@awak-app/simy-cli 0.2.3 → 0.4.0

package/src/sqm/proof.js

@@ -0,0 +1,154 @@
+import { createHash, createPrivateKey, createPublicKey, generateKeyPairSync, randomUUID, sign, verify } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { homedir } from "node:os";
+import path from "node:path";
+
+import { canonicalize } from "./canonical.js";
+
+export function repositoryIdentity(repository) {
+  return {
+    repository: repository.repository,
+    base_ref: repository.base_ref,
+    base_commit: repository.base_commit ?? null,
+    head_commit: repository.head_commit ?? null,
+    committed_diff_digest: repository.committed_diff_digest ?? null,
+    working_tree_digest: repository.working_tree_digest ?? null,
+    diff_digest: repository.diff_digest ?? null,
+  };
+}
+
+export function sameRepositoryIdentity(left, right) {
+  return ["repository", "base_ref", "base_commit", "head_commit", "committed_diff_digest", "working_tree_digest", "diff_digest"]
+    .every((key) => left?.[key] === right?.[key]);
+}
+
+export function finalizeMinCheck(value) {
+  const result = structuredClone(value);
+  delete result.result_digest;
+  return { ...result, result_digest: taggedDigest(result) };
+}
+
+export function verifyMinCheck(value) {
+  if (!value || value.schema_version !== "1.0.0" || value.kind !== "sqm_min_check") throw new Error("SQM min-check result is invalid.");
+  const copy = structuredClone(value);
+  const claimed = copy.result_digest;
+  delete copy.result_digest;
+  if (claimed !== taggedDigest(copy)) throw new Error("SQM min-check result digest does not match its content.");
+  return value;
+}
+
+export function buildProof({ organizationId, repository, bundle, minCheck, evaluation, findings, cliVersion, executedAt = new Date().toISOString() }) {
+  const statuses = evaluation.modules.flatMap((module) => module.scenarios.map((scenario) => scenario.status));
+  const failedModules = evaluation.modules.filter((module) => module.scenarios.some((scenario) => scenario.status === "failed"));
+  const hasFailure = findings.length > 0 || failedModules.length > 0;
+  const shadowOnly = hasFailure && findings.every((finding) => finding.lifecycle === "shadow") && failedModules.every((module) => module.lifecycle === "shadow");
+  const requiresHuman = statuses.includes("requires_human");
+  const requiresPostDeploy = statuses.includes("requires_post_deploy");
+  const status = shadowOnly ? "shadow" : hasFailure ? "failed" : requiresHuman ? "requires_human" : requiresPostDeploy ? "requires_post_deploy" : evaluation.modules.length === 0 ? "skipped" : "passed";
+  const proof = {
+    schema_version: "1.0.0",
+    proof_id: `SQM-PROOF-${randomUUID()}`,
+    organization_id: organizationId,
+    repository_identity: repositoryIdentity(repository),
+    knowledge_bundle: {
+      id: bundle.bundle_id,
+      version: bundle.version,
+      digest: bundle.integrity.digest,
+      signing_key_id: bundle.integrity.key_id,
+    },
+    min_check: {
+      result_digest: minCheck.result_digest,
+      executed_at: minCheck.executed_at,
+      status: minCheck.status,
+      preliminary_finding_count: minCheck.preliminary_findings.length,
+    },
+    executions: evaluation.modules,
+    findings,
+    outcome: {
+      status,
+      reasons: [
+        ...(hasFailure && !shadowOnly ? ["one_or_more_declarative_checks_failed"] : []),
+        ...(shadowOnly ? ["declarative_checks_failed_in_shadow_mode"] : []),
+        ...(evaluation.modules.length === 0 ? ["no_applicable_knowledge_module"] : []),
+        ...(requiresHuman ? ["human_evidence_required"] : []),
+        ...(requiresPostDeploy ? ["post_deploy_evidence_required"] : []),
+      ],
+    },
+    provenance: { cli_version: cliVersion, executed_at: executedAt, executor: "simy-cli" },
+  };
+  return { ...proof, integrity: { algorithm: "sha256", digest: taggedDigest(proof) } };
+}
+
+export function verifyProof(proof) {
+  const copy = structuredClone(proof);
+  const integrity = copy.integrity;
+  delete copy.integrity;
+  if (integrity?.algorithm !== "sha256" || integrity.digest !== taggedDigest(copy)) throw new Error("SQM proof digest verification failed.");
+  return integrity.digest;
+}
+
+export async function signProof(proof, {
+  deviceId,
+  accountId = null,
+  keyPath = process.env.SIMY_SQM_SIGNING_KEY_PATH || path.join(process.env.SIMY_HOME?.trim() || path.join(homedir(), ".simy"), "sqm", "run-signing-key.json"),
+  issuedAt = new Date().toISOString(),
+} = {}) {
+  if (!deviceId) throw new Error("A trusted SIMY CLI device identity is required to sign SQM proof.");
+  const identity = await loadOrCreateSigningIdentity(keyPath);
+  const proofDigest = verifyProof(proof);
+  const signature = sign(null, Buffer.from(proofDigest.slice("sha256:".length), "hex"), identity.privateKey).toString("base64");
+  return {
+    schema_version: "1.0.0",
+    evidence_id: `SQM-EVIDENCE-${randomUUID()}`,
+    proof_id: proof.proof_id,
+    organization_id: proof.organization_id,
+    repository: proof.repository_identity.repository,
+    proof_digest: proofDigest,
+    signer: {
+      type: "simy_cli_device",
+      device_id: deviceId,
+      account_id: accountId,
+      key_id: identity.keyId,
+      public_key: identity.publicKeyDer.toString("base64"),
+    },
+    issued_at: issuedAt,
+    integrity: { algorithm: "ed25519", signature },
+  };
+}
+
+export function verifySignedEvidence(proof, evidence) {
+  const proofDigest = verifyProof(proof);
+  if (evidence?.proof_id !== proof.proof_id || evidence?.proof_digest !== proofDigest || evidence?.organization_id !== proof.organization_id || evidence?.repository !== proof.repository_identity.repository) throw new Error("SQM signed evidence is not bound to this proof.");
+  if (evidence?.integrity?.algorithm !== "ed25519") throw new Error("SQM signed evidence uses an unsupported algorithm.");
+  const publicKeyDer = Buffer.from(String(evidence?.signer?.public_key || ""), "base64");
+  const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
+  if (evidence?.signer?.key_id !== keyId) throw new Error("SQM signed evidence key ID does not match its public key.");
+  const publicKey = createPublicKey({ key: publicKeyDer, format: "der", type: "spki" });
+  const signature = Buffer.from(String(evidence?.integrity?.signature || ""), "base64");
+  if (signature.length !== 64 || !verify(null, Buffer.from(proofDigest.slice("sha256:".length), "hex"), publicKey, signature)) throw new Error("SQM per-run signature verification failed.");
+  return { proof_digest: proofDigest, key_id: keyId, valid: true };
+}
+
+async function loadOrCreateSigningIdentity(location) {
+  try {
+    const parsed = JSON.parse(await readFile(location, "utf8"));
+    const privateKey = createPrivateKey({ key: Buffer.from(parsed.private_key, "base64"), format: "der", type: "pkcs8" });
+    const publicKeyDer = Buffer.from(parsed.public_key, "base64");
+    const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
+    if (parsed.key_id !== keyId) throw new Error("stored key ID mismatch");
+    return { privateKey, publicKeyDer, keyId };
+  } catch (error) {
+    if (error?.code !== "ENOENT") throw new Error(`SQM signing identity is invalid: ${error.message}`);
+  }
+  const pair = generateKeyPairSync("ed25519");
+  const privateKeyDer = pair.privateKey.export({ format: "der", type: "pkcs8" });
+  const publicKeyDer = pair.publicKey.export({ format: "der", type: "spki" });
+  const keyId = `sha256:${createHash("sha256").update(publicKeyDer).digest("hex")}`;
+  await mkdir(path.dirname(location), { recursive: true, mode: 0o700 });
+  await writeFile(location, `${JSON.stringify({ algorithm: "ed25519", key_id: keyId, private_key: privateKeyDer.toString("base64"), public_key: publicKeyDer.toString("base64"), created_at: new Date().toISOString() }, null, 2)}\n`, { encoding: "utf8", mode: 0o600 });
+  return { privateKey: pair.privateKey, publicKeyDer, keyId };
+}
+
+function taggedDigest(value) {
+  return `sha256:${createHash("sha256").update(canonicalize(value), "utf8").digest("hex")}`;
+}

package/src/sqm/repository.js

@@ -0,0 +1,163 @@
+import { execFile } from "node:child_process";
+import { createHash } from "node:crypto";
+import { lstat, readFile } from "node:fs/promises";
+import path from "node:path";
+import { promisify } from "node:util";
+
+import { normalizeGitHubRemote } from "../workspace-context.js";
+
+const execFileAsync = promisify(execFile);
+const MAX_UNTRACKED_FILE_BYTES = 1024 * 1024;
+const MAX_UNTRACKED_TOTAL_BYTES = 10 * 1024 * 1024;
+const MAX_UNTRACKED_FILES = 1_000;
+const MAX_UNTRACKED_LINES = 100_000;
+const UTF8_DECODER = new TextDecoder("utf-8", { fatal: true });
+
+export async function inspectRepository(cwd, { baseBranch = "dev", runCommand = execFileAsync } = {}) {
+  const root = await git(runCommand, ["rev-parse", "--show-toplevel"], cwd);
+  const remote = await git(runCommand, ["remote", "get-url", "origin"], root);
+  const repository = normalizeGitHubRemote(remote);
+  if (!repository) throw new Error("SQM requires a GitHub origin remote in owner/repository form.");
+  const baseRef = await resolveBaseRef(runCommand, root, baseBranch);
+  const baseCommit = await git(runCommand, ["merge-base", baseRef, "HEAD"], root);
+  const headCommit = await git(runCommand, ["rev-parse", "HEAD"], root);
+  const committed = await git(runCommand, ["diff", "--unified=0", "--no-color", `${baseRef}...HEAD`], root);
+  const working = await git(runCommand, ["diff", "--unified=0", "--no-color", "HEAD"], root);
+  const untracked = zeroSeparated(
+    await git(runCommand, ["ls-files", "-z", "--others", "--exclude-standard"], root),
+  );
+  const files = zeroSeparated(
+    await git(
+      runCommand,
+      ["ls-files", "-z", "--cached", "--others", "--exclude-standard"],
+      root,
+    ),
+  );
+  const trackedDiff = parseUnifiedDiff(`${committed}\n${working}`);
+  const untrackedDiff = await untrackedAddedDiff(root, untracked);
+  const diff = [...trackedDiff, ...untrackedDiff];
+  const workingTreeDigest = digest({ working, untracked: untrackedDiff });
+  return {
+    root,
+    repository,
+    base_ref: baseRef,
+    base_commit: baseCommit,
+    head_commit: headCommit,
+    committed_diff_digest: digest(committed),
+    working_tree_digest: workingTreeDigest,
+    diff_digest: digest(diff),
+    diff,
+    paths: [...new Set(files)],
+  };
+}
+
+function digest(value) {
+  const encoded = typeof value === "string" ? value : JSON.stringify(value);
+  return `sha256:${createHash("sha256").update(encoded).digest("hex")}`;
+}
+
+async function untrackedAddedDiff(root, files) {
+  const result = [];
+  let totalBytes = 0;
+  for (const relative of files.slice(0, MAX_UNTRACKED_FILES)) {
+    const resolved = pathInsideRoot(root, relative);
+    if (!resolved) continue;
+    let fileStat;
+    try {
+      fileStat = await lstat(resolved);
+    } catch {
+      continue;
+    }
+    if (
+      !fileStat.isFile() ||
+      fileStat.isSymbolicLink() ||
+      fileStat.size > MAX_UNTRACKED_FILE_BYTES ||
+      totalBytes + fileStat.size > MAX_UNTRACKED_TOTAL_BYTES
+    ) {
+      continue;
+    }
+    let buffer;
+    let content;
+    try {
+      buffer = await readFile(resolved);
+      if (buffer.includes(0)) continue;
+      content = UTF8_DECODER.decode(buffer);
+    } catch {
+      continue;
+    }
+    const textLines = content.split(/\r?\n/);
+    if (textLines.length > MAX_UNTRACKED_LINES) continue;
+    if (textLines.at(-1) === "") textLines.pop();
+    totalBytes += buffer.length;
+    result.push({
+      path: relative,
+      lines: textLines.map((text, index) => ({ side: "added", line: index + 1, text })),
+    });
+  }
+  return result;
+}
+
+export function parseUnifiedDiff(raw) {
+  const files = new Map();
+  let current = null;
+  let oldPath = null;
+  let oldLine = 0;
+  let newLine = 0;
+  for (const line of String(raw || "").split(/\r?\n/)) {
+    if (line.startsWith("--- ")) {
+      const candidate = line.slice(4).replace(/^a\//, "");
+      oldPath = candidate === "/dev/null" ? null : candidate;
+      continue;
+    }
+    if (line.startsWith("+++ ")) {
+      const candidate = line.slice(4).replace(/^b\//, "");
+      current = candidate === "/dev/null" ? oldPath : candidate;
+      if (current && !files.has(current)) files.set(current, []);
+      continue;
+    }
+    const hunk = /^@@ -(\d+)(?:,\d+)? \+(\d+)(?:,\d+)? @@/.exec(line);
+    if (hunk) {
+      oldLine = Number(hunk[1]);
+      newLine = Number(hunk[2]);
+      continue;
+    }
+    if (!current || line.startsWith("diff --git ")) continue;
+    if (line.startsWith("+") && !line.startsWith("+++")) {
+      files.get(current).push({ side: "added", line: newLine, text: line.slice(1) });
+      newLine += 1;
+    } else if (line.startsWith("-") && !line.startsWith("---")) {
+      files.get(current).push({ side: "removed", line: oldLine, text: line.slice(1) });
+      oldLine += 1;
+    } else if (!line.startsWith("\\")) {
+      oldLine += 1;
+      newLine += 1;
+    }
+  }
+  return [...files.entries()].map(([path, lines]) => ({ path, lines }));
+}
+
+async function resolveBaseRef(runCommand, cwd, baseBranch) {
+  for (const ref of [`origin/${baseBranch}`, baseBranch]) {
+    try {
+      await git(runCommand, ["rev-parse", "--verify", ref], cwd);
+      return ref;
+    } catch {
+      // Try the local branch after origin/<branch>.
+    }
+  }
+  throw new Error(`SQM could not resolve base branch ${baseBranch}.`);
+}
+
+async function git(runCommand, args, cwd) {
+  const result = await runCommand("git", args, { cwd, maxBuffer: 10 * 1024 * 1024 });
+  return String(result?.stdout || "").trimEnd();
+}
+
+function zeroSeparated(value) {
+  return String(value || "").split("\0").filter(Boolean);
+}
+
+function pathInsideRoot(root, relative) {
+  const resolved = path.resolve(root, relative);
+  return resolved !== root && resolved.startsWith(`${root}${path.sep}`) ? resolved : null;
+}

package/src/sqm/session.js

@@ -0,0 +1,58 @@
+import { startAgent } from "../agent.js";
+import { openAuthorizationUrl } from "../browser.js";
+import { isSessionValid, readSession } from "../session-store.js";
+import { createAgentShutdown } from "../shutdown.js";
+
+const DEFAULT_AUTH_TIMEOUT_MS = 2 * 60 * 1000;
+
+export async function ensureSqmSession(
+  webOrigin,
+  {
+    noOpen = false,
+    timeoutMs = DEFAULT_AUTH_TIMEOUT_MS,
+    logger = console,
+    now = Date.now,
+    sleep = (milliseconds) => new Promise((resolve) => setTimeout(resolve, milliseconds)),
+    readSessionImpl = readSession,
+    isSessionValidImpl = isSessionValid,
+    startAgentImpl = startAgent,
+    openAuthorizationUrlImpl = openAuthorizationUrl,
+    createAgentShutdownImpl = createAgentShutdown,
+  } = {},
+) {
+  let session = await readSessionImpl(webOrigin);
+  if (sqmSessionReady(session, webOrigin, now(), isSessionValidImpl)) return session;
+
+  const agent = await startAgentImpl({ requestedPort: 0, webOrigin, quiet: true });
+  const shutdown = createAgentShutdownImpl(agent);
+  try {
+    const loginUrl = agent.loginUrl;
+    if (!loginUrl) throw new Error("SIMY could not create an SQM authorization session.");
+    logger.log("SIMY sign-in is required before the SQM check can continue.");
+    if (noOpen) logger.log(`Open this URL to authorize SIMY CLI: ${loginUrl}`);
+    else await openAuthorizationUrlImpl(loginUrl, { logger });
+    logger.log("Waiting for browser authorization...");
+
+    const deadline = now() + timeoutMs;
+    while (now() < deadline) {
+      await sleep(Math.min(500, Math.max(1, deadline - now())));
+      session = await readSessionImpl(webOrigin);
+      if (sqmSessionReady(session, webOrigin, now(), isSessionValidImpl)) {
+        logger.log("SIMY CLI authorization completed. Continuing SQM check.");
+        return session;
+      }
+    }
+    throw new Error("SIMY authorization timed out. Complete the browser sign-in and rerun the SQM command.");
+  } finally {
+    await shutdown();
+  }
+}
+
+function sqmSessionReady(session, webOrigin, now, isSessionValidImpl) {
+  return Boolean(
+    isSessionValidImpl(session, now, webOrigin) &&
+      (session?.organization_id || session?.org_id) &&
+      session?.token &&
+      session?.api_base_url,
+  );
+}