@hilbras/omninode 2.0.0-alpha.12 → 2.0.0-alpha.14

package/dist/index.js

@@ -80,16 +80,19 @@ var ConsoleLogSink = class {
 };
 var Logger = class _Logger {
   level;
+  format;
   sink;
   context;
   constructor(options = {}) {
     this.level = options.level ?? "info";
+    this.format = options.format ?? "text";
     this.sink = options.sink ?? new ConsoleLogSink();
     this.context = options.context ?? {};
   }
   child(context) {
     return new _Logger({
       level: this.level,
+      format: this.format,
       sink: this.sink,
       context: { ...this.context, ...context }
     });
@@ -108,8 +111,13 @@ var Logger = class _Logger {
   }
   log(level, message, data) {
     if (LEVEL_ORDER[level] < LEVEL_ORDER[this.level]) return;
-    const parts = [(/* @__PURE__ */ new Date()).toISOString(), level.toUpperCase(), message];
+    const at = (/* @__PURE__ */ new Date()).toISOString();
     const merged = { ...this.context, ...data };
+    if (this.format === "json") {
+      this.sink.write(level, JSON.stringify({ at, level, message, ...merged }));
+      return;
+    }
+    const parts = [at, level.toUpperCase(), message];
     if (Object.keys(merged).length > 0) {
       parts.push(JSON.stringify(merged));
     }
@@ -117,6 +125,10 @@ var Logger = class _Logger {
   }
 };
 var logger = new Logger();
+function configureLogger(options) {
+  if (options.level !== void 0) logger.level = options.level;
+  if (options.format !== void 0) logger.format = options.format;
+}
 
 // src/config/schema.ts
 import { z } from "zod";
@@ -199,9 +211,45 @@ var projectConfigSchema = z.object({
 }).strict();
 var appConfigSchema = z.object({
   project: projectConfigSchema,
-  logging: z.object({ level: z.enum(["debug", "info", "warn", "error"]) }).strict().optional()
+  logging: z.object({
+    level: z.enum(["debug", "info", "warn", "error"]),
+    format: z.enum(["text", "json"]).optional()
+  }).strict().optional()
 }).strict();
 
+// src/config/secrets.ts
+var SAFE_KEY_SUFFIXES = ["_env", "_env_var", "_file", "_path", "_ref", "_id", "_url", "_command"];
+var SECRET_KEY = /^\s*([A-Za-z0-9_-]*(?:api[_-]?key|token|password|passwd|secret|credential)[A-Za-z0-9_-]*)\s*:\s*(.*)$/i;
+var SAFE_VALUE = /^\s*(?:\$\{[^}]*\}|\$[A-Z_][A-Z0-9_]*|<[^>]*>|""|''|null|~)\s*$/i;
+function scanForInlineSecrets(source) {
+  const findings = [];
+  source.split("\n").forEach((line, index) => {
+    const trimmed = line.trim();
+    if (trimmed.startsWith("#")) return;
+    const match = SECRET_KEY.exec(line);
+    if (!match) return;
+    const key = match[1] ?? "";
+    const rawValue = (match[2] ?? "").trim().replace(/,\s*$/, "");
+    const keyIsReference = SAFE_KEY_SUFFIXES.some((suffix) => key.toLowerCase().endsWith(suffix));
+    if (keyIsReference) return;
+    const value = rawValue.replace(/^["']|["']$/g, "");
+    if (value.length === 0 || SAFE_VALUE.test(rawValue)) return;
+    if (value.length < 8) return;
+    findings.push({
+      line: index + 1,
+      key,
+      excerpt: `${key}: ${value.slice(0, 3)}\u2026 (${value.length} chars, redacted)`
+    });
+  });
+  return findings;
+}
+function describeSecretFindings(file, findings) {
+  const lines = findings.map((f) => `  line ${f.line}: ${f.excerpt}`).join("\n");
+  return `${file} appears to contain ${findings.length} inline secret(s):
+${lines}
+OmniNode never stores credentials in configuration. Replace each value with an environment-variable reference, e.g. api_key_env_var: MY_API_KEY.`;
+}
+
 // src/config/loader.ts
 import { existsSync, readFileSync } from "fs";
 import { parse as parseYaml } from "yaml";
@@ -238,6 +286,10 @@ function loadConfig(options = {}) {
     );
   }
   const raw = readFileSync(path, "utf8");
+  const secretFindings = scanForInlineSecrets(raw);
+  if (secretFindings.length > 0) {
+    throw new ConfigError("CONFIG_INVALID", describeSecretFindings(path, secretFindings));
+  }
   const expanded = expandEnvRefs(raw, env, path);
   let data;
   try {
@@ -541,7 +593,9 @@ var OpenAICompatibleProvider = class {
   /** Discovered models, so getModel() answers without another round-trip. */
   discovered;
   env;
-  constructor(config, log = logger, env = process.env) {
+  audit;
+  constructor(config, log = logger, env = process.env, audit) {
+    this.audit = audit;
     this.config = { ...config, baseUrl: normalizeBaseUrl(config.baseUrl) };
     this.env = env;
     this.providerId = config.providerId ?? config.name;
@@ -580,17 +634,28 @@ var OpenAICompatibleProvider = class {
         timeoutMs: this.requestTimeoutMs
       });
     } catch (error) {
-      if (error instanceof ProviderError) throw error;
-      throw providerTransportError({ provider: this.config.name, operation: "listModels", cause: error });
+      if (error instanceof ProviderError) {
+        await this.recordProviderError("listModels", error);
+        throw error;
+      }
+      const normalized = providerTransportError({
+        provider: this.config.name,
+        operation: "listModels",
+        cause: error
+      });
+      await this.recordProviderError("listModels", normalized);
+      throw normalized;
     }
     const { status, body } = response;
     if (status !== 200) {
-      throw providerHttpError({
+      const httpError = providerHttpError({
         provider: this.config.name,
         operation: "listModels",
         status,
         body
       });
+      await this.recordProviderError("listModels", httpError);
+      throw httpError;
     }
     return response;
   }
@@ -642,6 +707,21 @@ var OpenAICompatibleProvider = class {
   stream(request, onChunk) {
     return streamChatCompletion(this.config, request, onChunk, this.env);
   }
+  /** Provider errors are part of the audit trail (§14 correlation, §18 observability). */
+  async recordProviderError(operation, error) {
+    await this.audit?.record({
+      at: (/* @__PURE__ */ new Date()).toISOString(),
+      action: "provider.error",
+      id: this.providerId,
+      providerId: this.providerId,
+      detail: {
+        operation,
+        code: error.code,
+        kind: error.details?.kind,
+        message: error.message
+      }
+    });
+  }
   async healthCheck() {
     const lastCheckedAt = (/* @__PURE__ */ new Date()).toISOString();
     try {
@@ -686,12 +766,17 @@ var OpenAICompatibleProvider = class {
         }
       });
     } catch (error) {
-      if (error instanceof ProviderError) throw error;
-      throw providerTransportError({ provider: this.config.name, operation: "chat", cause: error });
+      if (error instanceof ProviderError) {
+        await this.recordProviderError("chat", error);
+        throw error;
+      }
+      const normalized = providerTransportError({ provider: this.config.name, operation: "chat", cause: error });
+      await this.recordProviderError("chat", normalized);
+      throw normalized;
     }
     const { status, body } = response;
     if (status !== 200) {
-      throw providerHttpError({
+      const httpError = providerHttpError({
         provider: this.config.name,
         operation: "chat",
         status,
@@ -700,6 +785,8 @@ var OpenAICompatibleProvider = class {
           code: "MODEL_NOT_FOUND"
         } : {}
       });
+      await this.recordProviderError("chat", httpError);
+      throw httpError;
     }
     const payload = body;
     const choices = Array.isArray(payload.choices) ? payload.choices : [];
@@ -892,13 +979,18 @@ var OPENAI_COMPATIBLE_TYPES = [
   "local",
   "custom"
 ];
-function createProvider(config) {
+function createProvider(config, options = {}) {
+  const shared = {
+    ...options.env !== void 0 ? { env: options.env } : {},
+    ...options.audit !== void 0 ? { audit: options.audit } : {}
+  };
   if (config.type === "omnihilbras") {
-    return new OmniHilbrasProvider(config);
+    return new OmniHilbrasProvider(config, void 0, options.env, options.audit);
   }
   if (OPENAI_COMPATIBLE_TYPES.includes(config.type)) {
-    return new OpenAICompatibleProvider(config);
+    return new OpenAICompatibleProvider(config, void 0, options.env, options.audit);
   }
+  void shared;
   throw new OmniNodeError("NOT_IMPLEMENTED", `Provider type "${config.type}" has no adapter yet.`);
 }
 
@@ -1820,28 +1912,34 @@ function buildRoleRegistry(config) {
 }
 
 // src/persistence/json-file-store.ts
-import { open, mkdir, readFile, rename, stat } from "fs/promises";
+import { open, mkdir, readFile, rename, stat, writeFile } from "fs/promises";
 import { dirname } from "path";
 var SCHEMA_VERSION = 2;
-async function writeFileAtomic(target, contents) {
+async function writeFileAtomic(target, contents, durability = "rename") {
   const tmp = `${target}.tmp`;
   await mkdir(dirname(target), { recursive: true });
-  const handle = await open(tmp, "w");
-  try {
-    await handle.writeFile(contents, "utf8");
-    await handle.sync();
-  } finally {
-    await handle.close();
+  if (durability === "fsync") {
+    const handle = await open(tmp, "w");
+    try {
+      await handle.writeFile(contents, "utf8");
+      await handle.sync();
+    } finally {
+      await handle.close();
+    }
+  } else {
+    await writeFile(tmp, contents, "utf8");
   }
   await rename(tmp, target);
-  try {
-    const dir = await open(dirname(target), "r");
+  if (durability === "fsync") {
     try {
-      await dir.sync();
-    } finally {
-      await dir.close();
+      const dir = await open(dirname(target), "r");
+      try {
+        await dir.sync();
+      } finally {
+        await dir.close();
+      }
+    } catch {
     }
-  } catch {
   }
 }
 async function inspectDocument(path) {
@@ -1911,6 +2009,7 @@ async function readDocument(path, onCorrupt, quarantine = true) {
 var JsonFileStore = class {
   filePath;
   schemaVersion;
+  durability;
   onCorrupt;
   quarantine;
   log;
@@ -1918,6 +2017,7 @@ var JsonFileStore = class {
   constructor(options) {
     this.filePath = `${options.directory ?? `${process.cwd()}/.omninode`}/${options.fileName}`;
     this.schemaVersion = options.schemaVersion ?? SCHEMA_VERSION;
+    this.durability = options.durability ?? "rename";
     this.onCorrupt = options.onCorrupt;
     this.quarantine = options.quarantine ?? true;
     this.log = logger.child({ component: "persistence", file: options.fileName });
@@ -1932,7 +2032,7 @@ var JsonFileStore = class {
   async writeAll(items) {
     const document = { schemaVersion: this.schemaVersion, items };
     await writeFileAtomic(this.filePath, `${JSON.stringify(document, null, 2)}
-`);
+`, this.durability);
   }
   /** Serializes an async operation against this file. */
   synchronized(operation) {
@@ -2029,13 +2129,14 @@ var TaskEngine = class {
       createdAt: now,
       updatedAt: now,
       ...input.project !== void 0 ? { project: input.project } : {},
+      ...input.pipelineId !== void 0 ? { pipelineId: input.pipelineId } : {},
       ...input.role !== void 0 ? { role: input.role } : {},
       ...input.agent !== void 0 ? { agent: input.agent } : {},
       ...input.context !== void 0 ? { context: input.context } : {}
     };
     await this.options.store.save(task);
     this.log.info(`Created task ${task.id}.`);
-    await this.audit("task.created", task.id, { objective: task.objective, project: task.project });
+    await this.audit("task.created", task, { objective: task.objective });
     return task;
   }
   async queue(id) {
@@ -2078,12 +2179,24 @@ var TaskEngine = class {
       const executionId = `exec-${Date.now().toString(36)}-${randomBytes(3).toString("hex")}`;
       const startedAt = (/* @__PURE__ */ new Date()).toISOString();
       current = await this.transition(current, "running", { attempt });
+      await this.options.audit?.record({
+        at: startedAt,
+        action: "agent.started",
+        id: current.id,
+        taskId: current.id,
+        ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
+        agentId: task.agent,
+        executionId,
+        detail: { attempt }
+      });
       let output;
       let thrown;
       try {
         output = await agent.run({
           taskId: current.id,
           objective: current.objective,
+          executionId,
+          ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
           ...role ? { role } : {},
           ...background !== void 0 ? { context: background } : {}
         });
@@ -2091,6 +2204,16 @@ var TaskEngine = class {
         thrown = error;
       }
       const finishedAt = (/* @__PURE__ */ new Date()).toISOString();
+      await this.options.audit?.record({
+        at: finishedAt,
+        action: "agent.completed",
+        id: current.id,
+        taskId: current.id,
+        ...current.pipelineId !== void 0 ? { pipelineId: current.pipelineId } : {},
+        agentId: task.agent,
+        executionId,
+        detail: { attempt, outcome: thrown !== void 0 || output === void 0 ? "threw" : "returned" }
+      });
       if (thrown !== void 0 || output === void 0) {
         const outcome = classifyThrown(thrown);
         const message = thrown instanceof Error ? thrown.message : String(thrown);
@@ -2170,7 +2293,7 @@ var TaskEngine = class {
       updatedAt: (/* @__PURE__ */ new Date()).toISOString()
     };
     await this.options.store.save(reset);
-    await this.audit("task.retry", id, { from: task.status });
+    await this.audit("task.retry", reset, { from: task.status });
     this.log.info(`Task ${id} reset for retry.`);
     return reset;
   }
@@ -2203,16 +2326,21 @@ var TaskEngine = class {
       ...extra.result !== void 0 ? { result: { ...task.result, ...extra.result } } : {}
     };
     await this.options.store.save(updated);
-    await this.audit(`task.${to === "queued" ? "queued" : to}`, updated.id, {
+    await this.audit(`task.${to === "queued" ? "queued" : to}`, updated, {
       from: task.status
     });
     return updated;
   }
-  async audit(action, id, detail) {
+  async audit(action, task, detail, executionId) {
     await this.options.audit?.record({
       at: (/* @__PURE__ */ new Date()).toISOString(),
       action,
-      id,
+      id: task.id,
+      taskId: task.id,
+      ...task.project !== void 0 ? { project: task.project } : {},
+      ...task.pipelineId !== void 0 ? { pipelineId: task.pipelineId } : {},
+      ...task.agent !== void 0 ? { agentId: task.agent } : {},
+      ...executionId !== void 0 ? { executionId } : {},
       ...detail !== void 0 ? { detail } : {}
     });
   }
@@ -2235,7 +2363,7 @@ function sleep(ms) {
 }
 
 // src/audit/index.ts
-import { mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
+import { appendFile, mkdir as mkdir2, readFile as readFile2 } from "fs/promises";
 import { dirname as dirname2 } from "path";
 var FileAuditLog = class {
   filePath;
@@ -2247,15 +2375,8 @@ var FileAuditLog = class {
   async record(event) {
     try {
       await mkdir2(dirname2(this.filePath), { recursive: true });
-      const { open: open2 } = await import("fs/promises");
-      const handle = await open2(this.filePath, "a");
-      try {
-        await handle.appendFile(`${JSON.stringify(event)}
+      await appendFile(this.filePath, `${JSON.stringify(event)}
 `, "utf8");
-        await handle.sync();
-      } finally {
-        await handle.close();
-      }
     } catch (error) {
       this.log.warn(
         `Audit write failed: ${error instanceof Error ? error.message : String(error)}`
@@ -3394,6 +3515,7 @@ var PipelineEngine = class {
       at: (/* @__PURE__ */ new Date()).toISOString(),
       action: "pipeline.run.started",
       id: run.id,
+      pipelineId: def.id,
       detail: { pipeline: def.id, objective }
     });
     const deps = this.effectiveDependencies(def);
@@ -3434,7 +3556,9 @@ var PipelineEngine = class {
             combinedContext: contextParts.join("\n\n"),
             reports: [...allReports],
             pipelineRunId: run.id,
-            runId: run.id
+            runId: run.id,
+            pipelineDefId: def.id,
+            taskId: run.id
           };
           return this.executeStep(step, ctx);
         })
@@ -3511,8 +3635,9 @@ ${contribution}`);
     this.log.info(`Pipeline ${def.id} finished: ${finalStatus}.`);
     await this.options.audit?.record({
       at: (/* @__PURE__ */ new Date()).toISOString(),
-      action: "pipeline.run.finished",
+      action: cancelled ? "pipeline.run.cancelled" : finalStatus === "failed" ? "pipeline.run.failed" : "pipeline.run.finished",
       id: run.id,
+      pipelineId: def.id,
       detail: { pipeline: def.id, status: finalStatus }
     });
     return finished;
@@ -3593,6 +3718,7 @@ ${contribution}`);
       agentNames.map(
         (name) => this.options.tasks.create({
           objective: ctx.objective,
+          ...ctx.pipelineRunId !== void 0 ? { pipelineId: ctx.pipelineRunId } : {},
           agent: name,
           ...ctx.role ? { role: ctx.role.id } : {},
           ...ctx.combinedContext.length > 0 ? { context: { background: ctx.combinedContext } } : {}
@@ -3635,6 +3761,7 @@ ${contribution}`);
   async runSingle(step, ctx, agentName) {
     const task = await this.options.tasks.create({
       objective: ctx.objective,
+      ...ctx.pipelineRunId !== void 0 ? { pipelineId: ctx.pipelineRunId } : {},
       agent: agentName,
       ...ctx.role ? { role: ctx.role.id } : {},
       ...ctx.combinedContext.length > 0 ? { context: { background: ctx.combinedContext } } : {}
@@ -3705,7 +3832,13 @@ ${contribution}`);
       at: (/* @__PURE__ */ new Date()).toISOString(),
       action: "plan.generated",
       id: plan.id,
-      detail: { generatedBy: plan.generatedBy, steps: plan.steps.length }
+      ...ctx.pipelineDefId !== void 0 ? { pipelineId: ctx.pipelineDefId } : {},
+      detail: {
+        generatedBy: plan.generatedBy,
+        steps: plan.steps.length,
+        run: ctx.pipelineRunId,
+        taskId: ctx.taskId
+      }
     });
     return {
       status: "completed",
@@ -3739,7 +3872,7 @@ function formatPlan(plan) {
   }
   return lines.join("\n");
 }
-function createDefaultChatFn(providers) {
+function createDefaultChatFn(providers, options = {}) {
   return async (modelRef, messages) => {
     const separator = modelRef.indexOf(":");
     if (separator <= 0 || separator === modelRef.length - 1) {
@@ -3757,7 +3890,10 @@ function createDefaultChatFn(providers) {
         `Provider "${providerName}" (model "${modelRef}") is not configured.`
       );
     }
-    const provider = createProvider(providerConfig);
+    const provider = createProvider(providerConfig, {
+      ...options.audit !== void 0 ? { audit: options.audit } : {},
+      ...options.env !== void 0 ? { env: options.env } : {}
+    });
     const response = await provider.chat({ model: modelId, messages });
     return response.content;
   };
@@ -3896,6 +4032,7 @@ function truncate3(text, max) {
 }
 
 // src/reports/service.ts
+var MAX_REPORT_BYTES = 256 * 1024;
 var ReportService = class {
   constructor(store, log = logger) {
     this.store = store;
@@ -3930,6 +4067,16 @@ var ReportService = class {
     const reports = [];
     const rejected = [];
     for (const candidate of candidates) {
+      const size = Buffer.byteLength(JSON.stringify(candidate), "utf8");
+      if (size > MAX_REPORT_BYTES) {
+        rejected.push({
+          key: candidate?.id ?? "(unknown)",
+          reason: `report exceeds the ${MAX_REPORT_BYTES} byte limit (${size} bytes)`,
+          issues: []
+        });
+        this.log.warn(`Rejected oversized report (${size} bytes).`);
+        continue;
+      }
       const result = validateReport(candidate);
       if (result.valid) {
         reports.push(result.report);
@@ -4003,9 +4150,10 @@ var FileReportStore = class extends JsonFileStore {
 
 // src/pipelines/engine-factory.ts
 function buildPipelineEngine(config, log = logger) {
+  const auditLog = new FileAuditLog();
   const agents = buildAgentRegistry(config, log);
   const roles = buildRoleRegistry(config);
-  const chat = createDefaultChatFn(config.project.providers);
+  const chat = createDefaultChatFn(config.project.providers, { audit: auditLog });
   const tasks = new TaskEngine({
     agents,
     roles,
@@ -4102,7 +4250,7 @@ async function migrateProjectStores(directory = `${process.cwd()}/.omninode`, op
 }
 
 // src/version.ts
-var OMNINODE_VERSION = "2.0.0-alpha.12";
+var OMNINODE_VERSION = "2.0.0-alpha.14";
 export {
   AgentAdapterRegistry,
   AgentError,
@@ -4121,6 +4269,7 @@ export {
   Logger,
   MAX_CONTEXT_CHARS,
   MAX_MESSAGE_BYTES,
+  MAX_REPORT_BYTES,
   MemoryError,
   MemoryService,
   ModelPlanner,
@@ -4163,6 +4312,7 @@ export {
   buildPlannerContext,
   buildRoleRegistry,
   composeTaskText,
+  configureLogger,
   createAgent,
   createDefaultChatFn,
   createMemoryProvider,
@@ -4174,6 +4324,7 @@ export {
   defaultProjectConfigYaml,
   defaultSearch,
   describeExit,
+  describeSecretFindings,
   detectConflicts,
   encodeMessage,
   envelope,
@@ -4215,6 +4366,7 @@ export {
   resolveEnvPolicy,
   roleConfigSchema,
   sanitizeChunk,
+  scanForInlineSecrets,
   similar,
   validateEnvelope,
   validatePlan,