@pugi/cli 0.1.0-beta.2 → 0.1.0-beta.20

package/dist/core/engine/prompts.js

@@ -22,13 +22,62 @@ import { getJobRegistry, summarizeJobsForPrompt, } from '../jobs/registry.js';
 const COMMON_LOCAL_FIRST_PREAMBLE = [
     'You are the Pugi CLI agent running locally inside the operator\'s repository.',
     'The local filesystem is the source of truth. Every change you make is committed locally; nothing is uploaded by default (ADR-0037 local-first).',
-    'You have a tool registry: read, write, edit, grep, glob, bash, apply_patch, lsp_hover, lsp_definition, lsp_references, lsp_diagnostics, worktree_create, worktree_promote, worktree_drop. Call tools to inspect and modify the workspace.',
-    'Use lsp_hover / lsp_definition / lsp_references when you need precise symbol intel — they are faster and more reliable than grep for typed languages (TS/JS/Python/Go/Rust). Fall back to grep when the LSP server is unavailable.',
-    'Use apply_patch when you have a complete unified diff in hand (e.g. forwarded from an external review). For incremental edits, prefer edit/write over apply_patch — the failure modes are clearer.',
-    'Use worktree_create + worktree_promote when a multi-file change needs validation before landing on the operator\'s working tree. Drop the worktree with worktree_drop when done; never leave scratch worktrees around.',
+    // R1 fix (2026-05-26, PR #413 r1, Fix 5 Option B): only advertise the
+    // tools currently wired in `tool-bridge.ts::WIRED_TOOLS`. α7.7 ships
+    // apply_patch / lsp_* / worktree_* as CLI-only surfaces (`pugi patch`,
+    // `pugi lsp`, `pugi worktree`); wiring them into the engine loop is
+    // deferred to β2 (apply_patch), β4 (LSP tools), β7 (worktree tools)
+    // per the consolidated sprint plan. Advertising them in the system
+    // prompt without a matching executor entry caused Mira to attempt
+    // calls that returned `unknown_tool` — broken eval surface.
+    'You have a tool registry: read, write, edit, grep, glob, bash. Call tools to inspect and modify the workspace.',
     'Cite file paths relative to the workspace root. Keep edits minimal and reversible.',
     'When you are done, return a single final text answer that the operator can read on the CLI.',
 ].join(' ');
+/**
+ * β5a P1+P6 (2026-05-26): prompt v2 — intent marker contract +
+ * definitional examples + jargon ban. Fixes the dominant Pugi loss
+ * mode in the α7.X Phase 2 comparative eval: tool-use on pure
+ * knowledge questions ("What is grep?" → bash man grep).
+ *
+ * The CLI-side `classifyIntent` (apps/pugi-cli/src/core/engine/intent.ts)
+ * wraps definitional questions with `<intent kind="definitional">` on
+ * the user message before send. The rules below teach the model what
+ * to do with that marker.
+ *
+ * Voice constraint: same banned-jargon list as the cabinet Mira
+ * persona (брифую / диспатчу / шипаю and the English jargon list
+ * from BANNED_WORDS in mira.system-prompt.ts). Repeated here verbatim
+ * so the CLI surface has its own enforcement copy; the cabinet copy
+ * is the source of truth and ships through the runtime persona
+ * prompt for the cabinet UI. CLI runs DO NOT load the cabinet
+ * persona prompt — engine prompts are the only place to enforce
+ * voice for `pugi explain` / `pugi code` callers.
+ */
+const INTENT_MARKER_CONTRACT = [
+    '# Intent contract',
+    'When the operator\'s message starts with `<intent kind="definitional">`, treat it as a knowledge question:',
+    '  - Answer in prose. Do NOT call any tools.',
+    '  - Cite a file from the repo only when it directly supports the explanation.',
+    '  - Keep the answer to one short paragraph unless the operator asked for depth.',
+    'When no intent marker is present OR the marker is operational, use tools as needed.',
+    '',
+    '# Definitional examples',
+    'Operator: `<intent kind="definitional">What is grep?</intent>`',
+    'You: `grep is a Unix command-line tool that searches plain text for lines matching a regular expression. It reads stdin or files and prints matching lines to stdout.`',
+    '(No tool calls. One paragraph. No file paths because grep is a generic Unix tool, not a repo artefact.)',
+    '',
+    'Operator: `<intent kind="definitional">что такое pgvector?</intent>`',
+    'You: `pgvector - это расширение PostgreSQL для хранения и поиска векторных эмбеддингов. Поддерживает ivfflat и hnsw индексы; используется для RAG и semantic search.`',
+    '(One short paragraph. No tools.)',
+].join('\n');
+const JARGON_BAN = [
+    '# Voice',
+    'Brand voice: terse, operator-grade, English in code paths / Russian-Ukrainian permitted in chat answers.',
+    'Banned words (CLI customer-facing output): "брифую", "диспатчу", "шипаю", "journey", "explore", "delight", "magical", "friendly", "let me help", "I\'d be happy to", "pug-tastic". Use neutral verbs instead: brief / dispatch / ship / build / read / write.',
+    'No em-dashes. No emoji. No "AI assistant" framing.',
+].join('\n');
+const PROMPT_V2_APPENDIX = [INTENT_MARKER_CONTRACT, JARGON_BAN].join('\n\n');
 const PLAN_TOOLS_NOTE = 'PLAN MODE IS READ-ONLY. You may call read, grep, glob. Calls to write, edit, or bash will be refused and end the run. Produce a written plan, not changes.';
 const EDIT_FLOW_RULES = [
     'Before calling edit on a file you have not yet read this session, call read first — the edit tool fails otherwise.',
@@ -37,10 +86,16 @@ const EDIT_FLOW_RULES = [
 ].join(' ');
 export function systemPromptFor(kind) {
     const base = baseSystemPromptFor(kind);
+    // β5a P1+P6: append the prompt-v2 intent-marker contract +
+    // definitional examples + jargon ban to every command kind. The
+    // appendix is shared across kinds because the marker contract +
+    // voice gate are command-agnostic — a definitional question lands
+    // the same way under `pugi explain` and `pugi code`.
+    const withV2 = `${base}\n\n${PROMPT_V2_APPENDIX}`;
     const snapshot = formatBackgroundJobsSnapshot(getJobRegistrySafely());
     if (!snapshot)
-        return base;
-    return `${base}\n\n${snapshot}`;
+        return withV2;
+    return `${withV2}\n\n${snapshot}`;
 }
 function baseSystemPromptFor(kind) {
     switch (kind) {

package/dist/core/engine/strip-internal-fields.js

@@ -0,0 +1,124 @@
+/**
+ * α7 L3 (2026-05-27) — leak-parity: underscore-prefix internal-fields filter.
+ *
+ * The convention (observed in the leaked Claude Code BashTool surface and
+ * codified in `docs/research/2026-05-27-pugi-gap-analysis-3-repos.md` §1)
+ * is that tool-argument fields whose names start with a leading underscore
+ * are INTERNAL — populated by the dispatcher at call time (sessionId,
+ * tenantId, correlation handles, hook context, ask-modal bridge handles)
+ * but never advertised to the model. The model schema MUST omit them so:
+ *
+ *   1. No token cost — internal context never burns model budget.
+ *   2. No fabrication risk — the model cannot hallucinate values for
+ *      sessionId / tenantId / etc. because the field is invisible.
+ *   3. No leak surface — implementation detail stays implementation detail.
+ *
+ * The dispatcher (see `tool-bridge.ts::buildExecutor`) does NOT strip these
+ * fields at call time. It passes the full args record (including any
+ * `_internal*` keys an upstream layer injected) straight to the tool
+ * handler. Only the schema surface that the engine adapter ships to the
+ * model is filtered.
+ *
+ * This module is intentionally narrow: it accepts a JSON Schema fragment
+ * and returns a deep clone with `_`-prefixed keys removed from every
+ * `properties` map encountered while walking, and with `required` filtered
+ * to drop any references to those keys. It descends into nested object
+ * schemas and into the `items` schema of arrays. It is JSON-Schema-version
+ * agnostic (works on draft-07, 2019-09, 2020-12 alike) because it only
+ * inspects `properties`/`required`/`items` and leaves the rest of the
+ * fragment alone.
+ *
+ * Edge cases handled:
+ *   - `_` alone (single underscore) is treated as internal and stripped.
+ *   - Nested object schemas inside `properties` get the same treatment
+ *     (a sub-property whose name starts with `_` is removed too).
+ *   - Array `items` are walked. Tuple schemas (`items` as array) are
+ *     walked element-by-element.
+ *   - `oneOf`/`anyOf`/`allOf` branches are walked.
+ *   - Non-object inputs (null, primitives, arrays passed as the root)
+ *     are returned as-is — defensive no-op, never throws.
+ *
+ * Contract notes:
+ *   - Pure function. Input is never mutated.
+ *   - Output is a deep clone — every nested object/array is freshly
+ *     allocated so callers can mutate safely.
+ *   - JSON-only — does not preserve symbols, getters, or class instances
+ *     because JSON Schema is plain-data by spec.
+ */
+const INTERNAL_PREFIX = '_';
+/**
+ * Returns true when the field name should be stripped from the model-
+ * facing schema. Leading underscore is the contract — single `_` is also
+ * stripped (no escape hatch). Empty-string keys (which are technically
+ * valid JSON) are left alone so we do not silently drop them.
+ */
+export function isInternalFieldName(name) {
+    return name.length > 0 && name.startsWith(INTERNAL_PREFIX);
+}
+/**
+ * Strip `_`-prefixed properties from a JSON Schema fragment. Recursively
+ * walks nested object schemas and array `items`. Returns a deep clone;
+ * the input is never mutated.
+ *
+ * Pass-through behaviour:
+ *   - Non-object / null / array inputs round-trip unchanged (as deep
+ *     clones where applicable).
+ *   - Fragments with no `properties` key are returned as deep clones
+ *     after walking `items`/`oneOf`/`anyOf`/`allOf`.
+ */
+export function stripInternalFields(schema) {
+    if (schema === null || typeof schema !== 'object')
+        return schema;
+    if (Array.isArray(schema)) {
+        return schema.map((item) => stripInternalFields(item));
+    }
+    return walkObject(schema);
+}
+function walkObject(node) {
+    const out = {};
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'properties' && value !== null && typeof value === 'object' && !Array.isArray(value)) {
+            out[key] = walkProperties(value);
+            continue;
+        }
+        if (key === 'required' && Array.isArray(value)) {
+            out[key] = value.filter((entry) => typeof entry === 'string' && !isInternalFieldName(entry));
+            continue;
+        }
+        if (key === 'items') {
+            out[key] = stripInternalFields(value);
+            continue;
+        }
+        if (key === 'oneOf' || key === 'anyOf' || key === 'allOf') {
+            if (Array.isArray(value)) {
+                out[key] = value.map((branch) => stripInternalFields(branch));
+                continue;
+            }
+        }
+        // Default: deep-clone any nested objects/arrays so the caller can
+        // mutate freely without touching the input. Primitives pass through.
+        out[key] = cloneJson(value);
+    }
+    return out;
+}
+function walkProperties(props) {
+    const out = {};
+    for (const [propName, propSchema] of Object.entries(props)) {
+        if (isInternalFieldName(propName))
+            continue;
+        out[propName] = stripInternalFields(propSchema);
+    }
+    return out;
+}
+function cloneJson(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => cloneJson(item));
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+        out[key] = cloneJson(val);
+    }
+    return out;
+}
+//# sourceMappingURL=strip-internal-fields.js.map