@flyingrobots/graft 0.7.0 → 0.7.1
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/CHANGELOG.md +13 -0
- package/README.md +0 -1
- package/bin/graft.js +26 -26
- package/dist/cli/init-client-config.d.ts.map +1 -1
- package/dist/cli/init-client-config.js +40 -4
- package/dist/cli/init-client-config.js.map +1 -1
- package/dist/cli/init-model.js +2 -2
- package/dist/cli/init-model.js.map +1 -1
- package/dist/cli/json-document.d.ts +1 -0
- package/dist/cli/json-document.d.ts.map +1 -1
- package/dist/cli/json-document.js +3 -0
- package/dist/cli/json-document.js.map +1 -1
- package/dist/hooks/posttooluse-read.js +1 -1
- package/dist/hooks/posttooluse-read.js.map +1 -1
- package/dist/hooks/pretooluse-read.js +1 -1
- package/dist/hooks/pretooluse-read.js.map +1 -1
- package/dist/mcp/daemon-worker-child-pool.d.ts +2 -0
- package/dist/mcp/daemon-worker-child-pool.d.ts.map +1 -1
- package/dist/mcp/daemon-worker-child-pool.js +10 -3
- package/dist/mcp/daemon-worker-child-pool.js.map +1 -1
- package/dist/mcp/daemon-worker-pool.d.ts +1 -1
- package/dist/mcp/daemon-worker-pool.d.ts.map +1 -1
- package/dist/mcp/daemon-worker-pool.js +1 -1
- package/dist/mcp/daemon-worker-pool.js.map +1 -1
- package/dist/version.d.ts.map +1 -1
- package/dist/version.js +3 -1
- package/dist/version.js.map +1 -1
- package/docs/SETUP.md +11 -7
- package/package.json +9 -4
- package/src/adapters/canonical-json.ts +0 -56
- package/src/adapters/json-text-decoder.ts +0 -11
- package/src/adapters/node-fs.ts +0 -43
- package/src/adapters/node-git.ts +0 -47
- package/src/adapters/node-paths.ts +0 -35
- package/src/adapters/node-process-runner.ts +0 -27
- package/src/adapters/repo-paths.ts +0 -63
- package/src/adapters/rotating-ndjson-log.ts +0 -66
- package/src/api/index.ts +0 -107
- package/src/api/repo-local-graft.ts +0 -21
- package/src/api/repo-workspace.ts +0 -34
- package/src/api/tool-bridge.ts +0 -22
- package/src/cli/activity-render.ts +0 -112
- package/src/cli/cli-error.ts +0 -192
- package/src/cli/command-parser.ts +0 -484
- package/src/cli/daemon-status-model.ts +0 -238
- package/src/cli/daemon-status-render.ts +0 -102
- package/src/cli/daemon-status.ts +0 -100
- package/src/cli/entrypoint.ts +0 -18
- package/src/cli/git-graft-enhance-model.ts +0 -131
- package/src/cli/git-graft-enhance-render.ts +0 -33
- package/src/cli/git-graft-enhance.ts +0 -54
- package/src/cli/index-cmd.ts +0 -90
- package/src/cli/index-model.ts +0 -75
- package/src/cli/init-bootstrap.ts +0 -47
- package/src/cli/init-client-config.ts +0 -428
- package/src/cli/init-model.ts +0 -284
- package/src/cli/init-render.ts +0 -54
- package/src/cli/init-target-hooks.ts +0 -93
- package/src/cli/init.ts +0 -124
- package/src/cli/json-document.ts +0 -155
- package/src/cli/local-history-dag-model.ts +0 -437
- package/src/cli/local-history-dag-render.ts +0 -133
- package/src/cli/local-history-dag.ts +0 -103
- package/src/cli/main.ts +0 -197
- package/src/cli/migrate-local-history.ts +0 -119
- package/src/cli/peer-command.ts +0 -60
- package/src/contracts/capabilities.ts +0 -540
- package/src/contracts/causal-ontology.ts +0 -627
- package/src/contracts/causal-surface-next-action.ts +0 -18
- package/src/contracts/json-object.ts +0 -18
- package/src/contracts/mcp-runtime.ts +0 -16
- package/src/contracts/output-schema-cli.ts +0 -103
- package/src/contracts/output-schema-fragments.ts +0 -881
- package/src/contracts/output-schema-mcp.ts +0 -501
- package/src/contracts/output-schema-meta.ts +0 -119
- package/src/contracts/output-schemas.ts +0 -1524
- package/src/git/diff.ts +0 -161
- package/src/git/target-git-hook-bootstrap.ts +0 -56
- package/src/guards/stream-boundary.ts +0 -110
- package/src/hooks/posttooluse-read.ts +0 -54
- package/src/hooks/pretooluse-read.ts +0 -52
- package/src/hooks/read-governor.ts +0 -95
- package/src/hooks/read-messages.ts +0 -53
- package/src/hooks/shared.ts +0 -168
- package/src/index.ts +0 -1
- package/src/mcp/burden.ts +0 -132
- package/src/mcp/cache.ts +0 -7
- package/src/mcp/cached-file.ts +0 -1
- package/src/mcp/context.ts +0 -150
- package/src/mcp/control-plane/authz-storage.ts +0 -129
- package/src/mcp/control-plane/session-registry.ts +0 -115
- package/src/mcp/control-plane/status-projection.ts +0 -76
- package/src/mcp/control-plane/types.ts +0 -144
- package/src/mcp/daemon-bootstrap.ts +0 -100
- package/src/mcp/daemon-control-plane.ts +0 -310
- package/src/mcp/daemon-job-scheduler.ts +0 -279
- package/src/mcp/daemon-repos.ts +0 -99
- package/src/mcp/daemon-server.ts +0 -172
- package/src/mcp/daemon-session-host.ts +0 -234
- package/src/mcp/daemon-stdio-bridge.ts +0 -262
- package/src/mcp/daemon-worker-child-pool.ts +0 -213
- package/src/mcp/daemon-worker-inline-pool.ts +0 -46
- package/src/mcp/daemon-worker-pool.ts +0 -7
- package/src/mcp/daemon-worker-process.ts +0 -52
- package/src/mcp/daemon-worker-types.ts +0 -66
- package/src/mcp/metrics.ts +0 -176
- package/src/mcp/monitor-health.ts +0 -83
- package/src/mcp/monitor-persistence.ts +0 -54
- package/src/mcp/monitor-tick-job.ts +0 -153
- package/src/mcp/monitor-types.ts +0 -103
- package/src/mcp/persisted-local-history-graph.ts +0 -592
- package/src/mcp/persisted-local-history-policy.ts +0 -501
- package/src/mcp/persisted-local-history-views.ts +0 -250
- package/src/mcp/persisted-local-history.ts +0 -1621
- package/src/mcp/persistent-monitor-runtime.ts +0 -482
- package/src/mcp/policy.ts +0 -75
- package/src/mcp/receipt.ts +0 -201
- package/src/mcp/repo-concurrency.ts +0 -392
- package/src/mcp/repo-overview/filter.ts +0 -44
- package/src/mcp/repo-overview/types.ts +0 -63
- package/src/mcp/repo-overview/view-projection.ts +0 -90
- package/src/mcp/repo-state-git.ts +0 -247
- package/src/mcp/repo-state-observation.ts +0 -203
- package/src/mcp/repo-state-transition.ts +0 -151
- package/src/mcp/repo-state-types.ts +0 -107
- package/src/mcp/repo-state.ts +0 -146
- package/src/mcp/repo-tool-job.ts +0 -102
- package/src/mcp/repo-tool-worker-context.ts +0 -215
- package/src/mcp/repo-workspace.ts +0 -21
- package/src/mcp/run-capture-config.ts +0 -33
- package/src/mcp/runtime-causal-context.ts +0 -72
- package/src/mcp/runtime-observability.ts +0 -217
- package/src/mcp/runtime-staged-target.ts +0 -161
- package/src/mcp/runtime-workspace-overlay.ts +0 -255
- package/src/mcp/secret-scrub.ts +0 -89
- package/src/mcp/semantic-transition-guidance.ts +0 -60
- package/src/mcp/semantic-transition-summary.ts +0 -130
- package/src/mcp/server-context.ts +0 -236
- package/src/mcp/server-invocation.ts +0 -388
- package/src/mcp/server-tool-access.ts +0 -148
- package/src/mcp/server.ts +0 -270
- package/src/mcp/stdio-server.ts +0 -26
- package/src/mcp/stdio.ts +0 -3
- package/src/mcp/tool-registry.ts +0 -98
- package/src/mcp/tools/activity-view.ts +0 -325
- package/src/mcp/tools/budget.ts +0 -23
- package/src/mcp/tools/causal-attach.ts +0 -67
- package/src/mcp/tools/causal-status.ts +0 -58
- package/src/mcp/tools/changed-since.ts +0 -71
- package/src/mcp/tools/code-find.ts +0 -192
- package/src/mcp/tools/code-refs.ts +0 -470
- package/src/mcp/tools/code-show.ts +0 -289
- package/src/mcp/tools/daemon-monitors.ts +0 -14
- package/src/mcp/tools/daemon-repos.ts +0 -22
- package/src/mcp/tools/daemon-sessions.ts +0 -14
- package/src/mcp/tools/daemon-status.ts +0 -12
- package/src/mcp/tools/diagnostic-models.ts +0 -97
- package/src/mcp/tools/doctor.ts +0 -83
- package/src/mcp/tools/explain.ts +0 -84
- package/src/mcp/tools/export-surface-diff.ts +0 -26
- package/src/mcp/tools/file-outline.ts +0 -67
- package/src/mcp/tools/git-files.ts +0 -73
- package/src/mcp/tools/graft-diff.ts +0 -35
- package/src/mcp/tools/graft-edit.ts +0 -276
- package/src/mcp/tools/knowledge-map.ts +0 -34
- package/src/mcp/tools/map-collector.ts +0 -338
- package/src/mcp/tools/map.ts +0 -185
- package/src/mcp/tools/monitor-nudge.ts +0 -19
- package/src/mcp/tools/monitor-pause.ts +0 -18
- package/src/mcp/tools/monitor-resume.ts +0 -18
- package/src/mcp/tools/monitor-start.ts +0 -20
- package/src/mcp/tools/monitor-stop.ts +0 -18
- package/src/mcp/tools/precision-live.ts +0 -158
- package/src/mcp/tools/precision-match.ts +0 -54
- package/src/mcp/tools/precision-paths.ts +0 -59
- package/src/mcp/tools/precision-query.ts +0 -127
- package/src/mcp/tools/precision-show.ts +0 -86
- package/src/mcp/tools/precision-visibility.ts +0 -44
- package/src/mcp/tools/precision-warp.ts +0 -101
- package/src/mcp/tools/precision.ts +0 -21
- package/src/mcp/tools/read-range.ts +0 -28
- package/src/mcp/tools/refactor-difficulty.ts +0 -42
- package/src/mcp/tools/run-capture.ts +0 -149
- package/src/mcp/tools/safe-read.ts +0 -148
- package/src/mcp/tools/since.ts +0 -53
- package/src/mcp/tools/state.ts +0 -39
- package/src/mcp/tools/stats.ts +0 -24
- package/src/mcp/tools/structural-blame.ts +0 -55
- package/src/mcp/tools/structural-churn.ts +0 -28
- package/src/mcp/tools/structural-log.ts +0 -41
- package/src/mcp/tools/structural-review.ts +0 -63
- package/src/mcp/tools/workspace-authorizations.ts +0 -14
- package/src/mcp/tools/workspace-authorize.ts +0 -20
- package/src/mcp/tools/workspace-bind.ts +0 -25
- package/src/mcp/tools/workspace-rebind.ts +0 -25
- package/src/mcp/tools/workspace-revoke.ts +0 -18
- package/src/mcp/tools/workspace-status.ts +0 -12
- package/src/mcp/warp-pool.ts +0 -36
- package/src/mcp/workspace-read-observation-model.ts +0 -48
- package/src/mcp/workspace-read-observation.ts +0 -103
- package/src/mcp/workspace-router-capability.ts +0 -32
- package/src/mcp/workspace-router-history.ts +0 -233
- package/src/mcp/workspace-router-model.ts +0 -131
- package/src/mcp/workspace-router-resolution.ts +0 -71
- package/src/mcp/workspace-router-runtime.ts +0 -246
- package/src/mcp/workspace-router.ts +0 -688
- package/src/metrics/logger.ts +0 -40
- package/src/metrics/types.ts +0 -40
- package/src/operations/adaptive-projection.ts +0 -54
- package/src/operations/agent-handoff.ts +0 -59
- package/src/operations/cached-file.ts +0 -40
- package/src/operations/capture-range.ts +0 -64
- package/src/operations/conversation-primer.ts +0 -82
- package/src/operations/cross-session-resume.ts +0 -104
- package/src/operations/deterministic-replay.ts +0 -143
- package/src/operations/diff-identity.ts +0 -127
- package/src/operations/export-surface-diff.ts +0 -355
- package/src/operations/file-outline.ts +0 -48
- package/src/operations/footprint-parallelism.ts +0 -98
- package/src/operations/graft-diff.ts +0 -169
- package/src/operations/horizon-of-readability.ts +0 -60
- package/src/operations/import-reference-impact.ts +0 -143
- package/src/operations/knowledge-map.ts +0 -96
- package/src/operations/observation-cache.ts +0 -165
- package/src/operations/projection-safety.ts +0 -111
- package/src/operations/read-range.ts +0 -64
- package/src/operations/repo-workspace.ts +0 -339
- package/src/operations/result-dto.ts +0 -23
- package/src/operations/safe-read.ts +0 -118
- package/src/operations/semantic-drift.ts +0 -70
- package/src/operations/session-filtration.ts +0 -76
- package/src/operations/session-replay.ts +0 -73
- package/src/operations/sludge-detector.ts +0 -356
- package/src/operations/state.ts +0 -66
- package/src/operations/structural-blame.ts +0 -197
- package/src/operations/structural-review.ts +0 -317
- package/src/operations/structured-buffer-compare.ts +0 -429
- package/src/operations/structured-buffer-model.ts +0 -456
- package/src/operations/structured-buffer-query.ts +0 -794
- package/src/operations/structured-buffer.ts +0 -181
- package/src/operations/teaching-hints.ts +0 -52
- package/src/parser/diff.ts +0 -320
- package/src/parser/lang.ts +0 -71
- package/src/parser/markdown.ts +0 -197
- package/src/parser/outline.ts +0 -316
- package/src/parser/runtime.ts +0 -71
- package/src/parser/types.ts +0 -75
- package/src/policy/evaluate.ts +0 -178
- package/src/policy/graftignore.ts +0 -6
- package/src/policy/types.ts +0 -87
- package/src/ports/codec.ts +0 -13
- package/src/ports/filesystem.ts +0 -18
- package/src/ports/git.ts +0 -16
- package/src/ports/guards.ts +0 -68
- package/src/ports/paths.ts +0 -22
- package/src/ports/process-runner.ts +0 -22
- package/src/release/security-gate.ts +0 -102
- package/src/session/tracker.ts +0 -145
- package/src/session/types.ts +0 -23
- package/src/version.ts +0 -3
- package/src/warp/ast-emitter.ts +0 -133
- package/src/warp/ast-import-resolver.ts +0 -333
- package/src/warp/commit-meta.ts +0 -19
- package/src/warp/context.ts +0 -48
- package/src/warp/dead-symbols.ts +0 -174
- package/src/warp/drift-sentinel.ts +0 -101
- package/src/warp/index-head.ts +0 -348
- package/src/warp/observers.ts +0 -101
- package/src/warp/open.ts +0 -67
- package/src/warp/outline-diff-trailer.ts +0 -100
- package/src/warp/plumbing.d.ts +0 -24
- package/src/warp/refactor-difficulty.ts +0 -257
- package/src/warp/references.ts +0 -77
- package/src/warp/stale-docs.ts +0 -210
- package/src/warp/structural-drift-detection.ts +0 -97
- package/src/warp/structural-queries.ts +0 -258
- package/src/warp/symbol-timeline.ts +0 -209
- package/src/warp/traverse-hydrate.ts +0 -61
- package/src/warp/warp-reference-count.ts +0 -47
- package/src/warp/warp-structural-blame.ts +0 -65
- package/src/warp/warp-structural-churn.ts +0 -309
- package/src/warp/warp-structural-log.ts +0 -149
- package/src/warp/writer-id.ts +0 -30
package/src/policy/evaluate.ts
DELETED
|
@@ -1,178 +0,0 @@
|
|
|
1
|
-
import picomatch from "picomatch";
|
|
2
|
-
import type { PolicyInput, PolicyOptions, ReasonCode, GovernorDepth } from "./types.js";
|
|
3
|
-
import { ContentResult, OutlineResult, RefusedResult } from "./types.js";
|
|
4
|
-
import type { PolicyResult } from "./types.js";
|
|
5
|
-
|
|
6
|
-
export const STATIC_THRESHOLDS = { lines: 150, bytes: 12288 } as const;
|
|
7
|
-
|
|
8
|
-
const SESSION_BYTE_CAPS: Record<string, number> = {
|
|
9
|
-
early: 20480,
|
|
10
|
-
mid: 10240,
|
|
11
|
-
late: 4096,
|
|
12
|
-
};
|
|
13
|
-
|
|
14
|
-
const BINARY_EXTENSIONS = new Set([
|
|
15
|
-
".png", ".jpg", ".jpeg", ".gif", ".pdf", ".zip",
|
|
16
|
-
".wasm", ".bin", ".sqlite", ".mp4", ".mov", ".ico",
|
|
17
|
-
]);
|
|
18
|
-
|
|
19
|
-
const LOCKFILE_NAMES = new Set([
|
|
20
|
-
"package-lock.json", "pnpm-lock.yaml", "yarn.lock",
|
|
21
|
-
"Gemfile.lock", "poetry.lock", "Cargo.lock",
|
|
22
|
-
"composer.lock", "Pipfile.lock",
|
|
23
|
-
]);
|
|
24
|
-
|
|
25
|
-
const BUILD_OUTPUT_PREFIXES = ["dist/", "build/", ".next/", "out/", "target/"];
|
|
26
|
-
|
|
27
|
-
const SECRET_PATTERNS: ((name: string) => boolean)[] = [
|
|
28
|
-
(n) => n === ".env" || (n.startsWith(".env.") && !n.endsWith(".example")),
|
|
29
|
-
(n) => n.endsWith(".pem"),
|
|
30
|
-
(n) => n.endsWith(".key"),
|
|
31
|
-
(n) => n.startsWith("credentials."),
|
|
32
|
-
];
|
|
33
|
-
|
|
34
|
-
function basename(path: string): string {
|
|
35
|
-
const i = path.lastIndexOf("/");
|
|
36
|
-
return i === -1 ? path : path.slice(i + 1);
|
|
37
|
-
}
|
|
38
|
-
|
|
39
|
-
function extname(path: string): string {
|
|
40
|
-
const name = basename(path);
|
|
41
|
-
const i = name.lastIndexOf(".");
|
|
42
|
-
return i <= 0 ? "" : name.slice(i);
|
|
43
|
-
}
|
|
44
|
-
|
|
45
|
-
function checkBan(path: string): { reason: ReasonCode; reasonDetail: string; next: string[] } | undefined {
|
|
46
|
-
const name = basename(path);
|
|
47
|
-
const ext = extname(path).toLowerCase();
|
|
48
|
-
|
|
49
|
-
if (BINARY_EXTENSIONS.has(ext)) {
|
|
50
|
-
return {
|
|
51
|
-
reason: "BINARY",
|
|
52
|
-
reasonDetail: `Binary file (${ext}) cannot be usefully read`,
|
|
53
|
-
next: ["Use file_outline to see metadata", "Check for a text alternative"],
|
|
54
|
-
};
|
|
55
|
-
}
|
|
56
|
-
|
|
57
|
-
if (LOCKFILE_NAMES.has(name)) {
|
|
58
|
-
return {
|
|
59
|
-
reason: "LOCKFILE",
|
|
60
|
-
reasonDetail: `Lockfile ${name} is machine-generated and not useful to read`,
|
|
61
|
-
next: ["Read package.json for dependency info instead"],
|
|
62
|
-
};
|
|
63
|
-
}
|
|
64
|
-
|
|
65
|
-
if (name.endsWith(".min.js") || name.endsWith(".min.css")) {
|
|
66
|
-
return {
|
|
67
|
-
reason: "MINIFIED",
|
|
68
|
-
reasonDetail: `Minified file ${name} is not human-readable`,
|
|
69
|
-
next: ["Look for the unminified source"],
|
|
70
|
-
};
|
|
71
|
-
}
|
|
72
|
-
|
|
73
|
-
for (const prefix of BUILD_OUTPUT_PREFIXES) {
|
|
74
|
-
if (path.includes("/" + prefix) || path.startsWith(prefix)) {
|
|
75
|
-
return {
|
|
76
|
-
reason: "BUILD_OUTPUT",
|
|
77
|
-
reasonDetail: `Build output path ${prefix} contains generated files`,
|
|
78
|
-
next: ["Try reading src/ instead of dist/"],
|
|
79
|
-
};
|
|
80
|
-
}
|
|
81
|
-
}
|
|
82
|
-
|
|
83
|
-
for (const check of SECRET_PATTERNS) {
|
|
84
|
-
if (check(name)) {
|
|
85
|
-
return {
|
|
86
|
-
reason: "SECRET",
|
|
87
|
-
reasonDetail: `${name} may contain secrets and should not be read`,
|
|
88
|
-
next: ["Check for a .example or template version"],
|
|
89
|
-
};
|
|
90
|
-
}
|
|
91
|
-
}
|
|
92
|
-
|
|
93
|
-
return undefined;
|
|
94
|
-
}
|
|
95
|
-
|
|
96
|
-
export function evaluatePolicy(input: PolicyInput, options?: PolicyOptions): PolicyResult {
|
|
97
|
-
const { path, lines, bytes } = input;
|
|
98
|
-
const actual = { lines, bytes };
|
|
99
|
-
const thresholds = { ...STATIC_THRESHOLDS };
|
|
100
|
-
const sessionDepth: GovernorDepth | undefined = options?.sessionDepth;
|
|
101
|
-
|
|
102
|
-
// 1. Bans first
|
|
103
|
-
const ban = checkBan(path);
|
|
104
|
-
if (ban !== undefined) {
|
|
105
|
-
return new RefusedResult({
|
|
106
|
-
reason: ban.reason,
|
|
107
|
-
reasonDetail: ban.reasonDetail,
|
|
108
|
-
next: ban.next,
|
|
109
|
-
thresholds,
|
|
110
|
-
actual,
|
|
111
|
-
...(sessionDepth !== undefined ? { sessionDepth } : {}),
|
|
112
|
-
});
|
|
113
|
-
}
|
|
114
|
-
|
|
115
|
-
// 2. Graftignore
|
|
116
|
-
const patterns = options?.graftignorePatterns;
|
|
117
|
-
if (patterns !== undefined && patterns.length > 0) {
|
|
118
|
-
const isMatch = picomatch(patterns);
|
|
119
|
-
if (isMatch(path)) {
|
|
120
|
-
return new RefusedResult({
|
|
121
|
-
reason: "GRAFTIGNORE",
|
|
122
|
-
reasonDetail: "File matches .graftignore pattern",
|
|
123
|
-
next: ["Check .graftignore if this file should be readable"],
|
|
124
|
-
thresholds,
|
|
125
|
-
actual,
|
|
126
|
-
...(sessionDepth !== undefined ? { sessionDepth } : {}),
|
|
127
|
-
});
|
|
128
|
-
}
|
|
129
|
-
}
|
|
130
|
-
|
|
131
|
-
// 3. Determine effective byte cap
|
|
132
|
-
// When session depth is known (not "unknown"), the session cap replaces the static byte threshold.
|
|
133
|
-
// Static line threshold always applies.
|
|
134
|
-
const hasSessionCap = sessionDepth !== undefined && sessionDepth !== "unknown";
|
|
135
|
-
let effectiveByteCap = hasSessionCap
|
|
136
|
-
? SESSION_BYTE_CAPS[sessionDepth] ?? STATIC_THRESHOLDS.bytes
|
|
137
|
-
: STATIC_THRESHOLDS.bytes;
|
|
138
|
-
|
|
139
|
-
// 4. Budget cap — no single read should exceed 5% of remaining budget
|
|
140
|
-
const MAX_READ_FRACTION = 0.05;
|
|
141
|
-
const budgetRemaining = options?.budgetRemaining;
|
|
142
|
-
const hasBudgetCap = budgetRemaining !== undefined && budgetRemaining >= 0;
|
|
143
|
-
let budgetTriggered = false;
|
|
144
|
-
if (hasBudgetCap) {
|
|
145
|
-
const budgetCap = Math.floor(budgetRemaining * MAX_READ_FRACTION);
|
|
146
|
-
if (budgetCap < effectiveByteCap) {
|
|
147
|
-
effectiveByteCap = budgetCap;
|
|
148
|
-
budgetTriggered = true;
|
|
149
|
-
}
|
|
150
|
-
}
|
|
151
|
-
|
|
152
|
-
const exceedsLines = lines > STATIC_THRESHOLDS.lines;
|
|
153
|
-
const exceedsBytes = bytes > effectiveByteCap;
|
|
154
|
-
|
|
155
|
-
if (!exceedsLines && !exceedsBytes) {
|
|
156
|
-
return new ContentResult({
|
|
157
|
-
thresholds,
|
|
158
|
-
actual,
|
|
159
|
-
...(sessionDepth !== undefined ? { sessionDepth } : {}),
|
|
160
|
-
});
|
|
161
|
-
}
|
|
162
|
-
|
|
163
|
-
// Determine reason: BUDGET_CAP > SESSION_CAP > OUTLINE
|
|
164
|
-
const finalReason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" = exceedsLines && !exceedsBytes
|
|
165
|
-
? "OUTLINE"
|
|
166
|
-
: exceedsBytes && budgetTriggered
|
|
167
|
-
? "BUDGET_CAP"
|
|
168
|
-
: exceedsBytes && hasSessionCap
|
|
169
|
-
? "SESSION_CAP"
|
|
170
|
-
: "OUTLINE";
|
|
171
|
-
|
|
172
|
-
return new OutlineResult({
|
|
173
|
-
reason: finalReason,
|
|
174
|
-
thresholds,
|
|
175
|
-
actual,
|
|
176
|
-
...(sessionDepth !== undefined ? { sessionDepth } : {}),
|
|
177
|
-
});
|
|
178
|
-
}
|
package/src/policy/types.ts
DELETED
|
@@ -1,87 +0,0 @@
|
|
|
1
|
-
export type ReasonCode =
|
|
2
|
-
| "CONTENT"
|
|
3
|
-
| "OUTLINE"
|
|
4
|
-
| "SESSION_CAP"
|
|
5
|
-
| "BINARY"
|
|
6
|
-
| "LOCKFILE"
|
|
7
|
-
| "MINIFIED"
|
|
8
|
-
| "BUILD_OUTPUT"
|
|
9
|
-
| "SECRET"
|
|
10
|
-
| "GRAFTIGNORE"
|
|
11
|
-
| "BUDGET_CAP"
|
|
12
|
-
| "UNSUPPORTED_LANGUAGE";
|
|
13
|
-
|
|
14
|
-
export type GovernorDepth = "early" | "mid" | "late" | "unknown";
|
|
15
|
-
|
|
16
|
-
export interface PolicyInput {
|
|
17
|
-
path: string;
|
|
18
|
-
lines: number;
|
|
19
|
-
bytes: number;
|
|
20
|
-
}
|
|
21
|
-
|
|
22
|
-
export interface PolicyOptions {
|
|
23
|
-
graftignorePatterns?: string[] | undefined;
|
|
24
|
-
sessionDepth?: GovernorDepth | undefined;
|
|
25
|
-
budgetRemaining?: number | undefined;
|
|
26
|
-
}
|
|
27
|
-
|
|
28
|
-
// Shared fields for all results
|
|
29
|
-
interface PolicyResultBase {
|
|
30
|
-
readonly thresholds: { readonly lines: number; readonly bytes: number };
|
|
31
|
-
readonly actual: { readonly lines: number; readonly bytes: number };
|
|
32
|
-
readonly sessionDepth?: GovernorDepth | undefined;
|
|
33
|
-
}
|
|
34
|
-
|
|
35
|
-
export class ContentResult implements PolicyResultBase {
|
|
36
|
-
readonly projection = "content" as const;
|
|
37
|
-
readonly reason = "CONTENT" as const;
|
|
38
|
-
readonly thresholds: { readonly lines: number; readonly bytes: number };
|
|
39
|
-
readonly actual: { readonly lines: number; readonly bytes: number };
|
|
40
|
-
readonly sessionDepth?: GovernorDepth | undefined;
|
|
41
|
-
|
|
42
|
-
constructor(opts: { thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
|
|
43
|
-
this.thresholds = Object.freeze({ ...opts.thresholds });
|
|
44
|
-
this.actual = Object.freeze({ ...opts.actual });
|
|
45
|
-
if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
|
|
46
|
-
Object.freeze(this);
|
|
47
|
-
}
|
|
48
|
-
}
|
|
49
|
-
|
|
50
|
-
export class OutlineResult implements PolicyResultBase {
|
|
51
|
-
readonly projection = "outline" as const;
|
|
52
|
-
readonly reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE";
|
|
53
|
-
readonly thresholds: { readonly lines: number; readonly bytes: number };
|
|
54
|
-
readonly actual: { readonly lines: number; readonly bytes: number };
|
|
55
|
-
readonly sessionDepth?: GovernorDepth | undefined;
|
|
56
|
-
|
|
57
|
-
constructor(opts: { reason: "OUTLINE" | "SESSION_CAP" | "BUDGET_CAP" | "UNSUPPORTED_LANGUAGE"; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
|
|
58
|
-
this.reason = opts.reason;
|
|
59
|
-
this.thresholds = Object.freeze({ ...opts.thresholds });
|
|
60
|
-
this.actual = Object.freeze({ ...opts.actual });
|
|
61
|
-
if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
|
|
62
|
-
Object.freeze(this);
|
|
63
|
-
}
|
|
64
|
-
}
|
|
65
|
-
|
|
66
|
-
export class RefusedResult implements PolicyResultBase {
|
|
67
|
-
readonly projection = "refused" as const;
|
|
68
|
-
readonly reason: ReasonCode;
|
|
69
|
-
readonly reasonDetail: string;
|
|
70
|
-
readonly next: readonly string[];
|
|
71
|
-
readonly thresholds: { readonly lines: number; readonly bytes: number };
|
|
72
|
-
readonly actual: { readonly lines: number; readonly bytes: number };
|
|
73
|
-
readonly sessionDepth?: GovernorDepth | undefined;
|
|
74
|
-
|
|
75
|
-
constructor(opts: { reason: ReasonCode; reasonDetail: string; next: string[]; thresholds: { lines: number; bytes: number }; actual: { lines: number; bytes: number }; sessionDepth?: GovernorDepth | undefined }) {
|
|
76
|
-
this.reason = opts.reason;
|
|
77
|
-
this.reasonDetail = opts.reasonDetail;
|
|
78
|
-
this.next = Object.freeze([...opts.next]);
|
|
79
|
-
this.thresholds = Object.freeze({ ...opts.thresholds });
|
|
80
|
-
this.actual = Object.freeze({ ...opts.actual });
|
|
81
|
-
if (opts.sessionDepth !== undefined) this.sessionDepth = opts.sessionDepth;
|
|
82
|
-
Object.freeze(this);
|
|
83
|
-
}
|
|
84
|
-
}
|
|
85
|
-
|
|
86
|
-
// Union type for callers that need the general type
|
|
87
|
-
export type PolicyResult = ContentResult | OutlineResult | RefusedResult;
|
package/src/ports/codec.ts
DELETED
|
@@ -1,13 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// JsonCodec port — hexagonal boundary for JSON serialization
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* Portable JSON codec interface. Core logic imports this port, not
|
|
7
|
-
* JSON.stringify/JSON.parse directly. Implementations control key
|
|
8
|
-
* ordering, whitespace, and determinism.
|
|
9
|
-
*/
|
|
10
|
-
export interface JsonCodec {
|
|
11
|
-
encode(value: unknown): string;
|
|
12
|
-
decode(data: string): unknown;
|
|
13
|
-
}
|
package/src/ports/filesystem.ts
DELETED
|
@@ -1,18 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// FileSystem port — hexagonal boundary for file I/O
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* Portable filesystem interface. Core logic imports this port, not node:fs.
|
|
7
|
-
* Node adapter implements it; tests can substitute a mock.
|
|
8
|
-
*/
|
|
9
|
-
export interface FileSystem {
|
|
10
|
-
readFile(path: string, encoding: "utf-8"): Promise<string>;
|
|
11
|
-
readFile(path: string): Promise<Buffer>;
|
|
12
|
-
readdir(path: string): Promise<string[]>;
|
|
13
|
-
writeFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
|
|
14
|
-
appendFile(path: string, data: string, encoding: "utf-8"): Promise<void>;
|
|
15
|
-
mkdir(path: string, options: { recursive: true }): Promise<void>;
|
|
16
|
-
stat(path: string): Promise<{ size: number }>;
|
|
17
|
-
readFileSync(path: string, encoding: "utf-8"): string;
|
|
18
|
-
}
|
package/src/ports/git.ts
DELETED
|
@@ -1,16 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// GitClient port — hexagonal boundary for git command execution
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
import type { ProcessRunResult } from "./process-runner.js";
|
|
6
|
-
|
|
7
|
-
export interface GitRunRequest {
|
|
8
|
-
readonly args: readonly string[];
|
|
9
|
-
readonly cwd: string;
|
|
10
|
-
readonly timeoutMs?: number;
|
|
11
|
-
readonly maxBufferBytes?: number;
|
|
12
|
-
}
|
|
13
|
-
|
|
14
|
-
export interface GitClient {
|
|
15
|
-
run(request: GitRunRequest): Promise<ProcessRunResult>;
|
|
16
|
-
}
|
package/src/ports/guards.ts
DELETED
|
@@ -1,68 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// Port runtime guards — construction-time validation for port adapters
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
import type { FileSystem } from "./filesystem.js";
|
|
6
|
-
import type { JsonCodec } from "./codec.js";
|
|
7
|
-
|
|
8
|
-
const FILESYSTEM_METHODS = [
|
|
9
|
-
"readFile",
|
|
10
|
-
"readdir",
|
|
11
|
-
"writeFile",
|
|
12
|
-
"appendFile",
|
|
13
|
-
"mkdir",
|
|
14
|
-
"stat",
|
|
15
|
-
"readFileSync",
|
|
16
|
-
] as const;
|
|
17
|
-
|
|
18
|
-
const CODEC_METHODS = ["encode", "decode"] as const;
|
|
19
|
-
|
|
20
|
-
function assertMethodsPresent(
|
|
21
|
-
portName: string,
|
|
22
|
-
impl: Record<string, unknown>,
|
|
23
|
-
methods: readonly string[],
|
|
24
|
-
): void {
|
|
25
|
-
for (const method of methods) {
|
|
26
|
-
if (typeof impl[method] !== "function") {
|
|
27
|
-
throw new TypeError(
|
|
28
|
-
`${portName} adapter missing method: ${method} (got ${typeof impl[method]})`,
|
|
29
|
-
);
|
|
30
|
-
}
|
|
31
|
-
}
|
|
32
|
-
}
|
|
33
|
-
|
|
34
|
-
/**
|
|
35
|
-
* Validate that an object satisfies the FileSystem port contract at
|
|
36
|
-
* runtime. Call this at adapter construction boundaries to catch
|
|
37
|
-
* broken mocks and incomplete implementations early.
|
|
38
|
-
*/
|
|
39
|
-
export function assertFileSystem(impl: unknown): asserts impl is FileSystem {
|
|
40
|
-
if (impl === null || typeof impl !== "object") {
|
|
41
|
-
throw new TypeError(
|
|
42
|
-
`FileSystem adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
|
|
43
|
-
);
|
|
44
|
-
}
|
|
45
|
-
assertMethodsPresent(
|
|
46
|
-
"FileSystem",
|
|
47
|
-
impl as Record<string, unknown>,
|
|
48
|
-
FILESYSTEM_METHODS,
|
|
49
|
-
);
|
|
50
|
-
}
|
|
51
|
-
|
|
52
|
-
/**
|
|
53
|
-
* Validate that an object satisfies the JsonCodec port contract at
|
|
54
|
-
* runtime. Call this at adapter construction boundaries to catch
|
|
55
|
-
* broken mocks and incomplete implementations early.
|
|
56
|
-
*/
|
|
57
|
-
export function assertJsonCodec(impl: unknown): asserts impl is JsonCodec {
|
|
58
|
-
if (impl === null || typeof impl !== "object") {
|
|
59
|
-
throw new TypeError(
|
|
60
|
-
`JsonCodec adapter must be an object (got ${impl === null ? "null" : typeof impl})`,
|
|
61
|
-
);
|
|
62
|
-
}
|
|
63
|
-
assertMethodsPresent(
|
|
64
|
-
"JsonCodec",
|
|
65
|
-
impl as Record<string, unknown>,
|
|
66
|
-
CODEC_METHODS,
|
|
67
|
-
);
|
|
68
|
-
}
|
package/src/ports/paths.ts
DELETED
|
@@ -1,22 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// PathOps port — hexagonal boundary for path operations
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
/**
|
|
6
|
-
* Portable path operations. Core logic imports this port, not node:path.
|
|
7
|
-
* Node adapter implements it; tests can substitute a mock.
|
|
8
|
-
*
|
|
9
|
-
* All methods accept and return forward-slash paths. Normalization
|
|
10
|
-
* (collapsing `//`, resolving `..`, stripping trailing slashes) happens
|
|
11
|
-
* inside the adapter so callers never see raw platform paths.
|
|
12
|
-
*/
|
|
13
|
-
export interface PathOps {
|
|
14
|
-
/** Normalize a path: collapse `//`, resolve `..`, strip trailing `/`. */
|
|
15
|
-
normalize(p: string): string;
|
|
16
|
-
|
|
17
|
-
/** True when `filePath` is exactly `directory` or nested inside it. */
|
|
18
|
-
isWithin(filePath: string, directory: string): boolean;
|
|
19
|
-
|
|
20
|
-
/** Join path segments with forward slashes, normalized. */
|
|
21
|
-
join(...segments: string[]): string;
|
|
22
|
-
}
|
|
@@ -1,22 +0,0 @@
|
|
|
1
|
-
// ---------------------------------------------------------------------------
|
|
2
|
-
// ProcessRunner port — hexagonal boundary for command execution
|
|
3
|
-
// ---------------------------------------------------------------------------
|
|
4
|
-
|
|
5
|
-
export interface ProcessRunRequest {
|
|
6
|
-
readonly command: string;
|
|
7
|
-
readonly args: readonly string[];
|
|
8
|
-
readonly cwd: string;
|
|
9
|
-
readonly timeoutMs?: number;
|
|
10
|
-
readonly maxBufferBytes?: number;
|
|
11
|
-
}
|
|
12
|
-
|
|
13
|
-
export interface ProcessRunResult {
|
|
14
|
-
readonly status: number | null;
|
|
15
|
-
readonly stdout: string;
|
|
16
|
-
readonly stderr: string;
|
|
17
|
-
readonly error?: Error;
|
|
18
|
-
}
|
|
19
|
-
|
|
20
|
-
export interface ProcessRunner {
|
|
21
|
-
run(request: ProcessRunRequest): ProcessRunResult;
|
|
22
|
-
}
|
|
@@ -1,102 +0,0 @@
|
|
|
1
|
-
import { z } from "zod";
|
|
2
|
-
|
|
3
|
-
const severitySchema = z.enum([ "info", "low", "moderate", "high", "critical" ]);
|
|
4
|
-
|
|
5
|
-
const auditReportSchema = z.object({
|
|
6
|
-
metadata: z.object({
|
|
7
|
-
vulnerabilities: z.object({
|
|
8
|
-
info: z.number().int().nonnegative(),
|
|
9
|
-
low: z.number().int().nonnegative(),
|
|
10
|
-
moderate: z.number().int().nonnegative(),
|
|
11
|
-
high: z.number().int().nonnegative(),
|
|
12
|
-
critical: z.number().int().nonnegative(),
|
|
13
|
-
}),
|
|
14
|
-
}),
|
|
15
|
-
advisories: z.record(z.string(), z.object({
|
|
16
|
-
id: z.number().int().nonnegative(),
|
|
17
|
-
module_name: z.string(),
|
|
18
|
-
severity: severitySchema,
|
|
19
|
-
title: z.string(),
|
|
20
|
-
recommendation: z.string(),
|
|
21
|
-
github_advisory_id: z.string().nullable().optional(),
|
|
22
|
-
findings: z.array(z.object({
|
|
23
|
-
version: z.string(),
|
|
24
|
-
paths: z.array(z.string()),
|
|
25
|
-
})).optional(),
|
|
26
|
-
})),
|
|
27
|
-
});
|
|
28
|
-
|
|
29
|
-
export interface SecurityGateViolation {
|
|
30
|
-
readonly id: number;
|
|
31
|
-
readonly moduleName: string;
|
|
32
|
-
readonly severity: "high" | "critical";
|
|
33
|
-
readonly title: string;
|
|
34
|
-
readonly advisoryId: string | null;
|
|
35
|
-
readonly recommendation: string;
|
|
36
|
-
readonly paths: readonly string[];
|
|
37
|
-
readonly versions: readonly string[];
|
|
38
|
-
}
|
|
39
|
-
|
|
40
|
-
export interface SecurityGateResult {
|
|
41
|
-
readonly blocking: boolean;
|
|
42
|
-
readonly counts: {
|
|
43
|
-
readonly info: number;
|
|
44
|
-
readonly low: number;
|
|
45
|
-
readonly moderate: number;
|
|
46
|
-
readonly high: number;
|
|
47
|
-
readonly critical: number;
|
|
48
|
-
};
|
|
49
|
-
readonly blockingFindings: readonly SecurityGateViolation[];
|
|
50
|
-
}
|
|
51
|
-
|
|
52
|
-
export function evaluateSecurityGate(report: unknown): SecurityGateResult {
|
|
53
|
-
const parsed = auditReportSchema.parse(report);
|
|
54
|
-
const blockingFindings: SecurityGateViolation[] = [];
|
|
55
|
-
|
|
56
|
-
for (const advisory of Object.values(parsed.advisories)) {
|
|
57
|
-
if (advisory.severity !== "high" && advisory.severity !== "critical") {
|
|
58
|
-
continue;
|
|
59
|
-
}
|
|
60
|
-
blockingFindings.push({
|
|
61
|
-
id: advisory.id,
|
|
62
|
-
moduleName: advisory.module_name,
|
|
63
|
-
severity: advisory.severity,
|
|
64
|
-
title: advisory.title,
|
|
65
|
-
advisoryId: advisory.github_advisory_id ?? null,
|
|
66
|
-
recommendation: advisory.recommendation,
|
|
67
|
-
paths: advisory.findings?.flatMap((finding) => finding.paths) ?? [],
|
|
68
|
-
versions: advisory.findings?.map((finding) => finding.version) ?? [],
|
|
69
|
-
});
|
|
70
|
-
}
|
|
71
|
-
|
|
72
|
-
return {
|
|
73
|
-
blocking: blockingFindings.length > 0,
|
|
74
|
-
counts: parsed.metadata.vulnerabilities,
|
|
75
|
-
blockingFindings,
|
|
76
|
-
};
|
|
77
|
-
}
|
|
78
|
-
|
|
79
|
-
export function formatSecurityGateResult(result: SecurityGateResult): string {
|
|
80
|
-
const lines = [
|
|
81
|
-
`audit summary: critical=${String(result.counts.critical)} high=${String(result.counts.high)} moderate=${String(result.counts.moderate)} low=${String(result.counts.low)} info=${String(result.counts.info)}`,
|
|
82
|
-
];
|
|
83
|
-
|
|
84
|
-
if (!result.blocking) {
|
|
85
|
-
lines.push("release security gate: pass");
|
|
86
|
-
return lines.join("\n");
|
|
87
|
-
}
|
|
88
|
-
|
|
89
|
-
lines.push("release security gate: fail");
|
|
90
|
-
for (const finding of result.blockingFindings) {
|
|
91
|
-
const advisoryId = finding.advisoryId ?? `npm:${String(finding.id)}`;
|
|
92
|
-
const paths = finding.paths.length > 0 ? finding.paths.join(", ") : "unknown path";
|
|
93
|
-
const versions = finding.versions.length > 0 ? finding.versions.join(", ") : "unknown version";
|
|
94
|
-
lines.push(
|
|
95
|
-
`- ${finding.severity.toUpperCase()} ${advisoryId} ${finding.moduleName}@${versions} via ${paths}`,
|
|
96
|
-
);
|
|
97
|
-
lines.push(` ${finding.title}`);
|
|
98
|
-
lines.push(` ${finding.recommendation}`);
|
|
99
|
-
}
|
|
100
|
-
|
|
101
|
-
return lines.join("\n");
|
|
102
|
-
}
|
package/src/session/tracker.ts
DELETED
|
@@ -1,145 +0,0 @@
|
|
|
1
|
-
import { Tripwire } from "./types.js";
|
|
2
|
-
import type { GovernorDepth } from "./types.js";
|
|
3
|
-
|
|
4
|
-
const EDIT_BASH_TOOLS = new Set(["Edit", "Bash"]);
|
|
5
|
-
const LATE_READ_BYTE_THRESHOLD = 20480;
|
|
6
|
-
const LATE_READ_MESSAGE_THRESHOLD = 300;
|
|
7
|
-
|
|
8
|
-
export interface GovernorTrackerSnapshot {
|
|
9
|
-
readonly totalMessages: number;
|
|
10
|
-
readonly toolCallsSinceUser: number;
|
|
11
|
-
readonly editBashTransitions: number;
|
|
12
|
-
readonly lastEditBashTool: string | null;
|
|
13
|
-
readonly budgetBytes: number | null;
|
|
14
|
-
readonly consumedBytes: number;
|
|
15
|
-
}
|
|
16
|
-
|
|
17
|
-
export class GovernorTracker {
|
|
18
|
-
private totalMessages = 0;
|
|
19
|
-
private toolCallsSinceUser = 0;
|
|
20
|
-
private editBashTransitions = 0;
|
|
21
|
-
private lastEditBashTool: string | null = null;
|
|
22
|
-
private budgetBytes: number | null = null;
|
|
23
|
-
private consumedBytes = 0;
|
|
24
|
-
|
|
25
|
-
static fromSnapshot(snapshot: GovernorTrackerSnapshot): GovernorTracker {
|
|
26
|
-
const tracker = new GovernorTracker();
|
|
27
|
-
tracker.totalMessages = snapshot.totalMessages;
|
|
28
|
-
tracker.toolCallsSinceUser = snapshot.toolCallsSinceUser;
|
|
29
|
-
tracker.editBashTransitions = snapshot.editBashTransitions;
|
|
30
|
-
tracker.lastEditBashTool = snapshot.lastEditBashTool;
|
|
31
|
-
tracker.budgetBytes = snapshot.budgetBytes;
|
|
32
|
-
tracker.consumedBytes = snapshot.consumedBytes;
|
|
33
|
-
return tracker;
|
|
34
|
-
}
|
|
35
|
-
|
|
36
|
-
getMessageCount(): number {
|
|
37
|
-
return this.totalMessages;
|
|
38
|
-
}
|
|
39
|
-
|
|
40
|
-
recordMessage(): void {
|
|
41
|
-
this.totalMessages++;
|
|
42
|
-
}
|
|
43
|
-
|
|
44
|
-
recordToolCall(toolName: string): void {
|
|
45
|
-
this.toolCallsSinceUser++;
|
|
46
|
-
|
|
47
|
-
if (EDIT_BASH_TOOLS.has(toolName)) {
|
|
48
|
-
// Count full Edit→Bash cycles, not individual alternations.
|
|
49
|
-
// Each Edit followed by Bash is one cycle.
|
|
50
|
-
if (this.lastEditBashTool === "Edit" && toolName === "Bash") {
|
|
51
|
-
this.editBashTransitions++;
|
|
52
|
-
}
|
|
53
|
-
this.lastEditBashTool = toolName;
|
|
54
|
-
}
|
|
55
|
-
}
|
|
56
|
-
|
|
57
|
-
recordUserMessage(): void {
|
|
58
|
-
this.toolCallsSinceUser = 0;
|
|
59
|
-
}
|
|
60
|
-
|
|
61
|
-
checkTripwires(): Tripwire[] {
|
|
62
|
-
const wires: Tripwire[] = [];
|
|
63
|
-
|
|
64
|
-
if (this.totalMessages > 500) {
|
|
65
|
-
wires.push(new Tripwire({
|
|
66
|
-
signal: "SESSION_LONG",
|
|
67
|
-
recommendation:
|
|
68
|
-
"Session exceeds 500 messages. Use state_save to persist context and start a new session.",
|
|
69
|
-
}));
|
|
70
|
-
}
|
|
71
|
-
|
|
72
|
-
if (this.editBashTransitions > 30) {
|
|
73
|
-
wires.push(new Tripwire({
|
|
74
|
-
signal: "EDIT_BASH_LOOP",
|
|
75
|
-
recommendation:
|
|
76
|
-
"Detected repeated edit/bash cycling. Step back and rethink the approach.",
|
|
77
|
-
}));
|
|
78
|
-
}
|
|
79
|
-
|
|
80
|
-
if (this.toolCallsSinceUser > 80) {
|
|
81
|
-
wires.push(new Tripwire({
|
|
82
|
-
signal: "RUNAWAY_TOOLS",
|
|
83
|
-
recommendation:
|
|
84
|
-
"Over 80 tool calls without user input. Pause and check in with the user.",
|
|
85
|
-
}));
|
|
86
|
-
}
|
|
87
|
-
|
|
88
|
-
return wires;
|
|
89
|
-
}
|
|
90
|
-
|
|
91
|
-
checkLateRead(outputBytes: number): Tripwire | null {
|
|
92
|
-
if (
|
|
93
|
-
outputBytes > LATE_READ_BYTE_THRESHOLD &&
|
|
94
|
-
this.totalMessages > LATE_READ_MESSAGE_THRESHOLD
|
|
95
|
-
) {
|
|
96
|
-
return new Tripwire({
|
|
97
|
-
signal: "LATE_LARGE_READ",
|
|
98
|
-
recommendation:
|
|
99
|
-
"Large read late in session. Use file_outline or read_range instead.",
|
|
100
|
-
});
|
|
101
|
-
}
|
|
102
|
-
return null;
|
|
103
|
-
}
|
|
104
|
-
|
|
105
|
-
setBudget(bytes: number): void {
|
|
106
|
-
if (bytes <= 0) throw new Error("Budget must be positive");
|
|
107
|
-
this.budgetBytes = bytes;
|
|
108
|
-
}
|
|
109
|
-
|
|
110
|
-
recordBytesConsumed(bytes: number): void {
|
|
111
|
-
this.consumedBytes += bytes;
|
|
112
|
-
}
|
|
113
|
-
|
|
114
|
-
getBudget(): { total: number; consumed: number; remaining: number; fraction: number } | null {
|
|
115
|
-
if (this.budgetBytes === null) return null;
|
|
116
|
-
const remaining = Math.max(0, this.budgetBytes - this.consumedBytes);
|
|
117
|
-
return {
|
|
118
|
-
total: this.budgetBytes,
|
|
119
|
-
consumed: this.consumedBytes,
|
|
120
|
-
remaining,
|
|
121
|
-
fraction: Math.round((this.consumedBytes / this.budgetBytes) * 1000) / 1000,
|
|
122
|
-
};
|
|
123
|
-
}
|
|
124
|
-
|
|
125
|
-
snapshot(): GovernorTrackerSnapshot {
|
|
126
|
-
return {
|
|
127
|
-
totalMessages: this.totalMessages,
|
|
128
|
-
toolCallsSinceUser: this.toolCallsSinceUser,
|
|
129
|
-
editBashTransitions: this.editBashTransitions,
|
|
130
|
-
lastEditBashTool: this.lastEditBashTool,
|
|
131
|
-
budgetBytes: this.budgetBytes,
|
|
132
|
-
consumedBytes: this.consumedBytes,
|
|
133
|
-
};
|
|
134
|
-
}
|
|
135
|
-
|
|
136
|
-
getGovernorDepth(): GovernorDepth {
|
|
137
|
-
if (this.totalMessages < 100) {
|
|
138
|
-
return "early";
|
|
139
|
-
}
|
|
140
|
-
if (this.totalMessages <= 500) {
|
|
141
|
-
return "mid";
|
|
142
|
-
}
|
|
143
|
-
return "late";
|
|
144
|
-
}
|
|
145
|
-
}
|