principles-disciple 1.40.0 → 1.41.0

package/tests/core/template-generator.test.ts

@@ -0,0 +1,101 @@
+import { describe, it, expect } from 'vitest';
+import { generateFromTemplate, PainPattern } from '../../src/core/principle-compiler/template-generator';
+
+describe('generateFromTemplate', () => {
+  it('should generate code for a single tool with path pattern', () => {
+    const patterns: PainPattern[] = [
+      { toolName: 'write', pathRegex: 'secrets/.*\\.env' },
+    ];
+
+    const result = generateFromTemplate('P_066', 'Writing to secrets directory', patterns);
+
+    expect(result).not.toBeNull();
+    expect(result).toContain("export const meta");
+    expect(result).toContain("export function evaluate(input)");
+    expect(result).toContain('name: "Auto_P_066"');
+    expect(result).toContain('ruleId: "R_P_066_auto"');
+    expect(result).toContain('sourcePrincipleId: "P_066"');
+    expect(result).toContain('coversCondition: "Writing to secrets directory"');
+    expect(result).toContain('input.action.toolName === "write"');
+    expect(result).toContain("secrets/.*\\\\.env");
+    expect(result).toContain("input.action.normalizedPath");
+    expect(result).toContain("decision: 'block'");
+    expect(result).toContain("matched: true");
+    expect(result).toContain("[P_066]");
+  });
+
+  it('should generate code for write tool with content pattern', () => {
+    const patterns: PainPattern[] = [
+      { toolName: 'write', contentRegex: 'BEGIN RSA PRIVATE KEY' },
+    ];
+
+    const result = generateFromTemplate('P_007', 'Writing private keys', patterns);
+
+    expect(result).not.toBeNull();
+    expect(result).toContain('input.action.toolName === "write"');
+    expect(result).toContain("BEGIN RSA PRIVATE KEY");
+    expect(result).toContain("paramsSummary.content");
+  });
+
+  it('should generate code for multiple tool patterns', () => {
+    const patterns: PainPattern[] = [
+      { toolName: 'bash', commandRegex: 'rm\\s+-rf\\s+/' },
+      { toolName: 'write', pathRegex: 'secrets/', contentRegex: 'password' },
+    ];
+
+    const result = generateFromTemplate('P_010', 'Destructive operations', patterns);
+
+    expect(result).not.toBeNull();
+    expect(result).toContain('input.action.toolName === "bash"');
+    expect(result).toContain("rm\\\\s+-rf\\\\s+/");
+    expect(result).toContain("paramsSummary.command");
+    expect(result).toContain('input.action.toolName === "write"');
+    expect(result).toContain("secrets/");
+    expect(result).toContain("password");
+  });
+
+  it('should return null when patterns array is empty', () => {
+    const result = generateFromTemplate('P_066', 'some condition', []);
+    expect(result).toBeNull();
+  });
+
+  it('should not contain forbidden patterns (require, import, fetch)', () => {
+    const patterns: PainPattern[] = [
+      { toolName: 'bash', commandRegex: 'dangerous' },
+    ];
+
+    const result = generateFromTemplate('P_099', 'Dangerous commands', patterns);
+
+    expect(result).not.toBeNull();
+    expect(result).not.toContain('require(');
+    expect(result).not.toContain('import ');
+    expect(result).not.toContain('fetch(');
+  });
+
+  it('should have proper structure with meta and evaluate function', () => {
+    const patterns: PainPattern[] = [
+      { toolName: 'edit', pathRegex: '\\.json$', contentRegex: 'admin.*true' },
+    ];
+
+    const result = generateFromTemplate('P_050', 'Modifying admin config', patterns);
+
+    expect(result).not.toBeNull();
+
+    // Check meta structure
+    expect(result).toMatch(/export const meta = \{/);
+    expect(result).toMatch(/name: "Auto_P_050"/);
+    expect(result).toMatch(/version: '1\.0\.0'/);
+    expect(result).toMatch(/ruleId: "R_P_050_auto"/);
+    expect(result).toMatch(/sourcePrincipleId: "P_050"/);
+    expect(result).toMatch(/compiledAt: "\d{4}-\d{2}-\d{2}T/);
+
+    // Check evaluate function structure
+    expect(result).toMatch(/export function evaluate\(input\)/);
+    expect(result).toMatch(/decision: 'block'/);
+    expect(result).toMatch(/matched: true/);
+    expect(result).toMatch(/return \{ matched: false \}/);
+
+    // Check edit tool uses new_string fallback
+    expect(result).toContain("input.action.paramsSummary.content || input.action.paramsSummary.new_string");
+  });
+});

package/tests/integration/principle-compiler-e2e.test.ts

@@ -0,0 +1,335 @@
+/**
+ * E2E Test: Principle Compiler → RuleHost Enforcement
+ *
+ * Tests the full chain:
+ *   1. Set up principle in ledger with derivedFromPainIds
+ *   2. Record tool call (bash, failure) and pain event in trajectory DB
+ *   3. Compile principle via PrincipleCompiler (registers as active + persists code)
+ *   4. RuleHost.evaluate(matching input) → block
+ *   5. RuleHost.evaluate(non-matching input) → undefined (passthrough)
+ */
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import * as fs from 'fs';
+import * as os from 'os';
+import * as path from 'path';
+import { TrajectoryDatabase } from '../../src/core/trajectory.js';
+import { PrincipleCompiler } from '../../src/core/principle-compiler/compiler.js';
+import { RuleHost } from '../../src/core/rule-host.js';
+import {
+  loadLedger,
+  saveLedger,
+} from '../../src/core/principle-tree-ledger.js';
+import type { RuleHostInput } from '../../src/core/rule-host-types.js';
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+interface TestWorkspace {
+  workspaceDir: string;
+  stateDir: string;
+  trajectory: TrajectoryDatabase;
+}
+
+function createTestWorkspace(): TestWorkspace {
+  const workspaceDir = fs.mkdtempSync(path.join(os.tmpdir(), 'pd-compiler-e2e-'));
+  const stateDir = path.join(workspaceDir, '.state');
+  fs.mkdirSync(stateDir, { recursive: true });
+
+  const trajectory = new TrajectoryDatabase({ workspaceDir });
+
+  return { workspaceDir, stateDir, trajectory };
+}
+
+function disposeTestWorkspace(ws: TestWorkspace): void {
+  ws.trajectory.dispose();
+  fs.rmSync(ws.workspaceDir, { recursive: true, force: true });
+}
+
+// ---------------------------------------------------------------------------
+// Tests
+// ---------------------------------------------------------------------------
+
+describe('Principle Compiler E2E: compile → promote → RuleHost blocks', () => {
+  let ws: TestWorkspace;
+
+  beforeEach(() => {
+    ws = createTestWorkspace();
+  });
+
+  afterEach(() => {
+    disposeTestWorkspace(ws);
+  });
+
+  it('should compile a principle, promote it, and have RuleHost block matching input', () => {
+    const sessionId = 'session-e2e-001';
+    const principleId = 'P_066';
+
+    // ── Step 1: Record a tool call and pain event in trajectory DB ──
+    ws.trajectory.recordToolCall({
+      sessionId,
+      toolName: 'bash',
+      outcome: 'failure',
+      errorType: 'command_not_found',
+      errorMessage: 'heartbeat: command not found',
+      paramsJson: { command: 'heartbeat --status' },
+    });
+
+    // Pain event whose reason contains "bash" (known tool) so
+    // extractPatterns() can infer the toolName.
+    ws.trajectory.recordPainEvent({
+      sessionId,
+      source: 'gate_block',
+      score: 75,
+      reason: 'Blocked bash heartbeat command due to unsafe operation',
+      severity: 'moderate',
+      origin: 'system_infer',
+    });
+
+    // ── Step 2: Set up principle P_066 in the ledger with derivedFromPainIds ──
+    const store = loadLedger(ws.stateDir);
+
+    const now = new Date().toISOString();
+
+    // Principle must have derivedFromPainIds for the ReflectionContextCollector
+    // to return a non-null context. The painIds are arbitrary strings that
+    // we make match the pain event's auto-increment row ID via the
+    // best-effort resolution logic (it checks if painId appears in
+    // pe.reason, pe.origin, or String(pe.id)).
+    store.tree.principles[principleId] = {
+      id: principleId,
+      version: 1,
+      text: 'Do not run heartbeat commands via bash',
+      triggerPattern: 'heartbeat.*bash',
+      action: 'Block heartbeat commands in bash',
+      status: 'active',
+      priority: 'P1',
+      scope: 'general',
+      evaluability: 'deterministic',
+      valueScore: 0,
+      adherenceRate: 0,
+      painPreventedCount: 0,
+      derivedFromPainIds: ['1'], // references pain event row id (stringified)
+      ruleIds: [],
+      conflictsWithPrincipleIds: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    saveLedger(ws.stateDir, store);
+
+    // ── Step 3: Create PrincipleCompiler and compile P_066 ──
+    const compiler = new PrincipleCompiler(ws.stateDir, ws.trajectory);
+    const result = compiler.compileOne(principleId);
+
+    // Verify compilation succeeded
+    expect(result.success).toBe(true);
+    expect(result.principleId).toBe(principleId);
+    expect(result.code).toBeDefined();
+    expect(result.ruleId).toBeDefined();
+    expect(result.implementationId).toBeDefined();
+
+    const implId = result.implementationId!;
+
+    // Verify the implementation was registered as active (not candidate)
+    const ledger = loadLedger(ws.stateDir);
+    const impl = ledger.tree.implementations[implId];
+    expect(impl.lifecycleState).toBe('active');
+
+    // ── Step 4: Create RuleHost and evaluate with matching input ──
+    const host = new RuleHost(ws.stateDir, { warn: () => {} });
+
+    // Matching input: bash tool with a heartbeat command
+    const matchingInput: RuleHostInput = {
+      action: {
+        toolName: 'bash',
+        normalizedPath: null,
+        paramsSummary: { command: 'heartbeat --status' },
+      },
+      workspace: {
+        isRiskPath: false,
+        planStatus: 'NONE',
+        hasPlanFile: false,
+      },
+      session: {
+        sessionId: 'session-eval-001',
+        currentGfi: 50,
+        recentThinking: false,
+      },
+      evolution: {
+        epTier: 0,
+      },
+      derived: {
+        estimatedLineChanges: 0,
+        bashRisk: 'unknown',
+      },
+    };
+
+    const blockResult = host.evaluate(matchingInput);
+
+    // Verify RuleHost blocks the matching input
+    expect(blockResult).toBeDefined();
+    expect(blockResult!.decision).toBe('block');
+    expect(blockResult!.matched).toBe(true);
+    expect(blockResult!.reason).toContain(principleId);
+
+    // ── Step 5: Verify non-matching input returns undefined (passthrough) ──
+    const nonMatchingInput: RuleHostInput = {
+      action: {
+        toolName: 'write', // different tool, not bash
+        normalizedPath: '/home/user/project/src/index.ts',
+        paramsSummary: { content: 'console.log("hello")' },
+      },
+      workspace: {
+        isRiskPath: false,
+        planStatus: 'NONE',
+        hasPlanFile: false,
+      },
+      session: {
+        sessionId: 'session-eval-002',
+        currentGfi: 50,
+        recentThinking: false,
+      },
+      evolution: {
+        epTier: 0,
+      },
+      derived: {
+        estimatedLineChanges: 5,
+        bashRisk: 'safe',
+      },
+    };
+
+    const passthroughResult = host.evaluate(nonMatchingInput);
+    expect(passthroughResult).toBeUndefined();
+  });
+
+  it('should return undefined when no active implementations exist', () => {
+    const host = new RuleHost(ws.stateDir, { warn: () => {} });
+
+    const input: RuleHostInput = {
+      action: {
+        toolName: 'bash',
+        normalizedPath: null,
+        paramsSummary: { command: 'rm -rf /' },
+      },
+      workspace: {
+        isRiskPath: true,
+        planStatus: 'NONE',
+        hasPlanFile: false,
+      },
+      session: {
+        sessionId: 'session-empty-001',
+        currentGfi: 0,
+        recentThinking: false,
+      },
+      evolution: {
+        epTier: 0,
+      },
+      derived: {
+        estimatedLineChanges: 0,
+        bashRisk: 'dangerous',
+      },
+    };
+
+    const result = host.evaluate(input);
+    expect(result).toBeUndefined();
+  });
+
+  it('should return compilation failure when principle has no derivedFromPainIds', () => {
+    const sessionId = 'session-no-pain-001';
+    const principleId = 'P_099';
+
+    // Set up a principle WITHOUT derivedFromPainIds
+    const store = loadLedger(ws.stateDir);
+    const now = new Date().toISOString();
+
+    store.tree.principles[principleId] = {
+      id: principleId,
+      version: 1,
+      text: 'A principle with no pain grounding',
+      triggerPattern: 'noop',
+      action: 'do nothing',
+      status: 'active',
+      priority: 'P2',
+      scope: 'general',
+      evaluability: 'manual_only',
+      valueScore: 0,
+      adherenceRate: 0,
+      painPreventedCount: 0,
+      derivedFromPainIds: [], // EMPTY — no pain grounding
+      ruleIds: [],
+      conflictsWithPrincipleIds: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    saveLedger(ws.stateDir, store);
+
+    const compiler = new PrincipleCompiler(ws.stateDir, ws.trajectory);
+    const result = compiler.compileOne(principleId);
+
+    // Should fail because no context (no derivedFromPainIds)
+    expect(result.success).toBe(false);
+    expect(result.reason).toBe('no context');
+  });
+
+  it('should compile using session snapshot tool calls as pattern source', () => {
+    const sessionId = 'session-snapshot-001';
+    const principleId = 'P_077';
+
+    // Record a tool call that the session snapshot will pick up.
+    // Avoid file paths in the reason/params to prevent path-based regex
+    // generation which has a known escaping limitation in the template generator.
+    ws.trajectory.recordToolCall({
+      sessionId,
+      toolName: 'grep',
+      outcome: 'failure',
+      errorType: 'timeout',
+      errorMessage: 'grep command timed out',
+      paramsJson: { pattern: 'TODO' },
+    });
+
+    // Pain event referencing this session
+    ws.trajectory.recordPainEvent({
+      sessionId,
+      source: 'gate_block',
+      score: 60,
+      reason: 'grep tool failed with timeout error',
+      severity: 'moderate',
+      origin: 'system_infer',
+    });
+
+    // Set up principle
+    const store = loadLedger(ws.stateDir);
+    const now = new Date().toISOString();
+
+    store.tree.principles[principleId] = {
+      id: principleId,
+      version: 1,
+      text: 'Block grep tool on timeout patterns',
+      triggerPattern: 'grep.*timeout',
+      action: 'Block grep commands that time out',
+      status: 'active',
+      priority: 'P1',
+      scope: 'general',
+      evaluability: 'deterministic',
+      valueScore: 0,
+      adherenceRate: 0,
+      painPreventedCount: 0,
+      derivedFromPainIds: ['1'], // reference to pain event (auto-increment ID)
+      ruleIds: [],
+      conflictsWithPrincipleIds: [],
+      createdAt: now,
+      updatedAt: now,
+    };
+
+    saveLedger(ws.stateDir, store);
+
+    const compiler = new PrincipleCompiler(ws.stateDir, ws.trajectory);
+    const result = compiler.compileOne(principleId);
+
+    expect(result.success).toBe(true);
+    expect(result.code).toContain('grep'); // generated code should check for grep tool
+  });
+});