@tea-agent/loop-agent 0.22.0 → 0.23.1

package/dist/worker/console/chat/instruction-skills.js

@@ -0,0 +1,217 @@
+/**
+ * Operator Chat — instruction skills whitelist (design §7.5 / plan D1).
+ *
+ * Hard rules (plan D1):
+ * - skills are READ-ONLY text context injected into the Chat system prompt;
+ * - skills are NEVER registered as executable tools;
+ * - the whitelist is a COMPILE-TIME constant (no runtime dir scan, no env override);
+ * - arbitrary pi extension / package tool / user-level ~/.pi/agent skill is
+ *   never discovered or loaded (V12);
+ * - project `.agents/skills/` (init projection) is NOT injected (prevents
+ *   target-repo injecting write instructions).
+ *
+ * Only the loop-agent repo's own audited skills are eligible. Workflow-specific
+ * skills are conditional on taskKind/workflow and loaded on demand (not in MVP
+ * operator-context default set).
+ */
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+/**
+ * Operator-context instruction skills (plan D1, "operator-context 允许").
+ * These are read-only methodology skills. Loaded as text context for every
+ * Chat session by default.
+ *
+ * MUST stay a compile-time constant. Adding a skill requires an ADR / plan note.
+ */
+export const OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS = Object.freeze([
+    "grill-me",
+    "systematic-debugging",
+    "code-review-core",
+    "codebase-scout",
+    "verification-before-completion",
+    "requesting-code-review",
+    "analyze-product-requirements",
+    "analyze-product-dependencies",
+    "using-git-worktrees",
+]);
+/**
+ * Meta / governance skills that must NEVER be injected into Chat context
+ * (plan D1 "元 / 治理 skill"). Injecting these would let Chat rewrite its own
+ * governance. Listed explicitly so accidental allowlist edits are caught.
+ */
+export const OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS = Object.freeze([
+    "loop-agent",
+    "agent-worker",
+    "init-capability-evolution",
+    "ai-engineering-context",
+    "grill-with-docs",
+]);
+/**
+ * Workflow-specific skills (plan D1 "workflow-specific 允许（条件）").
+ * Only injected when the corresponding taskKind / workflow is active.
+ * NOT loaded by default in MVP Chat.
+ */
+export const OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS = Object.freeze([
+    "frontend-implementation",
+    "frontend-review",
+    "frontend-verification",
+    "frontend-design-review",
+    "test-driven-development",
+    "webapp-testing",
+    "playwright-cli",
+    "playwright-cli-case-generator",
+    "browser-tools",
+]);
+const ALLOWED = new Set(OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
+const DENIED = new Set(OPERATOR_CHAT_DENIED_INSTRUCTION_SKILLS.map((s) => s.toLowerCase()));
+const CONDITIONAL = new Set(OPERATOR_CHAT_WORKFLOW_CONDITIONAL_SKILLS.map((s) => s.toLowerCase()));
+export function isOperatorChatInstructionSkillAllowed(name) {
+    return ALLOWED.has(name.trim().toLowerCase());
+}
+export function isOperatorChatInstructionSkillDenied(name) {
+    return DENIED.has(name.trim().toLowerCase());
+}
+export function isOperatorChatInstructionSkillConditional(name) {
+    return CONDITIONAL.has(name.trim().toLowerCase());
+}
+export function classifyInstructionSkill(name, options) {
+    const n = name.trim().toLowerCase();
+    if (DENIED.has(n)) {
+        return { ok: false, reason: "denied-governance", name };
+    }
+    if (ALLOWED.has(n)) {
+        return { ok: true, kind: "operator-context", name };
+    }
+    if (CONDITIONAL.has(n)) {
+        const active = options?.activeWorkflowSkills ?? [];
+        const activeLower = new Set(active.map((s) => s.toLowerCase()));
+        if (activeLower.has(n)) {
+            // Conditional skill is allowed only when explicitly activated by workflow.
+            // For MVP, conditional skills are not auto-injected; callers must opt in.
+            return { ok: false, reason: "conditional-not-active", name };
+        }
+        return { ok: false, reason: "conditional-not-active", name };
+    }
+    return { ok: false, reason: "unknown", name };
+}
+/**
+ * Parse a SKILL.md frontmatter description (first `description:` line) and
+ * return the body text (frontmatter stripped). Tolerant of missing frontmatter.
+ */
+export function parseSkillFrontmatter(raw) {
+    let description = "";
+    let bodyText = raw;
+    const hasFrontmatter = raw.trimStart().startsWith("---");
+    if (hasFrontmatter) {
+        const lines = raw.split(/\r?\n/);
+        // find closing ---
+        let closeIdx = -1;
+        for (let i = 1; i < lines.length; i++) {
+            if (lines[i].trim() === "---") {
+                closeIdx = i;
+                break;
+            }
+        }
+        if (closeIdx > 0) {
+            const fm = lines.slice(1, closeIdx).join("\n");
+            bodyText = lines.slice(closeIdx + 1).join("\n").trim();
+            const descMatch = fm.match(/^description:\s*(.+)$/m);
+            if (descMatch) {
+                description = descMatch[1].trim().replace(/^["']|["']$/g, "");
+            }
+        }
+    }
+    else {
+        bodyText = raw.trim();
+    }
+    return { description, bodyText };
+}
+/**
+ * Load the operator-context instruction skills from the loop-agent repo's own
+ * `skills/` directory and return their text bodies for system-prompt injection.
+ *
+ * Security: only names in OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS are read;
+ * any other path is rejected before filesystem access (safe-side).
+ *
+ * @param skillsDir absolute path to the loop-agent repo `skills/` directory
+ *                  (source repo / npm pack asset, NOT target project `.agents/skills/`).
+ * @param names     override list (tests); defaults to the full allowlist.
+ */
+export async function loadOperatorChatInstructionSkills(skillsDir, names) {
+    const selected = names ?? OPERATOR_CHAT_ALLOWED_INSTRUCTION_SKILLS;
+    const loaded = [];
+    const failures = [];
+    const skipped = [];
+    for (const rawName of selected) {
+        const name = rawName.trim();
+        if (!isOperatorChatInstructionSkillAllowed(name)) {
+            skipped.push(name);
+            continue;
+        }
+        // Defense in depth: reject path traversal / governance skills even if
+        // an attacker managed to mutate the allowlist at runtime.
+        if (isOperatorChatInstructionSkillDenied(name)) {
+            skipped.push(name);
+            continue;
+        }
+        const skillPath = path.join(skillsDir, name, "SKILL.md");
+        const resolved = path.resolve(skillPath);
+        const resolvedSkillsDir = path.resolve(skillsDir);
+        if (!resolved.startsWith(resolvedSkillsDir + path.sep)) {
+            failures.push({
+                name,
+                message: "path escapes skills directory",
+            });
+            continue;
+        }
+        try {
+            const raw = await readFile(resolved, "utf8");
+            const { description, bodyText } = parseSkillFrontmatter(raw);
+            loaded.push({
+                name,
+                description,
+                bodyText,
+                charCount: bodyText.length,
+            });
+        }
+        catch (error) {
+            failures.push({
+                name,
+                message: error instanceof Error ? error.message : String(error),
+            });
+        }
+    }
+    return { loaded, failures, skipped };
+}
+/** Hard cap on total injected instruction-skill chars (token budget guard). */
+export const OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET = 24_000;
+/**
+ * Compose the system-prompt fragment listing loaded instruction skills.
+ * Each skill is rendered as a bounded text block. If total chars exceed the
+ * budget, later skills are truncated (operator-context set is small enough
+ * that truncation should not trigger in practice, but the cap is enforced).
+ */
+export function composeInstructionSkillsPrompt(skills, budget = OPERATOR_CHAT_INSTRUCTION_CHAR_BUDGET) {
+    if (skills.length === 0)
+        return "";
+    const lines = [
+        "## Operator methodology context (read-only instruction skills)",
+        "",
+        "These skills are READ-ONLY context. You may reference their methodology when reasoning, but you CANNOT execute them. All actions must go through the registered operator tools.",
+        "",
+    ];
+    let used = 0;
+    for (const skill of skills) {
+        const header = `\n### ${skill.name}${skill.description ? ` — ${skill.description}` : ""}\n`;
+        const remaining = budget - used - header.length;
+        if (remaining <= 0) {
+            lines.push(`_[${skill.name}: omitted, char budget exhausted]_`);
+            break;
+        }
+        const slice = skill.bodyText.slice(0, Math.max(0, remaining));
+        lines.push(header);
+        lines.push(slice);
+        used += header.length + slice.length;
+    }
+    return lines.join("\n");
+}

package/dist/worker/console/chat/model-resolver.js

@@ -0,0 +1,106 @@
+/**
+ * Operator Chat — default model resolver (no hardcoded model).
+ *
+ * Resolves the Chat default model from the repo harness.json `executors.pi.MED`
+ * tier, then finds a concrete provider by searching the Pi SDK's
+ * `snapshot.available` model list (preferring providers whose model entry is
+ * backed by credentials).
+ *
+ * Rationale: harness.json only stores a modelId per tier (e.g. "gpt-5.5"), not
+ * a provider. The Pi SDK `getModel(provider, modelId)` requires a provider, so
+ * we search `available` for entries whose `id` matches the modelId and pick the
+ * first whose provider resolves to a configured/credentialled source. This
+ * mirrors how the user's wizard-local / configured providers surface models.
+ *
+ * This module is deliberately framework-light: it takes a repoRoot + an
+ * optional model-list snapshot and returns a `{provider, modelId}` descriptor.
+ * The Pi runtime layer turns that into a concrete SDK model via getModel.
+ */
+import { readFile } from "node:fs/promises";
+import path from "node:path";
+/** Tier keys in harness executors.pi that may override the default. */
+const EXECUTOR_TIERS = ["LOW", "MED", "HIGH"];
+/**
+ * Read executors.pi.<tier> from the repo harness.json. Returns undefined when
+ * harness.json is absent or the tier is unset / "default" sentinel.
+ *
+ * Default tier = MED (matches DAG executor model matrix convention).
+ */
+export async function readHarnessPiModelTier(repoRoot, tier = "MED") {
+    try {
+        const raw = await readFile(path.join(repoRoot, "harness.json"), "utf-8");
+        const manifest = JSON.parse(raw);
+        const pi = manifest.executors?.pi;
+        if (!pi)
+            return undefined;
+        const tierValue = pi[tier];
+        if (tierValue && tierValue !== "default")
+            return tierValue;
+        const defaultModel = pi.defaultModel;
+        if (defaultModel && defaultModel !== "default")
+            return defaultModel;
+        return undefined;
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Search the SDK's available-model list for entries matching a modelId.
+ *
+ * Matching rule: an entry matches when its `id` equals the modelId OR equals
+ * `<provider>/<modelId>` (SDK lists both bare and provider-prefixed ids).
+ *
+ * Provider preference (in order):
+ *   1. Bare-id entries (`id === modelId`) — these are the user's own provider
+ *      config (e.g. wizard-local registering `gpt-5.5`), preferred over
+ *      aggregator reseller entries (`openai/gpt-5.5` from openrouter).
+ *   2. Among matches, prefer those flagged hasCredentials=true (provider is
+ *      in the SDK's configuredProviders set).
+ *   3. Stable list order otherwise.
+ */
+export function findProviderForModelId(modelId, available) {
+    const matches = available.filter((m) => {
+        if (m.id === modelId)
+            return true;
+        if (m.id === `${m.provider}/${modelId}`)
+            return true;
+        const slash = m.id.lastIndexOf("/");
+        if (slash >= 0 && m.id.slice(slash + 1) === modelId)
+            return true;
+        return false;
+    });
+    if (matches.length === 0)
+        return undefined;
+    // Score: bare-id (0) beats prefixed (1); then hasCredentials wins; then order.
+    const score = (m) => {
+        let s = 0;
+        if (m.id !== modelId)
+            s += 1; // prefixed id is less preferred
+        if (m.hasCredentials !== true)
+            s += 2; // no credentials is less preferred
+        return s;
+    };
+    return [...matches].sort((a, b) => score(a) - score(b))[0];
+}
+/**
+ * Resolve the Chat default model descriptor. Returns undefined when no model
+ * can be resolved (harness unset + no snapshot match).
+ *
+ * @param repoRoot  repo with harness.json
+ * @param available SDK snapshot.available (already mapped to AvailableModelEntry)
+ * @param options.tier harness tier to read (default MED)
+ */
+export async function resolveDefaultChatModel(repoRoot, available, options) {
+    const modelId = await readHarnessPiModelTier(repoRoot, options?.tier ?? "MED");
+    if (!modelId)
+        return undefined;
+    const entry = findProviderForModelId(modelId, available);
+    if (!entry)
+        return undefined;
+    return {
+        provider: entry.provider,
+        modelId,
+        label: entry.name,
+    };
+}