@phuetz/code-buddy 1.2.0 → 1.3.0

package/dist/skills/skill-sources.js

@@ -0,0 +1,102 @@
+/**
+ * Skill sources — a small "referential" of named places skills can be imported
+ * from. A source is a local directory or a git repo. Persisted to
+ * `~/.codebuddy/skill-sources.json`. The importer resolves a source to a local
+ * directory (cloning/pulling a git source into a cache) and then runs the same
+ * firewall-gated import path.
+ *
+ * @module skills/skill-sources
+ */
+import fs from 'fs';
+import path from 'path';
+import os from 'os';
+import { execFileSync } from 'child_process';
+import { logger } from '../utils/logger.js';
+function configPath() {
+    return path.join(os.homedir(), '.codebuddy', 'skill-sources.json');
+}
+function cacheRoot() {
+    return path.join(os.homedir(), '.codebuddy', 'skills', '.sources-cache');
+}
+/** Best-effort: locate the OpenClaw skills dir (it lives inside the npm global package). */
+function findOpenclawSkillsDir() {
+    const candidates = [path.join(os.homedir(), '.openclaw', 'skills')];
+    const nvmRoot = path.join(os.homedir(), '.nvm', 'versions', 'node');
+    try {
+        for (const v of fs.readdirSync(nvmRoot)) {
+            candidates.push(path.join(nvmRoot, v, 'lib', 'node_modules', 'openclaw', 'skills'));
+        }
+    }
+    catch {
+        /* no nvm */
+    }
+    candidates.push('/usr/local/lib/node_modules/openclaw/skills', '/usr/lib/node_modules/openclaw/skills');
+    return candidates.find((c) => fs.existsSync(c));
+}
+function read() {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(configPath(), 'utf-8'));
+        if (Array.isArray(parsed.sources))
+            return { schemaVersion: 1, sources: parsed.sources };
+    }
+    catch {
+        /* no config yet */
+    }
+    // Seed known local skill repos as default `dir` sources when present.
+    const seed = [];
+    const hermes = path.join(os.homedir(), '.hermes', 'skills');
+    if (fs.existsSync(hermes))
+        seed.push({ name: 'hermes', type: 'dir', location: hermes });
+    const openclaw = findOpenclawSkillsDir();
+    if (openclaw)
+        seed.push({ name: 'openclaw', type: 'dir', location: openclaw });
+    return { schemaVersion: 1, sources: seed };
+}
+function write(file) {
+    fs.mkdirSync(path.dirname(configPath()), { recursive: true });
+    fs.writeFileSync(configPath(), JSON.stringify(file, null, 2), 'utf-8');
+}
+export function listSources() {
+    return read().sources;
+}
+export function getSource(name) {
+    return read().sources.find((s) => s.name === name);
+}
+export function addSource(name, location, type = location.endsWith('.git') || location.includes('://') ? 'git' : 'dir') {
+    const file = read();
+    const source = { name, type, location };
+    file.sources = file.sources.filter((s) => s.name !== name);
+    file.sources.push(source);
+    write(file);
+    return source;
+}
+export function removeSource(name) {
+    const file = read();
+    const before = file.sources.length;
+    file.sources = file.sources.filter((s) => s.name !== name);
+    if (file.sources.length === before)
+        return false;
+    write(file);
+    return true;
+}
+/** Resolve a source to a local directory (clone/pull a git source into the cache). */
+export function resolveSourceDir(source) {
+    if (source.type === 'dir')
+        return source.location;
+    // git: shallow clone or pull into the cache.
+    const dir = path.join(cacheRoot(), source.name);
+    fs.mkdirSync(cacheRoot(), { recursive: true });
+    try {
+        if (fs.existsSync(path.join(dir, '.git'))) {
+            execFileSync('git', ['-C', dir, 'pull', '--ff-only', '--depth', '1'], { stdio: 'ignore' });
+        }
+        else {
+            execFileSync('git', ['clone', '--depth', '1', source.location, dir], { stdio: 'ignore' });
+        }
+    }
+    catch (err) {
+        logger.warn(`skill source "${source.name}": git fetch failed — ${err instanceof Error ? err.message : String(err)}`);
+    }
+    return dir;
+}
+//# sourceMappingURL=skill-sources.js.map

package/dist/skills/types.d.ts

@@ -28,6 +28,12 @@ export interface SkillMetadata {
     contextFork?: boolean;
     /** CC11: If true, skill content is returned directly without LLM invocation */
     disableModelInvocation?: boolean;
+    /** Self-improvement: if true, curation won't overwrite/remove/consolidate this skill */
+    pinned?: boolean;
+    /** Provenance: this skill was imported from an external source. */
+    imported?: boolean;
+    /** Provenance: label of the source it was imported from (e.g. "hermes"). */
+    source?: string;
 }
 export interface SkillRequirements {
     /** Required tools */

package/dist/tools/register-tool-handler.d.ts

@@ -0,0 +1,25 @@
+/**
+ * register_tool — lets Code Buddy author a NEW tool for itself at runtime.
+ *
+ * This is the "the code it builds can call its own tools" capability. On a
+ * passing static safety scan it writes BOTH tool registries (via LiveToolMutator):
+ *   - FormalToolRegistry  → the authored tool is immediately CALLABLE (dispatch),
+ *   - legacy ToolRegistry → its schema becomes VISIBLE to the model next turn.
+ *
+ * Authored tools are namespaced `authored__<name>` and run SANDBOXED. Gated
+ * overall by `CODEBUDDY_SELF_IMPROVE=true` at the registration site (tools.ts).
+ *
+ * The static scan here is the same G1 used by the self-improvement engine
+ * (authored-artifact-gate). The fuller behavioural held-out gate (which proves a
+ * tool actually works on fresh inputs) is applied by the engine's tool-gate when
+ * a tool is proposed as a self-improvement against a benchmark scenario.
+ */
+import type { ITool, ToolSchema } from './registry/types.js';
+import type { ToolResult } from '../types/index.js';
+export declare class RegisterToolTool implements ITool {
+    readonly name = "register_tool";
+    readonly description: string;
+    execute(input: Record<string, unknown>): Promise<ToolResult>;
+    getSchema(): ToolSchema;
+}
+export declare function createRegisterToolTool(): RegisterToolTool;

package/dist/tools/register-tool-handler.js

@@ -0,0 +1,100 @@
+/**
+ * register_tool — lets Code Buddy author a NEW tool for itself at runtime.
+ *
+ * This is the "the code it builds can call its own tools" capability. On a
+ * passing static safety scan it writes BOTH tool registries (via LiveToolMutator):
+ *   - FormalToolRegistry  → the authored tool is immediately CALLABLE (dispatch),
+ *   - legacy ToolRegistry → its schema becomes VISIBLE to the model next turn.
+ *
+ * Authored tools are namespaced `authored__<name>` and run SANDBOXED. Gated
+ * overall by `CODEBUDDY_SELF_IMPROVE=true` at the registration site (tools.ts).
+ *
+ * The static scan here is the same G1 used by the self-improvement engine
+ * (authored-artifact-gate). The fuller behavioural held-out gate (which proves a
+ * tool actually works on fresh inputs) is applied by the engine's tool-gate when
+ * a tool is proposed as a self-improvement against a benchmark scenario.
+ */
+import { AUTHORED_LANGUAGES, toAuthoredName, } from '../agent/self-improvement/authored-tool-runtime.js';
+import { inspectAuthoredCode } from '../agent/self-improvement/authored-artifact-gate.js';
+import { LiveToolMutator } from '../agent/self-improvement/tool-skill-mutator.js';
+import { logger } from '../utils/logger.js';
+export class RegisterToolTool {
+    name = 'register_tool';
+    description = 'Author a NEW tool for yourself at runtime. Provide a name, description, JSON-schema params, ' +
+        'a language (javascript|typescript|python) and the code. The code reads its call arguments as ' +
+        'JSON from the CODEBUDDY_TOOL_INPUT env var and prints its result to stdout. On a passing safety ' +
+        'check the tool is registered as `authored__<name>` and becomes callable by you on your next turn.';
+    async execute(input) {
+        const rawName = String(input.name ?? '').trim();
+        const description = String(input.description ?? '').trim();
+        const language = String(input.language ?? 'javascript').toLowerCase();
+        const code = typeof input.code === 'string' ? input.code : '';
+        const parameters = input.params && typeof input.params === 'object'
+            ? input.params
+            : { type: 'object', properties: {} };
+        if (!rawName)
+            return { success: false, error: 'register_tool: `name` is required.' };
+        if (!description)
+            return { success: false, error: 'register_tool: `description` is required.' };
+        if (!code.trim())
+            return { success: false, error: 'register_tool: `code` is required.' };
+        if (!AUTHORED_LANGUAGES.includes(language)) {
+            return { success: false, error: `register_tool: language must be one of ${AUTHORED_LANGUAGES.join(', ')}.` };
+        }
+        // Static safety scan (engine G1): dangerous patterns, secrets, no-src/-write, omissions.
+        const scan = inspectAuthoredCode(code, 'code');
+        if (!scan.ok) {
+            return { success: false, error: `register_tool: refused — ${scan.reasons.join('; ')}.` };
+        }
+        const spec = {
+            name: toAuthoredName(rawName),
+            description,
+            parameters,
+            language,
+            code,
+        };
+        try {
+            new LiveToolMutator().register(spec);
+        }
+        catch (err) {
+            return {
+                success: false,
+                error: `register_tool: registration failed — ${err instanceof Error ? err.message : String(err)}`,
+            };
+        }
+        logger.info(`[self-improve] authored tool registered: ${spec.name}`);
+        return {
+            success: true,
+            output: `Registered tool \`${spec.name}\`. It is now callable by you on your next turn — ` +
+                `call it with arguments matching its params.`,
+        };
+    }
+    getSchema() {
+        return {
+            name: this.name,
+            description: this.description,
+            parameters: {
+                type: 'object',
+                properties: {
+                    name: { type: 'string', description: 'Tool name (namespaced to authored__<name>)' },
+                    description: { type: 'string', description: 'What the tool does and when to use it' },
+                    params: { type: 'object', description: 'JSON Schema for the tool arguments' },
+                    language: {
+                        type: 'string',
+                        enum: ['javascript', 'typescript', 'python'],
+                        description: 'Implementation language (default javascript)',
+                    },
+                    code: {
+                        type: 'string',
+                        description: 'Code that reads its args as JSON from env CODEBUDDY_TOOL_INPUT and prints its result to stdout',
+                    },
+                },
+                required: ['name', 'description', 'code'],
+            },
+        };
+    }
+}
+export function createRegisterToolTool() {
+    return new RegisterToolTool();
+}
+//# sourceMappingURL=register-tool-handler.js.map

package/dist/tools/registry.d.ts

@@ -67,6 +67,12 @@ export declare class ToolRegistry {
      * @returns The registered tool object or undefined if not found
      */
     getTool(name: string): RegisteredTool | undefined;
+    /**
+     * Remove a registered tool by name (used to revert self-authored tools).
+     *
+     * @returns true if a tool was removed, false if it was not registered
+     */
+    removeTool(name: string): boolean;
     /**
      * Check if a tool is registered and currently enabled.
      *

package/dist/tools/registry.js

@@ -87,6 +87,14 @@ export class ToolRegistry {
     getTool(name) {
         return this.tools.get(name);
     }
+    /**
+     * Remove a registered tool by name (used to revert self-authored tools).
+     *
+     * @returns true if a tool was removed, false if it was not registered
+     */
+    removeTool(name) {
+        return this.tools.delete(name);
+    }
     /**
      * Check if a tool is registered and currently enabled.
      *

package/dist/utils/init-project.d.ts

@@ -81,4 +81,11 @@ export declare function initCodeBuddyProject(workingDirectory?: string, options?
  * Format init result for display (ASCII markers, no emojis)
  */
 export declare function formatInitResult(result: InitResult): string;
+/**
+ * Build the prompt for the agent-driven `/init`. Instructs the model to analyze
+ * the repository and write/improve a tailored root `AGENTS.md`, grounded on the
+ * RepoProfiler's verified facts so it cannot hallucinate build/test commands.
+ * Modeled on Codex's `prompt_for_init_command.md`.
+ */
+export declare function buildInitPrompt(contextPack: string): string;
 export {};

package/dist/utils/init-project.js

@@ -495,6 +495,13 @@ ${archLines.join('\n')}
 ## More Context
 ${moreLines.join('\n')}
 
+<sub>**How instruction files load:** Code Buddy reads from \`~/.codebuddy/\` (global), the
+project root, and subdirectories — the file closest to what you're editing wins.
+Accepted names compose in order: **AGENTS.md** (this file, primary), then \`CODEBUDDY.md\`,
+\`CLAUDE.md\`, \`GEMINI.md\`, \`CONTEXT.md\`, \`INSTRUCTIONS.md\`. Drop \`@./path.md\` to import
+another file. Override a file in the same directory with \`AGENTS.override.md\` (committed)
+or \`AGENTS.local.md\` (gitignored).</sub>
+
 ---
 *Auto-generated by \`buddy init\`. Re-run with \`--force\` to refresh, or edit by hand — \`buddy init\` won't overwrite without explicit force.*
 `;
@@ -772,6 +779,8 @@ Safety checks:
 .codebuddy/tool-results/
 .codebuddy/cache/
 .codebuddy/user-settings.json
+# Personal, uncommitted instruction overrides (AGENTS.local.md, CODEBUDDY.local.md, …)
+*.local.md
 `;
         if (fs.existsSync(gitignorePath)) {
             const currentContent = fs.readFileSync(gitignorePath, 'utf-8');
@@ -897,6 +906,34 @@ export function formatInitResult(result) {
     output += '  5. Use /starter to browse framework starter packs for new projects\n';
     return output;
 }
+/**
+ * Build the prompt for the agent-driven `/init`. Instructs the model to analyze
+ * the repository and write/improve a tailored root `AGENTS.md`, grounded on the
+ * RepoProfiler's verified facts so it cannot hallucinate build/test commands.
+ * Modeled on Codex's `prompt_for_init_command.md`.
+ */
+export function buildInitPrompt(contextPack) {
+    const facts = contextPack && contextPack.trim()
+        ? `\nVERIFIED FACTS about this repository (auto-detected — use these, do not invent commands):\n${contextPack.trim()}\n`
+        : '';
+    return `Analyze THIS repository and write a tailored \`AGENTS.md\` at the project root — a concise contributor/agent guide (the cross-CLI standard read by Claude Code, Cursor, Codex, Gemini CLI and Code Buddy).
+${facts}
+How to do it:
+1. Explore the real code first — use \`list_directory\`, \`view_file\`, \`search\` (and \`code_graph\` if available) to understand the actual structure, entry points, scripts and conventions. Read \`package.json\` / \`pyproject.toml\` / \`Cargo.toml\`, the README, and a few representative source files.
+2. Trust any auto-detected facts shown above for build/test/lint commands, languages and directories — do NOT invent commands. Confirm anything else by reading the config files.
+3. Write a clear, concise document (aim for 200–400 words, Markdown headings), adapting or omitting sections as appropriate:
+   - **Project Structure & Module Organization** — where source, tests and assets live.
+   - **Build, Test & Dev Commands** — the real commands, each briefly explained.
+   - **Coding Style & Naming Conventions** — indentation, language style, naming, lint/format tools.
+   - **Testing Guidelines** — framework, how to run, naming.
+   - **Commit & Pull Request Guidelines** — infer conventions from the git history.
+   - *(optional)* **Architecture Overview** — for non-obvious design.
+
+Important:
+- Write ONLY \`AGENTS.md\` at the project root. Do NOT modify anything under \`.codebuddy/\` — that config was just scaffolded deterministically.
+- If \`AGENTS.md\` already has meaningful content, IMPROVE it in place: preserve the user's good wording, refine and fill gaps; never blank-overwrite.
+- Keep it specific to THIS repository and actionable. No filler.`;
+}
 // ============================================================================
 // Data flow renderer — shows how key components connect
 // ============================================================================

package/dist/utils/settings-manager.d.ts

@@ -27,6 +27,18 @@ export interface ProjectSettings {
         judgeMaxTokens?: number;
         judgeTimeoutMs?: number;
     };
+    /**
+     * Project-instruction context-file loading (the AGENTS.md/CLAUDE.md/GEMINI.md
+     * hierarchy). All fields optional; omitted keys fall back to defaults in
+     * `src/context/instruction-excludes.ts` (`loadContextConfig`).
+     */
+    context?: {
+        fileNames?: string[];
+        maxBytes?: number;
+        jitMaxBytes?: number;
+        importMaxBytes?: number;
+        importMaxDepth?: number;
+    };
 }
 /**
  * Unified settings manager that handles both user-level and project-level settings

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@phuetz/code-buddy",
-  "version": "1.2.0",
+  "version": "1.3.0",
   "description": "Open-source multi-provider AI coding agent for the terminal. Supports Grok, Claude, ChatGPT, Gemini, Ollama and LM Studio with 52+ tools, multi-channel messaging, skills system, and Enterprise-grade architecture.",
   "author": "Patrice Huetz <patrice.huetz@gmail.com>",
   "repository": {