reasonix 0.4.17 → 0.4.19

package/dist/index.js

@@ -499,9 +499,25 @@ function setByPath(target, path, value) {
 var ToolRegistry = class {
   _tools = /* @__PURE__ */ new Map();
   _autoFlatten;
+  /**
+   * When true, `dispatch` refuses any tool whose `readOnly` flag isn't
+   * set (and whose `readOnlyCheck` doesn't pass on the specific args).
+   * Drives `reasonix code`'s Plan Mode — the model can still explore
+   * via read tools but its writes and non-allowlisted shell calls are
+   * bounced until the user approves a submitted plan.
+   */
+  _planMode = false;
   constructor(opts = {}) {
     this._autoFlatten = opts.autoFlatten !== false;
   }
+  /** Enable / disable plan-mode enforcement at dispatch. */
+  setPlanMode(on) {
+    this._planMode = Boolean(on);
+  }
+  /** True when the registry is currently refusing non-readonly calls. */
+  get planMode() {
+    return this._planMode;
+  }
   register(def) {
     if (!def.name) throw new Error("tool requires a name");
     const internal = { ...def };
@@ -553,16 +569,38 @@ var ToolRegistry = class {
     if (tool.flatSchema && args && typeof args === "object" && hasDotKey(args)) {
       args = nestArguments(args);
     }
+    if (this._planMode && !isReadOnlyCall(tool, args)) {
+      return JSON.stringify({
+        error: `${name}: unavailable in plan mode \u2014 this is a read-only exploration phase. Use read_file / list_directory / search_files / directory_tree / web_search / allowlisted shell commands to investigate. Call submit_plan with your proposed plan when you're ready for the user's review.`
+      });
+    }
     try {
       const result = await tool.fn(args, { signal: opts.signal });
       return typeof result === "string" ? result : JSON.stringify(result);
     } catch (err) {
+      const e = err;
+      if (typeof e.toToolResult === "function") {
+        try {
+          return JSON.stringify(e.toToolResult());
+        } catch {
+        }
+      }
       return JSON.stringify({
-        error: `${err.name}: ${err.message}`
+        error: `${e.name}: ${e.message}`
       });
     }
   }
 };
+function isReadOnlyCall(tool, args) {
+  if (tool.readOnlyCheck) {
+    try {
+      return Boolean(tool.readOnlyCheck(args));
+    } catch {
+      return false;
+    }
+  }
+  return tool.readOnly === true;
+}
 function hasDotKey(obj) {
   for (const k of Object.keys(obj)) {
     if (k.includes(".")) return true;
@@ -949,6 +987,16 @@ var ToolCallRepair = class {
     this.opts = opts;
     this.storm = new StormBreaker(opts.stormWindow ?? 6, opts.stormThreshold ?? 3);
   }
+  /**
+   * Drop the StormBreaker's sliding window of recent (name, args)
+   * signatures. Called at the start of every user turn — a fresh user
+   * message is a new intent, so carrying old repetition state into it
+   * would turn a valid "try again with different input" flow into a
+   * false-positive block.
+   */
+  resetStorm() {
+    this.storm.reset();
+  }
   process(declaredCalls, reasoningContent, content = null) {
     const report = {
       scavenged: 0,
@@ -1401,6 +1449,7 @@ var CacheFirstLoop = class {
   async *step(userInput) {
     this._turn++;
     this.scratch.reset();
+    this.repair.resetStorm();
     this._turnAbort = new AbortController();
     const signal = this._turnAbort.signal;
     let pendingUser = userInput;
@@ -1624,6 +1673,16 @@ var CacheFirstLoop = class {
         repair: report,
         branch: branchSummary
       };
+      if (report.stormsBroken > 0) {
+        const noteTail = report.notes.length ? ` \u2014 ${report.notes[report.notes.length - 1]}` : "";
+        const allSuppressed = repairedCalls.length === 0 && toolCalls.length > 0;
+        const phrase = allSuppressed ? `stopped the model from calling the same tool with identical args repeatedly (all ${toolCalls.length} call(s) this turn were already in the recent-repeat window). Likely a stuck retry \u2014 reword your instruction, rule out the underlying blocker, or try /retry after fixing it` : `suppressed ${report.stormsBroken} repeat tool call(s) that had fired 3+ times with identical args in a sliding window`;
+        yield {
+          turn: this._turn,
+          role: "warning",
+          content: `${phrase}${noteTail}`
+        };
+      }
       if (repairedCalls.length === 0) {
         yield { turn: this._turn, role: "done", content: assistantContent };
         return;
@@ -1916,6 +1975,7 @@ function registerFilesystemTools(registry, opts) {
   registry.register({
     name: "read_file",
     description: "Read a file under the sandbox root. Returns the full contents (truncated with a notice if larger than the per-call cap). Paths may be relative to the root or absolute-under-root.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -1953,6 +2013,7 @@ function registerFilesystemTools(registry, opts) {
   registry.register({
     name: "list_directory",
     description: "List entries in a directory under the sandbox root. Returns one line per entry, marking directories with a trailing slash. Not recursive \u2014 use directory_tree for that.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -1972,6 +2033,7 @@ function registerFilesystemTools(registry, opts) {
   registry.register({
     name: "directory_tree",
     description: "Recursively list entries in a directory. Shows indented tree structure with directories marked '/'. Caps output so a huge tree doesn't drown the context.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -2018,6 +2080,7 @@ function registerFilesystemTools(registry, opts) {
   registry.register({
     name: "search_files",
     description: "Find files whose NAME matches a substring or regex. Case-insensitive. Walks the directory recursively under the sandbox root. Returns one path per line.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -2070,6 +2133,7 @@ function registerFilesystemTools(registry, opts) {
   registry.register({
     name: "get_file_info",
     description: "Stat a path under the sandbox root. Returns type (file|directory|symlink), size in bytes, mtime in ISO-8601.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -2226,8 +2290,54 @@ function lineDiff(a, b) {
   return out;
 }
 
+// src/tools/plan.ts
+var PlanProposedError = class extends Error {
+  plan;
+  constructor(plan) {
+    super(
+      "PlanProposedError: plan submitted. STOP calling tools now \u2014 the TUI has shown the plan to the user. Wait for their next message; it will either approve (you'll then implement the plan), request a refinement (you should explore more and submit an updated plan), or cancel (drop the plan and ask what they want instead). Don't call any tools in the meantime."
+    );
+    this.name = "PlanProposedError";
+    this.plan = plan;
+  }
+  /**
+   * Structured tool-result shape. Consumed by the TUI to extract the
+   * plan without regex-scraping the error message.
+   */
+  toToolResult() {
+    return { error: `${this.name}: ${this.message}`, plan: this.plan };
+  }
+};
+function registerPlanTool(registry, opts = {}) {
+  registry.register({
+    name: "submit_plan",
+    description: "Submit a concrete plan to the user for review before executing. Use this for tasks that warrant a review gate \u2014 multi-file refactors, architecture changes, anything that would be expensive or confusing to undo. Skip it for small fixes (one-line typo, obvious bug with a clear fix) \u2014 just make the change. The user will either approve (you then implement it), ask for refinement, or cancel. If the user has already enabled /plan mode, writes are blocked at dispatch and you MUST use this. Write the plan as markdown with a one-line summary, a bulleted list of files to touch and what will change, and any risks or open questions.",
+    readOnly: true,
+    parameters: {
+      type: "object",
+      properties: {
+        plan: {
+          type: "string",
+          description: "Markdown-formatted plan. Lead with a one-sentence summary. Then a file-by-file breakdown of what you'll change and why. Flag any risks or open questions at the end so the user can weigh in before you start."
+        }
+      },
+      required: ["plan"]
+    },
+    fn: async (args) => {
+      const plan = (args?.plan ?? "").trim();
+      if (!plan) {
+        throw new Error("submit_plan: empty plan \u2014 write a markdown plan and try again.");
+      }
+      opts.onPlanSubmitted?.(plan);
+      throw new PlanProposedError(plan);
+    }
+  });
+  return registry;
+}
+
 // src/tools/shell.ts
 import { spawn } from "child_process";
+import { existsSync as existsSync3, statSync as statSync2 } from "fs";
 import * as pathMod2 from "path";
 var DEFAULT_TIMEOUT_SEC = 60;
 var DEFAULT_MAX_OUTPUT_CHARS = 32e3;
@@ -2345,10 +2455,12 @@ async function runCommand(cmd, opts) {
     windowsHide: true,
     env: process.env
   };
+  const { bin, args, spawnOverrides } = prepareSpawn(argv);
+  const effectiveSpawnOpts = { ...spawnOpts, ...spawnOverrides };
   return await new Promise((resolve5, reject) => {
     let child;
     try {
-      child = spawn(argv[0], argv.slice(1), spawnOpts);
+      child = spawn(bin, args, effectiveSpawnOpts);
     } catch (err) {
       reject(err);
       return;
@@ -2382,6 +2494,59 @@ async function runCommand(cmd, opts) {
     });
   });
 }
+function resolveExecutable(cmd, opts = {}) {
+  const platform = opts.platform ?? process.platform;
+  if (platform !== "win32") return cmd;
+  if (!cmd) return cmd;
+  if (cmd.includes("/") || cmd.includes("\\") || pathMod2.isAbsolute(cmd)) return cmd;
+  if (pathMod2.extname(cmd)) return cmd;
+  const env = opts.env ?? process.env;
+  const pathExt = (env.PATHEXT ?? ".COM;.EXE;.BAT;.CMD").split(";").map((e) => e.trim()).filter(Boolean);
+  const delimiter2 = opts.pathDelimiter ?? (platform === "win32" ? ";" : pathMod2.delimiter);
+  const pathDirs = (env.PATH ?? "").split(delimiter2).filter(Boolean);
+  const isFile = opts.isFile ?? defaultIsFile;
+  for (const dir of pathDirs) {
+    for (const ext of pathExt) {
+      const full = pathMod2.join(dir, cmd + ext);
+      if (isFile(full)) return full;
+    }
+  }
+  return cmd;
+}
+function defaultIsFile(full) {
+  try {
+    return existsSync3(full) && statSync2(full).isFile();
+  } catch {
+    return false;
+  }
+}
+function prepareSpawn(argv, opts = {}) {
+  const head = argv[0] ?? "";
+  const tail = argv.slice(1);
+  const platform = opts.platform ?? process.platform;
+  const resolved = resolveExecutable(head, opts);
+  if (platform !== "win32") {
+    return { bin: resolved, args: [...tail], spawnOverrides: {} };
+  }
+  if (/\.(cmd|bat)$/i.test(resolved)) {
+    const cmdline = [resolved, ...tail].map(quoteForCmdExe).join(" ");
+    return {
+      bin: "cmd.exe",
+      args: ["/d", "/s", "/c", cmdline],
+      // windowsVerbatimArguments prevents Node from re-quoting the /c
+      // payload — we've already composed an exact cmd.exe command
+      // line. Without this Node wraps our already-quoted string in
+      // another round of quotes and cmd.exe can't parse it.
+      spawnOverrides: { windowsVerbatimArguments: true }
+    };
+  }
+  return { bin: resolved, args: [...tail], spawnOverrides: {} };
+}
+function quoteForCmdExe(arg) {
+  if (arg === "") return '""';
+  if (!/[\s"&|<>^%(),;!]/.test(arg)) return arg;
+  return `"${arg.replace(/"/g, '""')}"`;
+}
 var NeedsConfirmationError = class extends Error {
   command;
   constructor(command) {
@@ -2401,6 +2566,16 @@ function registerShellTools(registry, opts) {
   registry.register({
     name: "run_command",
     description: "Run a shell command in the project root and return its combined stdout+stderr. Read-only and test commands (git status, ls, npm test, pytest, cargo test, grep, etc.) run immediately. Anything that could mutate state (npm install, git commit, rm, chmod) is refused and the user has to confirm in the TUI. Prefer this over asking the user to run a command manually \u2014 after edits, run the project's tests to verify.",
+    // Plan-mode gate: allow allowlisted commands through (git status,
+    // cargo check, ls, grep …) so the model can actually investigate
+    // during planning. Anything that would otherwise trigger a
+    // confirmation prompt is treated as "not read-only" and bounced.
+    readOnlyCheck: (args) => {
+      if (allowAll) return true;
+      const cmd = typeof args?.command === "string" ? args.command.trim() : "";
+      if (!cmd) return false;
+      return isAllowed(cmd, extraAllowed);
+    },
     parameters: {
       type: "object",
       properties: {
@@ -2567,6 +2742,7 @@ function registerWebTools(registry, opts = {}) {
   registry.register({
     name: "web_search",
     description: "Search the public web. Returns ranked results with title, url, and snippet. Use this when the question needs information more current than your training data, when you're unsure of a factual detail, or when the user asks about a specific webpage/library/release you haven't seen.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -2589,6 +2765,7 @@ function registerWebTools(registry, opts = {}) {
   registry.register({
     name: "web_fetch",
     description: "Download a URL and return its visible text content (HTML pages get scripts/styles/nav stripped). Truncated at the tool-result cap. Use after web_search when a snippet isn't enough.",
+    readOnly: true,
     parameters: {
       type: "object",
       properties: {
@@ -3753,7 +3930,7 @@ async function trySection(load) {
 }
 
 // src/code/edit-blocks.ts
-import { existsSync as existsSync3, mkdirSync as mkdirSync2, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
+import { existsSync as existsSync4, mkdirSync as mkdirSync2, readFileSync as readFileSync5, unlinkSync as unlinkSync2, writeFileSync as writeFileSync2 } from "fs";
 import { dirname as dirname3, resolve as resolve4 } from "path";
 var BLOCK_RE = /^(\S[^\n]*)\n<{7} SEARCH\n([\s\S]*?)\n?={7}\n([\s\S]*?)\n?>{7} REPLACE/gm;
 function parseEditBlocks(text) {
@@ -3782,7 +3959,7 @@ function applyEditBlock(block, rootDir) {
     };
   }
   const searchEmpty = block.search.length === 0;
-  const exists = existsSync3(absTarget);
+  const exists = existsSync4(absTarget);
   try {
     if (!exists) {
       if (!searchEmpty) {
@@ -3830,7 +4007,7 @@ function snapshotBeforeEdits(blocks, rootDir) {
     if (seen.has(b.path)) continue;
     seen.add(b.path);
     const abs = resolve4(absRoot, b.path);
-    if (!existsSync3(abs)) {
+    if (!existsSync4(abs)) {
       snapshots.push({ path: b.path, prevContent: null });
       continue;
     }
@@ -3855,7 +4032,7 @@ function restoreSnapshots(snapshots, rootDir) {
     }
     try {
       if (snap.prevContent === null) {
-        if (existsSync3(abs)) unlinkSync2(abs);
+        if (existsSync4(abs)) unlinkSync2(abs);
         return {
           path: snap.path,
           status: "applied",
@@ -3878,10 +4055,31 @@ function sep() {
 }
 
 // src/code/prompt.ts
-import { existsSync as existsSync4, readFileSync as readFileSync6 } from "fs";
-import { join as join4 } from "path";
+import { existsSync as existsSync5, readFileSync as readFileSync6 } from "fs";
+import { join as join5 } from "path";
 var CODE_SYSTEM_PROMPT = `You are Reasonix Code, a coding assistant. You have filesystem tools (read_file, write_file, list_directory, search_files, etc.) rooted at the user's working directory.
 
+# When to propose a plan (submit_plan)
+
+You have a \`submit_plan\` tool that shows the user a markdown plan and lets them Approve / Refine / Cancel before you execute. Use it proactively when the task is large enough to deserve a review gate:
+
+- Multi-file refactors or renames.
+- Architecture changes (moving modules, splitting / merging files, new abstractions).
+- Anything where "undo" after the fact would be expensive \u2014 migrations, destructive cleanups, API shape changes.
+- When the user's request is ambiguous and multiple reasonable interpretations exist \u2014 propose your reading as a plan and let them confirm.
+
+Skip submit_plan for small, obvious changes: one-line typo, clear bug with a clear fix, adding a missing import, renaming a local variable. Just do those.
+
+Plan body: one-sentence summary, then a file-by-file breakdown of what you'll change and why, and any risks or open questions. If some decisions are genuinely up to the user (naming, tradeoffs, out-of-scope possibilities), list them in an "Open questions" or "\u5F85\u786E\u8BA4" section \u2014 the user sees the plan in a picker and has a text input to answer your questions before approving. Don't pretend certainty you don't have; flagged questions are how the user tells you what they care about. After calling submit_plan, STOP \u2014 don't call any more tools, wait for the user's verdict.
+
+# Plan mode (/plan)
+
+The user can ALSO enter "plan mode" via /plan, which is a stronger, explicit constraint:
+- Write tools (edit_file, write_file, create_directory, move_file) and non-allowlisted run_command calls are BOUNCED at dispatch \u2014 you'll get a tool result like "unavailable in plan mode". Don't retry them.
+- Read tools (read_file, list_directory, search_files, directory_tree, get_file_info) and allowlisted shell (git status/log/diff, ls, cat, grep, cargo check, npm test) still work \u2014 use them to investigate.
+- You MUST call submit_plan before anything will execute. Approve exits plan mode; Refine stays in; Cancel exits without implementing.
+
+
 # When to edit vs. when to explore
 
 Only propose edits when the user explicitly asks you to change, fix, add, remove, refactor, or write something. Do NOT propose edits when the user asks you to:
@@ -3929,8 +4127,8 @@ Rules:
 `;
 function codeSystemPrompt(rootDir) {
   const withMemory = applyProjectMemory(CODE_SYSTEM_PROMPT, rootDir);
-  const gitignorePath = join4(rootDir, ".gitignore");
-  if (!existsSync4(gitignorePath)) return withMemory;
+  const gitignorePath = join5(rootDir, ".gitignore");
+  if (!existsSync5(gitignorePath)) return withMemory;
   let content;
   try {
     content = readFileSync6(gitignorePath, "utf8");
@@ -3955,9 +4153,9 @@ ${truncated}
 // src/config.ts
 import { chmodSync as chmodSync2, mkdirSync as mkdirSync3, readFileSync as readFileSync7, writeFileSync as writeFileSync3 } from "fs";
 import { homedir as homedir2 } from "os";
-import { dirname as dirname4, join as join5 } from "path";
+import { dirname as dirname4, join as join6 } from "path";
 function defaultConfigPath() {
-  return join5(homedir2(), ".reasonix", "config.json");
+  return join6(homedir2(), ".reasonix", "config.json");
 }
 function readConfig(path = defaultConfigPath()) {
   try {
@@ -3996,7 +4194,7 @@ function redactKey(key) {
 }
 
 // src/index.ts
-var VERSION = "0.4.17";
+var VERSION = "0.4.19";
 export {
   AppendOnlyLog,
   CODE_SYSTEM_PROMPT,
@@ -4009,6 +4207,7 @@ export {
   NeedsConfirmationError,
   PROJECT_MEMORY_FILE,
   PROJECT_MEMORY_MAX_CHARS,
+  PlanProposedError,
   SessionStats,
   SseTransport,
   StdioTransport,
@@ -4061,18 +4260,22 @@ export {
   parseMcpSpec,
   parseMojeekResults,
   parseTranscript,
+  prepareSpawn,
+  quoteForCmdExe,
   readConfig,
   readProjectMemory,
   readTranscript,
   recordFromLoopEvent,
   redactKey,
   registerFilesystemTools,
+  registerPlanTool,
   registerShellTools,
   registerWebTools,
   renderMarkdown as renderDiffMarkdown,
   renderSummaryTable as renderDiffSummary,
   repairTruncatedJson,
   replayFromFile,
+  resolveExecutable,
   restoreSnapshots,
   runBranches,
   runCommand,