@hmharness/kernel 0.6.6 → 0.6.7

package/dist/index.d.ts

@@ -1,4 +1,5 @@
 export * from './types.ts';
+export * from './shellgate.ts';
 export * from './registry.ts';
 export * from './provider.ts';
 export * from './window.ts';

package/dist/index.js

@@ -1,4 +1,5 @@
 export * from "./types.js";
+export * from "./shellgate.js";
 export * from "./registry.js";
 export * from "./provider.js";
 export * from "./window.js";

package/dist/loop.js

@@ -72,6 +72,18 @@ export async function runLoop(opts) {
         });
         usage.promptTokens += chatRes.usage?.prompt_tokens ?? 0;
         usage.completionTokens += chatRes.usage?.completion_tokens ?? 0;
+        // Usage fallback: many OpenAI-compatible gateways never report usage
+        // (even with stream_options.include_usage), which used to leave the token
+        // valve counting zero - a runaway loop had NO stop. Estimate from the
+        // wire text instead (chars/4 heuristic): coarse, but the valve only needs
+        // an order of magnitude to trip at 50M.
+        if (!chatRes.usage || (!chatRes.usage.prompt_tokens && !chatRes.usage.completion_tokens)) {
+            const promptChars = compacted.reduce((n, m) => n + (m.content?.length ?? 0), 0);
+            const replyChars = (chatRes.message.content?.length ?? 0)
+                + (chatRes.message.tool_calls ?? []).reduce((n, c) => n + c.function.arguments.length, 0);
+            usage.promptTokens += Math.ceil(promptChars / 4);
+            usage.completionTokens += Math.ceil(replyChars / 4);
+        }
         const { message } = chatRes;
         events?.onAssistant?.(message);
         const calls = message.tool_calls ?? [];
@@ -105,7 +117,7 @@ export async function runLoop(opts) {
                 p.isError = true;
                 p.skip = true;
             }
-            else if (tool.needsApproval?.(args)) {
+            else if (tool.needsApproval?.(args, ctx)) {
                 // Safe default: with no gate wired in, risky tools are denied.
                 const granted = opts.approval ? await opts.approval.ask(name, args) : false;
                 events?.onApproval?.(name, args, granted);

package/dist/provider.d.ts

@@ -15,6 +15,13 @@ export interface ChatResponse {
     };
 }
 export type DeltaKind = 'text' | 'reasoning';
+/** Parse a Retry-After header into a delay in ms (MDN: exactly two legal
+ *  forms - delta-seconds or HTTP-date), clamped to [0, 120s]. Returns 0 when
+ *  absent/illegal (caller falls back to exponential backoff). Deliberately
+ *  does NOT read x-ratelimit-reset: that header is an epoch timestamp in the
+ *  wild, which naive Number() parsing turned into a ~1.7e12 ms setTimeout
+ *  that overflowed and fired immediately - a retry storm. */
+export declare function parseRetryAfterMs(raw: string | null | undefined, maxMs?: number): number;
 export interface ChatOptions {
     timeoutMs?: number;
     /** Streaming callback; presence switches the request to stream:true. */

package/dist/provider.js

@@ -1,3 +1,20 @@
+/** Parse a Retry-After header into a delay in ms (MDN: exactly two legal
+ *  forms - delta-seconds or HTTP-date), clamped to [0, 120s]. Returns 0 when
+ *  absent/illegal (caller falls back to exponential backoff). Deliberately
+ *  does NOT read x-ratelimit-reset: that header is an epoch timestamp in the
+ *  wild, which naive Number() parsing turned into a ~1.7e12 ms setTimeout
+ *  that overflowed and fired immediately - a retry storm. */
+export function parseRetryAfterMs(raw, maxMs = 120_000) {
+    if (!raw)
+        return 0;
+    const v = raw.trim();
+    if (/^\d{1,10}$/.test(v))
+        return Math.min(maxMs, Number(v) * 1000);
+    const at = Date.parse(v);
+    if (!Number.isNaN(at))
+        return Math.min(maxMs, Math.max(0, at - Date.now()));
+    return 0;
+}
 export async function chat(cfg, messages, tools, opts = {}) {
     const streaming = typeof opts.onDelta === 'function';
     const body = { model: cfg.model, messages };
@@ -31,9 +48,10 @@ export async function chat(cfg, messages, tools, opts = {}) {
                 signal: ctrl.signal,
             });
             if (res.status === 429) {
-                // honour server-provided retry delay; fall back to exponential backoff
-                const retryAfter = Number(res.headers.get('retry-after')) || Number(res.headers.get('x-ratelimit-reset')) || 0;
-                const delay = retryAfter > 0 ? retryAfter * 1000 : Math.min(30_000, 2000 * Math.pow(2, attempt));
+                // Retry-After per RFC/MDN has two legal forms: delta-seconds ("120")
+                // or HTTP-date ("Wed, 21 Oct 2015 07:28:00 GMT"). See
+                // parseRetryAfterMs for why x-ratelimit-reset is deliberately ignored.
+                const delay = parseRetryAfterMs(res.headers.get('retry-after')) || Math.min(30_000, 2000 * Math.pow(2, attempt));
                 lastError = `HTTP 429 (rate limited): ${(await res.text()).slice(0, 200)}`;
                 await sleep(delay + Math.random() * 1000); // jitter
                 continue;

package/dist/shellgate.d.ts

@@ -0,0 +1,24 @@
+/**
+ * @hmharness/kernel - shell fast-path gate
+ *
+ * One shared implementation for every "run this without an approval card"
+ * decision over remotely/exec-ed shell strings (the agent's ssh_run tool and
+ * the web /api/ssh proxy). String allowlists are bypassable in general -
+ * documented bypass classes include command substitution `$()`/backticks
+ * (cli-mcp-server 0.2.5, CVE-2026-28470), `&&`-blind-spots (Claude Code),
+ * and argument-level execution such as `find -exec`/`-delete`
+ * (GHSA-cv3g-hj65-pcfh). The design here closes all of them at once:
+ *
+ *   fast path = ONE bare read-only verb + plain arguments + ZERO shell
+ *   metacharacters anywhere (no $ ` ( ) { } < > | ; & \ quotes/newlines)
+ *   and no verb whose own ARGUMENTS can execute or mutate (find, echo,
+ *   xargs, awk, date -s are excluded outright).
+ *
+ * Everything else returns false - i.e. needs an approval card. Fail closed:
+ * an unknown or oddly-shaped command is never a fast path.
+ */
+/**
+ * True only for a bare read-only probe (e.g. `df -h`, `ps aux`, `cat /etc/hosts`).
+ * Callers: `if (!isBareProbe(cmd)) → approval required`.
+ */
+export declare function isBareProbe(cmd: string): boolean;

package/dist/shellgate.js

@@ -0,0 +1,34 @@
+/**
+ * @hmharness/kernel - shell fast-path gate
+ *
+ * One shared implementation for every "run this without an approval card"
+ * decision over remotely/exec-ed shell strings (the agent's ssh_run tool and
+ * the web /api/ssh proxy). String allowlists are bypassable in general -
+ * documented bypass classes include command substitution `$()`/backticks
+ * (cli-mcp-server 0.2.5, CVE-2026-28470), `&&`-blind-spots (Claude Code),
+ * and argument-level execution such as `find -exec`/`-delete`
+ * (GHSA-cv3g-hj65-pcfh). The design here closes all of them at once:
+ *
+ *   fast path = ONE bare read-only verb + plain arguments + ZERO shell
+ *   metacharacters anywhere (no $ ` ( ) { } < > | ; & \ quotes/newlines)
+ *   and no verb whose own ARGUMENTS can execute or mutate (find, echo,
+ *   xargs, awk, date -s are excluded outright).
+ *
+ * Everything else returns false - i.e. needs an approval card. Fail closed:
+ * an unknown or oddly-shaped command is never a fast path.
+ */
+/** Metacharacters that enable substitution, chaining, or redirection. */
+const SHELL_METACHARS = /[$`(){}<>|;&'"\\\n\r]/;
+/** Verbs safe to run with plain arguments only (read-only, no exec-in-args). */
+const BARE_PROBE_VERBS = /^(ls|cat|head|tail|df|du|free|uptime|whoami|hostname|uname|ps|grep|wc|id|pwd|date)(\s+[A-Za-z0-9_.:@/=,-]+)*\s*$/;
+/**
+ * True only for a bare read-only probe (e.g. `df -h`, `ps aux`, `cat /etc/hosts`).
+ * Callers: `if (!isBareProbe(cmd)) → approval required`.
+ */
+export function isBareProbe(cmd) {
+    if (!cmd || SHELL_METACHARS.test(cmd))
+        return false;
+    if (/\bdate\b/.test(cmd) && /\s--?s(e[rt])?\b/.test(cmd))
+        return false; // clock set
+    return BARE_PROBE_VERBS.test(cmd);
+}

package/dist/types.d.ts

@@ -33,7 +33,7 @@ export interface Tool {
      * false means read-only / safe. Remote (MCP) tools default to needing
      * approval unless their server is marked trusted.
      */
-    needsApproval?(args: Record<string, unknown>): boolean;
+    needsApproval?(args: Record<string, unknown>, ctx?: ToolContext): boolean;
     execute(args: Record<string, unknown>, ctx: ToolContext): Promise<ToolResult>;
 }
 /** OpenAI-style chat message, reused across provider adapters. */
@@ -106,8 +106,18 @@ export interface HmhConfig {
      *  error self-notes (every task, zero cost), Tier 2 = one model-call
      *  lesson per erroring task (instant reflection), Tier 3 = this - full
      *  cycle with bench gate. Guards unchanged: double-gate, holdout, poison
-     *  screen, writes only under skills/ and memory/. */
+     *  screen; writes skills/ + memory/ + evolution logs, and repo code only
+     *  when evolution.autoPatch is explicitly enabled. */
     autoEvolveEvery?: number;
+    /** Evolution-cycle options. autoPatch (default FALSE) opts into code-level
+     *  self-evolution (the DGM-style sandboxed patch loop). Off by default:
+     *  self-modifying systems are unsafe by default (the DGM paper's own
+     *  framing) - with it off, evolution writes only skills/ + memory/ + its
+     *  own logs, never repo code. */
+    evolution?: {
+        /** Enable the code-patch (self-modification) step. Default false. */
+        autoPatch?: boolean;
+    };
     /** Named vendor endpoints for multi-provider routing. */
     providers?: Record<string, ProviderConfig>;
     /** Per-purpose provider names resolved against `providers`. */

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@hmharness/kernel",
-  "version": "0.6.6",
+  "version": "0.6.7",
   "description": "hmharness kernel: tool registry, provider adapters, the agent loop, session log, config. Zero runtime dependencies (Node >=22 native fetch).",
   "type": "module",
   "main": "dist/index.js",