woods 1.6.4 → 2.0.0.beta1

data/lib/woods/console/adapters/job_adapter.rb

@@ -1,74 +0,0 @@
-# frozen_string_literal: true
-
-module Woods
-  module Console
-    module Adapters
-      # Base class for job backend adapters.
-      #
-      # Subclasses implement `self.available?` and a private `prefix` method.
-      # The prefix is used to build bridge tool names (e.g., "sidekiq_queue_stats").
-      #
-      # @example
-      #   class MyAdapter < JobAdapter
-      #     def self.available? = !!defined?(::MyQueue)
-      #     private
-      #     def prefix = 'my_queue'
-      #   end
-      #
-      class JobAdapter
-        # Get queue statistics (sizes, latencies).
-        #
-        # @return [Hash] Bridge request
-        def queue_stats
-          { tool: "#{prefix}_queue_stats", params: {} }
-        end
-
-        # List recent job failures.
-        #
-        # @param limit [Integer] Max failures (default: 10, max: 100)
-        # @return [Hash] Bridge request
-        def recent_failures(limit: 10)
-          limit = [limit, 100].min
-          { tool: "#{prefix}_recent_failures", params: { limit: limit } }
-        end
-
-        # Find a job by its ID.
-        #
-        # A nil id is dropped from the bridge request so downstream tools see
-        # a missing parameter rather than an explicit `nil` — symmetric with
-        # `CacheAdapter.stats(namespace: nil)`.
-        #
-        # @param id [Object, nil] Job ID
-        # @return [Hash] Bridge request
-        def find_job(id:)
-          { tool: "#{prefix}_find_job", params: { id: id }.compact }
-        end
-
-        # List scheduled jobs.
-        #
-        # @param limit [Integer] Max jobs (default: 20, max: 100)
-        # @return [Hash] Bridge request
-        def scheduled_jobs(limit: 20)
-          limit = [limit, 100].min
-          { tool: "#{prefix}_scheduled_jobs", params: { limit: limit } }
-        end
-
-        # Retry a failed job.
-        #
-        # A nil id is dropped from the bridge request — see #find_job.
-        #
-        # @param id [Object, nil] Job ID
-        # @return [Hash] Bridge request
-        def retry_job(id:)
-          { tool: "#{prefix}_retry_job", params: { id: id }.compact }
-        end
-
-        private
-
-        def prefix
-          raise NotImplementedError, "#{self.class}#prefix must be implemented"
-        end
-      end
-    end
-  end
-end

data/lib/woods/console/adapters/sidekiq_adapter.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'job_adapter'
-
-module Woods
-  module Console
-    module Adapters
-      # Job backend adapter for Sidekiq.
-      #
-      # Builds bridge requests for Sidekiq queue stats, failure listing,
-      # job lookup, scheduled jobs, and retry operations.
-      #
-      # @example
-      #   adapter = SidekiqAdapter.new
-      #   adapter.queue_stats  # => { tool: 'sidekiq_queue_stats', params: {} }
-      #
-      class SidekiqAdapter < JobAdapter
-        # Check if Sidekiq is available in the current environment.
-        #
-        # @return [Boolean]
-        def self.available?
-          !!defined?(::Sidekiq)
-        end
-
-        private
-
-        def prefix
-          'sidekiq'
-        end
-      end
-    end
-  end
-end

data/lib/woods/console/adapters/solid_queue_adapter.rb

@@ -1,33 +0,0 @@
-# frozen_string_literal: true
-
-require_relative 'job_adapter'
-
-module Woods
-  module Console
-    module Adapters
-      # Job backend adapter for Solid Queue.
-      #
-      # Builds bridge requests for Solid Queue job stats, failure listing,
-      # job lookup, scheduled jobs, and retry operations.
-      #
-      # @example
-      #   adapter = SolidQueueAdapter.new
-      #   adapter.queue_stats  # => { tool: 'solid_queue_queue_stats', params: {} }
-      #
-      class SolidQueueAdapter < JobAdapter
-        # Check if Solid Queue is available in the current environment.
-        #
-        # @return [Boolean]
-        def self.available?
-          !!defined?(::SolidQueue)
-        end
-
-        private
-
-        def prefix
-          'solid_queue'
-        end
-      end
-    end
-  end
-end

data/lib/woods/console/bridge.rb

@@ -1,210 +0,0 @@
-# frozen_string_literal: true
-
-require 'json'
-require_relative 'bridge_protocol'
-require_relative 'model_validator'
-require_relative 'safe_context'
-
-module Woods
-  module Console
-    # **PROTOCOL SCAFFOLD — does not execute real queries.** Every handler
-    # below returns static empty data (`{ 'count' => 0 }`, `{ 'records' =>
-    # [] }`, etc.). Real in-process execution lives in
-    # {Woods::Console::EmbeddedExecutor}; the eventual real bridge process
-    # for Option D will replace this scaffold with a class that performs
-    # actual ActiveRecord queries.
-    #
-    # The scaffold pins the JSON-lines wire protocol — request envelope,
-    # response envelope, supported-tools list, error shape — so other
-    # components (EmbeddedExecutor, ConnectionManager, Server) can be
-    # built and tested against a stable contract before the real
-    # bridge-process implementation lands. Treat this class the way you'd
-    # treat a Sinatra fake of a third-party API in tests: it satisfies
-    # the protocol, nothing more.
-    #
-    # ## Why the name carries "Stub"
-    #
-    # Round-1 audit Track H-4 flagged this class as a "critical SafeContext
-    # bypass" because `handle_request` doesn't wrap calls in `SafeContext`.
-    # That finding wasn't exploitable — no live code path executes through
-    # this class in the shipped gem — but the bare name `Bridge` made the
-    # scaffold status invisible to auditors. The `Stub` prefix removes the
-    # ambiguity. When the real bridge-process implementation is delivered,
-    # it should claim the `Bridge` name; this class will either be deleted
-    # (if the protocol is fully owned by the real bridge) or renamed to
-    # `BridgeProtocol` and reduced to a constants module.
-    #
-    # ## Protocol
-    #
-    # Reads JSON-lines requests from an input IO, validates model/column names,
-    # dispatches to (stub) tool handlers, and writes JSON-lines responses to
-    # an output IO.
-    #
-    # Protocol:
-    #   Request:  {"id":"req_1","tool":"count","params":{"model":"Order","scope":{"status":"pending"}}}
-    #   Response: {"id":"req_1","ok":true,"result":{"count":1847},"timing_ms":12.3}
-    #   Error:    {"id":"req_1","ok":false,"error":"Model not found","error_type":"validation"}
-    #
-    # @example Wiring against a fake input/output (testing only — handlers return empty data)
-    #   bridge = StubBridge.new(input: $stdin, output: $stdout,
-    #                           model_validator: validator, safe_context: ctx)
-    #   bridge.run
-    #
-    class StubBridge
-      # Protocol constants live on {BridgeProtocol} so the real executor
-      # (EmbeddedExecutor) and a future real bridge-process class can
-      # reference them without importing the scaffold. These top-level
-      # aliases keep `StubBridge::SUPPORTED_TOOLS` working for existing
-      # callers and specs.
-      SUPPORTED_TOOLS = BridgeProtocol::SUPPORTED_TOOLS
-      TIER1_TOOLS     = BridgeProtocol::TIER1_TOOLS
-      TOOL_HANDLERS   = BridgeProtocol::TOOL_HANDLERS
-
-      # @param input [IO] Input stream (reads JSON-lines)
-      # @param output [IO] Output stream (writes JSON-lines)
-      # @param model_validator [ModelValidator] Validates model/column names
-      # @param safe_context [SafeContext] Wraps execution in safe transaction
-      def initialize(input:, output:, model_validator:, safe_context:)
-        @input = input
-        @output = output
-        @model_validator = model_validator
-        @safe_context = safe_context
-      end
-
-      # Read loop — processes requests until input is closed.
-      #
-      # @return [void]
-      def run
-        @input.each_line do |line|
-          line = line.strip
-          next if line.empty?
-
-          request = parse_request(line)
-          next unless request
-
-          response = handle_request(request)
-          write_response(response)
-        end
-      end
-
-      # Process a single request hash and return a response hash.
-      #
-      # @param request [Hash] Parsed request with "id", "tool", "params"
-      # @return [Hash] Response with "id", "ok", and "result" or "error"
-      def handle_request(request)
-        id = request['id']
-        tool = request['tool']
-        params = request['params'] || {}
-
-        return error_response(id, "Unknown tool: #{tool}", 'unknown_tool') unless SUPPORTED_TOOLS.include?(tool)
-
-        start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
-        result = dispatch(tool, params)
-        elapsed = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
-
-        { 'id' => id, 'ok' => true, 'result' => result, 'timing_ms' => elapsed }
-      rescue ValidationError => e
-        error_response(id, e.message, 'validation')
-      rescue StandardError => e
-        error_response(id, e.message, 'execution')
-      end
-
-      private
-
-      # Parse a JSON line into a request hash.
-      #
-      # @param line [String] Raw JSON line
-      # @return [Hash, nil] Parsed request or nil on parse error
-      def parse_request(line)
-        JSON.parse(line)
-      rescue JSON::ParserError => e
-        write_response(error_response(nil, "Invalid JSON: #{e.message}", 'parse'))
-        nil
-      end
-
-      # Dispatch a tool request to the appropriate handler.
-      #
-      # @param tool [String] Tool name
-      # @param params [Hash] Tool parameters
-      # @return [Hash] Tool result
-      def dispatch(tool, params)
-        case tool
-        when 'status'
-          handle_status
-        when 'schema'
-          handle_schema(params)
-        else
-          validate_model_param(params)
-          handler = TOOL_HANDLERS.fetch(tool) { raise ValidationError, "Unknown tool: #{tool}" }
-          send(handler, params)
-        end
-      end
-
-      # Validate that the model parameter is present and known.
-      def validate_model_param(params)
-        model = params['model']
-        raise ValidationError, 'Missing required parameter: model' unless model
-
-        @model_validator.validate_model!(model)
-      end
-
-      # Stub handlers below return empty/zero data by design — see the
-      # class-level docstring. Real in-process execution happens in
-      # EmbeddedExecutor; the eventual Option-D bridge process will replace
-      # this class entirely.
-
-      def handle_count(_params)
-        { 'count' => 0 }
-      end
-
-      def handle_sample(_params)
-        { 'records' => [] }
-      end
-
-      def handle_find(_params)
-        { 'record' => nil }
-      end
-
-      def handle_pluck(params)
-        @model_validator.validate_columns!(params['model'], params['columns']) if params['columns']
-        { 'columns' => Array(params['columns']), 'values' => [] }
-      end
-
-      def handle_aggregate(params)
-        @model_validator.validate_column!(params['model'], params['column']) if params['column']
-        { 'value' => nil }
-      end
-
-      def handle_association_count(_params)
-        { 'count' => 0 }
-      end
-
-      def handle_schema(params)
-        model = params['model']
-        raise ValidationError, 'Missing required parameter: model' unless model
-
-        @model_validator.validate_model!(model)
-        { 'columns' => @model_validator.columns_for(model), 'indexes' => [] }
-      end
-
-      def handle_recent(_params)
-        { 'records' => [] }
-      end
-
-      def handle_status
-        { 'status' => 'ok', 'models' => @model_validator.model_names }
-      end
-
-      # Build an error response hash.
-      def error_response(id, message, error_type)
-        { 'id' => id, 'ok' => false, 'error' => message, 'error_type' => error_type }
-      end
-
-      # Write a JSON-line response to the output stream.
-      def write_response(response)
-        @output.puts(JSON.generate(response))
-        @output.flush
-      end
-    end
-  end
-end

data/lib/woods/console/credential_scanner_registry.rb

@@ -1,36 +0,0 @@
-# frozen_string_literal: true
-
-module Woods
-  module Console
-    # Coordinates scanner construction and rotation without retaining servers
-    # after their transports release them. Requests keep their own index snapshot.
-    class CredentialScannerRegistry
-      def initialize
-        @scanners = ObjectSpace::WeakMap.new
-        @mutex = Mutex.new
-      end
-
-      def register
-        @mutex.synchronize do
-          scanner = yield
-          # Older Ruby WeakMap implementations validate the value's liveness
-          # when enumerating. Keep the scanner in both weak positions so an
-          # immortal sentinel cannot make an abandoned scanner look live.
-          @scanners[scanner] = scanner
-          scanner
-        end
-      end
-
-      def rebuild
-        @mutex.synchronize do
-          scanners = @scanners.values
-          return nil if scanners.empty?
-
-          index = yield
-          scanners.each { |scanner| scanner.replace_index!(index) }
-          index
-        end
-      end
-    end
-  end
-end

data/lib/woods/console/encrypted_credential_snapshot.rb

@@ -1,16 +0,0 @@
-# frozen_string_literal: true
-
-require 'active_support/encrypted_configuration'
-
-module Woods
-  module Console
-    # A private, uncached Rails configuration for one credential-index build.
-    # Unlike Rails' permissive configuration reader, a missing encrypted file
-    # must raise during an explicit refresh rather than erase the last index.
-    class EncryptedCredentialSnapshot < ActiveSupport::EncryptedConfiguration
-      def read
-        ActiveSupport::EncryptedFile.instance_method(:read).bind(self).call
-      end
-    end
-  end
-end