kodingo-cli 1.1.9 → 1.1.11

package/dist/cli.js

@@ -18,6 +18,7 @@ const sync_graph_1 = require("./commands/sync-graph");
 const sync_dependencies_1 = require("./commands/sync-dependencies");
 const security_scan_1 = require("./commands/security-scan");
 const init_1 = require("./commands/init");
+const build_1 = require("./commands/build");
 const install_hook_1 = require("./commands/install-hook");
 const update_1 = require("./commands/update");
 const sync_1 = require("./commands/sync");
@@ -31,6 +32,19 @@ const { version } = require("../package.json");
 program.name("kodingo").description("Kodingo CLI").version(version);
 // ── init ──────────────────────────────────────────────────────────────────────
 (0, init_1.registerInitCommand)(program);
+// ── build ─────────────────────────────────────────────────────────────────────
+program
+    .command("build")
+    .description("Run Kortex Build's local agent loop against this repo (test-driver for kodingo-agent)")
+    .argument("<task>", "what to build or fix")
+    .option("--repo <path>", "repo path (defaults to the current repo)")
+    .option("--max-turns <n>", "override the agent loop's turn budget")
+    .action(async (task, options) => {
+    await (0, build_1.buildCommand)(String(task), {
+        ...(options.repo ? { repo: String(options.repo) } : {}),
+        ...(options.maxTurns ? { maxTurns: Number.parseInt(String(options.maxTurns), 10) } : {}),
+    });
+});
 // ── update ────────────────────────────────────────────────────────────────────
 program
     .command("update")

package/dist/commands/build.js

@@ -0,0 +1,178 @@
+"use strict";
+/**
+ * kodingo build
+ *
+ * Runs Kortex Build's real local agent loop (kodingo-agent) against the
+ * current repo. Per this repo's own stated identity — "a test driver and
+ * plumbing layer, not the final product UX" — this command is deliberately
+ * minimal: it exists to exercise kodingo-agent headlessly against a real
+ * repo, not to be a polished second Build UX (that's kodingo-vscode's job).
+ *
+ * The loop runs entirely in this process, on this machine's real files and
+ * shell. Every model decision is one real HTTP call to kodingo-api's
+ * POST /build/:id/agent-turn — this command never calls a model directly.
+ */
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.buildCommand = buildCommand;
+const fs = __importStar(require("fs"));
+const path = __importStar(require("path"));
+const readline = __importStar(require("node:readline"));
+const kodingo_agent_1 = require("kodingo-agent");
+const persistence_config_1 = require("../utils/persistence-config");
+function findRepoRoot(startPath) {
+    let current = startPath;
+    while (true) {
+        if (fs.existsSync(path.join(current, ".git")))
+            return current;
+        const parent = path.dirname(current);
+        if (parent === current)
+            return startPath;
+        current = parent;
+    }
+}
+function prompt(rl, question) {
+    return new Promise((resolve) => rl.question(question, (ans) => resolve(ans.trim())));
+}
+async function confirmTrust(repoRoot) {
+    if ((0, kodingo_agent_1.isProjectTrusted)(repoRoot)) {
+        console.log(`✔ ${repoRoot} is already trusted for Kortex Build.\n`);
+        return true;
+    }
+    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    try {
+        console.log(`\nKortex Build will read, edit, and run allowed commands in:\n  ${repoRoot}\n`);
+        const answer = (await prompt(rl, "Allow? [o]nce / [a]lways / [c]ancel: ")).toLowerCase();
+        if (answer.startsWith("a")) {
+            (0, kodingo_agent_1.trustProject)(repoRoot);
+            console.log("✔ Always allowed for this repo.\n");
+            return true;
+        }
+        if (answer.startsWith("o"))
+            return true;
+        return false;
+    }
+    finally {
+        rl.close();
+    }
+}
+// writeWorkspaceConfig (kodingo init) stores workspace entries keyed by the
+// raw repo root path, but getPersistence() reads them back through a
+// lowercased normalizePath() — a pre-existing mismatch on any path with
+// uppercase characters (e.g. /Users/... on macOS), unrelated to this
+// command. Checking both the raw key and the global fallback here gives
+// this command the best real chance of finding a token either way, without
+// trying to fix that mismatch itself.
+function resolveApiConfig(repoRoot) {
+    const config = (0, persistence_config_1.readConfig)();
+    const ws = (0, persistence_config_1.readWorkspaceConfig)(repoRoot);
+    const apiUrl = ws?.apiUrl ?? config.apiUrl;
+    const token = ws?.token ?? config.token;
+    if (!apiUrl || !token)
+        return null;
+    return { apiUrl, token };
+}
+async function buildCommand(input, options = {}) {
+    const repoRoot = options.repo ? path.resolve(options.repo) : findRepoRoot(process.cwd());
+    const apiConfig = resolveApiConfig(repoRoot);
+    if (!apiConfig) {
+        console.error(`✖ No Kodingo project connected for ${repoRoot}. Run \`kodingo init\` in this repo first.`);
+        process.exitCode = 1;
+        return;
+    }
+    const allowed = await confirmTrust(repoRoot);
+    if (!allowed) {
+        console.log("✖ Cancelled.");
+        return;
+    }
+    const apiBaseUrl = apiConfig.apiUrl.replace(/\/$/, "");
+    // Bring-your-own, if configured (~/.kodingo/byo-model.json — same file
+    // kodingo-vscode already uses) — never logged, only forwarded.
+    const byoModelConfig = (0, kodingo_agent_1.getByoModelConfig)();
+    if (byoModelConfig) {
+        console.log(`Using bring-your-own model${byoModelConfig.label ? ` (${byoModelConfig.label})` : ""} — no shared quota consumed.`);
+    }
+    console.log(`Starting Kortex Build against ${repoRoot} ...`);
+    const startRes = await fetch(`${apiBaseUrl}/build/agent-start`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json", "X-Kodingo-Token": apiConfig.token },
+        body: JSON.stringify({
+            input,
+            repo: path.basename(repoRoot),
+            ...(byoModelConfig ? { modelConfig: byoModelConfig } : {}),
+        }),
+    });
+    const startBody = (await startRes.json());
+    if (!startRes.ok || !startBody.sessionId) {
+        console.error(`✖ Could not start Build session: ${startBody.error ?? startRes.status}`);
+        process.exitCode = 1;
+        return;
+    }
+    const sessionId = startBody.sessionId;
+    console.log(`Session: ${sessionId}`);
+    const modelPort = (0, kodingo_agent_1.createHttpModelCallPort)({ apiBaseUrl, projectToken: apiConfig.token, sessionId });
+    const initialMessages = [
+        {
+            role: "system",
+            content: "You are Kortex Build, a coding agent working directly on the developer's real local repository. " +
+                "Explore before you edit: read files, grep for symbols, and look around as needed — looking is just " +
+                "another turn, you can call tools as many times as it takes to actually understand the real code " +
+                "before changing it. Only use edit_file for surgical, minimal changes to existing files; use " +
+                "write_file only for brand-new files. Before reporting done, verify your change with run_command.",
+        },
+        { role: "user", content: input },
+    ];
+    const result = await (0, kodingo_agent_1.runAgentLoop)({
+        cwd: repoRoot,
+        tools: (0, kodingo_agent_1.createDefaultToolSet)(),
+        initialMessages,
+        modelPort,
+        reporter: (0, kodingo_agent_1.createTerminalReporter)(),
+        ...(options.maxTurns ? { budgets: { maxTurns: options.maxTurns } } : {}),
+    });
+    try {
+        await fetch(`${apiBaseUrl}/build/${sessionId}/agent-complete`, {
+            method: "POST",
+            headers: { "Content-Type": "application/json", "X-Kodingo-Token": apiConfig.token },
+            body: JSON.stringify({ status: result.status, message: result.error }),
+        });
+    }
+    catch {
+        // Best-effort — the loop's own outcome already printed to the terminal regardless.
+    }
+    if (result.status !== "completed") {
+        process.exitCode = 1;
+    }
+}

package/dist/commands/scan-repo.js

@@ -66,6 +66,9 @@ const SUPPORTED_EXTENSIONS = [
 const IGNORED_DIRS = [
     "node_modules", ".git", ".kortex", "dist", "build",
     "out", ".next", "coverage", "__pycache__", "vendor",
+    ".venv", "venv", "env", ".env", "site-packages",
+    "virtualenv", ".tox", "eggs", ".eggs", "wheels",
+    "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
 const MAX_SYMBOLS = 200;
 const BATCH_SIZE = 5;

package/dist/commands/security-scan.js

@@ -18,7 +18,7 @@ const graph_builder_1 = require("../utils/graph-builder");
 const security_code_analyzer_1 = require("../utils/security-code-analyzer");
 const context_assembler_1 = require("../utils/context-assembler");
 const ast_parser_1 = require("../utils/ast-parser");
-const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 const SUPPORTED_EXTENSIONS = [".ts", ".tsx", ".js", ".jsx", ".py", ".go", ".rs", ".php", ".java", ".kt", ".rb", ".c", ".cpp", ".html", ".phtml", ".twig", ".blade.php"];
 function walkFiles(dir) {
     const results = [];
@@ -131,13 +131,35 @@ async function securityScanCommand(options = {}) {
             }
             catch { }
             const allCandidates = (0, security_code_analyzer_1.analyzeForSecurityCandidates)(repoRoot, graph, symbols, dynamicRules);
-            // Cap at 30 candidates for LLM judgment — prioritise critical and high severity
+            // Fetch already-confirmed open findings so we don't re-scan them —
+            // they stay visible in the dashboard as open until fixed, but we use
+            // our 30-candidate budget on NEW issues each week.
+            let confirmedFingerprints = new Set();
+            try {
+                const existingRes = await fetch(`${apiUrl}/security/findings?repo=${encodeURIComponent(repoName)}`, {
+                    headers: { "X-Kodingo-Token": token },
+                });
+                if (existingRes.ok) {
+                    const { findings: existingFindings } = await existingRes.json();
+                    existingFindings.forEach((f) => {
+                        confirmedFingerprints.add(`${f.finding_type}:${f.endpoint ?? f.symbol ?? ""}:${f.vulnerability_id ?? ""}`);
+                    });
+                }
+            }
+            catch { }
+            // Filter out already-confirmed findings, then sort by severity and cap at 30
             const SEVERITY_ORDER = { critical: 0, high: 1, moderate: 2, low: 3 };
-            const candidates = allCandidates
+            const newCandidates = allCandidates.filter(c => {
+                const fp = `${c.patternType}:${c.symbol ?? c.file}:${c.file}`;
+                return !confirmedFingerprints.has(fp);
+            });
+            const candidates = newCandidates
                 .sort((a, b) => (SEVERITY_ORDER[a.severity ?? 'low'] ?? 3) - (SEVERITY_ORDER[b.severity ?? 'low'] ?? 3))
                 .slice(0, 30);
-            if (!options.silent && allCandidates.length > 30) {
-                console.log(`  Found ${allCandidates.length} candidates — reviewing top 30 by severity\n`);
+            if (!options.silent) {
+                if (allCandidates.length > 0) {
+                    console.log(`  Found ${allCandidates.length} candidates (${allCandidates.length - newCandidates.length} already tracked as open) — reviewing ${Math.min(candidates.length, 30)} new ones\n`);
+                }
             }
             if (candidates.length === 0) {
                 if (!options.silent)

package/dist/utils/dependency-parser.js

@@ -154,7 +154,7 @@ function parseComposerLock(repoRoot, filePath) {
     }
     return entries;
 }
-const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next"]);
+const IGNORED_DIRS = new Set(["node_modules", ".git", ".kortex", "dist", "build", "vendor", "out", ".next", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
 function findManifestFiles(repoRoot) {
     const result = { packageJson: [], packageLock: [], composerJson: [], composerLock: [] };
     function walk(dir) {

package/dist/utils/graph-builder.js

@@ -70,6 +70,8 @@ const TS_JS_EXTENSIONS = new Set([".ts", ".tsx", ".js", ".jsx"]);
 const IGNORED_DIRS = [
     "node_modules", ".git", ".kortex", "dist", "build",
     "out", ".next", "coverage", "__pycache__", "vendor",
+    ".venv", "venv", "env", "site-packages", "virtualenv",
+    ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj",
 ];
 function walkFiles(dir) {
     const results = [];

package/dist/utils/security-code-analyzer.js

@@ -98,7 +98,7 @@ function analyzeForSecurityCandidates(repoRoot, graph, symbols, dynamicRules = [
         ".java": "java", ".kt": "kotlin", ".rb": "ruby", ".c": "c", ".cpp": "cpp",
         ".html": "html", ".js": "javascript", ".ts": "typescript", ".jsx": "javascript", ".tsx": "typescript"
     };
-    const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", "vendor", "__pycache__", ".next", "out", "coverage"]);
+    const IGNORED_DIRS = new Set(["node_modules", ".git", "dist", "build", "vendor", "__pycache__", ".next", "out", "coverage", ".venv", "venv", "env", "site-packages", "virtualenv", ".tox", "target", ".gradle", ".idea", ".vscode", "bin", "obj"]);
     // Get recently changed files from git (last 30 days) — scan these first
     let priorityFiles = [];
     try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kodingo-cli",
-  "version": "1.1.9",
+  "version": "1.1.11",
   "description": "Kodingo CLI",
   "license": "MIT",
   "private": false,
@@ -25,6 +25,7 @@
     "@typescript-eslint/types": "^8.61.1",
     "@typescript-eslint/typescript-estree": "^8.61.1",
     "commander": "^12.1.0",
+    "kodingo-agent": "^0.1.0",
     "kodingo-core": "^0.2.1",
     "open": "^11.0.0",
     "simple-git": "^3.30.0",