@aria_asi/cli 0.2.40 → 0.2.41

package/scripts/live-sidecar-receipt-canary.mjs

@@ -0,0 +1,347 @@
+#!/usr/bin/env node
+
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { dirname, resolve } from 'node:path';
+
+const repoRoot = resolve(import.meta.dirname, '..', '..', '..');
+const runtimeUrl = (process.env.ARIA_RUNTIME_URL || 'http://127.0.0.1:4319').replace(/\/+$/, '');
+const receiptDir = process.env.ARIA_LIVE_CANARY_DIR || '/tmp/aria-playground-surfaces/live-sidecar-receipt-canary';
+const receiptPath = resolve(receiptDir, 'last-run.json');
+const codexBin = process.env.ARIA_CANARY_CODEX_BIN || '/usr/bin/codex';
+const claudeBin = process.env.ARIA_CANARY_CLAUDE_BIN || '/home/hamzaibrahim1/.local/bin/claude';
+const codexWrapperPath = process.env.ARIA_CANARY_CODEX_WRAPPER || '/home/hamzaibrahim1/.aria/wrappers/codex';
+const claudeWrapperPath = process.env.ARIA_CANARY_CLAUDE_WRAPPER || '/home/hamzaibrahim1/.aria/wrappers/claude';
+const runId = `${new Date().toISOString().replace(/[:.]/g, '-')}-${process.pid}`;
+const stableReceiptPath = resolve(receiptDir, `run-${runId}.json`);
+
+const CANARIES = Object.freeze({
+  codex: {
+    expected: 'codex-live-sidecar-receipt-canary-ok',
+    command: codexBin,
+    args: [
+      'exec',
+      '--ephemeral',
+      '--sandbox',
+      'read-only',
+      '--json',
+      '-C',
+      repoRoot,
+      'reply exactly: codex-live-sidecar-receipt-canary-ok',
+    ],
+  },
+  claude: {
+    expected: 'claude-live-sidecar-receipt-canary-ok',
+    command: claudeBin,
+    args: [
+      '-p',
+      '--verbose',
+      '--output-format',
+      'stream-json',
+      '--include-hook-events',
+      '--no-session-persistence',
+      '--tools',
+      '',
+      '--permission-mode',
+      'dontAsk',
+      '--max-budget-usd',
+      process.env.ARIA_CANARY_CLAUDE_MAX_BUDGET_USD || '1.00',
+      'reply exactly: claude-live-sidecar-receipt-canary-ok',
+    ],
+  },
+});
+
+function sha256File(pathname) {
+  if (!existsSync(pathname)) return null;
+  return createHash('sha256').update(readFileSync(pathname)).digest('hex');
+}
+
+function parseJsonLines(text) {
+  const rows = [];
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim();
+    if (!trimmed || !trimmed.startsWith('{')) continue;
+    try {
+      rows.push(JSON.parse(trimmed));
+    } catch {
+      rows.push({ parseError: true, raw: trimmed.slice(0, 500) });
+    }
+  }
+  return rows;
+}
+
+function collectStrings(value, out = []) {
+  if (typeof value === 'string') {
+    out.push(value);
+    return out;
+  }
+  if (Array.isArray(value)) {
+    for (const item of value) collectStrings(item, out);
+    return out;
+  }
+  if (value && typeof value === 'object') {
+    for (const item of Object.values(value)) collectStrings(item, out);
+  }
+  return out;
+}
+
+function unique(values) {
+  return [...new Set(values.filter(Boolean))];
+}
+
+function extractUniversalTurnPacketEvidence(strings) {
+  const text = strings.join('\n');
+  const loaded = Number(text.match(/Loaded skills:\s*(\d+)/)?.[1] || 0);
+  const fired = Number(text.match(/Fired skills:\s*(\d+)/)?.[1] || 0);
+  const activeRuntimes = Number(text.match(/Active runtimes:\s*(\d+)/)?.[1] || 0);
+  const qaPass = /QA:\s*pass/.test(text);
+  return {
+    present: loaded > 0 || fired > 0,
+    loadedSkills: loaded,
+    firedSkills: fired,
+    activeRuntimes,
+    qaPass,
+  };
+}
+
+function summarizeClaude(rows, expected) {
+  const hookEvents = rows
+    .filter((row) => row?.type === 'system' && typeof row.hook_event === 'string')
+    .map((row) => row.hook_event);
+  const assistantRows = rows.filter((row) => row?.type === 'assistant');
+  const resultRows = rows.filter((row) => row?.type === 'result');
+  const strings = collectStrings(rows);
+  const universalTurnPacket = extractUniversalTurnPacketEvidence(strings);
+  const ariaPayloads = assistantRows.map((row) => row?.message?.aria).filter(Boolean);
+  const runtimeLedgerRecords = ariaPayloads.flatMap((aria) => aria?.runtime_ledger?.records || []);
+  const coachKernelRecords = ariaPayloads.flatMap((aria) => aria?.coach_kernel?.records || []);
+  return {
+    observedExact: strings.includes(expected),
+    hookEvents: unique(hookEvents),
+    assistantMessages: assistantRows.length,
+    resultRows: resultRows.length,
+    sessionIds: unique(rows.map((row) => row?.session_id || row?.message?.session_id)),
+    runtimeEvidence: {
+      controlPlanes: unique(ariaPayloads.map((aria) => aria?.control_plane)),
+      layer3Pass: ariaPayloads.some((aria) => aria?.layer3?.pass === true),
+      validationPass: ariaPayloads.some((aria) => aria?.validation?.severity === 'pass'),
+      runtimeLedgerPhases: unique(runtimeLedgerRecords.map((record) => record.phase)),
+      coachKernelDecisions: unique(coachKernelRecords.map((record) => `${record.phase}:${record.decision}`)),
+      universalTurnPacket,
+    },
+  };
+}
+
+function summarizeCodex(rows, expected) {
+  const strings = collectStrings(rows);
+  return {
+    observedExact: strings.includes(expected),
+    eventTypes: unique(rows.map((row) => row?.type || row?.msg?.type || row?.event)),
+    sessionIds: unique(rows.map((row) => row?.session_id || row?.id || row?.thread_id)),
+    assistantTextMatches: strings.filter((value) => value === expected).length,
+  };
+}
+
+async function getRuntimeHealth() {
+  const response = await fetch(`${runtimeUrl}/health`);
+  const text = await response.text();
+  const data = text ? JSON.parse(text) : null;
+  assert.equal(response.ok, true, `runtime health failed: ${response.status} ${text}`);
+  return {
+    ok: data?.ok === true,
+    runtime: data?.runtime,
+    runtimeId: data?.runtimeId,
+    url: data?.url,
+    hiveMode: data?.mount?.hive?.mode,
+    postgresLocalOnly: data?.mount?.hive?.postgres_local_only,
+    postgresAvailable: data?.mount?.hive?.postgres_available,
+  };
+}
+
+function runProcess(label, command, args) {
+  return new Promise((resolveProcess) => {
+    const startedAt = Date.now();
+    const child = spawn(command, args, {
+      cwd: repoRoot,
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.on('error', (error) => {
+      resolveProcess({
+        label,
+        command,
+        args,
+        exitCode: null,
+        signal: null,
+        durationMs: Date.now() - startedAt,
+        stdout,
+        stderr,
+        error: error.message,
+      });
+    });
+    child.on('close', (exitCode, signal) => {
+      resolveProcess({
+        label,
+        command,
+        args,
+        exitCode,
+        signal,
+        durationMs: Date.now() - startedAt,
+        stdout,
+        stderr,
+      });
+    });
+  });
+}
+
+async function runCanary(label, spec) {
+  const result = await runProcess(label, spec.command, spec.args);
+  const stdoutRows = parseJsonLines(result.stdout);
+  const stderrRows = parseJsonLines(result.stderr);
+  const rows = [...stdoutRows, ...stderrRows];
+  const summary = label === 'claude' ? summarizeClaude(rows, spec.expected) : summarizeCodex(rows, spec.expected);
+  const mechanicalAutofireOk = label !== 'claude' || (
+    summary.runtimeEvidence.universalTurnPacket.present === true &&
+    summary.runtimeEvidence.universalTurnPacket.firedSkills >= 50 &&
+    summary.runtimeEvidence.universalTurnPacket.qaPass === true
+  );
+  const passed = result.exitCode === 0 && summary.observedExact === true && mechanicalAutofireOk;
+  return {
+    label,
+    status: passed ? 'passed' : 'failed',
+    command: spec.command,
+    args: spec.args,
+    expected: spec.expected,
+    exitCode: result.exitCode,
+    signal: result.signal,
+    durationMs: result.durationMs,
+    stdoutLineCount: result.stdout.split(/\r?\n/).filter(Boolean).length,
+    stderrLineCount: result.stderr.split(/\r?\n/).filter(Boolean).length,
+    stdoutJsonRows: stdoutRows.length,
+    stderrJsonRows: stderrRows.length,
+    error: result.error || null,
+    summary,
+    stdoutTail: result.stdout.split(/\r?\n/).filter(Boolean).slice(-8),
+    stderrTail: result.stderr.split(/\r?\n/).filter(Boolean).slice(-8),
+  };
+}
+
+async function main() {
+  mkdirSync(receiptDir, { recursive: true });
+  const startedAt = new Date().toISOString();
+  const runtimeHealth = await getRuntimeHealth();
+  assert.equal(runtimeHealth.ok, true, 'runtime health must be ok before live canaries');
+
+  const beforeHashes = {
+    codexWrapper: sha256File(codexWrapperPath),
+    claudeWrapper: sha256File(claudeWrapperPath),
+  };
+
+  const codex = await runCanary('codex', CANARIES.codex);
+  const claude = await runCanary('claude', CANARIES.claude);
+
+  const afterHashes = {
+    codexWrapper: sha256File(codexWrapperPath),
+    claudeWrapper: sha256File(claudeWrapperPath),
+  };
+
+  const receipt = {
+    schema: 'aria.live_sidecar_receipt_canary.v1',
+    status: codex.status === 'passed' && claude.status === 'passed' ? 'verified' : 'failed',
+    runId,
+    startedAt,
+    completedAt: new Date().toISOString(),
+    repoRoot,
+    runtimeUrl,
+    receiptPaths: {
+      stable: stableReceiptPath,
+      latest: receiptPath,
+    },
+    runtimeHealth,
+    wrapperHashes: {
+      before: beforeHashes,
+      after: afterHashes,
+      stable: JSON.stringify(beforeHashes) === JSON.stringify(afterHashes),
+    },
+    canaries: {
+      codex,
+      claude,
+    },
+    boundary: {
+      exactReplyCanary: 'verifies live CLI execution and receipt capture only',
+      universalSkillAutofire: 'verified when hook output contains the compact universal turn packet loaded/fired skill counts for that surface',
+      providerMutation: 'not performed',
+      defaultClaudeBudgetUsd: process.env.ARIA_CANARY_CLAUDE_MAX_BUDGET_USD || '1.00',
+    },
+  };
+
+  writeFileSync(stableReceiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  writeFileSync(receiptPath, `${JSON.stringify(receipt, null, 2)}\n`);
+  assert.equal(receipt.status, 'verified', `live sidecar receipt canary failed; receipt=${receiptPath}`);
+  assert.equal(receipt.wrapperHashes.stable, true, 'wrapper hashes changed during canary');
+
+  console.log(JSON.stringify({
+    ok: true,
+    status: receipt.status,
+    receiptPath: stableReceiptPath,
+    latestReceiptPath: receiptPath,
+    runtime: runtimeHealth.runtime,
+    codex: codex.status,
+    claude: claude.status,
+    claudeHookEvents: claude.summary.hookEvents,
+    claudeRuntimeLedgerPhases: claude.summary.runtimeEvidence.runtimeLedgerPhases,
+    wrapperHashesStable: receipt.wrapperHashes.stable,
+  }, null, 2));
+}
+
+function readReceiptIfPresent(pathname) {
+  if (!existsSync(pathname)) return null;
+  try {
+    return JSON.parse(readFileSync(pathname, 'utf8'));
+  } catch {
+    return null;
+  }
+}
+
+function writeFailureReceipt(error) {
+  mkdirSync(dirname(receiptPath), { recursive: true });
+  const existingReceipt = readReceiptIfPresent(stableReceiptPath) || readReceiptIfPresent(receiptPath);
+  const failureReceipt = {
+    ...(existingReceipt || {}),
+    schema: 'aria.live_sidecar_receipt_canary.v1',
+    status: 'failed',
+    runId,
+    error: error instanceof Error ? error.message : String(error),
+    completedAt: new Date().toISOString(),
+    receiptPaths: {
+      stable: stableReceiptPath,
+      latest: receiptPath,
+    },
+    evidenceRetention: {
+      detailedReceiptPreserved: Boolean(existingReceipt?.canaries || existingReceipt?.runtimeHealth),
+      preservedFields: existingReceipt
+        ? Object.keys(existingReceipt).filter((key) => !['status', 'error', 'completedAt', 'receiptPaths'].includes(key))
+        : [],
+    },
+  };
+  writeFileSync(stableReceiptPath, `${JSON.stringify(failureReceipt, null, 2)}\n`);
+  writeFileSync(receiptPath, `${JSON.stringify(failureReceipt, null, 2)}\n`);
+}
+
+main().catch((error) => {
+  writeFailureReceipt(error);
+  console.error(error instanceof Error ? error.stack : String(error));
+  process.exitCode = 1;
+});