dual-brain 0.2.30 → 0.3.1

package/src/recommendations.mjs

@@ -1,296 +0,0 @@
-// recommendations.mjs — Proactive settings recommendations from HEAD
-import { readFileSync, existsSync, readdirSync } from 'node:fs';
-import { join } from 'node:path';
-
-function readJSON(path) {
-  try {
-    return existsSync(path) ? JSON.parse(readFileSync(path, 'utf8')) : null;
-  } catch { return null; }
-}
-
-function dbPath(cwd, ...parts) {
-  return join(cwd || process.cwd(), '.dualbrain', ...parts);
-}
-
-// ─── Signal loaders ───────────────────────────────────────────────────────────
-
-function loadRoutingState(cwd) { return readJSON(dbPath(cwd, 'routing-state.json')) || {}; }
-function loadThinkMetrics(cwd) { return readJSON(dbPath(cwd, 'think-metrics.json')) || {}; }
-function loadGovernance(cwd)   { return readJSON(dbPath(cwd, 'governance-state.json')) || {}; }
-function loadSubscription(cwd) { return readJSON(dbPath(cwd, 'subscription.json')) || {}; }
-
-function loadOutcomes(cwd) {
-  try {
-    const dir = dbPath(cwd, 'outcomes');
-    if (!existsSync(dir)) return [];
-    return readdirSync(dir)
-      .filter(f => f.endsWith('.json'))
-      .map(f => readJSON(join(dir, f)))
-      .filter(Boolean);
-  } catch { return []; }
-}
-
-// ─── Recommendation rules ─────────────────────────────────────────────────────
-
-function thinkROI(metrics) {
-  const { hitRate, totalHits, totalMisses, avgTokensSaved } = metrics;
-  if (hitRate == null) return null;
-  const observations = (totalHits || 0) + (totalMisses || 0);
-  if (observations < 5) return null;
-
-  if (hitRate < 0.4) {
-    return {
-      id: 'think-roi-low',
-      priority: 'medium',
-      category: 'efficiency',
-      title: 'Think agent underperforming',
-      description: `${Math.round(hitRate * 100)}% hit rate — think preflight isn't saving tokens.`,
-      action: 'Consider disabling think triggers or narrowing trigger conditions.',
-      impact: 'Reduce latency and token overhead on low-complexity tasks.',
-    };
-  }
-  if (hitRate > 0.7) {
-    const savings = avgTokensSaved ? `~${Math.round(avgTokensSaved / 1000)}K tokens` : 'tokens';
-    return {
-      id: 'think-roi-high',
-      priority: 'medium',
-      category: 'efficiency',
-      title: 'Think agent performing well',
-      description: `${Math.round(hitRate * 100)}% hit rate, saving ${savings} per refined task.`,
-      action: 'No action needed, keep enabled.',
-      impact: 'Sustained token efficiency on complex dispatches.',
-    };
-  }
-  return null;
-}
-
-function modelMismatch(routingState) {
-  const recs = [];
-  for (const [taskType, models] of Object.entries(routingState)) {
-    if (taskType.startsWith('_')) continue; // skip metadata keys
-    for (const [model, stats] of Object.entries(models)) {
-      const { ema, observations } = stats || {};
-      if (observations >= 10 && ema < 0.4) {
-        recs.push({
-          id: `model-mismatch-low-${taskType}-${model}`,
-          priority: 'high',
-          category: 'routing',
-          title: 'Model mismatch detected',
-          description: `${model} scores ${ema.toFixed(2)} on ${taskType} tasks.`,
-          action: `Route ${taskType} tasks away from ${model}.`,
-          impact: 'Better task outcomes by avoiding poor model-task fit.',
-        });
-      } else if (observations >= 10 && ema > 0.8 && (model === 'haiku' || model.includes('haiku'))) {
-        recs.push({
-          id: `model-mismatch-promote-${taskType}-${model}`,
-          priority: 'high',
-          category: 'routing',
-          title: 'Cheap model excelling',
-          description: `${model} scores ${ema.toFixed(2)} on ${taskType} tasks.`,
-          action: `Promote ${model} as default for ${taskType} tier — quality without the cost.`,
-          impact: 'Same output quality at lower token cost.',
-        });
-      }
-    }
-  }
-  return recs;
-}
-
-function budgetTrajectory(governance) {
-  const { budgetUsedPct, sessionProgressPct, workStyle } = governance;
-  if (budgetUsedPct == null) return null;
-
-  if (budgetUsedPct > 60 && sessionProgressPct != null && sessionProgressPct < 50) {
-    return {
-      id: 'budget-critical',
-      priority: 'high',
-      category: 'budget',
-      title: 'Budget burning fast',
-      description: `${Math.round(budgetUsedPct)}% budget used, ~${Math.round(sessionProgressPct)}% through estimated work.`,
-      action: 'Switch to cost-saver mode: `dual-brain config set workStyle cost-saver`.',
-      impact: 'Avoid hitting budget ceiling before work completes.',
-    };
-  }
-  if (budgetUsedPct < 20 && workStyle === 'cost-saver') {
-    return {
-      id: 'budget-underutilized',
-      priority: 'low',
-      category: 'budget',
-      title: 'Budget well under control',
-      description: `Only ${Math.round(budgetUsedPct)}% budget used in cost-saver mode.`,
-      action: 'You could afford quality-first mode for this session.',
-      impact: 'Better output quality while staying within budget.',
-    };
-  }
-  return null;
-}
-
-function failurePattern(outcomes) {
-  if (!outcomes.length) return null;
-  const recent = outcomes.slice(-20);
-  const failures = recent.filter(o => o.success === false || (o.reward != null && o.reward < 0.3));
-  const failRate = failures.length / recent.length;
-
-  if (failRate > 0.3) {
-    const modelCounts = {};
-    failures.forEach(o => { if (o.model) modelCounts[o.model] = (modelCounts[o.model] || 0) + 1; });
-    const worstModel = Object.entries(modelCounts).sort((a, b) => b[1] - a[1])[0];
-    const modelNote = worstModel && worstModel[1] >= 3
-      ? ` Failures cluster on ${worstModel[0]}.`
-      : '';
-    return {
-      id: 'failure-pattern',
-      priority: 'high',
-      category: 'quality',
-      title: 'High failure rate detected',
-      description: `${Math.round(failRate * 100)}% of recent tasks failed.${modelNote}`,
-      action: worstModel && worstModel[1] >= 3
-        ? `Route away from ${worstModel[0]} — or check task ambiguity.`
-        : 'Review task clarity and model-task fit.',
-      impact: 'Fewer retries, less wasted compute.',
-    };
-  }
-  return null;
-}
-
-function subscriptionUtilization(subscription, routingState) {
-  const { tier, maxMultiplier } = subscription;
-  if (!tier) return null;
-
-  const routingCells = Object.entries(routingState)
-    .filter(([k]) => !k.startsWith('_')) // skip metadata keys
-    .map(([, v]) => v);
-
-  const opusUses = routingCells
-    .flatMap(m => Object.entries(m))
-    .filter(([model]) => model === 'opus' || model.includes('opus'))
-    .reduce((s, [, stats]) => s + (stats.observations || 0), 0);
-
-  const totalUses = routingCells
-    .flatMap(m => Object.values(m))
-    .reduce((s, stats) => s + (stats.observations || 0), 0);
-
-  if (!totalUses) return null;
-  const opusPct = opusUses / totalUses;
-
-  if ((tier === 'max' || (maxMultiplier && maxMultiplier >= 20)) && opusPct < 0.15) {
-    return {
-      id: 'subscription-underutilized',
-      priority: 'medium',
-      category: 'profile',
-      title: 'Subscription underutilized',
-      description: `Max ${maxMultiplier || ''}x plan but opus used only ${Math.round(opusPct * 100)}% of dispatches.`,
-      action: 'Consider quality-first mode for better output.',
-      impact: 'Get more value from your subscription tier.',
-    };
-  }
-  if ((tier === 'free' || tier === 'pro') && opusPct > 0.4) {
-    return {
-      id: 'subscription-aggressive',
-      priority: 'medium',
-      category: 'profile',
-      title: 'Routing aggressively for plan',
-      description: `${Math.round(opusPct * 100)}% opus usage on a ${tier} plan.`,
-      action: 'Switch to balanced or cost-saver to stay within limits.',
-      impact: 'Avoid rate limits and unexpected cost overruns.',
-    };
-  }
-  return null;
-}
-
-function cascadeEffectiveness(metrics, outcomes) {
-  const { cascadeHits } = metrics;
-  if (!cascadeHits || cascadeHits < 3) return null;
-
-  const cascaded = outcomes.filter(o => o.cascaded === true);
-  if (cascaded.length < 3) return null;
-
-  const avgReward = cascaded.reduce((s, o) => s + (o.reward || 0), 0) / cascaded.length;
-  if (avgReward > 0.7) {
-    return {
-      id: 'cascade-effective',
-      priority: 'low',
-      category: 'efficiency',
-      title: 'Cascade routing working well',
-      description: `${cascadeHits} cascade hits, ${avgReward.toFixed(2)} avg reward on cascaded tasks.`,
-      action: 'Keep cascade enabled — it\'s delivering quality results.',
-      impact: 'Continued token efficiency on eligible tasks.',
-    };
-  }
-  return {
-    id: 'cascade-poor',
-    priority: 'low',
-    category: 'efficiency',
-    title: 'Cascade delivering poor results',
-    description: `${cascadeHits} cascade hits but only ${avgReward.toFixed(2)} avg reward.`,
-    action: 'Consider disabling cascade: `dual-brain config set cascade false`.',
-    impact: 'Better outcomes by routing cascade tasks to full models.',
-  };
-}
-
-// ─── Export 1: generateRecommendations ────────────────────────────────────────
-
-export function generateRecommendations(cwd) {
-  try {
-    const routingState  = loadRoutingState(cwd);
-    const thinkMetrics  = loadThinkMetrics(cwd);
-    const governance    = loadGovernance(cwd);
-    const subscription  = loadSubscription(cwd);
-    const outcomes      = loadOutcomes(cwd);
-
-    const recs = [
-      ...modelMismatch(routingState),
-      failurePattern(outcomes),
-      budgetTrajectory(governance),
-      thinkROI(thinkMetrics),
-      subscriptionUtilization(subscription, routingState),
-      cascadeEffectiveness(thinkMetrics, outcomes),
-    ].filter(Boolean);
-
-    const order = { high: 0, medium: 1, low: 2 };
-    return recs.sort((a, b) => (order[a.priority] ?? 9) - (order[b.priority] ?? 9));
-  } catch { return []; }
-}
-
-// ─── Export 2: formatRecommendations ─────────────────────────────────────────
-
-const ICONS = { high: '⚡', medium: '💡', low: '📊' };
-
-export function formatRecommendations(recs) {
-  const top = recs.slice(0, 4);
-  if (!top.length) {
-    return '╭─ Recommendations ─────────────────────────────────────────────╮\n' +
-           '│  No recommendations — configuration looks healthy.            │\n' +
-           '╰───────────────────────────────────────────────────────────────╯';
-  }
-
-  const WIDTH = 63;
-  // Truncate + pad to fit inside box: WIDTH - 4 accounts for '│ ' and ' │'
-  const INNER = WIDTH - 4;
-  const clip = (str) => str.length > INNER ? str.slice(0, INNER - 1) + '…' : str;
-  const pad = (str) => clip(str).padEnd(INNER);
-  const line = (content) => `│ ${pad(content)} │`;
-
-  const lines = [
-    '╭─ Recommendations ' + '─'.repeat(WIDTH - 20) + '╮',
-    line(''),
-  ];
-
-  for (const rec of top) {
-    const icon = ICONS[rec.priority] || '•';
-    lines.push(line(`${icon} ${rec.priority.toUpperCase()}: ${rec.title}`));
-    lines.push(line(`   ${rec.description}`));
-    lines.push(line(`   → ${rec.action}`));
-    lines.push(line(''));
-  }
-
-  lines.push('╰' + '─'.repeat(WIDTH - 2) + '╯');
-  return lines.join('\n');
-}
-
-// ─── Export 3: getTopRecommendation ──────────────────────────────────────────
-
-export function getTopRecommendation(cwd) {
-  const recs = generateRecommendations(cwd);
-  return recs.length ? recs[0] : null;
-}

package/src/redact.mjs

@@ -1,192 +0,0 @@
-#!/usr/bin/env node
-// redact.mjs — Secret redaction utility for dual-brain orchestrator.
-// SAFETY-CRITICAL: nothing reaches AI dispatch without passing through redaction.
-// All functions are synchronous and regex-based — no external dependencies.
-// Exports: redact, redactFiles, isSecretFile
-
-import { basename, extname } from 'node:path';
-
-// ─── Non-secret placeholder values (skip redaction) ──────────────────────────
-const PLACEHOLDER_PATTERN = /^(xxx+|changeme|placeholder|your[_-].+|example|fake|dummy|test|none|null|true|false|0|1|<[^>]+>|\$\{[^}]+\}|%[A-Z_]+%|\*+|\.+)$/i;
-
-// ─── Secret patterns ──────────────────────────────────────────────────────────
-// Each entry: { pattern: RegExp, replacer: Function|string }
-// replacer receives the full match; return the redacted string.
-// IMPORTANT: Only redact the value portion, not the key name.
-
-const REDACT_PATTERNS = [
-  // .env-style: KEY=VALUE (key contains KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)
-  {
-    pattern: /\b([A-Z_]*(KEY|SECRET|TOKEN|PASSWORD|CREDENTIAL|AUTH)[A-Z_]*\s*=\s*)([^\s\n"'`]+)/gi,
-    replacer: (_m, key, _kw, val) => isPlaceholder(val) ? _m : `${key}[REDACTED]`,
-  },
-
-  // Explicit named keys (case-insensitive) with = or : assignment
-  // Covers: API_KEY=, OPENAI_API_KEY=, ANTHROPIC_API_KEY=, etc.
-  {
-    pattern: /\b((?:api[_-]?key|openai[_-]api[_-]key|anthropic[_-]api[_-]key|aws[_-]secret[_-]access[_-]key|aws[_-]access[_-]key[_-]id|private[_-]key|passwd)\s*[=:]\s*["'`]?)([^\s"'`\n,;]+)(["'`]?)/gi,
-    replacer: (_m, prefix, val, suffix) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]${suffix}`,
-  },
-
-  // Passwords: password=xxx / PASSWORD="xxx" / passwd: xxx
-  {
-    pattern: /\b(passwords?\s*[=:]\s*["'`]?)([^\s"'`\n,;]+)(["'`]?)/gi,
-    replacer: (_m, prefix, val, suffix) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]${suffix}`,
-  },
-
-  // Bearer tokens: Bearer xxx / Authorization: Bearer xxx
-  {
-    pattern: /(Bearer\s+)([A-Za-z0-9\-._~+/]+=*)/g,
-    replacer: (_m, prefix, val) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]`,
-  },
-
-  // Authorization header value (non-Bearer forms)
-  {
-    pattern: /(Authorization\s*:\s*)([^\s\n][^\n]*)/gi,
-    replacer: (_m, prefix, val) => {
-      const trimmed = val.trim();
-      if (isPlaceholder(trimmed)) return _m;
-      // Keep the auth scheme visible (Basic, Digest, etc.) but redact the credential
-      const schemeMatch = trimmed.match(/^(\w+)\s+(.+)$/);
-      if (schemeMatch) return `${prefix}${schemeMatch[1]} [REDACTED]`;
-      return `${prefix}[REDACTED]`;
-    },
-  },
-
-  // AWS credentials
-  {
-    pattern: /\b((?:AWS_SECRET_ACCESS_KEY|aws_secret_access_key|AWS_ACCESS_KEY_ID|aws_access_key_id)\s*[=:]\s*["'`]?)([^\s"'`\n,;]+)(["'`]?)/g,
-    replacer: (_m, prefix, val, suffix) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]${suffix}`,
-  },
-
-  // Connection strings: ://user:password@host
-  {
-    pattern: /([\w+.-]+:\/\/[^:@\s]+:)([^@\s]+)(@)/g,
-    replacer: (_m, prefix, pass, at) => isPlaceholder(pass) ? _m : `${prefix}[REDACTED]${at}`,
-  },
-
-  // Inline JSON: "api_key": "value", "secret": "...", "token": "..."
-  {
-    pattern: /("(?:api[_-]?key|secret|token|password|passwd|credential|auth[_-]?key|private[_-]?key)"\s*:\s*")([^"]*?)(")/gi,
-    replacer: (_m, prefix, val, suffix) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]${suffix}`,
-  },
-
-  // Inline JSON with single quotes
-  {
-    pattern: /('(?:api[_-]?key|secret|token|password|passwd|credential|auth[_-]?key|private[_-]?key)'\s*:\s*')([^']*?)(')/gi,
-    replacer: (_m, prefix, val, suffix) => isPlaceholder(val) ? _m : `${prefix}[REDACTED]${suffix}`,
-  },
-
-  // Common secret value prefixes: sk-, pk_, ghp_, gho_, npm_, pypi-
-  // Match these as standalone tokens (not inside process.env.X or function calls)
-  {
-    pattern: /(?<![.\w])(sk-[A-Za-z0-9\-_]{8,}|pk_(?:live|test)_[A-Za-z0-9]{8,}|ghp_[A-Za-z0-9]{8,}|gho_[A-Za-z0-9]{8,}|npm_[A-Za-z0-9]{8,}|pypi-[A-Za-z0-9\-]{8,})/g,
-    replacer: '[REDACTED]',
-  },
-];
-
-// ─── Secret file patterns ─────────────────────────────────────────────────────
-
-const SECRET_FILE_PATTERNS = [
-  // .env files
-  /(?:^|\/)\.env(?:\.[a-zA-Z0-9._-]+)?$/,
-  // Credential / service-account JSON files
-  /(?:^|\/)(?:credentials|service-account|serviceaccount)(?:\.[a-zA-Z0-9._-]+)?\.json$/i,
-  // Private key files
-  /\.pem$/i,
-  /\.key$/i,
-  // Git internals
-  /(?:^|\/)\.git\//,
-  // node_modules
-  /(?:^|\/)node_modules\//,
-];
-
-// ─── Helpers ──────────────────────────────────────────────────────────────────
-
-function isPlaceholder(value) {
-  if (!value) return true;
-  return PLACEHOLDER_PATTERN.test(value.trim());
-}
-
-// ─── Public API ───────────────────────────────────────────────────────────────
-
-/**
- * Scan text for common secret patterns and replace values with [REDACTED].
- * Returns the cleaned text. Fast — pure regex, no I/O.
- *
- * @param {string} text
- * @returns {string}
- */
-function redact(text) {
-  if (!text || typeof text !== 'string') return text;
-
-  let result = text;
-
-  for (const { pattern, replacer } of REDACT_PATTERNS) {
-    // Reset lastIndex for global regexes to avoid skipped matches
-    pattern.lastIndex = 0;
-
-    if (typeof replacer === 'string') {
-      result = result.replace(pattern, replacer);
-    } else {
-      result = result.replace(pattern, replacer);
-    }
-
-    // Reset again after use
-    pattern.lastIndex = 0;
-  }
-
-  return result;
-}
-
-/**
- * Given a list of file paths, return a Set of paths that should NOT be sent
- * as context to agents (secret files, .git, node_modules).
- *
- * @param {string[]} filePaths
- * @param {string} [cwd]
- * @returns {Set<string>}
- */
-function redactFiles(filePaths, cwd) {
-  const blocked = new Set();
-  for (const fp of filePaths) {
-    if (isSecretFile(fp)) blocked.add(fp);
-  }
-  return blocked;
-}
-
-/**
- * Returns true if the file path matches known secret/sensitive patterns.
- *
- * @param {string} filePath
- * @returns {boolean}
- */
-function isSecretFile(filePath) {
-  if (!filePath) return false;
-  // Normalise Windows separators
-  const normalised = filePath.replace(/\\/g, '/');
-  return SECRET_FILE_PATTERNS.some(p => p.test(normalised));
-}
-
-// ─── CLI (smoke test) ─────────────────────────────────────────────────────────
-if (process.argv[1] && new URL(import.meta.url).pathname === process.argv[1]) {
-  const samples = [
-    'OPENAI_API_KEY=sk-abc123secretvalue',
-    'Authorization: Bearer eyJhbGciOiJSUzI1NiJ9.payload.sig',
-    'password=changeme',
-    'password=supersecret123',
-    '{"api_key": "sk-proj-abcdefgh12345678"}',
-    'process.env.API_KEY',
-    'getSecret("my-key")',
-    'connect postgresql://admin:s3cr3t@db.host.com/mydb',
-    'AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY',
-    'ghp_ABCDEF1234567890abcdef1234567890',
-  ];
-  for (const s of samples) {
-    console.log(`IN : ${s}`);
-    console.log(`OUT: ${redact(s)}`);
-    console.log();
-  }
-}
-
-export { redact, redactFiles, isSecretFile };