@deksden-com/dd-flow-cli 0.9.0-beta.16 → 0.9.0-beta.160

package/dist/services/check-runner-evidence.js

@@ -0,0 +1,344 @@
+import fs from "node:fs";
+import crypto from "node:crypto";
+import path from "node:path";
+import { parse } from "shell-quote";
+import { AppError } from "../shared/errors.js";
+import { validateObservationDuration } from "../harness-runtime/lib/observation-clock.mjs";
+import { isDeepStrictEqual } from "node:util";
+import { runnerFailureValid, validateRunnerProof, validatedRunnerChild, hasValidatedNativeProof, hasValidatedBrowserProof, hasUnsupportedObservation, runnerLibraryInputs } from "./check-runner-proof.js";
+export { candidateAbsencesValid, candidateLibraryInputsValid, runnerFailureValid, runnerEvidencePass, runnerProofArtifacts } from "./check-runner-proof.js";
+const absoluteFile = (value) => typeof value === "string" && value.length > 0 && value.length <= 4096 && !value.includes("\0") && path.isAbsolute(value);
+function candidateFile(root, file) {
+    if (!root || !path.isAbsolute(file))
+        return false;
+    try {
+        const realRoot = fs.realpathSync(root), relative = path.relative(realRoot, fs.realpathSync(file));
+        if (!relative || relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            return false;
+        let current = file;
+        while (fs.realpathSync(current) !== realRoot) {
+            if (fs.lstatSync(current).isSymbolicLink())
+                return false;
+            const parent = path.dirname(current);
+            if (parent === current)
+                return false;
+            current = parent;
+        }
+        return fs.statSync(file).isFile();
+    }
+    catch {
+        return false;
+    }
+}
+export function candidateFailureFiles(evidence, root) {
+    return [...new Set((evidence?.failures ?? []).flatMap(failure => {
+            const child = validatedRunnerChild(failure);
+            if (child)
+                return candidateFailureFiles({ ...child.evidence, failures: [child.failure] }, root);
+            const proof = failure.repair_evidence;
+            const checksum = proof && "file_sha256" in proof ? proof.file_sha256 : undefined;
+            try {
+                return failure.file && candidateFile(root, failure.file) && (checksum === undefined || checksum === crypto.createHash("sha256").update(fs.readFileSync(failure.file)).digest("hex")) ? [failure.file] : [];
+            }
+            catch {
+                return [];
+            }
+        }))];
+}
+export function candidateLibraryInputs(evidence, root) {
+    const inputs = new Map();
+    for (const failure of evidence?.failures ?? []) {
+        const child = validatedRunnerChild(failure);
+        const candidates = child ? candidateLibraryInputs({ ...child.evidence, failures: [child.failure] }, root)
+            : failure.repair_evidence?.rule === "candidate_library_query_error" ? runnerLibraryInputs(failure.repair_evidence) ?? [] : [];
+        try {
+            if (candidates.some(input => !candidateFile(root, input.file) || crypto.createHash("sha256").update(readBoundedProofFile(input.file, 2 * 1024 * 1024)).digest("hex") !== input.sha256))
+                continue;
+        }
+        catch {
+            continue;
+        }
+        for (const input of candidates)
+            inputs.set(input.file, input.sha256);
+    }
+    return [...inputs].map(([file, sha256]) => ({ file, sha256 }));
+}
+/** Current execution/repair boundary only; historical readers retain captured proof. */
+export function currentCandidateLibraryInputsValid(receipt, workspaceRoot) {
+    return isDeepStrictEqual(receipt.candidate_library_inputs ?? [], candidateLibraryInputs(receipt.runner_evidence, workspaceRoot));
+}
+function absentCandidate(root, file) {
+    if (!root || !absoluteFile(file))
+        return false;
+    try {
+        let current = path.resolve(file);
+        try {
+            fs.lstatSync(current);
+            return false;
+        }
+        catch (error) {
+            if (error.code !== "ENOENT")
+                return false;
+        }
+        for (;;) {
+            try {
+                if (fs.lstatSync(current).isSymbolicLink())
+                    return false;
+                break;
+            }
+            catch (error) {
+                if (error.code !== "ENOENT")
+                    return false;
+                const parent = path.dirname(current);
+                if (parent === current)
+                    return false;
+                current = parent;
+            }
+        }
+        const realRoot = fs.realpathSync(root), relative = path.relative(realRoot, fs.realpathSync(current));
+        if (relative === ".." || relative.startsWith(`..${path.sep}`) || path.isAbsolute(relative))
+            return false;
+        while (fs.realpathSync(current) !== realRoot) {
+            if (fs.lstatSync(current).isSymbolicLink())
+                return false;
+            current = path.dirname(current);
+        }
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export function candidateFailureAbsences(evidence, root) {
+    return (evidence?.failures ?? []).flatMap(failure => {
+        const child = validatedRunnerChild(failure);
+        if (child)
+            return candidateFailureAbsences({ ...child.evidence, failures: [child.failure] }, root);
+        try {
+            const proof = failure.repair_evidence;
+            if (proof?.rule !== "candidate_tool_diagnostic" || proof.path_state !== "missing" || !proof.declaration || !hasValidatedNativeProof(proof)
+                || !absentCandidate(root, proof.file) || !candidateFile(root, proof.declaration.file) || crypto.createHash("sha256").update(fs.readFileSync(proof.declaration.file)).digest("hex") !== proof.declaration.sha256)
+                return [];
+            return [{ file: proof.file, declaration: proof.declaration, path_state: "missing" }];
+        }
+        catch {
+            return [];
+        }
+    });
+}
+function candidateFailure(failure, evidence, root, capturedFiles, capturedAbsences, capturedLibraryInputs) {
+    const child = validatedRunnerChild(failure);
+    if (child)
+        return candidateFailure(child.failure, child.evidence, root, capturedFiles, capturedAbsences, capturedLibraryInputs);
+    const owned = (file) => {
+        if (capturedFiles !== undefined)
+            return capturedFiles.includes(file);
+        if (!candidateFile(root, file))
+            return false;
+        const proof = failure.repair_evidence;
+        try {
+            return !proof || !("file_sha256" in proof) || proof.file_sha256 === crypto.createHash("sha256").update(fs.readFileSync(file)).digest("hex");
+        }
+        catch {
+            return false;
+        }
+    };
+    if (failure.origin === "tooling" || failure.origin === "unknown")
+        return false;
+    if (failure.category === "assertion")
+        return failure.origin === undefined || failure.origin === "candidate" && failure.file !== undefined && owned(failure.file);
+    const proof = failure.repair_evidence;
+    if (proof?.rule === "candidate_library_query_error") {
+        const required = runnerLibraryInputs(proof), captured = capturedFiles !== undefined ? capturedLibraryInputs : root ? candidateLibraryInputs({ ...evidence, failures: [failure] }, root) : undefined;
+        return hasValidatedNativeProof(proof) && failure.category === "unclassified" && failure.origin === "candidate" && failure.phase === "test" && failure.native_code === proof.exception_type
+            && failure.test_id === proof.test_id && failure.file === proof.file && owned(proof.file) && Boolean(required?.length && captured && required.every(input => captured.some(item => item.file === input.file && item.sha256 === input.sha256)));
+    }
+    if (proof?.rule === "candidate_test_runtime_error")
+        return hasValidatedNativeProof(proof) && failure.category === "unclassified" && failure.origin === "candidate"
+            && failure.phase === proof.phase && failure.native_code === proof.exception_type && failure.file === proof.file && owned(proof.file);
+    if (proof?.rule === "candidate_migration_sql" || proof?.rule === "candidate_tool_diagnostic") {
+        if (!hasValidatedNativeProof(proof) || failure.category !== "unclassified" || failure.origin !== "candidate" || failure.file !== proof.file || !["setup", "collection", "test"].includes(failure.phase ?? ""))
+            return false;
+        if (proof.rule === "candidate_migration_sql")
+            return failure.phase === "setup" && failure.native_code === "42601" && proof.world.invocation_id === evidence.binding.invocation_id && owned(proof.file);
+        if (failure.phase !== "collection" || failure.native_code !== proof.diagnostic_code)
+            return false;
+        return proof.path_state === "missing" ? Boolean(proof.declaration && (capturedAbsences ?? (root ? candidateFailureAbsences(evidence, root) : [])).some(item => item.file === proof.file && isDeepStrictEqual(item.declaration, proof.declaration))) : owned(proof.file);
+    }
+    if (proof?.rule === "candidate_browser_action_inactivity")
+        return hasValidatedBrowserProof(proof) && failure.category === "unclassified" && failure.phase === "test" && failure.origin === "candidate" && failure.native_code === proof.native_code && failure.file === proof.file && failure.test_id === proof.attempt.test_id && proof.attempt.invocation_id === evidence.binding.invocation_id && owned(proof.file);
+    return failure.category === "unclassified" && failure.origin === "candidate" && ["test", "setup"].includes(failure.phase ?? "") && proof?.rule === "candidate_sql_integrity" && ["23502", "23503", "23505", "23514"].includes(proof.native_code) && failure.native_code === proof.native_code && failure.file === proof.file && proof.world.invocation_id === evidence.binding.invocation_id && owned(proof.file);
+}
+export function runnerObservationDurations(environment) {
+    // Both observers leave the launcher its bounded physical cleanup tail.
+    return { startupMs: validateObservationDuration(validateObservationDuration(Number(environment.DD_FLOW_TEST_STARTUP_SILENCE_MS ?? 120_000)) + 10_000),
+        executionMs: validateObservationDuration(validateObservationDuration(Number(environment.DD_FLOW_TEST_EXECUTION_SILENCE_MS ?? 600_000)) + 15_000) };
+}
+/** Baseline uses argv rather than a shell alias. Recognize only a literal,
+ * unique execution contract; never guess shell expansion or compound syntax. */
+export function runnerContractForArgv(profile, command, args) {
+    if (profile.schema_id !== "dd-flow/code-check-profile@7" || !profile.runner_evidence_by_alias)
+        return null;
+    if (!runnerContractsValid(profile.runner_evidence_by_alias))
+        throw new AppError("invalid_code_check_profile", "Invalid baseline runner evidence contract", 2);
+    const matches = [];
+    for (const [alias, contract] of Object.entries(profile.runner_evidence_by_alias)) {
+        const source = profile.aliases?.[alias];
+        if (typeof source !== "string")
+            throw new AppError("invalid_code_check_profile", "Baseline runner evidence references an unknown alias", 2, { alias });
+        let expansion = false;
+        const tokens = parse(source, () => { expansion = true; return ""; });
+        if (!expansion && tokens.every(token => typeof token === "string") && JSON.stringify(tokens) === JSON.stringify([command, ...args]))
+            matches.push({ alias, command: source, contract });
+    }
+    if (matches.some(match => JSON.stringify(match.contract) !== JSON.stringify(matches[0].contract)))
+        throw new AppError("runner_evidence_ambiguous", "Baseline argv matches conflicting runner evidence contracts", 2, { aliases: matches.map(match => match.alias) });
+    return matches[0] ?? null;
+}
+/** Shared by CODE and EVAL baseline. The sole publisher owns this structured
+ * journal; logs belong on stdout/stderr. Partial final lines await append. */
+export function readRunnerProgress(file, invocationId, lastSequence = 0, now = Date.now()) {
+    try {
+        const text = readBoundedProofFile(file, 4 * 1024 * 1024).toString("utf8");
+        const accepted = [];
+        for (const line of text.split("\n").slice(0, -1)) {
+            if (Buffer.byteLength(line) > 16 * 1024)
+                throw new Error("Progress record exceeds 16 KiB");
+            const value = JSON.parse(line);
+            if (value && typeof value === "object" && !Array.isArray(value) && typeof value.invocation_id === "string" && value.invocation_id !== invocationId)
+                continue;
+            if (!value || typeof value !== "object" || Array.isArray(value) || value.schema_id !== "dd-flow/check-runner-progress@1" || value.invocation_id !== invocationId
+                || !Number.isSafeInteger(value.sequence) || value.sequence <= 0 || typeof value.at !== "string" || !Number.isFinite(Date.parse(value.at))
+                || !["startup", "execution"].includes(value.phase)
+                || !["setup_step_completed", "run_started", "module_collected", "test_started", "test_completed", "step_started", "step_completed", "run_completed"].includes(value.event))
+                throw new Error("Malformed official progress record");
+            if (value.sequence <= lastSequence || Date.parse(value.at) > now)
+                continue;
+            accepted.push(value);
+            lastSequence = value.sequence;
+        }
+        return accepted;
+    }
+    catch (cause) {
+        if (cause.code === "ENOENT")
+            return [];
+        throw new AppError("runner_progress_invalid", "Runner progress cannot be safely observed", 1, { cause: cause.code ?? cause.message });
+    }
+}
+function readBoundedProofFile(file, limit) {
+    const fd = fs.openSync(file, fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW | fs.constants.O_NONBLOCK);
+    try {
+        const stat = fs.fstatSync(fd);
+        if (!stat.isFile() || stat.size > limit)
+            throw new Error("Evidence is not a bounded regular file");
+        const buffer = Buffer.alloc(Math.min(limit + 1, stat.size + 1));
+        let length = 0;
+        while (length < buffer.length) {
+            const read = fs.readSync(fd, buffer, length, buffer.length - length, null);
+            if (!read)
+                break;
+            length += read;
+        }
+        if (length > limit || length > stat.size)
+            throw new Error("Evidence grew during observation");
+        return buffer.subarray(0, length);
+    }
+    finally {
+        fs.closeSync(fd);
+    }
+}
+export function runnerContractsValid(value) {
+    if (value === undefined)
+        return true;
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return false;
+    return Object.entries(value).every(([alias, raw]) => {
+        if (!raw || typeof raw !== "object" || Array.isArray(raw))
+            return false;
+        const contract = raw;
+        return alias.startsWith("@check/") && ["dd-flow/check-runner-evidence@1", "dd-flow/check-runner-evidence@2"].includes(String(contract.schema_id)) && typeof contract.path === "string" && contract.path.length > 0 && contract.path.split("/")[0] !== "engine-outcome.json" && !contract.path.includes("\\") && !path.isAbsolute(contract.path) && !contract.path.split("/").some(part => part === ".." || part === "" || part === ".");
+    });
+}
+export function readRunnerEvidenceDetailed(root, contract, binding) {
+    return validateRunnerProof(contract, binding, relative => {
+        let current = root;
+        if (!fs.lstatSync(current).isDirectory() || fs.lstatSync(current).isSymbolicLink())
+            throw new Error("Unsafe proof root");
+        for (const part of relative.split("/")) {
+            current = path.join(current, part);
+            if (fs.lstatSync(current).isSymbolicLink())
+                throw new Error("Symlink proof artifact");
+        }
+        return readBoundedProofFile(current, 2 * 1024 * 1024);
+    });
+}
+export function readRunnerEvidence(root, contract, binding) { return readRunnerEvidenceDetailed(root, contract, binding).evidence; }
+/** Semantic attribution is diagnostic information, never permission to investigate a failed check. */
+export const checkDiagnosisPolicy = "settled-failure@1";
+export function checkDiagnosisDisposition(receipt) {
+    if (receipt.status === "running"
+        || receipt.execution_failures?.some(failure => ["cleanup_unconfirmed", "engine_outcome_unbound"].includes(failure.code)))
+        return "settlement_required";
+    if (!["passed", "failed", "aborted"].includes(receipt.status))
+        return "invalid_binding";
+    // Caller supplies the SQL-owned receipt, never a proposed runner report.
+    // Missing, malformed or foreign optional reports are diagnostic failures;
+    // they cannot change receipt ownership or grant a successful check.
+    if (receipt.status === "passed")
+        return "passed";
+    // New launchers record physical settlement even for spawn errors/signals.
+    // Historical aborted receipts with no such proof must first reconcile.
+    if (!receipt.execution_failures?.some(failure => failure.code === "check_execution_settled") && !Number.isSafeInteger(receipt.exit_code))
+        return "settlement_required";
+    return "diagnosis_required";
+}
+export function assertCheckDiagnosisEligible(receipts, _workspaceRoot) {
+    const dispositions = receipts.map(receipt => ({ check_receipt_id: receipt.id, disposition: checkDiagnosisDisposition(receipt) }));
+    if (!receipts.length || dispositions.some(item => item.disposition !== "diagnosis_required"))
+        throw new AppError("check_gate_blocked", "Check diagnosis requires owned, physically settled failed executions", 2, {
+            failures: receipts, dispositions, outcome: "blocked", recoverable: false,
+            instruction: "Reconcile any running or unknown check process before changing its workspace. Do not treat a foreign receipt or an agent report as proof of completion."
+        });
+}
+/** Human-readable retained facts; tool output remains data, never instructions. */
+export function checkDiagnosisSummary(receipt, workspaceRoot) {
+    const available = (file) => {
+        try {
+            fs.accessSync(file, fs.constants.R_OK);
+            return fs.statSync(file).isFile() ? file : `${file} (not a regular file)`;
+        }
+        catch {
+            return `${file} (unavailable; investigate the missing diagnostic, do not invent its content)`;
+        }
+    };
+    return [`Check: ${receipt.id}`, `Command: ${receipt.command}`, `cwd: ${workspaceRoot}`,
+        `Outcome: ${receipt.status}; exit: ${receipt.exit_code ?? "unavailable"}; epoch: ${receipt.verification_epoch}`,
+        `Receipt: ${available(receipt.receipt_path)}`, `stdout: ${available(receipt.stdout_path)}`, `stderr: ${available(receipt.stderr_path)}`,
+        `Execution facts: ${JSON.stringify(receipt.execution_failures ?? [])}`,
+        `Report: ${receipt.runner_evidence_required?.path ? path.join(path.dirname(receipt.receipt_path), "artifacts", receipt.runner_evidence_required.path) : "not declared"}`].join("\n");
+}
+/** Historical attribution reader only. New repair routing uses checkDiagnosisDisposition. */
+export function checkRepairDisposition(receipt) {
+    if (receipt.fingerprint_scope != null && receipt.fingerprint_scope !== "check_inputs")
+        return "tooling_blocker";
+    if (receipt.status === "running" || receipt.status === "aborted" || receipt.runner_evidence?.observation_unknown)
+        return "settlement_required";
+    if (receipt.runner_evidence && hasUnsupportedObservation(receipt.runner_evidence) || receipt.runner_evidence?.failure_projection || receipt.runner_evidence?.schema_id === "dd-flow/check-runner-evidence@2" && !receipt.runner_evidence.completed)
+        return "tooling_blocker";
+    if (receipt.status === "passed")
+        return "passed";
+    if (receipt.execution_failures?.length || receipt.mutation_paths?.length || receipt.before_fingerprint !== receipt.after_fingerprint || receipt.diagnostic_evidence_valid === false)
+        return "tooling_blocker";
+    if (!Number.isSafeInteger(receipt.exit_code) || receipt.exit_code === 0)
+        return "unclassified";
+    const evidence = receipt.runner_evidence;
+    if (!evidence || !Array.isArray(evidence.failures) || !evidence.failures.length || receipt.exit_code === 0 || evidence.failures.some(f => !f || !["assertion", "tooling", "unclassified"].includes(f.category)))
+        return "unclassified";
+    if (evidence.failures.some(f => f.category === "tooling"))
+        return "tooling_blocker";
+    if (!evidence.completed)
+        return "unclassified";
+    if (evidence.failures.some(f => !runnerFailureValid(f) || !candidateFailure(f, evidence, receipt.candidate_root, receipt.candidate_files, receipt.candidate_absences, receipt.candidate_library_inputs)))
+        return "unclassified";
+    return "source_repair";
+}