freeturtle 0.1.0

package/dist/src/policy.js

@@ -0,0 +1,164 @@
+// Empty allowlist = deny all for that domain
+// undefined/not set = allow all (no restriction)
+export class PolicyDeniedError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.name = "PolicyDeniedError";
+        this.code = code;
+    }
+}
+/**
+ * Core allowlist check:
+ * - undefined = no restrictions (allow all)
+ * - empty array [] = deny everything
+ * - populated array = only allow listed values (case-insensitive)
+ */
+function assertAllowed(allowlist, value, code, label) {
+    if (allowlist === undefined)
+        return; // not configured = allow all
+    if (allowlist.length === 0) {
+        throw new PolicyDeniedError(code, `${label} denied: no entries are allowed (empty allowlist)`);
+    }
+    const lower = value.toLowerCase();
+    const match = allowlist.some((item) => item.toLowerCase() === lower);
+    if (!match) {
+        throw new PolicyDeniedError(code, `${label} denied: "${value}" is not in the allowlist [${allowlist.join(", ")}]`);
+    }
+}
+export function assertGithubRepoAllowed(policy, repo) {
+    if (!policy)
+        return;
+    assertAllowed(policy.github?.allowed_repos, repo, "GITHUB_REPO_DENIED", "GitHub repo");
+}
+export function assertGithubPathAllowed(policy, path) {
+    if (!policy)
+        return;
+    assertAllowed(policy.github?.allowed_paths, path, "GITHUB_PATH_DENIED", "GitHub path");
+}
+export function assertGithubBranchAllowed(policy, branch) {
+    if (!policy)
+        return;
+    assertAllowed(policy.github?.approval_required_branches, branch, "GITHUB_BRANCH_DENIED", "GitHub branch");
+}
+export function assertFarcasterChannelAllowed(policy, channel) {
+    if (!policy)
+        return;
+    assertAllowed(policy.farcaster?.allowed_channels, channel, "FARCASTER_CHANNEL_DENIED", "Farcaster channel");
+}
+export function assertDatabaseScopeAllowed(policy, schema, table) {
+    if (!policy)
+        return;
+    assertAllowed(policy.database?.allowed_schemas, schema, "DATABASE_SCHEMA_DENIED", "Database schema");
+    assertAllowed(policy.database?.allowed_tables, table, "DATABASE_TABLE_DENIED", "Database table");
+}
+export function assertOnchainScopeAllowed(policy, contract, fn) {
+    if (!policy)
+        return;
+    assertAllowed(policy.onchain?.allowed_contracts, contract, "ONCHAIN_CONTRACT_DENIED", "Onchain contract");
+    if (fn !== undefined) {
+        assertAllowed(policy.onchain?.allowed_read_functions, fn, "ONCHAIN_FUNCTION_DENIED", "Onchain function");
+    }
+}
+/**
+ * Determines whether a tool call requires human approval before execution.
+ * - delete_cast => always true
+ * - commit_file => true if branch is in approval_required_branches (default ["main"])
+ * - everything else => false
+ */
+export function requiresApproval(policy, toolName, input) {
+    if (toolName === "delete_cast")
+        return true;
+    if (toolName === "commit_file") {
+        const branch = input.branch ?? "main";
+        const approvalBranches = policy?.github?.approval_required_branches ?? ["main"];
+        return approvalBranches.some((b) => b.toLowerCase() === branch.toLowerCase());
+    }
+    return false;
+}
+export function getDefaultPolicy() {
+    return {
+        github: {
+            allowed_repos: [],
+            allowed_paths: [],
+            approval_required_branches: ["main"],
+        },
+        farcaster: {
+            allowed_channels: [],
+        },
+        database: {
+            allowed_schemas: [],
+            allowed_tables: [],
+        },
+        onchain: {
+            allowed_contracts: [],
+            allowed_read_functions: [],
+        },
+        approvals: {
+            timeout_seconds: 300,
+            fail_mode: "deny",
+        },
+    };
+}
+/**
+ * Parse a raw config object (from the ## Policy section) into a PolicyConfig.
+ * Expects subsections like github.allowed_repos as comma-separated strings.
+ */
+export function parsePolicy(raw) {
+    const defaults = getDefaultPolicy();
+    function parseList(value) {
+        if (value === undefined)
+            return undefined;
+        if (typeof value === "boolean")
+            return [];
+        const trimmed = value.trim();
+        if (trimmed === "")
+            return [];
+        return trimmed.split(",").map((s) => s.trim()).filter((s) => s.length > 0);
+    }
+    function parseString(value, fallback) {
+        if (value === undefined || typeof value === "boolean")
+            return fallback;
+        return value.trim() || fallback;
+    }
+    function parseNumber(value, fallback) {
+        if (value === undefined || typeof value === "boolean")
+            return fallback;
+        const n = Number(value);
+        return Number.isNaN(n) ? fallback : n;
+    }
+    const github = raw.github ?? {};
+    const farcaster = raw.farcaster ?? {};
+    const database = raw.database ?? {};
+    const onchain = raw.onchain ?? {};
+    const approvals = raw.approvals ?? {};
+    return {
+        github: {
+            allowed_repos: parseList(github.allowed_repos) ?? defaults.github.allowed_repos,
+            allowed_paths: parseList(github.allowed_paths) ?? defaults.github.allowed_paths,
+            approval_required_branches: parseList(github.approval_required_branches) ??
+                defaults.github.approval_required_branches,
+        },
+        farcaster: {
+            allowed_channels: parseList(farcaster.allowed_channels) ??
+                defaults.farcaster.allowed_channels,
+        },
+        database: {
+            allowed_schemas: parseList(database.allowed_schemas) ??
+                defaults.database.allowed_schemas,
+            allowed_tables: parseList(database.allowed_tables) ??
+                defaults.database.allowed_tables,
+        },
+        onchain: {
+            allowed_contracts: parseList(onchain.allowed_contracts) ??
+                defaults.onchain.allowed_contracts,
+            allowed_read_functions: parseList(onchain.allowed_read_functions) ??
+                defaults.onchain.allowed_read_functions,
+        },
+        approvals: {
+            timeout_seconds: parseNumber(approvals.timeout_seconds, defaults.approvals.timeout_seconds),
+            fail_mode: parseString(approvals.fail_mode, defaults.approvals.fail_mode),
+        },
+    };
+}
+//# sourceMappingURL=policy.js.map

package/dist/src/policy.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"policy.js","sourceRoot":"","sources":["../../src/policy.ts"],"names":[],"mappings":"AAwBA,6CAA6C;AAC7C,iDAAiD;AAEjD,MAAM,OAAO,iBAAkB,SAAQ,KAAK;IAC1C,IAAI,CAAS;IACb,YAAY,IAAY,EAAE,OAAe;QACvC,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,mBAAmB,CAAC;QAChC,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,SAA+B,EAC/B,KAAa,EACb,IAAY,EACZ,KAAa;IAEb,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,CAAC,6BAA6B;IAClE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC3B,MAAM,IAAI,iBAAiB,CAAC,IAAI,EAAE,GAAG,KAAK,mDAAmD,CAAC,CAAC;IACjG,CAAC;IACD,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,CAAC;IACrE,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,iBAAiB,CACzB,IAAI,EACJ,GAAG,KAAK,aAAa,KAAK,8BAA8B,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAChF,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,IAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,MAAgC,EAChC,IAAY;IAEZ,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CAAC,MAAM,CAAC,MAAM,EAAE,aAAa,EAAE,IAAI,EAAE,oBAAoB,EAAE,aAAa,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAgC,EAChC,MAAc;IAEd,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CACX,MAAM,CAAC,MAAM,EAAE,0BAA0B,EACzC,MAAM,EACN,sBAAsB,EACtB,eAAe,CAChB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,6BAA6B,CAC3C,MAAgC,EAChC,OAAe;IAEf,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CACX,MAAM,CAAC,SAAS,EAAE,gBAAgB,EAClC,OAAO,EACP,0BAA0B,EAC1B,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,MAAgC,EAChC,MAAc,EACd,KAAa;IAEb,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CACX,MAAM,CAAC,QAAQ,EAAE,eAAe,EAChC,MAAM,EACN,wBAAwB,EACxB,iBAAiB,CAClB,CAAC;IACF,aAAa,CACX,MAAM,CAAC,QAAQ,EAAE,cAAc,EAC/B,KAAK,EACL,uBAAuB,EACvB,gBAAgB,CACjB,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAgC,EAChC,QAAgB,EAChB,EAAW;IAEX,IAAI,CAAC,MAAM;QAAE,OAAO;IACpB,aAAa,CACX,MAAM,CAAC,OAAO,EAAE,iBAAiB,EACjC,QAAQ,EACR,yBAAyB,EACzB,kBAAkB,CACnB,CAAC;IACF,IAAI,EAAE,KAAK,SAAS,EAAE,CAAC;QACrB,aAAa,CACX,MAAM,CAAC,OAAO,EAAE,sBAAsB,EACtC,EAAE,EACF,yBAAyB,EACzB,kBAAkB,CACnB,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAC9B,MAAgC,EAChC,QAAgB,EAChB,KAA8B;IAE9B,IAAI,QAAQ,KAAK,aAAa;QAAE,OAAO,IAAI,CAAC;IAE5C,IAAI,QAAQ,KAAK,aAAa,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAI,KAAK,CAAC,MAAiB,IAAI,MAAM,CAAC;QAClD,MAAM,gBAAgB,GACpB,MAAM,EAAE,MAAM,EAAE,0BAA0B,IAAI,CAAC,MAAM,CAAC,CAAC;QACzD,OAAO,gBAAgB,CAAC,IAAI,CAC1B,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAChD,CAAC;IACJ,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,gBAAgB;IAC9B,OAAO;QACL,MAAM,EAAE;YACN,aAAa,EAAE,EAAE;YACjB,aAAa,EAAE,EAAE;YACjB,0BAA0B,EAAE,CAAC,MAAM,CAAC;SACrC;QACD,SAAS,EAAE;YACT,gBAAgB,EAAE,EAAE;SACrB;QACD,QAAQ,EAAE;YACR,eAAe,EAAE,EAAE;YACnB,cAAc,EAAE,EAAE;SACnB;QACD,OAAO,EAAE;YACP,iBAAiB,EAAE,EAAE;YACrB,sBAAsB,EAAE,EAAE;SAC3B;QACD,SAAS,EAAE;YACT,eAAe,EAAE,GAAG;YACpB,SAAS,EAAE,MAAM;SAClB;KACF,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,WAAW,CACzB,GAAqD;IAErD,MAAM,QAAQ,GAAG,gBAAgB,EAAE,CAAC;IAEpC,SAAS,SAAS,CAAC,KAAmC;QACpD,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO,SAAS,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9B,OAAO,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC7E,CAAC;IAED,SAAS,WAAW,CAClB,KAAmC,EACnC,QAAgB;QAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACvE,OAAO,KAAK,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC;IAClC,CAAC;IAED,SAAS,WAAW,CAClB,KAAmC,EACnC,QAAgB;QAEhB,IAAI,KAAK,KAAK,SAAS,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,QAAQ,CAAC;QACvE,MAAM,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QACxB,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACxC,CAAC;IAED,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;IAChC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,GAAG,CAAC,SAAS,IAAI,EAAE,CAAC;IAEtC,OAAO;QACL,MAAM,EAAE;YACN,aAAa,EACX,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa;YAClE,aAAa,EACX,SAAS,CAAC,MAAM,CAAC,aAAa,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,aAAa;YAClE,0BAA0B,EACxB,SAAS,CAAC,MAAM,CAAC,0BAA0B,CAAC;gBAC5C,QAAQ,CAAC,MAAM,CAAC,0BAA0B;SAC7C;QACD,SAAS,EAAE;YACT,gBAAgB,EACd,SAAS,CAAC,SAAS,CAAC,gBAAgB,CAAC;gBACrC,QAAQ,CAAC,SAAS,CAAC,gBAAgB;SACtC;QACD,QAAQ,EAAE;YACR,eAAe,EACb,SAAS,CAAC,QAAQ,CAAC,eAAe,CAAC;gBACnC,QAAQ,CAAC,QAAQ,CAAC,eAAe;YACnC,cAAc,EACZ,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;gBAClC,QAAQ,CAAC,QAAQ,CAAC,cAAc;SACnC;QACD,OAAO,EAAE;YACP,iBAAiB,EACf,SAAS,CAAC,OAAO,CAAC,iBAAiB,CAAC;gBACpC,QAAQ,CAAC,OAAO,CAAC,iBAAiB;YACpC,sBAAsB,EACpB,SAAS,CAAC,OAAO,CAAC,sBAAsB,CAAC;gBACzC,QAAQ,CAAC,OAAO,CAAC,sBAAsB;SAC1C;QACD,SAAS,EAAE;YACT,eAAe,EAAE,WAAW,CAC1B,SAAS,CAAC,eAAe,EACzB,QAAQ,CAAC,SAAS,CAAC,eAAe,CACnC;YACD,SAAS,EACN,WAAW,CAAC,SAAS,CAAC,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,SAAS,CAElD;SACf;KACF,CAAC;AACJ,CAAC"}

package/dist/src/redaction.d.ts

@@ -0,0 +1,13 @@
+export declare const SENSITIVE_KEYS: string[];
+export declare const SENSITIVE_PATTERNS: RegExp[];
+/**
+ * Deep clone and redact sensitive fields/patterns.
+ * - For objects: if key matches SENSITIVE_KEYS, replace value with "***"
+ * - For strings: replace SENSITIVE_PATTERNS matches with first 4 chars + "***"
+ * - Recurse into arrays and nested objects
+ */
+export declare function redact(obj: unknown): unknown;
+/**
+ * Replace sensitive patterns in a string with the first 4 characters + "***".
+ */
+export declare function redactString(str: string): string;

package/dist/src/redaction.js

@@ -0,0 +1,75 @@
+// List of keys that should be redacted in nested objects
+export const SENSITIVE_KEYS = [
+    "password",
+    "token",
+    "secret",
+    "key",
+    "mnemonic",
+    "signer_uuid",
+    "api_key",
+    "auth",
+    "credential",
+];
+// Mask patterns in strings (API keys, tokens, etc)
+export const SENSITIVE_PATTERNS = [
+    /sk-[a-zA-Z0-9]{20,}/g, // Anthropic/OpenAI keys
+    /ghp_[a-zA-Z0-9]{36}/g, // GitHub tokens
+    /neynar-[a-zA-Z0-9]+/g, // Neynar keys
+    /0x[a-fA-F0-9]{64}/g, // Private keys (64 hex chars)
+];
+/**
+ * Deep clone and redact sensitive fields/patterns.
+ * - For objects: if key matches SENSITIVE_KEYS, replace value with "***"
+ * - For strings: replace SENSITIVE_PATTERNS matches with first 4 chars + "***"
+ * - Recurse into arrays and nested objects
+ */
+export function redact(obj) {
+    return redactValue(obj, false);
+}
+function redactValue(value, isSensitiveKey) {
+    if (value === null || value === undefined)
+        return value;
+    // If this value sits under a sensitive key, mask it entirely
+    if (isSensitiveKey) {
+        if (typeof value === "string")
+            return "***";
+        if (typeof value === "number" || typeof value === "boolean")
+            return "***";
+        // For objects/arrays under a sensitive key, still mask to "***"
+        return "***";
+    }
+    if (typeof value === "string") {
+        return redactString(value);
+    }
+    if (typeof value === "number" || typeof value === "boolean") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value.map((item) => redactValue(item, false));
+    }
+    if (typeof value === "object") {
+        const result = {};
+        for (const [k, v] of Object.entries(value)) {
+            const keyIsSensitive = SENSITIVE_KEYS.some((sk) => k.toLowerCase().includes(sk));
+            result[k] = redactValue(v, keyIsSensitive);
+        }
+        return result;
+    }
+    return value;
+}
+/**
+ * Replace sensitive patterns in a string with the first 4 characters + "***".
+ */
+export function redactString(str) {
+    let result = str;
+    for (const pattern of SENSITIVE_PATTERNS) {
+        // Reset lastIndex since these are global regexes
+        pattern.lastIndex = 0;
+        result = result.replace(pattern, (match) => {
+            const prefix = match.slice(0, 4);
+            return `${prefix}***`;
+        });
+    }
+    return result;
+}
+//# sourceMappingURL=redaction.js.map

package/dist/src/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../../src/redaction.ts"],"names":[],"mappings":"AAAA,yDAAyD;AACzD,MAAM,CAAC,MAAM,cAAc,GAAG;IAC5B,UAAU;IACV,OAAO;IACP,QAAQ;IACR,KAAK;IACL,UAAU;IACV,aAAa;IACb,SAAS;IACT,MAAM;IACN,YAAY;CACb,CAAC;AAEF,mDAAmD;AACnD,MAAM,CAAC,MAAM,kBAAkB,GAAG;IAChC,sBAAsB,EAAE,wBAAwB;IAChD,sBAAsB,EAAE,gBAAgB;IACxC,sBAAsB,EAAE,cAAc;IACtC,oBAAoB,EAAE,8BAA8B;CACrD,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,GAAY;IACjC,OAAO,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;AACjC,CAAC;AAED,SAAS,WAAW,CAAC,KAAc,EAAE,cAAuB;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAExD,6DAA6D;IAC7D,IAAI,cAAc,EAAE,CAAC;QACnB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC;QAC1E,gEAAgE;QAChE,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,YAAY,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,SAAS,EAAE,CAAC;QAC5D,OAAO,KAAK,CAAC;IACf,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,MAAM,GAA4B,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAgC,CAAC,EAAE,CAAC;YACtE,MAAM,cAAc,GAAG,cAAc,CAAC,IAAI,CACxC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CACrC,CAAC;YACF,MAAM,CAAC,CAAC,CAAC,GAAG,WAAW,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;QAC7C,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,IAAI,MAAM,GAAG,GAAG,CAAC;IACjB,KAAK,MAAM,OAAO,IAAI,kBAAkB,EAAE,CAAC;QACzC,iDAAiD;QACjD,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YACzC,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACjC,OAAO,GAAG,MAAM,KAAK,CAAC;QACxB,CAAC,CAAC,CAAC;IACL,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/src/reliability.d.ts

@@ -0,0 +1,16 @@
+export interface RetryOptions {
+    maxRetries: number;
+    baseDelayMs: number;
+    maxDelayMs: number;
+    timeoutMs: number;
+    retryOn?: (err: unknown) => boolean;
+}
+/**
+ * Default classifier: retry on network errors, 429, 5xx.
+ * Don't retry 4xx (except 429).
+ */
+export declare function isRetryable(err: unknown): boolean;
+/**
+ * Wraps an async function with timeout + exponential backoff + jitter.
+ */
+export declare function withRetry<T>(fn: () => Promise<T>, opts?: Partial<RetryOptions>): Promise<T>;

package/dist/src/reliability.js

@@ -0,0 +1,124 @@
+const DEFAULT_OPTIONS = {
+    maxRetries: 3,
+    baseDelayMs: 1000,
+    maxDelayMs: 30000,
+    timeoutMs: 30000,
+};
+/**
+ * Default classifier: retry on network errors, 429, 5xx.
+ * Don't retry 4xx (except 429).
+ */
+export function isRetryable(err) {
+    if (err === null || err === undefined)
+        return false;
+    // Check for status/statusCode properties (HTTP errors)
+    if (typeof err === "object") {
+        const obj = err;
+        const status = typeof obj.status === "number"
+            ? obj.status
+            : typeof obj.statusCode === "number"
+                ? obj.statusCode
+                : undefined;
+        if (status !== undefined) {
+            if (status === 429)
+                return true; // rate limited
+            if (status >= 500)
+                return true; // server errors
+            if (status >= 400 && status < 500)
+                return false; // client errors (except 429)
+        }
+        // Check for response.status (e.g. fetch-style errors)
+        if (typeof obj.response === "object" &&
+            obj.response !== null) {
+            const resp = obj.response;
+            const respStatus = typeof resp.status === "number" ? resp.status : undefined;
+            if (respStatus !== undefined) {
+                if (respStatus === 429)
+                    return true;
+                if (respStatus >= 500)
+                    return true;
+                if (respStatus >= 400 && respStatus < 500)
+                    return false;
+            }
+        }
+        // Network errors (Node.js)
+        const code = typeof obj.code === "string" ? obj.code : "";
+        const networkCodes = [
+            "ECONNRESET",
+            "ECONNREFUSED",
+            "ENOTFOUND",
+            "ETIMEDOUT",
+            "EPIPE",
+            "EAI_AGAIN",
+            "ENETUNREACH",
+            "EHOSTUNREACH",
+            "UND_ERR_SOCKET",
+            "UND_ERR_CONNECT_TIMEOUT",
+            "FETCH_ERROR",
+        ];
+        if (networkCodes.includes(code))
+            return true;
+    }
+    // Check error message for common network issues
+    if (err instanceof Error) {
+        const msg = err.message.toLowerCase();
+        if (msg.includes("network") ||
+            msg.includes("timeout") ||
+            msg.includes("econnreset") ||
+            msg.includes("econnrefused") ||
+            msg.includes("socket hang up") ||
+            msg.includes("fetch failed")) {
+            return true;
+        }
+    }
+    return false;
+}
+/**
+ * Wraps an async function with timeout + exponential backoff + jitter.
+ */
+export async function withRetry(fn, opts) {
+    const options = { ...DEFAULT_OPTIONS, ...opts };
+    const classifier = options.retryOn ?? isRetryable;
+    let lastError;
+    for (let attempt = 0; attempt <= options.maxRetries; attempt++) {
+        try {
+            const result = await withTimeout(fn(), options.timeoutMs);
+            return result;
+        }
+        catch (err) {
+            lastError = err;
+            // Don't retry if we've exhausted attempts
+            if (attempt >= options.maxRetries)
+                break;
+            // Don't retry if the error isn't retryable
+            if (!classifier(err))
+                break;
+            // Exponential backoff with jitter
+            const exponentialDelay = options.baseDelayMs * Math.pow(2, attempt);
+            const cappedDelay = Math.min(exponentialDelay, options.maxDelayMs);
+            const jitteredDelay = cappedDelay * (0.5 + Math.random());
+            await sleep(jitteredDelay);
+        }
+    }
+    throw lastError;
+}
+function withTimeout(promise, timeoutMs) {
+    if (timeoutMs <= 0 || !Number.isFinite(timeoutMs))
+        return promise;
+    return new Promise((resolve, reject) => {
+        const timer = setTimeout(() => {
+            reject(new Error(`Operation timed out after ${timeoutMs}ms`));
+        }, timeoutMs);
+        promise.then((value) => {
+            clearTimeout(timer);
+            resolve(value);
+        }, (err) => {
+            clearTimeout(timer);
+            reject(err);
+        });
+    });
+}
+function sleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+//# sourceMappingURL=reliability.js.map

package/dist/src/reliability.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"reliability.js","sourceRoot":"","sources":["../../src/reliability.ts"],"names":[],"mappings":"AAQA,MAAM,eAAe,GAAiB;IACpC,UAAU,EAAE,CAAC;IACb,WAAW,EAAE,IAAI;IACjB,UAAU,EAAE,KAAK;IACjB,SAAS,EAAE,KAAK;CACjB,CAAC;AAEF;;;GAGG;AACH,MAAM,UAAU,WAAW,CAAC,GAAY;IACtC,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAEpD,uDAAuD;IACvD,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAA8B,CAAC;QAE3C,MAAM,MAAM,GACV,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ;YAC5B,CAAC,CAAC,GAAG,CAAC,MAAM;YACZ,CAAC,CAAC,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ;gBAClC,CAAC,CAAC,GAAG,CAAC,UAAU;gBAChB,CAAC,CAAC,SAAS,CAAC;QAElB,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;YACzB,IAAI,MAAM,KAAK,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,eAAe;YAChD,IAAI,MAAM,IAAI,GAAG;gBAAE,OAAO,IAAI,CAAC,CAAC,gBAAgB;YAChD,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;gBAAE,OAAO,KAAK,CAAC,CAAC,6BAA6B;QAChF,CAAC;QAED,sDAAsD;QACtD,IACE,OAAO,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAChC,GAAG,CAAC,QAAQ,KAAK,IAAI,EACrB,CAAC;YACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAmC,CAAC;YACrD,MAAM,UAAU,GAAG,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7E,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;gBAC7B,IAAI,UAAU,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACpC,IAAI,UAAU,IAAI,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACnC,IAAI,UAAU,IAAI,GAAG,IAAI,UAAU,GAAG,GAAG;oBAAE,OAAO,KAAK,CAAC;YAC1D,CAAC;QACH,CAAC;QAED,2BAA2B;QAC3B,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1D,MAAM,YAAY,GAAG;YACnB,YAAY;YACZ,cAAc;YACd,WAAW;YACX,WAAW;YACX,OAAO;YACP,WAAW;YACX,aAAa;YACb,cAAc;YACd,gBAAgB;YAChB,yBAAyB;YACzB,aAAa;SACd,CAAC;QACF,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IAED,gDAAgD;IAChD,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC;QACtC,IACE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC;YACvB,GAAG,CAAC,QAAQ,CAAC,YAAY,CAAC;YAC1B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC;YAC5B,GAAG,CAAC,QAAQ,CAAC,gBAAgB,CAAC;YAC9B,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,EAC5B,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,EAAoB,EACpB,IAA4B;IAE5B,MAAM,OAAO,GAAiB,EAAE,GAAG,eAAe,EAAE,GAAG,IAAI,EAAE,CAAC;IAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,OAAO,IAAI,WAAW,CAAC;IAElD,IAAI,SAAkB,CAAC;IAEvB,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,IAAI,OAAO,CAAC,UAAU,EAAE,OAAO,EAAE,EAAE,CAAC;QAC/D,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC,EAAE,EAAE,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;YAC1D,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,SAAS,GAAG,GAAG,CAAC;YAEhB,0CAA0C;YAC1C,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU;gBAAE,MAAM;YAEzC,2CAA2C;YAC3C,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,MAAM;YAE5B,kCAAkC;YAClC,MAAM,gBAAgB,GAAG,OAAO,CAAC,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;YACpE,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC,UAAU,CAAC,CAAC;YACnE,MAAM,aAAa,GAAG,WAAW,GAAG,CAAC,GAAG,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;YAE1D,MAAM,KAAK,CAAC,aAAa,CAAC,CAAC;QAC7B,CAAC;IACH,CAAC;IAED,MAAM,SAAS,CAAC;AAClB,CAAC;AAED,SAAS,WAAW,CAAI,OAAmB,EAAE,SAAiB;IAC5D,IAAI,SAAS,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,SAAS,CAAC;QAAE,OAAO,OAAO,CAAC;IAElE,OAAO,IAAI,OAAO,CAAI,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACxC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE;YAC5B,MAAM,CAAC,IAAI,KAAK,CAAC,6BAA6B,SAAS,IAAI,CAAC,CAAC,CAAC;QAChE,CAAC,EAAE,SAAS,CAAC,CAAC;QAEd,OAAO,CAAC,IAAI,CACV,CAAC,KAAK,EAAE,EAAE;YACR,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,OAAO,CAAC,KAAK,CAAC,CAAC;QACjB,CAAC,EACD,CAAC,GAAG,EAAE,EAAE;YACN,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,MAAM,CAAC,GAAG,CAAC,CAAC;QACd,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC"}

package/dist/src/runner.d.ts

@@ -0,0 +1,37 @@
+import type { LLMClient } from "./llm.js";
+import type { FreeTurtleModule } from "./modules/types.js";
+import type { Logger } from "./logger.js";
+import type { PolicyConfig } from "./policy.js";
+import { ApprovalManager } from "./approval.js";
+export interface TaskConfig {
+    name: string;
+    prompt: string;
+    output?: string;
+    isHeartbeat?: boolean;
+}
+export interface TaskResult {
+    response: string;
+    toolsCalled: string[];
+    durationMs: number;
+}
+export type ApprovalNotifier = (message: string) => void;
+export declare class TaskRunner {
+    private dir;
+    private llm;
+    private modules;
+    private logger;
+    private policy?;
+    private approvalManager;
+    private auditLogger;
+    private onApprovalNeeded?;
+    constructor(dir: string, llm: LLMClient, modules: FreeTurtleModule[], logger: Logger, options?: {
+        policy?: PolicyConfig;
+        onApprovalNeeded?: ApprovalNotifier;
+    });
+    runTask(task: TaskConfig): Promise<TaskResult>;
+    runMessage(message: string, channel: string): Promise<string>;
+    getApprovalManager(): ApprovalManager;
+    private buildSystemPrompt;
+    private collectTools;
+    private buildExecutor;
+}