wholestack 0.4.0

package/dist/index.js

@@ -0,0 +1,297 @@
+import {
+  ALL_DETECTORS,
+  Agent,
+  CapabilityEnforcer,
+  CommandRegistry,
+  DEFAULT_FIREWALL,
+  DEFAULT_POLICY,
+  DEFAULT_REGISTRY,
+  HookRunner,
+  InputController,
+  NO_CAPS,
+  PERMISSION_MODES,
+  Permissions,
+  PolicyEngine,
+  PromptFirewall,
+  PromptRegistry,
+  Session,
+  UNTRUSTED_CHANNELS,
+  UsageMeter,
+  applyFirewall,
+  applyHooks,
+  buildProviderOptions,
+  buildTools,
+  buildWebTools,
+  capsAllow,
+  channelAuthority,
+  compact,
+  defaultManifestFor,
+  diffStat,
+  estimateCost,
+  estimateTokens,
+  isPermissionMode,
+  isUntrusted,
+  isUntrustedTool,
+  listModels,
+  loadHookFiles,
+  loadMcpTools,
+  loadMdCommands,
+  loadPlugins,
+  loadProjectMemory,
+  maxSeverity,
+  mergeHookSets,
+  modelContextWindow,
+  modelId,
+  modelLabel,
+  renderEditDiff,
+  renderNewFileDiff,
+  resolveModel,
+  resolveModelKey,
+  severityRank,
+  supportsThinking
+} from "./chunk-7DJJXUV4.js";
+
+// src/prompts/template.ts
+var PLACEHOLDER = /\{\{([A-Za-z0-9_.]+)\}\}/g;
+function renderTemplate(tpl, vars, opts) {
+  const strict = opts?.strict ?? false;
+  return tpl.replace(PLACEHOLDER, (_match, key) => {
+    if (Object.prototype.hasOwnProperty.call(vars, key)) {
+      return vars[key];
+    }
+    if (strict) throw new Error(`renderTemplate: unknown template variable "${key}"`);
+    return "";
+  });
+}
+function estimateTextTokens(text) {
+  return Math.ceil(text.length / 4);
+}
+var TRIM_MARKER = " \u2026[trimmed]";
+var TRIM_ORDER = [
+  // untrusted data channels (see UNTRUSTED_CHANNELS / "memory" in the contract)
+  "tool",
+  "mcp",
+  "web",
+  "retrieved",
+  "memory",
+  "user",
+  "developer"
+];
+function cloneChannel(ch) {
+  return { ...ch };
+}
+function budgetChannels(input) {
+  const reserve = input.reserve ?? 0;
+  const limit = Math.max(0, input.maxTokens - reserve);
+  const channels = input.channels.map(cloneChannel);
+  const dropped = /* @__PURE__ */ new Map();
+  const total = () => channels.reduce((sum, ch) => sum + estimateTextTokens(ch.content), 0);
+  for (const kind of TRIM_ORDER) {
+    if (total() <= limit) break;
+    if (kind === "system") continue;
+    for (const ch of channels) {
+      if (ch.kind !== kind) continue;
+      const before = estimateTextTokens(ch.content);
+      const overBy = total() - limit;
+      if (overBy <= 0) break;
+      const trimmed = trimContent(ch.content, before - overBy);
+      if (trimmed === ch.content) continue;
+      ch.content = trimmed;
+      const removed = before - estimateTextTokens(ch.content);
+      if (removed > 0) dropped.set(kind, (dropped.get(kind) ?? 0) + removed);
+    }
+  }
+  const trimmedSummary = TRIM_ORDER.filter((k) => (dropped.get(k) ?? 0) > 0).map((kind) => ({
+    kind,
+    droppedTokens: dropped.get(kind) ?? 0
+  }));
+  return { channels, trimmed: trimmedSummary, total: total() };
+}
+function trimContent(content, targetTokens) {
+  if (estimateTextTokens(content) <= targetTokens) return content;
+  const markerTokens = estimateTextTokens(TRIM_MARKER);
+  const headChars = (targetTokens - markerTokens) * 4;
+  if (headChars <= 0) return TRIM_MARKER.trimStart();
+  const head = content.slice(0, Math.min(content.length, headChars));
+  return head + TRIM_MARKER;
+}
+
+// src/prompts/lint.ts
+var LONG_BODY_CHARS = 2e4;
+var SECRET_PATTERNS = [
+  { re: /\bsk-[A-Za-z0-9_-]{16,}\b/, label: "API key (sk-\u2026)" },
+  { re: /\bAKIA[0-9A-Z]{16}\b/, label: "AWS access key id (AKIA\u2026)" },
+  { re: /-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----/, label: "PEM private key block" }
+];
+var UNRENDERED_VAR = /\{\{[^}]*\}\}/;
+function lintSystemText(body) {
+  const findings = [];
+  if (body.trim().length === 0) {
+    findings.push({
+      rule: "empty-body",
+      severity: "error",
+      message: "Body is empty \u2014 an instruction channel with no content does nothing."
+    });
+    return findings;
+  }
+  if (body.length > LONG_BODY_CHARS) {
+    findings.push({
+      rule: "very-long-body",
+      severity: "warning",
+      message: `Body is ${body.length} chars (> ${LONG_BODY_CHARS}) \u2014 likely a paste accident or runaway concatenation.`
+    });
+  }
+  for (const { re, label } of SECRET_PATTERNS) {
+    if (re.test(body)) {
+      findings.push({
+        rule: "leaked-secret",
+        severity: "error",
+        message: `Apparent ${label} in body \u2014 strip the credential before sending.`
+      });
+    }
+  }
+  if (UNRENDERED_VAR.test(body)) {
+    findings.push({
+      rule: "unrendered-template-var",
+      severity: "warning",
+      message: 'Unrendered template variable "{{\u2026}}" left in body \u2014 the template was not filled in.'
+    });
+  }
+  return findings;
+}
+function lintPrompt(channels) {
+  const findings = [];
+  const systemChannels = channels.filter((ch) => ch.kind === "system");
+  if (systemChannels.length === 0) {
+    findings.push({
+      rule: "missing-system-channel",
+      severity: "error",
+      message: "No system channel present \u2014 the agent has no core instructions to anchor on.",
+      channel: "system"
+    });
+  } else if (systemChannels.length > 1) {
+    findings.push({
+      rule: "multiple-system-channels",
+      severity: "warning",
+      message: `${systemChannels.length} system channels present \u2014 collapse them into one to keep authority unambiguous.`,
+      channel: "system"
+    });
+  }
+  for (const ch of channels) {
+    if (isUntrusted(ch.kind) && ch.trusted) {
+      findings.push({
+        rule: "untrusted-marked-trusted",
+        severity: "error",
+        message: `Channel "${ch.kind}" is untrusted external input but is marked trusted:true \u2014 it must be fenced as data.`,
+        channel: ch.kind
+      });
+    }
+    if (ch.kind === "system" || ch.kind === "developer") {
+      for (const f of lintSystemText(ch.content)) {
+        findings.push({ ...f, channel: ch.kind });
+      }
+    }
+  }
+  return findings;
+}
+
+// src/prompts/channels.ts
+var ChannelStack = class {
+  list = [];
+  add(kind, content, opts = {}) {
+    this.list.push({
+      kind,
+      authority: channelAuthority(kind),
+      source: opts.source,
+      content,
+      trusted: !isUntrusted(kind)
+    });
+    return this;
+  }
+  /** Convenience for the untrusted families — always firewall-fenced on render. */
+  addUntrusted(kind, content, source) {
+    return this.add(kind, content, { source });
+  }
+  channels() {
+    return [...this.list];
+  }
+  /**
+   * Render the stack into provider-ready text, with hard tier isolation:
+   *   · `system`     — system + developer channels (authoritative)
+   *   · `user`       — user channels (the human's literal input)
+   *   · `dataBlocks` — every untrusted channel, firewalled + fenced as data
+   * Returns the firewall verdicts so the caller can warn on detections.
+   */
+  render(opts) {
+    const channels = opts.budget != null ? budgetChannels({ channels: this.list, maxTokens: opts.budget }).channels : this.list;
+    const system = channels.filter((ch) => ch.kind === "system" || ch.kind === "developer").map((ch) => ch.content).join("\n\n");
+    const user = channels.filter((ch) => ch.kind === "user").map((ch) => ch.content).join("\n\n");
+    const findings = [];
+    const blocks = [];
+    for (const ch of channels) {
+      if (!isUntrusted(ch.kind)) continue;
+      const verdict = opts.firewall.guard(ch, opts.policy);
+      findings.push(verdict);
+      blocks.push(verdict.safe);
+    }
+    return { system, user, dataBlocks: blocks.join("\n\n"), findings };
+  }
+};
+export {
+  ALL_DETECTORS,
+  Agent,
+  CapabilityEnforcer,
+  ChannelStack,
+  CommandRegistry,
+  DEFAULT_FIREWALL,
+  DEFAULT_POLICY,
+  DEFAULT_REGISTRY,
+  HookRunner,
+  InputController,
+  NO_CAPS,
+  PERMISSION_MODES,
+  Permissions,
+  PolicyEngine,
+  PromptFirewall,
+  PromptRegistry,
+  Session,
+  UNTRUSTED_CHANNELS,
+  UsageMeter,
+  applyFirewall,
+  applyHooks,
+  budgetChannels,
+  buildProviderOptions,
+  buildTools,
+  buildWebTools,
+  capsAllow,
+  channelAuthority,
+  compact,
+  defaultManifestFor,
+  diffStat,
+  estimateCost,
+  estimateTextTokens,
+  estimateTokens,
+  isPermissionMode,
+  isUntrusted,
+  isUntrustedTool,
+  lintPrompt,
+  lintSystemText,
+  listModels,
+  loadHookFiles,
+  loadMcpTools,
+  loadMdCommands,
+  loadPlugins,
+  loadProjectMemory,
+  maxSeverity,
+  mergeHookSets,
+  modelContextWindow,
+  modelId,
+  modelLabel,
+  renderEditDiff,
+  renderNewFileDiff,
+  renderTemplate,
+  resolveModel,
+  resolveModelKey,
+  severityRank,
+  supportsThinking
+};

package/package.json

@@ -0,0 +1,75 @@
+{
+  "name": "wholestack",
+  "version": "0.4.0",
+  "description": "Wholestack — a pro-grade conversational terminal agent for the Wholestack codegen engine. Talk to it in plain language: it writes ISL, generates full-stack or Solidity apps, and proves them with ShipGate. Browser login, membership-gated builds, slash commands, sessions, plan mode, diffs, MCP, plugins.",
+  "type": "module",
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js",
+      "default": "./dist/index.js"
+    }
+  },
+  "bin": {
+    "wholestack": "./dist/cli.js",
+    "zeta": "./dist/cli.js"
+  },
+  "keywords": [
+    "ai",
+    "codegen",
+    "agent",
+    "cli",
+    "wholestack",
+    "shipgate",
+    "isl",
+    "full-stack",
+    "solidity",
+    "formal-verification"
+  ],
+  "homepage": "https://wholestack.ai",
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/wholestack/wholestack.git",
+    "directory": "packages/zeta-g-cli"
+  },
+  "bugs": {
+    "url": "https://wholestack.ai"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md"
+  ],
+  "engines": {
+    "node": ">=20.0.0"
+  },
+  "scripts": {
+    "build": "tsup src/index.ts src/cli.ts --format esm --dts --clean && node -e \"require('fs').chmodSync('dist/cli.js','755')\"",
+    "dev": "tsx src/cli.ts",
+    "typecheck": "tsc --noEmit",
+    "clean": "rimraf dist"
+  },
+  "dependencies": {
+    "@ai-sdk/openai": "^3.0.64",
+    "@modelcontextprotocol/sdk": "^1.29.0",
+    "ai": "^6.0.170",
+    "diff": "^5.2.0",
+    "fast-glob": "^3.3.3",
+    "zod": "^3.25.76"
+  },
+  "devDependencies": {
+    "@types/diff": "^5.2.0",
+    "@types/node": "^20.10.0",
+    "tsup": "^8.0.1",
+    "tsx": "^4.7.0",
+    "typescript": "^5.3.3",
+    "rimraf": "^5.0.5"
+  },
+  "author": "Wholestack",
+  "license": "MIT",
+  "sideEffects": false
+}