0xray 4.0.11 → 4.0.13

package/dist/postprocessor/triggers/WebhookTrigger.js

@@ -1,210 +0,0 @@
-/**
- * Webhook Trigger for Post-Processor
- *
- * Provides a generic webhook server that receives events from external
- * services (GitHub, GitLab, Bitbucket, Stripe) and routes them
- * to the PostProcessor for execution.
- *
- * @since 2026-03-08
- */
-import express from 'express';
-import crypto from 'crypto';
-import { frameworkLogger } from '../../core/framework-logger.js';
-export class WebhookTrigger {
-    postProcessor;
-    initialized = false;
-    app;
-    config;
-    constructor(postProcessor, config // Make config optional
-    ) {
-        this.postProcessor = postProcessor;
-        this.config = {
-            verifySignature: true,
-            path: '/webhooks/' + (config?.provider || 'github'),
-            events: config?.events || ['push', 'pull_request'],
-            ...config
-        };
-        this.app = express();
-    }
-    async initialize() {
-        if (this.initialized)
-            return;
-        // Setup webhook endpoint
-        this.setupWebhookEndpoint();
-        this.initialized = true;
-        frameworkLogger.log('webhook-trigger', 'initialized', 'info', {
-            provider: this.config.provider,
-            path: this.config.path,
-            events: this.config.events,
-            signatureVerification: this.config.verifySignature
-        });
-    }
-    setupWebhookEndpoint() {
-        const webhookPath = this.config.path || ('/webhooks/' + this.config.provider);
-        // Raw body parser for signature verification
-        this.app.use(express.raw({ type: 'application/json', limit: '10mb' }));
-        // Webhook endpoint
-        this.app.post(webhookPath, async (req, res) => {
-            try {
-                // Verify signature if configured
-                if (this.config.verifySignature && this.config.secret) {
-                    const signature = req.headers['x-hub-signature'] ||
-                        req.headers['x-gitlab-token'] ||
-                        req.headers['x-hub-signature-256'] ||
-                        req.headers['stripe-signature'];
-                    // CRITICAL FIX: Require signature header when verification is enabled
-                    if (!signature) {
-                        frameworkLogger.log('webhook-trigger', 'signature-verification-failed', 'info', { provider: this.config.provider, reason: 'no-signature-header' });
-                        return res.status(401).json({ error: 'Signature required' });
-                    }
-                    if (!this.verifySignature(req.body, signature)) {
-                        frameworkLogger.log('webhook-trigger', 'signature-verification-failed', 'info', { provider: this.config.provider || 'unknown', signature });
-                        return res.status(401).json({ error: 'Invalid signature' });
-                    }
-                }
-                // Parse event type
-                const eventHeader = req.headers['x-github-event'] ||
-                    req.headers['x-gitlab-event'] ||
-                    req.headers['stripe-event'];
-                const event = eventHeader ? String(eventHeader) : 'unknown';
-                // Check if event is in allowed list
-                if (this.config.events && this.config.events.length > 0 && !this.config.events.includes(event)) {
-                    frameworkLogger.log('webhook-trigger', 'event-not-allowed', 'info', { provider: this.config.provider, event, allowed: this.config.events });
-                    return res.status(200).json({ received: true, ignored: true });
-                }
-                // Parse payload
-                const payloadStr = req.body.toString('utf-8');
-                const payload = JSON.parse(payloadStr);
-                frameworkLogger.log('webhook-trigger', 'webhook-received', 'info', { provider: this.config.provider, event, payloadKeys: Object.keys(payload) });
-                // Create PostProcessor context
-                const context = {
-                    trigger: 'webhook',
-                    tool: this.config.provider || 'unknown',
-                    operation: `${this.config.provider || 'unknown'}:${event}`,
-                    commitSha: payload.after || '',
-                    repository: payload.repository?.full_name || '',
-                    branch: payload.ref?.replace('refs/heads/', '') || '',
-                    author: payload.sender?.login || '',
-                    files: this.extractFilesFromPayload(payload, event)
-                };
-                // Trigger PostProcessor
-                await this.triggerPostProcessor(context);
-                res.json({ received: true, event });
-                return;
-            }
-            catch (error) {
-                frameworkLogger.log('webhook-trigger', 'webhook-error', 'error', { provider: this.config.provider, error: error instanceof Error ? error.message : String(error) });
-                res.status(500).json({ error: 'Webhook processing failed' });
-                return;
-            }
-        });
-    }
-    verifySignature(payload, signature) {
-        if (!this.config.secret)
-            return true;
-        const { provider, secret } = this.config;
-        try {
-            switch (provider) {
-                case 'github':
-                    // GitHub HMAC signature: sha1=<hex> or sha256=<hex>
-                    const [algo, ghSignature] = signature.split('=');
-                    if (algo !== 'sha1' && algo !== 'sha256')
-                        return false;
-                    const githubHmac = crypto.createHmac(algo, secret);
-                    githubHmac.update(payload);
-                    const githubComputed = `${algo}=${githubHmac.digest('hex')}`;
-                    // SECURITY FIX: Use timingSafeEqual to prevent timing attacks
-                    try {
-                        const ghSigBuffer = Buffer.from(ghSignature || '');
-                        const ghComputedBuffer = Buffer.from(githubComputed);
-                        return crypto.timingSafeEqual(ghComputedBuffer, ghSigBuffer);
-                    }
-                    catch {
-                        return false;
-                    }
-                case 'gitlab':
-                    // GitLab X-Gitlab-Token: just a token compare
-                    const token = signature;
-                    // SECURITY FIX: Use timingSafeEqual to prevent timing attacks
-                    try {
-                        const secretBuffer = Buffer.from(secret);
-                        const tokenBuffer = Buffer.from(token || '');
-                        return crypto.timingSafeEqual(secretBuffer, tokenBuffer);
-                    }
-                    catch {
-                        return false;
-                    }
-                case 'stripe':
-                    // Stripe signature: timestamp.payload, signature (HMAC-SHA256)
-                    const parts = signature.split('.');
-                    if (parts.length !== 2)
-                        return false;
-                    const [timestamp, stripeSignature] = parts;
-                    const signedPayload = `${timestamp}.${payload.toString('utf-8')}`;
-                    const stripeHmac = crypto.createHmac('sha256', secret);
-                    stripeHmac.update(signedPayload);
-                    const stripeComputed = stripeHmac.digest('hex');
-                    // SECURITY FIX: Use timingSafeEqual to prevent timing attacks
-                    try {
-                        const stripeSigBuffer = Buffer.from(stripeSignature || '');
-                        const stripeComputedBuffer = Buffer.from(stripeComputed);
-                        return crypto.timingSafeEqual(stripeComputedBuffer, stripeSigBuffer);
-                    }
-                    catch {
-                        return false;
-                    }
-                default:
-                    return true;
-            }
-        }
-        catch (error) {
-            const errorMessage = error instanceof Error ? error.message : String(error);
-            frameworkLogger.log('webhook-trigger', 'signature-verification-error', 'error', { provider, error: errorMessage });
-            return false;
-        }
-    }
-    /**
-     * Extract files from webhook payload
-     *
-     * Different webhook providers have different payload structures.
-     * This method extracts files in a unified way.
-     */
-    extractFilesFromPayload(payload, _event) {
-        try {
-            // GitHub push event
-            const commits = payload.commits;
-            if (commits && Array.isArray(commits)) {
-                const files = new Set();
-                for (const commit of commits) {
-                    const typedCommit = commit;
-                    if (typedCommit.added && Array.isArray(typedCommit.added)) {
-                        typedCommit.added.forEach((f) => files.add(f));
-                    }
-                    if (typedCommit.modified && Array.isArray(typedCommit.modified)) {
-                        typedCommit.modified.forEach((f) => files.add(f));
-                    }
-                }
-                return Array.from(files);
-            }
-            // GitHub pull_request event
-            const pullRequest = payload.pull_request;
-            if (pullRequest && pullRequest.files) {
-                return pullRequest.files.map((f) => f.filename);
-            }
-            return [];
-        }
-        catch (error) {
-            frameworkLogger.log('webhook-trigger', 'file-extraction-failed', 'info', { provider: this.config.provider, error: error instanceof Error ? error.message : String(error) });
-            return [];
-        }
-    }
-    async triggerPostProcessor(context) {
-        await this.postProcessor.executePostProcessorLoop(context);
-    }
-    getApp() {
-        return this.app;
-    }
-    shutdown() {
-        this.initialized = false;
-    }
-}

package/dist/postprocessor/types.d.ts

@@ -1,227 +0,0 @@
-/**
- * Post-Processor Type Definitions
- */
-export interface PostProcessorConfig {
-    triggers: {
-        gitHooks: boolean;
-        webhooks: boolean;
-        api: boolean;
-    };
-    monitoring: {
-        enabled: boolean;
-        interval: number;
-        timeout: number;
-    };
-    autoFix: {
-        enabled: boolean;
-        confidenceThreshold: number;
-        maxAttempts: number;
-    };
-    maxAttempts: number;
-    retryDelay: number;
-    escalation: {
-        manualInterventionThreshold: number;
-        rollbackThreshold: number;
-        emergencyThreshold: number;
-    };
-    redeploy: {
-        maxRetries: number;
-        retryDelay: number;
-        backoffStrategy: "linear" | "exponential";
-        canaryEnabled: boolean;
-        canaryPhases: number;
-        canaryTrafficIncrement: number;
-        healthCheckTimeout: number;
-        rollbackOnFailure: boolean;
-    };
-    success: {
-        successConfirmation: boolean;
-        cleanupEnabled: boolean;
-        notificationEnabled: boolean;
-        metricsCollection: boolean;
-    };
-    reporting: {
-        enabled: boolean;
-        autoGenerate: boolean;
-        reportThreshold: number;
-        reportDir: string;
-        retentionDays: number;
-    };
-}
-export interface PostProcessorContext {
-    commitSha: string;
-    repository: string;
-    branch: string;
-    author: string;
-    files: string[];
-    trigger: "git-hook" | "webhook" | "api" | "manual";
-    tool?: string | undefined;
-    operation?: string | undefined;
-    testResults?: {
-        unit?: {
-            passed: boolean;
-            coverage: number;
-        };
-        integration?: {
-            passed: boolean;
-            coverage: number;
-        };
-        e2e?: {
-            passed: boolean;
-            coverage: number;
-        };
-        performance?: {
-            passed: boolean;
-            coverage: number;
-        };
-    };
-    directory?: string;
-    filePath?: string;
-    args?: Record<string, unknown>;
-}
-export interface PostProcessorResult {
-    success: boolean;
-    commitSha: string;
-    sessionId: string;
-    attempts: number;
-    monitoringResults?: MonitoringResult[];
-    fixesApplied?: AppliedFix[];
-    error?: string;
-    duration?: number;
-}
-export interface MonitoringResult {
-    commitSha: string;
-    overallStatus: "success" | "failure" | "running";
-    timestamp: Date;
-    ciStatus?: CIStatus;
-    performanceStatus?: PerformanceStatus;
-    securityStatus?: SecurityStatus;
-    failedJobs?: string[];
-    duration: number;
-}
-export interface AppliedFix {
-    type: string;
-    files: string[];
-    description: string;
-    timestamp: Date;
-    rollbackData?: unknown;
-}
-export interface FixResult {
-    success: boolean;
-    appliedFixes: AppliedFix[];
-    requiresManualIntervention: boolean;
-    confidence: number;
-    rollbackAvailable: boolean;
-}
-export interface CIStatus {
-    status: "success" | "failure" | "running";
-    failedJobs: string[];
-    totalJobs: number;
-    duration: number;
-}
-export interface PerformanceStatus {
-    status: "passed" | "failed" | "warning";
-    score: number;
-    regressions: string[];
-    duration: number;
-}
-export interface SecurityStatus {
-    status: "passed" | "failed" | "warning";
-    vulnerabilities: number;
-    criticalVulnerabilities: number;
-    scanDuration: number;
-}
-export interface FailureAnalysis {
-    category: string;
-    severity: "low" | "medium" | "high" | "critical";
-    confidence: number;
-    rootCause: string;
-    recommendedActions: string[];
-    suggestedFixes: SuggestedFix[];
-}
-export interface SuggestedFix {
-    type: "dependency-update" | "code-fix" | "config-change" | "test-regeneration";
-    confidence: number;
-    description: string;
-    files: string[];
-    changes: (Record<string, unknown> | string)[];
-}
-export interface FixResult {
-    success: boolean;
-    appliedFixes: AppliedFix[];
-    requiresManualIntervention: boolean;
-    confidence: number;
-    rollbackAvailable: boolean;
-}
-export interface EscalationResult {
-    level: "manual-intervention" | "rollback" | "emergency";
-    reason: string;
-    recommendations: string[];
-    incidentReport: IncidentReport;
-}
-export interface IncidentReport {
-    id: string;
-    commitSha: string;
-    timestamp: Date;
-    severity: string;
-    affectedSystems: string[];
-    rootCause: string;
-    impact: string;
-    resolution: string;
-    timeline: EventTimeline[];
-}
-export interface EventTimeline {
-    timestamp: Date;
-    event: string;
-    details: string;
-}
-export interface RedeployResult {
-    success: boolean;
-    deploymentId: string;
-    commitSha: string;
-    environment: string;
-    duration: number;
-    error?: string;
-    rollbackPerformed?: boolean;
-    canaryResults?: CanaryResult[];
-}
-export interface CanaryResult {
-    phase: number;
-    trafficPercentage: number;
-    success: boolean;
-    metrics: {
-        responseTime: number;
-        errorRate: number;
-        throughput: number;
-    };
-    duration: number;
-}
-export type PostProcessorEvent = {
-    type: "initialized";
-    config: PostProcessorConfig;
-} | {
-    type: "loop-started";
-    context: PostProcessorContext;
-} | {
-    type: "monitoring-completed";
-    result: MonitoringResult;
-} | {
-    type: "failure-detected";
-    analysis: FailureAnalysis;
-} | {
-    type: "fix-applied";
-    result: FixResult;
-} | {
-    type: "redeployment-initiated";
-    commitSha: string;
-} | {
-    type: "loop-completed";
-    result: PostProcessorResult;
-} | {
-    type: "escalation-triggered";
-    result: EscalationResult;
-} | {
-    type: "error";
-    error: Error;
-    context: PostProcessorContext;
-};

package/dist/postprocessor/types.js

@@ -1,4 +0,0 @@
-/**
- * Post-Processor Type Definitions
- */
-export {};

package/dist/processors/doc-write-guard.d.ts

@@ -1,6 +0,0 @@
-export declare class DocWriteGuard {
-    static append(filePath: string, content: string): Promise<void>;
-    static createIfMissing(filePath: string, content: string): Promise<void>;
-    static isDocFile(filePath: string): boolean;
-    static isDocPath(filePath: string): boolean;
-}

package/dist/processors/doc-write-guard.js

@@ -1,46 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-import { frameworkLogger } from "../core/framework-logger.js";
-const DOC_EXTENSIONS = [".md", ".mdx", ".txt"];
-const DOC_DIRS = ["docs/", "docs/reflections/", "docs/reflections/deep/"];
-export class DocWriteGuard {
-    static async append(filePath, content) {
-        if (!DocWriteGuard.isDocFile(filePath)) {
-            throw new Error(`DocWriteGuard: ${filePath} is not a doc file`);
-        }
-        if (!fs.existsSync(filePath)) {
-            throw new Error(`DocWriteGuard: ${filePath} does not exist — use createIfMissing() instead`);
-        }
-        fs.appendFileSync(filePath, content);
-        frameworkLogger.log("doc-write-guard", "append", "info", {
-            filePath,
-            contentLength: content.length,
-        });
-    }
-    static async createIfMissing(filePath, content) {
-        if (!DocWriteGuard.isDocFile(filePath)) {
-            throw new Error(`DocWriteGuard: ${filePath} is not a doc file`);
-        }
-        if (fs.existsSync(filePath)) {
-            frameworkLogger.log("doc-write-guard", "create-skipped-exists", "info", { filePath });
-            return;
-        }
-        const dir = path.dirname(filePath);
-        if (!fs.existsSync(dir)) {
-            fs.mkdirSync(dir, { recursive: true });
-        }
-        fs.writeFileSync(filePath, content, "utf-8");
-        frameworkLogger.log("doc-write-guard", "create", "info", {
-            filePath,
-            contentLength: content.length,
-        });
-    }
-    static isDocFile(filePath) {
-        const ext = path.extname(filePath).toLowerCase();
-        return DOC_EXTENSIONS.includes(ext);
-    }
-    static isDocPath(filePath) {
-        const normalized = filePath.replace(/\\/g, "/");
-        return DOC_DIRS.some((dir) => normalized.startsWith(dir));
-    }
-}

package/dist/processors/implementations/agents-md-validation-processor.d.ts

@@ -1,62 +0,0 @@
-/**
- * AGENTS.md Validation Processor
- *
- * Pre-processor that validates AGENTS.md exists and is up-to-date before
- * allowing commits. Integrates with 0xRay's processor pipeline.
- *
- * @processor_type pre
- * @priority 90 (high - runs early)
- * @blocking true (blocks commit if AGENTS.md is invalid)
- *
- * @framework 0xRay 1.3.5
- */
-export interface AgentsMdValidationResult {
-    valid: boolean;
-    errors: string[];
-    warnings: string[];
-    fixes?: string[];
-}
-export declare class AgentsMdValidationProcessor {
-    private projectRoot;
-    private agentsPath;
-    private readonly REQUIRED_SECTIONS;
-    private readonly REQUIRED_AGENTS;
-    private readonly RECOMMENDED_SECTIONS;
-    constructor(projectRoot?: string);
-    /**
-     * Main execution method - called by ProcessorManager
-     */
-    execute(context: {
-        tool: string;
-        args?: {
-            filePath?: string;
-            content?: string;
-        };
-        operation: string;
-    }): Promise<{
-        success: boolean;
-        blocked: boolean;
-        message: string;
-        result?: AgentsMdValidationResult;
-    }>;
-    /**
-     * Determine if the change is agent-related
-     */
-    private isAgentRelatedChange;
-    /**
-     * Validate AGENTS.md file
-     */
-    private validateAgentsMd;
-    /**
-     * Calculate days since date
-     */
-    private calculateDaysOld;
-    private getPackageVersion;
-    private getSectionTemplate;
-    appendMissing(): Promise<{
-        success: boolean;
-        message: string;
-        added: string[];
-    }>;
-}
-export declare const agentsMdValidationProcessor: AgentsMdValidationProcessor;