knodin 0.7.4 → 0.7.6

package/dist/src/engine/source-policy.js

@@ -1,69 +0,0 @@
-import path from "node:path";
-import { isIndexablePath } from "./prune.js";
-const SOURCE_EXTENSIONS = new Set([
-    ".ts",
-    ".tsx",
-    ".mts",
-    ".cts",
-    ".js",
-    ".jsx",
-    ".mjs",
-    ".cjs",
-    ".py",
-    ".cls",
-    ".trigger",
-    ".page",
-    ".component",
-    ".app",
-    ".cmp",
-    ".design",
-    ".docs",
-    ".evt",
-    ".intf",
-    ".svg",
-    ".sql",
-    ".pkb",
-    ".pks",
-    ".prisma",
-    ".java",
-    ".cs",
-    ".go",
-    ".rs",
-    ".clp",
-    ".ws",
-    ".xml",
-    ".tf",
-    ".tfvars",
-    ".hcl",
-    ".dockerfile",
-    ".lsif",
-]);
-function isSalesforceBundleMarkup(normalized) {
-    return (/^force-app\/main\/default\/lwc\/([A-Za-z][A-Za-z0-9_]*)\/\1\.(?:html|css)$/.test(normalized) ||
-        /^force-app\/main\/default\/aura\/([A-Za-z][A-Za-z0-9_]*)\/\1\.(?:css)$/.test(normalized));
-}
-function isSalesforceExperienceJson(normalized) {
-    return (normalized === "lwr.config.json" ||
-        /^force-app\/main\/default\/experiences\/[A-Za-z][A-Za-z0-9_]*\/(?:routes|views|themes)\/[^/]+\.json$/.test(normalized));
-}
-/**
- * Canonical, path-only candidate policy shared by full-repository collection,
- * file watching, repair selection, and Git-hook refresh. Content-sensitive
- * formats (currently dbt manifest.json) are accepted as candidates here and
- * validated by the parser before symbols are persisted.
- */
-export function isIndexableSourcePath(relativePath) {
-    if (!isIndexablePath(relativePath))
-        return false;
-    const normalized = relativePath.replaceAll("\\", "/");
-    const base = path.posix.basename(normalized);
-    if (base === "Dockerfile")
-        return true;
-    if (normalized.endsWith(".json")) {
-        return base === "manifest.json" || isSalesforceExperienceJson(normalized);
-    }
-    if (normalized.endsWith(".html") || normalized.endsWith(".css")) {
-        return isSalesforceBundleMarkup(normalized);
-    }
-    return SOURCE_EXTENSIONS.has(path.posix.extname(normalized));
-}

package/dist/src/engine/sqlite.js

@@ -1,71 +0,0 @@
-/**
- * Production SQLite adapter for the Node runtime.
- *
- * knodin's engine was originally written against the compact `bun:sqlite`
- * surface. Node 24 ships `node:sqlite` without a runtime flag, so this adapter
- * preserves the engine's existing typed `query<Row, Params>()` contract while
- * using Node's native `DatabaseSync` implementation underneath.
- */
-import { DatabaseSync } from "node:sqlite";
-/**
- * knodin's call sites pass bind params either spread (`stmt.all(a, b)`) or as a
- * single array (`db.run(sql, [a, b])`). node:sqlite wants them spread — normalize a
- * lone array argument back into a spread list. SQLite has no array column type,
- * so a single array can only ever mean "the parameter list", never one value.
- */
-function normalize(params) {
-    if (params.length === 1 && Array.isArray(params[0]))
-        return params[0];
-    return params;
-}
-class Statement {
-    // node:sqlite's parameter union is intentionally narrower than the engine's
-    // generic call-site contract. Runtime validation still belongs to SQLite.
-    // biome-ignore lint/suspicious/noExplicitAny: adapter boundary around native bindings.
-    stmt;
-    // biome-ignore lint/suspicious/noExplicitAny: adapter boundary around native bindings.
-    constructor(stmt) {
-        this.stmt = stmt;
-    }
-    all(...params) {
-        return this.stmt.all(...normalize(params));
-    }
-    get(...params) {
-        return (this.stmt.get(...normalize(params)) ?? null);
-    }
-    run(...params) {
-        return this.stmt.run(...normalize(params));
-    }
-    finalize() {
-        // node:sqlite statements are released on GC; there is nothing to finalize.
-    }
-}
-export class Database {
-    db;
-    constructor(databasePath, options = {}) {
-        this.db = new DatabaseSync(databasePath, { readOnly: options.readonly === true });
-    }
-    query(sql) {
-        return new Statement(this.db.prepare(sql));
-    }
-    prepare(sql) {
-        return new Statement(this.db.prepare(sql));
-    }
-    run(sql, ...params) {
-        if (params.length === 0) {
-            // DDL / PRAGMA / BEGIN / COMMIT / multi-statement schema — `exec` avoids
-            // prepare() edge cases and handles more-than-one statement in one string.
-            this.db.exec(sql);
-            return { changes: 0, lastInsertRowid: 0 };
-        }
-        // biome-ignore lint/suspicious/noExplicitAny: adapter boundary around native bindings.
-        const statement = this.db.prepare(sql);
-        return statement.run(...normalize(params));
-    }
-    exec(sql) {
-        this.db.exec(sql);
-    }
-    close() {
-        this.db.close();
-    }
-}

package/dist/src/engine/symbol-delete.js

@@ -1,58 +0,0 @@
-/**
- * Single source of truth for "delete symbols, and everything keyed off them" (R17).
- *
- * `symbol_embeddings.symbolId` declares
- * `REFERENCES symbols(id) ON DELETE CASCADE`, but SQLite disables foreign-key
- * enforcement per connection by default, so for the life of the project that
- * cascade never fired: `symbols.id` is AUTOINCREMENT, every re-index of a file
- * deletes its symbols and reinserts them under NEW ids, and the embeddings
- * pointing at the old ids were stranded forever. On `/path/to/large-repository` that had
- * reached 37,258 orphans against 18,629 live symbols — 67% of the table, all
- * of it scanned by semantic search's exact cosine pass.
- *
- * `getOrInitDb` now sets `PRAGMA foreign_keys = ON`, which makes the declared
- * cascade real. These helpers are the second layer: they delete the embeddings
- * EXPLICITLY, so correctness does not depend on a per-connection pragma that
- * some future connection path forgets to set. Every `DELETE FROM symbols` site
- * in the engine goes through here — the R14 lesson (one policy, many thin
- * adapters) applied to deletion instead of ignore rules.
- */
-/**
- * Shared predicate for "this embedding's symbol no longer exists" — the
- * single source of truth for both the DELETE below and the `stats` orphan
- * COUNT in `src/engine/index.ts`, which previously hardcoded the identical
- * SQL as an independent string literal.
- */
-export const ORPHANED_EMBEDDING_PREDICATE = "symbolId NOT IN (SELECT id FROM symbols)";
-/**
- * Purge embeddings whose symbol no longer exists.
- *
- * Idempotent and cheap — a single correlated DELETE. Used by the 13 → 14
- * migration to clean indexes polluted before the cascade worked, and safe to
- * call on an empty or freshly-created table.
- *
- * Deliberately does NOT touch live embeddings: re-embedding a real corpus is
- * ~40 minutes of CPU, so this must stay a purge and never become a wipe.
- */
-export function purgeOrphanEmbeddings(db) {
-    db.run(`DELETE FROM symbol_embeddings WHERE ${ORPHANED_EMBEDDING_PREDICATE}`);
-}
-/** Delete every symbol declared in one repo-relative file, plus its embeddings. */
-export function deleteSymbolsForFile(db, filePath) {
-    db.run("DELETE FROM symbol_embeddings WHERE symbolId IN (SELECT id FROM symbols WHERE filePath = ?)", [filePath]);
-    db.run("DELETE FROM symbols WHERE filePath = ?", [filePath]);
-}
-/**
- * Delete every symbol whose file path matches a LIKE pattern, plus its
- * embeddings. Used by the dbt path, whose symbols live under synthetic
- * `.knodin/dbt/%` paths rather than one real file.
- */
-export function deleteSymbolsMatchingPath(db, likePattern) {
-    db.run("DELETE FROM symbol_embeddings WHERE symbolId IN (SELECT id FROM symbols WHERE filePath LIKE ?)", [likePattern]);
-    db.run("DELETE FROM symbols WHERE filePath LIKE ?", [likePattern]);
-}
-/** Delete every symbol in the index, plus every embedding. Full re-index only. */
-export function deleteAllSymbols(db) {
-    db.run("DELETE FROM symbol_embeddings;");
-    db.run("DELETE FROM symbols;");
-}

package/dist/src/execution-profile.js

@@ -1,203 +0,0 @@
-import childProcess from "node:child_process";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-import { compressOutput } from "./output-compression.js";
-function defaultGlobalConfigPath() {
-    const base = process.env.XDG_CONFIG_HOME
-        ? path.resolve(process.env.XDG_CONFIG_HOME)
-        : path.join(os.homedir(), ".config");
-    return path.join(base, "knodin", "execution.json");
-}
-function readDocument(file) {
-    try {
-        return JSON.parse(fs.readFileSync(file, "utf8"));
-    }
-    catch {
-        return null;
-    }
-}
-function sandboxLiteral(value) {
-    return `"${value.replaceAll("\\", "\\\\").replaceAll('"', '\\"')}"`;
-}
-function macosPolicy(repo, _executable) {
-    const protectedRoots = ["/Users", "/Volumes", "/Network", "/private/tmp", "/private/var/folders"];
-    return [
-        "(version 1)",
-        "(allow default)",
-        "(deny network*)",
-        "(deny process-fork)",
-        `(deny file-read* ${protectedRoots.map((item) => `(subpath ${sandboxLiteral(item)})`).join(" ")})`,
-        "(deny file-write*)",
-        `(allow file-read* file-write* (subpath ${sandboxLiteral(repo)}) (literal "/dev/null"))`,
-    ].join(" ");
-}
-function unavailable(profile, warning) {
-    return {
-        schemaVersion: 1,
-        status: "unavailable",
-        profile,
-        exit: { code: null, signal: null },
-        containment: {
-            level: "containment-unavailable",
-            platform: process.platform,
-            adapter: "unavailable",
-            filesystem: "unavailable",
-            network: "unavailable",
-            processes: "unavailable",
-            warning,
-        },
-        limits: { timeoutMs: 0, maxOutputBytes: 0, maxProcesses: 1 },
-        output: null,
-        audit: { commandTextRecorded: false, profileRecorded: true },
-    };
-}
-function validateProfile(profileName, value) {
-    if (!value || typeof value !== "object")
-        throw new Error(`execution profile ${profileName} is invalid`);
-    const profile = value;
-    if (!path.isAbsolute(profile.executable ?? ""))
-        throw new Error(`execution profile ${profileName}: executable must be absolute`);
-    if (!Array.isArray(profile.args) ||
-        profile.args.some((arg) => typeof arg !== "string" || arg.includes("\0")))
-        throw new Error(`execution profile ${profileName}: args must be a NUL-free string array`);
-    if (profile.network !== "deny")
-        throw new Error(`execution profile ${profileName}: network must be deny`);
-    if (!Number.isInteger(profile.timeoutMs) ||
-        (profile.timeoutMs ?? 0) < 1 ||
-        (profile.timeoutMs ?? 0) > 300_000)
-        throw new Error(`execution profile ${profileName}: timeoutMs must be 1..300000`);
-    if (!Number.isInteger(profile.maxOutputBytes) ||
-        (profile.maxOutputBytes ?? 0) < 256 ||
-        (profile.maxOutputBytes ?? 0) > 16 * 1024 * 1024)
-        throw new Error(`execution profile ${profileName}: maxOutputBytes must be 256..16777216`);
-    if (profile.maxProcesses !== 1)
-        throw new Error(`execution profile ${profileName}: maxProcesses must be 1 for hard fork denial`);
-    if (profile.containment !== undefined && profile.containment !== "fully-contained")
-        throw new Error(`execution profile ${profileName}: only fully-contained is supported`);
-    return profile;
-}
-function appendAudit(repo, record) {
-    const destination = path.join(repo, ".knodin", "execution-audit.jsonl");
-    fs.mkdirSync(path.dirname(destination), { recursive: true });
-    fs.appendFileSync(destination, `${JSON.stringify(record)}\n`, { mode: 0o600 });
-}
-export async function runExecutionProfile(options) {
-    const repo = fs.realpathSync(options.repo);
-    if (!/^[a-z][a-z0-9_-]{0,63}$/.test(options.profile))
-        throw new Error("execution profile identity must match [a-z][a-z0-9_-]{0,63}");
-    const globalDocument = readDocument(options.globalConfigPath ?? defaultGlobalConfigPath());
-    const repositoryDocument = readDocument(path.join(repo, ".knodin", "execution.json"));
-    if (globalDocument?.execution?.enabled !== true)
-        return unavailable(options.profile, "execution is disabled globally");
-    if (repositoryDocument?.execution?.enabled !== true)
-        return unavailable(options.profile, "execution is disabled for this repository");
-    const configured = repositoryDocument.execution.profiles?.[options.profile];
-    if (!configured)
-        throw new Error(`execution profile not found: ${options.profile}`);
-    const profile = validateProfile(options.profile, configured);
-    if (process.platform !== "darwin" || !fs.existsSync("/usr/bin/sandbox-exec"))
-        return unavailable(options.profile, "no certified containment adapter is available on this platform");
-    const executable = fs.realpathSync(profile.executable);
-    const temporaryDirectory = fs.mkdtempSync(path.join(repo, ".knodin", "execution-tmp-"));
-    const environment = {
-        PATH: `${path.dirname(executable)}:/usr/bin:/bin`,
-        LANG: "C.UTF-8",
-        LC_ALL: "C.UTF-8",
-        TMPDIR: temporaryDirectory,
-    };
-    const policy = macosPolicy(repo, executable);
-    const proc = childProcess.spawn("/usr/bin/sandbox-exec", ["-p", policy, executable, ...profile.args], {
-        cwd: repo,
-        env: environment,
-        shell: false,
-        detached: true,
-        stdio: ["ignore", "pipe", "pipe"],
-    });
-    let stdout = Buffer.alloc(0);
-    let stderr = Buffer.alloc(0);
-    let reason = "exit";
-    let stopped = false;
-    const stop = (next) => {
-        if (stopped || reason !== "exit")
-            return;
-        reason = next;
-        if (proc.pid)
-            try {
-                process.kill(-proc.pid, "SIGKILL");
-            }
-            catch { }
-    };
-    const append = (stream, chunk) => {
-        const remaining = Math.max(0, profile.maxOutputBytes - stdout.length - stderr.length);
-        const accepted = chunk.subarray(0, remaining);
-        if (stream === "stdout")
-            stdout = Buffer.concat([stdout, accepted]);
-        else
-            stderr = Buffer.concat([stderr, accepted]);
-        if (accepted.length < chunk.length)
-            stop("output-limit");
-    };
-    proc.stdout.on("data", (chunk) => append("stdout", chunk));
-    proc.stderr.on("data", (chunk) => append("stderr", chunk));
-    const timer = setTimeout(() => stop("timeout"), profile.timeoutMs);
-    const closed = await new Promise((resolve, reject) => {
-        proc.once("error", reject);
-        proc.once("close", (code, signal) => resolve({ code, signal }));
-    });
-    stopped = true;
-    clearTimeout(timer);
-    fs.rmSync(temporaryDirectory, { recursive: true, force: true });
-    const combined = [
-        ...(stdout.length ? [{ stream: "stdout", text: stdout.toString("utf8") }] : []),
-        ...(stderr.length ? [{ stream: "stderr", text: stderr.toString("utf8") }] : []),
-    ];
-    const output = compressOutput(repo, {
-        events: combined,
-        exitCode: closed.code,
-        signal: closed.signal,
-        lineBudget: 200,
-        byteBudget: Math.min(profile.maxOutputBytes, 16_384),
-        retain: true,
-    });
-    const finalReason = reason;
-    const status = finalReason === "timeout"
-        ? "timed-out"
-        : finalReason === "output-limit"
-            ? "output-limit"
-            : closed.code === 0
-                ? "completed"
-                : "failed";
-    const result = {
-        schemaVersion: 1,
-        status,
-        profile: options.profile,
-        exit: closed,
-        containment: {
-            level: "fully-contained",
-            platform: process.platform,
-            adapter: "macos-sandbox-exec",
-            filesystem: "repository-write-user-data-read-bounded",
-            network: "deny",
-            processes: "fork-denied",
-            warning: "macOS sandbox-exec is deprecated. Writes are repository-bound; system runtime paths remain readable while user homes, mounted volumes, network paths, and shared temporary roots are read-denied outside the repository.",
-        },
-        limits: {
-            timeoutMs: profile.timeoutMs,
-            maxOutputBytes: profile.maxOutputBytes,
-            maxProcesses: 1,
-        },
-        output,
-        audit: { commandTextRecorded: false, profileRecorded: true },
-    };
-    appendAudit(repo, {
-        timestamp: new Date().toISOString(),
-        profile: options.profile,
-        status,
-        exitCode: closed.code,
-        signal: closed.signal,
-        containment: result.containment.level,
-        outputArtifactId: output.artifact.id,
-    });
-    return result;
-}