jules-orchestrator-kit 0.32.3 → 0.32.5

package/src/router.mjs

@@ -0,0 +1,200 @@
+import { normalizePath } from "./config.mjs";
+import { matchesGlob } from "./security.mjs";
+import { extractPathTokens } from "./task-optimizer.mjs";
+import { createProvider, createFailoverProvider } from "./provider.mjs";
+
+/**
+ * Dynamic Complexity & Cost Router (Roadmap v0.33.0).
+ *
+ * Zero-dependency, rule-based heuristic classifier — no ML classifier, no
+ * external routing service. Routes trivial tasks (typos, lockfile bumps,
+ * lint fixes) to a cheap/fast provider while reserving the primary provider
+ * for complex, multi-file, or safety-sensitive work. Opt-in via
+ * `config.router.enabled` — disabled by default, zero behavior change for
+ * existing users.
+ */
+
+export const ROUTE_TIERS = {
+  FAST: "fast",
+  COMPLEX: "complex",
+};
+
+const TRIVIAL_SIGNALS = [
+  /\btypo(s)?\b/i,
+  /\brenam(e|ing|ed)\b/i,
+  /\bbump(ed|ing)?\b/i,
+  /\bversion bump\b/i,
+  /\block ?file\b/i,
+  /\bformat(ting)?\b/i,
+  /\blint(ing)?\s*(fix(es)?|error)?\b/i,
+  /\bwhitespace\b/i,
+  /\b(update|fix)\s+comment(s)?\b/i,
+  /\bdead code\b/i,
+  /\bunused (import|variable)s?\b/i,
+  /\breadme\b/i,
+  /\btypo fix\b/i,
+];
+
+const COMPLEX_SIGNALS = [
+  /\brefactor(ing)?\b/i,
+  /\barchitect(ure)?\b/i,
+  /\bmigrat(e|ion|ing)\b/i,
+  /\bredesign\b/i,
+  /\bconcurrency\b/i,
+  /\brace condition\b/i,
+  /\bsecurity\b/i,
+  /\bauth(entication|orization)?\b/i,
+  /\bschema\b/i,
+  /\bbreaking change\b/i,
+  /\bmulti-file\b/i,
+  /\bcross-package\b/i,
+  /\bdatabase\b/i,
+  /\bpayment(s)?\b/i,
+  /\bencrypt(ion)?\b/i,
+];
+
+// Sentinel handles security-sensitive work; the primary provider is always used.
+const FORCE_COMPLEX_ROLES = new Set(["sentinel"]);
+const FAST_LEANING_ROLES = new Set(["janitor", "bolt"]);
+const COMPLEX_LEANING_ROLES = new Set(["overseer", "sentinel"]);
+
+// Supplements config.scope.deny — these are never eligible for the fast tier
+// regardless of user scope config, mirroring src/risk.mjs's RESTRICTED_PATH_PATTERNS.
+const SENSITIVE_PATH_PATTERNS = [
+  "**/auth/**",
+  "**/migrations/**",
+  "**/pricing/**",
+  "**/secrets/**",
+  "**/*.pem",
+  "**/*.key",
+  ".github/**",
+  ".agent/config.yml",
+  ".agent/jules.yml",
+];
+
+function collectReferencedPaths(task) {
+  const fromPrompt = extractPathTokens(task.prompt || "");
+  const explicit = Array.isArray(task.targetFiles)
+    ? task.targetFiles
+    : Array.isArray(task.referenced_paths)
+      ? task.referenced_paths
+      : [];
+  return [...new Set([...fromPrompt, ...explicit])];
+}
+
+function touchesSensitivePath(paths, config) {
+  const denyPatterns = [...SENSITIVE_PATH_PATTERNS, ...((config && config.scope && config.scope.deny) || [])];
+  for (const rawPath of paths) {
+    const p = normalizePath(rawPath);
+    for (const pattern of denyPatterns) {
+      if (matchesGlob(p, pattern)) return { path: p, pattern };
+    }
+  }
+  return null;
+}
+
+/**
+ * Heuristically classifies a task envelope into a FAST or COMPLEX routing tier.
+ * @param {object} task - Task envelope (title, prompt, role, targetFiles, tier).
+ * @param {object} config - Loaded orchestrator config (uses scope.deny, router.threshold).
+ * @returns {{tier: string, score: number|null, forced: boolean, reason: string, signals?: string[]}}
+ */
+export function classifyTaskComplexity(task = {}, config = {}) {
+  const explicitTier = task.tier || task.complexity;
+  if (explicitTier === ROUTE_TIERS.FAST || explicitTier === ROUTE_TIERS.COMPLEX) {
+    return { tier: explicitTier, score: null, forced: true, reason: `Explicit task tier override: '${explicitTier}'` };
+  }
+
+  const paths = collectReferencedPaths(task);
+  const sensitiveHit = touchesSensitivePath(paths, config);
+  if (sensitiveHit) {
+    return {
+      tier: ROUTE_TIERS.COMPLEX,
+      score: null,
+      forced: true,
+      reason: `Touches sensitive path '${sensitiveHit.path}' (matches '${sensitiveHit.pattern}')`,
+    };
+  }
+
+  const role = String(task.role || "").toLowerCase();
+  if (FORCE_COMPLEX_ROLES.has(role)) {
+    return { tier: ROUTE_TIERS.COMPLEX, score: null, forced: true, reason: `Role '${role}' always routes to the primary provider` };
+  }
+
+  const text = `${task.title || ""} ${task.prompt || ""}`;
+  let score = 0;
+  const signals = [];
+
+  for (const pattern of COMPLEX_SIGNALS) {
+    if (pattern.test(text)) {
+      score += 2;
+      signals.push(`+2 complex keyword (${pattern.source})`);
+    }
+  }
+  for (const pattern of TRIVIAL_SIGNALS) {
+    if (pattern.test(text)) {
+      score -= 1;
+      signals.push(`-1 trivial keyword (${pattern.source})`);
+    }
+  }
+
+  if (paths.length >= 4) {
+    score += 3;
+    signals.push(`+3 touches ${paths.length} files`);
+  } else if (paths.length > 0 && paths.length <= 1) {
+    score -= 1;
+    signals.push(`-1 touches a single file`);
+  }
+
+  const promptLen = (task.prompt || "").length;
+  if (promptLen > 1200) {
+    score += 1;
+    signals.push(`+1 long prompt (${promptLen} chars)`);
+  } else if (promptLen > 0 && promptLen < 200) {
+    score -= 1;
+    signals.push(`-1 short prompt (${promptLen} chars)`);
+  }
+
+  if (COMPLEX_LEANING_ROLES.has(role)) {
+    score += 1;
+    signals.push(`+1 role '${role}' leans complex`);
+  }
+  if (FAST_LEANING_ROLES.has(role)) {
+    score -= 2;
+    signals.push(`-2 role '${role}' leans fast`);
+  }
+
+  const threshold = Number.isFinite(config?.router?.threshold) ? config.router.threshold : 0;
+  const tier = score > threshold ? ROUTE_TIERS.COMPLEX : ROUTE_TIERS.FAST;
+
+  return { tier, score, forced: false, threshold, signals, reason: `Heuristic score ${score} vs threshold ${threshold}` };
+}
+
+/**
+ * Resolves the provider adapter to dispatch a task through, honoring
+ * `config.router` (opt-in Dynamic Complexity & Cost Router). Disabled by
+ * default — returns the primary provider unchanged. FAST-tier tasks are
+ * wrapped in a failover cascade so a rate-limited/unavailable fast provider
+ * falls through to the primary provider automatically.
+ * @param {object} task
+ * @param {object} config
+ * @returns {{provider: object, routed: boolean, classification: object|null}}
+ */
+export function resolveRoutedProvider(task = {}, config = {}) {
+  const routerCfg = config.router || {};
+  const complexSpec = routerCfg.complex || config.provider || "jules";
+
+  if (!routerCfg.enabled) {
+    return { provider: createProvider(config.provider, config), routed: false, classification: null };
+  }
+
+  const classification = classifyTaskComplexity(task, config);
+
+  if (classification.tier === ROUTE_TIERS.COMPLEX) {
+    return { provider: createProvider(complexSpec, config), routed: true, classification };
+  }
+
+  const fastSpec = routerCfg.fast || "gemini-flash";
+  const provider = createFailoverProvider([fastSpec, complexSpec], config);
+  return { provider, routed: true, classification };
+}

package/src/security.mjs

@@ -2,6 +2,7 @@ import { openSync, writeSync, fsyncSync, closeSync, renameSync, realpathSync, ex
 import { dirname, join, basename } from "node:path";
 import { randomBytes } from "node:crypto";
 import { normalizePath } from "./config.mjs";
+import { detectCrossPackageBoundaryViolations } from "./stack-detector.mjs";
 
 export const HIGH_CONFIDENCE_PATTERNS = [
   /\bghp_[A-Za-z0-9_]{36,255}\b/g,
@@ -287,6 +288,50 @@ export function checkEdgeRuntimeImports(diffOrText = "", options = {}) {
   };
 }
 
+export function checkCrossPackageImports(diffOrText = "", root = process.cwd(), options = {}) {
+  if (!diffOrText || typeof diffOrText !== "string") return { ok: true, violations: [] };
+
+  const violations = [];
+
+  if (diffOrText.includes("+++ b/")) {
+    const lines = diffOrText.split("\n");
+    let currentFile = null;
+    let currentAdded = [];
+
+    const flushFile = () => {
+      if (currentFile && currentAdded.length > 0) {
+        const fileViolations = detectCrossPackageBoundaryViolations([currentFile], root, {
+          fileContents: { [currentFile]: currentAdded.join("\n") },
+          ...options,
+        });
+        violations.push(...fileViolations);
+      }
+    };
+
+    for (const line of lines) {
+      if (line.startsWith("+++ b/")) {
+        flushFile();
+        currentFile = line.slice(6).trim();
+        currentAdded = [];
+      } else if (line.startsWith("+") && !line.startsWith("+++")) {
+        currentAdded.push(line.slice(1));
+      }
+    }
+    flushFile();
+  } else if (options.file) {
+    const fileViolations = detectCrossPackageBoundaryViolations([options.file], root, {
+      fileContents: { [options.file]: diffOrText },
+      ...options,
+    });
+    violations.push(...fileViolations);
+  }
+
+  return {
+    ok: violations.length === 0,
+    violations,
+  };
+}
+
 export function scanDiff(diffTextStr = "", options = {}) {
   if (!diffTextStr) return { ok: true, findings: [] };
   const addedLines = diffTextStr
@@ -312,8 +357,17 @@ export function scanDiff(diffTextStr = "", options = {}) {
     }
   }
 
+  const root = options.root || process.cwd();
+  const crossPkgRes = checkCrossPackageImports(diffTextStr, root, options);
+  if (!crossPkgRes.ok) {
+    for (const v of crossPkgRes.violations) {
+      findings.push({ severity: "HIGH", type: "CROSS_PACKAGE_BOUNDARY_VIOLATION", description: v.reason });
+    }
+  }
+
   return {
-    ok: !hasHigh && !hasLow && edgeRes.ok,
+    ok: !hasHigh && !hasLow && edgeRes.ok && crossPkgRes.ok,
     findings,
   };
 }
+