thoth-agents 0.9.7 → 0.9.9

package/dist/chunk-RWQPMWEM.js

@@ -0,0 +1,624 @@
+// skills/thoth-sdd/scripts/validate-result.mjs
+import { readFileSync, realpathSync } from "fs";
+import { isAbsolute, relative, resolve, sep } from "path";
+import { fileURLToPath } from "url";
+
+// skills/thoth-sdd/scripts/record-digest.mjs
+import { createHash } from "crypto";
+function recordPrefixSha256(text) {
+  let offset = 0;
+  for (const raw of text.split(/(?<=\n)/)) {
+    let line = raw.replace(/\r?\n$/, "");
+    if (offset === 0) line = line.replace(/^\uFEFF/, "");
+    if (line === "## Authorization") break;
+    offset += raw.length;
+  }
+  return createHash("sha256").update(text.slice(0, offset), "utf8").digest("hex");
+}
+
+// skills/thoth-sdd/scripts/result-contract.json
+var result_contract_default = {
+  schemaVersion: 1,
+  fence: "thoth-result",
+  common: {
+    type: "object",
+    properties: {
+      schemaVersion: {
+        type: "number",
+        const: 1
+      },
+      role: {
+        type: "string",
+        enum: ["oracle"]
+      },
+      status: {
+        type: "string",
+        enum: ["complete", "partial", "blocked", "failed"]
+      },
+      conclusion: {
+        type: "string"
+      },
+      evidence: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            id: {
+              type: "string",
+              minLength: 1
+            },
+            kind: {
+              type: "string"
+            },
+            locator: {
+              type: "string"
+            },
+            claim: {
+              type: "string"
+            },
+            basis: {
+              type: "string",
+              enum: ["observed", "inferred"]
+            },
+            uncertainty: {
+              type: "string"
+            }
+          },
+          required: [
+            "id",
+            "kind",
+            "locator",
+            "claim",
+            "basis",
+            "uncertainty"
+          ],
+          additionalProperties: false
+        }
+      },
+      verification: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            check: {
+              type: "string"
+            },
+            method: {
+              type: "string"
+            },
+            outcome: {
+              type: "string",
+              enum: ["pass", "fail", "not-run"]
+            },
+            evidenceIds: {
+              type: "array",
+              items: {
+                type: "string"
+              }
+            },
+            reason: {
+              type: "string"
+            }
+          },
+          required: ["check", "method", "outcome", "evidenceIds", "reason"],
+          additionalProperties: false
+        }
+      },
+      risks: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            description: {
+              type: "string"
+            },
+            severity: {
+              type: "string",
+              enum: ["low", "medium", "high", "critical"]
+            },
+            blocking: {
+              type: "boolean"
+            },
+            evidenceIds: {
+              type: "array",
+              items: {
+                type: "string"
+              }
+            }
+          },
+          required: ["description", "severity", "blocking", "evidenceIds"],
+          additionalProperties: false
+        }
+      },
+      openQuestions: {
+        type: "array",
+        items: {
+          type: "object",
+          properties: {
+            question: {
+              type: "string"
+            },
+            owner: {
+              type: "string"
+            },
+            options: {
+              type: "array",
+              items: {
+                type: "string"
+              }
+            },
+            facts: {
+              type: "array",
+              items: {
+                type: "string"
+              }
+            }
+          },
+          required: ["question", "owner", "options", "facts"],
+          additionalProperties: false
+        }
+      }
+    },
+    required: [
+      "schemaVersion",
+      "role",
+      "status",
+      "conclusion",
+      "evidence",
+      "verification",
+      "risks",
+      "openQuestions"
+    ],
+    additionalProperties: false
+  },
+  roles: {
+    oracle: {
+      type: "object",
+      properties: {
+        nextAction: {
+          type: ["string", "null"]
+        },
+        review: {
+          type: "object",
+          properties: {
+            kind: {
+              type: "string",
+              enum: ["plan-review", "final-verification"]
+            },
+            verdict: {
+              type: "string"
+            },
+            reviewedRecord: {
+              type: "string",
+              minLength: 1
+            },
+            reviewedRecordSha256: {
+              type: "string",
+              pattern: "^[a-f0-9]{64}$"
+            }
+          },
+          required: ["kind", "verdict"],
+          additionalProperties: false
+        }
+      },
+      required: ["nextAction", "review"],
+      additionalProperties: false
+    }
+  },
+  reviewKinds: {
+    "plan-review": {
+      verdicts: ["OKAY", "REJECT"]
+    },
+    "final-verification": {
+      verdicts: ["PASS", "FAIL", "BLOCKED"]
+    }
+  },
+  rules: {
+    positiveVerdicts: ["OKAY", "PASS"],
+    positiveStatus: "complete",
+    positiveAllowsBlockingRisks: false,
+    evidenceIdUnique: true,
+    evidenceReferences: ["verification", "risks"],
+    recordBindingReviewKind: "final-verification",
+    recordBindingRequiredFields: ["reviewedRecord", "reviewedRecordSha256"],
+    recordBindingForbiddenUnderNoRecord: [
+      "reviewedRecord",
+      "reviewedRecordSha256"
+    ]
+  }
+};
+
+// skills/thoth-sdd/scripts/validate-result.mjs
+var childPath = (path, key) => `${path}/${String(key).replaceAll("~", "~0").replaceAll("/", "~1")}`;
+function parseStrictJSON(source) {
+  let cursor = 0;
+  const fail = (code, path, message) => {
+    throw { code, path, message };
+  };
+  const whitespace = () => {
+    while (/[\t\n\r ]/.test(source[cursor] ?? "\0")) cursor++;
+  };
+  const syntax = (path) => fail("JSON_SYNTAX", path, `Invalid JSON at offset ${cursor}.`);
+  function string(path) {
+    const start = cursor++;
+    while (cursor < source.length) {
+      const char = source[cursor++];
+      if (char === "\\") cursor++;
+      else if (char === '"') {
+        try {
+          return JSON.parse(source.slice(start, cursor));
+        } catch {
+          syntax(path);
+        }
+      }
+    }
+    syntax(path);
+  }
+  function value(path, depth) {
+    if (depth > 256)
+      fail("JSON_SYNTAX", path, "JSON nesting exceeds 256 levels.");
+    whitespace();
+    const char = source[cursor];
+    if (char === '"') return string(path);
+    if (char === "{" || char === "[") {
+      const isObject = char === "{";
+      const close = isObject ? "}" : "]";
+      const result3 = isObject ? /* @__PURE__ */ Object.create(null) : [];
+      const keys = /* @__PURE__ */ new Set();
+      cursor++;
+      whitespace();
+      if (source[cursor] === close) {
+        cursor++;
+        return result3;
+      }
+      for (; ; ) {
+        let key = result3.length;
+        if (isObject) {
+          if (source[cursor] !== '"') syntax(path);
+          key = string(path);
+          if (keys.has(key))
+            fail(
+              "JSON_DUPLICATE_KEY",
+              childPath(path, key),
+              `Duplicate key ${JSON.stringify(key)}.`
+            );
+          keys.add(key);
+          whitespace();
+          if (source[cursor++] !== ":") syntax(path);
+        }
+        result3[key] = value(childPath(path, key), depth + 1);
+        whitespace();
+        if (source[cursor] === close) {
+          cursor++;
+          return result3;
+        }
+        if (source[cursor++] !== ",") syntax(path);
+        whitespace();
+      }
+    }
+    const token = /^(?:true|false|null|-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?)/.exec(
+      source.slice(cursor)
+    );
+    if (!token) syntax(path);
+    cursor += token[0].length;
+    const result2 = JSON.parse(token[0]);
+    if (typeof result2 === "number" && !Number.isFinite(result2)) syntax(path);
+    return result2;
+  }
+  const result = value("", 0);
+  whitespace();
+  if (cursor !== source.length) syntax("");
+  return result;
+}
+function checkExpectations(options, issue) {
+  if (options.noRecord && (options.recordSha256 !== void 0 || options.reviewKind !== void 0 && options.reviewKind !== result_contract_default.rules.recordBindingReviewKind))
+    issue(
+      "EXPECTATION_INVALID",
+      "",
+      "No-record mode requires final-verification without an expected digest."
+    );
+  const expectations = [
+    ["role", Object.keys(result_contract_default.roles)],
+    ["reviewKind", Object.keys(result_contract_default.reviewKinds)]
+  ];
+  for (const [key, values] of expectations) {
+    if (options[key] !== void 0 && !values.includes(options[key]))
+      issue("EXPECTATION_INVALID", "", `Unknown expected ${key}.`);
+  }
+  if (options.recordSha256 !== void 0 && !/^[a-f0-9]{64}$/.test(options.recordSha256))
+    issue(
+      "EXPECTATION_INVALID",
+      "",
+      "Expected digest must be 64 lowercase hex characters."
+    );
+}
+function parseEnvelope(message) {
+  const trimmed = typeof message === "string" ? message.trim() : "";
+  const block = new RegExp(
+    `^\`\`\`${result_contract_default.fence}\\r?\\n([\\s\\S]*?)\\r?\\n\`\`\`$`
+  ).exec(trimmed);
+  if (!block || (trimmed.match(/^```.*$/gm) ?? []).length !== 2) {
+    return {
+      issues: [
+        {
+          code: "ENVELOPE_FORMAT",
+          path: "",
+          message: "Expected exactly one thoth-result fence and no surrounding prose."
+        }
+      ]
+    };
+  }
+  try {
+    return { envelope: parseStrictJSON(block[1]), issues: [] };
+  } catch (error) {
+    return { issues: [error] };
+  }
+}
+function validateEnvelope(parsed, options) {
+  const issues = [];
+  const issue = (code, path, text) => issues.push({ code, path, message: text });
+  const invalid = () => ({ valid: false, issues });
+  checkExpectations(options, issue);
+  if (issues.length) return invalid();
+  if (parsed.issues.length) return { valid: false, issues: parsed.issues };
+  const { envelope } = parsed;
+  function check(value, schema, path) {
+    const type = value === null ? "null" : Array.isArray(value) ? "array" : typeof value;
+    const types = Array.isArray(schema.type) ? schema.type : [schema.type];
+    if (!types.includes(type)) {
+      issue("TYPE_MISMATCH", path, `Expected ${types.join(" or ")}.`);
+      return;
+    }
+    if ("const" in schema && value !== schema.const)
+      issue("INVALID_VALUE", path, "Value differs from required constant.");
+    if (schema.enum && !schema.enum.includes(value))
+      issue("INVALID_VALUE", path, "Value is not in the allowed enumeration.");
+    if (type === "string") {
+      if (schema.minLength && value.length < schema.minLength)
+        issue("INVALID_VALUE", path, "String must not be empty.");
+      if (schema.pattern && !new RegExp(schema.pattern).test(value))
+        issue(
+          "INVALID_VALUE",
+          path,
+          "String does not match the required pattern."
+        );
+    }
+    if (type === "array") {
+      value.forEach((item, index) => {
+        check(item, schema.items, childPath(path, index));
+      });
+    }
+    if (type === "object") {
+      for (const key of schema.required)
+        if (!Object.hasOwn(value, key))
+          issue(
+            "REQUIRED_FIELD",
+            childPath(path, key),
+            "Required field is missing."
+          );
+      for (const key of Object.keys(value)) {
+        if (!Object.hasOwn(schema.properties, key))
+          issue(
+            "UNDECLARED_FIELD",
+            childPath(path, key),
+            "Undeclared field is forbidden."
+          );
+        else check(value[key], schema.properties[key], childPath(path, key));
+      }
+    }
+  }
+  const roleSchema = envelope && typeof envelope.role === "string" && Object.hasOwn(result_contract_default.roles, envelope.role) ? result_contract_default.roles[envelope.role] : { properties: {}, required: [] };
+  check(
+    envelope,
+    {
+      ...result_contract_default.common,
+      properties: { ...result_contract_default.common.properties, ...roleSchema.properties },
+      required: [...result_contract_default.common.required, ...roleSchema.required]
+    },
+    ""
+  );
+  if (issues.length) return invalid();
+  if (options.noRecord && envelope.review.kind !== result_contract_default.rules.recordBindingReviewKind) {
+    issue(
+      "EXPECTATION_INVALID",
+      "/review/kind",
+      "No-record mode requires final-verification."
+    );
+    return invalid();
+  }
+  if (options.role && envelope.role !== options.role)
+    issue("ROLE_MISMATCH", "/role", "Role does not match assignment.");
+  if (options.reviewKind && envelope.review.kind !== options.reviewKind)
+    issue(
+      "REVIEW_KIND_MISMATCH",
+      "/review/kind",
+      "Review kind does not match assignment."
+    );
+  const ids = /* @__PURE__ */ new Set();
+  envelope.evidence.forEach((entry, index) => {
+    if (result_contract_default.rules.evidenceIdUnique && ids.has(entry.id))
+      issue(
+        "EVIDENCE_ID_DUPLICATE",
+        `/evidence/${index}/id`,
+        "Evidence ids must be unique."
+      );
+    ids.add(entry.id);
+  });
+  for (const field of result_contract_default.rules.evidenceReferences) {
+    envelope[field].forEach((entry, index) => {
+      entry.evidenceIds.forEach((id, ref) => {
+        if (!ids.has(id))
+          issue(
+            "EVIDENCE_REFERENCE",
+            `/${field}/${index}/evidenceIds/${ref}`,
+            "Reference does not identify supplied evidence."
+          );
+      });
+    });
+  }
+  const { kind, verdict } = envelope.review;
+  if (!result_contract_default.reviewKinds[kind].verdicts.includes(verdict))
+    issue(
+      "VERDICT_MISMATCH",
+      "/review/verdict",
+      "Verdict is not allowed for this review kind."
+    );
+  if (result_contract_default.rules.positiveVerdicts.includes(verdict)) {
+    if (envelope.status !== result_contract_default.rules.positiveStatus)
+      issue(
+        "VERDICT_STATUS",
+        "/status",
+        "Positive verdict requires complete status."
+      );
+    envelope.risks.forEach((risk, index) => {
+      if (!result_contract_default.rules.positiveAllowsBlockingRisks && risk.blocking)
+        issue(
+          "BLOCKING_RISK",
+          `/risks/${index}/blocking`,
+          "Positive verdict forbids blocking risks."
+        );
+    });
+  }
+  if (options.noRecord) {
+    for (const key of result_contract_default.rules.recordBindingForbiddenUnderNoRecord) {
+      if (Object.hasOwn(envelope.review, key))
+        issue(
+          "RECORD_BINDING_FORBIDDEN",
+          `/review/${key}`,
+          "No-record mode forbids reviewed record binding."
+        );
+    }
+  } else if (envelope.review.kind === result_contract_default.rules.recordBindingReviewKind) {
+    for (const key of result_contract_default.rules.recordBindingRequiredFields) {
+      if (!envelope.review[key])
+        issue(
+          "RECORD_BINDING_REQUIRED",
+          `/review/${key}`,
+          "Final verification requires reviewed record binding."
+        );
+    }
+  }
+  if (options.recordSha256 !== void 0) {
+    if (envelope.review.kind !== result_contract_default.rules.recordBindingReviewKind)
+      issue(
+        "REVIEW_KIND_MISMATCH",
+        "/review/kind",
+        "Record binding requires final-verification."
+      );
+    if (envelope.review.reviewedRecordSha256 && envelope.review.reviewedRecordSha256 !== options.recordSha256)
+      issue(
+        "RECORD_DIGEST_MISMATCH",
+        "/review/reviewedRecordSha256",
+        "Digest does not match assignment."
+      );
+  }
+  return issues.length ? invalid() : { valid: true, envelope, issues };
+}
+var stringOrNull = (value) => typeof value === "string" ? value : null;
+function gateMode(envelope) {
+  const review = envelope?.review;
+  return review?.kind === result_contract_default.rules.recordBindingReviewKind && result_contract_default.rules.recordBindingRequiredFields.every(
+    (key) => !Object.hasOwn(review, key)
+  ) ? "no-record" : "record";
+}
+function recordDigest(review, cwd) {
+  if (!review || !Object.hasOwn(review, "reviewedRecordSha256")) return "none";
+  if (!cwd || typeof review.reviewedRecord !== "string") return "unavailable";
+  const inside = (root, path) => {
+    const fromRoot = relative(root, path);
+    return fromRoot !== ".." && !fromRoot.startsWith(`..${sep}`) && !isAbsolute(fromRoot);
+  };
+  try {
+    const root = resolve(cwd);
+    const path = resolve(root, review.reviewedRecord);
+    if (!inside(root, path) || !inside(realpathSync(root), realpathSync(path)))
+      return "unavailable";
+    return recordPrefixSha256(readFileSync(path, "utf8")) === review.reviewedRecordSha256 ? "match" : "mismatch";
+  } catch {
+    return "unavailable";
+  }
+}
+function summarizeValidation(envelope, result, cwd) {
+  const review = envelope?.review;
+  return {
+    valid: result.valid,
+    role: stringOrNull(envelope?.role),
+    kind: stringOrNull(review?.kind),
+    verdict: stringOrNull(review?.verdict),
+    mode: gateMode(envelope),
+    record: stringOrNull(review?.reviewedRecord),
+    recordSha256: stringOrNull(review?.reviewedRecordSha256),
+    recordDigest: recordDigest(review, cwd),
+    issues: result.issues.map(({ code, path }) => ({ code, path }))
+  };
+}
+function summarizeGateResult(message, { cwd } = {}) {
+  const parsed = parseEnvelope(message);
+  return summarizeValidation(
+    parsed.envelope,
+    validateEnvelope(parsed, {
+      noRecord: gateMode(parsed.envelope) === "no-record"
+    }),
+    cwd
+  );
+}
+function formatGateVerdict(summary) {
+  return `thoth-gate-verdict ${JSON.stringify(summary)}`;
+}
+function main(args) {
+  const print = (result2, envelope) => console.log(
+    JSON.stringify(summarizeValidation(envelope, result2, process.cwd()))
+  );
+  const options = {};
+  let input;
+  const names = {
+    "--role": "role",
+    "--review-kind": "reviewKind",
+    "--record-sha256": "recordSha256",
+    "--no-record": "noRecord",
+    "--input": "input"
+  };
+  const seen = /* @__PURE__ */ new Set();
+  for (let index = 0; index < args.length; index++) {
+    const flag = args[index];
+    if (!Object.hasOwn(names, flag) || seen.has(flag) || flag !== "--no-record" && (!args[index + 1] || args[index + 1].startsWith("--"))) {
+      print({ valid: false, issues: [{ code: "CLI_USAGE", path: "" }] });
+      return 2;
+    }
+    seen.add(flag);
+    if (flag === "--no-record") {
+      options.noRecord = true;
+      continue;
+    }
+    const value = args[++index];
+    if (flag === "--input") input = value;
+    else options[names[flag]] = value;
+  }
+  const expectationIssues = [];
+  checkExpectations(options, (code, path, message2) => {
+    expectationIssues.push({ code, path, message: message2 });
+  });
+  if (expectationIssues.length) {
+    print({ valid: false, issues: expectationIssues });
+    return 2;
+  }
+  let message;
+  try {
+    message = readFileSync(input ?? 0, "utf8");
+  } catch {
+    print({ valid: false, issues: [{ code: "CLI_INPUT", path: "" }] });
+    return 2;
+  }
+  const parsed = parseEnvelope(message);
+  const result = validateEnvelope(parsed, options);
+  print(result, parsed.envelope);
+  if (result.valid) return 0;
+  return result.issues.some((issue) => issue.code === "EXPECTATION_INVALID") ? 2 : 1;
+}
+if (import.meta.url.endsWith("/validate-result.mjs") && process.argv[1] && resolve(process.argv[1]) === fileURLToPath(import.meta.url))
+  process.exitCode = main(process.argv.slice(2));
+
+export {
+  summarizeGateResult,
+  formatGateVerdict
+};

package/dist/{chunk-QQV5S3TW.js → chunk-VHQMTZ5O.js}

@@ -19,7 +19,7 @@ import {
   renderAgentRoutingDescription,
   renderPromptSection,
   renderRolePrompt
-} from "./chunk-ARUBELNT.js";
+} from "./chunk-RVQ6IIBR.js";
 
 // src/harness/writers/pi-agent.ts
 var PI_MANAGED_OWNER = "thoth-agents";
@@ -63,7 +63,6 @@ function renderPiAgentDefinition(input) {
     ...input.model ? [`model: ${yamlScalar(input.model)}`] : [],
     ...input.effort ? [`effort: ${yamlScalar(input.effort)}`] : [],
     ...input.skills !== void 0 ? [`skills: ${JSON.stringify(input.skills)}`] : [],
-    `subagent_mode: ${yamlScalar(input.subagentMode)}`,
     `managed-by: ${PI_MANAGED_OWNER}`,
     "---",
     "",
@@ -263,8 +262,7 @@ function readOwnedPiSpecialistDefinition(piRoot, role) {
     "model",
     "effort",
     "thinking",
-    "tools",
-    "subagent_mode"
+    "tools"
   ]) {
     if ([...frontmatter(content).matchAll(new RegExp(`^${name}:`, "gm"))].length > 1) {
       throw new Error(`Duplicate ${name} in managed Pi definition: ${path}`);
@@ -380,7 +378,7 @@ function parseFrontmatter(content) {
   });
   const mapping = document.contents;
   if (isMap(mapping)) {
-    for (const name of ["tools", "disallowed_tools", "subagent_mode"]) {
+    for (const name of ["tools", "disallowed_tools"]) {
       const occurrences = mapping.items.filter(
         ({ key }) => isScalar(key) && key.value === name
       );
@@ -517,23 +515,13 @@ function parseDisallowedToolsField(mapping, source) {
   }
   return [...new Set(tools)];
 }
-function parseModeField(mapping, source) {
-  const pair = fieldPair(mapping, "subagent_mode");
-  if (!pair) return void 0;
-  const mode = scalarString(pair.value, "subagent_mode", source);
-  if (mode !== "task" && mode !== "background")
-    throw new Error('Invalid subagent_mode; expected "task" or "background".');
-  return mode;
-}
 function readPiSpecialistToolOverrides(content) {
   const { mapping, source } = parseFrontmatter(content);
   const parsedTools = parseToolsField(mapping, source);
   const disallowedTools = parseDisallowedToolsField(mapping, source);
-  const subagentMode = parseModeField(mapping, source);
   return {
     ...parsedTools.present ? { tools: parsedTools.tools } : {},
-    ...disallowedTools !== void 0 ? { disallowedTools } : {},
-    ...subagentMode ? { subagentMode } : {}
+    ...disallowedTools !== void 0 ? { disallowedTools } : {}
   };
 }
 function createPiToolsPanelAdapter(piRoot) {
@@ -641,12 +629,6 @@ function preserveOverrides(next, current, role) {
       "disallowed_tools",
       JSON.stringify(toolOverrides.disallowedTools.join(", "))
     );
-  if (toolOverrides.subagentMode)
-    frontmatter2 = replaceField2(
-      frontmatter2,
-      "subagent_mode",
-      JSON.stringify(toolOverrides.subagentMode)
-    );
   return `${frontmatter2}${next.slice(end)}`;
 }
 function syncPiSpecialists(options) {
@@ -702,7 +684,7 @@ function syncPiSpecialists(options) {
           content = preserveOverrides(content, current, role);
         } catch (error) {
           diagnostics2.push(
-            `Preserved ${name} unchanged because its tool, disallowed_tools, skills, or mode override is malformed: ${error instanceof Error ? error.message : String(error)}. Fix the frontmatter explicitly before synchronizing this role.`
+            `Preserved ${name} unchanged because its tool, disallowed_tools, or skills override is malformed: ${error instanceof Error ? error.message : String(error)}. Fix the frontmatter explicitly before synchronizing this role.`
           );
           continue;
         }
@@ -818,7 +800,6 @@ function roleArtifacts(config) {
           role: { ...role, name: role.name },
           model,
           effort: override ? void 0 : preset.effort,
-          subagentMode: "background",
           skills: config?.agents?.[role.name]?.skills,
           description: renderAgentRoutingDescription(role),
           instructions: [