salmon-loop 0.2.3

package/dist/core/testgen/index.js

@@ -0,0 +1,38 @@
+import { join } from 'path';
+import { writeFile } from '../adapters/fs/node-fs.js';
+import { detectProjectType } from './detector.js';
+import { NODE_TEMPLATE, PYTHON_TEMPLATE, JAVA_TEMPLATE, GO_TEMPLATE } from './templates.js';
+export async function injectSmokeTest(repoPath) {
+    const type = detectProjectType(repoPath);
+    let fileName = '';
+    let content = '';
+    let testCommand = '';
+    switch (type) {
+        case 'nodejs':
+            fileName = 'salmon_smoke_test.js';
+            content = NODE_TEMPLATE;
+            testCommand = 'node salmon_smoke_test.js';
+            break;
+        case 'python':
+            fileName = 'salmon_smoke_test.py';
+            content = PYTHON_TEMPLATE;
+            testCommand = 'python salmon_smoke_test.py';
+            break;
+        case 'java_maven':
+        case 'java_gradle':
+            fileName = 'SalmonSmokeTest.java';
+            content = JAVA_TEMPLATE;
+            testCommand = 'java SalmonSmokeTest.java';
+            break;
+        case 'go':
+            fileName = 'salmon_smoke_test.go';
+            content = GO_TEMPLATE;
+            testCommand = 'go run salmon_smoke_test.go';
+            break;
+        default:
+            return { created: false, testCommand: '' };
+    }
+    await writeFile(join(repoPath, fileName), content, 'utf-8');
+    return { created: true, testCommand };
+}
+//# sourceMappingURL=index.js.map

package/dist/core/testgen/templates.js

@@ -0,0 +1,46 @@
+export const PYTHON_TEMPLATE = `
+import sys
+import os
+
+print(f"Running smoke test on Python {sys.version}")
+try:
+    # Basic environment check
+    print("Environment check passed")
+    sys.exit(0)
+except Exception as e:
+    print(f"Smoke test failed: {e}")
+    sys.exit(1)
+`;
+export const JAVA_TEMPLATE = `
+public class SalmonSmokeTest {
+    public static void main(String[] args) {
+        System.out.println("Java Environment OK");
+        if (1 + 1 != 2) {
+            System.err.println("Universe is broken");
+            System.exit(1);
+        }
+        System.exit(0);
+    }
+}
+`;
+export const GO_TEMPLATE = `
+package main
+
+import (
+	"fmt"
+	"os"
+)
+
+func main() {
+	fmt.Println("Go Environment OK")
+	os.Exit(0)
+}
+`;
+export const NODE_TEMPLATE = `
+// Note: Use a logger in real code, this is a template smoke test
+if (1 + 1 !== 2) {
+  process.exit(1);
+}
+process.exit(0);
+`;
+//# sourceMappingURL=templates.js.map

package/dist/core/tools/audit.js

@@ -0,0 +1,140 @@
+import { text } from '../../locales/index.js';
+import { getLogger } from '../observability/logger.js';
+import { Phase } from '../types/runtime.js';
+import { sanitizeErrorMessage } from '../utils/sanitizer.js';
+export class ToolAuditLogger {
+    options;
+    logs = [];
+    callPhaseIndex = new Map();
+    authorizationSummary = {
+        auto: 0,
+        allowlist: 0,
+        user: 0,
+        cache: 0,
+        cli: 0,
+        hook: 0,
+    };
+    constructor(options) {
+        this.options = options;
+    }
+    onStart(call, spec, decision) {
+        this.callPhaseIndex.set(call.id, call.phase);
+        const entry = {
+            timestamp: new Date().toISOString(),
+            eventType: 'start',
+            callId: call.id,
+            phase: call.phase,
+            toolName: spec.name,
+            inputSummary: this.summarize(call.args),
+            decision,
+        };
+        this.logs.push(entry);
+        getLogger().debug(text.audit.event('Start', spec.name, decision.allowed ? 'allowed' : 'denied'));
+    }
+    onEnd(result) {
+        const phase = (result.id && this.callPhaseIndex.get(result.id)) ||
+            result.error?.failurePhase ||
+            Phase.CONTEXT;
+        const entry = {
+            timestamp: new Date().toISOString(),
+            eventType: 'end',
+            callId: result.id,
+            phase,
+            toolName: result.toolName,
+            status: result.status,
+            durationMs: result.durationMs,
+            outputSummary: result.outputSummary ?? result.summary,
+            error: result.error?.code,
+            errorMessage: result.error?.message ? sanitizeErrorMessage(result.error.message) : undefined,
+        };
+        this.logs.push(entry);
+        getLogger().debug(text.audit.event('End', result.toolName, result.status));
+        if (result.id) {
+            this.callPhaseIndex.delete(result.id);
+        }
+    }
+    onAuthorization(event) {
+        const entry = {
+            timestamp: new Date().toISOString(),
+            eventType: 'authorization',
+            callId: event.callId,
+            phase: event.phase,
+            toolName: event.toolName,
+            authOutcome: event.outcome,
+            authReason: event.reason,
+            authSource: event.source,
+            authRiskLevel: event.riskLevel,
+            authSideEffects: event.sideEffects,
+            authTtlMs: event.ttlMs,
+            authPersist: event.persist,
+        };
+        this.logs.push(entry);
+        getLogger().debug(text.audit.event('Authorization', event.toolName, event.outcome));
+        this.options?.onAuthorizationDecision?.(event);
+        const updated = this.updateAuthorizationSummary(event.source);
+        if (updated && this.options?.onAuthorizationSummary) {
+            this.options.onAuthorizationSummary({ ...this.authorizationSummary }, event);
+        }
+    }
+    /**
+     * Receives fine-grained backend events (start, ok, fail) for auditing.
+     */
+    onEvent(event) {
+        // For now, we just push them into the logs as a generic entry or log to debug
+        // In the future, this can be structured into a separate backend-attempts table
+        this.logs.push({
+            timestamp: new Date().toISOString(),
+            eventType: 'start', // Placeholder
+            callId: 'backend-event',
+            phase: event.phase || Phase.CONTEXT,
+            toolName: event.backendId || 'unknown-backend',
+            error: event.code,
+            outputSummary: `Backend event: ${JSON.stringify(event)}`,
+        });
+    }
+    getLogs() {
+        return this.logs;
+    }
+    getAuthorizationSummary() {
+        return { ...this.authorizationSummary };
+    }
+    summarize(data) {
+        try {
+            const str = JSON.stringify(data);
+            return str.length > 200 ? str.substring(0, 200) + '...' : str;
+        }
+        catch {
+            return '[Circular/Unserializable]';
+        }
+    }
+    updateAuthorizationSummary(source) {
+        if (!source)
+            return false;
+        if (source === 'auto') {
+            this.authorizationSummary.auto += 1;
+            return true;
+        }
+        if (source === 'allowlist') {
+            this.authorizationSummary.allowlist += 1;
+            return true;
+        }
+        if (source === 'user') {
+            this.authorizationSummary.user += 1;
+            return true;
+        }
+        if (source === 'cache') {
+            this.authorizationSummary.cache += 1;
+            return true;
+        }
+        if (source === 'cli') {
+            this.authorizationSummary.cli += 1;
+            return true;
+        }
+        if (source === 'hook') {
+            this.authorizationSummary.hook += 1;
+            return true;
+        }
+        return false;
+    }
+}
+//# sourceMappingURL=audit.js.map

package/dist/core/tools/authorization/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/core/tools/budget.js

@@ -0,0 +1,118 @@
+/**
+ * Default budget limits to ensure system stability.
+ */
+export const DEFAULT_BUDGET_CONFIG = {
+    maxConcurrentByRisk: {
+        low: 10, // High parallelism for search tools
+        medium: 3, // Controlled parallelism for MCP/External tools
+        high: 1, // Zero-concurrency for mutations (Git, Write, etc.)
+    },
+    maxCallsPerPhase: 50,
+};
+export class BudgetGuard {
+    activeCallsByRisk = {
+        low: 0,
+        medium: 0,
+        high: 0,
+    };
+    callCounts = new Map();
+    config;
+    /**
+     * @param partialConfig User provided configuration to override defaults.
+     */
+    constructor(partialConfig = {}) {
+        // Merge provided config with defaults
+        this.config = {
+            ...DEFAULT_BUDGET_CONFIG,
+            ...partialConfig,
+            maxConcurrentByRisk: {
+                ...DEFAULT_BUDGET_CONFIG.maxConcurrentByRisk,
+                ...(partialConfig.maxConcurrentByRisk || {}),
+            },
+        };
+    }
+    /**
+     * Updates the budget configuration at runtime.
+     * Useful for dynamic load balancing or user-driven adjustments.
+     */
+    updateConfig(newConfig) {
+        this.config = {
+            ...this.config,
+            ...newConfig,
+            maxConcurrentByRisk: {
+                ...this.config.maxConcurrentByRisk,
+                ...(newConfig.maxConcurrentByRisk || {}),
+            },
+        };
+    }
+    async runWithGuards(params) {
+        // 1. Concurrency Check by Risk Level
+        const currentRiskActive = this.activeCallsByRisk[params.riskLevel];
+        const maxRiskAllowed = this.config.maxConcurrentByRisk[params.riskLevel];
+        if (currentRiskActive >= maxRiskAllowed) {
+            throw {
+                code: 'BUDGET_CONCURRENCY',
+                message: `Too many concurrent ${params.riskLevel}-risk tool calls (limit: ${maxRiskAllowed})`,
+            };
+        }
+        // 2. Rate Limit / Count Check per Phase
+        const currentCount = this.callCounts.get(params.phase) || 0;
+        if (currentCount >= this.config.maxCallsPerPhase) {
+            throw {
+                code: 'BUDGET_RATE_LIMIT',
+                message: `Too many tool calls in phase ${params.phase}`,
+            };
+        }
+        this.activeCallsByRisk[params.riskLevel]++;
+        this.callCounts.set(params.phase, currentCount + 1);
+        try {
+            // 3. Timeout Wrapper
+            const result = await this.runWithTimeout(params.fn, params.timeoutMs);
+            // 4. Output Size Check (Preliminary)
+            const size = this.estimateSize(result);
+            if (size > params.maxOutputBytes) {
+                throw {
+                    code: 'OUTPUT_TOO_LARGE',
+                    message: `Output size ${size} bytes exceeds limit of ${params.maxOutputBytes}`,
+                };
+            }
+            return result;
+        }
+        finally {
+            this.activeCallsByRisk[params.riskLevel]--;
+        }
+    }
+    resetCounts() {
+        this.callCounts.clear();
+    }
+    async runWithTimeout(fn, timeoutMs) {
+        let timer;
+        const timeoutPromise = new Promise((_, reject) => {
+            timer = setTimeout(() => {
+                reject({ code: 'TIMEOUT', message: `Tool execution timed out after ${timeoutMs}ms` });
+            }, timeoutMs);
+        });
+        try {
+            return await Promise.race([fn(), timeoutPromise]);
+        }
+        finally {
+            clearTimeout(timer);
+        }
+    }
+    estimateSize(obj) {
+        if (obj === undefined || obj === null)
+            return 0;
+        if (typeof obj === 'string')
+            return obj.length; // UTF-16 approximation
+        if (Buffer.isBuffer(obj))
+            return obj.length;
+        try {
+            // This is expensive for large objects, but safe for checking limits
+            return JSON.stringify(obj).length;
+        }
+        catch {
+            return 0; // Circular structure or otherwise un-stringifiable
+        }
+    }
+}
+//# sourceMappingURL=budget.js.map

package/dist/core/tools/builtin/artifact.js

@@ -0,0 +1,29 @@
+import { z } from 'zod';
+import { text } from '../../../locales/index.js';
+import { ArtifactStore } from '../../sub-agent/artifacts/store.js';
+import { Phase } from '../../types/runtime.js';
+export const artifactReadSpec = {
+    name: 'artifact.read',
+    source: 'builtin',
+    intent: 'READ',
+    description: text.tools.artifactReadDescription,
+    riskLevel: 'low',
+    sideEffects: ['fs_read'],
+    concurrency: 'parallel_ok',
+    inputSchema: z.object({
+        handle: z.string().describe('Artifact handle returned by salmonloop (s8p namespace)'),
+    }),
+    outputSchema: z.object({
+        content: z.string(),
+        size: z.number(),
+    }),
+    allowedPhases: [Phase.CONTEXT, Phase.PLAN, Phase.PATCH, Phase.SHRINK],
+};
+export async function executeArtifactRead(input, _ctx) {
+    const result = await ArtifactStore.readText(input.handle);
+    if (!result.ok) {
+        throw new Error(text.tools.artifactNotFound(input.handle));
+    }
+    return { content: result.content, size: result.size };
+}
+//# sourceMappingURL=artifact.js.map

package/dist/core/tools/builtin/ast-grep.js

@@ -0,0 +1,107 @@
+import { z } from 'zod';
+import { spawnCommand } from '../../runtime/process-runner.js';
+import { Phase } from '../../types/runtime.js';
+import { processResource } from '../parallel/resource-helpers.js';
+const LANGUAGE_DESCRIPTION = 'Source language plugin id (e.g., "typescript", "tsx", "javascript"). If omitted, ast-grep will auto-detect.';
+/**
+ * Spec for the ast-grep structural search tool.
+ */
+export const astGrepSpec = {
+    name: 'code.search_ast',
+    source: 'builtin',
+    intent: 'SEARCH',
+    description: 'Structural search using ast-grep (sg). Use $VAR for placeholders (e.g., "console.log($ARGS)").',
+    riskLevel: 'low',
+    sideEffects: ['process'],
+    concurrency: 'mutex_by_resource',
+    computeResources: (_input, ctx) => [processResource(ctx)],
+    inputSchema: z.object({
+        pattern: z.string().describe('ast-grep pattern to search for'),
+        paths: z.array(z.string()).optional().describe('Scope search to specific files or directories'),
+        language: z.string().optional().describe(LANGUAGE_DESCRIPTION),
+    }),
+    outputSchema: z.object({
+        matches: z.array(z.object({
+            file: z.string(),
+            line: z.number(),
+            content: z.string(),
+            replacement: z.string().optional(),
+        })),
+        error: z.string().optional(),
+    }),
+    allowedPhases: [Phase.CONTEXT, Phase.EXPLORE, Phase.PLAN],
+};
+/**
+ * Executes the ast-grep search.
+ */
+export async function executeAstGrep(input, ctx) {
+    try {
+        const args = ['run', '--pattern', input.pattern, '--json'];
+        if (input.language) {
+            args.push('--lang', input.language);
+        }
+        const targetPaths = input.paths?.length ? input.paths : ['.'];
+        const allArgs = [...args, ...targetPaths];
+        const maxOutputBytes = 1024 * 1024 * 5;
+        let stdout = '';
+        let stderr = '';
+        let stdoutBytes = 0;
+        const result = await spawnCommand({
+            command: 'sg',
+            args: allArgs,
+            cwd: ctx.worktreeRoot || ctx.repoRoot,
+            env: ctx.env ? { ...process.env, ...ctx.env } : process.env,
+            timeoutMs: 30_000,
+            signal: ctx.signal,
+            onStdoutChunk: (chunk) => {
+                if (stdoutBytes >= maxOutputBytes)
+                    return;
+                const buffer = Buffer.from(chunk);
+                const remaining = maxOutputBytes - stdoutBytes;
+                if (buffer.length <= remaining) {
+                    stdout += buffer.toString();
+                    stdoutBytes += buffer.length;
+                    return;
+                }
+                stdout += buffer.subarray(0, remaining).toString();
+                stdoutBytes += remaining;
+            },
+            onStderrChunk: (chunk) => {
+                stderr += Buffer.from(chunk).toString();
+            },
+        });
+        if (result.error) {
+            return {
+                matches: [],
+                error: result.error.message.includes('not found')
+                    ? 'ast-grep (sg) is not installed in the environment'
+                    : result.error.message,
+            };
+        }
+        if (result.timedOut) {
+            return {
+                matches: [],
+                error: 'ast-grep execution timed out',
+            };
+        }
+        if (stderr && !stdout && result.code !== 1) {
+            return { matches: [], error: stderr };
+        }
+        const rawMatches = JSON.parse(stdout || '[]');
+        // Transform sg JSON output to our standardized format
+        const matches = rawMatches.map((m) => ({
+            file: m.file,
+            line: m.range.start.line + 1, // sg is 0-indexed
+            content: m.lines,
+            replacement: m.replacement,
+        }));
+        return { matches };
+    }
+    catch (e) {
+        return {
+            matches: [],
+            error: e instanceof Error ? e.message : String(e),
+        };
+    }
+}
+//# sourceMappingURL=ast-grep.js.map

package/dist/core/tools/builtin/ast.js

@@ -0,0 +1,62 @@
+import { join } from 'path';
+import { z } from 'zod';
+import { text } from '../../../locales/index.js';
+import { readFile } from '../../adapters/fs/node-fs.js';
+import { AstParser } from '../../ast/parser.js';
+import { tryGetPluginRegistry } from '../../plugin/registry.js';
+import { Phase } from '../../types/runtime.js';
+import { pathPrefixResource } from '../parallel/resource-helpers.js';
+export const astDefsRefsSpec = {
+    name: 'code.ast',
+    source: 'builtin',
+    intent: 'SEARCH',
+    description: text.tools.codeAstDescription,
+    riskLevel: 'low',
+    sideEffects: ['fs_read'],
+    concurrency: 'parallel_ok',
+    computeResources: (input, ctx) => [pathPrefixResource(ctx, input.file)],
+    inputSchema: z.object({
+        file: z.string().describe('Relative path to the file to analyze'),
+        symbol: z.string().optional().describe('Filter by specific symbol name'),
+    }),
+    outputSchema: z.object({
+        definitions: z.array(z.object({
+            name: z.string(),
+            location: z.any(),
+        })),
+        references: z.array(z.object({
+            name: z.string(),
+            location: z.any(),
+        })),
+    }),
+    allowedPhases: [Phase.CONTEXT, Phase.EXPLORE, Phase.PLAN],
+};
+/**
+ * Builtin tool to query AST definitions and references
+ */
+export async function executeAstDefsRefs(input, ctx) {
+    const fullPath = join(ctx.worktreeRoot || ctx.repoRoot, input.file);
+    const code = await readFile(fullPath, 'utf-8');
+    const registry = ctx.languagePlugins ?? tryGetPluginRegistry();
+    const lang = registry?.getByExtension(input.file)?.meta.id;
+    if (!lang) {
+        return { definitions: [], references: [] };
+    }
+    const tree = await AstParser.parse(code, lang);
+    try {
+        let defs = await AstParser.identifyDefinitions(tree, lang);
+        let refs = await AstParser.identifyReferences(tree, lang);
+        if (input.symbol) {
+            defs = defs.filter((d) => d.name === input.symbol);
+            refs = refs.filter((r) => r.name === input.symbol);
+        }
+        return {
+            definitions: defs.map((d) => ({ name: d.name, location: d.location })),
+            references: refs.map((r) => ({ name: r.name, location: r.location })),
+        };
+    }
+    finally {
+        // Tree deletion is handled by AstParser's cache cleanup logic or explicit delete if needed
+    }
+}
+//# sourceMappingURL=ast.js.map

package/dist/core/tools/builtin/code-search/backends/powershell.js

@@ -0,0 +1,84 @@
+import { LIMITS } from '../../../../config/limits.js';
+import { parsePlainMatches } from '../parse/plain-grep.js';
+export const psBackend = {
+    id: 'powershell',
+    async isCompatible(ctx) {
+        // Only compatible on Windows
+        if (ctx.platform !== 'win32')
+            return false;
+        try {
+            const res = await ctx.runner.execFile('powershell', ['-NoProfile', '-Command', '$PSVersionTable.PSVersion.Major'], {
+                timeoutMs: 1500,
+            });
+            return res.exitCode === 0;
+        }
+        catch {
+            return false;
+        }
+    },
+    async run(input, ctx) {
+        const cwd = input.cwd ?? ctx.repoRoot;
+        const glob = input.glob ?? '*.*';
+        // Build the PowerShell command using single-quote escaping for robustness
+        // PowerShell escapes single quotes by doubling them: ' -> ''
+        const safePattern = input.pattern.replace(/'/g, "''");
+        const safeGlob = glob.replace(/'/g, "''");
+        const matchMode = input.isRegex ? '' : '-SimpleMatch';
+        // Using -LiteralPath for Get-ChildItem to avoid glob issues if not intended,
+        // but here we actually want the glob for -Filter.
+        // We use ,($_) to ensure ConvertTo-Json always outputs an array even for a single result.
+        const command = `Get-ChildItem -Recurse -File -Filter '${safeGlob}' | Select-String -Pattern '${safePattern}' ${matchMode} | Select-Object Path, LineNumber, Line | ForEach-Object { ,$_ } | ConvertTo-Json -Compress`;
+        const res = await ctx.runner.execFile('powershell', ['-NoProfile', '-Command', command], {
+            cwd,
+            timeoutMs: ctx.limits.timeoutMs,
+            maxStdoutBytes: ctx.limits.maxOutputBytes,
+        });
+        if (res.timedOut) {
+            return {
+                ok: false,
+                code: 'TIMEOUT',
+                message: 'powershell execution timed out',
+                retryable: true,
+            };
+        }
+        if (res.exitCode !== 0) {
+            return {
+                ok: false,
+                code: 'NONZERO_EXIT',
+                message: `powershell exited with code ${res.exitCode}: ${res.stderr}`,
+                retryable: true,
+            };
+        }
+        try {
+            const { matches, truncated } = parsePlainMatches(res.stdout, {
+                format: 'ps-json',
+                maxMatches: input.maxMatches ?? LIMITS.defaultSearchMatches,
+            });
+            // Normalize paths to be relative to repoRoot
+            const normalizedMatches = matches.map((m) => ({
+                ...m,
+                file: m.file.startsWith(ctx.repoRoot)
+                    ? m.file.substring(ctx.repoRoot.length).replace(/^[\\/]/, '')
+                    : m.file,
+            }));
+            return {
+                ok: true,
+                output: {
+                    matches: normalizedMatches,
+                    truncated,
+                    backend: 'powershell',
+                    stats: { hits: normalizedMatches.length },
+                },
+            };
+        }
+        catch (err) {
+            return {
+                ok: false,
+                code: 'RUNTIME_ERROR',
+                message: `Failed to parse powershell output: ${err instanceof Error ? err.message : String(err)}`,
+                retryable: true,
+            };
+        }
+    },
+};
+//# sourceMappingURL=powershell.js.map