codecartographer-pi 0.19.6 → 0.21.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (57) hide show
  1. package/.codecarto/GUIDE.md +2 -2
  2. package/.codecarto/broadside/SKILL.md +21 -3
  3. package/.codecarto/broadside/config.yaml +35 -9
  4. package/.codecarto/findings/contracts/SKILL.md +4 -1
  5. package/.codecarto/findings/defect-scan/SKILL.md +10 -0
  6. package/.codecarto/findings/defect-scan-mechanical/SKILL.md +6 -0
  7. package/.codecarto/findings/defect-scan-semantic/SKILL.md +8 -1
  8. package/.codecarto/findings/porting/SKILL.md +4 -0
  9. package/.codecarto/findings/protocols/SKILL.md +4 -0
  10. package/.codecarto/templates/mechanical-defects.md +15 -0
  11. package/.codecarto/templates/reimplementation-spec.md +5 -3
  12. package/.codecarto/templates/reverse-engineering-bundle.md +10 -1
  13. package/.codecarto/templates/semantic-defects.md +15 -0
  14. package/.codecarto/workflow/VALIDATE.md +3 -2
  15. package/.codecarto/workflow/scaffold-version.yaml +1 -1
  16. package/README.md +13 -9
  17. package/dist/core/amendment.js +9 -4
  18. package/dist/core/broadside.d.ts +121 -2
  19. package/dist/core/broadside.js +478 -92
  20. package/dist/core/completion.js +88 -23
  21. package/dist/core/dashboard-writer.d.ts +8 -0
  22. package/dist/core/dashboard-writer.js +159 -0
  23. package/dist/core/index.d.ts +2 -0
  24. package/dist/core/index.js +2 -0
  25. package/dist/core/library.js +9 -4
  26. package/dist/core/orchestrator-config.d.ts +32 -7
  27. package/dist/core/orchestrator-config.js +124 -44
  28. package/dist/core/pipeline.d.ts +73 -0
  29. package/dist/core/pipeline.js +134 -10
  30. package/dist/core/prompts.d.ts +20 -0
  31. package/dist/core/prompts.js +53 -13
  32. package/dist/core/secrets.d.ts +16 -0
  33. package/dist/core/secrets.js +98 -0
  34. package/dist/core/status.d.ts +16 -0
  35. package/dist/core/status.js +47 -20
  36. package/dist/core/synthesis.js +5 -2
  37. package/dist/core/utils.d.ts +7 -0
  38. package/dist/core/utils.js +7 -0
  39. package/dist/core/workspace.d.ts +55 -8
  40. package/dist/core/workspace.js +116 -8
  41. package/dist/core/yaml.js +181 -15
  42. package/dist/extensions/codecarto/agent-rewriter.js +21 -14
  43. package/dist/extensions/codecarto/agent-runner.d.ts +6 -2
  44. package/dist/extensions/codecarto/agent-runner.js +27 -9
  45. package/dist/extensions/codecarto/agent-state.d.ts +0 -2
  46. package/dist/extensions/codecarto/auto-runner.d.ts +1 -1
  47. package/dist/extensions/codecarto/auto-runner.js +27 -8
  48. package/dist/extensions/codecarto/broadside-flags.d.ts +3 -1
  49. package/dist/extensions/codecarto/broadside-flags.js +12 -0
  50. package/dist/extensions/codecarto/dashboard-narrator.js +9 -2
  51. package/dist/extensions/codecarto/dashboard-writer.d.ts +1 -8
  52. package/dist/extensions/codecarto/dashboard-writer.js +5 -154
  53. package/dist/extensions/codecarto/index.js +158 -47
  54. package/dist/extensions/codecarto/phase-compaction.js +5 -1
  55. package/dist/mcp-server/server.d.ts +3 -1
  56. package/dist/mcp-server/server.js +205 -77
  57. package/package.json +3 -2
@@ -16,6 +16,16 @@ export declare const BROADSIDE_LENS_IDS: readonly ["architecture", "api", "secur
16
16
  export type BroadsideLensId = (typeof BROADSIDE_LENS_IDS)[number];
17
17
  export declare const BROADSIDE_POLL_INTERVAL_MS = 15000;
18
18
  export declare const BROADSIDE_DEFAULT_POLL_BUDGET_MS: number;
19
+ /**
20
+ * The run expense limit in USD a repository gets before it configures one.
21
+ * Pi asks a human before submitting over the estimate; the MCP surface cannot,
22
+ * and shipped with no limit at all, so a host calling submit with the stock
23
+ * config spent whatever the estimate came to (#231). One dollar covers a
24
+ * six-lens run of a repository this size with room to spare; a larger one
25
+ * raises `max_cost` in config.yaml, passes `max_cost` on the call, or sets it
26
+ * to 0 for no limit.
27
+ */
28
+ export declare const BROADSIDE_DEFAULT_MAX_COST = 1;
19
29
  export type ModelPricing = {
20
30
  /** USD per million input tokens. */
21
31
  inputPerM: number;
@@ -63,6 +73,14 @@ export type JsonSchemaDef = {
63
73
  strict: boolean;
64
74
  schema: Record<string, unknown>;
65
75
  };
76
+ /**
77
+ * Where the file list and the file contents both came from — one source, so
78
+ * a run's results correspond to one state of the repository (#248).
79
+ * `working-tree`: git's view of the checkout (tracked plus untracked files,
80
+ * ignore rules applied, files deleted on disk left out); `walk`: a bounded
81
+ * directory walk, for a target that is not a git repository.
82
+ */
83
+ export type RepoSnapshotSource = "working-tree" | "walk";
66
84
  export type RepoInfo = {
67
85
  name: string;
68
86
  path: string;
@@ -77,6 +95,13 @@ export type RepoInfo = {
77
95
  fileCounts: Record<string, number>;
78
96
  sourceGlob: string;
79
97
  sourceExts: string[];
98
+ /** How many slurpable files carry one of `sourceExts`; zero means no lens has code to scan. */
99
+ sourceFileCount: number;
100
+ snapshot: RepoSnapshotSource;
101
+ /** Files left out of every lens because their name says they hold secrets (#252). */
102
+ secretFilesSkipped: string[];
103
+ /** Secret-like values redacted from the entry point, manifest, and README excerpt. */
104
+ redactedValues: number;
80
105
  };
81
106
  export type FileSlice = {
82
107
  moduleName: string;
@@ -85,6 +110,10 @@ export type FileSlice = {
85
110
  chars: number;
86
111
  /** Repo-relative paths of the files folded into this slice. */
87
112
  files: string[];
113
+ /** Secret-like values redacted from this slice's files before upload (#252). */
114
+ redactedValues?: number;
115
+ /** The files in this slice that had at least one value redacted. */
116
+ redactedFiles?: string[];
88
117
  };
89
118
  /**
90
119
  * OpenRouter's unified `reasoning` control, as sent on a lens request.
@@ -202,6 +231,17 @@ export type BroadsideRun = {
202
231
  sourceDirty?: boolean;
203
232
  /** When incremental, the previous run's HEAD this run diffs against. */
204
233
  baseHead?: string | null;
234
+ /** Where the scanned files and their contents were read from (#248). */
235
+ snapshot?: RepoSnapshotSource;
236
+ /** The language the lenses scanned as. */
237
+ language?: string;
238
+ /** What the secret-redaction pass did before upload (#252); absent on runs from before it. */
239
+ redaction?: {
240
+ enabled: boolean;
241
+ values: number;
242
+ files: number;
243
+ skippedFiles: number;
244
+ };
205
245
  };
206
246
  export type BroadsideStateFile = {
207
247
  schema_version: number;
@@ -240,6 +280,13 @@ export type BroadsideConfig = {
240
280
  includeTriage: boolean;
241
281
  /** Default poll budget in seconds; 0 means "return immediately". */
242
282
  waitSeconds: number;
283
+ /**
284
+ * Replace secret-like values with `[REDACTED:<kind>]` and skip files named
285
+ * like credential stores before anything is uploaded (#252). On by default;
286
+ * off only for a repository whose maintainers have decided its contents may
287
+ * leave as they are.
288
+ */
289
+ redactSecrets: boolean;
243
290
  };
244
291
  /**
245
292
  * The pre-flight facts a caller needs to decide whether a run is worth its
@@ -276,6 +323,38 @@ export type BroadsideEstimate = {
276
323
  /** The provider's completion ceiling, when the catalog advertises one. */
277
324
  outputCap?: number;
278
325
  };
326
+ /**
327
+ * OpenRouter rejected the API key (HTTP 401/403). Thrown from the catalog
328
+ * lookup rather than swallowed into "could not price" or a silent built-in
329
+ * fallback: a run that cannot authenticate cannot submit either, and the
330
+ * message that reaches the user has to say so (#251).
331
+ */
332
+ export declare class BroadsideAuthError extends Error {
333
+ readonly httpStatus: number;
334
+ readonly detail: string;
335
+ constructor(httpStatus: number, detail: string);
336
+ }
337
+ /**
338
+ * `broadside/config.yaml` exists but cannot be used. A file that failed to
339
+ * parse used to be treated exactly like an absent one — defaults, including
340
+ * no spend cap and no lens routing, with no message — so a typo removed the
341
+ * user's own guard (#232). Only an absent file yields defaults now.
342
+ */
343
+ export declare class BroadsideConfigError extends Error {
344
+ readonly path: string;
345
+ constructor(path: string, detail: string);
346
+ }
347
+ /**
348
+ * `broadside/state.json` exists but cannot be read. It used to be read as
349
+ * empty and the next checkpoint wrote that empty state over it, losing the
350
+ * batch ids of every in-flight, already-paid run (#233). The corrupt file is
351
+ * preserved beside itself and nothing writes over it until someone looks.
352
+ */
353
+ export declare class BroadsideStateError extends Error {
354
+ readonly path: string;
355
+ readonly backupPath: string;
356
+ constructor(path: string, backupPath: string, detail: string);
357
+ }
279
358
  /** Thrown when a confirm hook declines a run. Nothing was submitted. */
280
359
  export declare class BroadsideCancelledError extends Error {
281
360
  constructor(message?: string);
@@ -312,6 +391,21 @@ export type BroadsideSubmitResult = {
312
391
  expirationDate?: string | null;
313
392
  };
314
393
  incremental: BroadsideIncrementalOutcome;
394
+ /** What was scanned: the language the lenses ran as and the snapshot the files came from. */
395
+ repo: {
396
+ language: string;
397
+ sourceFiles: number;
398
+ snapshot: RepoSnapshotSource;
399
+ sourceHead: string | null;
400
+ sourceDirty: boolean;
401
+ };
402
+ /** What the secret-redaction pass did before upload (#252). */
403
+ redaction: {
404
+ enabled: boolean;
405
+ values: number;
406
+ files: number;
407
+ skippedFiles: string[];
408
+ };
315
409
  };
316
410
  export type BroadsideCollectResult = {
317
411
  runId: string;
@@ -328,6 +422,7 @@ export type BroadsideCollectResult = {
328
422
  cost?: number;
329
423
  resultCount?: number;
330
424
  truncated?: number;
425
+ error?: string;
331
426
  }>>;
332
427
  synthesis: BroadsideSynthesisEntry;
333
428
  triage: BroadsideTriageEntry;
@@ -355,8 +450,14 @@ type LensDefinition = {
355
450
  };
356
451
  export declare function getLens(lensId: BroadsideLensId): LensDefinition;
357
452
  export declare function listLenses(): LensDefinition[];
358
- export declare function collectRepoInfo(targetDir: string): Promise<RepoInfo>;
359
- export declare function gatherSlices(targetDir: string, lens: LensDefinition, info: RepoInfo): Promise<FileSlice[]>;
453
+ /** The languages Broad-Side can scan; anything else is refused at submit. */
454
+ export declare const BROADSIDE_LANGUAGES: readonly ["go", "python", "rust", "typescript", "javascript"];
455
+ export declare function collectRepoInfo(targetDir: string, opts?: {
456
+ redact?: boolean;
457
+ }): Promise<RepoInfo>;
458
+ export declare function gatherSlices(targetDir: string, lens: LensDefinition, info: RepoInfo, opts?: {
459
+ redact?: boolean;
460
+ }): Promise<FileSlice[]>;
360
461
  export declare function buildBatchRequest(lens: LensDefinition, info: RepoInfo, slice: FileSlice, index: number, sliceCount: number, model?: string, maxTokensOverride?: number, reasoningOverride?: BroadsideReasoning): BatchRequest;
361
462
  /**
362
463
  * Pre-flight cost estimate for one lens.
@@ -434,6 +535,10 @@ export declare function updateBroadsideStateAtomically(broadsideDir: string, mut
434
535
  */
435
536
  export declare function persistBroadsideRun(broadsideDir: string, run: BroadsideRun): Promise<BroadsideStateFile>;
436
537
  export declare function loadBroadsideConfig(broadsideDir: string): Promise<BroadsideConfig>;
538
+ /** The shipped defaults: what an absent config.yaml means. */
539
+ export declare function defaultBroadsideConfig(): BroadsideConfig;
540
+ /** The catalog cache schema this build writes; a file from another is not read. */
541
+ export declare const BROADSIDE_CATALOG_CACHE_SCHEMA = 3;
437
542
  export declare function builtInCatalogEntry(model: string): CatalogEntry | null;
438
543
  export declare function builtInPricing(model: string): ModelPricing | null;
439
544
  export declare function resolveCatalogEntry(broadsideDir: string, config: BroadsideConfig, model: string, apiKey: string, fetcher?: FetchLike): Promise<BroadsideCatalogResult>;
@@ -463,6 +568,14 @@ export declare function fetchBatch(batchId: string, apiKey: string, fetcher?: Fe
463
568
  * charged, so callers must come back for it rather than retire it.
464
569
  */
465
570
  export declare const BROADSIDE_DEAD_BATCH_STATUSES: string[];
571
+ /**
572
+ * Batch entry statuses collect never polls again: the dead ones above, plus
573
+ * `completed`, plus the two a submit assigns without a batch (`skipped`: no
574
+ * matching files; `rejected`: the provider refused it). The 0.19.1 changelog
575
+ * called the dead set "a named constant rather than two hand-maintained
576
+ * lists"; this set was still three literal copies (self-audit sem 5.8).
577
+ */
578
+ export declare const BROADSIDE_TERMINAL_ENTRY_STATUSES: string[];
466
579
  export declare function pollBatchUntilTerminal(batchId: string, apiKey: string, opts?: {
467
580
  deadlineMs?: number;
468
581
  onStatus?: (status: string, counts: Record<string, unknown>) => void;
@@ -545,6 +658,12 @@ export declare function runBroadsideCollect(cwd: string, apiKey: string, opts?:
545
658
  retryTruncated?: boolean;
546
659
  onStatus?: (lensId: string, status: string, counts: Record<string, unknown>) => void;
547
660
  fetcher?: FetchLike;
661
+ /**
662
+ * Which run to collect. Absent, the most recent — which used to be the
663
+ * only choice, so an older run still in flight could not be collected
664
+ * once a newer submit existed (#268). `status` lists the ids.
665
+ */
666
+ runId?: string;
548
667
  }): Promise<BroadsideCollectResult>;
549
668
  export declare function runBroadsideStatus(cwd: string): Promise<{
550
669
  state: BroadsideStateFile;