@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/cloud-verifier-data-store-drift.js

@@ -1,158 +0,0 @@
-/**
- * Data-store drift check.
- *
- * A checked-in universe map lists the stores the Cloud Verifier clones. As the
- * app changes, that map silently goes stale — a new Redis nobody added to the
- * map, or a Mongo the code dropped — and a stale map makes the verifier clone
- * the wrong things. The static detector is a pure function of the repo, so the
- * only moment repo-derived drift can enter is a change to a file the detector
- * reads. This command catches that at the source: re-detect the stores, diff
- * against the checked-in baseline, and flag the delta.
- *
- * It is built to run per-PR and cost almost nothing: given a base ref, it first
- * checks whether the diff touches any file the detector reads (the exact gate —
- * nothing else can change the result) and exits immediately if not.
- */
-import { execFileSync } from 'node:child_process';
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
-import { basename, dirname, resolve } from 'node:path';
-import { findGitRoot } from '../utils/hooks.js';
-import { collectDataStores, isDataStoreInputName } from './cloud-verifier-identity-census.js';
-export const DATA_STORE_BASELINE_PATH = '.haystack/cloud-verifier/data-stores.json';
-export const DATA_STORE_BASELINE_SCHEMA = 'cloud-verifier-data-stores-v1';
-function snapshot(store) {
-    return {
-        engine: store.engine,
-        category: store.category,
-        confidence: store.confidence,
-        clone_strategy: store.clone_strategy,
-    };
-}
-/** Diff two store lists by engine. Pure and order-independent. */
-export function diffDataStores(baseline, current) {
-    const baseByEngine = new Map(baseline.map((store) => [store.engine, store]));
-    const currentByEngine = new Map(current.map((store) => [store.engine, store]));
-    const added = current.filter((store) => !baseByEngine.has(store.engine));
-    const removed = baseline.filter((store) => !currentByEngine.has(store.engine));
-    const changed = [];
-    for (const store of current) {
-        const before = baseByEngine.get(store.engine);
-        if (before && (before.confidence !== store.confidence || before.category !== store.category)) {
-            changed.push({
-                engine: store.engine,
-                from: `${before.category}/${before.confidence}`,
-                to: `${store.category}/${store.confidence}`,
-            });
-        }
-    }
-    return { added, removed, changed };
-}
-export function hasDrift(drift) {
-    return drift.added.length > 0 || drift.removed.length > 0 || drift.changed.length > 0;
-}
-function gitTrackedFiles(root) {
-    return execFileSync('git', ['-C', root, 'ls-files', '-z'], { encoding: 'utf8', maxBuffer: 256 * 1024 * 1024 })
-        .split('\0')
-        .filter(Boolean);
-}
-// Files changed between a base ref and HEAD. Returns null if git cannot resolve
-// the ref (e.g. a shallow clone missing the base) so the caller can fall back to
-// a full check rather than a false "no store changes" skip.
-function changedFiles(root, baseRef) {
-    try {
-        const range = `${baseRef}...HEAD`;
-        // --no-renames so a rename shows both the removed and added path. Otherwise
-        // renaming an input file to a non-input name (docker-compose.yml -> .bak)
-        // would report only the irrelevant destination and the gate would wrongly
-        // skip a change that actually dropped a store.
-        return execFileSync('git', ['-C', root, 'diff', '--name-only', '--no-renames', range], { encoding: 'utf8', maxBuffer: 64 * 1024 * 1024 })
-            .split('\n')
-            .filter(Boolean);
-    }
-    catch {
-        return null;
-    }
-}
-function currentStores(root) {
-    return collectDataStores(root, gitTrackedFiles(root)).map(snapshot);
-}
-function readBaseline(path) {
-    const parsed = JSON.parse(readFileSync(path, 'utf8'));
-    if (parsed.schema !== DATA_STORE_BASELINE_SCHEMA || !Array.isArray(parsed.stores)) {
-        throw new Error(`Not a data-store baseline (${DATA_STORE_BASELINE_SCHEMA}): ${path}`);
-    }
-    return parsed.stores;
-}
-function writeBaseline(path, stores) {
-    mkdirSync(dirname(path), { recursive: true });
-    writeFileSync(path, `${JSON.stringify({ schema: DATA_STORE_BASELINE_SCHEMA, stores }, null, 2)}\n`);
-}
-function emit(payload, json) {
-    if (json) {
-        process.stdout.write(`${JSON.stringify({ schema: 'cloud-verifier-data-store-drift-v1', ...payload }, null, 2)}\n`);
-    }
-}
-export function cloudVerifierDataStoreDriftCommand(options) {
-    const root = options.root ? resolve(options.root) : (findGitRoot() ?? process.cwd());
-    // resolve (not join) so an absolute --baseline is honored as-is and a relative
-    // one resolves against the repo root.
-    const baselinePath = resolve(root, options.baseline ?? DATA_STORE_BASELINE_PATH);
-    // Path gate: with a base ref, skip unless the diff touches a file the detector
-    // reads. This is exact — a file outside that set cannot change the stores.
-    if (options.baseRef && !options.update) {
-        const changed = changedFiles(root, options.baseRef);
-        if (changed !== null) {
-            const relevant = changed.filter((path) => isDataStoreInputName(basename(path).toLowerCase()));
-            if (relevant.length === 0) {
-                emit({ status: 'skipped', reason: 'no-store-relevant-changes', changed_files: changed.length }, options.json ?? false);
-                if (!options.json) {
-                    process.stdout.write('Data-store drift: no store-relevant files changed — skipped.\n');
-                }
-                return;
-            }
-        }
-    }
-    const current = currentStores(root);
-    if (options.update) {
-        writeBaseline(baselinePath, current);
-        emit({ status: 'updated', baseline: options.baseline ?? DATA_STORE_BASELINE_PATH, stores: current }, options.json ?? false);
-        if (!options.json) {
-            process.stdout.write(`Data-store baseline written: ${current.length} stores → ${options.baseline ?? DATA_STORE_BASELINE_PATH}\n`);
-        }
-        return;
-    }
-    if (!existsSync(baselinePath)) {
-        // Not opted in yet: a safe no-op so the check can be added to CI broadly
-        // without breaking repos that have not created a baseline.
-        emit({ status: 'no-baseline', baseline: options.baseline ?? DATA_STORE_BASELINE_PATH }, options.json ?? false);
-        if (!options.json) {
-            process.stdout.write(`Data-store drift: no baseline at ${options.baseline ?? DATA_STORE_BASELINE_PATH}. `
-                + 'Create one with `--update`.\n');
-        }
-        return;
-    }
-    const drift = diffDataStores(readBaseline(baselinePath), current);
-    if (!hasDrift(drift)) {
-        emit({ status: 'ok', stores: current.length }, options.json ?? false);
-        if (!options.json) {
-            process.stdout.write(`Data-store drift: none — map matches ${current.length} detected stores.\n`);
-        }
-        return;
-    }
-    emit({ status: 'drift', drift }, options.json ?? false);
-    if (!options.json) {
-        process.stdout.write('Data-store drift detected — the universe map is out of date:\n');
-        for (const store of drift.added) {
-            process.stdout.write(`  + ${store.engine} (${store.category}, ${store.confidence}) — detected, not in the map\n`);
-        }
-        for (const store of drift.removed) {
-            process.stdout.write(`  - ${store.engine} (${store.category}) — in the map, no longer detected\n`);
-        }
-        for (const change of drift.changed) {
-            process.stdout.write(`  ~ ${change.engine}: ${change.from} → ${change.to}\n`);
-        }
-        process.stdout.write('Sync the map with `--update`, or update the universe map to match.\n');
-    }
-    // Non-zero exit so a CI gate fails until the map is reconciled.
-    process.exitCode = 1;
-}