reasonix 0.4.15 → 0.4.17

package/dist/cli/{prompt-MMANQ36Z.js → prompt-HK5XLH55.js}

@@ -2,9 +2,9 @@
 import {
   CODE_SYSTEM_PROMPT,
   codeSystemPrompt
-} from "./chunk-2P2MZLCE.js";
+} from "./chunk-3YQRWFES.js";
 export {
   CODE_SYSTEM_PROMPT,
   codeSystemPrompt
 };
-//# sourceMappingURL=prompt-MMANQ36Z.js.map
+//# sourceMappingURL=prompt-HK5XLH55.js.map

package/dist/index.d.ts

@@ -718,6 +718,61 @@ declare function healLoadedMessages(messages: ChatMessage[], maxChars: number):
  */
 declare function formatLoopError(err: Error): string;
 
+/**
+ * Project memory — a user-authored `REASONIX.md` in the project root
+ * that gets pinned into the immutable-prefix system prompt.
+ *
+ * Design notes:
+ *
+ *   - The file lands in `ImmutablePrefix.system`, so the whole memory
+ *     block is hashed into the cache prefix fingerprint. Editing the
+ *     file invalidates the prefix; unchanged memory across sessions
+ *     keeps the DeepSeek prefix cache warm. That matches Pillar 1 —
+ *     memory is a deliberate, stable prefix, not per-turn drift.
+ *   - Only one source: the working-root `REASONIX.md`. No parent walk,
+ *     no `~/.reasonix/REASONIX.md`, no CLAUDE.md fallback. User-global
+ *     memory can come later; for v1 one file == one mental model.
+ *   - Truncated at 8 000 chars (≈ 2k tokens). `.gitignore` gets 2 000
+ *     because it's a constraint dump; memory gets more headroom because
+ *     it's deliberate instructions.
+ *   - Opt-out via `REASONIX_MEMORY=off|false|0`. No CLI flag — memory
+ *     is a file, `rm REASONIX.md` is the other opt-out.
+ */
+declare const PROJECT_MEMORY_FILE = "REASONIX.md";
+declare const PROJECT_MEMORY_MAX_CHARS = 8000;
+interface ProjectMemory {
+    /** Absolute path the memory was read from. */
+    path: string;
+    /** Post-truncation content (may include a "… (truncated N chars)" marker). */
+    content: string;
+    /** Original byte length before truncation. */
+    originalChars: number;
+    /** True iff `originalChars > PROJECT_MEMORY_MAX_CHARS`. */
+    truncated: boolean;
+}
+/**
+ * Read `REASONIX.md` from `rootDir`. Returns `null` when the file is
+ * missing, unreadable, or empty (whitespace-only counts as empty — an
+ * empty memory file shouldn't perturb the cache prefix).
+ */
+declare function readProjectMemory(rootDir: string): ProjectMemory | null;
+/**
+ * Resolve whether project memory should be read. Default: on.
+ * `REASONIX_MEMORY=off|false|0` turns it off (CI, reproducing issues,
+ * intentional offline runs).
+ */
+declare function memoryEnabled(): boolean;
+/**
+ * Return `basePrompt` with the project's `REASONIX.md` appended as a
+ * "Project memory" section. No-op when the file is absent, empty, or
+ * memory is disabled via env.
+ *
+ * The appended block is deterministic — identical input ⇒ identical
+ * output — so every session that opens against the same memory file
+ * gets the same prefix hash.
+ */
+declare function applyProjectMemory(basePrompt: string, rootDir: string): string;
+
 /**
  * Built-in filesystem tools for `reasonix code`.
  *
@@ -762,6 +817,91 @@ interface FilesystemToolsOptions {
 }
 declare function registerFilesystemTools(registry: ToolRegistry, opts: FilesystemToolsOptions): ToolRegistry;
 
+/**
+ * Native shell tool — lets the model run commands inside the sandbox
+ * root so it can actually verify its own work (run tests, check git
+ * status, inspect a lockfile, etc.). Without this the coding-mode
+ * loop is "write code, hope it works, ask the user to run it" —
+ * defeats the purpose.
+ *
+ * Safety model:
+ *   - Commands run with `cwd` pinned to the registered root. No
+ *     path traversal via the command itself is enforced (users can
+ *     `cat ../outside.txt`); the trust boundary is the directory
+ *     you opened Reasonix from.
+ *   - Commands are matched against a read-only / testing allowlist.
+ *     Allowlisted commands execute immediately and return stdout +
+ *     stderr merged. Everything else throws with a clear message —
+ *     the UI translates that into an `/apply`-style confirm gate so
+ *     the user sees the exact command before it runs.
+ *   - Default timeout: 60s. Output cap: matches tool-result budget.
+ *   - Every command that DOES run is spawned with `shell: false` and
+ *     a tokenized argv — no string-to-shell interpolation, so the
+ *     model can't accidentally construct a chained `rm` via quoting.
+ *
+ * This is intentionally narrower than what Claude Code / Aider ship:
+ * we gate more commands behind confirmation by default. Users who
+ * trust the model can widen the allowlist by instantiating their
+ * own tool registry.
+ */
+
+interface ShellToolsOptions {
+    /** Directory to run commands in. Must be an absolute path. */
+    rootDir: string;
+    /** Seconds before an individual command is killed. Default: 60. */
+    timeoutSec?: number;
+    /**
+     * Per-command stdout+stderr cap in characters. Default: 32_000 to
+     * match the tool-result budget.
+     */
+    maxOutputChars?: number;
+    /**
+     * Extra command-name prefixes the user explicitly trusts. Added on
+     * top of the built-in allowlist. Examples: `["my-ci-script", "lint"]`.
+     */
+    extraAllowed?: string[];
+    /**
+     * When true, skip the allowlist entirely and auto-run every command.
+     * Off by default — this is an escape hatch for non-interactive use
+     * (CI, benchmarks) where a human can't be in the loop to confirm.
+     */
+    allowAll?: boolean;
+}
+/**
+ * Tokenize a shell-ish command string into argv. Handles single/double
+ * quoting; rejects unclosed quotes. Does NOT expand env vars, globs,
+ * backticks, or `$(…)` — the goal is to prevent the model from
+ * accidentally (or not) sneaking arbitrary shells past the allowlist
+ * via concatenation. Exported for testing.
+ */
+declare function tokenizeCommand(cmd: string): string[];
+/**
+ * Return true when `cmd` matches an allowlisted prefix. Exported for
+ * testing. Match is on the space-normalized leading tokens so
+ * `git   status  -s ` and `git status` both match `git status`.
+ */
+declare function isAllowed(cmd: string, extra?: readonly string[]): boolean;
+interface RunCommandResult {
+    exitCode: number | null;
+    /** Combined stdout+stderr, truncated to `maxOutputChars` with a marker. */
+    output: string;
+    /** True when the process was killed for exceeding `timeoutSec`. */
+    timedOut: boolean;
+}
+declare function runCommand(cmd: string, opts: {
+    cwd: string;
+    timeoutSec?: number;
+    maxOutputChars?: number;
+    signal?: AbortSignal;
+}): Promise<RunCommandResult>;
+/** Error thrown by `run_command` when the command isn't allowlisted. */
+declare class NeedsConfirmationError extends Error {
+    readonly command: string;
+    constructor(command: string);
+}
+declare function registerShellTools(registry: ToolRegistry, opts: ShellToolsOptions): ToolRegistry;
+declare function formatCommandResult(cmd: string, r: RunCommandResult): string;
+
 /**
  * Built-in web search + fetch tools.
  *
@@ -1794,7 +1934,8 @@ declare const CODE_SYSTEM_PROMPT = "You are Reasonix Code, a coding assistant. Y
  * the file — we hand it to the model as-is. Truncate long ones so we
  * don't eat context budget on huge generated ignore lists.
  *
- * Missing or unreadable .gitignore → returns the base prompt unchanged.
+ * Stacking order (stable for cache prefix):
+ *   base prompt → project memory (REASONIX.md) → .gitignore block
  */
 declare function codeSystemPrompt(rootDir: string): string;
 
@@ -1844,6 +1985,17 @@ interface ReasonixConfig {
      * endpoint). Set to `false` to keep the session offline.
      */
     search?: boolean;
+    /**
+     * Per-project state keyed by absolute directory path. Written by the
+     * "always allow" choice on a shell confirmation prompt; merged into
+     * `registerShellTools({ extraAllowed })` when `reasonix code` runs
+     * against that directory again.
+     */
+    projects?: {
+        [absoluteRootDir: string]: {
+            shellAllowed?: string[];
+        };
+    };
 }
 declare function defaultConfigPath(): string;
 declare function readConfig(path?: string): ReasonixConfig;
@@ -1857,6 +2009,6 @@ declare function redactKey(key: string): string;
 
 /** Reasonix — DeepSeek-native agent framework. Library entry point. */
 
-declare const VERSION = "0.4.15";
+declare const VERSION = "0.4.17";
 
-export { AppendOnlyLog, type ApplyResult, type ApplyStatus, type BranchOptions, type BranchProgress, type BranchResult, type BranchSample, type BranchSelector, type BranchSummary, type BridgeOptions, type BridgeResult, CODE_SYSTEM_PROMPT, CacheFirstLoop, type CacheFirstLoopOptions, type CallToolResult, type ChatMessage, type ChatResponse, DEFAULT_MAX_RESULT_CHARS, DeepSeekClient, type DeepSeekClientOptions, type RenderOptions as DiffRenderOptions, type DiffReport, type DiffSide, type EditBlock, type EditSnapshot, type EventRole, type FilesystemToolsOptions, type FlattenDecision, type FlattenOptions, type GetPromptResult, type HarvestOptions, ImmutablePrefix, type ImmutablePrefixOptions, type InitializeResult, type InspectionReport, type JSONSchema, type JsonRpcMessage, type JsonRpcRequest, type JsonRpcResponse, type ListPromptsResult, type ListResourcesResult, type ListToolsResult, type LoopEvent, MCP_PROTOCOL_VERSION, McpClient, type McpClientOptions, type McpContentBlock, type McpProgressHandler, type McpProgressInfo, type McpPrompt, type McpPromptArgument, type McpPromptMessage, type McpPromptResourceBlock, type McpResource, type McpResourceContents, type McpResourceContentsBlob, type McpResourceContentsText, type McpSpec, type McpTool, type McpToolSchema, type McpTransport, type PageContent, type ProgressNotificationParams, type ReadResourceResult, type ReadTranscriptResult, type ReasonixConfig, type ReconfigurableOptions, type RepairReport, type ReplayStats, type RetryInfo, type RetryOptions, type Role, type ScavengeOptions, type ScavengeResult, type SearchResult, type SectionResult, type SessionInfo, SessionStats, type SessionSummary, type SseMcpSpec, SseTransport, type SseTransportOptions, type StdioMcpSpec, StdioTransport, type StdioTransportOptions, StormBreaker, type StreamChunk, type ToolCall, type ToolCallContext, ToolCallRepair, type ToolCallRepairOptions, type ToolDefinition, type ToolFunctionSpec, ToolRegistry, type ToolSpec, type TranscriptMeta, type TranscriptRecord, type TruncationRepairResult, type TurnPair, type TurnStats, type TypedPlanState, Usage, VERSION, VolatileScratch, type WebFetchOptions, type WebSearchOptions, type WebToolsOptions, aggregateBranchUsage, analyzeSchema, appendSessionMessage, applyEditBlock, applyEditBlocks, bridgeMcpTools, claudeEquivalentCost, codeSystemPrompt, computeReplayStats, costUsd, defaultConfigPath, defaultSelector, deleteSession, diffTranscripts, emptyPlanState, fetchWithRetry, flattenMcpResult, flattenSchema, formatLoopError, formatSearchResults, harvest, healLoadedMessages, htmlToText, inputCostUsd, inspectMcpServer, isJsonRpcError, isPlanStateEmpty, isPlausibleKey, listSessions, loadApiKey, loadDotenv, loadSessionMessages, nestArguments, openTranscriptFile, outputCostUsd, parseEditBlocks, parseMcpSpec, parseMojeekResults, parseTranscript, readConfig, readTranscript, recordFromLoopEvent, redactKey, registerFilesystemTools, registerWebTools, renderMarkdown as renderDiffMarkdown, renderSummaryTable as renderDiffSummary, repairTruncatedJson, replayFromFile, restoreSnapshots, runBranches, sanitizeName as sanitizeSessionName, saveApiKey, scavengeToolCalls, sessionPath, sessionsDir, similarity, snapshotBeforeEdits, stripHallucinatedToolMarkup, truncateForModel, webFetch, webSearch, writeConfig, writeMeta, writeRecord };
+export { AppendOnlyLog, type ApplyResult, type ApplyStatus, type BranchOptions, type BranchProgress, type BranchResult, type BranchSample, type BranchSelector, type BranchSummary, type BridgeOptions, type BridgeResult, CODE_SYSTEM_PROMPT, CacheFirstLoop, type CacheFirstLoopOptions, type CallToolResult, type ChatMessage, type ChatResponse, DEFAULT_MAX_RESULT_CHARS, DeepSeekClient, type DeepSeekClientOptions, type RenderOptions as DiffRenderOptions, type DiffReport, type DiffSide, type EditBlock, type EditSnapshot, type EventRole, type FilesystemToolsOptions, type FlattenDecision, type FlattenOptions, type GetPromptResult, type HarvestOptions, ImmutablePrefix, type ImmutablePrefixOptions, type InitializeResult, type InspectionReport, type JSONSchema, type JsonRpcMessage, type JsonRpcRequest, type JsonRpcResponse, type ListPromptsResult, type ListResourcesResult, type ListToolsResult, type LoopEvent, MCP_PROTOCOL_VERSION, McpClient, type McpClientOptions, type McpContentBlock, type McpProgressHandler, type McpProgressInfo, type McpPrompt, type McpPromptArgument, type McpPromptMessage, type McpPromptResourceBlock, type McpResource, type McpResourceContents, type McpResourceContentsBlob, type McpResourceContentsText, type McpSpec, type McpTool, type McpToolSchema, type McpTransport, NeedsConfirmationError, PROJECT_MEMORY_FILE, PROJECT_MEMORY_MAX_CHARS, type PageContent, type ProgressNotificationParams, type ProjectMemory, type ReadResourceResult, type ReadTranscriptResult, type ReasonixConfig, type ReconfigurableOptions, type RepairReport, type ReplayStats, type RetryInfo, type RetryOptions, type Role, type RunCommandResult, type ScavengeOptions, type ScavengeResult, type SearchResult, type SectionResult, type SessionInfo, SessionStats, type SessionSummary, type ShellToolsOptions, type SseMcpSpec, SseTransport, type SseTransportOptions, type StdioMcpSpec, StdioTransport, type StdioTransportOptions, StormBreaker, type StreamChunk, type ToolCall, type ToolCallContext, ToolCallRepair, type ToolCallRepairOptions, type ToolDefinition, type ToolFunctionSpec, ToolRegistry, type ToolSpec, type TranscriptMeta, type TranscriptRecord, type TruncationRepairResult, type TurnPair, type TurnStats, type TypedPlanState, Usage, VERSION, VolatileScratch, type WebFetchOptions, type WebSearchOptions, type WebToolsOptions, aggregateBranchUsage, analyzeSchema, appendSessionMessage, applyEditBlock, applyEditBlocks, applyProjectMemory, bridgeMcpTools, claudeEquivalentCost, codeSystemPrompt, computeReplayStats, costUsd, defaultConfigPath, defaultSelector, deleteSession, diffTranscripts, emptyPlanState, fetchWithRetry, flattenMcpResult, flattenSchema, formatCommandResult, formatLoopError, formatSearchResults, harvest, healLoadedMessages, htmlToText, inputCostUsd, inspectMcpServer, isAllowed, isJsonRpcError, isPlanStateEmpty, isPlausibleKey, listSessions, loadApiKey, loadDotenv, loadSessionMessages, memoryEnabled, nestArguments, openTranscriptFile, outputCostUsd, parseEditBlocks, parseMcpSpec, parseMojeekResults, parseTranscript, readConfig, readProjectMemory, readTranscript, recordFromLoopEvent, redactKey, registerFilesystemTools, registerShellTools, registerWebTools, renderMarkdown as renderDiffMarkdown, renderSummaryTable as renderDiffSummary, repairTruncatedJson, replayFromFile, restoreSnapshots, runBranches, runCommand, sanitizeName as sanitizeSessionName, saveApiKey, scavengeToolCalls, sessionPath, sessionsDir, similarity, snapshotBeforeEdits, stripHallucinatedToolMarkup, tokenizeCommand, truncateForModel, webFetch, webSearch, writeConfig, writeMeta, writeRecord };