thincoder 0.12.25 → 0.12.27

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "thincoder",
-  "version": "0.12.25",
+  "version": "0.12.27",
   "description": "Thin coding agent - zero dependencies, no build step, Node.js native. Sharp code, zero bloat.",
   "keywords": [
     "ai",

package/src/acp/session.mjs

@@ -12,9 +12,10 @@
  * - `run` is injectable for tests (defaults to the real runAgent).
  */
 import { runAgent } from "../agent.mjs"
+import { saveSession } from "../session.mjs"
 import { buildAcpCallbacks } from "./bridge.mjs"
 
-export function createAcpSession({ id, agent, notify, request = async () => { throw new Error("no request channel") }, log = () => {}, run = runAgent }) {
+export function createAcpSession({ id, agent, notify, request = async () => { throw new Error("no request channel") }, log = () => {}, run = runAgent, save = saveSession }) {
   let controller = new AbortController()
   const callbacks = buildAcpCallbacks({ sessionId: id, notify, request, log })
   let queue = Promise.resolve()
@@ -33,6 +34,11 @@ export function createAcpSession({ id, agent, notify, request = async () => { th
           busy = false
           // Fresh controller per turn: cancel() only affects the in-flight turn.
           controller = new AbortController()
+          // Persist the session archive at EVERY turn end (success/cancel/failure —
+          // finally semantics, desktop proposal ACP-SESSION-PERSISTENCE §2.1 US-E4):
+          // session/list / load / resume get a real data source; a save failure must
+          // never break the queue chain.
+          try { save(agent) } catch (e) { log(`[session] save failed: ${e?.message ?? e}`) }
         }
       })
       // Keep the chain alive even when a turn rejects (the next prompt still runs).

package/src/acp.mjs

@@ -13,13 +13,15 @@
  * `isConfigured` / `createSession` are injectable for tests.
  */
 import { readFileSync } from "node:fs"
-import { resolve } from "node:path"
-import { loadConfig } from "./config.mjs"
+import { resolve, join } from "node:path"
+import { loadConfig, configDir } from "./config.mjs"
 import { assembleAgent } from "./cli/make-agent.mjs"
 import { createAcpServer, ACP_ERRORS } from "./acp/transport.mjs"
 import { createAcpSession } from "./acp/session.mjs"
 import { replayHistory } from "./acp/bridge.mjs"
 import { listSlots, applySession, deleteSlot, sessionPath, normalizeCwd, isLegacyTransient } from "./session.mjs"
+import { createCheckpoint, listCheckpoints, rewind, isGitRepo } from "./git/checkpoint.mjs"
+import { createMemory, list as memList, remove as memRemove } from "./memory.mjs"
 
 const VERSION = JSON.parse(readFileSync(new URL("../package.json", import.meta.url), "utf8")).version
 
@@ -314,6 +316,56 @@ export function buildAcpHandlers({
         })
         return {}
       },
+
+      // ─── M5-pull-forward: checkpoints (desktop proposal ②) + memory (③) ───
+      // Checkpoints are cwd-scoped (same store the TUI git tool uses); non-git cwds
+      // now snapshot by full-directory copy instead of returning null.
+
+      "checkpoint/create": async () => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED }
+        const cp = await createCheckpoint(getCwd())
+        if (!cp) return { error: { ...ACP_ERRORS.INTERNAL, message: "checkpoint creation failed" } }
+        return { checkpoint: { id: cp.id, time: cp.time, files: cp.files, git: isGitRepo(getCwd()) } }
+      },
+
+      "checkpoint/list": async () => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED }
+        const cps = await listCheckpoints(getCwd())
+        return { checkpoints: cps.map((c) => ({ id: c.id, time: c.time, files: (c.tracked?.length ?? 0) + (c.untracked?.length ?? 0), trackedCount: c.tracked?.length ?? 0, untrackedCount: c.untracked?.length ?? 0 })) }
+      },
+
+      "checkpoint/restore": async (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED }
+        if (!params.checkpointId || !params.path) {
+          return { error: { ...ACP_ERRORS.INVALID_PARAMS, message: "checkpoint/restore requires checkpointId and path (single-file restore; full rewind is disabled)" } }
+        }
+        try {
+          await rewind(getCwd(), String(params.checkpointId), { path: String(params.path) })
+          return { restored: String(params.path) }
+        } catch (e) {
+          return { error: { ...ACP_ERRORS.INVALID_PARAMS, message: e?.message ?? String(e) } }
+        }
+      },
+
+      "memory/list": async (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED }
+        const mem = ensureAcpMemory()
+        if (!mem) return { error: { ...ACP_ERRORS.INTERNAL, message: "memory unavailable" } }
+        const entries = await memList(mem, { type: params.type })
+        return { entries: entries.map((e) => ({ id: e.id, type: e.type, title: e.title, tags: e.tags ?? "", updatedAt: e.updatedAt ?? null })) }
+      },
+
+      "memory/remove": async (params) => {
+        if (!authenticated) return { error: ACP_ERRORS.AUTH_REQUIRED }
+        const id = Number(params.id)
+        if (!Number.isInteger(id) || id < 1) {
+          return { error: { ...ACP_ERRORS.INVALID_PARAMS, message: `memory/remove requires a numeric id (got ${params.id})` } }
+        }
+        const mem = ensureAcpMemory()
+        if (!mem) return { error: { ...ACP_ERRORS.INTERNAL, message: "memory unavailable" } }
+        const ok = await memRemove(mem, id)
+        return ok ? { removed: id } : { error: { ...ACP_ERRORS.INVALID_PARAMS, message: `no memory entry #${id}` } }
+      },
     },
     sessions,
     notifyRef,
@@ -321,6 +373,19 @@ export function buildAcpHandlers({
   }
 }
 
+/** Shared memory handle for ACP handlers (same ~/.thincoder store the TUI uses).
+ *  dbPath mirrors the TUI default (see cli/make-agent.mjs). */
+let _acpMemory = null
+function ensureAcpMemory() {
+  if (_acpMemory) return _acpMemory
+  try {
+    _acpMemory = createMemory({ dbPath: join(configDir, "memory.db") })
+    return _acpMemory
+  } catch {
+    return null // memory subsystem unavailable — handlers report it
+  }
+}
+
 /** `thincoder acp` — start the server and block until the client closes the pipe. */
 export async function runAcpServer() {
   const log = (...a) => process.stderr.write(a.join(" ") + "\n")

package/src/agent/setup.mjs

@@ -1,6 +1,11 @@
 /**
  * agent/setup.mjs — runAgent pre-flight setup: context injection, system prompt construction, tool injection
  */
+/** Local time, second precision, for the per-run transient reminder. */
+function timeNowLocal() {
+  return new Date().toLocaleString("sv-SE")
+}
+
 import { search as memorySearch, docSearch } from "../memory.mjs"
 import { pushReal } from "../context.mjs"
 import { toOpenAISchema } from "../tools/index.mjs"
@@ -119,12 +124,14 @@ export async function prepareRun(agent, input, callbacks, {
         })
       }
     }
+    // Time grounding for EVERY agent depth (subagents are short-lived; they also need
+    // to know "now"). Transient — dropped on persist, fresh at every run start.
+    agent.history.push({
+      role: "user",
+      content: `[System reminder: current time is ${timeNowLocal()} (local; timezone ${Intl.DateTimeFormat().resolvedOptions().timeZone || "local"}).]`,
+      transient: true,
+    })
     if (depth === 0) {
-      agent.history.push({
-        role: "user",
-        content: `[System reminder: current time is ${new Date().toISOString()}.]`,
-        transient: true,
-      })
       // Checklist injection: inject pending + in_progress items from .thincoder/checklist.md
       try {
         const { pendingItems } = await import("../tools/checklist.mjs")
@@ -221,10 +228,10 @@ export async function prepareRun(agent, input, callbacks, {
       ? `${base}\n\n${mainOverlay}`
       : base
 
-  // Local time + timezone on every agent (main, subagent, consult) — without it "today"/
-  // "just now"/"recent" in user messages and search freshness are ungrounded.
-  const timeZone = Intl.DateTimeFormat().resolvedOptions().timeZone || "local"
-  systemPrompt += `\n\nCurrent time: ${new Date().toLocaleString("sv-SE")} (${timeZone}).`
+  // Time injection deliberately does NOT live here: system prompts must be byte-identical
+  // across runs (provider prefix caches). The time rides a transient user reminder per turn
+  // (see the current-time injection below) — variable content belongs in the history, not
+  // the cached prefix.
 
   const projectRules = await loadProjectInstructions(agent.cwd)
   if (projectRules) {

package/src/config.mjs

@@ -198,6 +198,20 @@ export function normalizeProxy(proxy) {
  * THINCODER_ACTIVE_MODEL overrides the active model (wins over THINCODER_MODEL — see loadConfig)
  * Provider-specific key fallbacks (when providers[] lacks a key): DEEPSEEK_API_KEY / OPENAI_API_KEY
  */
+/** Keep only { header: "string value" } pairs from a provider's headers field — anything
+ *  else (null, arrays, nested objects) is dropped so it can never reach a fetch call.
+ *  Authorization is built-in and cannot be overridden from headers (core.mjs spreads first). */
+function sanitizeProviderHeaders(p) {
+  if (p.headers == null || typeof p.headers !== "object" || Array.isArray(p.headers)) { delete p.headers; return p }
+  const clean = {}
+  for (const [k, v] of Object.entries(p.headers)) {
+    if (typeof v === "string" && k.toLowerCase() !== "authorization") clean[k] = v
+  }
+  if (Object.keys(clean).length > 0) p.headers = clean
+  else delete p.headers
+  return p
+}
+
 export function loadConfig() {
   let config = {}
   if (existsSync(configPath)) {
@@ -211,7 +225,9 @@ export function loadConfig() {
   const merged = {
     ...DEFAULTS,
     ...config,
-    providers: Array.isArray(config.providers) && config.providers.length ? config.providers.map((p) => ({ ...p })) : DEFAULTS.providers.map((p) => ({ ...p })),
+    providers: Array.isArray(config.providers) && config.providers.length
+      ? config.providers.map((p) => sanitizeProviderHeaders({ ...p }))
+      : DEFAULTS.providers.map((p) => ({ ...p })),
     activeProvider: config.activeProvider ?? DEFAULTS.activeProvider,
     agent: { ...DEFAULTS.agent, ...config.agent },
     memory: { ...DEFAULTS.memory, ...config.memory },

package/src/git/checkpoint.mjs

@@ -88,8 +88,53 @@ async function copyInto(dir, rel, src, skipped) {
  * Per-file metadata ({ size, sha } per copied file) is stored in meta.json — this powers
  * listFileVersions (per-file history across snapshots) without rescanning copies.
  */
+/** Full-directory snapshot for NON-git cwds (desktop proposal ②: createCheckpoint used to
+ *  return null here, silently disabling checkpoints for non-git projects). Every file is
+ *  copied under files/ (v2 layout, same rewind code path); meta carries nongit:true so
+ *  rewind knows to skip git plumbing. Respects .gitignore-like skips via SKIP set only. */
+async function createNonGitCheckpoint(cwd) {
+  const id = Date.now().toString(36) + "-" + Math.random().toString(36).slice(2, 6)
+  const dir = join(checkpointRoot(cwd), id)
+  await mkdir(join(dir, "files"), { recursive: true })
+  await mkdir(join(dir, "untracked"), { recursive: true })
+
+  const skipped = []
+  const fileMeta = {}
+  const all = await collectFiles(cwd)
+  for (const rel of all) {
+    const m = await copyInto(join(dir, "files"), rel, join(cwd, rel), skipped)
+    if (m) fileMeta[rel] = m
+  }
+  await writeFile(join(dir, "patch.diff"), "", "utf8") // no patch in nongit mode (layout compat)
+  await writeFile(join(dir, "meta.json"), JSON.stringify({
+    version: META_VERSION, id, time: Date.now(), nongit: true,
+    untracked: [], tracked: all, trackedAll: all, skipped, head: "", fileMeta, untrackedMeta: {},
+  }, null, 2), "utf8")
+  await pruneCheckpoints(cwd)
+  return { id, time: Date.now(), files: all.length, tracked: all, untracked: [], skipped }
+}
+
+/** Walk a non-git cwd collecting every file (relative paths), skipping heavy/irrelevant dirs. */
+async function collectFiles(cwd) {
+  const SKIP = new Set(["node_modules", ".git", "dist", "build", ".turbo", "coverage", ".next", "target", "__pycache__", ".venv"])
+  const out = []
+  async function walk(rel) {
+    const abs = rel ? join(cwd, rel) : cwd
+    let entries
+    try { entries = await readdir(abs, { withFileTypes: true }) } catch { return }
+    for (const e of entries) {
+      if (e.name.startsWith(".thincoder")) continue
+      const child = rel ? `${rel}/${e.name}` : e.name
+      if (e.isDirectory()) { if (!SKIP.has(e.name)) await walk(child) }
+      else out.push(child)
+    }
+  }
+  await walk("")
+  return out
+}
+
 export async function createCheckpoint(cwd) {
-  if (!isGitRepo(cwd)) return null
+  if (!isGitRepo(cwd)) return createNonGitCheckpoint(cwd)
 
   // Random suffix: prevents id collisions for two snapshots in the same millisecond (sorting stays ordered by timestamp prefix)
   const id = Date.now().toString(36) + "-" + Math.random().toString(36).slice(2, 6)

package/src/provider/core.mjs

@@ -267,7 +267,7 @@ export function normalizeToolPairing(messages) {
 /** List available model IDs from the provider's /models endpoint */
 export async function listModels(provider, { signal } = {}) {
   const response = await fetch(`${provider.baseURL}/models`, {
-    headers: { Authorization: `Bearer ${provider.apiKey}` },
+    headers: { ...(provider.headers ?? {}), Authorization: `Bearer ${provider.apiKey}` },
     signal,
   })
   if (!response.ok) {
@@ -294,6 +294,7 @@ async function requestWithRetry(provider, body, signal, onWait) {
       const opts = {
         method: "POST",
         headers: {
+          ...(provider.headers ?? {}), // custom per-provider headers (desktop proposal ④: X-Device-Id etc.)
           "Content-Type": "application/json",
           Authorization: `Bearer ${provider.apiKey}`,
         },