0xray 3.1.0 → 3.2.0

package/dist/inference/inference-proposal-generator.js

@@ -0,0 +1,149 @@
+function classifyProposalType(problemPattern) {
+    const lower = problemPattern.toLowerCase();
+    if (lower.includes("bug") || lower.includes("fix") || lower.includes("stability"))
+        return "fix";
+    if (lower.includes("dead code") || lower.includes("remove") || lower.includes("health"))
+        return "refactor";
+    if (lower.includes("manual") || lower.includes("automate"))
+        return "automate";
+    if (lower.includes("guard") || lower.includes("path") || lower.includes("timing") || lower.includes("edge case"))
+        return "guard";
+    return "codify";
+}
+function patternToProposalType(pattern) {
+    const name = pattern.name.toLowerCase();
+    if (name.includes("dead code"))
+        return "refactor";
+    if (name.includes("extract"))
+        return "refactor";
+    if (name.includes("registry") || name.includes("facade"))
+        return "codify";
+    if (name.includes("test"))
+        return "guard";
+    if (name.includes("stability"))
+        return "fix";
+    return "codify";
+}
+const ACTION_MAP = [
+    [/^Bug fix$/i, "Fix recurring bug pattern"],
+    [/^Code health cleanup$/i, "Clean up code health issues"],
+    [/^Accumulated dead code$/i, "Remove accumulated dead code"],
+    [/^Incomplete implementation$/i, "Complete partial implementation"],
+    [/^Technical debt/i, "Address technical debt"],
+    [/^Missing guard/i, "Add missing guard"],
+    [/^Manual step/i, "Automate manual step"],
+];
+function generateTitle(problem) {
+    const pattern = problem.pattern;
+    for (const [re, title] of ACTION_MAP) {
+        if (re.test(pattern)) {
+            return `${title} (${problem.occurrences}x across ${problem.sessions.length} sessions)`;
+        }
+    }
+    if (pattern.length > 80) {
+        return `Address: ${pattern.substring(0, 77)}... (${problem.occurrences}x)`;
+    }
+    return `Address: ${pattern} (${problem.occurrences}x)`;
+}
+function adjustConfidenceFromHistory(proposals, history) {
+    if (history.length === 0)
+        return;
+    const recentVotes = history.slice(-10).flatMap((h) => h.votes);
+    const approvedIds = new Set(recentVotes.filter((v) => v.decision === "approve").map((v) => v.proposalId));
+    const approvedTypes = new Map();
+    const rejectedTypes = new Map();
+    for (const h of history.slice(-10)) {
+        for (const p of h.proposals) {
+            if (p.status === "approved" || p.status === "applied") {
+                approvedTypes.set(p.type, (approvedTypes.get(p.type) ?? 0) + 1);
+            }
+            else if (p.status === "rejected" || p.status === "failed") {
+                rejectedTypes.set(p.type, (rejectedTypes.get(p.type) ?? 0) + 1);
+            }
+        }
+    }
+    for (const proposal of proposals) {
+        const approved = approvedTypes.get(proposal.type) ?? 0;
+        const rejected = rejectedTypes.get(proposal.type) ?? 0;
+        const total = approved + rejected;
+        if (total >= 3) {
+            const successRate = approved / total;
+            if (successRate < 0.3) {
+                proposal.confidence *= 0.8;
+            }
+            else if (successRate > 0.7) {
+                proposal.confidence = Math.min(0.95, proposal.confidence * 1.05);
+            }
+        }
+    }
+}
+export function generateProposals(corpus, history) {
+    const proposals = [];
+    for (const problem of corpus.recurringProblems) {
+        proposals.push({
+            id: `prop-${Date.now()}-${proposals.length}`,
+            type: classifyProposalType(problem.pattern),
+            title: generateTitle(problem),
+            description: `Recurring across ${problem.occurrences} sessions: ${problem.pattern}`,
+            evidence: problem.sessions.map((s) => `Seen in session ${s}`),
+            confidence: Math.min(0.95, 0.5 + problem.occurrences * 0.15),
+            source: "recurring_problem",
+            status: "pending",
+        });
+    }
+    const seenPatterns = new Set(corpus.recurringProblems.map((p) => p.pattern));
+    const allProblems = corpus.sessions.flatMap((s) => s.problems.map((p) => ({ problem: p, session: s.sessionId })));
+    for (const { problem, session } of allProblems) {
+        const normalized = problem.replace(/\([a-f0-9]{7}\)/g, "").trim();
+        if (seenPatterns.has(normalized))
+            continue;
+        if (proposals.length >= 5)
+            break;
+        proposals.push({
+            id: `prop-${Date.now()}-${proposals.length}`,
+            type: classifyProposalType(problem),
+            title: `Investigate: ${problem.substring(0, 80)}`,
+            description: `Observed in session ${session}: ${problem}`,
+            evidence: [problem],
+            confidence: 0.4,
+            source: "recurring_problem",
+            status: "pending",
+        });
+        seenPatterns.add(normalized);
+    }
+    for (const pattern of corpus.recurringPatterns) {
+        if (pattern.occurrences < 2)
+            continue;
+        const type = patternToProposalType(pattern);
+        proposals.push({
+            id: `prop-${Date.now()}-${proposals.length}`,
+            type,
+            title: `Codify ${pattern.name} pattern`,
+            description: `${pattern.name} detected across ${pattern.occurrences} sessions (avg confidence: ${Math.round(pattern.avgConfidence * 100)}%). ${pattern.description}`,
+            evidence: pattern.evidence,
+            confidence: pattern.avgConfidence,
+            source: "recurring_pattern",
+            status: "pending",
+        });
+    }
+    const wrongTurns = corpus.allWrongTurns.slice(0, 2);
+    for (const wt of wrongTurns) {
+        const summary = wt.length > 50 ? `${wt.substring(0, 47)}...` : wt;
+        proposals.push({
+            id: `prop-${Date.now()}-${proposals.length}`,
+            type: "guard",
+            title: `Guard against: ${summary}`,
+            description: `Recurring wrong turn detected: ${wt}. Add a guard or validation to prevent this pattern.`,
+            evidence: [wt],
+            confidence: 0.7,
+            source: "wrong_turn",
+            status: "pending",
+        });
+    }
+    const sorted = proposals.sort((a, b) => b.confidence - a.confidence).slice(0, 3);
+    if (history && history.length > 0) {
+        adjustConfidenceFromHistory(sorted, history);
+        sorted.sort((a, b) => b.confidence - a.confidence);
+    }
+    return sorted;
+}

package/dist/infrastructure/iac-validator.js

@@ -0,0 +1,465 @@
+/**
+ * Infrastructure as Code Validation System
+ *
+ * Comprehensive IaC validation with schema enforcement, pre-commit hooks,
+ * and automated CI/CD integration for enterprise-grade cloud deployments.
+ *
+ * @since 2026-01-08
+ */
+import { z } from "zod";
+import * as fs from "fs";
+import * as path from "path";
+import { spawn } from "child_process";
+import { frameworkLogger } from "../core/framework-logger.js";
+// ============================================================================
+// Schema Validation Types
+// ============================================================================
+export var ValidationSeverity;
+(function (ValidationSeverity) {
+    ValidationSeverity["ERROR"] = "error";
+    ValidationSeverity["WARNING"] = "warning";
+    ValidationSeverity["INFO"] = "info";
+})(ValidationSeverity || (ValidationSeverity = {}));
+// ============================================================================
+// Base Schema Validators
+// ============================================================================
+export const CloudFormationSchema = z.object({
+    AWSTemplateFormatVersion: z.string().optional(),
+    Description: z.string().optional(),
+    Metadata: z.record(z.string(), z.any()).optional(),
+    Parameters: z
+        .record(z.string(), z.object({
+        Type: z.string(),
+        Default: z.any().optional(),
+        AllowedValues: z.array(z.any()).optional(),
+        Description: z.string().optional(),
+    }))
+        .optional(),
+    Mappings: z
+        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
+        .optional(),
+    Conditions: z.record(z.string(), z.any()).optional(),
+    Transform: z.union([z.string(), z.array(z.string())]).optional(),
+    Resources: z.record(z.string(), z.object({
+        Type: z.string(),
+        Properties: z.record(z.string(), z.any()).optional(),
+        DependsOn: z.union([z.string(), z.array(z.string())]).optional(),
+        Metadata: z.record(z.string(), z.any()).optional(),
+        DeletionPolicy: z.enum(["Delete", "Retain", "Snapshot"]).optional(),
+    })),
+    Outputs: z
+        .record(z.string(), z.object({
+        Description: z.string().optional(),
+        Value: z.any(),
+        Export: z
+            .object({
+            Name: z.string(),
+        })
+            .optional(),
+    }))
+        .optional(),
+});
+export const TerraformSchema = z.object({
+    terraform: z
+        .object({
+        required_version: z.string().optional(),
+        required_providers: z
+            .record(z.string(), z.object({
+            version: z.string().optional(),
+            source: z.string().optional(),
+        }))
+            .optional(),
+        backend: z.record(z.string(), z.any()).optional(),
+    })
+        .optional(),
+    provider: z.record(z.string(), z.record(z.string(), z.any())).optional(),
+    resource: z
+        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
+        .optional(),
+    data: z
+        .record(z.string(), z.record(z.string(), z.record(z.string(), z.any())))
+        .optional(),
+    variable: z
+        .record(z.string(), z.object({
+        type: z.string().optional(),
+        default: z.any().optional(),
+        description: z.string().optional(),
+        validation: z
+            .array(z.object({
+            condition: z.any(),
+            error_message: z.string(),
+        }))
+            .optional(),
+    }))
+        .optional(),
+    output: z
+        .record(z.string(), z.object({
+        value: z.any(),
+        description: z.string().optional(),
+        sensitive: z.boolean().optional(),
+    }))
+        .optional(),
+    locals: z.record(z.string(), z.any()).optional(),
+    module: z.record(z.string(), z.record(z.string(), z.any())).optional(),
+});
+export const KubernetesSchema = z.object({
+    apiVersion: z.string(),
+    kind: z.string(),
+    metadata: z.object({
+        name: z.string(),
+        namespace: z.string().optional(),
+        labels: z.record(z.string(), z.string()).optional(),
+        annotations: z.record(z.string(), z.string()).optional(),
+    }),
+    spec: z.record(z.string(), z.any()).optional(),
+    status: z.record(z.string(), z.any()).optional(),
+});
+export const DockerComposeSchema = z.object({
+    version: z.string().optional(),
+    services: z
+        .record(z.string(), z.object({
+        image: z.string().optional(),
+        build: z.union([z.string(), z.record(z.string(), z.any())]).optional(),
+        ports: z.array(z.union([z.string(), z.number()])).optional(),
+        environment: z
+            .union([z.record(z.string(), z.string()), z.array(z.string())])
+            .optional(),
+        volumes: z.array(z.string()).optional(),
+        depends_on: z.array(z.string()).optional(),
+        networks: z.array(z.string()).optional(),
+        restart: z
+            .enum(["no", "always", "on-failure", "unless-stopped"])
+            .optional(),
+    }))
+        .optional(),
+    volumes: z.record(z.string(), z.record(z.string(), z.any())).optional(),
+    networks: z.record(z.string(), z.record(z.string(), z.any())).optional(),
+});
+// ============================================================================
+// IaC Validator Class
+// ============================================================================
+export class IaCValidator {
+    schemas = new Map();
+    constructor() {
+        this.registerSchemas();
+    }
+    registerSchemas() {
+        // CloudFormation
+        this.schemas.set("template.yaml", CloudFormationSchema);
+        this.schemas.set("template.yml", CloudFormationSchema);
+        this.schemas.set("cf-template.yaml", CloudFormationSchema);
+        this.schemas.set("cf-template.yml", CloudFormationSchema);
+        // Terraform
+        this.schemas.set("main.tf", TerraformSchema);
+        this.schemas.set("variables.tf", TerraformSchema);
+        this.schemas.set("outputs.tf", TerraformSchema);
+        this.schemas.set("terraform.tf", TerraformSchema);
+        // Kubernetes
+        this.schemas.set("deployment.yaml", KubernetesSchema);
+        this.schemas.set("deployment.yml", KubernetesSchema);
+        this.schemas.set("service.yaml", KubernetesSchema);
+        this.schemas.set("service.yml", KubernetesSchema);
+        this.schemas.set("configmap.yaml", KubernetesSchema);
+        this.schemas.set("configmap.yml", KubernetesSchema);
+        this.schemas.set("secret.yaml", KubernetesSchema);
+        this.schemas.set("secret.yml", KubernetesSchema);
+        // Docker Compose
+        this.schemas.set("docker-compose.yaml", DockerComposeSchema);
+        this.schemas.set("docker-compose.yml", DockerComposeSchema);
+        this.schemas.set("compose.yaml", DockerComposeSchema);
+        this.schemas.set("compose.yml", DockerComposeSchema);
+    }
+    async validateFile(filePath) {
+        const result = {
+            file: filePath,
+            valid: true,
+            errors: [],
+            warnings: [],
+        };
+        try {
+            const content = fs.readFileSync(filePath, "utf-8");
+            const ext = path.extname(filePath).toLowerCase();
+            const filename = path.basename(filePath).toLowerCase();
+            // Determine file type and validate
+            if (ext === ".json") {
+                await this.validateJsonFile(content, result);
+            }
+            else if (ext === ".yaml" || ext === ".yml") {
+                await this.validateYamlFile(filename, content, result);
+            }
+            // Additional security and best practice checks
+            this.performSecurityChecks(filePath, content, result);
+        }
+        catch (error) {
+            result.valid = false;
+            result.errors.push({
+                path: filePath,
+                message: `Failed to read or parse file: ${error instanceof Error ? error.message : String(error)}`,
+                severity: ValidationSeverity.ERROR,
+            });
+        }
+        return result;
+    }
+    async validateJsonFile(content, result) {
+        try {
+            JSON.parse(content);
+        }
+        catch (error) {
+            result.valid = false;
+            result.errors.push({
+                path: result.file,
+                message: `Invalid JSON: ${error instanceof Error ? error.message : String(error)}`,
+                severity: ValidationSeverity.ERROR,
+            });
+        }
+    }
+    async validateYamlFile(filename, content, result) {
+        try {
+            // Import yaml parser dynamically to avoid dependency issues
+            const yaml = await import("yaml");
+            const data = yaml.parse(content);
+            const schema = this.schemas.get(filename);
+            if (schema) {
+                const validation = schema.safeParse(data);
+                if (!validation.success) {
+                    result.valid = false;
+                    validation.error.issues.forEach((err) => {
+                        result.errors.push({
+                            path: `${result.file}.${err.path.join(".")}`,
+                            message: err.message,
+                            severity: ValidationSeverity.ERROR,
+                        });
+                    });
+                }
+            }
+            // Basic YAML structure validation
+            if (typeof data !== "object" || data === null) {
+                result.valid = false;
+                result.errors.push({
+                    path: result.file,
+                    message: "YAML file must contain a valid object structure",
+                    severity: ValidationSeverity.ERROR,
+                });
+            }
+        }
+        catch (error) {
+            result.valid = false;
+            result.errors.push({
+                path: result.file,
+                message: `Failed to parse YAML: ${error instanceof Error ? error.message : String(error)}`,
+                severity: ValidationSeverity.ERROR,
+            });
+        }
+    }
+    performSecurityChecks(filePath, content, result) {
+        const filename = path.basename(filePath).toLowerCase();
+        // Check for hardcoded secrets
+        const secretPatterns = [
+            /password\s*[:=]\s*['"]\w+['"]/i,
+            /secret\s*[:=]\s*['"]\w+['"]/i,
+            /token\s*[:=]\s*['"]\w+['"]/i,
+            /key\s*[:=]\s*['"]\w+['"]/i,
+            /api[_-]?key\s*[:=]\s*['"]\w+['"]/i,
+        ];
+        secretPatterns.forEach((pattern) => {
+            const matches = content.match(pattern);
+            if (matches) {
+                result.warnings.push({
+                    path: filePath,
+                    message: "Potential hardcoded secret detected",
+                    severity: ValidationSeverity.WARNING,
+                    suggestion: "Use environment variables or secret management services",
+                });
+            }
+        });
+        // Check for overly permissive permissions
+        if (filename.includes("iam") || filename.includes("policy")) {
+            if (content.includes("*") && content.includes("Action")) {
+                result.warnings.push({
+                    path: filePath,
+                    message: "Overly permissive IAM policy detected (* action)",
+                    severity: ValidationSeverity.WARNING,
+                    suggestion: "Specify explicit actions instead of wildcard",
+                });
+            }
+        }
+        // Check for missing resource constraints
+        if (filename.includes("deployment") || filename.includes("pod")) {
+            if (!content.includes("resources") && !content.includes("limits")) {
+                result.warnings.push({
+                    path: filePath,
+                    message: "Missing resource limits in deployment",
+                    severity: ValidationSeverity.WARNING,
+                    suggestion: "Add CPU and memory limits for production deployments",
+                });
+            }
+        }
+    }
+    async validateDirectory(dirPath) {
+        const results = [];
+        const files = this.findIaCFiles(dirPath);
+        for (const file of files) {
+            const result = await this.validateFile(file);
+            results.push(result);
+        }
+        return results;
+    }
+    findIaCFiles(dirPath) {
+        const files = [];
+        const extensions = [".yaml", ".yml", ".json", ".tf"];
+        const filenames = Array.from(this.schemas.keys());
+        function scanDir(currentPath) {
+            const items = fs.readdirSync(currentPath);
+            for (const item of items) {
+                const fullPath = path.join(currentPath, item);
+                const stat = fs.statSync(fullPath);
+                if (stat.isDirectory() &&
+                    !item.startsWith(".") &&
+                    item !== "node_modules") {
+                    scanDir(fullPath);
+                }
+                else if (stat.isFile()) {
+                    const ext = path.extname(item).toLowerCase();
+                    const filename = item.toLowerCase();
+                    if (extensions.includes(ext) || filenames.includes(filename)) {
+                        files.push(fullPath);
+                    }
+                }
+            }
+        }
+        scanDir(dirPath);
+        return files;
+    }
+}
+// ============================================================================
+// Pre-commit Hook Integration
+// ============================================================================
+export class PreCommitValidator {
+    validator;
+    constructor() {
+        this.validator = new IaCValidator();
+    }
+    async validateStagedFiles() {
+        try {
+            // Get staged files using spawn to prevent command injection
+            const stagedFiles = await new Promise((resolve, reject) => {
+                const gitProcess = spawn("git", ["diff", "--cached", "--name-only"]);
+                let stdout = "";
+                let stderr = "";
+                gitProcess.stdout?.on("data", (data) => {
+                    stdout += data.toString();
+                });
+                gitProcess.stderr?.on("data", (data) => {
+                    stderr += data.toString();
+                });
+                gitProcess.on("close", (code) => {
+                    if (code === 0) {
+                        const files = stdout
+                            .split("\n")
+                            .filter((file) => file.trim() &&
+                            (file.endsWith(".yaml") ||
+                                file.endsWith(".yml") ||
+                                file.endsWith(".json") ||
+                                file.endsWith(".tf")));
+                        resolve(files);
+                    }
+                    else {
+                        reject(new Error(`git failed with code ${code}: ${stderr}`));
+                    }
+                });
+                gitProcess.on("error", (err) => {
+                    reject(new Error(`Failed to spawn git: ${err.message}`));
+                });
+            });
+            const results = [];
+            for (const file of stagedFiles) {
+                if (fs.existsSync(file)) {
+                    const result = await this.validator.validateFile(file);
+                    results.push(result);
+                }
+            }
+            const hasErrors = results.some((r) => !r.valid);
+            return { success: !hasErrors, results };
+        }
+        catch (error) {
+            frameworkLogger.log("IaCValidator", "validate-staged-files", "error", { error, message: "Failed to validate staged files:" });
+            return { success: false, results: [] };
+        }
+    }
+    async validateAllIaCFiles() {
+        const results = await this.validator.validateDirectory(process.cwd());
+        const hasErrors = results.some((r) => !r.valid);
+        return { success: !hasErrors, results };
+    }
+}
+// ============================================================================
+// CLI Interface
+// ============================================================================
+export async function validateCommand(args) {
+    const validator = new IaCValidator();
+    const preCommitValidator = new PreCommitValidator();
+    if (args.includes("--staged")) {
+        const { success, results } = await preCommitValidator.validateStagedFiles();
+        printResults(results);
+        if (!success) {
+            frameworkLogger.log("IaCValidator", "validate-staged", "error", { message: "\n❌ IaC validation failed. Please fix errors before committing." });
+            process.exit(1);
+        }
+        else {
+            await frameworkLogger.log("iac-validator", "-n-all-iac-files-passed-validation-", "success", { message: "\n✅ All IaC files passed validation." });
+        }
+    }
+    else if (args.includes("--all")) {
+        const { success, results } = await preCommitValidator.validateAllIaCFiles();
+        printResults(results);
+        if (!success) {
+            frameworkLogger.log("IaCValidator", "validate-all", "error", { message: "\n❌ IaC validation failed." });
+            process.exit(1);
+        }
+        else {
+            await frameworkLogger.log("iac-validator", "-n-all-iac-files-passed-validation-", "success", { message: "\n✅ All IaC files passed validation." });
+        }
+    }
+    else {
+        const targetPath = args[0] || ".";
+        const results = await validator.validateDirectory(targetPath);
+        printResults(results);
+        const hasErrors = results.some((r) => !r.valid);
+        if (hasErrors) {
+            process.exit(1);
+        }
+    }
+}
+async function printResults(results) {
+    for (const result of results) {
+        await frameworkLogger.log("iac-validator", "-n-result-file-", "info", {
+            message: `\n📄 ${result.file}:`,
+        });
+        if (result.errors.length > 0) {
+            await frameworkLogger.log("iac-validator", "-errors-", "error", {
+                message: "  ❌ Errors:",
+            });
+            result.errors.forEach((error) => {
+                void frameworkLogger.log("iac-validator", "-error-path-error-message-", "error", { message: `    • ${error.path}: ${error.message}` });
+            });
+        }
+        if (result.warnings.length > 0) {
+            await frameworkLogger.log("iac-validator", "-warnings-", "info", {
+                message: "  ⚠️  Warnings:",
+            });
+            result.warnings.forEach((warning) => {
+                void frameworkLogger.log("iac-validator", "-warning-path-warning-message-", "info", { message: `    • ${warning.path}: ${warning.message}` });
+                if (warning.suggestion) {
+                    void frameworkLogger.log("iac-validator", "-warning-suggestion-", "info", { message: `      💡 ${warning.suggestion}` });
+                }
+            });
+        }
+        if (result.valid &&
+            result.errors.length === 0 &&
+            result.warnings.length === 0) {
+            await frameworkLogger.log("iac-validator", "-valid-", "success", {
+                message: "  ✅ Valid",
+            });
+        }
+    }
+}