@davesheffer/hunch 1.19.0 → 1.20.0-rc.2

package/dist/core/types.js

@@ -6,7 +6,8 @@
  * tool inputs. Every record carries `provenance` so nothing is a blind assertion.
  */
 import { z } from "zod";
-import { resourceId, resourceRelationshipId } from "./ids.js";
+import { createHash } from "node:crypto";
+import { findingId, resourceId, resourceRelationshipId } from "./ids.js";
 /** Where a fact came from and how much to trust it. Confidence tiers (DESIGN §4):
  *  inferred < extracted < llm_draft < llm_draft+human_confirmed/derived. */
 export const ProvenanceSchema = z.object({
@@ -485,6 +486,132 @@ export const FindingSchema = z.object({
     resolved_commit: z.string().nullable().default(null).describe("the commit that fixed it (set when triage becomes resolved)"),
     provenance: ProvenanceSchema,
 });
+export const LANDSCAPE_DRIFT_CANDIDATE_SCHEMA_VERSION = "hunch.landscape-drift-candidate/1";
+const LANDSCAPE_DRIFT_HASH = /^sha256:[a-f0-9]{64}$/;
+const LANDSCAPE_DRIFT_RECEIPT_ID = /^[a-z][a-z0-9_:-]{2,127}$/;
+/**
+ * An external observer's content-addressed mismatch claim. It is intake evidence
+ * for an advisory Finding only: it cannot update a Resource, relationship,
+ * currentness, decision, constraint, or execution policy.
+ */
+export const LandscapeDriftCandidateSchema = z.object({
+    schema: z.literal(LANDSCAPE_DRIFT_CANDIDATE_SCHEMA_VERSION),
+    candidateId: z.string().regex(/^ldf_[a-f0-9]{24}$/),
+    classification: z.literal("repository_identity_mismatch"),
+    resourceId: z.string().min(3).max(512),
+    declaredRepositoryId: z.string().min(3).max(512),
+    observedRepositoryId: z.string().min(3).max(512),
+    observation: z.object({
+        providerId: z.string().regex(/^[a-z][a-z0-9-]{0,63}$/),
+        observedAt: z.string().min(1).max(64),
+        providerReceiptId: z.string().regex(LANDSCAPE_DRIFT_RECEIPT_ID),
+        providerReceiptHash: z.string().regex(LANDSCAPE_DRIFT_HASH),
+        resolutionReceiptId: z.string().regex(LANDSCAPE_DRIFT_RECEIPT_ID),
+        resolutionReceiptHash: z.string().regex(LANDSCAPE_DRIFT_HASH),
+        resolutionSetHash: z.string().regex(LANDSCAPE_DRIFT_HASH),
+    }).strict(),
+    authority: z.literal("finding_candidate"),
+    contentHash: z.string().regex(LANDSCAPE_DRIFT_HASH),
+}).strict().superRefine((candidate, ctx) => {
+    if (!Number.isFinite(Date.parse(candidate.observation.observedAt))) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, path: ["observation", "observedAt"], message: "landscape drift observation timestamp is invalid" });
+    }
+    for (const [field, value] of [
+        ["resourceId", candidate.resourceId],
+        ["declaredRepositoryId", candidate.declaredRepositoryId],
+        ["observedRepositoryId", candidate.observedRepositoryId],
+    ]) {
+        if (!isCredentialFreeText(value)) {
+            ctx.addIssue({ code: z.ZodIssueCode.custom, path: [field], message: "landscape drift candidate contains credential material" });
+        }
+    }
+    if (candidate.declaredRepositoryId === candidate.observedRepositoryId) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "landscape drift candidate must describe a real identity mismatch" });
+    }
+    const unsigned = landscapeDriftCandidateUnsigned(candidate);
+    const contentHash = landscapeDriftCandidateHash(unsigned);
+    if (candidate.contentHash !== contentHash || candidate.candidateId !== `ldf_${contentHash.slice(7, 31)}`) {
+        ctx.addIssue({ code: z.ZodIssueCode.custom, message: "landscape drift candidate seal is invalid" });
+    }
+});
+function landscapeDriftCanonical(value) {
+    if (Array.isArray(value))
+        return `[${value.map(landscapeDriftCanonical).join(",")}]`;
+    if (value && typeof value === "object") {
+        return `{${Object.entries(value)
+            .sort(([left], [right]) => left.localeCompare(right))
+            .map(([key, child]) => `${JSON.stringify(key)}:${landscapeDriftCanonical(child)}`)
+            .join(",")}}`;
+    }
+    return JSON.stringify(value) ?? "null";
+}
+function landscapeDriftCandidateHash(value) {
+    return `sha256:${createHash("sha256").update(landscapeDriftCanonical(value)).digest("hex")}`;
+}
+function landscapeDriftCandidateUnsigned(candidate) {
+    return {
+        schema: candidate.schema,
+        classification: candidate.classification,
+        resourceId: candidate.resourceId,
+        declaredRepositoryId: candidate.declaredRepositoryId,
+        observedRepositoryId: candidate.observedRepositoryId,
+        observation: { ...candidate.observation },
+        authority: candidate.authority,
+    };
+}
+export function createLandscapeDriftCandidate(input) {
+    const unsigned = landscapeDriftCandidateUnsigned({
+        schema: LANDSCAPE_DRIFT_CANDIDATE_SCHEMA_VERSION,
+        classification: "repository_identity_mismatch",
+        resourceId: input.resourceId,
+        declaredRepositoryId: input.declaredRepositoryId,
+        observedRepositoryId: input.observedRepositoryId,
+        observation: { ...input.observation },
+        authority: "finding_candidate",
+    });
+    const contentHash = landscapeDriftCandidateHash(unsigned);
+    return LandscapeDriftCandidateSchema.parse({
+        ...unsigned,
+        candidateId: `ldf_${contentHash.slice(7, 31)}`,
+        contentHash,
+    });
+}
+export function assertLandscapeDriftCandidate(value) {
+    LandscapeDriftCandidateSchema.parse(value);
+}
+/** Convert one valid external observation into advisory Hunch memory, never graph authority. */
+export function landscapeDriftCandidateFinding(value) {
+    const candidate = LandscapeDriftCandidateSchema.parse(value);
+    const title = `External repository identity drift: ${candidate.resourceId}`;
+    const evidence = [
+        `candidate:${candidate.candidateId}`,
+        `candidate-content:${candidate.contentHash}`,
+        `provider-receipt:${candidate.observation.providerReceiptId}@${candidate.observation.providerReceiptHash}`,
+        `resolution-receipt:${candidate.observation.resolutionReceiptId}@${candidate.observation.resolutionReceiptHash}`,
+        `resolution-set:${candidate.observation.resolutionSetHash}`,
+    ];
+    return FindingSchema.parse({
+        id: findingId(title),
+        title,
+        observation: `Declared repository ${candidate.declaredRepositoryId} was observed as ${candidate.observedRepositoryId}; review the external reference before changing the landscape.`,
+        evidence,
+        method: null,
+        severity: "medium",
+        triage: "open",
+        affected_files: [],
+        affected_symbols: [candidate.resourceId],
+        violates_constraint: null,
+        spawned_decision: null,
+        observed_at: candidate.observation.observedAt,
+        resolved_commit: null,
+        provenance: {
+            source: "orc_observed+candidate",
+            confidence: 0.8,
+            evidence,
+            last_verified: candidate.observation.observedAt,
+        },
+    });
+}
 /** The entity collections, keyed by their on-disk directory name. */
 export const ENTITY_KINDS = ["components", "resources", "edges", "symbols", "decisions", "bugs", "constraints", "runbooks", "findings"];
 export const SCHEMAS = {

package/dist/extractors/git.js

@@ -77,7 +77,7 @@ function gitSafeWithoutReplacements(args, cwd, maxBuffer = 64 * 1024 * 1024) {
         return execFileSync("git", args, {
             cwd,
             encoding: "utf8",
-            env: { ...process.env, GIT_NO_REPLACE_OBJECTS: "1" },
+            env: { ...foreignRepoEnv(process.env), GIT_NO_REPLACE_OBJECTS: "1" },
             maxBuffer,
             stdio: ["ignore", "pipe", "ignore"],
         }).trim();
@@ -483,7 +483,7 @@ export function stableRepositoryName(root) {
         const digest = createHash("sha256").update(fetchRemote, "utf8").digest("hex");
         return `git-remote:sha256:${digest}`;
     }
-    const shallow = gitSafe(["rev-parse", "--is-shallow-repository"], root) === "true";
+    const shallow = gitSafeIsolated(["rev-parse", "--is-shallow-repository"], root) === "true";
     if (shallow)
         return basename(mainWorktreeRoot(root));
     const roots = gitSafeWithoutReplacements(["rev-list", "--max-parents=0", "HEAD"], root)