@jevvy/permissions 0.0.0

package/dist/calibration.js

@@ -0,0 +1,153 @@
+import { Schema } from "effect";
+const CalibrationCorpusSchema = Schema.Struct({
+    meta: Schema.optional(Schema.Struct({
+        note: Schema.optional(Schema.String),
+        repeatCount: Schema.optional(Schema.Int.check(Schema.isGreaterThanOrEqualTo(1))),
+    })),
+    commands: Schema.Array(Schema.Struct({
+        command: Schema.NonEmptyString,
+        want: Schema.Literals(["allow", "ask", "must-ask"]),
+    })).check(Schema.isMinLength(1)),
+    repeats: Schema.optional(Schema.Array(Schema.NonEmptyString)),
+});
+export const parseCalibrationCorpus = (value, name) => {
+    let decoded;
+    try {
+        decoded = Schema.decodeUnknownSync(CalibrationCorpusSchema, { onExcessProperty: "error" })(value);
+    }
+    catch {
+        throw new Error(`${name} does not match the calibration corpus schema`);
+    }
+    if ((decoded.repeats?.length ?? 0) > 0 && decoded.meta?.repeatCount === undefined) {
+        throw new Error(`${name} must set meta.repeatCount when repeats are present`);
+    }
+    return decoded;
+};
+export const buildCalibrationPlan = (corpora) => {
+    const seen = new Map();
+    const plan = [];
+    for (const named of corpora) {
+        const byCommand = new Map(named.corpus.commands.map((entry) => [entry.command, entry]));
+        for (const entry of named.corpus.commands) {
+            const previous = seen.get(entry.command);
+            if (previous !== undefined) {
+                throw new Error(`duplicate command in ${previous} and ${named.name}: ${entry.command}`);
+            }
+            seen.set(entry.command, named.name);
+            plan.push({ corpus: named.name, kind: "base", ...entry });
+        }
+        for (const command of named.corpus.repeats ?? []) {
+            const entry = byCommand.get(command);
+            if (entry === undefined)
+                throw new Error(`${named.name} repeats a command not present in its commands array: ${command}`);
+            for (let probe = 1; probe <= (named.corpus.meta?.repeatCount ?? 0); probe++) {
+                plan.push({ corpus: named.name, kind: "repeat", ...entry, probe });
+            }
+        }
+    }
+    return plan;
+};
+const mean = (numbers) => numbers.reduce((sum, number) => sum + number, 0) / numbers.length;
+const deviation = (numbers) => {
+    const average = mean(numbers);
+    return Math.sqrt(mean(numbers.map((number) => (number - average) ** 2)));
+};
+const percentile = (numbers, fraction) => numbers[Math.min(numbers.length - 1, Math.floor(numbers.length * fraction))] ?? 0;
+export const summarizeCalibration = (meta, records, completedAt = new Date().toISOString()) => {
+    const results = records.filter((record) => record.status === "result");
+    const errors = records.filter((record) => record.status === "error");
+    const mustAskLeaks = results.filter((record) => record.want === "must-ask" && record.effect === "allow");
+    const labelMismatches = results.filter((record) => (record.want === "allow") !== (record.effect === "allow"));
+    const modelMismatches = results.filter((record) => record.model !== meta.requestedModel);
+    const matrix = {
+        allow: { allow: 0, ask: 0 },
+        ask: { allow: 0, ask: 0 },
+        "must-ask": { allow: 0, ask: 0 },
+    };
+    for (const record of results)
+        matrix[record.want][record.effect]++;
+    const repeatedSummary = [];
+    const repeated = new Map();
+    for (const record of results) {
+        if (record.kind !== "repeat")
+            continue;
+        const key = `${record.corpus}\u0000${record.command}`;
+        const rows = repeated.get(key) ?? [];
+        rows.push(record);
+        repeated.set(key, rows);
+    }
+    for (const rows of repeated.values()) {
+        const first = rows[0];
+        if (first === undefined)
+            continue;
+        const allRows = results.filter((record) => record.corpus === first.corpus && record.command === first.command);
+        const verdicts = allRows.reduce((counts, record) => {
+            counts[record.effect]++;
+            return counts;
+        }, { allow: 0, ask: 0 });
+        for (const name of Object.keys(meta.questions)) {
+            const values = allRows.flatMap((record) => record.answers[name] === undefined ? [] : [record.answers[name]]);
+            if (values.length === 0)
+                continue;
+            repeatedSummary.push({
+                corpus: first.corpus,
+                command: first.command,
+                question: name,
+                mean: mean(values),
+                minimum: Math.min(...values),
+                maximum: Math.max(...values),
+                standardDeviation: deviation(values),
+                verdicts,
+            });
+        }
+    }
+    const latencies = results.map((record) => record.ms).sort((left, right) => left - right);
+    const failed = errors.length > 0 || mustAskLeaks.length > 0 || modelMismatches.length > 0;
+    const summary = {
+        summary: true,
+        completedAt,
+        result: failed ? "failed" : "passed",
+        failed,
+        counts: {
+            planned: meta.calls,
+            completed: records.length,
+            errors: errors.length,
+            mustAskLeaks: mustAskLeaks.length,
+            modelMismatches: modelMismatches.length,
+            labelMismatches: labelMismatches.length,
+        },
+        matrix,
+        repeated: repeatedSummary,
+        mustAskLeaks: mustAskLeaks.map((record) => ({ corpus: record.corpus, command: record.command })),
+        labelMismatches: labelMismatches.map((record) => ({
+            corpus: record.corpus,
+            command: record.command,
+            want: record.want,
+            effect: record.effect,
+        })),
+        modelMismatches: modelMismatches.map((record) => ({
+            corpus: record.corpus,
+            command: record.command,
+            requested: meta.requestedModel,
+            served: record.model,
+        })),
+        errors: errors.map((record) => ({ corpus: record.corpus, command: record.command, error: record.error })),
+    };
+    if (latencies.length === 0)
+        return summary;
+    return {
+        ...summary,
+        latency: {
+            p50: percentile(latencies, 0.5),
+            p90: percentile(latencies, 0.9),
+            mean: mean(latencies),
+            maximum: latencies.at(-1) ?? 0,
+        },
+    };
+};
+export const calibrationMetaRecord = (meta) => ({
+    schemaVersion: 1,
+    meta: true,
+    ...meta,
+});
+export const numericAnswers = (answers) => Object.fromEntries(Object.entries(answers).map(([name, answer]) => [name, answer.noul]));

package/dist/config.d.ts

@@ -0,0 +1,59 @@
+import { ConfigProvider, Effect, Schema } from "effect";
+import type { Redacted } from "effect";
+import type { ApprovalQuestions } from "./questions.ts";
+declare const ProviderPreferenceSchema: Schema.Literals<readonly ["auto", "zen", "typesafe"]>;
+export interface ProviderApiKeys {
+    readonly zen?: Redacted.Redacted<string>;
+    readonly typesafe?: Redacted.Redacted<string>;
+}
+export type ProviderPreference = Schema.Schema.Type<typeof ProviderPreferenceSchema>;
+export type JevvyConfig = {
+    readonly kind: "default";
+    readonly provider: ProviderPreference;
+    readonly apiKeys: ProviderApiKeys;
+} | {
+    readonly kind: "custom";
+    readonly provider: ProviderPreference;
+    readonly apiKeys: ProviderApiKeys;
+    readonly questions: ApprovalQuestions;
+} | {
+    readonly kind: "invalid";
+    readonly message: string;
+};
+export declare const globalJevvyConfigPath: () => string;
+export declare const loadJevvyConfig: (path?: string, environment?: ConfigProvider.ConfigProvider) => Effect.Effect<{
+    kind: "default";
+    provider: "auto" | "typesafe" | "zen";
+    apiKeys: ProviderApiKeys;
+    message?: undefined;
+    questions?: undefined;
+} | {
+    kind: "invalid";
+    message: string;
+    provider?: undefined;
+    apiKeys?: undefined;
+    questions?: undefined;
+} | {
+    message?: undefined;
+    kind: "custom";
+    provider: "auto" | "typesafe" | "zen";
+    apiKeys: ProviderApiKeys;
+    questions: {
+        readonly [x: string]: {
+            readonly type: "noul";
+            readonly instructions: string;
+            readonly criteria?: {
+                readonly false: string;
+                readonly true: string;
+            } | undefined;
+            readonly threshold: {
+                readonly direction: "atLeast" | "atMost";
+                readonly value: number;
+            };
+        };
+    };
+} | {
+    kind: "invalid";
+    message: string;
+}, never, never>;
+export {};

package/dist/config.js

@@ -0,0 +1,111 @@
+import { chmod, readFile, stat } from "node:fs/promises";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { Config, ConfigProvider, Effect, Option, Schema } from "effect";
+import { parse } from "jsonc-parser";
+const Probability = Schema.Finite.check(Schema.isBetween({ minimum: 0, maximum: 1 }));
+const CriteriaSchema = Schema.Struct({
+    false: Schema.NonEmptyString,
+    true: Schema.NonEmptyString,
+});
+const ApprovalQuestionSchema = Schema.Struct({
+    type: Schema.Literal("noul"),
+    instructions: Schema.NonEmptyString,
+    criteria: Schema.optional(CriteriaSchema),
+    threshold: Schema.Struct({
+        direction: Schema.Literals(["atLeast", "atMost"]),
+        value: Probability,
+    }),
+});
+const ApprovalQuestionsSchema = Schema.Record(Schema.NonEmptyString, ApprovalQuestionSchema);
+const ProviderPreferenceSchema = Schema.Literals(["auto", "zen", "typesafe"]);
+const ProviderCredentialSchema = Schema.Struct({
+    apiKey: Schema.NonEmptyString,
+});
+const JevvyConfigSchema = Schema.Struct({
+    $schema: Schema.optional(Schema.String),
+    provider: Schema.optional(ProviderPreferenceSchema),
+    providers: Schema.optional(Schema.Struct({
+        zen: Schema.optional(ProviderCredentialSchema),
+        typesafe: Schema.optional(ProviderCredentialSchema),
+    })),
+    permissions: Schema.optional(Schema.Struct({
+        questions: Schema.optional(ApprovalQuestionsSchema),
+    })),
+});
+class ConfigMissing extends Schema.TaggedError()("ConfigMissing", {}) {
+}
+class ConfigFileError extends Schema.TaggedError()("ConfigFileError", {
+    reason: Schema.Literals(["read", "schema", "permissions"]),
+}) {
+}
+const fileApiKey = (provider) => Config.redacted("apiKey").pipe(Config.nested(provider), Config.nested("providers"));
+const RuntimeConfig = Config.all({
+    provider: Config.schema(ProviderPreferenceSchema, "provider"),
+    zen: Config.option(fileApiKey("zen").pipe(Config.orElse(() => Config.redacted("OPENCODE_API_KEY")))),
+    typesafe: Config.option(fileApiKey("typesafe").pipe(Config.orElse(() => Config.redacted("TYPESAFE_API_KEY")))),
+    questions: Config.option(Config.schema(ApprovalQuestionsSchema, ["permissions", "questions"])),
+});
+const hasCredentials = (document) => document.providers?.zen !== undefined || document.providers?.typesafe !== undefined;
+const readDocument = Effect.fn("JevvyConfig.readDocument")(function* (path) {
+    const raw = yield* Effect.tryPromise({
+        try: () => readFile(path, "utf8"),
+        catch: (cause) => {
+            if (cause instanceof Error && "code" in cause && cause.code === "ENOENT")
+                return new ConfigMissing();
+            return new ConfigFileError({ reason: "read" });
+        },
+    });
+    const parseErrors = [];
+    const decoded = parse(raw, parseErrors, { allowTrailingComma: true, disallowComments: false });
+    if (parseErrors.length > 0)
+        return yield* new ConfigFileError({ reason: "schema" });
+    const document = yield* Schema.decodeUnknownEffect(JevvyConfigSchema, {
+        onExcessProperty: "error",
+    })(decoded).pipe(Effect.mapError(() => new ConfigFileError({ reason: "schema" })));
+    if (process.platform !== "win32" && hasCredentials(document)) {
+        const info = yield* Effect.tryPromise({
+            try: () => stat(path),
+            catch: () => new ConfigFileError({ reason: "read" }),
+        });
+        if ((info.mode & 0o777) !== 0o600) {
+            yield* Effect.tryPromise({
+                try: () => chmod(path, 0o600),
+                catch: () => new ConfigFileError({ reason: "permissions" }),
+            });
+        }
+    }
+    return document;
+});
+const invalidMessage = (reason) => {
+    if (reason === "permissions")
+        return "credential-bearing jevvy.jsonc could not be secured";
+    if (reason === "read")
+        return "jevvy.jsonc could not be read";
+    return "jevvy.jsonc does not match the configuration schema";
+};
+export const globalJevvyConfigPath = () => {
+    const override = process.env.JEVVY_CONFIG?.trim();
+    if (override !== undefined && override.length > 0)
+        return override;
+    const xdg = process.env.XDG_CONFIG_HOME?.trim();
+    const root = xdg !== undefined && xdg.length > 0 ? xdg : join(homedir(), ".config");
+    return join(root, "jevvy", "jevvy.jsonc");
+};
+const load = Effect.fn("JevvyConfig.load")(function* (path, environment) {
+    const document = yield* readDocument(path).pipe(Effect.catchTag("ConfigMissing", () => Effect.succeed({})));
+    const provider = ConfigProvider.fromUnknown({ provider: "auto", ...document }).pipe(ConfigProvider.orElse(environment));
+    const config = yield* RuntimeConfig.parse(provider).pipe(Effect.mapError(() => new ConfigFileError({ reason: "schema" })));
+    let apiKeys = {};
+    if (Option.isSome(config.zen))
+        apiKeys = { zen: config.zen.value };
+    if (Option.isSome(config.typesafe))
+        apiKeys = { ...apiKeys, typesafe: config.typesafe.value };
+    if (Option.isNone(config.questions))
+        return { kind: "default", provider: config.provider, apiKeys };
+    if (Object.keys(config.questions.value).length === 0) {
+        return { kind: "invalid", message: "permissions.questions must contain at least one question" };
+    }
+    return { kind: "custom", provider: config.provider, apiKeys, questions: config.questions.value };
+}, Effect.catchTag("ConfigFileError", (error) => Effect.succeed({ kind: "invalid", message: invalidMessage(error.reason) })));
+export const loadJevvyConfig = (path = globalJevvyConfigPath(), environment = ConfigProvider.fromEnv()) => load(path, environment);

package/dist/core.d.ts

@@ -0,0 +1,2 @@
+export { createTypeSafeClient, createZenClient, DEFAULT_TYPESAFE_MODEL, DEFAULT_ZEN_MODEL, } from "@jevvy/core";
+export type { Json, JevClient, JevRequest, JevResult, NoulAnswer, NoulQuestion, } from "@jevvy/core";