savant-code 0.0.20 → 0.0.21

package/README.md

@@ -46,11 +46,12 @@ Or select one of the supported gateway providers directly:
 | Provider | Selection | Environment variable | Notes |
 | --- | --- | --- | --- |
 | Ollama | Automatic detection | `OLLAMA_HOST` (optional) | Local inference; no API key required |
-| OpenCode Go | `/provider opencode-go` | `OPENCODE_GO_API_KEY` | Hosted gateway; MiMo 2.5 is the default model |
+| OpenRouter | `/provider openrouter` or `DIRECT_PROVIDER=openrouter` | `OR_MASTER_KEY`, `OPENROUTER_API_KEY`, or `INFERENCE_API_KEY` | Default provider; free tier (`openrouter/free`) is the boot default; direct mode without the Savant backend |
+| OpenCode Go | `/provider opencode-go` | `OPENCODE_GO_API_KEY` | Hosted gateway |
 | TokenRouter | `/provider tokenrouter` | `TOKENROUTER_API_KEY` | Multi-provider gateway |
+| TokenHarbor | `/provider tokenharbor` | `TOKENHARBOR_API_KEY` | OpenAI-compatible hosted gateway at `https://tokenharbor.ai/v1` |
 | NVIDIA NIM | `/provider nvidia` | `NVIDIA_API_KEY` | NVIDIA-hosted inference |
 | CommandCode | `/provider commandcode` | `COMMAND_CODE_API_KEY` | OpenAI-compatible hosted inference |
-| OpenRouter direct | `/provider openrouter` or `DIRECT_PROVIDER=openrouter` | `OR_MASTER_KEY`, `OPENROUTER_API_KEY`, or `INFERENCE_API_KEY` | Direct mode without the Savant backend |
 | Custom endpoint | Environment configuration | `INFERENCE_BASE_URL`, `INFERENCE_API_KEY` | Advanced OpenAI-compatible endpoint |
 
 The interactive key prompt is masked. Saved provider credentials are stored in the user configuration directory and are not added to chat history:
@@ -63,6 +64,7 @@ Shell environment variables take precedence over saved credentials. Configure on
 ```powershell
 # PowerShell — choose one hosted gateway
 $env:OPENCODE_GO_API_KEY = "your-key"
+# $env:TOKENHARBOR_API_KEY = "your-key"
 # $env:TOKENROUTER_API_KEY = "your-key"
 # $env:NVIDIA_API_KEY = "your-key"
 # $env:COMMAND_CODE_API_KEY = "your-key"
@@ -72,6 +74,7 @@ savant-code
 ```cmd
 :: Windows Command Prompt — choose one hosted gateway
 set OPENCODE_GO_API_KEY=your-key
+:: set TOKENHARBOR_API_KEY=your-key
 :: set TOKENROUTER_API_KEY=your-key
 :: set NVIDIA_API_KEY=your-key
 :: set COMMAND_CODE_API_KEY=your-key
@@ -81,6 +84,7 @@ savant-code
 ```bash
 # macOS/Linux — choose one hosted gateway
 export OPENCODE_GO_API_KEY="your-key"
+# export TOKENHARBOR_API_KEY="your-key"
 # export TOKENROUTER_API_KEY="your-key"
 # export NVIDIA_API_KEY="your-key"
 # export COMMAND_CODE_API_KEY="your-key"
@@ -111,7 +115,7 @@ The following is a public template containing dummy values only. Copy it to `.en
 NEXT_PUBLIC_CB_ENVIRONMENT=dev
 NEXT_PUBLIC_WEB_PORT=3000
 NEXT_PUBLIC_SAVANT_CODE_APP_URL=http://localhost:3000
-# NEXT_PUBLIC_FREEBUFF_APP_URL=http://localhost:3001
+# NEXT_PUBLIC_SAVANT_FREE_APP_URL=http://localhost:3001
 
 # Analytics, support, and billing placeholders
 NEXT_PUBLIC_POSTHOG_API_KEY=phc_dummy_replace_me
@@ -131,6 +135,7 @@ OR_MASTER_KEY=dummy-or-master-key-replace-me
 
 # Supported hosted gateways
 OPENCODE_GO_API_KEY=dummy-opencode-go-key-replace-me
+TOKENHARBOR_API_KEY=dummy-tokenharbor-key-replace-me
 TOKENROUTER_API_KEY=dummy-tokenrouter-key-replace-me
 NVIDIA_API_KEY=dummy-nvidia-key-replace-me
 COMMAND_CODE_API_KEY=dummy-commandcode-key-replace-me
@@ -162,7 +167,7 @@ Build release artifacts from a clean shell (no dev `NEXT_PUBLIC_*` exports, no `
 
 ## What Makes Savant-Code Different
 
-Savant-Code is a multi-agent system rather than a single model guessing at your code. Nine canonical ECHO roles coordinate with strict separation of duties:
+Savant-Code is a multi-agent system rather than a single model guessing at your code. Ten canonical ECHO roles coordinate with strict separation of duties:
 
 | Agent | Responsibility |
 | --- | --- |
@@ -175,6 +180,7 @@ Savant-Code is a multi-agent system rather than a single model guessing at your
 | **Scout** | Explores files and code to gather context |
 | **Researcher** | Performs web search, documentation lookup, and multi-query `deep_research` |
 | **Scribe** | Captures session summaries and durable knowledge |
+| **Adversary** | Meta-verification — refutes Verifier findings, re-audits unevidenced PASSes, resolves citations; verdicts override |
 
 Infrastructure helpers such as terminal execution, browser automation, and web/docs tool libraries support these roles; they are not additional roster members.
 
@@ -185,8 +191,10 @@ Every code change follows the ECHO Perfection Loop:
 1. **RED** — identify all failures and issues with evidence.
 2. **GREEN** — implement minimal, surgical changes from the converged FID.
 3. **AUDIT** — independently verify the implementation and call-graph reachability.
-4. **SELF-CORRECT** — resolve audit findings and repeat verification when needed.
-5. **COMPLETE** — record evidence, update tracking, and close the work item.
+4. **ADVERSARIAL** — the Adversary refutes Verifier findings, re-audits
+   unevidenced PASSes, and resolves citations; verdicts override.
+5. **SELF-CORRECT** — resolve audit findings and repeat verification when needed.
+6. **COMPLETE** — record evidence, update tracking, and close the work item.
 
 No code is written without a converged plan, and the implementing agent cannot serve as the final verifier.
 
@@ -194,7 +202,7 @@ No code is written without a converged plan, and the implementing agent cannot s
 
 ### Multi-agent orchestration
 
-- Nine canonical agents coordinate through ECHO with explicit separation of duties.
+- Ten canonical agents coordinate through ECHO with explicit separation of duties.
 - Child agents receive only their authorized tool subset through strict allowlist filtering.
 - Parallel agent work supports exploration, research, implementation, and independent review.
 - FID-bound execution keeps implementation tied to an approved specification.
@@ -290,7 +298,7 @@ The package ships the CLI on top of shared runtime and SDK capabilities:
 
 ## Slash Command Reference
 
-Commands can be entered with `/`; aliases are shown in parentheses. Some commands are intentionally unavailable in Savant-Free builds.
+Commands can be entered with `/`; aliases are shown in parentheses.
 
 | Command | Purpose |
 | --- | --- |
@@ -344,6 +352,19 @@ Commands can be entered with `/`; aliases are shown in parentheses. Some command
 
 > Review my recent changes and flag security issues, performance problems, and style violations.
 
+**Headless / scripting (FID-2026-0806-011):**
+
+```bash
+# Run a single prompt without the TUI and print the final answer to stdout
+savant-code --print "summarize this repo"
+
+# Pipe a prompt in — the CLI auto-enters headless mode
+printf 'add a .gitignore\n' | savant-code
+```
+
+Exit codes: `0` success, `1` error or timeout, `2` usage error.
+`SAVANT_CODE_RUN_TIMEOUT_MS` (default 10 minutes) bounds hung runs.
+
 ## Troubleshooting
 
 ### Permission errors

package/launcher.js

@@ -6,6 +6,7 @@ const http = require('http')
 const https = require('https')
 const os = require('os')
 const path = require('path')
+const readline = require('readline')
 const { pipeline } = require('stream/promises')
 const zlib = require('zlib')
 
@@ -547,6 +548,77 @@ function createLauncher(productConfig) {
     )
   }
 
+  // FID-2026-0806-014: consent before apply. Auto-updates must not silently
+  // replace the running binary or kill the session (Windows locks the exe in
+  // place). The launcher stages the update in the background, records it in a
+  // pending marker, and offers to install it on the next launch — when it owns
+  // stdin and can ask. SAVANT_CODE_NO_AUTO_UPDATE=1 opts out entirely.
+  function getPendingUpdatePath() {
+    return path.join(CONFIG.configDir, `${packageName}-pending-update.json`)
+  }
+
+  function writePendingUpdateMarker(stagedBinary) {
+    try {
+      fs.mkdirSync(CONFIG.configDir, { recursive: true })
+      fs.writeFileSync(
+        getPendingUpdatePath(),
+        JSON.stringify(stagedBinary, null, 2),
+      )
+    } catch {
+      // Best effort; the update is simply not offered next launch.
+    }
+  }
+
+  function readPendingUpdateMarker() {
+    try {
+      const marker = JSON.parse(fs.readFileSync(getPendingUpdatePath(), 'utf8'))
+      if (
+        marker &&
+        typeof marker.version === 'string' &&
+        typeof marker.tempBinaryPath === 'string' &&
+        fs.existsSync(marker.tempBinaryPath)
+      ) {
+        return marker
+      }
+      // Stale marker without a staged binary — drop it.
+      try {
+        fs.rmSync(getPendingUpdatePath(), { force: true })
+      } catch {
+        // Best effort
+      }
+      return null
+    } catch {
+      return null
+    }
+  }
+
+  function clearPendingUpdateMarker() {
+    try {
+      fs.rmSync(getPendingUpdatePath(), { force: true })
+    } catch {
+      // Best effort
+    }
+  }
+
+  /** Ask the user a y/N question on stdin (launcher owns the terminal before
+   *  the child spawns). Resolves false on anything that isn't y/yes. */
+  function askYesNo(question) {
+    return new Promise((resolve) => {
+      const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+      })
+      const finish = (answer) => {
+        rl.close()
+        resolve(answer)
+      }
+      rl.question(question, (answer) => {
+        finish(/^y(es)?$/i.test(String(answer).trim()))
+      })
+      rl.on('SIGINT', () => finish(false))
+    })
+  }
+
   function getFileSize(filePath) {
     try {
       return fs.statSync(filePath).size
@@ -940,9 +1012,7 @@ function createLauncher(productConfig) {
     })
   }
 
-  async function checkForUpdates(runningProcess, exitListener) {
-    let stoppedForUpdate = false
-
+  async function checkForUpdates() {
     try {
       const currentVersion = getCurrentVersion()
 
@@ -954,42 +1024,28 @@ function createLauncher(productConfig) {
         currentVersion === null ||
         compareVersions(currentVersion, latestVersion) < 0
       ) {
+        // FID-2026-0806-014: never install mid-session without consent.
+        if (process.env.SAVANT_CODE_NO_AUTO_UPDATE) return
+
+        // Already staged for this exact version — leave the pending marker alone.
+        const pending = readPendingUpdateMarker()
+        if (pending && pending.version === latestVersion) return
+
         const stagedBinary = await stageBinary(
           latestVersion,
           getDownloadTargetKey(),
           { quiet: true },
         )
+        writePendingUpdateMarker(stagedBinary)
 
         term.clearLine()
-
-        runningProcess.removeListener('exit', exitListener)
-        try {
-          await stopRunningProcess(runningProcess)
-        } catch (error) {
-          runningProcess.on('exit', exitListener)
-          throw error
-        }
-        stoppedForUpdate = true
-
-        resetTerminal({ exitAlternateScreen: true })
-        console.log(`Update available: ${currentVersion} → ${latestVersion}`)
-
-        installStagedBinary(stagedBinary)
-
-        const newChild = spawnInstalledBinary({ detached: false })
-        attachExitHandler(newChild)
-
-        return new Promise(() => {})
-      }
-    } catch (error) {
-      if (stoppedForUpdate && fs.existsSync(CONFIG.binaryPath)) {
-        console.error(
-          `Update failed; restarting ${packageName} ${getCurrentVersion()}.`,
+        term.writeLine(
+          `Update available: ${currentVersion || 'unknown'} → ${latestVersion}. ` +
+            'It will be installed the next time you launch (or set ' +
+            'SAVANT_CODE_NO_AUTO_UPDATE=1 to skip).',
         )
-        const child = spawnInstalledBinary({ detached: false })
-        attachExitHandler(child)
-        return new Promise(() => {})
       }
+    } catch (error) {
       try {
         fs.rmSync(CONFIG.tempDownloadDir, { recursive: true, force: true })
       } catch {
@@ -999,6 +1055,52 @@ function createLauncher(productConfig) {
     }
   }
 
+  /** Offer a pending update (staged last session) and install it on consent.
+   *  Runs before the child spawns, so the launcher owns stdin and the binary
+   *  is not locked by a running session. Returns true when an update was
+   *  installed. */
+  async function applyPendingUpdateIfApproved() {
+    if (process.env.SAVANT_CODE_NO_AUTO_UPDATE) {
+      return false
+    }
+    const pending = readPendingUpdateMarker()
+    if (!pending) {
+      return false
+    }
+
+    const currentVersion = getCurrentVersion()
+    console.log(
+      `Update available: ${currentVersion || 'unknown'} → ${pending.version}`,
+    )
+
+    if (!process.stdin.isTTY) {
+      console.log(
+        'Non-interactive launch — the update will be installed the next time ' +
+          'you run interactively.',
+      )
+      return false
+    }
+
+    const approved = await askYesNo('Install now? [y/N] ')
+    if (!approved) {
+      console.log(
+        'Skipping update. Set SAVANT_CODE_NO_AUTO_UPDATE=1 to stop being asked.',
+      )
+      clearPendingUpdateMarker()
+      return false
+    }
+
+    try {
+      installStagedBinary(pending)
+      clearPendingUpdateMarker()
+      return true
+    } catch (error) {
+      term.clearLine()
+      printDownloadFailure(error)
+      return false
+    }
+  }
+
   function printCrashDiagnostics(code, signal) {
     // Windows NTSTATUS codes (unsigned DWORD)
     const unsignedCode = getUnsignedExitCode(code)
@@ -1213,11 +1315,15 @@ function createLauncher(productConfig) {
 
     await ensureBinaryExists()
 
+    // FID-2026-0806-014: offer a staged update before the child takes over the
+    // terminal. Consent-gated — never silent, never mid-session.
+    await applyPendingUpdateIfApproved()
+
     const child = spawnInstalledBinary()
-    const exitListener = attachExitHandler(child)
+    attachExitHandler(child)
 
     setTimeout(() => {
-      checkForUpdates(child, exitListener)
+      checkForUpdates()
     }, 100)
   }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "savant-code",
-  "version": "0.0.20",
+  "version": "0.0.21",
   "description": "Multi-Agent AI Coding Assistant with ECHO Protocol",
   "license": "Apache-2.0",
   "author": "Savant Code <founders@savant-code.com>",