tribunal-kit 9.2.5 → 9.2.6

package/.agent/scripts/guardrail_engine.js

@@ -416,44 +416,60 @@ function ruleImportPhantom(content, _manifest, ctx) {
     try {
       const absPath = path.resolve(projectRoot || process.cwd(), filePath);
       const binName = process.platform === 'win32' ? 'tribunal-core.exe' : 'tribunal-core';
-      let corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'release', binName);
+      let corePath = path.join(
+        __dirname,
+        '..',
+        '..',
+        'crates',
+        'core',
+        'target',
+        'release',
+        binName,
+      );
       if (!fs.existsSync(corePath)) {
-          corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'debug', binName);
+        corePath = path.join(__dirname, '..', '..', 'crates', 'core', 'target', 'debug', binName);
       }
       if (fs.existsSync(corePath)) {
-        const result = require('child_process').execFileSync(corePath, ['ast-extract', '--file', absPath], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 500 });
+        const result = require('child_process').execFileSync(
+          corePath,
+          ['ast-extract', '--file', absPath],
+          { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'], timeout: 500 },
+        );
         const data = JSON.parse(result);
         if (data && data.success) {
-           extractedImports = data.imports;
+          extractedImports = data.imports;
         }
       }
-    } catch(_e) {
+    } catch (_e) {
       // Fallback
     }
   }
 
   const checkPackageName = (pkgName, locationString) => {
-      if (!builtins.has(pkgName) && !deps.has(pkgName)) {
-        violations.push({
-          rule: 'import-phantom',
-          severity: 'info',
-          location: locationString,
-          message: `Package "${pkgName}" is not in package.json`,
-          suggestion: `Verify "${pkgName}" is installed or add it to dependencies`,
-          autoFixable: false,
-        });
-      }
+    if (!builtins.has(pkgName) && !deps.has(pkgName)) {
+      violations.push({
+        rule: 'import-phantom',
+        severity: 'info',
+        location: locationString,
+        message: `Package "${pkgName}" is not in package.json`,
+        suggestion: `Verify "${pkgName}" is installed or add it to dependencies`,
+        autoFixable: false,
+      });
+    }
   };
 
   if (extractedImports) {
-     extractedImports.forEach(imp => {
-        const pkg = imp.source;
-        if (!pkg.startsWith('.') && !pkg.startsWith('/')) { // Only check external packages
-           const pkgName = pkg.startsWith('@') ? pkg.split('/').slice(0, 2).join('/') : pkg.split('/')[0];
-           checkPackageName(pkgName, `import from: "${pkg}"`);
-        }
-     });
-     return violations;
+    extractedImports.forEach(imp => {
+      const pkg = imp.source;
+      if (!pkg.startsWith('.') && !pkg.startsWith('/')) {
+        // Only check external packages
+        const pkgName = pkg.startsWith('@')
+          ? pkg.split('/').slice(0, 2).join('/')
+          : pkg.split('/')[0];
+        checkPackageName(pkgName, `import from: "${pkg}"`);
+      }
+    });
+    return violations;
   }
 
   const requireRegex = /require\s*\(\s*['"]([^'"./][^'"]*)['"]\s*\)/g;
@@ -508,7 +524,10 @@ function ruleRustModuleRegistration(content, manifest, _ctx) {
   const wrapperJs = path.join(root, 'bin', 'wrapper.js');
   if (fs.existsSync(wrapperJs)) {
     const wrapperContent = fs.readFileSync(wrapperJs, 'utf8');
-    if (!wrapperContent.includes('"context-broker"') && !wrapperContent.includes("'context-broker'")) {
+    if (
+      !wrapperContent.includes('"context-broker"') &&
+      !wrapperContent.includes("'context-broker'")
+    ) {
       violations.push({
         rule: 'rust-module-registration',
         severity: 'warning',

package/.agent/scripts/harness_manager.js

@@ -1,7 +1,7 @@
 #!/usr/bin/env node
 /**
  * harness_manager.js
- * CLI entry point for the Harness Manager. 
+ * CLI entry point for the Harness Manager.
  * Replaces direct `node .agent/scripts/...` calls with:
  * `node .agent/scripts/harness_manager.js --syscall <name> [...args]`
  */
@@ -14,9 +14,9 @@ const { executeSyscall } = require('./syscall_registry');
 function main() {
   const args = process.argv.slice(2);
   const syscallIndex = args.indexOf('--syscall');
-  
+
   if (syscallIndex === -1 || syscallIndex === args.length - 1) {
-    console.error("Usage: node harness_manager.js --syscall <name> [...args]");
+    console.error('Usage: node harness_manager.js --syscall <name> [...args]');
     process.exit(1);
   }
 
@@ -24,29 +24,41 @@ function main() {
   const syscallArgs = args.filter((_, i) => i !== syscallIndex && i !== syscallIndex + 1);
 
   // 1. Log ToolRequested
-  const eventId = appendEvent('ToolRequested', {
-    tool: syscall,
-    args: syscallArgs
-  }, 'harness-manager');
+  const eventId = appendEvent(
+    'ToolRequested',
+    {
+      tool: syscall,
+      args: syscallArgs,
+    },
+    'harness-manager',
+  );
 
   // 2. Execute Safely
   const result = executeSyscall(syscall, syscallArgs);
 
   // 3. Log ToolCompleted or ErrorEncountered
   if (result.exitCode === 0) {
-    appendEvent('ToolCompleted', {
-      exitCode: result.exitCode,
-      stdout: result.stdout,
-      requestEventId: eventId
-    }, 'harness-manager');
+    appendEvent(
+      'ToolCompleted',
+      {
+        exitCode: result.exitCode,
+        stdout: result.stdout,
+        requestEventId: eventId,
+      },
+      'harness-manager',
+    );
     console.log(result.stdout);
   } else {
-    appendEvent('ErrorEncountered', {
-      exitCode: result.exitCode,
-      message: result.stderr,
-      stdout: result.stdout,
-      requestEventId: eventId
-    }, 'harness-manager');
+    appendEvent(
+      'ErrorEncountered',
+      {
+        exitCode: result.exitCode,
+        message: result.stderr,
+        stdout: result.stdout,
+        requestEventId: eventId,
+      },
+      'harness-manager',
+    );
     if (result.stderr) console.error(result.stderr);
     if (result.stdout) console.log(result.stdout);
     process.exit(result.exitCode);

package/.agent/scripts/impact_classifier.js

@@ -78,11 +78,12 @@ function classifyImpact(opts = {}) {
   let score = 0.2; // Base baseline score
   const reasoning = [];
 
-  // Check 1: Critical File Patterns
+  // Check 1: Critical File Patterns & Diff
   const isCriticalFile = files.some(file => CRITICAL_PATTERNS.some(pat => pat.test(file)));
   const isCriticalTask = CRITICAL_PATTERNS.some(pat => pat.test(task));
+  const isCriticalDiff = diff && CRITICAL_PATTERNS.some(pat => pat.test(diff));
 
-  if (isCriticalFile || isCriticalTask) {
+  if (isCriticalFile || isCriticalTask || isCriticalDiff) {
     score += 0.6;
     reasoning.push('Critical path detected (auth/security/schema/payment)');
   }
@@ -135,15 +136,15 @@ function classifyImpact(opts = {}) {
   let maxReviewers = 1;
   let requireGate = false;
 
-  if (score < 0.15 && !isCriticalFile && !isCriticalTask) {
+  if (score < 0.15 && !isCriticalFile && !isCriticalTask && !isCriticalDiff) {
     tier = 0;
     maxReviewers = 0;
     requireGate = false;
-  } else if (score < 0.35 && !isCriticalFile && !isCriticalTask) {
+  } else if (score < 0.35 && !isCriticalFile && !isCriticalTask && !isCriticalDiff) {
     tier = 1;
     maxReviewers = 1;
     requireGate = false;
-  } else if (score < 0.7 && !isCriticalFile) {
+  } else if (score < 0.7 && !isCriticalFile && !isCriticalDiff) {
     tier = 2;
     maxReviewers = 2;
     requireGate = true; // Conditional gate

package/.agent/scripts/integrity_manifest.js

@@ -73,17 +73,29 @@ function crawlAgents(agentDir) {
   const specialists = [];
   const allAgents = [];
 
+  const nonReviewers = new Set([
+    'penetration-tester',
+    'agent-shield-auditor',
+    'anti-slop-auditor',
+  ]);
+
   for (const file of files) {
     const name = file.replace(/\.md$/, '');
     allAgents.push(name);
 
-    // Classify: reviewer if name contains "reviewer", "auditor", or "tester"
-    // or if frontmatter has role: reviewer
+    // Classify: reviewer if name is in canonical reviewer set or matches reviewer pattern
     const content = safeReadFile(path.join(agentsDir, file));
     const fm = parseFrontmatter(content);
     const isReviewer =
-      /reviewer|auditor|tester|throughput-optimizer/i.test(name) ||
-      (fm.role && /reviewer/i.test(fm.role));
+      !nonReviewers.has(name) &&
+      ((fm.role && /reviewer/i.test(fm.role)) ||
+        /reviewer/i.test(name) ||
+        name === 'security-auditor' ||
+        name === 'ui-ux-auditor' ||
+        name === 'ui-visual-auditor' ||
+        name === 'db-latency-auditor' ||
+        name === 'throughput-optimizer' ||
+        name === 'architecture-auditor');
 
     if (isReviewer) {
       reviewers.push(name);
@@ -170,9 +182,10 @@ function extractCrossReferences(filePath, content, agentDir) {
   const relSource = path.relative(agentDir, filePath).replace(/\\/g, '/');
 
   // Agent references: agents/name.md or `agent-name`
-  const agentRefRegex = /(?:agents\/)([\w-]+)(?:\.md)?/g;
+  const agentRefRegex = /(?:(?<![\.\w])agents\/)([\w-]+)(?:\.md)?/g;
   let m;
   while ((m = agentRefRegex.exec(content)) !== null) {
+    if (m[1] === 'skills') continue;
     const refFile = `agents/${m[1]}.md`;
     const fullPath = path.join(agentDir, refFile);
     refs.push({
@@ -184,14 +197,39 @@ function extractCrossReferences(filePath, content, agentDir) {
   }
 
   // Script references: scripts/name.js or scripts/name.py
-  const scriptRefRegex = /(?:scripts\/)([\w_-]+)\.(js|py)/g;
+  const scriptRefRegex = /(?:(?<![\.\w/])scripts\/)([\w_-]+)\.(js|py)/g;
   while ((m = scriptRefRegex.exec(content)) !== null) {
-    const refFile = `scripts/${m[1]}.${m[2]}`;
-    const fullPath = path.join(agentDir, refFile);
+    const precedingText = content.substring(Math.max(0, m.index - 150), m.index);
+    if (
+      precedingText.includes('http://') ||
+      precedingText.includes('https://') ||
+      precedingText.includes('github.com/') ||
+      precedingText.includes('raw.githubusercontent.com/') ||
+      precedingText.includes('These will all fail')
+    ) {
+      continue;
+    }
+    const scriptFileName = `${m[1]}.${m[2]}`;
+    const refFile = `scripts/${scriptFileName}`;
+    let exists = fs.existsSync(path.join(agentDir, refFile));
+    if (!exists) {
+      // Check skill-local scripts directory (or relative parent directories)
+      const fileDir = path.dirname(filePath);
+      const localPath = path.join(fileDir, 'scripts', scriptFileName);
+      const parentLocalPath = path.join(fileDir, '..', 'scripts', scriptFileName);
+      const grandParentLocalPath = path.join(fileDir, '..', '..', 'scripts', scriptFileName);
+      if (
+        fs.existsSync(localPath) ||
+        fs.existsSync(parentLocalPath) ||
+        fs.existsSync(grandParentLocalPath)
+      ) {
+        exists = true;
+      }
+    }
     refs.push({
       source: relSource,
       ref: refFile,
-      exists: fs.existsSync(fullPath),
+      exists,
       type: 'script',
     });
   }
@@ -232,6 +270,8 @@ function extractCrossReferences(filePath, content, agentDir) {
 function extractNumericClaims(filePath, content, agentDir, actualCounts) {
   const claims = [];
   const relSource = path.relative(agentDir, filePath).replace(/\\/g, '/');
+  // Historical architecture decision records record metrics at ADR publication time
+  if (relSource.startsWith('ADRs/') || relSource.includes('/ADRs/')) return claims;
   const lines = content.split(/\r?\n/);
 
   const claimPatterns = [

package/.agent/scripts/lint_runner.js

@@ -36,12 +36,14 @@ const RESULTS = [];
 function runLinter(label, cmd, cwd) {
   const elapsed = timer();
   try {
-    const executable = process.platform === 'win32' && cmd[0] === 'npx' ? 'npx.cmd' : cmd[0];
+    const isWindows = process.platform === 'win32';
+    const executable =
+      isWindows && (cmd[0] === 'npx' || cmd[0] === 'npm') ? `${cmd[0]}.cmd` : cmd[0];
     const result = spawnSync(executable, cmd.slice(1), {
       cwd,
       encoding: 'utf8',
       timeout: 120000,
-      shell: false,
+      shell: isWindows,
     });
 
     const ms = elapsed();