@ebrindley/build 0.0.0-stage → 1.42.1-rc28

package/dist/chunk-DNIOIISW.js

@@ -0,0 +1,616 @@
+import {
+  hasLocalIpv4Prefix
+} from "./chunk-H4HXVWEC.js";
+import {
+  detectStack,
+  readIntentContract,
+  resolveIntent
+} from "./chunk-VYI4DSZP.js";
+import {
+  KNOWLEDGE_BLOCK_BEGIN,
+  KNOWLEDGE_BLOCK_END,
+  readKnowledgeManifest
+} from "./chunk-BQ3VAGXH.js";
+import {
+  CHECK_SCRIPT_REL,
+  CONFIG_FILE_REL,
+  GUARD_DIR_REL,
+  LOCK_FILE_REL
+} from "./chunk-C3DH3NCY.js";
+
+// src/core/knowledge/doctor-checks.ts
+import { existsSync, readFileSync } from "fs";
+import { isIP } from "net";
+import path from "path";
+var DEFAULT_STALE_REF_TTL_MS = 90 * 24 * 60 * 60 * 1e3;
+var BLOCKED_LINK_HOSTNAMES = /* @__PURE__ */ new Set([
+  "localhost",
+  "0.0.0.0",
+  "::",
+  "::1",
+  "metadata",
+  "metadata.google.internal",
+  "metadata.goog",
+  "kubernetes.default",
+  "kubernetes.default.svc"
+]);
+function isBlockedHostname(hostname) {
+  const host = hostname.toLowerCase().replace(/\.$/, "");
+  if (BLOCKED_LINK_HOSTNAMES.has(host)) return true;
+  if (host.endsWith(".localhost") || host.endsWith(".local") || host.endsWith(".internal")) {
+    return true;
+  }
+  if (host.endsWith(".lan") || host.endsWith(".home") || host.endsWith(".corp")) {
+    return true;
+  }
+  return false;
+}
+function isBlockedIpv4(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return true;
+  }
+  const [a, b] = parts;
+  if (a === 0) return true;
+  if (hasLocalIpv4Prefix(parts.join("."))) return true;
+  if (a === 100 && b >= 64 && b <= 127) return true;
+  return false;
+}
+function ipv4FromHextets(high, low) {
+  return [high >> 8, high & 255, low >> 8, low & 255].join(".");
+}
+function parseIpv4Hextets(ip) {
+  const parts = ip.split(".").map((p) => Number(p));
+  if (parts.length !== 4 || parts.some((n) => !Number.isInteger(n) || n < 0 || n > 255)) {
+    return void 0;
+  }
+  const [a, b, c, d] = parts;
+  return [a << 8 | b, c << 8 | d];
+}
+function parseIpv6Hextets(ip) {
+  if (!ip || ip.includes(":::")) return void 0;
+  const sides = ip.toLowerCase().split("::");
+  if (sides.length > 2) return void 0;
+  const parseSide = (side) => {
+    if (!side) return [];
+    const result = [];
+    for (const rawPart of side.split(":")) {
+      if (!rawPart) return void 0;
+      if (rawPart.includes(".")) {
+        const hextets = parseIpv4Hextets(rawPart);
+        if (!hextets) return void 0;
+        result.push(...hextets);
+        continue;
+      }
+      if (!/^[0-9a-f]{1,4}$/i.test(rawPart)) return void 0;
+      result.push(Number.parseInt(rawPart, 16));
+    }
+    return result;
+  };
+  const left = parseSide(sides[0] ?? "");
+  const right = parseSide(sides[1] ?? "");
+  if (!left || !right) return void 0;
+  if (sides.length === 1) {
+    return left.length === 8 ? left : void 0;
+  }
+  const zeroCount = 8 - left.length - right.length;
+  if (zeroCount < 1) return void 0;
+  return [...left, ...Array(zeroCount).fill(0), ...right];
+}
+function isBlockedIpv6(ip) {
+  const normalized = ip.toLowerCase();
+  if (normalized === "::" || normalized === "::1") return true;
+  const hextets = parseIpv6Hextets(normalized);
+  if (!hextets || hextets.length !== 8) return true;
+  const [first] = hextets;
+  if ((first & 65024) === 64512) return true;
+  if ((first & 65472) === 65152) return true;
+  const firstFiveZero = hextets.slice(0, 5).every((part) => part === 0);
+  const firstSixZero = firstFiveZero && hextets[5] === 0;
+  const embeddedIpv4 = ipv4FromHextets(hextets[6], hextets[7]);
+  if (firstFiveZero && hextets[5] === 65535 && isBlockedIpv4(embeddedIpv4)) {
+    return true;
+  }
+  if (firstSixZero && isBlockedIpv4(embeddedIpv4)) return true;
+  if (hextets[0] === 100 && hextets[1] === 65435 && hextets.slice(2, 6).every((p) => p === 0)) {
+    return isBlockedIpv4(embeddedIpv4);
+  }
+  return false;
+}
+function unsafeLinkProbeReason(urlString) {
+  let url;
+  try {
+    url = new URL(urlString);
+  } catch {
+    return "invalid URL";
+  }
+  if (url.protocol !== "http:" && url.protocol !== "https:") {
+    return `disallowed scheme ${url.protocol}`;
+  }
+  if (url.username || url.password) {
+    return "URL credentials not allowed";
+  }
+  let hostname = url.hostname.toLowerCase();
+  if (hostname.startsWith("[") && hostname.endsWith("]")) {
+    hostname = hostname.slice(1, -1);
+  }
+  if (!hostname) return "missing hostname";
+  if (isBlockedHostname(hostname)) return `blocked hostname ${hostname}`;
+  const ipVersion = isIP(hostname);
+  if (ipVersion === 4 && isBlockedIpv4(hostname)) {
+    return `blocked address ${hostname}`;
+  }
+  if (ipVersion === 6 && isBlockedIpv6(hostname)) {
+    return `blocked address ${hostname}`;
+  }
+  return void 0;
+}
+var MAX_LINK_PROBE_REDIRECTS = 5;
+var FOLLOWED_REDIRECT_STATUSES = /* @__PURE__ */ new Set([301, 302, 303, 307, 308]);
+function redirectLocation(response) {
+  if (!FOLLOWED_REDIRECT_STATUSES.has(response.status)) return void 0;
+  const location = response.headers.get("location");
+  return location !== null && location.length > 0 ? location : void 0;
+}
+async function fetchWithScreenedRedirects(method, url, timeoutMs) {
+  const signal = AbortSignal.timeout(timeoutMs);
+  let current = url;
+  for (let hop = 0; hop <= MAX_LINK_PROBE_REDIRECTS; hop += 1) {
+    if (unsafeLinkProbeReason(current) !== void 0) return void 0;
+    const response = await fetch(current, { method, redirect: "manual", signal });
+    const location = redirectLocation(response);
+    if (location === void 0) return response;
+    try {
+      current = new URL(location, current).toString();
+    } catch {
+      return void 0;
+    }
+  }
+  return void 0;
+}
+async function defaultProbeLink(url, timeoutMs) {
+  if (unsafeLinkProbeReason(url) !== void 0) return false;
+  try {
+    const response = await fetchWithScreenedRedirects("HEAD", url, timeoutMs);
+    if (response === void 0) return false;
+    if (response.status === 405 || response.status === 501) {
+      const getResponse = await fetchWithScreenedRedirects("GET", url, timeoutMs);
+      if (getResponse === void 0) return false;
+      return getResponse.status < 400;
+    }
+    return response.status < 400;
+  } catch {
+    return false;
+  }
+}
+async function knowledgeDoctorChecks(cwd, options = {}) {
+  const root = path.resolve(cwd);
+  const findings = [];
+  const manifestResult = readKnowledgeManifest(root);
+  if (manifestResult.status === "absent") {
+    return { manifestPresent: false, findings };
+  }
+  if (manifestResult.status === "invalid") {
+    findings.push({
+      id: "manifest-invalid",
+      severity: "error",
+      message: `.build-project/context/knowledge/manifest.json is invalid: ${manifestResult.error}`
+    });
+    return { manifestPresent: true, findings };
+  }
+  const manifest = manifestResult.manifest;
+  let detection = detectStack(root);
+  const intent = readIntentContract(root);
+  if (intent.status === "ok" && intent.contract.status !== "retired") {
+    const resolution = resolveIntent(detection, intent.contract);
+    detection = resolution.effective;
+    for (const conflict of resolution.conflicts) {
+      findings.push({
+        id: "stack-intent-conflict",
+        severity: "warn",
+        message: `Stack intent conflict: declared ${conflict.dimension.token} vs detected ${conflict.detectedToken}. Resolve at an interactive 'build init' (keep both / accept detected).`
+      });
+    }
+  }
+  if (detection.fingerprint !== manifest.stackFingerprint) {
+    findings.push({
+      id: "manifest-drift",
+      severity: "warn",
+      message: `The repo stack has changed since the knowledge kit was accepted (fingerprint ${manifest.stackFingerprint} -> ${detection.fingerprint}). Re-run 'build init' to review updated recommendations.`
+    });
+  }
+  const staleTtlMs = options.staleTtlMs ?? DEFAULT_STALE_REF_TTL_MS;
+  const nowMs = (options.now?.() ?? /* @__PURE__ */ new Date()).getTime();
+  for (const item of manifest.items) {
+    const itemDate = Date.parse(item.versionOrDate);
+    if (!Number.isFinite(itemDate)) continue;
+    if (nowMs - itemDate > staleTtlMs) {
+      const days = Math.floor((nowMs - itemDate) / (24 * 60 * 60 * 1e3));
+      findings.push({
+        id: "stale-ref",
+        severity: "info",
+        itemId: item.id,
+        message: `Knowledge item "${item.id}" was accepted ${days} days ago and may be stale.`
+      });
+    }
+  }
+  const agentsPath = path.join(root, "AGENTS.md");
+  let agentsContent = "";
+  try {
+    agentsContent = existsSync(agentsPath) ? readFileSync(agentsPath, "utf8") : "";
+  } catch {
+    agentsContent = "";
+  }
+  const hasBegin = agentsContent.includes(KNOWLEDGE_BLOCK_BEGIN);
+  const hasEnd = agentsContent.includes(KNOWLEDGE_BLOCK_END);
+  if (!hasBegin && !hasEnd) {
+    findings.push({
+      id: "agents-block-missing",
+      severity: "warn",
+      message: "A knowledge manifest exists but AGENTS.md has no build-knowledge managed block. Re-run 'build init' to restore it."
+    });
+  } else if (hasBegin !== hasEnd || agentsContent.indexOf(KNOWLEDGE_BLOCK_END) < agentsContent.indexOf(KNOWLEDGE_BLOCK_BEGIN)) {
+    findings.push({
+      id: "agents-block-malformed",
+      severity: "error",
+      message: "AGENTS.md contains a malformed build-knowledge block (unpaired or out-of-order markers)."
+    });
+  }
+  if (options.checkLinks === true) {
+    const probe = options.probeLink ?? defaultProbeLink;
+    const timeoutMs = options.linkTimeoutMs ?? 1e4;
+    for (const item of manifest.items) {
+      const blocked = unsafeLinkProbeReason(item.sourceUrl);
+      if (blocked !== void 0) {
+        findings.push({
+          id: "dead-link",
+          severity: "warn",
+          itemId: item.id,
+          message: `Knowledge item "${item.id}" source URL was not probed (${blocked}): ${item.sourceUrl}`
+        });
+        continue;
+      }
+      const alive = await probe(item.sourceUrl, timeoutMs);
+      if (!alive) {
+        findings.push({
+          id: "dead-link",
+          severity: "warn",
+          itemId: item.id,
+          message: `Knowledge item "${item.id}" source URL appears unreachable: ${item.sourceUrl}`
+        });
+      }
+    }
+  }
+  return { manifestPresent: true, findings };
+}
+
+// src/core/guard-kit/state.ts
+import { createHash } from "crypto";
+import * as fs2 from "fs";
+import * as path3 from "path";
+
+// src/core/guard-kit/case-verify.ts
+import { execFileSync } from "child_process";
+import * as fs from "fs";
+import * as path2 from "path";
+var CANONICAL_GUARD_FILES = [CHECK_SCRIPT_REL, LOCK_FILE_REL, CONFIG_FILE_REL];
+function toPosix(value) {
+  return value.replace(/\\/g, "/");
+}
+function findCaseVariantEntry(dir, expected) {
+  let entries;
+  try {
+    entries = fs.readdirSync(dir);
+  } catch {
+    return null;
+  }
+  for (const entry of entries) {
+    if (entry !== expected && entry.toLowerCase() === expected.toLowerCase()) {
+      return entry;
+    }
+  }
+  return null;
+}
+function detectFilesystemCaseIssues(repoRoot) {
+  const issues = [];
+  const guardSegments = GUARD_DIR_REL.split(path2.sep);
+  let currentDir = repoRoot;
+  let relPrefix = "";
+  for (const segment of guardSegments) {
+    const variant = findCaseVariantEntry(currentDir, segment);
+    if (variant !== null) {
+      issues.push({
+        source: "filesystem",
+        actual: toPosix(path2.join(relPrefix, variant)),
+        expected: toPosix(path2.join(relPrefix, segment))
+      });
+    }
+    relPrefix = path2.join(relPrefix, segment);
+    currentDir = path2.join(currentDir, segment);
+  }
+  for (const name of CANONICAL_GUARD_FILES) {
+    const variant = findCaseVariantEntry(currentDir, name);
+    if (variant !== null) {
+      issues.push({
+        source: "filesystem",
+        actual: toPosix(path2.join(relPrefix, variant)),
+        expected: toPosix(path2.join(relPrefix, name))
+      });
+    }
+  }
+  return issues;
+}
+function detectGitCaseIssues(repoRoot) {
+  let stdout;
+  try {
+    stdout = execFileSync("git", ["ls-files", "-z"], {
+      cwd: repoRoot,
+      encoding: "utf8",
+      maxBuffer: 64 * 1024 * 1024,
+      stdio: ["ignore", "pipe", "ignore"]
+    });
+  } catch {
+    return [];
+  }
+  const guardPrefix = `${toPosix(GUARD_DIR_REL)}/`;
+  const guardPrefixLower = guardPrefix.toLowerCase();
+  const issues = [];
+  for (const raw of stdout.split("\0")) {
+    if (!raw) continue;
+    const tracked = toPosix(raw);
+    if (!tracked.toLowerCase().startsWith(guardPrefixLower)) continue;
+    if (tracked.startsWith(guardPrefix)) {
+      const rest = tracked.slice(guardPrefix.length);
+      const firstSegment = rest.split("/")[0] ?? "";
+      const canonical = CANONICAL_GUARD_FILES.find(
+        (name) => name !== firstSegment && name.toLowerCase() === firstSegment.toLowerCase()
+      );
+      if (canonical !== void 0) {
+        issues.push({
+          source: "git",
+          actual: tracked,
+          expected: `${guardPrefix}${canonical}${rest.slice(firstSegment.length)}`
+        });
+      }
+      continue;
+    }
+    issues.push({
+      source: "git",
+      actual: tracked,
+      expected: `${guardPrefix}${tracked.slice(guardPrefix.length)}`
+    });
+  }
+  return issues;
+}
+function detectGuardCaseIssues(repoRoot) {
+  const combined = [...detectFilesystemCaseIssues(repoRoot), ...detectGitCaseIssues(repoRoot)];
+  const seen = /* @__PURE__ */ new Set();
+  const issues = [];
+  for (const issue of combined) {
+    if (seen.has(issue.actual)) continue;
+    seen.add(issue.actual);
+    issues.push(issue);
+  }
+  return issues;
+}
+function repairGuardCaseIssues(repoRoot, issues) {
+  const repaired = [];
+  let remaining = [];
+  let pending = issues;
+  for (let round = 0; round < 5; round++) {
+    const result = repairPass(repoRoot, pending);
+    repaired.push(...result.repaired);
+    remaining = result.remaining;
+    if (result.repaired.length === 0) break;
+    const fresh = detectGuardCaseIssues(repoRoot);
+    if (fresh.length === 0) break;
+    const alreadyKnown = new Set(remaining.map((issue) => issue.actual));
+    pending = fresh.filter((issue) => !alreadyKnown.has(issue.actual));
+    if (pending.length === 0) break;
+  }
+  return { repaired, remaining };
+}
+function repairPass(repoRoot, issues) {
+  const repaired = [];
+  const remaining = [];
+  const ordered = [...issues].sort(
+    (a, b) => a.actual.split("/").length - b.actual.split("/").length
+  );
+  for (const issue of ordered) {
+    if (issue.source !== "filesystem") {
+      remaining.push(issue);
+      continue;
+    }
+    const actualAbs = path2.join(repoRoot, ...issue.actual.split("/"));
+    const expectedAbs = path2.join(repoRoot, ...issue.expected.split("/"));
+    const parent = path2.dirname(actualAbs);
+    const expectedName = path2.basename(expectedAbs);
+    let entries;
+    try {
+      entries = fs.readdirSync(parent);
+    } catch {
+      remaining.push(issue);
+      continue;
+    }
+    if (entries.includes(expectedName)) {
+      remaining.push(issue);
+      continue;
+    }
+    try {
+      let tmp = `${actualAbs}.case-repair-tmp`;
+      let suffix = 0;
+      while (fs.existsSync(tmp)) {
+        suffix += 1;
+        if (suffix > 100) throw new Error("no free temp name for case repair");
+        tmp = `${actualAbs}.case-repair-tmp${suffix}`;
+      }
+      fs.renameSync(actualAbs, tmp);
+      fs.renameSync(tmp, expectedAbs);
+      repaired.push(issue);
+    } catch {
+      remaining.push(issue);
+    }
+  }
+  return { repaired, remaining };
+}
+function formatGuardCaseIssues(issues) {
+  return issues.map(
+    (issue) => `Warning: guard path case mismatch (${issue.source}): ${issue.actual} should be ${issue.expected}. Rename to the exact casing (tracked paths need: git mv <actual> <expected>); case-insensitive filesystems silently merge these paths while CI sees them as distinct.`
+  );
+}
+
+// src/core/guard-kit/kit-version.ts
+var GUARD_KIT_VERSION = "0.6.0";
+
+// src/core/guard-kit/state.ts
+function sha256Hex(content) {
+  return createHash("sha256").update(content).digest("hex");
+}
+function readLock(guardDir) {
+  const lockPath = path3.join(guardDir, LOCK_FILE_REL);
+  let raw;
+  try {
+    raw = fs2.readFileSync(lockPath, "utf8");
+  } catch {
+    return null;
+  }
+  try {
+    const parsed = JSON.parse(raw);
+    if (typeof parsed.kitVersion !== "string" || typeof parsed.generatedAt !== "string" || typeof parsed.files !== "object" || parsed.files === null) {
+      return null;
+    }
+    const files = {};
+    const seenFolded = /* @__PURE__ */ new Set();
+    for (const [file, hash] of Object.entries(parsed.files)) {
+      if (typeof hash !== "string") return null;
+      const folded = file.toLowerCase();
+      if (seenFolded.has(folded)) return null;
+      seenFolded.add(folded);
+      files[file] = hash;
+    }
+    if (!(CHECK_SCRIPT_REL in files)) return null;
+    return { kitVersion: parsed.kitVersion, generatedAt: parsed.generatedAt, files };
+  } catch {
+    return null;
+  }
+}
+function compareKitVersions(a, b) {
+  const partsA = a.split(".").map((segment) => Number.parseInt(segment, 10) || 0);
+  const partsB = b.split(".").map((segment) => Number.parseInt(segment, 10) || 0);
+  const length = Math.max(partsA.length, partsB.length);
+  for (let index = 0; index < length; index++) {
+    const diff = (partsA[index] ?? 0) - (partsB[index] ?? 0);
+    if (diff !== 0) return diff;
+  }
+  return 0;
+}
+function classifyGuardState(repoRoot) {
+  const bundledVersion = GUARD_KIT_VERSION;
+  const guardDir = path3.join(repoRoot, GUARD_DIR_REL);
+  const caseIssues = detectGuardCaseIssues(repoRoot);
+  const caseMessages = formatGuardCaseIssues(caseIssues);
+  const base = (state, extra = {}) => {
+    const report = {
+      state,
+      bundledVersion,
+      mismatchedFiles: [],
+      missingFiles: [],
+      messages: [],
+      caseIssues,
+      ...extra
+    };
+    report.messages = [...report.messages, ...caseMessages];
+    return report;
+  };
+  if (caseIssues.length > 0) {
+    return base("partial", {
+      messages: [
+        "Warning: guard kit path casing diverges from the canonical .build-project/guard layout; the trusted-base CI extraction will fail."
+      ]
+    });
+  }
+  if (!fs2.existsSync(guardDir)) {
+    return base("absent", {
+      messages: ["Info: guard kit not installed (.build-project/guard/ absent)."]
+    });
+  }
+  const lock = readLock(guardDir);
+  if (!lock) {
+    return base("partial", {
+      messages: [
+        "Warning: guard kit lock (.build-project/guard/checks.lock) is missing or invalid."
+      ]
+    });
+  }
+  const mismatchedFiles = [];
+  const missingFiles = [];
+  const guardDirResolved = path3.resolve(guardDir);
+  for (const [file, expected] of Object.entries(lock.files)) {
+    const filePath = path3.resolve(guardDirResolved, file);
+    if (filePath !== guardDirResolved && !filePath.startsWith(guardDirResolved + path3.sep)) {
+      return base("partial", {
+        installedVersion: lock.kitVersion,
+        messages: [
+          `Warning: guard kit lock names a path outside .build-project/guard (${file}); the lock is invalid.`
+        ]
+      });
+    }
+    let content;
+    try {
+      content = fs2.readFileSync(filePath);
+    } catch {
+      missingFiles.push(file);
+      continue;
+    }
+    const actual = `sha256:${sha256Hex(content)}`;
+    if (actual !== expected) mismatchedFiles.push(file);
+  }
+  if (missingFiles.length > 0) {
+    return base("partial", {
+      installedVersion: lock.kitVersion,
+      missingFiles: missingFiles.sort(),
+      mismatchedFiles: mismatchedFiles.sort(),
+      messages: [
+        `Warning: guard kit is missing generated files: ${missingFiles.sort().join(", ")}.`
+      ]
+    });
+  }
+  if (mismatchedFiles.length > 0) {
+    return base("tampered", {
+      installedVersion: lock.kitVersion,
+      mismatchedFiles: mismatchedFiles.sort(),
+      messages: [
+        `Warning: guard kit generated files were hand-edited: ${mismatchedFiles.sort().join(", ")}.`
+      ]
+    });
+  }
+  const versionDelta = compareKitVersions(lock.kitVersion, bundledVersion);
+  if (versionDelta < 0) {
+    return base("upgradable", {
+      installedVersion: lock.kitVersion,
+      messages: [`Info: guard kit ${lock.kitVersion} installed; ${bundledVersion} available.`]
+    });
+  }
+  if (versionDelta > 0) {
+    return base("current", {
+      installedVersion: lock.kitVersion,
+      messages: [
+        `Info: guard kit ${lock.kitVersion} is newer than this Build's bundled ${bundledVersion}; leaving it untouched.`
+      ]
+    });
+  }
+  return base("current", {
+    installedVersion: lock.kitVersion,
+    messages: [`OK: guard kit ${lock.kitVersion} is current.`]
+  });
+}
+
+export {
+  knowledgeDoctorChecks,
+  GUARD_KIT_VERSION,
+  repairGuardCaseIssues,
+  formatGuardCaseIssues,
+  compareKitVersions,
+  classifyGuardState
+};
+//# sourceMappingURL=chunk-DNIOIISW.js.map