agent-gov-core 0.4.3 → 0.7.0

package/dist/toml.js

@@ -1,4 +1,5 @@
 import { readFileSync } from 'node:fs';
+import { toConfigParseError } from './parse-error.js';
 export function readTomlObject(path) {
     const text = readFileSync(path, 'utf8');
     try {
@@ -6,7 +7,7 @@ export function readTomlObject(path) {
         return { value: parsed, toml: parsed, text };
     }
     catch (err) {
-        return { value: undefined, toml: undefined, text, parseError: err };
+        return { value: undefined, toml: undefined, text, parseError: toConfigParseError(text, err) };
     }
 }
 /**
@@ -122,11 +123,11 @@ class TomlParser {
         // TOML spec violation. Without this guard, `[foo]` silently descended
         // into the last `[[foo]]` entry and let writes leak into it.
         if (this.aotPaths.has(path)) {
-            throw new Error(`Cannot redefine array-of-tables [[${keys.join('.')}]] as a standard table [${keys.join('.')}]`);
+            throw new Error(`Cannot redefine array-of-tables [[${keys.join('.')}]] as a standard table [${keys.join('.')}] at offset ${this.pos}`);
         }
         const table = this.descendTablePath(keys, /*forHeader*/ true);
         if (this.definedTables.has(path)) {
-            throw new Error(`Duplicate table definition: [${keys.join('.')}]`);
+            throw new Error(`Duplicate table definition: [${keys.join('.')}] at offset ${this.pos}`);
         }
         this.definedTables.add(path);
         this.current = table;
@@ -153,6 +154,17 @@ class TomlParser {
         else if (!Array.isArray(arr)) {
             throw new Error(`Key ${keys.join('.')} is not an array-of-tables`);
         }
+        // Each new array entry resets the "already defined" status of any subtables
+        // declared under this AOT path. TOML spec permits the same subtable header
+        // (`[fruits.physical]`) to reappear under each fresh `[[fruits]]` entry — it
+        // binds to the current array entry. Without this clearing, the v0.4.2
+        // definedTables guard rejected the second [fruits.physical] as a duplicate.
+        const aotPathPrefix = keys.join(this.PATH_KEY_SEPARATOR) + this.PATH_KEY_SEPARATOR;
+        for (const definedPath of this.definedTables) {
+            if (definedPath.startsWith(aotPathPrefix)) {
+                this.definedTables.delete(definedPath);
+            }
+        }
         const newTable = {};
         arr.push(newTable);
         this.current = newTable;
@@ -248,7 +260,7 @@ class TomlParser {
         }
         const lastKey = keys[keys.length - 1];
         if (Object.prototype.hasOwnProperty.call(node, lastKey)) {
-            throw new Error(`Duplicate key: ${keys.join('.')}`);
+            throw new Error(`Duplicate key: ${keys.join('.')} at offset ${this.pos}`);
         }
         node[lastKey] = value;
         this.expectLineEnd();
@@ -322,9 +334,18 @@ class TomlParser {
             const c = this.src[this.pos];
             if (c === '\\') {
                 this.pos++;
-                // line-ending backslash: consume to next non-ws line start
-                const next = this.src[this.pos];
+                // Line-ending backslash: per TOML spec, a `\` followed by *any amount
+                // of inline whitespace* (spaces/tabs) and then a newline strips the
+                // newline and trims leading whitespace on the next line. Peek past
+                // trailing inline whitespace before deciding whether this is a
+                // line-ending backslash or a regular escape.
+                let peek = this.pos;
+                while (peek < this.len && (this.src[peek] === ' ' || this.src[peek] === '\t')) {
+                    peek++;
+                }
+                const next = this.src[peek];
                 if (next === '\n' || next === '\r' || next === undefined) {
+                    this.pos = peek;
                     while (this.pos < this.len &&
                         (this.src[this.pos] === ' ' ||
                             this.src[this.pos] === '\t' ||
@@ -480,7 +501,7 @@ class TomlParser {
             // Without this guard, `{ host = "a", host = "b" }` silently parsed as
             // `{ host: "b" }` instead of raising.
             if (Object.prototype.hasOwnProperty.call(node, leaf)) {
-                throw new Error(`Duplicate key in inline table: ${keys.join('.')}`);
+                throw new Error(`Duplicate key in inline table: ${keys.join('.')} at offset ${this.pos}`);
             }
             node[leaf] = value;
             this.skipInlineWhitespace();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agent-gov-core",
-  "version": "0.4.3",
+  "version": "0.7.0",
   "description": "Shared primitives for the AI-agent governance suite: Finding schema, JSONC/TOML readers, line locators, MCP command normalization, shell tokenization, and GitHub Action helpers.",
   "type": "module",
   "main": "./dist/index.js",
@@ -14,7 +14,8 @@
       "types": "./dist/test-utils.d.ts",
       "import": "./dist/test-utils.js"
     },
-    "./schemas/finding.schema.json": "./schemas/finding.schema.json"
+    "./schemas/finding.schema.json": "./schemas/finding.schema.json",
+    "./schemas/report.schema.json": "./schemas/report.schema.json"
   },
   "files": [
     "dist/**/*.js",

package/schemas/report.schema.json

@@ -0,0 +1,55 @@
+{
+  "$schema": "https://json-schema.org/draft/2020-12/schema",
+  "$id": "https://github.com/Conalh/agent-gov-core/schemas/report.schema.json",
+  "title": "Report",
+  "description": "Canonical multi-tool report envelope emitted by tools in the AI-agent governance suite. Wraps a `Finding[]` with provenance, rating, and optional tool-specific extension data so a cross-tool meta-reviewer can ingest reports from N tools through one shape.",
+  "type": "object",
+  "required": ["schemaVersion", "tool", "rating", "findings"],
+  "additionalProperties": false,
+  "properties": {
+    "schemaVersion": {
+      "type": "string",
+      "const": "1.0",
+      "description": "Envelope schema version. Currently '1.0'. Future incompatible envelope changes require a major bump on this field; readers must reject unknown major versions."
+    },
+    "tool": {
+      "type": "string",
+      "enum": ["scope_trail", "policy_mesh", "capability_echo", "task_bound", "session_trail"],
+      "description": "Originating tool. Matches the `Finding.tool` enum."
+    },
+    "toolVersion": {
+      "type": "string",
+      "description": "Semver of the emitting tool (e.g. '0.1.18'). Optional; helps a meta-reviewer attribute findings to a specific release."
+    },
+    "runId": {
+      "type": "string",
+      "description": "Unique identifier for this run. Optional; useful when merging reports from concurrent runs or comparing runs over time."
+    },
+    "conversationId": {
+      "type": "string",
+      "description": "Identifier for the agent session, PR review, or thread this run belongs to. Distinct from runId (one conversation can produce many runs). Matches OpenTelemetry's gen_ai.conversation.id semantic convention — if a consumer also emits OTel traces about the same agent session, pass the same string here."
+    },
+    "baseRef": {
+      "type": "string",
+      "description": "Git base ref for diff-mode tools (ScopeTrail, CapabilityEcho, TaskBound). Omit for non-diff tools (PolicyMesh, SessionTrail)."
+    },
+    "headRef": {
+      "type": "string",
+      "description": "Git head ref for diff-mode tools. Omit for non-diff tools."
+    },
+    "rating": {
+      "type": "string",
+      "enum": ["none", "low", "medium", "high", "critical"],
+      "description": "Aggregate severity for this report. 'none' iff `findings` is empty or all findings fell below the tool's fail-on threshold."
+    },
+    "findings": {
+      "type": "array",
+      "items": { "$ref": "./finding.schema.json" },
+      "description": "Findings emitted by this tool run."
+    },
+    "data": {
+      "type": "object",
+      "description": "Tool-specific extension data (e.g. PolicyMesh's `effectiveUnion`, CapabilityEcho's `surfaceSummary`, ScopeTrail's `scopeMatchCount`). Opaque to a cross-tool meta-reviewer but preserved so each tool's UX can read its own extensions back from a merged report."
+    }
+  }
+}