@kibitzsh/kibitz 0.0.3

package/dist/core/commentary.js

@@ -0,0 +1,1041 @@
+"use strict";
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+
+// src/core/commentary.ts
+var commentary_exports = {};
+__export(commentary_exports, {
+  CommentaryEngine: () => CommentaryEngine,
+  applyAssessmentSignals: () => applyAssessmentSignals,
+  buildCommentaryAssessment: () => buildCommentaryAssessment,
+  sanitizeGeneratedCommentary: () => sanitizeGeneratedCommentary
+});
+module.exports = __toCommonJS(commentary_exports);
+var import_events = require("events");
+
+// src/core/types.ts
+var COMMENTARY_STYLE_OPTIONS = [
+  { id: "bullets", label: "Bullet list" },
+  { id: "one-liner", label: "One-liner" },
+  { id: "headline-context", label: "Headline + context" },
+  { id: "numbered-progress", label: "Numbered progress" },
+  { id: "short-question", label: "Short + question" },
+  { id: "table", label: "Table" },
+  { id: "emoji-bullets", label: "Emoji bullets" },
+  { id: "scoreboard", label: "Scoreboard" }
+];
+var MODELS = [
+  { id: "claude-opus-4-6", label: "Claude Opus", provider: "anthropic" },
+  { id: "claude-sonnet-4-6", label: "Claude Sonnet", provider: "anthropic" },
+  { id: "claude-haiku-4-5-20251001", label: "Claude Haiku", provider: "anthropic" },
+  { id: "gpt-4o", label: "GPT-4o", provider: "openai" },
+  { id: "gpt-4o-mini", label: "GPT-4o mini", provider: "openai" }
+];
+var DEFAULT_MODEL = "claude-opus-4-6";
+
+// src/core/providers/anthropic.ts
+var import_child_process = require("child_process");
+var import_fs = require("fs");
+var import_path = require("path");
+var import_os = require("os");
+var cachedClaudePath = null;
+var PROVIDER_TIMEOUT_MS = 9e4;
+function resolveNodeScript(cmdPath) {
+  if (process.platform !== "win32" || !cmdPath.endsWith(".cmd")) return null;
+  try {
+    const content = (0, import_fs.readFileSync)(cmdPath, "utf-8");
+    const match = content.match(/%dp0%\\(.+?\.js)/);
+    if (match) {
+      const script = (0, import_path.join)((0, import_path.dirname)(cmdPath), match[1]);
+      if ((0, import_fs.existsSync)(script)) return script;
+    }
+  } catch {
+  }
+  return null;
+}
+function resolveClaudePath() {
+  if (cachedClaudePath) return cachedClaudePath;
+  const home = (0, import_os.homedir)();
+  const isWindows = process.platform === "win32";
+  const candidates = isWindows ? [
+    (0, import_path.join)(home, ".claude", "bin", "claude.exe"),
+    (0, import_path.join)(home, "AppData", "Local", "Programs", "claude-code", "claude.exe"),
+    (0, import_path.join)(home, "AppData", "Local", "Claude", "claude.exe"),
+    (0, import_path.join)(home, "AppData", "Local", "Microsoft", "WinGet", "Links", "claude.exe"),
+    "C:\\Program Files\\Claude\\claude.exe",
+    (0, import_path.join)(home, "AppData", "Roaming", "npm", "claude.cmd")
+  ] : [
+    (0, import_path.join)(home, ".local", "bin", "claude"),
+    (0, import_path.join)(home, ".claude", "bin", "claude"),
+    "/usr/local/bin/claude",
+    "/usr/bin/claude",
+    "/snap/bin/claude",
+    "/opt/homebrew/bin/claude"
+  ];
+  for (const p of candidates) {
+    if ((0, import_fs.existsSync)(p)) {
+      cachedClaudePath = p;
+      return p;
+    }
+  }
+  const env = { ...process.env };
+  delete env.ELECTRON_RUN_AS_NODE;
+  delete env.CLAUDECODE;
+  if (isWindows) {
+    try {
+      const resolved = (0, import_child_process.execSync)("where claude", {
+        encoding: "utf-8",
+        env,
+        timeout: 5e3
+      }).trim().split("\n")[0].trim();
+      if (resolved && (0, import_fs.existsSync)(resolved)) {
+        cachedClaudePath = resolved;
+        return resolved;
+      }
+    } catch {
+    }
+  } else {
+    const shells = ["/bin/zsh", "/bin/bash"];
+    for (const sh of shells) {
+      if (!(0, import_fs.existsSync)(sh)) continue;
+      try {
+        const resolved = (0, import_child_process.execSync)(`${sh} -lic 'which claude'`, {
+          encoding: "utf-8",
+          env,
+          timeout: 5e3
+        }).trim();
+        if (resolved && (0, import_fs.existsSync)(resolved)) {
+          cachedClaudePath = resolved;
+          return resolved;
+        }
+      } catch {
+      }
+    }
+  }
+  return null;
+}
+var AnthropicProvider = class {
+  async generate(systemPrompt, userPrompt, _apiKey, model, onChunk) {
+    return new Promise((resolve, reject) => {
+      const claudePath = resolveClaudePath();
+      if (!claudePath) {
+        reject(new Error("Claude CLI not found. Install from https://docs.anthropic.com/en/docs/claude-code"));
+        return;
+      }
+      const fullPrompt = `${systemPrompt}
+
+${userPrompt}`;
+      const args = [
+        "-p",
+        fullPrompt,
+        "--output-format",
+        "stream-json",
+        "--verbose",
+        "--max-turns",
+        "1",
+        "--model",
+        model
+      ];
+      const env = { ...process.env };
+      delete env.ELECTRON_RUN_AS_NODE;
+      delete env.CLAUDECODE;
+      let proc;
+      try {
+        const nodeScript = resolveNodeScript(claudePath);
+        if (nodeScript) {
+          proc = (0, import_child_process.spawn)(process.execPath, [nodeScript, ...args], {
+            cwd: (0, import_os.homedir)(),
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true
+          });
+        } else {
+          proc = (0, import_child_process.spawn)(claudePath, args, {
+            cwd: (0, import_os.homedir)(),
+            env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            shell: process.platform === "win32"
+          });
+        }
+      } catch (err) {
+        reject(new Error(`Failed to spawn claude CLI: ${err instanceof Error ? err.message : String(err)}`));
+        return;
+      }
+      if (!proc.stdout || !proc.stderr) {
+        reject(new Error("Failed to create stdio pipes for Claude CLI"));
+        try {
+          proc.kill();
+        } catch {
+        }
+        return;
+      }
+      let full = "";
+      let buffer = "";
+      let stderr = "";
+      let timedOut = false;
+      proc.stdout.on("data", (data) => {
+        buffer += data.toString();
+        const lines = buffer.split("\n");
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          if (!line.trim()) continue;
+          try {
+            const event = JSON.parse(line);
+            if (event.type === "assistant") {
+              const content = event.message?.content;
+              if (Array.isArray(content)) {
+                for (const block of content) {
+                  if (block.type === "text" && typeof block.text === "string") {
+                    full += block.text;
+                    onChunk(block.text);
+                  }
+                }
+              }
+            }
+            if (event.type === "result" && event.result) {
+              if (!full) {
+                full = String(event.result);
+                onChunk(full);
+              }
+            }
+          } catch {
+          }
+        }
+      });
+      proc.stderr.on("data", (data) => {
+        stderr += data.toString();
+      });
+      const timeout = setTimeout(() => {
+        timedOut = true;
+        try {
+          proc.kill();
+        } catch {
+        }
+      }, PROVIDER_TIMEOUT_MS);
+      proc.on("close", (code) => {
+        clearTimeout(timeout);
+        if (timedOut && !full) {
+          reject(new Error(`Claude CLI timed out after ${PROVIDER_TIMEOUT_MS}ms`));
+          return;
+        }
+        if (code !== 0 && !full) {
+          reject(new Error(`Claude CLI exited with code ${code}: ${stderr.slice(0, 500)}`));
+        } else {
+          resolve(full);
+        }
+      });
+      proc.on("error", (err) => {
+        clearTimeout(timeout);
+        reject(new Error(`Claude CLI error: ${err.message}`));
+      });
+    });
+  }
+};
+
+// src/core/providers/openai.ts
+var import_child_process2 = require("child_process");
+var import_fs2 = require("fs");
+var import_path2 = require("path");
+var import_os2 = require("os");
+var cachedCodexScript = null;
+var codexScriptResolved = false;
+var PROVIDER_TIMEOUT_MS2 = 9e4;
+function resolveCodexNodeScript() {
+  if (codexScriptResolved) return cachedCodexScript;
+  codexScriptResolved = true;
+  if (process.platform !== "win32") return null;
+  try {
+    const cmdPath = (0, import_child_process2.execSync)("where codex.cmd", {
+      encoding: "utf-8",
+      timeout: 5e3,
+      stdio: ["ignore", "pipe", "ignore"]
+    }).trim().split("\n")[0].trim();
+    const content = (0, import_fs2.readFileSync)(cmdPath, "utf-8");
+    const match = content.match(/%dp0%\\(.+?\.js)/);
+    if (!match) return null;
+    const script = (0, import_path2.join)((0, import_path2.dirname)(cmdPath), match[1]);
+    if ((0, import_fs2.existsSync)(script)) {
+      cachedCodexScript = script;
+      return script;
+    }
+  } catch {
+  }
+  return null;
+}
+var OpenAIProvider = class {
+  async generate(systemPrompt, userPrompt, _apiKey, _model, onChunk) {
+    return new Promise((resolve, reject) => {
+      const fullPrompt = `${systemPrompt}
+
+${userPrompt}`;
+      const args = ["exec", "--json", "--skip-git-repo-check", fullPrompt];
+      let proc;
+      try {
+        const nodeScript = resolveCodexNodeScript();
+        if (nodeScript) {
+          proc = (0, import_child_process2.spawn)(process.execPath, [nodeScript, ...args], {
+            cwd: (0, import_os2.homedir)(),
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true
+          });
+        } else {
+          const codexCmd = process.platform === "win32" ? "codex.cmd" : "codex";
+          proc = (0, import_child_process2.spawn)(codexCmd, args, {
+            cwd: (0, import_os2.homedir)(),
+            env: process.env,
+            stdio: ["ignore", "pipe", "pipe"],
+            windowsHide: true,
+            shell: process.platform === "win32"
+          });
+        }
+      } catch (err) {
+        reject(new Error(`Failed to spawn codex CLI: ${err instanceof Error ? err.message : String(err)}`));
+        return;
+      }
+      if (!proc.stdout || !proc.stderr) {
+        reject(new Error("Failed to create stdio pipes for codex CLI"));
+        try {
+          proc.kill();
+        } catch {
+        }
+        return;
+      }
+      let full = "";
+      let buffer = "";
+      let stderr = "";
+      let timedOut = false;
+      proc.stdout.on("data", (data) => {
+        buffer += data.toString();
+        const lines = buffer.split("\n");
+        buffer = lines.pop() ?? "";
+        for (const line of lines) {
+          if (!line.trim()) continue;
+          try {
+            const event = JSON.parse(line);
+            if (event.type === "item.completed" && event.item) {
+              if (event.item.type === "agent_message" && typeof event.item.text === "string") {
+                full += event.item.text;
+                onChunk(event.item.text);
+              }
+            }
+          } catch {
+          }
+        }
+      });
+      proc.stderr.on("data", (data) => {
+        stderr += data.toString();
+      });
+      const timeout = setTimeout(() => {
+        timedOut = true;
+        try {
+          proc.kill();
+        } catch {
+        }
+      }, PROVIDER_TIMEOUT_MS2);
+      proc.on("close", (code) => {
+        clearTimeout(timeout);
+        if (timedOut && !full) {
+          reject(new Error(`Codex CLI timed out after ${PROVIDER_TIMEOUT_MS2}ms`));
+          return;
+        }
+        if (code !== 0 && !full) {
+          reject(new Error(`Codex CLI exited with code ${code}: ${stderr.slice(0, 500)}`));
+        } else {
+          resolve(full);
+        }
+      });
+      proc.on("error", (err) => {
+        clearTimeout(timeout);
+        reject(new Error(`Codex CLI error: ${err.message}`));
+      });
+    });
+  }
+};
+
+// src/core/commentary.ts
+var SYSTEM_PROMPT = `You oversee AI coding agents. Summarize what they did in plain language anyone can understand.
+
+Rules:
+- Plain language. "Fixed the login page" not "Edited auth middleware".
+- **Bold** only key nouns, 1-2 words: **tests**, **deploy**, **production**. NEVER bold sentences.
+- UPPER CASE short reactions when it helps: GREAT FIND, NICE MOVE, RISK ALERT, SOLID CHECK, WATCH OUT.
+- Vary judgment wording across messages; avoid repeating one catchphrase.
+- Always judge execution direction using the session goal + concrete actions in this batch.
+- Close with a sentence that captures the current direction and momentum of the work.
+- Emoji are allowed when they add meaning (max 2 per commentary).
+- No filler. No "methodical", "surgical", "disciplined", "clean work". Facts and reactions only.
+- Don't repeat what previous commentary already said.
+- Never mention session IDs, logs, traces, prompts, JSONL files, or internal tooling.
+- Never write in first person ("I", "I'll", "we") or future tense plans.
+- Never use the word "verdict". Write narrative, not a ruling.`;
+var FORMAT_TEMPLATES = {
+  bullets: `Use bullet points. Each bullet = one thing done or one observation.
+Close with a sentence on direction and momentum.
+Example:
+- Researched how the feature works
+- Rewrote the page with new layout
+- Shipped without **tests** \u2014 RISKY
+- Checked for errors before pushing`,
+  "one-liner": `Write a single sentence. Punchy, complete, under 20 words.
+One closing sentence on where this is headed.
+Example: Agent investigated the bug, found the root cause, and fixed it \u2014 NICE WORK.
+Example: Still reading code after 30 actions \u2014 hasn't changed anything yet.`,
+  "headline-context": `Start with a short UPPER CASE reaction (2-4 words), then one sentence of context.
+Close with a read on momentum.
+Example:
+SOLID APPROACH. Agent read the dependencies first, then made targeted changes across three files.
+Example:
+NOT GREAT. Pushed to **production** without running any tests \u2014 hope nothing breaks.`,
+  "numbered-progress": `Use numbered steps showing what the agent did in order. Finish with a momentum line.
+Example:
+1. Read the existing code
+2. Made changes to the login flow
+3. Tested locally
+4. Pushed to **production**
+Proper process, nothing to flag.`,
+  "short-question": `Summarize in one sentence, then ask a pointed rhetorical question.
+End with a one-sentence read on direction.
+Example:
+Agent rewrote the entire settings page and shipped it immediately. Did they test this at all?
+Example:
+Third time reading the same code. Lost, or just being thorough?`,
+  table: `Use a compact markdown table with columns: Action | Why it mattered.
+Include 3-5 rows max, then one sentence on momentum.
+Example:
+| Action | Why it mattered |
+| --- | --- |
+| Ran tests | Verified changes before shipping |
+| Skipped lint | Could hide style regressions |
+Mostly careful, one loose end.`,
+  "emoji-bullets": `Use bullet points with emoji tags to signal risk/quality.
+Use only these tags: \u2705, \u26A0\uFE0F, \u{1F525}, \u2744\uFE0F.
+Close with a direction sentence.
+Example:
+- \u2705 Fixed the failing migration script
+- \u26A0\uFE0F Pushed without rerunning integration tests
+- \u{1F525} Found the root cause in auth token parsing`,
+  scoreboard: `Use a scoreboard format with these labels:
+Wins:
+Risks:
+Next:
+Each label should have 1-3 short bullets, then one line on where things stand.`
+};
+var DEFAULT_FORMAT_STYLE_IDS = COMMENTARY_STYLE_OPTIONS.map((option) => option.id);
+var PRESET_INSTRUCTIONS = {
+  auto: "",
+  "critical-coder": "Be a VERY CRITICAL coder using code terminology. Call out architectural or process flaws directly and sharply.",
+  "precise-short": "Be precise and short. Keep the output compact and information-dense with minimal words.",
+  emotional: "Be emotional and expressive. React strongly to good or risky behavior while staying factual.",
+  newbie: "Explain for non-developers. Avoid jargon or explain it in plain words with simple cause/effect."
+};
+function normalizeFormatStyles(styleIds) {
+  const requested = new Set(styleIds.map((styleId) => String(styleId || "").trim()));
+  const normalized = COMMENTARY_STYLE_OPTIONS.map((option) => option.id).filter((styleId) => requested.has(styleId));
+  return normalized.length > 0 ? normalized : DEFAULT_FORMAT_STYLE_IDS.slice();
+}
+function sameFormatStyles(a, b) {
+  if (a.length !== b.length) return false;
+  for (let i = 0; i < a.length; i += 1) {
+    if (a[i] !== b[i]) return false;
+  }
+  return true;
+}
+var SESSION_ID_PATTERNS = [
+  /\b[0-9a-f]{8}(?:-[0-9a-f]{4}){3}-[0-9a-f]{12}\b/gi,
+  /\brollout-\d{4}-\d{2}-\d{2}t\d{2}[-:]\d{2}[-:]\d{2}[-a-z0-9]+(?:\.jsonl)?\b/gi,
+  /\bsession[\s:_-]*[0-9a-f]{8,}\b/gi,
+  /\bturn[\s:_-]*[0-9a-f]{8,}\b/gi
+];
+var MIN_BATCH_SIZE = 1;
+var MAX_BATCH_SIZE = 40;
+var IDLE_TIMEOUT_MS = 5e3;
+var MAX_WAIT_MS = 15e3;
+var TEST_COMMAND_PATTERNS = [
+  /\b(?:npm|pnpm|yarn|bun)\s+(?:run\s+)?(?:test|test:[\w:-]+)\b/i,
+  /\b(?:jest|vitest|mocha|ava|pytest|go\s+test|cargo\s+test|dotnet\s+test|mvn\s+test|gradle(?:w)?\s+test|rspec|phpunit)\b/i
+];
+var DEPLOY_COMMAND_PATTERNS = [
+  /\b(?:deploy|release|publish)\b/i,
+  /\b(?:kubectl\s+apply|helm\s+upgrade|terraform\s+apply|serverless\s+deploy|vercel\s+--prod|netlify\s+deploy|fly\s+deploy)\b/i
+];
+var ERROR_SIGNAL_PATTERN = /\b(?:error|failed|failure|exception|traceback|panic|denied|timeout|cannot|can't|unable)\b/i;
+var SECURITY_COMMAND_RULES = [
+  {
+    severity: "high",
+    signal: "Remote script piped directly into a shell",
+    pattern: /\b(?:curl|wget)\b[^\n|]{0,300}\|\s*(?:bash|sh|zsh|pwsh|powershell)\b/i
+  },
+  {
+    severity: "high",
+    signal: "TLS verification explicitly disabled",
+    pattern: /\bNODE_TLS_REJECT_UNAUTHORIZED\s*=\s*0\b/i
+  },
+  {
+    severity: "high",
+    signal: "Destructive root-level delete command",
+    pattern: /\brm\s+-rf\s+\/(?:\s|$)/i
+  },
+  {
+    severity: "medium",
+    signal: "Insecure transport flag used in command",
+    pattern: /\bcurl\b[^\n]*\s(?:--insecure|-k)\b/i
+  },
+  {
+    severity: "medium",
+    signal: "Git hooks bypassed with --no-verify",
+    pattern: /\bgit\b[^\n]*\s--no-verify\b/i
+  },
+  {
+    severity: "medium",
+    signal: "SSH host key verification disabled",
+    pattern: /\bStrictHostKeyChecking\s*=\s*no\b/i
+  },
+  {
+    severity: "medium",
+    signal: "Overly broad file permissions (chmod 777)",
+    pattern: /\bchmod\s+777\b/i
+  },
+  {
+    severity: "medium",
+    signal: "Potential secret exposed in command arguments",
+    pattern: /\b(?:api[_-]?key|token|password)\s*=\s*\S+/i
+  }
+];
+var SECURITY_PATH_RULES = [
+  {
+    severity: "medium",
+    signal: "Secret-related file touched",
+    pattern: /(?:^|[\\/])(?:\.env(?:\.[^\\/]+)?|id_rsa|id_dsa|authorized_keys|known_hosts|credentials?|secrets?)(?:$|[\\/])/i
+  },
+  {
+    severity: "medium",
+    signal: "Sensitive key/cert file touched",
+    pattern: /\.(?:pem|key|p12|pfx)$/i
+  }
+];
+var JUDGMENT_PHRASES = [
+  "NOT IDEAL",
+  "NOT GREAT",
+  "WATCH OUT",
+  "RISK ALERT",
+  "GREAT FIND",
+  "NICE MOVE",
+  "SOLID CHECK"
+];
+function getDetailValue(details, ...keys) {
+  for (const key of keys) {
+    const value = details[key];
+    if (typeof value === "string" && value.trim()) return value.trim();
+  }
+  return "";
+}
+function extractCommand(event) {
+  if (event.type !== "tool_call") return "";
+  const details = event.details || {};
+  const input = typeof details.input === "object" && details.input ? details.input : {};
+  const direct = getDetailValue(details, "command", "cmd");
+  if (direct) return direct;
+  return getDetailValue(input, "command", "cmd");
+}
+function extractTouchedPath(event) {
+  if (event.type !== "tool_call") return "";
+  const details = event.details || {};
+  const input = typeof details.input === "object" && details.input ? details.input : {};
+  const direct = getDetailValue(details, "path", "file_path");
+  if (direct) return direct;
+  return getDetailValue(input, "path", "file_path");
+}
+function extractToolName(event) {
+  const details = event.details || {};
+  const value = details.tool;
+  return typeof value === "string" ? value.toLowerCase() : "";
+}
+function pushUnique(list, value, maxItems = 4) {
+  const normalized = sanitizePromptText(value);
+  if (!normalized) return;
+  if (list.includes(normalized)) return;
+  if (list.length < maxItems) list.push(normalized);
+}
+function pushSecurityFinding(findings, finding) {
+  const key = `${finding.severity}:${finding.signal}:${finding.evidence}`;
+  const exists = findings.some((item) => `${item.severity}:${item.signal}:${item.evidence}` === key);
+  if (!exists) findings.push(finding);
+}
+function detectSecurityFindings(findings, sourceText, rules) {
+  const evidence = sanitizePromptText(sourceText).slice(0, 140);
+  if (!evidence) return;
+  for (const rule of rules) {
+    if (!rule.pattern.test(sourceText)) continue;
+    pushSecurityFinding(findings, {
+      severity: rule.severity,
+      signal: rule.signal,
+      evidence
+    });
+  }
+}
+function hasPattern(text, patterns) {
+  return patterns.some((pattern) => pattern.test(text));
+}
+function summarizeActivity(reads, writes, searches, commands, tests, errors) {
+  return `reads=${reads}, writes=${writes}, searches=${searches}, commands=${commands}, tests=${tests}, errors=${errors}`;
+}
+function summarizeClosingEvidence(assessment) {
+  if (assessment.progressSignals.length > 0) return assessment.progressSignals[0];
+  if (assessment.driftSignals.length > 0) return assessment.driftSignals[0];
+  return assessment.activitySummary;
+}
+function createClosingLine(assessment) {
+  const evidence = summarizeClosingEvidence(assessment);
+  const dir = assessment.direction === "on-track" ? "on track" : assessment.direction;
+  const sec = assessment.security !== "clean" ? ` Security is ${assessment.security}.` : "";
+  return `${evidence} \u2014 looks ${dir} with ${assessment.confidence} confidence.${sec}`;
+}
+function extractRecentlyUsedJudgments(recentCommentary) {
+  const found = /* @__PURE__ */ new Set();
+  for (const text of recentCommentary.slice(-5)) {
+    const upper = String(text || "").toUpperCase();
+    for (const phrase of JUDGMENT_PHRASES) {
+      if (upper.includes(phrase)) found.add(phrase);
+    }
+  }
+  return Array.from(found).slice(0, 4);
+}
+function buildCommentaryAssessment(events, sessionTitle) {
+  let reads = 0;
+  let writes = 0;
+  let searches = 0;
+  let commands = 0;
+  let tests = 0;
+  let deploys = 0;
+  let errors = 0;
+  const touchedFiles = [];
+  const progressSignals = [];
+  const driftSignals = [];
+  const securityFindings = [];
+  for (const event of events) {
+    const summary = sanitizePromptText(event.summary);
+    const summaryLower = summary.toLowerCase();
+    const toolName = extractToolName(event);
+    const command = extractCommand(event);
+    const touchedPath = extractTouchedPath(event);
+    if (event.type === "tool_call") {
+      if (summaryLower.startsWith("reading ") || toolName.includes("read")) reads += 1;
+      if (summaryLower.startsWith("writing ") || summaryLower.startsWith("editing ") || toolName.includes("write") || toolName.includes("edit") || toolName.includes("apply_diff")) {
+        writes += 1;
+      }
+      if (summaryLower.startsWith("searching ") || summaryLower.startsWith("finding files") || toolName.includes("grep") || toolName.includes("glob")) {
+        searches += 1;
+      }
+      if (command) {
+        commands += 1;
+        if (hasPattern(command, TEST_COMMAND_PATTERNS)) tests += 1;
+        if (hasPattern(command, DEPLOY_COMMAND_PATTERNS)) deploys += 1;
+        detectSecurityFindings(securityFindings, command, SECURITY_COMMAND_RULES);
+      }
+      if (touchedPath) {
+        pushUnique(touchedFiles, touchedPath, 3);
+        detectSecurityFindings(securityFindings, touchedPath, SECURITY_PATH_RULES);
+      }
+    }
+    const output = typeof event.details?.output === "string" ? event.details.output : "";
+    const combinedText = `${summary}
+${output}`;
+    if ((event.type === "message" || event.type === "tool_result") && ERROR_SIGNAL_PATTERN.test(combinedText)) {
+      errors += 1;
+    }
+  }
+  if (writes > 0) pushUnique(progressSignals, `${writes} write/edit actions executed`);
+  if (tests > 0) pushUnique(progressSignals, `${tests} test commands detected`);
+  if (deploys > 0) pushUnique(progressSignals, `${deploys} deploy/release commands detected`);
+  if (touchedFiles.length > 0) pushUnique(progressSignals, `touched files: ${touchedFiles.join(", ")}`);
+  if (reads >= 4 && writes === 0) pushUnique(driftSignals, `${reads} reads with no code edits`);
+  if (commands >= 6 && writes === 0 && tests === 0) {
+    pushUnique(driftSignals, `${commands} commands executed without visible code/test progress`);
+  }
+  if (errors >= 2) pushUnique(driftSignals, `${errors} error/failure signals seen in outputs`);
+  if (deploys > 0 && tests === 0) pushUnique(driftSignals, "deploy/release command seen without test evidence");
+  if (progressSignals.length === 0 && events.length >= 3) {
+    pushUnique(driftSignals, "no concrete progress signal captured in this batch");
+  }
+  let direction = "on-track";
+  if (errors >= 3 && writes === 0 && tests === 0) {
+    direction = "blocked";
+  } else if (driftSignals.length > 0 && writes === 0 && tests === 0) {
+    direction = "drifting";
+  } else if (progressSignals.length === 0) {
+    direction = "drifting";
+  }
+  const evidenceScore = writes + tests + deploys + (errors > 0 ? 1 : 0);
+  const confidence = events.length >= 8 || evidenceScore >= 3 ? "high" : events.length >= 4 || evidenceScore >= 1 ? "medium" : "low";
+  const security = securityFindings.some((finding) => finding.severity === "high") ? "alert" : securityFindings.length > 0 ? "watch" : "clean";
+  if (sessionTitle) {
+    pushUnique(progressSignals, `session goal/title: ${sessionTitle}`, 5);
+  }
+  return {
+    direction,
+    confidence,
+    security,
+    activitySummary: summarizeActivity(reads, writes, searches, commands, tests, errors),
+    progressSignals,
+    driftSignals,
+    securityFindings: securityFindings.slice(0, 3)
+  };
+}
+function applyAssessmentSignals(commentary, assessment) {
+  let out = String(commentary || "").trim();
+  if (!out) {
+    out = "Agent completed actions in this session.";
+  }
+  const hasSecuritySignal = /\bsecurity\b|\bsecurity alert\b|\bsecurity watch\b/i.test(out);
+  if (!hasSecuritySignal && assessment.security !== "clean") {
+    const top = assessment.securityFindings[0];
+    const label = assessment.security === "alert" ? "SECURITY ALERT" : "SECURITY WATCH";
+    const reason = top ? `${top.signal} (${top.evidence})` : "Risky behavior detected in this batch.";
+    out = `${label}: ${reason}
+${out}`;
+  }
+  const hasClosingLine = /\bverdict\b|\bon.?track\b|\bdrifting\b|\bblocked\b|\bmomentum\b/i.test(out);
+  if (!hasClosingLine) {
+    out = `${out}
+${createClosingLine(assessment)}`;
+  }
+  return out;
+}
+var CommentaryEngine = class extends import_events.EventEmitter {
+  sessions = /* @__PURE__ */ new Map();
+  flushQueue = [];
+  queuedSessions = /* @__PURE__ */ new Set();
+  generating = false;
+  model = DEFAULT_MODEL;
+  userFocus = "";
+  preset = "auto";
+  providers = {
+    anthropic: new AnthropicProvider(),
+    openai: new OpenAIProvider()
+  };
+  keyResolver;
+  paused = false;
+  enabledFormatStyleIds = DEFAULT_FORMAT_STYLE_IDS.slice();
+  lastFormatStyleId = null;
+  constructor(keyResolver) {
+    super();
+    this.keyResolver = keyResolver;
+  }
+  setModel(model) {
+    this.model = model;
+    this.emit("model-changed", model);
+  }
+  getModel() {
+    return this.model;
+  }
+  setFocus(focus) {
+    this.userFocus = focus;
+  }
+  getFocus() {
+    return this.userFocus;
+  }
+  setPreset(preset) {
+    const next = Object.prototype.hasOwnProperty.call(PRESET_INSTRUCTIONS, preset) ? preset : "auto";
+    this.preset = next;
+    this.emit("preset-changed", this.preset);
+  }
+  getPreset() {
+    return this.preset;
+  }
+  setFormatStyles(styleIds) {
+    const next = normalizeFormatStyles(Array.isArray(styleIds) ? styleIds : []);
+    if (sameFormatStyles(next, this.enabledFormatStyleIds)) return;
+    this.enabledFormatStyleIds = next;
+    if (this.lastFormatStyleId && !this.enabledFormatStyleIds.includes(this.lastFormatStyleId)) {
+      this.lastFormatStyleId = null;
+    }
+    this.emit("format-styles-changed", this.enabledFormatStyleIds.slice());
+  }
+  getFormatStyles() {
+    return this.enabledFormatStyleIds.slice();
+  }
+  pause() {
+    this.paused = true;
+  }
+  resume() {
+    this.paused = false;
+  }
+  isPaused() {
+    return this.paused;
+  }
+  addEvent(event) {
+    if (this.paused) return;
+    if (event.type === "tool_result" || event.type === "meta") return;
+    const key = this.sessionKey(event);
+    const state = this.ensureSessionState(key);
+    state.events.push(event);
+    if (state.events.length >= MAX_BATCH_SIZE) {
+      this.requestFlush(key, true);
+      return;
+    }
+    if (state.idleTimer) clearTimeout(state.idleTimer);
+    state.idleTimer = setTimeout(() => this.requestFlush(key, false), IDLE_TIMEOUT_MS);
+    if (!state.maxTimer) {
+      state.maxTimer = setTimeout(() => this.requestFlush(key, true), MAX_WAIT_MS);
+    }
+  }
+  sessionKey(event) {
+    return `${event.agent}:${event.sessionId}`;
+  }
+  ensureSessionState(key) {
+    if (!this.sessions.has(key)) {
+      this.sessions.set(key, {
+        events: [],
+        idleTimer: null,
+        maxTimer: null,
+        recentCommentary: []
+      });
+    }
+    return this.sessions.get(key);
+  }
+  clearSessionTimers(state) {
+    if (state.idleTimer) {
+      clearTimeout(state.idleTimer);
+      state.idleTimer = null;
+    }
+    if (state.maxTimer) {
+      clearTimeout(state.maxTimer);
+      state.maxTimer = null;
+    }
+  }
+  requestFlush(key, force) {
+    const state = this.sessions.get(key);
+    if (!state) return;
+    this.clearSessionTimers(state);
+    if (state.events.length === 0) return;
+    if (!force && state.events.length < MIN_BATCH_SIZE) {
+      state.idleTimer = setTimeout(() => this.requestFlush(key, true), IDLE_TIMEOUT_MS);
+      return;
+    }
+    this.enqueueFlush(key);
+  }
+  enqueueFlush(key) {
+    if (this.queuedSessions.has(key)) return;
+    this.queuedSessions.add(key);
+    this.flushQueue.push(key);
+    this.processFlushQueue();
+  }
+  async processFlushQueue() {
+    if (this.generating) return;
+    while (this.flushQueue.length > 0) {
+      const key = this.flushQueue.shift();
+      this.queuedSessions.delete(key);
+      const state = this.sessions.get(key);
+      if (!state || state.events.length === 0) continue;
+      const batch = state.events.splice(0);
+      this.generating = true;
+      try {
+        await this.generateCommentary(batch, state);
+      } catch (err) {
+        this.emit("error", err);
+      } finally {
+        this.generating = false;
+      }
+      if (state.events.length > 0) {
+        if (state.events.length >= MIN_BATCH_SIZE) {
+          this.enqueueFlush(key);
+        } else if (!state.idleTimer) {
+          state.idleTimer = setTimeout(() => this.requestFlush(key, true), IDLE_TIMEOUT_MS);
+        }
+      }
+    }
+  }
+  pickFormat() {
+    const enabled = this.enabledFormatStyleIds.length > 0 ? this.enabledFormatStyleIds : DEFAULT_FORMAT_STYLE_IDS;
+    const pool = this.lastFormatStyleId && enabled.length > 1 ? enabled.filter((styleId) => styleId !== this.lastFormatStyleId) : enabled;
+    const pickedStyleId = pool[Math.floor(Math.random() * pool.length)];
+    this.lastFormatStyleId = pickedStyleId;
+    return FORMAT_TEMPLATES[pickedStyleId];
+  }
+  async generateCommentary(events, state) {
+    if (events.length === 0) return;
+    const modelConfig = MODELS.find((m) => m.id === this.model);
+    if (!modelConfig) {
+      this.emit("error", new Error(`Unknown model: ${this.model}`));
+      return;
+    }
+    const apiKey = "";
+    const systemPrompt = this.buildSystemPrompt();
+    const latest = events[events.length - 1];
+    const assessment = buildCommentaryAssessment(events, latest.sessionTitle);
+    const userPrompt = this.buildUserPrompt(events, state.recentCommentary, assessment);
+    const provider = this.providers[modelConfig.provider];
+    const entry = {
+      timestamp: Date.now(),
+      sessionId: latest.sessionId,
+      projectName: latest.projectName,
+      sessionTitle: latest.sessionTitle,
+      agent: latest.agent,
+      source: latest.source,
+      eventSummary: events.map((e) => sanitizePromptText(e.summary)).join(" \u2192 "),
+      commentary: ""
+    };
+    this.emit("commentary-start", entry);
+    try {
+      let streamedRaw = "";
+      const full = await provider.generate(
+        systemPrompt,
+        userPrompt,
+        apiKey || "",
+        this.model,
+        (chunk) => {
+          streamedRaw += chunk;
+        }
+      );
+      const rawOutput = full || streamedRaw;
+      entry.commentary = applyAssessmentSignals(
+        sanitizeGeneratedCommentary(rawOutput),
+        assessment
+      );
+      if (entry.commentary) {
+        this.emit("commentary-chunk", { entry, chunk: entry.commentary });
+      }
+      this.emit("commentary-done", entry);
+      state.recentCommentary.push(entry.commentary);
+      if (state.recentCommentary.length > 5) {
+        state.recentCommentary.shift();
+      }
+    } catch (err) {
+      entry.commentary = "Commentary unavailable right now.";
+      this.emit("commentary-chunk", { entry, chunk: entry.commentary });
+      this.emit("commentary-done", entry);
+      this.emit("error", err);
+    }
+  }
+  buildSystemPrompt() {
+    let prompt = SYSTEM_PROMPT;
+    prompt += `
+
+Format for this message:
+${this.pickFormat()}`;
+    if (this.preset !== "auto") {
+      prompt += `
+
+Tone preset:
+${PRESET_INSTRUCTIONS[this.preset]}`;
+    }
+    if (this.userFocus.trim()) {
+      prompt += `
+
+Additional user instruction: ${this.userFocus}`;
+    }
+    return prompt;
+  }
+  buildUserPrompt(events, recentCommentary, assessment) {
+    const latest = events[events.length - 1];
+    const lines = events.map((e) => `  ${e.type}: ${sanitizePromptText(e.summary)}`);
+    let prompt = `Session: ${latest.agent}/${latest.projectName}
+`;
+    if (latest.sessionTitle) {
+      prompt += `Session title: ${sanitizePromptText(latest.sessionTitle)}
+`;
+    }
+    prompt += `Actions (${events.length}):
+${lines.join("\n")}`;
+    prompt += `
+
+Direction context:
+`;
+    prompt += `- Activity snapshot: ${assessment.activitySummary}
+`;
+    if (assessment.progressSignals.length > 0) {
+      prompt += `- Progress signals: ${assessment.progressSignals.join(" | ")}
+`;
+    }
+    if (assessment.driftSignals.length > 0) {
+      prompt += `- Drift/block signals: ${assessment.driftSignals.join(" | ")}
+`;
+    }
+    prompt += `- Initial direction estimate from raw signals: ${assessment.direction} (${assessment.confidence} confidence)
+`;
+    prompt += `
+Security auto-check:
+`;
+    prompt += `- Security state: ${assessment.security}
+`;
+    if (assessment.securityFindings.length > 0) {
+      prompt += assessment.securityFindings.map((finding) => `- ${finding.severity.toUpperCase()}: ${finding.signal} (${finding.evidence})`).join("\n");
+      prompt += "\n";
+    } else {
+      prompt += `- No explicit security flags in this batch.
+`;
+    }
+    if (recentCommentary.length > 0) {
+      prompt += `
+
+Previous commentary (don't repeat):
+`;
+      prompt += recentCommentary.slice(-3).map((c) => `- ${sanitizePromptText(c).slice(0, 80)}...`).join("\n");
+      prompt += `
+Use different judgment wording than these previous lines.`;
+    }
+    const recentlyUsed = extractRecentlyUsedJudgments(recentCommentary);
+    if (recentlyUsed.length > 0) {
+      prompt += `
+Avoid reusing these reaction phrases: ${recentlyUsed.join(", ")}.`;
+    }
+    prompt += `
+
+Summarize only this session's actions. Plain language, with your reaction.`;
+    prompt += `
+Close with one sentence about direction and momentum \u2014 weave in confidence and security naturally.`;
+    prompt += `
+Never mention IDs/logs/prompts/traces or internal data-collection steps.`;
+    prompt += `
+Never say "I", "I'll", "we", or any future plan.`;
+    return prompt;
+  }
+};
+function redactSessionIdentifiers(text) {
+  let out = text;
+  for (const pattern of SESSION_ID_PATTERNS) {
+    out = out.replace(pattern, "[session]");
+  }
+  return out;
+}
+function sanitizePromptText(text) {
+  return redactSessionIdentifiers(String(text || "")).replace(/\s+/g, " ").trim();
+}
+function sanitizeGeneratedCommentary(text) {
+  let out = redactSessionIdentifiers(String(text || ""));
+  out = out.replace(/\blocal session logs?\b/gi, "recent actions");
+  out = out.replace(/\bsession logs?\b/gi, "actions");
+  out = out.replace(/\bsession id\b/gi, "session");
+  out = out.replace(/\bverdict\s*:\s*/gi, "");
+  const blockedLine = /\b(i['’]?ll|i will|we(?:'ll| will)?)\b.*\b(pull|fetch|read|inspect|scan|parse|load|check)\b.*\b(session|log|trace|jsonl|prompt|history)\b/i;
+  const keptLines = out.split("\n").filter((line) => !blockedLine.test(line.trim()));
+  out = keptLines.join("\n").trim();
+  if (!out) {
+    return "Agent completed actions in this session.";
+  }
+  return out;
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  CommentaryEngine,
+  applyAssessmentSignals,
+  buildCommentaryAssessment,
+  sanitizeGeneratedCommentary
+});