@bolloon/bolloon-agent 0.1.35 → 0.1.37

package/dist/bollharness/src/scripts/checks/check_fragment_integrity.js

@@ -1,34 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    const fragmentDir = path.join(repoRoot, "scripts", "context-fragments");
-    const routerFile = path.join(repoRoot, "src", "scripts", "context_router.ts");
-    if (!fs.existsSync(routerFile)) {
-        findings.push({
-            severity: "P1",
-            message: "context_router.ts not found",
-            file: "src/scripts/context_router.ts",
-            blocking: false,
-            category: "governance_bootstrap",
-            problem_class: "unknown",
-            required_skills: [],
-            required_reads: [],
-        });
-        return findings;
-    }
-    if (!fs.existsSync(fragmentDir)) {
-        findings.push({
-            severity: "P2",
-            message: "context-fragments directory not found",
-            file: "scripts/context-fragments/",
-            blocking: false,
-            category: "governance_bootstrap",
-            problem_class: "unknown",
-            required_skills: [],
-            required_reads: [],
-        });
-        return findings;
-    }
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_hook_installed.js

@@ -1,63 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    const hookFiles = [
-        "src/scripts/hooks/loop-detection.ts",
-        "src/scripts/hooks/risk-tracker.ts",
-        "src/scripts/hooks/stop-evaluator.ts",
-        "src/scripts/hooks/guard-feedback.ts",
-        "src/scripts/hooks/deploy-guard.ts",
-    ];
-    const settingsFile = path.join(repoRoot, ".boll", "settings.json");
-    if (!fs.existsSync(settingsFile)) {
-        findings.push({
-            severity: "P1",
-            message: ".boll/settings.json does not exist",
-            file: ".boll/settings.json",
-            blocking: false,
-            category: "general",
-            problem_class: "unknown",
-            required_skills: [],
-            required_reads: [],
-        });
-        return findings;
-    }
-    try {
-        const settings = JSON.parse(fs.readFileSync(settingsFile, "utf-8"));
-        const registeredHooks = settings.hooks || {};
-        for (const [stage, hooks] of Object.entries(registeredHooks)) {
-            const hookList = hooks;
-            for (const hookGroup of hookList) {
-                for (const hook of hookGroup.hooks || []) {
-                    const cmd = hook.command || "";
-                    if (cmd.includes("python3") && cmd.includes(".py")) {
-                        findings.push({
-                            severity: "P1",
-                            message: `Hook in ${stage} still references Python script: ${cmd}`,
-                            file: ".boll/settings.json",
-                            blocking: false,
-                            category: "governance_bootstrap",
-                            problem_class: "unknown",
-                            required_skills: [],
-                            required_reads: [],
-                        });
-                    }
-                }
-            }
-        }
-    }
-    catch (exc) {
-        findings.push({
-            severity: "P1",
-            message: `Failed to parse settings.json: ${exc}`,
-            file: ".boll/settings.json",
-            blocking: false,
-            category: "governance_bootstrap",
-            problem_class: "unknown",
-            required_skills: [],
-            required_reads: [],
-        });
-    }
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_issue_closure.js

@@ -1,41 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    const docsIssuesDir = path.join(repoRoot, "docs", "issues");
-    if (!fs.existsSync(docsIssuesDir)) {
-        return findings;
-    }
-    const issueFiles = fs.readdirSync(docsIssuesDir).filter(f => f.endsWith(".md"));
-    for (const issueFile of issueFiles) {
-        const issuePath = path.join(docsIssuesDir, issueFile);
-        const content = fs.readFileSync(issuePath, "utf-8");
-        const hasStatus = /^(status|State):\s*/im.test(content);
-        const hasResolution = /^(resolution|Closed):\s*/im.test(content);
-        if (!hasStatus) {
-            findings.push({
-                severity: "P2",
-                message: `Issue ${issueFile} missing status field`,
-                file: `docs/issues/${issueFile}`,
-                blocking: false,
-                category: "doc_integrity",
-                problem_class: "unknown",
-                required_skills: [],
-                required_reads: [],
-            });
-        }
-        if (!hasResolution) {
-            findings.push({
-                severity: "P2",
-                message: `Issue ${issueFile} missing resolution/closed field`,
-                file: `docs/issues/${issueFile}`,
-                blocking: false,
-                category: "doc_integrity",
-                problem_class: "unknown",
-                required_skills: [],
-                required_reads: [],
-            });
-        }
-    }
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_mcp_parity.js

@@ -1,6 +0,0 @@
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    if (mode !== "full" && mode !== "ci")
-        return findings;
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_security.js

@@ -1,48 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-const SENSITIVE_PATTERNS = [
-    { pattern: /api[_-]?key["\s:=]+["'][a-zA-Z0-9]{20,}["']/gi, severity: "P0" },
-    { pattern: /password["\s:=]+["'][^"']{8,}["']/gi, severity: "P0" },
-    { pattern: /secret["\s:=]+["'][a-zA-Z0-9]{16,}["']/gi, severity: "P0" },
-    { pattern: /token["\s:=]+["'][a-zA-Z0-9]{20,}["']/gi, severity: "P1" },
-    { pattern: /bearer\s+[a-zA-Z0-9]{20,}/gi, severity: "P1" },
-];
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    if (mode !== "full" && mode !== "ci")
-        return findings;
-    const extensions = [".ts", ".tsx", ".js", ".jsx", ".py", ".json", ".yaml", ".yml"];
-    function scanDir(dir) {
-        if (!fs.existsSync(dir))
-            return;
-        const entries = fs.readdirSync(dir, { withFileTypes: true });
-        for (const entry of entries) {
-            const fullPath = path.join(dir, entry.name);
-            if (entry.isDirectory()) {
-                if (!entry.name.startsWith(".") && entry.name !== "node_modules") {
-                    scanDir(fullPath);
-                }
-            }
-            else if (extensions.includes(path.extname(entry.name))) {
-                const content = fs.readFileSync(fullPath, "utf-8");
-                for (const { pattern, severity } of SENSITIVE_PATTERNS) {
-                    const matches = content.match(pattern);
-                    if (matches) {
-                        findings.push({
-                            severity,
-                            message: `Potential secret detected: ${matches[0].slice(0, 30)}...`,
-                            file: path.relative(repoRoot, fullPath),
-                            blocking: severity === "P0",
-                            category: "security",
-                            problem_class: "secret_exposure",
-                            required_skills: [],
-                            required_reads: [],
-                        });
-                    }
-                }
-            }
-        }
-    }
-    scanDir(repoRoot);
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_skill_parity.js

@@ -1,6 +0,0 @@
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    if (mode !== "full" && mode !== "ci")
-        return findings;
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/check_versions.js

@@ -1,6 +0,0 @@
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    if (mode !== "full" && mode !== "ci")
-        return findings;
-    return findings;
-}

package/dist/bollharness/src/scripts/checks/finding.js

@@ -1,13 +0,0 @@
-export function createFinding(params) {
-    return {
-        severity: params.severity,
-        message: params.message,
-        file: params.file,
-        line: params.line,
-        blocking: params.blocking ?? false,
-        category: params.category ?? "general",
-        problem_class: params.problem_class ?? "unknown",
-        required_skills: params.required_skills ?? [],
-        required_reads: params.required_reads ?? [],
-    };
-}

package/dist/bollharness/src/scripts/checks/next_decision_number.js

@@ -1,20 +0,0 @@
-import { execSync } from "child_process";
-const REPO_ROOT = process.cwd();
-export function main() {
-    const args = process.argv.slice(2);
-    if (args[0] === "next") {
-        try {
-            const result = execSync("git log --oneline -1", { cwd: REPO_ROOT, encoding: "utf-8" });
-            const match = result.match(/ADR-(\d+)/);
-            if (match) {
-                const nextNum = parseInt(match[1], 10) + 1;
-                console.log(`ADR-${nextNum}`);
-            }
-        }
-        catch { }
-    }
-    process.exit(0);
-}
-if (require.main === module) {
-    main();
-}

package/dist/bollharness/src/scripts/checks/regenerate_magic_docs.js

@@ -1,6 +0,0 @@
-export function run(repoRoot, mode = "full") {
-    const findings = [];
-    if (mode !== "full" && mode !== "ci")
-        return findings;
-    return findings;
-}

package/dist/bollharness/src/scripts/ci/detect_rebaseline_triggers.js

@@ -1,8 +0,0 @@
-const REPO_ROOT = process.cwd();
-export function main() {
-    console.log("Detecting rebase triggers...");
-    process.exit(0);
-}
-if (require.main === module) {
-    main();
-}

package/dist/bollharness/src/scripts/ci/scan_subprocess_cfg.js

@@ -1,8 +0,0 @@
-const REPO_ROOT = process.cwd();
-export function main() {
-    console.log("Scanning subprocess configurations...");
-    process.exit(0);
-}
-if (require.main === module) {
-    main();
-}

package/dist/bollharness/src/scripts/ci/scan_verify_artifacts.js

@@ -1,8 +0,0 @@
-const REPO_ROOT = process.cwd();
-export function main() {
-    console.log("Scanning for artifact verification...");
-    process.exit(0);
-}
-if (require.main === module) {
-    main();
-}

package/dist/bollharness/src/scripts/ci/scan_yaml_schema.js

@@ -1,8 +0,0 @@
-const REPO_ROOT = process.cwd();
-export function main() {
-    console.log("Scanning YAML schemas...");
-    process.exit(0);
-}
-if (require.main === module) {
-    main();
-}

package/dist/bollharness/src/scripts/context_router.js

@@ -1,67 +0,0 @@
-import * as fs from "fs";
-import * as path from "path";
-export const FRAGMENTS_DIR = path.join(__dirname, "..", "context-fragments");
-export const CONTEXT_MAP = {
-    "bridge_agent/": ["bridge-constitution"],
-    "backend/product/bridge/": ["bridge-constitution"],
-    "mcp-server/": ["mcp-parity"],
-    "mcp-server-node/": ["mcp-parity"],
-    "backend/product/routes/protocol.py": ["protocol-consumers", "contract-consumers"],
-    "backend/product/protocol/": ["protocol-consumers"],
-    "backend/product/routes/": ["contract-consumers"],
-    "backend/product/db/crud_events.py": ["run-events-consumers"],
-    "backend/product/auth/": ["auth-consumers"],
-    "backend/product/db/": ["db-shared-structures"],
-    "backend/product/catalyst/": ["catalyst-distributed"],
-    "docs/issues/": ["fixed-three-layers", "closure-checklist"],
-    "scenes/": ["scene-fidelity", "two-language"],
-    "website/app/[scene]/": ["scene-fidelity", "two-language"],
-    "website/components/scene/": ["scene-fidelity", "two-language"],
-    "CLAUDE.md": ["truth-source-hierarchy"],
-    "MEMORY.md": ["truth-source-hierarchy"],
-    "docs/INDEX.md": ["truth-source-hierarchy"],
-    "mcp-server/pyproject.toml": ["version-sources"],
-    "mcp-server-node/package.json": ["version-sources"],
-    "website/": ["two-language"],
-    "docs/decisions/": ["artifact-linkage"],
-    "backend/product/": ["issue-first"],
-    "backend/server.py": ["issue-first"],
-    "mcp-server/boll_mcp/": ["issue-first"],
-    "mcp-server-node/src/": ["issue-first"],
-    "website/app/": ["issue-first"],
-};
-export const FALLBACK_FRAGMENTS = ["general-dev-principles"];
-export function match(filePath) {
-    if (!filePath)
-        return [];
-    if (path.isAbsolute(filePath))
-        return [];
-    const normalized = path.normalize(filePath).replace(/\\/g, "/");
-    if (normalized.startsWith("../") || normalized === ".." || normalized.includes("/../")) {
-        return [];
-    }
-    const matched = [];
-    const sortedPatterns = Object.keys(CONTEXT_MAP).sort((a, b) => b.length - a.length);
-    for (const pattern of sortedPatterns) {
-        if (normalized.startsWith(pattern) || normalized.endsWith(pattern)) {
-            matched.push(...CONTEXT_MAP[pattern]);
-        }
-    }
-    return [...new Set(matched)];
-}
-export function loadFragment(name) {
-    if (!name)
-        return "";
-    const candidate = path.join(FRAGMENTS_DIR, `${name}.md`);
-    try {
-        const resolved = path.resolve(candidate);
-        const fragmentsDirResolved = path.resolve(FRAGMENTS_DIR);
-        if (!resolved.startsWith(fragmentsDirResolved))
-            return "";
-        if (fs.existsSync(resolved) && fs.statSync(resolved).isFile()) {
-            return fs.readFileSync(resolved, "utf-8").trim();
-        }
-    }
-    catch { }
-    return "";
-}

package/dist/bollharness/src/scripts/deploy-guard.js

@@ -1,157 +0,0 @@
-import * as fs from "fs";
-const PROD_IP = "47.118.31.230";
-const BRIDGE_VPS_HOSTS = ["46.250.229.84"];
-const GUARDED_HOSTS = [PROD_IP, ...BRIDGE_VPS_HOSTS];
-const DEPLOY_SH_PATTERN = /^bash\s+scripts\/deploy\.sh(\s+--(dry-run|yes))*\s*$/;
-const SSH_READONLY_CMDS = new Set([
-    "journalctl", "cat", "ls", "head", "tail", "grep",
-    "ss", "curl", "dig", "status", "git", "file", "stat",
-]);
-const SYSTEMCTL_WRITE_OPS = new Set(["restart", "stop", "start"]);
-function getCommand() {
-    try {
-        const input = JSON.parse(fs.readFileSync(0, "utf-8"));
-        return input.tool_input?.command ?? null;
-    }
-    catch {
-        return null;
-    }
-}
-function isDeploySh(cmd) {
-    return DEPLOY_SH_PATTERN.test(cmd.trim());
-}
-function hasGuardedHost(cmd) {
-    return GUARDED_HOSTS.some(host => cmd.includes(host));
-}
-function whichGuardedHost(cmd) {
-    for (const host of GUARDED_HOSTS) {
-        if (cmd.includes(host))
-            return host;
-    }
-    return null;
-}
-function isCompoundCommand(cmd) {
-    let stripped = cmd.replace(/"[^"]*"/g, "");
-    stripped = stripped.replace(/'[^']*'/g, "");
-    return /[;&|]{1,2}/.test(stripped);
-}
-function checkScpDirection(cmd) {
-    const parts = cmd.split(/\s+/);
-    if (!parts.length || parts[0] !== "scp")
-        return "none";
-    const args = parts.slice(1).filter(p => !p.startsWith("-"));
-    if (args.length < 2)
-        return "none";
-    const lastArg = args[args.length - 1];
-    if (GUARDED_HOSTS.some(host => lastArg.includes(host))) {
-        return "upload";
-    }
-    for (const arg of args.slice(0, -1)) {
-        if (GUARDED_HOSTS.some(host => arg.includes(host))) {
-            return "download";
-        }
-    }
-    return "none";
-}
-function checkSshCommand(cmd) {
-    if (!cmd.includes("ssh") || !hasGuardedHost(cmd))
-        return "none";
-    const quoted = cmd.match(/"([^"]*)"/)?.[1] ?? cmd.match(/'([^']*)'/)?.[1];
-    if (!quoted)
-        return "none";
-    const remoteCmd = quoted.trim();
-    const parts = remoteCmd.split(/\s+/);
-    if (!parts.length)
-        return "none";
-    let idx = 0;
-    if (parts[0] === "sudo") {
-        idx = 1;
-        while (idx < parts.length && parts[idx].startsWith("-")) {
-            if (parts[idx] === "-u" && idx + 1 < parts.length) {
-                idx += 2;
-            }
-            else {
-                idx += 1;
-            }
-        }
-    }
-    const firstWord = parts[idx] ?? "";
-    if (firstWord === "systemctl") {
-        if (idx + 1 < parts.length && SYSTEMCTL_WRITE_OPS.has(parts[idx + 1])) {
-            return "write";
-        }
-        return "readonly";
-    }
-    if (SSH_READONLY_CMDS.has(firstWord)) {
-        return "readonly";
-    }
-    return "write";
-}
-function checkRsync(cmd) {
-    if (!cmd.includes("rsync") || !hasGuardedHost(cmd))
-        return "none";
-    const parts = cmd.split(/\s+/);
-    if (parts.includes("-n") || cmd.includes("--dry-run")) {
-        return "dryrun";
-    }
-    for (const p of parts) {
-        if (p.startsWith("-") && !p.startsWith("--") && p.includes("n")) {
-            return "dryrun";
-        }
-    }
-    return "write";
-}
-function block(reason, host = null) {
-    let guidance;
-    if (host === PROD_IP) {
-        guidance = `请使用标准部署流程：
-  后端: bash scripts/deploy.sh --yes
-  Demo 正式: bash scripts/deploy-demo.sh <name> --channel prod --yes
-  Demo 内测: bash scripts/deploy-demo.sh <name> --channel preview --yes
-  Edge/Nginx: bash scripts/deploy-edge.sh --yes
-详见 CLAUDE.md Development Commands。`;
-    }
-    else if (BRIDGE_VPS_HOSTS.includes(host ?? "")) {
-        guidance = `Bridge VPS 必须走 git pull 更新路径：
-  ssh root@${host} 'sudo -u boll git -C /opt/boll pull --ff-only'
-  scp/rsync 直传会重新制造 orphan worktree。
-  详见 docs/issues/guard-20260408-0445-bridge-vps-orphan-worktree.md。`;
-    }
-    else {
-        guidance = "未识别的受保护服务器目标，请确认 deploy 路径。";
-    }
-    process.stderr.write(`BLOCKED: ${reason}\n${guidance}\n`);
-    process.exit(1);
-}
-export function main() {
-    const cmd = getCommand();
-    if (!cmd)
-        process.exit(0);
-    if (!hasGuardedHost(cmd))
-        process.exit(0);
-    const host = whichGuardedHost(cmd);
-    if (isCompoundCommand(cmd)) {
-        block("检测到复合命令中包含受保护服务器操作，禁止绕过标准部署路径", host);
-    }
-    if (isDeploySh(cmd))
-        process.exit(0);
-    const scpDir = checkScpDirection(cmd);
-    if (scpDir === "upload")
-        block("禁止手动 scp 上传到受保护服务器", host);
-    if (scpDir === "download")
-        process.exit(0);
-    const sshType = checkSshCommand(cmd);
-    if (sshType === "write")
-        block("禁止手动对受保护服务器执行写操作", host);
-    if (sshType === "readonly")
-        process.exit(0);
-    const rsyncType = checkRsync(cmd);
-    if (rsyncType === "write")
-        block("禁止手动 rsync 写入受保护服务器", host);
-    if (rsyncType === "dryrun")
-        process.exit(0);
-    block("检测到未识别的受保护服务器操作", host);
-}
-if (require.main === module) {
-    main();
-}