@miphamai/cli 0.37.0 → 0.39.0

package/src/vajra/compose/mount.ts

@@ -0,0 +1,30 @@
+import type { Context, Mounted, Service } from '..'
+import type { Bundle, BundleLine, Profile } from './bundle'
+import { assemble } from './assemble'
+
+/** 服务解析器：bundle 行的「要挂的代码」——按行解析出要挂载的 Service；纯数据行（如 package-info）返回 undefined 跳过。 */
+export type ServiceResolver = (line: BundleLine) => Service | undefined
+
+/** 按行顺序把解析出的 Service 挂进 ctx（依赖未就位则挂起，语义同 ctx.mount）。 */
+export function mountLines(
+  ctx: Context,
+  lines: BundleLine[],
+  resolveService: ServiceResolver,
+): Mounted[] {
+  const mounted: Mounted[] = []
+  for (const line of lines) {
+    const service = resolveService(line)
+    if (service) mounted.push(ctx.mount(service))
+  }
+  return mounted
+}
+
+/** 从 profile 声明式挂载：assemble → mountLines 一整条链。 */
+export function mountProfile(
+  ctx: Context,
+  profile: Profile,
+  resolveBundle: (name: string) => Bundle,
+  resolveService: ServiceResolver,
+): Mounted[] {
+  return mountLines(ctx, assemble(profile, resolveBundle), resolveService)
+}

package/src/vajra/context.ts

@@ -0,0 +1,183 @@
+import type { EventsOfMode } from './events'
+import type { Service, Mounted, ServiceStatus } from './service'
+
+export type Disposer = () => void
+
+type Listener = (...args: any[]) => any
+
+export class Context {
+  private services = new Map<string, unknown>()
+  private effects: Disposer[] = []
+  private listeners = new Map<string, Listener[]>()
+  private waiters: Array<() => boolean> = []
+  private scopes = new Map<unknown, Context>()
+  readonly parent?: Context
+
+  constructor(parent?: Context) {
+    this.parent = parent
+  }
+
+  provide<T>(key: string, value: T): Disposer {
+    this.services.set(key, value)
+    this.flushWaiters()
+    return () => {
+      this.services.delete(key)
+    }
+  }
+
+  private flushWaiters(): void {
+    this.waiters = this.waiters.filter((w) => !w())
+  }
+
+  mount(service: Service): Mounted {
+    const keys = service.inject ?? []
+    let status: ServiceStatus = 'inactive'
+    let error: Error | undefined
+    let disposer: Disposer = () => {}
+    let applied = false
+    let disposed = false
+    let effectSnapshot = -1
+
+    const tryApply = (): boolean => {
+      if (applied) return true
+      if (!keys.every((k) => this.has(k))) return false
+      applied = true
+      status = 'loading'
+      effectSnapshot = this.effects.length
+      try {
+        disposer = service.apply(this) ?? (() => {})
+        status = 'active'
+      } catch (e) {
+        error = e as Error
+        status = 'failed'
+      }
+      return true
+    }
+
+    const waiter = (): boolean => {
+      if (disposed) {
+        this.waiters = this.waiters.filter((w) => w !== waiter)
+        return true
+      }
+      if (!tryApply()) return false
+      this.waiters = this.waiters.filter((w) => w !== waiter)
+      return true
+    }
+
+    if (!tryApply()) {
+      this.waiters.push(waiter)
+    }
+
+    const mounted: Mounted = {
+      dispose: () => {
+        disposed = true
+        this.waiters = this.waiters.filter((w) => w !== waiter)
+        if (status === 'active') {
+          status = 'unloading'
+          disposer()
+        }
+        if (effectSnapshot >= 0) {
+          while (this.effects.length > effectSnapshot) {
+            this.effects.pop()!()
+          }
+        }
+      },
+      status: () => status,
+    }
+    Object.defineProperty(mounted, 'error', { get: () => error })
+    return mounted
+  }
+
+  get<T>(key: string): T | undefined {
+    return (this.services.get(key) as T | undefined) ?? this.parent?.get<T>(key)
+  }
+
+  has(key: string): boolean {
+    return this.services.has(key) || (this.parent?.has(key) ?? false)
+  }
+
+  keys(): string[] {
+    return [...this.services.keys()]
+  }
+
+  /** 枚举本层 + 父层所有键（local 遮蔽 parent，去重）。 */
+  keysRecursive(): string[] {
+    const seen = new Set<string>(this.keys())
+    for (const k of this.parent?.keysRecursive() ?? []) seen.add(k)
+    return [...seen]
+  }
+
+  scope(key: unknown): Context {
+    let child = this.scopes.get(key)
+    if (!child) {
+      child = new Context(this)
+      this.scopes.set(key, child)
+    }
+    return child
+  }
+
+  effect(fn: () => Disposer | void): Disposer {
+    const d = fn() ?? (() => {})
+    let disposed = false
+    const dispose = () => {
+      if (disposed) return
+      disposed = true
+      d()
+    }
+    this.effects.push(dispose)
+    return dispose
+  }
+
+  on(event: string, fn: Listener): Disposer {
+    const ls = this.listeners.get(event) ?? []
+    ls.push(fn)
+    this.listeners.set(event, ls)
+    return () => {
+      const cur = this.listeners.get(event)
+      if (cur)
+        this.listeners.set(
+          event,
+          cur.filter((l) => l !== fn),
+        )
+    }
+  }
+
+  emit(event: EventsOfMode<'emit'>, ...args: unknown[]): void {
+    for (const fn of this.listeners.get(event) ?? []) fn(...args)
+  }
+
+  async waterfall<T>(event: EventsOfMode<'waterfall'>, value: T, ...args: unknown[]): Promise<T> {
+    const ls = this.listeners.get(event) ?? []
+    const run = async (i: number, v: T): Promise<T> => {
+      if (i >= ls.length) return v
+      const next = async (nextVal?: T) => run(i + 1, nextVal === undefined ? v : nextVal)
+      return (await ls[i]!(v, ...args, next)) as T
+    }
+    return run(0, value)
+  }
+
+  async parallel(event: EventsOfMode<'parallel'>, ...args: unknown[]): Promise<unknown[]> {
+    return Promise.all((this.listeners.get(event) ?? []).map((fn) => fn(...args)))
+  }
+
+  async serial(event: EventsOfMode<'serial'>, ...args: unknown[]): Promise<unknown[]> {
+    const out: unknown[] = []
+    for (const fn of this.listeners.get(event) ?? []) out.push(await fn(...args))
+    return out
+  }
+
+  dispose(): void {
+    const errors: unknown[] = []
+    while (this.effects.length) {
+      try {
+        this.effects.pop()!()
+      } catch (e) {
+        errors.push(e)
+      }
+    }
+    this.services.clear()
+    this.scopes.clear()
+    this.listeners.clear()
+    if (errors.length) throw new AggregateError(errors)
+  }
+}

package/src/vajra/events.ts

@@ -0,0 +1,13 @@
+export type DispatchMode = 'emit' | 'waterfall' | 'parallel' | 'serial'
+
+/**
+ * 事件契约映射。每个事件名声明其派发模式；里程碑/测试通过
+ * declaration merging 扩展本 interface（无需改内核）。
+ */
+// eslint-disable-next-line @typescript-eslint/no-empty-object-type
+export interface EventMap {}
+
+/** 提取声明为指定 mode 的事件名联合。 */
+export type EventsOfMode<M extends DispatchMode> = {
+  [K in keyof EventMap]: EventMap[K] extends { mode: M } ? K : never
+}[keyof EventMap]

package/src/vajra/index.ts

@@ -0,0 +1,4 @@
+export { Context } from './context'
+export type { Disposer } from './context'
+export type { DispatchMode, EventMap, EventsOfMode } from './events'
+export type { Service, ServiceStatus, Mounted } from './service'

package/src/vajra/leaf/plan-runner.ts

@@ -0,0 +1,94 @@
+import type { Service } from '../index'
+import type { Llm } from '../../providers/llm'
+import type { BundleLine } from '../compose/bundle'
+
+export type PlanTask = { id: string; description: string }
+export type Plan = { name: string; tasks: PlanTask[] }
+export type TaskOutcome = {
+  taskId: string
+  status: 'done' | 'needs-changes' | 'error'
+  result: string
+  review: string
+}
+
+export const PLAN_RUNNER_KEY = 'plan-runner'
+
+export interface PlanRunner {
+  run(plan: Plan): Promise<TaskOutcome[]>
+}
+
+// 事件契约：declaration merging 扩展 EventMap（内核首例，不改内核）
+declare module '../events' {
+  interface EventMap {
+    'plan/task-start': { mode: 'emit'; in: { taskId: string } }
+    'plan/task-done': {
+      mode: 'emit'
+      in: { taskId: string; status: 'done' | 'needs-changes' | 'error' }
+    }
+  }
+}
+
+async function chatText(llm: Llm, prompt: string, model: string): Promise<string> {
+  let text = ''
+  for await (const chunk of llm.chat({
+    model,
+    messages: [{ role: 'user', content: prompt }],
+  })) {
+    if (chunk.type === 'text' && chunk.content) text += chunk.content
+  }
+  return text
+}
+
+/** 创建 plan-runner Service。model 缺省为空串（「用 active model」，由 ProviderRegistry 的 req.model || activeModelId 回退）；传值则锁定该模型。 */
+export function createPlanRunnerService(options: { model?: string } = {}): Service {
+  const model = options.model ?? ''
+  return {
+    inject: ['llm'],
+    apply(ctx) {
+      const runner: PlanRunner = {
+        async run(plan) {
+          const outcomes: TaskOutcome[] = []
+          for (const task of plan.tasks) {
+            ctx.emit('plan/task-start', { taskId: task.id })
+            const taskCtx = ctx.scope(task.id) // 每任务独立作用域（继承父层 llm 缝）
+            let result = ''
+            let review = ''
+            try {
+              result = await chatText(
+                taskCtx.get<Llm>('llm')!,
+                `Implement: ${task.description}`,
+                model,
+              )
+              review = await chatText(
+                taskCtx.get<Llm>('llm')!,
+                `Review: does the result satisfy "${task.description}"? Result: ${result}`,
+                model,
+              )
+            } catch (e) {
+              outcomes.push({ taskId: task.id, status: 'error', result, review: String(e) })
+              ctx.emit('plan/task-done', { taskId: task.id, status: 'error' })
+              continue
+            }
+            const status: TaskOutcome['status'] = review.startsWith('APPROVE')
+              ? 'done'
+              : 'needs-changes'
+            outcomes.push({ taskId: task.id, status, result, review })
+            ctx.emit('plan/task-done', { taskId: task.id, status })
+          }
+          return outcomes
+        },
+      }
+      ctx.provide(PLAN_RUNNER_KEY, runner)
+    },
+  }
+}
+
+/** 默认 plan-runner Service（model 空串 = 用 active model）。 */
+export const planRunnerService: Service = createPlanRunnerService()
+
+/** 从 bundle 行解析 plan-runner Service（读 config.model 传工厂；id 非 plan-runner 或纯数据行返回 undefined）。 */
+export function planRunnerFromLine(line: BundleLine): Service | undefined {
+  if (line.id !== 'plan-runner') return undefined
+  const model = typeof line.config.model === 'string' ? line.config.model : undefined
+  return createPlanRunnerService({ model })
+}

package/src/vajra/service.ts

@@ -0,0 +1,15 @@
+import type { Context } from './context'
+import type { Disposer } from './context'
+
+export interface Service {
+  inject?: string[]
+  apply(ctx: Context): void | Disposer
+}
+
+export type ServiceStatus = 'inactive' | 'loading' | 'active' | 'unloading' | 'failed'
+
+export interface Mounted {
+  dispose(): void
+  status(): ServiceStatus
+  readonly error?: Error
+}

package/src/workflow/primitives/agent.ts

@@ -1,5 +1,6 @@
 import { SubAgent } from '../../agent/sub-agent'
 import type { ProviderRegistry } from '../../providers/registry'
+import type { Llm } from '../../providers/llm'
 import type { ToolDefinition } from '../../shared/index.ts'
 import type { PermissionSystem } from '../../core/permission'
 import { validateJSONSchema, formatValidationErrors } from '../schema-validator'
@@ -41,6 +42,7 @@ export async function workflowAgent(
   registry: ProviderRegistry,
   toolRegistry: Map<string, ToolDefinition>,
   opts: WorkflowAgentOpts = {},
+  llm?: Llm,
 ): Promise<unknown> {
   // If provider override, switch temporarily
   if (opts.provider) {
@@ -82,7 +84,7 @@ export async function workflowAgent(
       `Return ONLY the JSON object, no other text. Do not wrap in markdown code fences.`
   }
 
-  const sub = new SubAgent(registry, toolRegistry, opts.permissionSystem)
+  const sub = new SubAgent(registry, toolRegistry, opts.permissionSystem, undefined, undefined, llm)
 
   // ── Execute with optional schema validation + retry ──
   let result: unknown = ''

package/src/workflow/runtime.ts

@@ -1,5 +1,5 @@
 import vm from 'node:vm'
-import { createSandbox } from './sandbox'
+import { createSandbox, sealValue } from './sandbox'
 import { createJournal, appendJournal, loadJournal, loadScript } from './journal'
 import { createBudget } from './budget'
 import { workflowAgent } from './primitives/agent'
@@ -103,6 +103,7 @@ export async function runWorkflow(
   const registry: ProviderRegistry = engine.getRegistry()
   const toolRegistry = engine.getTools()
   const permission = engine.getPermission()
+  const llm = engine.getLlm()
 
   const budget = createBudget(budgetTotal)
 
@@ -124,10 +125,16 @@ export async function runWorkflow(
 
     bus.emitEvent({ type: 'agent:start', agentId, label: agentId, phase })
 
-    const result = await workflowAgent(prompt, registry, toolRegistry, {
-      ...(opts || {}),
-      permissionSystem: permission,
-    } as Record<string, unknown>)
+    const result = await workflowAgent(
+      prompt,
+      registry,
+      toolRegistry,
+      {
+        ...(opts || {}),
+        permissionSystem: permission,
+      } as Record<string, unknown>,
+      llm,
+    )
 
     const durationMs = Date.now() - startTime
     bus.emitEvent({ type: 'agent:end', agentId, label: agentId, success: true, durationMs })
@@ -159,19 +166,20 @@ export async function runWorkflow(
     })()
   `
 
-  // Execute in node:vm sandbox — no access to host globals
+  // Execute in a node:vm context (deterministic replay; NOT a security boundary).
   const vmScript = new vm.Script(wrappedScript, { filename: 'workflow.js' })
   const sandboxCtx = createSandbox(args, budget)
 
-  // Inject primitives into the sandbox context (whitelist approach)
-  sandboxCtx.agent = agent
-  sandboxCtx.parallel = parallel
-  sandboxCtx.pipeline = pipeline
-  sandboxCtx.verify = verify
-  sandboxCtx.judge = judge
-  sandboxCtx.loopUntilConvergence = loopUntilConvergence
-  sandboxCtx.phase = wrappedPhase
-  sandboxCtx.log = log
+  // Inject primitives into the context (sealed so their constructor chain
+  // can't reach host globals via `fn.constructor('return process')()`).
+  sandboxCtx.agent = sealValue(agent)
+  sandboxCtx.parallel = sealValue(parallel)
+  sandboxCtx.pipeline = sealValue(pipeline)
+  sandboxCtx.verify = sealValue(verify)
+  sandboxCtx.judge = sealValue(judge)
+  sandboxCtx.loopUntilConvergence = sealValue(loopUntilConvergence)
+  sandboxCtx.phase = sealValue(wrappedPhase)
+  sandboxCtx.log = sealValue(log)
 
   let result: unknown
   try {

package/src/workflow/sandbox.ts

@@ -4,22 +4,64 @@ import vm from 'node:vm'
 const FORBIDDEN = new Set(['Date.now', 'Math.random', 'crypto.randomUUID'])
 
 /**
- * Create a sandboxed VM context for workflow script execution.
- * Blocks Date.now(), Math.random(), argless new Date(), crypto.randomUUID(),
- * plus explicit sandbox escape vectors: eval, Function constructor, import(),
- * require(), process, Bun, fetch, setTimeout/setInterval, etc.
+ * Wrap a host function so `.constructor` / `.prototype` / `__proto__` access
+ * cannot reach the host `Function` constructor (blocks
+ * `fn.constructor('return process')()` and friends).
+ */
+function sealFunction<T extends (...args: never[]) => unknown>(fn: T): T {
+  return new Proxy(fn, {
+    get(target, prop) {
+      if (prop === 'constructor' || prop === 'prototype' || prop === '__proto__') {
+        return undefined
+      }
+      return Reflect.get(target, prop)
+    },
+    apply(target, thisArg, argArray) {
+      return Reflect.apply(target, thisArg, argArray)
+    },
+  }) as T
+}
+
+/**
+ * Best-effort seal a value: freeze objects and wrap function properties so
+ * their constructor chain can't reach host globals.
+ */
+export function sealValue(value: unknown, depth = 0): unknown {
+  if (depth > 4) return value
+  if (typeof value === 'function') {
+    return sealFunction(value as (...args: never[]) => unknown)
+  }
+  if (value && typeof value === 'object') {
+    for (const key of Object.getOwnPropertyNames(value)) {
+      const child = (value as Record<string, unknown>)[key]
+      if (typeof child === 'function') {
+        ;(value as Record<string, unknown>)[key] = sealFunction(
+          child as (...args: never[]) => unknown,
+        )
+      }
+    }
+    return Object.freeze(value)
+  }
+  return value
+}
+
+/**
+ * Create a VM context for workflow script execution.
  *
- * P0-2 (v2.1.223 alignment): Added explicit defense-in-depth denial of all
- * host globals (process, require, Bun, fetch, setTimeout, etc.) and
- * constructor.constructor escape vector blocking.
+ * SECURITY: node:vm is NOT a security boundary. Workflow scripts are
+ * model-authored code running in the same process — the model already has
+ * Bash access, so this context does NOT isolate the script from the host.
+ * Its purpose is determinism (blocking Date.now/Math.random/randomUUID for
+ * reproducible replay) plus best-effort blocking of common escape vectors.
+ * Do not treat this as a sandbox that can safely run untrusted code.
  */
 export function createSandbox(
   args: unknown,
   budget: { total: number | null; spent(): number; remaining(): number },
 ): vm.Context {
   const sandboxObj: Record<string, unknown> = {
-    args,
-    budget,
+    args: sealValue(args),
+    budget: sealValue(budget),
     console: {
       log: (..._a: unknown[]) => {}, // no-op in sandbox
       error: (..._a: unknown[]) => {},