flavor-code 1.2.18 → 1.3.0

package/dist/desktop/plugin-worker-entry.js

@@ -0,0 +1,230 @@
+// src/plugins/plugin-worker-entry.ts
+import { readFile, realpath } from "fs/promises";
+import { isAbsolute, relative, resolve, sep } from "path";
+import { fileURLToPath, pathToFileURL } from "url";
+import { createContext, runInContext, SourceTextModule } from "vm";
+import { parentPort, workerData } from "worker_threads";
+var MAX_MODULE_BYTES = 2 * 1024 * 1024;
+var CONTRIBUTION_NAME_SOURCE = "^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$";
+var data = workerData;
+var port = parentPort;
+if (port === null) throw new Error("Plugin sandbox requires a parent port");
+var activationKeepAlive = setInterval(() => void 0, 1e3);
+function send(message) {
+  port.postMessage(message);
+}
+function errorMessage(error) {
+  return error instanceof Error ? error.message : String(error);
+}
+function assertContained(root, candidate) {
+  const delta = relative(root, candidate);
+  if (delta === ".." || delta.startsWith(`..${sep}`) || isAbsolute(delta)) throw new Error("Plugin module import escapes the plugin root");
+}
+var SANDBOX_BOOTSTRAP = `(() => {
+  "use strict";
+  const stores = { command: new Map(), tool: new Map(), hook: new Map(), skillRoot: new Map(), modelAdapter: new Map() };
+  let deactivate;
+  let accepting = true;
+  const signal = Object.freeze({ aborted: false, reason: undefined, addEventListener() {}, removeEventListener() {}, throwIfAborted() {} });
+  const cloneJson = (value) => value === undefined ? undefined : JSON.parse(JSON.stringify(value));
+  const deepFreeze = (value) => {
+    if (!value || typeof value !== "object" || Object.isFrozen(value)) return value;
+    for (const child of Object.values(value)) deepFreeze(child);
+    return Object.freeze(value);
+  };
+  const config = deepFreeze(JSON.parse(globalThis.__flavorConfigJson));
+  delete globalThis.__flavorConfigJson;
+  const namePattern = new RegExp(${JSON.stringify(CONTRIBUTION_NAME_SOURCE)});
+  const name = (value) => {
+    const result = String(value);
+    if (!namePattern.test(result)) throw new Error("Invalid contribution name: " + result);
+    return result;
+  };
+  const register = (kind, rawName, value, metadata) => {
+    if (!accepting) throw new Error("Plugin registrations are closed after activation");
+    const contributionName = name(rawName);
+    if (stores[kind].has(contributionName)) throw new Error("Duplicate " + kind + " contribution: " + contributionName);
+    stores[kind].set(contributionName, { value, metadata });
+    let active = true;
+    return Object.freeze(function disposeRegistration() {
+      if (!active) return;
+      active = false;
+      stores[kind].delete(contributionName);
+    });
+  };
+  const context = Object.freeze({
+    signal,
+    config,
+    logger: Object.freeze({ debug() {}, info() {}, warn() {}, error() {} }),
+    services: Object.freeze({ filesystem: Object.freeze({
+      async readFile() { throw new Error("Filesystem read is not available in sandbox"); },
+      async writeFile() { throw new Error("Filesystem write is not available in sandbox"); },
+    }) }),
+    registerCommand(rawName, handler, description) {
+      if (typeof handler !== "function") throw new Error("Sandbox command handler must be a function");
+      return register("command", rawName, handler, { description: typeof description === "string" ? description : undefined });
+    },
+    registerTool(rawName, tool) {
+      if (!tool || typeof tool !== "object" || typeof tool.execute !== "function") throw new Error("Sandbox tool must provide execute(input, signal, context)");
+      return register("tool", rawName, tool, {
+        toolName: typeof tool.name === "string" ? tool.name : String(rawName),
+        description: typeof tool.description === "string" ? tool.description : "Plugin tool " + String(rawName),
+        modelInputSchema: cloneJson(tool.modelInputSchema), readOnly: tool.readOnly === true,
+      });
+    },
+    registerHook(rawName, handler, options) {
+      if (typeof handler !== "function") throw new Error("Sandbox hook handler must be a function");
+      return register("hook", rawName, handler, { options: cloneJson(options) });
+    },
+    registerSkillRoot(rawName, root) {
+      if (typeof root !== "string") throw new Error("Sandbox skill root must be a string");
+      return register("skillRoot", rawName, root, { root });
+    },
+    registerModelAdapter(rawName, adapter) {
+      if (!adapter || typeof adapter.stream !== "function") throw new Error("Sandbox model adapter must provide stream(request)");
+      return register("modelAdapter", rawName, adapter, {});
+    },
+  });
+  const describe = () => ({
+    commands: [...stores.command].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    tools: [...stores.tool].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    hooks: [...stores.hook].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    skillRoots: [...stores.skillRoot].map(([entryName, entry]) => ({ name: entryName, ...entry.metadata })),
+    modelAdapters: [...stores.modelAdapter].map(([entryName]) => ({ name: entryName })),
+  });
+  const invoke = async (kind, entryName, args) => {
+    const entry = stores[kind]?.get(entryName);
+    if (!entry) throw new Error("Unknown sandbox contribution: " + kind + ":" + entryName);
+    if (kind === "command") return entry.value(args[0], Object.freeze({ ...(args[1] || {}), signal }));
+    if (kind === "tool") return entry.value.execute(args[0], signal, args[1]);
+    if (kind === "hook") return entry.value(args[0], signal);
+    if (kind === "modelAdapter") {
+      const events = [];
+      for await (const event of entry.value.stream(args[0])) events.push(event);
+      return events;
+    }
+    throw new Error("Unsupported sandbox invocation kind: " + kind);
+  };
+  globalThis.__flavorSandbox = Object.freeze({
+    async activate(fn) {
+      const result = await fn(context);
+      if (result !== undefined && typeof result !== "function") throw new Error("Plugin activate result must be a disposer or undefined");
+      deactivate = result;
+      accepting = false;
+      return JSON.stringify(describe());
+    },
+    async invokeJson(kind, entryName, argsJson) {
+      try { return JSON.stringify({ ok: true, value: await invoke(kind, entryName, JSON.parse(argsJson)) }); }
+      catch (error) { return JSON.stringify({ ok: false, error: error instanceof Error ? error.message : String(error) }); }
+    },
+    async shutdown() { if (deactivate) await deactivate(); deactivate = undefined; },
+  });
+})();`;
+async function loadPlugin(pluginRoot, entryPath) {
+  const context = createContext(/* @__PURE__ */ Object.create(null), {
+    name: `flavor-plugin:${data.pluginName}`,
+    codeGeneration: { strings: false, wasm: false }
+  });
+  context.__flavorConfigJson = data.configJson;
+  runInContext(SANDBOX_BOOTSTRAP, context, { timeout: 1e3 });
+  const modules = /* @__PURE__ */ new Map();
+  const getModule = async (input) => {
+    const physical = await realpath(input);
+    assertContained(pluginRoot, physical);
+    const existing = modules.get(physical);
+    if (existing !== void 0) return existing;
+    const source = await readFile(physical, "utf8");
+    if (Buffer.byteLength(source) > MAX_MODULE_BYTES) throw new Error(`Plugin module exceeds ${MAX_MODULE_BYTES} bytes`);
+    const module = new SourceTextModule(source, {
+      context,
+      identifier: pathToFileURL(physical).href,
+      initializeImportMeta(meta) {
+        meta.url = pathToFileURL(physical).href;
+      },
+      importModuleDynamically: async (specifier, referencingModule) => {
+        const imported = await resolveModule(specifier, referencingModule);
+        if (imported.status === "unlinked") await imported.link(linker);
+        if (imported.status === "linked") await imported.evaluate();
+        return imported;
+      }
+    });
+    modules.set(physical, module);
+    return module;
+  };
+  const resolveModule = async (specifier, referencingModule) => {
+    if (!specifier.startsWith("./") && !specifier.startsWith("../")) throw new Error(`Sandbox blocks external module import: ${specifier}`);
+    return getModule(resolve(fileURLToPath(referencingModule.identifier), "..", specifier));
+  };
+  const linker = (specifier, referencingModule) => resolveModule(specifier, referencingModule);
+  const entry = await getModule(entryPath);
+  await entry.link(linker);
+  await entry.evaluate();
+  const activate = entry.namespace.activate;
+  if (typeof activate !== "function") throw new Error("Plugin entry must export activate(context)");
+  context.__flavorActivate = activate;
+  const contributionsJson = await runInContext(
+    "globalThis.__flavorSandbox.activate(globalThis.__flavorActivate)",
+    context
+  );
+  return { context, contributions: JSON.parse(contributionsJson) };
+}
+async function main() {
+  const pluginRoot = await realpath(data.pluginRoot);
+  assertContained(pluginRoot, await realpath(data.entryPath));
+  const loaded = await loadPlugin(pluginRoot, data.entryPath);
+  const { contributions } = loaded;
+  const result = {
+    ok: true,
+    name: data.pluginName,
+    version: data.pluginVersion,
+    registeredTools: contributions.tools.map(({ name }) => name),
+    registeredCommands: contributions.commands.map(({ name }) => name),
+    registeredHooks: contributions.hooks.map(({ name }) => name),
+    registeredSkillRoots: contributions.skillRoots.map(({ name }) => name),
+    registeredModelAdapters: contributions.modelAdapters.map(({ name }) => name),
+    contributions
+  };
+  send({ type: "ready", result });
+  port.on("message", (raw) => {
+    void handleMessage(raw, loaded.context);
+  });
+  clearInterval(activationKeepAlive);
+}
+async function handleMessage(raw, context) {
+  if (typeof raw !== "object" || raw === null || !("type" in raw)) {
+    send({ type: "fatal", error: "Invalid sandbox parent message" });
+    return;
+  }
+  const message = raw;
+  if (message.type === "shutdown") {
+    try {
+      await runInContext("globalThis.__flavorSandbox.shutdown()", context);
+      send({ type: "disposed" });
+    } catch (error) {
+      send({ type: "fatal", error: `Plugin sandbox shutdown failed: ${errorMessage(error)}` });
+    }
+    return;
+  }
+  if (message.type !== "invoke" || !Number.isSafeInteger(message.id) || typeof message.name !== "string" || typeof message.argsJson !== "string" || !["command", "tool", "hook", "modelAdapter"].includes(message.kind)) {
+    send({ type: "fatal", error: "Invalid sandbox invocation message" });
+    return;
+  }
+  context.__flavorKind = message.kind;
+  context.__flavorName = message.name;
+  context.__flavorArgs = message.argsJson;
+  try {
+    const responseJson = await runInContext(
+      "globalThis.__flavorSandbox.invokeJson(globalThis.__flavorKind, globalThis.__flavorName, globalThis.__flavorArgs)",
+      context
+    );
+    const response = JSON.parse(responseJson);
+    if (response.ok) send({ type: "response", id: message.id, ok: true, valueJson: response.value === void 0 ? "null" : JSON.stringify(response.value) });
+    else send({ type: "response", id: message.id, ok: false, error: response.error ?? "Sandbox invocation failed" });
+  } catch (error) {
+    send({ type: "response", id: message.id, ok: false, error: errorMessage(error) });
+  }
+}
+main().catch((error) => {
+  clearInterval(activationKeepAlive);
+  send({ type: "fatal", error: errorMessage(error) });
+});

package/dist/evolve/loader.d.ts

@@ -13,7 +13,7 @@ export interface FixPluginVerifyReport {
     commands: string[];
     error?: string;
 }
-/** Dry-run a plugin in a shadow PluginHost sandbox. The real host is untouched. */
+/** Verify a plugin in an isolated Worker sandbox. The real host is untouched. */
 export declare function verifyFixPlugin(workspace: string, name: string): Promise<FixPluginVerifyReport>;
 /** Copy the current plugin dir into .versions/<name>/<timestamp>/. */
 export declare function snapshotFixPlugin(workspace: string, name: string): Promise<string>;

package/dist/goal/classifier.d.ts

@@ -1,5 +1,5 @@
 import type { ModelRegistry } from "../models/registry.js";
-import { type AggregatedOutcome, type EvidencePacket, type Gap, type Plan } from "./types.js";
+import { type AggregatedOutcome, type EvidencePacket, type Gap, type HostVerificationEvidence, type Plan } from "./types.js";
 export interface ClassifierOptions {
     registry: ModelRegistry;
     modelId: string;
@@ -9,4 +9,4 @@ export interface ClassifierOptions {
 }
 export declare function runClassifier(evidence: EvidencePacket, plan: Plan, options: ClassifierOptions): Promise<AggregatedOutcome>;
 export declare function computeFingerprint(gaps: Gap[]): string;
-export declare function collectEvidence(workspace: string, objective: string, finalResponse: string, priorGaps: string): Promise<EvidencePacket>;
+export declare function collectEvidence(workspace: string, objective: string, finalResponse: string, priorGaps: string, contractHash?: string, hostVerification?: HostVerificationEvidence): Promise<EvidencePacket>;

package/dist/goal/orchestrator.d.ts

@@ -1,6 +1,6 @@
 import type { AgentEvent } from "../agent/types.js";
 import type { ModelRegistry } from "../models/registry.js";
-import type { GoalRuntimeEvent, GoalState } from "./types.js";
+import type { GoalRuntimeEvent, GoalState, HostVerificationEvidence } from "./types.js";
 export interface GoalOrchestratorOptions {
     workspace: string;
     registry: ModelRegistry;
@@ -22,6 +22,7 @@ export interface GoalOrchestratorOptions {
     persistence?: {
         save(state: GoalState): Promise<void>;
     };
+    verifyHost?(signal: AbortSignal): Promise<HostVerificationEvidence>;
 }
 export declare class GoalOrchestrator {
     #private;

package/dist/goal/types.d.ts

@@ -88,6 +88,22 @@ export interface EvidencePacket {
     planFile: string | null;
     finalResponse: string;
     priorGaps: string;
+    contractHash: string;
+    workspaceDiffHash: string;
+    workspaceStatus: string[];
+    hostVerification?: HostVerificationEvidence;
+}
+export interface HostVerificationEvidence {
+    passed: boolean;
+    summary: string;
+    commands: Array<{
+        command: string;
+        args: string[];
+        exitCode: number | null;
+        stdout?: string;
+        stderr?: string;
+        truncated?: boolean;
+    }>;
 }
 export declare const GoalStateSchema: z.ZodObject<{
     id: z.ZodString;
@@ -141,6 +157,23 @@ export declare const GoalStateSchema: z.ZodObject<{
     }, z.core.$strict>>;
     gapFingerprint: z.ZodString;
     stallStreak: z.ZodNumber;
+    contractHash: z.ZodString;
+    evidenceRounds: z.ZodArray<z.ZodObject<{
+        round: z.ZodNumber;
+        workspaceDiffHash: z.ZodString;
+        hostVerification: z.ZodOptional<z.ZodObject<{
+            passed: z.ZodBoolean;
+            summary: z.ZodString;
+            commands: z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                args: z.ZodArray<z.ZodString>;
+                exitCode: z.ZodNullable<z.ZodNumber>;
+                stdout: z.ZodOptional<z.ZodString>;
+                stderr: z.ZodOptional<z.ZodString>;
+                truncated: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strict>;

package/dist/harness/invariants.d.ts

@@ -0,0 +1,4 @@
+import type { HarnessJournalRecord } from "./journal.js";
+/** Mechanical replay invariants owned by the durable harness package. */
+export declare function harnessInvariantViolations(records: readonly HarnessJournalRecord[]): string[];
+export declare function assertHarnessInvariants(records: readonly HarnessJournalRecord[]): void;

package/dist/harness/journal.d.ts

@@ -0,0 +1,109 @@
+import { z } from "zod";
+export declare const HARNESS_JOURNAL_VERSION: 1;
+declare const EventTypeSchema: z.ZodEnum<{
+    "model.completed": "model.completed";
+    "model.requested": "model.requested";
+    "queue.acked": "queue.acked";
+    "queue.admitted": "queue.admitted";
+    "queue.claimed": "queue.claimed";
+    "queue.released": "queue.released";
+    "recovery.completed": "recovery.completed";
+    "savepoint.created": "savepoint.created";
+    "tool.completed": "tool.completed";
+    "tool.interrupted": "tool.interrupted";
+    "tool.started": "tool.started";
+    "turn.completed": "turn.completed";
+    "turn.interrupted": "turn.interrupted";
+    "turn.started": "turn.started";
+}>;
+declare const JournalRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    sequence: z.ZodNumber;
+    id: z.ZodString;
+    timestamp: z.ZodString;
+    type: z.ZodEnum<{
+        "model.completed": "model.completed";
+        "model.requested": "model.requested";
+        "queue.acked": "queue.acked";
+        "queue.admitted": "queue.admitted";
+        "queue.claimed": "queue.claimed";
+        "queue.released": "queue.released";
+        "recovery.completed": "recovery.completed";
+        "savepoint.created": "savepoint.created";
+        "tool.completed": "tool.completed";
+        "tool.interrupted": "tool.interrupted";
+        "tool.started": "tool.started";
+        "turn.completed": "turn.completed";
+        "turn.interrupted": "turn.interrupted";
+        "turn.started": "turn.started";
+    }>;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    previousHash: z.ZodNullable<z.ZodString>;
+    hash: z.ZodString;
+}, z.core.$strict>;
+export type HarnessJournalEventType = z.infer<typeof EventTypeSchema>;
+export type HarnessJournalRecord = z.infer<typeof JournalRecordSchema>;
+export interface DurableQueueItem<T = unknown> {
+    id: string;
+    kind: "steer" | "followUp";
+    payload: T;
+    admittedAt: string;
+    recovered: boolean;
+}
+export interface IncompleteToolCall {
+    id: string;
+    tool: string;
+    retrySafe: boolean;
+    inputHash: string;
+}
+export interface HarnessRecovery<T = unknown> {
+    queue: DurableQueueItem<T>[];
+    incompleteTools: IncompleteToolCall[];
+    incompleteModelIds: string[];
+    interruptedTurnIds: string[];
+    lastSavepoint?: {
+        id: string;
+        phase: string;
+        configHash: string;
+    };
+}
+export interface HarnessJournalOptions {
+    workspace: string;
+    sessionId: string;
+    now?(): string;
+    maxBytes?: number;
+}
+/**
+ * Crash-consistent, hash-chained execution journal. Queue admission uses a
+ * synchronous fsync because returning from steer/followUp is the durability
+ * boundary: once the UI says "queued", the prompt must survive a hard crash.
+ */
+export declare class HarnessJournal {
+    #private;
+    constructor(options: HarnessJournalOptions);
+    get path(): string;
+    get records(): readonly HarnessJournalRecord[];
+    admitQueue<T>(kind: "steer" | "followUp", payload: T): string;
+    claimQueue(id: string): void;
+    ackQueue(id: string): void;
+    releaseQueue(id: string, reason: string): void;
+    startTurn(config: unknown, prompt: unknown): string;
+    completeTurn(id: string): void;
+    interruptTurn(id: string, reason: string): void;
+    startModel(input: {
+        agent: string;
+        model: string;
+        iteration: number;
+        attempt: number;
+        messages: unknown;
+    }): string;
+    completeModel(id: string, completed: boolean, error?: string): void;
+    startTool(tool: string, input: unknown, retrySafe: boolean): string;
+    completeTool(id: string, result: unknown): void;
+    interruptTool(id: string, reason: string): void;
+    savepoint(phase: string, config: unknown): string;
+    recover<T = unknown>(): HarnessRecovery<T>;
+    markRecoveryComplete(recovery: HarnessRecovery): void;
+}
+export declare function hashJson(value: unknown): string;
+export {};

package/dist/harness/local.d.ts

@@ -1,12 +1,13 @@
-import { AgentLoop } from "../agent/loop.js";
+import { AgentLoop, type AgentLoopOptions } from "../agent/loop.js";
 import type { TaskNode } from "../agent/planner.js";
 import type { HallucinationGuard } from "../hallucination/guard.js";
 import type { PermissionMode, PermissionProfile } from "../permissions/engine.js";
+import type { CompiledPermissionPolicy } from "../permissions/policy.js";
 import type { ContextManager } from "../context/manager.js";
 import type { HookBus } from "../hooks/bus.js";
 import type { ModelRegistry } from "../models/registry.js";
 import type { ModelTool } from "../models/types.js";
-import { ToolRuntime, type ApprovalCallback } from "../tools/runtime.js";
+import { ToolRuntime, type ApprovalCallback, type ToolRuntimeOptions } from "../tools/runtime.js";
 import type { ToolDefinition } from "../tools/types.js";
 export interface LocalHarnessOptions {
     registry: ModelRegistry;
@@ -25,6 +26,9 @@ export interface LocalHarnessOptions {
     /** When true, non-destructive tools skip the approval callback. Destructive tools still require confirmation. */
     loopMode?: boolean;
     afterToolSuccess?(tool: string, paths: readonly string[], input: unknown, output: unknown, context: import("../tools/types.js").ToolContext): Promise<readonly string[]>;
+    toolJournal?: ToolRuntimeOptions["journal"];
+    permissionPolicy?: CompiledPermissionPolicy;
+    modelJournal?: AgentLoopOptions["modelJournal"];
 }
 export interface HarnessProfile {
     modelId: string;

package/dist/permissions/engine.d.ts

@@ -1,4 +1,5 @@
 import { type LegacyPermissionMode, type PermissionMode } from "../config/schema.js";
+import type { CompiledPermissionPolicy } from "./policy.js";
 export type { PermissionMode } from "../config/schema.js";
 export type PermissionDecision = {
     decision: "allow" | "deny" | "ask";
@@ -22,6 +23,7 @@ export interface PermissionEngineOptions {
     workspace: string;
     mode?: PermissionMode | LegacyPermissionMode;
     profile?: PermissionProfile;
+    policy?: CompiledPermissionPolicy;
 }
 export type ToolCategory = "control" | "read" | "write" | "destructive" | "shell" | "network" | "unknown";
 export declare function getToolCategory(name: string): ToolCategory;

package/dist/permissions/policy.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import type { PermissionDecision, PermissionRequest } from "./engine.js";
+declare const RuleSchema: z.ZodObject<{
+    id: z.ZodString;
+    decision: z.ZodEnum<{
+        allow: "allow";
+        ask: "ask";
+        deny: "deny";
+    }>;
+    prefix: z.ZodArray<z.ZodString>;
+    tool: z.ZodOptional<z.ZodString>;
+    agent: z.ZodOptional<z.ZodEnum<{
+        main: "main";
+        subagent: "subagent";
+    }>>;
+    justification: z.ZodOptional<z.ZodString>;
+    match: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+    notMatch: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>;
+export type PermissionRule = z.infer<typeof RuleSchema> & {
+    source: string;
+    tier: "managed" | "user" | "project" | "local" | "session";
+};
+export interface PermissionPolicyLoadOptions {
+    workspace: string;
+    home: string;
+    managedPath?: string;
+    sessionRules?: readonly z.input<typeof RuleSchema>[];
+}
+export declare class CompiledPermissionPolicy {
+    #private;
+    readonly diagnostics: readonly string[];
+    constructor(rules: readonly PermissionRule[], diagnostics?: readonly string[]);
+    get rules(): readonly PermissionRule[];
+    decide(request: PermissionRequest): PermissionDecision | undefined;
+}
+export declare function loadPermissionPolicy(options: PermissionPolicyLoadOptions): Promise<CompiledPermissionPolicy>;
+export {};