@jmtrin/opencode-kevin 1.1.0 → 1.3.0

package/dist/migrations/009_v08_team.sql

@@ -1,100 +0,0 @@
--- ============================================================
--- Kevin 0.8.0 - Migration 009: Team (additive)
--- ============================================================
--- Backward-compatible, additive only. All new columns are
--- nullable or carry a NOT NULL DEFAULT so legacy rows keep
--- working without a destructive rebuild.
---
--- Scope note: this migration introduces `repo_id`, a SECOND
--- scoping dimension. `project_id` is retained on every table,
--- unchanged, as local-path provenance (D8-02). Nothing that
--- reads `project_id` today stops working.
--- ============================================================
-
--- 1. shared_entries: the local projection of the committed OKF file.
---    One row per (repo_id, entry_id). Rewritten by SharedLayer.import(),
---    never edited by hand, never the source of truth - the file is.
---    No REFERENCES to memories: an entry may arrive from a teammate
---    before any local memory corresponds to it (D8-12).
-CREATE TABLE IF NOT EXISTS shared_entries (
-  id           TEXT PRIMARY KEY,
-  repo_id      TEXT NOT NULL,
-  entry_id     TEXT NOT NULL,
-  type         TEXT NOT NULL CHECK (type IN ('decision', 'rule', 'pattern', 'solution')),
-  statement    TEXT NOT NULL,
-  scope        TEXT,
-  confidence   REAL NOT NULL DEFAULT 0.0,
-  evidence     INTEGER NOT NULL DEFAULT 0,
-  origin       TEXT NOT NULL DEFAULT 'shared',
-  author_hash  TEXT,
-  op           TEXT NOT NULL CHECK (op IN ('assert', 'tombstone')) DEFAULT 'assert',
-  supersedes   TEXT,
-  created_at   TEXT NOT NULL,
-  imported_at  TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
--- 1b. Identity is (repo_id, entry_id). The UNIQUE index is what makes
---     import() an idempotent upsert instead of an append.
-CREATE UNIQUE INDEX IF NOT EXISTS uq_shared_entries
-  ON shared_entries(repo_id, entry_id);
-CREATE INDEX IF NOT EXISTS idx_shared_entries_op
-  ON shared_entries(op);
-CREATE INDEX IF NOT EXISTS idx_shared_entries_type
-  ON shared_entries(type);
-
--- 2. okf_imports: append-only audit of every read of the shared file,
---    including no-op reads and refusals. `file_hash` drives the skip
---    path in SharedLayer.import() (D8-14).
-CREATE TABLE IF NOT EXISTS okf_imports (
-  id               TEXT PRIMARY KEY,
-  repo_id          TEXT NOT NULL,
-  path             TEXT NOT NULL,
-  file_hash        TEXT,
-  entries_parsed   INTEGER NOT NULL DEFAULT 0,
-  entries_folded   INTEGER NOT NULL DEFAULT 0,
-  entries_rejected INTEGER NOT NULL DEFAULT 0,
-  skipped          INTEGER NOT NULL DEFAULT 0,
-  imported_at      TEXT NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_okf_imports_repo
-  ON okf_imports(repo_id, imported_at);
-
--- 3. memories: the second scoping dimension and the layer marker.
---    repo_id is NULLABLE and back-filled by the post-apply hook, not by
---    a DEFAULT: the value depends on the row's existing project_id and
---    SQLite cannot express that in a column default.
---    layer carries NO CHECK constraint - widening it later would force
---    the migration-004 rebuild path (D8-07). Enforced in TypeScript.
-ALTER TABLE memories ADD COLUMN repo_id TEXT;
-ALTER TABLE memories ADD COLUMN layer TEXT NOT NULL DEFAULT 'local';
-ALTER TABLE memories ADD COLUMN shared_entry_id TEXT;
-
-CREATE INDEX IF NOT EXISTS idx_memories_repo_id
-  ON memories(repo_id, status);
-CREATE INDEX IF NOT EXISTS idx_memories_layer
-  ON memories(layer);
-
--- 4. kevin_metrics: seed the six v0.8 counters (33 -> 39).
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES
-  ('shared_entries_total',    0),
-  ('shared_entries_imported', 0),
-  ('shared_entries_exported', 0),
-  ('okf_merge_folds',         0),
-  ('rekey_events',            0),
-  ('injections_from_shared',  0);
-
--- 5. kevin_settings: seed the five v0.8 flags (18 -> 23).
---    shared_layer_enabled defaults OFF: this release must be opted into,
---    because its first side effect is a new file in the user's repository.
---    shared_confidence_floor (0.7) is deliberately STRICTER than
---    injection_confidence_floor (0.6) - see 5.7.
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES
-  ('shared_layer_enabled',     '0'),
-  ('okf_path',                 '.kevin/knowledge.okf'),
-  ('share_requires_approval',  '1'),
-  ('author_identity_mode',     'hashed'),
-  ('shared_confidence_floor',  '0.7');
-
--- 6. Seed version 009.
-INSERT OR IGNORE INTO schema_version (version) VALUES ('009');

package/dist/migrations/010_v09_native.sql

@@ -1,78 +0,0 @@
--- ============================================================
--- Kevin v0.9.0 "Native" — host surface and hook liveness
--- Migration 010. Additive only. No table rebuild.
--- ============================================================
-
--- 1. Hook liveness. Deliberately NOT project-scoped: a hook is a
---    property of the host binary, not of a checkout. One row per
---    hook name, updated in place. See D9-08.
-CREATE TABLE IF NOT EXISTS hook_liveness (
-	hook            TEXT PRIMARY KEY,
-	experimental    INTEGER NOT NULL DEFAULT 0,
-	fire_count      INTEGER NOT NULL DEFAULT 0,
-	error_count     INTEGER NOT NULL DEFAULT 0,
-	expected_count  INTEGER NOT NULL DEFAULT 0,
-	first_seen_at   TEXT,
-	last_seen_at    TEXT,
-	dead_since      TEXT,
-	plugin_version  TEXT
-);
-
-CREATE INDEX IF NOT EXISTS idx_hook_liveness_dead
-	ON hook_liveness(dead_since);
-
--- 2. Host probe history. Append-only. Off by default; exists so a
---    user chasing an intermittent fault can turn it on and get a
---    timeline instead of a single current value.
-CREATE TABLE IF NOT EXISTS host_probes (
-	id              TEXT PRIMARY KEY,
-	probed_at       TEXT NOT NULL DEFAULT (datetime('now')),
-	plugin_version  TEXT,
-	flavour         TEXT NOT NULL,
-	has_shell       INTEGER NOT NULL DEFAULT 0,
-	v2_skill        INTEGER NOT NULL DEFAULT 0,
-	v2_reference    INTEGER NOT NULL DEFAULT 0,
-	notes           TEXT
-);
-
-CREATE INDEX IF NOT EXISTS idx_host_probes_at
-	ON host_probes(probed_at);
-
--- 3. Native registration outcomes. One row per attach attempt, so
---    "registered but unverified" is a queryable state rather than a
---    log line.
-CREATE TABLE IF NOT EXISTS native_registrations (
-	id              TEXT PRIMARY KEY,
-	attached_at     TEXT NOT NULL DEFAULT (datetime('now')),
-	surface         TEXT NOT NULL CHECK (surface IN ('skill', 'reference')),
-	registered      INTEGER NOT NULL DEFAULT 0,
-	verified        INTEGER NOT NULL DEFAULT 0,
-	note            TEXT
-);
-
-CREATE INDEX IF NOT EXISTS idx_native_registrations_surface
-	ON native_registrations(surface, attached_at);
-
--- 4. Metric seeds (39 -> 45).
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES
-	('hook_fires_total',                0),
-	('hook_errors_total',               0),
-	('hooks_dead_total',                0),
-	('injections_suppressed_dead_hook', 0),
-	('native_registrations_total',      0),
-	('native_registration_failures',    0);
-
--- 5. Setting seeds (23 -> 27).
---    hook_liveness_enabled defaults ON: it is a read-only instrument
---    on the success path, and an instrument nobody switches on is an
---    instrument nobody has.
---    native_registration_enabled defaults OFF: it changes where a
---    curated skill comes from, and that is a change a user opts into.
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES
-	('hook_liveness_enabled',       '1'),
-	('native_registration_enabled', '0'),
-	('host_probe_history_enabled',  '0'),
-	('dead_hook_report_threshold',  '3');
-
--- 6. Version marker.
-INSERT OR IGNORE INTO schema_version (version) VALUES ('010');

package/dist/migrations/011_v10_proven.sql

@@ -1,69 +0,0 @@
--- =============================================================
--- Kevin v1.0.0 "Proven" — migration 011
--- Adds: perf sampling, benchmark results.
--- No ALTER TABLE (second release running); no column is retyped.
--- =============================================================
-
--- 1. Per-scope latency aggregates, flushed at session.idle.
---    Machine-scoped: no project_id, for the same reason hook_liveness
---    has none (v0.9.0 D9-08) — latency is a property of the install.
-CREATE TABLE IF NOT EXISTS perf_samples (
-    id             INTEGER PRIMARY KEY AUTOINCREMENT,
-    scope          TEXT    NOT NULL,
-    sample_count   INTEGER NOT NULL,
-    p50_ms         REAL    NOT NULL,
-    p95_ms         REAL    NOT NULL,
-    max_ms         REAL    NOT NULL,
-    budget_p95_ms  REAL    NOT NULL,
-    within_budget  INTEGER NOT NULL DEFAULT 1,
-    recorded_at    TEXT    NOT NULL DEFAULT (datetime('now'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_perf_samples_scope
-    ON perf_samples(scope, recorded_at DESC);
-CREATE INDEX IF NOT EXISTS idx_perf_samples_breach
-    ON perf_samples(within_budget) WHERE within_budget = 0;
-
--- 2. Benchmark results. Append-only. One row per arm per run.
---    arm CHECK is closed by the plan; widening requires a table rebuild (intentional friction).
---    scope CHECK is intentionally absent: the scope union may gain members in a 1.x minor.
-CREATE TABLE IF NOT EXISTS bench_runs (
-    id               INTEGER PRIMARY KEY AUTOINCREMENT,
-    corpus_digest    TEXT    NOT NULL,
-    contract_digest  TEXT    NOT NULL,
-    package_version  TEXT    NOT NULL,
-    runtime          TEXT    NOT NULL,
-    arm              TEXT    NOT NULL,
-    k                INTEGER NOT NULL,
-    precision_at_k   REAL    NOT NULL,
-    recall_at_k      REAL    NOT NULL,
-    mrr              REAL    NOT NULL,
-    ran_at           TEXT    NOT NULL DEFAULT (datetime('now')),
-    CHECK (arm IN ('none', 'recent-k', 'random-k', 'kevin'))
-);
-
-CREATE INDEX IF NOT EXISTS idx_bench_runs_corpus
-    ON bench_runs(corpus_digest, ran_at DESC);
-CREATE INDEX IF NOT EXISTS idx_bench_runs_arm
-    ON bench_runs(arm, ran_at DESC);
-
--- 3. Metric seeds (45 -> 51).
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('perf_samples_recorded', 0);
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('perf_budget_breaches', 0);
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('dispose_fires_total', 0);
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('dispose_misses_total', 0);
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('contract_digest_changes', 0);
-INSERT OR IGNORE INTO kevin_metrics (key, value) VALUES ('bench_runs_total', 0);
-
--- 4. Setting seeds (27 -> 31). All TEXT; '0'/'1' are strings.
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_enabled', '1');
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_ring_capacity', '512');
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('perf_flush_on_idle', '1');
-INSERT OR IGNORE INTO kevin_settings (key, value) VALUES ('contract_report_enabled', '1');
-
--- 5. `dispose` becomes the seventh instrumented hook (v0.9.0 migration 010
---    seeded six rows; this is a data seed, not a schema change).
-INSERT OR IGNORE INTO hook_liveness (hook) VALUES ('dispose');
-
--- 6. Schema version.
-INSERT OR IGNORE INTO schema_version (version) VALUES ('011');

package/dist/migrations/012_v11_drift.sql

@@ -1,24 +0,0 @@
--- millisecond companions for the two tables whose ORDERING decides outcomes.
-ALTER TABLE tool_calls       ADD COLUMN ts_ms           INTEGER;
-ALTER TABLE kevin_injections ADD COLUMN injected_at_ms  INTEGER;
-
--- conservative backfill: seconds -> ms (x1000). Rows keep their original
--- second-granularity value in the old column; nothing is rewritten there.
-UPDATE tool_calls SET ts_ms =
-  CAST(strftime('%s', ts) AS INTEGER) * 1000
-WHERE ts_ms IS NULL AND ts IS NOT NULL;
-
-UPDATE kevin_injections SET injected_at_ms =
-  CAST(strftime('%s', injected_at) AS INTEGER) * 1000
-WHERE injected_at_ms IS NULL AND injected_at IS NOT NULL;
-
-CREATE INDEX idx_tool_calls_ts_ms        ON tool_calls(ts_ms);
-CREATE INDEX idx_injections_injected_ms  ON kevin_injections(injected_at_ms);
-
--- metric seeds (C-05 additions carry since=1.1.0 in contract)
-INSERT INTO kevin_metrics (key, value, updated_at) VALUES
-  ('bench_regression_failures',    0, datetime('now')),
-  ('forget_requests_total',        0, datetime('now')),
-  ('forget_tombstones_published',  0, datetime('now'));
-
-INSERT INTO schema_version (version) VALUES ('012');

package/dist/plugin/Archiver.d.ts

@@ -1,42 +0,0 @@
-import type { MemoryService } from "./MemoryService.js";
-import type { Store } from "./Store.js";
-import type { Metrics } from "./metrics.js";
-/**
- * v0.5.0 Archiver (K5-012 / plan §5.4, D5-05).
- *
- * Lifecycle tail of the memory loop: reflectors mark a lesson `stale` when
- * its fingerprint recurred enough times (penalizeRecurringReflectors,
- * migration 003), but nothing ever retires those rows — they keep
- * circulating through status filters and inflating counts. The Archiver
- * runs on `session.idle` and retires stale memories whose last activity
- * (`updated_at`, falling back to `last_verified_at`) is older than
- * `archive_after_days` (kevin_settings, seeded '30' in migration 006).
- *
- * Rules:
- *  - Only `status = 'stale'` rows with `archived_at IS NULL`.
- *  - `type != 'pattern'`: a pattern is the FIXED form of a fingerprint
- *    (K4-025); archiving it would break kevin_why and the recurrence
- *    re-admission path (QualityGate rule 4).
- *  - Clock: the injection clock (K5-008) — tests freeze it; production
- *    defaults to `new Date()`. Never `Date.now()` inside.
- *  - `memories_archived` is bumped by the batch size, once per run.
- *  - Pre-006 DBs (no `archived_at`) degrade to a no-op.
- *
- * Archived rows remain queryable with `includeSuperseded: true`-style
- * reads (status filter is exclusive, not destructive).
- */
-export declare class Archiver {
-    private readonly store;
-    private readonly memoryService;
-    private readonly metrics;
-    private readonly now;
-    constructor(store: Store, memoryService: MemoryService, metrics?: Metrics | null, now?: () => Date);
-    /**
-     * Archives every eligible stale memory. Returns the number of rows
-     * retired. Idempotent: archived rows are excluded by `archived_at IS
-     * NULL`, so a second run archives nothing.
-     */
-    run(): number;
-    private archiveAfterDays;
-    private hasArchivedColumn;
-}

package/dist/plugin/Archiver.js

@@ -1,83 +0,0 @@
-import { hasArchivedColumn } from "./columns.js";
-/**
- * v0.5.0 Archiver (K5-012 / plan §5.4, D5-05).
- *
- * Lifecycle tail of the memory loop: reflectors mark a lesson `stale` when
- * its fingerprint recurred enough times (penalizeRecurringReflectors,
- * migration 003), but nothing ever retires those rows — they keep
- * circulating through status filters and inflating counts. The Archiver
- * runs on `session.idle` and retires stale memories whose last activity
- * (`updated_at`, falling back to `last_verified_at`) is older than
- * `archive_after_days` (kevin_settings, seeded '30' in migration 006).
- *
- * Rules:
- *  - Only `status = 'stale'` rows with `archived_at IS NULL`.
- *  - `type != 'pattern'`: a pattern is the FIXED form of a fingerprint
- *    (K4-025); archiving it would break kevin_why and the recurrence
- *    re-admission path (QualityGate rule 4).
- *  - Clock: the injection clock (K5-008) — tests freeze it; production
- *    defaults to `new Date()`. Never `Date.now()` inside.
- *  - `memories_archived` is bumped by the batch size, once per run.
- *  - Pre-006 DBs (no `archived_at`) degrade to a no-op.
- *
- * Archived rows remain queryable with `includeSuperseded: true`-style
- * reads (status filter is exclusive, not destructive).
- */
-export class Archiver {
-    store;
-    memoryService;
-    metrics;
-    now;
-    constructor(store, memoryService, metrics, now = () => new Date()) {
-        this.store = store;
-        this.memoryService = memoryService;
-        this.metrics = metrics ?? null;
-        this.now = now;
-    }
-    /**
-     * Archives every eligible stale memory. Returns the number of rows
-     * retired. Idempotent: archived rows are excluded by `archived_at IS
-     * NULL`, so a second run archives nothing.
-     */
-    run() {
-        if (!this.hasArchivedColumn())
-            return 0;
-        const days = this.archiveAfterDays();
-        if (days <= 0)
-            return 0;
-        const now = this.now();
-        const cutoff = formatSqliteUtc(new Date(now.getTime() - days * 86_400_000));
-        this.store
-            .prepare(`UPDATE memories
-				    SET status = 'archived', archived_at = ?, updated_at = ?
-				  WHERE status = 'stale'
-				    AND type != 'pattern'
-				    AND archived_at IS NULL
-				    AND updated_at < ?`)
-            .run(formatSqliteUtc(now), formatSqliteUtc(now), cutoff);
-        const changed = this.store.prepare("SELECT changes() AS n").get();
-        const n = changed.n;
-        if (n > 0)
-            this.metrics?.incr("memories_archived", n);
-        return n;
-    }
-    archiveAfterDays() {
-        try {
-            const raw = this.memoryService.getSetting("archive_after_days", "30");
-            const n = Number(raw);
-            return Number.isFinite(n) ? n : 30;
-        }
-        catch {
-            return 30;
-        }
-    }
-    hasArchivedColumn() {
-        return hasArchivedColumn(this.store);
-    }
-}
-/** 'YYYY-MM-DD HH:MM:SS' UTC — the format SQLite `datetime('now')` uses,
- * so lexicographic comparisons against `updated_at` are valid. */
-function formatSqliteUtc(d) {
-    const pad = (n) => String(n).padStart(2, "0");
-    return `${d.getUTCFullYear()}-${pad(d.getUTCMonth() + 1)}-${pad(d.getUTCDate())} ${pad(d.getUTCHours())}:${pad(d.getUTCMinutes())}:${pad(d.getUTCSeconds())}`;
-}

package/dist/plugin/ArtifactWriter.d.ts

@@ -1,93 +0,0 @@
-import type { Store } from "./Store.js";
-import type { Metrics } from "./metrics.js";
-export declare const MARKER_BEGIN = "<!-- kevin:begin \u2014 curated by opencode-kevin, safe to edit -->";
-export declare const MARKER_END = "<!-- kevin:end -->";
-export type WriteOutcome = "written" | "noop" | "refused";
-/**
- * v0.8.0 (K8-019 / D8-08) — the two write modes. `markers` is the
- * v0.6.0 behaviour, byte for byte: a splice between the two marker
- * comments, used for `AGENTS.md`, a file humans edit. `whole` replaces
- * the entire file and is used only for Kevin-owned paths such as
- * `.kevin/knowledge.okf` — a file humans do not hand-edit.
- */
-export type WriteMode = "markers" | "whole";
-export interface WriteRequest {
-    readonly path: string;
-    readonly mode: WriteMode;
-    /** marker block body ("markers"), or whole-file content ("whole"). */
-    readonly content: string;
-    /**
-     * Caller-side refusal reason (K8-020 / D6-03): when present, the plan
-     * is refused — nothing is written, and the refusal is audited with
-     * both hashes. The refusal conditions belong to the caller; the
-     * writer only records them.
-     */
-    readonly refusal?: string;
-}
-export interface WritePlan {
-    readonly path: string;
-    readonly before: string;
-    readonly after: string;
-    readonly diff: string;
-    readonly outcome: WriteOutcome;
-    readonly reason?: string;
-    readonly hashBefore: string;
-    readonly hashAfter: string;
-}
-/**
- * Rule 9, layer (a) — superseded in v1.0.0 by `escapeForMarkerBlock`
- * in `plugin/escape.ts` (K10-027), which carries the same idempotent
- * entity discipline.
- */
-/**
- * v1.0.0 (K10-027 / plan §5.7) — the boundary functions now live in
- * `plugin/escape.ts`; this composer applies them in fence-then-marker
- * order. Layer (b) — strip any line containing `kevin:begin` or
- * `kevin:end`, in any casing — is a filter rather than an escape and
- * stays here. Without layer (b), a memory containing a literal
- * `<!-- kevin:end -->` line would close the marker comment early and
- * let subsequent content escape the curated region on the next
- * regeneration — a marker-injection variant of the v0.1.5
- * prompt-injection defect (plan §3.5). The trailing `-->` strip is kept
- * as defence in depth although `escapeForMarkerBlock` already escapes
- * every `>` that could form one.
- */
-export declare function sanitizeArtifactBody(body: string): string;
-/**
- * v1.0.0 (K10-027 / plan §5.7, rule 2) — whole-file writes escape by
- * container. Only `.okf` files are line-oriented JSON: each line gets
- * `escapeForOkfLine`, which is the identity on a well-formed OKF line
- * (canonical JSON never contains raw control characters) and therefore
- * preserves the re-render `noop`. Kevin-owned markdown paths keep their
- * bytes — fences there are legitimate content.
- */
-export declare function escapeForContainer(path: string, content: string): string;
-/**
- * v0.6.0 (K6-005 / plan §5.1) — the single write path to disk (D6-01).
- *
- * `plan()` is pure: it reads the target file, locates the marker pair, splices
- * the body between the markers and returns a {@link WritePlan}. It performs no
- * writes — rule 1. `apply()` is implemented by K6-007; until then it is a stub
- * that throws, so no caller can accidentally write before the audit trail
- * exists.
- *
- * `projectId` is a constructor argument rather than a per-call argument so that
- * every audit row is attributed without the call site having to remember.
- */
-export declare class ArtifactWriter {
-    private readonly store;
-    private readonly projectId;
-    private readonly metrics;
-    constructor(store: Store, projectId: string, metrics?: Metrics | null);
-    plan(path: string, body: string): WritePlan;
-    plan(request: WriteRequest): WritePlan;
-    /**
-     * K8-019 (D8-08) — the single write funnel: every file Kevin writes
-     * goes through this method, which is the ONLY call site of `apply()`
-     * in the plugin (asserted by tests/unit/single_write_path.test.ts).
-     */
-    write(request: WriteRequest, proposalId?: string): WriteOutcome;
-    apply(plan: WritePlan, proposalId?: string): WriteOutcome;
-    private renameTemp;
-    private audit;
-}