kifaru 1.0.198 → 1.0.200

package/extensions/kifaru-finding-classification.ts

@@ -0,0 +1,102 @@
+/** Read-only TypeSafe experiment over agent findings in the Pi target dossier. */
+import type { ExtensionAPI } from "@earendil-works/pi-coding-agent"
+import { Type } from "typebox"
+import fs from "node:fs/promises"
+import path from "node:path"
+import { targetSlug } from "./kifaru-dossier"
+
+export type Severity = "critical" | "high" | "medium" | "low" | "info" | "unknown"
+export interface AgentFinding { text: string; severity?: Severity }
+const rank: Record<Severity, number> = { critical: 5, high: 4, medium: 3, low: 2, info: 1, unknown: 0 }
+
+export function severityFromText(text: string): Severity {
+  const match = text.match(/(?:^|\n)\s*(?:\[|severity\s*[:=-]\s*)(critical|high|medium|low|info)(?:\]|\b)/i)
+  return (match?.[1]?.toLowerCase() as Severity | undefined) ?? "unknown"
+}
+
+export function redactFindingText(value: string): string {
+  return value
+    .replace(/\b(?:sk|pk)_[A-Za-z0-9_-]{12,}\b/g, "[REDACTED_KEY]")
+    .replace(/\b(?:AKIA|ASIA)[A-Z0-9]{16}\b/g, "[REDACTED_KEY]")
+    .replace(/\bBearer\s+\S+/gi, "Bearer [REDACTED]")
+    .replace(/\b(?:password|passwd|api[_-]?key|token|secret)\s*[:=]\s*\S+/gi, "[REDACTED_SECRET]")
+    .replace(/\beyJ[A-Za-z0-9_-]+\.eyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b/g, "[REDACTED_JWT]")
+    .replace(/\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}\b/g, "[REDACTED_EMAIL]")
+    .replace(/https?:\/\/[^\s)]+/gi, "[REDACTED_URL]")
+    .slice(0, 1800)
+}
+
+export const detailQuestion = {
+  type: "score",
+  instructions: "How complete is this security finding for an independent reviewer to understand and reproduce the claimed issue? Judge only the supplied report text. Do not infer missing evidence or judge severity.",
+  criteria: [
+    "Thin: the issue or affected behavior is unclear, with no usable reproduction or impact explanation.",
+    "Partial: the issue and impact are understandable, but reproduction, evidence, or remediation detail is missing.",
+    "Actionable: the issue, impact, reproduction evidence, and remediation are clear enough for independent triage.",
+  ],
+} as const
+
+export function classifyFinding(finding: AgentFinding, score: number, confidence: number) {
+  const severity = finding.severity ?? severityFromText(finding.text)
+  const detail = score < 0.75 ? "thin" : score < 1.5 ? "partial" : "actionable"
+  const review = confidence < 0.5 || severity === "unknown"
+    ? "manual_review"
+    : rank[severity] >= 4 && detail !== "actionable" ? "needs_detail" : "ready_for_triage"
+  return { severity, detail, detailScore: score, confidence, review }
+}
+
+export async function dossierFindings(target: string, cwd = process.cwd()): Promise<AgentFinding[]> {
+  const file = path.join(cwd, ".kifaru", "dossiers", `${targetSlug(target)}.json`)
+  const data = await fs.readFile(file, "utf8").then((raw) => JSON.parse(raw) as { findings?: unknown }).catch(() => null)
+  return Array.isArray(data?.findings)
+    ? data.findings.filter((item): item is string => typeof item === "string").map((text) => ({ text }))
+    : []
+}
+
+export default function (pi: ExtensionAPI) {
+  pi.registerTool({
+    name: "kifaru_finding_classification",
+    label: "Finding Classification Experiment",
+    description: "Read-only TypeSafe experiment: classify agent findings by recorded severity and report detail. Supply findings or a target whose Pi dossier contains findings. Requires TYPESAFE_API_KEY. Advisory only; does not change the dossier or report.",
+    promptSnippet: "Experimentally classify recorded findings by severity and report detail",
+    parameters: Type.Object({
+      target: Type.Optional(Type.String({ description: "Target whose .kifaru/dossiers/<slug>.json findings to read" })),
+      findings: Type.Optional(Type.Array(Type.Object({
+        text: Type.String({ description: "Finding report text" }),
+        severity: Type.Optional(Type.Union(["critical", "high", "medium", "low", "info", "unknown"].map((s) => Type.Literal(s)))),
+      }), { description: "Agent findings to classify directly; overrides target dossier findings" })),
+    }),
+    async execute(_toolCallId, params: { target?: string; findings?: AgentFinding[] }) {
+      const result = (text: string, details: Record<string, unknown> = {}) => ({ content: [{ type: "text" as const, text }], details })
+      const key = process.env.TYPESAFE_API_KEY
+      if (!key) return result("Experiment unavailable: set TYPESAFE_API_KEY in the Pi process environment.", { ok: false })
+      if (!params.findings && !params.target) return result("Supply findings or target.", { ok: false })
+      const findings = params.findings ?? await dossierFindings(params.target!)
+      if (!findings.length) return result("No agent findings to classify.", { ok: true, findings: [] })
+      const classifications = []
+      for (const [index, finding] of findings.entries()) {
+        let response: Response
+        try {
+          response = await fetch("https://api.typesafe.ai/v1/systemone", {
+            method: "POST",
+            headers: { Authorization: `Bearer ${key}`, "Content-Type": "application/json" },
+            body: JSON.stringify({ model: "jev-latest", state: { report: redactFindingText(finding.text) }, questions: { report_detail: detailQuestion } }),
+            signal: AbortSignal.timeout(15_000),
+          })
+        } catch {
+          return result(`TypeSafe request failed at finding ${index + 1}; no dossier data changed.`, { ok: false })
+        }
+        if (!response.ok) return result(`TypeSafe returned HTTP ${response.status} at finding ${index + 1}; no dossier data changed.`, { ok: false })
+        let data: { model?: string; answers?: { report_detail?: { type?: string; score?: number; confidence?: number } } }
+        try { data = await response.json() } catch { return result(`Invalid TypeSafe JSON at finding ${index + 1}.`, { ok: false }) }
+        const answer = data.answers?.report_detail
+        if (answer?.type !== "score" || typeof answer.score !== "number" || !Number.isFinite(answer.score) || answer.score < 0 || answer.score > 2 || typeof answer.confidence !== "number" || !Number.isFinite(answer.confidence) || answer.confidence < 0 || answer.confidence > 1) {
+          return result(`Invalid TypeSafe score at finding ${index + 1}.`, { ok: false })
+        }
+        classifications.push({ index: index + 1, ...classifyFinding(finding, answer.score, answer.confidence), model: data.model })
+      }
+      classifications.sort((a, b) => rank[b.severity] - rank[a.severity] || a.detailScore - b.detailScore)
+      return result(JSON.stringify({ advisory: true, classifications }, null, 2), { ok: true, classifications })
+    },
+  })
+}