@hegemonart/get-design-done 1.31.0 → 1.32.0

package/sdk/primitives/error-classifier.cjs

@@ -0,0 +1,232 @@
+// scripts/lib/error-classifier.cjs
+//
+// Plan 20-14 — classify raw errors into a recovery-action vocabulary.
+//
+// Plan 20-04 shipped the GDDError taxonomy (ValidationError /
+// StateConflictError / OperationFailedError). This module is one layer
+// lower: it maps LOW-LEVEL errors (fetch rejections, Anthropic API
+// responses, Node errno rejections) onto a small enum that recovery
+// code can switch on without needing to know which SDK produced the
+// error.
+//
+// Consumers (e.g. budget-enforcer retry, figma probe retry, MCP
+// transport) check `classify(err).reason` and decide whether to retry,
+// compress, surface, or fail.
+//
+// Classification rules — evaluated in order; first match wins:
+//   1. HTTP 429  OR  message ~ /rate.?limit/       → RATE_LIMITED      (retryable)
+//   2. HTTP 413  OR  /context.?(length|window|overflow)/
+//                OR  /context_length_exceeded/     → CONTEXT_OVERFLOW  (retryable with compression)
+//   3. HTTP 401/403                                → AUTH_ERROR        (NOT retryable)
+//   4. /tool not found|unknown tool/               → TOOL_NOT_FOUND    (NOT retryable)
+//   5. HTTP 5xx  OR  errno ECONNRESET/ETIMEDOUT/EAI_AGAIN/ECONNREFUSED
+//                OR  /network|timeout|socket/       → NETWORK_TRANSIENT (retryable)
+//   6. HTTP 4xx (non-auth, non-rate, non-overflow) → VALIDATION        (NOT retryable)
+//   7. HTTP >= 400 with no other match             → NETWORK_PERMANENT (NOT retryable)
+//   8. Anything else (null, undefined, plain Error) → UNKNOWN          (NOT retryable)
+//
+// Rule order matters: the tool-not-found string can land inside
+// otherwise-validation-shaped errors, so it's checked early. Anthropic
+// "context_length_exceeded" returns HTTP 400 in some surfaces and HTTP
+// 413 in others — rule 2 catches it either way.
+//
+// Reference: `reference/error-recovery.md` describes the protocol layer
+// that sits on top of this module.
+
+'use strict';
+
+/**
+ * @readonly
+ * @enum {string}
+ */
+const FailoverReason = Object.freeze({
+  RATE_LIMITED: 'rate_limited',
+  CONTEXT_OVERFLOW: 'context_overflow',
+  AUTH_ERROR: 'auth_error',
+  NETWORK_TRANSIENT: 'network_transient',
+  NETWORK_PERMANENT: 'network_permanent',
+  TOOL_NOT_FOUND: 'tool_not_found',
+  VALIDATION: 'validation',
+  UNKNOWN: 'unknown',
+});
+
+/** Suggested actions per reason — keyed by FailoverReason. */
+const SUGGESTED_ACTIONS = Object.freeze({
+  [FailoverReason.RATE_LIMITED]:
+    'consult scripts/lib/rate-guard.cjs → blockUntilReady(provider); then retry with scripts/lib/jittered-backoff.cjs',
+  [FailoverReason.CONTEXT_OVERFLOW]:
+    'compress context (drop oldest non-system turns; target 50% reduction) and retry once',
+  [FailoverReason.AUTH_ERROR]:
+    'surface to user — do not retry; credentials or OAuth session need refresh',
+  [FailoverReason.NETWORK_TRANSIENT]:
+    'retry with scripts/lib/jittered-backoff.cjs; max 3 attempts',
+  [FailoverReason.NETWORK_PERMANENT]:
+    'surface to user; do not retry — endpoint is wrong or resource is gone',
+  [FailoverReason.TOOL_NOT_FOUND]:
+    'do not retry; verify tool name and MCP registration',
+  [FailoverReason.VALIDATION]:
+    'do not retry same input; surface validation detail to caller',
+  [FailoverReason.UNKNOWN]:
+    'surface to user — cannot determine safe recovery action',
+});
+
+/** Which reasons are safe to retry by policy. */
+const RETRYABLE = Object.freeze({
+  [FailoverReason.RATE_LIMITED]: true,
+  [FailoverReason.CONTEXT_OVERFLOW]: true,
+  [FailoverReason.NETWORK_TRANSIENT]: true,
+  [FailoverReason.AUTH_ERROR]: false,
+  [FailoverReason.NETWORK_PERMANENT]: false,
+  [FailoverReason.TOOL_NOT_FOUND]: false,
+  [FailoverReason.VALIDATION]: false,
+  [FailoverReason.UNKNOWN]: false,
+});
+
+/** Extract a numeric HTTP status from an error shape. Returns null on miss. */
+function statusOf(err) {
+  if (err === null || err === undefined) return null;
+  if (typeof err !== 'object') return null;
+  // Direct status / statusCode field.
+  if (Number.isFinite(err.status)) return Number(err.status);
+  if (Number.isFinite(err.statusCode)) return Number(err.statusCode);
+  // Fetch / node-fetch responses wrap status under .response.
+  if (err.response && typeof err.response === 'object') {
+    if (Number.isFinite(err.response.status)) return Number(err.response.status);
+    if (Number.isFinite(err.response.statusCode)) return Number(err.response.statusCode);
+  }
+  return null;
+}
+
+/** Extract a string message; tolerant of anything. */
+function messageOf(err) {
+  if (err === null || err === undefined) return '';
+  if (typeof err === 'string') return err;
+  if (typeof err === 'object') {
+    // Gather every string-ish field in priority order; join with ' | ' so
+    // classification regexes can match against any of them without the
+    // caller needing to know which SDK shaped the error. OpenAI-style
+    // wraps the interesting discriminator in `error.code` while keeping
+    // a generic top-level message; the join lets both contribute.
+    const parts = [];
+    if (typeof err.message === 'string' && err.message.length > 0) parts.push(err.message);
+    if (err.error && typeof err.error === 'object') {
+      if (typeof err.error.code === 'string') parts.push(err.error.code);
+      if (typeof err.error.type === 'string') parts.push(err.error.type);
+      if (typeof err.error.message === 'string') parts.push(err.error.message);
+    }
+    // Only use top-level `code` when it is NOT an errno (errnoOf handles
+    // those). Errnos always match /^E[A-Z0-9_]+$/, so filter them out.
+    if (typeof err.code === 'string' && !/^E[A-Z0-9_]+$/.test(err.code)) {
+      parts.push(err.code);
+    }
+    if (parts.length > 0) return parts.join(' | ');
+  }
+  return '';
+}
+
+/** Extract a low-level errno code (ECONNRESET, ETIMEDOUT, ...). */
+function errnoOf(err) {
+  if (err === null || err === undefined || typeof err !== 'object') return '';
+  if (typeof err.code === 'string' && /^E[A-Z0-9_]+$/.test(err.code)) return err.code;
+  // fetch native in newer Node wraps the cause
+  if (err.cause && typeof err.cause === 'object') {
+    const code = err.cause.code;
+    if (typeof code === 'string' && /^E[A-Z0-9_]+$/.test(code)) return code;
+  }
+  return '';
+}
+
+/**
+ * Classify a raw error into a {@link FailoverReason}.
+ *
+ * @param {unknown} err
+ * @returns {{reason: string, retryable: boolean, suggestedAction: string, raw: unknown}}
+ */
+function classify(err) {
+  const status = statusOf(err);
+  const message = messageOf(err).toLowerCase();
+  const errno = errnoOf(err);
+
+  // 1. Rate limit.
+  if (status === 429 || /rate.?limit/.test(message) || /too many requests/.test(message)) {
+    return build(FailoverReason.RATE_LIMITED, err);
+  }
+
+  // 2. Context overflow. Anthropic returns 400 with type=invalid_request and
+  //    message containing "prompt is too long"; OpenAI returns 400 with
+  //    code=context_length_exceeded; some edge surfaces use 413.
+  if (
+    status === 413 ||
+    /context_length_exceeded/.test(message) ||
+    /context.{0,10}(length|window|overflow|too.?long)/.test(message) ||
+    /prompt is too long/.test(message) ||
+    /maximum context length/.test(message)
+  ) {
+    return build(FailoverReason.CONTEXT_OVERFLOW, err);
+  }
+
+  // 3. Auth.
+  if (status === 401 || status === 403) {
+    return build(FailoverReason.AUTH_ERROR, err);
+  }
+  if (
+    /not authenticated/.test(message) ||
+    /invalid[_ ]api[_ ]key/.test(message) ||
+    /unauthorized/.test(message) ||
+    /authentication/.test(message)
+  ) {
+    return build(FailoverReason.AUTH_ERROR, err);
+  }
+
+  // 4. Tool not found.
+  if (/tool not found/.test(message) || /unknown tool/.test(message) || /no such tool/.test(message)) {
+    return build(FailoverReason.TOOL_NOT_FOUND, err);
+  }
+
+  // 5. Network transient: 5xx or low-level errno.
+  if (typeof status === 'number' && status >= 500 && status < 600) {
+    return build(FailoverReason.NETWORK_TRANSIENT, err);
+  }
+  if (
+    errno === 'ECONNRESET' ||
+    errno === 'ETIMEDOUT' ||
+    errno === 'EAI_AGAIN' ||
+    errno === 'ECONNREFUSED' ||
+    errno === 'ENETUNREACH' ||
+    errno === 'EPIPE'
+  ) {
+    return build(FailoverReason.NETWORK_TRANSIENT, err);
+  }
+  if (/\bsocket\b/.test(message) || /network/.test(message) || /\btimeout\b/.test(message)) {
+    return build(FailoverReason.NETWORK_TRANSIENT, err);
+  }
+
+  // 6. Other 4xx → validation.
+  if (typeof status === 'number' && status >= 400 && status < 500) {
+    return build(FailoverReason.VALIDATION, err);
+  }
+
+  // 7. Other >= 400 (e.g. 6xx exotic gateway codes).
+  if (typeof status === 'number' && status >= 400) {
+    return build(FailoverReason.NETWORK_PERMANENT, err);
+  }
+
+  // 8. Fallthrough.
+  return build(FailoverReason.UNKNOWN, err);
+}
+
+function build(reason, raw) {
+  return {
+    reason,
+    retryable: RETRYABLE[reason] === true,
+    suggestedAction: SUGGESTED_ACTIONS[reason],
+    raw,
+  };
+}
+
+module.exports = {
+  FailoverReason,
+  classify,
+  SUGGESTED_ACTIONS,
+  RETRYABLE,
+};

package/sdk/primitives/iteration-budget.cjs

@@ -0,0 +1,205 @@
+// scripts/lib/iteration-budget.cjs
+//
+// Plan 20-14 — bounded fix-loop iteration budget.
+//
+// Stops infinite fix cycles from burning unbounded context. Every fix-
+// iteration consumes 1 unit; Layer-B cache hits refund 1 unit so
+// cached answers don't count against the ceiling. When the budget
+// reaches 0, consume() throws and the caller must surface to user.
+//
+// State file: `.design/iteration-budget.json`. All mutations go through
+// `scripts/lib/lockfile.cjs` with atomic temp+rename writes so
+// concurrent callers (hook + fix-loop + verify) don't clobber each
+// other. The lock scope is the state file itself, so refund + consume
+// from different children serialize correctly.
+//
+// Shape on disk matches reference/schemas/iteration-budget.schema.json:
+//   { budget, remaining, consumed, refunded, updatedAt }
+
+'use strict';
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { acquire, renameWithRetry } = require('./lockfile.cjs');
+
+const STATE_PATH_REL = path.join('.design', 'iteration-budget.json');
+const DEFAULT_BUDGET = 50;
+const LOCK_MAX_WAIT_MS = 5_000;
+
+/** Error thrown by `consume()` when the remaining budget would go below 0. */
+class IterationBudgetExhaustedError extends Error {
+  constructor(amount, state) {
+    super(
+      `IterationBudgetExhausted: cannot consume ${amount} — remaining=${state.remaining}, budget=${state.budget}, consumed=${state.consumed}. Caller must surface to user (fix-loop has stopped converging).`,
+    );
+    this.name = 'IterationBudgetExhaustedError';
+    this.amount = amount;
+    this.state = state;
+  }
+}
+
+function stateAbsPath() {
+  return path.join(process.cwd(), STATE_PATH_REL);
+}
+
+/** Read and validate the state file. Returns null on missing/corrupt. */
+function readStateSync() {
+  const p = stateAbsPath();
+  if (!fs.existsSync(p)) return null;
+  try {
+    const raw = fs.readFileSync(p, 'utf8');
+    const parsed = JSON.parse(raw);
+    if (
+      parsed &&
+      typeof parsed === 'object' &&
+      Number.isInteger(parsed.budget) && parsed.budget >= 0 &&
+      Number.isInteger(parsed.remaining) && parsed.remaining >= 0 &&
+      Number.isInteger(parsed.consumed) && parsed.consumed >= 0 &&
+      Number.isInteger(parsed.refunded) && parsed.refunded >= 0 &&
+      typeof parsed.updatedAt === 'string'
+    ) {
+      return parsed;
+    }
+    return null;
+  } catch {
+    return null;
+  }
+}
+
+/** Atomically write state under a file-lock. */
+async function writeStateAtomic(state) {
+  const p = stateAbsPath();
+  const dir = path.dirname(p);
+  fs.mkdirSync(dir, { recursive: true });
+  const release = await acquire(p, { maxWaitMs: LOCK_MAX_WAIT_MS });
+  try {
+    // Re-read inside the lock so we merge against the very latest
+    // on-disk state, not the value the caller observed pre-lock. This
+    // is what makes concurrent consume() from 10 children add up to
+    // consumed=10 rather than racing each other.
+    const latest = readStateSync();
+    const merged = state.mergeFn ? state.mergeFn(latest || state.seed) : state.seed;
+    const tmp = `${p}.tmp.${process.pid}.${Date.now()}`;
+    fs.writeFileSync(tmp, JSON.stringify(merged, null, 2) + '\n', 'utf8');
+    await renameWithRetry(tmp, p);
+    return merged;
+  } finally {
+    await release();
+  }
+}
+
+/**
+ * Initialize or restart the iteration budget.
+ *
+ * @param {number} [budget] default 50
+ * @returns {Promise<{budget, remaining, consumed, refunded, updatedAt}>}
+ */
+async function reset(budget = DEFAULT_BUDGET) {
+  if (!Number.isFinite(budget) || budget < 0) {
+    throw new Error(`iteration-budget.reset: budget must be a non-negative finite number, got ${budget}`);
+  }
+  const b = Math.floor(budget);
+  const state = {
+    budget: b,
+    remaining: b,
+    consumed: 0,
+    refunded: 0,
+    updatedAt: new Date().toISOString(),
+  };
+  return writeStateAtomic({ seed: state, mergeFn: () => state });
+}
+
+/**
+ * Consume N units from the remaining budget. Throws
+ * IterationBudgetExhaustedError when N would send remaining below zero.
+ *
+ * @param {number} [amount] default 1
+ * @returns {Promise<{budget, remaining, consumed, refunded, updatedAt}>}
+ *   the new on-disk state after consumption.
+ */
+async function consume(amount = 1) {
+  const n = normalizeAmount(amount);
+  // Seed for the case when no state exists yet: auto-init to default budget.
+  const seed = defaultState();
+  return writeStateAtomic({
+    seed,
+    mergeFn: (current) => {
+      const base = current || seed;
+      const nextRemaining = base.remaining - n;
+      if (nextRemaining < 0) {
+        // Throw without writing — atomic: either consume fully or not at all.
+        throw new IterationBudgetExhaustedError(n, base);
+      }
+      return {
+        budget: base.budget,
+        remaining: nextRemaining,
+        consumed: base.consumed + n,
+        refunded: base.refunded,
+        updatedAt: new Date().toISOString(),
+      };
+    },
+  });
+}
+
+/**
+ * Refund N units to the remaining budget, capped at `budget`.
+ *
+ * @param {number} [amount] default 1
+ * @returns {Promise<{budget, remaining, consumed, refunded, updatedAt}>}
+ */
+async function refund(amount = 1) {
+  const n = normalizeAmount(amount);
+  const seed = defaultState();
+  return writeStateAtomic({
+    seed,
+    mergeFn: (current) => {
+      const base = current || seed;
+      const nextRemaining = Math.min(base.budget, base.remaining + n);
+      // Only count the portion that actually landed — if we were already
+      // at budget, the refund is a no-op.
+      const actuallyRefunded = nextRemaining - base.remaining;
+      return {
+        budget: base.budget,
+        remaining: nextRemaining,
+        consumed: base.consumed,
+        refunded: base.refunded + actuallyRefunded,
+        updatedAt: new Date().toISOString(),
+      };
+    },
+  });
+}
+
+/**
+ * Return the current on-disk state. Reads without the lock — callers
+ * using this for UI display only see a best-effort snapshot; mutating
+ * paths (consume/refund) always re-read inside the lock.
+ */
+function remaining() {
+  return readStateSync() || defaultState();
+}
+
+function normalizeAmount(amount) {
+  if (!Number.isFinite(amount) || amount <= 0) {
+    throw new Error(`iteration-budget: amount must be a positive finite number, got ${amount}`);
+  }
+  return Math.floor(amount);
+}
+
+function defaultState() {
+  return {
+    budget: DEFAULT_BUDGET,
+    remaining: DEFAULT_BUDGET,
+    consumed: 0,
+    refunded: 0,
+    updatedAt: new Date().toISOString(),
+  };
+}
+
+module.exports = {
+  consume,
+  refund,
+  remaining,
+  reset,
+  IterationBudgetExhaustedError,
+};

package/sdk/primitives/jittered-backoff.cjs

@@ -0,0 +1,112 @@
+// scripts/lib/jittered-backoff.cjs
+//
+// Plan 20-14 — jittered exponential backoff primitive.
+//
+// Replaces fixed-interval retry sleeps across the codebase (update-check,
+// watch-authorities, figma probes, connection probes, hook retry loops) with
+// a deterministic, capped, jittered backoff curve.
+//
+// Formula:
+//   base = min(maxMs, baseMs * factor^attempt)
+//   delay = base * (1 + rand(-jitter, +jitter))
+//   clamp to [0, maxMs * (1 + jitter)]
+//
+// The zero-based `attempt` counter gives `baseMs` on the first call, then
+// multiplies by `factor` per attempt up to the cap. Jitter is full-width
+// symmetric (not AWS-style equal/decorrelated) because our consumers are
+// single-threaded retry loops — there's no thundering-herd problem to
+// smooth; the jitter is cosmetic protection against synchronized retries
+// between siblings like the watcher + update-check running at the same
+// session boundary.
+//
+// Defaults (baseMs=100, maxMs=30_000, factor=2, jitter=0.2) yield:
+//   attempt 0 → 80-120ms
+//   attempt 1 → 160-240ms
+//   attempt 2 → 320-480ms
+//   ...
+//   attempt 9 → ~24s-30s (capped)
+//
+// This module is `.cjs` (not `.ts`) per Plan 20-14 D-01 so it can be
+// `require()`d from both the `.ts` runtime (hooks, MCP server) and future
+// `.cjs` CLI invocations without needing `--experimental-strip-types` at
+// every consumer site. Types live in the paired `jittered-backoff.d.cts`.
+//
+// No external dependencies; pure Math.random + setTimeout.
+
+'use strict';
+
+/**
+ * Default backoff parameters — chosen to cover retry-after-Xms through
+ * retry-after-30s with reasonable mid-range distribution.
+ */
+const DEFAULTS = Object.freeze({
+  baseMs: 100,
+  maxMs: 30_000,
+  factor: 2,
+  jitter: 0.2,
+});
+
+/**
+ * Compute the jittered delay in milliseconds for a given attempt number.
+ *
+ * @param {number} attempt zero-based attempt counter (0 = first retry)
+ * @param {object} [opts]
+ * @param {number} [opts.baseMs]  initial delay before any jitter. Default 100.
+ * @param {number} [opts.maxMs]   maximum un-jittered base. Default 30_000.
+ * @param {number} [opts.factor]  per-attempt multiplier. Default 2.
+ * @param {number} [opts.jitter]  symmetric jitter fraction in [0, 1). Default 0.2.
+ * @returns {number} delay in ms. Never negative. May exceed `maxMs` by up
+ *   to `jitter * maxMs` on the high side.
+ *
+ * Invariants:
+ *  - `delayMs(n, opts) >= 0` for every non-negative `n`.
+ *  - `delayMs(n, opts) <= maxMs * (1 + jitter)` for every non-negative `n`.
+ *  - The distribution has nonzero stddev whenever `jitter > 0`.
+ */
+function delayMs(attempt, opts) {
+  const baseMs = (opts && Number.isFinite(opts.baseMs)) ? opts.baseMs : DEFAULTS.baseMs;
+  const maxMs = (opts && Number.isFinite(opts.maxMs)) ? opts.maxMs : DEFAULTS.maxMs;
+  const factor = (opts && Number.isFinite(opts.factor)) ? opts.factor : DEFAULTS.factor;
+  const jitter = (opts && Number.isFinite(opts.jitter)) ? opts.jitter : DEFAULTS.jitter;
+
+  // Guard against nonsense inputs — callers that pass garbage shouldn't
+  // cause NaN or Infinity to propagate into setTimeout.
+  const a = Math.max(0, Number.isFinite(attempt) ? Math.floor(attempt) : 0);
+  const safeBase = Math.max(0, baseMs);
+  const safeMax = Math.max(safeBase, maxMs);
+  const safeFactor = factor > 0 ? factor : DEFAULTS.factor;
+  // Clamp jitter to [0, 1) — full-range (>=1) would allow negative values
+  // after subtraction, which we want to forbid by invariant.
+  const safeJitter = Math.min(0.999, Math.max(0, jitter));
+
+  // Exponential growth capped at safeMax.
+  // Math.pow with a huge attempt count can overflow to Infinity; the
+  // Math.min picks up safeMax before Infinity escapes.
+  const unjittered = Math.min(safeMax, safeBase * Math.pow(safeFactor, a));
+
+  // Symmetric jitter in [-jitter, +jitter).
+  // Math.random() returns [0, 1); 2r - 1 maps to [-1, 1); scale by jitter.
+  const noise = (Math.random() * 2 - 1) * safeJitter;
+  const delay = unjittered * (1 + noise);
+
+  // Floor at zero (noise could in theory go slightly negative due to FP
+  // precision even with safeJitter < 1, for very small unjittered values).
+  return Math.max(0, delay);
+}
+
+/**
+ * Sleep for a jittered backoff interval. Convenience wrapper around
+ * `delayMs` + `setTimeout`.
+ *
+ * @param {number} attempt zero-based attempt counter
+ * @param {object} [opts] see {@link delayMs}
+ * @returns {Promise<number>} resolves to the actual delay that was applied
+ */
+function sleep(attempt, opts) {
+  const ms = delayMs(attempt, opts);
+  return new Promise((resolve) => {
+    setTimeout(() => resolve(ms), ms);
+  });
+}
+
+module.exports = { delayMs, sleep, DEFAULTS };