patchwork-os 0.2.0-alpha.0

package/dist/fp/commandDescription.js

@@ -0,0 +1,125 @@
+/**
+ * Pure command-description builder extracted from runCommand.ts.
+ * All allowlist/blocklist/path-traversal security checks live here.
+ * No side effects, no fs.*, no process.* (except INTERPRETER_COMMANDS import).
+ */
+import { INTERPRETER_COMMANDS } from "../config.js";
+import { optionalInt, optionalString, requireString, resolveFilePath, } from "../tools/utils.js";
+const MAX_ARGS = 100;
+const MAX_ARG_LENGTH = 16_384;
+/** Flags that allow interpreter commands to execute arbitrary code */
+const DANGEROUS_INTERPRETER_FLAGS = new Set([
+    "-e",
+    "--eval",
+    "-c",
+    "--print",
+    "-p",
+    "--input-type",
+    "--import",
+    "--loader",
+    "--experimental-loader",
+    "-m",
+    "--inspect",
+    "--inspect-brk",
+    "--inspect-port",
+]);
+/** Flags that redirect where commands read config/manifests from */
+const DANGEROUS_PATH_FLAGS = new Set([
+    "--prefix",
+    "--manifest-path",
+    "--config",
+    "--rcfile",
+    "--require",
+    "--userconfig",
+    "--globalconfig",
+    "--makefile",
+    "-o",
+    "--output",
+    "-O",
+    "--remote-name",
+    "-D",
+    "--dump-header",
+    "-K",
+    "--unix-socket",
+    "--abstract-unix-socket",
+    "--netrc-file",
+]);
+const DANGEROUS_FLAGS_FOR_COMMAND = {
+    make: new Set(["-f", "--file"]),
+    curl: new Set(["-w", "--write-out"]),
+    node: new Set(["-r"]),
+    "ts-node": new Set(["-r"]),
+    tsx: new Set(["-r"]),
+};
+const PATH_FLAG_EXEMPTIONS = {
+    psql: new Set(["--config"]),
+    pg_dump: new Set(["--config"]),
+    pg_restore: new Set(["--config"]),
+};
+function validateCommandName(command, allowlist) {
+    if (command.includes("/") ||
+        command.includes("\\") ||
+        command.includes("..") ||
+        command.includes(" ")) {
+        throw new Error(`Invalid command "${command}": must be a simple basename without /, \\, .., or spaces`);
+    }
+    if (!allowlist.some((entry) => entry.toLowerCase() === command)) {
+        throw new Error(`Command "${command}" is not in the allowlist. Use --allow-command ${command} to add it. Run getToolCapabilities to see allowed commands.`);
+    }
+}
+function validateCommandArgs(args, command, workspace) {
+    if (args === undefined || args === null)
+        return [];
+    if (!Array.isArray(args)) {
+        throw new Error("args must be an array of strings");
+    }
+    if (args.length > MAX_ARGS) {
+        throw new Error(`args exceeds maximum length of ${MAX_ARGS}`);
+    }
+    const isInterpreter = INTERPRETER_COMMANDS.has(command);
+    for (let i = 0; i < args.length; i++) {
+        const arg = args[i];
+        if (typeof arg !== "string") {
+            throw new Error(`args[${i}] must be a string`);
+        }
+        if (arg.length > MAX_ARG_LENGTH) {
+            throw new Error(`args[${i}] exceeds maximum length of ${MAX_ARG_LENGTH}`);
+        }
+        const flag = arg.split("=")[0] ?? arg;
+        if (isInterpreter && DANGEROUS_INTERPRETER_FLAGS.has(flag)) {
+            throw new Error(`Flag "${flag}" is blocked for interpreter command "${command}" — it allows arbitrary code execution`);
+        }
+        const exemptions = PATH_FLAG_EXEMPTIONS[command];
+        if (DANGEROUS_PATH_FLAGS.has(flag) && !exemptions?.has(flag)) {
+            throw new Error(`Flag "${flag}" is blocked — it can redirect command execution outside the workspace`);
+        }
+        if (DANGEROUS_FLAGS_FOR_COMMAND[command]?.has(flag)) {
+            throw new Error(`Flag "${flag}" is blocked for command "${command}" — it can redirect command execution outside the workspace`);
+        }
+        if (!arg.startsWith("-") && (arg.startsWith("/") || arg.startsWith("~/"))) {
+            try {
+                resolveFilePath(arg, workspace);
+            }
+            catch {
+                throw new Error(`args[${i}] "${arg}" is an absolute path outside the workspace`);
+            }
+        }
+    }
+    return args;
+}
+/**
+ * Validate raw tool arguments and return an immutable command description.
+ * Throws on any security violation (allowlist, blocklist, path-traversal).
+ * All security checks are performed here — executeCommand receives a trusted descriptor.
+ */
+export function buildCommandDescription(rawArgs, config, workspace) {
+    const command = requireString(rawArgs, "command", 256).toLowerCase();
+    validateCommandName(command, config.commandAllowlist);
+    const args = validateCommandArgs(rawArgs.args, command, workspace);
+    const cwdRaw = optionalString(rawArgs, "cwd");
+    const timeout = optionalInt(rawArgs, "timeout", 1000, 600_000) ?? config.commandTimeout;
+    const cwd = cwdRaw ? resolveFilePath(cwdRaw, workspace) : workspace;
+    const maxBuffer = config.maxResultSize * 1024;
+    return { command, args, cwd, timeout, maxBuffer };
+}
+//# sourceMappingURL=commandDescription.js.map

package/dist/fp/commandDescription.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandDescription.js","sourceRoot":"","sources":["../../src/fp/commandDescription.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EACL,WAAW,EACX,cAAc,EACd,aAAa,EACb,eAAe,GAChB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,cAAc,GAAG,MAAM,CAAC;AAE9B,sEAAsE;AACtE,MAAM,2BAA2B,GAAG,IAAI,GAAG,CAAC;IAC1C,IAAI;IACJ,QAAQ;IACR,IAAI;IACJ,SAAS;IACT,IAAI;IACJ,cAAc;IACd,UAAU;IACV,UAAU;IACV,uBAAuB;IACvB,IAAI;IACJ,WAAW;IACX,eAAe;IACf,gBAAgB;CACjB,CAAC,CAAC;AAEH,oEAAoE;AACpE,MAAM,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACnC,UAAU;IACV,iBAAiB;IACjB,UAAU;IACV,UAAU;IACV,WAAW;IACX,cAAc;IACd,gBAAgB;IAChB,YAAY;IACZ,IAAI;IACJ,UAAU;IACV,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,IAAI;IACJ,eAAe;IACf,wBAAwB;IACxB,cAAc;CACf,CAAC,CAAC;AAEH,MAAM,2BAA2B,GAAgC;IAC/D,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IAC/B,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IACpC,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IACrB,SAAS,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC1B,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;CACrB,CAAC;AAEF,MAAM,oBAAoB,GAAgC;IACxD,IAAI,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC3B,OAAO,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;IAC9B,UAAU,EAAE,IAAI,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;CAClC,CAAC;AAgBF,SAAS,mBAAmB,CAAC,OAAe,EAAE,SAAmB;IAC/D,IACE,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QACrB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAC;QACtB,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,oBAAoB,OAAO,2DAA2D,CACvF,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO,CAAC,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CACb,YAAY,OAAO,kDAAkD,OAAO,8DAA8D,CAC3I,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,IAAa,EACb,OAAe,EACf,SAAiB;IAEjB,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,kCAAkC,CAAC,CAAC;IACtD,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CAAC,kCAAkC,QAAQ,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,aAAa,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IACxD,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;QACpB,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;QACjD,CAAC;QACD,IAAI,GAAG,CAAC,MAAM,GAAG,cAAc,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,QAAQ,CAAC,+BAA+B,cAAc,EAAE,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC;QACtC,IAAI,aAAa,IAAI,2BAA2B,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,yCAAyC,OAAO,wCAAwC,CACtG,CAAC;QACJ,CAAC;QACD,MAAM,UAAU,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;QACjD,IAAI,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,wEAAwE,CACtF,CAAC;QACJ,CAAC;QACD,IAAI,2BAA2B,CAAC,OAAO,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACpD,MAAM,IAAI,KAAK,CACb,SAAS,IAAI,6BAA6B,OAAO,6DAA6D,CAC/G,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAC1E,IAAI,CAAC;gBACH,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC;YAClC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,KAAK,CACb,QAAQ,CAAC,MAAM,GAAG,6CAA6C,CAChE,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,IAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB,CACrC,OAAgC,EAChC,MAAqB,EACrB,SAAiB;IAEjB,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,WAAW,EAAE,CAAC;IACrE,mBAAmB,CAAC,OAAO,EAAE,MAAM,CAAC,gBAAgB,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,mBAAmB,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;IACnE,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAC9C,MAAM,OAAO,GACX,WAAW,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,MAAM,CAAC,cAAc,CAAC;IAC1E,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,MAAM,SAAS,GAAG,MAAM,CAAC,aAAa,GAAG,IAAI,CAAC;IAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACpD,CAAC"}

package/dist/fp/extensionSnapshot.d.ts

@@ -0,0 +1,10 @@
+import type { AIComment, DebugState, Diagnostic, ExtensionClient, SelectionState } from "../extensionClient.js";
+export interface ExtensionSnapshot {
+    readonly diagnostics: ReadonlyMap<string, readonly Diagnostic[]>;
+    readonly selection: Readonly<SelectionState> | null;
+    readonly activeFile: string | null;
+    readonly aiComments: ReadonlyMap<string, readonly AIComment[]>;
+    readonly debugState: Readonly<DebugState> | null;
+    readonly capturedAt: number;
+}
+export declare function snapshotExtension(client: ExtensionClient): ExtensionSnapshot;

package/dist/fp/extensionSnapshot.js

@@ -0,0 +1,14 @@
+// CRITICAL: Must deep-copy Maps — ReadonlyMap<K,V> is compile-time only.
+// A notification arriving after snapshot creation would mutate the
+// underlying Map if we just alias it.
+export function snapshotExtension(client) {
+    return {
+        diagnostics: new Map([...client.latestDiagnostics.entries()].map(([k, v]) => [k, [...v]])),
+        selection: client.latestSelection,
+        activeFile: client.latestActiveFile,
+        aiComments: new Map([...client.latestAIComments.entries()].map(([k, v]) => [k, [...v]])),
+        debugState: client.latestDebugState,
+        capturedAt: Date.now(),
+    };
+}
+//# sourceMappingURL=extensionSnapshot.js.map

package/dist/fp/extensionSnapshot.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extensionSnapshot.js","sourceRoot":"","sources":["../../src/fp/extensionSnapshot.ts"],"names":[],"mappings":"AAiBA,yEAAyE;AACzE,mEAAmE;AACnE,sCAAsC;AACtC,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,OAAO;QACL,WAAW,EAAE,IAAI,GAAG,CAClB,CAAC,GAAG,MAAM,CAAC,iBAAiB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACrE;QACD,SAAS,EAAE,MAAM,CAAC,eAAe;QACjC,UAAU,EAAE,MAAM,CAAC,gBAAgB;QACnC,UAAU,EAAE,IAAI,GAAG,CACjB,CAAC,GAAG,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CACpE;QACD,UAAU,EAAE,MAAM,CAAC,gBAAgB;QACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE;KACvB,CAAC;AACJ,CAAC"}

package/dist/fp/index.d.ts

@@ -0,0 +1,8 @@
+export * from "./automationInterpreter.js";
+export * from "./automationProgram.js";
+export * from "./automationState.js";
+export * from "./brandedTypes.js";
+export * from "./extensionSnapshot.js";
+export * from "./interpreterContext.js";
+export * from "./policyParser.js";
+export * from "./result.js";

package/dist/fp/index.js

@@ -0,0 +1,9 @@
+export * from "./automationInterpreter.js";
+export * from "./automationProgram.js";
+export * from "./automationState.js";
+export * from "./brandedTypes.js";
+export * from "./extensionSnapshot.js";
+export * from "./interpreterContext.js";
+export * from "./policyParser.js";
+export * from "./result.js";
+//# sourceMappingURL=index.js.map

package/dist/fp/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/fp/index.ts"],"names":[],"mappings":"AAAA,cAAc,4BAA4B,CAAC;AAC3C,cAAc,wBAAwB,CAAC;AACvC,cAAc,sBAAsB,CAAC;AACrC,cAAc,mBAAmB,CAAC;AAClC,cAAc,wBAAwB,CAAC;AACvC,cAAc,yBAAyB,CAAC;AACxC,cAAc,mBAAmB,CAAC;AAClC,cAAc,aAAa,CAAC"}

package/dist/fp/interpreterContext.d.ts

@@ -0,0 +1,69 @@
+/**
+ * InterpreterContext — backend interface + concrete implementations for the
+ * AutomationProgram interpreter.
+ */
+import type { ClaudeOrchestrator } from "../claudeOrchestrator.js";
+import type { AutomationState } from "./automationState.js";
+export interface BackendEnqueueOpts {
+    prompt: string;
+    triggerSource: string;
+    sessionId: string;
+    isAutomationTask: true;
+    model?: string;
+    effort?: "low" | "medium" | "high" | "max";
+    systemPrompt?: string;
+}
+export interface Backend {
+    /** Enqueue a task and return the task ID. */
+    enqueueTask(opts: BackendEnqueueOpts): Promise<string>;
+    /** Schedule a retry after delayMs; returns a cancel function. */
+    scheduleRetry(key: string, delayMs: number, fn: () => void): () => void;
+    /** Emit an informational notification (fire-and-forget). */
+    notify(msg: string): void;
+}
+export interface InterpreterContext {
+    readonly state: AutomationState;
+    readonly now: number;
+    /** The event type that triggered this interpreter run (e.g. "onFileSave"). */
+    readonly eventType: string;
+    readonly eventData: Readonly<Record<string, string>>;
+    readonly backend: Backend;
+    readonly log: (msg: string) => void;
+}
+export interface InterpreterResult {
+    readonly taskIds: ReadonlyArray<string>;
+    readonly skipped: ReadonlyArray<{
+        reason: string;
+        hook: string;
+    }>;
+    readonly errors: ReadonlyArray<{
+        message: string;
+        hook: string;
+    }>;
+    readonly updatedState: AutomationState;
+}
+export declare class VsCodeBackend implements Backend {
+    private readonly orchestrator;
+    private readonly logger?;
+    constructor(orchestrator: ClaudeOrchestrator, logger?: {
+        info: (msg: string) => void;
+    } | undefined);
+    enqueueTask(opts: BackendEnqueueOpts): Promise<string>;
+    scheduleRetry(key: string, delayMs: number, fn: () => void): () => void;
+    notify(msg: string): void;
+}
+export interface TestBackendCollector {
+    enqueuedTasks: BackendEnqueueOpts[];
+    scheduledRetries: Array<{
+        key: string;
+        delayMs: number;
+    }>;
+    notifications: string[];
+}
+export declare class TestBackend implements Backend {
+    readonly collector: TestBackendCollector;
+    enqueueTask(opts: BackendEnqueueOpts): Promise<string>;
+    scheduleRetry(key: string, delayMs: number, _fn: () => void): () => void;
+    notify(msg: string): void;
+    reset(): void;
+}

package/dist/fp/interpreterContext.js

@@ -0,0 +1,56 @@
+// ── VsCodeBackend ─────────────────────────────────────────────────────────────
+export class VsCodeBackend {
+    orchestrator;
+    logger;
+    constructor(orchestrator, logger) {
+        this.orchestrator = orchestrator;
+        this.logger = logger;
+    }
+    async enqueueTask(opts) {
+        const taskId = this.orchestrator.enqueue({
+            prompt: opts.prompt,
+            sessionId: opts.sessionId,
+            isAutomationTask: opts.isAutomationTask,
+            triggerSource: opts.triggerSource,
+            model: opts.model,
+            effort: opts.effort,
+            systemPrompt: opts.systemPrompt,
+        });
+        return taskId;
+    }
+    scheduleRetry(key, delayMs, fn) {
+        const handle = setTimeout(() => {
+            this.logger?.info(`[automation] retrying ${key}`);
+            fn();
+        }, delayMs);
+        return () => clearTimeout(handle);
+    }
+    notify(msg) {
+        this.logger?.info(msg);
+    }
+}
+export class TestBackend {
+    collector = {
+        enqueuedTasks: [],
+        scheduledRetries: [],
+        notifications: [],
+    };
+    async enqueueTask(opts) {
+        this.collector.enqueuedTasks.push(opts);
+        return `task-${this.collector.enqueuedTasks.length}`;
+    }
+    scheduleRetry(key, delayMs, _fn) {
+        this.collector.scheduledRetries.push({ key, delayMs });
+        // Do not actually schedule in test environment
+        return () => { };
+    }
+    notify(msg) {
+        this.collector.notifications.push(msg);
+    }
+    reset() {
+        this.collector.enqueuedTasks = [];
+        this.collector.scheduledRetries = [];
+        this.collector.notifications = [];
+    }
+}
+//# sourceMappingURL=interpreterContext.js.map

package/dist/fp/interpreterContext.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"interpreterContext.js","sourceRoot":"","sources":["../../src/fp/interpreterContext.ts"],"names":[],"mappings":"AAiDA,iFAAiF;AAEjF,MAAM,OAAO,aAAa;IAEL;IACA;IAFnB,YACmB,YAAgC,EAChC,MAAwC;QADxC,iBAAY,GAAZ,YAAY,CAAoB;QAChC,WAAM,GAAN,MAAM,CAAkC;IACxD,CAAC;IAEJ,KAAK,CAAC,WAAW,CAAC,IAAwB;QACxC,MAAM,MAAM,GAAG,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YACvC,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,SAAS,EAAE,IAAI,CAAC,SAAS;YACzB,gBAAgB,EAAE,IAAI,CAAC,gBAAgB;YACvC,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,KAAK,EAAE,IAAI,CAAC,KAAK;YACjB,MAAM,EAAE,IAAI,CAAC,MAAM;YACnB,YAAY,EAAE,IAAI,CAAC,YAAY;SAChC,CAAC,CAAC;QACH,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,EAAc;QACxD,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,EAAE;YAC7B,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,yBAAyB,GAAG,EAAE,CAAC,CAAC;YAClD,EAAE,EAAE,CAAC;QACP,CAAC,EAAE,OAAO,CAAC,CAAC;QACZ,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC;IACzB,CAAC;CACF;AAUD,MAAM,OAAO,WAAW;IACb,SAAS,GAAyB;QACzC,aAAa,EAAE,EAAE;QACjB,gBAAgB,EAAE,EAAE;QACpB,aAAa,EAAE,EAAE;KAClB,CAAC;IAEF,KAAK,CAAC,WAAW,CAAC,IAAwB;QACxC,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,OAAO,QAAQ,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,MAAM,EAAE,CAAC;IACvD,CAAC;IAED,aAAa,CAAC,GAAW,EAAE,OAAe,EAAE,GAAe;QACzD,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC;QACvD,+CAA+C;QAC/C,OAAO,GAAG,EAAE,GAAE,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,CAAC,GAAW;QAChB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACzC,CAAC;IAED,KAAK;QACH,IAAI,CAAC,SAAS,CAAC,aAAa,GAAG,EAAE,CAAC;QAClC,IAAI,CAAC,SAAS,CAAC,gBAAgB,GAAG,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,CAAC,aAAa,GAAG,EAAE,CAAC;IACpC,CAAC;CACF"}

package/dist/fp/policyParser.d.ts

@@ -0,0 +1,16 @@
+/**
+ * policyParser — converts a validated AutomationPolicy object into an
+ * AutomationProgram[] (the functional DSL).
+ *
+ * Pure function — no I/O, no Date.now().
+ */
+import type { AutomationPolicy } from "../automation.js";
+import { type AutomationProgram } from "./automationProgram.js";
+import { type ToolResult } from "./result.js";
+/**
+ * Parse an already-validated AutomationPolicy into an AutomationProgram[].
+ *
+ * Returns ok([]) for an empty policy.
+ * Returns err("invalid_arg", ...) if any hook is misconfigured.
+ */
+export declare function parsePolicy(policy: AutomationPolicy): ToolResult<AutomationProgram[]>;

package/dist/fp/policyParser.js

@@ -0,0 +1,334 @@
+import { hook, withCooldown, withDedup, withRateLimit, withRetry, } from "./automationProgram.js";
+import { err, ok } from "./result.js";
+// ── Cooldown key per hook type ────────────────────────────────────────────────
+function cooldownKey(hookType, condition) {
+    switch (hookType) {
+        case "onFileSave":
+            return `save:${condition ?? "*"}`;
+        case "onFileChanged":
+            return `change:${condition ?? "*"}`;
+        case "onDiagnosticsError":
+            return `diagnostics:${condition ?? "*"}`;
+        case "onDiagnosticsCleared":
+            return `cleared:${condition ?? "*"}`;
+        case "onGitCommit":
+            return "gitcommit";
+        case "onGitPush":
+            return "gitpush";
+        case "onGitPull":
+            return "gitpull";
+        case "onBranchCheckout":
+            return "checkout";
+        case "onPullRequest":
+            return "pr";
+        case "onTestRun":
+            return "testrun";
+        case "onTestPassAfterFailure":
+            return "testpass";
+        case "onTaskCreated":
+            return "taskcreated";
+        case "onTaskSuccess":
+            return "tasksuccess";
+        case "onPermissionDenied":
+            return "permdenied";
+        case "onCwdChanged":
+            return "cwdchanged";
+        case "onPreCompact":
+            return "precompact";
+        case "onPostCompact":
+            return "postcompact";
+        case "onInstructionsLoaded":
+            return "instructions";
+        case "onDebugSessionStart":
+            return "debugstart";
+        case "onDebugSessionEnd":
+            return "debugend";
+    }
+}
+// ── PromptSource → PromptSourceNode ──────────────────────────────────────────
+function buildPromptSource(src) {
+    if (src.prompt !== undefined) {
+        return ok({ kind: "inline", prompt: src.prompt });
+    }
+    if (src.promptName !== undefined) {
+        return ok({
+            kind: "named",
+            promptName: src.promptName,
+            promptArgs: src.promptArgs,
+        });
+    }
+    return err("invalid_arg", "Hook must specify either `prompt` or `promptName`");
+}
+// ── WhenCondition mapping ─────────────────────────────────────────────────────
+function buildWhen(src) {
+    if (!src.when)
+        return undefined;
+    const w = src.when;
+    const parts = {};
+    if (w.minDiagnosticCount !== undefined)
+        parts.minDiagnosticCount = w.minDiagnosticCount;
+    if (w.diagnosticsMinSeverity !== undefined)
+        parts.diagnosticsMinSeverity = w.diagnosticsMinSeverity;
+    if (w.testRunnerLastStatus !== undefined)
+        parts.testRunnerLastStatus = w.testRunnerLastStatus;
+    return Object.keys(parts).length > 0
+        ? parts
+        : undefined;
+}
+// ── Hook builder ──────────────────────────────────────────────────────────────
+function buildHook(hookType, src, enabled, cooldownMs, condition, patterns, extras, model, effort, systemPrompt) {
+    const promptSourceResult = buildPromptSource(src);
+    if (!promptSourceResult.ok)
+        return promptSourceResult;
+    const hookNode = hook({
+        hookType,
+        enabled,
+        condition,
+        patterns,
+        when: buildWhen(src),
+        promptSource: promptSourceResult.value,
+        model,
+        effort,
+        systemPrompt,
+        extras,
+    });
+    const key = cooldownKey(hookType, condition);
+    // When dedupeByContent is active, the content-based dedup provides its own
+    // cooldown window — skip the standard per-file WithCooldown so that
+    // diagnostics with different content can fire within the cooldown window.
+    const useDedup = hookType === "onDiagnosticsError" &&
+        extras?.kind === "diagnosticsError" &&
+        extras.dedupeByContent;
+    let program = useDedup
+        ? hookNode
+        : withCooldown(key, cooldownMs, hookNode);
+    // Wrap WithRetry around WithCooldown if retryCount > 0
+    const retryCount = src.retryCount ?? 0;
+    if (retryCount > 0) {
+        const retryDelayMs = Math.max(5_000, src.retryDelayMs ?? 30_000);
+        program = withRetry(key, retryCount, retryDelayMs, program);
+    }
+    // Wrap WithDedup for diagnostics error with dedupeByContent
+    if (useDedup) {
+        const dedupCooldown = Math.max(5_000, extras
+            .dedupeContentCooldownMs ?? 900_000);
+        program = withDedup(`dedup:${key}`, dedupCooldown, program);
+    }
+    return ok(program);
+}
+// ── Main parser ───────────────────────────────────────────────────────────────
+/**
+ * Parse an already-validated AutomationPolicy into an AutomationProgram[].
+ *
+ * Returns ok([]) for an empty policy.
+ * Returns err("invalid_arg", ...) if any hook is misconfigured.
+ */
+export function parsePolicy(policy) {
+    const programs = [];
+    const defaultModel = policy.defaultModel ?? "claude-haiku-4-5-20251001";
+    const defaultEffort = policy.defaultEffort ?? "low";
+    const DEFAULT_SYSTEM_PROMPT = "You are a concise automation assistant. " +
+        "Respond in \u22645 lines. No preamble. No markdown headers. " +
+        "Call the tools listed in the task prompt, then report results only.";
+    const defaultSystemPrompt = policy.automationSystemPrompt ?? DEFAULT_SYSTEM_PROMPT;
+    // Helper to push a hook or return early on error
+    function push(result) {
+        if (!result.ok)
+            return false;
+        programs.push(result.value);
+        return true;
+    }
+    // onDiagnosticsError
+    if (policy.onDiagnosticsError?.enabled) {
+        const p = policy.onDiagnosticsError;
+        const extras = {
+            kind: "diagnosticsError",
+            diagnosticTypes: p.diagnosticTypes,
+            diagnosticsMinSeverity: p.minSeverity,
+            dedupeByContent: p.dedupeByContent,
+            dedupeContentCooldownMs: p.dedupeContentCooldownMs,
+        };
+        // Merge minSeverity into the `when` block so the interpreter's evaluateWhen()
+        // enforces it at evaluation time (extras are stored but not evaluated by the
+        // interpreter — only `when` fields are checked).
+        const diagSeverity = p.minSeverity;
+        const pWithSeverity = diagSeverity
+            ? {
+                ...p,
+                when: { ...p.when, diagnosticsMinSeverity: diagSeverity },
+            }
+            : p;
+        const result = buildHook("onDiagnosticsError", pWithSeverity, true, p.cooldownMs, p.condition, undefined, extras, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onDiagnosticsCleared
+    if (policy.onDiagnosticsCleared?.enabled) {
+        const p = policy.onDiagnosticsCleared;
+        const result = buildHook("onDiagnosticsCleared", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onFileSave
+    if (policy.onFileSave?.enabled) {
+        const p = policy.onFileSave;
+        const result = buildHook("onFileSave", p, true, p.cooldownMs, p.condition, p.patterns, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onFileChanged
+    if (policy.onFileChanged?.enabled) {
+        const p = policy.onFileChanged;
+        const result = buildHook("onFileChanged", p, true, p.cooldownMs, p.condition, p.patterns, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onPreCompact
+    if (policy.onPreCompact?.enabled) {
+        const p = policy.onPreCompact;
+        const result = buildHook("onPreCompact", p, true, p.cooldownMs, undefined, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onPostCompact
+    if (policy.onPostCompact?.enabled) {
+        const p = policy.onPostCompact;
+        const result = buildHook("onPostCompact", p, true, p.cooldownMs, undefined, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onInstructionsLoaded
+    if (policy.onInstructionsLoaded?.enabled) {
+        const p = policy.onInstructionsLoaded;
+        const result = buildHook("onInstructionsLoaded", p, true, p.cooldownMs ?? 60_000, undefined, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onCwdChanged
+    if (policy.onCwdChanged?.enabled) {
+        const p = policy.onCwdChanged;
+        const result = buildHook("onCwdChanged", p, true, p.cooldownMs, undefined, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onTestRun
+    if (policy.onTestRun?.enabled) {
+        const p = policy.onTestRun;
+        const extras = {
+            kind: "testRun",
+            onFailureOnly: p.onFailureOnly,
+            minDuration: p.minDuration,
+        };
+        const result = buildHook("onTestRun", p, true, p.cooldownMs, p.condition, undefined, extras, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onTestPassAfterFailure
+    if (policy.onTestPassAfterFailure?.enabled) {
+        const p = policy.onTestPassAfterFailure;
+        const result = buildHook("onTestPassAfterFailure", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onGitCommit
+    if (policy.onGitCommit?.enabled) {
+        const p = policy.onGitCommit;
+        const result = buildHook("onGitCommit", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onGitPush
+    if (policy.onGitPush?.enabled) {
+        const p = policy.onGitPush;
+        const result = buildHook("onGitPush", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onGitPull
+    if (policy.onGitPull?.enabled) {
+        const p = policy.onGitPull;
+        const result = buildHook("onGitPull", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onBranchCheckout
+    if (policy.onBranchCheckout?.enabled) {
+        const p = policy.onBranchCheckout;
+        const result = buildHook("onBranchCheckout", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onPullRequest
+    if (policy.onPullRequest?.enabled) {
+        const p = policy.onPullRequest;
+        const result = buildHook("onPullRequest", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onTaskCreated
+    if (policy.onTaskCreated?.enabled) {
+        const p = policy.onTaskCreated;
+        const result = buildHook("onTaskCreated", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onPermissionDenied
+    if (policy.onPermissionDenied?.enabled) {
+        const p = policy.onPermissionDenied;
+        const result = buildHook("onPermissionDenied", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onTaskSuccess
+    if (policy.onTaskSuccess?.enabled) {
+        const p = policy.onTaskSuccess;
+        const result = buildHook("onTaskSuccess", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onDebugSessionStart
+    if (policy.onDebugSessionStart?.enabled) {
+        const p = policy.onDebugSessionStart;
+        const result = buildHook("onDebugSessionStart", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // onDebugSessionEnd
+    if (policy.onDebugSessionEnd?.enabled) {
+        const p = policy.onDebugSessionEnd;
+        const result = buildHook("onDebugSessionEnd", p, true, p.cooldownMs, p.condition, undefined, undefined, p.model ?? defaultModel, p.effort ?? defaultEffort, defaultSystemPrompt);
+        if (!result.ok)
+            return result;
+        push(result);
+    }
+    // Wrap entire array in WithRateLimit if maxTasksPerHour > 0
+    if (programs.length === 0)
+        return ok([]);
+    const maxPerHour = policy.maxTasksPerHour ?? 0;
+    if (maxPerHour > 0) {
+        // Wrap each program individually so each fires through the shared rate limiter
+        const wrapped = programs.map((p) => withRateLimit(maxPerHour, p));
+        return ok(wrapped);
+    }
+    return ok(programs);
+}
+//# sourceMappingURL=policyParser.js.map