scalix 0.0.1 → 1.1.0

package/dist/sessions.js

@@ -0,0 +1,106 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import os from 'node:os';
+import { randomUUID } from 'node:crypto';
+import { logger } from './logger.js';
+import { USER_CONFIG_DIR } from './constants.js';
+const SESSIONS_DIR = path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR, 'sessions');
+let cleanupDone = false;
+async function cleanupStaleTempFiles() {
+    if (cleanupDone)
+        return;
+    cleanupDone = true;
+    try {
+        const tmpDir = os.tmpdir();
+        const entries = await fs.readdir(tmpDir);
+        const oneHourAgo = Date.now() - 3600_000;
+        for (const entry of entries) {
+            if (!entry.startsWith('scalix-session-') || !entry.endsWith('.tmp'))
+                continue;
+            try {
+                const fullPath = path.join(tmpDir, entry);
+                const stat = await fs.stat(fullPath);
+                if (stat.mtimeMs < oneHourAgo) {
+                    await fs.unlink(fullPath);
+                    logger.debug('Cleaned up stale temp file', { file: entry });
+                }
+            }
+            catch { }
+        }
+    }
+    catch { }
+}
+async function ensureDir() {
+    await fs.mkdir(SESSIONS_DIR, { recursive: true });
+    await cleanupStaleTempFiles();
+}
+function sessionPath(id) {
+    return path.join(SESSIONS_DIR, `${id}.json`);
+}
+export async function saveSession(id, messages, model, name, costState) {
+    await ensureDir();
+    const existing = await loadSession(id).catch(() => null);
+    const now = new Date().toISOString();
+    const meta = {
+        id,
+        name: name || existing?.meta.name || `Session ${id.slice(0, 8)}`,
+        model,
+        messageCount: messages.length,
+        createdAt: existing?.meta.createdAt || now,
+        updatedAt: now,
+    };
+    const data = { meta, messages, costState };
+    // Atomic write: write to temp file then rename to prevent corruption
+    const tmpPath = path.join(os.tmpdir(), `scalix-session-${id}-${Date.now()}-${randomUUID().slice(0, 8)}.tmp`);
+    await fs.writeFile(tmpPath, JSON.stringify(data, null, 2), { encoding: 'utf-8', mode: 0o600 });
+    await fs.rename(tmpPath, sessionPath(id));
+    return meta;
+}
+export async function loadSession(id) {
+    const raw = await fs.readFile(sessionPath(id), 'utf-8');
+    let data;
+    try {
+        data = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Corrupted session file: ${id}`);
+    }
+    if (!data || typeof data !== 'object' ||
+        !('meta' in data) || !('messages' in data) ||
+        !Array.isArray(data.messages)) {
+        throw new Error(`Invalid session structure: ${id}`);
+    }
+    return data;
+}
+export async function listSessions() {
+    await ensureDir();
+    const files = await fs.readdir(SESSIONS_DIR);
+    const sessions = [];
+    for (const file of files) {
+        if (!file.endsWith('.json'))
+            continue;
+        try {
+            const raw = await fs.readFile(path.join(SESSIONS_DIR, file), 'utf-8');
+            const data = JSON.parse(raw);
+            if (data?.meta?.id && data?.meta?.updatedAt) {
+                sessions.push(data.meta);
+            }
+        }
+        catch (e) {
+            logger.warn('Failed to read session file', { file, error: e.message });
+        }
+    }
+    return sessions.sort((a, b) => b.updatedAt.localeCompare(a.updatedAt));
+}
+export async function deleteSession(id) {
+    try {
+        await fs.unlink(sessionPath(id));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function generateSessionId() {
+    return randomUUID();
+}

package/dist/settings.js

@@ -0,0 +1,260 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { setSecurityConfig } from './sandbox.js';
+import { DEFAULT_BASE_URL, DEFAULT_MODELS, AGENT_DEFAULTS, CONTEXT_DEFAULTS, WEB_DEFAULTS, TOOL_DEFAULTS, SUB_AGENT_DEFAULTS, MULTI_AGENT_DEFAULTS, USER_CONFIG_DIR, registerUserModels, setNetworkSecurityOverrides, } from './constants.js';
+function getConfigDir() {
+    return path.join(process.env.HOME || process.env.USERPROFILE || '.', USER_CONFIG_DIR);
+}
+function getConfigFile() {
+    return path.join(getConfigDir(), 'config.json');
+}
+export const THINKING_MODES = ['off', 'low', 'medium', 'high'];
+export const DEFAULT_SECURITY = {};
+export const DEFAULT_LIMITS = {
+    maxSteps: AGENT_DEFAULTS.maxSteps,
+    maxMessages: AGENT_DEFAULTS.maxMessages,
+    maxContextTokens: CONTEXT_DEFAULTS.maxContextTokens,
+    compressionThreshold: CONTEXT_DEFAULTS.compressionThreshold,
+    maxToolResultTokens: CONTEXT_DEFAULTS.maxToolResultTokens,
+    toolTimeoutMs: AGENT_DEFAULTS.toolTimeoutMs,
+    maxRetries: AGENT_DEFAULTS.maxRetries,
+    messageKeepRatio: AGENT_DEFAULTS.messageKeepRatio,
+    circuitBreakerThreshold: AGENT_DEFAULTS.circuitBreakerThreshold,
+    circuitBreakerResetMs: AGENT_DEFAULTS.circuitBreakerResetMs,
+    commandTimeoutMs: TOOL_DEFAULTS.commandTimeoutMs,
+    webFetchTimeoutMs: WEB_DEFAULTS.fetchTimeoutMs,
+    htmlMaxSize: WEB_DEFAULTS.htmlMaxSize,
+    defaultSearchResults: WEB_DEFAULTS.defaultSearchResults,
+    defaultMaxFetchLength: WEB_DEFAULTS.defaultMaxLength,
+    bgBufferMax: TOOL_DEFAULTS.bgBufferMax,
+    bgCleanupMs: TOOL_DEFAULTS.bgCleanupMs,
+    searchTimeoutMs: TOOL_DEFAULTS.searchTimeoutMs,
+    fileRefTruncation: TOOL_DEFAULTS.fileRefTruncation,
+    charsPerToken: CONTEXT_DEFAULTS.charsPerToken,
+    minRecentMessages: CONTEXT_DEFAULTS.minRecentMessages,
+    subAgentTimeoutMs: SUB_AGENT_DEFAULTS.timeoutMs,
+    subAgentMaxSteps: SUB_AGENT_DEFAULTS.maxSteps,
+    subAgentMaxContextTokens: SUB_AGENT_DEFAULTS.maxContextTokens,
+    subAgentCompressionThreshold: SUB_AGENT_DEFAULTS.compressionThreshold,
+    agentToolTimeoutMs: SUB_AGENT_DEFAULTS.agentToolTimeoutMs,
+    exploreMaxSteps: SUB_AGENT_DEFAULTS.exploreMaxSteps,
+    shellDetectionTimeoutMs: TOOL_DEFAULTS.shellDetectionTimeoutMs,
+    treeMaxEntries: TOOL_DEFAULTS.treeMaxEntries,
+    gitTimeoutMs: TOOL_DEFAULTS.gitTimeoutMs,
+    gitDiffMaxBuffer: TOOL_DEFAULTS.gitDiffMaxBuffer,
+    readFileMaxSize: TOOL_DEFAULTS.readFileMaxSize,
+    maxEditStringLength: TOOL_DEFAULTS.maxEditStringLength,
+    maxNotebookSource: TOOL_DEFAULTS.maxNotebookSource,
+    maxWebFetchLength: TOOL_DEFAULTS.maxWebFetchLength,
+    slidingWindowTarget: CONTEXT_DEFAULTS.slidingWindowTarget,
+    maxConcurrentAgents: MULTI_AGENT_DEFAULTS.maxConcurrentAgents,
+    maxAgentDepth: MULTI_AGENT_DEFAULTS.maxDepth,
+    globalTokenBudget: MULTI_AGENT_DEFAULTS.globalTokenBudget,
+};
+const DEFAULTS = {
+    apiKey: '',
+    baseUrl: DEFAULT_BASE_URL,
+    models: [...DEFAULT_MODELS],
+    customModels: {},
+    limits: { ...DEFAULT_LIMITS },
+    permissionMode: 'default',
+    thinkingMode: 'off',
+    security: { ...DEFAULT_SECURITY },
+    injectionDetection: { enabled: true, sensitivity: 'medium' },
+    disableUpdateCheck: false,
+};
+function safeNumber(val, min, max, fallback) {
+    if (typeof val === 'number' && Number.isFinite(val) && val >= min && val <= max)
+        return val;
+    return fallback;
+}
+function validateConfig(parsed) {
+    const safe = {};
+    if (typeof parsed.apiKey === 'string')
+        safe.apiKey = parsed.apiKey;
+    if (typeof parsed.baseUrl === 'string' && parsed.baseUrl.length > 0)
+        safe.baseUrl = parsed.baseUrl;
+    if (Array.isArray(parsed.models) && parsed.models.every((m) => typeof m === 'string')) {
+        safe.models = parsed.models;
+    }
+    if (typeof parsed.permissionMode === 'string' && ['plan', 'default', 'auto', 'yolo'].includes(parsed.permissionMode)) {
+        safe.permissionMode = parsed.permissionMode;
+    }
+    if (parsed.customModels && typeof parsed.customModels === 'object' && !Array.isArray(parsed.customModels)) {
+        const validated = {};
+        for (const [id, spec] of Object.entries(parsed.customModels)) {
+            const s = spec;
+            if (typeof s === 'object' && s &&
+                typeof s.contextWindow === 'number' && s.contextWindow > 0 &&
+                typeof s.maxOutputTokens === 'number' && s.maxOutputTokens > 0) {
+                validated[id] = { contextWindow: s.contextWindow, maxOutputTokens: s.maxOutputTokens };
+            }
+        }
+        if (Object.keys(validated).length > 0) {
+            safe.customModels = validated;
+        }
+    }
+    if (parsed.limits && typeof parsed.limits === 'object' && !Array.isArray(parsed.limits)) {
+        const l = parsed.limits;
+        safe.limits = {
+            maxSteps: safeNumber(l.maxSteps, 1, Infinity, DEFAULT_LIMITS.maxSteps),
+            maxMessages: safeNumber(l.maxMessages, 1, Infinity, DEFAULT_LIMITS.maxMessages),
+            maxContextTokens: safeNumber(l.maxContextTokens, 1000, Infinity, DEFAULT_LIMITS.maxContextTokens),
+            compressionThreshold: safeNumber(l.compressionThreshold, 0.1, 0.99, DEFAULT_LIMITS.compressionThreshold),
+            maxToolResultTokens: safeNumber(l.maxToolResultTokens, 100, Infinity, DEFAULT_LIMITS.maxToolResultTokens),
+            toolTimeoutMs: safeNumber(l.toolTimeoutMs, 1000, 600_000, DEFAULT_LIMITS.toolTimeoutMs),
+            maxRetries: safeNumber(l.maxRetries, 0, 20, DEFAULT_LIMITS.maxRetries),
+            messageKeepRatio: safeNumber(l.messageKeepRatio, 0.1, 0.99, DEFAULT_LIMITS.messageKeepRatio),
+            circuitBreakerThreshold: safeNumber(l.circuitBreakerThreshold, 1, 50, DEFAULT_LIMITS.circuitBreakerThreshold),
+            circuitBreakerResetMs: safeNumber(l.circuitBreakerResetMs, 1000, 600_000, DEFAULT_LIMITS.circuitBreakerResetMs),
+            commandTimeoutMs: safeNumber(l.commandTimeoutMs, 1000, 600_000, DEFAULT_LIMITS.commandTimeoutMs),
+            webFetchTimeoutMs: safeNumber(l.webFetchTimeoutMs, 1000, 120_000, DEFAULT_LIMITS.webFetchTimeoutMs),
+            htmlMaxSize: safeNumber(l.htmlMaxSize, 1024, Infinity, DEFAULT_LIMITS.htmlMaxSize),
+            defaultSearchResults: safeNumber(l.defaultSearchResults, 1, 100, DEFAULT_LIMITS.defaultSearchResults),
+            defaultMaxFetchLength: safeNumber(l.defaultMaxFetchLength, 1000, Infinity, DEFAULT_LIMITS.defaultMaxFetchLength),
+            bgBufferMax: safeNumber(l.bgBufferMax, 1024, Infinity, DEFAULT_LIMITS.bgBufferMax),
+            bgCleanupMs: safeNumber(l.bgCleanupMs, 60_000, 86_400_000, DEFAULT_LIMITS.bgCleanupMs),
+            searchTimeoutMs: safeNumber(l.searchTimeoutMs, 1000, 600_000, DEFAULT_LIMITS.searchTimeoutMs),
+            fileRefTruncation: safeNumber(l.fileRefTruncation, 1000, Infinity, DEFAULT_LIMITS.fileRefTruncation),
+            charsPerToken: safeNumber(l.charsPerToken, 1, 10, DEFAULT_LIMITS.charsPerToken),
+            minRecentMessages: safeNumber(l.minRecentMessages, 1, 100, DEFAULT_LIMITS.minRecentMessages),
+            subAgentTimeoutMs: safeNumber(l.subAgentTimeoutMs, 5000, Infinity, DEFAULT_LIMITS.subAgentTimeoutMs),
+            subAgentMaxSteps: safeNumber(l.subAgentMaxSteps, 1, Infinity, DEFAULT_LIMITS.subAgentMaxSteps),
+            subAgentMaxContextTokens: safeNumber(l.subAgentMaxContextTokens, 1000, Infinity, DEFAULT_LIMITS.subAgentMaxContextTokens),
+            subAgentCompressionThreshold: safeNumber(l.subAgentCompressionThreshold, 0.1, 0.99, DEFAULT_LIMITS.subAgentCompressionThreshold),
+            agentToolTimeoutMs: safeNumber(l.agentToolTimeoutMs, 5000, Infinity, DEFAULT_LIMITS.agentToolTimeoutMs),
+            exploreMaxSteps: safeNumber(l.exploreMaxSteps, 1, Infinity, DEFAULT_LIMITS.exploreMaxSteps),
+            shellDetectionTimeoutMs: safeNumber(l.shellDetectionTimeoutMs, 500, 30_000, DEFAULT_LIMITS.shellDetectionTimeoutMs),
+            treeMaxEntries: safeNumber(l.treeMaxEntries, 10, Infinity, DEFAULT_LIMITS.treeMaxEntries),
+            gitTimeoutMs: safeNumber(l.gitTimeoutMs, 1000, 120_000, DEFAULT_LIMITS.gitTimeoutMs),
+            gitDiffMaxBuffer: safeNumber(l.gitDiffMaxBuffer, 1024, Infinity, DEFAULT_LIMITS.gitDiffMaxBuffer),
+            readFileMaxSize: safeNumber(l.readFileMaxSize, 1024, Infinity, DEFAULT_LIMITS.readFileMaxSize),
+            maxEditStringLength: safeNumber(l.maxEditStringLength, 1000, Infinity, DEFAULT_LIMITS.maxEditStringLength),
+            maxNotebookSource: safeNumber(l.maxNotebookSource, 1000, Infinity, DEFAULT_LIMITS.maxNotebookSource),
+            maxWebFetchLength: safeNumber(l.maxWebFetchLength, 1000, Infinity, DEFAULT_LIMITS.maxWebFetchLength),
+            slidingWindowTarget: safeNumber(l.slidingWindowTarget, 0.1, 0.99, DEFAULT_LIMITS.slidingWindowTarget),
+            maxConcurrentAgents: safeNumber(l.maxConcurrentAgents, 1, 100, DEFAULT_LIMITS.maxConcurrentAgents),
+            maxAgentDepth: safeNumber(l.maxAgentDepth, 1, 20, DEFAULT_LIMITS.maxAgentDepth),
+            globalTokenBudget: safeNumber(l.globalTokenBudget, 10_000, Infinity, DEFAULT_LIMITS.globalTokenBudget),
+        };
+    }
+    if (typeof parsed.thinkingMode === 'string' && THINKING_MODES.includes(parsed.thinkingMode)) {
+        safe.thinkingMode = parsed.thinkingMode;
+    }
+    if (parsed.security && typeof parsed.security === 'object' && !Array.isArray(parsed.security)) {
+        safe.security = validateSecurityConfig(parsed.security);
+    }
+    if (parsed.injectionDetection && typeof parsed.injectionDetection === 'object') {
+        const id = parsed.injectionDetection;
+        const config = {
+            enabled: typeof id.enabled === 'boolean' ? id.enabled : true,
+            sensitivity: ['low', 'medium', 'high'].includes(id.sensitivity) ? id.sensitivity : 'medium',
+        };
+        if (isStringArray(id.customPatterns)) {
+            config.customPatterns = validateRegexStrings(id.customPatterns);
+        }
+        safe.injectionDetection = config;
+    }
+    if (typeof parsed.disableUpdateCheck === 'boolean') {
+        safe.disableUpdateCheck = parsed.disableUpdateCheck;
+    }
+    return safe;
+}
+function isStringArray(val) {
+    return Array.isArray(val) && val.every((v) => typeof v === 'string');
+}
+function validateRegexStrings(patterns) {
+    return patterns.filter(p => {
+        try {
+            new RegExp(p);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+function validateSecurityConfig(raw) {
+    const sec = {};
+    if (isStringArray(raw.additionalBlockedCommands)) {
+        sec.additionalBlockedCommands = validateRegexStrings(raw.additionalBlockedCommands);
+    }
+    if (isStringArray(raw.disabledBlockedCommands)) {
+        sec.disabledBlockedCommands = raw.disabledBlockedCommands;
+    }
+    if (isStringArray(raw.additionalInjectionPatterns)) {
+        sec.additionalInjectionPatterns = validateRegexStrings(raw.additionalInjectionPatterns);
+    }
+    if (isStringArray(raw.disabledInjectionPatterns)) {
+        sec.disabledInjectionPatterns = raw.disabledInjectionPatterns;
+    }
+    if (isStringArray(raw.additionalReadOnlyTools))
+        sec.additionalReadOnlyTools = raw.additionalReadOnlyTools;
+    if (isStringArray(raw.additionalWriteTools))
+        sec.additionalWriteTools = raw.additionalWriteTools;
+    if (isStringArray(raw.additionalDangerousTools))
+        sec.additionalDangerousTools = raw.additionalDangerousTools;
+    if (raw.toolOverrides && typeof raw.toolOverrides === 'object' && !Array.isArray(raw.toolOverrides)) {
+        const valid = {};
+        const levels = new Set(['read-only', 'write', 'dangerous']);
+        for (const [tool, level] of Object.entries(raw.toolOverrides)) {
+            if (typeof level === 'string' && levels.has(level)) {
+                valid[tool] = level;
+            }
+        }
+        if (Object.keys(valid).length > 0)
+            sec.toolOverrides = valid;
+    }
+    if (typeof raw.allowPrivateNetworkAccess === 'boolean')
+        sec.allowPrivateNetworkAccess = raw.allowPrivateNetworkAccess;
+    if (isStringArray(raw.additionalBlockedHosts))
+        sec.additionalBlockedHosts = raw.additionalBlockedHosts;
+    if (isStringArray(raw.allowedPrivateHosts))
+        sec.allowedPrivateHosts = raw.allowedPrivateHosts;
+    if (isStringArray(raw.additionalSensitiveEnvPatterns)) {
+        sec.additionalSensitiveEnvPatterns = validateRegexStrings(raw.additionalSensitiveEnvPatterns);
+    }
+    if (isStringArray(raw.allowedEnvPatterns)) {
+        sec.allowedEnvPatterns = validateRegexStrings(raw.allowedEnvPatterns);
+    }
+    if (typeof raw.maxImageSize === 'number' && raw.maxImageSize > 0) {
+        sec.maxImageSize = raw.maxImageSize;
+    }
+    return sec;
+}
+async function ensureDir() {
+    await fs.mkdir(getConfigDir(), { recursive: true });
+}
+export function applySecurityConfig(security) {
+    setSecurityConfig(security);
+    setNetworkSecurityOverrides({
+        allowAll: security.allowPrivateNetworkAccess,
+        blockedHosts: security.additionalBlockedHosts,
+        allowedHosts: security.allowedPrivateHosts,
+    });
+}
+export async function loadConfig() {
+    try {
+        const raw = await fs.readFile(getConfigFile(), 'utf-8');
+        const parsed = JSON.parse(raw);
+        const validated = validateConfig(parsed);
+        const config = { ...DEFAULTS, ...validated };
+        if (config.customModels && Object.keys(config.customModels).length > 0) {
+            registerUserModels(config.customModels);
+        }
+        if (config.security && Object.keys(config.security).length > 0) {
+            applySecurityConfig(config.security);
+        }
+        return config;
+    }
+    catch {
+        return { ...DEFAULTS };
+    }
+}
+export async function saveConfig(config) {
+    await ensureDir();
+    await fs.writeFile(getConfigFile(), JSON.stringify(config, null, 2), { encoding: 'utf-8', mode: 0o600 });
+}
+export function isConfigured(config) {
+    return config.apiKey.length > 0 && config.models.length > 0;
+}

package/dist/sub-agent.js

@@ -0,0 +1,154 @@
+import { createAgent } from './agent.js';
+import { defaultTools } from './tools.js';
+import { extraTools } from './tools-extra.js';
+import { webTools } from './tools-web.js';
+import { advancedTools } from './tools-advanced.js';
+import { logger } from './logger.js';
+import { SUB_AGENT_DEFAULTS, CHEAP_MODEL_INDICATORS } from './constants.js';
+import { AgentRegistry, generateAgentId } from './agent-registry.js';
+import { createWorktree, removeWorktree, mergeWorktree } from './worktree.js';
+const READ_ONLY_TOOL_NAMES = new Set([
+    'get_current_time', 'calculate', 'read_file', 'read_file_lines',
+    'list_files', 'search_files', 'find_files', 'tree',
+    'git_status', 'git_diff', 'web_search', 'monitor',
+]);
+function selectTools(level, allowAgentTool = false) {
+    const all = [...defaultTools, ...extraTools, ...webTools, ...advancedTools]
+        .filter((t) => {
+        const name = t.function?.name || t.name;
+        if (name === 'agent' && !allowAgentTool)
+            return false;
+        return true;
+    });
+    switch (level) {
+        case 'read-only':
+            return all.filter((t) => READ_ONLY_TOOL_NAMES.has(t.function?.name || t.name));
+        case 'all':
+            return all;
+        case 'standard':
+        default:
+            return all;
+    }
+}
+export async function spawnSubAgent(parentConfig, prompt, options = {}) {
+    const model = options.model || parentConfig.models[parentConfig.models.length - 1];
+    const allowAgentTool = options.allowAgentTool ?? false;
+    const tools = selectTools(options.tools, allowAgentTool);
+    const timeout = options.timeout ?? SUB_AGENT_DEFAULTS.timeoutMs;
+    const subAgentId = generateAgentId();
+    const parentId = options.parentAgentId ?? null;
+    const description = options.agentDescription ?? 'sub-agent';
+    const registry = AgentRegistry.getInstance();
+    const spawnCheck = registry.canSpawn(parentId);
+    if (!spawnCheck.allowed) {
+        throw new Error(`Cannot spawn agent: ${spawnCheck.reason}`);
+    }
+    const permissionMode = options.permissionMode
+        ?? (options.tools === 'read-only' ? 'plan' : parentConfig.permissionMode ?? 'default');
+    // Worktree isolation for write-capable agents
+    const shouldIsolate = options.isolate !== false && options.tools !== 'read-only';
+    let worktreeInfo = null;
+    if (shouldIsolate) {
+        try {
+            worktreeInfo = await createWorktree(subAgentId, process.cwd());
+            logger.info('Agent isolated in worktree', { agentId: subAgentId, path: worktreeInfo.path });
+        }
+        catch (err) {
+            logger.warn('Worktree creation failed, running without isolation', { error: err.message });
+        }
+    }
+    const isReadOnly = options.tools === 'read-only';
+    const subAgent = createAgent({
+        apiKey: parentConfig.apiKey,
+        baseUrl: parentConfig.baseUrl,
+        model,
+        instructions: options.instructions || 'You are a focused research assistant. Be concise and factual. Respond in under 500 words.',
+        tools,
+        permissionMode,
+        confirmToolCall: options.confirmToolCall,
+        maxSteps: options.maxSteps ?? SUB_AGENT_DEFAULTS.maxSteps,
+        contextManager: {
+            maxContextTokens: SUB_AGENT_DEFAULTS.maxContextTokens,
+            compressionThreshold: SUB_AGENT_DEFAULTS.compressionThreshold,
+        },
+        agentId: subAgentId,
+        parentAgentId: parentId,
+        agentDescription: description,
+        groundingCheck: true,
+        contextRetrieval: !isReadOnly,
+    });
+    let steps = 0;
+    let tokenEstimate = 0;
+    subAgent.on('tool:call', () => { steps++; });
+    subAgent.on('usage', (data) => {
+        tokenEstimate += data.total_tokens ?? 0;
+    });
+    let timer;
+    const timeoutPromise = new Promise((_, reject) => {
+        timer = setTimeout(() => reject(new Error(`Sub-agent timed out after ${timeout}ms`)), timeout);
+    });
+    try {
+        const response = await Promise.race([subAgent.send(prompt), timeoutPromise]);
+        logger.info('Sub-agent completed', { agentId: subAgentId, model, steps, tokens: tokenEstimate });
+        let mergeResult;
+        if (worktreeInfo) {
+            try {
+                mergeResult = await mergeWorktree(worktreeInfo, process.cwd());
+                logger.info('Worktree merge result', {
+                    agentId: subAgentId,
+                    merged: mergeResult.merged,
+                    commits: mergeResult.commitCount,
+                    conflicts: mergeResult.conflicts?.length ?? 0,
+                });
+            }
+            catch (err) {
+                logger.warn('Worktree merge failed', { error: err.message });
+            }
+        }
+        return {
+            response,
+            model,
+            tokenEstimate,
+            steps,
+            agentId: subAgentId,
+            worktree: mergeResult ? {
+                merged: mergeResult.merged,
+                conflicts: mergeResult.conflicts,
+                commitCount: mergeResult.commitCount,
+            } : undefined,
+        };
+    }
+    catch (err) {
+        subAgent.abort();
+        logger.error('Sub-agent failed', { agentId: subAgentId, model, error: err.message });
+        throw err;
+    }
+    finally {
+        clearTimeout(timer);
+        if (worktreeInfo) {
+            try {
+                await removeWorktree(worktreeInfo, process.cwd());
+            }
+            catch (err) {
+                logger.warn('Worktree cleanup failed', { error: err.message });
+            }
+        }
+    }
+}
+export async function spawnParallelAgents(parentConfig, requests) {
+    logger.info('Spawning parallel agents', { count: requests.length });
+    return Promise.allSettled(requests.map(r => spawnSubAgent(parentConfig, r.prompt, {
+        ...r.options,
+        allowAgentTool: r.options?.allowAgentTool ?? true,
+        agentDescription: r.description,
+    })));
+}
+export function pickCheapestModel(models) {
+    const cheapIndicators = CHEAP_MODEL_INDICATORS;
+    for (const model of [...models].reverse()) {
+        const lower = model.toLowerCase();
+        if (cheapIndicators.some((ind) => lower.includes(ind)))
+            return model;
+    }
+    return models[models.length - 1];
+}

package/dist/task-board.js

@@ -0,0 +1,105 @@
+import { EventEmitter } from 'eventemitter3';
+import { randomUUID } from 'node:crypto';
+import { logger } from './logger.js';
+export class TaskBoard extends EventEmitter {
+    static instance = null;
+    tasks = new Map();
+    constructor() {
+        super();
+    }
+    static getInstance() {
+        if (!TaskBoard.instance) {
+            TaskBoard.instance = new TaskBoard();
+        }
+        return TaskBoard.instance;
+    }
+    static resetInstance() {
+        if (TaskBoard.instance) {
+            TaskBoard.instance.removeAllListeners();
+            TaskBoard.instance.tasks.clear();
+        }
+        TaskBoard.instance = null;
+    }
+    create(agentId, title, description) {
+        const task = {
+            id: randomUUID().slice(0, 8),
+            title,
+            description,
+            status: 'open',
+            assignee: null,
+            createdBy: agentId,
+            createdAt: Date.now(),
+            updatedAt: Date.now(),
+        };
+        this.tasks.set(task.id, task);
+        this.emit('task:created', task);
+        logger.debug('Task created', { id: task.id, title, by: agentId });
+        return task;
+    }
+    claim(taskId, agentId) {
+        const task = this.tasks.get(taskId);
+        if (!task) {
+            return { error: `Task "${taskId}" not found` };
+        }
+        if (task.status !== 'open') {
+            return { error: `Task "${taskId}" is not open (status: ${task.status}, assignee: ${task.assignee})` };
+        }
+        task.assignee = agentId;
+        task.status = 'claimed';
+        task.updatedAt = Date.now();
+        this.emit('task:claimed', task);
+        logger.debug('Task claimed', { id: taskId, by: agentId });
+        return task;
+    }
+    update(taskId, agentId, updates) {
+        const task = this.tasks.get(taskId);
+        if (!task) {
+            return { error: `Task "${taskId}" not found` };
+        }
+        if (task.assignee && task.assignee !== agentId && task.createdBy !== agentId) {
+            return { error: `Agent "${agentId}" is not the assignee or creator of task "${taskId}"` };
+        }
+        if (updates.status) {
+            task.status = updates.status;
+            if (updates.status === 'in_progress' && !task.assignee) {
+                task.assignee = agentId;
+            }
+        }
+        if (updates.result !== undefined) {
+            task.result = updates.result;
+        }
+        task.updatedAt = Date.now();
+        if (task.status === 'completed' || task.status === 'failed') {
+            this.emit('task:completed', task);
+        }
+        else {
+            this.emit('task:updated', task);
+        }
+        logger.debug('Task updated', { id: taskId, status: task.status, by: agentId });
+        return task;
+    }
+    list(filter) {
+        let tasks = [...this.tasks.values()];
+        if (filter?.status) {
+            tasks = tasks.filter(t => t.status === filter.status);
+        }
+        if (filter?.assignee) {
+            tasks = tasks.filter(t => t.assignee === filter.assignee);
+        }
+        return tasks;
+    }
+    get(taskId) {
+        return this.tasks.get(taskId);
+    }
+    getStats() {
+        const all = [...this.tasks.values()];
+        return {
+            total: all.length,
+            open: all.filter(t => t.status === 'open').length,
+            claimed: all.filter(t => t.status === 'claimed').length,
+            inProgress: all.filter(t => t.status === 'in_progress').length,
+            completed: all.filter(t => t.status === 'completed').length,
+            failed: all.filter(t => t.status === 'failed').length,
+        };
+    }
+}

package/dist/token-counter.js

@@ -0,0 +1,47 @@
+import { TOKEN_ESTIMATION } from './constants.js';
+const CODE_CHARS = /[{}()\[\]<>;:,."'`=+\-*/%!&|^~?@#$\\]/g;
+const UNICODE_MULTI = /[\u0080-\uffff]/g;
+const WORD_SPLIT = /\s+/;
+export function estimateTokens(text) {
+    if (!text)
+        return 0;
+    const len = text.length;
+    if (len < TOKEN_ESTIMATION.simpleCharsPerToken)
+        return 1;
+    const codeChars = (text.match(CODE_CHARS) || []).length;
+    const unicodeChars = (text.match(UNICODE_MULTI) || []).length;
+    const words = text.split(WORD_SPLIT).filter(Boolean).length;
+    const codeRatio = codeChars / len;
+    const charsPerToken = codeRatio > TOKEN_ESTIMATION.codeRatioThreshold
+        ? TOKEN_ESTIMATION.codeCharsPerToken
+        : TOKEN_ESTIMATION.textCharsPerToken;
+    const charEstimate = (len - unicodeChars) / charsPerToken + unicodeChars * TOKEN_ESTIMATION.unicodeTokenMultiplier;
+    const wordEstimate = words * TOKEN_ESTIMATION.wordTokenMultiplier + codeChars * TOKEN_ESTIMATION.codeCharTokenMultiplier;
+    return Math.max(1, Math.ceil(charEstimate * TOKEN_ESTIMATION.charEstimateWeight + wordEstimate * TOKEN_ESTIMATION.wordEstimateWeight));
+}
+function contentToString(content) {
+    if (!content)
+        return '';
+    if (typeof content === 'string')
+        return content;
+    return content
+        .filter((p) => p.type === 'text')
+        .map((p) => p.text)
+        .join('\n');
+}
+export function estimateMessageTokens(messages) {
+    let total = 0;
+    for (const msg of messages) {
+        total += TOKEN_ESTIMATION.messageOverhead;
+        if (msg.content)
+            total += estimateTokens(contentToString(msg.content));
+        if (msg.tool_calls) {
+            for (const tc of msg.tool_calls) {
+                total += estimateTokens(tc.function.name) + estimateTokens(tc.function.arguments) + TOKEN_ESTIMATION.messageOverhead;
+            }
+        }
+        if (msg.name)
+            total += estimateTokens(msg.name);
+    }
+    return total;
+}