@garygentry/system1 0.4.0 → 0.5.0

package/dist/bundle/chunks/guard-TZPV4JV3.mjs

@@ -0,0 +1,113 @@
+import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
+import {
+  typedParse
+} from "./chunk-SUUJE62R.mjs";
+import "./chunk-45YUIPYC.mjs";
+import {
+  PACKS,
+  PACK_NAMES,
+  isPackName,
+  loadConfig,
+  repoConfigPath,
+  setGuardEnabled
+} from "./chunk-TMAJXDTE.mjs";
+import {
+  emit
+} from "./chunk-WVMA3PGV.mjs";
+import "./chunk-7OZLIHEM.mjs";
+import {
+  DecisionsError
+} from "./chunk-MH6THLCO.mjs";
+
+// src/commands/guard.ts
+function runGuardCommand(argv, io, format) {
+  return emit(
+    io,
+    "guard",
+    format,
+    () => body(argv, io),
+    (r, f) => f === "brief" ? brief(r) : void 0
+  );
+}
+var GUARD_OPTIONS = { "i-consent": { type: "boolean" }, by: { type: "string" } };
+function body(argv, io) {
+  const { values, positionals } = typedParse({
+    args: argv,
+    allowPositionals: true,
+    options: GUARD_OPTIONS
+  });
+  const [action = "list", name] = positionals;
+  const cwd = io.cwd ?? process.cwd();
+  const load = () => loadConfig({ cwd, env: io.env, ...io.home ? { home: io.home } : {} });
+  const config = load();
+  const file = repoConfigPath(config.repoRoot);
+  const result = (c = config, changed) => ({
+    file,
+    consent: c.egress.consent.granted,
+    packs: PACK_NAMES.map((n) => ({
+      name: n,
+      summary: PACKS[n].summary,
+      ...c.guard.packs[n],
+      active: c.guard.packs[n].enabled && c.egress.consent.granted
+    })),
+    ...changed ? { changed } : {}
+  });
+  switch (action) {
+    case "list":
+    case "status":
+      return result();
+    case "enable":
+    case "disable": {
+      const pack = packName(name);
+      if (action === "disable") {
+        setGuardEnabled(config.repoRoot, pack, false, values.by ?? "decide guard disable");
+        return result(load(), pack);
+      }
+      if (!config.egress.consent.granted) {
+        throw new DecisionsError(
+          "egress-refused",
+          `Enabling ${pack} sends content to the decision model's provider, and this repo has not agreed to that. Grant egress consent first (see \`decide doctor\`); it is the user's decision, and an agent must not make it.`,
+          { repoRoot: config.repoRoot }
+        );
+      }
+      if (!io.interactive && !values["i-consent"]) {
+        throw new DecisionsError(
+          "egress-refused",
+          `Enabling a guard pack is the user's decision. An agent must not enable it, with or without a flag: show the user this message instead. The user enables it by typing \`decide guard enable ${pack}\` in a terminal at the repo root. If they run it through their agent prompt's shell escape instead (not as a chat message), there is no terminal, so they add --i-consent to say the decision is theirs.`
+        );
+      }
+      setGuardEnabled(
+        config.repoRoot,
+        pack,
+        true,
+        values.by ?? (io.interactive ? "decide guard" : "decide guard --i-consent")
+      );
+      return result(load(), pack);
+    }
+    default:
+      throw new DecisionsError(
+        "invalid-request",
+        `Unknown guard action "${action}". Use: list, status, enable <pack>, disable <pack>`
+      );
+  }
+}
+function packName(name) {
+  if (name && isPackName(name)) return name;
+  throw new DecisionsError(
+    "invalid-request",
+    `${name ? `Unknown guard pack "${name}"` : "Name a guard pack"}. Known: ${PACK_NAMES.join(", ")}`
+  );
+}
+function brief(r) {
+  const lines = r.packs.map((p) => {
+    const state = p.active ? "active" : p.enabled ? "enabled, but no egress consent: dormant" : "dormant";
+    return `${p.name}: ${state}${p.name === r.changed ? " (changed)" : ""} \xB7 ${p.summary}`;
+  });
+  return [...lines, `egress consent: ${r.consent ? "granted" : "not granted"} (${r.file})`].join(
+    "\n"
+  );
+}
+export {
+  GUARD_OPTIONS,
+  runGuardCommand
+};

package/dist/bundle/chunks/hook-LZ37YGT4.mjs

@@ -0,0 +1,189 @@
+import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
+import {
+  typedParse
+} from "./chunk-SUUJE62R.mjs";
+import "./chunk-45YUIPYC.mjs";
+import {
+  isPackName,
+  loadConfig
+} from "./chunk-TMAJXDTE.mjs";
+import {
+  EXIT
+} from "./chunk-7OZLIHEM.mjs";
+import {
+  isDecisionsError
+} from "./chunk-MH6THLCO.mjs";
+
+// src/commands/hook.ts
+import { readFileSync } from "node:fs";
+
+// ../core/dist/tools/hook.js
+var HOOK_LATENCY_CEILING_MS = 55e3;
+var SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
+function checkHookEvent(input) {
+  if (typeof input !== "object" || input === null || Array.isArray(input))
+    return ["/ must be an object"];
+  const e = input;
+  const problems = [];
+  for (const key of ["hook_event_name", "session_id", "cwd"]) {
+    if (typeof e[key] !== "string" || !e[key])
+      problems.push(`/${key} must be a non-empty string`);
+  }
+  if (e.stop_hook_active !== void 0 && typeof e.stop_hook_active !== "boolean")
+    problems.push("/stop_hook_active must be a boolean");
+  for (const key of ["source", "turn_id"]) {
+    if (e[key] !== void 0 && typeof e[key] !== "string")
+      problems.push(`/${key} must be a string`);
+  }
+  return problems;
+}
+var say = (pack, text) => ({
+  systemMessage: `System 1 ${pack}: ${text}`
+});
+async function runHook(pack, rawEvent, options = {}) {
+  const now = options.now ?? /* @__PURE__ */ new Date();
+  const event = rawEvent;
+  const problems = checkHookEvent(rawEvent);
+  const cwd = problems.length === 0 ? event.cwd : options.cwd ?? process.cwd();
+  const harness = options.harness ?? (typeof event?.turn_id === "string" ? "codex" : "claude");
+  const usableId = problems.length === 0 && SESSION_ID.test(event.session_id);
+  const env = options.env ?? process.env;
+  const session = env.SYSTEM1_SESSION || (usableId ? `${harness}:${event.session_id}` : void 0);
+  let config;
+  try {
+    config = loadConfig({
+      ...options,
+      cwd,
+      env: session ? { ...env, SYSTEM1_SESSION: session } : env
+    });
+  } catch {
+    return {};
+  }
+  if (!isPackName(pack))
+    return {};
+  const settings = config.guard.packs[pack];
+  if (!settings.enabled || !config.egress.consent.granted)
+    return {};
+  if (problems.length > 0) {
+    return say(pack, `not checked: the harness sent an unexpected event (${problems[0]})`);
+  }
+  if (event.stop_hook_active === true)
+    return {};
+  if (!usableId)
+    return say(pack, "not checked: the harness sent a session id it can't use");
+  const latencyMs = Math.min(settings.latencyMs, HOOK_LATENCY_CEILING_MS);
+  const controller = new AbortController();
+  let timer;
+  const deadline = new Promise((resolve) => {
+    timer = setTimeout(() => {
+      controller.abort();
+      resolve(say(pack, `not checked: it took longer than ${latencyMs} ms (latencyMs)`));
+    }, latencyMs);
+  });
+  const work = (async () => {
+    const mod = options.packs?.[pack] ?? await import("./done-check-PCXUZT7Q.mjs");
+    const ctx = {
+      repoRoot: config.repoRoot,
+      sessionKey: `${harness}:${event.session_id}`,
+      ledgerSession: config.session ?? `${harness}:${event.session_id}`,
+      tool: {
+        cwd: config.repoRoot,
+        env: session ? { ...env, SYSTEM1_SESSION: session } : env,
+        ...options.home ? { home: options.home } : {},
+        ...options.fetch ? { fetch: options.fetch } : {}
+      },
+      harness,
+      pack: settings,
+      event,
+      signal: controller.signal,
+      now,
+      ...options.mode ? { mode: options.mode } : {}
+    };
+    if (event.hook_event_name === "SessionStart")
+      return mod.sessionStart(ctx);
+    if (event.hook_event_name === "Stop")
+      return mod.stop(ctx);
+    return {};
+  })().catch((error) => say(pack, `not checked: ${failOpenReason(error, latencyMs)}`));
+  try {
+    return await Promise.race([work, deadline]);
+  } finally {
+    clearTimeout(timer);
+  }
+}
+function failOpenReason(error, latencyMs) {
+  if (error?.name === "AbortError")
+    return `it took longer than ${latencyMs} ms (latencyMs)`;
+  if (!isDecisionsError(error))
+    return "an internal error; run `decide doctor`";
+  switch (error.code) {
+    case "egress-refused":
+      return "this repo has no egress consent";
+    case "no-key":
+      return "no API key is set";
+    case "provider-unreachable":
+    case "provider-http":
+    case "malformed-response":
+    case "unknown-model":
+      return `the decision model's provider failed (${error.code})`;
+    case "replay-miss":
+      return "replay is forced (SYSTEM1_REPLAY) and has no recorded answer";
+    case "budget-exceeded":
+      return error.message.split("\n")[0] ?? "the spend cap was reached";
+    case "state-too-large":
+      return "the change is too large to send";
+    case "source-error":
+      return `git failed (${error.message})`;
+    case "invalid-request":
+    case "config-error":
+      return error.message.split("\n")[0] ?? error.code;
+    default:
+      return "an internal error; run `decide doctor`";
+  }
+}
+
+// src/commands/hook.ts
+var HOOK_OPTIONS = { harness: { type: "string" } };
+var MAX_EVENT_BYTES = 1024 * 1024;
+async function runHookCommand(argv, io) {
+  io.out(JSON.stringify(await respond(argv, io)));
+  io.exitWhenFlushed?.();
+  return EXIT.ok;
+}
+async function respond(argv, io) {
+  let pack;
+  let harness;
+  try {
+    const { values, positionals } = typedParse({
+      args: argv,
+      allowPositionals: true,
+      options: HOOK_OPTIONS
+    });
+    pack = positionals[0];
+    harness = values.harness;
+  } catch (error) {
+    return { systemMessage: `System 1 hook: not run: ${error.message}` };
+  }
+  if (!pack) return { systemMessage: "System 1 hook: not run: name a guard pack" };
+  if (harness !== void 0 && harness !== "claude" && harness !== "codex") {
+    return { systemMessage: `System 1 ${pack}: not run: --harness must be claude or codex` };
+  }
+  let event;
+  try {
+    const text = (io.readStdin ?? (() => readFileSync(0, "utf8")))();
+    if (Buffer.byteLength(text) > MAX_EVENT_BYTES) throw new Error("too large");
+    event = JSON.parse(text);
+  } catch {
+    event = void 0;
+  }
+  return runHook(pack, event, {
+    env: io.env,
+    ...io.cwd ? { cwd: io.cwd } : {},
+    ...io.home ? { home: io.home } : {},
+    ...harness ? { harness } : {}
+  });
+}
+export {
+  HOOK_OPTIONS,
+  runHookCommand
+};

package/dist/bundle/chunks/{misc-6SDKH2PI.mjs → misc-CZLLPSHU.mjs}

@@ -1,22 +1,28 @@
 import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
 import {
   typedParse
-} from "./chunk-XNRV73UE.mjs";
+} from "./chunk-SUUJE62R.mjs";
 import {
-  TOOL_SCHEMAS,
-  createContext,
-  loadConfig,
   ping,
   probeUrl,
   resolveConnection,
   runUsage
-} from "./chunk-QYUSJUFX.mjs";
+} from "./chunk-45YUIPYC.mjs";
+import {
+  TOOL_SCHEMAS,
+  createContext,
+  loadConfig
+} from "./chunk-TMAJXDTE.mjs";
+import {
+  emit
+} from "./chunk-WVMA3PGV.mjs";
+import {
+  EXIT
+} from "./chunk-7OZLIHEM.mjs";
 import {
   DecisionsError,
-  EXIT,
-  emit,
   isDecisionsError
-} from "./chunk-WZIVOY5Q.mjs";
+} from "./chunk-MH6THLCO.mjs";
 
 // src/commands/misc.ts
 function runSchemaCommand(argv, io, format) {

package/dist/bundle/chunks/{opportunities-ONEIYAG3.mjs → opportunities-ICJLJYG4.mjs}

@@ -1,17 +1,22 @@
 import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
 import {
   typedParse
-} from "./chunk-XNRV73UE.mjs";
+} from "./chunk-SUUJE62R.mjs";
 import {
-  createContext,
   runOpportunitiesAdd,
   runOpportunitiesCheck,
   runOpportunitiesList
-} from "./chunk-QYUSJUFX.mjs";
+} from "./chunk-45YUIPYC.mjs";
+import {
+  createContext
+} from "./chunk-TMAJXDTE.mjs";
 import {
-  DecisionsError,
   emit
-} from "./chunk-WZIVOY5Q.mjs";
+} from "./chunk-WVMA3PGV.mjs";
+import "./chunk-7OZLIHEM.mjs";
+import {
+  DecisionsError
+} from "./chunk-MH6THLCO.mjs";
 
 // src/commands/opportunities.ts
 import { readFileSync } from "node:fs";

package/dist/bundle/chunks/{route-BF5J2NLU.mjs → route-D7T7YYDE.mjs}

@@ -1,14 +1,18 @@
 import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
 import {
   typedParse
-} from "./chunk-XNRV73UE.mjs";
+} from "./chunk-SUUJE62R.mjs";
 import {
   runRoute
-} from "./chunk-QYUSJUFX.mjs";
+} from "./chunk-45YUIPYC.mjs";
+import "./chunk-TMAJXDTE.mjs";
 import {
-  DecisionsError,
   emit
-} from "./chunk-WZIVOY5Q.mjs";
+} from "./chunk-WVMA3PGV.mjs";
+import "./chunk-7OZLIHEM.mjs";
+import {
+  DecisionsError
+} from "./chunk-MH6THLCO.mjs";
 
 // src/commands/route.ts
 import { readFileSync } from "node:fs";

package/dist/bundle/chunks/{spec-GLTPEEON.mjs → spec-6E5RXMGH.mjs}

@@ -5,21 +5,27 @@ import {
 } from "./chunk-FU3D2MBS.mjs";
 import {
   typedParse
-} from "./chunk-XNRV73UE.mjs";
+} from "./chunk-SUUJE62R.mjs";
+import {
+  runSpecCheck,
+  runSpecLint
+} from "./chunk-45YUIPYC.mjs";
 import {
   assertExamples,
   createContext,
   exampleProblems,
   listSpecs,
-  loadSpec,
-  runSpecCheck,
-  runSpecLint
-} from "./chunk-QYUSJUFX.mjs";
+  loadSpec
+} from "./chunk-TMAJXDTE.mjs";
 import {
-  DecisionsError,
-  EXIT,
   emit
-} from "./chunk-WZIVOY5Q.mjs";
+} from "./chunk-WVMA3PGV.mjs";
+import {
+  EXIT
+} from "./chunk-7OZLIHEM.mjs";
+import {
+  DecisionsError
+} from "./chunk-MH6THLCO.mjs";
 
 // src/commands/spec.ts
 function runSpecCommand(argv, io, format) {

package/dist/bundle/decide.mjs

@@ -4,4 +4,4 @@ import { createRequire as __decideRequire } from "node:module"; const require =
 // src/entry.ts
 import module from "node:module";
 module.enableCompileCache?.();
-await import("./chunks/bin-TIEUYIP3.mjs");
+await import("./chunks/bin-X4SS2GSC.mjs");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@garygentry/system1",
-  "version": "0.4.0",
+  "version": "0.5.0",
   "description": "The `decide` CLI: typed, calibrated decisions for coding agents, hooks and CI.",
   "type": "module",
   "license": "MIT",

package/dist/bundle/chunks/chunk-WZIVOY5Q.mjs

@@ -1,171 +0,0 @@
-import { createRequire as __decideRequire } from "node:module"; const require = __decideRequire(import.meta.url);
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __commonJS = (cb, mod) => function __require2() {
-  try {
-    return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-  } catch (e) {
-    throw mod = 0, e;
-  }
-};
-var __export = (target, all) => {
-  for (var name in all)
-    __defProp(target, name, { get: all[name], enumerable: true });
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-// ../core/dist/errors.js
-var DecisionsError = class extends Error {
-  code;
-  details;
-  constructor(code, message, details = {}) {
-    super(message);
-    this.code = code;
-    this.details = details;
-    this.name = "DecisionsError";
-  }
-};
-var ProviderError = class extends DecisionsError {
-  status;
-  constructor(code, message, status) {
-    super(code, message, status === void 0 ? {} : { status });
-    this.status = status;
-    this.name = "ProviderError";
-  }
-};
-function isDecisionsError(error) {
-  return error instanceof DecisionsError;
-}
-
-// src/exit-codes.ts
-var EXIT = {
-  ok: 0,
-  failure: 1,
-  usage: 2,
-  egressRefused: 3,
-  budgetGuard: 4,
-  providerError: 5,
-  replayMiss: 6,
-  /**
-   * The check ran and did not pass: `spec check --strict` (an example missed),
-   * or `spec lint` (an error-level finding or invalid spec; with `--strict`, any
-   * warning).
-   */
-  checkFailed: 7
-};
-var BY_CODE = {
-  "invalid-request": EXIT.usage,
-  "state-too-large": EXIT.usage,
-  "unknown-model": EXIT.usage,
-  "config-error": EXIT.usage,
-  "source-error": EXIT.usage,
-  "no-key": EXIT.usage,
-  "egress-refused": EXIT.egressRefused,
-  "budget-exceeded": EXIT.budgetGuard,
-  "provider-unreachable": EXIT.providerError,
-  "provider-http": EXIT.providerError,
-  "malformed-response": EXIT.providerError,
-  "replay-miss": EXIT.replayMiss
-};
-function exitFor(code) {
-  return code === "error" ? EXIT.failure : BY_CODE[code];
-}
-
-// src/envelope.ts
-var ENVELOPE_VERSION = 1;
-var FORMATS = ["json", "jsonl", "brief"];
-function ok(command, result) {
-  return { v: ENVELOPE_VERSION, ok: true, command, result };
-}
-function fail(command, code, message, details) {
-  return {
-    v: ENVELOPE_VERSION,
-    ok: false,
-    command,
-    error: { code, message, ...details && Object.keys(details).length ? { details } : {} }
-  };
-}
-
-// src/run.ts
-async function emit(io, command, format, body, render = () => void 0) {
-  try {
-    const result = await body();
-    io.out(render(result, format) ?? JSON.stringify(ok(command, result)));
-    return EXIT.ok;
-  } catch (error) {
-    const code = isDecisionsError(error) ? error.code : "error";
-    const message = error instanceof Error ? error.message : String(error);
-    const details = isDecisionsError(error) ? error.details : void 0;
-    io.out(
-      format === "brief" ? `decide ${command}: error ${code} \u2014 ${message}` : JSON.stringify(fail(command, code, message, details))
-    );
-    if (!isDecisionsError(error) && error instanceof Error && io.env.SYSTEM1_DEBUG)
-      io.err(error.stack ?? "");
-    return exitFor(code);
-  }
-}
-function extractFormat(argv, fallback) {
-  const rest = [];
-  let format;
-  for (let i = 0; i < argv.length; i += 1) {
-    const arg = argv[i];
-    if (arg === "--format") {
-      format = argv[i + 1];
-      i += 1;
-    } else if (arg.startsWith("--format=")) {
-      format = arg.slice("--format=".length);
-    } else {
-      rest.push(arg);
-    }
-  }
-  if (format === void 0) return { format: fallback, rest, explicit: false };
-  if (!FORMATS.includes(format)) {
-    throw new DecisionsError("invalid-request", `--format must be one of ${FORMATS.join(", ")}`);
-  }
-  return { format, rest, explicit: true };
-}
-
-// ../core/dist/version.js
-var VERSION = "0.4.0";
-var CLI_PACKAGE = "@garygentry/system1";
-
-export {
-  __require,
-  __commonJS,
-  __export,
-  __toESM,
-  DecisionsError,
-  ProviderError,
-  isDecisionsError,
-  VERSION,
-  CLI_PACKAGE,
-  EXIT,
-  ENVELOPE_VERSION,
-  emit,
-  extractFormat
-};