selftune 0.1.4 → 0.2.1

package/cli/selftune/contribute/contribute.ts

@@ -0,0 +1,214 @@
+#!/usr/bin/env bun
+/**
+ * selftune contribute — opt-in export of anonymized skill observability data.
+ *
+ * Usage:
+ *   bun run cli/selftune/contribute/contribute.ts --skill selftune [--preview] [--output file.json]
+ *   bun run cli/selftune/contribute/contribute.ts --skill selftune --submit
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { parseArgs } from "node:util";
+import { CONTRIBUTIONS_DIR } from "../constants.js";
+import { assembleBundle } from "./bundle.js";
+import { sanitizeBundle } from "./sanitize.js";
+
+// ---------------------------------------------------------------------------
+// CLI
+// ---------------------------------------------------------------------------
+
+export async function cliMain(): Promise<void> {
+  const { values } = parseArgs({
+    options: {
+      skill: { type: "string", default: "selftune" },
+      output: { type: "string" },
+      preview: { type: "boolean", default: false },
+      sanitize: { type: "string", default: "conservative" },
+      since: { type: "string" },
+      submit: { type: "boolean", default: false },
+      endpoint: { type: "string", default: "https://selftune-api.fly.dev" },
+      github: { type: "boolean", default: false },
+    },
+    strict: true,
+  });
+
+  const skillName = values.skill ?? "selftune";
+  const sanitizationLevel = values.sanitize === "aggressive" ? "aggressive" : "conservative";
+
+  let since: Date | undefined;
+  if (values.since) {
+    since = new Date(values.since);
+    if (Number.isNaN(since.getTime())) {
+      console.error(
+        `Error: Invalid --since date: "${values.since}". Use a valid date format (e.g., 2026-01-01).`,
+      );
+      process.exit(1);
+    }
+  }
+
+  // 1. Assemble raw bundle
+  const rawBundle = assembleBundle({
+    skillName,
+    since,
+    sanitizationLevel,
+  });
+
+  // 2. Sanitize
+  const bundle = sanitizeBundle(rawBundle, sanitizationLevel, skillName);
+
+  // 3. Preview mode
+  if (values.preview) {
+    console.log(JSON.stringify(bundle, null, 2));
+    return;
+  }
+
+  // 4. Determine output path
+  const timestamp = new Date().toISOString().replace(/[:.]/g, "-");
+  const defaultPath = `${CONTRIBUTIONS_DIR}/selftune-contribution-${timestamp}.json`;
+  const outputPath = values.output ?? defaultPath;
+
+  // Ensure parent directory exists
+  const dir = outputPath.substring(0, outputPath.lastIndexOf("/"));
+  if (dir && !existsSync(dir)) {
+    mkdirSync(dir, { recursive: true });
+  }
+
+  // 5. Write
+  const json = JSON.stringify(bundle, null, 2);
+  writeFileSync(outputPath, json, "utf-8");
+
+  // 6. Summary
+  console.log(`Contribution bundle written to: ${outputPath}`);
+  console.log(`  Queries:       ${bundle.positive_queries.length}`);
+  console.log(`  Eval entries:  ${bundle.eval_entries.length}`);
+  console.log(`  Sessions:      ${bundle.session_metrics.total_sessions}`);
+  console.log(`  Sanitization:  ${sanitizationLevel}`);
+  if (bundle.grading_summary) {
+    console.log(
+      `  Grading:       ${bundle.grading_summary.graded_sessions} sessions, ${(bundle.grading_summary.average_pass_rate * 100).toFixed(1)}% avg pass rate`,
+    );
+  }
+  if (bundle.evolution_summary) {
+    console.log(
+      `  Evolution:     ${bundle.evolution_summary.total_proposals} proposals, ${bundle.evolution_summary.deployed_proposals} deployed`,
+    );
+  }
+
+  // 7. Submit
+  if (values.submit) {
+    if (values.github) {
+      const ok = submitToGitHub(json, outputPath);
+      if (!ok) process.exit(1);
+    } else {
+      const endpoint = values.endpoint ?? "https://selftune-api.fly.dev";
+      const ok = await submitToService(json, endpoint, skillName);
+      if (!ok) {
+        console.log("Falling back to GitHub submission...");
+        const ghOk = submitToGitHub(json, outputPath);
+        if (!ghOk) process.exit(1);
+      }
+    }
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Service submission
+// ---------------------------------------------------------------------------
+
+async function submitToService(
+  json: string,
+  endpoint: string,
+  skillName: string,
+): Promise<boolean> {
+  try {
+    const url = `${endpoint}/api/submit`;
+    const res = await fetch(url, {
+      method: "POST",
+      headers: { "Content-Type": "application/json" },
+      body: json,
+    });
+
+    if (!res.ok) {
+      const body = await res.text();
+      console.error(`[ERROR] Service submission failed (${res.status}): ${body}`);
+      return false;
+    }
+
+    console.log(`\nSubmitted to ${endpoint}`);
+    console.log(`  Badge: ${endpoint}/badge/${encodeURIComponent(skillName)}`);
+    console.log(`  Report: ${endpoint}/report/${encodeURIComponent(skillName)}`);
+    return true;
+  } catch (err) {
+    console.error(
+      `[ERROR] Could not reach ${endpoint}: ${err instanceof Error ? err.message : String(err)}`,
+    );
+    return false;
+  }
+}
+
+// ---------------------------------------------------------------------------
+// GitHub submission
+// ---------------------------------------------------------------------------
+
+function submitToGitHub(json: string, outputPath: string): boolean {
+  const repo = "selftune-dev/selftune";
+  const sizeKB = Buffer.byteLength(json, "utf-8") / 1024;
+
+  let body: string;
+  if (sizeKB < 50) {
+    body = `## Selftune Contribution\n\n\`\`\`json\n${json}\n\`\`\``;
+  } else {
+    // Create gist for large bundles
+    try {
+      const result = spawnSync("gh", ["gist", "create", outputPath, "--public"], {
+        encoding: "utf-8",
+      });
+      if (result.status !== 0) {
+        console.error("[ERROR] Failed to create gist. Is `gh` installed and authenticated?");
+        console.error(result.stderr || "gh gist create failed");
+        return false;
+      }
+      const gistUrl = result.stdout.trim();
+      body = `## Selftune Contribution\n\nBundle too large to inline (${sizeKB.toFixed(1)} KB).\n\nGist: ${gistUrl}`;
+    } catch (err) {
+      console.error("[ERROR] Failed to create gist. Is `gh` installed and authenticated?");
+      console.error(String(err));
+      return false;
+    }
+  }
+
+  try {
+    const result = spawnSync(
+      "gh",
+      [
+        "issue",
+        "create",
+        "--repo",
+        repo,
+        "--label",
+        "contribution",
+        "--title",
+        "selftune contribution",
+        "--body",
+        body,
+      ],
+      { encoding: "utf-8" },
+    );
+    if (result.status !== 0) {
+      console.error("[ERROR] Failed to create GitHub issue. Is `gh` installed and authenticated?");
+      console.error(result.stderr || "gh issue create failed");
+      return false;
+    }
+    console.log(`\nSubmitted: ${result.stdout.trim()}`);
+    return true;
+  } catch (err) {
+    console.error("[ERROR] Failed to create GitHub issue. Is `gh` installed and authenticated?");
+    console.error(String(err));
+    return false;
+  }
+}
+
+if (import.meta.main) {
+  await cliMain();
+}

package/cli/selftune/contribute/sanitize.ts

@@ -0,0 +1,162 @@
+/**
+ * Privacy sanitization for contribution bundles.
+ *
+ * Two levels:
+ *   conservative (default) — redacts paths, emails, secrets, IPs, project names, session IDs
+ *   aggressive — extends conservative with identifiers, quoted strings, modules, truncation
+ *
+ * All functions are pure (no side effects).
+ */
+
+import {
+  AGGRESSIVE_MAX_QUERY_LENGTH,
+  EMAIL_PATTERN,
+  FILE_PATH_PATTERN,
+  IDENTIFIER_PATTERN,
+  IP_PATTERN,
+  MODULE_PATTERN,
+  SECRET_PATTERNS,
+} from "../constants.js";
+import type { ContributionBundle } from "../types.js";
+
+// UUID v4 pattern for session ID redaction
+const UUID_PATTERN = /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b/gi;
+
+// Quoted string patterns for aggressive mode
+const DOUBLE_QUOTED_PATTERN = /"[^"]*"/g;
+const SINGLE_QUOTED_PATTERN = /'[^']*'/g;
+
+// ---------------------------------------------------------------------------
+// Conservative sanitization
+// ---------------------------------------------------------------------------
+
+export function sanitizeConservative(text: string, projectName?: string): string {
+  if (!text) return text;
+
+  let result = text;
+
+  // Secrets first (longest/most specific patterns)
+  for (const pattern of SECRET_PATTERNS) {
+    // Clone regex to reset lastIndex
+    result = result.replace(new RegExp(pattern.source, pattern.flags), "[SECRET]");
+  }
+
+  // File paths
+  result = result.replace(new RegExp(FILE_PATH_PATTERN.source, FILE_PATH_PATTERN.flags), "[PATH]");
+
+  // Emails
+  result = result.replace(new RegExp(EMAIL_PATTERN.source, EMAIL_PATTERN.flags), "[EMAIL]");
+
+  // IPs
+  result = result.replace(new RegExp(IP_PATTERN.source, IP_PATTERN.flags), "[IP]");
+
+  // Project name
+  if (projectName) {
+    result = result.replace(new RegExp(escapeRegExp(projectName), "g"), "[PROJECT]");
+  }
+
+  // Session IDs (UUIDs)
+  result = result.replace(UUID_PATTERN, "[SESSION]");
+
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Aggressive sanitization
+// ---------------------------------------------------------------------------
+
+export function sanitizeAggressive(text: string, projectName?: string): string {
+  if (!text) return text;
+
+  // Start with conservative
+  let result = sanitizeConservative(text, projectName);
+
+  // Module paths (import/require/from)
+  result = result.replace(new RegExp(MODULE_PATTERN.source, MODULE_PATTERN.flags), (match) => {
+    // Preserve the keyword, replace the path
+    const keyword = match.match(/^(import|require|from)/)?.[0] ?? "";
+    // Determine what follows the keyword
+    if (match.includes("(")) {
+      return `${keyword}([MODULE])`;
+    }
+    return `${keyword} [MODULE]`;
+  });
+
+  // Quoted strings
+  result = result.replace(DOUBLE_QUOTED_PATTERN, "[STRING]");
+  result = result.replace(SINGLE_QUOTED_PATTERN, "[STRING]");
+
+  // Long identifiers (camelCase/PascalCase > 8 chars)
+  result = result.replace(
+    new RegExp(IDENTIFIER_PATTERN.source, IDENTIFIER_PATTERN.flags),
+    "[IDENTIFIER]",
+  );
+
+  // Truncate
+  if (result.length > AGGRESSIVE_MAX_QUERY_LENGTH) {
+    result = result.slice(0, AGGRESSIVE_MAX_QUERY_LENGTH);
+  }
+
+  return result;
+}
+
+// ---------------------------------------------------------------------------
+// Dispatcher
+// ---------------------------------------------------------------------------
+
+export function sanitize(
+  text: string,
+  level: "conservative" | "aggressive",
+  projectName?: string,
+): string {
+  return level === "aggressive"
+    ? sanitizeAggressive(text, projectName)
+    : sanitizeConservative(text, projectName);
+}
+
+// ---------------------------------------------------------------------------
+// Bundle sanitization
+// ---------------------------------------------------------------------------
+
+export function sanitizeBundle(
+  bundle: ContributionBundle,
+  level: "conservative" | "aggressive",
+  projectName?: string,
+): ContributionBundle {
+  return {
+    ...bundle,
+    sanitization_level: level,
+    positive_queries: bundle.positive_queries.map((q) => ({
+      ...q,
+      query: sanitize(q.query, level, projectName),
+    })),
+    eval_entries: bundle.eval_entries.map((e) => ({
+      ...e,
+      query: sanitize(e.query, level, projectName),
+    })),
+    ...(bundle.unmatched_queries
+      ? {
+          unmatched_queries: bundle.unmatched_queries.map((q) => ({
+            ...q,
+            query: sanitize(q.query, level, projectName),
+          })),
+        }
+      : {}),
+    ...(bundle.pending_proposals
+      ? {
+          pending_proposals: bundle.pending_proposals.map((p) => ({
+            ...p,
+            details: sanitize(p.details, level, projectName),
+          })),
+        }
+      : {}),
+  };
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function escapeRegExp(str: string): string {
+  return str.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/cli/selftune/cron/setup.ts

@@ -0,0 +1,266 @@
+#!/usr/bin/env bun
+/**
+ * selftune cron — OpenClaw cron integration for selftune automation.
+ *
+ * Subcommands:
+ *   setup    Register default selftune cron jobs with OpenClaw
+ *   list     Show registered selftune cron jobs
+ *   remove   Remove all selftune cron jobs
+ *
+ * Usage:
+ *   selftune cron setup [--dry-run] [--tz <timezone>]
+ *   selftune cron list
+ *   selftune cron remove [--dry-run]
+ */
+
+import { existsSync, readFileSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { parseArgs } from "node:util";
+
+// ---------------------------------------------------------------------------
+// Types & constants
+// ---------------------------------------------------------------------------
+
+export interface CronJobConfig {
+  name: string;
+  cron: string;
+  message: string;
+  description: string;
+}
+
+export const DEFAULT_CRON_JOBS: CronJobConfig[] = [
+  {
+    name: "selftune-sync",
+    cron: "*/30 * * * *",
+    message:
+      "Run selftune sync to replay and ingest new Claude Code, Codex, OpenCode, and OpenClaw source data, then rebuild the repaired skill-usage overlay.",
+    description: "Sync source-truth telemetry every 30 minutes",
+  },
+  {
+    name: "selftune-status",
+    cron: "0 8 * * *",
+    message:
+      "Run selftune sync first, then run selftune status --json and report any skills with pass rate below 80% or still ungraded due to sparse recent checks.",
+    description: "Daily health check after source sync",
+  },
+  {
+    name: "selftune-orchestrate",
+    cron: "0 */6 * * *",
+    message:
+      "Run selftune orchestrate --max-skills 3. This performs source-truth sync, selects candidate skills, evolves validated low-risk descriptions autonomously, and watches recent deployments for regressions.",
+    description: "Autonomous improvement loop every 6 hours",
+  },
+];
+
+// ---------------------------------------------------------------------------
+// Helpers (exported for testability)
+// ---------------------------------------------------------------------------
+
+/** Build the argument array for `openclaw cron add`. */
+export function buildCronAddArgs(job: CronJobConfig, tz: string): string[] {
+  return [
+    "cron",
+    "add",
+    "--name",
+    job.name,
+    "--cron",
+    job.cron,
+    "--tz",
+    tz,
+    "--session",
+    "isolated",
+    "--message",
+    job.message,
+  ];
+}
+
+/** Return the default path to OpenClaw's cron jobs file. */
+export function getOpenClawJobsPath(): string {
+  return join(homedir(), ".openclaw", "cron", "jobs.json");
+}
+
+/** Type guard that validates all required CronJobConfig fields. */
+function isCronJobConfig(value: unknown): value is CronJobConfig {
+  if (typeof value !== "object" || value === null) return false;
+  const obj = value as Record<string, unknown>;
+  return (
+    typeof obj.name === "string" &&
+    typeof obj.cron === "string" &&
+    typeof obj.message === "string" &&
+    typeof obj.description === "string"
+  );
+}
+
+/** Load cron jobs from a JSON file, filtering for selftune entries. */
+export function loadCronJobs(jobsPath: string): CronJobConfig[] {
+  if (!existsSync(jobsPath)) {
+    return [];
+  }
+  try {
+    const raw = readFileSync(jobsPath, "utf-8");
+    const data = JSON.parse(raw);
+    if (!Array.isArray(data)) {
+      return [];
+    }
+    return data.filter((j: unknown) => isCronJobConfig(j) && j.name.startsWith("selftune-"));
+  } catch {
+    return [];
+  }
+}
+
+// ---------------------------------------------------------------------------
+// Subcommands
+// ---------------------------------------------------------------------------
+
+/** Register default cron jobs with OpenClaw. */
+export async function setupCronJobs(tz: string, dryRun: boolean): Promise<void> {
+  const openclawPath = Bun.which("openclaw");
+  if (!dryRun && !openclawPath) {
+    console.error("Error: openclaw is not installed or not in PATH.");
+    console.error("");
+    console.error("Install OpenClaw:");
+    console.error("  https://openclaw.dev/install");
+    console.error("");
+    console.error("Or ensure the openclaw binary is in your PATH.");
+    process.exit(1);
+  }
+
+  console.log(`Registering ${DEFAULT_CRON_JOBS.length} cron jobs (tz=${tz})...\n`);
+
+  for (const job of DEFAULT_CRON_JOBS) {
+    const args = buildCronAddArgs(job, tz);
+
+    if (dryRun) {
+      console.log(`[DRY RUN] openclaw ${args.join(" ")}`);
+    } else {
+      const proc = Bun.spawn(["openclaw", ...args], {
+        stdout: "inherit",
+        stderr: "inherit",
+      });
+      const exitCode = await proc.exited;
+      if (exitCode !== 0) {
+        console.error(
+          `Error: openclaw cron add failed for "${job.name}" with exit code ${exitCode}`,
+        );
+        process.exit(1);
+      }
+      console.log(`  Registered: ${job.name} — ${job.description}`);
+    }
+  }
+
+  console.log("\nDone.");
+}
+
+/** Show registered selftune cron jobs. */
+export function listCronJobs(): void {
+  const jobsPath = getOpenClawJobsPath();
+  const jobs = loadCronJobs(jobsPath);
+
+  if (jobs.length === 0) {
+    if (!existsSync(jobsPath)) {
+      console.log("No cron jobs file found at:", jobsPath);
+    } else {
+      console.log("No selftune cron jobs registered.");
+    }
+    return;
+  }
+
+  // Print as formatted table
+  const nameWidth = Math.max(20, ...jobs.map((j) => j.name.length));
+  const cronWidth = Math.max(16, ...jobs.map((j) => j.cron.length));
+
+  console.log(`${"NAME".padEnd(nameWidth)}  ${"SCHEDULE".padEnd(cronWidth)}  DESCRIPTION`);
+  console.log(`${"─".repeat(nameWidth)}  ${"─".repeat(cronWidth)}  ${"─".repeat(40)}`);
+
+  for (const job of jobs) {
+    console.log(`${job.name.padEnd(nameWidth)}  ${job.cron.padEnd(cronWidth)}  ${job.description}`);
+  }
+}
+
+/** Remove all selftune cron jobs from OpenClaw. */
+export async function removeCronJobs(dryRun: boolean): Promise<void> {
+  const jobsPath = getOpenClawJobsPath();
+  const jobs = loadCronJobs(jobsPath);
+
+  if (jobs.length === 0) {
+    console.log("No selftune cron jobs to remove.");
+    return;
+  }
+
+  console.log(`Removing ${jobs.length} selftune cron jobs...\n`);
+
+  for (const job of jobs) {
+    if (dryRun) {
+      console.log(`[DRY RUN] openclaw cron remove --name ${job.name}`);
+    } else {
+      const proc = Bun.spawn(["openclaw", "cron", "remove", "--name", job.name], {
+        stdout: "inherit",
+        stderr: "inherit",
+      });
+      const exitCode = await proc.exited;
+      if (exitCode !== 0) {
+        console.error(
+          `Error: openclaw cron remove failed for "${job.name}" with exit code ${exitCode}`,
+        );
+        process.exit(1);
+      }
+      console.log(`  Removed: ${job.name}`);
+    }
+  }
+
+  console.log("\nDone.");
+}
+
+// ---------------------------------------------------------------------------
+// CLI entry point
+// ---------------------------------------------------------------------------
+
+export async function cliMain(): Promise<void> {
+  const subcommand = process.argv[2];
+
+  const { values } = parseArgs({
+    options: {
+      "dry-run": { type: "boolean", default: false },
+      tz: { type: "string" },
+    },
+    strict: false,
+    allowPositionals: true,
+  });
+
+  // Get timezone: flag > env > system default
+  const tz = values.tz ?? process.env.TZ ?? Intl.DateTimeFormat().resolvedOptions().timeZone;
+
+  switch (subcommand) {
+    case "setup":
+      await setupCronJobs(tz, values["dry-run"] ?? false);
+      break;
+    case "list":
+      listCronJobs();
+      break;
+    case "remove":
+      await removeCronJobs(values["dry-run"] ?? false);
+      break;
+    default:
+      console.log(`selftune cron — OpenClaw cron integration
+
+Registers selftune automation jobs with OpenClaw's Gateway Scheduler.
+This is an optional convenience for OpenClaw users. For generic scheduling
+with system cron, launchd, or systemd, see: selftune schedule
+
+Usage:
+  selftune cron setup [--dry-run] [--tz <timezone>]
+  selftune cron list
+  selftune cron remove [--dry-run]
+
+Subcommands:
+  setup    Register default selftune cron jobs with OpenClaw
+  list     Show registered selftune cron jobs
+  remove   Remove all selftune cron jobs`);
+      break;
+  }
+}
+
+if (import.meta.main) {
+  await cliMain();
+}