@lsctech/polaris 0.5.6 → 0.5.8

package/dist/qc/repair-packets.js

@@ -0,0 +1,420 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.GOVERNANCE_SCOPE_PATTERNS = void 0;
+exports.isHighRiskCategory = isHighRiskCategory;
+exports.getRepairRoundDir = getRepairRoundDir;
+exports.getRepairPacketManifestPath = getRepairPacketManifestPath;
+exports.compileRepairPackets = compileRepairPackets;
+exports.writeRepairPacketManifest = writeRepairPacketManifest;
+exports.compileAndWriteRepairPackets = compileAndWriteRepairPackets;
+exports.readRepairPacketManifest = readRepairPacketManifest;
+const node_fs_1 = require("node:fs");
+const path = __importStar(require("node:path"));
+const severity_js_1 = require("./severity.js");
+const routing_js_1 = require("./routing.js");
+const schemas_js_1 = require("./schemas.js");
+/** Scope patterns that autonomous repair packets must not touch. */
+exports.GOVERNANCE_SCOPE_PATTERNS = [
+    "**/.polaris/**",
+    "**/.taskchain_artifacts/**",
+    "**/polaris.config.*",
+    "**/package.json",
+    "**/tsconfig*.json",
+    "**/.github/**",
+    "**/policy*",
+    "**/governance*",
+];
+const HIGH_RISK_CATEGORY_PATTERN = /security|secret|vulnerability|vuln|auth|crypto|injection|xss|csrf|sql|data-loss|migration|governance|compliance|privacy|pii|gdpr|hipaa/i;
+/** Determine whether a finding category is high-risk/sensitive. */
+function isHighRiskCategory(category) {
+    if (!category)
+        return false;
+    return HIGH_RISK_CATEGORY_PATTERN.test(category);
+}
+function riskLevel(finding) {
+    return isHighRiskCategory(finding.category) ? "high-risk" : "normal";
+}
+function confidenceBand(finding) {
+    return finding.attribution.confidence === "high" || finding.attribution.confidence === "medium"
+        ? "clear"
+        : "unclear";
+}
+function subsystemFromFilePath(filePath) {
+    if (!filePath)
+        return "unknown";
+    const lastSlash = filePath.lastIndexOf("/");
+    return lastSlash === -1 ? "root" : filePath.slice(0, lastSlash);
+}
+function enrichFinding(finding, config, sourceQcRunId) {
+    return {
+        ...finding,
+        routingTarget: resolveRoutingTarget(finding, config),
+        risk: riskLevel(finding),
+        confidenceBand: confidenceBand(finding),
+        subsystem: subsystemFromFilePath(finding.filePath),
+        sourceQcRunId,
+    };
+}
+/**
+ * Resolve the routing target for a finding, applying conservative safety overrides
+ * before falling back to the pre-computed routing decision or the routing policy.
+ */
+function resolveRoutingTarget(finding, config) {
+    // Critical/high severity or high-risk categories are escalated to operator review.
+    if ((0, severity_js_1.compareSeverity)(finding.severity, "high") >= 0 || riskLevel(finding) === "high-risk") {
+        return "operator-review";
+    }
+    // Broad findings without a concrete file path cannot be safely dispatched to repair workers.
+    if (!finding.filePath) {
+        return (0, severity_js_1.compareSeverity)(finding.severity, "high") >= 0 ? "operator-review" : "follow-up";
+    }
+    // Pre-existing findings are deferred unless severity already escalated above.
+    if (finding.attribution.reason === "pre-existing") {
+        return "follow-up";
+    }
+    // Low/unattributed confidence is not safe for autonomous repair.
+    if (finding.attribution.confidence === "low" || finding.attribution.confidence === "unattributed") {
+        return finding.attribution.childId ? "repair-worker" : "follow-up";
+    }
+    return finding.routingDecision ?? (0, routing_js_1.decideRepairRouting)(finding, config, finding.autofixEligible);
+}
+function rangesOverlapOrAdjacent(a, b, adjacency = 5) {
+    if (!a || !b)
+        return false;
+    const aStart = a.startLine ?? 1;
+    const aEnd = a.endLine ?? a.startLine ?? 1;
+    const bStart = b.startLine ?? 1;
+    const bEnd = b.endLine ?? b.startLine ?? 1;
+    return !(aEnd + adjacency < bStart || bEnd + adjacency < aStart);
+}
+/**
+ * Conservative grouping predicate.
+ *
+ * Findings in the same file are always grouped under the same routing target
+ * and risk level to avoid parallel edit conflicts. Cross-file grouping requires
+ * an exact match on severity, attribution confidence, category, and a specific
+ * subsystem directory (at least one path segment deep) so top-level directories
+ * do not collapse unrelated files.
+ */
+function shouldGroup(a, b) {
+    if (a.routingTarget !== b.routingTarget)
+        return false;
+    if (a.risk !== b.risk)
+        return false;
+    const sameFile = a.filePath && b.filePath && a.filePath === b.filePath;
+    if (sameFile)
+        return true;
+    const sameCategory = a.category && b.category && a.category === b.category;
+    const sameSubsystem = a.subsystem !== "unknown" && a.subsystem === b.subsystem;
+    const specificSubsystem = sameSubsystem && a.subsystem.includes("/");
+    if (a.severity === b.severity &&
+        a.confidenceBand === b.confidenceBand &&
+        sameCategory &&
+        specificSubsystem) {
+        return true;
+    }
+    return false;
+}
+class UnionFind {
+    parent;
+    constructor(size) {
+        this.parent = Array.from({ length: size }, (_, i) => i);
+    }
+    find(x) {
+        if (this.parent[x] !== x) {
+            this.parent[x] = this.find(this.parent[x]);
+        }
+        return this.parent[x];
+    }
+    union(a, b) {
+        const ra = this.find(a);
+        const rb = this.find(b);
+        if (ra !== rb) {
+            // Deterministic: lower index becomes root.
+            this.parent[rb] = ra;
+        }
+    }
+}
+function groupFindings(findings) {
+    const sorted = [...findings].sort((a, b) => a.findingId.localeCompare(b.findingId));
+    const uf = new UnionFind(sorted.length);
+    for (let i = 0; i < sorted.length; i++) {
+        for (let j = i + 1; j < sorted.length; j++) {
+            if (shouldGroup(sorted[i], sorted[j])) {
+                uf.union(i, j);
+            }
+        }
+    }
+    const groups = new Map();
+    for (let i = 0; i < sorted.length; i++) {
+        const root = uf.find(i);
+        if (!groups.has(root)) {
+            groups.set(root, []);
+        }
+        groups.get(root).push(sorted[i]);
+    }
+    return [...groups.values()].sort((a, b) => a[0].findingId.localeCompare(b[0].findingId));
+}
+function buildProviderFailurePacket(result, index, clusterId, round, createdAt) {
+    const packetId = `pkt-${clusterId}-r${round}-${String(index).padStart(3, "0")}`;
+    return {
+        packetId,
+        round,
+        clusterId,
+        sourceQcRunIds: [result.qcRunId],
+        findingIds: [],
+        severityFloor: "critical",
+        rootCauseHint: `provider failure: ${result.status}; operator review required`,
+        allowedScope: [],
+        prohibitedScope: ["**/*"],
+        validationCommands: [],
+        routingTarget: "operator-review",
+        parallelGroup: null,
+        conflicts: [],
+        medic: true,
+        status: "pending",
+        createdAt,
+    };
+}
+function buildPacket(group, index, clusterId, round, allRunIds, validationCommands, createdAt) {
+    const packetId = `pkt-${clusterId}-r${round}-${String(index).padStart(3, "0")}`;
+    const findingIds = group.map((f) => f.findingId).sort();
+    const sourceRunIds = [...new Set(group.map((f) => f.sourceQcRunId))].sort();
+    const severityFloor = group.reduce((acc, f) => (0, severity_js_1.maxSeverity)(acc, f.severity), "info");
+    const categories = [...new Set(group.map((f) => f.category).filter(Boolean))].sort();
+    const filePaths = group.map((f) => f.filePath).filter((f) => Boolean(f));
+    const files = [...new Set(filePaths)].sort();
+    const rootCauseHint = [
+        `categories=[${categories.join(", ") || "uncategorized"}]`,
+        `files=[${files.join(", ") || "none"}]`,
+        `confidence=${group[0]?.confidenceBand ?? "clear"}`,
+        `severity=${severityFloor}`,
+    ].join("; ");
+    const hasHighRisk = group.some((f) => f.risk === "high-risk");
+    const medic = group[0].routingTarget === "operator-review" &&
+        ((0, severity_js_1.compareSeverity)(severityFloor, "high") >= 0 || hasHighRisk);
+    return {
+        packetId,
+        round,
+        clusterId,
+        sourceQcRunIds: sourceRunIds.length > 0 ? sourceRunIds : allRunIds,
+        findingIds,
+        severityFloor,
+        rootCauseHint,
+        allowedScope: files,
+        prohibitedScope: hasHighRisk ? exports.GOVERNANCE_SCOPE_PATTERNS : [],
+        validationCommands,
+        routingTarget: group[0].routingTarget,
+        parallelGroup: null,
+        conflicts: [],
+        medic,
+        status: "pending",
+        createdAt,
+    };
+}
+function scopeOverlap(a, b) {
+    const aScope = new Set([...a.allowedScope, ...a.prohibitedScope]);
+    const bScope = new Set([...b.allowedScope, ...b.prohibitedScope]);
+    for (const s of aScope) {
+        if (bScope.has(s))
+            return true;
+    }
+    return false;
+}
+function packetsConflict(a, b) {
+    // Medic packets are never parallel-safe.
+    if (a.medic || b.medic)
+        return true;
+    return scopeOverlap(a, b);
+}
+function assignParallelGroups(packets) {
+    const sorted = [...packets].sort((a, b) => a.packetId.localeCompare(b.packetId));
+    const groups = [];
+    for (const packet of sorted) {
+        let assigned = false;
+        for (let i = 0; i < groups.length; i++) {
+            if (!groups[i].some((p) => packetsConflict(p, packet))) {
+                groups[i].push(packet);
+                assigned = true;
+                break;
+            }
+        }
+        if (!assigned) {
+            groups.push([packet]);
+        }
+    }
+    const packetToGroup = new Map();
+    groups.forEach((g, i) => g.forEach((p) => packetToGroup.set(p.packetId, i)));
+    return sorted.map((packet) => {
+        const groupIndex = packetToGroup.get(packet.packetId);
+        const conflicts = sorted
+            .filter((p) => p.packetId !== packet.packetId && packetsConflict(packet, p))
+            .map((p) => p.packetId)
+            .sort();
+        return {
+            ...packet,
+            parallelGroup: groupIndex === undefined ? null : `g-${String(groupIndex).padStart(3, "0")}`,
+            conflicts,
+        };
+    });
+}
+/** Returns the directory for a repair-round manifest. */
+function getRepairRoundDir(clusterId, round, repoRoot) {
+    return path.join(repoRoot || process.cwd(), ".polaris", "clusters", clusterId, "qc", "repair-rounds", String(round));
+}
+/** Returns the persisted path for a repair-round manifest. */
+function getRepairPacketManifestPath(clusterId, round, repoRoot) {
+    return path.join(getRepairRoundDir(clusterId, round, repoRoot), "repair-packets.json");
+}
+/**
+ * Compile normalized QC findings into cluster-scoped repair packet manifests.
+ *
+ * The compiler is deterministic for the same inputs (grouping, conflict detection,
+ * and parallel group assignment are stable) and is conservative about merging
+ * unrelated security/auth/data-loss/migration/governance findings with normal repairs.
+ */
+function compileRepairPackets(input) {
+    const { clusterId, round, qcResults, config, validationCommands = [], repoRoot, compiledAt = new Date().toISOString(), } = input;
+    const sortedResults = [...qcResults].sort((a, b) => a.qcRunId.localeCompare(b.qcRunId));
+    const allRunIds = sortedResults.map((r) => r.qcRunId);
+    const packets = [];
+    // Provider failure artifacts that require operator review are surfaced as Medic packets.
+    for (const result of sortedResults) {
+        if (result.allProvidersFailed || result.status === "failed" || result.status === "blocked") {
+            packets.push(buildProviderFailurePacket(result, packets.length, clusterId, round, compiledAt));
+        }
+    }
+    // Actionable findings from successful runs.
+    const actionableFindings = [];
+    for (const result of sortedResults) {
+        if (result.status === "failed" || result.status === "blocked") {
+            continue;
+        }
+        for (const finding of result.findings) {
+            if (finding.status === "waived" ||
+                finding.status === "autofixed" ||
+                finding.status === "repaired") {
+                continue;
+            }
+            actionableFindings.push(enrichFinding(finding, config, result.qcRunId));
+        }
+    }
+    // Deduplicate by findingId; keep first occurrence in sorted run order.
+    const seenIds = new Set();
+    const uniqueFindings = [];
+    for (const finding of actionableFindings) {
+        if (seenIds.has(finding.findingId))
+            continue;
+        seenIds.add(finding.findingId);
+        uniqueFindings.push(finding);
+    }
+    const groups = groupFindings(uniqueFindings);
+    for (const group of groups) {
+        packets.push(buildPacket(group, packets.length, clusterId, round, allRunIds, validationCommands, compiledAt));
+    }
+    const finalPackets = assignParallelGroups(packets);
+    const manifest = {
+        schemaVersion: "1.0",
+        clusterId,
+        round,
+        compiledAt,
+        sourceQcRunIds: allRunIds,
+        packets: finalPackets,
+    };
+    const manifestPath = getRepairPacketManifestPath(clusterId, round, repoRoot);
+    return {
+        clusterId,
+        round,
+        packets: finalPackets,
+        manifest,
+        manifestPath,
+    };
+}
+/**
+ * Persist a compiled repair packet manifest as a durable cluster artifact.
+ * Writes atomically via a temp file + rename and returns the absolute path.
+ */
+function writeRepairPacketManifest(manifest, repoRoot) {
+    const manifestPath = getRepairPacketManifestPath(manifest.clusterId, manifest.round, repoRoot);
+    const dir = path.dirname(manifestPath);
+    (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    const tempPath = `${manifestPath}.tmp.${process.pid}.${Date.now()}.${Math.random().toString(36).slice(2, 8)}`;
+    try {
+        (0, node_fs_1.writeFileSync)(tempPath, JSON.stringify(manifest, null, 2), "utf-8");
+        (0, node_fs_1.renameSync)(tempPath, manifestPath);
+    }
+    catch (error) {
+        try {
+            (0, node_fs_1.unlinkSync)(tempPath);
+        }
+        catch {
+            // Ignore cleanup failure.
+        }
+        throw error;
+    }
+    return manifestPath;
+}
+/** Convenience helper that compiles and persists repair packets in one call. */
+function compileAndWriteRepairPackets(input) {
+    const result = compileRepairPackets(input);
+    writeRepairPacketManifest(result.manifest, input.repoRoot);
+    return result;
+}
+/**
+ * Read and validate a persisted repair packet manifest.
+ * Returns null if the file is missing or fails schema validation.
+ */
+function readRepairPacketManifest(clusterId, round, repoRoot) {
+    const manifestPath = getRepairPacketManifestPath(clusterId, round, repoRoot);
+    try {
+        const data = (0, node_fs_1.readFileSync)(manifestPath, "utf-8");
+        const parsed = JSON.parse(data);
+        const validation = (0, schemas_js_1.validateRepairPacketManifest)(parsed);
+        if (!validation.success) {
+            return null;
+        }
+        return validation.manifest;
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            return null;
+        }
+        if (error instanceof SyntaxError) {
+            return null;
+        }
+        throw error;
+    }
+}