@bunshin-cc/bunshin 0.1.2 → 0.1.3

package/dist/bin.js

@@ -405,6 +405,7 @@ var init_store = __esm({
 var sync_exports = {};
 __export(sync_exports, {
   canSync: () => canSync,
+  mothershipLookup: () => mothershipLookup,
   mothershipRecall: () => mothershipRecall,
   pendingConflictQuestion: () => pendingConflictQuestion,
   resolveConflict: () => resolveConflict,
@@ -440,6 +441,14 @@ async function mothershipRecall(config, req, timeoutMs = 8e3) {
     return null;
   }
 }
+async function mothershipLookup(config, ids, timeoutMs = 8e3) {
+  if (!canSync(config) || !ids.length) return null;
+  try {
+    return await api(config, "POST", "/lessons/lookup", { ids }, timeoutMs);
+  } catch {
+    return null;
+  }
+}
 async function runSync(store) {
   const config = store.config();
   const result = { pushedLessons: 0, pushedTraces: 0, pulledConflicts: 0, errors: [] };
@@ -650,6 +659,7 @@ async function askCodexCli(opts) {
   const outFile = path4.join(os.tmpdir(), `bunshin-codex-${process.pid}-${Date.now()}.txt`);
   const args = ["exec", "--skip-git-repo-check", "--ephemeral", "-s", "read-only", "-o", outFile];
   if (opts.model) args.push("-m", opts.model);
+  if (opts.effort) args.push("-c", `model_reasoning_effort="${opts.effort}"`);
   args.push("-");
   const prompt = `${opts.system}${jsonOnlyInstruction(opts.schema)}
 
@@ -1977,10 +1987,11 @@ function redact(text) {
       if (name === "email") {
         return /^(?:no[._-]?reply|do[._-]?not[._-]?reply)@|@example\./i.test(match) ? match : "[REDACTED:email]";
       }
-      if (name === "bearer" || name === "assigned-secret") {
+      if (name === "bearer" || name === "assigned-secret" || name === "json-secret") {
         const key = String(groups[0] ?? "");
         const value = String(groups[1] ?? "");
         if (PLACEHOLDER_RE.test(value)) return match;
+        if (name === "json-secret") return `${JSON.stringify(key)}:"[REDACTED:json-secret]"`;
         return `${key}=[REDACTED:${name}]`;
       }
       return `[REDACTED:${name}]`;
@@ -1993,6 +2004,7 @@ var init_redact2 = __esm({
   "src/redact.ts"() {
     "use strict";
     PATTERNS = [
+      ["bunshin-key", /\bbsk_[A-Za-z0-9]{8}_[A-Za-z0-9]{32}\b/g],
       ["aws-key", /\b(?:AKIA|ASIA|AGPA|AIDA|AROA|ANPA)[0-9A-Z]{16}\b/g],
       ["github-pat", /\bgh[pousr]_[A-Za-z0-9]{20,}\b/g],
       ["anthropic-key", /\bsk-ant-[A-Za-z0-9_-]{20,}\b/g],
@@ -2007,6 +2019,7 @@ var init_redact2 = __esm({
         "assigned-secret",
         /\b([A-Za-z0-9_.-]*(?:secret|passwd|password|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|session[_-]?token)[A-Za-z0-9_.-]*)\s*[:=]\s*['"]?([^\s'"#,;]{6,})['"]?/gi
       ],
+      ["json-secret", /"([A-Za-z0-9_.-]*(?:secret|passwd|password|api[_-]?key|access[_-]?key|private[_-]?key|client[_-]?secret|auth[_-]?token|session[_-]?token)[A-Za-z0-9_.-]*)"\s*:\s*"([^"\r\n]{6,})"/gi],
       ["card", /\b(?:\d[ -]?){13,19}\b/g],
       ["email", /\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g]
     ];
@@ -2119,18 +2132,26 @@ function summarizeInput(input) {
   }
   return JSON.stringify(obj);
 }
-function digest(facts, { from = 0, maxChars = 6e4, toolResultChars = 600 } = {}) {
+function bounded(text, maxChars) {
+  if (text.length <= maxChars) return text;
+  const marker = "\n[... middle omitted ...]\n";
+  if (maxChars <= marker.length) return text.slice(0, Math.max(0, maxChars));
+  const head = Math.floor((maxChars - marker.length) / 2);
+  return text.slice(0, head) + marker + text.slice(-(maxChars - marker.length - head));
+}
+function digest(facts, { from = 0, maxChars = 6e4, toolResultChars = 6e3 } = {}) {
   const parts = [];
   for (const t of facts.turns.slice(from)) {
+    const text = redact(t.text);
     if (t.role === "user") parts.push(`[USER]
-${truncate(t.text, maxChars)}`);
+${bounded(text, maxChars)}`);
     else if (t.role === "assistant") parts.push(`[ASSISTANT]
-${truncate(t.text, maxChars)}`);
+${bounded(text, maxChars)}`);
     else if (t.tool === "result") parts.push(`[TOOL RESULT${t.isError ? " \u2014 ERROR" : ""}]
-${truncate(t.text, toolResultChars)}`);
-    else parts.push(`[TOOL ${t.tool}] ${truncate(t.text, 400)}`);
+${bounded(text, toolResultChars)}`);
+    else parts.push(`[TOOL ${t.tool}] ${truncate(text, 400)}`);
   }
-  return redact(truncate(parts.join("\n\n"), maxChars));
+  return bounded(parts.join("\n\n"), maxChars);
 }
 function recentContext(file, { turns = 2, maxChars = 6e3 } = {}) {
   const facts = parseTranscript(file);
@@ -2176,27 +2197,53 @@ async function runRecall(store, opts) {
   const rules = new Map(store.listRecallLessons().map((r) => [r.id, r]));
   let degraded;
   if (connected && !opts.offline) {
-    const remote = await mothershipRecall(config, {
-      task,
-      userId: config.userId,
-      role: config.role,
-      orgUnit: config.orgUnit,
-      limit: 8,
-      recentContext: history,
-      dryRun: opts.dryRun
-    }, remaining(8e3));
-    if (remote && (!remote.profile || remote.profile.orgId === config.orgId && remote.profile.userId === config.userId)) {
-      if (remote.profile) profile = remote.profile;
-      for (const lesson of remote.lessons) {
+    const cached = prepareRecall(local.map((lesson) => ({ lesson })), { task, ...profile }, profile).candidates.slice(0, 60).map((candidate) => candidate.lesson);
+    const cachedIds = new Set(cached.map((lesson) => lesson.id));
+    const [remote, lookup] = await Promise.all([
+      mothershipRecall(config, {
+        task,
+        userId: config.userId,
+        role: config.role,
+        orgUnit: config.orgUnit,
+        limit: 8,
+        recentContext: history,
+        dryRun: opts.dryRun
+      }, remaining(8e3)),
+      cached.length ? mothershipLookup(config, [...cachedIds], remaining(8e3)) : null
+    ]);
+    const sameIdentity = (p) => p?.orgId === config.orgId && p.userId === config.userId;
+    const remoteOK = remote && (!remote.profile || sameIdentity(remote.profile));
+    const lookupOK = lookup && sameIdentity(lookup.profile);
+    if (remoteOK || lookupOK) {
+      profile = (remoteOK ? remote.profile : void 0) ?? (lookupOK ? lookup.profile : void 0) ?? profile;
+      byId.clear();
+      const refreshed = /* @__PURE__ */ new Map();
+      if (lookupOK) {
+        const unavailable = new Set(lookup.unavailableIds);
+        for (const lesson of cached) {
+          if (unavailable.has(lesson.id) && lesson.version === 1 && (!config.lastSyncAt || lesson.provenance.createdAt > config.lastSyncAt)) byId.set(lesson.id, lesson);
+        }
+        for (const lesson of lookup.lessons) {
+          if (cachedIds.has(lesson.id) && lesson.provenance.orgId === profile.orgId) refreshed.set(lesson.id, lesson);
+        }
+      } else if (cached.length) {
+        degraded = "local cache refresh unavailable; using current hosted knowledge";
+      }
+      for (const lesson of remoteOK ? remote.lessons : []) {
         if (lesson.provenance.orgId !== profile.orgId) continue;
+        const checked = refreshed.get(lesson.id);
+        if (!checked || lesson.version > checked.version) refreshed.set(lesson.id, lesson);
+      }
+      for (const lesson of refreshed.values()) {
         byId.set(lesson.id, lesson);
         if (!opts.dryRun) store.saveLesson(lesson, { reindex: false });
       }
-      for (const rule of remote.recallLessons) rules.set(rule.id, rule);
+      for (const rule of remoteOK ? remote.recallLessons : []) rules.set(rule.id, rule);
       if (!opts.dryRun) {
-        for (const conflict of remote.pendingConflicts) store.saveConflict(conflict);
-        if (remote.lessons.length) store.rebuildIndex();
+        for (const conflict of remoteOK ? remote.pendingConflicts : []) store.saveConflict(conflict);
+        if (refreshed.size) store.rebuildIndex();
       }
+      if (!remoteOK) degraded = "hosted search unavailable; using refreshed locally authored knowledge";
     } else {
       degraded = "mothership unavailable or identity mismatch; using locally authored knowledge";
     }
@@ -2440,7 +2487,12 @@ async function reflectSession(store, opts) {
   for (const raw of out.lessons) {
     const rejection = workflowRejection(raw, facts, excerpt);
     if (rejection) {
-      store.log("reflect-workflow-rejected", { session: opts.sessionId, title: redact(raw.title), reason: rejection });
+      store.log("reflect-workflow-rejected", {
+        session: opts.sessionId,
+        title: redact(raw.title),
+        reason: rejection,
+        evidence: Array.isArray(raw.verificationEvidence) ? raw.verificationEvidence.filter((quote) => typeof quote === "string").map((quote) => redact(quote).slice(0, 1e3)) : []
+      });
       continue;
     }
     const lesson = store.saveLesson(buildLesson(raw, store, opts), { reindex: false });
@@ -2466,11 +2518,13 @@ function workflowRejection(raw, facts, excerpt) {
   const visible = normalize(excerpt);
   const results = facts.turns.filter((turn) => turn.role === "tool" && turn.tool === "result" && !turn.isError).map((turn) => normalize(turn.text));
   const evidence = raw.verificationEvidence;
-  if (!Array.isArray(evidence) || !evidence.length || evidence.some((quote) => {
-    if (typeof quote !== "string") return true;
+  if (!Array.isArray(evidence) || !evidence.length) return "workflow requires verification quotes from successful tool results";
+  for (const [index, quote] of evidence.entries()) {
+    if (typeof quote !== "string") return `workflow verification quote ${index + 1} is not text`;
     const text = normalize(quote);
-    return !text || !visible.includes(text) || !results.some((result) => result.includes(text));
-  })) return "workflow requires matching verification evidence from successful tool results";
+    if (!text || !results.some((result) => result.includes(text))) return `workflow verification quote ${index + 1} does not match a successful tool result`;
+    if (!visible.includes(text)) return `workflow verification quote ${index + 1} is outside the visible excerpt`;
+  }
 }
 function countFacts(turns) {
   return {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@bunshin-cc/bunshin",
-  "version": "0.1.2",
+  "version": "0.1.3",
   "description": "Shared memory for company AI agents. Connect Codex, Claude Code, or Pi to Bunshin.",
   "type": "module",
   "bin": {