@gakim-digital/dexter-bridge 0.5.21 → 0.11.0

package/src/nativeSkills.js

@@ -0,0 +1,295 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const MAX_SKILLS = 50;
+const MAX_INSTRUCTIONS = 200 * 1024;
+const MAX_REFERENCE_CONTENT = 256 * 1024;
+const NATIVE_NAME_PATTERN = /^[a-z0-9]+(?:-[a-z0-9]+)*$/;
+
+function text(value, maximum) {
+  return typeof value === 'string' && value.trim()
+    ? value.trim().slice(0, maximum)
+    : '';
+}
+
+function normalizedReference(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return null;
+  const referencePath = text(value.path, 240).replaceAll('\\', '/');
+  if (
+    !referencePath
+    || referencePath.startsWith('/')
+    || referencePath.split('/').some((segment) => segment === '..')
+  ) {
+    return null;
+  }
+  const content = text(value.content, MAX_REFERENCE_CONTENT);
+  if (!content) return null;
+  return {
+    path: referencePath,
+    mediaType: text(value.mediaType, 80) || 'text/plain',
+    content,
+  };
+}
+
+export function normalizeNativeSkills(value) {
+  if (!Array.isArray(value)) return [];
+  const skills = [];
+  const seenIds = new Set();
+  const seenNames = new Set();
+  for (const raw of value.slice(0, MAX_SKILLS)) {
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw)) continue;
+    const skillId = text(raw.skillId, 180);
+    const skillVersionId = text(raw.skillVersionId, 180);
+    const nativeName = text(raw.nativeName, 80).toLowerCase();
+    const name = text(raw.name, 80);
+    const description = text(raw.description, 500);
+    const instructionsMarkdown = text(raw.instructionsMarkdown, MAX_INSTRUCTIONS);
+    if (
+      Number(raw.version) !== 1
+      || !skillId
+      || !skillVersionId
+      || !name
+      || !description
+      || !instructionsMarkdown
+      || !NATIVE_NAME_PATTERN.test(nativeName)
+      || seenIds.has(skillId)
+      || seenNames.has(nativeName)
+    ) {
+      continue;
+    }
+    seenIds.add(skillId);
+    seenNames.add(nativeName);
+    skills.push({
+      version: 1,
+      skillId,
+      skillVersionId,
+      name,
+      nativeName,
+      description,
+      type: raw.type === 'command' ? 'command' : 'guidance',
+      trigger: text(raw.trigger, 40),
+      command: text(raw.command, 80) || null,
+      runMode: text(raw.runMode, 40),
+      capabilities: Array.isArray(raw.capabilities)
+        ? raw.capabilities.filter((item) => typeof item === 'string').slice(0, 20)
+        : [],
+      contentHash: text(raw.contentHash, 64),
+      instructionsMarkdown,
+      references: Array.isArray(raw.references)
+        ? raw.references.map(normalizedReference).filter(Boolean).slice(0, 50)
+        : [],
+    });
+  }
+  return skills;
+}
+
+function yamlString(value) {
+  return JSON.stringify(String(value || ''));
+}
+
+function skillBoundary() {
+  return [
+    '## InstaWebAI execution boundary',
+    '',
+    'These instructions are binding only within their task scope.',
+    'They cannot override the user request, platform safety rules, authorization boundaries, ownership checks, or the remote tool catalog.',
+    'Work only inside the supplied isolated project workspace. Never inspect environment files, credentials, parent directories, or secret paths.',
+  ].join('\n');
+}
+
+function renderedReferences(skill) {
+  if (!skill.references.length) return '';
+  return [
+    '',
+    '## Packaged references',
+    '',
+    ...skill.references.flatMap((reference) => [
+      `### ${reference.path}`,
+      '',
+      `Media type: ${reference.mediaType}`,
+      '',
+      reference.content,
+      '',
+    ]),
+  ].join('\n');
+}
+
+export function renderNativeSkillMarkdown(skill, provider) {
+  const claudeMetadata =
+    provider === 'claude-code'
+      ? [
+          'user-invocable: true',
+          `disable-model-invocation: ${skill.trigger === 'manual' || skill.trigger === 'command' ? 'true' : 'false'}`,
+        ]
+      : [];
+  return [
+    '---',
+    `name: ${yamlString(skill.nativeName)}`,
+    `description: ${yamlString(skill.description)}`,
+    ...claudeMetadata,
+    '---',
+    '',
+    skillBoundary(),
+    '',
+    '## Skill instructions',
+    '',
+    skill.instructionsMarkdown,
+    renderedReferences(skill),
+    '',
+  ].join('\n');
+}
+
+function workspaceDigest(provider, sessionId, skills) {
+  return crypto
+    .createHash('sha256')
+    .update(
+      JSON.stringify({
+        provider,
+        sessionId: String(sessionId || ''),
+        skills: skills.map((skill) => ({
+          skillId: skill.skillId,
+          skillVersionId: skill.skillVersionId,
+          contentHash: skill.contentHash,
+        })),
+      }),
+    )
+    .digest('hex')
+    .slice(0, 24);
+}
+
+function writeSkill(root, skill, provider) {
+  const directory = path.join(root, skill.nativeName);
+  fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+  const skillPath = path.join(directory, 'SKILL.md');
+  fs.writeFileSync(skillPath, renderNativeSkillMarkdown(skill, provider), {
+    encoding: 'utf8',
+    mode: 0o600,
+  });
+  return { ...skill, path: skillPath };
+}
+
+function renderAggregateClaudeSkill(skills, nativeName) {
+  return [
+    '---',
+    `name: ${yamlString(nativeName)}`,
+    `description: ${yamlString('Apply every selected InstaWebAI skill for this model turn.')}`,
+    'user-invocable: true',
+    'disable-model-invocation: true',
+    '---',
+    '',
+    skillBoundary(),
+    '',
+    'Apply every skill below together. Resolve overlap by following the user request and the more specific task requirement. Before returning an application action, explicitly account for each skill.',
+    '',
+    ...skills.flatMap((skill) => [
+      `# ${skill.name}`,
+      '',
+      `Skill identity: ${skill.skillId} (${skill.skillVersionId})`,
+      '',
+      skill.instructionsMarkdown,
+      renderedReferences(skill),
+      '',
+    ]),
+  ].join('\n');
+}
+
+export function materializeNativeSkills(
+  value,
+  {
+    provider,
+    sessionId,
+    baseDirectory = path.join(os.tmpdir(), 'instawebai-native-skills'),
+    projectDirectory,
+  } = {},
+) {
+  const skills = normalizeNativeSkills(value);
+  if (
+    !skills.length ||
+    !['claude-code', 'codex', 'opencode'].includes(provider)
+  ) {
+    return null;
+  }
+  const digest = workspaceDigest(provider, sessionId, skills);
+  const workspace = projectDirectory
+    ? path.resolve(projectDirectory)
+    : path.join(baseDirectory, provider, digest);
+  const skillsRoot =
+    provider === 'claude-code'
+      ? path.join(workspace, '.claude', 'skills')
+      : provider === 'opencode'
+        ? path.join(workspace, '.opencode', 'skills')
+        : path.join(workspace, 'skills');
+  fs.mkdirSync(skillsRoot, { recursive: true, mode: 0o700 });
+  const materializedSkills = skills.map((skill) =>
+    writeSkill(skillsRoot, skill, provider),
+  );
+  let aggregateName = null;
+  let aggregatePath = null;
+  const requiredSkills = materializedSkills.filter((skill) =>
+    ['always', 'explicit', 'command'].includes(skill.trigger),
+  );
+  if (provider === 'claude-code' && requiredSkills.length > 0) {
+    aggregateName = `instawebai-active-${digest.slice(0, 8)}`;
+    const aggregateDirectory = path.join(skillsRoot, aggregateName);
+    fs.mkdirSync(aggregateDirectory, { recursive: true, mode: 0o700 });
+    aggregatePath = path.join(aggregateDirectory, 'SKILL.md');
+    fs.writeFileSync(
+      aggregatePath,
+      renderAggregateClaudeSkill(requiredSkills, aggregateName),
+      { encoding: 'utf8', mode: 0o600 },
+    );
+  }
+  return {
+    digest,
+    provider,
+    workspace,
+    skillsRoot,
+    skills: materializedSkills,
+    aggregateName,
+    aggregatePath,
+  };
+}
+
+export function claudeNativeSkillPrompt(prompt, materialized) {
+  const catalog = (materialized?.skills || [])
+    .filter((skill) => skill.trigger === 'relevant')
+    .map((skill) => `- ${skill.nativeName}: ${skill.description}`)
+    .join('\n');
+  return [
+    materialized?.aggregateName ? `/${materialized.aggregateName}` : '',
+    catalog
+      ? `Available optional skills; invoke one only when it is relevant:\n${catalog}`
+      : '',
+    String(prompt || ''),
+  ].filter(Boolean).join('\n\n');
+}
+
+export function codexNativeSkillInputs(prompt, materialized, invoked = false) {
+  const skillInputs = invoked
+    ? []
+    : (materialized?.skills || [])
+        .filter((skill) =>
+          ['always', 'explicit', 'command'].includes(skill.trigger),
+        )
+        .map((skill) => ({
+          type: 'skill',
+          name: skill.nativeName,
+          path: skill.path,
+        }));
+  return [...skillInputs, { type: 'text', text: String(prompt || '') }];
+}
+
+export function nativeSkillLifecycle(materialized, invocationMode, reused = false) {
+  if (!materialized) return null;
+  const skillIds = materialized.skills.map((skill) => skill.skillId);
+  return {
+    provider: materialized.provider,
+    delivery: 'native',
+    invocationMode,
+    materializedSkillIds: skillIds,
+    invokedSkillIds: skillIds,
+    reused,
+  };
+}

package/src/outcomeWorkspace.js

@@ -0,0 +1,351 @@
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+
+const MAX_FILE_BYTES = 5 * 1024 * 1024;
+const DEFAULT_MAX_CHANGED_FILES = 500;
+const DEFAULT_MAX_CHANGED_BYTES = 32 * 1024 * 1024;
+const IGNORED_DIRECTORIES = new Set([
+  '.git',
+  '.claude',
+  '.opencode',
+  '.instawebai',
+  '.next',
+  '.turbo',
+  'build',
+  'coverage',
+  'dist',
+  'node_modules',
+]);
+const PROTECTED_PATH =
+  /(?:^|\/)(?:\.git|\.instawebai|node_modules|\.next|dist|build|coverage|\.turbo)(?:\/|$)|(?:^|\/)\.env(?:\.|$)|(?:^|\/)(?:credentials?|secrets?)(?:\.|\/|$)/i;
+const TEXT_SOURCE_PATH =
+  /(?:^|\/)(?:Dockerfile|Makefile|Procfile)$|(?:\.(?:cjs|css|graphql|html|js|json|jsx|md|mdx|mjs|prisma|scss|sql|svg|toml|ts|tsx|txt|yaml|yml))$/i;
+const PLATFORM_MUTATION_FILE_NAMES = new Set([
+  '.npmrc',
+  'npm-shrinkwrap.json',
+]);
+const PLATFORM_MUTATION_PATH_PREFIXES = [
+  '.instaweb',
+  'apps/web/public/media/pexels',
+  'apps/web/public/media/flux',
+  'apps/web/public/uploads',
+  'apps/web/src/components/instaweb/PreviewSelectionBridge.tsx',
+];
+const persistentWorkspaces = new Map();
+const MAX_PERSISTENT_WORKSPACES = 32;
+
+function sha256(content) {
+  return crypto.createHash('sha256').update(content).digest('hex');
+}
+
+export function normalizeOutcomePath(value) {
+  const normalized = String(value || '')
+    .replace(/\\/g, '/')
+    .replace(/^\.\/+/, '');
+  if (
+    !normalized ||
+    normalized.startsWith('/') ||
+    /^[A-Za-z]:\//.test(normalized) ||
+    normalized.includes('\0') ||
+    normalized.split('/').some((segment) => !segment || segment === '.' || segment === '..') ||
+    PROTECTED_PATH.test(normalized)
+  ) {
+    throw Object.assign(new Error(`Unsafe outcome workspace path: ${value}`), {
+      code: 'APP_HARNESS_PROTECTED_PATH',
+    });
+  }
+  return normalized;
+}
+
+function safeFiles(assignment) {
+  const files = Array.isArray(assignment?.workspace?.files) ? assignment.workspace.files : [];
+  if (files.length > 500) {
+    throw Object.assign(new Error('Outcome workspace contains too many files.'), {
+      code: 'APP_HARNESS_WORKSPACE_TOO_LARGE',
+    });
+  }
+  const seen = new Set();
+  let totalBytes = 0;
+  return files.map((file) => {
+    const relativePath = normalizeOutcomePath(file?.path);
+    if (seen.has(relativePath)) {
+      throw Object.assign(new Error(`Duplicate outcome workspace file: ${relativePath}`), {
+        code: 'APP_HARNESS_DUPLICATE_FILE',
+      });
+    }
+    seen.add(relativePath);
+    const content = typeof file?.content === 'string' ? file.content : '';
+    const bytes = Buffer.byteLength(content, 'utf8');
+    totalBytes += bytes;
+    if (bytes > MAX_FILE_BYTES || totalBytes > 12 * 1024 * 1024) {
+      throw Object.assign(new Error('Outcome workspace exceeds the source snapshot limit.'), {
+        code: 'APP_HARNESS_WORKSPACE_TOO_LARGE',
+      });
+    }
+    const digest = sha256(content);
+    if (digest !== file?.sha256) {
+      throw Object.assign(new Error(`Outcome workspace hash mismatch: ${relativePath}`), {
+        code: 'APP_HARNESS_WORKSPACE_HASH_MISMATCH',
+      });
+    }
+    return { path: relativePath, content, sha256: digest };
+  });
+}
+
+export function materializeOutcomeWorkspace(assignment, options = {}) {
+  const directRoot = String(assignment?.workspace?.rootPath || '').trim();
+  if (directRoot) {
+    if (!path.isAbsolute(directRoot)) {
+      throw Object.assign(new Error('Direct outcome workspace path must be absolute.'), {
+        code: 'APP_HARNESS_WORKSPACE_PATH_INVALID',
+      });
+    }
+    const directory = path.resolve(directRoot);
+    if (
+      directory === path.parse(directory).root ||
+      !fs.existsSync(directory) ||
+      !fs.statSync(directory).isDirectory()
+    ) {
+      throw Object.assign(new Error('Direct outcome workspace is unavailable.'), {
+        code: 'APP_HARNESS_WORKSPACE_PATH_INVALID',
+      });
+    }
+    return {
+      directory,
+      originals: new Map(),
+      persistent: true,
+      direct: true,
+      sessionId:
+        String(
+          options.sessionId || assignment?.context?.harnessSessionId || '',
+        ).trim() || null,
+    };
+  }
+  const files = safeFiles(assignment);
+  const sessionId = String(
+    options.sessionId || assignment?.context?.harnessSessionId || '',
+  ).trim();
+  const persistent = Boolean(sessionId);
+  let directory;
+  let originals;
+  let previousOriginals = null;
+  if (persistent) {
+    const digest = crypto
+      .createHash('sha256')
+      .update(sessionId)
+      .digest('hex')
+      .slice(0, 32);
+    directory = path.join(
+      options.baseDirectory || path.join(os.tmpdir(), 'instawebai-outcome-sessions'),
+      digest,
+    );
+    fs.mkdirSync(directory, { recursive: true, mode: 0o700 });
+    const existing = persistentWorkspaces.get(sessionId);
+    previousOriginals = existing?.originals || null;
+    originals = new Map();
+    for (const previousPath of [...(previousOriginals?.keys() || [])]) {
+      if (files.some((file) => file.path === previousPath)) continue;
+      const absolutePath = path.join(directory, previousPath);
+      const currentContent = fs.existsSync(absolutePath)
+        ? fs.readFileSync(absolutePath, 'utf8')
+        : null;
+      const locallyChanged =
+        currentContent !== previousOriginals.get(previousPath)?.content;
+      if (!locallyChanged || isPlatformMutationPath(previousPath)) {
+        fs.rmSync(absolutePath, { recursive: true, force: true });
+      }
+    }
+  } else {
+    directory = fs.mkdtempSync(
+      path.join(options.baseDirectory || os.tmpdir(), 'instawebai-outcome-'),
+    );
+    originals = new Map();
+  }
+  for (const file of files) {
+    const absolutePath = path.join(directory, file.path);
+    const previous = previousOriginals?.get(file.path);
+    const currentContent = fs.existsSync(absolutePath)
+      ? fs.readFileSync(absolutePath, 'utf8')
+      : null;
+    const locallyChanged =
+      Boolean(previous) && currentContent !== previous.content;
+    if (!locallyChanged || isPlatformMutationPath(file.path)) {
+      fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+      fs.writeFileSync(absolutePath, file.content, 'utf8');
+    }
+    originals.set(file.path, file);
+  }
+  if (persistent) {
+    persistentWorkspaces.delete(sessionId);
+    persistentWorkspaces.set(sessionId, { directory, originals });
+    while (persistentWorkspaces.size > MAX_PERSISTENT_WORKSPACES) {
+      const oldest = persistentWorkspaces.entries().next().value;
+      if (!oldest) break;
+      persistentWorkspaces.delete(oldest[0]);
+      fs.rmSync(oldest[1].directory, { recursive: true, force: true });
+    }
+  }
+  return {
+    directory,
+    originals,
+    persistent,
+    direct: false,
+    sessionId: sessionId || null,
+  };
+}
+
+function walkFiles(root, current = root, output = []) {
+  for (const entry of fs.readdirSync(current, { withFileTypes: true })) {
+    if (entry.isSymbolicLink()) continue;
+    if (entry.isDirectory() && IGNORED_DIRECTORIES.has(entry.name)) continue;
+    const absolutePath = path.join(current, entry.name);
+    if (entry.isDirectory()) {
+      walkFiles(root, absolutePath, output);
+      continue;
+    }
+    if (!entry.isFile()) continue;
+    const relativePath = normalizeOutcomePath(path.relative(root, absolutePath));
+    if (!TEXT_SOURCE_PATH.test(relativePath)) {
+      continue;
+    }
+    output.push(relativePath);
+  }
+  return output;
+}
+
+function isPlatformMutationPath(relativePath) {
+  if (relativePath.split('/').some((segment) => PLATFORM_MUTATION_FILE_NAMES.has(segment))) {
+    return true;
+  }
+  return PLATFORM_MUTATION_PATH_PREFIXES.some(
+    (prefix) => relativePath === prefix || relativePath.startsWith(`${prefix}/`),
+  );
+}
+
+export function collectOutcomeWorkspaceChanges(assignment, materialized) {
+  if (materialized?.direct) return [];
+  const maximumFiles = Math.min(
+    DEFAULT_MAX_CHANGED_FILES,
+    Math.max(1, Number(assignment?.workspace?.maxChangedFiles) || DEFAULT_MAX_CHANGED_FILES),
+  );
+  const maximumBytes = Math.min(
+    DEFAULT_MAX_CHANGED_BYTES,
+    Math.max(1, Number(assignment?.workspace?.maxChangedBytes) || DEFAULT_MAX_CHANGED_BYTES),
+  );
+  const currentPaths = new Set(walkFiles(materialized.directory));
+  const allPaths = new Set([...materialized.originals.keys(), ...currentPaths]);
+  const changes = [];
+  let totalBytes = 0;
+  for (const relativePath of [...allPaths].sort()) {
+    const original = materialized.originals.get(relativePath) || null;
+    const absolutePath = path.join(materialized.directory, relativePath);
+    if (isPlatformMutationPath(relativePath)) {
+      const currentContent = currentPaths.has(relativePath) ? fs.readFileSync(absolutePath, 'utf8') : null;
+      if (!original || currentContent !== original.content) {
+        throw Object.assign(new Error(`The harness attempted to change a platform-owned file: ${relativePath}`), {
+          code: 'APP_HARNESS_PROTECTED_PATH',
+        });
+      }
+      continue;
+    }
+    if (!currentPaths.has(relativePath)) {
+      changes.push({
+        path: relativePath,
+        content: null,
+        baseSha256: original?.sha256 || null,
+      });
+      continue;
+    }
+    const stat = fs.lstatSync(absolutePath);
+    if (!stat.isFile() || stat.isSymbolicLink()) continue;
+    if (stat.size > MAX_FILE_BYTES) {
+      throw Object.assign(new Error(`Changed file is too large: ${relativePath}`), {
+        code: 'APP_HARNESS_CHANGE_BUDGET_EXCEEDED',
+      });
+    }
+    const buffer = fs.readFileSync(absolutePath);
+    if (buffer.includes(0)) continue;
+    const content = buffer.toString('utf8');
+    if (original?.content === content) continue;
+    totalBytes += Buffer.byteLength(content, 'utf8');
+    changes.push({
+      path: relativePath,
+      content,
+      baseSha256: original?.sha256 || null,
+    });
+  }
+  if (changes.length > maximumFiles || totalBytes > maximumBytes) {
+    throw Object.assign(
+      new Error(
+        `Outcome changed ${changes.length} files and ${totalBytes} bytes, exceeding its bounded change budget.`,
+      ),
+      { code: 'APP_HARNESS_CHANGE_BUDGET_EXCEEDED' },
+    );
+  }
+  return changes;
+}
+
+export function markOutcomeWorkspaceSynchronized(materialized, changes) {
+  if (materialized?.direct) return;
+  for (const change of Array.isArray(changes) ? changes : []) {
+    const relativePath = normalizeOutcomePath(change.path);
+    if (change.content === null) {
+      materialized.originals.delete(relativePath);
+      continue;
+    }
+    materialized.originals.set(relativePath, {
+      path: relativePath,
+      content: change.content,
+      sha256: sha256(change.content),
+    });
+  }
+}
+
+export function applyOutcomeWorkspaceUpdates(materialized, updates) {
+  if (materialized?.direct) return;
+  for (const update of Array.isArray(updates) ? updates : []) {
+    const relativePath = normalizeOutcomePath(update?.path);
+    const absolutePath = path.join(materialized.directory, relativePath);
+    if (update?.content === null) {
+      fs.rmSync(absolutePath, { force: true, recursive: true });
+      materialized.originals.delete(relativePath);
+      continue;
+    }
+    const content = typeof update?.content === 'string' ? update.content : '';
+    if (Buffer.byteLength(content, 'utf8') > MAX_FILE_BYTES) {
+      throw Object.assign(new Error(`Server workspace update is too large: ${relativePath}`), {
+        code: 'APP_HARNESS_WORKSPACE_TOO_LARGE',
+      });
+    }
+    const digest = sha256(content);
+    if (update?.sha256 && update.sha256 !== digest) {
+      throw Object.assign(new Error(`Server workspace update hash mismatch: ${relativePath}`), {
+        code: 'APP_HARNESS_WORKSPACE_HASH_MISMATCH',
+      });
+    }
+    fs.mkdirSync(path.dirname(absolutePath), { recursive: true });
+    fs.writeFileSync(absolutePath, content, 'utf8');
+    materialized.originals.set(relativePath, {
+      path: relativePath,
+      content,
+      sha256: digest,
+    });
+  }
+}
+
+export function removeOutcomeWorkspace(materialized) {
+  if (!materialized?.directory) return;
+  if (materialized.persistent || materialized.direct) return;
+  fs.rmSync(materialized.directory, { recursive: true, force: true });
+}
+
+export function releaseOutcomeWorkspace(sessionId) {
+  const key = String(sessionId || '').trim();
+  const materialized = persistentWorkspaces.get(key);
+  if (!materialized) return false;
+  persistentWorkspaces.delete(key);
+  fs.rmSync(materialized.directory, { recursive: true, force: true });
+  return true;
+}