@bjoernrochel/sevro 0.1.0-rc.1

package/src/hosts/claude-nested-skills.ts

@@ -0,0 +1,218 @@
+import { lstat, readFile, readdir, realpath } from "node:fs/promises";
+import { join } from "node:path";
+
+type Entry = Record<string, unknown>;
+const MAX_BYTES = 8 * 1024 * 1024;
+const MAX_AGENTS = 64;
+const MAX_SKILLS = 128;
+
+function record(value: unknown): value is Entry {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function label(value: unknown): value is string {
+  return typeof value === "string" && /^[A-Za-z0-9_.:-]{1,256}$/.test(value);
+}
+
+function identity(value: unknown): value is string {
+  return typeof value === "string" && /^[A-Za-z0-9_-]{1,128}$/.test(value);
+}
+
+function blocks(entry: Entry): Entry[] {
+  const content = record(entry.message) ? entry.message.content : null;
+  return Array.isArray(content) ? content.filter(record) : [];
+}
+
+function entries(text: string): Entry[] {
+  return text
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((line) => {
+      const parsed: unknown = JSON.parse(line);
+      if (!record(parsed)) throw new Error("invalid Claude session entry");
+      return parsed;
+    });
+}
+
+async function readSession(path: string): Promise<string> {
+  const file = await lstat(path);
+  if (!file.isFile() || file.isSymbolicLink() || file.size > MAX_BYTES)
+    throw new Error("Claude session file is unavailable");
+  return readFile(path, "utf8");
+}
+
+type NestedSkill = {
+  ancestorToolUseId: string;
+  skill: string;
+  invocation: string;
+};
+
+type State = {
+  sessionId: string;
+  projectDir: string;
+  seen: Set<string>;
+  calls: NestedSkill[];
+};
+
+async function sidecarChild(
+  state: State,
+  toolUseId: string,
+  parentAgentId: string | null,
+): Promise<string> {
+  const directory = join(state.projectDir, state.sessionId, "subagents");
+  const names = (await readdir(directory)).filter((name) =>
+    /^agent-[A-Za-z0-9_-]+\.meta\.json$/.test(name),
+  );
+  if (names.length > MAX_AGENTS) throw new Error("excessive Claude agents");
+  const matches: string[] = [];
+  for (const name of names) {
+    const metadata: unknown = JSON.parse(
+      await readSession(join(directory, name)),
+    );
+    if (
+      record(metadata) &&
+      metadata.toolUseId === toolUseId &&
+      (metadata.parentAgentId ?? null) === parentAgentId
+    )
+      matches.push(name.slice(6, -10));
+  }
+  if (matches.length !== 1 || !identity(matches[0]))
+    throw new Error("Claude child identity is unavailable");
+  return matches[0]!;
+}
+
+async function childId(
+  entry: Entry,
+  state: State,
+  toolUseId: string,
+  parentAgentId: string | null,
+): Promise<string> {
+  const result = record(entry.toolUseResult) ? entry.toolUseResult : null;
+  if (result) {
+    if (result.status !== "completed" || !identity(result.agentId))
+      throw new Error("Claude child did not complete");
+    return result.agentId;
+  }
+  return sidecarChild(state, toolUseId, parentAgentId);
+}
+
+async function childSession(state: State, agentId: string) {
+  const directory = join(state.projectDir, state.sessionId, "subagents");
+  const path = join(directory, `agent-${agentId}.jsonl`);
+  if ((await realpath(path)) !== path)
+    throw new Error("Claude child session is redirected");
+  return readSession(path);
+}
+
+function skillCall(block: Entry, ancestorToolUseId: string | null) {
+  const invocation = record(block.input) ? block.input.skill : null;
+  if (!label(invocation)) throw new Error("invalid Claude Skill call");
+  return ancestorToolUseId
+    ? {
+        ancestorToolUseId,
+        skill: invocation.split(":").at(-1)!,
+        invocation,
+      }
+    : null;
+}
+
+async function visit(
+  text: string,
+  state: State,
+  agentId: string | null,
+  ancestorToolUseId: string | null,
+): Promise<void> {
+  const pending = new Set<string>();
+  for (const entry of entries(text)) {
+    if (entry.type !== "assistant" && entry.type !== "user") continue;
+    if (
+      entry.sessionId !== state.sessionId ||
+      (entry.agentId ?? null) !== agentId
+    )
+      throw new Error("Claude session identity mismatch");
+    for (const block of blocks(entry)) {
+      if (entry.type === "assistant" && block.type === "tool_use") {
+        if (block.name === "Skill") {
+          const call = skillCall(block, ancestorToolUseId);
+          if (call) state.calls.push(call);
+          if (state.calls.length > MAX_SKILLS)
+            throw new Error("excessive Claude Skill calls");
+        }
+        if (block.name === "Agent" || block.name === "Task") {
+          if (!identity(block.id) || pending.has(block.id))
+            throw new Error("invalid Claude Agent call");
+          pending.add(block.id);
+        }
+      }
+      if (
+        entry.type === "user" &&
+        block.type === "tool_result" &&
+        identity(block.tool_use_id) &&
+        pending.has(block.tool_use_id)
+      ) {
+        if (block.is_error === true)
+          throw new Error("Claude child call failed");
+        const child = await childId(entry, state, block.tool_use_id, agentId);
+        if (state.seen.has(child) || state.seen.size >= MAX_AGENTS)
+          throw new Error("repeated Claude child");
+        state.seen.add(child);
+        await visit(
+          await childSession(state, child),
+          state,
+          child,
+          ancestorToolUseId ?? block.tool_use_id,
+        );
+        pending.delete(block.tool_use_id);
+      }
+    }
+  }
+  if (pending.size) throw new Error("incomplete Claude Agent graph");
+}
+
+export async function claudeNestedSkillsObservation(
+  stream: string,
+  configRoot: string,
+  workspace: string,
+) {
+  const unavailable = {
+    id: "sevro.claude.nested-skills" as const,
+    completeness: "partial" as const,
+    data: { method: "native_session_graph", calls: [] as NestedSkill[] },
+  };
+  try {
+    const sessions = [
+      ...new Set(
+        entries(stream)
+          .filter((entry) => entry.type === "result")
+          .map((entry) => entry.session_id),
+      ),
+    ];
+    if (sessions.length !== 1 || !identity(sessions[0])) return unavailable;
+    const canonicalWorkspace = await realpath(workspace);
+    const canonicalConfigRoot = await realpath(configRoot);
+    const projectDir = join(
+      canonicalConfigRoot,
+      "projects",
+      canonicalWorkspace.replace(/[^A-Za-z0-9]/g, "-"),
+    );
+    const state: State = {
+      sessionId: sessions[0],
+      projectDir,
+      seen: new Set(),
+      calls: [],
+    };
+    await visit(
+      await readSession(join(projectDir, `${state.sessionId}.jsonl`)),
+      state,
+      null,
+      null,
+    );
+    return {
+      id: "sevro.claude.nested-skills" as const,
+      completeness: "complete" as const,
+      data: { method: "native_session_graph", calls: state.calls },
+    };
+  } catch {
+    return unavailable;
+  }
+}

package/src/hosts/claude-repository-invocation.ts

@@ -0,0 +1,239 @@
+import { lstat, readFile, realpath } from "node:fs/promises";
+import { join } from "node:path";
+import type { HostAdapter } from "../engine";
+import type { ClaudeToolCallsObservation } from "./claude-tool-calls";
+
+type Entry = Record<string, unknown>;
+export interface ClaudeRepositoryInvocation {
+  skillName: string;
+  skillDir: string;
+  skillText: string;
+  prompt: string;
+}
+
+function record(value: unknown): value is Entry {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function entries(text: string): Entry[] {
+  return text
+    .split(/\r?\n/)
+    .filter((line) => line.trim())
+    .map((line) => {
+      const value: unknown = JSON.parse(line);
+      if (!record(value)) throw new Error("invalid Claude session entry");
+      return value;
+    });
+}
+
+function content(entry: Entry): string {
+  const blocks = record(entry.message) ? entry.message.content : null;
+  if (typeof blocks === "string") return blocks;
+  if (!Array.isArray(blocks)) return "";
+  return blocks
+    .filter(record)
+    .filter((block) => block.type === "text")
+    .map((block) => (typeof block.text === "string" ? block.text : ""))
+    .join("\n");
+}
+
+/** Validate the native project mount before candidate execution. */
+export async function verifyClaudeRepositoryInvocation(
+  request: Parameters<HostAdapter["run"]>[0],
+): Promise<ClaudeRepositoryInvocation> {
+  const selected = request.explicitSkillInvocation;
+  if (!selected || selected.scope !== "repository")
+    throw new Error("Claude repository invocation is not declared");
+  const { skillName, token } = selected;
+  if (
+    !/^[A-Za-z0-9._-]+$/.test(skillName) ||
+    [".", ".."].includes(skillName) ||
+    token !== `/${skillName}` ||
+    request.prompt.split(token).length - 1 !== 1 ||
+    (request.prompt !== token &&
+      !request.prompt.startsWith(token + " ") &&
+      !request.prompt.startsWith(token + "\n"))
+  )
+    throw new Error("invalid Claude repository skill invocation");
+  let path = await realpath(request.workspace);
+  for (const [index, part] of [
+    ".claude",
+    "skills",
+    skillName,
+    "SKILL.md",
+  ].entries()) {
+    path = join(path, part);
+    const entry = await lstat(path).catch(() => null);
+    if (
+      !entry ||
+      entry.isSymbolicLink() ||
+      (index === 3
+        ? !entry.isFile() || entry.size > 1024 * 1024
+        : !entry.isDirectory())
+    )
+      throw new Error(
+        "invoked Claude repository skill is unavailable or unsafe",
+      );
+  }
+  return {
+    skillName,
+    skillDir: join(path, ".."),
+    skillText: await readFile(path, "utf8"),
+    prompt: request.prompt,
+  };
+}
+
+/** Match one exact command and complete body before the assistant starts. */
+export function matchClaudeRepositoryInvocation(
+  input: ClaudeRepositoryInvocation & {
+    transcript: string;
+    sessionId: string;
+  },
+): { accepted: boolean | null; reason: string } {
+  let native: Entry[];
+  try {
+    native = entries(input.transcript);
+  } catch {
+    return { accepted: null, reason: "malformed native session" };
+  }
+  const firstAssistant = native.findIndex(
+    (entry) => entry.type === "assistant",
+  );
+  if (firstAssistant < 0)
+    return { accepted: null, reason: "missing assistant turn" };
+  const assistant = native[firstAssistant]!;
+  if (assistant.sessionId !== input.sessionId || assistant.isSidechain === true)
+    return { accepted: false, reason: "assistant session differs" };
+  const before = native.slice(0, firstAssistant);
+  const token = `/${input.skillName}`;
+  if (
+    input.prompt !== token &&
+    !input.prompt.startsWith(token + " ") &&
+    !input.prompt.startsWith(token + "\n")
+  )
+    return { accepted: false, reason: "prompt differs from mounted command" };
+  const args = input.prompt.slice(token.length).trim();
+  const command =
+    `<command-message>${input.skillName}</command-message>\n<command-name>${token}</command-name>` +
+    (args ? `\n<command-args>${args}</command-args>` : "");
+  const commands = before.filter(
+    (entry) =>
+      entry.type === "user" &&
+      content(entry).includes(`<command-name>${token}</command-name>`),
+  );
+  if (commands.length !== 1)
+    return { accepted: false, reason: "missing or duplicate native command" };
+  const called = commands[0]!;
+  if (
+    called.sessionId !== input.sessionId ||
+    called.isMeta === true ||
+    called.isSidechain === true ||
+    content(called) !== command
+  )
+    return { accepted: false, reason: "command session or arguments differ" };
+  const body = input.skillText
+    .replace(/^---\r?\n[\s\S]*?\r?\n---\r?\n/, "")
+    .trim();
+  if (!body) return { accepted: null, reason: "empty mounted body" };
+  const prefix = `Base directory for this skill: ${input.skillDir}\n\n${body}`;
+  const expanded = before.filter(
+    (entry) =>
+      entry.type === "user" &&
+      (content(entry) === prefix || content(entry).startsWith(prefix + "\n")),
+  );
+  if (expanded.length !== 1)
+    return {
+      accepted: false,
+      reason: "missing, partial, or duplicate mounted body",
+    };
+  const loaded = expanded[0]!;
+  if (
+    loaded.sessionId !== input.sessionId ||
+    loaded.isMeta !== true ||
+    loaded.isSidechain === true ||
+    before.indexOf(loaded) <= before.indexOf(called)
+  )
+    return { accepted: false, reason: "mounted body is uncorrelated" };
+  return {
+    accepted: true,
+    reason: "native command and complete mounted body matched",
+  };
+}
+
+/** Read only the completed bound native session; retain no arguments or body. */
+export async function claudeRepositoryInvocationObservation(input: {
+  invocation: ClaudeRepositoryInvocation;
+  stream: string;
+  configRoot: string;
+  workspace: string;
+  tools: ClaudeToolCallsObservation;
+}) {
+  let receipt: { accepted: boolean | null; reason: string } = {
+    accepted: null,
+    reason: "native session evidence unavailable",
+  };
+  try {
+    const sessions = [
+      ...new Set(
+        entries(input.stream)
+          .filter(
+            (entry) =>
+              entry.type === "result" ||
+              (entry.type === "system" && entry.subtype === "init"),
+          )
+          .map((entry) => entry.session_id),
+      ),
+    ];
+    if (
+      sessions.length === 1 &&
+      typeof sessions[0] === "string" &&
+      /^[A-Za-z0-9_-]{1,128}$/.test(sessions[0])
+    ) {
+      const workspace = await realpath(input.workspace);
+      const path = join(
+        await realpath(input.configRoot),
+        "projects",
+        workspace.replace(/[^A-Za-z0-9]/g, "-"),
+        `${sessions[0]}.jsonl`,
+      );
+      const entry = await lstat(path);
+      if (
+        entry.isFile() &&
+        !entry.isSymbolicLink() &&
+        entry.size <= 8 * 1024 * 1024 &&
+        (await realpath(path)) === path
+      ) {
+        receipt = matchClaudeRepositoryInvocation({
+          ...input.invocation,
+          sessionId: sessions[0],
+          transcript: await readFile(path, "utf8"),
+        });
+      }
+    }
+  } catch {
+    /* Unavailable or malformed native evidence stays partial. */
+  }
+  const observed = input.tools.data.calls
+    .filter((call) => call.name === "Skill")
+    .map((call) => call.skill);
+  const observedSkills = [
+    ...new Set([
+      ...(receipt.accepted === true ? [input.invocation.skillName] : []),
+      ...observed,
+    ]),
+  ];
+  return {
+    id: "sevro.claude.repository-invocation" as const,
+    completeness:
+      receipt.accepted === true && input.tools.completeness === "complete"
+        ? ("complete" as const)
+        : ("partial" as const),
+    data: {
+      method: "native_repository_command",
+      ...receipt,
+      skill: input.invocation.skillName,
+      primarySkill: observedSkills[0] ?? null,
+      observedSkills,
+    },
+  };
+}

package/src/hosts/claude-settings.ts

@@ -0,0 +1,50 @@
+import { isAbsolute } from "node:path";
+
+function absoluteRule(root: string, tool: "Read" | "Edit"): string {
+  if (!isAbsolute(root) || /[\r\n()]/.test(root))
+    throw new Error("Claude protected path is invalid");
+  return `${tool}(/${root}/**)`;
+}
+
+/** Keep agent tools away from the CLI's private state while core auth works. */
+export function claudeHostSettings(
+  privateRoot: string,
+  credentialFile: string,
+  pluginRoots: string[] = [],
+  protectedRoots: string[] = [],
+): Record<string, unknown> {
+  if (
+    !isAbsolute(privateRoot) ||
+    !isAbsolute(credentialFile) ||
+    !credentialFile.startsWith(`${privateRoot}/`) ||
+    [...pluginRoots, ...protectedRoots].some(
+      (root) => !isAbsolute(root) || /[\r\n()]/.test(root),
+    )
+  )
+    throw new Error("Claude private state paths are invalid");
+  return {
+    disableAllHooks: true,
+    sandbox: {
+      enabled: true,
+      allowUnsandboxedCommands: false,
+      failIfUnavailable: true,
+      filesystem: {
+        denyRead: [privateRoot, ...protectedRoots],
+        denyWrite: [privateRoot, ...pluginRoots, ...protectedRoots],
+      },
+      credentials: {
+        files: [{ path: credentialFile, mode: "deny" }],
+      },
+    },
+    permissions: {
+      allow: ["Bash", "Read", "Edit", "Skill", "Agent"],
+      deny: [
+        ...[privateRoot, ...protectedRoots].flatMap((root) => [
+          absoluteRule(root, "Read"),
+          absoluteRule(root, "Edit"),
+        ]),
+        ...pluginRoots.map((root) => absoluteRule(root, "Edit")),
+      ],
+    },
+  };
+}

package/src/hosts/claude-tool-calls.ts

@@ -0,0 +1,159 @@
+import { createHash } from "node:crypto";
+import { summarizeClaudeEvents } from "./claude-events";
+
+const MAX_RETAINED_CALLS = 128;
+type Entry = Record<string, unknown>;
+
+function record(value: unknown): value is Entry {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+
+function label(value: unknown, max = 256): string | null {
+  return typeof value === "string" &&
+    value.length >= 1 &&
+    value.length <= max &&
+    /^[A-Za-z0-9_.:-]+$/.test(value)
+    ? value
+    : null;
+}
+
+interface SkillCall {
+  ordinal: number;
+  actor: "parent" | "nested";
+  parentToolUseId: string | null;
+  name: "Skill";
+  skill: string;
+  invocation: string;
+}
+
+interface AgentCall {
+  ordinal: number;
+  actor: "parent" | "nested";
+  parentToolUseId: string | null;
+  name: "Agent";
+  toolUseId: string | null;
+  subagentType: string | null;
+  runInBackground: boolean | null;
+  model: string | null;
+  promptSha256: string | null;
+  promptFirstLineSha256: string | null;
+}
+
+export interface ClaudeToolCallsObservation {
+  id: "sevro.claude.tool-calls";
+  completeness: "complete" | "partial";
+  data: {
+    method: "stream_tool_calls";
+    calls: Array<SkillCall | AgentCall>;
+    truncated: boolean;
+  };
+}
+
+/** Retain ordered host call metadata, never tool prompts or results. */
+export function claudeToolCallsObservation(
+  stream: string,
+  exitCode: number,
+): ClaudeToolCallsObservation {
+  const summary = summarizeClaudeEvents(stream, exitCode);
+  const calls: Array<SkillCall | AgentCall> = [];
+  let malformed = false;
+  let truncated = false;
+  let ordinal = 0;
+  for (const line of stream.split("\n")) {
+    if (!line.trim()) continue;
+    let event: unknown;
+    try {
+      event = JSON.parse(line);
+    } catch {
+      malformed = true;
+      continue;
+    }
+    if (!record(event) || event.type !== "assistant") continue;
+    const blocks = record(event.message) ? event.message.content : null;
+    if (!Array.isArray(blocks)) {
+      malformed = true;
+      continue;
+    }
+    const parentToolUseId = label(event.parent_tool_use_id, 128);
+    const actor = parentToolUseId ? "nested" : "parent";
+    if (
+      event.parent_tool_use_id !== undefined &&
+      event.parent_tool_use_id !== null &&
+      actor === "parent"
+    )
+      malformed = true;
+    for (const value of blocks) {
+      if (!record(value) || value.type !== "tool_use") continue;
+      ordinal++;
+      if (!["Skill", "Agent", "Task"].includes(String(value.name))) continue;
+      if (calls.length >= MAX_RETAINED_CALLS) {
+        truncated = true;
+        break;
+      }
+      const input = record(value.input) ? value.input : null;
+      if (value.name === "Skill") {
+        const invocation = label(input?.skill);
+        if (!invocation) {
+          malformed = true;
+          continue;
+        }
+        calls.push({
+          ordinal,
+          actor,
+          parentToolUseId,
+          name: "Skill",
+          skill: invocation.split(":").at(-1)!,
+          invocation,
+        });
+        continue;
+      }
+      const toolUseId = label(value.id, 128);
+      const subagentType = label(input?.subagent_type ?? input?.subagentType);
+      const runInBackground =
+        typeof input?.run_in_background === "boolean"
+          ? input.run_in_background
+          : null;
+      const model = input?.model === undefined ? null : label(input.model, 128);
+      const boundedPrompt =
+        typeof input?.prompt === "string" &&
+        Buffer.byteLength(input.prompt, "utf8") <= 1024 * 1024
+          ? input.prompt
+          : null;
+      const promptSha256 = boundedPrompt
+        ? createHash("sha256").update(boundedPrompt).digest("hex")
+        : null;
+      const promptFirstLineSha256 = boundedPrompt
+        ? createHash("sha256")
+            .update(boundedPrompt.split(/\r?\n/, 1)[0]!)
+            .digest("hex")
+        : null;
+      if (
+        !toolUseId ||
+        !subagentType ||
+        runInBackground === null ||
+        (input?.model !== undefined && !model) ||
+        !promptSha256
+      )
+        malformed = true;
+      calls.push({
+        ordinal,
+        actor,
+        parentToolUseId,
+        name: "Agent",
+        toolUseId,
+        subagentType,
+        runInBackground,
+        model,
+        promptSha256,
+        promptFirstLineSha256,
+      });
+    }
+    if (truncated) break;
+  }
+  return {
+    id: "sevro.claude.tool-calls",
+    completeness:
+      summary.complete && !malformed && !truncated ? "complete" : "partial",
+    data: { method: "stream_tool_calls", calls, truncated },
+  };
+}