indusagi 0.13.11 → 0.13.12

package/dist/types/facade/ml/models.generated.d.ts

@@ -4664,6 +4664,60 @@ export declare const MODELS: {
             contextWindow: number;
             maxTokens: number;
         };
+        readonly "gpt-6-sol": {
+            id: string;
+            name: string;
+            api: "openai-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: "high"[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-luna": {
+            id: string;
+            name: string;
+            api: "openai-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
         readonly "gpt-5.6-sol": {
             id: string;
             name: string;
@@ -5152,6 +5206,60 @@ export declare const MODELS: {
             contextWindow: number;
             maxTokens: number;
         };
+        readonly "gpt-6-sol": {
+            id: string;
+            name: string;
+            api: "openai-codex-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: "high"[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
+        readonly "gpt-6-luna": {
+            id: string;
+            name: string;
+            api: "openai-codex-responses";
+            provider: string;
+            baseUrl: string;
+            reasoning: true;
+            reasoningEfforts: ("low" | "medium" | "high" | "xhigh" | "max")[];
+            input: ("text" | "image")[];
+            cost: {
+                input: number;
+                output: number;
+                cacheRead: number;
+                cacheWrite: number;
+            };
+            longContextPricing: {
+                threshold: number;
+                multipliers: {
+                    input: number;
+                    output: number;
+                    cacheRead: number;
+                    cacheWrite: number;
+                };
+            };
+            contextWindow: number;
+            maxTokens: number;
+        };
     };
     readonly opencode: {
         readonly "big-pickle": {

package/dist/types/react-host/jsx-dev-runtime.d.ts

@@ -0,0 +1,3 @@
+import type * as ReactJsxDevRuntimeTypes from "react/jsx-dev-runtime";
+export declare const Fragment: typeof ReactJsxDevRuntimeTypes.Fragment;
+export declare const jsxDEV: typeof ReactJsxDevRuntimeTypes.jsxDEV;

package/dist/types/react-host/loader.d.ts

@@ -1,3 +1,4 @@
 export declare function loadHostReact(): Promise<typeof import("react")>;
 export declare function loadHostJsxRuntime(): Promise<typeof import("react/jsx-runtime")>;
+export declare function loadHostJsxDevRuntime(): Promise<typeof import("react/jsx-dev-runtime")>;
 export declare function loadHostInk(): Promise<typeof import("ink")>;

package/dist/types/security/private-state.d.ts

@@ -0,0 +1,3 @@
+export declare function ensurePrivateDirectorySync(path: string): void;
+export declare function readPrivateFileSync(path: string): string | null;
+export declare function atomicWritePrivateFileSync(path: string, content: string): void;

package/dist/zoho.js

@@ -840,8 +840,96 @@ function platformOpenCommand(url) {
 }
 
 // src/facade/mcp-core/oauth/token-store.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
-import { dirname, join } from "node:path";
+import { join } from "node:path";
+
+// src/security/private-state.ts
+import {
+  chmodSync,
+  closeSync,
+  constants,
+  fchmodSync,
+  fstatSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  renameSync,
+  rmSync,
+  writeFileSync
+} from "node:fs";
+import { randomUUID } from "node:crypto";
+import { dirname } from "node:path";
+var NO_FOLLOW = constants.O_NOFOLLOW ?? 0;
+var isPosix = () => process.platform !== "win32";
+function assertOwned(uid, path) {
+  if (!isPosix() || process.getuid === void 0) return;
+  if (uid !== process.getuid()) throw new Error(`Refusing sensitive path not owned by the current user: ${path}`);
+}
+function ensurePrivateDirectorySync(path) {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isDirectory()) throw new Error(`Refusing non-directory sensitive state path: ${path}`);
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if (error.code !== "ENOENT") throw error;
+    mkdirSync(path, { recursive: true, mode: 448 });
+  }
+  if (isPosix()) chmodSync(path, 448);
+}
+function validateExistingFile(path) {
+  try {
+    const current = lstatSync(path);
+    if (current.isSymbolicLink() || !current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    assertOwned(current.uid, path);
+  } catch (error) {
+    if (error.code === "ENOENT") return;
+    throw error;
+  }
+}
+function readPrivateFileSync(path) {
+  ensurePrivateDirectorySync(dirname(path));
+  validateExistingFile(path);
+  let fd;
+  try {
+    fd = openSync(path, constants.O_RDONLY | NO_FOLLOW);
+  } catch (error) {
+    if (error.code === "ENOENT") return null;
+    throw error;
+  }
+  try {
+    const current = fstatSync(fd);
+    if (!current.isFile()) throw new Error(`Refusing non-regular sensitive file: ${path}`);
+    assertOwned(current.uid, path);
+    if (isPosix()) fchmodSync(fd, 384);
+    return readFileSync(fd, "utf8");
+  } finally {
+    closeSync(fd);
+  }
+}
+function atomicWritePrivateFileSync(path, content) {
+  ensurePrivateDirectorySync(dirname(path));
+  validateExistingFile(path);
+  const temporary = `${path}.tmp-${process.pid}-${randomUUID()}`;
+  let fd;
+  try {
+    fd = openSync(temporary, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | NO_FOLLOW, 384);
+    writeFileSync(fd, content, "utf8");
+    if (isPosix()) fchmodSync(fd, 384);
+    closeSync(fd);
+    fd = void 0;
+    renameSync(temporary, path);
+    if (isPosix()) chmodSync(path, 384);
+  } catch (error) {
+    if (fd !== void 0) closeSync(fd);
+    try {
+      rmSync(temporary, { force: true });
+    } catch {
+    }
+    throw error;
+  }
+}
+
+// src/facade/mcp-core/oauth/token-store.ts
 function defaultCredentialsDir() {
   const xdg = process.env.XDG_CONFIG_HOME;
   const home = process.env.HOME ?? process.env.USERPROFILE ?? "";
@@ -858,10 +946,11 @@ function credentialsPath(credentialsDir, id) {
 }
 function readMcpOAuthState(credentialsDir, id) {
   const path = credentialsPath(credentialsDir, id);
-  if (!existsSync(path)) return void 0;
   let raw;
   try {
-    raw = readFileSync(path, "utf8");
+    const stored = readPrivateFileSync(path);
+    if (stored === null) return void 0;
+    raw = stored;
   } catch (e) {
     return void 0;
   }
@@ -876,15 +965,8 @@ function readMcpOAuthState(credentialsDir, id) {
 }
 function writeMcpOAuthState(credentialsDir, state) {
   const path = credentialsPath(credentialsDir, state.id);
-  mkdirSync(dirname(path), { recursive: true });
-  const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
   const json = JSON.stringify({ ...state, updatedAt: Date.now() }, null, 2);
-  writeFileSync(tmp, json, { mode: 384 });
-  renameSync(tmp, path);
-  try {
-    chmodSync(path, 384);
-  } catch {
-  }
+  atomicWritePrivateFileSync(path, json);
 }
 function clearMcpOAuthState(credentialsDir, id) {
   const path = credentialsPath(credentialsDir, id);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "indusagi",
-  "version": "0.13.11",
+  "version": "0.13.12",
   "description": "Indusagi — a terminal-first AI coding agent framework. Clean-room implementation.",
   "author": "Varun Israni",
   "license": "AGPL-3.0",
@@ -138,7 +138,7 @@
     "@types/react": "^18.3.30",
     "esbuild": "^0.28.0",
     "typescript": "^5.7.2",
-    "vitest": "^2.1.8"
+    "vitest": "^4.1.11"
   },
   "dependencies": {
     "@anthropic-ai/sdk": "^0.100.1",
@@ -162,5 +162,10 @@
     "strip-ansi": "^7.2.0",
     "ulid": "^3.0.2",
     "zod": "^4.4.3"
+  },
+  "overrides": {
+    "fast-uri": "3.1.6",
+    "hono": "4.13.5",
+    "qs": "6.16.0"
   }
 }