min-agent 0.5.1 → 0.6.0

package/dist/serve/routes-meta.js

@@ -1,268 +0,0 @@
-import { fetchModels, getActiveProvider, getEffectiveConfig, getBudgetSnapshot, setBudgetMaxCost, setSandboxConfig, setPermissionMode, parsePermissionMode, parseThinkingEffort, } from "../config.js";
-import { setThinkingEffort } from "../thinking.js";
-import { parseNetworkPolicy, parseSandboxMode } from "../sandbox.js";
-import { readScope } from "../scope.js";
-import { getWorkingTreeDiff } from "../tui/diff-view.js";
-import { scanProject } from "../code-mode.js";
-import { getContextWindowInfo } from "../context-window.js";
-import { parseCtxChoice, setOllamaContextChoice, ctxPayload, CTX_CHOICES } from "../ctx.js";
-import { getModelPrice, estimateCost } from "../pricing.js";
-import { checkForUpdate } from "../updater.js";
-import { sendJson, sendJsonError, readJsonBody, readStringPathList, sandboxPayload, permissionPayload, thinkingPayload, memoryPayload, } from "./common.js";
-export const handleMetaRoutes = async (req, res, ctx, url, pathname) => {
-    if (req.method === "GET" && pathname === "/health") {
-        sendJson(res, 200, { ok: true, service: "min-agent", version: ctx.version });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/meta") {
-        sendJson(res, 200, {
-            version: ctx.version,
-            cwd: process.cwd(),
-            instructions_chars: ctx.instructions.join("\n").length,
-            sandbox: sandboxPayload(),
-            permission: permissionPayload(),
-            thinking: thinkingPayload(),
-            memory: memoryPayload(),
-        });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/update") {
-        const check = await checkForUpdate({ currentVersion: ctx.version });
-        sendJson(res, 200, {
-            current: check.current,
-            latest: check.latest,
-            update_available: check.updateAvailable,
-            ...(check.latest === null ? { error: "registry_unavailable" } : {}),
-        });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/models") {
-        const config = getEffectiveConfig();
-        const provider = getActiveProvider(config);
-        const base = provider?.baseURL;
-        const key = provider?.apiKey;
-        if (!base || !key) {
-            sendJson(res, 500, { error: "provider_not_configured" });
-            return true;
-        }
-        const models = await fetchModels(base, key);
-        sendJson(res, 200, {
-            default_model: provider?.defaultModel ?? null,
-            models,
-        });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/budget") {
-        const snap = getBudgetSnapshot();
-        sendJson(res, 200, { maxCostUSD: snap.maxCostUSD ?? null, source: snap.source });
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/budget") {
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const n = parsed.value.maxCostUSD;
-        if (typeof n !== "number" || !Number.isFinite(n) || n <= 0) {
-            sendJson(res, 400, { error: "invalid_max_cost", detail: "maxCostUSD must be a positive number" });
-            return true;
-        }
-        const scopeParsed = readScope(parsed.value.scope);
-        if (!scopeParsed.ok) {
-            sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-            return true;
-        }
-        const scope = scopeParsed.scope ?? "global";
-        setBudgetMaxCost(n, scope);
-        const snap = getBudgetSnapshot();
-        sendJson(res, 200, { ok: true, maxCostUSD: snap.maxCostUSD ?? n, source: snap.source, scope });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/sandbox") {
-        sendJson(res, 200, sandboxPayload());
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/permission") {
-        sendJson(res, 200, permissionPayload());
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/permission") {
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const mode = parsePermissionMode(parsed.value.permission);
-        if (!mode) {
-            sendJson(res, 400, { error: "invalid_permission", detail: "permission must be ask, accept-edits, or allow-all" });
-            return true;
-        }
-        const scopeParsed = readScope(parsed.value.scope);
-        if (!scopeParsed.ok) {
-            sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-            return true;
-        }
-        const scope = scopeParsed.scope ?? "global";
-        setPermissionMode(mode, scope);
-        sendJson(res, 200, { ok: true, scope, ...permissionPayload() });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/thinking") {
-        sendJson(res, 200, thinkingPayload());
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/thinking") {
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const effort = parseThinkingEffort(parsed.value.thinking);
-        if (!effort) {
-            sendJson(res, 400, { error: "invalid_thinking", detail: "thinking must be off, low, medium, high, or max" });
-            return true;
-        }
-        const scopeParsed = readScope(parsed.value.scope);
-        if (!scopeParsed.ok) {
-            sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-            return true;
-        }
-        const scope = scopeParsed.scope ?? "global";
-        setThinkingEffort(effort, scope);
-        sendJson(res, 200, { ok: true, scope, ...thinkingPayload() });
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/sandbox") {
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const body = parsed.value;
-        const mode = body.mode === undefined ? undefined : parseSandboxMode(body.mode);
-        if (body.mode !== undefined && !mode) {
-            sendJson(res, 400, { error: "invalid_sandbox", detail: "mode must be off, workspace, or strict" });
-            return true;
-        }
-        const network = body.network === undefined ? undefined : parseNetworkPolicy(body.network);
-        if (body.network !== undefined && !network) {
-            sendJson(res, 400, { error: "invalid_network", detail: "network must be allow or deny" });
-            return true;
-        }
-        const extraWrite = readStringPathList(body.extraWriteRoots);
-        const extraRead = readStringPathList(body.extraReadRoots);
-        if (!extraWrite.ok || !extraRead.ok) {
-            sendJson(res, 400, {
-                error: "invalid_roots",
-                detail: "extraWriteRoots and extraReadRoots must be arrays of non-empty strings",
-            });
-            return true;
-        }
-        if (!mode && !network && extraWrite.value === undefined && extraRead.value === undefined) {
-            sendJson(res, 400, { error: "invalid_body", detail: "Provide mode, network, extraWriteRoots, or extraReadRoots" });
-            return true;
-        }
-        const scopeParsed = readScope(body.scope);
-        if (!scopeParsed.ok) {
-            sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-            return true;
-        }
-        const scope = scopeParsed.scope ?? "global";
-        setSandboxConfig({
-            ...(mode ? { mode } : {}),
-            ...(network ? { network } : {}),
-            ...(extraWrite.value ? { extraWriteRoots: extraWrite.value } : {}),
-            ...(extraRead.value ? { extraReadRoots: extraRead.value } : {}),
-        }, scope);
-        sendJson(res, 200, { ok: true, scope, ...sandboxPayload() });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/diff") {
-        const result = await getWorkingTreeDiff();
-        if (!result.ok) {
-            sendJson(res, 200, { ok: false, reason: result.reason, message: result.message });
-            return true;
-        }
-        sendJson(res, 200, { ok: true, diff: result.diff });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/rules") {
-        sendJson(res, 200, {
-            count: ctx.instructions.length,
-            rules: ctx.instructions.map((inst) => {
-                const firstLine = inst.split("\n")[0] ?? "";
-                return { source: firstLine.replace("Instructions from: ", ""), chars: inst.length };
-            }),
-        });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/project") {
-        const project = scanProject();
-        sendJson(res, 200, { project });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/context") {
-        const config = getEffectiveConfig();
-        const provider = getActiveProvider(config);
-        const info = await getContextWindowInfo(provider?.defaultModel);
-        sendJson(res, 200, {
-            context_window: info.tokens,
-            source: info.source,
-            model: provider?.defaultModel ?? null,
-            ...ctxPayload(),
-        });
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/context") {
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const choice = typeof parsed.value.level === "string" ? parseCtxChoice(parsed.value.level) : null;
-        if (!choice) {
-            sendJson(res, 400, {
-                error: "invalid_context_level",
-                detail: `level must be one of: ${CTX_CHOICES.join(", ")}`,
-            });
-            return true;
-        }
-        const result = setOllamaContextChoice(choice);
-        if (!result.ok) {
-            sendJson(res, 400, {
-                error: "ctx_not_supported",
-                detail: "context levels are only available for an Ollama provider",
-            });
-            return true;
-        }
-        const provider = getActiveProvider(getEffectiveConfig());
-        const info = await getContextWindowInfo(provider?.defaultModel);
-        sendJson(res, 200, {
-            ok: true,
-            context_window: info.tokens,
-            source: info.source,
-            model: provider?.defaultModel ?? null,
-            ...ctxPayload(),
-        });
-        return true;
-    }
-    if (req.method === "GET" && pathname === "/v1/cost") {
-        const config = getEffectiveConfig();
-        const provider = getActiveProvider(config);
-        const modelId = url.searchParams.get("model") ?? provider?.defaultModel ?? null;
-        const inputRaw = url.searchParams.get("input");
-        const outputRaw = url.searchParams.get("output");
-        const input = inputRaw ? parseInt(inputRaw, 10) : 0;
-        const output = outputRaw ? parseInt(outputRaw, 10) : 0;
-        if (Number.isNaN(input) || Number.isNaN(output) || input < 0 || output < 0) {
-            sendJson(res, 400, { error: "invalid_tokens", detail: "input/output must be non-negative integers" });
-            return true;
-        }
-        const price = modelId ? await getModelPrice(modelId) : null;
-        const cost = price ? estimateCost({ inputTokens: input, outputTokens: output }, price) : null;
-        sendJson(res, 200, { model: modelId, price, cost_usd: cost });
-        return true;
-    }
-    return false;
-};

package/dist/serve/routes-sessions.js

@@ -1,61 +0,0 @@
-import { listSessions, loadSession, deleteSession, renameSession } from "../sessions.js";
-import { sendJson, sendJsonError, readJsonBody, decodePathSegment } from "./common.js";
-export const handleSessionRoutes = async (req, res, _ctx, _url, pathname) => {
-    if (req.method === "GET" && pathname === "/v1/sessions") {
-        const sessions = listSessions();
-        sendJson(res, 200, { sessions });
-        return true;
-    }
-    if (req.method === "DELETE" && pathname.startsWith("/v1/sessions/")) {
-        const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
-        if (!id) {
-            sendJson(res, 400, { error: "missing_session_id" });
-            return true;
-        }
-        const ok = deleteSession(id);
-        if (!ok) {
-            sendJson(res, 404, { error: "session_not_found", session_id: id });
-            return true;
-        }
-        sendJson(res, 200, { ok: true, deleted: id });
-        return true;
-    }
-    if (req.method === "GET" && pathname.startsWith("/v1/sessions/")) {
-        const id = decodePathSegment(pathname.slice("/v1/sessions/".length));
-        if (!id) {
-            sendJson(res, 400, { error: "missing_session_id" });
-            return true;
-        }
-        const session = loadSession(id);
-        if (!session) {
-            sendJson(res, 404, { error: "session_not_found", session_id: id });
-            return true;
-        }
-        sendJson(res, 200, { session });
-        return true;
-    }
-    if (req.method === "POST" && pathname.startsWith("/v1/sessions/") && pathname.endsWith("/rename")) {
-        const id = decodePathSegment(pathname.slice("/v1/sessions/".length, -"/rename".length));
-        if (!id) {
-            sendJson(res, 400, { error: "missing_session_id" });
-            return true;
-        }
-        const parsed = await readJsonBody(req);
-        if (!parsed.ok) {
-            sendJsonError(res, parsed);
-            return true;
-        }
-        const title = parsed.value.title?.trim();
-        if (!title) {
-            sendJson(res, 400, { error: "missing_title" });
-            return true;
-        }
-        if (!renameSession(id, title)) {
-            sendJson(res, 404, { error: "session_not_found", session_id: id });
-            return true;
-        }
-        sendJson(res, 200, { ok: true, session_id: id, title });
-        return true;
-    }
-    return false;
-};

package/dist/serve/routes-skills.js

@@ -1,70 +0,0 @@
-import { discoverSkills, getAllSkills, getSkill, getStaleDisabledSkills, setSkillEnabled } from "../skills.js";
-import { sendJson, readJsonBody, decodePathSegment, skillPayload } from "./common.js";
-export const handleSkillRoutes = async (req, res, _ctx, _url, pathname) => {
-    if (req.method === "GET" && pathname === "/v1/skills") {
-        const all = getAllSkills();
-        sendJson(res, 200, {
-            count: all.length,
-            enabled_count: all.filter((s) => s.enabled).length,
-            stale_disabled: getStaleDisabledSkills(),
-            skills: all.map(skillPayload),
-        });
-        return true;
-    }
-    if (req.method === "POST" && pathname === "/v1/skills/reload") {
-        discoverSkills({ silent: true });
-        const all = getAllSkills();
-        sendJson(res, 200, {
-            ok: true,
-            count: all.length,
-            enabled_count: all.filter((s) => s.enabled).length,
-            stale_disabled: getStaleDisabledSkills(),
-            skills: all.map(skillPayload),
-        });
-        return true;
-    }
-    const skillDetail = pathname.match(/^\/v1\/skills\/([^/]+)$/);
-    if (req.method === "GET" && skillDetail) {
-        const name = decodePathSegment(skillDetail[1]);
-        if (!name) {
-            sendJson(res, 400, { error: "invalid_skill_name" });
-            return true;
-        }
-        const skill = getSkill(name);
-        if (!skill) {
-            sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
-            return true;
-        }
-        sendJson(res, 200, { skill: { ...skillPayload(skill), content: skill.content } });
-        return true;
-    }
-    const skillToggle = pathname.match(/^\/v1\/skills\/([^/]+)\/(enable|disable)$/);
-    if (req.method === "POST" && skillToggle) {
-        const name = decodePathSegment(skillToggle[1]);
-        if (!name) {
-            sendJson(res, 400, { error: "invalid_skill_name" });
-            return true;
-        }
-        const enabled = skillToggle[2] === "enable";
-        if (!getSkill(name)) {
-            sendJson(res, 404, { error: "skill_not_found", name, available: getAllSkills().map((s) => s.name) });
-            return true;
-        }
-        const parsed = await readJsonBody(req);
-        const scope = parsed.ok ? parsed.value.scope : undefined;
-        if (scope !== undefined && scope !== "global" && scope !== "project") {
-            sendJson(res, 400, { error: "invalid_scope", allowed: ["global", "project"] });
-            return true;
-        }
-        const [result] = setSkillEnabled([name], enabled, scope ?? "global");
-        sendJson(res, 200, {
-            ok: true,
-            name,
-            enabled: result.enabled,
-            scope: scope ?? "global",
-            ...(result.blockedBy ? { blocked_by: result.blockedBy } : {}),
-        });
-        return true;
-    }
-    return false;
-};

package/dist/serve.js

@@ -1,138 +0,0 @@
-/**
- * HTTP API server: exposes chat / models / health for programmatic use.
- * Run: min-agent serve [--host 127.0.0.1] [--port 8787]
- */
-import { createServer } from "http";
-import { timingSafeEqual } from "crypto";
-import { initMcp, shutdownMcp } from "./mcp.js";
-import { discoverSkills } from "./skills.js";
-import { loadInstructions } from "./instructions.js";
-import { isConfigured } from "./config.js";
-import { setAutoApprove } from "./confirm.js";
-import { createApprovalGate } from "./http-approvals.js";
-import { packageVersion, corsEnabled, corsHeaders, sendJson, } from "./serve/common.js";
-import { handleChatRoutes } from "./serve/routes-chat.js";
-import { handleSessionRoutes } from "./serve/routes-sessions.js";
-import { handleMemoryRoutes } from "./serve/routes-memory.js";
-import { handleMcpRoutes } from "./serve/routes-mcp.js";
-import { handleSkillRoutes } from "./serve/routes-skills.js";
-import { handleMetaRoutes } from "./serve/routes-meta.js";
-/**
- * With CORS enabled and no auth token, arbitrary web pages could drive the
- * agent. Allow only same-machine origins (localhost) in that configuration;
- * a token bypasses the origin check entirely.
- */
-function originAllowed(req) {
-    if (process.env.MIN_AGENT_SERVE_TOKEN?.trim())
-        return true;
-    const origin = req.headers.origin?.trim();
-    if (!origin || origin === "null")
-        return true;
-    try {
-        const host = new URL(origin).hostname;
-        if (host === "localhost" || host === "127.0.0.1" || host === "[::1]")
-            return true;
-    }
-    catch {
-        return false;
-    }
-    return false;
-}
-function authOk(req) {
-    const token = process.env.MIN_AGENT_SERVE_TOKEN?.trim();
-    if (!token)
-        return true;
-    const h = req.headers.authorization?.trim();
-    if (!h?.startsWith("Bearer "))
-        return false;
-    const provided = Buffer.from(h.slice(7));
-    const expected = Buffer.from(token);
-    return provided.length === expected.length && timingSafeEqual(provided, expected);
-}
-export async function runServe(opts = {}) {
-    if (!isConfigured()) {
-        console.error("Not configured. Run: min-agent setup");
-        process.exit(1);
-    }
-    const host = opts.host ?? process.env.MIN_AGENT_SERVE_HOST ?? "127.0.0.1";
-    const port = opts.port ?? parseInt(process.env.MIN_AGENT_SERVE_PORT ?? "8787", 10);
-    const isLoopbackHost = host === "127.0.0.1" || host === "::1" || host === "localhost";
-    if (!isLoopbackHost && !process.env.MIN_AGENT_SERVE_TOKEN?.trim()) {
-        console.error("Refusing to serve on a non-loopback address without MIN_AGENT_SERVE_TOKEN. " +
-            "Set the token (Authorization: Bearer <token>) or bind to 127.0.0.1.");
-        process.exit(1);
-    }
-    console.error("\x1b[33m⚠ min-agent serve: confirmations are auto-approved by default (same as -y). Set auto_approve: false with stream: true to require callbacks.\x1b[0m");
-    setAutoApprove(true);
-    console.error("\x1b[90m⟳ Initializing MCP, skills, instructions…\x1b[0m");
-    await initMcp();
-    discoverSkills();
-    const ctx = {
-        host,
-        version: packageVersion(),
-        instructions: await loadInstructions(),
-        approvalGate: createApprovalGate(),
-        activeChats: 0,
-    };
-    const routes = [
-        handleMetaRoutes,
-        handleChatRoutes,
-        handleSessionRoutes,
-        handleMemoryRoutes,
-        handleMcpRoutes,
-        handleSkillRoutes,
-    ];
-    const server = createServer(async (req, res) => {
-        const c = corsHeaders();
-        if (req.method === "OPTIONS") {
-            res.writeHead(204, c);
-            res.end();
-            return;
-        }
-        if (!authOk(req)) {
-            sendJson(res, 401, {
-                error: "unauthorized",
-                detail: "Set Authorization: Bearer <MIN_AGENT_SERVE_TOKEN> when MIN_AGENT_SERVE_TOKEN is set",
-            });
-            return;
-        }
-        if (corsEnabled() && !originAllowed(req)) {
-            sendJson(res, 403, {
-                error: "origin_not_allowed",
-                detail: "CORS is enabled without a token; only localhost origins are allowed. Set MIN_AGENT_SERVE_TOKEN or disable CORS.",
-            });
-            return;
-        }
-        const url = new URL(req.url ?? "/", `http://${host}`);
-        const pathname = url.pathname.replace(/\/$/, "") || "/";
-        try {
-            for (const route of routes) {
-                if (await route(req, res, ctx, url, pathname))
-                    return;
-            }
-            sendJson(res, 404, { error: "not_found", path: pathname });
-        }
-        catch (err) {
-            sendJson(res, 500, { error: "internal_error", message: err?.message ?? String(err) });
-        }
-    });
-    await new Promise((resolve, reject) => {
-        server.once("error", reject);
-        server.listen(port, host, () => {
-            console.error(`\x1b[32m✓ min-agent serve\x1b[0m http://${host}:${port}  (API: docs/API.md)`);
-            resolve();
-        });
-    });
-    const closeServer = async () => {
-        await shutdownMcp();
-        server.closeAllConnections?.();
-        await new Promise((resolve) => server.close(() => resolve()));
-    };
-    const shutdown = async () => {
-        await closeServer();
-        process.exit(0);
-    };
-    process.on("SIGINT", shutdown);
-    process.on("SIGTERM", shutdown);
-    return { close: closeServer };
-}