tribunal-kit 6.0.1 → 8.0.0

package/bin/proxy-server.js

@@ -0,0 +1,113 @@
+const http = require('http');
+const https = require('https');
+const fs = require('fs');
+const path = require('path');
+const globalStore = require('./global-store');
+
+let proxyServer = null;
+
+function getSystemPrompt() {
+  const agentPath = globalStore.getGlobalAgentPath();
+  const rulesPath = path.join(agentPath, 'rules', 'GEMINI.md');
+
+  let rules = 'You are governed by Tribunal Kit rules.';
+  if (fs.existsSync(rulesPath)) {
+    rules = fs.readFileSync(rulesPath, 'utf8');
+  }
+
+  return `<tribunal_rules>\n${rules}\n</tribunal_rules>\n`;
+}
+
+function injectRulesIntoAnthropicPayload(payloadString) {
+  try {
+    const payload = JSON.parse(payloadString);
+
+    // Inject into Anthropic's system parameter
+    const tribunalSystem = getSystemPrompt();
+
+    if (payload.system) {
+      if (Array.isArray(payload.system)) {
+        payload.system.unshift({ type: 'text', text: tribunalSystem });
+      } else if (typeof payload.system === 'string') {
+        payload.system = tribunalSystem + '\n' + payload.system;
+      }
+    } else {
+      payload.system = tribunalSystem;
+    }
+
+    return JSON.stringify(payload);
+  } catch (e) {
+    console.error('[Tribunal Proxy] Failed to parse payload for injection:', e);
+    return payloadString;
+  }
+}
+
+function startProxyServer(port) {
+  return new Promise((resolve, reject) => {
+    proxyServer = http.createServer((clientReq, clientRes) => {
+      let body = '';
+      clientReq.on('data', chunk => {
+        body += chunk.toString();
+        // 5MB payload limit to prevent memory exhaustion (DoS)
+        if (body.length > 5 * 1024 * 1024) {
+          console.error('[Tribunal Proxy] Request too large, aborting.');
+          clientReq.destroy();
+        }
+      });
+
+      clientReq.on('end', () => {
+        let modifiedBody = body;
+
+        // Only intercept AI chat completion endpoints
+        if (clientReq.url.includes('/v1/messages')) {
+          console.log(`[Tribunal Proxy] Intercepting request to ${clientReq.url}`);
+          modifiedBody = injectRulesIntoAnthropicPayload(body);
+        }
+
+        const options = {
+          hostname: 'api.anthropic.com',
+          port: 443,
+          path: clientReq.url,
+          method: clientReq.method,
+          headers: {
+            ...clientReq.headers,
+            host: 'api.anthropic.com',
+            'content-length': Buffer.byteLength(modifiedBody),
+          },
+        };
+
+        const proxyReq = https.request(options, proxyRes => {
+          clientRes.writeHead(proxyRes.statusCode, proxyRes.headers);
+          proxyRes.pipe(clientRes, { end: true });
+        });
+
+        proxyReq.on('error', err => {
+          console.error('[Tribunal Proxy] Proxy request error:', err);
+          clientRes.writeHead(500);
+          clientRes.end();
+        });
+
+        proxyReq.write(modifiedBody);
+        proxyReq.end();
+      });
+    });
+
+    proxyServer.listen(port, () => {
+      console.log(`[Tribunal Proxy] Listening on http://localhost:${port}`);
+      resolve(port);
+    });
+
+    proxyServer.on('error', reject);
+  });
+}
+
+function stopProxyServer() {
+  if (proxyServer) {
+    proxyServer.close();
+  }
+}
+
+module.exports = {
+  startProxyServer,
+  stopProxyServer,
+};

package/bin/spawn-agent.js

@@ -0,0 +1,39 @@
+const { spawn } = require('child_process');
+
+function spawnAgent(agentCommand, proxyPort) {
+  const proxyUrl = `http://localhost:${proxyPort}`;
+  console.log(`[Tribunal Proxy] Launching ${agentCommand} with proxy ${proxyUrl}`);
+
+  // Split command and arguments. e.g. "claude-code" or "npx claude-code"
+  const args = agentCommand.split(' ');
+  const command = args.shift();
+
+  // Inject proxy environment variables
+  // ANTHROPIC_BASE_URL is commonly respected by Anthropic-based CLI tools
+  const env = {
+    ...process.env,
+    ANTHROPIC_BASE_URL: proxyUrl,
+    // Note: If using HTTPS_PROXY, it would look like this:
+    // HTTPS_PROXY: proxyUrl,
+    // NODE_TLS_REJECT_UNAUTHORIZED: "0"
+  };
+
+  const child = spawn(command, args, {
+    stdio: 'inherit', // Pass stdin, stdout, stderr directly to the TTY
+    env,
+  });
+
+  child.on('close', code => {
+    console.log(`[Tribunal Proxy] ${command} exited with code ${code}`);
+    process.exit(code);
+  });
+
+  child.on('error', err => {
+    console.error(`[Tribunal Proxy] Failed to start ${command}:`, err);
+    process.exit(1);
+  });
+}
+
+module.exports = {
+  spawnAgent,
+};

package/bin/tk-proxy.js

@@ -0,0 +1,34 @@
+#!/usr/bin/env node
+
+const { initializeGlobalStore } = require('./global-store');
+const { startProxyServer } = require('./proxy-server');
+const { spawnAgent } = require('./spawn-agent');
+
+async function main() {
+  const args = process.argv.slice(2);
+
+  if (args.length === 0) {
+    console.error('Usage: tk-proxy <command>');
+    console.error('Example: tk-proxy claude-code');
+    process.exit(1);
+  }
+
+  const targetCommand = args.join(' ');
+
+  // 1. Initialize the global rules database
+  initializeGlobalStore();
+
+  // 2. Start the local API proxy server
+  // Port 0 will pick an available random port
+  try {
+    const port = await startProxyServer(0);
+
+    // 3. Spawn the target CLI agent
+    spawnAgent(targetCommand, port);
+  } catch (e) {
+    console.error('[Tribunal Proxy] Fatal error starting proxy:', e);
+    process.exit(1);
+  }
+}
+
+main();

package/bin/tribunal-kit.js

@@ -26,31 +26,30 @@
  *   tribunal-kit uninstall
  */
 
-"use strict";
+'use strict';
 
-const path = require("path");
+const path = require('path');
 
 // Delegate core execution to the modular dist/ entry point
-const { main } = require("../dist/cli.js");
+const { main } = require('../dist/cli.js');
 
 // Utilities re-exported for backwards compatibility with tests
-const { compareSemver } = require("../dist/utils/version");
-const { copyDir, countDir, isSelfInstall: _isSelfInstall } = require("../dist/utils/fs");
-const { CORE_AGENTS, CORE_SKILLS, generateIDEBridges } = require("../dist/commands/init");
-const { cmdMarathon: _cmdMarathon } = require("../dist/commands/marathon");
+const { compareSemver } = require('../dist/utils/version');
+const { copyDir, countDir, isSelfInstall: _isSelfInstall } = require('../dist/utils/fs');
+const { CORE_AGENTS, CORE_SKILLS, generateIDEBridges } = require('../dist/commands/init');
+const { cmdMarathon: _cmdMarathon } = require('../dist/commands/marathon');
 
 function cmdMarathon(flags, processArgs = process.argv) {
   return _cmdMarathon(flags, processArgs, flags?.quiet || false);
 }
 
-
-const PKG = require(path.resolve(__dirname, "..", "package.json"));
+const PKG = require(path.resolve(__dirname, '..', 'package.json'));
 
 /**
  * Returns true if the target directory IS the tribunal-kit package itself.
  */
 function isSelfInstall(targetDir) {
-  const kitRoot = path.resolve(__dirname, "..");
+  const kitRoot = path.resolve(__dirname, '..');
   return _isSelfInstall(targetDir, PKG.name, kitRoot);
 }
 
@@ -63,31 +62,31 @@ function parseArgs(argv) {
 
   for (let i = 0; i < raw.length; i++) {
     const arg = raw[i];
-    if (!arg.startsWith("--") && !arg.startsWith("-") && !args.command) {
+    if (!arg.startsWith('--') && !arg.startsWith('-') && !args.command) {
       args.command = arg;
       continue;
     }
-    if (arg === "--force") args.flags.force = true;
-    else if (arg === "--quiet") args.flags.quiet = true;
-    else if (arg === "--verbose") args.flags.verbose = true;
-    else if (arg === "--dry-run") args.flags.dryRun = true;
-    else if (arg === "--minimal") args.flags.minimal = true;
-    else if (arg === "--token-optimized") args.flags.tokenOptimized = true;
-    else if (arg === "--skip-update-check") args.flags.skipUpdateCheck = true;
-    else if (arg === "--head") args.flags.head = true;
-    else if (arg.startsWith("--path=")) {
-      args.flags.path = arg.split("=").slice(1).join("=");
-    } else if (arg === "--path" && raw[i + 1] && !raw[i + 1].startsWith("-")) {
+    if (arg === '--force') args.flags.force = true;
+    else if (arg === '--quiet') args.flags.quiet = true;
+    else if (arg === '--verbose') args.flags.verbose = true;
+    else if (arg === '--dry-run') args.flags.dryRun = true;
+    else if (arg === '--minimal') args.flags.minimal = true;
+    else if (arg === '--token-optimized') args.flags.tokenOptimized = true;
+    else if (arg === '--skip-update-check') args.flags.skipUpdateCheck = true;
+    else if (arg === '--head') args.flags.head = true;
+    else if (arg.startsWith('--path=')) {
+      args.flags.path = arg.split('=').slice(1).join('=');
+    } else if (arg === '--path' && raw[i + 1] && !raw[i + 1].startsWith('-')) {
       args.flags.path = raw[++i];
-    } else if (arg.startsWith("--branch=")) {
-      args.flags.branch = arg.split("=").slice(1).join("=");
-    } else if (arg.startsWith("--log=")) {
-      args.flags.log = arg.split("=").slice(1).join("=");
-    } else if (arg === "--log" && raw[i + 1] && !raw[i + 1].startsWith("-")) {
+    } else if (arg.startsWith('--branch=')) {
+      args.flags.branch = arg.split('=').slice(1).join('=');
+    } else if (arg.startsWith('--log=')) {
+      args.flags.log = arg.split('=').slice(1).join('=');
+    } else if (arg === '--log' && raw[i + 1] && !raw[i + 1].startsWith('-')) {
       args.flags.log = raw[++i];
-    } else if (arg.startsWith("--strategy=")) {
-      args.flags.strategy = arg.split("=").slice(1).join("=");
-    } else if (arg === "--strategy" && raw[i + 1] && !raw[i + 1].startsWith("-")) {
+    } else if (arg.startsWith('--strategy=')) {
+      args.flags.strategy = arg.split('=').slice(1).join('=');
+    } else if (arg === '--strategy' && raw[i + 1] && !raw[i + 1].startsWith('-')) {
       args.flags.strategy = raw[++i];
     }
   }

package/bin/wrapper.js

@@ -7,34 +7,33 @@
  * falls back to the original JavaScript implementation.
  */
 
-const fs = require("fs");
-const path = require("path");
-const { spawnSync } = require("child_process");
-const os = require("os");
+const fs = require('fs');
+const path = require('path');
+const { spawnSync } = require('child_process');
+const os = require('os');
 
 // Commands that have been fully ported to Rust so far
 const RUST_COMMANDS = new Set([
-  "init",
-  "validate",
-  "status",
-  "sync",
-  "hook",
-  "uninstall",
-  "memory",
-  "min-context",
-  "dag-schedule",
-  "context-compress",
-  "context-broker",
-  "optimize-step",
-  "impact-tier",
+  'init',
+  'validate',
+  'status',
+  'sync',
+  'hook',
+  'uninstall',
+  'memory',
+  'min-context',
+  'dag-schedule',
+  'context-compress',
+  'context-broker',
+  'optimize-step',
+  'impact-tier',
 ]);
 
-
 // Determine the path to the compiled Rust binary
 // In a full production release, this checks optionalDependencies in node_modules
 // For development, it checks the local target/release folder
 function getBinaryPath() {
-  if (process.env.TRIBUNAL_FORCE_JS === "1") {
+  if (process.env.TRIBUNAL_FORCE_JS === '1') {
     return null;
   }
 
@@ -42,8 +41,8 @@ function getBinaryPath() {
     return process.env.TRIBUNAL_CORE_PATH;
   }
 
-  const isWindows = os.platform() === "win32";
-  const ext = isWindows ? ".exe" : "";
+  const isWindows = os.platform() === 'win32';
+  const ext = isWindows ? '.exe' : '';
   const platform = os.platform();
   const arch = os.arch();
 
@@ -66,14 +65,14 @@ function getBinaryPath() {
 
   // Second, try to find the binary in local dev target directories
   const candidatePaths = [
-    path.resolve(__dirname, "..", "target", "release", `tribunal-core${ext}`),
-    path.resolve(__dirname, "..", "target", "debug", `tribunal-core${ext}`),
-    path.resolve(__dirname, "..", "..", "target", "release", `tribunal-core${ext}`),
-    path.resolve(__dirname, "..", "..", "target", "debug", `tribunal-core${ext}`),
-    path.resolve(process.cwd(), "target", "release", `tribunal-core${ext}`),
-    path.resolve(process.cwd(), "target", "debug", `tribunal-core${ext}`),
-    path.resolve(process.cwd(), "tribunal-kit", "target", "release", `tribunal-core${ext}`),
-    path.resolve(process.cwd(), "tribunal-kit", "target", "debug", `tribunal-core${ext}`),
+    path.resolve(__dirname, '..', 'target', 'release', `tribunal-core${ext}`),
+    path.resolve(__dirname, '..', 'target', 'debug', `tribunal-core${ext}`),
+    path.resolve(__dirname, '..', '..', 'target', 'release', `tribunal-core${ext}`),
+    path.resolve(__dirname, '..', '..', 'target', 'debug', `tribunal-core${ext}`),
+    path.resolve(process.cwd(), 'target', 'release', `tribunal-core${ext}`),
+    path.resolve(process.cwd(), 'target', 'debug', `tribunal-core${ext}`),
+    path.resolve(process.cwd(), 'tribunal-kit', 'target', 'release', `tribunal-core${ext}`),
+    path.resolve(process.cwd(), 'tribunal-kit', 'target', 'debug', `tribunal-core${ext}`),
   ];
 
   for (const candidate of candidatePaths) {
@@ -83,12 +82,12 @@ function getBinaryPath() {
   }
 
   // Third, attempt on-demand compilation if Cargo.toml exists locally and cargo is installed
-  const cargoTomlPath = path.resolve(__dirname, "..", "Cargo.toml");
+  const cargoTomlPath = path.resolve(__dirname, '..', 'Cargo.toml');
   if (fs.existsSync(cargoTomlPath)) {
     try {
-      const buildResult = spawnSync("cargo", ["build", "--release"], {
-        cwd: path.resolve(__dirname, ".."),
-        stdio: "ignore",
+      const buildResult = spawnSync('cargo', ['build', '--release'], {
+        cwd: path.resolve(__dirname, '..'),
+        stdio: 'ignore',
         timeout: 60000,
       });
       if (buildResult.status === 0) {
@@ -105,13 +104,8 @@ function getBinaryPath() {
   return null;
 }
 
-
 function runRustBinary(binPath, args) {
-  const stdio = [
-    "inherit",
-    "inherit",
-    "inherit",
-  ];
+  const stdio = ['inherit', 'inherit', 'inherit'];
   const result = spawnSync(binPath, args, {
     stdio: stdio,
     env: process.env,
@@ -133,8 +127,8 @@ function runRustBinary(binPath, args) {
 function runLegacyFallback() {
   // Use the modular dist/ CLI with lazy-loaded commands for faster cold-start.
   // Each command module is require()'d only when invoked (~70% fewer files loaded).
-  const { main } = require("../dist/cli.js");
-  main().catch((err) => {
+  const { main } = require('../dist/cli.js');
+  main().catch(err => {
     console.error(`\x1b[91m✖ Fatal Error:\x1b[0m ${err.message || err}`);
     process.exit(1);
   });
@@ -145,16 +139,16 @@ function main() {
   const args = process.argv.slice(2);
 
   // Extract the command (the first non-flag argument)
-  const command = args.find((a) => !a.startsWith("-"));
+  const command = args.find(a => !a.startsWith('-'));
 
   if (command && RUST_COMMANDS.has(command)) {
     const binPath = getBinaryPath();
 
     if (binPath) {
       // For the init command, Rust needs to know where the .agent template folder is.
-      if (command === "init") {
-        const sourceDir = path.resolve(__dirname, "..", ".agent");
-        args.push("--source-dir", sourceDir);
+      if (command === 'init') {
+        const sourceDir = path.resolve(__dirname, '..', '.agent');
+        args.push('--source-dir', sourceDir);
       }
 
       // Route to Rust engine
@@ -168,7 +162,7 @@ function main() {
       // Warn if Rust command was requested but binary is missing (in verbose mode)
       if (process.env.TK_VERBOSE || process.env.VERBOSE) {
         console.warn(
-          "\x1b[93m⚠ Rust binary not found in target/. Falling back to JS engine.\x1b[0m",
+          '\x1b[93m⚠ Rust binary not found in target/. Falling back to JS engine.\x1b[0m',
         );
       }
     }

package/dist/cli.js

@@ -121,6 +121,7 @@ function cmdHelp(quiet = false) {
     (0, logger_1.log)(cmd('context-compress', 'Compress a context file while retaining VERIFY comments'));
     (0, logger_1.log)(cmd('optimize-step', 'Apply bounded SkillOpt edits from a JSON payload'));
     (0, logger_1.log)(cmd('guardrail', 'Validate .agent/ integrity (phantom refs, count mismatches, drift)'));
+    (0, logger_1.log)(cmd('contract', 'AI Agent Behavioral Contract Testing (init, verify, list, trace, replay)'));
     (0, logger_1.log)(cmd('impact-tier', 'Classify task governance impact tier (0-3)'));
     (0, logger_1.log)(cmd('uninstall', 'Remove .agent/ folder from project'));
     console.log();
@@ -288,6 +289,11 @@ async function runWithUpdateCheck(command, flags) {
             await cmdGuardrail(flags, process.argv, quiet);
             break;
         }
+        case 'contract': {
+            const cmdContract = loadCmd('./commands/contract', 'cmdContract');
+            await cmdContract(flags, process.argv, quiet);
+            break;
+        }
         case 'validate': {
             const cmdValidate = loadCmd('./commands/validate', 'cmdValidate');
             cmdValidate(flags, process.argv, quiet);

package/dist/commands/case.js

@@ -59,6 +59,8 @@ async function cmdCase(flags, processArgs, quiet = false) {
                 );
                 if (!quiet) {
                     (0, logger_1.log)(`  ${(0, logger_1.c)('cyan', '\u25b8')} Memory bridge: case law rejection stored to memory index`);
+                    (0, logger_1.log)(`  ${(0, logger_1.c)('gray', '💡')} Tip: Auto-generate a behavioral contract to prevent recurrence:`);
+                    (0, logger_1.log)(`     ${(0, logger_1.c)('cyan', 'tk contract generate --from-case latest')}`);
                 }
             } catch {
                 // Non-critical — case law was still saved, memory bridge is a bonus