@cyanautomation/kaseki-agent 1.4.1

package/ops/logrotate/kaseki

@@ -0,0 +1,10 @@
+/var/log/kaseki/*.log {
+    daily
+    rotate 14
+    compress
+    delaycompress
+    missingok
+    notifempty
+    copytruncate
+    create 0640 root adm
+}

package/package.json

@@ -0,0 +1,83 @@
+{
+  "name": "@cyanautomation/kaseki-agent",
+  "version": "1.4.1",
+  "description": "Ephemeral coding-agent runner: orchestrates Pi CLI via Docker for automated code modifications with validation",
+  "type": "module",
+  "license": "MIT",
+  "engines": {
+    "node": ">=24"
+  },
+  "os": [
+    "linux"
+  ],
+  "bin": {
+    "kaseki-agent": "dist/cli.js"
+  },
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/CyanAutomation/kaseki-agent.git"
+  },
+  "keywords": [
+    "pi-cli",
+    "openrouter",
+    "coding-agent",
+    "docker",
+    "automation"
+  ],
+  "author": "CyanAutomation",
+  "bugs": {
+    "url": "https://github.com/CyanAutomation/kaseki-agent/issues"
+  },
+  "homepage": "https://github.com/CyanAutomation/kaseki-agent#readme",
+  "scripts": {
+    "build": "tsc && node dist/add-js-extensions.js && chmod 0755 dist/*.js",
+    "type-check": "tsc --noEmit",
+    "check": "npm run type-check && npm run lint",
+    "test": "npm run test:unit",
+    "test:unit": "jest --passWithNoTests",
+    "test:cli": "npm run build && npm run test:cli:install && npm run test:cli:verify",
+    "test:cli:install": "npm run test:cli:install-local && npm run test:cli:install-npx",
+    "test:cli:install-local": "npm link && kaseki-agent --version && npm unlink -g @cyanautomation/kaseki-agent",
+    "test:cli:install-npx": "npx . --version 2>&1 | grep -q 'version' && echo 'npx test passed'",
+    "test:cli:verify": "npm run build && kaseki-agent --help && kaseki-agent doctor --help",
+    "test:ci": "npm run build && npm run type-check && jest --passWithNoTests && bash run-kaseki-json.test.sh && bash tests/allowlist-glob.test.sh && bash tests/restore-disallowed-changes.test.sh && bash tests/dependency-cache-key.test.sh && bash tests/dependency-restore-mode.test.sh && bash tests/doctor-template-parity.test.sh && bash tests/npm-install-flags.test.sh && bash tests/repo-memory.test.sh && bash scripts/test-github-app.sh",
+    "test:watch": "jest --watch",
+    "test:coverage": "jest --coverage",
+    "lint": "npm run lint:js && npm run lint:sh || true",
+    "lint:js": "eslint . src/ --ignore-pattern dist/",
+    "lint:js:fix": "eslint . src/ --fix --ignore-pattern dist/",
+    "lint:sh": "shellcheck -x kaseki-agent.sh scripts/docker-entrypoint.sh run-kaseki-json.test.sh",
+    "lint:fix": "npm run lint:js:fix && npm run lint:sh",
+    "kaseki-api": "tsx src/kaseki-api-service.ts",
+    "type-check:full": "npm run type-check",
+    "type-check:changed": "tsc --noEmit -p tsconfig.changed.json",
+    "benchmark:pi-event-filter": "npm run build && RUN_PI_EVENT_FILTER_PERF=1 jest --testMatch \"<rootDir>/perf/**/*.benchmark.test.ts\" --runInBand",
+    "release": "semantic-release",
+    "release:dry": "semantic-release --dry-run"
+  },
+  "dependencies": {
+    "express": "^4.18.2",
+    "zod": "^3.22.4"
+  },
+  "devDependencies": {
+    "@semantic-release/changelog": "^6.0.3",
+    "@semantic-release/commit-analyzer": "^13.0.1",
+    "@semantic-release/git": "^10.0.1",
+    "@semantic-release/github": "^12.0.6",
+    "@semantic-release/release-notes-generator": "^14.1.0",
+    "@types/express": "^4.17.21",
+    "@types/jest": "^29.5.14",
+    "@types/node": "^22.10.5",
+    "@types/uuid": "^9.0.2",
+    "@typescript-eslint/eslint-plugin": "^7.18.0",
+    "@typescript-eslint/parser": "^7.18.0",
+    "conventional-changelog-conventionalcommits": "^9.3.1",
+    "eslint": "^8.56.0",
+    "jest": "^29.7.0",
+    "semantic-release": "^25.0.3",
+    "ts-jest": "^29.2.6",
+    "ts-node": "^10.9.2",
+    "tsx": "^4.21.0",
+    "typescript": "^5.7.3"
+  }
+}

package/perf/README.md

@@ -0,0 +1,54 @@
+# Pi event filter benchmark
+
+The 200k-event `pi-event-filter` scenario is intentionally kept outside `src/`
+so it is not discovered by the normal Jest unit/integration configuration. Treat
+it as an explicit nightly or ad-hoc benchmark check, not as regular CI coverage.
+
+## Required build artifact
+
+Build before running the benchmark:
+
+```sh
+npm run build
+```
+
+The benchmark launches Node against the compiled artifact at:
+
+```text
+dist/pi-event-filter.js
+```
+
+If that file is missing or stale, run `npm run build` again before collecting
+benchmark data.
+
+## Required environment variables
+
+Run through the package script for the standard setup:
+
+```sh
+npm run benchmark:pi-event-filter
+```
+
+The script sets `RUN_PI_EVENT_FILTER_PERF=1`, which enables the otherwise skipped
+benchmark suite. Equivalent enablement variables accepted by the benchmark are:
+
+- `RUN_PI_EVENT_FILTER_PERF=1` for manual benchmark runs.
+- `CI_NIGHTLY=1` for scheduled nightly workers.
+- `PERF_TESTS=1` for generic performance-test jobs.
+
+The benchmark process also sets `PI_EVENT_FILTER_TRACK_RSS=1` for the child
+`dist/pi-event-filter.js` process so the worker prints `MAX_RSS_BYTES=<bytes>` to
+stderr for assertion and trend collection.
+
+## Expected worker memory profile
+
+`pi-event-filter` is expected to stream JSONL without retaining the 200k-event
+input in memory. The benchmark asserts the maximum worker RSS reported by the
+child process:
+
+- Nightly workers (`CI_NIGHTLY=1`): less than 450 MiB.
+- Manual/ad-hoc runs: less than 800 MiB to allow for unknown local host overhead
+  while still catching large regressions.
+
+Use the stderr `MAX_RSS_BYTES` value as the benchmark datapoint when tracking
+memory drift across nightly runs.

package/perf/pi-event-filter.benchmark.test.ts

@@ -0,0 +1,98 @@
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawn } from 'node:child_process';
+
+const runPerf =
+  process.env.RUN_PI_EVENT_FILTER_PERF === '1' ||
+  process.env.CI_NIGHTLY === '1' ||
+  process.env.PERF_TESTS === '1';
+const describePerf = runPerf ? describe : describe.skip;
+
+describePerf('pi-event-filter nightly benchmark suite', () => {
+  test('200k event benchmark completes within worker memory profile', async () => {
+    const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pi-event-filter-perf-'));
+    const inputPath = path.join(tmpDir, 'in.jsonl');
+    const outputPath = path.join(tmpDir, 'out.jsonl');
+    const summaryPath = path.join(tmpDir, 'summary.json');
+
+    try {
+      const totalEvents = 200_000;
+      const filteredEvery = 5;
+      const expectedKept = totalEvents - Math.floor(totalEvents / filteredEvery);
+
+      const input = fs.createWriteStream(inputPath, { encoding: 'utf8' });
+      for (let i = 0; i < totalEvents; i++) {
+        const filtered = i % filteredEvery === 0;
+        const event = {
+          type: i % 2 === 0 ? 'tool_execution_start' : 'tool_execution_end',
+          timestamp: `2026-01-01T00:00:${String(i % 60).padStart(2, '0')}.000Z`,
+          message: { model: 'pi-stress-model', api: 'pi-stress-api' },
+          assistantMessageEvent: {
+            type: filtered ? 'thinking_delta' : 'output_delta',
+            partial: {
+              timestamp: `2026-01-01T00:00:${String((i + 1) % 60).padStart(2, '0')}.000Z`,
+              content: [
+                { type: 'thinking', text: 'internal note' },
+                { type: 'output_text', text: `event-${i}` },
+              ],
+            },
+          },
+        };
+        const canContinue = input.write(`${JSON.stringify(event)}\n`);
+        if (!canContinue) {
+          await new Promise<void>((resolve) => input.once('drain', resolve));
+        }
+      }
+      await new Promise<void>((resolve) => input.end(resolve));
+
+      const script = [
+        path.join(__dirname, '..', 'dist', 'pi-event-filter.js'),
+        inputPath,
+        outputPath,
+        summaryPath,
+      ];
+
+      const child = spawn(process.execPath, script, {
+        env: { ...process.env, PI_EVENT_FILTER_TRACK_RSS: '1' },
+      });
+      let stderr = '';
+      child.stderr.on('data', (chunk) => {
+        stderr += chunk.toString();
+      });
+
+      const exitCode = await new Promise<number | null>((resolve, reject) => {
+        child.once('error', reject);
+        child.once('close', resolve);
+      });
+
+      expect(exitCode).toBe(0);
+
+      const lines = fs.readFileSync(outputPath, 'utf8').trim().split('\n');
+      expect(lines).toHaveLength(expectedKept);
+
+      const summary = JSON.parse(fs.readFileSync(summaryPath, 'utf8'));
+      expect(summary.tool_start_count + summary.tool_end_count).toBe(totalEvents);
+      expect(summary.invalid_json_lines).toBe(0);
+      expect(summary.selected_model).toBe('pi-stress-model');
+      expect(summary.selected_api).toBe('pi-stress-api');
+
+      const maxRssMatch = stderr.match(/MAX_RSS_BYTES=(\d+)/);
+      expect(maxRssMatch).not.toBeNull();
+      if (!maxRssMatch) return;
+
+      const memoryMb = Number.parseInt(maxRssMatch[1], 10) / (1024 * 1024);
+
+      // Threshold guidance:
+      // - default (developer laptops/unknown CI): loose guardrail for regressions
+      // - nightly perf workers: tighter budget to track drift
+      const thresholdMb = process.env.CI_NIGHTLY === '1' ? 450 : 800;
+      // Expected profile: a streaming worker should remain well below 450 MiB
+      // on nightly hosts; the 800 MiB fallback only protects ad-hoc local runs
+      // from large regressions on unknown hardware.
+      expect(memoryMb).toBeLessThan(thresholdMb);
+    } finally {
+      fs.rmSync(tmpDir, { recursive: true, force: true });
+    }
+  }, 120000);
+});

package/run-kaseki-json.test.sh

@@ -0,0 +1,106 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
+TMP_DIR="$(mktemp -d)"
+trap 'rm -rf "$TMP_DIR"' EXIT
+
+require_file() {
+  local file="$1"
+  if [ ! -f "$file" ]; then
+    echo "Expected file missing: $file" >&2
+    exit 1
+  fi
+}
+
+require_artifacts() {
+  local result_dir="$1"
+  shift
+  for artifact in "$@"; do
+    require_file "$result_dir/$artifact"
+  done
+}
+
+KASEKI_ROOT="$TMP_DIR/kaseki"
+REPO_URL='https://example.com/repo"quoted"'
+GIT_REF='feature/"quoted"/branch'
+OPENROUTER_API_KEY_FILE="$TMP_DIR/missing-secret"
+DOCKER_BIN="$(command -v docker || true)"
+if [ -z "$DOCKER_BIN" ]; then
+  echo "Skipping run-kaseki-json.test.sh because docker is not available" >&2
+  exit 0
+fi
+TEST_PATH="$(dirname "$DOCKER_BIN"):/usr/bin:/bin"
+
+set +e
+env \
+  PATH="$TEST_PATH" \
+  KASEKI_ROOT="$KASEKI_ROOT" \
+  REPO_URL="$REPO_URL" \
+  GIT_REF="$GIT_REF" \
+  OPENROUTER_API_KEY_FILE="$OPENROUTER_API_KEY_FILE" \
+  "$ROOT_DIR/run-kaseki.sh" >/dev/null 2>&1
+status=$?
+set -e
+
+if [ "$status" -ne 2 ]; then
+  echo "Expected run-kaseki.sh to exit 2 when API key is missing, got: $status" >&2
+  exit 1
+fi
+
+if [ ! -d "$KASEKI_ROOT/kaseki-results/kaseki-1" ]; then
+  echo "Expected first auto run to create $KASEKI_ROOT/kaseki-results/kaseki-1" >&2
+  exit 1
+fi
+result_dir="$KASEKI_ROOT/kaseki-results/kaseki-1"
+
+require_artifacts "$result_dir" host-start.json metadata.json
+
+node -e '
+const fs = require("node:fs");
+const hostStart = JSON.parse(fs.readFileSync(process.argv[1], "utf8"));
+const metadata = JSON.parse(fs.readFileSync(process.argv[2], "utf8"));
+const expectedRepo = process.argv[3];
+const expectedRef = process.argv[4];
+if (hostStart.repo_url !== expectedRepo) throw new Error("host-start repo_url mismatch");
+if (hostStart.git_ref !== expectedRef) throw new Error("host-start git_ref mismatch");
+if (metadata.repo_url !== expectedRepo) throw new Error("metadata repo_url mismatch");
+if (metadata.git_ref !== expectedRef) throw new Error("metadata git_ref mismatch");
+' \
+  "$result_dir/host-start.json" \
+  "$result_dir/metadata.json" \
+  "$REPO_URL" \
+  "$GIT_REF"
+
+require_artifacts "$result_dir" changed-files.txt validation-timings.tsv stage-timings.tsv dependency-cache.log quality.log secret-scan.log git-push.log progress.log progress.jsonl cleanup.log
+
+if ! grep -q "missing OPENROUTER_API_KEY" "$result_dir/stage-timings.tsv"; then
+  echo "Expected missing-key failure to be recorded in stage-timings.tsv" >&2
+  exit 1
+fi
+
+set +e
+env \
+  PATH="$TEST_PATH" \
+  KASEKI_ROOT="$KASEKI_ROOT" \
+  REPO_URL="$REPO_URL" \
+  GIT_REF="$GIT_REF" \
+  OPENROUTER_API_KEY_FILE="$OPENROUTER_API_KEY_FILE" \
+  "$ROOT_DIR/run-kaseki.sh" >/tmp/kaseki-json-rerun.out 2>/tmp/kaseki-json-rerun.err
+rerun_status=$?
+set -e
+
+if [ "$rerun_status" -ne 2 ]; then
+  echo "Expected second auto run to skip existing result and fail with missing key at kaseki-2, got: $rerun_status" >&2
+  exit 1
+fi
+
+if [ ! -d "$KASEKI_ROOT/kaseki-results/kaseki-2" ]; then
+  echo "Expected second auto run to create kaseki-2 instead of overwriting kaseki-1" >&2
+  exit 1
+fi
+
+if grep -q "node: command not found" "$result_dir/stderr.log"; then
+  echo "run-kaseki.sh should not require node on the host" >&2
+  exit 1
+fi