ultimate-pi 0.18.1 → 0.19.0

package/.pi/lib/agt/policy-engine.ts

@@ -0,0 +1,154 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import {
+	ConflictResolutionStrategy,
+	PolicyEngine,
+} from "@microsoft/agent-governance-sdk";
+import {
+	resolveHarnessPoliciesDir,
+	resolveProjectPoliciesDir,
+} from "./config.js";
+
+const PACKAGE_POLICY_FILES = [
+	"defaults.yaml",
+	"phases.yaml",
+	"roles.yaml",
+	"orchestrator.yaml",
+	"bash-denylists.yaml",
+	"web-guard.yaml",
+	"workflow-sequences.yaml",
+] as const;
+
+let cachedEngine: PolicyEngine | null = null;
+let cachedKey: string | null = null;
+
+export class HarnessPolicyLoadError extends Error {
+	constructor(message: string) {
+		super(message);
+		this.name = "HarnessPolicyLoadError";
+	}
+}
+
+function loadYamlFile(engine: PolicyEngine, path: string): void {
+	let raw: string;
+	try {
+		raw = readFileSync(path, "utf-8");
+	} catch (err) {
+		throw new HarnessPolicyLoadError(
+			`Missing or unreadable policy file: ${path} (${String(err)})`,
+		);
+	}
+	engine.loadYaml(raw);
+}
+
+function loadProjectPolicyDir(
+	engine: PolicyEngine,
+	projectRoot: string,
+): string[] {
+	const dir = resolveProjectPoliciesDir(projectRoot);
+	const loaded: string[] = [];
+	if (!existsSync(dir)) return loaded;
+	const names = readdirSync(dir)
+		.filter((f) => f.endsWith(".yaml") || f.endsWith(".yml"))
+		.sort();
+	for (const name of names) {
+		loadYamlFile(engine, join(dir, name));
+		loaded.push(name);
+	}
+	return loaded;
+}
+
+export interface CreateAgtPolicyEngineInput {
+	packageRoot: string;
+	projectRoot: string;
+}
+
+export function createAgtPolicyEngine(
+	input: CreateAgtPolicyEngineInput,
+): PolicyEngine {
+	const engine = new PolicyEngine([], ConflictResolutionStrategy.DenyOverrides);
+	const dir = resolveHarnessPoliciesDir(input.packageRoot);
+	for (const file of PACKAGE_POLICY_FILES) {
+		loadYamlFile(engine, join(dir, file));
+	}
+	loadProjectPolicyDir(engine, input.projectRoot);
+	return engine;
+}
+
+/** @deprecated Use createAgtPolicyEngine */
+export function createHarnessPolicyEngine(packageRoot: string): PolicyEngine {
+	return createAgtPolicyEngine({
+		packageRoot,
+		projectRoot: process.cwd(),
+	});
+}
+
+export function getAgtPolicyEngine(
+	packageRoot: string,
+	projectRoot: string,
+): PolicyEngine {
+	const key = `${packageRoot}\0${projectRoot}`;
+	if (cachedEngine && cachedKey === key) return cachedEngine;
+	cachedEngine = createAgtPolicyEngine({ packageRoot, projectRoot });
+	cachedKey = key;
+	return cachedEngine;
+}
+
+export function getHarnessPolicyEngine(packageRoot: string): PolicyEngine {
+	return getAgtPolicyEngine(packageRoot, process.cwd());
+}
+
+export function resetHarnessPolicyEngineCache(): void {
+	cachedEngine = null;
+	cachedKey = null;
+}
+
+/** Doctor: policies dir exists and all expected YAML files present. */
+export function doctorHarnessPolicies(
+	packageRoot: string,
+	projectRoot = process.cwd(),
+): {
+	ok: boolean;
+	errors: string[];
+	policyDir: string;
+	loaded: string[];
+	projectLoaded: string[];
+} {
+	const errors: string[] = [];
+	const policyDir = resolveHarnessPoliciesDir(packageRoot);
+	if (!existsSync(policyDir)) {
+		errors.push(`policy directory missing: ${policyDir}`);
+	}
+	const loaded: string[] = [];
+	for (const file of PACKAGE_POLICY_FILES) {
+		const path = join(policyDir, file);
+		if (!existsSync(path)) {
+			errors.push(`missing policy file: ${path}`);
+			continue;
+		}
+		loaded.push(file);
+	}
+	let projectLoaded: string[] = [];
+	try {
+		const names = readdirSync(policyDir).filter((f) => f.endsWith(".yaml"));
+		if (names.length === 0) {
+			errors.push(`no YAML policies in ${policyDir}`);
+		}
+	} catch (err) {
+		errors.push(`cannot read policy dir: ${String(err)}`);
+	}
+	if (errors.length === 0) {
+		try {
+			createAgtPolicyEngine({ packageRoot, projectRoot });
+			const projDir = resolveProjectPoliciesDir(projectRoot);
+			if (existsSync(projDir)) {
+				projectLoaded = readdirSync(projDir).filter(
+					(f) => f.endsWith(".yaml") || f.endsWith(".yml"),
+				);
+			}
+		} catch (err) {
+			errors.push(`PolicyEngine load failed: ${String(err)}`);
+		}
+	}
+	return { ok: errors.length === 0, errors, policyDir, loaded, projectLoaded };
+}

package/.pi/lib/agt/rings.ts

@@ -0,0 +1,21 @@
+import { ExecutionRing, RingEnforcer } from "@microsoft/agent-governance-sdk";
+
+const KIND_RING: Record<string, ExecutionRing> = {
+	planner: ExecutionRing.Ring0,
+	executor: ExecutionRing.Ring2,
+	evaluator: ExecutionRing.Ring0,
+	adversary: ExecutionRing.Ring3,
+	tie_breaker: ExecutionRing.Ring0,
+	meta: ExecutionRing.Ring0,
+	trace: ExecutionRing.Ring0,
+	incident: ExecutionRing.Ring0,
+	other: ExecutionRing.Ring3,
+};
+
+export function ringForHarnessAgentKind(kind: string): ExecutionRing {
+	return KIND_RING[kind] ?? ExecutionRing.Ring3;
+}
+
+export function createRingEnforcer(): RingEnforcer {
+	return new RingEnforcer();
+}

package/.pi/lib/agt/sre-hooks.ts

@@ -0,0 +1,45 @@
+import {
+	CircuitBreaker,
+	GovernanceMetrics,
+} from "@microsoft/agent-governance-sdk";
+
+let metrics: GovernanceMetrics | null = null;
+const breakers = new Map<string, CircuitBreaker>();
+
+export function getHarnessGovernanceMetrics(): GovernanceMetrics {
+	if (!metrics) {
+		metrics = new GovernanceMetrics();
+	}
+	return metrics;
+}
+
+export function getSpawnCircuitBreaker(runId: string): CircuitBreaker {
+	let cb = breakers.get(runId);
+	if (!cb) {
+		cb = new CircuitBreaker(5, 60_000);
+		breakers.set(runId, cb);
+	}
+	return cb;
+}
+
+export function isSreEnforceEnabled(): boolean {
+	return process.env.HARNESS_AGT_SRE_ENFORCE === "1";
+}
+
+export function recordSpawnAttempt(runId: string, ok: boolean): void {
+	const cb = getSpawnCircuitBreaker(runId);
+	if (ok) {
+		cb.onSuccess();
+	} else {
+		cb.onFailure();
+	}
+	getHarnessGovernanceMetrics().recordPolicyDecision(ok ? "allow" : "deny", 0, {
+		run_id: runId,
+		kind: "harness_spawn",
+	});
+}
+
+export function spawnCircuitOpen(runId: string): boolean {
+	if (!isSreEnforceEnabled()) return false;
+	return !getSpawnCircuitBreaker(runId).canExecute();
+}

package/.pi/lib/agt/trust-run-store.ts

@@ -0,0 +1,26 @@
+import { TrustManager } from "@microsoft/agent-governance-sdk";
+
+const stores = new Map<string, TrustManager>();
+
+export function getTrustManagerForRun(runId: string): TrustManager {
+	let tm = stores.get(runId);
+	if (!tm) {
+		tm = new TrustManager({ initialScore: 0.85, decayFactor: 0.98 });
+		stores.set(runId, tm);
+	}
+	return tm;
+}
+
+export function recordPolicyDeny(runId: string, agentDid: string): void {
+	const tm = getTrustManagerForRun(runId);
+	tm.recordFailure(agentDid, 0.08);
+}
+
+export function recordPolicyAllow(runId: string, agentDid: string): void {
+	const tm = getTrustManagerForRun(runId);
+	tm.recordSuccess(agentDid, 0.02);
+}
+
+export function trustScoreForAgent(runId: string, agentDid: string): number {
+	return getTrustManagerForRun(runId).getTrustScore(agentDid).overall;
+}

package/.pi/lib/agt/workflow-history.ts

@@ -0,0 +1,29 @@
+/** Lightweight workflow flags from session custom entries (observation-bus parity). */
+
+type EntryLike = {
+	type?: string;
+	customType?: string;
+	data?: { kind?: string; flags?: string[] };
+};
+
+export function workflowFlagsFromEntries(entries: unknown[]): Set<string> {
+	const flags = new Set<string>();
+	for (const raw of entries) {
+		const entry = raw as EntryLike;
+		if (entry.type !== "custom") continue;
+		if (entry.customType !== "harness-observation") continue;
+		const data = entry.data;
+		if (!data?.flags) continue;
+		for (const f of data.flags) {
+			if (typeof f === "string") flags.add(f);
+		}
+	}
+	return flags;
+}
+
+export function workflowBlocked(
+	flags: Set<string>,
+	requiredPrior: string,
+): boolean {
+	return !flags.has(requiredPrior);
+}

package/.pi/lib/agt-governance-active.ts

@@ -0,0 +1,14 @@
+import { existsSync } from "node:fs";
+import { isAgtGovernanceActive as hasProjectAgtFiles } from "./agents-policy.mjs";
+import { isHarnessProjectEnabled } from "./harness-project-config.js";
+
+/** Subprocess AGT + merged policies when harness is on or project declares policy files. */
+export function isAgtGovernanceActive(projectRoot?: string): boolean {
+	const root = projectRoot ?? process.cwd();
+	if (isHarnessProjectEnabled(root)) return true;
+	return hasProjectAgtFiles(root);
+}
+
+export function projectHasPolicyDir(projectRoot: string): boolean {
+	return hasProjectAgtFiles(projectRoot);
+}

package/.pi/lib/agt-tool-guard.ts

@@ -0,0 +1,78 @@
+import { join } from "node:path";
+import { appendPolicyAuditEvent } from "./agt/audit-run-sink.js";
+import type { BuildEvaluationContextInput } from "./agt/build-evaluation-context.js";
+import { evaluateHarnessToolPolicy } from "./agt/evaluate-policy.js";
+import { recordHarnessPolicyDeny } from "./agt/kill-switch-state.js";
+import { recordPolicyAllow, recordPolicyDeny } from "./agt/trust-run-store.js";
+import { getHarnessPackageRoot } from "./harness-paths.js";
+
+type HarnessPhase = "plan" | "execute" | "evaluate" | "adversary" | "merge";
+
+export interface PolicyStateSlice {
+	phase: HarnessPhase;
+	approvedPlan: boolean;
+	planId: string | null;
+	aborted: boolean;
+	budgetBypass: boolean;
+}
+
+export async function evaluateAgtToolCall(input: {
+	moduleUrl: string;
+	toolName: string;
+	toolInput: Record<string, unknown>;
+	policyState: PolicyStateSlice;
+	entries: unknown[];
+	sessionId: string;
+	projectRoot: string;
+}): Promise<{ block: boolean; reason?: string } | undefined> {
+	const packageRoot = getHarnessPackageRoot(input.moduleUrl);
+	const evalInput: BuildEvaluationContextInput = {
+		toolName: input.toolName,
+		toolInput: input.toolInput,
+		packageRoot,
+		projectRoot: input.projectRoot,
+		sessionId: input.sessionId,
+		entries: input.entries,
+		policyState: input.policyState,
+	};
+
+	const result = await evaluateHarnessToolPolicy(packageRoot, evalInput);
+	const runId = process.env.HARNESS_RUN_ID?.trim();
+	const runDir =
+		process.env.HARNESS_RUN_DIR?.trim() ??
+		(runId ? join(packageRoot, ".pi", "harness", "runs", runId) : "");
+
+	if (runId && runDir) {
+		const agentDid =
+			process.env.HARNESS_AGENT_DID?.trim() ??
+			(process.env.HARNESS_AGENT_ID?.trim() || "parent-orchestrator");
+		appendPolicyAuditEvent({
+			runDir,
+			runId,
+			toolName: input.toolName,
+			allowed: result.allowed,
+			reason: result.reason,
+			agentDid,
+			phase: input.policyState.phase,
+		});
+		if (result.allowed) {
+			recordPolicyAllow(runId, agentDid);
+		} else {
+			recordPolicyDeny(runId, agentDid);
+		}
+	}
+
+	if (!result.allowed) {
+		recordHarnessPolicyDeny(input.sessionId);
+		return {
+			block: true,
+			reason: result.reason.startsWith("agt-policy")
+				? result.reason
+				: `agt-policy: ${result.reason}`,
+		};
+	}
+	return undefined;
+}
+
+/** @deprecated Use evaluateAgtToolCall */
+export const evaluateAgtHarnessToolCall = evaluateAgtToolCall;

package/.pi/lib/ask-user/dialog.ts

@@ -0,0 +1,314 @@
+import type { ExtensionUIContext } from "@earendil-works/pi-coding-agent";
+import {
+	Editor,
+	type EditorTheme,
+	Key,
+	matchesKey,
+	truncateToWidth,
+} from "@earendil-works/pi-tui";
+import type { AskResponse, DialogResult, ValidatedAskParams } from "./types.js";
+
+type DisplayOption = {
+	title: string;
+	description?: string;
+	isFreeform?: boolean;
+};
+
+interface CustomAnswer {
+	response: AskResponse;
+}
+
+type ThemeLike = { fg(color: string, text: string): string };
+type TuiLike = ConstructorParameters<typeof Editor>[0] & {
+	requestRender(): void;
+};
+type Done = (answer: CustomAnswer | null) => void;
+
+function withTimeout<T>(
+	promise: Promise<T | null>,
+	ms: number | undefined,
+): Promise<T | null> {
+	if (!ms) return promise;
+	return Promise.race([
+		promise,
+		new Promise<null>((resolve) => {
+			setTimeout(() => resolve(null), ms);
+		}),
+	]);
+}
+
+function displayOptionsFor(validated: ValidatedAskParams): DisplayOption[] {
+	const displayOptions: DisplayOption[] = [...validated.options];
+	if (validated.allowFreeform) {
+		displayOptions.push({ title: "Type something…", isFreeform: true });
+	}
+	return displayOptions;
+}
+
+async function runFreeformOnly(
+	ui: ExtensionUIContext,
+	question: string,
+): Promise<DialogResult> {
+	const text = await ui.input(question, "");
+	if (!text?.trim()) return { response: null, cancelled: true };
+	return {
+		response: { kind: "freeform", text: text.trim() },
+		cancelled: false,
+	};
+}
+
+function editorThemeFor(theme: ThemeLike): EditorTheme {
+	return {
+		borderColor: (s) => theme.fg("accent", s),
+		selectList: {
+			selectedPrefix: (t) => theme.fg("accent", t),
+			selectedText: (t) => theme.fg("accent", t),
+			description: (t) => theme.fg("muted", t),
+			scrollInfo: (t) => theme.fg("dim", t),
+			noMatch: (t) => theme.fg("warning", t),
+		},
+	};
+}
+
+class AskDialogController {
+	private optionIndex = 0;
+	private editMode = false;
+	private readonly selected = new Set<number>();
+	private cachedLines: string[] | undefined;
+	private readonly editor: Editor;
+
+	constructor(
+		private readonly validated: ValidatedAskParams,
+		private readonly displayOptions: DisplayOption[],
+		private readonly tui: TuiLike,
+		private readonly theme: ThemeLike,
+		private readonly done: Done,
+	) {
+		this.editor = new Editor(tui, editorThemeFor(theme));
+		this.editor.onSubmit = (value) => this.submitFreeform(value);
+	}
+
+	invalidate(): void {
+		this.cachedLines = undefined;
+	}
+
+	handleInput(data: string): void {
+		if (this.editMode) {
+			this.handleEditInput(data);
+			return;
+		}
+		if (this.handleNavigationInput(data)) return;
+		if (this.validated.allowMultiple && matchesKey(data, Key.space)) {
+			this.toggleMultiSelect();
+			return;
+		}
+		if (matchesKey(data, Key.enter)) this.submitSelection();
+		if (matchesKey(data, Key.escape)) this.done(null);
+	}
+
+	render(width: number): string[] {
+		if (this.cachedLines) return this.cachedLines;
+		const lines: string[] = [];
+		const add = (s: string) => lines.push(truncateToWidth(s, width));
+		const useOverlay = this.validated.displayMode !== "inline";
+		this.renderHeader(lines, add, width, useOverlay);
+		this.renderOptions(add);
+		this.renderEditor(lines, add, width);
+		this.renderFooter(add, width, useOverlay);
+		this.cachedLines = lines;
+		return lines;
+	}
+
+	private refresh(): void {
+		this.invalidate();
+		this.tui.requestRender();
+	}
+
+	private submitFreeform(value: string): void {
+		const trimmed = value.trim();
+		if (trimmed) {
+			this.done({ response: { kind: "freeform", text: trimmed } });
+			return;
+		}
+		this.editMode = false;
+		this.editor.setText("");
+		this.refresh();
+	}
+
+	private submitSelection(): void {
+		if (this.validated.allowMultiple) {
+			const titles = [...this.selected]
+				.sort((a, b) => a - b)
+				.map((i) => this.displayOptions[i].title)
+				.filter((t) => t !== "Type something…");
+			if (titles.length) {
+				this.done({ response: { kind: "selection", selections: titles } });
+			}
+			return;
+		}
+		const opt = this.displayOptions[this.optionIndex];
+		if (opt.isFreeform) {
+			this.editMode = true;
+			this.refresh();
+			return;
+		}
+		this.done({ response: { kind: "selection", selections: [opt.title] } });
+	}
+
+	private handleEditInput(data: string): void {
+		if (matchesKey(data, Key.escape)) {
+			this.editMode = false;
+			this.editor.setText("");
+		} else {
+			this.editor.handleInput(data);
+		}
+		this.refresh();
+	}
+
+	private handleNavigationInput(data: string): boolean {
+		if (matchesKey(data, Key.up)) {
+			this.optionIndex = Math.max(0, this.optionIndex - 1);
+			this.refresh();
+			return true;
+		}
+		if (matchesKey(data, Key.down)) {
+			this.optionIndex = Math.min(
+				this.displayOptions.length - 1,
+				this.optionIndex + 1,
+			);
+			this.refresh();
+			return true;
+		}
+		return false;
+	}
+
+	private toggleMultiSelect(): void {
+		const opt = this.displayOptions[this.optionIndex];
+		if (opt.isFreeform) return;
+		if (this.selected.has(this.optionIndex)) {
+			this.selected.delete(this.optionIndex);
+		} else {
+			this.selected.add(this.optionIndex);
+		}
+		this.refresh();
+	}
+
+	private renderHeader(
+		lines: string[],
+		add: (s: string) => void,
+		width: number,
+		useOverlay: boolean,
+	): void {
+		if (useOverlay) add(this.theme.fg("accent", "─".repeat(width)));
+		if (this.validated.context) {
+			for (const line of this.validated.context.split("\n")) {
+				add(this.theme.fg("muted", ` ${line}`));
+			}
+			lines.push("");
+		}
+		add(this.theme.fg("text", ` ${this.validated.question}`));
+		lines.push("");
+	}
+
+	private renderOptions(add: (s: string) => void): void {
+		for (let i = 0; i < this.displayOptions.length; i++) {
+			const opt = this.displayOptions[i];
+			const prefix = this.optionPrefix(i, opt.isFreeform === true);
+			const label = this.optionLabel(i, opt);
+			add(`${prefix}${label}`);
+			if (opt.description)
+				add(`     ${this.theme.fg("muted", opt.description)}`);
+		}
+	}
+
+	private optionPrefix(index: number, isFreeform: boolean): string {
+		if (!this.validated.allowMultiple) {
+			return index === this.optionIndex ? this.theme.fg("accent", "> ") : "  ";
+		}
+		if (isFreeform) return "  ";
+		return this.selected.has(index) ? this.theme.fg("accent", "[x] ") : "[ ] ";
+	}
+
+	private optionLabel(index: number, opt: DisplayOption): string {
+		const raw = `${index + 1}. ${opt.title}`;
+		const focused = index === this.optionIndex;
+		if (opt.isFreeform && this.editMode && focused) {
+			return this.theme.fg("accent", `${raw} ✎`);
+		}
+		if (focused && !this.validated.allowMultiple) {
+			return this.theme.fg("accent", raw);
+		}
+		return this.theme.fg("text", raw);
+	}
+
+	private renderEditor(
+		lines: string[],
+		add: (s: string) => void,
+		width: number,
+	): void {
+		if (!this.editMode) return;
+		lines.push("");
+		add(this.theme.fg("muted", " Your answer:"));
+		for (const line of this.editor.render(width - 2)) add(` ${line}`);
+	}
+
+	private renderFooter(
+		add: (s: string) => void,
+		width: number,
+		useOverlay: boolean,
+	): void {
+		add("");
+		if (this.editMode) {
+			add(this.theme.fg("dim", " Enter to submit • Esc to go back"));
+		} else if (this.validated.allowMultiple) {
+			add(
+				this.theme.fg(
+					"dim",
+					" ↑↓ navigate • Space toggle • Enter confirm • Esc cancel",
+				),
+			);
+		} else {
+			add(
+				this.theme.fg("dim", " ↑↓ navigate • Enter to select • Esc to cancel"),
+			);
+		}
+		if (useOverlay) add(this.theme.fg("accent", "─".repeat(width)));
+	}
+}
+
+async function runOptionDialog(
+	ui: ExtensionUIContext,
+	validated: ValidatedAskParams,
+	displayOptions: DisplayOption[],
+): Promise<CustomAnswer | null> {
+	return withTimeout(
+		ui.custom<CustomAnswer | null>((tui, theme, _kb, done) => {
+			const controller = new AskDialogController(
+				validated,
+				displayOptions,
+				tui as TuiLike,
+				theme,
+				done,
+			);
+			return {
+				render: (width: number) => controller.render(width),
+				invalidate: () => controller.invalidate(),
+				handleInput: (data: string) => controller.handleInput(data),
+			};
+		}),
+		validated.timeout,
+	);
+}
+
+export async function runAskDialog(
+	ui: ExtensionUIContext,
+	validated: ValidatedAskParams,
+): Promise<DialogResult> {
+	const displayOptions = displayOptionsFor(validated);
+	if (displayOptions.length === 0) {
+		return runFreeformOnly(ui, validated.question);
+	}
+	const result = await runOptionDialog(ui, validated, displayOptions);
+	if (!result) return { response: null, cancelled: true };
+	return { response: result.response, cancelled: false };
+}