@juzser/blacksmith 0.2.0 → 0.4.0

package/factory/orchestrator/dist/policy.js

@@ -39,8 +39,20 @@ export class PolicyError extends SmithError {
  * that reason: it is the mechanism that keeps a tester out of the code it is
  * grading, and a policy that cannot name it either blocks the tester
  * entirely or lets it mark its own homework.
+ *
+ * The list is closed in both directions. Every id here must appear in
+ * guardrails.yml, for the reasons above; and every id guardrails.yml declares
+ * must appear here, because a rule is a row in that file *plus* a branch in
+ * this one that looks the row up. A row with no branch parses, counts and
+ * prints like the others and enforces nothing — the file says the door is
+ * shut and no one is standing at it. So the name is what the evaluator
+ * consults, not what the file happens to carry, and `GuardrailRuleId` below
+ * makes the compiler hold every `requireRule`/`sandboxViolation` call site to
+ * it. What no type can check is a stale entry — an id left here after its
+ * branch was deleted — so policy.test.ts scrapes the call sites back out of
+ * this file and holds them against the list.
  */
-const REQUIRED_RULE_IDS = [
+export const EVALUATED_RULE_IDS = [
     'push-to-protected',
     'force-push',
     'merge-into-protected',
@@ -52,6 +64,7 @@ const REQUIRED_RULE_IDS = [
     'judge-sandbox-escape',
     'role-write-scope',
 ];
+const EVALUATED_RULE_ID_SET = new Set(EVALUATED_RULE_IDS);
 function isStringArray(value) {
     return Array.isArray(value) && value.every((v) => typeof v === 'string');
 }
@@ -80,8 +93,15 @@ function parseCommandSpecs(raw, key) {
         return { command: e.command, subcommands: e.subcommands };
     });
 }
-/** Fold one `rules:` list into the shared id-keyed map. Used for the top-level list and the judge_sandbox one. */
-function collectRules(raw, into, key) {
+/**
+ * Fold one `rules:` list into the shared id-keyed map, used for the top-level
+ * list and the two block-level ones. `declaredIn` remembers which block each
+ * id came from, so a second definition can be refused by name rather than
+ * overwriting the first: the folds run in source order, and a plain `set`
+ * would leave the last block read holding the rule while the file still reads
+ * as if the first one did.
+ */
+function collectRules(raw, into, declaredIn, key) {
     if (!Array.isArray(raw)) {
         throw new PolicyError('policy.invalid-document', `guardrails.yml is missing ${key} (a list).`, {
             key,
@@ -94,6 +114,11 @@ function collectRules(raw, into, key) {
             typeof r.reason !== 'string') {
             throw new PolicyError('policy.invalid-document', `guardrails.yml has a rule in ${key} missing a string id/severity/reason.`, { key, rule: entry });
         }
+        const already = declaredIn.get(r.id);
+        if (already !== undefined) {
+            throw new PolicyError('policy.invalid-document', `guardrails.yml declares rule "${r.id}" in both ${already} and ${key}; a rule gets one definition, not two.`, { rule: r.id, declaredIn: already, redeclaredIn: key });
+        }
+        declaredIn.set(r.id, key);
         into.set(r.id, {
             id: r.id,
             severity: r.severity,
@@ -194,10 +219,16 @@ export function parseGuardrailPolicy(yamlText) {
     }
     const roleWriteScopes = parseRoleWriteScopes(rawScopes.scopes, judgeSandbox.roles);
     const rules = new Map();
-    collectRules(doc.rules, rules, 'rules');
-    collectRules(rawSandbox.rules, rules, 'judge_sandbox.rules');
-    collectRules(rawScopes.rules, rules, 'role_write_scopes.rules');
-    for (const requiredId of REQUIRED_RULE_IDS) {
+    const declaredIn = new Map();
+    collectRules(doc.rules, rules, declaredIn, 'rules');
+    collectRules(rawSandbox.rules, rules, declaredIn, 'judge_sandbox.rules');
+    collectRules(rawScopes.rules, rules, declaredIn, 'role_write_scopes.rules');
+    for (const [declaredId, key] of declaredIn) {
+        if (!EVALUATED_RULE_ID_SET.has(declaredId)) {
+            throw new PolicyError('policy.invalid-document', `guardrails.yml declares rule "${declaredId}" in ${key}, which nothing in the evaluator consults; a rule with no branch to fire it enforces nothing.`, { rule: declaredId, key });
+        }
+    }
+    for (const requiredId of EVALUATED_RULE_IDS) {
         if (!rules.has(requiredId)) {
             throw new PolicyError('policy.invalid-document', `guardrails.yml is missing required rule "${requiredId}".`, { rule: requiredId });
         }
@@ -365,20 +396,35 @@ function renderBranch(template, branch) {
  * inspect, not a hardcoded branch in `evaluateCommand` — a second Bash-like
  * tool added later is a one-line change here, not new control flow.
  */
-const INSPECTED_TOOLS = ['Bash'];
+export const INSPECTED_TOOLS = ['Bash'];
 /**
  * Tools whose `file_path` this policy inspects — the write path that does
  * not go through a shell. Nothing here has a command to match, so only the
  * lease rules can fire on them; the base six are all about shell commands
  * and no-op on an empty one.
+ *
+ * Exported because this evaluator is not the only place that has to know
+ * which tools write a file. `harness.ts` asks the same question from the
+ * other side: a `cli` judge is refused a worktree unless its `judge_args`
+ * deny every one of these, and a new write tool added here is a tool that
+ * harness has to start denying on the same commit. Held to that shipped
+ * policy, and to the guard hook's own `matcher`, by policy.test.ts.
  */
-const INSPECTED_FILE_TOOLS = ['Write', 'Edit', 'MultiEdit', 'NotebookEdit'];
+export const INSPECTED_FILE_TOOLS = [
+    'Write',
+    'Edit',
+    'MultiEdit',
+    'NotebookEdit',
+];
 function requireRule(policy, id) {
     const rule = policy.rules.get(id);
     if (!rule) {
         // Unreachable once a policy has passed parseGuardrailPolicy (which
-        // requires every id in REQUIRED_RULE_IDS) — this is a defensive
-        // safety-net, not a real code path.
+        // requires every id in EVALUATED_RULE_IDS) — this is a defensive
+        // safety-net, not a real code path. Taking a `GuardrailRuleId` rather
+        // than a string is the other half: a call site that invents an id the
+        // roster does not carry does not compile, so the only way to reach a
+        // rule from here is to have declared it as one.
         throw new PolicyError('policy.missing-rule', `guardrails.yml has no rule "${id}".`, {
             rule: id,
         });

package/factory/orchestrator/dist/projects.js

@@ -32,7 +32,7 @@
 // silent exactly when somebody is editing (D-21).
 import { existsSync } from 'node:fs';
 import path from 'node:path';
-import { PROJECTS_DIR, REPO_ROOT, WORKSPACES_DIR } from './paths.js';
+import { isFactoryCheckout, PROJECTS_DIR, REPO_ROOT, WORKSPACES_DIR } from './paths.js';
 import { FACTORY_PROJECT, loadRoadmap } from './roadmap.js';
 function collectProjects(opts) {
     const roots = opts.roots ?? [PROJECTS_DIR, WORKSPACES_DIR];
@@ -58,6 +58,17 @@ function collectProjects(opts) {
             missing.push({ name, roots });
             continue;
         }
+        // Dedupe by name alone is not enough: a self-audit's cut can stamp this
+        // clone's OWN directory name onto a milestone rather than FACTORY_PROJECT
+        // (audit.ts's `auditedProjectName`), and that name is never in `seen`.
+        // Left unchecked, `firstCheckout` resolves it to REPO_ROOT -- PROJECTS_DIR
+        // is this clone's own parent -- and this clone gets registered a second
+        // time as a foreign, non-self ref that `--no-self` cannot filter
+        // (`resolveProjectDirs` only ever drops the entry at index 0). Self
+        // already leads `refs`; a checkout that resolves to REPO_ROOT is that
+        // entry under another name, so it is skipped rather than pushed again.
+        if (isFactoryCheckout(dir))
+            continue;
         refs.push({ name, dir, self: false });
     }
     return { refs, missing };