bareloop 0.5.1 → 0.7.0

package/types/validate.d.ts

@@ -29,54 +29,37 @@ export function isNonEmptyString(v: unknown): v is string;
  * Scan a RAW text stream (a spine file, a close's output, a transcript) for
  * known secret shapes and return the literal matches. The ONE spelling of the
  * text-side scan, for the same reason SECRET_PATTERNS is the ONE inventory: a
- * hand-rolled copy that misses a shape is a leak on the very output it guards
- * (seven copies of this expression lived in scripts/ before it landed here).
+ * hand-rolled copy that misses a shape is a leak on the very output it guards.
+ * The dedup is now COMPLETE and the count is grepped, not remembered: all 11
+ * call sites in scripts/ go through this function, and zero hand-rolled copies
+ * of the expression remain anywhere in the repo. (F40 landed the helper and
+ * converted 2 of 7 sites; the 5 it left alone plus 4 that accreted afterwards
+ * were converted in one sweep, byte-identical behaviour — measured equivalent
+ * on 900 spiked real spines, 0 divergences.)
  * `sweepSecretLiterals` is the config-tree twin — same shapes, tree walk.
  * Never throws; returns [] for a missing stream.
  * @param {unknown} raw
  * @returns {string[]} every match, in stream order per pattern
  */
 export function scanSecrets(raw: unknown): string[];
+/**
+ * Mask known secret shapes in a text. The REDACTION twin of `scanSecrets` and
+ * the ONE spelling of it: detection and redaction read the same inventory, so a
+ * shape the validator reds can never be a shape the redactor passes (a divergence
+ * there is a leak on the very output the validator was guarding). Housed beside
+ * the inventory rather than at each consumer for the same reason `scanSecrets`
+ * is — a hand-rolled copy is how the two drift.
+ * Consumers: the plan flow's spine/close/prompt `scrub`, and the isolate verbs,
+ * which write model-authored text into `<workdir>/.litectx` — a file INSIDE the
+ * tree that outlives the run and reads back through ctx_recall.
+ * @param {unknown} raw
+ * @returns {string}
+ */
+export function redactSecrets(raw: unknown): string;
 /**
  * Red every string in a config tree that carries a known secret-token shape.
  * @param {any} root
  * @param {(code: string, path: string, detail?: string) => void} red
  */
 export function sweepSecretLiterals(root: any, red: (code: string, path: string, detail?: string) => void): void;
-/**
- * Validate a workflow config against schema v1. Returns the parsed config on
- * ok (single parse — callers never re-parse; null on any red).
- * @param {object|string} input parsed config, or raw JSON text (parse failures are a red)
- * @param {{ shellCapUsd?: number, jobWriteScope?: string[] }} [opts] the shell's
- *   ceilings — a config may tighten either, never exceed. `shellCapUsd`: at N2+
- *   the shell passes min(shell cap, job budgetUsd) — the ceiling chain
- *   workflow ≤ job ≤ shell. `jobWriteScope`: the job spec's outer fence
- *   (operator law, job-v1) — every workflow scope must fit inside it.
- * @returns {{ ok: boolean, reds: Array<{code: string, path: string, detail?: string}>, config: object|null }}
- */
-export function validateConfig(input: object | string, { shellCapUsd, jobWriteScope }?: {
-    shellCapUsd?: number;
-    jobWriteScope?: string[];
-}): {
-    ok: boolean;
-    reds: Array<{
-        code: string;
-        path: string;
-        detail?: string;
-    }>;
-    config: object | null;
-};
-/**
- * Changed JSON paths between two configs — the one-knob mutation checker
- * (a legal mutant has exactly one). A subtree present on only one side counts
- * as ONE path (its root), so "add an op to a slot" is one knob, not two params.
- * @param {object} a
- * @param {object} b
- * @returns {string[]} sorted changed paths, dot-notation with array indices
- */
-export function diffPaths(a: object, b: object): string[];
-export const LOOP_SHAPES: readonly string[];
-export const SLOTS: readonly string[];
-export const VERBS: readonly string[];
-export const REMEMBER_KINDS: string[];
 export const SECRET_PATTERNS: RegExp[];

package/src/extract.js

@@ -1,103 +0,0 @@
-// The rules extractor — the lineage's inheritance representation. One sealed
-// LLM call after a green run distills/updates the lineage's rules list from
-// LEDGER FACTS only: the green config, the prior rules, and the revision diff
-// if the run recovered mid-run (the diff is the lesson — failure-transition
-// evidence, free in the event log). It never sees the close, the tests, or the
-// worker's code: rules describe the WORKFLOW, and showing the judge would open
-// the config-level fit-to-pass surface (PRD §2).
-//
-// N3 extends this with the contrast-bit rule (design law #3: verdict admits,
-// contrast attributes — the extractor may claim a knob only with ≥1
-// ledger-counted contrast bit; adaptlearn F16/F18 showed bare greens lose
-// working features). At N0 the extractor is the adaptlearn-proven distiller.
-//
-// Honesty invariants:
-// - One shot, no retry: malformed output is a red as DATA — the caller keeps
-//   the lineage's prior rules; there is never a silent empty inheritance.
-// - The ≤MAX_RULES/≤MAX_RULE_CHARS bound is stated to the model but ENFORCED
-//   mechanically post-call, and enforcement rejects whole — never trims
-//   (rejecting a half-applicable output beats silently part-applying it).
-// - Extractor spend is carried in costUsd and lands on the run's cost line —
-//   a representation whose upkeep rides free corrupts the ranking (design
-//   law #4: green gates, cost ranks).
-
-import { createRequire } from 'node:module';
-
-import { extractArtifact, priceOf } from './text.js';
-
-const require = createRequire(import.meta.url);
-const { Loop } = require('bare-agent');
-
-export const MAX_RULES = 5;
-export const MAX_RULE_CHARS = 200;
-
-/**
- * Distill/update a lineage's rules from one green run's ledger facts.
- * @param {object} opts
- * @param {object} opts.config the config that went green
- * @param {object} opts.provider a bareagent provider — SHELL-owned, sealed
- * @param {string[]|null} opts.priorRules the lineage's current rules, if any
- * @param {string[]} [opts.revisionDiff] changed config paths, when the run recovered mid-run
- * @returns {Promise<{rules: string[]|null, valid: boolean, reds: Array<object>, costUsd: number|null, raw: string}>}
- *   costUsd is null when the spend could not be priced — the explicit-unknown
- *   signal (F6: unpriced is never free); callers must not coerce it to 0
- */
-export async function extractRules({ config, provider, priorRules, revisionDiff }) {
-  const loop = new Loop({ provider, system: 'You emit exactly one JSON document and nothing else.' });
-  const prompt = `An automated coding workflow just completed a run that PASSED its hidden judgement.
-You maintain this workflow lineage's inherited rules: short, general lessons about how to
-configure the workflow for this task family. You never see the tasks' tests or code — only
-workflow facts.
-
-The config that went green:
-${JSON.stringify(config, null, 2)}
-${revisionDiff && revisionDiff.length > 0 ? `
-This run stalled and recovered after revising these config paths mid-run (the revision that
-turned red into green — strong evidence about what mattered):
-${revisionDiff.join(', ')}
-` : ''}${priorRules && priorRules.length > 0 ? `
-The lineage's current rules — revise them: keep what still holds, drop what this run
-contradicts, add at most what this run actually evidences:
-${JSON.stringify(priorRules, null, 2)}
-` : `
-The lineage has no rules yet. Write only what this single run actually evidences.
-`}
-Output ONLY a JSON array of strings: at most ${MAX_RULES} rules, each at most ${MAX_RULE_CHARS}
-characters. No markdown fences, no commentary.`;
-
-  // Never throw (the module contract): a provider blip during post-green
-  // extraction must not lose the green run's bookkeeping — it degrades to a
-  // red as data and the caller keeps the lineage's prior rules. Loop defaults
-  // throwOnError: true, so a transient 500 WOULD reject without this.
-  let r;
-  try {
-    r = await loop.run([{ role: 'user', content: prompt }]);
-  } catch (e) {
-    // a transport throw means the spend is UNKNOWN, not zero (F6)
-    return { rules: null, valid: false, reds: [{ code: 'provider-error', detail: String(/** @type {Error} */ (e).message ?? e) }], costUsd: null, raw: '' };
-  }
-  const { costUsd } = priceOf(r); // the ONE honest-null cost read (F6)
-  const ex = extractArtifact(r.text ?? '');
-  const raw = ex.code ?? '';
-  if (r.error) {
-    return { rules: null, valid: false, reds: [{ code: 'provider-error', detail: String(r.error) }], costUsd, raw };
-  }
-  /** @type {(code: string, detail: string) => {rules: null, valid: false, reds: Array<object>, costUsd: number|null, raw: string}} */
-  const red = (code, detail) => ({ rules: null, valid: false, reds: [{ code, detail }], costUsd, raw });
-  // ONE-parser doctrine: extractArtifact's red field is part of its contract —
-  // dropping it here buried 'empty response' under JSON.parse's generic
-  // "Unexpected end of JSON input" (interpret.js consumes ex.red the same way)
-  if (ex.red) return red('artifact-red', ex.red);
-
-  let rules;
-  try { rules = JSON.parse(raw); } catch (e) {
-    return red('parse-error', String(/** @type {Error} */ (e).message));
-  }
-  if (!Array.isArray(rules) || rules.length === 0 || !rules.every((x) => typeof x === 'string')) {
-    return red('rules-shape', 'expected a non-empty JSON array of strings');
-  }
-  if (rules.length > MAX_RULES || rules.some((x) => x.length > MAX_RULE_CHARS)) {
-    return red('rules-bound', `max ${MAX_RULES} rules of ${MAX_RULE_CHARS} chars — rejected whole, never trimmed`);
-  }
-  return { rules, valid: true, reds: [], costUsd, raw };
-}