opencode-qoder-bridge 0.1.8 → 0.1.9

package/CHANGELOG.md

@@ -4,6 +4,59 @@ All notable changes to this project are documented here. The format follows
 [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and releases use
 [Semantic Versioning](https://semver.org/).
 
+## [0.1.9] - 2026-08-30
+
+### Added
+
+- Updated `@qoder-ai/qoder-agent-sdk` to `1.0.30` (paired with `qodercli` 1.1.35).
+- **Plan Mode Integration**: Added `planMode?: boolean` provider option to run in planning mode independently from tool permissions. Registered new `/qoder_plan_mode` tool.
+- **Outbound Proxy Routing**: Added `proxy?: string` provider option for direct qodercli HTTP/HTTPS/SOCKS5 proxy routing without mutating environment variables, with automatic fallback to `HTTPS_PROXY` / `HTTP_PROXY`.
+- **Skill Evolution**: Added `evolution?: EvolutionOptions` provider option to enable autonomous turn-completion skill analysis and recommendations.
+- **Dynamic Live Model Catalog Updates**: Ingests real-time `available_models_update` stream events to synchronize model availability and persistent cache without restarting OpenCode.
+- **Artifacts Tracking**: Ingests `artifacts_update` events during chat turns and surfaces artifact change metadata in `providerMetadata.qoder.artifacts`.
+- **Sessions Tool**: Added `qoder_sessions` tool using SDK's `listSessions()` to inspect recent sessions, titles, and git branches.
+
+### Fixed
+
+- **Runtime Package Boundary**: Moved the runtime-used `@opencode-ai/plugin`
+  helper into production dependencies and verified root/provider imports from a
+  dev-omitted packed install.
+- **Workspace-Aware Session Safety**: Scoped persisted session mappings by
+  workspace, serialized same-key turns, delayed mapping writes until a
+  successful turn, and added bounded cross-process state locking.
+- **Catalog, Usage, and Stream Hardening**: Made live model snapshots
+  authoritative, bounded discovery/usage requests, closed abort and duplicate
+  event races, sanitized malformed SDK usage/metadata, and surfaced typed
+  authentication/result failures.
+- **Persistent State and Input Bounds**: Hardened atomic state/config writes,
+  model/session cache validation, prompt/image limits, MCP URL/command input,
+  and finite cost/statusline accounting.
+- **Unknown Model Transparency**: Unknown requested model IDs are now forwarded
+  unchanged to Qoder while the default catalog entry is used only for prompt
+  sizing metadata; the bridge no longer silently selects `auto`.
+- **Ephemeral Session Privacy**: Explicitly disables SDK transcript persistence
+  for non-persistent turns and auxiliary usage/model discovery queries.
+- **Stream and Boundary Hardening**: Added bounded turn timeouts, abort-aware
+  generation failures, bounded query cleanup, malformed-stream rejection,
+  replay UUID guards, tool ownership deny rules, diagnostic redaction, and
+  stricter MCP URL/command validation.
+- **Release Artifact Safety**: Added a `prepack` rebuild hook, executable usage
+  CLI permissions, and a public `./errors` export for the typed error API.
+- **Session Store Concurrency Race Condition**: Added an async mutex queue (`withLock`) to serialize concurrent `ensureQoderSession` and `deleteQoderSession` operations, preventing dropped session records under parallel turns.
+- **Tool Continuation History Trimming**: Fixed a critical bug in `trimToBudget` where the active user prompt was dropped during continuation turns with large assistant/tool outputs, preventing prompts from falling back to `"Hello"`.
+- **Data URL Parsing Hardening**: Added bounded-length and round-trip base64 validation with early rejection of oversized image attachments, preventing avoidable CPU and memory pressure from malformed multi-megabyte inputs.
+- **Stream Controller Abort Safety & Listener Cleanup**: Added `safeEnqueue` and `safeClose` to prevent uncaught `Invalid state: Controller is already closed` exceptions when streams are aborted or cancelled, and cleaned up `abortSignal` event listeners in `language-model.ts` and `sdk-session.ts` to prevent memory leaks on shared signals.
+- **`doGenerate` Provider Metadata**: Fixed `doGenerate` discarding `providerMetadata` (`totalCostUSD`, `contextUsageRatio`, `planMode`, `artifacts`), ensuring parity with `doStream`.
+- **Coalesced Model Cache Writes**: Implemented a coalesced cache write queue in `models.ts` to prevent simultaneous file write contention and eliminate orphaned `.tmp` files under rapid streaming catalog updates.
+- **Atomic File Cleanup & All-Session Reset**: Added `try...finally` temporary file unlinking in `session-store.ts` and `models.ts` to guarantee zero dangling `.tmp` files, and exported `clearAllSessions()` to support full session resets.
+- **Tool Schema & Error Boundaries**: Upgraded plugin tools with `tool()` and `tool.schema` from `@opencode-ai/plugin`, added `key` (and `"all"`) to `qoder_session_reset`, added `dir` and `limit` filtering to `qoder_sessions`, and wrapped tool executions in error boundaries.
+- **Tool Normalization & Path Aliases**: Added `execute_command`, `executecommand`, `run_command`, and `runcommand` mapping to `bash`, added `cmd` alias for command, and added `path` alias for `filePath` across read, write, edit, delete, view, and apply_diff.
+- **MCP Bridge Argument Flexibility**: Converted numeric and boolean arguments in `mcp-bridge` stdio configs without dropping the argument list.
+- **Prompt Serialization Hardening**: Added non-image file attachment serialization in `prompt-builder` so attached text files are preserved, and safely guarded missing `toolCallId` / `toolName`.
+- **TUI & CLI Hardening**: Guarded `latest.model?.providerID` in `tui.ts` against undefined model objects, guarded against non-finite costs (`NaN`) in sidebar and statusline, and trimmed PAT whitespace in `hasQoderPAT()`.
+- **Stress Test Suite**: Added `test/stress.test.mjs` verifying concurrency, massive conversations (1,000 messages), stream aborts, and prototype pollution protection.
+- **CI-Safe Live Stress Coverage**: Made the Qoder-backed stream-abort stress probe opt-in with `QODER_STRESS_E2E=1`, keeping the normal test suite credential-free while preserving live stress coverage when explicitly enabled.
+
 ## [0.1.8] - 2026-08-26
 
 ### Fixed
@@ -78,7 +131,9 @@ All notable changes to this project are documented here. The format follows
   session.
 - The `models.json` cache is written atomically with mode 0600 instead of a
   direct partial-write-prone write.
-- Unknown model IDs fall back to the default model with a debug log entry.
+- Unknown model IDs previously fell back to the default model with a debug log
+  entry; current releases preserve the requested ID and let Qoder report model
+  availability explicitly.
 
 ## [0.1.3] - 2026-08-20
 
@@ -155,3 +210,4 @@ also verified with an in-process MCP transport.
 [0.1.4]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.3...v0.1.4
 [0.1.5]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.4...v0.1.5
 [0.1.8]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.7...v0.1.8
+[0.1.9]: https://github.com/naoufalelbani/opencode-qoder-bridge/compare/v0.1.8...v0.1.9

package/README.md

@@ -119,37 +119,23 @@ The ledger accumulates across sessions. Delete `~/.config/opencode-qoder-bridge/
 
 The bridge discovers the available catalog at startup through the SDK's
 `getAvailableModels()` API. Availability is account-, region-, rollout-, and
-SDK-version-dependent. A live query on **2026-08-20** returned:
-
-| Model ID | Name | Credit multiplier | Vision | Reasoning | Max input | Max output |
-|----------|------|-------------------|--------|-----------|-----------|------------|
-
-The following are known or historical model IDs. Some may be obsolete or
-unavailable for a particular account and are not an availability guarantee:
-
-| Model ID | Name | Credit multiplier | Vision | Reasoning | Max input | Max output |
-|----------|------|-------------------|--------|-----------|-----------|------------|
-| `auto` | Auto | 1.00x | ✓ | ✗ | 180K | 32K |
-| `ultimate` | Ultimate | 0.80x | ✓ | ✓ | 1M | 32K |
-| `performance` | Performance | 1.10x | ✓ | ✗ | 1M | 32K |
-| `efficient` | Efficient | 0.30x | ✓ | ✗ | 180K | 32K |
-| `lite` | Lite | 0.00x | ✗ | ✗ | 180K | 32K |
-| `cmodel` | Cantus | 1.60x | ✓ | ✓ | 180K | 32K |
-| `qmodel_preview` | Qwen3.8-Max-Preview | 0.01x promo | ✓ | ✓ | 180K | 32K |
-| `qmodel_38max` | Qwen3.8-Max | 0.25x | ✓ | ✓ | 180K | 32K |
-| `qmodel_latest` | Qwen3.7-Max | 0.10x promo | ✓ | ✗ | 1M | 32K |
-| `qmodel` | Qwen3.7-Plus | 0.04x promo | ✓ | ✗ | 1M | 32K |
-| `kmodel_latest` | Kimi-K3 | 0.80x | ✓ | ✗ | 180K | 32K |
-| `kmodel` | Kimi-K2.7-Code | 0.30x | ✓ | ✗ | 256K | 32K |
-| `gm51model` | GLM-5.2 | 0.50x promo | ✓ | ✓ | 1M | 32K |
-| `dmodel` | DeepSeek-V4-Pro | 0.50x | ✓ | ✓ | 1M | 32K |
-| `dfmodel` | DeepSeek-V4-Flash | 0.10x | ✓ | ✓ | 1M | 32K |
-| `mmodel` | MiniMax-M3 | 0.20x | ✓ | ✗ | 1M | 32K |
-
-This table is a snapshot, not a hard-coded allowlist. Qoder can vary model
-availability by account, plan, CLI version, or staged rollout. Promotional
-multipliers are time-dependent; the SDK's current `priceFactor` is
-authoritative. Restart OpenCode to refresh the bridge's in-process model cache.
+SDK-version-dependent. A permanent allowlist is intentionally not embedded
+here because the catalog is account- and scene-dependent.
+
+The following is the current model snapshot returned by `qodercli --list-models`
+on 2026-08-30:
+
+| Model |
+|-------|
+| `Qwen3.8-Max` |
+| `Qwen3.8-Flash` |
+| `Qwen3.7-Max` |
+| `Qwen3.7-Plus` |
+
+This is an account-, region-, plan-, CLI-version-, and rollout-dependent
+snapshot. The CLI command reports display names only; the bridge's SDK catalog
+is authoritative for model IDs, capabilities, context limits, and pricing.
+Run `qodercli --list-models` and restart OpenCode to refresh the local view.
 
 Run `opencode models qoder` to inspect the models currently registered with
 OpenCode. The `qoder_models` tool also exposes capabilities, context limits,
@@ -172,7 +158,13 @@ Bridge opencode MCP servers into the SDK by passing provider options:
 }
 ```
 
+Flag names may be written with or without the leading `--`.
+
 `config.mcp` servers are bridged into the SDK's `mcpServers` automatically.
+Chat turns have a 30-minute bridge timeout by default; set `options.timeoutMs`
+to a positive value to use a shorter or longer bounded timeout (up to 24 hours).
+Values in `options.env` override inherited process variables rather than
+replacing the complete child environment.
 
 ### Persistent sessions and permissions
 
@@ -194,9 +186,15 @@ Session persistence is opt-in. Give a provider configuration a stable
 
 Mappings are stored in
 `~/.config/opencode-qoder-bridge/sessions.json` with restrictive file
-permissions. Use the `qoder_session_reset` tool to forget the mapping. A new
-session is created automatically if the mapping does not exist; existing
-sessions are resumed through the Qoder SDK.
+permissions and are scoped to the configured working directory. The plugin
+uses OpenCode's project directory when available; set `options.cwd` when
+loading the provider directly. Use the `qoder_session_reset` tool to forget
+the mapping. A new session is created automatically if the mapping does not
+exist; existing sessions are resumed through the Qoder SDK.
+
+Qoder-native and bridged MCP tools remain provider-owned. If OpenCode supplies
+a function with a colliding native name, the bridge derives a Qoder deny rule
+to avoid executing the same operation in both runtimes.
 
 The bridge uses the SDK's safer permission policy by default. To explicitly
 allow all Qoder tools in a trusted local environment, configure for example:
@@ -218,6 +216,80 @@ Available permission modes are `default`, `acceptEdits`, and
 `bypassPermissions`. Only explicitly configure `bypassPermissions` when the
 host environment is trusted.
 
+Image inputs may reference `file://`, `~/`, or absolute local paths. Only pass
+paths from trusted callers: the bridge bounds image size but does not sandbox
+or restrict readable local files to the project directory. A current turn is
+limited to 64 images and 40 MiB of decoded image data; excess attachments are
+reported as omitted text.
+
+### Plan Mode
+
+Plan Mode instructs Qoder to analyze and plan changes without modifying files
+or running action tools. It operates independently from tool permissions,
+preserving your configured `permissionMode`:
+
+```json
+{
+  "provider": {
+    "qoder": {
+      "options": {
+        "planMode": true
+      }
+    }
+  }
+}
+```
+
+Run `/qoder_plan_mode` in OpenCode for quick guidance.
+
+### Proxy & Network Routing
+
+Pass an outbound proxy URL directly to the Qoder runtime without mutating host
+environment variables (supports `http://`, `https://`, `socks5://`, and `socks://`):
+
+```json
+{
+  "provider": {
+    "qoder": {
+      "options": {
+        "proxy": "http://127.0.0.1:8888"
+      }
+    }
+  }
+}
+```
+
+If `proxy` is omitted, the bridge automatically falls back to `HTTPS_PROXY` or
+`HTTP_PROXY` from your environment.
+
+### Skill Evolution
+
+Enable autonomous turn-completion skill analysis and recommendations:
+
+```json
+{
+  "provider": {
+    "qoder": {
+      "options": {
+        "evolution": {
+          "skill": { "mode": "native" }
+        }
+      }
+    }
+  }
+}
+```
+
+### Available Tools
+
+The plugin registers several built-in OpenCode tools:
+
+- `qoder_usage` — Live account balance, quota percentages, and local cost ledger totals.
+- `qoder_models` — List known Qoder models, context limits, vision/reasoning flags, and multipliers.
+- `qoder_sessions` — List recent Qoder sessions, session IDs, branches, and timestamps via SDK `listSessions()`.
+- `qoder_session_reset` — Forget the persisted Qoder session mapping for the active project.
+- `qoder_plan_mode` — View Plan Mode status and configuration guidance.
+
 ## Troubleshooting
 
 | Problem | Solution |
@@ -225,15 +297,16 @@ host environment is trusted.
 | Auth prompt at startup | Run `qoder login`, then restart opencode |
 | `qodercli not found` | Authenticate with `qoder login` or set `QODER_PERSONAL_ACCESS_TOKEN`; the SDK can use its bundled runtime, while an installed CLI is preferred when available |
 | Model not found | Verify the model ID matches the table above |
-| Missing models in the model list | Run `/qoder_models`; the bridge refreshes the live catalog at every startup and falls back to the last cached catalog plus the built-ins (`lite`, `auto`, `performance`) when offline. If your account serves models in a different Qoder scene, set `QODER_SCENE` before launching opencode (or via provider option `env`) |
+| Missing models in the model list | Run `/qoder_models`; the bridge refreshes the live catalog at startup and falls back to the last cached catalog plus the built-ins (`lite`, `auto`, `performance`) when offline. If your account serves models in a different Qoder scene, set `QODER_SCENE` before launching opencode |
 
 ### How model discovery works
 
 At startup the bridge immediately exposes cached/built-in models, then
 refreshes the live catalog from Qoder (`fetchStrategy: "live"` — the CLI
 re-queries the server and falls back to its local cache if the server returns
-nothing). Discovered models override built-ins with the same ID; a failed
-refresh never removes previously known models.
+nothing). Each successful catalog snapshot replaces previously discovered
+dynamic IDs, so retired models do not remain selectable. A failed refresh
+keeps the last known catalog and the built-ins.
 
 ## Development
 

package/bin/statusline.mjs

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { readFileSync } from "node:fs";
+import { lstatSync, readFileSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 
@@ -8,20 +8,41 @@ import { join } from "node:path";
 function resolveStateDir(env = process.env) {
   const override = env.QODER_BRIDGE_STATE_DIR?.trim();
   if (override) return join(override);
-  const configHome = env.XDG_CONFIG_HOME?.trim();
+  const configHome = env.XDG_CONFIG_HOME?.trim()
+    || (process.platform === "win32" ? env.APPDATA?.trim() : undefined);
   return join(configHome || join(homedir(), ".config"), "opencode-qoder-bridge");
 }
 
 const STATE_FILE = join(resolveStateDir(), "usage.json");
+const MAX_STATE_BYTES = 1_000_000;
 
 function fmt(usd) {
-  return `$${(usd ?? 0).toFixed(4)}`;
+  const n = typeof usd === "number" && Number.isFinite(usd) ? usd : 0;
+  return `$${n.toFixed(4)}`;
+}
+
+function count(value) {
+  return typeof value === "number" && Number.isFinite(value) && value >= 0 ? value : 0;
+}
+
+function add(left, right) {
+  const total = left + right;
+  return Number.isFinite(total) ? total : Number.MAX_SAFE_INTEGER;
 }
 
 function main() {
   let state = null;
   try {
+    const info = lstatSync(STATE_FILE);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > MAX_STATE_BYTES) {
+      process.stdout.write("qoder: no usage yet");
+      return;
+    }
     state = JSON.parse(readFileSync(STATE_FILE, "utf8"));
+    if (!state || typeof state !== "object" || Array.isArray(state)) {
+      process.stdout.write("qoder: no usage yet");
+      return;
+    }
   } catch {
     process.stdout.write("qoder: no usage yet");
     return;
@@ -29,12 +50,15 @@ function main() {
 
   const parts = [
     `cost ${fmt(state.totalCostUsd)}`,
-    `turns ${state.turnCount ?? 0}`,
-    `tok ${(state.totalInputTokens ?? 0) + (state.totalOutputTokens ?? 0)}`,
+    `turns ${count(state.turnCount)}`,
+    `tok ${add(count(state.totalInputTokens), count(state.totalOutputTokens))}`,
   ];
 
   const last = Array.isArray(state.recent) ? state.recent.at(-1) : null;
-  if (last?.model) parts.push(`last ${last.model}`);
+  if (typeof last?.model === "string" && last.model) {
+    const model = last.model.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, 256);
+    parts.push(`last ${model}`);
+  }
 
   process.stdout.write(`qoder: ${parts.join(" · ")}`);
 }

package/bin/usage.mjs

@@ -1,6 +1,7 @@
 #!/usr/bin/env node
 import { getLiveUsage, formatUsageReport } from "../dist/usage.js";
 import { summarize, formatCost } from "../dist/cost.js";
+import { describeError } from "../dist/logger.js";
 
 async function main() {
   const lines = [];
@@ -14,11 +15,11 @@ async function main() {
   const summary = summarize();
   lines.push("");
   lines.push("Local Usage Ledger");
-  lines.push(`  Reference cost: ${formatCost(summary.totalCostUsd)}`);
-  lines.push(`  Turns: ${summary.turnCount}`);
-  lines.push(`  Tokens: ${summary.totalInputTokens} in / ${summary.totalOutputTokens} out`);
+  lines.push(`  Reference cost: ${formatCost(summary?.totalCostUsd ?? 0)}`);
+  lines.push(`  Turns: ${summary?.turnCount ?? 0}`);
+  lines.push(`  Tokens: ${summary?.totalInputTokens ?? 0} in / ${summary?.totalOutputTokens ?? 0} out`);
 
-  const models = Object.entries(summary.byModel);
+  const models = Object.entries(summary?.byModel ?? {});
   if (models.length > 0) {
     lines.push("  By model:");
     for (const [name, bucket] of models) {
@@ -30,6 +31,6 @@ async function main() {
 }
 
 main().catch((error) => {
-  process.stderr.write(`Unable to read Qoder usage: ${error instanceof Error ? error.message : String(error)}\n`);
+  process.stderr.write(`Unable to read Qoder usage: ${describeError(error)}\n`);
   process.exitCode = 1;
 });

package/dist/async-utils.d.ts

@@ -0,0 +1,8 @@
+/** Race SDK operations against a host-side deadline. Aborting the SDK is
+ * still the caller's responsibility; this helper guarantees the bridge does
+ * not wait forever for a non-cooperative promise. */
+export declare function withTimeout<T>(operation: PromiseLike<T>, timeoutMs: number, message: string): Promise<T>;
+export declare function closeAsyncIterator(iterator: {
+    return?: (value?: void | PromiseLike<void>) => PromiseLike<unknown> | unknown;
+}, timeoutMs: number): Promise<void>;
+//# sourceMappingURL=async-utils.d.ts.map

package/dist/async-utils.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-utils.d.ts","sourceRoot":"","sources":["../src/async-utils.ts"],"names":[],"mappings":"AAAA;;qDAEqD;AACrD,wBAAgB,WAAW,CAAC,CAAC,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CASxG;AAED,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE;IAAE,MAAM,CAAC,EAAE,CAAC,KAAK,CAAC,EAAE,IAAI,GAAG,WAAW,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,OAAO,CAAC,GAAG,OAAO,CAAA;CAAE,EAC3F,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,IAAI,CAAC,CAQf"}

package/dist/async-utils.js

@@ -0,0 +1,27 @@
+/** Race SDK operations against a host-side deadline. Aborting the SDK is
+ * still the caller's responsibility; this helper guarantees the bridge does
+ * not wait forever for a non-cooperative promise. */
+export function withTimeout(operation, timeoutMs, message) {
+    let timer;
+    const timeout = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(message)), timeoutMs);
+        if (typeof timer.unref === "function")
+            timer.unref();
+    });
+    return Promise.race([Promise.resolve(operation), timeout]).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+    });
+}
+export async function closeAsyncIterator(iterator, timeoutMs) {
+    if (typeof iterator.return !== "function")
+        return;
+    const closing = Promise.resolve().then(() => iterator.return?.(undefined)).then(() => undefined);
+    try {
+        await withTimeout(closing, timeoutMs, "SDK iterator cleanup timed out");
+    }
+    catch {
+        // Cleanup is best effort; the request's primary error remains authoritative.
+    }
+}
+//# sourceMappingURL=async-utils.js.map

package/dist/async-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"async-utils.js","sourceRoot":"","sources":["../src/async-utils.ts"],"names":[],"mappings":"AAAA;;qDAEqD;AACrD,MAAM,UAAU,WAAW,CAAI,SAAyB,EAAE,SAAiB,EAAE,OAAe;IAC1F,IAAI,KAAgD,CAAC;IACrD,MAAM,OAAO,GAAG,IAAI,OAAO,CAAQ,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE;QAC/C,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC;QAChE,IAAI,OAAO,KAAK,CAAC,KAAK,KAAK,UAAU;YAAE,KAAK,CAAC,KAAK,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;QACtE,IAAI,KAAK;YAAE,YAAY,CAAC,KAAK,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,QAA2F,EAC3F,SAAiB;IAEjB,IAAI,OAAO,QAAQ,CAAC,MAAM,KAAK,UAAU;QAAE,OAAO;IAClD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACjG,IAAI,CAAC;QACH,MAAM,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgC,CAAC,CAAC;IAC1E,CAAC;IAAC,MAAM,CAAC;QACP,6EAA6E;IAC/E,CAAC;AACH,CAAC"}

package/dist/auth.d.ts

@@ -7,5 +7,6 @@ export declare function isAuthenticated(): boolean;
  * Returns null when no separately installed CLI is found. The Qoder SDK can
  * still run through its bundled Worker runtime when credentials are present.
  */
-export declare function findQoderCLI(): string | null;
+export declare function findQoderCLI(force?: boolean): string | null;
+export declare function resetCachedCliPath(): void;
 //# sourceMappingURL=auth.d.ts.map

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AASA,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAuBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,IAAI,MAAM,GAAG,IAAI,CAI5C"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AASA,wBAAgB,eAAe,IAAI,OAAO,CAEzC;AAuBD;;;;;;;GAOG;AACH,wBAAgB,YAAY,CAAC,KAAK,UAAQ,GAAG,MAAM,GAAG,IAAI,CAIzD;AAED,wBAAgB,kBAAkB,IAAI,IAAI,CAEzC"}

package/dist/auth.js

@@ -38,12 +38,15 @@ let cachedCliPath;
  * Returns null when no separately installed CLI is found. The Qoder SDK can
  * still run through its bundled Worker runtime when credentials are present.
  */
-export function findQoderCLI() {
-    if (cachedCliPath !== undefined)
+export function findQoderCLI(force = false) {
+    if (!force && cachedCliPath !== undefined)
         return cachedCliPath;
     cachedCliPath = resolveCli();
     return cachedCliPath;
 }
+export function resetCachedCliPath() {
+    cachedCliPath = undefined;
+}
 function resolveCli() {
     const exe = process.platform === "win32" ? "qodercli.exe" : "qodercli";
     for (const dir of (process.env.PATH ?? "").split(delimiter)) {
@@ -58,12 +61,12 @@ function resolveCli() {
         return local;
     const binDir = join(homedir(), ".qoder", "bin", "qodercli");
     try {
-        const latest = readdirSync(binDir)
+        const versions = readdirSync(binDir)
             .filter((f) => f.startsWith("qodercli-"))
-            .sort()
-            .at(-1);
-        if (latest) {
-            const p = join(binDir, latest);
+            .sort(compareCliVersions)
+            .reverse();
+        for (const version of versions) {
+            const p = join(binDir, version);
             if (isExecutableFile(p))
                 return p;
         }
@@ -73,4 +76,20 @@ function resolveCli() {
     }
     return null;
 }
+function compareCliVersions(left, right) {
+    const leftParts = left.slice("qodercli-".length).split(/[.-]/);
+    const rightParts = right.slice("qodercli-".length).split(/[.-]/);
+    const length = Math.max(leftParts.length, rightParts.length);
+    for (let i = 0; i < length; i++) {
+        const a = leftParts[i] ?? "";
+        const b = rightParts[i] ?? "";
+        const aNumber = /^\d+$/.test(a) ? Number(a) : NaN;
+        const bNumber = /^\d+$/.test(b) ? Number(b) : NaN;
+        if (Number.isFinite(aNumber) && Number.isFinite(bNumber) && aNumber !== bNumber)
+            return aNumber - bNumber;
+        if (a !== b)
+            return a.localeCompare(b);
+    }
+    return left.localeCompare(right);
+}
 //# sourceMappingURL=auth.js.map

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,UAAU,GAAG;IACjB,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,aAAwC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IACtD,aAAa,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAEvE,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,WAAW,CAAC,MAAM,CAAC;aAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aACxC,IAAI,EAAE;aACN,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACV,IAAI,MAAM,EAAE,CAAC;YACX,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;YAC/B,IAAI,gBAAgB,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACvE,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE5C,MAAM,UAAU,GAAG;IACjB,IAAI,CAAC,OAAO,EAAE,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,CAAC;IAC9C,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,CAAC;CAC3C,CAAC;AAEF,MAAM,UAAU,eAAe;IAC7B,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;AAClD,CAAC;AAED,SAAS,aAAa,CAAC,CAAS;IAC9B,IAAI,CAAC;QACH,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,CAAS;IACjC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACpC,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC9C,IAAI,CAAC;QACH,UAAU,CAAC,CAAC,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QAC9B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,IAAI,aAAwC,CAAC;AAE7C;;;;;;;GAOG;AACH,MAAM,UAAU,YAAY,CAAC,KAAK,GAAG,KAAK;IACxC,IAAI,CAAC,KAAK,IAAI,aAAa,KAAK,SAAS;QAAE,OAAO,aAAa,CAAC;IAChE,aAAa,GAAG,UAAU,EAAE,CAAC;IAC7B,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,SAAS,CAAC;AAC5B,CAAC;AAED,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,UAAU,CAAC;IAEvE,KAAK,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5D,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QACzB,IAAI,gBAAgB,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtD,IAAI,gBAAgB,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC,CAAC;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM,CAAC;aACjC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC;aACxC,IAAI,CAAC,kBAAkB,CAAC;aACxB,OAAO,EAAE,CAAC;QACb,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;YAC/B,MAAM,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;YAChC,IAAI,gBAAgB,CAAC,CAAC,CAAC;gBAAE,OAAO,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,mBAAmB;IACrB,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAY,EAAE,KAAa;IACrD,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC/D,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACjE,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,MAAM,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;IAC7D,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAChC,MAAM,CAAC,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,MAAM,OAAO,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAClD,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,KAAK,OAAO;YAAE,OAAO,OAAO,GAAG,OAAO,CAAC;QAC1G,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC;IACzC,CAAC;IACD,OAAO,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;AACnC,CAAC"}

package/dist/cost.d.ts

@@ -23,9 +23,10 @@ interface PersistedState {
     }>;
     recent: TurnCost[];
 }
+export declare function flushLedgerSync(): void;
 export interface RecordInput {
     model: string;
-    usage: {
+    usage?: {
         input_tokens?: number | null;
         output_tokens?: number | null;
         cache_read_input_tokens?: number | null;

package/dist/cost.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAS5D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAqJD,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE;QACL,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACzC;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CA+BvD;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,wBAAgB,SAAS,IAAI,YAAY,CAUxC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAGlC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C"}
+{"version":3,"file":"cost.d.ts","sourceRoot":"","sources":["../src/cost.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,2BAA2B,CAAC;AAa5D,MAAM,WAAW,QAAQ;IACvB,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,UAAU,cAAc;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACvG,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAoND,wBAAgB,eAAe,IAAI,IAAI,CAOtC;AAED,MAAM,WAAW,WAAW;IAC1B,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE;QACN,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC7B,aAAa,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,uBAAuB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;QACxC,2BAA2B,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;KAC7C,CAAC;IACF,OAAO,EAAE,MAAM,CAAC;IAChB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;CACzC;AAED,0DAA0D;AAC1D,wBAAgB,UAAU,CAAC,KAAK,EAAE,WAAW,GAAG,QAAQ,CAoBvD;AAED,MAAM,WAAW,YAAY;IAC3B,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,EAAE,MAAM,CAAC;IACzB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,cAAc,CAAC,SAAS,CAAC,CAAC;IACnC,MAAM,EAAE,QAAQ,EAAE,CAAC;CACpB;AAED,wBAAgB,SAAS,IAAI,YAAY,CAUxC;AAED,wBAAgB,WAAW,IAAI,IAAI,CAKlC;AAED,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE9C"}