s-app-scoder-agent 0.3.0 → 0.4.0

package/dist/agent.js

@@ -43,6 +43,8 @@ export class Agent {
     sessionCreatedAt;
     currentTask = "";
     lastBuildResult = null;
+    /** Accumulated token usage across the current run (session state). */
+    usageTotals = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0 };
     mcp = null;
     /** Aborted when abort() is called — cancels in-flight LLM requests (SIGINT). */
     runSignal = new AbortController();
@@ -90,6 +92,55 @@ export class Agent {
         // terminate its child process immediately (long builds must be interruptible).
         this.ctx.signal = this.runSignal.signal;
     }
+    /** Push one tool-result message back into the conversation. */
+    pushToolResult(tc, content) {
+        this.messages.push({
+            role: "tool",
+            tool_call_id: tc.id,
+            name: tc.name,
+            content,
+        });
+    }
+    /**
+     * Handle a rejected tool call (unknown tool, policy denial, user denial):
+     * render the failure, log the event, and push an ERROR tool message so the
+     * LLM can react. Replaces the previously duplicated denied/deny/unknown blocks.
+     */
+    rejectToolCall(step, tc, output, logExtra) {
+        ui.toolResult(tc.name, false, output);
+        this.logger.log({ type: "tool", step, tool: tc.name, ok: false, ...logExtra });
+        this.pushToolResult(tc, output);
+    }
+    /**
+     * Record usage of one LLM call: render token counts, log an `llm_usage`
+     * event, and accumulate totals into session state.
+     */
+    recordLlmUsage(usage) {
+        if (!usage)
+            return;
+        const input = usage.prompt_tokens ?? 0;
+        const output = usage.completion_tokens ?? 0;
+        const cached = usage.cached_tokens ?? 0;
+        this.usageTotals.calls += 1;
+        this.usageTotals.inputTokens += input;
+        this.usageTotals.outputTokens += output;
+        this.usageTotals.cachedTokens += cached;
+        ui.info(`tokens: in=${usage.prompt_tokens ?? "?"} out=${usage.completion_tokens ?? "?"}`);
+        this.logger.log({
+            type: "llm_usage",
+            model: this.client.model,
+            provider: this.config.provider,
+            usage: {
+                input_tokens: input,
+                output_tokens: output,
+                cached_tokens: cached,
+            },
+        });
+    }
+    /** Reset per-run usage accumulation (called when a fresh run starts). */
+    resetUsageTotals() {
+        this.usageTotals = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0 };
+    }
     /**
      * One LLM turn: streaming if enabled (renders deltas live), with automatic
      * fallback to non-streaming when the provider/stream fails.
@@ -171,6 +222,7 @@ export class Agent {
         ui.info(`model=${this.client.model}  workdir=${this.config.workdir}  build="${buildCmd}"  maxSteps=${this.config.maxSteps}`);
         this.currentTask = task;
         this.resetRunSignal();
+        this.resetUsageTotals();
         this.messages = [
             {
                 role: "system",
@@ -199,6 +251,7 @@ export class Agent {
         const buildCmd = this.buildCmd;
         this.currentTask = `${this.currentTask}\n${task}`.trim();
         this.resetRunSignal();
+        this.resetUsageTotals();
         this.messages.push({ role: "user", content: task });
         try {
             await this.connectMcp();
@@ -217,6 +270,7 @@ export class Agent {
         this.sessionCreatedAt = session.createdAt;
         this.currentTask = session.task;
         this.resetRunSignal();
+        this.resetUsageTotals();
         this.messages = session.messages ?? [];
         ui.header(`RESUME ${session.id}`);
         ui.info(`previous task: ${session.task} (${session.steps} step(s) done)`);
@@ -262,19 +316,13 @@ export class Agent {
             });
             if (this.aborted)
                 break;
-            if (usage) {
-                ui.info(`tokens: in=${usage.prompt_tokens ?? "?"} out=${usage.completion_tokens ?? "?"}`);
-                this.logger.log({ type: "step", step: steps, usage });
-            }
-            else {
-                this.logger.log({ type: "step", step: steps });
-            }
+            this.recordLlmUsage(usage);
+            this.logger.log({ type: "step", step: steps });
             // No tool calls => assistant produced a text answer
             if (!message.tool_calls || message.tool_calls.length === 0) {
                 const text = message.content ?? "";
                 this.messages.push({ role: "assistant", content: text });
                 // If the assistant says it's done without building, force a build check.
-                // If the assistant says it's done without building, force a build check.
                 if (claimsCompletion(text) && steps < this.config.maxSteps) {
                     ui.info("agent claims completion -> verifying with build");
                     lastBuild = await this.checkBuild(buildCmd);
@@ -311,24 +359,12 @@ export class Agent {
                     args = tc.arguments ? JSON.parse(tc.arguments) : {};
                 }
                 catch {
-                    this.messages.push({
-                        role: "tool",
-                        tool_call_id: tc.id,
-                        name: tc.name,
-                        content: `ERROR: invalid JSON arguments: ${tc.arguments.slice(0, 200)}`,
-                    });
+                    this.pushToolResult(tc, `ERROR: invalid JSON arguments: ${tc.arguments.slice(0, 200)}`);
                     continue;
                 }
                 ui.toolCall(tc.name, args);
                 if (!tool && !(this.mcp?.hasTool(tc.name))) {
-                    ui.toolResult(tc.name, false, "unknown tool");
-                    this.logger.log({ type: "tool", step: steps, tool: tc.name, ok: false, error: "unknown tool" });
-                    this.messages.push({
-                        role: "tool",
-                        tool_call_id: tc.id,
-                        name: tc.name,
-                        content: `ERROR: unknown tool "${tc.name}". Available: ${AGENT_TOOLS.map((t) => t.spec.function.name).join(", ")}${this.mcp ? " + MCP tools (mcp__<server>__<tool>)" : ""}`,
-                    });
+                    this.rejectToolCall(steps, tc, `ERROR: unknown tool "${tc.name}". Available: ${AGENT_TOOLS.map((t) => t.spec.function.name).join(", ")}${this.mcp ? " + MCP tools (mcp__<server>__<tool>)" : ""}`, { error: "unknown tool" });
                     continue;
                 }
                 let result;
@@ -341,14 +377,7 @@ export class Agent {
                                 ok: false,
                                 output: `ERROR: command denied by permission policy (${decision.reason}): ${String(args.command).slice(0, 200)}`,
                             };
-                            ui.toolResult(tc.name, false, result.output);
-                            this.logger.log({ type: "tool", step: steps, tool: tc.name, args, ok: false, denied: decision.reason });
-                            this.messages.push({
-                                role: "tool",
-                                tool_call_id: tc.id,
-                                name: tc.name,
-                                content: result.output,
-                            });
+                            this.rejectToolCall(steps, tc, result.output, { args, denied: decision.reason });
                             continue;
                         }
                         if (decision.decision === "ask") {
@@ -358,14 +387,7 @@ export class Agent {
                                     ok: false,
                                     output: `ERROR: user denied permission to run: ${String(args.command).slice(0, 200)}`,
                                 };
-                                ui.toolResult(tc.name, false, result.output);
-                                this.logger.log({ type: "tool", step: steps, tool: tc.name, args, ok: false, denied: "user" });
-                                this.messages.push({
-                                    role: "tool",
-                                    tool_call_id: tc.id,
-                                    name: tc.name,
-                                    content: result.output,
-                                });
+                                this.rejectToolCall(steps, tc, result.output, { args, denied: "user" });
                                 continue;
                             }
                         }
@@ -406,12 +428,7 @@ export class Agent {
                 }
                 ui.toolResult(tc.name, result.ok, result.output);
                 stepToolResults.set(tc.id, { ok: result.ok, output: result.output });
-                this.messages.push({
-                    role: "tool",
-                    tool_call_id: tc.id,
-                    name: tc.name,
-                    content: summariseOutput(result.output),
-                });
+                this.pushToolResult(tc, summariseOutput(result.output));
             }
             // After a build-command run, treat success as the terminal condition.
             // Match the FULL build command (not just its first word): matching "npm"
@@ -456,6 +473,12 @@ export class Agent {
             lastBuild: lastBuild
                 ? { success: lastBuild.success, command: lastBuild.command, output: lastBuild.output.slice(0, 10_000) }
                 : null,
+            usage: {
+                llmCalls: this.usageTotals.calls,
+                inputTokens: this.usageTotals.inputTokens,
+                outputTokens: this.usageTotals.outputTokens,
+                cachedTokens: this.usageTotals.cachedTokens,
+            },
         }, this.sessionCreatedAt);
     }
     /** Explicitly verify the build (independent of what the LLM claims). */

package/dist/build.js

@@ -10,8 +10,9 @@ export function detectBuildCommand(workdir) {
             if (pkg.scripts?.build)
                 return "npm run build";
         }
-        catch {
-            // fall through
+        catch (err) {
+            // malformed package.json -> fall through to the other detectors
+            console.error(`⚠  cannot parse package.json (${err.message}) — build command detection degraded`);
         }
     }
     if (existsSync(resolve(workdir, "Makefile")))
@@ -26,10 +27,6 @@ export function detectBuildCommand(workdir) {
         return "npx tsc --noEmit";
     return null;
 }
-/**
- * Run the build command. This is the agent's stop condition:
- * exit code 0 == task complete.
- */
 /**
  * Run the build command. This is the agent's stop condition:
  * exit code 0 == task complete.

package/dist/config.js

@@ -11,8 +11,9 @@ function loadRcFile(workdir) {
             try {
                 return JSON.parse(readFileSync(p, "utf8"));
             }
-            catch {
-                // malformed rc file -> ignore
+            catch (err) {
+                // malformed rc file -> ignore it, but tell the user why their config is not applied
+                console.error(`⚠  ignoring malformed config file ${name}: ${err.message}`);
             }
         }
     }
@@ -28,6 +29,28 @@ function parseList(raw) {
         return [];
     return raw.filter((x) => typeof x === "string");
 }
+/** Validate the user-supplied pricing table; drop malformed entries with a warning. */
+function parsePricing(raw) {
+    if (raw === undefined)
+        return undefined;
+    if (typeof raw !== "object" || raw === null) {
+        console.error("⚠  ignoring invalid modelPricing in config (expected an object)");
+        return undefined;
+    }
+    const out = {};
+    for (const key of Object.keys(raw)) {
+        const p = raw[key];
+        if (typeof p === "object" && p !== null &&
+            typeof p.input === "number" && Number.isFinite(p.input) &&
+            typeof p.output === "number" && Number.isFinite(p.output)) {
+            out[key] = { input: p.input, output: p.output };
+        }
+        else {
+            console.error(`⚠  ignoring invalid modelPricing entry "${key}" (expected { input: number, output: number })`);
+        }
+    }
+    return out;
+}
 export function loadConfig(overrides = {}) {
     const workdir = overrides.workdir ?? process.cwd();
     const rc = loadRcFile(workdir);
@@ -74,6 +97,7 @@ export function loadConfig(overrides = {}) {
         stream: overrides.stream ?? (process.env.SCODER_STREAM !== "0" ? true : false),
         permissionMode: overrides.permissionMode ??
             parsePermissionMode(process.env.SCODER_PERMISSION ?? rc.permission ?? rc.permissions?.mode ?? "auto"),
+        modelPricing: parsePricing(rc.modelPricing),
     };
     // Secrets hygiene: warn if apiKey is set in the rc file (risk of accidental commit)
     if (rc.apiKey && !process.env.SCODER_NO_APIKEY_WARNING) {

package/dist/constants.js

@@ -0,0 +1,69 @@
+/**
+ * Central constants: model pricing for cost estimation.
+ *
+ * Prices are USD per 1M tokens (input / output), approximate list prices.
+ * They can be overridden per-project via the rc file:
+ *
+ *   .scoderrc.json:
+ *   { "modelPricing": { "my-model": { "input": 1.0, "output": 2.0 } } }
+ *
+ * Keys are matched as a PREFIX of the model name (case-insensitive), so
+ * "gpt-4o-mini" also covers "gpt-4o-mini-2024-07-18". More specific keys
+ * (longer prefix) win.
+ */
+/** Fallback price when a model is unknown (deliberately conservative, not zero). */
+export const DEFAULT_MODEL_PRICING = { input: 0.5, output: 1.5 };
+/** Approximate list prices, USD per 1M tokens. Longest matching prefix wins. */
+export const MODEL_PRICING = {
+    // OpenAI
+    "gpt-4o-mini": { input: 0.15, output: 0.6 },
+    "gpt-4o": { input: 2.5, output: 10 },
+    "gpt-4.1-mini": { input: 0.4, output: 1.6 },
+    "gpt-4.1": { input: 2, output: 8 },
+    "gpt-4-turbo": { input: 10, output: 30 },
+    "gpt-4": { input: 30, output: 60 },
+    "gpt-3.5-turbo": { input: 0.5, output: 1.5 },
+    "o1": { input: 15, output: 60 },
+    "o1-mini": { input: 1.1, output: 4.4 },
+    "o3-mini": { input: 1.1, output: 4.4 },
+    "o3": { input: 2, output: 8 },
+    "o4-mini": { input: 1.1, output: 4.4 },
+    // Anthropic
+    "claude-opus-4": { input: 15, output: 75 },
+    "claude-sonnet-4": { input: 3, output: 15 },
+    "claude-haiku-4": { input: 0.8, output: 4 },
+    "claude-3-7-sonnet": { input: 3, output: 15 },
+    "claude-3-5-sonnet": { input: 3, output: 15 },
+    "claude-3-5-haiku": { input: 0.8, output: 4 },
+    "claude-3-haiku": { input: 0.25, output: 1.25 },
+    "claude-3-opus": { input: 15, output: 75 },
+    // Popular local/OpenAI-compatible providers (mostly $0 or nominal)
+    "llama3": { input: 0, output: 0 },
+    "qwen": { input: 0, output: 0 },
+    "deepseek-chat": { input: 0.27, output: 1.1 },
+    "deepseek-reasoner": { input: 0.55, output: 2.19 },
+};
+/**
+ * Resolve the price table for a model, honouring user overrides.
+ * `overrides` maps model-name prefixes to pricing and always wins over the
+ * built-in table. Longest matching prefix wins (case-insensitive).
+ */
+export function resolveModelPricing(model, overrides = {}) {
+    const m = model.toLowerCase();
+    let best = null;
+    // Built-in table first (longest prefix wins), then overrides — an override
+    // with the SAME prefix length replaces the built-in entry.
+    for (const [key, pricing] of Object.entries(MODEL_PRICING)) {
+        const k = key.toLowerCase();
+        if (m.startsWith(k) && (!best || k.length > best.key.length)) {
+            best = { key: k, pricing };
+        }
+    }
+    for (const [key, pricing] of Object.entries(overrides)) {
+        const k = key.toLowerCase();
+        if (m.startsWith(k) && (!best || k.length >= best.key.length)) {
+            best = { key: k, pricing };
+        }
+    }
+    return best ? best.pricing : DEFAULT_MODEL_PRICING;
+}

package/dist/cost.js

@@ -0,0 +1,141 @@
+/**
+ * Usage & cost tracking (enterprise feature).
+ *
+ * Every LLM call writes an `llm_usage` event into the session JSONL log:
+ *   { ts, type: "llm_usage", model, provider, usage: { input_tokens, output_tokens, cached_tokens } }
+ *
+ * `scoder cost` reads those logs and aggregates tokens + estimated cost.
+ * All logic here is pure/filesystem-only so it stays unit-testable.
+ */
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join, resolve } from "node:path";
+import { resolveModelPricing } from "./constants.js";
+/** Extract `llm_usage` events from a list of raw log events. */
+export function extractUsageEvents(sessionId, events) {
+    const out = [];
+    for (const ev of events) {
+        if (ev.type !== "llm_usage")
+            continue;
+        const usage = (ev.usage ?? {});
+        const num = (v) => (typeof v === "number" && Number.isFinite(v) ? v : 0);
+        out.push({
+            ts: typeof ev.ts === "string" ? ev.ts : undefined,
+            sessionId,
+            model: typeof ev.model === "string" ? ev.model : "unknown",
+            provider: typeof ev.provider === "string" ? ev.provider : undefined,
+            inputTokens: num(usage.input_tokens ?? usage.prompt_tokens),
+            outputTokens: num(usage.output_tokens ?? usage.completion_tokens),
+            cachedTokens: num(usage.cached_tokens),
+        });
+    }
+    return out;
+}
+/** Cost of one usage event in USD (cached tokens are billed like input tokens here — provider-specific discounts are approximated by the price table). */
+export function estimateEventCost(ev, overrides = {}) {
+    const p = resolveModelPricing(ev.model, overrides);
+    return (ev.inputTokens / 1_000_000) * p.input + (ev.outputTokens / 1_000_000) * p.output;
+}
+/** Aggregate usage events into totals + estimated cost. */
+export function aggregateUsage(events, overrides = {}) {
+    const agg = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0, costUsd: 0 };
+    for (const ev of events) {
+        agg.calls += 1;
+        agg.inputTokens += ev.inputTokens;
+        agg.outputTokens += ev.outputTokens;
+        agg.cachedTokens += ev.cachedTokens;
+        agg.costUsd += estimateEventCost(ev, overrides);
+    }
+    agg.costUsd = Math.round(agg.costUsd * 10_000) / 10_000; // round to $0.0001
+    return agg;
+}
+/** Parse a JSONL log file into raw events (null if missing/unreadable). */
+export function readJsonlLog(path) {
+    let content;
+    try {
+        content = readFileSync(path, "utf8");
+    }
+    catch {
+        return null;
+    }
+    const events = [];
+    for (const line of content.split("\n")) {
+        if (!line.trim())
+            continue;
+        try {
+            events.push(JSON.parse(line));
+        }
+        catch {
+            // skip malformed lines
+        }
+    }
+    return events;
+}
+/** List all session log files, newest id first (ids sort chronologically). */
+export function listLogSessions(workdir) {
+    const dir = resolve(workdir, ".scoder/logs");
+    if (!existsSync(dir))
+        return [];
+    try {
+        return readdirSync(dir)
+            .filter((f) => f.endsWith(".jsonl"))
+            .map((f) => f.slice(0, -".jsonl".length))
+            .sort()
+            .reverse();
+    }
+    catch {
+        return [];
+    }
+}
+/** Load all usage events of a single session (or [] if no log). */
+export function loadSessionUsage(workdir, sessionId) {
+    const path = resolve(workdir, ".scoder/logs", `${sessionId}.jsonl`);
+    const events = readJsonlLog(path);
+    return events ? extractUsageEvents(sessionId, events) : [];
+}
+/**
+ * Collect usage for a selection of sessions:
+ *  - explicit id    -> that session
+ *  - "last n"       -> n most recent session logs
+ *  - all            -> every session log in the workdir
+ */
+export function collectUsage(workdir, opts = {}) {
+    let ids;
+    if (opts.sessionId) {
+        ids = [opts.sessionId];
+    }
+    else if (typeof opts.last === "number") {
+        const all = listLogSessions(workdir);
+        ids = all.slice(0, Math.max(0, opts.last));
+    }
+    else {
+        ids = listLogSessions(workdir);
+    }
+    return ids.map((id) => ({
+        sessionId: id,
+        aggregate: aggregateUsage(loadSessionUsage(workdir, id), opts.pricingOverrides),
+    }));
+}
+/** Render a human-readable cost report (also used by tests to assert output). */
+export function formatCostReport(sessionCosts) {
+    if (sessionCosts.length === 0) {
+        return "No LLM usage recorded. Run with --log-file (or SCODER_LOG_FILE=1) to record usage.";
+    }
+    const grand = { calls: 0, inputTokens: 0, outputTokens: 0, cachedTokens: 0, costUsd: 0 };
+    const lines = ["COST REPORT"];
+    for (const sc of sessionCosts) {
+        const a = sc.aggregate;
+        grand.calls += a.calls;
+        grand.inputTokens += a.inputTokens;
+        grand.outputTokens += a.outputTokens;
+        grand.cachedTokens += a.cachedTokens;
+        grand.costUsd += a.costUsd;
+        lines.push(`  ${sc.sessionId}  calls=${a.calls}  in=${a.inputTokens.toLocaleString("en-US")}  out=${a.outputTokens.toLocaleString("en-US")}  cached=${a.cachedTokens.toLocaleString("en-US")}  cost≈$${a.costUsd.toFixed(4)}`);
+    }
+    grand.costUsd = Math.round(grand.costUsd * 10_000) / 10_000;
+    lines.push(`TOTAL (${sessionCosts.length} session(s))  calls=${grand.calls}  in=${grand.inputTokens.toLocaleString("en-US")}  out=${grand.outputTokens.toLocaleString("en-US")}  cached=${grand.cachedTokens.toLocaleString("en-US")}  cost≈$${grand.costUsd.toFixed(4)}`);
+    return lines.join("\n");
+}
+/** Join a path under the workdir's log dir (exported for tests). */
+export function logFilePath(workdir, sessionId) {
+    return join(workdir, ".scoder/logs", `${sessionId}.jsonl`);
+}

package/dist/index.js

@@ -6,6 +6,7 @@ import { loadConfig } from "./config.js";
 import { Agent } from "./agent.js";
 import { listSessions, resolveSessionId, pruneSessions } from "./session.js";
 import { JsonlLogger } from "./logger.js";
+import { collectUsage, formatCostReport } from "./cost.js";
 import { getVersion as getPackageVersion } from "./version.js";
 import * as ui from "./ui.js";
 // Single source of truth: read version from package.json (see src/version.ts).
@@ -18,6 +19,8 @@ USAGE
   scoder list                      List saved sessions for this directory
   scoder resume <id|last> [task]   Resume a saved session (optionally with a follow-up task)
   scoder logs [id|last] [filter]   Print a session's JSONL log (requires --log-file runs)
+  scoder cost [--session <id>] [--last <n>]
+                                    Token usage & estimated cost from JSONL logs
   scoder --version | --help
 
 OPTIONS
@@ -33,6 +36,8 @@ OPTIONS
   --no-save                 Disable session auto-save to .scoder/sessions/
   --log-file                Write a JSONL event log to .scoder/logs/<session>.jsonl
                             (or set SCODER_LOG_FILE=1 / =/path/to/log.jsonl)
+  --session <id>            (cost) Aggregate usage of one specific session
+  --last <n>                (cost) Aggregate usage of the n most recent sessions
   -h, --help                Show this help
   -v, --version             Show version
 
@@ -96,6 +101,17 @@ function parseArgs(argv) {
             case "--log-file":
                 args.logFile = true;
                 break;
+            case "--session":
+                args.costSession = next();
+                break;
+            case "--last": {
+                const n = Number(next());
+                if (!Number.isFinite(n) || n < 1) {
+                    throw new Error(`Invalid --last value (expected a positive integer): ${n}`);
+                }
+                args.costLast = Math.floor(n);
+                break;
+            }
             case "--provider": {
                 const p = next();
                 if (p !== "openai" && p !== "anthropic") {
@@ -135,6 +151,10 @@ function parseArgs(argv) {
         args.logsId = rest[1] ?? "last";
         args.logsFilter = rest.length > 2 ? rest.slice(2).join(" ") : undefined;
     }
+    else if (rest[0] === "cost") {
+        args.subcommand = "cost";
+        args.task = null;
+    }
     return args;
 }
 async function runOnce(cfg, task) {
@@ -273,6 +293,15 @@ async function main() {
         }
         return;
     }
+    if (args.subcommand === "cost") {
+        const sessionCosts = collectUsage(cfg.workdir, {
+            sessionId: args.costSession,
+            last: args.costLast,
+            pricingOverrides: cfg.modelPricing,
+        });
+        console.log(formatCostReport(sessionCosts));
+        return;
+    }
     if (args.task) {
         const code = await runOnce(cfg, args.task);
         process.exit(code);

package/dist/llm.js

@@ -119,6 +119,16 @@ export class LlmClient {
         const choice = data.choices?.[0]?.message;
         if (!choice)
             throw new LlmError("LLM API returned no message in response");
+        // Extract cached prompt tokens when the provider reports them
+        // (OpenAI-style: usage.prompt_tokens_details.cached_tokens).
+        let usage;
+        if (data.usage) {
+            usage = { ...data.usage };
+            const details = usage.prompt_tokens_details;
+            if (usage.cached_tokens === undefined && typeof details?.cached_tokens === "number") {
+                usage.cached_tokens = details.cached_tokens;
+            }
+        }
         return {
             message: {
                 role: "assistant",
@@ -130,7 +140,7 @@ export class LlmClient {
                     arguments: tc.function?.arguments ?? "",
                 })),
             },
-            usage: data.usage,
+            usage,
         };
     }
     // ── Streaming ───────────────────────────────────────────────────────────────

package/dist/permissions.js

@@ -10,9 +10,30 @@ import { createInterface } from "node:readline";
 // Catastrophic command patterns — always denied, no exceptions
 // ---------------------------------------------------------------------------
 const CATASTROPHIC_PATTERNS = [
+    // rm -rf (original) — kept for backwards compatibility
     /rm\s+-rf\s+[/~"]|(?:rm\s+-rf\s+\/\*)/i,
-    /mkfs\b/i,
+    // rm with whitespace/flag variants: "rm  -rf /", "rm -fr /", "rm -r -f /",
+    // "rm --recursive --force /", "rm -rvf /" … i.e. any rm followed by one or
+    // more option flags and then a target at filesystem root or home.
+    // Does NOT match common safe commands: "rm -rf node_modules", "rm file.txt",
+    // "rm ./build" (target must START with / or ~).
+    /\brm\s+(?:-{1,2}[\w-]+\s+)+["']?[/~](?:\s|$|\/)/,
+    // rm with a single flag token containing both r/R and f (e.g. -fr, -Rf, -rvf)
+    // targeting / or ~ — covered above, but also catch "rm -fr --no-preserve-root".
+    /\brm\s+[^|;&>]*--no-preserve-root/i,
+    // base64/sh -c wrappers used to smuggle destructive commands past filters:
+    //   echo cm0gLXJmIC8= | base64 -d | sh
+    //   sh -c "rm -rf /"
+    /base64\s+(?:-d|-D|--decode)\b[^|;&]*\|\s*(?:ba|z|da)?sh\b/i,
+    /\b(?:ba|z|da)?sh\s+-c\s+["'][^"']*\brm\s+[^"']*\s-[a-zA-Z]*[rf]/i,
+    // Filesystem destruction
+    /\bmkfs(?:\.[a-z0-9]+)?\b/i,
     /dd\s+.*of=\//i,
+    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
+    // chmod -R 777 on / or ~ (any flag spelling: -R, -r, -Rf, --recursive)
+    /\bchmod\s+(?:-{1,2}[\w-]+\s+)+[0-7]{3,4}\s+["']?[/~](?:\s|$|\/)/,
+    // Redirect raw writes to block devices: > /dev/sda, > /dev/nvme0n1, dd > disk...
+    />\s*\/dev\/(?:sd[a-z]+|hd[a-z]+|nvme\d+n\d+(?:p\d+)?|disk\d|rdisk\d)/i,
     /:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;/i,
     // curl/wget pipe-to-shell: match any content between command and '| sh'/'| bash'
     // Handles -qO-, -X POST, etc. flags; URL-like patterns must contain '/' or '.'
@@ -20,9 +41,9 @@ const CATASTROPHIC_PATTERNS = [
     /curl\s+.*[/.].*\s*\|\s*bash\b/i,
     /wget\s+.*[/.].*\s*\|\s*sh\b/i,
     /wget\s+.*[/.].*\s*\|\s*bash\b/i,
-    /sudo\s+rm\s+-rf/i,
+    // sudo rm with any recursive/force flag combo: "sudo rm -rf x", "sudo rm -fr /usr"
+    /sudo\s+rm\s+[^|;&]*-\w*[rR]/i,
     /\bshutdown\b|\breboot\b|\binit\s+[06]\b/i,
-    /chmod\s+-R\s+0[77][07][07]\s+[/~]/i,
     />\s*\/dev\/sda/i,
     /\|\s*nc\s+-e\s+/i,
     /\|\s*bash\s+-i/i,

package/dist/provider-anthropic.js

@@ -72,16 +72,20 @@ export function fromAnthropicResponse(data) {
             });
         }
     }
+    const usage = {
+        prompt_tokens: data.usage?.input_tokens,
+        completion_tokens: data.usage?.output_tokens,
+    };
+    if (typeof data.usage?.cache_read_input_tokens === "number") {
+        usage.cached_tokens = data.usage.cache_read_input_tokens;
+    }
     return {
         message: {
             role: "assistant",
             content: text.length > 0 ? text : null,
             tool_calls: toolCalls.length > 0 ? toolCalls : undefined,
         },
-        usage: {
-            prompt_tokens: data.usage?.input_tokens,
-            completion_tokens: data.usage?.output_tokens,
-        },
+        usage,
     };
 }
 // ---------------------------------------------------------------------------
@@ -216,6 +220,9 @@ export class AnthropicClient {
                         prompt_tokens: ev.message.usage.input_tokens,
                         completion_tokens: ev.message.usage.output_tokens,
                     };
+                    if (typeof ev.message.usage.cache_read_input_tokens === "number") {
+                        usage.cached_tokens = ev.message.usage.cache_read_input_tokens;
+                    }
                 }
                 return null;
             }
@@ -252,6 +259,9 @@ export class AnthropicClient {
                         prompt_tokens: usage?.prompt_tokens ?? ev.usage.input_tokens,
                         completion_tokens: ev.usage.output_tokens ?? usage?.completion_tokens,
                     };
+                    if (usage?.cached_tokens === undefined && typeof ev.usage.cache_read_input_tokens === "number") {
+                        usage = { ...usage, cached_tokens: ev.usage.cache_read_input_tokens };
+                    }
                 }
                 return null;
             }

package/dist/tools.js

@@ -25,8 +25,13 @@ function safePath(workdir, p) {
     try {
         realWorkdir = realpathSync(workdir);
     }
-    catch {
-        // workdir must exist; keep lexical fallback
+    catch (err) {
+        // workdir must exist; keep lexical fallback for a transient ENOENT,
+        // but surface unexpected failures instead of silently swallowing them.
+        const code = err.code;
+        if (code !== "ENOENT") {
+            throw new Error(`Cannot resolve working directory "${workdir}": ${err.message}`, { cause: err });
+        }
     }
     // Walk up to the nearest existing ancestor, then verify containment.
     let probe = abs;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "s-app-scoder-agent",
-  "version": "0.3.0",
+  "version": "0.4.0",
   "description": "Autonomous coding agent CLI - similar to opencode/cline/claude. Runs tasks until build succeeds.",
   "type": "module",
   "main": "dist/index.js",
@@ -9,6 +9,8 @@
   },
   "scripts": {
     "build": "tsc",
+    "prepare": "npm run build",
+    "prepublishOnly": "npm run lint && npm run typecheck && npm test",
     "start": "node dist/index.js",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit",
@@ -48,4 +50,4 @@
     "typescript": "^5.6.0",
     "typescript-eslint": "^8.72.1"
   }
-}
+}