@maycombhq/atticus 0.0.0-stage → 2.0.0-beta.3

package/dist/chunk-D3PO4DOZ.js

@@ -0,0 +1,261 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+
+// packages/core/dist/schema/version.js
+var SCHEMA_VERSION = 3;
+
+// packages/core/dist/fs.js
+import { randomBytes } from "node:crypto";
+import { mkdir, readFile, rename, rm, writeFile } from "node:fs/promises";
+import { hostname } from "node:os";
+import { dirname, join } from "node:path";
+async function writeFileAtomic(path, data) {
+  await mkdir(dirname(path), { recursive: true });
+  const tmp = `${path}.${process.pid}.${randomBytes(4).toString("hex")}.tmp`;
+  try {
+    await writeFile(tmp, data, typeof data === "string" ? "utf8" : void 0);
+    await renameRetrying(tmp, path);
+  } catch (e) {
+    await rm(tmp, { force: true });
+    throw e;
+  }
+}
+var BUSY = /* @__PURE__ */ new Set(["EPERM", "EBUSY", "EACCES"]);
+async function renameRetrying(from, to, tries = 9) {
+  for (let i = 0; ; i++) {
+    try {
+      await rename(from, to);
+      return;
+    } catch (e) {
+      const code = e.code ?? "";
+      if (!BUSY.has(code) || i >= tries - 1)
+        throw e;
+      await new Promise((r) => setTimeout(r, 20 * 2 ** i));
+    }
+  }
+}
+var LockHeldError = class extends Error {
+  held;
+  constructor(held) {
+    super(`Another ${held.what} is running (process ${held.pid} on ${held.host}, since ${held.startedAt}). Wait for it to finish.`);
+    this.held = held;
+    this.name = "LockHeldError";
+  }
+};
+var lockFileOf = (root, name) => join(root, ".atticus", "locks", `${name}.json`);
+function alive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (e) {
+    return e.code === "EPERM";
+  }
+}
+async function readLock(root, name) {
+  try {
+    const info = JSON.parse(await readFile(lockFileOf(root, name), "utf8"));
+    const stale = info.host === hostname() ? !alive(info.pid) : false;
+    return { ...info, stale };
+  } catch {
+    return void 0;
+  }
+}
+async function acquireLock(root, name, what, now = () => /* @__PURE__ */ new Date()) {
+  const file = lockFileOf(root, name);
+  await ensureLocalIgnore(root);
+  await mkdir(dirname(file), { recursive: true });
+  const info = {
+    pid: process.pid,
+    host: hostname(),
+    startedAt: now().toISOString(),
+    what
+  };
+  let interrupted;
+  for (let attempt = 0; attempt < 2; attempt++) {
+    try {
+      await writeFile(file, JSON.stringify(info), { encoding: "utf8", flag: "wx" });
+      const release = async () => {
+        const cur = await readLock(root, name);
+        if (cur && cur.pid === info.pid && cur.startedAt === info.startedAt)
+          await rm(file, { force: true });
+      };
+      return interrupted ? { release, interrupted } : { release };
+    } catch (e) {
+      if (e.code !== "EEXIST")
+        throw e;
+      const held = await readLock(root, name);
+      if (held && !held.stale)
+        throw new LockHeldError(held);
+      if (held) {
+        const { stale: _s, ...rest } = held;
+        interrupted = rest;
+      }
+      await rm(file, { force: true });
+    }
+  }
+  throw new Error(`Couldn't take the ${name} lock at ${file}.`);
+}
+var LOCAL_ONLY = [
+  "me.yaml",
+  "logs/",
+  "locks/",
+  "backups/",
+  "history/",
+  "probe/",
+  "cache/"
+];
+async function ensureLocalIgnore(root) {
+  const file = join(root, ".atticus", ".gitignore");
+  const text = await readFile(file, "utf8").catch(() => "");
+  const have = new Set(text.split(/\r?\n/).map((l) => l.trim()));
+  const missing = LOCAL_ONLY.filter((l) => !have.has(l));
+  if (!missing.length)
+    return;
+  await mkdir(dirname(file), { recursive: true });
+  const prefix = text && !text.endsWith("\n") ? `${text}
+` : text;
+  await writeFile(file, `${prefix}${prefix ? "" : "# This machine's own files: never committed.\n"}${missing.join("\n")}
+`, "utf8");
+}
+
+// packages/core/dist/log.js
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, rmSync, statSync, writeFileSync } from "node:fs";
+import { homedir, userInfo } from "node:os";
+import { join as join2 } from "node:path";
+var ORDER = { debug: 10, info: 20, warn: 30, error: 40, off: 100 };
+var LOG_MAX_BYTES = 5 * 1024 * 1024;
+var LOG_KEEP = 3;
+var logFileOf = (root) => join2(root, ".atticus", "logs", "atticus.log");
+var SECRET_KEY = /(token|password|passwd|pwd|secret|api[-_]?key|private[-_]?key|credential|authorization|cookie|session)/i;
+function redactText(s, o = {}) {
+  let out = s.replace(/([a-z][a-z0-9+.-]*:\/\/)[^/@\s:]+:[^/@\s]+@/gi, "$1***@").replace(/\b(bearer|basic)\s+[A-Za-z0-9._~+/=-]{8,}/gi, "$1 ***").replace(new RegExp(`(${SECRET_KEY.source})(["']?\\s*[:=]\\s*["']?)([^\\s"',;&]+)`, "gi"), "$1$3***").replace(/\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{5,}/g, "***").replace(/\b(?=[A-Za-z0-9+_-]*\d)(?=[A-Za-z0-9+_-]*[A-Z])(?=[A-Za-z0-9+_-]*[a-z])[A-Za-z0-9+_-]{32,}={0,2}/g, "***");
+  const home = o.home ?? safeHome();
+  if (home && home.length > 3)
+    out = out.split(home).join("~");
+  const user = o.user ?? safeUser();
+  if (user && user.length > 2)
+    out = out.replace(new RegExp(`([\\\\/])${escapeRe(user)}(?=[\\\\/])`, "g"), "$1<user>");
+  return out;
+}
+function redact(v, o = {}) {
+  if (typeof v === "string")
+    return redactText(v, o);
+  if (Array.isArray(v))
+    return v.map((x) => redact(x, o));
+  if (v && typeof v === "object") {
+    const out = {};
+    for (const [k, x] of Object.entries(v))
+      out[k] = SECRET_KEY.test(k) ? "***" : redact(x, o);
+    return out;
+  }
+  return v;
+}
+var escapeRe = (s) => s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function safeHome() {
+  try {
+    return homedir();
+  } catch {
+    return void 0;
+  }
+}
+function safeUser() {
+  try {
+    return userInfo().username;
+  } catch {
+    return void 0;
+  }
+}
+function rotate(file, max, keep) {
+  try {
+    if (statSync(file).size < max)
+      return;
+  } catch {
+    return;
+  }
+  rmSync(`${file}.${keep}`, { force: true });
+  for (let i = keep - 1; i >= 1; i--) {
+    try {
+      renameSync(`${file}.${i}`, `${file}.${i + 1}`);
+    } catch {
+    }
+  }
+  try {
+    renameSync(file, `${file}.1`);
+  } catch {
+  }
+}
+function logLevelFrom(env = process.env) {
+  const v = (env.ATTICUS_LOG ?? "").toLowerCase();
+  return v in ORDER ? v : "info";
+}
+function createLog(root, o = {}) {
+  const file = logFileOf(root);
+  const level = o.level ?? logLevelFrom();
+  const now = o.now ?? (() => /* @__PURE__ */ new Date());
+  const write = (lvl, event, fields) => {
+    if (ORDER[lvl] < ORDER[level])
+      return;
+    try {
+      mkdirSync(join2(file, ".."), { recursive: true });
+      ignoreLocalSync(root);
+      rotate(file, o.maxBytes ?? LOG_MAX_BYTES, o.keep ?? LOG_KEEP);
+      const entry = redact({ at: now().toISOString(), level: lvl, event, ...fields });
+      appendFileSync(file, `${JSON.stringify(entry)}
+`, "utf8");
+    } catch {
+    }
+  };
+  return {
+    file,
+    debug: (e, f = {}) => write("debug", e, f),
+    info: (e, f = {}) => write("info", e, f),
+    warn: (e, f = {}) => write("warn", e, f),
+    error: (e, err, f = {}) => write("error", e, {
+      ...f,
+      error: err instanceof Error ? { name: err.name, message: err.message, stack: err.stack?.split("\n").slice(0, 25) } : { message: String(err) }
+    })
+  };
+}
+function ignoreLocalSync(root) {
+  const f = join2(root, ".atticus", ".gitignore");
+  const text = existsSync(f) ? readFileSync(f, "utf8") : "";
+  const have = new Set(text.split(/\r?\n/).map((l) => l.trim()));
+  const missing = LOCAL_ONLY.filter((l) => !have.has(l));
+  if (!missing.length)
+    return;
+  const prefix = text && !text.endsWith("\n") ? `${text}
+` : text;
+  const head = prefix ? "" : "# This machine's own files: never committed.\n";
+  writeFileSync(f, `${prefix}${head}${missing.join("\n")}
+`, "utf8");
+}
+var NO_LOG = {
+  file: "",
+  debug: () => void 0,
+  info: () => void 0,
+  warn: () => void 0,
+  error: () => void 0
+};
+
+export {
+  SCHEMA_VERSION,
+  writeFileAtomic,
+  renameRetrying,
+  LockHeldError,
+  lockFileOf,
+  readLock,
+  acquireLock,
+  LOCAL_ONLY,
+  ensureLocalIgnore,
+  LOG_MAX_BYTES,
+  LOG_KEEP,
+  logFileOf,
+  redactText,
+  redact,
+  logLevelFrom,
+  createLog,
+  NO_LOG
+};

package/dist/chunk-DFBCSHVT.js

@@ -0,0 +1,69 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  defaultKeyStore
+} from "./chunk-YEDDOYSC.js";
+import "./chunk-CNUKCS2T.js";
+import "./chunk-S2A7YC3Q.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/secret-commands.js
+var NAME = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
+async function readStdin() {
+  const chunks = [];
+  for await (const c of process.stdin)
+    chunks.push(typeof c === "string" ? Buffer.from(c) : c);
+  return Buffer.concat(chunks).toString("utf8");
+}
+async function secretCommand(args, io, deps = {}) {
+  const [verb, name] = args;
+  const store = deps.store ?? defaultKeyStore();
+  const env = deps.env ?? process.env;
+  if (!verb || !["set", "check", "forget"].includes(verb) || !name) {
+    io.err("Usage: atticus secret set|check|forget <name>, the name runtime.yaml gives as keyEnv.");
+    return 2;
+  }
+  if (!NAME.test(name)) {
+    io.err(`${name} isn't a variable's name: use letters, digits and _, such as ATTICUS_MODEL_KEY.`);
+    return 2;
+  }
+  if (verb === "set") {
+    if (process.stdin.isTTY && !deps.read)
+      io.out(`Paste the key for ${name}, then press Enter and Ctrl+Z (Windows) or Ctrl+D:`);
+    const value = (await (deps.read ?? readStdin)()).trim();
+    if (!value) {
+      io.err("No key was given: pipe it in, for example from your password manager.");
+      return 2;
+    }
+    try {
+      store.set(name, value);
+    } catch (e) {
+      io.err(e instanceof Error ? e.message : String(e));
+      return 1;
+    }
+    io.out(`Kept ${name} in this machine's credential store. runtime.yaml names it as keyEnv.`);
+    return 0;
+  }
+  if (verb === "forget") {
+    store.forget(name);
+    io.out(`${name} is no longer kept on this machine.`);
+    return 0;
+  }
+  if (env[name]?.trim()) {
+    io.out(`${name} is set in the environment (it is used before the credential store).`);
+    return 0;
+  }
+  if (store.get(name)) {
+    io.out(`${name} is kept in this machine's credential store.`);
+    return 0;
+  }
+  io.out(`${name} isn't set on this machine: atticus secret set ${name} keeps it.`);
+  return 1;
+}
+export {
+  secretCommand
+};

package/dist/chunk-DHPACDG7.js

@@ -0,0 +1,104 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  acceptStandardChecks,
+  draftStandardChecks,
+  estimateScan
+} from "./chunk-L24C55VN.js";
+import "./chunk-23W7VWKR.js";
+import "./chunk-7EKXJZ2Y.js";
+import "./chunk-MC3H7736.js";
+import "./chunk-GQ4N4WKF.js";
+import "./chunk-CNUKCS2T.js";
+import {
+  loadOrgPack,
+  orgPackDirOf
+} from "./chunk-S2A7YC3Q.js";
+import "./chunk-D3PO4DOZ.js";
+import "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/wikis-commands.js
+var plural = (n, w) => `${n.toLocaleString("en")} ${w}${n === 1 ? "" : "s"}`;
+var str = (v) => typeof v === "string" && v.trim() ? v.trim() : void 0;
+async function sourcesEstimate(root, o, io) {
+  const op = await loadOrgPack(orgPackDirOf(root));
+  if (o.source && !op.sources.wikis.some((w) => w.id === o.source)) {
+    io.err(`There is no source ${o.source} in org-pack/sources.yaml.`);
+    return 2;
+  }
+  const pack = o.source ? {
+    ...op,
+    sources: { ...op.sources, wikis: op.sources.wikis.filter((w) => w.id === o.source) }
+  } : op;
+  const e = await estimateScan(root, {
+    orgPack: pack,
+    ...o.batchTokens ? { batchTokens: o.batchTokens } : {},
+    ...o.full ? { full: true } : {}
+  });
+  if (o.json) {
+    io.out(JSON.stringify(e, null, 2));
+    return e.sources.length ? 0 : 2;
+  }
+  if (!e.sources.length) {
+    io.err("There is no snapshot yet. Run atticus sources sync first: the estimate reads the snapshots.");
+    return 2;
+  }
+  io.out(`A knowledge scan would read ${plural(e.total.toRead, "page")} of ${plural(e.total.pages, "page")}, about ${plural(e.total.tokens, "token")}, in ${plural(e.total.calls, "model call")} (each call up to ${plural(e.room, "token")} of pages):`);
+  for (const s of e.sources)
+    io.out(`  ${s.source}: ${plural(s.toRead, "page")} to read of ${s.pages}${s.unchanged ? ` (${s.unchanged} as at the last scan)` : ""}, about ${plural(s.tokens, "token")}, ${plural(s.calls, "call")} on its own${s.capped ? `; ${s.capped} wait for a later run (maxPages ${s.cap})` : ""}`);
+  for (const id of e.notSynced)
+    io.out(`  ${id}: not synced yet (atticus sources sync --source ${id})`);
+  io.out("Each call is one prompt to the configured model (with Copilot, one premium request). Cap a source with maxPages in sources.yaml; atticus knowledge scan reads the rest on a later run.");
+  return 0;
+}
+async function standardsCli(root, command, values, io) {
+  const json = values.json === true;
+  try {
+    if (command === "propose") {
+      const d = await draftStandardChecks(root);
+      if (json) {
+        io.out(JSON.stringify(d, null, 2));
+        return 0;
+      }
+      if (!d.proposals.length)
+        io.out("No rule of a confirmed standard waits to be accepted.");
+      else {
+        io.out(`${plural(d.proposals.length, "critic check")} proposed from confirmed standards (nothing is enforced until accepted):`);
+        for (const p of d.proposals)
+          io.out(`  ${p.rule.id} (${p.rule.severity}): ${p.rule.title} [${p.page}, confirmed by ${p.verifiedBy}]`);
+      }
+      for (const l of d.left)
+        io.out(`  not proposed: ${l.item}: ${l.why}`);
+      io.out(`Written to ${d.file} and ${d.file.replace(/\.yaml$/, ".md")}. Accept them with atticus standards accept [--only id,id].`);
+      return 0;
+    }
+    if (command === "accept") {
+      const only = str(values.only)?.split(",").map((x) => x.trim()).filter(Boolean);
+      const r = await acceptStandardChecks(root, {
+        ...only ? { only } : {},
+        ...values["dry-run"] === true ? { dryRun: true } : {}
+      });
+      if (json) {
+        io.out(JSON.stringify(r, null, 2));
+        return 0;
+      }
+      const would = values["dry-run"] === true;
+      io.out(`${would ? "Would add" : "Added"} ${r.added.length ? r.added.join(", ") : "no check"} to ${r.file}; ${r.left} left proposed.`);
+      if (!would && r.added.length)
+        io.out("Commit the checklist through a pull request: merging it is the approval, and the critic runs it from then on.");
+      return 0;
+    }
+    io.err("Usage: atticus standards propose | atticus standards accept [--only id,id] [--dry-run]");
+    return 2;
+  } catch (e) {
+    io.err(e.message);
+    return 2;
+  }
+}
+export {
+  sourcesEstimate,
+  standardsCli
+};