@visual-z/xeno 0.8.2 → 0.8.3

package/src/core/events.ts

@@ -109,6 +109,22 @@ export interface OutcomeEvent {
   at: IsoTime;
   reason: string;
   outcome: ExecutionOutcome;
+  /** Why a failed request failed; absent on success and in logs written before it existed. */
+  failure?: FailureCause;
+}
+
+/**
+ * Credential-free facts about a failure (PLAYBOOK: provider error text never
+ * reaches the log). `label` is a phrase from retry.ts's fixed vocabulary or an
+ * error class name -- both chosen by code, never copied from a response body.
+ */
+export interface FailureCause {
+  /** provider: the model request failed after its retries; harness: xeno itself threw. */
+  source: "provider" | "harness";
+  label: string;
+  status?: number;
+  /** Retries the adapter actually made before giving up. */
+  retries?: number;
 }
 
 /** A factual harness notice, appended once rather than rewriting the prompt (N.1). */
@@ -116,7 +132,7 @@ export interface GuidanceEvent {
   t: "guidance";
   id: EventId;
   at: IsoTime;
-  reason: "continuation" | "repetition" | "budget" | "boundary" | "stall" | "output_recovery" | "completion_review" | "churn" | "deadline" | "runtime_acceptance" | "goal";
+  reason: "continuation" | "repetition" | "budget" | "boundary" | "stall" | "output_recovery" | "completion_review" | "churn" | "deadline" | "runtime_acceptance" | "goal" | "secret";
   text: string;
   sources: readonly EventId[];
 }
@@ -243,7 +259,8 @@ export interface CutEvent {
   handoff_tokens?: number;
   /** O.10: absent preserves the original D20 carried projection. */
   /** R9: present when the source-priority working set was carried across this cut. */
-  working_set_version?: 2;
+  /** 3: user turns are carried before other pages, with image references and one copy of each next action. */
+  working_set_version?: 2 | 3;
   /** R10: declared builtin advice capabilities at this cut, not an authorization grant. Absent replays old text. */
   guidance_tools?: readonly string[];
   /** N.8: first retained event on the effective ancestry; no copied transcript. */
@@ -564,8 +581,26 @@ export interface ProcessExitEvent {
   receipt?: import("./process-receipt.ts").ProcessReceipt;
 }
 
+/**
+ * Who let one call through the permission gate (feat-approval-events). A
+ * harness fact recorded between the call's invocation and its result, before
+ * the call starts; it never enters the model's context. `decision` is the
+ * person's prompt choice when `source` is `user`, otherwise the rule's own
+ * `allow` / `deny`. `rule` is the matched rule's text -- for `user`, the rule
+ * that asked. `no_prompt`: a rule asked and nobody could be asked.
+ */
+export interface ApprovalEvent {
+  t: "approval"; id: EventId; at: IsoTime;
+  call_id: string; tool: string;
+  decision: "once" | "command" | "tool" | "deny" | "allow";
+  source: "user" | "session_rule" | "config" | "auto" | "no_prompt";
+  command?: string;
+  rule?: string;
+}
+
 export type LogEvent =
   | ToolInvocationEvent
+  | ApprovalEvent
   | ProcessExitEvent
   | SkillLoadedEvent
   | AcceptanceContractEvent
@@ -606,6 +641,7 @@ export const HARNESS_EVENTS = [
   "checkpoint", "workspace_observation",
   "target_observation",
   "process_exit",
+  "approval",
   "skill_loaded",
   "acceptance_contract", "acceptance_decision", "goal", "counter_check", "blind_check",
   "user", "user_bash", "outcome", "guidance", "interrupt", "assistant", "tool_result", "cut", "rewind", "extension",

package/src/core/evidence.ts

@@ -74,15 +74,109 @@ export function exchangeProgressChecks(events: readonly LogEvent[]): Set<string>
   return eligibleProgressChecks(events, claimed, new Set([...gates].filter(([, exit]) => exit !== 0).map(([gate]) => gate)));
 }
 
-/** D11: classify an actual verifier invocation, never a runner word in data. */
+/**
+ * D11: classify an actual verifier invocation, never a runner word in data.
+ *
+ * Only command shapes whose exit 0 proves every gate in them exited 0 are
+ * read: simple commands joined by `&&` (the chain stops at the first failure),
+ * each optionally ending in output redirects to fixed paths (a redirect that
+ * cannot open fails the command, it never masks one). Anything that can turn
+ * a failure into exit 0 or run text the log does not show -- `;`, `||`,
+ * pipes, background jobs, subshells, expansions, input redirects -- rejects
+ * the whole command, as before. A chain's gates join with `+` in order, so a
+ * failed chain is recorded as that chain failing, not as one of its parts.
+ */
 export function classifyGate(gates: Readonly<Record<string, string>>, command: string): string | undefined {
-  if (/[\n\r;&|<>`$(){}'"\\]/.test(command)) return undefined;
-  const tokens = command.trim().split(/\s+/);
-  const informational = ["--version", "-V", "--help", "-h", "--collect-only", "--listTests", "--showConfig", "--init", "--fixtures", "--markers"];
-  if (tokens.some((t) => informational.includes(t))) return undefined;
+  const segments = gateSegments(command);
+  if (!segments) return undefined;
+  const names = [...new Set(segments.flatMap((words) => segmentGates(gates, words)))];
+  return names.length === 0 ? undefined : names.join("+");
+}
+
+type ShellToken = { kind: "word"; value: string } | { kind: "and" } | { kind: "redirect"; target: boolean };
+
+/**
+ * A deliberately small tokenizer, not a shell parser (M.2): it accepts the
+ * subset above and returns undefined for everything else, so an unfamiliar
+ * construct can only lose a gate, never forge one. Quotes may hold plain text
+ * only; `$`, backticks and backslashes are rejected even inside them.
+ */
+function shellTokens(command: string): ShellToken[] | undefined {
+  const tokens: ShellToken[] = [];
+  let word: string | undefined, i = 0;
+  const end = () => { if (word !== undefined) tokens.push({ kind: "word", value: word }); word = undefined; };
+  while (i < command.length) {
+    const c = command[i]!;
+    if (c === " " || c === "\t") { end(); i++; continue; }
+    if (c === "#" && word === undefined) break; // a comment runs to the end of the (single) line
+    if (c === "'" || c === '"') {
+      const close = command.indexOf(c, i + 1);
+      if (close < 0) return undefined;
+      const quoted = command.slice(i + 1, close);
+      if (/[$`\\\n\r]/.test(quoted)) return undefined;
+      word = (word ?? "") + quoted; i = close + 1; continue;
+    }
+    if (c === "&" && command[i + 1] === "&") { end(); tokens.push({ kind: "and" }); i += 2; continue; }
+    if (c === ">" || c === "&" && command[i + 1] === ">") {
+      // An unquoted 1 or 2 directly before `>` is the descriptor, not a word.
+      if (c === ">" && (word === "1" || word === "2") && /[12]$/.test(command.slice(0, i))) word = undefined;
+      end();
+      i += c === "&" ? 2 : 1;
+      if (command[i] === ">") i++;
+      if (c === ">" && command[i] === "&") {
+        if (!/^[12](?![^\s&])/.test(command.slice(i + 1))) return undefined;
+        tokens.push({ kind: "redirect", target: false }); i += 2; continue;
+      }
+      if (command[i] === "|") return undefined;
+      tokens.push({ kind: "redirect", target: true }); continue;
+    }
+    if (/[\n\r;&|<`$(){}\\]/.test(c)) return undefined;
+    word = (word ?? "") + c; i++;
+  }
+  end();
+  return tokens;
+}
+
+/** The `&&`-joined segments' words with trailing output redirects removed. */
+function gateSegments(command: string): string[][] | undefined {
+  const tokens = shellTokens(command);
+  if (!tokens) return undefined;
+  const segments: string[][] = [[]];
+  let redirected = false, needTarget = false;
+  for (const token of tokens) {
+    const words = segments.at(-1)!;
+    if (token.kind === "and") {
+      if (needTarget || words.length === 0) return undefined;
+      segments.push([]); redirected = false; continue;
+    }
+    if (token.kind === "redirect") {
+      if (needTarget || words.length === 0) return undefined;
+      redirected = true; needTarget = token.target; continue;
+    }
+    if (needTarget) { needTarget = false; continue; }
+    // Only trailing redirects are stripped; one before an argument is rejected.
+    if (redirected) return undefined;
+    words.push(token.value);
+  }
+  return needTarget || segments.at(-1)!.length === 0 ? undefined : segments;
+}
+
+const INFORMATIONAL = ["--version", "-V", "--help", "-h", "--collect-only", "--listTests", "--showConfig", "--init", "--fixtures", "--markers"];
+
+/** One simple command's gates: none, the runner's gate, or a target runner's gate targets. */
+function segmentGates(gates: Readonly<Record<string, string>>, tokens: readonly string[]): string[] {
+  if (tokens.some((t) => INFORMATIONAL.includes(t))) return [];
+  const first = tokens[0] ?? "";
+  const runner = own(TARGET_RUNNERS, first);
+  if (runner && !Object.hasOwn(gates, first)) return targetGates(gates, runner, tokens.slice(1));
+  const single = runnerGate(gates, tokens);
+  return single === undefined ? [] : [single];
+}
+
+function runnerGate(gates: Readonly<Record<string, string>>, tokens: readonly string[]): string | undefined {
   let i = 0;
   const first = tokens[0];
-  if (["bun", "npm", "pnpm", "yarn"].includes(first ?? "") && tokens[1] === "test") return gates["test"];
+  if (["bun", "npm", "pnpm", "yarn"].includes(first ?? "") && tokens[1] === "test") return own(gates, "test");
   if (first === "python" || first === "python3") {
     if (tokens[1] !== "-m") return undefined;
     i = 2;
@@ -94,5 +188,53 @@ export function classifyGate(gates: Readonly<Record<string, string>>, command: s
   const executable = tokens[i];
   if (executable === "cargo" && !["test", "check", "clippy", "build"].includes(tokens[i + 1] ?? "")) return undefined;
   if (executable === "vitest" && ["list", "init"].includes(tokens[i + 1] ?? "")) return undefined;
-  return gates[executable ?? ""];
+  return own(gates, executable ?? "");
+}
+
+/** A table lookup that a word like `constructor` cannot satisfy through the prototype. */
+function own<T>(table: Readonly<Record<string, T>>, key: string): T | undefined {
+  return Object.hasOwn(table, key) ? table[key] : undefined;
+}
+
+/**
+ * Options a target runner may carry and still prove its targets ran. An
+ * allowlist on purpose: an unknown option might be a dry run, a touch or an
+ * ignore-errors switch (exit 0 without the targets passing), so it makes the
+ * segment not a gate rather than being guessed at.
+ */
+type TargetRunner = { withValue: readonly string[]; flags: readonly string[]; attached: RegExp; argsAfterDashes: boolean };
+const TARGET_RUNNERS: Readonly<Record<string, TargetRunner>> = {
+  make: { withValue: ["-C", "-f", "--directory", "--file", "--makefile"],
+    flags: ["-k", "-s", "-B", "-w", "-r", "-R", "--keep-going", "--silent", "--quiet", "--always-make", "--print-directory", "--no-print-directory"],
+    attached: /^(?:-C.+|-f.+|-j\d*|--(?:directory|file|makefile|jobs)=.+|--jobs)$/, argsAfterDashes: false },
+  just: { withValue: ["-f", "-d", "--justfile", "--working-directory"], flags: ["-q", "-v", "--quiet", "--verbose"],
+    attached: /^--(?:justfile|working-directory)=.+$/, argsAfterDashes: false },
+  task: { withValue: ["-d", "-t", "--dir", "--taskfile"], flags: ["-s", "-v", "-p", "-f", "--silent", "--verbose", "--parallel", "--force"],
+    attached: /^--(?:dir|taskfile)=.+$/, argsAfterDashes: true },
+};
+
+/**
+ * `make build size test`: the runner exits 0 only when every target
+ * succeeded, so each target named after a configured gate key (exactly, or
+ * as `<key>-…` / `<key>:…`) is that gate; other targets do not weaken it. No
+ * gate target, or no target at all (the default goal is unknown), is no gate.
+ */
+function targetGates(gates: Readonly<Record<string, string>>, runner: TargetRunner, args: readonly string[]): string[] {
+  const keys = Object.keys(gates).sort((a, b) => b.length - a.length);
+  const names: string[] = [];
+  for (let i = 0; i < args.length; i++) {
+    const arg = args[i]!;
+    if (arg === "--") { if (runner.argsAfterDashes) break; return []; }
+    if (arg.startsWith("-")) {
+      if (runner.withValue.includes(arg)) { if (++i >= args.length) return []; continue; }
+      if (arg === "-j" && /^\d+$/.test(args[i + 1] ?? "")) { i++; continue; }
+      if (runner.flags.includes(arg) || runner.attached.test(arg)) continue;
+      return [];
+    }
+    if (arg.includes("=")) continue; // a variable override, not a target
+    if (/[*?[\]~]/.test(arg)) return [];
+    const key = keys.find((k) => arg === k || arg.startsWith(`${k}-`) || arg.startsWith(`${k}:`));
+    if (key !== undefined) names.push(gates[key]!);
+  }
+  return names;
 }

package/src/core/export.ts

@@ -137,6 +137,8 @@ function eventHtml(e: LogEvent): string {
     case "evidence_link":
       return wrap("event", "evidence link", e.at, `${e.work}: ${e.what} → ${e.source}`);
     case "work_owner": case "work_dependencies": return wrap("event", e.t, e.at, JSON.stringify(e));
+    case "approval": return wrap("event", "approval", e.at,
+      [`${e.tool} · ${e.call_id} · ${e.decision} · ${e.source}`, ...(e.rule ? [`rule: ${e.rule}`] : []), ...(e.command !== undefined ? [`$ ${e.command}`] : [])].join("\n"));
     case "skill_loaded": return wrap("event", "skill loaded", e.at, `${e.name} · ${e.path} · ${e.sha256} · ${e.mode}`);
     case "process_exit": return wrap("event", "process exit", e.at, `${e.session} · exit ${e.exit} · output ${e.output.sha256}`);
     case "acceptance_contract": return wrap("event", "acceptance contract", e.at, JSON.stringify(e.contract));