@graychennpm/codebridge 0.0.0-stage → 0.1.0

package/node_modules/@codebridge/policy/dist/capability-runtime.js

@@ -0,0 +1,195 @@
+import { spawn } from "node:child_process";
+import fs from "node:fs";
+import path from "node:path";
+export class CapabilityExecutionError extends Error {
+    retryable;
+    constructor(message, options = {}) {
+        super(message);
+        this.name = "CapabilityExecutionError";
+        this.retryable = options.retryable ?? false;
+    }
+}
+export class CapabilityRuntime {
+    adapters = new Map();
+    constructor(adapters = []) {
+        for (const adapter of adapters)
+            this.register(adapter);
+    }
+    register(adapter) {
+        if (!adapter.id.trim())
+            throw new Error("capability adapter id must not be empty");
+        this.adapters.set(adapter.id, adapter);
+    }
+    get(id) {
+        return this.adapters.get(id);
+    }
+    has(id) {
+        return this.adapters.has(id);
+    }
+    list() {
+        return [...this.adapters.values()];
+    }
+    async execute(id, invocation) {
+        const adapter = this.get(id);
+        if (!adapter)
+            throw new Error(`Capability adapter not registered: ${id}`);
+        return adapter.execute(invocation);
+    }
+}
+export class FunctionCapabilityAdapter {
+    id;
+    handler;
+    kind = "function";
+    constructor(id, handler) {
+        this.id = id;
+        this.handler = handler;
+    }
+    async execute(invocation) {
+        return this.handler(invocation);
+    }
+}
+export class McpCapabilityAdapter {
+    id;
+    tool;
+    call;
+    kind = "mcp";
+    constructor(id, tool, call) {
+        this.id = id;
+        this.tool = tool;
+        this.call = call;
+    }
+    async execute(invocation) {
+        return { output: await this.call(this.tool, invocation.input, invocation.context) };
+    }
+}
+export class CliCapabilityAdapter {
+    id;
+    options;
+    kind = "cli";
+    constructor(id, options) {
+        this.id = id;
+        this.options = options;
+    }
+    async execute(invocation) {
+        const { command, args = [], env, timeoutMs = 120_000 } = this.options;
+        return new Promise((resolve, reject) => {
+            const child = spawn(command, args, {
+                cwd: invocation.context.cwd,
+                env: { ...process.env, ...env },
+                stdio: ["pipe", "pipe", "pipe"],
+                signal: invocation.context.signal,
+            });
+            let stdout = "";
+            let stderr = "";
+            const timer = setTimeout(() => child.kill("SIGTERM"), timeoutMs);
+            child.stdout.setEncoding("utf8");
+            child.stderr.setEncoding("utf8");
+            child.stdout.on("data", (chunk) => { stdout += chunk; });
+            child.stderr.on("data", (chunk) => { stderr += chunk; });
+            child.once("error", (error) => {
+                clearTimeout(timer);
+                reject(error);
+            });
+            child.once("close", (code, signal) => {
+                clearTimeout(timer);
+                if (code !== 0) {
+                    reject(new Error(`Capability CLI failed (${code ?? signal ?? "unknown"}): ${stderr.trim()}`));
+                    return;
+                }
+                resolve({ output: parseOutput(stdout), metadata: { stderr: stderr.trim() || undefined } });
+            });
+            child.stdin.end(JSON.stringify(invocation.input));
+        });
+    }
+}
+export class HttpCapabilityAdapter {
+    id;
+    options;
+    kind = "http";
+    constructor(id, options) {
+        this.id = id;
+        this.options = options;
+    }
+    async execute(invocation) {
+        const controller = new AbortController();
+        const timeout = setTimeout(() => controller.abort(), this.options.timeoutMs ?? 30_000);
+        const signal = invocation.context.signal
+            ? AbortSignal.any([invocation.context.signal, controller.signal])
+            : controller.signal;
+        try {
+            const response = await fetch(this.options.url, {
+                method: this.options.method ?? "POST",
+                headers: { "content-type": "application/json", ...this.options.headers },
+                body: this.options.method === "GET" ? undefined : JSON.stringify(invocation.input),
+                signal,
+            });
+            const text = await response.text();
+            if (!response.ok)
+                throw new Error(`Capability HTTP failed (${response.status}): ${text.slice(0, 500)}`);
+            return { output: parseOutput(text), metadata: { status: response.status } };
+        }
+        finally {
+            clearTimeout(timeout);
+        }
+    }
+}
+/** Discover standard SKILL.md files without imposing a script language or metadata format. */
+export function discoverSkillDocuments(roots) {
+    const documents = [];
+    for (const root of roots) {
+        const resolvedRoot = path.resolve(root);
+        walkSkillRoot(resolvedRoot, resolvedRoot, documents);
+    }
+    return documents.sort((a, b) => a.id.localeCompare(b.id));
+}
+export class SkillCapabilityAdapter {
+    id;
+    document;
+    kind = "skill";
+    constructor(id, document) {
+        this.id = id;
+        this.document = document;
+    }
+    async execute() {
+        return {
+            output: { skillId: this.document.id, instructions: this.document.content },
+            forwardToAgent: true,
+            metadata: { file: this.document.file },
+        };
+    }
+}
+function walkSkillRoot(root, directory, documents) {
+    let entries;
+    try {
+        entries = fs.readdirSync(directory, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const fullPath = path.join(directory, entry.name);
+        if (entry.isDirectory()) {
+            walkSkillRoot(root, fullPath, documents);
+        }
+        else if (entry.isFile() && entry.name === "SKILL.md") {
+            documents.push({
+                id: path.relative(root, directory).replaceAll(path.sep, "/") || path.basename(root),
+                directory,
+                file: fullPath,
+                content: fs.readFileSync(fullPath, "utf8"),
+            });
+        }
+    }
+}
+function parseOutput(value) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        return "";
+    try {
+        return JSON.parse(trimmed);
+    }
+    catch {
+        return trimmed;
+    }
+}
+//# sourceMappingURL=capability-runtime.js.map

package/node_modules/@codebridge/policy/dist/demo-capabilities.d.ts

@@ -0,0 +1,4 @@
+import type { CapabilityRegistry } from "./index.js";
+import { type CapabilityRuntime } from "./capability-runtime.js";
+export declare function registerDemoCapabilities(registry: CapabilityRegistry, runtime: CapabilityRuntime): void;
+//# sourceMappingURL=demo-capabilities.d.ts.map

package/node_modules/@codebridge/policy/dist/demo-capabilities.js

@@ -0,0 +1,134 @@
+import { FunctionCapabilityAdapter } from "./capability-runtime.js";
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function productIds(input) {
+    return String(input.product_ids ?? "")
+        .split(/[\s,]+/)
+        .map((value) => value.trim())
+        .filter(Boolean);
+}
+function target(input) {
+    return {
+        price: Number(input.target_price),
+        status: String(input.target_status ?? ""),
+    };
+}
+export function registerDemoCapabilities(registry, runtime) {
+    const source = { kind: "function", ref: "demo", version: "1" };
+    registry.register({
+        id: "demo.echo",
+        risk: "read_only",
+        adapter: "demo.echo",
+        side_effects: false,
+        description: "Echo input.text",
+        source,
+    });
+    registry.register({
+        id: "demo.concat",
+        risk: "read_only",
+        adapter: "demo.concat",
+        side_effects: false,
+        description: "Concat resolved text with prior echo output",
+        source,
+    });
+    runtime.register(new FunctionCapabilityAdapter("demo.echo", ({ input }) => {
+        const text = String(input.text ?? "");
+        return { output: { text } };
+    }));
+    runtime.register(new FunctionCapabilityAdapter("demo.concat", ({ input }) => {
+        const echo = asRecord(asRecord(input.step_outputs).echo);
+        const text = String(echo.text ?? input.text ?? "");
+        const prefix = String(input.prefix ?? "");
+        return { output: { result: `${prefix}${text}` } };
+    }));
+    for (const definition of [
+        { id: "demo.catalog.inspect", description: "Inspect synthetic catalog records in memory" },
+        { id: "demo.catalog.plan_change", description: "Build a synthetic catalog change plan" },
+        { id: "demo.catalog.simulate_apply", description: "Simulate applying a catalog change without writes" },
+        { id: "demo.catalog.verify", description: "Verify the simulated catalog outcome" },
+    ]) {
+        registry.register({
+            ...definition,
+            risk: "read_only",
+            adapter: definition.id,
+            side_effects: false,
+            source,
+        });
+    }
+    runtime.register(new FunctionCapabilityAdapter("demo.catalog.inspect", ({ input }) => {
+        const ids = productIds(input);
+        return {
+            output: {
+                product_ids: ids,
+                product_type: Number(input.product_type),
+                current: ids.map((id) => ({ id, price: 0, status: "unknown" })),
+                simulation: true,
+            },
+        };
+    }));
+    runtime.register(new FunctionCapabilityAdapter("demo.catalog.plan_change", ({ input }) => {
+        const inspected = asRecord(asRecord(input.step_outputs).inspect);
+        const ids = Array.isArray(inspected.product_ids)
+            ? inspected.product_ids.map(String)
+            : productIds(input);
+        return {
+            output: {
+                product_ids: ids,
+                change_count: ids.length,
+                target: target(input),
+                simulation: true,
+            },
+        };
+    }));
+    runtime.register(new FunctionCapabilityAdapter("demo.catalog.simulate_apply", ({ input }) => {
+        const plan = asRecord(asRecord(input.step_outputs).plan);
+        const ids = Array.isArray(plan.product_ids)
+            ? plan.product_ids.map(String)
+            : productIds(input);
+        const plannedTarget = asRecord(plan.target);
+        return {
+            output: {
+                product_ids: ids,
+                applied_count: ids.length,
+                target: {
+                    price: Number(plannedTarget.price ?? input.target_price),
+                    status: String(plannedTarget.status ?? input.target_status ?? ""),
+                },
+                simulation: true,
+            },
+        };
+    }));
+    runtime.register(new FunctionCapabilityAdapter("demo.catalog.verify", ({ input }) => {
+        const simulated = asRecord(asRecord(input.step_outputs).simulate);
+        const ids = Array.isArray(simulated.product_ids)
+            ? simulated.product_ids.map(String)
+            : productIds(input);
+        const simulatedTarget = asRecord(simulated.target);
+        const expected = target(input);
+        const actual = {
+            price: Number(simulatedTarget.price),
+            status: String(simulatedTarget.status ?? ""),
+        };
+        const verified = ids.length > 0
+            && actual.price === expected.price
+            && actual.status === expected.status
+            && simulated.simulation === true;
+        return {
+            output: {
+                verified,
+                product_ids: ids,
+                target: actual,
+                simulation: true,
+            },
+            verification: {
+                validator: "demo.catalog.verify",
+                status: verified ? "passed" : "failed",
+                summary: verified ? "Synthetic catalog state matches the requested target" : "Synthetic catalog state mismatch",
+            },
+        };
+    }));
+}
+//# sourceMappingURL=demo-capabilities.js.map

package/node_modules/@codebridge/policy/dist/equity-capabilities.d.ts

@@ -0,0 +1,8 @@
+import type { CapabilityRegistry } from "./index.js";
+import { type CapabilityRuntime } from "./capability-runtime.js";
+/**
+ * 真实领域示例：权益余额查询（只读）。演示一个 registry+runtime 都注册的
+ * adapter：capability 有定义、有可执行 adapter、非 forwardToAgent。
+ */
+export declare function registerEquityCapabilities(registry: CapabilityRegistry, runtime: CapabilityRuntime): void;
+//# sourceMappingURL=equity-capabilities.d.ts.map

package/node_modules/@codebridge/policy/dist/equity-capabilities.js

@@ -0,0 +1,35 @@
+import { FunctionCapabilityAdapter } from "./capability-runtime.js";
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+/**
+ * 真实领域示例：权益余额查询（只读）。演示一个 registry+runtime 都注册的
+ * adapter：capability 有定义、有可执行 adapter、非 forwardToAgent。
+ */
+export function registerEquityCapabilities(registry, runtime) {
+    const source = { kind: "function", ref: "equity", version: "1" };
+    registry.register({
+        id: "equity.balance",
+        risk: "read_only",
+        adapter: "equity.balance",
+        side_effects: false,
+        description: "查询用户权益余额（只读）",
+        source,
+    });
+    runtime.register(new FunctionCapabilityAdapter("equity.balance", ({ input }) => {
+        const userId = String(input.user_id ?? "");
+        const prior = asRecord(asRecord(input.step_outputs).lookup);
+        const balance = typeof prior.balance === "number" ? prior.balance : 0;
+        return {
+            output: {
+                user_id: userId,
+                balance,
+                currency: "CNY",
+                updated_at: new Date().toISOString(),
+            },
+        };
+    }));
+}
+//# sourceMappingURL=equity-capabilities.js.map

package/node_modules/@codebridge/policy/dist/index.d.ts

@@ -0,0 +1,107 @@
+import type { SqliteEventStore } from "@codebridge/work-items";
+export * from "./capability-runtime.js";
+export { registerDemoCapabilities } from "./demo-capabilities.js";
+export { registerEquityCapabilities } from "./equity-capabilities.js";
+export type CapabilityRisk = "read_only" | "workspace_write" | "git_write" | "production_write";
+export interface CapabilityDefinition {
+    id: string;
+    risk: CapabilityRisk;
+    adapter: string;
+    environments?: string[];
+    description?: string;
+    source?: CapabilitySource;
+    /** true when the capability mutates state; such adapters must honor context.dry_run. */
+    side_effects?: boolean;
+    idempotency?: {
+        /** input field names that derive the idempotency key. */
+        key: string[];
+        /** dedupe window. `permanent` = never expires. */
+        validity_window?: "24h" | "7d" | "permanent";
+    };
+}
+export interface CapabilitySource {
+    kind: "skill" | "mcp" | "cli" | "http" | "function";
+    ref: string;
+    version?: string;
+    revision?: string;
+}
+export interface CapabilityRegistryOptions {
+    databasePath?: string;
+}
+export interface PolicyContext {
+    environment: string;
+    approvalGranted?: boolean;
+}
+export type PolicyDecision = {
+    allowed: true;
+    requiresApproval: false;
+    capability: CapabilityDefinition;
+} | {
+    allowed: false;
+    requiresApproval: true;
+    reason: "approval_required";
+    capability: CapabilityDefinition;
+} | {
+    allowed: false;
+    requiresApproval: false;
+    reason: "unknown_capability" | "environment_not_allowed";
+};
+export declare class CapabilityRegistry {
+    private readonly definitions;
+    private readonly database;
+    constructor(definitions?: CapabilityDefinition[], options?: CapabilityRegistryOptions);
+    register(definition: CapabilityDefinition): void;
+    get(id: string): CapabilityDefinition | undefined;
+    list(): CapabilityDefinition[];
+    close(): void;
+}
+export declare class PolicyEngine {
+    private readonly registry;
+    constructor(registry: CapabilityRegistry);
+    getCapability(capabilityId: string): CapabilityDefinition | undefined;
+    evaluate(capabilityId: string, context: PolicyContext): PolicyDecision;
+}
+export type ApprovalStatus = "requested" | "granted" | "consumed" | "expired" | "revoked";
+export interface ApprovalRecord {
+    id: string;
+    workItemId: string;
+    runId: string;
+    stepId: string;
+    capabilityId: string;
+    sessionId: string;
+    environment: string;
+    targetResource: string;
+    inputHash: string;
+    status: ApprovalStatus;
+    requestedBy: string;
+    grantedBy: string | null;
+    createdAt: string;
+    expiresAt: string;
+    grantedAt: string | null;
+    consumedAt: string | null;
+}
+export interface RequestApprovalInput {
+    workItemId: string;
+    runId: string;
+    stepId: string;
+    capabilityId: string;
+    sessionId?: string;
+    environment?: string;
+    targetResource?: string;
+    inputHash: string;
+    requestedBy: string;
+    ttlMs?: number;
+}
+export declare class ApprovalService {
+    private readonly eventStore;
+    private readonly database;
+    constructor(eventStore: SqliteEventStore, databasePath: string);
+    request(input: RequestApprovalInput): ApprovalRecord;
+    grant(id: string, grantedBy: string): ApprovalRecord | undefined;
+    revoke(id: string, rejectedBy: string): ApprovalRecord | undefined;
+    consume(id: string, runId: string, stepId: string, inputHash: string): boolean;
+    get(id: string): ApprovalRecord | undefined;
+    listForRun(runId: string): ApprovalRecord[];
+    close(): void;
+}
+//# sourceMappingURL=index.d.ts.map