bazilion 0.11.0 → 0.12.0

package/dist/worker.js

@@ -1,8 +1,10 @@
 #!/usr/bin/env node
 
 // ../daemon/src/runtime/worker/entry.ts
-import { randomUUID as randomUUID17 } from "crypto";
+import { randomUUID as randomUUID19 } from "crypto";
+import { mkdtempSync as mkdtempSync3, rmSync as rmSync12 } from "fs";
 import { join as join19 } from "path";
+import { Type as Type3 } from "typebox";
 
 // ../daemon/src/core/agent/delete.ts
 import { randomUUID } from "crypto";
@@ -18,8 +20,11 @@ import { join as join2 } from "path";
 // ../daemon/src/core/profile/identity.ts
 import { readFileSync as readFileSync2 } from "fs";
 
-// ../daemon/src/core/agent/spawn.ts
+// ../daemon/src/core/repos/agentLessonProposals.ts
 import { randomUUID as randomUUID2 } from "crypto";
+
+// ../daemon/src/core/agent/spawn.ts
+import { randomUUID as randomUUID3 } from "crypto";
 import { mkdirSync as mkdirSync3, rmSync as rmSync3, writeFileSync as writeFileSync4 } from "fs";
 import { join as join7 } from "path";
 
@@ -85,14 +90,17 @@ function resolvePaths(home) {
 import { existsSync as existsSync6, rmSync as rmSync4 } from "fs";
 
 // ../daemon/src/core/repos/teamTemplates.ts
-import { randomUUID as randomUUID3 } from "crypto";
+import { randomUUID as randomUUID4 } from "crypto";
 
 // ../daemon/src/core/profile/update.ts
 import { writeFileSync as writeFileSync5 } from "fs";
 import { join as join10 } from "path";
 
+// ../daemon/src/core/repos/agentReviews.ts
+import { randomUUID as randomUUID5 } from "crypto";
+
 // ../daemon/src/core/repos/communicationApprovals.ts
-import { createHash, randomUUID as randomUUID4 } from "crypto";
+import { createHash, randomUUID as randomUUID6 } from "crypto";
 var DEFAULT_TTL_MS = 24 * 60 * 60 * 1e3;
 
 // ../daemon/src/core/services.ts
@@ -529,6 +537,13 @@ var SERVICES = [
         label: "Extra environment allowlist",
         placeholder: "MY_SAFE_VARIABLE,ANOTHER_SAFE_VARIABLE",
         description: "Optional comma-separated variable names copied into the container. Provider credentials remain excluded unless explicitly named."
+      },
+      {
+        envVar: "BAZILION_AGENT_LOOP_MAX_HOPS",
+        kind: "config",
+        label: "Agent-message hop limit",
+        placeholder: "8",
+        description: "Maximum causal hops in an agent-to-agent message chain before the daemon stops it. Default 8."
       }
     ]
   },
@@ -634,22 +649,22 @@ var CONFIG_KEYS = [
 var CONFIG_KEY_SET = new Set(CONFIG_KEYS);
 
 // ../daemon/src/core/repos/mcpServers.ts
-import { randomUUID as randomUUID5 } from "crypto";
+import { randomUUID as randomUUID7 } from "crypto";
 
 // ../daemon/src/core/repos/messages.ts
-import { randomUUID as randomUUID6 } from "crypto";
+import { randomUUID as randomUUID8 } from "crypto";
 
 // ../daemon/src/core/repos/secrets.ts
 import { createCipheriv, createDecipheriv, pbkdf2Sync, randomBytes } from "crypto";
 
 // ../daemon/src/core/repos/triggerDispatches.ts
-import { randomUUID as randomUUID7 } from "crypto";
+import { randomUUID as randomUUID9 } from "crypto";
 
 // ../daemon/src/core/repos/triggers.ts
-import { randomUUID as randomUUID8 } from "crypto";
+import { randomUUID as randomUUID10 } from "crypto";
 
 // ../daemon/src/core/repos/webTokens.ts
-import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID9 } from "crypto";
+import { createHash as createHash2, randomBytes as randomBytes2, randomUUID as randomUUID11 } from "crypto";
 
 // ../daemon/src/core/secrets.ts
 import { existsSync as existsSync7, readFileSync as readFileSync6 } from "fs";
@@ -695,20 +710,20 @@ function parseSkillFile(path) {
 }
 
 // ../daemon/src/core/team/delete.ts
-import { randomUUID as randomUUID10 } from "crypto";
+import { randomUUID as randomUUID12 } from "crypto";
 import { existsSync as existsSync9, renameSync as renameSync2, rmSync as rmSync6 } from "fs";
 
 // ../daemon/src/core/team-policy/adopt.ts
-import { randomUUID as randomUUID11 } from "crypto";
+import { randomUUID as randomUUID13 } from "crypto";
 
 // ../daemon/src/core/team-policy/authorization.ts
-import { createHash as createHash3, randomUUID as randomUUID12 } from "crypto";
+import { createHash as createHash3, randomUUID as randomUUID14 } from "crypto";
 
 // ../daemon/src/core/team-policy/source.ts
-import { randomUUID as randomUUID13 } from "crypto";
+import { randomUUID as randomUUID15 } from "crypto";
 
 // ../daemon/src/core/team-policy/spawn.ts
-import { randomUUID as randomUUID14 } from "crypto";
+import { randomUUID as randomUUID16 } from "crypto";
 import { readdirSync as readdirSync4, rmSync as rmSync8 } from "fs";
 
 // ../daemon/src/core/team-policy/rm-with-retry.ts
@@ -1348,11 +1363,34 @@ ${agent.team.userMd.trim()}`
 This team's USER.md is empty. As you learn STABLE facts about the human (preferences, role, working hours, how they like to be addressed), populate it via \`user_md_get\` then \`user_md_write\` (always get first \u2014 you need the etag). Reserve this for things you're confident are durable \u2014 project knowledge belongs in \`memory_write\`, personal notes about yourself in \`home_write\` on IDENTITY.md. **Do NOT send peer messages announcing USER.md changes \u2014 every agent in the team sees the new content in their system prompt on their next turn automatically.**`
     );
   }
+  const reviewedLessons = boundReviewedLessons(agent.privateLessons);
+  if (reviewedLessons.length > 0) {
+    parts.push(
+      `# Reviewed lessons
+
+These private lessons were explicitly approved by the human for your behavior. Follow them when relevant; current user instructions and higher-priority policy still win.
+
+${reviewedLessons.map((lesson) => `- ${lesson}`).join("\n")}`
+    );
+  }
   parts.push(
     "# Memory\n\nYou share a persistent memory backend with every other agent in this team. Use `memory_write` to remember things across sessions, and `memory_search` / `memory_read` / `memory_list` to recall them. This memory is for project knowledge \u2014 codebase notes, decisions, things the user told you about the work. For personal notes about yourself (preferences, persona quirks), use `home_write` on IDENTITY.md instead. Always check memory at the start of a session: another agent in the team may have already learned something useful. **Do NOT send peer messages announcing memory writes \u2014 every agent has access to the same store via `memory_search` and will find your note when they need it.**"
   );
   return parts.join("\n\n---\n\n");
 }
+function boundReviewedLessons(lessons, maxCharacters = 8e3) {
+  const selected = [];
+  let used = 0;
+  for (const raw of lessons) {
+    const lesson = raw.trim();
+    if (!lesson) continue;
+    const remaining = maxCharacters - used;
+    if (remaining <= 0) break;
+    selected.push(lesson.slice(0, remaining));
+    used += Math.min(lesson.length, remaining);
+  }
+  return selected;
+}
 
 // ../daemon/src/runtime/shell/tooling.ts
 import { existsSync as existsSync11, lstatSync as lstatSync2, realpathSync as realpathSync2 } from "fs";
@@ -1743,7 +1781,7 @@ function createApprovalGatedBashTool(base, host) {
 
 // ../daemon/src/runtime/shell/docker.ts
 import { spawn } from "child_process";
-import { randomUUID as randomUUID15 } from "crypto";
+import { randomUUID as randomUUID17 } from "crypto";
 import { closeSync as closeSync2, constants as constants2, mkdtempSync as mkdtempSync2, openSync as openSync2, rmSync as rmSync10, writeFileSync as writeFileSync7 } from "fs";
 import { access, realpath, stat } from "fs/promises";
 import { tmpdir as tmpdir2 } from "os";
@@ -1894,7 +1932,7 @@ function createDockerBashOperations(options) {
       const dockerClientEnv = await resolveLocalDockerClientEnv(dockerPath, hostEnv);
       const resolvedImage = await inspectSandboxImage(dockerPath, image, dockerClientEnv);
       if (signal?.aborted) throw new Error("aborted");
-      const containerName = `bazilion-bash-${process.pid}-${randomUUID15().replaceAll("-", "")}`;
+      const containerName = `bazilion-bash-${process.pid}-${randomUUID17().replaceAll("-", "")}`;
       const spec = buildDockerRunSpec({
         image,
         env,
@@ -3668,7 +3706,8 @@ async function createBazilionSession(opts) {
     mcpTools,
     fileSink,
     bashApprovalHost,
-    refreshApiKey
+    refreshApiKey,
+    restricted
   } = opts;
   const { providerName, modelId } = splitModelString(agent.model);
   if (enabledProviders.size > 0 && !enabledProviders.has(providerName)) {
@@ -3700,9 +3739,9 @@ async function createBazilionSession(opts) {
   }
   const cwd = agent.team.path;
   if (!existsSync13(cwd)) mkdirSync5(cwd, { recursive: true });
-  const promptSkills = loadPromptSkills(paths.skillsDir, agent.skills);
+  const promptSkills = restricted ? [] : loadPromptSkills(paths.skillsDir, agent.skills);
   const uploadsDir = join18(agent.agent.dir, "uploads");
-  const shellTools = createSessionShellTools(cwd, env, {
+  const shellTools = restricted ? null : createSessionShellTools(cwd, env, {
     ...existsSync13(uploadsDir) ? { inputsDir: uploadsDir } : {},
     skillMounts: promptSkills.map((skill) => ({
       source: skill.hostDir,
@@ -3710,9 +3749,9 @@ async function createBazilionSession(opts) {
     })),
     approvalHost: bashApprovalHost
   });
-  const sessionDir = join18(paths.agentDir(agent.agent.id), "sessions");
+  const sessionDir = restricted?.sessionDir ?? join18(paths.agentDir(agent.agent.id), "sessions");
   mkdirSync5(sessionDir, { recursive: true });
-  const existing = findMostRecent(sessionDir);
+  const existing = restricted ? null : findMostRecent(sessionDir);
   const sessionManager = existing ? SessionManager.open(existing, sessionDir, cwd) : SessionManager.create(cwd, sessionDir);
   const settingsManager = SettingsManager.inMemory({
     compaction: { enabled: false },
@@ -3723,13 +3762,13 @@ async function createBazilionSession(opts) {
       provider: { maxRetryDelayMs: 8e3 }
     }
   });
-  const bazilionPrompt = buildSystemPrompt(agent, {
+  const bazilionPrompt = restricted?.systemPrompt ?? buildSystemPrompt(agent, {
     skills: promptSkills,
-    sandboxMode: shellTools.config.sandboxMode
+    sandboxMode: shellTools?.config.sandboxMode ?? "off"
   });
   const resourceLoader = createBazilionResourceLoader(bazilionPrompt);
   await resourceLoader.reload();
-  const bazilionTools = createBazilionCustomTools({
+  const bazilionTools = restricted ? restricted.tools : createBazilionCustomTools({
     agent,
     memory,
     messagingHost,
@@ -3740,13 +3779,13 @@ async function createBazilionSession(opts) {
     fileSink,
     env
   });
-  const customTools = shellTools.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
-  const allowedTools = [...shellTools.hostToolNames, ...customTools.map((t) => t.name)];
+  const customTools = shellTools?.customBash ? [...bazilionTools, shellTools.customBash] : bazilionTools;
+  const allowedTools = [...shellTools?.hostToolNames ?? [], ...customTools.map((t) => t.name)];
   const { session } = await createAgentSession({
     cwd,
     agentDir: join18(paths.home, "pi"),
     model,
-    thinkingLevel: toPiThinkingLevel(agent.reasoningLevel),
+    thinkingLevel: toPiThinkingLevel(restricted?.reasoningLevel ?? agent.reasoningLevel),
     tools: allowedTools,
     customTools,
     sessionManager,
@@ -3902,7 +3941,7 @@ function assertOpenAICodexProvider(requested, expected) {
 }
 
 // ../daemon/src/runtime/worker/ipc-client.ts
-import { randomUUID as randomUUID16 } from "crypto";
+import { randomUUID as randomUUID18 } from "crypto";
 function createIpcClient(channel) {
   const pending = /* @__PURE__ */ new Map();
   let disconnected = false;
@@ -3929,7 +3968,7 @@ function createIpcClient(channel) {
     if (!send) {
       return Promise.reject(new Error("worker: no IPC channel \u2014 daemon must spawn with stdio:ipc"));
     }
-    const id = randomUUID16();
+    const id = randomUUID18();
     const message = { type: "rpc", id, method, args };
     return new Promise((resolve5, reject) => {
       pending.set(id, { resolve: (value) => resolve5(value), reject });
@@ -3968,6 +4007,9 @@ async function readInput() {
       "worker: stdin must include {agent, message, enabledProviders, turnId, bashApprovalMode}"
     );
   }
+  if (parsed.mode === "review" && !parsed.review?.reviewId) {
+    throw new Error("worker: review mode requires review metadata");
+  }
   const providerName = parsed.agent.model.split(":", 1)[0] ?? "";
   if (parsed.apiKeyRefreshEnabled && (providerName !== "openai-codex" || typeof parsed.apiKey !== "string")) {
     throw new Error("worker: API key refresh requires an openai-codex turn with an initial token");
@@ -4006,7 +4048,7 @@ function createIpcBashApprovalHost(call, input) {
   return {
     async requestApproval(request) {
       const result = await call("bashApproval", {
-        id: randomUUID17(),
+        id: randomUUID19(),
         turnId: input.turnId,
         toolCallId: request.toolCallId,
         agentId: input.agent.agent.id,
@@ -4046,7 +4088,9 @@ async function main() {
     mcpTools,
     images,
     turnId,
-    bashApprovalMode
+    bashApprovalMode,
+    mode = "chat",
+    review
   } = await readInput();
   const paths = resolvePaths();
   const memory = qmdBackend(join19(agent.team.path, "memory"));
@@ -4072,6 +4116,52 @@ async function main() {
     turnId,
     bashApprovalMode
   });
+  const reviewSessionDir = mode === "review" ? mkdtempSync3(join19(paths.logsDir, "review-session-")) : null;
+  const proposals = [];
+  let proposalBatchSubmitted = false;
+  const allowedEvidence = new Set(
+    (review?.evidence ?? []).map((item) => `${item.sessionId}:${item.entryOrdinal}`)
+  );
+  const reviewTools = [
+    {
+      name: "propose_lesson",
+      label: "propose_lesson",
+      description: "Submit zero to five evidence-backed lesson proposals in one final batch. This is the only available action.",
+      parameters: Type3.Object({
+        proposals: Type3.Array(
+          Type3.Object({
+            scope: Type3.Union([Type3.Literal("private"), Type3.Literal("shared")]),
+            text: Type3.String({ minLength: 1, maxLength: 500 }),
+            evidenceEntryIds: Type3.Array(
+              Type3.Object({ sessionId: Type3.String(), entryOrdinal: Type3.Integer({ minimum: 0 }) }),
+              { minItems: 1 }
+            )
+          }),
+          { maxItems: 5 }
+        )
+      }),
+      async execute(_toolCallId, params) {
+        if (proposalBatchSubmitted) throw new Error("propose_lesson may be called only once");
+        proposalBatchSubmitted = true;
+        const input = params;
+        for (const candidate of input.proposals) {
+          const text = candidate.text.trim();
+          if (!text || text.length > 500) throw new Error("proposal text must be 1-500 characters");
+          for (const evidence of candidate.evidenceEntryIds) {
+            if (!allowedEvidence.has(`${evidence.sessionId}:${evidence.entryOrdinal}`)) {
+              throw new Error("proposal cites evidence outside the supplied digest");
+            }
+          }
+          proposals.push({ ...candidate, text });
+        }
+        return {
+          content: [{ type: "text", text: `accepted ${proposals.length} proposals` }],
+          details: {},
+          terminate: true
+        };
+      }
+    }
+  ];
   const { session, dispose } = await createBazilionSession({
     agent,
     paths,
@@ -4087,12 +4177,25 @@ async function main() {
     mcpTools,
     bashApprovalHost,
     // deliver_file emits a `file` event straight onto our stdout frame stream.
-    fileSink: (f) => emit({ kind: "event", event: { type: "file", ...f } })
+    fileSink: (f) => emit({ kind: "event", event: { type: "file", ...f } }),
+    ...mode === "review" && reviewSessionDir ? {
+      restricted: {
+        systemPrompt: REVIEW_SYSTEM_PROMPT,
+        tools: reviewTools,
+        sessionDir: reviewSessionDir,
+        reasoningLevel: agent.agent.reviewReasoningLevel
+      }
+    } : {}
   });
   abortSession = () => {
     void session.abort();
   };
+  let reviewValidationFailures = 0;
   const unsubscribe = session.subscribe((piEvent) => {
+    if (mode === "review" && piEvent.type === "tool_execution_end" && piEvent.toolName === "propose_lesson" && piEvent.isError) {
+      reviewValidationFailures += 1;
+      if (reviewValidationFailures >= 2) void session.abort();
+    }
     for (const ev of translatePiEvent(piEvent)) {
       emit({ kind: "event", event: ev });
     }
@@ -4105,10 +4208,19 @@ async function main() {
     }));
     await session.prompt(message, promptImages.length > 0 ? { images: promptImages } : void 0);
     await session.agent.waitForIdle();
-    emit({
-      kind: "done",
-      messages: piMessagesToProviderView(session.agent.state.messages)
-    });
+    if (mode === "review" && reviewValidationFailures >= 2) {
+      throw new Error("review output remained invalid after one schema-repair attempt");
+    }
+    if (mode === "review" && !proposalBatchSubmitted) {
+      throw new Error("review output did not submit a proposal batch");
+    }
+    if (mode === "review") emit({ kind: "review_result", proposals });
+    else {
+      emit({
+        kind: "done",
+        messages: piMessagesToProviderView(session.agent.state.messages)
+      });
+    }
   } catch (err) {
     if (!aborted) {
       emit({ kind: "event", event: { type: "error", error: err.message } });
@@ -4120,6 +4232,7 @@ async function main() {
     process.off("SIGTERM", onSignal);
     process.off("SIGINT", onSignal);
     dispose();
+    if (reviewSessionDir) rmSync12(reviewSessionDir, { recursive: true, force: true });
     try {
       process.disconnect?.();
     } catch {
@@ -4133,4 +4246,21 @@ main().catch((err) => {
   }
   process.exit(1);
 });
+var REVIEW_SYSTEM_PROMPT = `You are a restricted learning reviewer. Analyze only the supplied
+transcript digest and approved-lesson index. You cannot act on the world. Call propose_lesson once
+with zero to five proposals, then stop.
+
+If propose_lesson rejects malformed output, correct the schema exactly once. If that repair is also
+rejected, stop; the review will fail.
+
+Classify before proposing:
+1. Stable human preference or biography belongs to USER.md: do not propose it.
+2. Agent-specific verified behavior or strategy is private.
+3. Reusable verified Team project knowledge, decisions, or procedures are shared.
+4. Everything else produces no proposal.
+
+Zero proposals is a successful result. Never save transient or environment-dependent failures,
+unresolved attempts, guesses, contradicted claims, one-off narratives, status updates, secrets,
+credentials, sensitive personal data, raw logs, copied text, or duplicates. Each proposal must cite
+at least one supplied evidence entry and one observation may appear in only one proposal.`;
 //# sourceMappingURL=worker.js.map