brainclaw 0.29.2 → 1.5.3

package/dist/core/search.js

@@ -1,5 +1,6 @@
 import { loadState } from './state.js';
 import { listCandidates } from './candidates.js';
+import { listSequences } from './sequence.js';
 const K1 = 1.5;
 const B = 0.75;
 function tokenize(text) {
@@ -9,7 +10,7 @@ function tokenize(text) {
         .split(/\s+/)
         .filter(t => t.length > 1);
 }
-function buildCorpus(state, includePending) {
+function buildCorpus(state, includePending, cwd) {
     const docs = [];
     const add = (section, item) => {
         const textParts = [item.text, item.author ?? '', ...(item.tags ?? []), ...(item.related_paths ?? [])];
@@ -25,6 +26,24 @@ function buildCorpus(state, includePending) {
         add('handoffs', { ...h, text: `${h.from} -> ${h.to}: ${h.text}` });
     for (const p of state.plan_items)
         add('plans', p);
+    // Index sequences: combine name, description, item labels/lanes into searchable text
+    try {
+        const sequences = listSequences(cwd);
+        for (const seq of sequences) {
+            const itemTexts = (seq.items ?? []).map((it) => [it.lane, it.scope_hint, it.label, it.rationale].filter(Boolean).join(' '));
+            const text = [seq.name, seq.description ?? '', ...itemTexts].join(' — ');
+            add('sequences', {
+                id: seq.id,
+                text,
+                author: seq.author,
+                created_at: seq.created_at,
+                tags: seq.tags ?? [],
+            });
+        }
+    }
+    catch {
+        // Sequences dir may not exist yet — non-fatal
+    }
     if (includePending) {
         const candidates = listCandidates('pending');
         for (const c of candidates)
@@ -109,7 +128,7 @@ export function searchCorpus(documents, options) {
 }
 export function search(options) {
     const state = loadState(options.cwd);
-    const corpus = buildCorpus(state, options.includePending ?? false);
+    const corpus = buildCorpus(state, options.includePending ?? false, options.cwd);
     return searchCorpus(corpus, options);
 }
 //# sourceMappingURL=search.js.map

package/dist/core/security-cache.js

@@ -0,0 +1,71 @@
+import fs from 'node:fs';
+import path from 'node:path';
+function cacheKey(ecosystem, depname, version) {
+    return `${ecosystem}/${depname}@${version}`;
+}
+function loadStore(cachePath) {
+    try {
+        const raw = fs.readFileSync(cachePath, 'utf-8');
+        const parsed = JSON.parse(raw);
+        if (parsed?.version === 1 && typeof parsed.entries === 'object') {
+            return parsed;
+        }
+    }
+    catch {
+        // file missing or corrupt — start fresh
+    }
+    return { version: 1, entries: {} };
+}
+function saveStore(cachePath, store) {
+    const dir = path.dirname(cachePath);
+    if (!fs.existsSync(dir))
+        fs.mkdirSync(dir, { recursive: true });
+    fs.writeFileSync(cachePath, JSON.stringify(store, null, 2), 'utf-8');
+}
+export class SecurityCache {
+    store;
+    cachePath;
+    ttlMs;
+    constructor(cachePath, ttlHours = 24) {
+        this.cachePath = cachePath;
+        this.ttlMs = ttlHours * 60 * 60 * 1000;
+        this.store = loadStore(cachePath);
+    }
+    get(ecosystem, depname, version) {
+        const key = cacheKey(ecosystem, depname, version);
+        const entry = this.store.entries[key];
+        if (!entry)
+            return null;
+        const age = Date.now() - new Date(entry.fetched_at).getTime();
+        if (age > this.ttlMs) {
+            delete this.store.entries[key];
+            return null;
+        }
+        return entry.scores;
+    }
+    set(ecosystem, depname, version, scores) {
+        const key = cacheKey(ecosystem, depname, version);
+        this.store.entries[key] = {
+            scores,
+            fetched_at: new Date().toISOString(),
+        };
+    }
+    flush() {
+        saveStore(this.cachePath, this.store);
+    }
+    prune() {
+        const now = Date.now();
+        let pruned = 0;
+        for (const [key, entry] of Object.entries(this.store.entries)) {
+            if (now - new Date(entry.fetched_at).getTime() > this.ttlMs) {
+                delete this.store.entries[key];
+                pruned++;
+            }
+        }
+        return pruned;
+    }
+    size() {
+        return Object.keys(this.store.entries).length;
+    }
+}
+//# sourceMappingURL=security-cache.js.map

package/dist/core/security-guard.js

@@ -0,0 +1,152 @@
+/**
+ * Generates brainclaw-guard wrapper scripts (bash + PowerShell) that intercept
+ * npm/pip install commands and check packages via brainclaw check-security.
+ */
+export function generateBashGuard(brainclawBin) {
+    return `#!/usr/bin/env bash
+# brainclaw-guard — preinstall security gate
+# Generated by: brainclaw setup --security
+# Do not edit manually — regenerate with brainclaw setup --security
+
+BRAINCLAW_BIN="${brainclawBin}"
+ORIGINAL_CMD="\${BRAINCLAW_GUARD_ORIGINAL_CMD:-npm}"
+
+is_install_command() {
+  for arg in "$@"; do
+    case "$arg" in
+      install|add|i) return 0 ;;
+      -*)            continue  ;;
+      *)             break     ;;
+    esac
+  done
+  return 1
+}
+
+extract_packages() {
+  local packages=""
+  local skip_next=false
+  local past_command=false
+  for arg in "$@"; do
+    if [ "$skip_next" = true ]; then
+      skip_next=false
+      continue
+    fi
+    case "$arg" in
+      install|add|i)
+        past_command=true
+        continue
+        ;;
+      --save-dev|--save-peer|--save-optional|-D|-P|-O|-g|--global)
+        continue
+        ;;
+      --registry|--prefix)
+        skip_next=true
+        continue
+        ;;
+      -*)
+        continue
+        ;;
+      *)
+        if [ "$past_command" = true ]; then
+          if [ -n "$packages" ]; then
+            packages="$packages,$arg"
+          else
+            packages="$arg"
+          fi
+        fi
+        ;;
+    esac
+  done
+  echo "$packages"
+}
+
+# Main logic
+if is_install_command "$@"; then
+  packages=$(extract_packages "$@")
+  if [ -n "$packages" ]; then
+    ecosystem="npm"
+    if [ "$ORIGINAL_CMD" = "pip" ] || [ "$ORIGINAL_CMD" = "pip3" ]; then
+      ecosystem="pypi"
+    fi
+
+    result=$("$BRAINCLAW_BIN" check-security --packages "$packages" --ecosystem "$ecosystem" --json 2>/dev/null)
+    exit_code=$?
+
+    if [ $exit_code -eq 2 ]; then
+      echo "[brainclaw-guard] BLOCKED — supply chain risk detected" >&2
+      echo "[brainclaw-guard] Run: brainclaw check-security --packages \\"$packages\\" for details" >&2
+      exit 1
+    elif [ $exit_code -eq 1 ]; then
+      echo "[brainclaw-guard] WARNING — potential supply chain risk" >&2
+      echo "[brainclaw-guard] Run: brainclaw check-security --packages \\"$packages\\" for details" >&2
+    fi
+    # exit_code 0 = pass, continue silently
+  fi
+fi
+
+exec "$ORIGINAL_CMD" "$@"
+`;
+}
+export function generatePowerShellGuard(brainclawBin) {
+    return `# brainclaw-guard — preinstall security gate (PowerShell)
+# Generated by: brainclaw setup --security
+# Do not edit manually — regenerate with brainclaw setup --security
+
+param([Parameter(ValueFromRemainingArguments)]$Args)
+
+$BrainclawBin = "${brainclawBin}"
+$OriginalCmd = if ($env:BRAINCLAW_GUARD_ORIGINAL_CMD) { $env:BRAINCLAW_GUARD_ORIGINAL_CMD } else { "npm" }
+
+function Is-InstallCommand($arguments) {
+    foreach ($arg in $arguments) {
+        if ($arg -match "^(install|add|i)$") { return $true }
+        if ($arg -notmatch "^-") { break }
+    }
+    return $false
+}
+
+function Extract-Packages($arguments) {
+    $packages = @()
+    $pastCommand = $false
+    $skipNext = $false
+    foreach ($arg in $arguments) {
+        if ($skipNext) { $skipNext = $false; continue }
+        if ($arg -match "^(install|add|i)$") { $pastCommand = $true; continue }
+        if ($arg -match "^--(registry|prefix)$") { $skipNext = $true; continue }
+        if ($arg -match "^-") { continue }
+        if ($pastCommand) { $packages += $arg }
+    }
+    return ($packages -join ",")
+}
+
+if (Is-InstallCommand $Args) {
+    $packages = Extract-Packages $Args
+    if ($packages) {
+        $ecosystem = "npm"
+        if ($OriginalCmd -match "^pip") { $ecosystem = "pypi" }
+
+        try {
+            & $BrainclawBin check-security --packages $packages --ecosystem $ecosystem --json 2>$null | Out-Null
+            $exitCode = $LASTEXITCODE
+        } catch {
+            $exitCode = 0
+        }
+
+        if ($exitCode -eq 2) {
+            Write-Error "[brainclaw-guard] BLOCKED - supply chain risk detected"
+            Write-Error "[brainclaw-guard] Run: brainclaw check-security --packages \`"$packages\`" for details"
+            exit 1
+        } elseif ($exitCode -eq 1) {
+            Write-Warning "[brainclaw-guard] WARNING - potential supply chain risk"
+            Write-Warning "[brainclaw-guard] Run: brainclaw check-security --packages \`"$packages\`" for details"
+        }
+    }
+}
+
+& $OriginalCmd @Args
+`;
+}
+export function generatePipBashGuard(brainclawBin) {
+    return generateBashGuard(brainclawBin).replace('ORIGINAL_CMD="${BRAINCLAW_GUARD_ORIGINAL_CMD:-npm}"', 'ORIGINAL_CMD="${BRAINCLAW_GUARD_ORIGINAL_CMD:-pip}"');
+}
+//# sourceMappingURL=security-guard.js.map

package/dist/core/security-scoring.js

@@ -0,0 +1,86 @@
+const DEFAULT_WEIGHTS = {
+    supply_chain: 0.35,
+    vulnerability: 0.30,
+    quality: 0.15,
+    maintenance: 0.15,
+    license: 0.05,
+};
+const DEFAULT_THRESHOLDS = {
+    composite_pass: 70,
+    composite_warn: 50,
+    supply_chain_block: 30,
+    vulnerability_block: 20,
+};
+export function computeComposite(scores, weights) {
+    const w = { ...DEFAULT_WEIGHTS, ...weights };
+    return Math.round((scores.supplyChain * w.supply_chain +
+        scores.vulnerability * w.vulnerability +
+        scores.quality * w.quality +
+        scores.maintenance * w.maintenance +
+        scores.license * w.license) * 10) / 10;
+}
+export function evaluatePackage(scores, config) {
+    const thresholds = { ...DEFAULT_THRESHOLDS, ...config?.thresholds };
+    const weights = { ...DEFAULT_WEIGHTS, ...config?.weights };
+    const allowlist = config?.allowlist ?? [];
+    const denylist = config?.denylist ?? [];
+    const pkgName = scores.purl.replace(/^pkg:\w+\//, '');
+    const ecosystem = scores.purl.startsWith('pkg:pypi') ? 'pypi' : 'npm';
+    const reasons = [];
+    // Denylist check (exact match on package name)
+    if (denylist.some(d => pkgName === d || scores.purl.includes(d))) {
+        return {
+            package: pkgName,
+            ecosystem,
+            version: scores.version,
+            scores,
+            composite: 0,
+            decision: 'block',
+            reasons: [`Package "${pkgName}" is on the denylist`],
+        };
+    }
+    // Allowlist check (skip scoring)
+    if (allowlist.some(a => pkgName === a || scores.purl.includes(a))) {
+        return {
+            package: pkgName,
+            ecosystem,
+            version: scores.version,
+            scores,
+            composite: 100,
+            decision: 'pass',
+            reasons: [`Package "${pkgName}" is on the allowlist`],
+        };
+    }
+    const composite = computeComposite(scores, weights);
+    // Hard blocks on individual scores
+    if (scores.supplyChain < thresholds.supply_chain_block) {
+        reasons.push(`supply_chain=${scores.supplyChain} < ${thresholds.supply_chain_block} (hard block)`);
+    }
+    if (scores.vulnerability < thresholds.vulnerability_block) {
+        reasons.push(`vulnerability=${scores.vulnerability} < ${thresholds.vulnerability_block} (hard block)`);
+    }
+    if (reasons.length > 0) {
+        return { package: pkgName, ecosystem, version: scores.version, scores, composite, decision: 'block', reasons };
+    }
+    // Composite-based decision
+    if (composite < thresholds.composite_warn) {
+        reasons.push(`composite=${composite} < ${thresholds.composite_warn} (block threshold)`);
+        return { package: pkgName, ecosystem, version: scores.version, scores, composite, decision: 'block', reasons };
+    }
+    if (composite < thresholds.composite_pass) {
+        reasons.push(`composite=${composite} < ${thresholds.composite_pass} (warn threshold)`);
+        return { package: pkgName, ecosystem, version: scores.version, scores, composite, decision: 'warn', reasons };
+    }
+    return { package: pkgName, ecosystem, version: scores.version, scores, composite, decision: 'pass', reasons: [] };
+}
+export function evaluateBatch(scoresList, config) {
+    return scoresList.map(s => evaluatePackage(s, config));
+}
+export function worstDecision(verdicts) {
+    if (verdicts.some(v => v.decision === 'block'))
+        return 'block';
+    if (verdicts.some(v => v.decision === 'warn'))
+        return 'warn';
+    return 'pass';
+}
+//# sourceMappingURL=security-scoring.js.map

package/dist/core/sequence.js

@@ -0,0 +1,130 @@
+import fs from 'node:fs';
+import { JsonStore } from './json-store.js';
+import { mutate } from './mutation-pipeline.js';
+import { generateIdWithLabel, nowISO } from './ids.js';
+import { resolveEntityDir } from './io.js';
+import { SequenceItemSchema, SequenceSchema } from './schema.js';
+import { refreshLiveCompanions } from '../commands/export.js';
+function sequencesDir(cwd, mode = 'read') {
+    return resolveEntityDir('sequences', cwd ?? process.cwd(), mode);
+}
+export function ensureSequencesDir(cwd) {
+    const dir = sequencesDir(cwd, 'write');
+    if (!fs.existsSync(dir)) {
+        fs.mkdirSync(dir, { recursive: true });
+    }
+}
+function sequenceStore(cwd, mode = 'read') {
+    return new JsonStore({
+        dirPath: sequencesDir(cwd, mode),
+        documentType: 'sequence',
+        getId: (sequence) => sequence.id,
+        sort: (a, b) => a.updated_at.localeCompare(b.updated_at),
+    });
+}
+function normalizeItems(items) {
+    return items
+        .map((item) => SequenceItemSchema.parse(item))
+        .sort((a, b) => a.rank - b.rank || a.planId.localeCompare(b.planId));
+}
+function validateRanks(items) {
+    const ranks = new Set();
+    for (const item of items) {
+        if (ranks.has(item.rank)) {
+            throw new Error(`Duplicate sequence rank: ${item.rank}`);
+        }
+        ranks.add(item.rank);
+    }
+}
+export function saveSequence(sequence, cwd) {
+    mutate({ cwd }, () => {
+        ensureSequencesDir(cwd);
+        sequenceStore(cwd, 'write').save(SequenceSchema.parse(sequence));
+        // Auto-refresh live companions after sequence changes (non-fatal)
+        try {
+            refreshLiveCompanions(cwd);
+        }
+        catch { /* best-effort */ }
+    });
+}
+export function listSequences(cwd) {
+    return sequenceStore(cwd).list().sort((a, b) => {
+        const activeBoost = Number(b.status === 'active') - Number(a.status === 'active');
+        if (activeBoost !== 0)
+            return activeBoost;
+        return b.updated_at.localeCompare(a.updated_at);
+    });
+}
+export function loadSequence(id, cwd) {
+    const sequence = listSequences(cwd).find((entry) => entry.id === id || entry.short_label === id);
+    if (!sequence) {
+        throw new Error(`Sequence not found: ${id}`);
+    }
+    return sequence;
+}
+export function getActiveSequence(cwd) {
+    return listSequences(cwd).find((sequence) => sequence.status === 'active');
+}
+export function createSequence(input, cwd) {
+    const items = normalizeItems(input.items ?? []);
+    validateRanks(items);
+    const { id, short_label } = generateIdWithLabel('sequences', cwd);
+    const timestamp = nowISO();
+    const sequence = {
+        id,
+        short_label,
+        name: input.name,
+        description: input.description,
+        status: input.status ?? 'draft',
+        items,
+        owner: input.owner,
+        created_at: timestamp,
+        updated_at: timestamp,
+        author: input.author,
+        author_id: input.authorId,
+        model: input.model,
+        project_id: input.projectId,
+        host_id: input.hostId,
+        session_id: input.sessionId,
+        tags: input.tags ?? [],
+    };
+    saveSequence(sequence, cwd);
+    return { id, shortLabel: short_label, name: input.name };
+}
+export function deleteSequence(id, cwd) {
+    return mutate({ cwd }, () => {
+        ensureSequencesDir(cwd);
+        const store = sequenceStore(cwd, 'write');
+        const current = store.list().find((entry) => entry.id === id || entry.short_label === id);
+        if (!current) {
+            throw new Error(`Sequence not found: ${id}`);
+        }
+        store.delete(current.id);
+        return { id: current.id, name: current.name };
+    });
+}
+export function updateSequence(input, cwd) {
+    return mutate({ cwd }, () => {
+        ensureSequencesDir(cwd);
+        const store = sequenceStore(cwd, 'write');
+        const current = store.list().find((entry) => entry.id === input.id || entry.short_label === input.id);
+        if (!current) {
+            throw new Error(`Sequence not found: ${input.id}`);
+        }
+        const items = input.items ? normalizeItems(input.items) : current.items;
+        validateRanks(items);
+        const next = {
+            ...current,
+            name: input.name ?? current.name,
+            description: input.description ?? current.description,
+            status: input.status ?? current.status,
+            items,
+            owner: input.owner ?? current.owner,
+            tags: input.tags ?? current.tags,
+            updated_at: nowISO(),
+        };
+        store.save(SequenceSchema.parse(next));
+        return next;
+    });
+}
+//# sourceMappingURL=sequence.js.map

package/dist/core/socket-client.js

@@ -0,0 +1,113 @@
+import https from 'node:https';
+const DEFAULT_ENDPOINT = 'https://mcp.socket.dev/';
+const DEFAULT_TIMEOUT = 15_000;
+const MCP_PROTOCOL_VERSION = '2024-11-05';
+function post(url, body, headers, timeoutMs) {
+    return new Promise((resolve, reject) => {
+        const parsed = new URL(url);
+        const req = https.request({
+            hostname: parsed.hostname,
+            port: parsed.port || 443,
+            path: parsed.pathname,
+            method: 'POST',
+            headers: { 'Content-Type': 'application/json', 'Content-Length': String(Buffer.byteLength(body)), ...headers },
+            timeout: timeoutMs,
+        }, res => {
+            let data = '';
+            res.on('data', (c) => data += c.toString());
+            res.on('end', () => {
+                const h = {};
+                for (const [k, v] of Object.entries(res.headers)) {
+                    if (typeof v === 'string')
+                        h[k] = v;
+                }
+                resolve({ status: res.statusCode ?? 0, headers: h, body: data });
+            });
+        });
+        req.on('timeout', () => { req.destroy(); reject(new Error('Socket MCP request timed out')); });
+        req.on('error', reject);
+        req.write(body);
+        req.end();
+    });
+}
+function parseScoresFromText(text) {
+    const results = [];
+    for (const line of text.split('\n')) {
+        if (!line.startsWith('pkg:'))
+            continue;
+        const match = line.match(/^(pkg:\w+\/[^@]+)@([^:]+):\s*(.+)/);
+        if (!match)
+            continue;
+        const [, purl, version, rest] = match;
+        const scores = {};
+        for (const pair of rest.split(',')) {
+            const [k, v] = pair.trim().split(':').map(s => s.trim());
+            if (k && v)
+                scores[k] = parseInt(v, 10);
+        }
+        results.push({
+            purl: purl,
+            version: version,
+            supplyChain: scores['supplyChain'] ?? 0,
+            vulnerability: scores['vulnerability'] ?? 0,
+            quality: scores['quality'] ?? 0,
+            maintenance: scores['maintenance'] ?? 0,
+            license: scores['license'] ?? 0,
+        });
+    }
+    return results;
+}
+export async function querySocketScores(packages, options = {}) {
+    const endpoint = options.endpoint ?? DEFAULT_ENDPOINT;
+    const timeout = options.timeoutMs ?? DEFAULT_TIMEOUT;
+    // Step 1: MCP initialize
+    const initBody = JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'initialize',
+        params: {
+            protocolVersion: MCP_PROTOCOL_VERSION,
+            capabilities: {},
+            clientInfo: { name: 'brainclaw-security', version: '1.0.0' },
+        },
+        id: 1,
+    });
+    const initRes = await post(endpoint, initBody, {}, timeout);
+    if (initRes.status !== 200) {
+        throw new Error(`Socket MCP initialize failed: HTTP ${initRes.status}`);
+    }
+    const sessionId = initRes.headers['mcp-session-id'];
+    if (!sessionId) {
+        throw new Error('Socket MCP did not return a session ID');
+    }
+    // Step 2: Send initialized notification
+    const notifBody = JSON.stringify({ jsonrpc: '2.0', method: 'notifications/initialized' });
+    await post(endpoint, notifBody, { 'mcp-session-id': sessionId }, timeout);
+    // Step 3: Call depscore
+    const callBody = JSON.stringify({
+        jsonrpc: '2.0',
+        method: 'tools/call',
+        params: {
+            name: 'depscore',
+            arguments: { packages },
+        },
+        id: 2,
+    });
+    const callRes = await post(endpoint, callBody, { 'mcp-session-id': sessionId }, timeout);
+    if (callRes.status !== 200) {
+        throw new Error(`Socket MCP depscore failed: HTTP ${callRes.status}`);
+    }
+    const parsed = JSON.parse(callRes.body);
+    if (parsed.error) {
+        throw new Error(`Socket MCP error: ${parsed.error.message ?? JSON.stringify(parsed.error)}`);
+    }
+    const content = parsed.result?.content;
+    if (!Array.isArray(content) || content.length === 0) {
+        throw new Error('Socket MCP returned empty content');
+    }
+    const text = content[0]?.text;
+    if (typeof text !== 'string') {
+        throw new Error('Socket MCP returned non-text content');
+    }
+    return parseScoresFromText(text);
+}
+//# sourceMappingURL=socket-client.js.map