xcoder-jarvis-agent 0.0.0-stage → 1.3.0

package/dist/jarvis/tools/memory-tools.d.ts

@@ -0,0 +1,27 @@
+import { z } from "zod";
+import type { ToolDescriptor } from "./registry.js";
+/**
+ * Memory tools (design §2.6).
+ *
+ * `remember` is the only tool that mutates persistent state, so it is the one
+ * that respects the confirmation seam. It is also the only path by which the
+ * agent can carry something across sessions, and the value is redacted before
+ * it is written — so a key glimpsed in a file cannot be memorised verbatim.
+ */
+declare const RememberArgs: z.ZodObject<{
+    value: z.ZodString;
+    kind: z.ZodDefault<z.ZodEnum<{
+        fact: "fact";
+        preference: "preference";
+        task: "task";
+        observation: "observation";
+    }>>;
+    key: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+export declare const rememberTool: ToolDescriptor<z.infer<typeof RememberArgs>>;
+declare const RecallArgs: z.ZodObject<{
+    limit: z.ZodOptional<z.ZodNumber>;
+}, z.core.$strip>;
+export declare const recallTool: ToolDescriptor<z.infer<typeof RecallArgs>>;
+export declare const MEMORY_TOOLS: readonly ToolDescriptor<any>[];
+export {};

package/dist/jarvis/tools/memory-tools.js

@@ -0,0 +1,83 @@
+// xcoder:version 1 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:46:55.784Z | xcoder:subtask code-st-53c7b5
+import { z } from "zod";
+import { requireConfirmation } from "../util/confirm.js";
+import { byteLength, truncate } from "../util/text.js";
+/**
+ * Memory tools (design §2.6).
+ *
+ * `remember` is the only tool that mutates persistent state, so it is the one
+ * that respects the confirmation seam. It is also the only path by which the
+ * agent can carry something across sessions, and the value is redacted before
+ * it is written — so a key glimpsed in a file cannot be memorised verbatim.
+ */
+const RememberArgs = z.object({
+    value: z.string().min(1).max(2_000),
+    kind: z.enum(["fact", "preference", "task", "observation"]).default("fact"),
+    key: z.string().min(1).max(128).optional(),
+});
+export const rememberTool = {
+    name: "remember",
+    description: "Save one short durable note for future sessions. Args: { value, kind?, key? }. Secrets are redacted before storage.",
+    risk: "write",
+    argsSchema: RememberArgs,
+    async execute(args, ctx) {
+        if (ctx.signal?.aborted) {
+            return { ok: false, summary: "aborted by kill switch", bytes: 0, truncated: false };
+        }
+        const allowed = await requireConfirmation(ctx.confirm, {
+            tool: "remember",
+            risk: "write",
+            summary: `${args.kind}: ${args.value.slice(0, 120)}`,
+        });
+        if (!allowed) {
+            return { ok: false, summary: "refused: memory write was not confirmed", bytes: 0, truncated: false };
+        }
+        const entry = await ctx.memory.append({
+            session: ctx.session,
+            kind: args.kind,
+            ...(args.key ? { key: args.key } : {}),
+            value: args.value,
+            source: "agent",
+        });
+        const preview = truncate(entry.value, 200).text;
+        return {
+            ok: true,
+            summary: `remembered ${args.kind}${args.key ? ` '${args.key}'` : ""}: ${preview}`,
+            bytes: byteLength(entry.value),
+            truncated: false,
+            data: { id: entry.id, kind: entry.kind, key: entry.key },
+        };
+    },
+};
+const RecallArgs = z.object({
+    limit: z.number().int().positive().max(100).optional(),
+});
+export const recallTool = {
+    name: "recall",
+    description: "Read back recent memory entries for this user and workspace. Args: { limit? }.",
+    risk: "read",
+    argsSchema: RecallArgs,
+    async execute(args, ctx) {
+        if (ctx.signal?.aborted) {
+            return { ok: false, summary: "aborted by kill switch", bytes: 0, truncated: false };
+        }
+        const limit = Math.min(args.limit ?? 20, ctx.limits.maxResults);
+        const entries = await ctx.memory.window(limit);
+        if (entries.length === 0) {
+            return { ok: true, summary: "no memory entries in scope", bytes: 0, truncated: false };
+        }
+        const lines = entries.map((e) => {
+            const key = e.key ? ` key=${e.key}` : "";
+            return `- ${e.ts} [${e.kind}${key}] ${truncate(e.value, 300).text}`;
+        });
+        const summary = lines.join("\n");
+        return {
+            ok: true,
+            summary,
+            bytes: byteLength(summary),
+            truncated: false,
+            data: { count: entries.length },
+        };
+    },
+};
+export const MEMORY_TOOLS = [rememberTool, recallTool];

package/dist/jarvis/tools/registry.d.ts

@@ -0,0 +1,54 @@
+import type { z } from "zod";
+import type { MemoryStore } from "../memory/store.js";
+import type { ConfirmFn, ToolRisk } from "../util/confirm.js";
+export type { ToolRisk, ConfirmFn };
+export interface ToolObservation {
+    ok: boolean;
+    summary: string;
+    data?: unknown;
+    bytes: number;
+    truncated: boolean;
+}
+export interface ToolLimits {
+    maxReadBytes: number;
+    maxResults: number;
+}
+export interface ToolContext {
+    workspaceRoot: string;
+    memory: MemoryStore;
+    session: string;
+    signal?: AbortSignal;
+    confirm: ConfirmFn;
+    limits: ToolLimits;
+}
+export interface ToolDescriptor<A = unknown> {
+    name: string;
+    description: string;
+    risk: ToolRisk;
+    argsSchema: z.ZodType<A>;
+    execute(args: A, ctx: ToolContext): Promise<ToolObservation>;
+}
+export interface ToolRegistry {
+    get(name: string): ToolDescriptor | undefined;
+    allowlist(): readonly string[];
+    describeForPrompt(): string;
+}
+export declare const DEFAULT_LIMITS: ToolLimits;
+/**
+ * Pass-1 allowlist. Six narrow, side-effect-free tools (PRM-04, design §2.6).
+ *
+ * Deliberately absent: shell/exec, file write or delete, network fetch, git
+ * push, SQL. There is no open-ended 'run any command' surface to smuggle a
+ * model instruction into, and no irreversible tool exists in this build.
+ */
+export declare const ALLOWED_TOOLS: readonly ["read_file", "glob", "grep", "search_workspace", "remember", "recall"];
+export type AllowedToolName = (typeof ALLOWED_TOOLS)[number];
+/**
+ * Static registry. The allowlist is enforced here, in code, not by prose in
+ * the prompt (PRM-09): `get()` returns undefined for any name not both
+ * registered and allowed, and the loop refuses rather than dispatching.
+ */
+export declare function createToolRegistry(o?: {
+    tools?: readonly ToolDescriptor<any>[];
+    allow?: readonly string[];
+}): ToolRegistry;

package/dist/jarvis/tools/registry.js

@@ -0,0 +1,49 @@
+export const DEFAULT_LIMITS = {
+    maxReadBytes: 262_144,
+    maxResults: 200,
+};
+/**
+ * Pass-1 allowlist. Six narrow, side-effect-free tools (PRM-04, design §2.6).
+ *
+ * Deliberately absent: shell/exec, file write or delete, network fetch, git
+ * push, SQL. There is no open-ended 'run any command' surface to smuggle a
+ * model instruction into, and no irreversible tool exists in this build.
+ */
+export const ALLOWED_TOOLS = [
+    "read_file",
+    "glob",
+    "grep",
+    "search_workspace",
+    "remember",
+    "recall",
+];
+/**
+ * Static registry. The allowlist is enforced here, in code, not by prose in
+ * the prompt (PRM-09): `get()` returns undefined for any name not both
+ * registered and allowed, and the loop refuses rather than dispatching.
+ */
+export function createToolRegistry(o = {}) {
+    const registered = new Map();
+    for (const t of o.tools ?? [])
+        registered.set(t.name, t);
+    const allowSet = new Set((o.allow && o.allow.length > 0 ? o.allow : ALLOWED_TOOLS).filter((n) => registered.has(n)));
+    return {
+        get(name) {
+            if (!allowSet.has(name))
+                return undefined;
+            return registered.get(name);
+        },
+        allowlist() {
+            return [...allowSet].sort();
+        },
+        describeForPrompt() {
+            return [...allowSet]
+                .sort()
+                .map((name) => {
+                const t = registered.get(name);
+                return t ? `- ${t.name}: ${t.description}` : `- ${name}`;
+            })
+                .join("\n");
+        },
+    };
+}

package/dist/jarvis/util/confirm.d.ts

@@ -0,0 +1,28 @@
+export type ToolRisk = "read" | "write" | "irreversible";
+export interface ConfirmRequest {
+    tool: string;
+    risk: ToolRisk;
+    summary: string;
+}
+export type ConfirmFn = (r: ConfirmRequest) => Promise<boolean>;
+/**
+ * Human-in-the-loop gate for high-impact actions (AI-03).
+ *
+ * Fails closed: when stdin is not a TTY (CI, piped input, an agent harness)
+ * there is nobody to ask, so the answer is `deny`. Pass-1 tools are all
+ * `read` or `write` and never reach this path; it exists so that adding an
+ * `irreversible` tool later cannot silently skip confirmation.
+ */
+export declare const denyWhenNotTty: ConfirmFn;
+export declare const alwaysDeny: ConfirmFn;
+export declare function createConfirm(opts?: {
+    stdin?: NodeJS.ReadableStream & {
+        isTTY?: boolean;
+    };
+    stdout?: NodeJS.WritableStream;
+}): ConfirmFn;
+/**
+ * Enforce the gate. Read/write tools with no confirmation callback still
+ * proceed only for `read`; anything above `read` requires an explicit allow.
+ */
+export declare function requireConfirmation(confirm: ConfirmFn, req: ConfirmRequest): Promise<boolean>;

package/dist/jarvis/util/confirm.js

@@ -0,0 +1,54 @@
+// xcoder:version 1 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:44:35.687Z | xcoder:subtask code-st-53c7b5
+import readline from "node:readline/promises";
+/**
+ * Human-in-the-loop gate for high-impact actions (AI-03).
+ *
+ * Fails closed: when stdin is not a TTY (CI, piped input, an agent harness)
+ * there is nobody to ask, so the answer is `deny`. Pass-1 tools are all
+ * `read` or `write` and never reach this path; it exists so that adding an
+ * `irreversible` tool later cannot silently skip confirmation.
+ */
+export const denyWhenNotTty = async () => false;
+export const alwaysDeny = async () => false;
+const RISK_LABEL = {
+    read: "reads data",
+    write: "modifies local state",
+    irreversible: "CANNOT BE UNDONE",
+};
+export function createConfirm(opts = {}) {
+    const stdin = opts.stdin ?? process.stdin;
+    const stdout = opts.stdout ?? process.stderr;
+    if (!stdin.isTTY)
+        return denyWhenNotTty;
+    return async (req) => {
+        const summary = req.summary.slice(0, 200).replace(/\s+/g, " ");
+        const rl = readline.createInterface({
+            input: stdin,
+            output: stdout,
+        });
+        try {
+            const answer = await rl.question(`jarvis: allow tool "${req.tool}" (${RISK_LABEL[req.risk]})? ${summary} [y/N] `);
+            return /^y(es)?$/i.test(answer.trim());
+        }
+        catch {
+            return false;
+        }
+        finally {
+            rl.close();
+        }
+    };
+}
+/**
+ * Enforce the gate. Read/write tools with no confirmation callback still
+ * proceed only for `read`; anything above `read` requires an explicit allow.
+ */
+export async function requireConfirmation(confirm, req) {
+    if (req.risk === "read")
+        return true;
+    try {
+        return await confirm(req);
+    }
+    catch {
+        return false;
+    }
+}

package/dist/jarvis/util/kill.d.ts

@@ -0,0 +1,10 @@
+export interface KillState {
+    killed: boolean;
+    /** Which signal tripped, for provenance. Never contains file contents. */
+    reason?: "env" | "stop-file";
+}
+export declare function stopFilePath(workspaceRoot: string): string;
+/** Never throws: an unreadable STOP path is treated as "not killed". */
+export declare function readKillState(workspaceRoot: string): KillState;
+/** Convenience predicate for `ReactLoopInput.isKilled`. */
+export declare function createKillProbe(workspaceRoot: string): () => boolean;

package/dist/jarvis/util/kill.js

@@ -0,0 +1,39 @@
+// xcoder:version 1 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:44:31.387Z | xcoder:subtask code-st-53c7b5
+import fs from "node:fs";
+import path from "node:path";
+/**
+ * Kill switch, fail-closed (design §4.3, AI-09).
+ *
+ * Jarvis aborts when either signal is present:
+ *  - `XCODER_JARVIS_KILL` is a truthy env value, or
+ *  - the workspace holds `.xcoder/jarvis/STOP`.
+ *
+ * The check runs before every LLM call, every tool dispatch and every memory
+ * write, so an operator can stop a runaway run without killing the process.
+ * It reads the filesystem on each call on purpose: the STOP file must take
+ * effect mid-run, which a value cached at startup could not do.
+ */
+const TRUTHY = new Set(["1", "true", "yes", "on"]);
+export function stopFilePath(workspaceRoot) {
+    return path.join(workspaceRoot, ".xcoder", "jarvis", "STOP");
+}
+/** Never throws: an unreadable STOP path is treated as "not killed". */
+export function readKillState(workspaceRoot) {
+    const env = process.env["XCODER_JARVIS_KILL"];
+    if (env && TRUTHY.has(env.trim().toLowerCase())) {
+        return { killed: true, reason: "env" };
+    }
+    try {
+        if (fs.existsSync(stopFilePath(workspaceRoot))) {
+            return { killed: true, reason: "stop-file" };
+        }
+    }
+    catch {
+        // An environment we cannot inspect must not be reported as a tripped switch.
+    }
+    return { killed: false };
+}
+/** Convenience predicate for `ReactLoopInput.isKilled`. */
+export function createKillProbe(workspaceRoot) {
+    return () => readKillState(workspaceRoot).killed;
+}

package/dist/jarvis/util/text.d.ts

@@ -0,0 +1,74 @@
+/**
+ * Text and filesystem primitives shared by the prompt assembler, the tools and
+ * the memory store. Kept together so the injection and redaction behaviour is
+ * auditable in exactly one file (PRM-02, PRM-06, PRM-10).
+ */
+export declare function sha256(input: string | Buffer): string;
+export declare function shortHash(input: string, len?: number): string;
+/**
+ * Normalise untrusted text before it enters a prompt (PRM-06).
+ *
+ * Strips zero-width/bidi controls, collapses CRLF to LF, and normalises to
+ * NFC. Deliberately does NOT rewrite ordinary text: the output still reads as
+ * the author wrote it, it just cannot carry invisible instructions.
+ */
+export declare function normalizeUntrusted(text: string, maxChars?: number): string;
+/**
+ * Escape a closing delimiter so untrusted text cannot break out of its block.
+ *
+ * An attacker who gets `</untrusted-skill>` into a skill pack could otherwise
+ * end the data block early and have the remainder read as instructions. We
+ * escape the angle brackets of any delimiter-shaped sequence rather than
+ * stripping it, so the text stays visible and reviewable.
+ */
+export declare function escapeDelimiter(text: string, tag: string): string;
+/** Escape every angle bracket/quoter — used for attribute values (name, sha). */
+export declare function escapeAttr(value: string): string;
+export interface Redacted {
+    text: string;
+    hits: number;
+}
+/** Redact secrets and report how many rules fired (CORE-07). */
+export declare function redact(text: string): Redacted;
+export declare function truncate(text: string, max: number): {
+    text: string;
+    truncated: boolean;
+};
+export declare function byteLength(text: string): number;
+/**
+ * Short, filesystem-safe label derived from a user-supplied scope id.
+ *
+ * `--user` is an untrusted scope label, and it becomes a filename, so it must
+ * not be able to name a directory that resolves above the memory root. All
+ * separators become '-', runs of dots collapse to a single '.', and leading
+ * dots are stripped — that removes '.' and '..' as possible results, which
+ * are the only relative names that traverse.
+ */
+export declare function sanitizeLabel(raw: string, fallback?: string): string;
+/**
+ * Resolve `candidate` inside `root`, refusing paths that escape it.
+ *
+ * Uses `realpath` on both sides so a symlink pointing outside the workspace
+ * is rejected rather than followed (AI-04 path confinement).
+ */
+export declare function resolveInsideRoot(root: string, candidate: string): Promise<{
+    ok: true;
+    path: string;
+} | {
+    ok: false;
+    reason: string;
+}>;
+export declare function ensureDir(dir: string, mode?: number): Promise<void>;
+export declare function writeFilePrivate(file: string, data: string): Promise<void>;
+/** Write via temp file + rename so a reader never sees a half-written file. */
+export declare function writeAtomic(file: string, data: string): Promise<void>;
+/** Read a file, refusing anything larger than `maxBytes` before allocating. */
+export declare function readBounded(file: string, maxBytes: number): Promise<{
+    ok: true;
+    text: string;
+    bytes: number;
+    truncated: boolean;
+} | {
+    ok: false;
+    reason: string;
+}>;

package/dist/jarvis/util/text.js

@@ -0,0 +1,190 @@
+// xcoder:version 2 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:49:12.254Z | xcoder:subtask code-st-53c7b5
+import crypto from "node:crypto";
+import fsp from "node:fs/promises";
+import path from "node:path";
+import { redactSecrets } from "xcoder-dna";
+/**
+ * Text and filesystem primitives shared by the prompt assembler, the tools and
+ * the memory store. Kept together so the injection and redaction behaviour is
+ * auditable in exactly one file (PRM-02, PRM-06, PRM-10).
+ */
+export function sha256(input) {
+    return crypto.createHash("sha256").update(input).digest("hex");
+}
+export function shortHash(input, len = 16) {
+    return sha256(input).slice(0, len);
+}
+/** Zero-width and bidi-control characters used to hide instructions. */
+const ZERO_WIDTH = /[\u200B-\u200F\u202A-\u202E\u2060-\u2064\uFEFF]/g;
+/**
+ * Normalise untrusted text before it enters a prompt (PRM-06).
+ *
+ * Strips zero-width/bidi controls, collapses CRLF to LF, and normalises to
+ * NFC. Deliberately does NOT rewrite ordinary text: the output still reads as
+ * the author wrote it, it just cannot carry invisible instructions.
+ */
+export function normalizeUntrusted(text, maxChars = 200_000) {
+    const clipped = text.length > maxChars ? text.slice(0, maxChars) : text;
+    return clipped.replace(ZERO_WIDTH, "").replace(/\r\n?/g, "\n").normalize("NFC");
+}
+const ENTITIES = {
+    "<": "&lt;",
+    ">": "&gt;",
+    "&": "&amp;",
+    '"': "&quot;",
+    "'": "&#39;",
+};
+/**
+ * Escape a closing delimiter so untrusted text cannot break out of its block.
+ *
+ * An attacker who gets `</untrusted-skill>` into a skill pack could otherwise
+ * end the data block early and have the remainder read as instructions. We
+ * escape the angle brackets of any delimiter-shaped sequence rather than
+ * stripping it, so the text stays visible and reviewable.
+ */
+export function escapeDelimiter(text, tag) {
+    const pattern = new RegExp(`<\\s*/?\\s*${tag}\\b`, "gi");
+    return text.replace(pattern, (m) => m.replace(/[<>]/g, (c) => ENTITIES[c] ?? c));
+}
+/** Escape every angle bracket/quoter — used for attribute values (name, sha). */
+export function escapeAttr(value) {
+    return value.replace(/[<>&"']/g, (c) => ENTITIES[c] ?? c);
+}
+/** Redact secrets and report how many rules fired (CORE-07). */
+export function redact(text) {
+    try {
+        const result = redactSecrets(text);
+        const hits = (result.redactions ?? []).reduce((n, r) => n + (r.count ?? 0), 0);
+        return { text: result.text, hits };
+    }
+    catch {
+        // redactSecrets is documented never to throw; if that ever changes, the
+        // safe action for a logging path is to withhold the text entirely.
+        return { text: "[REDACTED:redaction-failed]", hits: 1 };
+    }
+}
+export function truncate(text, max) {
+    if (text.length <= max)
+        return { text, truncated: false };
+    return { text: text.slice(0, max), truncated: true };
+}
+export function byteLength(text) {
+    return Buffer.byteLength(text, "utf8");
+}
+/**
+ * Short, filesystem-safe label derived from a user-supplied scope id.
+ *
+ * `--user` is an untrusted scope label, and it becomes a filename, so it must
+ * not be able to name a directory that resolves above the memory root. All
+ * separators become '-', runs of dots collapse to a single '.', and leading
+ * dots are stripped — that removes '.' and '..' as possible results, which
+ * are the only relative names that traverse.
+ */
+export function sanitizeLabel(raw, fallback = "unknown") {
+    const cleaned = raw
+        .normalize("NFKC")
+        .replace(/[^A-Za-z0-9._-]+/g, "-")
+        .replace(/\.{2,}/g, ".")
+        .replace(/^[.-]+|[.-]+$/g, "")
+        .slice(0, 64);
+    return cleaned.length > 0 ? cleaned : fallback;
+}
+/**
+ * Resolve `candidate` inside `root`, refusing paths that escape it.
+ *
+ * Uses `realpath` on both sides so a symlink pointing outside the workspace
+ * is rejected rather than followed (AI-04 path confinement).
+ */
+export async function resolveInsideRoot(root, candidate) {
+    let realRoot;
+    try {
+        realRoot = await fsp.realpath(root);
+    }
+    catch {
+        return { ok: false, reason: "workspace root is not readable" };
+    }
+    const target = path.resolve(realRoot, candidate);
+    let realTarget;
+    try {
+        realTarget = await fsp.realpath(target);
+    }
+    catch {
+        return { ok: false, reason: "path does not exist" };
+    }
+    const rel = path.relative(realRoot, realTarget);
+    if (rel.startsWith("..") || path.isAbsolute(rel)) {
+        return { ok: false, reason: "path escapes the workspace" };
+    }
+    return { ok: true, path: realTarget };
+}
+export async function ensureDir(dir, mode = 0o700) {
+    await fsp.mkdir(dir, { recursive: true, mode });
+    // Windows ignores POSIX modes; best-effort is documented in the README.
+    if (process.platform !== "win32") {
+        try {
+            await fsp.chmod(dir, mode);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+export async function writeFilePrivate(file, data) {
+    await ensureDir(path.dirname(file));
+    await fsp.writeFile(file, data, { encoding: "utf8", mode: 0o600 });
+    if (process.platform !== "win32") {
+        try {
+            await fsp.chmod(file, 0o600);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+/** Write via temp file + rename so a reader never sees a half-written file. */
+export async function writeAtomic(file, data) {
+    await ensureDir(path.dirname(file));
+    const tmp = `${file}.tmp-${process.pid}-${crypto.randomBytes(4).toString("hex")}`;
+    await fsp.writeFile(tmp, data, { encoding: "utf8", mode: 0o600 });
+    await fsp.rename(tmp, file);
+    if (process.platform !== "win32") {
+        try {
+            await fsp.chmod(file, 0o600);
+        }
+        catch {
+            /* best effort */
+        }
+    }
+}
+/** Read a file, refusing anything larger than `maxBytes` before allocating. */
+export async function readBounded(file, maxBytes) {
+    let stat;
+    try {
+        stat = await fsp.stat(file);
+    }
+    catch {
+        return { ok: false, reason: "file does not exist" };
+    }
+    if (!stat.isFile())
+        return { ok: false, reason: "not a regular file" };
+    const limit = Math.min(stat.size, maxBytes);
+    try {
+        const handle = await fsp.open(file, "r");
+        try {
+            const buf = Buffer.alloc(limit);
+            const { bytesRead } = await handle.read(buf, 0, limit, 0);
+            return {
+                ok: true,
+                text: buf.subarray(0, bytesRead).toString("utf8"),
+                bytes: bytesRead,
+                truncated: stat.size > limit,
+            };
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    catch {
+        return { ok: false, reason: "file could not be read" };
+    }
+}

package/dist/program.d.ts

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+export {};

package/dist/program.js

@@ -0,0 +1,12 @@
+#!/usr/bin/env node
+// xcoder:version 1 | xcoder:task task-f1b5f6 | xcoder:updated 2026-11-05T02:47:38.121Z | xcoder:subtask code-st-53c7b5
+import { runJarvisAgent } from "./index.js";
+/**
+ * Process boundary only (design §2.1).
+ *
+ * Everything testable lives behind `runJarvisAgent`; this file exists so the
+ * manifest's `bin.jarvis` entry has something to point at, and so the exit
+ * code the CLI contract promises is the one the process actually returns.
+ */
+const code = await runJarvisAgent(process.argv.slice(2));
+process.exit(code);

package/package.json

@@ -1,6 +1,38 @@
 {
   "name": "xcoder-jarvis-agent",
-  "version": "0.0.0-stage",
-  "stub": true,
-  "description": "Temporary package placeholder for staged publishing"
+  "version": "1.3.0",
+  "description": "Jarvis — a ReAct agent with scoped memory, skill-pack prompt assembly and a code-enforced tool allowlist, built on xcoder-dna.",
+  "license": "MIT",
+  "author": "Neural Node Labs",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "publishConfig": {
+    "access": "public"
+  },
+  "files": [
+    "dist",
+    "README.md",
+    "LICENSE"
+  ],
+  "exports": {
+    ".": {
+      "types": "./dist/index.d.ts",
+      "import": "./dist/index.js"
+    },
+    "./package.json": "./package.json"
+  },
+  "bin": {
+    "jarvis": "./dist/program.js"
+  },
+  "scripts": {
+    "build": "tsc -p tsconfig.json",
+    "typecheck": "tsc --noEmit -p tsconfig.json",
+    "test": "vitest run"
+  },
+  "dependencies": {
+    "xcoder-dna": "^1.3.0",
+    "zod": "^4.4.3"
+  }
 }