@malmhq/intermesh-cli 0.1.0

package/dist/generation/scripts/repair-loop.mjs

@@ -0,0 +1,519 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { copyFile, mkdir, readFile, readdir, rm, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+
+const findingLimit = 8_000;
+const maximumFindings = 20;
+const excludedDirectories = new Set(['node_modules', 'dist']);
+const excludedFiles = new Set(['.DS_Store']);
+
+function record(value, name) {
+  if (!value || typeof value !== 'object' || Array.isArray(value))
+    throw new TypeError(`${name} is invalid`);
+  return value;
+}
+
+function safeText(value, name) {
+  if (typeof value !== 'string' || value.trim() === '') throw new TypeError(`${name} is invalid`);
+  return value.trim().slice(0, findingLimit);
+}
+
+function secrets(environment) {
+  return Object.entries(environment)
+    .filter(
+      ([name, value]) =>
+        typeof value === 'string' &&
+        value.length >= 8 &&
+        /(KEY|TOKEN|SECRET|PASSWORD)/iu.test(name),
+    )
+    .map(([, value]) => value);
+}
+
+function sanitize(value, environment) {
+  let output = String(value);
+  for (const secret of secrets(environment)) output = output.replaceAll(secret, '[redacted]');
+  return output
+    .replace(/Bearer\s+[^\s"']+/giu, 'Bearer [redacted]')
+    .replace(/((?:api[_-]?key|token|secret|password)\s*[=:]\s*)[^\s,"']+/giu, '$1[redacted]')
+    .slice(-findingLimit);
+}
+
+async function sha256(path) {
+  return createHash('sha256')
+    .update(await readFile(path))
+    .digest('hex');
+}
+
+async function filesBelow(directory, prefix = '', ignoredDirectories = new Set()) {
+  const result = [];
+  for (const entry of await readdir(directory, { withFileTypes: true })) {
+    const path = prefix ? `${prefix}/${entry.name}` : entry.name;
+    if (entry.isDirectory() && !ignoredDirectories.has(entry.name))
+      result.push(...(await filesBelow(join(directory, entry.name), path, ignoredDirectories)));
+    else if (entry.isFile()) result.push(path);
+    else if (entry.isDirectory()) continue;
+    else throw new TypeError(`Unsupported package file: ${path}`);
+  }
+  return result;
+}
+
+export async function sourceTreeHash(packageDirectory, protectedPaths) {
+  const files = await sourceTreeSnapshot(packageDirectory, protectedPaths);
+  return snapshotHash(files);
+}
+
+function snapshotHash(files) {
+  const hash = createHash('sha256');
+  for (const [path, fileHash] of files)
+    hash.update(path).update('\0').update(fileHash).update('\0');
+  return hash.digest('hex');
+}
+
+async function sourceTreeSnapshot(packageDirectory, protectedPaths) {
+  const protectedSet = new Set(protectedPaths);
+  const paths = (await filesBelow(packageDirectory, '', excludedDirectories))
+    .filter((path) => {
+      const parts = path.split('/');
+      return !protectedSet.has(path) && !excludedFiles.has(parts.at(-1)) && !path.endsWith('.tgz');
+    })
+    .sort();
+  return new Map(
+    await Promise.all(
+      paths.map(async (path) => [path, await sha256(join(packageDirectory, path))]),
+    ),
+  );
+}
+
+function changedPaths(before, after) {
+  return [...new Set([...before.keys(), ...after.keys()])]
+    .filter((path) => before.get(path) !== after.get(path))
+    .sort();
+}
+
+export async function verifyInputIntegrity(inputDirectory, expected) {
+  for (const [path, expectedHash] of Object.entries(record(expected, 'Input manifest'))) {
+    const pathParts = path.split('/');
+    if (
+      !/^[a-zA-Z0-9._-]+(?:\/[a-zA-Z0-9._-]+)*$/u.test(path) ||
+      pathParts.includes('.') ||
+      pathParts.includes('..') ||
+      typeof expectedHash !== 'string' ||
+      !/^[a-f0-9]{64}$/u.test(expectedHash)
+    )
+      throw new TypeError('Input manifest is invalid');
+    const actual = await sha256(resolve(inputDirectory, path)).catch(() => '');
+    if (actual !== expectedHash) throw new TypeError(`Generation input changed: ${path}`);
+  }
+}
+
+function protectedDirectories(paths) {
+  return [
+    'src/auth',
+    'src/shared',
+    'src/lifecycle',
+    ...new Set(
+      paths
+        .filter((path) => /^skills\/[a-z0-9-]+-cli-management\//u.test(path))
+        .map((path) => path.split('/').slice(0, 2).join('/')),
+    ),
+  ];
+}
+
+async function verifyFoundation(packageDirectory, foundation) {
+  const paths = Object.keys(foundation).sort();
+  const directories = protectedDirectories(paths);
+  const actual = (
+    await Promise.all(
+      directories.map((path) => filesBelow(join(packageDirectory, path), path).catch(() => [])),
+    )
+  )
+    .flat()
+    .sort();
+  const expected = paths.filter((path) =>
+    directories.some((directory) => path.startsWith(`${directory}/`)),
+  );
+  if (actual.join('\0') !== expected.join('\0')) return false;
+  for (const [path, expectedHash] of Object.entries(foundation)) {
+    if ((await sha256(join(packageDirectory, path)).catch(() => '')) !== expectedHash) return false;
+  }
+  return true;
+}
+
+async function restoreFoundation(packageDirectory, backupDirectory, foundation) {
+  const paths = Object.keys(foundation).sort();
+  for (const directory of protectedDirectories(paths)) {
+    await rm(join(packageDirectory, directory), { recursive: true, force: true });
+  }
+  for (const path of paths) {
+    const backup = join(backupDirectory, path);
+    if ((await sha256(backup).catch(() => '')) !== foundation[path])
+      throw new TypeError(`Protected foundation backup is invalid: ${path}`);
+    await mkdir(dirname(join(packageDirectory, path)), { recursive: true });
+    await copyFile(backup, join(packageDirectory, path));
+  }
+  if (!(await verifyFoundation(packageDirectory, foundation)))
+    throw new TypeError('Protected foundation could not be restored');
+}
+
+async function ensureFoundation(packageDirectory, backupDirectory, foundation) {
+  if (await verifyFoundation(packageDirectory, foundation)) return false;
+  await restoreFoundation(packageDirectory, backupDirectory, foundation);
+  return true;
+}
+
+async function run(command, args, options) {
+  const remaining = options.deadline === undefined ? undefined : options.deadline - Date.now();
+  if (remaining !== undefined && remaining <= 0) throw new TypeError('Generation deadline reached');
+  return new Promise((resolvePromise, reject) => {
+    const child = spawn(command, args, {
+      cwd: options.cwd,
+      env: options.environment,
+      signal: options.signal,
+      stdio: 'inherit',
+    });
+    let forceTimer;
+    const timer =
+      remaining === undefined
+        ? undefined
+        : setTimeout(() => {
+            child.kill('SIGTERM');
+            forceTimer = setTimeout(() => child.kill('SIGKILL'), 2_000);
+          }, remaining);
+    child.once('error', (error) => {
+      clearTimeout(timer);
+      if (forceTimer) clearTimeout(forceTimer);
+      reject(error);
+    });
+    child.once('close', (code, signal) => {
+      clearTimeout(timer);
+      if (forceTimer) clearTimeout(forceTimer);
+      resolvePromise({ code: code ?? 1, signal });
+    });
+  });
+}
+
+async function stage(options, name, operation) {
+  await writeFile(join(options.notes, 'current-stage'), name);
+  await run(process.execPath, [options.stageTimings, 'start', options.timingPath, name], options);
+  try {
+    const result = await operation();
+    await run(
+      process.execPath,
+      [
+        options.stageTimings,
+        'finish',
+        options.timingPath,
+        name,
+        result.code === 0 ? 'passed' : 'failed',
+      ],
+      options,
+    );
+    return result;
+  } catch (error) {
+    await run(
+      process.execPath,
+      [options.stageTimings, 'finish', options.timingPath, name, 'failed'],
+      options,
+    ).catch(() => {});
+    throw error;
+  }
+}
+
+async function readJson(path, name) {
+  return record(JSON.parse(await readFile(path, 'utf8')), name);
+}
+
+async function appendHistory(options, attempt) {
+  options.history.attempts.push(attempt);
+  await writeFile(options.historyPath, `${JSON.stringify(options.history, null, 2)}\n`);
+}
+
+async function protectFoundation(options, cycle, stage) {
+  if (
+    !(await ensureFoundation(options.packageDirectory, options.backupDirectory, options.foundation))
+  )
+    return;
+  options.history.foundation_restorations.push({ cycle, stage });
+  await writeFile(options.historyPath, `${JSON.stringify(options.history, null, 2)}\n`);
+}
+
+async function repair(options, source, findings) {
+  const attempt = options.history.attempts.length + 1;
+  const beforeFiles = await sourceTreeSnapshot(
+    options.packageDirectory,
+    Object.keys(options.foundation),
+  );
+  const before = snapshotHash(beforeFiles);
+  const request = {
+    attempt,
+    source,
+    findings: findings
+      .slice(0, maximumFindings)
+      .map((finding) => sanitize(finding, options.environment)),
+  };
+  await writeFile(options.repairRequestPath, `${JSON.stringify(request, null, 2)}\n`);
+  const started = Date.now();
+  const result = await run(
+    options.opencode,
+    [
+      'run',
+      '--session',
+      options.leadSessionId,
+      '--agent',
+      'generation-builder',
+      '--format',
+      'json',
+      '--auto',
+      'Read .generation/repair-request.json. Correct each finding across affected implementation, focused tests, README and Skills. Check sibling response variants for the same requirement, run affected focused checks, and return control.',
+    ],
+    options,
+  );
+  const foundationRestored = await ensureFoundation(
+    options.packageDirectory,
+    options.backupDirectory,
+    options.foundation,
+  );
+  const afterFiles = await sourceTreeSnapshot(
+    options.packageDirectory,
+    Object.keys(options.foundation),
+  );
+  const after = snapshotHash(afterFiles);
+  const changed = changedPaths(beforeFiles, afterFiles);
+  for (const path of changed) options.changedSinceReview.add(path);
+  const outcome =
+    result.code !== 0 ? 'agent_failed' : before === after ? 'no_progress' : 'repaired';
+  await appendHistory(options, {
+    attempt,
+    source,
+    findings: request.findings,
+    source_hash_before: before,
+    source_hash_after: after,
+    changed_paths: changed,
+    duration_ms: Date.now() - started,
+    foundation_restored: foundationRestored,
+    outcome,
+  });
+  if (result.code !== 0) throw new TypeError('OpenCode repair session failed');
+  if (outcome === 'no_progress') throw new TypeError('Repair made no relevant source change');
+}
+
+function reviewerFindings(summary) {
+  if (!Array.isArray(summary.reviews)) throw new TypeError('Reviewer summary is invalid');
+  const findings = [];
+  let blocked = false;
+  for (const reviewValue of summary.reviews) {
+    const review = record(reviewValue, 'Reviewer result');
+    if (review.verdict === 'blocked') blocked = true;
+    if (!Array.isArray(review.findings)) throw new TypeError('Reviewer findings are invalid');
+    for (const findingValue of review.findings) {
+      const finding = record(findingValue, 'Reviewer finding');
+      findings.push(
+        `[${safeText(finding.area, 'Reviewer finding area')}] ${safeText(finding.message, 'Reviewer finding message')}`,
+      );
+    }
+  }
+  return { blocked, findings };
+}
+
+async function reviewContext(options) {
+  if (!options.reviewAnchor) return { mode: 'full' };
+  const anchor = options.reviewAnchor;
+  const summary = await readJson(anchor.summary_path, 'Anchored reviewer summary').catch(
+    () => undefined,
+  );
+  if (
+    !summary ||
+    !Array.isArray(summary.reviews) ||
+    summary.reviews.length === 0 ||
+    JSON.stringify(summary.reviews).length > 100_000 ||
+    summary.candidate_sha256 !== anchor.candidate_sha256 ||
+    (await sha256(anchor.summary_path).catch(() => '')) !== anchor.summary_sha256
+  )
+    return { mode: 'full' };
+  const recorded = new Set(
+    options.history.attempts
+      .slice(anchor.attempt_count)
+      .flatMap((attempt) => attempt.changed_paths ?? []),
+  );
+  const changed = [...options.changedSinceReview].sort();
+  if (changed.length > 1_000 || changed.join('\0') !== [...recorded].sort().join('\0'))
+    return { mode: 'full' };
+  return {
+    mode: 'focused',
+    anchor,
+    prior_reviews: summary.reviews,
+    outstanding_findings: options.outstandingFindings,
+    changed_paths: changed,
+  };
+}
+
+async function promoteCycle(options, cycle) {
+  const receiptPath = join(cycle, 'candidate-verification.json');
+  const receipt = await readJson(receiptPath, 'Candidate verification');
+  const review = await readJson(join(cycle, 'reviewer-summary.json'), 'Reviewer summary');
+  if (receipt.passed !== true || review.passed !== true || review.candidate_unchanged !== true)
+    throw new TypeError('Passing candidate cycle is invalid');
+  if (receipt.tarball !== 'candidate.tgz') throw new TypeError('Candidate tarball is invalid');
+  const tarballPath = join(cycle, receipt.tarball);
+  const tarballHash = await sha256(tarballPath);
+  if (tarballHash !== receipt.tarball_sha256)
+    throw new TypeError('Reviewed candidate tarball hash does not match');
+  await copyFile(receiptPath, join(options.notes, 'candidate-verification.json'));
+  await copyFile(
+    join(cycle, 'reviewer-summary.json'),
+    join(options.notes, 'reviewer-summary.json'),
+  );
+  await copyFile(tarballPath, join(options.notes, 'candidate.tgz'));
+  if ((await sha256(join(options.notes, 'candidate.tgz'))) !== tarballHash)
+    throw new TypeError('Promoted candidate tarball hash does not match');
+}
+
+export async function runRepairLoop(input) {
+  const notes = resolve(input.cwd, '.generation');
+  const foundation = record(
+    JSON.parse(await readFile(input.foundationManifest, 'utf8')),
+    'Foundation manifest',
+  );
+  for (const [path, hash] of Object.entries(foundation)) {
+    if (typeof path !== 'string' || typeof hash !== 'string' || !/^[a-f0-9]{64}$/u.test(hash))
+      throw new TypeError('Foundation manifest is invalid');
+  }
+  const options = {
+    ...input,
+    notes,
+    packageDirectory: resolve(input.cwd, input.packageDirectory),
+    backupDirectory: resolve(input.backupDirectory),
+    cyclesDirectory: join(notes, 'cycles'),
+    historyPath: join(notes, 'repair-history.json'),
+    repairRequestPath: join(notes, 'repair-request.json'),
+    timingPath: join(notes, 'stage-timings.json'),
+    foundation,
+    history: { schema_version: '1.0.0', attempts: [], foundation_restorations: [] },
+    changedSinceReview: new Set(),
+  };
+  await mkdir(options.cyclesDirectory, { recursive: true });
+  await writeFile(options.historyPath, `${JSON.stringify(options.history, null, 2)}\n`, {
+    flag: 'wx',
+  });
+  let lastFinding;
+  let repeatedFindingCount = 0;
+  for (let cycleNumber = 1; ; cycleNumber += 1) {
+    if (options.deadline !== undefined && Date.now() >= options.deadline)
+      throw new TypeError('Generation deadline reached');
+    await verifyInputIntegrity(join(options.cwd, 'inputs'), options.inputHashes);
+    await protectFoundation(options, cycleNumber, 'before_verification');
+    const cycle = join(options.cyclesDirectory, String(cycleNumber));
+    await mkdir(cycle);
+    const verificationPath = join(cycle, 'candidate-verification.json');
+    const verificationEnvironment = { ...options.environment };
+    delete verificationEnvironment.DEEPSEEK_API_KEY;
+    delete verificationEnvironment.OPENROUTER_API_KEY;
+    const verification = await stage(options, 'candidate_verification', () =>
+      run(
+        process.execPath,
+        [options.verifier, input.packageDirectory, input.requestPath, verificationPath],
+        { ...options, environment: verificationEnvironment },
+      ),
+    );
+    if (verification.code !== 0) {
+      const result = await readJson(verificationPath, 'Candidate verification failure');
+      const finding = safeText(result.finding, 'Candidate verification finding');
+      repeatedFindingCount = finding === lastFinding ? repeatedFindingCount + 1 : 1;
+      lastFinding = finding;
+      if (repeatedFindingCount >= 3)
+        throw new TypeError('The same candidate verification finding survived two repairs');
+      await repair(options, 'candidate_verification', [finding]);
+      continue;
+    }
+    lastFinding = undefined;
+    repeatedFindingCount = 0;
+    const reviewPath = join(cycle, 'reviewer-summary.json');
+    const reviewContextPath = join(options.notes, 'review-context.json');
+    await writeFile(
+      reviewContextPath,
+      `${JSON.stringify(await reviewContext(options), null, 2)}\n`,
+    );
+    const reviewResult = await stage(options, 'independent_review', () =>
+      run(process.execPath, [options.reviewers, verificationPath, reviewPath], options),
+    );
+    const summary = await readJson(reviewPath, 'Reviewer summary');
+    const reviewed = reviewerFindings(summary);
+    const receipt = await readJson(verificationPath, 'Candidate verification');
+    if (summary.candidate_sha256 !== receipt.tarball_sha256)
+      throw new TypeError('Reviewer summary does not match the candidate');
+    options.reviewAnchor = {
+      cycle: cycleNumber,
+      candidate_sha256: receipt.tarball_sha256,
+      summary_path: reviewPath,
+      summary_sha256: await sha256(reviewPath),
+      attempt_count: options.history.attempts.length,
+    };
+    options.outstandingFindings = reviewed.findings;
+    options.changedSinceReview.clear();
+    if (reviewed.blocked) throw new TypeError('Independent review is blocked');
+    if (reviewResult.code !== 0 || summary.passed !== true) {
+      if (reviewed.findings.length === 0) throw new TypeError('Independent review failed');
+      await repair(options, 'independent_review', reviewed.findings);
+      continue;
+    }
+    await protectFoundation(options, cycleNumber, 'after_review');
+    await promoteCycle(options, cycle);
+    return options.history;
+  }
+}
+
+function argumentsFrom(argv) {
+  const values = {};
+  for (let index = 0; index < argv.length; index += 2) {
+    const name = argv[index];
+    const value = argv[index + 1];
+    if (!name?.startsWith('--') || value === undefined)
+      throw new TypeError('Repair arguments are invalid');
+    values[name.slice(2)] = value;
+  }
+  return values;
+}
+
+if (
+  globalThis.__INTERMESH_BUNDLED__ !== true &&
+  process.argv[1] === new URL(import.meta.url).pathname
+) {
+  const values = argumentsFrom(process.argv.slice(2));
+  const required = [
+    'cwd',
+    'package',
+    'request',
+    'verifier',
+    'reviewers',
+    'opencode',
+    'lead-session',
+    'foundation-backup',
+    'foundation-manifest',
+    'stage-timings',
+    'input-manifest',
+  ];
+  for (const name of required) safeText(values[name], name);
+  const deadline = values.deadline === undefined ? undefined : Number(values.deadline);
+  if (deadline !== undefined && (!Number.isSafeInteger(deadline) || deadline <= 0))
+    throw new TypeError('Deadline is invalid');
+  const inputHashes = record(
+    JSON.parse(await readFile(values['input-manifest'], 'utf8')),
+    'Input manifest',
+  );
+  await runRepairLoop({
+    cwd: resolve(values.cwd),
+    packageDirectory: values.package,
+    requestPath: values.request,
+    verifier: values.verifier,
+    reviewers: values.reviewers,
+    opencode: values.opencode,
+    leadSessionId: values['lead-session'],
+    ...(deadline === undefined ? {} : { deadline }),
+    backupDirectory: values['foundation-backup'],
+    foundationManifest: values['foundation-manifest'],
+    stageTimings: values['stage-timings'],
+    environment: process.env,
+    inputHashes,
+  });
+}