@jevitate/cli 0.1.0 → 0.2.0

package/dist/credentials-file.d.ts

@@ -0,0 +1,15 @@
+import { type CredentialKey } from "@jevitate/ai-core";
+export declare class CredentialsFileError extends Error {
+}
+export interface CredentialsFileDeps {
+    readonly homedir?: () => string;
+    readonly readFile?: (path: string) => string;
+}
+export declare function credentialsFilePath(deps?: CredentialsFileDeps): string;
+/**
+ * Reads the credential file. A MISSING file means "no local keys" ({}); anything
+ * else wrong with it (unreadable, not JSON, not an object) fails closed with an
+ * actionable error — never a silent empty store that looks like "keys missing".
+ * Only the known key names with string values are returned.
+ */
+export declare function loadLocalCredentials(deps?: CredentialsFileDeps): Partial<Record<CredentialKey, string>>;

package/dist/credentials-file.js

@@ -0,0 +1,56 @@
+import { readFileSync } from "node:fs";
+import { ALL_CREDENTIAL_KEYS } from "@jevitate/ai-core";
+import { resolveDataDir } from "./data-dir.js";
+/**
+ * The machine-local credential file written by `jevitate init` / `jevitate ai setup`
+ * (`~/.jevitate/credentials.json`, mode 0600). Every credential READ site loads it
+ * through this module so what setup persists is what status/explore/generate see
+ * (env vars still win — see `envCredentialStore`).
+ */
+const KNOWN_KEYS = ALL_CREDENTIAL_KEYS;
+export class CredentialsFileError extends Error {
+}
+export function credentialsFilePath(deps = {}) {
+    return resolveDataDir(["credentials.json"], deps.homedir ? { homedir: deps.homedir } : {});
+}
+function isMissingFile(err) {
+    return typeof err === "object" && err !== null && "code" in err && err.code === "ENOENT";
+}
+/**
+ * Reads the credential file. A MISSING file means "no local keys" ({}); anything
+ * else wrong with it (unreadable, not JSON, not an object) fails closed with an
+ * actionable error — never a silent empty store that looks like "keys missing".
+ * Only the known key names with string values are returned.
+ */
+export function loadLocalCredentials(deps = {}) {
+    const path = credentialsFilePath(deps);
+    const read = deps.readFile ?? ((p) => readFileSync(p, "utf8"));
+    let raw;
+    try {
+        raw = read(path);
+    }
+    catch (err) {
+        if (isMissingFile(err))
+            return {};
+        throw new CredentialsFileError(`cannot read ${path}: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        throw new CredentialsFileError(`${path} is not valid JSON — fix or delete it, then run \`jevitate init\``);
+    }
+    if (typeof parsed !== "object" || parsed === null || Array.isArray(parsed)) {
+        throw new CredentialsFileError(`${path} must be a JSON object of credential keys — fix or delete it, then run \`jevitate init\``);
+    }
+    const values = new Map(Object.entries(parsed));
+    const out = {};
+    for (const key of KNOWN_KEYS) {
+        const value = values.get(key);
+        if (typeof value === "string")
+            out[key] = value;
+    }
+    return out;
+}
+//# sourceMappingURL=credentials-file.js.map

package/dist/credentials-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials-file.js","sourceRoot":"","sources":["../src/credentials-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,mBAAmB,EAAsB,MAAM,mBAAmB,CAAC;AAC5E,OAAO,EAAE,cAAc,EAAE,MAAM,eAAe,CAAC;AAE/C;;;;;GAKG;AAEH,MAAM,UAAU,GAA6B,mBAAmB,CAAC;AAEjE,MAAM,OAAO,oBAAqB,SAAQ,KAAK;CAAG;AAOlD,MAAM,UAAU,mBAAmB,CAAC,OAA4B,EAAE;IAChE,OAAO,cAAc,CAAC,CAAC,kBAAkB,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,aAAa,CAAC,GAAY;IACjC,OAAO,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,IAAI,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;IACvE,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;IACnB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,EAAE,CAAC;QAClC,MAAM,IAAI,oBAAoB,CAC5B,eAAe,IAAI,KAAK,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,oBAAoB,CAC5B,GAAG,IAAI,mEAAmE,CAC3E,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,MAAM,IAAI,oBAAoB,CAC5B,GAAG,IAAI,0FAA0F,CAClG,CAAC;IACJ,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,CAAkB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,MAAM,GAAG,GAA2C,EAAE,CAAC;IACvD,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC9B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IAClD,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/data-dir.d.ts

@@ -1,6 +1,6 @@
 /**
  * Resolves a default runtime-data path under `~/.jevitate/<segments>`
- * (product = Jevitate). Greenfield: there is no legacy `~/.doit` location.
+ * (product = Jevitate). Greenfield — no legacy data location to migrate.
  * `homedir` is injectable so this is unit-testable without touching
  * `os.homedir()`.
  */

package/dist/data-dir.js

@@ -2,7 +2,7 @@ import { homedir as osHomedir } from "node:os";
 import { join } from "node:path";
 /**
  * Resolves a default runtime-data path under `~/.jevitate/<segments>`
- * (product = Jevitate). Greenfield: there is no legacy `~/.doit` location.
+ * (product = Jevitate). Greenfield — no legacy data location to migrate.
  * `homedir` is injectable so this is unit-testable without touching
  * `os.homedir()`.
  */

package/dist/defect-evidence.d.ts

@@ -0,0 +1,141 @@
+import { type FilingConfig, type IssueFilerPort } from "@jevitate/domain";
+import { type BrowserPort, type EmulationSpec } from "@jevitate/playwright";
+import type { Recording, RecordedStep } from "@jevitate/recording";
+import { type BrowserRunOptions } from "./browser-run-options.js";
+import type { RunScreenshots } from "./run-screenshots.js";
+/**
+ * #250 — defect evidence: per defect, its minimal repro Recording (the one `verify-fix` replays:
+ * the finding's own, else the run's, up to `repro.recordingStepIndex`) is replayed in a FRESH
+ * session with the demo overlay and a video. Each step is captioned with what it does (its
+ * objective, else its label, else a value-free description); the failing step is marked with the
+ * defect's actual signal ("Save → server returned 500 (PUT /api/profile)", "invariant `x`
+ * violated", …) and whether this replay saw it fire again. Two key screenshots — just before the
+ * failing step and at it, the failing element highlighted — have the overlay hidden.
+ *
+ * Secrets are masked in pixels by the display-only mask layer (`demo-capture.ts`) from the video's
+ * first paint; the mask is re-proven at every step. FAIL CLOSED: a clip whose mask could not be
+ * proven at some step is deleted and the reason recorded; a screenshot that cannot be proven is not
+ * written. Nothing here reaches a model; every string written is redacted.
+ *
+ * The media are attached as `defects[].evidence.{videoPath, screenshots[]}` (additive, schemaVersion
+ * 1), appended to the defect's issue draft, and read by `report` / `check` (JUnit, SARIF). GitHub's
+ * API cannot upload media: drafts and filed issues LINK to the files (commit them under `.jevitate/`
+ * or publish them as CI artifacts).
+ */
+/** Caption time per step in an evidence clip (ms). */
+export declare const EVIDENCE_PACE_MS = 700;
+/** At most this many defects get a clip per run (hard defects first). */
+export declare const EVIDENCE_MAX_DEFECTS = 5;
+export interface DefectEvidence {
+    /** The captioned repro clip (WebM). Absent: no video was asked for, or it was refused (see `skipped`). */
+    readonly videoPath?: string;
+    /** Key screenshots: just before the failing step, and at it (failing element highlighted). */
+    readonly screenshots: string[];
+    /** 1-based failing step within the repro. */
+    readonly failingStep?: number;
+    /** What the failing step is marked with (redacted). */
+    readonly signal?: string;
+    /** Whether the defect's signal fired again on this replay (absent when the replay cannot tell). */
+    readonly reproduced?: boolean;
+    /** How the replay went: `completed`, or where it stopped. */
+    readonly replay?: {
+        readonly outcome: "completed" | "stopped";
+        readonly atStep?: number;
+        readonly reason?: string;
+    };
+    /** Why there is no media at all (no repro Recording, the session could not be masked, …). */
+    readonly skipped?: string;
+    /** Captures refused (fail closed) with their reason. */
+    readonly captureSkips?: string[];
+}
+export interface EvidenceReplayInput {
+    readonly recording: Recording;
+    /** Flat index of the failing step (the defect's `repro.recordingStepIndex`). */
+    readonly stepIndex: number;
+    /** The defect's fingerprint(s): a page signal with one of them means it fired again. */
+    readonly fingerprints: readonly string[];
+    /** Whether a page signal can show this defect at all (else `reproduced` stays absent). */
+    readonly signalCheckable: boolean;
+    /** The failing step's mark (redacted by the caller). */
+    readonly signal: string;
+    readonly seedUrl: string;
+    readonly allowlist: readonly string[];
+    readonly storageState?: string;
+    readonly emulation?: EmulationSpec;
+    /** Where the clip and screenshots go (created). */
+    readonly outDir: string;
+    /** Record the clip (else screenshots only). */
+    readonly video: boolean;
+    /** #251: the run's `--screenshots` capture, fed after every step. */
+    readonly screenshots?: RunScreenshots;
+    readonly secrets: readonly string[];
+    readonly browser?: BrowserRunOptions;
+    readonly browserPortFactory?: () => BrowserPort;
+    readonly paceMs?: number;
+    readonly settleCeilingMs?: number;
+    /** The final card (e.g. verify-fix's verdict); default: reproduced / not reproduced. */
+    readonly finalCard?: (reproduced: boolean | undefined) => {
+        readonly text: string;
+        readonly ok: boolean;
+    };
+}
+/** A recorded step's caption: its objective, else its label, else a value-free description. */
+export declare function stepCaption(recorded: RecordedStep): string;
+/** Whether a replay's page signals can show a defect of this kind fire again. */
+export declare function signalCheckable(kind: string): boolean;
+/** The persisted defect (or hang) record with this fingerprint in a raw `<stem>.result.json`. */
+export declare function persistedDefect(raw: unknown, fingerprint: string): Record<string, unknown> | undefined;
+/** What a defect's failing step is marked with: its actual signal, in one line (redacted). */
+export declare function defectSignalText(d: Record<string, unknown>, secrets: readonly string[]): string;
+/**
+ * Replays `recording` up to `stepIndex` with captions, the failing step marked, key screenshots and
+ * (when `video`) a clip — see the module comment. Never throws: a failure is `skipped` / `captureSkips`.
+ */
+export declare function replayWithEvidence(input: EvidenceReplayInput): Promise<DefectEvidence>;
+export interface AttachEvidenceOptions {
+    /** The run's persisted `<stem>.result.json`. */
+    readonly resultPath: string;
+    /** Record a clip per defect (`--evidence-video`); screenshots are always taken. Default true. */
+    readonly video?: boolean;
+    /** Where evidence goes (default `<stem>.evidence/` beside the result); one folder per defect. */
+    readonly dir?: string;
+    /** Every registered secret of the run: masked in pixels, redacted in text. */
+    readonly secrets?: readonly string[];
+    /** Overrides the storage state recorded with the run. */
+    readonly storageState?: string;
+    readonly browser?: BrowserRunOptions;
+    readonly browserPortFactory?: () => BrowserPort;
+    readonly paceMs?: number;
+    readonly maxDefects?: number;
+    readonly settleCeilingMs?: number;
+}
+/** `<dir>/<stem>.result.json` → `<dir>/<stem>.evidence`. */
+export declare function evidenceDirFor(resultPath: string): string;
+/**
+ * Captures evidence for a finished run's defects (hard ones first, at most `maxDefects`), writes it
+ * into the persisted result (`defects[].evidence`) and the defects' issue drafts, and returns the
+ * updated result. A run with no defects is returned unchanged (nothing replayed).
+ */
+export declare function attachDefectEvidence<R extends object>(result: R, opts: AttachEvidenceOptions): Promise<R>;
+/** The heading of a draft's media section (#250). */
+export declare const EVIDENCE_MEDIA_HEADING = "## Repro clip and screenshots";
+/** The Markdown media section of an issue draft (paths only; redacted, proven secret-free). */
+export declare function evidenceSection(e: DefectEvidence, secrets: readonly string[]): string;
+/**
+ * Files the run's drafts AFTER their evidence was attached (the run itself wrote drafts only), so
+ * a filed issue links to the media. Returns the result with `issues.filing` replaced.
+ */
+export declare function fileDraftsWithEvidence<R extends object>(result: R, config: FilingConfig, makeFiler: () => IssueFilerPort, nowIso: string): Promise<R>;
+/** The runner options `withRunEvidence` reads (every explore runner has them). */
+export interface RunEvidenceOptions {
+    readonly evidenceVideo?: boolean;
+    readonly browser?: BrowserRunOptions;
+    readonly browserPortFactory?: () => BrowserPort;
+    readonly storageState?: string;
+}
+/** A runner's evidence settings: on only with `evidenceVideo`, over the run's own secrets. */
+export declare function evidenceOf(opts: RunEvidenceOptions, secrets: readonly string[]): AttachEvidenceOptions | undefined;
+/** A written result with its defects' evidence attached (unchanged without `evidenceVideo`). */
+export declare function withRunEvidence<R extends {
+    readonly resultPath: string;
+}>(result: R, evidence: AttachEvidenceOptions | undefined): Promise<R>;