loom-agent 1.2.37 → 1.3.3

package/CHANGELOG.md

@@ -6,7 +6,43 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased] — completion harness, specialist agents, headless browser, TUI refresh
 
+### Security
+- **All dependency advisories cleared — `npm audit` reports 0
+  vulnerabilities** (was 7: 4 critical, 1 high, 2 low):
+  - `@opentui/solid` / `@opentui/core` (+ all platform binaries)
+    0.5.3 → **0.5.17** — fixes the `@babel/core` arbitrary-file-read
+    advisory and the `solid-js`/`seroval` critical chain.
+  - `seroval` + `seroval-plugins` forced to **1.6.9** via npm `overrides`
+    (solid-js is peer-pinned to 1.9.12 by @opentui/solid; 1.6.9 is exactly
+    the seroval line solid 1.9.17 itself moved to — fixes the critical
+    `fromJSON()` thenable-assimilation + memory-exhaustion advisories).
+  - `shell-quote` **removed** — it was an unused direct dependency carrying
+    a critical `quote()` command-injection advisory.
+  - `diff` ^7 → **^9.0.0** (we only use `diffLines`, unchanged; 9.x ships
+    CJS exports) — fixes the parsePatch/applyPatch DoS advisory.
+  - `brace-expansion` re-resolved to **5.0.12** (transitive, via
+    `npm audit fix`) — fixes the DoS/recursion advisories.
+
 ### Added
+- **Docker sandbox with a guided `/sandbox` wizard (`src/core/sandbox.js`,
+  `SandboxModal`).** `/sandbox` (or `/sandbox setup`) opens a three-step
+  modal: (1) Docker check — if missing, shows the platform install link with
+  an "open download page" action and remembers the pending install; (2) OS
+  pick — Alpine (~250 MB, apk), Debian Slim (~600 MB, apt) or Ubuntu
+  (~900 MB, apt); (3) live build with a real progress UI: per-stage
+  checklist (pull → create → start → essentials → browser → ready), a
+  percentage bar driven by actual docker-pull layer bytes, and streamed
+  install logs. Setup is fully asynchronous — the TUI never freezes — and
+  the wizard can be esc'd while setup continues in the background. Setup
+  pulls the chosen `node:20-*` image, creates the single shared
+  `loom-sandbox` container with the project mounted at `/workspace`,
+  installs essentials (git, bash, curl, ripgrep, coreutils) plus a headless
+  Chromium where offered (best-effort). Isolation: project dir only, no host
+  network, no `--privileged`. The container idles in the background; the
+  dedicated **`sandbox` tool** runs one command inside it only when the
+  agent decides isolation is needed (see Changed). `LOOM_SANDBOX=0` is a
+  hard kill-switch. Saying "docker is ready" after installing reopens the
+  wizard at the OS step.
 - **Drive-to-completion harness (`src/core/session.js`).** When the model ends
   a turn with todos still pending/in_progress (the "stops between tasks"
   failure), the loop injects a continuation listing the unfinished items — up
@@ -31,7 +67,46 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   Chrome/Edge. The page singleton persists across calls. Permissions: passive
   reads allow, interactive click/fill/press ask.
 
+### Fixed
+- **Agent loop no longer stops in the middle of work** (`src/core/session.js`
+  continuation guards — opencode/Claude-Code parity):
+  - **Truncation auto-continue.** `finish_reason=length` (output budget
+    exhausted — the #1 cause of mid-task stops with reasoning models, where
+    thinking eats max_tokens and the answer never streams) now continues
+    the turn with a "continue exactly from where it stopped" nudge instead
+    of dead-ending with a placeholder — up to 5 continuations per turn.
+    Empty truncated replies also drop the empty assistant row from history
+    (Anthropic 400s on empty assistant messages, which silently killed
+    subsequent calls).
+  - **Empty-reply nudges raised 1 → 3 per turn** (provider hiccups repeat).
+  - **Premature-wrap-up detection broadened.** The drive guard now also
+    fires when tools ran, todos exist, and the reply LOOKS unfinished
+    (short, or ends on a promise like "Now I will…") — catching models that
+    never call todowrite. Drive nudges raised 5 → 8 per turn. Leftover
+    todos are surfaced to the UI whenever the guard engaged.
+
 ### Changed
+- **Sandbox is now opt-in per command, not a global router.** Enabling the
+  sandbox no longer hijacks the bash tool — every host command keeps running
+  on your machine (Windows included) exactly as before. Instead, a dedicated
+  **`sandbox` tool** appears; the agent calls it only when isolation is
+  genuinely needed (you asked for the sandbox, the command is risky, or a
+  Linux-only environment is required). Each call revives the container if it
+  stopped (e.g. after a Docker Desktop restart) and re-mounts the current
+  project, then runs just that one command via `docker exec`. The container
+  idles in the background between calls; `/sandbox off` disables the tool
+  (not the host), `/sandbox on` re-enables it. The setup wizard's build step
+  also became fully non-blocking: docker pull streams per-layer progress
+  into a live percentage bar, package installs stream their output, and the
+  TUI stays responsive throughout (esc lets setup finish in the background).
+- **Slash popup decluttered.** The autocomplete popup and command palette
+  now show a short one-line description per command — argument syntax is no
+  longer appended (it lives in `/help` and the README table). Duplicate
+  entries were removed from the picker while their handlers stay callable:
+  `/model` → `/models`, `/thinking` + `/details` → `/settings`, `/rewind`
+  → `/restore` (40 → 36 entries). Every desc was shortened to ~2–35 chars
+  so rows fit on one clean line. README table regenerated from the real
+  list (it previously advertised commands that no longer exist).
 - **TUI design overhaul.** The splash leads with the full LOOM CODE wordmark
   in solid terracotta over a separator rule and a pill-style status
   row; the default "Loom Dark" (and Light) palettes got deeper surface
@@ -56,6 +131,23 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
   with the actual items; the interrupt line reports kept chars + the
   in-progress todo; the plan-complete line includes the planned step count;
   "(no response)"/"(interrupted)" placeholders describe what happened.
+- **Sessions now live in per-session folders inside the project**
+  (claude-code/opencode style): `<project>/.loom/sessions/<id>/session.json`
+  (metadata) + `messages.jsonl` (one message per line, append/rewrite-safe).
+  Old flat `~/.loom/sessions/<id>.json` files stay readable and are migrated
+  into the project folder on the next save; the /sessions picker merges both.
+
+### Fixed
+- **Resuming a session 400'd the next turn** (`NVIDIA error 400: missing
+  field tool_call_id`). The resume path rebuilt the in-memory message list
+  from `{role, content, toolCalls}` only — dropping `toolCallId` — so the
+  provider payload carried a tool row with no id. Resume now preserves
+  `toolCallId` (and aliases legacy snake_case `tool_calls`/`tool_call_id`
+  on load); both providers also skip orphaned tool rows defensively instead
+  of failing the turn.
+- **"The model ended the turn without any text" now says why when it knows.**
+  `finish_reason` is captured from the stream; a truncated reply (reasoning
+  ate the output budget) reports that instead of a mystery placeholder.
 
 ## [1.2.36] — fix `loom web` / `loom acp` / `loom attach`
 

package/README.md

@@ -128,44 +128,51 @@ Zed (add to `~/.config/zed/settings.json`, then Command Palette → `agent: new
 Full transport spec, JetBrains/Neovim configs, the protocol walkthrough, and a
 self-test client (`node scripts/acp-smoke.js`) live in **[docs/acp.md](docs/acp.md)**.
 
-## Slash Commands (35 total)
+## Slash Commands (36 total)
 
 | Command | Args | Description |
 |---------|------|-------------|
-| `/help` | — | Show all commands |
-| `/build` | — | Build mode — all tools |
-| `/plan` | — | Plan mode — read-only analysis |
+| `/help` | — | Show help |
+| `/agents` | — | List agents |
+| `/build` | — | Build mode — full tools |
+| `/plan` | — | Plan mode — read only |
 | `/chat` | — | Chat mode — no tools |
-| `/agents` | — | List primary agents and subagents |
-| `/connect` | `[provider]` | Add/connect a provider |
-| `/key` | — | Edit API key for current provider |
+| `/connect` | `[provider]` | Connect a provider |
+| `/key` | — | Edit API key |
 | `/baseurl` | `[provider] [url]` | Set provider base URL |
-| `/model` | `[model-id]` | Pick active model |
-| `/models` | — | List available models |
-| `/providers` | — | List supported providers |
-| `/status` | — | Show connection status |
-| `/usage` | — | Show token usage and billing |
-| `/new` | — | Start a new session |
+| `/models` | — | Model picker |
+| `/providers` | — | List providers |
+| `/status` | — | Connection status |
+| `/usage` | — | Token usage & billing |
+| `/budget` | `free\|cheap\|best\|auto` | Budget level |
+| `/new` | — | New session |
 | `/clear` | — | Clear the chat |
-| `/compact` | — | Compact conversation |
-| `/undo` | — | Undo last exchange |
-| `/redo` | — | Redo last undone exchange |
-| `/reset` | — | Reset the session |
-| `/settings` | — | Toggle details/sidebar/etc. |
+| `/restore` | — | Restore earlier state |
+| `/settings` | — | Settings — details, thinking, sidebar |
 | `/sessions` | — | Browse saved sessions |
-| `/share` | — | Export current session to JSON |
-| `/export` | — | Export to markdown |
-| `/thinking` | — | Toggle thinking visibility |
-| `/details` | — | Toggle tool detail visibility |
-| `/init` | — | Create LOOM.md |
-| `/memory` | — | Show memory files |
-| `/doctor` | — | Run diagnostics |
+| `/theme` | — | Switch UI theme |
+| `/graph` | — | Memory graph |
 | `/skills` | `install\|remove` | Manage skills |
 | `/mcp` | `add\|remove\|toggle` | Manage MCP servers |
-| `/debug` | — | Show debug info |
-| `/fork` | — | Fork conversation |
+| `/connectors` | `add\|remove\|toggle` | Manage connectors |
+| `/permissions` | `reset\|auto` | Permission rules |
+| `/subagents` | — | Subagent runs |
+| `/context` | — | Context window usage |
+| `/think` | `off\|low\|medium\|high` | Thinking budget |
+| `/approve` | — | Approve plan → Build |
+| `/tasks` | — | Background tasks |
+| `/share` | — | Export chat as HTML |
+| `/worktree` | `<name>` | New git worktree |
+| `/sandbox` | `setup\|status\|on\|off\|rm` | Docker sandbox (opt-in `sandbox` tool; host untouched) |
+| `/style` | `[preset\|text]` | Output style preset |
+| `/vim` | — | Toggle vim editing |
+| `/remember` | `<fact>` | Save a fact to LOOM.md |
 | `/exit` | — | Quit Loom Code |
 
+Aliases still work when typed but are hidden from the picker to keep it
+clean: `/model` → `/models`, `/thinking` + `/details` → `/settings`,
+`/rewind` → `/restore`.
+
 ## Keybindings
 
 Every key is configurable from `~/.loom/tui.json` (`keybinds`, `leader`,

package/package.json

@@ -1,125 +1,126 @@
-{
-  "name": "loom-agent",
-  "version": "1.2.37",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/toshalkumbhar8979-design/loomcode.git"
-  },
-  "homepage": "https://github.com/toshalkumbhar8979-design/loomcode#readme",
-  "bugs": {
-    "url": "https://github.com/toshalkumbhar8979-design/loomcode/issues"
-  },
-  "description": "Loom Code — AI-powered coding agent for the terminal. Multi-provider support including NVIDIA. OpenTUI interface.",
-  "main": "src/index.js",
-  "publishConfig": {
-    "access": "public",
-    "tag": "latest"
-  },
-  "bin": {
-    "loom": "bin/loom-bun.js",
-    "loom-tui": "bin/loom-tui.js"
-  },
-  "scripts": {
-    "start": "node src/index.js",
-    "dev": "node --watch src/index.js",
-    "setup": "node src/setup.js",
-    "test": "bun run src/tui/test-interactive.tsx && bun run test:unit && bun run lint:core",
-    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/tools/index.test.js src/tools/security.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/tui/keybinds.test.ts",
-    "lint:core": "node node_modules/typescript/bin/tsc -p tsconfig.core.json",
-    "smoke:acp": "node scripts/acp-smoke.js",
-    "tui": "bun bin/loom-tui.js",
-    "tui:win": "\"%USERPROFILE%\\..\\bun\\bin\\bun.exe\" run src/tui-open.tsx",
-    "prepublishOnly": "npm test",
-    "postinstall": "node scripts/postinstall.js",
-    "lint": "tsc --noEmit"
-  },
-  "dependencies": {
-    "@anthropic-ai/sdk": "^0.120.0",
-    "@opentui/core": "0.5.3",
-    "@opentui/solid": "0.5.3",
-    "@shikijs/themes": "4.4.3",
-    "@supabase/supabase-js": "^2.45.0",
-    "boxen": "^8.0.0",
-    "chalk": "^5.3.0",
-    "cli-spinners": "^3.2.0",
-    "commander": "^12.1.0",
-    "convex": "^1.14.0",
-    "dayjs": "^1.11.0",
-    "diff": "^7.0.0",
-    "dotenv": "^16.4.0",
-    "glob": "^13.0.6",
-    "inquirer": "^12.1.0",
-    "openai": "^5.23.2",
-    "ora": "^8.0.0",
-    "playwright-core": "^1.64.1",
-    "shell-quote": "^1.8.1",
-    "solid-js": "1.9.12",
-    "strip-ansi": "^7.1.0",
-    "tiktoken": "^1.0.22",
-    "uuid": "^11.0.0",
-    "wrap-ansi": "^9.0.0"
-  },
-  "optionalDependencies": {
-    "@opentui/core-darwin-arm64": "0.5.3",
-    "@opentui/core-darwin-x64": "0.5.3",
-    "@opentui/core-linux-arm64": "0.5.3",
-    "@opentui/core-linux-x64": "0.5.3",
-    "@opentui/core-win32-x64": "0.5.3",
-    "@oven/bun-darwin-aarch64": "1.3.14",
-    "@oven/bun-darwin-x64": "1.3.14",
-    "@oven/bun-linux-aarch64": "1.3.14",
-    "@oven/bun-linux-x64": "1.3.14",
-    "@oven/bun-windows-aarch64": "1.3.14",
-    "@oven/bun-windows-x64": "1.3.14"
-  },
-  "overrides": {
-    "glob": "^13.0.6"
-  },
-  "devDependencies": {
-    "@types/bun": "^1.2.0",
-    "typescript": "^5.7.3"
-  },
-  "files": [
-    "bunfig.toml",
-    "tsconfig.json",
-    "bin/loom-bun.js",
-    "bin/loom.js",
-    "bin/loom-tui.js",
-    "src/**/*.js",
-    "src/**/*.tsx",
-    "src/**/*.ts",
-    "!src/**/test-*",
-    "!src/**/*.test.*",
-    "!src/test-loop.js",
-    "!src/test-tools.js",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE",
-    ".env.example",
-    "LOOM.md",
-    "docs/acp.md",
-    "scripts/acp-smoke.js",
-    "scripts/postinstall.js"
-  ],
-  "keywords": [
-    "ai",
-    "cli",
-    "coding-agent",
-    "loom-code",
-    "anthropic",
-    "openai",
-    "nvidia",
-    "terminal",
-    "opentui"
-  ],
-  "engines": {
-    "node": ">=18.0.0",
-    "bun": ">=1.0.0"
-  },
-  "directories": {
-    "doc": "docs"
-  },
-  "author": "",
-  "license": "MIT",
-  "type": "commonjs"
-}
+{
+  "name": "loom-agent",
+  "version": "1.3.3",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/toshalkumbhar8979-design/loomcode.git"
+  },
+  "homepage": "https://github.com/toshalkumbhar8979-design/loomcode#readme",
+  "bugs": {
+    "url": "https://github.com/toshalkumbhar8979-design/loomcode/issues"
+  },
+  "description": "Loom Code — AI-powered coding agent for the terminal. Multi-provider support including NVIDIA. OpenTUI interface.",
+  "main": "src/index.js",
+  "publishConfig": {
+    "access": "public",
+    "tag": "latest"
+  },
+  "bin": {
+    "loom": "bin/loom-bun.js",
+    "loom-tui": "bin/loom-tui.js"
+  },
+  "scripts": {
+    "start": "node src/index.js",
+    "dev": "node --watch src/index.js",
+    "setup": "node src/setup.js",
+    "test": "bun run src/tui/test-interactive.tsx && bun run test:unit && bun run lint:core",
+    "test:unit": "bun test src/core/agents.test.js src/core/hooks.test.js src/core/custom-commands.test.js src/core/background-tasks.test.js src/core/memory.test.js src/core/subagent-log.test.js src/core/session.test.js src/core/sandbox.test.js src/tools/index.test.js src/tools/security.test.js src/providers/providers.test.js src/providers/caching.test.js src/providers/caching-thinking.test.js src/providers/registry.test.js src/mcp/mcp-client.test.js src/mcp/mcp-manager.test.js src/core/session-store.test.js src/skills/skills-manager.test.js src/core/usage.test.js src/core/permissions.test.js src/core/format.test.js src/acp/acp-server.test.js src/tui/keybinds.test.ts",
+    "lint:core": "node node_modules/typescript/bin/tsc -p tsconfig.core.json",
+    "smoke:acp": "node scripts/acp-smoke.js",
+    "tui": "bun bin/loom-tui.js",
+    "tui:win": "\"%USERPROFILE%\\..\\bun\\bin\\bun.exe\" run src/tui-open.tsx",
+    "prepublishOnly": "npm test",
+    "postinstall": "node scripts/postinstall.js",
+    "lint": "tsc --noEmit"
+  },
+  "dependencies": {
+    "@anthropic-ai/sdk": "^0.120.0",
+    "@opentui/core": "0.5.17",
+    "@opentui/solid": "0.5.17",
+    "@shikijs/themes": "4.4.3",
+    "@supabase/supabase-js": "^2.45.0",
+    "boxen": "^8.0.0",
+    "chalk": "^5.3.0",
+    "cli-spinners": "^3.2.0",
+    "commander": "^12.1.0",
+    "convex": "^1.14.0",
+    "dayjs": "^1.11.0",
+    "diff": "^9.0.0",
+    "dotenv": "^16.4.0",
+    "glob": "^13.0.6",
+    "inquirer": "^12.1.0",
+    "openai": "^5.23.2",
+    "ora": "^8.0.0",
+    "playwright-core": "^1.64.1",
+    "solid-js": "1.9.12",
+    "strip-ansi": "^7.1.0",
+    "tiktoken": "^1.0.22",
+    "uuid": "^11.0.0",
+    "wrap-ansi": "^9.0.0"
+  },
+  "optionalDependencies": {
+    "@opentui/core-darwin-arm64": "0.5.17",
+    "@opentui/core-darwin-x64": "0.5.17",
+    "@opentui/core-linux-arm64": "0.5.17",
+    "@opentui/core-linux-x64": "0.5.17",
+    "@opentui/core-win32-x64": "0.5.17",
+    "@oven/bun-darwin-aarch64": "1.3.14",
+    "@oven/bun-darwin-x64": "1.3.14",
+    "@oven/bun-linux-aarch64": "1.3.14",
+    "@oven/bun-linux-x64": "1.3.14",
+    "@oven/bun-windows-aarch64": "1.3.14",
+    "@oven/bun-windows-x64": "1.3.14"
+  },
+  "overrides": {
+    "glob": "^13.0.6",
+    "seroval": "1.6.9",
+    "seroval-plugins": "1.6.9"
+  },
+  "devDependencies": {
+    "@types/bun": "^1.2.0",
+    "typescript": "^5.7.3"
+  },
+  "files": [
+    "bunfig.toml",
+    "tsconfig.json",
+    "bin/loom-bun.js",
+    "bin/loom.js",
+    "bin/loom-tui.js",
+    "src/**/*.js",
+    "src/**/*.tsx",
+    "src/**/*.ts",
+    "!src/**/test-*",
+    "!src/**/*.test.*",
+    "!src/test-loop.js",
+    "!src/test-tools.js",
+    "README.md",
+    "CHANGELOG.md",
+    "LICENSE",
+    ".env.example",
+    "LOOM.md",
+    "docs/acp.md",
+    "scripts/acp-smoke.js",
+    "scripts/postinstall.js"
+  ],
+  "keywords": [
+    "ai",
+    "cli",
+    "coding-agent",
+    "loom-code",
+    "anthropic",
+    "openai",
+    "nvidia",
+    "terminal",
+    "opentui"
+  ],
+  "engines": {
+    "node": ">=18.0.0",
+    "bun": ">=1.0.0"
+  },
+  "directories": {
+    "doc": "docs"
+  },
+  "author": "",
+  "license": "MIT",
+  "type": "commonjs"
+}