diff --git a/.agents/skills/find-skills/SKILL.md b/.agents/skills/find-skills/SKILL.md new file mode 100644 index 0000000000..8309948e74 --- /dev/null +++ b/.agents/skills/find-skills/SKILL.md @@ -0,0 +1,139 @@ +--- +name: find-skills +description: Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill. +--- + +# Find Skills + +This skill helps you discover and install skills from the open agent skills ecosystem. + +## When to Use This Skill + +Use this skill when the user: + +- Asks "how do I do X" where X might be a common task with an existing skill +- Says "find a skill for X" or "is there a skill for X" +- Asks "can you do X" where X is a specialized capability +- Expresses interest in extending agent capabilities +- Wants to search for tools, templates, or workflows +- Mentions they wish they had help with a specific domain (design, testing, deployment, etc.) + +## What is the Skills CLI? + +The Skills CLI (`npx skills@1.0.0` or the version pinned in `skills-lock.json`) is the package manager for the open agent skills ecosystem. Skills are modular packages that extend agent capabilities with specialized knowledge, workflows, and tools. + +**Key commands (always pin the CLI version):** + +- `npx skills@1.0.0 find [query] [--owner ]` — Search for skills interactively or by keyword +- `npx skills@1.0.0 add ` — Install a skill **project-locally** by default (no global flag) +- `npx skills@1.0.0 update` — Update installed skills in the current project + +**Security rules:** + +- Pin every `npx skills@...` invocation to an explicit version (see `skills-lock.json` / approved release). +- Default install scope is **project-local**. Do not use `--global` / `-g` or non-interactive `--yes` / `-y` unless the user explicitly approves that scope and mode. +- Do not treat install counts, GitHub stars, or source reputation as security validation. + +**Browse skills at:** https://skills.sh/ + +## How to Help Users Find Skills + +### Step 1: Understand What They Need + +When a user asks for help with something, identify: + +1. The domain (e.g., React, testing, design, deployment) +2. The specific task (e.g., writing tests, creating animations, reviewing PRs) +3. Whether this is a common enough task that a skill likely exists + +### Step 2: Check the Leaderboard First + +Before running a CLI search, check the [skills.sh leaderboard](https://skills.sh/) for well-known skills in the domain. Rankings can help discovery but are **not** a security signal. + +### Step 3: Search for Skills + +If the leaderboard doesn't cover the user's need, run the find command with a pinned version: + +```bash +npx skills@1.0.0 find [query] [--owner ] +``` + +For example: + +- User asks "how do I make my React app faster?" → `npx skills@1.0.0 find react performance` +- User asks "can you help me with PR reviews?" → `npx skills@1.0.0 find pr review` +- User asks "I need to create a changelog" → `npx skills@1.0.0 find changelog` + +### Step 4: Review Before Recommending + +**Do not recommend a skill based solely on search results.** Review the skill source, license, and contents. Prefer official or known maintainers when possible, but always require explicit user approval before install. + +### Step 5: Present Options to the User + +When you find relevant skills, present them with: + +1. The skill name and what it does +2. The source repository +3. The **project-local** install command (pinned version) +4. A link to learn more at skills.sh + +Example response: + +```text +I found a skill that might help: "react-best-practices" from vercel-labs/agent-skills. + +To install it project-locally (pinned CLI): +npx skills@1.0.0 add vercel-labs/agent-skills@react-best-practices + +Learn more: https://skills.sh/vercel-labs/agent-skills/react-best-practices + +Say if you want global install or non-interactive flags — those require explicit approval. +``` + +### Step 6: Offer to Install (with approval) + +If the user wants to proceed, install **project-locally** by default: + +```bash +npx skills@1.0.0 add +``` + +Only add `--global` / `-g` or `--yes` / `-y` when the user has explicitly approved global scope or non-interactive execution. + +## Common Skill Categories + +When searching, consider these common categories: + +| Category | Example Queries | +| --------------- | ---------------------------------------- | +| Web Development | react, nextjs, typescript, css, tailwind | +| Testing | testing, jest, playwright, e2e | +| DevOps | deploy, docker, kubernetes, ci-cd | +| Documentation | docs, readme, changelog, api-docs | +| Code Quality | review, lint, refactor, best-practices | +| Design | ui, ux, design-system, accessibility | +| Productivity | workflow, automation, git | + +## Tips for Effective Searches + +1. **Use specific keywords**: "react testing" is better than just "testing" +2. **Try alternative terms**: If "deploy" doesn't work, try "deployment" or "ci-cd" +3. **Check popular sources**: Many skills come from `vercel-labs/agent-skills` or similar collections — still review before install + +## When No Skills Are Found + +If no relevant skills exist: + +1. Acknowledge that no existing skill was found +2. Offer to help with the task directly using your general capabilities +3. Suggest the user could create their own skill with a pinned init command + +Example: + +```text +I searched for skills related to "xyz" but didn't find any matches. +I can still help you with this task directly! Would you like me to proceed? + +If this is something you do often, you could create your own skill: +npx skills@1.0.0 init my-xyz-skill +``` diff --git a/.replit b/.replit new file mode 100644 index 0000000000..05dc727bd0 --- /dev/null +++ b/.replit @@ -0,0 +1,7 @@ +modules = ["python-3.12", "bash", "web", "nodejs-20", "rust-stable"] + +[nix] +channel = "stable-26_05" + +[agent] +expertMode = true diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000000..5bda9a744e --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,16 @@ +# Security and responsible use + +This repository contains helpers that interact with external Web chat providers (e.g., Mistral). +Some tools in the repository are convenience scripts for local use only and may read or write +sensitive artifacts such as cookies, bearer tokens, or session exports. + +Guidelines +- Do NOT commit tokens, cookie files, session exports, or other credentials into the repository. +- Any script that interacts with credentials must be run deliberately by an operator, and only + after they have reviewed the code and understand the legal and ToS implications. +- Tools that capture or manipulate credentials are placed under tools/harvesters/credentialing_optin/ + and require explicit opt-in (see README in that folder). +- Token files, cookie files, and session exports MUST use 600 permissions; directories MUST use 700 permissions. + +If you find secrets accidentally committed to the repo, follow the GitHub guidance for removing +secrets from history and rotate the credentials immediately. diff --git a/archwiz/__init__.py b/archwiz/__init__.py new file mode 100644 index 0000000000..527a0d3f13 --- /dev/null +++ b/archwiz/__init__.py @@ -0,0 +1,2 @@ +# archwiz package — makes `from archwiz import config` work +# regardless of the caller's working directory. diff --git a/archwiz/config.py b/archwiz/config.py new file mode 100644 index 0000000000..f85ee0107b --- /dev/null +++ b/archwiz/config.py @@ -0,0 +1,198 @@ +from pathlib import Path +import os +import json + +# archwiz/config.py +# Environment-aware configuration for ArchWiz / termux-monorepo. +# Single source of truth for all runtime paths — import this instead of +# hard-coding os.path.expanduser('~/archwiz/...') at every call site. +# +# Environments detected (in priority order): +# termux — /data/data/com.termux exists on the filesystem +# replit — REPL_ID or REPLIT_DOMAINS env var is present +# local — everything else (Linux desktop, CI, etc.) +# +# Override detection with ARCHWIZ_ENV=termux|replit|local in the shell, +# or by writing {"archwiz_env": "..."} to ~/.archwiz/config.json. + +HOME = Path.home() + +USER_CONFIG_DIR = HOME / ".archwiz" +USER_CONFIG_FILE = USER_CONFIG_DIR / "config.json" + +# Defaults — all overridable via ~/.archwiz/config.json or ARCHWIZ_ENV +_defaults: dict = { + "archwiz_env": "auto", # auto | termux | replit | local + "archwiz_root": None, # None → auto-detected from env + "multi_ai_tokens_dir": str(HOME / ".multi-ai-tokens"), + "session_store": str(HOME / ".deepcli" / "session_store"), + "log_dir": str(HOME / ".archwiz" / "logs"), +} + + +class Config: + def __init__(self): + USER_CONFIG_DIR.mkdir(mode=0o700, parents=True, exist_ok=True) + self._cfg = dict(_defaults) + + # Load persisted user config, silently retire broken files + if USER_CONFIG_FILE.exists(): + try: + data = json.loads(USER_CONFIG_FILE.read_text()) + if isinstance(data, dict): + self._cfg.update(data) + except (OSError, json.JSONDecodeError) as e: + import sys + print(f"[config] Failed to load {USER_CONFIG_FILE}: {e}", file=sys.stderr, flush=True) + try: + USER_CONFIG_FILE.rename(USER_CONFIG_FILE.with_suffix(".broken")) + except OSError as rename_err: + print(f"[config] Failed to rename broken config: {rename_err}", file=sys.stderr, flush=True) + + # Shell override takes highest priority + shell_env = os.environ.get("ARCHWIZ_ENV", "").strip().lower() + if shell_env in ("termux", "replit", "local"): + self._cfg["archwiz_env"] = shell_env + + self._apply_auto_detection() + + # ------------------------------------------------------------------ + # Internal helpers + # ------------------------------------------------------------------ + + def _apply_auto_detection(self): + ev = self._cfg.get("archwiz_env", "auto") + if ev == "auto": + if Path("/data/data/com.termux").exists(): + ev = "termux" + elif ( + os.environ.get("REPL_ID") + or os.environ.get("REPLIT_DOMAINS") + or os.environ.get("REPLIT_DB_URL") + ): + ev = "replit" + else: + ev = "local" + self._cfg["archwiz_env"] = ev + + if not self._cfg.get("archwiz_root"): + if ev == "termux": + self._cfg["archwiz_root"] = "/data/data/com.termux/files/home" + else: + self._cfg["archwiz_root"] = str(HOME) + + self._cfg.setdefault("multi_ai_tokens_dir", _defaults["multi_ai_tokens_dir"]) + self._cfg.setdefault("session_store", _defaults["session_store"]) + self._cfg.setdefault("log_dir", _defaults["log_dir"]) + + def _mkdir(self, p: Path, mode: int = 0o700) -> Path: + p.mkdir(mode=mode, parents=True, exist_ok=True) + return p + + # ------------------------------------------------------------------ + # Persistence + # ------------------------------------------------------------------ + + def save(self): + USER_CONFIG_FILE.write_text(json.dumps(self._cfg, indent=2)) + USER_CONFIG_FILE.chmod(0o600) + + def get(self, key, default=None): + return self._cfg.get(key, default) + + def set(self, key, value): + self._cfg[key] = value + self.save() + + # ------------------------------------------------------------------ + # Core path properties — used by archwiz.py and all sub-tools + # ------------------------------------------------------------------ + + @property + def archwiz_env(self) -> str: + return self._cfg.get("archwiz_env", "local") + + @property + def archwiz_root(self) -> Path: + """Root home directory for this environment.""" + return Path(self._cfg["archwiz_root"]) + + @property + def ARCHWIZ_DIR(self) -> Path: + """~/archwiz/ — cockpit, listener, sentinel, etc.""" + return self._mkdir(self.archwiz_root / "archwiz") + + @property + def DEEPCLI_DIR(self) -> Path: + """~/deepcli/ — DeepSeek CLI package.""" + return self.archwiz_root / "deepcli" + + @property + def WORKSPACE_DIR(self) -> Path: + """~/workspace/ — llm_map, provenance, etc.""" + return self.archwiz_root / "workspace" + + @property + def SESSION_STORE(self) -> Path: + """~/.deepcli/session_store/ — per-session JSON cache.""" + p = Path(self._cfg["session_store"]) + self._mkdir(p.parent) + self._mkdir(p) + return p + + @property + def MULTI_AI_TOKENS_DIR(self) -> Path: + """~/.multi-ai-tokens/ — bearer tokens for all AI providers.""" + return self._mkdir(Path(self._cfg["multi_ai_tokens_dir"])) + + @property + def LOG_DIR(self) -> Path: + """~/.archwiz/logs/ — pipeline + debug logs.""" + return self._mkdir(Path(self._cfg["log_dir"])) + + +# --------------------------------------------------------------------------- +# Module-level singleton — import and use directly: +# from archwiz.config import ARCHWIZ_DIR, SESSION_STORE +# from archwiz import config as cfg; cfg.ARCHWIZ_DIR +# --------------------------------------------------------------------------- + +_config = Config() + +# Flat convenience constants — drop-in replacements for expanduser() calls +ARCHWIZ_DIR = _config.ARCHWIZ_DIR +DEEPCLI_DIR = _config.DEEPCLI_DIR +WORKSPACE_DIR = _config.WORKSPACE_DIR +SESSION_STORE = _config.SESSION_STORE +MULTI_AI_TOKENS_DIR = _config.MULTI_AI_TOKENS_DIR +LOG_DIR = _config.LOG_DIR +ARCHWIZ_ENV = _config.archwiz_env +ARCHWIZ_ROOT = _config.archwiz_root + + +# --------------------------------------------------------------------------- +# Convenience functions — kept for API compat with mistral/fixes-config-security +# --------------------------------------------------------------------------- + +def get_tokens_dir() -> Path: + return _config.MULTI_AI_TOKENS_DIR + + +def get_session_store() -> Path: + return _config.SESSION_STORE + + +def set_tokens_dir(path): + _config.set("multi_ai_tokens_dir", str(path)) + + +def set_session_store(path): + _config.set("session_store", str(path)) + + +def ensure_dirs(): + """Pre-create all runtime directories. Call once at startup.""" + _ = _config.ARCHWIZ_DIR + _ = _config.SESSION_STORE + _ = _config.MULTI_AI_TOKENS_DIR + _ = _config.LOG_DIR diff --git a/docs/proposals/ChatGPT_droidApp.md b/docs/proposals/ChatGPT_droidApp.md new file mode 100644 index 0000000000..1129a24bd9 --- /dev/null +++ b/docs/proposals/ChatGPT_droidApp.md @@ -0,0 +1,8 @@ +# Repository and Commit/PR Evaluation Links + +This document contains shared links for repository and commit/PR evaluations. + +> **Note:** Reconsider the directory location for proposal documents under `docs/proposals/`. + +- [Initial repository evaluation](https://chatgpt.com/s/t_6a6d3a3b2a308191981b5877ea748ed4) +- [PR branch commit review](https://chatgpt.com/s/t_6a6d3a0c17e48191a470ddf338780387) diff --git a/replit.md b/replit.md new file mode 100644 index 0000000000..4a2683ace8 --- /dev/null +++ b/replit.md @@ -0,0 +1,262 @@ +# ArchWiz Monorepo — Critical Evaluation & Roadmap + +> Evaluated: 2026-07-31. Stack: Python 3 / Bash / Rust (harmonizer) / TypeScript (commingle-swarm). Origin: Termux/Android monorepo. + +--- + +## What This Is + +A personal **agentic development environment** built around the DeepSeek AI API. The system closes a loop: the user chats with DeepSeek via a terminal CLI (`deepcli`), the ArchWiz cockpit auto-detects and executes code blocks from those conversations, results feed back into the knowledge graph, and a suite of forensic/verification tools (Sentinel, Archivist, Mirror, Dangle Detector) maintain quality and provenance. + +### Pipeline Flow (high-level) +```text +User → DeepSeek (via deepcli TUI / cli.py) + → core.py stream_completion() → session cache (~/.deepcli/session_store/) + → dispatch_pipeline.py (called on every cache write, via core.py hook) + → autonomous_runner.py / dispatch_task.py (sandboxed execution) + → Sentinel (5-gate verification: file integrity, naming, duplicate, probe, shockwave) + → promote.py (ascension to true_versions) + → cli-synthegration (exports, versions, branches conversation history) + → Chronos / time_loop_accelerator (success-only trunk management) + → archwiz/archivist.py (query engine over all indices) +``` + +> **Note:** `export_poller.sh` and `activity_listener.py` are legacy execution paths — the canonical code-block execution flow runs through the TUI and `core.py`'s cache-write hook (`dispatch_pipeline.py`). The poller/listener represent an earlier, now-superseded approach and should be treated as candidates for removal or archival rather than maintained in parallel. + +--- + +## How to Run (on Replit) + +Most tools **cannot run as-is** on Replit — see the Termux coupling issue below. Once that is resolved, the entry point is: + +```bash +python3 archwiz/archwiz.py # Main cockpit (TUI menu) +python3 deepcli/deepcli.py new # Start a new DeepSeek session +python3 deepcli/deepcli.py send "prompt here" +``` + +The DeepSeek integration requires a valid `ds_session_id` cookie and bearer token extracted from a browser session (see `deepcli/extract-token.js`). **Store these only in Replit Secrets or environment variables** — never commit or echo them, redact them from logs and exports, and revoke immediately if exposed. + +--- + +## Critical Issues (Must Fix) + +### 1. Termux Path Coupling — Blocks Everything +Almost all `subprocess.run(...)` calls in `archwiz/archwiz.py` use `os.path.expanduser('~/archwiz/...')`, which correctly resolves to `/home/runner/archwiz/...` on Replit. However: + +- `archwiz/archwiz.sh` has a hardcoded Termux shebang: `/data/data/com.termux/files/usr/bin/bash` +- `cli-synthegration/workspace/reference/token_provider.py:5` hardcodes `/data/data/com.termux/files/home/deepcli` +- Top-level `enforce_hierarchy.sh` is a broken symlink → `/data/data/com.termux/files/home/workspace/scripts/enforce_workspace_hierarchy.sh` +- Many top-level symlinks (e.g., `dispatch_task.py`, `agent_shell.py`, `archaeologist.py`) point into the Termux filesystem — silently broken on Replit +- Large archive files (`archwiz/pointer_inverted.json`, session logs) contain historical Termux paths — low priority but confusing + +> **Key constraint:** Pure relative paths are not a safe fix here — the tools are invoked from different working directories (cockpit, listener, dispatch, TUI), so a relative path resolves differently depending on the call site. The correct solution is an **environment-aware intermediary layer**, not relative paths. + +**Fix:** Create `archwiz/config.py` as a single source of truth for all paths, resolved at import time via an environment variable: + +```python +# archwiz/config.py (summary — see landed implementation on this branch) +import os +from pathlib import Path + +# ARCHWIZ_ENV=termux | replit | local (explicit) or auto-detect +# Detection: Termux via /data/data/com.termux; Replit via REPL_ID / REPLIT_DOMAINS / REPLIT_DB_URL; +# otherwise local. Reject unknown explicit values. +_env = os.environ.get('ARCHWIZ_ENV', '').lower() +if not _env or _env == 'auto': + if Path('/data/data/com.termux').exists(): + _env = 'termux' + elif os.environ.get('REPL_ID') or os.environ.get('REPLIT_DOMAINS') or os.environ.get('REPLIT_DB_URL'): + _env = 'replit' + else: + _env = 'local' +elif _env not in ('termux', 'replit', 'local'): + raise ValueError(f'Unknown ARCHWIZ_ENV: {_env}') + +if _env == 'termux': + ARCHWIZ_ROOT = Path('/data/data/com.termux/files/home') +else: + ARCHWIZ_ROOT = Path(os.environ.get('ARCHWIZ_HOME', Path.home())) + +ARCHWIZ_DIR = ARCHWIZ_ROOT / 'archwiz' +DEEPCLI_DIR = ARCHWIZ_ROOT / 'deepcli' +SESSION_STORE = ARCHWIZ_ROOT / '.deepcli' / 'session_store' +WORKSPACE_DIR = ARCHWIZ_ROOT / 'workspace' +``` + +All scripts import from `config.py` instead of constructing paths inline. `ARCHWIZ_ENV` overrides auto-detection for edge cases. This is portable across Termux, Replit, and local Linux without changing any call-site code. + +### 2. Silent Exception Swallowing in `core.py` +`deepcli/deepcli/core.py:58-59` has a bare `except Exception: pass` around the ArchWiz dispatch call. If the dispatch pipeline fails (missing file, import error, broken path), the failure is completely invisible. The user sees normal operation while the pipeline is dead. + +```python +# current (line ~55-59) +try: + ...dispatch... +except Exception: + pass # ← silent failure, no log, no warning +``` + +**Fix:** At minimum log to stderr: `except Exception as e: print(f"[archwiz dispatch] {e}", file=sys.stderr, flush=True)` + +### 3. Duplicate Completion Paths (`send_message` vs `stream_completion`) +`deepcli/deepcli/core.py` has two chat completion implementations. The methodology log (`archwiz/METHODOLOGY_INDEX.md`) confirms `send_message` had missing `thinking_enabled`/`search_enabled` fields causing "Update to latest version" API errors. The fix was applied but the two paths remain diverged — any future change to one may miss the other. + +**Fix:** Unify behind a single `_build_payload()` function. Both `send_message` and `stream_completion` call it. Remove the old `deepcli_old.py` and the backup `send_message_working` variant. + +### 4. Hardcoded Session ID Default +`archwiz/archwiz.py:349` has a hardcoded session UUID as the fallback: `sid = '417ddd6d-9711-465d-ab90-c92cc04aeabf'`. This is a personal session ID that will silently target a non-existent session for any new user. + +**Fix:** Remove the hardcoded default. If no `.json` files exist in the session store, prompt the user to start a session first. + +### 5. Broken Symlinks at Root +Multiple top-level symlinks are permanently broken on any non-Termux host: +```text +dispatch_task.py → /data/data/com.termux/files/home/workspace/llm_map/dispatch_task.py +agent_shell.py → /data/data/com.termux/.../agent_shell.py +archaeologist.py → /data/data/com.termux/.../archaeologist.py +enforce_hierarchy.sh → /data/data/com.termux/.../enforce_workspace_hierarchy.sh +``` + +**Fix:** Either replace symlinks with relative path symlinks (pointing into `archwiz/` or `cli-synthegration/workspace/`) or remove them and update callers to use the canonical paths. + +### 6. No Dependency Declaration *(partially resolved — see Branch Evaluations below)* +~~No `requirements.txt` exists.~~ `requirements-base.txt` and `setup.sh` now exist (landed in `mistral/fixes-config-security`). Remaining gap: `requirements-base.txt` covers only `curl-cffi`, `requests`, `websockets` — system tools (`ruff`, `ripgrep`, `fd`, `shellcheck`, `jq`, `entr`) still require manual install. `multi-ai-cli/requirements.txt` exists independently but is not reconciled with the root baseline. + +**Fix remaining:** Add system-tool installation to `setup.sh` via `nix-env` or document them in a `PREREQUISITES.md`. Reconcile `multi-ai-cli/requirements.txt` with `requirements-base.txt` — avoid two separate dependency tracks diverging silently. + +--- + +## Important Warnings + +### `.bak` File Pollution +The `archwiz/` directory contains **~25 timestamped `.bak` files** for `archwiz.py` and `live_view.py` alone (`archwiz.py.bak.1782737822`, `archwiz.py.bak.$(date +%H%M%S)`, etc.). These: +- Inflate repository size +- Make `ls` and `rg` results noisy +- One file is literally named `archwiz.py.bak.$(date +%H%M%S)` — the shell variable was never expanded + +**Recommendation:** Move all `.bak` files to a `_archive/` folder or delete them. Git history is the canonical backup mechanism. + +### commingle-swarm Is a Template / Scavenging Source +`commingle-swarm/` is a **cloned/forked external repo** kept in the monorepo as a structural reference and code-scavenging template, not a first-class project to run or maintain. It is intentionally disconnected from the rest of the monorepo. Treat it as read-only reference material — do not install its dependencies, do not wire it into the pipeline, and do not include it in health checks or index sweeps. + +--- + +## Optimization Proposals + +### A. Retire / Archive `export_poller.sh` and `activity_listener.py` +These are legacy execution paths that predate the current `core.py` cache-write hook → `dispatch_pipeline.py` flow. They duplicate work the TUI already does and introduce a second, less-reliable execution surface. The methodology log documents the pain: 4 listener lifecycle attempts, nohup ghosts, PID-file fragility. The canonical path is: `core.py stream_completion()` writes cache → `dispatch_pipeline.update_all()` → `autonomous_runner`. The listener and poller should be archived (moved to `_archive/`) once the dispatch hook is confirmed stable on Replit. + +### B. `fzf` Integration (Shelved → Resolvable) +CONSIDERATIONS.md documents why fzf was shelved: it indexed 194k files without respecting `bloat_exclusions.lst`. Resolve the exclusions file from the **stable repository root** (via `archwiz.config.ARCHWIZ_ROOT` or repo root), and **prune during traversal** rather than filtering after a full walk: + +```bash +# Example: prune excluded dirs during find (adjust paths to repo root) +EXCL="$(git rev-parse --show-toplevel)/bloat_exclusions.lst" +find "$(git rev-parse --show-toplevel)" -type d \( + $(while read -r d; do [ -n "$d" ] && printf -- '-path */%s -o ' "$d"; done < "$EXCL") -false \) -prune -o -type d -print | fzf +``` + +The keyboard issue was Termux-specific and does not apply on Replit. This is ready to implement once pruning is in place. + +### C. Real-Time Chat Feedback (ROADMAP Priority 🔴) +Do **not** add `report_back` onto legacy `activity_listener.py`. Route execution results through the **canonical** cache-write → `dispatch_pipeline.py` path using a non-dispatching message/event append with an **idempotency guard** so each result is recorded once. Avoid calling `stream_completion()` from a path that re-enters dispatch and risks recursive or duplicate reports. + +### D. ChronoMancer Branch-Routing UI (ROADMAP 🟡) +`cli-synthegration/Chronos/accelerator.py` and `versioner.py` have the data layer. What's missing is a TUI visualizer for the branch tree — a read-only `curses` (or rich-text) panel showing fork points and child session previews. + +### E. Self-Healing Sandbox (CONCEPT_INDEX: ❌ Not Built) +The full loop: Sentinel detects a failure → auto-repair attempts a fix → Probe validates → promote if clean. `auto_repair.py` handles the Sentinel REVIEW tier. The gap is the detection→dispatch→promote chain being fully automated without human `[1]` invocation. This is ~50 lines of glue in `autonomous_runner.py`. + +### F. Web Dashboard (Replit-Native Extension) +The cockpit is currently terminal-only (stdin/stdout). On Replit, a lightweight Flask/FastAPI server exposing the same 19 menu actions as REST endpoints, with a minimal HTML dashboard, would make the environment accessible from any browser — including mobile. The pipeline status, activity feed, and live metrics are natural candidates for this. + +**Security requirements before any REST implementation:** +- Bind to `127.0.0.1` only (never `0.0.0.0`) unless behind the Replit proxy +- Require a session token (env-var seeded, checked on every request via middleware) +- CSRF protection on all state-mutating endpoints (e.g., double-submit cookie or `SameSite=Strict`) +- Origin allowlist (only the Replit preview domain) +- Rate-limit all endpoints — especially `[1]` (Full Autonomous Run), which triggers heavy workloads +- Emit an audit log entry (timestamp, action, result) for every invocation; persist to `LOG_DIR` +- Least-privilege: read-only endpoints (status, feed, metrics) available without elevated scope; execution endpoints require an explicit capability flag + +### G. Expert-Mode Session Creation (ROADMAP 🟡) +Sessions created without the `thinking_enabled`/`search_enabled` fields default to non-Expert mode. The `create_session()` call in `core.py` should accept and forward these flags, and `cli.py`'s `new` command should expose `--expert / --no-expert`. + +--- + +## Extension Ideas + +| Idea | Effort | Value | +|------|--------|-------| +| Multi-account DeepSeek probing | Medium | Enables parallel task execution on account 2 | +| Cross-session idea harvester | Medium | Scan all exports for novel `#concept` tags across sessions | +| Prompt engine rotation (A/B test) | Low | Validate the CONSIDERATIONS.md prompt-phrase observations empirically | +| Commit notes scanner → CHANGES.md | Low | Auto-detect "what changed" summaries from session digests | +| Tab completion for `/sessions` | Low | Already partially designed in TUI | +| Sigil substitution engine (cedrlang) | High | Runtime compression protocol — reduces token usage | + +--- + +--- + +## Branch Evaluations + +### `mistral/fixes-config-security` — env-aware config, bridge hardening, security docs +*Author: timerloggedout-spec. 9 files, +297/−27 lines.* + +**What it does well:** +- `archwiz/config.py` — persistent JSON config at `~/.archwiz/config.json`, proper directory/file permissions (700/600), graceful corruption handling (renames to `.broken`), atomic token writes (temp-file + `os.replace`) +- `multi-ai-cli/bridge/mistral_bridge.py` — now imports from `archwiz.config`; atomic token write with secure perms +- `tools/tests/mistral_bridge_smoke.py` — smoke test that is safe (no external calls, cleans up after itself) +- `SECURITY.md` and harvester READMEs — explicit opt-in model for credential tooling +- `requirements-base.txt` + `setup.sh` — fills the missing dependency declaration gap + +**Critical gaps (fixes applied on this branch / tracked):** + +| Gap | Severity | Fix applied | +|-----|----------|-------------| +| Missing `ARCHWIZ_DIR`, `DEEPCLI_DIR`, `WORKSPACE_DIR` — the paths archwiz.py actually calls | 🔴 High | Added as `@property` on `Config` + module-level constants | +| Replit detection used `REPL_OWNER` (unreliable) | 🟡 Medium | Updated to `REPL_ID` / `REPLIT_DOMAINS` / `REPLIT_DB_URL` | +| No `archwiz/__init__.py` — `from archwiz import config` fails | 🔴 High | Created `archwiz/__init__.py` | +| `setup.sh` creates a venv — breaks on Replit (no venv support) | 🔴 High | Replaced with env-aware install: venv only for `local`, system pip for Replit/Termux | +| Module-level constants missing — callers need `from archwiz.config import ARCHWIZ_DIR` | 🟡 Medium | Added flat module-level constants as drop-in replacements | +| `multi-ai-cli/core/core.py` dispatch hook copies the silent `except: pass` bug | 🔴 High | Not yet fixed — tracked in task #3 | + +**Verdict:** Do not merge until task `#3` (silent dispatch failure) is fixed and verified. The config design is sound. The bridge hardening and security documentation are genuine improvements. + +--- + +### `vibe/mistralai-vibe-code-wrapper-6055d2` — MistralAI CLI + Codex-style code harvester +*Author: Vibe Nuage Agent / timerloggedout-spec co-authored. 22 files, +1072/−643 lines.* + +**What it does well:** +- Complete MistralAI CLI mirroring the DeepSeek/cli-synthegration pattern end-to-end +- `code_harvester.py` — content-addressable blob store (SHA256, first 16 chars), `Pointer` class, hierarchical taxonomy (`language → project → session`), dedup by hash — directly ports the cli-synthegration Codex pattern +- 31 tests passing; regex-only extraction (no BeautifulSoup dependency) +- Dispatch hook plumbed into `multi-ai-cli/core/core.py` — same pipeline integration as deepcli + +**Critical gaps:** + +| Gap | Severity | Recommendation | +|-----|----------|----------------| +| `multi-ai-cli/core/core.py` uses hardcoded `~/.mistralai-cli/` paths — ignores `archwiz/config.py` for its own storage | 🟡 Medium | Replace with `from archwiz.config import SESSION_STORE` or a parallel `MISTRALAI_SESSION_STORE` constant in config.py | +| Dispatch hook (`core.py:64-65`) is `except Exception: pass` — copies the deepcli silent-failure bug | 🔴 High | Log to stderr; tracked in task #3 | +| `multi-ai-cli/requirements.txt` is independent — not reconciled with `requirements-base.txt` | 🟡 Medium | Merge or reference from root baseline | +| `WASM_SOLVER` may be missing or resolve to an incorrect package-relative location (not a cwd-change failure) | 🟡 Medium | Resolve via `archwiz.config.DEEPCLI_DIR` or package-local path with an existence check | +| No equivalent of `archwiz/sentinel.py` or `archwiz/probe.py` for Mistral output — verification absent | 🟢 Low | Future: extend Sentinel to validate multi-ai-cli executions | + +**What to expand:** +- Add `MISTRALAI_SESSION_STORE`, `MISTRALAI_TOKENS_DIR` to `archwiz/config.py` so all AI providers share one config root +- `code_harvester.py`'s taxonomy is richer than cli-synthegration's — port the `TaxonomyNode.search()` back to the DeepSeek codex (`cli-synthegration/codex/`) +- The harvester's blob store is an ideal foundation for the **cross-session idea harvester** extension (Extension Ideas table) — add a `#concept` tag scanner on top of it + +**Verdict:** High-value addition. The Codex port is well-executed. Fix the silent dispatch hook and reconcile storage paths before merging to master. + +--- + +## User Preferences + +- Evaluate critically, propose optimizations and extensions +- Preserve existing structure and stack — do not migrate or restructure +- Check recent commits and branches before recommending changes diff --git a/requirements-base.txt b/requirements-base.txt new file mode 100644 index 0000000000..695d57ed66 --- /dev/null +++ b/requirements-base.txt @@ -0,0 +1,5 @@ +# Minimal runtime requirements (base) +# Keep this small: core libs required for parser and bridge smoke tests +curl-cffi +requests +websockets diff --git a/setup.sh b/setup.sh new file mode 100755 index 0000000000..54d7af0047 --- /dev/null +++ b/setup.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash +# setup.sh — bootstrap ArchWiz dependencies across environments. +# Supports: Replit (no venv), Termux (no venv), local Linux/macOS (venv). +set -euo pipefail + +SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" + +# ---------- Detect environment ---------- +_detect_env() { + if [ -d /data/data/com.termux ]; then + echo "termux" + elif [ -n "${REPL_ID:-}" ] || [ -n "${REPLIT_DOMAINS:-}" ] || [ -n "${REPLIT_DB_URL:-}" ]; then + echo "replit" + else + echo "local" + fi +} +ARCHWIZ_ENV="${ARCHWIZ_ENV:-$(_detect_env)}" +echo "Environment detected: $ARCHWIZ_ENV" + +# ---------- Install Python deps ---------- +case "$ARCHWIZ_ENV" in + termux) + # Termux: pkg provides ruff; install Python libs system-wide + echo "Installing Python libs (Termux)..." + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + ;; + replit) + # Replit: no venv support; install directly to the Nix/system Python. + # pip install --user is also acceptable here. + echo "Installing Python libs (Replit)..." + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + ;; + *) + # Local: use a venv to avoid polluting the system Python + echo "Installing Python libs (local venv)..." + VENV="$SCRIPT_DIR/.venv" + if [ ! -d "$VENV" ]; then + python3 -m venv "$VENV" + fi + # shellcheck source=/dev/null + source "$VENV/bin/activate" + pip install --quiet --upgrade pip + pip install --quiet -r "$SCRIPT_DIR/requirements-base.txt" + echo " Activate with: source .venv/bin/activate" + ;; +esac + +# ---------- Validate archwiz.config imports ---------- +echo "Validating archwiz.config..." +PYTHONPATH="$SCRIPT_DIR" python3 - <<'PY' +from archwiz import config as aw_config +from archwiz.config import ARCHWIZ_DIR, SESSION_STORE, MULTI_AI_TOKENS_DIR +print(f" env: {aw_config.ARCHWIZ_ENV}") +print(f" archwiz_root: {aw_config.ARCHWIZ_ROOT}") +print(f" ARCHWIZ_DIR: {ARCHWIZ_DIR}") +print(f" SESSION_STORE: {SESSION_STORE}") +print(f" TOKENS_DIR: {MULTI_AI_TOKENS_DIR}") +PY + +echo "Done." +echo "For heavy dependencies (flair, torch, watchexec, hyperfine), install them separately in an x86_64 environment." diff --git a/skills-lock.json b/skills-lock.json new file mode 100644 index 0000000000..f26dcebc10 --- /dev/null +++ b/skills-lock.json @@ -0,0 +1,11 @@ +{ + "version": 1, + "skills": { + "find-skills": { + "source": "vercel-labs/skills", + "sourceType": "github", + "skillPath": "skills/find-skills/SKILL.md", + "computedHash": "c00eeea0e13e74fe4a9d84ba0a8542205a1b736d65f13134fe1a6647eb14976f" + } + } +}