• v2.0.0-beta: write tools, pending-changes queue, inference loop, API routes

    indifferentketchup released this 2026-05-25 01:53:38 +00:00 | 57 commits to main since this release

    Phase 2 of v2.0. BooCoder is now a functional write-capable chatbot.

    Write-path guard: resolveWritePath() uses resolve() (no realpath — files may
    not exist for creates) + prefix-check + secret-file deny list (.env, .pem,
    id_rsa
    , etc.). 23 unit tests cover traversal attacks.

    Pending-changes service: queueEdit/Create/Delete → applyOne/All →
    rejectOne/All → rewindOne. Edit diffs stored as JSON {old, new}. All writes
    queue before touching disk; apply re-validates the path guard.

    5 write tools: edit_file, create_file, delete_file, apply_pending, rewind.
    Registered alongside 25 read-only tools from BooChat (30 total, alpha-sorted).
    Write tools use a module-level inference context for sql+sessionId injection.

    Inference loop via workspace dependency: apps/coder imports
    createInferenceRunner, createBroker, ALL_TOOLS from @boocode/server (dist/).
    apps/server gains declaration: true + exports map with typed subpath entries.
    No code duplication — one inference engine shared by both apps.

    API routes: POST /api/sessions/:id/messages (user msg → inference), POST stop,
    GET/POST pending-changes CRUD (5 endpoints), WebSocket session streaming.

    Dockerfile updated to build apps/server first (coder depends on its .d.ts).
    Health endpoint reports tool count: {"ok":true,"db":true,"tools":30}.

    Co-Authored-By: Claude Opus 4.7 (1M context) noreply@anthropic.com

    Downloads