mirror of
https://github.com/Twigpine/zero.git
synced 2026-11-11 05:01:36 -10:00
* tui: migrate off the deprecated Bubble Tea mouse Type API (SA1019)
The mouse classification helpers checked both the current Button/Action pair and
the deprecated msg.Type / tea.Mouse* constants. Bubble Tea's parser always
populates Button+Action and only DERIVES Type from them, so the Type fallbacks
were pure redundancy (a left-button drag is Action==Motion, already covered by
mouseMotion). Drop them — clears all 11 SA1019 findings in internal/tui with no
behavior change. The left-drag test now asserts the Action==Motion path directly.
Gates: gofmt/vet/build(host+linux+windows)/test -race/staticcheck(SA1019 0)/
deadcode(no new) all pass.
* notify: wire the webhook sink behind an opt-in env var
The WebhookSink (Slack / generic JSON POST on turn completion) was fully
implemented, redaction-safe, and tested — but never attached to a Notifier, so
deadcode flagged its entire machinery (NewWebhookSink, Emit, text, redactLinks,
log, eventType, readSnippet) as unreachable.
Wire it via a small, testable helper, MaybeAddWebhookSink(n, env, logf):
- reads ZERO_NOTIFY_WEBHOOK_URL (+ optional ZERO_NOTIFY_WEBHOOK_SUMMARY)
- no-op when the URL is unset/blank, so it is safe to call unconditionally
- sourcing the URL from the environment keeps the secret token out of any
on-disk config file
Attached at both notifier construction sites:
- headless exec: failed deliveries log to stderr (never stdout); the sink
redacts before logging
- TUI: logf=nil so a delivery failure can't corrupt the alt-screen
The sink stays gated by the existing Mode/focus policy (verified by
TestNotifierOffSuppressesSinks), so a webhook only fires when notifications are
enabled (e.g. --notify both) — no change to default behavior. Opt-in and
fail-closed: with the env var unset nothing is attached.
deadcode: 100 -> 93 unreachable funcs (the 7 WebhookSink entries become
reachable); no new dead code. gofmt/vet/build(host+linux+windows)/test -race/
staticcheck(no new)/govulncheck(0) all pass.
* swarm: add opt-in recurring-spawn scheduler (wakeup + daily)
Adds a dependency-free Scheduler to internal/swarm so a member can be spawned on
a recurring schedule, plus a swarm_schedule tool to drive it.
- Schedule is interval-based ("wakeup", every >= 1s) with an optional first
delay and a MaxRuns cap; a daily "HH:MM" ("cron") time is expressed as a 24h
interval whose first delay lands on the next occurrence.
- Each fire spawns a fresh member through the existing Swarm.Spawn path, so
members inherit the recorded policy and are bounded by the team slot cap +
queue. Non-overlapping by default: a fire is skipped while the job's previous
spawn is still running, preventing queue pile-up.
- Scheduler is lazily created (Swarm.Scheduler()), opt-in (nothing runs until a
job is added), and tied to the Swarm's base context — Swarm.Close() stops the
scheduler first so no spawn fires during shutdown.
- swarm_schedule tool: action add|list|cancel; prompt-gated like swarm_spawn;
add validates schedule + agent type up front (fail fast).
The timing loop takes an injectable ticker, so the tests drive fires
deterministically with no real time (fire/skip/cap/cancel/close, plus pure
nextDailyDelay/parseClock/swarmInt). All swarm tests pass 3x under -race.
Gates: gofmt/vet/build(host+linux+windows)/test/staticcheck(clean)/govulncheck(0)/
deadcode(no new) all pass.
* daemon/remote: SessionLink + git-bundle upload over the bridge
Adds an opt-in way to ship a local repo's git history to a remote daemon and
link a remote working tree to it — without a shared filesystem or a network git
remote. The daemon core (protocol/server) is untouched; all changes live in the
remote package plus a CLI hook.
Wire:
- The auth handshake gains an optional Mode field ("" / "session" => a daemon
session as before; "bundle" => a one-shot git-bundle upload). Unknown modes,
or bundle mode when uploads are disabled, are denied (fail closed).
- Bundle transfer reuses the daemon frame codec: a header frame (link id +
exact size), then the bundle bytes as KindData frames, then a result frame.
Server (Bridge):
- BridgeOptions.BundleDir enables uploads (empty => refused). A received bundle
is size-capped (default 256 MiB), staged to a temp file, `git bundle verify`-d,
then `git clone`-d into a staging dir and atomically renamed over
<BundleDir>/<link-id>. Link ids are sanitized to a single path component and
containment is re-checked, so an upload can never escape the bundle dir.
Client:
- UploadRepoBundle creates `git bundle create --all` of a work tree, hashes it
(sha256), streams it over an authenticated bundle-mode TLS connection, and
returns a SessionLink {address, link id, remote path, bundle sha}. SessionLink
persists as a 0600 atomic JSON file (token never stored) with Save/Load/Validate.
CLI:
- `daemon serve-remote --bundle-dir <d>` enables uploads.
- `daemon link --remote <addr> --repo <dir> --id <name> [--out <file>]` uploads
and prints the remote path (+ a ready run command); `daemon link --show <file>`
prints a saved link.
Tests: git bundle create/verify/clone roundtrip; link-id sanitization + path
containment; SessionLink save/load/validate (0600); and a full bridge upload E2E
over real TLS (extract + content check + re-upload-replaces + disabled + bad
token). All remote tests pass 2x under -race; CLI smoke verified via the binary.
Gates: gofmt/vet/build(host+linux+windows)/test/staticcheck(no new)/
govulncheck(0)/deadcode(no new) all pass.
* mcp: unify OAuth token storage onto the shared oauth store
MCP server tokens lived in their own mcp-oauth-tokens.json with a bespoke
codec/lock, separate from the provider-login store (internal/oauth). The oauth
store already reserved the "mcp:" key namespace for exactly this. Unify them.
- mcp.TokenStore now delegates to internal/oauth.Store, keying each server's
token as "mcp:<server>". Its public API (StoredToken/TokenStatus/Save/Load/
Delete/Status/FilePath) is unchanged, so callers (network client, CLI) are
untouched. The bespoke read/write/lock code is removed in favor of the shared,
cross-process-locked, atomic store.
- Transparent, non-destructive migration on first construction: a legacy
mcp-oauth-tokens.json is imported into the unified store (only entries not
already present — a newer unified token is never overwritten), then renamed to
a ".migrated" backup so it is imported at most once and stays recoverable.
A missing / unreadable / unknown-schema legacy file is left untouched and
never blocks startup. An explicit FilePath suppresses the default-path
migration so tests/overrides can't touch the real user config.
- Server names that can't form a valid namespaced key (oauth.ValidateKey) are
rejected on save and skipped during migration. Added oauth.Store.FilePath().
The token format was already identical (access/refresh/type/scopes/expires), so
this is a key rename, not a format change. Existing TokenStore tests pass
unchanged (they exercise the API); added migration + namespacing + newer-wins
tests. Local run check: `zero mcp oauth status` migrates a seeded legacy file
into oauth-tokens.json under mcp:demo, renames the legacy to .migrated, and leaks
no token material.
Gates: gofmt/vet/build(host+linux+windows)/test -race/staticcheck(clean)/
govulncheck(0)/deadcode(no new) all pass.
* oauth: add an opt-in OS keyring storage backend
Introduces a pluggable storage backend for the unified oauth token store and a
dependency-free OS keyring implementation, selected with
ZERO_OAUTH_STORAGE=keyring (default stays the 0600 file).
- internal/keyring: a small, third-party-dep-free secret store backed by the OS
tooling — `security` on macOS, `secret-tool` (libsecret) on Linux; other
platforms report unsupported. On Linux the secret is passed via stdin (never
the argv); on macOS `security` takes it as an argument (briefly visible in the
process list) — documented, and a reason to prefer the file backend there.
A runner seam makes the per-OS command logic fully testable without a real
keychain.
- internal/oauth: Store now persists its JSON blob through a blobStore backend.
fileBlob preserves the exact prior behavior (0600, atomic write, cross-process
lock file). keyringBlob stores the blob as one base64 entry (keeps multi-line
JSON a single control-char-free value) via a KeyringClient. NewStore resolves
the backend from StoreOptions.Storage or ZERO_OAUTH_STORAGE; unknown storage
and an unavailable keyring fail closed with a clear error.
Because both `zero auth` and the (now unified) MCP token store construct their
store through oauth.NewStore, the keyring backend is honored by both with no
call-site changes. Added oauth.Store.FilePath() returns a "keyring:" identifier
for that backend.
No new module dependency (go.mod unchanged). Tests: keyring round-trip/not-found/
unsupported/missing-binary/stdin-not-argv via an injected runner; store keyring
round-trip + base64-at-rest + storage selection; all existing file-backend tests
pass unchanged. Local run check (macOS): validated the exact `security`
add/find/delete shapes and the not-found exit code (44) against the real binary,
and `mcp oauth status` with ZERO_OAUTH_STORAGE=keyring reads the real keychain
cleanly.
Gates: gofmt/vet/build(host+linux+windows)/test -race/staticcheck(no new)/
govulncheck(0)/deadcode(no new) all pass.
* all: prune unused unexported functions (dead-code sweep)
Removes 15 unexported functions/types/consts that are unreachable even from
tests (every one flagged by staticcheck U1000), clearing the U1000 noise the v16
audit surfaced. Conservative by design: only unexported, test-unused symbols are
removed — exported internal API (which may be an intentional surface or used only
by tests) is deliberately left in place.
Removed:
- agenteval: validateExpectedChangedFiles
- providers/gemini: const providerName
- tui: stripMarkdownInline, removeTrailingAtToken,
noopModelSwitchCompactionPolicy (+ BeforeModelSwitch), deleteComposerLineBefore,
deleteComposerLineAfter, deleteCompletedFileMentionBefore, mcpViewStatus,
mcpServerLines, fitCommandOutput, (*commandPicker).clearQuery,
tuiTheme.onPanel2, indentText
No behavior change (the symbols had no callers). staticcheck U1000 is now empty;
deadcode drops accordingly with no genuinely-new unreachable functions (verified
by a name-based diff vs origin/main). gofmt/vet/build(host+linux+windows)/full
test all pass.
* Address review feedback on the audit backlog
Resolve CodeRabbit review comments on this PR:
- keyring isNotFound: match the specific not-found exit codes (macOS `security`
44 = errSecItemNotFound; `secret-tool` 1) instead of treating any non-zero
exit as "no entry", so a real failure (locked keychain, permissions) surfaces
instead of being masked as absent.
- swarm scheduler daily_at: recompute each fire as the next local HH:MM rather
than adding a fixed 24h, so a wall-clock daily schedule does not drift across
DST. Adds Daily/Hour/Minute to Schedule and a clock to the Scheduler.
- swarm scheduler: reject Add when the scheduler context is already canceled
(not just when closed); re-check cancellation after a tick so a tick+cancel
race can't spawn one extra member after Cancel/Close.
- swarm schedule_tool swarmInt: reject non-integer / non-finite JSON numbers
(max_runs=1.9 errors instead of silently truncating to 1).
- mcp migrateLegacy: resolve a relative LegacyPath to absolute before the
same-file guard so it can't be bypassed by a relative spelling.
- oauth keyring store: serialize the keyring read-modify-write with a
cross-process lock file (best-effort, beside the config dir) so concurrent
processes don't clobber each other's tokens; previously withLock was a no-op.
Adds tests for the non-not-found keyring error, the daily delay recompute, the
Add-after-cancel guard, and non-integer swarmInt.
* swarm: make nextDailyDelay roll the day, not add 24h (DST)
CodeRabbit follow-up: the run loop already recomputes a daily job's delay each
cycle, but nextDailyDelay itself rolled "passed today" to the next occurrence
with Add(24*time.Hour). On a DST changeover day (23h/25h) that fires an hour
early/late. Use time.Date(..., day+1, hour, minute, ...) so Go normalizes the
date and applies the correct local offset, holding the wall-clock HH:MM across
DST. Adds an America/New_York spring-forward test (skips if tzdata is absent).
252 lines
8.0 KiB
Go
252 lines
8.0 KiB
Go
package agenteval
|
|
|
|
import (
|
|
"encoding/json"
|
|
"errors"
|
|
"fmt"
|
|
"io"
|
|
"os"
|
|
"path"
|
|
"sort"
|
|
"strings"
|
|
)
|
|
|
|
type Suite struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description,omitempty"`
|
|
Tasks []Task `json:"tasks"`
|
|
}
|
|
|
|
type Task struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
Description string `json:"description,omitempty"`
|
|
Tags []string `json:"tags,omitempty"`
|
|
Difficulty string `json:"difficulty,omitempty"`
|
|
Prompt string `json:"prompt"`
|
|
WorkspaceFixture string `json:"workspaceFixture"`
|
|
VerificationCommands []Command `json:"verificationCommands"`
|
|
ExpectedChangedFiles []string `json:"expectedChangedFiles"`
|
|
ForbiddenChangedFiles []string `json:"forbiddenChangedFiles,omitempty"`
|
|
RequiredTraceEvents []string `json:"requiredTraceEvents,omitempty"`
|
|
ContextChecks ContextChecks `json:"contextChecks,omitempty"`
|
|
}
|
|
|
|
type Command struct {
|
|
ID string `json:"id"`
|
|
Name string `json:"name"`
|
|
Command []string `json:"command"`
|
|
}
|
|
|
|
type ValidationError struct {
|
|
Problems []string
|
|
}
|
|
|
|
func (err ValidationError) Error() string {
|
|
if len(err.Problems) == 0 {
|
|
return "agent eval suite is invalid"
|
|
}
|
|
return "agent eval suite is invalid: " + strings.Join(err.Problems, "; ")
|
|
}
|
|
|
|
func LoadSuite(path string) (Suite, error) {
|
|
data, err := os.ReadFile(path)
|
|
if err != nil {
|
|
return Suite{}, fmt.Errorf("load agent eval suite: %w", err)
|
|
}
|
|
var suite Suite
|
|
decoder := json.NewDecoder(strings.NewReader(string(data)))
|
|
decoder.DisallowUnknownFields()
|
|
if err := decoder.Decode(&suite); err != nil {
|
|
return Suite{}, fmt.Errorf("parse agent eval suite: %w", err)
|
|
}
|
|
var extra any
|
|
if err := decoder.Decode(&extra); err == nil {
|
|
return Suite{}, fmt.Errorf("parse agent eval suite: trailing JSON after suite")
|
|
} else if !errors.Is(err, io.EOF) {
|
|
return Suite{}, fmt.Errorf("parse agent eval suite: trailing JSON after suite: %w", err)
|
|
}
|
|
if err := suite.Validate(); err != nil {
|
|
return Suite{}, err
|
|
}
|
|
suite.normalize()
|
|
return suite, nil
|
|
}
|
|
|
|
func (suite Suite) Validate() error {
|
|
problems := []string{}
|
|
if blank(suite.ID) {
|
|
problems = append(problems, "suite id is required")
|
|
}
|
|
if blank(suite.Name) {
|
|
problems = append(problems, "suite name is required")
|
|
}
|
|
if len(suite.Tasks) == 0 {
|
|
problems = append(problems, "tasks must not be empty")
|
|
}
|
|
taskIndexes := map[string]int{}
|
|
for taskIndex, task := range suite.Tasks {
|
|
taskPath := fmt.Sprintf("tasks[%d]", taskIndex)
|
|
if blank(task.ID) {
|
|
problems = append(problems, taskPath+" id is required")
|
|
} else if previous, ok := taskIndexes[task.ID]; ok {
|
|
problems = append(problems, fmt.Sprintf("%s id duplicates tasks[%d]", taskPath, previous))
|
|
} else {
|
|
taskIndexes[task.ID] = taskIndex
|
|
}
|
|
if blank(task.Name) {
|
|
problems = append(problems, taskPath+" name is required")
|
|
}
|
|
if blank(task.Prompt) {
|
|
problems = append(problems, taskPath+" prompt is required")
|
|
}
|
|
if blank(task.WorkspaceFixture) {
|
|
problems = append(problems, taskPath+" workspaceFixture is required")
|
|
}
|
|
if len(task.VerificationCommands) == 0 {
|
|
problems = append(problems, taskPath+" verificationCommands must not be empty")
|
|
}
|
|
problems = append(problems, validateFileList(taskPath, "expectedChangedFiles", task.ExpectedChangedFiles, true)...)
|
|
problems = append(problems, validateFileList(taskPath, "forbiddenChangedFiles", task.ForbiddenChangedFiles, false)...)
|
|
problems = append(problems, validateFileList(taskPath, "contextChecks.requiredFiles", task.ContextChecks.RequiredFiles, false)...)
|
|
problems = append(problems, validateFileList(taskPath, "contextChecks.forbiddenFiles", task.ContextChecks.ForbiddenFiles, false)...)
|
|
problems = append(problems, validateStringList(taskPath, "requiredTraceEvents", task.RequiredTraceEvents)...)
|
|
commandIndexes := map[string]int{}
|
|
for commandIndex, command := range task.VerificationCommands {
|
|
commandPath := fmt.Sprintf("%s verificationCommands[%d]", taskPath, commandIndex)
|
|
if blank(command.ID) {
|
|
problems = append(problems, commandPath+" id is required")
|
|
} else if previous, ok := commandIndexes[command.ID]; ok {
|
|
problems = append(problems, fmt.Sprintf("%s id duplicates verificationCommands[%d]", commandPath, previous))
|
|
} else {
|
|
commandIndexes[command.ID] = commandIndex
|
|
}
|
|
if blank(command.Name) {
|
|
problems = append(problems, commandPath+" name is required")
|
|
}
|
|
if emptyCommand(command.Command) {
|
|
problems = append(problems, commandPath+" command must not be empty")
|
|
}
|
|
}
|
|
}
|
|
if len(problems) > 0 {
|
|
return ValidationError{Problems: problems}
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (suite *Suite) normalize() {
|
|
for taskIndex := range suite.Tasks {
|
|
suite.Tasks[taskIndex].ExpectedChangedFiles = normalizeFiles(suite.Tasks[taskIndex].ExpectedChangedFiles)
|
|
suite.Tasks[taskIndex].ForbiddenChangedFiles = normalizeFiles(suite.Tasks[taskIndex].ForbiddenChangedFiles)
|
|
suite.Tasks[taskIndex].RequiredTraceEvents = normalizeStrings(suite.Tasks[taskIndex].RequiredTraceEvents)
|
|
suite.Tasks[taskIndex].ContextChecks.RequiredFiles = normalizeFiles(suite.Tasks[taskIndex].ContextChecks.RequiredFiles)
|
|
suite.Tasks[taskIndex].ContextChecks.ForbiddenFiles = normalizeFiles(suite.Tasks[taskIndex].ContextChecks.ForbiddenFiles)
|
|
}
|
|
}
|
|
|
|
func normalizeFiles(files []string) []string {
|
|
seen := map[string]bool{}
|
|
normalized := make([]string, 0, len(files))
|
|
for _, file := range files {
|
|
file, ok := normalizeEvalPath(file)
|
|
if !ok || file == "" || seen[file] {
|
|
continue
|
|
}
|
|
seen[file] = true
|
|
normalized = append(normalized, file)
|
|
}
|
|
sort.Strings(normalized)
|
|
return normalized
|
|
}
|
|
|
|
func validateFileList(taskPath string, field string, files []string, required bool) []string {
|
|
if required && len(files) == 0 {
|
|
return []string{taskPath + " " + field + " must not be empty"}
|
|
}
|
|
problems := []string{}
|
|
seen := map[string]int{}
|
|
for index, file := range files {
|
|
normalized, ok := normalizeEvalPath(file)
|
|
if !ok {
|
|
problems = append(problems, fmt.Sprintf("%s %s[%d] must be a relative workspace path", taskPath, field, index))
|
|
continue
|
|
}
|
|
if normalized == "" {
|
|
problems = append(problems, fmt.Sprintf("%s %s[%d] must not be empty", taskPath, field, index))
|
|
continue
|
|
}
|
|
if previous, ok := seen[normalized]; ok {
|
|
problems = append(problems, fmt.Sprintf("%s %s[%d] duplicates %s[%d]", taskPath, field, index, field, previous))
|
|
continue
|
|
}
|
|
seen[normalized] = index
|
|
}
|
|
return problems
|
|
}
|
|
|
|
func validateStringList(taskPath string, field string, values []string) []string {
|
|
problems := []string{}
|
|
seen := map[string]int{}
|
|
for index, value := range values {
|
|
value = strings.TrimSpace(value)
|
|
if value == "" {
|
|
problems = append(problems, fmt.Sprintf("%s %s[%d] must not be empty", taskPath, field, index))
|
|
continue
|
|
}
|
|
if previous, ok := seen[value]; ok {
|
|
problems = append(problems, fmt.Sprintf("%s %s[%d] duplicates %s[%d]", taskPath, field, index, field, previous))
|
|
continue
|
|
}
|
|
seen[value] = index
|
|
}
|
|
return problems
|
|
}
|
|
|
|
func normalizeEvalPath(file string) (string, bool) {
|
|
file = strings.TrimSpace(strings.ReplaceAll(file, "\\", "/"))
|
|
if file == "" {
|
|
return "", true
|
|
}
|
|
if strings.HasPrefix(file, "/") || strings.Contains(file, ":") {
|
|
return "", false
|
|
}
|
|
clean := path.Clean(file)
|
|
if clean == "." || clean == ".." || strings.HasPrefix(clean, "../") {
|
|
return "", false
|
|
}
|
|
return clean, true
|
|
}
|
|
|
|
func blank(value string) bool {
|
|
return strings.TrimSpace(value) == ""
|
|
}
|
|
|
|
func normalizeStrings(values []string) []string {
|
|
seen := map[string]bool{}
|
|
normalized := make([]string, 0, len(values))
|
|
for _, value := range values {
|
|
value = strings.TrimSpace(value)
|
|
if value == "" || seen[value] {
|
|
continue
|
|
}
|
|
seen[value] = true
|
|
normalized = append(normalized, value)
|
|
}
|
|
sort.Strings(normalized)
|
|
return normalized
|
|
}
|
|
|
|
func emptyCommand(command []string) bool {
|
|
if len(command) == 0 {
|
|
return true
|
|
}
|
|
for _, part := range command {
|
|
if !blank(part) {
|
|
return false
|
|
}
|
|
}
|
|
return true
|
|
}
|