@haystackeditor/cli 0.25.1 → 0.26.0

package/dist/commands/system-map.js

@@ -1,228 +0,0 @@
-/**
- * `haystack system-map validate` — instant feedback on `.haystack/system.yml`.
- *
- * The system map holds customer-declared facts about how their system WORKS
- * (build, boot, seed, log in, observe) so Haystack QA can run it. It never
- * selects tests — Haystack decides what to test from each PR's diff. The
- * `/map-your-system` skill authors the file; this command lets a user (or
- * their coding agent) check it before committing, instead of waiting for the
- * next QA run to reject it.
- *
- * Source-of-truth note: the QA pipeline's own loader for this file
- * (`analysis/src/agents/systemMap.ts`) lives on the incoming QA-replay
- * subsystem branch and is NOT on main yet — until it lands, this command is
- * the only validator of the format, and its rules were copied verbatim from
- * that loader. Once the subsystem merges, the analysis-side loader becomes
- * the source of truth (it is a separate deployable the CLI cannot import),
- * and rule changes must update both in the same PR.
- */
-import { existsSync, readFileSync } from 'node:fs';
-import { join } from 'node:path';
-import chalk from 'chalk';
-import { parse as parseYaml } from 'yaml';
-import { findGitRoot } from '../utils/hooks.js';
-const SYSTEM_MAP_RELATIVE_PATHS = ['.haystack/system.yml', '.haystack/system.yaml'];
-/**
- * Keys whose presence means the file is steering test selection rather than
- * describing the system. Rejected structurally so the "facts in, never test
- * selection in" rule cannot erode.
- */
-const TEST_SELECTION_KEYS = new Set([
-    'scenarios', 'tests', 'tests_to_run', 'run_tests', 'skip', 'skip_tests',
-    'focus', 'only', 'exclude', 'test_plan', 'experiments',
-]);
-/** Values that look like credentials rather than references to them. */
-const SECRET_VALUE_RES = [
-    { name: 'AWS access key', re: /AKIA[0-9A-Z]{16}/ },
-    { name: 'GitHub token', re: /gh[pousr]_[A-Za-z0-9]{36,}/ },
-    { name: 'API key', re: /sk-[A-Za-z0-9_-]{24,}/ },
-    { name: 'private key block', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----/ },
-    { name: 'password-like assignment', re: /(password|passwd|secret)\s*[:=]\s*\S{8,}/i },
-];
-export function validateSystemMapText(rawYaml) {
-    const issues = [];
-    let doc;
-    try {
-        doc = parseYaml(rawYaml);
-    }
-    catch (error) {
-        return {
-            issues: [{ severity: 'error', path: '(root)', message: `YAML parse error: ${error.message}` }],
-            summary: null,
-        };
-    }
-    if (!doc || typeof doc !== 'object' || Array.isArray(doc)) {
-        return {
-            issues: [{ severity: 'error', path: '(root)', message: 'System map must be a mapping' }],
-            summary: null,
-        };
-    }
-    const root = doc;
-    if (root.version !== 1 && root.version !== '1') {
-        issues.push({ severity: 'error', path: 'version', message: 'version must be 1' });
-    }
-    for (const key of Object.keys(root)) {
-        if (TEST_SELECTION_KEYS.has(key)) {
-            issues.push({
-                severity: 'error',
-                path: key,
-                message: `"${key}" steers test selection — the system map may only describe how the system works. Haystack decides what to test from the diff.`,
-            });
-        }
-    }
-    scanForSecrets(root, '(root)', issues);
-    validateCommands(root, issues);
-    if (issues.some((issue) => issue.severity === 'error')) {
-        return { issues, summary: null };
-    }
-    return { issues, summary: summarize(root) };
-}
-function scanForSecrets(value, atPath, issues) {
-    if (typeof value === 'string') {
-        for (const { name, re } of SECRET_VALUE_RES) {
-            if (re.test(value)) {
-                issues.push({
-                    severity: 'error',
-                    path: atPath,
-                    message: `Value looks like a ${name}. Facts must reference env var NAMES; secret values are injected out-of-band.`,
-                });
-            }
-        }
-        return;
-    }
-    if (Array.isArray(value)) {
-        value.forEach((entry, index) => scanForSecrets(entry, `${atPath}[${index}]`, issues));
-        return;
-    }
-    if (value && typeof value === 'object') {
-        for (const [key, entry] of Object.entries(value)) {
-            scanForSecrets(entry, atPath === '(root)' ? key : `${atPath}.${key}`, issues);
-        }
-    }
-}
-function validateCommands(root, issues) {
-    const requireString = (value, atPath) => {
-        if (typeof value !== 'string' || value.trim().length === 0) {
-            issues.push({ severity: 'error', path: atPath, message: 'must be a non-empty string command' });
-        }
-    };
-    const env = root.environment;
-    if (env?.setup !== undefined) {
-        if (!Array.isArray(env.setup)) {
-            issues.push({ severity: 'error', path: 'environment.setup', message: 'must be a list of { run } steps' });
-        }
-        else {
-            env.setup.forEach((step, index) => requireString(step?.run, `environment.setup[${index}].run`));
-        }
-    }
-    // Not in the QA loader's checks (yet): a scalar here would silently compile
-    // into per-character garbage via Object.entries — reject it as malformed.
-    if (env?.toolchain !== undefined && !isPlainObject(env.toolchain)) {
-        issues.push({
-            severity: 'error',
-            path: 'environment.toolchain',
-            message: 'must be a mapping of tool name → version (e.g. { node: "22" })',
-        });
-    }
-    const services = root.services;
-    for (const [name, service] of Object.entries(services ?? {})) {
-        requireString(service?.boot, `services.${name}.boot`);
-    }
-    const personas = root.data?.personas;
-    for (const [name, persona] of Object.entries(personas ?? {})) {
-        requireString(persona?.login, `data.personas.${name}.login`);
-    }
-    const artifacts = root.artifacts;
-    for (const [name, artifact] of Object.entries(artifacts ?? {})) {
-        const decl = artifact;
-        if (decl?.kind !== 'container-image') {
-            issues.push({
-                severity: 'error',
-                path: `artifacts.${name}.kind`,
-                message: 'must be "container-image" (the only artifact kind supported today)',
-            });
-        }
-        requireString(decl?.reference, `artifacts.${name}.reference`);
-        if (decl?.boot !== undefined) {
-            if (!Array.isArray(decl.boot)) {
-                issues.push({ severity: 'error', path: `artifacts.${name}.boot`, message: 'must be a list of { name } boot modes' });
-            }
-            else {
-                decl.boot.forEach((mode, index) => requireString(mode?.name, `artifacts.${name}.boot[${index}].name`));
-            }
-        }
-    }
-}
-function isPlainObject(value) {
-    return typeof value === 'object' && value !== null && !Array.isArray(value);
-}
-function summarize(root) {
-    const env = (root.environment ?? {});
-    const data = (root.data ?? {});
-    const observability = (root.observability ?? {});
-    const testing = (root.testing ?? {});
-    return {
-        setup_steps: Array.isArray(env.setup) ? env.setup.length : 0,
-        toolchain_entries: isPlainObject(env.toolchain) ? Object.keys(env.toolchain).length : 0,
-        services: Object.keys((root.services ?? {})),
-        personas: Object.keys(data.personas ?? {}),
-        data_commands: (data.seed ? 1 : 0) + (data.reset ? 1 : 0),
-        observability_entries: (Array.isArray(observability.logs) ? observability.logs.length : 0) + (observability.inspect_db ? 1 : 0),
-        external_services: Object.keys((root.external_services ?? {})),
-        testing_entries: Object.keys(testing).length,
-        constraints: Array.isArray(root.constraints) ? root.constraints.length : 0,
-        artifacts: Object.keys((root.artifacts ?? {})),
-    };
-}
-export async function systemMapValidateCommand(options) {
-    const root = findGitRoot() ?? process.cwd();
-    const relativePath = SYSTEM_MAP_RELATIVE_PATHS.find((candidate) => existsSync(join(root, candidate)));
-    if (!relativePath) {
-        if (options.json) {
-            console.log(JSON.stringify({ status: 'missing', path: SYSTEM_MAP_RELATIVE_PATHS[0], issues: [] }, null, 2));
-        }
-        else {
-            console.error(chalk.red(`No system map found at ${SYSTEM_MAP_RELATIVE_PATHS[0]}.`) +
-                ' Run the /map-your-system skill in your coding agent (installed via `haystack skills install`) to create one.');
-        }
-        process.exit(1);
-    }
-    const { issues, summary } = validateSystemMapText(readFileSync(join(root, relativePath), 'utf-8'));
-    const ok = summary !== null;
-    if (options.json) {
-        console.log(JSON.stringify({ status: ok ? 'valid' : 'invalid', path: relativePath, issues, summary }, null, 2));
-    }
-    else {
-        for (const issue of issues) {
-            const bullet = issue.severity === 'error' ? chalk.red('✗') : chalk.yellow('•');
-            console.log(`${bullet} ${chalk.white(issue.path)}: ${issue.message}`);
-        }
-        if (!ok) {
-            console.log();
-            console.log(chalk.red(`${relativePath} is invalid — fix the errors above.`));
-        }
-        else {
-            const declared = [];
-            if (summary.setup_steps)
-                declared.push(`${summary.setup_steps} setup step(s)`);
-            if (summary.services.length)
-                declared.push(`services: ${summary.services.join(', ')}`);
-            if (summary.personas.length)
-                declared.push(`personas: ${summary.personas.join(', ')}`);
-            if (summary.data_commands)
-                declared.push(`${summary.data_commands} data command(s)`);
-            if (summary.external_services.length)
-                declared.push(`external: ${summary.external_services.join(', ')}`);
-            if (summary.artifacts.length)
-                declared.push(`artifacts: ${summary.artifacts.join(', ')}`);
-            if (summary.testing_entries)
-                declared.push('testing');
-            if (summary.constraints)
-                declared.push(`${summary.constraints} constraint(s)`);
-            console.log(chalk.green(`✓ ${relativePath} is valid`) + (declared.length ? chalk.dim(` — ${declared.join('; ')}`) : ''));
-            console.log(chalk.dim('When Haystack QA runs on this repo, each entry is treated as a declared fact and checked against run receipts.'));
-        }
-    }
-    if (!ok)
-        process.exit(1);
-}