salmon-loop 0.2.3

package/dist/core/tools/streaming/ToolCallAccumulator.js

@@ -0,0 +1,64 @@
+function isRecord(value) {
+    return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}
+function mergeToolCall(prev, next) {
+    if (!isRecord(next))
+        return prev ?? next;
+    if (!isRecord(prev))
+        return next;
+    const prevFn = isRecord(prev.function) ? prev.function : null;
+    const nextFn = isRecord(next.function) ? next.function : null;
+    const mergedFn = {};
+    if (prevFn)
+        Object.assign(mergedFn, prevFn);
+    if (nextFn)
+        Object.assign(mergedFn, nextFn);
+    const merged = { ...prev, ...next };
+    if (prevFn || nextFn)
+        merged.function = mergedFn;
+    return merged;
+}
+export class ToolCallAccumulator {
+    orderedIds = [];
+    byId = new Map();
+    unkeyed = [];
+    append(chunk) {
+        if (!chunk?.tool_calls || !Array.isArray(chunk.tool_calls)) {
+            return;
+        }
+        for (const call of chunk.tool_calls) {
+            if (!isRecord(call)) {
+                this.unkeyed.push(call);
+                continue;
+            }
+            const id = typeof call.id === 'string' ? call.id : null;
+            if (!id) {
+                this.unkeyed.push(call);
+                continue;
+            }
+            const existing = this.byId.get(id);
+            if (!existing)
+                this.orderedIds.push(id);
+            this.byId.set(id, mergeToolCall(existing, call));
+        }
+    }
+    drain() {
+        if (this.byId.size === 0 && this.unkeyed.length === 0)
+            return [];
+        const out = [];
+        for (const id of this.orderedIds) {
+            const call = this.byId.get(id);
+            if (call)
+                out.push(call);
+        }
+        out.push(...this.unkeyed);
+        this.orderedIds.length = 0;
+        this.byId.clear();
+        this.unkeyed.length = 0;
+        return out;
+    }
+    hasAccumulated() {
+        return this.byId.size > 0 || this.unkeyed.length > 0;
+    }
+}
+//# sourceMappingURL=ToolCallAccumulator.js.map

package/dist/core/tools/types.js

@@ -0,0 +1,2 @@
+export const TOOL_INTENTS = ['READ', 'SEARCH', 'LIST', 'WRITE', 'INFRA', 'AGENT'];
+//# sourceMappingURL=types.js.map

package/dist/core/types/authorization.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=authorization.js.map

package/dist/core/types/context.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=context.js.map

package/dist/core/types/errors.js

@@ -0,0 +1,29 @@
+export class SalmonError extends Error {
+    code;
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = this.constructor.name;
+    }
+}
+export class GitError extends SalmonError {
+    command;
+    stderr;
+    constructor(message, command, stderr) {
+        const fullMessage = stderr ? `${message}\nStderr: ${stderr}` : message;
+        super(fullMessage, 'GIT_ERROR');
+        this.command = command;
+        this.stderr = stderr;
+    }
+}
+export class DiffValidationError extends SalmonError {
+    constructor(message) {
+        super(message, 'DIFF_VALIDATION_FAILED');
+    }
+}
+export class PatchNotApplicableError extends SalmonError {
+    constructor(message) {
+        super(message, 'PATCH_NOT_APPLICABLE');
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/core/types/execution.js

@@ -0,0 +1,65 @@
+/**
+ * Single Source of Truth (SSOT) for Execution Phases.
+ *
+ * EXECUTION_PHASES (Array):
+ * - Used for runtime iteration (e.g., CLI progress bars, validation loops).
+ * - Ensures order and completeness.
+ */
+export const EXECUTION_PHASES = [
+    'PREFLIGHT',
+    'PREPARE_DEPS',
+    'CONTEXT',
+    'EXPLORE',
+    'RESEARCH',
+    'PLAN',
+    'PATCH',
+    'VALIDATE',
+    'AST_VALIDATE',
+    'APPLY',
+    'VERIFY',
+    'ROLLBACK',
+    'SHRINK',
+    'APPLY_BACK',
+];
+/**
+ * Phase (Object):
+ * - Used for value access in code logic (e.g., `if (phase === Phase.PLAN)`).
+ * - Eliminates "magic strings" and allows easy refactoring/renaming.
+ */
+export const Phase = {
+    // SLASH is an out-of-band interactive phase used for adapter-level slash routing and skill expansion.
+    // It is intentionally excluded from EXECUTION_PHASES to avoid impacting the main SalmonLoop flow.
+    SLASH: 'SLASH',
+    PREFLIGHT: 'PREFLIGHT',
+    PREPARE_DEPS: 'PREPARE_DEPS',
+    CONTEXT: 'CONTEXT',
+    EXPLORE: 'EXPLORE',
+    RESEARCH: 'RESEARCH',
+    PLAN: 'PLAN',
+    PATCH: 'PATCH',
+    VALIDATE: 'VALIDATE',
+    AST_VALIDATE: 'AST_VALIDATE',
+    APPLY: 'APPLY',
+    VERIFY: 'VERIFY',
+    ROLLBACK: 'ROLLBACK',
+    SHRINK: 'SHRINK',
+    APPLY_BACK: 'APPLY_BACK',
+};
+export const ALL_VISIBLE_STEPS = [
+    ...EXECUTION_PHASES,
+    'REVIEW',
+    'REPORT',
+    'ANALYZE_ISSUES',
+];
+export var ErrorType;
+(function (ErrorType) {
+    ErrorType["COMPILATION"] = "compilation";
+    ErrorType["LINT"] = "lint";
+    ErrorType["TEST"] = "test";
+    ErrorType["LOGIC"] = "logic";
+    ErrorType["DEPENDENCY_ERROR"] = "dependency_error";
+    ErrorType["RESOURCE_LOCK_ERROR"] = "resource_lock_error";
+    ErrorType["AST_VALIDATION_ERROR"] = "ast_validation_error";
+    ErrorType["UNKNOWN"] = "unknown";
+})(ErrorType || (ErrorType = {}));
+//# sourceMappingURL=execution.js.map

package/dist/core/types/index.js

@@ -0,0 +1,9 @@
+export * from './context.js';
+export * from './errors.js';
+export * from './execution.js';
+export * from './llm.js';
+export * from './loop.js';
+export * from './planning.js';
+export * from './authorization.js';
+export * from './usage.js';
+//# sourceMappingURL=index.js.map

package/dist/core/types/llm.js

@@ -0,0 +1,9 @@
+export const LLM_OUTPUT_KINDS = [
+    'review',
+    'assistant_message',
+    'explore',
+    'research',
+    'plan',
+    'patch',
+];
+//# sourceMappingURL=llm.js.map

package/dist/core/types/loop.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=loop.js.map

package/dist/core/types/planning.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=planning.js.map

package/dist/core/types/runtime.js

@@ -0,0 +1,2 @@
+export { ALL_VISIBLE_STEPS, ErrorType, EXECUTION_PHASES, Phase, } from './execution.js';
+//# sourceMappingURL=runtime.js.map

package/dist/core/types/usage.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=usage.js.map

package/dist/core/ui/kaomoji.js

@@ -0,0 +1,5 @@
+export const KAOMOJI = {
+    cleanupWorking: '(,,-`_●-)',
+    cleanupDone: '(,,•﹏•,,)',
+};
+//# sourceMappingURL=kaomoji.js.map

package/dist/core/utils/path.js

@@ -0,0 +1,116 @@
+import path from 'path';
+function isWindowsAbsolutePath(p) {
+    // Drive letter, e.g. "C:\\" or "C:/"
+    if (/^[a-zA-Z]:[\\/]/.test(p))
+        return true;
+    // UNC path, e.g. "\\\\server\\share"
+    if (p.startsWith('\\\\'))
+        return true;
+    return false;
+}
+function shouldUseWin32PathSemantics(p) {
+    if (!p)
+        return false;
+    if (isWindowsAbsolutePath(p))
+        return true;
+    // Heuristic: treat backslash-containing paths as Windows-like, even if relative.
+    // This enables correct behavior for inputs like "src\\components\\file.ts" on POSIX.
+    return p.includes('\\');
+}
+/**
+ * Normalize a path to use forward slashes, regardless of the operating system.
+ * This ensures consistency across Windows and Linux/macOS.
+ */
+export function normalizePath(p) {
+    const replaced = p.replace(/\\/g, '/');
+    // Collapse duplicate separators for repo-relative paths like "src\\index.js".
+    // Preserve UNC-style prefix ("//server/share") by keeping the leading double slash.
+    if (replaced.startsWith('//')) {
+        return `//${replaced.slice(2).replace(/\/{2,}/g, '/')}`;
+    }
+    return replaced.replace(/\/{2,}/g, '/');
+}
+/**
+ * Join path segments and normalize the result to use forward slashes.
+ */
+export function safeJoin(...paths) {
+    return normalizePath(path.join(...paths));
+}
+/**
+ * Resolve path segments and normalize the result to use forward slashes.
+ */
+export function safeResolve(...paths) {
+    return normalizePath(path.resolve(...paths));
+}
+/**
+ * Get the directory name of a path and normalize it.
+ */
+export function safeDirname(p) {
+    const normalized = normalizePath(p);
+    const impl = shouldUseWin32PathSemantics(p) ? path.win32 : path.posix;
+    return normalizePath(impl.dirname(normalized));
+}
+/**
+ * Get the relative path from one path to another and normalize it.
+ */
+export function safeRelative(from, to) {
+    return normalizePath(path.relative(from, to));
+}
+/**
+ * Check whether a path is a safe relative path (no absolute paths or traversal).
+ */
+export function isSafeRelativePath(p) {
+    const normalized = normalizePath(p);
+    if (!normalized)
+        return false;
+    if (normalized.startsWith('/'))
+        return false;
+    if (/^[a-zA-Z]:/.test(normalized))
+        return false;
+    return !normalized.split('/').some((segment) => segment === '..');
+}
+/**
+ * Ensures a path is safely contained within a root directory.
+ * Throws a security violation if the path escapes the sandbox.
+ */
+export function ensureInSandbox(root, target) {
+    const normalizedRoot = normalizePath(root);
+    const normalizedTarget = normalizePath(target);
+    const impl = isWindowsAbsolutePath(normalizedRoot) ? path.win32 : path.posix;
+    if (impl === path.posix && isWindowsAbsolutePath(normalizedTarget)) {
+        throw new Error(`Security Violation: Path traversal attempt: ${target} is outside of ${root}`);
+    }
+    if (impl === path.win32 && normalizedTarget.startsWith('/')) {
+        throw new Error(`Security Violation: Path traversal attempt: ${target} is outside of ${root}`);
+    }
+    const resolvedRoot = impl.resolve(normalizedRoot);
+    const resolvedTarget = impl.resolve(normalizedTarget);
+    if (!isPathWithinDirectory(resolvedRoot, resolvedTarget, { allowEqual: true })) {
+        throw new Error(`Security Violation: Path traversal attempt: ${target} is outside of ${root}`);
+    }
+    return normalizePath(resolvedTarget);
+}
+/**
+ * Check whether a target path is located within a root directory.
+ * Uses resolved absolute paths and path.relative to avoid prefix-match pitfalls.
+ */
+export function isPathWithinDirectory(root, target, options = {}) {
+    const { allowEqual = true } = options;
+    const normalizedRoot = normalizePath(root);
+    const normalizedTarget = normalizePath(target);
+    const impl = isWindowsAbsolutePath(normalizedRoot) || shouldUseWin32PathSemantics(normalizedTarget)
+        ? path.win32
+        : path.posix;
+    if (impl === path.posix && isWindowsAbsolutePath(normalizedTarget))
+        return false;
+    if (impl === path.win32 && normalizedTarget.startsWith('/'))
+        return false;
+    const resolvedRoot = impl.resolve(normalizedRoot);
+    const resolvedTarget = impl.resolve(normalizedTarget);
+    const rel = impl.relative(resolvedRoot, resolvedTarget);
+    const relNormalized = normalizePath(rel);
+    if (relNormalized === '')
+        return allowEqual;
+    return !relNormalized.startsWith('..') && !impl.isAbsolute(rel);
+}
+//# sourceMappingURL=path.js.map

package/dist/core/utils/platform-shell.js

@@ -0,0 +1,10 @@
+export function getPlatformShellInvocation(command) {
+    if (process.platform === 'win32') {
+        const file = process.env.ComSpec || 'cmd.exe';
+        return { file, args: ['/d', '/s', '/c', command] };
+    }
+    // Match Node.js child_process default as closely as possible.
+    // See: child_process spawn/exec `shell: true` behavior on POSIX.
+    return { file: '/bin/sh', args: ['-c', command] };
+}
+//# sourceMappingURL=platform-shell.js.map

package/dist/core/utils/sanitizer.js

@@ -0,0 +1,107 @@
+/**
+ * Sanitizes any error input (object, string, or mixed) to prevent leakage
+ * of sensitive technical data like Zod dumps or stack traces.
+ */
+export function sanitizeErrorMessage(err) {
+    if (!err)
+        return 'Unknown error';
+    // 1. Force convert to string to analyze content regardless of object structure
+    let msg = '';
+    try {
+        msg = err instanceof Error ? err.message : typeof err === 'string' ? err : JSON.stringify(err);
+    }
+    catch {
+        msg = String(err);
+    }
+    // 2. Strict Whitelist Detection
+    // Only allow very short, non-technical, localized-style or user-initiated strings
+    const isSafeText = msg.length < 100 &&
+        !msg.includes('error') &&
+        !msg.includes('Error') &&
+        !msg.includes('failed') &&
+        !msg.includes('Exception') &&
+        !msg.includes(':') &&
+        !msg.includes('{') &&
+        !msg.includes('/') &&
+        !msg.includes('Unavailable') &&
+        !msg.includes('Not Found') &&
+        !/at\s+.*:\d+:\d+/.test(msg);
+    const isKnownSafe = [
+        'User aborted the operation',
+        'Operation cancelled',
+        'Request timed out',
+    ].includes(msg);
+    // 3. The Strict Block Rule
+    if (!(isSafeText || isKnownSafe) || msg.length > 500) {
+        return 'ERR_TECHNICAL_DETAILS_HIDDEN';
+    }
+    return msg;
+}
+/**
+ * Deeply sanitizes an object to remove sensitive technical data from any nested property.
+ * Uses Reflect.ownKeys to catch non-enumerable properties and symbols.
+ * Includes a recursion depth limit to prevent stack overflow on extremely deep objects.
+ */
+const MAX_DEPTH = 5;
+export function sanitizeObject(obj, maxDepth = MAX_DEPTH, depth = 0) {
+    if (depth >= maxDepth)
+        return '[DEPTH_EXCEEDED]';
+    if (!obj || typeof obj !== 'object' || obj === null)
+        return obj;
+    if (Array.isArray(obj)) {
+        return obj.map((item) => sanitizeObject(item, maxDepth, depth + 1));
+    }
+    const result = {};
+    const keys = Reflect.ownKeys(obj);
+    for (const key of keys) {
+        const value = obj[key];
+        const keyStr = String(key);
+        // High risk fields that definitely need string-level sanitization
+        if (['responseBody', 'providerMessage', 'message', 'causeMessage', 'details', 'data'].includes(keyStr)) {
+            if (typeof value === 'string') {
+                result[key] = sanitizeErrorMessage(value);
+            }
+            else if (typeof value === 'object' && value !== null) {
+                result[key] = sanitizeObject(value, maxDepth, depth + 1);
+            }
+            else {
+                result[key] = value;
+            }
+            continue;
+        }
+        // Blacklisted fields that contain raw request/response data that should be completely hidden
+        if ([
+            'requestBodyValues',
+            'requestBody',
+            'headers',
+            'responseHeaders',
+            'request',
+            'stack',
+            'url',
+        ].includes(keyStr)) {
+            result[key] = '[HIDDEN FOR SECURITY]';
+            continue;
+        }
+        if (typeof value === 'object' && value !== null) {
+            // Avoid circular references for safety during deep recursion
+            try {
+                result[key] = sanitizeObject(value, maxDepth, depth + 1);
+            }
+            catch {
+                result[key] = '[CIRCULAR]';
+            }
+        }
+        else {
+            result[key] = value;
+        }
+    }
+    return result;
+}
+/**
+ * Normalizes text while preserving essential characters like hyphens and underscores.
+ * Fixed: Removed aggressive [^\w\s] replacement that was causing character loss.
+ */
+export function normalizeContent(text) {
+    return text.trim();
+}
+//# sourceMappingURL=sanitizer.js.map