@codespar/cli 0.14.1 → 0.17.0

package/templates/supplier-payments-agent/packages/agent-runtime/test/whatsapp-rules.test.ts

@@ -0,0 +1,174 @@
+/**
+ * The rules of collecting over a conversation, tried and refused.
+ *
+ * Every case here is an ATTEMPT: the message is handed to the channel the way
+ * the runner hands it one, and what is asserted is that nothing left the
+ * process. The backend under the channel is a recorder, so "refused" is not a
+ * claim about a return value — it is the recorder having seen nothing.
+ *
+ * The last case is the one that matters most: the same attempts through a
+ * DIFFERENT backend. The rules live above the backend, so choosing one cannot
+ * be a way around them.
+ */
+import { describe, expect, it } from "vitest";
+import { WhatsAppChannel } from "../src/channels/whatsapp/index.js";
+import { checkOutbound } from "../src/channels/rules.js";
+import type { ChannelBackend, InboundMessage, OutboundBody, SentMessage } from "../src/channels/types.js";
+
+/** A backend that carries nothing and remembers everything it was asked to carry. */
+class Recorder implements ChannelBackend {
+  readonly delivered: Array<{ to: string; body: OutboundBody }> = [];
+  constructor(
+    readonly name = "recorder",
+    readonly live = false,
+    private readonly inbox: InboundMessage[] = [],
+  ) {}
+  async open(): Promise<void> {}
+  async next(): Promise<InboundMessage | undefined> {
+    return this.inbox.shift();
+  }
+  async deliver(to: string, body: OutboundBody): Promise<SentMessage> {
+    this.delivered.push({ to, body });
+    return { id: `rec_${this.delivered.length}`, state: "sent" };
+  }
+  async close(): Promise<void> {}
+}
+
+const CONTACT = "+5511987654321";
+const INSIDE = new Date("2026-09-23T14:00:00-03:00");
+const OUTSIDE = new Date("2026-09-23T22:30:00-03:00");
+const HOURS = { window: "08:00-20:00", timezone: "America/Sao_Paulo" };
+
+function channelAt(now: Date, backend = new Recorder(), openSession = true) {
+  const channel = new WhatsAppChannel({
+    backend,
+    conversation: { contact: CONTACT, subject: "acordo-1042" },
+    now: () => now,
+    hours: HOURS,
+    knownSubjects: ["acordo-1042", "acordo-1077", "acordo-1103"],
+    templates: [{ name: "cobranca_lembrete", language: "pt_BR", description: "a reminder", body: "Oi {{1}}, sobre o acordo." }],
+  });
+  // A session is open because the person wrote; the window is WhatsApp's rule, not ours, and has its own test below.
+  if (openSession) {
+    (channel as unknown as { session: { observeInbound(t: number): void } }).session.observeInbound(Math.floor(now.getTime() / 1000));
+  }
+  return { channel, backend };
+}
+
+describe("the collection rules, tried through the channel", () => {
+  it("sends inside the collection hours", async () => {
+    const { channel, backend } = channelAt(INSIDE);
+    const sent = await channel.say("Oi, Joana! Sobre o pedido #1042.");
+    expect(sent.refused).toBeUndefined();
+    expect(backend.delivered).toHaveLength(1);
+  });
+
+  it("refuses everything outside the collection hours, and the backend never sees it", async () => {
+    const { channel, backend } = channelAt(OUTSIDE);
+    const sent = await channel.say("Oi, Joana! Sobre o pedido #1042.");
+    expect(sent.refused?.rule).toBe("collection_hours");
+    expect(sent.state).toBe("failed");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("refuses a message to any contact but the one the conversation is bound to", () => {
+    const refusal = checkOutbound("+5511900000000", { kind: "text", text: "sobre a sua divida" }, {
+      conversation: { contact: CONTACT, subject: "acordo-1042" },
+      hours: HOURS,
+      now: () => INSIDE,
+    });
+    expect(refusal?.rule).toBe("bound_contact");
+  });
+
+  it("refuses a message that names another debtor's agreement", async () => {
+    const { channel, backend } = channelAt(INSIDE);
+    const sent = await channel.say("O acordo-1077 do Carlos tambem esta em aberto, voces podem combinar.");
+    expect(sent.refused?.rule).toBe("subject_scope");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("refuses a CPF or a CNPJ in a message, formatted or bare", async () => {
+    for (const text of ["confirma o CPF 111.444.777-35?", "o CPF do titular e 11144477735", "CNPJ 12.345.678/0001-95", "CNPJ 12345678000195"]) {
+      const { channel, backend } = channelAt(INSIDE);
+      const sent = await channel.say(text);
+      expect(sent.refused?.rule, text).toBe("no_document");
+      expect(backend.delivered).toHaveLength(0);
+    }
+  });
+
+  it("does NOT read a Pix copy-and-paste or a boleto line as a document", async () => {
+    const { channel, backend } = channelAt(INSIDE);
+    const brcode = "00020126580014br.gov.bcb.pix0136stub-chg_abc5204000053039865802BR5909CODESPAR6009SAO PAULO62070503***6304STUB";
+    const bankLine = "78517596684364082005302425802108566187285620000";
+    expect((await channel.send({ kind: "instrument", instrument: "pix_copy_paste", value: brcode })).refused).toBeUndefined();
+    expect((await channel.send({ kind: "instrument", instrument: "boleto_bank_line", value: bankLine })).refused).toBeUndefined();
+    expect(backend.delivered).toHaveLength(2);
+  });
+
+  it("refuses an empty message", async () => {
+    const { channel } = channelAt(INSIDE);
+    expect((await channel.say("   ")).refused?.rule).toBe("empty_message");
+  });
+
+  it("masks the contact everywhere it is written down", async () => {
+    const { channel } = channelAt(INSIDE);
+    await channel.say("Oi!");
+    for (const line of channel.log()) {
+      expect(line.contact).not.toContain("987654321");
+      expect(line.contact).toContain("****");
+    }
+  });
+
+  it("applies the same rules through a different backend: a backend is not a way around one", async () => {
+    const other = new Recorder("another-backend", true);
+    const { channel, backend } = channelAt(OUTSIDE, other);
+    expect((await channel.say("boa noite, sobre a sua divida")).refused?.rule).toBe("collection_hours");
+    expect((await channelAt(INSIDE, new Recorder("another-backend", true)).channel.say("CPF 11144477735")).refused?.rule).toBe("no_document");
+    expect(backend.delivered).toHaveLength(0);
+  });
+});
+
+describe("WhatsApp's own rule: the 24-hour session window", () => {
+  it("carries a free-form message while the window is open", async () => {
+    const { channel, backend } = channelAt(INSIDE);
+    expect((await channel.say("Oi, Joana!")).refused).toBeUndefined();
+    expect(backend.delivered).toHaveLength(1);
+  });
+
+  it("refuses a free-form message once the window has shut, and says what would carry", async () => {
+    const { channel, backend } = channelAt(INSIDE, new Recorder(), false);
+    const sent = await channel.say("Recebemos, acordo quitado.");
+    expect(sent.refused?.rule).toBe("session_window_closed");
+    expect(sent.refused?.detail).toContain("template");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("carries a declared template with the window shut", async () => {
+    const { channel, backend } = channelAt(INSIDE, new Recorder(), false);
+    const sent = await channel.send({ kind: "template", template: "cobranca_lembrete", language: "pt_BR", variables: ["Joana"] });
+    expect(sent.refused).toBeUndefined();
+    expect(backend.delivered).toHaveLength(1);
+  });
+
+  it("refuses a template the agent never declared: Meta only delivers the ones it approved", async () => {
+    const { channel, backend } = channelAt(INSIDE, new Recorder(), false);
+    const sent = await channel.send({ kind: "template", template: "nao_registrado", language: "pt_BR", variables: [] });
+    expect(sent.refused?.rule).toBe("template_unknown");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("holds a template to the house rules too: an approved template is not a way past the hours", async () => {
+    const { channel, backend } = channelAt(OUTSIDE, new Recorder(), false);
+    const sent = await channel.send({ kind: "template", template: "cobranca_lembrete", language: "pt_BR", variables: ["Joana"] });
+    expect(sent.refused?.rule).toBe("collection_hours");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("reopens the window when the person writes again", async () => {
+    const backend = new Recorder("recorder", false, [{ id: "in_1", from: CONTACT, text: "oi", timestamp: Math.floor(INSIDE.getTime() / 1000) }]);
+    const { channel } = channelAt(INSIDE, backend, false);
+    expect((await channel.say("antes")).refused?.rule).toBe("session_window_closed");
+    await channel.next();
+    expect((await channel.say("depois")).refused).toBeUndefined();
+  });
+});

package/templates/supplier-payments-agent/packages/agent-runtime/test/whatsapp-session.test.ts

@@ -0,0 +1,135 @@
+/**
+ * The 24-hour window, read back and reasoned about.
+ *
+ * Two things are under test and they are the two halves of issue #25. A
+ * conversation that a later process comes back to has to know where its
+ * window stood, and the only honest source for that is the PROVIDER's
+ * timestamp in the record — not the run's own clock, which belongs to a
+ * machine WhatsApp never consulted. And a message that may only go as a
+ * template has to be held to what the agent actually declared, because a
+ * template Meta never approved is not a message, it is a 4xx.
+ *
+ * None of it needs the emulator: every refusal here happens above the
+ * backend, which is the whole claim `channels/` makes.
+ */
+import { describe, expect, it } from "vitest";
+import { templateArity, type WhatsAppTemplate } from "@codespar/agent-core";
+import { WhatsAppChannel } from "../src/channels/whatsapp/index.js";
+import { SessionWindow, sessionStateFromChannelLog, SESSION_WINDOW_SECONDS } from "../src/channels/whatsapp/session.js";
+import type { ChannelBackend, InboundMessage, OutboundBody, SentMessage } from "../src/channels/types.js";
+
+class Recorder implements ChannelBackend {
+  readonly name = "recorder";
+  readonly live = false;
+  readonly delivered: OutboundBody[] = [];
+  async open(): Promise<void> {}
+  async next(): Promise<InboundMessage | undefined> {
+    return undefined;
+  }
+  async deliver(_to: string, body: OutboundBody): Promise<SentMessage> {
+    this.delivered.push(body);
+    return { id: `rec_${this.delivered.length}`, state: "sent" };
+  }
+  async close(): Promise<void> {}
+}
+
+const CONTACT = "+5511987654321";
+const TUESDAY = new Date("2026-09-23T14:00:00-03:00");
+const FRIDAY = new Date("2026-09-25T14:00:00-03:00");
+const QUITADO: WhatsAppTemplate = { name: "acordo_quitado", language: "pt_BR", description: "paid", body: "Recebemos o pagamento do {{1}}." };
+
+function channel(now: Date, lastInboundAt?: number, backend = new Recorder()) {
+  const c = new WhatsAppChannel({
+    backend,
+    conversation: { contact: CONTACT, subject: "acordo-1042" },
+    now: () => now,
+    templates: [QUITADO],
+    ...(lastInboundAt !== undefined ? { session: { lastInboundAt } } : {}),
+  });
+  return { channel: c, backend };
+}
+
+describe("where the window stood, read back from the record", () => {
+  it("takes the provider's timestamp and never the line's own `at`", () => {
+    const state = sessionStateFromChannelLog([
+      { direction: "in", at: "2020-01-01T00:00:00.000Z", provider_timestamp: 1790182801 },
+      { direction: "out", at: "2026-09-23T17:00:10.000Z" },
+      { direction: "in", at: "2020-01-01T00:00:00.000Z", provider_timestamp: 1790182821 },
+    ]);
+    expect(state.lastInboundAt).toBe(1790182821);
+  });
+
+  it("yields nothing from a log whose inbound lines carry no provider timestamp, and the window then reads as shut", () => {
+    // A bundle written before the timestamp was recorded. Shut is the safe
+    // direction: a template is deliverable in both halves of the rule.
+    const state = sessionStateFromChannelLog([{ direction: "in", at: "2026-09-23T17:00:00.000Z", text: "oi" }]);
+    expect(state.lastInboundAt).toBeUndefined();
+    expect(new SessionWindow([], state).open(TUESDAY)).toBe(false);
+  });
+
+  it("ignores outbound lines: the window is opened by the PERSON writing, not by us", () => {
+    expect(sessionStateFromChannelLog([{ direction: "out", provider_timestamp: 1790182801 }]).lastInboundAt).toBeUndefined();
+  });
+});
+
+describe("a conversation a later process comes back to", () => {
+  it("writes freely when the restored window is still open", async () => {
+    const { channel: c, backend } = channel(TUESDAY, Math.floor(TUESDAY.getTime() / 1000) - 3600);
+    expect(c.sessionOpen).toBe(true);
+    expect(c.sessionRemainingSeconds).toBe(SESSION_WINDOW_SECONDS - 3600);
+    const sent = await c.say("Recebemos, acordo quitado.");
+    expect(sent.refused).toBeUndefined();
+    expect(backend.delivered).toHaveLength(1);
+  });
+
+  it("refuses free text once the restored window has shut, which is the case the poll exists for", async () => {
+    const { channel: c, backend } = channel(FRIDAY, Math.floor(TUESDAY.getTime() / 1000));
+    expect(c.sessionOpen).toBe(false);
+    const sent = await c.say("Recebemos, acordo quitado.");
+    expect(sent.refused?.rule).toBe("session_window_closed");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("carries the declared template in the same breath, with the language the registry holds", async () => {
+    const { channel: c, backend } = channel(FRIDAY, Math.floor(TUESDAY.getTime() / 1000));
+    const declared = c.declaredTemplate("acordo_quitado");
+    expect(declared?.language).toBe("pt_BR");
+    const sent = await c.send({ kind: "template", template: declared!.name, language: declared!.language, variables: ["acordo-1042"] });
+    expect(sent.refused).toBeUndefined();
+    expect(backend.delivered).toEqual([{ kind: "template", template: "acordo_quitado", language: "pt_BR", variables: ["acordo-1042"] }]);
+  });
+
+  it("reads as shut when nothing restored it: a process with no record of the conversation assumes the worst", () => {
+    expect(channel(TUESDAY).channel.sessionOpen).toBe(false);
+  });
+});
+
+describe("the local registry refuses what Meta would refuse", () => {
+  it("a name the agent never declared", async () => {
+    const { channel: c, backend } = channel(FRIDAY, Math.floor(TUESDAY.getTime() / 1000));
+    const sent = await c.send({ kind: "template", template: "nao_registrado", language: "pt_BR", variables: [] });
+    expect(sent.refused?.rule).toBe("template_unknown");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("a language the template was not registered in: an approved template does not exist in another", async () => {
+    const { channel: c, backend } = channel(FRIDAY, Math.floor(TUESDAY.getTime() / 1000));
+    const sent = await c.send({ kind: "template", template: "acordo_quitado", language: "es_MX", variables: ["acordo-1042"] });
+    expect(sent.refused?.rule).toBe("template_language_unknown");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("a variable count the body has no placeholders for", async () => {
+    const { channel: c, backend } = channel(FRIDAY, Math.floor(TUESDAY.getTime() / 1000));
+    const sent = await c.send({ kind: "template", template: "acordo_quitado", language: "pt_BR", variables: ["acordo-1042", "a mais"] });
+    expect(sent.refused?.rule).toBe("template_variables_mismatch");
+    expect(sent.refused?.detail).toContain("takes 1 variable(s)");
+    expect(backend.delivered).toHaveLength(0);
+  });
+
+  it("counts the placeholders the way Meta numbers them", () => {
+    expect(templateArity("nenhuma")).toBe(0);
+    expect(templateArity("Oi {{1}}, sobre o {{2}}.")).toBe(2);
+    expect(templateArity("Oi {{ 1 }}.")).toBe(1);
+  });
+});

package/templates/supplier-payments-agent/packages/agent-runtime/tsconfig.json

@@ -0,0 +1,9 @@
+{
+  "extends": "../../tsconfig.base.json",
+  "compilerOptions": {
+    "rootDir": "."
+  },
+  "include": [
+    "src/**/*.ts"
+  ]
+}

package/templates/supplier-payments-agent/tsconfig.base.json

@@ -0,0 +1,16 @@
+{
+  "compilerOptions": {
+    "target": "ES2022",
+    "module": "NodeNext",
+    "moduleResolution": "NodeNext",
+    "strict": true,
+    "exactOptionalPropertyTypes": true,
+    "noUncheckedIndexedAccess": true,
+    "noImplicitOverride": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "resolveJsonModule": true,
+    "noEmit": true,
+    "types": ["node"]
+  }
+}

package/templates/supplier-payments-agent/vitest.config.ts

@@ -0,0 +1,12 @@
+import { defineConfig } from "vitest/config";
+
+export default defineConfig({
+  test: {
+    include: ["packages/*/test/**/*.test.ts", "agents/*/test/**/*.test.ts", "test/**/*.test.ts"],
+    pool: "forks",
+    maxWorkers: 1,
+    minWorkers: 1,
+    fileParallelism: false,
+    testTimeout: 30000,
+  },
+});

package/templates/bills-agent/agents/bills-agent/channels/terminal/index.ts

@@ -1,108 +0,0 @@
-/**
- * The terminal channel: what `npm start` opens. No account, no server. It
- * shows what the core decided, asks the person when an execution is
- * awaiting approval, and prints where the receipt landed.
- */
-import { createInterface } from "node:readline/promises";
-import { stdin, stderr, stdout } from "node:process";
-import { relative } from "node:path";
-import type { Execution } from "@codespar/agent-core";
-import { formatBRL } from "../../src/bills.js";
-import type { Setup } from "../../src/setup.js";
-
-export interface TerminalOptions {
-  setup: Setup;
-  approver: { id: string; channel: string };
-  /** Non-interactive decision for `--input`: approve, deny, or leave it awaiting. */
-  decision?: "approve" | "deny" | "none";
-  say?: (line: string) => void;
-  ask?: (question: string) => Promise<string>;
-}
-
-export function describeExecution(execution: Execution, setup: Setup): string[] {
-  const lines: string[] = [];
-  lines.push(`  execucao ${execution.id}: ${execution.state}${execution.reason ? ` (${execution.reason})` : ""}`);
-  for (const item of execution.items) lines.push(`    - ${item.beneficiary}: ${formatBRL(item.amount)}${item.description ? ` — ${item.description}` : ""}`);
-  lines.push(`    total (calculado pelo core): ${formatBRL(execution.total)}`);
-  if (execution.escalation) lines.push(`    escalado por: ${execution.escalation.trigger} — ${execution.escalation.detail}`);
-  if (execution.blocking_reasons.length) lines.push(`    bloqueado: ${execution.blocking_reasons.join(", ")} — o mandato nao autoriza; nao ha o que aprovar`);
-  if (execution.detail && execution.state !== "awaiting_approval") lines.push(`    ${execution.detail}`);
-  for (const outcome of execution.outcomes) {
-    if (outcome.receipt_id) lines.push(`    recibo: ${relative(process.cwd(), `${setup.bundle.dir}/receipts/${outcome.receipt_id}.json`)}`);
-  }
-  return lines;
-}
-
-/** Decides an `awaiting_approval` execution and runs an `approved` one. Returns the final execution of this pass. */
-export async function handleExecution(execution: Execution, options: TerminalOptions): Promise<Execution> {
-  const { setup, approver } = options;
-  const say = options.say ?? ((l: string) => stderr.write(l + "\n"));
-  const engine = setup.engine;
-
-  for (const line of describeExecution(execution, setup)) say(line);
-
-  let current = execution;
-  if (current.state === "awaiting_approval") {
-    let decision = options.decision;
-    if (!decision) {
-      if (current.blocking_reasons.length > 0) {
-        say("  (o unico desfecho possivel e negar; aperte Enter)");
-      }
-      const ask = options.ask ?? defaultAsk;
-      const answer = (await ask("  Aprovar este pagamento? [s/N] ")).trim().toLowerCase();
-      decision = answer === "s" || answer === "sim" || answer === "y" || answer === "yes" ? "approve" : "deny";
-    }
-    if (decision === "approve") current = engine.approve(current.id, approver);
-    else if (decision === "deny") current = engine.deny(current.id, approver);
-    else {
-      say("  deixado em awaiting_approval (rode de novo com --approve ou --deny)");
-      return current;
-    }
-    say(`  -> ${current.state}${current.reason ? ` (${current.reason})` : ""}`);
-  }
-
-  if (current.state === "approved") {
-    current = await engine.execute(current.id);
-    say(`  -> ${current.state}${current.reason ? ` (${current.reason})` : ""}`);
-    for (const outcome of current.outcomes) {
-      if (outcome.receipt_id) say(`  recibo: ${relative(process.cwd(), `${setup.bundle.dir}/receipts/${outcome.receipt_id}.json`)}`);
-    }
-    if (current.state === "executing") say("  desfecho desconhecido no trilho; rode `npm run resume` para reconciliar (nunca repita o pagamento)");
-  }
-  return current;
-}
-
-let rl: ReturnType<typeof createInterface> | undefined;
-
-export function defaultAsk(question: string): Promise<string> {
-  rl ??= createInterface({ input: stdin, output: stderr });
-  return rl.question(question);
-}
-
-export function closeTerminal(): void {
-  rl?.close();
-  rl = undefined;
-}
-
-export async function interactive(options: TerminalOptions & { runtime: import("@codespar/agent-core").AgentRuntime }): Promise<void> {
-  const { setup } = options;
-  const say = options.say ?? ((l: string) => stderr.write(l + "\n"));
-  const loop = setup.makeLoop(options.runtime, (execution) => handleExecution(execution, options));
-  say(`bills-agent ${setup.manifest.manifest.version} — approval: ${setup.mode} — trilho: ${setup.railKind} — mandato ${setup.mandate.id}`);
-  say(`run ${setup.runId} — bundle em ${relative(process.cwd(), setup.bundle.dir)}`);
-  say('Diga o que pagar ("pague a escola de outubro"). Ctrl+D ou "sair" encerra.');
-  for (;;) {
-    let text: string;
-    try {
-      text = await defaultAsk("> ");
-    } catch {
-      break;
-    }
-    const trimmed = text.trim();
-    if (!trimmed) continue;
-    if (["sair", "exit", "quit"].includes(trimmed.toLowerCase())) break;
-    const result = await loop.turn(trimmed);
-    stdout.write(result.reply + "\n");
-  }
-  closeTerminal();
-}

package/templates/bills-agent/agents/bills-agent/src/commands/approve.ts

@@ -1,9 +0,0 @@
-/**
- * `npm run approve <execution-id> [--user <id>] [--json]`: decides an
- * execution left in `awaiting_approval` (a `--input` run without
- * `--approve`, a restart). Produces the section 4.2 artifact and runs the
- * execution through the same last gate `npm start` uses.
- */
-import { decideFromCli } from "./decide.js";
-
-await decideFromCli("approve");

package/templates/bills-agent/agents/bills-agent/src/commands/check.ts

@@ -1,13 +0,0 @@
-/**
- * `npm run check [--json]`: the manifest-coherence gate of section 4.3.
- */
-import { stderr, stdout } from "node:process";
-import { checkAgent } from "@codespar/agent-core";
-import { AGENT_DIR } from "../setup.js";
-
-const json = process.argv.includes("--json");
-const report = checkAgent(AGENT_DIR);
-if (json) stdout.write(JSON.stringify(report) + "\n");
-for (const f of report.findings) stderr.write(`${f.level === "error" ? "ERROR" : "warn "} ${f.code}: ${f.message}\n`);
-stderr.write(report.ok ? `check ok: ${report.agent} agrees with its agent.yaml\n` : `check FAILED for ${report.agent ?? "agent"}\n`);
-process.exit(report.ok ? 0 : 1);

package/templates/bills-agent/agents/bills-agent/src/commands/consent.ts

@@ -1,26 +0,0 @@
-/**
- * `npm run consent [--yes]`: runs the partner-surface consent for a new
- * mandate with the test key (the titular authorizes at the keyboard), stores
- * the signed envelope locally and credits the sandbox. Module `embedded-consent`.
- */
-import { resolve } from "node:path";
-import { stderr } from "node:process";
-import { createCodeSparClient, loadMandate } from "@codespar/agent-core";
-import { runEmbeddedConsent } from "../modules/embedded-consent.js";
-import { AGENT_DIR, MANDATE_PATH, readDotEnv } from "../setup.js";
-
-readDotEnv();
-const say = (l: string) => stderr.write(l + "\n");
-const api = createCodeSparClient({ apiKey: process.env["CODESPAR_API_KEY"], baseUrl: process.env["CODESPAR_API_URL"], projectId: process.env["CODESPAR_PROJECT_ID"] });
-const example = loadMandate(resolve(AGENT_DIR, "mandate.example.json"));
-const yes = process.argv.includes("--yes");
-const confirm = async (question: string): Promise<boolean> => {
-  if (yes) return true;
-  const { createInterface } = await import("node:readline/promises");
-  const rl = createInterface({ input: process.stdin, output: process.stderr });
-  const answer = (await rl.question(question)).trim();
-  rl.close();
-  return /^(s|sim|y|yes)$/i.test(answer);
-};
-const mandate = await runEmbeddedConsent({ api, example, mandatePath: MANDATE_PATH, say, confirm });
-say(`mandato ${mandate.id} salvo em .codespar/mandate.json`);

package/templates/bills-agent/agents/bills-agent/src/commands/decide.ts

@@ -1,45 +0,0 @@
-import { relative } from "node:path";
-import { stderr, stdout } from "node:process";
-import { handleExecution } from "../../channels/terminal/index.js";
-import { readDotEnv, setup } from "../setup.js";
-
-export async function decideFromCli(decision: "approve" | "deny"): Promise<never> {
-  const argv = process.argv.slice(2);
-  const json = argv.includes("--json");
-  const user = argv.includes("--user") ? argv[argv.indexOf("--user") + 1] : undefined;
-  const executionId = argv.find((a, i) => !a.startsWith("--") && argv[i - 1] !== "--user");
-  const say = (l: string) => stderr.write(l + "\n");
-  if (!executionId) {
-    say(`usage: npm run ${decision} <execution-id> [--user <id>] [--json]`);
-    process.exit(2);
-  }
-  readDotEnv();
-  const s = setup({ say, runId: `run_${decision}_${Date.now().toString(36)}` });
-  try {
-    const execution = s.engine.get(executionId);
-    if (!execution) {
-      say(`unknown execution ${executionId}`);
-      process.exit(1);
-    }
-    if (execution.state !== "awaiting_approval") {
-      say(`${executionId} is ${execution.state}, not awaiting_approval; nothing to decide`);
-      process.exit(1);
-    }
-    const final = await handleExecution(execution, { setup: s, approver: { id: user ?? "usr_terminal", channel: "terminal" }, decision, say });
-    if (json) {
-      stdout.write(
-        JSON.stringify({
-          execution_id: final.id,
-          state: final.state,
-          reason: final.reason ?? null,
-          approval_id: final.approval_id ?? null,
-          receipt_ids: final.outcomes.filter((o) => o.receipt_id).map((o) => o.receipt_id),
-          bundle_dir: relative(process.cwd(), s.bundle.dir),
-        }) + "\n",
-      );
-    }
-    process.exit(final.state === "executing" ? 3 : 0);
-  } finally {
-    s.close();
-  }
-}

package/templates/bills-agent/agents/bills-agent/src/commands/deny.ts

@@ -1,7 +0,0 @@
-/**
- * `npm run deny <execution-id> [--user <id>] [--json]`: denies an execution
- * left in `awaiting_approval`. Terminal; nothing is sent.
- */
-import { decideFromCli } from "./decide.js";
-
-await decideFromCli("deny");

package/templates/bills-agent/agents/bills-agent/src/commands/eval.ts

@@ -1,37 +0,0 @@
-/**
- * `npm run eval [--json] [--case <name>]`: the adversarial suite of section 9
- * plus every scenario of section 12 in every mode it declares. Runs on the
- * replay provider, with no model and no network. A regression blocks merge.
- */
-import { stderr, stdout } from "node:process";
-import { listAdversarialCases, loadAdversarialCase, runAdversarialCase } from "../adversarial.js";
-import { checkScenario, listScenarios, loadScenario, runScenario } from "../scenarios.js";
-
-const argv = process.argv.slice(2);
-const json = argv.includes("--json");
-const only = argv.includes("--case") ? argv[argv.indexOf("--case") + 1] : undefined;
-const say = (l: string) => stderr.write(l + "\n");
-
-const adversarial = [];
-for (const name of listAdversarialCases()) {
-  if (only && only !== name) continue;
-  const result = await runAdversarialCase(loadAdversarialCase(name));
-  adversarial.push(result);
-  say(`${result.ok ? "ok  " : "FAIL"} adversarial/${name} — ${result.attack} — states ${JSON.stringify(result.states)}${result.failures.length ? ` — ${result.failures.join("; ")}` : ""}`);
-}
-
-const scenarios = [];
-for (const name of listScenarios()) {
-  if (only && only !== name) continue;
-  const scenario = loadScenario(name);
-  for (const mode of scenario.modes) {
-    const check = checkScenario(scenario, await runScenario(scenario, { mode }));
-    scenarios.push({ name, mode, ok: check.ok, failures: check.failures, states: check.run.executions.map((e) => e.state), receipts: check.run.receipts });
-    say(`${check.ok ? "ok  " : "FAIL"} scenario/${name} [${mode}] — states ${JSON.stringify(check.run.executions.map((e) => e.state))}, ${check.run.receipts} receipt(s)${check.failures.length ? ` — ${check.failures.join("; ")}` : ""}`);
-  }
-}
-
-const ok = adversarial.every((r) => r.ok) && scenarios.every((r) => r.ok);
-if (json) stdout.write(JSON.stringify({ ok, adversarial, scenarios }) + "\n");
-say(ok ? `eval ok: ${adversarial.length} adversarial case(s), ${scenarios.length} scenario run(s)` : "eval FAILED");
-process.exit(ok ? 0 : 1);

package/templates/bills-agent/agents/bills-agent/src/commands/reconcile.ts

@@ -1,38 +0,0 @@
-/**
- * `npm run reconcile [--json]`: compares local state with the rail. Names
- * executions without an outcome, attempts the rail never saw, receipts the
- * rail sealed that the bundle does not hold. Read-only unless an execution
- * is in `executing`, which it closes from what the rail says.
- */
-import { existsSync } from "node:fs";
-import { join } from "node:path";
-import { stderr, stdout } from "node:process";
-import { readDotEnv, runsDir, setup } from "../setup.js";
-
-const json = process.argv.includes("--json");
-const say = (l: string) => stderr.write(l + "\n");
-readDotEnv();
-const s = setup({ say, runId: `run_reconcile_${Date.now().toString(36)}` });
-try {
-  const findings: Array<{ execution_id: string; kind: string; detail: string }> = [];
-  for (const e of s.engine.list()) {
-    if (e.state === "executing") {
-      const closed = await s.engine.reconcile(e.id);
-      findings.push({ execution_id: e.id, kind: closed.state === "executing" ? "still_uncertain" : "closed_from_rail", detail: `executing -> ${closed.state}` });
-      continue;
-    }
-    for (const o of e.outcomes) {
-      if (o.receipt_id && !existsSync(join(runsDir(), e.run_id, "receipts", `${o.receipt_id}.json`))) {
-        findings.push({ execution_id: e.id, kind: "receipt_missing_locally", detail: `receipt ${o.receipt_id} is not in runs/${e.run_id}/receipts` });
-      }
-    }
-    const outbox = s.store.getOutbox(e.idempotency_key);
-    if (e.state === "settled" && outbox?.status !== "done") findings.push({ execution_id: e.id, kind: "outbox_mismatch", detail: `settled but outbox is ${outbox?.status ?? "absent"}` });
-  }
-  for (const f of findings) say(`${f.kind} ${f.execution_id}: ${f.detail}`);
-  if (json) stdout.write(JSON.stringify({ executions: s.engine.list().length, findings }) + "\n");
-  else say(findings.length ? `${findings.length} finding(s)` : "local state and rail agree");
-  process.exit(0);
-} finally {
-  s.close();
-}