1 Commits

Include renames

Author	SHA1	Message	Date
3 people	9c2e14272b	CLI: doctor config validation, autonomy ceiling, changes --base, usage report (#142) ... * config: add ValidateFile for structured config diagnostics * doctor: add offsetToLineCol helper for JSON error positions * doctor: validate config files in config.validation check * cli: thread config paths into doctor and degrade on bad JSON * doctor: inline read, single-parse config validation + utf8 col test - Remove the osReadFile wrapper; call os.ReadFile directly at its one call site - Add config.ValidateBytes([]byte) so each config file is read and JSON-parsed once in configValidationCheck instead of twice (once for position, once via ValidateFile); ValidateFile now reads then delegates to its own unmarshal for the path-prefixed error message, keeping its public signature unchanged - Fix the misleading skip comment in configValidationCheck: configFilesCheck only checks path-string presence; the skip is a defensive guard for the unreachable case where DefaultResolveOptions passed a non-empty path that still fails to read - Add utf8 multibyte case to TestOffsetToLineCol documenting byte-column semantics (column counts bytes, not runes) * sandbox: add Policy.MaxAutonomy ceiling defaulting to high * sandbox: normalize both operands in autonomyAllowed to fail closed * sandbox: clamp grant-allow and unsafe escalation to policy autonomy ceiling * sandbox: add RequiredAutonomyForBatch helper with fail-closed mapping * config: add sandbox.maxAutonomy field to file and resolved config * config: merge sandbox.maxAutonomy across layers, env, and overrides * cli: thread configured autonomy ceiling into sandbox engine construction * cli: surface max_autonomy in sandbox policy formatters * zerocommands: carry max autonomy in sandbox policy snapshot * sandbox: default empty policy ceiling to high + reason const Evaluate now treats an empty Policy.MaxAutonomy (from a directly-constructed Policy that bypasses DefaultPolicy) as High instead of letting it normalize to Low, which would silently clamp every Medium/High decision to Prompt. The ceiling is a no-op unless explicitly configured. Also extracts the "above policy ceiling" clamp reason into a package const referenced at both engine clamp sites and the related tests, and adds a non-vacuous engine test proving the empty-ceiling trap is closed. * zerogit: add base-ref three-dot diff to changes inspect * zerogit: cover base-ref backward-compat and real-git diff * zerogit: propagate base ref through change snapshot * cli: parse changes --base ref and reject on commit * cli: thread base ref into changes inspect output and help * changes: redact base in cli summary + guard --base= + rename test - redactChangeSummary now redacts the Base field alongside Root/Branch/Commit/etc. - --base= equals-form rejects leading-dash values via flagValueLooksLikeOption, closing the option-smuggling gap - TestParseNameStatusRenameAndCopy asserts rename/copy three-field lines use the new/destination path with correct status, and confirms two-field modify is unaffected * Add ParseDiffStat helper for git diff --stat summaries * Add usage report aggregation over persisted session usage events * Add zero usage report command over persisted session usage * Wire usage command into CLI dispatch and help * usage: validate --since format, fix redaction comments, add tests Fix 1 (BLOCKING): parseUsageArgs now validates --since with time.Parse against YYYY-MM-DD; returns exitUsage + "invalid --since %q: expected YYYY-MM-DD" for bare strings like "foo", unpadded "2026-6-1", or wrong-separator "06/01/2026". Valid dates are stored unchanged for the existing lexical comparison. Fix 2: Replace false "pre-redaction stat" claims in diffstat.go and usage.go with accurate comments: the --stat summary line carries no secret-bearing tokens so parsing the already-redacted DiffStat is safe. Fix 3: Add three tests to usage_test.go — - TestRunUsageDaysFilter: stubs deps.now, seeds events on two dates, asserts --days 3 includes the recent date and excludes the old one. - TestRunUsageInvalidSince: table-driven; verifies "foo", "2026-6-1", "06/01/2026" each return exitUsage + validation message, while "2026-06-01" returns exitSuccess. - TestRunUsageEmptyStore: zero usage events → exitSuccess, output contains header and "total" row, no panic. * doctor: surface type-mismatch offsets and drop colliding flat line/col keys Probe config validation against config.FileConfig instead of a bare any so a structurally-valid document with a wrong field type (e.g. maxTurns as a string) surfaces a *json.UnmarshalTypeError carrying the offset, instead of losing line/col. Remove the flat top-level details["line"]/["col"] keys that were overwritten by the last malformed file when several were present; keep only the unambiguous per-path map entry. Tighten the existing malformed test to assert concrete per-path line/col and add a type-mismatch test that exercises the previously-dead UnmarshalTypeError branch. * sandbox: fail closed on invalid configured autonomy ceiling An invalid non-empty sandbox.maxAutonomy (e.g. "moderate") previously survived Resolve (only trimmed, never validated), failed to normalize at the sandbox bridge, and left the policy unchanged at the default High ceiling. A typo therefore silently disabled the admin's intended ceiling: fail-open on a security boundary. Validate at resolve time (fail loud): Resolve now rejects a non-empty maxAutonomy that does not normalize, returning a clear error. As defense in depth, applyConfiguredAutonomyCeiling now clamps an unrecognised non-empty value to the most restrictive ceiling (low) instead of returning the policy unchanged, so a bad value can never widen the ceiling even via direct use. Empty/unset stays valid and keeps the default High ceiling. Add resolver tests for invalid-fails / valid-resolves and bridge tests for the fail-closed clamp and valid mappings. * sandbox: fail closed on malformed autonomy and surface policy resolve errors Treat a genuinely-invalid request autonomy as the highest tier in the engine so it exceeds a Medium/Low ceiling and clamps to Prompt instead of being sanitized to Low and auto-allowing on the grant/unsafe path. Surface resolveConfig failures in the policy command instead of silently falling back to the permissive DefaultPolicy, which would misreport trust posture. * usage: bucket and filter by UTC calendar day, reject empty --session Normalize RFC3339 timestamps to their UTC calendar date before day bucketing (report) and before the --since/--days cutoff comparison (CLI) so offset timestamps land on the correct UTC day and the bucket and cutoff agree; malformed timestamps fall back to the leading-10 slice. Reject empty --session/--session-id values with a value-required error matching the --since validation style. * doctor: fail on unreadable config files and stop fabricating positions Surface a present-but-unreadable config path (permissions, is-a-directory) as a failing per-path validation detail instead of silently skipping it; a genuinely-missing path stays a skip. Return ok=false for a JSON parse error that carries no offset so it routes through the no-position ValidateBytes path rather than fabricating a (1,1) line/col. Assert empty stderr on the JSON doctor failure path. * config: make sandbox maxAutonomy resolver tests hermetic Pass an explicit empty Env to the maxAutonomy Resolve tests so host environment variables cannot leak in through the nil-Env os.Getenv fallback. * sandbox: preserve raw autonomy for ceiling check so invalid clamps under default ceiling Defaulting invalid request.Autonomy to High only clamped under a Medium/Low ceiling; under the default High ceiling autonomyAllowed(High, High) returned true and still auto-allowed (fail-open). Keep the raw requested value for the ceiling check so autonomyAllowed's unknown-tier guard fails it closed under ANY ceiling. Adds default-High-ceiling regression tests for the unsafe and grant-allow paths. --------- Co-authored-by: KRATOS <[email protected]> Co-authored-by: Vasanthdev2004 <[email protected]>	2026-06-08 17:15:57 +05:30