@evomap/evolver-core 2.0.0-beta.2 → 2.0.0-beta.22

package/dist/hub/recipeCompose.js

@@ -0,0 +1,90 @@
+export const RECIPE_COMPOSE_FLAG = 'compose_recipe';
+function asRecord(value) {
+    return value && typeof value === 'object' && !Array.isArray(value)
+        ? value
+        : null;
+}
+function assetType(asset) {
+    const typed = asset['type'] ?? asset['assetType'];
+    return typeof typed === 'string' ? typed : '';
+}
+function assetId(asset) {
+    const id = asset['asset_id'] ?? asset['assetId'];
+    return typeof id === 'string' ? id : '';
+}
+function assetSummary(asset) {
+    const summary = asset['summary'] ?? asset['shortTitle'] ?? asset['nlSummary'];
+    return typeof summary === 'string' ? summary : '';
+}
+export function recipeComposeRequested(payload) {
+    if (payload[RECIPE_COMPOSE_FLAG] === false)
+        return false;
+    if (payload['publish_recipe'] === false)
+        return false;
+    return true;
+}
+function shouldCompose(payload) {
+    return recipeComposeRequested(payload);
+}
+export function recipeAssetsFromPayload(payload) {
+    const assets = Array.isArray(payload.assets) ? payload.assets : [];
+    const records = assets.filter((item) => !!asRecord(item));
+    return {
+        gene: records.find((asset) => assetType(asset) === 'Gene'),
+        capsule: records.find((asset) => assetType(asset) === 'Capsule'),
+    };
+}
+/**
+ * After a Gene/Capsule bundle is accepted by Hub, compose a Recipe as the
+ * preferred public artifact. Skill Store publish is not the default outbound.
+ * Missing recipe capability or missing Gene is a no-op, never a publish failure.
+ */
+export async function composeRecipeAfterAssetPublish(hub, payload) {
+    if (!shouldCompose(payload))
+        return { attempted: false, ok: true, reason: 'not_requested' };
+    const recipes = hub.recipes;
+    if (!recipes)
+        return { attempted: false, ok: true, reason: 'recipes_unsupported' };
+    const { gene, capsule } = recipeAssetsFromPayload(payload);
+    if (!gene)
+        return { attempted: false, ok: true, reason: 'gene_missing' };
+    const geneId = assetId(gene);
+    if (!geneId)
+        return { attempted: false, ok: true, reason: 'gene_missing' };
+    const title = String(payload.title || assetSummary(gene) || 'Reusable recipe').trim().slice(0, 200);
+    if (title.length < 3)
+        return { attempted: false, ok: true, reason: 'title_too_short' };
+    const description = String(payload.description || assetSummary(gene) || title).trim().slice(0, 2000);
+    const steps = [
+        { assetId: geneId, assetType: 'Gene', position: 0 },
+        ...(capsule && assetId(capsule)
+            ? [{ assetId: assetId(capsule), assetType: 'Capsule', position: 1 }]
+            : []),
+    ];
+    try {
+        const created = await recipes.create({
+            title,
+            description,
+            steps,
+            pricePerExecution: 5,
+            currency: 'Credit',
+        });
+        const recipeId = created.recipeId;
+        if (!recipeId)
+            return { attempted: true, ok: false, reason: 'recipe_id_missing' };
+        const published = await recipes.publish(recipeId);
+        return {
+            attempted: true,
+            ok: true,
+            recipeId,
+            status: published.status ?? created.status ?? 'published',
+        };
+    }
+    catch (error) {
+        return {
+            attempted: true,
+            ok: false,
+            reason: error instanceof Error ? error.message : 'recipe_compose_failed',
+        };
+    }
+}

package/dist/hub/sanitize.js

@@ -10,17 +10,15 @@ export const REDACTED = '[REDACTED]';
 const REDACT_PATTERNS = [
     // API keys & tokens (generic)
     /Bearer\s+[A-Za-z0-9-._~+/]+=*/g,
-    /"?node_secret"?\s*[:=]\s*["']?[A-Za-z0-9-._~+/]{16,}["']?/gi,
+    /\bBasic\s+[A-Za-z0-9+/]{8,}={0,2}(?=$|[\s,;)}\]])/gi,
+    /\b(?:AIza[0-9A-Za-z_-]{20,}|ya29\.[0-9A-Za-z_-]{20,}|(?:xai|hf|glpat|dop_v1|pk_live|pk_test|sk_live|sk_test|rk_live|rk_test)[-_][A-Za-z0-9_-]{16,}|sq0(?:atp|csp)-[A-Za-z0-9_-]{16,})\b/g,
     /sk-[A-Za-z0-9]{20,}/g,
-    /"?token"?[=:]\s*["']?[A-Za-z0-9-._~+/]{16,}["']?/gi,
-    /api[_-]?key[=:]\s*["']?[A-Za-z0-9-._~+/]{16,}["']?/gi,
-    /secret[=:]\s*["']?[A-Za-z0-9-._~+/]{16,}["']?/gi,
-    /password[=:]\s*["']?[^\s"',;)}\]]{6,}["']?/gi,
-    // GitHub tokens (ghp_, gho_, ghu_, ghs_, github_pat_)
+    // GitHub tokens (ghp_, gho_, ghu_, ghs_, ghr_, github_pat_)
     /ghp_[A-Za-z0-9]{36,}/g,
     /gho_[A-Za-z0-9]{36,}/g,
     /ghu_[A-Za-z0-9]{36,}/g,
     /ghs_[A-Za-z0-9]{36,}/g,
+    /ghr_[A-Za-z0-9]{36,}/g,
     /github_pat_[A-Za-z0-9_]{22,}/g,
     // AWS access keys
     /AKIA[0-9A-Z]{16}/g,
@@ -54,6 +52,120 @@ const REDACT_PATTERNS = [
     /\.env\.[a-zA-Z]+\b/g,
     /(?<=[\\/])\.env\b/g,
 ];
+// 结构化执行诊断可能来自 JSON、YAML 或键值输出，字段名与分隔符之间也可能有空格。
+// 这里只识别字段前缀，值由下面两个小解析器分别读取：带引号的值读取到匹配的闭合引号，
+// 不带引号的值在空白或结构分隔符处停止，避免把凭据后的普通说明文字一起吞掉。
+const STRUCTURED_CREDENTIAL_PREFIX = /(?<![A-Za-z0-9_-])(["']?)(node[_-]?secret|access[_-]?token|refresh[_-]?token|id[_-]?token|session[_-]?token|api[_-]?key|client[_-]?secret|private[_-]?key|token|secret|password|passwd|passphrase|credential|credentials|authorization|auth|bearer|cookie|dsn|webhook|signature)\1(\s*[:=]\s*)/gi;
+const OPAQUE_CREDENTIAL_PATTERN = /(?<![A-Za-z0-9_-])[A-Za-z0-9][A-Za-z0-9._~+=-]{31,}(?![A-Za-z0-9_-])/g;
+const AMBIGUOUS_STRUCTURED_KEYS = new Set([
+    'token', 'secret', 'credential', 'credentials', 'authorization', 'auth', 'cookie', 'signature',
+]);
+const DIAGNOSTIC_STATUS_VALUE = /^(?:ok|success|successful|succeeded|failed|failure|pending|missing|invalid|expired|mismatch|denied|unavailable|refresh needed|not configured|not found|none|null|true|false|enabled|disabled|present|absent|unknown|skipped|unsupported)$/i;
+const DIAGNOSTIC_ASSIGNMENT_VALUE = /^(?:policy|mode|state|status|configured|enabled)=(?:ok|success|successful|succeeded|failed|failure|pending|missing|invalid|expired|mismatch|denied|unavailable|none|null|true|false|enabled|disabled|present|absent|unknown|skipped|unsupported)$/i;
+function unquoteStructuredValue(value) {
+    const trimmed = value.trim();
+    if (trimmed.length >= 2 && ((trimmed.startsWith('"') && trimmed.endsWith('"')) || (trimmed.startsWith("'") && trimmed.endsWith("'")))) {
+        return trimmed.slice(1, -1).trim();
+    }
+    return trimmed;
+}
+function shouldRedactStructuredField(key, rawValue) {
+    const normalizedKey = key.toLowerCase().replace(/[_-]/g, '');
+    if (!AMBIGUOUS_STRUCTURED_KEYS.has(normalizedKey))
+        return true;
+    const value = unquoteStructuredValue(rawValue);
+    const normalizedStatus = value.replace(/[_-]+/g, ' ').replace(/\s+/g, ' ').trim();
+    if (!value
+        || /^\[redacted\]$/i.test(value)
+        || DIAGNOSTIC_STATUS_VALUE.test(normalizedStatus)
+        || DIAGNOSTIC_ASSIGNMENT_VALUE.test(value))
+        return false;
+    if (/^(?:Bearer|Digest|NTLM|Negotiate|AWS)\s+\S+/i.test(value))
+        return true;
+    if (/^Basic\s+[A-Za-z0-9+/]{8,}={0,2}$/i.test(value))
+        return true;
+    // 歧义字段只有在值呈现紧凑凭据形态时才脱敏，保留“auth: denied by policy”等诊断上下文。
+    return !/\s/.test(value) && value.length >= 8;
+}
+function readQuotedStructuredValue(input, start) {
+    const quote = input[start];
+    if (quote !== '"' && quote !== "'")
+        return undefined;
+    let escaped = false;
+    for (let index = start + 1; index < input.length; index += 1) {
+        const char = input[index];
+        if (escaped) {
+            escaped = false;
+            continue;
+        }
+        if (char === '\\') {
+            escaped = true;
+            continue;
+        }
+        if (char === quote) {
+            const end = index + 1;
+            return { end, raw: input.slice(start, end), quote };
+        }
+        if (char === '\r' || char === '\n')
+            break;
+    }
+    return undefined;
+}
+function readUnquotedStructuredValue(input, start) {
+    if (input.startsWith(REDACTED, start)) {
+        return { end: start + REDACTED.length, raw: REDACTED, quote: '' };
+    }
+    let end = start;
+    while (end < input.length) {
+        const char = input[end] ?? '';
+        if (/[\s,;)}\]]/.test(char) || (char === ':' && /\s/.test(input[end + 1] ?? '')))
+            break;
+        end += 1;
+    }
+    if (end === start)
+        return undefined;
+    return { end, raw: input.slice(start, end), quote: '' };
+}
+function redactStructuredCredentials(input) {
+    let cursor = 0;
+    let output = '';
+    STRUCTURED_CREDENTIAL_PREFIX.lastIndex = 0;
+    let match = STRUCTURED_CREDENTIAL_PREFIX.exec(input);
+    while (match) {
+        if (match.index < cursor) {
+            match = STRUCTURED_CREDENTIAL_PREFIX.exec(input);
+            continue;
+        }
+        const valueStart = STRUCTURED_CREDENTIAL_PREFIX.lastIndex;
+        const span = readQuotedStructuredValue(input, valueStart) ?? readUnquotedStructuredValue(input, valueStart);
+        if (!span) {
+            match = STRUCTURED_CREDENTIAL_PREFIX.exec(input);
+            continue;
+        }
+        output += input.slice(cursor, valueStart);
+        output += shouldRedactStructuredField(match[2] ?? '', span.raw)
+            ? `${span.quote}${REDACTED}${span.quote}`
+            : span.raw;
+        cursor = span.end;
+        STRUCTURED_CREDENTIAL_PREFIX.lastIndex = span.end;
+        match = STRUCTURED_CREDENTIAL_PREFIX.exec(input);
+    }
+    return cursor === 0 ? input : output + input.slice(cursor);
+}
+function isOpaqueCredential(candidate) {
+    const compact = candidate.replace(/[._~+/=-]/g, '');
+    const classes = Number(/[a-z]/.test(compact)) + Number(/[A-Z]/.test(compact)) + Number(/[0-9]/.test(compact));
+    if (compact.length < 24 || classes < 3 || /^[0-9a-f]+$/i.test(compact))
+        return false;
+    const frequencies = new Map();
+    for (const char of compact)
+        frequencies.set(char, (frequencies.get(char) ?? 0) + 1);
+    const entropy = [...frequencies.values()].reduce((sum, count) => {
+        const probability = count / compact.length;
+        return sum - probability * Math.log2(probability);
+    }, 0);
+    return entropy >= 3.5;
+}
 // Post-filter allowlist (ported from v1 src/gep/sanitize.js, PR #151): strings the patterns above — and the path
 // anonymizer below — WILL catch but that are not actually sensitive. If any entry matches a captured string it is
 // kept verbatim instead of being redacted / anonymized / flagged as a leak. Keeping this as a post-filter rather
@@ -103,6 +215,9 @@ export function redactString(s) {
         p.lastIndex = 0;
         out = out.replace(p, (m) => (isAllowlisted(m) ? m : REDACTED));
     }
+    out = redactStructuredCredentials(out);
+    OPAQUE_CREDENTIAL_PATTERN.lastIndex = 0;
+    out = out.replace(OPAQUE_CREDENTIAL_PATTERN, (candidate) => (isOpaqueCredential(candidate) ? REDACTED : candidate));
     for (const [p, rep] of ANONYMIZE_PATTERNS) {
         p.lastIndex = 0;
         out = out.replace(p, (m) => (isAllowlisted(m) ? m : rep));
@@ -139,7 +254,7 @@ const LEAK_SCANNERS = [
     { type: 'api_key', pattern: /sk-proj-[A-Za-z0-9-_]{20,}/g, suggest: 'process.env.OPENAI_API_KEY' },
     { type: 'api_key', pattern: /sk-ant-[A-Za-z0-9-_]{20,}/g, suggest: 'process.env.ANTHROPIC_API_KEY' },
     { type: 'api_key', pattern: /AKIA[0-9A-Z]{16}/g, suggest: 'process.env.AWS_ACCESS_KEY_ID' },
-    { type: 'github_token', pattern: /ghp_[A-Za-z0-9]{36,}/g, suggest: 'process.env.GITHUB_TOKEN' },
+    { type: 'github_token', pattern: /gh(?:p|o|u|s|r)_[A-Za-z0-9]{36,}/g, suggest: 'process.env.GITHUB_TOKEN' },
     { type: 'github_token', pattern: /github_pat_[A-Za-z0-9_]{22,}/g, suggest: 'process.env.GITHUB_TOKEN' },
     { type: 'npm_token', pattern: /npm_[A-Za-z0-9]{36,}/g, suggest: 'process.env.NPM_TOKEN' },
     { type: 'slack_token', pattern: /xox[baprsv]-[A-Za-z0-9-]{10,}/g, suggest: 'process.env.SLACK_TOKEN' },

package/dist/index.d.ts

@@ -10,6 +10,7 @@ export * as daemon from './daemon/index.js';
 export * as material from './material/index.js';
 export * as mailbox from './mailbox/index.js';
 export * as assetstore from './assetstore/index.js';
+export * as assetrepair from './assetrepair/index.js';
 export * as strategy from './strategy/index.js';
 export * as algo from './algo/index.js';
 export * as personality from './personality/index.js';
@@ -24,4 +25,8 @@ export * as hub from './hub/index.js';
 export * as shadow from './shadow/index.js';
 export * as ops from './ops/index.js';
 export * as util from './util/index.js';
-export * as trace from './trace/index.js';
+export * as trace from './trace/index.js';
+export * as issueReporter from './issueReporter/index.js';
+export * as feedback from './feedback/index.js';
+export * as compatibility from './modelCompatibility.js';
+export { isValidationCommandAllowed } from './verify/validation.js';

package/dist/index.js

@@ -10,6 +10,7 @@ export * as daemon from './daemon/index.js';
 export * as material from './material/index.js';
 export * as mailbox from './mailbox/index.js';
 export * as assetstore from './assetstore/index.js';
+export * as assetrepair from './assetrepair/index.js';
 export * as strategy from './strategy/index.js';
 export * as algo from './algo/index.js';
 export * as personality from './personality/index.js';
@@ -24,4 +25,9 @@ export * as hub from './hub/index.js';
 export * as shadow from './shadow/index.js';
 export * as ops from './ops/index.js';
 export * as util from './util/index.js';
-export * as trace from './trace/index.js';
+export * as trace from './trace/index.js';
+export * as issueReporter from './issueReporter/index.js';
+export * as feedback from './feedback/index.js';
+export * as compatibility from './modelCompatibility.js';
+// Re-export commonly used validation functions at top level for convenience
+export { isValidationCommandAllowed } from './verify/validation.js';

package/dist/issueReporter/index.d.ts

@@ -0,0 +1,156 @@
+import { type EnvFingerprint } from '../bootstrap/envFingerprint.js';
+export type IssueReportSource = 'cycle_failure' | 'doctor' | 'review' | 'event';
+export type IssueDraftStatus = 'draft' | 'rejected' | 'submitted';
+export declare function isIssueReportSource(value: unknown): value is IssueReportSource;
+export interface IssueReportInput {
+    source: IssueReportSource;
+    errorClass: string;
+    cycleIds?: readonly string[];
+    eventIds?: readonly string[];
+    traceIds?: readonly string[];
+    reproductionSteps?: readonly string[];
+    diagnosticCodes?: readonly string[];
+    failureClass?: string;
+    version?: string;
+    platform?: string;
+    arch?: string;
+}
+export interface IssueDraft {
+    schemaVersion: 1;
+    fingerprint: string;
+    status: IssueDraftStatus;
+    createdAt: string;
+    updatedAt: string;
+    title: string;
+    body: string;
+    source: IssueReportSource;
+    errorClass: string;
+    cycleIds: string[];
+    eventIds: string[];
+    traceRefs: string[];
+    github?: {
+        issueNumber: number;
+        url: string;
+    };
+}
+export interface IssueReporterOptions {
+    rootDir: string;
+    workspaceScope?: string;
+    now?: () => Date;
+    env?: Record<string, string | undefined>;
+    envFingerprint?: Partial<EnvFingerprint>;
+    dedupWindowMs?: number;
+    rateLimitWindowMs?: number;
+    maxSubmissionsPerWindow?: number;
+    logger?: (entry: IssueReporterLogEntry) => void;
+}
+export interface IssueReporterLogEntry {
+    fingerprint: string;
+    status: 'draft_created' | 'duplicate' | 'rejected' | 'submitted' | 'submission_failed' | 'rate_limited';
+    errorClass?: 'approval_required' | 'rate_limited' | 'transport_error' | 'invalid_response' | 'unsafe_draft' | 'local_finalize_error' | 'quota_persistence_error';
+}
+export interface GithubIssueTransport {
+    listOpenIssues(input: {
+        repo: string;
+        page: number;
+        perPage: number;
+    }): Promise<{
+        issues: Array<{
+            number: number;
+            url: string;
+            body: string;
+            isPullRequest: boolean;
+        }>;
+        hasNextPage: boolean;
+    }>;
+    createIssue(input: {
+        repo: string;
+        title: string;
+        body: string;
+    }): Promise<{
+        number: number;
+        url: string;
+    }>;
+}
+export declare class GithubIssueTransportError extends Error {
+    readonly outcome: 'not_created' | 'ambiguous';
+    constructor(outcome: 'not_created' | 'ambiguous');
+}
+export interface SubmitIssueOptions {
+    repo: string;
+    approved: boolean;
+    approvalSource?: 'human' | 'operator_policy';
+    transport: GithubIssueTransport;
+}
+export type DraftResult = {
+    status: 'created';
+    draft: IssueDraft;
+} | {
+    status: 'duplicate';
+    draft: IssueDraft;
+};
+export type SubmitResult = {
+    status: 'submitted';
+    draft: IssueDraft;
+    errorClass?: 'local_finalize_error' | 'quota_persistence_error';
+} | {
+    status: 'already_submitted';
+    draft: IssueDraft;
+} | {
+    status: 'approval_required';
+    draft: IssueDraft;
+} | {
+    status: 'rejected';
+    draft: IssueDraft;
+} | {
+    status: 'rate_limited';
+    draft: IssueDraft;
+    errorClass?: 'issue_report_submission_in_flight' | 'issue_report_submission_ambiguous';
+} | {
+    status: 'failed';
+    draft: IssueDraft;
+    errorClass: 'transport_error' | 'invalid_response' | 'unsafe_draft' | 'local_finalize_error';
+};
+export type IssueDraftConflictErrorClass = 'issue_report_submission_in_flight' | 'issue_report_submission_ambiguous';
+export declare class IssueDraftConflictError extends Error {
+    readonly errorClass: IssueDraftConflictErrorClass;
+    constructor(errorClass: IssueDraftConflictErrorClass);
+}
+export declare function createIssueDraft(input: IssueReportInput, options: IssueReporterOptions): DraftResult;
+export declare function rejectIssueDraft(draft: IssueDraft, options: IssueReporterOptions): IssueDraft;
+export declare function submitIssueDraft(draft: IssueDraft, submit: SubmitIssueOptions, options: IssueReporterOptions): Promise<SubmitResult>;
+export type IssueDraftLookupResult = {
+    status: 'found';
+    draft: IssueDraft;
+} | {
+    status: 'missing' | 'invalid';
+};
+export declare function lookupIssueDraft(rootDir: string, fingerprint: string): IssueDraftLookupResult;
+export declare function loadIssueDraft(rootDir: string, fingerprint: string): IssueDraft | null;
+export type IssueSubmissionResolution = {
+    outcome: 'not_created' | 'abandoned';
+} | {
+    outcome: 'submitted';
+    issueNumber: number;
+    url: string;
+    repo: string;
+};
+export declare function resolveIssueSubmission(fingerprint: string, resolution: IssueSubmissionResolution, options: IssueReporterOptions): IssueDraft;
+export interface IssueReportEvent {
+    type: string;
+    eventId?: string;
+    payload?: Record<string, unknown>;
+}
+export interface IssueReportDoctorCheck {
+    name: string;
+    status: 'pass' | 'warn' | 'fail';
+}
+export interface IssueReportReviewRecord {
+    assetId: string;
+    state: 'quarantined' | 'approved' | 'rejected';
+}
+export declare function issueReportInputFromCycle(events: readonly IssueReportEvent[], cycleId: string): IssueReportInput | null;
+export declare function issueReportInputFromDoctor(checks: readonly IssueReportDoctorCheck[]): IssueReportInput | null;
+export declare function issueReportInputFromReview(record: IssueReportReviewRecord): IssueReportInput | null;
+export declare function issueReportInputFromEvent(event: IssueReportEvent): IssueReportInput | null;
+export declare function createIssueDraftForEventBestEffort(event: IssueReportEvent, options: IssueReporterOptions): DraftResult | null;