simt-dev 0.6.3 → 0.7.1

package/src/resolve/local.mjs

@@ -0,0 +1,58 @@
+// Repo-local skills as resolver nodes.
+//
+// The registry is what simt-dev ships; the skill directories a repo holds are what
+// that repo owns. After plan 0005 S2 the registry is small and generic, so a skill
+// that lives only in a repo was invisible to `skills find` and `skills brief`, and
+// the NOT SELECTED block points a reader at `skills show` by name - a remedy that
+// 404s for a name the registry does not declare.
+//
+// Presence in the repo's skill directory is the eligibility signal: a skill the repo
+// installed is about the repo, and the stack it belongs to is the stack the repo has.
+// The node's `stack` is therefore the repo's own signals, which makes the stack gate
+// a self-overlap that always passes, and the stack score reads "more this repo's"
+// rather than "compatible with a stranger".
+
+import { stat } from 'node:fs/promises';
+
+import { BODY_BYTE_BUDGET } from '../graph/compile.mjs';
+import { installedSkills } from '../projection/disclosure.mjs';
+
+/**
+ * The repo's own skills, as nodes the resolver can rank.
+ *
+ * Names the registry declares are excluded: the registry entry is canonical and the
+ * local file is its installed copy, so keeping both would rank one skill twice.
+ *
+ * @param {string} root the repository
+ * @param {object} registry the loaded registry
+ * @param {string[]} repoStack the repo's signals (stack ∪ facts)
+ * @returns {Promise<object[]>} resolver-ready nodes, name-sorted
+ */
+export async function localSkillNodes(root, registry, repoStack) {
+  const installed = await installedSkills(root);
+  const known = new Set(registry.skills.map((s) => s.name));
+  const nodes = [];
+  for (const { name, trigger, file } of installed) {
+    if (known.has(name)) continue;
+    let size;
+    try {
+      size = (await stat(file)).size;
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      continue; // gone between listing and measuring
+    }
+    nodes.push({
+      name,
+      summary: trigger,
+      keywords: [],
+      capabilities: [],
+      stack: [...repoStack],
+      paths: [],
+      bytes: size,
+      deferred: size > BODY_BYTE_BUDGET,
+      localFile: file,
+    });
+  }
+  nodes.sort((a, b) => a.name.localeCompare(b.name));
+  return nodes;
+}

package/src/review/critic.mjs

@@ -32,9 +32,12 @@ import { digestOf, promptHash, proposalFrontmatter } from '../distill/engine.mjs
 
 const exec = promisify(execFile);
 
-// Locked on-disk beneath `.simt`, like `.simt/distilled` (R38) — a cache of
+import { LOCAL_DIR } from '../state.mjs';
+import { commandRoot } from '../repo-root.mjs';
+
+// Locked on-disk beneath machine-local state, like the distilled cache (R38) —
 // proposals keyed by content digest, never projected and never committed.
-const REVIEW_DIR = '.simt/reviews';
+const REVIEW_DIR = join(LOCAL_DIR, 'reviews');
 const ENGINE_REVIEW_LOCAL = 'review-local';
 
 /** The diff brief's byte cap; `--budget` overrides it, `0` means unlimited. */
@@ -214,7 +217,7 @@ export async function reviewTarget(args, flags, { write = true, commands = [] }
   if (args.length > 0) {
     return fail(`unknown review argument ${args[0]}`, EXIT.USAGE, `usage: ${CLI} review [--local]`);
   }
-  const root = resolve(flags.root ?? process.cwd());
+  const root = resolve(commandRoot(flags));
   const listed = await tracked(root);
   if (listed.error) return listed.error;
 

package/src/secrets.mjs

@@ -33,39 +33,73 @@ const ENTROPY_MIN_LENGTH = 32;
 export const ENTROPY_MIN_BITS = 4.5;
 
 /**
- * Value markers that mean "this string is here to be replaced". A pattern match
- * or entropy hit whose value carries one of these is documentation, not a leak.
+ * A value is a placeholder when the WHOLE value is placeholder-shaped, not when
+ * it contains a placeholder word: a real secret may contain "example" and still
+ * be a secret, and the substring test blocked exactly that commit (review 0003 Q24).
  */
-const PLACEHOLDER =
-  /(example|placeholder|changeme|dummy|redacted|notasecret|your[_-]|xxxx+|<[a-z-]*>|\{\{?[a-z_.-]+\}\}?)/i;
+const PLACEHOLDER_WORD = /^(?:example|sample|placeholder|changeme|change[-_]?me|dummy|fake|redacted|notasecret|undefined|null|none|true|false|x+)$/i;
+const PLACEHOLDER_SLOT = /^(?:<[^<>]*>|\{\{?[a-z0-9_.-]+\}\}?|your[-_][a-z0-9_-]*|my[-_][a-z0-9_-]*)$/i;
+
+/**
+ * @param {string} value the candidate secret
+ * @returns {boolean} true when the whole value is documentation, not a leak
+ */
+function isPlaceholder(value) {
+  const v = String(value).trim();
+  if (v === '') return true;
+  if (PLACEHOLDER_SLOT.test(v)) return true;
+  const words = v.split(/[^a-zA-Z]+/).filter(Boolean);
+  if (words.length === 0) return true; // punctuation only: `…`, `-`
+  return words.every((w) => PLACEHOLDER_WORD.test(w));
+}
 
 /**
  * The pattern library. Each row names itself so the finding tells the reader
  * WHICH shape matched — "a secret was found" sends them hunting for it;
  * "aws-access-key-id on line 12" says what to revoke.
  *
- * `group`, when set, is the capture holding the VALUE — what the placeholder
- * check and the redaction run on. Without it the whole match is the value.
+ * `groups`, when set, lists the captures that may hold the VALUE — what the
+ * placeholder check and the redaction run on; the first defined capture wins.
+ * Without it the whole match is the value.
  */
 const PATTERNS = [
   { id: 'aws-access-key-id', re: /\b(?:A3T[A-Z0-9]|AKIA|ASIA|ABIA|ACCA)[A-Z0-9]{16}\b/g },
-  { id: 'private-key-block', re: /-----BEGIN (?:RSA |EC |DSA |OPENSSH |PGP )?PRIVATE KEY(?: BLOCK)?-----/g },
+  // The type word is not the discriminator, "PRIVATE KEY" is: RSA, EC, DSA,
+  // OPENSSH, PGP and ENCRYPTED all carry the same header shape (review 0003 Q24).
+  { id: 'private-key-block', re: /-----BEGIN [A-Z0-9 ]*PRIVATE KEY(?: BLOCK)?-----/g },
   { id: 'github-token', re: /\b(?:ghp|gho|ghu|ghs|ghr)_[A-Za-z0-9]{36}\b|\bgithub_pat_[A-Za-z0-9_]{22,}\b/g },
+  { id: 'gitlab-token', re: /\bglpat-[A-Za-z0-9_-]{20,}\b/g },
+  { id: 'npm-token', re: /\bnpm_[A-Za-z0-9]{36}\b/g },
   { id: 'slack-token', re: /\bxox[baprs]-[A-Za-z0-9-]{10,}\b/g },
   { id: 'stripe-live-key', re: /\b(?:sk|rk)_live_[0-9a-zA-Z]{24,}\b/g },
   { id: 'google-api-key', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
   { id: 'openai-style-key', re: /\bsk-[A-Za-z0-9_-]{20,}\b/g },
   { id: 'jwt', re: /\beyJ[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\.[A-Za-z0-9_-]{10,}\b/g },
+  // The key name is prefix-aware — DB_PASSWORD, aws_secret_access_key — and the
+  // value may be quoted or bare, because .env and YAML do not quote (review 0003 Q24).
   {
     id: 'assigned-secret',
-    re: /\b(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*["']([^"']{8,})["']/gi,
-    group: 1,
+    re: /\b[A-Za-z0-9_.-]*(?:password|passwd|secret|token|api[_-]?key|access[_-]?key|client[_-]?secret)\b\s*[:=]\s*(?:"([^"]{8,})"|'([^']{8,})'|([A-Za-z0-9+/=_-]{8,}))/gi,
+    groups: [1, 2, 3],
+  },
+  // The password half of https://user:pw@host: the only place a URL carries one.
+  {
+    id: 'url-userinfo',
+    re: /\b[a-z][a-z0-9+.-]*:\/\/[^:/\s@]+:([A-Za-z0-9._~+-]{8,})@/g,
+    groups: [1],
   },
 ];
 
 /** Longest base64ish run worth measuring for entropy. */
 const ENTROPY_CANDIDATE = /[A-Za-z0-9+/=_-]{32,}/g;
 
+/**
+ * Subresource-integrity hashes: `sha256-<base64>` and kin. A deterministic
+ * digest of file content, present in every lockfile and build manifest —
+ * high-entropy bytes that are never a secret (review 0003 Q24).
+ */
+const SRI_HASH = /^sha(1|256|384|512)-[A-Za-z0-9+/]+={0,2}$/;
+
 /**
  * Shannon entropy of a string, in bits per character.
  *
@@ -92,27 +126,37 @@ function redact(value) {
 }
 
 /**
- * Scan one line's worth of added text.
+ * Every secret span in the text: pattern matches in library order, then entropy
+ * over whatever no pattern claimed. One function because the gate report and
+ * the redactor must agree on what a secret is: two matchers drift, and the
+ * drift is a token one of them stores (review 0003 Q36).
  *
- * @param {string} text the added line, without the leading `+`
- * @returns {{kind: string, preview: string, entropy?: number}[]} findings in
- *   pattern order, then entropy over whatever no pattern claimed
+ * @param {string} text
+ * @returns {{start: number, end: number, kind: string, preview: string, entropy?: number}[]}
  */
-export function scanText(text) {
+function findSpans(text) {
   const found = [];
   const claimed = [];
 
   for (const pattern of PATTERNS) {
     pattern.re.lastIndex = 0;
     for (const match of text.matchAll(pattern.re)) {
-      const value = pattern.group !== undefined ? match[pattern.group] : match[0];
-      if (PLACEHOLDER.test(value)) continue;
-      const at = match.index + (pattern.group !== undefined ? match[0].indexOf(value) : 0);
+      const groups = pattern.groups ?? [0];
+      let value = null;
+      for (const g of groups) {
+        if (match[g] !== undefined) {
+          value = match[g];
+          break;
+        }
+      }
+      if (value === null) continue;
+      if (isPlaceholder(value)) continue;
+      const at = match.index + match[0].indexOf(value);
       // Overlap, not equality: a token a pattern named is one finding, and the
       // entropy reading of the same bytes would double the count a gate reports.
       if (claimed.some(([a, b]) => at < b && a < at + value.length)) continue;
       claimed.push([at, at + value.length]);
-      found.push({ kind: pattern.id, preview: redact(value) });
+      found.push({ start: at, end: at + value.length, kind: pattern.id, preview: redact(value) });
     }
   }
 
@@ -120,16 +164,106 @@ export function scanText(text) {
   for (const match of text.matchAll(ENTROPY_CANDIDATE)) {
     const value = match[0];
     if (value.length < ENTROPY_MIN_LENGTH) continue;
-    if (PLACEHOLDER.test(value)) continue;
+    if (SRI_HASH.test(value)) continue;
+    if (isPlaceholder(value)) continue;
     if (claimed.some(([a, b]) => match.index < b && a < match.index + value.length)) continue;
     const bits = entropy(value);
     if (bits < ENTROPY_MIN_BITS) continue;
-    found.push({ kind: 'high-entropy', preview: redact(value), entropy: Number(bits.toFixed(1)) });
+    found.push({
+      start: match.index,
+      end: match.index + value.length,
+      kind: 'high-entropy',
+      preview: redact(value),
+      entropy: Number(bits.toFixed(1)),
+    });
   }
 
   return found;
 }
 
+/**
+ * Scan one line's worth of added text.
+ *
+ * @param {string} text the added line, without the leading `+`
+ * @returns {{kind: string, preview: string, entropy?: number}[]} findings in
+ *   pattern order, then entropy over whatever no pattern claimed
+ */
+export function scanText(text) {
+  return findSpans(text).map(({ kind, preview, entropy }) =>
+    entropy === undefined ? { kind, preview } : { kind, preview, entropy },
+  );
+}
+
+/**
+ * Replace every secret span with `[redacted:<kind>]`, leaving the rest of the
+ * text byte-identical. Lesson candidates store the commands that failed, and a
+ * command can carry a token (`curl -H "Authorization: Bearer …"`); storing it
+ * verbatim writes the secret into a JSONL file that is then read, rendered and
+ * injected into prompts (review 0003 Q36).
+ *
+ * @param {string} text
+ * @returns {string} the text with secret values replaced
+ */
+export function redactText(text) {
+  const spans = findSpans(String(text ?? '')).sort((a, b) => b.start - a.start);
+  let out = String(text ?? '');
+  for (const span of spans) {
+    out = `${out.slice(0, span.start)}[redacted:${span.kind}]${out.slice(span.end)}`;
+  }
+  return out;
+}
+
+/**
+ * Lockfiles are skipped by default (review 0003 Q24): their high-entropy bytes
+ * are integrity hashes and version pins, and a dependency bump is a commit the
+ * gate must not block. The SRI allow-list above covers the same shapes wherever
+ * they appear outside a lockfile.
+ */
+const LOCKFILES = new Set([
+  'package-lock.json',
+  'npm-shrinkwrap.json',
+  'yarn.lock',
+  'bun.lockb',
+  'pnpm-lock.yaml',
+  'Cargo.lock',
+  'go.sum',
+  'composer.lock',
+  'Gemfile.lock',
+  'Pipfile.lock',
+  'poetry.lock',
+  'uv.lock',
+  'pubspec.lock',
+  'mix.lock',
+]);
+
+/** A line carrying this marker is the author's explicit exemption for that line. */
+const PRAGMA = 'simt:allow-secret';
+
+/**
+ * One glob to one anchored regex: `**` crosses separators, `*` and `?` do not.
+ * The same small matcher the ignore lists render with, because a repository
+ * that writes `vendor/**` in `.simtignore` expects the same reading here.
+ */
+function globToRegExp(glob) {
+  let re = '';
+  for (let i = 0; i < glob.length; i += 1) {
+    const c = glob[i];
+    if (c === '*') {
+      if (glob[i + 1] === '*') {
+        re += '.*';
+        i += 1;
+      } else {
+        re += '[^/]*';
+      }
+    } else if (c === '?') {
+      re += '[^/]';
+    } else {
+      re += c.replace(/[.+^${}()|[\]\\]/g, '\\$&');
+    }
+  }
+  return new RegExp(`^${re}$`);
+}
+
 /**
  * Scan the staged diff: the added lines of what the next commit would record.
  *
@@ -141,12 +275,18 @@ export function scanText(text) {
  * one a line is.
  *
  * @param {string} root repository root
+ * @param {{ignore?: string[]}} [options] `ignore` is the manifest's
+ *   `gates.secretScan.ignore`: globs of repository paths to skip (review 0003 Q24)
  * @returns {Promise<{findings: {file: string, line: number, kind: string,
  *   preview: string, entropy?: number}[], lines: number, error: string|null}>}
  *   `error` is set only when git itself could not answer; callers fail closed on
  *   it rather than reading silence as a clean diff.
  */
-export async function scanStaged(root) {
+export async function scanStaged(root, options = {}) {
+  const ignore = (Array.isArray(options.ignore) ? options.ignore : [])
+    .filter((g) => typeof g === 'string' && g !== '')
+    .map(globToRegExp);
+
   let stdout;
   try {
     // Every flag here defeats a way a repository can keep the scan from seeing its
@@ -183,6 +323,7 @@ export async function scanStaged(root) {
   let file = null;
   let lineNo = 0;
   let inHunk = false;
+  let fileSkipped = false;
 
   for (const raw of stdout.split('\n')) {
     if (raw.startsWith('diff --git ')) {
@@ -203,12 +344,14 @@ export async function scanStaged(root) {
       if (raw.startsWith('+++ ')) {
         const path = raw.slice(4).trim();
         file = path === '/dev/null' ? null : path.replace(/^b\//, '');
+        const name = file === null ? '' : file.slice(file.lastIndexOf('/') + 1);
+        fileSkipped = file !== null && (LOCKFILES.has(name) || ignore.some((re) => re.test(file)));
       }
       continue;
     }
     if (!raw.startsWith('+')) continue; // -U0 has no context; this is `\ No newline…`
     lines += 1;
-    if (file !== null) {
+    if (file !== null && !fileSkipped && !raw.includes(PRAGMA)) {
       for (const hit of scanText(raw.slice(1))) {
         findings.push({ file, line: lineNo, ...hit });
       }

package/src/state.mjs

@@ -0,0 +1,76 @@
+// Machine-local state lives here, not in the tree (review 0003 Q19).
+//
+// Everything this tool writes for itself — the ledger, the check cache, the
+// index, leases, the journal, briefs, gate logs, bench runs — used to live
+// directly under `.simt/`, so `simt check` changed the tree id its own
+// evidence was measured against, and a slice worktree landed in the main
+// checkout as an embedded gitlink. The fix is one directory: local state
+// goes under `.simt/local/`, which is ignored and excluded from the tree,
+// while committed content (`packs/`, `bin/`, `bench/tasks/`, profiles) stays
+// where it was.
+//
+// Readers try the new path first and fall back to the old one for one
+// release, so a repository whose state predates the move keeps working until
+// the next write migrates it. Writers always write the new path.
+
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+
+import { STATE_DIR } from './name.mjs';
+
+/** The ignored directory every machine-local write goes under. */
+export const LOCAL_DIR = join(STATE_DIR, 'local');
+
+/** A machine-local path, relative to the repository root. */
+export function localRel(...parts) {
+  return join(LOCAL_DIR, ...parts);
+}
+
+/**
+ * Where a machine-local file is read from: the new path first, then each
+ * legacy path in order. Writers use only the first entry.
+ */
+function readCandidates(root, rel, legacy = []) {
+  return [join(root, rel), ...legacy.map((l) => join(root, l))];
+}
+
+/** The first readable candidate, or null when none exists. */
+export async function readStateFile(root, rel, legacy = []) {
+  for (const path of readCandidates(root, rel, legacy)) {
+    try {
+      return { text: await readFile(path, 'utf8'), path };
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+    }
+  }
+  return { text: null, path: join(root, rel) };
+}
+
+/**
+ * Every machine-local path the tree id must exclude: the whole local area
+ * plus the legacy paths a pre-move checkout may still carry, so an old
+ * `check.json` or worktree can neither change the id nor be committed.
+ */
+export const TREE_EXCLUDES = [
+  LOCAL_DIR,
+  join(STATE_DIR, 'ledger.jsonl'),
+  join(STATE_DIR, 'lessons.jsonl'),
+  join(STATE_DIR, 'leases.json'),
+  join(STATE_DIR, 'check.json'),
+  join(STATE_DIR, 'index.sqlite'),
+  join(STATE_DIR, 'index.jsonl'),
+  join(STATE_DIR, 'brief.md'),
+  join(STATE_DIR, 'journal'),
+  join(STATE_DIR, 'worktrees'),
+  join(STATE_DIR, 'gate'),
+  join(STATE_DIR, 'distilled'),
+  join(STATE_DIR, 'reviews'),
+  join(STATE_DIR, 'proposals'),
+  join(STATE_DIR, 'compiled'),
+  join(STATE_DIR, 'critic-labels.jsonl'),
+  join(STATE_DIR, 'bench', 'runs'),
+  join(STATE_DIR, 'bench', 'vault'),
+  join(STATE_DIR, 'bench', 'prices.json'),
+  join(STATE_DIR, 'bench', 'ablation.json'),
+  join(STATE_DIR, 'bench', 'probes'),
+];

package/src/status.mjs

@@ -31,11 +31,12 @@ import { join } from 'node:path';
 import { promisify } from 'node:util';
 
 import { readHooksState, wantsShim } from './compare/hooksstate.mjs';
-import { STATE_DIR } from './name.mjs';
+import { LOCAL_DIR } from './state.mjs';
 
 const exec = promisify(execFile);
 
-const CACHE_FILE = join(STATE_DIR, 'check.json');
+const CACHE_FILE = join(LOCAL_DIR, 'check.json');
+const CACHE_FILE_LEGACY = '.simt/check.json';
 const CACHE_VERSION = 1;
 
 /**
@@ -79,7 +80,7 @@ export async function buildCacheRecord(root, summary) {
 /** Atomically replace the cache. A killed `check` leaves the previous record, not half of one. */
 export async function writeCheckCache(root, record) {
   const path = cachePath(root);
-  await mkdir(join(root, STATE_DIR), { recursive: true });
+  await mkdir(join(root, LOCAL_DIR), { recursive: true });
   const body = `${JSON.stringify(record)}\n`;
   const tmp = `${path}.tmp-${process.pid}`;
   await writeFile(tmp, body, 'utf8');
@@ -88,9 +89,13 @@ export async function writeCheckCache(root, record) {
 
 /** The last record `check` wrote, or null when it never ran (or a writer invalidated it). */
 export async function readCheckCache(root) {
+  // The pre-move path is a fallback for one release (review 0003 Q19).
   let raw;
   try {
-    raw = await readFile(cachePath(root), 'utf8');
+    raw = await readFile(cachePath(root), 'utf8').catch(async (error) => {
+      if (error.code !== 'ENOENT') throw error;
+      return readFile(join(root, CACHE_FILE_LEGACY), 'utf8');
+    });
   } catch (error) {
     if (error.code === 'ENOENT') return null;
     throw error;

package/src/toolwords.mjs

@@ -22,6 +22,8 @@ import { VARIANTS_MARKER } from './kernel/variants.mjs';
 import { LESSON_KEYS } from './memory/lessons.mjs';
 import { DECISION_KEYS } from './memory/decide.mjs';
 import { PROMPT_WORDS } from './mcp/prompts.mjs';
+import { AGENT_STEM, SKILL_STEM } from './agents/render.mjs';
+import { CORPUS_KIND } from './bench/corpus.mjs';
 
 /**
  * `simt-` names that belong to this tool and never to a repository.
@@ -45,6 +47,12 @@ export const TOOL_WORDS = new Set([
   'simt-dev',
   'simt-dev-check',
   'simt-hooks',
+  // The one agent this tool ships, named by the stem every harness's agents file shares.
+  AGENT_STEM,
+  // The companion skill the agent reads on demand; its stem is the directory name.
+  SKILL_STEM,
+  // The kind stamp this tool writes into every sealed bench corpus document it exports.
+  CORPUS_KIND,
 ]);
 
 /**