@nurix/nustack 0.23.22 → 0.23.23

package/dist/commands/gate.js

@@ -5,7 +5,7 @@ import { readDesktopSettings } from "../lib/desktop_settings.js";
 import { loadOutlineLibrary } from "../lib/gate/outline.js";
 import { isRedirectOn } from "../lib/gate/redirect.js";
 import { resolveProjectRoot } from "../lib/graph/projectRoot.js";
-import { resolveThreshold } from "../lib/gate/settings.js";
+import { resolveCoin, resolveThreshold } from "../lib/gate/settings.js";
 import { printJsonSuccess } from "../lib/json_output.js";
 import { readStoreVersion } from "../lib/local_store/database.js";
 export const GATE_HOOK_TIMEOUT_SECONDS = 10;
@@ -56,6 +56,7 @@ export async function readGateStatus() {
         isInSync: localReader ? isInstalled : isUninstalled,
         thresholdTokens,
         thresholdSource,
+        coin: resolveCoin().coin,
         outline: library !== null && typeof library.outlineSource === "function" ? "tree-sitter" : "fallback",
         storeVersion: await readStoreVersion(),
         redirect: isRedirectOn(resolveProjectRoot(process.env.CLAUDE_PROJECT_DIR, process.cwd())),
@@ -72,6 +73,7 @@ export async function runGateStatus(options) {
         `Read hook: ${onOff(status.installed.read)} · Bash hook: ${onOff(status.installed.bash)}`,
         `Local Reader switch: ${status.localReader ? "on" : "off"} (${status.isInSync ? "in sync with the hooks" : "out of sync with the hooks — run `nustack gate install` or `nustack gate remove`"})`,
         `Threshold: ${status.thresholdTokens} tokens (from ${status.thresholdSource})`,
+        ...(status.coin === null ? [] : [`Coin: rate ${status.coin.rate}, seed ${JSON.stringify(status.coin.seed)} — replaces the size test`]),
         `Outline: ${status.outline}`,
         `Local store version: ${status.storeVersion ?? "no store"}`,
         `Large-read redirect: ${status.redirect.isOn ? "on" : "off"} (from ${status.redirect.source})`,

package/dist/lib/gate/bashRead.js

@@ -199,3 +199,16 @@ export function assessBashRead(file, range, thresholdTokens, minimumThresholdTok
         return { decision: "pass", reason: "under-threshold", source: "read", estimatedTokens };
     return { decision: "gate", source: "read", estimatedTokens, thresholdTokens: threshold };
 }
+export function assessBashReadByCoin(file, range, isSelected, env = process.env) {
+    const size = regularFileSize(file);
+    if (size === null)
+        return { decision: "pass", reason: "not-a-file", source: "stat", estimatedTokens: null };
+    if (isSkippedExtension(file))
+        return { decision: "pass", reason: "skipped-extension", source: "stat", estimatedTokens: null };
+    if (hasLeadingNul(file))
+        return { decision: "pass", reason: "binary", source: "read", estimatedTokens: null };
+    const estimatedTokens = Math.min(tokensOfLength(printedBytes(file, size, range)), tokensOfLength(bashMaxOutputLength(env)));
+    if (!isSelected())
+        return { decision: "pass", reason: "coin-not-selected", source: "read", estimatedTokens };
+    return { decision: "gate", source: "read", estimatedTokens, thresholdTokens: null };
+}

package/dist/lib/gate/estimate.js

@@ -88,3 +88,17 @@ export function assessFullRead(file, thresholdTokens, minimumThresholdTokens) {
         return { decision: "pass", reason: "under-threshold", source: "read", estimatedTokens };
     return { decision: "gate", source: "read", estimatedTokens, thresholdTokens: threshold };
 }
+export function assessFullReadByCoin(file, isSelected) {
+    const size = regularFileSize(file);
+    if (size === null)
+        return { decision: "pass", reason: "not-a-file", source: "stat", estimatedTokens: null };
+    if (isSkippedExtension(file))
+        return { decision: "pass", reason: "skipped-extension", source: "stat", estimatedTokens: null };
+    const scan = readLeadingLines(file, READ_DEFAULT_LINE_LIMIT);
+    if (scan.isBinary)
+        return { decision: "pass", reason: "binary", source: "read", estimatedTokens: null };
+    const estimatedTokens = estimateReadTokens(scan);
+    if (!isSelected())
+        return { decision: "pass", reason: "coin-not-selected", source: "read", estimatedTokens };
+    return { decision: "gate", source: "read", estimatedTokens, thresholdTokens: null };
+}

package/dist/lib/gate/hook.js

@@ -2,6 +2,7 @@ import path from "node:path";
 import { performance } from "node:perf_hooks";
 import { classifyBashRead } from "./bashRead.js";
 import { GateInputError, gateBashCall, gateReadCall } from "./readGate.js";
+import { GATE_COIN_RATE_ENV, resolveCoin } from "./settings.js";
 const TTY_NOTICE = "nustack gate: hook entry point; reads Claude Code's PreToolUse JSON on stdin\n";
 async function readStdin(stdin) {
     const chunks = [];
@@ -113,11 +114,14 @@ export async function runGateHook(subcommand, io = { stdin: process.stdin, stdou
             return;
         }
         const call = parseCall(await readStdin(io.stdin), startedAt);
+        const { coin, rejected } = resolveCoin(io.env);
+        if (rejected !== null)
+            io.stderr.write(`nustack gate: GATE_COIN_RATE_INVALID: ${GATE_COIN_RATE_ENV}=${JSON.stringify(rejected)} is not a number in [0, 1]; the size test applies\n`);
         let answer;
         if (subcommand === "read")
-            answer = await gateReadCall(call, io.env);
+            answer = await gateReadCall(call, io.env, {}, coin);
         else if (subcommand === "bash")
-            answer = await gateBashCall(call, io.env);
+            answer = await gateBashCall(call, io.env, coin);
         else
             throw new GateInputError(`unknown hook "${subcommand}"`);
         if (answer.decision === "deny")

package/dist/lib/gate/readGate.js

@@ -2,10 +2,10 @@ import { randomUUID } from "node:crypto";
 import { closeSync, openSync, readFileSync, readSync, realpathSync } from "node:fs";
 import path from "node:path";
 import { performance } from "node:perf_hooks";
-import { assessBashRead, classifyBashRead } from "./bashRead.js";
-import { assessFullRead, readLeadingLines, regularFileSize, tokensOfLength } from "./estimate.js";
+import { assessBashRead, assessBashReadByCoin, classifyBashRead } from "./bashRead.js";
+import { assessFullRead, assessFullReadByCoin, readLeadingLines, regularFileSize, tokensOfLength } from "./estimate.js";
 import { assessRedirect, redirectHandler } from "./redirect.js";
-import { GATE_MIN_THRESHOLD_TOKENS, isGateOff, resolveThreshold } from "./settings.js";
+import { GATE_MIN_THRESHOLD_TOKENS, isCoinSelected, isGateOff, resolveCoin, resolveThreshold } from "./settings.js";
 export class GateInputError extends Error {
     code = "HOOK_INPUT_INVALID";
     constructor(message) {
@@ -27,7 +27,10 @@ function realPathOf(file) {
         return file;
     }
 }
-export async function gateReadCall(call, env = process.env, deps = {}) {
+function coinSelects(coin, call, resolved) {
+    return () => isCoinSelected(coin, call.sessionId, realPathOf(resolved));
+}
+export async function gateReadCall(call, env = process.env, deps = {}, coin = resolveCoin(env).coin) {
     if (isGateOff(env))
         return PASS;
     const filePath = call.toolInput.file_path;
@@ -37,13 +40,15 @@ export async function gateReadCall(call, env = process.env, deps = {}) {
         return PASS;
     const resolved = resolvePath(call.cwd, filePath);
     const redirect = await assessRedirect(resolved, call.cwd, env, deps);
-    const assessment = assessFullRead(resolved, () => resolveThreshold(env).thresholdTokens, GATE_MIN_THRESHOLD_TOKENS);
+    const assessment = coin === null
+        ? assessFullRead(resolved, () => resolveThreshold(env).thresholdTokens, GATE_MIN_THRESHOLD_TOKENS)
+        : assessFullReadByCoin(resolved, coinSelects(coin, call, resolved));
     if (assessment.decision === "gate" || !redirect.isRedirect)
         return answerAssessment(call, resolved, assessment, "read");
     const { LABEL_ROW_HANDLERS } = await import("../local_store/routing.js");
     return answerLargeRead(call, resolved, redirect.estimatedTokens, "read", redirectHandler(LABEL_ROW_HANDLERS));
 }
-export async function gateBashCall(call, env = process.env) {
+export async function gateBashCall(call, env = process.env, coin = resolveCoin(env).coin) {
     if (isGateOff(env))
         return PASS;
     const command = call.toolInput.command;
@@ -53,7 +58,9 @@ export async function gateBashCall(call, env = process.env) {
     if (read === null)
         return PASS;
     const resolved = resolvePath(call.cwd, read.path);
-    const assessment = assessBashRead(resolved, read.range, () => resolveThreshold(env).thresholdTokens, GATE_MIN_THRESHOLD_TOKENS, env);
+    const assessment = coin === null
+        ? assessBashRead(resolved, read.range, () => resolveThreshold(env).thresholdTokens, GATE_MIN_THRESHOLD_TOKENS, env)
+        : assessBashReadByCoin(resolved, read.range, coinSelects(coin, call, resolved), env);
     return answerAssessment(call, resolved, assessment, "bash");
 }
 async function answerAssessment(call, resolved, assessment, tool) {

package/dist/lib/gate/settings.js

@@ -1,3 +1,4 @@
+import { createHash } from "node:crypto";
 import { DIGEST_BUDGET_MS_MAX, DIGEST_BUDGET_MS_MIN, GATE_THRESHOLD_TOKENS_MAX, GATE_THRESHOLD_TOKENS_MIN, readDesktopSettings, } from "../desktop_settings.js";
 export const NUSTACK_GATE_ENV = "NUSTACK_GATE";
 export const NUSTACK_GATE_THRESHOLD_ENV = "NUSTACK_GATE_THRESHOLD_TOKENS";
@@ -45,3 +46,24 @@ export function resolveReadBulkBudget(flagBudgetMs, env = process.env, readSetti
         return { budgetMs: fromSettings, budgetSource: "settings" };
     return { budgetMs: null, budgetSource: "none" };
 }
+export const GATE_COIN_RATE_ENV = "NUSTACK_GATE_COIN_RATE";
+export const GATE_COIN_SEED_ENV = "NUSTACK_GATE_COIN_SEED";
+export const GATE_COIN_DEFAULT_SEED = "0";
+const COIN_RATE_PATTERN = /^(?:\d+(?:\.\d*)?|\.\d+)$/;
+export function resolveCoin(env = process.env) {
+    const text = env[GATE_COIN_RATE_ENV]?.trim();
+    if (text === undefined || text === "")
+        return { coin: null, rejected: null };
+    const rate = COIN_RATE_PATTERN.test(text) ? Number(text) : Number.NaN;
+    if (!(rate >= 0 && rate <= 1))
+        return { coin: null, rejected: text };
+    const seed = env[GATE_COIN_SEED_ENV];
+    return { coin: { rate, seed: seed === undefined || seed === "" ? GATE_COIN_DEFAULT_SEED : seed }, rejected: null };
+}
+export function coinDraw(seed, sessionId, realPath) {
+    const digest = createHash("sha256").update(`${seed}\0${sessionId}\0${realPath}`).digest("hex");
+    return Number.parseInt(digest.slice(0, 8), 16) / 2 ** 32;
+}
+export function isCoinSelected(coin, sessionId, realPath) {
+    return coinDraw(coin.seed, sessionId, realPath) < coin.rate;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.23.22",
+  "version": "0.23.23",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,