saeeol 1.4.2 → 1.4.4

package/src/overlay/tool/bash-security.ts

@@ -1,6 +0,0 @@
-/**
- * Bash security validator — re-exported from @saeeol/boxes
- * Original 2-file module (patterns + validator) → single atom
- */
-export { validate, isCommandSafe, getSecurityReport } from "@/boxes/bash-security"
-export type { SecurityResult } from "@/boxes/bash-security"

package/src/overlay/tool/encoded-io.ts

@@ -1,19 +0,0 @@
-import { Effect } from "effect"
-import * as Encoding from "../encoding"
-
-/**
- * Effect wrappers around {@link Encoding.read} and {@link Encoding.write} so
- * tool code can preserve file encoding without leaking Node/async boilerplate
- * into each call site. Uses {@link Effect.tryPromise} so I/O failures surface
- * as typed errors that can be recovered with `.pipe(Effect.catch(...))`.
- *
- * Consumers should import this module as a namespace:
- *   import * as EncodedIO from "../overlay/tool/encoded-io"
- */
-
-const wrap = (cause: unknown) => (cause instanceof Error ? cause : new Error(String(cause)))
-
-export const read = (path: string) => Effect.tryPromise({ try: () => Encoding.read(path), catch: wrap })
-
-export const write = (path: string, text: string, encoding: string = Encoding.DEFAULT) =>
-  Effect.tryPromise({ try: () => Encoding.write(path, text, encoding), catch: wrap })

package/src/overlay/tool/question.ts

@@ -1,27 +0,0 @@
-import { Effect } from "effect"
-import { Question } from "@/question"
-
-/**
- * Helpers for the shared `@/tool/question` tool that surface a dismissed-question
- * outcome (from `Question.dismissAll` when a new prompt arrives mid-question) as
- * a normal tool result instead of letting `Effect.orDie` turn the
- * `QuestionRejectedError` into a defect that kills the in-flight stream.
- *
- * Extracted here so the shared tool file keeps just a one-liner pipe plus an
- * early return, minimising the surface area that conflicts with upstream.
- */
-export namespace SaeeolQuestionTool {
-  const DISMISSED = "dismissed" as const
-  type Dismissed = typeof DISMISSED
-
-  export const catchDismissed = <A, E, R>(eff: Effect.Effect<A, E | Question.RejectedError, R>) =>
-    eff.pipe(Effect.catchTag("QuestionRejectedError", () => Effect.succeed<Dismissed>(DISMISSED)))
-
-  export const isDismissed = (v: unknown): v is Dismissed => v === DISMISSED
-
-  export const dismissedResult = () => ({
-    title: "Question dismissed",
-    output: "User dismissed the question.",
-    metadata: { answers: [] as ReadonlyArray<Question.Answer>, dismissed: true as const },
-  })
-}

package/src/overlay/tool/registry.ts

@@ -1,97 +0,0 @@
-import { CodebaseSearchTool } from "../../tool/warpgrep"
-import { RecallTool } from "../../tool/recall"
-import { AgentManagerTool } from "./agent-manager"
-import * as Tool from "../../tool/tool"
-import { Flag } from "@saeeol/core/flag/flag"
-import { Effect } from "effect"
-import * as Log from "@saeeol/core/util/log"
-import { Agent } from "@/agent/agent"
-import * as Truncate from "@/tool/truncate"
-
-const log = Log.create({ service: "saeeol-tool-registry" })
-type Deps = { agent: Agent.Interface; truncate: Truncate.Interface }
-
-export namespace SaeeolToolRegistry {
-  const hint =
-    "- When you are doing an open-ended search where you do not know the exact symbol name, use the `semantic_search` tool first to narrow down the search scope, then follow up with `Grep` and/or `Read`"
-
-  /** Resolve Saeeol-specific tool Infos outside any InstanceState, so their Truncate/Agent deps are
-   * satisfied at the outer registry scope instead of leaking into InstanceState's Effect. */
-  export function infos() {
-    return Effect.gen(function* () {
-      const codebase = yield* CodebaseSearchTool
-      const recall = yield* RecallTool
-      const manager = yield* AgentManagerTool
-      return { codebase, recall, manager }
-    })
-  }
-
-  /** Finalize Saeeol-specific tools into Tool.Defs. Call this inside the InstanceState state Effect —
-   * it has no Service deps beyond what Tool.init itself needs. */
-  export function build(tools: { codebase: Tool.Info; recall: Tool.Info; manager: Tool.Info }, deps: Deps) {
-    return Effect.gen(function* () {
-      const base = yield* Effect.all({
-        codebase: Tool.init(tools.codebase),
-        recall: Tool.init(tools.recall),
-        manager: Tool.init(tools.manager),
-      })
-      const semantic = yield* semanticTool(deps)
-      return { ...base, semantic }
-    })
-  }
-
-  function semanticTool(deps: Deps) {
-    return Effect.gen(function* () {
-      const ready = yield* Effect.tryPromise(() =>
-        import("@/saeeol/indexing").then((mod) => mod.SaeeolIndexing.ready()),
-      ).pipe(
-        Effect.catch((err) =>
-          Effect.sync(() => {
-            log.warn("semantic search unavailable", { err })
-            return false
-          }),
-        ),
-      )
-      if (!ready) return undefined
-
-      const mod = yield* Effect.tryPromise(() => import("@/saeeol/tool/semantic-search")).pipe(
-        Effect.catch((err) =>
-          Effect.sync(() => {
-            log.warn("semantic search tool unavailable", { err })
-            return undefined
-          }),
-        ),
-      )
-      if (!mod) return undefined
-
-      const info = yield* mod.SemanticSearchTool.pipe(
-        Effect.provideService(Agent.Service, deps.agent),
-        Effect.provideService(Truncate.Service, deps.truncate),
-      )
-      if (!info) return undefined
-      return yield* Tool.init(info)
-    })
-  }
-
-  /** Saeeol-specific tools to append to the builtin list */
-  export function extra(
-    tools: { codebase: Tool.Def; semantic?: Tool.Def; recall: Tool.Def; manager: Tool.Def },
-    cfg: { experimental?: { codebase_search?: boolean; agent_manager_tool?: boolean } },
-  ): Tool.Def[] {
-    return [
-      ...(cfg.experimental?.codebase_search === true ? [tools.codebase] : []),
-      ...(tools.semantic ? [tools.semantic] : []),
-      tools.recall,
-      // The extension is the only client that can consume the Agent Manager start event.
-      ...(Flag.SAEEOL_CLIENT === "vscode" && cfg.experimental?.agent_manager_tool === true ? [tools.manager] : []),
-    ]
-  }
-
-  export function describe(tools: Tool.Def[], extra: { semantic?: Tool.Def }): Tool.Def[] {
-    if (!extra.semantic) return tools
-    return tools.map((tool) => {
-      if (tool.id !== "glob" && tool.id !== "grep") return tool
-      return { ...tool, description: `${tool.description}\n${hint}` }
-    })
-  }
-}

package/src/overlay/tool/semantic-search.ts

@@ -1,128 +0,0 @@
-import { Effect, Schema } from "effect"
-import path from "path"
-import * as Tool from "@/tool/tool"
-import { SaeeolIndexing } from "@/saeeol/indexing"
-import { Instance } from "@/project/instance"
-
-import DESCRIPTION from "./semantic-search.txt"
-
-const Parameters = Schema.Struct({
-  query: Schema.String.annotate({
-    description: "The search query, expressed in natural language.",
-  }),
-  path: Schema.optional(Schema.String).annotate({
-    description:
-      "Limit search to specific subdirectory (relative to the current workspace directory). Leave empty for entire workspace.",
-  }),
-})
-
-type SearchResult = {
-  filePath: string
-  score: number
-  startLine: number
-  endLine: number
-  codeChunk: string
-}
-
-type Meta = {
-  results: SearchResult[]
-}
-
-export const SemanticSearchTool = Tool.define(
-  "semantic_search",
-  Effect.succeed({
-    description: DESCRIPTION,
-    parameters: Parameters,
-    execute: (
-      params: Schema.Schema.Type<typeof Parameters>,
-      ctx: Tool.Context,
-    ): Effect.Effect<Tool.ExecuteResult<Meta>> =>
-      Effect.gen(function* () {
-        if (!params.query) {
-          throw new Error("query is required")
-        }
-
-        yield* ctx.ask({
-          permission: "semantic_search",
-          patterns: [params.query],
-          always: ["*"],
-          metadata: {
-            query: params.query,
-            path: params.path,
-          },
-        })
-
-        const prefix = normalizeSearchPath(params.path)
-        const matches = yield* Effect.promise(() => SaeeolIndexing.search(params.query, prefix))
-
-        const results = matches.flatMap<SearchResult>((item) => {
-          const payload = item.payload
-          if (!payload) return []
-          if (
-            typeof payload.filePath !== "string" ||
-            typeof payload.codeChunk !== "string" ||
-            typeof payload.startLine !== "number" ||
-            typeof payload.endLine !== "number"
-          ) {
-            return []
-          }
-
-          return [
-            {
-              filePath: normalizePath(payload.filePath),
-              score: item.score,
-              startLine: payload.startLine,
-              endLine: payload.endLine,
-              codeChunk: payload.codeChunk,
-            },
-          ]
-        })
-
-        if (results.length === 0) {
-          return {
-            title: "Codebase Search",
-            metadata: {
-              results,
-            },
-            output: `No relevant code found for "${params.query}"${prefix ? ` in ${normalizePath(prefix)}` : ""}.`,
-          }
-        }
-
-        const output = [
-          `Found ${results.length} result${results.length === 1 ? "" : "s"} for "${params.query}"${prefix ? ` in ${normalizePath(prefix)}` : ""}.`,
-          "",
-          ...results.flatMap((item, index) => {
-            return [
-              `${index + 1}. ${item.filePath}:${item.startLine}-${item.endLine} (score ${item.score.toFixed(4)})`,
-              item.codeChunk,
-              "",
-            ]
-          }),
-        ]
-
-        return {
-          title: "Codebase Search",
-          metadata: {
-            results,
-          },
-          output: output.join("\n").trim(),
-        }
-      }).pipe(Effect.orDie),
-  }),
-)
-
-function normalizeSearchPath(input?: string): string | undefined {
-  if (!input) return undefined
-
-  const absolute = path.resolve(Instance.directory, input)
-  const relative = path.relative(Instance.directory, absolute)
-  if (!relative || relative === ".") return undefined
-  if (path.isAbsolute(relative) || relative === ".." || relative.startsWith(`..${path.sep}`)) {
-    throw new Error(`path must be within the current workspace: ${input}`)
-  }
-  return path.normalize(relative)
-}
-
-function normalizePath(value: string): string {
-  return value.replaceAll("\\", "/")
-}

package/src/overlay/tool/semantic-search.txt

@@ -1,28 +0,0 @@
-Find code snippets by semantic meaning and return ranked matches with file paths and line ranges.
-
-## When to use
-
-- Explore an unfamiliar code area before you know exact identifiers
-- Find related implementations of a concept or behavior across the workspace
-- Search by intent such as authentication, caching, or session resume logic
-- Narrow a large codebase before following up with `Read` or `Grep`
-- Limit semantic search to one subdirectory with `path`
-
-## When NOT to use
-
-- Search for an exact symbol or regex pattern — use `Grep`
-- Find files by filename or extension — use `Glob`
-- Read the contents of a known file — use `Read`
-- Explore files outside the current workspace - use `Grep`, `Glob`, and `Read`
-
-## Examples
-
-- "User login and password hashing" → search for auth-related code by meaning
-- "Database connection pooling" → find conceptually similar implementations
-- "Session resume flow" → retrieve snippets involved in restoring session state
-- "Tool approval UI" with `path: "packages/saeeol/src"` → combine a natural-language query with `path`
-
-## Constraints
-
-- Write the query in English.
-- Use `path` only for subdirectories inside the current workspace.

package/src/overlay/tool/task.ts

@@ -1,77 +0,0 @@
-import { Effect } from "effect"
-import path from "path"
-import { Permission } from "@/permission"
-import { Flag } from "@saeeol/core/flag/flag"
-import { Global } from "@saeeol/core/global"
-import { ModelID, ProviderID } from "@/provider/schema"
-import type { Session } from "../../session/session"
-import type { Agent } from "../../agent/agent"
-import type { Config } from "../../config/config"
-import z from "zod"
-
-// RATIONALE: Mirror narrow state slice Task tool consumes and ignore unrelated TUI fields.
-const ModelState = z
-  .object({
-    model: z.record(z.string(), z.object({ providerID: ProviderID.zod, modelID: ModelID.zod })).optional(),
-    variant: z.record(z.string(), z.string().optional()).optional(),
-  })
-  .passthrough()
-
-export namespace SaeeolTask {
-  /** Reject primary agents used as subagents */
-  export function validate(info: Agent.Info, name: string) {
-    if (info.mode === "primary") throw new Error(`Agent "${name}" is a primary agent and cannot be used as a subagent`)
-  }
-
-  /** Saeeol keeps delegation one level deep to avoid recursive subagent chains. */
-  export function nestedTask(): false {
-    return false
-  }
-
-  /**
-   * Build inherited permission rules from the calling agent.
-   * Merges the static agent definition with the session's accumulated permissions
-   * so restrictions survive multi-hop chains (plan → general → explore).
-   *
-   * The caller must resolve `caller` (Agent.Info) and `session` (Session.Info)
-   * before calling — this function is pure/synchronous.
-   */
-  export function inherited(input: {
-    caller: Agent.Info
-    session: Session.Info
-    mcp: Config.Info["mcp"]
-  }): Permission.Ruleset {
-    const rules = Permission.merge(input.caller.permission ?? [], input.session.permission ?? [])
-    const prefixes = Object.keys(input.mcp ?? {}).map((k) => k.replace(/[^a-zA-Z0-9_-]/g, "_") + "_")
-    const isMcp = (p: string) => prefixes.some((prefix) => p.startsWith(prefix))
-    return rules.filter(
-      (r: Permission.Rule) => r.permission === "edit" || r.permission === "bash" || isMcp(r.permission),
-    )
-  }
-
-  /** Extra permission rules appended to subagent sessions */
-  export function permissions(rules: Permission.Ruleset): Permission.Ruleset {
-    return [{ permission: "task", pattern: "*", action: "deny" }, ...rules]
-  }
-
-  /** Return saved CLI model for agent, if any. */
-  export const resolveModel = Effect.fn("SaeeolTask.resolveModel")(function* (name: string) {
-    if (Flag.SAEEOL_CLIENT !== "cli") return undefined
-    const file = path.join(Global.Path.state, "model.json")
-    const state = yield* Effect.tryPromise({
-      try: () =>
-        Bun.file(file)
-          .text()
-          .then((raw) => ModelState.safeParse(JSON.parse(raw)))
-          .then((result) => (result.success ? result.data : undefined))
-          .catch(() => undefined),
-      catch: () => undefined,
-    })
-    const model = state?.model?.[name]
-    if (!model) return undefined
-    return {
-      ...model,
-      variant: state?.variant?.[`${model.providerID}/${model.modelID}`],
-    }
-  })
-}

package/src/overlay/ts-check.ts

@@ -1,170 +0,0 @@
-import type { Diagnostic } from "vscode-languageserver-types"
-import * as Log from "@saeeol/core/util/log"
-import { Filesystem } from "../util/filesystem"
-import path from "path"
-import fs from "fs/promises"
-
-export namespace TsCheck {
-  const log = Log.create({ service: "ts-check" })
-
-  // Match: file(line,col): error TSxxxx: message
-  const DIAG_RE = /^(.+?)\((\d+),(\d+)\):\s+(error|warning)\s+(TS\d+):\s+(.*)$/
-
-  export async function run(root: string): Promise<Map<string, Diagnostic[]>> {
-    const result = new Map<string, Diagnostic[]>()
-    const bin = await resolve(root)
-    if (!bin) {
-      log.info("no typescript checker found", { root })
-      return result
-    }
-
-    log.info("running ts check", { bin, root })
-    const start = Date.now()
-
-    // --incremental writes a .tsbuildinfo cache so subsequent runs only
-    // re-check changed files. First run is cold (~1.3s), warm runs
-    // reuse the cache and typically finish in ~200-400ms.
-    const proc = Bun.spawn([bin, "--noEmit", "--pretty", "false", "--incremental"], {
-      cwd: root,
-      stdout: "pipe",
-      stderr: "pipe",
-      windowsHide: true,
-      env: { ...process.env },
-    })
-
-    const TIMEOUT = 30_000
-    const done = Promise.all([new Response(proc.stdout).text(), new Response(proc.stderr).text(), proc.exited])
-    const settled = await Promise.race([
-      done.then(([out, err]) => ({ out, err, timedOut: false as const })),
-      new Promise<{ out: string; err: string; timedOut: true }>((r) =>
-        setTimeout(() => r({ out: "", err: "", timedOut: true }), TIMEOUT),
-      ),
-    ])
-    if (settled.timedOut) {
-      log.warn("ts check timed out, killing process", { elapsed: Date.now() - start })
-      proc.kill()
-    }
-
-    const stdout = settled.out
-    const stderr = settled.err
-
-    log.info("ts check done", {
-      elapsed: Date.now() - start,
-      lines: stdout.split("\n").length,
-    })
-
-    if (stderr.trim()) {
-      log.info("ts check stderr", { stderr: stderr.slice(0, 500) })
-    }
-
-    for (const line of stdout.split("\n")) {
-      const m = DIAG_RE.exec(line)
-      if (!m) continue
-      if (m.length < 7) continue
-
-      const file = m[1]!
-      const row = parseInt(m[2]!, 10) - 1
-      const col = parseInt(m[3]!, 10) - 1
-      const sev = m[4]!
-      const abs = path.isAbsolute(file) ? file : path.resolve(root, file)
-      const normalized = Filesystem.normalizePath(abs)
-
-      const diag: Diagnostic = {
-        range: {
-          start: { line: row, character: col },
-          end: { line: row, character: col },
-        },
-        severity: sev === "error" ? 1 : 2,
-        message: m[6]!,
-        source: "ts",
-        code: m[5]!,
-      }
-
-      const arr = result.get(normalized) ?? []
-      arr.push(diag)
-      result.set(normalized, arr)
-    }
-
-    return result
-  }
-
-  // Resolve the native tsgo binary directly, avoiding the node.js wrapper
-  // (node_modules/.bin/tsgo is a #!/usr/bin/env node script that spawns a
-  // node process just to execFileSync the native binary — adding ~200MB overhead).
-  async function resolve(root: string): Promise<string | undefined> {
-    // 1. Try resolving the native tsgo binary from the platform-specific package
-    const native = await native_tsgo(root)
-    if (native) return native
-
-    // 2. Try workspace-local tsc from node_modules
-    const local = await local_tsc(root)
-    if (local) return local
-
-    // 3. Try global tsc (fallback)
-    const tsc = Bun.which("tsc")
-    if (tsc) return tsc
-
-    return undefined
-  }
-
-  // Walk up from root looking for a usable tsc binary.
-  // On Windows the JS entrypoint has no shebang support, so use the .cmd shim.
-  async function local_tsc(root: string): Promise<string | undefined> {
-    const shim = process.platform === "win32" ? path.join(".bin", "tsc.cmd") : path.join("typescript", "bin", "tsc")
-    let dir = root
-    while (true) {
-      const bin = path.join(dir, "node_modules", shim)
-      if (await exists(bin)) return bin
-      const parent = path.dirname(dir)
-      if (parent === dir) break
-      dir = parent
-    }
-    return undefined
-  }
-
-  // Resolve the native tsgo binary by finding the platform-specific package.
-  // The @typescript/native-preview npm package includes platform-specific
-  // optional dependencies like @typescript/native-preview-darwin-arm64 that
-  // contain the actual native binary at lib/tsgo.
-  // Exported for use by the LSP server spawn (tsgo --lsp --stdio).
-  export async function native_tsgo(root: string): Promise<string | undefined> {
-    const pkg = `@typescript/native-preview-${process.platform}-${process.arch}`
-
-    // Walk up from root looking in node_modules (including .bun hoisted paths)
-    let dir = root
-    while (true) {
-      // Standard node_modules layout
-      const standard = path.join(dir, "node_modules", pkg, "lib", "tsgo")
-      if (await exists(standard)) return standard
-
-      // Bun hoisted layout: node_modules/.bun/<pkg>@<version>/node_modules/<pkg>/lib/tsgo
-      const bun = path.join(dir, "node_modules", ".bun")
-      if (await exists(bun)) {
-        const match = await scan_bun(bun, pkg)
-        if (match) return match
-      }
-
-      const parent = path.dirname(dir)
-      if (parent === dir) break
-      dir = parent
-    }
-
-    return undefined
-  }
-
-  // Scan .bun hoisted directory for the platform package
-  async function scan_bun(dir: string, pkg: string): Promise<string | undefined> {
-    const prefix = pkg.replace("/", "+")
-    const entries = await fs.readdir(dir).catch(() => [] as string[])
-    for (const entry of entries) {
-      if (!entry.startsWith(prefix + "@")) continue
-      const bin = path.join(dir, entry, "node_modules", pkg, "lib", "tsgo")
-      if (await exists(bin)) return bin
-    }
-    return undefined
-  }
-
-  async function exists(p: string): Promise<boolean> {
-    return Filesystem.exists(p)
-  }
-}

package/src/overlay/ts-client.ts

@@ -1,95 +0,0 @@
-// Lightweight TypeScript diagnostic client that shells out to tsgo/tsc
-// instead of spawning a persistent typescript-language-server process.
-// This drops memory from ~500MB persistent to ~50MB peak (0 idle).
-
-import { LSPClient } from "../lsp/client"
-import { Bus } from "../bus"
-import { TsCheck } from "./ts-check"
-import * as Log from "@saeeol/core/util/log"
-import { withTimeout } from "../util/timeout"
-import path from "path"
-import { Instance } from "../project/instance"
-
-export namespace TsClient {
-  const log = Log.create({ service: "ts-client" })
-
-  export function create(input: { root: string }): LSPClient.Info {
-    const diagnostics = new Map<string, LSPClient.Diagnostic[]>()
-    // Pending tsgo run promise — used for coalescing rapid calls.
-    // Only set when waitForDiagnostics() triggers a run, NOT on
-    // notify.open() (which is a warm-up call from read.ts).
-    let pending: Promise<void> | undefined
-
-    function check(): Promise<void> {
-      if (pending) return pending
-      pending = TsCheck.run(client.root)
-        .then((result) => {
-          diagnostics.clear()
-          for (const [file, diags] of result) {
-            diagnostics.set(file, diags)
-          }
-          for (const file of result.keys()) {
-            Bus.publish(LSPClient.LSPEvent.Diagnostics, {
-              path: file,
-              serverID: client.serverID,
-            })
-          }
-        })
-        .catch((err) => {
-          log.error("ts check failed", { error: err })
-        })
-        .finally(() => {
-          pending = undefined
-        })
-      return pending
-    }
-
-    const client: LSPClient.Info = {
-      root: input.root,
-      get serverID() {
-        return "typescript"
-      },
-      get connection(): any {
-        // LSP namespace methods (hover, definition, etc.) call
-        // connection.sendRequest() directly. Provide a stub that
-        // rejects so those code paths surface a clear error instead
-        // of crashing with "cannot read property sendRequest of undefined".
-        return {
-          sendRequest() {
-            return Promise.reject(
-              new Error("TypeScript LSP operations are not supported in lightweight diagnostic mode"),
-            )
-          },
-          sendNotification() {
-            return Promise.resolve()
-          },
-        }
-      },
-      notify: {
-        async open(_input: { path: string }) {
-          // No-op. Warm-up calls from read.ts (touchFile(path, false))
-          // trigger notify.open() but should NOT spawn tsgo. The actual
-          // check is deferred to waitForDiagnostics() which is only
-          // called when tools need diagnostics (write, edit, apply_patch).
-          return 0
-        },
-      },
-      get diagnostics() {
-        return diagnostics
-      },
-      async waitForDiagnostics(_input: { path: string; version: number; mode?: "document" | "full"; after?: number }) {
-        // Run tsgo --noEmit and wait for results. Coalesces concurrent calls.
-        // 30s cap matches the process timeout in TsCheck.run(). Silent catch
-        // matches the real LSPClient's .catch(() => {}) on its 3s timeout.
-        await withTimeout(check(), 30_000).catch(() => {})
-      },
-      async shutdown() {
-        log.info("shutting down ts-client")
-        diagnostics.clear()
-      },
-    }
-
-    log.info("created lightweight ts client", { root: input.root })
-    return client
-  }
-}