Initial commit

Co-Authored-By: Nellie Mullane <nellie@keygraph.io>
2025-10-03 19:35:08 -07:00
commit 8f52722d56
69 changed files with 16062 additions and 0 deletions
@@ -0,0 +1,195 @@
+import { $ } from 'zx';
+import chalk from 'chalk';
+
+// Global git operations semaphore to prevent index.lock conflicts during parallel execution
+class GitSemaphore {
+  constructor() {
+    this.queue = [];
+    this.running = false;
+  }
+
+  async acquire() {
+    return new Promise((resolve) => {
+      this.queue.push(resolve);
+      this.process();
+    });
+  }
+
+  release() {
+    this.running = false;
+    this.process();
+  }
+
+  process() {
+    if (!this.running && this.queue.length > 0) {
+      this.running = true;
+      const resolve = this.queue.shift();
+      resolve();
+    }
+  }
+}
+
+const gitSemaphore = new GitSemaphore();
+
+// Execute git commands with retry logic for index.lock conflicts
+export const executeGitCommandWithRetry = async (commandArgs, sourceDir, description, maxRetries = 5) => {
+  await gitSemaphore.acquire();
+
+  try {
+    for (let attempt = 1; attempt <= maxRetries; attempt++) {
+      try {
+        // Handle both array and string commands
+        let result;
+        if (Array.isArray(commandArgs)) {
+          // For arrays like ['git', 'status', '--porcelain'], execute parts separately
+          const [cmd, ...args] = commandArgs;
+          result = await $`cd ${sourceDir} && ${cmd} ${args}`;
+        } else {
+          // For string commands
+          result = await $`cd ${sourceDir} && ${commandArgs}`;
+        }
+        return result;
+      } catch (error) {
+        const isLockError = error.message.includes('index.lock') ||
+                           error.message.includes('unable to lock') ||
+                           error.message.includes('Another git process') ||
+                           error.message.includes('fatal: Unable to create') ||
+                           error.message.includes('fatal: index file');
+
+        if (isLockError && attempt < maxRetries) {
+          const delay = Math.pow(2, attempt - 1) * 1000; // Exponential backoff: 1s, 2s, 4s, 8s, 16s
+          console.log(chalk.yellow(`    ⚠️ Git lock conflict during ${description} (attempt ${attempt}/${maxRetries}). Retrying in ${delay}ms...`));
+          await new Promise(resolve => setTimeout(resolve, delay));
+          continue;
+        }
+
+        throw error;
+      }
+    }
+  } finally {
+    gitSemaphore.release();
+  }
+};
+
+// Pure functions for Git workspace management
+export const cleanWorkspace = async (sourceDir, reason = 'clean start') => {
+  console.log(chalk.blue(`    🧹 Cleaning workspace for ${reason}`));
+  try {
+    // Check for uncommitted changes
+    const status = await $`cd ${sourceDir} && git status --porcelain`;
+    const hasChanges = status.stdout.trim().length > 0;
+
+    if (hasChanges) {
+      // Show what we're about to remove
+      const changes = status.stdout.trim().split('\n').filter(line => line.length > 0);
+      console.log(chalk.yellow(`    🔄 Rolling back workspace for ${reason}`));
+
+      await $`cd ${sourceDir} && git reset --hard HEAD`;
+      await $`cd ${sourceDir} && git clean -fd`;
+
+      console.log(chalk.yellow(`    ✅ Rollback completed - removed ${changes.length} contaminated changes:`));
+      changes.slice(0, 3).forEach(change => console.log(chalk.gray(`       ${change}`)));
+      if (changes.length > 3) {
+        console.log(chalk.gray(`       ... and ${changes.length - 3} more files`));
+      }
+    } else {
+      console.log(chalk.blue(`    ✅ Workspace already clean (no changes to remove)`));
+    }
+    return { success: true, hadChanges: hasChanges };
+  } catch (error) {
+    console.log(chalk.yellow(`    ⚠️ Workspace cleanup failed: ${error.message}`));
+    return { success: false, error };
+  }
+};
+
+export const createGitCheckpoint = async (sourceDir, description, attempt) => {
+  console.log(chalk.blue(`    📍 Creating checkpoint for ${description} (attempt ${attempt})`));
+  try {
+    // Only clean workspace on retry attempts (attempt > 1), not on first attempts
+    // This preserves deliverables between agents while still cleaning on actual retries
+    if (attempt > 1) {
+      const cleanResult = await cleanWorkspace(sourceDir, `${description} (retry cleanup)`);
+      if (!cleanResult.success) {
+        console.log(chalk.yellow(`    ⚠️ Workspace cleanup failed, continuing anyway: ${cleanResult.error.message}`));
+      }
+    }
+
+    // Check for uncommitted changes with retry logic
+    const status = await executeGitCommandWithRetry(['git', 'status', '--porcelain'], sourceDir, 'status check');
+    const hasChanges = status.stdout.trim().length > 0;
+
+    // Stage changes with retry logic
+    await executeGitCommandWithRetry(['git', 'add', '-A'], sourceDir, 'staging changes');
+
+    // Create commit with retry logic
+    await executeGitCommandWithRetry(['git', 'commit', '-m', `📍 Checkpoint: ${description} (attempt ${attempt})`, '--allow-empty'], sourceDir, 'creating commit');
+
+    if (hasChanges) {
+      console.log(chalk.blue(`    ✅ Checkpoint created with uncommitted changes staged`));
+    } else {
+      console.log(chalk.blue(`    ✅ Empty checkpoint created (no workspace changes)`));
+    }
+    return { success: true };
+  } catch (error) {
+    console.log(chalk.yellow(`    ⚠️ Checkpoint creation failed after retries: ${error.message}`));
+    return { success: false, error };
+  }
+};
+
+export const commitGitSuccess = async (sourceDir, description) => {
+  console.log(chalk.green(`    💾 Committing successful results for ${description}`));
+  try {
+    // Check what we're about to commit with retry logic
+    const status = await executeGitCommandWithRetry(['git', 'status', '--porcelain'], sourceDir, 'status check for success commit');
+    const changes = status.stdout.trim().split('\n').filter(line => line.length > 0);
+
+    // Stage changes with retry logic
+    await executeGitCommandWithRetry(['git', 'add', '-A'], sourceDir, 'staging changes for success commit');
+
+    // Create success commit with retry logic
+    await executeGitCommandWithRetry(['git', 'commit', '-m', `✅ ${description}: completed successfully`, '--allow-empty'], sourceDir, 'creating success commit');
+
+    if (changes.length > 0) {
+      console.log(chalk.green(`    ✅ Success commit created with ${changes.length} file changes:`));
+      changes.slice(0, 5).forEach(change => console.log(chalk.gray(`       ${change}`)));
+      if (changes.length > 5) {
+        console.log(chalk.gray(`       ... and ${changes.length - 5} more files`));
+      }
+    } else {
+      console.log(chalk.green(`    ✅ Empty success commit created (agent made no file changes)`));
+    }
+    return { success: true };
+  } catch (error) {
+    console.log(chalk.yellow(`    ⚠️ Success commit failed after retries: ${error.message}`));
+    return { success: false, error };
+  }
+};
+
+export const rollbackGitWorkspace = async (sourceDir, reason = 'retry preparation') => {
+  console.log(chalk.yellow(`    🔄 Rolling back workspace for ${reason}`));
+  try {
+    // Show what we're about to remove with retry logic
+    const status = await executeGitCommandWithRetry(['git', 'status', '--porcelain'], sourceDir, 'status check for rollback');
+    const changes = status.stdout.trim().split('\n').filter(line => line.length > 0);
+
+    // Reset to HEAD with retry logic
+    await executeGitCommandWithRetry(['git', 'reset', '--hard', 'HEAD'], sourceDir, 'hard reset for rollback');
+
+    // Clean untracked files with retry logic
+    await executeGitCommandWithRetry(['git', 'clean', '-fd'], sourceDir, 'cleaning untracked files for rollback');
+
+    if (changes.length > 0) {
+      console.log(chalk.yellow(`    ✅ Rollback completed - removed ${changes.length} contaminated changes:`));
+      changes.slice(0, 3).forEach(change => console.log(chalk.gray(`       ${change}`)));
+      if (changes.length > 3) {
+        console.log(chalk.gray(`       ... and ${changes.length - 3} more files`));
+      }
+    } else {
+      console.log(chalk.yellow(`    ✅ Rollback completed - no changes to remove`));
+    }
+    return { success: true };
+  } catch (error) {
+    console.log(chalk.red(`    ❌ Rollback failed after retries: ${error.message}`));
+    return { success: false, error };
+  }
+};
@@ -0,0 +1,104 @@
+import chalk from 'chalk';
+
+// Timing utilities
+export const formatDuration = (ms) => {
+  if (ms < 1000) return `${ms}ms`;
+  if (ms < 60000) return `${(ms / 1000).toFixed(1)}s`;
+  const minutes = Math.floor(ms / 60000);
+  const seconds = Math.floor((ms % 60000) / 1000);
+  return `${minutes}m ${seconds}s`;
+};
+
+export class Timer {
+  constructor(name) {
+    this.name = name;
+    this.startTime = Date.now();
+    this.endTime = null;
+  }
+
+  stop() {
+    this.endTime = Date.now();
+    return this.duration();
+  }
+
+  duration() {
+    const end = this.endTime || Date.now();
+    return end - this.startTime;
+  }
+}
+
+// Global timing and cost tracker
+export const timingResults = {
+  total: null,
+  phases: {},
+  commands: {},
+  agents: {}
+};
+
+export const costResults = {
+  agents: {},
+  total: 0
+};
+
+// Function to display comprehensive timing summary
+export const displayTimingSummary = () => {
+  const totalDuration = timingResults.total.stop();
+
+  console.log(chalk.cyan.bold('\n⏱️  TIMING SUMMARY'));
+  console.log(chalk.gray('─'.repeat(60)));
+
+  // Total execution time
+  console.log(chalk.cyan(`📊 Total Execution Time: ${formatDuration(totalDuration)}`));
+  console.log();
+
+  // Phase breakdown
+  if (Object.keys(timingResults.phases).length > 0) {
+    console.log(chalk.yellow.bold('🔍 Phase Breakdown:'));
+    let phaseTotal = 0;
+    for (const [phase, duration] of Object.entries(timingResults.phases)) {
+      const percentage = ((duration / totalDuration) * 100).toFixed(1);
+      console.log(chalk.yellow(`  ${phase.padEnd(20)} ${formatDuration(duration).padStart(8)} (${percentage}%)`));
+      phaseTotal += duration;
+    }
+    console.log(chalk.gray(`  ${'Phases Total'.padEnd(20)} ${formatDuration(phaseTotal).padStart(8)} (${((phaseTotal / totalDuration) * 100).toFixed(1)}%)`));
+    console.log();
+  }
+
+  // Command breakdown
+  if (Object.keys(timingResults.commands).length > 0) {
+    console.log(chalk.blue.bold('🖥️  Command Breakdown:'));
+    let commandTotal = 0;
+    for (const [command, duration] of Object.entries(timingResults.commands)) {
+      const percentage = ((duration / totalDuration) * 100).toFixed(1);
+      console.log(chalk.blue(`  ${command.padEnd(20)} ${formatDuration(duration).padStart(8)} (${percentage}%)`));
+      commandTotal += duration;
+    }
+    console.log(chalk.gray(`  ${'Commands Total'.padEnd(20)} ${formatDuration(commandTotal).padStart(8)} (${((commandTotal / totalDuration) * 100).toFixed(1)}%)`));
+    console.log();
+  }
+
+  // Agent breakdown
+  if (Object.keys(timingResults.agents).length > 0) {
+    console.log(chalk.magenta.bold('🤖 Agent Breakdown:'));
+    let agentTotal = 0;
+    for (const [agent, duration] of Object.entries(timingResults.agents)) {
+      const percentage = ((duration / totalDuration) * 100).toFixed(1);
+      const displayName = agent.replace(/-/g, ' ');
+      console.log(chalk.magenta(`  ${displayName.padEnd(20)} ${formatDuration(duration).padStart(8)} (${percentage}%)`));
+      agentTotal += duration;
+    }
+    console.log(chalk.gray(`  ${'Agents Total'.padEnd(20)} ${formatDuration(agentTotal).padStart(8)} (${((agentTotal / totalDuration) * 100).toFixed(1)}%)`));
+  }
+
+  // Cost breakdown
+  if (Object.keys(costResults.agents).length > 0) {
+    console.log(chalk.green.bold('\n💰 Cost Breakdown:'));
+    for (const [agent, cost] of Object.entries(costResults.agents)) {
+      const displayName = agent.replace(/-/g, ' ');
+      console.log(chalk.green(`  ${displayName.padEnd(20)} $${cost.toFixed(4).padStart(8)}`));
+    }
+    console.log(chalk.gray(`  ${'Total Cost'.padEnd(20)} $${costResults.total.toFixed(4).padStart(8)}`));
+  }
+
+  console.log(chalk.gray('─'.repeat(60)));
+};
@@ -0,0 +1,238 @@
+import { AGENTS } from '../session-manager.js';
+
+/**
+ * Extract domain from URL for display
+ */
+function extractDomain(url) {
+  try {
+    const urlObj = new URL(url);
+    return urlObj.hostname || url.slice(0, 30);
+  } catch {
+    return url.slice(0, 30);
+  }
+}
+
+/**
+ * Summarize TodoWrite updates into clean progress indicators
+ */
+function summarizeTodoUpdate(input) {
+  if (!input?.todos || !Array.isArray(input.todos)) {
+    return null;
+  }
+
+  const todos = input.todos;
+  const completed = todos.filter(t => t.status === 'completed');
+  const inProgress = todos.filter(t => t.status === 'in_progress');
+
+  // Show recently completed tasks
+  if (completed.length > 0) {
+    const recent = completed[completed.length - 1];
+    return `✅ ${recent.content}`;
+  }
+
+  // Show current in-progress task
+  if (inProgress.length > 0) {
+    const current = inProgress[0];
+    return `🔄 ${current.content}`;
+  }
+
+  return null;
+}
+
+/**
+ * Get agent prefix for parallel execution
+ */
+export function getAgentPrefix(description) {
+  // Map agent names to their prefixes
+  const agentPrefixes = {
+    'injection-vuln': '[SQLi/Cmd]',
+    'xss-vuln': '[XSS]',
+    'auth-vuln': '[Auth]',
+    'authz-vuln': '[Authz]',
+    'ssrf-vuln': '[SSRF]',
+    'injection-exploit': '[SQLi/Cmd]',
+    'xss-exploit': '[XSS]',
+    'auth-exploit': '[Auth]',
+    'authz-exploit': '[Authz]',
+    'ssrf-exploit': '[SSRF]'
+  };
+
+  // First try to match by agent name directly
+  for (const [agentName, prefix] of Object.entries(agentPrefixes)) {
+    if (AGENTS[agentName] && description.includes(AGENTS[agentName].displayName)) {
+      return prefix;
+    }
+  }
+
+  // Fallback to partial matches for backwards compatibility
+  if (description.includes('injection')) return '[SQLi/Cmd]';
+  if (description.includes('xss')) return '[XSS]';
+  if (description.includes('authz')) return '[Authz]';  // Check authz before auth
+  if (description.includes('auth')) return '[Auth]';
+  if (description.includes('ssrf')) return '[SSRF]';
+
+  return '[Agent]';
+}
+
+/**
+ * Format browser tool calls into clean progress indicators
+ */
+function formatBrowserAction(toolCall) {
+  const toolName = toolCall.name;
+  const input = toolCall.input || {};
+
+  // Core Browser Operations
+  if (toolName === 'mcp__playwright__browser_navigate') {
+    const url = input.url || '';
+    const domain = extractDomain(url);
+    return `🌐 Navigating to ${domain}`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_navigate_back') {
+    return `⬅️ Going back`;
+  }
+
+  // Page Interaction
+  if (toolName === 'mcp__playwright__browser_click') {
+    const element = input.element || 'element';
+    return `🖱️ Clicking ${element.slice(0, 25)}`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_hover') {
+    const element = input.element || 'element';
+    return `👆 Hovering over ${element.slice(0, 20)}`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_type') {
+    const element = input.element || 'field';
+    return `⌨️ Typing in ${element.slice(0, 20)}`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_press_key') {
+    const key = input.key || 'key';
+    return `⌨️ Pressing ${key}`;
+  }
+
+  // Form Handling
+  if (toolName === 'mcp__playwright__browser_fill_form') {
+    const fieldCount = input.fields?.length || 0;
+    return `📝 Filling ${fieldCount} form fields`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_select_option') {
+    return `📋 Selecting dropdown option`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_file_upload') {
+    return `📁 Uploading file`;
+  }
+
+  // Page Analysis
+  if (toolName === 'mcp__playwright__browser_snapshot') {
+    return `📸 Taking page snapshot`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_take_screenshot') {
+    return `📸 Taking screenshot`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_evaluate') {
+    return `🔍 Running JavaScript analysis`;
+  }
+
+  // Waiting & Monitoring
+  if (toolName === 'mcp__playwright__browser_wait_for') {
+    if (input.text) {
+      return `⏳ Waiting for "${input.text.slice(0, 20)}"`;
+    }
+    return `⏳ Waiting for page response`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_console_messages') {
+    return `📜 Checking console logs`;
+  }
+
+  if (toolName === 'mcp__playwright__browser_network_requests') {
+    return `🌐 Analyzing network traffic`;
+  }
+
+  // Tab Management
+  if (toolName === 'mcp__playwright__browser_tabs') {
+    const action = input.action || 'managing';
+    return `🗂️ ${action} browser tab`;
+  }
+
+  // Dialog Handling
+  if (toolName === 'mcp__playwright__browser_handle_dialog') {
+    return `💬 Handling browser dialog`;
+  }
+
+  // Fallback for any missed tools
+  const actionType = toolName.split('_').pop();
+  return `🌐 Browser: ${actionType}`;
+}
+
+/**
+ * Filter out JSON tool calls from content, with special handling for Task calls
+ */
+export function filterJsonToolCalls(content) {
+  if (!content || typeof content !== 'string') {
+    return content;
+  }
+
+  const lines = content.split('\n');
+  const processedLines = [];
+
+  for (const line of lines) {
+    const trimmed = line.trim();
+
+    // Skip empty lines
+    if (trimmed === '') {
+      continue;
+    }
+
+    // Check if this is a JSON tool call
+    if (trimmed.startsWith('{"type":"tool_use"')) {
+      try {
+        const toolCall = JSON.parse(trimmed);
+
+        // Special handling for Task tool calls
+        if (toolCall.name === 'Task') {
+          const description = toolCall.input?.description || 'analysis agent';
+          processedLines.push(`🚀 Launching ${description}`);
+          continue;
+        }
+
+        // Special handling for TodoWrite tool calls
+        if (toolCall.name === 'TodoWrite') {
+          const summary = summarizeTodoUpdate(toolCall.input);
+          if (summary) {
+            processedLines.push(summary);
+          }
+          continue;
+        }
+
+        // Special handling for browser tool calls
+        if (toolCall.name.startsWith('mcp__playwright__browser_')) {
+          const browserAction = formatBrowserAction(toolCall);
+          if (browserAction) {
+            processedLines.push(browserAction);
+          }
+          continue;
+        }
+
+        // Hide all other tool calls (Read, Write, Grep, etc.)
+        continue;
+
+      } catch (error) {
+        // If JSON parsing fails, treat as regular text
+        processedLines.push(line);
+      }
+    } else {
+      // Keep non-JSON lines (assistant text)
+      processedLines.push(line);
+    }
+  }
+
+  return processedLines.join('\n');
+}