@heretek-ai/epistemic-swarm 0.7.21 → 0.7.22

package/plugins/opencode/index.js

@@ -152,13 +152,13 @@ export const TOOL_CATALOG = [
         show: {
           type: 'boolean',
           description:
-            'Inspect only; equivalent to calling with no update keys (reads are always safe).',
+            'Inspect only; equivalent to calling with no update keys (reads are always safe). When true, the call is read-only even if update keys are present (they are reported as ignored and nothing is written; the expected_hash guard, including the dual-spelling conflict check, is not evaluated).',
           default: false,
         },
         expected_hash: {
           type: 'string',
           description:
-            'Optimistic-concurrency guard: SHA-256 (or a unique prefix of at least 8 hex chars) of the config file you read. A mismatch returns a structured stale error with a fresh snapshot and writes nothing. Alias: `expectedHash`; if both spellings are present they must be equal or the call is rejected.',
+            'Optimistic-concurrency guard: SHA-256 (or a unique prefix of at least 8 hex chars) of the config file you read. A mismatch returns a structured stale error with a fresh snapshot and writes nothing. Empty/whitespace-only spellings count as absent. Alias: `expectedHash`; if both spellings are present they must be equal after normalization (strip + lowercase) or the call is rejected.',
         },
         expectedHash: {
           type: 'string',
@@ -207,8 +207,8 @@ export const TOOL_CATALOG = [
         },
         searxng_url: {
           type: ['string', 'null'],
-          pattern: '^https?://',
-          description: 'Base URL of a self-hosted SearXNG, exported as SEARXNG_URL when set; must include an http:// or https:// scheme; null leaves the environment untouched.',
+          pattern: '^https?://[^\\s/]+\\S*$',
+          description: 'Base URL of a self-hosted SearXNG, exported as SEARXNG_URL when set; must include an http:// or https:// scheme and a host, with no whitespace anywhere; null leaves the environment untouched.',
         },
         license_whitelist: {
           type: 'array',
@@ -227,7 +227,8 @@ export const TOOL_CATALOG = [
         domain_pack: {
           type: ['string', 'null'],
           minLength: 1,
-          description: 'Regulated Domain Pack id (config/domain_packs/) or null for the legacy constitution; the empty string is rejected.',
+          pattern: '^\\S(.*\\S)?$',
+          description: 'Regulated Domain Pack id (config/domain_packs/) or null for the legacy constitution; the empty string, whitespace-only strings, and ids with leading/trailing whitespace are rejected.',
         },
         verify: {
           type: 'object',
@@ -440,13 +441,18 @@ export const TOOL_CATALOG = [
   {
     name: 'iumbtems_factory',
     description:
-      'Drive factory run state: init / phase-add / qa-record / expansion / stop. State goes to <project>/.factory and <project>/.roadmap; no helper-script path needed.',
+      'Drive factory run state: init / phase-add / qa-record / expansion / stop / gate. State goes to <project>/.factory and <project>/.roadmap; no helper-script path needed.',
     input: {
       type: 'object',
       properties: {
         command: {
           type: 'string',
-          enum: ['init', 'phase-add', 'qa-record', 'expansion', 'stop'],
+          enum: ['init', 'phase-add', 'qa-record', 'expansion', 'stop', 'gate'],
+        },
+        action: {
+          type: 'string',
+          enum: ['open', 'settle', 'approve', 'waive', 'escalate', 'count'],
+          description: 'Gate action (with command: gate)',
         },
         run: { type: 'string', description: 'Factory run name' },
         phase: { type: 'string', description: 'Phase id (e.g. 01-auth)' },
@@ -2227,13 +2233,16 @@ function rpcFail(context, type, message, data) {
 const SETTINGS_CONTROL_ARGS = new Set(['base_dir', 'dir', 'show', 'expected_hash', 'expectedHash']);
 
 /**
- * Leak signatures that must never reach the RPC transport (phase-03 R7/R9):
- * tracebacks, `File "…", line N` frames, interpreter failure lines, and
- * absolute filesystem paths of ANY root — POSIX (e.g. `/workspace/…`,
- * `/srv/…`, `/Users/…`, `/app/…`), Windows drive (`C:\Users\…`), and UNC
- * (`\\server\share`). Structured validation problems (e.g. `mode: value … not
- * in enum …`, type/range violations carrying ordinary values) match none of
- * these and pass through intact.
+ * Leak signatures that must never reach the RPC transport (phase-03 R7/R9,
+ * phase-08 R1): tracebacks, `File "…", line N` frames, interpreter failure
+ * lines, `file://` URIs, and absolute filesystem paths of ANY root — POSIX
+ * multi-segment (e.g. `/workspace/…`, `/srv/…`, `/Users/…`, `/app/…`),
+ * single-segment system roots (`/etc`, `/tmp`, `/lib`, `/lib64`, `/boot`,
+ * `/snap`, macOS `/System`, `/Library`, `/Volumes`, `/Applications`, …),
+ * Windows drive
+ * (`C:\Users\…`), and UNC (`\\server\share`). Structured validation problems
+ * (e.g. `mode: value … not in enum …`, type/range violations carrying
+ * ordinary values) match none of these and pass through intact.
  */
 const SETTINGS_ERROR_LEAK_PATTERNS = [
   // Tracebacks and Python/Node interpreter failure lines.
@@ -2241,7 +2250,39 @@ const SETTINGS_ERROR_LEAK_PATTERNS = [
   /File\s+["'][^"']+["']\s*,\s*line\s+\d+/i,
   /\b(?:ModuleNotFoundError|ImportError|SyntaxError|NameError|OSError|Errno \d+)\b/,
   // Absolute POSIX path of any root: a bounded leading slash + >=2 segments.
-  /(?:^|[\s"'(=:,])\/(?:[A-Za-z0-9._-]+\/)+[A-Za-z0-9._-]+/,
+  // Phase-08 R1 (W9) REWORK-2 L2: prefix class gains `[`, `{`, `-` so
+  // bracket/brace/dash-delimited absolutes (`[/etc]`, `{/etc}`, `-/etc`,
+  // `x-/lib64,y`) redact. Canonical values contain no `/`-root tokens
+  // (proven by the canonical-value corpus passing verbatim), so `-`-prefixed
+  // path tokens are disclosures, not user echoes.
+  /(?:^|[\s"'(=:,\[{-])\/(?:[A-Za-z0-9._-]+\/)+[A-Za-z0-9._-]+/,
+  // Phase-08 R1 (W9) REWORK-1: single-segment system-root absolutes
+  // (`/etc`, `/tmp`, plus `/lib`, `/lib64`, `/boot`, `/snap`, macOS `/System`,
+  // `/Library`, `/Volumes`, `/Applications`).
+  // The >=2-segment arm above lets these through, but a bare system root in
+  // a failure item is a local-filesystem disclosure (interpreter stderr
+  // echoes absolute paths of any depth). The root allowlist keeps ordinary
+  // user echoes intact: single-segment non-system values (`/v1`, `/nope`)
+  // still pass through, and sanitization stays per-item (R9).
+  // RESIDUAL (documented): truly exotic single-segment roots outside the
+  // mainstream Linux + macOS set (e.g. `/net`, `/nfs`, future mount points)
+  // still pass through by design to avoid over-redacting user echoes.
+  // TRIGGER (consumed for this class): qa-b repro `["error at /lib nope"]`
+  // passthrough + inspection-named `/lib64`, `/boot`, `/snap`, `/System`,
+  // `/Library`, `/Volumes`, `/Applications` are now covered. Revisit only
+  // with a NEW real leak repro naming the still-uncovered root.
+  // Phase-08 R1 (W9) REWORK-2 L1: suffix lookahead gains `.!?]}` so
+  // bare-root + sentence punctuation (`/lib.`, `/etc.`, `/lib!`, `/tmp?`,
+  // `/lib]`, `/lib}`) redacts. The >=2-segment arm is untouched (its trailing
+  // `[A-Za-z0-9._-]+` already consumes `/etc/foo.`). L2: prefix class gains
+  // `[`, `{`, `-` (same `-` safety proof as above) so `[/etc]`, `[/lib]`,
+  // `[/lib64]`, `{/etc}`, `-/etc`, `x-/lib64,y` redact.
+  /(?:^|[\s"'(=:,\[{-])\/(?:etc|var|tmp|srv|app|home|root|usr|opt|bin|sbin|proc|sys|dev|run|mnt|media|private|Users|workspace|lib64|lib|boot|snap|System|Library|Volumes|Applications)(?=\/|$|[\s"'<>|,;:().!?\]}])/,
+  // Phase-08 R1 (W9): `file://` URIs always disclose local filesystem
+  // layout, and no canonical config value is a file:// URI (`searxng_url`
+  // requires an http(s) scheme) — so a file:// URI in a failure item is
+  // never a legitimate user echo. Fail closed.
+  /file:\/\/[^\s"'<>|]+/i,
   // Windows drive-letter absolute path (`C:\Users\…`) or UNC share (`\\srv\share`).
   /\b[A-Za-z]:[\\/](?:[^\\/\s"'<>|]+[\\/])*[^\\/\s"'<>|]+/,
   /\\\\[^\\/\s"'<>|]+[\\/][^\\/\s"'<>|]+/,

package/plugins/opencode/tui.js

@@ -504,9 +504,98 @@ const WIZARD_KEEP_VALUE = '__iumbtems_keep__';
 
 function wizardToast(host, title, message) {
   try {
-    host?.ui?.toast?.show?.({ title, message, variant: 'info', duration: 6000 });
+    const toast = host?.ui?.toast;
+    const show = toast?.show;
+    if (typeof show !== 'function') return false;
+    show.call(toast, { title, message, variant: 'info', duration: 6000 });
+    return true;
   } catch {
-    /* toast is best-effort */
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Phase 07 (H8): keyed advisory dedup window for the repeating R4 advisories.
+//
+// Editing an env-shadowed or deprecated row fires its advisory on EVERY edit,
+// so a multi-edit wizard session spams one toast per row visit. `warnOnce`
+// collapses repeats of the SAME advisory key inside a TTL window: the first
+// shows, repeats within the window are suppressed (counted), expiry re-shows
+// (annotated with the suppressed count), and distinct keys stay independent.
+//
+// SAFETY: only the two repeating R4 advisories route here. Degraded-path,
+// malformed-config, validation-error, stale, and save-failure toasts call
+// `wizardToast` directly and are NEVER deduped (missed-action safety).
+// Durations are preserved: wizard advisories stay 6000ms via `wizardToast`
+// (the 4000ms keymap usage toast is untouched).
+// ---------------------------------------------------------------------------
+
+/** Dedup window for repeating R4 advisories, in ms. Exported for tests. */
+export const ADVISORY_DEDUP_MS = 30000;
+
+/** key -> { ts, suppressed }: last show time + repeats collapsed since. */
+const advisorySeen = new Map();
+
+/**
+ * Show a keyed advisory toast at most once per `ttlMs` window.
+ * Returns true when a toast was actually delivered, false when collapsed
+ * or when delivery failed (failed deliveries never arm the window).
+ * `opts.now` injects the clock (tests); `opts.ttlMs` overrides the window.
+ * Session scope: each `openSettingsWizard` call resets the window (fresh
+ * wizard session always warns at least once); repeats within one session
+ * still collapse. Never throws.
+ */
+export function warnOnce(host, key, title, message, opts = {}) {
+  try {
+    const ttl =
+      opts && opts.ttlMs !== undefined && opts.ttlMs !== null
+        ? Number(opts.ttlMs)
+        : ADVISORY_DEDUP_MS;
+    const now =
+      opts && opts.now !== undefined && opts.now !== null
+        ? Number(opts.now)
+        : Date.now();
+    const entry = advisorySeen.get(key);
+    if (entry && Number.isFinite(ttl) && ttl > 0) {
+      const dt = now - entry.ts;
+      if (Number.isFinite(dt) && dt >= 0 && dt < ttl) {
+        entry.suppressed += 1;
+        return false;
+      }
+      // dt < 0 (clock moved backwards) or dt >= ttl (expiry) fall through
+      // to reshow — a backwards clock must never suppress indefinitely.
+    }
+    let text = message;
+    if (entry && entry.suppressed > 0) {
+      text += ` (repeated ${entry.suppressed + 1}× since last notice)`;
+    }
+    // Arm the window ONLY on actual delivery: a failed toast (missing/broken
+    // host) leaves state untouched so the next real warning still delivers.
+    const delivered = wizardToast(host, title, text);
+    if (!delivered) return false;
+    advisorySeen.set(key, { ts: now, suppressed: 0 });
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/** Test hook: forget all dedup state. Never throws. */
+export function _resetAdvisoryDedup() {
+  try {
+    advisorySeen.clear();
+  } catch {
+    /* never throw */
+  }
+}
+
+/** Test hook: suppressed-repeat count pending for `key`. Never throws. */
+export function _advisorySuppressed(key) {
+  try {
+    const entry = advisorySeen.get(key);
+    return entry ? entry.suppressed : 0;
+  } catch {
+    return 0;
   }
 }
 
@@ -715,23 +804,29 @@ async function editRow(dialog, host, draft, row) {
   try {
     const sub = row.schema || {};
     // R4 advisories (never block the edit; the write still proceeds):
-    // an env-shadowed value has no runtime effect until the override is
-    // unset, and a deprecated key is display-only.
+    // an env-shadowed value is not effective while the override is set, and
+    // a deprecated key is ignored at runtime. Both route through the keyed
+    // dedup window (per-key repeats collapse); every other toast stays
+    // un-deduped so no error or degraded-path notice is ever swallowed.
     if (row.source === 'env-override') {
-      wizardToast(
+      warnOnce(
         host,
+        `env:${row.key}`,
         'Environment override',
-        `The environment shadows '${row.key}' — editing the file value has ` +
-          'no runtime effect until the override is unset. The stored value is ' +
-          'still saved on confirm.'
+        `The environment shadows '${row.key}' — the file value is not ` +
+          'effective while the override is set and has no runtime effect ' +
+          'until the override is unset. The edited value is still stored ' +
+          'on save (cancel writes nothing).'
       );
     }
     if (row.deprecated) {
-      wizardToast(
+      warnOnce(
         host,
+        `deprecated:${row.key}`,
         'Deprecated field',
-        `'${row.key}' is deprecated and display-only — it never selects the ` +
-          'workspace. The stored value is still saved on confirm.'
+        `'${row.key}' is deprecated and ignored — it has no runtime ` +
+          'effect. The edited value is still stored on save for reference, ' +
+          'but changes nothing (cancel writes nothing).'
       );
     }
     const types = Array.isArray(sub.type) ? sub.type : [sub.type];
@@ -999,6 +1094,15 @@ async function editAgentsRow(dialog, host, draft, row) {
  */
 export async function openSettingsWizard(host, root, opts = {}) {
   try {
+    // R1 session scope: a fresh wizard session always warns at least once.
+    // The keyed R4 window collapses repeats WITHIN one session only; reset
+    // the boundary here so a prior session (same key, <30s ago) never leaks
+    // into the new session. Never throws.
+    try {
+      advisorySeen.clear();
+    } catch {
+      /* dedup reset is best-effort */
+    }
     const dialog = dialogOf(host);
     const baseDir = researchDirOf(host, root);
     const env = (opts && opts.env) || process.env;

package/plugins/research-cache/skills/research_cache/hasher.py

@@ -17,6 +17,35 @@ from typing import Dict, Any, Optional, Tuple
 DEFAULT_RESEARCH_DIR = ".research"
 BASE_DIR_HELP = "Base .research directory"
 
+#: Historical decision boundary for the fuzzy quote fallback (config
+#: `verify.min_fuzzy_confidence`). This is the default whenever no threshold
+#: is configured or the configured value is malformed.
+DEFAULT_MIN_FUZZY_CONFIDENCE = 0.88
+
+
+def coerce_min_fuzzy_confidence(value: Any) -> float:
+    """Coerce a `verify.min_fuzzy_confidence` candidate into [0, 1].
+
+    SINGLE-ENFORCEMENT-POINT CONTRACT (Phase 05 H5): this function is the one
+    definition of the coercion rule — string values are parsed with `float()`
+    (so a hand-edited `"0.95"` behaves like `0.95`), the result is clamped
+    into [0, 1], and anything malformed (None, non-numeric strings, NaN)
+    falls back to `DEFAULT_MIN_FUZZY_CONFIDENCE` (0.88, the strict
+    historical boundary). `SourceHasher.verify_quote` enforces it at call
+    time; every other layer (MCP `iumbtems_verify_quote`, the auditor, the
+    swarm runner) forwards its configured value untouched and must NOT
+    re-implement this rule. The persisted schema stays strict
+    (`type: number`): coercion exists only for hand-edited files and direct
+    library callers, never as an excuse to loosen validation.
+    """
+    try:
+        threshold = float(value)
+    except (TypeError, ValueError):
+        return DEFAULT_MIN_FUZZY_CONFIDENCE
+    if threshold != threshold:  # NaN: float("nan") parses but matches nothing
+        return DEFAULT_MIN_FUZZY_CONFIDENCE
+    return max(0.0, min(1.0, threshold))
+
 
 def _log_retrieval(base_dir, kind: str, **fields) -> None:
     """Best-effort retrieval telemetry (see runner/retrieval_log.py)."""
@@ -146,15 +175,11 @@ class SourceHasher:
         the historical decision boundary; callers that pass a value opt into a
         stricter/looser match. Exact and normalized matches are unaffected.
 
-        The value is clamped into [0, 1] here — the single enforcement point —
-        so MCP/auditor layers may parse config freely; malformed input falls back
-        to the strict default.
+        Coercion is NOT done here inline: `coerce_min_fuzzy_confidence` (the
+        single enforcement point — see its contract) parses, clamps, and
+        defaults the threshold.
         """
-        try:
-            threshold = float(min_fuzzy_confidence)
-        except (TypeError, ValueError):
-            threshold = 0.88
-        threshold = max(0.0, min(1.0, threshold))
+        threshold = coerce_min_fuzzy_confidence(min_fuzzy_confidence)
 
         source_text = self.get_source_content(content_hash)
         if not source_text: