@owasp-aghast/aghast 0.8.0-beta.0

package/dist/budget.js

@@ -0,0 +1,137 @@
+/**
+ * Budget controls: per-scan and per-period token/cost limits.
+ *
+ * `checkBudget` is called before each AI invocation in the scan runner with
+ * the current accumulated cost. It returns one of:
+ *   - `continue` — under the warn threshold, proceed silently.
+ *   - `warn` — at or above the warn threshold but below the abort threshold.
+ *   - `abort` — at or above the abort threshold; the scan should stop.
+ *
+ * Period limits are computed against historical scan records (from
+ * scan-history.ts) plus the in-flight scan's accumulated cost.
+ */
+const DEFAULT_WARN_AT = 0.8;
+const DEFAULT_ABORT_AT = 1.0;
+/**
+ * Compute the start of the current budget window for `now`.
+ */
+function windowStart(now, window) {
+    const d = new Date(now);
+    d.setUTCHours(0, 0, 0, 0);
+    if (window === 'day')
+        return d;
+    if (window === 'week') {
+        // ISO-style week: start on Monday (UTC).
+        const day = d.getUTCDay(); // 0=Sun..6=Sat
+        const offset = (day + 6) % 7; // days since Monday
+        d.setUTCDate(d.getUTCDate() - offset);
+        return d;
+    }
+    // month
+    d.setUTCDate(1);
+    return d;
+}
+/**
+ * Sum costs of historical records whose startedAt falls within [start, now].
+ *
+ * The upper bound on `now` matters because clock-skewed CI machines can write
+ * history records dated in the future. Without an upper bound, those records
+ * would count toward every period until "now" surpasses them.
+ */
+function sumHistoryWithinWindow(history, start, now) {
+    const startIso = start.toISOString();
+    const nowIso = now.toISOString();
+    let total = 0;
+    for (const r of history) {
+        if (r.startedAt >= startIso && r.startedAt <= nowIso) {
+            total += r.totalCost;
+        }
+    }
+    return total;
+}
+/**
+ * Evaluate the current scan against the configured budget limits.
+ */
+export function checkBudget(input, limits) {
+    if (!limits || (!limits.perScan && !limits.perPeriod)) {
+        return { ok: true, action: 'continue' };
+    }
+    const warnAt = limits.thresholds?.warnAt ?? DEFAULT_WARN_AT;
+    const abortAt = limits.thresholds?.abortAt ?? DEFAULT_ABORT_AT;
+    let worst = { ok: true, action: 'continue' };
+    const escalate = (status) => {
+        if (status.action === 'abort' || (status.action === 'warn' && worst.action === 'continue')) {
+            worst = status;
+        }
+    };
+    // Per-scan token limit
+    if (limits.perScan?.maxTokens !== undefined && limits.perScan.maxTokens > 0) {
+        const ratio = input.currentScanTokens / limits.perScan.maxTokens;
+        if (ratio >= abortAt) {
+            escalate({
+                ok: false,
+                action: 'abort',
+                reason: `Per-scan token limit reached: ${input.currentScanTokens} / ${limits.perScan.maxTokens}`,
+            });
+        }
+        else if (ratio >= warnAt) {
+            escalate({
+                ok: true,
+                action: 'warn',
+                reason: `Per-scan token usage at ${(ratio * 100).toFixed(0)}% of limit (${input.currentScanTokens} / ${limits.perScan.maxTokens})`,
+            });
+        }
+    }
+    // Per-scan cost limit
+    if (limits.perScan?.maxCostUsd !== undefined && limits.perScan.maxCostUsd > 0) {
+        const ratio = input.currentScanCostUsd / limits.perScan.maxCostUsd;
+        if (ratio >= abortAt) {
+            escalate({
+                ok: false,
+                action: 'abort',
+                reason: `Per-scan cost limit reached: ${input.currentScanCostUsd.toFixed(4)} / ${limits.perScan.maxCostUsd} USD`,
+            });
+        }
+        else if (ratio >= warnAt) {
+            escalate({
+                ok: true,
+                action: 'warn',
+                reason: `Per-scan cost at ${(ratio * 100).toFixed(0)}% of limit (${input.currentScanCostUsd.toFixed(4)} / ${limits.perScan.maxCostUsd} USD)`,
+            });
+        }
+    }
+    // Per-period cost limit
+    if (limits.perPeriod && limits.perPeriod.maxCostUsd > 0) {
+        const now = input.now ?? new Date();
+        const start = windowStart(now, limits.perPeriod.window);
+        const historical = sumHistoryWithinWindow(input.history ?? [], start, now);
+        const total = historical + input.currentScanCostUsd;
+        const ratio = total / limits.perPeriod.maxCostUsd;
+        if (ratio >= abortAt) {
+            escalate({
+                ok: false,
+                action: 'abort',
+                reason: `Per-${limits.perPeriod.window} cost limit reached: ${total.toFixed(4)} / ${limits.perPeriod.maxCostUsd} USD`,
+            });
+        }
+        else if (ratio >= warnAt) {
+            escalate({
+                ok: true,
+                action: 'warn',
+                reason: `Per-${limits.perPeriod.window} cost at ${(ratio * 100).toFixed(0)}% of limit (${total.toFixed(4)} / ${limits.perPeriod.maxCostUsd} USD)`,
+            });
+        }
+    }
+    return worst;
+}
+/**
+ * Sentinel error thrown by the scan runner when a budget abort fires mid-scan.
+ * Distinct class so callers can detect budget aborts vs other failures.
+ */
+export class BudgetExceededError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'BudgetExceededError';
+    }
+}
+//# sourceMappingURL=budget.js.map

package/dist/budget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"budget.js","sourceRoot":"","sources":["../src/budget.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAgDH,MAAM,eAAe,GAAG,GAAG,CAAC;AAC5B,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;GAEG;AACH,SAAS,WAAW,CAAC,GAAS,EAAE,MAAiC;IAC/D,MAAM,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC,CAAC,WAAW,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;IAC1B,IAAI,MAAM,KAAK,KAAK;QAAE,OAAO,CAAC,CAAC;IAC/B,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,yCAAyC;QACzC,MAAM,GAAG,GAAG,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,eAAe;QAC1C,MAAM,MAAM,GAAG,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,oBAAoB;QAClD,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,MAAM,CAAC,CAAC;QACtC,OAAO,CAAC,CAAC;IACX,CAAC;IACD,QAAQ;IACR,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;IAChB,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;GAMG;AACH,SAAS,sBAAsB,CAAC,OAAqB,EAAE,KAAW,EAAE,GAAS;IAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IACrC,MAAM,MAAM,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;QACxB,IAAI,CAAC,CAAC,SAAS,IAAI,QAAQ,IAAI,CAAC,CAAC,SAAS,IAAI,MAAM,EAAE,CAAC;YACrD,KAAK,IAAI,CAAC,CAAC,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,WAAW,CAAC,KAAuB,EAAE,MAAgC;IACnF,IAAI,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,CAAC,UAAU,EAAE,MAAM,IAAI,eAAe,CAAC;IAC5D,MAAM,OAAO,GAAG,MAAM,CAAC,UAAU,EAAE,OAAO,IAAI,gBAAgB,CAAC;IAE/D,IAAI,KAAK,GAAiB,EAAE,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAE3D,MAAM,QAAQ,GAAG,CAAC,MAAoB,EAAE,EAAE;QACxC,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC,EAAE,CAAC;YAC3F,KAAK,GAAG,MAAM,CAAC;QACjB,CAAC;IACH,CAAC,CAAC;IAEF,uBAAuB;IACvB,IAAI,MAAM,CAAC,OAAO,EAAE,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,CAAC,EAAE,CAAC;QAC5E,MAAM,KAAK,GAAG,KAAK,CAAC,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC;QACjE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC;gBACP,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,iCAAiC,KAAK,CAAC,iBAAiB,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE;aACjG,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC;gBACP,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,2BAA2B,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,iBAAiB,MAAM,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG;aACnI,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,sBAAsB;IACtB,IAAI,MAAM,CAAC,OAAO,EAAE,UAAU,KAAK,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QAC9E,MAAM,KAAK,GAAG,KAAK,CAAC,kBAAkB,GAAG,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC;QACnE,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC;gBACP,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,gCAAgC,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,MAAM;aACjH,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC;gBACP,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,oBAAoB,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,OAAO,CAAC,UAAU,OAAO;aAC7I,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,wBAAwB;IACxB,IAAI,MAAM,CAAC,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,UAAU,GAAG,CAAC,EAAE,CAAC;QACxD,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QACpC,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACxD,MAAM,UAAU,GAAG,sBAAsB,CAAC,KAAK,CAAC,OAAO,IAAI,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC;QAC3E,MAAM,KAAK,GAAG,UAAU,GAAG,KAAK,CAAC,kBAAkB,CAAC;QACpD,MAAM,KAAK,GAAG,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC,UAAU,CAAC;QAClD,IAAI,KAAK,IAAI,OAAO,EAAE,CAAC;YACrB,QAAQ,CAAC;gBACP,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,OAAO;gBACf,MAAM,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,wBAAwB,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,MAAM;aACtH,CAAC,CAAC;QACL,CAAC;aAAM,IAAI,KAAK,IAAI,MAAM,EAAE,CAAC;YAC3B,QAAQ,CAAC;gBACP,EAAE,EAAE,IAAI;gBACR,MAAM,EAAE,MAAM;gBACd,MAAM,EAAE,OAAO,MAAM,CAAC,SAAS,CAAC,MAAM,YAAY,CAAC,KAAK,GAAG,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,MAAM,CAAC,SAAS,CAAC,UAAU,OAAO;aAClJ,CAAC,CAAC;QACL,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,mBAAoB,SAAQ,KAAK;IAC5C,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,qBAAqB,CAAC;IACpC,CAAC;CACF"}

package/dist/build-config.d.ts

@@ -0,0 +1,15 @@
+/**
+ * CLI utility for building / editing a runtime-config.json file.
+ *
+ * Interactive by default; flag-only mode skips prompts. If a config file
+ * already exists, its values are loaded and used as defaults — only the
+ * fields you change (or pass as flags) are updated.
+ *
+ * Usage:
+ *   aghast build-config --config-dir <path>          # interactive, file at <path>/runtime-config.json
+ *   aghast build-config --runtime-config <file>      # interactive, write to explicit file
+ *   aghast build-config --config-dir <path> --provider claude-code --model sonnet  # non-interactive
+ *   aghast build-config --config-dir <path> --non-interactive  # accept all current/defaults
+ */
+export declare function runBuildConfig(args: string[]): Promise<void>;
+//# sourceMappingURL=build-config.d.ts.map

package/dist/build-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build-config.d.ts","sourceRoot":"","sources":["../src/build-config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA4XH,wBAAsB,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAkOlE"}