@astrosheep/keiyaku 2.9.5 → 2.9.6

package/build/core/audit/evidence.js

@@ -0,0 +1,158 @@
+import { FlowError, asMessage } from "../../flow-error.js";
+import { scopePathEvidence } from "../scope.js";
+import { verificationExecutor, resolveVerificationCommands, runVerificationCommand } from "../settlement/verification.js";
+function importLine(line) {
+    return /^(?:import\b|export\s+(?:\*|\{)|(?:const|let|var)\s+[^=]+\s*=\s*require\s*\(|[^=]+\brequire\s*\(|[^=]+\bimport\s*\()/.test(line.content.trim());
+}
+function identifierRename(before, after) {
+    const left = before.match(/[A-Za-z_$][\w$]*/g) ?? [];
+    const right = after.match(/[A-Za-z_$][\w$]*/g) ?? [];
+    if (left.length !== right.length)
+        return null;
+    const differences = left.flatMap((value, index) => value === right[index] ? [] : [{ from: value, to: right[index] }]);
+    if (differences.length !== 1)
+        return null;
+    const rename = differences[0];
+    const expression = new RegExp(`\\b${rename.from.replace(/[.*+?^${}()|[\]\\]/g, "\\$&")}\\b`, "g");
+    return before.replace(expression, rename.to) === after ? rename : null;
+}
+function explainFile(file, matcher) {
+    const explanations = [];
+    const explained = new Set();
+    if (file.status === "R" && file.oldPath)
+        explanations.push({ kind: "file-rename", from: file.oldPath, to: file.path, similarity: file.similarity ?? 0 });
+    for (const hunk of file.hunks) {
+        const changed = hunk.lines.filter((line) => line.kind !== "context");
+        for (const line of changed) {
+            if (!importLine(line))
+                continue;
+            explanations.push({ kind: "import", hunk: hunk.index, oldLine: line.oldLine, newLine: line.newLine });
+            explained.add(`${hunk.index}:${line.kind}:${line.oldLine}:${line.newLine}`);
+        }
+        const deletions = changed.filter((line) => line.kind === "deletion" && !importLine(line));
+        const additions = changed.filter((line) => line.kind === "addition" && !importLine(line));
+        if (deletions.length === additions.length)
+            deletions.forEach((deletion, index) => {
+                const addition = additions[index];
+                const rename = identifierRename(deletion.content, addition.content);
+                if (!rename)
+                    return;
+                explanations.push({ kind: "symbol-rename", ...rename, hunk: hunk.index, oldLine: deletion.oldLine, newLine: addition.newLine });
+                explained.add(`${hunk.index}:${deletion.kind}:${deletion.oldLine}:${deletion.newLine}`);
+                explained.add(`${hunk.index}:${addition.kind}:${addition.oldLine}:${addition.newLine}`);
+            });
+    }
+    const residue = file.binary ? [{ hunk: -1, oldLine: null, newLine: null, kind: "binary", content: "binary content changed" }] : [];
+    for (const hunk of file.hunks)
+        for (const line of hunk.lines) {
+            if (line.kind === "context")
+                continue;
+            const key = `${hunk.index}:${line.kind}:${line.oldLine}:${line.newLine}`;
+            if (!explained.has(key))
+                residue.push({ hunk: hunk.index, oldLine: line.oldLine, newLine: line.newLine, kind: line.kind, content: line.content });
+        }
+    return { path: file.path, ...(file.oldPath ? { oldPath: file.oldPath } : {}), matcher, explanations, residue, class: matcher.matched ? "in-scope" : residue.length === 0 && explanations.length > 0 ? "downgraded" : "violated" };
+}
+export async function evaluateScope(input) {
+    const matchers = await scopePathEvidence(input.cwd, input.frozen.scope, input.diff.files.map((file) => file.path));
+    return input.diff.files.map((file, index) => explainFile(file, matchers[index]));
+}
+function rawHunk(file, hunk) {
+    return [`${file.status} ${file.oldPath ? `${file.oldPath} -> ` : ""}${file.path} · +${file.insertions} -${file.deletions}`, hunk.header, ...hunk.lines.map((line) => `${line.kind === "addition" ? "+" : line.kind === "deletion" ? "-" : " "}${line.content}`)].join("\n");
+}
+function rawFile(file) { return `${file.status} ${file.oldPath ? `${file.oldPath} -> ` : ""}${file.path} · +${file.insertions} -${file.deletions}`; }
+function moduleFor(pathname) { const segments = pathname.split("/"); return segments.length > 1 ? segments.slice(0, -1).join("/") : "."; }
+function byteLength(content) { return new TextEncoder().encode(content).byteLength; }
+function isAuthorityBoundary(pathname) { return /(^|\/)(auth(?:entication|orization)?|schema|schemas|migrations?|api|config|ci|\.github|permissions?|concurrency)(\/|$)|(^|\/)(package|tsconfig|vite|webpack|eslint|prettier)\.(json|ya?ml|[cm]?[jt]s)$/.test(pathname); }
+function isGeneratedOrLowPriority(pathname, file) { return file.binary || /(^|\/)(vendor|generated|dist|build)(\/|$)|(^|\/)([^/]+\.)?(lock|min)\.(json|ya?ml|js|css)$|(?:^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock)$/.test(pathname); }
+function isSource(pathname) { return /\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|rb|php|cs|swift)$/.test(pathname) && !/(^|\/)(test|tests|__tests__|spec)(\/|\.)/.test(pathname); }
+function hasRelatedTest(file, all) { const stem = file.path.replace(/\.[^.]+$/, "").replace(/\/index$/, ""); return all.some((candidate) => candidate.path !== file.path && /(test|tests|__tests__|spec)/.test(candidate.path) && candidate.path.replace(/\.(?:[cm]?[jt]sx?|py|go|rs|java|kt|rb|php|cs|swift)$/, "").includes(stem.split("/").at(-1) ?? "")); }
+function portfolioTier(file, scope, all) {
+    if (scope.class === "violated")
+        return { tier: 0, mandatory: true };
+    if (isAuthorityBoundary(file.path))
+        return { tier: 1, mandatory: true };
+    if (/(^|\/)(package\.json|workspace|pnpm-workspace|turbo|nx)\b/.test(file.path))
+        return { tier: 2, mandatory: false };
+    if (isGeneratedOrLowPriority(file.path, file))
+        return { tier: 6, mandatory: false };
+    if (isSource(file.path) && !hasRelatedTest(file, all))
+        return { tier: 3, mandatory: false };
+    if (file.status === "R" || scope.class === "downgraded")
+        return { tier: 5, mandatory: false };
+    return { tier: 4, mandatory: false };
+}
+function stablePortfolioOrder(left, right) { if (left.tier !== right.tier)
+    return left.tier - right.tier; const ratio = (1000 - right.tier * 100) / Math.max(right.bytes, 1) - (1000 - left.tier * 100) / Math.max(left.bytes, 1); return ratio || left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1); }
+function retrieval(from, to, pathname, hunk) { return { kind: "git-coordinate", from, to, argv: ["git", "diff", "--no-color", "--no-ext-diff", "--unified=3", `${from}..${to}`, "--", pathname], path: pathname, hunk }; }
+export function presentDiff(input) {
+    const { diff, scope, budget } = input;
+    const candidates = [];
+    for (let fileIndex = 0; fileIndex < diff.files.length; fileIndex += 1) {
+        const file = diff.files[fileIndex];
+        const policy = portfolioTier(file, scope[fileIndex], diff.files);
+        const chunks = file.hunks.length === 0 ? [{ hunk: null, content: rawFile(file) }] : file.hunks.map((hunk) => ({ hunk: hunk.index, content: rawHunk(file, hunk) }));
+        for (const chunk of chunks) {
+            const bytes = byteLength(chunk.content);
+            candidates.push({ path: file.path, hunk: chunk.hunk, content: chunk.content, bytes, cost: bytes, tier: policy.tier, mandatory: policy.mandatory, module: moduleFor(file.path) });
+        }
+    }
+    const selected = [];
+    const selectedKeys = new Set();
+    let used = 0;
+    const keyFor = (candidate) => `${candidate.path}\0${candidate.hunk ?? "file"}`;
+    const take = (candidate) => { const key = keyFor(candidate); if (selectedKeys.has(key))
+        return; selectedKeys.add(key); selected.push(candidate); used += candidate.cost; };
+    for (const candidate of [...candidates].filter((item) => item.mandatory).sort(stablePortfolioOrder))
+        if (used + candidate.cost <= budget)
+            take(candidate);
+    for (const module of [...new Set(candidates.map((candidate) => candidate.module))].sort()) {
+        const representative = candidates.filter((candidate) => candidate.module === module && !selectedKeys.has(keyFor(candidate))).sort(stablePortfolioOrder)[0];
+        if (representative && used + representative.cost <= budget)
+            take(representative);
+    }
+    for (const candidate of [...candidates].sort(stablePortfolioOrder))
+        if (!selectedKeys.has(keyFor(candidate)) && used + candidate.cost <= budget)
+            take(candidate);
+    const omissions = candidates.filter((candidate) => !selectedKeys.has(keyFor(candidate))).sort((left, right) => left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1)).map((candidate) => ({ path: candidate.path, hunk: candidate.hunk, bytes: candidate.bytes, reason: candidate.hunk === null ? "no-raw-hunks" : used + candidate.cost > budget ? "budget" : "not-selected", retrieval: retrieval(input.retrievalCoordinates.from, input.retrievalCoordinates.to, candidate.path, candidate.hunk) }));
+    return { budget: { limit: budget, used }, selected: selected.sort((left, right) => left.path.localeCompare(right.path) || (left.hunk ?? -1) - (right.hunk ?? -1)), omissions };
+}
+function fileFacts(diff, scope) { return diff.files.map((file, index) => { const row = scope[index]; return { path: file.path, ...(file.oldPath ? { oldPath: file.oldPath } : {}), status: file.status, stats: { insertions: file.insertions, deletions: file.deletions, binary: file.binary }, matcher: row.matcher, explanations: row.explanations, residue: row.residue, class: row.class }; }); }
+export async function evaluateVerification(cwd, head) {
+    let commands;
+    try {
+        commands = await resolveVerificationCommands(cwd);
+    }
+    catch (error) {
+        return { status: "unknown", cause: { code: error instanceof FlowError ? error.code : "INTERNAL_STATE", message: asMessage(error) }, results: [] };
+    }
+    if (commands.length === 0)
+        return { status: "not_configured", results: [] };
+    const results = [];
+    for (const command of commands) {
+        const argv = [command.command, ...command.args];
+        const known = verificationExecutor(command);
+        if ("cause" in known) {
+            results.push({ status: "unverifiable", label: command.label, command: command.command, argv, head, cause: known.cause });
+            continue;
+        }
+        try {
+            const execution = await runVerificationCommand(cwd, command);
+            results.push({ status: "executed", label: command.label, executor: known.executor, body: known.body, command: command.command, argv, head, exitCode: execution.code, durationMs: execution.durationMs, stdout: execution.stdout, stderr: execution.stderr });
+        }
+        catch (error) {
+            return { status: "unknown", cause: { code: error instanceof FlowError ? error.code : "INTERNAL_STATE", message: asMessage(error) }, results: [] };
+        }
+    }
+    return { status: "evaluated", results };
+}
+export async function collectEvidence(input) {
+    const candidate = input.candidateResult.candidate;
+    if (!candidate)
+        return null;
+    if (!input.diff)
+        return null;
+    const diff = input.diff;
+    const scope = await evaluateScope({ cwd: input.candidateResult.cwd, frozen: input.frozen, diff });
+    return { diff, scope, presentation: presentDiff({ diff, scope, budget: input.diffBudgetBytes, retrievalCoordinates: { from: input.frozen.base, to: input.frozen.coordinates.delivery.head } }), files: fileFacts(diff, scope), verification: await evaluateVerification(input.candidateResult.cwd, candidate.head), candidate };
+}

package/build/core/audit/facade.js

@@ -0,0 +1,42 @@
+import { createAuditCandidate, disposeAuditCandidate, readAuditCandidateDiff } from "./candidate.js";
+import { initialCoordinateRace, pinAuditCoordinates, pinAuditSnapshot, rereadCoordinateRace } from "./coordinates.js";
+import { collectEvidence } from "./evidence.js";
+import { collectFindings, emptyRaceReport } from "./report.js";
+import { readinessFromFacts } from "./readiness.js";
+export async function auditContract(input) {
+    const contractId = input.address.binding.commissionId;
+    let frozen;
+    try {
+        frozen = await pinAuditCoordinates({ cwd: input.cwd, address: input.address });
+    }
+    catch (error) {
+        const fallback = await pinAuditSnapshot({ address: input.address }).catch(() => null);
+        if (!fallback)
+            throw error;
+        return emptyRaceReport({ contractId, coordinates: fallback.coordinates, terms: { criteria: fallback.criteria, scope: fallback.scope, appendScope: fallback.appendScope }, detail: error instanceof Error ? error.message : String(error), race: initialCoordinateRace({ frozen: fallback, observed: error instanceof Error ? error.message : String(error) }) });
+    }
+    const candidateResult = await createAuditCandidate({ root: input.address.repo.stableRoot, contractId, frozen });
+    let evidence = null;
+    let verification;
+    try {
+        const diff = await readAuditCandidateDiff(candidateResult);
+        evidence = await collectEvidence({ candidateResult, frozen, diff, diffBudgetBytes: input.diffBudgetBytes ?? 32_000 });
+        verification = evidence?.verification ?? { status: "not_evaluated", reason: candidateResult.rehearsal.status === "conflict" ? "renew_conflict" : "renew_unknown", results: [] };
+        await input.afterEvidence?.();
+    }
+    finally {
+        await disposeAuditCandidate(candidateResult);
+    }
+    const race = await rereadCoordinateRace({ cwd: input.cwd, address: input.address, frozen });
+    if (race) {
+        const detail = typeof race.observed === "string"
+            ? `final coordinate reread failed: ${race.observed}`
+            : race.which === "delivery-worktree"
+                ? "delivery worktree bytes or HEAD changed"
+                : `audit coordinates changed while evidence was collected: ${race.which}`;
+        return emptyRaceReport({ contractId, coordinates: frozen.coordinates, terms: { criteria: frozen.criteria, scope: frozen.scope, appendScope: frozen.appendScope }, detail, race });
+    }
+    const readiness = readinessFromFacts(frozen.readiness);
+    const findings = collectFindings({ contractId, deliveryCwd: frozen.deliveryCwd, rehearsal: candidateResult.rehearsal, scope: evidence?.scope ?? null, verification, readiness });
+    return { contract: contractId, coordinates: frozen.coordinates, terms: { criteria: frozen.criteria, scope: frozen.scope, appendScope: frozen.appendScope }, rehearsal: candidateResult.rehearsal, candidate: evidence ? (evidence.candidate.rewritten ? { kind: "renew-rehearsal", base: evidence.candidate.base, head: evidence.candidate.head, tree: evidence.candidate.tree, deliveryHead: frozen.coordinates.delivery.head, targetHead: frozen.coordinates.target.head } : { kind: "delivery", base: evidence.candidate.base, head: evidence.candidate.head, tree: evidence.candidate.tree }) : null, diff: evidence?.diff ?? null, presentation: evidence?.presentation ?? null, files: evidence?.files ?? null, scope: evidence?.scope ?? null, verification, readiness, findings, counts: { files: evidence?.files.length ?? 0, selected: evidence?.presentation.selected.length ?? 0, omitted: evidence?.presentation.omissions.length ?? 0, inScope: evidence?.scope.filter((row) => row.class === "in-scope").length ?? 0, downgraded: evidence?.scope.filter((row) => row.class === "downgraded").length ?? 0, violated: evidence?.scope.filter((row) => row.class === "violated").length ?? 0, findings: findings.length } };
+}

package/build/core/audit/readiness.js

@@ -0,0 +1,4 @@
+/** Readiness is assembled from the coordinate owner's one frozen read. */
+export function readinessFromFacts(facts) {
+    return facts;
+}

package/build/core/audit/report.js

@@ -0,0 +1,38 @@
+export function collectFindings(input) {
+    const findings = [];
+    const selector = `keiyaku @${input.contractId}`;
+    if (input.rehearsal.status === "clean")
+        findings.push({ code: "BASE_DRIFT", detail: `${input.rehearsal.oldBase} -> ${input.rehearsal.newBase}`, nextCommand: `${selector} renew` });
+    if (input.rehearsal.status === "conflict")
+        findings.push({ code: "RENEW_CONFLICT", detail: input.rehearsal.paths.join(", "), nextCommand: `${selector} renew` });
+    if (input.rehearsal.status === "unknown")
+        findings.push({ code: "RENEW_UNKNOWN", detail: `${input.rehearsal.cause.code}: ${input.rehearsal.cause.message}`, nextCommand: `${selector} audit` });
+    for (const row of input.scope?.filter((item) => item.class === "violated") ?? [])
+        findings.push({ code: "SCOPE_RESIDUE", detail: `${row.path}: ${row.residue.length} unexplained changes`, nextCommand: `${selector} amend --scope-add ${JSON.stringify(row.path)}` });
+    if (input.verification.status === "evaluated") {
+        for (const result of input.verification.results) {
+            if (result.status === "executed" && result.exitCode !== 0)
+                findings.push({ code: "VERIFICATION_FAILED", detail: `${result.label} exited ${result.exitCode}`, nextCommand: result.command });
+            if (result.status === "unverifiable")
+                findings.push({ code: "VERIFICATION_UNVERIFIABLE", detail: `${result.label}: ${result.cause}`, nextCommand: result.command });
+        }
+    }
+    const residue = input.readiness.deliveryResidue;
+    if (residue.tracked.length + residue.staged.length + residue.unstaged.length + residue.untracked.length > 0)
+        findings.push({ code: "DELIVERY_RESIDUE", detail: `registered delivery worktree has uncommitted residue at ${input.deliveryCwd}`, nextCommand: `git -C ${JSON.stringify(input.deliveryCwd)} status --short` });
+    if (input.readiness.arc.max > 0 && input.readiness.arc.open === null && input.readiness.arc.looseCommits.length > 0)
+        findings.push({ code: "LOOSE_COMMITS", detail: `${input.readiness.arc.looseCommits.length} loose commits after fence`, nextCommand: `printf '# Continue\\n\\n## Objective\\nReceipt loose commits.\\n\\n## Brief\\nContinue delivery.\\n' | ${selector} arc` });
+    if (input.readiness.renewSession.open)
+        findings.push({ code: "RENEW_SESSION_OPEN", detail: "renew recovery session is open", nextCommand: `${selector} renew --continue` });
+    if (input.readiness.rewriteGuard.liveProjection)
+        findings.push({ code: "LIVE_REWRITE_GUARD", detail: "a live projection owns the delivery worktree", nextCommand: "keiyaku status" });
+    for (const dependency of input.readiness.dependencies.filter((item) => !item.satisfied))
+        findings.push({ code: "DEPENDENCY_OPEN", detail: `dependency ${dependency.id} is ${dependency.state}`, nextCommand: `keiyaku @${dependency.id} log` });
+    if (input.readiness.petition.state === "petitioned" && input.readiness.petition.queue?.position !== 1)
+        findings.push({ code: "PETITION_QUEUE", detail: `petition queue position ${input.readiness.petition.queue?.position ?? "unknown"}`, nextCommand: "keiyaku status" });
+    return findings;
+}
+export function emptyRaceReport(input) {
+    const findings = [{ code: "COORDINATE_RACE", detail: input.detail, nextCommand: `keiyaku @${input.contractId} audit`, race: input.race }];
+    return { contract: input.contractId, coordinates: input.coordinates, terms: input.terms, rehearsal: { status: "unknown", cause: { code: "COORDINATE_RACE", message: input.detail } }, candidate: null, diff: null, presentation: null, files: null, scope: null, verification: { status: "not_evaluated", reason: "coordinate_race", results: [] }, readiness: null, findings, counts: { files: 0, selected: 0, omitted: 0, inScope: 0, downgraded: 0, violated: 0, findings: 1 } };
+}