@aria_asi/cli 0.2.26 → 0.2.30

package/dist/assets/hooks/aria-repo-doctrine-gate.mjs

@@ -0,0 +1,397 @@
+#!/usr/bin/env node
+
+import { appendFileSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
+import { dirname, extname, isAbsolute, join, resolve } from 'node:path';
+import { execFileSync } from 'node:child_process';
+import { homedir } from 'node:os';
+
+const HOME = homedir();
+const AUDIT_PATH = `${HOME}/.claude/aria-repo-doctrine-gate-audit.jsonl`;
+const ALLOW_MARKER = 'ARIA_ALLOW_STUB';
+const TEACHING_PROSE_MARKER = 'ARIA_TEACHING_PROSE';
+const ALLOW_EXTERNAL_LLM_CALL_MARKER = 'ARIA_ALLOW_EXTERNAL_LLM_CALL';
+const CODE_EXTENSIONS = new Set([
+  '.js', '.jsx', '.ts', '.tsx', '.mjs', '.cjs',
+  '.py', '.sh', '.bash', '.zsh', '.rb', '.go', '.rs', '.java', '.kt', '.cs',
+  '.php', '.swift', '.scala', '.yml', '.yaml',
+]);
+const DOCTRINE_ROOT_PREFIXES = ['apps/', 'packages/', 'harness/', 'ops/', 'scripts/'];
+const IGNORE_PATH_RX = [
+  /(^|\/)(node_modules|dist|build|coverage|archive|generated|telegram_env|backup-opencode-config|training-data|\.next|\.turbo|\.cache)(\/|$)/i,
+  /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/i,
+  /\.map$/i,
+];
+const ALLOW_PATH_RX = [
+  /(^|\/)(__tests__|tests?|specs?|fixtures?|examples?|demos?|benchmarks?|mocks?)(\/|$)/i,
+  /\.(test|spec)\.[^.]+$/i,
+];
+const DIRECT_LLM_GUARDED_PATH_RX = [
+  /(^|\/)packages\/aria-hardening-worker\//i,
+  /(^|\/)packages\/openclaw-shared\//i,
+  /(^|\/)packages\/aria-connector\/hooks\//i,
+  /(^|\/)packages\/aria-connector\/opencode-plugins\//i,
+  /(^|\/)packages\/aria-connector\/src\/connectors\//i,
+];
+const DIRECT_LLM_INTERNAL_ALLOW_RX = [
+  /(^|\/)harness\/packages\/harness-http-client\/src\//i,
+  /(^|\/)packages\/aria-connector\/runtime-src\//i,
+  /(^|\/)packages\/aria-connector\/hooks\/aria-architect-fallback\.mjs$/i,
+  /(^|\/)apps\/arias-soul\/api\/v1\//i,
+  /(^|\/)apps\/arias-soul\/api\/harness\//i,
+];
+const BLOCK_RULES = [
+  {
+    id: 'stub_semantics',
+    message: 'stub or mock semantics in doctrine-bound source',
+    rx: /\b(?:stub|stubs|mock|mocks|implementation pending|not implemented|fake implementation|synthetic payload|synthetic response|synthetic data|coming soon|will be wired)\b/i,
+  },
+  {
+    id: 'placeholder_semantics',
+    message: 'placeholder implementation semantics in doctrine-bound source',
+    rx: /\bplaceholder\b(?!(?:\s*=))[^\n]{0,40}\b(?:implementation|handler|route|logic|response|payload|data|endpoint|function|service)\b/i,
+  },
+  {
+    id: 'todo_stub_semantics',
+    message: 'TODO tied to stub or pending implementation in doctrine-bound source',
+    rx: /\bTODO\b[^\n]{0,120}\b(?:stub|mock|placeholder|pending|implement)\b/i,
+  },
+  {
+    id: 'http_501_pending',
+    message: '501 or pending-path marker in doctrine-bound source',
+    rx: /(?:\bstatus\s*\(\s*501\s*\)|\bsendStatus\s*\(\s*501\s*\)|\b501\b)[^\n]{0,120}\b(?:TODO|pending|not implemented|placeholder)\b|(?:\bTODO\b|\bpending\b|\bnot implemented\b)[^\n]{0,120}(?:\bstatus\s*\(\s*501\s*\)|\bsendStatus\s*\(\s*501\s*\)|\b501\b)/i,
+  },
+  {
+    id: 'mock_import',
+    message: 'mock or stub import in doctrine-bound source',
+    rx: /\b(?:from|require\s*\()\s*['"][^'"]*(?:mock|stub|fake)[^'"]*['"]/i,
+  },
+  {
+    id: 'direct_llm_bypass',
+    message: 'bare direct LLM/provider call outside approved runtime or SDK surface',
+    rx: /\bfetch\s*\([^\n]{0,240}(?:\/v1\/chat\/completions|\/v1\/messages|api\.anthropic\.com\/v1\/messages|api\.openai\.com\/v1\/chat\/completions|api\.deepseek\.com(?:\/v1)?\/chat\/completions|openrouter\.ai\/api\/v1\/chat\/completions|integrate\.api\.nvidia\.com\/v1\/chat\/completions|api\.x\.ai\/v1\/chat\/completions|open\.bigmodel\.cn\/api\/paas\/v4\/chat\/completions)\b/i,
+  },
+  {
+    id: 'direct_llm_sdk_bypass',
+    message: 'direct provider SDK call outside approved runtime or SDK surface',
+    rx: /\b(?:anthropic\.messages\.create|client\.messages\.create|chat\.completions\.create)\s*\(/i,
+  },
+];
+
+function audit(event, data = {}) {
+  try {
+    mkdirSync(dirname(AUDIT_PATH), { recursive: true, mode: 0o700 });
+    appendFileSync(
+      AUDIT_PATH,
+      JSON.stringify({ ts: new Date().toISOString(), event, ...data }) + '\n',
+    );
+  } catch {}
+}
+
+function parseArgs(argv) {
+  const parsed = {
+    mode: 'working-tree',
+    repo: null,
+    paths: [],
+  };
+  for (let i = 0; i < argv.length; i++) {
+    const arg = argv[i];
+    if (arg === '--mode' && argv[i + 1]) {
+      parsed.mode = argv[++i];
+    } else if (arg === '--repo' && argv[i + 1]) {
+      parsed.repo = argv[++i];
+    } else if (arg === '--path' && argv[i + 1]) {
+      parsed.paths.push(argv[++i]);
+    } else if (arg === '--paths') {
+      parsed.paths.push(...argv.slice(i + 1));
+      break;
+    }
+  }
+  return parsed;
+}
+
+function runGit(args, cwd, options = {}) {
+  return execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    stdio: ['pipe', 'pipe', 'pipe'],
+    ...options,
+  }).trim();
+}
+
+function resolveRepoRoot(hint, fallbackPaths = []) {
+  const candidates = [hint, ...fallbackPaths, process.cwd()].filter(Boolean);
+  for (const candidate of candidates) {
+    const base = existsSync(candidate) ? candidate : dirname(candidate);
+    try {
+      const root = runGit(['-C', base, 'rev-parse', '--show-toplevel'], base);
+      if (root) return root;
+    } catch {}
+  }
+  return null;
+}
+
+function readStdin() {
+  return new Promise((resolvePromise) => {
+    let input = '';
+    process.stdin.setEncoding('utf8');
+    process.stdin.on('data', (chunk) => { input += chunk; });
+    process.stdin.on('end', () => resolvePromise(input));
+    process.stdin.on('error', () => resolvePromise(''));
+    if (process.stdin.isTTY) resolvePromise('');
+  });
+}
+
+function isDoctrineBound(relPath) {
+  return DOCTRINE_ROOT_PREFIXES.some((prefix) => relPath.startsWith(prefix));
+}
+
+function isIgnored(relPath) {
+  return IGNORE_PATH_RX.some((rx) => rx.test(relPath));
+}
+
+function isAllowlisted(relPath, text) {
+  if (text.includes(ALLOW_MARKER) || text.includes(TEACHING_PROSE_MARKER)) return true;
+  return ALLOW_PATH_RX.some((rx) => rx.test(relPath));
+}
+
+function stripQuotedContent(line) {
+  return line
+    .replace(/`(?:\\.|[^`])*`/g, '``')
+    .replace(/"(?:\\.|[^"])*"/g, '""')
+    .replace(/'(?:\\.|[^'])*'/g, "''");
+}
+
+function buildMultilineStringMask(text) {
+  const lines = String(text || '').split('\n');
+  const mask = new Array(lines.length).fill(false);
+  let inTemplate = false;
+
+  for (let lineIndex = 0; lineIndex < lines.length; lineIndex++) {
+    const line = lines[lineIndex];
+    let escaped = false;
+    let inSingle = false;
+    let inDouble = false;
+    let lineInsideTemplate = inTemplate;
+
+    for (let i = 0; i < line.length; i++) {
+      const ch = line[i];
+      if (escaped) {
+        escaped = false;
+        continue;
+      }
+      if (ch === '\\') {
+        escaped = true;
+        continue;
+      }
+      if (!inDouble && !inTemplate && ch === '\'') {
+        inSingle = !inSingle;
+        continue;
+      }
+      if (!inSingle && !inTemplate && ch === '"') {
+        inDouble = !inDouble;
+        continue;
+      }
+      if (!inSingle && !inDouble && ch === '`') {
+        inTemplate = !inTemplate;
+        lineInsideTemplate = true;
+      }
+    }
+
+    mask[lineIndex] = lineInsideTemplate;
+  }
+
+  return mask;
+}
+
+function isCommentOnlyLine(line) {
+  return /^\s*(?:\/\/|#|\*)/.test(line);
+}
+
+function isPolicyOrRuleDefinitionLine(line) {
+  const lower = String(line || '').toLowerCase();
+  if (!lower) return false;
+  if (/\bpattern\s*:\s*\/.*\/[a-z]*\s*,\s*violation\s*:/.test(line)) return true;
+  if (lower.includes('code quality default')) return true;
+  if (lower.includes('anti-patterns')) return true;
+  if (lower.includes('produce real working code')) return true;
+  if (lower.includes('non-stub check')) return true;
+  if (lower.includes('output file is a stub')) return true;
+  if (/\bno stubs?\b/.test(lower)) return true;
+  if (/\bno placeholders?\b/.test(lower)) return true;
+  if (/\bno fake implementations?\b/.test(lower)) return true;
+  return false;
+}
+
+function isDirectLlmGuardedPath(relPath) {
+  return DIRECT_LLM_GUARDED_PATH_RX.some((rx) => rx.test(relPath));
+}
+
+function isDirectLlmAllowlisted(relPath, text) {
+  if (text.includes(ALLOW_EXTERNAL_LLM_CALL_MARKER)) return true;
+  return DIRECT_LLM_INTERNAL_ALLOW_RX.some((rx) => rx.test(relPath));
+}
+
+function shouldScan(relPath, absPath) {
+  if (!existsSync(absPath)) return false;
+  if (isIgnored(relPath)) return false;
+  if (!isDoctrineBound(relPath)) return false;
+  return CODE_EXTENSIONS.has(extname(relPath).toLowerCase());
+}
+
+function collectViolations(repoRoot, relPaths) {
+  const violations = [];
+  for (const relPath of relPaths) {
+    const absPath = resolve(repoRoot, relPath);
+    if (!shouldScan(relPath, absPath)) continue;
+    let text;
+    try {
+      text = readFileSync(absPath, 'utf8');
+    } catch {
+      continue;
+    }
+    if (isAllowlisted(relPath, text)) continue;
+    const lines = text.split('\n');
+    const multilineStringMask = buildMultilineStringMask(text);
+    lines.forEach((line, index) => {
+      const semanticLine = stripQuotedContent(line);
+      const commentOnly = isCommentOnlyLine(line);
+      const inMultilineString = multilineStringMask[index] === true;
+      for (const rule of BLOCK_RULES) {
+        if (
+          (rule.id === 'stub_semantics' || rule.id === 'placeholder_semantics') &&
+          isPolicyOrRuleDefinitionLine(line)
+        ) {
+          continue;
+        }
+        if ((rule.id === 'direct_llm_bypass' || rule.id === 'direct_llm_sdk_bypass')) {
+          if (!isDirectLlmGuardedPath(relPath)) continue;
+          if (isDirectLlmAllowlisted(relPath, text)) continue;
+        }
+        const scanLine =
+          (rule.id === 'stub_semantics' || rule.id === 'placeholder_semantics')
+            ? (commentOnly || inMultilineString ? '' : semanticLine)
+            : (rule.id === 'todo_stub_semantics' || rule.id === 'http_501_pending' || rule.id === 'mock_import')
+              ? (inMultilineString ? '' : semanticLine)
+              : line;
+        if (rule.rx.test(scanLine)) {
+          violations.push({
+            path: relPath,
+            line: index + 1,
+            rule: rule.id,
+            message: rule.message,
+            excerpt: line.trim().slice(0, 240),
+          });
+        }
+      }
+    });
+  }
+  return violations;
+}
+
+function parsePrePushRefs(stdin) {
+  const ranges = [];
+  for (const line of String(stdin || '').split('\n').filter(Boolean)) {
+    const [localRef, localSha, remoteRef, remoteSha] = line.trim().split(/\s+/);
+    if (!localSha || !remoteSha) continue;
+    ranges.push({ localRef, localSha, remoteRef, remoteSha });
+  }
+  return ranges;
+}
+
+function emptyTreeSha(repoRoot) {
+  return runGit(['hash-object', '-t', 'tree', '/dev/null'], repoRoot);
+}
+
+function changedPathsForMode(repoRoot, mode, explicitPaths, stdin) {
+  if (explicitPaths.length > 0) {
+    return explicitPaths.map((candidate) => {
+      const abs = isAbsolute(candidate) ? candidate : resolve(process.cwd(), candidate);
+      return resolve(repoRoot, abs).startsWith(repoRoot) ? abs.slice(repoRoot.length + 1).replace(/\\/g, '/') : candidate;
+    });
+  }
+
+  if (mode === 'staged') {
+    return runGit(['diff', '--cached', '--name-only', '--diff-filter=ACMR'], repoRoot)
+      .split('\n')
+      .filter(Boolean);
+  }
+
+  if (mode === 'push') {
+    const refs = parsePrePushRefs(stdin);
+    const paths = new Set();
+    const emptyTree = emptyTreeSha(repoRoot);
+    for (const ref of refs) {
+      const remoteSha = /^0+$/.test(ref.remoteSha) ? emptyTree : ref.remoteSha;
+      const diff = runGit(['diff', '--name-only', '--diff-filter=ACMR', `${remoteSha}...${ref.localSha}`], repoRoot);
+      diff.split('\n').filter(Boolean).forEach((entry) => paths.add(entry));
+    }
+    if (paths.size > 0) return [...paths];
+  }
+
+  return runGit(['diff', '--name-only', '--diff-filter=ACMR'], repoRoot)
+    .split('\n')
+    .filter(Boolean);
+}
+
+function renderReason(repoRoot, violations, mode) {
+  const lines = violations
+    .slice(0, 20)
+    .map((violation) => `- ${violation.path}:${violation.line} [${violation.rule}] ${violation.excerpt}`);
+  return [
+    `Aria repo doctrine gate blocked ${mode}.`,
+    '',
+    'Doctrine-bound source cannot introduce stub/mock/pending semantics outside explicit allowlists.',
+    `Repo: ${repoRoot}`,
+    '',
+    'Violations:',
+    ...lines,
+    '',
+    `Allow path categories: tests/specs/fixtures/examples/demos/mocks, or add ${ALLOW_MARKER} in the file when the exception is intentional and reviewable.`,
+    `External provider calls require explicit ${ALLOW_EXTERNAL_LLM_CALL_MARKER} marker or an approved internal runtime/SDK path.`,
+  ].join('\n');
+}
+
+async function main() {
+  const args = parseArgs(process.argv.slice(2));
+  const stdin = await readStdin();
+  let event = null;
+  try { event = stdin ? JSON.parse(stdin) : null; } catch {}
+
+  const eventPaths = [];
+  if (event?.tool_input?.file_path) eventPaths.push(event.tool_input.file_path);
+  if (event?.tool_input?.path) eventPaths.push(event.tool_input.path);
+  if (event?.tool_input?.command && typeof event.tool_input.command === 'string') {
+    // For Bash mutations, scan repo diff rather than trying to parse arbitrary shell.
+  }
+
+  const repoRoot = resolveRepoRoot(
+    args.repo || event?.cwd || event?.working_directory || event?.tool_input?.file_path || event?.tool_input?.path,
+    eventPaths,
+  );
+  if (!repoRoot) process.exit(0);
+
+  const mode = args.mode || (event ? 'working-tree' : 'working-tree');
+  const relPaths = changedPathsForMode(repoRoot, mode, args.paths, stdin);
+  const violations = collectViolations(repoRoot, relPaths);
+  if (violations.length === 0) {
+    audit('repo_doctrine_gate_pass', { repoRoot, mode, scanned: relPaths.length });
+    process.exit(0);
+  }
+
+  const reason = renderReason(repoRoot, violations, mode);
+  audit('repo_doctrine_gate_block', { repoRoot, mode, violations });
+
+  if (event) {
+    console.log(JSON.stringify({ decision: 'block', reason }));
+    process.exit(2);
+  }
+
+  console.error(reason);
+  process.exit(1);
+}
+
+main().catch((err) => {
+  audit('repo_doctrine_gate_error', { err: err instanceof Error ? err.message : String(err) });
+  console.error(`Aria repo doctrine gate failed closed: ${err instanceof Error ? err.message : String(err)}`);
+  process.exit(1);
+});