 600)
+  --max-turns <n>                Turn budget, max 1000 (default 100)
+  --max-cost <usd>               Cost budget (default 3)
+  --python <path>                Python executable for scenarios that need it
+  --seed-from <dir>              Continue from a previous candidate directory
+  --allow-live                   Confirm live provider calls
+  --dry-run                      Assemble and preview without calling a provider
+  --help, -h                     Show this help
+`);
+  process.exit(0);
+}
 if (!args['allow-live'] && !args['dry-run']) throw Error('Live calls spend API credit and generated code runs with your permissions. Use --allow-live explicitly (or --dry-run to preview the assembled run without calling a provider).');
 if (!['baseline', 'custom', 'both'].includes(args.mode)) throw Error('Use --mode baseline|custom|both');
 for (const key of ['timeout', 'max-turns', 'max-cost']) if (!(Number(args[key]) > 0 && Number.isFinite(Number(args[key])))) throw Error(`Invalid ${key}`);
@@ -197,7 +223,8 @@ for (const mode of args.mode === 'both' ? ['baseline', 'custom'] : [args.mode])
     cwd,
     evidenceSchema: 2,
     runtime: NATIVE_EVALUATION_RUNTIME,
-    runtimeVersion: result.opencodeVersion,
+    compatibilityVersion: result.compatibilityVersion,
+    runtimeVersion: result.runtimeVersion,
     exitCode: result.exitCode,
     timedOut: result.timedOut,
     budgetReason: result.budgetReason,

package/lib/budget.mjs

@@ -22,7 +22,7 @@ export function budgetReason(budget, action, now = Date.now()) {
 
 export function validateBudgetOptions(opts, { allowWithoutDelivery = false } = {}) {
   const keys = ['maxTools', 'maxSeconds', 'maxRepairs'];
-  if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
+if (!allowWithoutDelivery && opts.delivery === false && keys.some(key => opts[key] !== undefined)) {
     throw Error('Budget options require the delivery extension');
   }
   budgetLimits(flag => opts[{ 'delivery-max-tools': 'maxTools', 'delivery-max-seconds': 'maxSeconds', 'delivery-max-repairs': 'maxRepairs' }[flag]]);

package/lib/cloud/client.mjs

@@ -73,7 +73,7 @@ export class CloudClient {
   }
 
   async request(path, { method = 'GET', accessToken, body, signal } = {}) {
-    if (typeof this.fetch !== 'function') throw new Error('Carthagent Ship requires fetch support.');
+    if (typeof this.fetch !== 'function') throw new Error('Carthagent Cloud requires fetch support.');
     const headers = { accept: 'application/json' };
     if (body !== undefined) headers['content-type'] = 'application/json';
     if (accessToken) headers.authorization = `Bearer ${accessToken}`;
@@ -128,6 +128,11 @@ export class CloudClient {
     return this.request('/v1/billing/checkout', { method: 'POST', accessToken, body: { successUrl, cancelUrl, priceId }, signal });
   }
 
+  /** @param {{ accessToken?: string, plan?: string, signal?: AbortSignal }} [input] */
+  quote({ accessToken, plan = 'builder', signal } = {}) {
+    return this.request(`/v1/billing/quote?plan=${encodeURIComponent(plan)}`, { accessToken, signal });
+  }
+
   portal({ accessToken, returnUrl, signal } = {}) {
     return this.request('/v1/billing/portal', { method: 'POST', accessToken, body: { returnUrl }, signal });
   }
@@ -184,10 +189,10 @@ function formatEpochSeconds(value) {
 
 export function cloudManagedUsageRecovery(value) {
   const text = String(value?.code || value?.message || value || '');
-  if (/daily_limit_reached|managed daily usage limit/i.test(text)) return 'Managed daily usage is exhausted. It resets at 00:00 UTC. Use /account for headroom or /login for BYOK.';
-  if (/monthly_allowance_exhausted|managed monthly allowance/i.test(text)) return 'Managed monthly usage is exhausted. Use /billing portal to manage the plan or /login for BYOK.';
-  if (/subscription_inactive|managed subscription is not active/i.test(text)) return 'The managed subscription is inactive. Use /billing portal or /login for BYOK.';
-  if (/insufficient_quota|insufficient.credit|credit (?:is )?exhausted/i.test(text)) return 'Carthagent Ship credit is exhausted. Use /billing checkout where available or /login for BYOK.';
+  if (/daily_limit_reached|managed daily usage limit/i.test(text)) return 'Cloud daily usage is exhausted. It resets at 00:00 UTC. Use /account for your plan and headroom, /billing portal to manage billing, or /login for your own provider (BYOK). Your task stays in this session.';
+  if (/monthly_allowance_exhausted|managed monthly allowance/i.test(text)) return 'Cloud monthly usage is exhausted. Use /account for your renewal date, /billing portal to manage billing, or /login for your own provider (BYOK). To review a different plan use /billing checkout pro or /billing checkout max. After payment use /billing refresh, then explicitly continue this task.';
+  if (/subscription_inactive|managed subscription is not active/i.test(text)) return 'Cloud access is awaiting payment or activation. Use /billing refresh to check, /billing portal to manage payment, or /login for your own provider.';
+  if (/insufficient_quota|insufficient.credit|credit (?:is )?exhausted/i.test(text)) return 'Carthagent Cloud usage credit is exhausted. Use /billing checkout builder to review your eligible price (new Builder customers: $1 first month, then $10/month), or /login for your own provider. After payment use /billing refresh, then explicitly continue this task.';
   return null;
 }
 
@@ -256,9 +261,10 @@ export function formatCloudAccount(account, { usage } = {}) {
   const managed = account?.managedUsage;
   const planName = managed?.planName || 'plan';
   const lines = [
-    `Carthagent Ship account ${account?.accountId || 'unknown'}`,
+    `Carthagent Cloud account ${account?.accountId || 'unknown'}`,
     `Credit: ${formatNanoUsd(account?.balance?.availableNanoUsd)} available`,
-    `Plan: ${subscription.status && subscription.status !== 'none' ? `${planName} (${subscription.status})` : 'Free'}`,
+    `Plan: ${subscription.status && subscription.status !== 'none' ? `${planName} (${subscription.status})` : 'No paid plan'}`,
+    ...(account?.email ? [`Signed in as: ${account.email}`] : []),
   ];
   const subscriptionEnd = formatEpochSeconds(subscription.current_period_end);
   if (subscriptionEnd) lines.push(`Renews/ends: ${subscriptionEnd}`);

package/lib/codegraph.mjs

@@ -153,7 +153,7 @@ const parsers = new Map(); // lang -> dedicated parser (setLanguage once; concur
 async function parserFor(lang) {
   if (!runtimePromise) {
     runtimePromise = (async () => {
-      const Parser = require_('web-tree-sitter');
+      const Parser = require_('web-tree-sitter-legacy');
       await Parser.init();
       const wasmDir = require_.resolve('tree-sitter-wasms/package.json').replace(/package\.json$/, 'out');
       const languages = new Map();

package/lib/delivery-review.mjs

@@ -1,6 +1,6 @@
 import { createHash, randomUUID } from 'node:crypto';
 import { readFileSync, writeFileSync, mkdirSync, realpathSync, statSync } from 'node:fs';
-import { dirname, join, resolve } from 'node:path';
+import { dirname, join, resolve, relative, isAbsolute, sep } from 'node:path';
 import { fingerprint, runCommand, localPath, pendingRequirements, evidenceExcludedDirectories, evidenceFresh } from './delivery.mjs';
 
 // Captures real Git output and new source contents. The receipt binds a
@@ -13,15 +13,18 @@ export async function captureDeliveryReview(state, cwd, directory, signal) {
     text = 'No Git repository available. Manually inspect source files and describe the review scope honestly; no diff comparison was possible.\n';
   } else {
     if (top.timedOut || top.cancelled || top.outputLimit) throw Error('Git repository discovery failed.');
-    if (realpathSync.native(resolve(top.output.trim())) !== realpathSync.native(resolve(cwd))) throw Error('Review requires the workspace Git root, not an unrelated ancestor repository.');
+    const root = realpathSync.native(resolve(top.output.trim()));
+    const workspace = realpathSync.native(resolve(cwd));
+    const scope = relative(root, workspace);
+    if (isAbsolute(scope) || scope === '..' || scope.startsWith(`..${sep}`)) throw Error('Review requires a workspace inside the discovered Git repository.');
     const log = join(directory, `diff-${randomUUID()}.log`);
     const exclusions = evidenceExcludedDirectories.map(name => `:(exclude,glob)**/${name}/**`);
-    const diff = await runCommand(['git', 'diff', '--no-ext-diff', '--no-textconv', 'HEAD', '--', '.', ...exclusions], { cwd, signal, timeoutSeconds: 30, logPath: log });
+    const diff = await runCommand(['git', 'diff', '--relative', '--no-renames', '--no-ext-diff', '--no-textconv', 'HEAD', '--', '.', ...exclusions], { cwd, signal, timeoutSeconds: 30, logPath: log });
     if (diff.code !== 0 || diff.timedOut || diff.cancelled || diff.outputLimit) throw Error('Cannot capture complete Git diff (requires a committed baseline and bounded output).');
     const untrackedLog = join(directory, `untracked-${randomUUID()}.log`);
-    const status = await runCommand(['git', 'ls-files', '-z', '--others', '--exclude-standard', ...evidenceExcludedDirectories.map(name => `--exclude=${name}/`)], { cwd, signal, timeoutSeconds: 10, logPath: untrackedLog });
+    const status = await runCommand(['git', 'ls-files', '-z', '--others', '--exclude-standard', ...evidenceExcludedDirectories.map(name => `--exclude=${name}/`), '--', '.'], { cwd, signal, timeoutSeconds: 10, logPath: untrackedLog });
     if (status.code !== 0 || status.cancelled || status.timedOut || status.outputLimit) throw Error('Cannot enumerate untracked files for review.');
-    text = `Review scope excludes dependency/cache/output directories: ${evidenceExcludedDirectories.join(', ')}.\n${readFileSync(log, 'utf8')}\nNew source files:\n`;
+    text = `Review scope: workspace ${JSON.stringify(scope || '.')} relative to Git root; paths below are workspace-relative.\nReview scope excludes dependency/cache/output directories: ${evidenceExcludedDirectories.join(', ')}.\n${readFileSync(log, 'utf8')}\nNew source files:\n`;
     for (const name of readFileSync(untrackedLog, 'utf8').split('\0').filter(Boolean).sort()) {
       const path = localPath(cwd, name);
       if (statSync(path).size > 1024 * 1024) throw Error(`New file too large for review capture: ${JSON.stringify(name)}. Inspect it separately or narrow the workspace.`);
@@ -41,13 +44,23 @@ export async function captureDeliveryReview(state, cwd, directory, signal) {
   return { ...capture, diff: text.slice(0, 12000), truncated: text.length > 12000, unresolvedFindings: (state.reviewFindings || []).filter(f => !f.resolution), next: 'Read the full capture path if truncated; new text source is included. Inspect binary assets separately. Probe critical component connections and user outcomes, not only individual functions or artifact existence. Record coverage, findings and limitations; earlier findings require explicit resolutions with evidence, never silently move them to limitations.' };
 }
 
+/** Models commonly send `assertion` or a string array; both carry the same claim. */
+function coverageAssertions(item) {
+  const value = item.assertions ?? item.assertion;
+  if (Array.isArray(value)) return value.filter(v => typeof v === 'string' && v.trim()).join('; ');
+  return typeof value === 'string' ? value : '';
+}
+
 export function recordDeliveryReview(state, cwd, params) {
   const capture = state.reviewCapture;
   const hash = fingerprint(cwd, ['.']);
   if (!capture || capture.id !== params.captureId || capture.runId !== state.runId || capture.revision !== state.revision || capture.fingerprint !== hash) throw Error('Review capture missing or stale. Use delivery_review action=inspect after final source edits.');
   if (pendingRequirements(state, hash).length) throw Error('Run fresh checks for every requirement before recording review.');
   const nonempty = value => typeof value === 'string' && value.trim().length > 0;
-  if (!Array.isArray(params.coverage) || (state.plan.acceptance || []).some(a => !params.coverage.some(c => c.requirement === a.requirement && nonempty(c.assertions)))) throw Error('Review coverage must explain concrete assertions for every exact acceptance requirement, including required validators.');
+  if (!Array.isArray(params.coverage) || params.coverage.some(c => !c || typeof c !== 'object')) throw Error('coverage must be an array of {requirement, assertions, status?} objects.');
+  params = { ...params, coverage: params.coverage.map(c => ({ ...c, assertions: coverageAssertions(c) })) };
+  const uncovered = (state.plan.acceptance || []).filter(a => !params.coverage.some(c => c.requirement === a.requirement && nonempty(c.assertions))).map(a => a.requirement);
+  if (uncovered.length) throw Error(`Review coverage must explain concrete assertions for every exact acceptance requirement, including required validators. Missing: ${JSON.stringify(uncovered.slice(0, 10))}${uncovered.length > 10 ? ` (+${uncovered.length - 10} more)` : ''}. Each item: {requirement: <exact acceptance text>, assertions: "<what the checks assert>", status?: "demonstrated"|"unverified"}.`);
   if (params.coverage.some(c => c.status !== undefined && !['demonstrated', 'unverified'].includes(c.status))) throw Error('Coverage status must be demonstrated or unverified.');
   if (!Array.isArray(params.probes) || !params.probes.length || params.probes.some(p => !nonempty(p))) throw Error('Record boundary/metamorphic probes and observed results, not just a generic review claim.');
   if (!Array.isArray(params.findings) || params.findings.some(p => !nonempty(p))) throw Error('findings must be an array; unresolved findings require repairs or a blocked handoff.');

package/lib/delivery.mjs

@@ -4,6 +4,7 @@ import { createHash, randomUUID } from 'node:crypto';
 import { existsSync, lstatSync, readdirSync, readFileSync, mkdirSync, writeFileSync, renameSync, openSync, writeSync, closeSync } from 'node:fs';
 import { resolve, relative, isAbsolute, join, dirname, basename } from 'node:path';
 import { spawn } from 'node:child_process';
+import { withoutRuntimeGithubToken } from './environment.mjs';
 
 // Generic dependency/cache/output directories excluded from the source fingerprint.
 // Scenarios or projects can add more via the manifest; these are the common defaults.
@@ -425,7 +426,7 @@ export function atomicJson(path, data) {
 export function killTree(child) {
   if (!child.pid) return;
   if (process.platform === 'win32') {
-    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore' });
+    const killer = spawn('taskkill.exe', ['/pid', String(child.pid), '/t', '/f'], { windowsHide: true, stdio: 'ignore', env: withoutRuntimeGithubToken() });
     killer.on('error', () => child.kill());
   } else {
     try { process.kill(-child.pid, 'SIGKILL'); } catch { child.kill('SIGKILL'); }
@@ -443,7 +444,7 @@ export async function runCommand(argv, { cwd, timeoutSeconds = 60, signal, logPa
   const started = Date.now();
   return new Promise(resolveResult => {
     let tail = '', written = 0, timedOut = false, cancelled = false, outputLimit = false;
-    const child = spawn(argv[0], argv.slice(1), { cwd, shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
+    const child = spawn(argv[0], argv.slice(1), { cwd, env: withoutRuntimeGithubToken(), shell: false, windowsHide: true, detached: process.platform !== 'win32', stdio: ['ignore', 'pipe', 'pipe'] });
     const stop = () => killTree(child);
     const abort = () => { cancelled = true; stop(); };
     const timer = setTimeout(() => { timedOut = true; stop(); }, timeoutSeconds * 1000);

package/lib/environment.mjs

@@ -0,0 +1,8 @@
+/** Return a copy of an environment without the optional runtime transport token. */
+export function withoutRuntimeGithubToken(env = process.env) {
+  const clean = { ...env };
+  for (const key of Object.keys(clean)) {
+    if (key.toUpperCase() === 'CTG_RUNTIME_GITHUB_TOKEN') delete clean[key];
+  }
+  return clean;
+}

package/lib/guidance.mjs

@@ -1,7 +1,7 @@
 import { existsSync, readFileSync, readdirSync } from 'node:fs';
 import { dirname, join, resolve } from 'node:path';
 import { fileURLToPath } from 'node:url';
-import { unframe } from './tui/framing.mjs';
+import { unframe } from '../plugins/carthagent/src/server/framing.mjs';
 
 const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
 export const DEFAULT_PROFILE_DIR = join(root, 'guidance', 'profiles');