vipcode 0.0.0-stage → 0.2.1

package/dist/permissions.js

@@ -0,0 +1,144 @@
+import os from "node:os";
+import path from "node:path";
+import { deepMerge } from "./config.js";
+import { wildcardMatch } from "./match.js";
+import { HOME_DIR, INSTALL_DIR } from "./paths.js";
+const STRICTNESS = { allow: 0, ask: 1, deny: 2 };
+function strictest(a, b) {
+    if (STRICTNESS[b] > STRICTNESS[a]) {
+        return b;
+    }
+    return a;
+}
+// Reglas tipo { "*": "ask", "git status*": "allow" }: gana el patrón más concreto (el más largo)
+export function matchRules(rules, subject, fallback) {
+    if (!rules) {
+        return fallback;
+    }
+    if (typeof rules === "string") {
+        return rules;
+    }
+    let best = null;
+    for (const [pattern, action] of Object.entries(rules)) {
+        if (wildcardMatch(pattern, subject) && (!best || pattern.length >= best.length)) {
+            best = { length: pattern.length, action };
+        }
+    }
+    if (best) {
+        return best.action;
+    }
+    return fallback;
+}
+// Parte "a && b | c; d" en comandos sueltos para que "git status && rm -rf x" no pase como "git status"
+// Redirecciones que no escriben ficheros (2>&1, >/dev/null): no cuentan como separadores ni como escritura
+const HARMLESS_REDIRECTS = /\d*>&\d+|&>\s*\/dev\/null|\d*>>?\s*\/dev\/null/g;
+export function splitCommand(command) {
+    // Un & suelto (segundo plano) también separa: «ls & rm -rf ~» son dos comandos
+    return command
+        .replace(HARMLESS_REDIRECTS, " ")
+        .split(/&&|\|\||;|\||\n|&/)
+        .map((part) => part.trim())
+        .filter((part) => part.length > 0);
+}
+export function evaluate(config, kind, subject) {
+    if (kind === "none") {
+        return "allow";
+    }
+    if (kind === "write") {
+        return config.edit || "ask";
+    }
+    if (kind === "web") {
+        return config.webfetch || "ask";
+    }
+    if (kind === "mcp") {
+        return matchRules(config.mcp, subject, "ask");
+    }
+    const parts = splitCommand(subject);
+    let result = "allow";
+    if (parts.length === 0) {
+        result = matchRules(config.bash, subject, "ask");
+    }
+    for (const part of parts) {
+        result = strictest(result, matchRules(config.bash, part, "ask"));
+    }
+    // Una sustitución $(...) o `...` puede esconder cualquier cosa
+    // Sustituciones, escribir en ficheros (> o --output) y saltos de línea raros siempre se preguntan,
+    // aunque el comando esté permitido (si no, «ls > ~/.zshrc» pasaría por «ls*»)
+    const writes = /[<>]\(|>/.test(subject.replace(HARMLESS_REDIRECTS, " ")) || /--output\b|\r/.test(subject);
+    if (/\$\(|`/.test(subject) || writes) {
+        result = strictest(result, "ask");
+    }
+    return result;
+}
+// Mezcla los permisos generales con los de un agente concreto
+export function permissionsFor(base, override) {
+    if (!override) {
+        return base;
+    }
+    return deepMerge(base, override);
+}
+// Sugerencia de patrón para "siempre este comando": "npm test -- --watch" → "npm test*"
+export function suggestPattern(command) {
+    const first = splitCommand(command)[0] || command.trim();
+    const words = first.split(/\s+/);
+    const twoWords = ["npm", "pnpm", "yarn", "bun", "git", "cargo", "go", "pip", "pip3", "python", "python3", "node", "npx", "docker", "make", "uv", "poetry", "deno", "composer", "php", "dotnet", "mvn", "gradle", "./gradlew", "bundle", "rails", "rake", "pytest", "php artisan"];
+    if (words.length >= 2 && twoWords.includes(words[0])) {
+        return `${words[0]} ${words[1]}*`;
+    }
+    return `${words[0]}*`;
+}
+// Permisos concedidos durante la sesión ("sí a todo", "siempre este comando")
+export class SessionGrants {
+    kinds = new Set();
+    patterns = [];
+    allowKind(kind) {
+        this.kinds.add(kind);
+    }
+    allowPattern(kind, pattern) {
+        this.patterns.push({ kind, pattern });
+    }
+    allows(kind, subject) {
+        if (this.kinds.has(kind)) {
+            return true;
+        }
+        const patterns = this.patterns.filter((entry) => entry.kind === kind).map((entry) => entry.pattern);
+        if (patterns.length === 0) {
+            return false;
+        }
+        if (kind === "bash") {
+            if (/\$\(|`/.test(subject)) {
+                return false;
+            }
+            const parts = splitCommand(subject);
+            return parts.length > 0 && parts.every((part) => patterns.some((pattern) => wildcardMatch(pattern, part)));
+        }
+        return patterns.some((pattern) => wildcardMatch(pattern, subject));
+    }
+}
+// Decide si una acción se permite sola, se bloquea o hay que preguntar
+// Un comando que nombra la carpeta de datos de vipcode o su instalación (para leer tus claves, cambiar la
+// configuración o tocar su propio código) se pregunta siempre: no vale ninguna regla allow ni «sí a todo»
+export function touchesVipcode(command) {
+    const home = os.homedir();
+    const names = [HOME_DIR, INSTALL_DIR, "lib/node_modules/vipcode"];
+    if (HOME_DIR.startsWith(home + path.sep)) {
+        const inHome = HOME_DIR.slice(home.length + 1);
+        names.push(`~/${inHome}`, `$HOME/${inHome}`, `\${HOME}/${inHome}`);
+    }
+    return names.some((name) => command.includes(name));
+}
+export function createAsker(getConfig, grants, prompt) {
+    return async (request) => {
+        const action = evaluate(getConfig(), request.kind, request.subject);
+        if (action === "deny") {
+            return { allow: false, feedback: "bloqueado por la configuración de permisos (deny)" };
+        }
+        if (request.kind === "bash" && touchesVipcode(request.subject)) {
+            return prompt({ ...request, title: `${request.title} (toca la carpeta de vipcode)` });
+        }
+        if (action === "allow" || grants.allows(request.kind, request.subject)) {
+            return { allow: true };
+        }
+        return prompt(request);
+    };
+}

package/dist/prompt.js

@@ -0,0 +1,123 @@
+import fs from "node:fs";
+import path from "node:path";
+import fg from "fast-glob";
+import { GLOBAL_INSTRUCTIONS_PATH } from "./paths.js";
+function readLimited(file, max = 15000) {
+    try {
+        return fs.readFileSync(file, "utf8").slice(0, max);
+    }
+    catch {
+        return "";
+    }
+}
+// Instrucciones del proyecto, igual que hace opencode con AGENTS.md
+function projectInstructions(root, extra) {
+    const parts = [];
+    const global = readLimited(GLOBAL_INSTRUCTIONS_PATH);
+    if (global.trim() !== "") {
+        parts.push(`# Instrucciones generales del usuario (~/.vipcode/AGENTS.md)\n${global}`);
+    }
+    const names = ["AGENTS.md", "CLAUDE.md", ".vipcode.md"];
+    for (const name of names) {
+        const file = path.join(root, name);
+        if (fs.existsSync(file)) {
+            parts.push(`# Instrucciones del proyecto (${name})\n${readLimited(file)}`);
+            break;
+        }
+    }
+    // Ficheros extra del config ("instructions": ["docs/estilo.md", ".cursor/rules/*.md"])
+    const seen = new Set();
+    for (const pattern of extra) {
+        let files = [];
+        try {
+            files = fg.sync(pattern, { cwd: root, onlyFiles: true, dot: true, absolute: true }).slice(0, 10);
+        }
+        catch {
+            files = [];
+        }
+        for (const file of files) {
+            if (seen.has(file)) {
+                continue;
+            }
+            seen.add(file);
+            parts.push(`# Instrucciones (${path.relative(root, file)})\n${readLimited(file, 8000)}`);
+        }
+    }
+    if (parts.length === 0) {
+        return "";
+    }
+    return `\n\n${parts.join("\n\n")}`;
+}
+// Lo que hay en la raíz del proyecto, para que el modelo se oriente sin gastar una llamada
+function topLevel(root) {
+    try {
+        const entries = fs
+            .readdirSync(root, { withFileTypes: true })
+            .filter((entry) => entry.name !== ".git" && entry.name !== "node_modules" && entry.name !== ".DS_Store")
+            .sort((a, b) => Number(b.isDirectory()) - Number(a.isDirectory()) || a.name.localeCompare(b.name))
+            .map((entry) => {
+            if (entry.isDirectory()) {
+                return `${entry.name}/`;
+            }
+            return entry.name;
+        });
+        if (entries.length === 0) {
+            return "(empty)";
+        }
+        let extra = "";
+        if (entries.length > 40) {
+            extra = ` … (+${entries.length - 40} more)`;
+        }
+        return entries.slice(0, 40).join(", ") + extra;
+    }
+    catch {
+        return "(unknown)";
+    }
+}
+export function systemPrompt(root, options) {
+    const { agent, toolNames } = options;
+    const has = (name) => toolNames.includes(name);
+    let modeText = "You are in BUILD mode: you may read, create and edit files and run shell commands (the user approves risky actions).";
+    if (agent.readOnly && !options.subagent) {
+        modeText = "";
+    }
+    const rules = [
+        "Explore before acting: use list_dir, glob, grep and read_file to understand the code. Never guess file contents.",
+    ];
+    if (!agent.readOnly) {
+        rules.push("To change an existing file, read it first and then use edit_file with an exact, unique old_string copied from read_file output (without the line-number prefix). Use write_file only for new files or full rewrites.", "Make the smallest change that solves the task and follows the existing style of the project.", "After changing code, run the relevant build, linter or tests with bash when the project has them. If the language server reports errors after your edit, fix them.");
+    }
+    rules.push("Call several tools in one turn when they are independent.", "If a tool returns an error, read it and fix your approach instead of repeating the same call.");
+    if (has("todowrite")) {
+        rules.push("For tasks with 3 or more steps, keep a todo list with todowrite: mark one step in_progress when you start it and completed as soon as it is done. Skip it for simple tasks.");
+    }
+    if (has("task")) {
+        rules.push("Use the task tool to delegate broad searches or independent sub-tasks to a subagent; it keeps your own context small.");
+    }
+    if (has("skill")) {
+        rules.push("The skill tool lists skills: specialised instructions for certain kinds of tasks. When the request matches a skill's description, load it with skill before starting and follow its instructions.");
+    }
+    if (has("websearch") || has("webfetch")) {
+        rules.push("Use websearch to find documentation and webfetch to read a page when you need information you don't have.");
+    }
+    rules.push("Files the user attaches with @path come inside <fichero> or <carpeta> tags in their message; they are already read.", "When you finish, reply with a short summary of what you changed. Do not paste whole files back.", "Reply in the same language the user writes in (usually Spanish). Be concise; use Markdown only when it helps.");
+    let agentText = "";
+    if (agent.prompt.trim() !== "") {
+        agentText = `\n\n${agent.prompt.trim()}`;
+    }
+    let isGit = "no";
+    if (fs.existsSync(path.join(root, ".git"))) {
+        isGit = "yes";
+    }
+    return `You are vipcode, an expert software engineering agent running in the user's terminal.${modeText ? `\n\n${modeText}` : ""}${agentText}
+
+Working rules:
+${rules.map((rule) => `- ${rule}`).join("\n")}
+
+Environment:
+- Working directory: ${root}
+- Git repository: ${isGit}
+- Platform: ${process.platform}
+- Date: ${new Date().toISOString().slice(0, 10)}
+- Top-level entries: ${topLevel(root)}${projectInstructions(root, options.instructions)}`;
+}

package/dist/ranking.js

@@ -0,0 +1,230 @@
+import fs from "node:fs";
+import { readAuth } from "./auth.js";
+import { debugLog } from "./debug.js";
+import { RANKING_PATH, ensureHomeDir } from "./paths.js";
+const WEIGHTS = {
+    coding: { code: 0.4, agents: 0.3, tools: 0.15, general: 0.15 },
+    general: { general: 1 },
+};
+// Nombres que cada proveedor escribe a su manera y no se parecen al de LLM Stats
+const ALIASES = {
+    "openai-fast": "gpt-oss-20b",
+    "nemotron-3-120b-a12b": "nemotron-3-super-120b-a12b",
+};
+// API oficial de LLM Stats (VIPCODE_LLMSTATS_URL permite usar otra, por ejemplo en las pruebas)
+function apiBase() {
+    return process.env.VIPCODE_LLMSTATS_URL || "https://api.zeroeval.com/stats/v1";
+}
+// "nvidia/z-ai/glm-5.3:free" → "glm-5.3"
+function baseId(id) {
+    let text = String(id).toLowerCase().replace(/^@cf\//, "");
+    text = text.slice(text.lastIndexOf("/") + 1);
+    return text.replace(/(:free|-free|:cloud|-cloud)$/, "");
+}
+// Clave para comparar: solo letras y números, sin palabras que no cambian el modelo
+function keyOf(id) {
+    let text = baseId(id).replace(/[:._\s]+/g, "-");
+    text = text.replace(/-(instruct|it|chat|fp8|hf|versatile)(?=-|$)/g, "");
+    text = text.replace(/^(meta-|zai-|z-ai-)/, "");
+    return text.replace(/[^a-z0-9]/g, "");
+}
+// Palabras del nombre sin versiones ni tamaños ("gemini-3.8-flash" → gemini, flash)
+function wordsOf(id) {
+    return baseId(id)
+        .replace(/[:._\s]+/g, "-")
+        .split("-")
+        .filter((word) => word && word !== "latest" && !/^\d+$/.test(word) && !/^v?\d+(\.\d+)?[bm]?$/.test(word))
+        .sort()
+        .join(" ");
+}
+// Lo descargado con la API (null si todavía no hay clave de LLM Stats o nunca se ha descargado)
+export function loadRankingData() {
+    try {
+        const data = JSON.parse(fs.readFileSync(RANKING_PATH, "utf8"));
+        if (Array.isArray(data.models) && data.models.length > 0) {
+            return data;
+        }
+    }
+    catch {
+        // sin descargas todavía
+    }
+    return null;
+}
+export class Ranking {
+    data;
+    metric;
+    byKey = new Map();
+    keys = [];
+    sorted = {};
+    cache = new Map();
+    constructor(data, metric = "coding") {
+        this.data = data;
+        this.metric = metric;
+        for (const model of data.models) {
+            for (const key of [keyOf(model.id), keyOf(model.name)]) {
+                if (key && !this.byKey.has(key)) {
+                    this.byKey.set(key, model);
+                }
+            }
+        }
+        this.keys = [...this.byKey.keys()];
+        for (const field of ["general", "code", "agents", "tools"]) {
+            this.sorted[field] = data.models
+                .map((model) => model[field])
+                .filter((value) => typeof value === "number")
+                .sort((a, b) => a - b);
+        }
+    }
+    // Busca el modelo de LLM Stats que corresponde a un id de proveedor
+    find(id) {
+        const alias = ALIASES[baseId(id)];
+        if (alias) {
+            return this.byKey.get(keyOf(alias)) || null;
+        }
+        const base = baseId(id);
+        const withoutDate = base.replace(/-(\d{4}|\d{6}|\d{8}|\d{2}-\d{4})$/, "");
+        const tries = [keyOf(base), keyOf(withoutDate), keyOf(base.replace(/-v\d+$/, ""))];
+        for (const key of tries) {
+            if (this.byKey.has(key)) {
+                return this.byKey.get(key);
+            }
+        }
+        // "…-latest": el más reciente con las mismas palabras
+        if (base.endsWith("-latest")) {
+            const words = wordsOf(base);
+            const candidates = this.data.models
+                .filter((model) => wordsOf(model.id) === words)
+                .sort((a, b) => String(b.released).localeCompare(String(a.released)));
+            if (candidates[0]) {
+                return candidates[0];
+            }
+        }
+        // Un nombre más corto que el de LLM Stats ("beam" → "beam-1.0-501b-a23b"), o más largo ("llama-4-scout-17b" → "llama-4-scout")
+        const short = keyOf(withoutDate);
+        const longer = this.keys.filter((key) => key.startsWith(short)).sort((a, b) => a.length - b.length);
+        const distinct = new Set(longer.map((key) => this.byKey.get(key)));
+        if (longer.length > 0 && (distinct.size === 1 || short.length >= 8)) {
+            return this.byKey.get(longer[0]);
+        }
+        const shorter = this.keys.filter((key) => key.length >= 8 && short.startsWith(key)).sort((a, b) => b.length - a.length);
+        if (shorter[0]) {
+            return this.byKey.get(shorter[0]);
+        }
+        return null;
+    }
+    percentile(field, value) {
+        const list = this.sorted[field];
+        if (!list || list.length < 2) {
+            return 0.5;
+        }
+        let below = 0;
+        while (below < list.length && list[below] < value) {
+            below++;
+        }
+        return below / (list.length - 1);
+    }
+    // Nota de 0 a 100 (null si LLM Stats no tiene datos del modelo)
+    score(id) {
+        if (this.cache.has(id)) {
+            return this.cache.get(id);
+        }
+        const model = this.find(id);
+        let result = null;
+        if (model) {
+            let sum = 0;
+            let weight = 0;
+            for (const [field, value] of Object.entries(WEIGHTS[this.metric])) {
+                const raw = model[field];
+                if (typeof raw === "number" && value) {
+                    // Percentiles para que índices con escalas distintas se puedan sumar
+                    sum += this.percentile(field, raw) * value;
+                    weight += value;
+                }
+            }
+            if (weight > 0) {
+                result = { score: Math.round((sum / weight) * 100), model };
+            }
+        }
+        this.cache.set(id, result);
+        return result;
+    }
+}
+// Clave de la API de LLM Stats (vipcode auth login llm-stats, o la variable LLMSTATS_API_KEY)
+export function rankingKey() {
+    return readAuth()["llm-stats"]?.key || process.env.LLMSTATS_API_KEY || null;
+}
+function pick(source, names) {
+    for (const name of names) {
+        const value = source[name];
+        if (typeof value === "number" && Number.isFinite(value)) {
+            return value;
+        }
+    }
+    return null;
+}
+// Un modelo tal como lo devuelve la API (los nombres de los campos pueden variar: se buscan varios)
+function parseApiModel(item) {
+    const id = String(item?.id || item?.model_id || "");
+    if (!id) {
+        return null;
+    }
+    const scores = {
+        ...item,
+        ...(item.top_scores || {}),
+        ...(item.scores || {}),
+        ...(item.indices || {}),
+        ...(item.category_scores || {}),
+    };
+    return {
+        id,
+        name: String(item.name || id),
+        general: pick(scores, ["index_general", "general", "overall", "llm_stats_score", "score"]),
+        code: pick(scores, ["index_code", "code", "coding"]),
+        agents: pick(scores, ["index_agents", "agents", "agent", "agentic"]),
+        tools: pick(scores, ["index_tool_calling", "tool_calling", "tools", "tool_use"]),
+        released: item.release_date ? String(item.release_date) : null,
+    };
+}
+// Descarga las puntuaciones actuales con la API oficial (plan gratis: 250 respuestas al día)
+export async function refreshRanking(apiKey, signal) {
+    const models = [];
+    let cursor = "";
+    for (let page = 0; page < 20; page++) {
+        let url = `${apiBase()}/models?limit=100`;
+        if (cursor) {
+            url += `&cursor=${encodeURIComponent(cursor)}`;
+        }
+        const signals = [AbortSignal.timeout(20000)];
+        if (signal) {
+            signals.push(signal);
+        }
+        const response = await fetch(url, {
+            headers: { authorization: `Bearer ${apiKey}`, accept: "application/json" },
+            signal: AbortSignal.any(signals),
+        });
+        if (!response.ok) {
+            throw new Error(`HTTP ${response.status}`);
+        }
+        const json = await response.json();
+        const items = Array.isArray(json?.models) ? json.models : Array.isArray(json?.data) ? json.data : [];
+        for (const item of items) {
+            const model = parseApiModel(item);
+            if (model) {
+                models.push(model);
+            }
+        }
+        cursor = json?.next_cursor || json?.nextCursor || "";
+        if (!cursor || items.length === 0) {
+            break;
+        }
+    }
+    const rated = models.filter((model) => [model.general, model.code, model.agents, model.tools].some((value) => value !== null));
+    if (rated.length < 30) {
+        throw new Error("la API no devolvió puntuaciones que vipcode sepa leer");
+    }
+    const data = { updated: new Date().toISOString().slice(0, 10), source: "https://llm-stats.com (API)", models: rated };
+    ensureHomeDir();
+    fs.writeFileSync(RANKING_PATH, JSON.stringify(data));
+    debugLog("ranking actualizado", rated.length);
+    return { count: rated.length };
+}