rovecode 0.4.0-beta.3 → 0.4.0

package/README.md

@@ -8,7 +8,7 @@ OpenHands) — every port traces to file:line in a snapshotted source and lands
 fresh-context critic verifies it against a pre-written bar (ledger: `PORTS.md`, kept outside this
 repository for now).
 
-![The sextant TUI at 160×44 cells: the files tree with git statuses, the code panel on src/auth/callback.ts with edited lines highlighted, the messages panel with read and edit tool rows and an approval card asking to run bun test, the plan at step 1 of 4, usage at 13% context, and the rovecode cloud pet waiting for a nod.](https://raw.githubusercontent.com/9Code-Labs/rovecode-community/main/docs/assets/approval-160x44.png)
+![The sextant TUI at 160×44 cells: the files tree with git statuses, the code panel on src/auth/callback.ts with edited lines highlighted, the messages panel with read and edit tool rows and an approval card asking to run bun test, the plan at step 1 of 4, usage at 13% context, and the rovecode cloud pet waiting for a nod.](https://raw.githubusercontent.com/9Code-Labs/rovecode-site/main/public/shots/approval-160x44.png)
 
 ## Status (2026-09-04, post wave 4)
 
@@ -38,22 +38,18 @@ repository for now).
   - **run budgets** — `--max-turns` / `--max-seconds`, so a spiral ends in a result instead of an outside kill
   - a decided **wire-failure policy** (`docs/wire-failures.md`): what is retried, what is never retried after
     text has arrived, and the wait announced while it happens
-  - the **site** ([live at rovecode.dev](https://rovecode.dev), 15 languages, prerendered) and the CI/CD workflows
+  - the **site** ([its own repo](https://github.com/9Code-Labs/rovecode-site), 15 languages, prerendered, [live](http://64.177.43.110/)) and the CI/CD workflows
     that build and ship it
   - **sextant** gained mouse and scrollbar dragging, the page tab strip, the notices history and prompt suggestions
   - **startup** is lazy: `rovecode --help` no longer boots the TUI, the loop, the runtime or the plugin scanner
 
 ## Install
 
-Requires [Bun](https://bun.sh) ≥ 1.3.14 on PATH (both the published bundle and the source are executed by bun — node cannot run them).
+Requires [Bun](https://bun.sh) ≥ 1.3.14 (the CLI entry is TypeScript, executed by bun — node cannot run it).
 
 ```bash
-# from npm — the published minified bundle (beta channel until a stable is cut)
-npm install -g rovecode@beta
-rovecode --version
-
-# from source (this repository is the bundle's AGPL source)
-git clone https://github.com/9Code-Labs/rovecode-community.git && cd rovecode-community && bun install
+# from source
+git clone https://github.com/9Code-Labs/rovecode.git && cd rovecode && bun install
 bun run src/cli/main.ts --help          # or: bun link → `rovecode` on PATH
 bun run build:cli                       # optional: pre-bundle (TUI cold start ~230 ms → ~80 ms); re-run after git pull
 
@@ -61,24 +57,18 @@ bun run build:cli                       # optional: pre-bundle (TUI cold start ~
 bun run build                           # scripts/build.ts → dist/rovecode(.exe) + smoke
 dist/rovecode.exe --version
 
-# from a locally packed tarball — npm pack runs the minified build:npm through prepack
-npm pack && npm install -g ./rovecode-0.4.0-beta.0.tgz
+# from an npm tarball (npm pack) — global install shims to bun via the shebang
+npm install -g ./rovecode-0.3.1.tgz
 ```
 
-Published to npm as [`rovecode`](https://www.npmjs.com/package/rovecode): the tarball carries the minified
-bundle, and THIS repository is its source, as the AGPL requires (`npm install -g rovecode` — the beta
-channel is `rovecode@beta`). Releases are cut on
-[GitHub Releases](https://github.com/9Code-Labs/rovecode-community/releases). `rovecode update` updates
-this installation the way it was installed (npm: `npm install -g rovecode@<channel>`; a source checkout:
-`git pull` + `bun install`; the channel follows the running version, so a beta stays on beta), and
-`"autoUpdate": true` in settings.json (or `ROVECODE_AUTO_UPDATE=1`) runs that plan in the background at
-boot when the check finds a newer release — the session is never blocked or swapped; the note says
-restart. A compiled binary does not replace itself yet and says where the new artifact is. Rovecode does tell you when that is worth doing: the
-TUI's startup card carries `update available: 0.3.2 → 0.4.0 · <release url>` when a newer release exists. The check
-(`src/core/update-check.ts`) asks GitHub once every six hours (cached per release repo in `~/.rovecode/update-check-<repo>.json`), never
-blocks the start and never throws. The repository is public, so the check works anonymously; `GITHUB_TOKEN`,
-`GH_TOKEN` or a `gh auth login` only raise the rate limit. When the check could not look,
-the card prints nothing rather than a guess. Only a real newer release produces a line
+Not yet published to the npm registry (name availability unverified). Releases are cut on
+[GitHub Releases](https://github.com/9Code-Labs/rovecode/releases) — v0.3.1 is the current one — and there is no
+self-update: `git pull` and rebuild, or reinstall the binary. Rovecode does tell you when that is worth doing: the
+TUI's startup card carries `update available: 0.3.0 → 0.4.0 · <release url>` when a newer release exists. The check
+(`src/core/update-check.ts`) asks GitHub once every six hours (cached in `~/.rovecode/update-check.json`), never
+blocks the start and never throws. The repository is private, so it needs `GITHUB_TOKEN`, `GH_TOKEN` or a
+`gh auth login`; without one the result is "unknown — the release repository is private and no token is set",
+never "up to date", and the card prints nothing rather than a guess. Only a real newer release produces a line
 on the card — `rovecode --version` prints the version to stdout alone (so a script can still read it) and, on
 stderr, whatever the last check found. It reads the cache and never opens a socket: a courtesy line must not
 make the one command scripts call to identify a build wait on the network.
@@ -121,9 +111,9 @@ rovecode --accept-edits         # middle tier: writes INSIDE this folder stop as
                                 # session. network and writes outside it still ask (/accept-edits ·
                                 # ROVECODE_ACCEPT_EDITS=1 · or the `all edits` button on a write approval
                                 # card)
-                                # The same file takes "bell": false — both TUIs notify you (bell, or an
-                                # OSC 9 toast where the terminal shows one) when a run ends or a card
-                                # needs you, ONLY while the terminal is unfocused; off with that key.
+                                # The same file takes "bell": false — the sextant rings the terminal bell
+                                # (BEL) when a run ends or a card needs you, so a tabbed-away terminal
+                                # can flash or chime; off with that key (user or project scope).
 @src/auth.ts why does this fail  # @file attaches the file to the message as a `read` would return it —
                                 # contents + edit anchors, no tool round-trip. Capped and said: 400 lines
                                 # per file (the footer names the offset to continue), 8 files, ~60k chars
@@ -143,6 +133,8 @@ rovecode gauntlet               # adversarial eval suite (offline, deterministic
 rovecode gauntlet --live        # 9 of those tasks against the configured REAL model, through the real prompt
                                 # (--model provider/model, --effort …): the before/after instrument for prompt
                                 # work
+bun scripts/eval-offline.ts     # eval gate: trajectory JSONL + patch/test grading + offline replay + stuck
+                                # detection + secrets redaction, no network (~150 ms; docs/eval.md)
 rovecode bench                  # cross-harness micro-benchmarks
 rovecode tools                  # registered tool listing
 rovecode auth set <provider>    # store an API key (prompted on the terminal, never echoed); auth list / auth
@@ -154,10 +146,7 @@ rovecode models               # just list them (* = current); alias for `model l
 rovecode model use <provider/model>  # persist the default model directly (--project pins it to this repo)
 rovecode model show           # the model, its protocol, and the exact thinking field each --effort level
                               # sends
-rovecode sessions [--json]      # this folder's sessions, newest first (+ a footer counting empty session dirs)
-rovecode sessions rename|delete|fork|search   # name, remove (with its checkpoints), copy or search sessions —
-                                # ids are exact or a unique prefix; ambiguous/unknown → exit 2, nothing touched
-rovecode trace <id|prefix>      # replay a session's JSONL tree
+rovecode trace <session-id>     # replay a session's JSONL tree
 rovecode acp                    # Agent Client Protocol v1 over stdio (Zed/JetBrains)
 rovecode serve                  # headless HTTP + SSE server (ROVECODE_PORT, loopback-only)
 ```
@@ -382,10 +371,6 @@ mcp/ acp/ server/ tui/ sextant/  surfaces over the same loop (no second loop
 eval/                  scripted-provider gauntlet + deterministic benches
 ```
 
-## Supported extension API
-
-Distributed integrations should import only `rovecode/extensions`, `rovecode/plugins`, or `rovecode/providers`; deep `src/` imports are internal. See [API stability](docs/api-stability.md), [extension interfaces](docs/extensions.md), the [authentication boundary](docs/authentication-boundary.md), and the [open-core architecture](docs/open-core-architecture.md). Public code is mechanically prevented from importing private overlays or hosted product-auth/control-plane contracts. Generic local provider and MCP authentication remain part of the usable open-source core.
-
 ## Configuration
 
 Defaults < project config chunks (harvested, capped) < env < CLI flags.
@@ -395,15 +380,6 @@ Defaults < project config chunks (harvested, capped) < env < CLI flags.
 - `.rovecode/mcp.json` (+ harvested `.mcp.json`, + `~/.rovecode/mcp.json` for you) — MCP servers; `rovecode mcp add`
   writes them. PROJECT files are gated: until you approve them (`rovecode mcp show` to review,
   `rovecode mcp trust` to approve) their servers stay off, and any edit asks again (`docs/mcp-market.md`)
-- **Project trust** (`src/core/trust.ts`, 2026-09-07) — the same gate, one store (`~/.rovecode/plugins.json`, path →
-  sha256), now covers EVERY project file that could make rovecode run or import something: `.rovecode/hooks.ts`
-  (imported in-process at boot — the worst of them), `.rovecode/sandbox.json` (the rung and the docker image every
-  bash command runs in), `.rovecode/settings.json` when it carries a command-bearing key (`verify`, `lsp`,
-  `notify_command`), and the MCP files. A cloned repository's copies contribute NOTHING until `rovecode trust`:
-  `rovecode trust show` lists each file with what it WOULD do (the keys and their values, the rung and image, the
-  server commands), `rovecode trust [--yes]` approves them as they are now, `rovecode trust untrust` withdraws; an
-  edit asks again. Your own `~/.rovecode` files never ask. `verify: false` is a refusal, not a command, and is honoured
-  from any file. `.rovecode/commands/*.md` and `agents/*.md` are prompt text, not executables — out of this gate's scope
 - `.rovecode/modes.json` — per-mode model config (TUI-scoped; see limitations)
 - `.rovecode/sandbox.json` — `{"rung": "direct"|"wsl"|"docker", "dockerImage"?: "…"}` selects where `bash` runs (#27);
   `ROVECODE_SANDBOX=<rung>` / `ROVECODE_SANDBOX_IMAGE=<image>` override it; default `direct`
@@ -417,15 +393,8 @@ Defaults < project config chunks (harvested, capped) < env < CLI flags.
   give once; the project file wins key by key. Three keys: `"permission": "ask" | "accept-edits" | "auto"` (written
   by `/yolo --save` and `/accept-edits --save [--project]`; ladder: CLI flag > `ROVECODE_PERMISSION` > project >
   user > ask), `"effort": "auto" | "off" | "low" | "medium" | "high"` (the thinking dial, `/effort --save`), and
-  `"bell": false` — both TUIs notify you when a run ends and when an approval or question card opens, but ONLY while
-  the terminal is unfocused: the point is telling someone who looked away, and a bell on every turn is a bell nobody
-  hears (a terminal that never reports focus reads as watched and stays silent). `"notify": "auto" | "bell" | "osc9" |
-  "osc777"` picks the signal (auto = an OSC 9 desktop toast on Ghostty, iTerm2, kitty, Warp and WezTerm, the BEL
-  everywhere else; Windows Terminal turns the bell into a flash, a chime or a taskbar badge per profile);
-  `"notify_when": "always"` brings back a signal on every run; `"notify_command": ["notify-send","rovecode"]` (a JSON
-  string array, or whitespace-split words) runs a desktop hook under the same gate with a JSON payload as its last
-  argument, never through a shell — from the project file it applies only once that file is trusted, from the user file
-  always. `ROVECODE_NOTIFY[=off]`, `ROVECODE_NOTIFY_WHEN` and `ROVECODE_NOTIFY_COMMAND` override the files. Fourth key: `"verify": "bun run check"`
+  `"bell": false` — both TUIs ring the terminal bell (BEL) when a run ends and when an approval or question card
+  opens, so a terminal you tabbed away from can flash or chime; this turns it off. Fourth key: `"verify": "bun run check"`
   (or a list, run in order; or `false`) — the check the loop runs after the agent's last edit before its reply counts
   as done. Without the key rovecode infers one only where both the name and the shape are recognised: a
   `package.json` `check` script (unless its body names deploy/publish/push/docker/curl and the like), or a
@@ -511,14 +480,6 @@ Environment knobs (`rovecode help env` is the full reference; this list is the c
   `ROVECODE_STREAM` — streaming is ON by default for both protocols; `off`/`json`/`0`/`false`/`none` fall back
   to the one-shot JSON adapters (a proxy with no SSE route); `sse` selects the raw OpenAI-compatible SSE
   adapter for `rovecode run` — still streaming, but without the text-tool-call middleware wrap;
-  `ROVECODE_OPENAI_WIRE=responses|chat` — which OpenAI wire a request takes (`src/providers/wire-select.ts`, per call).
-  Unset: a stored ChatGPT login (`rovecode auth login openai`) always takes `/responses` (its token is accepted by the
-  Codex backend only, with `originator: rovecode`); provider `openai` takes `/responses` for models the catalog does not
-  mark non-reasoning (gpt-5, o3, unknown ids) and `/chat/completions` for the gpt-4o class; every other provider stays
-  on `/chat/completions`, byte-identical to before. Selection is static — a `/responses` 404 is an error turn, never a
-  re-issue. Not done yet on `/responses`: reasoning items are not replayed to the model on the next turn (each turn
-  reasons afresh; reasoning text still streams live) — that needs a reasoning message part across the store, export
-  and the other wires;
   `ROVECODE_HOME` — credentials + user-scope commands dir (default `~/.rovecode`)
 - `ROVECODE_TUI=sextant|classic` — force the TUI surface (#44; sextant still needs a TTY of at least 40×12,
   `--classic` wins); `ROVECODE_THEME=night|ember|contrast` — the sextant palette at boot (`/theme` switches it
@@ -654,14 +615,14 @@ tokens, cache hits, and catalog-priced spend.
   `const rc = createClient({ cwd })`, `const s = await rc.session.create()`, and
   `for await (const ev of s.prompt({ text })) …` streams every `RunEvent` plus `agent_tree_update`
   frames for live subagent trees. One client = one engine: the SDK boots the same runtime the CLI
-  boots (no second loop), and `stream: mockStream(…)` makes it testable with no provider.
+  boots (no second loop), and `stream: mockStream(…)` makes it testable with no provider. A
+  `remote` transport against `rovecode serve` is planned on the same types. New in 0.4.0; the
+  surface is `0.x` — expect evolution, pinned by `test/unit/sdk-client.test.ts`.
 - **Workflows** (`rovecode workflow run <file.ts>`, `src/workflow/engine.ts`): a file that
   `export default defineWorkflow({ name, steps })` — a DAG of `agent` steps (run through the
   TaskManager, so they appear in `serve`'s `/ui` agent tree) and `gate` steps (human approval),
   with per-step retry, a token budget, and a JSONL checkpoint in `.rovecode/workflows/` that
   `--resume <runId>` continues after a crash. `rovecode workflow list` shows known runs.
-- **Mission control** (`rovecode serve` → `GET /ui` + `GET /events`): a zero-build dark dashboard
-  over a global SSE bus — sessions, every run's live event stream, and the per-session agent tree.
 - **Plugins** (`src/plugins`, `docs/plugins.md`): a folder with a `plugin.json` that bundles the things below —
   an in-process entry module (tools + hooks), `commands/*.md`, `skills/**/SKILL.md`, MCP servers — so one
   `rovecode plugin add <folder|git-url>` installs all of it and `rovecode plugin list` shows all of it. User scope
@@ -696,10 +657,8 @@ tokens, cache hits, and catalog-priced spend.
   tools arrive lazily through `mcp_list`/`mcp_call` under the same policy pipeline. A server a **repository** brings
   with it is listed but never connected until you trust it: `mcp show` prints every configured file and what it would
   run, `mcp trust` records the project files' content digest in your home (`--yes` to skip the prompt; an edit to
-  either file asks again) and `mcp untrust` revokes it. User-scope servers need no gate. `rovecode trust` is the same
-  store one level up: it approves the MCP files together with `hooks.ts`, `sandbox.json` and the command-bearing
-  settings keys in one step (see Project trust above).
-- **Market** (`src/market`, [`docs/mcp-market.md`](docs/mcp-market.md)): one shelf over all three — `rovecode market search|info|docs|
+  either file asks again) and `mcp untrust` revokes it. User-scope servers need no gate.
+- **Market** (`src/market`, `docs/market.md`): one shelf over all three — `rovecode market search|info|docs|
   install|remove|list|update|sources|verify|validate` (each with `--json`) and `/market` in the TUI find MCP
   servers, skills and plugins
   and install any of them with one command. A single argument resolves five shapes (bare id, `kind:id`, a git URL,
@@ -719,6 +678,34 @@ tokens, cache hits, and catalog-priced spend.
   `.rovecode/design.json`) and `design_audit`, which counts template patterns in source and reports them as
   *slop* only while nothing is recorded, or as *deviation* from what the project chose. `ROVECODE_DESIGN=off`
   drops the section for runs with no UI in them.
+- **Site** ([9Code-Labs/rovecode-site](https://github.com/9Code-Labs/rovecode-site), `docs/deploy.md`):
+  the landing page, the docs and the market — Vite + React, prerendered once per language, no runtime.
+  It moved out of this repository on 2026-09-06 and builds without reading anything outside itself.
+  What stays here is the content it renders: `bun run publish:site` regenerates `docs.json`,
+  `market.json` and `facts.json` from `docs/*.md`, `src/market/catalogs/`, `src/mcp/market-catalog.ts`
+  and `plugins/`, and pushes them there. Deploying is `bun run deploy` in that repo. Live at
+  [64.177.43.110](http://64.177.43.110/) until there is a domain.
+
+## License & notices
+
+Rovecode is free software under the GNU Affero General Public License v3.0 — see `LICENSE`.
+Copyright (C) 2026 9Code Labs. You may use, study, modify and redistribute it; every copy and every
+derivative must keep this license and its copyright notices, and if you run a modified rovecode as a
+network service you must offer its complete source to the users of that service.
+
+Third-party attributions (Apache-2.0 NOTICE entries + MIT credits): `THIRD_PARTY_NOTICES.md`
+(shipped in the npm tarball). No code from crush (FSL), claw-code, nanocoder, iflow, or the Claude
+Agent SDK.
+
+## What wave 3 added (`PORTS.md` §Wave-3)
+
+Landed, not planned. Ports #21–#39: mid-turn cancellation, first-class grep/glob/ls tools,
+retry-with-backoff, approval diff previews, compaction v2, background subagents, sandbox rung config,
+reflection retries, hooks v2, custom slash commands, web fetch, todo/ask_user tools, image input,
+JSON/NDJSON output modes, session export, OTel spans.
+
+### Not built
+
 - **#47 external agentic-CLI lanes** — the one wave-4 row that was never implemented here. Measured
   2026-09-06 rather than assumed: `claude -p` and `opencode run` already work through the `bash` tool
   today, in print mode, without a TTY. What makes a lane a real feature rather than a shortcut is the
@@ -732,7 +719,5 @@ tokens, cache hits, and catalog-priced spend.
   and name the account it spends from. (`opencode` also writes `.opencode/` and `docs/` into the working
   directory even when it fails, and on Windows a nested shell layer ate the backslashes of an absolute
   path and produced a file literally named `C:UsersberkaycikAppData…banana.txt`.)
-- **Publishing**: the npm package (`rovecode`) ships the minified bundle from this repository via the
-  `prepack` hook; the repo itself stays the AGPL source. `npm install -g rovecode@beta` for the beta
-  channel, `rovecode` for the latest stable cut.
+- **Publishing**: no npm package; the binary is built locally (see Known limitations)
 - **Linux/macOS CI**: POSIX paths are exercised in tests, but only Windows is gated

package/THIRD_PARTY_NOTICES.md

@@ -48,22 +48,6 @@ Source: https://github.com/openai/codex, © 2025 OpenAI. Snapshot
   `codex-rs/utils/cli/src/sandbox_mode_cli_arg.rs:14-25`), and an explicitly requested but
   unprovidable tier as a hard error (`codex-rs/sandboxing/src/manager.rs:203-222`
   SandboxTransformError). Here `.rovecode/sandbox.json` < `ROVECODE_SANDBOX`; rungs direct/wsl/docker only.
-- **OpenAI Responses wire (aion port #75, 2026-09-07)** — `src/providers/responses.ts` follows AT PATTERN
-  LEVEL (no code copied) the event set a Responses client consumes and the `event:` + `data:` pairing
-  (`codex-rs/codex-api/src/sse/responses.rs:357-518`, fixtures :843-845), the ChatGPT Codex base URL
-  (`codex-rs/model-provider-info/src/lib.rs:40`) and an `originator` header on every request
-  (`codex-rs/core/src/client.rs:688`; the value here is `rovecode`). The request shape, the output-slot
-  state machine and the `chatgpt-account-id` / `OpenAI-Beta` headers follow earendil-works/pi (MIT,
-  credited in the module header). Not ported: codex's error taxonomy, websocket and zstd transports.
-- **TUI notifications (aion port #79, 2026-09-07)** — `src/tui/notify-seq.ts` and `src/tui/notify.ts` follow AT
-  PATTERN LEVEL (no code copied) codex's terminal-notification design: the `auto` backend chooser and its
-  terminal list (`codex-rs/tui/src/notifications/mod.rs`), the tmux DCS passthrough with doubled ESC and its
-  test vectors (`codex-rs/tui/src/notifications/osc9.rs`), the env markers per terminal
-  (`codex-rs/terminal-detection/src/lib.rs`), the unfocused | always gate with focus starting true and the
-  warn-once-then-disable write path (`codex-rs/tui/src/tui.rs`), the event set (`codex-rs/tui/src/chatwidget/
-  notifications.rs`) and the `notify` argv hook with the payload as the last argument and nulled stdio
-  (`codex-rs/hooks/src/legacy_notify.rs`). Deviations: focus reporting stays on under Windows, and the hook obeys
-  the focus gate. OSC 777, the control-byte scrub, the argv parser and the trust gate are rovecode's own.
 
 ## cline (Apache-2.0)
 
@@ -194,34 +178,6 @@ every surface and fails closed at execute time instead. Snapshot
 `research/source_snapshots/google-gemini-gemini-cli` @ 0bd1d43. The tool contract (option labels,
 typed answer, dismissed question = error) follows opencode (MIT, credited in the module header).
 
-### Port #81 — workspace roots (`--add-dir`)
-`src/core/workspace.ts` follows AT PATTERN LEVEL (no code copied) opencode's external-directory
-handling (`external-directory.ts` and `fs-util.ts` `contains()`: an added directory is a peer of the
-cwd, and containment is decided on canonical paths, not on string prefixes) and gemini-cli's
-`isPathWithinRoot`. Snapshots `research/source_snapshots/opencode-2026` @ ebece6e and
-`research/source_snapshots/google-gemini-gemini-cli` @ 0bd1d43. What is not followed: neither project
-puts the boundary in the permission ladder as its own action — rovecode evaluates `file.external` at
-dispatch so the refusal is a card a person can answer, and so an "always" is remembered per directory.
-
-### Port #57/#76 — MCP prompts, resources, status and OAuth
-`src/mcp/prompts-resources.ts` follows AT PATTERN LEVEL (no code copied) gemini-cli's
-`list-mcp-resources.ts` / `read-mcp-resource.ts`: server-scoped listing, text content returned
-verbatim, binary content summarized rather than inlined. `src/mcp/status.ts` follows its `/mcp`
-per-server status rows (state, tool and prompt counts, the remedy line). `src/mcp/oauth.ts` follows
-`packages/core/src/mcp/oauth-provider.ts:399-405` — start the loopback callback server FIRST so the
-redirect URI names a port that is already listening, rather than racing the browser. Snapshot
-`research/source_snapshots/google-gemini-gemini-cli` @ 0bd1d43.
-
-The provider-class shape over the SDK's own seam was additionally read from opencode's
-`packages/opencode/src/mcp/oauth-provider.ts` (MIT); its FIXED callback port is deliberately not
-followed — rovecode allocates an ephemeral one, so two logins cannot collide and a stuck listener
-cannot block the next attempt.
-
-MCP OAuth itself is done through `@modelcontextprotocol/sdk`'s `OAuthClientProvider` seam (MIT —
-dependency, API usage, not a port): the SDK performs discovery, dynamic client registration, PKCE and
-refresh; rovecode supplies persistence (`~/.rovecode/credentials.json`, 0600), the loopback redirect
-and the `rovecode mcp login` command.
-
 ## Zed Industries — agent-client-protocol (Apache-2.0)
 
 - **ACP endpoint (port #15)** — `src/acp/server.ts` speaks ACP v1 via the official SDK

package/bin/rovecode.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env bun
+/** Entrypoint wrapper: routes TUI invocations through the pre-bundled dist/cli/main.js for fast
+ *  cold start (~90 ms vs ~230 ms), and falls back to src/cli/main.ts for lightweight subcommands
+ *  (--help, --version, provider, model, …) which are already instant from source.
+ *  Run `bun run build:cli` to produce dist/cli/main.js; re-run after `git pull`. */
+import { existsSync } from "node:fs";
+import { join } from "node:path";
+import { isTuiInvocation } from "../src/cli/is-tui-invocation.ts";
+
+const bundled = join(import.meta.dir, "..", "dist", "cli", "main.js");
+const useDist = isTuiInvocation(process.argv) && existsSync(bundled);
+
+if (process.env.ROVECODE_TRACE_BOOT === "1") {
+  process.stderr.write(`[boot] dist=${useDist}\n`);
+}
+
+if (useDist) {
+  await import(bundled);
+} else {
+  await import("../src/cli/main.ts");
+}

package/package.json

@@ -1,33 +1,30 @@
 {
   "name": "rovecode",
-  "version": "0.4.0-beta.3",
+  "version": "0.4.0",
   "license": "AGPL-3.0-only",
   "author": "9Code Labs",
   "repository": {
     "type": "git",
-    "url": "git+https://github.com/9Code-Labs/rovecode-community.git"
+    "url": "https://github.com/9Code-Labs/rovecode.git"
   },
-  "homepage": "https://github.com/9Code-Labs/rovecode-community#readme",
-  "description": "Rovecode: a coding agent for the terminal. Research-derived harness on Bun/TypeScript with evidence-based ports from open-source harnesses (sextant TUI, MCP, ACP, headless server, repo-map, shadow-git checkpoints, execpolicy, model routers). The npm tarball ships the minified bundle; this public repository is its AGPL source.",
+  "homepage": "https://github.com/9Code-Labs/rovecode",
+  "description": "Rovecode: a coding agent for the terminal. Research-derived harness on Bun/TypeScript with evidence-based ports from open-source harnesses (sextant TUI, MCP, ACP, headless server, repo-map, shadow-git checkpoints, execpolicy, model routers).",
   "type": "module",
-  "module": "./dist/lib/index.js",
+  "module": "src/index.ts",
   "exports": {
-    ".": "./dist/lib/index.js",
-    "./extensions": "./dist/lib/public-api.js",
-    "./plugins": "./dist/lib/plugins.js",
-    "./providers": "./dist/lib/providers.js",
-    "./sdk": "./dist/lib/sdk.js",
-    "./package.json": "./package.json"
+    ".": "./src/index.ts",
+    "./sdk": "./src/sdk/index.ts",
+    "./package.json": "./package.json",
+    "./*": "./*"
   },
   "bin": {
-    "rovecode": "bin/rovecode.js"
+    "rovecode": "bin/rovecode.ts"
   },
   "files": [
     "bin",
-    "dist",
-    "README.md",
-    "CHANGELOG.md",
-    "LICENSE",
+    "src",
+    "vendor",
+    "tsconfig.json",
     "THIRD_PARTY_NOTICES.md"
   ],
   "engines": {
@@ -35,12 +32,7 @@
   },
   "scripts": {
     "build": "bun run scripts/build.ts",
-    "build:cli": "bun -e \"require('node:fs').rmSync('dist/cli', { recursive: true, force: true })\" && bun build --target=bun --splitting --sourcemap=external src/cli/main.ts --outdir dist/cli && bun -e \"require('node:fs').copyFileSync('src/providers/models-index.json', 'dist/cli/models-index.json')\" && bun run smoke:cli && bun run smoke:dist",
-    "build:npm": "bun run build:npm:cli && bun run build:npm:lib && bun run smoke:npm",
-    "build:npm:cli": "bun -e \"require('node:fs').rmSync('dist/cli', { recursive: true, force: true })\" && bun build --target=bun --minify --splitting --packages=external src/cli/main.ts --outdir dist/cli && bun -e \"require('node:fs').copyFileSync('src/providers/models-index.json', 'dist/cli/models-index.json')\"",
-    "build:npm:lib": "bun -e \"require('node:fs').rmSync('dist/lib', { recursive: true, force: true })\" && bun build --target=bun --minify --packages=external src/index.ts --outfile dist/lib/index.js && bun build --target=bun --minify --packages=external src/public-api.ts --outfile dist/lib/public-api.js && bun build --target=bun --minify --packages=external src/plugins/index.ts --outfile dist/lib/plugins.js && bun build --target=bun --minify --packages=external src/providers/stream.ts --outfile dist/lib/providers.js && bun build --target=bun --minify --packages=external src/sdk/index.ts --outfile dist/lib/sdk.js && bun -e \"require('node:fs').copyFileSync('src/providers/models-index.json', 'dist/lib/models-index.json')\"",
-    "smoke:npm": "bun dist/cli/main.js --version && bun dist/cli/main.js smoke-tui --sextant",
-    "prepack": "bun run build:npm",
+    "build:cli": "bun -e \"require('node:fs').rmSync('dist/cli', { recursive: true, force: true })\" && bun build --target=bun --splitting --sourcemap=external src/cli/main.ts --outdir dist/cli && bun run smoke:cli && bun run smoke:dist",
     "smoke:cli": "bun dist/cli/main.js --version",
     "smoke:dist": "bun dist/cli/main.js smoke-tui --sextant",
     "test": "bun test",
@@ -48,14 +40,8 @@
     "typecheck": "tsc --noEmit",
     "check": "node scripts/build-model-index.mjs --check && tsc --noEmit && bun test",
     "smoke": "bun src/cli/main.ts smoke-tui --sextant",
-    "build:model-index": "node scripts/build-model-index.mjs",
-    "check:boundary": "node scripts/check-public-boundary.mjs",
-    "check:product-boundary": "node scripts/check-product-boundary.mjs",
-    "check:links": "node scripts/check-doc-links.mjs",
-    "ci": "bun run check:boundary && bun run check:product-boundary && bun run check:links && bun run typecheck && bun test && bun run build:cli",
-    "release:check": "bun run ci && bun run build:npm && npm pack --dry-run",
-    "release:stage": "bun run scripts/stage-release.ts",
-    "quality:offline": "bun run scripts/harness-quality.ts"
+    "publish:site": "bash scripts/publish-site-data.sh",
+    "build:model-index": "node scripts/build-model-index.mjs"
   },
   "dependencies": {
     "@ast-grep/napi": "^0.45.3",
@@ -72,13 +58,5 @@
     "@types/bun": "latest",
     "@xterm/headless": "6.0.0",
     "typescript": "^5.9.3"
-  },
-  "bugs": {
-    "url": "https://github.com/9Code-Labs/rovecode-community/issues"
-  },
-  "publishConfig": {
-    "access": "public",
-    "provenance": true,
-    "tag": "beta"
   }
 }

package/src/account/keys.ts

@@ -0,0 +1,97 @@
+/** The CLI's proof-of-possession key (Ed25519, node:crypto only — no dependencies).
+ *
+ *  `rovecode login` generates one keypair per machine and sends only the PUBLIC JWK with the device/code
+ *  request; the server binds the issued `rc_live_…` token to that key's thumbprint. Every authed call then
+ *  carries a compact-JWS proof (DPoP-style) in the `dpop` header, so a stolen token alone answers 401.
+ *
+ *  The private key lives in ~/.rovecode/account-key.json (mode 0600) and never crosses the wire. */
+
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomBytes, sign as edSign, type KeyObject } from "node:crypto";
+import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import { join } from "node:path";
+import { rovecodeHome } from "../providers/auth.ts";
+
+export interface PopJwk {
+  kty: "OKP";
+  crv: "Ed25519";
+  x: string;
+}
+
+export interface AccountKey {
+  privateKey: KeyObject;
+  publicJwk: PopJwk;
+  /** RFC 7638 thumbprint of publicJwk — what the server binds the token to */
+  jkt: string;
+}
+
+const b64url = (buf: Buffer): string => buf.toString("base64url");
+
+export function keyPath(): string {
+  return join(rovecodeHome(), "account-key.json");
+}
+
+export function thumbprint(publicJwk: PopJwk): string {
+  return b64url(createHash("sha256").update(`{"crv":"${publicJwk.crv}","kty":"${publicJwk.kty}","x":"${publicJwk.x}"}`).digest());
+}
+
+export function createAccountKey(): AccountKey {
+  const { privateKey, publicKey } = generateKeyPairSync("ed25519");
+  const jwk = publicKey.export({ format: "jwk" });
+  const publicJwk: PopJwk = { kty: "OKP", crv: "Ed25519", x: jwk.x! };
+  return { privateKey, publicJwk, jkt: thumbprint(publicJwk) };
+}
+
+/** load the machine's key, generating and persisting it on first use (or after a corrupt file) */
+export function loadOrCreateAccountKey(path: string = keyPath()): AccountKey {
+  try {
+    const parsed = JSON.parse(readFileSync(path, "utf8")) as { privateJwk?: unknown; publicJwk?: unknown };
+    const privateKey = createPrivateKey({ key: parsed.privateJwk as never, format: "jwk" });
+    const publicKey = createPublicKey({ key: parsed.publicJwk as never, format: "jwk" });
+    const jwk = publicKey.export({ format: "jwk" });
+    if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || !jwk.x) throw new Error("not an Ed25519 key");
+    const publicJwk: PopJwk = { kty: "OKP", crv: "Ed25519", x: jwk.x };
+    return { privateKey, publicJwk, jkt: thumbprint(publicJwk) };
+  } catch {
+    const key = createAccountKey();
+    saveAccountKey(key, path);
+    return key;
+  }
+}
+
+function saveAccountKey(key: AccountKey, path: string): void {
+  mkdirSync(rovecodeHome(), { recursive: true, mode: 0o700 });
+  const privateJwk = key.privateKey.export({ format: "jwk" });
+  writeFileSync(path, JSON.stringify({ privateJwk, publicJwk: key.publicJwk }, null, 2) + "\n", { mode: 0o600 });
+  try {
+    chmodSync(path, 0o600);
+  } catch {
+    /* best-effort, same Windows caveat as account/store.ts */
+  }
+}
+
+export interface ProofClaims {
+  htm: string;
+  htu: string;
+  /** seconds since epoch */
+  iat: number;
+  jti?: string;
+  /** the access token the request carries — its sha256 goes in as ath */
+  accessToken?: string;
+}
+
+/** sign a compact JWS (`dpop+jwt`) for one request. jti defaults to 128 random bits. */
+export function signProof(key: AccountKey, claims: ProofClaims): string {
+  const header = b64url(Buffer.from(JSON.stringify({ typ: "dpop+jwt", alg: "EdDSA", jwk: key.publicJwk })));
+  const payload: Record<string, unknown> = {
+    jti: claims.jti ?? b64url(randomBytes(16)),
+    htm: claims.htm,
+    htu: claims.htu,
+    iat: claims.iat,
+  };
+  if (claims.accessToken !== undefined) {
+    payload.ath = b64url(createHash("sha256").update(claims.accessToken).digest());
+  }
+  const body = b64url(Buffer.from(JSON.stringify(payload)));
+  const sig = b64url(edSign(null, Buffer.from(`${header}.${body}`), key.privateKey));
+  return `${header}.${body}.${sig}`;
+}