oakode 0.0.0-stage → 0.5.0

package/dist/models.js

@@ -0,0 +1,106 @@
+/** Presentation helpers for the OICKI model catalog (369 entries in production, so lookup must be filterable). */
+import { configFile, configProblem, loadConfig } from "./config.js";
+import { dim, fmtTokens, green, red, yellow } from "./ui.js";
+/**
+ * The models OAKODE recommends: affordable coding models whose tool calls, multi-step turns and prompt caching were
+ * checked through OICKI (eval/probe.ts, eval/cache-probe.ts, 2026-10-30), plus two stronger ones. The rest of the
+ * catalog stays reachable by search (`/model <text>`, `/models all`).
+ */
+export const CURATED = [
+    { id: "auto", note: "OICKI's pick (default)" },
+    { id: "deepseek/deepseek-v4.1-flash", note: "fast, cheap, caches" },
+    { id: "xiaomi/mimo-v2.6-flash", note: "cheapest once cached; text only", noImages: true }, // images did not reach it (2026-10-30)
+    { id: "minimax/minimax-m3.1-flash", note: "cheap, caches" },
+    { id: "z-ai/glm-5.3-flash", note: "cheap" },
+    { id: "openai/gpt-6-luna", note: "cheap, caches" },
+    { id: "inclusionai/ling-3.1-flash", note: "low price, slower; no images" },
+    { id: "anthropic/claude-sonnet-5.5", note: "stronger; about 20x the cost" },
+    { id: "openai/gpt-6.1-sol", note: "stronger; about 20x the cost" },
+];
+// ---------------------------------------------------------------- model policy
+// OAKODE supports the curated models. `"experimentalModels": true` in config.json opts in to the rest of the catalog,
+// unsupported. It only changes what OAKODE offers and accepts: OICKI still decides what a credential may use.
+export const isSupported = (id) => CURATED.some((c) => c.id === id);
+export const experimentalModels = () => loadConfig().experimentalModels === true;
+/** May a new choice of this model be made (picker, /model, -m, a saved default)? */
+export const allowedModel = (id) => isSupported(id) || experimentalModels();
+/** How to opt in, for every message that refuses a model. */
+export const experimentalHint = () => configProblem() ?? `To use models outside the supported list anyway, add "experimentalModels": true to ${configFile()} (unsupported; OICKI's access rules still apply).`;
+export const notSupported = (id) => `"${id}" is not one of OAKODE's supported models (/models or \`oakode models\` lists them). ${experimentalHint()}`;
+/** What can be browsed and chosen: the supported models, plus (experimental) the rest of the catalog after them. */
+export function selectableModels(catalog) {
+    const supported = curatedModels(catalog);
+    return experimentalModels() ? [...supported, ...catalog.filter((m) => !isSupported(m.id))] : supported;
+}
+/** For a resumed session whose model may no longer be chosen: it keeps working, nothing is switched. */
+export const compatibilityNotice = (id) => `This session uses "${id}", which is not one of OAKODE's supported models. It continues as before; /model switches to a supported one. ${experimentalHint()}`;
+export const ignoredDefaultNotice = (id) => `Your saved default model "${id}" is not one of OAKODE's supported models, so this session uses auto (the saved default is left as it is). ${experimentalHint()}`;
+/** The model for a new session: the saved default if it may still be chosen, else `auto`. The config is not changed. */
+export function defaultModel() {
+    const saved = loadConfig().model;
+    return !saved || allowedModel(saved) ? { id: saved ?? "auto" } : { id: "auto", ignored: saved };
+}
+/** The curated models that are in this catalog, in the curated order. */
+export const curatedModels = (models) => CURATED.map((c) => models.find((m) => m.id === c.id)).filter((m) => !!m);
+export const curatedNote = (id) => CURATED.find((c) => c.id === id)?.note;
+/** Corrects what the catalog claims where OAKODE's own checks found otherwise (a model that does not receive images). */
+function withKnownLimits(m) {
+    if (!CURATED.find((c) => c.id === m.id)?.noImages)
+        return m;
+    return { ...m, oicki: { ...m.oicki, capabilities: { ...m.oicki.capabilities, input_modalities: m.oicki.capabilities.input_modalities.filter((x) => x !== "image") } } };
+}
+/** Why requests to this model may be refused for the current credential, or undefined if they won't be. */
+export function accessNote(m) {
+    const a = m.oicki.access;
+    if (!a.permission_required || a.permission_granted)
+        return undefined;
+    // A "standard" model can still turn expensive for large prompts (expensive_from_prompt_tokens > 0).
+    return a.expensive_from_prompt_tokens
+        ? `needs ${a.permission_required} for prompts over ${fmtTokens(a.expensive_from_prompt_tokens)} tokens`
+        : `needs ${a.permission_required}`;
+}
+export function describeModel(m, current) {
+    const o = m.oicki;
+    const price = o.pricing ? `$${o.pricing.input_usd_per_million}/${o.pricing.output_usd_per_million} per M tok${o.pricing.tiers?.length ? "+" : ""}` : "price n/a";
+    const note = accessNote(m);
+    const flags = [
+        note ? yellow(note) : o.access.permission_required ? "expensive (allowed)" : "",
+        o.capabilities.tools ? "" : red("no tools"),
+        o.resolves_to ? `→ ${o.resolves_to}` : "",
+    ].filter(Boolean);
+    const pick = curatedNote(m.id);
+    return `${m.id === current ? green("*") : " "} ${m.id}  ${pick ? `${pick} · ` : `${yellow("experimental")} · `}${dim(`ctx ${o.context_window ? fmtTokens(o.context_window) : "?"} · ${price}`)} ${flags.join(" ")}`;
+}
+/** Exact id, else case-insensitive substring of id or name. */
+export function matchModels(models, query) {
+    const q = query.trim().toLowerCase();
+    if (!q)
+        return models;
+    const exact = models.find((m) => m.id.toLowerCase() === q);
+    return exact ? [exact] : models.filter((m) => m.id.toLowerCase().includes(q) || (m.oicki.name ?? "").toLowerCase().includes(q));
+}
+/**
+ * Limits to plan with when `selected` is a router such as `auto`: the tighter of the router's own numbers and the
+ * model that actually serves it. The request still names `selected.id`.
+ */
+export function effectiveModel(selected, served) {
+    selected = withKnownLimits(selected);
+    if (!served || served.id === selected.id)
+        return selected;
+    served = withKnownLimits(served);
+    const min = (a, b) => (a && b ? Math.min(a, b) : (a ?? b));
+    return {
+        ...selected,
+        oicki: {
+            ...selected.oicki,
+            context_window: min(selected.oicki.context_window, served.oicki.context_window),
+            max_output_tokens: min(selected.oicki.max_output_tokens, served.oicki.max_output_tokens),
+            capabilities: {
+                ...selected.oicki.capabilities,
+                tools: selected.oicki.capabilities.tools && served.oicki.capabilities.tools,
+                reasoning: !!selected.oicki.capabilities.reasoning && !!served.oicki.capabilities.reasoning,
+                input_modalities: selected.oicki.capabilities.input_modalities.filter((x) => served.oicki.capabilities.input_modalities.includes(x)),
+            },
+        },
+    };
+}

package/dist/modes.js

@@ -0,0 +1,114 @@
+/**
+ * Permission modes: presets that decide, for every tool call, whether it runs, asks, or is refused.
+ *
+ *   default   reads run; edits, writes, commands and MCP calls follow your saved permissions, otherwise ask
+ *   autoedit  like default, but edits/writes inside the workspace run without asking
+ *   plan      only read-only tools run; everything that could change something is refused
+ *   custom    a per-tool table (Always Allow / Ask Every Time / Deny) that you edit with /permissions
+ *
+ * This is enforced where tools are executed (Agent.runTool -> App.authorize, and again in App.confirm), not by the prompt.
+ * Modes are not sandboxes: an approved shell command can do anything the user can.
+ */
+import { protectedPath } from "./permissions.js";
+export const MODES = ["default", "autoedit", "plan", "custom"];
+export const MODE_LABEL = { default: "Default", autoedit: "Auto Edit", plan: "Plan", custom: "Custom" };
+export const MODE_SUMMARY = {
+    default: "reads run; edits, commands and MCP calls follow your saved permissions, otherwise ask",
+    autoedit: "edits and writes inside the workspace run without asking; commands and MCP calls still follow your permissions",
+    plan: "read-only: nothing that modifies files, runs commands or calls MCP tools can run",
+    custom: "your own per-tool policy (/permissions)",
+};
+export const POLICY_LABEL = { allow: "Always Allow", ask: "Ask Every Time", deny: "Deny" };
+export const nextMode = (m) => MODES[(MODES.indexOf(m) + 1) % MODES.length];
+export const parseMode = (s) => {
+    const k = s.toLowerCase().replace(/[\s_-]+/g, "");
+    return MODES.find((m) => m === k);
+};
+const READ_ONLY = new Set(["read", "grep", "glob", "ls", "skill", "job"]); // job only checks or stops what was approved
+const norm = (p) => p.replace(/\\/g, "/").replace(/^\.\//, "").replace(/\/+$/, "");
+/** Relative, no `..`: inside the workspace as far as the path text can tell (the tools themselves also resolve symlinks). */
+export const insideWorkspace = (p) => p !== "" && !p.startsWith("/") && !/^[A-Za-z]:/.test(p) && !p.split("/").includes("..");
+export function subjectOf(name, args, mcp) {
+    if (mcp)
+        return { kind: "mcp", server: mcp.server, mcpTool: mcp.tool };
+    if (READ_ONLY.has(name))
+        return { kind: "read", name };
+    if (name === "write" || name === "edit")
+        return { kind: "file", tool: name, path: norm(String(args?.path ?? "")) };
+    if (name === "bash")
+        return { kind: "bash", command: String(args?.command ?? "") };
+    return { kind: "other", name };
+}
+export function subjectOfAction(a) {
+    if (a.tool === "bash")
+        return { kind: "bash", command: a.command ?? "" };
+    if (a.tool === "mcp")
+        return { kind: "mcp", server: a.server ?? "", mcpTool: a.mcpTool ?? "" };
+    return { kind: "file", tool: a.tool, path: norm(a.path ?? "") };
+}
+const actionOf = (s) => s.kind === "file" ? { tool: s.tool, path: s.path } : s.kind === "bash" ? { tool: "bash", command: s.command } : s.kind === "mcp" ? { tool: "mcp", server: s.server, mcpTool: s.mcpTool } : undefined;
+/** The policy keys that apply to a subject, most specific first. */
+export function policyKeys(s) {
+    switch (s.kind) {
+        case "read": return s.name === "skill" ? [] : [s.name];
+        case "file": return [s.tool];
+        case "bash": return [`bash:${s.command.trim()}`, "bash"];
+        case "mcp": return [`mcp:${s.mcpTool ? `${s.server}/${s.mcpTool}` : s.server}`, `mcp:${s.server}`, "mcp:*"];
+        case "other": return [];
+    }
+}
+const label = (s) => s.kind === "file" ? `${s.tool} ${s.path}` : s.kind === "bash" ? "shell commands" : s.kind === "mcp" ? `MCP tool ${s.server}/${s.mcpTool}` : s.kind === "read" ? s.name : s.name;
+export function decide(mode, perms, s) {
+    const M = MODE_LABEL[mode];
+    if (s.kind === "read") {
+        if (mode === "custom") {
+            for (const k of policyKeys(s)) {
+                const p = perms.policyOf(k);
+                if (p)
+                    return { decision: p.policy, why: `${M}: ${s.name} is set to ${POLICY_LABEL[p.policy]}` };
+            }
+            return { decision: "allow", why: `${M}: ${s.name} is read-only` };
+        }
+        return { decision: "allow", why: `${M}: ${s.name} is read-only` };
+    }
+    if (mode === "plan") {
+        return {
+            decision: "deny",
+            why: `Plan mode is read-only: ${label(s)} is blocked. Do not try to achieve the same effect with another tool (bash, an MCP tool, …). Inspect with read/grep/ls and describe the proposed changes in your answer; the user switches mode (Shift+Tab) to apply them.`,
+        };
+    }
+    const action = actionOf(s);
+    const grant = action ? perms.allowedBy(action) : undefined;
+    // a runner command (npm test, make …) whose command-defining files changed since it was approved asks again
+    const changed = s.kind === "bash" ? perms.runnerChanged(s.command) : undefined;
+    const rerun = () => ({ decision: "ask", why: `${changed.slice(0, 5).join(", ")}${changed.length > 5 ? ` and ${changed.length - 5} more` : ""} changed since this command was allowed, and it runs what ${changed.length > 1 ? "they define" : "that file defines"}. Allowing it accepts the new contents` });
+    const viaGrant = () => (grant ? (changed ? rerun() : { decision: "allow", why: `allowed by a ${grant.scope} permission`, rule: grant }) : undefined);
+    if (s.kind === "other")
+        return { decision: "ask", why: `${M}: ${s.name} is not a known tool, so it asks` };
+    // A protected file (git metadata, project instructions, skills, MCP config) is never allowed by a mode or a broad
+    // policy: only an exact per-file grant or a fresh approval. A Deny still denies.
+    const prot = s.kind === "file" ? protectedPath(s.path) : undefined;
+    const askProtected = () => viaGrant() ?? { decision: "ask", why: `protected file (${prot}); it always asks` };
+    // installed programs (node_modules/.bin, a virtualenv's bin/) are what runner commands run: Auto Edit does not cover them
+    const installed = s.kind === "file" && s.path.split("/").some((seg) => /^(node_modules|\.venv|venv)$/i.test(seg));
+    if (mode === "autoedit" && s.kind === "file" && insideWorkspace(s.path) && !prot && !installed)
+        return { decision: "allow", why: `Auto Edit: ${s.tool} inside the workspace` };
+    if (mode === "custom") {
+        for (const k of policyKeys(s)) {
+            const p = perms.policyOf(k);
+            if (!p)
+                continue;
+            const src = `${M}: ${k} is set to ${POLICY_LABEL[p.policy]}${p.scope === "session" ? " (this session)" : ""}`;
+            if (p.policy === "ask")
+                return viaGrant() ?? { decision: "ask", why: src };
+            if (p.policy === "allow" && prot)
+                return askProtected();
+            if (p.policy === "allow" && changed && k !== "bash")
+                return rerun(); // "all of bash" stays as the person chose it
+            return { decision: p.policy, why: src };
+        }
+    }
+    if (prot)
+        return askProtected();
+    return viaGrant() ?? { decision: "ask", why: `${M}: ${label(s)} asks first${mode === "autoedit" && s.kind === "file" ? (installed ? " (installed packages, which commands run)" : " (outside the workspace)") : ""}; no saved permission matches` };
+}