jules-orchestrator-kit 0.32.3 → 0.32.4

package/README.md

@@ -388,7 +388,7 @@ Native stdio server exposing task dispatch, gate verification, and risk auditing
 | `clean` | `agentctl clean` | Prunes stale git worktrees, lockfiles, and temporary ledgers. | `0` (Clean) |
 | `mcp` | `agentctl mcp` | Starts stdio Model Context Protocol (MCP) server for tool integration. | `0` / Stdio stream |
 | `mcp init` | `agentctl mcp init [--target cursor\|vscode\|claude\|all]` | 1-click scaffolding for Cursor (`.cursor/mcp.json`), VS Code tasks (`tasks.json`), and Claude Desktop. | `0` (Scaffolded) |
-| `version` | `agentctl version` | Outputs orchestrator kit semantic version (`v0.32.3`). | `0` |
+| `version` | `agentctl version` | Outputs orchestrator kit semantic version (`v0.32.4`). | `0` |
 
 <br/>
 

package/bin/agentctl.mjs

@@ -12,9 +12,11 @@ import { reapOrphanedIntents, reapStaleMutexDirs } from "../src/journal.mjs";
 const args = process.argv.slice(2);
 const command = args[0];
 
-function printHelp() {
+export const VERSION = "0.32.4";
+
+export function printHelp() {
   console.log(`
-🚀 agentctl v0.32.3 — Universal Agent Orchestrator & Safety Gatekeeper
+🚀 agentctl v0.32.4 — Universal Agent Orchestrator & Safety Gatekeeper
 
 Usage: agentctl <command> [options]
 
@@ -63,7 +65,7 @@ async function main() {
   }
 
   if (command === "version" || command === "--version" || command === "-v") {
-    console.log("agentctl v0.32.3");
+    console.log("agentctl v0.32.4");
     process.exit(0);
   }
 

package/index.mjs

@@ -13,6 +13,8 @@ export {
   matchesGlob,
   checkScope,
   scanDiff,
+  checkEdgeRuntimeImports,
+  checkCrossPackageImports,
 } from "./src/security.mjs";
 export { sanitizeUntrustedData, buildAgentEnvelope } from "./src/prompt-guard.mjs";
 export { isolateMcpStdout, writeMcpFrame } from "./src/mcp.mjs";
@@ -29,7 +31,14 @@ export {
   ProviderSchemaError,
   parseRetryAfter,
 } from "./src/provider.mjs";
-export { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo } from "./src/stack-detector.mjs";
+export {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+} from "./src/stack-detector.mjs";
 export {
   appendLedger,
   readLedger,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.32.3",
+  "version": "0.32.4",
   "description": "Orchestration kit for running Google Jules autonomous agents.",
   "repository": {
     "type": "git",
@@ -70,7 +70,7 @@
   "author": "FullThrottle83",
   "license": "MIT",
   "devDependencies": {
-    "eslint": "^9.39.5",
-    "globals": "^17.8.0"
+    "eslint": "^10.8.1",
+    "globals": "^17.11.0"
   }
 }

package/scripts/jules-merge-swarm.mjs

@@ -10,7 +10,7 @@ import { join } from "node:path";
 import { tmpdir } from "node:os";
 import { spawnSync } from "node:child_process";
 import { classifyRiskTier, RISK_TIERS } from "../src/risk.mjs";
-import { changedFiles, git, resolveBase } from "../src/git.mjs";
+import { git, resolveBase } from "../src/git.mjs";
 import { normalizePath } from "../src/config.mjs";
 
 export const EXIT = Object.freeze({

package/src/config.mjs

@@ -185,9 +185,23 @@ export function detectPackageManager(root = process.cwd(), pkg = {}) {
   return "npm";
 }
 
-import { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo } from "./stack-detector.mjs";
-
-export { detectPolyglotStack, resolveWorkspaceBoundary, bootstrapZeroTestRepo };
+import {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+} from "./stack-detector.mjs";
+
+export {
+  detectPolyglotStack,
+  resolveWorkspaceBoundary,
+  bootstrapZeroTestRepo,
+  findSubprojectRoot,
+  detectCrossPackageBoundaryViolations,
+  detectCircularDependencies,
+};
 
 /**
  * Autodetects verification test/build commands across 24+ polyglot tech stacks.

package/src/engine.mjs

@@ -187,8 +187,8 @@ export async function gate(opts = {}) {
     return { ok: false, code: 5, phases };
   }
 
-  // Phase 3: Diff Secret Scanner
-  const secretResult = scanDiff(diffStr);
+  // Phase 3: Diff Secret Scanner & Security Checks
+  const secretResult = scanDiff(diffStr, { root });
   phases.push({ phase: "secrets", ok: secretResult.ok, findings: secretResult.findings });
   appendTelemetry(root, "gate_phase", { phase: "secrets", ok: secretResult.ok });
   if (progressBus && progressToken) {

package/src/memory.mjs

@@ -61,9 +61,9 @@ export function recordLearning(root = process.cwd(), learning = {}) {
   const sanitize = (str) => str.replace(/\|/g, "&#124;").replace(/\r?\n/g, "<br>");
   let md = `<!-- 🚫 AUTO-GENERATED. AGENTS: DO NOT EDIT THIS FILE DIRECTLY. -->\n`;
   md += `# 🧠 System Learnings & Platform Quirks\n\n`;
-  md += `> **⚠️ TILL AGENTER:** Redigera ALDRIG denna fil manuellt. Registrera lärdomar via:\n`;
+  md += `> **⚠️ TO AGENTS:** NEVER edit this file manually. Record learnings via:\n`;
   md += `> \`agentctl learning add "<trigger>" "<solution>"\`\n\n`;
-  md += `| Datum | Agent | Trigger / Symptom | Mandatory Rule / Solution |\n`;
+  md += `| Date | Agent | Trigger / Symptom | Mandatory Rule / Solution |\n`;
   md += `| :--- | :--- | :--- | :--- |\n`;
 
   db.forEach((l) => {

package/src/security.mjs

@@ -2,6 +2,7 @@ import { openSync, writeSync, fsyncSync, closeSync, renameSync, realpathSync, ex
 import { dirname, join, basename } from "node:path";
 import { randomBytes } from "node:crypto";
 import { normalizePath } from "./config.mjs";
+import { detectCrossPackageBoundaryViolations } from "./stack-detector.mjs";
 
 export const HIGH_CONFIDENCE_PATTERNS = [
   /\bghp_[A-Za-z0-9_]{36,255}\b/g,
@@ -287,6 +288,50 @@ export function checkEdgeRuntimeImports(diffOrText = "", options = {}) {
   };
 }
 
+export function checkCrossPackageImports(diffOrText = "", root = process.cwd(), options = {}) {
+  if (!diffOrText || typeof diffOrText !== "string") return { ok: true, violations: [] };
+
+  const violations = [];
+
+  if (diffOrText.includes("+++ b/")) {
+    const lines = diffOrText.split("\n");
+    let currentFile = null;
+    let currentAdded = [];
+
+    const flushFile = () => {
+      if (currentFile && currentAdded.length > 0) {
+        const fileViolations = detectCrossPackageBoundaryViolations([currentFile], root, {
+          fileContents: { [currentFile]: currentAdded.join("\n") },
+          ...options,
+        });
+        violations.push(...fileViolations);
+      }
+    };
+
+    for (const line of lines) {
+      if (line.startsWith("+++ b/")) {
+        flushFile();
+        currentFile = line.slice(6).trim();
+        currentAdded = [];
+      } else if (line.startsWith("+") && !line.startsWith("+++")) {
+        currentAdded.push(line.slice(1));
+      }
+    }
+    flushFile();
+  } else if (options.file) {
+    const fileViolations = detectCrossPackageBoundaryViolations([options.file], root, {
+      fileContents: { [options.file]: diffOrText },
+      ...options,
+    });
+    violations.push(...fileViolations);
+  }
+
+  return {
+    ok: violations.length === 0,
+    violations,
+  };
+}
+
 export function scanDiff(diffTextStr = "", options = {}) {
   if (!diffTextStr) return { ok: true, findings: [] };
   const addedLines = diffTextStr
@@ -312,8 +357,17 @@ export function scanDiff(diffTextStr = "", options = {}) {
     }
   }
 
+  const root = options.root || process.cwd();
+  const crossPkgRes = checkCrossPackageImports(diffTextStr, root, options);
+  if (!crossPkgRes.ok) {
+    for (const v of crossPkgRes.violations) {
+      findings.push({ severity: "HIGH", type: "CROSS_PACKAGE_BOUNDARY_VIOLATION", description: v.reason });
+    }
+  }
+
   return {
-    ok: !hasHigh && !hasLow && edgeRes.ok,
+    ok: !hasHigh && !hasLow && edgeRes.ok && crossPkgRes.ok,
     findings,
   };
 }
+

package/src/stack-detector.mjs

@@ -1,5 +1,5 @@
 import { readFileSync, writeFileSync, existsSync, readdirSync, mkdirSync } from "node:fs";
-import { join, sep } from "node:path";
+import { join, relative } from "node:path";
 
 /**
  * Generate a zero-dependency smoke test file using node:test for untested JS/Generic repos.
@@ -230,42 +230,363 @@ export function detectPolyglotStack(projectRoot = process.cwd()) {
   return { ...container, stack: "unknown", testCmd: "", buildCmd: "", triggerFile: null };
 }
 
+/**
+ * Normalizes file paths to POSIX slashes.
+ */
+function toPosixPath(p = "") {
+  return p.replace(/\\/g, "/");
+}
+
+/**
+ * Finds the nearest subproject root directory for a given relative file path.
+ */
+export function findSubprojectRoot(fileRelPath = "", root = process.cwd()) {
+  const normalized = toPosixPath(fileRelPath);
+  const parts = normalized.split("/");
+  if (parts.length <= 1) return ".";
+
+  const manifestFiles = [
+    "package.json",
+    "Cargo.toml",
+    "go.mod",
+    "pyproject.toml",
+    "setup.py",
+    "requirements.txt",
+    "composer.json",
+    "pom.xml",
+    "build.gradle",
+  ];
+
+  // Walk up from parent directory of file to top-level folder
+  for (let i = parts.length - 1; i >= 1; i--) {
+    const candidateDir = parts.slice(0, i).join("/");
+    const fullCandidate = join(root, candidateDir);
+    if (existsSync(fullCandidate)) {
+      try {
+        const entries = readdirSync(fullCandidate);
+        const hasManifest = entries.some(
+          (e) => manifestFiles.includes(e) || e.endsWith(".csproj") || e.endsWith(".fsproj")
+        );
+        if (hasManifest) {
+          return candidateDir;
+        }
+      } catch (_) {}
+    }
+  }
+
+  return ".";
+}
+
+/**
+ * Detects illegal cross-package imports escaping subproject boundaries in monorepos.
+ */
+export function detectCrossPackageBoundaryViolations(changedFiles = [], root = process.cwd(), options = {}) {
+  const violations = [];
+  if (!changedFiles || changedFiles.length === 0) return violations;
+
+  const fileContents = options.fileContents || {};
+
+  // Regex patterns for relative imports across languages
+  const jsImportRegex = /(?:import\s+(?:[\w*\s{},]*\s+from\s+)?|export\s+(?:[\w*\s{},]*\s+from\s+)?|require\s*\(\s*|import\s*\(\s*)['"](\.[^'"]+)['"]/g;
+  const goImportRegex = /(?:^|\n)\s*(?:import\s+['"](\.[^'"]+)['"]|import\s*\([\s\S]*?['"](\.[^'"]+)['"][\s\S]*?\))/g;
+  const rustPathRegex = /#\[path\s*=\s*['"](\.[^'"]+)['"]\]/g;
+  const pyRelImportRegex = /(?:^|\n)\s*from\s+(\.{2,}\w*)\s+import/g;
+
+  for (const file of changedFiles) {
+    const posixFile = toPosixPath(file);
+    let content = fileContents[file] || fileContents[posixFile];
+
+    if (!content) {
+      const fullPath = join(root, file);
+      if (existsSync(fullPath)) {
+        try {
+          content = readFileSync(fullPath, "utf-8");
+        } catch (_) {}
+      }
+    }
+
+    if (!content || typeof content !== "string") continue;
+
+    const subproject = findSubprojectRoot(posixFile, root);
+    if (subproject === "." && !options.enforceRootBoundary) {
+      continue;
+    }
+
+    const fileDir = posixFile.includes("/") ? posixFile.substring(0, posixFile.lastIndexOf("/")) : ".";
+    const ext = posixFile.includes(".") ? posixFile.substring(posixFile.lastIndexOf(".")).toLowerCase() : "";
+    const isJsTs = [".js", ".mjs", ".cjs", ".ts", ".tsx", ".jsx", ".svelte", ".vue"].includes(ext) || !ext;
+    const isGo = ext === ".go";
+    const isRust = ext === ".rs";
+    const isPython = ext === ".py";
+
+    const lines = content.split("\n");
+
+    for (let lineIdx = 0; lineIdx < lines.length; lineIdx++) {
+      const line = lines[lineIdx];
+
+      // 1. JS / TS imports
+      if (isJsTs) {
+        let match;
+        jsImportRegex.lastIndex = 0;
+        while ((match = jsImportRegex.exec(line)) !== null) {
+          const relTarget = match[1];
+          if (relTarget.startsWith("..")) {
+            const resolved = toPosixPath(join(fileDir, relTarget));
+            const relToSubproject = toPosixPath(relative(subproject, resolved));
+            if (relToSubproject.startsWith("..") || resolved === "." || (subproject !== "." && !resolved.startsWith(subproject + "/"))) {
+              violations.push({
+                file: posixFile,
+                subproject,
+                importTarget: relTarget,
+                resolvedTarget: resolved,
+                line: lineIdx + 1,
+                language: "javascript/typescript",
+                reason: `Cross-Package Boundary Violation: File "${posixFile}" in package "${subproject}" illegally imports "${relTarget}" (resolves to "${resolved}"), escaping its package boundary. Declare a workspace dependency instead of a relative cross-package file import.`,
+              });
+            }
+          }
+        }
+      }
+
+      // 2. Go relative imports escaping module
+      if (isGo) {
+        let match;
+        goImportRegex.lastIndex = 0;
+        while ((match = goImportRegex.exec(line)) !== null) {
+          const relTarget = match[1] || match[2];
+          if (relTarget && relTarget.startsWith("..")) {
+            const resolved = toPosixPath(join(fileDir, relTarget));
+            const relToSubproject = toPosixPath(relative(subproject, resolved));
+            if (relToSubproject.startsWith("..")) {
+              violations.push({
+                file: posixFile,
+                subproject,
+                importTarget: relTarget,
+                resolvedTarget: resolved,
+                line: lineIdx + 1,
+                language: "go",
+                reason: `Cross-Module Boundary Violation: Go file "${posixFile}" in module "${subproject}" illegally imports relative path "${relTarget}" escaping module root.`,
+              });
+            }
+          }
+        }
+      }
+
+      // 3. Rust path attributes escaping crate
+      if (isRust) {
+        let match;
+        rustPathRegex.lastIndex = 0;
+        while ((match = rustPathRegex.exec(line)) !== null) {
+          const relTarget = match[1];
+          if (relTarget && relTarget.startsWith("..")) {
+            const resolved = toPosixPath(join(fileDir, relTarget));
+            const relToSubproject = toPosixPath(relative(subproject, resolved));
+            if (relToSubproject.startsWith("..")) {
+              violations.push({
+                file: posixFile,
+                subproject,
+                importTarget: relTarget,
+                resolvedTarget: resolved,
+                line: lineIdx + 1,
+                language: "rust",
+                reason: `Cross-Crate Boundary Violation: Rust file "${posixFile}" in crate "${subproject}" uses path attribute "${relTarget}" escaping crate root.`,
+              });
+            }
+          }
+        }
+      }
+
+      // 4. Python relative imports escaping package
+      if (isPython) {
+        let match;
+        pyRelImportRegex.lastIndex = 0;
+        while ((match = pyRelImportRegex.exec(line)) !== null) {
+          const dots = match[1];
+          const dotCount = (dots.match(/\./g) || []).length;
+          // Count depth from subproject to fileDir
+          const depth = fileDir === subproject ? 0 : fileDir.slice(subproject.length + 1).split("/").length;
+          if (dotCount > depth + 1) {
+            violations.push({
+              file: posixFile,
+              subproject,
+              importTarget: dots,
+              resolvedTarget: "<parent-package>",
+              line: lineIdx + 1,
+              language: "python",
+              reason: `Cross-Package Boundary Violation: Python file "${posixFile}" in package "${subproject}" uses relative import with ${dotCount} dots, escaping package root.`,
+            });
+          }
+        }
+      }
+    }
+  }
+
+  return violations;
+}
+
+/**
+ * Discovers monorepo packages and detects circular dependencies.
+ */
+export function detectCircularDependencies(root = process.cwd()) {
+  const packageMap = new Map(); // name -> { path, deps: [] }
+  const searchDirs = ["packages", "apps", "crates", "services", "libs", "modules", "backend", "frontend", "cli", "."];
+
+  for (const dir of searchDirs) {
+    const fullDir = join(root, dir);
+    if (!existsSync(fullDir)) continue;
+
+    const subDirs = dir === "." ? ["."] : [];
+    try {
+      if (dir !== ".") {
+        const entries = readdirSync(fullDir, { withFileTypes: true });
+        for (const e of entries) {
+          if (e.isDirectory()) subDirs.push(`${dir}/${e.name}`);
+        }
+      }
+    } catch (_) {}
+
+    for (const subDir of subDirs) {
+      const fullSubDir = join(root, subDir);
+      // 1. JS/TS package.json
+      const pkgJsonPath = join(fullSubDir, "package.json");
+      if (existsSync(pkgJsonPath)) {
+        try {
+          const pkg = JSON.parse(readFileSync(pkgJsonPath, "utf-8"));
+          if (pkg.name) {
+            const allDeps = {
+              ...(pkg.dependencies || {}),
+              ...(pkg.devDependencies || {}),
+              ...(pkg.peerDependencies || {}),
+            };
+            packageMap.set(pkg.name, {
+              name: pkg.name,
+              path: subDir,
+              type: "npm",
+              deps: Object.keys(allDeps),
+            });
+          }
+        } catch (_) {}
+      }
+
+      // 2. Rust Cargo.toml
+      const cargoPath = join(fullSubDir, "Cargo.toml");
+      if (existsSync(cargoPath)) {
+        try {
+          const content = readFileSync(cargoPath, "utf-8");
+          const nameMatch = content.match(/\[package\][\s\S]*?name\s*=\s*["']([^"']+)["']/);
+          if (nameMatch) {
+            const crateName = nameMatch[1];
+            const deps = [];
+            const depMatches = content.matchAll(/([a-zA-Z0-9_-]+)\s*=\s*\{[^}]*?path\s*=\s*["']([^"']+)["']/g);
+            for (const dm of depMatches) {
+              deps.push(dm[1]);
+            }
+            packageMap.set(crateName, {
+              name: crateName,
+              path: subDir,
+              type: "cargo",
+              deps,
+            });
+          }
+        } catch (_) {}
+      }
+    }
+  }
+
+  // Filter dependencies to only workspace internal packages
+  const knownNames = new Set(packageMap.keys());
+  const graph = new Map();
+  for (const [name, info] of packageMap.entries()) {
+    graph.set(name, info.deps.filter((d) => knownNames.has(d)));
+  }
+
+  // Cycle detection via DFS
+  const cycles = [];
+  const visited = new Set();
+  const recStack = new Set();
+  const path = [];
+
+  function dfs(node) {
+    visited.add(node);
+    recStack.add(node);
+    path.push(node);
+
+    const neighbors = graph.get(node) || [];
+    for (const neighbor of neighbors) {
+      if (!visited.has(neighbor)) {
+        dfs(neighbor);
+      } else if (recStack.has(neighbor)) {
+        const cycleStartIndex = path.indexOf(neighbor);
+        const cycle = path.slice(cycleStartIndex).concat(neighbor);
+        cycles.push(cycle.join(" -> "));
+      }
+    }
+
+    path.pop();
+    recStack.delete(node);
+  }
+
+  for (const node of graph.keys()) {
+    if (!visited.has(node)) {
+      dfs(node);
+    }
+  }
+
+  return {
+    hasCycles: cycles.length > 0,
+    cycles,
+    packages: Array.from(packageMap.values()),
+  };
+}
+
 /**
  * Resolves workspace boundaries in polyglot monorepos by mapping changed files to subprojects.
  */
-export function resolveWorkspaceBoundary(changedFiles = [], root = process.cwd()) {
+export function resolveWorkspaceBoundary(changedFiles = [], root = process.cwd(), options = {}) {
   const rootStack = detectPolyglotStack(root);
+  const boundaryViolations = detectCrossPackageBoundaryViolations(changedFiles, root, options);
+  const circular = detectCircularDependencies(root);
+
   if (!changedFiles || changedFiles.length === 0) {
-    return { isMonorepo: false, globalFallback: false, projects: [{ path: ".", ...rootStack }], testCmd: rootStack.testCmd, buildCmd: rootStack.buildCmd };
+    return {
+      isMonorepo: circular.packages.length > 1,
+      globalFallback: false,
+      projects: [{ path: ".", ...rootStack }],
+      testCmd: rootStack.testCmd,
+      buildCmd: rootStack.buildCmd,
+      boundaryViolations,
+      circularDependencies: circular.cycles,
+    };
   }
 
   const sharedTriggers = new Set(["openapi.yaml", "openapi.json", "schema.graphql", "docker-compose.yml", "Makefile", "turbo.json", "pnpm-workspace.yaml", "nx.json"]);
   for (const file of changedFiles) {
-    const baseName = file.split(sep).pop();
+    const baseName = toPosixPath(file).split("/").pop();
     if (sharedTriggers.has(baseName) || file.startsWith(".agent/") || file.startsWith(".github/")) {
-      return { isMonorepo: true, globalFallback: true, projects: [{ path: ".", ...rootStack }], testCmd: rootStack.testCmd, buildCmd: rootStack.buildCmd };
+      return {
+        isMonorepo: true,
+        globalFallback: true,
+        projects: [{ path: ".", ...rootStack }],
+        testCmd: rootStack.testCmd,
+        buildCmd: rootStack.buildCmd,
+        boundaryViolations,
+        circularDependencies: circular.cycles,
+      };
     }
   }
 
   const projectMap = new Map();
   for (const file of changedFiles) {
-    const parts = file.split(sep);
-    let resolved = false;
-
-    for (let i = parts.length - 1; i >= 1; i--) {
-      const subDir = parts.slice(0, i).join("/");
+    const subDir = findSubprojectRoot(file, root);
+    if (subDir !== ".") {
       const subStack = detectPolyglotStack(join(root, subDir));
-      if (subStack.stack !== "unknown" && subStack.triggerFile) {
-        if (!projectMap.has(subDir)) {
-          projectMap.set(subDir, { path: subDir, ...subStack });
-        }
-        resolved = true;
-        break;
+      if (!projectMap.has(subDir)) {
+        projectMap.set(subDir, { path: subDir, ...subStack });
+      }
+    } else {
+      if (!projectMap.has(".")) {
+        projectMap.set(".", { path: ".", ...rootStack });
       }
-    }
-
-    if (!resolved && !projectMap.has(".")) {
-      projectMap.set(".", { path: ".", ...rootStack });
     }
   }
 
@@ -278,11 +599,13 @@ export function resolveWorkspaceBoundary(changedFiles = [], root = process.cwd()
     .map((p) => (p.path === "." ? p.buildCmd : `(cd ${p.path} && ${p.buildCmd})`));
 
   return {
-    isMonorepo: projects.length > 1,
+    isMonorepo: projects.length > 1 || circular.packages.length > 1,
     globalFallback: false,
     projects,
     testCmd: testCmds.join(" && ") || rootStack.testCmd,
     buildCmd: buildCmds.join(" && ") || rootStack.buildCmd,
+    boundaryViolations,
+    circularDependencies: circular.cycles,
   };
 }