vipcode 0.2.0 → 0.2.2

package/dist/trust.js

@@ -0,0 +1,171 @@
+import crypto from "node:crypto";
+import fs from "node:fs";
+import path from "node:path";
+import { parseFrontmatter } from "./frontmatter.js";
+import { TRUST_PATH, ensureHomeDir } from "./paths.js";
+// Lo que un proyecto puede traer y que cambia qué ejecuta vipcode o a dónde manda tus claves: servidores MCP y
+// de lenguaje, proveedores, permisos, agentes con permisos propios y comandos que lanzan órdenes. No se usa hasta
+// que confías en la carpeta, y si cambia (por ejemplo tras un git pull) se vuelve a preguntar.
+const CONFIG_FILES = ["vipcode.json", path.join(".vipcode", "config.json")];
+const AGENT_DIRS = [path.join(".vipcode", "agents"), path.join(".opencode", "agent"), path.join(".opencode", "agents")];
+const COMMAND_DIRS = [path.join(".vipcode", "commands"), path.join(".opencode", "command"), path.join(".opencode", "commands")];
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function short(value) {
+    const text = typeof value === "string" ? value : JSON.stringify(value);
+    return text.length > 100 ? `${text.slice(0, 99)}…` : text;
+}
+function readText(file) {
+    try {
+        return fs.statSync(file).isFile() ? fs.readFileSync(file, "utf8") : null;
+    }
+    catch {
+        return null;
+    }
+}
+function markdownFiles(root, dirs) {
+    const files = [];
+    for (const dir of dirs) {
+        try {
+            for (const name of fs.readdirSync(path.join(root, dir)).sort()) {
+                if (name.endsWith(".md")) {
+                    files.push(path.join(dir, name));
+                }
+            }
+        }
+        catch {
+            // la carpeta no existe
+        }
+    }
+    return files;
+}
+function describeConfig(data) {
+    const changes = [];
+    const keys = Object.keys(data).filter((key) => !key.startsWith("$"));
+    const rest = [];
+    for (const key of keys) {
+        const value = data[key];
+        if (key === "providers" && Array.isArray(value)) {
+            const names = value.map((item) => (isObject(item) ? String(item.name || "?") : "?"));
+            changes.push(`proveedores: ${names.join(", ")} (pueden cambiar a dónde se mandan tus claves)`);
+        }
+        else if (key === "mcp" && isObject(value)) {
+            const servers = Object.entries(value).map(([name, server]) => {
+                const detail = isObject(server) ? server.command || server.url : server;
+                return `${name} (${short(detail)})`;
+            });
+            changes.push(`servidores MCP que se arrancan solos: ${servers.join(", ")}`);
+        }
+        else if (key === "lsp" && isObject(value)) {
+            changes.push(`servidores de lenguaje: ${short(value)}`);
+        }
+        else if (key === "permission") {
+            changes.push(`permisos: ${short(value)}`);
+        }
+        else if (key === "agents" && isObject(value)) {
+            changes.push(`agentes: ${Object.keys(value).join(", ")}`);
+        }
+        else if (key === "commands" && isObject(value)) {
+            changes.push(`comandos: ${Object.keys(value).join(", ")}`);
+        }
+        else {
+            rest.push(key);
+        }
+    }
+    if (rest.length > 0) {
+        changes.push(`otros ajustes: ${rest.join(", ")}`);
+    }
+    return changes;
+}
+function readStore() {
+    try {
+        const data = JSON.parse(fs.readFileSync(TRUST_PATH, "utf8"));
+        return isObject(data) ? data : {};
+    }
+    catch {
+        return {};
+    }
+}
+function key(root) {
+    try {
+        return fs.realpathSync(root);
+    }
+    catch {
+        return path.resolve(root);
+    }
+}
+export function projectTrust(root) {
+    const files = [];
+    const changes = [];
+    const parts = [];
+    const add = (relative, text, change) => {
+        files.push(relative);
+        parts.push(`${relative}\u0000${text}`);
+        changes.push(...change.map((item) => `${relative}: ${item}`));
+    };
+    for (const relative of CONFIG_FILES) {
+        const text = readText(path.join(root, relative));
+        if (text === null) {
+            continue;
+        }
+        let data = {};
+        try {
+            data = JSON.parse(text);
+        }
+        catch {
+            data = {};
+        }
+        const described = isObject(data) ? describeConfig(data) : [];
+        add(relative, text, described.length > 0 ? described : ["configuración de vipcode"]);
+    }
+    for (const relative of markdownFiles(root, AGENT_DIRS)) {
+        const text = readText(path.join(root, relative)) || "";
+        const { data } = parseFrontmatter(text);
+        // Un agente que solo trae instrucciones es como un AGENTS.md: no hace falta confiar
+        if (data.permission !== undefined || data.readOnly !== undefined) {
+            add(relative, text, [`agente con permisos propios: ${short({ permission: data.permission, readOnly: data.readOnly })}`]);
+        }
+    }
+    for (const relative of markdownFiles(root, COMMAND_DIRS)) {
+        const text = readText(path.join(root, relative)) || "";
+        if (/!`[^`]+`/.test(text)) {
+            add(relative, text, ["comando que ejecuta órdenes en la terminal al usarlo"]);
+        }
+    }
+    if (files.length === 0) {
+        return { files, changes, fingerprint: null, trusted: true };
+    }
+    const fingerprint = crypto.createHash("sha256").update(parts.join("\u0000\u0000")).digest("hex");
+    return { files, changes, fingerprint, trusted: readStore()[key(root)]?.fingerprint === fingerprint };
+}
+// Confías en la configuración que trae la carpeta tal como está ahora
+export function trustProject(root) {
+    const trust = projectTrust(root);
+    if (!trust.fingerprint) {
+        return trust;
+    }
+    const store = readStore();
+    store[key(root)] = { fingerprint: trust.fingerprint, date: new Date().toISOString() };
+    ensureHomeDir();
+    fs.writeFileSync(TRUST_PATH, JSON.stringify(store, null, 2), { mode: 0o600 });
+    return { ...trust, trusted: true };
+}
+export function untrustProject(root) {
+    const store = readStore();
+    if (!store[key(root)]) {
+        return false;
+    }
+    delete store[key(root)];
+    ensureHomeDir();
+    fs.writeFileSync(TRUST_PATH, JSON.stringify(store, null, 2), { mode: 0o600 });
+    return true;
+}
+// Ficheros de un agente o comando que están dentro del proyecto (los tuyos de ~/.vipcode no cuentan)
+export function isProjectFile(root, file) {
+    if (!file) {
+        return false;
+    }
+    const relative = path.relative(root, file);
+    return relative !== "" && !relative.startsWith("..") && !path.isAbsolute(relative);
+}

package/dist/tui/app.js

@@ -8,35 +8,22 @@ import { useEffect, useMemo, useRef, useState } from "react";
 import { configNotices } from "../config.js";
 import { discoveryIsStale } from "../discovery.js";
 import { isImagePath, readClipboardImage, toDataUrl } from "../images.js";
+import { toolLabel } from "../labels.js";
 import { renderMarkdown } from "../markdown.js";
 import { VERSION } from "../meta.js";
 import { NoSlotError } from "../router.js";
-import { appendHistory, loadHistory } from "../session.js";
+import { showControl, stripControl, stripUnsafe } from "../sanitize.js";
+import { appendHistory, loadHistory, sessionMarkdownPath } from "../session.js";
 import { suggestFiles } from "../tools.js";
 import { colorPreview } from "../ui.js";
 import { checkForUpdate } from "../update.js";
 import { PermissionDialog, PromptDialog, SelectDialog } from "./dialogs.js";
 import * as E from "./editor.js";
+// Al volver a una sesión se enseñan sus últimos pasos (el .md los tiene todos)
+const REPLAY_MAX = 300;
 // Comandos que se pueden usar mientras el agente trabaja (solo consultan)
 const SAFE_WHILE_BUSY = ["/help", "/usage", "/todos", "/mcp", "/lsp", "/providers", "/skills"];
 const SPINNER = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
-// Cómo se cuenta cada herramienta en pantalla
-const TOOL_LABEL = {
-    read_file: "Lee",
-    write_file: "Escribe",
-    edit_file: "Edita",
-    list_dir: "Lista",
-    glob: "Busca ficheros",
-    grep: "Busca",
-    bash: "Ejecuta",
-    webfetch: "Abre",
-    websearch: "Busca en internet",
-    todowrite: "Tareas",
-    todoread: "Tareas",
-    diagnostics: "Diagnósticos",
-    task: "Subagente",
-    skill: "Skill",
-};
 function Spinner(props) {
     const { frame } = useAnimation({ interval: 80 });
     return _jsx(Text, { color: props.color || "cyan", children: SPINNER[frame % SPINNER.length] });
@@ -107,7 +94,8 @@ function diffStats(display) {
 }
 // Debajo de cada herramienta, un resumen corto de lo que pasó
 function toolDetail(event) {
-    const output = event.output || "";
+    // La salida viene de ficheros y comandos: sin secuencias de la terminal
+    const output = stripControl(event.output || "");
     if (event.isError) {
         return [pc.red(firstLine(output))];
     }
@@ -162,8 +150,9 @@ function toolDetail(event) {
             return [pc.dim(firstLine(output))];
     }
 }
+// El resumen sale de lo que pidió el modelo (comandos, rutas): los caracteres de control se ven, no actúan
 function ToolHeader(props) {
-    return (_jsxs(_Fragment, { children: [_jsx(Text, { bold: true, children: TOOL_LABEL[props.name] || props.name }), props.summary ? _jsxs(Text, { children: [" ", props.summary] }) : null] }));
+    return (_jsxs(_Fragment, { children: [_jsx(Text, { bold: true, children: showControl(toolLabel(props.name)) }), props.summary ? _jsxs(Text, { children: [" ", showControl(props.summary)] }) : null] }));
 }
 function ToolView(props) {
     const { event } = props;
@@ -193,8 +182,8 @@ function ItemView(props) {
         case "banner":
             return _jsx(Banner, { app: props.app });
         case "user": {
-            const lines = item.text.split("\n");
-            let text = item.text;
+            const lines = stripControl(item.text).split("\n");
+            let text = lines.join("\n");
             if (lines.length > 20) {
                 text = `${lines.slice(0, 20).join("\n")}\n… (${lines.length - 20} líneas más)`;
             }
@@ -207,18 +196,19 @@ function ItemView(props) {
         case "answer":
             return (_jsx(Box, { marginLeft: 2, children: _jsxs(Text, { dimColor: true, wrap: "truncate-end", children: ["\u25C6 ", item.slot, item.score !== null ? ` · nota ${item.score}` : "", " \u00B7 ", formatDuration(item.ms), item.tokens > 0 ? ` · ${shortTokens(item.tokens)} tokens` : ""] }) }));
         case "shell": {
-            const lines = item.output ? item.output.split("\n") : [];
+            const lines = item.output ? stripControl(item.output).split("\n") : [];
             const shown = lines.slice(-30);
-            return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: [_jsxs(Text, { color: "yellow", bold: true, children: ["$", " "] }), _jsx(Text, { bold: true, children: item.command })] }), lines.length > shown.length ? _jsxs(Text, { dimColor: true, children: ["  \u2026 ", lines.length - shown.length, " l\u00EDneas antes"] }) : null, shown.length > 0 ? _jsx(Text, { children: shown.map((line) => `  ${line}`).join("\n") }) : null, _jsxs(Text, { dimColor: true, children: ["  ", item.code === 0 ? "✓" : "✗", " c\u00F3digo ", item.code ?? "?", " \u00B7 el agente ver\u00E1 la salida con tu siguiente mensaje"] })] }));
+            return (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: [_jsxs(Text, { color: "yellow", bold: true, children: ["$", " "] }), _jsx(Text, { bold: true, children: showControl(item.command) })] }), lines.length > shown.length ? _jsxs(Text, { dimColor: true, children: ["  \u2026 ", lines.length - shown.length, " l\u00EDneas antes"] }) : null, shown.length > 0 ? _jsx(Text, { children: shown.map((line) => `  ${line}`).join("\n") }) : null, _jsxs(Text, { dimColor: true, children: ["  ", item.code === 0 ? "✓" : "✗", " c\u00F3digo ", item.code ?? "?", " \u00B7 el agente ver\u00E1 la salida con tu siguiente mensaje"] })] }));
         }
+        // Avisos y bloques pueden llevar mensajes de los proveedores o datos de fuera: solo se dejan los colores
         case "info":
-            return _jsx(Text, { dimColor: true, children: item.text });
+            return _jsx(Text, { dimColor: true, children: stripUnsafe(item.text) });
         case "notice":
-            return _jsxs(Text, { color: "yellow", children: ["\u26A0 ", item.text] });
+            return _jsxs(Text, { color: "yellow", children: ["\u26A0 ", stripUnsafe(item.text)] });
         case "error":
-            return _jsxs(Text, { color: "red", children: ["\u2716 ", item.text] });
+            return _jsxs(Text, { color: "red", children: ["\u2716 ", stripUnsafe(item.text)] });
         case "block":
-            return (_jsx(Box, { marginY: 1, children: _jsx(Text, { children: item.text }) }));
+            return (_jsx(Box, { marginY: 1, children: _jsx(Text, { children: stripUnsafe(item.text) }) }));
     }
 }
 function TodoPanel(props) {
@@ -229,15 +219,15 @@ function TodoPanel(props) {
     const done = props.todos.filter((todo) => todo.status === "completed").length;
     return (_jsxs(Box, { flexDirection: "column", marginTop: 1, paddingX: 1, children: [_jsxs(Text, { dimColor: true, children: ["Tareas (", done, "/", props.todos.length, ")"] }), props.todos.slice(0, 10).map((todo, index) => {
                 if (todo.status === "completed") {
-                    return (_jsxs(Text, { color: "green", strikethrough: true, children: ["\u2611 ", todo.content] }, index));
+                    return (_jsxs(Text, { color: "green", strikethrough: true, children: ["\u2611 ", stripControl(todo.content)] }, index));
                 }
                 if (todo.status === "in_progress") {
-                    return (_jsxs(Text, { color: "yellow", children: ["\u25D0 ", todo.content] }, index));
+                    return (_jsxs(Text, { color: "yellow", children: ["\u25D0 ", stripControl(todo.content)] }, index));
                 }
                 if (todo.status === "cancelled") {
-                    return (_jsxs(Text, { dimColor: true, strikethrough: true, children: ["\u2612 ", todo.content] }, index));
+                    return (_jsxs(Text, { dimColor: true, strikethrough: true, children: ["\u2612 ", stripControl(todo.content)] }, index));
                 }
-                return _jsxs(Text, { children: ["\u2610 ", todo.content] }, index);
+                return _jsxs(Text, { children: ["\u2610 ", stripControl(todo.content)] }, index);
             }), props.todos.length > 10 ? _jsxs(Text, { dimColor: true, children: ["\u2026 y ", props.todos.length - 10, " m\u00E1s"] }) : null] }));
 }
 function InputBox(props) {
@@ -501,6 +491,9 @@ function Main(props) {
                     await quit();
                     return;
                 }
+                if (result.loaded) {
+                    replay(app.agent.session);
+                }
                 if (result.run) {
                     void runAgent({ ...result.run.input, images }, result.run.options);
                 }
@@ -542,6 +535,35 @@ function Main(props) {
         }
         refresh();
     };
+    // La conversación de una sesión a la que vuelves, tal como la viste
+    const replay = (session) => {
+        const entries = session.log;
+        if (entries.length === 0) {
+            push({ kind: "info", text: `Sesión «${session.title}» cargada.` });
+            return;
+        }
+        const shown = entries.slice(-REPLAY_MAX);
+        push({ kind: "info", text: `── Conversación anterior: «${session.title}» · ${new Date(session.updated).toLocaleString()} ──` });
+        if (entries.length > shown.length) {
+            push({ kind: "info", text: `… ${entries.length - shown.length} pasos antes; la conversación entera está en ${sessionMarkdownPath(session)}` });
+        }
+        shown.forEach((entry, index) => {
+            if (entry.role === "user") {
+                push({ kind: "user", text: entry.text, images: entry.images || 0, color: agentColor() });
+            }
+            else if (entry.role === "assistant") {
+                push({ kind: "assistant", text: entry.text, color: agentColor() });
+            }
+            else if (entry.role === "tool" && entry.tool) {
+                const event = { id: `historial-${index}`, name: entry.tool.name, summary: entry.tool.summary, depth: 0, agent: "" };
+                push({ kind: "tool", event: { ...event, output: entry.text, display: entry.tool.display, isError: entry.tool.isError }, ms: 0 });
+            }
+            else {
+                push({ kind: "info", text: entry.text });
+            }
+        });
+        push({ kind: "info", text: "── Sigues desde aquí (/new empieza otra conversación) ──" });
+    };
     // Paleta de comandos (Ctrl+P): todos los comandos, skills y agentes con su descripción
     const openPalette = async () => {
         const commands = app.commandSuggestions();
@@ -655,9 +677,8 @@ function Main(props) {
         for (const notice of configNotices) {
             push({ kind: "notice", text: notice });
         }
-        const session = app.agent.session;
-        if (session.messages.length > 0) {
-            push({ kind: "info", text: `Continúas «${session.title}» (${session.turns.length} mensajes tuyos). /new empieza otra.` });
+        if (app.agent.session.log.length > 0) {
+            replay(app.agent.session);
         }
         if (app.router.slots.length === 0) {
             push({
@@ -1004,7 +1025,7 @@ function Main(props) {
     if (busy) {
         placeholder = "Escribe para añadir instrucciones mientras trabaja…";
     }
-    return (_jsxs(_Fragment, { children: [_jsx(Static, { items: items, children: (item) => _jsx(ItemView, { item: item, app: app, width: columns }, item.id) }), _jsxs(Box, { flexDirection: "column", children: [live.current.reasoning ? (_jsxs(Text, { dimColor: true, italic: true, wrap: "truncate-end", children: ["\uD83D\uDCAD ", lastLines(live.current.reasoning.replace(/\s+/g, " "), 1).slice(-Math.max(20, columns - 6))] })) : null, liveText ? (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: color, children: "\u25CF " }), _jsx(Box, { flexDirection: "column", flexGrow: 1, children: _jsxs(Text, { children: [liveText, _jsx(Text, { color: color, children: "\u258D" })] }) })] })) : null, running.map(({ event, progress, since }) => (_jsxs(Box, { flexDirection: "column", marginLeft: event.depth > 0 ? 4 : 0, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Spinner, {}), " ", _jsx(ToolHeader, { name: event.name, summary: event.summary }), " ", _jsx(Elapsed, { since: since, hideUnderMs: 2000 })] }), progress ? (_jsxs(Text, { dimColor: true, wrap: "truncate-end", children: ["    ", lastLines(progress, 1).slice(0, Math.max(20, columns - 8))] })) : null] }, `${event.depth}:${event.id}`))), shell ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: [_jsx(Spinner, { color: "yellow" }), " ", _jsx(Text, { bold: true, children: shell.command }), " ", _jsx(Elapsed, { since: startedAt.current, hideUnderMs: 1000 })] }), shell.output ? _jsx(Text, { dimColor: true, children: lastLines(shell.output, Math.min(8, liveRoom)).replace(/^/gm, "  ") }) : null] })) : null, _jsx(TodoPanel, { todos: todos }), busy && !shell && running.length === 0 && !liveText && !answered.current ? (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Spinner, {}), " ", _jsxs(Text, { dimColor: true, children: ["Pensando", live.current.model ? ` con ${live.current.model}` : "", "\u2026 "] }), _jsx(Elapsed, { since: startedAt.current, hideUnderMs: 1000 })] }) })) : null, dialogView || (_jsx(InputBox, { editor: editor, color: color, placeholder: placeholder, attachments: attachments.length, maxLines: Math.max(3, Math.floor(rows / 2) - 4), width: columns })), suggestionsVisible && !dialog ? (_jsx(Box, { flexDirection: "column", paddingX: 2, children: suggestions.map((suggestion, index) => (_jsxs(Text, { color: index === selected ? "cyan" : undefined, wrap: "truncate-end", children: [index === selected ? "❯ " : "  ", suggestion.label, suggestion.description ? _jsxs(Text, { dimColor: true, children: [" ", suggestion.description] }) : null] }, `${index}-${suggestion.label}`))) })) : null, _jsx(StatusBar, { app: app, agentName: agentName, busy: busy, model: busy ? live.current.model : "" })] })] }));
+    return (_jsxs(_Fragment, { children: [_jsx(Static, { items: items, children: (item) => _jsx(ItemView, { item: item, app: app, width: columns }, item.id) }), _jsxs(Box, { flexDirection: "column", children: [live.current.reasoning ? (_jsxs(Text, { dimColor: true, italic: true, wrap: "truncate-end", children: ["\uD83D\uDCAD ", lastLines(stripControl(live.current.reasoning).replace(/\s+/g, " "), 1).slice(-Math.max(20, columns - 6))] })) : null, liveText ? (_jsxs(Box, { marginTop: 1, children: [_jsx(Text, { color: color, children: "\u25CF " }), _jsx(Box, { flexDirection: "column", flexGrow: 1, children: _jsxs(Text, { children: [liveText, _jsx(Text, { color: color, children: "\u258D" })] }) })] })) : null, running.map(({ event, progress, since }) => (_jsxs(Box, { flexDirection: "column", marginLeft: event.depth > 0 ? 4 : 0, children: [_jsxs(Text, { wrap: "truncate-end", children: [_jsx(Spinner, {}), " ", _jsx(ToolHeader, { name: event.name, summary: event.summary }), " ", _jsx(Elapsed, { since: since, hideUnderMs: 2000 })] }), progress ? (_jsxs(Text, { dimColor: true, wrap: "truncate-end", children: ["    ", lastLines(stripControl(progress), 1).slice(0, Math.max(20, columns - 8))] })) : null] }, `${event.depth}:${event.id}`))), shell ? (_jsxs(Box, { flexDirection: "column", marginTop: 1, children: [_jsxs(Text, { children: [_jsx(Spinner, { color: "yellow" }), " ", _jsx(Text, { bold: true, children: showControl(shell.command) }), " ", _jsx(Elapsed, { since: startedAt.current, hideUnderMs: 1000 })] }), shell.output ? _jsx(Text, { dimColor: true, children: lastLines(stripControl(shell.output), Math.min(8, liveRoom)).replace(/^/gm, "  ") }) : null] })) : null, _jsx(TodoPanel, { todos: todos }), busy && !shell && running.length === 0 && !liveText && !answered.current ? (_jsx(Box, { marginTop: 1, children: _jsxs(Text, { wrap: "truncate-end", children: [_jsx(Spinner, {}), " ", _jsxs(Text, { dimColor: true, children: ["Pensando", live.current.model ? ` con ${live.current.model}` : "", "\u2026 "] }), _jsx(Elapsed, { since: startedAt.current, hideUnderMs: 1000 })] }) })) : null, dialogView || (_jsx(InputBox, { editor: editor, color: color, placeholder: placeholder, attachments: attachments.length, maxLines: Math.max(3, Math.floor(rows / 2) - 4), width: columns })), suggestionsVisible && !dialog ? (_jsx(Box, { flexDirection: "column", paddingX: 2, children: suggestions.map((suggestion, index) => (_jsxs(Text, { color: index === selected ? "cyan" : undefined, wrap: "truncate-end", children: [index === selected ? "❯ " : "  ", suggestion.label, suggestion.description ? _jsxs(Text, { dimColor: true, children: [" ", suggestion.description] }) : null] }, `${index}-${suggestion.label}`))) })) : null, _jsx(StatusBar, { app: app, agentName: agentName, busy: busy, model: busy ? live.current.model : "" })] })] }));
 }
 export async function startTui(app, options = {}) {
     const instance = render(_jsx(Main, { app: app, initial: options.initial || "" }), {

package/dist/tui/dialogs.js

@@ -2,6 +2,7 @@ import { Fragment as _Fragment, jsx as _jsx, jsxs as _jsxs } from "react/jsx-run
 import { Box, Text, useInput, usePaste } from "ink";
 import { useMemo, useState } from "react";
 import { suggestPattern } from "../permissions.js";
+import { showControl, stripControl } from "../sanitize.js";
 import { colorPreview } from "../ui.js";
 import { EMPTY, backspace, deleteWordBack, insert, moveLeft, moveRight, splitEnter } from "./editor.js";
 const KIND_LABEL = {
@@ -96,7 +97,7 @@ export function PermissionDialog(props) {
     const lines = request.preview.split("\n");
     const shown = lines.slice(0, 30).join("\n");
     const hidden = lines.length - 30;
-    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "yellow", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "yellow", children: ["? ", request.title, props.agent !== "build" ? _jsxs(Text, { dimColor: true, children: [" (", props.agent, ")"] }) : null] }), _jsxs(Box, { marginY: 1, flexDirection: "column", children: [_jsx(Text, { children: colorPreview(shown) }), hidden > 0 ? _jsxs(Text, { dimColor: true, children: ["\u2026 ", hidden, " l\u00EDneas m\u00E1s"] }) : null] }), explaining ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "\u00BFQu\u00E9 deber\u00EDa hacer en su lugar? (Enter env\u00EDa, Esc vuelve)" }), _jsxs(Text, { children: [_jsx(Text, { color: "yellow", children: "\u276F " }), feedback.value.slice(0, feedback.cursor), _jsx(Text, { inverse: true, children: feedback.value[feedback.cursor] || " " }), feedback.value.slice(feedback.cursor + 1)] })] })) : (_jsxs(_Fragment, { children: [options.map((option, index) => (_jsxs(Text, { color: index === selected ? "cyan" : undefined, children: [index === selected ? "❯ " : "  ", _jsxs(Text, { dimColor: true, children: ["[", option.key, "]"] }), " ", option.label] }, option.key))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 elige \u00B7 Enter acepta \u00B7 la letra es un atajo \u00B7 Esc = no" })] }))] }));
+    return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "yellow", paddingX: 1, children: [_jsxs(Text, { bold: true, color: "yellow", children: ["? ", showControl(request.title), props.agent !== "build" ? _jsxs(Text, { dimColor: true, children: [" (", props.agent, ")"] }) : null] }), _jsxs(Box, { marginY: 1, flexDirection: "column", children: [_jsx(Text, { children: colorPreview(shown) }), hidden > 0 ? _jsxs(Text, { dimColor: true, children: ["\u2026 ", hidden, " l\u00EDneas m\u00E1s"] }) : null] }), explaining ? (_jsxs(Box, { flexDirection: "column", children: [_jsx(Text, { children: "\u00BFQu\u00E9 deber\u00EDa hacer en su lugar? (Enter env\u00EDa, Esc vuelve)" }), _jsxs(Text, { children: [_jsx(Text, { color: "yellow", children: "\u276F " }), feedback.value.slice(0, feedback.cursor), _jsx(Text, { inverse: true, children: feedback.value[feedback.cursor] || " " }), feedback.value.slice(feedback.cursor + 1)] })] })) : (_jsxs(_Fragment, { children: [options.map((option, index) => (_jsxs(Text, { color: index === selected ? "cyan" : undefined, children: [index === selected ? "❯ " : "  ", _jsxs(Text, { dimColor: true, children: ["[", option.key, "]"] }), " ", option.label] }, option.key))), _jsx(Text, { dimColor: true, children: "\u2191\u2193 elige \u00B7 Enter acepta \u00B7 la letra es un atajo \u00B7 Esc = no" })] }))] }));
 }
 function matches(item, query) {
     return `${item.label} ${item.description || ""}`.toLowerCase().includes(query);
@@ -155,7 +156,7 @@ export function SelectDialog(props) {
     const visible = filtered.slice(start, start + windowSize);
     return (_jsxs(Box, { flexDirection: "column", borderStyle: "round", borderColor: "cyan", paddingX: 1, children: [_jsx(Text, { bold: true, color: "cyan", children: props.title }), _jsx(Text, { dimColor: true, children: filter ? `Filtro: ${filter}` : "Escribe para filtrar · ↑↓ elegir · Enter aceptar · Esc salir" }), visible.length === 0 ? _jsx(Text, { dimColor: true, children: "(nada coincide)" }) : null, visible.map((item, index) => {
                 const active = start + index === selected;
-                return (_jsxs(Text, { color: active ? "cyan" : undefined, wrap: "truncate-end", children: [active ? "❯ " : "  ", item.label, item.description ? _jsxs(Text, { dimColor: true, children: [" ", item.description] }) : null] }, `${start + index}-${item.label}`));
+                return (_jsxs(Text, { color: active ? "cyan" : undefined, wrap: "truncate-end", children: [active ? "❯ " : "  ", stripControl(item.label), item.description ? _jsxs(Text, { dimColor: true, children: [" ", stripControl(item.description)] }) : null] }, `${start + index}-${item.label}`));
             }), filtered.length > windowSize ? (_jsxs(Text, { dimColor: true, children: [selected + 1, "/", filtered.length] })) : null] }));
 }
 // Pide un texto (las claves se ven como •••)

package/dist/ui.js

@@ -1,22 +1,27 @@
 import pc from "picocolors";
+import { toolLabel } from "./labels.js";
+import { renderMarkdown } from "./markdown.js";
 import { suggestPattern } from "./permissions.js";
+import { showControl, stripControl, stripUnsafe } from "./sanitize.js";
+import { sessionMarkdownPath } from "./session.js";
 import { formatTodos } from "./tools.js";
 export const ui = {
     text(chunk) {
         process.stdout.write(chunk);
     },
+    // Los mensajes pueden llevar texto de los proveedores o del modelo: sin secuencias de la terminal
     info(message) {
-        console.log(pc.dim(message));
+        console.log(pc.dim(stripUnsafe(message)));
     },
     notice(message) {
-        console.log(pc.yellow(`⚠ ${message}`));
+        console.log(pc.yellow(`⚠ ${stripUnsafe(message)}`));
     },
     error(message) {
-        console.log(pc.red(`✖ ${message}`));
+        console.log(pc.red(`✖ ${stripUnsafe(message)}`));
     },
     tool(name, summary, depth = 0) {
         const indent = depth > 0 ? "      " : "  ";
-        console.log(pc.cyan(`${indent}● ${name}`) + pc.dim(` ${summary}`));
+        console.log(pc.cyan(`${indent}● ${showControl(name)}`) + pc.dim(` ${showControl(summary)}`));
     },
     banner(agent, slots) {
         console.log(pc.bold(pc.magenta("vipcode")) + pc.dim(` · agente ${agent} · ${slots} modelos · /help para ayuda`));
@@ -31,9 +36,10 @@ export const ui = {
         return pc.magenta("❯ ");
     },
 };
-// Líneas quitadas en rojo, añadidas en verde, cabeceras @@ en cian y el contexto atenuado
+// Líneas quitadas en rojo, añadidas en verde, cabeceras @@ en cian y el contexto atenuado.
+// Es lo que apruebas: los caracteres de control se ven (␛) en vez de actuar
 export function colorPreview(preview) {
-    return preview
+    return showControl(preview)
         .split("\n")
         .map((line) => {
         if (line.startsWith("+ ")) {
@@ -75,7 +81,7 @@ export function plainEvents(options) {
                 return;
             }
             flushReasoning();
-            process.stdout.write(chunk);
+            process.stdout.write(stripControl(chunk));
         },
         onTextEnd: (depth) => {
             if (depth === 0) {
@@ -92,7 +98,7 @@ export function plainEvents(options) {
                     process.stdout.write(pc.dim("  💭 "));
                     reasoningShown = true;
                 }
-                const piece = chunk.replace(/\s+/g, " ").slice(0, 240 - reasoning.length);
+                const piece = stripControl(chunk).replace(/\s+/g, " ").slice(0, 240 - reasoning.length);
                 reasoning += piece;
                 process.stdout.write(pc.dim(piece));
                 if (reasoning.length >= 240) {
@@ -107,7 +113,7 @@ export function plainEvents(options) {
         onToolEnd: (event) => {
             const pad = event.depth > 0 ? "        " : "    ";
             if (event.isError) {
-                console.log(pc.red(`${pad}${event.output.split("\n")[0].slice(0, 200)}`));
+                console.log(pc.red(`${pad}${stripControl(event.output.split("\n")[0]).slice(0, 200)}`));
             }
             else if (event.display && event.depth === 0) {
                 console.log(indent(colorPreview(event.display), pad));
@@ -129,7 +135,7 @@ export function plainPermissionPrompt(getReadline, grants) {
             return { allow: false, feedback: "no hay nadie para aprobarlo (usa --yolo o ajusta los permisos)" };
         }
         console.log("");
-        console.log(pc.bold(pc.yellow(`? ${request.title}`)));
+        console.log(pc.bold(pc.yellow(`? ${showControl(request.title)}`)));
         console.log(colorPreview(request.preview));
         let options = "[s]í / [n]o / [t]odo en esta sesión / [e] no y explicar";
         let pattern = "";
@@ -172,10 +178,37 @@ export function plainPermissionPrompt(getReadline, grants) {
         }
     };
 }
+// La conversación de una sesión a la que vuelves, en el modo de texto simple
+export function printLog(session, max = 300) {
+    const entries = session.log;
+    if (entries.length === 0) {
+        return;
+    }
+    const shown = entries.slice(-max);
+    console.log(pc.dim(`── Conversación anterior: «${stripControl(session.title)}» · ${new Date(session.updated).toLocaleString()} ──`));
+    if (entries.length > shown.length) {
+        console.log(pc.dim(`… ${entries.length - shown.length} pasos antes; la conversación entera está en ${sessionMarkdownPath(session)}`));
+    }
+    for (const entry of shown) {
+        if (entry.role === "user") {
+            console.log(`\n${pc.magenta("❯")} ${stripControl(entry.text)}`);
+        }
+        else if (entry.role === "assistant") {
+            console.log(`\n${renderMarkdown(entry.text, process.stdout.columns || 80)}`);
+        }
+        else if (entry.role === "tool" && entry.tool) {
+            ui.tool(toolLabel(entry.tool.name), entry.tool.summary);
+        }
+        else {
+            console.log(pc.dim(stripControl(entry.text)));
+        }
+    }
+    console.log(pc.dim("\n── Sigues desde aquí (/new empieza otra conversación) ──"));
+}
 // Interfaz mínima para los comandos / en el modo de texto
 export const plainAdapter = {
     info: (text) => ui.info(text),
     notice: (text) => ui.notice(text),
     error: (text) => ui.error(text),
-    block: (text) => console.log(text),
+    block: (text) => console.log(stripUnsafe(text)),
 };

package/dist/update.js

@@ -2,13 +2,12 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { fileURLToPath } from "node:url";
 import { PACKAGE_NAME, REPO_URL, VERSION } from "./meta.js";
-import { HOME_DIR, UPDATE_PATH } from "./paths.js";
+import { INSTALL_DIR, UPDATE_PATH, ensureHomeDir } from "./paths.js";
 const DAY_MS = 24 * 60 * 60 * 1000;
 // Carpeta donde está instalado vipcode (la que contiene dist/). VIPCODE_INSTALL_ROOT permite fingir otra en las pruebas
 export function packageRoot() {
-    return process.env.VIPCODE_INSTALL_ROOT || path.resolve(path.dirname(fileURLToPath(import.meta.url)), "..");
+    return process.env.VIPCODE_INSTALL_ROOT || INSTALL_DIR;
 }
 // "v0.10.1" frente a "0.9.3": positivo si a es más nueva
 export function compareVersions(a, b) {
@@ -102,7 +101,7 @@ export async function checkForUpdate() {
         try {
             const release = await latestRelease();
             cache = { checked: Date.now(), latest: release?.version || VERSION };
-            fs.mkdirSync(HOME_DIR, { recursive: true });
+            ensureHomeDir();
             fs.writeFileSync(UPDATE_PATH, JSON.stringify(cache, null, 2));
         }
         catch {
@@ -218,6 +217,9 @@ async function updateFromRelease(root, log) {
             message: `Hay una versión nueva (${release.version}, tienes la ${VERSION}), pero este vipcode no está instalado con «npm install -g». Instálala con:\n  npm install -g ${release.spec}`,
         };
     }
+    if (!/^[\w@.:/+~%-]+$/.test(release.spec) || release.spec.startsWith("-")) {
+        return { status: "error", message: `La última versión publicada tiene un nombre de paquete raro (${release.spec}): no la instalo.` };
+    }
     log(`Instalando vipcode ${release.version} desde ${release.source}…`);
     // Desde la carpeta temporal, para que no se mezcle con la configuración de npm del proyecto en el que estás
     const install = await run(NPM, ["install", "-g", release.spec], os.tmpdir());

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vipcode",
-  "version": "0.2.0",
+  "version": "0.2.2",
   "description": "Agente de programación para la terminal que usa IAs gratuitas y salta a otro proveedor cuando uno se agota",
   "keywords": [
     "ai",
@@ -23,7 +23,7 @@
     "url": "git+https://github.com/PabloVip/vipcode.git"
   },
   "license": "MIT",
-  "author": "Pablo Vicente (https://github.com/PabloVip)",
+  "author": "Pablo Vicente Juan (https://github.com/PabloVip)",
   "type": "module",
   "bin": {
     "vipcode": "dist/index.js"