@twinklerg/coden 0.1.0

package/src/tools/executor.ts

@@ -0,0 +1,90 @@
+import { truncateOutput } from "../context/truncate.js";
+import type { EventBus } from "../core/events.js";
+import type { ToolCall, ToolResult } from "../core/types.js";
+import type { PermissionPolicy } from "../permissions/policy.js";
+import { resolveWorkspacePath } from "../permissions/workspace.js";
+import type { ToolRegistry } from "./registry.js";
+
+export class ToolExecutor {
+  constructor(
+    private registry: ToolRegistry,
+    private readonly permissions: PermissionPolicy,
+    private readonly events: EventBus,
+    private readonly workspace: string,
+    private readonly timeoutMs = 60_000,
+  ) {}
+  setRegistry(registry: ToolRegistry): void {
+    this.registry = registry;
+  }
+  async execute(call: ToolCall, signal: AbortSignal, turnId?: string): Promise<ToolResult> {
+    await this.events.emit("tool.requested", { name: call.name, callId: call.callId }, turnId);
+    const tool = this.registry.get(call.name);
+    if (!tool) return { content: `tool.not_found: ${call.name}`, isError: true };
+    const validation = this.registry.validate(call.name, call.input);
+    if (!validation.valid)
+      return { content: `tool.invalid_input: ${validation.errors}`, isError: true };
+    if (["read", "write", "edit"].includes(call.name)) {
+      try {
+        await resolveWorkspacePath(this.workspace, (call.input as { path: string }).path);
+      } catch (error) {
+        return {
+          content: `permission.workspace_denied: ${error instanceof Error ? error.message : String(error)}`,
+          isError: true,
+        };
+      }
+    }
+    const permission = await this.permissions.authorize(tool, call, signal);
+    await this.events.emit(
+      "permission.requested",
+      { name: call.name, callId: call.callId, risk: permission.risk, allowed: permission.allowed },
+      turnId,
+    );
+    if (!permission.allowed)
+      return { content: `permission.denied: ${call.name} was not authorized`, isError: true };
+    await this.events.emit("tool.started", { name: call.name, callId: call.callId }, turnId);
+    const start = Date.now();
+    let result: ToolResult;
+    const controller = new AbortController();
+    const relayAbort = () => controller.abort(signal.reason);
+    if (signal.aborted) relayAbort();
+    else signal.addEventListener("abort", relayAbort, { once: true });
+    const timer = setTimeout(
+      () => controller.abort(new Error(`Tool timed out after ${this.timeoutMs}ms`)),
+      this.timeoutMs,
+    );
+    try {
+      const aborted = controller.signal.aborted
+        ? Promise.reject(controller.signal.reason)
+        : new Promise<never>((_, reject) => {
+            controller.signal.addEventListener("abort", () => reject(controller.signal.reason), {
+              once: true,
+            });
+          });
+      result = await Promise.race([
+        tool.execute(call.input, { workspace: this.workspace, signal: controller.signal }),
+        aborted,
+      ]);
+      result = { ...result, content: truncateOutput(result.content, 50_000) };
+    } catch (error) {
+      const timedOut = !signal.aborted && controller.signal.aborted;
+      result = {
+        content: `${timedOut ? "tool.timeout (abort requested; tools must cooperate)" : "tool.internal_error"}: ${error instanceof Error ? error.message : String(error)}`,
+        isError: true,
+      };
+    } finally {
+      clearTimeout(timer);
+      signal.removeEventListener("abort", relayAbort);
+    }
+    await this.events.emit(
+      "tool.completed",
+      {
+        name: call.name,
+        callId: call.callId,
+        isError: result.isError ?? false,
+        durationMs: Date.now() - start,
+      },
+      turnId,
+    );
+    return result;
+  }
+}

package/src/tools/plugin-loader.ts

@@ -0,0 +1,122 @@
+import { createHash, randomUUID } from "node:crypto";
+import { readdir, readFile, realpath, stat } from "node:fs/promises";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import type { EventBus } from "../core/events.js";
+import type { ToolDefinition } from "../core/types.js";
+import { ToolRegistry } from "./registry.js";
+
+export type ProjectTrust = (realPluginDirectory: string) => Promise<boolean>;
+export interface PluginLoadResult {
+  registry: ToolRegistry;
+  loaded: string[];
+  failed: string[];
+}
+
+export type PluginImporter = (specifier: string) => Promise<{ default?: unknown }>;
+
+export class PluginLoader {
+  private static readonly defaultImporter: PluginImporter = (specifier) => import(specifier);
+  // Bun keys its module and directory caches by real path and ignores query
+  // strings, so re-importing a changed plugin file returns the stale module.
+  // Content-hash caching plus data: URL imports make /reload deterministic.
+  readonly #moduleCache = new Map<string, { hash: string; module: { default?: unknown } }>();
+  constructor(
+    private readonly builtins: ToolDefinition[],
+    private readonly events: EventBus,
+    private readonly auto: boolean,
+    private readonly trust?: ProjectTrust,
+    private readonly importer: PluginImporter = PluginLoader.defaultImporter,
+  ) {}
+  async load(
+    directories: Array<{ path: string; project: boolean }>,
+    baseRegistry?: ToolRegistry,
+  ): Promise<PluginLoadResult> {
+    const registry = baseRegistry?.clone() ?? new ToolRegistry(this.builtins);
+    const loaded: string[] = [];
+    const failed: string[] = [];
+    for (const target of directories) {
+      try {
+        const real = await realpath(target.path);
+        const targetStat = await stat(real);
+        const trustPath = targetStat.isDirectory() ? real : path.dirname(real);
+        if (target.project && !this.auto) {
+          const trusted = this.trust ? await this.trust(trustPath) : false;
+          if (!trusted) {
+            await this.events.emit("plugin.unavailable", {
+              path: trustPath,
+              reason: "not trusted",
+            });
+            continue;
+          }
+        }
+        const files = targetStat.isDirectory()
+          ? (await readdir(real))
+              .filter((entry) => entry.endsWith(".ts"))
+              .sort()
+              .map((entry) => path.join(real, entry))
+          : real.endsWith(".ts")
+            ? [real]
+            : [];
+        for (const file of files) {
+          try {
+            const module = await this.importPlugin(file);
+            if (!isToolDefinition(module.default))
+              throw new Error("default export is not a ToolDefinition");
+            registry.register(module.default, { kind: "local", path: file });
+            loaded.push(module.default.name);
+            await this.events.emit("plugin.loaded", { path: file, name: module.default.name });
+          } catch (error) {
+            failed.push(file);
+            await this.events.emit("plugin.failed", {
+              path: file,
+              message: error instanceof Error ? error.message : String(error),
+            });
+          }
+        }
+      } catch (error) {
+        if ((error as NodeJS.ErrnoException).code !== "ENOENT") {
+          failed.push(target.path);
+          await this.events.emit("plugin.failed", {
+            path: target.path,
+            message: error instanceof Error ? error.message : String(error),
+          });
+        }
+      }
+    }
+    return { registry, loaded, failed };
+  }
+
+  private async importPlugin(file: string): Promise<{ default?: unknown }> {
+    if (this.importer !== PluginLoader.defaultImporter) {
+      // Test seam: injected importers receive a file URL with an mtime marker.
+      const mtime = (await stat(file)).mtimeMs;
+      return this.importer(`${pathToFileURL(file).href}?mtime=${mtime}`);
+    }
+    const source = await readFile(file, "utf8");
+    const hash = createHash("sha256").update(source).digest("hex");
+    const cached = this.#moduleCache.get(file);
+    if (cached?.hash === hash) return cached.module;
+    // Plugins must be single-file and self-contained: relative imports cannot
+    // resolve from a data: URL, while bare package imports resolve from the
+    // current working directory as usual.
+    const stamped = `// coden-source: ${pathToFileURL(file).href}\n// coden-load: ${randomUUID()}\n${source}\n//# sourceURL=${pathToFileURL(file).href}\n`;
+    const module = (await this.importer(
+      `data:text/typescript;base64,${Buffer.from(stamped).toString("base64")}`,
+    )) as { default?: unknown };
+    this.#moduleCache.set(file, { hash, module });
+    return module;
+  }
+}
+
+function isToolDefinition(value: unknown): value is ToolDefinition {
+  if (!value || typeof value !== "object") return false;
+  const candidate = value as Partial<ToolDefinition>;
+  return (
+    typeof candidate.name === "string" &&
+    typeof candidate.description === "string" &&
+    (candidate.risk === "read" || candidate.risk === "modify" || candidate.risk === "dangerous") &&
+    !!candidate.inputSchema &&
+    typeof candidate.execute === "function"
+  );
+}

package/src/tools/registry.ts

@@ -0,0 +1,97 @@
+import Ajv from "ajv";
+import { CodeNError, type ToolDefinition } from "../core/types.js";
+
+const ajv = new Ajv({ allErrors: true, strict: false, useDefaults: true });
+
+export type ToolSource =
+  | { kind: "builtin" }
+  | { kind: "local"; path?: string }
+  | { kind: "npm"; pluginName: string; pluginVersion: string; path?: string };
+
+export interface RegisteredTool {
+  definition: ToolDefinition;
+  source: ToolSource;
+}
+
+export class ToolRegistry {
+  #tools = new Map<string, RegisteredTool>();
+
+  constructor(tools: ToolDefinition[] = []) {
+    for (const tool of tools) this.register(tool, { kind: "builtin" });
+  }
+
+  register(tool: ToolDefinition, source: ToolSource = { kind: "local" }): void {
+    if (!/^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/.test(tool.name))
+      throw new CodeNError("plugin", "tool.invalid_name", `Invalid tool name: ${tool.name}`);
+    const existing = this.#tools.get(tool.name);
+    if (existing)
+      throw new CodeNError(
+        "plugin",
+        "tool.duplicate",
+        `Duplicate tool: ${tool.name} from ${formatSource(existing.source)} and ${formatSource(source)}`,
+      );
+    try {
+      ajv.compile(tool.inputSchema);
+    } catch (cause) {
+      throw new CodeNError(
+        "plugin",
+        "tool.invalid_schema",
+        `Invalid schema for ${tool.name}`,
+        false,
+        undefined,
+        { cause },
+      );
+    }
+    this.#tools.set(tool.name, { definition: tool, source });
+  }
+
+  get(name: string): ToolDefinition | undefined {
+    return this.#tools.get(name)?.definition;
+  }
+
+  list(): ToolDefinition[] {
+    return [...this.#tools.values()].map((entry) => entry.definition);
+  }
+
+  source(name: string): ToolSource | undefined {
+    return this.#tools.get(name)?.source;
+  }
+
+  entries(): RegisteredTool[] {
+    return [...this.#tools.values()].map((entry) => ({
+      definition: entry.definition,
+      source: entry.source,
+    }));
+  }
+
+  clone(): ToolRegistry {
+    const registry = new ToolRegistry();
+    registry.#tools = new Map(this.#tools);
+    return registry;
+  }
+
+  replaceWith(candidate: ToolRegistry): void {
+    this.#tools = new Map(candidate.#tools);
+  }
+
+  validate(name: string, input: unknown): { valid: boolean; errors?: string } {
+    const tool = this.get(name);
+    if (!tool) return { valid: false, errors: `Unknown tool: ${name}` };
+    const validate = ajv.compile(tool.inputSchema);
+    const valid = validate(input);
+    return valid ? { valid: true } : { valid: false, errors: ajv.errorsText(validate.errors) };
+  }
+}
+
+function formatSource(source: ToolSource): string {
+  switch (source.kind) {
+    case "builtin":
+      return "builtin";
+    case "local":
+      return source.path ? `local:${source.path}` : "local";
+    case "npm":
+      return source.path
+        ? `${source.pluginName}@${source.pluginVersion}:${source.path}`
+        : `${source.pluginName}@${source.pluginVersion}`;
+  }
+}