renor-engine 0.0.0-stage → 1.0.0

package/dist/mvp/sanitize.js

@@ -0,0 +1,48 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeErrorMessage = sanitizeErrorMessage;
+exports.escapeInvisibleControls = escapeInvisibleControls;
+/**
+ * Privacy-safe error sanitizer: redacts host filesystem paths and bounds message length.
+ * Preserves error descriptions, status codes, and syscalls without disclosing server directories.
+ */
+function sanitizeErrorMessage(err) {
+    let message = err instanceof Error ? err.message : String(err);
+    if (err && typeof err === 'object' && 'path' in err && typeof err.path === 'string' && err.path.length > 0) {
+        message = message.split(err.path).join('[redacted-path]');
+    }
+    // Windows absolute paths: C:\...
+    const winPath = /(?:^|(?<=[\s(]))(['"`]?)[a-zA-Z]:\\(?:[^\s'"`:,;()\[\]\\]+\\)*[^\s'"`:,;()\[\]]*\1/g;
+    // Unix absolute paths: starts with / and has at least two segments (e.g. /home/user/vault or /tmp/x)
+    const unixPath = /(?:^|(?<=[\s(]))(['"`]?)\/(?:[^\s'"`:,;()\[\]/]+\/)+[^\s'"`:,;()\[\]]*\1/g;
+    return message.replace(winPath, '[redacted-path]').replace(unixPath, '[redacted-path]');
+}
+/**
+ * Characters JSON.stringify leaves literal although a reader may treat them as structure rather than
+ * data: the C1 controls (U+0085 NEXT LINE among them), the Unicode format controls — bidirectional
+ * overrides and zero-width characters a stored memory can use to reorder or hide text — and the line
+ * and paragraph separators. A memory is untrusted text; emitted raw, a bidirectional override makes
+ * the reply read backwards in an agent's transcript and a zero-width or line separator can hide an
+ * instruction from a human reviewer while the model still tokenizes it.
+ *
+ * Escaping them to a plain `\uXXXX` escape on the wire changes no tool's contract: JSON.stringify
+ * already escapes every C0 control, any JSON parser reads the same string back, so the decoded value
+ * is byte-identical while the raw reply an agent or a log reads shows the hidden character as an
+ * escape instead of applying it. Mirrors lifecycle.ts JSON_LEAVES_LITERAL, which does the same for the
+ * ledger's statement field. Surrogate pairs (astral format characters) are escaped unit by unit.
+ *
+ * The categories above are not the whole set a reader cannot see. Variation selectors (Mn: U+FE00–FE0F and the
+ * supplement U+E0100–E01EF, which spell out bytes an instruction can hide in) and blank fillers (Lo, So or Mn: the Hangul
+ * fillers, the braille blank, the combining grapheme joiner) are invisible in a transcript yet pass the categories
+ * above, so they are listed by code point (adv report renor-adv-inj6b-1012, F4). Emoji presentation selectors (U+FE0F
+ * after a symbol) are escaped too: still lossless after a JSON parse, a few bytes longer in the raw reply.
+ */
+const OUTPUT_INVISIBLE = new RegExp('[\\p{Cc}\\p{Cf}\\p{Zl}\\p{Zp}'
+    + '\\u034F\\u115F\\u1160\\u2800\\u3164\\uFE00-\\uFE0F\\uFFA0\\u{E0100}-\\u{E01EF}]', 'gu');
+/** A text of printable ASCII alone holds none of the characters above: found by a plain character class, not by the Unicode properties. */
+const PRINTABLE_ASCII = /^[\x20-\x7e]*$/;
+function escapeInvisibleControls(text) {
+    if (PRINTABLE_ASCII.test(text))
+        return text;
+    return text.replace(OUTPUT_INVISIBLE, ch => Array.from({ length: ch.length }, (_, i) => `\\u${ch.charCodeAt(i).toString(16).padStart(4, '0')}`).join(''));
+}

package/dist/mvp/schemaRejections.js

@@ -0,0 +1,91 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.countSchemaRejections = countSchemaRejections;
+const types_js_1 = require("@modelcontextprotocol/sdk/types.js");
+const zod_compat_js_1 = require("@modelcontextprotocol/sdk/server/zod-compat.js");
+const telemetry_1 = require("./telemetry");
+/**
+ * Wraps `server` so that each call its tools' schemas refuse is counted as one `tool_rejected` event. `onRefused` hears the
+ * tool's name for each such call, before the event is written: a refused call is still a call (a session's first call).
+ */
+function countSchemaRejections(server, onRefused) {
+    const sdk = server;
+    const validate = sdk.validateToolInput;
+    if (typeof validate !== 'function')
+        return;
+    sdk.validateToolInput = async (tool, args, toolName) => {
+        try {
+            return await validate.call(server, tool, args, toolName);
+        }
+        catch (err) {
+            // Inside this method the SDK throws InvalidParams for one thing only: the arguments failed the schema (an unknown or
+            // disabled tool is refused before it is reached). Anything else is a defect of the schema itself, not a refusal.
+            if (err?.code === types_js_1.ErrorCode.InvalidParams) {
+                onRefused?.(toolName);
+                await recordRejection(tool, args, toolName);
+            }
+            throw err;
+        }
+    };
+}
+async function recordRejection(tool, args, toolName) {
+    // The SDK has refused the call, so it is counted whatever happens next: a failure to say more leaves the kind at `other`.
+    let described = { kind: 'other' };
+    try {
+        described = await describeFailure(tool, args);
+    }
+    catch {
+        // Observability must never change what the caller reads.
+    }
+    (0, telemetry_1.emitTelemetry)({ event: 'tool_rejected', tool: toolName, ...described });
+}
+/**
+ * Which argument the schema refused first and how, read from the issues the SDK's own parse yields (the same function, on
+ * the same schema and the same arguments, so the same verdict). Issues follow the schema's own order, so "first" is stable.
+ */
+async function describeFailure(tool, args) {
+    if (!tool.inputSchema)
+        return { kind: 'other' };
+    const parsed = await (0, zod_compat_js_1.safeParseAsync)(tool.inputSchema, args);
+    if (parsed.success)
+        return { kind: 'other' };
+    const issue = firstIssue(parsed.error);
+    if (!issue)
+        return { kind: 'other' };
+    // Only a name the tool's own schema declares can be an argument that failed: a key the caller invented is not one. A declared
+    // name that is not a plain identifier is left out too, so the call is still counted instead of the whole line being dropped.
+    const shape = (0, zod_compat_js_1.getObjectShape)(tool.inputSchema);
+    const head = issue.path[0];
+    const named = typeof head === 'string' && shape !== undefined && Object.prototype.hasOwnProperty.call(shape, head) && (0, telemetry_1.isSafeArgName)(head);
+    return { ...(named ? { arg: head } : {}), kind: kindOf(issue, args) };
+}
+function firstIssue(error) {
+    const issues = error?.issues;
+    if (!Array.isArray(issues))
+        return undefined;
+    const first = issues[0];
+    if (!first || typeof first.code !== 'string' || !Array.isArray(first.path))
+        return undefined;
+    return { code: first.code, path: first.path };
+}
+function kindOf(issue, args) {
+    switch (issue.code) {
+        // The schema says "invalid_type" both for an absent argument and for one of the wrong type; the call says which.
+        case 'invalid_type': return valueAt(args, issue.path) === undefined ? 'missing' : 'wrong_type';
+        case 'too_small': return 'too_small';
+        case 'too_big': return 'too_big';
+        case 'invalid_value': return 'invalid_value';
+        case 'invalid_format': return 'invalid_format';
+        default: return 'other';
+    }
+}
+/** Whatever sits at `path` in what the caller sent. Only ever compared with `undefined`: it is never kept or written. */
+function valueAt(root, path) {
+    let value = root;
+    for (const key of path) {
+        if (value === null || typeof value !== 'object')
+            return undefined;
+        value = value[key];
+    }
+    return value;
+}

package/dist/mvp/scope.js

@@ -0,0 +1,127 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.normalizeScope = normalizeScope;
+exports.dailyDirForScope = dailyDirForScope;
+exports.notePathMatchesScope = notePathMatchesScope;
+exports.scopeSqlPredicate = scopeSqlPredicate;
+exports.scopeSpellings = scopeSpellings;
+exports.savedScopeMatches = savedScopeMatches;
+exports.savedScopeSqlPredicate = savedScopeSqlPredicate;
+/**
+ * Optional memory scope for MVP tools (global vs named project/scope).
+ *
+ * Allowed forms:
+ *   - "global" (default)
+ *   - "scope:<slug>" or "project:<slug>"
+ * Slug: lowercase [a-z0-9-]{1,64} after normalization.
+ */
+const toolRefusal_1 = require("../toolRefusal");
+/** The one directory a scope owns. Read by both the JS and the SQL scope rules. */
+const SCOPES_ROOT = 'Memory/Scopes/';
+const SLUG_RE = /^[a-z0-9-]{1,64}$/;
+/** Normalize user/agent scope input. Throws on invalid values. */
+function normalizeScope(raw) {
+    if (raw === undefined || raw === null || raw.trim() === '')
+        return 'global';
+    const s = raw.trim().toLowerCase();
+    if (s === 'global')
+        return 'global';
+    let kind = null;
+    let slug = s;
+    if (s.startsWith('scope:')) {
+        kind = 'scope';
+        slug = s.slice('scope:'.length);
+    }
+    else if (s.startsWith('project:')) {
+        kind = 'project';
+        slug = s.slice('project:'.length);
+    }
+    else {
+        // Bare slug → scope:<slug>
+        kind = 'scope';
+        slug = s;
+    }
+    // Normalize slug: spaces/underscores → hyphens; strip invalid chars
+    slug = slug
+        .replace(/[_\s]+/g, '-')
+        .replace(/[^a-z0-9-]/g, '')
+        .replace(/-+/g, '-')
+        .replace(/^-|-$/g, '');
+    if (!SLUG_RE.test(slug)) {
+        // The refusal names its code for telemetry (a closed set, never built from this input); the message the
+        // agent reads is unchanged, and it is the agent's own argument that is quoted in it.
+        throw (0, toolRefusal_1.refusal)('invalid_scope', `invalid scope ${JSON.stringify(raw)}: use "global" or "scope:<slug>" / "project:<slug>" with slug matching [a-z0-9-]{1,64}`);
+    }
+    return `${kind}:${slug}`;
+}
+/** Daily-note directory under the vault for this scope. */
+function dailyDirForScope(scope) {
+    if (scope === 'global')
+        return 'Memory/Daily';
+    const slug = scope.includes(':') ? scope.slice(scope.indexOf(':') + 1) : scope;
+    return `Memory/Scopes/${slug}/Daily`;
+}
+/** True if a vault-relative note path belongs to the given scope. */
+function notePathMatchesScope(notePath, scope) {
+    const norm = notePath.replace(/\\/g, '/');
+    if (scope === 'global') {
+        // Global notes: not under Memory/Scopes/
+        if (norm.startsWith('Memory/Scopes/') || norm.includes('/Memory/Scopes/'))
+            return false;
+        return true;
+    }
+    const slug = scope.slice(scope.indexOf(':') + 1);
+    const prefix = `Memory/Scopes/${slug}/`;
+    return norm === prefix.slice(0, -1) || norm.startsWith(prefix) || norm.includes('/' + prefix);
+}
+/**
+ * The same rule as notePathMatchesScope, as a SQL predicate over a stored path
+ * column, for the callers that must filter or count rows without materializing
+ * every path. Each arm below is one arm of that function — the three `dir`
+ * terms are its equality, startsWith and includes cases — and
+ * tests/mvp/scope-isolation.test.ts pins them against each other, so a scope
+ * can never mean two different things depending on whether it was checked in
+ * SQL or in JS. `dir` is built from a validated slug, so it contains no LIKE
+ * wildcard. Bind with better-sqlite3's positional params in `params`.
+ */
+function scopeSqlPredicate(scope, column) {
+    if (scope === 'global') {
+        return {
+            sql: `(${column} NOT LIKE ? AND instr(${column}, ?) = 0)`,
+            params: [`${SCOPES_ROOT}%`, `/${SCOPES_ROOT}`],
+        };
+    }
+    const dir = `${SCOPES_ROOT}${scope.slice(scope.indexOf(':') + 1)}`;
+    return {
+        sql: `(instr(${column}, ?) > 0 OR ${column} LIKE ? OR ${column} = ?)`,
+        params: [`/${dir}/`, `${dir}/%`, dir],
+    };
+}
+/**
+ * The scopes a fact or a ledger event can have been saved in and belong to `scope`: the one rule notes follow, for
+ * what is not a note. A named scope is its slug. `scope:<slug>`, `project:<slug>` and the bare `<slug>` are spellings
+ * of one scope: a note saved in any of them goes to the one folder of that slug (`dailyDirForScope`) and is read in
+ * all three (`notePathMatchesScope`). A fact keeps the spelling it was saved with (the ledger, its digest and the
+ * `scope` a read shows are what was written), and is read in every spelling of its slug, as its scope's notes are. A
+ * save corrects its subject and predicate in every spelling too: it closes the current value whatever spelling that
+ * was saved with (memory/lifecycle.ts, one lifecycle stream per slug).
+ * Global has one spelling. Distinct, so a caller that reads once per spelling never reads a scope twice.
+ */
+function scopeSpellings(scope) {
+    if (scope === 'global')
+        return ['global'];
+    const slug = scope.slice(scope.indexOf(':') + 1);
+    return [`scope:${slug}`, `project:${slug}`];
+}
+/** Whether a fact or ledger event saved in `saved` (a stored, normalized scope) belongs to `scope`. */
+function savedScopeMatches(saved, scope) {
+    return scopeSpellings(scope).includes(saved);
+}
+/**
+ * The same rule as savedScopeMatches, as a SQL predicate over a stored scope column (`facts.scope`,
+ * `fact_terms.scope`). Bind with better-sqlite3's positional params in `params`.
+ */
+function savedScopeSqlPredicate(scope, column) {
+    const spellings = scopeSpellings(scope);
+    return { sql: `${column} IN (${spellings.map(() => '?').join(', ')})`, params: spellings };
+}