@juzser/blacksmith 0.3.0 → 0.5.0

package/factory/orchestrator/dist/cliName.js

@@ -0,0 +1,27 @@
+/**
+ * bs-rename, operator decision 3: `smith`/`smith-run` keep working as
+ * deprecated aliases of `bs`/`bs-run` for a transition period, each printing
+ * one deprecation line to stderr (never stdout -- stdout is parsed as JSON by
+ * playbooks) when invoked under the old name.
+ *
+ * Detection is argv[1]'s basename. `npm`/`pnpm`'s `bin` field creates one
+ * shim per key, and each is an unextended file (a symlink on POSIX) literally
+ * named after that key, sharing the same target script with its non-
+ * deprecated sibling -- so this reads back exactly what the operator typed to
+ * reach the running process, never the shared script file underneath it.
+ */
+import path from 'node:path';
+export function invokedName(argv1) {
+    return argv1 === undefined ? undefined : path.basename(argv1);
+}
+/**
+ * Writes the deprecation line when the current process was invoked as
+ * `legacyName`; a no-op for every other invocation, `currentName` included.
+ */
+export function warnIfLegacyName(argv1, legacyName, currentName, writeStderr = (text) => {
+    process.stderr.write(text);
+}) {
+    if (invokedName(argv1) !== legacyName)
+        return;
+    writeStderr(`${legacyName}: deprecated, use "${currentName}" instead -- ${legacyName} will be removed in a future release.\n`);
+}

package/factory/orchestrator/dist/crossFinding.js

@@ -123,6 +123,26 @@ export function reconcile(input) {
         if (!nativeByFingerprint.has(finding.fingerprint)) {
             nativeByFingerprint.set(finding.fingerprint, finding);
         }
+        // Also key by the fingerprint computeFingerprint() would produce for this
+        // record TODAY, not just the one stored at raise time. `input.native`
+        // comes straight out of listFindings() (a lineage-wide, possibly
+        // long-lived read) while `group.fingerprint` below is always computed
+        // fresh from the independent provider's evidence -- so a native finding
+        // raised before issue #178 widened the normalizer (its summary containing
+        // a line span the old algorithm did not strip) would otherwise never
+        // match an independent finder's evidence for the identical bug, and get
+        // reported as `co-located`/`independent-only` plus a duplicate
+        // `native-only` instead of `corroborated`.
+        if (finding.file_path !== undefined) {
+            const recomputed = computeFingerprint({
+                filePath: finding.file_path,
+                category: finding.finding_category,
+                summary: finding.summary,
+            });
+            if (!nativeByFingerprint.has(recomputed)) {
+                nativeByFingerprint.set(recomputed, finding);
+            }
+        }
         if (finding.file_path === undefined)
             continue;
         const key = coLocationKey(finding.file_path, finding.finding_category);

package/factory/orchestrator/dist/crosscheck.js

@@ -12,11 +12,27 @@
 // backward compatibility with the Phase-1 scaffold (it predates the transport
 // split and no longer carries meaning on its own — `transport` is now the
 // field that actually selects behavior).
-import { readFileSync } from 'node:fs';
+import { existsSync, readFileSync } from 'node:fs';
+import path from 'node:path';
 import { parse as parseYaml } from 'yaml';
+import { readEnv } from './env.js';
 import { SmithError } from './errors.js';
 import { CROSSCHECK_POLICY_PATH } from './paths.js';
 import { apiKeyPresent, commandOnPath } from './preconditions.js';
+/**
+ * OpenRouter (https://openrouter.ai/api/v1) speaks the same OpenAI
+ * chat/completions wire format api-transport.ts already sends, so it plays
+ * two roles here without a new transport module:
+ *
+ * - Substitute: a default external provider (codex, deepseek) whose own
+ *   precondition is unmet on this box runs through OpenRouter instead, using
+ *   `openrouter_fallback.model` from crosscheck.yml — same provider name,
+ *   mode and gating power, `via: 'openrouter'` recorded for the log.
+ * - Extra judge: `OPENROUTER_MODELS` (comma-separated model ids) synthesizes
+ *   additional `openrouter:<model>` providers, `mode: shadow` by default.
+ */
+const OPENROUTER_BASE_URL = 'https://openrouter.ai/api/v1';
+const OPENROUTER_API_KEY_ENV = 'OPENROUTER_API_KEY';
 export class CrosscheckError extends SmithError {
 }
 /**
@@ -246,6 +262,13 @@ function parseProvider(name, raw) {
             throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" has transport: cli but no command.`, { provider: name });
         }
         const command = quorumString(`providers.${name}.command`, raw.command);
+        // Computed unconditionally (not only under `auto`) so a substitution
+        // decision below can ask "can this provider run as declared" even when
+        // the file says `enabled: true` outright.
+        const preconditionMet = commandOnPath(command);
+        if (shouldSubstituteViaOpenrouter(declared, preconditionMet, raw.openrouter_fallback)) {
+            return substituteViaOpenrouter(name, mode, modelTier, raw.openrouter_fallback, enabledSource);
+        }
         return {
             name,
             kind: 'api',
@@ -254,7 +277,7 @@ function parseProvider(name, raw) {
             // binary runnable here. Not whether it is authenticated -- only a real
             // call knows that, so `auto` can still resolve true on a box where
             // `codex login` was never run, and the quorum records the failure.
-            enabled: declared === 'auto' ? commandOnPath(command) : declared,
+            enabled: declared === 'auto' ? preconditionMet : declared,
             enabledSource,
             mode,
             modelTier,
@@ -271,13 +294,18 @@ function parseProvider(name, raw) {
             throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" has transport: api but is missing base_url/model/api_key_env.`, { provider: name });
         }
         const apiKeyEnv = quorumString(`providers.${name}.api_key_env`, raw.api_key_env);
+        // Computed unconditionally for the same reason as the cli branch above.
+        const preconditionMet = apiKeyPresent(apiKeyEnv);
+        if (shouldSubstituteViaOpenrouter(declared, preconditionMet, raw.openrouter_fallback)) {
+            return substituteViaOpenrouter(name, mode, modelTier, raw.openrouter_fallback, enabledSource);
+        }
         return {
             name,
             kind: 'api',
             transport: 'api',
             // Set and non-empty, which is all that is knowable without spending a
             // call; whether the key is VALID is not.
-            enabled: declared === 'auto' ? apiKeyPresent(apiKeyEnv) : declared,
+            enabled: declared === 'auto' ? preconditionMet : declared,
             enabledSource,
             mode,
             modelTier,
@@ -292,6 +320,85 @@ function parseProvider(name, raw) {
     }
     throw new CrosscheckError('crosscheck.invalid-provider', `Provider "${name}" is not kind: native and has no recognized transport (got "${String(raw.transport)}").`, { provider: name, transport: raw.transport });
 }
+/**
+ * Operator decision 1a's eligibility rule: a provider substitutes through
+ * OpenRouter when it is not explicitly turned off (`enabled: false` stays an
+ * opt-out, whether the reason is cost, policy, or "I don't want a
+ * substitute"), its own precondition failed on this box, the policy names a
+ * fallback model for it, and OPENROUTER_API_KEY is actually set here.
+ */
+function shouldSubstituteViaOpenrouter(declared, preconditionMet, fallback) {
+    return (declared !== false &&
+        !preconditionMet &&
+        Boolean(fallback) &&
+        apiKeyPresent(OPENROUTER_API_KEY_ENV));
+}
+function substituteViaOpenrouter(name, mode, modelTier, fallback, enabledSource) {
+    const model = quorumString(`providers.${name}.openrouter_fallback.model`, fallback.model);
+    return {
+        name,
+        kind: 'api',
+        transport: 'api',
+        enabled: true,
+        enabledSource,
+        mode,
+        modelTier,
+        baseUrl: OPENROUTER_BASE_URL,
+        model,
+        apiKeyEnv: OPENROUTER_API_KEY_ENV,
+        responseFormatJsonObject: fallback.response_format_json_object ?? true,
+        via: 'openrouter',
+    };
+}
+/**
+ * `OPENROUTER_MODELS` (comma-separated OpenRouter model ids) synthesizes
+ * extra judges, operator decision 1b: `openrouter:<model>` as the provider
+ * name (deterministic, so a repeated run of the same env names the same
+ * provider), `mode: shadow` unless a project/policy overlay promotes it.
+ */
+function envOpenrouterProviders() {
+    const raw = (process.env.OPENROUTER_MODELS ?? '').trim();
+    if (!raw)
+        return {};
+    const providers = {};
+    for (const model of raw
+        .split(',')
+        .map((entry) => entry.trim())
+        .filter(Boolean)) {
+        providers[`openrouter:${model}`] = {
+            kind: 'api',
+            transport: 'api',
+            enabled: 'auto',
+            mode: 'shadow',
+            model_tier: DEFAULT_MODEL_TIER,
+            base_url: OPENROUTER_BASE_URL,
+            model,
+            api_key_env: OPENROUTER_API_KEY_ENV,
+        };
+    }
+    return providers;
+}
+/** `<project-dir>/.blacksmith/crosscheck.yml` — mirrors auditStorePath()'s STORE_DIR pattern in audit.ts. */
+export function crosscheckOverlayPath(projectDir) {
+    return path.join(path.resolve(projectDir), '.blacksmith', 'crosscheck.yml');
+}
+/**
+ * The per-project overlay (config source 1, highest precedence): only a
+ * `providers:` map is legal here, merged by provider name over env and the
+ * shipped policy. Quorum rules and everything else stay repo policy, so any
+ * other top-level key is refused loudly rather than silently ignored.
+ */
+export function loadProjectProviderOverlay(projectDir) {
+    const filePath = crosscheckOverlayPath(projectDir);
+    if (!existsSync(filePath))
+        return {};
+    const doc = (parseYaml(readFileSync(filePath, 'utf8')) ?? {});
+    const extraKeys = Object.keys(doc).filter((key) => key !== 'providers');
+    if (extraKeys.length > 0) {
+        throw new CrosscheckError('crosscheck.invalid-overlay', `${filePath} may only set "providers" -- rejected ${extraKeys.map((key) => JSON.stringify(key)).join(', ')}. Quorum rules and every other crosscheck.yml knob stay repo policy; only which providers run is a per-project decision.`, { file: filePath, keys: extraKeys });
+    }
+    return doc.providers ?? {};
+}
 /**
  * The isolation pair list, rebuilt entry by entry for quorumPairs()' reason:
  * a half-readable list is the same hole as no list. An empty list stays legal
@@ -359,9 +466,27 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
     if (!doc.providers || Object.keys(doc.providers).length === 0) {
         throw new CrosscheckError('crosscheck.invalid-policy', 'crosscheck.yml has no providers.');
     }
+    const declaredProviders = doc.providers;
+    const envProviders = envOpenrouterProviders();
+    const overlay = options.providerOverlay ?? {};
+    const names = new Set([
+        ...Object.keys(declaredProviders),
+        ...Object.keys(envProviders),
+        ...Object.keys(overlay),
+    ]);
     const providers = {};
-    for (const [name, raw] of Object.entries(doc.providers)) {
-        const config = parseProvider(name, raw ?? {});
+    for (const name of names) {
+        const fromPolicy = declaredProviders[name];
+        const fromEnv = envProviders[name];
+        const fromOverlay = overlay[name];
+        const merged = {
+            ...(fromPolicy ?? {}),
+            ...(fromEnv ?? {}),
+            ...(fromOverlay ?? {}),
+        };
+        const configSource = fromOverlay ? 'project' : fromEnv ? 'env' : 'policy';
+        const parsed = parseProvider(name, merged);
+        const config = parsed.kind === 'native' ? parsed : { ...parsed, configSource };
         providers[name] =
             options.offline && config.kind !== 'native'
                 ? // The switch is the decider now, and says so: a reader that saw
@@ -391,8 +516,9 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
     };
 }
 /**
- * Reads the policy, honouring `SMITH_CROSSCHECK_OFFLINE`: set it to anything
- * non-empty and no external provider can be invoked, whatever the file says.
+ * Reads the policy, honouring `BS_CROSSCHECK_OFFLINE` (or its legacy
+ * `SMITH_CROSSCHECK_OFFLINE` fallback): set it to anything non-empty and no
+ * external provider can be invoked, whatever the file says.
  *
  * The switch is read here rather than passed down from each call site because
  * the property it protects is process-wide — "this process makes no judge
@@ -401,7 +527,9 @@ export function parseCrosscheckPolicy(yamlText, options = {}) {
  * built binary as a subprocess; nothing else would reach them.
  */
 export function loadCrosscheckPolicy(filePath = CROSSCHECK_POLICY_PATH, options = {}) {
+    const { projectDir, ...rest } = options;
     return parseCrosscheckPolicy(readFileSync(filePath, 'utf8'), {
-        offline: options.offline ?? Boolean(process.env.SMITH_CROSSCHECK_OFFLINE),
+        offline: rest.offline ?? Boolean(readEnv(process.env, 'SMITH_CROSSCHECK_OFFLINE')),
+        providerOverlay: projectDir ? loadProjectProviderOverlay(projectDir) : rest.providerOverlay,
     });
 }