prismalens 0.2.0 → 0.4.0

package/dist/chunk-PVQVFRIV.js

@@ -0,0 +1,452 @@
+import {
+  loadConfig
+} from "./chunk-V6M6ISKI.js";
+import {
+  createSessionManager
+} from "./chunk-CTKCK7QT.js";
+import {
+  resolveInvestigation
+} from "./chunk-QDK5PAI3.js";
+import {
+  assertKnownFlags
+} from "./chunk-PTBCAI34.js";
+import {
+  HARNESS_REGISTRY,
+  SANDBOX_MODES,
+  conductRun,
+  resolveSandbox
+} from "./chunk-5BT3XQOG.js";
+import {
+  INVESTIGATION_DEFAULTS
+} from "./chunk-6N4PHBII.js";
+
+// src/cli/investigate.ts
+import { randomUUID } from "node:crypto";
+import { writeFile } from "node:fs/promises";
+import { join, resolve } from "node:path";
+import { defineCommand } from "citty";
+import consola from "consola";
+
+// src/core/detect-repo.ts
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+var execFileAsync = promisify(execFile);
+var REPO_PATTERN = /(?:github\.com|gitlab\.com|bitbucket\.org)[/:](.+?)(?:\.git)?$/;
+async function detectRepo(cwd) {
+  try {
+    const { stdout } = await execFileAsync(
+      "git",
+      ["remote", "get-url", "origin"],
+      { cwd }
+    );
+    return stdout.trim().match(REPO_PATTERN)?.[1];
+  } catch {
+    return void 0;
+  }
+}
+async function resolveRepoSlug(configRepo, cwd = process.cwd()) {
+  return configRepo ?? await detectRepo(cwd);
+}
+
+// src/core/file-session-store.ts
+function createFileSessionStore(sessions, meta) {
+  let session;
+  const store = {
+    async create() {
+      session = await sessions.create(meta);
+    },
+    async append(event) {
+      await sessions.appendEvent(meta.runId, event);
+    },
+    async finish(report) {
+      await sessions.writeReport(meta.runId, report);
+      await sessions.update(meta.runId, {
+        status: "done",
+        completedAt: (/* @__PURE__ */ new Date()).toISOString()
+      });
+    },
+    async fail(error) {
+      await sessions.update(meta.runId, { status: "errored", error });
+    }
+  };
+  return {
+    store,
+    workspacePath() {
+      if (!session) {
+        throw new Error(
+          "workspacePath() called before store.create() resolved"
+        );
+      }
+      return session.workspacePath;
+    }
+  };
+}
+
+// src/core/parse-stdin.ts
+async function parseStdin() {
+  if (process.stdin.isTTY) return void 0;
+  const chunks = [];
+  for await (const chunk of process.stdin) {
+    chunks.push(chunk);
+  }
+  const raw = Buffer.concat(chunks).toString("utf-8").trim();
+  if (!raw) return void 0;
+  try {
+    return JSON.parse(raw);
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : String(err);
+    throw new Error(`invalid FiringAlert JSON on stdin: ${msg}`);
+  }
+}
+
+// src/cli/investigate.ts
+var investigate_default = defineCommand({
+  meta: {
+    name: "investigate",
+    description: "Run a root-cause investigation of a firing alert (two-tier engine, ADR-0008).\n\nExamples:\n  $ pl investigate -q 'Why did the database crash?' --max-turns 30"
+  },
+  args: {
+    repo: {
+      type: "string",
+      description: "Path to the repository the harness investigates (its cwd). Defaults to the current directory."
+    },
+    query: {
+      type: "string",
+      alias: "q",
+      description: "Investigate a synthesized alert from this one-line description (alternative to piping a FiringAlert JSON on stdin)."
+    },
+    config: {
+      type: "string",
+      description: "Path to a prismalens.config.yaml (skips the upward config search)."
+    },
+    model: {
+      type: "string",
+      description: "Override agent.model \u2014 a bare model id, e.g. gpt-oss:120b."
+    },
+    harness: {
+      type: "enum",
+      options: ["deepagents", "claude-code", "codex"],
+      description: "Tier-2 harness backend. Defaults to agent.default in config."
+    },
+    mode: {
+      type: "enum",
+      options: ["read-only", "supervised", "auto", "dangerous"],
+      description: "Permission posture the harness runs under (ADR-0017). Defaults to agent.permissions.mode in config (read-only)."
+    },
+    dangerouslySkipPermissions: {
+      type: "boolean",
+      default: false,
+      description: "Alias for --mode dangerous."
+    },
+    sandbox: {
+      type: "enum",
+      options: [...SANDBOX_MODES],
+      description: "Isolation boundary the harness runs in (ADR-0020): process (cooperative floor), srt (enforced), or auto. Defaults to agent.sandbox in config (auto \u2014 srt when its egress bridge is healthy, else the process floor)."
+    },
+    service: {
+      type: "string",
+      description: "Select the service context by name from `services` in config (overrides the alert's service label)."
+    },
+    json: {
+      type: "boolean",
+      default: false,
+      description: "Print the InvestigationReport as JSON to stdout (suppresses the human renderer)."
+    },
+    output: {
+      type: "string",
+      description: "Write the InvestigationReport JSON to this file."
+    },
+    quiet: {
+      type: "boolean",
+      default: false,
+      description: "Suppress progress + the human renderer (errors still go to stderr)."
+    },
+    "max-turns": {
+      type: "string",
+      description: "Per-run turn ceiling for the default harness."
+    }
+  },
+  async run({ args, cmd }) {
+    try {
+      assertKnownFlags(args, cmd);
+      const json = Boolean(args.json);
+      const quiet = Boolean(args.quiet) || json;
+      const info = (msg) => {
+        if (!quiet) consola.info(msg);
+      };
+      const success = (msg) => {
+        if (!quiet) consola.success(msg);
+      };
+      const line = (msg) => {
+        if (!quiet) consola.log(msg);
+      };
+      const piped = await parseStdin();
+      const cwd = args.repo ? resolve(args.repo) : process.cwd();
+      const config = await loadConfig({
+        ...args.config ? { configPath: args.config } : {},
+        cwd,
+        cliOverrides: { ...args.model ? { model: args.model } : {} }
+      });
+      const maxTurns = args["max-turns"] ? Number(args["max-turns"]) : config.agent.max_turns;
+      const repoSlug = await resolveRepoSlug(config.repo, cwd);
+      const permissionMode = args.dangerouslySkipPermissions ? "dangerous" : args.mode;
+      const harnessName = args.harness ?? config.agent.default;
+      const sandboxMode = args.sandbox ?? config.agent.sandbox;
+      let selection = null;
+      try {
+        const resolvedSandbox = await resolveRunSandbox(
+          harnessName,
+          sandboxMode,
+          config
+        );
+        selection = resolvedSandbox.selection;
+        if (selection && resolvedSandbox.degradeReason) {
+          if (resolvedSandbox.degradeExpected) {
+            info(
+              `Sandbox: ${selection.actual} (${resolvedSandbox.degradeReason}).`
+            );
+          } else {
+            consola.warn(
+              `Sandbox 'auto' degraded to the ${selection.actual} (cooperative, not an OS boundary): ${resolvedSandbox.degradeReason}.`
+            );
+          }
+        } else if (selection?.actual === "srt") {
+          info("Sandbox: srt (enforced OS boundary).");
+        }
+        const resolved = resolveInvestigation(
+          {
+            ...piped ? { alert: piped } : {},
+            ...args.query ? { query: args.query } : {},
+            ...args.repo ? { repo: args.repo } : {},
+            ...args.harness ? { harness: args.harness } : {},
+            ...args.service ? { service: args.service } : {},
+            ...permissionMode ? { permissionMode } : {},
+            ...selection ? {
+              sandbox: selection.sandbox,
+              requestedSandbox: selection.requested
+            } : {},
+            ...maxTurns ? { maxTurns } : {}
+          },
+          config
+        );
+        const { context, harness, synth, fidelity, maxBranches } = resolved;
+        const primaryAlert = context.alerts[0];
+        if (!synth.configured) {
+          info(
+            "No Tier-1 provider configured (checked env + _FILE for: ANTHROPIC_API_KEY, OPENAI_API_KEY, GOOGLE_API_KEY, GROQ_API_KEY, OLLAMA_API_KEY) \u2014 reports will be RAW harness pass-through (un-synthesized). This is supported."
+          );
+        }
+        const runId = randomUUID();
+        const sessions = createSessionManager(config.workspace.dir);
+        const fileSession = createFileSessionStore(sessions, {
+          runId,
+          alertname: primaryAlert.alertname,
+          agent: harnessName,
+          ...repoSlug ? { repo: repoSlug } : {}
+        });
+        info(
+          `Investigating "${primaryAlert.alertname}" with ${harnessName} in ${cwd} (run ${runId})`
+        );
+        const outcome = await conductRun(
+          {
+            context,
+            harness,
+            synth,
+            fidelity,
+            runId,
+            ...maxBranches !== void 0 ? { maxBranches } : {}
+          },
+          {
+            sink: (event) => {
+              const entry = liveTimelineEntry(event);
+              if (entry) line(entry);
+            },
+            store: fileSession.store
+          }
+        );
+        if (!outcome.report) {
+          consola.error(outcome.error);
+          process.exitCode = 1;
+          return;
+        }
+        const report = outcome.report;
+        if (args.output) {
+          const outPath = resolve(args.output);
+          await writeFile(
+            outPath,
+            `${JSON.stringify(report, null, 2)}
+`,
+            "utf-8"
+          );
+          success(`Report written to ${outPath}`);
+        }
+        if (json) {
+          process.stdout.write(`${JSON.stringify(report, null, 2)}
+`);
+          return;
+        }
+        if (!quiet) {
+          renderReport(report);
+          success(
+            `Report saved to ${join(fileSession.workspacePath(), "report.json")}`
+          );
+        }
+      } finally {
+        if (selection) await selection.sandbox.destroy();
+      }
+    } catch (err) {
+      consola.error(err instanceof Error ? err.message : String(err));
+      process.exit(1);
+    }
+  }
+});
+function collectAllowedDomains(config) {
+  const llmBaseUrl = process.env.OLLAMA_BASE_URL ?? process.env.OPENAI_BASE_URL ?? INVESTIGATION_DEFAULTS.synth.baseURL;
+  const urls = [
+    llmBaseUrl,
+    config.telemetry.prometheus_url ?? INVESTIGATION_DEFAULTS.telemetry.prometheusUrl,
+    config.telemetry.alertmanager_url ?? INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl,
+    config.telemetry.api_url ?? INVESTIGATION_DEFAULTS.telemetry.apiUrl,
+    config.logs.url
+  ];
+  const hosts = /* @__PURE__ */ new Set();
+  for (const url of urls) {
+    if (!url) continue;
+    try {
+      hosts.add(new URL(url).hostname);
+    } catch {
+    }
+  }
+  return [...hosts];
+}
+async function resolveRunSandbox(harness, mode, config) {
+  const guard = resolveSandboxGuard(harness, mode);
+  if (guard.blocked) {
+    throw new Error(
+      `Harness "${harness}" cannot run inside an enforced sandbox (${mode}) yet \u2014 it is not spawned as a child process. Use the auto or process sandbox mode (no enforced boundary), or an ACP harness (deepagents).`
+    );
+  }
+  if (!guard.takesSandbox)
+    return { selection: null, degradeReason: null, degradeExpected: false };
+  const probeUrl = firstProbeUrl(config);
+  const selection = await resolveSandbox(mode, {
+    allowedDomains: collectAllowedDomains(config),
+    ...probeUrl ? { probeUrl } : {}
+  });
+  const degradeReason = mode === "auto" && selection.actual !== "srt" ? selection.degradeReason ?? "srt unavailable" : null;
+  return {
+    selection,
+    degradeReason,
+    degradeExpected: selection.degradeExpected ?? false
+  };
+}
+function firstProbeUrl(config) {
+  const urls = [
+    config.telemetry.prometheus_url,
+    config.telemetry.alertmanager_url,
+    config.telemetry.api_url,
+    config.logs.url
+  ];
+  for (const url of urls) {
+    if (!url) continue;
+    try {
+      return new URL(url).href;
+    } catch {
+    }
+  }
+  return void 0;
+}
+function resolveSandboxGuard(harness, mode) {
+  const takesSandbox = HARNESS_REGISTRY[harness]?.transport === "acp";
+  const demandsEnforcedBoundary = mode === "srt" || mode === "e2b";
+  return { takesSandbox, blocked: !takesSandbox && demandsEnforcedBoundary };
+}
+function liveTimelineEntry(event) {
+  switch (event.kind) {
+    case "agent_step": {
+      const firstLine = event.text.trim().split("\n", 1)[0]?.trim() ?? "";
+      const n = event.toolCalls.length;
+      if (!firstLine && n === 0) return null;
+      const calls = n > 0 ? ` + ${n} tool call${n === 1 ? "" : "s"}` : "";
+      return `\u2022 ${firstLine}${calls}`;
+    }
+    case "tool_result":
+      return `  ${event.result.ok ? "ok" : "ERR"} ${event.result.source}`;
+    case "branch_done":
+      return `  [branch ${event.reason}]`;
+    case "error":
+      return `  [error] ${event.message}`;
+    default:
+      return null;
+  }
+}
+var HYPOTHESIS_MARK = {
+  confirmed: "[confirmed]",
+  supported: "[supported]",
+  speculative: "[speculative]",
+  refuted: "[refuted]"
+};
+function renderReport(report) {
+  consola.log("");
+  consola.log("=== Investigation Report ===");
+  consola.log(report.summary);
+  consola.log("");
+  if (report.rootCause) {
+    const cat = report.rootCauseCategory ? ` [${report.rootCauseCategory}]` : "";
+    consola.log(`Root cause${cat}:`);
+    consola.log(`  ${report.rootCause}`);
+  } else {
+    consola.log("Root cause: not determined");
+  }
+  if (report.hypotheses.length > 0) {
+    consola.log("");
+    consola.log("Hypotheses (most -> least plausible):");
+    report.hypotheses.forEach((h, i) => {
+      renderHypothesis(h, i + 1);
+    });
+  }
+  if (report.ruledOut.length > 0) {
+    consola.log("");
+    consola.log("Ruled out:");
+    for (const r of report.ruledOut) renderRuledOut(r);
+  }
+  const { queried, notQueried } = report.coverage;
+  if (queried.length > 0 || notQueried.length > 0) {
+    consola.log("");
+    consola.log(
+      `Coverage: ${queried.length} source(s) queried, ${notQueried.length} not queried.`
+    );
+  }
+  if (report.nextSteps.length > 0) {
+    consola.log("");
+    consola.log("Next steps:");
+    for (const s of report.nextSteps) renderNextStep(s);
+  }
+}
+function renderHypothesis(h, n) {
+  consola.log(`  ${n}. ${HYPOTHESIS_MARK[h.status]} ${h.statement}`);
+  for (const e of h.evidence) {
+    const sign = e.direction === "supports" ? "+" : "-";
+    consola.log(`       ${sign} (${e.status}) ${e.observation}  [${e.source}]`);
+  }
+}
+function renderRuledOut(r) {
+  consola.log(`  x ${r.statement} \u2014 ${r.why}`);
+  for (const e of r.evidence) {
+    consola.log(`       - (${e.status}) ${e.observation}  [${e.source}]`);
+  }
+}
+function renderNextStep(s) {
+  const prio = s.priority ? `[${s.priority}] ` : "";
+  consola.log(`  * ${prio}${s.title}: ${s.detail}`);
+}
+
+export {
+  resolveRepoSlug,
+  createFileSessionStore,
+  investigate_default,
+  collectAllowedDomains,
+  resolveRunSandbox,
+  resolveSandboxGuard,
+  liveTimelineEntry
+};

package/dist/chunk-QDK5PAI3.js

@@ -0,0 +1,155 @@
+import {
+  ensureV1,
+  resolveCredentials
+} from "./chunk-CVSS5JPC.js";
+import {
+  coerceFiringAlert,
+  resolveInvestigation
+} from "./chunk-5BT3XQOG.js";
+import {
+  INVESTIGATION_DEFAULTS
+} from "./chunk-6N4PHBII.js";
+import {
+  AUTO_SELECT_PROVIDER_IDS,
+  getDefaultModel
+} from "./chunk-XH6DIKTA.js";
+
+// src/core/run-investigation.ts
+import { resolve } from "node:path";
+function isSynthConfigured(config) {
+  if (config.synth.provider) {
+    return resolveCredentials(config.synth.provider, config.synth.base_url).source !== "none";
+  }
+  for (const id of AUTO_SELECT_PROVIDER_IDS) {
+    if (resolveCredentials(id).source !== "none") {
+      return true;
+    }
+  }
+  return false;
+}
+function resolveInvestigation2(args, config) {
+  const cwd = args.repo ? resolve(args.repo) : process.cwd();
+  let providerId = config.synth.provider;
+  let creds;
+  if (providerId) {
+    creds = resolveCredentials(providerId, config.synth.base_url);
+    if (providerId === "custom" && !creds.baseURL) {
+      throw new Error(
+        "Custom LLM provider requires synth.base_url to be configured."
+      );
+    }
+  } else {
+    for (const id of AUTO_SELECT_PROVIDER_IDS) {
+      const candidate = resolveCredentials(id);
+      if (candidate.source !== "none") {
+        providerId = id;
+        break;
+      }
+    }
+    if (providerId) {
+      creds = resolveCredentials(
+        providerId,
+        config.synth.base_url
+      );
+    } else {
+      creds = { providerId: "ollama", source: "none" };
+      providerId = "ollama";
+    }
+  }
+  const synthModel = config.synth.model ?? getDefaultModel(providerId) ?? "";
+  if (!synthModel && creds.source !== "none") {
+    throw new Error("No synthesis model configured (set synth.model).");
+  }
+  const service = selectService(args, config);
+  const repos = config.repo ? [config.repo] : Object.keys(config.repos).length > 0 ? Object.keys(config.repos) : void 0;
+  const logs = config.logs.url ? {
+    ...config.logs.kind ? { kind: config.logs.kind } : {},
+    url: config.logs.url
+  } : void 0;
+  const harnessName = args.harness ?? config.agent.default;
+  const permissionMode = args.permissionMode ?? config.agent.permissions.mode;
+  const harnessNative = config.harnesses[harnessName]?.native;
+  const limits = toSandboxLimits(config.agent.limits);
+  const telemetry = {
+    prometheusUrl: config.telemetry.prometheus_url ?? INVESTIGATION_DEFAULTS.telemetry.prometheusUrl,
+    alertmanagerUrl: config.telemetry.alertmanager_url ?? INVESTIGATION_DEFAULTS.telemetry.alertmanagerUrl,
+    apiUrl: config.telemetry.api_url ?? INVESTIGATION_DEFAULTS.telemetry.apiUrl
+  };
+  const request = {
+    query: args.query,
+    harness: harnessName,
+    permissionMode,
+    ...harnessNative ? { harnessNative } : {},
+    ...args.sandbox ? { sandbox: args.sandbox } : {},
+    ...args.requestedSandbox ? { requestedSandbox: args.requestedSandbox } : {},
+    ...limits ? { limits } : {},
+    // Per-alert fan-out cap (ADR-0016 decision 2): wire `agent.max_branches` when
+    // set; unset leaves the engine default (mirrors the `limits` thread-through).
+    ...config.agent.max_branches ? { maxBranches: config.agent.max_branches } : {},
+    ...args.maxTurns ? { maxTurns: args.maxTurns } : {},
+    ...args.isolateSettings ? { isolateSettings: args.isolateSettings } : {},
+    model: config.agent.model,
+    cwd,
+    synth: {
+      providerId,
+      model: synthModel,
+      apiKey: creds.apiKey ?? "",
+      baseURL: creds.baseURL,
+      configured: creds.source !== "none"
+    },
+    harnessEnv: {
+      OPENAI_API_KEY: process.env.OLLAMA_API_KEY ?? process.env.OPENAI_API_KEY,
+      OPENAI_BASE_URL: ensureV1(
+        process.env.OLLAMA_BASE_URL ?? process.env.OPENAI_BASE_URL ?? INVESTIGATION_DEFAULTS.synth.baseURL
+      )
+    },
+    initTimeoutMs: INVESTIGATION_DEFAULTS.harnessInitTimeoutMs
+  };
+  if (args.alerts && args.alerts.length > 0) {
+    request.context = {
+      alerts: args.alerts.map(coerceFiringAlert),
+      telemetry,
+      ...service ? { service } : {},
+      ...repos ? { repos } : {},
+      ...logs ? { logs } : {}
+    };
+  } else {
+    request.alert = args.alert;
+    request.telemetry = telemetry;
+    if (service) request.service = service;
+    if (repos) request.repos = repos;
+    if (logs) request.logs = logs;
+  }
+  return resolveInvestigation(request);
+}
+function toSandboxLimits(limits) {
+  const out = {
+    ...limits.wall_clock_ms ? { wallClockMs: limits.wall_clock_ms } : {},
+    ...limits.memory_mb ? { memoryMb: limits.memory_mb } : {},
+    ...limits.cpu_cores ? { cpuCores: limits.cpu_cores } : {}
+  };
+  return Object.keys(out).length > 0 ? out : void 0;
+}
+function selectService(args, config) {
+  const name = args.service ?? pickServiceLabel(args.alerts?.[0] ?? args.alert);
+  if (!name) return void 0;
+  const cfg = config.services[name];
+  if (!cfg) return void 0;
+  return {
+    name,
+    ...cfg.tier ? { tier: cfg.tier } : {},
+    ...cfg.repo ? { repo: cfg.repo } : {},
+    ...cfg.depends_on.length > 0 ? { dependsOn: cfg.depends_on } : {}
+  };
+}
+function pickServiceLabel(alert) {
+  const labels = alert?.labels ?? {};
+  const pick = labels.service ?? labels.namespace ?? labels.job;
+  return typeof pick === "string" && pick ? pick : void 0;
+}
+
+export {
+  isSynthConfigured,
+  resolveInvestigation2 as resolveInvestigation,
+  pickServiceLabel
+};