@abelxiaoxing/cadence 1.8.3 → 2.0.0

package/src/evidence-draft.ts

@@ -1,122 +0,0 @@
-import { StringEnum } from "@earendil-works/pi-ai";
-import { Type } from "typebox";
-import { AGENTS_IMPACTS, RELATIVE_PATH_PATTERN } from "./contracts.ts";
-
-// The authoring boundary is smaller than the sealed EvidenceResult. Only
-// code-owned identity and explicitly advisory fields may be omitted.
-const advisoryStrings = () => Type.Optional(Type.Array(Type.String()));
-const relativePath = () =>
-  Type.String({
-    pattern: RELATIVE_PATH_PATTERN,
-    minLength: 1,
-    maxLength: 512,
-    description:
-      "Canonical workspace-relative path or module slug; no absolute paths, ./, .., backslashes, or trailing slash.",
-  });
-const pathSet = (minItems = 0) =>
-  Type.Array(relativePath(), { uniqueItems: true, minItems });
-
-export function evidenceDraftSchema(requestId: string, role: string) {
-  const identity = {
-    id: Type.Optional(
-      Type.Literal(requestId, {
-        description:
-          "Omit: bound by the submit tool. If supplied, must match this request.",
-      }),
-    ),
-    role: Type.Optional(Type.Literal(role)),
-    kind: Type.Optional(Type.Literal("evidence")),
-  };
-  return role === "design-explorer"
-    ? Type.Object(
-        {
-          ...identity,
-          packet_id: Type.Optional(Type.Literal(requestId)),
-          module_name: relativePath(),
-          scope: pathSet(1),
-          files_read: pathSet(),
-          evidence: Type.Array(
-            Type.Object(
-              {
-                claim: Type.String({ minLength: 1 }),
-                path: relativePath(),
-                line_start: Type.Integer({ minimum: 1 }),
-                line_end: Type.Integer({
-                  minimum: 1,
-                  description:
-                    "Inclusive end line, greater than or equal to line_start.",
-                }),
-              },
-              { additionalProperties: false },
-            ),
-          ),
-          existing_structures: advisoryStrings(),
-          existing_conventions: advisoryStrings(),
-          constraints_discovered: Type.Array(Type.String()),
-          open_questions: Type.Array(Type.String()),
-          dependencies: advisoryStrings(),
-          write_set_hints: Type.Optional(pathSet()),
-          validation_hints: advisoryStrings(),
-          agents_impact_hints: advisoryStrings(),
-          risks: Type.Array(Type.String()),
-          success_criteria_hints: advisoryStrings(),
-        },
-        { additionalProperties: false },
-      )
-    : Type.Object(
-        {
-          ...identity,
-          conclusions: Type.Array(Type.String()),
-          citations: Type.Array(
-            Type.Object(
-              { path: relativePath(), lines: Type.String() },
-              { additionalProperties: false },
-            ),
-          ),
-          constraints: Type.Array(Type.String()),
-          dependencies: advisoryStrings(),
-          risks: Type.Array(Type.String()),
-          blockingQuestions: Type.Array(Type.String()),
-          hints: Type.Optional(
-            Type.Object(
-              {
-                writeSet: pathSet(),
-                verification: Type.String(),
-                agentsImpact: StringEnum(AGENTS_IMPACTS),
-              },
-              { additionalProperties: false },
-            ),
-          ),
-        },
-        { additionalProperties: false },
-      );
-}
-
-export function completeEvidenceDraft(
-  value: unknown,
-  requestId: string,
-  role: string,
-): unknown {
-  if (!value || typeof value !== "object" || Array.isArray(value)) return value;
-  const draft = value as Record<string, unknown>;
-  const defaults: Record<string, unknown> = {
-    id: requestId,
-    role,
-    kind: "evidence",
-    dependencies: [],
-    ...(role === "design-explorer"
-      ? {
-          packet_id: requestId,
-          existing_structures: [],
-          existing_conventions: [],
-          write_set_hints: [],
-          validation_hints: [],
-          agents_impact_hints: [],
-          success_criteria_hints: [],
-        }
-      : { hints: { writeSet: [], verification: "", agentsImpact: "none" } }),
-  };
-  // Defaults mean "no advisory information supplied", never verified facts or
-  // authority. Explicit wrong values (including null/undefined) survive validation.
-  return { ...defaults, ...draft };
-}

package/src/execution-profile.ts

@@ -1,64 +0,0 @@
-import path from "node:path";
-import { fileURLToPath } from "node:url";
-
-export interface ExecutionProfile {
-  mode: "isolated" | "local-trusted" | "host-trusted";
-  timeoutMs: number;
-  bwrapPath: string;
-  inheritEnvironment: string[];
-  windowsHelperPath?: string;
-}
-
-/** Operator configuration only. Unknown modes never silently disable isolation. */
-export function executionProfile(
-  env: NodeJS.ProcessEnv = process.env,
-): ExecutionProfile {
-  const mode = env.ABEL_EXECUTION_MODE ?? "isolated";
-  if (
-    mode !== "isolated" &&
-    mode !== "local-trusted" &&
-    mode !== "host-trusted"
-  )
-    throw new Error("execution-mode-invalid");
-  const timeoutMs = Number(env.ABEL_VERIFICATION_TIMEOUT_MS ?? 600_000);
-  if (
-    !Number.isSafeInteger(timeoutMs) ||
-    timeoutMs < 1 ||
-    timeoutMs > 86_400_000
-  )
-    throw new Error("verification-timeout-invalid");
-  const inheritEnvironment = (env.ABEL_VERIFICATION_ENV ?? "")
-    .split(",")
-    .map((name) => name.trim())
-    .filter(Boolean);
-  if (
-    inheritEnvironment.some((name) => !/^[A-Za-z_][A-Za-z0-9_]*$/u.test(name))
-  )
-    throw new Error("verification-environment-names-invalid");
-  if (mode === "isolated" && inheritEnvironment.length)
-    throw new Error("verification-environment-requires-trusted-mode");
-  if (
-    mode === "host-trusted" &&
-    env.ABEL_WINDOWS_JOB_HELPER !== undefined &&
-    (!env.ABEL_WINDOWS_JOB_HELPER ||
-      env.ABEL_WINDOWS_JOB_HELPER.includes("\0") ||
-      !(
-        path.isAbsolute(env.ABEL_WINDOWS_JOB_HELPER) ||
-        path.win32.isAbsolute(env.ABEL_WINDOWS_JOB_HELPER)
-      ))
-  )
-    throw new Error("windows-job-helper-path-invalid");
-  return {
-    mode,
-    timeoutMs,
-    bwrapPath: env.ABEL_BWRAP_PATH ?? "/usr/bin/bwrap",
-    inheritEnvironment,
-    ...(mode === "host-trusted"
-      ? {
-          windowsHelperPath:
-            env.ABEL_WINDOWS_JOB_HELPER ??
-            fileURLToPath(new URL("./windows-job.exe", import.meta.url)),
-        }
-      : {}),
-  };
-}

package/src/execution-retention.ts

@@ -1,77 +0,0 @@
-import { randomUUID } from "node:crypto";
-import {
-  closeSync,
-  fsyncSync,
-  lstatSync,
-  openSync,
-  readdirSync,
-  unlinkSync,
-  writeFileSync,
-} from "node:fs";
-import path from "node:path";
-import { syncDirectory } from "./directory-sync.ts";
-
-const prefix = ".cadence-execution-";
-const active = new Set<string>();
-const retained = new Map<string, readonly string[]>();
-/** Written before launching a host process. Absence of a settlement receipt
- * survives host loss; reopening must not infer ownership from a recycled PID. */
-export function retainExecution(ownerRoot: string, roots: readonly string[]) {
-  assertExecutionsSettled(ownerRoot);
-  const file = path.join(ownerRoot, `${prefix}${randomUUID()}.json`);
-  const fd = openSync(file, "wx", 0o600);
-  try {
-    writeFileSync(
-      fd,
-      JSON.stringify({
-        version: 1,
-        roots: roots.map((root) => path.resolve(root)),
-      }),
-    );
-    fsyncSync(fd);
-  } finally {
-    closeSync(fd);
-  }
-  syncDirectory(ownerRoot);
-  active.add(file);
-  retained.set(file, roots);
-  return {
-    settled() {
-      unlinkSync(file);
-      syncDirectory(ownerRoot);
-      active.delete(file);
-      retained.delete(file);
-    },
-    uncertain() {
-      active.delete(file);
-    },
-  };
-}
-export function assertExecutionsSettled(
-  ownerRoot: string,
-  includeActive = false,
-): void {
-  if (!lstatSync(ownerRoot, { throwIfNoEntry: false })) return;
-  if (
-    readdirSync(ownerRoot).some(
-      (name) =>
-        name.startsWith(prefix) &&
-        (includeActive || !active.has(path.join(ownerRoot, name))),
-    )
-  )
-    throw new Error("isolation-termination-unconfirmed");
-}
-export function isExecutionRetained(root: string): boolean {
-  const resolved = path.resolve(root);
-  return [...retained.values()].some((roots) =>
-    roots.some((candidate) => {
-      const relative = path.relative(resolved, path.resolve(candidate));
-      return (
-        relative === "" ||
-        (relative !== ".." &&
-          !relative.startsWith(`..${path.sep}`) &&
-          !path.isAbsolute(relative))
-      );
-    }),
-  );
-}

package/src/file-snapshot.ts

@@ -1,163 +0,0 @@
-// File-level snapshots: content hashes for observed files, deterministic
-// recursive content manifests for observed directories, and explicit absent
-// markers for proposed new paths. Currency is decided per bound path; no
-// global workspace revision participates.
-import { createHash } from "node:crypto";
-import { lstatSync, readdirSync, readFileSync, readlinkSync } from "node:fs";
-import { join, resolve } from "node:path";
-
-import { observeSafePath } from "./safe-path.ts";
-
-export interface FileBound {
-  kind: "file";
-  sha256: string;
-  bytes: number;
-}
-
-export interface DirBound {
-  kind: "dir";
-  manifest: string;
-}
-
-export interface AbsentBound {
-  kind: "absent";
-  absent: true;
-}
-
-export type Bound = Record<string, FileBound | DirBound | AbsentBound>;
-
-function sha256(bytes: Buffer): string {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-/** Hash bytes with the same identity used by file and workspace snapshots. */
-export function snapshotContentHash(bytes: Uint8Array): string {
-  return createHash("sha256").update(bytes).digest("hex");
-}
-
-/** Snapshot one existing regular file under root. */
-export function snapshotFile(root: string, relPath: string): FileBound | null {
-  if (observeSafePath(root, relPath).kind !== "file") return null;
-  const abs = resolve(root, relPath);
-  const bytes = readFileSync(abs);
-  return { sha256: sha256(bytes), bytes: bytes.length, kind: "file" };
-}
-
-function updateManifest(
-  hash: ReturnType<typeof createHash>,
-  ...fields: Array<string | Buffer>
-): void {
-  for (const field of fields) {
-    const bytes = typeof field === "string" ? Buffer.from(field) : field;
-    hash.update(`${bytes.length}:`);
-    hash.update(bytes);
-  }
-}
-
-function recursiveDirectoryManifest(abs: string): string {
-  const hash = createHash("sha256");
-  updateManifest(hash, "cadence-directory-manifest");
-  const visit = (directory: string, prefix: string): void => {
-    const names = readdirSync(directory).sort();
-    for (const name of names) {
-      const relative = prefix ? `${prefix}/${name}` : name;
-      const current = join(directory, name);
-      const stat = lstatSync(current);
-      if (stat.isDirectory()) {
-        updateManifest(hash, "dir", relative, String(stat.mode & 0o777));
-        visit(current, relative);
-      } else if (stat.isFile()) {
-        const bytes = readFileSync(current);
-        updateManifest(
-          hash,
-          "file",
-          relative,
-          String(stat.mode & 0o777),
-          String(bytes.length),
-          sha256(bytes),
-        );
-      } else if (stat.isSymbolicLink()) {
-        updateManifest(hash, "symlink", relative, readlinkSync(current));
-      } else {
-        updateManifest(
-          hash,
-          "special",
-          relative,
-          String(stat.mode),
-          String(stat.size),
-        );
-      }
-    }
-  };
-  visit(abs, "");
-  return hash.digest("hex");
-}
-
-/** Deterministic recursive directory manifest bound to installed content. */
-export function snapshotDirManifest(
-  root: string,
-  relDir: string,
-): DirBound | null {
-  if (observeSafePath(root, relDir).kind !== "directory") return null;
-  const abs = resolve(root, relDir);
-  return { manifest: recursiveDirectoryManifest(abs), kind: "dir" };
-}
-
-/** Build a bound map for the given file paths, observed directories, and absent markers. */
-export function snapshotFiles(
-  root: string,
-  files: string[],
-  opts: { absent?: string[] } = {},
-): Bound {
-  const bound: Bound = {};
-  for (const p of [...new Set(files)]) {
-    const entry = snapshotFile(root, p);
-    if (entry) bound[p] = entry;
-    else bound[p] = { kind: "absent", absent: true };
-  }
-  for (const p of opts.absent ?? []) {
-    bound[p] = { kind: "absent", absent: true };
-  }
-  return bound;
-}
-
-/** Build a bound map for observed directories (deterministic manifests). */
-export function snapshotDirManifests(root: string, dirs: string[]): Bound {
-  const bound: Bound = {};
-  for (const p of [...new Set(dirs)]) {
-    const entry = snapshotDirManifest(root, p);
-    if (entry) bound[p] = entry;
-    else bound[p] = { kind: "absent", absent: true };
-  }
-  return bound;
-}
-
-/** Recapture each bound path and report whether the bound state is current. */
-export function isCurrent(root: string, bound: Bound): boolean {
-  for (const [rel, expected] of Object.entries(bound)) {
-    if (expected.kind === "dir") {
-      const now = snapshotDirManifest(root, rel);
-      if (!now || now.manifest !== expected.manifest) return false;
-      continue;
-    }
-    const observation = observeSafePath(root, rel);
-    if (expected.kind === "file") {
-      if (observation.kind !== "file") return false;
-      const now = snapshotFile(root, rel);
-      if (
-        !now ||
-        now.sha256 !== expected.sha256 ||
-        now.bytes !== expected.bytes
-      )
-        return false;
-    } else if (expected.absent && observation.kind !== "absent") {
-      return false;
-    }
-  }
-  return true;
-}
-
-/** Merge bound maps (read observations + write targets). */
-export function mergeBounds(...bounds: Bound[]): Bound {
-  return Object.assign({}, ...bounds);
-}