@jaimevalasek/aioson 1.30.2 → 1.36.0

package/src/verification/redaction.js

@@ -0,0 +1,77 @@
+'use strict';
+
+const SECRET_KEY_RE = /\b([A-Za-z0-9_.-]*(?:token|secret|password|passwd|pwd|api[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|auth)[A-Za-z0-9_.-]*)(\s*[:=]\s*)(["']?)([^"'\s,;}]+)/gi;
+const BEARER_RE = /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}/g;
+const COMMON_SECRET_RE = /\b(?:sk-[A-Za-z0-9_-]{12,}|sk_(?:live|test)_[A-Za-z0-9_-]{12,}|pk_[A-Za-z0-9_-]{12,}|ghp_[A-Za-z0-9_]{20,}|github_pat_[A-Za-z0-9_]{20,}|glpat-[A-Za-z0-9_-]{20,}|xox[baprs]-[A-Za-z0-9-]{10,}|AKIA[0-9A-Z]{16})\b/g;
+const PEM_BLOCK_RE = /-----BEGIN [^-]+-----[\s\S]*?-----END [^-]+-----/g;
+const BASIC_AUTH_URL_RE = /(https?:\/\/)([^/\s:@]+):([^/\s@]+)@/g;
+
+function createCounter() {
+  return {
+    secret_assignments: 0,
+    bearer_tokens: 0,
+    common_tokens: 0,
+    pem_blocks: 0,
+    credential_urls: 0
+  };
+}
+
+function redactText(input, counter = createCounter()) {
+  let text = String(input || '');
+  text = text.replace(PEM_BLOCK_RE, () => {
+    counter.pem_blocks += 1;
+    return '[REDACTED_PEM_BLOCK]';
+  });
+  text = text.replace(BASIC_AUTH_URL_RE, (_match, protocol) => {
+    counter.credential_urls += 1;
+    return `${protocol}[REDACTED_CREDENTIALS]@`;
+  });
+  text = text.replace(BEARER_RE, () => {
+    counter.bearer_tokens += 1;
+    return 'Bearer [REDACTED_SECRET]';
+  });
+  text = text.replace(SECRET_KEY_RE, (_match, key, sep, quote) => {
+    counter.secret_assignments += 1;
+    return `${key}${sep}${quote}[REDACTED_SECRET]`;
+  });
+  text = text.replace(COMMON_SECRET_RE, () => {
+    counter.common_tokens += 1;
+    return '[REDACTED_SECRET]';
+  });
+  return text;
+}
+
+function isSecretKey(key) {
+  return /(?:token|secret|password|passwd|pwd|api[_-]?key|private[_-]?key|access[_-]?key|client[_-]?secret|auth)/i.test(String(key || ''));
+}
+
+function redactJson(value, counter = createCounter()) {
+  if (Array.isArray(value)) {
+    return value.map((item) => redactJson(item, counter));
+  }
+  if (value && typeof value === 'object') {
+    const output = {};
+    for (const [key, item] of Object.entries(value)) {
+      if (isSecretKey(key)) {
+        counter.secret_assignments += 1;
+        output[key] = '[REDACTED_SECRET]';
+      } else {
+        output[key] = redactJson(item, counter);
+      }
+    }
+    return output;
+  }
+  if (typeof value === 'string') return redactText(value, counter);
+  return value;
+}
+
+function totalRedactions(counter) {
+  return Object.values(counter || {}).reduce((sum, value) => sum + Number(value || 0), 0);
+}
+
+module.exports = {
+  createCounter,
+  redactText,
+  redactJson,
+  totalRedactions
+};

package/src/verification/report-parser.js

@@ -0,0 +1,132 @@
+'use strict';
+
+const fs = require('node:fs/promises');
+
+const {
+  VERDICTS,
+  validateVerificationReport,
+  makeError
+} = require('./result');
+const { resolveInsideRoot } = require('./path-policy');
+const { extractJsonBlock } = require('./ledger-store');
+
+const REQUIRED_REPORT_SECTIONS = [
+  { id: 'verdict', heading: 'Verdict' },
+  { id: 'commands_run', heading: 'Commands Run' },
+  { id: 'findings', heading: 'Findings' },
+  { id: 'before_and_now', heading: 'Before And Now' },
+  { id: 'residual_risk', heading: 'Residual Risk' },
+  { id: 'recommended_route', heading: 'Recommended Route' },
+  { id: 'machine_report', heading: 'Machine Report' }
+];
+
+function sectionPattern(heading) {
+  return new RegExp(`^##\\s+${heading.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*$`, 'im');
+}
+
+function missingReportSections(content) {
+  return REQUIRED_REPORT_SECTIONS
+    .filter((section) => !sectionPattern(section.heading).test(content))
+    .map((section) => section.id);
+}
+
+function extractSection(content, heading) {
+  const text = String(content || '');
+  const headingRe = new RegExp(`^##\\s+${heading}\\s*$`, 'im');
+  const headingMatch = headingRe.exec(text);
+  if (!headingMatch) return '';
+  const start = headingMatch.index + headingMatch[0].length;
+  const rest = text.slice(start);
+  const nextHeading = rest.search(/^##\s+/m);
+  return (nextHeading === -1 ? rest : rest.slice(0, nextHeading)).trim();
+}
+
+function proseVerdictTokens(content) {
+  const verdictSection = extractSection(content, 'Verdict');
+  if (!verdictSection) return [];
+  const pattern = new RegExp(`\\b(${Array.from(VERDICTS).join('|')})\\b`, 'g');
+  return [...verdictSection.matchAll(pattern)].map((match) => match[1]);
+}
+
+function proseVerdict(content) {
+  const tokens = proseVerdictTokens(content);
+  return tokens.length > 0 ? tokens[0] : null;
+}
+
+async function parseVerificationReport(rootDir, slug, reportPath, requestedPolicy) {
+  const safe = resolveInsideRoot(rootDir, reportPath);
+  if (!safe.ok) return safe;
+
+  let content;
+  try {
+    content = await fs.readFile(safe.path, 'utf8');
+  } catch {
+    return makeError('report_not_found', { report_path: safe.relative_path });
+  }
+
+  const missingSections = missingReportSections(content);
+  if (missingSections.length > 0) {
+    return makeError('missing_report_sections', {
+      feature_slug: slug,
+      report_path: safe.relative_path,
+      missing_sections: missingSections
+    });
+  }
+
+  const rawJson = extractJsonBlock(content, 'Machine Report');
+  if (!rawJson) {
+    return makeError('missing_machine_report', {
+      feature_slug: slug,
+      report_path: safe.relative_path
+    });
+  }
+
+  let report;
+  try {
+    report = JSON.parse(rawJson);
+  } catch (error) {
+    return makeError('invalid_machine_report_json', {
+      feature_slug: slug,
+      report_path: safe.relative_path,
+      detail: error.message
+    });
+  }
+
+  // Conflict only when the Verdict prose names verdict token(s) and NONE of them
+  // match the machine verdict. Collecting all tokens (not just the first) avoids a
+  // false conflict when the auditor writes a negated mention, e.g.
+  // "Not a PASS — NEEDS_DEV_FIX" alongside a machine verdict of NEEDS_DEV_FIX.
+  const proseTokens = proseVerdictTokens(content);
+  if (proseTokens.length > 0 && report.verdict && !proseTokens.includes(report.verdict)) {
+    return makeError('report_conflict', {
+      feature_slug: slug,
+      report_path: safe.relative_path,
+      prose_verdict: proseTokens[0],
+      machine_verdict: report.verdict
+    });
+  }
+
+  const errors = validateVerificationReport(report, { slug, requestedPolicy });
+  if (errors.length > 0) {
+    return makeError('invalid_machine_report', {
+      feature_slug: slug,
+      report_path: safe.relative_path,
+      errors
+    });
+  }
+
+  return {
+    ok: true,
+    feature_slug: slug,
+    report_path: safe.relative_path,
+    report
+  };
+}
+
+module.exports = {
+  parseVerificationReport,
+  REQUIRED_REPORT_SECTIONS,
+  missingReportSections,
+  proseVerdict,
+  proseVerdictTokens
+};

package/src/verification/report-store.js

@@ -0,0 +1,97 @@
+'use strict';
+
+const fs = require('node:fs/promises');
+const path = require('node:path');
+
+const { REPORT_SCHEMA_VERSION } = require('./schema');
+const { featureContextDir, verificationRunsDir, relativeFromRoot } = require('./path-policy');
+const { timestampForFile } = require('./prompt-package');
+
+function safeSegment(value, fallback = 'default') {
+  const segment = String(value || fallback)
+    .trim()
+    .replace(/[^A-Za-z0-9._-]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 80);
+  return segment || fallback;
+}
+
+function runnerRunStem({ timestamp = timestampForFile(), tool, model }) {
+  return `${timestamp}-${safeSegment(tool, 'tool')}-${safeSegment(model || 'configured-default', 'configured-default')}`;
+}
+
+async function writeVerificationRunFile(rootDir, slug, stem, suffix, content) {
+  const runsDir = verificationRunsDir(rootDir, slug);
+  await fs.mkdir(runsDir, { recursive: true });
+  const targetPath = path.join(runsDir, `${stem}-${suffix}`);
+  await fs.writeFile(targetPath, String(content || ''), 'utf8');
+  return {
+    path: targetPath,
+    relative_path: relativeFromRoot(rootDir, targetPath)
+  };
+}
+
+async function promoteLatestReport(rootDir, slug, markdown) {
+  const targetPath = path.join(featureContextDir(rootDir, slug), 'verification-report.md');
+  await fs.mkdir(path.dirname(targetPath), { recursive: true });
+  await fs.writeFile(targetPath, String(markdown || ''), 'utf8');
+  return {
+    path: targetPath,
+    relative_path: relativeFromRoot(rootDir, targetPath)
+  };
+}
+
+function systemInconclusiveReport({ slug, policy, summary, route = 'qa', command, status, evidence }) {
+  const report = {
+    schema_version: REPORT_SCHEMA_VERSION,
+    feature_slug: slug,
+    policy,
+    verdict: 'INCONCLUSIVE',
+    summary,
+    commands_run: [
+      {
+        command: command || 'auditor runner',
+        status: status || 'failed',
+        evidence: evidence || summary
+      }
+    ],
+    findings: [],
+    recommended_route: route,
+    blocking_findings_count: 0
+  };
+
+  return `# Verification Report - ${slug}
+
+## Verdict
+INCONCLUSIVE
+
+## Commands Run
+${command || 'auditor runner'} — ${status || 'failed'}.
+
+## Findings
+No auditor findings were trusted because the runner did not produce a valid report.
+
+## Before And Now
+Not evaluated by a valid auditor report.
+
+## Residual Risk
+${summary}
+
+## Recommended Route
+${route}
+
+## Machine Report
+
+\`\`\`json
+${JSON.stringify(report, null, 2)}
+\`\`\`
+`;
+}
+
+module.exports = {
+  safeSegment,
+  runnerRunStem,
+  writeVerificationRunFile,
+  promoteLatestReport,
+  systemInconclusiveReport
+};

package/src/verification/result.js

@@ -0,0 +1,16 @@
+'use strict';
+
+const schema = require('./schema');
+
+function makeError(reason, detail = {}) {
+  return {
+    ok: false,
+    reason,
+    ...detail
+  };
+}
+
+module.exports = {
+  ...schema,
+  makeError
+};

package/src/verification/runners/index.js

@@ -0,0 +1,319 @@
+'use strict';
+
+const { spawn } = require('node:child_process');
+
+const SUPPORTED_RUNNER_TOOLS = new Set(['codex', 'claude', 'opencode']);
+const DEFAULT_RUNNER_MODEL = 'configured-default';
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+const DEFAULT_MAX_OUTPUT_BYTES = 256 * 1024;
+const DETECTION_TIMEOUT_MS = 5000;
+const MODEL_RE = /^[A-Za-z0-9][A-Za-z0-9._:/-]{0,119}$/;
+
+function normalizeRunnerTool(tool) {
+  const value = String(tool || '').trim().toLowerCase();
+  if (!value) return { ok: false, reason: 'missing_tool' };
+  if (!SUPPORTED_RUNNER_TOOLS.has(value)) {
+    return {
+      ok: false,
+      reason: 'unsupported_tool',
+      tool: value,
+      supported_tools: Array.from(SUPPORTED_RUNNER_TOOLS)
+    };
+  }
+  return { ok: true, tool: value };
+}
+
+function normalizeRunnerModel(model) {
+  const value = String(model || DEFAULT_RUNNER_MODEL).trim();
+  if (!value || value === DEFAULT_RUNNER_MODEL) {
+    return { ok: true, model: DEFAULT_RUNNER_MODEL, uses_configured_default: true };
+  }
+  if (!MODEL_RE.test(value) || value.includes('..')) {
+    return { ok: false, reason: 'invalid_model', model: value };
+  }
+  return { ok: true, model: value, uses_configured_default: false };
+}
+
+function positiveInt(value, fallback, min, max) {
+  const parsed = Number(value);
+  if (!Number.isFinite(parsed)) return fallback;
+  const integer = Math.floor(parsed);
+  if (integer < min) return min;
+  if (integer > max) return max;
+  return integer;
+}
+
+function runnerLimits(options = {}) {
+  return {
+    timeout_ms: positiveInt(
+      options['timeout-ms'] || options.timeoutMs || options.timeout,
+      DEFAULT_TIMEOUT_MS,
+      100,
+      60 * 60 * 1000
+    ),
+    max_output_bytes: positiveInt(
+      options['max-output-bytes'] || options.maxOutputBytes || options['max-output'],
+      DEFAULT_MAX_OUTPUT_BYTES,
+      1024,
+      5 * 1024 * 1024
+    )
+  };
+}
+
+function adapterInvocation({ tool, model, rootDir, promptPath, promptText }) {
+  const usesDefault = model === DEFAULT_RUNNER_MODEL;
+  if (tool === 'codex') {
+    const args = [
+      'exec',
+      '--cd', rootDir,
+      '--sandbox', 'read-only',
+      '--ephemeral',
+      '--color', 'never'
+    ];
+    if (!usesDefault) args.push('--model', model);
+    args.push('-');
+    return {
+      command: 'codex',
+      args,
+      stdin: promptText,
+      permission_mode: 'read-only',
+      destructive_commands_allowed: false
+    };
+  }
+
+  if (tool === 'claude') {
+    const args = [
+      '--print',
+      '--permission-mode', 'plan',
+      '--tools', ''
+    ];
+    if (!usesDefault) args.push('--model', model);
+    return {
+      command: 'claude',
+      args,
+      stdin: promptText,
+      permission_mode: 'plan',
+      destructive_commands_allowed: false
+    };
+  }
+
+  const args = [
+    'run',
+    '--dir', rootDir,
+    '--pure',
+    '--file', promptPath
+  ];
+  if (!usesDefault) args.push('--model', model);
+  args.push('Run the implementation audit described in the attached prompt package. Return only the requested verification report with the Machine Report JSON block.');
+  return {
+    command: 'opencode',
+    args,
+    stdin: null,
+    permission_mode: 'default',
+    destructive_commands_allowed: false
+  };
+}
+
+function commandLabel(invocation) {
+  return [invocation.command, ...invocation.args].join(' ');
+}
+
+function runProcessWithLimits(invocation, { cwd, timeoutMs, maxOutputBytes, spawnImpl = spawn }) {
+  return new Promise((resolve) => {
+    const startedAt = Date.now();
+    let settled = false;
+    let timedOut = false;
+    let outputLimited = false;
+    let stdout = '';
+    let stderr = '';
+    let outputBytes = 0;
+    let timer = null;
+
+    function finish(result) {
+      if (settled) return;
+      settled = true;
+      if (timer) clearTimeout(timer);
+      resolve({
+        ...result,
+        duration_ms: Date.now() - startedAt,
+        stdout,
+        stderr,
+        output_bytes: outputBytes,
+        output_truncated: outputLimited
+      });
+    }
+
+    let child;
+    try {
+      child = spawnImpl(invocation.command, invocation.args, {
+        cwd,
+        windowsHide: true,
+        stdio: ['pipe', 'pipe', 'pipe'],
+        env: {
+          ...process.env,
+          NO_COLOR: '1',
+          CI: process.env.CI || '1'
+        }
+      });
+    } catch (error) {
+      finish({
+        status: 'spawn_error',
+        exit_code: null,
+        signal: null,
+        error: error.message
+      });
+      return;
+    }
+
+    timer = setTimeout(() => {
+      timedOut = true;
+      if (child && child.kill) child.kill('SIGTERM');
+      setTimeout(() => {
+        if (!settled && child && child.kill) child.kill('SIGKILL');
+      }, 1000).unref?.();
+    }, timeoutMs);
+
+    function capture(kind, chunk) {
+      const text = Buffer.isBuffer(chunk) ? chunk.toString('utf8') : String(chunk || '');
+      outputBytes += Buffer.byteLength(text, 'utf8');
+      if (outputBytes <= maxOutputBytes) {
+        if (kind === 'stdout') stdout += text;
+        else stderr += text;
+        return;
+      }
+      outputLimited = true;
+      const remaining = Math.max(0, maxOutputBytes - Buffer.byteLength(stdout + stderr, 'utf8'));
+      if (remaining > 0) {
+        const slice = Buffer.from(text, 'utf8').subarray(0, remaining).toString('utf8');
+        if (kind === 'stdout') stdout += slice;
+        else stderr += slice;
+      }
+      if (child && child.kill) child.kill('SIGTERM');
+    }
+
+    if (child.stdout && child.stdout.on) child.stdout.on('data', (chunk) => capture('stdout', chunk));
+    if (child.stderr && child.stderr.on) child.stderr.on('data', (chunk) => capture('stderr', chunk));
+    if (child.on) {
+      child.on('error', (error) => {
+        finish({
+          status: 'spawn_error',
+          exit_code: null,
+          signal: null,
+          error: error.message
+        });
+      });
+      child.on('close', (code, signal) => {
+        if (timedOut) {
+          finish({ status: 'timeout', exit_code: code, signal });
+        } else if (outputLimited) {
+          finish({ status: 'output_limit', exit_code: code, signal });
+        } else {
+          finish({
+            status: code === 0 ? 'completed' : 'failed',
+            exit_code: code,
+            signal
+          });
+        }
+      });
+    }
+
+    if (child.stdin) {
+      if (invocation.stdin) child.stdin.write(invocation.stdin);
+      child.stdin.end();
+    }
+  });
+}
+
+async function detectRunnerTool(tool, { rootDir, spawnImpl = spawn }) {
+  const invocation = {
+    command: tool,
+    args: ['--version'],
+    stdin: null
+  };
+  const result = await runProcessWithLimits(invocation, {
+    cwd: rootDir,
+    timeoutMs: DETECTION_TIMEOUT_MS,
+    maxOutputBytes: 16 * 1024,
+    spawnImpl
+  });
+  if (result.status !== 'completed') {
+    return {
+      ok: false,
+      reason: result.status === 'spawn_error' ? 'tool_not_found' : `tool_detection_${result.status}`,
+      tool,
+      detail: result.error || result.stderr || result.stdout || null
+    };
+  }
+  return {
+    ok: true,
+    tool,
+    version_output: (result.stdout || result.stderr || '').trim().slice(0, 500)
+  };
+}
+
+async function runAuditorTool({
+  rootDir,
+  tool,
+  model,
+  promptPath,
+  promptText,
+  limits = {},
+  spawnImpl = spawn
+}) {
+  const toolResult = normalizeRunnerTool(tool);
+  if (!toolResult.ok) return toolResult;
+  const modelResult = normalizeRunnerModel(model);
+  if (!modelResult.ok) return modelResult;
+
+  const detected = await detectRunnerTool(toolResult.tool, { rootDir, spawnImpl });
+  if (!detected.ok) return detected;
+
+  const invocation = adapterInvocation({
+    tool: toolResult.tool,
+    model: modelResult.model,
+    rootDir,
+    promptPath,
+    promptText
+  });
+  const run = await runProcessWithLimits(invocation, {
+    cwd: rootDir,
+    timeoutMs: limits.timeout_ms || DEFAULT_TIMEOUT_MS,
+    maxOutputBytes: limits.max_output_bytes || DEFAULT_MAX_OUTPUT_BYTES,
+    spawnImpl
+  });
+
+  return {
+    ok: run.status === 'completed',
+    status: run.status,
+    tool: toolResult.tool,
+    model: modelResult.model,
+    command: commandLabel(invocation),
+    permission_mode: invocation.permission_mode,
+    destructive_commands_allowed: invocation.destructive_commands_allowed,
+    timeout_ms: limits.timeout_ms || DEFAULT_TIMEOUT_MS,
+    max_output_bytes: limits.max_output_bytes || DEFAULT_MAX_OUTPUT_BYTES,
+    duration_ms: run.duration_ms,
+    exit_code: run.exit_code,
+    signal: run.signal,
+    stdout: run.stdout,
+    stderr: run.stderr,
+    output_bytes: run.output_bytes,
+    output_truncated: run.output_truncated,
+    error: run.error || null,
+    detected
+  };
+}
+
+module.exports = {
+  SUPPORTED_RUNNER_TOOLS,
+  DEFAULT_RUNNER_MODEL,
+  DEFAULT_TIMEOUT_MS,
+  DEFAULT_MAX_OUTPUT_BYTES,
+  normalizeRunnerTool,
+  normalizeRunnerModel,
+  runnerLimits,
+  adapterInvocation,
+  runProcessWithLimits,
+  detectRunnerTool,
+  runAuditorTool
+};