@phuetz/code-buddy 1.6.1 → 2.1.0

package/dist/agent/self-improvement/strategy-types.js

@@ -0,0 +1,90 @@
+/**
+ * Strategy layer types — the FOURTH learnable surface of the self-improvement
+ * engine (after lessons, tools and skills): HOW the agent executes.
+ *
+ * A strategy is a small, bounded execution policy: round/cost ceilings, the
+ * reasoning level, verification requirements and a handful of short method
+ * directives. It is a JSON file under `.codebuddy/strategies/`, NEVER code, and
+ * the schema below is STRICT — an unknown key is a rejection, so a mutation can
+ * only move inside the envelope the schema declares. No field exists that could
+ * disable a safety middleware, the sandbox, the confirmation service or the
+ * skill firewall: that invariant holds by construction, not by a runtime check.
+ *
+ * @module agent/self-improvement/strategy-types
+ */
+import { z } from 'zod';
+export const STRATEGY_SCHEMA_VERSION = 1;
+export const STRATEGY_SCOPES = ['default', 'headless', 'code-edit', 'audit', 'research'];
+export const REASONING_LEVELS = ['off', 'low', 'medium', 'high'];
+/** Hard envelope — the machine can move inside it, never outside. */
+export const STRATEGY_LIMITS = {
+    maxToolRounds: { min: 1, max: 400 },
+    maxCostUsd: { min: 0, max: 100 },
+    contextCompactPct: { min: 40, max: 95 },
+    maxDirectives: 5,
+    maxDirectiveChars: 400,
+};
+const idRe = /^[a-z0-9][a-z0-9-]{2,63}$/;
+export const strategyLimitsSchema = z
+    .object({
+    maxToolRounds: z
+        .number()
+        .int()
+        .min(STRATEGY_LIMITS.maxToolRounds.min)
+        .max(STRATEGY_LIMITS.maxToolRounds.max),
+    maxCostUsd: z.number().min(STRATEGY_LIMITS.maxCostUsd.min).max(STRATEGY_LIMITS.maxCostUsd.max),
+    contextCompactPct: z
+        .number()
+        .int()
+        .min(STRATEGY_LIMITS.contextCompactPct.min)
+        .max(STRATEGY_LIMITS.contextCompactPct.max)
+        .optional(),
+})
+    .strict();
+export const strategyVerificationSchema = z
+    .object({
+    /** Before finishing, run the tests of every file touched and report the count. */
+    testsForTouchedFiles: z.boolean(),
+    /** Commit after each completed step so a rollback never erases proven work. */
+    commitPerStep: z.boolean(),
+})
+    .strict();
+export const strategyProvenanceSchema = z
+    .object({
+    source: z.enum(['baseline', 'heuristic', 'llm', 'manual']),
+    experienceIds: z.array(z.string().max(200)).max(50),
+    createdAt: z.string().datetime({ offset: true }).or(z.string().datetime()),
+    /** Mutation operator that produced this candidate (audit trail). */
+    operator: z.string().max(80).optional(),
+})
+    .strict();
+export const strategySpecSchema = z
+    .object({
+    schemaVersion: z.literal(STRATEGY_SCHEMA_VERSION),
+    id: z.string().regex(idRe, 'id must be a lowercase slug'),
+    version: z.number().int().min(1),
+    parentId: z.string().regex(idRe).optional(),
+    scope: z.enum(STRATEGY_SCOPES),
+    /** Short method directives appended to the system prompt (firewall-scanned). */
+    directives: z
+        .array(z.string().min(8).max(STRATEGY_LIMITS.maxDirectiveChars))
+        .max(STRATEGY_LIMITS.maxDirectives),
+    limits: strategyLimitsSchema,
+    reasoning: z.enum(REASONING_LEVELS),
+    verification: strategyVerificationSchema,
+    provenance: strategyProvenanceSchema,
+})
+    .strict();
+/** The immutable root every lineage descends from — Code Buddy's historical defaults. */
+export const BASELINE_STRATEGY = Object.freeze({
+    schemaVersion: STRATEGY_SCHEMA_VERSION,
+    id: 'baseline',
+    version: 1,
+    scope: 'default',
+    directives: [],
+    limits: { maxToolRounds: 50, maxCostUsd: 10 },
+    reasoning: 'medium',
+    verification: { testsForTouchedFiles: false, commitPerStep: false },
+    provenance: { source: 'baseline', experienceIds: [], createdAt: '2026-09-04T00:00:00.000Z' },
+});
+//# sourceMappingURL=strategy-types.js.map

package/dist/agent/self-improvement/tool-benchmark.js

@@ -12,12 +12,15 @@ export const SEED_TOOL_SCENARIOS = [
         capability: 'Slugify the string field `text`: lowercase it, replace runs of spaces with single hyphens, and print the slug.',
         description: 'authored__slugify converts text to a url slug',
         visibleCases: [
-            { input: { text: 'Hello World' }, expectIncludes: ['hello-world'] },
-            { input: { text: 'Foo Bar Baz' }, expectIncludes: ['foo-bar-baz'] },
+            { input: { text: 'Hello World' }, expectedOutput: 'hello-world' },
+            { input: { text: 'Foo Bar Baz' }, expectedOutput: 'foo-bar-baz' },
         ],
         heldOutCases: [
-            { input: { text: 'The Quick Brown' }, expectIncludes: ['the-quick-brown'] },
-            { input: { text: 'A B C' }, expectIncludes: ['a-b-c'] },
+            { input: { text: 'The Quick Brown' }, expectedOutput: 'the-quick-brown' },
+            { input: { text: 'A B C' }, expectedOutput: 'a-b-c' },
+            // Capability says "runs of spaces" — a tool that only replace(' ','-')
+            // would otherwise pass G4 on the single-space held-out pairs above.
+            { input: { text: 'Hello  World' }, expectedOutput: 'hello-world' },
         ],
     },
     {
@@ -25,12 +28,165 @@ export const SEED_TOOL_SCENARIOS = [
         capability: 'Count the whitespace-separated words in the string field `text` and print the integer count.',
         description: 'authored__word_count counts words',
         visibleCases: [
-            { input: { text: 'one two three' }, expectIncludes: ['3'] },
-            { input: { text: 'hello' }, expectIncludes: ['1'] },
+            { input: { text: 'one two three' }, expectedOutput: '3' },
+            { input: { text: 'hello' }, expectedOutput: '1' },
         ],
         heldOutCases: [
-            { input: { text: 'a b c d e' }, expectIncludes: ['5'] },
-            { input: { text: 'foo bar' }, expectIncludes: ['2'] },
+            { input: { text: 'a b c d e' }, expectedOutput: '5' },
+            { input: { text: 'foo bar' }, expectedOutput: '2' },
+        ],
+    },
+    {
+        id: 'sitemap-check',
+        capability: 'Extract all URLs from string `content` (supporting XML <loc> tags and HTML href attributes). For each URL found (preserving appearance order, without duplicates), look up its HTTP status code in object `statuses` (default to 404 if missing). Print each result as `<url>: <code>` separated by newlines.',
+        description: 'authored__sitemap_check checks URLs extracted from sitemap XML or HTML against a status map',
+        visibleCases: [
+            {
+                input: {
+                    content: '<urlset><url><loc>https://example.com/page1</loc></url><url><loc>https://example.com/page2</loc></url></urlset>',
+                    statuses: {
+                        'https://example.com/page1': 200,
+                        'https://example.com/page2': 404,
+                    },
+                },
+                expectedOutput: 'https://example.com/page1: 200\nhttps://example.com/page2: 404',
+            },
+            {
+                input: {
+                    content: '<html><body><a href="https://example.com/home">Home</a><a href="https://example.com/contact">Contact</a></body></html>',
+                    statuses: {
+                        'https://example.com/home': 200,
+                        'https://example.com/contact': 301,
+                    },
+                },
+                expectedOutput: 'https://example.com/home: 200\nhttps://example.com/contact: 301',
+            },
+        ],
+        heldOutCases: [
+            {
+                input: {
+                    content: '<urlset><url><loc>https://example.com/blog</loc></url><url><loc>https://example.com/api</loc></url></urlset>',
+                    statuses: {
+                        'https://example.com/blog': 200,
+                        'https://example.com/api': 500,
+                    },
+                },
+                expectedOutput: 'https://example.com/blog: 200\nhttps://example.com/api: 500',
+            },
+            {
+                input: {
+                    content: '<html><a href="https://example.com/a">A</a><a href="https://example.com/b">B</a></html>',
+                    statuses: {
+                        'https://example.com/a': 200,
+                    },
+                },
+                expectedOutput: 'https://example.com/a: 200\nhttps://example.com/b: 404',
+            },
+            {
+                input: {
+                    content: '<urlset><url><loc>https://example.com/dup</loc></url><url><loc>https://example.com/dup</loc></url></urlset>',
+                    statuses: {
+                        'https://example.com/dup': 200,
+                    },
+                },
+                expectedOutput: 'https://example.com/dup: 200',
+            },
+        ],
+    },
+    {
+        id: 'ffmpeg-argv-audit',
+        capability: 'Audit an ffmpeg command line string in `argv`. Identify these 3 defects: ' +
+            '1. "stream_loop_without_t": has "-stream_loop -1" but lacks an input duration limit "-t"; ' +
+            '2. "duplicate_output": the output filename appears more than once; ' +
+            '3. "format_after_output": "-f" appears after the output file declaration. ' +
+            'Print the detected defect names sorted alphabetically and separated by comma and space (e.g. "duplicate_output, format_after_output"). If no defect is found, print "ok".',
+        description: 'authored__ffmpeg_argv_audit audits an ffmpeg command for common CLI pitfalls',
+        visibleCases: [
+            {
+                input: { argv: 'ffmpeg -stream_loop -1 -i in.mp4 out.mp4' },
+                expectedOutput: 'stream_loop_without_t',
+            },
+            {
+                input: { argv: 'ffmpeg -i in.mp4 out.mp4 -f mp4' },
+                expectedOutput: 'format_after_output',
+            },
+            {
+                input: { argv: 'ffmpeg -stream_loop -1 -t 10 -i in.mp4 out.mp4' },
+                expectedOutput: 'ok',
+            },
+        ],
+        heldOutCases: [
+            {
+                input: { argv: 'ffmpeg -i in.mp4 out.mp4 out.mp4' },
+                expectedOutput: 'duplicate_output',
+            },
+            {
+                input: { argv: 'ffmpeg -stream_loop -1 -i in.mp4 out.mp4 -f mp4' },
+                expectedOutput: 'format_after_output, stream_loop_without_t',
+            },
+            {
+                input: { argv: 'ffmpeg -i input.mov -c:v copy output.mov' },
+                expectedOutput: 'ok',
+            },
+        ],
+    },
+    {
+        id: 'orphan-temporaries',
+        capability: 'Inspect a directory file listing in array `entries` (where each entry has `name`: string and `ageMinutes`: number) and find orphan temporary files matching pattern `<target>.tmp.*` where `ageMinutes` is strictly greater than `maxAgeMinutes`. Print matching file names sorted alphabetically, joined by comma and space. If no matching files exist, print "none".',
+        description: 'authored__orphan_temporaries detects orphan temporary files older than a given threshold',
+        visibleCases: [
+            {
+                input: {
+                    entries: [
+                        { name: 'report.pdf.tmp.1023', ageMinutes: 45 },
+                        { name: 'video.mp4.tmp.999', ageMinutes: 5 },
+                        { name: 'data.csv', ageMinutes: 60 },
+                    ],
+                    maxAgeMinutes: 30,
+                },
+                expectedOutput: 'report.pdf.tmp.1023',
+            },
+            {
+                input: {
+                    entries: [
+                        { name: 'main.ts', ageMinutes: 120 },
+                        { name: 'notes.txt.tmp.1', ageMinutes: 10 },
+                    ],
+                    maxAgeMinutes: 15,
+                },
+                expectedOutput: 'none',
+            },
+        ],
+        heldOutCases: [
+            {
+                input: {
+                    entries: [
+                        { name: 'cache.db.tmp.8812', ageMinutes: 75 },
+                        { name: 'index.html.tmp.4421', ageMinutes: 90 },
+                        { name: 'style.css.tmp.12', ageMinutes: 2 },
+                    ],
+                    maxAgeMinutes: 60,
+                },
+                expectedOutput: 'cache.db.tmp.8812, index.html.tmp.4421',
+            },
+            {
+                input: {
+                    entries: [
+                        { name: 'archive.tar.gz.tmp.old', ageMinutes: 25 },
+                    ],
+                    maxAgeMinutes: 20,
+                },
+                expectedOutput: 'archive.tar.gz.tmp.old',
+            },
+            {
+                input: {
+                    entries: [
+                        { name: 'old_file.txt', ageMinutes: 1000 },
+                    ],
+                    maxAgeMinutes: 10,
+                },
+                expectedOutput: 'none',
+            },
         ],
     },
 ];

package/dist/agent/self-improvement/tool-engine.d.ts

@@ -3,14 +3,16 @@
  *   pick an uncovered tool scenario → propose (redacted view) → tool gate
  *   (static scan → visible → held-out) → keep+archive (auto-apply) or report.
  *
- * Autonomy is the same fail-safe toggle: 'propose-only' (default) validates and
- * reports; 'auto-apply' (CODEBUDDY_SELF_IMPROVE=true) keeps only tools that pass
+ * Autonomy is the same fail-safe toggle: 'propose-only' (default, including
+ * CODEBUDDY_SELF_IMPROVE=true) validates and reports; 'auto-apply'
+ * (CODEBUDDY_SELF_IMPROVE=auto-apply or `--apply`) keeps only tools that pass
  * the behavioural held-out gate, and archives them (reversible — un-registerable).
  *
  * @module agent/self-improvement/tool-engine
  */
 import { EvolutionaryArchive } from './evolutionary-archive.js';
 import { type Autonomy } from './engine.js';
+import { PendingProposalStore } from './proposal-store.js';
 import { type ToolMutatorPort } from './tool-skill-mutator.js';
 import { type ToolProposer } from './tool-proposer.js';
 import type { ToolBenchmarkScenario, ToolGateOutcome } from './tool-types.js';
@@ -31,6 +33,9 @@ export interface ToolImprovementEngineOptions {
     archive?: EvolutionaryArchive;
     autonomy?: Autonomy;
     now?: () => Date;
+    /** Workspace root for pending propose-only candidates (default cwd). */
+    workDir?: string;
+    proposalStore?: PendingProposalStore;
 }
 export declare class ToolImprovementEngine {
     private readonly scenarios;
@@ -39,16 +44,20 @@ export declare class ToolImprovementEngine {
     private readonly archive;
     private readonly autonomy;
     private readonly now;
+    private readonly proposals;
     /** Scenario ids already satisfied this run (coverage is per-scenario, not per tool name). */
     private readonly covered;
+    /** Scenario ids already attempted during this engine instance lifetime. */
+    private readonly attempted;
     constructor(options: ToolImprovementEngineOptions);
     /** Run exactly one tool-improvement cycle. */
     runCycle(): Promise<ToolCycleResult>;
-    /** Run cycles until nothing new is applied (or maxCycles). */
+    /** Run cycles until nothing new is applied or all scenarios are evaluated (or maxCycles). */
     runLoop(maxCycles?: number): Promise<ToolCycleResult[]>;
     status(): {
         autonomy: Autonomy;
         scenarios: number;
         archive: ReturnType<EvolutionaryArchive['summary']>;
     };
+    private finishCycle;
 }

package/dist/agent/self-improvement/tool-engine.js

@@ -3,14 +3,16 @@
  *   pick an uncovered tool scenario → propose (redacted view) → tool gate
  *   (static scan → visible → held-out) → keep+archive (auto-apply) or report.
  *
- * Autonomy is the same fail-safe toggle: 'propose-only' (default) validates and
- * reports; 'auto-apply' (CODEBUDDY_SELF_IMPROVE=true) keeps only tools that pass
+ * Autonomy is the same fail-safe toggle: 'propose-only' (default, including
+ * CODEBUDDY_SELF_IMPROVE=true) validates and reports; 'auto-apply'
+ * (CODEBUDDY_SELF_IMPROVE=auto-apply or `--apply`) keeps only tools that pass
  * the behavioural held-out gate, and archives them (reversible — un-registerable).
  *
  * @module agent/self-improvement/tool-engine
  */
 import { EvolutionaryArchive } from './evolutionary-archive.js';
 import { resolveAutonomy } from './engine.js';
+import { PendingProposalStore } from './proposal-store.js';
 import { validateToolProposal } from './tool-gate.js';
 import { LiveToolMutator } from './tool-skill-mutator.js';
 import { toProposerView } from './tool-proposer.js';
@@ -21,15 +23,19 @@ export class ToolImprovementEngine {
     archive;
     autonomy;
     now;
+    proposals;
     /** Scenario ids already satisfied this run (coverage is per-scenario, not per tool name). */
     covered = new Set();
+    /** Scenario ids already attempted during this engine instance lifetime. */
+    attempted = new Set();
     constructor(options) {
         this.scenarios = options.scenarios;
         this.proposer = options.proposer;
         this.mutator = options.mutator ?? new LiveToolMutator();
-        this.archive = options.archive ?? new EvolutionaryArchive();
+        this.archive = options.archive ?? new EvolutionaryArchive({ workDir: options.workDir });
         this.autonomy = options.autonomy ?? resolveAutonomy();
         this.now = options.now ?? (() => new Date());
+        this.proposals = options.proposalStore ?? new PendingProposalStore({ workDir: options.workDir });
     }
     /** Run exactly one tool-improvement cycle. */
     async runCycle() {
@@ -38,40 +44,29 @@ export class ToolImprovementEngine {
         for (const scenario of this.scenarios) {
             // Coverage is per-scenario: once a tool has satisfied this scenario's gate,
             // don't re-author it (even if the model would pick a different name).
-            if (this.covered.has(scenario.id))
+            if (this.covered.has(scenario.id) || this.attempted.has(scenario.id))
                 continue;
+            if (this.autonomy === 'auto-apply') {
+                const pending = this.proposals.loadTool(scenario.id);
+                if (pending) {
+                    const appliedPending = await this.finishCycle(base, scenario, pending.proposal, true);
+                    if (appliedPending.applied)
+                        this.proposals.remove('tool', scenario.id);
+                    return appliedPending;
+                }
+            }
             const proposal = await this.proposer.propose(toProposerView(scenario));
-            if (!proposal)
+            if (!proposal) {
+                this.attempted.add(scenario.id);
                 continue;
+            }
             // A tool with this exact name already exists — skip (avoid dup-register).
             if (this.mutator.has(proposal.spec.name)) {
                 this.covered.add(scenario.id);
+                this.attempted.add(scenario.id);
                 continue;
             }
-            const gate = await validateToolProposal(proposal, scenario, this.mutator, {
-                keepOnAccept: this.autonomy === 'auto-apply',
-            });
-            const applied = gate.accepted && !!gate.appliedRef;
-            if (applied) {
-                this.covered.add(scenario.id);
-                this.archive.append({
-                    proposalId: proposal.id,
-                    kind: 'tool',
-                    targetScenarioId: scenario.id,
-                    experienceId: proposal.experienceId,
-                    delta: 1,
-                    scoreAfter: gate.visiblePassed + gate.heldOutPassed,
-                    appliedRef: gate.appliedRef,
-                });
-            }
-            return {
-                ...base,
-                selectedScenarioId: scenario.id,
-                proposalId: proposal.id,
-                gate,
-                applied,
-                notes: gate.reasons,
-            };
+            return this.finishCycle(base, scenario, proposal, this.autonomy === 'auto-apply');
         }
         return {
             ...base,
@@ -82,14 +77,14 @@ export class ToolImprovementEngine {
             notes: ['no uncovered tool scenario with an available proposal'],
         };
     }
-    /** Run cycles until nothing new is applied (or maxCycles). */
+    /** Run cycles until nothing new is applied or all scenarios are evaluated (or maxCycles). */
     async runLoop(maxCycles) {
         const cap = Math.max(1, maxCycles ?? this.scenarios.length + 1);
         const results = [];
         for (let i = 0; i < cap; i++) {
             const r = await this.runCycle();
             results.push(r);
-            if (!r.applied)
+            if (!r.selectedScenarioId)
                 break;
         }
         return results;
@@ -97,5 +92,38 @@ export class ToolImprovementEngine {
     status() {
         return { autonomy: this.autonomy, scenarios: this.scenarios.length, archive: this.archive.summary() };
     }
+    async finishCycle(base, scenario, proposal, keepOnAccept) {
+        this.attempted.add(scenario.id);
+        const gate = await validateToolProposal(proposal, scenario, this.mutator, { keepOnAccept });
+        const applied = gate.accepted && !!gate.appliedRef;
+        if (gate.accepted && !keepOnAccept) {
+            this.proposals.saveTool({
+                scenarioId: scenario.id,
+                acceptedAt: this.now().toISOString(),
+                proposal,
+                gate,
+            });
+        }
+        if (applied) {
+            this.covered.add(scenario.id);
+            this.archive.append({
+                proposalId: proposal.id,
+                kind: 'tool',
+                targetScenarioId: scenario.id,
+                experienceId: proposal.experienceId,
+                delta: 1,
+                scoreAfter: gate.visiblePassed + gate.heldOutPassed,
+                appliedRef: gate.appliedRef,
+            });
+        }
+        return {
+            ...base,
+            selectedScenarioId: scenario.id,
+            proposalId: proposal.id,
+            gate,
+            applied,
+            notes: gate.reasons,
+        };
+    }
 }
 //# sourceMappingURL=tool-engine.js.map

package/dist/agent/self-improvement/tool-gate.d.ts

@@ -16,5 +16,7 @@ import type { ToolBenchmarkScenario, ToolGateOutcome, ToolProposal } from './too
 export interface ValidateToolOptions {
     /** auto-apply: keep (register) an accepted tool. propose-only: report only. */
     keepOnAccept: boolean;
+    /** Optional source before mutation. When absent, G0 is not applicable to a new tool. */
+    parentCode?: string;
 }
 export declare function validateToolProposal(proposal: ToolProposal, scenario: ToolBenchmarkScenario, mutator: ToolMutatorPort, options: ValidateToolOptions): Promise<ToolGateOutcome>;

package/dist/agent/self-improvement/tool-gate.js

@@ -12,6 +12,8 @@
  * @module agent/self-improvement/tool-gate
  */
 import { inspectAuthoredCode } from './authored-artifact-gate.js';
+import { AUTHORED_PREFIX } from './authored-tool-runtime.js';
+import { checkAstNovelty } from './evolution/ast-novelty.js';
 import { scoreToolCases } from './sandbox-scorer.js';
 export async function validateToolProposal(proposal, scenario, mutator, options) {
     const zero = {
@@ -22,11 +24,35 @@ export async function validateToolProposal(proposal, scenario, mutator, options)
         heldOutPassed: 0,
         heldOutTotal: scenario.heldOutCases.length,
     };
+    // G0 — reject a proven AST-identical mutation before static scans or behavioural scoring. A new
+    // authored tool has no parent and therefore remains on the normal G1→G4 path.
+    const parentCode = options.parentCode ?? proposal.parentCode;
+    if (parentCode !== undefined) {
+        const novelty = checkAstNovelty(proposal.spec.code, parentCode);
+        if (!novelty.isNovel) {
+            return {
+                ...zero,
+                accepted: false,
+                rejectionReason: 'ast-identical',
+                reasons: [`G0 rejected AST-identical mutation (${novelty.diffNodesCount} changed nodes)`],
+            };
+        }
+    }
     // G1 — static scan (no execution).
     const scan = inspectAuthoredCode(proposal.spec.code, 'code');
     if (!scan.ok) {
         return { ...zero, accepted: false, rejectionReason: 'static-scan', reasons: scan.reasons };
     }
+    // G1b — namespace: an authored tool must never be able to shadow a built-in.
+    // Reject before spending any scoring on a mis-named proposal.
+    if (!proposal.spec.name.startsWith(AUTHORED_PREFIX)) {
+        return {
+            ...zero,
+            accepted: false,
+            rejectionReason: 'name-invalid',
+            reasons: [`tool name "${proposal.spec.name}" is not namespaced "${AUTHORED_PREFIX}*" — refusing to avoid shadowing a built-in`],
+        };
+    }
     // Fail-closed: a scenario with no held-out cases can't defend against gaming.
     if (scenario.heldOutCases.length === 0) {
         return {

package/dist/agent/self-improvement/tool-skill-mutator.d.ts

@@ -35,6 +35,6 @@ export declare class LiveToolMutator implements ToolMutatorPort {
 /**
  * Re-register persisted authored tools into both registries at startup. Does NOT
  * re-persist (it's loading what's already on disk). Returns the names loaded.
- * Gated by callers on CODEBUDDY_SELF_IMPROVE.
+ * Every persisted spec is re-gated by `register`; callers may load it at boot.
  */
 export declare function loadAuthoredTools(workDir?: string): string[];

package/dist/agent/self-improvement/tool-skill-mutator.js

@@ -9,8 +9,9 @@
  */
 import { FormalToolRegistry } from '../../tools/registry/tool-registry.js';
 import { getToolRegistry } from '../../tools/registry.js';
-import { buildAuthoredTool } from './authored-tool-runtime.js';
+import { AUTHORED_PREFIX, buildAuthoredTool } from './authored-tool-runtime.js';
 import { AuthoredToolStore } from './authored-tool-store.js';
+import { inspectAuthoredCode } from './authored-artifact-gate.js';
 /** Dual-registry mutator over the live singletons, with optional disk persistence. */
 export class LiveToolMutator {
     persist;
@@ -20,6 +21,23 @@ export class LiveToolMutator {
         this.store = options.store ?? new AuthoredToolStore();
     }
     register(spec) {
+        // Hard backstop for the namespace invariant: registration uses
+        // `override: true`, so a spec named `bash`/`read_file` would silently
+        // REPLACE the built-in and route the model's calls to sandboxed authored
+        // code (bypassing e.g. the bash command validator). Only the LLM proposer
+        // applies `toAuthoredName`; a hand-built ToolProposal, a StaticToolProposer
+        // fixture, or a tampered persisted spec would otherwise slip through.
+        if (!spec.name.startsWith(AUTHORED_PREFIX)) {
+            throw new Error(`refusing to register tool "${spec.name}": authored tools must be namespaced "${AUTHORED_PREFIX}*" (never shadow a built-in)`);
+        }
+        // Même backstop pour la sûreté du code : les appelants légitimes
+        // (register_tool, tool-gate) pré-scannent, mais un spec persisté trafiqué
+        // ou un appel direct ne doit avoir AUCUN chemin d'enregistrement sans le
+        // scan G1. Si le test gardien no-backdoor casse, STOP — sécuriser d'abord.
+        const scan = inspectAuthoredCode(spec.code, 'code');
+        if (!scan.ok) {
+            throw new Error(`refusing to register tool "${spec.name}": ${scan.reasons.join('; ')}`);
+        }
         const tool = buildAuthoredTool(spec);
         FormalToolRegistry.getInstance().register(tool, { override: true });
         const definition = {
@@ -56,7 +74,7 @@ export class LiveToolMutator {
 /**
  * Re-register persisted authored tools into both registries at startup. Does NOT
  * re-persist (it's loading what's already on disk). Returns the names loaded.
- * Gated by callers on CODEBUDDY_SELF_IMPROVE.
+ * Every persisted spec is re-gated by `register`; callers may load it at boot.
  */
 export function loadAuthoredTools(workDir) {
     const store = new AuthoredToolStore(workDir ? { workDir } : {});

package/dist/agent/self-improvement/tool-types.d.ts

@@ -6,10 +6,10 @@
  * @module agent/self-improvement/tool-types
  */
 import type { AuthoredToolSpec } from './authored-tool-runtime.js';
-/** One behavioural assertion: run the tool on `input`, output must contain ALL of `expectIncludes`. */
+/** One behavioural assertion: run the tool on `input`, output must equal `expectedOutput` after whitespace normalization. */
 export interface ToolCase {
     input: Record<string, unknown>;
-    expectIncludes: string[];
+    expectedOutput: string;
 }
 /**
  * A behavioural benchmark for an authored tool. `visibleCases` describe the
@@ -31,8 +31,10 @@ export interface ToolProposal {
     targetScenarioId: string;
     experienceId?: string;
     spec: AuthoredToolSpec;
+    /** Optional source of the tool before mutation; enables the shared G0 AST novelty gate. */
+    parentCode?: string;
 }
-export type ToolGateRejection = 'static-scan' | 'visible-fail' | 'heldout-fail';
+export type ToolGateRejection = 'ast-identical' | 'static-scan' | 'name-invalid' | 'visible-fail' | 'heldout-fail';
 export interface ToolGateOutcome {
     accepted: boolean;
     proposalId: string;