@ngockhoale/ukit 2.2.16 → 2.3.1

package/templates/ukit/storage/config.json

@@ -6,6 +6,10 @@
     "affectVerification": true,
     "affectDelegation": true
   },
+  "security": {
+    "sensitiveDataGate": true,
+    "allowlistPath": ".ukit/storage/security/allowlist.json"
+  },
   "compact": {
     "enabled": true,
     "tokenThreshold": 150000,
@@ -91,7 +95,6 @@
     "advisorEnabled": true,
     "contracts": {
       "tiny-fix": {
-        "modelTier": "lite",
         "maxReadPasses": 0,
         "maxContextPulls": 0,
         "verificationPolicy": "minimal-or-targeted",
@@ -99,7 +102,6 @@
         "delegationPolicy": "disallow"
       },
       "local-fix": {
-        "modelTier": "code",
         "maxReadPasses": 1,
         "maxContextPulls": 1,
         "verificationPolicy": "targeted-if-covered",
@@ -107,7 +109,6 @@
         "delegationPolicy": "disallow"
       },
       "local-build": {
-        "modelTier": "code",
         "maxReadPasses": 2,
         "maxContextPulls": 1,
         "verificationPolicy": "targeted-if-covered",
@@ -116,14 +117,12 @@
         "postEditReviewPolicy": "sidecar-non-blocking"
       },
       "find-cause": {
-        "modelTier": "code",
         "maxReadPassesBeforeReassess": 3,
         "verificationPolicy": "root-cause-then-targeted",
         "completionRule": "never-claim-fixed-without-write-and-verification",
         "delegationPolicy": "allow-specialized-debug-lane"
       },
       "shared-edit": {
-        "modelTier": "code",
         "maxReadPasses": 2,
         "maxContextPulls": 2,
         "verificationPolicy": "targeted-then-widen-on-risk",
@@ -132,7 +131,6 @@
         "postEditReviewPolicy": "sidecar-non-blocking"
       },
       "map-impact": {
-        "modelTier": "code",
         "maxReadPasses": 3,
         "maxContextPulls": 3,
         "verificationPolicy": "impact-first-then-targeted-then-widen-on-risk",
@@ -140,7 +138,6 @@
         "delegationPolicy": "allow-impact-sidecar"
       },
       "review-release": {
-        "modelTier": "smart",
         "verificationPolicy": "evidence-first",
         "completionRule": "report-findings-not-implementation",
         "delegationPolicy": "allow-review-sidecar"
@@ -392,6 +389,10 @@
       "affectVerification": "Nếu true, autonomy.level ảnh hưởng hành vi verification plan.",
       "affectDelegation": "Nếu true, autonomy.level ảnh hưởng ngưỡng delegation."
     },
+    "security": {
+      "sensitiveDataGate": "Bật sensitive-data gate: chặn key/private data/secret (đọc file .env, *.pem, id_rsa; lệnh bash dump secret; prompt chứa token) trước khi chúng tới AI. Chặn cực gắt theo yêu cầu: chỉ cần nghi ngờ là chặn và hỏi user. Tắt chỉ khi debug gate này.",
+      "allowlistPath": "File allowlist JSON do USER tự tạo để phê duyệt tường minh giá trị secret (sha256) hoặc đường dẫn file được phép gửi. File này được protect-files.sh chặn AI tự sửa."
+    },
     "compact": {
       "enabled": "Bật/tắt toàn bộ helper compact của UKit.",
       "tokenThreshold": "Ngưỡng token chung cho runtime compact dùng chung.",

package/src/core/router/advisor.js

@@ -1,42 +0,0 @@
-export function shouldEscalate(trigger) {
-  if (!trigger || typeof trigger !== 'object') {
-    return false;
-  }
-
-  if (trigger.type === 'user_requested') {
-    return true;
-  }
-
-  if (trigger.type === 'complexity_detected') {
-    return true;
-  }
-
-  if (trigger.type === 'retry_exceeded') {
-    return (trigger.attempts ?? 0) >= 2;
-  }
-
-  if (trigger.type === 'validation_failed') {
-    return (trigger.attempts ?? 0) >= 1;
-  }
-
-  return false;
-}
-
-export async function askAdvisor(request) {
-  const strategy = request?.question
-    ? `Break the task into verifiable steps, focusing on: ${request.question}`
-    : 'Break the task into smaller verifiable steps.';
-
-  return {
-    strategy,
-    steps: [
-      'Restate the goal in one short sentence.',
-      'List the smallest changes that can be verified locally.',
-      'Run focused checks before expanding the scope.',
-    ],
-    warnings: [
-      'Fallback advisor response used because no external advisor integration is wired in this local runtime.',
-    ],
-    confidence: 55,
-  };
-}

package/src/core/router/router.js

@@ -1,180 +0,0 @@
-const HIGH_COMPLEXITY_KEYWORDS = [
-  'architecture',
-  'architect',
-  'design',
-  'trade-off',
-  'tradeoff',
-  'security',
-  'compare',
-  'why',
-  'reasoning',
-  'scalable',
-  'system design',
-];
-
-const LOW_COMPLEXITY_KEYWORDS = [
-  'rename',
-  'add field',
-  'change text',
-  'format',
-  'typo',
-  'update label',
-  'refactor name',
-];
-
-const REVIEW_KEYWORDS = ['review', 'code review', 'audit'];
-const DEBUG_KEYWORDS = ['debug', 'bug', 'stack trace', 'error', 'crash', 'retry', 'failed attempt', 'failure'];
-const CODING_HINTS = ['src/', 'package.json', 'function', 'class', 'implement', 'file', '.js', '.ts', '.tsx', '.jsx', '```'];
-
-function normalize(text) {
-  return String(text ?? '').toLowerCase();
-}
-
-function escapeRegExp(value) {
-  return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
-}
-
-function matchesKeyword(text, keyword) {
-  if (keyword.startsWith('.')) {
-    return new RegExp(`(?:^|[\\s/\\\\])[^\\s/\\\\]+${escapeRegExp(keyword)}(?:$|[\\s)\\],.;:])`).test(text);
-  }
-
-  if (keyword.includes(' ')) {
-    return new RegExp(`\\b${keyword.split(/\\s+/).map(escapeRegExp).join('\\\\s+')}\\b`).test(text);
-  }
-
-  return new RegExp(`\\b${escapeRegExp(keyword)}\\b`).test(text);
-}
-
-function countFileHints(text) {
-  const explicitCount = Number.parseInt(normalize(text).match(/\b(\d+)\s+files?\b/)?.[1] ?? '0', 10);
-  const pathMatches = normalize(text).match(/\b[\w./-]+\.(?:js|ts|tsx|jsx|json|md|yaml|yml)\b/g) ?? [];
-  return Math.max(explicitCount, new Set(pathMatches).size);
-}
-
-export function detectComplexity(message, context = '') {
-  const combined = normalize(`${message}\n${context}`);
-  const wordCount = combined.split(/\s+/).filter(Boolean).length;
-  const fileHints = countFileHints(combined);
-  const hasRetryPattern = /\b(retry|failed|failure|attempt)\b/.test(combined);
-  const highSignals = HIGH_COMPLEXITY_KEYWORDS.filter((keyword) => matchesKeyword(combined, keyword)).length;
-  const lowSignals = LOW_COMPLEXITY_KEYWORDS.filter((keyword) => matchesKeyword(combined, keyword)).length;
-
-  if (highSignals > 0 || fileHints > 5 || (hasRetryPattern && /\b(debug|error|crash|stack trace)\b/.test(combined))) {
-    return 'high';
-  }
-
-  if (lowSignals > 0 || (fileHints <= 1 && wordCount <= 24 && !hasRetryPattern)) {
-    return 'low';
-  }
-
-  return 'medium';
-}
-
-function detectTaskType(message, context = '', complexity = 'medium') {
-  const combined = normalize(`${message}\n${context}`);
-
-  if (DEBUG_KEYWORDS.some((keyword) => matchesKeyword(combined, keyword)) && complexity === 'high') {
-    return 'debug_hard';
-  }
-
-  if (HIGH_COMPLEXITY_KEYWORDS.some((keyword) => matchesKeyword(combined, keyword))) {
-    return 'reasoning';
-  }
-
-  if (REVIEW_KEYWORDS.some((keyword) => matchesKeyword(combined, keyword))) {
-    return 'review';
-  }
-
-  if (CODING_HINTS.some((keyword) => matchesKeyword(combined, keyword))) {
-    return 'coding';
-  }
-
-  return 'simple_chat';
-}
-
-function recommendTier(type, complexity) {
-  if (type === 'simple_chat' && complexity === 'low') {
-    return 'fast';
-  }
-
-  if (type === 'reasoning') {
-    return 'powerful';
-  }
-
-  if (type === 'debug_hard' && complexity === 'high') {
-    return 'powerful';
-  }
-
-  if (type === 'review') {
-    return complexity === 'high' ? 'powerful' : 'balanced';
-  }
-
-  if (type === 'coding') {
-    return complexity === 'high' ? 'powerful' : 'balanced';
-  }
-
-  return complexity === 'low' ? 'fast' : 'balanced';
-}
-
-function buildReason(type, complexity) {
-  if (type === 'simple_chat') {
-    return 'Short conversational request without strong coding or reasoning signals.';
-  }
-
-  if (type === 'debug_hard') {
-    return 'Debugging request includes repeated failures or stack-trace style signals.';
-  }
-
-  if (type === 'reasoning') {
-    return 'Request asks for architecture, comparison, trade-offs, or deeper analysis.';
-  }
-
-  if (type === 'review') {
-    return complexity === 'high'
-      ? 'Review request touches higher-risk or cross-cutting areas.'
-      : 'Review request is scoped enough for the balanced tier.';
-  }
-
-  if (type === 'coding') {
-    return complexity === 'high'
-      ? 'Implementation spans multiple modules or difficult trade-offs.'
-      : 'Normal implementation work is best handled by the balanced tier.';
-  }
-
-  return 'Fallback routing decision.';
-}
-
-export function classifyTask(userMessage, context = '') {
-  const complexity = detectComplexity(userMessage, context);
-  const type = detectTaskType(userMessage, context, complexity);
-  const recommendedTier = recommendTier(type, complexity);
-
-  return {
-    type,
-    complexity,
-    recommendedTier,
-    reason: buildReason(type, complexity),
-  };
-}
-
-export function selectModel(classification, config) {
-  const tier = classification?.recommendedTier ?? 'balanced';
-  if (config?.[tier]) {
-    return config[tier];
-  }
-
-  if (tier === 'powerful' && config?.advisorModel) {
-    return config.advisorModel;
-  }
-
-  if (tier === 'balanced' && config?.defaultModel) {
-    return config.defaultModel;
-  }
-
-  if (tier === 'fast' && config?.fast) {
-    return config.fast;
-  }
-
-  return config?.defaultModel ?? config?.balanced ?? config?.fast ?? config?.powerful ?? null;
-}

package/src/core/validation/confidence.js

@@ -1,89 +0,0 @@
-const HEDGING_WORDS = [
-  'maybe',
-  'might',
-  'i think',
-  'probably',
-  'possibly',
-  'could be',
-  'perhaps',
-  'có thể',
-  'chắc là',
-  'hình như',
-];
-
-const VERIFICATION_WORDS = [
-  'verified',
-  'tested',
-  'passes',
-  'passed',
-  'checked',
-  'confirmed',
-  'validated',
-  'đã test',
-  'đã kiểm tra',
-];
-
-function normalize(text) {
-  return String(text ?? '').toLowerCase();
-}
-
-function buildResult(score, factors) {
-  const clamped = Math.max(0, Math.min(100, Math.round(score)));
-  const level = clamped >= 80 ? 'high' : clamped >= 50 ? 'medium' : 'low';
-  const action = clamped >= 80 ? 'respond' : clamped >= 50 ? 'warn' : 'clarify';
-
-  return {
-    score: clamped,
-    level,
-    factors,
-    action,
-  };
-}
-
-export function scoreConfidence(output, taskType, context = '') {
-  const normalizedOutput = normalize(output);
-  const normalizedContext = normalize(context);
-  const factors = [];
-  let score = 50;
-
-  if (normalizedContext.trim().length >= 24) {
-    score += 15;
-    factors.push({ name: 'context_availability', impact: 'positive', reason: 'Enough task context is available.' });
-  } else {
-    score -= 20;
-    factors.push({ name: 'context_availability', impact: 'negative', reason: 'Very little context is available.' });
-  }
-
-  if (normalizedOutput.length >= 60 && !HEDGING_WORDS.some((word) => normalizedOutput.includes(word))) {
-    score += 15;
-    factors.push({ name: 'task_clarity', impact: 'positive', reason: 'Output is specific and direct.' });
-  } else if (normalizedOutput.length < 30) {
-    score -= 10;
-    factors.push({ name: 'task_clarity', impact: 'negative', reason: 'Output is too short to inspire confidence.' });
-  }
-
-  const hedges = HEDGING_WORDS.filter((word) => normalizedOutput.includes(word));
-  if (hedges.length > 0) {
-    score -= 30;
-    factors.push({ name: 'model_certainty', impact: 'negative', reason: `Hedging language detected: ${hedges.join(', ')}.` });
-  } else {
-    score += 10;
-    factors.push({ name: 'model_certainty', impact: 'positive', reason: 'Language is direct rather than hedged.' });
-  }
-
-  const verificationHits = VERIFICATION_WORDS.filter((word) => normalizedOutput.includes(word));
-  if (verificationHits.length > 0) {
-    score += 20;
-    factors.push({ name: 'verification', impact: 'positive', reason: `Verification signals found: ${verificationHits.join(', ')}.` });
-  } else if (taskType === 'coding' || taskType === 'debug' || taskType === 'debug_hard') {
-    score -= 10;
-    factors.push({ name: 'verification', impact: 'negative', reason: 'No verification evidence was provided for a technical task.' });
-  }
-
-  if (/\b(previous|existing|again|recall|memory)\b/.test(normalizedContext)) {
-    score += 5;
-    factors.push({ name: 'prior_knowledge', impact: 'positive', reason: 'Context suggests continuity with prior knowledge.' });
-  }
-
-  return buildResult(score, factors);
-}

package/src/core/validation/validator.js

@@ -1,165 +0,0 @@
-const REQUIREMENT_PREFIX = /^\s*(?:[-*•]|\d+[.)])\s+/;
-const STOPWORDS = new Set([
-  'the', 'a', 'an', 'and', 'or', 'to', 'for', 'of', 'with', 'in', 'on', 'is', 'are',
-  'be', 'this', 'that', 'it', 'as', 'by', 'run', 'add', 'use', 'please', 'giúp', 'hãy',
-  'và', 'là', 'cho', 'cần', 'một', 'những',
-]);
-
-function normalize(text) {
-  return String(text ?? '')
-    .toLowerCase()
-    .replace(/```[\w-]*\n?/g, ' ')
-    .replace(/```/g, ' ')
-    .replace(/[^\p{L}\p{N}\s]/gu, ' ')
-    .replace(/\s+/g, ' ')
-    .trim();
-}
-
-function unwrapCodeFence(output) {
-  const match = String(output ?? '').match(/```(?:[\w-]+)?\n([\s\S]*?)```/);
-  return match ? match[1].trim() : String(output ?? '').trim();
-}
-
-function tokenize(text) {
-  return normalize(text)
-    .split(/\s+/)
-    .filter((token) => token && !STOPWORDS.has(token) && token.length > 1);
-}
-
-function parseRequirements(spec) {
-  if (!spec) {
-    return [];
-  }
-
-  if (Array.isArray(spec?.requirements)) {
-    return spec.requirements.filter(Boolean);
-  }
-
-  if (typeof spec === 'string') {
-    const lines = spec.split('\n').map((line) => line.trim()).filter(Boolean);
-    const bulletLines = lines.filter((line) => REQUIREMENT_PREFIX.test(line));
-    if (bulletLines.length > 0) {
-      return bulletLines.map((line) => line.replace(REQUIREMENT_PREFIX, '').trim());
-    }
-
-    return lines.length > 0 ? [lines.join(' ')] : [];
-  }
-
-  return [];
-}
-
-function requirementCovered(requirement, output) {
-  const outputTokens = new Set(tokenize(output));
-  const requirementTokens = tokenize(requirement);
-  if (requirementTokens.length === 0) {
-    return true;
-  }
-
-  const matches = requirementTokens.filter((token) => outputTokens.has(token)).length;
-  const threshold = requirementTokens.length <= 2 ? requirementTokens.length : Math.max(2, Math.ceil(requirementTokens.length * 0.6));
-  return matches >= threshold;
-}
-
-function buildCompletenessCheck(output, spec) {
-  const requirements = parseRequirements(spec);
-  if (requirements.length === 0) {
-    return { name: 'completeness', passed: true };
-  }
-
-  const missing = requirements.filter((requirement) => !requirementCovered(requirement, output));
-  return {
-    name: 'completeness',
-    passed: missing.length === 0,
-    details: missing.length === 0 ? undefined : `Missing requirement coverage: ${missing.join('; ')}`,
-  };
-}
-
-function countListItems(output) {
-  return String(output ?? '')
-    .split('\n')
-    .filter((line) => /^\s*(?:[-*•]|\d+[.)])\s+/.test(line))
-    .length;
-}
-
-function buildConsistencyCheck(output) {
-  const text = String(output ?? '');
-  const numericClaim = text.match(/\b(\d+)\s+(?:steps?|items?|checks?|requirements?|bước|mục)\b/i);
-  if (!numericClaim) {
-    return { name: 'consistency', passed: true };
-  }
-
-  const expectedCount = Number.parseInt(numericClaim[1], 10);
-  const actualCount = countListItems(text);
-  const passed = actualCount === expectedCount;
-
-  return {
-    name: 'consistency',
-    passed,
-    details: passed ? undefined : `Declared ${expectedCount} items but found ${actualCount}.`,
-  };
-}
-
-function detectRequestedFormat(taskType, spec) {
-  if (typeof spec === 'object' && typeof spec?.format === 'string') {
-    return spec.format.toLowerCase();
-  }
-
-  const combined = `${taskType ?? ''}\n${typeof spec === 'string' ? spec : ''}`.toLowerCase();
-  if (combined.includes('json')) return 'json';
-  if (combined.includes('code')) return 'code';
-  if (combined.includes('list')) return 'list';
-  return 'text';
-}
-
-function buildFormatCheck(output, taskType, spec) {
-  const format = detectRequestedFormat(taskType, spec);
-  const raw = String(output ?? '').trim();
-
-  if (format === 'json') {
-    try {
-      JSON.parse(unwrapCodeFence(raw));
-      return { name: 'format', passed: true };
-    } catch (error) {
-      return { name: 'format', passed: false, details: `Invalid JSON output: ${error.message}` };
-    }
-  }
-
-  if (format === 'code') {
-    const passed = /```/.test(raw);
-    return {
-      name: 'format',
-      passed,
-      details: passed ? undefined : 'Expected a code block in the output.',
-    };
-  }
-
-  if (format === 'list') {
-    const passed = countListItems(raw) > 0;
-    return {
-      name: 'format',
-      passed,
-      details: passed ? undefined : 'Expected a list-style response.',
-    };
-  }
-
-  return { name: 'format', passed: true };
-}
-
-export function validateOutput(output, taskType, spec) {
-  const checks = [
-    buildCompletenessCheck(output, spec),
-    buildConsistencyCheck(output),
-    buildFormatCheck(output, taskType, spec),
-  ];
-
-  const failedChecks = checks.filter((check) => !check.passed);
-
-  return {
-    passed: failedChecks.length === 0,
-    checks,
-    shouldRetry: failedChecks.length > 0,
-    retryHint: failedChecks.length === 0
-      ? undefined
-      : `Previous output failed validation: ${failedChecks.map((check) => `${check.name}${check.details ? ` (${check.details})` : ''}`).join('; ')}`,
-  };
-}

package/templates/docs/INSTALL.md

@@ -1,115 +0,0 @@
-# Installation Guide
-
-## Team Rule
-
-**For this project, the only UKit command teammates should need to remember is `ukit install`.**
-
-After it runs, the normal workflow is:
-1. fill the docs baseline
-2. open the AI tool
-3. work in natural language
-
-Do not turn normal onboarding into a list of UKit subcommands.
-How the CLI binary itself gets installed or updated can stay a maintainer/platform concern; inside projects, the human-facing workflow still centers on `ukit install`.
-
----
-
-## Initial Installation
-
-### 1) Install the UKit CLI
-
-```bash
-npm install -g @ngockhoale/ukit
-```
-
-### 2) Install UKit into this project
-
-Run from the project root:
-
-```bash
-ukit install
-```
-
-This creates or refreshes the UKit workspace (`.claude/`, adapters, metadata, and `docs/`).
-
-It also provisions the shared runtime in `.ukit/storage/`, including:
-- memory state
-- prompt/output caches
-- compact history
-- threshold-based compact pressure tracking
-
-If the repo still has a legacy visible `ukit/` runtime from older installs, rerunning `ukit install` now migrates that shared runtime into hidden `.ukit/` when it is safe to do so.
-
-End users do not need to manage any of that manually.
-
-### 3) Fill in the docs baseline
-
-Complete these files before first serious use:
-- `docs/PROJECT.md`
-- `docs/MEMORY.md`
-- `docs/AI_HANDOFF/`
-- `docs/WORKLOG.md`
-
-### 4) Open your AI tool
-
-After install, give natural-language requests such as:
-- review this change
-- fix this bug
-- implement this feature
-- follow the existing pattern
-
-No slash command is required.
-Teammates also should not need to know skill names — Claude Code / Codex should auto-detect and use the right project-local skill from the prompt plus the files/tools involved.
-The workspace should also lean on indexed source code to find files/tests fast and prefer targeted verification before broad blanket checks.
-When long sessions grow large, the shared runtime should compact old safe-zone context automatically near its configured threshold without changing the human workflow.
-By default, the soft threshold comes from the configured compact token threshold and the hard threshold is about 20% above that; UKit should compact logs/history first while preserving the active task, rules, decisions, and current code focus.
-
----
-
-## Updating
-
-To refresh the workspace after UKit changes, rerun the same command:
-
-```bash
-ukit install
-```
-
-UKit is designed so first install and later refreshes use the same command.
-
----
-
-## Troubleshooting
-
-### `ukit` command not found
-
-```bash
-npm install -g @ngockhoale/ukit
-```
-
-### Workspace files seem stale
-
-```bash
-ukit install
-```
-
-### The AI lacks project context
-
-Check that the docs baseline files exist and are filled in:
-- `docs/PROJECT.md`
-- `docs/MEMORY.md`
-- `docs/AI_HANDOFF/`
-- `docs/WORKLOG.md`
-
----
-
-## Maintainer / Debug Note
-
-UKit may expose additional subcommands for maintainers and debugging. Upstream skill catalogs, GitHub skill repos, and awesome lists are also maintainer inputs — not the default team workflow.
-
-If maintainers pull ideas from official skill ecosystems or curated lists, they should package those improvements into UKit and have teammates rerun the same install command.
-
-Those sources should not become a new onboarding burden.
-
-When in doubt, keep the guidance simple:
-
-> rerun `ukit install`, then work in natural language inside the AI tool.