jules-orchestrator-kit 0.32.0 → 0.32.1

package/README.md

@@ -102,7 +102,7 @@ Autonomous coding agents can write software at 100× human speed—but unconstra
 
 * **🔒 Zero Runtime Dependencies:** Built exclusively on Node.js 20+ built-ins (`node:fs`, `node:child_process`, `node:crypto`, `node:path`, `node:http`, `node:tty`, `node:test`). Zero third-party npm packages mean zero supply-chain CVE risk.
 
-* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, redacts high-entropy secrets and PII from dry-runs and git diffs, and rejects PRs exceeding the 75 KB Diff Payload governor.
+* **🛡️ Fail-Closed Security Gatekeeper:** Unconditionally evaluates explicit Deny rules *before* Allow rules, redacts high-entropy secrets and PII from dry-runs and git diffs, blocks unsupported Node.js native module imports in Edge environments (Cloudflare Workers, Vercel Edge, Netlify Edge), and rejects PRs exceeding the 75 KB Diff Payload governor.
 
 * **🔄 Autonomous OODA Self-Healing:** Captures test stderr/stdout, normalizes failure fingerprints, and feeds structured error contexts back into repair iterations (up to 3 automatic attempts) before human escalation.
 

package/bin/agentctl.mjs

@@ -14,7 +14,7 @@ const command = args[0];
 
 function printHelp() {
   console.log(`
-🚀 agentctl v0.32.0 — Universal Agent Orchestrator & Safety Gatekeeper
+🚀 agentctl v0.32.1 — Universal Agent Orchestrator & Safety Gatekeeper
 
 Usage: agentctl <command> [options]
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.32.0",
+  "version": "0.32.1",
   "description": "Orchestration kit for running Google Jules autonomous agents.",
   "repository": {
     "type": "git",

package/src/security.mjs

@@ -236,7 +236,58 @@ export function checkScope(files = [], scope = {}, opts = {}) {
   };
 }
 
-export function scanDiff(diffTextStr = "") {
+export const FORBIDDEN_EDGE_MODULES = [
+  "fs", "node:fs",
+  "child_process", "node:child_process",
+  "cluster", "node:cluster",
+  "dgram", "node:dgram",
+  "net", "node:net",
+  "tls", "node:tls",
+  "v8", "node:v8",
+  "vm", "node:vm",
+  "worker_threads", "node:worker_threads",
+];
+
+export function checkEdgeRuntimeImports(diffOrText = "", options = {}) {
+  if (!diffOrText || typeof diffOrText !== "string") return { ok: true, violations: [] };
+
+  const isEdgeExplicit = options.isEdgeRuntime === true;
+  const hasEdgeExport = /export\s+const\s+runtime\s*=\s*['"]edge['"]/i.test(diffOrText);
+  const isEdgeContext = isEdgeExplicit || hasEdgeExport;
+
+  if (!isEdgeContext) {
+    return { ok: true, violations: [] };
+  }
+
+  const lines = diffOrText.split("\n");
+  const targetLines = lines.filter((line) => {
+    if (diffOrText.includes("+++ b/")) {
+      return line.startsWith("+") && !line.startsWith("+++");
+    }
+    return true;
+  });
+
+  const edgeImportRegex = /(?:import\s+.*?\s+from\s+|require\s*\(\s*)['"](node:(?:fs|child_process|cluster|dgram|net|tls|v8|vm|worker_threads)|(?:fs|child_process|cluster|dgram|net|tls|v8|vm|worker_threads))(?:\/.*)?['"]/i;
+
+  const violations = [];
+  for (const line of targetLines) {
+    const match = line.match(edgeImportRegex);
+    if (match) {
+      violations.push({
+        module: match[1],
+        line: line.trim(),
+        reason: `Edge Runtime Violation: Native Node module "${match[1]}" is unsupported in Edge environments (Cloudflare Workers / Vercel Edge / Netlify Edge).`,
+      });
+    }
+  }
+
+  return {
+    ok: violations.length === 0,
+    violations,
+  };
+}
+
+export function scanDiff(diffTextStr = "", options = {}) {
   if (!diffTextStr) return { ok: true, findings: [] };
   const addedLines = diffTextStr
     .split("\n")
@@ -254,8 +305,15 @@ export function scanDiff(diffTextStr = "") {
     findings.push({ severity: "HIGH", type: "LOW_CONFIDENCE_SECRET", description: "Low-confidence secret or authorization token detected in added diff lines" });
   }
 
+  const edgeRes = checkEdgeRuntimeImports(diffTextStr, options);
+  if (!edgeRes.ok) {
+    for (const v of edgeRes.violations) {
+      findings.push({ severity: "HIGH", type: "EDGE_RUNTIME_VIOLATION", description: v.reason });
+    }
+  }
+
   return {
-    ok: !hasHigh && !hasLow,
+    ok: !hasHigh && !hasLow && edgeRes.ok,
     findings,
   };
 }

package/src/stack-detector.mjs

@@ -26,10 +26,45 @@ test("Zero-Test Bootstrapped Smoke Verification", () => {
   return ".agent/smoke.test.mjs";
 }
 
+export function detectEdgeRuntime(projectRoot = process.cwd()) {
+  const isCloudflare = existsSync(join(projectRoot, "wrangler.toml")) || existsSync(join(projectRoot, "wrangler.json"));
+  const isDeno = existsSync(join(projectRoot, "deno.json")) || existsSync(join(projectRoot, "deno.jsonc"));
+  const isNetlify = existsSync(join(projectRoot, "netlify.toml"));
+
+  let isPkgEdge = false;
+  let pkgEdgePlatform = null;
+
+  const pkgPath = join(projectRoot, "package.json");
+  if (existsSync(pkgPath)) {
+    try {
+      const content = readFileSync(pkgPath, "utf-8");
+      if (content.includes("@cloudflare/workers-types") || content.includes("@cloudflare/env")) {
+        isPkgEdge = true;
+        pkgEdgePlatform = "cloudflare";
+      } else if (content.includes("@vercel/edge") || content.includes("@vercel/functions")) {
+        isPkgEdge = true;
+        pkgEdgePlatform = "vercel";
+      } else if (content.includes("@netlify/edge-functions")) {
+        isPkgEdge = true;
+        pkgEdgePlatform = "netlify";
+      }
+    } catch (_) {}
+  }
+
+  const isEdge = isCloudflare || isDeno || isNetlify || isPkgEdge;
+  const platform = isCloudflare ? "cloudflare" : isDeno ? "deno" : isNetlify ? "netlify" : pkgEdgePlatform;
+
+  return {
+    isEdgeRuntime: isEdge,
+    edgePlatform: platform,
+  };
+}
+
 /**
  * Detects 24+ polyglot stacks and container environments.
  */
 export function detectPolyglotStack(projectRoot = process.cwd()) {
+  const edgeInfo = detectEdgeRuntime(projectRoot);
   const isDevcontainer = existsSync(join(projectRoot, ".devcontainer", "devcontainer.json"));
   const isCompose =
     existsSync(join(projectRoot, "docker-compose.yml")) ||
@@ -38,6 +73,7 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
     existsSync(join(projectRoot, "compose.yaml"));
 
   const container = {
+    ...edgeInfo,
     containerized: isDevcontainer || isCompose,
     containerType: isDevcontainer ? "devcontainer" : isCompose ? "docker-compose" : null,
     containerCmd: isDevcontainer