@flyingrobots/graft 0.7.0 → 0.8.0

package/src/hooks/shared.ts

@@ -1,168 +0,0 @@
-// ---------------------------------------------------------------------------
-// Shared utilities for Claude Code hooks
-// ---------------------------------------------------------------------------
-
-import * as path from "node:path";
-
-/** Maximum stdin bytes before rejecting (1 MB — generous for JSON). */
-const MAX_STDIN_BYTES = 1_048_576;
-
-export class HookInput {
-  readonly session_id: string;
-  readonly cwd: string;
-  readonly hook_event_name: string;
-  readonly tool_name: string;
-  readonly tool_input: {
-    readonly file_path: string;
-    readonly offset?: number;
-    readonly limit?: number;
-  };
-  readonly tool_result?: string;
-
-  constructor(opts: {
-    session_id: string;
-    cwd: string;
-    hook_event_name: string;
-    tool_name: string;
-    tool_input: { file_path: string; offset?: number; limit?: number };
-    tool_result?: string;
-  }) {
-    if (opts.session_id.length === 0) {
-      throw new Error("HookInput: session_id must be non-empty");
-    }
-    if (opts.cwd.length === 0) {
-      throw new Error("HookInput: cwd must be non-empty");
-    }
-    if (opts.tool_input.file_path.length === 0) {
-      throw new Error("HookInput: tool_input.file_path must be non-empty");
-    }
-    this.session_id = opts.session_id;
-    this.cwd = opts.cwd;
-    this.hook_event_name = opts.hook_event_name;
-    this.tool_name = opts.tool_name;
-    this.tool_input = Object.freeze({ ...opts.tool_input });
-    if (opts.tool_result !== undefined) this.tool_result = opts.tool_result;
-    Object.freeze(this);
-  }
-}
-
-export class HookOutput {
-  readonly exitCode: number;
-  readonly stderr: string;
-
-  constructor(exitCode: number, stderr: string) {
-    this.exitCode = exitCode;
-    this.stderr = stderr;
-    Object.freeze(this);
-  }
-}
-
-/**
- * Reads stdin with a size guard. Throws if input exceeds MAX_STDIN_BYTES.
- * Accumulates raw buffers to avoid corrupting multi-byte UTF-8 characters
- * that may be split across chunk boundaries.
- */
-export async function readStdin(): Promise<string> {
-  const chunks: Buffer[] = [];
-  let totalBytes = 0;
-  for await (const chunk of process.stdin) {
-    const buf = Buffer.isBuffer(chunk) ? chunk : Buffer.from(String(chunk), "utf-8");
-    totalBytes += buf.length;
-    if (totalBytes > MAX_STDIN_BYTES) {
-      throw new Error(
-        `stdin exceeded ${String(MAX_STDIN_BYTES)} bytes — aborting`,
-      );
-    }
-    chunks.push(buf);
-  }
-  return Buffer.concat(chunks).toString("utf-8");
-}
-
-/**
- * Parses and validates hook input from a raw JSON string.
- * Returns a frozen HookInput instance.
- */
-export function parseHookInput(raw: string): HookInput {
-  const parsed: unknown = JSON.parse(raw);
-  if (typeof parsed !== "object" || parsed === null) {
-    throw new Error("Hook input must be a JSON object");
-  }
-
-  const obj = parsed as Record<string, unknown>;
-
-  const sessionId = obj["session_id"];
-  if (typeof sessionId !== "string") {
-    throw new Error("Hook input missing session_id");
-  }
-
-  const cwd = obj["cwd"];
-  if (typeof cwd !== "string") {
-    throw new Error("Hook input missing cwd");
-  }
-
-  const rawToolInput = obj["tool_input"];
-  if (typeof rawToolInput !== "object" || rawToolInput === null) {
-    throw new Error("Hook input missing tool_input");
-  }
-  const toolInput = rawToolInput as Record<string, unknown>;
-
-  const filePath = toolInput["file_path"];
-  if (typeof filePath !== "string") {
-    throw new Error("Hook input missing tool_input.file_path");
-  }
-
-  const hookEventName = obj["hook_event_name"];
-  const toolName = obj["tool_name"];
-  const toolResult = obj["tool_result"];
-  const offset = toolInput["offset"];
-  const limit = toolInput["limit"];
-
-  return new HookInput({
-    session_id: sessionId,
-    cwd,
-    hook_event_name: typeof hookEventName === "string" ? hookEventName : "",
-    tool_name: typeof toolName === "string" ? toolName : "",
-    tool_input: {
-      file_path: filePath,
-      ...(typeof offset === "number" ? { offset } : {}),
-      ...(typeof limit === "number" ? { limit } : {}),
-    },
-    ...(typeof toolResult === "string" ? { tool_result: toolResult } : {}),
-  });
-}
-
-/**
- * Returns a cwd-relative path, or null if the path is outside the cwd.
- * Prevents path traversal attacks and handles the path.relative() edge case
- * where paths outside cwd produce absolute or '../' prefixed results.
- */
-export function safeRelativePath(cwd: string, filePath: string): string | null {
-  const rel = path.relative(cwd, filePath);
-  if (rel.startsWith("..") || path.isAbsolute(rel)) {
-    return null;
-  }
-  return rel;
-}
-
-/**
- * Wraps a hook's main function with stdin reading, input parsing,
- * and error handling. Logs full stack traces on failure.
- */
-export function runHook(
-  handler: (input: HookInput) => HookOutput | Promise<HookOutput>,
-  failExitCode: number,
-): void {
-  const run = async (): Promise<void> => {
-    const raw = await readStdin();
-    const input = parseHookInput(raw);
-    const output = await handler(input);
-    if (output.stderr.length > 0) process.stderr.write(output.stderr);
-    process.exit(output.exitCode);
-  };
-
-  run().catch((err: unknown) => {
-    const detail = err instanceof Error ? (err.stack ?? err.message) : String(err);
-    process.stderr.write(`[graft] Hook error: ${detail}`);
-    process.exit(failExitCode);
-  });
-}

package/src/index.ts

@@ -1 +0,0 @@
-export * from "./api/index.js";

package/src/mcp/burden.ts

@@ -1,132 +0,0 @@
-import type { McpToolName } from "../contracts/output-schemas.js";
-
-export const BURDEN_KINDS = ["read", "search", "shell", "state", "diagnostic"] as const;
-
-export type BurdenKind = typeof BURDEN_KINDS[number];
-
-export interface BurdenBucket {
-  readonly calls: number;
-  readonly bytesReturned: number;
-}
-
-export type BurdenByKind = Record<BurdenKind, BurdenBucket>;
-
-const ZERO_BUCKET: BurdenBucket = Object.freeze({ calls: 0, bytesReturned: 0 });
-
-const TOOL_BURDEN_KIND: Record<McpToolName, BurdenKind> = {
-  safe_read: "read",
-  graft_edit: "state",
-  file_outline: "read",
-  read_range: "read",
-  changed_since: "read",
-  graft_diff: "search",
-  graft_since: "search",
-  graft_map: "search",
-  code_show: "search",
-  code_find: "search",
-  code_refs: "search",
-  daemon_repos: "diagnostic",
-  daemon_status: "diagnostic",
-  daemon_sessions: "diagnostic",
-  daemon_monitors: "diagnostic",
-  monitor_start: "diagnostic",
-  monitor_pause: "diagnostic",
-  monitor_resume: "diagnostic",
-  monitor_nudge: "diagnostic",
-  monitor_stop: "diagnostic",
-  workspace_authorize: "diagnostic",
-  workspace_authorizations: "diagnostic",
-  workspace_revoke: "diagnostic",
-  workspace_bind: "diagnostic",
-  workspace_status: "diagnostic",
-  causal_status: "diagnostic",
-  causal_attach: "diagnostic",
-  activity_view: "diagnostic",
-  workspace_rebind: "diagnostic",
-  run_capture: "shell",
-  state_save: "state",
-  state_load: "state",
-  set_budget: "diagnostic",
-  explain: "diagnostic",
-  doctor: "diagnostic",
-  stats: "diagnostic",
-  graft_churn: "search",
-  graft_exports: "search",
-  graft_log: "search",
-  graft_blame: "search",
-  graft_difficulty: "search",
-  graft_review: "search",
-  knowledge_map: "diagnostic",
-};
-
-export function emptyBurdenByKind(): BurdenByKind {
-  return {
-    read: ZERO_BUCKET,
-    search: ZERO_BUCKET,
-    shell: ZERO_BUCKET,
-    state: ZERO_BUCKET,
-    diagnostic: ZERO_BUCKET,
-  };
-}
-
-export function cloneBurdenByKind(source: Readonly<BurdenByKind>): BurdenByKind {
-  return {
-    read: { ...source.read },
-    search: { ...source.search },
-    shell: { ...source.shell },
-    state: { ...source.state },
-    diagnostic: { ...source.diagnostic },
-  };
-}
-
-export function freezeBurdenByKind(source: BurdenByKind): Readonly<BurdenByKind> {
-  for (const kind of BURDEN_KINDS) {
-    Object.freeze(source[kind]);
-  }
-  return Object.freeze(source);
-}
-
-export function burdenKindForTool(tool: McpToolName): BurdenKind {
-  return TOOL_BURDEN_KIND[tool];
-}
-
-export function isNonReadBurdenKind(kind: BurdenKind): boolean {
-  return kind !== "read";
-}
-
-export function projectBurdenByKind(
-  source: Readonly<BurdenByKind>,
-  tool: McpToolName,
-  returnedBytes: number,
-): Readonly<BurdenByKind> {
-  const next = cloneBurdenByKind(source);
-  const kind = burdenKindForTool(tool);
-  const current = next[kind];
-  next[kind] = {
-    calls: current.calls + 1,
-    bytesReturned: current.bytesReturned + returnedBytes,
-  };
-  return freezeBurdenByKind(next);
-}
-
-export function totalNonReadBytesReturned(source: Readonly<BurdenByKind>): number {
-  return BURDEN_KINDS
-    .filter((kind) => isNonReadBurdenKind(kind))
-    .reduce((sum, kind) => sum + source[kind].bytesReturned, 0);
-}
-
-export function topBurdenKind(
-  source: Readonly<BurdenByKind>,
-): { kind: BurdenKind; calls: number; bytesReturned: number } | null {
-  let best: { kind: BurdenKind; calls: number; bytesReturned: number } | null = null;
-
-  for (const kind of BURDEN_KINDS) {
-    const bucket = source[kind];
-    if (bucket.bytesReturned === 0) continue;
-    if (best === null || bucket.bytesReturned > best.bytesReturned) {
-      best = { kind, calls: bucket.calls, bytesReturned: bucket.bytesReturned };
-    }
-  }
-
-  return best;
-}

package/src/mcp/cache.ts

@@ -1,7 +0,0 @@
-export {
-  hashContent,
-  Observation,
-  ObservationCache,
-  type CacheResult,
-  type ObservationSnapshot,
-} from "../operations/observation-cache.js";

package/src/mcp/cached-file.ts

@@ -1 +0,0 @@
-export { CachedFile } from "../operations/cached-file.js";

package/src/mcp/context.ts

@@ -1,150 +0,0 @@
-// ---------------------------------------------------------------------------
-// ToolContext — shared dependencies injected into every tool handler
-// ---------------------------------------------------------------------------
-
-import { createRepoPathResolver } from "../adapters/repo-paths.js";
-import type { ObservationCache } from "./cache.js";
-import type { Metrics } from "./metrics.js";
-import type { GovernorTracker } from "../session/tracker.js";
-import type { McpToolResult } from "./receipt.js";
-import type { FileSystem } from "../ports/filesystem.js";
-import type { JsonCodec } from "../ports/codec.js";
-import type { ProcessRunner } from "../ports/process-runner.js";
-import type { GitClient } from "../ports/git.js";
-import type { WarpContext } from "../warp/context.js";
-import type { RepoObservation } from "./repo-state.js";
-import type { RunCaptureConfig } from "./run-capture-config.js";
-import type { RuntimeObservabilityState, ToolCallFootprintRegion } from "./runtime-observability.js";
-import type { RuntimeCausalContext } from "./runtime-causal-context.js";
-import type { RuntimeWorkspaceOverlayFooting } from "./runtime-workspace-overlay.js";
-import type {
-  PersistedLocalActivityWindow,
-  PersistedLocalHistoryAttachDeclaration,
-  RepoConcurrencySummary,
-  PersistedLocalHistorySummary,
-} from "./persisted-local-history.js";
-import type { McpToolName } from "../contracts/output-schemas.js";
-import type {
-  DaemonSessionView,
-  DaemonStatusView,
-  AuthorizedWorkspaceView,
-  WorkspaceAuthorizeRequest,
-  WorkspaceAuthorizeResult,
-  WorkspaceRevokeResult,
-} from "./daemon-control-plane.js";
-import type {
-  DaemonRepoFilter,
-  DaemonRepoListView,
-} from "./daemon-repos.js";
-import type {
-  MonitorActionResult,
-  MonitorStartRequest,
-  MonitorStatusView,
-} from "./persistent-monitor-runtime.js";
-import type {
-  WorkspaceActionResult,
-  CausalAttachResult,
-  WorkspaceBindRequest,
-  WorkspaceStatus,
-} from "./workspace-router.js";
-
-import type { z } from "zod";
-
-export type ToolHandler = (args: Record<string, unknown>, ctx: ToolContext) => McpToolResult | Promise<McpToolResult>;
-
-export interface ToolDefinition {
-  readonly name: McpToolName;
-  readonly description: string;
-  readonly schema?: Record<string, z.ZodType>;
-  readonly policyCheck?: boolean;
-  readonly createHandler: () => ToolHandler;
-}
-
-export interface ToolContext {
-  readonly projectRoot: string;
-  readonly graftDir: string;
-  readonly graftignorePatterns: readonly string[];
-  readonly governor: GovernorTracker;
-  readonly cache: ObservationCache;
-  readonly metrics: Metrics;
-  readonly fs: FileSystem;
-  readonly codec: JsonCodec;
-  readonly process: ProcessRunner;
-  readonly git: GitClient;
-  readonly runCapture: RunCaptureConfig;
-  readonly observability: RuntimeObservabilityState;
-  respond(tool: McpToolName, data: Record<string, unknown>): McpToolResult;
-  recordFootprint(entry: {
-    readonly paths?: readonly string[];
-    readonly symbols?: readonly string[];
-    readonly regions?: readonly ToolCallFootprintRegion[];
-  }): void;
-  resolvePath(relative: string): string;
-  getWarp(): Promise<WarpContext>;
-  getRepoState(): RepoObservation;
-  getCausalContext(): RuntimeCausalContext;
-  getWorkspaceOverlayFooting(): Promise<RuntimeWorkspaceOverlayFooting | null>;
-  getPersistedLocalHistorySummary(): Promise<PersistedLocalHistorySummary>;
-  getPersistedLocalActivityWindow(limit: number): Promise<PersistedLocalActivityWindow>;
-  getRepoConcurrencySummary(): Promise<RepoConcurrencySummary | null>;
-  declareCausalAttach(request: PersistedLocalHistoryAttachDeclaration): Promise<CausalAttachResult>;
-  getWorkspaceStatus(): WorkspaceStatus;
-  bindWorkspace(request: WorkspaceBindRequest, actionName: string): Promise<WorkspaceActionResult>;
-  rebindWorkspace(request: WorkspaceBindRequest, actionName: string): Promise<WorkspaceActionResult>;
-  getDaemonStatus(): Promise<DaemonStatusView>;
-  listDaemonRepos(filter: DaemonRepoFilter): Promise<DaemonRepoListView>;
-  listDaemonSessions(): Promise<readonly DaemonSessionView[]>;
-  listDaemonMonitors(): Promise<readonly MonitorStatusView[]>;
-  startMonitor(request: MonitorStartRequest): Promise<MonitorActionResult>;
-  pauseMonitor(request: WorkspaceBindRequest): Promise<MonitorActionResult>;
-  resumeMonitor(request: WorkspaceBindRequest): Promise<MonitorActionResult>;
-  stopMonitor(request: WorkspaceBindRequest): Promise<MonitorActionResult>;
-  nudgeMonitor(request: WorkspaceBindRequest): Promise<MonitorActionResult>;
-  listWorkspaceAuthorizations(): Promise<readonly AuthorizedWorkspaceView[]>;
-  authorizeWorkspace(request: WorkspaceAuthorizeRequest): Promise<WorkspaceAuthorizeResult>;
-  revokeWorkspace(request: WorkspaceBindRequest): Promise<WorkspaceRevokeResult>;
-}
-
-/**
- * Resolve a user-provided path against projectRoot with traversal guard.
- * Both absolute and relative paths are confined to the project root.
- * Symlinks are resolved before the confinement check to prevent escapes.
- */
-export function createPathResolver(projectRoot: string): (input: string) => string {
-  return createRepoPathResolver(projectRoot);
-}
-
-/**
- * Runtime guard: asserts that the supplied value satisfies the ToolContext
- * shape.  Used at composition-root boundaries to catch wiring errors early.
- */
-export function assertToolContext(value: unknown): asserts value is ToolContext {
-  if (value === null || typeof value !== "object") {
-    throw new Error("ToolContext must be an object");
-  }
-  const obj = value as Record<string, unknown>;
-
-  const ports = ["fs", "codec", "process", "git"] as const;
-  for (const port of ports) {
-    if (obj[port] === undefined || obj[port] === null) {
-      throw new Error(`ToolContext missing port: ${port}`);
-    }
-  }
-
-  const governanceProps = ["governor", "cache", "metrics"] as const;
-  for (const prop of governanceProps) {
-    if (obj[prop] === undefined || obj[prop] === null) {
-      throw new Error(`ToolContext missing governance property: ${prop}`);
-    }
-  }
-
-  const methods = ["respond", "resolvePath", "getWarp", "getRepoState", "getCausalContext", "getWorkspaceStatus"] as const;
-  for (const method of methods) {
-    if (obj[method] === undefined || obj[method] === null) {
-      throw new Error(`ToolContext missing method: ${method}`);
-    }
-    if (typeof obj[method] !== "function") {
-      throw new Error(`ToolContext missing method: ${method} (got ${typeof obj[method]})`);
-    }
-  }
-}

package/src/mcp/control-plane/authz-storage.ts

@@ -1,129 +0,0 @@
-import * as path from "node:path";
-import { z } from "zod";
-import type { JsonCodec } from "../../ports/codec.js";
-import type { FileSystem } from "../../ports/filesystem.js";
-import type {
-  WorkspaceCapabilityProfile,
-} from "../workspace-router.js";
-import type { AuthorizedWorkspaceRecord } from "./types.js";
-
-// ---------------------------------------------------------------------------
-// Zod schemas for persisted authorization state
-// ---------------------------------------------------------------------------
-
-const workspaceCapabilityProfileSchema = z.object({
-  boundedReads: z.boolean(),
-  structuralTools: z.boolean(),
-  precisionTools: z.boolean(),
-  stateBookmarks: z.boolean(),
-  runtimeLogs: z.literal("session_local_only"),
-  runCapture: z.boolean(),
-}).strict();
-
-const authorizedWorkspaceRecordSchema = z.object({
-  repoId: z.string(),
-  worktreeId: z.string(),
-  worktreeRoot: z.string(),
-  gitCommonDir: z.string(),
-  capabilityProfile: workspaceCapabilityProfileSchema,
-  authorizedAt: z.string(),
-  lastBoundAt: z.string().nullable(),
-}).strict();
-
-const persistedControlPlaneStateSchema = z.object({
-  version: z.literal(1),
-  workspaces: z.array(authorizedWorkspaceRecordSchema),
-}).strict();
-
-export type PersistedControlPlaneState = z.infer<typeof persistedControlPlaneStateSchema>;
-
-// ---------------------------------------------------------------------------
-// Capability profile helpers
-// ---------------------------------------------------------------------------
-
-export function cloneCapabilityProfile(
-  profile: WorkspaceCapabilityProfile,
-): WorkspaceCapabilityProfile {
-  return { ...profile };
-}
-
-export function capabilityProfilesEqual(
-  left: WorkspaceCapabilityProfile,
-  right: WorkspaceCapabilityProfile,
-): boolean {
-  return left.boundedReads === right.boundedReads
-    && left.structuralTools === right.structuralTools
-    && left.precisionTools === right.precisionTools
-    && left.stateBookmarks === right.stateBookmarks
-    && left.runCapture === right.runCapture;
-}
-
-export function resolveCapabilityProfile(
-  current: WorkspaceCapabilityProfile | undefined,
-  defaultProfile: WorkspaceCapabilityProfile,
-  runCapture: boolean | undefined,
-): WorkspaceCapabilityProfile {
-  return {
-    ...(current ?? defaultProfile),
-    ...(runCapture !== undefined ? { runCapture } : {}),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Record helpers
-// ---------------------------------------------------------------------------
-
-export function sortByWorktreeRoot(records: readonly AuthorizedWorkspaceRecord[]): AuthorizedWorkspaceRecord[] {
-  return [...records].sort((left, right) => left.worktreeRoot.localeCompare(right.worktreeRoot));
-}
-
-export function cloneAuthorizedWorkspaceRecord(record: AuthorizedWorkspaceRecord): AuthorizedWorkspaceRecord {
-  return {
-    ...record,
-    capabilityProfile: cloneCapabilityProfile(record.capabilityProfile),
-  };
-}
-
-// ---------------------------------------------------------------------------
-// Persistence
-// ---------------------------------------------------------------------------
-
-const CONTROL_PLANE_DIR = "control-plane";
-const AUTHORIZED_WORKSPACES_FILE = "authorized-workspaces.json";
-
-export function buildStatePath(graftDir: string): string {
-  return path.join(
-    path.resolve(graftDir),
-    CONTROL_PLANE_DIR,
-    AUTHORIZED_WORKSPACES_FILE,
-  );
-}
-
-export async function loadPersistedState(
-  statePath: string,
-  fs: FileSystem,
-  codec: JsonCodec,
-): Promise<PersistedControlPlaneState | null> {
-  const raw = await fs.readFile(statePath, "utf-8").catch((error: unknown) => {
-    if (error instanceof Error && "code" in error && error.code === "ENOENT") {
-      return null;
-    }
-    throw error;
-  });
-  if (raw === null) return null;
-  return persistedControlPlaneStateSchema.parse(codec.decode(raw));
-}
-
-export async function persistState(
-  statePath: string,
-  fs: FileSystem,
-  codec: JsonCodec,
-  workspaces: ReadonlyMap<string, AuthorizedWorkspaceRecord>,
-): Promise<void> {
-  const payload: PersistedControlPlaneState = {
-    version: 1,
-    workspaces: sortByWorktreeRoot([...workspaces.values()]),
-  };
-  await fs.mkdir(path.dirname(statePath), { recursive: true });
-  await fs.writeFile(statePath, codec.encode(payload), "utf-8");
-}