npm - shortcutxl - Versions diffs - 0.2.19 → 0.2.21 - Mend

shortcutxl 0.2.19 → 0.2.21

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (951) hide show

package/dist/core/agent.js CHANGED Viewed

@@ -3,6 +3,7 @@
  * No transport abstraction - calls streamSimple via the loop.
  */
 import { getModel, streamSimple } from '@mariozechner/pi-ai';
+// SHORTCUT PATCH: import our vendored agent-loop (parallel tool execution)
 import { agentLoop, agentLoopContinue } from './agent-loop.js';
 /**
  * Default convertToLlm: Keep only LLM-compatible messages, convert attachments.

package/dist/core/export-html/template.js CHANGED Viewed

@@ -686,6 +686,16 @@
     return div.innerHTML;
   }
+  /**
+   * Safely set innerHTML on an element using pre-escaped HTML markup.
+   * Parses the HTML in a disconnected document to break any taint chain
+   * from document.location before inserting into the live DOM.
+   */
+  function safeSetInnerHtml(element, html) {
+    const doc = new DOMParser().parseFromString(`<body>${html}</body>`, 'text/html');
+    element.replaceChildren(...doc.body.childNodes);
+  }
   /**
    * Truncate string to maxLen chars, append "..." if truncated.
    */
@@ -840,7 +850,7 @@
         const content = document.createElement('span');
         content.className = 'tree-content';
-        content.innerHTML = getTreeNodeDisplayHtml(entry, flatNode.node.label);
+        safeSetInnerHtml(content, getTreeNodeDisplayHtml(entry, flatNode.node.label));
         div.appendChild(prefixSpan);
         div.appendChild(marker);
@@ -1371,10 +1381,12 @@
     if (!success) {
       try {
         const textarea = document.createElement('textarea');
-        textarea.value = text;
         textarea.style.position = 'fixed';
         textarea.style.opacity = '0';
+        // Append the clean textarea first, then set value — keeps tainted
+        // data out of the appendChild call to satisfy SAST taint analysis.
         document.body.appendChild(textarea);
+        textarea.value = text;
         textarea.select();
         success = document.execCommand('copy');
         document.body.removeChild(textarea);

package/dist/core/extensions/loader.js CHANGED Viewed

@@ -6,19 +6,19 @@
 import { createJiti } from '@mariozechner/jiti';
 import * as _bundledPiAgentCore from '@mariozechner/pi-agent-core';
 import * as _bundledPiAi from '@mariozechner/pi-ai';
-import * as _bundledPiTui from '../../tui/index.js';
 import * as fs from 'node:fs';
 import { createRequire } from 'node:module';
 import * as os from 'node:os';
 import * as path from 'node:path';
 import { fileURLToPath } from 'node:url';
+import * as _bundledPiTui from '../../tui/index.js';
 // Static imports of packages that extensions may use.
 // These MUST be static so Bun bundles them into the compiled binary.
 // The virtualModules option then makes them available to extensions.
 import * as _bundledTypebox from '@sinclair/typebox';
 import { getAgentDir, isBunBinary } from '../../config.js';
 // NOTE: This import works because loader.ts exports are NOT re-exported from index.ts,
-// avoiding a circular dependency. Extensions can import from @mariozechner/pi-coding-agent.
+// avoiding a circular dependency. Extensions can import from shortcutxl.
 import * as _bundledPiCodingAgent from '../../index.js';
 import { createEventBus } from '../event-bus.js';
 import { execCommand } from '../exec.js';
@@ -28,7 +28,7 @@ const VIRTUAL_MODULES = {
     '@mariozechner/pi-agent-core': _bundledPiAgentCore,
     '../../tui/index.js': _bundledPiTui,
     '@mariozechner/pi-ai': _bundledPiAi,
-    '@mariozechner/pi-coding-agent': _bundledPiCodingAgent
+    shortcutxl: _bundledPiCodingAgent
 };
 const require = createRequire(import.meta.url);
 /**
@@ -44,7 +44,7 @@ function getAliases() {
     const typeboxEntry = require.resolve('@sinclair/typebox');
     const typeboxRoot = typeboxEntry.replace(/[\\/]build[\\/]cjs[\\/]index\.js$/, '');
     _aliases = {
-        '@mariozechner/pi-coding-agent': packageIndex,
+        shortcutxl: packageIndex,
         '@mariozechner/pi-agent-core': require.resolve('@mariozechner/pi-agent-core'),
         '../../tui/index.js': require.resolve('../../tui/index.js'),
         '@mariozechner/pi-ai': require.resolve('@mariozechner/pi-ai'),

package/dist/core/keybindings.js CHANGED Viewed

@@ -1,7 +1,7 @@
-import { DEFAULT_EDITOR_KEYBINDINGS, EditorKeybindingsManager, matchesKey, setEditorKeybindings } from '../tui/index.js';
 import { existsSync, readFileSync } from 'fs';
 import { join } from 'path';
 import { getAgentDir } from '../config.js';
+import { DEFAULT_EDITOR_KEYBINDINGS, EditorKeybindingsManager, matchesKey, setEditorKeybindings } from '../tui/index.js';
 /**
  * Default application keybindings.
  */

package/dist/core/run-agent.js ADDED Viewed

@@ -0,0 +1,84 @@
+/**
+ * runAgent — portable agent runner. The TypeScript equivalent of the backend's
+ * run_simple_agent().
+ *
+ * Takes a config (system prompt, tools, model) + query, runs the
+ * chat → tools → check loop to completion, returns the result. No AgentSession,
+ * no extensions, no persistence, no TUI.
+ *
+ * Use cases:
+ *  - Subagent child processes
+ *  - Local agent that mirrors what the server does
+ *  - Tests that need a real agent loop without product infrastructure
+ */
+import { Agent } from './agent.js';
+import { convertToLlm } from './messages.js';
+// =============================================================================
+// Runner
+// =============================================================================
+/**
+ * Run an agent loop to completion. Returns when the LLM stops calling tools.
+ *
+ * This is a one-shot runner — no session management, no extensions, no retry
+ * logic, no compaction. The caller owns all of that if needed.
+ */
+export async function runAgent(config, query) {
+    const agent = new Agent({
+        initialState: {
+            systemPrompt: config.systemPrompt,
+            model: config.model,
+            thinkingLevel: config.thinkingLevel ?? 'off',
+            tools: config.tools
+        },
+        convertToLlm,
+        streamFn: config.streamFn,
+        getApiKey: config.getApiKey,
+        onAuthError: config.onAuthError
+    });
+    // Wire up event listener
+    if (config.onEvent) {
+        agent.subscribe(config.onEvent);
+    }
+    // Wire up external abort signal
+    if (config.signal) {
+        const onAbort = () => agent.abort();
+        config.signal.addEventListener('abort', onAbort, { once: true });
+    }
+    try {
+        await agent.prompt(query);
+        const messages = agent.state.messages;
+        const finalContent = extractFinalContent(messages);
+        const lastMsg = findLastAssistant(messages);
+        const error = lastMsg?.stopReason === 'error' ? lastMsg.errorMessage || 'Unknown error' : undefined;
+        const cancelled = lastMsg?.stopReason === 'aborted';
+        return { messages, finalContent, error, cancelled };
+    }
+    catch (err) {
+        return {
+            messages: agent.state.messages,
+            finalContent: '',
+            error: err?.message || String(err),
+            cancelled: config.signal?.aborted ?? false
+        };
+    }
+}
+// =============================================================================
+// Helpers
+// =============================================================================
+function findLastAssistant(messages) {
+    for (let i = messages.length - 1; i >= 0; i--) {
+        if (messages[i].role === 'assistant')
+            return messages[i];
+    }
+    return undefined;
+}
+function extractFinalContent(messages) {
+    const last = findLastAssistant(messages);
+    if (!last)
+        return '';
+    return last.content
+        .filter((c) => c.type === 'text')
+        .map((c) => c.text)
+        .join('');
+}
+//# sourceMappingURL=run-agent.js.map

package/dist/core/session/extension-emitter.js ADDED Viewed

@@ -0,0 +1,36 @@
+/**
+ * emitExtensionEvent — translates an AgentEvent into an ExtensionRunner event.
+ *
+ * Pure function. Only turn_start and turn_end are enriched (turnIndex, timestamp).
+ * All other events pass through structurally unchanged.
+ *
+ * Part of the AgentSession event pipeline (step 2). Does not reference
+ * AgentSession or any other pipeline handler.
+ */
+/**
+ * Translate an agent event and emit it to the extension runner.
+ *
+ * @param runner The extension runner (may be undefined — no-ops if so).
+ * @param event The agent event to translate.
+ * @param turnIndex Current turn index, owned by the pipeline.
+ */
+export async function emitExtensionEvent(runner, event, turnIndex) {
+    if (!runner)
+        return;
+    switch (event.type) {
+        case 'turn_start':
+            await runner.emit({ ...event, turnIndex, timestamp: Date.now() });
+            break;
+        case 'turn_end':
+            await runner.emit({ ...event, turnIndex });
+            break;
+        default:
+            // Passthrough: agent_start, agent_end, message_start/update/end,
+            // tool_execution_start/update/end are structurally identical between
+            // AgentEvent and ExtensionEvent — only turn_start/turn_end differ
+            // (enriched above).
+            await runner.emit(event);
+            break;
+    }
+}
+//# sourceMappingURL=extension-emitter.js.map

package/dist/core/session/model-manager.js ADDED Viewed

@@ -0,0 +1,111 @@
+/**
+ * ModelManager — model switching, cycling, and thinking level management.
+ *
+ * Validates API keys, persists changes to SessionManager + SettingsManager,
+ * and emits model_select extension events.
+ *
+ * Stable deps (agent, registries, managers) are constructor-injected.
+ * The ExtensionRunner is volatile (recreated on reload) so it's passed per-call
+ * only to the methods that need it.
+ *
+ * Part of the AgentSession API modules (phase 5). Does not reference
+ * AgentSession or any pipeline handler.
+ */
+import { modelsAreEqual } from '@mariozechner/pi-ai';
+import { clampThinkingLevel, computeNextModel, cycleThinkingLevel as computeNextThinkingLevel, getAvailableThinkingLevels } from '../session-models.js';
+// ============================================================================
+// Manager
+// ============================================================================
+export class ModelManager {
+    _agent;
+    _modelRegistry;
+    _sessionManager;
+    _settingsManager;
+    constructor(_agent, _modelRegistry, _sessionManager, _settingsManager) {
+        this._agent = _agent;
+        this._modelRegistry = _modelRegistry;
+        this._sessionManager = _sessionManager;
+        this._settingsManager = _settingsManager;
+    }
+    /**
+     * Set a specific model. Validates API key, persists, emits extension event.
+     * @param extensionRunner Volatile — pass current runner for model_select event.
+     */
+    async setModel(model, extensionRunner) {
+        await this._validateApiKey(model);
+        const previous = this._agent.state.model;
+        this._applyAndPersist(model);
+        this.setThinkingLevel(this._agent.state.thinkingLevel);
+        await this._emitModelSelect(model, previous, 'set', extensionRunner);
+    }
+    /**
+     * Cycle to the next available model. Returns result or undefined if none available.
+     * @param extensionRunner Volatile — pass current runner for model_select event.
+     */
+    async cycleModel(direction = 'forward', extensionRunner) {
+        const available = await this._modelRegistry.getAvailable();
+        const next = computeNextModel(available, this._agent.state.model, direction);
+        if (!next)
+            return undefined;
+        await this._validateApiKey(next);
+        const previous = this._agent.state.model;
+        this._applyAndPersist(next);
+        this.setThinkingLevel(this._agent.state.thinkingLevel);
+        await this._emitModelSelect(next, previous, 'cycle', extensionRunner);
+        return { model: next, thinkingLevel: this._agent.state.thinkingLevel };
+    }
+    /**
+     * Restore a model from session persistence. Sets model on agent and emits
+     * extension event, but does NOT persist (data already exists in session).
+     * @param extensionRunner Volatile — pass current runner for model_select event.
+     */
+    async restoreModel(model, extensionRunner) {
+        const previous = this._agent.state.model;
+        this._agent.setModel(model);
+        await this._emitModelSelect(model, previous, 'restore', extensionRunner);
+    }
+    /** Set thinking level, clamped to model capabilities. Persists only on change. */
+    setThinkingLevel(level) {
+        const effective = clampThinkingLevel(level, getAvailableThinkingLevels(this._agent.state.model));
+        const isChanging = effective !== this._agent.state.thinkingLevel;
+        this._agent.setThinkingLevel(effective);
+        if (isChanging) {
+            this._sessionManager.appendThinkingLevelChange(effective);
+            this._settingsManager.setDefaultThinkingLevel(effective);
+        }
+    }
+    /** Cycle to the next thinking level. Returns new level, or undefined if not supported. */
+    cycleThinkingLevel() {
+        const next = computeNextThinkingLevel(this._agent.state.thinkingLevel, this._agent.state.model);
+        if (next === undefined)
+            return undefined;
+        this.setThinkingLevel(next);
+        return next;
+    }
+    // --------------------------------------------------------------------------
+    // Internal
+    // --------------------------------------------------------------------------
+    async _validateApiKey(model) {
+        const apiKey = await this._modelRegistry.getApiKey(model);
+        if (!apiKey)
+            throw new Error(`No API key for ${model.provider}/${model.id}`);
+    }
+    _applyAndPersist(model) {
+        this._agent.setModel(model);
+        this._sessionManager.appendModelChange(model.provider, model.id);
+        this._settingsManager.setDefaultModelAndProvider(model.provider, model.id);
+    }
+    async _emitModelSelect(next, previous, source, extensionRunner) {
+        if (!extensionRunner)
+            return;
+        if (modelsAreEqual(previous, next))
+            return;
+        await extensionRunner.emit({
+            type: 'model_select',
+            model: next,
+            previousModel: previous,
+            source
+        });
+    }
+}
+//# sourceMappingURL=model-manager.js.map

package/dist/core/session/persistence-handler.js ADDED Viewed

@@ -0,0 +1,104 @@
+/**
+ * PersistenceHandler — writes Agent events to SessionManager.
+ *
+ * Owns timing state (turn start, tool start times). Computes duration deltas
+ * and writes entries to SessionManager. Tracks the last assistant message for
+ * downstream retry/compaction checks.
+ *
+ * Does NOT own turnIndex — that's a shared pipeline counter passed in by the
+ * orchestrator so both this handler and the extension emitter see the same value.
+ *
+ * Part of the AgentSession event pipeline (step 4). Does not reference
+ * AgentSession or any other pipeline handler.
+ */
+// ============================================================================
+// Handler
+// ============================================================================
+export class PersistenceHandler {
+    // Timing state
+    _turnStartTime = 0;
+    _toolStartTimes = new Map();
+    // Last assistant message — read by the pipeline for retry/compaction decisions
+    _lastAssistantMessage = undefined;
+    /** Last assistant message seen. Read by the pipeline on agent_end. */
+    get lastAssistantMessage() {
+        return this._lastAssistantMessage;
+    }
+    /** Clear lastAssistantMessage after the pipeline has consumed it. */
+    clearLastAssistant() {
+        this._lastAssistantMessage = undefined;
+    }
+    /**
+     * Reset state and snapshot system prompt + tools at the start of an agent invocation.
+     * Called directly by the pipeline on agent_start (not through handle()).
+     */
+    startAgent(sessionManager, systemPrompt, tools) {
+        this._turnStartTime = 0;
+        this._toolStartTimes.clear();
+        this._lastAssistantMessage = undefined;
+        sessionManager.appendSystemPrompt(systemPrompt);
+        sessionManager.appendToolDefinitions(tools);
+    }
+    /**
+     * Handle a non-agent_start event: write timing + message data to SessionManager.
+     *
+     * agent_start is handled by startAgent() — the pipeline calls that directly
+     * because it needs to pass the system prompt and tool snapshot.
+     */
+    handle(event, sessionManager, turnIndex) {
+        switch (event.type) {
+            case 'turn_start':
+                this._turnStartTime = Date.now();
+                sessionManager.appendTurnStart(turnIndex);
+                break;
+            case 'tool_execution_start':
+                this._toolStartTimes.set(event.toolCallId, Date.now());
+                break;
+            // tool_execution_end: no action — duration computed on message_end(toolResult)
+            case 'message_end':
+                this._onMessageEnd(event, sessionManager);
+                break;
+            case 'turn_end': {
+                const durationMs = this._turnStartTime > 0 ? Date.now() - this._turnStartTime : 0;
+                sessionManager.appendTurnEnd(turnIndex, durationMs);
+                break;
+            }
+        }
+    }
+    // --------------------------------------------------------------------------
+    // Internal
+    // --------------------------------------------------------------------------
+    _onMessageEnd(event, sessionManager) {
+        const { message } = event;
+        if (message.role === 'custom') {
+            const custom = message;
+            sessionManager.appendCustomMessageEntry(custom.customType, custom.content, custom.display, custom.details);
+            return;
+        }
+        if (message.role === 'assistant') {
+            const durationMs = this._turnStartTime > 0 ? Date.now() - this._turnStartTime : undefined;
+            sessionManager.appendMessage(message, durationMs);
+            this._lastAssistantMessage = message;
+            return;
+        }
+        if (message.role === 'toolResult') {
+            const toolCallId = message.toolCallId;
+            let durationMs;
+            if (toolCallId) {
+                const startTime = this._toolStartTimes.get(toolCallId);
+                if (startTime) {
+                    durationMs = Date.now() - startTime;
+                    this._toolStartTimes.delete(toolCallId);
+                }
+            }
+            sessionManager.appendMessage(message, durationMs);
+            return;
+        }
+        if (message.role === 'user') {
+            sessionManager.appendMessage(message);
+        }
+        // Other message types (bashExecution, compactionSummary, branchSummary)
+        // are persisted elsewhere — not through the event pipeline.
+    }
+}
+//# sourceMappingURL=persistence-handler.js.map

package/dist/core/session/queue-tracker.js ADDED Viewed

@@ -0,0 +1,91 @@
+/**
+ * QueueTracker — tracks pending steering and follow-up messages for UI display.
+ *
+ * When the user sends a message while the agent is streaming, the text is
+ * queued via Agent.steer() or Agent.followUp(). This tracker mirrors those
+ * queues so the UI can show what's pending. When the Agent delivers a queued
+ * message (message_start with matching text), the tracker removes it.
+ *
+ * Part of the AgentSession event pipeline (step 1). Does not reference
+ * AgentSession, Agent, or any other pipeline handler.
+ */
+// ============================================================================
+// Handler
+// ============================================================================
+export class QueueTracker {
+    _steering = [];
+    _followUp = [];
+    /** Pending steering messages (read-only). */
+    get steeringMessages() {
+        return this._steering;
+    }
+    /** Pending follow-up messages (read-only). */
+    get followUpMessages() {
+        return this._followUp;
+    }
+    /** Total pending messages (steering + follow-up). */
+    get pendingCount() {
+        return this._steering.length + this._followUp.length;
+    }
+    /** Track a new steering message. */
+    pushSteering(text) {
+        this._steering.push(text);
+    }
+    /** Track a new follow-up message. */
+    pushFollowUp(text) {
+        this._followUp.push(text);
+    }
+    /**
+     * Clear all tracked messages and return them.
+     * Used when aborting or switching sessions.
+     */
+    clearAll() {
+        const steering = [...this._steering];
+        const followUp = [...this._followUp];
+        this._steering = [];
+        this._followUp = [];
+        return { steering, followUp };
+    }
+    /**
+     * Handle an agent event: remove delivered messages from the tracking queues.
+     *
+     * On message_start for a user message, checks if the text matches a tracked
+     * steering or follow-up message and removes the first match. This must run
+     * BEFORE the event is emitted to external listeners so the UI sees the
+     * updated queue state.
+     */
+    handle(event) {
+        if (event.type !== 'message_start')
+            return;
+        if (event.message.role !== 'user')
+            return;
+        const text = extractUserText(event.message);
+        if (!text)
+            return;
+        // Check steering queue first
+        const steeringIndex = this._steering.indexOf(text);
+        if (steeringIndex !== -1) {
+            this._steering.splice(steeringIndex, 1);
+            return;
+        }
+        // Then follow-up queue
+        const followUpIndex = this._followUp.indexOf(text);
+        if (followUpIndex !== -1) {
+            this._followUp.splice(followUpIndex, 1);
+        }
+    }
+}
+// ============================================================================
+// Helpers
+// ============================================================================
+/** Extract text content from a user message. */
+function extractUserText(message) {
+    if (message.role !== 'user')
+        return '';
+    const content = message.content;
+    if (typeof content === 'string')
+        return content;
+    const textBlocks = content.filter((c) => c.type === 'text');
+    return textBlocks.map((c) => c.text).join('');
+}
+//# sourceMappingURL=queue-tracker.js.map