companion-for-agy 1.2.0-alpha.2 → 1.2.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # Changelog
 
+## [1.2.0] - 2026-06-07
+
+### Fixed (Bugsweep)
+- **Security:** Stale temp workspace from crashed run with same PID could leak permissions to new run — now cleaned on startup (`e8c5230`)
+- Temp directory leak in sandbox/skip-permissions modes when no custom rules are set (`d406299`)
+- Temp cleanup race on Windows: post-kill delay + rmSync retries for CWD lock (`41412d6`)
+- ConPTY text extraction: stale cursor position, bold SGR false-positive, dedup scope too narrow (`c2194bb`)
+- isNoiseLine false positives for blockquotes (`>`) and lines containing "tokens" keyword (`f6a8e7b`)
+
 ## [1.2.0-alpha.2] - 2026-06-07
 
 ### Changed

package/README_de.md

@@ -41,6 +41,18 @@ npm install -g companion-for-agy
   - **macOS:** `xcode-select --install`
   - **Linux:** `sudo apt install build-essential python3` (Debian/Ubuntu)
 
+### Fehlerbehebung bei `node-pty` Build-Fehlern
+
+Falls `npm install` mit nativen Kompilierungsfehlern fehlschlägt:
+
+```bash
+# Alle Plattformen: native Module neu bauen
+npm rebuild node-pty
+
+# Windows: falls cl.exe nicht gefunden wird, Visual Studio Build Tools installieren
+# dann "Developer Command Prompt" oder "x64 Native Tools" verwenden
+```
+
 ## Verwendung
 
 ```bash
@@ -73,6 +85,13 @@ companion-for-agy [optionen] "prompt"
 | `--json` | Ausgabe als JSON-Objekt |
 | `--debug` | Rohen PTY-Output in `agy-debug.log` speichern |
 
+### Umgebungsvariablen
+
+| Variable | Beschreibung |
+|----------|-------------|
+| `AGY_COMPANION_AGY_PATH` | Pfad zur agy-Binary (wird automatisch erkannt wenn nicht gesetzt) |
+| `AGY_PATH` | Alternativer Pfad zur agy-Binary |
+
 ### Beispiele
 
 ```bash
@@ -85,6 +104,9 @@ companion-for-agy --no-tools "Überprüfe diesen Code: ..."
 # Web-Recherche
 companion-for-agy --researcher "Neueste Infos zu Node.js 24"
 
+# Nur-Lesen mit zusätzlicher Git-Berechtigung
+companion-for-agy --read-only --allow "command(git log)" "prompt"
+
 # JSON-Output für programmatische Nutzung
 companion-for-agy --json --model gemini-3.5-pro "prompt"
 ```
@@ -121,6 +143,10 @@ companion-for-agy --json --model gemini-3.5-pro "prompt"
 - **CI/CD-Pipelines:** Automatisierte Gemini-Abfragen in Build-Scripts
 - **Scripting:** Jedes Szenario wo agys Antwort als Text benötigt wird
 
+## Hintergrund
+
+Dieses Tool entstand, weil drei CLI-Agenten — **Claude Code**, **Codex** und **agy** — sich gegenseitig als Fallback-Berater aufrufen können müssen. Claude → Codex und agy → Claude/Codex funktionieren bereits, aber Claude → agy war durch den TUI-stdout-Bug blockiert.
+
 ## Lizenz
 
 MIT

package/ROADMAP.md

@@ -63,6 +63,15 @@ Emit response tokens as they arrive (line-by-line or chunk-by-chunk) instead of
 ### Response Format Detection
 Detect whether agy's response is Markdown, JSON, or plain text and expose this in the JSON output (`"format": "markdown"`).
 
+### Robustness Improvements (from Bugsweep 2026-06-07)
+
+Items identified during the systematic bug sweep that are design improvements, not defects:
+
+- **Response idle timer minimum-progress threshold:** Currently, any single byte within the idle window resets the timer. A very slow stream (1 char/10s) keeps the timer alive indefinitely — only the global timeout catches it. Add a "minimum bytes since last check" threshold.
+- **Signal handling for external kill:** Register `process.on('SIGTERM')` and `process.on('SIGINT')` to ensure temp workspace cleanup when the process is killed externally (e.g., by a parent orchestrator or Ctrl+C in a pipeline).
+- **Dead code cleanup:** `tempSettingsCreated` variable is set but never read. Cleanup works unconditionally via `cleanupTemp()`.
+- **Prompt-echo filter edge case:** Very short prompts (≤2 chars) identical to the response text are incorrectly filtered as prompt echoes. Rare in practice (requires the user's question to be the same as the answer), but theoretically possible.
+
 ## Completed (v1.2.0-alpha.1)
 
 - Trust dialog auto-confirmation (5-phase state machine)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "companion-for-agy",
-  "version": "1.2.0-alpha.2",
+  "version": "1.2.0",
   "description": "Unofficial PTY-based wrapper for agy (Antigravity CLI / Gemini CLI) — captures Gemini responses that agy writes to the terminal buffer instead of stdout",
   "type": "module",
   "main": "src/agy-companion.mjs",

package/src/agy-companion.mjs

@@ -71,6 +71,38 @@ export function findAgyPath() {
 
 export const AGY_PATH = findAgyPath();
 
+// ---------- Go-style Duration Parser ----------
+
+export function parseDurationToMs(str) {
+  if (!str) return null;
+  const regex = /(\d+(?:\.\d+)?)(ns|us|µs|ms|s|m|h)/g;
+  let match;
+  let totalMs = 0;
+  let hasMatch = false;
+  while ((match = regex.exec(str)) !== null) {
+    hasMatch = true;
+    const value = parseFloat(match[1]);
+    const unit = match[2];
+    switch (unit) {
+      case 'ns': totalMs += value / 1e6; break;
+      case 'us':
+      case 'µs': totalMs += value / 1000; break;
+      case 'ms': totalMs += value; break;
+      case 's': totalMs += value * 1000; break;
+      case 'm': totalMs += value * 60000; break;
+      case 'h': totalMs += value * 3600000; break;
+    }
+  }
+  if (!hasMatch) {
+    const plain = parseFloat(str);
+    if (!isNaN(plain) && plain > 0) {
+      return Math.round(plain * 1000);
+    }
+    return null;
+  }
+  return Math.round(totalMs);
+}
+
 // ---------- Permission-Presets ----------
 
 export const PERMISSION_PRESETS = {
@@ -105,6 +137,7 @@ export const PERMISSION_PRESETS = {
 // ---------- State-Machine-Patterns ----------
 
 export const TRUST_DIALOG_PATTERN = /Do you trust/;
+export const LOGIN_PROMPT_PATTERN = /Select login method/;
 export const BANNER_MODEL_PATTERN = /Gemini \d[\d.]* \w+(?:\s*\([^)]*\))?/;
 
 export const STARTUP_DONE_PATTERNS = [
@@ -151,9 +184,9 @@ export function isNoiseLine(line, promptFilter = '') {
   const t = line.trim();
   if (!t) return true;
   if (/^[│┌└┐┘├┤┬┴┼─═╔╗╚╝╠╣╦╩╬▸►◉●▲▼◆□■╭╮╯╰]+$/.test(t)) return true;
-  if (t.startsWith('>')) return true;
+  if (t === '>') return true;
   if (/[⣾⣷⣯⣟⡿⢿⣻⣽⠿⠾⠽⠼⠻⠺⠹⠸⠷⠶⠵⠴⠳⠲⠱⠰]/.test(t)) return true;
-  if (/Generating|esc to cancel|for shortcuts|tokens/i.test(t)) return true;
+  if (/Generating|esc to cancel|for shortcuts/i.test(t)) return true;
   if (t === '?' || t === '? for shortcuts') return true;
   if (/^Gemini \d/.test(t)) return true;
   if (/^\d+\s*tokens$/.test(t)) return true;
@@ -172,6 +205,12 @@ export function extractByResponseColor(rawSection) {
   let inResponseColor = false;
   let pos = 0;
   const src = rawSection;
+  let hadCursorPos = false;
+  let cursorRow = null;
+  let cursorCol = null;
+  let gapHadNewline = false;
+  let currentGapNewline = false;
+  let preColorSpaces = 0;
 
   while (pos < src.length) {
     if (src[pos] === '\x1b') {
@@ -182,8 +221,26 @@ export function extractByResponseColor(rawSection) {
         const params = src.slice(pos + 2, end);
         if (params === '38;2;232;234;237' && cmd === 'm') {
           inResponseColor = true;
+          currentGapNewline = gapHadNewline;
+          hadCursorPos = false;
+          cursorRow = null;
+          cursorCol = null;
+          gapHadNewline = false;
         } else if (cmd === 'm') {
-          inResponseColor = false;
+          if (params === '' || params === '0' || params === '39' ||
+              (params.startsWith('38;') && params !== '38;2;232;234;237') ||
+              /^3[0-7]$/.test(params) || /^9[0-7]$/.test(params)) {
+            inResponseColor = false;
+          }
+        } else if (inResponseColor && (cmd === 'H' || cmd === 'f')) {
+          hadCursorPos = true;
+          const parts = params.split(';');
+          if (parts.length >= 2) {
+            const r = parseInt(parts[0], 10);
+            const c = parseInt(parts[1], 10);
+            if (!isNaN(r)) cursorRow = r;
+            if (!isNaN(c)) cursorCol = c;
+          }
         }
         pos = end + 1;
       } else if (src[pos + 1] === ']') {
@@ -199,9 +256,29 @@ export function extractByResponseColor(rawSection) {
       while (textEnd < src.length && src[textEnd] !== '\x1b') textEnd++;
       const rawText = src.slice(pos, textEnd);
       const text = rawText.replace(/[\x00-\x08\x0b\x0e-\x1f\x7f]/g, '');
-      if (text.length > 0) segments.push(text);
+      if (text.length > 0) {
+        segments.push({
+          text,
+          newLine: currentGapNewline && !hadCursorPos,
+          startCol: hadCursorPos ? cursorCol : null,
+          startRow: hadCursorPos ? cursorRow : null,
+          estimatedCol: !hadCursorPos ? preColorSpaces + 1 : null,
+        });
+        currentGapNewline = false;
+        if (hadCursorPos && cursorCol !== null) {
+          cursorCol += text.length;
+        }
+      }
       pos = textEnd;
     } else {
+      if (src[pos] === '\n') {
+        gapHadNewline = true;
+        preColorSpaces = 0;
+      } else if (src[pos] === ' ') {
+        preColorSpaces++;
+      } else {
+        preColorSpaces = 0;
+      }
       pos++;
     }
   }
@@ -209,10 +286,58 @@ export function extractByResponseColor(rawSection) {
   if (segments.length === 0) return null;
 
   const deduped = segments.filter((s, i) =>
-    !segments.some((o, j) => j !== i && o.length > s.length && o.startsWith(s))
+    !segments.some((o, j) => j !== i &&
+      s.startCol === null &&
+      o.text.length > s.text.length && o.text.startsWith(s.text))
   );
 
-  const combined = deduped.join('').trim();
+  let combined = '';
+  let lastEndCol = null;
+  let lastRow = null;
+  for (let i = 0; i < deduped.length; i++) {
+    const seg = deduped[i];
+    const rowChanged = seg.startRow !== null && lastRow !== null && seg.startRow !== lastRow;
+    if (i === 0) {
+      combined = seg.text;
+      if (seg.startCol !== null) {
+        lastEndCol = seg.startCol + seg.text.length;
+      } else if (seg.estimatedCol !== null) {
+        lastEndCol = seg.estimatedCol + seg.text.length;
+      }
+      if (seg.startRow !== null) lastRow = seg.startRow;
+    } else if (seg.startCol !== null && lastEndCol !== null && !rowChanged) {
+      const gap = seg.startCol - lastEndCol;
+      if (gap > 0) combined += ' '.repeat(gap);
+      else if (gap < 0) combined = combined.slice(0, Math.max(0, combined.length + gap));
+      combined += seg.text;
+      lastEndCol = seg.startCol + seg.text.length;
+      if (seg.startRow !== null) lastRow = seg.startRow;
+    } else if (seg.startCol !== null && !rowChanged) {
+      combined += seg.text;
+      lastEndCol = seg.startCol + seg.text.length;
+      if (seg.startRow !== null) lastRow = seg.startRow;
+    } else if (rowChanged || seg.newLine) {
+      if (seg.startCol !== null && lastEndCol !== null && seg.startCol === lastEndCol) {
+        combined += seg.text;
+      } else {
+        combined = combined.trimEnd() + ' ' + seg.text;
+      }
+      if (seg.startCol !== null) {
+        lastEndCol = seg.startCol + seg.text.length;
+      } else if (seg.estimatedCol !== null) {
+        lastEndCol = seg.estimatedCol + seg.text.length;
+      } else {
+        lastEndCol = null;
+      }
+      if (seg.startRow !== null) lastRow = seg.startRow;
+    } else {
+      combined += seg.text;
+      if (lastEndCol !== null) {
+        lastEndCol += seg.text.length;
+      }
+    }
+  }
+  combined = combined.replace(/ {2,}/g, ' ').trim();
   return combined.length > 0 ? combined : null;
 }
 
@@ -264,14 +389,16 @@ export function extractResponse(stripped, rawSection, promptFilter = '', effecti
   if (meaningful.length === 0) return null;
 
   let best = meaningful.join('\n').trim();
-  if (promptFilter) {
-    const promptWords = promptFilter.split(/\s+/).slice(0, 5).join('');
-    best = best.split('\n')
-      .filter(l => !l.replace(/\s/g, '').startsWith(promptWords.replace(/\s/g, '')))
-      .join('\n')
-      .trim();
+  const echoFilter = effectiveFilter || promptFilter;
+  if (echoFilter) {
+    const cleaned = stripPromptEcho(best, echoFilter);
+    if (cleaned !== null) best = cleaned || '';
   }
-  return best || null;
+  if (promptFilter && promptFilter !== echoFilter) {
+    const cleaned = stripPromptEcho(best, promptFilter);
+    if (cleaned !== null) best = cleaned || '';
+  }
+  return best.trim() || null;
 }
 
 // ---------- CLI Main ----------
@@ -362,7 +489,7 @@ if (isMainModule()) {
       jsonOutput = true;
     } else if (arg === '--sandbox') {
       permissionMode = 'sandbox';
-    } else if (arg === '--skip-permissions') {
+    } else if (arg === '--skip-permissions' || arg === '--dangerously-skip-permissions') {
       permissionMode = 'skip-permissions';
     } else if (arg === '--no-tools') {
       permissionMode = 'no-tools';
@@ -370,6 +497,16 @@ if (isMainModule()) {
       permissionMode = 'researcher';
     } else if (arg === '--read-only') {
       permissionMode = 'read-only';
+    } else if (arg === '--print-timeout' && rawArgs[i + 1]) {
+      const ms = parseDurationToMs(rawArgs[++i]);
+      if (ms !== null) timeoutMs = ms;
+    } else if (arg.startsWith('--print-timeout=')) {
+      const ms = parseDurationToMs(arg.slice(16));
+      if (ms !== null) timeoutMs = ms;
+    } else if (arg === '-p' || arg === '--print' || arg === '--prompt') {
+      // Ignored: agy-companion runs in interactive mode internally to capture PTY/ANSI
+    } else if (arg === '-i' || arg === '--prompt-interactive') {
+      // Ignored: agy-companion runs interactive by default
     } else if (arg === '--allow' && rawArgs[i + 1]) {
       customAllow.push(rawArgs[++i]);
     } else if (arg === '--deny' && rawArgs[i + 1]) {
@@ -396,6 +533,9 @@ if (isMainModule()) {
   const tempWorkspace = path.join(os.tmpdir(), `agy-companion-${process.pid}`);
   let tempSettingsCreated = false;
 
+  // Clean stale workspace from a previous crashed run with same PID
+  try { fs.rmSync(tempWorkspace, { recursive: true, force: true }); } catch (_) {}
+
   if (allAllow.length > 0 || allDeny.length > 0) {
     const geminiDir = path.join(tempWorkspace, '.gemini');
     fs.mkdirSync(geminiDir, { recursive: true });
@@ -491,7 +631,7 @@ if (isMainModule()) {
     cols: 220,
     rows: 50,
     cwd: tempWorkspace,
-    env: { ...process.env, TERM: 'xterm-256color' },
+    env: { ...process.env, TERM: 'xterm-256color', COLORTERM: 'truecolor' },
   });
 
   let rawBuffer = '';
@@ -514,11 +654,7 @@ if (isMainModule()) {
 
   function cleanupTemp() {
     try {
-      if (tempSettingsCreated) {
-        fs.rmSync(tempWorkspace, { recursive: true, force: true });
-      } else {
-        fs.rmdirSync(tempWorkspace);
-      }
+      fs.rmSync(tempWorkspace, { recursive: true, force: true, maxRetries: 5, retryDelay: 200 });
     } catch (_) {}
   }
 
@@ -539,8 +675,11 @@ if (isMainModule()) {
         process.stderr.write(`[agy-companion] Debug log: ${debugPath}\n`);
       }
 
-      cleanupTemp();
-      process.exit(code);
+      // Windows holds a CWD lock on tempWorkspace until child processes fully terminate
+      setTimeout(() => {
+        cleanupTemp();
+        process.exit(code);
+      }, 1000);
     }, 500);
   }
 
@@ -599,6 +738,12 @@ if (isMainModule()) {
         }
       }
 
+      if (LOGIN_PROMPT_PATTERN.test(recentStripped)) {
+        process.stderr.write(`[agy-companion] agy is not signed in. Please run 'agy' manually and complete sign-in first.\n`);
+        shutdown(3);
+        return;
+      }
+
       if (!trustHandled && TRUST_DIALOG_PATTERN.test(recentStripped)) {
         trustHandled = true;
         process.stderr.write(`[agy-companion] Trust dialog detected. Auto-confirming...\n`);