@arnilo/prism-coding-agent 0.0.96 → 0.1.0

package/dist/git.js

@@ -5,12 +5,12 @@
  * `git check-ref-format` for refs, and safe config that disables hooks,
  * external diff/textconv, pagers, and credential prompts by default.
  */
-import { mkdtemp, writeFile, rm } from "node:fs/promises";
+import { mkdtemp, rm, writeFile } from "node:fs/promises";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
-import { DEFAULT_MAX_GIT_CHANGED_FILES, DEFAULT_MAX_GIT_DIFF_LINES, DEFAULT_MAX_GIT_MESSAGE_BYTES, DEFAULT_MAX_GIT_OUTPUT_BYTES, DEFAULT_MAX_GIT_PATCH_BYTES, DEFAULT_MAX_GIT_PATHS, DEFAULT_MAX_GIT_REF_BYTES, DEFAULT_MAX_GIT_WORKTREES, DEFAULT_MAX_PR_COMMITS, DEFAULT_MAX_PR_HANDOFF_BYTES, HARD_MAX_GIT_CHANGED_FILES, HARD_MAX_GIT_DIFF_LINES, HARD_MAX_GIT_MESSAGE_BYTES, HARD_MAX_GIT_OUTPUT_BYTES, HARD_MAX_GIT_PATCH_BYTES, HARD_MAX_GIT_PATHS, HARD_MAX_GIT_REF_BYTES, HARD_MAX_GIT_WORKTREES, HARD_MAX_PR_COMMITS, HARD_MAX_PR_HANDOFF_BYTES, validateCodingLimit, } from "./limits.js";
 import { createBoundGitRunner, GitError, gitRequireOk, gitText, } from "./git-exec.js";
 import { parsePorcelainV2 } from "./git-status.js";
+import { DEFAULT_MAX_GIT_CHANGED_FILES, DEFAULT_MAX_GIT_DIFF_LINES, DEFAULT_MAX_GIT_MESSAGE_BYTES, DEFAULT_MAX_GIT_OUTPUT_BYTES, DEFAULT_MAX_GIT_PATCH_BYTES, DEFAULT_MAX_GIT_PATHS, DEFAULT_MAX_GIT_REF_BYTES, DEFAULT_MAX_GIT_WORKTREES, DEFAULT_MAX_PR_COMMITS, DEFAULT_MAX_PR_HANDOFF_BYTES, HARD_MAX_GIT_CHANGED_FILES, HARD_MAX_GIT_DIFF_LINES, HARD_MAX_GIT_MESSAGE_BYTES, HARD_MAX_GIT_OUTPUT_BYTES, HARD_MAX_GIT_PATCH_BYTES, HARD_MAX_GIT_PATHS, HARD_MAX_GIT_REF_BYTES, HARD_MAX_GIT_WORKTREES, HARD_MAX_PR_COMMITS, HARD_MAX_PR_HANDOFF_BYTES, validateCodingLimit, } from "./limits.js";
 import { resolveToCwd } from "./path-utils.js";
 export function resolveGitLimits(options) {
     return {
@@ -77,7 +77,7 @@ function truncateLines(text, maxLines) {
     const lineCount = lines.length;
     if (lineCount <= maxLines)
         return { text, truncated: false, lineCount };
-    const kept = lines.slice(0, maxLines).join("\n") + "\n";
+    const kept = `${lines.slice(0, maxLines).join("\n")}\n`;
     return { text: kept, truncated: true, lineCount };
 }
 async function withTempFile(prefix, contents, fn) {
@@ -292,9 +292,7 @@ export async function createGitOperations(options) {
                 ? await ensureCleanOrCheckpoint(request.createCheckpoint, request.signal, `git apply ${request.action}`)
                 : undefined;
             // Always check first for apply/reverse.
-            const checkArgs = request.action === "reverse"
-                ? ["apply", "--reverse", "--check"]
-                : ["apply", "--check"];
+            const checkArgs = request.action === "reverse" ? ["apply", "--reverse", "--check"] : ["apply", "--check"];
             const check = await runApply(checkArgs, filePath);
             if (check.exitCode !== 0) {
                 const output = (gitText(check, "stderr") || gitText(check)).trim();
@@ -302,9 +300,7 @@ export async function createGitOperations(options) {
                     await restoreCheckpoint(checkpoint, request.signal).catch(() => undefined);
                 return { ok: false, checkpoint, restored: Boolean(checkpoint), output: output || "patch check failed" };
             }
-            const applyArgs = request.action === "reverse"
-                ? ["apply", "--reverse"]
-                : ["apply"];
+            const applyArgs = request.action === "reverse" ? ["apply", "--reverse"] : ["apply"];
             const result = await runApply(applyArgs, filePath);
             if (result.exitCode !== 0) {
                 const output = (gitText(result, "stderr") || gitText(result)).trim();
@@ -314,12 +310,14 @@ export async function createGitOperations(options) {
                 }
                 else {
                     // Best-effort restore of tracked files when no checkpoint was taken (clean tree).
-                    await runner.exec({
+                    await runner
+                        .exec({
                         args: ["checkout", "--", "."],
                         cwd,
                         signal: request.signal,
                         maxOutputBytes: limits.maxOutputBytes,
-                    }).catch(() => undefined);
+                    })
+                        .catch(() => undefined);
                     restored = true;
                 }
                 return { ok: false, checkpoint, restored, output: output || `apply failed with exit ${result.exitCode}` };
@@ -378,12 +376,14 @@ export async function createGitOperations(options) {
         }
         catch (error) {
             // Reset index for the attempted paths; never drop pre-existing dirty work unless checkpointed.
-            await runner.exec({
+            await runner
+                .exec({
                 args: ["reset", "-q", "HEAD", "--", ...paths],
                 cwd,
                 signal: request.signal,
                 maxOutputBytes: limits.maxOutputBytes,
-            }).catch(() => undefined);
+            })
+                .catch(() => undefined);
             if (checkpoint)
                 await restoreCheckpoint(checkpoint, request.signal).catch(() => undefined);
             throw error;
@@ -490,6 +490,6 @@ export async function createGitOperations(options) {
     }
     return { status, diff, branch, worktree, apply, commit, prHandoff };
 }
+export { createBoundGitRunner, GitError, runGitCli, SAFE_GIT_CONFIG_ARGS, SAFE_GIT_ENV, } from "./git-exec.js";
 export { parsePorcelainV2 } from "./git-status.js";
-export { GitError, SAFE_GIT_ENV, SAFE_GIT_CONFIG_ARGS, createBoundGitRunner, runGitCli, } from "./git-exec.js";
 //# sourceMappingURL=git.js.map

package/dist/glob-match.d.ts

@@ -0,0 +1,6 @@
+/**
+ * Minimal glob matcher: `*`, `?`, and `**` only. No brace expansion, no regex.
+ */
+export declare function validateGlobPattern(pattern: string, maxPatternBytes: number): void;
+/** Match a workspace-relative path against a glob pattern using `/` separators. */
+export declare function matchGlobPattern(pattern: string, path: string): boolean;

package/dist/glob-match.js

@@ -0,0 +1,81 @@
+/**
+ * Minimal glob matcher: `*`, `?`, and `**` only. No brace expansion, no regex.
+ */
+export function validateGlobPattern(pattern, maxPatternBytes) {
+    const patternBytes = Buffer.byteLength(pattern, "utf8");
+    if (patternBytes < 1)
+        throw new Error("pattern must be non-empty");
+    if (patternBytes > maxPatternBytes) {
+        throw new Error(`pattern exceeds ${maxPatternBytes} byte pattern limit`);
+    }
+    if (pattern.includes("{") || pattern.includes("}")) {
+        throw new Error("brace expansion is not supported in glob patterns");
+    }
+}
+function matchSegment(pattern, segment) {
+    function go(pi, si) {
+        if (pi === pattern.length)
+            return si === segment.length;
+        const pc = pattern[pi];
+        if (pc === "*") {
+            if (pi === pattern.length - 1)
+                return true;
+            for (let k = si; k <= segment.length; k++) {
+                if (go(pi + 1, k))
+                    return true;
+            }
+            return false;
+        }
+        if (pc === "?") {
+            if (si >= segment.length)
+                return false;
+            return go(pi + 1, si + 1);
+        }
+        if (si >= segment.length || pc !== segment[si])
+            return false;
+        return go(pi + 1, si + 1);
+    }
+    return go(0, 0);
+}
+function splitPattern(pattern) {
+    const normalized = pattern.replace(/\\/g, "/");
+    if (normalized === "")
+        return [];
+    const parts = normalized.split("/");
+    if (parts.length > 0 && parts[0] === "")
+        parts.shift();
+    if (parts.length > 0 && parts[parts.length - 1] === "")
+        parts.pop();
+    return parts;
+}
+function matchSegments(patternParts, pathParts, pi, pj) {
+    while (pi < patternParts.length) {
+        const part = patternParts[pi];
+        if (part === "**") {
+            pi++;
+            if (pi === patternParts.length)
+                return true;
+            for (let k = pj; k <= pathParts.length; k++) {
+                if (matchSegments(patternParts, pathParts, pi, k))
+                    return true;
+            }
+            return false;
+        }
+        if (pj >= pathParts.length)
+            return false;
+        if (!matchSegment(part, pathParts[pj]))
+            return false;
+        pi++;
+        pj++;
+    }
+    return pj === pathParts.length;
+}
+/** Match a workspace-relative path against a glob pattern using `/` separators. */
+export function matchGlobPattern(pattern, path) {
+    const patternParts = splitPattern(pattern);
+    const pathParts = splitPattern(path);
+    if (patternParts.length === 0)
+        return pathParts.length === 0;
+    return matchSegments(patternParts, pathParts, 0, 0);
+}
+//# sourceMappingURL=glob-match.js.map

package/dist/glob.d.ts

@@ -0,0 +1,14 @@
+/**
+ * `glob` tool: bounded native pattern file finder.
+ */
+import type { ExecutionPolicy, ToolDefinition } from "@arnilo/prism";
+import { type RepositoryLimitOptions, type RepositoryOperations } from "./repository.js";
+export interface GlobToolOptions {
+    executionPolicy?: ExecutionPolicy;
+    operations?: RepositoryOperations;
+    repository?: RepositoryLimitOptions;
+    maxDepth?: number;
+    maxResults?: number;
+    exclude?: readonly string[];
+}
+export declare function createGlobTool(cwd: string, options?: GlobToolOptions): ToolDefinition;

package/dist/glob.js

@@ -0,0 +1,147 @@
+import { CODING_OBSERVATION_EFFECT } from "./effects.js";
+import { enforceExecutionPolicy } from "./execution-policy.js";
+import { HARD_MAX_REPO_DEPTH, HARD_MAX_REPO_RESULTS, validateCodingLimit, validateCodingLimitAllowZero } from "./limits.js";
+import { createLocalRepositoryOperations, RepositoryError, resolveRepositoryLimits, } from "./repository.js";
+function errorResult(toolCallId, message) {
+    return {
+        toolCallId,
+        name: "glob",
+        content: [{ type: "text", text: message }],
+        error: { message },
+    };
+}
+function formatGlobText(result) {
+    if (result.paths.length === 0) {
+        return result.truncated ? `[truncated by ${result.truncatedBy ?? "limit"} before any matches]` : "(no matches)";
+    }
+    const lines = [...result.paths];
+    if (result.truncated) {
+        const next = result.nextOffset !== undefined ? ` Use offset=${result.nextOffset} to continue.` : "";
+        lines.push(`[truncated by ${result.truncatedBy ?? "limit"}.${next}]`);
+    }
+    return lines.join("\n");
+}
+export function createGlobTool(cwd, options) {
+    const limits = resolveRepositoryLimits({
+        ...options?.repository,
+        maxDepth: options?.maxDepth ?? options?.repository?.maxDepth,
+        maxResults: options?.maxResults ?? options?.repository?.maxResults,
+        exclude: options?.exclude ?? options?.repository?.exclude,
+    });
+    const ops = options?.operations ?? createLocalRepositoryOperations(limits);
+    return {
+        name: "glob",
+        effect: CODING_OBSERVATION_EFFECT,
+        description: `Find workspace files by glob pattern without shell find. Supports * (segment), ? (one char), and ** (directories). Brace expansion is rejected. Skips hidden names and excluded basenames (default: ${limits.exclude.join(", ")}) unless overridden. Does not follow symlinks. Results paginate with offset/maxResults (default ${limits.maxResults}). Depth default ${limits.maxDepth}. Prefer repo_list to enumerate directories and repo_search to find text inside files.`,
+        parameters: {
+            type: "object",
+            properties: {
+                pattern: {
+                    type: "string",
+                    description: "Glob pattern matched against workspace-relative file paths (required)",
+                },
+                path: {
+                    type: "string",
+                    description: "Workspace-relative directory or file to search under (default: workspace root)",
+                },
+                includeHidden: {
+                    type: "boolean",
+                    description: "Include dotfile/dotdir names (default false). Excluded basenames still apply.",
+                },
+                maxDepth: {
+                    type: "number",
+                    description: `Maximum directory depth to descend (default ${limits.maxDepth}, hard ${HARD_MAX_REPO_DEPTH})`,
+                },
+                maxResults: {
+                    type: "number",
+                    description: `Maximum paths returned in this page (default ${limits.maxResults}, hard ${HARD_MAX_REPO_RESULTS})`,
+                },
+                offset: {
+                    type: "number",
+                    description: "Number of matching paths to skip before retaining results (default 0)",
+                },
+            },
+            required: ["pattern"],
+            additionalProperties: false,
+        },
+        async execute(args, context) {
+            const toolCallId = context.toolCallId;
+            if (context.signal?.aborted)
+                return errorResult(toolCallId, "Operation aborted");
+            const pattern = typeof args.pattern === "string" ? args.pattern : "";
+            if (!pattern)
+                return errorResult(toolCallId, "pattern must be a non-empty string");
+            const path = typeof args.path === "string" ? args.path : undefined;
+            const includeHidden = args.includeHidden === true;
+            let maxDepth;
+            let maxResults;
+            let offset = 0;
+            try {
+                if (args.maxDepth !== undefined) {
+                    maxDepth = validateCodingLimit("maxDepth", args.maxDepth, HARD_MAX_REPO_DEPTH);
+                }
+                if (args.maxResults !== undefined) {
+                    maxResults = validateCodingLimit("maxResults", args.maxResults, HARD_MAX_REPO_RESULTS);
+                }
+                if (args.offset !== undefined) {
+                    offset = validateCodingLimitAllowZero("offset", args.offset, limits.maxEntries);
+                }
+            }
+            catch (error) {
+                return errorResult(toolCallId, error instanceof Error ? error.message : String(error));
+            }
+            const policyCheck = await enforceExecutionPolicy(options?.executionPolicy, {
+                kind: "glob",
+                operation: "glob",
+                paths: [path ? path : cwd],
+                risk: "low",
+                metadata: {
+                    pattern,
+                    includeHidden,
+                    maxDepth,
+                    maxResults,
+                    offset,
+                    sessionId: context.sessionId,
+                    runId: context.runId,
+                    signal: context.signal,
+                },
+            }, toolCallId, "glob");
+            if (!policyCheck.allowed)
+                return policyCheck.result;
+            try {
+                const result = await ops.glob({
+                    root: cwd,
+                    pattern,
+                    path,
+                    includeHidden,
+                    exclude: limits.exclude,
+                    maxDepth: maxDepth ?? limits.maxDepth,
+                    maxResults: maxResults ?? limits.maxResults,
+                    offset,
+                    signal: context.signal,
+                    deadlineMs: limits.maxTimeMs,
+                });
+                return {
+                    toolCallId,
+                    name: "glob",
+                    content: [{ type: "text", text: formatGlobText(result) }],
+                    metadata: {
+                        truncated: result.truncated,
+                        truncatedBy: result.truncatedBy,
+                        offset: result.offset,
+                        nextOffset: result.nextOffset,
+                        returned: result.paths.length,
+                        scannedEntries: result.scannedEntries,
+                        scannedFiles: result.scannedFiles,
+                        paths: result.paths,
+                    },
+                };
+            }
+            catch (error) {
+                const message = error instanceof RepositoryError ? error.message : error instanceof Error ? error.message : String(error);
+                return errorResult(toolCallId, message);
+            }
+        },
+    };
+}
+//# sourceMappingURL=glob.js.map

package/dist/goal-verify.d.ts

@@ -0,0 +1,66 @@
+/**
+ * Thin goal→verify composition: plan Markdown + named checks + workflow
+ * suspend/approve + bounded handoff. Not a second agent/workflow engine.
+ */
+import type { OwnershipScope, SecretRedactor } from "@arnilo/prism";
+import { type WorkflowCheckpointAdapter, type WorkflowEvent, type WorkflowResumeValidator, type WorkflowRunResult } from "@arnilo/prism-workflows";
+import { type CodingCheckpointMetadata, type CodingCheckSummary, type CodingHandoffSummary } from "./coding-checkpoint.js";
+export declare const CODING_GOAL_VERIFY_WORKFLOW_ID: "coding-goal-verify";
+export declare const CODING_GOAL_VERIFY_REVISION: "1";
+export declare const CODING_GOAL_VERIFY_SUSPEND_REASON: "approve-coding-goal-verify";
+export declare class CodingGoalVerifyError extends Error {
+    readonly code = "ERR_PRISM_CODING_GOAL_VERIFY";
+    constructor(message: string);
+}
+export interface CodingGoalVerifyApproval {
+    /** Host validator; required — helper fails closed without it. */
+    readonly validateResume: WorkflowResumeValidator;
+    readonly reason?: string;
+}
+export interface RunCodingGoalVerifyOptions {
+    readonly goal: string;
+    readonly cwd: string;
+    readonly taskId?: string;
+    readonly title?: string;
+    readonly baseBranch?: string;
+    readonly branch?: string;
+    /** Named checks to execute via `runCheck` (host-declared; no free-form shell). */
+    readonly checks: readonly string[];
+    readonly runCheck: (name: string) => Promise<CodingCheckSummary>;
+    /** Host-owned bounded handoff; required before completion. */
+    readonly buildHandoff: (input: {
+        readonly coding: CodingCheckpointMetadata;
+        readonly checks: readonly CodingCheckSummary[];
+    }) => Promise<CodingHandoffSummary>;
+    readonly approval: CodingGoalVerifyApproval;
+    readonly checkpoints: WorkflowCheckpointAdapter;
+    readonly ownership?: OwnershipScope;
+    readonly redactor?: SecretRedactor;
+    readonly signal?: AbortSignal;
+    readonly onEvent?: (event: WorkflowEvent) => void;
+    /** Second call after suspension — mirrors workflow resume. */
+    readonly resume?: {
+        readonly runId: string;
+        readonly decision: "approve" | "deny";
+        readonly expectedVersion: number;
+        readonly input?: unknown;
+    };
+}
+/** Build the durable DAG used by `runCodingGoalVerify` (exported for hosts that want the definition alone). */
+export declare function createCodingGoalVerifyWorkflow(options: {
+    readonly goal: string;
+    readonly cwd: string;
+    readonly taskId: string;
+    readonly title: string;
+    readonly baseBranch: string;
+    readonly branch: string;
+    readonly checks: readonly string[];
+    readonly runCheck: (name: string) => Promise<CodingCheckSummary>;
+    readonly buildHandoff: RunCodingGoalVerifyOptions["buildHandoff"];
+    readonly suspendReason: string;
+}): import("@arnilo/prism-workflows").WorkflowDefinition;
+/**
+ * Run (or resume) a thin goal→verify coding composition.
+ * Fails closed when `approval` / `approval.validateResume` is missing.
+ */
+export declare function runCodingGoalVerify(options: RunCodingGoalVerifyOptions): Promise<WorkflowRunResult>;