agentlas 0.4.0 → 0.5.5

package/engine/architecture.data.json

@@ -1,5 +1,5 @@
 {
-  "version": "1.5.34",
+  "version": "1.5.35",
   "emitterBlock": "## Memory (Agentlas curated memory)\n\nIf — and only if — this turn produced something durable (a decision, a stable fact,\na user preference, a risk, a reusable procedure), end your reply with a Memory Events\nblock. Emit nothing when nothing durable was learned.\n\nRules:\n- Never include secrets, credentials, API keys, raw logs, or full transcripts.\n- Real credential values may live only in local project .env/.env.local,\n  ignored signing/ or credentials/ files, or a local keychain/vault. Memory\n  Events may mention env names and local relative paths only.\n- For deploy, release, store, billing, auth, API, or cloud work, first read the\n  project's .agentlas/local-credentials.map.json and the top\n  \"Local Credential Index\" section of .agentlas/project-soul-memory.md\n  before saying a credential is missing.\n- One event per durable item. Keep \"content\" to one or two sentences.\n- \"memory_kind\": fact | decision | preference | risk | procedure | hypothesis | evidence | deprecation | conflict\n- \"suggested_scope\": user_identity | team_memory | project (this folder) | agent_repo | session (temporary) | discard\n- \"agent_team\" is accepted only as a legacy alias for team_memory.\n- Add \"request_context\" when it improves future recall: user_intent, trigger_terms,\n  cwd_at_request, target_project, target_path, cross_context, outcome.\n- Never put the raw user prompt or transcript in request_context.\n- Suggest a scope; the Memory Curator decides the final destination.\n\nFormat (omit entirely if empty):\n\n## Memory Events\n```json\n[\n  {\n    \"memory_kind\": \"decision\",\n    \"content\": \"...\",\n    \"suggested_scope\": \"project\",\n    \"confidence\": \"high\",\n    \"evidence_refs\": [],\n    \"request_context\": {\n      \"user_intent\": \"...\",\n      \"trigger_terms\": [\"...\"],\n      \"cwd_at_request\": null,\n      \"target_project\": null,\n      \"target_path\": null,\n      \"cross_context\": false,\n      \"outcome\": \"...\"\n    }\n  }\n]\n```",
   "eventsHeading": "## Memory Events",
   "memoryDir": ".agentlas",
@@ -14,6 +14,10 @@
   "skillRegistryFile": "skill-registry.json",
   "skillTrialsFile": "skill-trials.jsonl",
   "curatorDecisionsFile": "curator-decisions.jsonl",
+  "careerGraphConfigFile": "career-graph.json",
+  "careerGraphSourceManifestFile": "career-graph-sources.json",
+  "careerGraphInboxDir": "career-graph-inbox",
+  "careerGraphDbFile": "career-graph.sqlite",
   "superOntologyContractFile": "super-ontology-contract.json",
   "superOntologyOpenWorldCoverageFile": "super-ontology-open-world-coverage.json",
   "superOntologyConsensusCoordinationFile": "super-ontology-consensus-coordination.json",

package/engine/semver.cjs

@@ -0,0 +1,64 @@
+"use strict";
+
+const SEMVER_RE = /^[vV]?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)(?:-([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?(?:\+([0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*))?$/;
+
+function parseSemVer(value) {
+  if (typeof value !== "string") return null;
+  const match = value.trim().match(SEMVER_RE);
+  if (!match) return null;
+  const prerelease = match[4] ? match[4].split(".") : [];
+  if (prerelease.some((identifier) => /^\d+$/.test(identifier) && identifier.length > 1 && identifier.startsWith("0"))) {
+    return null;
+  }
+  return {
+    major: match[1],
+    minor: match[2],
+    patch: match[3],
+    prerelease,
+    build: match[5] ? match[5].split(".") : [],
+  };
+}
+
+function normalizeSemVer(value) {
+  const parsed = parseSemVer(value);
+  if (!parsed) return null;
+  return `${parsed.major}.${parsed.minor}.${parsed.patch}` +
+    `${parsed.prerelease.length ? `-${parsed.prerelease.join(".")}` : ""}` +
+    `${parsed.build.length ? `+${parsed.build.join(".")}` : ""}`;
+}
+
+function compareNumericIdentifier(left, right) {
+  if (left.length !== right.length) return left.length < right.length ? -1 : 1;
+  if (left === right) return 0;
+  return left < right ? -1 : 1;
+}
+
+/** SemVer 2.0.0 precedence. Build metadata is intentionally ignored. */
+function compareSemVer(left, right) {
+  const a = parseSemVer(left);
+  const b = parseSemVer(right);
+  if (!a || !b) return null;
+  for (const key of ["major", "minor", "patch"]) {
+    const compared = compareNumericIdentifier(a[key], b[key]);
+    if (compared !== 0) return compared;
+  }
+  if (a.prerelease.length === 0 && b.prerelease.length === 0) return 0;
+  if (a.prerelease.length === 0) return 1;
+  if (b.prerelease.length === 0) return -1;
+  const length = Math.max(a.prerelease.length, b.prerelease.length);
+  for (let index = 0; index < length; index += 1) {
+    const leftIdentifier = a.prerelease[index];
+    const rightIdentifier = b.prerelease[index];
+    if (leftIdentifier === undefined) return -1;
+    if (rightIdentifier === undefined) return 1;
+    if (leftIdentifier === rightIdentifier) continue;
+    const leftNumeric = /^\d+$/.test(leftIdentifier);
+    const rightNumeric = /^\d+$/.test(rightIdentifier);
+    if (leftNumeric && rightNumeric) return compareNumericIdentifier(leftIdentifier, rightIdentifier);
+    if (leftNumeric !== rightNumeric) return leftNumeric ? -1 : 1;
+    return leftIdentifier < rightIdentifier ? -1 : 1;
+  }
+  return 0;
+}
+
+module.exports = { parseSemVer, normalizeSemVer, compareSemVer };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "agentlas",
-  "version": "0.4.0",
+  "version": "0.5.5",
   "description": "Agentlas agent terminal — chat with your installed AI agents and teams from the terminal, Claude Code style. Standalone: no desktop app required.",
   "bin": {
     "agentlas": "bin/agentlas.cjs"

package/test/bootstrap-race.cjs

@@ -0,0 +1,47 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const fs = require("node:fs");
+const os = require("node:os");
+const path = require("node:path");
+const { spawn } = require("node:child_process");
+
+const root = path.resolve(__dirname, "..");
+const launcher = path.join(root, "bin", "agentlas.cjs");
+const temp = fs.mkdtempSync(path.join(os.tmpdir(), "agentlas-bootstrap-race-"));
+const probe = `const x=require(${JSON.stringify(launcher)}); process.stdout.write(JSON.stringify(x.bootstrapDbIfMissing()))`;
+
+function runOne() {
+  return new Promise((resolve, reject) => {
+    const child = spawn(process.execPath, ["-e", probe], {
+      cwd: root,
+      env: { ...process.env, AGENTLAS_USER_DATA_DIR: temp },
+      stdio: ["ignore", "pipe", "pipe"],
+    });
+    let stdout = "";
+    let stderr = "";
+    child.stdout.on("data", (chunk) => { stdout += chunk; });
+    child.stderr.on("data", (chunk) => { stderr += chunk; });
+    child.on("error", reject);
+    child.on("close", (code) => {
+      if (code !== 0) return reject(new Error(`bootstrap child ${code}: ${stderr}`));
+      resolve(JSON.parse(stdout));
+    });
+  });
+}
+
+Promise.all(Array.from({ length: 8 }, () => runOne()))
+  .then((results) => {
+    assert.equal(results.filter((result) => result.created).length, 1, "exactly one process owns first creation");
+    const db = path.join(temp, "agentlas.sqlite");
+    assert.equal(fs.existsSync(db), true);
+    assert.ok(fs.statSync(db).size > 0);
+    assert.deepEqual(fs.readdirSync(temp).filter((name) => name.includes(".bootstrap-")), []);
+    console.log(JSON.stringify({ ok: true, workers: results.length, created: 1 }, null, 2));
+  })
+  .catch((error) => {
+    console.error(error);
+    process.exitCode = 1;
+  })
+  .finally(() => fs.rmSync(temp, { recursive: true, force: true }));

package/test/capture-runtime-guard.cjs

@@ -0,0 +1,122 @@
+#!/usr/bin/env node
+"use strict";
+
+const assert = require("node:assert/strict");
+const { EventEmitter } = require("node:events");
+const { PassThrough } = require("node:stream");
+const { captureRuntime, captureOutputLimit, isProtectedChildEnvKeyCli } = require("../engine/agentlas.cjs");
+
+class FakeChild extends EventEmitter {
+  constructor(options = {}) {
+    super();
+    this.stdout = new PassThrough();
+    this.stderr = new PassThrough();
+    this.signals = [];
+    this.ignoreTerm = !!options.ignoreTerm;
+    this.ignoreKill = !!options.ignoreKill;
+    this.closed = false;
+  }
+
+  kill(signal) {
+    this.signals.push(signal);
+    if (signal === "SIGTERM" && this.ignoreTerm) return true;
+    if (signal === "SIGKILL" && this.ignoreKill) return true;
+    this.finish(null, signal);
+    return true;
+  }
+
+  finish(code = 0, signal = null) {
+    if (this.closed) return;
+    this.closed = true;
+    this.stdout.end();
+    this.stderr.end();
+    queueMicrotask(() => this.emit("close", code, signal));
+  }
+}
+
+function capture(child, options = {}) {
+  return captureRuntime("gemini", "system", "prompt", {
+    cwd: process.cwd(),
+    permission: "read",
+    env: {},
+    timeoutConfig: options.timeoutConfig || { idleMs: 40, totalMs: 300, killGraceMs: 15 },
+    outputLimitBytes: options.outputLimitBytes || 1_024,
+    signal: options.signal,
+    spawn: () => child,
+  });
+}
+
+async function main() {
+  assert.equal(captureOutputLimit({ AGENTLAS_CAPTURE_MAX_OUTPUT_BYTES: "NaN" }), 4 * 1024 * 1024);
+  assert.equal(captureOutputLimit({ AGENTLAS_CAPTURE_MAX_OUTPUT_BYTES: "-1" }), 64 * 1024);
+  assert.equal(captureOutputLimit({ AGENTLAS_CAPTURE_MAX_OUTPUT_BYTES: "999999999999" }), 32 * 1024 * 1024);
+  for (const key of [
+    "AGENTLAS_NATIVE_IDLE_TIMEOUT_MS",
+    "AGENTLAS_NATIVE_TOTAL_TIMEOUT_MS",
+    "AGENTLAS_NATIVE_KILL_GRACE_MS",
+    "AGENTLAS_CAPTURE_MAX_OUTPUT_BYTES",
+  ]) {
+    assert.equal(isProtectedChildEnvKeyCli(key), true, `${key} must not be overridden by a project .env`);
+  }
+
+  const streaming = new FakeChild();
+  const streamingRun = capture(streaming, { timeoutConfig: { idleMs: 35, totalMs: 250, killGraceMs: 15 } });
+  ["one", "two", "three", "four"].forEach((value, index) => {
+    setTimeout(() => streaming.stdout.write(value), 15 + index * 20);
+  });
+  setTimeout(() => streaming.finish(0), 110);
+  assert.equal(await streamingRun, "onetwothreefour", "regular output must keep the capture idle timer alive");
+  assert.deepEqual(streaming.signals, []);
+
+  const silent = new FakeChild({ ignoreTerm: true });
+  await assert.rejects(
+    capture(silent, { timeoutConfig: { idleMs: 30, totalMs: 250, killGraceMs: 15 } }),
+    (error) => error && error.code === "AGENTLAS_CAPTURE_IDLE_TIMEOUT",
+  );
+  assert.deepEqual(silent.signals, ["SIGTERM", "SIGKILL"]);
+
+  const active = new FakeChild({ ignoreTerm: true });
+  const activeRun = capture(active, { timeoutConfig: { idleMs: 35, totalMs: 85, killGraceMs: 15 } });
+  const activity = setInterval(() => active.stderr.write("progress\n"), 12);
+  await assert.rejects(activeRun, (error) => error && error.code === "AGENTLAS_CAPTURE_TOTAL_TIMEOUT");
+  clearInterval(activity);
+  assert.deepEqual(active.signals, ["SIGTERM", "SIGKILL"], "total timeout caps an otherwise active capture");
+
+  const noisy = new FakeChild();
+  const noisyRun = capture(noisy, {
+    outputLimitBytes: 128,
+    timeoutConfig: { idleMs: 200, totalMs: 300, killGraceMs: 15 },
+  });
+  noisy.stdout.write(Buffer.alloc(512, 0x61));
+  await assert.rejects(noisyRun, (error) => error && error.code === "AGENTLAS_CAPTURE_OUTPUT_LIMIT");
+  assert.deepEqual(noisy.signals, ["SIGTERM"], "output overflow should stop immediately without retaining unbounded data");
+
+  const cancellable = new FakeChild();
+  const controller = new AbortController();
+  const cancelRun = capture(cancellable, {
+    signal: controller.signal,
+    timeoutConfig: { idleMs: 200, totalMs: 300, killGraceMs: 15 },
+  });
+  setTimeout(() => controller.abort(new Error("operator cancelled")), 15);
+  await assert.rejects(cancelRun, /operator cancelled/);
+  assert.deepEqual(cancellable.signals, ["SIGTERM"]);
+
+  const stubborn = new FakeChild({ ignoreTerm: true, ignoreKill: true });
+  const startedAt = Date.now();
+  await assert.rejects(
+    capture(stubborn, { timeoutConfig: { idleMs: 20, totalMs: 300, killGraceMs: 10 } }),
+    (error) => error && error.code === "AGENTLAS_CAPTURE_IDLE_TIMEOUT",
+  );
+  assert.ok(Date.now() - startedAt < 1_000, "capture slot must be released even if the child never emits close");
+  assert.deepEqual(stubborn.signals, ["SIGTERM", "SIGKILL"]);
+  assert.equal(stubborn.stdout.listenerCount("data"), 0, "force resolution must detach stdout capture");
+  assert.equal(stubborn.stderr.listenerCount("data"), 0, "force resolution must detach stderr capture");
+  assert.equal(stubborn.listenerCount("close"), 0, "force resolution must detach process listeners");
+
+  console.log("capture-runtime-guard: PASS");
+}
+
+main().catch((error) => {
+  console.error(error);
+  process.exitCode = 1;
+});