@gaunt-sloth/agent 2.0.0-alpha.9 → 2.0.0-beta.0

package/dist/modules/acpModule.js

@@ -1,78 +0,0 @@
-/**
- * @packageDocumentation
- * ACP (Agent Client Protocol) server entry for the Gaunt Sloth deep agent.
- *
- * This is a parallel front-door to the AG-UI server ({@link startAgUiServer}); both expose
- * the SAME {@link GthDeepAgent}. AG-UI stays the robot-controller path; ACP is an additional
- * way to drive Galvanized Pukeko from an ACP host (Zed, JetBrains, a future Pukeko client).
- *
- * It reuses {@link GthDeepAgent.buildDeepAgentParams} so tool resolution (with the filesystem
- * disabled so deepagents owns fs access), the `.aiignore`/filesystem→permission mapping and the
- * fs-denial-softening middleware are identical to the local runner path. `deepagents-acp`
- * supplies the rest of the coding-agent surface itself: a per-session `ACPFilesystemBackend`
- * (proxying reads/writes through the ACP client so unsaved editor buffers are visible), the
- * checkpointer, interactive `session/request_permission` gating, and tool-call/plan reporting.
- */
-import { getProcessCwd, stderr } from '@gaunt-sloth/core/utils/systemUtils.js';
-import { debugLog } from '@gaunt-sloth/core/utils/debugUtils.js';
-import { GthDeepAgent } from '#src/core/GthDeepAgent.js';
-import { startGthAcpServer } from '#src/core/gthAcpServer.js';
-import { createResolvers } from '#src/resolvers.js';
-/**
- * ACP-side status routing: the ACP protocol owns stdout (JSON-RPC framing), so agent
- * status/info must never touch it. Route everything to stderr.
- */
-const acpStatusUpdate = (_level, message) => {
-    stderr.write(`${message}\n`);
-};
-/**
- * Start the Gaunt Sloth deep agent as an ACP server over stdio.
- *
- * Resolves once the stdio transport is listening; the process then stays alive serving the
- * ACP host until it is terminated. The returned promise rejecting means startup failed.
- *
- * NOTE: deepagents-acp 0.1.12 does NOT forward `permissions` to `createDeepAgent` — on the ACP
- * path fs gating is delegated to the host's interactive permission prompts, not gsloth's
- * `.aiignore`→permissions mapping. `permissions` is still passed here for forward-compatibility.
- * EXT-13 caveat: the ACP backend keeps `virtualMode` ON (`/` = workspace, see gthAcpServer), while
- * EXT-13 re-anchored gsloth's default permissions at the REAL absolute cwd for the local runner. So
- * if a future deepagents-acp DOES forward these rules they would not match the virtual `/`-rooted
- * paths the ACP backend hands them — revisit the mapping (or the ACP backend's mode) at that point.
- */
-export async function startAcpServer(config, options = {}) {
-    const command = options.command ?? 'code';
-    // ACP is structurally deep-only: it calls GthDeepAgent.buildDeepAgentParams and hands the
-    // extracted params to the deepagents-acp server. There is no lean analog, so an explicit
-    // `agent.backend: 'lean'` cannot be honored here — reject it loudly rather than silently
-    // running deep despite the request (B5 selector, kept honest at the ACP entry).
-    if (config.agent?.backend === 'lean') {
-        throw new Error("agent.backend: 'lean' is not supported by the ACP server — ACP relies on the deep " +
-            '(deepagents) backend. Remove the lean setting, or use the AG-UI/api server for a lean agent.');
-    }
-    const agent = new GthDeepAgent(acpStatusUpdate, createResolvers());
-    const params = await agent.buildDeepAgentParams(command, config);
-    // gsloth's composed system prompt (backstory + guidelines + per-command mode prompt + system
-    // prompt) comes back on `params.systemPrompt` — the SAME prompt the local runner passes to
-    // createDeepAgent. ACP has no per-turn hook, so it sets the agent's `systemPrompt` here.
-    const systemPrompt = params.systemPrompt;
-    // workspaceRoot is only the startup default: startGthAcpServer re-roots the filesystem backend
-    // to each ACP session's `cwd` (the IDE's project root). Use the raw process cwd, not
-    // getCurrentWorkDir() — its INIT_CWD preference leaks stale paths into this long-lived subprocess.
-    const workspaceRoot = getProcessCwd();
-    debugLog(`Starting ACP server (command: ${command}, startup workspace: ${workspaceRoot})`);
-    await startGthAcpServer({
-        agents: {
-            name: options.name ?? 'gaunt-sloth',
-            description: options.description ?? 'Gaunt Sloth deep coding agent',
-            model: params.model,
-            tools: params.tools,
-            systemPrompt,
-            // eslint-disable-next-line @typescript-eslint/no-explicit-any
-            middleware: params.middleware,
-            // Forward-compat: ignored by deepagents-acp 0.1.12 (the host gates fs interactively).
-            permissions: params.permissions,
-        },
-        workspaceRoot,
-    });
-}
-//# sourceMappingURL=acpModule.js.map

package/dist/modules/acpModule.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"acpModule.js","sourceRoot":"","sources":["../../src/modules/acpModule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAKH,OAAO,EAAE,aAAa,EAAE,MAAM,EAAE,MAAM,wCAAwC,CAAC;AAC/E,OAAO,EAAE,QAAQ,EAAE,MAAM,uCAAuC,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAWpD;;;GAGG;AACH,MAAM,eAAe,GAAyB,CAAC,MAAmB,EAAE,OAAe,EAAQ,EAAE;IAC3F,MAAM,CAAC,KAAK,CAAC,GAAG,OAAO,IAAI,CAAC,CAAC;AAC/B,CAAC,CAAC;AAEF;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,MAAiB,EACjB,UAAiC,EAAE;IAEnC,MAAM,OAAO,GAAe,OAAO,CAAC,OAAO,IAAI,MAAM,CAAC;IAEtD,0FAA0F;IAC1F,yFAAyF;IACzF,yFAAyF;IACzF,gFAAgF;IAChF,IAAI,MAAM,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,KAAK,CACb,oFAAoF;YAClF,8FAA8F,CACjG,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,YAAY,CAAC,eAAe,EAAE,eAAe,EAAE,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,oBAAoB,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;IAEjE,6FAA6F;IAC7F,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;IAEzC,+FAA+F;IAC/F,qFAAqF;IACrF,mGAAmG;IACnG,MAAM,aAAa,GAAG,aAAa,EAAE,CAAC;IACtC,QAAQ,CAAC,iCAAiC,OAAO,wBAAwB,aAAa,GAAG,CAAC,CAAC;IAE3F,MAAM,iBAAiB,CAAC;QACtB,MAAM,EAAE;YACN,IAAI,EAAE,OAAO,CAAC,IAAI,IAAI,aAAa;YACnC,WAAW,EAAE,OAAO,CAAC,WAAW,IAAI,+BAA+B;YACnE,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,YAAY;YACZ,8DAA8D;YAC9D,UAAU,EAAE,MAAM,CAAC,UAAiB;YACpC,sFAAsF;YACtF,WAAW,EAAE,MAAM,CAAC,WAAW;SAChC;QACD,aAAa;KACd,CAAC,CAAC;AACL,CAAC"}

package/dist/tools/shell/allowlist.d.ts

@@ -1,11 +0,0 @@
-/**
- * @module tools/shell/allowlist
- *
- * Re-export of the EXT-9 Tier-2 allow-list engine. The implementation lives in
- * `@gaunt-sloth/core` (`core/shell/allowlist`) because the core {@link GthAgentRunner}
- * owns the per-instance session store and the loaded persisted store and consults
- * `matchesApproval` before prompting (core cannot import from `@gaunt-sloth/agent`).
- *
- * See the core module for the exact safe-bin / anti-widening matching rule.
- */
-export { matchesApproval, hasWideningFlag, AllowlistStore, PersistedAllowlist, type ApprovalScope, type ApprovalStores, } from '@gaunt-sloth/core/core/shell/allowlist.js';

package/dist/tools/shell/allowlist.js

@@ -1,12 +0,0 @@
-/**
- * @module tools/shell/allowlist
- *
- * Re-export of the EXT-9 Tier-2 allow-list engine. The implementation lives in
- * `@gaunt-sloth/core` (`core/shell/allowlist`) because the core {@link GthAgentRunner}
- * owns the per-instance session store and the loaded persisted store and consults
- * `matchesApproval` before prompting (core cannot import from `@gaunt-sloth/agent`).
- *
- * See the core module for the exact safe-bin / anti-widening matching rule.
- */
-export { matchesApproval, hasWideningFlag, AllowlistStore, PersistedAllowlist, } from '@gaunt-sloth/core/core/shell/allowlist.js';
-//# sourceMappingURL=allowlist.js.map

package/dist/tools/shell/allowlist.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"allowlist.js","sourceRoot":"","sources":["../../../src/tools/shell/allowlist.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,eAAe,EACf,cAAc,EACd,kBAAkB,GAGnB,MAAM,2CAA2C,CAAC"}

package/dist/tools/shell/arity.d.ts

@@ -1,11 +0,0 @@
-/**
- * @module tools/shell/arity
- *
- * Re-export of the EXT-9 Tier-2 command classifier. The implementation lives in
- * `@gaunt-sloth/core` (`core/shell/arity`) because the core {@link GthAgentRunner}
- * must consult it BEFORE prompting (and core cannot import from `@gaunt-sloth/agent`).
- * This stable agent-side path is kept for tests and any agent-layer consumers.
- *
- * See the core module for the arity table scope and the anti-injection fail-closed rule.
- */
-export { classifyCommand, tokenize, meaningfulPrefixTokens, type CommandClassification, } from '@gaunt-sloth/core/core/shell/arity.js';

package/dist/tools/shell/arity.js

@@ -1,12 +0,0 @@
-/**
- * @module tools/shell/arity
- *
- * Re-export of the EXT-9 Tier-2 command classifier. The implementation lives in
- * `@gaunt-sloth/core` (`core/shell/arity`) because the core {@link GthAgentRunner}
- * must consult it BEFORE prompting (and core cannot import from `@gaunt-sloth/agent`).
- * This stable agent-side path is kept for tests and any agent-layer consumers.
- *
- * See the core module for the arity table scope and the anti-injection fail-closed rule.
- */
-export { classifyCommand, tokenize, meaningfulPrefixTokens, } from '@gaunt-sloth/core/core/shell/arity.js';
-//# sourceMappingURL=arity.js.map

package/dist/tools/shell/arity.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"arity.js","sourceRoot":"","sources":["../../../src/tools/shell/arity.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EACL,eAAe,EACf,QAAQ,EACR,sBAAsB,GAEvB,MAAM,uCAAuC,CAAC"}

package/dist/tools/shell/hardline.d.ts

@@ -1,15 +0,0 @@
-/**
- * Hardline patterns: [regex, human description]. Matched case-insensitively
- * against the normalized command.
- */
-export declare const HARDLINE_PATTERNS: ReadonlyArray<readonly [RegExp, string]>;
-export interface HardlineMatch {
-    /** Human-readable reason the command was refused. */
-    description: string;
-}
-/**
- * Check a raw command against the hardline blocklist. Normalizes first so
- * obfuscated variants are caught. Returns the match (with a description) when the
- * command is catastrophic, or `null` when it is allowed to proceed.
- */
-export declare function checkHardline(command: string): HardlineMatch | null;

package/dist/tools/shell/hardline.js

@@ -1,88 +0,0 @@
-/**
- * @module tools/shell/hardline
- *
- * Unbypassable hardline blocklist for the shell tool. These are catastrophic,
- * non-recoverable commands (wipe the root filesystem, format a disk, overwrite a
- * raw block device, fork-bomb, take the host down). They are refused inside
- * `executeCommand` itself — BEFORE spawn — so the refusal fires regardless of
- * yolo (`shellYolo`), any allow-list, or the confirmation path. yolo deliberately
- * bypasses the *confirmation*; it does NOT bypass this floor.
- *
- * Recoverable-but-costly operations (e.g. `git reset --hard`, `rm -rf ./build`,
- * `chmod -R 777 ./dir`, `curl | sh`) are intentionally NOT here — those are what
- * the confirmation dialog / yolo are for.
- *
- * Patterns match the NORMALIZED command ({@link ./normalize.js}) so obfuscation
- * (ANSI/fullwidth/backslash splits/whitespace padding) cannot bypass them.
- *
- * Patterned after hermes-agent `tools/approval.py` HARDLINE_PATTERNS.
- */
-import { normalizeCommand } from '#src/tools/shell/normalize.js';
-// Matches a position where the shell would begin parsing a NEW command: start of
-// string, after a separator (; & | newline), after `$(` or backtick, optionally
-// consuming leading wrappers (sudo/env VAR=VAL/exec/nohup/setsid/time). Used by
-// the shutdown-family patterns so they don't false-positive on `echo reboot`.
-const CMD_POS = '(?:^|[;&|\\n`]|\\$\\()' +
-    '\\s*' +
-    '(?:sudo\\s+(?:-[^\\s]+\\s+)*)?' +
-    '(?:env\\s+(?:\\w+=\\S*\\s+)*)?' +
-    '(?:(?:exec|nohup|setsid|time)\\s+)*' +
-    '\\s*';
-/**
- * Hardline patterns: [regex, human description]. Matched case-insensitively
- * against the normalized command.
- */
-export const HARDLINE_PATTERNS = [
-    // rm -rf targeting the root filesystem (`/`, `/*`).
-    [/\brm\s+(?:-[^\s]*\s+)*\/\s*\*?\s*(?:$|[;&|])/, 'recursive delete of root filesystem'],
-    // rm -rf targeting protected system directories (with optional /* suffix).
-    [
-        /\brm\s+(?:-[^\s]*\s+)*(?:\/(?:home|root|etc|usr|var|bin|sbin|boot|lib|lib64|opt|sys|proc))(?:\/\*)?\s*(?:$|[;&|])/,
-        'recursive delete of system directory',
-    ],
-    // rm -rf targeting the home directory (~ or $HOME).
-    // Note: patterns match the LOWERCASED normalized command, so $HOME → $home.
-    [
-        /\brm\s+(?:-[^\s]*\s+)*(?:~|\$home)(?:\/\*)?\s*(?:$|[;&|])/,
-        'recursive delete of home directory',
-    ],
-    // Filesystem format.
-    [/\bmkfs(?:\.[a-z0-9]+)?\b/, 'format filesystem (mkfs)'],
-    // dd writing to a raw block device.
-    [/\bdd\b[^\n]*\bof=\/dev\/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*/, 'dd to raw block device'],
-    // Shell redirection to a raw block device (`> /dev/sda`).
-    [/>\s*\/dev\/(?:sd|nvme|hd|mmcblk|vd|xvd)[a-z0-9]*\b/, 'redirect to raw block device'],
-    // Classic fork bomb `:(){ :|:& };:`.
-    [/:\s*\(\s*\)\s*\{\s*:\s*\|\s*:\s*&\s*\}\s*;\s*:/, 'fork bomb'],
-    // chmod -R 777 / (recursive world-writable on root).
-    [
-        /\bchmod\s+(?:-[^\s]*\s+)*(?:-r|--recursive)\s+(?:-[^\s]*\s+)*777\s+\//,
-        'recursive chmod 777 of root',
-    ],
-    // Kill every process on the system (`kill -1`, `kill -9 -1`).
-    [/\bkill\s+(?:-[^\s]+\s+)*-1\b/, 'kill all processes'],
-    // System shutdown / reboot — anchored to a command position so `echo reboot`
-    // and `grep shutdown log` don't trip it.
-    [new RegExp(CMD_POS + '(?:shutdown|reboot|halt|poweroff)\\b'), 'system shutdown/reboot'],
-    [new RegExp(CMD_POS + 'init\\s+[06]\\b'), 'init 0/6 (shutdown/reboot)'],
-    [
-        new RegExp(CMD_POS + 'systemctl\\s+(?:poweroff|reboot|halt|kexec)\\b'),
-        'systemctl poweroff/reboot',
-    ],
-    [new RegExp(CMD_POS + 'telinit\\s+[06]\\b'), 'telinit 0/6 (shutdown/reboot)'],
-];
-/**
- * Check a raw command against the hardline blocklist. Normalizes first so
- * obfuscated variants are caught. Returns the match (with a description) when the
- * command is catastrophic, or `null` when it is allowed to proceed.
- */
-export function checkHardline(command) {
-    const normalized = normalizeCommand(command).toLowerCase();
-    for (const [pattern, description] of HARDLINE_PATTERNS) {
-        if (pattern.test(normalized)) {
-            return { description };
-        }
-    }
-    return null;
-}
-//# sourceMappingURL=hardline.js.map

package/dist/tools/shell/hardline.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"hardline.js","sourceRoot":"","sources":["../../../src/tools/shell/hardline.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,+BAA+B,CAAC;AAEjE,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,8EAA8E;AAC9E,MAAM,OAAO,GACX,wBAAwB;IACxB,MAAM;IACN,gCAAgC;IAChC,gCAAgC;IAChC,qCAAqC;IACrC,MAAM,CAAC;AAET;;;GAGG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAA6C;IACzE,oDAAoD;IACpD,CAAC,8CAA8C,EAAE,qCAAqC,CAAC;IACvF,2EAA2E;IAC3E;QACE,mHAAmH;QACnH,sCAAsC;KACvC;IACD,oDAAoD;IACpD,4EAA4E;IAC5E;QACE,2DAA2D;QAC3D,oCAAoC;KACrC;IACD,qBAAqB;IACrB,CAAC,0BAA0B,EAAE,0BAA0B,CAAC;IACxD,oCAAoC;IACpC,CAAC,+DAA+D,EAAE,wBAAwB,CAAC;IAC3F,0DAA0D;IAC1D,CAAC,oDAAoD,EAAE,8BAA8B,CAAC;IACtF,qCAAqC;IACrC,CAAC,gDAAgD,EAAE,WAAW,CAAC;IAC/D,qDAAqD;IACrD;QACE,uEAAuE;QACvE,6BAA6B;KAC9B;IACD,8DAA8D;IAC9D,CAAC,8BAA8B,EAAE,oBAAoB,CAAC;IACtD,6EAA6E;IAC7E,yCAAyC;IACzC,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,sCAAsC,CAAC,EAAE,wBAAwB,CAAC;IACxF,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,iBAAiB,CAAC,EAAE,4BAA4B,CAAC;IACvE;QACE,IAAI,MAAM,CAAC,OAAO,GAAG,gDAAgD,CAAC;QACtE,2BAA2B;KAC5B;IACD,CAAC,IAAI,MAAM,CAAC,OAAO,GAAG,oBAAoB,CAAC,EAAE,+BAA+B,CAAC;CAC9E,CAAC;AAOF;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3D,KAAK,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC,IAAI,iBAAiB,EAAE,CAAC;QACvD,IAAI,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;YAC7B,OAAO,EAAE,WAAW,EAAE,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tools/shell/normalize.d.ts

@@ -1,10 +0,0 @@
-/**
- * @module tools/shell/normalize
- *
- * Re-export of the canonical command normalizer, which now lives in
- * `@gaunt-sloth/core` (`core/shell/normalize`) so the core runner's EXT-9 Tier-2
- * allow-list classifier and the agent's Tier-1 hardline blocklist share ONE
- * implementation. Kept as a stable import path for existing agent-side consumers
- * (`tools/shell/hardline`, specs).
- */
-export { normalizeCommand } from '@gaunt-sloth/core/core/shell/normalize.js';

package/dist/tools/shell/normalize.js

@@ -1,11 +0,0 @@
-/**
- * @module tools/shell/normalize
- *
- * Re-export of the canonical command normalizer, which now lives in
- * `@gaunt-sloth/core` (`core/shell/normalize`) so the core runner's EXT-9 Tier-2
- * allow-list classifier and the agent's Tier-1 hardline blocklist share ONE
- * implementation. Kept as a stable import path for existing agent-side consumers
- * (`tools/shell/hardline`, specs).
- */
-export { normalizeCommand } from '@gaunt-sloth/core/core/shell/normalize.js';
-//# sourceMappingURL=normalize.js.map

package/dist/tools/shell/normalize.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"normalize.js","sourceRoot":"","sources":["../../../src/tools/shell/normalize.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,gBAAgB,EAAE,MAAM,2CAA2C,CAAC"}