CoStrict Documentation

repository·main·Indexed 26 days ago

https://github.com/zgsm-ai/costrict

An open-source, enterprise-focused AI coding assistant for secure and standardized development workflows. Features include 'Strict Mode' for controlled code generation, RAG-based repository-wide code reviews, a CLI (roo/cos) with interactive TUI and programmatic modes, and an IPC client (@roo-code/ipc) for socket-based communication with the extension.

Tokens
48.9K
Snippets
75
Records
354
Agent score
88%

What's inside CoStrict

  1. Overview of Evals System Components

    main

    The architecture is composed of several specialized components:

    • Next.js Web Application: The management interface for creating runs, monitoring progress via Server-Sent Events (SSE), and viewing the results dashboard.
    • Controller Container: An orchestrator (based on evals-runner) that manages an in-memory task queue using p-queue, prepares Git workspaces, and coordinates runner containers.
    • Runner Containers: Isolated environments that execute single tasks. They include a fresh VS Code instance, pre-installed language runtimes (Go, Java, JavaScript, Python, Rust), and the Roo Code extension.
    • Redis: Used for pub/sub messaging, runner registration tracking, and heartbeat monitoring (Note: it is not used for task queuing).
    • PostgreSQL: The primary database for storing run configurations, task definitions, metrics, and results.
  2. Overview of CoStrict

    main

    CoStrict is an open-source AI-assisted programming tool designed for enterprise-level development. It supports private deployment and focuses on standardized, secure, and high-quality AI development workflows.

    Core Capabilities:

    • Strict Mode: Standardized AI code generation including requirement analysis, architecture design, task planning, and test generation.
    • Code Review: Repository-wide RAG-based analysis using multi-expert model cross-verification.
    • Code Completion: Context-aware code generation.
    • MCP Integration: Supports connecting to APIs, databases, and custom tools via Model Context Protocol.
    • Multimodal Support: Supports image uploads and visual context.
    • Extensible Skills: A system for specialized task workflows.
  3. Overview of CoStrict Core Capabilities

    main

    CoStrict is an enterprise-grade AI coding assistant providing the following core features:

    • Strict Mode: Standardized AI code generation involving requirements analysis, architecture design, task planning, and test generation.
    • Code Review: Repository-wide RAG-based analysis using multi-expert model verification.
    • Code Completion: Context-aware generation.
    • Vibe Code: Rapid development via natural language dialogue.
    • MCP Integration: Connectivity for APIs, databases, and custom tools via Model Context Protocol.
    • Multi-modal Support: Ability to process image context and visual inputs.
    • Skills Support: An extensible system for specialized task workflows.
  4. Review Roo Code Cloud Terms of Service

    main

    The Roo Code Cloud Terms of Service govern the use of Roo Code software and services. By clicking "Sign Up", "I agree", or otherwise indicating assent, or by accessing/using any Software, you enter into a legally binding agreement with Roo Code, Inc.

    Key aspects include:

    • Agreement Scope: Includes the Data Processing Addendum, Privacy Policy, and any applicable Entity Agreement.
    • Limited License: Users are granted a limited, revocable, non-exclusive, non-sublicensable, and non-transferable license to use the Software for purposes specified in an Order Form.
    • No Reliance: Users should not rely on promises of future functionality or features.
    • Data Privacy: Users in Europe (EEA, UK, Switzerland) are subject to specific privacy acknowledgments. For users outside Europe, the agreement includes the Roo Code Data Protection Notice.
  5. Understand Evals System Operational Characteristics

    main

    The Evals system is designed with three primary operational pillars to ensure scalable and reliable AI coding capability evaluations:

    Performance

    • Task Isolation: Each task runs in a completely isolated environment to prevent interference.
    • Parallel Execution: Supports configurable concurrency to maximize resource utilization.
    • Efficient Communication: Uses Unix sockets and Redis for low-latency messaging.
    • Resource Cleanup: Automatically terminates containers to prevent resource leaks.

    Reliability

    • Fault Tolerance: Failures in individual tasks do not impact the rest of the execution.
    • Timeout Management: Prevents hung tasks from consuming resources indefinitely.
    • Health Monitoring: Uses controller heartbeats and runner registration tracking.
    • Graceful Shutdown: Ensures proper cleanup of containers and database connections.

    Observability

    • Real-time Monitoring: Live progress tracking via a web interface.
    • Comprehensive Logging: Detailed execution logs for debugging.
    • Metrics Collection: Provides performance and cost analytics.
    • Event Auditing: Tracks the complete task lifecycle.
  6. Understand CoStrict Data Handling and Transmission

    main

    CoStrict's data handling depends on your configuration:

    Data TypeDestination / Handling
    Code & FilesSent to your chosen AI provider (e.g., OpenAI, Anthropic) for processing. If using CoStrict Cloud (proxy mode), code transits CoStrict servers only to be forwarded and is deleted immediately after.
    CommandsExecuted locally. Relevant code/context from commands is sent to your chosen AI provider for AI-powered features.
    Prompts & AI RequestsSent to your chosen AI provider. If using CoStrict Cloud (proxy mode), prompts transit CoStrict servers only for forwarding and are not stored.
    API Keys & CredentialsStored locally on your device only. They are never sent to CoStrict or third parties, except to the provider you have chosen.
    Marketplace RequestsSecure API calls are made to CoStrict's backend to retrieve Model Configuration Profiles (MCPs) or Custom Modes. Only query parameters (e.g., search terms) are sent.
    TelemetryAnonymous usage and error data sent to PostHog.
  7. Understand Roo Code Cloud Indemnification and Liability

    main

    The Roo Code Cloud Terms of Service outline the indemnification responsibilities and limitations of liability for both the User and Roo Code.

    Indemnification

    • By User: Users must defend and indemnify Roo Code against claims arising from User Data, breaches of the agreement, or gross negligence/willful misconduct by the User.
    • By Roo Code: Roo Code indemnifies Users against third-party claims that the Software (excluding Third Party Materials) infringes on US patents, copyrights, or trade secrets, provided the User gives prompt written notice and allows Roo Code sole control of the defense.

    Limitations of Liability

    • Direct Damages: Roo Code's total aggregate liability is limited to the greater of $100 USD or the fees paid by the User in the 12 months preceding the event.
    • Consequential Damages: Roo Code is not liable for indirect, incidental, special, punitive, or consequential damages, including loss of data, revenue, or profits.
  8. Use Roo Code to support organic AI adoption

    main

    Roo Code facilitates organic adoption by providing internal influencers with repeatable and reviewable outcomes. Unlike theoretical best practices, Roo Code allows influencers to demonstrate real, reproducible workflows in demo forums using explicit artifacts:

    • Diffs: Showing exact code changes.
    • Test Output: Demonstrating successful validation.
    • Execution Trails: Providing a clear record of what was attempted, including failure modes.

    This makes it easier for influencers to share exactly what worked (and what didn't) with their peers.

  9. Add support for a new programming language

    main

    To introduce a completely new language to the Roo Code evals system, you must update multiple components:

    1. Update Language Configuration: Add the language name to the exerciseLanguages array in packages/evals/src/exercises/index.ts.
    2. Create Language Prompt: Create prompts/{language}.md in the evals repository. This prompt should instruct the AI to complete the exercise and specify the {test-command} used to verify correctness.
    3. Update Docker Configuration: Modify packages/evals/Dockerfile.runner to include the necessary runtime and dependencies for the new language.
    4. Update Test Runner Integration: If the language uses a non-standard testing framework, update packages/evals/src/cli/runUnitTest.ts to handle it.
    5. Seed Exercises: Create 2-3 initial exercises using the standard exercise structure to validate the setup.
  10. Mitigate risks of prototype-first development

    main

    While prototype-first workflows increase velocity, they introduce specific failure modes that require mitigation:

    • Scope Creep: Without an initial constraint document, prototypes can drift.
      • Mitigation: Use a lightweight one-page brief that states the problem, success criteria, and hard boundaries to anchor scope.
    • Lost Rationale: Losing the 'why' behind decisions can damage institutional memory.
      • Mitigation: Use lightweight decision records such as ADRs (Architecture Decision Records), RFC-style docs, structured commit messages, or task logs generated by tools like Roo Code.
    • Stakeholder Whiplash: Stakeholders may lack trust without a polished plan.
      • Mitigation: Align stakeholders around working software they can touch and interact with, rather than abstract documents.
  11. Write the Commit Body

    main

    The Body is an optional detailed description of the commit. It should be written in the present tense and must explain the motivation for the change and how it differs from previous versions.

    Safari 15.4+ enforces stricter CORS policies for localStorage access,
    causing intermittent auth failures. Added retry logic for token refresh.