0sec-cli 0.15.0 → 0.17.0

package/chunks/chunk-BKZFDZ23.js

@@ -0,0 +1,361 @@
+#!/usr/bin/env node
+import { createRequire as __0secCreateRequire } from "node:module";
+const require = __0secCreateRequire(import.meta.url);
+import {
+  collectScopeFiles
+} from "./chunk-53G27VPS.js";
+
+// packages/core/dist/specdrift/extract.js
+var MODAL_RE = /\b(MUST(?:\s+NOT)?|SHALL(?:\s+NOT)?|SHOULD(?:\s+NOT)?|MAY|REQUIRED|OPTIONAL)\b/;
+var RANGE_RE = /\b(?:between|minimum|maximum|at least|at most|less than|greater than|[0-9]+\s*(?:-|to)\s*[0-9]+|0x[0-9a-f]+)\b/i;
+var LENGTH_RE = /\b(length|size|bytes?|octets?|bits?|payload|frame size|field)\b/i;
+var STATE_RE = /\b(state|transition|handshake|stream|session|before|after|until|when|while|once)\b/i;
+var REJECT_RE = /\b(reject(?:ed|s|ing)?|error|invalid|malformed|abort(?:ed|s|ing)?|terminate(?:d|s|ing)?|discard(?:ed|s|ing)?|fail(?:ed|s|ing)?|close(?:d|s|ing)?)\b/i;
+var ORDER_RE = /\b(before|after|first|then|prior to|followed by|precede|order)\b/i;
+var CANON_RE = /\b(canonical|normalize|normalise|case-sensitive|case-insensitive|duplicate|unique)\b/i;
+function hasNormativeSignal(text) {
+  return MODAL_RE.test(text) || REJECT_RE.test(text) || STATE_RE.test(text) && (RANGE_RE.test(text) || LENGTH_RE.test(text));
+}
+function slug(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-|-$/g, "").slice(0, 48) || "rule";
+}
+function splitLines(specText) {
+  const out = [];
+  let section;
+  const lines = specText.replace(/\r\n/g, "\n").split("\n");
+  for (let i = 0; i < lines.length; i++) {
+    const raw = lines[i] ?? "";
+    const trimmed = raw.trim();
+    const mdHeading = /^#{1,6}\s+(.+)$/.exec(trimmed);
+    const numberedHeading = /^(\d+(?:\.\d+)*\.?\s+.+)$/.exec(trimmed);
+    if (mdHeading?.[1])
+      section = mdHeading[1].trim();
+    else if (numberedHeading?.[1] && trimmed.length < 120)
+      section = numberedHeading[1].trim();
+    out.push({ n: i + 1, text: raw, ...section ? { section } : {} });
+  }
+  return out;
+}
+function sentences(lines) {
+  const out = [];
+  let buf = "";
+  let start = 1;
+  let section;
+  for (const line of lines) {
+    const trimmed = line.text.trim();
+    if (!trimmed)
+      continue;
+    if (/^#{1,6}\s+/.test(trimmed) || /^(\d+(?:\.\d+)*\.?\s+.+)$/.test(trimmed))
+      continue;
+    if (!buf && !hasNormativeSignal(trimmed))
+      continue;
+    if (!buf) {
+      start = line.n;
+      section = line.section;
+    }
+    buf = buf ? `${buf} ${trimmed}` : trimmed;
+    if (/[.!?]$/.test(trimmed) || buf.length > 420) {
+      out.push({ n: start, text: buf, ...section ? { section } : {} });
+      buf = "";
+      section = void 0;
+    }
+  }
+  if (buf)
+    out.push({ n: start, text: buf, ...section ? { section } : {} });
+  return out;
+}
+function kindFor(text) {
+  if (REJECT_RE.test(text))
+    return "rejection";
+  if (STATE_RE.test(text))
+    return "state";
+  if (RANGE_RE.test(text))
+    return "range";
+  if (LENGTH_RE.test(text))
+    return "length";
+  if (ORDER_RE.test(text))
+    return "ordering";
+  if (CANON_RE.test(text))
+    return "canonicalization";
+  return "requirement";
+}
+function relevanceFor(kind, text) {
+  if (/\b(auth|encrypt|signature|certificate|key|nonce|token|permission|credential)\b/i.test(text))
+    return "high";
+  if (kind === "state" || kind === "rejection")
+    return "high";
+  if (kind === "range" || kind === "length")
+    return "medium";
+  return "low";
+}
+function subjectFor(text) {
+  const match = /(?:the|a|an)\s+([A-Za-z0-9_.-]+(?:\s+[A-Za-z0-9_.-]+){0,4})\s+(?:MUST|SHALL|SHOULD|MAY|is|required|contains|has)\b/i.exec(text);
+  return match?.[1]?.trim();
+}
+function summarize(text) {
+  return text.replace(/\s+/g, " ").slice(0, 180).replace(/[.;:,\s]+$/g, "");
+}
+function extractSpecInvariants(opts) {
+  const max = opts.maxInvariants ?? 40;
+  const warnings = [];
+  const lines = splitLines(opts.specText);
+  const candidates = sentences(lines).filter((s) => hasNormativeSignal(s.text)).slice(0, max);
+  if (candidates.length === max)
+    warnings.push(`capped invariants at ${max}; raise --max-invariants to widen extraction`);
+  if (candidates.length === 0)
+    warnings.push("no normative invariants found; spec may need OCR cleanup or LLM extraction");
+  const invariants = candidates.map((c, idx) => {
+    const kind = kindFor(c.text);
+    const summary = summarize(c.text);
+    return {
+      id: `inv-${String(idx + 1).padStart(3, "0")}-${slug(summary)}`,
+      kind,
+      summary,
+      rule: c.text,
+      ...subjectFor(c.text) ? { subject: subjectFor(c.text) } : {},
+      citations: [{ spec: opts.specName, ...c.section ? { section: c.section } : {}, lineStart: c.n, lineEnd: c.n, text: c.text }],
+      securityRelevance: relevanceFor(kind, c.text)
+    };
+  });
+  return {
+    mode: "specdrift",
+    stage: "extract",
+    spec: opts.specName,
+    invariants,
+    warnings
+  };
+}
+
+// packages/core/dist/specdrift/map.js
+import { readFileSync } from "node:fs";
+import { relative } from "node:path";
+var STOPWORDS = /* @__PURE__ */ new Set([
+  "the",
+  "and",
+  "that",
+  "this",
+  "with",
+  "from",
+  "when",
+  "while",
+  "must",
+  "shall",
+  "should",
+  "not",
+  "may",
+  "been",
+  "have",
+  "has",
+  "are",
+  "is",
+  "be",
+  "for",
+  "into",
+  "whose",
+  "their",
+  "there",
+  "then",
+  "than",
+  "frame",
+  "field",
+  "message",
+  "payload",
+  "implementation",
+  "implementations"
+]);
+var KIND_HINTS = {
+  range: [/\b(?:len|length|size|limit|max|min|range|bounds?)\b/i, /[<>]=?|\bbetween\b/i],
+  length: [/\b(?:len|length|size|payload|bytes?|octets?)\b/i, /[<>]=?/],
+  ordering: [/\b(?:before|after|state|phase|order|seq|sequence)\b/i],
+  state: [/\b(?:state|phase|handshake|session|stream|open|closed|init)\b/i],
+  rejection: [/\b(?:reject|invalid|error|fail|abort|discard|close|return|throw)\b/i],
+  canonicalization: [/\b(?:canonical|normalize|normalise|lower|upper|duplicate|unique)\b/i],
+  requirement: [/\b(?:validate|check|require|assert|if|return|throw)\b/i]
+};
+var SOURCE_EXTS = /* @__PURE__ */ new Set([
+  ".c",
+  ".h",
+  ".cc",
+  ".cpp",
+  ".cxx",
+  ".hpp",
+  ".rs",
+  ".go",
+  ".java",
+  ".kt",
+  ".py",
+  ".js",
+  ".ts",
+  ".jsx",
+  ".tsx"
+]);
+function termsFor(invariant) {
+  const raw = `${invariant.subject ?? ""} ${invariant.summary} ${invariant.rule}`.toLowerCase().replace(/[`*_]/g, " ").match(/[a-z][a-z0-9-]{2,}/g) ?? [];
+  const out = [];
+  for (const term of raw) {
+    const normalized = term.replace(/-/g, "");
+    if (STOPWORDS.has(term) || STOPWORDS.has(normalized))
+      continue;
+    if (!out.includes(term))
+      out.push(term);
+    if (out.length >= 12)
+      break;
+  }
+  return out;
+}
+function snippet(lines, line) {
+  const start = Math.max(1, line - 2);
+  const end = Math.min(lines.length, line + 2);
+  const text = lines.slice(start - 1, end).map((l, idx) => `${start + idx}: ${l}`).join("\n");
+  return { lineStart: start, lineEnd: end, text };
+}
+function scoreLine(invariant, line, terms) {
+  const lowered = line.toLowerCase();
+  const matchedTerms = terms.filter((term) => lowered.includes(term));
+  let score = matchedTerms.length;
+  for (const hint of KIND_HINTS[invariant.kind])
+    if (hint.test(line))
+      score += 2;
+  if (/\b(if|switch|case|return|throw|goto|break|continue)\b/.test(line))
+    score += 1;
+  if (/^\s*(\/\/|\*|#)/.test(line))
+    score -= 2;
+  return { score, matchedTerms };
+}
+function mapInvariantsToImplementation(opts) {
+  const warnings = [];
+  const files = collectScopeFiles(opts.sourceRoot, { maxFiles: opts.maxFiles ?? 400, extensions: SOURCE_EXTS });
+  if (files.length === (opts.maxFiles ?? 400))
+    warnings.push(`source file scan capped at ${files.length}; raise --max-files to widen mapping`);
+  const candidates = [];
+  const maxPerInvariant = opts.maxCandidatesPerInvariant ?? 5;
+  for (const invariant of opts.invariants) {
+    const terms = termsFor(invariant);
+    if (terms.length === 0)
+      continue;
+    const ranked = [];
+    for (const file of files) {
+      let source;
+      try {
+        source = readFileSync(file, "utf8");
+      } catch {
+        continue;
+      }
+      const lines = source.split(/\r?\n/);
+      for (let i = 0; i < lines.length; i++) {
+        const { score, matchedTerms } = scoreLine(invariant, lines[i] ?? "", terms);
+        if (score < 3 || matchedTerms.length === 0)
+          continue;
+        const snip = snippet(lines, i + 1);
+        ranked.push({
+          invariantId: invariant.id,
+          file: relative(opts.sourceRoot, file),
+          lineStart: snip.lineStart,
+          lineEnd: snip.lineEnd,
+          snippet: snip.text,
+          matchedTerms,
+          reason: `${invariant.kind} invariant terms matched implementation code`,
+          confidence: Math.min(0.95, 0.25 + score * 0.08),
+          status: "candidate",
+          rawScore: score
+        });
+      }
+    }
+    ranked.sort((a, b) => b.rawScore - a.rawScore || a.file.localeCompare(b.file) || a.lineStart - b.lineStart);
+    candidates.push(...ranked.slice(0, maxPerInvariant).map(({ rawScore: _rawScore, ...candidate }) => candidate));
+  }
+  if (opts.invariants.length > 0 && candidates.length === 0)
+    warnings.push("no implementation candidates matched extracted invariants");
+  return { candidates, warnings };
+}
+function runSpecdriftScan(opts) {
+  const extracted = extractSpecInvariants({
+    specName: opts.specName,
+    specText: opts.specText,
+    ...opts.maxInvariants ? { maxInvariants: opts.maxInvariants } : {}
+  });
+  const mapped = mapInvariantsToImplementation({
+    sourceRoot: opts.sourceRoot,
+    invariants: extracted.invariants,
+    ...opts.maxFiles ? { maxFiles: opts.maxFiles } : {},
+    ...opts.maxCandidatesPerInvariant ? { maxCandidatesPerInvariant: opts.maxCandidatesPerInvariant } : {}
+  });
+  return {
+    mode: "specdrift",
+    stage: "scan",
+    spec: opts.specName,
+    source: opts.sourceRoot,
+    invariants: extracted.invariants,
+    candidates: mapped.candidates,
+    warnings: [...extracted.warnings, ...mapped.warnings]
+  };
+}
+
+// packages/core/dist/specdrift/plan.js
+function adapterFor(invariant, candidate) {
+  const file = candidate.file.toLowerCase();
+  if (/\b(kernel|net|drivers)\b/.test(file))
+    return "kernel-repro";
+  if (invariant.kind === "state" || invariant.kind === "ordering")
+    return "stateful-transcript";
+  if (/\.(c|h|cc|cpp|cxx|rs|go)$/i.test(file) && (invariant.kind === "range" || invariant.kind === "length" || invariant.kind === "rejection"))
+    return "raw-bytes";
+  if (/\.(js|ts|py|java|kt)$/i.test(file))
+    return "unit-test";
+  return "request-response";
+}
+function questionFor(invariant, candidate) {
+  const subject = invariant.subject ? ` for ${invariant.subject}` : "";
+  if (invariant.kind === "rejection") {
+    return `Does ${candidate.file}:${candidate.lineStart} reject inputs that violate the spec rule${subject}: ${invariant.summary}?`;
+  }
+  if (invariant.kind === "state" || invariant.kind === "ordering") {
+    return `Can an input transcript reach ${candidate.file}:${candidate.lineStart} in an order/state forbidden by the spec rule${subject}: ${invariant.summary}?`;
+  }
+  if (invariant.kind === "range" || invariant.kind === "length") {
+    return `Does ${candidate.file}:${candidate.lineStart} enforce the spec bound${subject}: ${invariant.summary}?`;
+  }
+  return `Does ${candidate.file}:${candidate.lineStart} implement the spec invariant${subject}: ${invariant.summary}?`;
+}
+function planSpecdriftHypotheses(opts) {
+  const byInvariant = new Map(opts.scan.invariants.map((inv) => [inv.id, inv]));
+  const max = opts.maxHypotheses ?? 20;
+  const hypotheses = [];
+  for (const candidate of opts.scan.candidates) {
+    const invariant = byInvariant.get(candidate.invariantId);
+    if (!invariant)
+      continue;
+    const suggestedAdapter = adapterFor(invariant, candidate);
+    hypotheses.push({
+      id: `hyp-${String(hypotheses.length + 1).padStart(3, "0")}-${invariant.id.replace(/^inv-\d+-/, "").slice(0, 40)}`,
+      invariantId: invariant.id,
+      candidateFile: candidate.file,
+      candidateLineStart: candidate.lineStart,
+      candidateLineEnd: candidate.lineEnd,
+      question: questionFor(invariant, candidate),
+      suggestedAdapter,
+      rationale: `Spec invariant (${invariant.kind}, ${invariant.securityRelevance} relevance) matched ${candidate.matchedTerms.join(", ")} in candidate code. This is a hypothesis only; adapter execution or skeptic review must prove/refute behavior.`,
+      status: "hypothesis",
+      confidence: Math.min(0.9, candidate.confidence * (invariant.securityRelevance === "high" ? 1 : 0.85))
+    });
+    if (hypotheses.length >= max)
+      break;
+  }
+  return hypotheses;
+}
+function runSpecdriftPlan(opts) {
+  const scan = runSpecdriftScan(opts);
+  return {
+    ...scan,
+    stage: "plan",
+    hypotheses: planSpecdriftHypotheses({ scan, ...opts.maxHypotheses ? { maxHypotheses: opts.maxHypotheses } : {} })
+  };
+}
+
+export {
+  extractSpecInvariants,
+  mapInvariantsToImplementation,
+  runSpecdriftScan,
+  planSpecdriftHypotheses,
+  runSpecdriftPlan
+};