lcode-cli 0.28.0__tar.gz → 0.28.1__tar.gz

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/CHANGELOG.md

@@ -6,6 +6,39 @@ All notable changes to lcode are documented here. The format follows
 
 ## [Unreleased]
 
+## [0.28.1] - 2026-10-13
+
+### Fixed
+
+Found by testing lcode's tools on real files and commands (#118):
+
+- Some commands that change things ran without asking, because they were taken for read-only:
+  `sort -o`, `uniq in out`, `tree -o`, `git branch -D` and other branch changes, `git remote
+  add/remove`, `git log/diff --output`, `rg --pre` (which runs a program), `find -fls`, `date -s`,
+  and `nvidia-smi` settings. Arguments are now checked. `2>&1` and `>/dev/null` no longer make a
+  read-only command ask.
+- "Always allow" for a command also covered chains that started with it: allowing `npm test` let
+  `npm test && rm -rf build` run without asking. Now a chain needs its own "always".
+- A JSON tool call that the model only showed as an example in its answer was run. Text is now
+  taken as a call only when the whole message is one.
+- A change you made to a file while lcode asked to edit it was overwritten. lcode now notices and
+  doesn't apply the edit, and the model redoes it on the current content.
+- `replace_all: "false"`, and other values sent as text, were taken as true. They now get the
+  type the tool declares.
+- The shell timeout wasn't enforced while a command kept printing, so a watcher started without
+  `background` hung the request. Long output is no longer held in memory either: 400 MB of output
+  used to cost 2.5 GB, and now it goes to a file, keeping its start, end and error lines.
+- One tool result could overflow the context window: `read_file` returned up to ~40K tokens,
+  however small the window, and compaction only looked at the previous request. A result now takes
+  at most a quarter of the window (`read_file` says where to read on), and lcode makes room based on
+  the size of the next request.
+- Sessions were saved only when a request ended, so a crash lost the whole request. They're now
+  saved after every step, and atomically, so a crash while writing can't corrupt them.
+- Editing a file with Windows line endings turned the whole file to Unix line endings, and editing a
+  file that isn't UTF-8 (Windows-1252 or Latin-1) replaced every accented letter in it with `�`,
+  not only in the edited line. Files now keep their encoding, line endings and byte order mark. A
+  character the encoding can't hold is refused instead of written wrong.
+
 ## [0.28.0] - 2026-10-13
 
 ### Added
@@ -599,7 +632,8 @@ First public release.
 - `AGENTS.md` project instructions and `/init` to generate them.
 - One-line installer for Linux and macOS.
 
-[Unreleased]: https://github.com/nasser1941/lcode/compare/v0.28.0...HEAD
+[Unreleased]: https://github.com/nasser1941/lcode/compare/v0.28.1...HEAD
+[0.28.1]: https://github.com/nasser1941/lcode/compare/v0.28.0...v0.28.1
 [0.28.0]: https://github.com/nasser1941/lcode/compare/v0.27.0...v0.28.0
 [0.27.0]: https://github.com/nasser1941/lcode/compare/v0.26.0...v0.27.0
 [0.26.0]: https://github.com/nasser1941/lcode/compare/v0.25.0...v0.26.0

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: lcode-cli
-Version: 0.28.0
+Version: 0.28.1
 Summary: A local-first terminal coding agent powered by open-weight models on your own GPU or Mac, via Ollama.
 Project-URL: Homepage, https://nasser1941.github.io/lcode/
 Project-URL: Documentation, https://nasser1941.github.io/lcode/

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/docs/quickstart.md

@@ -12,7 +12,7 @@ lcode
 
 ```text
 ╭──────────────────────────────────────────────╮
-│ lcode v0.28.0 — local coding agent           │
+│ lcode v0.28.1 — local coding agent           │
 │                                              │
 │ model    lcode-qwen3.6-35b                   │
 │ context  256K tokens                         │

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/docs/usage.md

@@ -224,11 +224,14 @@ image support off with `lcode config set vision_model off`.
 `--yolo` start in one.
 
 Read-only commands run without asking: `ls`, `cat`, `head`, `tail`, `grep`, `rg`, `find`, `tree`,
-`wc`, `diff`, `git status/log/diff/show/branch/blame` and similar, as long as they don't redirect
-output, chain commands or run subshells. A `cd <folder> &&` in front is fine.
+`wc`, `diff`, `git status/log/diff/show/branch/blame` and similar. Their arguments count too:
+`sort -o file`, `git branch -D`, `git log --output=file`, `rg --pre` or `find -delete` change
+things, so they ask. Pipes between read-only commands are fine, and so are `cd <folder> &&` in front
+and `2>&1` or `>/dev/null`; anything else (`&&`, `;`, redirecting to a file, `$(…)`) asks.
 
 When asked, answer ++y++ (once), ++a++ (always, for this command or for all edits, until you quit)
-or ++n++. For lasting answers, write [permission rules](hooks.md#permission-rules): allow lists and
+or ++n++. "Always" covers the same program, or for a chain the same programs in the same order:
+allowing `npm test` doesn't allow `npm test && rm -rf build`. For lasting answers, write [permission rules](hooks.md#permission-rules): allow lists and
 deny lists, per user or per repository; deny always wins, even in `yolo`. Text after ++n++ goes to the model as instructions: `n run the tests with -x first`.
 
 !!! warning "yolo mode"

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/src/lcode/__init__.py

@@ -3,7 +3,7 @@
 From a program: `from lcode import Session` (see lcode.api).
 """
 
-__version__ = "0.28.0"
+__version__ = "0.28.1"
 
 API = ("Session", "Result", "Options", "SetupError")
 

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/src/lcode/agent.py

@@ -6,6 +6,7 @@ import base64
 import contextlib
 import datetime as dt
 import json
+import os
 import platform
 import re
 import shutil
@@ -81,6 +82,8 @@ REFUSED = ("Error:", "A deny rule", "The user denied", "This needs the user's pe
 MAX_MALFORMED_CALL_RETRIES = 2  # Ollama rejects tool calls whose arguments aren't valid JSON
 # How Ollama reports a tool call it couldn't parse (Qwen3.6's calls are XML)
 MALFORMED_CALL = ("error parsing tool call", "XML syntax error")
+RESULT_SHARE = 0.25  # of the context window, at most, for one tool result
+MIN_RESULT_CHARS = 8000
 READING_NOTE_TOKENS = 4000  # new input this large gets "Reading … new tokens" in the status line
 AUTO_COMPACT_RATIO = 0.85  # summarize the history when the context is this full
 PRUNED_ENOUGH = 0.6  # after pruning old tool output, summarize only if the context is still this full
@@ -320,7 +323,9 @@ class Agent:
         self.hardware = None  # an lcode.hardware.Hardware, set by the CLI: for what fits on the GPU
         self.made_room_for = ""  # why the model was unloaded (the vision model, an MCP tool), for the reload line
         self.load_state = ""  # "loading" while the model loads in the background at startup (lcode.repl)
+        self.autosave = False  # save the session after every step (sessions people resume; not the bench's)
         self.sent_chars = 0  # characters of the conversation the model had already read
+        self.counted_chars: int | None = None  # characters that ctx_used covers (None: all of them)
         self.turn_status = ""  # how the last request ended: success, max_steps, loop
         self.repeats = Repeats(settings.repeat_limit)  # notices when the model repeats itself
         self.response = None  # the streaming response, so another thread can abort it
@@ -576,6 +581,7 @@ class Agent:
         self.tools.read_mtimes.clear()
         self.reflected = len(self.messages)
         self.ctx_used = len(self.messages[0]["content"]) // 3
+        self.counted_chars = None
 
     def session_file(self) -> Path:
         return sessions.sessions_dir() / f"{self.session_id}.json"
@@ -597,7 +603,10 @@ class Agent:
             "messages": self.messages,
             "checkpoints": self.checkpoints.to_json(),
         }
-        f.write_text(json.dumps(data))
+        # Written next to it and then renamed: a crash halfway leaves the previous version, not a broken file.
+        partial = f.with_name(f".{f.name}.partial")
+        partial.write_text(json.dumps(data))
+        os.replace(partial, f)
 
     def new_session(self) -> None:
         self.reset()
@@ -634,6 +643,7 @@ class Agent:
         self.tools.read_mtimes.clear()  # files may have changed since; the model must read them again
         self.reflected = len(self.messages)  # checked for notes to remember when that session ended
         self.ctx_used = sum(len(json.dumps(m)) for m in self.messages) // 3
+        self.counted_chars = None
         return note
 
     def load_latest(self) -> bool:
@@ -797,7 +807,7 @@ class Agent:
             self.usage["output_tokens"] += final.get("eval_count", 0)
             self.usage["output_ns"] += final.get("eval_duration", 0)
             self.ctx_used = final.get("prompt_eval_count", 0) + final.get("eval_count", 0)
-            self.sent_chars = conversation_chars(self.messages)
+            self.sent_chars = self.counted_chars = conversation_chars(self.messages)
             seconds = final.get("eval_duration", 0) / 1e9
             self.last_speed = final.get("eval_count", 0) / seconds if seconds else 0.0
         return message
@@ -943,6 +953,8 @@ class Agent:
         for step in range(self.max_steps):
             if self.cancel is not None and self.cancel.is_set():
                 raise KeyboardInterrupt
+            if step and self.autosave:
+                self.save()  # a crash or a closed terminal loses at most this step
             self.maybe_compact()
             try:
                 reply = self.assistant_step()
@@ -1027,6 +1039,9 @@ class Agent:
                     self.console.print(Text(f"  {result[:300]}", style="red"))
                 elif name in ("read_file", "grep", "glob", "list_dir"):
                     self.console.print(Text(f"  ⎿ {result.count(chr(10)) + 1} line(s)", style="dim"))
+                budget = self.result_budget()
+                if len(result) > budget and name not in ("agent", "skill"):
+                    result = context_tools.shorten(result, budget, f"{name} result")
                 verdict = self.repeats.check(name, args, result)
                 if verdict.note:
                     result += verdict.note
@@ -1161,8 +1176,21 @@ class Agent:
             limit = min(limit, self.settings.compact_at)
         return limit
 
+    def next_request_tokens(self) -> int:
+        """The size of the next request: what the model last counted, plus what was added since (tool output,
+        attachments). Deciding on the last count alone let one large tool result overflow the window."""
+        if self.counted_chars is None:
+            return self.ctx_used
+        return self.ctx_used + max(0, conversation_chars(self.messages) - self.counted_chars) // 3
+
+    def result_budget(self) -> int:
+        """Characters one tool result may take: a share of the window, so one large result can't fill it."""
+        return max(MIN_RESULT_CHARS, int(self.settings.context * 3 * RESULT_SHARE))
+
     def maybe_compact(self) -> None:
         limit = self.compact_limit()
+        if self.next_request_tokens() > limit:
+            self.ctx_used, self.counted_chars = self.next_request_tokens(), None
         if self.ctx_used <= limit:
             return
         enough = int(limit * PRUNED_ENOUGH / AUTO_COMPACT_RATIO)  # after pruning, a summary isn't needed below this
@@ -1231,6 +1259,7 @@ class Agent:
             )
             self.skills_loaded.clear()
         self.ctx_used = sum(len(m["content"]) for m in self.messages) // 3
+        self.counted_chars = None
         self.summarized_size = self.ctx_used
         self.sent_chars = 0
         self.reflected = len(self.messages)

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/src/lcode/api.py

@@ -200,6 +200,7 @@ def open_agent(cwd: Path, options: Options, console: Console, hw: Hardware | Non
     )
     agent = Agent(ollama, settings, cwd, console=console)
     agent.hardware = hw
+    agent.autosave = True
     agent.interactive = options.interactive
     if options.max_steps:
         agent.max_steps = options.max_steps

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/src/lcode/context.py

@@ -14,8 +14,10 @@ full output is saved to a file the model can read if it needs more.
 from __future__ import annotations
 
 import json
+import os
 import re
 import time
+from collections import deque
 from dataclasses import dataclass
 from pathlib import Path
 from typing import TYPE_CHECKING
@@ -253,6 +255,72 @@ def shorten(text: str, limit: int, label: str = "output") -> str:
     return f"{head}{note}{tail}{where}"
 
 
+class OutputSpool:
+    """Output collected line by line with bounded memory: once it's long, everything goes to a file, and only the
+    start, the end and the error-looking lines stay in memory. What `shorten` returns comes out the same."""
+
+    def __init__(self, limit: int, label: str = "output") -> None:
+        self.limit, self.label = limit, label
+        self.head: list[str] = []  # everything, until the output gets long; then its start
+        self.tail: deque[str] = deque()
+        self.tail_chars = 0
+        self.errors: list[str] = []
+        self.chars = 0
+        self.file = None
+        self.path: Path | None = None
+
+    def add(self, line: str) -> None:
+        self.chars += len(line)
+        if self.file is None:
+            self.head.append(line)
+            if self.chars > self.limit * 2:
+                self._spool()
+            return
+        try:
+            self.file.write(line)
+        except OSError:
+            pass
+        if ERROR_LINE.search(line) and len(self.errors) < MAX_ERROR_LINES:
+            self.errors.append(line.strip()[:300])
+        self.tail.append(line)
+        self.tail_chars += len(line)
+        while self.tail_chars > self.limit // 4 and len(self.tail) > 1:
+            self.tail_chars -= len(self.tail.popleft())
+
+    def _spool(self) -> None:
+        text = "".join(self.head)
+        self.path = save_output(text, self.label)
+        if self.path is not None:
+            try:
+                self.file = self.path.open("a")
+            except OSError:
+                self.file = None
+        if self.file is None:  # nowhere to keep it: keep only the start and carry on counting
+            self.file = open(os.devnull, "w")  # noqa: SIM115
+        head = text[: self.limit * 3 // 5]
+        self.head = [head]
+
+    def text(self) -> str:
+        if self.file is None:
+            return shorten("".join(self.head), self.limit, self.label)
+        self.file.close()
+        head, tail = "".join(self.head), "".join(self.tail)
+        cut = self.chars - len(head) - len(tail)
+        note = f"\n\n... [{cut} characters cut"
+        if self.errors:
+            note += f"; {len(self.errors)} line(s) from them that look like errors:]\n" + "\n".join(self.errors)
+            note += "\n[...]\n\n"
+        else:
+            note += "] ...\n\n"
+        where = (
+            f"\n[The full {self.label} ({self.chars} characters) is in {self.path}: read parts of it with read_file "
+            "if you need them.]"
+            if self.path
+            else ""
+        )
+        return f"{head}{note}{tail}{where}"
+
+
 # ----------------------------------------------------------------------------- what uses the context
 
 

lcode_cli-0.28.1/src/lcode/permissions.py

@@ -0,0 +1,260 @@
+"""Permission prompts for file edits and shell commands."""
+
+from __future__ import annotations
+
+import re
+import shlex
+from collections.abc import Callable
+
+from rich.console import Console, RenderableType
+from rich.panel import Panel
+
+from lcode.config import PERMISSION_MODES
+
+# Commands that only read state run without asking (when used without redirection or chaining).
+SAFE_COMMANDS = {
+    "ls", "cat", "head", "tail", "wc", "pwd", "grep", "rg", "find", "tree", "file", "stat", "du", "df",
+    "echo", "which", "whoami", "uname", "date", "sort", "uniq", "cut", "nl", "diff", "basename", "dirname",
+    "realpath", "readlink", "nvidia-smi", "sw_vers",
+}  # fmt: skip
+SAFE_GIT = {"status", "log", "diff", "show", "branch", "ls-files", "rev-parse", "remote", "blame", "shortlog"}
+# For these, "always allow" is remembered per subcommand (e.g. `git commit`, not all of `git`).
+MULTI_WORD = {"git", "npm", "pnpm", "yarn", "pip", "uv", "docker", "cargo", "go", "kubectl", "python", "python3", "brew"}  # fmt: skip  # noqa: E501
+
+
+# `cd <plain path> &&` in front of a command: harmless, and models write it all the time.
+NOT_ASKED = (
+    "This needs the user's permission, and nobody can be asked in this run, so it was not allowed. Do without it "
+    "if you can; otherwise finish and say what permission you need."
+)
+LEADING_CD = re.compile(r"""^\s*(?:cd\s+(?:[\w./~@+,=:-]+|'[^']*'|"[^"$`\\]*")\s*&&\s*)+""")
+
+
+# Redirections that write nothing anyone keeps: stderr into stdout, or output thrown away.
+HARMLESS_REDIRECT = re.compile(r"(?<![\w>&])(?:[12]?>&[12]|[12]?>\s*/dev/null)(?=\s|$)")
+OPERATORS = {"|", "||", "&&", ";", "&", ">", ">>", "<", "<<", "<<<", ">&", "<&", ">|", "(", ")", ";;"}
+
+
+def split_command(command: str) -> tuple[list[list[str]], list[str]] | None:
+    """The command's segments (as words) and the operators between them, quotes respected. None when it can't be
+    read: command substitution, process substitution or unbalanced quotes."""
+    if any(tok in command for tok in ("`", "$(", "<(", ">(")) or "\n" in command.strip():
+        return None
+    lexer = shlex.shlex(command, posix=True, punctuation_chars=True)
+    lexer.whitespace_split = True
+    try:
+        tokens = list(lexer)
+    except ValueError:
+        return None
+    segments: list[list[str]] = [[]]
+    operators: list[str] = []
+    for token in tokens:
+        if token in OPERATORS or (token and set(token) <= set("|&;<>()")):
+            operators.append(token)
+            segments.append([])
+        else:
+            segments[-1].append(token)
+    return [s for s in segments if s], operators
+
+
+def segment_key(words: list[str]) -> str:
+    """The program, plus the subcommand for tools like git (`git commit`, `python -m pytest`)."""
+    while words and re.fullmatch(r"\w+=\S*", words[0]):
+        words = words[1:]  # VAR=value in front
+    if not words:
+        return ""
+    if words[0] in MULTI_WORD and len(words) > 1:
+        if words[1] in ("-m", "-c") and len(words) > 2:  # python -m <module>
+            return " ".join(words[:3])
+        return f"{words[0]} {words[1]}"
+    return words[0]
+
+
+def bash_key(command: str) -> str:
+    """What "always allow" remembers. For one program, the program (plus subcommand for git and the like); for a
+    chain such as `npm test && rm -rf build`, every program in it, so allowing `npm test` doesn't allow the chain.
+    `cd dir &&` in front doesn't count."""
+    command = HARMLESS_REDIRECT.sub(" ", LEADING_CD.sub("", command)).strip()
+    parsed = split_command(command)
+    if parsed is None:
+        return "bash:" + " ".join(command.split())  # can't be read: only this exact command
+    segments, operators = parsed
+    keys, redirected = [], False
+    for i, words in enumerate(segments):
+        before = operators[i - 1] if i else ""
+        if before and before not in ("|", "&&", "||", ";", "&"):
+            redirected = True  # a file name after > or <, not a program
+            continue
+        keys.append(segment_key(words))
+    key = " + ".join(k for k in keys if k) + (" (redirected)" if redirected else "")
+    return f"bash:{key}"
+
+
+def option_values(words: list[str], *options: str) -> list[str]:
+    """The values of options such as `-o FILE`, `-oFILE` or `--output=FILE`."""
+    found = []
+    for i, word in enumerate(words):
+        for option in options:
+            if word == option and i + 1 < len(words):
+                found.append(words[i + 1])
+            elif option.startswith("--") and word.startswith(option + "="):
+                found.append(word.split("=", 1)[1])
+            elif not option.startswith("--") and word.startswith(option) and len(word) > len(option):
+                found.append(word[len(option) :])
+    return found
+
+
+def flags(words: list[str]) -> list[str]:
+    return [w for w in words[1:] if w.startswith("-")]
+
+
+def positional(words: list[str]) -> list[str]:
+    return [w for w in words[1:] if not w.startswith("-")]
+
+
+# Branch and remote listing; anything else creates, deletes, renames or reconfigures.
+BRANCH_LISTING = {
+    "-a", "--all", "-r", "--remotes", "-l", "--list", "-v", "-vv", "--verbose", "--show-current", "--color",
+    "--no-color", "--column", "--no-column", "--abbrev", "--no-abbrev", "-i", "--ignore-case", "--omit-empty",
+}  # fmt: skip
+BRANCH_WITH_VALUE = {"--contains", "--no-contains", "--merged", "--no-merged", "--points-at", "--sort", "--format"}
+NVIDIA_QUERY = ("-q", "--query", "-L", "--list-gpus", "--format", "-i", "--id", "-d", "--display", "-x", "--xml-format",
+                "-h", "--help", "--query-gpu", "--query-compute-apps")  # fmt: skip
+
+
+def safe_git(words: list[str]) -> bool:
+    if len(words) < 2 or words[1] not in SAFE_GIT:
+        return False  # also `git -c …` and `git -C …`, which can run anything
+    sub, args = words[1], words[2:]
+    if sub in ("log", "show", "diff", "shortlog") and option_values(words, "--output"):
+        return False  # writes the output to a file
+    if sub == "branch":
+        listing = any(a in ("-l", "--list") for a in args)
+        i = 0
+        while i < len(args):
+            arg = args[i]
+            name = arg.split("=", 1)[0]
+            if name in BRANCH_WITH_VALUE:
+                i += 1 if "=" in arg else 2
+                continue
+            if arg.startswith("-") and name not in BRANCH_LISTING:
+                return False  # -d, -D, -m, -c, -f, -u, --set-upstream-to, --edit-description, …
+            if not arg.startswith("-") and not listing:
+                return False  # `git branch name` creates a branch
+            i += 1
+    if sub == "remote":
+        return not args or all(a in ("-v", "--verbose") for a in args) or args[0] in ("show", "get-url")
+    return True
+
+
+def safe_segment(words: list[str]) -> bool:
+    program = words[0]
+    if program == "git":
+        return safe_git(words)
+    if program not in SAFE_COMMANDS:
+        return False
+    if program == "sort" and (
+        option_values(words, "-o", "--output") or any(f.startswith("--compress-program") for f in flags(words))
+    ):
+        return False
+    if program == "uniq" and len(positional(words)) > 1:
+        return False  # `uniq in out` writes out
+    if program == "tree" and option_values(words, "-o"):
+        return False
+    if program == "rg" and any(f.split("=")[0] in ("--pre", "--pre-glob") for f in flags(words)):
+        return False  # runs a program on each file
+    if program == "find" and any(
+        w in ("-exec", "-execdir", "-ok", "-okdir", "-delete", "-fprint", "-fprint0", "-fprintf", "-fls") for w in words
+    ):
+        return False
+    if program == "date" and (option_values(words, "-s", "--set") or "-s" in words):
+        return False
+    if program == "file" and any(f in ("-C", "--compile") for f in flags(words)):
+        return False
+    if program == "nvidia-smi":
+        return all(f.split("=")[0] in NVIDIA_QUERY for f in flags(words))
+    return True
+
+
+def is_read_only(command: str) -> bool:
+    """Whether a command only reads: known read-only programs with arguments that don't write, joined only by
+    pipes. `cd dir &&` in front, `2>&1` and `>/dev/null` are fine."""
+    command = HARMLESS_REDIRECT.sub(" ", LEADING_CD.sub("", command)).strip()
+    parsed = split_command(command)
+    if parsed is None:
+        return False
+    segments, operators = parsed
+    if not segments or any(op != "|" for op in operators):
+        return False
+    return all(safe_segment(words) for words in segments)
+
+
+class Permissions:
+    def __init__(self, console: Console, mode: str = "ask"):
+        from lcode.hooks import Rules
+
+        self.console = console
+        self.mode = mode
+        self.always: set[str] = set()
+        self.rules = Rules()  # allow and deny lists from the settings (lcode.hooks)
+        self.on_prompt = None  # called with the title before lcode asks the user (notification hooks)
+        # Decides instead of asking (lcode.api, lcode acp): True, False, or a message saying why not.
+        self.approve: Callable[[dict], bool | str] | None = None
+
+    def rule(self, kind: str, target: str) -> tuple[bool, str] | None:
+        """A rule's verdict on an action: (allowed, message for the model), or None when no rule matches."""
+        verdict, which = self.rules.check(kind, target) if target else (None, "")
+        if verdict == "deny":
+            return False, f"A deny rule blocks this: {which}. Don't try it another way; tell the user if it's needed."
+        if verdict == "allow":
+            return True, ""
+        return None
+
+    def cycle(self) -> None:
+        self.mode = PERMISSION_MODES[(PERMISSION_MODES.index(self.mode) + 1) % len(PERMISSION_MODES)]
+
+    def needs_prompt(self, key: str, kind: str) -> bool:
+        if key in self.always or (self.mode == "yolo" and kind != "memory"):
+            return False
+        return not (kind == "edit" and self.mode == "auto-edit")
+
+    def request(self, key: str, kind: str, title: str, body: RenderableType, target: str = "") -> tuple[bool, str]:
+        """Ask the user. kind is 'edit', 'bash', 'web', 'mcp' or 'memory'. Returns (allowed, message for the model).
+
+        Memory notes follow the memory setting rather than the mode: with `memory = ask`, even yolo asks.
+        """
+        verdict = self.rule(kind, target)
+        if verdict is not None:
+            return verdict
+        if not self.needs_prompt(key, kind):
+            return True, ""
+        if self.approve is not None:  # a program or a non-interactive run decides
+            target = target or key.split(":", 1)[-1]
+            if kind == "bash":
+                target = LEADING_CD.sub("", target)  # the command itself, without `cd <folder> &&`
+            verdict = self.approve({"kind": kind, "title": title, "target": target, "key": key})
+            if verdict is True:
+                return True, ""
+            return False, verdict if isinstance(verdict, str) and verdict else NOT_ASKED
+        if self.on_prompt:
+            self.on_prompt(title)
+        self.console.print(Panel(body, title=title, title_align="left", border_style="yellow"))
+        scope = {"edit": "file edits", "memory": "memory notes"}.get(kind) or key.split(":", 1)[-1]
+        if kind == "mcp":
+            scope = scope.replace(":", " › ", 1)
+        try:
+            answer = input(f"  Allow? [y]es / [a]lways for '{scope}' this session / [n]o (+ optional reason): ")
+        except EOFError:
+            return False, "The user denied this action (no input available)."
+        answer = answer.strip()
+        if answer.lower() in ("y", "yes", ""):
+            return True, ""
+        if answer.lower() in ("a", "always"):
+            self.always.add("edit" if kind == "edit" else key)
+            return True, ""
+        # "n", "no", "n <reason>" or any other text, which is taken as the reason.
+        reason = re.sub(r"^(no|n)\b[\s,:-]*", "", answer, flags=re.I).strip()
+        message = "The user denied this action."
+        if reason:
+            return False, f"{message} User says: {reason}"
+        return False, f"{message} Ask the user how to proceed or choose a different approach."

{lcode_cli-0.28.0 → lcode_cli-0.28.1}/src/lcode/repl.py

@@ -754,6 +754,7 @@ def restore_checkpoint(agent: Agent, target: Checkpoint, rewind: bool) -> None:
         agent.messages = agent.messages[:index]
         agent.reflected = min(agent.reflected, index)
         agent.ctx_used = sum(len(json.dumps(m)) for m in agent.messages) // 3
+        agent.counted_chars = None
         c.print(f"The conversation is back to before request {target.n} as well.")
     elif plan.restore or plan.remove:
         what = "undid the file changes from" if not rewind else "rolled the files back to before"