@guanlin4924/devflow-pi 0.1.15 → 0.1.17

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/runtime_context_collector.rb

@@ -0,0 +1,210 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Repository-declared runtime context collector (P0).
+# It reads manifest content from one immutable Git revision rather than the
+# working tree, so every inventory entry and every absence claim is replayable.
+require "digest"
+require "json"
+require "open3"
+require "optparse"
+require "rexml/document"
+require "rexml/xpath"
+require_relative "control_io"
+
+module RuntimeContextCollector
+  SCHEMA_VERSION = 1
+  HISTORY_DIR = File.join(".context", "runtime-context", "revisions")
+  POINTER = File.join(".context", "runtime-context.json")
+  EXTRACTORS = {
+    "package.json" => :extract_package_json,
+    "requirements.txt" => :extract_requirements_txt,
+    "pom.xml" => :extract_pom_xml
+  }.freeze
+  EXCLUDED_ROOTS = %w[node_modules vendor dist build .git].freeze
+
+  module_function
+
+  def safe_version(value)
+    text = value.to_s.strip
+    # A dependency version is useful evidence, but a direct URL can carry an
+    # access token. P0 does not consume versions, so redact unsafe forms.
+    return nil if text.empty? || text.match?(%r{[:/@]})
+
+    text
+  end
+
+  def extract_package_json(content)
+    parsed = JSON.parse(content)
+    deps = parsed["dependencies"].is_a?(Hash) ? parsed["dependencies"] : {}
+    deps.map { |name, version| { "subject" => name.to_s.downcase.strip, "version" => safe_version(version) } }
+  rescue JSON::ParserError
+    raise "parse_error"
+  end
+
+  def extract_requirements_txt(content)
+    content.lines.map(&:strip).reject { |line| line.empty? || line.start_with?("#", "-e", "--", "-r", "-f") }.map do |line|
+      name = line.split(/[<>=!\[\s]/, 2).first.to_s.downcase.strip
+      version = line.match(/\A[^<>=!\[\s]+\s*(?:==|>=|<=|~=|>|<)\s*([^\s;]+)\z/)&.[](1)
+      { "subject" => name, "version" => safe_version(version) }
+    end
+  end
+
+  def extract_pom_xml(content)
+    document = REXML::Document.new(content)
+    REXML::XPath.match(document, "//dependency").map do |dependency|
+      group = dependency.elements["groupId"]&.text.to_s.strip
+      artifact = dependency.elements["artifactId"]&.text.to_s.strip
+      next if group.empty? || artifact.empty?
+
+      { "subject" => "#{group}:#{artifact}".downcase, "version" => safe_version(dependency.elements["version"]&.text) }
+    end.compact
+  rescue REXML::ParseException
+    raise "parse_error"
+  end
+
+  def git_capture(root, *args)
+    stdout, stderr, status = Open3.capture3("git", "-C", root, *args)
+    [stdout, stderr, status.success?]
+  end
+
+  def git_revision(root)
+    output, _error, success = git_capture(root, "rev-parse", "HEAD")
+    success ? output.strip : ""
+  end
+
+  def excluded_path?(path)
+    path.split("/").any? { |segment| EXCLUDED_ROOTS.include?(segment) }
+  end
+
+  def git_file_list(root, revision)
+    output, error, success = git_capture(root, "ls-tree", "-r", "--name-only", revision)
+    raise "git_tree_unavailable: #{error.strip}" unless success
+
+    supported = output.lines.map(&:strip).select { |path| EXTRACTORS.key?(File.basename(path)) }.sort
+    included, excluded = supported.partition { |path| !excluded_path?(path) }
+    [included, excluded]
+  end
+
+  def git_file_content(root, revision, path)
+    output, error, success = git_capture(root, "show", "#{revision}:#{path}")
+    raise "git_show_failed: #{error.strip}" unless success
+
+    output
+  end
+
+  # Enumerates every supported manifest in the committed tree. Files not
+  # matching the explicit P0 allowlist are outside the declared collector
+  # scope; every matching file has a scanned or failed entry.
+  def discover_and_extract(root, revision)
+    files = []
+    inventory = {}
+    paths, excluded_paths = git_file_list(root, revision)
+    excluded_paths.each do |path|
+      files << { "path" => path, "status" => "excluded", "reason" => "third_party_or_build_output" }
+    end
+    paths.each do |path|
+      extractor = EXTRACTORS.fetch(File.basename(path))
+      begin
+        content = git_file_content(root, revision, path)
+        entries = send(extractor, content)
+        evidence = {
+          "path" => path,
+          "git_revision" => revision,
+          "sha256" => Digest::SHA256.hexdigest(content),
+          "extractor" => extractor.to_s
+        }
+        entries.each do |entry|
+          subject = entry["subject"].to_s.downcase.strip
+          next if subject.empty?
+
+          inventory[subject] ||= {
+            "kind" => "runtime_dep", "subject" => subject,
+            "version" => entry["version"], "evidence" => evidence
+          }
+        end
+        files << { "path" => path, "status" => "scanned" }
+      rescue StandardError => error
+        files << { "path" => path, "status" => "failed", "error" => error.message }
+      end
+    end
+    [files, inventory.values]
+  rescue StandardError => error
+    [[{ "path" => "<repository>", "status" => "failed", "error" => error.message }], []]
+  end
+
+  def current_revision(root)
+    pointer = File.join(root, POINTER)
+    return 0 unless File.exist?(pointer)
+
+    JSON.parse(File.read(pointer))["current_revision"].to_i
+  rescue JSON::ParserError
+    raise ArgumentError, "runtime-context pointer is invalid JSON: #{pointer}"
+  end
+
+  def collect(root)
+    repository_revision = git_revision(root)
+    files, inventory =
+      if repository_revision.empty?
+        [[{ "path" => "<repository>", "status" => "failed", "error" => "git_revision_unavailable" }], []]
+      else
+        discover_and_extract(root, repository_revision)
+      end
+    coverage_status = files.any? { |file| file["status"] == "failed" } ? "incomplete" : "complete"
+    revision = current_revision(root) + 1
+    snapshot = {
+      "schema_version" => SCHEMA_VERSION,
+      "context_id" => "repo-default",
+      "snapshot_revision" => revision,
+      "scope" => "repository-default:package.json|requirements.txt|pom.xml",
+      "repository_revision" => repository_revision,
+      "discovery_hash" => Digest::SHA256.hexdigest(JSON.generate(files)),
+      "collector" => {
+        "version" => "git-manifest-allowlist-v1",
+        "discovery" => { "rules" => EXTRACTORS.keys.sort, "files" => files }
+      },
+      "inventory_hash" => Digest::SHA256.hexdigest(JSON.generate(inventory)),
+      "coverage_status" => coverage_status,
+      "inventory" => inventory
+    }
+    history = File.join(root, HISTORY_DIR, "#{revision}.json")
+    DevflowControlIO.atomic_create(history, JSON.pretty_generate(snapshot) + "\n")
+    DevflowControlIO.atomic_write(File.join(root, POINTER), JSON.pretty_generate({ "current_revision" => revision, "path" => history.sub("#{root}/", "") }) + "\n")
+    DevflowControlIO.append_audit(File.join(root, ".context", "runtime-context", "audit.jsonl"), {
+      "event" => "snapshot_collected", "snapshot_revision" => revision,
+      "repository_revision" => repository_revision, "coverage_status" => coverage_status
+    })
+    DevflowControlIO.register_control_artifact(root, {
+      "path" => history.sub("#{root}/", ""), "type" => "runtime_context_snapshot",
+      "produced_by" => "core", "snapshot_revision" => revision,
+      "coverage_status" => coverage_status, "repository_revision" => repository_revision
+    })
+    snapshot
+  end
+end
+
+if __FILE__ == $PROGRAM_NAME
+  options = { json: false }
+  command = ARGV.shift
+  OptionParser.new do |o|
+    o.on("--json") { options[:json] = true }
+  end.parse!
+  root = Dir.pwd
+  lock = command == "collect" ? DevflowControlIO.acquire_project_lock(root) : nil
+  begin
+    raise ArgumentError, "command must be collect or inspect" unless %w[collect inspect].include?(command)
+    result =
+      if command == "collect"
+        snapshot = RuntimeContextCollector.collect(root)
+        { "ok" => true, "snapshot_revision" => snapshot["snapshot_revision"], "coverage_status" => snapshot["coverage_status"], "inventory_count" => snapshot["inventory"].length, "repository_revision" => snapshot["repository_revision"] }
+      else
+        pointer = File.join(root, RuntimeContextCollector::POINTER)
+        { "ok" => true, "current_revision" => RuntimeContextCollector.current_revision(root), "pointer_exists" => File.exist?(pointer) }
+      end
+  rescue StandardError => error
+    result = { "ok" => false, "reason" => "runtime_context_collector_failed", "message" => error.message }
+  ensure
+    DevflowControlIO.release_lock(lock)
+  end
+  puts JSON.pretty_generate(result)
+end

package/plugins/devflow-core/skills/workflow-orchestrator/scripts/stale_check.rb

@@ -0,0 +1,56 @@
+#!/usr/bin/env ruby
+# frozen_string_literal: true
+
+# Field-level staleness check (P1). A downstream consumer pins the exact
+# evidence paths it consumed plus the snapshot revision it read; this checker
+# compares evidence sha256 across revisions and reports only the changed
+# paths — not a whole-snapshot invalidation.
+require "json"
+require "optparse"
+require_relative "runtime_context_collector"
+
+module StaleCheck
+  module_function
+
+  def evidence_map(snapshot)
+    map = {}
+    Array(snapshot["inventory"]).each do |item|
+      evidence = item["evidence"]
+      next unless evidence.is_a?(Hash) && evidence["path"]
+      map[evidence["path"]] = evidence["sha256"]
+    end
+    map
+  end
+
+  def changed_paths(old_snapshot, new_snapshot, evidence_paths)
+    old_map = evidence_map(old_snapshot)
+    new_map = evidence_map(new_snapshot)
+    Array(evidence_paths).select { |path| old_map[path] != new_map[path] }
+  end
+end
+
+if __FILE__ == $PROGRAM_NAME
+  options = { consumed_revision: nil, evidence_paths: nil }
+  command = ARGV.shift
+  OptionParser.new do |o|
+    o.on("--consumed-revision N", Integer) { |v| options[:consumed_revision] = v }
+    o.on("--evidence-paths JSON") { |v| options[:evidence_paths] = v }
+    o.on("--json") { options[:json] = true }
+  end.parse!
+  root = Dir.pwd
+  begin
+    raise ArgumentError, "command must be check" unless command == "check"
+    raise ArgumentError, "--consumed-revision is required" if options[:consumed_revision].nil?
+    current = RuntimeContextCollector.current_revision(root)
+    old_path = File.join(root, RuntimeContextCollector::HISTORY_DIR, "#{options[:consumed_revision]}.json")
+    new_path = File.join(root, RuntimeContextCollector::HISTORY_DIR, "#{current}.json")
+    raise ArgumentError, "consumed snapshot not found" unless File.exist?(old_path)
+    old = JSON.parse(File.read(old_path))
+    new = JSON.parse(File.read(new_path))
+    paths = JSON.parse(options[:evidence_paths].to_s)
+    changed = StaleCheck.changed_paths(old, new, paths)
+    { "ok" => true, "consumed_revision" => options[:consumed_revision], "current_revision" => current, "changed_paths" => changed }
+  rescue StandardError => error
+    { "ok" => false, "reason" => "stale_check_failed", "message" => error.message }
+  end.tap { |r| puts JSON.pretty_generate(r) }
+end