0xray 4.0.13 → 4.0.14

package/dist/execution/proposal-applier.js

@@ -0,0 +1,254 @@
+import * as fs from "fs";
+import * as path from "path";
+import { spawnSync } from "child_process";
+import { frameworkLogger } from "../core/framework-logger.js";
+function sanitizeGitArgument(s) {
+    if (!/^[a-zA-Z0-9 \-_.\/@]+$/.test(s)) {
+        throw new Error("Invalid git argument: contains disallowed characters");
+    }
+    return s;
+}
+export class ProposalApplier {
+    projectRoot;
+    codeChangeCallback;
+    reviewCallback;
+    constructor(projectRoot = process.cwd(), codeChangeCallback, reviewCallback) {
+        this.projectRoot = projectRoot;
+        this.codeChangeCallback = codeChangeCallback;
+        this.reviewCallback = reviewCallback;
+    }
+    async applyProposals(proposals) {
+        frameworkLogger.log("execution", "proposal-applier-start", "info", {
+            count: proposals.length,
+        });
+        const results = [];
+        for (const proposal of proposals) {
+            const result = await this.applyProposal(proposal);
+            results.push(result);
+        }
+        return results;
+    }
+    async applyProposal(p) {
+        frameworkLogger.log("execution", "apply-proposal", "info", {
+            proposalId: p.id,
+            type: p.type,
+        });
+        if (p.type === "codify") {
+            return this.applyCodification(p);
+        }
+        const branchName = `inference/${p.type}-${Date.now()}`;
+        const isGit = this.isInsideGitRepo();
+        try {
+            this.recordAppliedProposal(p);
+            const changedFiles = [
+                path.relative(this.projectRoot, this.getAppliedMarkerPath(p)),
+            ];
+            if (isGit) {
+                const branchR = spawnSync('git', ['checkout', '-b', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (branchR.status !== 0) {
+                    throw new Error(`git checkout -b failed: ${(branchR.stderr || '').toString().trim()}`);
+                }
+            }
+            if (this.codeChangeCallback) {
+                const changed = await this.codeChangeCallback(p);
+                if (!changed) {
+                    if (isGit) {
+                        spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                        spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                    }
+                    return {
+                        proposalId: p.id,
+                        success: false,
+                        error: "Code change returned false (no changes applied)",
+                    };
+                }
+            }
+            if (isGit) {
+                const addR = spawnSync('git', ['add', '-A'], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (addR.status !== 0) {
+                    throw new Error(`git add failed: ${(addR.stderr || '').toString().trim()}`);
+                }
+                const commitR = spawnSync('git', ['commit', '-m', p.title], { cwd: this.projectRoot, stdio: 'pipe' });
+                if (commitR.status !== 0) {
+                    throw new Error(`git commit failed: ${(commitR.stderr || '').toString().trim()}`);
+                }
+                const prUrl = this.createPR(p, branchName);
+                if (prUrl) {
+                    frameworkLogger.log("execution", "pr-created", "info", {
+                        prUrl,
+                        proposalId: p.id,
+                    });
+                }
+                if (this.reviewCallback && prUrl) {
+                    const review = await this.reviewCallback(p, prUrl);
+                    if (review === "no-go") {
+                        frameworkLogger.log("execution", "review-no-go", "warning", {
+                            proposalId: p.id,
+                            prUrl,
+                        });
+                        spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                        spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                        return {
+                            proposalId: p.id,
+                            success: false,
+                            error: "Researcher review rejected proposal",
+                        };
+                    }
+                }
+                spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+            }
+            return {
+                proposalId: p.id,
+                success: true,
+                filesChanged: changedFiles,
+                details: [
+                    "Proposal applied by Autonomous Engine (ProposalApplier)",
+                    isGit ? `branch=${branchName}` : "non-git (marker only)",
+                    `type=${p.type}`,
+                ],
+            };
+        }
+        catch (err) {
+            const errorMsg = err.message;
+            frameworkLogger.log("execution", "apply-proposal-error", "error", {
+                proposalId: p.id,
+                error: errorMsg,
+            });
+            if (isGit) {
+                try {
+                    spawnSync('git', ['checkout', 'master'], { cwd: this.projectRoot, stdio: 'pipe' });
+                    spawnSync('git', ['branch', '-D', branchName], { cwd: this.projectRoot, stdio: 'pipe' });
+                }
+                catch {
+                    // ignore cleanup
+                }
+            }
+            return {
+                proposalId: p.id,
+                success: false,
+                error: errorMsg,
+            };
+        }
+    }
+    applyCodification(p) {
+        try {
+            const catalogPath = path.join(this.projectRoot, "docs", "pattern-catalog.md");
+            const dir = path.dirname(catalogPath);
+            if (!fs.existsSync(dir))
+                fs.mkdirSync(dir, { recursive: true });
+            const entry = `\n## ${p.title}\n\n${p.description}\n\n**Evidence:** ${p.evidence.length} sessions\n`;
+            fs.appendFileSync(catalogPath, entry);
+            frameworkLogger.log("execution", "codification-applied", "info", {
+                proposalId: p.id,
+                catalogPath,
+                module: "v2-refactor",
+            });
+            return {
+                proposalId: p.id,
+                success: true,
+                details: ["codification written to docs/pattern-catalog.md"],
+            };
+        }
+        catch (err) {
+            const errorMsg = err.message;
+            frameworkLogger.log("execution", "codification-failed", "error", {
+                proposalId: p.id,
+                error: errorMsg,
+                module: "v2-refactor",
+            });
+            return { proposalId: p.id, success: false, error: errorMsg };
+        }
+    }
+    isInsideGitRepo() {
+        try {
+            const r = spawnSync('git', ['rev-parse', '--is-inside-work-tree'], {
+                cwd: this.projectRoot,
+                stdio: 'pipe',
+                timeout: 2000,
+            });
+            return r.status === 0;
+        }
+        catch {
+            return false;
+        }
+    }
+    getAppliedMarkerPath(p) {
+        const appliedDir = path.join(this.projectRoot, "docs", "inference", "applied");
+        if (!fs.existsSync(appliedDir)) {
+            fs.mkdirSync(appliedDir, { recursive: true });
+        }
+        return path.join(appliedDir, `${p.id.replace(/[^a-z0-9_-]/gi, "-")}.md`);
+    }
+    recordAppliedProposal(p) {
+        const markerPath = this.getAppliedMarkerPath(p);
+        const content = [
+            `# Applied Inference Proposal`,
+            ``,
+            `**ID:** ${p.id}`,
+            `**Type:** ${p.type}`,
+            `**Title:** ${p.title}`,
+            `**Description:** ${p.description}`,
+            ``,
+            `**Source:** ${p.source}`,
+            `**Confidence:** ${(p.confidence * 100).toFixed(0)}%`,
+            `**Evidence:**`,
+            ...p.evidence.map((e) => `- ${e}`),
+            ``,
+            `**Applied At:** ${new Date().toISOString()}`,
+            `**Applied By:** Autonomous Engine (ProposalApplier) — PHASE1-02b`,
+            ``,
+            `Marker proves Governance-approved proposal executed by Engine.`,
+        ].join("\n");
+        fs.writeFileSync(markerPath, content, "utf-8");
+        frameworkLogger.log("execution", "proposal-recorded", "info", {
+            proposalId: p.id,
+            markerPath: path.relative(this.projectRoot, markerPath),
+            module: "v2-refactor",
+        });
+    }
+    createPR(p, branchName) {
+        try {
+            sanitizeGitArgument(p.title);
+            sanitizeGitArgument(branchName);
+            const pushR = spawnSync('git', ['push', '-u', 'origin', branchName], {
+                cwd: this.projectRoot,
+                stdio: 'pipe',
+                timeout: 30000,
+            });
+            if (pushR.status !== 0) {
+                throw new Error(`git push failed: ${(pushR.stderr || '').toString().trim()}`);
+            }
+            const body = [
+                "## Inference Proposal (Autonomous Engine)",
+                "",
+                p.description,
+                "",
+                `**Type:** ${p.type}  **Confidence:** ${(p.confidence * 100).toFixed(0)}%`,
+                "",
+                "## Evidence",
+                p.evidence.slice(0, 5).join("\n"),
+                "",
+                "Executed by ProposalApplier (Engine-owned) — V2 Phase 1.",
+            ].join("\n");
+            const ghR = spawnSync('gh', ['pr', 'create', '--head', branchName, '--title', p.title, '--body', body], {
+                cwd: this.projectRoot,
+                encoding: 'utf-8',
+                stdio: 'pipe',
+                timeout: 30000,
+            });
+            if (ghR.status !== 0) {
+                throw new Error(`gh pr create failed: ${ghR.stderr || 'unknown error'}`);
+            }
+            return (ghR.stdout || '').trim();
+        }
+        catch (err) {
+            frameworkLogger.log("execution", "pr-create-failed", "warning", {
+                error: String(err),
+                proposalId: p.id,
+                module: "v2-refactor",
+            });
+            return "";
+        }
+    }
+}
+export const proposalApplier = new ProposalApplier();

package/dist/governance/codex-policy.service.d.ts

@@ -0,0 +1,56 @@
+/**
+ * CodexPolicyService
+ *
+ * The initial Governance-owned Single Source of Truth (SSOT) for Codex / policy loading.
+ * This is the V2-P1-S02-REAL first concrete migration slice.
+ *
+ * Role (per 3-subsystem architecture + researcher mapping):
+ *   - External Governance (Decision Layer & SSOT) owns "what the policy is".
+ *   - All consumers (enforcement CodexLoader, injectors, formatters, MCP surfaces, plugins)
+ *     will eventually ask here instead of performing direct fs reads.
+ *
+ * Current scope (minimal safe skeleton):
+ *   - Read-only query surface.
+ *   - Uses canonical resolveCodexPath + async file load (no duplication of resolution logic).
+ *   - Returns ActiveCodexSnapshot compatible with the existing get_active_codex MCP tool.
+ *   - Provides getTermCount() with safe 60-term fallback (preserves prior behavior of bypasses).
+ *   - Full frameworkLogger discipline on every load/decision/error.
+ *   - No caching in v1 skeleton (additive later); no mutation; no enforcement.
+ *
+ * First wired consumer: src/mcps/enforcer-tools.server.ts (getCodexTermCount bypass removed;
+ * now delegates through this service).
+ *
+ * Next recommended slices (documented in researcher mapping append):
+ *   - Wire governance.server.ts handleGetActiveCodex to delegate (remove its direct read).
+ *   - S02b/S02c follow-ups: update codex-injector, context-loader, codex-formatter, plugin.
+ *   - Make CodexLoader delegate its raw data load here, then re-export from governance.
+ *
+ * @module governance/codex-policy.service
+ */
+import type { ActiveCodexSnapshot, ICodexPolicyProvider } from './governance-types.js';
+/**
+ * Canonical implementation of the Governance Codex/Policy provider.
+ * Single owner of the "first read" of any codex.json for the framework.
+ */
+export declare class CodexPolicyService implements ICodexPolicyProvider {
+    private readonly component;
+    /**
+     * Internal loader: resolves candidates, picks first existing, reads + parses.
+     * Always logs via frameworkLogger (success, error, fallback).
+     */
+    private loadRaw;
+    private computeTermCount;
+    private getBuiltinFallback;
+    /**
+     * Primary SSOT query: returns the ActiveCodexSnapshot.
+     * Matches (and is the intended backing impl for) the get_active_codex MCP response.
+     */
+    getCurrentCodex(includeRaw?: boolean): Promise<ActiveCodexSnapshot>;
+    /**
+     * Convenience: just the term count.
+     * Preserves historical caller behavior (hard 60 fallback when everything fails).
+     */
+    getTermCount(): Promise<number>;
+}
+export declare function getCodexPolicyService(): CodexPolicyService;
+export { CodexPolicyService as default };

package/dist/governance/codex-policy.service.js

@@ -0,0 +1,166 @@
+/**
+ * CodexPolicyService
+ *
+ * The initial Governance-owned Single Source of Truth (SSOT) for Codex / policy loading.
+ * This is the V2-P1-S02-REAL first concrete migration slice.
+ *
+ * Role (per 3-subsystem architecture + researcher mapping):
+ *   - External Governance (Decision Layer & SSOT) owns "what the policy is".
+ *   - All consumers (enforcement CodexLoader, injectors, formatters, MCP surfaces, plugins)
+ *     will eventually ask here instead of performing direct fs reads.
+ *
+ * Current scope (minimal safe skeleton):
+ *   - Read-only query surface.
+ *   - Uses canonical resolveCodexPath + async file load (no duplication of resolution logic).
+ *   - Returns ActiveCodexSnapshot compatible with the existing get_active_codex MCP tool.
+ *   - Provides getTermCount() with safe 60-term fallback (preserves prior behavior of bypasses).
+ *   - Full frameworkLogger discipline on every load/decision/error.
+ *   - No caching in v1 skeleton (additive later); no mutation; no enforcement.
+ *
+ * First wired consumer: src/mcps/enforcer-tools.server.ts (getCodexTermCount bypass removed;
+ * now delegates through this service).
+ *
+ * Next recommended slices (documented in researcher mapping append):
+ *   - Wire governance.server.ts handleGetActiveCodex to delegate (remove its direct read).
+ *   - S02b/S02c follow-ups: update codex-injector, context-loader, codex-formatter, plugin.
+ *   - Make CodexLoader delegate its raw data load here, then re-export from governance.
+ *
+ * @module governance/codex-policy.service
+ */
+import { frameworkLogger } from '../core/framework-logger.js';
+import { resolveCodexPath } from '../core/config-paths.js';
+import { existsSync } from 'fs';
+import * as fs from 'fs/promises';
+/**
+ * Canonical implementation of the Governance Codex/Policy provider.
+ * Single owner of the "first read" of any codex.json for the framework.
+ */
+export class CodexPolicyService {
+    component = 'codex-policy-service';
+    /**
+     * Internal loader: resolves candidates, picks first existing, reads + parses.
+     * Always logs via frameworkLogger (success, error, fallback).
+     */
+    async loadRaw() {
+        const candidates = resolveCodexPath();
+        const resolvedPath = Array.isArray(candidates)
+            ? candidates.find((p) => existsSync(p)) || candidates[0] || null
+            : candidates || null;
+        if (!resolvedPath || !existsSync(resolvedPath)) {
+            await frameworkLogger.log(this.component, 'codex-not-found', 'warning', {
+                candidates,
+                resolvedPath,
+                message: 'No codex.json found in standard locations; using fallback behavior',
+            });
+            return { path: resolvedPath, data: this.getBuiltinFallback(), isFallback: true };
+        }
+        try {
+            const content = await fs.readFile(resolvedPath, 'utf-8');
+            const data = JSON.parse(content);
+            const termCount = this.computeTermCount(data);
+            await frameworkLogger.log(this.component, 'codex-loaded', 'success', {
+                source: resolvedPath,
+                version: data?.version || 'unknown',
+                termCount,
+                lastUpdated: data?.lastUpdated,
+            });
+            return { path: resolvedPath, data, isFallback: false };
+        }
+        catch (error) {
+            const msg = error instanceof Error ? error.message : String(error);
+            await frameworkLogger.log(this.component, 'codex-load-error', 'error', {
+                source: resolvedPath,
+                error: msg,
+            });
+            // Safe fallback (never break callers)
+            return { path: resolvedPath, data: this.getBuiltinFallback(), isFallback: true };
+        }
+    }
+    computeTermCount(data) {
+        if (!data)
+            return 0;
+        const terms = data.terms;
+        if (Array.isArray(terms))
+            return terms.length;
+        if (terms && typeof terms === 'object')
+            return Object.keys(terms).length;
+        if (Array.isArray(data.codex_terms))
+            return data.codex_terms.length;
+        return 0;
+    }
+    getBuiltinFallback() {
+        // Minimal structural fallback matching historical default (60 terms expectation)
+        // In real usage this should rarely be hit; the canonical files always exist in dev.
+        return {
+            version: 'builtin-fallback',
+            lastUpdated: new Date().toISOString(),
+            errorPreventionTarget: 0.99,
+            terms: {}, // empty; termCount will be 0 but callers fall back to 60 at getTermCount level
+        };
+    }
+    /**
+     * Primary SSOT query: returns the ActiveCodexSnapshot.
+     * Matches (and is the intended backing impl for) the get_active_codex MCP response.
+     */
+    async getCurrentCodex(includeRaw = false) {
+        const { path, data, isFallback } = await this.loadRaw();
+        const termCount = this.computeTermCount(data);
+        const versionRaw = data?.version ?? data?.codex_version;
+        const version = typeof versionRaw === 'string' ? versionRaw : 'unknown';
+        const lastUpdatedRaw = data?.lastUpdated ?? data?.last_updated;
+        const lastUpdated = typeof lastUpdatedRaw === 'string' ? lastUpdatedRaw : '';
+        const snapshot = {
+            source: path,
+            loaded_at: new Date().toISOString(),
+            term_count: termCount,
+            version,
+            last_updated: lastUpdated,
+            governance_ssot: !isFallback,
+            is_fallback: isFallback,
+            note: isFallback
+                ? 'Governance CodexPolicyService — builtin fallback (no external codex.json resolved)'
+                : 'Returned via Governance CodexPolicyService — V2 Single Source of Truth (S02-REAL)',
+            dynamo_required: true,
+            ...(includeRaw ? { codex: data } : {}),
+        };
+        await frameworkLogger.log(this.component, 'get-current-codex', 'info', {
+            source: path,
+            termCount: snapshot.term_count,
+            version: snapshot.version,
+            isFallback,
+            includeRaw,
+        });
+        return snapshot;
+    }
+    /**
+     * Convenience: just the term count.
+     * Preserves historical caller behavior (hard 60 fallback when everything fails).
+     */
+    async getTermCount() {
+        try {
+            const snapshot = await this.getCurrentCodex(false);
+            if (snapshot.term_count > 0) {
+                return snapshot.term_count;
+            }
+            // If loaded but 0 terms (e.g. empty or fallback shape), honor historical default
+            return 60;
+        }
+        catch (error) {
+            await frameworkLogger.log(this.component, 'get-term-count-fallback', 'warning', {
+                error: error instanceof Error ? error.message : String(error),
+                fallback: 60,
+            });
+            return 60;
+        }
+    }
+}
+// Singleton (matches pattern used by GovernanceService)
+let codexPolicyServiceInstance = null;
+export function getCodexPolicyService() {
+    if (!codexPolicyServiceInstance) {
+        codexPolicyServiceInstance = new CodexPolicyService();
+    }
+    return codexPolicyServiceInstance;
+}
+// Also export the class for direct construction in tests / advanced wiring
+export { CodexPolicyService as default };

package/dist/governance/governance-core.d.ts

@@ -0,0 +1,53 @@
+/**
+ * Pure governance decision logic.
+ * This module contains the PHI/TAU matrix and merging rules.
+ * It has no side effects and does not call any MCPs.
+ *
+ * This is the shared "pure logic" that both the Governance MCP
+ * and any HTTP deployment (Vercel) can use.
+ */
+import type { GovernanceVote, GovernanceResult } from './governance-types.js';
+export interface DecisionMatrixInput {
+    resonance: number;
+    isotopicRatio: number;
+    vortexVolume?: number;
+    historicalCoherence?: number;
+    solarActivity?: 'quiet' | 'moderate' | 'active' | 'storm';
+    moralTension?: 'Aligned' | 'Mild' | 'Significant' | 'Critical';
+    moralScore?: number;
+    moralFusion?: number;
+}
+export interface DecisionMatrixOutput {
+    recommendation: 'PASS' | 'NEEDS_REVISION' | 'REJECT';
+    confidence: number;
+    voteWeight: number;
+    reasons: string[];
+    moralOverride?: 'rejected_critical' | 'downgraded_significant' | 'none';
+}
+export declare const MORAL_OVERRIDE_LEVELS: {
+    Critical: "rejected_critical";
+    Significant: "downgraded_significant";
+    Mild: "none";
+    Aligned: "none";
+};
+export type MoralOverrideThreshold = 'Critical' | 'Significant' | 'Mild' | 'Aligned' | 'disabled';
+/**
+ * The core PHI/TAU decision matrix.
+ * Extracted so it can be shared between local MCP and deployed HTTP versions.
+ */
+export declare function applyDecisionMatrix(input: DecisionMatrixInput): DecisionMatrixOutput;
+/**
+ * Simple weighted merge of votes from multiple servers + external.
+ */
+export declare function mergeVotes(votes: GovernanceVote[]): {
+    finalDecision: GovernanceResult['finalDecision'];
+    averageConfidence: number;
+    reasoningSummary: string;
+};
+export interface MetamorphosisInput {
+    averageConfidence: number;
+    proposalType: 'fix' | 'automate' | 'codify' | 'compliance';
+    historicalCoherence?: number;
+    resonanceScore?: number;
+}
+export declare function calculateMetamorphosisScore(input: MetamorphosisInput): number;