@cassiomc1/forgeloop 1.2.1 → 1.2.2

package/src/core/policy-adapters.js

@@ -0,0 +1,276 @@
+import { readFile, readdir } from "node:fs/promises";
+import path from "node:path";
+import { fileExists } from "./filesystem.js";
+import { sha256 } from "./manifest.js";
+
+const SECRET_PATTERNS = [
+  { name: "AWS Access Key", pattern: /AKIA[0-9A-Z]{16}/ },
+  { name: "Private Key", pattern: /-----BEGIN (?:RSA |EC |OPENSSH |DSA )?PRIVATE KEY-----/ },
+  { name: "GitHub Token", pattern: /gh[pousr]_[A-Za-z0-9_]{36,255}/ },
+  { name: "Generic API Key", pattern: /(?:api_key|apikey|secret_key|auth_token)\s*[:=]\s*["'][A-Za-z0-9_\-]{20,}["']/i },
+  { name: "Password Assignment", pattern: /(?:password|passwd|pwd)\s*[:=]\s*["'][^"'\s]{8,}["']/i },
+];
+
+const IGNORED_SECRET_FILES = [
+  "package-lock.json",
+  "pnpm-lock.yaml",
+  "yarn.lock",
+  ".forgeloop/policy/baseline.json",
+  ".forgeloop/policy/policy.lock",
+];
+
+const IGNORED_DIRECTORIES = new Set([
+  "node_modules",
+  ".git",
+  ".forgeloop",
+  "dist",
+  "build",
+  "coverage",
+]);
+
+async function collectFiles(directory, baseDir = directory) {
+  const files = [];
+  try {
+    const entries = await readdir(directory, { withFileTypes: true });
+    for (const entry of entries) {
+      if (IGNORED_DIRECTORIES.has(entry.name)) continue;
+      const fullPath = path.join(directory, entry.name);
+      if (entry.isDirectory()) {
+        const nested = await collectFiles(fullPath, baseDir);
+        files.push(...nested);
+      } else if (entry.isFile()) {
+        files.push(path.relative(baseDir, fullPath));
+      }
+    }
+  } catch {
+    // If directory not readable, return collected
+  }
+  return files;
+}
+
+export const BUILTIN_ADAPTERS = Object.freeze({
+  ["secret-detection"]: {
+    id: "secret-detection",
+    description: "Scans repository files for hardcoded credentials, tokens, and private keys.",
+    supports: () => true,
+    check: async ({ target, files = null, contentOverrides = null } = {}) => {
+      const targetFiles = files ?? (await collectFiles(target));
+      const violations = [];
+      let scannedFileCount = 0;
+
+      for (const relPath of targetFiles) {
+        if (IGNORED_SECRET_FILES.some((ignored) => relPath.endsWith(ignored))) continue;
+        // Only inspect text/source files
+        const ext = path.extname(relPath).toLowerCase();
+        const textExtensions = [".js", ".mjs", ".ts", ".jsx", ".tsx", ".py", ".rs", ".go", ".json", ".yaml", ".yml", ".toml", ".env", ".md", ".sh"];
+        if (ext && !textExtensions.includes(ext)) continue;
+
+        let content;
+        if (contentOverrides && contentOverrides[relPath] !== undefined) {
+          content = contentOverrides[relPath];
+        } else {
+          try {
+            content = await readFile(path.join(target, relPath), "utf8");
+          } catch {
+            continue;
+          }
+        }
+
+        scannedFileCount += 1;
+        const lines = content.split("\n");
+        for (let lineIndex = 0; lineIndex < lines.length; lineIndex += 1) {
+          const line = lines[lineIndex];
+          for (const { name, pattern } of SECRET_PATTERNS) {
+            if (pattern.test(line)) {
+              // Ignore test fixtures or documentation examples that explicitly mention dummy/fake/example
+              if (line.includes("EXAMPLE") || line.includes("fake_") || line.includes("placeholder")) continue;
+              const snippet = line.trim().slice(0, 80);
+              const fingerprint = sha256(`SECURITY.NO_HARDCODED_SECRET:${relPath}:${lineIndex + 1}:${snippet}`);
+              violations.push({
+                ruleId: "SECURITY.NO_HARDCODED_SECRET",
+                file: relPath,
+                line: lineIndex + 1,
+                snippet,
+                fingerprint: `sha256:${fingerprint}`,
+                message: `Potential hardcoded secret (${name}) detected at ${relPath}:${lineIndex + 1}`,
+              });
+            }
+          }
+        }
+      }
+
+      return {
+        passed: violations.length === 0,
+        scannedFiles: scannedFileCount,
+        isInert: scannedFileCount === 0,
+        violations,
+      };
+    },
+  },
+
+  "grain-complexity": {
+    id: "grain-complexity",
+    description: "Evaluates file and method complexity against configured thresholds.",
+    supports: () => true,
+    check: async ({ target, rule, files = null, contentOverrides = null } = {}) => {
+      const threshold = rule?.check?.threshold ?? rule?.parameters?.threshold ?? 15;
+      const targetFiles = files ?? (await collectFiles(target));
+      const sourceExtensions = [".js", ".mjs", ".ts", ".jsx", ".tsx", ".py", ".rs", ".go"];
+      const relevantFiles = targetFiles.filter((f) => sourceExtensions.includes(path.extname(f).toLowerCase()));
+      const violations = [];
+      let checkedCount = 0;
+
+      for (const relPath of relevantFiles) {
+        let content;
+        if (contentOverrides && contentOverrides[relPath] !== undefined) {
+          content = contentOverrides[relPath];
+        } else {
+          try {
+            content = await readFile(path.join(target, relPath), "utf8");
+          } catch {
+            continue;
+          }
+        }
+
+        checkedCount += 1;
+        const lines = content.split("\n");
+        let nestingLevel = 0;
+        let maxNesting = 0;
+
+        for (let i = 0; i < lines.length; i += 1) {
+          const trimmed = lines[i].trim();
+          const opens = (trimmed.match(/{/g) || []).length;
+          const closes = (trimmed.match(/}/g) || []).length;
+          nestingLevel += opens - closes;
+          if (nestingLevel > maxNesting) maxNesting = nestingLevel;
+        }
+
+        // Check if complexity metric exceeds threshold
+        if (maxNesting > threshold) {
+          const fingerprint = sha256(`GRAIN.MAX_COMPLEXITY:${relPath}:${maxNesting}`);
+          violations.push({
+            ruleId: rule?.id ?? "GRAIN.MAX_COMPLEXITY",
+            file: relPath,
+            observed: maxNesting,
+            threshold,
+            fingerprint: `sha256:${fingerprint}`,
+            message: `Complexity ${maxNesting} exceeds threshold of ${threshold} in ${relPath}`,
+          });
+        }
+      }
+
+      return {
+        passed: violations.length === 0,
+        scannedFiles: checkedCount,
+        isInert: checkedCount === 0,
+        violations,
+      };
+    },
+  },
+
+  "architecture-layers": {
+    id: "architecture-layers",
+    description: "Enforces clean layered dependency boundaries (e.g. domain cannot depend on infrastructure).",
+    supports: () => true,
+    check: async ({ target, rule, files = null, contentOverrides = null } = {}) => {
+      const targetFiles = files ?? (await collectFiles(target));
+      const sourceExtensions = [".js", ".mjs", ".ts", ".jsx", ".tsx", ".py", ".rs", ".go"];
+      const domainFiles = targetFiles.filter((f) => {
+        const norm = f.replace(/\\/g, "/");
+        return (norm.startsWith("src/domain/") || norm.startsWith("domain/")) && sourceExtensions.includes(path.extname(f).toLowerCase());
+      });
+
+      const violations = [];
+      let checkedCount = 0;
+
+      for (const relPath of domainFiles) {
+        let content;
+        if (contentOverrides && contentOverrides[relPath] !== undefined) {
+          content = contentOverrides[relPath];
+        } else {
+          try {
+            content = await readFile(path.join(target, relPath), "utf8");
+          } catch {
+            continue;
+          }
+        }
+
+        checkedCount += 1;
+        const lines = content.split("\n");
+        for (let i = 0; i < lines.length; i += 1) {
+          const line = lines[i];
+          if (/import\s+.*from\s+['"].*(?:infrastructure|infra|database|db)['"]/i.test(line) ||
+              /require\(['"].*(?:infrastructure|infra|database|db)['"]\)/i.test(line)) {
+            const snippet = line.trim();
+            const fingerprint = sha256(`ARCH.NO_DIRECT_DATABASE_ACCESS:${relPath}:${i + 1}:${snippet}`);
+            violations.push({
+              ruleId: rule?.id ?? "ARCH.NO_DIRECT_DATABASE_ACCESS",
+              file: relPath,
+              line: i + 1,
+              snippet,
+              fingerprint: `sha256:${fingerprint}`,
+              message: `Layer boundary violation in ${relPath}:${i + 1}: domain layer importing infrastructure`,
+            });
+          }
+        }
+      }
+
+      return {
+        passed: violations.length === 0,
+        scannedFiles: checkedCount,
+        isInert: checkedCount === 0,
+        violations,
+      };
+    },
+  },
+
+  "repo-structure": {
+    id: "repo-structure",
+    description: "Verifies required repository structure and root layout.",
+    supports: () => true,
+    check: async ({ target, rule } = {}) => {
+      const requiredFiles = rule?.parameters?.requiredFiles ?? rule?.check?.parameters?.requiredFiles ?? [];
+      const violations = [];
+      for (const req of requiredFiles) {
+        const full = path.join(target, req);
+        const exists = await fileExists(full);
+        if (!exists) {
+          const fingerprint = sha256(`REPO.STRUCTURE:${req}:missing`);
+          violations.push({
+            ruleId: rule?.id ?? "REPO.STRUCTURE",
+            file: req,
+            fingerprint: `sha256:${fingerprint}`,
+            message: `Required file or directory missing: ${req}`,
+          });
+        }
+      }
+
+      return {
+        passed: violations.length === 0,
+        scannedFiles: requiredFiles.length,
+        isInert: requiredFiles.length === 0,
+        violations,
+      };
+    },
+  },
+
+  "test-runner": {
+    id: "test-runner",
+    description: "Candidate test command verifier within ForgeLoop command authority boundary.",
+    supports: () => true,
+    check: async ({ rule } = {}) => {
+      // Discovered commands are candidate verifiers, evaluated in verification flow
+      return {
+        passed: true,
+        scannedFiles: 1,
+        isInert: false,
+        violations: [],
+        candidateCommand: rule?.check?.command ?? ["npm", "test"],
+      };
+    },
+  },
+});
+
+export function getPolicyAdapter(adapterId) {
+  return BUILTIN_ADAPTERS[adapterId] ?? null;
+}

package/src/core/policy-baseline.js

@@ -0,0 +1,144 @@
+import { readFile } from "node:fs/promises";
+import { fileExists } from "./filesystem.js";
+import { PROJECT_ARTIFACT_PATHS } from "./task-paths.js";
+import { assertJsonLimits } from "./json-safety.js";
+import { assertSchema, readSchema } from "./schema-validation.js";
+import { writeJsonArtifact } from "./artifacts.js";
+import { sha256 } from "./manifest.js";
+
+export function computeViolationFingerprint(violation) {
+  if (violation.fingerprint) {
+    return violation.fingerprint.startsWith("sha256:") ? violation.fingerprint : `sha256:${violation.fingerprint}`;
+  }
+  const raw = `${violation.ruleId}:${violation.file || ""}:${violation.line || ""}:${violation.snippet || violation.message || ""}`;
+  return `sha256:${sha256(raw)}`;
+}
+
+export async function readBaseline(target, packageRoot) {
+  const relPath = PROJECT_ARTIFACT_PATHS.policyBaseline;
+  const fullPath = `${target}/${relPath}`;
+  if (!(await fileExists(fullPath))) {
+    return null;
+  }
+  const raw = await readFile(fullPath, "utf8");
+  assertJsonLimits(raw, relPath);
+  const parsed = JSON.parse(raw);
+  const schema = await readSchema("policy-baseline", packageRoot);
+  assertSchema(parsed, schema, "policy-baseline");
+  return parsed;
+}
+
+export async function writeBaseline(target, baseline, packageRoot) {
+  const relPath = PROJECT_ARTIFACT_PATHS.policyBaseline;
+  const schema = await readSchema("policy-baseline", packageRoot);
+  assertSchema(baseline, schema, "policy-baseline");
+  await writeJsonArtifact(target, relPath, baseline, "policy-baseline", packageRoot);
+  return baseline;
+}
+
+export function createBaselineFromViolations(violations, { createdAt = new Date().toISOString() } = {}) {
+  const ruleGroups = new Map();
+  for (const v of violations) {
+    const ruleId = v.ruleId;
+    if (!ruleGroups.has(ruleId)) {
+      ruleGroups.set(ruleId, []);
+    }
+    const fp = computeViolationFingerprint(v);
+    ruleGroups.get(ruleId).push(fp);
+  }
+
+  const entries = [];
+  for (const [ruleId, fingerprints] of ruleGroups.entries()) {
+    entries.push({
+      ruleId,
+      fingerprints: [...new Set(fingerprints)].sort(),
+    });
+  }
+
+  return {
+    schemaVersion: 1,
+    createdAt,
+    entries: entries.sort((a, b) => a.ruleId.localeCompare(b.ruleId)),
+  };
+}
+
+export function evaluateBaselineViolations(baseline, currentViolations, { now = new Date().toISOString() } = {}) {
+  if (!baseline || !baseline.entries) {
+    return {
+      newViolations: currentViolations,
+      baselinedViolations: [],
+      resolvedViolations: [],
+      ratchetedBaseline: null,
+      warnings: [],
+    };
+  }
+
+  const baselineMap = new Map();
+  for (const entry of baseline.entries) {
+    baselineMap.set(entry.ruleId, new Set(entry.fingerprints));
+  }
+
+  const newViolations = [];
+  const baselinedViolations = [];
+  const matchedFingerprintsPerRule = new Map();
+
+  for (const v of currentViolations) {
+    const fp = computeViolationFingerprint(v);
+    const existing = baselineMap.get(v.ruleId);
+    if (existing && existing.has(fp)) {
+      baselinedViolations.push(v);
+      if (!matchedFingerprintsPerRule.has(v.ruleId)) {
+        matchedFingerprintsPerRule.set(v.ruleId, new Set());
+      }
+      matchedFingerprintsPerRule.get(v.ruleId).add(fp);
+    } else {
+      newViolations.push(v);
+    }
+  }
+
+  // Determine resolved debt and ratcheted baseline
+  const resolvedViolations = [];
+  const ratchetedEntries = [];
+  const warnings = [];
+
+  for (const entry of baseline.entries) {
+    const matched = matchedFingerprintsPerRule.get(entry.ruleId) ?? new Set();
+    const remaining = entry.fingerprints.filter((fp) => matched.has(fp));
+    const resolved = entry.fingerprints.filter((fp) => !matched.has(fp));
+
+    for (const r of resolved) {
+      resolvedViolations.push({ ruleId: entry.ruleId, fingerprint: r });
+    }
+
+    if (entry.reviewBy && entry.reviewBy <= now.slice(0, 10)) {
+      warnings.push({
+        code: "BASELINE_REVIEW_DUE",
+        ruleId: entry.ruleId,
+        reviewBy: entry.reviewBy,
+        message: `Baseline review date ${entry.reviewBy} for rule ${entry.ruleId} has expired.`,
+      });
+    }
+
+    if (remaining.length > 0) {
+      ratchetedEntries.push({
+        ruleId: entry.ruleId,
+        fingerprints: remaining.sort(),
+        ...(entry.reviewBy ? { reviewBy: entry.reviewBy } : {}),
+      });
+    }
+  }
+
+  const ratchetedBaseline = {
+    schemaVersion: baseline.schemaVersion ?? 1,
+    createdAt: baseline.createdAt,
+    entries: ratchetedEntries.sort((a, b) => a.ruleId.localeCompare(b.ruleId)),
+  };
+
+  return {
+    newViolations,
+    baselinedViolations,
+    resolvedViolations,
+    ratchetedBaseline,
+    warnings,
+  };
+}

package/src/core/policy-diff.js

@@ -0,0 +1,133 @@
+export const POLICY_DIFF_CLASSIFICATIONS = Object.freeze({
+  TIGHTEN: "TIGHTEN",
+  NEUTRAL: "NEUTRAL",
+  WEAKEN: "WEAKEN",
+  UNKNOWN: "UNKNOWN",
+});
+
+export function diffPolicies(beforePolicy = {}, afterPolicy = {}) {
+  const changes = [];
+  const beforeRules = new Map((beforePolicy?.rules ?? []).map((r) => [r.id, r]));
+  const afterRules = new Map((afterPolicy?.rules ?? []).map((r) => [r.id, r]));
+
+  // Check removed rules
+  for (const [id, beforeRule] of beforeRules.entries()) {
+    if (!afterRules.has(id)) {
+      const isWeakening = beforeRule.blocking || beforeRule.severity === "HIGH";
+      changes.push({
+        path: `rules.${id}`,
+        type: isWeakening ? "WEAKEN" : "NEUTRAL",
+        before: beforeRule,
+        after: null,
+        description: `Rule ${id} was removed`,
+      });
+    }
+  }
+
+  // Check added rules
+  for (const [id, afterRule] of afterRules.entries()) {
+    if (!beforeRules.has(id)) {
+      const isTightening = afterRule.blocking || afterRule.severity === "HIGH";
+      changes.push({
+        path: `rules.${id}`,
+        type: isTightening ? "TIGHTEN" : "NEUTRAL",
+        before: null,
+        after: afterRule,
+        description: `Rule ${id} was added`,
+      });
+    }
+  }
+
+  // Check modified rules
+  for (const [id, beforeRule] of beforeRules.entries()) {
+    const afterRule = afterRules.get(id);
+    if (!afterRule) continue;
+
+    // Check blocking change
+    if (beforeRule.blocking !== afterRule.blocking) {
+      const isWeakening = beforeRule.blocking && !afterRule.blocking;
+      changes.push({
+        path: `rules.${id}.blocking`,
+        type: isWeakening ? "WEAKEN" : "TIGHTEN",
+        before: beforeRule.blocking,
+        after: afterRule.blocking,
+        description: isWeakening ? `Rule ${id} was changed from blocking to advisory` : `Rule ${id} was changed to blocking`,
+      });
+    }
+
+    // Check threshold change
+    const beforeThreshold = beforeRule.check?.threshold ?? beforeRule.parameters?.threshold;
+    const afterThreshold = afterRule.check?.threshold ?? afterRule.parameters?.threshold;
+    if (beforeThreshold !== undefined && afterThreshold !== undefined && beforeThreshold !== afterThreshold) {
+      const isWeakening = afterThreshold > beforeThreshold;
+      changes.push({
+        path: `rules.${id}.threshold`,
+        type: isWeakening ? "WEAKEN" : "TIGHTEN",
+        before: beforeThreshold,
+        after: afterThreshold,
+        description: `Threshold for ${id} changed from ${beforeThreshold} to ${afterThreshold}`,
+      });
+    }
+  }
+
+  // Check baseline changes
+  if (beforePolicy && beforePolicy.baseline === undefined && beforePolicy.baselineDigest) {
+    // Legacy snapshot lacking semantic baseline state
+    if (afterPolicy?.baselineDigest && beforePolicy.baselineDigest !== afterPolicy.baselineDigest) {
+      changes.push({
+        path: "baseline",
+        type: "UNKNOWN",
+        before: beforePolicy.baselineDigest,
+        after: afterPolicy.baselineDigest,
+        description: "Baseline digest changed but semantic baseline snapshot is unavailable",
+      });
+    }
+  } else if (beforePolicy?.baseline || afterPolicy?.baseline) {
+    const beforeEntries = beforePolicy?.baseline?.entries ?? [];
+    const afterEntries = afterPolicy?.baseline?.entries ?? [];
+    const beforeBaseline = new Map(beforeEntries.map((e) => [e.ruleId, new Set(e.fingerprints ?? [])]));
+    const afterBaseline = new Map(afterEntries.map((e) => [e.ruleId, new Set(e.fingerprints ?? [])]));
+
+    const allRuleIds = new Set([...beforeBaseline.keys(), ...afterBaseline.keys()]);
+    for (const ruleId of allRuleIds) {
+      const beforeFpSet = beforeBaseline.get(ruleId) ?? new Set();
+      const afterFpSet = afterBaseline.get(ruleId) ?? new Set();
+
+      const addedFps = [...afterFpSet].filter((fp) => !beforeFpSet.has(fp));
+      const removedFps = [...beforeFpSet].filter((fp) => !afterFpSet.has(fp));
+
+      if (addedFps.length > 0) {
+        changes.push({
+          path: `baseline.${ruleId}`,
+          type: "WEAKEN",
+          before: beforeFpSet.size,
+          after: afterFpSet.size,
+          description: `Added ${addedFps.length} new violations to baseline for rule ${ruleId}`,
+        });
+      }
+      if (removedFps.length > 0) {
+        changes.push({
+          path: `baseline.${ruleId}`,
+          type: "TIGHTEN",
+          before: beforeFpSet.size,
+          after: afterFpSet.size,
+          description: `Resolved and removed ${removedFps.length} baseline violations for rule ${ruleId}`,
+        });
+      }
+    }
+  }
+
+  let classification = POLICY_DIFF_CLASSIFICATIONS.NEUTRAL;
+  if (changes.some((c) => c.type === "WEAKEN")) {
+    classification = POLICY_DIFF_CLASSIFICATIONS.WEAKEN;
+  } else if (changes.some((c) => c.type === "UNKNOWN")) {
+    classification = POLICY_DIFF_CLASSIFICATIONS.UNKNOWN;
+  } else if (changes.some((c) => c.type === "TIGHTEN")) {
+    classification = POLICY_DIFF_CLASSIFICATIONS.TIGHTEN;
+  }
+
+  return {
+    classification,
+    changes,
+  };
+}