flavor-code 1.2.20 → 1.3.0

package/dist/goal/classifier.d.ts

@@ -1,5 +1,5 @@
 import type { ModelRegistry } from "../models/registry.js";
-import { type AggregatedOutcome, type EvidencePacket, type Gap, type Plan } from "./types.js";
+import { type AggregatedOutcome, type EvidencePacket, type Gap, type HostVerificationEvidence, type Plan } from "./types.js";
 export interface ClassifierOptions {
     registry: ModelRegistry;
     modelId: string;
@@ -9,4 +9,4 @@ export interface ClassifierOptions {
 }
 export declare function runClassifier(evidence: EvidencePacket, plan: Plan, options: ClassifierOptions): Promise<AggregatedOutcome>;
 export declare function computeFingerprint(gaps: Gap[]): string;
-export declare function collectEvidence(workspace: string, objective: string, finalResponse: string, priorGaps: string): Promise<EvidencePacket>;
+export declare function collectEvidence(workspace: string, objective: string, finalResponse: string, priorGaps: string, contractHash?: string, hostVerification?: HostVerificationEvidence): Promise<EvidencePacket>;

package/dist/goal/orchestrator.d.ts

@@ -1,6 +1,6 @@
 import type { AgentEvent } from "../agent/types.js";
 import type { ModelRegistry } from "../models/registry.js";
-import type { GoalRuntimeEvent, GoalState } from "./types.js";
+import type { GoalRuntimeEvent, GoalState, HostVerificationEvidence } from "./types.js";
 export interface GoalOrchestratorOptions {
     workspace: string;
     registry: ModelRegistry;
@@ -22,6 +22,7 @@ export interface GoalOrchestratorOptions {
     persistence?: {
         save(state: GoalState): Promise<void>;
     };
+    verifyHost?(signal: AbortSignal): Promise<HostVerificationEvidence>;
 }
 export declare class GoalOrchestrator {
     #private;

package/dist/goal/types.d.ts

@@ -88,6 +88,22 @@ export interface EvidencePacket {
     planFile: string | null;
     finalResponse: string;
     priorGaps: string;
+    contractHash: string;
+    workspaceDiffHash: string;
+    workspaceStatus: string[];
+    hostVerification?: HostVerificationEvidence;
+}
+export interface HostVerificationEvidence {
+    passed: boolean;
+    summary: string;
+    commands: Array<{
+        command: string;
+        args: string[];
+        exitCode: number | null;
+        stdout?: string;
+        stderr?: string;
+        truncated?: boolean;
+    }>;
 }
 export declare const GoalStateSchema: z.ZodObject<{
     id: z.ZodString;
@@ -141,6 +157,23 @@ export declare const GoalStateSchema: z.ZodObject<{
     }, z.core.$strict>>;
     gapFingerprint: z.ZodString;
     stallStreak: z.ZodNumber;
+    contractHash: z.ZodString;
+    evidenceRounds: z.ZodArray<z.ZodObject<{
+        round: z.ZodNumber;
+        workspaceDiffHash: z.ZodString;
+        hostVerification: z.ZodOptional<z.ZodObject<{
+            passed: z.ZodBoolean;
+            summary: z.ZodString;
+            commands: z.ZodArray<z.ZodObject<{
+                command: z.ZodString;
+                args: z.ZodArray<z.ZodString>;
+                exitCode: z.ZodNullable<z.ZodNumber>;
+                stdout: z.ZodOptional<z.ZodString>;
+                stderr: z.ZodOptional<z.ZodString>;
+                truncated: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+        }, z.core.$strict>>;
+    }, z.core.$strict>>;
     createdAt: z.ZodString;
     updatedAt: z.ZodString;
 }, z.core.$strict>;

package/dist/harness/invariants.d.ts

@@ -0,0 +1,4 @@
+import type { HarnessJournalRecord } from "./journal.js";
+/** Mechanical replay invariants owned by the durable harness package. */
+export declare function harnessInvariantViolations(records: readonly HarnessJournalRecord[]): string[];
+export declare function assertHarnessInvariants(records: readonly HarnessJournalRecord[]): void;

package/dist/harness/journal.d.ts

@@ -0,0 +1,109 @@
+import { z } from "zod";
+export declare const HARNESS_JOURNAL_VERSION: 1;
+declare const EventTypeSchema: z.ZodEnum<{
+    "model.completed": "model.completed";
+    "model.requested": "model.requested";
+    "queue.acked": "queue.acked";
+    "queue.admitted": "queue.admitted";
+    "queue.claimed": "queue.claimed";
+    "queue.released": "queue.released";
+    "recovery.completed": "recovery.completed";
+    "savepoint.created": "savepoint.created";
+    "tool.completed": "tool.completed";
+    "tool.interrupted": "tool.interrupted";
+    "tool.started": "tool.started";
+    "turn.completed": "turn.completed";
+    "turn.interrupted": "turn.interrupted";
+    "turn.started": "turn.started";
+}>;
+declare const JournalRecordSchema: z.ZodObject<{
+    version: z.ZodLiteral<1>;
+    sequence: z.ZodNumber;
+    id: z.ZodString;
+    timestamp: z.ZodString;
+    type: z.ZodEnum<{
+        "model.completed": "model.completed";
+        "model.requested": "model.requested";
+        "queue.acked": "queue.acked";
+        "queue.admitted": "queue.admitted";
+        "queue.claimed": "queue.claimed";
+        "queue.released": "queue.released";
+        "recovery.completed": "recovery.completed";
+        "savepoint.created": "savepoint.created";
+        "tool.completed": "tool.completed";
+        "tool.interrupted": "tool.interrupted";
+        "tool.started": "tool.started";
+        "turn.completed": "turn.completed";
+        "turn.interrupted": "turn.interrupted";
+        "turn.started": "turn.started";
+    }>;
+    payload: z.ZodRecord<z.ZodString, z.ZodUnknown>;
+    previousHash: z.ZodNullable<z.ZodString>;
+    hash: z.ZodString;
+}, z.core.$strict>;
+export type HarnessJournalEventType = z.infer<typeof EventTypeSchema>;
+export type HarnessJournalRecord = z.infer<typeof JournalRecordSchema>;
+export interface DurableQueueItem<T = unknown> {
+    id: string;
+    kind: "steer" | "followUp";
+    payload: T;
+    admittedAt: string;
+    recovered: boolean;
+}
+export interface IncompleteToolCall {
+    id: string;
+    tool: string;
+    retrySafe: boolean;
+    inputHash: string;
+}
+export interface HarnessRecovery<T = unknown> {
+    queue: DurableQueueItem<T>[];
+    incompleteTools: IncompleteToolCall[];
+    incompleteModelIds: string[];
+    interruptedTurnIds: string[];
+    lastSavepoint?: {
+        id: string;
+        phase: string;
+        configHash: string;
+    };
+}
+export interface HarnessJournalOptions {
+    workspace: string;
+    sessionId: string;
+    now?(): string;
+    maxBytes?: number;
+}
+/**
+ * Crash-consistent, hash-chained execution journal. Queue admission uses a
+ * synchronous fsync because returning from steer/followUp is the durability
+ * boundary: once the UI says "queued", the prompt must survive a hard crash.
+ */
+export declare class HarnessJournal {
+    #private;
+    constructor(options: HarnessJournalOptions);
+    get path(): string;
+    get records(): readonly HarnessJournalRecord[];
+    admitQueue<T>(kind: "steer" | "followUp", payload: T): string;
+    claimQueue(id: string): void;
+    ackQueue(id: string): void;
+    releaseQueue(id: string, reason: string): void;
+    startTurn(config: unknown, prompt: unknown): string;
+    completeTurn(id: string): void;
+    interruptTurn(id: string, reason: string): void;
+    startModel(input: {
+        agent: string;
+        model: string;
+        iteration: number;
+        attempt: number;
+        messages: unknown;
+    }): string;
+    completeModel(id: string, completed: boolean, error?: string): void;
+    startTool(tool: string, input: unknown, retrySafe: boolean): string;
+    completeTool(id: string, result: unknown): void;
+    interruptTool(id: string, reason: string): void;
+    savepoint(phase: string, config: unknown): string;
+    recover<T = unknown>(): HarnessRecovery<T>;
+    markRecoveryComplete(recovery: HarnessRecovery): void;
+}
+export declare function hashJson(value: unknown): string;
+export {};

package/dist/harness/local.d.ts

@@ -1,12 +1,13 @@
-import { AgentLoop } from "../agent/loop.js";
+import { AgentLoop, type AgentLoopOptions } from "../agent/loop.js";
 import type { TaskNode } from "../agent/planner.js";
 import type { HallucinationGuard } from "../hallucination/guard.js";
 import type { PermissionMode, PermissionProfile } from "../permissions/engine.js";
+import type { CompiledPermissionPolicy } from "../permissions/policy.js";
 import type { ContextManager } from "../context/manager.js";
 import type { HookBus } from "../hooks/bus.js";
 import type { ModelRegistry } from "../models/registry.js";
 import type { ModelTool } from "../models/types.js";
-import { ToolRuntime, type ApprovalCallback } from "../tools/runtime.js";
+import { ToolRuntime, type ApprovalCallback, type ToolRuntimeOptions } from "../tools/runtime.js";
 import type { ToolDefinition } from "../tools/types.js";
 export interface LocalHarnessOptions {
     registry: ModelRegistry;
@@ -25,6 +26,9 @@ export interface LocalHarnessOptions {
     /** When true, non-destructive tools skip the approval callback. Destructive tools still require confirmation. */
     loopMode?: boolean;
     afterToolSuccess?(tool: string, paths: readonly string[], input: unknown, output: unknown, context: import("../tools/types.js").ToolContext): Promise<readonly string[]>;
+    toolJournal?: ToolRuntimeOptions["journal"];
+    permissionPolicy?: CompiledPermissionPolicy;
+    modelJournal?: AgentLoopOptions["modelJournal"];
 }
 export interface HarnessProfile {
     modelId: string;

package/dist/permissions/engine.d.ts

@@ -1,4 +1,5 @@
 import { type LegacyPermissionMode, type PermissionMode } from "../config/schema.js";
+import type { CompiledPermissionPolicy } from "./policy.js";
 export type { PermissionMode } from "../config/schema.js";
 export type PermissionDecision = {
     decision: "allow" | "deny" | "ask";
@@ -22,6 +23,7 @@ export interface PermissionEngineOptions {
     workspace: string;
     mode?: PermissionMode | LegacyPermissionMode;
     profile?: PermissionProfile;
+    policy?: CompiledPermissionPolicy;
 }
 export type ToolCategory = "control" | "read" | "write" | "destructive" | "shell" | "network" | "unknown";
 export declare function getToolCategory(name: string): ToolCategory;

package/dist/permissions/policy.d.ts

@@ -0,0 +1,38 @@
+import { z } from "zod";
+import type { PermissionDecision, PermissionRequest } from "./engine.js";
+declare const RuleSchema: z.ZodObject<{
+    id: z.ZodString;
+    decision: z.ZodEnum<{
+        allow: "allow";
+        ask: "ask";
+        deny: "deny";
+    }>;
+    prefix: z.ZodArray<z.ZodString>;
+    tool: z.ZodOptional<z.ZodString>;
+    agent: z.ZodOptional<z.ZodEnum<{
+        main: "main";
+        subagent: "subagent";
+    }>>;
+    justification: z.ZodOptional<z.ZodString>;
+    match: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+    notMatch: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString>>>;
+}, z.core.$strict>;
+export type PermissionRule = z.infer<typeof RuleSchema> & {
+    source: string;
+    tier: "managed" | "user" | "project" | "local" | "session";
+};
+export interface PermissionPolicyLoadOptions {
+    workspace: string;
+    home: string;
+    managedPath?: string;
+    sessionRules?: readonly z.input<typeof RuleSchema>[];
+}
+export declare class CompiledPermissionPolicy {
+    #private;
+    readonly diagnostics: readonly string[];
+    constructor(rules: readonly PermissionRule[], diagnostics?: readonly string[]);
+    get rules(): readonly PermissionRule[];
+    decide(request: PermissionRequest): PermissionDecision | undefined;
+}
+export declare function loadPermissionPolicy(options: PermissionPolicyLoadOptions): Promise<CompiledPermissionPolicy>;
+export {};

package/dist/plugins/types.d.ts

@@ -10,6 +10,9 @@ export declare const PluginManifestSchema: z.ZodObject<{
     permissions: z.ZodArray<z.ZodEnum<{
         "filesystem:read": "filesystem:read";
         "filesystem:write": "filesystem:write";
+        network: "network";
+        process: "process";
+        "runtime:in-process": "runtime:in-process";
     }>>;
     contributes: z.ZodObject<{
         commands: z.ZodArray<z.ZodObject<{
@@ -74,8 +77,9 @@ export interface PluginCommandContext {
 }
 export type PluginCommandHandler = (args: readonly string[], context: PluginCommandContext) => unknown | Promise<unknown>;
 /**
- * A deliberately narrow registration surface. Plugins run in-process and are trusted in the
- * MVP: this API mediates host-provided capabilities, but it is not a Node.js process sandbox.
+ * A deliberately narrow registration surface. Production runs plugins in an
+ * isolated Worker/vm realm by default. Hosts that explicitly opt into legacy
+ * in-process activation must treat the plugin as fully trusted Node.js code.
  */
 export interface PluginContext {
     readonly signal: AbortSignal;
@@ -107,6 +111,18 @@ export interface LoadedPlugin {
     readonly version: string;
     readonly source: PluginSource;
     readonly root: string;
+    readonly fingerprint: string;
+    readonly sandboxed: boolean;
+    readonly permissions: readonly PluginPermission[];
+}
+export interface PluginTrustRequest {
+    readonly name: string;
+    readonly version: string;
+    readonly source: PluginSource;
+    readonly root: string;
+    readonly fingerprint: string;
+    readonly sandboxed: boolean;
+    readonly permissions: readonly PluginPermission[];
 }
 export interface PluginRegistrationCallbacks {
     command(name: string, command: PluginCommandHandler, description?: string): PluginDisposer;
@@ -137,4 +153,8 @@ export interface PluginHostOptions {
     /** When true, plugin modules run in an isolated Worker/vm realm. Only relative
      *  modules inside the plugin root and RPC-backed contribution calls are available. */
     sandbox?: boolean;
+    /** Trust gate evaluated against the content fingerprint before activation. */
+    authorizePlugin?: (request: PluginTrustRequest) => boolean | Promise<boolean>;
+    /** Legacy in-process execution requires both a manifest capability and trust approval. */
+    requireInProcessTrust?: boolean;
 }

package/dist/production.d.ts

@@ -37,6 +37,9 @@ export interface ProductionRuntimeOptions {
     shutdownStepTimeoutMs?: number;
     /** Additional tools provided by embedders (e.g. desktop-only D2C tools). */
     extraTools?: readonly ToolDefinition<unknown>[];
+    /** Compatibility seam for explicitly trusted legacy plugins. Product
+     * runtimes default to Worker/vm isolation. */
+    pluginSandbox?: boolean;
     /** Explicitly opt into CLI-local collaboration. Omit for print/RPC/eval callers. */
     collaboration?: {
         instanceId: string;

package/dist/sdk/index.js

@@ -4,7 +4,7 @@ import {
   FlavorRpcServer,
   TraceRecordSchema,
   TraceRecorder
-} from "../chunk-A7PMQ22O.js";
+} from "../chunk-IX65GYUF.js";
 import {
   AgentMessageQueue,
   DockerExecutionEnvironment,
@@ -13,7 +13,7 @@ import {
   WorkspaceCheckpointStore,
   buildDockerInvocation,
   createProductionRuntime
-} from "../chunk-AXLUVJKC.js";
+} from "../chunk-KL4UHJ2Q.js";
 import "../chunk-IG4Z23CL.js";
 import "../chunk-RQTYHUMK.js";
 import "../chunk-S32JRDZK.js";

package/dist/session/store.d.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import { type TranscriptState } from "../ui/transcript.js";
 import type { ModelContent } from "../models/types.js";
-export declare const SESSION_VERSION: 3;
+export declare const SESSION_VERSION: 4;
 export declare const DEFAULT_MAX_SESSION_BYTES: number;
 export declare const SessionDocumentSchema: z.ZodObject<{
     sessionId: z.ZodString;
@@ -93,12 +93,31 @@ export declare const SessionDocumentSchema: z.ZodObject<{
         finalizedAt: z.ZodOptional<z.ZodString>;
         transcriptHash: z.ZodOptional<z.ZodString>;
     }, z.core.$strict>>;
-    version: z.ZodLiteral<3>;
+    version: z.ZodLiteral<4>;
     conversation: z.ZodObject<{
         compact: z.ZodOptional<z.ZodObject<{
             summary: z.ZodString;
             compactedAt: z.ZodString;
         }, z.core.$strict>>;
+        epoch: z.ZodOptional<z.ZodObject<{
+            version: z.ZodLiteral<1>;
+            id: z.ZodString;
+            startedAt: z.ZodString;
+            stableMessages: z.ZodArray<z.ZodObject<{
+                role: z.ZodLiteral<"system">;
+                content: z.ZodString;
+                cacheBreakpoint: z.ZodOptional<z.ZodBoolean>;
+            }, z.core.$strict>>;
+            sources: z.ZodRecord<z.ZodString, z.ZodString>;
+            stableSourceHash: z.ZodString;
+        }, z.core.$strict>>;
+        visibilityLog: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            id: z.ZodString;
+            role: z.ZodLiteral<"system">;
+            content: z.ZodString;
+            admittedAt: z.ZodString;
+            scope: z.ZodLiteral<"run">;
+        }, z.core.$strict>>>;
         messages: z.ZodArray<z.ZodDiscriminatedUnion<[z.ZodObject<{
             toolCallId: z.ZodOptional<z.ZodString>;
             toolCalls: z.ZodOptional<z.ZodArray<z.ZodObject<{
@@ -108,6 +127,15 @@ export declare const SessionDocumentSchema: z.ZodObject<{
             }, z.core.$strict>>>;
             role: z.ZodLiteral<"user">;
             content: z.ZodType<ModelContent, unknown, z.core.$ZodTypeInternals<ModelContent, unknown>>;
+        }, z.core.$strict>, z.ZodObject<{
+            toolCallId: z.ZodOptional<z.ZodString>;
+            toolCalls: z.ZodOptional<z.ZodArray<z.ZodObject<{
+                id: z.ZodString;
+                name: z.ZodString;
+                input: z.ZodUnknown;
+            }, z.core.$strict>>>;
+            role: z.ZodLiteral<"system">;
+            content: z.ZodString;
         }, z.core.$strict>, z.ZodObject<{
             toolCallId: z.ZodOptional<z.ZodString>;
             toolCalls: z.ZodOptional<z.ZodArray<z.ZodObject<{

package/dist/tools/runtime.d.ts

@@ -20,6 +20,11 @@ export interface ToolRuntimeOptions {
     /** Inline tool-result content budgets. */
     outputLimits?: Partial<ToolOutputLimits>;
     afterSuccess?(tool: string, paths: readonly string[], input: unknown, output: unknown, context: ToolContext): Promise<readonly string[]>;
+    journal?: {
+        start(tool: string, input: unknown, retrySafe: boolean): string;
+        complete(id: string, result: ToolResult): void;
+        interrupt(id: string, reason: string): void;
+    };
 }
 export interface ToolOutputLimits {
     perToolChars: number;

package/dist/tools/types.d.ts

@@ -91,6 +91,9 @@ export interface ToolDefinition<T, O = unknown> {
     modelStrict?: boolean;
     /** Declared read-only: allowed without approval, same as Read/Glob/Grep (including plan mode). */
     readOnly?: boolean;
+    /** Explicitly safe to retry after an interrupted process. Defaults to false;
+     *  read-only tools are treated as retry-safe by the durable harness. */
+    retrySafe?: boolean;
     paths(input: T): string[];
     /**
      * Optional short human-readable parameter summary, rendered dimmed next to the tool name.

package/dist/ui/session.d.ts

@@ -156,6 +156,17 @@ export interface SessionServices {
     login(): Promise<string>;
     logout(): Promise<string>;
     pals?: PalSessionServices;
+    durableQueue?: {
+        recover(): readonly {
+            id: string;
+            kind: "steer" | "followUp";
+            payload: unknown;
+        }[];
+        admit(kind: "steer" | "followUp", payload: unknown): string;
+        claim(id: string): void;
+        ack(id: string): void;
+        release(id: string, reason: string): void;
+    };
 }
 export interface MultimodalSessionInput {
     text: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "flavor-code",
-  "version": "1.2.20",
+  "version": "1.3.0",
   "author": "YachuanWzh",
   "type": "module",
   "publishConfig": {
@@ -44,7 +44,8 @@
     "desktop:start": "npm run build && electron .",
     "desktop:pack": "npm run build && electron-builder --win --dir",
     "desktop:dist": "npm run build && electron-builder --win nsis",
-    "test": "vitest run",
+    "test": "vitest run",
+    "test:reliability": "vitest run tests/harness/journal.test.ts tests/context/manager.test.ts tests/session/store.test.ts tests/permissions/policy.test.ts tests/goal/classifier.test.ts tests/goal/orchestrator.test.ts",
     "test:watch": "vitest",
     "test:desktop:e2e": "npm run build:desktop && node tests/desktop/electron-app.e2e.mjs",
     "typecheck": "tsc --noEmit",