@wrongstack/core 0.1.8 → 0.1.9
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/defaults/index.d.ts +104 -1
- package/dist/defaults/index.js +239 -3
- package/dist/defaults/index.js.map +1 -1
- package/dist/index.d.ts +5 -4
- package/dist/index.js +240 -4
- package/dist/index.js.map +1 -1
- package/package.json +2 -2
- package/skills/audit-log/SKILL.md +67 -0
- package/skills/bug-hunter/SKILL.md +87 -0
- package/skills/refactor-planner/SKILL.md +94 -0
- package/skills/security-scanner/SKILL.md +117 -0
package/dist/index.d.ts
CHANGED
|
@@ -8,7 +8,7 @@ export { aC as Agent, a as AgentBridge, b as AgentBridgeConfig, aD as AgentInit,
|
|
|
8
8
|
import { S as SystemPromptBuilder, M as ModelCapabilities, B as BuildContext } from './system-prompt-vAB0F54-.js';
|
|
9
9
|
export { AtomicWriteOptions, NewlineStyle, SafeParseResult, ToolOutputSerializerOptions, UnifiedDiffOptions, ValidationError, ValidationResult, atomicWrite, color, compileGlob, createToolOutputSerializer, detectNewlineStyle, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, matchAny, matchGlob, normalizeToLf, safeParse, safeStringify, sanitizeJsonString, stripAnsi, toStyle, unifiedDiff, validateAgainstSchema } from './utils/index.js';
|
|
10
10
|
export { W as WstackPathOptions, a as WstackPaths, p as projectHash, r as resolveWstackPaths } from './wstack-paths-BGu2INTm.js';
|
|
11
|
-
export { AbandonedSession, AgentFactory, AgentFactoryResult, AgentRunnerOptions, AttachmentStoreOptions, AutoCompactionMiddleware, AutonomousRunner, AutonomousRunnerOptions, CompactorOptions, ConfigLoaderOptions, ConfigMigration, ConfigMigrationError, ConfigSource, ContextManagerAction, ContextManagerInput, ContextManagerResult, ContextManagerToolOptions, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultLoggerOptions, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultModelsRegistryOptions, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, DefaultTokenCounter, Director, DirectorPromptParts, DirectorSessionFactory, DirectorSessionFactoryOptions, DoneCheckResult, DoneConditionChecker, FleetBus, FleetEvent, FleetHandler, FleetUsage, FleetUsageAggregator, GeneratedTask, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, IntelligentCompactorOptions, LLMSelector, LLMSelectorOptions, MemoryStoreOptions, MetricsServerHandle, MetricsServerOptions, MigrationContext, MigrationResult, ModeLoaderOptions, MultiAgentCoordinatorOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, PermissionPolicyOptions, PersistedQueueItem, QueueStore, RecoveryLock, RecoveryLockOptions, SecretVaultOptions, SelectiveCompactor, SelectiveCompactorOptions, SessionStoreOptions, SkillLoaderOptions, SpecDrivenDev, SpecDrivenDevOptions, SpecParser, SubagentPromptParts, SubagentUsageSnapshot, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, ToolExecutor, allServers, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createContextManagerTool, createMessage, decryptConfigSecrets, encryptConfigSecrets, everArtServer, filesystemServer, githubServer, googleMapsServer, loadProjectModes, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, renderPrometheus, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from './defaults/index.js';
|
|
11
|
+
export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, AbandonedSession, AgentFactory, AgentFactoryResult, AgentRunnerOptions, AttachmentStoreOptions, AutoCompactionMiddleware, AutonomousRunner, AutonomousRunnerOptions, BUG_HUNTER_AGENT, CompactorOptions, ConfigLoaderOptions, ConfigMigration, ConfigMigrationError, ConfigSource, ContextManagerAction, ContextManagerInput, ContextManagerResult, ContextManagerToolOptions, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultLoggerOptions, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultModelsRegistryOptions, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultTaskStore, DefaultTokenCounter, Director, DirectorBudgetError, DirectorPromptParts, DirectorSessionFactory, DirectorSessionFactoryOptions, DoneCheckResult, DoneConditionChecker, FLEET_ROSTER, FleetBus, FleetEvent, FleetHandler, FleetUsage, FleetUsageAggregator, GeneratedTask, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, IntelligentCompactor, IntelligentCompactorOptions, LLMSelector, LLMSelectorOptions, MemoryStoreOptions, MetricsServerHandle, MetricsServerOptions, MigrationContext, MigrationResult, ModeLoaderOptions, MultiAgentCoordinatorOptions, NoopMetricsSink, NoopTracer, OTelTracer, OtlpMetricsExporterHandle, OtlpMetricsExporterOptions, OtlpTraceExporterHandle, OtlpTraceExporterOptions, PROMETHEUS_CONTENT_TYPE, PermissionPolicyOptions, PersistedQueueItem, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, RecoveryLockOptions, SECURITY_SCANNER_AGENT, SecretVaultOptions, SelectiveCompactor, SelectiveCompactorOptions, SessionStoreOptions, SkillLoaderOptions, SpecDrivenDev, SpecDrivenDevOptions, SpecParser, SubagentPromptParts, SubagentUsageSnapshot, TaskFlow, TaskFlowEventMap, TaskFlowEventName, TaskFlowExecutionContext, TaskFlowOptions, TaskFlowPhase, TaskGenerator, TaskGeneratorOptions, TaskStore, TaskTracker, TaskTrackerOptions, TaskTransition, ToolExecutor, allServers, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, composeDirectorPrompt, composeSubagentPrompt, context7Server, contextManagerTool, createContextManagerTool, createMessage, decryptConfigSecrets, encryptConfigSecrets, everArtServer, filesystemServer, githubServer, googleMapsServer, loadProjectModes, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, migratePlaintextSecrets, renderPrometheus, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, wireMetricsToEvents } from './defaults/index.js';
|
|
12
12
|
import 'node:events';
|
|
13
13
|
|
|
14
14
|
interface InputBuilderOptions {
|
|
@@ -179,11 +179,12 @@ declare class DefaultPluginAPI implements PluginAPI {
|
|
|
179
179
|
* (PluginAPI, types/plugin) changes in a way that breaks existing setup
|
|
180
180
|
* functions. Plugins declare `apiVersion: "^1.0"` to opt into this contract.
|
|
181
181
|
*
|
|
182
|
-
* 0.1.
|
|
183
|
-
*
|
|
182
|
+
* 0.1.9: additive — `DirectorBudgetError` plus `FLEET_ROSTER` and the
|
|
183
|
+
* pre-built fleet agent configs (Audit Log, Bug Hunter, Refactor Planner,
|
|
184
|
+
* Security Scanner) now exported from `@wrongstack/core`.
|
|
184
185
|
* Plugins pinning `apiVersion: "^0.1"` continue to load unchanged.
|
|
185
186
|
*/
|
|
186
|
-
declare const KERNEL_API_VERSION = "0.1.
|
|
187
|
+
declare const KERNEL_API_VERSION = "0.1.9";
|
|
187
188
|
interface LoadPluginsOptions {
|
|
188
189
|
apiFactory: (plugin: Plugin) => PluginAPI;
|
|
189
190
|
log: Logger;
|
package/dist/index.js
CHANGED
|
@@ -5080,6 +5080,15 @@ ${parts.role.trim()}`);
|
|
|
5080
5080
|
sections.push(`Task:
|
|
5081
5081
|
${parts.task.trim()}`);
|
|
5082
5082
|
}
|
|
5083
|
+
if (parts.sharedScratchpad && parts.sharedScratchpad.trim().length > 0) {
|
|
5084
|
+
sections.push(
|
|
5085
|
+
`Shared notes:
|
|
5086
|
+
A scratchpad shared with the rest of the fleet is mounted at \`${parts.sharedScratchpad.trim()}\`.
|
|
5087
|
+
- Write your final findings as markdown files there (e.g. \`findings.md\`, \`security.md\`).
|
|
5088
|
+
- Before starting, list the directory and read any sibling files relevant to your task \u2014 they may already contain context you can build on.
|
|
5089
|
+
- Use stable filenames (one file per concern); overwrite instead of appending so the Director sees the latest state.`
|
|
5090
|
+
);
|
|
5091
|
+
}
|
|
5083
5092
|
if (parts.override && parts.override.trim().length > 0) {
|
|
5084
5093
|
sections.push(parts.override.trim());
|
|
5085
5094
|
}
|
|
@@ -5097,6 +5106,20 @@ function rosterSummaryFromConfigs(roster) {
|
|
|
5097
5106
|
}
|
|
5098
5107
|
|
|
5099
5108
|
// src/defaults/director.ts
|
|
5109
|
+
var DirectorBudgetError = class extends Error {
|
|
5110
|
+
kind;
|
|
5111
|
+
limit;
|
|
5112
|
+
observed;
|
|
5113
|
+
constructor(kind, limit, observed) {
|
|
5114
|
+
super(
|
|
5115
|
+
kind === "max_spawns" ? `Director spawn budget exceeded: tried to spawn #${observed} but maxSpawns is ${limit}` : `Director spawn depth budget exceeded: this director is at depth ${observed} and maxSpawnDepth is ${limit}`
|
|
5116
|
+
);
|
|
5117
|
+
this.name = "DirectorBudgetError";
|
|
5118
|
+
this.kind = kind;
|
|
5119
|
+
this.limit = limit;
|
|
5120
|
+
this.observed = observed;
|
|
5121
|
+
}
|
|
5122
|
+
};
|
|
5100
5123
|
var Director = class {
|
|
5101
5124
|
id;
|
|
5102
5125
|
fleet;
|
|
@@ -5131,12 +5154,32 @@ var Director = class {
|
|
|
5131
5154
|
roster;
|
|
5132
5155
|
directorPreamble;
|
|
5133
5156
|
subagentBaseline;
|
|
5157
|
+
/** Absolute path to the fleet's shared scratchpad directory, or null
|
|
5158
|
+
* when none was configured. Exposed as a readonly getter for callers
|
|
5159
|
+
* that need to surface the path to the user (e.g. the CLI logging
|
|
5160
|
+
* the location after `--director` boots). */
|
|
5161
|
+
sharedScratchpadPath;
|
|
5162
|
+
/** Spawn cap (lifetime total). Infinity means unlimited. */
|
|
5163
|
+
maxSpawns;
|
|
5164
|
+
/** Nesting cap. The N-th director in a chain has `spawnDepth = N-1`. */
|
|
5165
|
+
maxSpawnDepth;
|
|
5166
|
+
/** This director's position in a director chain. Root director = 0. */
|
|
5167
|
+
spawnDepth;
|
|
5168
|
+
/** Live spawn counter for `maxSpawns` enforcement. */
|
|
5169
|
+
spawnCount = 0;
|
|
5134
5170
|
constructor(opts) {
|
|
5135
5171
|
this.id = opts.config.coordinatorId || randomUUID();
|
|
5136
5172
|
this.manifestPath = opts.manifestPath;
|
|
5137
5173
|
this.roster = opts.roster;
|
|
5138
5174
|
this.directorPreamble = opts.directorPreamble ?? DEFAULT_DIRECTOR_PREAMBLE;
|
|
5139
5175
|
this.subagentBaseline = opts.subagentBaseline ?? DEFAULT_SUBAGENT_BASELINE;
|
|
5176
|
+
this.sharedScratchpadPath = opts.sharedScratchpadPath ?? null;
|
|
5177
|
+
this.maxSpawns = opts.maxSpawns ?? Infinity;
|
|
5178
|
+
this.maxSpawnDepth = opts.maxSpawnDepth ?? 2;
|
|
5179
|
+
this.spawnDepth = opts.spawnDepth ?? 0;
|
|
5180
|
+
if (this.sharedScratchpadPath) {
|
|
5181
|
+
void fsp.mkdir(this.sharedScratchpadPath, { recursive: true }).catch(() => void 0);
|
|
5182
|
+
}
|
|
5140
5183
|
this.transport = new InMemoryBridgeTransport();
|
|
5141
5184
|
this.bridge = new InMemoryAgentBridge(
|
|
5142
5185
|
{ agentId: this.id, coordinatorId: this.id },
|
|
@@ -5172,6 +5215,13 @@ var Director = class {
|
|
|
5172
5215
|
* it the `cost` column in `usage.snapshot()` stays at 0.
|
|
5173
5216
|
*/
|
|
5174
5217
|
async spawn(config, priceLookup) {
|
|
5218
|
+
if (this.spawnDepth >= this.maxSpawnDepth) {
|
|
5219
|
+
throw new DirectorBudgetError("max_spawn_depth", this.maxSpawnDepth, this.spawnDepth);
|
|
5220
|
+
}
|
|
5221
|
+
if (this.spawnCount >= this.maxSpawns) {
|
|
5222
|
+
throw new DirectorBudgetError("max_spawns", this.maxSpawns, this.spawnCount + 1);
|
|
5223
|
+
}
|
|
5224
|
+
this.spawnCount += 1;
|
|
5175
5225
|
const result = await this.coordinator.spawn(config);
|
|
5176
5226
|
this.subagentMeta.set(result.subagentId, {
|
|
5177
5227
|
provider: config.provider,
|
|
@@ -5424,6 +5474,7 @@ var Director = class {
|
|
|
5424
5474
|
baseline: this.subagentBaseline,
|
|
5425
5475
|
role: config.prompt,
|
|
5426
5476
|
task: taskBrief,
|
|
5477
|
+
sharedScratchpad: this.sharedScratchpadPath ?? void 0,
|
|
5427
5478
|
override: config.systemPromptOverride
|
|
5428
5479
|
});
|
|
5429
5480
|
}
|
|
@@ -5493,8 +5544,15 @@ function makeSpawnTool(director, roster) {
|
|
|
5493
5544
|
if (typeof i.maxIterations === "number") cfg.maxIterations = i.maxIterations;
|
|
5494
5545
|
if (typeof i.maxToolCalls === "number") cfg.maxToolCalls = i.maxToolCalls;
|
|
5495
5546
|
if (typeof i.maxCostUsd === "number") cfg.maxCostUsd = i.maxCostUsd;
|
|
5496
|
-
|
|
5497
|
-
|
|
5547
|
+
try {
|
|
5548
|
+
const subagentId = await director.spawn(cfg);
|
|
5549
|
+
return { subagentId, provider: cfg.provider, model: cfg.model, name: cfg.name };
|
|
5550
|
+
} catch (err) {
|
|
5551
|
+
if (err instanceof DirectorBudgetError) {
|
|
5552
|
+
return { error: err.message, kind: err.kind, limit: err.limit, observed: err.observed };
|
|
5553
|
+
}
|
|
5554
|
+
return { error: err instanceof Error ? err.message : String(err) };
|
|
5555
|
+
}
|
|
5498
5556
|
}
|
|
5499
5557
|
};
|
|
5500
5558
|
}
|
|
@@ -5685,6 +5743,184 @@ function makeDirectorSessionFactory(opts) {
|
|
|
5685
5743
|
};
|
|
5686
5744
|
}
|
|
5687
5745
|
|
|
5746
|
+
// src/defaults/agents/fleet.ts
|
|
5747
|
+
var AUDIT_LOG_AGENT = {
|
|
5748
|
+
id: "audit-log",
|
|
5749
|
+
name: "Audit Log",
|
|
5750
|
+
role: "audit-log",
|
|
5751
|
+
prompt: `You are the Audit Log agent. Your job is to analyze structured JSONL
|
|
5752
|
+
session logs and produce actionable markdown reports.
|
|
5753
|
+
|
|
5754
|
+
Scope:
|
|
5755
|
+
- Parse session logs (iteration counts, tool calls, errors, usage)
|
|
5756
|
+
- Detect repeated failure patterns across multiple runs
|
|
5757
|
+
- Identify tool usage anomalies (over-use, failures, unexpected chains)
|
|
5758
|
+
- Track token consumption trends
|
|
5759
|
+
- Generate structured audit reports with severity ratings
|
|
5760
|
+
|
|
5761
|
+
Input format you accept:
|
|
5762
|
+
{ "task": "analyze | report | trends", "sessionPath": "<path>", "focus": "errors | tools | usage | all" }
|
|
5763
|
+
|
|
5764
|
+
Output: Markdown audit report with sections:
|
|
5765
|
+
- ## Summary (totals, error rate)
|
|
5766
|
+
- ## Top Errors (count + context)
|
|
5767
|
+
- ## Tool Usage (table with calls, failures, avg duration)
|
|
5768
|
+
- ## Anomalies (pattern \u2192 severity)
|
|
5769
|
+
|
|
5770
|
+
Working rules:
|
|
5771
|
+
- Never fabricate numbers \u2014 read the actual logs first
|
|
5772
|
+
- Always include file:line references for errors
|
|
5773
|
+
- If sessionPath is missing, ask the director to provide it
|
|
5774
|
+
- Report confidence level: high (>90% accuracy), medium, low`,
|
|
5775
|
+
maxIterations: 50,
|
|
5776
|
+
maxToolCalls: 200,
|
|
5777
|
+
timeoutMs: 12e4
|
|
5778
|
+
};
|
|
5779
|
+
var BUG_HUNTER_AGENT = {
|
|
5780
|
+
id: "bug-hunter",
|
|
5781
|
+
name: "Bug Hunter",
|
|
5782
|
+
role: "bug-hunter",
|
|
5783
|
+
prompt: `You are the Bug Hunter agent. Your job is to systematically scan
|
|
5784
|
+
source code for bugs, anti-patterns, and code smells using pattern matching
|
|
5785
|
+
and heuristics. Output a prioritized hit list with file:line references.
|
|
5786
|
+
|
|
5787
|
+
Scope:
|
|
5788
|
+
- Detect common bug patterns (uncaught errors, resource leaks, race conditions)
|
|
5789
|
+
- Identify anti-patterns (callback hell, God objects, circular deps)
|
|
5790
|
+
- Find TypeScript-specific issues (unsafe any, missing null checks, branded types)
|
|
5791
|
+
- Flag security-sensitive constructs (eval, innerHTML, hardcoded secrets)
|
|
5792
|
+
- Rank findings: critical > high > medium > low
|
|
5793
|
+
|
|
5794
|
+
Input format you accept:
|
|
5795
|
+
{ "task": "scan | hunt | check", "paths": ["src/**/*.ts"], "focus": "bugs | patterns | security | all", "severityThreshold": "medium" }
|
|
5796
|
+
|
|
5797
|
+
Output: Markdown bug hunt report:
|
|
5798
|
+
- ## Critical (must fix first)
|
|
5799
|
+
- ## High (should fix)
|
|
5800
|
+
- ## Medium
|
|
5801
|
+
- ## Low (consider)
|
|
5802
|
+
Each entry: **[TYPE]** \`file:line\` \u2014 description + suggested fix
|
|
5803
|
+
|
|
5804
|
+
Bug pattern reference you know:
|
|
5805
|
+
| Pattern | Regex hint | Severity |
|
|
5806
|
+
|---------|------------|----------|
|
|
5807
|
+
| Uncaught promise | /.then\\(.*\\)/ without catch | high |
|
|
5808
|
+
| Event leak | on\\( without off/removeListener | high |
|
|
5809
|
+
| Hardcoded secret | [a-zA-Z0-9/_-]{20,} in config files | critical |
|
|
5810
|
+
| unsafe any | : any\\b or <any> | medium |
|
|
5811
|
+
| innerHTML | innerHTML\\s*= | high |
|
|
5812
|
+
|
|
5813
|
+
Working rules:
|
|
5814
|
+
- Never scan node_modules \u2014 it's noise
|
|
5815
|
+
- Always include file:line for every finding
|
|
5816
|
+
- If >30% of findings are false positives, note the confidence level
|
|
5817
|
+
- Ask director for clarification if paths are ambiguous`,
|
|
5818
|
+
maxIterations: 80,
|
|
5819
|
+
maxToolCalls: 300,
|
|
5820
|
+
timeoutMs: 18e4
|
|
5821
|
+
};
|
|
5822
|
+
var REFACTOR_PLANNER_AGENT = {
|
|
5823
|
+
id: "refactor-planner",
|
|
5824
|
+
name: "Refactor Planner",
|
|
5825
|
+
role: "refactor-planner",
|
|
5826
|
+
prompt: `You are the Refactor Planner agent. Your job is to analyze code
|
|
5827
|
+
structure and produce a concrete, phased refactoring plan with risk
|
|
5828
|
+
assessment, dependency ordering, and rollback strategy.
|
|
5829
|
+
|
|
5830
|
+
Scope:
|
|
5831
|
+
- Map module-level dependencies (import graph)
|
|
5832
|
+
- Identify coupling hotspots (high fan-in/out modules)
|
|
5833
|
+
- Assess refactoring risk by complexity and test coverage
|
|
5834
|
+
- Generate phased plans with checkpoint milestones
|
|
5835
|
+
- Produce diff-friendly task lists (one task = one concern)
|
|
5836
|
+
|
|
5837
|
+
Input format you accept:
|
|
5838
|
+
{ "task": "plan | assess | roadmap", "target": "src/core", "constraint": "no-breaking-changes | minimal-downtime | full-rewrite", "focus": "architecture | performance | maintainability" }
|
|
5839
|
+
|
|
5840
|
+
Output: Markdown refactor plan:
|
|
5841
|
+
- ## Phase 1: Low Risk / High Payoff (do first)
|
|
5842
|
+
Table: | # | Task | Module | Risk | Est. Time |
|
|
5843
|
+
- ## Phase 2: Medium Risk
|
|
5844
|
+
- ## Phase 3: High Risk (requires full regression)
|
|
5845
|
+
- ## Dependency Graph (abbreviated ASCII)
|
|
5846
|
+
- ## Rollback Strategy
|
|
5847
|
+
- ## Exit Criteria (checkbox list)
|
|
5848
|
+
|
|
5849
|
+
Risk scoring criteria:
|
|
5850
|
+
| Factor | Low | Medium | High |
|
|
5851
|
+
|--------|-----|--------|------|
|
|
5852
|
+
| Cyclomatic complexity | <10 | 10-20 | >20 |
|
|
5853
|
+
| Test coverage | >80% | 50-80% | <50% |
|
|
5854
|
+
| Fan-out (imports) | <5 | 5-15 | >15 |
|
|
5855
|
+
|
|
5856
|
+
Working rules:
|
|
5857
|
+
- Always include rollback strategy \u2014 every refactor can fail
|
|
5858
|
+
- Merge tasks that take <1h into a single phase
|
|
5859
|
+
- Respect team constraints (reviewer availability, parallelization)
|
|
5860
|
+
- Never plan without analyzing the actual code first`,
|
|
5861
|
+
maxIterations: 60,
|
|
5862
|
+
maxToolCalls: 250,
|
|
5863
|
+
timeoutMs: 15e4
|
|
5864
|
+
};
|
|
5865
|
+
var SECURITY_SCANNER_AGENT = {
|
|
5866
|
+
id: "security-scanner",
|
|
5867
|
+
name: "Security Scanner",
|
|
5868
|
+
role: "security-scanner",
|
|
5869
|
+
prompt: `You are the Security Scanner agent. Your job is to scan code,
|
|
5870
|
+
configs, and dependencies for security issues from hardcoded secrets to
|
|
5871
|
+
supply chain risks.
|
|
5872
|
+
|
|
5873
|
+
Scope:
|
|
5874
|
+
- Detect hardcoded secrets: API keys, tokens, passwords, private keys
|
|
5875
|
+
- Find injection vectors: eval, innerHTML, SQL concat, shell injection
|
|
5876
|
+
- Identify insecure patterns: weak crypto, hardcoded IVs, disabled TLS
|
|
5877
|
+
- Scan dependencies for known CVEs (via npm/pnpm audit)
|
|
5878
|
+
- Flag supply chain risks: postinstall hooks, unverified scripts, .npmrc
|
|
5879
|
+
|
|
5880
|
+
Input format you accept:
|
|
5881
|
+
{ "task": "scan | audit | secrets | dependencies", "paths": ["src", "config"], "depth": "quick | normal | deep" }
|
|
5882
|
+
|
|
5883
|
+
Output: Markdown security report:
|
|
5884
|
+
- ## CRITICAL: Secrets Found (with code snippets)
|
|
5885
|
+
- ## HIGH: Injection Vectors
|
|
5886
|
+
- ## MEDIUM: Insecure Patterns
|
|
5887
|
+
- ## Dependency Issues (CVE list)
|
|
5888
|
+
- ## Summary table (severity \u2192 count)
|
|
5889
|
+
- ## Remediation Checklist (with checkboxes)
|
|
5890
|
+
|
|
5891
|
+
Secret patterns you detect:
|
|
5892
|
+
| Pattern | Example | Severity |
|
|
5893
|
+
|---------|---------|----------|
|
|
5894
|
+
| AWS Access Key | AKIAIOSFODNN7EXAMPLE | critical |
|
|
5895
|
+
| AWS Secret Key | [a-zA-Z0-9/+=]{40} base64 | critical |
|
|
5896
|
+
| GitHub Token | ghp_[a-zA-Z0-9]{36} | critical |
|
|
5897
|
+
| Private Key PEM | -----BEGIN.*PRIVATE KEY----- | critical |
|
|
5898
|
+
| JWT | eyJ[a-zA-Z0-9_-]+ | high |
|
|
5899
|
+
|
|
5900
|
+
Injection patterns:
|
|
5901
|
+
| Construct | Safe alternative |
|
|
5902
|
+
|-----------|-----------------|
|
|
5903
|
+
| eval(str) | new Function() or parse |
|
|
5904
|
+
| innerHTML = x | textContent or sanitize |
|
|
5905
|
+
| exec(\`cmd \${x}\`) | execFile with args array |
|
|
5906
|
+
|
|
5907
|
+
Working rules:
|
|
5908
|
+
- Never scan node_modules \u2014 use npm audit instead
|
|
5909
|
+
- Always provide remediation steps, not just findings
|
|
5910
|
+
- Verify regex-based secrets before flagging (false positive risk)
|
|
5911
|
+
- When in doubt, flag as medium rather than ignoring potential issues`,
|
|
5912
|
+
maxIterations: 70,
|
|
5913
|
+
maxToolCalls: 280,
|
|
5914
|
+
timeoutMs: 16e4
|
|
5915
|
+
};
|
|
5916
|
+
var FLEET_ROSTER = {
|
|
5917
|
+
"audit-log": AUDIT_LOG_AGENT,
|
|
5918
|
+
"bug-hunter": BUG_HUNTER_AGENT,
|
|
5919
|
+
"refactor-planner": REFACTOR_PLANNER_AGENT,
|
|
5920
|
+
"security-scanner": SECURITY_SCANNER_AGENT
|
|
5921
|
+
};
|
|
5922
|
+
var ALL_FLEET_AGENTS = Object.values(FLEET_ROSTER);
|
|
5923
|
+
|
|
5688
5924
|
// src/defaults/autonomous-runner.ts
|
|
5689
5925
|
var DoneConditionChecker = class {
|
|
5690
5926
|
constructor(condition) {
|
|
@@ -9667,7 +9903,7 @@ var noopSlashCommands = {
|
|
|
9667
9903
|
};
|
|
9668
9904
|
|
|
9669
9905
|
// src/plugin/loader.ts
|
|
9670
|
-
var KERNEL_API_VERSION = "0.1.
|
|
9906
|
+
var KERNEL_API_VERSION = "0.1.9";
|
|
9671
9907
|
function parseSemver(v) {
|
|
9672
9908
|
const parts = v.replace(/^[^0-9]*/, "").split(".").map((s) => Number.parseInt(s, 10) || 0);
|
|
9673
9909
|
return [parts[0] ?? 0, parts[1] ?? 0, parts[2] ?? 0];
|
|
@@ -9899,6 +10135,6 @@ function wrapApiForCapabilityCheck(plugin, api, log) {
|
|
|
9899
10135
|
});
|
|
9900
10136
|
}
|
|
9901
10137
|
|
|
9902
|
-
export { Agent, AgentError, AutoCompactionMiddleware, AutonomousRunner, BudgetExceededError, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DoneConditionChecker, ENCRYPTED_PREFIX, EventBus, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, RecoveryLock, RunController, SelectiveCompactor, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, allServers, asBlocks, asText, atomicWrite, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, color, compileGlob, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, githubServer, googleMapsServer, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, loadPlugins, loadProjectModes, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, matchAny, matchGlob, migratePlaintextSecrets, normalizeToLf, projectHash, renderPrometheus, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState };
|
|
10138
|
+
export { ALL_FLEET_AGENTS, AUDIT_LOG_AGENT, Agent, AgentError, AutoCompactionMiddleware, AutonomousRunner, BUG_HUNTER_AGENT, BudgetExceededError, ConfigError, ConfigMigrationError, Container, Context, ConversationState, DEFAULT_CONFIG_MIGRATIONS, DEFAULT_DIRECTOR_PREAMBLE, DEFAULT_MAX_ITERATIONS, DEFAULT_MODES, DEFAULT_SPEC_TEMPLATE, DEFAULT_SUBAGENT_BASELINE, DefaultAttachmentStore, DefaultConfigLoader, DefaultConfigStore, DefaultErrorHandler, DefaultHealthRegistry, DefaultLogger, DefaultMemoryStore, DefaultModeStore, DefaultModelsRegistry, DefaultMultiAgentCoordinator, DefaultPathResolver, DefaultPermissionPolicy, DefaultPluginAPI, DefaultRetryPolicy, DefaultSecretScrubber, DefaultSecretVault, DefaultSessionReader, DefaultSessionStore, DefaultSkillLoader, DefaultSystemPromptBuilder, DefaultTaskStore, DefaultTokenCounter, Director, DirectorBudgetError, DoneConditionChecker, ENCRYPTED_PREFIX, EventBus, FLEET_ROSTER, FleetBus, FleetUsageAggregator, HybridCompactor, InMemoryAgentBridge, InMemoryBridgeTransport, InMemoryMetricsSink, InputBuilder, IntelligentCompactor, KERNEL_API_VERSION, LAYER_1_IDENTITY, LLMSelector, NoopMetricsSink, NoopTracer, OTelTracer, PROMETHEUS_CONTENT_TYPE, Pipeline, PluginError, ProviderError, ProviderRegistry, QueueStore, REFACTOR_PLANNER_AGENT, RecoveryLock, RunController, SECURITY_SCANNER_AGENT, SelectiveCompactor, SessionError, SlashCommandRegistry, SpecDrivenDev, SpecParser, SubagentBudget, TOKENS, TaskFlow, TaskGenerator, TaskTracker, ToolError, ToolExecutor, ToolRegistry, WrongStackError, allServers, asBlocks, asText, atomicWrite, awsServer, blockServer, braveSearchServer, buildOtlpMetricsRequest, buildOtlpTracesRequest, classifyFamily, color, compileGlob, composeDirectorPrompt, composeSubagentPrompt, computeTaskProgress, context7Server, contextManagerTool, createContextManagerTool, createDefaultPipelines, createMessage, createToolOutputSerializer, decryptConfigSecrets, detectNewlineStyle, encryptConfigSecrets, ensureDir, estimateTextTokens, estimateToolInputTokens, estimateToolResultTokens, everArtServer, extractRunEnv, filesystemServer, findCriticalPath, githubServer, googleMapsServer, isAgentError, isConfigError, isImageBlock, isPluginError, isSessionError, isTextBlock, isToolError, isToolResultBlock, isToolUseBlock, isWrongStackError, loadPlugins, loadProjectModes, loadUserModes, makeAgentSubagentRunner, makeDirectorSessionFactory, matchAny, matchGlob, migratePlaintextSecrets, normalizeToLf, projectHash, renderPrometheus, resolveWstackPaths, rewriteConfigEncrypted, rosterSummaryFromConfigs, runConfigMigrations, safeParse, safeStringify, sanitizeJsonString, sentinelServer, slackServer, startMetricsServer, startOtlpMetricsExporter, startOtlpTraceExporter, stripAnsi, toStyle, toWrongStackError, topologicalSort, unifiedDiff, unloadPlugins, validateAgainstSchema, wireMetricsToEvents, wrapAsState };
|
|
9903
10139
|
//# sourceMappingURL=index.js.map
|
|
9904
10140
|
//# sourceMappingURL=index.js.map
|