@wrongstack/core 0.310.1 → 0.313.1

package/dist/chunk-SVT4RNTR.js

@@ -0,0 +1,49 @@
+// src/utils/sage-output-block.ts
+var SAGE_INJECTOR_HEADINGS = /* @__PURE__ */ new Set([
+  "--- SAGE: task-aware project knowledge (Memory Injector) ---",
+  "--- SAGE: related project knowledge (Memory Injector) ---"
+]);
+var SAGE_MEMORY_LINE = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*<\/memory>(?: .*)?$/;
+var SAGE_MEMORY_LINE_TRUNCATED = /^- \[[^\]]+\](?:\[[^\]]+\])* <memory id="[^"]+">.*…$/;
+function splitSageOutputBlock(output) {
+  if (!output.includes("--- SAGE: ")) return { body: output, sageLines: [] };
+  const lines = output.split("\n");
+  for (let sageIdx = lines.length - 1; sageIdx >= 0; sageIdx--) {
+    if (!SAGE_INJECTOR_HEADINGS.has(lines[sageIdx] ?? "")) continue;
+    const candidate = lines.slice(sageIdx);
+    if (candidate.length < 2) continue;
+    const memoryLines = candidate.slice(1).filter((line) => line.trim().length > 0);
+    if (memoryLines.length === 0) continue;
+    const bodyOk = memoryLines.every(
+      (line, index) => SAGE_MEMORY_LINE.test(line) || index === memoryLines.length - 1 && SAGE_MEMORY_LINE_TRUNCATED.test(line)
+    );
+    if (!bodyOk) continue;
+    let end = candidate.length;
+    while (end > 1 && candidate[end - 1].trim().length === 0) end--;
+    return {
+      body: lines.slice(0, sageIdx).join("\n").trimEnd(),
+      sageLines: candidate.slice(0, end)
+    };
+  }
+  return { body: output, sageLines: [] };
+}
+function capSageLines(sageLines, maxChars) {
+  if (sageLines.length < 2) return [];
+  const header = sageLines[0];
+  if (header.length >= maxChars) return [];
+  const out = [header];
+  let used = header.length;
+  for (const line of sageLines.slice(1)) {
+    if (used + 1 + line.length > maxChars) break;
+    out.push(line);
+    used += 1 + line.length;
+  }
+  return out.length > 1 ? out : [];
+}
+
+export {
+  SAGE_INJECTOR_HEADINGS,
+  splitSageOutputBlock,
+  capSageLines
+};
+//# sourceMappingURL=chunk-SVT4RNTR.js.map

package/dist/chunk-SWUFN7XM.js

@@ -0,0 +1,43 @@
+// src/replay/hash.ts
+import { createHash } from "node:crypto";
+function stableStringify(value) {
+  return JSON.stringify(sortKeys(value));
+}
+function sortKeys(value) {
+  if (Array.isArray(value)) return value.map(sortKeys);
+  if (value && typeof value === "object") {
+    const obj = value;
+    const sorted = {};
+    for (const key of Object.keys(obj).sort()) {
+      sorted[key] = sortKeys(obj[key]);
+    }
+    return sorted;
+  }
+  return value;
+}
+function semanticMessage(message) {
+  const { ts: _ts, _estTokens: _estimate, origin: _origin, ...semantic } = message;
+  return semantic;
+}
+function hashRequest(request) {
+  const payload = {
+    model: request.model,
+    system: request.system,
+    messages: request.messages.map(semanticMessage),
+    tools: request.tools,
+    maxTokens: request.maxTokens,
+    temperature: request.temperature,
+    topP: request.topP,
+    stopSequences: request.stopSequences,
+    toolChoice: request.toolChoice
+  };
+  const json = stableStringify(payload);
+  const digest = createHash("sha256").update(json, "utf8").digest("hex");
+  return `sha256:${digest}`;
+}
+
+export {
+  stableStringify,
+  hashRequest
+};
+//# sourceMappingURL=chunk-SWUFN7XM.js.map

package/dist/chunk-SXMVYC5H.js

@@ -0,0 +1,174 @@
+// src/security/permission-policy-schema.ts
+var TRUST_POLICY_SCHEMA_VERSION = 1;
+var TRUST_POLICY_LIMITS = Object.freeze({
+  maxTools: 1e3,
+  maxPatternsPerRule: 1e3,
+  maxToolNameChars: 256,
+  maxPatternChars: 4096
+});
+var TRUST_POLICY_JSON_SCHEMA = Object.freeze({
+  $schema: "https://json-schema.org/draft/2020-12/schema",
+  $id: "https://wrongstack.dev/schemas/trust-policy-v1.json",
+  title: "WrongStack Trust Policy",
+  type: "object",
+  maxProperties: TRUST_POLICY_LIMITS.maxTools,
+  propertyNames: {
+    minLength: 1,
+    maxLength: TRUST_POLICY_LIMITS.maxToolNameChars,
+    not: { enum: ["__proto__", "prototype", "constructor"] }
+  },
+  additionalProperties: {
+    type: "object",
+    additionalProperties: false,
+    properties: {
+      allow: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      deny: {
+        type: "array",
+        maxItems: TRUST_POLICY_LIMITS.maxPatternsPerRule,
+        items: { type: "string", minLength: 1, maxLength: TRUST_POLICY_LIMITS.maxPatternChars }
+      },
+      auto: { type: "boolean" },
+      trustWorkdir: { type: "boolean" },
+      denyPrivate: { type: "boolean" }
+    }
+  }
+});
+var RULE_FIELDS = /* @__PURE__ */ new Set(["allow", "deny", "auto", "trustWorkdir", "denyPrivate"]);
+var UNSAFE_PROPERTY_NAMES = /* @__PURE__ */ new Set(["__proto__", "prototype", "constructor"]);
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function error(diagnostics, code, path, message) {
+  diagnostics.push({ severity: "error", code, path, message });
+}
+function validatePatterns(value, path, diagnostics) {
+  if (!Array.isArray(value)) {
+    error(diagnostics, "invalid_pattern_list", path, "must be an array of strings");
+    return void 0;
+  }
+  if (value.length > TRUST_POLICY_LIMITS.maxPatternsPerRule) {
+    error(
+      diagnostics,
+      "too_many_patterns",
+      path,
+      `must contain at most ${TRUST_POLICY_LIMITS.maxPatternsPerRule} patterns`
+    );
+    return void 0;
+  }
+  const patterns = [];
+  const seen = /* @__PURE__ */ new Set();
+  for (const [index, pattern] of value.entries()) {
+    const itemPath = `${path}[${index}]`;
+    if (typeof pattern !== "string" || pattern.length === 0 || pattern.length > TRUST_POLICY_LIMITS.maxPatternChars) {
+      error(
+        diagnostics,
+        "invalid_pattern",
+        itemPath,
+        `must be a non-empty string up to ${TRUST_POLICY_LIMITS.maxPatternChars} characters`
+      );
+      continue;
+    }
+    if (seen.has(pattern)) {
+      diagnostics.push({
+        severity: "warning",
+        code: "duplicate_pattern",
+        path: itemPath,
+        message: "duplicates an earlier pattern and was normalized away"
+      });
+      continue;
+    }
+    seen.add(pattern);
+    patterns.push(pattern);
+  }
+  return patterns;
+}
+function validateTrustPolicy(value) {
+  const diagnostics = [];
+  if (!isRecord(value)) {
+    return {
+      ok: false,
+      diagnostics: [
+        {
+          severity: "error",
+          code: "invalid_root",
+          path: "$",
+          message: "trust policy must be an object"
+        }
+      ]
+    };
+  }
+  const entries = Object.entries(value);
+  if (entries.length > TRUST_POLICY_LIMITS.maxTools) {
+    error(
+      diagnostics,
+      "too_many_tools",
+      "$",
+      `must contain at most ${TRUST_POLICY_LIMITS.maxTools} tool rules`
+    );
+  }
+  const policy = {};
+  for (const [toolName, rawRule] of entries.slice(0, TRUST_POLICY_LIMITS.maxTools)) {
+    const toolPath = `$[${JSON.stringify(toolName)}]`;
+    if (toolName.length === 0 || toolName.length > TRUST_POLICY_LIMITS.maxToolNameChars) {
+      error(
+        diagnostics,
+        "invalid_tool_name",
+        toolPath,
+        `tool name must be 1-${TRUST_POLICY_LIMITS.maxToolNameChars} characters`
+      );
+      continue;
+    }
+    if (UNSAFE_PROPERTY_NAMES.has(toolName)) {
+      error(
+        diagnostics,
+        "unsafe_tool_name",
+        toolPath,
+        "reserved object property names are not valid tool rules"
+      );
+      continue;
+    }
+    if (!isRecord(rawRule)) {
+      error(diagnostics, "invalid_rule", toolPath, "tool rule must be an object");
+      continue;
+    }
+    for (const field of Object.keys(rawRule)) {
+      if (!RULE_FIELDS.has(field)) {
+        error(
+          diagnostics,
+          "unknown_field",
+          `${toolPath}.${field}`,
+          `unknown policy field "${field}"`
+        );
+      }
+    }
+    const rule = {};
+    for (const field of ["allow", "deny"]) {
+      if (rawRule[field] === void 0) continue;
+      const patterns = validatePatterns(rawRule[field], `${toolPath}.${field}`, diagnostics);
+      if (patterns) rule[field] = patterns;
+    }
+    for (const field of ["auto", "trustWorkdir", "denyPrivate"]) {
+      const setting = rawRule[field];
+      if (setting === void 0) continue;
+      if (typeof setting !== "boolean") {
+        error(diagnostics, "invalid_boolean", `${toolPath}.${field}`, "must be a boolean");
+      } else {
+        rule[field] = setting;
+      }
+    }
+    policy[toolName] = rule;
+  }
+  return diagnostics.some((diagnostic) => diagnostic.severity === "error") ? { ok: false, diagnostics } : { ok: true, policy, diagnostics };
+}
+
+export {
+  TRUST_POLICY_SCHEMA_VERSION,
+  TRUST_POLICY_LIMITS,
+  TRUST_POLICY_JSON_SCHEMA,
+  validateTrustPolicy
+};
+//# sourceMappingURL=chunk-SXMVYC5H.js.map

package/dist/chunk-SZ6AYUIZ.js

@@ -0,0 +1,23 @@
+// src/storage/storage-concurrency.ts
+async function mapWithConcurrency(items, concurrency, mapper) {
+  if (items.length === 0) return [];
+  const limit = Math.max(1, Math.floor(concurrency));
+  const results = new Array(items.length);
+  let next = 0;
+  async function worker() {
+    while (true) {
+      const index = next;
+      next++;
+      if (index >= items.length) return;
+      results[index] = await mapper(items[index], index);
+    }
+  }
+  const workers = Array.from({ length: Math.min(limit, items.length) }, () => worker());
+  await Promise.all(workers);
+  return results;
+}
+
+export {
+  mapWithConcurrency
+};
+//# sourceMappingURL=chunk-SZ6AYUIZ.js.map