@flyingrobots/graft 0.7.0 → 0.7.1

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (283) hide show
  1. package/CHANGELOG.md +13 -0
  2. package/README.md +0 -1
  3. package/bin/graft.js +26 -26
  4. package/dist/cli/init-client-config.d.ts.map +1 -1
  5. package/dist/cli/init-client-config.js +40 -4
  6. package/dist/cli/init-client-config.js.map +1 -1
  7. package/dist/cli/init-model.js +2 -2
  8. package/dist/cli/init-model.js.map +1 -1
  9. package/dist/cli/json-document.d.ts +1 -0
  10. package/dist/cli/json-document.d.ts.map +1 -1
  11. package/dist/cli/json-document.js +3 -0
  12. package/dist/cli/json-document.js.map +1 -1
  13. package/dist/hooks/posttooluse-read.js +1 -1
  14. package/dist/hooks/posttooluse-read.js.map +1 -1
  15. package/dist/hooks/pretooluse-read.js +1 -1
  16. package/dist/hooks/pretooluse-read.js.map +1 -1
  17. package/dist/mcp/daemon-worker-child-pool.d.ts +2 -0
  18. package/dist/mcp/daemon-worker-child-pool.d.ts.map +1 -1
  19. package/dist/mcp/daemon-worker-child-pool.js +10 -3
  20. package/dist/mcp/daemon-worker-child-pool.js.map +1 -1
  21. package/dist/mcp/daemon-worker-pool.d.ts +1 -1
  22. package/dist/mcp/daemon-worker-pool.d.ts.map +1 -1
  23. package/dist/mcp/daemon-worker-pool.js +1 -1
  24. package/dist/mcp/daemon-worker-pool.js.map +1 -1
  25. package/dist/version.d.ts.map +1 -1
  26. package/dist/version.js +3 -1
  27. package/dist/version.js.map +1 -1
  28. package/docs/SETUP.md +11 -7
  29. package/package.json +9 -4
  30. package/src/adapters/canonical-json.ts +0 -56
  31. package/src/adapters/json-text-decoder.ts +0 -11
  32. package/src/adapters/node-fs.ts +0 -43
  33. package/src/adapters/node-git.ts +0 -47
  34. package/src/adapters/node-paths.ts +0 -35
  35. package/src/adapters/node-process-runner.ts +0 -27
  36. package/src/adapters/repo-paths.ts +0 -63
  37. package/src/adapters/rotating-ndjson-log.ts +0 -66
  38. package/src/api/index.ts +0 -107
  39. package/src/api/repo-local-graft.ts +0 -21
  40. package/src/api/repo-workspace.ts +0 -34
  41. package/src/api/tool-bridge.ts +0 -22
  42. package/src/cli/activity-render.ts +0 -112
  43. package/src/cli/cli-error.ts +0 -192
  44. package/src/cli/command-parser.ts +0 -484
  45. package/src/cli/daemon-status-model.ts +0 -238
  46. package/src/cli/daemon-status-render.ts +0 -102
  47. package/src/cli/daemon-status.ts +0 -100
  48. package/src/cli/entrypoint.ts +0 -18
  49. package/src/cli/git-graft-enhance-model.ts +0 -131
  50. package/src/cli/git-graft-enhance-render.ts +0 -33
  51. package/src/cli/git-graft-enhance.ts +0 -54
  52. package/src/cli/index-cmd.ts +0 -90
  53. package/src/cli/index-model.ts +0 -75
  54. package/src/cli/init-bootstrap.ts +0 -47
  55. package/src/cli/init-client-config.ts +0 -428
  56. package/src/cli/init-model.ts +0 -284
  57. package/src/cli/init-render.ts +0 -54
  58. package/src/cli/init-target-hooks.ts +0 -93
  59. package/src/cli/init.ts +0 -124
  60. package/src/cli/json-document.ts +0 -155
  61. package/src/cli/local-history-dag-model.ts +0 -437
  62. package/src/cli/local-history-dag-render.ts +0 -133
  63. package/src/cli/local-history-dag.ts +0 -103
  64. package/src/cli/main.ts +0 -197
  65. package/src/cli/migrate-local-history.ts +0 -119
  66. package/src/cli/peer-command.ts +0 -60
  67. package/src/contracts/capabilities.ts +0 -540
  68. package/src/contracts/causal-ontology.ts +0 -627
  69. package/src/contracts/causal-surface-next-action.ts +0 -18
  70. package/src/contracts/json-object.ts +0 -18
  71. package/src/contracts/mcp-runtime.ts +0 -16
  72. package/src/contracts/output-schema-cli.ts +0 -103
  73. package/src/contracts/output-schema-fragments.ts +0 -881
  74. package/src/contracts/output-schema-mcp.ts +0 -501
  75. package/src/contracts/output-schema-meta.ts +0 -119
  76. package/src/contracts/output-schemas.ts +0 -1524
  77. package/src/git/diff.ts +0 -161
  78. package/src/git/target-git-hook-bootstrap.ts +0 -56
  79. package/src/guards/stream-boundary.ts +0 -110
  80. package/src/hooks/posttooluse-read.ts +0 -54
  81. package/src/hooks/pretooluse-read.ts +0 -52
  82. package/src/hooks/read-governor.ts +0 -95
  83. package/src/hooks/read-messages.ts +0 -53
  84. package/src/hooks/shared.ts +0 -168
  85. package/src/index.ts +0 -1
  86. package/src/mcp/burden.ts +0 -132
  87. package/src/mcp/cache.ts +0 -7
  88. package/src/mcp/cached-file.ts +0 -1
  89. package/src/mcp/context.ts +0 -150
  90. package/src/mcp/control-plane/authz-storage.ts +0 -129
  91. package/src/mcp/control-plane/session-registry.ts +0 -115
  92. package/src/mcp/control-plane/status-projection.ts +0 -76
  93. package/src/mcp/control-plane/types.ts +0 -144
  94. package/src/mcp/daemon-bootstrap.ts +0 -100
  95. package/src/mcp/daemon-control-plane.ts +0 -310
  96. package/src/mcp/daemon-job-scheduler.ts +0 -279
  97. package/src/mcp/daemon-repos.ts +0 -99
  98. package/src/mcp/daemon-server.ts +0 -172
  99. package/src/mcp/daemon-session-host.ts +0 -234
  100. package/src/mcp/daemon-stdio-bridge.ts +0 -262
  101. package/src/mcp/daemon-worker-child-pool.ts +0 -213
  102. package/src/mcp/daemon-worker-inline-pool.ts +0 -46
  103. package/src/mcp/daemon-worker-pool.ts +0 -7
  104. package/src/mcp/daemon-worker-process.ts +0 -52
  105. package/src/mcp/daemon-worker-types.ts +0 -66
  106. package/src/mcp/metrics.ts +0 -176
  107. package/src/mcp/monitor-health.ts +0 -83
  108. package/src/mcp/monitor-persistence.ts +0 -54
  109. package/src/mcp/monitor-tick-job.ts +0 -153
  110. package/src/mcp/monitor-types.ts +0 -103
  111. package/src/mcp/persisted-local-history-graph.ts +0 -592
  112. package/src/mcp/persisted-local-history-policy.ts +0 -501
  113. package/src/mcp/persisted-local-history-views.ts +0 -250
  114. package/src/mcp/persisted-local-history.ts +0 -1621
  115. package/src/mcp/persistent-monitor-runtime.ts +0 -482
  116. package/src/mcp/policy.ts +0 -75
  117. package/src/mcp/receipt.ts +0 -201
  118. package/src/mcp/repo-concurrency.ts +0 -392
  119. package/src/mcp/repo-overview/filter.ts +0 -44
  120. package/src/mcp/repo-overview/types.ts +0 -63
  121. package/src/mcp/repo-overview/view-projection.ts +0 -90
  122. package/src/mcp/repo-state-git.ts +0 -247
  123. package/src/mcp/repo-state-observation.ts +0 -203
  124. package/src/mcp/repo-state-transition.ts +0 -151
  125. package/src/mcp/repo-state-types.ts +0 -107
  126. package/src/mcp/repo-state.ts +0 -146
  127. package/src/mcp/repo-tool-job.ts +0 -102
  128. package/src/mcp/repo-tool-worker-context.ts +0 -215
  129. package/src/mcp/repo-workspace.ts +0 -21
  130. package/src/mcp/run-capture-config.ts +0 -33
  131. package/src/mcp/runtime-causal-context.ts +0 -72
  132. package/src/mcp/runtime-observability.ts +0 -217
  133. package/src/mcp/runtime-staged-target.ts +0 -161
  134. package/src/mcp/runtime-workspace-overlay.ts +0 -255
  135. package/src/mcp/secret-scrub.ts +0 -89
  136. package/src/mcp/semantic-transition-guidance.ts +0 -60
  137. package/src/mcp/semantic-transition-summary.ts +0 -130
  138. package/src/mcp/server-context.ts +0 -236
  139. package/src/mcp/server-invocation.ts +0 -388
  140. package/src/mcp/server-tool-access.ts +0 -148
  141. package/src/mcp/server.ts +0 -270
  142. package/src/mcp/stdio-server.ts +0 -26
  143. package/src/mcp/stdio.ts +0 -3
  144. package/src/mcp/tool-registry.ts +0 -98
  145. package/src/mcp/tools/activity-view.ts +0 -325
  146. package/src/mcp/tools/budget.ts +0 -23
  147. package/src/mcp/tools/causal-attach.ts +0 -67
  148. package/src/mcp/tools/causal-status.ts +0 -58
  149. package/src/mcp/tools/changed-since.ts +0 -71
  150. package/src/mcp/tools/code-find.ts +0 -192
  151. package/src/mcp/tools/code-refs.ts +0 -470
  152. package/src/mcp/tools/code-show.ts +0 -289
  153. package/src/mcp/tools/daemon-monitors.ts +0 -14
  154. package/src/mcp/tools/daemon-repos.ts +0 -22
  155. package/src/mcp/tools/daemon-sessions.ts +0 -14
  156. package/src/mcp/tools/daemon-status.ts +0 -12
  157. package/src/mcp/tools/diagnostic-models.ts +0 -97
  158. package/src/mcp/tools/doctor.ts +0 -83
  159. package/src/mcp/tools/explain.ts +0 -84
  160. package/src/mcp/tools/export-surface-diff.ts +0 -26
  161. package/src/mcp/tools/file-outline.ts +0 -67
  162. package/src/mcp/tools/git-files.ts +0 -73
  163. package/src/mcp/tools/graft-diff.ts +0 -35
  164. package/src/mcp/tools/graft-edit.ts +0 -276
  165. package/src/mcp/tools/knowledge-map.ts +0 -34
  166. package/src/mcp/tools/map-collector.ts +0 -338
  167. package/src/mcp/tools/map.ts +0 -185
  168. package/src/mcp/tools/monitor-nudge.ts +0 -19
  169. package/src/mcp/tools/monitor-pause.ts +0 -18
  170. package/src/mcp/tools/monitor-resume.ts +0 -18
  171. package/src/mcp/tools/monitor-start.ts +0 -20
  172. package/src/mcp/tools/monitor-stop.ts +0 -18
  173. package/src/mcp/tools/precision-live.ts +0 -158
  174. package/src/mcp/tools/precision-match.ts +0 -54
  175. package/src/mcp/tools/precision-paths.ts +0 -59
  176. package/src/mcp/tools/precision-query.ts +0 -127
  177. package/src/mcp/tools/precision-show.ts +0 -86
  178. package/src/mcp/tools/precision-visibility.ts +0 -44
  179. package/src/mcp/tools/precision-warp.ts +0 -101
  180. package/src/mcp/tools/precision.ts +0 -21
  181. package/src/mcp/tools/read-range.ts +0 -28
  182. package/src/mcp/tools/refactor-difficulty.ts +0 -42
  183. package/src/mcp/tools/run-capture.ts +0 -149
  184. package/src/mcp/tools/safe-read.ts +0 -148
  185. package/src/mcp/tools/since.ts +0 -53
  186. package/src/mcp/tools/state.ts +0 -39
  187. package/src/mcp/tools/stats.ts +0 -24
  188. package/src/mcp/tools/structural-blame.ts +0 -55
  189. package/src/mcp/tools/structural-churn.ts +0 -28
  190. package/src/mcp/tools/structural-log.ts +0 -41
  191. package/src/mcp/tools/structural-review.ts +0 -63
  192. package/src/mcp/tools/workspace-authorizations.ts +0 -14
  193. package/src/mcp/tools/workspace-authorize.ts +0 -20
  194. package/src/mcp/tools/workspace-bind.ts +0 -25
  195. package/src/mcp/tools/workspace-rebind.ts +0 -25
  196. package/src/mcp/tools/workspace-revoke.ts +0 -18
  197. package/src/mcp/tools/workspace-status.ts +0 -12
  198. package/src/mcp/warp-pool.ts +0 -36
  199. package/src/mcp/workspace-read-observation-model.ts +0 -48
  200. package/src/mcp/workspace-read-observation.ts +0 -103
  201. package/src/mcp/workspace-router-capability.ts +0 -32
  202. package/src/mcp/workspace-router-history.ts +0 -233
  203. package/src/mcp/workspace-router-model.ts +0 -131
  204. package/src/mcp/workspace-router-resolution.ts +0 -71
  205. package/src/mcp/workspace-router-runtime.ts +0 -246
  206. package/src/mcp/workspace-router.ts +0 -688
  207. package/src/metrics/logger.ts +0 -40
  208. package/src/metrics/types.ts +0 -40
  209. package/src/operations/adaptive-projection.ts +0 -54
  210. package/src/operations/agent-handoff.ts +0 -59
  211. package/src/operations/cached-file.ts +0 -40
  212. package/src/operations/capture-range.ts +0 -64
  213. package/src/operations/conversation-primer.ts +0 -82
  214. package/src/operations/cross-session-resume.ts +0 -104
  215. package/src/operations/deterministic-replay.ts +0 -143
  216. package/src/operations/diff-identity.ts +0 -127
  217. package/src/operations/export-surface-diff.ts +0 -355
  218. package/src/operations/file-outline.ts +0 -48
  219. package/src/operations/footprint-parallelism.ts +0 -98
  220. package/src/operations/graft-diff.ts +0 -169
  221. package/src/operations/horizon-of-readability.ts +0 -60
  222. package/src/operations/import-reference-impact.ts +0 -143
  223. package/src/operations/knowledge-map.ts +0 -96
  224. package/src/operations/observation-cache.ts +0 -165
  225. package/src/operations/projection-safety.ts +0 -111
  226. package/src/operations/read-range.ts +0 -64
  227. package/src/operations/repo-workspace.ts +0 -339
  228. package/src/operations/result-dto.ts +0 -23
  229. package/src/operations/safe-read.ts +0 -118
  230. package/src/operations/semantic-drift.ts +0 -70
  231. package/src/operations/session-filtration.ts +0 -76
  232. package/src/operations/session-replay.ts +0 -73
  233. package/src/operations/sludge-detector.ts +0 -356
  234. package/src/operations/state.ts +0 -66
  235. package/src/operations/structural-blame.ts +0 -197
  236. package/src/operations/structural-review.ts +0 -317
  237. package/src/operations/structured-buffer-compare.ts +0 -429
  238. package/src/operations/structured-buffer-model.ts +0 -456
  239. package/src/operations/structured-buffer-query.ts +0 -794
  240. package/src/operations/structured-buffer.ts +0 -181
  241. package/src/operations/teaching-hints.ts +0 -52
  242. package/src/parser/diff.ts +0 -320
  243. package/src/parser/lang.ts +0 -71
  244. package/src/parser/markdown.ts +0 -197
  245. package/src/parser/outline.ts +0 -316
  246. package/src/parser/runtime.ts +0 -71
  247. package/src/parser/types.ts +0 -75
  248. package/src/policy/evaluate.ts +0 -178
  249. package/src/policy/graftignore.ts +0 -6
  250. package/src/policy/types.ts +0 -87
  251. package/src/ports/codec.ts +0 -13
  252. package/src/ports/filesystem.ts +0 -18
  253. package/src/ports/git.ts +0 -16
  254. package/src/ports/guards.ts +0 -68
  255. package/src/ports/paths.ts +0 -22
  256. package/src/ports/process-runner.ts +0 -22
  257. package/src/release/security-gate.ts +0 -102
  258. package/src/session/tracker.ts +0 -145
  259. package/src/session/types.ts +0 -23
  260. package/src/version.ts +0 -3
  261. package/src/warp/ast-emitter.ts +0 -133
  262. package/src/warp/ast-import-resolver.ts +0 -333
  263. package/src/warp/commit-meta.ts +0 -19
  264. package/src/warp/context.ts +0 -48
  265. package/src/warp/dead-symbols.ts +0 -174
  266. package/src/warp/drift-sentinel.ts +0 -101
  267. package/src/warp/index-head.ts +0 -348
  268. package/src/warp/observers.ts +0 -101
  269. package/src/warp/open.ts +0 -67
  270. package/src/warp/outline-diff-trailer.ts +0 -100
  271. package/src/warp/plumbing.d.ts +0 -24
  272. package/src/warp/refactor-difficulty.ts +0 -257
  273. package/src/warp/references.ts +0 -77
  274. package/src/warp/stale-docs.ts +0 -210
  275. package/src/warp/structural-drift-detection.ts +0 -97
  276. package/src/warp/structural-queries.ts +0 -258
  277. package/src/warp/symbol-timeline.ts +0 -209
  278. package/src/warp/traverse-hydrate.ts +0 -61
  279. package/src/warp/warp-reference-count.ts +0 -47
  280. package/src/warp/warp-structural-blame.ts +0 -65
  281. package/src/warp/warp-structural-churn.ts +0 -309
  282. package/src/warp/warp-structural-log.ts +0 -149
  283. package/src/warp/writer-id.ts +0 -30
@@ -1,178 +0,0 @@
1
- import picomatch from "picomatch";
2
- import type { PolicyInput, PolicyOptions, ReasonCode, GovernorDepth } from "./types.js";
3
- import { ContentResult, OutlineResult, RefusedResult } from "./types.js";
4
- import type { PolicyResult } from "./types.js";
5
-
6
- export const STATIC_THRESHOLDS = { lines: 150, bytes: 12288 } as const;
7
-
8
- const SESSION_BYTE_CAPS: Record<string, number> = {
9
- early: 20480,
10
- mid: 10240,
11
- late: 4096,
12
- };
13
-
14
- const BINARY_EXTENSIONS = new Set([
15
- ".png", ".jpg", ".jpeg", ".gif", ".pdf", ".zip",
16
- ".wasm", ".bin", ".sqlite", ".mp4", ".mov", ".ico",
17
- ]);
18
-
19
- const LOCKFILE_NAMES = new Set([
20
- "package-lock.json", "pnpm-lock.yaml", "yarn.lock",
21
- "Gemfile.lock", "poetry.lock", "Cargo.lock",
22
- "composer.lock", "Pipfile.lock",
23
- ]);
24
-
25
- const BUILD_OUTPUT_PREFIXES = ["dist/", "build/", ".next/", "out/", "target/"];
26
-
27
- const SECRET_PATTERNS: ((name: string) => boolean)[] = [
28
- (n) => n === ".env" || (n.startsWith(".env.") && !n.endsWith(".example")),
29
- (n) => n.endsWith(".pem"),
30
- (n) => n.endsWith(".key"),
31
- (n) => n.startsWith("credentials."),
32
- ];
33
-
34
- function basename(path: string): string {
35
- const i = path.lastIndexOf("/");
36
- return i === -1 ? path : path.slice(i + 1);
37
- }
38
-
39
- function extname(path: string): string {
40
- const name = basename(path);
41
- const i = name.lastIndexOf(".");
42
- return i <= 0 ? "" : name.slice(i);
43
- }
44
-
45
- function checkBan(path: string): { reason: ReasonCode; reasonDetail: string; next: string[] } | undefined {
46
- const name = basename(path);
47
- const ext = extname(path).toLowerCase();
48
-
49
- if (BINARY_EXTENSIONS.has(ext)) {
50
- return {
51
- reason: "BINARY",
52
- reasonDetail: `Binary file (${ext}) cannot be usefully read`,
53
- next: ["Use file_outline to see metadata", "Check for a text alternative"],
54
- };
55
- }
56
-
57
- if (LOCKFILE_NAMES.has(name)) {
58
- return {
59
- reason: "LOCKFILE",
60
- reasonDetail: `Lockfile ${name} is machine-generated and not useful to read`,
61
- next: ["Read package.json for dependency info instead"],
62
- };
63
- }
64
-
65
- if (name.endsWith(".min.js") || name.endsWith(".min.css")) {
66
- return {
67
- reason: "MINIFIED",
68
- reasonDetail: `Minified file ${name} is not human-readable`,
69
- next: ["Look for the unminified source"],
70
- };
71
- }
72
-
73
- for (const prefix of BUILD_OUTPUT_PREFIXES) {
74
- if (path.includes("/" + prefix) || path.startsWith(prefix)) {
75
- return {
76
- reason: "BUILD_OUTPUT",
77
- reasonDetail: `Build output path ${prefix} contains generated files`,
78
- next: ["Try reading src/ instead of dist/"],
79
- };
80
- }
81
- }
82
-
83
- for (const check of SECRET_PATTERNS) {
84
- if (check(name)) {
85
- return {
86
- reason: "SECRET",
87
- reasonDetail: `${name} may contain secrets and should not be read`,
88
- next: ["Check for a .example or template version"],
89
- };
90
- }
91
- }
92
-
93
- return undefined;
94
- }
95
-
96
- export function evaluatePolicy(input: PolicyInput, options?: PolicyOptions): PolicyResult {
97
- const { path, lines, bytes } = input;
98
- const actual = { lines, bytes };
99
- const thresholds = { ...STATIC_THRESHOLDS };
100
- const sessionDepth: GovernorDepth | undefined = options?.sessionDepth;
101
-
102
- // 1. Bans first
103
- const ban = checkBan(path);
104
- if (ban !== undefined) {
105
- return new RefusedResult({
106
- reason: ban.reason,
107
- reasonDetail: ban.reasonDetail,
108
- next: ban.next,
109
- thresholds,
110
- actual,
111
- ...(sessionDepth !== undefined ? { sessionDepth } : {}),
112
- });
113
- }
114
-
115
- // 2. Graftignore
116
- const patterns = options?.graftignorePatterns;
117
- if (patterns !== undefined && patterns.length > 0) {
118
- const isMatch = picomatch(patterns);
119
- if (isMatch(path)) {
120
- return new RefusedResult({
121
- reason: "GRAFTIGNORE",
122
- reasonDetail: "File matches .graftignore pattern",
123
- next: ["Check .graftignore if this file should be readable"],
124
- thresholds,
125
- actual,
126
- ...(sessionDepth !== undefined ? { sessionDepth } : {}),
127
- });
128
- }
129
- }
130
-
131
- // 3. Determine effective byte cap
132
- // When session depth is known (not "unknown"), the session cap replaces the static byte threshold.
133
- // Static line threshold always applies.
134
- const hasSessionCap = sessionDepth !== undefined && sessionDepth !== "unknown";
135
- let effectiveByteCap = hasSessionCap
136
- ? SESSION_BYTE_CAPS[sessionDepth] ?? STATIC_THRESHOLDS.bytes
137
- : STATIC_THRESHOLDS.bytes;
138
-
139
- // 4. Budget cap — no single read should exceed 5% of remaining budget
140
- const MAX_READ_FRACTION = 0.05;
141
- const budgetRemaining = options?.budgetRemaining;
142
- const hasBudgetCap = budgetRemaining !== undefined && budgetRemaining >= 0;
143
- let budgetTriggered = false;
144
- if (hasBudgetCap) {
145
- const budgetCap = Math.floor(budgetRemaining * MAX_READ_FRACTION);
146
- if (budgetCap < effectiveByteCap) {
147
- effectiveByteCap = budgetCap;
148
- budgetTriggered = true;
149
- }
150
- }
151
-
152
- const exceedsLines = lines > STATIC_THRESHOLDS.lines;
153
- const exceedsBytes = bytes > effectiveByteCap;
154
-
155
- if (!exceedsLines && !exceedsBytes) {
156
- return new ContentResult({
157
- thresholds,
158
- actual,
159
- ...(sessionDepth !== undefined ? { sessionDepth } : {}),
160
- });
161
- }
162
-
163
- // Determine reason: BUDGET_CAP > SESSION_CAP > OUTLINE
164
- const finalReason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" = exceedsLines && !exceedsBytes
165
- ? "OUTLINE"
166
- : exceedsBytes && budgetTriggered
167
- ? "BUDGET_CAP"
168
- : exceedsBytes && hasSessionCap
169
- ? "SESSION_CAP"
170
- : "OUTLINE";
171
-
172
- return new OutlineResult({
173
- reason: finalReason,
174
- thresholds,
175
- actual,
176
- ...(sessionDepth !== undefined ? { sessionDepth } : {}),
177
- });
178
- }
@@ -1,6 +0,0 @@
1
- export function loadGraftignore(content: string): string[] {
2
- return content
3
- .split("\n")
4
- .map((line) => line.trim())
5
- .filter((line) => line.length > 0 && !line.startsWith("#"));
6
- }
@@ -1,87 +0,0 @@
1
- export type ReasonCode =
2
- | "CONTENT"
3
- | "OUTLINE"
4
- | "SESSION_CAP"
5
- | "BINARY"
6
- | "LOCKFILE"
7
- | "MINIFIED"
8
- | "BUILD_OUTPUT"
9
- | "SECRET"
10
- | "GRAFTIGNORE"
11
- | "BUDGET_CAP"
12
- | "UNSUPPORTED_LANGUAGE";
13
-
14
- export type GovernorDepth = "early" | "mid" | "late" | "unknown";
15
-
16
- export interface PolicyInput {
17
- path: string;
18
- lines: number;
19
- bytes: number;
20
- }
21
-
22
- export interface PolicyOptions {
23
- graftignorePatterns?: string[] | undefined;
24
- sessionDepth?: GovernorDepth | undefined;
25
- budgetRemaining?: number | undefined;
26
- }
27
-
28
- // Shared fields for all results
29
- interface PolicyResultBase {
30
- readonly thresholds: { readonly lines: number; readonly bytes: number };
31
- readonly actual: { readonly lines: number; readonly bytes: number };
32
- readonly sessionDepth?: GovernorDepth | undefined;
33
- }
34
-
35
- export class ContentResult implements PolicyResultBase {
36
- readonly projection = "content" as const;
37
- readonly reason = "CONTENT" as const;
38
- readonly thresholds: { readonly lines: number; readonly bytes: number };
39
- readonly actual: { readonly lines: number; readonly bytes: number };
40
- readonly sessionDepth?: GovernorDepth | undefined;
41
-
42
- constructor(opts: { thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
43
- this.thresholds = Object.freeze({ ...opts.thresholds });
44
- this.actual = Object.freeze({ ...opts.actual });
45
- if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
46
- Object.freeze(this);
47
- }
48
- }
49
-
50
- export class OutlineResult implements PolicyResultBase {
51
- readonly projection = "outline" as const;
52
- readonly reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
53
- readonly thresholds: { readonly lines: number; readonly bytes: number };
54
- readonly actual: { readonly lines: number; readonly bytes: number };
55
- readonly sessionDepth?: GovernorDepth | undefined;
56
-
57
- constructor(opts: { reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE"; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
58
- this.reason = opts.reason;
59
- this.thresholds = Object.freeze({ ...opts.thresholds });
60
- this.actual = Object.freeze({ ...opts.actual });
61
- if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
62
- Object.freeze(this);
63
- }
64
- }
65
-
66
- export class RefusedResult implements PolicyResultBase {
67
- readonly projection = "refused" as const;
68
- readonly reason: ReasonCode;
69
- readonly reasonDetail: string;
70
- readonly next: readonly string[];
71
- readonly thresholds: { readonly lines: number; readonly bytes: number };
72
- readonly actual: { readonly lines: number; readonly bytes: number };
73
- readonly sessionDepth?: GovernorDepth | undefined;
74
-
75
- constructor(opts: { reason: ReasonCode; reasonDetail: string; next: string[]; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
76
- this.reason = opts.reason;
77
- this.reasonDetail = opts.reasonDetail;
78
- this.next = Object.freeze([...opts.next]);
79
- this.thresholds = Object.freeze({ ...opts.thresholds });
80
- this.actual = Object.freeze({ ...opts.actual });
81
- if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
82
- Object.freeze(this);
83
- }
84
- }
85
-
86
- // Union type for callers that need the general type
87
- export type PolicyResult = ContentResult | OutlineResult | RefusedResult;
@@ -1,13 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // JsonCodec port — hexagonal boundary for JSON serialization
3
- // ---------------------------------------------------------------------------
4
-
5
- /**
6
- * Portable JSON codec interface. Core logic imports this port, not
7
- * JSON.stringify/JSON.parse directly. Implementations control key
8
- * ordering, whitespace, and determinism.
9
- */
10
- export interface JsonCodec {
11
- encode(value: unknown): string;
12
- decode(data: string): unknown;
13
- }
@@ -1,18 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // FileSystem port — hexagonal boundary for file I/O
3
- // ---------------------------------------------------------------------------
4
-
5
- /**
6
- * Portable filesystem interface. Core logic imports this port, not node:fs.
7
- * Node adapter implements it; tests can substitute a mock.
8
- */
9
- export interface FileSystem {
10
- readFile(path: string, encoding: "utf-8"): Promise<string>;
11
- readFile(path: string): Promise<Buffer>;
12
- readdir(path: string): Promise<string[]>;
13
- writeFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
14
- appendFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
15
- mkdir(path: string, options: { recursive: true }): Promise<void>;
16
- stat(path: string): Promise<{ size: number }>;
17
- readFileSync(path: string, encoding: "utf-8"): string;
18
- }
package/src/ports/git.ts DELETED
@@ -1,16 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // GitClient port — hexagonal boundary for git command execution
3
- // ---------------------------------------------------------------------------
4
-
5
- import type { ProcessRunResult } from "./process-runner.js";
6
-
7
- export interface GitRunRequest {
8
- readonly args: readonly string[];
9
- readonly cwd: string;
10
- readonly timeoutMs?: number;
11
- readonly maxBufferBytes?: number;
12
- }
13
-
14
- export interface GitClient {
15
- run(request: GitRunRequest): Promise<ProcessRunResult>;
16
- }
@@ -1,68 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // Port runtime guards — construction-time validation for port adapters
3
- // ---------------------------------------------------------------------------
4
-
5
- import type { FileSystem } from "./filesystem.js";
6
- import type { JsonCodec } from "./codec.js";
7
-
8
- const FILESYSTEM_METHODS = [
9
- "readFile",
10
- "readdir",
11
- "writeFile",
12
- "appendFile",
13
- "mkdir",
14
- "stat",
15
- "readFileSync",
16
- ] as const;
17
-
18
- const CODEC_METHODS = ["encode", "decode"] as const;
19
-
20
- function assertMethodsPresent(
21
- portName: string,
22
- impl: Record<string, unknown>,
23
- methods: readonly string[],
24
- ): void {
25
- for (const method of methods) {
26
- if (typeof impl[method] !== "function") {
27
- throw new TypeError(
28
- `${portName} adapter missing method: ${method} (got ${typeof impl[method]})`,
29
- );
30
- }
31
- }
32
- }
33
-
34
- /**
35
- * Validate that an object satisfies the FileSystem port contract at
36
- * runtime. Call this at adapter construction boundaries to catch
37
- * broken mocks and incomplete implementations early.
38
- */
39
- export function assertFileSystem(impl: unknown): asserts impl is FileSystem {
40
- if (impl === null || typeof impl !== "object") {
41
- throw new TypeError(
42
- `FileSystem adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
43
- );
44
- }
45
- assertMethodsPresent(
46
- "FileSystem",
47
- impl as Record<string, unknown>,
48
- FILESYSTEM_METHODS,
49
- );
50
- }
51
-
52
- /**
53
- * Validate that an object satisfies the JsonCodec port contract at
54
- * runtime. Call this at adapter construction boundaries to catch
55
- * broken mocks and incomplete implementations early.
56
- */
57
- export function assertJsonCodec(impl: unknown): asserts impl is JsonCodec {
58
- if (impl === null || typeof impl !== "object") {
59
- throw new TypeError(
60
- `JsonCodec adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
61
- );
62
- }
63
- assertMethodsPresent(
64
- "JsonCodec",
65
- impl as Record<string, unknown>,
66
- CODEC_METHODS,
67
- );
68
- }
@@ -1,22 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // PathOps port — hexagonal boundary for path operations
3
- // ---------------------------------------------------------------------------
4
-
5
- /**
6
- * Portable path operations. Core logic imports this port, not node:path.
7
- * Node adapter implements it; tests can substitute a mock.
8
- *
9
- * All methods accept and return forward-slash paths. Normalization
10
- * (collapsing `//`, resolving `..`, stripping trailing slashes) happens
11
- * inside the adapter so callers never see raw platform paths.
12
- */
13
- export interface PathOps {
14
- /** Normalize a path: collapse `//`, resolve `..`, strip trailing `/`. */
15
- normalize(p: string): string;
16
-
17
- /** True when `filePath` is exactly `directory` or nested inside it. */
18
- isWithin(filePath: string, directory: string): boolean;
19
-
20
- /** Join path segments with forward slashes, normalized. */
21
- join(...segments: string[]): string;
22
- }
@@ -1,22 +0,0 @@
1
- // ---------------------------------------------------------------------------
2
- // ProcessRunner port — hexagonal boundary for command execution
3
- // ---------------------------------------------------------------------------
4
-
5
- export interface ProcessRunRequest {
6
- readonly command: string;
7
- readonly args: readonly string[];
8
- readonly cwd: string;
9
- readonly timeoutMs?: number;
10
- readonly maxBufferBytes?: number;
11
- }
12
-
13
- export interface ProcessRunResult {
14
- readonly status: number | null;
15
- readonly stdout: string;
16
- readonly stderr: string;
17
- readonly error?: Error;
18
- }
19
-
20
- export interface ProcessRunner {
21
- run(request: ProcessRunRequest): ProcessRunResult;
22
- }
@@ -1,102 +0,0 @@
1
- import { z } from "zod";
2
-
3
- const severitySchema = z.enum([ "info", "low", "moderate", "high", "critical" ]);
4
-
5
- const auditReportSchema = z.object({
6
- metadata: z.object({
7
- vulnerabilities: z.object({
8
- info: z.number().int().nonnegative(),
9
- low: z.number().int().nonnegative(),
10
- moderate: z.number().int().nonnegative(),
11
- high: z.number().int().nonnegative(),
12
- critical: z.number().int().nonnegative(),
13
- }),
14
- }),
15
- advisories: z.record(z.string(), z.object({
16
- id: z.number().int().nonnegative(),
17
- module_name: z.string(),
18
- severity: severitySchema,
19
- title: z.string(),
20
- recommendation: z.string(),
21
- github_advisory_id: z.string().nullable().optional(),
22
- findings: z.array(z.object({
23
- version: z.string(),
24
- paths: z.array(z.string()),
25
- })).optional(),
26
- })),
27
- });
28
-
29
- export interface SecurityGateViolation {
30
- readonly id: number;
31
- readonly moduleName: string;
32
- readonly severity: "high" | "critical";
33
- readonly title: string;
34
- readonly advisoryId: string | null;
35
- readonly recommendation: string;
36
- readonly paths: readonly string[];
37
- readonly versions: readonly string[];
38
- }
39
-
40
- export interface SecurityGateResult {
41
- readonly blocking: boolean;
42
- readonly counts: {
43
- readonly info: number;
44
- readonly low: number;
45
- readonly moderate: number;
46
- readonly high: number;
47
- readonly critical: number;
48
- };
49
- readonly blockingFindings: readonly SecurityGateViolation[];
50
- }
51
-
52
- export function evaluateSecurityGate(report: unknown): SecurityGateResult {
53
- const parsed = auditReportSchema.parse(report);
54
- const blockingFindings: SecurityGateViolation[] = [];
55
-
56
- for (const advisory of Object.values(parsed.advisories)) {
57
- if (advisory.severity !== "high" && advisory.severity !== "critical") {
58
- continue;
59
- }
60
- blockingFindings.push({
61
- id: advisory.id,
62
- moduleName: advisory.module_name,
63
- severity: advisory.severity,
64
- title: advisory.title,
65
- advisoryId: advisory.github_advisory_id ?? null,
66
- recommendation: advisory.recommendation,
67
- paths: advisory.findings?.flatMap((finding) => finding.paths) ?? [],
68
- versions: advisory.findings?.map((finding) => finding.version) ?? [],
69
- });
70
- }
71
-
72
- return {
73
- blocking: blockingFindings.length > 0,
74
- counts: parsed.metadata.vulnerabilities,
75
- blockingFindings,
76
- };
77
- }
78
-
79
- export function formatSecurityGateResult(result: SecurityGateResult): string {
80
- const lines = [
81
- `audit summary: critical=${String(result.counts.critical)} high=${String(result.counts.high)} moderate=${String(result.counts.moderate)} low=${String(result.counts.low)} info=${String(result.counts.info)}`,
82
- ];
83
-
84
- if (!result.blocking) {
85
- lines.push("release security gate: pass");
86
- return lines.join("\n");
87
- }
88
-
89
- lines.push("release security gate: fail");
90
- for (const finding of result.blockingFindings) {
91
- const advisoryId = finding.advisoryId ?? `npm:${String(finding.id)}`;
92
- const paths = finding.paths.length > 0 ? finding.paths.join(", ") : "unknown path";
93
- const versions = finding.versions.length > 0 ? finding.versions.join(", ") : "unknown version";
94
- lines.push(
95
- `- ${finding.severity.toUpperCase()} ${advisoryId} ${finding.moduleName}@${versions} via ${paths}`,
96
- );
97
- lines.push(` ${finding.title}`);
98
- lines.push(` ${finding.recommendation}`);
99
- }
100
-
101
- return lines.join("\n");
102
- }
@@ -1,145 +0,0 @@
1
- import { Tripwire } from "./types.js";
2
- import type { GovernorDepth } from "./types.js";
3
-
4
- const EDIT_BASH_TOOLS = new Set(["Edit", "Bash"]);
5
- const LATE_READ_BYTE_THRESHOLD = 20480;
6
- const LATE_READ_MESSAGE_THRESHOLD = 300;
7
-
8
- export interface GovernorTrackerSnapshot {
9
- readonly totalMessages: number;
10
- readonly toolCallsSinceUser: number;
11
- readonly editBashTransitions: number;
12
- readonly lastEditBashTool: string | null;
13
- readonly budgetBytes: number | null;
14
- readonly consumedBytes: number;
15
- }
16
-
17
- export class GovernorTracker {
18
- private totalMessages = 0;
19
- private toolCallsSinceUser = 0;
20
- private editBashTransitions = 0;
21
- private lastEditBashTool: string | null = null;
22
- private budgetBytes: number | null = null;
23
- private consumedBytes = 0;
24
-
25
- static fromSnapshot(snapshot: GovernorTrackerSnapshot): GovernorTracker {
26
- const tracker = new GovernorTracker();
27
- tracker.totalMessages = snapshot.totalMessages;
28
- tracker.toolCallsSinceUser = snapshot.toolCallsSinceUser;
29
- tracker.editBashTransitions = snapshot.editBashTransitions;
30
- tracker.lastEditBashTool = snapshot.lastEditBashTool;
31
- tracker.budgetBytes = snapshot.budgetBytes;
32
- tracker.consumedBytes = snapshot.consumedBytes;
33
- return tracker;
34
- }
35
-
36
- getMessageCount(): number {
37
- return this.totalMessages;
38
- }
39
-
40
- recordMessage(): void {
41
- this.totalMessages++;
42
- }
43
-
44
- recordToolCall(toolName: string): void {
45
- this.toolCallsSinceUser++;
46
-
47
- if (EDIT_BASH_TOOLS.has(toolName)) {
48
- // Count full Edit→Bash cycles, not individual alternations.
49
- // Each Edit followed by Bash is one cycle.
50
- if (this.lastEditBashTool === "Edit" && toolName === "Bash") {
51
- this.editBashTransitions++;
52
- }
53
- this.lastEditBashTool = toolName;
54
- }
55
- }
56
-
57
- recordUserMessage(): void {
58
- this.toolCallsSinceUser = 0;
59
- }
60
-
61
- checkTripwires(): Tripwire[] {
62
- const wires: Tripwire[] = [];
63
-
64
- if (this.totalMessages > 500) {
65
- wires.push(new Tripwire({
66
- signal: "SESSION_LONG",
67
- recommendation:
68
- "Session exceeds 500 messages. Use state_save to persist context and start a new session.",
69
- }));
70
- }
71
-
72
- if (this.editBashTransitions > 30) {
73
- wires.push(new Tripwire({
74
- signal: "EDIT_BASH_LOOP",
75
- recommendation:
76
- "Detected repeated edit/bash cycling. Step back and rethink the approach.",
77
- }));
78
- }
79
-
80
- if (this.toolCallsSinceUser > 80) {
81
- wires.push(new Tripwire({
82
- signal: "RUNAWAY_TOOLS",
83
- recommendation:
84
- "Over 80 tool calls without user input. Pause and check in with the user.",
85
- }));
86
- }
87
-
88
- return wires;
89
- }
90
-
91
- checkLateRead(outputBytes: number): Tripwire | null {
92
- if (
93
- outputBytes > LATE_READ_BYTE_THRESHOLD &&
94
- this.totalMessages > LATE_READ_MESSAGE_THRESHOLD
95
- ) {
96
- return new Tripwire({
97
- signal: "LATE_LARGE_READ",
98
- recommendation:
99
- "Large read late in session. Use file_outline or read_range instead.",
100
- });
101
- }
102
- return null;
103
- }
104
-
105
- setBudget(bytes: number): void {
106
- if (bytes <= 0) throw new Error("Budget must be positive");
107
- this.budgetBytes = bytes;
108
- }
109
-
110
- recordBytesConsumed(bytes: number): void {
111
- this.consumedBytes += bytes;
112
- }
113
-
114
- getBudget(): { total: number; consumed: number; remaining: number; fraction: number } | null {
115
- if (this.budgetBytes === null) return null;
116
- const remaining = Math.max(0, this.budgetBytes - this.consumedBytes);
117
- return {
118
- total: this.budgetBytes,
119
- consumed: this.consumedBytes,
120
- remaining,
121
- fraction: Math.round((this.consumedBytes / this.budgetBytes) * 1000) / 1000,
122
- };
123
- }
124
-
125
- snapshot(): GovernorTrackerSnapshot {
126
- return {
127
- totalMessages: this.totalMessages,
128
- toolCallsSinceUser: this.toolCallsSinceUser,
129
- editBashTransitions: this.editBashTransitions,
130
- lastEditBashTool: this.lastEditBashTool,
131
- budgetBytes: this.budgetBytes,
132
- consumedBytes: this.consumedBytes,
133
- };
134
- }
135
-
136
- getGovernorDepth(): GovernorDepth {
137
- if (this.totalMessages < 100) {
138
- return "early";
139
- }
140
- if (this.totalMessages <= 500) {
141
- return "mid";
142
- }
143
- return "late";
144
- }
145
- }