@ouro.bot/cli 0.1.0-alpha.18 → 0.1.0-alpha.181

package/dist/repertoire/coding/tools.js

@@ -1,8 +1,13 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.codingToolDefinitions = void 0;
+exports.countFilesInSessionOutput = countFilesInSessionOutput;
 const index_1 = require("./index");
+const context_pack_1 = require("./context-pack");
+const identity_1 = require("../../heart/identity");
+const obligations_1 = require("../../heart/obligations");
 const runtime_1 = require("../../nerves/runtime");
+const scrutiny_1 = require("../../mind/scrutiny");
 const RUNNERS = ["claude", "codex"];
 function requireArg(args, key) {
     const value = args[key];
@@ -29,11 +34,112 @@ function emitCodingToolEvent(toolName) {
         meta: { toolName },
     });
 }
+/**
+ * Count distinct file paths mentioned in a coding session's stdout output.
+ * Looks for path-like tokens (containing / and a file extension).
+ * Returns the count of unique paths found.
+ */
+function countFilesInSessionOutput(session) {
+    const text = `${session.stdoutTail}\n${session.stderrTail}`;
+    // Match path-like tokens: contain at least one / and a file extension
+    const pathPattern = /(?:^|\s)((?:\/|\.\/|\.\.\/)?(?:[\w.@-]+\/)+[\w.-]+\.[\w]+)/gm;
+    const paths = new Set();
+    let match;
+    while ((match = pathPattern.exec(text)) !== null) {
+        paths.add(match[1]);
+    }
+    return paths.size;
+}
+/**
+ * If a coding session is completed, append scrutiny to the result.
+ * Returns the original result with scrutiny appended, or unchanged if
+ * the session is not completed or has no file changes.
+ */
+function appendCompletionScrutiny(result, session) {
+    if (session.status !== "completed")
+        return result;
+    const fileCount = countFilesInSessionOutput(session);
+    const scrutiny = (0, scrutiny_1.getCodingCompletionScrutiny)(fileCount);
+    return scrutiny ? `${result}\n\n${scrutiny}` : result;
+}
+function sameOriginSession(left, right) {
+    if (!left && !right)
+        return true;
+    if (!left || !right)
+        return false;
+    return left.friendId === right.friendId && left.channel === right.channel && left.key === right.key;
+}
+function matchesReusableCodingSession(session, request) {
+    if (session.status !== "spawning" && session.status !== "running" && session.status !== "waiting_input" && session.status !== "stalled") {
+        return false;
+    }
+    const scopeMatches = request.scopeFile ? session.scopeFile === request.scopeFile : true;
+    const stateMatches = request.stateFile ? session.stateFile === request.stateFile : true;
+    return (session.runner === request.runner &&
+        session.workdir === request.workdir &&
+        session.taskRef === request.taskRef &&
+        scopeMatches &&
+        stateMatches &&
+        session.obligationId === request.obligationId &&
+        sameOriginSession(request.originSession, session.originSession));
+}
+function latestSessionFirst(left, right) {
+    const lastActivityDelta = Date.parse(right.lastActivityAt) - Date.parse(left.lastActivityAt);
+    if (lastActivityDelta !== 0)
+        return lastActivityDelta;
+    return right.id.localeCompare(left.id);
+}
+function findReusableCodingSession(sessions, request) {
+    const matches = sessions.filter((session) => matchesReusableCodingSession(session, request)).sort(latestSessionFirst);
+    return matches[0] ?? null;
+}
+function isLiveCodingStatus(status) {
+    return status === "spawning" || status === "running" || status === "waiting_input" || status === "stalled";
+}
+function rankCodingStatusSession(session, currentSession) {
+    return sameOriginSession({
+        friendId: currentSession.friendId,
+        channel: currentSession.channel,
+        key: currentSession.key,
+    }, session.originSession)
+        ? 0
+        : 1;
+}
+function selectCodingStatusSessions(sessions, currentSession) {
+    if (sessions.length === 0)
+        return [];
+    if (!currentSession) {
+        return sessions;
+    }
+    const activeSessions = sessions.filter((session) => isLiveCodingStatus(session.status)).sort(latestSessionFirst);
+    if (activeSessions.length > 0) {
+        return activeSessions.sort((left, right) => {
+            const rankDelta = rankCodingStatusSession(left, currentSession) - rankCodingStatusSession(right, currentSession);
+            if (rankDelta !== 0)
+                return rankDelta;
+            return latestSessionFirst(left, right);
+        });
+    }
+    const matchingClosedSessions = sessions
+        .filter((session) => sameOriginSession({
+        friendId: currentSession.friendId,
+        channel: currentSession.channel,
+        key: currentSession.key,
+    }, session.originSession))
+        .sort(latestSessionFirst);
+    if (matchingClosedSessions.length > 0) {
+        return matchingClosedSessions;
+    }
+    return [...sessions].sort(latestSessionFirst);
+}
+function buildCodingObligationContent(taskRef) {
+    return `finish ${taskRef} and bring the result back`;
+}
 const codingSpawnTool = {
     type: "function",
     function: {
         name: "coding_spawn",
-        description: "spawn a coding session using claude/codex and explicit task-threaded guidance",
+        description: "Spawn a coding session using claude or codex with task-threaded guidance. The coding session runs as a separate process with its own context. Give it a COMPLETE, SELF-CONTAINED task description -- it cannot see this conversation, doesn't know what you've tried, doesn't understand the broader context. Include: what to do, why, what files are involved, what 'done' looks like. Never delegate understanding -- don't write 'based on the conversation, fix the bug.' Write the specific file paths, line numbers, and what to change. Include any required verification steps or tests in the task description so the coding session knows how to prove the work is done.",
         parameters: {
             type: "object",
             properties: {
@@ -52,7 +158,7 @@ const codingStatusTool = {
     type: "function",
     function: {
         name: "coding_status",
-        description: "inspect coding sessions; omit sessionId to list all active/known sessions",
+        description: "Inspect coding sessions. Omit sessionId to list all active/known sessions with their status. Use this to check progress before asking the human for a status update.",
         parameters: {
             type: "object",
             properties: {
@@ -65,7 +171,7 @@ const codingTailTool = {
     type: "function",
     function: {
         name: "coding_tail",
-        description: "show recent stdout/stderr tail for a coding session in a readable format",
+        description: "Show recent stdout/stderr output from a coding session. Use this to understand what the session is doing or why it might be stuck. Read the actual output before reporting status -- don't guess.",
         parameters: {
             type: "object",
             properties: {
@@ -130,6 +236,17 @@ exports.codingToolDefinitions = [
                 prompt,
                 taskRef,
             };
+            if (ctx?.currentSession && ctx.currentSession.channel !== "inner") {
+                request.originSession = {
+                    friendId: ctx.currentSession.friendId,
+                    channel: ctx.currentSession.channel,
+                    key: ctx.currentSession.key,
+                };
+                const obligation = (0, obligations_1.findPendingObligationForOrigin)((0, identity_1.getAgentRoot)(), request.originSession);
+                if (obligation) {
+                    request.obligationId = obligation.id;
+                }
+            }
             const scopeFile = optionalArg(args, "scopeFile");
             if (scopeFile)
                 request.scopeFile = scopeFile;
@@ -137,7 +254,48 @@ exports.codingToolDefinitions = [
             if (stateFile)
                 request.stateFile = stateFile;
             const manager = (0, index_1.getCodingSessionManager)();
+            const existingSessions = manager.listSessions();
+            const existingSession = findReusableCodingSession(existingSessions, request);
+            if (existingSession) {
+                (0, runtime_1.emitNervesEvent)({
+                    component: "repertoire",
+                    event: "repertoire.coding_session_reused",
+                    message: "reused active coding session",
+                    meta: { id: existingSession.id, runner: existingSession.runner, taskRef: existingSession.taskRef },
+                });
+                if (ctx?.codingFeedback) {
+                    (0, index_1.attachCodingSessionFeedback)(manager, existingSession, ctx.codingFeedback);
+                }
+                return JSON.stringify({ ...existingSession, reused: true });
+            }
+            if (request.originSession && !request.obligationId) {
+                const created = (0, obligations_1.createObligation)((0, identity_1.getAgentRoot)(), {
+                    origin: request.originSession,
+                    content: buildCodingObligationContent(taskRef),
+                });
+                request.obligationId = created.id;
+            }
+            if (!request.scopeFile || !request.stateFile) {
+                const generated = (0, context_pack_1.prepareCodingContextPack)({
+                    request: { ...request },
+                    existingSessions,
+                    activeWorkFrame: ctx?.activeWorkFrame,
+                });
+                if (!request.scopeFile)
+                    request.scopeFile = generated.scopeFile;
+                if (!request.stateFile)
+                    request.stateFile = generated.stateFile;
+            }
             const session = await manager.spawnSession(request);
+            if (session.obligationId) {
+                (0, obligations_1.advanceObligation)((0, identity_1.getAgentRoot)(), session.obligationId, {
+                    status: "investigating",
+                    currentSurface: { kind: "coding", label: `${session.runner} ${session.id}` },
+                    latestNote: session.originSession
+                        ? `coding session started for ${session.originSession.channel}/${session.originSession.key}`
+                        : "coding session started",
+                });
+            }
             if (args.runner === "codex" && args.taskRef) {
                 (0, runtime_1.emitNervesEvent)({
                     component: "repertoire",
@@ -151,21 +309,23 @@ exports.codingToolDefinitions = [
             }
             return JSON.stringify(session);
         },
+        summaryKeys: ["runner", "workdir", "taskRef"],
     },
     {
         tool: codingStatusTool,
-        handler: (args) => {
+        handler: (args, ctx) => {
             emitCodingToolEvent("coding_status");
             const manager = (0, index_1.getCodingSessionManager)();
             const sessionId = requireArg(args, "sessionId");
             if (!sessionId) {
-                return JSON.stringify(manager.listSessions());
+                return JSON.stringify(selectCodingStatusSessions(manager.listSessions(), ctx?.currentSession));
             }
             const session = manager.getSession(sessionId);
             if (!session)
                 return `session not found: ${sessionId}`;
-            return JSON.stringify(session);
+            return appendCompletionScrutiny(JSON.stringify(session), session);
         },
+        summaryKeys: ["sessionId"],
     },
     {
         tool: codingTailTool,
@@ -177,8 +337,9 @@ exports.codingToolDefinitions = [
             const session = (0, index_1.getCodingSessionManager)().getSession(sessionId);
             if (!session)
                 return `session not found: ${sessionId}`;
-            return (0, index_1.formatCodingTail)(session);
+            return appendCompletionScrutiny((0, index_1.formatCodingTail)(session), session);
         },
+        summaryKeys: ["sessionId"],
     },
     {
         tool: codingSendInputTool,
@@ -192,6 +353,7 @@ exports.codingToolDefinitions = [
                 return "input is required";
             return JSON.stringify((0, index_1.getCodingSessionManager)().sendInput(sessionId, input));
         },
+        summaryKeys: ["sessionId", "input"],
     },
     {
         tool: codingKillTool,
@@ -202,5 +364,6 @@ exports.codingToolDefinitions = [
                 return "sessionId is required";
             return JSON.stringify((0, index_1.getCodingSessionManager)().killSession(sessionId));
         },
+        summaryKeys: ["sessionId"],
     },
 ];

package/dist/repertoire/guardrails.js

@@ -0,0 +1,291 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.OURO_CLI_TRUST_MANIFEST = void 0;
+exports.guardInvocation = guardInvocation;
+const fs = __importStar(require("node:fs"));
+const os = __importStar(require("node:os"));
+const types_1 = require("../mind/friends/types");
+const runtime_1 = require("../nerves/runtime");
+const deny = (reason) => ({ allowed: false, reason });
+const allow = { allowed: true };
+// --- reason templates ---
+// Structural reasons (always-on, apply to everyone)
+const REASONS = {
+    readBeforeEdit: "i need to read that file first before i can edit it.",
+    readBeforeOverwrite: "i need to read that file first before i can overwrite it.",
+    protectedPath: "that path is protected — i can read it but not modify it.",
+    destructiveCommand: "that command is too dangerous to run — it could cause irreversible damage.",
+    // Trust reasons (vary by relationship)
+    needsTrust: "i'd need a closer friend to vouch for you before i can do that.",
+    needsTrustForWrite: "i'd need a closer friend to vouch for you before i can write files outside my home.",
+};
+// --- read-only tools that never need guardrails ---
+const READ_ONLY_TOOLS = new Set(["read_file", "glob", "grep"]);
+// --- protected path detection ---
+const PROTECTED_PATH_SEGMENTS = [".git/"];
+function getProtectedAbsolutePrefixes() {
+    return [`${os.homedir()}/.agentsecrets/`];
+}
+function isProtectedPath(filePath) {
+    for (const segment of PROTECTED_PATH_SEGMENTS) {
+        if (filePath.includes(`/${segment}`) || filePath.startsWith(segment))
+            return true;
+    }
+    for (const prefix of getProtectedAbsolutePrefixes()) {
+        if (filePath.startsWith(prefix))
+            return true;
+    }
+    return false;
+}
+// --- destructive shell patterns ---
+const DESTRUCTIVE_PATTERNS = [
+    /\brm\s+(-\w*\s+)*-\w*r\w*\s+(-\w+\s+)*[/~]/, // rm -rf / or rm -rf ~
+    /\bchmod\s+(-\w*\s+)*-\w*R\w*\s+\d+\s+\//, // chmod -R 777 /
+    /\bmkfs\b/, // mkfs.*
+    /\bdd\s+if=/, // dd if=
+];
+function isDestructiveShellCommand(command) {
+    return DESTRUCTIVE_PATTERNS.some((p) => p.test(command));
+}
+// --- compound command splitting ---
+// Shell operators that chain commands: &&, ||, ;, |, $(), backticks
+const COMPOUND_SEPARATORS = /\s*(?:&&|\|\||;|\|)\s*/;
+const SUBSHELL_PATTERN = /\$\(|`/;
+function splitShellCommands(command) {
+    if (SUBSHELL_PATTERN.test(command))
+        return [command];
+    return command.split(COMPOUND_SEPARATORS).filter(Boolean);
+}
+// --- shell commands that write to protected paths ---
+function shellWritesToProtectedPath(command) {
+    const redirectMatch = command.match(/>\s*(\S+)/);
+    if (redirectMatch && isProtectedPath(redirectMatch[1]))
+        return true;
+    const teeMatch = command.match(/tee\s+(?:-\w+\s+)*(\S+)/);
+    if (teeMatch && isProtectedPath(teeMatch[1]))
+        return true;
+    return false;
+}
+// --- structural guardrail checks (always on, all trust levels) ---
+function checkReadBeforeWrite(toolName, args, context) {
+    if (toolName === "edit_file") {
+        const filePath = args.path || "";
+        if (!context.readPaths.has(filePath))
+            return deny(REASONS.readBeforeEdit);
+    }
+    if (toolName === "write_file") {
+        const filePath = args.path || "";
+        if (context.readPaths.has(filePath))
+            return allow;
+        if (!fs.existsSync(filePath))
+            return allow;
+        return deny(REASONS.readBeforeOverwrite);
+    }
+    return allow;
+}
+function checkDestructiveShellPatterns(toolName, args) {
+    if (toolName !== "shell")
+        return allow;
+    const command = args.command || "";
+    // Check each subcommand in compound commands for destructive patterns
+    for (const sub of splitShellCommands(command)) {
+        if (isDestructiveShellCommand(sub))
+            return deny(REASONS.destructiveCommand);
+    }
+    return allow;
+}
+function checkProtectedPaths(toolName, args) {
+    if (toolName === "write_file" || toolName === "edit_file") {
+        const filePath = args.path || "";
+        if (isProtectedPath(filePath))
+            return deny(REASONS.protectedPath);
+    }
+    if (toolName === "shell") {
+        const command = args.command || "";
+        if (shellWritesToProtectedPath(command))
+            return deny(REASONS.protectedPath);
+    }
+    return allow;
+}
+function checkStructuralGuardrails(toolName, args, context) {
+    const protectedResult = checkProtectedPaths(toolName, args);
+    if (!protectedResult.allowed)
+        return protectedResult;
+    const destructiveResult = checkDestructiveShellPatterns(toolName, args);
+    if (!destructiveResult.allowed)
+        return destructiveResult;
+    return checkReadBeforeWrite(toolName, args, context);
+}
+// --- ouro CLI trust manifest ---
+/** Minimum trust level required for each ouro CLI subcommand. */
+exports.OURO_CLI_TRUST_MANIFEST = {
+    whoami: "acquaintance",
+    changelog: "acquaintance",
+    "session list": "acquaintance",
+    "task board": "friend",
+    "task create": "friend",
+    "task update": "friend",
+    "task show": "friend",
+    "task actionable": "friend",
+    "task deps": "friend",
+    "task sessions": "friend",
+    "task fix": "friend",
+    "friend list": "friend",
+    "friend show": "friend",
+    "friend create": "friend",
+    "friend update": "family",
+    "reminder create": "friend",
+    "config model": "friend",
+    "config models": "friend",
+    "mcp list": "acquaintance",
+    "mcp call": "friend",
+    auth: "family",
+    "auth verify": "family",
+    "auth switch": "family",
+    rollback: "family",
+    versions: "acquaintance",
+};
+// --- trust level comparison ---
+const LEVEL_ORDER = {
+    stranger: 0,
+    acquaintance: 1,
+    friend: 2,
+    family: 3,
+};
+function trustLevelSatisfied(required, actual) {
+    return LEVEL_ORDER[actual] >= LEVEL_ORDER[required];
+}
+// --- general CLI allowlists for acquaintance ---
+const ACQUAINTANCE_SHELL_ALLOWLIST = new Set([
+    "cat", "ls", "head", "tail", "wc", "file", "stat", "which", "echo",
+    "pwd", "env", "printenv", "whoami", "date", "uname",
+]);
+const ACQUAINTANCE_GIT_ALLOWLIST = new Set([
+    "status", "log", "show", "diff", "branch",
+]);
+// --- trust-level shell guardrails ---
+function resolveOuroSubcommand(command) {
+    const afterOuro = command.replace(/^ouro\s+/, "").trim();
+    /* v8 ignore next -- bare "ouro" is caught upstream by checkShellTrustGuardrails @preserve */
+    if (!afterOuro)
+        return null;
+    const tokens = afterOuro.split(/\s+/);
+    const twoWord = tokens.length >= 2 ? `${tokens[0]} ${tokens[1]}` : null;
+    // Two-word match first (e.g. "task board"), then one-word (e.g. "whoami")
+    if (twoWord && exports.OURO_CLI_TRUST_MANIFEST[twoWord])
+        return twoWord;
+    if (exports.OURO_CLI_TRUST_MANIFEST[tokens[0]])
+        return tokens[0];
+    return null;
+}
+function checkSingleShellCommandTrust(command, trustLevel) {
+    const trimmed = command.trim();
+    const tokens = trimmed.split(/\s+/);
+    const firstToken = tokens[0] || "";
+    // ouro CLI — check per-subcommand trust manifest
+    if (firstToken === "ouro") {
+        const subcommand = resolveOuroSubcommand(trimmed);
+        const requiredLevel = subcommand ? exports.OURO_CLI_TRUST_MANIFEST[subcommand] : "friend";
+        if (trustLevelSatisfied(requiredLevel, trustLevel))
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    // git — check subcommand allowlist
+    if (firstToken === "git") {
+        const gitSub = tokens[1] || "";
+        if (ACQUAINTANCE_GIT_ALLOWLIST.has(gitSub))
+            return allow;
+        return deny(REASONS.needsTrust);
+    }
+    // General CLI — check allowlist
+    if (ACQUAINTANCE_SHELL_ALLOWLIST.has(firstToken))
+        return allow;
+    return deny(REASONS.needsTrust);
+}
+function checkShellTrustGuardrails(command, trustLevel) {
+    // Subshell patterns ($(), backticks) can't be reliably split — check as single command
+    /* v8 ignore next -- subshell branch: tested via guardrails.test.ts @preserve */
+    if (SUBSHELL_PATTERN.test(command)) {
+        return checkSingleShellCommandTrust(command, trustLevel);
+    }
+    // Compound commands: check each subcommand individually
+    const subcommands = splitShellCommands(command);
+    if (subcommands.length === 0)
+        return checkSingleShellCommandTrust(command, trustLevel);
+    for (const sub of subcommands) {
+        const result = checkSingleShellCommandTrust(sub, trustLevel);
+        if (!result.allowed)
+            return result;
+    }
+    return allow;
+}
+function checkWriteTrustGuardrails(toolName, args, context) {
+    if (toolName !== "write_file" && toolName !== "edit_file")
+        return allow;
+    const filePath = args.path || "";
+    if (context.agentRoot && filePath.startsWith(context.agentRoot))
+        return allow;
+    if (!context.agentRoot)
+        return allow;
+    return deny(REASONS.needsTrustForWrite);
+}
+function checkTrustLevelGuardrails(toolName, args, context) {
+    // Trusted levels (family/friend) — no trust guardrails. Undefined defaults to friend.
+    if ((0, types_1.isTrustedLevel)(context.trustLevel))
+        return allow;
+    if (toolName === "shell") {
+        return checkShellTrustGuardrails(args.command || "", context.trustLevel);
+    }
+    return checkWriteTrustGuardrails(toolName, args, context);
+}
+// --- main entry point ---
+function guardInvocation(toolName, args, context) {
+    (0, runtime_1.emitNervesEvent)({
+        component: "tools",
+        event: "tools.guard_check",
+        message: "guardrail check",
+        meta: { toolName },
+    });
+    // Read-only tools are always allowed (no structural or trust guardrails)
+    if (READ_ONLY_TOOLS.has(toolName))
+        return allow;
+    // Layer 1: structural guardrails (always on)
+    const structuralResult = checkStructuralGuardrails(toolName, args, context);
+    if (!structuralResult.allowed)
+        return structuralResult;
+    // Layer 2: trust-level guardrails (varies by friend's trust)
+    return checkTrustLevelGuardrails(toolName, args, context);
+}