jules-orchestrator-kit 0.52.3 → 0.52.4

package/README.md

@@ -143,7 +143,7 @@ To maximize PR merge rates, dispatch tasks according to deterministic boundaries
 * **Fail-Closed Security & Secret Redaction:** Evaluates explicit Deny rules before Allow rules against canonicalized, case-folded paths. Redacts high-entropy keys and base64-encoded credentials (such as Kubernetes `Secret` manifests).
 * **Complexity & Cost Router:** Zero-dependency heuristic classifier (`src/router.mjs`) routing mechanical tasks to lightweight models while reserving primary models for complex refactors, with a `node --check` syntax-verification gate that transparently escalates a FAST-tier result to the primary provider if it left broken JS on disk.
 * **Terminal UI & Diagnostic Matrix (`agentctl doctor`):** Interactive terminal dashboard, task sidecar manager, and automated transactional self-repair.
-* **Verified Test Suite:** Tested with **809 unit tests across 91 suites passing in < 10.0s**.
+* **Verified Test Suite:** Tested with **815 unit tests across 91 suites passing in < 10.0s**.
 
 <br/>
 

package/bin/agentctl.mjs

@@ -427,7 +427,10 @@ async function main() {
           } else if (res.flakyVerdict?.verdict === "QUARANTINED") {
             console.log(`💡 Remediation Hint (Exit 8 Flaky Test Quarantined):`);
             console.log(`   • This command has alternated between pass and fail across recent runs.`);
-            console.log(`   • Fix the test's non-determinism — re-running will not clear the verdict.\n`);
+          } else if (res.code === 188) {
+            console.log(`💡 Remediation Hint (Exit 188 Offline Network Violation / Infrastructure):`);
+            console.log(`   • An unmocked network request was blocked by the preload network guard during verification.`);
+            console.log(`   • Ensure dependencies are installed locally (run: npm install) and all network calls in tests are mocked.\n`);
           } else if (failedPhase === "verify" || failedPhase === "evidence") {
             console.log(`💡 Remediation Hint (Exit ${res.code} Verification Failed):`);
             console.log(`   • The stage above exited non-zero. Reproduce it locally, then re-run the gate.`);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "jules-orchestrator-kit",
-  "version": "0.52.3",
+  "version": "0.52.4",
   "description": "Zero-dependency safety gatekeeper, test oracle generator, and multi-agent coordination protocol for Google Jules (jules) autonomous agents.",
   "repository": {
     "type": "git",

package/src/engine.mjs

@@ -433,6 +433,14 @@ export async function gate(opts = {}) {
   // the one gate failure the operator is expected to fix themselves was the
   // only one that told them nothing about how. Both streams are already
   // redacted at the point they were captured.
+  const isNetViolation = failingCmd?.status === 188;
+  const netViolationDiagnostics = isNetViolation
+    ? [
+        "Offline Network Guard: Outbound network request was blocked (Exit 188).",
+        "Ensure dependencies are installed locally (run npm install) and tests do not perform unmocked network access.",
+      ]
+    : [];
+
   const verifyFailure = failingCmd
     ? {
         stageId: failingCmd.stageId || failingCmd.phase || "verify",
@@ -440,7 +448,7 @@ export async function gate(opts = {}) {
         exitCode: failingCmd.status ?? null,
         stdout: failingCmd.stdout || "",
         stderr: failingCmd.stderr || "",
-        diagnostics: failingCmd.diagnostics || [],
+        diagnostics: [...netViolationDiagnostics, ...(failingCmd.diagnostics || [])],
       }
     : testTampered
       ? {
@@ -510,6 +518,10 @@ export async function gate(opts = {}) {
   }
 
   if (!verifyOk && opts.fix && failingCmd) {
+    if (isNetViolation) {
+      appendTelemetry(root, "gate_finished", { ok: false, code: 188, networkViolation: true });
+      return { ok: false, code: 188, phases, evidence: evidenceManifest };
+    }
     const repairs = await repair(failingCmd, { config, root, signal: opts.signal, progressBus, progressToken });
     const finalOk = repairs.ok;
     const finalCode = repairs.ok ? 0 : 4;
@@ -520,7 +532,7 @@ export async function gate(opts = {}) {
     return { ok: false, code: 4, phases, repairs, evidence: evidenceManifest };
   }
 
-  const code = verifyOk ? 0 : testTampered ? 3 : 4;
+  const code = verifyOk ? 0 : isNetViolation ? 188 : testTampered ? 3 : 4;
   appendTelemetry(root, "gate_finished", { ok: verifyOk, code });
   return { ok: verifyOk, code, phases, evidence: evidenceManifest };
 }

package/src/git.mjs

@@ -306,7 +306,10 @@ export function ensureBaseFetched(root = process.cwd(), baseRef = "main") {
 }
 
 export function resolveBase(root = process.cwd(), baseRef = "main") {
-  const candidates = [`origin/${baseRef}`, `refs/remotes/origin/${baseRef}`, baseRef];
+  const isHeadRef = baseRef === "HEAD" || baseRef.startsWith("HEAD~") || baseRef.startsWith("HEAD^") || baseRef.startsWith("HEAD@");
+  const candidates = isHeadRef
+    ? [baseRef]
+    : [`origin/${baseRef}`, `refs/remotes/origin/${baseRef}`, baseRef];
   for (const ref of candidates) {
     try {
       const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
@@ -321,20 +324,22 @@ export function resolveBase(root = process.cwd(), baseRef = "main") {
     } catch (_) {}
   }
 
-  ensureBaseFetched(root, baseRef);
+  if (!isHeadRef) {
+    ensureBaseFetched(root, baseRef);
 
-  for (const ref of candidates) {
-    try {
-      const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
-        cwd: root,
-        encoding: "utf-8",
-        shell: false,
-        stdio: ["ignore", "pipe", "ignore"],
-      });
-      if (res && res.trim()) {
-        return res.trim();
-      }
-    } catch (_) {}
+    for (const ref of candidates) {
+      try {
+        const res = execFileSync("git", ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`], {
+          cwd: root,
+          encoding: "utf-8",
+          shell: false,
+          stdio: ["ignore", "pipe", "ignore"],
+        });
+        if (res && res.trim()) {
+          return res.trim();
+        }
+      } catch (_) {}
+    }
   }
 
   throw new GateError(

package/src/security.mjs

@@ -588,6 +588,11 @@ function secretScanVariants(addedLines) {
   // Collapse method concatenations like .concat("...") or .join("")
   dejoined = dejoined.replace(/\.concat\(\s*["'`]/g, "").replace(/\.join\(\s*["'`]{2}\s*\)/g, "");
 
+  // Collapse whitespace/newlines between adjacent base64 characters (including line-wrapped PEM/base64, template literals, and quoted string chunks)
+  const base64Dejoined = stripped
+    .replace(/([A-Za-z0-9+/=_-])\s*[\r\n]+\s*(?=[A-Za-z0-9+/=_-])/g, "$1")
+    .replace(/([A-Za-z0-9+/=_-])["'`]\s*(?:\+\s*)?[\r\n]+\s*["'`]?([A-Za-z0-9+/=_-])/g, "$1$2");
+
   const hexDecoded = tryHexDecodeTokens(dejoined);
   const pctDecoded = tryPercentDecode(dejoined);
   // Confusable / NFKD normalisation runs over both the raw text and the
@@ -597,8 +602,9 @@ function secretScanVariants(addedLines) {
   const confusableDejoined = normalizeSecretText(dejoined);
 
   return {
-    all: [...new Set([addedLines, stripped, dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined])],
+    all: [...new Set([addedLines, stripped, dejoined, base64Dejoined, hexDecoded, pctDecoded, confusable, confusableDejoined])],
     normalized: dejoined,
+    base64Normalized: base64Dejoined,
   };
 }
 
@@ -725,9 +731,22 @@ function decodeBase64Blobs(text, onDecoded) {
  * @returns {boolean}
  */
 export function hasEncodedSecret(text) {
+  if (!text) return false;
   const result = decodeBase64Blobs(text);
   if (result.capped) return true; // Fail closed if cap exceeded
-  return result.decoded.some((plain) => hasHighConfidenceSecret(plain));
+  if (result.decoded.some((plain) => hasHighConfidenceSecret(plain))) return true;
+
+  if (text.includes("\n") || text.includes("\r")) {
+    const collapsed = text
+      .replace(/([A-Za-z0-9+/=_-])\s*[\r\n]+\s*(?=[A-Za-z0-9+/=_-])/g, "$1")
+      .replace(/([A-Za-z0-9+/=_-])["'`]\s*(?:\+\s*)?[\r\n]+\s*["'`]?([A-Za-z0-9+/=_-])/g, "$1$2");
+    if (collapsed !== text) {
+      const collapsedResult = decodeBase64Blobs(collapsed);
+      if (collapsedResult.capped) return true;
+      if (collapsedResult.decoded.some((plain) => hasHighConfidenceSecret(plain))) return true;
+    }
+  }
+  return false;
 }
 
 /**
@@ -784,14 +803,14 @@ function splitDiffByFile(diffText) {
  * @returns {{ severity: string, type: string, description: string, encoded: boolean }|null}
  */
 function classifyAddedLines(addedLines) {
-  const { all: variants, normalized } = secretScanVariants(addedLines);
+  const { all: variants, normalized, base64Normalized } = secretScanVariants(addedLines);
   if (variants.some((v) => hasHighConfidenceSecret(v))) {
     return { severity: "CRITICAL", type: "HIGH_CONFIDENCE_SECRET", encoded: false, description: "High-confidence secret pattern detected in added diff lines" };
   }
   // Only worth decoding when nothing was found in the clear, and only against
   // the fully-normalised text: decoding is the expensive step, and the
   // intermediate variants differ from it in ways base64 blobs do not care about.
-  if (hasEncodedSecret(normalized)) {
+  if (hasEncodedSecret(normalized) || (base64Normalized && hasEncodedSecret(base64Normalized))) {
     // Same type as the cleartext case: every gate that blocks on
     // HIGH_CONFIDENCE_SECRET should block on this too, and a new type would
     // have silently passed through the ones not updated. The description
@@ -868,6 +887,17 @@ export function checkTestTampering(diffOrText = "", options = {}) {
 
   const COMMENTED_ASSERTION = /^\+\s*(?:\/\/|\/\*)\s*(?:expect\(|assert\.|assert\(|t\.expect|t\.assert)/i;
 
+  const VACUOUS_ASSERTIONS = [
+    { pattern: /\bassert(?:\.ok)?\s*\(\s*true\s*(?:,[^)]*)?\)/i, desc: "Vacuous truth assertion (assert.ok(true))" },
+    { pattern: /\bassert\.(?:strictEqual|deepStrictEqual|equal|deepEqual)\s*\(\s*([^,]+?)\s*,\s*\1\s*(?:,[^)]*)?\)/i, desc: "Vacuous identity assertion (assert.equal(X, X))" },
+    { pattern: /\bexpect\s*\(\s*true\s*\)\s*\.(?:toBe|toEqual)\s*\(\s*true\s*\)/i, desc: "Vacuous truth expectation (expect(true).toBe(true))" },
+    { pattern: /\bexpect\s*\(\s*([^)]+?)\s*\)\s*\.(?:toBe|toEqual)\s*\(\s*\1\s*\)/i, desc: "Vacuous identity expectation (expect(X).toBe(X))" },
+    { pattern: /\bexpect\s*\(\s*true\s*\)\s*\.toBeTruthy\s*\(/i, desc: "Vacuous truth expectation (expect(true).toBeTruthy())" },
+    { pattern: /\bexpect\s*\(\s*false\s*\)\s*\.toBeFalsy\s*\(/i, desc: "Vacuous falsity expectation (expect(false).toBeFalsy())" },
+    { pattern: /\bassert\.(?:isTrue|isOk)\s*\(\s*true\s*(?:,[^)]*)?\)/i, desc: "Vacuous truth assertion (assert.isTrue(true))" },
+    { pattern: /\bassert\.(?:isFalse|isNotOk)\s*\(\s*false\s*(?:,[^)]*)?\)/i, desc: "Vacuous falsity assertion (assert.isFalse(false))" },
+  ];
+
   for (let i = 0; i < lines.length; i++) {
     const line = lines[i];
     if ((line.startsWith("+++ ") || line.startsWith("+++ b/") || line.startsWith("+++ /dev/null")) && !line.startsWith("++++")) {
@@ -902,6 +932,18 @@ export function checkTestTampering(diffOrText = "", options = {}) {
         }
       }
 
+      // Check vacuous assertions
+      for (const vacuousRule of VACUOUS_ASSERTIONS) {
+        if (vacuousRule.pattern.test(addedText)) {
+          violations.push({
+            file: currentFile,
+            line: currentLineNo,
+            type: "VACUOUS_ASSERTION",
+            reason: `Test Tamper Guard: ${vacuousRule.desc} detected in ${currentFile}${currentLineNo ? `:${currentLineNo}` : ""}`,
+          });
+        }
+      }
+
       // Check commented-out assertions
       if (COMMENTED_ASSERTION.test(line)) {
         violations.push({

package/src/wizard-init.mjs

@@ -123,7 +123,7 @@ export function planInit(root = process.cwd(), options = {}) {
   const tierName = options.tier || FALLBACK_TIER;
   // An unrecognised name resolves the same way loadConfig() resolves it, so the
   // scaffolded limits always match what the runtime will later enforce.
-  const limits = TIER_PROFILES[tierName] || TIER_PROFILES[FALLBACK_TIER];
+  const tierPresetLimits = TIER_PROFILES[tierName] || TIER_PROFILES[FALLBACK_TIER];
 
   // Preserve existing config if present
   let existingConfig = {};
@@ -134,6 +134,21 @@ export function planInit(root = process.cwd(), options = {}) {
     } catch (_) {}
   }
 
+  // Preserve existing jules.yml if present
+  let existingJules = {};
+  const existingJulesPath = join(root, ".agent", "jules.yml");
+  if (existsSync(existingJulesPath)) {
+    try {
+      existingJules = parseYaml(readFileSync(existingJulesPath, "utf-8")) || {};
+    } catch (_) {}
+  }
+
+  const customLimits = options.limits || existingConfig.limits;
+  const isCustomLimits = customLimits && Object.entries(customLimits).some(
+    ([k, v]) => v !== undefined && tierPresetLimits[k] !== undefined && Number(v) !== Number(tierPresetLimits[k])
+  );
+  const limits = isCustomLimits ? { ...tierPresetLimits, ...customLimits } : tierPresetLimits;
+
   const verify = {
     test: options.testCmd || existingConfig.verify?.test || oracle.candidates.testCmd || "",
     build: options.buildCmd || existingConfig.verify?.build || oracle.candidates.buildCmd || "",
@@ -143,19 +158,17 @@ export function planInit(root = process.cwd(), options = {}) {
 
   const selectedPresets = options.presets || existingConfig.presets || ["nightly-security-audit", "flaky-test-quarantine"];
 
+  const limitsBlock = isCustomLimits
+    ? `\nlimits:\n  concurrency: ${limits.concurrency}\n  daily_tasks: ${limits.daily_tasks}\n  stagger_ms: ${limits.stagger_ms}\n  diff_kb: ${limits.diff_kb}\n`
+    : "";
+
   const configYaml = `# Google Jules Orchestrator Kit Config (v${KIT_VERSION})
 version: 1
 provider: ${existingConfig.provider || "jules"}
 tier: ${tierName}
 base_branch: ${options.baseBranch || existingConfig.base_branch || "main"}
 branch_prefix: ${existingConfig.branch_prefix || "agent/"}
-
-limits:
-  concurrency: ${limits.concurrency}
-  daily_tasks: ${limits.daily_tasks}
-  stagger_ms: ${limits.stagger_ms}
-  diff_kb: ${limits.diff_kb}
-
+${limitsBlock}
 verify:
   test: "${verify.test}"
   build: "${verify.build}"
@@ -166,10 +179,23 @@ presets:
 ${selectedPresets.map((p) => `  - ${p}`).join("\n")}
 `;
 
-  const julesYaml = `# Google Jules Agent Compatibility Manifest
-version: 1
+  const forbiddenPaths = options.forbiddenPaths || existingJules.forbidden_paths || [
+    ".github/**",
+    "**/secrets/**",
+    "**/*.pem",
+    "**/lock-manager/**",
+    "scripts/jules-self-audit.mjs",
+    ".agent/jules.yml",
+  ];
+  const allowPaths = options.allowPaths || existingJules.allow_paths || [];
+
+  const julesYaml = `# Google Jules Repository Configuration (Version 2)
+version: 2
 test_cmd: "${verify.test}"
 build_cmd: "${verify.build}"
+forbidden_paths:
+${forbiddenPaths.map((p) => `  - "${p}"`).join("\n")}
+allow_paths: ${allowPaths.length > 0 ? "\n" + allowPaths.map((p) => `  - "${p}"`).join("\n") : "[]"}
 `;
 
   return {