@tomsun28/pizza 0.1.0 → 0.1.1

package/dist/core/intent/classifier.js

@@ -0,0 +1,353 @@
+/**
+ * Intent Classifier
+ *
+ * Classifies LLM-proposed tool calls by risk level and approval requirements.
+ */
+const DEFAULT_CLASSIFIER_CONFIG = {
+    require_approval_writes: true,
+    require_approval_edits: true,
+    require_approval_shell_moderate: false,
+    require_approval_unknown: true,
+};
+// ============================================================================
+// Intent Classifier
+// ============================================================================
+/**
+ * Classifies tool calls by risk level and approval requirements.
+ *
+ * Default policy:
+ * - file_read, shell_safe: auto-approve
+ * - file_write, network, unknown: require approval (configurable)
+ * - shell_moderate: auto-approve by default (configurable)
+ * - file_delete, shell_dangerous: always require approval
+ */
+export class IntentClassifier {
+    constructor(config = {}) {
+        this.config = resolveClassifierConfig(config);
+    }
+    /**
+     * Classify a tool call by name and arguments.
+     */
+    classify(toolName, args) {
+        // Built-in tool classification
+        switch (toolName) {
+            case "read":
+            case "find":
+            case "grep":
+            case "ls":
+            case "path_utils":
+                return {
+                    risk: "safe",
+                    requires_approval: false,
+                    category: "file_read",
+                    description: `Read ${args.path ?? ""}`,
+                };
+            case "write":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_writes,
+                    category: "file_write",
+                    affected_files: [String(args.path)],
+                    description: `Write to ${args.path}`,
+                };
+            case "edit":
+            case "edit_diff":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_edits,
+                    category: "file_write",
+                    affected_files: [String(args.path)],
+                    description: `Edit ${args.path}`,
+                };
+            case "cli":
+            case "bash":
+                return this._classifyBashCommand(String(args.command ?? ""));
+            case "truncate":
+                return {
+                    risk: "dangerous",
+                    requires_approval: true,
+                    category: "file_delete",
+                    description: `Truncate ${args.path ?? ""}`,
+                };
+            case "builtin":
+                return this._classifyBuiltinCommand(String(args.command ?? ""));
+            default:
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_unknown,
+                    category: "unknown",
+                    description: `Execute ${toolName}`,
+                };
+        }
+    }
+    /**
+     * Classify a bash command by its content.
+     */
+    _classifyBashCommand(command) {
+        const trimmed = command.trim();
+        const builtin = parseBuiltinInvocation(trimmed);
+        if (builtin) {
+            if (builtin.command === "read") {
+                return {
+                    risk: "safe",
+                    requires_approval: false,
+                    category: "file_read",
+                    affected_files: builtin.path ? [builtin.path] : undefined,
+                    description: `Read ${builtin.path ?? ""}`,
+                };
+            }
+            if (builtin.command === "write") {
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_writes,
+                    category: "file_write",
+                    affected_files: builtin.path ? [builtin.path] : undefined,
+                    description: `Write to ${builtin.path ?? ""}`,
+                };
+            }
+            if (builtin.command === "edit") {
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_edits,
+                    category: "file_write",
+                    affected_files: builtin.path ? [builtin.path] : undefined,
+                    description: `Edit ${builtin.path ?? ""}`,
+                };
+            }
+        }
+        // Dangerous patterns
+        const dangerousPatterns = [
+            { pattern: /\brm\s+-[a-z]*r/i, description: "Recursive delete" },
+            { pattern: /\brm\s+-[rf]\s+\//i, description: "Delete from root" },
+            { pattern: /\bsudo\s+/i, description: "Elevated privileges" },
+            { pattern: /\bcurl\b.*\|\s*bash/i, description: "Download and execute" },
+            { pattern: /\bwget\b.*\|\s*bash/i, description: "Download and execute" },
+            { pattern: /\bchmod\s+777/i, description: "World-writable permissions" },
+            { pattern: /\b>\s*\/dev\/(?!null\b)/i, description: "Redirect to device" },
+            { pattern: /\n\s*rm\s+/i, description: "Embedded delete command" },
+            { pattern: /\bdd\b/i, description: "Direct disk access" },
+            { pattern: /\bmkfs\b/i, description: "Filesystem format" },
+        ];
+        for (const { pattern, description } of dangerousPatterns) {
+            if (pattern.test(trimmed)) {
+                return {
+                    risk: "dangerous",
+                    requires_approval: true,
+                    category: "shell_dangerous",
+                    description: `DANGEROUS: ${description}`,
+                };
+            }
+        }
+        const redirectedPath = getNonNullRedirectPath(trimmed);
+        if (redirectedPath) {
+            return {
+                risk: "moderate",
+                requires_approval: this.config.require_approval_writes,
+                category: "file_write",
+                affected_files: [redirectedPath],
+                description: `Shell redirection to ${redirectedPath}`,
+            };
+        }
+        // Safe patterns
+        const safePatterns = [
+            /^(echo|cat|pwd|ls|find|grep|head|tail|wc|date|whoami|id|uname)\b/,
+            /^git\s+(status|log|diff|branch|show|remote)\b/,
+            /^npm\s+(list|config|root)\b/,
+            /^yarn\s+(info|list)\b/,
+            /^pnpm\s+(list|root)\b/,
+            /^docker\s+(ps|images|logs)\b/,
+        ];
+        if (isSingleSafeShellCommand(trimmed)) {
+            for (const pattern of safePatterns) {
+                if (!pattern.test(trimmed))
+                    continue;
+                return {
+                    risk: "safe",
+                    requires_approval: false,
+                    category: "shell_safe",
+                    description: trimmed.length > 50 ? trimmed.slice(0, 50) + "..." : trimmed,
+                };
+            }
+        }
+        // Moderate (default for shell)
+        return {
+            risk: "moderate",
+            requires_approval: this.config.require_approval_shell_moderate,
+            category: "shell_moderate",
+            description: trimmed.length > 50 ? trimmed.slice(0, 50) + "..." : trimmed,
+        };
+    }
+    /**
+     * Classify a builtin command.
+     */
+    _classifyBuiltinCommand(command) {
+        const trimmed = command.trim().toLowerCase();
+        // Safe builtin commands
+        const safeCommands = ["help", "version", "list", "ls", "status"];
+        if (safeCommands.includes(trimmed)) {
+            return {
+                risk: "safe",
+                requires_approval: false,
+                category: "shell_safe",
+                description: `Builtin: ${command}`,
+            };
+        }
+        // Everything else is moderate
+        return {
+            risk: "moderate",
+            requires_approval: false,
+            category: "shell_moderate",
+            description: `Builtin: ${command}`,
+        };
+    }
+    /**
+     * Classify by intent category directly.
+     */
+    classifyByCategory(category, args) {
+        const toolName = String(args.tool_name ?? "unknown");
+        switch (category) {
+            case "file_read":
+                return {
+                    risk: "safe",
+                    requires_approval: false,
+                    category,
+                    description: `Read ${args.path ?? ""}`,
+                };
+            case "file_write":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_writes,
+                    category,
+                    affected_files: [String(args.path)],
+                    description: `Write to ${args.path}`,
+                };
+            case "file_delete":
+                return {
+                    risk: "dangerous",
+                    requires_approval: true,
+                    category,
+                    description: `Delete ${args.path ?? ""}`,
+                };
+            case "shell_safe":
+                return {
+                    risk: "safe",
+                    requires_approval: false,
+                    category,
+                    description: toolName,
+                };
+            case "shell_moderate":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_shell_moderate,
+                    category,
+                    description: toolName,
+                };
+            case "shell_dangerous":
+                return {
+                    risk: "dangerous",
+                    requires_approval: true,
+                    category,
+                    description: `DANGEROUS: ${toolName}`,
+                };
+            case "network":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_unknown,
+                    category,
+                    description: `Network: ${args.url ?? toolName}`,
+                };
+            case "unknown":
+                return {
+                    risk: "moderate",
+                    requires_approval: this.config.require_approval_unknown,
+                    category,
+                    description: toolName,
+                };
+        }
+    }
+}
+function resolveClassifierConfig(config) {
+    return {
+        require_approval_writes: config.require_approval_writes ?? config.approve_writes ?? DEFAULT_CLASSIFIER_CONFIG.require_approval_writes,
+        require_approval_edits: config.require_approval_edits ?? config.approve_edits ?? DEFAULT_CLASSIFIER_CONFIG.require_approval_edits,
+        require_approval_shell_moderate: config.require_approval_shell_moderate ??
+            config.approve_shell_moderate ??
+            DEFAULT_CLASSIFIER_CONFIG.require_approval_shell_moderate,
+        require_approval_unknown: config.require_approval_unknown ?? config.approve_unknown ?? DEFAULT_CLASSIFIER_CONFIG.require_approval_unknown,
+    };
+}
+function parseBuiltinInvocation(command) {
+    const firstLine = command.split("\n", 1)[0]?.trim() ?? "";
+    const parts = splitShellWords(firstLine);
+    const builtin = parts[0]?.toLowerCase();
+    if (builtin !== "read" && builtin !== "write" && builtin !== "edit")
+        return undefined;
+    let path;
+    for (let i = 1; i < parts.length; i++) {
+        const arg = parts[i];
+        if ((arg === "--path" || arg === "-p") && parts[i + 1]) {
+            path = parts[i + 1];
+            break;
+        }
+        if (!arg.startsWith("-") && !path) {
+            path = arg;
+            break;
+        }
+    }
+    return { command: builtin, path };
+}
+function splitShellWords(input) {
+    const words = [];
+    let current = "";
+    let quote;
+    let escaped = false;
+    for (const char of input) {
+        if (escaped) {
+            current += char;
+            escaped = false;
+            continue;
+        }
+        if (char === "\\") {
+            escaped = true;
+            continue;
+        }
+        if (quote) {
+            if (char === quote) {
+                quote = undefined;
+            }
+            else {
+                current += char;
+            }
+            continue;
+        }
+        if (char === "'" || char === "\"") {
+            quote = char;
+            continue;
+        }
+        if (/\s/.test(char)) {
+            if (current) {
+                words.push(current);
+                current = "";
+            }
+            continue;
+        }
+        current += char;
+    }
+    if (current)
+        words.push(current);
+    return words;
+}
+function getNonNullRedirectPath(command) {
+    const matches = command.matchAll(/(?:^|[\s;|&])(?:\d*)>>?\s*(['"]?)([^'"\s;&|]+)\1/g);
+    for (const match of matches) {
+        const path = match[2];
+        if (!path || path === "/dev/null")
+            continue;
+        return path;
+    }
+    return undefined;
+}
+function isSingleSafeShellCommand(command) {
+    const withoutNullRedirects = command.replace(/\s+\d*>\/dev\/null\b/g, "");
+    return !/[|;&<>`$()]/.test(withoutNullRedirects);
+}

package/dist/core/intent/index.d.ts

@@ -0,0 +1,8 @@
+/**
+ * Intent Module
+ *
+ * Handles intent classification and deterministic execution.
+ */
+export * from "./types.js";
+export * from "./classifier.js";
+export * from "./tool-adapter.js";

package/dist/core/intent/index.js

@@ -0,0 +1,8 @@
+/**
+ * Intent Module
+ *
+ * Handles intent classification and deterministic execution.
+ */
+export * from "./types.js";
+export * from "./classifier.js";
+export * from "./tool-adapter.js";

package/dist/core/intent/tool-adapter.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Tool Adapter
+ *
+ * Adapts legacy AgentTool instances to the new ToolExecutor / ToolRegistry
+ * interface used by the event-sourced runtime.
+ *
+ * Key responsibilities:
+ * - Convert AgentTool.execute(toolCallId, params, signal, onUpdate) → ToolExecutor.execute(args, options)
+ * - Detect file mutations from tool results and populate file_mutations
+ * - Build a ToolRegistry from an array of AgentTools
+ */
+import type { AgentTool } from "../agent/types.js";
+import type { ToolExecutionOptions, ToolExecutionResult, ToolExecutor, ToolMetadata, ToolRegistry } from "./types.js";
+/**
+ * Wraps a legacy AgentTool as a ToolExecutor for the event-sourced runtime.
+ */
+export declare class AgentToolAdapter implements ToolExecutor {
+    private tool;
+    private metadata;
+    constructor(tool: AgentTool<any, any>);
+    execute(args: Record<string, unknown>, options?: ToolExecutionOptions): Promise<ToolExecutionResult>;
+    getMetadata(): ToolMetadata;
+}
+/**
+ * Build a ToolRegistry from an array of AgentTool instances.
+ *
+ * Usage:
+ *   const tools = createTools(cwd, options);
+ *   const registry = createToolRegistry(tools);
+ */
+export declare function createToolRegistry(tools: AgentTool<any, any>[]): ToolRegistry;

package/dist/core/intent/tool-adapter.js

@@ -0,0 +1,168 @@
+/**
+ * Tool Adapter
+ *
+ * Adapts legacy AgentTool instances to the new ToolExecutor / ToolRegistry
+ * interface used by the event-sourced runtime.
+ *
+ * Key responsibilities:
+ * - Convert AgentTool.execute(toolCallId, params, signal, onUpdate) → ToolExecutor.execute(args, options)
+ * - Detect file mutations from tool results and populate file_mutations
+ * - Build a ToolRegistry from an array of AgentTools
+ */
+// ============================================================================
+// File Mutation Detection
+// ============================================================================
+/** Tools known to mutate files */
+const FILE_MUTATING_TOOLS = new Set(["edit", "edit_diff", "write", "cli", "bash"]);
+/**
+ * Infer file mutations from a tool execution.
+ *
+ * For write/edit tools, the path is in the arguments.
+ * For cli/bash, we cannot reliably detect mutations (best-effort).
+ */
+function inferFileMutations(toolName, args, _result) {
+    if (!FILE_MUTATING_TOOLS.has(toolName))
+        return undefined;
+    switch (toolName) {
+        case "edit":
+        case "edit_diff": {
+            const path = args.path;
+            if (path)
+                return [{ path, operation: "modify" }];
+            return undefined;
+        }
+        case "write": {
+            const path = args.path;
+            if (path)
+                return [{ path, operation: "create" }];
+            return undefined;
+        }
+        case "cli":
+        case "bash": {
+            const details = _result.details;
+            const builtin = details?.builtin;
+            if (builtin?.name === "write" && builtin.args.path) {
+                return [{ path: builtin.args.path, operation: "create" }];
+            }
+            if (builtin?.name === "edit" && builtin.args.path) {
+                return [{ path: builtin.args.path, operation: "modify" }];
+            }
+            return undefined;
+        }
+        default:
+            return undefined;
+    }
+}
+// ============================================================================
+// Tool Category Mapping
+// ============================================================================
+/** Map AgentTool name to IntentCategory */
+function inferCategory(toolName) {
+    switch (toolName) {
+        case "read":
+        case "find":
+        case "grep":
+        case "ls":
+        case "path_utils":
+            return "file_read";
+        case "write":
+        case "edit":
+        case "edit_diff":
+            return "file_write";
+        case "cli":
+        case "bash":
+            return "shell_moderate";
+        case "truncate":
+            return "file_delete";
+        default:
+            return "unknown";
+    }
+}
+/** Map category to default risk */
+function inferRisk(category) {
+    switch (category) {
+        case "file_read":
+        case "shell_safe":
+            return "safe";
+        case "file_write":
+        case "shell_moderate":
+        case "network":
+            return "moderate";
+        case "file_delete":
+        case "shell_dangerous":
+        case "unknown":
+            return "dangerous";
+    }
+}
+// ============================================================================
+// ToolExecutor Adapter
+// ============================================================================
+/**
+ * Wraps a legacy AgentTool as a ToolExecutor for the event-sourced runtime.
+ */
+export class AgentToolAdapter {
+    constructor(tool) {
+        this.tool = tool;
+        const category = inferCategory(tool.name);
+        this.metadata = {
+            name: tool.name,
+            description: tool.description,
+            category,
+            defaultRisk: inferRisk(category),
+        };
+    }
+    async execute(args, options) {
+        const toolCallId = options?.tool_call_id ?? `tc_${Date.now()}_${Math.random().toString(36).slice(2, 8)}`;
+        // Prepare arguments if the tool has a prepareArguments hook
+        const prepared = this.tool.prepareArguments ? this.tool.prepareArguments(args) : args;
+        try {
+            const result = await this.tool.execute(toolCallId, prepared, options?.signal, options?.onUpdate);
+            const executionResult = {
+                content: result.content.map((block) => ({ ...block })),
+                details: result.details,
+                is_error: false,
+            };
+            // Detect file mutations
+            const mutations = inferFileMutations(this.tool.name, args, executionResult);
+            if (mutations?.length) {
+                executionResult.file_mutations = mutations;
+            }
+            return executionResult;
+        }
+        catch (err) {
+            const msg = err instanceof Error ? err.message : String(err);
+            return {
+                content: [{ type: "text", text: msg }],
+                is_error: true,
+                error_message: msg,
+            };
+        }
+    }
+    getMetadata() {
+        return this.metadata;
+    }
+}
+// ============================================================================
+// ToolRegistry from AgentTools
+// ============================================================================
+/**
+ * Build a ToolRegistry from an array of AgentTool instances.
+ *
+ * Usage:
+ *   const tools = createTools(cwd, options);
+ *   const registry = createToolRegistry(tools);
+ */
+export function createToolRegistry(tools) {
+    const executors = new Map();
+    for (const tool of tools) {
+        executors.set(tool.name, new AgentToolAdapter(tool));
+    }
+    return {
+        get(name) {
+            return executors.get(name);
+        },
+        list() {
+            return Array.from(executors.keys());
+        },
+    };
+}

package/dist/core/intent/types.d.ts

@@ -0,0 +1,71 @@
+/**
+ * Intent Classification Types
+ *
+ * Defines the risk levels and categories for LLM-proposed tool calls.
+ */
+import type { FileMutation } from "../event-store/types.js";
+/** Intent risk level */
+export type IntentRisk = "safe" | "moderate" | "dangerous";
+/** Intent category */
+export type IntentCategory = "file_read" | "file_write" | "file_delete" | "shell_safe" | "shell_moderate" | "shell_dangerous" | "network" | "unknown";
+/** Intent classification result */
+export interface IntentClassification {
+    risk: IntentRisk;
+    /** Whether this intent requires user approval */
+    requires_approval: boolean;
+    category: IntentCategory;
+    /** Files affected by this intent */
+    affected_files?: string[];
+    /** Human-readable description */
+    description: string;
+}
+/** Tool execution result */
+export interface ToolExecutionResult {
+    content: Array<{
+        type: string;
+        [key: string]: unknown;
+    }>;
+    /** Optional structured payload for logs/UI. */
+    details?: unknown;
+    is_error: boolean;
+    /** File mutations produced by this execution */
+    file_mutations?: FileMutation[];
+    /** Error message if is_error */
+    error_message?: string;
+}
+/** Partial tool execution update emitted while a tool is running. */
+export interface ToolExecutionUpdate {
+    content: Array<{
+        type: string;
+    }>;
+    details?: unknown;
+    progress?: number;
+}
+/** Runtime-provided execution context for a tool call. */
+export interface ToolExecutionOptions {
+    tool_call_id?: string;
+    signal?: AbortSignal;
+    onUpdate?: (partial: ToolExecutionUpdate) => void;
+}
+/** Tool registry interface */
+export interface ToolRegistry {
+    get(name: string): ToolExecutor | undefined;
+    list(): string[];
+}
+/** Tool executor interface */
+export interface ToolExecutor {
+    execute(args: Record<string, unknown>, options?: ToolExecutionOptions): Promise<ToolExecutionResult>;
+    getMetadata(): ToolMetadata;
+}
+/** Tool metadata */
+export interface ToolMetadata {
+    name: string;
+    description?: string;
+    category: IntentCategory;
+    defaultRisk: IntentRisk;
+}
+/** Approval handler for UI integration */
+export interface ApprovalHandler {
+    requestApproval(intentEventId: string, classification: IntentClassification): void;
+    cancelApproval(intentEventId: string): void;
+}

package/dist/core/intent/types.js

@@ -0,0 +1,6 @@
+/**
+ * Intent Classification Types
+ *
+ * Defines the risk levels and categories for LLM-proposed tool calls.
+ */
+export {};