s-app-scoder-agent 0.8.20 → 0.9.2

package/dist/agents-guide.js

@@ -0,0 +1,201 @@
+/**
+ * v2 (3.2): AGENTS.md hierarchy — project/global conventions injected into
+ * the system prompt instead of being rediscovered every run.
+ *
+ * Sources (in order of increasing specificity):
+ *   1. ~/.scoder/AGENTS.md        — user-global conventions
+ *   2. <workdir>/AGENTS.md        — repo root conventions
+ *   3. <dir>/AGENTS.md            — nearest file walking up from each focus
+ *      file mentioned in the task (e.g. src/tui/app.tsx → src/tui/, src/, root)
+ *
+ * Budgets: global + root ≤ 1200 chars each, nested ≤ 800 chars each,
+ * total block ≤ 4000 chars. Content is wrapped in a clearly-delimited block
+ * and marked "(project conventions — apply unless the task says otherwise)".
+ */
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { homedir } from "node:os";
+import { basename, dirname, join, normalize, relative, resolve, sep } from "node:path";
+const GLOBAL_BUDGET = 1200;
+const ROOT_BUDGET = 1200;
+const NESTED_BUDGET = 800;
+const TOTAL_BUDGET = 4000;
+function readBudget(file, budget) {
+    try {
+        const st = statSync(file);
+        if (!st.isFile())
+            return null;
+        const raw = readFileSync(file, "utf8").trim();
+        if (!raw)
+            return null;
+        return raw.length <= budget ? raw : `${raw.slice(0, budget)}\n… [truncated — ${raw.length - budget} more chars]`;
+    }
+    catch {
+        return null;
+    }
+}
+const ROOT_NAMES = ["AGENTS.md", "AGENTS.local.md"];
+function rootGuide(workdir) {
+    const out = [];
+    const globalFile = join(homedir(), ".scoder", "AGENTS.md");
+    const global = readBudget(globalFile, GLOBAL_BUDGET);
+    if (global)
+        out.push({ source: globalFile, content: global });
+    for (const name of ROOT_NAMES) {
+        const f = join(workdir, name);
+        const content = readBudget(f, ROOT_BUDGET);
+        if (content) {
+            out.push({ source: f, content });
+            break;
+        }
+    }
+    return out;
+}
+/** Nearest AGENTS.md at or above `focusFile`, stopping at workdir root. */
+function nearestGuide(workdir, focusFile) {
+    let dir = dirname(resolve(workdir, focusFile));
+    const rootAbs = resolve(workdir);
+    for (;;) {
+        const root = normalize(rootAbs);
+        const current = normalize(dir);
+        if (current !== root && !current.startsWith(`${root}${sep}`))
+            return null;
+        for (const name of ROOT_NAMES) {
+            const f = join(dir, name);
+            const content = readBudget(f, NESTED_BUDGET);
+            if (content)
+                return { source: f, content };
+        }
+        if (normalize(dir) === normalize(rootAbs))
+            return null;
+        const parent = dirname(dir);
+        if (parent === dir)
+            return null;
+        dir = parent;
+    }
+}
+/** Extract path-like tokens from a task description (relative file mentions). */
+export function extractFocusFiles(task, workdir) {
+    const FILE_EXTS = new Set([
+        "ts", "tsx", "js", "jsx", "mjs", "cjs", "py", "go", "rs", "java", "rb", "php", "cs",
+        "json", "yaml", "yml", "toml", "md", "sql", "sh", "css", "scss", "vue", "svelte", "html",
+    ]);
+    const out = new Set();
+    const rx = /(?:\.\.?\/|[\w-]+\/)*[\w-]+\.[A-Za-z][\w]{0,9}/g;
+    for (const m of task.matchAll(rx)) {
+        const p = m[0];
+        const ext = p.slice(p.lastIndexOf(".") + 1).toLowerCase();
+        if (!FILE_EXTS.has(ext))
+            continue;
+        if (/^https?:/i.test(p))
+            continue;
+        const abs = resolve(workdir, p);
+        const rel = relative(workdir, abs);
+        if (rel.startsWith("..") || /^[a-zA-Z]:/.test(rel))
+            continue;
+        if (existsSync(abs))
+            out.add(rel.split(sep).join("/"));
+        if (out.size >= 5)
+            break;
+    }
+    return [...out];
+}
+/**
+ * Collect the AGENTS.md chain for a task. `focusFiles` are relative paths
+ * (typically extracted via extractFocusFiles). Order: global → root → nearest
+ * nested (deduped by source). Total size capped at TOTAL_BUDGET.
+ */
+export function collectAgentGuides(workdir, focusFiles = []) {
+    const guides = [];
+    const seen = new Set();
+    const push = (g) => {
+        if (seen.has(g.source))
+            return false;
+        seen.add(g.source);
+        guides.push(g);
+        return true;
+    };
+    for (const g of rootGuide(workdir))
+        push(g);
+    for (const f of focusFiles) {
+        const g = nearestGuide(workdir, f);
+        if (g)
+            push(g);
+    }
+    // Total budget cap — drop the oldest (least specific) first.
+    let total = guides.reduce((n, g) => n + g.content.length, 0);
+    while (guides.length > 1 && total > TOTAL_BUDGET) {
+        const dropped = guides.shift();
+        if (!dropped)
+            break;
+        total -= dropped.content.length;
+    }
+    return guides;
+}
+/**
+ * Template written by /init — AGENTS.md starter. Detects project identity and
+ * build/test commands from common manifest files; falls back to placeholders.
+ */
+export function agentsMdTemplate(workdir) {
+    let name = basename(workdir);
+    let build = "npm run build";
+    let test = "npm test";
+    try {
+        const pkg = JSON.parse(readFileSync(join(workdir, "package.json"), "utf8"));
+        if (pkg.name)
+            name = pkg.name;
+        if (pkg.scripts?.build)
+            build = "npm run build";
+        if (pkg.scripts?.test)
+            test = "npm test";
+    }
+    catch {
+        // not a node project — keep generic placeholders
+        if (existsSync(join(workdir, "go.mod"))) {
+            build = "go build ./...";
+            test = "go test ./...";
+        }
+        else if (existsSync(join(workdir, "Cargo.toml"))) {
+            build = "cargo build";
+            test = "cargo test";
+        }
+        else if (existsSync(join(workdir, "pyproject.toml"))) {
+            build = "python -m compileall .";
+            test = "pytest";
+        }
+        else if (existsSync(join(workdir, "Makefile"))) {
+            build = "make";
+            test = "make test";
+        }
+    }
+    return `# ${name} — AGENTS.md
+
+Conventions for AI coding agents working in this repository. Keep this file
+accurate: update it when the build, tests, or architecture change.
+
+## Project overview
+<!-- One paragraph: what this project is, its main stack, and its layout. -->
+
+## Commands
+- Build: \`${build}\`
+- Test: \`${test}\`
+- Lint / typecheck: <!-- e.g. npm run lint && npm run typecheck -->
+
+## Architecture map
+<!-- Where the important things live: entry points, modules, data flow. -->
+
+## Conventions
+<!-- Code style, error-handling patterns, naming, test style, commit style. -->
+
+## Guardrails
+<!-- What agents must never do here (generated files, migrations, secrets…). -->
+`;
+}
+/** Format the AGENTS.md block for the system prompt ("" when nothing found). */
+export function buildAgentGuideBlock(workdir, task) {
+    const guides = collectAgentGuides(workdir, extractFocusFiles(task, workdir));
+    if (guides.length === 0)
+        return "";
+    const parts = guides.map((g) => `--- ${relative(workdir, g.source).split(sep).join("/") || g.source} ---\n${g.content}`);
+    return (`\n\nAGENTS.md (project conventions — apply unless the task explicitly says otherwise):\n` +
+        parts.join("\n\n"));
+}

package/dist/agents.js

@@ -1,14 +1,29 @@
 /**
- * Agents (I-06) — .scoder/agents/<name>.md definitions + built-ins.
+ * Agents (I-06 + v2 profiles) — .scoder/agents/<name>.md definitions + built-ins.
  *
  * Frontmatter semantics from opencode /v2/docs/agents (concept only —
  * prompt bodies are scoder's own). An agent def is: description, mode
- * (primary|subagent|all), model override, steps, prompt body.
+ * (primary|subagent|all), model override, steps, prompt body — plus v2:
+ * tool whitelist, permission mode, temperature, reasoning, maxTokens,
+ * skills pre-staging, color.
  */
 import { existsSync, readFileSync, readdirSync } from "node:fs";
 import { homedir } from "node:os";
 import { join } from "node:path";
 import { parseFrontmatter } from "./skills.js";
+/** Read-only tools an agent may use — mutating specs are filtered out. */
+export const READ_ONLY_TOOL_SPECS = [
+    "read_file",
+    "list_files",
+    "grep",
+    "glob",
+    "repo_map",
+    "web_fetch",
+    "load_skill",
+    "write_todos",
+];
+/** Specs a readonly primary/subagent never sees (defense in depth vs permission alone). */
+export const MUTATING_TOOL_SPECS = ["write_file", "edit_file", "apply_patch", "run_command"];
 /** Built-in agents — lowest priority; .md files override by name. */
 export const BUILTIN_AGENTS = [
     {
@@ -22,14 +37,41 @@ export const BUILTIN_AGENTS = [
         description: "Read-only planner — investigates and proposes an implementation plan, never edits code.",
         mode: "primary",
         prompt: "You are a planning agent. Investigate the codebase (read files, search, list) and produce a concrete, step-by-step implementation plan. You MUST NOT modify any files or run mutating commands — report the plan and stop. Structure: goal, findings (files/lines), plan steps ordered, risks, and the exact first step to take.",
+        permission: "readonly",
+        tools: READ_ONLY_TOOL_SPECS,
+        reasoning: "on",
     },
     {
         name: "explore",
         description: "Read-only subagent — searches and summarizes the codebase, returns findings.",
         mode: "subagent",
         prompt: "You are an exploration subagent. Answer the given question about this codebase using read-only tools (list_files, read_file, run_command with read-only commands). Be terse and factual; cite file paths. Do not modify anything.",
+        permission: "readonly",
+        tools: READ_ONLY_TOOL_SPECS,
+    },
+    {
+        name: "review",
+        description: "Code reviewer — reviews diffs for correctness, security and style. Never edits.",
+        mode: "all",
+        prompt: "You are a code review agent. Review the requested diff or files for correctness bugs, security issues, and violations of the project's conventions. Use read-only tools only. Report findings as a ranked list: [blocking] / [important] / [nit] with file:line citations and a concrete fix for each. End with an overall verdict: APPROVE / REQUEST CHANGES / NEEDS DISCUSSION. Do NOT modify any files.",
+        permission: "readonly",
+        tools: READ_ONLY_TOOL_SPECS,
     },
 ];
+const parsePermissions = (v) => v === "auto" || v === "ask" || v === "readonly" ? v : undefined;
+const parseReasoning = (v) => v === "off" || v === "on" ? v : undefined;
+const parseList = (v) => {
+    if (!v)
+        return undefined;
+    const out = (Array.isArray(v) ? v : v.split(",")).map((s) => String(s).trim()).filter(Boolean);
+    return out.length > 0 ? out : undefined;
+};
+const parseNumber = (v) => {
+    if (v === undefined)
+        return undefined;
+    const n = Number(v);
+    return Number.isFinite(n) ? n : undefined;
+};
 /** Scan .scoder/agents/*.md (project) + ~/.scoder/agents/*.md (global). */
 export function discoverAgents(workdir) {
     const out = new Map();
@@ -51,10 +93,18 @@ export function discoverAgents(workdir) {
                     description: meta.description ?? "",
                     mode: mode,
                     model: meta.model || undefined,
-                    steps: meta.steps ? Number(meta.steps) || undefined : undefined,
+                    steps: parseNumber(meta.steps),
                     prompt: body,
                     hidden: meta.hidden === "true",
                     disabled: meta.disabled === "true",
+                    tools: parseList(meta.tools),
+                    permission: parsePermissions(meta.permission),
+                    temperature: parseNumber(meta.temperature),
+                    reasoning: parseReasoning(meta.reasoning),
+                    // frontmatter keys are lowercased by parseFrontmatter
+                    maxTokens: parseNumber(meta.maxtokens),
+                    skills: parseList(meta.skills),
+                    color: meta.color || undefined,
                 });
             }
             catch {
@@ -68,3 +118,26 @@ export function discoverAgents(workdir) {
 export function findAgent(workdir, name) {
     return discoverAgents(workdir).find((a) => a.name === name) ?? null;
 }
+/** Primary agents user-selectable via --agent / /agent (mode primary|all). */
+export function selectableAgents(workdir) {
+    return discoverAgents(workdir).filter((a) => a.mode !== "subagent" && !a.hidden);
+}
+/**
+ * v2: filter a tool list for an agent def.
+ *  - def.tools set → whitelist (unknown names dropped, reported by caller);
+ *  - def.permission "readonly" → drop mutating specs (defense in depth);
+ *  - otherwise the list is unchanged.
+ */
+export function filterToolNamesForDef(names, def) {
+    if (!def)
+        return names;
+    if (def.tools && def.tools.length > 0) {
+        const allow = new Set(def.tools.map((t) => t.toLowerCase()));
+        return names.filter((n) => allow.has(n.toLowerCase()));
+    }
+    if (def.permission === "readonly") {
+        const blocked = new Set(MUTATING_TOOL_SPECS);
+        return names.filter((n) => !blocked.has(n.toLowerCase()));
+    }
+    return names;
+}

package/dist/compaction.js

@@ -79,11 +79,16 @@ export function extractSummaryInput(task, messages) {
         lines.push(`Files modified: ${[...files].join(", ")}`);
     return lines.join("\n");
 }
-/** Message sent to the summarizer LLM. */
+/** Message sent to the summarizer LLM (v2: structured template, not prose). */
 export const COMPACTION_INSTRUCTION = "Summarize the conversation above for a coding agent that will CONTINUE this task. " +
-    "Include: (1) the original task, (2) what has been done so far and why, " +
-    "(3) files created/modified, (4) current build/test state, (5) exact next steps. " +
-    "Be factual and terse. Max 300 words.";
+    "Use a STRUCTURED template with exactly these sections (skip a section only if empty):\n" +
+    "GOAL: one line — the original task.\n" +
+    "STATE: what is done and what is not (build/test status).\n" +
+    "CHANGED: files created/modified and why.\n" +
+    "DECISIONS: decisions made and their rationale (keep every decision).\n" +
+    "FAILURES: errors hit and what did NOT work (so they are not repeated).\n" +
+    "NEXT: the exact next steps, in order.\n" +
+    "Be factual and terse — max 400 words. Preserve file paths, commands and error codes verbatim.";
 /** Build the post-compaction message list. */
 export function applyCompaction(messages, summary, cfg) {
     const cut = findCutIndex(messages, cfg);
@@ -104,6 +109,9 @@ export function applyCompaction(messages, summary, cfg) {
                     arguments: tc.arguments.length > 120 ? tc.arguments.slice(0, 120) + "…" : tc.arguments,
                 })),
             });
+            for (const tc of m.tool_calls) {
+                skeletons.push({ role: "tool", tool_call_id: tc.id, content: "[compacted — tool result omitted]" });
+            }
         }
     }
     const summaryMsg = {

package/dist/config.js

@@ -53,6 +53,9 @@ function mergeRc(global, project) {
     if (global.mcpServers || project.mcpServers) {
         merged.mcpServers = { ...global.mcpServers, ...project.mcpServers };
     }
+    if (global.routing || project.routing) {
+        merged.routing = { ...global.routing, ...project.routing };
+    }
     if (global.modelPricing || project.modelPricing) {
         merged.modelPricing = { ...global.modelPricing, ...project.modelPricing };
     }
@@ -66,6 +69,7 @@ function mergeRc(global, project) {
             mode: project.permissions?.mode ?? global.permissions?.mode,
             allowCommands: concat(global.permissions?.allowCommands, project.permissions?.allowCommands),
             denyCommands: concat(global.permissions?.denyCommands, project.permissions?.denyCommands),
+            rules: concat(global.permissions?.rules, project.permissions?.rules),
         };
     }
     return merged;
@@ -176,7 +180,7 @@ export function loadConfig(overrides = {}) {
             process.env.OPENAI_API_KEY ??
             rc.apiKey ??
             "",
-        model: overrides.model ?? process.env.SCODER_MODEL ?? process.env.OPENAI_MODEL ?? rc.model ?? (modelFromSlash || (isAnthropic ? ANTHROPIC_DEFAULT_MODEL : DEFAULT_MODEL)),
+        model: modelFromSlash || (overrides.model ?? process.env.SCODER_MODEL ?? process.env.OPENAI_MODEL ?? rc.model ?? (isAnthropic ? ANTHROPIC_DEFAULT_MODEL : DEFAULT_MODEL)),
         providerDef,
         contextWindow: providerDef?.contextWindow,
         workdir,
@@ -208,6 +212,12 @@ export function loadConfig(overrides = {}) {
         sandbox: rc.sandbox,
         limits: parseLimits(rc.limits),
         snapshots: rc.snapshots,
+        agent: overrides.agent ?? process.env.SCODER_AGENT ?? rc.agent,
+        routing: rc.routing,
+        repoMap: rc.repoMap,
+        promptVersion: rc.promptVersion,
+        verifyCmds: rc.verifyCmds,
+        selfReview: rc.selfReview,
         modelPricing: parsePricing(rc.modelPricing),
     };
     // Secrets hygiene: warn if apiKey is set in the rc file (risk of accidental commit)
@@ -266,7 +276,11 @@ export function loadSavedApprovals(workdir) {
     if (!existsSync(p))
         return [];
     try {
-        return parsePermissionRules(JSON.parse(readFileSync(p, "utf8")), p) ?? [];
+        const raw = JSON.parse(readFileSync(p, "utf8"));
+        const rules = raw && typeof raw === "object" && !Array.isArray(raw) && "rules" in raw
+            ? raw.rules
+            : raw;
+        return parsePermissionRules(rules, p) ?? [];
     }
     catch {
         return [];

package/dist/context.js

@@ -1,13 +1,24 @@
 import { encode } from "gpt-tokenizer";
-import { readFileSync, readdirSync, statSync } from "node:fs";
-import { resolve } from "node:path";
+import { readFileSync, readdirSync, statSync, realpathSync } from "node:fs";
+import { resolve, relative, isAbsolute } from "node:path";
 const MAX_MESSAGES = 120; // keep history under control for long runs
 /**
- * Total history token budget (I-10: token-accurate via gpt-tokenizer, thay
- * char heuristic 100k chars ≈ 25k tokens). Conservative: system prompt +
- * tool defs + reply buffer chiếm phần còn lại của contextWindow.
+ * Default history token budget when compaction is disabled (I-10:
+ * token-accurate via gpt-tokenizer, thay char heuristic 100k chars ≈ 25k
+ * tokens). Conservative: system prompt + tool defs + reply buffer chiếm phần
+ * còn lại của contextWindow.
  */
-const MAX_HISTORY_TOKENS = 90_000;
+export const MAX_HISTORY_TOKENS = 90_000;
+/**
+ * Fraction of the model context window where mechanical trim starts when
+ * compaction is enabled. Must stay ABOVE the compaction trigger (default
+ * 0.8) so semantic compaction gets a chance to run first.
+ */
+export const HISTORY_TRIM_FRACTION = 0.95;
+/** Mechanical trim budget for a given context window (floor 2k). */
+export function historyTokenBudget(contextWindow) {
+    return Math.max(2_000, Math.floor(contextWindow * HISTORY_TRIM_FRACTION));
+}
 /** Tool results older than this many recent tool messages get pruned. */
 const KEEP_RECENT_TOOL_RESULTS = 20;
 /** Token count for one message (tool_calls arguments included). Never throws. */
@@ -25,16 +36,19 @@ function messageTokens(m) {
 }
 const historyTokens = (msgs) => msgs.reduce((n, m) => n + messageTokens(m), 0);
 /**
- * Trim message history to stay within token budget. Layered strategy
+ * Trim message history to stay within a token budget. Layered strategy
  * (context engineering — inspired by compaction patterns, from scratch):
  *   1. Message-count cap: keep system + newest MAX_MESSAGES-1.
  *   2. Token budget: drop the OLDEST WHOLE TURNS (from a user message up to
- *      the next user message) until under MAX_HISTORY_TOKENS — dropping whole
+ *      the next user message) until under `maxTokens` — dropping whole
  *      turns never orphans an assistant tool_calls / tool result pair.
  *   3. Old tool results (outside the recent window) are pruned in place to a
  *      short placeholder — their content dominated the budget anyway.
+ *
+ * `maxTokens` defaults to the legacy 90k cap; callers with compaction enabled
+ * pass `historyTokenBudget(contextWindow)` so trim runs *after* compaction.
  */
-export function trimHistory(messages) {
+export function trimHistory(messages, maxTokens = MAX_HISTORY_TOKENS) {
     let out = messages;
     // 1) Message-count cap
     if (out.length > MAX_MESSAGES) {
@@ -43,7 +57,7 @@ export function trimHistory(messages) {
         out = system ? [system, ...rest.slice(-(MAX_MESSAGES - 1))] : rest.slice(-(MAX_MESSAGES - 1));
     }
     // 2) Token budget — drop oldest whole turns, never the system message
-    while (out.length > 2 && historyTokens(out) > MAX_HISTORY_TOKENS) {
+    while (out.length > 2 && historyTokens(out) > maxTokens) {
         const firstIdx = out[0].role === "system" ? 1 : 0;
         if (out[firstIdx]?.role !== "user")
             break; // no clean turn boundary — stop
@@ -123,7 +137,19 @@ export function expandMentions(task, workdir) {
         if (idx >= 0)
             out = (out.slice(0, idx) + " " + out.slice(idx + token.length)).replace(/ {2,}/g, " ");
         const abs = resolve(workdir, path);
-        if (!abs.startsWith(resolve(workdir))) {
+        const root = resolve(workdir);
+        const lexical = relative(root, abs);
+        let contained = !lexical.startsWith("..") && !isAbsolute(lexical);
+        try {
+            const realRoot = realpathSync(root);
+            const realAbs = realpathSync(abs);
+            const realRel = relative(realRoot, realAbs);
+            contained = contained && !realRel.startsWith("..") && !isAbsolute(realRel);
+        }
+        catch {
+            // Missing paths are retained as a diagnostic; existing paths are checked above.
+        }
+        if (!contained) {
             blocks.push(`@${path}: path escapes working directory — skipped.`);
             continue;
         }