magi-ai 0.1.0

package/dist/src/config/user-config.js

@@ -0,0 +1,134 @@
+/**
+ * User configuration management for .magi/config.json
+ *
+ * Handles loading, saving, validating, and merging user-level
+ * settings with the immutable DEFAULT_CONFIG.
+ */
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod/v4';
+import { DEFAULT_CONFIG } from '../types/config.js';
+import { safePersist } from '../utils/safe-fs.js';
+import { logger } from '../utils/logger.js';
+// ── User Config Schema ──────────────────────────────────────────
+const DeadlockStrategySchema = z.enum([
+    'escalate', 'melchior-tiebreak', 'highest-confidence', 'human-in-the-loop',
+]);
+export const UserConfigSchema = z.object({
+    enabledUnits: z.array(z.enum(['MELCHIOR', 'BALTHASAR', 'CASPER'])).min(1).max(3).optional(),
+    adapters: z.record(z.string(), z.object({
+        timeoutMs: z.number().int().min(1_000).max(600_000).optional(),
+        maxRetries: z.number().int().min(0).max(5).optional(),
+        model: z.string().optional(),
+    })).optional(),
+    defaultPipeline: z.object({
+        maxRounds: z.number().int().min(1).max(10).optional(),
+        earlyConsensusExit: z.boolean().optional(),
+        consensus: z.object({
+            deadlockStrategy: DeadlockStrategySchema.optional(),
+            quorum: z.number().int().min(1).max(7).optional(),
+        }).optional(),
+        phaseTimeoutMs: z.number().int().min(1_000).max(3_600_000).optional(),
+    }).optional(),
+    logLevel: z.enum(['debug', 'info', 'warn', 'error']).optional(),
+    outputFormat: z.enum(['console', 'json', 'markdown']).optional(),
+    tui: z.object({
+        enabled: z.boolean().optional(),
+        soundEnabled: z.boolean().optional(),
+    }).optional(),
+    cacheEnabled: z.boolean().optional(),
+    language: z.enum(['ja', 'en']).optional(),
+    fileAccess: z.object({
+        enabled: z.boolean().optional(),
+        allowedPaths: z.array(z.string()).optional(),
+        deniedPatterns: z.array(z.string()).optional(),
+    }).optional(),
+}).strict();
+// ── Paths ───────────────────────────────────────────────────────
+const CONFIG_FILENAME = 'config.json';
+export function getUserConfigPath(workspaceDir = '.magi') {
+    return join(workspaceDir, CONFIG_FILENAME);
+}
+// ── Load / Save ─────────────────────────────────────────────────
+/**
+ * Load user config from .magi/config.json.
+ * Returns undefined if file does not exist.
+ * Throws on invalid JSON or schema validation failure.
+ */
+export async function loadUserConfig(workspaceDir = '.magi') {
+    const configPath = getUserConfigPath(workspaceDir);
+    let raw;
+    try {
+        raw = await readFile(configPath, 'utf-8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT') {
+            return undefined;
+        }
+        throw err;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new Error(`Invalid JSON in ${configPath}`);
+    }
+    return UserConfigSchema.parse(parsed);
+}
+/**
+ * Load user config with graceful fallback.
+ * Logs a warning on error and returns undefined instead of throwing.
+ */
+export async function loadUserConfigSafe(workspaceDir = '.magi') {
+    try {
+        return await loadUserConfig(workspaceDir);
+    }
+    catch (err) {
+        logger.warn(`Failed to load user config: ${err instanceof Error ? err.message : String(err)}`);
+        return undefined;
+    }
+}
+/**
+ * Save user config to .magi/config.json using safePersist (0o600).
+ */
+export async function saveUserConfig(config, workspaceDir = '.magi') {
+    const validated = UserConfigSchema.parse(config);
+    const configPath = getUserConfigPath(workspaceDir);
+    await safePersist(configPath, JSON.stringify(validated, null, 2) + '\n');
+}
+// ── Deep Merge ──────────────────────────────────────────────────
+function isPlainObject(val) {
+    return val !== null && typeof val === 'object' && !Array.isArray(val);
+}
+/**
+ * Recursively merge user overrides into a base object.
+ * Arrays are replaced (not merged). undefined values in user are skipped.
+ */
+const UNSAFE_KEYS = new Set(['__proto__', 'constructor', 'prototype']);
+function deepMerge(base, overrides) {
+    const result = { ...base };
+    for (const key of Object.keys(overrides)) {
+        if (UNSAFE_KEYS.has(key))
+            continue;
+        const userVal = overrides[key];
+        if (userVal === undefined)
+            continue;
+        const baseVal = base[key];
+        if (isPlainObject(baseVal) && isPlainObject(userVal)) {
+            result[key] = deepMerge(baseVal, userVal);
+        }
+        else {
+            result[key] = userVal;
+        }
+    }
+    return result;
+}
+/**
+ * Merge user config with DEFAULT_CONFIG, producing a full MagiConfig.
+ * The `tui` and `language` fields are stripped (consumed by the CLI layer, not Magi core).
+ */
+export function mergeWithDefaults(userConfig) {
+    const { tui: _tui, language: _language, ...magiFields } = userConfig;
+    return deepMerge(DEFAULT_CONFIG, magiFields);
+}

package/dist/src/context/auto-collector.d.ts

@@ -0,0 +1,43 @@
+/**
+ * Auto-context collector — gathers project context and related files
+ * to enrich MAGI deliberation quality.
+ *
+ * Two main capabilities:
+ * 1. Project context: git status, package.json, directory tree
+ * 2. Related files: imports, type definitions, tests for a target file
+ *
+ * All collection is graceful — failures are silently skipped so that
+ * deliberation proceeds even without context.
+ */
+import type { TaskArtifact } from '../types/core.js';
+/**
+ * Collect project-level context: git status, package.json, directory tree.
+ * Returns a structured text block ready for injection into task.context.
+ */
+export declare function collectProjectContext(cwd?: string): Promise<{
+    text: string;
+    charCount: number;
+}>;
+/**
+ * Collect files related to a target file: imports, type definitions, tests.
+ * Returns TaskArtifact[] ready for injection into task.artifacts.
+ */
+export declare function collectRelatedFiles(targetFile: string, fileContent: string, options?: {
+    basedir?: string;
+}): Promise<TaskArtifact[]>;
+/**
+ * Extract relative import paths from source code.
+ *
+ * Supports:
+ * - import ... from './path'
+ * - import('./path')
+ * - require('./path')
+ * - export ... from './path'
+ *
+ * Only extracts relative paths (starting with ./ or ../).
+ * Package imports are excluded.
+ *
+ * Limitation: single-line only, no tsconfig paths alias support.
+ * The function signature is kept simple for future AST migration.
+ */
+export declare function extractImports(content: string): string[];

package/dist/src/context/auto-collector.js

@@ -0,0 +1,337 @@
+/**
+ * Auto-context collector — gathers project context and related files
+ * to enrich MAGI deliberation quality.
+ *
+ * Two main capabilities:
+ * 1. Project context: git status, package.json, directory tree
+ * 2. Related files: imports, type definitions, tests for a target file
+ *
+ * All collection is graceful — failures are silently skipped so that
+ * deliberation proceeds even without context.
+ */
+import { readFile, readdir, stat } from 'node:fs/promises';
+import { join, dirname, resolve, extname, basename, relative, isAbsolute } from 'node:path';
+import { execGit } from '../engine/change-metrics.js';
+import { validateFile } from '../utils/file-validator.js';
+import { detectLanguage } from '../utils/language-detector.js';
+// ── Constants ────────────────────────────────────────────────
+/** Directories excluded from tree traversal */
+const TREE_EXCLUDE = new Set([
+    'node_modules', '.git', 'dist', 'build', 'coverage',
+    '.magi', '.next', '.nuxt', '.output', '__pycache__',
+    '.tox', '.venv', 'venv', '.cache', '.turbo',
+]);
+/** Maximum tree depth */
+const TREE_MAX_DEPTH = 3;
+/** Extensions to try when resolving imports */
+const RESOLVE_EXTENSIONS = ['.ts', '.tsx', '.js', '.jsx', '.mjs', '.cjs'];
+/** Index file names to try when resolving directory imports */
+const INDEX_FILES = ['index.ts', 'index.tsx', 'index.js', 'index.mjs'];
+/** Sensitive file patterns — never collected or exposed to AI CLIs */
+const SENSITIVE_PATTERNS = [
+    /\.env($|\.)/, /secret/i, /credential/i, /password/i,
+    /\.pem$/, /\.key$/, /\.p12$/, /\.pfx$/, /id_rsa/,
+    /\.npmrc$/, /\.pypirc$/, /\.netrc$/, /\.aws\//,
+    /\.docker\/config\.json$/,
+    /\.ssh\//, /authorized_keys$/,
+];
+// ── Project context ──────────────────────────────────────────
+/**
+ * Collect project-level context: git status, package.json, directory tree.
+ * Returns a structured text block ready for injection into task.context.
+ */
+export async function collectProjectContext(cwd) {
+    const dir = cwd ?? process.cwd();
+    const sections = [];
+    // Run all collectors in parallel
+    const [gitStatus, packageJson, tree] = await Promise.allSettled([
+        collectGitStatus(dir),
+        collectPackageJson(dir),
+        collectDirectoryTree(dir),
+    ]);
+    if (gitStatus.status === 'fulfilled' && gitStatus.value) {
+        sections.push('## Git Status\n```\n' + gitStatus.value + '\n```');
+    }
+    if (packageJson.status === 'fulfilled' && packageJson.value) {
+        sections.push('## package.json\n```json\n' + packageJson.value + '\n```');
+    }
+    if (tree.status === 'fulfilled' && tree.value) {
+        sections.push('## Directory Structure\n```\n' + tree.value + '\n```');
+    }
+    if (sections.length === 0) {
+        return { text: '', charCount: 0 };
+    }
+    const MAX_PROJECT_CONTEXT = 524_288; // 512KB safety cap
+    let text = '# Project Context\n\n' + sections.join('\n\n');
+    if (text.length > MAX_PROJECT_CONTEXT) {
+        text = text.slice(0, MAX_PROJECT_CONTEXT) + '\n\n[truncated]';
+    }
+    return { text, charCount: text.length };
+}
+// ── Related files ────────────────────────────────────────────
+/**
+ * Collect files related to a target file: imports, type definitions, tests.
+ * Returns TaskArtifact[] ready for injection into task.artifacts.
+ */
+export async function collectRelatedFiles(targetFile, fileContent, options) {
+    const basedir = options?.basedir ?? process.cwd();
+    const targetAbsolute = resolve(basedir, targetFile);
+    const targetDir = dirname(targetAbsolute);
+    const artifacts = [];
+    const seen = new Set([targetAbsolute]);
+    // Collect import targets and test files in parallel
+    const imports = extractImports(fileContent);
+    const resolvedImports = await resolveImportPaths(imports, targetDir, basedir);
+    const testFiles = await findTestFiles(targetAbsolute, basedir);
+    const candidates = [...resolvedImports, ...testFiles];
+    // Read all candidates in parallel
+    const reads = await Promise.allSettled(candidates.map(async (absPath) => {
+        if (seen.has(absPath))
+            return null;
+        seen.add(absPath);
+        // Skip sensitive files (secrets, credentials, keys)
+        if (isSensitivePath(absPath))
+            return null;
+        const validation = await validateFile(absPath, { basedir, rejectBinary: true, maxBytes: 524_288 });
+        if (!validation.ok)
+            return null;
+        const content = await readFile(absPath, 'utf-8');
+        const language = detectLanguage(absPath);
+        const relativePath = absPath.startsWith(basedir)
+            ? absPath.slice(basedir.length + 1)
+            : absPath;
+        return {
+            type: 'file',
+            path: relativePath,
+            content,
+            language,
+            label: testFiles.includes(absPath) ? 'test' : 'import',
+        };
+    }));
+    for (const r of reads) {
+        if (r.status === 'fulfilled' && r.value) {
+            artifacts.push(r.value);
+        }
+    }
+    return artifacts;
+}
+// ── Import extraction ────────────────────────────────────────
+/**
+ * Extract relative import paths from source code.
+ *
+ * Supports:
+ * - import ... from './path'
+ * - import('./path')
+ * - require('./path')
+ * - export ... from './path'
+ *
+ * Only extracts relative paths (starting with ./ or ../).
+ * Package imports are excluded.
+ *
+ * Limitation: single-line only, no tsconfig paths alias support.
+ * The function signature is kept simple for future AST migration.
+ */
+export function extractImports(content) {
+    const imports = new Set();
+    // Match: import/export ... from '...' or "..."
+    // Also matches: require('...') and import('...')
+    const patterns = [
+        // import ... from './path' / export ... from './path'
+        /(?:import|export)\s+.*?\s+from\s+['"](\.[^'"]+)['"]/g,
+        // import './path' (side-effect import)
+        /import\s+['"](\.[^'"]+)['"]/g,
+        // require('./path')
+        /require\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g,
+        // import('./path') (dynamic import)
+        /import\s*\(\s*['"](\.[^'"]+)['"]\s*\)/g,
+    ];
+    for (const pattern of patterns) {
+        let match;
+        while ((match = pattern.exec(content)) !== null) {
+            const importPath = match[1];
+            if (importPath) {
+                imports.add(importPath);
+            }
+        }
+    }
+    return [...imports];
+}
+// ── Internal helpers ─────────────────────────────────────────
+async function collectGitStatus(cwd) {
+    try {
+        return await execGit(['status', '--short'], cwd);
+    }
+    catch {
+        return null;
+    }
+}
+async function collectPackageJson(cwd) {
+    try {
+        return await readFile(join(cwd, 'package.json'), 'utf-8');
+    }
+    catch {
+        return null;
+    }
+}
+async function collectDirectoryTree(dir, depth = 0, prefix = '') {
+    if (depth > TREE_MAX_DEPTH)
+        return null;
+    try {
+        const entries = await readdir(dir, { withFileTypes: true });
+        // Sort: directories first, then files, alphabetical
+        entries.sort((a, b) => {
+            if (a.isDirectory() !== b.isDirectory()) {
+                return a.isDirectory() ? -1 : 1;
+            }
+            return a.name.localeCompare(b.name);
+        });
+        const lines = [];
+        const filtered = entries.filter((e) => !TREE_EXCLUDE.has(e.name) && !e.name.startsWith('.'));
+        for (let i = 0; i < filtered.length; i++) {
+            const entry = filtered[i];
+            const isLast = i === filtered.length - 1;
+            const connector = isLast ? '└── ' : '├── ';
+            const childPrefix = isLast ? '    ' : '│   ';
+            if (entry.isDirectory()) {
+                lines.push(prefix + connector + entry.name + '/');
+                const subtree = await collectDirectoryTree(join(dir, entry.name), depth + 1, prefix + childPrefix);
+                if (subtree)
+                    lines.push(subtree);
+            }
+            else {
+                lines.push(prefix + connector + entry.name);
+            }
+        }
+        return lines.join('\n');
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Resolve relative import paths to absolute file paths.
+ * Tries multiple extensions and index files.
+ * All resolved paths are confined within basedir.
+ */
+async function resolveImportPaths(imports, fromDir, basedir) {
+    const resolved = [];
+    const results = await Promise.allSettled(imports.map(async (imp) => {
+        const base = resolve(fromDir, imp);
+        // Basedir confinement: reject paths escaping the project root
+        if (basedir) {
+            const rel = relative(basedir, base);
+            if (rel.startsWith('..') || isAbsolute(rel))
+                return null;
+        }
+        // Try exact path first (already has extension)
+        const ext = extname(base);
+        if (ext) {
+            try {
+                const s = await stat(base);
+                if (s.isFile())
+                    return base;
+            }
+            catch { /* continue */ }
+            // TypeScript convention: import './foo.js' may refer to './foo.ts'
+            // Try replacing .js/.mjs/.cjs with .ts/.mts/.cts and .tsx
+            const remapped = remapExtension(base, ext);
+            for (const candidate of remapped) {
+                try {
+                    const s = await stat(candidate);
+                    if (s.isFile())
+                        return candidate;
+                }
+                catch { /* continue */ }
+            }
+        }
+        // Try appending extensions (for extensionless imports)
+        for (const tryExt of RESOLVE_EXTENSIONS) {
+            try {
+                const candidate = base + tryExt;
+                const s = await stat(candidate);
+                if (s.isFile())
+                    return candidate;
+            }
+            catch { /* continue */ }
+        }
+        // Try as directory with index file
+        for (const idx of INDEX_FILES) {
+            try {
+                const candidate = join(base, idx);
+                const s = await stat(candidate);
+                if (s.isFile())
+                    return candidate;
+            }
+            catch { /* continue */ }
+        }
+        return null;
+    }));
+    for (const r of results) {
+        if (r.status === 'fulfilled' && r.value) {
+            resolved.push(r.value);
+        }
+    }
+    return resolved;
+}
+/** JS/MJS/CJS → TS/MTS/CTS extension remap (TypeScript convention) */
+const EXTENSION_REMAP = {
+    '.js': ['.ts', '.tsx'],
+    '.jsx': ['.tsx', '.ts'],
+    '.mjs': ['.mts'],
+    '.cjs': ['.cts'],
+};
+function remapExtension(filePath, ext) {
+    const targets = EXTENSION_REMAP[ext];
+    if (!targets)
+        return [];
+    const base = filePath.slice(0, -ext.length);
+    return targets.map((t) => base + t);
+}
+/**
+ * Find test files associated with a target file.
+ *
+ * Looks for:
+ * - Same directory: foo.test.ts, foo.spec.ts
+ * - test/ directory: test/foo.test.ts
+ * - test/unit/ directory: test/unit/<subdir>/foo.test.ts
+ * - __tests__/ directory: __tests__/foo.test.ts
+ */
+async function findTestFiles(targetAbsolute, basedir) {
+    const found = [];
+    const targetBase = basename(targetAbsolute);
+    const nameWithoutExt = targetBase.replace(/\.[^.]+$/, '');
+    const targetDir = dirname(targetAbsolute);
+    // Derive relative path from basedir to figure out test/unit/<subdir>
+    const relDir = targetDir.startsWith(basedir)
+        ? targetDir.slice(basedir.length + 1)
+        : '';
+    // e.g. "src/utils" → strip "src/" → "utils"
+    const subdir = relDir.replace(/^src\//, '');
+    const candidates = [
+        // Same directory
+        join(targetDir, `${nameWithoutExt}.test.ts`),
+        join(targetDir, `${nameWithoutExt}.spec.ts`),
+        join(targetDir, `${nameWithoutExt}.test.js`),
+        // test/ root
+        join(basedir, 'test', `${nameWithoutExt}.test.ts`),
+        // test/unit/<subdir>/
+        ...(subdir ? [join(basedir, 'test', 'unit', subdir, `${nameWithoutExt}.test.ts`)] : []),
+        // __tests__/
+        join(targetDir, '__tests__', `${nameWithoutExt}.test.ts`),
+        join(targetDir, '__tests__', `${nameWithoutExt}.test.js`),
+    ];
+    const checks = await Promise.allSettled(candidates.map(async (path) => {
+        const s = await stat(path);
+        return s.isFile() ? path : null;
+    }));
+    for (const r of checks) {
+        if (r.status === 'fulfilled' && r.value) {
+            found.push(r.value);
+        }
+    }
+    return found;
+}
+/** Check if a file path matches any sensitive file pattern. */
+function isSensitivePath(filePath) {
+    return SENSITIVE_PATTERNS.some((pattern) => pattern.test(filePath));
+}

package/dist/src/context/manager.d.ts

@@ -0,0 +1,35 @@
+import type { MagiTask, DeliberationRound, MagiDeliberation } from '../types/core.js';
+import { MagiError } from '../utils/errors.js';
+export declare class PathTraversalError extends MagiError {
+    constructor(message: string);
+}
+/**
+ * File-System-as-State context manager with path traversal prevention.
+ *
+ * Manages the .magi/ workspace directory where deliberation state is persisted.
+ * Each deliberation gets its own subdirectory with round-by-round JSON files.
+ *
+ * Security hardening:
+ * - Deliberation IDs are validated as UUID v4 format
+ * - All paths are resolved and verified to stay within the base directory
+ * - Null bytes are rejected
+ * - Symlinks at target directories are rejected
+ * - File permissions: directories 0o700, files 0o600
+ */
+export declare class ContextManager {
+    private readonly resolvedBaseDir;
+    constructor(baseDir: string);
+    /** Validate deliberation ID format and resolve path safely. */
+    private validateAndResolvePath;
+    /** Create directory with 0o700 permissions, rejecting symlinks. */
+    private safeMkdir;
+    /** Write file with 0o600 permissions. */
+    private safeWriteFile;
+    /** Write JSON with safe permissions. */
+    private writeJson;
+    initWorkspace(deliberationId: string, task: MagiTask): Promise<string>;
+    saveRound(deliberationId: string, round: DeliberationRound): Promise<void>;
+    saveDeliberation(deliberation: MagiDeliberation): Promise<void>;
+    listDeliberations(): Promise<string[]>;
+    loadTask(deliberationId: string): Promise<MagiTask | null>;
+}