s-app-scoder-agent 0.0.0-stage → 0.4.0

package/dist/tools.js

@@ -0,0 +1,361 @@
+import { readFileSync, writeFileSync, readdirSync, statSync, mkdirSync, realpathSync } from "node:fs";
+import { spawn } from "node:child_process";
+import { resolve, dirname, basename, join, relative, isAbsolute } from "node:path";
+import { unifiedDiff } from "./diff.js";
+import * as ui from "./ui.js";
+const MAX_OUTPUT_CHARS = 20_000;
+const MAX_FILE_SIZE_BYTES = 2 * 1024 * 1024; // refuse to read files > 2MB
+function clamp(s, max = MAX_OUTPUT_CHARS) {
+    if (s.length <= max)
+        return s;
+    return s.slice(0, max) + `\n... [truncated, ${s.length - max} more chars]`;
+}
+/** Resolve a user-supplied path inside workdir; reject escapes and symlink traversal. */
+function safePath(workdir, p) {
+    const abs = isAbsolute(p) ? resolve(p) : resolve(workdir, p);
+    // Lexical containment first (cheap): reject obvious ../ escapes.
+    const relLex = relative(workdir, abs);
+    if (relLex.startsWith("..") || isAbsolute(relLex)) {
+        throw new Error(`Path escapes working directory: ${p}`);
+    }
+    // Realpath containment: resolve symlinks so a link inside workdir pointing
+    // outside (e.g. evil-link -> /etc) cannot be used to read/write outside.
+    // macOS may present /tmp as /private/tmp — resolve workdir the same way.
+    let realWorkdir = workdir;
+    try {
+        realWorkdir = realpathSync(workdir);
+    }
+    catch (err) {
+        // workdir must exist; keep lexical fallback for a transient ENOENT,
+        // but surface unexpected failures instead of silently swallowing them.
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw new Error(`Cannot resolve working directory "${workdir}": ${err.message}`, { cause: err });
+        }
+    }
+    // Walk up to the nearest existing ancestor, then verify containment.
+    let probe = abs;
+    const missing = [];
+    for (;;) {
+        try {
+            const real = realpathSync(probe);
+            const reconstructed = real + missing.map((s) => `/${s}`).join("");
+            const rel = relative(realWorkdir, reconstructed.length > 0 ? reconstructed : real);
+            if (rel.startsWith("..") || isAbsolute(rel)) {
+                throw new Error(`Path escapes working directory: ${p}`);
+            }
+            return abs;
+        }
+        catch (err) {
+            if (err.code === "ENOENT" && probe !== dirname(probe)) {
+                missing.push(basename(probe));
+                probe = dirname(probe);
+                continue;
+            }
+            // realpath failed for another reason (e.g. escaped) — rethrow escape errors
+            throw err;
+        }
+    }
+}
+// ---------------------------------------------------------------------------
+// Tool implementations
+// ---------------------------------------------------------------------------
+/** Turn a sync tool step into a ToolResult, converting thrown errors (e.g. path escapes) into structured results. */
+function toResult(fn) {
+    try {
+        return fn();
+    }
+    catch (err) {
+        return { ok: false, output: `ERROR: ${err.message}` };
+    }
+}
+function toolReadFile(workdir, args) {
+    return toResult(() => {
+        const abs = safePath(workdir, args.path);
+        const st = statSync(abs);
+        if (st.isDirectory()) {
+            return { ok: false, output: `ERROR: ${args.path} is a directory — use list_files instead.` };
+        }
+        if (st.size > MAX_FILE_SIZE_BYTES) {
+            return {
+                ok: false,
+                output: `ERROR: ${args.path} is ${(st.size / 1024 / 1024).toFixed(1)}MB (limit ${MAX_FILE_SIZE_BYTES / 1024 / 1024}MB). Use run_command with grep/head/tail to inspect specific parts.`,
+            };
+        }
+        const content = readFileSync(abs, "utf8");
+        const lines = content.split("\n");
+        const numbered = lines.map((l, i) => `${i + 1}: ${l}`).join("\n");
+        return { ok: true, output: clamp(numbered) };
+    });
+}
+/** Shared permission/diff gate for file writes. Returns null = approved. */
+async function gateWrite(ctx, path, oldContent, newContent) {
+    const mode = ctx.permissionMode ?? "auto";
+    const diff = unifiedDiff(path, oldContent, newContent);
+    if (mode === "readonly") {
+        if (diff.text)
+            ui.printDiff(diff.text);
+        return {
+            ok: false,
+            output: `ERROR: readonly mode — write to ${path} denied. The diff above is shown for review only; nothing was written.`,
+        };
+    }
+    if (mode === "ask" && ctx.permissions) {
+        if (diff.text)
+            ui.printDiff(diff.text);
+        const allowed = await ctx.permissions.confirmEdit(path, diff.text);
+        if (!allowed) {
+            return { ok: false, output: `ERROR: user rejected the write to ${path}. Try a different approach or explain why it is needed.` };
+        }
+    }
+    else if (diff.text && !diff.truncated) {
+        ui.printDiff(diff.text);
+    }
+    else if (diff.truncated) {
+        ui.diffSummary(path, diff.added, diff.removed);
+    }
+    return null;
+}
+async function toolWriteFile(ctx, args) {
+    let abs;
+    try {
+        abs = safePath(ctx.workdir, args.path);
+    }
+    catch (err) {
+        return { ok: false, output: `ERROR: ${err.message}` };
+    }
+    let oldContent = null;
+    try {
+        oldContent = readFileSync(abs, "utf8");
+    }
+    catch {
+        // new file
+    }
+    const gate = await gateWrite(ctx, args.path, oldContent, args.content);
+    if (gate)
+        return gate;
+    mkdirSync(dirname(abs), { recursive: true });
+    writeFileSync(abs, args.content, "utf8");
+    return { ok: true, output: `Wrote ${args.content.split("\n").length} lines to ${args.path}` };
+}
+async function toolEditFile(ctx, args) {
+    let abs;
+    try {
+        abs = safePath(ctx.workdir, args.path);
+    }
+    catch (err) {
+        return { ok: false, output: `ERROR: ${err.message}` };
+    }
+    const content = readFileSync(abs, "utf8");
+    if (!content.includes(args.old_string)) {
+        return { ok: false, output: `old_string not found in ${args.path}. Read the file again and retry with exact text.` };
+    }
+    const count = content.split(args.old_string).length - 1;
+    if (count > 1) {
+        return { ok: false, output: `old_string matches ${count} locations in ${args.path}; include more surrounding context to make it unique.` };
+    }
+    // Function replacement: avoids JS $-pattern interpolation ($&, $', $`, $1…)
+    // which would corrupt literal text like "$&" in the new content.
+    const newContent = content.replace(args.old_string, () => args.new_string);
+    const gate = await gateWrite(ctx, args.path, content, newContent);
+    if (gate)
+        return gate;
+    writeFileSync(abs, newContent, "utf8");
+    return { ok: true, output: `Edited ${args.path}` };
+}
+function toolListFiles(workdir, args) {
+    return toResult(() => {
+        const root = safePath(workdir, args.path ?? ".");
+        const skip = new Set(["node_modules", ".git", "dist", "build", ".next", "__pycache__", ".venv"]);
+        const out = [];
+        const walk = (dir, depth) => {
+            if (depth > 4 || out.length > 500)
+                return;
+            let entries;
+            try {
+                entries = readdirSync(dir).sort();
+            }
+            catch {
+                return;
+            }
+            for (const e of entries) {
+                if (skip.has(e))
+                    continue;
+                const full = join(dir, e);
+                let st;
+                try {
+                    st = statSync(full);
+                }
+                catch {
+                    continue;
+                }
+                const rel = relative(workdir, full);
+                if (st.isDirectory()) {
+                    out.push(`${rel}/`);
+                    walk(full, depth + 1);
+                }
+                else {
+                    out.push(`${rel} (${st.size}b)`);
+                }
+                if (out.length > 500) {
+                    out.push("... [truncated]");
+                    return;
+                }
+            }
+        };
+        walk(root, 0);
+        return { ok: true, output: out.length > 0 ? clamp(out.join("\n")) : "(empty directory)" };
+    });
+}
+/**
+ * Run a shell command asynchronously (async spawn keeps the event loop free,
+ * so streaming output renders and SIGINT is handled promptly).
+ * Kills the child on timeout or external abort (SIGINT via ctx.signal).
+ */
+export async function toolRunCommand(workdir, args, signal) {
+    const timeoutMs = Math.min(Math.max(args.timeout_secs ?? 120, 1), 600) * 1000;
+    return new Promise((resolve) => {
+        let settled = false;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            signal?.removeEventListener("abort", onAbort);
+            resolve(result);
+        };
+        const child = spawn("/bin/sh", ["-c", args.command], {
+            cwd: workdir,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let killedReason = null;
+        const killChild = (reason) => {
+            killedReason = reason;
+            try {
+                child.kill("SIGTERM");
+            }
+            catch { /* already dead */ }
+            // SIGKILL fallback if the process ignores SIGTERM
+            setTimeout(() => {
+                try {
+                    if (child.exitCode === null)
+                        child.kill("SIGKILL");
+                }
+                catch { /* already dead */ }
+            }, 5_000).unref();
+        };
+        const timer = setTimeout(() => killChild("timeout"), timeoutMs);
+        const onAbort = () => killChild("aborted");
+        if (signal?.aborted)
+            onAbort();
+        else
+            signal?.addEventListener("abort", onAbort, { once: true });
+        child.stdout?.on("data", (c) => { stdout += c.toString("utf8"); });
+        child.stderr?.on("data", (c) => { stderr += c.toString("utf8"); });
+        child.on("error", (err) => {
+            finish({ ok: false, output: clamp(`$ ${args.command}\n(spawn error) ${err.message}`) });
+        });
+        child.on("close", (code) => {
+            if (killedReason === "timeout") {
+                finish({
+                    ok: false,
+                    output: clamp(`$ ${args.command}\n(command timed out after ${Math.round(timeoutMs / 1000)}s and was killed)\n--- stdout ---\n${stdout}\n--- stderr ---\n${stderr}`),
+                });
+                return;
+            }
+            if (killedReason === "aborted") {
+                finish({
+                    ok: false,
+                    output: clamp(`$ ${args.command}\n(interrupted by user)\n--- stdout ---\n${stdout}\n--- stderr ---\n${stderr}`),
+                });
+                return;
+            }
+            const status = code ?? -1;
+            if (status === 0) {
+                finish({ ok: true, output: clamp(`$ ${args.command}\n(exit 0)\n${stdout}`) });
+            }
+            else {
+                finish({
+                    ok: false,
+                    output: clamp(`$ ${args.command}\n(exit ${status})\n--- stdout ---\n${stdout}\n--- stderr ---\n${stderr}`),
+                });
+            }
+        });
+    });
+}
+const obj = (properties, required) => ({
+    type: "object",
+    properties,
+    required,
+    additionalProperties: false,
+});
+const str = (description) => ({ type: "string", description });
+export const AGENT_TOOLS = [
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "list_files",
+                description: "List files and directories recursively under a path in the working directory.",
+                parameters: obj({ path: str("Relative path, defaults to '.'") }, []),
+            },
+        },
+        run: (ctx, args) => toolListFiles(ctx.workdir, args),
+    },
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "read_file",
+                description: "Read a text file. Returns content with 1-based line numbers.",
+                parameters: obj({ path: str("Relative file path") }, ["path"]),
+            },
+        },
+        run: (ctx, args) => toolReadFile(ctx.workdir, args),
+    },
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "write_file",
+                description: "Create or overwrite a file with the given full content. Parent dirs are created automatically.",
+                parameters: obj({ path: str("Relative file path"), content: str("Full file content") }, ["path", "content"]),
+            },
+        },
+        run: (ctx, args) => toolWriteFile(ctx, args),
+    },
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "edit_file",
+                description: "Replace an exact unique substring in a file. old_string must appear exactly once; include enough surrounding context.",
+                parameters: obj({
+                    path: str("Relative file path"),
+                    old_string: str("Exact text to replace"),
+                    new_string: str("Replacement text"),
+                }, ["path", "old_string", "new_string"]),
+            },
+        },
+        run: (ctx, args) => toolEditFile(ctx, args),
+    },
+    {
+        spec: {
+            type: "function",
+            function: {
+                name: "run_command",
+                description: "Run a shell command (/bin/sh -c) in the working directory. Use for builds, tests, git, installing deps, etc.",
+                parameters: obj({
+                    command: str("Shell command to run"),
+                    timeout_secs: str("Timeout in seconds (default 120, max 600)"),
+                }, ["command"]),
+            },
+        },
+        run: (ctx, args) => toolRunCommand(ctx.workdir, args, ctx.signal),
+    },
+];
+export function getTool(name) {
+    return AGENT_TOOLS.find((t) => t.spec.function.name === name);
+}

package/dist/ui.js

@@ -0,0 +1,96 @@
+import process from "node:process";
+const RESET = "\x1b[0m";
+const BOLD = "\x1b[1m";
+const DIM = "\x1b[2m";
+const GREEN = "\x1b[32m";
+const YELLOW = "\x1b[33m";
+const RED = "\x1b[31m";
+const CYAN = "\x1b[36m";
+const BLUE = "\x1b[34m";
+function ts() {
+    return new Date().toISOString().slice(11, 23);
+}
+export function info(msg) {
+    console.log(`${DIM}[${ts()}]${RESET} ${msg}`);
+}
+export function step(stepNum, total, msg) {
+    console.log(`${BLUE}[${stepNum}/${total}]${RESET} ${BOLD}${msg}${RESET}`);
+}
+export function success(msg) {
+    console.log(`${GREEN}✓${RESET} ${GREEN}${msg}${RESET}`);
+}
+export function warn(msg) {
+    console.log(`${YELLOW}⚠${RESET} ${YELLOW}${msg}${RESET}`);
+}
+export function error(msg) {
+    console.error(`${RED}✗${RESET} ${RED}${msg}${RESET}`);
+}
+export function llm(prefix, content) {
+    console.log(`${CYAN}${prefix}:${RESET} ${content.slice(0, 300)}${content.length > 300 ? " ..." : ""}`);
+}
+export function toolCall(name, args) {
+    const a = Object.entries(args)
+        .map(([k, v]) => `${k}=${JSON.stringify(v)?.slice(0, 80)}`)
+        .join(" ");
+    console.log(`${CYAN}→ ${name}(${a})${RESET}`);
+}
+export function toolResult(name, ok, output) {
+    const preview = output.split("\n")[0]?.slice(0, 120) ?? "";
+    const icon = ok ? `${GREEN}✓${RESET}` : `${RED}✗${RESET}`;
+    console.log(`${icon} ${CYAN}${name}${RESET} → ${preview}`);
+}
+export function buildStatus(success, output) {
+    const icon = success ? `${GREEN}✓ BUILD SUCCESS` : `${RED}✗ BUILD FAILED`;
+    console.log(`\n${icon}${RESET}\n${output.split("\n").slice(-10).join("\n")}\n`);
+}
+export function header(msg) {
+    console.log(`\n${BOLD}${CYAN}── ${msg} ${"─".repeat(Math.max(2, 60 - msg.length))}${RESET}`);
+}
+// ── Streaming helpers ────────────────────────────────────────────────────────
+let _streamLine = "";
+let _streamColor = CYAN;
+let _streamPrefix = "";
+/** Start a streaming line. Call llmStreamChunk() for each delta, then llmStreamEnd(). */
+export function llmStreamStart(prefix = "assistant", color = CYAN) {
+    _streamLine = "";
+    _streamColor = color;
+    _streamPrefix = prefix;
+    process.stdout.write(`${color}${prefix}:${RESET} `);
+}
+/** Append a text delta to the current streaming line. */
+export function llmStreamChunk(delta) {
+    _streamLine += delta;
+    process.stdout.write(delta);
+}
+/** Finish the streaming line (append suffix + newline). */
+export function llmStreamEnd(suffix = "") {
+    const line = _streamLine;
+    _streamLine = "";
+    process.stdout.write(`${suffix}\n`);
+    return line;
+}
+// ── Diff rendering ───────────────────────────────────────────────────────────
+/** Print a unified diff with colors (+ green, - red, @@ cyan). */
+export function printDiff(diffText) {
+    for (const line of diffText.split("\n")) {
+        if (line.startsWith("+++") || line.startsWith("---")) {
+            console.log(`${BOLD}${line}${RESET}`);
+        }
+        else if (line.startsWith("+")) {
+            console.log(`${GREEN}${line}${RESET}`);
+        }
+        else if (line.startsWith("-")) {
+            console.log(`${RED}${line}${RESET}`);
+        }
+        else if (line.startsWith("@@")) {
+            console.log(`${CYAN}${line}${RESET}`);
+        }
+        else {
+            console.log(line);
+        }
+    }
+}
+/** Print a one-line diff summary: "✎ +12 -3 lines → src/foo.ts". */
+export function diffSummary(path, added, removed) {
+    console.log(`${CYAN}✎${RESET} ${BOLD}${path}${RESET} ${GREEN}+${added}${RESET} ${RED}-${removed}${RESET} lines`);
+}

package/dist/version.js

@@ -0,0 +1,18 @@
+/**
+ * Single source of truth for the package version and client name.
+ * Reads package.json at runtime (works both from src/ during dev and from
+ * dist/ in the published build), falling back to "0.0.0" for bundled builds.
+ */
+import { readFileSync } from "node:fs";
+import { dirname, resolve } from "node:path";
+import { fileURLToPath } from "node:url";
+const pkgPath = resolve(dirname(fileURLToPath(import.meta.url)), "../package.json");
+export const CLIENT_NAME = "app-scoder-agent";
+export function getVersion() {
+    try {
+        return JSON.parse(readFileSync(pkgPath, "utf8")).version ?? "0.0.0";
+    }
+    catch {
+        return "0.0.0";
+    }
+}

package/package.json

@@ -1,6 +1,53 @@
 {
   "name": "s-app-scoder-agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
-}
+  "version": "0.4.0",
+  "description": "Autonomous coding agent CLI - similar to opencode/cline/claude. Runs tasks until build succeeds.",
+  "type": "module",
+  "main": "dist/index.js",
+  "bin": {
+    "scoder": "dist/index.js"
+  },
+  "scripts": {
+    "build": "tsc",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test",
+    "start": "node dist/index.js",
+    "dev": "tsc --watch",
+    "typecheck": "tsc --noEmit",
+    "lint": "eslint src/",
+    "coverage": "npm run build && node --test --experimental-test-coverage test/*.test.mjs",
+    "test": "npm run build && node --test test/*.test.mjs && node test/run-e2e.mjs && node test/run-mcp-test.mjs"
+  },
+  "engines": {
+    "node": ">=18"
+  },
+  "keywords": [
+    "cli",
+    "agent",
+    "ai",
+    "coding-agent",
+    "llm"
+  ],
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/nbhson/app-scoder-agent.git"
+  },
+  "homepage": "https://github.com/nbhson/app-scoder-agent#readme",
+  "bugs": "https://github.com/nbhson/app-scoder-agent/issues",
+  "license": "MIT",
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/node": "^22.0.0",
+    "eslint": "^10.13.0",
+    "typescript": "^5.6.0",
+    "typescript-eslint": "^8.72.1"
+  }
+}