@toyako/hive 1.0.0

package/dist/safety/MessageDeduplicator.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MessageDeduplicator = void 0;
+const crypto_1 = require("crypto");
+/**
+ * MessageDeduplicator
+ *
+ * Prevents duplicate messages within a time window.
+ * Uses content-based fingerprinting.
+ */
+class MessageDeduplicator {
+    seen = new Map(); // fingerprint → timestamp
+    windowMs;
+    constructor(windowMs = 30_000) {
+        this.windowMs = windowMs;
+    }
+    /**
+     * Check if a message is a duplicate.
+     * Returns true if duplicate, false if new.
+     */
+    isDuplicate(msg) {
+        const fingerprint = this.fingerprint(msg);
+        const now = Date.now();
+        // Clean old entries
+        this.cleanup(now);
+        if (this.seen.has(fingerprint)) {
+            const lastSeen = this.seen.get(fingerprint);
+            if (now - lastSeen < this.windowMs) {
+                return true; // Duplicate within window
+            }
+        }
+        // Record this message
+        this.seen.set(fingerprint, now);
+        return false;
+    }
+    /**
+     * Generate a fingerprint for a message.
+     */
+    fingerprint(msg) {
+        const key = `${msg.from}:${msg.to}:${msg.type}:${msg.taskId}:${JSON.stringify(msg.payload)}`;
+        return (0, crypto_1.createHash)("md5").update(key).digest("hex");
+    }
+    /**
+     * Clean up expired entries.
+     */
+    cleanup(now) {
+        for (const [fingerprint, timestamp] of this.seen) {
+            if (now - timestamp > this.windowMs * 2) {
+                this.seen.delete(fingerprint);
+            }
+        }
+    }
+    /**
+     * Get stats for monitoring.
+     */
+    stats() {
+        return {
+            tracked: this.seen.size,
+            windowMs: this.windowMs,
+        };
+    }
+}
+exports.MessageDeduplicator = MessageDeduplicator;
+//# sourceMappingURL=MessageDeduplicator.js.map

package/dist/safety/MessageDeduplicator.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"MessageDeduplicator.js","sourceRoot":"","sources":["../../src/safety/MessageDeduplicator.ts"],"names":[],"mappings":";;;AACA,mCAAoC;AAEpC;;;;;GAKG;AACH,MAAa,mBAAmB;IACtB,IAAI,GAAwB,IAAI,GAAG,EAAE,CAAC,CAAC,0BAA0B;IACjE,QAAQ,CAAS;IAEzB,YAAY,WAAmB,MAAM;QACnC,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;;OAGG;IACH,WAAW,CAAC,GAAoB;QAC9B,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;QAC1C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAEvB,oBAAoB;QACpB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QAElB,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAE,CAAC;YAC7C,IAAI,GAAG,GAAG,QAAQ,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACnC,OAAO,IAAI,CAAC,CAAC,0BAA0B;YACzC,CAAC;QACH,CAAC;QAED,sBAAsB;QACtB,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;OAEG;IACK,WAAW,CAAC,GAAoB;QACtC,MAAM,GAAG,GAAG,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;QAC7F,OAAO,IAAA,mBAAU,EAAC,KAAK,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED;;OAEG;IACK,OAAO,CAAC,GAAW;QACzB,KAAK,MAAM,CAAC,WAAW,EAAE,SAAS,CAAC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;YACjD,IAAI,GAAG,GAAG,SAAS,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC;gBACxC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC;YAChC,CAAC;QACH,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK;QACH,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACvB,QAAQ,EAAE,IAAI,CAAC,QAAQ;SACxB,CAAC;IACJ,CAAC;CACF;AA3DD,kDA2DC"}

package/dist/safety/TimeBudget.d.ts

@@ -0,0 +1,69 @@
+import { TaskTimeBudget } from "../types";
+/**
+ * TimeBudget
+ *
+ * Enforces time limits at multiple levels:
+ * - Total task time
+ * - Per-agent invocation time
+ * - Per-review-cycle time
+ */
+export declare class TimeBudget {
+    private budgets;
+    /**
+     * Create a time budget for a task.
+     */
+    create(taskId: string, budget: TaskTimeBudget): void;
+    /**
+     * Start tracking an agent invocation.
+     */
+    startAgentInvocation(taskId: string): void;
+    /**
+     * Start tracking a review cycle.
+     */
+    startReviewCycle(taskId: string): void;
+    /**
+     * Check if total task budget is exceeded.
+     */
+    isTotalExceeded(taskId: string): boolean;
+    /**
+     * Check if per-agent budget is exceeded.
+     */
+    isAgentExceeded(taskId: string): boolean;
+    /**
+     * Check if review cycle budget is exceeded.
+     */
+    isReviewCycleExceeded(taskId: string): boolean;
+    /**
+     * Check all budgets at once.
+     */
+    checkAll(taskId: string): BudgetCheckResult;
+    /**
+     * Get remaining time for total budget.
+     */
+    remainingTotal(taskId: string): number;
+    /**
+     * Get tracker info for a task.
+     */
+    getTracker(taskId: string): BudgetTracker | undefined;
+    /**
+     * Remove budget tracking for a task.
+     */
+    remove(taskId: string): void;
+}
+interface BudgetTracker {
+    taskId: string;
+    budget: TaskTimeBudget;
+    startTime: number;
+    agentStartTime: number;
+    reviewCycleStartTime: number;
+    agentInvocations: number;
+}
+export interface BudgetCheckResult {
+    taskId: string;
+    totalExceeded: boolean;
+    agentExceeded: boolean;
+    reviewCycleExceeded: boolean;
+    anyExceeded: boolean;
+}
+export {};
+//# sourceMappingURL=TimeBudget.d.ts.map

package/dist/safety/TimeBudget.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimeBudget.d.ts","sourceRoot":"","sources":["../../src/safety/TimeBudget.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,cAAc,EAAE,MAAM,UAAU,CAAC;AAE1C;;;;;;;GAOG;AACH,qBAAa,UAAU;IACrB,OAAO,CAAC,OAAO,CAAyC;IAExD;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,GAAG,IAAI;IAWpD;;OAEG;IACH,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAQ1C;;OAEG;IACH,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;IAOtC;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAMxC;;OAEG;IACH,eAAe,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAMxC;;OAEG;IACH,qBAAqB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO;IAM9C;;OAEG;IACH,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,iBAAiB;IAU3C;;OAEG;IACH,cAAc,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM;IAOtC;;OAEG;IACH,UAAU,CAAC,MAAM,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS;IAIrD;;OAEG;IACH,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI;CAG7B;AAED,UAAU,aAAa;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,EAAE,MAAM,CAAC;IAClB,cAAc,EAAE,MAAM,CAAC;IACvB,oBAAoB,EAAE,MAAM,CAAC;IAC7B,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,OAAO,CAAC;IACvB,aAAa,EAAE,OAAO,CAAC;IACvB,mBAAmB,EAAE,OAAO,CAAC;IAC7B,WAAW,EAAE,OAAO,CAAC;CACtB"}

package/dist/safety/TimeBudget.js

@@ -0,0 +1,109 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.TimeBudget = void 0;
+/**
+ * TimeBudget
+ *
+ * Enforces time limits at multiple levels:
+ * - Total task time
+ * - Per-agent invocation time
+ * - Per-review-cycle time
+ */
+class TimeBudget {
+    budgets = new Map();
+    /**
+     * Create a time budget for a task.
+     */
+    create(taskId, budget) {
+        this.budgets.set(taskId, {
+            taskId,
+            budget,
+            startTime: Date.now(),
+            agentStartTime: 0,
+            reviewCycleStartTime: 0,
+            agentInvocations: 0,
+        });
+    }
+    /**
+     * Start tracking an agent invocation.
+     */
+    startAgentInvocation(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (tracker) {
+            tracker.agentStartTime = Date.now();
+            tracker.agentInvocations++;
+        }
+    }
+    /**
+     * Start tracking a review cycle.
+     */
+    startReviewCycle(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (tracker) {
+            tracker.reviewCycleStartTime = Date.now();
+        }
+    }
+    /**
+     * Check if total task budget is exceeded.
+     */
+    isTotalExceeded(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (!tracker)
+            return false;
+        return Date.now() - tracker.startTime >= tracker.budget.totalMs;
+    }
+    /**
+     * Check if per-agent budget is exceeded.
+     */
+    isAgentExceeded(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (!tracker || tracker.agentStartTime === 0)
+            return false;
+        return Date.now() - tracker.agentStartTime >= tracker.budget.perAgentMs;
+    }
+    /**
+     * Check if review cycle budget is exceeded.
+     */
+    isReviewCycleExceeded(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (!tracker || tracker.reviewCycleStartTime === 0)
+            return false;
+        return Date.now() - tracker.reviewCycleStartTime >= tracker.budget.reviewCycleMs;
+    }
+    /**
+     * Check all budgets at once.
+     */
+    checkAll(taskId) {
+        return {
+            taskId,
+            totalExceeded: this.isTotalExceeded(taskId),
+            agentExceeded: this.isAgentExceeded(taskId),
+            reviewCycleExceeded: this.isReviewCycleExceeded(taskId),
+            anyExceeded: this.isTotalExceeded(taskId) || this.isAgentExceeded(taskId) || this.isReviewCycleExceeded(taskId),
+        };
+    }
+    /**
+     * Get remaining time for total budget.
+     */
+    remainingTotal(taskId) {
+        const tracker = this.budgets.get(taskId);
+        if (!tracker)
+            return Infinity;
+        const elapsed = Date.now() - tracker.startTime;
+        return Math.max(0, tracker.budget.totalMs - elapsed);
+    }
+    /**
+     * Get tracker info for a task.
+     */
+    getTracker(taskId) {
+        return this.budgets.get(taskId);
+    }
+    /**
+     * Remove budget tracking for a task.
+     */
+    remove(taskId) {
+        this.budgets.delete(taskId);
+    }
+}
+exports.TimeBudget = TimeBudget;
+//# sourceMappingURL=TimeBudget.js.map

package/dist/safety/TimeBudget.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TimeBudget.js","sourceRoot":"","sources":["../../src/safety/TimeBudget.ts"],"names":[],"mappings":";;;AAEA;;;;;;;GAOG;AACH,MAAa,UAAU;IACb,OAAO,GAA+B,IAAI,GAAG,EAAE,CAAC;IAExD;;OAEG;IACH,MAAM,CAAC,MAAc,EAAE,MAAsB;QAC3C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE;YACvB,MAAM;YACN,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE;YACrB,cAAc,EAAE,CAAC;YACjB,oBAAoB,EAAE,CAAC;YACvB,gBAAgB,EAAE,CAAC;SACpB,CAAC,CAAC;IACL,CAAC;IAED;;OAEG;IACH,oBAAoB,CAAC,MAAc;QACjC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,cAAc,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;YACpC,OAAO,CAAC,gBAAgB,EAAE,CAAC;QAC7B,CAAC;IACH,CAAC;IAED;;OAEG;IACH,gBAAgB,CAAC,MAAc;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,OAAO,EAAE,CAAC;YACZ,OAAO,CAAC,oBAAoB,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QAC5C,CAAC;IACH,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,KAAK,CAAC;QAC3B,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;IAClE,CAAC;IAED;;OAEG;IACH,eAAe,CAAC,MAAc;QAC5B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,cAAc,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3D,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;IAC1E,CAAC;IAED;;OAEG;IACH,qBAAqB,CAAC,MAAc;QAClC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,oBAAoB,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACjE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,oBAAoB,IAAI,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;IACnF,CAAC;IAED;;OAEG;IACH,QAAQ,CAAC,MAAc;QACrB,OAAO;YACL,MAAM;YACN,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC3C,aAAa,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;YAC3C,mBAAmB,EAAE,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;YACvD,WAAW,EAAE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,IAAI,IAAI,CAAC,qBAAqB,CAAC,MAAM,CAAC;SAChH,CAAC;IACJ,CAAC;IAED;;OAEG;IACH,cAAc,CAAC,MAAc;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,OAAO;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,SAAS,CAAC;QAC/C,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,GAAG,OAAO,CAAC,CAAC;IACvD,CAAC;IAED;;OAEG;IACH,UAAU,CAAC,MAAc;QACvB,OAAO,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,CAAC;IAED;;OAEG;IACH,MAAM,CAAC,MAAc;QACnB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC9B,CAAC;CACF;AArGD,gCAqGC"}

package/dist/safety/__tests__/CircuitBreaker.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=CircuitBreaker.test.d.ts.map

package/dist/safety/__tests__/CircuitBreaker.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"CircuitBreaker.test.d.ts","sourceRoot":"","sources":["../../../src/safety/__tests__/CircuitBreaker.test.ts"],"names":[],"mappings":""}

package/dist/safety/__tests__/CircuitBreaker.test.js

@@ -0,0 +1,98 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+const CircuitBreaker_1 = require("../CircuitBreaker");
+describe('CircuitBreaker — sliding window', () => {
+    let cb;
+    beforeEach(() => {
+        cb = new CircuitBreaker_1.CircuitBreaker({
+            threshold: 3,
+            windowMs: 1000, // 1 second window
+            cooldownMs: 500,
+        });
+    });
+    test('agent starts available (closed state)', () => {
+        expect(cb.isAvailable('agent-1')).toBe(true);
+        const state = cb.getState('agent-1');
+        expect(state.state).toBe('closed');
+        expect(state.failures).toBe(0);
+    });
+    test('opens circuit after threshold failures within window', () => {
+        cb.recordFailure('agent-1');
+        cb.recordFailure('agent-1');
+        expect(cb.isAvailable('agent-1')).toBe(true); // 2 < 3
+        cb.recordFailure('agent-1');
+        expect(cb.isAvailable('agent-1')).toBe(false); // 3 >= 3 → OPEN
+        expect(cb.getState('agent-1').state).toBe('open');
+    });
+    test('old failures outside window are evicted', () => {
+        // Use a CB with very short window for testing
+        const fastCb = new CircuitBreaker_1.CircuitBreaker({
+            threshold: 3,
+            windowMs: 50, // 50ms window
+            cooldownMs: 10,
+        });
+        fastCb.recordFailure('agent-1');
+        fastCb.recordFailure('agent-1');
+        // Wait for failures to expire
+        return new Promise(resolve => {
+            setTimeout(() => {
+                // These old failures should be evicted
+                const count = fastCb.getActiveFailureCount('agent-1');
+                expect(count).toBe(0);
+                // New failure alone shouldn't open (old ones expired)
+                fastCb.recordFailure('agent-1');
+                expect(fastCb.isAvailable('agent-1')).toBe(true);
+                expect(fastCb.getState('agent-1').failures).toBe(1);
+                resolve();
+            }, 80);
+        });
+    });
+    test('success resets failure count and timestamps', () => {
+        cb.recordFailure('agent-1');
+        cb.recordFailure('agent-1');
+        expect(cb.getState('agent-1').failures).toBe(2);
+        cb.recordSuccess('agent-1');
+        expect(cb.getState('agent-1').failures).toBe(0);
+        expect(cb.getState('agent-1').state).toBe('closed');
+        expect(cb.getActiveFailureCount('agent-1')).toBe(0);
+    });
+    test('reset clears both states and timestamps', () => {
+        cb.recordFailure('agent-1');
+        cb.recordFailure('agent-1');
+        cb.recordFailure('agent-1');
+        expect(cb.getState('agent-1').state).toBe('open');
+        cb.reset('agent-1');
+        expect(cb.getState('agent-1').state).toBe('closed');
+        expect(cb.getState('agent-1').failures).toBe(0);
+        expect(cb.getActiveFailureCount('agent-1')).toBe(0);
+    });
+    test('half-open allows one attempt after cooldown', () => {
+        const fastCb = new CircuitBreaker_1.CircuitBreaker({
+            threshold: 2,
+            windowMs: 5000,
+            cooldownMs: 50,
+        });
+        fastCb.recordFailure('agent-1');
+        fastCb.recordFailure('agent-1');
+        expect(fastCb.isAvailable('agent-1')).toBe(false); // OPEN
+        return new Promise(resolve => {
+            setTimeout(() => {
+                expect(fastCb.isAvailable('agent-1')).toBe(true); // HALF_OPEN after cooldown
+                expect(fastCb.getState('agent-1').state).toBe('half-open');
+                resolve();
+            }, 80);
+        });
+    });
+    test('allStates returns windowed failure counts', () => {
+        cb.recordFailure('agent-1');
+        cb.recordFailure('agent-2');
+        cb.recordFailure('agent-2');
+        const states = cb.allStates();
+        expect(states).toHaveLength(2);
+        const s1 = states.find(s => s.agentId === 'agent-1');
+        const s2 = states.find(s => s.agentId === 'agent-2');
+        expect(s1?.failures).toBe(1);
+        expect(s2?.failures).toBe(2);
+    });
+});
+//# sourceMappingURL=CircuitBreaker.test.js.map

package/dist/safety/__tests__/CircuitBreaker.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"CircuitBreaker.test.js","sourceRoot":"","sources":["../../../src/safety/__tests__/CircuitBreaker.test.ts"],"names":[],"mappings":";;AAAA,sDAAmD;AAEnD,QAAQ,CAAC,iCAAiC,EAAE,GAAG,EAAE;IAC/C,IAAI,EAAkB,CAAC;IAEvB,UAAU,CAAC,GAAG,EAAE;QACd,EAAE,GAAG,IAAI,+BAAc,CAAC;YACtB,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,IAAI,EAAI,kBAAkB;YACpC,UAAU,EAAE,GAAG;SAChB,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,uCAAuC,EAAE,GAAG,EAAE;QACjD,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;QACrC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACnC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,sDAAsD,EAAE,GAAG,EAAE;QAChE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ;QAEtD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB;QAC/D,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,8CAA8C;QAC9C,MAAM,MAAM,GAAG,IAAI,+BAAc,CAAC;YAChC,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,EAAE,EAAG,cAAc;YAC7B,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAEhC,8BAA8B;QAC9B,OAAO,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YACjC,UAAU,CAAC,GAAG,EAAE;gBACd,uCAAuC;gBACvC,MAAM,KAAK,GAAG,MAAM,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC;gBACtD,MAAM,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAEtB,sDAAsD;gBACtD,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;gBAChC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACjD,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBACpD,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAEhD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,yCAAyC,EAAE,GAAG,EAAE;QACnD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAElD,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QACpB,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACpD,MAAM,CAAC,EAAE,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAChD,MAAM,CAAC,EAAE,CAAC,qBAAqB,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACtD,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACvD,MAAM,MAAM,GAAG,IAAI,+BAAc,CAAC;YAChC,SAAS,EAAE,CAAC;YACZ,QAAQ,EAAE,IAAI;YACd,UAAU,EAAE,EAAE;SACf,CAAC,CAAC;QAEH,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO;QAE1D,OAAO,IAAI,OAAO,CAAO,OAAO,CAAC,EAAE;YACjC,UAAU,CAAC,GAAG,EAAE;gBACd,MAAM,CAAC,MAAM,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,2BAA2B;gBAC7E,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;gBAC3D,OAAO,EAAE,CAAC;YACZ,CAAC,EAAE,EAAE,CAAC,CAAC;QACT,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,IAAI,CAAC,2CAA2C,EAAE,GAAG,EAAE;QACrD,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAC5B,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC,CAAC;QAE5B,MAAM,MAAM,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,MAAM,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;QAC/B,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QACrD,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;QACrD,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAC7B,MAAM,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}

package/dist/sandbox/ExecutionSandbox.d.ts

@@ -0,0 +1,16 @@
+/**
+ * ExecutionSandbox — validates AST before execution.
+ * Rejects unsafe constructs, string commands, shell injection patterns.
+ */
+import { CommandAST } from "../command/CommandAST";
+export interface ValidationResult {
+    valid: boolean;
+    errors: string[];
+}
+export declare class ExecutionSandbox {
+    /** Validate an AST for safety */
+    validate(ast: CommandAST): ValidationResult;
+    private validateNode;
+    private validateExec;
+}
+//# sourceMappingURL=ExecutionSandbox.d.ts.map

package/dist/sandbox/ExecutionSandbox.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionSandbox.d.ts","sourceRoot":"","sources":["../../src/sandbox/ExecutionSandbox.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AAEnD,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,OAAO,CAAC;IACf,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED,qBAAa,gBAAgB;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,GAAG,EAAE,UAAU,GAAG,gBAAgB;IAQ3C,OAAO,CAAC,YAAY;IAmBpB,OAAO,CAAC,YAAY;CAwBrB"}

package/dist/sandbox/ExecutionSandbox.js

@@ -0,0 +1,52 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExecutionSandbox = void 0;
+class ExecutionSandbox {
+    /** Validate an AST for safety */
+    validate(ast) {
+        const errors = [];
+        this.validateNode(ast, errors);
+        return { valid: errors.length === 0, errors };
+    }
+    validateNode(ast, errors) {
+        switch (ast.type) {
+            case "exec":
+                this.validateExec(ast, errors);
+                break;
+            case "sequence":
+                for (const step of ast.steps) {
+                    this.validateNode(step, errors);
+                }
+                break;
+            case "pipe":
+                this.validateNode(ast.left, errors);
+                this.validateNode(ast.right, errors);
+                break;
+            default:
+                errors.push(`Unknown AST node type: ${ast.type}`);
+        }
+    }
+    validateExec(ast, errors) {
+        // Reject if cmd is not a string
+        if (typeof ast.cmd !== "string") {
+            errors.push("cmd must be a string");
+            return;
+        }
+        // Reject shell injection patterns in cmd
+        const dangerous = [";", "&&", "||", "|", ">", ">>", "<", "`", "$("];
+        for (const pattern of dangerous) {
+            if (ast.cmd.includes(pattern)) {
+                errors.push(`Unsafe shell injection pattern in cmd: ${ast.cmd}`);
+                break;
+            }
+        }
+        // Args are safe — they're passed as literal strings, not interpreted by shell
+        // No need to check args for injection patterns
+        // Reject empty cmd
+        if (!ast.cmd.trim()) {
+            errors.push("cmd cannot be empty");
+        }
+    }
+}
+exports.ExecutionSandbox = ExecutionSandbox;
+//# sourceMappingURL=ExecutionSandbox.js.map

package/dist/sandbox/ExecutionSandbox.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ExecutionSandbox.js","sourceRoot":"","sources":["../../src/sandbox/ExecutionSandbox.ts"],"names":[],"mappings":";;;AAWA,MAAa,gBAAgB;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,GAAe;QACtB,MAAM,MAAM,GAAa,EAAE,CAAC;QAE5B,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QAE/B,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;IAChD,CAAC;IAEO,YAAY,CAAC,GAAe,EAAE,MAAgB;QACpD,QAAQ,GAAG,CAAC,IAAI,EAAE,CAAC;YACjB,KAAK,MAAM;gBACT,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;gBAC/B,MAAM;YACR,KAAK,UAAU;gBACb,KAAK,MAAM,IAAI,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;oBAC7B,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBAClC,CAAC;gBACD,MAAM;YACR,KAAK,MAAM;gBACT,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;gBACpC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACrC,MAAM;YACR;gBACE,MAAM,CAAC,IAAI,CAAC,0BAA2B,GAAW,CAAC,IAAI,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IAEO,YAAY,CAAC,GAAQ,EAAE,MAAgB;QAC7C,gCAAgC;QAChC,IAAI,OAAO,GAAG,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YAChC,MAAM,CAAC,IAAI,CAAC,sBAAsB,CAAC,CAAC;YACpC,OAAO;QACT,CAAC;QAED,yCAAyC;QACzC,MAAM,SAAS,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACpE,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;YAChC,IAAI,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;gBAC9B,MAAM,CAAC,IAAI,CAAC,0CAA0C,GAAG,CAAC,GAAG,EAAE,CAAC,CAAC;gBACjE,MAAM;YACR,CAAC;QACH,CAAC;QAED,8EAA8E;QAC9E,+CAA+C;QAE/C,mBAAmB;QACnB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC;YACpB,MAAM,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;CACF;AArDD,4CAqDC"}

package/dist/security/P0IncidentResponse.d.ts

@@ -0,0 +1,90 @@
+/**
+ * P0 Incident Response System — v5.5
+ *
+ * When a security breach is detected:
+ * The system must shift from "prevention mode" to "incident containment mode"
+ *
+ * Activation Condition:
+ * - any secret is confirmed exposed
+ * - npm package contains credentials
+ * - git history includes secrets
+ * - logs or traces are publicly distributed
+ *
+ * A system that leaks secrets must not continue operating as if nothing happened.
+ * Security incidents are NOT warnings.
+ * They are architectural validation failures.
+ */
+export interface ExposureReport {
+    package: string;
+    versions: string[];
+    files: string[];
+    secretTypes: string[];
+    blastRadius: "LOW" | "MEDIUM" | "HIGH" | "CRITICAL";
+}
+export type IncidentStatus = "DETECTED" | "CONTAINED" | "ANALYZING" | "REMEDIATING" | "RESOLVED";
+export interface IncidentRecord {
+    id: string;
+    status: IncidentStatus;
+    exposure: ExposureReport;
+    timeline: string[];
+    rootCause?: string;
+    recoveryPlan?: string;
+    timestamp: number;
+}
+export declare class P0IncidentResponseSystem {
+    private incidents;
+    private publishFrozen;
+    /**
+     * 检测到安全事件
+     */
+    detectIncident(exposure: ExposureReport): IncidentRecord;
+    /**
+     * Phase 1: Immediate Containment (P0 Lockdown)
+     */
+    private contain;
+    /**
+     * Phase 2: Exposure Scope Analysis
+     */
+    analyzeExposure(incidentId: string): ExposureReport | null;
+    /**
+     * Phase 3: Secret Rotation Protocol
+     */
+    rotateSecrets(incidentId: string, secrets: string[]): void;
+    /**
+     * Phase 4: Artifact Purge
+     */
+    purgeArtifacts(incidentId: string, files: string[]): void;
+    /**
+     * Phase 5: Version Retraction
+     */
+    retractVersion(incidentId: string, version: string, strategy: "unpublish" | "deprecate"): void;
+    /**
+     * Phase 6: Forensic Trace Reconstruction
+     */
+    reconstructTrace(incidentId: string, rootCause: string): void;
+    /**
+     * Phase 7: Recovery Release Strategy
+     */
+    planRecovery(incidentId: string, patchedVersion: string): void;
+    /**
+     * Phase 8: Trust Reset Protocol
+     */
+    resetTrust(incidentId: string): void;
+    /**
+     * 获取事件状态
+     */
+    getIncident(id: string): IncidentRecord | undefined;
+    /**
+     * 获取所有事件
+     */
+    getAllIncidents(): IncidentRecord[];
+    /**
+     * 检查发布是否冻结
+     */
+    isPublishFrozen(): boolean;
+    /**
+     * 解除发布冻结
+     */
+    unfreezePublish(): void;
+}
+//# sourceMappingURL=P0IncidentResponse.d.ts.map

package/dist/security/P0IncidentResponse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"P0IncidentResponse.d.ts","sourceRoot":"","sources":["../../src/security/P0IncidentResponse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAGH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,WAAW,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,GAAG,UAAU,CAAC;CACrD;AAGD,MAAM,MAAM,cAAc,GAAG,UAAU,GAAG,WAAW,GAAG,WAAW,GAAG,aAAa,GAAG,UAAU,CAAC;AAGjG,MAAM,WAAW,cAAc;IAC7B,EAAE,EAAE,MAAM,CAAC;IACX,MAAM,EAAE,cAAc,CAAC;IACvB,QAAQ,EAAE,cAAc,CAAC;IACzB,QAAQ,EAAE,MAAM,EAAE,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,qBAAa,wBAAwB;IACnC,OAAO,CAAC,SAAS,CAA0C;IAC3D,OAAO,CAAC,aAAa,CAAkB;IAEvC;;OAEG;IACH,cAAc,CAAC,QAAQ,EAAE,cAAc,GAAG,cAAc;IAiBxD;;OAEG;IACH,OAAO,CAAC,OAAO;IAcf;;OAEG;IACH,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,cAAc,GAAG,IAAI;IAU1D;;OAEG;IACH,aAAa,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,IAAI;IAa1D;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI;IAWzD;;OAEG;IACH,cAAc,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,GAAG,WAAW,GAAG,IAAI;IAW9F;;OAEG;IACH,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI;IAQ7D;;OAEG;IACH,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,GAAG,IAAI;IAS9D;;OAEG;IACH,UAAU,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI;IASpC;;OAEG;IACH,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAInD;;OAEG;IACH,eAAe,IAAI,cAAc,EAAE;IAInC;;OAEG;IACH,eAAe,IAAI,OAAO;IAI1B;;OAEG;IACH,eAAe,IAAI,IAAI;CAGxB"}