thatgfsj-code 0.2.1 → 0.2.2

package/src/core/hooks.ts

@@ -1,196 +0,0 @@
-/**
- * S08: Hooks System
- * Inject custom logic at key event points without modifying agent source code
- * 
- * Hook points: before/after tool calls, before/after agent loop, onError, etc.
- * Users can register hooks for: audit logging, auto-formatting, security filtering, notifications
- */
-
-import { ChatMessage, ToolCall } from './types.js';
-
-// ==================== Hook Types ====================
-
-export type HookName =
-  | 'beforeToolCall'
-  | 'afterToolCall'
-  | 'beforeAgentLoop'
-  | 'afterAgentLoop'
-  | 'onError'
-  | 'beforeMessage'
-  | 'afterMessage'
-  | 'onCompact';
-
-export interface HookContext {
-  toolName?: string;
-  toolParams?: Record<string, any>;
-  toolResult?: any;
-  messages?: ChatMessage[];
-  error?: Error;
-  iteration?: number;
-  [key: string]: any;
-}
-
-export type HookFn = (ctx: HookContext) => void | Promise<void>;
-
-export interface HookRegistration {
-  name: HookName;
-  fn: HookFn;
-  priority?: number; // Higher = runs first
-  once?: boolean;    // If true, auto-remove after first run
-}
-
-// ==================== Hook Manager ====================
-
-export class HookManager {
-  private hooks: Map<HookName, HookRegistration[]> = new Map();
-
-  constructor() {
-    // Initialize all hook types
-    const allHooks: HookName[] = [
-      'beforeToolCall', 'afterToolCall', 'beforeAgentLoop', 'afterAgentLoop',
-      'onError', 'beforeMessage', 'afterMessage', 'onCompact'
-    ];
-    for (const h of allHooks) {
-      this.hooks.set(h, []);
-    }
-  }
-
-  /**
-   * S08: Register a hook
-   * @param name Hook point name
-   * @param fn Function to run
-   * @param priority Higher priority runs first
-   * @param once If true, auto-removed after first run
-   */
-  register(name: HookName, fn: HookFn, priority = 0, once = false): void {
-    const regs = this.hooks.get(name) || [];
-    regs.push({ name, fn, priority, once });
-    regs.sort((a, b) => (b.priority || 0) - (a.priority || 0));
-    this.hooks.set(name, regs);
-  }
-
-  /**
-   * S08: Unregister a hook by function reference
-   */
-  unregister(name: HookName, fn: HookFn): void {
-    const regs = this.hooks.get(name) || [];
-    this.hooks.set(name, regs.filter(r => r.fn !== fn));
-  }
-
-  /**
-   * S08: Clear all hooks for a given name (or all)
-   */
-  clear(name?: HookName): void {
-    if (name) {
-      this.hooks.set(name, []);
-    } else {
-      for (const [, regs] of this.hooks) {
-        regs.length = 0;
-      }
-    }
-  }
-
-  /**
-   * S08: Emit a hook — call all registered functions at that point
-   * Returns after all sync hooks complete, awaits async ones
-   */
-  async emit(name: HookName, ctx: HookContext): Promise<void> {
-    const regs = this.hooks.get(name) || [];
-
-    for (const reg of regs) {
-      try {
-        await Promise.resolve(reg.fn(ctx));
-      } catch (error: any) {
-        console.error(`[Hook ${name}] error:`, error.message);
-      }
-
-      // Remove if one-time hook
-      if (reg.once) {
-        this.unregister(name, reg.fn);
-      }
-    }
-  }
-
-  /**
-   * S08: Check if any hooks are registered for a given name
-   */
-  hasHooks(name: HookName): boolean {
-    return (this.hooks.get(name)?.length || 0) > 0;
-  }
-
-  /**
-   * S08: Get hook count
-   */
-  getHookCount(name?: HookName): number {
-    if (name) {
-      return this.hooks.get(name)?.length || 0;
-    }
-    let total = 0;
-    for (const regs of this.hooks.values()) {
-      total += regs.length;
-    }
-    return total;
-  }
-}
-
-// ==================== Built-in Hooks ====================
-
-/**
- * S08: Audit logging hook — logs all tool calls
- */
-export function auditLogHook(ctx: HookContext): void {
-  if (ctx.toolName) {
-    const ts = new Date().toISOString().split('T')[1].split('.')[0];
-    const status = ctx.toolResult?.success ? 'OK' : 'FAIL';
-    console.log(`[AUDIT ${ts}] ${status} | tool=${ctx.toolName} | params=${JSON.stringify(ctx.toolParams || {})} | result=${ctx.toolResult?.success ? 'OK' : ctx.toolResult?.error}`);
-  }
-}
-
-/**
- * S08: Prettier auto-format hook — run prettier after file writes
- */
-export async function prettierFormatHook(ctx: HookContext): Promise<void> {
-  if (ctx.toolName === 'file' && ctx.toolParams?.action === 'write') {
-    const path = ctx.toolParams.path;
-    const ext = path.split('.').pop()?.toLowerCase();
-
-    const formattable = ['js', 'ts', 'jsx', 'tsx', 'json', 'md', 'css', 'html'];
-    if (formattable.includes(ext || '')) {
-      console.log(`[Hook] Auto-format skipped (prettier not installed) for ${path}`);
-      // In real impl: spawn prettier on the file
-    }
-  }
-}
-
-/**
- * S08: Security filter hook — block suspicious patterns
- */
-export function securityFilterHook(ctx: HookContext): { blocked: boolean; reason: string } {
-  if (ctx.toolName === 'shell' && ctx.toolParams?.command) {
-    const cmd = ctx.toolParams.command;
-    const suspicious = [
-      /curl\s+.*\|.*sh/i,
-      /wget\s+.*\|.*sh/i,
-      /base64\s+-d/i,
-      /\.\/[^/]+\s+&&.*rm/i
-    ];
-
-    for (const pattern of suspicious) {
-      if (pattern.test(cmd)) {
-        return { blocked: true, reason: `Suspicious pattern detected: ${pattern}` };
-      }
-    }
-  }
-  return { blocked: false, reason: '' };
-}
-
-// ==================== Singleton ====================
-
-let globalHookManager: HookManager | null = null;
-
-export function getHookManager(): HookManager {
-  if (!globalHookManager) {
-    globalHookManager = new HookManager();
-  }
-  return globalHookManager;
-}

package/src/core/permissions.ts

@@ -1,308 +0,0 @@
-/**
- * S03: Permissions System
- * 6-stage permission pipeline for tool execution
- * Core principle: permissions are first-class citizens, not an afterthought
- */
-
-import chalk from 'chalk';
-import { ToolContext, ToolMetadata } from './types.js';
-
-// ==================== Permission Types ====================
-
-export type PermissionMode = 'accept' | 'deny' | 'ask';
-export type PermissionLevel = 'none' | 'low' | 'medium' | 'high' | 'critical';
-
-export interface PermissionResult {
-  allowed: boolean;
-  reason: string;
-  level: PermissionLevel;
-  requiresConfirmation: boolean;
-  stage: 1 | 2 | 3 | 4 | 5 | 6;
-}
-
-/**
- * Permission rule — pattern-based allow/deny rules
- */
-export interface PermissionRule {
-  pattern: RegExp;
-  action: 'allow' | 'deny';
-  reason: string;
-}
-
-/**
- * S03: Permission Checker — 6-stage pipeline
- */
-export class PermissionChecker {
-  private mode: PermissionMode = 'ask';
-  private rules: PermissionRule[] = [];
-  private workspaceRoot: string;
-
-  // Stage 1: Blocked patterns
-  private static BLOCKED_PATTERNS = [
-    /^rm\s+-rf\s+\//i,
-    /^rm\s+-rf\s+\$HOME/i,
-    /^rm\s+-rf\s+%USERPROFILE%/i,
-    /^del\s+\/f\s+\/s\s+\/q/i,
-    /^format\s+[a-z]:/i,
-    /^mkfs/i,
-    /^dd\s+if=/i,
-    /^shred/i,
-    />\s*\/dev\/sda/i,
-    /^curl\s+.*\||^wget\s+.*\|/i,
-    /^eval\s+/i,
-    /^exec\s+/i,
-    /base64\s+-d\s+.*\|/i,
-    /\$\(.*\)/i,
-    /`.*`/i,
-  ];
-
-  // Stage 2: Commands needing confirmation
-  private static CONFIRM_REQUIRED = [
-    'rm -rf',
-    'rmdir',
-    'del /s /q',
-    'format',
-    'mkfs',
-    'dd',
-    'shutdown',
-    'init 0',
-    'init 6',
-    'poweroff',
-    'reboot',
-    'pkill',
-    'killall',
-    'mv .* /tmp',
-    'chmod 777',
-    'chmod -R 777',
-    'git push --force',
-    'git push -f',
-  ];
-
-  // Stage 4: AI borderline commands (use LLM to classify)
-  private static BORDERLINE_PATTERNS = [
-    /curl\s+https?:\/\//i,
-    /wget\s+/i,
-    /npm\s+install\s+-g/i,
-    /pip\s+install\s+/i,
-    /yarn\s+add\s+/i,
-    /sudo\s+/i,
-    /chown\s+/i,
-    /chmod\s+[67]/i,
-    /^git\s+reset/i,
-    /^git\s+clean/i,
-  ];
-
-  constructor(workspaceRoot: string = process.cwd()) {
-    this.workspaceRoot = workspaceRoot;
-  }
-
-  /**
-   * S03: 6-Stage Permission Pipeline
-   * Every tool execution passes through all 6 stages
-   */
-  async check(
-    toolName: string,
-    params: Record<string, any>,
-    ctx: ToolContext
-  ): Promise<PermissionResult> {
-
-    // Stage 1: Pattern block — reject known dangerous commands immediately
-    const stage1 = this.stage1PatternBlock(toolName, params);
-    if (!stage1.allowed) return stage1;
-
-    // Stage 2: Permission rules — check user-defined allow/deny rules
-    const stage2 = this.stage2Rules(toolName, params);
-    if (!stage2.allowed) return stage2;
-
-    // Stage 3: Path sandboxing — prevent workspace escape
-    const stage3 = this.stage3PathSandbox(toolName, params);
-    if (!stage3.allowed) return stage3;
-
-    // Stage 4: AI classification for borderline cases
-    const stage4 = await this.stage4AIClassify(toolName, params, ctx);
-    if (!stage4.allowed) return stage4;
-
-    // Stage 5: User confirmation for medium/high risk
-    const stage5 = this.stage5Confirmation(toolName, params, ctx);
-    if (stage5.requiresConfirmation) {
-      return stage5;
-    }
-
-    // Stage 6: Pass through
-    return {
-      allowed: true,
-      reason: 'Allowed',
-      level: stage5.level,
-      requiresConfirmation: false,
-      stage: 6
-    };
-  }
-
-  // Stage 1: Pattern block
-  private stage1PatternBlock(toolName: string, params: Record<string, any>): PermissionResult {
-    if (toolName !== 'shell') return { allowed: true, reason: 'Stage 1: N/A', level: 'none', requiresConfirmation: false, stage: 1 };
-
-    const command = params.command || '';
-    for (const pattern of PermissionChecker.BLOCKED_PATTERNS) {
-      if (pattern.test(command.trim())) {
-        return {
-          allowed: false,
-          reason: `Blocked: command matches dangerous pattern ${pattern}`,
-          level: 'critical',
-          requiresConfirmation: false,
-          stage: 1
-        };
-      }
-    }
-    return { allowed: true, reason: 'Stage 1: Passed pattern check', level: 'none', requiresConfirmation: false, stage: 1 };
-  }
-
-  // Stage 2: User-defined rules
-  private stage2Rules(toolName: string, params: Record<string, any>): PermissionResult {
-    const command = params.command || '';
-
-    for (const rule of this.rules) {
-      if (rule.pattern.test(command)) {
-        return {
-          allowed: rule.action === 'allow',
-          reason: `Rule matched: ${rule.reason}`,
-          level: rule.action === 'deny' ? 'high' : 'none',
-          requiresConfirmation: false,
-          stage: 2
-        };
-      }
-    }
-    return { allowed: true, reason: 'Stage 2: No rules matched', level: 'none', requiresConfirmation: false, stage: 2 };
-  }
-
-  // Stage 3: Path sandboxing
-  private stage3PathSandbox(toolName: string, params: Record<string, any>): PermissionResult {
-    if (toolName !== 'shell' && toolName !== 'file') return { allowed: true, reason: 'Stage 3: N/A', level: 'none', requiresConfirmation: false, stage: 3 };
-
-    const path = params.path || params.command || '';
-
-    // Check for path traversal attempts
-    if (/^\.\.\//.test(path) || /\%00/.test(path) || /\0/.test(path)) {
-      return {
-        allowed: false,
-        reason: 'Blocked: path traversal attempt detected',
-        level: 'high',
-        requiresConfirmation: false,
-        stage: 3
-      };
-    }
-
-    return { allowed: true, reason: 'Stage 3: Path sandbox passed', level: 'none', requiresConfirmation: false, stage: 3 };
-  }
-
-  // Stage 4: AI classification for borderline commands
-  private async stage4AIClassify(
-    toolName: string,
-    params: Record<string, any>,
-    ctx: ToolContext
-  ): Promise<PermissionResult> {
-    if (toolName !== 'shell') return { allowed: true, reason: 'Stage 4: N/A', level: 'none', requiresConfirmation: false, stage: 4 };
-
-    const command = params.command || '';
-
-    // Check if borderline
-    const isBorderline = PermissionChecker.BORDERLINE_PATTERNS.some(p => p.test(command));
-    if (!isBorderline) {
-      return { allowed: true, reason: 'Stage 4: Not borderline', level: 'none', requiresConfirmation: false, stage: 4 };
-    }
-
-    // For CLI, mark as medium risk (actual AI classification skipped for perf)
-    return {
-      allowed: true,
-      reason: 'Stage 4: Borderline — escalated to confirmation',
-      level: 'medium',
-      requiresConfirmation: false,
-      stage: 4
-    };
-  }
-
-  // Stage 5: User confirmation
-  private stage5Confirmation(
-    toolName: string,
-    params: Record<string, any>,
-    ctx: ToolContext
-  ): PermissionResult {
-    if (this.mode === 'accept') {
-      return { allowed: true, reason: 'Mode: accept all', level: 'none', requiresConfirmation: false, stage: 5 };
-    }
-
-    if (this.mode === 'deny') {
-      return { allowed: false, reason: 'Mode: deny all', level: 'high', requiresConfirmation: false, stage: 5 };
-    }
-
-    // mode === 'ask'
-    const command = params.command || '';
-
-    // Critical: auto-deny
-    if (/rm\s+-rf/.test(command) && !command.includes('node_modules')) {
-      return {
-        allowed: false,
-        reason: 'Auto-deny: rm -rf without node_modules is too risky',
-        level: 'critical',
-        requiresConfirmation: false,
-        stage: 5
-      };
-    }
-
-    // Check confirm required list
-    const needsConfirm = PermissionChecker.CONFIRM_REQUIRED.some(cmd =>
-      command.toLowerCase().includes(cmd.toLowerCase())
-    );
-
-    if (needsConfirm) {
-      return {
-        allowed: true,
-        reason: 'Requires user confirmation',
-        level: 'medium',
-        requiresConfirmation: true,
-        stage: 5
-      };
-    }
-
-    return { allowed: true, reason: 'Stage 5: No confirmation needed', level: 'low', requiresConfirmation: false, stage: 5 };
-  }
-
-  // ==================== Config Methods ====================
-
-  setMode(mode: PermissionMode) {
-    this.mode = mode;
-  }
-
-  getMode(): PermissionMode {
-    return this.mode;
-  }
-
-  addRule(pattern: RegExp, action: 'allow' | 'deny', reason: string) {
-    this.rules.push({ pattern, action, reason });
-  }
-
-  clearRules() {
-    this.rules = [];
-  }
-
-  setWorkspaceRoot(path: string) {
-    this.workspaceRoot = path;
-  }
-}
-
-// ==================== Permission Mode CLI ====================
-
-export function printPermissionResult(result: PermissionResult, command?: string) {
-  if (!result.allowed) {
-    console.log(chalk.red(`\n🚫 BLOCKED [Stage ${result.stage}]: ${result.reason}`));
-    return;
-  }
-
-  if (result.requiresConfirmation && command) {
-    console.log(chalk.yellow(`\n⚠️  Requires confirmation [Stage ${result.stage}]: ${result.reason}`));
-    console.log(chalk.gray(`  Command: ${command}`));
-    return;
-  }
-
-  console.log(chalk.green(`\n✅ Allowed [Stage ${result.stage}]: ${result.reason}`));
-}

package/src/core/session.ts

@@ -1,165 +0,0 @@
-/**
- * Session Manager - Manages conversation history
- *
- * F4 (anti-[已中断]):
- *   - addMessage 拦截含"已中断" / 链形 think 块等污染字符串
- *     （之前 AI 在失败重试时会把这些字面写进 history 造成病毒循环）
- *   - sanitize() 在 lastMessages 输出到 LLM 前再做一次去噪
- */
-
-import { ChatMessage, Session } from './types.js';
-
-/**
- * Patterns that indicate the message is polluted by a previous broken
- * tool/stream retry loop. These should never be re-sent to the LLM.
- */
-const POLLUTION_PATTERNS: RegExp[] = [
-  /\[已中断/,                       // literally "[已中断" - sentinel from bad run
-  /\u5df2\u4e2d\u65ad/,              // 已中断 (escaped form)
-  /^\s*\[已中断\s*$/m,                // line that is exactly [已中断
-  /^<think>[\s\S]*?<\/think>\s*$/m,  // entire message that is just a think block
-  /\u{1F6AB}/u,                     // ⛔ emoji sometimes used as interrupt marker
-];
-
-function looksPolluted(content: string): boolean {
-  if (!content) return false;
-  // Strip obvious thinking fences and check the *remaining* core content.
-  const stripped = content
-    .replace(/<think>[\s\S]*?<\/think>/g, '')
-    .replace(/<\/?think>/g, '')
-    .trim();
-
-  for (const p of POLLUTION_PATTERNS) {
-    if (p.test(content)) return true;
-  }
-
-  // A message whose entire stripped form is shorter than 6 chars AND
-  // contains an interruption-related token is also suspect.
-  if (stripped.length < 6 && /(中断|interrupted|cancelled|已取消)/i.test(stripped)) {
-    return true;
-  }
-  return false;
-}
-
-export class SessionManager {
-  private messages: ChatMessage[] = [];
-  private sessionId: string;
-  private createdAt: Date;
-  private droppedCount = 0;
-
-  constructor() {
-    this.sessionId = this.generateId();
-    this.createdAt = new Date();
-  }
-
-  /**
-   * Add a message to the session.
-   * Returns true if accepted, false if dropped because it looked polluted.
-   */
-  addMessage(role: ChatMessage['role'], content: string): boolean {
-    if (role !== 'system' && looksPolluted(content)) {
-      this.droppedCount++;
-      // Keep a 1-line internal note so the user can see *something* happened,
-      // but the original polluted text does NOT go to the LLM context.
-      this.messages.push({
-        role: 'user',
-        content: '[system: dropped a polluted prior message containing "已中断" markers. Continue with the original task.]',
-        name: 'system'
-      });
-      return false;
-    }
-
-    this.messages.push({
-      role,
-      content,
-      name: role === 'user' ? 'user' : undefined
-    });
-    return true;
-  }
-
-  /**
-   * Add a message WITHOUT any sanitization (for trusted callers, e.g. system prompt)
-   */
-  addMessageRaw(role: ChatMessage['role'], content: string): void {
-    this.messages.push({ role, content });
-  }
-
-  /**
-   * How many polluted messages have we filtered out? Useful for debugging
-   * the "AI keeps saying interrupted" loop.
-   */
-  getDroppedCount(): number {
-    return this.droppedCount;
-  }
-
-  /**
-   * Return messages ready to send to the LLM.  We additionally dedupe
-   * adjacent identical assistant messages (a recovery hack against the
-   * "AI repeats the same paragraph each turn" loop).
-   */
-  getMessages(): ChatMessage[] {
-    const out: ChatMessage[] = [];
-    for (let i = 0; i < this.messages.length; i++) {
-      const m = this.messages[i];
-      const prev = out[out.length - 1];
-      if (
-        prev &&
-        m.role === 'assistant' &&
-        prev.role === 'assistant' &&
-        m.content.length > 0 &&
-        m.content === prev.content
-      ) {
-        // collapse identical neighbour
-        continue;
-      }
-      out.push(m);
-    }
-    return out;
-  }
-
-  /**
-   * Get message count (raw, includes internal notes)
-   */
-  getMessageCount(): number {
-    return this.messages.length;
-  }
-
-  /**
-   * Clear session history
-   */
-  clear(): void {
-    this.messages = [];
-    this.droppedCount = 0;
-  }
-
-  /**
-   * Get session info
-   */
-  getSession(): Session {
-    return {
-      id: this.sessionId,
-      messages: this.messages,
-      createdAt: this.createdAt,
-      lastActiveAt: new Date()
-    };
-  }
-
-  /**
-   * Truncate messages to fit token limit
-   */
-  truncate(maxMessages: number = 20): void {
-    if (this.messages.length > maxMessages) {
-      const systemMsg = this.messages.find(m => m.role === 'system');
-      const otherMsgs = this.messages.filter(m => m.role !== 'system');
-
-      this.messages = [
-        ...(systemMsg ? [systemMsg] : []),
-        ...otherMsgs.slice(-(maxMessages - 1))
-      ];
-    }
-  }
-
-  private generateId(): string {
-    return `session_${Date.now()}_${Math.random().toString(36).substring(2, 9)}`;
-  }
-}