@alisio/core 0.1.0-alpha.9 → 0.1.1

package/dist/agents/service.d.ts

@@ -0,0 +1,57 @@
+/**
+ * The agent definition service every surface (web server, TUI) uses: CRUD over the project and
+ * global `.agents/agents` scopes, the merged listing (a project agent overrides the global one
+ * with the same id) and the hot-reload of the runtime agent registry after each write.
+ *
+ * The runtime registry belongs to the subagents plugin (it discovers agent files at setup and
+ * publishes them through plugin state). After a write the service asks it to rediscover and then
+ * checks whether the saved file is actually loaded, so callers report `live: true` only when the
+ * change is usable by the next prompt; otherwise they must tell the user to restart.
+ */
+import type { AgentDefinitionInfo, AgentDefinitionInput, AgentScope } from "@alisio/sdk";
+/** The runtime registry the service refreshes (implemented by the application). */
+export interface AgentRegistry {
+    /** Rediscovers agent files; false when no registry can reload (e.g. subagents plugin off). */
+    reload(): Promise<boolean>;
+    /** Absolute paths of the agent files currently loaded, or undefined when unknown. */
+    loadedPaths(): string[] | undefined;
+}
+export interface AgentChange<T> {
+    result: T;
+    /**
+     * The runtime registry reflects the change now (new prompts use it). False: the file is saved,
+     * but Alisio must restart (or the workspace must be trusted / the plugin enabled) to use it.
+     */
+    live: boolean;
+}
+export interface AgentDefinitionServiceOptions {
+    /** Workspace root; without it only the global scope exists. */
+    workspace?: string;
+    /** Home directory of the global scope (`os.homedir()`). */
+    home: string;
+    registry?: AgentRegistry;
+    now?: () => number;
+}
+/** Applies the project-over-global precedence and marks both sides of an override. */
+export declare function mergeAgentScopes(project: AgentDefinitionInfo[], global: AgentDefinitionInfo[]): AgentDefinitionInfo[];
+export declare class AgentDefinitionService {
+    private readonly options;
+    private readonly stores;
+    constructor(options: AgentDefinitionServiceOptions);
+    /** Scopes available here: `project` only with a workspace. */
+    get scopes(): AgentScope[];
+    /** The scope new agents default to: the project when a workspace is open. */
+    get defaultScope(): AgentScope;
+    dir(scope: AgentScope): string;
+    private store;
+    list(): Promise<AgentDefinitionInfo[]>;
+    get(scope: AgentScope, id: string): Promise<AgentDefinitionInfo | undefined>;
+    create(scope: AgentScope, input: AgentDefinitionInput): Promise<AgentChange<AgentDefinitionInfo>>;
+    update(scope: AgentScope, id: string, input: AgentDefinitionInput): Promise<AgentChange<AgentDefinitionInfo>>;
+    delete(scope: AgentScope, id: string): Promise<AgentChange<boolean>>;
+    /** Asks the runtime registry to rediscover agent files (false: nothing could reload). */
+    reload(): Promise<boolean>;
+    /** Whether the runtime registry has `path` loaded (false when unknown). */
+    isLoaded(path: string): boolean;
+    private settle;
+}

package/dist/agents/service.js

@@ -0,0 +1,86 @@
+import { AgentNotFoundError, AgentScopeStore, agentScopeDir } from "./definitions.js";
+/** Applies the project-over-global precedence and marks both sides of an override. */
+export function mergeAgentScopes(project, global) {
+    const projectIds = new Set(project.map((a) => a.id));
+    const globalIds = new Set(global.map((a) => a.id));
+    const byName = (a, b) => a.name.localeCompare(b.name) || (a.scope === b.scope ? 0 : a.scope === "project" ? -1 : 1);
+    return [
+        ...project.map((a) => (globalIds.has(a.id) ? { ...a, overridesGlobal: true } : a)),
+        ...global.map((a) => (projectIds.has(a.id) ? { ...a, overriddenByProject: true } : a)),
+    ].sort(byName);
+}
+export class AgentDefinitionService {
+    options;
+    stores = {};
+    constructor(options) {
+        this.options = options;
+        this.stores.global = new AgentScopeStore("global", agentScopeDir("global", options), options.now);
+        if (options.workspace)
+            this.stores.project = new AgentScopeStore("project", agentScopeDir("project", options), options.now);
+    }
+    /** Scopes available here: `project` only with a workspace. */
+    get scopes() {
+        return this.stores.project ? ["project", "global"] : ["global"];
+    }
+    /** The scope new agents default to: the project when a workspace is open. */
+    get defaultScope() {
+        return this.stores.project ? "project" : "global";
+    }
+    dir(scope) {
+        return this.store(scope).dir;
+    }
+    store(scope) {
+        const store = this.stores[scope];
+        if (!store)
+            throw new Error(`The ${scope} scope is not available without a workspace`);
+        return store;
+    }
+    async list() {
+        const [project, global] = await Promise.all([
+            this.stores.project?.list() ?? Promise.resolve([]),
+            this.store("global").list(),
+        ]);
+        return mergeAgentScopes(project, global);
+    }
+    async get(scope, id) {
+        const all = await this.list();
+        return all.find((a) => a.scope === scope && a.id === id);
+    }
+    async create(scope, input) {
+        const created = await this.store(scope).create(input);
+        return this.settle(created.id, scope, created.path, true);
+    }
+    async update(scope, id, input) {
+        const updated = await this.store(scope).update(id, input);
+        return this.settle(updated.id, scope, updated.path, true);
+    }
+    async delete(scope, id) {
+        const store = this.store(scope);
+        const existing = await store.get(id);
+        if (!existing)
+            throw new AgentNotFoundError(scope, id);
+        const deleted = await store.delete(id);
+        const live = (await this.reload()) && !this.isLoaded(existing.path);
+        return { result: deleted, live };
+    }
+    /** Asks the runtime registry to rediscover agent files (false: nothing could reload). */
+    async reload() {
+        if (!this.options.registry)
+            return false;
+        try {
+            return await this.options.registry.reload();
+        }
+        catch {
+            return false;
+        }
+    }
+    /** Whether the runtime registry has `path` loaded (false when unknown). */
+    isLoaded(path) {
+        return !!this.options.registry?.loadedPaths()?.includes(path);
+    }
+    async settle(id, scope, path, mustBeLoaded) {
+        const reloaded = await this.reload();
+        const result = (await this.get(scope, id));
+        return { result, live: reloaded && this.isLoaded(path) === mustBeLoaded };
+    }
+}

package/dist/agents/templates.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Predefined starting points for new agents, shared by the web Agents window (served by
+ * `GET /api/agents/templates`) and the TUI `/agents` manager. A template never chooses a model:
+ * the editor starts from the active one.
+ */
+import type { AgentTemplateInfo } from "@alisio/sdk";
+export declare const AGENT_TEMPLATES: readonly AgentTemplateInfo[];
+export declare function agentTemplate(id: string): AgentTemplateInfo | undefined;

package/dist/agents/templates.js

@@ -0,0 +1,102 @@
+const lines = (...parts) => parts.join("\n");
+export const AGENT_TEMPLATES = [
+    {
+        id: "code-reviewer",
+        name: "Code Reviewer",
+        description: "Reads a diff or a set of files and reports bugs, risky changes and missing tests, ordered by severity.",
+        instructions: lines("You are a meticulous code reviewer working inside the user's repository.", "", "- Start from the change under review (git diff, the files named by the user) and read the surrounding code before judging it.", "- Report correctness bugs first, then security and data-loss risks, then maintainability. Skip pure style nits unless asked.", "- For every finding give the file and line, why it is a problem, and a concrete fix.", "- Say explicitly when you found nothing serious; never invent issues to fill a report.", "- Do not edit files unless the user asks you to apply a fix."),
+        reasoning: { effort: "high", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "test-writer",
+        name: "Test Writer",
+        description: "Adds focused tests for existing behavior or a new change, following the project's test framework and conventions.",
+        instructions: lines("You write automated tests for this project.", "", "- Detect the test framework, file layout and helpers already in use and follow them.", "- Test observable behavior at module boundaries; avoid snapshots that only restate the implementation.", "- Cover the happy path, edge cases and failure modes. Keep each test small and named after the behavior it proves.", "- Run the tests you add and report the command and its result. If a test fails because of a real bug, say so instead of weakening the assertion."),
+        reasoning: { effort: "medium", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "low" },
+    },
+    {
+        id: "refactoring-assistant",
+        name: "Refactoring Assistant",
+        description: "Improves the structure of existing code in small, behavior-preserving steps verified by the test suite.",
+        instructions: lines("You refactor code without changing its behavior.", "", "- Before editing, explain the smell you are addressing and the target shape in a few lines.", "- Work in small steps; run the relevant tests after each meaningful step.", "- Keep public interfaces stable unless the user agrees to change them, and update every caller when they do change.", "- Do not mix refactoring with feature work or formatting churn.", "- Finish with a short summary of what moved where and how it was verified."),
+        reasoning: { effort: "high", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "documentation-writer",
+        name: "Documentation Writer",
+        description: "Writes and updates READMEs, guides and API docs that match the code as it is today.",
+        instructions: lines("You write clear technical documentation for this project.", "", "- Read the code first; document what it actually does, not what it was meant to do.", "- Lead with the task the reader wants to accomplish, then details. Prefer short sections, lists and runnable examples.", "- Keep commands, flags and configuration keys exact, and keep every translated copy of a page in sync.", "- Flag behavior that looks wrong instead of documenting it as intended."),
+        reasoning: { effort: "low", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "security-auditor",
+        name: "Security Auditor",
+        description: "Looks for vulnerabilities such as injection, secret leaks, unsafe defaults and weak access control, with evidence.",
+        instructions: lines("You audit code for security problems.", "", "- Trace untrusted input from where it enters (HTTP, CLI arguments, files, environment) to where it is used.", "- Look for injection, path traversal, unsafe deserialization, missing authorization, secrets in code or logs, and insecure defaults.", "- Rate every finding (critical, high, medium, low) and include the exploit path, the affected code and a fix.", "- Distinguish confirmed issues from hypotheses. Never run destructive commands or exfiltrate data while testing."),
+        reasoning: { effort: "high", summary: "detailed" },
+        text: { format: { type: "text" }, verbosity: "high" },
+    },
+    {
+        id: "debugger",
+        name: "Bug Triage & Debugger",
+        description: "Reproduces a reported failure, isolates the root cause and proposes the smallest safe fix.",
+        instructions: lines("You debug problems reported by the user.", "", "1. Restate the symptom and gather facts: error output, logs, recent changes, versions.", "2. Reproduce it with the smallest possible command or test before changing anything.", "3. Form hypotheses and test them one at a time; record what each experiment ruled out.", "4. Fix the root cause, not the symptom, and add a regression test when the project has tests.", "", "If you cannot reproduce the issue, say what you tried and what information would unblock you."),
+        reasoning: { effort: "high", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "migration-assistant",
+        name: "Migration Assistant",
+        description: "Plans and carries out upgrades of frameworks, libraries or APIs across the codebase, one verified batch at a time.",
+        instructions: lines("You migrate this codebase from one version, library or API to another.", "", "- Read the official migration notes for the target version when they are available and list the breaking changes that apply here.", "- Inventory every affected call site before editing, then migrate in batches that keep the build green.", "- Run the type checker and tests after each batch and report anything you had to leave behind.", "- Never silence errors with casts or disabled checks just to finish a batch."),
+        reasoning: { effort: "high", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "research-agent",
+        name: "Research Agent",
+        description: "Investigates a question across the web, documentation and local data, and returns a sourced, structured report.",
+        instructions: lines("You are a research assistant.", "", "- Clarify the question and the decision it supports before searching.", "- Gather evidence from several independent sources; prefer primary documentation and data over summaries.", "- Organize the answer as: summary, key findings, evidence (with links or file paths), open questions.", "- Mark uncertainty explicitly and never present a guess as a sourced fact."),
+        reasoning: { effort: "medium", summary: "concise" },
+        text: { format: { type: "text" }, verbosity: "high" },
+    },
+    {
+        id: "customer-support-agent",
+        name: "Customer Support Agent",
+        description: "Answers customer requests politely, checks the account details it is given and hands off what it cannot resolve.",
+        instructions: lines("You help customers resolve their requests.", "", "- Be warm, concise and specific. Confirm what the customer is asking before acting.", "- Use only the account information and tools you are given; never guess balances, orders or personal data.", "- Follow the documented policies. When a request needs a human (refunds above policy, legal or safety issues, angry escalations), say so and summarize the case for the hand-off.", "- End each reply with the next step for the customer."),
+        reasoning: { effort: "low", summary: "none" },
+        text: { format: { type: "text" }, verbosity: "low" },
+    },
+    {
+        id: "devops-assistant",
+        name: "DevOps Assistant",
+        description: "Helps with deployments, CI pipelines, incident response and infrastructure troubleshooting.",
+        instructions: lines("You are a DevOps and site-reliability assistant.", "", "- During an incident, focus on impact and mitigation first, then root cause.", "- Read configuration, pipeline definitions and logs before proposing changes; quote the lines that matter.", "- Prefer reversible, incremental changes. Spell out the exact commands and how to roll them back.", "- Ask before running anything that touches production, deletes resources or rotates credentials."),
+        reasoning: { effort: "medium", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+    {
+        id: "meeting-assistant",
+        name: "Meeting Assistant",
+        description: "Turns meeting transcripts or notes into decisions, action items with owners and a short summary.",
+        instructions: lines("You process meeting transcripts and notes.", "", "Produce, in this order:", "1. A summary of three to five sentences.", "2. Decisions made.", "3. Action items as `owner — task — due date` (write `unassigned` or `no date` when missing).", "4. Open questions and risks.", "", "Use only what the transcript says; do not invent owners or dates."),
+        reasoning: { effort: "low", summary: "none" },
+        text: { format: { type: "text" }, verbosity: "low" },
+    },
+    {
+        id: "analytics-agent",
+        name: "Analytics Agent",
+        description: "Queries data, builds reports and explains trends and anomalies in plain language.",
+        instructions: lines("You are a data analyst.", "", "- Confirm the metric definitions, filters and time range before querying.", "- Show the query or computation you used so the result can be reproduced.", "- Explain what changed, by how much, and the most likely drivers; separate correlation from causation.", "- Call out data quality problems (gaps, duplicates, outliers) instead of hiding them."),
+        reasoning: { effort: "medium", summary: "auto" },
+        text: { format: { type: "text" }, verbosity: "medium" },
+    },
+];
+export function agentTemplate(id) {
+    return AGENT_TEMPLATES.find((template) => template.id === id);
+}

package/dist/analysis/capabilities.d.ts

@@ -0,0 +1,48 @@
+/**
+ * Persisted capability decisions (`capability_grants`). A `session` allow of the ROOT session is
+ * the only state that grants anything; `once` allows and every `deny` are audit rows only (a deny
+ * is never sticky: the next call asks again). Revoking stamps `revoked_at`; nothing is deleted.
+ */
+import type { AnalysisCapability, CapabilityGrantWire, SqlDatabase } from "@alisio/sdk";
+export type GrantSource = CapabilityGrantWire["source"];
+export interface GrantRecord extends CapabilityGrantWire {
+    workspace: string;
+    callId?: string;
+    runId?: string;
+    correlationId?: string;
+    revokedBy?: string;
+}
+/** Wire shape (no workspace path or call ids). */
+export declare const toGrantWire: (record: GrantRecord) => CapabilityGrantWire;
+export declare class CapabilityGrants {
+    private options;
+    constructor(options: {
+        db: SqlDatabase;
+        /** Root of a session (grants always belong to the root). */
+        rootOf: (sessionId: string) => string;
+        now?: () => number;
+    });
+    rootOf(sessionId: string): string;
+    /** The live `session` allow of `capability` for the root of `sessionId`, if any. */
+    active(capability: AnalysisCapability, sessionId: string): GrantRecord | undefined;
+    granted(capability: AnalysisCapability, sessionId: string): boolean;
+    /** Records one decision (audit row; a `session` allow is also the live grant). */
+    record(input: {
+        capability: AnalysisCapability;
+        sessionId: string;
+        workspace: string;
+        scope: "once" | "session";
+        decision: "allow" | "deny";
+        source: GrantSource;
+        callId?: string;
+        runId?: string;
+        correlationId?: string;
+    }): GrantRecord;
+    get(id: string): GrantRecord | undefined;
+    /** Live session grants first, then the latest `limit` audit rows of the root session. */
+    list(sessionId: string, limit?: number): GrantRecord[];
+    /** Live grants of the root session only. */
+    live(sessionId: string): GrantRecord[];
+    /** Revokes a live grant of `sessionId`'s root. False when unknown, foreign or already revoked. */
+    revoke(sessionId: string, grantId: string, by: string): boolean;
+}

package/dist/analysis/capabilities.js

@@ -0,0 +1,90 @@
+import { newId } from "../runtime/ids.js";
+const toRecord = (r) => ({
+    id: String(r.id),
+    capability: String(r.capability),
+    sessionId: String(r.session),
+    workspace: String(r.workspace),
+    scope: String(r.scope),
+    decision: String(r.decision),
+    source: String(r.source),
+    createdAt: Number(r.created_at),
+    ...(r.revoked_at != null ? { revokedAt: Number(r.revoked_at) } : {}),
+    ...(r.revoked_by != null ? { revokedBy: String(r.revoked_by) } : {}),
+    ...(r.call_id != null ? { callId: String(r.call_id) } : {}),
+    ...(r.run_id != null ? { runId: String(r.run_id) } : {}),
+    ...(r.correlation_id != null ? { correlationId: String(r.correlation_id) } : {}),
+});
+/** Wire shape (no workspace path or call ids). */
+export const toGrantWire = (record) => ({
+    id: record.id,
+    capability: record.capability,
+    sessionId: record.sessionId,
+    scope: record.scope,
+    decision: record.decision,
+    source: record.source,
+    createdAt: record.createdAt,
+    ...(record.revokedAt !== undefined ? { revokedAt: record.revokedAt } : {}),
+});
+export class CapabilityGrants {
+    options;
+    constructor(options) {
+        this.options = options;
+    }
+    rootOf(sessionId) {
+        return this.options.rootOf(sessionId);
+    }
+    /** The live `session` allow of `capability` for the root of `sessionId`, if any. */
+    active(capability, sessionId) {
+        const row = this.options.db
+            .prepare(`SELECT * FROM capability_grants WHERE capability=? AND session=? AND scope='session'
+           AND decision='allow' AND revoked_at IS NULL ORDER BY created_at DESC LIMIT 1`)
+            .get(capability, this.rootOf(sessionId));
+        return row ? toRecord(row) : undefined;
+    }
+    granted(capability, sessionId) {
+        return !!this.active(capability, sessionId);
+    }
+    /** Records one decision (audit row; a `session` allow is also the live grant). */
+    record(input) {
+        const id = newId("grant");
+        const createdAt = (this.options.now ?? Date.now)();
+        this.options.db
+            .prepare(`INSERT INTO capability_grants(id,capability,session,workspace,scope,decision,source,call_id,
+           run_id,correlation_id,created_at) VALUES(?,?,?,?,?,?,?,?,?,?,?)`)
+            .run(id, input.capability, this.rootOf(input.sessionId), input.workspace, input.scope, input.decision, input.source, input.callId ?? null, input.runId ?? null, input.correlationId ?? null, createdAt);
+        return this.get(id);
+    }
+    get(id) {
+        const row = this.options.db.prepare("SELECT * FROM capability_grants WHERE id=?").get(id);
+        return row ? toRecord(row) : undefined;
+    }
+    /** Live session grants first, then the latest `limit` audit rows of the root session. */
+    list(sessionId, limit = 50) {
+        const root = this.rootOf(sessionId);
+        const live = this.options.db
+            .prepare(`SELECT * FROM capability_grants WHERE session=? AND scope='session' AND decision='allow'
+             AND revoked_at IS NULL ORDER BY created_at DESC`)
+            .all(root).map(toRecord);
+        const ids = new Set(live.map((g) => g.id));
+        const audit = this.options.db
+            .prepare("SELECT * FROM capability_grants WHERE session=? ORDER BY created_at DESC LIMIT ?")
+            .all(root, limit)
+            .map(toRecord)
+            .filter((g) => !ids.has(g.id));
+        return [...live, ...audit];
+    }
+    /** Live grants of the root session only. */
+    live(sessionId) {
+        return this.list(sessionId, 0).filter((g) => g.revokedAt === undefined && g.scope === "session");
+    }
+    /** Revokes a live grant of `sessionId`'s root. False when unknown, foreign or already revoked. */
+    revoke(sessionId, grantId, by) {
+        const grant = this.get(grantId);
+        if (!grant || grant.sessionId !== this.rootOf(sessionId) || grant.revokedAt !== undefined)
+            return false;
+        this.options.db
+            .prepare("UPDATE capability_grants SET revoked_at=?, revoked_by=? WHERE id=?")
+            .run((this.options.now ?? Date.now)(), by, grantId);
+        return true;
+    }
+}

package/dist/analysis/data/csv.d.ts

@@ -0,0 +1,46 @@
+/**
+ * Streaming CSV/TSV parser (RFC 4180, spec §17.2): quoted fields, doubled quotes, line breaks
+ * inside quotes, CRLF/LF/CR rows. No dependencies and no I/O: callers push decoded text chunks
+ * (any split, even inside a quote or between CR and LF) and receive rows through a callback.
+ * Blank lines are skipped. Lenient on purpose: a stray quote inside an unquoted field is literal
+ * and text after a closing quote is appended.
+ */
+export declare class CsvError extends Error {
+    readonly code: "cell_too_large";
+    constructor(message: string, code: "cell_too_large");
+}
+export declare class CsvParser {
+    private readonly onRow;
+    private readonly maxCellChars;
+    private state;
+    private field;
+    private fields;
+    private skipLineFeed;
+    /** The current field was opened with a quote (so `""` is a value, not a blank line). */
+    private quotedField;
+    private readonly delimiter;
+    /** Rows delivered so far (blank lines excluded). */
+    rows: number;
+    constructor(delimiter: string, onRow: (fields: string[]) => void, maxCellChars?: number);
+    private add;
+    private endField;
+    private endRow;
+    write(chunk: string): void;
+    /** Flushes the last row when the input has no final line break. */
+    end(): void;
+}
+/** Parses a whole string (tests and small inputs). */
+export declare function parseCsv(text: string, delimiter?: string): string[][];
+/**
+ * Detects the delimiter from a text sample (the first 64 KiB): the candidate that splits most
+ * rows into the same number (> 1) of fields wins; ties keep the order `,` `;` TAB `|`.
+ */
+export declare function detectDelimiter(sample: string): string;
+/**
+ * Decodes a byte sample as the ingestion does: UTF-8 (BOM removed), UTF-16 by BOM, or
+ * windows-1252 when the bytes are not valid UTF-8. A sample cut inside a character is tolerated.
+ */
+export declare function decodeTextBytes(bytes: Uint8Array, truncated?: boolean): {
+    text: string;
+    encoding: string;
+};