@pugi/cli 0.1.0-beta.8 → 0.1.0-beta.87

package/dist/core/engine/prompts.js

@@ -1,19 +1,21 @@
 import { getJobRegistry, summarizeJobsForPrompt, } from '../jobs/registry.js';
+import { compileStyleBlock } from '../output-style/presets.js';
+import { resolveOutputStyle } from '../output-style/state.js';
 /**
  * System prompts for each engine command. Each prompt:
- *   - Anchors the model in Pugi's local-first contract (ADR-0037).
- *   - Lists the tools the model may call (the registry is authoritative,
- *     but stating it inline prevents the model from inventing tool names
- *     when the tool schema is large).
- *   - Defines the deliverable shape so the model produces a useful final
- *     text answer instead of "here is what I did".
+ *  - Anchors the model in Pugi's local-first contract .
+ *  - Lists the tools the model may call (the registry is authoritative,
+ *    but stating it inline prevents the model from inventing tool names
+ *    when the tool schema is large).
+ *  - Defines the deliverable shape so the model produces a useful final
+ *    text answer instead of "here is what I did".
  *
  * The prompts are intentionally terse. Per gstack `engineering-standards`
  * the persona system prompt comes from the runtime (Anvil bridge
  * prepends `oes-dev` / Sigma prompt automatically when configured); these
  * prompts ride on top and scope the model to the current command.
  *
- * Sprint α5.9 (ADR-0056 PR-PUGI-CLI-M1-GAP-J): the system prompt picks up
+ * Sprint : the system prompt picks up
  * a `BACKGROUND JOBS:` snapshot appended at the tail so the agent loop
  * knows what background bash work is currently on watch and can avoid
  * spawning a duplicate. The snapshot is sourced from `JobRegistry` and
@@ -21,23 +23,114 @@ import { getJobRegistry, summarizeJobsForPrompt, } from '../jobs/registry.js';
  */
 const COMMON_LOCAL_FIRST_PREAMBLE = [
     'You are the Pugi CLI agent running locally inside the operator\'s repository.',
-    'The local filesystem is the source of truth. Every change you make is committed locally; nothing is uploaded by default (ADR-0037 local-first).',
+    'The local filesystem is the source of truth. Every change you make is committed locally; nothing is uploaded by default .',
+    // R1 fix (2026-05-26, PR r1, Fix 5 Option B): only advertise the
+    // tools currently wired in `tool-bridge.ts::WIRED_TOOLS`. ships
+    // apply_patch / lsp_* / worktree_* as CLI-only surfaces (`pugi patch`,
+    // `pugi lsp`, `pugi worktree`); wiring them into the engine loop is
+    // deferred to β2 (apply_patch), β4 (LSP tools), β7 (worktree tools)
+    // per the consolidated sprint plan. Advertising them in the system
+    // prompt without a matching executor entry caused Pugi to attempt
+    // calls that returned `unknown_tool` — broken eval surface.
     'You have a tool registry: read, write, edit, grep, glob, bash. Call tools to inspect and modify the workspace.',
     'Cite file paths relative to the workspace root. Keep edits minimal and reversible.',
     'When you are done, return a single final text answer that the operator can read on the CLI.',
 ].join(' ');
+/**
+ * β5a P1+P6 : prompt v2 — intent marker contract +
+ * definitional examples + jargon ban. Fixes the dominant Pugi loss
+ * mode in the .X Phase 2 comparative eval: tool-use on pure
+ * knowledge questions ("What is grep?" → bash man grep).
+ *
+ * The CLI-side `classifyIntent` (apps/pugi-cli/src/core/engine/intent.ts)
+ * wraps definitional questions with `<intent kind="definitional">` on
+ * the user message before send. The rules below teach the model what
+ * to do with that marker.
+ *
+ * Voice constraint: same banned-jargon list as the cabinet Pugi
+ * persona (брифую / диспатчу / шипаю and the English jargon list
+ * from BANNED_WORDS in mira.system-prompt.ts). Repeated here verbatim
+ * so the CLI surface has its own enforcement copy; the cabinet copy
+ * is the source of truth and ships through the runtime persona
+ * prompt for the cabinet UI. CLI runs DO NOT load the cabinet
+ * persona prompt — engine prompts are the only place to enforce
+ * voice for `pugi explain` / `pugi code` callers.
+ */
+const INTENT_MARKER_CONTRACT = [
+    '# Intent contract',
+    'When the operator\'s message starts with `<intent kind="definitional">`, treat it as a knowledge question:',
+    ' - Answer in prose. Do NOT call any tools.',
+    ' - Cite a file from the repo only when it directly supports the explanation.',
+    ' - Keep the answer to one short paragraph unless the operator asked for depth.',
+    'When no intent marker is present OR the marker is operational, use tools as needed.',
+    '',
+    '# Definitional examples',
+    'Operator: `<intent kind="definitional">What is grep?</intent>`',
+    'You: `grep is a Unix command-line tool that searches plain text for lines matching a regular expression. It reads stdin or files and prints matching lines to stdout.`',
+    '(No tool calls. One paragraph. No file paths because grep is a generic Unix tool, not a repo artefact.)',
+    '',
+    'Operator: `<intent kind="definitional">что такое pgvector?</intent>`',
+    'You: `pgvector - это расширение PostgreSQL для хранения и поиска векторных эмбеддингов. Поддерживает ivfflat и hnsw индексы; используется для RAG и semantic search.`',
+    '(One short paragraph. No tools.)',
+].join('\n');
+const JARGON_BAN = [
+    '# Voice',
+    'Brand voice: terse, operator-grade, English in code paths / Russian-Ukrainian permitted in chat answers.',
+    'Banned words (CLI customer-facing output): "брифую", "диспатчу", "шипаю", "journey", "explore", "delight", "magical", "friendly", "let me help", "I\'d be happy to", "pug-tastic". Use neutral verbs instead: brief / dispatch / ship / build / read / write.',
+    'No em-dashes. No emoji. No "AI assistant" framing.',
+].join('\n');
+const PROMPT_V2_APPENDIX = [INTENT_MARKER_CONTRACT, JARGON_BAN].join('\n\n');
 const PLAN_TOOLS_NOTE = 'PLAN MODE IS READ-ONLY. You may call read, grep, glob. Calls to write, edit, or bash will be refused and end the run. Produce a written plan, not changes.';
 const EDIT_FLOW_RULES = [
     'Before calling edit on a file you have not yet read this session, call read first — the edit tool fails otherwise.',
     'Prefer edit over write when changing existing files; write only for newly created files.',
     'After your last tool call, summarise what you changed and what the operator should review.',
+    // Backlog — Layer A.5 fuzzy ladder advisory. The operator may
+    // have run with `--fuzzy-edits`; the ladder is invisible to the
+    // model but the model should still anchor its SEARCH blocks on
+    // verbatim source when possible. Ellipsis is the only relaxation
+    // we want the model к reach for explicitly; whitespace + edit-
+    // distance fire automatically and silently when they're needed.
+    'If exact SEARCH match fails, the dispatcher may retry with a fuzzy ladder (whitespace-flex → ellipsis → 0.8 edit-distance). Prefer exact match; use `...` ellipsis only when you explicitly need to skip a long unchanged middle.',
 ].join(' ');
 export function systemPromptFor(kind) {
     const base = baseSystemPromptFor(kind);
+    // β5a P1+P6: append the prompt-v2 intent-marker contract +
+    // definitional examples + jargon ban to every command kind. The
+    // appendix is shared across kinds because the marker contract +
+    // voice gate are command-agnostic — a definitional question lands
+    // the same way under `pugi explain` and `pugi code`.
+    const withV2 = `${base}\n\n${PROMPT_V2_APPENDIX}`;
+    // output-style preset block. Compiled from
+    // workspace > user > default precedence. The `default` preset
+    // returns an empty block (no override over the base voice), so the
+    // injection is a no-op for the most-common case. Wrapped in
+    // try/catch — every IO failure inside `resolveOutputStyle` already
+    // degrades to the default slug, but defence in depth keeps the
+    // engine prompt assembly from ever crashing on a hand-edited
+    // config.json.
+    const styleBlock = formatOutputStyleBlock();
+    const withStyle = styleBlock ? `${withV2}\n\n${styleBlock}` : withV2;
     const snapshot = formatBackgroundJobsSnapshot(getJobRegistrySafely());
     if (!snapshot)
-        return base;
-    return `${base}\n\n${snapshot}`;
+        return withStyle;
+    return `${withStyle}\n\n${snapshot}`;
+}
+/**
+ * Resolve the active output-style preset for the current process
+ * and compile it into a prompt block. Returns empty string for the
+ * default preset OR for any unexpected IO failure so the engine
+ * prompt assembly path is unaffected by a missing / malformed
+ * config.json.
+ */
+function formatOutputStyleBlock() {
+    try {
+        const resolved = resolveOutputStyle({ workspaceRoot: process.cwd() });
+        return compileStyleBlock(resolved.slug);
+    }
+    catch {
+        return '';
+    }
 }
 function baseSystemPromptFor(kind) {
     switch (kind) {
@@ -107,12 +200,37 @@ function getJobRegistrySafely() {
     }
 }
 /**
- * Anvil persona slug to invoke per command. Today every command routes
- * to `oes-dev` (Sigma) — the Tier-2 reviewer persona already configured
- * for Pugi runtime work. When we add per-command personas (e.g. `pugi-
- * planner`, `pugi-coder`) this is the single switch to update.
+ * Anvil persona slug to invoke per command. Routes each engine command
+ * to the appropriate Tier-1 persona from PERSONA_REGISTRY (admin-api/
+ * src/pugi-runtime/personas/persona-dispatch.ts):
+ *
+ *  - code / fix / build → 'dev' (Hiroshi, coder, Sonnet codegen tag)
+ *  - plan              → 'architect' (Marcus, architect, Sonnet reason)
+ *  - explain           → 'main' (Pugi orchestrator, DeepSeek reason)
+ *
+ * Previously this returned 'oes-dev' unconditionally — that is an OES
+ * C++ reviewer persona, wrong tool set + wrong system prompt for
+ * customer dispatches. CEO live trace #53.
+ *
+ * Operator override: PUGI_ENGINE_PERSONA_<COMMAND> env (e.g.
+ * PUGI_ENGINE_PERSONA_CODE=frontend pins Mia for the next dispatch).
  */
-export function personaSlugFor(_kind) {
-    return 'oes-dev';
+export function personaSlugFor(kind) {
+    const envKey = `PUGI_ENGINE_PERSONA_${kind.toUpperCase()}`;
+    const override = process.env[envKey];
+    if (override && override.length > 0)
+        return override;
+    switch (kind) {
+        case 'code':
+        case 'fix':
+        case 'build':
+            return 'dev';
+        case 'plan':
+            return 'architect';
+        case 'explain':
+            return 'main';
+        default:
+            return 'main';
+    }
 }
 //# sourceMappingURL=prompts.js.map

package/dist/core/engine/strip-internal-fields.js

@@ -0,0 +1,124 @@
+/**
+ * L3 — leak-parity: underscore-prefix internal-fields filter.
+ *
+ * The convention (observed in the leaked the upstream tool BashTool surface and
+ * codified in `docs/research/2026-05-27-pugi-.md` §1)
+ * is that tool-argument fields whose names start with a leading underscore
+ * are INTERNAL — populated by the dispatcher at call time (sessionId,
+ * tenantId, correlation handles, hook context, ask-modal bridge handles)
+ * but never advertised to the model. The model schema MUST omit them so:
+ *
+ *  1. No token cost — internal context never burns model budget.
+ *  2. No fabrication risk — the model cannot hallucinate values for
+ *     sessionId / tenantId / etc. because the field is invisible.
+ *  3. No leak surface — implementation detail stays implementation detail.
+ *
+ * The dispatcher (see `tool-bridge.ts::buildExecutor`) does NOT strip these
+ * fields at call time. It passes the full args record (including any
+ * `_internal*` keys an upstream layer injected) straight to the tool
+ * handler. Only the schema surface that the engine adapter ships to the
+ * model is filtered.
+ *
+ * This module is intentionally narrow: it accepts a JSON Schema fragment
+ * and returns a deep clone with `_`-prefixed keys removed from every
+ * `properties` map encountered while walking, and with `required` filtered
+ * to drop any references to those keys. It descends into nested object
+ * schemas and into the `items` schema of arrays. It is JSON-Schema-version
+ * agnostic (works on draft-07, 2019-09, 2020-12 alike) because it only
+ * inspects `properties`/`required`/`items` and leaves the rest of the
+ * fragment alone.
+ *
+ * Edge cases handled:
+ *  - `_` alone (single underscore) is treated as internal and stripped.
+ *  - Nested object schemas inside `properties` get the same treatment
+ *    (a sub-property whose name starts with `_` is removed too).
+ *  - Array `items` are walked. Tuple schemas (`items` as array) are
+ *    walked element-by-element.
+ *  - `oneOf`/`anyOf`/`allOf` branches are walked.
+ *  - Non-object inputs (null, primitives, arrays passed as the root)
+ *    are returned as-is — defensive no-op, never throws.
+ *
+ * Contract notes:
+ *  - Pure function. Input is never mutated.
+ *  - Output is a deep clone — every nested object/array is freshly
+ *    allocated so callers can mutate safely.
+ *  - JSON-only — does not preserve symbols, getters, or class instances
+ *    because JSON Schema is plain-data by spec.
+ */
+const INTERNAL_PREFIX = '_';
+/**
+ * Returns true when the field name should be stripped from the model-
+ * facing schema. Leading underscore is the contract — single `_` is also
+ * stripped (no escape hatch). Empty-string keys (which are technically
+ * valid JSON) are left alone so we do not silently drop them.
+ */
+export function isInternalFieldName(name) {
+    return name.length > 0 && name.startsWith(INTERNAL_PREFIX);
+}
+/**
+ * Strip `_`-prefixed properties from a JSON Schema fragment. Recursively
+ * walks nested object schemas and array `items`. Returns a deep clone;
+ * the input is never mutated.
+ *
+ * Pass-through behaviour:
+ *  - Non-object / null / array inputs round-trip unchanged (as deep
+ *    clones where applicable).
+ *  - Fragments with no `properties` key are returned as deep clones
+ *    after walking `items`/`oneOf`/`anyOf`/`allOf`.
+ */
+export function stripInternalFields(schema) {
+    if (schema === null || typeof schema !== 'object')
+        return schema;
+    if (Array.isArray(schema)) {
+        return schema.map((item) => stripInternalFields(item));
+    }
+    return walkObject(schema);
+}
+function walkObject(node) {
+    const out = {};
+    for (const [key, value] of Object.entries(node)) {
+        if (key === 'properties' && value !== null && typeof value === 'object' && !Array.isArray(value)) {
+            out[key] = walkProperties(value);
+            continue;
+        }
+        if (key === 'required' && Array.isArray(value)) {
+            out[key] = value.filter((entry) => typeof entry === 'string' && !isInternalFieldName(entry));
+            continue;
+        }
+        if (key === 'items') {
+            out[key] = stripInternalFields(value);
+            continue;
+        }
+        if (key === 'oneOf' || key === 'anyOf' || key === 'allOf') {
+            if (Array.isArray(value)) {
+                out[key] = value.map((branch) => stripInternalFields(branch));
+                continue;
+            }
+        }
+        // Default: deep-clone any nested objects/arrays so the caller can
+        // mutate freely without touching the input. Primitives pass through.
+        out[key] = cloneJson(value);
+    }
+    return out;
+}
+function walkProperties(props) {
+    const out = {};
+    for (const [propName, propSchema] of Object.entries(props)) {
+        if (isInternalFieldName(propName))
+            continue;
+        out[propName] = stripInternalFields(propSchema);
+    }
+    return out;
+}
+function cloneJson(value) {
+    if (value === null || typeof value !== 'object')
+        return value;
+    if (Array.isArray(value))
+        return value.map((item) => cloneJson(item));
+    const out = {};
+    for (const [key, val] of Object.entries(value)) {
+        out[key] = cloneJson(val);
+    }
+    return out;
+}
+//# sourceMappingURL=strip-internal-fields.js.map