@lore-co/cli 0.2.19 → 0.2.21

package/dist/runtime.js

@@ -13,7 +13,7 @@ import { dirname, parse, relative, resolve } from "node:path";
 import { homedir } from "node:os";
 import { fileURLToPath, pathToFileURL } from "node:url";
 import { promisify } from "node:util";
-import { boundedUtf8Text, defaultGitPushBranches, repositoryScopeFromGitRoot, } from "./repository.js";
+import { boundedUtf8Text, defaultGitPushBranches, repositoryRemoteScope, repositoryScopeFromGitRoot, } from "./repository.js";
 import { ReliabilityStore, ReliabilityStoreError, atomicWriteJson as durableAtomicWriteJson, classifyRetryFailure, createIntegrationInvocationAttempt, durableUnlink, recordLocalGuardMetric, recordLocalRetrievalMetric, } from "./reliability-store.js";
 import { writeInvocationAttemptBounded, writeInvocationCompletionBounded, } from "./invocation-health-writer.js";
 import { SignedSnapshotError, verifySignedSnapshot, } from "./signed-snapshot.js";
@@ -21,7 +21,7 @@ import { CONTEXT_CACHE_MAX_STALE_MS, isContextTransportFailure, selectCachedCont
 import { RUNTIME_VERSION } from "./runtime-version.js";
 import { checkLoreAccess, checkDirectory, checkWorkspaceRepository, readLocalConfig, resolveLocalConnection, bindLocalSession } from "./directory-policy.js";
 import { capturePendingImages, enqueueEventImages, flushImageAttachment, hostMessageImages, rememberImageCapture } from "./image-capture.js";
-import { guardRuleConflict, guardToolTrigger, supportedGuardRule, guardEmergencyCommand, emergencyOverrideApplies } from "@lore-co/core/guard-evaluation";
+import { guardRepositoryOverride, guardRuleConflict, guardToolTrigger, supportedGuardRule, guardEmergencyCommand, emergencyOverrideApplies } from "@lore-co/core/guard-evaluation";
 const IS_STANDALONE_RUNTIME = typeof __LORE_STANDALONE__ === "boolean" && __LORE_STANDALONE__;
 export const COMMAND_HOOK_AGENT_NAMES = [
     "codex",
@@ -456,7 +456,12 @@ async function repositoryRoot(cwd) {
         }
     }
 }
-async function repositoryScope(cwd) {
+/**
+ * Captured scope records only an origin-derived repository, so a checkout
+ * without a remote never stores its folder name as one. Guard keeps the folder
+ * label for that case because local overrides are keyed by it.
+ */
+async function repositoryScope(cwd, repository = repositoryRemoteScope) {
     if (cwd === undefined) {
         return undefined;
     }
@@ -465,8 +470,9 @@ async function repositoryScope(cwd) {
         return undefined;
     }
     const scopedPath = normalizedRepositoryPath(relative(root, resolve(cwd)));
+    const repo = await repository(root);
     return {
-        repo: await repositoryScopeFromGitRoot(root),
+        ...(repo === undefined ? {} : { repo }),
         ...(scopedPath === "" ? {} : { path: scopedPath }),
     };
 }
@@ -485,20 +491,16 @@ async function gitOutput(root, args) {
 }
 async function collectGitContext(cwd) {
     const scope = await repositoryScope(cwd);
-    if (cwd === undefined || scope?.repo === undefined) {
+    if (cwd === undefined || scope === undefined) {
         return {
             ...(scope === undefined ? {} : { scope }),
             learningScope: {},
         };
     }
+    const learningScope = scope.repo === undefined ? {} : { repo: scope.repo };
     const root = await repositoryRoot(cwd);
     if (root === null) {
-        return {
-            scope,
-            learningScope: {
-                repo: scope.repo,
-            },
-        };
+        return { scope, learningScope };
     }
     const [trackedFiles, untrackedFiles, rawDiff] = await Promise.all([
         gitOutput(root, [
@@ -527,9 +529,7 @@ async function collectGitContext(cwd) {
     const diff = boundedUtf8Text(redactSecrets(rawDiff), MAX_GIT_DIFF_BYTES, "\n\n[diff truncated by Lore]").trim();
     return {
         scope,
-        learningScope: {
-            repo: scope.repo,
-        },
+        learningScope,
         ...(files.length === 0 ? {} : { files }),
         ...(diff === "" ? {} : { diff }),
     };
@@ -813,6 +813,64 @@ function deliveryFromResponse(value) {
 }
 class IncompatibleReliabilityError extends Error {
     incompatible = true;
+    reason;
+    constructor(message, reason = "invalid_response") {
+        super(message);
+        this.reason = reason;
+    }
+}
+const RETRIEVAL_FAILURE_STAGE = Symbol("lore.retrievalFailureStage");
+function markKeyRefreshFailure(error) {
+    if (typeof error === "object" && error !== null) {
+        Object.defineProperty(error, RETRIEVAL_FAILURE_STAGE, {
+            value: "key_refresh",
+            enumerable: false,
+            configurable: true,
+        });
+    }
+    return error;
+}
+export function classifyRetrievalFailure(error) {
+    if (typeof error === "object" &&
+        error !== null &&
+        error[RETRIEVAL_FAILURE_STAGE] === "key_refresh") {
+        return "key_refresh";
+    }
+    if (error instanceof IncompatibleReliabilityError) {
+        return error.reason;
+    }
+    if (error instanceof SignedSnapshotError) {
+        return "snapshot_unverified";
+    }
+    if (error instanceof RuntimeHttpError) {
+        return `http_${error.httpStatus}`;
+    }
+    if (error instanceof Error) {
+        if (["AbortError", "TimeoutError", "LoreTimeoutError"].includes(error.name)) {
+            return "timeout";
+        }
+        const own = error.code;
+        const cause = error.cause;
+        const code = typeof own === "string"
+            ? own
+            : isObject(cause) && typeof cause.code === "string"
+                ? cause.code
+                : undefined;
+        if ((code !== undefined && isContextTransportFailure({ code })) ||
+            (code === undefined && error instanceof TypeError)) {
+            return "network";
+        }
+        const status = error;
+        const httpStatus = typeof status.httpStatus === "number"
+            ? status.httpStatus
+            : typeof status.status === "number"
+                ? status.status
+                : undefined;
+        if (httpStatus !== undefined && Number.isInteger(httpStatus)) {
+            return `http_${httpStatus}`;
+        }
+    }
+    return "unknown";
 }
 async function protocolResponseJson(response) {
     try {
@@ -853,7 +911,7 @@ function deliveryFromSignedContext(payload, expectedRequest) {
         !Array.isArray(payload.memories) ||
         !Array.isArray(payload.hits) ||
         !isObject(payload.packing)) {
-        throw new IncompatibleReliabilityError("Lore context snapshot does not bind the request or signed delivery");
+        throw new IncompatibleReliabilityError("Lore context snapshot does not bind the request or signed delivery", "binding_mismatch");
     }
     return deliveryFromResponse({
         context: payload.context,
@@ -1075,15 +1133,29 @@ async function verifySnapshot(compactJws, kind, config, store, fetchImplementati
         keys,
         allowExpired,
     }).payload;
+    let keys;
+    try {
+        keys = await pinnedKeys(config, store, fetchImplementation);
+    }
+    catch (error) {
+        throw markKeyRefreshFailure(error);
+    }
     try {
-        return verifyWith(await pinnedKeys(config, store, fetchImplementation));
+        return verifyWith(keys);
     }
     catch (error) {
         if (!(error instanceof SignedSnapshotError) ||
             error.code !== "UNTRUSTED_KEY") {
             throw error;
         }
-        return verifyWith(await refreshTrustKeys(config, store, fetchImplementation));
+        let refreshed;
+        try {
+            refreshed = await refreshTrustKeys(config, store, fetchImplementation);
+        }
+        catch (refreshError) {
+            throw markKeyRefreshFailure(refreshError);
+        }
+        return verifyWith(refreshed);
     }
 }
 function committedAcknowledgement(value, externalEventId, serverEventId) {
@@ -1136,13 +1208,13 @@ async function postTurn(config, request, fetchImplementation, store) {
         typeof value.turn.event.id !== "string" ||
         !isObject(value.retrieval) ||
         !committedAcknowledgement(value.capture, request.eventId, value.turn.event.id)) {
-        throw new IncompatibleReliabilityError("Lore turn response has no matching durable acknowledgement");
+        throw new IncompatibleReliabilityError("Lore turn response has no matching durable acknowledgement", "acknowledgement_mismatch");
     }
     const payload = await verifySnapshot(value.contextSnapshot, "context", config, store, fetchImplementation, true);
     if (payload.eventId !== value.turn.event.id ||
         !isObject(value.turn.receipt) ||
         payload.receiptId !== value.turn.receipt.id) {
-        throw new IncompatibleReliabilityError("Lore turn snapshot does not bind the returned event and receipt");
+        throw new IncompatibleReliabilityError("Lore turn snapshot does not bind the returned event and receipt", "binding_mismatch");
     }
     const reliability = retrievalReliability(value.retrieval, payload);
     if (Date.now() - Date.parse(payload.validUntil) >
@@ -1172,7 +1244,8 @@ async function postTurn(config, request, fetchImplementation, store) {
         task: {
             agent: request.agent,
             ...(request.scope === undefined ? {} : { scope: request.scope }),
-            task: request.task ?? request.currentUser.content.trim(),
+            // The server trims the retrieval task before searching and signing.
+            task: (request.task ?? request.currentUser.content).trim(),
         },
     });
     await store
@@ -1287,7 +1360,7 @@ async function getPromptContext(config, agent, sessionId, sourceEventId, prompt,
     const payload = await verifySnapshot(value.snapshot, "context", config, store, fetchImplementation, true);
     if (payload.eventId !== value.delivery.event.id ||
         payload.receiptId !== value.delivery.receipt.id) {
-        throw new IncompatibleReliabilityError("Lore context snapshot does not bind the returned event and receipt");
+        throw new IncompatibleReliabilityError("Lore context snapshot does not bind the returned event and receipt", "binding_mismatch");
     }
     const reliability = retrievalReliability(value.reliability, payload);
     if (Date.now() - Date.parse(payload.validUntil) >
@@ -1399,11 +1472,16 @@ async function getCachedPromptContext(config, prompt, gitContext, store, now, re
         },
     };
 }
-async function getPromptContextWithFallback(config, agent, sessionId, sourceEventId, prompt, gitContext, fetchImplementation, store, now, retained = []) {
+async function getPromptContextWithFallback(config, agent, sessionId, sourceEventId, prompt, gitContext, fetchImplementation, store, now, retained = [], failures) {
     try {
         return await getPromptContext(config, agent, sessionId, sourceEventId, prompt, gitContext, fetchImplementation, store, retained);
     }
     catch (error) {
+        failures?.push({
+            reason: classifyRetrievalFailure(error),
+            agent,
+            path: "context",
+        });
         if (isContextTransportFailure(error)) {
             const cached = await getCachedPromptContext(config, prompt, gitContext, store, now, retained).catch(() => null);
             if (cached !== null) {
@@ -1623,6 +1701,7 @@ async function flushOne(config, fetchImplementation, store, preferredIdempotency
                 : failed.state === "dead"
                     ? "dead"
                     : "ready",
+            failureReason: classifyRetrievalFailure(error),
         };
     }
 }
@@ -1885,7 +1964,7 @@ async function offlineGuard(config, store, request, now, previouslyEnforced, all
         return { offline: true, mode: "enforce", requiresConfirmation: false, items: [], conflictSummaries: ["An audited, time-limited emergency override is active for this session and repository."] };
     }
     const overrides = isObject(remembered) && Array.isArray(remembered.overrides) ? remembered.overrides : [];
-    const override = overrides.find((item) => isObject(item) && item.repo === request.repo);
+    const override = guardRepositoryOverride(overrides, request.repo);
     const knownEnforce = previouslyEnforced || (isObject(override) ? override.mode : isObject(remembered) ? remembered.mode : undefined) === "enforce";
     try {
         if (!allowCachedPolicy)
@@ -1897,7 +1976,7 @@ async function offlineGuard(config, store, request, now, previouslyEnforced, all
         const payload = verifySignedSnapshot(compactJws, {
             workspaceId: store.workspaceId, keys, kind: "guard_policy", now,
         }).payload;
-        const cachedOverride = Array.isArray(payload.overrides) ? payload.overrides.find((item) => isObject(item) && item.repo === request.repo) : undefined;
+        const cachedOverride = guardRepositoryOverride(payload.overrides, request.repo);
         const mode = isObject(cachedOverride) ? cachedOverride.mode : payload.mode;
         if (isObject(remembered) && remembered.policyVersion !== payload.policyVersion)
             throw new Error("Policy has changed");
@@ -1956,7 +2035,7 @@ async function handleGuardEvent(input, agent, config, sessionId, options, now) {
         return undefined;
     }
     const cwd = stringField(input.cwd);
-    const scope = await repositoryScope(cwd);
+    const scope = await repositoryScope(cwd, repositoryScopeFromGitRoot);
     const root = cwd === undefined ? null : await repositoryRoot(cwd);
     const files = (trigger.files ?? [])
         .map((file) => {
@@ -2128,8 +2207,8 @@ export async function handleHookEvent(value, agent, options = {}) {
             const prior = await readGuardState(agent, sessionId, options.home, config.connectionId).catch(() => null);
             const saved = await runtimeStore(config, options.home).then(store => store.readState("guard-policy-state")).catch(() => null);
             // Use the same scope as live Guard: non-Git folders have no repo override.
-            const scope = await repositoryScope(stringField(input.cwd)).catch(() => undefined);
-            const override = isObject(saved) && Array.isArray(saved.overrides) ? saved.overrides.find(value => isObject(value) && value.repo === scope?.repo) : undefined;
+            const scope = await repositoryScope(stringField(input.cwd), repositoryScopeFromGitRoot).catch(() => undefined);
+            const override = guardRepositoryOverride(isObject(saved) ? saved.overrides : undefined, scope?.repo);
             if (prior?.mode === "enforce" || (isObject(override) ? override.mode : isObject(saved) ? saved.mode : undefined) === "enforce") {
                 const reason = "Lore cannot verify workspace repository settings. Restore the connection before retrying.";
                 if (agent === "cursor")
@@ -2187,8 +2266,8 @@ export async function handleHookEvent(value, agent, options = {}) {
         catch {
             const prior = await readGuardState(agent, sessionId, options.home, config.connectionId).catch(() => null);
             const saved = await runtimeStore(config, options.home).then((store) => store.readState("guard-policy-state")).catch(() => null);
-            const scope = await repositoryScope(stringField(input.cwd)).catch(() => undefined);
-            const override = isObject(saved) && Array.isArray(saved.overrides) ? saved.overrides.find((entry) => isObject(entry) && entry.repo === scope?.repo) : undefined;
+            const scope = await repositoryScope(stringField(input.cwd), repositoryScopeFromGitRoot).catch(() => undefined);
+            const override = guardRepositoryOverride(isObject(saved) ? saved.overrides : undefined, scope?.repo);
             if (prior?.mode === "enforce" || (isObject(override) ? override.mode : isObject(saved) ? saved.mode : undefined) === "enforce") {
                 const reason = "Lore Guard cannot verify its enforcement policy. Restore Lore before retrying.";
                 if (agent === "cursor")
@@ -2288,6 +2367,8 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         throw new InvalidHookInputError();
     }
     const notices = [];
+    // Classified reasons only: never the prompt, task, or request payload.
+    const retrievalFailures = [];
     let store;
     try {
         store = await runtimeStore(config, options.home);
@@ -2402,8 +2483,15 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
                 else if (!terminal(flushed, request.eventId)) {
                     notices.push("Lore saved this capture locally; server upload is pending.");
                 }
+                if (retrieve &&
+                    flushed?.idempotencyKey === request.eventId &&
+                    flushed.failureReason !== undefined) {
+                    retrievalFailures.push({ reason: flushed.failureReason, agent, path: "turn" });
+                }
             }
             catch {
+                // Local store errors are not retrieval failures; the context
+                // delivery below records its own reason if it also fails.
                 notices.push("Lore saved this capture locally; server upload is pending.");
             }
         }
@@ -2414,9 +2502,10 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
                     learningScope: request.learningScope,
                     ...(request.diff === undefined ? {} : { diff: request.diff }),
                     ...(request.files === undefined ? {} : { files: request.files }),
-                }, fetchImplementation, store, now, retained);
+                }, fetchImplementation, store, now, retained, retrievalFailures);
             }
-            catch {
+            catch (error) {
+                retrievalFailures.push({ reason: classifyRetrievalFailure(error), agent, path: "context" });
                 delivery = {
                     ...emptyDelivery(),
                     reliability: {
@@ -2476,9 +2565,10 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
         }
         if (retrieve) {
             try {
-                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, task, gitContext, fetchImplementation, store, now, retained);
+                delivery = await getPromptContextWithFallback(config, agent, sessionId, observation.eventId, task, gitContext, fetchImplementation, store, now, retained, retrievalFailures);
             }
-            catch {
+            catch (error) {
+                retrievalFailures.push({ reason: classifyRetrievalFailure(error), agent, path: "context" });
                 delivery = {
                     ...emptyDelivery(),
                     reliability: {
@@ -2513,6 +2603,7 @@ async function handlePromptEvent(input, agent, sessionId, config, options, now,
             ...(reliability?.freshness.ageMs === undefined
                 ? {}
                 : { cacheAgeMs: reliability.freshness.ageMs }),
+            ...(retrievalFailures.length === 0 ? {} : { failures: retrievalFailures }),
         }, now).catch(() => undefined);
         const contextReliabilityNotice = await retrievalNotice(delivery, sessionId, store, now);
         if (contextReliabilityNotice !== undefined) {