@vizuh/sabi 0.1.4 → 0.1.5

package/mod/sabi.mjs

@@ -1,6 +1,260 @@
-// @vizuh/sabi 0.1.4 — generated by pack.mjs from packages/adapters/command-code/mod/sabi.ts.
+// @vizuh/sabi 0.1.5 — generated by pack.mjs from packages/adapters/command-code/mod/sabi.ts.
 // Source and docs: https://github.com/vizuh/sabi
 
+// packages/core/src/telemetry.ts
+var ALLOWLIST = /* @__PURE__ */ new Set([
+  "error-line",
+  "python-traceback",
+  "panic",
+  "exception",
+  "typescript-error",
+  "fail-marker",
+  "command-failed",
+  "nonzero-exit",
+  "failure-count",
+  "command-not-found",
+  "permission-denied",
+  "missing-file",
+  "soft-warning",
+  "soft-deprecated",
+  "soft-retrying",
+  "soft-timeout",
+  "tool-error",
+  "permission-denial",
+  "rate-limited",
+  "quota-exceeded",
+  "timeout",
+  "mutation",
+  "verification-receipt",
+  "summary-claim",
+  "scope-observed",
+  "constraint",
+  "prior-failure",
+  "context-boundary",
+  "observation"
+]);
+function allowlisted(value) {
+  const code = value.split(":")[0]?.trim();
+  return ALLOWLIST.has(code);
+}
+function telemetryPolicy(config) {
+  const captureSnippets = config?.captureSnippets === true;
+  const captureChars = config?.captureChars ?? 800;
+  return {
+    captureSnippets,
+    allowlisted: (value) => allowlisted(value),
+    snippet: (value) => captureSnippets ? String(value).slice(0, captureChars) : ""
+  };
+}
+function sanitizeReason(reason, policy) {
+  if (!policy.captureSnippets) {
+    if (!reason || allowlisted(reason)) return reason;
+    const segments = reason.split(":").map((segment) => segment.trim());
+    const last = segments[segments.length - 1] ?? "";
+    if (allowlisted(last)) return reason;
+    return "reason withheld (telemetry.allowlistOnly)";
+  }
+  return policy.snippet(reason);
+}
+var KEYWORD_REDACT = /\b(bearer|authorization|api[-_]?\s*key|token|secret|password|passwd)\b["']?\s*[:=\s]\s*["']?[^\s"'{},\]]+/gi;
+var BARE_TOKEN_REDACT = [
+  [/\bsk-[A-Za-z0-9_-]{8,}\b/g, "sk-[REDACTED]"],
+  [/\bAKIA[0-9A-Z]{16}\b/g, "AKIA[REDACTED]"],
+  [/\bAIza[0-9A-Za-z_-]{30,}\b/g, "AIza[REDACTED]"],
+  [/\bghp_[A-Za-z0-9]{8,}\b/g, "ghp_[REDACTED]"],
+  [/\bghu_[A-Za-z0-9]{8,}\b/g, "ghu_[REDACTED]"],
+  [/\bghs_[A-Za-z0-9]{8,}\b/g, "ghs_[REDACTED]"],
+  [/\bgithub_pat_[A-Za-z0-9_]{8,}\b/g, "github_pat_[REDACTED]"]
+];
+var CREDENTIAL_URL_REDACT = /([a-zA-Z][a-zA-Z0-9+.-]*:\/\/)[^:@\s/]+:[^@\s/]+@/g;
+function sanitizeError(error) {
+  const first = String(error ?? "").split("\n")[0]?.slice(0, 200) ?? "";
+  if (!first.trim()) return "unknown error";
+  let redacted = first.replace(KEYWORD_REDACT, "$1=REDACTED");
+  for (const [pattern, replacement] of BARE_TOKEN_REDACT) redacted = redacted.replace(pattern, replacement);
+  redacted = redacted.replace(CREDENTIAL_URL_REDACT, "$1REDACTED@");
+  if (looksLikeCanary(redacted)) return "upstream error redacted (possible secret)";
+  return redacted || "unknown error";
+}
+var CANARY_PATTERNS = [
+  /\b(BEGIN|END)\s+(RSA|OPENSSH|EC|DSA)\s+PRIVATE\s+KEY/i,
+  /\bsk-[A-Za-z0-9_-]{8,}\b/,
+  /\bAKIA[0-9A-Z]{16}\b/,
+  /\bAIza[0-9A-Za-z_-]{30,}\b/,
+  /\bghp_[A-Za-z0-9]{8,}\b/,
+  /\bghu_[A-Za-z0-9]{8,}\b/,
+  /\bghs_[A-Za-z0-9]{8,}\b/,
+  /\bgithub_pat_[A-Za-z0-9_]{8,}\b/,
+  /[a-zA-Z][a-zA-Z0-9+.-]*:\/\/[^:@\s/]+:[^@\s/]+@/,
+  /(?:password|passwd|pwd|secret)\s*[:=]\s*\S+/i
+];
+function looksLikeCanary(text) {
+  return CANARY_PATTERNS.some((re) => re.test(text));
+}
+
+// packages/core/src/evidence.ts
+var MAX_EVIDENCE_ITEMS = 16;
+var MAX_EVIDENCE_DETAIL_CHARS = 240;
+var MAX_SCOPE_ITEMS = 32;
+var MAX_SCOPE_LABEL_CHARS = 120;
+var MAX_RECEIPT_ID_CHARS = 128;
+var EVIDENCE_CODES = /* @__PURE__ */ new Set([
+  "error-line",
+  "python-traceback",
+  "panic",
+  "exception",
+  "typescript-error",
+  "fail-marker",
+  "command-failed",
+  "nonzero-exit",
+  "failure-count",
+  "command-not-found",
+  "permission-denied",
+  "missing-file",
+  "soft-warning",
+  "soft-deprecated",
+  "soft-retrying",
+  "soft-timeout",
+  "tool-error",
+  "permission-denial",
+  "rate-limited",
+  "quota-exceeded",
+  "timeout",
+  "mutation",
+  "verification-receipt",
+  "summary-claim",
+  "scope-observed",
+  "constraint",
+  "prior-failure",
+  "context-boundary",
+  "observation"
+]);
+var EVIDENCE_SOURCES = /* @__PURE__ */ new Set(["tool", "user", "harness", "judge", "summary"]);
+var EVIDENCE_STATUSES = /* @__PURE__ */ new Set(["observed", "verified", "unverified", "contradicted"]);
+function boundedText(value, maxChars) {
+  if (typeof value !== "string") return void 0;
+  const text = value.replace(/[\u0000-\u001f\u007f]/g, " ").trim();
+  if (!text || looksLikeCanary(text)) return void 0;
+  return text.slice(0, maxChars);
+}
+function generationOf(value) {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 ? value : 0;
+}
+function isEvidenceCode(value) {
+  return typeof value === "string" && EVIDENCE_CODES.has(value);
+}
+function isEvidenceSource(value) {
+  return typeof value === "string" && EVIDENCE_SOURCES.has(value);
+}
+function isEvidenceStatus(value) {
+  return typeof value === "string" && EVIDENCE_STATUSES.has(value);
+}
+function normalizeTrajectoryEvidence(value, fallbackGeneration = 0) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const item = value;
+  if (!isEvidenceCode(item.code) || !isEvidenceSource(item.source) || !isEvidenceStatus(item.status)) return void 0;
+  const detail = boundedText(item.detail, MAX_EVIDENCE_DETAIL_CHARS);
+  return {
+    code: item.code,
+    source: item.source,
+    status: item.status,
+    contextGeneration: generationOf(item.contextGeneration ?? fallbackGeneration),
+    ...detail ? { detail } : {}
+  };
+}
+function boundTrajectoryEvidence(values, maxItems = MAX_EVIDENCE_ITEMS) {
+  const result = [];
+  if (maxItems <= 0) return result;
+  const seen = /* @__PURE__ */ new Set();
+  for (const value of values ?? []) {
+    const item = normalizeTrajectoryEvidence(value);
+    if (!item) continue;
+    const key = JSON.stringify(item);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    result.push(item);
+    if (result.length >= Math.max(0, Math.min(maxItems, MAX_EVIDENCE_ITEMS))) break;
+  }
+  return result;
+}
+function countScope(value) {
+  if (typeof value === "number") return Number.isSafeInteger(value) && value >= 0 ? { count: value } : {};
+  if (!Array.isArray(value)) return {};
+  const labels = [...new Set(value.map((item) => boundedText(item, MAX_SCOPE_LABEL_CHARS)).filter((item) => Boolean(item)))].slice(0, MAX_SCOPE_ITEMS);
+  return { count: labels.length, labels };
+}
+function buildScopeCoverage(input = {}) {
+  const expected = countScope(input.expected);
+  const observed = countScope(input.observed);
+  const explicit = input.source === "explicit" || input.expected !== void 0;
+  const source = input.source ?? (explicit ? "explicit" : input.observed !== void 0 ? "inferred" : "unknown");
+  const expectedCount = expected.count;
+  const observedCount = observed.count;
+  const ratio = expectedCount !== void 0 && expectedCount > 0 && observedCount !== void 0 ? Math.min(1, observedCount / expectedCount) : void 0;
+  const missing = input.missing ? [...new Set(input.missing.map((item) => boundedText(item, MAX_SCOPE_LABEL_CHARS)).filter((item) => Boolean(item)))].slice(0, MAX_SCOPE_ITEMS) : expected.labels && observed.labels ? expected.labels.filter((item) => !observed.labels.includes(item)).slice(0, MAX_SCOPE_ITEMS) : void 0;
+  return {
+    ...expectedCount !== void 0 ? { expected: expectedCount } : {},
+    ...observedCount !== void 0 ? { observed: observedCount } : {},
+    ...ratio !== void 0 ? { ratio } : {},
+    source,
+    ...missing && missing.length > 0 ? { missing } : {}
+  };
+}
+function validReceipt(value, generation) {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return void 0;
+  const item = value;
+  const id = boundedText(item.id, MAX_RECEIPT_ID_CHARS);
+  const status = item.status === "passed" || item.status === "failed" ? item.status : void 0;
+  const source = item.source === "tool" || item.source === "user" || item.source === "harness" ? item.source : void 0;
+  const receiptGeneration = generationOf(item.generation);
+  if (!id || !status || !source || item.valid === false || receiptGeneration !== generation) return void 0;
+  return { id, status, source, generation: receiptGeneration, ...item.valid === true ? { valid: true } : {} };
+}
+function deriveVerificationState(input = {}) {
+  const generation = generationOf(input.generation);
+  const receiptCandidate = input.receipt;
+  if (receiptCandidate !== void 0) {
+    const receipt = validReceipt(receiptCandidate, generation);
+    if (receipt) return { status: receipt.status, receiptId: receipt.id, generation };
+    return { status: "unknown", reason: "invalid-receipt", generation };
+  }
+  if (input.summaryClaim) return { status: "unknown", reason: "summary-without-receipt", generation };
+  if (input.mutation) return { status: "needed", reason: "mutation-without-receipt", generation };
+  if (input.verificationAttempted) return { status: "attempted", reason: "missing-receipt", generation };
+  return { status: "not-required", generation };
+}
+function evidenceForTrajectory(state, options = {}) {
+  const generation = generationOf(state.contextGeneration);
+  const evidence = [];
+  if (state.roundKind === "implementation") evidence.push({ code: "mutation", source: "tool", status: "observed", contextGeneration: generation });
+  for (const code of state.failureEvidence) {
+    if (isEvidenceCode(code)) evidence.push({ code, source: "tool", status: "observed", contextGeneration: generation });
+  }
+  if (options.verificationReceipt) evidence.push({ code: "verification-receipt", source: "harness", status: "verified", contextGeneration: generation });
+  if (options.summaryClaim) evidence.push({ code: "summary-claim", source: "summary", status: "unverified", contextGeneration: generation });
+  if (generation > 0) evidence.push({ code: "context-boundary", source: "harness", status: "observed", contextGeneration: generation });
+  return boundTrajectoryEvidence(evidence);
+}
+function decorateTrajectoryState(state, metadata = {}) {
+  const generation = generationOf(metadata.generation ?? state.contextGeneration);
+  const receipt = metadata.verificationReceipt;
+  const verification = deriveVerificationState({
+    mutation: state.roundKind === "implementation",
+    verificationAttempted: state.roundKind === "verification",
+    summaryClaim: metadata.summaryClaim,
+    generation,
+    receipt
+  });
+  const scopeCoverage = metadata.scope ? buildScopeCoverage(metadata.scope) : void 0;
+  const evidence = evidenceForTrajectory(state, { summaryClaim: metadata.summaryClaim, verificationReceipt: receipt !== void 0 });
+  return {
+    ...state,
+    ...evidence.length > 0 ? { evidence } : {},
+    verification,
+    ...scopeCoverage ? { scopeCoverage } : {}
+  };
+}
+
 // packages/core/src/state.ts
 var EXPLORE_TOOLS = /* @__PURE__ */ new Set([
   "read",
@@ -678,6 +932,24 @@ function validateConfig(value, source = "<inline>") {
   return { ...config, upstreams, models, aliases, policy };
 }
 
+// packages/core/src/recovery-actions.ts
+var RECOVERY_ACTIONS = [
+  "continue",
+  "retry-same",
+  "retry-with-feedback",
+  "gather-evidence",
+  "escalate-model",
+  "fresh-context",
+  "rollback-with-reflection",
+  "ask-user"
+];
+function isRecoveryAction(value) {
+  return typeof value === "string" && RECOVERY_ACTIONS.includes(value);
+}
+function normalizeRecoveryAction(value, fallback = "ask-user") {
+  return isRecoveryAction(value) ? value : fallback;
+}
+
 // packages/core/src/log.ts
 import { appendFileSync, chmodSync, existsSync as existsSync2, mkdirSync, readFileSync as readFileSync2, writeFileSync } from "node:fs";
 import { createHmac, randomBytes, randomUUID } from "node:crypto";
@@ -774,12 +1046,101 @@ function recordLogWriteFailure(logFile, error) {
 }
 function appendDecision(record, logFile = defaultLogPath()) {
   try {
-    appendPrivateLine(logFile, `${JSON.stringify(record)}
+    appendPrivateLine(logFile, `${serializeDecisionRecord(record)}
 `);
   } catch (error) {
     recordLogWriteFailure(logFile, error);
   }
 }
+function boundedStringList(values, maxItems, maxChars) {
+  if (!Array.isArray(values)) return [];
+  return values.filter((value) => typeof value === "string" && value.trim().length > 0).map((value) => value.replace(/[\u0000-\u001f\u007f]/g, " ").slice(0, maxChars)).slice(0, maxItems);
+}
+function isPlainObject(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function sanitizeState(state, config) {
+  const policy = telemetryPolicy(config);
+  const failureEvidence = boundedStringList(state.failureEvidence, 8, 64).filter((value) => policy.allowlisted(value));
+  const evidence = boundTrajectoryEvidence(state.evidence);
+  const clean = {
+    messageCount: state.messageCount,
+    assistantTurns: state.assistantTurns,
+    toolMessages: state.toolMessages,
+    lastRole: String(state.lastRole ?? "").slice(0, 32),
+    contextChars: state.contextChars,
+    estimatedTokens: state.estimatedTokens,
+    hasTools: state.hasTools,
+    toolNames: boundedStringList(state.toolNames, 40, 120),
+    lastToolNames: boundedStringList(state.lastToolNames, 12, 120),
+    roundKind: state.roundKind,
+    failure: state.failure,
+    failureEvidence,
+    ...state.contextTokens !== void 0 ? { contextTokens: state.contextTokens } : {},
+    ...state.contextKnown !== void 0 ? { contextKnown: state.contextKnown } : {},
+    ...state.contextGeneration !== void 0 ? { contextGeneration: state.contextGeneration } : {},
+    ...state.repeatedFailure !== void 0 ? { repeatedFailure: state.repeatedFailure } : {},
+    ...state.failureStreak !== void 0 ? { failureStreak: state.failureStreak } : {},
+    ...state.contextWindow !== void 0 ? { contextWindow: state.contextWindow } : {},
+    ...state.inputModalities ? { inputModalities: state.inputModalities.slice(0, 5) } : {},
+    ...state.mediaCounts ? { mediaCounts: state.mediaCounts } : {},
+    ...evidence.length > 0 ? { evidence } : {},
+    ...state.verification ? { verification: { ...state.verification, receiptId: state.verification.receiptId?.slice(0, 128) } } : {},
+    ...state.scopeCoverage ? {
+      scopeCoverage: {
+        ...state.scopeCoverage,
+        ...state.scopeCoverage.missing ? { missing: boundedStringList(state.scopeCoverage.missing, 32, 120) } : {}
+      }
+    } : {}
+  };
+  return clean;
+}
+function sanitizeDecisionRecord(record, config) {
+  const policy = telemetryPolicy(config);
+  const state = isPlainObject(record.state) ? sanitizeState(record.state, config) : void 0;
+  const sanitized = {
+    ts: record.ts,
+    sessionId: record.sessionId,
+    sessionKnown: record.sessionKnown,
+    requestId: record.requestId,
+    client: record.client,
+    turnId: record.turnId,
+    servedModel: record.servedModel,
+    alias: record.alias,
+    mode: record.mode,
+    rule: record.rule,
+    tier: record.tier,
+    reason: sanitizeReason(String(record.reason ?? ""), policy),
+    upstream: record.upstream,
+    upstreamModel: record.upstreamModel,
+    stream: record.stream,
+    state,
+    judge: record.judge,
+    usage: record.usage,
+    cost: record.cost,
+    latencyMs: record.latencyMs,
+    ttftMs: record.ttftMs,
+    outcome: record.outcome,
+    ...record.error ? { error: sanitizeError(record.error) } : {},
+    transport: record.transport,
+    fallback: record.fallback,
+    ...record.recovery ? {
+      recovery: {
+        ...record.recovery,
+        action: normalizeRecoveryAction(record.recovery.action),
+        evidenceGrade: record.recovery.evidenceGrade === "matched" || record.recovery.evidenceGrade === "replayed" ? record.recovery.evidenceGrade : "observed",
+        failureSignature: String(record.recovery.failureSignature).slice(0, 64),
+        stateFingerprint: String(record.recovery.stateFingerprint).slice(0, 64),
+        ...record.recovery.route ? { route: String(record.recovery.route).slice(0, 160) } : {},
+        ...record.recovery.receiptId ? { receiptId: String(record.recovery.receiptId).slice(0, 128) } : {}
+      }
+    } : {}
+  };
+  return sanitized;
+}
+function serializeDecisionRecord(record, config) {
+  return JSON.stringify(sanitizeDecisionRecord(record, config));
+}
 function hashIdentity(kind, ...parts) {
   return createHmac("sha256", getIdentitySalt()).update(JSON.stringify([kind, ...parts])).digest("hex");
 }
@@ -804,7 +1165,7 @@ function trajectoryFromRound(round, previous) {
   const sameFailure = previous?.failure === "hard" && failure === "hard";
   const repeatedFailure = sameFailure === true;
   const failureStreak = repeatedFailure ? 2 : failure === "hard" ? 1 : 0;
-  return {
+  const state = {
     messageCount: round.messageCount,
     assistantTurns: round.assistantTurns,
     toolMessages: round.calls.length,
@@ -825,6 +1186,12 @@ function trajectoryFromRound(round, previous) {
     ...round.inputModalities ? { inputModalities: round.inputModalities } : {},
     ...round.mediaCounts && Object.keys(round.mediaCounts).length ? { inputModalities: round.inputModalities ?? modalitiesOf(round.mediaCounts), mediaCounts: round.mediaCounts } : {}
   };
+  return decorateTrajectoryState(state, {
+    generation: round.contextGeneration,
+    verificationReceipt: round.verificationReceipt,
+    summaryClaim: round.summaryClaim,
+    scope: round.scope
+  });
 }
 function roundMedia(round) {
   return { counts: round.mediaCounts ?? {}, payloadChars: 0 };
@@ -856,54 +1223,6 @@ function planRound(state, policy, tiers, options = {}) {
   };
 }
 
-// packages/core/src/telemetry.ts
-var ALLOWLIST = /* @__PURE__ */ new Set([
-  "error-line",
-  "python-traceback",
-  "panic",
-  "exception",
-  "typescript-error",
-  "fail-marker",
-  "command-failed",
-  "nonzero-exit",
-  "failure-count",
-  "command-not-found",
-  "permission-denied",
-  "missing-file",
-  "soft-warning",
-  "soft-deprecated",
-  "soft-retrying",
-  "soft-timeout",
-  "tool-error",
-  "permission-denial",
-  "rate-limited",
-  "quota-exceeded",
-  "timeout"
-]);
-function allowlisted(value) {
-  const code = value.split(":")[0]?.trim();
-  return ALLOWLIST.has(code);
-}
-function telemetryPolicy(config) {
-  const captureSnippets = config?.captureSnippets === true;
-  const captureChars = config?.captureChars ?? 800;
-  return {
-    captureSnippets,
-    allowlisted: (value) => allowlisted(value),
-    snippet: (value) => captureSnippets ? String(value).slice(0, captureChars) : ""
-  };
-}
-function sanitizeReason(reason, policy) {
-  if (!policy.captureSnippets) {
-    if (!reason || allowlisted(reason)) return reason;
-    const segments = reason.split(":").map((segment) => segment.trim());
-    const last = segments[segments.length - 1] ?? "";
-    if (allowlisted(last)) return reason;
-    return "reason withheld (telemetry.allowlistOnly)";
-  }
-  return policy.snippet(reason);
-}
-
 // packages/core/src/prompt.ts
 import * as readline from "node:readline/promises";
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vizuh/sabi",
-  "version": "0.1.4",
+  "version": "0.1.5",
   "description": "Adaptive inference scheduling for Command Code: one bundled mod that routes each continuing round by model, effort and trajectory state.",
   "type": "module",
   "license": "MIT",