s-app-scoder-agent 0.0.0-stage → 0.3.0

package/dist/permissions.js

@@ -0,0 +1,277 @@
+/**
+ * Permission & Safety System
+ *
+ * Layer giữa LLM tool call và actual execution.
+ * Cung cấp 3 mode: auto (run everything), ask (prompt for shell commands), readonly.
+ * Luôn deny catastrophic commands bất kể mode nào.
+ */
+import { createInterface } from "node:readline";
+// ---------------------------------------------------------------------------
+// Catastrophic command patterns — always denied, no exceptions
+// ---------------------------------------------------------------------------
+const CATASTROPHIC_PATTERNS = [
+    /rm\s+-rf\s+[/~"]|(?:rm\s+-rf\s+\/\*)/i,
+    /mkfs\b/i,
+    /dd\s+.*of=\//i,
+    /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i,
+    // curl/wget pipe-to-shell: match any content between command and '| sh'/'| bash'
+    // Handles -qO-, -X POST, etc. flags; URL-like patterns must contain '/' or '.'
+    /curl\s+.*[/.].*\s*\|\s*sh\b/i,
+    /curl\s+.*[/.].*\s*\|\s*bash\b/i,
+    /wget\s+.*[/.].*\s*\|\s*sh\b/i,
+    /wget\s+.*[/.].*\s*\|\s*bash\b/i,
+    /sudo\s+rm\s+-rf/i,
+    /\bshutdown\b|\breboot\b|\binit\s+[06]\b/i,
+    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
+    />\s*\/dev\/sda/i,
+    /\|\s*nc\s+-e\s+/i,
+    /\|\s*bash\s+-i/i,
+    /sysctl\s+-w\s+kernel\.panic=/i,
+    /echo\s+[^|]*>\s*\/etc\/sudoers/i,
+];
+function isCatastrophic(command) {
+    return CATASTROPHIC_PATTERNS.some((p) => p.test(command));
+}
+export function isDangerousCommand(command) {
+    return isCatastrophic(command);
+}
+// ---------------------------------------------------------------------------
+// Session allowlist (runtime, in-memory)
+// ---------------------------------------------------------------------------
+export class SessionAllowlist {
+    prefixes = new Set();
+    addPrefix(prefix) {
+        // Normalize to a word-bounded prefix: "git" -> "git " so that allowing
+        // "git" never matches a different binary like "gitx" or "github-cli".
+        const t = prefix.trim().replace(/\s+$/, "");
+        if (t.length === 0)
+            return;
+        this.prefixes.add(`${t} `);
+    }
+    hasMatch(command) {
+        return [...this.prefixes].some((p) => command.startsWith(p));
+    }
+    clear() {
+        this.prefixes.clear();
+    }
+}
+function extractFirstWord(command) {
+    return command.trim().split(/\s+/)[0] ?? "";
+}
+/**
+ * Classify a command given current permission config and session allowlist.
+ */
+export function classifyCommand(command, mode, configAllow, configDeny, sessionAllow) {
+    const safeFirst = extractFirstWord(command);
+    // 1. Catastrophic — always deny
+    if (isCatastrophic(command)) {
+        return { decision: "deny", reason: "matches catastrophic command pattern" };
+    }
+    // 2. Config deny list
+    if (configDeny.some((p) => command.startsWith(p.trim()))) {
+        return { decision: "deny", reason: "matches denyCommands pattern in config" };
+    }
+    // 3. Session allowlist
+    if (sessionAllow.hasMatch(command)) {
+        return { decision: "allow", reason: "allowed by session allowlist" };
+    }
+    // 4. Config allow list
+    if (configAllow.some((p) => command.startsWith(p.trim()))) {
+        return { decision: "allow", reason: "allowed by config allowCommands" };
+    }
+    // 5. Mode-dependent
+    switch (mode) {
+        case "auto":
+            return { decision: "allow", reason: "auto mode — run without confirmation" };
+        case "readonly":
+            return {
+                decision: "deny",
+                reason: "readonly mode — shell commands are disabled",
+            };
+        case "ask":
+            return {
+                decision: "ask",
+                reason: "requires user confirmation",
+                alwaysAllowPrefix: safeFirst + " ",
+            };
+    }
+}
+/**
+ * Prompt user for permission. Returns true/false. "always" is signaled via
+ * the alwaysAllowPrefix callback.
+ * Uses AbortController so timeoutSecs is actually enforced (deny on timeout).
+ */
+export async function promptForPermission(opts, onAlwaysAllow) {
+    const cmd = opts.command.length > 80 ? opts.command.slice(0, 80) + "..." : opts.command;
+    const timeoutMs = (opts.timeoutSecs ?? 60) * 1000;
+    const ac = new AbortController();
+    const timer = setTimeout(() => ac.abort(), timeoutMs);
+    const rl = createInterface({ input: process.stdin, output: process.stdout, signal: ac.signal });
+    // NOTE: Node's rl.question() callback is NOT invoked (and the promise never
+    // settles) when the interface is closed by an aborted signal — so we must
+    // race it against an abort promise or promptForPermission would hang forever.
+    const question = (q) => new Promise((res, _rej) => {
+        rl.question(q, (ans) => res(ans));
+    });
+    let rejectAborted = null;
+    const aborted = new Promise((_res, rej) => {
+        rejectAborted = rej;
+    });
+    ac.signal.addEventListener("abort", () => {
+        const e = new Error("permission prompt timed out");
+        e.name = "AbortError";
+        rejectAborted?.(e);
+    }, { once: true });
+    try {
+        let answer = "";
+        while (true) {
+            const timeoutStr = Math.ceil((opts.timeoutSecs ?? 60)) + "s";
+            let prompt = `⚠  run_command requires approval: ${cmd} (timeout in ${timeoutStr})\n`;
+            if (opts.alwaysAllowPrefix) {
+                prompt += `[y] yes  [a] always allow "${opts.alwaysAllowPrefix}"  [n] no  [q] quit: `;
+            }
+            else {
+                prompt += `[y] yes  [n] no  [q] quit: `;
+            }
+            try {
+                answer = (await Promise.race([question(prompt), aborted])).trim().toLowerCase();
+            }
+            catch {
+                // Timeout — AbortController triggered
+                clearTimeout(timer);
+                rl.close();
+                return false; // safe default: deny on timeout
+            }
+            if (answer === "q") {
+                clearTimeout(timer);
+                rl.close();
+                return false; // caller will abort
+            }
+            if (answer === "y") {
+                clearTimeout(timer);
+                rl.close();
+                return true;
+            }
+            if (answer === "n") {
+                clearTimeout(timer);
+                rl.close();
+                return false;
+            }
+            if (answer === "a" && opts.alwaysAllowPrefix) {
+                clearTimeout(timer);
+                rl.close();
+                onAlwaysAllow?.(opts.alwaysAllowPrefix);
+                return true;
+            }
+            // invalid answer — loop again (timeout still ticking)
+        }
+    }
+    finally {
+        clearTimeout(timer);
+        try {
+            rl.close();
+        }
+        catch { /* already closed */ }
+    }
+}
+export class PermissionChecker {
+    config;
+    sessionAllow = new SessionAllowlist();
+    allowAllEdits = false;
+    constructor(config) {
+        this.config = config;
+    }
+    /**
+     * Check if a command should run. Returns null = allowed immediately,
+     * or a PermissionResult if user needs to be consulted.
+     */
+    classify(command) {
+        return classifyCommand(command, this.config.mode, this.config.allowCommands, this.config.denyCommands, this.sessionAllow);
+    }
+    /**
+     * Ask user interactively. Returns true = allowed, false = denied.
+     * In non-interactive mode, always returns false for "ask" decisions.
+     */
+    async confirm(command) {
+        const result = this.classify(command);
+        if (result.decision === "allow")
+            return true;
+        if (result.decision === "deny")
+            return false;
+        // Decision is "ask"
+        if (this.config.nonInteractive) {
+            // In non-interactive (CI), deny commands that need asking
+            return false;
+        }
+        return promptForPermission({
+            command,
+            alwaysAllowPrefix: result.alwaysAllowPrefix,
+        }, (prefix) => this.sessionAllow.addPrefix(prefix));
+    }
+    get sessionAllowlist() {
+        return this.sessionAllow;
+    }
+    /**
+     * Ask user to approve a file write/edit, showing the diff first.
+     * Returns true = approved, false = rejected.
+     * Enforced timeout (default 120s) — deny on timeout (safe default).
+     */
+    async confirmEdit(path, diffText, timeoutSecs = 120) {
+        if (this.allowAllEdits)
+            return true;
+        if (this.config.nonInteractive) {
+            return false;
+        }
+        const ac = new AbortController();
+        const timer = setTimeout(() => ac.abort(), timeoutSecs * 1000);
+        const rl = createInterface({ input: process.stdin, output: process.stdout, signal: ac.signal });
+        const question = (q) => new Promise((res) => rl.question(q, (ans) => res(ans)));
+        let rejectAborted = null;
+        const aborted = new Promise((_res, rej) => {
+            rejectAborted = rej;
+        });
+        ac.signal.addEventListener("abort", () => {
+            const e = new Error("edit confirmation timed out");
+            e.name = "AbortError";
+            rejectAborted?.(e);
+        }, { once: true });
+        try {
+            for (;;) {
+                let answer;
+                try {
+                    answer = (await Promise.race([
+                        question(`\nApply this change to ${path}? [y]es  [a] always (this session)  [n]o  [q]uit: `),
+                        aborted,
+                    ])).trim().toLowerCase();
+                }
+                catch {
+                    // timeout — deny (safe default)
+                    return false;
+                }
+                if (answer === "y")
+                    return true;
+                if (answer === "a") {
+                    this.allowAllEdits = true;
+                    return true;
+                }
+                if (answer === "n")
+                    return false;
+                if (answer === "q") {
+                    // Graceful abort signal instead of process.exit from library code
+                    this.abortRequested = true;
+                    return false;
+                }
+                // invalid answer — loop again (timeout still ticking)
+            }
+        }
+        finally {
+            clearTimeout(timer);
+            try {
+                rl.close();
+            }
+            catch { /* already closed */ }
+        }
+    }
+    /** Set when the user pressed [q]uit in confirmEdit — the agent should stop. */
+    abortRequested = false;
+}

package/dist/provider-anthropic.js

@@ -0,0 +1,322 @@
+import { LlmError, LLM_REQUEST_TIMEOUT_MS, combinedSignal } from "./llm.js";
+import { withRetry } from "./retry.js";
+// ---------------------------------------------------------------------------
+// Translation: OpenAI-style -> Anthropic
+// ---------------------------------------------------------------------------
+export function toAnthropicMessages(messages) {
+    const systemParts = [];
+    const out = [];
+    for (const m of messages) {
+        if (m.role === "system") {
+            if (m.content)
+                systemParts.push(m.content);
+            continue;
+        }
+        if (m.role === "tool") {
+            // Tool results become user tool_result blocks; consecutive tool results
+            // are merged into one user message (Anthropic requirement).
+            const block = {
+                type: "tool_result",
+                tool_use_id: m.tool_call_id ?? "",
+                content: m.content ?? "",
+            };
+            const last = out[out.length - 1];
+            if (last && last.role === "user" && Array.isArray(last.content)) {
+                last.content.push(block);
+            }
+            else {
+                out.push({ role: "user", content: [block] });
+            }
+            continue;
+        }
+        if (m.role === "assistant") {
+            const blocks = [];
+            if (m.content)
+                blocks.push({ type: "text", text: m.content });
+            for (const tc of m.tool_calls ?? []) {
+                let input;
+                try {
+                    input = tc.arguments ? JSON.parse(tc.arguments) : {};
+                }
+                catch {
+                    input = {};
+                }
+                blocks.push({ type: "tool_use", id: tc.id || `call_${tc.name}`, name: tc.name, input });
+            }
+            out.push({
+                role: "assistant",
+                content: blocks.length > 0 ? blocks : (m.content ?? ""),
+            });
+            continue;
+        }
+        // user
+        out.push({ role: "user", content: m.content ?? "" });
+    }
+    return { system: systemParts.join("\n\n") || undefined, messages: out };
+}
+// ---------------------------------------------------------------------------
+// Translation: Anthropic -> OpenAI-style ChatResult
+// ---------------------------------------------------------------------------
+export function fromAnthropicResponse(data) {
+    let text = "";
+    const toolCalls = [];
+    for (const block of data.content ?? []) {
+        if (block.type === "text") {
+            text = text ? `${text}\n${block.text ?? ""}` : (block.text ?? "");
+        }
+        else if (block.type === "tool_use") {
+            toolCalls.push({
+                id: block.id ?? "",
+                name: block.name ?? "",
+                arguments: JSON.stringify(block.input ?? {}),
+            });
+        }
+    }
+    return {
+        message: {
+            role: "assistant",
+            content: text.length > 0 ? text : null,
+            tool_calls: toolCalls.length > 0 ? toolCalls : undefined,
+        },
+        usage: {
+            prompt_tokens: data.usage?.input_tokens,
+            completion_tokens: data.usage?.output_tokens,
+        },
+    };
+}
+// ---------------------------------------------------------------------------
+// AnthropicClient — same surface as LlmClient
+// ---------------------------------------------------------------------------
+const ANTHROPIC_VERSION = "2023-06-01";
+export class AnthropicClient {
+    opts;
+    constructor(opts) {
+        this.opts = opts;
+    }
+    get model() {
+        return this.opts.model;
+    }
+    async chat(messages, tools, opts = {}) {
+        const url = `${this.opts.baseUrl.replace(/\/$/, "")}/messages`;
+        const { system, messages: translated } = toAnthropicMessages(messages);
+        const { signal, cleanup } = combinedSignal(opts.signal, LLM_REQUEST_TIMEOUT_MS);
+        const body = JSON.stringify({
+            model: this.opts.model,
+            max_tokens: this.opts.maxTokens,
+            temperature: this.opts.temperature,
+            system,
+            messages: translated,
+            tools: tools.length > 0
+                ? tools.map((t) => ({
+                    name: t.function.name,
+                    description: t.function.description,
+                    input_schema: t.function.parameters,
+                }))
+                : undefined,
+        });
+        let res;
+        try {
+            res = await withRetry(async () => {
+                const r = await fetch(url, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        "x-api-key": this.opts.apiKey,
+                        "anthropic-version": ANTHROPIC_VERSION,
+                    },
+                    body,
+                    signal,
+                });
+                if (!r.ok)
+                    throw await toAnthropicError(r, url);
+                return r;
+            }, {}, (attempt, delay, reason) => console.error(`⚠  Anthropic request failed (${reason}), retrying in ${(delay / 1000).toFixed(1)}s (attempt ${attempt}/3)...`));
+        }
+        finally {
+            cleanup();
+        }
+        const data = (await res.json());
+        if (data.error) {
+            throw new LlmError(`Anthropic API error: ${data.error.message ?? "unknown"}`);
+        }
+        return fromAnthropicResponse(data);
+    }
+    /**
+     * Streaming: parse Anthropic SSE events (message_start, content_block_delta,
+     * message_delta, message_stop) and translate them to StreamChunks:
+     *  - text_delta            -> contentDelta
+     *  - tool_use + input_json_delta -> toolCallDelta accumulation
+     *  - message_delta stop_reason/usage -> final ChatResult
+     */
+    async *streamChat(messages, tools, opts = {}) {
+        const url = `${this.opts.baseUrl.replace(/\/$/, "")}/messages`;
+        const { system, messages: translated } = toAnthropicMessages(messages);
+        const { signal, cleanup } = combinedSignal(opts.signal, LLM_REQUEST_TIMEOUT_MS);
+        const body = JSON.stringify({
+            model: this.opts.model,
+            max_tokens: this.opts.maxTokens,
+            temperature: this.opts.temperature,
+            system,
+            messages: translated,
+            stream: true,
+            tools: tools.length > 0
+                ? tools.map((t) => ({
+                    name: t.function.name,
+                    description: t.function.description,
+                    input_schema: t.function.parameters,
+                }))
+                : undefined,
+        });
+        let res;
+        try {
+            res = await withRetry(async () => {
+                const r = await fetch(url, {
+                    method: "POST",
+                    headers: {
+                        "Content-Type": "application/json",
+                        "x-api-key": this.opts.apiKey,
+                        "anthropic-version": ANTHROPIC_VERSION,
+                    },
+                    body,
+                    signal,
+                });
+                if (!r.ok)
+                    throw await toAnthropicError(r, url);
+                return r;
+            }, {}, (attempt, delay, reason) => console.error(`⚠  Anthropic stream request failed (${reason}), retrying in ${(delay / 1000).toFixed(1)}s...`));
+        }
+        catch (err) {
+            cleanup(); // don't leak the 120s request timer — it would hang the process
+            throw new LlmError(`Anthropic stream fetch error after retries at ${url}: ${err.message}`);
+        }
+        if (!res.body) {
+            throw new LlmError("Anthropic stream: response body is not readable");
+        }
+        // Accumulators — text content + tool_use blocks (by block index)
+        let text = "";
+        const toolBlocks = new Map();
+        let stopReason;
+        let usage;
+        let sawStop = false;
+        const reader = res.body.getReader();
+        const decoder = new TextDecoder();
+        let buffer = "";
+        const handleEvent = (raw) => {
+            let ev;
+            try {
+                ev = JSON.parse(raw);
+            }
+            catch {
+                return null;
+            }
+            if (ev.type === "message_start") {
+                // Initial usage (input tokens) arrives on message_start
+                if (ev.message?.usage) {
+                    usage = {
+                        prompt_tokens: ev.message.usage.input_tokens,
+                        completion_tokens: ev.message.usage.output_tokens,
+                    };
+                }
+                return null;
+            }
+            if (ev.type === "content_block_start" && ev.content_block?.type === "tool_use") {
+                toolBlocks.set(ev.index ?? 0, {
+                    id: ev.content_block.id ?? "",
+                    name: ev.content_block.name ?? "",
+                    json: "",
+                });
+                return null;
+            }
+            if (ev.type === "content_block_delta") {
+                if (ev.delta?.type === "text_delta" && ev.delta.text) {
+                    text += ev.delta.text;
+                    return { contentDelta: ev.delta.text, done: false };
+                }
+                if (ev.delta?.type === "input_json_delta" && ev.delta.partial_json) {
+                    const block = toolBlocks.get(ev.index ?? 0);
+                    if (block)
+                        block.json += ev.delta.partial_json;
+                    return {
+                        toolCallDelta: { index: ev.index ?? 0, argumentsDelta: ev.delta.partial_json },
+                        done: false,
+                    };
+                }
+                return null;
+            }
+            if (ev.type === "message_delta") {
+                stopReason = ev.delta?.stop_reason ?? stopReason;
+                // Merge: message_delta usage only carries output_tokens
+                if (ev.usage) {
+                    usage = {
+                        ...usage,
+                        prompt_tokens: usage?.prompt_tokens ?? ev.usage.input_tokens,
+                        completion_tokens: ev.usage.output_tokens ?? usage?.completion_tokens,
+                    };
+                }
+                return null;
+            }
+            if (ev.type === "message_stop") {
+                sawStop = true;
+                return null;
+            }
+            return null;
+        };
+        let finalResult;
+        try {
+            while (true) {
+                const { done, value } = await reader.read();
+                if (done)
+                    break;
+                buffer += decoder.decode(value, { stream: true });
+                const lines = buffer.split("\n");
+                buffer = lines.pop() ?? "";
+                for (const rawLine of lines) {
+                    const line = rawLine.trim();
+                    if (!line.startsWith("data:"))
+                        continue;
+                    const payload = line.slice(5).trim();
+                    if (!payload)
+                        continue;
+                    const chunk = handleEvent(payload);
+                    if (chunk)
+                        yield chunk;
+                }
+            }
+            if (sawStop) {
+                const toolCalls = [...toolBlocks.values()]
+                    .filter((b) => b.name)
+                    .map((b) => ({ id: b.id, name: b.name, arguments: b.json || "{}" }));
+                finalResult = {
+                    message: {
+                        role: "assistant",
+                        content: text.length > 0 ? text : null,
+                        stop_reason: stopReason,
+                        tool_calls: toolCalls.length > 0 ? toolCalls : undefined,
+                    },
+                    usage,
+                };
+            }
+        }
+        finally {
+            try {
+                reader.cancel();
+            }
+            catch { /* already released */ }
+            reader.releaseLock();
+            cleanup();
+        }
+        yield { done: true, final: finalResult };
+    }
+}
+async function toAnthropicError(res, url) {
+    let body = await res.text().catch(() => "");
+    body = body.replace(/sk-ant-[^\s,&\]]+/gi, "sk-ant-***REDACTED***");
+    const err = new LlmError(`Anthropic API error ${res.status} at ${url}: ${body.slice(0, 500)}`, res.status);
+    const retryAfterHeader = res.headers.get("retry-after");
+    if (retryAfterHeader != null && retryAfterHeader !== "") {
+        const sec = Number(retryAfterHeader);
+        if (Number.isFinite(sec) && sec > 0)
+            err.retryAfterMs = sec * 1000;
+    }
+    return err;
+}

package/dist/retry.js

@@ -0,0 +1,53 @@
+/**
+ * Retry with exponential backoff + jitter for transient failures.
+ */
+export class NonRetryableError extends Error {
+}
+/** HTTP statuses worth retrying (transient). */
+export function isRetryableStatus(status) {
+    return status === 429 || status === 500 || status === 502 || status === 503 || status === 504;
+}
+/** Network-level errors worth retrying. */
+export function isRetryableNetworkError(err) {
+    const msg = String(err?.message ?? err ?? "");
+    return (/ECONNRESET|ETIMEDOUT|ECONNREFUSED|EAI_AGAIN|ENOTFOUND|socket hang up|network|fetch failed/i.test(msg));
+}
+function sleep(ms) {
+    return new Promise((res) => setTimeout(res, ms));
+}
+/**
+ * Run fn with retries. Retries on retryable HTTP statuses (thrown as errors
+ * carrying `.status`) and network errors. Client errors (4xx except 429)
+ * fail immediately via NonRetryableError semantics.
+ */
+export async function withRetry(fn, opts = {}, onRetry) {
+    const maxRetries = opts.maxRetries ?? 3;
+    const baseDelayMs = opts.baseDelayMs ?? 1000;
+    const maxDelayMs = opts.maxDelayMs ?? 30_000;
+    let lastErr;
+    for (let attempt = 0; attempt <= maxRetries; attempt++) {
+        try {
+            return await fn();
+        }
+        catch (err) {
+            lastErr = err;
+            const status = err.status;
+            const retryable = (typeof status === "number" && isRetryableStatus(status)) ||
+                (!(err instanceof NonRetryableError) && isRetryableNetworkError(err));
+            // Client errors (except 429) — fail immediately
+            if (typeof status === "number" && status >= 400 && status < 500 && status !== 429) {
+                throw err;
+            }
+            if (!retryable || attempt === maxRetries) {
+                throw err;
+            }
+            // Respect Retry-After header if present (seconds)
+            const retryAfter = err.retryAfterMs;
+            const jitter = Math.floor(Math.random() * 500);
+            const delay = Math.min(retryAfter ?? baseDelayMs * 2 ** attempt + jitter, maxDelayMs);
+            onRetry?.(attempt + 1, delay, status ? `HTTP ${status}` : String(err.message).slice(0, 80));
+            await sleep(delay);
+        }
+    }
+    throw lastErr; // unreachable
+}