indusagi-coding-agent 0.2.8 → 0.2.10

package/src/boot/runners/oneshot-runner.ts

@@ -0,0 +1,58 @@
+/**
+ * Runner: `oneshot` — single non-interactive request to stdout.
+ *
+ * Drives the Phase-8 oneshot channel: it assembles a {@link SessionConductor}
+ * for the invocation, builds a {@link ChannelContext} over `process.stdout`
+ * (clean text, or a streamed NDJSON event log), runs every prompt to settlement
+ * via {@link runOneshot}, and resolves the channel exit code. The output shape is
+ * NDJSON when the invocation carries a `json` flag, otherwise clean text.
+ */
+import { inertDialog, ndjsonFramer, runOneshot } from "../../channels/index.js";
+import type { Invocation, Runner } from "../contract.js";
+import { oneshotPrompts, buildSessionConductor } from "./session.js";
+
+const EXIT_NO_INPUT = 2;
+
+const STDOUT = {
+  write(chunk: string | Uint8Array, cb?: (err?: Error | null) => void) {
+    return process.stdout.write(chunk, cb);
+  },
+};
+
+function shapeOf(inv: Invocation): "ndjson" | "text" {
+  return inv.flags.json === true || inv.flags.json === "true" ? "ndjson" : "text";
+}
+
+/**
+ * The one-shot runner.
+ *
+ * {@link Runner.accepts} matches invocations whose resolved mode is `oneshot`.
+ * {@link Runner.run} assembles the conductor and channel context, then delegates
+ * the run to {@link runOneshot} and returns its exit code. With no request text
+ * it writes a short notice and exits non-zero rather than mounting an empty run.
+ */
+export const oneshotRunner: Runner = {
+  id: "oneshot",
+  accepts(inv) {
+    return inv.mode === "oneshot";
+  },
+  async run(ctx) {
+    const prompts = oneshotPrompts(ctx);
+    if (prompts.length === 0) {
+      process.stderr.write("oneshot: no request text supplied\n");
+      return EXIT_NO_INPUT;
+    }
+    const conductor = await buildSessionConductor(ctx);
+    const channel = {
+      conductor,
+      out: STDOUT,
+      framer: ndjsonFramer,
+      dialog: inertDialog,
+    };
+    const request = {
+      shape: shapeOf(ctx.invocation),
+      prompts,
+    };
+    return runOneshot(channel, request);
+  },
+};

package/src/boot/runners/read-state.ts

@@ -0,0 +1,90 @@
+/**
+ * Per-session read-state store — the product half of the read-before-edit gate
+ * (read-edit-gate, #11).
+ *
+ * The framework's file tools (read/write/edit) consult a host-injected handle on
+ * `ctx.framework` under the string-literal key {@link READ_STATE_HANDLE_KEY} to
+ * decide whether an edit/write may proceed: a file must have been read before it
+ * is mutated, and an edit is refused when the file changed on disk since that
+ * read. This module supplies the missing host piece — an in-memory map of which
+ * files have been read this session and the stat fingerprint at read time — so
+ * the gate has somewhere to record and look up that state.
+ */
+import { normalize } from "node:path";
+
+/**
+ * The string-literal key under which the host wires this store onto the deck's
+ * `ctx.framework` bag.
+ *
+ * Mirrors the existing `DELEGATE_HANDLE_KEY = "delegate"` and
+ * `MEMORY_HANDLE_KEY = "memoryStore"` conventions. The framework's file tools
+ * read `ctx.framework["readState"]` by the same literal, so the two sides agree
+ * by string rather than by a shared imported symbol.
+ */
+export const READ_STATE_HANDLE_KEY = "readState";
+
+/**
+ * One file's read fingerprint, recorded when the agent reads it this session.
+ *
+ *   - `mtimeMs` — the file's last-modified time (ms) at read. The gate refuses an
+ *     edit when the on-disk mtime has advanced past this. (The framework's stat
+ *     result names this `modifiedMs`; the host maps it to `mtimeMs` here.)
+ *   - `size` — the file's byte length at read, a cheap secondary change signal.
+ *   - `contentHash` — optional digest of the content read, for a content-equality
+ *     fallback when the mtime advanced but the bytes are unchanged.
+ *   - `readAt` — when the host recorded this read (ms since epoch).
+ */
+export interface ReadStateRecord {
+  readonly mtimeMs: number;
+  readonly size: number;
+  readonly contentHash?: string;
+  readonly readAt: number;
+}
+
+/**
+ * In-memory map of read files for one session, keyed by normalized absolute path.
+ *
+ * The framework gate `set`s a record after every read and after every successful
+ * mutation, and `get`s/`has`-checks it before an edit. Keys are normalized in one
+ * place (`key`) so writes and lookups of the same file land on the same entry no
+ * matter how the caller spelled the path.
+ */
+export class ReadStateStore {
+  private readonly entries = new Map<string, ReadStateRecord>();
+
+  /** Normalize an absolute path into the store's canonical key. */
+  private key(absPath: string): string {
+    return normalize(absPath);
+  }
+
+  /** The recorded read fingerprint for a path, or `undefined` if never read. */
+  get(absPath: string): ReadStateRecord | undefined {
+    return this.entries.get(this.key(absPath));
+  }
+
+  /** Record (or replace) the read fingerprint for a path; returns this store. */
+  set(absPath: string, value: ReadStateRecord): this {
+    this.entries.set(this.key(absPath), value);
+    return this;
+  }
+
+  /** Whether a path has a recorded read fingerprint this session. */
+  has(absPath: string): boolean {
+    return this.entries.has(this.key(absPath));
+  }
+
+  /** Drop a path's recorded read fingerprint; returns whether one existed. */
+  delete(absPath: string): boolean {
+    return this.entries.delete(this.key(absPath));
+  }
+
+  /** Forget every recorded read for this session. */
+  clear(): void {
+    this.entries.clear();
+  }
+}
+
+/** Mint a fresh, empty per-session read-state store. */
+export function createReadStateStore(): ReadStateStore {
+  return new ReadStateStore();
+}

package/src/boot/runners/registry.ts

@@ -0,0 +1,42 @@
+/**
+ * Runner registry — the table-driven replacement for a mode `if/else` ladder.
+ *
+ * The boot pipeline ends by handing the resolved {@link Invocation} to exactly
+ * one {@link Runner}. Rather than branch on the mode string at the call site,
+ * dispatch is data: {@link RUNNERS} lists every available runner in priority
+ * order, and {@link selectRunner} returns the first whose {@link Runner.accepts}
+ * predicate matches. Adding or reordering modes is a one-line edit to the table,
+ * never a change to control flow.
+ *
+ * The interactive REPL is both first in the table and the guaranteed fallback:
+ * if no runner claims an invocation, {@link selectRunner} returns it, so a bare
+ * command line lands in the interactive session.
+ */
+import type { Invocation, Runner } from "../contract.js";
+import { replRunner } from "./repl-runner.js";
+import { oneshotRunner } from "./oneshot-runner.js";
+import { linkRunner } from "./link-runner.js";
+
+/**
+ * Every runner the boot layer can dispatch to, in match-priority order.
+ *
+ * {@link selectRunner} scans this list front-to-back and returns the first
+ * accepting runner; `replRunner` leads the list and also serves as the default.
+ */
+export const RUNNERS: readonly Runner[] = [replRunner, oneshotRunner, linkRunner];
+
+/**
+ * Choose the runner for a parsed {@link Invocation}.
+ *
+ * Returns the first runner in {@link RUNNERS} that {@link Runner.accepts | accepts}
+ * the invocation; if none does, falls back to the interactive REPL runner so
+ * dispatch is total and a runner is always returned.
+ */
+export function selectRunner(inv: Invocation): Runner {
+  for (const runner of RUNNERS) {
+    if (runner.accepts(inv)) {
+      return runner;
+    }
+  }
+  return replRunner;
+}

package/src/boot/runners/repl-runner.ts

@@ -0,0 +1,143 @@
+/**
+ * Runner: `repl` — interactive terminal session.
+ *
+ * Mounts the Phase-7 console for a live session: it assembles a
+ * {@link SessionConductor} for the invocation and renders the interactive surface
+ * via {@link mountConsole}, seeding it with the positional prompt when one was
+ * supplied. The runner resolves the success exit code once the surface is
+ * dismissed.
+ */
+import { mountConsole } from "../../console/index.js";
+import { listLoginProviders, openLoginUrl, startOAuthLogin } from "../../launch/oauth.js";
+import { pickResumeTarget } from "../../launch/pickers.js";
+import { SessionLibrary } from "../../sessions/library.js";
+import { PreferenceStore } from "../../settings/manager.js";
+import { sessionScopeDir } from "./session.js";
+import { createAuthVault } from "../auth-vault.js";
+import type { BootContext, Runner } from "../contract.js";
+import { buildSessionConductor } from "./session.js";
+import { resolveServerGatewayUrls } from "./server-mode.js";
+
+const EXIT_OK = 0;
+
+/**
+ * Build the in-memory overlay services the interactive console expects.
+ *
+ * The console calls a few helpers directly (`listLoginProviders`,
+ * `startOAuthLogin`, vault access, gateway re-routing). All of those are
+ * wired here from the boot-layer pieces so the conductor and the UI share one
+ * credential store and one gateway-base-url mapping.
+ */
+export function buildOverlayServices(ctx: BootContext, conductor: { updateGatewayBaseUrls(map: Record<string, string>): void }) {
+  const cwd = ctx.invocation.cwd ?? process.cwd();
+  const vault = createAuthVault(ctx.workspace.authPath);
+  return {
+    conductor,
+    settings: PreferenceStore.fromWorkspace(ctx.workspace, cwd),
+    sessions: new SessionLibrary({
+      sessionsDir: sessionScopeDir(ctx.workspace.sessionsDir, ctx.invocation.cwd ?? process.cwd()),
+    }),
+    listLoginProviders,
+    startOAuthLogin,
+    openLoginUrl,
+    vault,
+    async refreshGatewayRouting() {
+      const map = await resolveServerGatewayUrls(ctx, vault);
+      conductor.updateGatewayBaseUrls(map);
+    },
+  };
+}
+
+function toResumeRef(row: { id: string; path: string; lastModified?: number; messageCount?: number; preview?: string; name?: string; size?: number }) {
+  const lastModified = row.lastModified ?? 0;
+  return {
+    id: row.id,
+    path: row.path,
+    cwd: "",
+    lastModified,
+    created: new Date(lastModified),
+    modified: new Date(lastModified),
+    messageCount: row.messageCount ?? 0,
+    firstMessage: row.preview ?? "",
+    allMessagesText: row.preview ?? "",
+    ...row.name !== undefined ? { name: row.name } : {},
+    ...row.size !== undefined ? { size: row.size } : {},
+  };
+}
+
+async function chooseResumeTarget(ctx: BootContext, library: SessionLibrary): Promise<string | null> {
+  const inv = ctx.invocation;
+  if (inv.continueLatest === true) {
+    const rows = await library.list();
+    return rows.length > 0 ? rows[0].id : null;
+  }
+  const rows = await library.list();
+  if (rows.length === 0) return null;
+  const refs = rows.map(toResumeRef);
+  const idByPath = new Map(rows.map((row) => [row.path, row.id]));
+  const load = async () => refs;
+  const outcome = await pickResumeTarget(load, load);
+  if (outcome.fault !== undefined) {
+    throw outcome.fault.cause ?? new Error(outcome.fault.message);
+  }
+  if (outcome.path === null) return null;
+  return idByPath.get(outcome.path) ?? null;
+}
+
+/**
+ * Apply `--resume` / `--continue` to a freshly-built conductor.
+ *
+ * Tolerates a missing resume target by logging and starting a fresh session;
+ * tolerance preserves the interactive boot flow when the prior session was
+ * deleted between launches.
+ */
+export async function applyResume(ctx: BootContext, conductor: { resume(id: string): Promise<void>; snapshot(): { phase: string } }): Promise<void> {
+  const inv = ctx.invocation;
+  if (inv.resume !== true && inv.continueLatest !== true) return;
+  const library = new SessionLibrary({
+    sessionsDir: sessionScopeDir(ctx.workspace.sessionsDir, ctx.invocation.cwd ?? process.cwd()),
+  });
+  try {
+    const sessionId = await chooseResumeTarget(ctx, library);
+    if (sessionId === null) {
+      process.stderr.write("No prior session to resume; starting a fresh one.\n");
+      return;
+    }
+    await conductor.resume(sessionId);
+    const state = conductor.snapshot();
+    if (state.phase === "faulted") {
+      process.stderr.write(
+        `Could not resume session "${sessionId}"; starting a fresh one.\n`,
+      );
+    }
+  } catch (cause) {
+    const detail = cause instanceof Error ? cause.message : String(cause);
+    process.stderr.write(`Resume failed (${detail}); starting a fresh session.\n`);
+  }
+}
+
+/**
+ * The interactive-REPL runner.
+ *
+ * {@link Runner.accepts} matches invocations whose resolved mode is `repl`; it is
+ * also the registry default, so it is reached for the empty / interactive command
+ * line. {@link Runner.run} assembles the conductor, honours `--resume` /
+ * `--continue`, and mounts the console.
+ */
+export const replRunner: Runner = {
+  id: "repl",
+  accepts(inv) {
+    return inv.mode === "repl";
+  },
+  async run(ctx) {
+    const conductor = await buildSessionConductor(ctx);
+    await applyResume(ctx, conductor);
+    const services = buildOverlayServices(ctx, conductor);
+    const initialInput = ctx.invocation.prompt;
+    await mountConsole(
+      conductor,
+      initialInput === undefined ? { services } : { initialInput, services },
+    );
+    return EXIT_OK;
+  },
+};

package/src/boot/runners/server-mode.ts

@@ -0,0 +1,121 @@
+/**
+ * Boot helper: decide whether a provider runs in **server mode** (Case B).
+ *
+ * A model turn takes one of three paths (see LOGIN_GATEWAY_PLAN.md §1):
+ *   - **A. Local key** — a usable key for the provider is stored in the on-disk
+ *     auth vault (or exported in the environment). The framework calls the
+ *     provider directly; behaviour is unchanged and this module returns
+ *     `{ serverMode: false }`.
+ *   - **B. Server tier** — the provider is gateway-eligible, the user has **no**
+ *     usable local key, and they hold a **valid server token**. The session token
+ *     is vended as the provider "key" and the model is re-routed through the indus
+ *     gateway. This module returns `{ serverMode: true, token }`.
+ *   - **C. Blocked** — no local key and no valid token: `{ serverMode: false }`
+ *     (the resolver then falls through to the framework's own env lookup, which
+ *     surfaces the usual "no API key" guidance pointing at `indus login`).
+ *
+ * The two consumers in {@link file://./session.ts} call this with the SAME
+ * `(ctx, provider, vault)` triple so the key-resolver fallback and the
+ * gateway-base-url computation always agree on whether server mode is active.
+ */
+import { INDUS_SERVER_URL, getServerToken, hasValidServerToken } from "../server-token.js";
+import type { AuthVault } from "../../launch/contract.js";
+import type { BootContext } from "../contract.js";
+
+/**
+ * The outcome of {@link resolveServerMode}: whether the provider should route
+ * through the gateway this run, and (when so) the session token to hand back as
+ * the provider api key.
+ */
+export interface ServerModeResult {
+  /** `true` => bind the gateway base url and use {@link token} as the key. */
+  serverMode: boolean;
+  /** The session token (`access_token`) to vend as the key, when `serverMode`. */
+  token?: string;
+}
+
+const GATEWAY_ELIGIBLE_PROVIDERS: ReadonlySet<string> = new Set([
+  "minimax",
+  "sarvam",
+]);
+
+/**
+ * Whether `provider` may be routed through the indus gateway. Excludes the
+ * non-portable providers (vertex / bedrock / codex) and the deferred opencode
+ * `anthropic-messages` api per the §B.4 caveat.
+ */
+export function isGatewayEligibleProvider(provider: string): boolean {
+  return GATEWAY_ELIGIBLE_PROVIDERS.has(provider);
+}
+
+/** The server-tier provider slugs (for default-model selection / listing). */
+export function serverTierProviders(): readonly string[] {
+  return [...GATEWAY_ELIGIBLE_PROVIDERS];
+}
+
+async function hasUsableLocalKey(provider: string, vault: AuthVault): Promise<boolean> {
+  try {
+    const accounts: string[] = [];
+    const def = await vault.defaultAccount(provider);
+    if (def !== undefined && def.length > 0) accounts.push(def);
+    for (const account of await vault.listAccounts(provider)) {
+      if (!accounts.includes(account)) accounts.push(account);
+    }
+    for (const account of accounts) {
+      const key = await vault.readUsableKey(provider, account);
+      if (typeof key === "string" && key.length > 0) return true;
+    }
+  } catch {
+    // ignore
+  }
+  return false;
+}
+
+/**
+ * Decide whether `provider` runs in server mode for this session.
+ *
+ * Server mode is active when ALL hold:
+ *   1. {@link isGatewayEligibleProvider}(provider) — excludes vertex/bedrock/codex
+ *      and the deferred opencode `anthropic-messages` api (§B.4);
+ *   2. no EXPLICIT local key — the vault holds no usable key for the provider
+ *      (an ambient env var is intentionally ignored for server-tier providers);
+ *   3. {@link hasValidServerToken}() — a stored, non-expired server token exists.
+ *
+ * Returns `{ serverMode: false }` whenever any condition fails, so the
+ * local-key (Case A) path is preserved byte-for-byte: the resolver then returns
+ * `undefined` and no gateway base url is bound.
+ *
+ * @param _ctx the boot context (reserved for future per-run policy; the vault is
+ *   passed explicitly so callers share one instance)
+ * @param provider the framework provider slug to evaluate
+ * @param vault the on-disk credential vault to probe for a local key
+ */
+export async function resolveServerMode(_ctx: BootContext, provider: string, vault: AuthVault): Promise<ServerModeResult> {
+  if (!isGatewayEligibleProvider(provider)) return { serverMode: false };
+  if (await hasUsableLocalKey(provider, vault)) return { serverMode: false };
+  if (!(await hasValidServerToken())) return { serverMode: false };
+  const token = await getServerToken();
+  const access = token?.access_token;
+  if (typeof access !== "string" || access.length === 0) return { serverMode: false };
+  return { serverMode: true, token: access };
+}
+
+/**
+ * Build the per-provider gateway base-url map for THIS session: for every
+ * gateway-eligible provider currently in server mode (no explicit local key +
+ * valid token), map `provider -> ${INDUS_SERVER_URL}/gateway/${provider}`.
+ *
+ * The conductor consults this map at EVERY model bind — including a runtime
+ * `/model` switch — so selecting ANY server-tier model (not just the one the
+ * session launched on) routes through the gateway. Empty when nothing qualifies.
+ */
+export async function resolveServerGatewayUrls(ctx: BootContext, vault: AuthVault): Promise<Record<string, string>> {
+  const map: Record<string, string> = {};
+  for (const provider of GATEWAY_ELIGIBLE_PROVIDERS) {
+    const result = await resolveServerMode(ctx, provider, vault);
+    if (result.serverMode) {
+      map[provider] = `${INDUS_SERVER_URL}/gateway/${provider}`;
+    }
+  }
+  return map;
+}