glm-coding-router 2.0.0 → 2.1.0

package/dist/core/zai-quota.js

@@ -16,7 +16,89 @@ export function describeWindow(limit) {
     }
     return `window unit=${String(limit.unit)} x ${String(limit.number)}`;
 }
-/** Fetch and validate the Z.ai quota snapshot. Never logs the Authorization header. */
+/**
+ * Thrown by `fetchZaiQuota` instead of a plain `Error`. `message` is always a
+ * safe, locally-constructed string — it never contains the raw response body,
+ * a provider `msg`, headers, or a URL with credentials (spec §D "Security").
+ */
+export class ZaiQuotaError extends Error {
+    kind;
+    httpStatus;
+    /** Only meaningful when kind === "network": distinguishes a timeout from any other network failure. */
+    timeout;
+    constructor(kind, message, options = {}) {
+        super(message);
+        this.name = "ZaiQuotaError";
+        this.kind = kind;
+        this.httpStatus = options.httpStatus;
+        this.timeout = options.timeout ?? false;
+    }
+}
+function isPlainObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function isFiniteNumberOrAbsent(value) {
+    return value === undefined || (typeof value === "number" && Number.isFinite(value));
+}
+/** Every quota field is optional, but any field that IS present must be well-typed. */
+function isValidLimit(entry) {
+    if (!isPlainObject(entry))
+        return false;
+    if (entry.type !== undefined && typeof entry.type !== "string")
+        return false;
+    return (isFiniteNumberOrAbsent(entry.unit) &&
+        isFiniteNumberOrAbsent(entry.number) &&
+        isFiniteNumberOrAbsent(entry.usage) &&
+        isFiniteNumberOrAbsent(entry.currentValue) &&
+        isFiniteNumberOrAbsent(entry.remaining) &&
+        isFiniteNumberOrAbsent(entry.percentage) &&
+        isFiniteNumberOrAbsent(entry.nextResetTime));
+}
+/**
+ * Validate the monitor response shape (spec §D "Success validation"). Empty
+ * `limits` is a valid, fully-authenticated response meaning "no windows
+ * reported" — never treated as zero quota. A missing or wrong-type `limits`
+ * field means the schema did not match, which is unverified, not rejected.
+ */
+function parseQuotaBody(body) {
+    if (!isPlainObject(body)) {
+        return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint returned an unexpected response shape." };
+    }
+    if (typeof body.code !== "number") {
+        return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint response is missing a status code." };
+    }
+    if (body.code !== 200) {
+        return { ok: false, kind: "provider", message: `Z.ai monitor endpoint rejected the request (code ${body.code}).` };
+    }
+    if (body.success !== undefined && body.success !== true) {
+        return { ok: false, kind: "provider", message: "Z.ai monitor endpoint reported an unsuccessful request." };
+    }
+    if (!isPlainObject(body.data)) {
+        return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint response is missing usage data." };
+    }
+    const data = body.data;
+    if (data.level !== undefined && typeof data.level !== "string") {
+        return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint response has an invalid level field." };
+    }
+    if (!Array.isArray(data.limits)) {
+        return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint response is missing usage limits." };
+    }
+    for (const entry of data.limits) {
+        if (!isValidLimit(entry)) {
+            return { ok: false, kind: "invalid-response", message: "Z.ai monitor endpoint response contains a malformed limit entry." };
+        }
+    }
+    return {
+        ok: true,
+        data: { level: data.level, limits: data.limits },
+    };
+}
+/**
+ * Fetch and validate the Z.ai quota snapshot. Never logs the Authorization
+ * header. Throws `ZaiQuotaError` on any failure — callers branch on `.kind`.
+ * `redirect: "error"` refuses to forward the bearer token to a redirect
+ * target (spec §D "Security").
+ */
 export async function fetchZaiQuota(key, fetchImpl) {
     let response;
     try {
@@ -24,23 +106,43 @@ export async function fetchZaiQuota(key, fetchImpl) {
             method: "GET",
             headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
             signal: AbortSignal.timeout(10_000),
+            redirect: "error",
         });
     }
     catch (error) {
-        throw new Error(`Z.ai monitor endpoint unreachable (${error instanceof Error ? error.message : "network error"})`);
+        const isTimeout = error instanceof Error && error.name === "TimeoutError";
+        throw new ZaiQuotaError("network", isTimeout ? "Z.ai monitor endpoint timed out." : "Z.ai monitor endpoint was unreachable.", { timeout: isTimeout });
+    }
+    if (response.status === 401) {
+        throw new ZaiQuotaError("unauthorized", "Z.ai monitor endpoint rejected the key (HTTP 401).", {
+            httpStatus: 401,
+        });
+    }
+    if (response.status === 403) {
+        throw new ZaiQuotaError("forbidden", "Z.ai monitor endpoint denied access (HTTP 403).", {
+            httpStatus: 403,
+        });
+    }
+    if (response.status === 429) {
+        throw new ZaiQuotaError("rate-limited", "Z.ai monitor endpoint is rate-limiting this key (HTTP 429).", {
+            httpStatus: 429,
+        });
     }
     if (!response.ok) {
-        throw new Error(`Z.ai monitor endpoint returned HTTP ${response.status}`);
+        throw new ZaiQuotaError("http", `Z.ai monitor endpoint returned HTTP ${response.status}.`, {
+            httpStatus: response.status,
+        });
     }
     let body;
     try {
-        body = (await response.json());
+        body = await response.json();
     }
     catch {
-        throw new Error("Z.ai monitor endpoint returned a non-JSON body");
+        throw new ZaiQuotaError("invalid-response", "Z.ai monitor endpoint returned a non-JSON body.");
     }
-    if (body.code !== 200 || typeof body.data !== "object" || body.data === null) {
-        throw new Error(`Z.ai monitor endpoint rejected the request (${body.msg ?? `code ${String(body.code)}`})`);
+    const parsed = parseQuotaBody(body);
+    if (!parsed.ok) {
+        throw new ZaiQuotaError(parsed.kind, parsed.message);
     }
-    return body.data;
+    return parsed.data;
 }

package/dist/templates/agents-block.js

@@ -1,55 +1,55 @@
 /** Managed block content for AGENTS.md (spec §24). Keep in sync with the spec. */
-export const AGENTS_MANAGED_BLOCK = `<!-- glm-coding-router:start -->
-
-## GLM Worker Delegation
-
-Available commands:
-
-- \`glm-worker "<task>"\`
-- \`glm-review "<task>"\`
-
-Codex is the primary orchestrator.
-
-Delegate:
-- CRUD
-- boilerplate
-- tests
-- documentation
-- mechanical refactoring
-- repository exploration
-- straightforward implementation
-
-Keep in Codex:
-- requirements
-- planning
-- architecture
-- ambiguous business logic
-- complex debugging
-- security decisions
-- integration
-- final review
-
-Before delegation create a task packet:
-
-TASK
-SCOPE
-FILES ALLOWED TO MODIFY
-FILES NOT TO MODIFY
-REQUIREMENTS
-CONSTRAINTS
-ACCEPTANCE CRITERIA
-VALIDATION
-EXPECTED OUTPUT
-
-Never trust a worker's success report without inspecting the resulting changes.
-
-Worker exit codes 41 and 42 are NOT crashes:
-
-- stdout carries one JSON object: \`{"status":"handoff_required", ...}\`
-- read \`handoff_path\` — a handoff.md with what was done, what remains, files
-  changed, and untracked files that are NOT in diff.patch
-- continue the task yourself in the SAME worktree, starting from "Remaining"
-- do not re-run the worker until quota resets
-- 41 means nothing was spawned; 42 means work was done and is preserved
-
+export const AGENTS_MANAGED_BLOCK = `<!-- glm-coding-router:start -->
+
+## GLM Worker Delegation
+
+Available commands:
+
+- \`glm-worker "<task>"\`
+- \`glm-review "<task>"\`
+
+Codex is the primary orchestrator.
+
+Delegate:
+- CRUD
+- boilerplate
+- tests
+- documentation
+- mechanical refactoring
+- repository exploration
+- straightforward implementation
+
+Keep in Codex:
+- requirements
+- planning
+- architecture
+- ambiguous business logic
+- complex debugging
+- security decisions
+- integration
+- final review
+
+Before delegation create a task packet:
+
+TASK
+SCOPE
+FILES ALLOWED TO MODIFY
+FILES NOT TO MODIFY
+REQUIREMENTS
+CONSTRAINTS
+ACCEPTANCE CRITERIA
+VALIDATION
+EXPECTED OUTPUT
+
+Never trust a worker's success report without inspecting the resulting changes.
+
+Worker exit codes 41 and 42 are NOT crashes:
+
+- stdout carries one JSON object: \`{"status":"handoff_required", ...}\`
+- read \`handoff_path\` — a handoff.md with what was done, what remains, files
+  changed, and untracked files that are NOT in diff.patch
+- continue the task yourself in the SAME worktree, starting from "Remaining"
+- do not re-run the worker until quota resets
+- 41 means nothing was spawned; 42 means work was done and is preserved
+
 <!-- glm-coding-router:end -->`;

package/dist/templates/claude-block.js

@@ -1,58 +1,58 @@
 /** Managed block content for CLAUDE.md (spec §20). Keep in sync with the spec. */
-export const CLAUDE_MANAGED_BLOCK = `<!-- glm-coding-router:start -->
-
-## GLM Worker Delegation
-
-GLM workers available:
-
-- \`glm-worker "<task>"\`
-- \`glm-review "<task>"\`
-
-Delegate well-scoped, implementation-heavy work to GLM.
-
-Use GLM for:
-- repository exploration
-- CRUD
-- boilerplate
-- tests
-- documentation
-- mechanical refactoring
-- straightforward implementation
-
-Claude remains responsible for:
-- requirements
-- architecture
-- ambiguous business rules
-- security-sensitive decisions
-- complex debugging
-- integration
-- final review
-
-Before delegation, define:
-- task
-- scope
-- allowed files
-- forbidden files
-- requirements
-- constraints
-- acceptance criteria
-- validation command
-- expected output
-
-After worker completion:
-1. inspect the actual diff
-2. validate against requirements
-3. run relevant tests
-4. resolve integration problems
-5. accept only after verification
-
-Worker exit codes 41 and 42 are NOT crashes:
-
-- stdout carries one JSON object: \`{"status":"handoff_required", ...}\`
-- read \`handoff_path\` — a handoff.md with what was done, what remains, files
-  changed, and untracked files that are NOT in diff.patch
-- continue the task yourself in the SAME worktree, starting from "Remaining"
-- do not re-run the worker until quota resets
-- 41 means nothing was spawned; 42 means work was done and is preserved
-
+export const CLAUDE_MANAGED_BLOCK = `<!-- glm-coding-router:start -->
+
+## GLM Worker Delegation
+
+GLM workers available:
+
+- \`glm-worker "<task>"\`
+- \`glm-review "<task>"\`
+
+Delegate well-scoped, implementation-heavy work to GLM.
+
+Use GLM for:
+- repository exploration
+- CRUD
+- boilerplate
+- tests
+- documentation
+- mechanical refactoring
+- straightforward implementation
+
+Claude remains responsible for:
+- requirements
+- architecture
+- ambiguous business rules
+- security-sensitive decisions
+- complex debugging
+- integration
+- final review
+
+Before delegation, define:
+- task
+- scope
+- allowed files
+- forbidden files
+- requirements
+- constraints
+- acceptance criteria
+- validation command
+- expected output
+
+After worker completion:
+1. inspect the actual diff
+2. validate against requirements
+3. run relevant tests
+4. resolve integration problems
+5. accept only after verification
+
+Worker exit codes 41 and 42 are NOT crashes:
+
+- stdout carries one JSON object: \`{"status":"handoff_required", ...}\`
+- read \`handoff_path\` — a handoff.md with what was done, what remains, files
+  changed, and untracked files that are NOT in diff.patch
+- continue the task yourself in the SAME worktree, starting from "Remaining"
+- do not re-run the worker until quota resets
+- 41 means nothing was spawned; 42 means work was done and is preserved
+
 <!-- glm-coding-router:end -->`;

package/dist/tui/command-ui.js

@@ -0,0 +1,158 @@
+/**
+ * Shared presentation layer for the management screens — `doctor`, `status`,
+ * `usage`, and the root landing page (specs/terminal-ui-doctor.md §A). This
+ * module never fetches data, reads credentials, or makes routing decisions;
+ * it only turns already-computed values into aligned, width-aware text.
+ *
+ * All ANSI stays in render.ts (`paint`); this file composes plain strings
+ * and colors them through that one choke point.
+ */
+import { displayWidth, padEndDisplay, paint, truncate } from "./render.js";
+const STATUS_TAG = {
+    ok: "[OK]",
+    warn: "[WARN]",
+    fail: "[FAIL]",
+    info: "[INFO]",
+};
+const STATUS_STYLE = {
+    ok: "green",
+    warn: "yellow",
+    fail: "red",
+    info: "cyan",
+};
+/** Widest tag ("[WARN]"/"[FAIL]"/"[INFO]") plus one separating space. */
+const TAG_COLUMN = 7;
+const BASE_INDENT = "  ";
+const LABEL_COLUMN = 24;
+const MIN_BOX_WIDTH = 44;
+const MAX_BOX_WIDTH = 78;
+const BAR_SLOTS = 20;
+function effectiveWidth(writer) {
+    return Number.isFinite(writer.columns) && writer.columns > 0 ? Math.floor(writer.columns) : 80;
+}
+/** Strip control characters from text that did not originate in this module (spec §A). */
+function sanitize(text, allowNewline) {
+    const pattern = allowNewline ? /[\x00-\x09\x0B\x0C\x0E-\x1F\x7F]/g : /[\x00-\x1F\x7F]/g;
+    return text.replace(pattern, "");
+}
+function border(width) {
+    return `+${"-".repeat(Math.max(width - 2, 0))}+`;
+}
+function boxLine(text, width) {
+    const inner = Math.max(width - 4, 0);
+    return `| ${padEndDisplay(truncate(text, inner), inner)} |`;
+}
+/**
+ * Wrap `text` to `width`-wide lines (measured in display columns, not code
+ * units — spec §A "Width uses display cells") without breaking a word
+ * mid-way when avoidable.
+ */
+function wrap(text, width) {
+    if (width <= 0)
+        return [text];
+    const words = text.split(/\s+/).filter((w) => w.length > 0);
+    const lines = [];
+    let current = "";
+    for (const word of words) {
+        const candidate = current.length === 0 ? word : `${current} ${word}`;
+        if (displayWidth(candidate) > width && current.length > 0) {
+            lines.push(current);
+            current = word;
+        }
+        else {
+            current = candidate;
+        }
+    }
+    if (current.length > 0)
+        lines.push(current);
+    return lines.length > 0 ? lines : [""];
+}
+export function createCommandUi(writer, options = {}) {
+    const quiet = options.quiet ?? false;
+    return {
+        header(title, subtitle) {
+            if (quiet)
+                return "";
+            const width = effectiveWidth(writer);
+            const cleanTitle = sanitize(title, false);
+            const cleanSubtitle = subtitle !== undefined ? sanitize(subtitle, false) : undefined;
+            if (width < MIN_BOX_WIDTH) {
+                const lines = [paint(writer, "cyan", truncate(cleanTitle, width))];
+                if (cleanSubtitle)
+                    lines.push(paint(writer, "dim", truncate(cleanSubtitle, width)));
+                return lines.join("\n");
+            }
+            const boxWidth = Math.min(width, MAX_BOX_WIDTH);
+            const lines = [border(boxWidth), boxLine(cleanTitle, boxWidth)];
+            if (cleanSubtitle)
+                lines.push(boxLine(cleanSubtitle, boxWidth));
+            lines.push(border(boxWidth));
+            return lines.join("\n");
+        },
+        section(title) {
+            return paint(writer, "bold", sanitize(title, false));
+        },
+        row(label, value, status) {
+            const width = effectiveWidth(writer);
+            const cleanLabel = sanitize(label, false);
+            const cleanValue = sanitize(value, false);
+            const tagField = status !== undefined ? STATUS_TAG[status].padEnd(TAG_COLUMN) : "";
+            const labelField = padEndDisplay(cleanLabel, LABEL_COLUMN);
+            const plainPrefix = `${BASE_INDENT}${tagField}${labelField}`;
+            const singleLine = `${plainPrefix}${cleanValue}`;
+            const coloredPrefix = () => {
+                if (status === undefined)
+                    return plainPrefix;
+                const tag = STATUS_TAG[status];
+                return `${BASE_INDENT}${paint(writer, STATUS_STYLE[status], tag)}${tagField.slice(tag.length)}${labelField}`;
+            };
+            if (cleanValue.length === 0 || displayWidth(singleLine.replace(/\s+$/, "")) <= width) {
+                return `${coloredPrefix()}${cleanValue}`.replace(/\s+$/, "");
+            }
+            // Stack: tag + label on one line, value wrapped and indented beneath.
+            const tagLine = status !== undefined
+                ? `${BASE_INDENT}${paint(writer, STATUS_STYLE[status], STATUS_TAG[status])} ${cleanLabel}`
+                : `${BASE_INDENT}${cleanLabel}`;
+            const valueIndent = `${BASE_INDENT}${" ".repeat(TAG_COLUMN)}`;
+            const valueWidth = Math.max(width - valueIndent.length, 8);
+            const valueLines = wrap(cleanValue, valueWidth).map((line) => `${valueIndent}${line}`);
+            return [tagLine, ...valueLines].join("\n");
+        },
+        detail(text) {
+            const width = effectiveWidth(writer);
+            const indent = `${BASE_INDENT}${" ".repeat(TAG_COLUMN - 2)}`;
+            const availableWidth = Math.max(width - indent.length, 8);
+            const cleanText = sanitize(text, true);
+            const lines = [];
+            for (const paragraph of cleanText.split("\n")) {
+                if (paragraph.length === 0) {
+                    lines.push("");
+                    continue;
+                }
+                for (const line of wrap(paragraph, availableWidth)) {
+                    lines.push(`${indent}${line}`);
+                }
+            }
+            return lines.join("\n");
+        },
+        footer(text) {
+            if (quiet)
+                return "";
+            const cleanText = sanitize(text, true);
+            return cleanText
+                .split("\n")
+                .map((line) => (line.length === 0 ? "" : `${BASE_INDENT}${line}`))
+                .join("\n");
+        },
+        bar(percent) {
+            if (percent === undefined || !Number.isFinite(percent)) {
+                return `[${"-".repeat(BAR_SLOTS)}] unknown`;
+            }
+            const clamped = Math.min(100, Math.max(0, percent));
+            const filled = Math.round((clamped / 100) * BAR_SLOTS);
+            const bar = `[${"#".repeat(filled)}${"-".repeat(BAR_SLOTS - filled)}]`;
+            const style = clamped >= 90 ? "red" : clamped >= 70 ? "yellow" : "green";
+            return `${paint(writer, style, bar)} ${Math.round(clamped)}% used`;
+        },
+    };
+}

package/dist/tui/render.js

@@ -50,7 +50,8 @@ export function createWriter(stream, opts) {
     const terminal = stream;
     const isTTY = terminal.isTTY === true;
     const noColor = (process.env.NO_COLOR ?? "").length > 0;
-    const color = opts?.color ?? (isTTY && !noColor);
+    const dumbTerm = process.env.TERM === "dumb";
+    const color = opts?.color ?? (isTTY && !noColor && !dumbTerm);
     return {
         write(text) {
             stream.write(text);
@@ -64,15 +65,80 @@ export function createWriter(stream, opts) {
     };
 }
 /**
- * Cut `text` to `max` characters, marking the cut with a single ellipsis
+ * Terminal display width of one Unicode code point: 0 for combining marks,
+ * variation selectors and control characters, 2 for East Asian Wide/Fullwidth
+ * ranges and common emoji, 1 otherwise. A simplified, dependency-free
+ * approximation of Markus Kuhn's wcwidth (specs/terminal-ui-doctor.md §A
+ * "Width uses display cells, not ANSI string length") — good enough for
+ * layout purposes without pulling in a wcwidth/string-width package, which
+ * would break the TUI's dependency-free design (specs/v2-architecture.md D1).
+ */
+function codePointWidth(cp) {
+    if (cp === 0 ||
+        (cp >= 0x0001 && cp <= 0x001f) ||
+        (cp >= 0x007f && cp <= 0x009f) ||
+        (cp >= 0x0300 && cp <= 0x036f) || // combining diacritical marks
+        (cp >= 0x200b && cp <= 0x200f) || // zero-width space/joiners, LTR/RTL marks
+        cp === 0xfeff || // zero-width no-break space / BOM
+        (cp >= 0xfe00 && cp <= 0xfe0f) || // variation selectors
+        (cp >= 0x20d0 && cp <= 0x20ff) || // combining marks for symbols
+        (cp >= 0x1f3fb && cp <= 0x1f3ff) // emoji skin-tone modifiers
+    ) {
+        return 0;
+    }
+    if ((cp >= 0x1100 && cp <= 0x115f) || // Hangul Jamo
+        (cp >= 0x2e80 && cp <= 0x303e) || // CJK radicals, Kangxi, CJK punctuation
+        (cp >= 0x3041 && cp <= 0x33ff) || // Hiragana, Katakana, CJK compat, enclosed CJK
+        (cp >= 0x3400 && cp <= 0x4dbf) || // CJK Unified Ideographs Extension A
+        (cp >= 0x4e00 && cp <= 0x9fff) || // CJK Unified Ideographs
+        (cp >= 0xa000 && cp <= 0xa4cf) || // Yi
+        (cp >= 0xac00 && cp <= 0xd7a3) || // Hangul syllables
+        (cp >= 0xf900 && cp <= 0xfaff) || // CJK compatibility ideographs
+        (cp >= 0xfe30 && cp <= 0xfe4f) || // CJK compatibility forms
+        (cp >= 0xff00 && cp <= 0xff60) || // Fullwidth forms
+        (cp >= 0xffe0 && cp <= 0xffe6) || // Fullwidth signs
+        (cp >= 0x1f300 && cp <= 0x1f64f) || // emoji: symbols/pictographs, emoticons
+        (cp >= 0x1f680 && cp <= 0x1f6ff) || // transport/map symbols
+        (cp >= 0x1f900 && cp <= 0x1f9ff) || // supplemental symbols/pictographs
+        (cp >= 0x20000 && cp <= 0x3fffd) // CJK unified ideographs, supplementary planes
+    ) {
+        return 2;
+    }
+    return 1;
+}
+/** Total terminal display width of `text`, iterating by code point (not UTF-16 unit). */
+export function displayWidth(text) {
+    let width = 0;
+    for (const char of text) {
+        width += codePointWidth(char.codePointAt(0) ?? 0);
+    }
+    return width;
+}
+/** Right-pad `text` with spaces until its DISPLAY width reaches `target` (never cuts). */
+export function padEndDisplay(text, target) {
+    const pad = target - displayWidth(text);
+    return pad > 0 ? text + " ".repeat(pad) : text;
+}
+/**
+ * Cut `text` to `max` display columns, marking the cut with a single ellipsis
  * character so a truncated path stays visually distinguishable from a real one.
  */
 export function truncate(text, max) {
     if (max <= 0) {
         return "";
     }
-    if (text.length <= max) {
+    if (displayWidth(text) <= max) {
         return text;
     }
-    return text.slice(0, max - 1) + "…";
+    const budget = max - 1; // reserve one column for the ellipsis
+    let width = 0;
+    let result = "";
+    for (const char of text) {
+        const w = codePointWidth(char.codePointAt(0) ?? 0);
+        if (width + w > budget)
+            break;
+        result += char;
+        width += w;
+    }
+    return result + "…";
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "glm-coding-router",
-  "version": "2.0.0",
+  "version": "2.1.0",
   "description": "GLM Coding Plan workers for Claude Code and Codex",
   "type": "module",
   "license": "MIT",