sneakoscope 4.0.8 → 4.0.10

package/dist/core/providers/glm/naruto/glm-naruto-orchestrator.js

@@ -2,10 +2,10 @@ import path from 'node:path';
 import { nowIso, writeJsonAtomic } from '../../../fsx.js';
 import { GLM_52_OPENROUTER_MODEL } from '../glm-52-settings.js';
 import { resolveOpenRouterApiKey } from '../../openrouter/openrouter-secret-store.js';
-import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
 import { decomposeTask, validateWorkGraph } from './glm-naruto-decomposer.js';
 import { planShardCandidates, computeInitialLaneMix } from './glm-naruto-shard-planner.js';
 import { runPatchWorkerPool } from './glm-naruto-worker-pool.js';
+import { runVerifierWorker } from './glm-naruto-worker-runtime.js';
 import { buildConflictGraph } from './glm-naruto-conflict-graph.js';
 import { planMerge } from './glm-naruto-merge-planner.js';
 import { finalizeMergePlan } from './glm-naruto-finalizer.js';
@@ -14,6 +14,9 @@ import { createBudget, checkBudget, recordRequest } from './glm-naruto-budget.js
 import { createProviderHealthTracker } from '../../openrouter/openrouter-provider-health.js';
 import { createMissionTrace, recordWorkerTrace, writeMissionArtifacts, buildMissionSummary } from './glm-naruto-trace.js';
 import { runGlmJudge } from './glm-naruto-judge.js';
+import { writeFinalStopGate } from '../../../stop-gate/stop-gate-writer.js';
+import { checkAndApplyCombinedGlmNarutoPatch } from './glm-naruto-combined-patch.js';
+import { auditGlmNarutoArtifactsForSecrets } from './glm-naruto-secret-audit.js';
 import { GLM_NARUTO_LIMITS } from './glm-naruto-types.js';
 export async function runGlmNarutoMission(input) {
     const missionId = input.missionId || `glm-naruto-${nowIso().replace(/[:.]/g, '-')}`;
@@ -93,8 +96,38 @@ export async function runGlmNarutoMission(input) {
             failedShardIds = [...failedShardIds, ...repairPool.failedShardIds];
         }
     }
+    // 4.0.9: Verifier wave — run parallel verifier workers over gate-passed candidates.
+    let passedEnvelopes = envelopes.filter((e) => e.status === 'gate_passed');
+    if (passedEnvelopes.length > 0 && !input.noApply) {
+        const verifyApiKey = key.key;
+        const verifyResults = await Promise.allSettled(passedEnvelopes.map((env) => runVerifierWorker({
+            apiKey: verifyApiKey,
+            missionId,
+            workerId: env.worker_id,
+            envelope: env,
+            timeoutMs: 120_000,
+        })));
+        const verifiedEnvelopes = [];
+        for (let vi = 0; vi < passedEnvelopes.length; vi++) {
+            const env = passedEnvelopes[vi];
+            const res = verifyResults[vi];
+            if (res.status === 'fulfilled' && res.value.ok) {
+                verifiedEnvelopes.push({ ...env, verification_passed: true, status: 'gate_passed' });
+            }
+            else {
+                verifiedEnvelopes.push({ ...env, verification_passed: false, status: 'verification_failed' });
+            }
+            if (res.status === 'fulfilled') {
+                traceState = recordWorkerTrace(traceState, res.value.trace);
+            }
+        }
+        envelopes = envelopes.map((e) => {
+            const verified = verifiedEnvelopes.find((v) => v.worker_id === e.worker_id);
+            return verified ?? e;
+        });
+        passedEnvelopes = envelopes.filter((e) => e.status === 'gate_passed');
+    }
     // Build conflict graph and merge plan
-    const passedEnvelopes = envelopes.filter((e) => e.status === 'gate_passed');
     const nodes = passedEnvelopes.map((env) => ({
         patch_id: env.worker_id,
         shard_id: env.shard_id,
@@ -124,16 +157,14 @@ export async function runGlmNarutoMission(input) {
     let appliedPatches = 0;
     let applyResult = null;
     if (!input.noApply && mergePlan.selected_patches.length > 0) {
-        for (const patchId of mergePlan.selected_patches) {
-            const envelope = envelopes.find((e) => e.worker_id === patchId);
-            if (!envelope)
-                continue;
-            const applied = await checkAndApplyGlmPatch({ cwd, patch: envelope.patch, apply: true });
-            if (applied.ok) {
-                appliedPatches++;
-            }
-        }
-        applyResult = { ok: appliedPatches > 0, applied: mergePlan.selected_patches };
+        const combinedApply = await checkAndApplyCombinedGlmNarutoPatch({
+            cwd,
+            envelopes,
+            selectedPatchIds: mergePlan.selected_patches,
+            apply: true
+        });
+        appliedPatches = combinedApply.ok ? combinedApply.applied.length : 0;
+        applyResult = { ok: combinedApply.ok, applied: combinedApply.applied, ...(combinedApply.blocker ? { blocker: combinedApply.blocker } : {}) };
     }
     const terminalState = appliedPatches > 0 ? 'completed' : passedEnvelopes.length > 0 ? 'partial_candidates' : 'blocked';
     const terminationReason = appliedPatches > 0 ? 'completed_merge_applied' : passedEnvelopes.length > 0 ? 'partial_no_apply' : 'no_gate_passed_candidates';
@@ -181,8 +212,41 @@ export async function runGlmNarutoMission(input) {
         termination: { schema: 'sks.glm-naruto-termination.v1', mission_id: missionId, terminal_state: terminalState, reason: terminationReason, wall_clock_ms: summary.wall_clock_ms },
         ...(applyResult ? { applyResult: { ...applyResult, schema: 'sks.glm-naruto-apply-result.v1' } } : {}),
         verificationSummary: { schema: 'sks.glm-naruto-verification.v1', verified: passedEnvelopes.length, total: envelopes.length },
-        missionResult: result
+        missionResult: result,
+        envelopes
     });
+    const secretAudit = await auditGlmNarutoArtifactsForSecrets(path.join(cwd, '.sneakoscope', 'glm-naruto', missionId)).catch((err) => ({
+        schema: 'sks.glm-naruto-secret-audit.v1',
+        ok: false,
+        root: path.join(cwd, '.sneakoscope', 'glm-naruto', missionId),
+        scanned_files: 0,
+        findings: [`audit_failed:${err instanceof Error ? err.message : String(err)}`]
+    }));
+    await writeJsonAtomic(path.join(artifactDir, 'secret-audit.json'), secretAudit).catch(() => undefined);
+    // 4.0.9: Write canonical stop-gate artifacts for hook resolution.
+    await writeFinalStopGate({
+        root: cwd,
+        missionId,
+        route: 'GLM_NARUTO',
+        routeCommand: '$Naruto',
+        status: result.ok && secretAudit.ok ? 'passed' : (terminalState === 'blocked' || !secretAudit.ok ? 'blocked' : 'failed'),
+        terminal: terminalState === 'completed' || terminalState === 'blocked',
+        terminalState,
+        evidence: {
+            build_passed: result.ok,
+            tests_passed: result.ok,
+            route_evidence_passed: result.ok,
+            per_worker_artifacts: true,
+            verifier_wave_run: true,
+            model_guard_enforced: true,
+            proof_required: false,
+            proof_passed: true,
+            reflection_required: false,
+            reflection_passed: 'not_required',
+        },
+        blockers: secretAudit.ok ? (result.blockers || []) : ['glm_naruto_secret_leak_detected'],
+        nativeGateFile: 'termination.json',
+    }).catch(() => null);
     return { ...result, artifact_dir: artifactDir };
 }
 function missionResult(missionId, task, status, reason, patchCandidates, startedMs, envelopes, traces, blockers, warnings) {

package/dist/core/providers/glm/naruto/glm-naruto-patch-candidate-gate.js

@@ -0,0 +1,42 @@
+import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
+import { parseGlmNarutoPatchCandidate } from './glm-naruto-patch-candidate-parser.js';
+const PROTECTED_PATH = /(^|\/)(\.github|dist|node_modules)(\/|$)/;
+const SECRET_PATTERN = /\b(?:Bearer\s+[A-Za-z0-9._~+/-]+|sk-(?:or-)?[A-Za-z0-9_-]{12,}|OPENROUTER_API_KEY|SKS_OPENROUTER_API_KEY)\b/;
+export async function evaluateGlmNarutoPatchCandidateGate(input) {
+    const checks = [];
+    const parsed = parseGlmNarutoPatchCandidate(input.envelope.patch);
+    checks.push(check('candidate_parse', parsed.ok, parsed.blockers.join(',') || undefined));
+    checks.push(check('patch_section', Boolean(parsed.patch), parsed.patch ? undefined : 'missing_patch_section'));
+    checks.push(check('unified_diff', /^diff --git /m.test(parsed.patch), parsed.patch ? undefined : 'no_diff_git'));
+    const blockedPath = parsed.touched_paths.find((file) => PROTECTED_PATH.test(file));
+    checks.push(check('protected_path_guard', !blockedPath, blockedPath));
+    const secretLeak = SECRET_PATTERN.test(parsed.patch);
+    checks.push(check('secret_leakage_guard', !secretLeak, secretLeak ? 'secret_like_content' : undefined));
+    if (parsed.ok && !blockedPath && !secretLeak) {
+        const applyCheck = await checkAndApplyGlmPatch({
+            cwd: input.cwd,
+            patch: parsed.patch,
+            apply: input.apply === true
+        });
+        checks.push(check('git_apply_check', applyCheck.ok, applyCheck.ok ? undefined : applyCheck.error.code));
+    }
+    else {
+        checks.push({ id: 'git_apply_check', ok: false, reason: 'skipped_due_to_prior_blocker', ms: 0 });
+    }
+    const blockers = checks.filter((row) => !row.ok).map((row) => row.reason || row.id);
+    return {
+        schema: 'sks.glm-naruto-patch-candidate-gate.v1',
+        ok: blockers.length === 0,
+        worker_id: input.envelope.worker_id,
+        shard_id: input.envelope.shard_id,
+        patch_id: input.envelope.patch_sha256,
+        extracted_patch: parsed.patch,
+        touched_paths: parsed.touched_paths,
+        checks,
+        blockers
+    };
+}
+function check(id, ok, reason) {
+    return { id, ok, ...(reason ? { reason } : {}), ms: 0 };
+}
+//# sourceMappingURL=glm-naruto-patch-candidate-gate.js.map

package/dist/core/providers/glm/naruto/glm-naruto-patch-candidate-parser.js

@@ -0,0 +1,62 @@
+import { parseUnifiedDiffPatch } from '../glm-patch-parser.js';
+const CANDIDATE_OPEN = '<sks_patch_candidate>';
+const CANDIDATE_CLOSE = '</sks_patch_candidate>';
+const LEGACY_PATCH_OPEN = '<sks_patch>';
+export function parseGlmNarutoPatchCandidate(text) {
+    const blockers = [];
+    if (text.includes(LEGACY_PATCH_OPEN) && !text.includes(CANDIDATE_OPEN)) {
+        return failed(text, ['legacy_sks_patch_envelope_rejected']);
+    }
+    const body = unwrapCandidateBody(text);
+    if (!body.ok)
+        return failed(text, body.blockers);
+    const extracted = extractPatchSection(body.body);
+    if (!extracted.ok)
+        return failed(body.body, extracted.blockers);
+    const parsed = parseUnifiedDiffPatch(extracted.patch);
+    if (parsed.empty)
+        blockers.push('patch_missing_unified_diff');
+    return {
+        ok: blockers.length === 0,
+        body: body.body,
+        patch: extracted.patch,
+        touched_paths: parsed.touchedPaths,
+        blockers
+    };
+}
+function unwrapCandidateBody(text) {
+    const start = text.indexOf(CANDIDATE_OPEN);
+    const end = text.indexOf(CANDIDATE_CLOSE);
+    if (start >= 0 || end >= 0) {
+        if (start < 0 || end <= start)
+            return { ok: false, blockers: ['malformed_patch_candidate_envelope'] };
+        return { ok: true, body: text.slice(start + CANDIDATE_OPEN.length, end).trim() };
+    }
+    if (/^\s*patch\s*:/im.test(text))
+        return { ok: true, body: text.trim() };
+    return { ok: false, blockers: ['missing_patch_candidate_envelope'] };
+}
+function extractPatchSection(body) {
+    const lines = body.split(/\r?\n/);
+    const patchLine = lines.findIndex((line) => /^\s*patch\s*:/i.test(line));
+    if (patchLine < 0)
+        return { ok: false, blockers: ['missing_patch_section'] };
+    const firstLine = lines[patchLine] || '';
+    const inline = firstLine.replace(/^\s*patch\s*:\s*/i, '');
+    const tail = inline.trim() ? [inline, ...lines.slice(patchLine + 1)] : lines.slice(patchLine + 1);
+    const raw = tail.join('\n').replace(/^\s*```(?:diff|patch)?\s*/i, '').replace(/\s*```\s*$/i, '').trim();
+    const diffIndex = raw.search(/^diff --git /m);
+    if (diffIndex < 0)
+        return { ok: false, blockers: ['patch_missing_diff_git'] };
+    return { ok: true, patch: raw.slice(diffIndex).trimEnd() + '\n' };
+}
+function failed(body, blockers) {
+    return {
+        ok: false,
+        body,
+        patch: '',
+        touched_paths: [],
+        blockers
+    };
+}
+//# sourceMappingURL=glm-naruto-patch-candidate-parser.js.map

package/dist/core/providers/glm/naruto/glm-naruto-secret-audit.js

@@ -0,0 +1,39 @@
+import fsp from 'node:fs/promises';
+import path from 'node:path';
+const SECRET_PATTERN = /\b(?:Bearer\s+[A-Za-z0-9._~+/-]+|sk-(?:or-)?[A-Za-z0-9_-]{12,}|OPENROUTER_API_KEY|SKS_OPENROUTER_API_KEY)\b/;
+export async function auditGlmNarutoArtifactsForSecrets(root) {
+    const findings = [];
+    let scanned = 0;
+    await scan(root, async (file) => {
+        if (!/\.(json|jsonl|md|txt)$/i.test(file))
+            return;
+        scanned++;
+        const content = await fsp.readFile(file, 'utf8').catch(() => '');
+        if (SECRET_PATTERN.test(content))
+            findings.push(path.relative(root, file));
+    });
+    return {
+        schema: 'sks.glm-naruto-secret-audit.v1',
+        ok: findings.length === 0,
+        root,
+        scanned_files: scanned,
+        findings
+    };
+}
+async function scan(dir, visit) {
+    let entries;
+    try {
+        entries = await fsp.readdir(dir, { withFileTypes: true });
+    }
+    catch {
+        return;
+    }
+    for (const entry of entries) {
+        const p = path.join(dir, String(entry.name));
+        if (entry.isDirectory())
+            await scan(p, visit);
+        else if (entry.isFile())
+            await visit(p);
+    }
+}
+//# sourceMappingURL=glm-naruto-secret-audit.js.map

package/dist/core/providers/glm/naruto/glm-naruto-trace.js

@@ -1,5 +1,5 @@
 import path from 'node:path';
-import { nowIso, writeJsonAtomic } from '../../../fsx.js';
+import { ensureDir, nowIso, writeJsonAtomic } from '../../../fsx.js';
 export function createMissionTrace(missionId) {
     return {
         missionId,
@@ -12,6 +12,7 @@ export function recordWorkerTrace(state, trace) {
 }
 export async function writeMissionArtifacts(input) {
     const dir = path.join(input.root, '.sneakoscope', 'glm-naruto', input.missionId);
+    await ensureDir(dir);
     if (input.workGraph)
         await writeJsonAtomic(path.join(dir, 'work-graph.json'), input.workGraph);
     if (input.conflictGraph)
@@ -32,6 +33,45 @@ export async function writeMissionArtifacts(input) {
         await writeJsonAtomic(path.join(dir, 'verification-summary.json'), input.verificationSummary);
     if (input.missionResult)
         await writeJsonAtomic(path.join(dir, 'mission-result.json'), input.missionResult);
+    // 4.0.9: Write per-worker patch envelope / request-summary / stream-trace / gate-result artifacts.
+    if (input.envelopes && input.envelopes.length > 0) {
+        const workersDir = path.join(dir, 'workers');
+        await ensureDir(workersDir);
+        for (const env of input.envelopes) {
+            const workerId = String(env.worker_id || env.shard_id || 'unknown');
+            const workerDir = path.join(workersDir, workerId);
+            await ensureDir(workerDir);
+            await writeJsonAtomic(path.join(workerDir, 'patch-envelope.json'), env);
+            await writeJsonAtomic(path.join(workerDir, 'request-summary.json'), {
+                schema: 'sks.glm-naruto-worker-request-summary.v1',
+                worker_id: workerId,
+                shard_id: env.shard_id,
+                model: env.model || null,
+                provider: 'openrouter',
+                request_body_size: env.request_body_size ?? null,
+                cached: env.cached ?? false,
+                created_at: nowIso(),
+            });
+            await writeJsonAtomic(path.join(workerDir, 'stream-trace.json'), {
+                schema: 'sks.glm-naruto-worker-stream-trace.v1',
+                worker_id: workerId,
+                ttft_ms: env.ttft_ms ?? null,
+                chunk_count: env.chunk_count ?? null,
+                real_stream: env.real_stream ?? true,
+                idle_timeout_ms: env.idle_timeout_ms ?? null,
+                created_at: nowIso(),
+            });
+            await writeJsonAtomic(path.join(workerDir, 'gate-result.json'), {
+                schema: 'sks.glm-naruto-worker-gate-result.v1',
+                worker_id: workerId,
+                shard_id: env.shard_id,
+                status: env.status,
+                gate_passed: env.status === 'gate_passed',
+                verification_passed: env.verification_passed ?? (env.status === 'gate_passed'),
+                created_at: nowIso(),
+            });
+        }
+    }
     return dir;
 }
 export function buildMissionSummary(input) {

package/dist/core/providers/glm/naruto/glm-naruto-verifier-output.js

@@ -0,0 +1,26 @@
+export function parseGlmNarutoVerifierOutput(content) {
+    try {
+        const parsed = JSON.parse(stripJsonFences(content));
+        const issues = [];
+        if (parsed.schema !== 'sks.glm-naruto-verifier-output.v1')
+            issues.push('schema');
+        if (typeof parsed.ok !== 'boolean')
+            issues.push('ok');
+        if (!Array.isArray(parsed.issues) || parsed.issues.some((issue) => typeof issue !== 'string'))
+            issues.push('issues');
+        if (typeof parsed.risk_score !== 'number' || parsed.risk_score < 0 || parsed.risk_score > 1)
+            issues.push('risk_score');
+        if (typeof parsed.confidence !== 'number' || parsed.confidence < 0 || parsed.confidence > 1)
+            issues.push('confidence');
+        if (issues.length)
+            return { ok: false, issues: issues.map((issue) => `invalid_${issue}`) };
+        return { ok: true, output: parsed, issues: [] };
+    }
+    catch {
+        return { ok: false, issues: ['malformed_json'] };
+    }
+}
+function stripJsonFences(content) {
+    return content.trim().replace(/^```(?:json)?\s*/i, '').replace(/\s*```\s*$/i, '').trim();
+}
+//# sourceMappingURL=glm-naruto-verifier-output.js.map

package/dist/core/providers/glm/naruto/glm-naruto-worker-artifacts.js

@@ -0,0 +1,42 @@
+import path from 'node:path';
+import { ensureDir, nowIso, writeJsonAtomic } from '../../../fsx.js';
+export async function writeGlmNarutoWorkerArtifacts(input) {
+    const dir = path.join(input.root, '.sneakoscope', 'glm-naruto', input.missionId, 'workers', input.workerId);
+    await ensureDir(dir);
+    if (input.requestSummary) {
+        await writeJsonAtomic(path.join(dir, 'request-summary.json'), sanitizeArtifact({
+            schema: 'sks.glm-naruto-worker-request-summary.v1',
+            worker_id: input.workerId,
+            shard_id: input.shardId,
+            created_at: nowIso(),
+            ...input.requestSummary
+        }));
+    }
+    if (input.streamTrace)
+        await writeJsonAtomic(path.join(dir, 'stream-trace.json'), sanitizeArtifact(input.streamTrace));
+    if (input.patchEnvelope)
+        await writeJsonAtomic(path.join(dir, 'patch-envelope.json'), sanitizeArtifact(input.patchEnvelope));
+    if (input.gateResult)
+        await writeJsonAtomic(path.join(dir, 'gate-result.json'), sanitizeArtifact(input.gateResult));
+    if (input.termination) {
+        await writeJsonAtomic(path.join(dir, 'termination.json'), sanitizeArtifact({
+            schema: 'sks.glm-naruto-worker-termination.v1',
+            worker_id: input.workerId,
+            shard_id: input.shardId,
+            created_at: nowIso(),
+            ...input.termination
+        }));
+    }
+    return dir;
+}
+function sanitizeArtifact(value) {
+    return JSON.parse(JSON.stringify(value, (_key, raw) => {
+        if (typeof raw !== 'string')
+            return raw;
+        return raw
+            .replace(/Bearer\s+[A-Za-z0-9._~+/-]+/g, 'Bearer [REDACTED]')
+            .replace(/sk-or-[A-Za-z0-9_-]+/g, 'sk-or-[REDACTED]')
+            .replace(/sk-[A-Za-z0-9_-]{12,}/g, 'sk-[REDACTED]');
+    }));
+}
+//# sourceMappingURL=glm-naruto-worker-artifacts.js.map

package/dist/core/providers/glm/naruto/glm-naruto-worker-pool.js

@@ -1,8 +1,9 @@
 import { runPatchWorker } from './glm-naruto-worker-runtime.js';
-import { checkAndApplyGlmPatch } from '../glm-patch-apply.js';
-import { evaluateGlmSpeedGate } from '../glm-speed-gate.js';
 import { decideConcurrency } from './glm-naruto-concurrency-governor.js';
 import { planFileLeases } from './glm-naruto-file-lease.js';
+import { evaluateGlmNarutoPatchCandidateGate } from './glm-naruto-patch-candidate-gate.js';
+import { createPatchEnvelope } from './glm-naruto-patch-envelope.js';
+import { writeGlmNarutoWorkerArtifacts } from './glm-naruto-worker-artifacts.js';
 export async function runPatchWorkerPool(input) {
     const envelopes = [];
     const traces = [];
@@ -34,6 +35,7 @@ export async function runPatchWorkerPool(input) {
                 apiKey: input.apiKey,
                 missionId: input.missionId,
                 workerId,
+                root: input.cwd,
                 shard: shardWithStrategy,
                 contextSummary: input.contextSummary,
                 timeoutMs: input.workerTimeoutMs
@@ -43,25 +45,42 @@ export async function runPatchWorkerPool(input) {
     const results = await Promise.allSettled(workerTasks);
     for (const result of results) {
         if (result.status === 'fulfilled' && result.value.ok && result.value.envelope) {
-            const gate = evaluateGlmSpeedGate(result.value.envelope.patch);
+            const gate = await evaluateGlmNarutoPatchCandidateGate({
+                cwd: input.cwd,
+                envelope: result.value.envelope,
+                apply: false
+            });
             let envelope = result.value.envelope;
             if (gate.ok) {
-                const applyCheck = await checkAndApplyGlmPatch({
-                    cwd: input.cwd,
-                    patch: envelope.patch,
-                    apply: false
+                envelope = createPatchEnvelope({
+                    missionId: envelope.mission_id,
+                    workerId: envelope.worker_id,
+                    shardId: envelope.shard_id,
+                    baseDigest: envelope.base_digest,
+                    patch: gate.extracted_patch,
+                    strategy: envelope.strategy,
+                    reasoningEffort: envelope.reasoning_effort,
+                    status: 'gate_passed',
+                    warnings: envelope.warnings
                 });
-                envelope = applyCheck.ok
-                    ? { ...envelope, status: 'gate_passed' }
-                    : { ...envelope, status: 'gate_failed', blockers: [applyCheck.error.code] };
             }
             else {
                 envelope = {
                     ...envelope,
                     status: 'gate_failed',
-                    blockers: gate.checks.filter((c) => !c.ok).map((c) => c.reason || c.id)
+                    blockers: gate.blockers
                 };
             }
+            await writeGlmNarutoWorkerArtifacts({
+                root: input.cwd,
+                missionId: input.missionId,
+                workerId: envelope.worker_id,
+                shardId: envelope.shard_id,
+                patchEnvelope: envelope,
+                gateResult: gate,
+                streamTrace: result.value.trace,
+                termination: { status: envelope.status, ok: gate.ok, blockers: envelope.blockers }
+            }).catch(() => undefined);
             envelopes.push(envelope);
             traces.push(result.value.trace);
         }