opencode-wait-a-minute 0.0.0-stage → 1.1.0-rc.8

package/src/policy/failure-classification.js

@@ -0,0 +1,5 @@
+export function classifyFailure(observation) {
+  if (!observation) return { category: "UNKNOWN", confidence: 0 };
+  if (observation.error?.includes("timeout")) return { category: "TIMEOUT", confidence: 0.9 };
+  return { category: "GENERIC", confidence: 0.5 };
+}

package/src/policy/feature-flags.js

@@ -0,0 +1,65 @@
+/**
+ * Feature Flags — in-memory key/value toggles with defaults.
+ *
+ * Supports: get/set/has/toggle, with optional per-user overrides.
+ * Production hardening (M5-55).
+ */
+
+/**
+ * @typedef {Object} FeatureFlags
+ * @property {(key: string, fallback?: boolean) => boolean} isEnabled
+ * @property {(key: string, value: boolean) => void} set
+ * @property {(key: string) => boolean} has
+ * @property {(key: string) => void} toggle
+ * @property {() => string[]} list
+ * @property {(ctx: {userId?: string}) => FeatureFlags} forContext
+ */
+
+/**
+ * @param {Record<string, boolean>} initial
+ * @returns {FeatureFlags}
+ */
+export function createFeatureFlags(initial = {}) {
+  /** @type {Map<string, boolean>} */
+  const store = new Map(Object.entries(initial));
+
+  function isEnabled(key, fallback = false) {
+    return store.has(key) ? store.get(key) : fallback;
+  }
+
+  function set(key, value) {
+    store.set(key, Boolean(value));
+  }
+
+  function has(key) {
+    return store.has(key);
+  }
+
+  function toggle(key) {
+    const next = !isEnabled(key);
+    store.set(key, next);
+    return next;
+  }
+
+  function list() {
+    return [...store.keys()];
+  }
+
+  function forContext(ctx) {
+    const userId = ctx?.userId;
+    return {
+      isEnabled: (key, fallback = false) => {
+        if (userId && store.has(`${key}:${userId}`)) {
+          return store.get(`${key}:${userId}`);
+        }
+        return isEnabled(key, fallback);
+      },
+      set: (key, value) => {
+        if (userId) store.set(`${key}:${userId}`, Boolean(value));
+        else set(key, value);
+      },
+    };
+  }
+
+  return { isEnabled, set, has, toggle, list, forContext };
+}

package/src/policy/governance-enforcement.js

@@ -0,0 +1,118 @@
+/**
+ * Governance Enforcement — Centralized policy check for tool execution.
+ *
+ * Returns a decision object, or throws WamPolicyBlock when governance is
+ * violated. Invariants:
+ *   - Only CONTRACT_GATED_TOOLS are ever blocked; `bash`/`task` (investigation
+ *     and delegation surfaces) stay usable so tests can run and workers can be
+ *     dispatched.
+ *   - A session with no tracked task/contract fails OPEN: there is nothing to
+ *     approve, and default-deny here deadlocked every write/edit.
+ *   - Delegated workers (sessions with a parentID) are exempt.
+ *   - An explicit, audited override disables enforcement (WAM_GOVERNANCE=off).
+ */
+
+import { WamPolicyBlock } from "./risk-engine.js";
+import { logger } from "../integration/logger.js";
+
+/** Tools gated by contract approval. Deliberately narrower than the risk
+ *  engine's MUTATING_TOOLS (which also covers bash/task). */
+export const CONTRACT_GATED_TOOLS = new Set([
+  "write", "edit", "apply_patch", "patch", "todo_write", "todowrite",
+]);
+
+/** Phases from which no further mutation gate applies. */
+export const TERMINAL_PHASES = new Set(["COMPLETE", "DONE"]);
+
+const TRIVIAL_MAX_FILES = Number.parseInt(process.env.WAM_TRIVIAL_MAX_FILES || "2", 10);
+
+/** Paths that always require an approved contract regardless of file count. */
+const PROTECTED_SEGMENT_RE = /(^|[\\/])(\.github|migrations?|deploy|\.env)([\\/]|$)/i;
+const PROTECTED_BASENAME_RE = /(^|[\\/])(ci\.ya?ml|package\.json|package-lock\.json|tsconfig[^\\/]*\.json)$/i;
+
+export function isGovernanceDisabled() {
+  const v = String(process.env.WAM_GOVERNANCE || "").toLowerCase();
+  return v === "off" || v === "0" || process.env.WAM_BYPASS === "1";
+}
+
+export function isTerminalPhase(phase) {
+  return TERMINAL_PHASES.has(phase);
+}
+
+export function isProtectedPath(file) {
+  const f = String(file || "");
+  return PROTECTED_SEGMENT_RE.test(f) || PROTECTED_BASENAME_RE.test(f);
+}
+
+export function isTrivialChange(declaredFiles) {
+  if (!Array.isArray(declaredFiles) || declaredFiles.length === 0) return false;
+  if (declaredFiles.length > TRIVIAL_MAX_FILES) return false;
+  return declaredFiles.every((f) => !isProtectedPath(f));
+}
+
+function logDecision(event) {
+  try {
+    logger.info("governance", JSON.stringify(event));
+  } catch {
+    /* logging must never break enforcement */
+  }
+}
+
+/**
+ * @param {string} tool
+ * @param {object|null} state - task state ({ phase, contract, requirements }).
+ * @param {object} [ctx]
+ * @param {boolean} [ctx.isSubagent] - true when the caller is a delegated worker.
+ * @param {string[]} [ctx.declaredFiles] - files the current task is scoped to.
+ * @returns {{allowed: boolean, reason: string}}
+ * @throws {WamPolicyBlock}
+ */
+export function enforceGovernance(tool, state, ctx = {}) {
+  if (!CONTRACT_GATED_TOOLS.has(tool)) return { allowed: true, reason: "tool-not-gated" };
+
+  if (isGovernanceDisabled()) {
+    logDecision({ decision: "allow", reason: "override", tool, phase: state?.phase });
+    return { allowed: true, reason: "override" };
+  }
+
+  if (ctx.isSubagent) {
+    logDecision({ decision: "allow", reason: "subagent", tool, phase: state?.phase });
+    return { allowed: true, reason: "subagent" };
+  }
+
+  // No tracked task/contract: nothing to approve → fail open (never deadlock
+  // ad-hoc/untracked sessions before a contract can exist).
+  if (!state) {
+    logDecision({ decision: "allow", reason: "untracked", tool });
+    return { allowed: true, reason: "untracked" };
+  }
+
+  const contractStatus = state?.contract?.status;
+  const phase = state?.phase;
+
+  if (contractStatus === "APPROVED") return { allowed: true, reason: "contract-approved" };
+  if (isTerminalPhase(phase)) return { allowed: true, reason: "terminal-phase" };
+  // Let the Clarification Gate handle ASKING (answer the unknown, don't approve).
+  if (phase === "ASKING") return { allowed: true, reason: "defer-asking" };
+  if (isTrivialChange(ctx.declaredFiles)) {
+    logDecision({ decision: "allow", reason: "trivial", tool, files: ctx.declaredFiles });
+    return { allowed: true, reason: "trivial" };
+  }
+
+  const pending = (state.requirements || state.contract?.requirements || [])
+    .filter((r) => r.status !== "done" && r.status !== "verified").length;
+
+  const directive =
+    `[wait-a-minute] GOVERNANCE BLOCK (${tool}): contrato no aprobado ` +
+    `(fase ${phase || "?"}). ${pending} requisito(s) pendiente(s). ` +
+    `Aprobá el contrato (/wam contract approve) o pasá el token de aprobación en el Task. ` +
+    `Si sos subagente, ESCALATE al orquestador — no explores buscando un camino alternativo.`;
+
+  logDecision({ decision: "deny", tool, phase, contractStatus, files: ctx.declaredFiles || [] });
+  throw new WamPolicyBlock(directive, {
+    tool,
+    reason: "contract-not-approved",
+    level: "BLOCKED",
+    source: "governance-enforcement",
+  });
+}

package/src/policy/locale.js

@@ -0,0 +1,15 @@
+export function createLocale(defaultLang, dict = {}) {
+  let currentLang = defaultLang;
+  let translations = dict;
+
+  return {
+    t: (key, vars = {}) => {
+      let str = translations[currentLang]?.[key] || key;
+      for (const [k, v] of Object.entries(vars)) {
+        str = str.replace(`{${k}}`, v);
+      }
+      return str;
+    },
+    setLang: (lang) => { currentLang = lang; }
+  };
+}

package/src/policy/multi-signer.js

@@ -0,0 +1,151 @@
+/**
+ * Multi-Signer Approval
+ *
+ * N-of-M approval quorum for strict release mode. Each signer may approve
+ * at most once per change; a signer cannot both propose and approve.
+ *
+ * Config shape (`config`):
+ *   {
+ *     signers: string[],                  // M: the eligible signer pool
+ *     required: number,                   // N: approvals needed (default = signers.length)
+ *     mode: "strict" | "majority" | "any",// policy hint; quorum = required
+ *   }
+ *
+ * API:
+ *   createMultiSigner(config) -> {
+ *     approve(changeId, signerId) -> { ok, changeId, signerId, tally, reason }
+ *     status(changeId) -> { tally, required, total, satisfied, approvals }
+ *     reset(changeId?) -> void
+ *   }
+ */
+
+const VALID_MODES = new Set(["strict", "majority", "any"]);
+
+function normalizeConfig(config = {}) {
+  const signers = Array.isArray(config.signers)
+    ? config.signers.filter((s) => typeof s === "string" && s.length > 0)
+    : [];
+  if (signers.length === 0) {
+    throw new Error("multi-signer config requires non-empty signers array");
+  }
+  const explicit = Number.isFinite(config.required) ? config.required : null;
+  let required;
+  if (explicit !== null) {
+    if (explicit < 1 || explicit > signers.length) {
+      throw new Error(
+        `multi-signer required (${explicit}) must be in 1..${signers.length}`
+      );
+    }
+    required = explicit;
+  } else {
+    const mode = VALID_MODES.has(config.mode) ? config.mode : "strict";
+    if (mode === "strict") required = signers.length;
+    else if (mode === "majority") required = Math.floor(signers.length / 2) + 1;
+    else required = 1;
+  }
+  return { signers, required, mode: config.mode ?? "strict" };
+}
+
+export function createMultiSigner(config = {}) {
+  const { signers, required, mode } = normalizeConfig(config);
+  const signerSet = new Set(signers);
+  const tallies = new Map();
+
+  function getTally(changeId) {
+    let tally = tallies.get(changeId);
+    if (!tally) {
+      tally = {
+        changeId,
+        approvals: [],
+        rejected: [],
+      };
+      tallies.set(changeId, tally);
+    }
+    return tally;
+  }
+
+  function approve(changeId, signerId) {
+    if (typeof changeId !== "string" || !changeId) {
+      return {
+        ok: false,
+        changeId,
+        signerId,
+        reason: "changeId required",
+        tally: null,
+        satisfied: false,
+      };
+    }
+    if (typeof signerId !== "string" || !signerId) {
+      return {
+        ok: false,
+        changeId,
+        signerId,
+        reason: "signerId required",
+        tally: null,
+        satisfied: false,
+      };
+    }
+    if (!signerSet.has(signerId)) {
+      return {
+        ok: false,
+        changeId,
+        signerId,
+        reason: `signer not eligible: ${signerId}`,
+        tally: status(changeId),
+        satisfied: false,
+      };
+    }
+    const tally = getTally(changeId);
+    if (tally.approvals.includes(signerId)) {
+      return {
+        ok: false,
+        changeId,
+        signerId,
+        reason: "duplicate approval",
+        tally: status(changeId),
+        satisfied: false,
+      };
+    }
+    tally.approvals.push(signerId);
+    const tallyView = status(changeId);
+    return {
+      ok: true,
+      changeId,
+      signerId,
+      reason: tallyView.satisfied ? "quorum reached" : "approval recorded",
+      tally: tallyView,
+      satisfied: tallyView.satisfied,
+    };
+  }
+
+  function status(changeId) {
+    const tally = tallies.get(changeId) || {
+      changeId,
+      approvals: [],
+      rejected: [],
+    };
+    return {
+      changeId,
+      required,
+      total: signers.length,
+      signed: tally.approvals.length,
+      approvals: [...tally.approvals],
+      satisfied: tally.approvals.length >= required,
+    };
+  }
+
+  function reset(changeId) {
+    if (changeId === undefined) {
+      tallies.clear();
+      return;
+    }
+    tallies.delete(changeId);
+  }
+
+  return {
+    approve,
+    status,
+    reset,
+    config: { signers: [...signers], required, mode },
+  };
+}

package/src/policy/policy-state-machine.js

@@ -0,0 +1,97 @@
+// Change 37 — Policy-state-machine
+// Policy state machine with states, transitions, decisions, and preconditions.
+
+export const POLICY_STATES = {
+  SCOPE: "Scope",
+  INVESTIGATE: "Investigate",
+  ACTION: "Action",
+  DEBUG: "Debug",
+  OBSERVE: "Observe",
+  VERIFY: "Verify",
+  REVIEW: "Review",
+  COMPLETION: "Completion"
+};
+
+export const POLICY_TRANSITIONS = {
+  [POLICY_STATES.SCOPE]: [POLICY_STATES.INVESTIGATE],
+  [POLICY_STATES.INVESTIGATE]: [POLICY_STATES.ACTION, POLICY_STATES.DEBUG],
+  [POLICY_STATES.ACTION]: [POLICY_STATES.OBSERVE, POLICY_STATES.VERIFY],
+  [POLICY_STATES.DEBUG]: [POLICY_STATES.OBSERVE, POLICY_STATES.VERIFY],
+  [POLICY_STATES.OBSERVE]: [POLICY_STATES.VERIFY, POLICY_STATES.REVIEW],
+  [POLICY_STATES.VERIFY]: [POLICY_STATES.REVIEW, POLICY_STATES.COMPLETION],
+  [POLICY_STATES.REVIEW]: [POLICY_STATES.COMPLETION, POLICY_STATES.INVESTIGATE],
+  [POLICY_STATES.COMPLETION]: []
+};
+
+// Change 36 — Policy-coordination (validatePolicyFlow, getNextPolicy)
+export const POLICY_CHAIN = [
+  POLICY_STATES.SCOPE,
+  POLICY_STATES.INVESTIGATE,
+  POLICY_STATES.ACTION,
+  POLICY_STATES.DEBUG,
+  POLICY_STATES.OBSERVE,
+  POLICY_STATES.VERIFY,
+  POLICY_STATES.REVIEW,
+  POLICY_STATES.COMPLETION
+];
+
+export function validatePolicyFlow(currentPolicy, nextPolicy) {
+  if (currentPolicy === nextPolicy) return { valid: false, reason: "same-policy" };
+  const allowed = POLICY_TRANSITIONS[currentPolicy] || [];
+  if (!allowed.includes(nextPolicy)) return { valid: false, reason: "invalid-transition" };
+  return { valid: true };
+}
+
+export function getNextPolicy(currentPolicy) {
+  const idx = POLICY_CHAIN.indexOf(currentPolicy);
+  if (idx === -1 || idx >= POLICY_CHAIN.length - 1) return null;
+  return POLICY_CHAIN[idx + 1];
+}
+
+export function createPolicyDecision(policy, action, reason, requirementsAffected = [], expectedObservation = null) {
+  return {
+    policy,
+    action,
+    reason,
+    requirementsAffected,
+    expectedObservation,
+    timestamp: Date.now()
+  };
+}
+
+export function isValidPolicyTransition(fromPolicy, toPolicy) {
+  const allowed = POLICY_TRANSITIONS[fromPolicy];
+  return allowed ? allowed.includes(toPolicy) : false;
+}
+
+// Change 38 — Policy-preconditions
+export const POLICY_PRECONDITIONS = {
+  [POLICY_STATES.INVESTIGATE]: { contextSufficient: true },
+  [POLICY_STATES.ACTION]: { requirementKnown: true },
+  [POLICY_STATES.DEBUG]: { requirementKnown: true },
+  [POLICY_STATES.VERIFY]: { evidenceAvailable: true },
+  [POLICY_STATES.REVIEW]: { allVerified: false } // can review even if not all verified
+};
+
+export function checkPolicyPreconditions(policy, taskState) {
+  const required = POLICY_PRECONDITIONS[policy];
+  if (!required) return { satisfied: true, failures: [] };
+
+  const failures = [];
+
+  if (required.contextSufficient === true && !taskState.contextSufficient) {
+    failures.push("context not sufficient");
+  }
+  if (required.requirementKnown === true && !taskState.currentRequirement) {
+    failures.push("no current requirement");
+  }
+  if (required.evidenceAvailable === true && (!taskState.evidence || taskState.evidence.length === 0)) {
+    failures.push("no evidence available");
+  }
+  if (required.allVerified === true) {
+    const unverified = (taskState.requirements || []).filter(r => r.status !== "VERIFIED");
+    if (unverified.length > 0) failures.push("requirements not verified");
+  }
+
+  return { satisfied: failures.length === 0, failures };
+}

package/src/policy/ponytail-constraint.js

@@ -0,0 +1,38 @@
+// Change 39 — Ponytail-cross-cutting
+// Cross-cutting constraints that modify policy behavior (ponytail, simplify, safety, security).
+
+export const CONSTRAINT_TYPES = {
+  PONYTAIL: "ponytail",
+  SIMPLIFY: "simplify",
+  SAFETY: "safety",
+  SECURITY: "security"
+};
+
+export function applyConstraint(policy, constraints) {
+  const activeConstraints = constraints.filter(c => c.active);
+
+  for (const constraint of activeConstraints) {
+    if (constraint.type === CONSTRAINT_TYPES.PONYTAIL) {
+      // Ponytail: keep actions minimal and focused
+      if (policy.actions && policy.actions.length > 3) {
+        policy.actions = policy.actions.slice(0, 3);
+        policy.constrained = true;
+        policy.constraintReason = "ponytail";
+      }
+    }
+
+    if (constraint.type === CONSTRAINT_TYPES.SIMPLIFY) {
+      // Simplify: prefer simple solutions over complex
+      if (policy.complexity && policy.complexity > 5) {
+        policy.simplified = true;
+        policy.constraintReason = "simplify";
+      }
+    }
+  }
+
+  return policy;
+}
+
+export function isConstraintActive(constraints, type) {
+  return constraints.some(c => c.type === type && c.active);
+}

package/src/policy/project-inspector.js

@@ -0,0 +1,93 @@
+import fs from "node:fs";
+import path from "node:path";
+
+/**
+ * Verifica si un archivo existe
+ */
+function fileExists(filePath) {
+  try {
+    fs.accessSync(filePath);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+/**
+ * Obtiene el contenido de AGENTS.md si existe
+ */
+export function getAgentsMd(projectPath) {
+  const agentsPath = path.join(projectPath, "AGENTS.md");
+  if (!fileExists(agentsPath)) return "";
+  return fs.readFileSync(agentsPath, "utf-8");
+}
+
+/**
+ * Obtiene el package.json si existe
+ */
+export function getPackageJson(projectPath) {
+  const pkgPath = path.join(projectPath, "package.json");
+  if (!fileExists(pkgPath)) return null;
+  try {
+    return JSON.parse(fs.readFileSync(pkgPath, "utf-8"));
+  } catch {
+    return null;
+  }
+}
+
+/**
+ * Obtiene dependencias relevantes del package.json
+ */
+export function getDependencies(pkgJson) {
+  if (!pkgJson) return {};
+  return {
+    ...(pkgJson.dependencies || {}),
+    ...(pkgJson.devDependencies || {}),
+  };
+}
+
+/**
+ * Detecta el stack tecnológico del proyecto
+ */
+export function detectStack(projectPath) {
+  if (!fileExists(path.join(projectPath, "package.json"))) {
+    return { stack: "unknown", languages: [] };
+  }
+
+  const pkg = getPackageJson(projectPath);
+  if (!pkg) return { stack: "unknown", languages: [] };
+
+  const deps = getDependencies(pkg);
+  const languages = [];
+
+  // Node/TypeScript/JavaScript
+  if (deps.typescript || deps.ts) languages.push("typescript");
+  if (deps.vue || deps["vue-template-compiler"]) languages.push("vue");
+  if (deps.react || deps["react-dom"]) languages.push("react");
+  if (deps.svelte) languages.push("svelte");
+
+  // Python
+  if (deps.flask || deps.django) {
+    languages.push("python");
+  }
+
+  // Go
+  if (deps.go || deps["go.mod"]) languages.push("go");
+
+  // Rust
+  if (deps.rust || deps["Cargo.toml"]) languages.push("rust");
+
+  // Java
+  if (deps.java || deps["javax"]) languages.push("java");
+
+  // PHP
+  if (deps.laravel || deps.symfony || deps.woocommerce) languages.push("php");
+
+  // Ruby
+  if (deps.ruby || deps["rake"]) languages.push("ruby");
+
+  // Determine primary stack
+  const primary = languages.length > 0 ? languages[0] : "other";
+
+  return { stack: primary, languages };
+}

package/src/policy/query-builder.js

@@ -0,0 +1,14 @@
+export function buildAuditQuery(filters) {
+  const query = {};
+  if (filters.entity) query.entity = filters.entity;
+  if (filters.actor) query.actor = filters.actor;
+  if (filters.action) query.action = filters.action;
+  if (filters.outcome) query.outcome = filters.outcome;
+  if (filters.timeRange) {
+    query.timeRange = {
+      start: filters.timeRange.start,
+      end: filters.timeRange.end,
+    };
+  }
+  return query;
+}

package/src/policy/request-classifier.js

@@ -0,0 +1,79 @@
+/**
+ * Pre-flight request classification logic.
+ */
+export function classifyRequest(prompt) {
+  const lower = String(prompt ?? "").toLowerCase();
+
+  // Trivial patterns - bypass wait-a-minute
+  const trivialPatterns = [
+    /^\s*rename\s+/i,
+    /^\s*renombra\s+/i,
+    /^\s*cambia\s+\w+/i,
+    /^\s*change\s+\w+/i,
+    /^\s*what(is|are)\s+/i,
+    /^\s*qué\s+es\s+/i,
+    /^\s*que\s+es\s+/i,
+    /^\s*explain\s+/i,
+    /^\s*explica\s+/i,
+    /^\s*how\s+to\s+/i,
+    /^\s*cómo\s+/i,
+    /^\s*como\s+hago\s+/i,
+    /^\s*list\s+/i,
+    /^\s*lista\s+/i,
+    /^\s*listar\s+/i,
+    /^\s*show\s+/i,
+    /^\s*muestra\s+/i,
+    /^\s*get\s+\w+/i,
+  ];
+
+  for (const pattern of trivialPatterns) {
+    if (pattern.test(prompt)) {
+      return { type: "trivial", ambiguity: "low", confidence: 95 };
+    }
+  }
+
+  // Architecture/security/high-risk patterns -> STRICT
+  const strictPatterns = [
+    /(migra|migrate)/i,
+    /(seguridad|security)/i,
+    /(arquitectura|architecture)/i,
+    /(provee(?:r|ndase)|provide)/i,
+    /(alto impacto|high impact)/i,
+    /(producción|production)/i,
+    /(destructivo|destructive)/i,
+  ];
+
+  let strictMatch = null;
+  for (const pattern of strictPatterns) {
+    if (pattern.test(prompt)) {
+      strictMatch = pattern;
+      break;
+    }
+  }
+
+  if (strictMatch) {
+    return {
+      type: "architectural",
+      ambiguity: "medium",
+      confidence: 60,
+      mode: "STRICT",
+    };
+  }
+
+  // Research/exploration patterns
+  const researchPatterns = [
+    /(buscar|research)/i,
+    /(comparar|compare)/i,
+    /(opciones|options)/i,
+    /(alternativas|alternatives)/i,
+  ];
+
+  for (const pattern of researchPatterns) {
+    if (pattern.test(prompt)) {
+      return { type: "research", ambiguity: "medium", confidence: 70 };
+    }
+  }
+
+  // Default: normal ambiguity
+  return { type: "normal", ambiguity: "medium", confidence: 50 };
+}