agent-mockingbird 0.0.1

package/apps/server/src/backend/config/policy.ts

@@ -0,0 +1,158 @@
+import type { AgentMockingbirdConfig } from "./schema";
+import { ConfigApplyError } from "./types";
+
+interface ConfigPolicyDecision {
+  mode: "builder" | "strict";
+  changedPaths: string[];
+  rejectedPaths: string[];
+  requireExpectedHash: boolean;
+  requireSmokeTest: boolean;
+  autoRollbackOnFailure: boolean;
+}
+
+function isPlainObject(value: unknown): value is Record<string, unknown> {
+  return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+
+function stableSerialize(value: unknown): string {
+  if (value === null) return "null";
+  if (typeof value === "number" || typeof value === "boolean") return JSON.stringify(value);
+  if (typeof value === "string") return JSON.stringify(value);
+  if (Array.isArray(value)) return `[${value.map(item => stableSerialize(item)).join(",")}]`;
+  if (!isPlainObject(value)) return JSON.stringify(value);
+  const entries = Object.entries(value).sort(([a], [b]) => a.localeCompare(b));
+  return `{${entries.map(([key, entry]) => `${JSON.stringify(key)}:${stableSerialize(entry)}`).join(",")}}`;
+}
+
+function normalizePath(path: string) {
+  return path.trim().replace(/\.+$/g, "");
+}
+
+function pathMatchesRule(path: string, rawRule: string) {
+  const normalizedPath = normalizePath(path);
+  const rule = normalizePath(rawRule);
+  if (!normalizedPath || !rule) return false;
+  if (rule === "*") return true;
+  if (rule.endsWith(".*")) {
+    const prefix = rule.slice(0, -2);
+    return normalizedPath === prefix || normalizedPath.startsWith(`${prefix}.`);
+  }
+  return normalizedPath === rule || normalizedPath.startsWith(`${rule}.`);
+}
+
+function pushPath(set: Set<string>, path: string) {
+  const normalized = normalizePath(path);
+  if (normalized) {
+    set.add(normalized);
+  }
+}
+
+function collectPatchPaths(value: unknown, path: string, out: Set<string>) {
+  if (Array.isArray(value)) {
+    pushPath(out, path);
+    return;
+  }
+  if (!isPlainObject(value)) {
+    pushPath(out, path);
+    return;
+  }
+
+  const entries = Object.entries(value);
+  if (entries.length === 0) {
+    pushPath(out, path);
+    return;
+  }
+
+  for (const [key, child] of entries) {
+    const nextPath = path ? `${path}.${key}` : key;
+    collectPatchPaths(child, nextPath, out);
+  }
+}
+
+function collectChangedPaths(current: unknown, next: unknown, path: string, out: Set<string>) {
+  if (Array.isArray(current) || Array.isArray(next)) {
+    if (stableSerialize(current) !== stableSerialize(next)) {
+      pushPath(out, path);
+    }
+    return;
+  }
+
+  if (isPlainObject(current) && isPlainObject(next)) {
+    const keys = new Set([...Object.keys(current), ...Object.keys(next)]);
+    if (keys.size === 0) {
+      if (stableSerialize(current) !== stableSerialize(next)) {
+        pushPath(out, path);
+      }
+      return;
+    }
+    for (const key of keys) {
+      const left = current[key];
+      const right = next[key];
+      const nextPath = path ? `${path}.${key}` : key;
+      if (!(key in current) || !(key in next)) {
+        pushPath(out, nextPath);
+        continue;
+      }
+      collectChangedPaths(left, right, nextPath, out);
+    }
+    return;
+  }
+
+  if (stableSerialize(current) !== stableSerialize(next)) {
+    pushPath(out, path);
+  }
+}
+
+function evaluatePolicy(config: AgentMockingbirdConfig, changedPaths: string[]): ConfigPolicyDecision {
+  const policy = config.runtime.configPolicy;
+  const mode = policy.mode;
+  const rejected = new Set<string>();
+
+  for (const path of changedPaths) {
+    const denied = policy.denyPaths.some(rule => pathMatchesRule(path, rule));
+    if (denied) {
+      rejected.add(path);
+      continue;
+    }
+    if (mode === "strict") {
+      const allowed = policy.strictAllowPaths.some(rule => pathMatchesRule(path, rule));
+      if (!allowed) {
+        rejected.add(path);
+      }
+    }
+  }
+
+  return {
+    mode,
+    changedPaths,
+    rejectedPaths: [...rejected].sort((a, b) => a.localeCompare(b)),
+    requireExpectedHash: policy.requireExpectedHash,
+    requireSmokeTest: policy.requireSmokeTest,
+    autoRollbackOnFailure: policy.autoRollbackOnFailure,
+  };
+}
+
+export function evaluateConfigPolicyForPatch(config: AgentMockingbirdConfig, patch: unknown): ConfigPolicyDecision {
+  const changed = new Set<string>();
+  collectPatchPaths(patch, "", changed);
+  return evaluatePolicy(config, [...changed].sort((a, b) => a.localeCompare(b)));
+}
+
+export function evaluateConfigPolicyForReplace(
+  current: AgentMockingbirdConfig,
+  candidate: AgentMockingbirdConfig,
+): ConfigPolicyDecision {
+  const changed = new Set<string>();
+  collectChangedPaths(current, candidate, "", changed);
+  return evaluatePolicy(current, [...changed].sort((a, b) => a.localeCompare(b)));
+}
+
+export function assertConfigPolicyAllows(decision: ConfigPolicyDecision) {
+  if (decision.rejectedPaths.length > 0) {
+    throw new ConfigApplyError("policy", "Config policy rejected one or more changes", {
+      mode: decision.mode,
+      rejectedPaths: decision.rejectedPaths,
+      changedPaths: decision.changedPaths,
+    });
+  }
+}

package/apps/server/src/backend/config/schema.test.ts

@@ -0,0 +1,15 @@
+import { expect, test } from "bun:test";
+
+import { agentTypeDefinitionSchema } from "./schema";
+
+test("agent type schema rejects legacy heartbeat config blocks", () => {
+  const parsed = agentTypeDefinitionSchema.safeParse({
+    id: "agent-1",
+    heartbeat: {
+      enabled: true,
+      interval: "30m",
+      ackMaxChars: 300,
+    },
+  });
+  expect(parsed.success).toBe(false);
+});

package/apps/server/src/backend/config/schema.ts

@@ -0,0 +1,391 @@
+import { z } from "zod";
+
+const stringListSchema = z.array(z.string().min(1)).transform(values => {
+  const normalized = values.map(value => value.trim()).filter(Boolean);
+  return [...new Set(normalized)];
+});
+
+const mcpServerIdSchema = z.string().min(1).regex(/^[A-Za-z0-9._-]+$/);
+const mcpHeadersSchema = z.record(z.string(), z.string()).default({});
+const mcpEnvironmentSchema = z.record(z.string(), z.string()).default({});
+
+export const specialistAgentSchema = z.object({
+  id: z.string().min(1),
+  name: z.string().min(1),
+  specialty: z.string().min(1),
+  summary: z.string().min(1),
+  model: z.string().min(1),
+  status: z.enum(["available", "busy", "offline"]),
+});
+
+const agentTypeModeSchema = z.enum(["subagent", "primary", "all"]);
+const openCodePermissionScalarSchema = z.enum(["allow", "deny", "ask"]);
+const openCodePermissionRuleMapSchema = z.record(z.string(), openCodePermissionScalarSchema);
+const openCodePermissionValueSchema = z.union([openCodePermissionScalarSchema, openCodePermissionRuleMapSchema]);
+const openCodePermissionSchema = z.record(z.string(), openCodePermissionValueSchema);
+
+const queueModeSchema = z.enum(["collect", "followup", "replace"]);
+
+export const agentTypeDefinitionSchema = z
+  .object({
+    id: z.string().min(1),
+    name: z.string().min(1).optional(),
+    description: z.string().min(1).optional(),
+    prompt: z.string().min(1).optional(),
+    model: z.string().min(1).optional(),
+    variant: z.string().min(1).optional(),
+    mode: agentTypeModeSchema.default("subagent"),
+    hidden: z.boolean().default(false),
+    disable: z.boolean().default(false),
+    temperature: z.number().optional(),
+    topP: z.number().optional(),
+    steps: z.number().int().positive().optional(),
+    permission: openCodePermissionSchema.optional(),
+    options: z.record(z.string(), z.unknown()).default({}),
+    queueMode: queueModeSchema.optional(),
+  })
+  .strict();
+
+const agentTypeDefinitionListSchema = z.array(agentTypeDefinitionSchema).transform(agentTypes => {
+  const deduped = new Map<string, (typeof agentTypes)[number]>();
+  for (const rawType of agentTypes) {
+    const id = rawType.id.trim();
+    if (!id) continue;
+    deduped.set(id, {
+      ...rawType,
+      id,
+      name: rawType.name?.trim() || undefined,
+      description: rawType.description?.trim() || undefined,
+      prompt: rawType.prompt?.trim() || undefined,
+      model: rawType.model?.trim() || undefined,
+      variant: rawType.variant?.trim() || undefined,
+    });
+  }
+  return [...deduped.values()].sort((a, b) => a.id.localeCompare(b.id));
+});
+
+export const configuredMcpServerSchema = z.discriminatedUnion("type", [
+  z
+    .object({
+      id: mcpServerIdSchema,
+      type: z.literal("remote"),
+      enabled: z.boolean().default(true),
+      url: z.string().url(),
+      headers: mcpHeadersSchema,
+      oauth: z.enum(["auto", "off"]).default("auto"),
+      timeoutMs: z.number().int().positive().optional(),
+    })
+    .strict(),
+  z
+    .object({
+      id: mcpServerIdSchema,
+      type: z.literal("local"),
+      enabled: z.boolean().default(true),
+      command: z.array(z.string().min(1)).min(1),
+      environment: mcpEnvironmentSchema,
+      timeoutMs: z.number().int().positive().optional(),
+    })
+    .strict(),
+]);
+
+const configuredMcpServerListSchema = z.array(configuredMcpServerSchema).transform(servers => {
+  const deduped = new Map<string, (typeof servers)[number]>();
+  for (const server of servers) {
+    deduped.set(server.id, server);
+  }
+  return [...deduped.values()].sort((a, b) => a.id.localeCompare(b.id));
+});
+
+const runtimeOpencodeSchema = z
+  .object({
+    baseUrl: z.string().url(),
+    providerId: z.string().min(1),
+    modelId: z.string().min(1),
+    fallbackModels: stringListSchema.default([]),
+    imageModel: z.string().min(1).nullable().default(null),
+    smallModel: z.string().min(1),
+    timeoutMs: z.number().int().positive(),
+    promptTimeoutMs: z.number().int().positive(),
+    runWaitTimeoutMs: z.number().int().positive().default(180_000),
+    childSessionHideAfterDays: z.number().int().min(0).max(365).default(3),
+    directory: z.string().min(1).nullable().default(null),
+    bootstrap: z
+      .object({
+        enabled: z.boolean().default(true),
+        maxCharsPerFile: z.number().int().positive().default(20_000),
+        maxCharsTotal: z.number().int().positive().default(150_000),
+        subagentMinimal: z.boolean().default(true),
+        includeAgentPrompt: z.boolean().default(true),
+      })
+      .strict()
+      .default({
+        enabled: true,
+        maxCharsPerFile: 20_000,
+        maxCharsTotal: 150_000,
+        subagentMinimal: true,
+        includeAgentPrompt: true,
+      }),
+  })
+  .strict();
+
+const runtimeSmokeTestSchema = z
+  .object({
+    prompt: z.string().min(1),
+    expectedResponsePattern: z.string().min(1),
+  })
+  .strict();
+
+const runtimeRunStreamSchema = z
+  .object({
+    heartbeatMs: z.number().int().min(1_000).default(15_000),
+    replayPageSize: z.number().int().positive().max(1_000).default(200),
+  })
+  .strict();
+
+const runtimeMemorySchema = z
+  .object({
+    enabled: z.boolean().default(true),
+    workspaceDir: z.string().min(1).default("./data/workspace"),
+    embedProvider: z.enum(["ollama", "none"]).default("ollama"),
+    embedModel: z.string().min(1).default("granite-embedding:278m"),
+    ollamaBaseUrl: z.string().url().default("http://127.0.0.1:11434"),
+    chunkTokens: z.number().int().positive().default(400),
+    chunkOverlap: z.number().int().min(0).default(80),
+    maxResults: z.number().int().positive().default(4),
+    minScore: z.number().min(0).max(1).default(0.35),
+    syncCooldownMs: z.number().int().min(0).default(10_000),
+    toolMode: z.enum(["hybrid", "inject_only", "tool_only"]).default("tool_only"),
+    injectionDedupeEnabled: z.boolean().default(true),
+    injectionDedupeFallbackRecallOnly: z.boolean().default(true),
+    injectionDedupeMaxTracked: z.number().int().min(32).max(10_000).default(256),
+    retrieval: z
+      .object({
+        engine: z.enum(["qmd_hybrid", "legacy"]).default("qmd_hybrid"),
+        strongSignalMinScore: z.number().min(0).max(1).default(0.85),
+        strongSignalMinGap: z.number().min(0).max(1).default(0.15),
+        candidateLimit: z.number().int().positive().max(200).default(40),
+        rrfK: z.number().int().positive().max(500).default(60),
+        expansionEnabled: z.boolean().default(true),
+        conceptExpansionEnabled: z.boolean().default(true),
+        conceptExpansionMaxPacks: z.number().int().positive().max(20).default(3),
+        conceptExpansionMaxTerms: z.number().int().positive().max(64).default(10),
+        rerankEnabled: z.boolean().default(true),
+        rerankTopN: z.number().int().positive().max(200).default(40),
+        semanticRescueEnabled: z.boolean().default(true),
+        semanticRescueMinVectorScore: z.number().min(0).max(1).default(0.75),
+        semanticRescueMaxResults: z.number().int().min(0).max(20).default(2),
+        expansionModel: z.string().min(1).nullable().default(null),
+        rerankModel: z.string().min(1).nullable().default(null),
+        vectorBackend: z.enum(["sqlite_vec", "legacy_json", "disabled"]).default("sqlite_vec"),
+        vectorUnavailableFallback: z.enum(["disabled", "legacy_json"]).default("disabled"),
+        vectorK: z.number().int().positive().max(500).default(60),
+        vectorProbeLimit: z.number().int().positive().max(200).default(20),
+      })
+      .strict()
+      .default({
+        engine: "qmd_hybrid",
+        strongSignalMinScore: 0.85,
+        strongSignalMinGap: 0.15,
+        candidateLimit: 40,
+        rrfK: 60,
+        expansionEnabled: true,
+        conceptExpansionEnabled: true,
+        conceptExpansionMaxPacks: 3,
+        conceptExpansionMaxTerms: 10,
+        rerankEnabled: true,
+        rerankTopN: 40,
+        semanticRescueEnabled: true,
+        semanticRescueMinVectorScore: 0.75,
+        semanticRescueMaxResults: 2,
+        expansionModel: null,
+        rerankModel: null,
+        vectorBackend: "sqlite_vec",
+        vectorUnavailableFallback: "disabled",
+        vectorK: 60,
+        vectorProbeLimit: 20,
+      }),
+  })
+  .strict();
+
+const runtimeCronSchema = z
+  .object({
+    defaultMaxAttempts: z.number().int().min(1).default(3),
+    defaultRetryBackoffMs: z.number().int().min(1_000).default(30_000),
+    retryBackoffCapMs: z.number().int().min(1_000).default(3_600_000),
+    conditionalModuleTimeoutMs: z.number().int().min(1_000).max(300_000).default(30_000),
+  })
+  .strict();
+
+const runtimeHeartbeatActiveHoursSchema = z
+  .object({
+    start: z.string().regex(/^\d{2}:\d{2}$/),
+    end: z.string().regex(/^\d{2}:\d{2}$/),
+    timezone: z.string().min(1),
+  })
+  .strict();
+
+const runtimeHeartbeatSchema = z
+  .object({
+    enabled: z.boolean().default(true),
+    interval: z.string().regex(/^\d+[mhd]$/).default("30m"),
+    agentId: z.string().min(1).default("build"),
+    model: z.string().min(1),
+    prompt: z.string().min(1).default(
+      'Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.',
+    ),
+    ackMaxChars: z.number().int().positive().max(4_000).default(300),
+    activeHours: runtimeHeartbeatActiveHoursSchema.nullable().default(null),
+  })
+  .strict();
+
+const runtimeQueueSchema = z
+  .object({
+    enabled: z.boolean().default(true),
+    defaultMode: queueModeSchema.default("collect"),
+    maxDepth: z.number().int().min(1).max(100).default(10),
+    coalesceDebounceMs: z.number().int().min(0).max(60_000).default(500),
+  })
+  .strict();
+
+const runtimeConfigPolicySchema = z
+  .object({
+    mode: z.enum(["builder", "strict"]).default("builder"),
+    denyPaths: stringListSchema.default(["version", "runtime.configPolicy", "runtime.smokeTest"]),
+    strictAllowPaths: stringListSchema.default([
+      "runtime.opencode.runWaitTimeoutMs",
+      "runtime.opencode.childSessionHideAfterDays",
+      "runtime.opencode.bootstrap",
+      "runtime.opencode.imageModel",
+      "runtime.runStream",
+      "runtime.memory",
+      "runtime.heartbeat",
+      "runtime.cron",
+      "runtime.queue",
+      "ui.skills",
+      "ui.mcps",
+      "ui.mcpServers",
+      "ui.agents",
+      "ui.agentTypes",
+    ]),
+    requireExpectedHash: z.boolean().default(true),
+    requireSmokeTest: z.boolean().default(true),
+    autoRollbackOnFailure: z.boolean().default(true),
+  })
+  .strict();
+
+export const agentMockingbirdConfigSchema = z
+  .object({
+    version: z.literal(2),
+    workspace: z
+      .object({
+        pinnedDirectory: z.string().min(1).default("./data/workspace"),
+      })
+      .strict(),
+    runtime: z
+      .object({
+        opencode: runtimeOpencodeSchema,
+        smokeTest: runtimeSmokeTestSchema,
+        runStream: runtimeRunStreamSchema.default({
+          heartbeatMs: 15_000,
+          replayPageSize: 200,
+        }),
+        memory: runtimeMemorySchema.default({
+          enabled: true,
+          workspaceDir: "./data/workspace",
+          embedProvider: "ollama",
+          embedModel: "granite-embedding:278m",
+          ollamaBaseUrl: "http://127.0.0.1:11434",
+          chunkTokens: 400,
+          chunkOverlap: 80,
+          maxResults: 4,
+          minScore: 0.35,
+          syncCooldownMs: 10_000,
+          toolMode: "tool_only",
+          injectionDedupeEnabled: true,
+          injectionDedupeFallbackRecallOnly: true,
+          injectionDedupeMaxTracked: 256,
+          retrieval: {
+            engine: "qmd_hybrid",
+            strongSignalMinScore: 0.85,
+            strongSignalMinGap: 0.15,
+            candidateLimit: 40,
+            rrfK: 60,
+            expansionEnabled: true,
+            conceptExpansionEnabled: true,
+            conceptExpansionMaxPacks: 3,
+            conceptExpansionMaxTerms: 10,
+            rerankEnabled: true,
+            rerankTopN: 40,
+            semanticRescueEnabled: true,
+            semanticRescueMinVectorScore: 0.75,
+            semanticRescueMaxResults: 2,
+            expansionModel: null,
+            rerankModel: null,
+            vectorBackend: "sqlite_vec",
+            vectorUnavailableFallback: "disabled",
+            vectorK: 60,
+            vectorProbeLimit: 20,
+          },
+        }),
+        heartbeat: runtimeHeartbeatSchema.default({
+          enabled: true,
+          interval: "30m",
+          agentId: "build",
+          model: "opencode/big-pickle",
+          prompt:
+            "Read HEARTBEAT.md if it exists (workspace context). Follow it strictly. Do not infer or repeat old tasks from prior chats. If nothing needs attention, reply HEARTBEAT_OK.",
+          ackMaxChars: 300,
+          activeHours: null,
+        }),
+        cron: runtimeCronSchema.default({
+          defaultMaxAttempts: 3,
+          defaultRetryBackoffMs: 30_000,
+          retryBackoffCapMs: 3_600_000,
+          conditionalModuleTimeoutMs: 30_000,
+        }),
+        queue: runtimeQueueSchema.default({
+          enabled: true,
+          defaultMode: "collect",
+          maxDepth: 10,
+          coalesceDebounceMs: 500,
+        }),
+        configPolicy: runtimeConfigPolicySchema.default({
+          mode: "builder",
+          denyPaths: ["version", "runtime.configPolicy", "runtime.smokeTest"],
+          strictAllowPaths: [
+            "runtime.opencode.runWaitTimeoutMs",
+            "runtime.opencode.childSessionHideAfterDays",
+            "runtime.opencode.bootstrap",
+            "runtime.opencode.imageModel",
+            "runtime.runStream",
+            "runtime.memory",
+            "runtime.heartbeat",
+            "runtime.cron",
+            "runtime.queue",
+            "ui.skills",
+            "ui.mcps",
+            "ui.mcpServers",
+            "ui.agents",
+            "ui.agentTypes",
+          ],
+          requireExpectedHash: true,
+          requireSmokeTest: true,
+          autoRollbackOnFailure: true,
+        }),
+      })
+      .strict(),
+    ui: z
+      .object({
+        skills: stringListSchema.default([]),
+        mcps: stringListSchema.default([]),
+        mcpServers: configuredMcpServerListSchema.default([]),
+        agents: z.array(specialistAgentSchema).default([]),
+        agentTypes: agentTypeDefinitionListSchema.default([]),
+      })
+      .strict(),
+  })
+  .strict();
+
+export type AgentMockingbirdConfig = z.infer<typeof agentMockingbirdConfigSchema>;
+export type ConfiguredMcpServer = z.infer<typeof configuredMcpServerSchema>;
+export type AgentTypeDefinition = z.infer<typeof agentTypeDefinitionSchema>;

package/apps/server/src/backend/config/semantic.test.ts

@@ -0,0 +1,34 @@
+import { expect, test } from "bun:test";
+
+import { resolveModelRefForValidation } from "./semantic";
+
+function buildModelMap() {
+  return new Map<string, Set<string>>([
+    ["chutes", new Set(["zai-org/GLM-4.7-Flash", "openai/gpt-oss-20b"])],
+    ["anthropic", new Set(["claude-sonnet-4-5"])],
+  ]);
+}
+
+test("resolveModelRefForValidation keeps slash model IDs on default provider when exact model exists", () => {
+  const resolved = resolveModelRefForValidation("zai-org/GLM-4.7-Flash", "chutes", buildModelMap());
+  expect(resolved).toEqual({
+    providerId: "chutes",
+    modelId: "zai-org/GLM-4.7-Flash",
+  });
+});
+
+test("resolveModelRefForValidation accepts qualified provider/model references", () => {
+  const resolved = resolveModelRefForValidation("anthropic/claude-sonnet-4-5", "chutes", buildModelMap());
+  expect(resolved).toEqual({
+    providerId: "anthropic",
+    modelId: "claude-sonnet-4-5",
+  });
+});
+
+test("resolveModelRefForValidation falls back to default provider when provider prefix is unknown", () => {
+  const resolved = resolveModelRefForValidation("custom/my-model", "chutes", buildModelMap());
+  expect(resolved).toEqual({
+    providerId: "chutes",
+    modelId: "custom/my-model",
+  });
+});