@heretek-ai/epistemic-swarm 0.7.23 → 0.7.25

package/plugins/antigravity/hook_bus_bridge.js

@@ -0,0 +1,352 @@
+/**
+ * Antigravity Hook Bus & Quality Gates Bridge.
+ *
+ * Connects Antigravity's lifecycle events (PreToolUse, PostToolUse, PreInvocation, Stop)
+ * to IUMBTEMS's 6-event Hook Bus and the three automated Quality Gates:
+ * 1. Analysis Bridge (Biome CLI static analysis for JS/TS)
+ * 2. Dependency Health Gate (OSV.dev vulnerability & freshness scanner)
+ * 3. Weight Signals (esbuild bundle weight & coverage deltas vs baseline)
+ *
+ * Also provides:
+ * - Pre-commit gating on .research/config.json with optimistic concurrency (expected_hash)
+ * - Session context & compaction preservation (buildCompactionContext)
+ * - Living dossier claim degradation stop-gating
+ *
+ * Contract:
+ * - Zero runtime dependencies; node builtins only.
+ * - Fail-open: internal errors log and allow, never throwing into host.
+ */
+
+import {
+  createHookBus,
+  gatePreCommit,
+  FAST_TIMEOUT_MS,
+  SLOW_TIMEOUT_MS,
+  normalizeVerdictEx,
+} from '../opencode/hook-bus.js';
+import { registerAnalysisBridge } from '../opencode/analysis-bridge.js';
+import { registerDepHealth } from '../opencode/dep-health.js';
+import { registerWeightSignals } from '../opencode/weight-signals.js';
+import { buildCompactionContext, readLedgerDegraded } from '../opencode/index.js';
+import { loadConfig, validateConfig } from '../opencode/config-io.js';
+import { existsSync, readFileSync, appendFileSync, writeFileSync, unlinkSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const PROJECT_ROOT = path.resolve(__dirname, '../..');
+
+export function resolveWorkspaceRoot(payload = {}) {
+  const ws = payload.workspacePaths || [];
+  if (Array.isArray(ws) && ws.length > 0 && ws[0]) {
+    return path.resolve(ws[0]);
+  }
+  if (payload.workspaceRoot) {
+    return path.resolve(payload.workspaceRoot);
+  }
+  if (process.env.IUMBTEMS_WORKSPACE) {
+    return path.resolve(process.env.IUMBTEMS_WORKSPACE);
+  }
+  if (process.env.IUMBTEMS_ROOT) {
+    return path.resolve(process.env.IUMBTEMS_ROOT);
+  }
+  let curr = path.resolve(process.cwd());
+  while (curr !== path.dirname(curr)) {
+    if (existsSync(path.join(curr, '.research')) || existsSync(path.join(curr, '.git'))) {
+      return curr;
+    }
+    curr = path.dirname(curr);
+  }
+  return path.resolve(process.cwd());
+}
+
+/**
+ * Instantiate a hook bus populated with all quality gate subscribers.
+ */
+export async function createConfiguredBus(root) {
+  const bus = createHookBus();
+  const mockHost = {
+    location: { directory: root },
+    session: {
+      hook: () => ({ dispose: () => {} }),
+      prompt: () => Promise.resolve(),
+    },
+  };
+
+  try {
+    await registerAnalysisBridge(mockHost, { bus, root });
+  } catch {
+    /* fail open */
+  }
+
+  try {
+    await registerDepHealth(mockHost, { bus, root });
+  } catch {
+    /* fail open */
+  }
+
+  try {
+    await registerWeightSignals(mockHost, { bus });
+  } catch {
+    /* fail open */
+  }
+
+  return bus;
+}
+
+/**
+ * Handle pre-tool-use:
+ * - Check pre-commit gating on .research/config.json
+ * - Emit pre-tool-use on the bus (Analysis Bridge)
+ */
+export async function handlePreTool(payload = {}) {
+  const root = resolveWorkspaceRoot(payload);
+  const toolCall = payload.toolCall || {};
+  const toolName = String(toolCall.name || '').toLowerCase();
+  const args = toolCall.args || {};
+
+  // Check if tool is attempting to edit .research/config.json
+  const targetFile = String(args.TargetFile || args.file || args.path || '');
+  const isConfigTarget =
+    targetFile.endsWith('.research/config.json') ||
+    targetFile === '.research/config.json' ||
+    (targetFile.includes('.research') && targetFile.includes('config.json'));
+
+  if (isConfigTarget && (toolName === 'write_to_file' || toolName === 'replace_file_content')) {
+    const bus = createHookBus();
+    const content = args.CodeContent || args.ReplacementContent || '';
+    let parsedUpdates = null;
+    try {
+      parsedUpdates = JSON.parse(content);
+    } catch {
+      // If content is not full JSON (e.g. replace_file_content chunk), attempt validation if possible
+    }
+
+    if (parsedUpdates && typeof parsedUpdates === 'object') {
+      const problems = validateConfig(parsedUpdates);
+      if (problems && problems.length > 0) {
+        return {
+          decision: 'deny',
+          allowed: false,
+          reason: `Pre-commit validation rejected .research/config.json update: ${problems.join('; ')}`,
+        };
+      }
+
+      const preCommitResult = await gatePreCommit(bus, {
+        updates: parsedUpdates,
+        root,
+        expected_hash: args.expected_hash || args.expectedHash || parsedUpdates.expected_hash || parsedUpdates.expectedHash,
+      });
+
+      if (!preCommitResult.allowed) {
+        return {
+          decision: 'deny',
+          allowed: false,
+          reason: `Pre-commit gate denied config write: ${preCommitResult.reason || 'optimistic concurrency or validation failure'}`,
+        };
+      }
+    }
+  }
+
+  const bus = await createConfiguredBus(root);
+  const busResult = await bus.emit('pre-tool-use', {
+    tool: toolName,
+    args,
+    sessionID: payload.conversationId,
+    targetFile,
+  });
+
+  if (!busResult.allowed) {
+    return {
+      decision: 'deny',
+      allowed: false,
+      reason: busResult.reason || 'Blocked by Hook Bus pre-tool-use policy',
+      annotations: busResult.annotations || [],
+    };
+  }
+
+  return {
+    decision: 'allow',
+    allowed: true,
+    annotations: busResult.annotations || [],
+  };
+}
+
+/**
+ * Handle post-tool-use:
+ * - Emit post-tool-use on the bus (triggers Analysis Bridge, Dep Health, Weight Signals)
+ * - Persist annotations to .research/quality_gates.jsonl
+ */
+export async function handlePostTool(payload = {}) {
+  const root = resolveWorkspaceRoot(payload);
+  const toolCall = payload.toolCall || {};
+  const toolName = String(toolCall.name || '').toLowerCase();
+  const args = toolCall.args || {};
+  const targetFile = String(args.TargetFile || args.file || args.path || '');
+
+  const bus = await createConfiguredBus(root);
+  const busResult = await bus.emit('post-tool-use', {
+    tool: toolName,
+    args,
+    result: payload.result,
+    error: payload.error,
+    sessionID: payload.conversationId,
+    targetFile,
+  });
+
+  const annotations = busResult.annotations || [];
+  if (annotations.length > 0) {
+    try {
+      const qgLog = path.join(root, '.research', 'quality_gates.jsonl');
+      const lines = annotations.map((a) =>
+        JSON.stringify({
+          at: new Date().toISOString(),
+          stepIdx: payload.stepIdx,
+          tool: toolName,
+          annotation: a,
+        })
+      );
+      appendFileSync(qgLog, lines.join('\n') + '\n', 'utf-8');
+    } catch {
+      /* ignore file log error */
+    }
+  }
+
+  return {
+    allowed: busResult.allowed !== false,
+    annotations,
+  };
+}
+
+/**
+ * Handle pre-invocation:
+ * - Return compaction context from buildCompactionContext
+ * - Collect and clear any pending quality gate annotations
+ */
+export async function handlePreInvocation(payload = {}) {
+  const root = resolveWorkspaceRoot(payload);
+  const compaction = buildCompactionContext(root);
+
+  let pendingAnnotations = [];
+  const qgLog = path.join(root, '.research', 'quality_gates.jsonl');
+  if (existsSync(qgLog)) {
+    try {
+      const content = readFileSync(qgLog, 'utf-8');
+      const lines = content.trim().split('\n').filter(Boolean);
+      for (const line of lines) {
+        try {
+          const entry = JSON.parse(line);
+          if (entry.annotation) {
+            pendingAnnotations.push(entry.annotation);
+          }
+        } catch {
+          /* ignore bad json line */
+        }
+      }
+      // Truncate the file so annotations are reported once
+      writeFileSync(qgLog, '', 'utf-8');
+    } catch {
+      /* fail open */
+    }
+  }
+
+  return {
+    compactionContext: compaction,
+    annotations: pendingAnnotations,
+  };
+}
+
+/**
+ * Handle stop:
+ * - Emit stop on the bus
+ * - Check degraded claims in .research/ledger/claim_status.json
+ */
+export async function handleStop(payload = {}) {
+  const root = resolveWorkspaceRoot(payload);
+
+  // If a STOP file was placed, allow immediately
+  if (existsSync(path.join(root, '.factory', 'STOP'))) {
+    return { decision: 'allow', allowed: true };
+  }
+
+  const bus = await createConfiguredBus(root);
+  const busResult = await bus.emit('stop', {
+    sessionID: payload.conversationId,
+    terminationReason: payload.terminationReason,
+  });
+
+  if (!busResult.allowed) {
+    return {
+      decision: 'continue',
+      allowed: false,
+      reason: busResult.reason || 'Blocked by Hook Bus stop policy',
+    };
+  }
+
+  const degraded = readLedgerDegraded(root);
+  const total = (degraded.stale || []).length + (degraded.suspect || []).length;
+  if (total > 0) {
+    return {
+      decision: 'continue',
+      allowed: false,
+      reason: `Epistemic audit warning: ${total} claims are degraded (${degraded.stale.length} STALE, ${degraded.suspect.length} SUSPECT) due to source retractions. Review before finishing.`,
+    };
+  }
+
+  return { decision: 'allow', allowed: true };
+}
+
+/**
+ * CLI dispatcher for subprocess calls.
+ */
+async function main() {
+  const action = process.argv[2] || 'pre_tool';
+  let inputData = '';
+
+  if (process.argv[3]) {
+    inputData = process.argv[3];
+  } else {
+    try {
+      inputData = readFileSync(0, 'utf-8');
+    } catch {
+      inputData = '{}';
+    }
+  }
+
+  let payload = {};
+  try {
+    payload = JSON.parse(inputData.trim() || '{}');
+  } catch {
+    payload = {};
+  }
+
+  let result = {};
+  try {
+    if (action === 'pre_tool' || action === 'pre-tool-use') {
+      result = await handlePreTool(payload);
+    } else if (action === 'post_tool' || action === 'post-tool-use') {
+      result = await handlePostTool(payload);
+    } else if (action === 'pre_invocation' || action === 'session-start') {
+      result = await handlePreInvocation(payload);
+    } else if (action === 'stop') {
+      result = await handleStop(payload);
+    } else {
+      result = { decision: 'allow', allowed: true };
+    }
+  } catch (err) {
+    result = {
+      decision: 'allow',
+      allowed: true,
+      error: String(err?.message || err),
+    };
+  }
+
+  process.stdout.write(JSON.stringify(result));
+}
+
+if (process.argv[1] && process.argv[1].endsWith('hook_bus_bridge.js')) {
+  main().catch(() => {
+    process.stdout.write(JSON.stringify({ decision: 'allow', allowed: true }));
+  });
+}

package/plugins/antigravity/hooks.json

@@ -2,7 +2,7 @@
   "epistemic-query-interceptor": {
     "PreToolUse": [
       {
-        "matcher": "search_web|read_url_content",
+        "matcher": "*",
         "hooks": [
           {
             "type": "command",

package/plugins/antigravity/plugin.json

@@ -1,7 +1,7 @@
 {
   "$schema": "https://antigravity.google/schemas/v1/plugin.json",
   "name": "epistemic-swarm",
-  "version": "0.7.23",
+  "version": "0.7.25",
   "description": "IUMBTEMS (Epistemic Swarm) \u2014 High-Integrity Dialectic Research, Architecture Auditing, Competitor Teardowns, and Socratic Planning for Antigravity.",
   "author": {
     "name": "Heretek AI",

package/plugins/opencode/analysis-bridge.js

@@ -22,8 +22,8 @@
  * pinned devDependency (Biome, single dep, zero-config, lint+format JS/TS).
  *
  * Phase evidence (cited per programmer brief):
- * - Bus contract (six blockable events, tiered enforcement, fail-open,
- *   tool/eventId audit guarantees)
+ * - Bus contract (six events, 3 host-enforced / 1 advisory / 2 bus-level,
+ *   tiered enforcement, fail-open, tool/eventId audit guarantees)
  *   [VERIFIED: sha256:f2c0843b598ba6f19cc0e208f8d02e0250c70615e3c484474d50635d0b5cdef8
  *   `file:///home/john/Projects/IUMBTEMS/plugins/opencode/hook-bus.js`]
  * - Host emit points (pre/post-tool-use own-tools scope, pre-commit both
@@ -44,7 +44,7 @@
  */
 
 import { spawn } from 'node:child_process';
-import { existsSync } from 'node:fs';
+import { existsSync, realpathSync } from 'node:fs';
 import path from 'node:path';
 import { fileURLToPath } from 'node:url';
 import { FAST_TIMEOUT_MS } from './hook-bus.js';
@@ -84,10 +84,32 @@ export function isJsTsFile(p) {
   return typeof p === 'string' && /\.(m|c)?[jt]sx?$/i.test(p.trim());
 }
 
-function pushCandidate(out, seen, v) {
+function pushCandidate(out, seen, v, root, skipped) {
   if (typeof v !== 'string') return;
   const t = v.trim();
-  if (!t || !isJsTsFile(t) || seen.has(t)) return;
+  if (!t || t.includes('\0') || t.startsWith('-')) return;
+  if (!isJsTsFile(t)) return;
+  const resolvedRoot = root ? path.resolve(root) : process.cwd();
+  const abs = path.resolve(resolvedRoot, t);
+  const rel = path.relative(resolvedRoot, abs);
+  if (rel.startsWith('..') || path.isAbsolute(rel)) {
+    if (skipped) skipped.push(t);
+    return;
+  }
+  try {
+    if (existsSync(abs)) {
+      const real = realpathSync(abs);
+      const realRoot = realpathSync(resolvedRoot);
+      const realRel = path.relative(realRoot, real);
+      if (realRel.startsWith('..') || path.isAbsolute(realRel)) {
+        if (skipped) skipped.push(t);
+        return;
+      }
+    }
+  } catch {
+    /* fail safe */
+  }
+  if (seen.has(t)) return;
   seen.add(t);
   out.push(t);
 }
@@ -97,28 +119,31 @@ function pushCandidate(out, seen, v) {
  * conventional locator fields (`file`, `files`, `path`, `paths`,
  * `filename`, `filenames`) plus a one-level scan of `args` values (plain
  * strings or arrays of strings, e.g. an edit tool's file argument).
- * De-duplicated, capped at `MAX_TARGET_FILES`. Never throws.
+ * Confines targets to the project root, rejects option-like flags (`-x`),
+ * de-duplicates, and caps at `MAX_TARGET_FILES`. Never throws.
  */
-export function collectTargets(payload) {
+export function collectTargets(payload, opts = {}) {
   try {
     const out = [];
     const seen = new Set();
+    const skipped = Array.isArray(opts?.skipped) ? opts.skipped : null;
+    const root = opts?.root || opts?.cwd || process.cwd();
     if (!payload || typeof payload !== 'object') return out;
     for (const key of ['file', 'files', 'path', 'paths', 'filename', 'filenames']) {
       const v = payload[key];
       if (Array.isArray(v)) {
-        for (const item of v) pushCandidate(out, seen, item);
+        for (const item of v) pushCandidate(out, seen, item, root, skipped);
       } else {
-        pushCandidate(out, seen, v);
+        pushCandidate(out, seen, v, root, skipped);
       }
     }
     const args = payload.args;
     if (args && typeof args === 'object') {
       for (const v of Object.values(args)) {
         if (Array.isArray(v)) {
-          for (const item of v) pushCandidate(out, seen, item);
+          for (const item of v) pushCandidate(out, seen, item, root, skipped);
         } else {
-          pushCandidate(out, seen, v);
+          pushCandidate(out, seen, v, root, skipped);
         }
       }
     }
@@ -187,8 +212,16 @@ function errorFinding(tool, eventId, targets, message) {
   });
 }
 
-/** Locate the Biome binary: repo devDep first, then PATH fallback. */
-export function findAnalyzerBin() {
+/** Locate the Biome binary: project devDep first, then repo devDep, then PATH fallback. */
+export function findAnalyzerBin(root) {
+  try {
+    if (root) {
+      const projectLocal = path.join(root, 'node_modules', '.bin', 'biome');
+      if (existsSync(projectLocal)) return projectLocal;
+    }
+  } catch {
+    /* fall through */
+  }
   try {
     const local = path.join(PKG_ROOT, 'node_modules', '.bin', 'biome');
     if (existsSync(local)) return local;
@@ -241,7 +274,7 @@ export function defaultRunAnalyzer(files, opts = {}) {
     let child;
     try {
       child = spawn(
-        findAnalyzerBin(),
+        findAnalyzerBin(opts.root || opts.cwd),
         [
           'lint',
           '--reporter=json',
@@ -249,6 +282,7 @@ export function defaultRunAnalyzer(files, opts = {}) {
           '--diagnostic-level=info',
           '--colors=off',
           '--files-ignore-unknown=true',
+          '--',
           ...files,
         ],
         { cwd: opts.cwd || process.cwd() },
@@ -319,37 +353,50 @@ export async function analyzePayload(payload, opts = {}) {
   try {
     const tool = resolveTool(payload);
     const eventId = resolveEventId(payload);
-    const targets = collectTargets(payload);
-    if (targets.length === 0) return { allowed: true, annotations: [] };
+    const root = opts.root || opts.cwd || process.cwd();
+    const skipped = [];
+    const targets = collectTargets(payload, { root, skipped });
+    const skippedAnnotations = skipped.slice(0, 10).map((s) => toFinding({
+      tool,
+      eventId,
+      rule: 'analysis-bridge/skipped-target',
+      file: s,
+      line: null,
+      message: `target path outside project root or invalid: ${s} (skipped)`,
+      severity: 'info',
+    }));
+
+    if (targets.length === 0) return { allowed: true, annotations: skippedAnnotations };
     const timeoutMs = Number(opts.timeoutMs ?? ANALYZER_TIMEOUT_MS);
     const budget = Number.isFinite(timeoutMs) && timeoutMs >= 0 ? timeoutMs : ANALYZER_TIMEOUT_MS;
     const runAnalyzer = typeof opts.runAnalyzer === 'function' ? opts.runAnalyzer : defaultRunAnalyzer;
     const res = await runBounded(
-      runAnalyzer(targets, { timeoutMs: budget, cwd: opts.cwd }),
+      runAnalyzer(targets, { timeoutMs: budget, cwd: opts.cwd, root }),
       budget,
     );
     if (!res || typeof res !== 'object') {
-      return { allowed: true, annotations: [errorFinding(tool, eventId, targets, 'malformed analyzer result')] };
+      return { allowed: true, annotations: [...skippedAnnotations, errorFinding(tool, eventId, targets, 'malformed analyzer result')] };
     }
-    if (res.status === 'missing') return { allowed: true, annotations: [] };
+    if (res.status === 'missing') return { allowed: true, annotations: skippedAnnotations };
     if (res.status === 'timeout') {
-      return { allowed: true, annotations: [timeoutFinding(tool, eventId, targets, budget)] };
+      return { allowed: true, annotations: [...skippedAnnotations, timeoutFinding(tool, eventId, targets, budget)] };
     }
     if (res.status === 'error') {
-      return { allowed: true, annotations: [errorFinding(tool, eventId, targets, res.message || 'unknown error')] };
+      return { allowed: true, annotations: [...skippedAnnotations, errorFinding(tool, eventId, targets, res.message || 'unknown error')] };
     }
     if (res.status === 'ok' && Array.isArray(res.findings)) {
       const findings = res.findings
+        .filter((f) => f && typeof f === 'object' && !Array.isArray(f))
         .slice(0, MAX_FINDINGS)
         .map((f) => toFinding({ ...f, tool: f?.tool ?? tool, eventId: f?.eventId ?? eventId }));
-      return { allowed: true, annotations: findings };
+      return { allowed: true, annotations: [...skippedAnnotations, ...findings] };
     }
     if (typeof res.stdout === 'string') {
       // Default-runner raw form: parse Biome JSON reporter output here so
       // injected mocks may return either parsed findings or raw stdout.
-      return { allowed: true, annotations: parseBiomeJson(res.stdout, tool, eventId) };
+      return { allowed: true, annotations: [...skippedAnnotations, ...parseBiomeJson(res.stdout, tool, eventId)] };
     }
-    return { allowed: true, annotations: [errorFinding(tool, eventId, targets, 'malformed analyzer result')] };
+    return { allowed: true, annotations: [...skippedAnnotations, errorFinding(tool, eventId, targets, 'malformed analyzer result')] };
   } catch (err) {
     // Last resort: fail-open allow with a single error annotation.
     try {
@@ -433,7 +480,7 @@ export function createBridgeHandler(bus, opts = {}) {
       const result = await analyzePayload(payload, runOpts);
       const annotations = Array.isArray(result?.annotations) ? result.annotations : [];
       if (annotations.length === 0) {
-        const targets = collectTargets(payload);
+        const targets = collectTargets(payload, runOpts);
         if (targets.length === 0) {
           return { verdict: 'allow', reason: 'analysis-bridge: no js/ts targets; skipped' };
         }
@@ -461,14 +508,21 @@ export function createBridgeHandler(bus, opts = {}) {
           }
         }
       }
-      const files = new Set(annotations.map((f) => f.file).filter(Boolean));
-      notifySummary(runOpts, {
-        title: 'IUMBTEMS analysis',
-        message: `analysis-bridge: ${annotations.length} finding(s) in ${files.size} file(s) (advisory; action allowed)`,
-      });
+      const nonSkipped = annotations.filter((f) => f.rule !== 'analysis-bridge/skipped-target');
+      if (nonSkipped.length > 0) {
+        const files = new Set(nonSkipped.map((f) => f.file).filter(Boolean));
+        notifySummary(runOpts, {
+          title: 'IUMBTEMS analysis',
+          message: `analysis-bridge: ${nonSkipped.length} finding(s) in ${files.size} file(s) (advisory; action allowed)`,
+        });
+        return {
+          verdict: 'advisory',
+          reason: `analysis-bridge: ${nonSkipped.length} finding(s) in ${files.size} file(s) (advisory; action allowed)`,
+        };
+      }
       return {
-        verdict: 'advisory',
-        reason: `analysis-bridge: ${annotations.length} finding(s) in ${files.size} file(s) (advisory; action allowed)`,
+        verdict: 'allow',
+        reason: `analysis-bridge: ${annotations.length} target(s) skipped (advisory; action allowed)`,
       };
     } catch {
       return { verdict: 'allow', reason: 'analysis-bridge: internal fault; fail-open allow' };