@kb-labs/policy-core 0.5.0

package/dist/cli/commands/check.js

@@ -0,0 +1,646 @@
+import { defineCommand, findRepoRoot, useConfig } from '@kb-labs/sdk';
+import { execSync, spawnSync } from 'child_process';
+import fs from 'fs';
+import path4 from 'path';
+import semver from 'semver';
+
+var __defProp = Object.defineProperty;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __esm = (fn, res) => function __init() {
+  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
+};
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+
+// src/core/category-resolver.ts
+var category_resolver_exports = {};
+__export(category_resolver_exports, {
+  detectCategories: () => detectCategories,
+  detectCategory: () => detectCategory
+});
+function matchesPattern(repoPath, pattern) {
+  const normalizedPath = repoPath.replace(/\/$/, "");
+  const normalizedPattern = pattern.replace(/\/$/, "");
+  if (normalizedPattern === normalizedPath) {
+    return true;
+  }
+  if (normalizedPattern.endsWith("/*")) {
+    const prefix = normalizedPattern.slice(0, -2);
+    const pathPrefix = normalizedPath.split("/").slice(0, prefix.split("/").length).join("/");
+    return pathPrefix === prefix;
+  }
+  if (normalizedPattern.includes("*")) {
+    const regexStr = normalizedPattern.replace(/[.+^${}()|[\]\\]/g, "\\$&").replace(/\*/g, "[^/]+");
+    return new RegExp(`^${regexStr}$`).test(normalizedPath);
+  }
+  return false;
+}
+function detectCategory(repoPath, config) {
+  for (const [categoryName, categoryConfig] of Object.entries(config.categories)) {
+    for (const pattern of categoryConfig.paths) {
+      if (matchesPattern(repoPath, pattern)) {
+        return {
+          path: repoPath,
+          category: categoryName,
+          rules: categoryConfig.rules
+        };
+      }
+    }
+  }
+  return {
+    path: repoPath,
+    category: null,
+    rules: ["boundary-check"]
+    // default fallback rule
+  };
+}
+function detectCategories(repoPaths, config) {
+  return repoPaths.map((p) => detectCategory(p, config));
+}
+var init_category_resolver = __esm({
+  "src/core/category-resolver.ts"() {
+  }
+});
+
+// src/cli/commands/check.ts
+init_category_resolver();
+
+// src/core/workspace-scanner.ts
+init_category_resolver();
+function buildPackageMap(workspaceRoot, config) {
+  const packages = scanAllPackages(workspaceRoot, config);
+  const map = /* @__PURE__ */ new Map();
+  for (const pkg of packages) {
+    map.set(pkg.name, pkg.category);
+  }
+  return map;
+}
+function getRepoPackageNames(workspaceRoot, repoPath) {
+  const absRepoPath = path4.resolve(workspaceRoot, repoPath);
+  const names = [];
+  for (const subdir of ["packages", "apps"]) {
+    const subdirPath = path4.join(absRepoPath, subdir);
+    if (!fs.existsSync(subdirPath)) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(subdirPath)) {
+      const pkgJsonPath = path4.join(subdirPath, entry, "package.json");
+      if (!fs.existsSync(pkgJsonPath)) {
+        continue;
+      }
+      try {
+        const json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+        if (json.name) {
+          names.push(json.name);
+        }
+      } catch {
+      }
+    }
+  }
+  return names;
+}
+function scanAllPackages(workspaceRoot, config) {
+  const results = [];
+  const topLevelDirs = ["platform", "plugins", "infra", "templates", "installer", "sites"];
+  for (const topDir of topLevelDirs) {
+    const topDirPath = path4.join(workspaceRoot, topDir);
+    if (!fs.existsSync(topDirPath)) {
+      continue;
+    }
+    for (const repoEntry of fs.readdirSync(topDirPath)) {
+      const repoPath = path4.join(topDirPath, repoEntry);
+      const repoRelPath = `${topDir}/${repoEntry}`;
+      let isDir;
+      try {
+        isDir = fs.statSync(repoPath).isDirectory();
+      } catch {
+        continue;
+      }
+      if (!isDir) {
+        continue;
+      }
+      const categoryResult = detectCategory(repoRelPath, config);
+      for (const subdir of ["packages", "apps"]) {
+        const subdirPath = path4.join(repoPath, subdir);
+        if (!fs.existsSync(subdirPath)) {
+          continue;
+        }
+        for (const pkgEntry of fs.readdirSync(subdirPath)) {
+          const pkgJsonPath = path4.join(subdirPath, pkgEntry, "package.json");
+          if (!fs.existsSync(pkgJsonPath)) {
+            continue;
+          }
+          try {
+            const json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+            if (json.name) {
+              results.push({
+                name: json.name,
+                repoPath: repoRelPath,
+                category: categoryResult.category,
+                packageJsonPath: pkgJsonPath
+              });
+            }
+          } catch {
+          }
+        }
+      }
+    }
+  }
+  return results;
+}
+
+// src/checks/sdk-only-deps.ts
+async function checkSdkOnlyDeps(repoPath, _config, workspaceRoot) {
+  const violations = [];
+  const absRepoPath = path4.resolve(workspaceRoot, repoPath);
+  const internalPackageNames = new Set(getRepoPackageNames(workspaceRoot, repoPath));
+  const packageJsonPaths = findPackageJsonPaths(absRepoPath);
+  for (const pkgJsonPath of packageJsonPaths) {
+    let json;
+    try {
+      json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    } catch {
+      continue;
+    }
+    const deps = Object.keys(json.dependencies ?? {});
+    const packageName = json.name ?? path4.basename(path4.dirname(pkgJsonPath));
+    const relPath = path4.relative(workspaceRoot, pkgJsonPath);
+    for (const dep of deps) {
+      if (!dep.startsWith("@kb-labs/")) {
+        continue;
+      }
+      if (dep === "@kb-labs/sdk") {
+        continue;
+      }
+      if (internalPackageNames.has(dep)) {
+        continue;
+      }
+      violations.push({
+        rule: "sdk-only-deps",
+        severity: "error",
+        message: `${packageName} imports ${dep} directly`,
+        package: packageName,
+        detail: `Plugins must depend only on @kb-labs/sdk. Move needed types to SDK or use SDK re-exports.`,
+        file: relPath
+      });
+    }
+  }
+  return violations;
+}
+function findPackageJsonPaths(absRepoPath) {
+  const results = [];
+  for (const subdir of ["packages", "apps"]) {
+    const subdirPath = path4.join(absRepoPath, subdir);
+    if (!fs.existsSync(subdirPath)) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(subdirPath)) {
+      const pkgJsonPath = path4.join(subdirPath, entry, "package.json");
+      if (fs.existsSync(pkgJsonPath)) {
+        results.push(pkgJsonPath);
+      }
+    }
+  }
+  return results;
+}
+async function checkBoundary(repoPath, config, workspaceRoot) {
+  const violations = [];
+  const { detectCategory: detectCategory2 } = await Promise.resolve().then(() => (init_category_resolver(), category_resolver_exports));
+  const categoryResult = detectCategory2(repoPath, config);
+  const category = categoryResult.category;
+  if (!category) {
+    return violations;
+  }
+  const boundaryRuleConfig = config.rules["boundary-check"]?.config;
+  const allowedCategories = boundaryRuleConfig?.allowed?.[category] ?? [];
+  if (allowedCategories.includes("sdk-only")) {
+    return checkSdkOnlyDeps(repoPath, config, workspaceRoot);
+  }
+  const packageMap = buildPackageMap(workspaceRoot, config);
+  const internalPackageNames = new Set(getRepoPackageNames(workspaceRoot, repoPath));
+  const absRepoPath = path4.resolve(workspaceRoot, repoPath);
+  for (const pkgJsonPath of findPackageJsonPaths2(absRepoPath)) {
+    let json;
+    try {
+      json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    } catch {
+      continue;
+    }
+    const deps = Object.keys(json.dependencies ?? {});
+    const packageName = json.name ?? path4.basename(path4.dirname(pkgJsonPath));
+    const relPath = path4.relative(workspaceRoot, pkgJsonPath);
+    for (const dep of deps) {
+      if (!dep.startsWith("@kb-labs/")) {
+        continue;
+      }
+      if (internalPackageNames.has(dep)) {
+        continue;
+      }
+      const depCategory = packageMap.get(dep);
+      if (depCategory === void 0 || depCategory === null) {
+        continue;
+      }
+      if (!allowedCategories.includes(depCategory)) {
+        violations.push({
+          rule: "boundary-check",
+          severity: "error",
+          message: `${packageName} depends on ${dep} (category: ${depCategory ?? "unknown"})`,
+          package: packageName,
+          detail: `Category "${category}" may only depend on: ${allowedCategories.join(", ")}`,
+          file: relPath
+        });
+      }
+    }
+  }
+  return violations;
+}
+function findPackageJsonPaths2(absRepoPath) {
+  const results = [];
+  for (const subdir of ["packages", "apps"]) {
+    const subdirPath = path4.join(absRepoPath, subdir);
+    if (!fs.existsSync(subdirPath)) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(subdirPath)) {
+      const pkgJsonPath = path4.join(subdirPath, entry, "package.json");
+      if (fs.existsSync(pkgJsonPath)) {
+        results.push(pkgJsonPath);
+      }
+    }
+  }
+  return results;
+}
+
+// src/checks/symbol-extractor.ts
+var RegexSymbolExtractor = class {
+  extract(dtsContent) {
+    const symbols = /* @__PURE__ */ new Set();
+    for (const m of dtsContent.matchAll(/^export\s+(?:async\s+)?function\s+(\w+)/gm)) {
+      symbols.add(m[1]);
+    }
+    for (const m of dtsContent.matchAll(/^export\s+(?:abstract\s+)?class\s+(\w+)/gm)) {
+      symbols.add(m[1]);
+    }
+    for (const m of dtsContent.matchAll(/^export\s+(?:type\s+|interface\s+)(\w+)/gm)) {
+      symbols.add(m[1]);
+    }
+    for (const m of dtsContent.matchAll(/^export\s+(?:const|let|var)\s+(\w+)/gm)) {
+      symbols.add(m[1]);
+    }
+    for (const m of dtsContent.matchAll(/^export\s+(?:const\s+)?enum\s+(\w+)/gm)) {
+      symbols.add(m[1]);
+    }
+    for (const m of dtsContent.matchAll(/^export\s+\{([^}]+)\}/gm)) {
+      const entries = m[1].split(",").map((s) => s.trim());
+      for (const entry of entries) {
+        const asMatch = entry.match(/\w+\s+as\s+(\w+)/);
+        if (asMatch) {
+          symbols.add(asMatch[1]);
+        } else {
+          const nameMatch = entry.match(/^(\w+)/);
+          if (nameMatch) {
+            symbols.add(nameMatch[1]);
+          }
+        }
+      }
+    }
+    if (/^export\s+default\s+/m.test(dtsContent)) {
+      symbols.add("default");
+    }
+    return symbols;
+  }
+};
+var defaultSymbolExtractor = new RegexSymbolExtractor();
+
+// src/checks/api-compat-check.ts
+var SNAPSHOTS_DIR = ".kb/api-snapshots";
+async function checkApiCompat(repoPath, _config, workspaceRoot) {
+  const violations = [];
+  const absRepoPath = path4.resolve(workspaceRoot, repoPath);
+  const packageJsonPaths = findPackageJsonPaths3(absRepoPath);
+  for (const pkgJsonPath of packageJsonPaths) {
+    let json;
+    try {
+      json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (!json.name || !json.version) {
+      continue;
+    }
+    const pkgName = json.name;
+    const currentVersion = json.version;
+    const snapshotPath = getSnapshotPath(workspaceRoot, pkgName);
+    const pkgDir = path4.dirname(pkgJsonPath);
+    const currentSymbols = extractSymbolsFromDist(pkgDir);
+    if (!fs.existsSync(snapshotPath)) {
+      console.warn(
+        `[policy] api-compat: No snapshot for ${pkgName} \u2014 run 'policy update-snapshots' to create one.`
+      );
+      continue;
+    }
+    let snapshot;
+    try {
+      snapshot = JSON.parse(fs.readFileSync(snapshotPath, "utf-8"));
+    } catch {
+      console.warn(`[policy] api-compat: Could not read snapshot for ${pkgName}, skipping.`);
+      continue;
+    }
+    const snapshotSymbols = new Set(snapshot.symbols);
+    const relPath = path4.relative(workspaceRoot, pkgJsonPath);
+    const removed = [];
+    for (const sym of snapshotSymbols) {
+      if (!currentSymbols.has(sym)) {
+        removed.push(sym);
+      }
+    }
+    if (removed.length > 0) {
+      const currentMajor = parseMajor(currentVersion);
+      const snapshotMajor = parseMajor(snapshot.version);
+      if (currentMajor <= snapshotMajor) {
+        violations.push({
+          rule: "api-compat-check",
+          severity: "error",
+          message: `${pkgName} removed exported symbols without major version bump`,
+          package: pkgName,
+          detail: `Removed: ${removed.join(", ")}. Bump major version (current: ${currentVersion}, snapshot: ${snapshot.version}) or restore symbols.`,
+          file: relPath
+        });
+      }
+    }
+  }
+  return violations;
+}
+function extractSymbolsFromDist(pkgDir) {
+  const distDir = path4.join(pkgDir, "dist");
+  const symbols = /* @__PURE__ */ new Set();
+  if (!fs.existsSync(distDir)) {
+    return symbols;
+  }
+  const dtsFiles = findDtsFiles(distDir);
+  for (const dtsFile of dtsFiles) {
+    const content = fs.readFileSync(dtsFile, "utf-8");
+    for (const sym of defaultSymbolExtractor.extract(content)) {
+      symbols.add(sym);
+    }
+  }
+  return symbols;
+}
+function findDtsFiles(dir) {
+  const results = [];
+  for (const entry of fs.readdirSync(dir, { withFileTypes: true })) {
+    const fullPath = path4.join(dir, entry.name);
+    if (entry.isDirectory()) {
+      results.push(...findDtsFiles(fullPath));
+    } else if (entry.name.endsWith(".d.ts")) {
+      results.push(fullPath);
+    }
+  }
+  return results;
+}
+function getSnapshotPath(workspaceRoot, packageName) {
+  const safeName = packageName.replace(/\//g, "__").replace(/@/g, "");
+  const snapshotsDir = path4.join(workspaceRoot, SNAPSHOTS_DIR);
+  if (!fs.existsSync(snapshotsDir)) {
+    fs.mkdirSync(snapshotsDir, { recursive: true });
+  }
+  return path4.join(snapshotsDir, `${safeName}.json`);
+}
+function parseMajor(version) {
+  return parseInt(version.split(".")[0] ?? "0", 10);
+}
+function findPackageJsonPaths3(absRepoPath) {
+  const results = [];
+  for (const subdir of ["packages", "apps"]) {
+    const subdirPath = path4.join(absRepoPath, subdir);
+    if (!fs.existsSync(subdirPath)) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(subdirPath)) {
+      const pkgJsonPath = path4.join(subdirPath, entry, "package.json");
+      if (fs.existsSync(pkgJsonPath)) {
+        results.push(pkgJsonPath);
+      }
+    }
+  }
+  return results;
+}
+async function checkNoRollback(repoPath, _config, workspaceRoot) {
+  const violations = [];
+  const absRepoPath = path4.resolve(workspaceRoot, repoPath);
+  const packageJsonPaths = findPackageJsonPaths4(absRepoPath);
+  for (const pkgJsonPath of packageJsonPaths) {
+    let json;
+    try {
+      json = JSON.parse(fs.readFileSync(pkgJsonPath, "utf-8"));
+    } catch {
+      continue;
+    }
+    if (!json.name || !json.version) {
+      continue;
+    }
+    if (json.private) {
+      continue;
+    }
+    const packageName = json.name;
+    const currentVersion = json.version;
+    const relPath = path4.relative(workspaceRoot, pkgJsonPath);
+    const publishedVersion = getPublishedVersion(packageName);
+    if (publishedVersion === null) {
+      continue;
+    }
+    if (!semver.gte(currentVersion, publishedVersion)) {
+      violations.push({
+        rule: "no-rollback",
+        severity: "error",
+        message: `${packageName} version ${currentVersion} is less than published ${publishedVersion}`,
+        package: packageName,
+        detail: `Cannot decrease version once published to npm. Restore to ${publishedVersion} or higher.`,
+        file: relPath
+      });
+    }
+  }
+  return violations;
+}
+function getPublishedVersion(packageName) {
+  const result = spawnSync("npm", ["show", packageName, "version", "--silent"], {
+    timeout: 1e4,
+    encoding: "utf-8",
+    stdio: ["ignore", "pipe", "ignore"]
+  });
+  if (result.error || result.status !== 0) {
+    return null;
+  }
+  return semver.valid(result.stdout.trim()) ?? null;
+}
+function findPackageJsonPaths4(absRepoPath) {
+  const results = [];
+  for (const subdir of ["packages", "apps"]) {
+    const subdirPath = path4.join(absRepoPath, subdir);
+    if (!fs.existsSync(subdirPath)) {
+      continue;
+    }
+    for (const entry of fs.readdirSync(subdirPath)) {
+      const pkgJsonPath = path4.join(subdirPath, entry, "package.json");
+      if (fs.existsSync(pkgJsonPath)) {
+        results.push(pkgJsonPath);
+      }
+    }
+  }
+  return results;
+}
+
+// src/core/policy-runner.ts
+var RULE_CHECKS = {
+  "sdk-only-deps": checkSdkOnlyDeps,
+  "boundary-check": checkBoundary,
+  "no-breaking-without-major": checkApiCompat,
+  "no-rollback": checkNoRollback,
+  "api-compat-check": checkApiCompat
+};
+async function runChecks(repos, config, workspaceRoot) {
+  const repoResults = [];
+  for (const repo of repos) {
+    const violations = [];
+    const passed = [];
+    const rulesToRun = repo.rules;
+    for (const rule of rulesToRun) {
+      const checkFn = RULE_CHECKS[rule];
+      if (!checkFn) {
+        console.warn(`[policy] Unknown rule: ${rule} (skipping)`);
+        continue;
+      }
+      let ruleViolations;
+      try {
+        ruleViolations = await checkFn(repo.path, config, workspaceRoot);
+      } catch (err) {
+        console.warn(`[policy] Rule '${rule}' threw an unexpected error (skipping): ${err.message}`);
+        continue;
+      }
+      if (ruleViolations.length === 0) {
+        passed.push(rule);
+      } else {
+        violations.push(...ruleViolations.map((v) => ({ ...v, rule })));
+      }
+    }
+    repoResults.push({
+      path: repo.path,
+      category: repo.category,
+      violations,
+      passed
+    });
+  }
+  const totalViolations = repoResults.reduce((sum, r) => sum + r.violations.length, 0);
+  const failedRepos = repoResults.filter((r) => r.violations.length > 0).length;
+  return {
+    passed: totalViolations === 0,
+    repos: repoResults,
+    summary: {
+      total: repos.length,
+      passed: repos.length - failedRepos,
+      failed: failedRepos,
+      violations: totalViolations
+    }
+  };
+}
+
+// src/cli/commands/check.ts
+var check_default = defineCommand({
+  id: "policy:check",
+  description: "Run policy checks for changed repos or a specific path. Exits with code 1 on violations.",
+  handler: {
+    async execute(ctx, input) {
+      const flags = input.flags ?? input;
+      const workspaceRoot = await findRepoRoot(ctx.cwd) ?? ctx.cwd;
+      const policyConfig = await useConfig();
+      if (!policyConfig?.categories) {
+        ctx.ui.error('No policies config found in .kb/kb.config.json (expected "policies" key)');
+        const emptyReport = {
+          passed: false,
+          repos: [],
+          summary: { total: 0, passed: 0, failed: 0, violations: 0 }
+        };
+        if (flags.json) {
+          ctx.ui.json?.({ passed: false, error: "No policies config" });
+        }
+        return { exitCode: 1, report: emptyReport };
+      }
+      const repoPaths = flags.path ? [flags.path] : detectChangedRepos(workspaceRoot);
+      const repos = repoPaths.map((p) => detectCategory(p, policyConfig));
+      for (const r of repos) {
+        if (!r.category) {
+          ctx.ui.warn?.(`Repo ${r.path} has no category \u2014 applying default rules: ${r.rules.join(", ")}`);
+        }
+      }
+      const report = await runChecks(repos, policyConfig, workspaceRoot);
+      if (flags.json) {
+        ctx.ui.json?.(report);
+      } else {
+        renderHumanReport(ctx, report);
+      }
+      return { exitCode: report.passed ? 0 : 1, report };
+    }
+  }
+});
+function renderHumanReport(ctx, report) {
+  const lines = [];
+  for (const repo of report.repos) {
+    const cat = repo.category ?? "(no category)";
+    lines.push(`
+${repo.path} (category: ${cat})`);
+    for (const violation of repo.violations) {
+      lines.push(`  \u274C ${violation.rule}`);
+      lines.push(`     ${violation.message}`);
+      if (violation.detail) {
+        lines.push(`     \u2192 ${violation.detail}`);
+      }
+    }
+    for (const passed2 of repo.passed) {
+      lines.push(`  \u2705 ${passed2}`);
+    }
+  }
+  const { total, passed, failed, violations } = report.summary;
+  const summaryLine = report.passed ? `\u2705 All ${total} repo(s) passed` : `\u274C ${violations} violation(s) found in ${failed}/${total} repo(s) \u2014 pipeline blocked`;
+  if (report.passed) {
+    ctx.ui.success?.("Policy Check", {
+      sections: [
+        { header: "Results", items: lines },
+        { header: "Summary", items: [`${passed}/${total} passed`] }
+      ]
+    });
+  } else {
+    ctx.ui.error(`Policy Check Failed
+${lines.join("\n")}
+
+${summaryLine}`);
+  }
+}
+function detectChangedRepos(workspaceRoot) {
+  try {
+    const output = execSync("git diff --name-only HEAD 2>/dev/null || git diff --name-only", {
+      cwd: workspaceRoot,
+      encoding: "utf-8",
+      timeout: 1e4
+    });
+    const repoSet = /* @__PURE__ */ new Set();
+    for (const file of output.trim().split("\n").filter(Boolean)) {
+      const parts = file.split("/");
+      if (parts.length >= 2) {
+        const topDir = parts[0];
+        const repoDir = parts[1];
+        if (["platform", "plugins", "infra", "templates", "installer", "sites"].includes(topDir)) {
+          repoSet.add(`${topDir}/${repoDir}`);
+        }
+      }
+    }
+    return Array.from(repoSet);
+  } catch {
+    return [];
+  }
+}
+
+export { check_default as default };
+//# sourceMappingURL=check.js.map
+//# sourceMappingURL=check.js.map