codeep 2.25.0 → 3.1.0

package/dist/utils/telegramUpdates.js

@@ -0,0 +1,175 @@
+/**
+ * One long poll, one offset, both kinds of update.
+ *
+ * Telegram's getUpdates has a single cursor per bot. `offset` confirms every
+ * update older than itself **regardless of `allowed_updates`** — that parameter
+ * only filters what comes back in the response, not what the call acknowledges.
+ * So two pollers on one bot do not coexist: each advances the cursor past
+ * updates the other never saw, and both start losing traffic silently. An
+ * approval tapped on the phone would simply not register, with nothing anywhere
+ * to say why.
+ *
+ * Hence this. Everything that wants updates subscribes here, the loop asks for
+ * every type any subscriber could want, and dispatch happens locally where
+ * losing one is impossible.
+ */
+const API = 'https://api.telegram.org';
+/** Server-side long-poll window. The request blocks for up to this long. */
+const POLL_SECONDS = 25;
+/** Local ceiling, comfortably past the server's own. */
+const REQUEST_TIMEOUT_MS = (POLL_SECONDS + 10) * 1000;
+/**
+ * Pause after a poll that brought nothing back.
+ *
+ * Telegram's long poll already blocks server-side for POLL_SECONDS, so in
+ * normal running this never fires. It exists for the case where the request
+ * returns immediately — a network failure, or a server that ignored the
+ * timeout — which without it turns this into a loop that hammers the API as
+ * fast as the connection allows.
+ */
+const IDLE_PAUSE_MS = 1000;
+/**
+ * Where the cursor goes after a batch.
+ *
+ * Never backwards: a retry that returns an older batch, or a response with ids
+ * this build does not understand, must not re-deliver what was already handled.
+ */
+export function nextOffset(current, updates) {
+    let out = current;
+    for (const update of updates) {
+        if (typeof update.update_id === 'number')
+            out = Math.max(out, update.update_id + 1);
+    }
+    return out;
+}
+/** Every kind this loop asks for, so one cursor can serve every subscriber. */
+export const POLLED_KINDS = ['callback_query', 'message'];
+const sleep = (ms) => new Promise(resolve => setTimeout(resolve, ms));
+export class TelegramUpdates {
+    botToken;
+    handlers = new Map();
+    offset = 0;
+    running = false;
+    idlePauseMs;
+    observer = null;
+    /** Only the first failure of a streak is reported, then the recovery. */
+    failing = false;
+    constructor(botToken, idlePauseMs = IDLE_PAUSE_MS) {
+        this.botToken = botToken;
+        this.idlePauseMs = idlePauseMs;
+    }
+    /** Watch the health of the poll itself, separately from its payload. */
+    observe(observer) {
+        this.observer = observer;
+    }
+    report(ok, detail) {
+        if (ok === !this.failing)
+            return; // nothing changed; stay quiet
+        this.failing = !ok;
+        this.observer?.({ ok, detail });
+    }
+    /**
+     * Listen for one kind of update. Returns the function that stops listening.
+     *
+     * The loop runs while anyone is listening and stops when the last subscriber
+     * leaves, so a CLI with the inbox switched off never opens a connection.
+     */
+    subscribe(kind, handler) {
+        let set = this.handlers.get(kind);
+        if (!set) {
+            set = new Set();
+            this.handlers.set(kind, set);
+        }
+        set.add(handler);
+        if (!this.running)
+            void this.loop();
+        return () => {
+            set.delete(handler);
+            if (this.subscriberCount() === 0)
+                this.running = false;
+        };
+    }
+    subscriberCount() {
+        let total = 0;
+        for (const set of this.handlers.values())
+            total += set.size;
+        return total;
+    }
+    async loop() {
+        if (this.running)
+            return;
+        this.running = true;
+        while (this.running && this.subscriberCount() > 0) {
+            const json = await this.getUpdates();
+            if (!this.running)
+                break;
+            const updates = Array.isArray(json?.result) ? json.result : [];
+            // Advance before dispatching. A handler that throws must not make the
+            // loop re-read the same update forever.
+            this.offset = nextOffset(this.offset, updates);
+            for (const update of updates) {
+                for (const kind of POLLED_KINDS) {
+                    const payload = update[kind];
+                    if (payload === undefined)
+                        continue;
+                    for (const handler of this.handlers.get(kind) ?? []) {
+                        try {
+                            await handler(payload);
+                        }
+                        catch {
+                            // One subscriber's failure is not the others' problem, and is
+                            // certainly not a reason to stop reading the bot.
+                        }
+                    }
+                }
+            }
+            // Covers an empty batch as well as a failed request: both mean the loop
+            // would otherwise come straight back with nothing to do.
+            if (updates.length === 0)
+                await sleep(this.idlePauseMs);
+        }
+        this.running = false;
+    }
+    async getUpdates() {
+        try {
+            const response = await fetch(`${API}/bot${this.botToken}/getUpdates`, {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({
+                    offset: this.offset,
+                    timeout: POLL_SECONDS,
+                    allowed_updates: POLLED_KINDS,
+                }),
+                signal: AbortSignal.timeout(REQUEST_TIMEOUT_MS),
+            });
+            const json = await response.json().catch(() => null);
+            if (!response.ok || json?.ok === false) {
+                const description = typeof json?.description === 'string' ? json.description : `HTTP ${response.status}`;
+                this.report(false, description);
+                return null;
+            }
+            this.report(true, 'reading updates again');
+            return json;
+        }
+        catch (error) {
+            this.report(false, error?.message || 'could not reach Telegram');
+            return null;
+        }
+    }
+}
+/**
+ * The one poller per bot token.
+ *
+ * Approvals are constructed per dangerous tool call and the inbox lives for the
+ * whole session; both must reach the same cursor, so the instance is keyed by
+ * token rather than owned by either.
+ */
+const shared = new Map();
+export function sharedUpdates(botToken) {
+    let instance = shared.get(botToken);
+    if (!instance) {
+        instance = new TelegramUpdates(botToken);
+        shared.set(botToken, instance);
+    }
+    return instance;
+}

package/dist/utils/tokenTracker.js

@@ -22,6 +22,7 @@ const MODEL_CONTEXT_WINDOWS = {
     'gpt-5.4': 1_050_000,
     'gpt-5.4-mini': 400_000,
     // Anthropic
+    'claude-fable-5-1': 1_000_000,
     'claude-fable-5': 1_000_000,
     'claude-opus-5': 1_000_000,
     'claude-sonnet-4-6': 1_000_000,
@@ -97,10 +98,11 @@ const MODEL_PRICING = {
     'gpt-5.4': { inputPer1M: 2.50, outputPer1M: 15.00 },
     'gpt-5.4-mini': { inputPer1M: 0.75, outputPer1M: 4.50 },
     // Anthropic
+    'claude-fable-5-1': { inputPer1M: 10.00, outputPer1M: 50.00 },
     'claude-fable-5': { inputPer1M: 10.00, outputPer1M: 50.00 },
     'claude-opus-5': { inputPer1M: 5.00, outputPer1M: 25.00 },
     'claude-sonnet-4-6': { inputPer1M: 3.00, outputPer1M: 15.00 },
-    'claude-sonnet-5': { inputPer1M: 3.00, outputPer1M: 15.00 },
+    'claude-sonnet-5': { inputPer1M: 2.00, outputPer1M: 10.00 },
     'claude-haiku-4-5-20251001': { inputPer1M: 1.00, outputPer1M: 5.00 },
     // DeepSeek (cache-miss input pricing)
     // DeepSeek moved to peak / off-peak billing on 2026-08-16, with off-peak at
@@ -206,11 +208,18 @@ export function recordTokenUsage(usage, model, provider, actualCostUsd) {
  */
 export function extractOpenAIUsage(data) {
     if (data?.usage) {
-        // OpenAI-protocol `prompt_tokens` is INCLUSIVE of cached prompt tokens
-        // (DeepSeek/OpenAI report cache hits in prompt_tokens_details.cached_tokens).
+        // OpenAI-protocol `prompt_tokens` is INCLUSIVE of cached prompt tokens.
         // Surface them so getCostBreakdown bills cache reads at the discounted
         // rate instead of the full cache-miss input rate.
-        const cached = data.usage.prompt_tokens_details?.cached_tokens || 0;
+        //
+        // Two shapes are in the wild. OpenAI, DeepSeek and Qwen's text models nest
+        // it under prompt_tokens_details; Kimi returns it at the top level, and
+        // Alibaba's own docs say some Qwen models still do and will be migrated
+        // later. Reading only the nested form zeroed every Kimi cache hit, so the
+        // cached portion of a run billed at the full cache-miss rate — five times
+        // what it costs — with nothing anywhere to say so.
+        const nested = data.usage.prompt_tokens_details?.cached_tokens;
+        const cached = (typeof nested === 'number' ? nested : data.usage.cached_tokens) || 0;
         return {
             promptTokens: data.usage.prompt_tokens || 0,
             completionTokens: data.usage.completion_tokens || 0,
@@ -242,6 +251,36 @@ export function extractAnthropicUsage(data) {
     }
     return null;
 }
+/**
+ * What a provider charges to read a cached token, as a fraction of its own
+ * cache-miss input rate.
+ *
+ * 0.1 is Anthropic's ratio and used to be applied to everyone. Kimi lists
+ * $0.19 against a $0.95 cache-miss rate, and Alibaba prices Qwen's implicit
+ * cache at 20% of input — both 0.2, so every cached token on those two was
+ * billed at half what it actually costs.
+ */
+/**
+ * Models whose cache-read rate is not their provider's usual one.
+ *
+ * Fable 5.1 reads a cached token at 0.025× the base input price, where every
+ * other Anthropic model charges 0.1×. Checked before the provider map, because
+ * this is a property of the model and not of the account it runs under.
+ */
+const MODEL_CACHE_READ_RATE = {
+    'claude-fable-5-1': 0.025,
+};
+const CACHE_READ_RATE = {
+    'kimi': 0.2,
+    'kimi-api': 0.2,
+    'qwen': 0.2,
+    'qwen-api': 0.2,
+    'qwen-cn': 0.2,
+    'qwen-cn-api': 0.2,
+    'qwen-token-plan': 0.2,
+};
+/** Anthropic's ratio, and the safest guess for a provider we have not priced. */
+const DEFAULT_CACHE_READ_RATE = 0.1;
 /**
  * Get cost breakdown grouped by provider/model.
  *
@@ -269,16 +308,20 @@ export function getCostBreakdown(startIndex = 0) {
         else {
             const pricing = MODEL_PRICING[record.model];
             if (pricing) {
-                // Anthropic prompt caching: cache_creation_input is billed at 1.25×
-                // the base input rate, cache_read_input at 0.1×. The remaining
-                // (uncached) prompt tokens bill at the standard 1.0× rate.
+                // Cache writes bill at 1.25× the base input rate (Anthropic's, and the
+                // only provider here that charges for them at all); cache reads bill
+                // at whatever fraction the provider charges. The remaining (uncached)
+                // prompt tokens bill at the standard 1.0× rate.
                 const cacheCreate = record.cacheCreationTokens ?? 0;
                 const cacheRead = record.cacheReadTokens ?? 0;
+                const cacheReadRate = MODEL_CACHE_READ_RATE[record.model]
+                    ?? CACHE_READ_RATE[record.provider?.trim().toLowerCase()]
+                    ?? DEFAULT_CACHE_READ_RATE;
                 const uncachedPrompt = Math.max(0, record.promptTokens - cacheCreate - cacheRead);
                 existing.estimatedCost +=
                     (uncachedPrompt / 1_000_000) * pricing.inputPer1M
                         + (cacheCreate / 1_000_000) * pricing.inputPer1M * 1.25
-                        + (cacheRead / 1_000_000) * pricing.inputPer1M * 0.1
+                        + (cacheRead / 1_000_000) * pricing.inputPer1M * cacheReadRate
                         + (record.completionTokens / 1_000_000) * pricing.outputPer1M;
             }
         }

package/dist/utils/tools.js

@@ -57,7 +57,12 @@ export const AGENT_TOOLS = {
     },
     execute_command: {
         name: 'execute_command',
-        description: 'Execute a shell command. Use for npm, git, build tools, tests, etc.',
+        // Naming a few examples read as an exhaustive list: the agent refused
+        // `sleep`, which IS on the allowlist, explaining that its tool was
+        // "limited to package managers and version control". It believed the
+        // description over its own capability. Say the shape instead, and let
+        // the runtime refuse — it already answers with a specific reason.
+        description: 'Execute a shell command. A safety allowlist applies and covers far more than build tooling — package managers, git, test runners, and ordinary utilities such as ls, cat, grep, find, echo, date, sleep and curl. Do not assume a command is forbidden: try it, and a refusal will say so.',
         parameters: {
             command: { type: 'string', description: 'The command to run (e.g., npm, git, node)', required: true },
             args: { type: 'array', description: 'Command arguments as array (e.g., ["install", "lodash"])', required: false },

package/dist/version.d.ts

@@ -1 +1 @@
-export declare const VERSION = "2.25.0";
+export declare const VERSION = "3.1.0";

package/dist/version.js

@@ -1,4 +1,4 @@
 // AUTO-GENERATED by scripts/gen-version.js — do not edit by hand.
 // Baked from package.json at build time so the bun-compiled binary reports
 // the right version (it has no package.json on disk to read at runtime).
-export const VERSION = '2.25.0';
+export const VERSION = '3.1.0';

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "codeep",
-  "version": "2.25.0",
+  "version": "3.1.0",
   "description": "AI-powered coding assistant built for the terminal. Multiple LLM providers, project-aware context, and a seamless development workflow.",
   "type": "module",
   "main": "dist/index.js",