3 Commits

Include renames

Author	SHA1	Message	Date
3 people	583e6530bd	fix(lint): resolve static analysis baseline (#769) ... * fix(lint): resolve static analysis baseline * fix(lint): clear linux staticcheck findings Amp-Thread-ID: https://ampcode.com/threads/T-019fa018-b2ee-7442-8a31-80b2cf9dd270 Co-authored-by: Pierre Bruno <[email protected]> --------- Co-authored-by: Amp <[email protected]>	2026-07-27 09:59:33 +08:00
3 people	6fb0231df8	TUI scrollback re-architecture, Lime chat surface, and deep-audit fixes (#158) ... * docs(design): add Lime TUI prototype and rebuild spec * tui: remove the zeroline skin system One design remains in the tree ahead of the Lime rebuild: the zeroline package, its TUI view/skin plumbing (Options.Skin/ThemeVariant/ThemeDark, model skin branches, theme picker), and the zeroline CLI subcommand are gone. /theme keeps its shell-only message. * tui: replace the cyan palette with the Lime token table theme.go is rebuilt around the Lime design tokens (docs/design/ zero_tui_lime.html): near-black panels, one lime accent, solid tint stand-ins for the prototype's rgba overlays. Existing render sites map onto the new role styles (ink/line/userPrompt/toolName/toolArg) without layout changes; no hex exists outside theme.go. * tui: build the Lime chat-surface components Title bar with brand badge + context window, empty state replacing the deleted splash (block-art 0, tagline, 1-3 starter suggestions), stream blocks (user prompt gutter, muted interim with cursor, final-answer accent rail, done line, bordered notes), tool cards with diff/read/ bash/grep bodies and MiniDot run spinner, borderless composer with run-state hints, and the grouped status line. Final answers are marked at append time; resolved tool calls collapse into their result cards. * tui: fix Stage 2 review findings Adversarial review of the chat-surface commit confirmed 15 issues, all fixed here: - wrapPlainText sliced wide runes by rune count: CJK/emoji prose could panic the TUI or emit lines ~2x the measure; split at width instead - a cancelled run's streamingText leaked into the next turn's interim block; cancelRun now clears it - orphaned tool-call cards (cancelled/errored turns) re-animated with the spinner on any later run; the glyph is now scoped to the call's own runID - starter-suggestion digit capture was active while the chips were off screen (/clear mid-run); the guard now mirrors the render condition - prompt submits while a deferred Ctrl+C quit is draining could start a run the quit would orphan; submission is blocked while exiting - the running placeholder advertised ctrl+c (which quits) as the interrupt key; it now says esc - read-card parser expected 'N: text' but read_file emits 'N | text', so the gutter and L-range never rendered on real output - toolCard borders were one column short of the body rows - diff tint bands now span the full row; NEW FILE renders green on addBg; preamble/no-newline lines are unnumbered meta and no longer shift hunk numbering - card bodies and system notes paint the panel surface; the head gains the separate faintest arg column (grep target + pattern) - title-bar overflow now truncates the minimal candidate instead of rendering the deleted design's 'ZERO … READY' line - untracked the stray snake-game.html (left on disk, ignored) * tui: restyle the interactive surfaces for Lime Permission prompts render as the amber permission card (PERMISSION badge, risk readout, key chips); resolved prompts collapse to one line (allowed once/always/denied · tool) and unprompted allows fold into the tool card's [auto] tag. Ask-user and spec-review prompts share the card language with line borders. Autocomplete and picker overlays move onto the panel/selection tints with the accent ❯ marker; model-picker rows gain the provider dot and ctx · KEY_ENV metadata from the registry and provider catalog. /resume renders its list as stacked session cards (id + age, title, meta). Key handling is untouched everywhere. * tui: adaptive width tiers, doc updates, final polish Width tiers re-evaluate from the live width: ≥100 renders the full spec; 80–99 drops the tool-arg column, header ctx, and the status 'interactive' group; 58–79 drops the diff/read gutters, bares the badge, and keeps provider+tokens+mode; <58 renders a single-segment header, rail-less cards, and a mode-only status line. Table-driven tests cover {58,70,80,100,120} plus a frame-wide invariant that no emitted line exceeds the terminal at any tier. Card bodies expand tabs so width math holds. Dead splash-chip machinery (startupCommandNames, startupOrder) is gone; README's TUI section now describes Lime. * tui: fix final-review findings across Stages 3-4 A second adversarial review confirmed 14 issues, all addressed: - permission collapse and tool-card pairing are now run-scoped (rcKey): providers with repeating synthetic ToolCallIDs (Gemini gemini_tool_N) could attribute a decision or result to a different run's call - rehydrated always-grants no longer mislabel as 'allowed once' (GrantMatched fallback) - the width invariant now actually holds everywhere: empty-state tagline/hint, ask-user rows, permission detail blobs, pending image chips, and the sessions trailing hint are wrapped or fitted; the invariant test renders the empty state and all of those rows at widths 24-120 - every card (permission, ask-user, spec-review, sessions, notes) drops side borders on tiny terminals, not just tool cards - /resume card fields are sanitized against separator bytes from user-controlled titles - the picker's selected row paints its gap so the selBg band is solid - dead splash helpers (normalizedStartupWidth, countLines, nonEmpty, unreachable rowWelcome branch) and stale /theme comments are gone - README no longer claims transcript scrolling keys or Tab-accept behavior that never existed; chatWidth documents its 24-col floor Tag tui-lime-s4 moves to this commit. * audit: deep-audit report, TUI scrollback re-architecture, and cross-module fixes TUI: settled-row flush frontier prints history to native terminal scrollback (tea.Println, ordered + ack-serialized); View() renders only the live tail. Full diffs (400-line flush cap) and OSC 8 file:// links land in history; streamed interim text, cancellation markers, ask_user exchanges, and composer input history are preserved; run-scoped dedup keys fix Gemini's repeating tool-call ids; /exit, Ctrl+C-after-Esc, and cross-session late flushes no longer orphan or contaminate checkpoints. Cross-module: zero search panic + offset mapping, usage report robustness, 529 retry, SSE keep-alive watchdog, registry corrections, update --check on dev builds, MCP ping + mcp list --json secret redaction, sandbox.network config knob, doctor apiKey presence, atomic config writes, C1-safe notifications, rune-safe truncation everywhere, gofmt + vet CI gates, dead glamour dependency dropped. Full audit report: docs/audit/2026-06-10-deep-audit.md (175 findings). Co-Authored-By: Claude Fable 5 <[email protected]> * tui: hide malformed ask_user tool errors * fix tui malformed tool retries * fix max-turn finalization * upgrade tui agent guardrails * fix coderabbit guardrail findings --------- Co-authored-by: Claude Fable 5 <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-10 17:18:30 +05:30
3 people	9c2e14272b	CLI: doctor config validation, autonomy ceiling, changes --base, usage report (#142) ... * config: add ValidateFile for structured config diagnostics * doctor: add offsetToLineCol helper for JSON error positions * doctor: validate config files in config.validation check * cli: thread config paths into doctor and degrade on bad JSON * doctor: inline read, single-parse config validation + utf8 col test - Remove the osReadFile wrapper; call os.ReadFile directly at its one call site - Add config.ValidateBytes([]byte) so each config file is read and JSON-parsed once in configValidationCheck instead of twice (once for position, once via ValidateFile); ValidateFile now reads then delegates to its own unmarshal for the path-prefixed error message, keeping its public signature unchanged - Fix the misleading skip comment in configValidationCheck: configFilesCheck only checks path-string presence; the skip is a defensive guard for the unreachable case where DefaultResolveOptions passed a non-empty path that still fails to read - Add utf8 multibyte case to TestOffsetToLineCol documenting byte-column semantics (column counts bytes, not runes) * sandbox: add Policy.MaxAutonomy ceiling defaulting to high * sandbox: normalize both operands in autonomyAllowed to fail closed * sandbox: clamp grant-allow and unsafe escalation to policy autonomy ceiling * sandbox: add RequiredAutonomyForBatch helper with fail-closed mapping * config: add sandbox.maxAutonomy field to file and resolved config * config: merge sandbox.maxAutonomy across layers, env, and overrides * cli: thread configured autonomy ceiling into sandbox engine construction * cli: surface max_autonomy in sandbox policy formatters * zerocommands: carry max autonomy in sandbox policy snapshot * sandbox: default empty policy ceiling to high + reason const Evaluate now treats an empty Policy.MaxAutonomy (from a directly-constructed Policy that bypasses DefaultPolicy) as High instead of letting it normalize to Low, which would silently clamp every Medium/High decision to Prompt. The ceiling is a no-op unless explicitly configured. Also extracts the "above policy ceiling" clamp reason into a package const referenced at both engine clamp sites and the related tests, and adds a non-vacuous engine test proving the empty-ceiling trap is closed. * zerogit: add base-ref three-dot diff to changes inspect * zerogit: cover base-ref backward-compat and real-git diff * zerogit: propagate base ref through change snapshot * cli: parse changes --base ref and reject on commit * cli: thread base ref into changes inspect output and help * changes: redact base in cli summary + guard --base= + rename test - redactChangeSummary now redacts the Base field alongside Root/Branch/Commit/etc. - --base= equals-form rejects leading-dash values via flagValueLooksLikeOption, closing the option-smuggling gap - TestParseNameStatusRenameAndCopy asserts rename/copy three-field lines use the new/destination path with correct status, and confirms two-field modify is unaffected * Add ParseDiffStat helper for git diff --stat summaries * Add usage report aggregation over persisted session usage events * Add zero usage report command over persisted session usage * Wire usage command into CLI dispatch and help * usage: validate --since format, fix redaction comments, add tests Fix 1 (BLOCKING): parseUsageArgs now validates --since with time.Parse against YYYY-MM-DD; returns exitUsage + "invalid --since %q: expected YYYY-MM-DD" for bare strings like "foo", unpadded "2026-6-1", or wrong-separator "06/01/2026". Valid dates are stored unchanged for the existing lexical comparison. Fix 2: Replace false "pre-redaction stat" claims in diffstat.go and usage.go with accurate comments: the --stat summary line carries no secret-bearing tokens so parsing the already-redacted DiffStat is safe. Fix 3: Add three tests to usage_test.go — - TestRunUsageDaysFilter: stubs deps.now, seeds events on two dates, asserts --days 3 includes the recent date and excludes the old one. - TestRunUsageInvalidSince: table-driven; verifies "foo", "2026-6-1", "06/01/2026" each return exitUsage + validation message, while "2026-06-01" returns exitSuccess. - TestRunUsageEmptyStore: zero usage events → exitSuccess, output contains header and "total" row, no panic. * doctor: surface type-mismatch offsets and drop colliding flat line/col keys Probe config validation against config.FileConfig instead of a bare any so a structurally-valid document with a wrong field type (e.g. maxTurns as a string) surfaces a *json.UnmarshalTypeError carrying the offset, instead of losing line/col. Remove the flat top-level details["line"]/["col"] keys that were overwritten by the last malformed file when several were present; keep only the unambiguous per-path map entry. Tighten the existing malformed test to assert concrete per-path line/col and add a type-mismatch test that exercises the previously-dead UnmarshalTypeError branch. * sandbox: fail closed on invalid configured autonomy ceiling An invalid non-empty sandbox.maxAutonomy (e.g. "moderate") previously survived Resolve (only trimmed, never validated), failed to normalize at the sandbox bridge, and left the policy unchanged at the default High ceiling. A typo therefore silently disabled the admin's intended ceiling: fail-open on a security boundary. Validate at resolve time (fail loud): Resolve now rejects a non-empty maxAutonomy that does not normalize, returning a clear error. As defense in depth, applyConfiguredAutonomyCeiling now clamps an unrecognised non-empty value to the most restrictive ceiling (low) instead of returning the policy unchanged, so a bad value can never widen the ceiling even via direct use. Empty/unset stays valid and keeps the default High ceiling. Add resolver tests for invalid-fails / valid-resolves and bridge tests for the fail-closed clamp and valid mappings. * sandbox: fail closed on malformed autonomy and surface policy resolve errors Treat a genuinely-invalid request autonomy as the highest tier in the engine so it exceeds a Medium/Low ceiling and clamps to Prompt instead of being sanitized to Low and auto-allowing on the grant/unsafe path. Surface resolveConfig failures in the policy command instead of silently falling back to the permissive DefaultPolicy, which would misreport trust posture. * usage: bucket and filter by UTC calendar day, reject empty --session Normalize RFC3339 timestamps to their UTC calendar date before day bucketing (report) and before the --since/--days cutoff comparison (CLI) so offset timestamps land on the correct UTC day and the bucket and cutoff agree; malformed timestamps fall back to the leading-10 slice. Reject empty --session/--session-id values with a value-required error matching the --since validation style. * doctor: fail on unreadable config files and stop fabricating positions Surface a present-but-unreadable config path (permissions, is-a-directory) as a failing per-path validation detail instead of silently skipping it; a genuinely-missing path stays a skip. Return ok=false for a JSON parse error that carries no offset so it routes through the no-position ValidateBytes path rather than fabricating a (1,1) line/col. Assert empty stderr on the JSON doctor failure path. * config: make sandbox maxAutonomy resolver tests hermetic Pass an explicit empty Env to the maxAutonomy Resolve tests so host environment variables cannot leak in through the nil-Env os.Getenv fallback. * sandbox: preserve raw autonomy for ceiling check so invalid clamps under default ceiling Defaulting invalid request.Autonomy to High only clamped under a Medium/Low ceiling; under the default High ceiling autonomyAllowed(High, High) returned true and still auto-allowed (fail-open). Keep the raw requested value for the ceiling check so autonomyAllowed's unknown-tier guard fails it closed under ANY ceiling. Adds default-High-ceiling regression tests for the unsafe and grant-allow paths. --------- Co-authored-by: KRATOS <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-08 17:15:57 +05:30