looply-cli 0.0.0-stage → 0.2.0

package/dist/tool-call-record.js

@@ -0,0 +1,276 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RECORD_LIMITS = exports.NO_RECORD = exports.nodeRecordFs = exports.CAPPED_BECAUSE = exports.MAX_FIELD_CHARS = exports.TOOL_CALL_CAP_BYTES = exports.TOOL_CALL_FILE = void 0;
+exports.identityOf = identityOf;
+exports.answerOf = answerOf;
+exports.entryFor = entryFor;
+exports.makeToolCallRecorder = makeToolCallRecorder;
+exports.summariseToolCalls = summariseToolCalls;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const tool_protocol_1 = require("./tool-protocol");
+/**
+ * WHAT THE BRIDGE ACTUALLY SERVED.
+ *
+ * 🔴 A MODEL-QUOTED TOOL ERROR COULD NOT BE MATCHED TO ANYTHING. The round's
+ * note carries the model's sentence about a tool that failed, and nothing
+ * carried the other half — so the one question worth asking, *did the bridge
+ * serve what the model says it served*, could not be answered at all, and any
+ * argument about it was two people reading the same quote. The capability
+ * audit's G-05.
+ *
+ * ⚠️ THE BRIDGE KEEPS THIS, NOT THE WORKER, and that is the load-bearing
+ * choice. `makeToolBridge.call()` is the single funnel: every request arrives
+ * there and every response leaves there, INCLUDING every refusal — a role that
+ * may not call the tool, an exhausted invocation budget, a request whose shape
+ * is wrong, a toolchain that is not there, a worker that did not answer. None
+ * of those ever reaches the worker. They are also a large share of what a model
+ * quotes, so a record kept on the far side would be missing the cases it exists
+ * for.
+ *
+ * ⚠️ WHAT THE MODEL ASKED FOR IS KEPT; WHAT IT WAS GIVEN, OR ASKED TO WRITE, IS
+ * COUNTED AND NEVER COPIED. No `contents`, no `oldText`/`newText`, and none of
+ * the response text. Their sizes are already computed for the invocation budget
+ * and those numbers go in instead. A project-relative path and a search pattern
+ * are what the model chose rather than what the project holds — and this file
+ * sits inside the very checkout whose files it would otherwise be copying, so
+ * they add nothing a reader of that directory does not already have.
+ *
+ * ⚠️ THE RUN ID IS THE SWITCH. A record of what a run was served belongs to a
+ * run; `scan` and `verify` carry no run id and write nothing, byte for byte as
+ * before this existed. It is not a config setting because it could not be one:
+ * `LOOPLY_`-prefixed variables are stripped from the provider's environment and
+ * this process is spawned BY the provider, which is why the daemon's home is
+ * told on argv rather than inherited. And a record that answers a question
+ * raised after the fact is worth nothing if it was switched off when the
+ * surprise happened, which is G-05 restated.
+ */
+/** Beside `events.jsonl` and `run-starts.jsonl`, in the run's own state directory. */
+exports.TOOL_CALL_FILE = 'tool-calls.jsonl';
+/**
+ * How large the record may grow in one checkout.
+ *
+ * A cap rather than a rotation: rewriting an append-only log is how a
+ * neighbour's record gets lost, and this file's whole value is that what it
+ * says happened, happened. Two megabytes is thousands of calls — far more than
+ * the 300 one invocation may make — and it is the file, not the night, that is
+ * bounded.
+ */
+exports.TOOL_CALL_CAP_BYTES = 2 * 1024 * 1024;
+/** Longest model-chosen string kept on an entry. A pattern is identity, not content. */
+exports.MAX_FIELD_CHARS = 512;
+exports.CAPPED_BECAUSE = `this record reached its cap of ${exports.TOOL_CALL_CAP_BYTES} bytes — tool calls after this line are not recorded here`;
+function clip(v) {
+    if (typeof v !== 'string' || v.length === 0)
+        return undefined;
+    return v.length <= exports.MAX_FIELD_CHARS ? v : `${v.slice(0, exports.MAX_FIELD_CHARS)}…`;
+}
+/**
+ * The request's identity, and nothing it carries.
+ *
+ * Read as `unknown` rather than as a typed request on purpose: this is called
+ * on the refusal paths too, where the request failed its shape check and may be
+ * any shape at all. A record that threw on a malformed request would be missing
+ * exactly the entries a person came looking for.
+ */
+function identityOf(raw) {
+    if (raw === null || typeof raw !== 'object')
+        return {};
+    const r = raw;
+    const path = clip(r['path']);
+    const pattern = clip(r['pattern']);
+    const under = clip(r['under']);
+    return {
+        ...(path === undefined ? {} : { path }),
+        ...(pattern === undefined ? {} : { pattern }),
+        ...(under === undefined ? {} : { under }),
+    };
+}
+/** What an answer cost, never what it contained. */
+function answerOf(res) {
+    if (res.ok) {
+        const bytes = res.bytes ?? Buffer.byteLength(res.text, 'utf8');
+        return { bytes, ...(res.truncated === true ? { truncated: true } : {}) };
+    }
+    return { code: res.code, because: clip(res.because) ?? '' };
+}
+function entryFor(raw, res, meta) {
+    return {
+        at: meta.at,
+        runId: meta.runId,
+        role: meta.role,
+        tool: res.tool,
+        ok: res.ok,
+        ms: meta.ms,
+        ...identityOf(raw),
+        ...answerOf(res),
+    };
+}
+exports.nodeRecordFs = {
+    size(path) {
+        try {
+            return (0, node_fs_1.statSync)(path).size;
+        }
+        catch {
+            return null;
+        }
+    },
+    append(path, line) {
+        (0, node_fs_1.appendFileSync)(path, line, 'utf8');
+    },
+    mkdir(dir) {
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    },
+};
+/** A recorder that keeps nothing — what a bridge with no run id gets. */
+exports.NO_RECORD = { record: () => undefined, total: () => undefined };
+/**
+ * The recorder for one bridge, which is one provider invocation.
+ *
+ * ⚠️ IT SWALLOWS ITS OWN FAILURES, deliberately and to the end. A full disk, a
+ * read-only checkout or a path that vanished must cost the round nothing: the
+ * tool call has already been served and its answer is already on its way back
+ * to the model. Losing a line of the record is a smaller harm than turning a
+ * working round into a failed one to complain about bookkeeping.
+ */
+function makeToolCallRecorder(stateDir, meta, deps = {}) {
+    const fs = deps.fs ?? exports.nodeRecordFs;
+    const now = deps.now ?? Date.now;
+    const path = (0, node_path_1.join)(stateDir, exports.TOOL_CALL_FILE);
+    let closed = false;
+    let wrote = false;
+    const write = (body) => {
+        try {
+            fs.mkdir(stateDir);
+            // LED BY A NEWLINE, for the reason `RunStartMarks` wrote down: a torn
+            // write must cost one record rather than two.
+            fs.append(path, `\n${JSON.stringify(body)}\n`);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    };
+    return {
+        record(raw, res, ms) {
+            if (closed)
+                return;
+            const size = fs.size(path) ?? 0;
+            if (size >= exports.TOOL_CALL_CAP_BYTES) {
+                /**
+                 * Already full when this invocation arrived. Nothing is written — not
+                 * even a notice — because the closing line already standing in the file
+                 * says the record is closed, and one such line per invocation for the
+                 * rest of a night would be the unbounded growth the cap exists to stop.
+                 */
+                closed = true;
+                return;
+            }
+            const entry = entryFor(raw, res, {
+                runId: meta.runId,
+                role: meta.role,
+                at: new Date(now()).toISOString(),
+                ms,
+            });
+            if (!write(entry))
+                return;
+            wrote = true;
+            // Crossing the cap makes this the last entry, and it is followed by the
+            // one line that says so. Checked AFTER the write so the entry that
+            // crossed it is kept rather than discarded — it is as much a fact as the
+            // ones before it.
+            if ((fs.size(path) ?? 0) >= exports.TOOL_CALL_CAP_BYTES) {
+                write({ at: new Date(now()).toISOString(), capped: true, because: exports.CAPPED_BECAUSE });
+                closed = true;
+            }
+        },
+        total(spent) {
+            // Only for an invocation that actually recorded something. A totals line
+            // for an invocation whose entries are not in the file would describe
+            // calls a reader cannot find, and a closed record stays closed.
+            if (closed || !wrote)
+                return;
+            write({
+                at: new Date(now()).toISOString(),
+                runId: meta.runId,
+                role: meta.role,
+                invocation: true,
+                calls: spent.calls,
+                bytesRead: spent.bytesRead,
+                bytesWritten: spent.bytesWritten,
+            });
+        },
+    };
+}
+function summariseToolCalls(text) {
+    if (text === null)
+        return null;
+    let calls = 0;
+    let refused = 0;
+    let badLines = 0;
+    let capped = false;
+    let lastRefusal = null;
+    // Plain counters rather than a nullable object built up in place: the total
+    // is a fact about the whole file and is assembled once, at the end, where
+    // "no invocation said anything" can be told from "they summed to zero".
+    let invocations = 0;
+    let servedCalls = 0;
+    let bytesRead = 0;
+    let bytesWritten = 0;
+    for (const line of text.split('\n')) {
+        const t = line.trim();
+        if (t.length === 0)
+            continue;
+        let v;
+        try {
+            v = JSON.parse(t);
+        }
+        catch {
+            badLines += 1;
+            continue;
+        }
+        if (v === null || typeof v !== 'object') {
+            badLines += 1;
+            continue;
+        }
+        const e = v;
+        if (e['capped'] === true) {
+            capped = true;
+            continue;
+        }
+        if (e['invocation'] === true) {
+            const n = (k) => (typeof e[k] === 'number' && Number.isFinite(e[k]) ? e[k] : 0);
+            invocations += 1;
+            servedCalls += n('calls');
+            bytesRead += n('bytesRead');
+            bytesWritten += n('bytesWritten');
+            continue;
+        }
+        if (typeof e['tool'] !== 'string' || typeof e['ok'] !== 'boolean') {
+            badLines += 1;
+            continue;
+        }
+        calls += 1;
+        if (e['ok'] === false) {
+            refused += 1;
+            lastRefusal = {
+                tool: e['tool'],
+                code: typeof e['code'] === 'string' ? e['code'] : 'unknown',
+                because: typeof e['because'] === 'string' ? e['because'] : '',
+            };
+        }
+    }
+    if (calls === 0 && badLines === 0 && !capped && invocations === 0)
+        return null;
+    return {
+        calls,
+        refused,
+        badLines,
+        capped,
+        lastRefusal,
+        served: invocations === 0 ? null : { invocations, calls: servedCalls, bytesRead, bytesWritten },
+    };
+}
+/** Kept beside the cap so a reader can see the two numbers agree. */
+exports.RECORD_LIMITS = { capBytes: exports.TOOL_CALL_CAP_BYTES, fieldChars: exports.MAX_FIELD_CHARS, readBytes: tool_protocol_1.LIMITS.readBytes };
+//# sourceMappingURL=tool-call-record.js.map

package/dist/tool-call-record.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-call-record.js","sourceRoot":"","sources":["../src/tool-call-record.ts"],"names":[],"mappings":";;;AAkHA,gCAWC;AAGD,4BAMC;AAED,4BAeC;AA0DD,oDAsEC;AA4BD,gDAgEC;AAnXD,qCAA8D;AAC9D,yCAAiC;AACjC,mDAAiH;AAEjH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,sFAAsF;AACzE,QAAA,cAAc,GAAG,kBAAkB,CAAC;AAEjD;;;;;;;;GAQG;AACU,QAAA,mBAAmB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAEnD,wFAAwF;AAC3E,QAAA,eAAe,GAAG,GAAG,CAAC;AA0CtB,QAAA,cAAc,GACzB,kCAAkC,2BAAmB,2DAA2D,CAAC;AAEnH,SAAS,IAAI,CAAC,CAAU;IACtB,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAC9D,OAAO,CAAC,CAAC,MAAM,IAAI,uBAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,uBAAe,CAAC,GAAG,CAAC;AAC7E,CAAC;AAED;;;;;;;GAOG;AACH,SAAgB,UAAU,CAAC,GAAY;IACrC,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,EAAE,CAAC;IACvD,MAAM,CAAC,GAAG,GAAqD,CAAC;IAChE,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/B,OAAO;QACL,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;QAC7C,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC;KAC1C,CAAC;AACJ,CAAC;AAED,oDAAoD;AACpD,SAAgB,QAAQ,CAAC,GAAiB;IACxC,IAAI,GAAG,CAAC,EAAE,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,IAAI,MAAM,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/D,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAa,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IACpF,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;AAC9D,CAAC;AAED,SAAgB,QAAQ,CACtB,GAAY,EACZ,GAAiB,EACjB,IAA6D;IAE7D,OAAO;QACL,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,IAAI,EAAE,IAAI,CAAC,IAAI;QACf,IAAI,EAAE,GAAG,CAAC,IAAI;QACd,EAAE,EAAE,GAAG,CAAC,EAAE;QACV,EAAE,EAAE,IAAI,CAAC,EAAE;QACX,GAAG,UAAU,CAAC,GAAG,CAAC;QAClB,GAAG,QAAQ,CAAC,GAAG,CAAC;KACjB,CAAC;AACJ,CAAC;AAQY,QAAA,YAAY,GAAa;IACpC,IAAI,CAAC,IAAI;QACP,IAAI,CAAC;YACH,OAAO,IAAA,kBAAQ,EAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QAC7B,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,MAAM,CAAC,IAAI,EAAE,IAAI;QACf,IAAA,wBAAc,EAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IACD,KAAK,CAAC,GAAG;QACP,IAAA,mBAAS,EAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,CAAC;CACF,CAAC;AAwBF,yEAAyE;AAC5D,QAAA,SAAS,GAAqB,EAAE,MAAM,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,CAAC;AAE/F;;;;;;;;GAQG;AACH,SAAgB,oBAAoB,CAClC,QAAgB,EAChB,IAAqC,EACrC,OAA8C,EAAE;IAEhD,MAAM,EAAE,GAAG,IAAI,CAAC,EAAE,IAAI,oBAAY,CAAC;IACnC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IACjC,MAAM,IAAI,GAAG,IAAA,gBAAI,EAAC,QAAQ,EAAE,sBAAc,CAAC,CAAC;IAC5C,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,KAAK,GAAG,KAAK,CAAC;IAElB,MAAM,KAAK,GAAG,CAAC,IAA8D,EAAW,EAAE;QACxF,IAAI,CAAC;YACH,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;YACnB,sEAAsE;YACtE,8CAA8C;YAC9C,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAC/C,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC;IAEF,OAAO;QACL,MAAM,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;YACjB,IAAI,MAAM;gBAAE,OAAO;YACnB,MAAM,IAAI,GAAG,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,IAAI,IAAI,2BAAmB,EAAE,CAAC;gBAChC;;;;;mBAKG;gBACH,MAAM,GAAG,IAAI,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,KAAK,GAAG,QAAQ,CAAC,GAAG,EAAE,GAAG,EAAE;gBAC/B,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACjC,EAAE;aACH,CAAC,CAAC;YACH,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC;gBAAE,OAAO;YAC1B,KAAK,GAAG,IAAI,CAAC;YACb,wEAAwE;YACxE,mEAAmE;YACnE,yEAAyE;YACzE,kBAAkB;YAClB,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,2BAAmB,EAAE,CAAC;gBAChD,KAAK,CAAC,EAAE,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,sBAAc,EAAE,CAAC,CAAC;gBACpF,MAAM,GAAG,IAAI,CAAC;YAChB,CAAC;QACH,CAAC;QACD,KAAK,CAAC,KAAK;YACT,yEAAyE;YACzE,qEAAqE;YACrE,gEAAgE;YAChE,IAAI,MAAM,IAAI,CAAC,KAAK;gBAAE,OAAO;YAC7B,KAAK,CAAC;gBACJ,EAAE,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,WAAW,EAAE;gBACjC,KAAK,EAAE,IAAI,CAAC,KAAK;gBACjB,IAAI,EAAE,IAAI,CAAC,IAAI;gBACf,UAAU,EAAE,IAAI;gBAChB,KAAK,EAAE,KAAK,CAAC,KAAK;gBAClB,SAAS,EAAE,KAAK,CAAC,SAAS;gBAC1B,YAAY,EAAE,KAAK,CAAC,YAAY;aACjC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AA4BD,SAAgB,kBAAkB,CAAC,IAAmB;IACpD,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,WAAW,GAAmC,IAAI,CAAC;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,IAAI,YAAY,GAAG,CAAC,CAAC;IACrB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAC7B,IAAI,CAAU,CAAC;QACf,IAAI,CAAC;YACH,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QACpB,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;YACxC,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,MAAM,CAAC,GAAG,CAA4B,CAAC;QACvC,IAAI,CAAC,CAAC,QAAQ,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,MAAM,GAAG,IAAI,CAAC;YACd,SAAS;QACX,CAAC;QACD,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,IAAI,EAAE,CAAC;YAC7B,MAAM,CAAC,GAAG,CAAC,CAAS,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;YAC5G,WAAW,IAAI,CAAC,CAAC;YACjB,WAAW,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;YAC1B,SAAS,IAAI,CAAC,CAAC,WAAW,CAAC,CAAC;YAC5B,YAAY,IAAI,CAAC,CAAC,cAAc,CAAC,CAAC;YAClC,SAAS;QACX,CAAC;QACD,IAAI,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,SAAS,EAAE,CAAC;YAClE,QAAQ,IAAI,CAAC,CAAC;YACd,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;QACX,IAAI,CAAC,CAAC,IAAI,CAAC,KAAK,KAAK,EAAE,CAAC;YACtB,OAAO,IAAI,CAAC,CAAC;YACb,WAAW,GAAG;gBACZ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;gBACf,IAAI,EAAE,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS;gBAC3D,OAAO,EAAE,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE;aAC9D,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,IAAI,CAAC,MAAM,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC/E,OAAO;QACL,KAAK;QACL,OAAO;QACP,QAAQ;QACR,MAAM;QACN,WAAW;QACX,MAAM,EAAE,WAAW,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,EAAE,WAAW,EAAE,SAAS,EAAE,YAAY,EAAE;KAChG,CAAC;AACJ,CAAC;AAED,qEAAqE;AACxD,QAAA,aAAa,GAAG,EAAE,QAAQ,EAAE,2BAAmB,EAAE,UAAU,EAAE,uBAAe,EAAE,SAAS,EAAE,sBAAM,CAAC,SAAS,EAAE,CAAC"}

package/dist/tool-protocol.d.ts

@@ -0,0 +1,135 @@
+/**
+ * WHAT THE MODEL MAY ASK FOR, AND WHAT IT GETS BACK.
+ *
+ * The provider transport runs OUTSIDE the container — it has to, because the
+ * packaged provider spawns children with piped stdio and an AppContainer cannot
+ * create the named pipes that requires. So the process holding the model is no
+ * longer the untrusted executor, and the boundary moves:
+ *
+ *   the model has no host tools at all; every capability it can call is one of
+ *   these, implemented by Looply, and performed inside the container.
+ *
+ * That is the whole point of this file. It is a data contract, not a
+ * capability: nothing here executes anything, and a request that arrives
+ * malformed or hostile is a value to reject rather than a path to follow.
+ *
+ * NOTHING HERE RUNS A COMMAND. There is deliberately no shell, no exec, no
+ * "run", no git and no fetch. Project code is executed in exactly one place —
+ * the gate — under Looply's own orchestration, never at the model's request.
+ */
+/** The tools a model may call. Adding one is a security decision. */
+export declare const TOOL_NAMES: readonly ["read", "glob", "grep", "edit", "write"];
+export type ToolName = (typeof TOOL_NAMES)[number];
+/**
+ * Bounds on a single call.
+ *
+ * A tool result becomes model context, and an unbounded one is both a way to
+ * exhaust this machine's memory and a way to spend the round's budget in one
+ * call. These are ceilings, not promises: a worker may return less.
+ */
+export declare const LIMITS: {
+    /** A file the model reads. Larger files come back truncated, and say so. */
+    readonly readBytes: number;
+    /** Lines returned from one read. */
+    readonly readLines: 4000;
+    /** Paths from one glob. */
+    readonly globPaths: 1000;
+    /** Matching lines from one grep. */
+    readonly grepMatches: 200;
+    /** Bytes of one written or edited file. */
+    readonly writeBytes: number;
+    /** Files walked before a glob or grep gives up and says it was truncated. */
+    readonly walkFiles: 20000;
+};
+/**
+ * Bounds across ONE provider invocation.
+ *
+ * The model may call tools many times inside a single session — that is the
+ * point of the design, and it is also a loop nobody is watching. These are the
+ * inner safety budget. They are deliberately NOT the Goal or autonomy budgets,
+ * which count provider invocations and belong to Phase 6.
+ */
+export declare const INVOCATION_BUDGET: {
+    readonly calls: 300;
+    readonly bytesRead: number;
+    readonly bytesWritten: number;
+};
+export interface ReadRequest {
+    tool: 'read';
+    /** Project-relative. Absolute, UNC, device and escaping paths are refused. */
+    path: string;
+    /** 1-based, inclusive. Omitted means from the start. */
+    fromLine?: number;
+    /** 1-based, inclusive. Omitted means to the end, subject to the limits. */
+    toLine?: number;
+}
+export interface GlobRequest {
+    tool: 'glob';
+    /** A `*`/`**`/`?` pattern, matched against project-relative paths. */
+    pattern: string;
+    /** Project-relative subdirectory to search under. */
+    under?: string;
+}
+export interface GrepRequest {
+    tool: 'grep';
+    /** A JavaScript regular expression source. */
+    pattern: string;
+    /** Restrict to paths matching this glob. */
+    include?: string;
+    under?: string;
+    ignoreCase?: boolean;
+}
+export interface EditRequest {
+    tool: 'edit';
+    path: string;
+    /**
+     * The text as the model believes it currently is.
+     *
+     * An edit that carries its expectation can be applied at most once: replaying
+     * it finds the text already gone and fails, which is what makes a retried
+     * turn safe. A fuzzy match would silently do something else.
+     */
+    oldText: string;
+    newText: string;
+    /** How many occurrences the model expects. Defaults to exactly one. */
+    expected?: number;
+}
+export interface WriteRequest {
+    tool: 'write';
+    path: string;
+    contents: string;
+    /** `create` refuses to clobber; `overwrite` requires the file to exist. */
+    intent: 'create' | 'overwrite';
+}
+export type ToolRequest = ReadRequest | GlobRequest | GrepRequest | EditRequest | WriteRequest;
+/**
+ * The answer to one call.
+ *
+ * A refusal is a VALUE, not an exception: the model is expected to be told "no"
+ * and to carry on, and a transport-level error would end the session instead.
+ */
+export type ToolResponse = {
+    ok: true;
+    tool: ToolName;
+    text: string;
+    truncated?: boolean;
+    bytes?: number;
+} | {
+    ok: false;
+    tool: ToolName | 'unknown';
+    because: string;
+    code: ToolErrorCode;
+};
+export type ToolErrorCode = 'bad_request' | 'path_not_allowed' | 'not_found' | 'denied' | 'not_text' | 'precondition_failed' | 'too_large' | 'budget_exhausted' | 'worker_failed';
+/**
+ * A first, LEXICAL check on a model-supplied path.
+ *
+ * Deliberately not the boundary. It runs in trusted code, so a bug here is a
+ * bug in the trusted process, and the whole architecture is arranged so that
+ * such a bug is survivable: the worker resolves the physical path and the
+ * container refuses what it was never granted. This exists to turn obvious
+ * nonsense into a clean structured refusal instead of a container denial that
+ * reads like a crash.
+ */
+export declare function pathTrouble(p: string): string | null;
+//# sourceMappingURL=tool-protocol.d.ts.map

package/dist/tool-protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-protocol.d.ts","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,qEAAqE;AACrE,eAAO,MAAM,UAAU,oDAAqD,CAAC;AAC7E,MAAM,MAAM,QAAQ,GAAG,CAAC,OAAO,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC;AAEnD;;;;;;GAMG;AACH,eAAO,MAAM,MAAM;IACjB,4EAA4E;;IAE5E,oCAAoC;;IAEpC,2BAA2B;;IAE3B,oCAAoC;;IAEpC,2CAA2C;;IAE3C,6EAA6E;;CAErE,CAAC;AAEX;;;;;;;GAOG;AACH,eAAO,MAAM,iBAAiB;;;;CAIpB,CAAC;AAEX,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8EAA8E;IAC9E,IAAI,EAAE,MAAM,CAAC;IACb,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,2EAA2E;IAC3E,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,sEAAsE;IACtE,OAAO,EAAE,MAAM,CAAC;IAChB,qDAAqD;IACrD,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,8CAA8C;IAC9C,OAAO,EAAE,MAAM,CAAC;IAChB,4CAA4C;IAC5C,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,UAAU,CAAC,EAAE,OAAO,CAAC;CACtB;AAED,MAAM,WAAW,WAAW;IAC1B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb;;;;;;OAMG;IACH,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,uEAAuE;IACvE,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,OAAO,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,2EAA2E;IAC3E,MAAM,EAAE,QAAQ,GAAG,WAAW,CAAC;CAChC;AAED,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,YAAY,CAAC;AAE/F;;;;;GAKG;AACH,MAAM,MAAM,YAAY,GACpB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/E;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,QAAQ,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,aAAa,CAAA;CAAE,CAAC;AAEpF,MAAM,MAAM,aAAa,GACrB,aAAa,GACb,kBAAkB,GAClB,WAAW,GACX,QAAQ,GACR,UAAU,GACV,qBAAqB,GACrB,WAAW,GACX,kBAAkB,GAClB,eAAe,CAAC;AAEpB;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA2BpD"}

package/dist/tool-protocol.js

@@ -0,0 +1,104 @@
+"use strict";
+/**
+ * WHAT THE MODEL MAY ASK FOR, AND WHAT IT GETS BACK.
+ *
+ * The provider transport runs OUTSIDE the container — it has to, because the
+ * packaged provider spawns children with piped stdio and an AppContainer cannot
+ * create the named pipes that requires. So the process holding the model is no
+ * longer the untrusted executor, and the boundary moves:
+ *
+ *   the model has no host tools at all; every capability it can call is one of
+ *   these, implemented by Looply, and performed inside the container.
+ *
+ * That is the whole point of this file. It is a data contract, not a
+ * capability: nothing here executes anything, and a request that arrives
+ * malformed or hostile is a value to reject rather than a path to follow.
+ *
+ * NOTHING HERE RUNS A COMMAND. There is deliberately no shell, no exec, no
+ * "run", no git and no fetch. Project code is executed in exactly one place —
+ * the gate — under Looply's own orchestration, never at the model's request.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.INVOCATION_BUDGET = exports.LIMITS = exports.TOOL_NAMES = void 0;
+exports.pathTrouble = pathTrouble;
+/** The tools a model may call. Adding one is a security decision. */
+exports.TOOL_NAMES = ['read', 'glob', 'grep', 'edit', 'write'];
+/**
+ * Bounds on a single call.
+ *
+ * A tool result becomes model context, and an unbounded one is both a way to
+ * exhaust this machine's memory and a way to spend the round's budget in one
+ * call. These are ceilings, not promises: a worker may return less.
+ */
+exports.LIMITS = {
+    /** A file the model reads. Larger files come back truncated, and say so. */
+    readBytes: 256 * 1024,
+    /** Lines returned from one read. */
+    readLines: 4000,
+    /** Paths from one glob. */
+    globPaths: 1000,
+    /** Matching lines from one grep. */
+    grepMatches: 200,
+    /** Bytes of one written or edited file. */
+    writeBytes: 1024 * 1024,
+    /** Files walked before a glob or grep gives up and says it was truncated. */
+    walkFiles: 20_000,
+};
+/**
+ * Bounds across ONE provider invocation.
+ *
+ * The model may call tools many times inside a single session — that is the
+ * point of the design, and it is also a loop nobody is watching. These are the
+ * inner safety budget. They are deliberately NOT the Goal or autonomy budgets,
+ * which count provider invocations and belong to Phase 6.
+ */
+exports.INVOCATION_BUDGET = {
+    calls: 300,
+    bytesRead: 16 * 1024 * 1024,
+    bytesWritten: 8 * 1024 * 1024,
+};
+/**
+ * A first, LEXICAL check on a model-supplied path.
+ *
+ * Deliberately not the boundary. It runs in trusted code, so a bug here is a
+ * bug in the trusted process, and the whole architecture is arranged so that
+ * such a bug is survivable: the worker resolves the physical path and the
+ * container refuses what it was never granted. This exists to turn obvious
+ * nonsense into a clean structured refusal instead of a container denial that
+ * reads like a crash.
+ */
+function pathTrouble(p) {
+    // Separators are built from char codes on purpose. An escaped backslash in
+    // this file has been collapsed by tooling more than once, and a path check
+    // that silently stops matching is the worst possible thing to get wrong.
+    const BS = String.fromCharCode(92);
+    const SL = String.fromCharCode(47);
+    const NUL = String.fromCharCode(0);
+    if (typeof p !== 'string' || p.length === 0)
+        return 'a path is required';
+    if (p.length > 1024)
+        return 'that path is too long';
+    if (p.indexOf(NUL) >= 0)
+        return 'a path may not contain a null byte';
+    // Drive-qualified, UNC and device paths all name somewhere that is not the
+    // project, and the project root is Looply's to decide, not the model's.
+    if (/^[A-Za-z]:/.test(p))
+        return 'paths are project-relative, not drive-qualified';
+    if (p.startsWith(BS + BS) || p.startsWith(SL + SL)) {
+        return 'a UNC path is not a project path';
+    }
+    if (p.startsWith(BS + '?' + BS) || p.startsWith(BS + '.' + BS)) {
+        return 'a device path is not a project path';
+    }
+    if (p.startsWith(SL) || p.startsWith(BS))
+        return 'paths are project-relative';
+    const parts = p.split(BS).join(SL).split(SL);
+    // `..` at any depth, however it is spelled.
+    if (parts.some((s) => s === '..'))
+        return 'a path may not leave the project';
+    // An alternate data stream is a second file hiding behind the same name.
+    if (parts.some((s) => s.includes(':')))
+        return 'a path may not name a stream';
+    return null;
+}
+//# sourceMappingURL=tool-protocol.js.map

package/dist/tool-protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-protocol.js","sourceRoot":"","sources":["../src/tool-protocol.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;GAkBG;;;AA+HH,kCA2BC;AAxJD,qEAAqE;AACxD,QAAA,UAAU,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO,CAAU,CAAC;AAG7E;;;;;;GAMG;AACU,QAAA,MAAM,GAAG;IACpB,4EAA4E;IAC5E,SAAS,EAAE,GAAG,GAAG,IAAI;IACrB,oCAAoC;IACpC,SAAS,EAAE,IAAI;IACf,2BAA2B;IAC3B,SAAS,EAAE,IAAI;IACf,oCAAoC;IACpC,WAAW,EAAE,GAAG;IAChB,2CAA2C;IAC3C,UAAU,EAAE,IAAI,GAAG,IAAI;IACvB,6EAA6E;IAC7E,SAAS,EAAE,MAAM;CACT,CAAC;AAEX;;;;;;;GAOG;AACU,QAAA,iBAAiB,GAAG;IAC/B,KAAK,EAAE,GAAG;IACV,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI;IAC3B,YAAY,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;CACrB,CAAC;AA6EX;;;;;;;;;GASG;AACH,SAAgB,WAAW,CAAC,CAAS;IACnC,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,EAAE,GAAG,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;IACnC,MAAM,GAAG,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;IAEnC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,oBAAoB,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,GAAG,IAAI;QAAE,OAAO,uBAAuB,CAAC;IACpD,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,oCAAoC,CAAC;IACrE,2EAA2E;IAC3E,wEAAwE;IACxE,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,iDAAiD,CAAC;IACnF,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,CAAC;QACnD,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,GAAG,GAAG,GAAG,EAAE,CAAC,EAAE,CAAC;QAC/D,OAAO,qCAAqC,CAAC;IAC/C,CAAC;IACD,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,EAAE,CAAC;QAAE,OAAO,4BAA4B,CAAC;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IAC7C,4CAA4C;IAC5C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC;QAAE,OAAO,kCAAkC,CAAC;IAC7E,yEAAyE;IACzE,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAAE,OAAO,8BAA8B,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/tool-worker.d.ts

@@ -0,0 +1,3 @@
+import type { ToolRequest, ToolResponse } from './tool-protocol';
+export declare function handle(root: string, req: ToolRequest): ToolResponse;
+//# sourceMappingURL=tool-worker.d.ts.map

package/dist/tool-worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-worker.d.ts","sourceRoot":"","sources":["../src/tool-worker.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AA6RjE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,GAAG,YAAY,CA+JnE"}