@enterpriseai/cli 3.19.0 → 3.19.2

package/resources/gofer/node-scripts/gofer-closed-loop-audit.mjs

@@ -2,6 +2,7 @@
 
 import { promises as fs } from 'fs';
 import path from 'path';
+import { reviewPriority } from './gofer-priority-check.mjs';
 
 const STAGE_ORDER = {
   '1_research': 1,
@@ -31,6 +32,7 @@ Options:
   --report <path>      Override markdown report path
   --json               Print JSON summary to stdout
   --strict             Exit non-zero on drift, missing evidence, or invalid artifacts
+  --completion         Require the current priority outcome receipt before completion
   --no-report          Do not write goal-rebaseline-report.md
 `;
 }
@@ -42,6 +44,7 @@ function parseArgs(argv) {
     reportPath: '',
     json: false,
     strict: false,
+    completion: false,
     writeReport: true,
   };
 
@@ -66,6 +69,9 @@ function parseArgs(argv) {
       case '--strict':
         args.strict = true;
         break;
+      case '--completion':
+        args.completion = true;
+        break;
       case '--no-report':
         args.writeReport = false;
         break;
@@ -370,7 +376,7 @@ function getSpecArtifactStatus(content) {
   return 'ready';
 }
 
-async function analyzeFeature({ featureDir, workspaceRoot }) {
+async function analyzeFeature({ featureDir, workspaceRoot, completion = false }) {
   const featureId = path.basename(featureDir);
   const specPath = path.join(featureDir, 'spec.md');
   const planPath = path.join(featureDir, 'plan.md');
@@ -673,7 +679,7 @@ async function analyzeFeature({ featureDir, workspaceRoot }) {
     latestMtimeMs(path.join(featureDir, 'contract-pack.md')),
     latestMtimeMs(path.join(featureDir, 'contracts')),
     latestMtimeMs(path.join(featureDir, 'ui-preview-brief.md')),
-    latestMtimeMs(path.join(featureDir, 'ui-approval.md')),
+    latestMtimeMs(path.join(featureDir, 'ui-show-and-tell.md')),
     latestMtimeMs(path.join(featureDir, 'service-fit-matrix.md')),
   ]);
 
@@ -776,6 +782,16 @@ async function analyzeFeature({ featureDir, workspaceRoot }) {
     }
   }
 
+  if (completion || await pathExists(path.join(featureDir, 'priority-plan.json'))) {
+    result.priorityReview = await reviewPriority(featureDir, { finish: completion });
+    if (result.priorityReview.status !== 'pass') {
+      result.status = 'fail';
+      for (const message of result.priorityReview.findings) addFinding(result.blockingFindings, {
+        stage: '6_validate', source: 'priority-plan.json', message,
+      });
+    }
+  }
+
   if (
     result.status === 'healthy' &&
     (result.warnings.length > 0 || result.deliveryStates.incomplete.length > 0)
@@ -863,6 +879,7 @@ async function writeReport(reportPath, content) {
 async function main() {
   const args = parseArgs(process.argv.slice(2));
   const result = await analyzeFeature({
+    completion: args.completion,
     featureDir: args.featureDir,
     workspaceRoot: args.workspace,
   });

package/resources/gofer/node-scripts/gofer-delivery-check.mjs

@@ -0,0 +1,121 @@
+#!/usr/bin/env node
+import { readFile, writeFile, realpath, rename } from 'node:fs/promises';
+import { createHash, randomUUID } from 'node:crypto';
+import path from 'node:path';
+import { pathToFileURL } from 'node:url';
+
+const REQUIRED = ['spec.md', 'plan.md', 'tasks.md', 'traceability.md'];
+const OPTIONAL = ['goal-ledger.json', 'research.md', 'discovery.md', 'issues.md', 'validation-report.md', 'decisions.md', 'priority-plan.json'];
+const hash = text => createHash('sha256').update(text).digest('hex');
+
+function namesReceipt(line, receipt) {
+  // Consume Markdown links as a whole so their labels cannot stand in for destinations.
+  const references = line.matchAll(/`([^`]+)`|\[[^\[\]]*\]\(\s*(?:<([^>]+)>|([^\s)]+))(?:\s+["'][^"']*["'])?\s*\)|\[[^\[\]]*\](?:\[[^\[\]]*\])?|([^\s|`()[\]<>]+)/g);
+  return Array.from(references).some(match => (match[1] ?? match[2] ?? match[3] ?? match[4]) === receipt);
+}
+
+async function safeRead(root, relative) {
+  if (typeof relative !== 'string' || path.isAbsolute(relative) || relative.split(/[\\/]/).includes('..')) throw new Error('Unsafe artifact path');
+  const target = await realpath(path.resolve(root, relative));
+  if (!target.startsWith(root + path.sep)) throw new Error('Artifact escapes feature folder');
+  return readFile(target, 'utf8');
+}
+
+export async function reviewDelivery(featureDir, { capture = false, evidenceMap } = {}) {
+  const root = await realpath(featureDir);
+  const findings = [];
+  const artifacts = {};
+  const contents = {};
+  for (const file of [...REQUIRED, ...OPTIONAL]) {
+    try {
+      contents[file] = await safeRead(root, file);
+      if (!contents[file].trim()) findings.push(`EMPTY_ARTIFACT:${file}`);
+      artifacts[file] = hash(contents[file]);
+    } catch (error) {
+      artifacts[file] = null;
+      if (REQUIRED.includes(file) || error.code !== 'ENOENT') findings.push(`UNREADABLE_ARTIFACT:${file}`);
+    }
+  }
+  let checkpoint;
+  try { checkpoint = JSON.parse(await safeRead(root, 'delivery-checkpoint.json')); }
+  catch (error) { if (!capture || error.code !== 'ENOENT') findings.push('MISSING_OR_INVALID_CHECKPOINT'); }
+  const completed = [];
+  const taskIds = new Set();
+  for (const line of (contents['tasks.md'] || '').split('\n')) {
+    if (/^\s*-\s+\[[xX]\]/.test(line) && !/^\s*-\s+\[[xX]\]\s+(?:\*\*)?#?T\d+\b/.test(line)) findings.push('COMPLETED_TASK_WITHOUT_ID');
+  }
+  for (const match of (contents['tasks.md'] || '').matchAll(/^\s*-\s+\[([^\]])\]\s+(?:\*\*)?#?(T\d+)\b/gm)) {
+    if (taskIds.has(match[2])) findings.push(`DUPLICATE_TASK:${match[2]}`);
+    taskIds.add(match[2]);
+    if (/[xX]/.test(match[1])) completed.push(match[2]);
+  }
+  const mapping = evidenceMap ?? checkpoint?.completedTasks ?? {};
+  if (!mapping || typeof mapping !== 'object' || Array.isArray(mapping)) findings.push('INVALID_EVIDENCE_MAP');
+  const checked = {};
+  for (const task of completed) {
+    const item = mapping?.[task];
+    if (!item || !Array.isArray(item.requirements) || !item.requirements.length) {
+      findings.push(`MISSING_TASK_EVIDENCE:${task}`); continue;
+    }
+    const requirements = new Set((contents['spec.md'] || '').match(/\b(?:FR|NFR|SC)-\d+\b/g) || []);
+    if (item.requirements.some(id => !requirements.has(id))) findings.push(`UNKNOWN_REQUIREMENT:${task}`);
+    const trace = contents['traceability.md'] || '';
+    if (!trace.split('\n').some(line => new RegExp(`\\b${task}\\b`).test(line) && item.requirements.every(id => typeof id === 'string' && /^(?:FR|NFR|SC)-\d+$/.test(id) && new RegExp(`\\b${id}\\b`).test(line)))) findings.push(`MISSING_TRACEABILITY:${task}`);
+    if (artifacts['priority-plan.json'] && !trace.split('\n').some(line =>
+      new RegExp(`\\b${task}\\b`).test(line) && typeof item.evidence === 'string' && namesReceipt(line, item.evidence))) {
+      findings.push(`MISSING_NAMED_TASK_RECEIPT:${task}`);
+    }
+    try {
+      const raw = await safeRead(root, item.evidence);
+      const proof = JSON.parse(raw);
+      if (proof.result !== 'pass' || proof.specHash !== artifacts['spec.md'] ||
+          !Array.isArray(proof.requirements) || item.requirements.some(id => !proof.requirements.includes(id)) ||
+          typeof proof.check !== 'string' || !proof.check.trim()) findings.push(`INVALID_OR_STALE_EVIDENCE:${task}`);
+      if (!capture && item.evidenceHash !== hash(raw)) findings.push(`CHANGED_EVIDENCE:${task}`);
+      checked[task] = { requirements: item.requirements, evidence: item.evidence, evidenceHash: hash(raw) };
+    } catch { findings.push(`UNREADABLE_EVIDENCE:${task}`); }
+  }
+  if (mapping && Object.keys(mapping).some(task => !completed.includes(task))) findings.push('EVIDENCE_FOR_UNFINISHED_OR_REMOVED_TASK');
+  if (!capture) {
+    if (checkpoint?.schemaVersion !== 1) findings.push('INVALID_CHECKPOINT_VERSION');
+    for (const file of Object.keys(artifacts)) {
+      if ((checkpoint?.artifacts?.[file] ?? null) !== artifacts[file]) findings.push(`ARTIFACT_DRIFT:${file}`);
+    }
+  }
+  if (capture && !findings.length) {
+    // Refuse symlink outputs as well as symlink inputs outside the feature.
+    try { await safeRead(root, 'delivery-checkpoint.json'); }
+    catch (error) { if (error.code !== 'ENOENT') throw error; }
+    const temporary = path.join(root, `.delivery-checkpoint-${randomUUID()}.tmp`);
+    await writeFile(temporary, JSON.stringify({
+      schemaVersion: 1, capturedAt: new Date().toISOString(), artifacts, completedTasks: checked,
+    }, null, 2) + '\n', { flag: 'wx' });
+    await rename(temporary, path.join(root, 'delivery-checkpoint.json'));
+  }
+  return { status: findings.length ? 'fail' : 'pass', findings, completedTasks: completed.length,
+    artifacts, scope: 'File freshness and recorded evidence checks, not independent proof of test execution or goal alignment.' };
+}
+
+async function main() {
+  const args = process.argv.slice(2);
+  if (args.includes('--help')) {
+    console.log('Usage: gofer-delivery-check.mjs --feature-dir <path> [--capture --evidence-map <json-file>]'); return;
+  }
+  const options = {};
+  let featureDir;
+  for (let i = 0; i < args.length; i++) {
+    if (args[i] === '--capture') options.capture = true;
+    else if (['--feature-dir', '--evidence-map'].includes(args[i]) && args[i + 1] && !args[i + 1].startsWith('--')) {
+      const flag = args[i++];
+      if (flag === '--feature-dir') featureDir = args[i];
+      else options.evidenceMap = JSON.parse(await readFile(args[i], 'utf8'));
+    } else throw new Error('Invalid arguments');
+  }
+  if (!featureDir || (options.evidenceMap && !options.capture)) throw new Error('Invalid capture arguments');
+  const result = await reviewDelivery(path.resolve(featureDir), options);
+  console.log(JSON.stringify(result, null, 2));
+  if (result.status === 'fail') process.exitCode = 1;
+}
+if (process.argv[1] && import.meta.url === pathToFileURL(path.resolve(process.argv[1])).href) {
+  main().catch(() => { console.error('Delivery check failed. Check the local feature files and arguments.'); process.exitCode = 1; });
+}

package/resources/gofer/node-scripts/gofer-encrypted-key.mjs

@@ -0,0 +1,58 @@
+/**
+ * Passphrase-encrypted Ed25519 signing key. A worker sandbox can read the
+ * account home, so a plaintext signing key is forgeable by any worker. This
+ * envelope is useless without a passphrase that only a person types at a
+ * terminal. It is never read from the environment, a file, or an argument.
+ */
+import { createCipheriv, createDecipheriv, createPrivateKey, randomBytes, scrypt } from 'node:crypto';
+import { promisify } from 'node:util';
+
+const derive = promisify(scrypt);
+const denied = () => new Error('ENCRYPTED_KEY_REQUIRED');
+const MIN_PASSPHRASE_LENGTH = 12;
+const KDF = Object.freeze({ N: 2 ** 17, r: 8, p: 1, keyLength: 32, maxmem: 256 * 1024 * 1024 });
+const b64 = value => Buffer.from(value).toString('base64url');
+const fromB64 = (value, length) => {
+  if (typeof value !== 'string' || !/^[A-Za-z0-9_-]+$/.test(value)) throw denied();
+  const bytes = Buffer.from(value, 'base64url');
+  if (length !== undefined && bytes.length !== length) throw denied();
+  return bytes;
+};
+
+export function assertStrongPassphrase(passphrase) {
+  if (typeof passphrase !== 'string' || passphrase.length < MIN_PASSPHRASE_LENGTH) throw denied();
+}
+
+/** `privateKey` must be an Ed25519 KeyObject. */
+export async function encryptSigningKey(privateKey, passphrase) {
+  assertStrongPassphrase(passphrase);
+  if (privateKey?.asymmetricKeyType !== 'ed25519') throw denied();
+  const salt = randomBytes(16);
+  const iv = randomBytes(12);
+  const key = await derive(passphrase, salt, KDF.keyLength, { N: KDF.N, r: KDF.r, p: KDF.p, maxmem: KDF.maxmem });
+  const cipher = createCipheriv('aes-256-gcm', key, iv);
+  cipher.setAAD(Buffer.from('gofer-verifier-key-v1'));
+  const ciphertext = Buffer.concat([cipher.update(privateKey.export({ type: 'pkcs8', format: 'der' })), cipher.final()]);
+  return Object.freeze({ schemaVersion: 1, kdf: { name: 'scrypt', N: KDF.N, r: KDF.r, p: KDF.p, salt: b64(salt) },
+    cipher: { name: 'aes-256-gcm', iv: b64(iv), tag: b64(cipher.getAuthTag()) }, ciphertext: b64(ciphertext) });
+}
+
+/** Returns an Ed25519 private KeyObject, or throws. A wrong passphrase and a
+ * tampered envelope are indistinguishable by design. */
+export async function decryptSigningKey(envelope, passphrase) {
+  assertStrongPassphrase(passphrase);
+  if (envelope?.schemaVersion !== 1 || envelope.kdf?.name !== 'scrypt' ||
+      envelope.kdf.N !== KDF.N || envelope.kdf.r !== KDF.r || envelope.kdf.p !== KDF.p ||
+      envelope.cipher?.name !== 'aes-256-gcm') throw denied();
+  try {
+    const key = await derive(passphrase, fromB64(envelope.kdf.salt, 16), KDF.keyLength,
+      { N: KDF.N, r: KDF.r, p: KDF.p, maxmem: KDF.maxmem });
+    const decipher = createDecipheriv('aes-256-gcm', key, fromB64(envelope.cipher.iv, 12));
+    decipher.setAAD(Buffer.from('gofer-verifier-key-v1'));
+    decipher.setAuthTag(fromB64(envelope.cipher.tag, 16));
+    const der = Buffer.concat([decipher.update(fromB64(envelope.ciphertext)), decipher.final()]);
+    const privateKey = createPrivateKey({ key: der, format: 'der', type: 'pkcs8' });
+    if (privateKey.asymmetricKeyType !== 'ed25519') throw denied();
+    return privateKey;
+  } catch { throw denied(); }
+}