@oscharko-dev/keiko 0.1.6 → 0.1.7

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/evidence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"evidence.d.ts","sourceRoot":"","sources":["../../../../src/evidence.ts"],"names":[],"mappings":"AAWA,OAAO,EAKL,KAAK,cAAc,EAGpB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAAmB,KAAK,SAAS,EAAiB,MAAM,6BAA6B,CAAC;AAC7F,OAAO,EAAoB,KAAK,SAAS,EAAE,MAAM,mCAAmC,CAAC;AACrF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,WAAW,CAAC;AAC7C,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAChD,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAE3C,KAAK,cAAc,GAAG,OAAO,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;AAEpD,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC;IAC9B,QAAQ,CAAC,GAAG,EAAE,SAAS,CAAC;IACxB,QAAQ,CAAC,iBAAiB,CAAC,EAAE,SAAS,MAAM,EAAE,GAAG,SAAS,CAAC;CAC5D;AAID,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,cAAc,CAAC;IAChC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC7C;AAUD,wBAAgB,uBAAuB,CACrC,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,OAAO,EACf,MAAM,EAAE,SAAS,WAAW,EAAE,EAC9B,GAAG,EAAE,sBAAsB,GAC1B,cAAc,CAgBhB;AAKD,wBAAgB,sBAAsB,CACpC,QAAQ,EAAE,WAAW,EACrB,MAAM,EAAE,SAAS,EACjB,GAAG,EAAE,sBAAsB,GAC1B,cAAc,CAMhB;AAYD,wBAAgB,qBAAqB,CACnC,QAAQ,EAAE,WAAW,EACrB,GAAG,EAAE,sBAAsB,GAC1B,cAAc,CAMhB"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/evidence.js

@@ -0,0 +1,143 @@
+// Evidence persistence for UI-initiated runs (ADR-0011 AC5; #10 audit public API only). The Wave 2
+// BFF never persisted evidence, so UI runs (including cancellations) never reached the evidence
+// browser. This module folds a terminated run into a redacted EvidenceManifest and writes it through
+// the #10 EvidenceStore, composing the audit layer's PUBLIC API UNCHANGED (no frozen-core edit).
+//
+// The WORKFLOW manifest mapping now lives in the shared audit module `workflow-evidence.ts` (ADR-0012
+// C2), so the evaluation harness and this BFF build it from one implementation. This module keeps the
+// EXPLAIN-PLAN harness path (whose `usage` shape differs) local, and adapts the UI RunKind/RunStatus
+// to the shared module's narrow workflow types. Persistence errors surface to the run engine so the
+// final registry payload cannot silently omit required evidence.
+import { buildEvidenceReport, createAuditRedactor, EVIDENCE_SCHEMA_VERSION, persistWorkflowEvidence as persistWorkflowEvidenceCore, } from "@oscharko-dev/keiko-evidence";
+import { deepRedactStrings } from "@oscharko-dev/keiko-evidence";
+import { HARNESS_VERSION } from "@oscharko-dev/keiko-harness";
+import { resolveCostClass } from "@oscharko-dev/keiko-model-gateway";
+// Only the two model-driven workflow kinds map to the shared audit core; explain-plan and verify
+// follow their own manifest paths (different usage shape / no usage at all).
+function toWorkflowKind(kind) {
+    return kind === "bug-investigation" ? "bug-investigation" : "unit-tests";
+}
+// Persists a terminated WORKFLOW run (unit-tests / bug-investigation) via the shared audit core. The
+// report is the workflow's own typed report; only counts/summaries are folded in (never the raw diff).
+export function persistWorkflowEvidence(identity, report, events, ctx) {
+    return persistWorkflowEvidenceCore({
+        runId: identity.runId,
+        fingerprint: identity.fingerprint,
+        modelId: identity.modelId,
+        kind: toWorkflowKind(identity.kind),
+        status: identity.status,
+        startedAt: identity.startedAt,
+        finishedAt: identity.finishedAt,
+        ...(identity.workspaceRoot === undefined ? {} : { workspaceRoot: identity.workspaceRoot }),
+    }, report, events, { ...ctx, costClassResolver: resolveCostClass });
+}
+// Persists a terminated EXPLAIN-PLAN harness run. The RunResult carries the raw harness events whose
+// `usage` shape the audit fold understands; the usage is folded directly so the explain path keeps a
+// single manifest-build path independent of the shared workflow core (which folds top-level fields).
+export function persistExplainEvidence(identity, result, ctx) {
+    const manifest = buildExplainManifest(identity, result);
+    const redactor = createAuditRedactor({ additionalSecrets: ctx.additionalSecrets ?? [] }, ctx.env);
+    const redacted = deepRedactStrings(manifest, redactor);
+    const location = ctx.store.put(redacted.run.runId, JSON.stringify(redacted));
+    return buildEvidenceReport(redacted, location);
+}
+const KIND_TO_TASK_TYPE = {
+    "unit-tests": "generate-unit-tests",
+    "bug-investigation": "investigate-bug",
+    "explain-plan": "explain-plan",
+    verify: "verify",
+};
+// Persists a terminated VERIFY run. Verify never calls a model, so usageTotals are all zero and
+// stateTransitions/toolCalls/commandExecutions stay empty (the verification orchestrator's own
+// audit summarisation lives in `src/verification/summary.ts` and is out of scope for this leaf).
+export function persistVerifyEvidence(identity, ctx) {
+    const manifest = buildVerifyManifest(identity);
+    const redactor = createAuditRedactor({ additionalSecrets: ctx.additionalSecrets ?? [] }, ctx.env);
+    const redacted = deepRedactStrings(manifest, redactor);
+    const location = ctx.store.put(redacted.run.runId, JSON.stringify(redacted));
+    return buildEvidenceReport(redacted, location);
+}
+function buildVerifyManifest(identity) {
+    const context = identity.workspaceRoot === undefined
+        ? undefined
+        : {
+            workspaceRoot: identity.workspaceRoot,
+            totalCandidates: 0,
+            usedBytes: 0,
+            budgetBytes: 0,
+            droppedForBudget: 0,
+            entries: [],
+        };
+    return {
+        evidenceSchemaVersion: EVIDENCE_SCHEMA_VERSION,
+        run: {
+            runId: identity.runId,
+            fingerprint: identity.fingerprint,
+            harnessVersion: HARNESS_VERSION,
+            taskType: KIND_TO_TASK_TYPE[identity.kind],
+            outcome: identity.status,
+            startedAt: identity.startedAt,
+            finishedAt: identity.finishedAt,
+            durationMs: Math.max(0, identity.finishedAt - identity.startedAt),
+        },
+        model: { modelId: identity.modelId, costClass: resolveCostClass(identity.modelId) },
+        usageTotals: { promptTokens: 0, completionTokens: 0, requestCount: 0, totalLatencyMs: 0 },
+        ...(context === undefined ? {} : { context }),
+        stateTransitions: [],
+        toolCalls: [],
+        commandExecutions: [],
+        verification: undefined,
+        patch: undefined,
+        failure: undefined,
+    };
+}
+function buildExplainManifest(identity, result) {
+    const context = identity.workspaceRoot === undefined
+        ? undefined
+        : {
+            workspaceRoot: identity.workspaceRoot,
+            totalCandidates: 0,
+            usedBytes: 0,
+            budgetBytes: 0,
+            droppedForBudget: 0,
+            entries: [],
+        };
+    return {
+        evidenceSchemaVersion: EVIDENCE_SCHEMA_VERSION,
+        run: {
+            runId: identity.runId,
+            fingerprint: identity.fingerprint,
+            harnessVersion: HARNESS_VERSION,
+            taskType: KIND_TO_TASK_TYPE[identity.kind],
+            outcome: identity.status,
+            startedAt: identity.startedAt,
+            finishedAt: identity.finishedAt,
+            durationMs: Math.max(0, identity.finishedAt - identity.startedAt),
+        },
+        model: { modelId: identity.modelId, costClass: resolveCostClass(identity.modelId) },
+        usageTotals: foldHarnessUsage(result.events),
+        ...(context === undefined ? {} : { context }),
+        stateTransitions: [],
+        toolCalls: [],
+        commandExecutions: [],
+        verification: undefined,
+        patch: undefined,
+        failure: undefined,
+    };
+}
+function foldHarnessUsage(events) {
+    let promptTokens = 0;
+    let completionTokens = 0;
+    let requestCount = 0;
+    let totalLatencyMs = 0;
+    for (const event of events) {
+        if (event.type !== "model:call:completed") {
+            continue;
+        }
+        promptTokens += event.usage.promptTokens;
+        completionTokens += event.usage.completionTokens;
+        totalLatencyMs += event.usage.latencyMs;
+        requestCount += 1;
+    }
+    return { promptTokens, completionTokens, requestCount, totalLatencyMs };
+}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/files-deny.d.ts

@@ -0,0 +1,3 @@
+export declare const DENIED_MESSAGE = "The requested path is excluded from the read surface.";
+export declare function pathIsDenied(relativePath: string): boolean;
+//# sourceMappingURL=files-deny.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/files-deny.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files-deny.d.ts","sourceRoot":"","sources":["../../../../src/files-deny.ts"],"names":[],"mappings":"AAUA,eAAO,MAAM,cAAc,0DAA0D,CAAC;AAEtF,wBAAgB,YAAY,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAE1D"}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/files-deny.js

@@ -0,0 +1,12 @@
+// Deny-list wiring for the Files BFF (`/api/files/*`). Reuses
+// `src/workspace/ignore.ts` unchanged: `isDenied` is the always-on security
+// gate that filters secret/dep/build/vcs/log entries from both tree listings
+// and previews. See ADR-0016.
+import { isDenied } from "@oscharko-dev/keiko-workspace";
+// Generic, non-leaking deny message. NEVER include the requested path or the
+// matched pattern: the deny list is treated as a server-side safety invariant
+// the client must not be able to probe.
+export const DENIED_MESSAGE = "The requested path is excluded from the read surface.";
+export function pathIsDenied(relativePath) {
+    return isDenied(relativePath);
+}

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/files.d.ts

@@ -0,0 +1,66 @@
+import { type RouteContext, type RouteResult } from "./routes.js";
+import type { UiHandlerDeps } from "./deps.js";
+import type { UiStore } from "./store/index.js";
+export interface FilesDirectoryRoot {
+    readonly label: string;
+    readonly path: string;
+}
+export interface FilesDirectoryEntry {
+    readonly name: string;
+    readonly path: string;
+}
+export interface FilesDirectoryListing {
+    readonly path: string;
+    readonly parent: string | null;
+    readonly entries: readonly FilesDirectoryEntry[];
+    readonly roots: readonly FilesDirectoryRoot[];
+}
+export type FilesEntryKind = "directory" | "file" | "symlink";
+export interface FilesTreeEntry {
+    readonly name: string;
+    readonly path: string;
+    readonly kind: FilesEntryKind;
+    readonly sizeBytes: number;
+    readonly modifiedAt: number;
+    readonly extension: string | null;
+    readonly symlink: boolean;
+    readonly readable: boolean;
+}
+export interface FilesTreeResponse {
+    readonly root: string;
+    readonly path: string;
+    readonly entries: readonly FilesTreeEntry[];
+    readonly truncated: boolean;
+}
+interface FilesPreviewBase {
+    readonly root: string;
+    readonly path: string;
+    readonly name: string;
+    readonly sizeBytes: number;
+    readonly modifiedAt: number;
+    readonly extension: string | null;
+    readonly mime: string;
+    readonly symlink: boolean;
+}
+export type FilesPreviewResponse = (FilesPreviewBase & {
+    readonly kind: "text";
+    readonly content: string;
+    readonly truncated: boolean;
+    readonly maxBytes: number;
+}) | (FilesPreviewBase & {
+    readonly kind: "image";
+    readonly dataUrl: string;
+    readonly maxBytes: number;
+}) | (FilesPreviewBase & {
+    readonly kind: "binary";
+    readonly reason: "unsupported" | "too_large";
+    readonly maxBytes?: number | undefined;
+});
+export declare function listFilesDirectories(store: UiStore, rootInput: string | null, pathInput?: string): Promise<FilesDirectoryListing>;
+export declare function readFilesTree(store: UiStore, rootInput: string | null, pathInput: string | null): Promise<FilesTreeResponse>;
+export declare function readFilesPreview(store: UiStore, rootInput: string | null, pathInput: string | null, redactor: UiHandlerDeps["redactor"]): Promise<FilesPreviewResponse>;
+export declare function handleFilesDirectories(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleFilesTree(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export declare function handleFilesPreview(ctx: RouteContext, deps: UiHandlerDeps): Promise<RouteResult>;
+export {};
+//# sourceMappingURL=files.d.ts.map

package/node_modules/@oscharko-dev/keiko-server/dist/packages/keiko-server/src/files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"files.d.ts","sourceRoot":"","sources":["../../../../src/files.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAa,KAAK,YAAY,EAAE,KAAK,WAAW,EAAE,MAAM,aAAa,CAAC;AAC7E,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,KAAK,EAAW,OAAO,EAAE,MAAM,kBAAkB,CAAC;AAOzD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,QAAQ,CAAC,KAAK,EAAE,SAAS,kBAAkB,EAAE,CAAC;CAC/C;AAED,MAAM,MAAM,cAAc,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,CAAC;AAE9D,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,SAAS,cAAc,EAAE,CAAC;IAC5C,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;CAC7B;AAED,UAAU,gBAAgB;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,MAAM,MAAM,oBAAoB,GAC5B,CAAC,gBAAgB,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC,GACF,CAAC,gBAAgB,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC,GACF,CAAC,gBAAgB,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;IAC7C,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC,CAAC;AA4NP,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,qBAAqB,CAAC,CAQhC;AAiID,wBAAsB,aAAa,CACjC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAAG,IAAI,GACvB,OAAO,CAAC,iBAAiB,CAAC,CAqB5B;AAiJD,wBAAsB,gBAAgB,CACpC,KAAK,EAAE,OAAO,EACd,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,QAAQ,EAAE,aAAa,CAAC,UAAU,CAAC,GAClC,OAAO,CAAC,oBAAoB,CAAC,CAY/B;AAED,wBAAsB,sBAAsB,CAC1C,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAStB;AAED,wBAAsB,eAAe,CACnC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAStB;AAED,wBAAsB,kBAAkB,CACtC,GAAG,EAAE,YAAY,EACjB,IAAI,EAAE,aAAa,GAClB,OAAO,CAAC,WAAW,CAAC,CAUtB"}