@snowyroad/braid 0.94.0 → 0.96.0

package/dist/cli.js

@@ -29,6 +29,7 @@ import {
   classifyFatal,
   configDir,
   createAdapter,
+  createEphemeralLisaAdapter,
   createWorkspaceNoticeGate,
   decodeInvite,
   distinctWorkspaceNames,
@@ -40,6 +41,7 @@ import {
   interactiveResumeSpecFor,
   isAddressed,
   isAddressedByReply,
+  isFilesystemRoot,
   isShellSafeName,
   legacyTwinPath,
   listAgents,
@@ -74,7 +76,7 @@ import {
   updateAgentWorkspace,
   validateRelayWsUrl,
   wsToHttp
-} from "./chunk-267GOUH7.js";
+} from "./chunk-2TZT7YDG.js";
 import {
   clampUntrusted,
   externalSourceLabel,
@@ -289,7 +291,8 @@ function buildFlowPrompt(signal, agentName, channelId, toolMode = "readonly", ca
     ].filter((line, i, arr) => !(line === "" && arr[i - 1] === "")).join("\n");
   }
   const isSynthesis = signal.kind === "synthesis";
-  const header = isSynthesis ? `You are ${agentName} and the TEAM LEAD for this Braid bounded discussion.` : `You are ${agentName} responding in an Braid bounded discussion.`;
+  const lisaRole = signal.lisa?.role;
+  const header = lisaRole === "builder" ? `You are the BUILDER in an iteration loop. Produce the next revision of the artifact. End with the COMMIT: <ref> line.` : lisaRole === "critic" ? `You are a BLIND CRITIC. Judge ONLY the artifact below \u2014 you cannot see the builder's reasoning or other critics. Your report MUST contain the ARTIFACT-SHA, SCORE, and WORST lines exactly as the instructions specify.` : isSynthesis ? `You are ${agentName} and the TEAM LEAD for this Braid bounded discussion.` : `You are ${agentName} responding in an Braid bounded discussion.`;
   const role = signal.rolePrompt ? `${fence("flow role description (supplied by flow configuration)", signal.rolePrompt)}
 ` : "";
   const ctx = signal.contextPrompt ? `${fence("flow context (supplied by flow configuration)", signal.contextPrompt)}
@@ -362,7 +365,7 @@ function externalTaintOf(messages) {
   return { preambleLabel: "an external source", fenceLabel: "external message" };
 }
 var ChannelSession = class {
-  constructor(adapter, onReply, agentName, channelId, flow, fetchContext, beacon, toolMode = "readonly", holdCatchUpMaxMentions = 3, fetchPrivateContext, channelName, operator) {
+  constructor(adapter, onReply, agentName, channelId, flow, fetchContext, beacon, toolMode = "readonly", holdCatchUpMaxMentions = 3, fetchPrivateContext, channelName, operator, makeEphemeralAdapter) {
     this.adapter = adapter;
     this.onReply = onReply;
     this.agentName = agentName;
@@ -375,6 +378,7 @@ var ChannelSession = class {
     this.fetchPrivateContext = fetchPrivateContext;
     this.channelName = channelName;
     this.operator = operator;
+    this.makeEphemeralAdapter = makeEphemeralAdapter;
   }
   adapter;
   onReply;
@@ -388,6 +392,7 @@ var ChannelSession = class {
   fetchPrivateContext;
   channelName;
   operator;
+  makeEphemeralAdapter;
   session = null;
   roster = [];
   /** Replace the known peer roster (situational facts surfaced per message). */
@@ -434,6 +439,17 @@ var ChannelSession = class {
    * invocation regardless; a flow turn before any message frame narrows nothing.
    */
   lastBundleMode;
+  /** The options this session was started with (model, mcpServers, env, health, ...).
+   *  Reused verbatim to construct each lisa ephemeral adapter's start() call, so a
+   *  fresh-session turn runs with the SAME provider/tool wiring as the warm session
+   *  minus persistence. Set once in start(); null before then.
+   *  G2 (lisa loop, D13 review Minor 3): `mcpServers` here is this channel's broker
+   *  tool advertisement, replayed VERBATIM into the ephemeral (possibly blind-critic)
+   *  session below. Safe today only because the broker exposes no channel/flow
+   *  message-READ route (see the matching note in src/mcp/broker.ts's handle()) — a
+   *  future one would leak the transcript the relay deliberately withholds from a
+   *  blind critic straight through this replay. */
+  startOpts = null;
   /** Mode-aware prompt head: the untrusted-content framing plus the one-line
    *  truth about tool access (both OUTSIDE all fences, once per prompt).
    *  `externalLabel`, when present (e.g. "Slack", "Discord"), selects the
@@ -456,6 +472,7 @@ ${toolStatusLine(mode, cause)}
 ${operatorFacts}`;
   }
   async start(opts) {
+    this.startOpts = opts;
     this.session = await this.adapter.start(opts);
     const notifier = makeTurnErrorNotifier((_ch, text) => this.onReply(text));
     this.session.onTurn((full, usage, turnId) => {
@@ -540,6 +557,80 @@ ${fence("reactions", formatReactions(msg.reactions))}
     this.pendingModes.push(effectiveMode);
     this.session.submit(capPrompt(head + instructions), narrowestOverride(effectiveMode, this.toolMode));
   }
+  /** BL-193: flow turns honor the channel's bound bundle mode for parity with the
+   *  channel_message path — same narrow-only rule (G7: never widens), fed by the
+   *  last-seen frame mode since flow signals carry none. The override threaded to
+   *  converseLocal is the enforcement-layer half; effectiveMode + cause make the
+   *  prompt framing truthful (BL-203: a full operator narrowed by the channel is
+   *  told the CHANNEL restricts it, not its own mode). Shared by both the warm and
+   *  the lisa-ephemeral flow-turn paths so they can never drift. */
+  flowModeAndCause() {
+    const effectiveMode = narrowestMode(this.lastBundleMode, this.toolMode);
+    const cause = effectiveMode === "readonly" && this.toolMode !== "readonly" ? "channel" : "operator";
+    return { effectiveMode, cause };
+  }
+  /**
+   * D13/D20 (lisa fresh-session turns): run the turn on a FRESH, ONE-SHOT provider
+   * session — never the channel's warm session/sessionStore entry, never
+   * saveStoredSession. Constructs the ephemeral adapter, starts it (no persistence
+   * wired ⇒ AcpClient's newSession path), submits EXACTLY ONE turn via
+   * converseLocalWithUsage, and tears it down in a finally so a failure mid-turn
+   * still disposes it. Posts the reply with lisaFresh:true and the turn's REAL usage
+   * (from the ephemeral adapter's own isolated usage source — see
+   * createEphemeralLisaAdapter). FAILURE POLICY (hard rule, D20): if the ephemeral
+   * adapter fails to start, OR the turn itself fails, this REJECTS — nothing posts,
+   * and the relay watchdog re-notifies the builder. Never falls back to the warm
+   * session or fabricates freshness/usage.
+   */
+  async runLisaFreshTurn(signal) {
+    if (!this.flow) {
+      throw new Error(
+        "[braid] lisa fresh-session turn requested but flow routing is unavailable for this session"
+      );
+    }
+    if (!this.makeEphemeralAdapter) {
+      throw new Error(
+        "[braid] lisa fresh-session turn requested but no ephemeral adapter factory is wired for this session"
+      );
+    }
+    const startOpts = this.startOpts;
+    if (!startOpts) throw new Error("ChannelSession not started");
+    const { effectiveMode, cause } = this.flowModeAndCause();
+    const prompt = buildFlowPrompt(
+      signal,
+      this.agentName,
+      this.channelId,
+      effectiveMode,
+      cause,
+      this.channelName?.(this.channelId)
+    );
+    this.beacon?.begin();
+    try {
+      const ephemeral = this.makeEphemeralAdapter();
+      const ephemeralSession = await ephemeral.start(startOpts);
+      try {
+        if (!ephemeralSession.converseLocalWithUsage) {
+          throw new Error("[braid] ephemeral lisa adapter does not support converseLocalWithUsage");
+        }
+        const { text, usage } = await ephemeralSession.converseLocalWithUsage(
+          capPrompt(prompt),
+          narrowestOverride(effectiveMode, this.toolMode)
+        );
+        await this.flow.postReply(signal.flowId, text.trim() || "(no response)", usage, signal.dispatchId, true);
+      } finally {
+        try {
+          await ephemeralSession.stop();
+        } catch (stopErr) {
+          console.warn(
+            "[braid] failed to dispose the ephemeral lisa adapter (leaked subprocess risk):",
+            String(stopErr?.message ?? stopErr)
+          );
+        }
+      }
+    } finally {
+      this.beacon?.end();
+    }
+  }
   /**
    * Run one bounded-flow turn or synthesis. Frames a MUST-RESPOND prompt (no
    * `<<silent>>`), runs it through the SAME warm session via converseLocal (so the
@@ -547,9 +638,18 @@ ${fence("reactions", formatReactions(msg.reactions))}
    * endpoint. A minimal turn_notification carries no transcript, so we backfill it
    * from the relay first. An empty reply still posts a fallback so the relay-blocked
    * flow advances rather than timing out.
+   *
+   * D13/D20: a signal carrying `lisa.freshSession:true` is routed to runLisaFreshTurn
+   * instead — an entirely separate, one-shot ephemeral session. Every other signal
+   * (including a lisa signal without freshSession) runs unchanged, below, on the warm
+   * session.
    */
   async runFlowTurn(signal) {
     if (!this.session) throw new Error("ChannelSession not started");
+    if (signal.lisa?.freshSession) {
+      await this.runLisaFreshTurn(signal);
+      return;
+    }
     if (!this.session.converseLocal || !this.flow) {
       console.warn("[braid] flow turn skipped: warm aside / flow routing unavailable");
       return;
@@ -557,9 +657,8 @@ ${fence("reactions", formatReactions(msg.reactions))}
     this.beacon?.begin();
     try {
       let history = signal.history;
-      if (history.length === 0) history = await this.flow.fetchHistory(signal.flowId);
-      const effectiveMode = narrowestMode(this.lastBundleMode, this.toolMode);
-      const cause = effectiveMode === "readonly" && this.toolMode !== "readonly" ? "channel" : "operator";
+      if (history.length === 0 && !signal.lisa) history = await this.flow.fetchHistory(signal.flowId);
+      const { effectiveMode, cause } = this.flowModeAndCause();
       const prompt = buildFlowPrompt(
         { ...signal, history },
         this.agentName,
@@ -2537,7 +2636,8 @@ async function startBridge(cfg, relay, deps) {
         channelId,
         {
           // BL-126: thread dispatchId from the FlowSignal through to the POST body.
-          postReply: (flowId, content, usage, dispatchId) => relay.postFlowMessage(channelId, flowId, content, usage, dispatchId),
+          // D13: also thread lisaFresh (true only for a lisa fresh-session reply).
+          postReply: (flowId, content, usage, dispatchId, lisaFresh) => relay.postFlowMessage(channelId, flowId, content, usage, dispatchId, lisaFresh),
           fetchHistory: (flowId) => relay.fetchFlowMessages(channelId, flowId)
         },
         (queryHint) => relay.fetchChannelContext(channelId, queryHint),
@@ -2559,7 +2659,13 @@ async function startBridge(cfg, relay, deps) {
         // BL-272 Task 5 (D3/D6/D7/D8): the relay's live, per-hello platform-verified
         // operator attestation for THIS agent — a thunk (not a snapshot) so a
         // reconnect's fresh hello is reflected on the very next prompt.
-        () => relay.operator()
+        () => relay.operator(),
+        // D13/D20: construct a FRESH ephemeral adapter per lisa turn (never memoized).
+        // Absent when the caller's deps omit makeEphemeralAdapter (e.g. a test using
+        // only makeAdapter) — a lisa fresh-session signal then fails loudly instead of
+        // silently running on the warm session. Ordered AFTER operator to match the
+        // merged ChannelSession constructor param order (session.ts).
+        deps.makeEphemeralAdapter ? () => deps.makeEphemeralAdapter(cfg) : void 0
       );
       const broker = new SourceBroker(channelId, relay);
       const brokerInfo = await broker.start();
@@ -2847,7 +2953,9 @@ async function createAndStartBridge(cfg, deps = {}) {
   );
   const rawMakeAdapter = deps.makeAdapter ?? createAdapter;
   const makeAdapter = (c, channelId) => rawMakeAdapter(c, channelId, deps.telemetry);
-  handle = await startBridge(cfg, relay, { makeAdapter, onReady: deps.onReady, cardCache: deps.cardCache, controlSocket: deps.controlSocket });
+  const rawMakeEphemeralAdapter = deps.makeEphemeralAdapter ?? createEphemeralLisaAdapter;
+  const makeEphemeralAdapter = (c) => rawMakeEphemeralAdapter(c, deps.telemetry);
+  handle = await startBridge(cfg, relay, { makeAdapter, makeEphemeralAdapter, onReady: deps.onReady, cardCache: deps.cardCache, controlSocket: deps.controlSocket });
   return { relay, sessions: handle.sessions, channelNames: handle.channelNames, brokers: handle.brokers, hub: handle.hub, ensureSession: handle.ensureSession, controlSocketClose: handle.controlSocketClose };
 }
 
@@ -6370,6 +6478,18 @@ async function main() {
     await initScopeRuntime(cfg, cfg.agent);
     console.log(banner("braid", "SCOPE", resolveScope(cfg, cfg.agent, process.env).describe()));
   }
+  if (cfg.toolMode === "readonly") {
+    const scopeCwd = process.cwd();
+    if (scopeCwd === homedir6()) {
+      console.error(
+        "[braid] note: started in your home directory; read-and-reply may read any non-credential file under it. Start from a project directory to narrow it."
+      );
+    } else if (isFilesystemRoot(scopeCwd, process.platform)) {
+      console.error(
+        "[braid] WARNING: no working directory (started at the filesystem root); read-and-reply will refuse file reads until you pass --allow-read <dir>."
+      );
+    }
+  }
   const runVerbose = invocation.argv.includes("--verbose");
   const sticky = createStickyLine(process.stdout);
   const connStatus = createConnStatus({

package/dist/{http-JA7L7WBG.js → http-5RVYBQJV.js}

@@ -4,7 +4,7 @@ import {
   boundedJsonFetch,
   resetHttpMetricsForTest,
   snapshotHttpMetrics
-} from "./chunk-267GOUH7.js";
+} from "./chunk-2TZT7YDG.js";
 import "./chunk-HQNAAXUM.js";
 export {
   assertHttpEndpoint,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@snowyroad/braid",
-  "version": "0.94.0",
+  "version": "0.96.0",
   "description": "Braid: connect your own coding agent (Claude Code, Codex, Gemini, Grok) to a Braid channel and collaborate with other agents and humans.",
   "license": "SEE LICENSE IN LICENSE.md",
   "author": "SnowyRoad",
@@ -36,6 +36,7 @@
   ],
   "scripts": {
     "build": "tsup",
+    "prepare": "git config core.hooksPath .githooks || true",
     "shrinkwrap:gen": "node scripts/generate-shrinkwrap.mjs",
     "prepublishOnly": "pnpm build && node scripts/generate-shrinkwrap.mjs",
     "dev": "tsx src/index.ts",