lonny-agent 0.2.4 → 0.2.7

package/src/cli/index.ts

@@ -1,4 +1,7 @@
+import { resetGlobalEventBus } from '../agent/event-bus.js'
+import { Session } from '../agent/session.js'
 import { type Config, loadConfig } from '../config/index.js'
+import { resetTokenUsage } from '../config/tokens.js'
 import { runInit } from './init.js'
 
 export interface CliOptions {
@@ -7,6 +10,10 @@ export interface CliOptions {
   web?: boolean
   port?: number
   init?: boolean
+  continueSession?: boolean
+  sessionId?: string
+  listSessions?: boolean
+  deleteSession?: string
 }
 
 export async function parseArgs(argv: string[]): Promise<CliOptions> {
@@ -18,11 +25,69 @@ export async function parseArgs(argv: string[]): Promise<CliOptions> {
     return { init: true } as CliOptions
   }
 
+  // Check for new command — clear all saved sessions, then continue fresh
+  if (args[0] === 'new') {
+    const config = loadConfig()
+    Session.clearSavedSession(config.cwd)
+    resetTokenUsage(config.cwd)
+    resetGlobalEventBus()
+    args.splice(0, 1) // Remove 'new', remaining args become normal arguments
+  }
+
+  // ── Session subcommands ──
+  if (args[0] === 'session') {
+    const sub = args[1]
+    if (sub === 'list') {
+      const sessions = Session.listSessions()
+      if (sessions.length === 0) {
+        console.log('No saved sessions found.')
+      } else {
+        console.log(`\n  Saved Sessions (${sessions.length}):`)
+        console.log('  ' + '-'.repeat(80))
+        console.log(
+          '  ID        Title                                       Mode    Messages  Tokens    Updated',
+        )
+        console.log('  ' + '-'.repeat(80))
+        for (const s of sessions) {
+          const id = s.id.padEnd(9)
+          const title = (s.title || '(untitled)').slice(0, 42).padEnd(43)
+          const mode = s.mode.padEnd(7)
+          const msgs = String(s.messageCount).padEnd(9)
+          const tokens = String(s.totalInputTokens + s.totalOutputTokens).padEnd(9)
+          const date = s.updatedAt.slice(0, 10)
+          console.log(`  ${id} ${title} ${mode} ${msgs} ${tokens} ${date}`)
+        }
+        console.log()
+      }
+      process.exit(0)
+    }
+    if (sub === 'delete') {
+      const id = args[2]
+      if (!id) {
+        console.error('Usage: lonny session delete <id>')
+        process.exit(1)
+      }
+      const deleted = Session.deleteSession(id)
+      if (deleted) {
+        console.log(`Deleted session: ${id}`)
+      } else {
+        console.error(`Session not found: ${id}`)
+        process.exit(1)
+      }
+      process.exit(0)
+    }
+    // If just "session" with no subcommand, show usage
+    console.log('Usage: lonny session list|delete <id>')
+    process.exit(0)
+  }
+
   let prompt: string | undefined
   let autoApprove: boolean | undefined
-  let mode: 'code' | 'plan' | 'ask' | undefined
+  let mode: 'code' | 'plan' | 'ask' | 'loop' | undefined
   let web = false
   let port: number | undefined
+  let continueSession = false
+  let sessionId: string | undefined
 
   for (let i = 0; i < args.length; i++) {
     const arg = args[i]
@@ -31,19 +96,23 @@ export async function parseArgs(argv: string[]): Promise<CliOptions> {
     } else if (arg === '--auto-approve') {
       autoApprove = true
     } else if (arg === '--mode') {
-      mode = args[++i] as 'code' | 'plan' | 'ask'
+      mode = args[++i] as 'code' | 'plan' | 'ask' | 'loop'
     } else if (arg === '--web') {
       web = true
     } else if (arg === '--port') {
       port = parseInt(args[++i], 10)
+    } else if (arg === '--continue' || arg === '-c') {
+      continueSession = true
+    } else if (arg === '--session' || arg === '-s') {
+      sessionId = args[++i]
     }
   }
 
-  if (!prompt && args.length > 0 && !args[0].startsWith('-')) {
+  if (!prompt && args.length > 0 && !args[0].startsWith('-') && args[0] !== 'session') {
     prompt = args[0]
   }
 
   const config = loadConfig({ autoApprove, mode })
 
-  return { config, prompt, web, port }
+  return { config, prompt, web, port, continueSession, sessionId }
 }

package/src/config/index.ts

@@ -5,7 +5,7 @@ import * as path from 'node:path'
 export interface Config {
   apiKey: string
   baseUrl?: string
-  mode: 'code' | 'plan' | 'ask'
+  mode: 'code' | 'plan' | 'ask' | 'loop'
   provider: 'openai' | 'anthropic' | 'google' | 'ollama'
   model: string
   contextWindow: number
@@ -288,6 +288,12 @@ function loadJsonConfig(): JsonConfig {
   }
 }
 
+function saveJsonConfig(config: JsonConfig): void {
+  const configPath = path.join(os.homedir(), '.lonny', 'config.json')
+  fs.writeFileSync(configPath, JSON.stringify(config, null, 2), 'utf-8')
+  cachedJsonConfig = config
+}
+
 /** Check if the model is a DeepSeek model (supports enable_cache). */
 function isDeepSeekModel(model: string, baseUrl?: string): boolean {
   if (/deepseek/i.test(model)) return true
@@ -296,7 +302,7 @@ function isDeepSeekModel(model: string, baseUrl?: string): boolean {
 }
 
 export function loadConfig(options?: {
-  mode?: 'code' | 'plan' | 'ask'
+  mode?: 'code' | 'plan' | 'ask' | 'loop'
   autoApprove?: boolean
   cwd?: string
 }): Config {
@@ -304,6 +310,11 @@ export function loadConfig(options?: {
 
   const model = jsonConfig.model || 'deepseek-v4-flash'
   const baseUrl = process.env.LONNY_BASE_URL || jsonConfig.baseUrl || undefined
+  const provider = (process.env.LONNY_PROVIDER || jsonConfig.provider || 'openai') as
+    | 'openai'
+    | 'anthropic'
+    | 'google'
+    | 'ollama'
 
   // Auto-enable cache for DeepSeek models unless explicitly disabled
   const enableCache = jsonConfig.enableCache ?? (isDeepSeekModel(model, baseUrl) || undefined)
@@ -314,11 +325,7 @@ export function loadConfig(options?: {
   return {
     apiKey: jsonConfig.apiKey || '',
     baseUrl,
-    provider: (process.env.LONNY_PROVIDER || jsonConfig.provider || 'openai') as
-      | 'openai'
-      | 'anthropic'
-      | 'google'
-      | 'ollama',
+    provider,
     mode: options?.mode || 'code',
     model,
     contextWindow,

package/src/index.ts

@@ -2,6 +2,7 @@
 import { execSync } from 'node:child_process'
 import * as os from 'node:os'
 import { runAgent } from './agent/index.js'
+import { Session } from './agent/session.js'
 import { parseArgs } from './cli/index.js'
 import { fmtErr } from './tools/errors.js'
 import { startTui } from './tui/index.js'
@@ -27,7 +28,9 @@ function tryEnableUtf8(): void {
 
 async function main() {
   tryEnableUtf8()
-  const { config, prompt, web, port, init } = await parseArgs(process.argv)
+  const { config, prompt, web, port, init, continueSession, sessionId } = await parseArgs(
+    process.argv,
+  )
 
   // init command exits after completion
   if (init) {
@@ -41,12 +44,36 @@ async function main() {
     process.exit(1)
   }
 
+  let loadedSession: Session | null = null
+
+  // Handle --continue and --session flags
+  if (continueSession || sessionId) {
+    if (sessionId) {
+      loadedSession = await Session.loadById(sessionId, config)
+      if (loadedSession) {
+        console.log(
+          `${BLD}Resuming session:${RS} ${loadedSession.sessionTitle || loadedSession.sessionId}`,
+        )
+      } else {
+        console.error(`${RE}Error:${RS} Session not found: ${sessionId}`)
+        process.exit(1)
+      }
+    } else {
+      loadedSession = await Session.load(config)
+      if (loadedSession) {
+        console.log(
+          `${BLD}Continuing last session:${RS} ${loadedSession.sessionTitle || loadedSession.sessionId}`,
+        )
+      }
+    }
+  }
+
   if (web) {
     await startWebUi(config, port || 15090)
   } else if (prompt) {
-    await runAgent(prompt, config)
+    await runAgent(prompt, config, loadedSession ?? undefined)
   } else {
-    await startTui(config)
+    await startTui(config, loadedSession ?? undefined)
   }
 }
 

package/src/tools/__tests__/bash.test.ts

@@ -1,5 +1,12 @@
+import * as fs from 'node:fs'
+import * as os from 'node:os'
+import * as path from 'node:path'
 import { describe, expect, it } from 'vitest'
-import { bashTool } from '../bash.js'
+import { bashTool } from '../execute/bash/index.js'
+
+function makeTempDir(): string {
+  return fs.mkdtempSync(path.join(os.tmpdir(), 'lonny-test-'))
+}
 
 describe('bash tool', () => {
   it('executes a command successfully', async () => {
@@ -17,7 +24,7 @@ describe('bash tool', () => {
   it('returns error for invalid command', async () => {
     const result = await bashTool.execute({ command: 'some_nonexistent_command_xyz' })
     expect(result.success).toBe(false)
-    expect(result.error).toContain('Command failed')
+    expect(result.error).toContain('Command exited with code 1')
   })
 
   it('accepts custom timeout', async () => {
@@ -25,4 +32,183 @@ describe('bash tool', () => {
     expect(result.success).toBe(true)
     expect(result.output).toContain('timed')
   })
+
+  it('includes description in output when provided', async () => {
+    const result = await bashTool.execute({
+      command: 'echo hello',
+      description: 'testing description',
+    })
+    expect(result.success).toBe(true)
+    expect(result.output).toContain('[bash]')
+    expect(result.output).toContain('testing description')
+    expect(result.output).toContain('hello')
+  })
+
+  it('runs command in specified cwd', async () => {
+    const tmpDir = makeTempDir()
+    try {
+      // Create a marker file so we can verify cwd
+      const result = await bashTool.execute({ command: 'pwd', cwd: tmpDir })
+      expect(result.success).toBe(true)
+      // On Windows, PowerShell's Get-Location returns the path
+      // We just need to check the command executed without error
+      if (os.platform() === 'win32') {
+        // PowerShell: use Get-Location instead of pwd
+        const result2 = await bashTool.execute({
+          command: `Get-Location | Select-Object -ExpandProperty Path`,
+          cwd: tmpDir,
+        })
+        expect(result2.success).toBe(true)
+        const normalizedOutput = result2.output.replace(/\\/g, '/')
+        const normalizedTmp = tmpDir.replace(/\\/g, '/')
+        expect(normalizedOutput).toContain(normalizedTmp)
+      } else {
+        expect(result.output).toContain(tmpDir)
+      }
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true })
+    }
+  })
+
+  it('handles stderr output separately', async () => {
+    // PowerShell: write to stderr using Write-Error
+    const result = await bashTool.execute({
+      command: 'Write-Error "test error" 2>&1 | Out-Null; Write-Output "stdout ok"',
+    })
+    // 2>&1 redirects stderr to stdout in PowerShell, so it should succeed
+    expect(result.success).toBe(true)
+  })
+
+  it('shows (no output) for empty output', async () => {
+    // A command that produces no output
+    const result = await bashTool.execute({ command: 'Write-Output ""' })
+    expect(result.success).toBe(true)
+    expect(result.output).toContain('(no output)')
+  })
+
+  it('truncates very large output', async () => {
+    // Generate a very large output to trigger truncation
+    const result = await bashTool.execute({ command: '1..5000 | ForEach-Object { "Line $_" }' })
+    expect(result.success).toBe(true)
+    // Check if truncation warning is present (output > 10k chars)
+    if (result.output.length > 10000) {
+      expect(result.output).toContain('truncated at')
+    }
+  })
+
+  it('rejects whitespace-only command', async () => {
+    const result = await bashTool.execute({ command: '   ' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('whitespace')
+  })
+
+  it('rejects non-string command type', async () => {
+    const result = await bashTool.execute({ command: 123 })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('must be a string')
+  })
+
+  it('rejects non-existent cwd', async () => {
+    const result = await bashTool.execute({
+      command: 'echo test',
+      cwd: 'C:\\NonExistent_Directory_XYZ_123',
+    })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('does not exist')
+  })
+
+  it('blocks destructive rm -rf / command', async () => {
+    const result = await bashTool.execute({ command: 'rm -rf /' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('Destructive')
+    expect(result.error).toContain('destroy')
+  })
+
+  it('blocks destructive format command', async () => {
+    const result = await bashTool.execute({ command: 'format D: /Q' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('Destructive')
+    expect(result.error).toContain('destroy')
+  })
+
+  it('clamps timeout to valid range', async () => {
+    // Very large timeout should be clamped, not cause error
+    const result = await bashTool.execute({ command: 'echo ok', timeout: 999999999 })
+    expect(result.success).toBe(true)
+  })
+
+  it('rejects filename-like command (no space before flag)', async () => {
+    // This test verifies that the tool handles edge case input gracefully
+    const result = await bashTool.execute({ command: '--version' })
+    // Should fail with exit code 1, not crash
+    expect(result.success).toBe(false)
+  })
+
+  it('blocks Remove-Item -Recurse -Force command', async () => {
+    const result = await bashTool.execute({ command: 'Remove-Item C:\\Windows -Recurse -Force' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('Destructive')
+  })
+
+  it('blocks diskpart clean-all command', async () => {
+    const result = await bashTool.execute({ command: 'diskpart clean-all' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('Destructive')
+  })
+
+  it('blocks reg delete command', async () => {
+    const result = await bashTool.execute({ command: 'reg delete HKLM\\Software' })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('Destructive')
+  })
+
+  it('rejects cwd with path traversal', async () => {
+    const result = await bashTool.execute({
+      command: 'echo test',
+      cwd: 'C:\\Users\\..\\Windows',
+    })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('path traversal')
+    expect(result.error).toContain('..')
+  })
+
+  it('rejects cwd with path traversal using forward slashes', async () => {
+    const result = await bashTool.execute({
+      command: 'echo test',
+      cwd: '/Users/../etc',
+    })
+    expect(result.success).toBe(false)
+    expect(result.error).toContain('path traversal')
+  })
+
+  it('redacts sensitive data from output', async () => {
+    // Test redaction of API key pattern in output
+    const result = await bashTool.execute({
+      command: "Write-Output 'api_key=sk-abc123def456ghi789jkl012mno345pqr678stu'",
+    })
+    expect(result.success).toBe(true)
+    // The API key should be redacted
+    expect(result.output).not.toContain('sk-abc123def456ghi789jkl012mno345pqr678stu')
+    expect(result.output).toContain('[REDACTED]')
+  })
+
+  it('redacts sensitive data from stderr', async () => {
+    const result = await bashTool.execute({
+      command: "Write-Error 'The token ghp_xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx is invalid'",
+    })
+    // Should not crash; the redacted marker should appear in the output/error
+    if (!result.success && result.error) {
+      // The token may be split across lines in PowerShell error formatting,
+      // but [REDACTED] should appear at least once
+      expect(result.error).toContain('[REDACTED]')
+    }
+  })
+
+  it('shows platform-specific tip for grep on Windows', async () => {
+    if (os.platform() === 'win32') {
+      const result = await bashTool.execute({ command: 'grep "pattern" file.txt' })
+      expect(result.success).toBe(false)
+      expect(result.error).toContain('findstr')
+    }
+  })
 })