@andorra-labs/code 0.0.0-stage → 0.1.4

package/dist/src/qa/orchestrator/QaOrchestrator.js

@@ -0,0 +1,373 @@
+import { mkdir, readdir, rm, appendFile } from 'node:fs/promises';
+import path from 'node:path';
+import { randomUUID } from 'node:crypto';
+import { executeShell } from '../../shell.js';
+import { emptyQaState } from '../types.js';
+import { deriveProfile } from '../profile/ProjectInspector.js';
+import { detectChanges } from '../git/ChangeDetector.js';
+import { reviewDiff } from '../git/DiffReviewer.js';
+import { scanAddedLinesForSecrets } from '../security/SecretScanner.js';
+import { runDependencyAudit } from '../security/DependencyScanner.js';
+import { runCommandCheck } from '../runners/CommandRunner.js';
+import { buildTestCommand } from '../runners/TestRunner.js';
+import { runRuntimeSmoke } from '../runtime/RuntimeSmoke.js';
+import { runApiSmokeTests } from '../api/http-runner.js';
+import { runBrowserQa } from '../browser/PlaywrightRunner.js';
+import { classifyChanges } from './ChangeClassifier.js';
+import { computeMergeGate, gateVerdict } from './MergeGate.js';
+import { describeRuntimeCapabilities } from '../runtime-detect.js';
+const LINT_TIMEOUT_MS = 120_000;
+const TEST_TIMEOUT_MS = 300_000;
+const LOG_RETENTION = 20;
+function shortRunId() {
+    return `${Date.now().toString(36)}-${randomUUID().slice(0, 8)}`;
+}
+/**
+ * Per-workspace QA session: derives/caches the project profile, runs check
+ * pipelines, records normalized results with a working-tree fingerprint for
+ * staleness, bounds the repair loop, and prunes run logs to a retention set.
+ */
+export class QaOrchestrator {
+    workspace;
+    state = emptyQaState();
+    profileEntry;
+    lastRunFingerprint;
+    qaRoot;
+    constructor(workspace) {
+        this.workspace = workspace;
+        this.qaRoot = path.join(workspace, '.andorra', 'runtime', 'qa');
+    }
+    async getProfile(signal) {
+        const derived = await deriveProfile(this.workspace);
+        if (!this.profileEntry || this.profileEntry.fingerprint !== derived.fingerprint)
+            this.profileEntry = derived;
+        signal.throwIfAborted();
+        return this.profileEntry.profile;
+    }
+    /** Every command this session could execute under the current profile, for pre-flight policy checks. */
+    plannedCommands(profile) {
+        const commands = [];
+        for (const key of ['lint', 'typecheck', 'unit', 'build', 'e2e']) {
+            const spec = profile.qa[key];
+            if (spec)
+                commands.push(spec.command);
+        }
+        if (profile.startup)
+            commands.push(profile.startup.command);
+        if (profile.security.dependencyScan)
+            commands.push(`${profile.project.packageManager ?? 'npm'} audit --json`);
+        if (profile.security.semgrep)
+            commands.push('semgrep scan --error --config p/default --metrics off');
+        return commands;
+    }
+    async profileSummary(signal) {
+        const profile = await this.getProfile(signal);
+        const lines = [
+            `language=${profile.project.language}${profile.project.framework ? ` framework=${profile.project.framework}` : ''}${profile.project.packageManager ? ` packageManager=${profile.project.packageManager}` : ''}`,
+            ...['lint', 'typecheck', 'unit', 'build', 'e2e'].map(key => `qa.${key}: ${profile.qa[key]?.command ?? 'not configured'}`),
+            profile.startup ? `startup: ${profile.startup.command}${profile.startup.healthUrl ? ` (health ${profile.startup.healthUrl})` : ''}` : 'startup: not configured',
+            `browser: ${profile.browser.enabled ? `enabled${profile.browser.url ? ` url=${profile.browser.url}` : ' (no url configured)'}` : 'disabled'}`,
+            `merge gate: ${profile.mergeGate.join(', ')}`,
+            profile.configError ? `qa.yaml error: ${profile.configError}` : undefined,
+        ].filter((line) => line !== undefined);
+        return (await lines.join('\n')) + `\n${await describeRuntimeCapabilities()}`;
+    }
+    async newRun(signal) {
+        const runId = shortRunId();
+        const logDir = path.join(this.qaRoot, runId);
+        await mkdir(logDir, { recursive: true });
+        await this.pruneLogs();
+        signal.throwIfAborted();
+        return { runId, logDir };
+    }
+    async pruneLogs() {
+        try {
+            const entries = await readdir(this.qaRoot, { withFileTypes: true });
+            const dirs = entries.filter(entry => entry.isDirectory() && entry.name !== 'processes').map(entry => entry.name);
+            if (dirs.length <= LOG_RETENTION)
+                return;
+            const stats = await Promise.all(dirs.map(async (name) => ({ name, mtime: (await statMtime(path.join(this.qaRoot, name))).getTime() })));
+            stats.sort((a, b) => b.mtime - a.mtime);
+            await Promise.all(stats.slice(LOG_RETENTION).map(entry => rm(path.join(this.qaRoot, entry.name), { recursive: true, force: true })));
+        }
+        catch { /* pruning is best-effort */ }
+    }
+    async audit(record) {
+        try {
+            await mkdir(this.qaRoot, { recursive: true });
+            await appendFile(path.join(this.qaRoot, 'audit.ndjson'), `${JSON.stringify(record)}\n`, 'utf8');
+        }
+        catch { /* audit is best-effort */ }
+    }
+    record(result, fingerprint, profile) {
+        let stored = result;
+        if (result.status === 'failed') {
+            const count = (this.state.failureCounts[result.id] ?? 0) + 1;
+            this.state.failureCounts[result.id] = count;
+            if (profile.autoRepair.enabled && count >= profile.autoRepair.maxAttemptsPerCheck) {
+                stored = { ...stored, repairExhausted: true, summary: `BLOCKED: ${result.id} still fails after ${count} repair attempts. ${stored.summary}` };
+            }
+        }
+        else if (result.status === 'passed') {
+            this.state.failureCounts[result.id] = 0;
+        }
+        stored = { ...stored, fingerprint };
+        this.state.checks[stored.id] = stored;
+        return stored;
+    }
+    verdictFor(results) {
+        if (results.some(result => result.status === 'failed'))
+            return 'issues';
+        if (results.some(result => result.status === 'blocked'))
+            return 'blocked';
+        return 'clean';
+    }
+    /** qa.fast: lint, typecheck, related tests, optional build, diff review and secret scan. */
+    async fast(options) {
+        const profile = await this.getProfile(options.signal);
+        const changeSet = await detectChanges({ cwd: this.workspace, signal: options.signal });
+        const { runId, logDir } = await this.newRun(options.signal);
+        const results = [];
+        const command = async (id, category, key, defaultTimeoutMs) => {
+            const spec = profile.qa[key];
+            if (!spec)
+                return { id, category, status: 'skipped', durationMs: 0, summary: `no ${key} command configured or detected` };
+            await options.authorize?.(spec.command);
+            const result = await runCommandCheck({ id, category, command: spec, workspace: this.workspace, logDir, defaultTimeoutMs, signal: options.signal });
+            await this.audit({ time: new Date().toISOString(), runId, id, command: spec.command, status: result.status, durationMs: result.durationMs });
+            return result;
+        };
+        results.push(await command('lint', 'lint', 'lint', LINT_TIMEOUT_MS));
+        results.push(await command('typecheck', 'typecheck', 'typecheck', LINT_TIMEOUT_MS));
+        const relatedFiles = changeSet.changedFiles;
+        if (!relatedFiles.length) {
+            results.push({ id: 'related_tests', category: 'unit', status: 'skipped', durationMs: 0, summary: 'no changed files to scope tests to' });
+        }
+        else {
+            const built = buildTestCommand(profile, { mode: 'related', files: relatedFiles });
+            if (built.blocked || !built.command) {
+                results.push({ id: 'related_tests', category: 'unit', status: 'blocked', durationMs: 0, summary: built.blocked ?? 'test command could not be built' });
+            }
+            else {
+                await options.authorize?.(built.command);
+                const result = await runCommandCheck({ id: 'related_tests', category: 'unit', command: { command: built.command, timeoutMs: built.timeoutMs }, workspace: this.workspace, logDir, defaultTimeoutMs: TEST_TIMEOUT_MS, signal: options.signal });
+                if (built.note)
+                    result.summary = `${result.summary} (${built.note})`;
+                await this.audit({ time: new Date().toISOString(), runId, id: 'related_tests', command: built.command, status: result.status, durationMs: result.durationMs });
+                results.push(result);
+            }
+        }
+        if (options.includeBuild)
+            results.push(await command('build', 'build', 'build', TEST_TIMEOUT_MS));
+        else
+            results.push({ id: 'build', category: 'build', status: 'skipped', durationMs: 0, summary: 'build not requested; pass includeBuild to run it' });
+        const secretHits = scanAddedLinesForSecrets(changeSet.diff ?? '');
+        results.push(secretHits.length
+            ? { id: 'secret_scan', category: 'security', status: 'failed', durationMs: 0, summary: `${secretHits.length} possible secret(s) added to the working tree`, errors: secretHits }
+            : { id: 'secret_scan', category: 'security', status: 'passed', durationMs: 0, summary: 'no credential-shaped strings added to the diff' });
+        const review = reviewDiff(changeSet, []);
+        results.push({
+            id: 'diff_review', category: 'diff',
+            status: review.passed ? 'passed' : 'failed',
+            durationMs: 0,
+            summary: `${review.stats.filesChanged} files, +${review.stats.insertions}/-${review.stats.deletions}: ${review.passed ? 'no blocking findings' : `${review.issues.filter(issue => issue.severity === 'error').length} blocking finding(s)`}`,
+            errors: review.issues.length ? review.issues : undefined,
+        });
+        const recorded = results.map(result => this.record(result, changeSet.fingerprint, profile));
+        this.state.lastFastRun = runId;
+        this.lastRunFingerprint = changeSet.fingerprint;
+        this.state.changedSinceLastQa = false;
+        return { runId, fingerprint: changeSet.fingerprint, results: recorded, verdict: this.verdictFor(recorded), changedFiles: changeSet.changedFiles };
+    }
+    /** qa.test: run the unit suite scoped by mode. */
+    async test(request, options) {
+        const { signal, authorize } = options;
+        const profile = await this.getProfile(signal);
+        const built = buildTestCommand(profile, request);
+        if (built.blocked || !built.command) {
+            return { id: 'related_tests', category: 'unit', status: 'blocked', durationMs: 0, summary: built.blocked ?? 'test command could not be built' };
+        }
+        const { runId, logDir } = await this.newRun(signal);
+        await authorize?.(built.command);
+        const result = await runCommandCheck({ id: 'related_tests', category: 'unit', command: { command: built.command, timeoutMs: built.timeoutMs }, workspace: this.workspace, logDir, defaultTimeoutMs: TEST_TIMEOUT_MS, signal });
+        if (built.note)
+            result.summary = `${result.summary} (${built.note})`;
+        await this.audit({ time: new Date().toISOString(), runId, id: 'related_tests', mode: request.mode, command: built.command, status: result.status, durationMs: result.durationMs });
+        const changeSet = await detectChanges({ cwd: this.workspace, signal });
+        return this.record(result, changeSet.fingerprint, profile);
+    }
+    /** qa.security: built-in secret scan, dependency audit, and semgrep when enabled. */
+    async security(options) {
+        const { signal, authorize } = options;
+        const profile = await this.getProfile(signal);
+        const { runId, logDir } = await this.newRun(signal);
+        const results = [];
+        const changeSet = await detectChanges({ cwd: this.workspace, signal });
+        const secretHits = scanAddedLinesForSecrets(changeSet.diff ?? '');
+        results.push(this.record(secretHits.length
+            ? { id: 'secret_scan', category: 'security', status: 'failed', durationMs: 0, summary: `${secretHits.length} possible secret(s) added to the working tree`, errors: secretHits }
+            : { id: 'secret_scan', category: 'security', status: 'passed', durationMs: 0, summary: 'no credential-shaped strings added to the diff' }, changeSet.fingerprint, profile));
+        if (profile.security.dependencyScan) {
+            await authorize?.(`${profile.project.packageManager ?? 'npm'} audit --json`);
+            const audit = await runDependencyAudit({ workspace: this.workspace, packageManager: profile.project.packageManager, failOn: profile.security.failOn, signal });
+            results.push(this.record({
+                id: 'dependency_audit', category: 'security', status: audit.status, durationMs: audit.durationMs,
+                summary: audit.summary, errors: audit.issues.length ? audit.issues : undefined,
+                importantOutput: audit.importantOutput.length ? audit.importantOutput : undefined,
+            }, changeSet.fingerprint, profile));
+        }
+        else {
+            results.push({ id: 'dependency_audit', category: 'security', status: 'skipped', durationMs: 0, summary: 'dependency scan disabled in configuration' });
+        }
+        if (profile.security.semgrep) {
+            results.push(this.record(await this.semgrepCheck(logDir, runId, signal, authorize), changeSet.fingerprint, profile));
+        }
+        return results;
+    }
+    async semgrepCheck(logDir, runId, signal, authorize) {
+        try {
+            await executeShell('semgrep --version', this.workspace, 10_000, signal);
+        }
+        catch {
+            return { id: 'semgrep', category: 'security', status: 'blocked', durationMs: 0, summary: 'semgrep is enabled in configuration but not installed' };
+        }
+        const command = 'semgrep scan --error --config p/default --metrics off';
+        await authorize?.(command);
+        const result = await runCommandCheck({ id: 'semgrep', category: 'security', command: { command }, workspace: this.workspace, logDir, defaultTimeoutMs: 300_000, signal });
+        await this.audit({ time: new Date().toISOString(), runId, id: 'semgrep', status: result.status, durationMs: result.durationMs });
+        return result;
+    }
+    /** qa.browser: load a URL in Playwright and report smoke/console/network(/a11y). */
+    async browser(options) {
+        const profile = await this.getProfile(options.signal);
+        const outcome = await runBrowserQa({ workspace: this.workspace, profile, ...(options.url ? { url: options.url } : {}), ...(options.accessibility !== undefined ? { accessibility: options.accessibility } : {}), signal: options.signal });
+        const changeSet = await detectChanges({ cwd: this.workspace, signal: options.signal });
+        const results = [outcome.smoke, outcome.consoleErrors, outcome.networkErrors, ...(outcome.accessibility ? [outcome.accessibility] : [])];
+        return results.map(result => this.record(result, changeSet.fingerprint, profile));
+    }
+    /** qa.deep: the full dynamic merge gate over the current change set. */
+    async deep(options) {
+        const { signal, authorize } = options;
+        const profile = await this.getProfile(signal);
+        const changeSet = await detectChanges({ cwd: this.workspace, signal });
+        const classification = classifyChanges(changeSet.changedFiles);
+        const steps = options.checks?.length ? options.checks : computeMergeGate(profile, classification);
+        const { runId, logDir } = await this.newRun(signal);
+        const results = [];
+        let browserOutcome;
+        for (const step of steps) {
+            signal.throwIfAborted();
+            if (step === 'browser_smoke' || step === 'console_errors' || step === 'network_errors' || step === 'accessibility') {
+                browserOutcome ??= await runBrowserQa({ workspace: this.workspace, profile, signal });
+                const pick = step === 'browser_smoke' ? browserOutcome.smoke
+                    : step === 'console_errors' ? browserOutcome.consoleErrors
+                        : step === 'network_errors' ? browserOutcome.networkErrors
+                            : browserOutcome.accessibility ?? { id: 'accessibility', category: 'accessibility', status: 'skipped', durationMs: 0, summary: 'accessibility not requested' };
+                results.push(pick);
+                continue;
+            }
+            results.push(await this.gateStep(step, profile, changeSet.changedFiles, { runId, logDir }, signal, authorize));
+        }
+        const recorded = results.map(result => this.record(result, changeSet.fingerprint, profile));
+        const verdict = gateVerdict(recorded);
+        this.state.lastDeepRun = runId;
+        this.state.mergeReady = verdict === 'ready';
+        this.state.lastGateVerdict = verdict;
+        this.lastRunFingerprint = changeSet.fingerprint;
+        this.state.changedSinceLastQa = false;
+        return { runId, fingerprint: changeSet.fingerprint, results: recorded, verdict: verdict === 'ready' ? 'clean' : verdict === 'failed' ? 'issues' : 'blocked', changedFiles: changeSet.changedFiles, gate: { steps, verdict } };
+    }
+    async gateStep(step, profile, changedFiles, run, signal, authorize) {
+        switch (step) {
+            case 'lint':
+            case 'typecheck':
+            case 'build': {
+                const spec = profile.qa[step];
+                if (!spec)
+                    return { id: step, category: step, status: 'skipped', durationMs: 0, summary: `no ${step} command configured or detected` };
+                await authorize?.(spec.command);
+                const result = await runCommandCheck({ id: step, category: step, command: spec, workspace: this.workspace, logDir: run.logDir, defaultTimeoutMs: step === 'build' ? TEST_TIMEOUT_MS : LINT_TIMEOUT_MS, signal });
+                await this.audit({ time: new Date().toISOString(), runId: run.runId, id: step, command: spec.command, status: result.status, durationMs: result.durationMs });
+                return result;
+            }
+            case 'related_tests': {
+                if (!changedFiles.length)
+                    return { id: 'related_tests', category: 'unit', status: 'skipped', durationMs: 0, summary: 'no changed files to test' };
+                const built = buildTestCommand(profile, { mode: 'related', files: changedFiles });
+                if (built.blocked || !built.command)
+                    return { id: 'related_tests', category: 'unit', status: 'blocked', durationMs: 0, summary: built.blocked ?? 'test command could not be built' };
+                await authorize?.(built.command);
+                const result = await runCommandCheck({ id: 'related_tests', category: 'unit', command: { command: built.command, timeoutMs: built.timeoutMs }, workspace: this.workspace, logDir: run.logDir, defaultTimeoutMs: TEST_TIMEOUT_MS, signal });
+                if (built.note)
+                    result.summary = `${result.summary} (${built.note})`;
+                await this.audit({ time: new Date().toISOString(), runId: run.runId, id: 'related_tests', command: built.command, status: result.status, durationMs: result.durationMs });
+                return result;
+            }
+            case 'diff_review': {
+                const changeSet = await detectChanges({ cwd: this.workspace, signal });
+                const review = reviewDiff(changeSet, []);
+                const blocking = review.issues.filter(issue => issue.severity === 'error').length;
+                return {
+                    id: 'diff_review', category: 'diff', status: review.passed ? 'passed' : 'failed', durationMs: 0,
+                    summary: `${review.stats.filesChanged} files, +${review.stats.insertions}/-${review.stats.deletions}: ${review.passed ? 'no blocking findings' : `${blocking} blocking finding(s)`}`,
+                    errors: review.issues.length ? review.issues : undefined,
+                };
+            }
+            case 'secret_scan': {
+                const changeSet = await detectChanges({ cwd: this.workspace, signal });
+                const secretHits = scanAddedLinesForSecrets(changeSet.diff ?? '');
+                return secretHits.length
+                    ? { id: 'secret_scan', category: 'security', status: 'failed', durationMs: 0, summary: `${secretHits.length} possible secret(s) added to the working tree`, errors: secretHits }
+                    : { id: 'secret_scan', category: 'security', status: 'passed', durationMs: 0, summary: 'no credential-shaped strings added to the diff' };
+            }
+            case 'dependency_audit': {
+                if (!profile.security.dependencyScan)
+                    return { id: 'dependency_audit', category: 'security', status: 'skipped', durationMs: 0, summary: 'dependency scan disabled in configuration' };
+                await authorize?.(`${profile.project.packageManager ?? 'npm'} audit --json`);
+                const audit = await runDependencyAudit({ workspace: this.workspace, packageManager: profile.project.packageManager, failOn: profile.security.failOn, signal });
+                return { id: 'dependency_audit', category: 'security', status: audit.status, durationMs: audit.durationMs, summary: audit.summary, errors: audit.issues.length ? audit.issues : undefined, importantOutput: audit.importantOutput.length ? audit.importantOutput : undefined };
+            }
+            case 'runtime_smoke': {
+                if (profile.startup)
+                    await authorize?.(profile.startup.command);
+                return runRuntimeSmoke({ workspace: this.workspace, profile, logDir: run.logDir, signal });
+            }
+            case 'api_smoke':
+                return runApiSmokeTests(profile.apiSmokeTests, signal);
+            case 'migration_validation':
+                return { id: 'migration_validation', category: 'runtime', status: 'skipped', durationMs: 0, summary: 'migration validation is not implemented in this release; run migrations against a scratch database' };
+            case 'semgrep':
+                return this.semgrepCheck(run.logDir, run.runId, signal, authorize);
+            default:
+                return { id: step, category: 'runtime', status: 'skipped', durationMs: 0, summary: `gate step "${step}" is not implemented in this release` };
+        }
+    }
+    /** qa.status: session view — profile summary, last results, staleness, gate verdict. */
+    async status(signal) {
+        const changeSet = await detectChanges({ cwd: this.workspace, signal });
+        if (this.lastRunFingerprint !== undefined)
+            this.state.changedSinceLastQa = changeSet.fingerprint !== this.lastRunFingerprint;
+        return { summary: await this.profileSummary(signal), state: this.state };
+    }
+    /** True when results recorded at the last run no longer reflect the tree. */
+    isStale(currentFingerprint) {
+        return this.lastRunFingerprint !== undefined && this.lastRunFingerprint !== currentFingerprint;
+    }
+    async changeSnapshot(signal) {
+        const changeSet = await detectChanges({ cwd: this.workspace, signal });
+        return { changedFiles: changeSet.changedFiles, classification: classifyChanges(changeSet.changedFiles), fingerprint: changeSet.fingerprint };
+    }
+}
+async function statMtime(target) {
+    const { stat } = await import('node:fs/promises');
+    return (await stat(target)).mtime;
+}
+const orchestrators = new Map();
+export function getQaOrchestrator(workspace) {
+    let orchestrator = orchestrators.get(workspace);
+    if (!orchestrator) {
+        orchestrator = new QaOrchestrator(workspace);
+        orchestrators.set(workspace, orchestrator);
+    }
+    return orchestrator;
+}

package/dist/src/qa/profile/ProjectInspector.d.ts

@@ -0,0 +1,9 @@
+import type { QaProfile } from '../types.js';
+/**
+ * Derive a QA profile from repository markers, then overlay `.andorra/qa.yaml`.
+ * Generated defaults work without the config file; explicit config always wins.
+ */
+export declare function deriveProfile(workspace: string): Promise<{
+    profile: QaProfile;
+    fingerprint: string;
+}>;