create-principles-disciple 1.146.6 → 1.146.7

package/core/dist/runtime-v2/evidence-triage/admission-events.js

@@ -1,159 +0,0 @@
-/**
- * Admission Events — PEAT-B2
- *
- * Structured event types for the pain evidence admission pipeline.
- * These events make admission decisions observable without exposing raw data.
- *
- * Privacy boundary: events MUST NOT contain raw prompt, raw chat, raw trajectory,
- * full local paths, file contents, env vars, tokens, or API keys.
- *
- * ERR checklist:
- * - ERR-002: Every event has reason + nextAction.
- * - ERR-009: Malformed input events include validation error details.
- */
-// ── Event Factory Functions ─────────────────────────────────────────────────
-let eventCounter = 0;
-function nextEventId() {
-    return `adm_${Date.now()}_${++eventCounter}`;
-}
-/**
- * Create an AdmissionDecisionEvent from a TriggerDecision.
- *
- * This is the canonical way to produce an admission event.
- * The event contains no raw sensitive data — only structured metadata.
- */
-export function createAdmissionDecisionEvent(decision, options) {
-    return {
-        eventType: 'admission_decision',
-        eventId: nextEventId(),
-        timestamp: decision.decidedAt,
-        sourceKind: decision.sourceKind,
-        workspaceRef: options.workspaceRef,
-        sessionId: options.sessionId,
-        triageDecision: decision.triageDecision,
-        triggerOutcome: decision.outcome,
-        reason: decision.reason,
-        nextAction: decision.nextAction,
-        shouldCreateDiagnosticTask: decision.shouldCreateDiagnosticTask,
-    };
-}
-/**
- * Create a DiagnosisTaskCreatedEvent.
- */
-export function createDiagnosisTaskCreatedEvent(opts) {
-    return {
-        eventType: 'diagnosis_task_created',
-        eventId: nextEventId(),
-        timestamp: new Date().toISOString(),
-        sourceKind: opts.decision.sourceKind,
-        workspaceRef: opts.workspaceRef,
-        sessionId: opts.sessionId,
-        painId: opts.painId,
-        taskId: opts.taskId,
-        triggerOutcome: opts.decision.outcome,
-    };
-}
-/**
- * Create an EvidenceOnlyRecordedEvent.
- */
-export function createEvidenceOnlyRecordedEvent(decision, options) {
-    return {
-        eventType: 'evidence_only_recorded',
-        eventId: nextEventId(),
-        timestamp: decision.decidedAt,
-        sourceKind: decision.sourceKind,
-        workspaceRef: options.workspaceRef,
-        sessionId: options.sessionId,
-        triageDecision: decision.triageDecision,
-        reason: decision.reason,
-        nextAction: decision.nextAction,
-    };
-}
-/**
- * Create a SkippedRefusedEvent.
- */
-export function createSkippedRefusedEvent(decision, options) {
-    return {
-        eventType: 'skipped_refused',
-        eventId: nextEventId(),
-        timestamp: decision.decidedAt,
-        sourceKind: decision.sourceKind,
-        workspaceRef: options.workspaceRef,
-        sessionId: options.sessionId,
-        triggerOutcome: decision.outcome,
-        reason: decision.reason,
-        nextAction: decision.nextAction,
-    };
-}
-// ── Event Serialization ─────────────────────────────────────────────────────
-/**
- * Serialize an admission event to a JSONL-safe string.
- *
- * Privacy boundary: only structured fields are included.
- * No raw prompt/chat/trajectory/file content/token/path secrets.
- */
-export function serializeAdmissionEvent(event) {
-    // Explicit field selection prevents accidental raw data leakage
-    const safe = {
-        eventType: event.eventType,
-        eventId: event.eventId,
-        timestamp: event.timestamp,
-        sourceKind: event.sourceKind,
-        workspaceRef: event.workspaceRef,
-        sessionId: event.sessionId,
-    };
-    if (event.eventType === 'admission_decision') {
-        safe.triageDecision = event.triageDecision;
-        safe.triggerOutcome = event.triggerOutcome;
-        safe.reason = event.reason;
-        safe.nextAction = event.nextAction;
-        safe.shouldCreateDiagnosticTask = event.shouldCreateDiagnosticTask;
-    }
-    else if (event.eventType === 'diagnosis_task_created') {
-        safe.painId = event.painId;
-        safe.taskId = event.taskId;
-        safe.triggerOutcome = event.triggerOutcome;
-    }
-    else if (event.eventType === 'evidence_only_recorded') {
-        safe.triageDecision = event.triageDecision;
-        safe.reason = event.reason;
-        safe.nextAction = event.nextAction;
-    }
-    else if (event.eventType === 'skipped_refused') {
-        safe.triggerOutcome = event.triggerOutcome;
-        safe.reason = event.reason;
-        safe.nextAction = event.nextAction;
-    }
-    return JSON.stringify(safe);
-}
-// ── Validation ──────────────────────────────────────────────────────────────
-/**
- * Validate that an admission event does not contain raw sensitive data.
- *
- * Returns true if the event passes privacy checks.
- * This is a defense-in-depth check for tests and auditing.
- */
-export function validateEventPrivacy(event) {
-    const violations = [];
-    const serialized = JSON.stringify(event);
-    // Check for common sensitive patterns
-    if (/sk-[a-zA-Z0-9]{20,}/.test(serialized)) {
-        violations.push('potential_api_key_detected');
-    }
-    // Check for absolute paths in JSON-serialized form.
-    // JSON.stringify('C:\\Users\\admin') produces "C:\\\\Users\\\\admin" in the JSON string.
-    // At runtime, serialized.includes('Users\\') checks for Users followed by one backslash.
-    const hasWindowsPath = serialized.includes('Users\\') ||
-        /[A-Z]:\\[Uu]sers/.test(serialized);
-    if (hasWindowsPath) {
-        violations.push('absolute_windows_path_detected');
-    }
-    if (/\/home\/[a-z]/.test(serialized)) {
-        violations.push('absolute_unix_path_detected');
-    }
-    if (/"prompt"\s*:\s*"/.test(serialized) && serialized.length > 2000) {
-        violations.push('potential_raw_prompt_in_event');
-    }
-    return { valid: violations.length === 0, violations };
-}
-//# sourceMappingURL=admission-events.js.map

package/core/dist/runtime-v2/evidence-triage/admission-events.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"admission-events.js","sourceRoot":"","sources":["../../../src/runtime-v2/evidence-triage/admission-events.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AA2EH,+EAA+E;AAE/E,IAAI,YAAY,GAAG,CAAC,CAAC;AAErB,SAAS,WAAW;IAClB,OAAO,OAAO,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,4BAA4B,CAC1C,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,oBAAoB;QAC/B,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,0BAA0B,EAAE,QAAQ,CAAC,0BAA0B;KAChE,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,IAMC;IAED,OAAO;QACL,SAAS,EAAE,wBAAwB;QACnC,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,UAAU,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU;QACpC,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,MAAM,EAAE,IAAI,CAAC,MAAM;QACnB,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,OAAO;KACtC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,wBAAwB;QACnC,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,cAAc;QACvC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,yBAAyB,CACvC,QAAyB,EACzB,OAGC;IAED,OAAO;QACL,SAAS,EAAE,iBAAiB;QAC5B,OAAO,EAAE,WAAW,EAAE;QACtB,SAAS,EAAE,QAAQ,CAAC,SAAS;QAC7B,UAAU,EAAE,QAAQ,CAAC,UAAU;QAC/B,YAAY,EAAE,OAAO,CAAC,YAAY;QAClC,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,cAAc,EAAE,QAAQ,CAAC,OAAO;QAChC,MAAM,EAAE,QAAQ,CAAC,MAAM;QACvB,UAAU,EAAE,QAAQ,CAAC,UAAU;KAChC,CAAC;AACJ,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,KAAqB;IAC3D,gEAAgE;IAChE,MAAM,IAAI,GAA4B;QACpC,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,YAAY,EAAE,KAAK,CAAC,YAAY;QAChC,SAAS,EAAE,KAAK,CAAC,SAAS;KAC3B,CAAC;IAEF,IAAI,KAAK,CAAC,SAAS,KAAK,oBAAoB,EAAE,CAAC;QAC7C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;QACnC,IAAI,CAAC,0BAA0B,GAAG,KAAK,CAAC,0BAA0B,CAAC;IACrE,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;QACxD,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;IAC7C,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,wBAAwB,EAAE,CAAC;QACxD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;SAAM,IAAI,KAAK,CAAC,SAAS,KAAK,iBAAiB,EAAE,CAAC;QACjD,IAAI,CAAC,cAAc,GAAG,KAAK,CAAC,cAAc,CAAC;QAC3C,IAAI,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC3B,IAAI,CAAC,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;IACrC,CAAC;IAED,OAAO,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAE/E;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAAC,KAAqB;IACxD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAEzC,sCAAsC;IACtC,IAAI,qBAAqB,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QAC3C,UAAU,CAAC,IAAI,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,oDAAoD;IACpD,yFAAyF;IACzF,yFAAyF;IACzF,MAAM,cAAc,GAAG,UAAU,CAAC,QAAQ,CAAC,SAAS,CAAC;QACnD,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACtC,IAAI,cAAc,EAAE,CAAC;QACnB,UAAU,CAAC,IAAI,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,eAAe,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC;QACrC,UAAU,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,IAAI,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,UAAU,CAAC,MAAM,GAAG,IAAI,EAAE,CAAC;QACpE,UAAU,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;IACnD,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,UAAU,EAAE,CAAC;AACxD,CAAC"}

package/plugin/dist/core/detection-funnel.d.ts

@@ -1,47 +0,0 @@
-/**
- * Detection Funnel — PRI-446 thin adapter
- *
- * The pure three-layer funnel logic (LRU cache, async queue, layer dispatch)
- * now lives in principles-core
- * (runtime-v2/detection/detection-funnel-policy.ts). This file is a thin shell
- * that wires DetectionFunnelCore with the two environment-coupled dependencies
- * the plugin owns:
- *   - crypto.createHash (the L2 cache key hasher)
- *   - PainDictionary.match (the L1 exact matcher)
- *   - shouldIgnorePainProtocolText (the protocol-token gate)
- *
- * It re-exports DetectionFunnel (same class name + constructor signature) and
- * DetectionResult so DetectionService and llm.ts keep working
- * unchanged.
- *
- * ERR checklist:
- * - ERR-011: this is a thin adapter delegating to core pure logic.
- */
-import { type PainDictionary } from './dictionary.js';
-import { type DetectionResult } from '@principles/core/runtime-v2';
-export type { DetectionResult };
-/**
- * Orchestrates the three-layer detection funnel for pain signals.
- *
- * Delegates to the core DetectionFunnelCore, injecting the crypto hasher,
- * the dictionary matcher, and the protocol-token gate.
- */
-export declare class DetectionFunnel {
-    private readonly core;
-    constructor(dictionary: PainDictionary);
-    /**
-     * Detects pain in the given text using L1 (Exact), L2 (Cache), and L3 (Async).
-     */
-    detect(text: string): DetectionResult;
-    /**
-     * Internal method for the worker to update the cache after a semantic hit.
-     */
-    updateCache(text: string, result: {
-        detected: boolean;
-        severity?: number;
-    }): void;
-    /**
-     * Retrieves and clears the current asynchronous queue.
-     */
-    flushQueue(): string[];
-}

package/plugin/dist/core/detection-service.d.ts

@@ -1,15 +0,0 @@
-import { DetectionFunnel } from './detection-funnel.js';
-/**
- * Singleton service to manage the Semantic Detection Funnel.
- */
-export declare const DetectionService: {
-    /**
-     * Gets or initializes the Detection Funnel instance.
-     * @param stateDir The directory used to initialize the dictionary.
-     */
-    get(stateDir: string): DetectionFunnel;
-    /**
-     * Resets the singleton instance (primarily for testing).
-     */
-    reset(): void;
-};