sanook-cli 0.4.0

package/.env.example

@@ -0,0 +1,23 @@
+# BYOK — API key ตรงจาก console ของค่ายเท่านั้น
+# ห้าม OAuth / subscription token (Claude.ai / ChatGPT plan) — ละเมิด ToS, บัญชีโดนแบนได้
+# ตั้งเฉพาะค่ายที่ใช้ (อันไหนไม่มี key ก็ข้ามได้)
+
+# ── ToS-sensitive: ต้อง API key ตรง ห้าม OAuth ──
+ANTHROPIC_API_KEY=sk-ant-api03-xxx        # console.anthropic.com → API Keys
+GOOGLE_GENERATIVE_AI_API_KEY=AIzaxxx      # aistudio.google.com/apikey (restrict เป็น Gemini-only)
+
+# ── Cloud BYOK ──
+OPENAI_API_KEY=sk-xxx                     # platform.openai.com (รวม Codex: model gpt-5-codex)
+DEEPSEEK_API_KEY=sk-xxx                   # platform.deepseek.com
+XAI_API_KEY=xai-xxx                       # console.x.ai
+MISTRAL_API_KEY=xxx                       # console.mistral.ai
+GROQ_API_KEY=gsk_xxx                      # console.groq.com
+MINIMAX_API_KEY=xxx                        # platform.minimax.io  (MINIMAX_BASE_URL สลับ region)
+ZHIPU_API_KEY=xxx                         # z.ai / open.bigmodel.cn (GLM — GLM_BASE_URL สลับ region)
+
+# ── Local (ไม่ต้อง key — ตั้ง baseURL ถ้าไม่ใช่ default) ──
+# OLLAMA_BASE_URL=http://localhost:11434/v1
+# LMSTUDIO_BASE_URL=http://localhost:1234/v1
+
+# default model (alias หรือ provider:model) — เช่น sonnet | opus | gpt | grok | groq:fast
+SANOOK_MODEL=sonnet

package/CHANGELOG.md

@@ -0,0 +1,38 @@
+# Changelog
+
+## 0.4.0 — second brain, GLM Coding Plan, Telegram, hardening
+
+- **Second brain**: `sanook brain init` scaffolds a portable Obsidian "second-brain" workspace — full folder taxonomy (each with `_Index.md`), a central `Vault Structure Map.md`, seed memory files, and a portable AI operating constitution (`CLAUDE/GEMINI/AGENTS.md`). Research-backed rules: context-assembly (anti context-rot), intake quarantine + injection-scan, bi-temporal fact validity, provenance tracking, a verification-gated `Skills/` library, sleep-time consolidation. The agent now **loads the vault** into context, and `brain init` **auto-wires a filesystem MCP** to it. First-run wizard offers to create one (personalized).
+- **GLM Coding Plan**: GLM routes through the Anthropic-compatible endpoint (`/api/anthropic`), so Coding Plan keys work; curated ids `glm-4.6 / glm-5.1 / glm-4.5-air`.
+- **Telegram channel**: drive the agent from your phone (long-polling, fail-closed allowlist, private-only). Remote surface defaults to ask-mode (mutations denied) unless `TELEGRAM_ALLOW_WRITE=1`.
+- **Auto-compaction**: token-aware sliding window keeps long sessions under the limit.
+- **Interactive approval** (`ask` mode) + capability-based gating — any non-read-only tool (incl. MCP) is confirmed before running.
+- **REPL resume** (`sanook -c`), **stdin piping** (`git diff | sanook "review"`), gateway multi-turn history, and `sanook config` / `sanook mcp` management commands.
+- **Provider audit**: corrected stale model ids (OpenAI `gpt-5.3-codex`, DeepSeek `v4-flash/pro`, xAI `grok-4.3`).
+- **Hardening**: budget cap now actually fires on the default fast model; write paths confined (no `~/.sanook` / shell-rc / ssh backdoors); MCP child processes get a minimal env (no secret leakage); provider errors surface a clean one-line message; versions read from `package.json`. Added tests for the BYOK/redaction core and budget cap.
+
+## 0.3.0 — providers, memory, gateway, MCP, git
+
+- **Providers**: data-driven registry, now 12 providers (added MiniMax, GLM, and OpenAI Codex via the official CLI). Per-provider model picker that fetches the live model list.
+- **Memory**: auto-memory (`remember` / `recall`), session resume (`--continue`), and in-session REPL conversation history.
+- **Gateway + cron**: `sanook serve` runs a loopback HTTP endpoint (OpenAI-compatible) plus a cron scheduler with natural-language scheduling, backed by a file-locked JSON task ledger.
+- **Skills**: load `SKILL.md` files on demand; the agent can author its own with `create_skill`.
+- **Subagents**: a `task` tool spawns a fresh-context sub-agent (read-only by default, depth-guarded).
+- **Hooks**: PreToolUse / PostToolUse commands via `~/.sanook/hooks.json`.
+- **Plan mode** (`--plan`): read-only exploration that produces a plan before acting.
+- **MCP**: connect Model Context Protocol servers (stdio) via `~/.sanook/mcp.json`.
+- **Git**: automatic git context in the prompt + `git_status` / `git_diff` / `git_log` / `git_commit` tools.
+- Onboarding: welcome banner + first-run setup wizard.
+- Hardened across several adversarial reviews — command injection, prompt injection, concurrency, and secret redaction.
+
+## 0.1.0 — first usable release
+
+A terminal AI coding agent, built from scratch in TypeScript. BYOK, works with any model.
+
+- **Agent loop** on Vercel AI SDK 6 (`streamText` + `stopWhen` + `fullStream`), streamed output
+- **Tools**: read / write / edit (multi-tier matcher) / list / glob / grep / bash, with a permission gate (denies destructive commands + protected paths)
+- **Multi-provider BYOK**: Anthropic / OpenAI / Google / Ollama via one model spec; direct API key only (no OAuth/subscription reuse)
+- **Cost meter** + budget cap (per-token, cache-aware)
+- **Context memory**: hierarchical `SANOOK.md` loader (stops at project boundary) + tool-result compaction
+- **Ink TUI** REPL with slash commands (`/model` `/cost` `/clear` `/compact` `/help`), plus headless `--json` mode for CI
+- Eval harness (outcome-checked tasks) + CI matrix (mac/linux/windows × Node 22/24)

package/LICENSE

@@ -0,0 +1,201 @@
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or Derivative
+          Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and do
+          not modify the License. You may add Your own attribution notices
+          within Derivative Works that You distribute, alongside or as an
+          addendum to the NOTICE text from the Work, provided that such
+          additional attribution notices cannot be construed as modifying
+          the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2026 Sanook contributors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.

package/README.md

@@ -0,0 +1,239 @@
+<div align="center">
+
+# Sanook CLI
+
+**A terminal AI coding agent — built from scratch in TypeScript.**
+
+Bring your own key, run with any of 12 model providers, and let it remember what it did across sessions.
+
+[![Version](https://img.shields.io/badge/version-0.3.0-2563eb.svg)](https://github.com/Sir-chawakorn/sanook-cli/releases)
+[![License](https://img.shields.io/badge/license-Apache--2.0-22c55e.svg)](LICENSE)
+[![Node](https://img.shields.io/badge/node-%E2%89%A5%2022-339933.svg?logo=node.js&logoColor=white)](https://nodejs.org)
+[![TypeScript](https://img.shields.io/badge/TypeScript-strict-3178c6.svg?logo=typescript&logoColor=white)](https://www.typescriptlang.org)
+[![Tests](https://img.shields.io/badge/tests-143%20passing-22c55e.svg)](#development)
+[![CI](https://github.com/Sir-chawakorn/sanook-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/Sir-chawakorn/sanook-cli/actions/workflows/ci.yml)
+
+[Quickstart](#quickstart) · [Providers](#providers) · [Usage](#usage) · [Gateway](#gateway--scheduling) · [Skills](#skills) · [MCP](#mcp) · [Security](#security)
+
+</div>
+
+---
+
+## Overview
+
+Sanook is a small, transparent coding agent for your terminal. At its heart is a single loop —
+
+```
+prompt → LLM → tool call → result → loop → answer
+```
+
+— wrapped with everything that makes it usable for real work: a permission gate, a memory the agent writes itself, a long-running gateway with cron and chat channels, on-demand skills, MCP servers, and first-class git awareness.
+
+It is **BYOK (bring your own key)** by design. Every provider connects with a **direct API key from that provider's own console** — Sanook never reuses OAuth or subscription credentials, because that violates provider terms and gets accounts banned.
+
+## Quickstart
+
+```bash
+npm install -g sanook-cli
+
+export ANTHROPIC_API_KEY=sk-ant-...        # or run `sanook` and use the setup wizard
+sanook "read package.json and list the dependencies"
+```
+
+Run `sanook` with no task to drop into an interactive REPL. On the very first run with no key configured, a setup wizard walks you through picking a provider, pasting a key, and choosing a model.
+
+```bash
+sanook                          # interactive REPL
+sanook "fix the failing test"   # one-shot, headless
+sanook --json "..."             # JSONL output for CI / scripts
+```
+
+## Features
+
+| Area | What you get |
+|---|---|
+| **Agent loop** | Built on the Vercel AI SDK 6 (`streamText` + `stopWhen` + `fullStream`), with streamed output, a cost meter, and a budget cap. |
+| **Tools** | `read_file` · `write_file` · `edit_file` (multi-tier matcher) · `list_dir` · `glob` · `grep` · `run_bash`, plus git tools — gated by a permission layer that denies destructive commands and protected paths. |
+| **Approval** | Interactive `ask` mode prompts `y/n` before any file write or shell command. `--yes` for auto-approve; headless defaults to safe-deny. |
+| **Memory** | The agent writes its own notes (`remember`), recalls them across past sessions (`recall`), and `--continue` resumes the last run where it left off. |
+| **Skills** | 69 built-in skills + install your own from a GitHub repo, URL, or local path. The agent can also author new skills after a repeatable task. |
+| **Subagents** | A `task` tool spawns a fresh-context sub-agent for scoped exploration without bloating the main context — read-only by default, depth-guarded. |
+| **Gateway + cron** | `sanook serve` runs a long-lived daemon: a loopback OpenAI-compatible HTTP endpoint plus a cron scheduler. Ask it in plain language and it schedules itself. |
+| **Channels** | A Telegram adapter (long-polling, no public URL) lets you drive the agent from your phone — locked down with a required allowlist and private-chat-only policy. |
+| **MCP** | Connect any Model Context Protocol server (filesystem, GitHub, Postgres, …) via `~/.sanook/mcp.json`. |
+| **Git** | Branch, uncommitted changes, and recent commits are injected automatically, with `git_status` / `git_diff` / `git_log` / `git_commit` tools. |
+| **Hooks** | Run your own command before/after any tool. A non-zero `PreToolUse` exit blocks the tool — enforce lint, format, or policy. |
+| **Plan mode** | `--plan` restricts the agent to read-only tools and asks it to produce a plan before touching anything. |
+| **Auto-compaction** | A token-aware sliding window keeps long sessions under the context limit with zero extra LLM cost. |
+| **Second brain** | `sanook brain init` scaffolds a structured Obsidian "second-brain" workspace (folders + `_Index` + a portable AI operating constitution) for organising work and giving the agent durable, cross-session memory. |
+
+## Providers
+
+One model spec, twelve providers. Switch with `-m <spec>` on the command line or `/model` in the REPL.
+
+| Provider | Spec example | Key |
+|---|---|---|
+| Anthropic (Claude) | `-m sonnet`, `-m opus`, `-m haiku` | `ANTHROPIC_API_KEY` |
+| Google (Gemini) | `-m gemini`, `-m google:gemini-2.5-flash` | `GOOGLE_GENERATIVE_AI_API_KEY` |
+| OpenAI | `-m gpt`, `-m openai:gpt-5.5` | `OPENAI_API_KEY` |
+| DeepSeek | `-m deepseek` | `DEEPSEEK_API_KEY` |
+| xAI (Grok) | `-m grok` | `XAI_API_KEY` |
+| Mistral | `-m mistral` | `MISTRAL_API_KEY` |
+| Groq | `-m groq:fast` | `GROQ_API_KEY` |
+| MiniMax | `-m minimax` | `MINIMAX_API_KEY` |
+| GLM (Zhipu) | `-m glm` | `ZHIPU_API_KEY` |
+| Ollama | `-m ollama` | — (local) |
+| LM Studio | `-m lmstudio` | — (local) |
+| OpenAI Codex | `-m codex` | via the official Codex CLI |
+
+A spec is an alias (`sonnet`), a `provider:model-id` pair (`openai:gpt-5.5`), or a bare model id. `sanook models <provider>` lists the curated ids and, when a key is set, verifies them against the provider's live `/models` endpoint.
+
+```bash
+sanook models                 # list all providers
+sanook models anthropic       # curated ids (+ live verification if a key is set)
+```
+
+## Usage
+
+```
+sanook "<task>"          run one task (headless)
+sanook                   interactive REPL
+sanook -c "<task>"       resume the latest session
+sanook --plan "<task>"   plan mode (read-only)
+sanook --json "<task>"   JSONL output for scripts / CI
+
+  -m, --model <spec>     model or provider:model-id
+  -b, --budget <usd>     stop when estimated cost exceeds this
+  -y, --yes              auto-approve tool calls (skip ask-mode)
+  -v, --version          print version
+  -h, --help             show help
+```
+
+**REPL slash commands:** `/model` · `/tools` · `/skills` · `/cost` · `/clear` · `/compact` · `/help` · `/quit`
+
+## Gateway & scheduling
+
+`sanook serve` starts a single long-lived process that hosts an HTTP API, a cron scheduler, and optional chat channels — all driving the same agent core.
+
+```bash
+sanook serve --port 8787                       # HTTP (127.0.0.1 only) + scheduler
+sanook cron add "every 30m" "check the CI"     # also "09:00", an ISO time, or "now"
+sanook cron list
+sanook cron rm <id>
+```
+
+The HTTP server binds to **loopback only** and authenticates every endpoint (except `/health`) with a bearer token stored at `~/.sanook/gateway/token` (chmod 600). It speaks the OpenAI chat-completions shape, so existing clients work unchanged:
+
+```bash
+curl http://127.0.0.1:8787/v1/chat/completions \
+  -H "Authorization: Bearer $(cat ~/.sanook/gateway/token)" \
+  -H 'content-type: application/json' \
+  -d '{"messages":[{"role":"user","content":"summarise today's commits"}]}'
+```
+
+| Method | Endpoint | Purpose |
+|---|---|---|
+| `GET` | `/health` | liveness (public) |
+| `POST` | `/v1/chat/completions` | run the agent (OpenAI-compatible) |
+| `GET` / `POST` | `/tasks` | list / enqueue scheduled tasks |
+
+### Telegram channel
+
+Set two environment variables before `sanook serve` and the gateway adds a Telegram adapter via long-polling (no public URL needed):
+
+```bash
+export TELEGRAM_BOT_TOKEN=123:abc
+export TELEGRAM_ALLOWED_CHATS=5222385839   # required — comma-separated chat ids
+sanook serve
+```
+
+The channel is **fail-closed**: with no allowlist it refuses to start, it accepts private chats only, and it never leaks internal errors back to the sender. See [Security](#security).
+
+## Skills
+
+A skill is a `SKILL.md` file (front-matter + instructions) the agent loads on demand. Sanook ships with 69 built-in skills and can install more.
+
+```bash
+sanook skill list                          # browse all skills
+sanook skill add anthropics/skills         # from a GitHub repo
+sanook skill add https://…/SKILL.md        # from a URL
+sanook skill add ./my-skill                # from a local path
+sanook skill remove my-skill
+```
+
+> ⚠️ A skill is an instruction the agent will follow. Install only from sources you trust.
+
+## Second brain
+
+Scaffold a structured [Obsidian](https://obsidian.md) workspace for organising your work and giving the agent a durable, cross-session memory:
+
+```bash
+sanook brain init                  # interactive — asks where + a few identity questions
+sanook brain init ~/notes/brain    # non-interactive (with --yes)
+```
+
+It creates a full folder taxonomy (`Projects/`, `Sessions/`, `Shared/` memory layer, `Goals/`, `Research/`, `Skills/`, …), an `_Index.md` in every folder, seed memory files, and a portable AI **operating constitution** (`CLAUDE.md` / `GEMINI.md` / `AGENTS.md`) so any AI agent works with the vault consistently. It ships with research-backed operating rules — context-assembly (anti context-rot), an intake quarantine + injection-scan gate, bi-temporal fact validity, provenance tracking, a verification-gated `Skills/` library, and sleep-time consolidation. The first-run setup wizard also offers to create one.
+
+Everything is **create-if-missing** — re-running never overwrites your notes. Point an Obsidian or filesystem MCP server at the workspace to let the agent read and write it.
+
+## MCP
+
+Connect Model Context Protocol servers (stdio) with the same config shape you already use elsewhere:
+
+```jsonc
+// ~/.sanook/mcp.json
+{
+  "mcpServers": {
+    "filesystem": { "command": "npx", "args": ["-y", "@modelcontextprotocol/server-filesystem", "/path"] }
+  }
+}
+```
+
+Their tools are merged into the agent's toolset automatically. `/tools` in the REPL lists everything currently available.
+
+## Configuration
+
+Everything lives under `~/.sanook/` (with per-project `.sanook/` overrides where relevant):
+
+```
+~/.sanook/auth.json          API keys (chmod 600)
+~/.sanook/memory/            auto-memory the agent writes
+~/.sanook/sessions/          saved conversations (for --continue)
+~/.sanook/skills/<name>/     installed SKILL.md files
+~/.sanook/mcp.json           MCP servers  { "mcpServers": { … } }
+~/.sanook/hooks.json         PreToolUse / PostToolUse hooks
+~/.sanook/gateway/           gateway token + task ledger
+SANOOK.md                    project memory (hierarchical, like a system prompt)
+```
+
+## Security
+
+Sanook runs shell commands and edits files, so safety is built into the core rather than bolted on:
+
+- **BYOK, direct keys only** — OAuth and subscription tokens are rejected by an explicit guard (`ya29.`, `Bearer`, `sk-ant-oat…`). This keeps you within every provider's terms of service.
+- **Permission gate** — destructive commands (`rm -rf`, `git reset --hard`, `push --force`, fork bombs, …) and writes to protected paths are denied; interactive `ask` mode confirms mutations.
+- **Secret redaction** — API keys are stripped from error messages and logs.
+- **Gateway** — HTTP binds to `127.0.0.1` only and requires a bearer token on every non-health endpoint.
+- **Telegram** — fail-closed: a required allowlist, private-chat-only, per-chat rate-limiting, and generic error replies that never reveal internal paths.
+
+Hardened across several adversarial security reviews covering command injection, prompt injection, concurrency, and credential leakage.
+
+## Development
+
+```bash
+npm install
+npm run build       # → dist/
+npm test            # vitest — 143 tests
+npm run typecheck   # tsc --noEmit (strict)
+npm run dev -- "…"  # run from source without building
+```
+
+CI runs the suite across macOS / Linux / Windows on Node 22 and 24. Requires **Node ≥ 22**.
+
+## License
+
+[Apache-2.0](LICENSE)
+
+<div align="center">
+<sub>Built from scratch in TypeScript on the Vercel AI SDK — no framework, no magic.</sub>
+</div>

package/dist/agentContext.js

@@ -0,0 +1,2 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export const agentContext = new AsyncLocalStorage();

package/dist/approval.js

@@ -0,0 +1,78 @@
+import { AsyncLocalStorage } from 'node:async_hooks';
+export const approvalContext = new AsyncLocalStorage();
+// tool ที่เปลี่ยน state จริง → ต้องขออนุมัติใน ask-mode
+// NOTE: ต้อง sync กับ tools ที่ mutate — มี test guard ใน approval.test.ts กันหลุด
+export const MUTATE_TOOLS = new Set([
+    'write_file',
+    'edit_file',
+    'run_bash',
+    'git_commit',
+    'schedule_task',
+    'cancel_scheduled',
+    'remember', // เขียน auto-memory ถาวร
+    'create_skill', // เขียน skill ถาวร
+]);
+// capability-based gate: tool ที่ "อ่านอย่างเดียว" เท่านั้นที่ผ่านโดยไม่ขออนุมัติ
+// อย่างอื่น (รวม MCP tools ที่ไม่รู้จัก เช่น fs write / postgres DELETE) = treat as mutating → gate ใน ask-mode
+const READ_ONLY_TOOLS = new Set([
+    'read_file',
+    'list_dir',
+    'glob',
+    'grep',
+    'recall',
+    'find_skills',
+    'skill',
+    'git_status',
+    'git_diff',
+    'git_log',
+    'list_scheduled',
+]);
+/** สรุป tool input เป็นบรรทัดเดียวให้ user ตัดสินใจ */
+export function summarizeToolCall(tool, input) {
+    const i = (input ?? {});
+    switch (tool) {
+        case 'run_bash':
+            return `$ ${String(i.cmd ?? '')}`;
+        case 'write_file':
+            return `เขียนไฟล์ ${String(i.path ?? '')}`;
+        case 'edit_file':
+            return `แก้ไฟล์ ${String(i.path ?? '')}`;
+        case 'git_commit':
+            return `git commit -m "${String(i.message ?? '')}"`;
+        case 'schedule_task':
+            return `ตั้ง cron: ${String(i.when ?? '')} → ${String(i.task ?? '').slice(0, 40)}`;
+        case 'cancel_scheduled':
+            return `ยกเลิก task ${String(i.id ?? '')}`;
+        case 'remember':
+            return `จำ: ${String(i.fact ?? '').slice(0, 50)}`;
+        case 'create_skill':
+            return `สร้าง skill ${String(i.name ?? '')}`;
+        default:
+            return tool;
+    }
+}
+/** ครอบ mutate tools ด้วย approval gate — ask-mode เรียก approve() ก่อน execute */
+export function wrapToolsWithApproval(tools) {
+    const out = {};
+    for (const [name, t] of Object.entries(tools)) {
+        // read-only → ผ่าน · ที่เหลือ (mutate + MCP/unknown) → gate ใน ask-mode (deny-by-default)
+        if (READ_ONLY_TOOLS.has(name) || typeof t.execute !== 'function') {
+            out[name] = t;
+            continue;
+        }
+        const orig = t.execute;
+        out[name] = {
+            ...t,
+            execute: async (input, opts) => {
+                const ctx = approvalContext.getStore();
+                if (ctx?.mode === 'ask') {
+                    const ok = ctx.approve ? await ctx.approve(name, summarizeToolCall(name, input)) : false;
+                    if (!ok)
+                        return `⛔ ผู้ใช้ปฏิเสธการรัน ${name} (${summarizeToolCall(name, input)})`;
+                }
+                return orig(input, opts);
+            },
+        };
+    }
+    return out;
+}