tribunal-kit 9.2.5 → 9.2.6

package/.agent/scripts/mcp_server.js

@@ -16,15 +16,15 @@ class McpServer {
     this.rl = readline.createInterface({
       input: process.stdin,
       output: process.stdout,
-      terminal: false
+      terminal: false,
     });
 
-    this.rl.on('line', (line) => {
+    this.rl.on('line', line => {
       try {
         const req = JSON.parse(line);
         this.handleMessage(req);
       } catch (_err) {
-        this.sendError(null, -32700, "Parse error");
+        this.sendError(null, -32700, 'Parse error');
       }
     });
 
@@ -33,31 +33,32 @@ class McpServer {
       name: `tribunal_${syscallName}`,
       description: `Executes the Tribunal Kit ${syscallName} script securely.`,
       inputSchema: {
-        type: "object",
+        type: 'object',
         properties: {
           args: {
-            type: "array",
-            items: { type: "string" },
-            description: `Arguments to pass. Allowed arguments: ${SYSCALL_MAP[syscallName].allowedArgs.join(', ')}`
-          }
-        }
-      }
+            type: 'array',
+            items: { type: 'string' },
+            description: `Arguments to pass. Allowed arguments: ${SYSCALL_MAP[syscallName].allowedArgs.join(', ')}`,
+          },
+        },
+      },
     }));
-    
+
     // Add DAG dispatch as an exposed MCP tool
     this.tools.push({
-      name: "tribunal_dispatch_dag",
-      description: "Dispatch a Dynamic Directed Acyclic Graph (DAG) for parallel, staged execution.",
+      name: 'tribunal_dispatch_dag',
+      description:
+        'Dispatch a Dynamic Directed Acyclic Graph (DAG) for parallel, staged execution.',
       inputSchema: {
-        type: "object",
+        type: 'object',
         properties: {
           payloadFile: {
-            type: "string",
-            description: "Path to the JSON payload file containing the DAG"
-          }
+            type: 'string',
+            description: 'Path to the JSON payload file containing the DAG',
+          },
         },
-        required: ["payloadFile"]
-      }
+        required: ['payloadFile'],
+      },
     });
   }
 
@@ -67,114 +68,135 @@ class McpServer {
 
   sendError(id, code, message) {
     this.send({
-      jsonrpc: "2.0",
+      jsonrpc: '2.0',
       id: id || null,
-      error: { code, message }
+      error: { code, message },
     });
   }
 
   handleMessage(req) {
-    if (req.method === "initialize") {
+    if (req.method === 'initialize') {
       this.send({
-        jsonrpc: "2.0",
+        jsonrpc: '2.0',
         id: req.id,
         result: {
-          protocolVersion: "2024-11-05",
+          protocolVersion: '2024-11-05',
           capabilities: { tools: {} },
-          serverInfo: { name: "tribunal-mcp", version: "1.0.0" }
-        }
+          serverInfo: { name: 'tribunal-mcp', version: '1.0.0' },
+        },
       });
       return;
     }
 
-    if (req.method === "tools/list") {
+    if (req.method === 'tools/list') {
       this.send({
-        jsonrpc: "2.0",
+        jsonrpc: '2.0',
         id: req.id,
-        result: { tools: this.tools }
+        result: { tools: this.tools },
       });
       return;
     }
 
-    if (req.method === "tools/call") {
+    if (req.method === 'tools/call') {
       this.handleToolCall(req);
       return;
     }
 
     // Ignore unsupported methods gracefully
-    this.sendError(req.id, -32601, "Method not found");
+    this.sendError(req.id, -32601, 'Method not found');
   }
 
   handleToolCall(req) {
     const { name, arguments: args } = req.params;
 
     // Log the MCP interaction natively into the session.jsonl log
-    const eventId = appendEvent('ToolRequested', {
-      tool: name,
-      args: args
-    }, 'mcp-server');
-
-    if (name === "tribunal_dispatch_dag") {
+    const eventId = appendEvent(
+      'ToolRequested',
+      {
+        tool: name,
+        args: args,
+      },
+      'mcp-server',
+    );
+
+    if (name === 'tribunal_dispatch_dag') {
       const payloadFile = args.payloadFile;
       if (!payloadFile) {
-        return this.sendError(req.id, -32602, "Missing payloadFile argument");
+        return this.sendError(req.id, -32602, 'Missing payloadFile argument');
       }
-      
+
       try {
         const { spawnSync } = require('child_process');
         const scriptPath = require('path').join(__dirname, 'swarm_dispatcher.js');
         const result = spawnSync('node', [scriptPath, '--mode', 'dag', '--file', payloadFile], {
           cwd: process.cwd(),
           encoding: 'utf8',
-          timeout: 120000 
+          timeout: 120000,
         });
-        
-        appendEvent('ToolCompleted', { exitCode: result.status, requestEventId: eventId }, 'mcp-server');
+
+        appendEvent(
+          'ToolCompleted',
+          { exitCode: result.status, requestEventId: eventId },
+          'mcp-server',
+        );
         this.send({
-          jsonrpc: "2.0",
+          jsonrpc: '2.0',
           id: req.id,
           result: {
-            content: [{ type: "text", text: result.stdout || (result.stderr ? "Error: " + result.stderr : "Executed.") }]
-          }
+            content: [
+              {
+                type: 'text',
+                text: result.stdout || (result.stderr ? 'Error: ' + result.stderr : 'Executed.'),
+              },
+            ],
+          },
         });
       } catch (err) {
-        this.sendError(req.id, -32603, "Internal execution error: " + err.message);
+        this.sendError(req.id, -32603, 'Internal execution error: ' + err.message);
       }
       return;
     }
 
     // Process syscall registry tools
-    const prefix = "tribunal_";
+    const prefix = 'tribunal_';
     if (name.startsWith(prefix)) {
       const syscall = name.substring(prefix.length);
       const syscallArgs = args.args || [];
-      
+
       const result = executeSyscall(syscall, syscallArgs);
-      
+
       if (result.exitCode === 0) {
-        appendEvent('ToolCompleted', { exitCode: 0, stdout: result.stdout, requestEventId: eventId }, 'mcp-server');
+        appendEvent(
+          'ToolCompleted',
+          { exitCode: 0, stdout: result.stdout, requestEventId: eventId },
+          'mcp-server',
+        );
         this.send({
-          jsonrpc: "2.0",
+          jsonrpc: '2.0',
           id: req.id,
           result: {
-            content: [{ type: "text", text: result.stdout }]
-          }
+            content: [{ type: 'text', text: result.stdout }],
+          },
         });
       } else {
-        appendEvent('ErrorEncountered', { exitCode: result.exitCode, message: result.stderr, requestEventId: eventId }, 'mcp-server');
+        appendEvent(
+          'ErrorEncountered',
+          { exitCode: result.exitCode, message: result.stderr, requestEventId: eventId },
+          'mcp-server',
+        );
         this.send({
-          jsonrpc: "2.0",
+          jsonrpc: '2.0',
           id: req.id,
           result: {
-            content: [{ type: "text", text: "Error: " + result.stderr + "\n" + result.stdout }],
-            isError: true
-          }
+            content: [{ type: 'text', text: 'Error: ' + result.stderr + '\n' + result.stdout }],
+            isError: true,
+          },
         });
       }
       return;
     }
 
-    this.sendError(req.id, -32601, "Tool not found");
+    this.sendError(req.id, -32601, 'Tool not found');
   }
 }
 

package/.agent/scripts/memory_archivist.js

@@ -44,39 +44,43 @@ function saveInstincts(instincts) {
 function archiveSession() {
   const events = readEvents();
   const instincts = loadInstincts();
-  
+
   let currentError = null;
   let newInstinctsCount = 0;
 
   for (const evt of events) {
     if (evt.type === 'ErrorEncountered') {
       currentError = evt;
-    } else if (evt.type === 'ToolCompleted' && currentError && evt.sessionId === currentError.sessionId) {
-      // If we see a successful tool completion shortly after an error in the same session, 
+    } else if (
+      evt.type === 'ToolCompleted' &&
+      currentError &&
+      evt.sessionId === currentError.sessionId
+    ) {
+      // If we see a successful tool completion shortly after an error in the same session,
       // we assume it's a resolution. In a real LLM setup, we'd use an AI pass here to summarize the fix.
       // For now, we stub the instinct generation based on the error.
-      
+
       const errorMsg = currentError.payload.message || 'Unknown error';
-      
+
       // Avoid duplicates
       const exists = instincts.find(i => i.evidence.failedEventId === currentError.eventId);
-      
+
       if (!exists && errorMsg !== 'Unknown error') {
         const newInstinct = {
           id: `instinct_${Date.now()}_${Math.floor(Math.random() * 1000)}`,
-          domain: "auto-archived",
+          domain: 'auto-archived',
           rule: `Avoid pattern that caused: ${errorMsg}`,
           evidence: {
             failedEventId: currentError.eventId,
-            resolutionEventId: evt.eventId
+            resolutionEventId: evt.eventId,
           },
-          confidence: "L3" // L3 because it's auto-generated without human verification
+          confidence: 'L3', // L3 because it's auto-generated without human verification
         };
-        
+
         instincts.push(newInstinct);
         newInstinctsCount++;
       }
-      
+
       // Reset error tracker
       currentError = null;
     }
@@ -84,7 +88,9 @@ function archiveSession() {
 
   if (newInstinctsCount > 0) {
     saveInstincts(instincts);
-    console.log(`✅ Memory Archivist mined ${newInstinctsCount} new instincts from the session log.`);
+    console.log(
+      `✅ Memory Archivist mined ${newInstinctsCount} new instincts from the session log.`,
+    );
   } else {
     console.log(`ℹ️ Memory Archivist found no new verifiable patterns in the session log.`);
   }

package/.agent/scripts/memory_consolidator.js

@@ -2,25 +2,25 @@ const { MemoryEngine } = require('./memory_engine.js');
 
 async function consolidateMemory(agentDir) {
   console.log(`Starting memory consolidation for workspace: ${agentDir}`);
-  
+
   const engine = new MemoryEngine(agentDir);
   const index = engine.loadIndex();
 
   const episodics = index.entries.filter(e => e.memory_type === 'episodic');
   const workings = index.entries.filter(e => e.memory_type === 'working');
-  
+
   if (episodics.length === 0 && workings.length === 0) {
-    console.log("No Episodic or Working memories to consolidate.");
+    console.log('No Episodic or Working memories to consolidate.');
     return;
   }
 
   console.log(`Found ${episodics.length} Episodic and ${workings.length} Working memories.`);
-  console.log("Submitting to LLM for consolidation into Semantic rules...");
+  console.log('Submitting to LLM for consolidation into Semantic rules...');
 
   // Simulation of Tribunal's Maker-Reviewer LLM invocation.
   // In production, this would pass the contexts to the `logic-reviewer` and output a compressed fact.
   const consolidatedContent = `Generalized rule derived from ${episodics.length} episodic events and ${workings.length} working sessions.`;
-  
+
   const semanticId = engine.store({
     type: 'semantic',
     content: consolidatedContent,
@@ -30,7 +30,7 @@ async function consolidateMemory(agentDir) {
   });
 
   console.log(`Generated new Semantic Memory ID: ${semanticId}`);
-  console.log("Consolidation complete. Run `tk memory gc` to clear old working entries.");
+  console.log('Consolidation complete. Run `tk memory gc` to clear old working entries.');
 }
 
 const dir = process.cwd();

package/.agent/scripts/memory_engine.js

@@ -117,29 +117,37 @@ function releaseLock(lockPath) {
 
 function computeScore(entry, query, corpus = []) {
   if (!query || !entry.content) return 0;
-  const queryWords = query.toLowerCase().split(/\s+/).filter(w => w.length > 2);
+  const queryWords = query
+    .toLowerCase()
+    .split(/\s+/)
+    .filter(w => w.length > 2);
   if (queryWords.length === 0) return 0;
   const contentLower = entry.content.toLowerCase();
 
   let relevance = 0;
   const k1 = 1.2;
   const b = 0.75;
-  const avgdl_raw = corpus.length > 0 ? corpus.reduce((sum, e) => sum + (e.content ? e.content.length : 0), 0) / corpus.length : 100;
+  const avgdl_raw =
+    corpus.length > 0
+      ? corpus.reduce((sum, e) => sum + (e.content ? e.content.length : 0), 0) / corpus.length
+      : 100;
   const avgdl = avgdl_raw || 100;
   const dl = contentLower.length;
 
   for (const word of queryWords) {
     const termFreq = contentLower.split(word).length - 1;
-    if (termFreq === 0 && (!entry.tags || !entry.tags.some(t => t.toLowerCase().includes(word)))) continue;
-    
+    if (termFreq === 0 && (!entry.tags || !entry.tags.some(t => t.toLowerCase().includes(word))))
+      continue;
+
     // Effective TF including tag boost
-    const tf = termFreq + (entry.tags && entry.tags.some(t => t.toLowerCase().includes(word)) ? 2 : 0);
-    
+    const tf =
+      termFreq + (entry.tags && entry.tags.some(t => t.toLowerCase().includes(word)) ? 2 : 0);
+
     const docFreq = corpus.filter(e => e.content && e.content.toLowerCase().includes(word)).length;
     // IDF
     const idf = Math.log((corpus.length - docFreq + 0.5) / (docFreq + 0.5) + 1.0);
-    
-    relevance += idf * (tf * (k1 + 1)) / (tf + k1 * (1 - b + b * (dl / avgdl)));
+
+    relevance += (idf * (tf * (k1 + 1))) / (tf + k1 * (1 - b + b * (dl / avgdl)));
   }
 
   // Exact phrase match bonus
@@ -149,9 +157,10 @@ function computeScore(entry, query, corpus = []) {
 
   if (relevance === 0) return 0;
 
-  const priority = entry.priority != null ? entry.priority : (TYPE_PRIORITY[entry.memory_type] || 0.5);
+  const priority =
+    entry.priority != null ? entry.priority : TYPE_PRIORITY[entry.memory_type] || 0.5;
   const confidence = typeof entry.confidence === 'number' ? entry.confidence : 1.0;
-  
+
   let recency = 0;
   if (entry.memory_type === 'episodic') {
     const age = daysSince(entry.created_at);
@@ -159,7 +168,7 @@ function computeScore(entry, query, corpus = []) {
   }
   const freqBoost = Math.max(0, Math.log(entry.access_count || 1)) * 0.05;
 
-  return (relevance * priority * confidence) + recency + freqBoost;
+  return relevance * priority * confidence + recency + freqBoost;
 }
 
 // ─── Memory Engine Class ──────────────────────────────────────────────────────
@@ -260,7 +269,9 @@ class MemoryEngine {
       }
 
       const now = nowEpochStr();
-      const nextId = index.next_id || (index.entries.length > 0 ? Math.max(...index.entries.map(e => e.id)) + 1 : 1);
+      const nextId =
+        index.next_id ||
+        (index.entries.length > 0 ? Math.max(...index.entries.map(e => e.id)) + 1 : 1);
       const cleanTags = Array.isArray(tags)
         ? tags.filter(t => typeof t === 'string' && t.trim().length > 0).map(t => t.trim())
         : [];
@@ -278,7 +289,12 @@ class MemoryEngine {
         session_id: options.sessionId || options.session_id || null,
         priority: typeof options.priority === 'number' ? options.priority : 1.0,
         relations: Array.isArray(options.relations) ? options.relations : [],
-        confidence: typeof options.confidence === 'number' ? options.confidence : (options.source === 'learned' ? 0.5 : 1.0),
+        confidence:
+          typeof options.confidence === 'number'
+            ? options.confidence
+            : options.source === 'learned'
+              ? 0.5
+              : 1.0,
       };
 
       index.entries.push(entry);
@@ -316,10 +332,10 @@ class MemoryEngine {
       for (const s of scored) {
         if (s.entry.relations) {
           for (const relId of s.entry.relations) {
-             const related = scored.find(r => String(r.entry.id) === String(relId));
-             if (related) {
-               related.score += s.score * 0.2; // 20% boost from incoming relation
-             }
+            const related = scored.find(r => String(r.entry.id) === String(relId));
+            if (related) {
+              related.score += s.score * 0.2; // 20% boost from incoming relation
+            }
           }
         }
       }

package/.agent/scripts/pipeline_engine.js

@@ -52,7 +52,6 @@ try {
   sessionLogger = require('./session_logger');
 } catch (_e) {}
 
-
 // ── Lazy-load sibling scripts (avoid circular deps) ─────────────────────────
 let _contextBroker = null;
 function getContextBroker() {
@@ -528,15 +527,28 @@ function validatePhase(code, spec, opts = {}) {
   const guardrailEngine = _getGuardrailEngine();
   if (guardrailEngine && typeof guardrailEngine.validate === 'function') {
     try {
-      let manifest = { agents: { all: [] }, skills: { names: [] }, cross_references: [], numeric_claims: [], scripts: { files: {} } };
+      let manifest = {
+        agents: { all: [] },
+        skills: { names: [] },
+        cross_references: [],
+        numeric_claims: [],
+        scripts: { files: {} },
+      };
       try {
-        const manifestPath = path.join(process.cwd(), '.agent', 'history', 'integrity_manifest.json');
+        const manifestPath = path.join(
+          process.cwd(),
+          '.agent',
+          'history',
+          'integrity_manifest.json',
+        );
         if (fs.existsSync(manifestPath)) {
           manifest = JSON.parse(fs.readFileSync(manifestPath, 'utf8'));
         }
       } catch (_e) {}
 
-      const grResult = guardrailEngine.validate(code, manifest, { context: { projectRoot: process.cwd(), filePath: spec.target_file } });
+      const grResult = guardrailEngine.validate(code, manifest, {
+        context: { projectRoot: process.cwd(), filePath: spec.target_file },
+      });
       if (grResult && grResult.violations) {
         for (const v of grResult.violations) {
           issues.push({
@@ -614,7 +626,6 @@ function detectLang(spec) {
   return map[ext] || 'js';
 }
 
-
 /**
  * Find the first line number matching a regex pattern.
  */
@@ -656,12 +667,16 @@ function fullPipeline(task, files = [], opts = {}) {
   const validate = code => validatePhase(code, spec, { lang: detectLang(spec) });
 
   if (sessionLogger) {
-    sessionLogger.appendEvent('AgentDispatched', {
-      task,
-      files,
-      promptTokens: builderResult.tokenEstimate,
-      skills: builderResult.skillsLoaded,
-    }, 'pipeline_engine');
+    sessionLogger.appendEvent(
+      'AgentDispatched',
+      {
+        task,
+        files,
+        promptTokens: builderResult.tokenEstimate,
+        skills: builderResult.skillsLoaded,
+      },
+      'pipeline_engine',
+    );
   }
 
   return {

package/.agent/scripts/secret_redactor.js

@@ -0,0 +1,119 @@
+#!/usr/bin/env node
+/**
+ * secret_redactor.js — Redacts recognizable secrets from evidence and report content.
+ *
+ * Patterns covered:
+ *   - API keys (common prefixes: sk_, pk_, api_, key_)
+ *   - Bearer tokens
+ *   - JWTs (eyJ...)
+ *   - Private keys (-----BEGIN)
+ *   - Database URLs (postgres://, mysql://, mongodb://)
+ *   - .env key=value pairs with sensitive names
+ *   - AWS access keys (AKIA...)
+ *   - Generic long hex/base64 strings in value positions
+ */
+
+'use strict';
+
+const SECRET_PATTERNS = [
+  // API keys with common prefixes
+  {
+    pattern: /\b(sk_live_|sk_test_|pk_live_|pk_test_|api_key_|key_)[A-Za-z0-9_\-]{8,}\b/g,
+    label: '[REDACTED_API_KEY]',
+  },
+  // Bearer tokens
+  { pattern: /Bearer\s+[A-Za-z0-9\-_.~+/]{20,}/gi, label: 'Bearer [REDACTED_TOKEN]' },
+  // JWTs
+  {
+    pattern: /eyJ[A-Za-z0-9_\-]{10,}\.eyJ[A-Za-z0-9_\-]{10,}\.[A-Za-z0-9_\-]{10,}/g,
+    label: '[REDACTED_JWT]',
+  },
+  // Private keys
+  {
+    pattern:
+      /-----BEGIN\s+(RSA\s+)?PRIVATE\s+KEY-----[\s\S]*?-----END\s+(RSA\s+)?PRIVATE\s+KEY-----/g,
+    label: '[REDACTED_PRIVATE_KEY]',
+  },
+  // Database connection strings
+  {
+    pattern: /(postgres|postgresql|mysql|mongodb|redis|amqp):\/\/[^\s"'`]+/gi,
+    label: '[REDACTED_DB_URL]',
+  },
+  // AWS access keys
+  { pattern: /\bAKIA[A-Z0-9]{16}\b/g, label: '[REDACTED_AWS_KEY]' },
+  // Generic password/secret assignments
+  {
+    pattern:
+      /(password|passwd|secret|token|api_key|apikey|auth_token|access_token|private_key)\s*[:=]\s*["']?[^\s"']{8,}["']?/gi,
+    label: '$1=[REDACTED]',
+  },
+  // Hex strings that look like secrets (32+ chars in value-like positions)
+  { pattern: /(?<==["']?)[0-9a-f]{32,}(?=["']?\s|$)/gi, label: '[REDACTED_HEX]' },
+];
+
+/**
+ * Redact secrets from a string.
+ * Returns the redacted string and a count of redactions performed.
+ */
+function redactSecrets(text) {
+  if (!text || typeof text !== 'string') return { text, redactions: 0 };
+  let redactions = 0;
+  let result = text;
+  for (const { pattern, label } of SECRET_PATTERNS) {
+    // Reset regex lastIndex for global patterns
+    pattern.lastIndex = 0;
+    result = result.replace(pattern, (...args) => {
+      redactions++;
+      // Handle capture groups in replacement
+      if (label.includes('$1') && args.length > 2) {
+        return label.replace('$1', args[1]);
+      }
+      return label;
+    });
+    // Reset again after use
+    pattern.lastIndex = 0;
+  }
+  return { text: result, redactions };
+}
+
+/**
+ * Redact secrets from a finding's evidence, impact, remediation, and title.
+ */
+function redactFinding(finding) {
+  const redacted = { ...finding };
+  let totalRedactions = 0;
+
+  if (redacted.title) {
+    const r = redactSecrets(redacted.title);
+    redacted.title = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.impact) {
+    const r = redactSecrets(redacted.impact);
+    redacted.impact = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.remediation) {
+    const r = redactSecrets(redacted.remediation);
+    redacted.remediation = r.text;
+    totalRedactions += r.redactions;
+  }
+
+  if (redacted.evidence && Array.isArray(redacted.evidence)) {
+    redacted.evidence = redacted.evidence.map(e => {
+      const desc = redactSecrets(e.description || '');
+      totalRedactions += desc.redactions;
+      return { ...e, description: desc.text };
+    });
+  }
+
+  if (totalRedactions > 0) {
+    redacted._redactions = totalRedactions;
+  }
+
+  return redacted;
+}
+
+module.exports = { redactSecrets, redactFinding, SECRET_PATTERNS };

package/.agent/scripts/session_logger.js

@@ -36,7 +36,7 @@ function appendEvent(type, payload = {}, source = 'system', sessionId = 'default
     sessionId,
     type,
     source,
-    payload
+    payload,
   };
 
   const line = JSON.stringify(event) + '\n';
@@ -83,10 +83,10 @@ function rehydrateState() {
         startedAt: null,
         endedAt: null,
         events: [],
-        status: 'active'
+        status: 'active',
       };
     }
-    
+
     const sess = state.sessions[evt.sessionId];
     sess.events.push(evt);
 
@@ -111,5 +111,5 @@ module.exports = {
   appendEvent,
   readEvents,
   rehydrateState,
-  SESSION_FILE
+  SESSION_FILE,
 };