tribunal-kit 9.2.4 → 9.2.6

package/src/commands/system1.js

@@ -0,0 +1,312 @@
+'use strict';
+
+const fs = require('fs');
+const path = require('path');
+const crypto = require('crypto');
+const child_process = require('child_process');
+const { log, err, dim, c, bold } = require('../utils/logger');
+const { getLayaDir, getConfigPath } = require('../system1/provider');
+
+function verifyChecksum(filePath, expectedHash) {
+  return new Promise((resolve, reject) => {
+    if (!fs.existsSync(filePath)) {
+      return reject(new Error(`File missing: ${filePath}`));
+    }
+    const hash = crypto.createHash('sha256');
+    const stream = fs.createReadStream(filePath);
+    stream.on('data', data => hash.update(data));
+    stream.on('end', () => {
+      const actual = hash.digest('hex');
+      if (actual === expectedHash) {
+        resolve(true);
+      } else {
+        reject(
+          new Error(
+            `Hash mismatch for ${path.basename(filePath)}.\nExpected: ${expectedHash}\nActual:   ${actual}`,
+          ),
+        );
+      }
+    });
+    stream.on('error', err => reject(err));
+  });
+}
+
+// Pinned dependencies for reproducible installations
+const RECEPTRON_LAYA_VERSION = '0.1.2';
+const ONNXRUNTIME_NODE_VERSION = '1.22.0';
+
+async function cmdSystem1Enable(quiet) {
+  const layaDir = getLayaDir();
+  const configPath = getConfigPath();
+  const modelsDir = path.join(layaDir, 'models');
+
+  if (!quiet) {
+    log(`\n  ${c('cyan', '⚡')} ${bold('Tribunal Kit Laya System-1 Initialization')}`);
+    dim('  --------------------------------------------------');
+    dim('  This will install the local Laya ONNX decision engine.');
+    dim('  - Engine: @receptron/laya & onnxruntime-node');
+    dim('  - Model: convaiinnovations/laya (~1.7GB)');
+    dim(`  - Path: ${layaDir}`);
+    log('');
+  }
+
+  if (process.env.TK_MOCK_LAYA_DOWNLOAD) {
+    if (!fs.existsSync(layaDir)) fs.mkdirSync(layaDir, { recursive: true });
+    if (!fs.existsSync(modelsDir)) fs.mkdirSync(modelsDir, { recursive: true });
+    fs.writeFileSync(path.join(modelsDir, 'laya.onnx'), 'mock');
+    fs.writeFileSync(configPath, JSON.stringify({ enabled: true, mocked: true }));
+    if (!quiet) log(`  ${c('green', '✓')} System-1 successfully mocked!`);
+    return;
+  }
+
+  try {
+    if (!fs.existsSync(layaDir)) fs.mkdirSync(layaDir, { recursive: true });
+
+    const lockDir = path.join(layaDir, '.install.lock');
+    const lockPidFile = path.join(lockDir, 'pid');
+    try {
+      fs.mkdirSync(lockDir);
+      fs.writeFileSync(lockPidFile, String(process.pid));
+    } catch (err) {
+      if (err.code === 'EEXIST') {
+        let isStale = false;
+        try {
+          const pidStr = fs.readFileSync(lockPidFile, 'utf8');
+          const pid = parseInt(pidStr, 10);
+          if (pid > 0) {
+            try {
+              process.kill(pid, 0);
+            } catch (_e) {
+              if (_e.code === 'ESRCH') isStale = true;
+            }
+          } else {
+            const stat = fs.statSync(lockPidFile);
+            if (Date.now() - stat.mtimeMs > 900000) isStale = true;
+          }
+        } catch (_e) {
+          try {
+            const stat = fs.statSync(lockDir);
+            if (Date.now() - stat.mtimeMs > 900000) isStale = true;
+          } catch (_e2) {
+            isStale = true;
+          }
+        }
+
+        if (isStale) {
+          if (!quiet)
+            log(`  ${c('yellow', '⚠')} Found stale lock from previous crash. Recovering...`);
+          fs.rmSync(lockDir, { recursive: true, force: true });
+          fs.mkdirSync(lockDir);
+          fs.writeFileSync(lockPidFile, String(process.pid));
+        } else {
+          throw new Error(
+            'System-1 installation is currently in progress by another process (PID is active). Please wait.',
+          );
+        }
+      } else {
+        throw err;
+      }
+    }
+
+    try {
+      if (!fs.existsSync(modelsDir)) fs.mkdirSync(modelsDir, { recursive: true });
+
+      // 1. Install @receptron/laya with strictly reproducible dependency tree
+      if (!quiet)
+        log(`  ${c('yellow', '1.')} Installing local runtime dependency (clean install)...`);
+
+      fs.copyFileSync(
+        path.join(__dirname, '../system1/laya-package.json'),
+        path.join(layaDir, 'package.json'),
+      );
+      fs.copyFileSync(
+        path.join(__dirname, '../system1/laya-package-lock.json'),
+        path.join(layaDir, 'package-lock.json'),
+      );
+
+      // Validate layaDir to prevent shell injection on Windows
+      if (/[&|";<>]/.test(layaDir)) {
+        throw new Error(`Invalid path characters in Laya directory: ${layaDir}`);
+      }
+
+      let cmd;
+      const args = ['ci', '--prefix', layaDir, '--no-audit', '--no-fund'];
+      let shell = false;
+
+      if (process.platform === 'win32') {
+        cmd = 'npm.cmd';
+        shell = true; // Windows requires shell: true for .cmd files
+      } else {
+        cmd = 'npm';
+      }
+
+      child_process.execFileSync(cmd, args, {
+        stdio: quiet ? 'ignore' : 'pipe',
+        shell: shell,
+      });
+
+      // 2. Download model safely without initializing ONNX Runtime
+      if (!quiet)
+        log(`  ${c('yellow', '2.')} Downloading model weights (~1.7GB, this may take a while)...`);
+
+      const layaPkgPath = path.join(layaDir, 'node_modules', '@receptron', 'laya');
+      const { Laya, ensureBundle } = require(layaPkgPath);
+
+      // This natively downloads via huggingface_hub using pinned commit SHA
+      const revision = '68f27dfe5a27a54fb2b1fefc432f43f972e90868';
+      const downloadedModelDir = await ensureBundle({
+        repo: 'receptron/laya-onnx',
+        revision: revision,
+        cacheDir: modelsDir,
+      });
+
+      // 3. Verify SHA-256 for artifacts BEFORE consumption
+      if (!quiet) log(`  ${c('yellow', '3.')} Verifying artifact integrity (SHA-256)...`);
+
+      const expectedHashes = {
+        'laya.onnx': 'a874eb254b58b0fcb1e7ad56fbb188c29d64e08c9a46b689433e1f52c66dba1e',
+        'laya.onnx.data': '487746363a8da57bcadb4345352997d22a0fb90d70aa22c6856668d023242aba',
+      };
+
+      for (const [filename, expectedHash] of Object.entries(expectedHashes)) {
+        const artifactPath = path.join(downloadedModelDir, filename);
+        try {
+          await verifyChecksum(artifactPath, expectedHash);
+        } catch (err) {
+          // If validation fails, completely purge the corrupted installation to prevent bypass
+          fs.rmSync(layaDir, { recursive: true, force: true });
+          throw new Error(
+            `Integrity check failed: ${err.message}\nInstallation aborted and quarantined.`,
+          );
+        }
+      }
+
+      // Also ensure tokenizer files exist
+      for (const filename of ['tokenizer/tokenizer.json', 'tokenizer/tokenizer_config.json']) {
+        if (!fs.existsSync(path.join(downloadedModelDir, filename))) {
+          fs.rmSync(layaDir, { recursive: true, force: true });
+          throw new Error(`Integrity check failed: Missing ${filename}`);
+        }
+      }
+
+      // 4. Initialize model safely (only after verification)
+      if (!quiet) log(`  ${c('yellow', '4.')} Initializing model...`);
+      const laya = await Laya.load({
+        modelDir: downloadedModelDir,
+        executionProviders: ['cpu'],
+      });
+      await laya.close();
+
+      // 4. Save config
+      fs.writeFileSync(
+        configPath,
+        JSON.stringify(
+          {
+            enabled: true,
+            model_version: 'v1.0.0',
+            checksum_verified: true,
+            installed_at: new Date().toISOString(),
+          },
+          null,
+          2,
+        ),
+      );
+
+      if (!quiet) {
+        log(`\n  ${c('green', '✓')} System-1 successfully enabled!`);
+        dim(`  Impact tier resolution will now use local inference.`);
+      }
+    } finally {
+      try {
+        fs.rmSync(lockDir, { recursive: true, force: true });
+      } catch (_e) {}
+    }
+  } catch (error) {
+    err(`\n  ✖ Failed to enable System-1: ${error.message}`);
+    process.exitCode = 1;
+  }
+}
+
+function cmdSystem1Disable(quiet) {
+  const configPath = getConfigPath();
+  if (fs.existsSync(configPath)) {
+    try {
+      const config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+      config.enabled = false;
+      fs.writeFileSync(configPath, JSON.stringify(config, null, 2));
+      if (!quiet)
+        log(`  ${c('green', '✓')} System-1 has been disabled (installation kept intact).`);
+    } catch {
+      if (!quiet) err(`  ✖ Failed to parse System-1 config.`);
+      process.exitCode = 1;
+    }
+  } else {
+    if (!quiet) dim(`  System-1 is not currently installed.`);
+  }
+}
+
+function cmdSystem1Status(quiet) {
+  const configPath = getConfigPath();
+  const layaDir = getLayaDir();
+  const modelPath = path.join(layaDir, 'models', 'laya.onnx');
+  const runtimePath = path.join(layaDir, 'node_modules', '@receptron', 'laya');
+
+  let config = null;
+  if (fs.existsSync(configPath)) {
+    try {
+      config = JSON.parse(fs.readFileSync(configPath, 'utf8'));
+    } catch {}
+  }
+
+  if (!quiet) {
+    log(`\n  ${bold('System-1 Status')}`);
+    dim('  --------------------------------------------------');
+    log(`  Provider:      ${c('white', 'Laya (ONNX CPU)')}`);
+    log(`  Enabled:       ${config?.enabled ? c('green', 'Yes') : c('yellow', 'No')}`);
+    log(`  Config path:   ${configPath}`);
+    log(`  Model found:   ${fs.existsSync(modelPath) ? c('green', 'Yes') : c('red', 'No')}`);
+    log(`  Runtime found: ${fs.existsSync(runtimePath) ? c('green', 'Yes') : c('red', 'No')}`);
+    log('');
+  }
+}
+
+function cmdSystem1Clean(quiet) {
+  const layaDir = getLayaDir();
+  if (fs.existsSync(layaDir)) {
+    fs.rmSync(layaDir, { recursive: true, force: true });
+    if (!quiet) log(`  ${c('green', '✓')} System-1 installation completely removed.`);
+  } else {
+    if (!quiet) dim(`  System-1 is not installed.`);
+  }
+}
+
+async function cmdSystem1(flags, args, quiet) {
+  const rawArgs = args.slice(2);
+  const subCommand = rawArgs.find(a => !a.startsWith('-') && a !== 'system1');
+
+  switch (subCommand) {
+    case 'enable':
+      await cmdSystem1Enable(quiet);
+      break;
+    case 'disable':
+      cmdSystem1Disable(quiet);
+      break;
+    case 'status':
+      cmdSystem1Status(quiet);
+      break;
+    case 'clean':
+      cmdSystem1Clean(quiet);
+      break;
+    default:
+      err(`Unknown system1 command: "${subCommand || ''}"`);
+      dim('Available: enable, disable, status, clean');
+      process.exitCode = 1;
+  }
+}
+
+module.exports = {
+  cmdSystem1,
+  verifyChecksum,
+  RECEPTRON_LAYA_VERSION,
+  ONNXRUNTIME_NODE_VERSION,
+};

package/src/commands/uninstall.js

@@ -0,0 +1,63 @@
+'use strict';
+const __importDefault =
+  (this && this.__importDefault) ||
+  function (mod) {
+    return mod && mod.__esModule ? mod : { default: mod };
+  };
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.cmdUninstall = cmdUninstall;
+const fs_1 = __importDefault(require('fs'));
+const path_1 = __importDefault(require('path'));
+const logger_1 = require('../utils/logger');
+const helpers_1 = require('../utils/helpers');
+const fs_2 = require('../utils/fs');
+function cmdUninstall(flags, quiet = false) {
+  const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
+  const pkgStr = fs_1.default.readFileSync(
+    path_1.default.resolve(__dirname, '../../package.json'),
+    'utf8',
+  );
+  const pkg = JSON.parse(pkgStr);
+  if ((0, fs_2.isSelfInstall)(targetDir, pkg.name, path_1.default.resolve(__dirname, '../..'))) {
+    (0, logger_1.err)('Cannot run uninstall inside the tribunal-kit package itself.');
+    (0, logger_1.err)(`Target: ${targetDir}`);
+    console.log();
+    (0, logger_1.dim)('This command is designed to remove .agent/ from OTHER projects.');
+    (0, logger_1.dim)('Run it from the root of the target project you want to uninstall from.');
+    console.log();
+    process.exit(1);
+  }
+  const agentDest = path_1.default.join(targetDir, '.agent');
+  (0, helpers_1.banner)(quiet);
+  if (!fs_1.default.existsSync(agentDest)) {
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('yellow', '⚠')} ${(0, logger_1.bold)('.agent/')} is not installed in this project.`,
+    );
+    console.log();
+    return;
+  }
+  if (flags.dryRun) {
+    (0, logger_1.log)((0, logger_1.colorize)('yellow', '  DRY RUN — would remove:'));
+    (0, logger_1.log)(`  ${(0, logger_1.c)('gray', '  ╰─')} ${agentDest}`);
+    console.log();
+    return;
+  }
+  try {
+    fs_1.default.rmSync(agentDest, { recursive: true, force: true });
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('green', '✔')} ${(0, logger_1.bold)('.agent/')} has been removed from this project.`,
+    );
+    console.log();
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('gray', '▸')} To reinstall: ${(0, logger_1.c)('cyan', 'npx tribunal-kit init')}`,
+    );
+    console.log();
+  } catch (e) {
+    if (e instanceof Error) {
+      (0, logger_1.err)(`Failed to remove .agent/: ${e.message}`);
+    } else {
+      (0, logger_1.err)(`Failed to remove .agent/: ${String(e)}`);
+    }
+    process.exit(1);
+  }
+}

package/src/commands/update.js

@@ -0,0 +1,44 @@
+'use strict';
+const __importDefault =
+  (this && this.__importDefault) ||
+  function (mod) {
+    return mod && mod.__esModule ? mod : { default: mod };
+  };
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.cmdUpdate = cmdUpdate;
+const fs_1 = __importDefault(require('fs'));
+const path_1 = __importDefault(require('path'));
+const logger_1 = require('../utils/logger');
+const fs_2 = require('../utils/fs');
+const init_1 = require('./init');
+async function cmdUpdate(flags) {
+  const pkgStr = fs_1.default.readFileSync(
+    path_1.default.resolve(__dirname, '../../package.json'),
+    'utf8',
+  );
+  const pkg = JSON.parse(pkgStr);
+  // ── Self-install guard (early, before banner) ───────────
+  const targetDir = flags.path ? path_1.default.resolve(flags.path) : process.cwd();
+  if ((0, fs_2.isSelfInstall)(targetDir, pkg.name, path_1.default.resolve(__dirname, '../..'))) {
+    (0, logger_1.err)('Cannot run update inside the tribunal-kit package itself.');
+    (0, logger_1.err)(`Target: ${targetDir}`);
+    console.log();
+    (0, logger_1.dim)('This command is designed to update .agent/ in OTHER projects.');
+    (0, logger_1.dim)('Run it from the root of the project you want to update:');
+    (0, logger_1.dim)('  cd /path/to/your-project');
+    (0, logger_1.dim)('  npx tribunal-kit update');
+    console.log();
+    process.exit(1);
+  }
+  // ────────────────────────────────────────────────────────
+  const isQuiet = flags.quiet || false;
+  // Update = init with --force
+  flags.force = true;
+  if (!isQuiet) {
+    (0, logger_1.log)(
+      `  ${(0, logger_1.c)('cyan', '↻')} ${(0, logger_1.bold)('Updating')} ${(0, logger_1.c)('white', '.agent/')} to latest version...`,
+    );
+    console.log();
+  }
+  await (0, init_1.cmdInit)(flags, isQuiet);
+}

package/{dist → src}/commands/validate.js

@@ -1,58 +1,66 @@
-'use strict';
-
-/**
- * validate.js — CLI command handler for `tk validate` (JS Engine)
- * Validates JSON payloads or .agent/ structure against strict schemas with live reviewer grid.
- */
-
-Object.defineProperty(exports, '__esModule', { value: true });
-exports.cmdValidate = cmdValidate;
-
-const fs = require('fs');
-const path = require('path');
-const { color, bold, dim, RGB, GLYPHS, renderReviewerGrid, ActionTree } = require('../tui');
-
-async function cmdValidate(flags, quiet = false) {
-  const projectRoot = flags.path ? path.resolve(flags.path) : process.cwd();
-  const agentDir = path.join(projectRoot, '.agent');
-  const g = GLYPHS;
-  const tree = new ActionTree();
-
-  if (!fs.existsSync(agentDir)) {
-    console.error(`  ${color(RGB.ROSE, g.failure)} ${bold('No .agent/ directory found.')} Run ${color(RGB.CYAN, 'tk init')} first.`);
-    process.exit(1);
-  }
-
-  const fileToValidate = flags.file || flags.target;
-
-  if (fileToValidate) {
-    const fullPath = path.resolve(fileToValidate);
-    if (!fs.existsSync(fullPath)) {
-      console.error(`  ${color(RGB.ROSE, g.failure)} ${bold('File not found for validation:')} ${fileToValidate}`);
-      process.exit(1);
-    }
-    try {
-      const content = fs.readFileSync(fullPath, 'utf8');
-      if (fullPath.endsWith('.json')) {
-        JSON.parse(content);
-        if (!quiet) {
-          console.log(`  ${color(RGB.EMERALD, g.success)} ${bold('Valid JSON payload:')} ${color(RGB.CYAN, fullPath)}`);
-        }
-      } else {
-        if (!quiet) {
-          console.log(`  ${color(RGB.EMERALD, g.success)} ${bold('File validated successfully:')} ${color(RGB.CYAN, fullPath)}`);
-        }
-      }
-      return;
-    } catch (err) {
-      console.error(`  ${color(RGB.ROSE, g.failure)} ${bold('Validation failed:')} ${err.message}`);
-      process.exit(1);
-    }
-  }
-
-  // General .agent validation with parallel reviewer swarm display
-  if (!quiet) {
-    renderReviewerGrid(28);
-    tree.complete('.agent/ payload structure & 28 parallel reviewers verified successfully');
-  }
-}
+'use strict';
+
+/**
+ * validate.js — CLI command handler for `tk validate` (JS Engine)
+ * Validates JSON payloads or .agent/ structure against strict schemas with live reviewer grid.
+ */
+
+Object.defineProperty(exports, '__esModule', { value: true });
+exports.cmdValidate = cmdValidate;
+
+const fs = require('fs');
+const path = require('path');
+const { color, bold, RGB, GLYPHS, renderReviewerGrid, ActionTree } = require('../tui');
+
+async function cmdValidate(flags, quiet = false) {
+  const projectRoot = flags.path ? path.resolve(flags.path) : process.cwd();
+  const agentDir = path.join(projectRoot, '.agent');
+  const g = GLYPHS;
+  const tree = new ActionTree();
+
+  if (!fs.existsSync(agentDir)) {
+    console.error(
+      `  ${color(RGB.ROSE, g.failure)} ${bold('No .agent/ directory found.')} Run ${color(RGB.CYAN, 'tk init')} first.`,
+    );
+    process.exit(1);
+  }
+
+  const fileToValidate = flags.file || flags.target;
+
+  if (fileToValidate) {
+    const fullPath = path.resolve(fileToValidate);
+    if (!fs.existsSync(fullPath)) {
+      console.error(
+        `  ${color(RGB.ROSE, g.failure)} ${bold('File not found for validation:')} ${fileToValidate}`,
+      );
+      process.exit(1);
+    }
+    try {
+      const content = fs.readFileSync(fullPath, 'utf8');
+      if (fullPath.endsWith('.json')) {
+        JSON.parse(content);
+        if (!quiet) {
+          console.log(
+            `  ${color(RGB.EMERALD, g.success)} ${bold('Valid JSON payload:')} ${color(RGB.CYAN, fullPath)}`,
+          );
+        }
+      } else {
+        if (!quiet) {
+          console.log(
+            `  ${color(RGB.EMERALD, g.success)} ${bold('File validated successfully:')} ${color(RGB.CYAN, fullPath)}`,
+          );
+        }
+      }
+      return;
+    } catch (err) {
+      console.error(`  ${color(RGB.ROSE, g.failure)} ${bold('Validation failed:')} ${err.message}`);
+      process.exit(1);
+    }
+  }
+
+  // General .agent validation with parallel reviewer swarm display
+  if (!quiet) {
+    renderReviewerGrid(28);
+    tree.complete('.agent/ payload structure & 28 parallel reviewers verified successfully');
+  }
+}