tribunal-kit 7.0.0 → 8.0.0

package/.agent/scripts/payload_schemas.js

@@ -0,0 +1,146 @@
+const { z } = require('zod');
+
+// Worker Request Schema
+const WorkerRequestSchema = z.object({
+  task_id: z.string().min(1, 'task_id must be a non-empty string'),
+  type: z.enum(
+    [
+      'research',
+      'generate_code',
+      'review_code',
+      'debug',
+      'plan',
+      'design_schema',
+      'write_docs',
+      'security_audit',
+      'optimize',
+      'test',
+    ],
+    'type must be a valid worker type',
+  ),
+  agent: z.string().min(1, 'agent must be a non-empty string'),
+  goal: z
+    .string()
+    .min(1, 'goal must be a non-empty string')
+    .max(200, 'goal must not exceed 200 characters (keep it to a single, focused sentence)'),
+  context: z
+    .string()
+    .min(1, 'context must be a non-empty string')
+    .max(800, 'context must not exceed 800 characters (trim to minimal required context only)'),
+  max_retries: z
+    .number()
+    .int('max_retries must be an integer')
+    .min(1, 'max_retries must be at least 1')
+    .max(3, 'max_retries must be at most 3')
+    .optional()
+    .default(3),
+  files_attached: z
+    .array(z.string())
+    .optional()
+    .default([])
+    .describe('List of file paths to attach to the worker'),
+  priority: z
+    .enum(['low', 'medium', 'high'])
+    .optional()
+    .default('medium')
+    .describe('Task priority level'),
+  metadata: z.record(z.unknown()).optional().describe('Additional metadata for the worker'),
+});
+
+// Worker Result Schema
+const WorkerResultSchema = z.object({
+  task_id: z.string().min(1, 'task_id must be a non-empty string'),
+  agent: z.string().min(1, 'agent must be a non-empty string'),
+  status: z.enum(
+    ['success', 'failure', 'escalate'],
+    'status must be one of: success, failure, escalate',
+  ),
+  output: z
+    .string()
+    .optional()
+    .describe('Output generated by the worker (required for success status)'),
+  error: z.string().optional().describe('Error message (required for failure or escalate status)'),
+  attempts: z
+    .number()
+    .int('attempts must be an integer')
+    .min(1, 'attempts must be at least 1')
+    .optional(),
+  duration: z.number().int('duration must be an integer (milliseconds)').optional(),
+  findings: z
+    .array(z.string())
+    .optional()
+    .default([])
+    .describe('List of findings or issues discovered'),
+  suggestions: z
+    .array(z.string())
+    .optional()
+    .default([])
+    .describe('List of suggestions or recommendations'),
+});
+
+// Swarm Payload Schema
+const SwarmPayloadSchema = z.object({
+  workers: z
+    .array(WorkerRequestSchema)
+    .min(1, 'Must have at least one worker')
+    .max(28, 'Maximum 28 workers allowed per swarm (for full tribunal)'),
+  wave: z
+    .enum(['wave-1-core', 'wave-2-security', 'wave-3-domain', 'full'])
+    .optional()
+    .default('full')
+    .describe('Which tribunal wave to execute'),
+  shared_context: z
+    .record(z.unknown())
+    .optional()
+    .describe('Context shared between all workers in the swarm'),
+  metadata: z
+    .record(z.unknown())
+    .optional()
+    .describe('Additional metadata for the swarm execution'),
+});
+
+/**
+ * Validate a payload against a Zod schema
+ * @param {Object} payload - The payload to validate
+ * @param {z.ZodSchema} schema - The Zod schema to validate against
+ * @returns {Object} Validation result with { valid: boolean, data?: Object, errors?: Array }
+ */
+function validatePayload(payload, schema) {
+  const result = schema.safeParse(payload);
+  if (!result.success) {
+    return {
+      valid: false,
+      errors: result.error.issues.map(issue => ({
+        path: issue.path.join('.'),
+        message: issue.message,
+        code: issue.code,
+      })),
+    };
+  }
+  return { valid: true, data: result.data };
+}
+
+/**
+ * Validate a payload and throw an error if invalid
+ * @param {Object} payload - The payload to validate
+ * @param {z.ZodSchema} schema - The Zod schema to validate against
+ * @throws {Error} If validation fails
+ */
+function validatePayloadOrThrow(payload, schema) {
+  const validationResult = validatePayload(payload, schema);
+  if (!validationResult.valid) {
+    const errorMessages = validationResult.errors
+      .map(err => `${err.path}: ${err.message}`)
+      .join('; ');
+    throw new Error(`Payload validation failed: ${errorMessages}`);
+  }
+  return validationResult.data;
+}
+
+module.exports = {
+  WorkerRequestSchema,
+  WorkerResultSchema,
+  SwarmPayloadSchema,
+  validatePayload,
+  validatePayloadOrThrow,
+};

package/.agent/scripts/prompt_compiler.js

@@ -53,35 +53,69 @@ const ACTION_ROUTER = {
   audit: ['vulnerability-scanner', 'lint-and-validate'],
 };
 
+/**
+ * Sanitizes user input to prevent prompt injection attacks.
+ * @param {string} text
+ * @returns {string} Sanitized text
+ */
+function sanitizeUserInput(text) {
+  // 1. Strip XML/HTML tags
+  const sanitized = text.replace(/<[^>]+>/g, '');
+
+  // 2. Check for injection patterns
+  const injectionPatterns = [
+    /ignore\s+(all\s+)?previous\s+instructions/i,
+    /you\s+are\s+now\s+a?\s+/i,
+    /system\s*:\s*/i,
+    /assistant\s*:\s*/i,
+    /\[\[INST\]\]/i,
+    /<<SYS>>/i,
+  ];
+
+  for (const pattern of injectionPatterns) {
+    if (pattern.test(sanitized)) {
+      // Wrap in explicit delimiter if injection is detected
+      return `USER_INPUT_START\n${sanitized}\nUSER_INPUT_END`;
+    }
+  }
+
+  return sanitized;
+}
+
 /**
  * Programmatically compile a user request or spec object into a hyper-dense super-prompt string.
  * @param {string|object} input
  * @returns {string} Highly compressed YAML string
  */
 function compileSuperPrompt(input) {
-  let cleanInput = '';
   let preStack = [];
   let preRules = [];
 
+  let rawText = '';
   if (typeof input === 'object' && input !== null) {
-    cleanInput = (input.task || input.spec || '').trim();
+    rawText = input.task || input.spec || '';
     if (Array.isArray(input.stack)) preStack = input.stack;
     if (Array.isArray(input.rules)) preRules = input.rules;
   } else {
-    cleanInput = String(input || '').trim();
+    rawText = String(input || '');
   }
 
-  // 1. Extract Action (Intent mapping)
-  const actionMatch = cleanInput.match(
+  // Sanitize the input to prevent prompt injection
+  const originalInput = sanitizeUserInput(rawText);
+  const trimmedInput = originalInput.trim();
+  const _cleanInput = trimmedInput;
+
+  // 1. Extract Action (Intent mapping) using trimmed input
+  const actionMatch = trimmedInput.match(
     /^(?:(?:hey,?\s*|please\s+|can you\s+|could you\s+|would you\s+|i need you to\s+|i want to\s+)*)(build|create|fix|debug|refactor|update|write|design|audit)\b/i,
   );
   const action = actionMatch ? actionMatch[1].toLowerCase() : 'execute';
 
-  // 2. Extract Tech Stack
+  // 2. Extract Tech Stack using trimmed input
   const stackSet = new Set(preStack.map(s => s.toLowerCase()));
   TECH_KEYWORDS.forEach(tech => {
     const regex = new RegExp(`\\b${tech.replace('.', '\\.')}\\b`, 'i');
-    if (regex.test(cleanInput)) {
+    if (regex.test(trimmedInput)) {
       stackSet.add(tech.toLowerCase());
     }
   });
@@ -101,10 +135,25 @@ function compileSuperPrompt(input) {
 
   const finalSkills = Array.from(recommendedSkills).slice(0, 4);
 
-  // 4. Compact YAML Generation
-  const indentedTarget = cleanInput
+  // 4. Compact YAML Generation with prompt injection defense
+  // Preserve leading whitespace and escape leading "---" or "..." to prevent YAML document start
+  const indentedTarget = originalInput
     .split('\n')
-    .map(line => '  ' + line)
+    .map(line => {
+      const match = line.match(/^(\s*)/);
+      const leadingSpaces = match[1];
+      const content = line.substring(match[1].length);
+
+      let escapedContent = content;
+      if (content.startsWith('---')) {
+        escapedContent = '- --' + content.substring(3);
+      } else if (content.startsWith('...')) {
+        escapedContent = '- ...' + content.substring(3);
+      }
+
+      const withIndent = '   ' + leadingSpaces + escapedContent; // 3 spaces for YAML indentation
+      return withIndent;
+    })
     .join('\n');
 
   return [
@@ -114,7 +163,6 @@ function compileSuperPrompt(input) {
     indentedTarget,
     `stack: [${stack.join(', ')}]`,
     `recommended_skills: [${finalSkills.join(', ')}]`,
-    '---',
   ].join('\n');
 }
 

package/.agent/scripts/swarm_dispatcher.js

@@ -9,6 +9,12 @@
 const fs = require('fs');
 const path = require('path');
 const { execSync } = require('child_process');
+const {
+  WorkerRequestSchema: _WorkerRequestSchema,
+  WorkerResultSchema: _WorkerResultSchema,
+  SwarmPayloadSchema,
+  validatePayloadOrThrow,
+} = require('./payload_schemas');
 
 // ─── ANSI TUI Renderer ────────────────────────────────────────────────────────
 class SwarmDashboard {
@@ -85,7 +91,7 @@ const VALID_RESULT_STATUSES = new Set(['success', 'failure', 'escalate']);
 
 const MAX_GOAL_LENGTH = 200;
 const MAX_CONTEXT_LENGTH = 800;
-const MAX_WORKERS_PER_SWARM = 5;
+const _MAX_WORKERS_PER_SWARM = 10;
 
 function getBinaryPath() {
   if (process.env.TRIBUNAL_FORCE_JS === '1') return null;
@@ -134,6 +140,42 @@ function findAgentDir(startPath) {
   return null;
 }
 
+// ─── Retry Policy Configuration ───────────────────────────────────────────────
+const MAX_RETRIES = 3;
+const RETRY_DELAYS = [1000, 3000, 10000]; // Exponential backoff: 1s, 3s, 10s
+
+/**
+ * Execute a function with 3-strike retry policy
+ * @param {Function} fn - Function to execute
+ * @param {Object} context - Context for error reporting
+ * @returns {Promise<any>} Result of the function or throws error after max retries
+ */
+async function executeWithRetry(fn, _context = {}) {
+  let lastError;
+
+  for (let attempt = 1; attempt <= MAX_RETRIES; attempt++) {
+    try {
+      return await fn();
+    } catch (error) {
+      lastError = error;
+
+      // If this was the last attempt, don't delay
+      if (attempt === MAX_RETRIES) {
+        break;
+      }
+
+      // Wait before retrying (exponential backoff)
+      const delay = RETRY_DELAYS[attempt - 1];
+      await new Promise(resolve => setTimeout(resolve, delay));
+    }
+  }
+
+  // If we got here, all retries failed
+  throw new Error(
+    `Operation failed after ${MAX_RETRIES} attempts. Last error: ${lastError.message}`,
+  );
+}
+
 // ─── Legacy mode: validate orchestrator micro-worker payloads ──────────────────
 
 function validatePayload(payloadData, workspaceRoot, agentsDir, payloadFile = null) {
@@ -227,6 +269,185 @@ function buildWorkerPrompts(payloadData, workspaceRoot) {
   return prompts;
 }
 
+// ─── Swarm Orchestrator (Wave-Based Execution) ───────────────────────────────
+
+const TRIBUNAL_WAVES = {
+  'wave-1-core': {
+    reviewers: ['precedence-reviewer', 'logic-reviewer', 'schema-reviewer', 'resilience-reviewer'],
+    maxParallel: 4,
+    timeout: 30000,
+    failureMode: 'halt',
+  },
+  'wave-2-security': {
+    reviewers: [
+      'security-auditor',
+      'dependency-reviewer',
+      'type-safety-reviewer',
+      'complexity-reviewer',
+      'sql-reviewer',
+      'pipeline-reviewer',
+    ],
+    maxParallel: 6,
+    timeout: 45000,
+    failureMode: 'continue-warn',
+  },
+  'wave-3-domain': {
+    reviewers: [
+      'frontend-reviewer',
+      'performance-reviewer',
+      'mobile-reviewer',
+      'ai-code-reviewer',
+      'test-coverage-reviewer',
+      'accessibility-reviewer',
+      'ui-ux-auditor',
+      'review-animations',
+      'vitals-reviewer',
+      'db-latency-auditor',
+      'throughput-optimizer',
+    ],
+    maxParallel: 8,
+    timeout: 60000,
+    failureMode: 'continue',
+  },
+};
+
+class SwarmOrchestrator {
+  constructor(dashboard = null) {
+    this.dashboard = dashboard;
+    this.workers = [];
+    this.results = [];
+  }
+
+  async executeTribunal(payload, waveName = 'full') {
+    const wavesToRun =
+      waveName === 'full' ? ['wave-1-core', 'wave-2-security', 'wave-3-domain'] : [waveName];
+
+    const workers =
+      typeof payload === 'object' && payload !== null && payload.workers
+        ? payload.workers
+        : Array.isArray(payload)
+          ? payload
+          : [payload];
+
+    this.workers = workers;
+    this.results = [];
+
+    if (this.dashboard) {
+      this.dashboard.workers = this.workers.map(w => ({
+        name: w.target_agent || w.agent || 'Worker',
+        task: (w.task_description || w.goal || '').slice(0, 40) + '...',
+        status: '⏳ Pending',
+        color: '\x1b[33m', // Yellow
+      }));
+      this.dashboard.start();
+    }
+
+    for (const wave of wavesToRun) {
+      const config = TRIBUNAL_WAVES[wave] || {
+        maxParallel: 4,
+        timeout: 30000,
+        failureMode: 'continue',
+      };
+      // Filter workers belonging to this wave
+      let waveWorkers = [];
+      if (waveName === 'full') {
+        // If it's a full run, we only pick the reviewers designated for this wave
+        const allowedReviewers = new Set(config.reviewers || []);
+        waveWorkers = this.workers.filter(w => allowedReviewers.has(w.agent || w.target_agent));
+      } else {
+        waveWorkers = this.workers;
+      }
+
+      if (waveWorkers.length === 0) continue;
+
+      const waveResults = await this.executeWave(wave, config, waveWorkers);
+      this.results.push(...waveResults);
+
+      if (config.failureMode === 'halt' && waveResults.some(r => r.status === 'failure')) {
+        if (this.dashboard) this.dashboard.stop();
+        console.error(
+          `\n\x1b[31m✖ HALT: Core wave '${wave}' encountered a failure. Aborting subsequent waves.\x1b[0m`,
+        );
+        return this.results;
+      }
+    }
+
+    if (this.dashboard) {
+      this.dashboard.stop();
+    }
+    return this.results;
+  }
+
+  async executeWave(waveName, config, workers) {
+    const results = [];
+    const { maxParallel } = config;
+
+    // Batch workers by maxParallel
+    for (let i = 0; i < workers.length; i += maxParallel) {
+      const batch = workers.slice(i, i + maxParallel);
+      const batchPromises = batch.map(worker => this.executeWorker(worker, config.timeout));
+      const batchResults = await Promise.allSettled(batchPromises);
+      results.push(...batchResults.map(r => r.value || r.reason));
+    }
+    return results;
+  }
+
+  async executeWorker(worker, timeout) {
+    const workerIndex = this.workers.indexOf(worker);
+    if (this.dashboard && workerIndex !== -1) {
+      this.dashboard.updateStatus(workerIndex, 'Working', '\x1b[36m'); // Cyan
+    }
+
+    const agentName = worker.agent || worker.target_agent || 'Unknown';
+
+    try {
+      const result = await executeWithRetry(
+        async () => {
+          return this.invokeReviewerMock(worker, timeout);
+        },
+        { agentName },
+      );
+
+      if (this.dashboard && workerIndex !== -1) {
+        this.dashboard.updateStatus(workerIndex, '✔ Success', '\x1b[32m'); // Green
+      }
+      return {
+        agent: agentName,
+        status: 'success',
+        output: result,
+      };
+    } catch (error) {
+      if (this.dashboard && workerIndex !== -1) {
+        this.dashboard.updateStatus(workerIndex, '✖ Failed', '\x1b[31m'); // Red
+      }
+      return {
+        agent: agentName,
+        status: 'failure',
+        error: error.message,
+      };
+    }
+  }
+
+  // Since this script primarily validates and outputs JSON, we simulate execution
+  // taking between 1-3 seconds for demo purposes.
+  async invokeReviewerMock(worker, _timeout) {
+    return new Promise((resolve, reject) => {
+      const delay = Math.floor(Math.random() * 2000) + 1000;
+      // 5% chance to simulate a transient failure for retry logic testing
+      const shouldFail = Math.random() < 0.05;
+
+      setTimeout(() => {
+        if (shouldFail) {
+          reject(new Error('Transient API failure simulated.'));
+        } else {
+          resolve(`Completed processing for ${worker.agent || worker.target_agent}`);
+        }
+      }, delay);
+    });
+  }
+}
+// ─────────────────────────────────────────────────────────────────────────────
+
 // ─── Swarm mode: validate WorkerRequest / WorkerResult payloads ───────────────
 
 function validateWorkerRequest(req, index, agentsDir) {
@@ -349,57 +570,66 @@ function validateSwarmPayload(payloadData, agentsDir, payloadFile = null, opts =
     }
   }
 
-  let items;
-  if (typeof payloadData === 'object' && payloadData !== null) {
+  // Validate using Zod schema
+  try {
+    // Convert payloadData to the expected format for SwarmPayloadSchema
+    let swarmPayload;
     if (Array.isArray(payloadData)) {
-      items = payloadData;
+      swarmPayload = { workers: payloadData };
     } else if (payloadData.workers && Array.isArray(payloadData.workers)) {
-      items = payloadData.workers;
+      swarmPayload = payloadData;
     } else {
-      items = [payloadData];
+      swarmPayload = { workers: [payloadData] };
     }
-  } else {
-    if (!quiet) console.error('ERROR: Swarm payload must be a JSON object or array.');
-    return false;
-  }
 
-  if (items.length > MAX_WORKERS_PER_SWARM) {
-    if (!quiet) {
-      console.error(
-        `ERROR: Swarm payload contains ${items.length} workers, exceeding the maximum of ${MAX_WORKERS_PER_SWARM}.`,
-      );
+    // Add default wave if not provided
+    if (!swarmPayload.wave) {
+      swarmPayload.wave = 'full';
     }
-    return false;
-  }
 
-  const allErrors = [];
-  for (let i = 0; i < items.length; i++) {
-    const item = items[i];
-    if (typeof item !== 'object' || item === null) {
-      allErrors.push(`Item[${i}]: must be a JSON object.`);
-      continue;
-    }
+    // Validate using Zod schema
+    validatePayloadOrThrow(swarmPayload, SwarmPayloadSchema);
+
+    // Additional validation: check that agents exist
+    const workers = swarmPayload.workers;
+    for (let i = 0; i < workers.length; i++) {
+      const worker = workers[i];
+      const agent = worker.agent;
+      if (agent && typeof agent === 'string') {
+        const agentFile = path.join(resolvedAgentsDir, `${agent}.md`);
+        if (!fs.existsSync(agentFile)) {
+          if (!quiet) {
+            console.error(
+              `ERROR: Worker ${i}: agent '${agent}' not found at ${agentFile}. Only agents that exist in .agent/agents/ are valid.`,
+            );
+          }
+          return false;
+        }
+      }
 
-    let errors;
-    if ('status' in item && 'output' in item) {
-      errors = validateWorkerResult(item, i);
-    } else {
-      errors = validateWorkerRequest(item, i, resolvedAgentsDir);
+      // Validate attached files exist (warning only, not error)
+      const filesAttached = worker.files_attached || [];
+      if (Array.isArray(filesAttached)) {
+        for (const f of filesAttached) {
+          const filePath = path.resolve(process.cwd(), f);
+          if (!fs.existsSync(filePath)) {
+            if (!quiet) {
+              console.warn(
+                `WARN: Worker ${i}: attached file '${f}' does not exist (might be a new file to create).`,
+              );
+            }
+          }
+        }
+      }
     }
 
-    allErrors.push(...errors);
-  }
-
-  if (allErrors.length > 0) {
+    return true;
+  } catch (error) {
     if (!quiet) {
-      for (const err of allErrors) {
-        console.error(`ERROR: ${err}`);
-      }
+      console.error(`ERROR: Swarm payload validation failed: ${error.message}`);
     }
     return false;
   }
-
-  return true;
 }
 
 // ─── Main ─────────────────────────────────────────────────────────────────────
@@ -499,35 +729,33 @@ function main() {
       }
     }
 
-    if (useTui) {
-      const workers =
-        typeof payloadData === 'object' && payloadData !== null && payloadData.workers
-          ? payloadData.workers
-          : Array.isArray(payloadData)
-            ? payloadData
-            : [payloadData];
-
-      const dashboard = new SwarmDashboard(workers);
-      dashboard.start();
-
-      // Simulate parallel execution for demo/UX purposes
-      setTimeout(() => dashboard.updateStatus(0, 'Researching', '\x1b[36m'), 1000);
-      setTimeout(() => {
-        if (workers.length > 1) dashboard.updateStatus(1, 'Generating', '\x1b[35m');
-      }, 1500);
-
-      setTimeout(() => {
-        workers.forEach((w, i) => dashboard.updateStatus(i, '✔ Done', '\x1b[32m'));
-        dashboard.stop();
-        console.log('\n\x1b[32m✔ Swarm validation complete. Ready for dispatch.\x1b[0m\n');
-      }, 3000);
-    } else {
-      console.log('INFO: Swarm payload validation successful.');
-      if (astContext) {
-        console.log('--- ENRICHED SWARM PAYLOAD ---');
-        console.log(JSON.stringify(payloadData, null, 2));
-      }
-    }
+    const orchestrator = new SwarmOrchestrator(useTui ? new SwarmDashboard([]) : null);
+
+    // We must run in an async context since SwarmOrchestrator uses async/await.
+    const wave =
+      typeof payloadData === 'object' && payloadData !== null && payloadData.wave
+        ? payloadData.wave
+        : 'full';
+
+    orchestrator
+      .executeTribunal(payloadData, wave)
+      .then(results => {
+        if (!useTui) {
+          console.log('INFO: Swarm payload validation and orchestration successful.');
+          if (astContext) {
+            console.log('--- ENRICHED SWARM PAYLOAD ---');
+            console.log(JSON.stringify(payloadData, null, 2));
+          }
+          console.log('--- EXECUTION PLAN (MOCK RESULTS) ---');
+          console.log(JSON.stringify(results, null, 2));
+        } else {
+          console.log('\n\x1b[32m✔ Swarm orchestration complete.\x1b[0m\n');
+        }
+      })
+      .catch(err => {
+        console.error(`ERROR: Swarm orchestration failed: ${err.message}`);
+        process.exit(1);
+      });
   } else {
     if (!validatePayload(payloadData, workspaceRoot, agentsDir, file)) {
       console.error('ERROR: Payload validation failed.');