@digital-threads/loom
Advanced tools
@digital-threads/loom - npm Package Compare versions
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
+27
-1
@@ -9,2 +9,27 @@ # Changelog | ||
| ## [0.7.1] - 2026-06-26 | ||
| ### Fixed | ||
| - **Account authorization works on macOS** — the in-UI "Authorize" used | ||
| Linux-only `script` flags, so on a Mac it ended with "authorization did not | ||
| complete". The invocation is now platform-correct (BSD form on darwin). | ||
| - **An auth failure offers re-authorize / switch** — a 401 / invalid-credentials | ||
| error now shows an account banner (re-authorize or switch account), like a rate | ||
| limit, instead of a silent "degraded" park. | ||
| - **No false "switch subscription" prompt** — the rate-limit detector matched bare | ||
| "rate limit" / "429" / "too many requests" in the agent's own output (e.g. an | ||
| analysis discussing HTTP codes), popping a switch prompt at low usage. Narrowed | ||
| to the provider's actual block phrasing. | ||
| - **Onboarding installs cleanly** — task-journal's marketplace used a `github:` | ||
| prefix the CLI rejects (now an `https://` URL); a plugin "update" at the wrong | ||
| scope no longer fails the whole install (best-effort). | ||
| ### Changed | ||
| - **Readable system log** — each tool burst is labelled with a human action | ||
| (📖 Reading code / 🧪 Running tests / ✏️ Editing files / 🔍 Searching …), with the | ||
| raw tool name kept beside it; the analysis stage is steered to token-pilot | ||
| exploration instead of raw recursive `find`/`grep`. | ||
| ## [0.7.0] - 2026-06-26 | ||
@@ -121,5 +146,6 @@ | ||
| [Unreleased]: https://github.com/Digital-Threads/loom/compare/v0.7.0...master | ||
| [Unreleased]: https://github.com/Digital-Threads/loom/compare/v0.7.1...master | ||
| [0.7.1]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.1 | ||
| [0.7.0]: https://github.com/Digital-Threads/loom/releases/tag/v0.7.0 | ||
| [0.6.0]: https://github.com/Digital-Threads/loom/releases/tag/v0.6.0 | ||
| [0.5.0]: https://github.com/Digital-Threads/loom/releases/tag/v0.5.0 |
@@ -44,3 +44,3 @@ // Hard enforcement of the platform's mandatory tools for every Loom-launched | ||
| const bounded=/\\|\\s*(head|tail|wc)\\b/.test(cmd)||/--max-count|(^|\\s)-m\\s*\\d/.test(cmd); | ||
| if((recGrep||broadFind)&&!bounded){process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:"Безлимитный рекурсивный поиск вываливает много в контекст. Для символов кода используй mcp__token-pilot__find_usages(symbol); для файлов — Glob; либо ограничь: grep ... | head -50, find ... -maxdepth N."}}))} | ||
| if((recGrep||broadFind)&&!bounded){process.stdout.write(JSON.stringify({hookSpecificOutput:{hookEventName:"PreToolUse",permissionDecision:"deny",permissionDecisionReason:"Unbounded recursive search floods the context. For code symbols use mcp__token-pilot__find_usages(symbol); for files use Glob; or bound it: grep ... | head -50, find ... -maxdepth N."}}))} | ||
| process.exit(0)});`; | ||
@@ -47,0 +47,0 @@ // Command-policy PreToolUse(Bash) hook: enforce the security command policy on |
@@ -77,5 +77,9 @@ // TaskSession — one persistent Claude session per task. Every stage injects its | ||
| * burying "You've hit your session limit" in the transcript. Returns the reset | ||
| * hint when the provider includes one. */ | ||
| * hint when the provider includes one. Deliberately NARROW: it matches the | ||
| * provider's own block phrasing, NOT bare "rate limit" / "429" / "too many | ||
| * requests" — those appear in normal agent output (e.g. an analysis discussing | ||
| * HTTP codes or rate-limiting code) and used to false-fire a "switch account" | ||
| * prompt at low usage (loom-rlfp). */ | ||
| export function detectRateLimit(text) { | ||
| if (!/\b(hit (your|the) (session|usage) limit|rate limit|usage limit reached|too many requests|429)\b/i.test(text)) { | ||
| if (!/\b(hit (your|the) (session|usage) limit|usage limit reached|rate[ _-]?limit[ _-]?(error|exceeded|reached)|api error:\s*429)\b/i.test(text)) { | ||
| return { hit: false }; | ||
@@ -86,2 +90,9 @@ } | ||
| } | ||
| /** Detect an authentication / credential failure in an agent turn (a 401, expired | ||
| * or missing login) — distinct from a rate limit. The pipeline surfaces it as a | ||
| * fixable stop ("re-authorize or switch account") instead of a silent degraded | ||
| * park (loom-authfail). Excludes 404/5xx, which are not auth problems. */ | ||
| export function detectAuthError(text) { | ||
| return /\b(failed to authenticate|invalid authentication|authentication credentials|authentication failed|not logged in|please run \/login|api error:\s*40[13])\b/i.test(text); | ||
| } | ||
| /** Parse the mandatory completeness marker the agent appends as the last line. | ||
@@ -88,0 +99,0 @@ * Conservative: only an explicit "НЕ ГОТОВО" parks the stage; an explicit |
@@ -7,3 +7,7 @@ import { detect, runRecipe } from "./recipe.js"; | ||
| // command is a no-op when already current, so it's safe to run every onboarding. | ||
| const pluginUpdate = (ref) => [{ cmd: "claude", args: ["plugin", "update", ref] }]; | ||
| // Refreshing a plugin is best-effort: `claude plugin update` fails when the | ||
| // plugin is present at a different scope (project, not user), already current, or | ||
| // offline — none of which should fail onboarding, since the plugin IS installed. | ||
| // Marked optional so a failed update is a warning, not a hard failure (loom-isd). | ||
| const pluginUpdate = (ref) => [{ cmd: "claude", args: ["plugin", "update", ref], optional: true }]; | ||
| // Pull a bundled plugin's install recipe straight from its plugin.json — the | ||
@@ -10,0 +14,0 @@ // single source of truth, so we never duplicate the steps here. |
@@ -47,2 +47,5 @@ // L12 — the dialog stages (Analysis / Brainstorm / Spec). Unlike L4's autonomous | ||
| "delegate a deep read to the `code-analyzer` agent if it spans many files.", | ||
| "To map the structure use project_overview / explore_area / Glob — NOT a raw", | ||
| "recursive `find`/`grep` (those are blocked to keep context lean; bound them", | ||
| "with -maxdepth / | head if you must shell out).", | ||
| "Write a short, clear analysis in plain language:", | ||
@@ -49,0 +52,0 @@ "- what the task actually is (in your words),", |
@@ -21,4 +21,10 @@ // In-UI profile authorization. `aimux auth login <name>` wraps the interactive | ||
| throw new Error(`invalid profile name: ${name}`); | ||
| // script -q (quiet) -f (flush) -e (return child's exit code) -c <cmd> <typescript> | ||
| return spawn("script", ["-qfec", `aimux auth login ${name}`, "/dev/null"], { | ||
| // `script` gives the CLI a pseudo-TTY so it runs + prints the OAuth URL. Its | ||
| // flags differ by OS: util-linux is `script -qfec "<cmd>" <file>`, but BSD/macOS | ||
| // is `script -q <file> <cmd> <args...>` (no -f/-e/-c). Using the Linux form on | ||
| // macOS passes invalid flags and the auth flow dies with "did not complete". | ||
| const args = process.platform === "darwin" | ||
| ? ["-q", "/dev/null", "aimux", "auth", "login", name] | ||
| : ["-qfec", `aimux auth login ${name}`, "/dev/null"]; | ||
| return spawn("script", args, { | ||
| stdio: ["pipe", "pipe", "pipe"], | ||
@@ -25,0 +31,0 @@ }); |
@@ -21,3 +21,3 @@ { | ||
| { "cmd": "cargo", "args": ["install","task-journal-mcp"], "optional": true }, | ||
| { "cmd": "claude", "args": ["plugin","marketplace","add","github:Digital-Threads/Task-Journal"] }, | ||
| { "cmd": "claude", "args": ["plugin","marketplace","add","https://github.com/Digital-Threads/Task-Journal"] }, | ||
| { "cmd": "claude", "args": ["plugin","install","--scope","{scope}","task-journal@task-journal"], "scoped": true } | ||
@@ -24,0 +24,0 @@ ], |
+1
-1
| { | ||
| "name": "@digital-threads/loom", | ||
| "version": "0.7.0", | ||
| "version": "0.7.1", | ||
| "type": "module", | ||
@@ -5,0 +5,0 @@ "description": "Loom — local AI-dev orchestrator: give it a task and it runs the work through an analysis → spec → code → review → PR pipeline on a board, with cost, reasoning memory and multi-account support. Public beta.", |
@@ -7,4 +7,4 @@ <!doctype html> | ||
| <title>Loom</title> | ||
| <script type="module" crossorigin src="/assets/index-Du8gpz3-.js"></script> | ||
| <link rel="stylesheet" crossorigin href="/assets/index-DOvANPEQ.css"> | ||
| <script type="module" crossorigin src="/assets/index-DGQK6jZR.js"></script> | ||
| <link rel="stylesheet" crossorigin href="/assets/index-B9gwl4LI.css"> | ||
| </head> | ||
@@ -11,0 +11,0 @@ <body> |
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
Sorry, the diff of this file is too big to display
New alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Minified code
QualityThis package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Fixed alerts
AI-detected potential code anomaly
Supply chain riskAI has identified unusual behaviors that may pose a security risk.
Minified code
QualityThis package contains minified code. This may be harmless in some cases where minified code is included in packaged libraries, however packages on npm should not minify code.
URL strings
Supply chain riskPackage contains fragments of external URLs or IP addresses, which the package may be accessing at runtime.
Improved metrics
- Total package byte prevSize
2107576
0.27%- Lines of code
16053
0.24%