@flyingrobots/graft 0.3.5 → 0.5.0

package/src/release/security-gate.ts

@@ -0,0 +1,102 @@
+import { z } from "zod";
+
+const severitySchema = z.enum([ "info", "low", "moderate", "high", "critical" ]);
+
+const auditReportSchema = z.object({
+  metadata: z.object({
+    vulnerabilities: z.object({
+      info: z.number().int().nonnegative(),
+      low: z.number().int().nonnegative(),
+      moderate: z.number().int().nonnegative(),
+      high: z.number().int().nonnegative(),
+      critical: z.number().int().nonnegative(),
+    }),
+  }),
+  advisories: z.record(z.string(), z.object({
+    id: z.number().int().nonnegative(),
+    module_name: z.string(),
+    severity: severitySchema,
+    title: z.string(),
+    recommendation: z.string(),
+    github_advisory_id: z.string().nullable().optional(),
+    findings: z.array(z.object({
+      version: z.string(),
+      paths: z.array(z.string()),
+    })).optional(),
+  })),
+});
+
+export interface SecurityGateViolation {
+  readonly id: number;
+  readonly moduleName: string;
+  readonly severity: "high" | "critical";
+  readonly title: string;
+  readonly advisoryId: string | null;
+  readonly recommendation: string;
+  readonly paths: readonly string[];
+  readonly versions: readonly string[];
+}
+
+export interface SecurityGateResult {
+  readonly blocking: boolean;
+  readonly counts: {
+    readonly info: number;
+    readonly low: number;
+    readonly moderate: number;
+    readonly high: number;
+    readonly critical: number;
+  };
+  readonly blockingFindings: readonly SecurityGateViolation[];
+}
+
+export function evaluateSecurityGate(report: unknown): SecurityGateResult {
+  const parsed = auditReportSchema.parse(report);
+  const blockingFindings: SecurityGateViolation[] = [];
+
+  for (const advisory of Object.values(parsed.advisories)) {
+    if (advisory.severity !== "high" && advisory.severity !== "critical") {
+      continue;
+    }
+    blockingFindings.push({
+      id: advisory.id,
+      moduleName: advisory.module_name,
+      severity: advisory.severity,
+      title: advisory.title,
+      advisoryId: advisory.github_advisory_id ?? null,
+      recommendation: advisory.recommendation,
+      paths: advisory.findings?.flatMap((finding) => finding.paths) ?? [],
+      versions: advisory.findings?.map((finding) => finding.version) ?? [],
+    });
+  }
+
+  return {
+    blocking: blockingFindings.length > 0,
+    counts: parsed.metadata.vulnerabilities,
+    blockingFindings,
+  };
+}
+
+export function formatSecurityGateResult(result: SecurityGateResult): string {
+  const lines = [
+    `audit summary: critical=${String(result.counts.critical)} high=${String(result.counts.high)} moderate=${String(result.counts.moderate)} low=${String(result.counts.low)} info=${String(result.counts.info)}`,
+  ];
+
+  if (!result.blocking) {
+    lines.push("release security gate: pass");
+    return lines.join("\n");
+  }
+
+  lines.push("release security gate: fail");
+  for (const finding of result.blockingFindings) {
+    const advisoryId = finding.advisoryId ?? `npm:${String(finding.id)}`;
+    const paths = finding.paths.length > 0 ? finding.paths.join(", ") : "unknown path";
+    const versions = finding.versions.length > 0 ? finding.versions.join(", ") : "unknown version";
+    lines.push(
+      `- ${finding.severity.toUpperCase()} ${advisoryId} ${finding.moduleName}@${versions} via ${paths}`,
+    );
+    lines.push(`  ${finding.title}`);
+    lines.push(`  ${finding.recommendation}`);
+  }
+
+  return lines.join("\n");
+}

package/src/session/tracker.ts

@@ -5,6 +5,15 @@ const EDIT_BASH_TOOLS = new Set(["Edit", "Bash"]);
 const LATE_READ_BYTE_THRESHOLD = 20480;
 const LATE_READ_MESSAGE_THRESHOLD = 300;
 
+export interface SessionTrackerSnapshot {
+  readonly totalMessages: number;
+  readonly toolCallsSinceUser: number;
+  readonly editBashTransitions: number;
+  readonly lastEditBashTool: string | null;
+  readonly budgetBytes: number | null;
+  readonly consumedBytes: number;
+}
+
 export class SessionTracker {
   private totalMessages = 0;
   private toolCallsSinceUser = 0;
@@ -13,6 +22,17 @@ export class SessionTracker {
   private budgetBytes: number | null = null;
   private consumedBytes = 0;
 
+  static fromSnapshot(snapshot: SessionTrackerSnapshot): SessionTracker {
+    const tracker = new SessionTracker();
+    tracker.totalMessages = snapshot.totalMessages;
+    tracker.toolCallsSinceUser = snapshot.toolCallsSinceUser;
+    tracker.editBashTransitions = snapshot.editBashTransitions;
+    tracker.lastEditBashTool = snapshot.lastEditBashTool;
+    tracker.budgetBytes = snapshot.budgetBytes;
+    tracker.consumedBytes = snapshot.consumedBytes;
+    return tracker;
+  }
+
   getMessageCount(): number {
     return this.totalMessages;
   }
@@ -102,6 +122,17 @@ export class SessionTracker {
     };
   }
 
+  snapshot(): SessionTrackerSnapshot {
+    return {
+      totalMessages: this.totalMessages,
+      toolCallsSinceUser: this.toolCallsSinceUser,
+      editBashTransitions: this.editBashTransitions,
+      lastEditBashTool: this.lastEditBashTool,
+      budgetBytes: this.budgetBytes,
+      consumedBytes: this.consumedBytes,
+    };
+  }
+
   getSessionDepth(): SessionDepth {
     if (this.totalMessages < 100) {
       return "early";

package/src/version.ts

@@ -0,0 +1,3 @@
+import packageJson from "../package.json";
+
+export const GRAFT_VERSION = packageJson.version;

package/src/warp/indexer.ts

@@ -0,0 +1,513 @@
+/**
+ * WARP Indexer — walks git history and writes structural delta
+ * patches into the WARP graph.
+ *
+ * Observer Law: this module WRITES facts. It never reads them back.
+ * Reading is done exclusively through observers (see observers.ts).
+ */
+
+import type WarpApp from "@git-stunts/git-warp";
+import type { GitClient } from "../ports/git.js";
+import { extractOutline } from "../parser/outline.js";
+import { diffOutlines } from "../parser/diff.js";
+import { detectLang } from "../parser/lang.js";
+import { getFileAtRef } from "../git/diff.js";
+import type { OutlineEntry, JumpEntry } from "../parser/types.js";
+import type { DiffEntry } from "../parser/diff.js";
+
+export interface IndexOptions {
+  readonly cwd: string;
+  readonly git: GitClient;
+  readonly from?: string;
+  readonly to?: string;
+}
+
+export interface IndexResult {
+  readonly commitsIndexed: number;
+  readonly patchesWritten: number;
+  readonly commitTicks: ReadonlyMap<string, number>;
+}
+
+// Patch builder shape — matches PatchBuilderV2's fluent API.
+interface PatchOps {
+  addNode(id: string): PatchOps;
+  removeNode(id: string): PatchOps;
+  setProperty(id: string, key: string, value: unknown): PatchOps;
+  addEdge(from: string, to: string, label: string): PatchOps;
+  removeEdge(from: string, to: string, label: string): PatchOps;
+}
+
+interface PreparedChange {
+  readonly status: string;
+  readonly filePath: string;
+  readonly fileId: string;
+  readonly lang: string | null;
+  readonly parentExists: boolean;
+  readonly oldOutline: readonly OutlineEntry[];
+  readonly newOutline?: readonly OutlineEntry[] | undefined;
+  readonly jumpLookup?: Map<string, { start: number; end: number }> | undefined;
+  readonly diff?: ReturnType<typeof diffOutlines> | undefined;
+}
+
+async function git(gitClient: GitClient, cwd: string, args: readonly string[]): Promise<string> {
+  const result = await gitClient.run({ cwd, args });
+  if (result.error !== undefined || result.status !== 0) {
+    throw result.error ?? new Error(result.stderr.trim() || `git exited with status ${String(result.status)}`);
+  }
+  return result.stdout;
+}
+
+async function listCommits(gitClient: GitClient, cwd: string, from?: string, to?: string): Promise<string[]> {
+  const range = from !== undefined ? `${from}..${to ?? "HEAD"}` : to ?? "HEAD";
+  const args = ["log", "--reverse", "--format=%H", range];
+  try {
+    return (await git(gitClient, cwd, args))
+      .trim().split("\n").filter((l) => l.length > 0);
+  } catch {
+    return [];
+  }
+}
+
+async function getCommitChanges(
+  gitClient: GitClient,
+  sha: string,
+  cwd: string,
+): Promise<{ status: string; path: string }[]> {
+  // --root handles the initial commit (no parent to diff against)
+  const args = ["diff-tree", "--root", "--no-commit-id", "-r", "--name-status", sha];
+  try {
+    return (await git(gitClient, cwd, args))
+      .trim().split("\n").filter((l) => l.length > 0).map((line) => {
+        const parts = line.split("\t");
+        return { status: parts[0] ?? "", path: parts[1] ?? "" };
+      });
+  } catch {
+    return [];
+  }
+}
+
+async function getCommitMeta(
+  gitClient: GitClient,
+  sha: string,
+  cwd: string,
+): Promise<{ message: string; author: string; email: string; timestamp: string }> {
+  try {
+    const output = await git(gitClient, cwd, ["log", "-1", "--format=%s%n%aN%n%aE%n%aI", sha]);
+    const lines = output.trim().split("\n");
+    return { message: lines[0] ?? "", author: lines[1] ?? "", email: lines[2] ?? "", timestamp: lines[3] ?? "" };
+  } catch {
+    return { message: "", author: "", email: "", timestamp: "" };
+  }
+}
+
+/**
+ * Check if a commit has a parent (is not the root commit).
+ */
+async function hasParent(gitClient: GitClient, sha: string, cwd: string): Promise<boolean> {
+  try {
+    await git(gitClient, cwd, ["rev-parse", "--verify", `${sha}~1`]);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+function dirNodeId(dirPath: string): string {
+  return `dir:${dirPath}`;
+}
+
+function fileNodeId(filePath: string): string {
+  return `file:${filePath}`;
+}
+
+function symNodeId(filePath: string, name: string): string {
+  return `sym:${filePath}:${name}`;
+}
+
+/**
+ * Build a lookup from symbol name → line range from the jump table.
+ */
+function buildJumpLookup(jumpTable: readonly JumpEntry[]): Map<string, { start: number; end: number }> {
+  const lookup = new Map<string, { start: number; end: number }>();
+  for (const entry of jumpTable) {
+    lookup.set(entry.symbol, { start: entry.start, end: entry.end });
+  }
+  return lookup;
+}
+
+/**
+ * Emit directory nodes + edges for all path components of a file.
+ */
+function emitDirectoryChain(patch: PatchOps, filePath: string): void {
+  const parts = filePath.split("/");
+  if (parts.length <= 1) return;
+
+  let current = "";
+  for (let i = 0; i < parts.length - 1; i++) {
+    const parent = current;
+    const part = parts[i] ?? "";
+    current = current.length > 0 ? `${current}/${part}` : part;
+    const dirId = dirNodeId(current);
+    patch.addNode(dirId);
+    patch.setProperty(dirId, "path", current);
+
+    if (parent.length > 0) {
+      patch.addEdge(dirNodeId(parent), dirId, "contains");
+    }
+  }
+
+  patch.addEdge(dirNodeId(current), fileNodeId(filePath), "contains");
+}
+
+/**
+ * Emit symbol nodes + edges for all entries in a file outline.
+ */
+function emitSymbols(
+  patch: PatchOps,
+  filePath: string,
+  entries: readonly OutlineEntry[],
+  jumpLookup: Map<string, { start: number; end: number }>,
+  parentSymId?: string,
+): void {
+  for (const entry of entries) {
+    const symId = symNodeId(filePath, entry.name);
+    patch.addNode(symId);
+    patch.setProperty(symId, "name", entry.name);
+    patch.setProperty(symId, "kind", entry.kind);
+    patch.setProperty(symId, "exported", entry.exported);
+    if (entry.signature !== undefined) {
+      patch.setProperty(symId, "signature", entry.signature);
+    }
+    const jump = jumpLookup.get(entry.name);
+    if (jump !== undefined) {
+      patch.setProperty(symId, "startLine", jump.start);
+      patch.setProperty(symId, "endLine", jump.end);
+    }
+    patch.addEdge(fileNodeId(filePath), symId, "contains");
+    if (parentSymId !== undefined) {
+      patch.addEdge(parentSymId, symId, "child_of");
+    }
+    if (entry.children !== undefined && entry.children.length > 0) {
+      emitSymbols(patch, filePath, entry.children, jumpLookup, symId);
+    }
+  }
+}
+
+/**
+ * Tombstone (remove) symbol nodes recursively including children.
+ */
+function removeSymbols(
+  patch: PatchOps,
+  filePath: string,
+  entries: readonly OutlineEntry[],
+): void {
+  for (const entry of entries) {
+    // Recurse into children FIRST (bottom-up removal)
+    if (entry.children !== undefined && entry.children.length > 0) {
+      removeSymbols(patch, filePath, entry.children);
+    }
+    const symId = symNodeId(filePath, entry.name);
+    patch.removeEdge(fileNodeId(filePath), symId, "contains");
+    patch.removeNode(symId);
+  }
+}
+
+/**
+ * Remove symbols from DiffEntry (removed symbols in a diff).
+ * Also recursively handles childDiff if present.
+ */
+function removeDiffSymbols(
+  patch: PatchOps,
+  filePath: string,
+  fileId: string,
+  entries: readonly DiffEntry[],
+): void {
+  for (const entry of entries) {
+    // Recurse into childDiff if present (remove grandchildren first)
+    if (entry.childDiff !== undefined) {
+      removeDiffSymbols(patch, filePath, fileId, [...entry.childDiff.removed]);
+      removeDiffSymbols(patch, filePath, fileId, [...entry.childDiff.added]);
+      removeDiffSymbols(patch, filePath, fileId, [...entry.childDiff.changed]);
+    }
+    const symId = symNodeId(filePath, entry.name);
+    patch.removeEdge(fileId, symId, "contains");
+    patch.removeNode(symId);
+  }
+}
+
+/**
+ * Apply child diffs for changed symbols (methods added/removed/changed
+ * inside a class that kept its name).
+ */
+function applyChildDiffs(
+  patch: PatchOps,
+  filePath: string,
+  fileId: string,
+  commitId: string,
+  changed: readonly DiffEntry[],
+  jumpLookup: Map<string, { start: number; end: number }>,
+): void {
+  for (const entry of changed) {
+    if (entry.childDiff === undefined) continue;
+    const parentSymId = symNodeId(filePath, entry.name);
+
+    for (const added of entry.childDiff.added) {
+      const symId = symNodeId(filePath, added.name);
+      patch.addNode(symId);
+      patch.setProperty(symId, "name", added.name);
+      patch.setProperty(symId, "kind", added.kind);
+      patch.setProperty(symId, "exported", false);
+      if (added.signature !== undefined) {
+        patch.setProperty(symId, "signature", added.signature);
+      }
+      const jump = jumpLookup.get(added.name);
+      if (jump !== undefined) {
+        patch.setProperty(symId, "startLine", jump.start);
+        patch.setProperty(symId, "endLine", jump.end);
+      }
+      patch.addEdge(fileId, symId, "contains");
+      patch.addEdge(parentSymId, symId, "child_of");
+      patch.addEdge(commitId, symId, "adds");
+    }
+
+    for (const removed of entry.childDiff.removed) {
+      const symId = symNodeId(filePath, removed.name);
+      patch.addEdge(commitId, symId, "removes");
+      patch.removeEdge(fileId, symId, "contains");
+      patch.removeNode(symId);
+    }
+
+    // Recurse into changed children that have their own childDiffs
+    applyChildDiffs(patch, filePath, fileId, commitId, [...entry.childDiff.changed], jumpLookup);
+
+    for (const child of entry.childDiff.changed) {
+      const symId = symNodeId(filePath, child.name);
+      patch.setProperty(symId, "kind", child.kind);
+      if (child.signature !== undefined) {
+        patch.setProperty(symId, "signature", child.signature);
+      }
+      patch.addEdge(commitId, symId, "changes");
+    }
+  }
+}
+
+async function prepareChange(
+  gitClient: GitClient,
+  cwd: string,
+  sha: string,
+  parentRef: string,
+  parentExists: boolean,
+  change: { status: string; path: string },
+): Promise<PreparedChange> {
+  const filePath = change.path;
+  const fileId = fileNodeId(filePath);
+  const lang = detectLang(filePath);
+
+  if (change.status === "D") {
+    let oldOutline: readonly OutlineEntry[] = [];
+    if (lang !== null && parentExists) {
+      const oldContent = await getFileAtRef(parentRef, filePath, { cwd, git: gitClient });
+      if (oldContent !== null) {
+        oldOutline = extractOutline(oldContent, lang).entries;
+      }
+    }
+    return {
+      status: change.status,
+      filePath,
+      fileId,
+      lang,
+      parentExists,
+      oldOutline,
+    };
+  }
+
+  if (lang === null) {
+    return {
+      status: change.status,
+      filePath,
+      fileId,
+      lang,
+      parentExists,
+      oldOutline: [],
+    };
+  }
+
+  const newContent = await getFileAtRef(sha, filePath, { cwd, git: gitClient });
+  if (newContent === null) {
+    return {
+      status: change.status,
+      filePath,
+      fileId,
+      lang,
+      parentExists,
+      oldOutline: [],
+    };
+  }
+
+  const newResult = extractOutline(newContent, lang);
+  const newOutline = newResult.entries;
+  const jumpLookup = buildJumpLookup(newResult.jumpTable ?? []);
+
+  if (change.status === "A" || !parentExists) {
+    return {
+      status: change.status,
+      filePath,
+      fileId,
+      lang,
+      parentExists,
+      oldOutline: [],
+      newOutline,
+      jumpLookup,
+    };
+  }
+
+  const oldContent = await getFileAtRef(parentRef, filePath, { cwd, git: gitClient });
+  if (oldContent === null) {
+    return {
+      status: change.status,
+      filePath,
+      fileId,
+      lang,
+      parentExists,
+      oldOutline: [],
+      newOutline,
+      jumpLookup,
+    };
+  }
+
+  const oldOutline = extractOutline(oldContent, lang).entries;
+  return {
+    status: change.status,
+    filePath,
+    fileId,
+    lang,
+    parentExists,
+    oldOutline,
+    newOutline,
+    jumpLookup,
+    diff: diffOutlines(oldOutline, newOutline),
+  };
+}
+
+/**
+ * Index a range of commits into the WARP graph.
+ */
+export async function indexCommits(
+  warp: WarpApp,
+  options: IndexOptions,
+): Promise<IndexResult> {
+  const { cwd, git: gitClient } = options;
+  const commits = await listCommits(gitClient, cwd, options.from, options.to);
+
+  let patchesWritten = 0;
+  const commitTicks = new Map<string, number>();
+
+  for (const sha of commits) {
+    const changes = await getCommitChanges(gitClient, sha, cwd);
+
+    // Only materialize when removals are possible (D or M status).
+    // Materialization is expensive — O(n) replay of all prior patches.
+    // Add-only commits (A status) and no-change commits don't need it.
+    const hasRemovals = changes.some((c) => c.status === "D" || c.status === "M");
+    if (hasRemovals) {
+      await warp.core().materialize();
+    }
+
+    const meta = await getCommitMeta(gitClient, sha, cwd);
+    const parentExists = await hasParent(gitClient, sha, cwd);
+    const parentRef = `${sha}~1`;
+    const preparedChanges = await Promise.all(changes.map((change) =>
+      prepareChange(gitClient, cwd, sha, parentRef, parentExists, change)
+    ));
+
+    await warp.patch((p) => {
+      const patch = p as unknown as PatchOps;
+
+      const commitId = `commit:${sha}`;
+      patch.addNode(commitId);
+      patch.setProperty(commitId, "sha", sha);
+      patch.setProperty(commitId, "message", meta.message);
+      patch.setProperty(commitId, "author", meta.author);
+      patch.setProperty(commitId, "email", meta.email);
+      patch.setProperty(commitId, "timestamp", meta.timestamp);
+
+      for (const change of preparedChanges) {
+        if (change.status === "D") {
+          if (change.lang !== null) {
+            removeSymbols(patch, change.filePath, change.oldOutline);
+          }
+          patch.removeNode(change.fileId);
+          continue;
+        }
+
+        // Added or modified — ensure file + directory nodes exist
+        patch.addNode(change.fileId);
+        patch.setProperty(change.fileId, "path", change.filePath);
+        patch.setProperty(change.fileId, "lang", change.lang ?? "unknown");
+        patch.addEdge(commitId, change.fileId, "touches");
+        emitDirectoryChain(patch, change.filePath);
+
+        if (change.lang === null || change.newOutline === undefined || change.jumpLookup === undefined) continue;
+
+        if (change.status === "A" || !change.parentExists || change.diff === undefined) {
+          // New file or root commit — emit all symbols
+          emitSymbols(patch, change.filePath, change.newOutline, change.jumpLookup);
+        } else {
+          const diff = change.diff;
+
+          // Remove deleted symbols
+          for (const removed of diff.removed) {
+            const symId = symNodeId(change.filePath, removed.name);
+            patch.addEdge(commitId, symId, "removes");
+            removeDiffSymbols(patch, change.filePath, change.fileId, [removed]);
+          }
+
+          // Add new symbols (preserve actual exported status)
+          for (const added of diff.added) {
+            const symId = symNodeId(change.filePath, added.name);
+            patch.addNode(symId);
+            patch.setProperty(symId, "name", added.name);
+            patch.setProperty(symId, "kind", added.kind);
+            // DiffEntry doesn't carry exported — default false for safety.
+            // Full exported status comes from emitSymbols on initial add.
+            patch.setProperty(symId, "exported", false);
+            if (added.signature !== undefined) {
+              patch.setProperty(symId, "signature", added.signature);
+            }
+            const jump = change.jumpLookup.get(added.name);
+            if (jump !== undefined) {
+              patch.setProperty(symId, "startLine", jump.start);
+              patch.setProperty(symId, "endLine", jump.end);
+            }
+            patch.addEdge(change.fileId, symId, "contains");
+            patch.addEdge(commitId, symId, "adds");
+          }
+
+          // Update changed symbols
+          for (const changed of diff.changed) {
+            const symId = symNodeId(change.filePath, changed.name);
+            patch.setProperty(symId, "kind", changed.kind);
+            if (changed.signature !== undefined) {
+              patch.setProperty(symId, "signature", changed.signature);
+            }
+            patch.addEdge(commitId, symId, "changes");
+          }
+
+          // Apply nested child diffs (methods in classes)
+          applyChildDiffs(
+            patch,
+            change.filePath,
+            change.fileId,
+            commitId,
+            [...diff.changed],
+            change.jumpLookup,
+          );
+        }
+      }
+    });
+    patchesWritten++;
+    commitTicks.set(sha, patchesWritten);
+  }
+
+  return { commitsIndexed: commits.length, patchesWritten, commitTicks };
+}