@malmhq/intermesh-cli 0.1.0

package/dist/generation/scripts/run-reviewers.mjs

@@ -0,0 +1,306 @@
+import { spawn } from 'node:child_process';
+import { createHash } from 'node:crypto';
+import { mkdir, readFile, writeFile } from 'node:fs/promises';
+import { dirname, join, resolve } from 'node:path';
+import { prepareOpenCodeDependencies } from './prepare-opencode.mjs';
+import { startRuntimeCapture } from './runtime-capture.mjs';
+
+const agents = ['generation-fidelity'];
+const resultPattern = /REVIEW_RESULT:\s*(\{[^\n]+\})/gu;
+const outputLimit = 10 * 1024 * 1024;
+const retainedReportLimit = 100_000;
+const findingLimit = 8_000;
+const areas = new Set(['cli', 'skill', 'cross-cutting', 'unknown']);
+
+function positiveInteger(value, fallback, name) {
+  const parsed = value === undefined ? fallback : Number(value);
+  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new TypeError(`${name} is invalid`);
+  return parsed;
+}
+
+function redact(value, secrets) {
+  return secrets.reduce((text, secret) => text.replaceAll(secret, '[REDACTED]'), value);
+}
+
+function resultText(output) {
+  return output
+    .split('\n')
+    .map((line) => {
+      try {
+        const event = JSON.parse(line);
+        return typeof event?.part?.text === 'string' ? event.part.text : line;
+      } catch {
+        return line;
+      }
+    })
+    .join('\n');
+}
+
+function parseResult(output) {
+  const source = [...resultText(output).matchAll(resultPattern)].at(-1)?.[1];
+  if (!source) return;
+  try {
+    const value = JSON.parse(source);
+    if (!value || !['passed', 'needs-fix', 'blocked'].includes(value.verdict)) return;
+    if (!Array.isArray(value.findings)) return;
+    const findings = value.findings.map((finding) => {
+      if (!finding || !areas.has(finding.area) || typeof finding.message !== 'string')
+        throw new TypeError('Invalid finding');
+      const message = finding.message.trim().slice(0, findingLimit);
+      if (!message) throw new TypeError('Invalid finding');
+      return { area: finding.area, message };
+    });
+    if (value.verdict === 'passed' && findings.length !== 0) return;
+    if (value.verdict === 'needs-fix' && findings.length === 0) return;
+    const reason =
+      typeof value.reason === 'string' ? value.reason.trim().slice(0, findingLimit) : '';
+    if (value.verdict === 'blocked' && !reason) return;
+    return { verdict: value.verdict, findings, ...(reason ? { reason } : {}) };
+  } catch {
+    return;
+  }
+}
+
+async function sha256(path) {
+  return createHash('sha256')
+    .update(await readFile(path))
+    .digest('hex');
+}
+
+async function matchesHash(path, expected) {
+  return sha256(path)
+    .then((actual) => actual === expected)
+    .catch(() => false);
+}
+
+async function attemptReview(options, agent, attempt) {
+  const chunks = [];
+  let bytes = 0;
+  let lastActivity = Date.now();
+  let reason;
+  let forceTimer;
+  const state = join(options.cwd, '.generation', 'harness-data', 'reviews', agent);
+  await mkdir(state, { recursive: true });
+  const environment = {
+    ...options.environment,
+    XDG_CONFIG_HOME: join(state, 'config'),
+    XDG_DATA_HOME: join(state, 'data'),
+    XDG_CACHE_HOME: join(state, 'cache'),
+    XDG_STATE_HOME: join(state, 'state'),
+  };
+  await (options.prepareOpenCodeDependencies ?? prepareOpenCodeDependencies)([
+    join(environment.XDG_CONFIG_HOME, 'opencode'),
+  ]);
+  const child = spawn(options.opencode, ['run', '--agent', agent, '--format', 'json', '--auto'], {
+    cwd: options.cwd,
+    env: environment,
+    stdio: ['pipe', 'pipe', 'pipe'],
+  });
+  const capture =
+    environment.INTERMESH_DEBUG_RUNTIME === '1'
+      ? startRuntimeCapture(
+          join(options.cwd, '.generation/runtime-debug', `${agent}-${attempt}`),
+          options.secrets,
+        )
+      : undefined;
+  child.stderr.on('data', (chunk) => capture?.stderr(chunk));
+  child.once('close', (code, signal) => {
+    capture?.finish({ code, signal });
+    if (capture?.errors.length) process.stderr.write('Diagnostic capture incomplete\n');
+  });
+  const stop = (nextReason) => {
+    if (reason) return;
+    reason = nextReason;
+    child.kill('SIGTERM');
+    forceTimer = setTimeout(() => child.kill('SIGKILL'), 2_000);
+  };
+  const cancel = () => stop('cancelled');
+  options.signal?.addEventListener('abort', cancel, { once: true });
+  if (options.signal?.aborted) cancel();
+  const collect = (chunk) => {
+    lastActivity = Date.now();
+    bytes += chunk.length;
+    if (bytes <= outputLimit) chunks.push(chunk);
+    else stop('output-limit');
+  };
+  child.stdout.on('data', collect);
+  child.stderr.on('data', collect);
+  child.stdin.on('error', () => {});
+  child.stdin.end(options.prompt);
+  const hardTimer = setTimeout(() => stop('hard-timeout'), options.hardTimeoutMs);
+  const idleTimer = setInterval(() => {
+    if (Date.now() - lastActivity >= options.idleMs) stop('idle-timeout');
+  }, options.pollMs);
+  const exit = await new Promise((resolveExit) => {
+    child.once('error', () => resolveExit({ code: 1, spawnError: true }));
+    child.once('close', (code) => resolveExit({ code: code ?? 1, spawnError: false }));
+  }).finally(() => {
+    clearTimeout(hardTimer);
+    clearInterval(idleTimer);
+    if (forceTimer) clearTimeout(forceTimer);
+    options.signal?.removeEventListener('abort', cancel);
+  });
+  const output = redact(Buffer.concat(chunks).toString('utf8'), options.secrets);
+  await writeFile(
+    join(options.cwd, '.generation', 'reviews', `${agent}-attempt-${attempt}.jsonl`),
+    output,
+  );
+  const result = parseResult(output);
+  return {
+    exit_code: exit.code,
+    reason:
+      reason ??
+      (exit.spawnError
+        ? 'spawn-error'
+        : exit.code === 0 && result
+          ? 'completed'
+          : 'invalid-result'),
+    result,
+    report: output.slice(-retainedReportLimit),
+  };
+}
+
+async function review(options, agent) {
+  const started = Date.now();
+  for (let attempt = 1; attempt <= 2; attempt += 1) {
+    const result = await attemptReview(options, agent, attempt);
+    if (result.exit_code === 0 && result.result) {
+      return {
+        agent,
+        ...result.result,
+        ...(result.result.reason ? { blocked_reason: result.result.reason } : {}),
+        attempts: attempt,
+        reason: result.reason,
+        duration_ms: Date.now() - started,
+        report: result.report,
+      };
+    }
+    if (attempt === 2)
+      return {
+        agent,
+        verdict: 'blocked',
+        findings: [],
+        attempts: attempt,
+        reason: result.reason,
+        duration_ms: Date.now() - started,
+        report: result.report,
+      };
+  }
+  throw new Error('Unreachable reviewer state');
+}
+
+export async function runReviewers({
+  cwd,
+  opencode = 'opencode',
+  prompt,
+  environment = process.env,
+  idleMs = 600_000,
+  hardTimeoutMs = 1_200_000,
+  pollMs = 1_000,
+  signal,
+  authority,
+  candidate,
+  prepareOpenCodeDependencies: prepareDependencies,
+}) {
+  const options = {
+    cwd: resolve(cwd),
+    opencode,
+    prompt,
+    environment,
+    idleMs: positiveInteger(idleMs, 600_000, 'Idle timeout'),
+    hardTimeoutMs: positiveInteger(hardTimeoutMs, 1_200_000, 'Hard timeout'),
+    pollMs: positiveInteger(pollMs, 1_000, 'Poll interval'),
+    signal,
+    authority,
+    candidate,
+    prepareOpenCodeDependencies: prepareDependencies,
+    secrets: ['OPENROUTER_API_KEY', 'DEEPSEEK_API_KEY']
+      .map((name) => environment[name])
+      .filter((value) => typeof value === 'string' && value.length > 0),
+  };
+  await mkdir(join(options.cwd, '.generation', 'reviews'), { recursive: true });
+  const expectedHash = candidate?.sha256;
+  const candidatePath = candidate?.path && resolve(options.cwd, candidate.path);
+  const candidateWasValid = candidatePath ? await matchesHash(candidatePath, expectedHash) : true;
+  const authorityHash = options.authority?.sha256;
+  const authorityPath = options.authority?.path && resolve(options.cwd, options.authority.path);
+  const authorityWasValid = authorityPath ? await matchesHash(authorityPath, authorityHash) : true;
+  const reviews = await Promise.all(agents.map((agent) => review(options, agent)));
+  const candidateUnchanged = candidatePath
+    ? candidateWasValid && (await matchesHash(candidatePath, expectedHash))
+    : true;
+  const authorityUnchanged = authorityPath
+    ? authorityWasValid && (await matchesHash(authorityPath, authorityHash))
+    : true;
+  return {
+    passed:
+      candidateUnchanged &&
+      authorityUnchanged &&
+      reviews.every(({ verdict }) => verdict === 'passed'),
+    candidate_unchanged: candidateUnchanged,
+    authority_unchanged: authorityUnchanged,
+    reviews,
+  };
+}
+
+async function main() {
+  const [verificationPath, reportPath] = process.argv.slice(2);
+  if (!verificationPath || !reportPath)
+    throw new TypeError('Expected verification and report paths');
+  const verification = JSON.parse(await readFile(verificationPath, 'utf8'));
+  if (
+    verification.passed !== true ||
+    typeof verification.tarball !== 'string' ||
+    typeof verification.tarball_sha256 !== 'string'
+  )
+    throw new TypeError('Candidate verification is invalid');
+  const tarball = join(dirname(verificationPath), verification.tarball);
+  const approvedProposal = await readFile('.generation/approved-proposal.json', 'utf8')
+    .then(() => ' Read .generation/approved-proposal.json as the exact human-approved authority.')
+    .catch(() => '');
+  const reviewContext = await readFile('.generation/review-context.json', 'utf8').catch(
+    () => '{"mode":"full"}',
+  );
+  const prompt = `Review the exact candidate tarball at ${tarball} with SHA-256 ${verification.tarball_sha256}. Its submitted package files are available read-only at package/. Read inputs/run-request.json and its original source paths.${approvedProposal} Read the passing verification receipt at ${verificationPath}; accept its build, tests, packaging, install, help and structural results without repeating them. Review context: ${reviewContext} If mode is focused, verify every outstanding finding and changed path plus concrete affected dependencies; otherwise perform one full API fidelity, business meaning and safety review. Target three minutes and execute only focused checks for named suspected mismatches. Report insufficient evidence as blocked. Do not change the submitted package. Return findings and evidence, then end with exactly one line: REVIEW_RESULT: {"verdict":"passed","findings":[]}. Verdict may be passed, needs-fix, or blocked. Finding area must be cli, skill, cross-cutting, or unknown. needs-fix requires findings; blocked requires a reason.`;
+  const controller = new AbortController();
+  const cancel = () => controller.abort();
+  process.once('SIGINT', cancel);
+  process.once('SIGTERM', cancel);
+  try {
+    const result = await runReviewers({
+      cwd: process.cwd(),
+      opencode: process.env.OPENCODE_BIN ?? 'opencode',
+      prompt,
+      idleMs: process.env.REVIEW_IDLE_MS,
+      hardTimeoutMs: process.env.REVIEW_HARD_TIMEOUT_MS,
+      pollMs: process.env.REVIEW_POLL_MS,
+      signal: controller.signal,
+      candidate: { path: tarball, sha256: verification.tarball_sha256 },
+      ...(approvedProposal
+        ? {
+            authority: {
+              path: '.generation/approved-proposal.json',
+              sha256:
+                process.env.INTERMESH_APPROVED_PROPOSAL_HASH ??
+                (await sha256('.generation/approved-proposal.json')),
+            },
+          }
+        : {}),
+    });
+    await writeFile(
+      reportPath,
+      JSON.stringify({ ...result, candidate_sha256: verification.tarball_sha256 }, null, 2),
+      { flag: 'wx' },
+    );
+    if (!result.passed) process.exitCode = 1;
+  } finally {
+    process.off('SIGINT', cancel);
+    process.off('SIGTERM', cancel);
+  }
+}
+
+if (
+  globalThis.__INTERMESH_BUNDLED__ !== true &&
+  process.argv[1] === new URL(import.meta.url).pathname
+)
+  main();

package/dist/generation/scripts/runtime-capture.mjs

@@ -0,0 +1,119 @@
+import { appendFileSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { StringDecoder } from 'node:string_decoder';
+
+const limit = 256 * 1024;
+
+export function startRuntimeCapture(directory, secrets) {
+  const errors = [];
+  const startedAt = new Date().toISOString();
+  const decoder = new StringDecoder('utf8');
+  let pending = '';
+  let dropping = false;
+  let tail = '';
+  let truncated = false;
+  let resourceBytes = 0;
+  let finished = false;
+  const attempt = (operation) => {
+    try {
+      operation();
+    } catch {
+      if (!errors.includes('Diagnostic capture incomplete'))
+        errors.push('Diagnostic capture incomplete');
+    }
+  };
+  const redact = (text) => {
+    for (const secret of secrets.filter(Boolean)) text = text.replaceAll(secret, '[redacted]');
+    return text
+      .replace(/Bearer\s+[^\s"']+/giu, 'Bearer [redacted]')
+      .replace(/((?:api[_-]?key|token|secret|password)\s*[=:]\s*)[^\s,"']+/giu, '$1[redacted]');
+  };
+  const retain = (line) => {
+    tail += redact(line);
+    if (Buffer.byteLength(tail) > limit) {
+      tail = Buffer.from(tail).subarray(-limit).toString('utf8');
+      tail = tail.slice(tail.indexOf('\n') + 1);
+      truncated = true;
+    }
+  };
+  const consume = (text) => {
+    for (const fragment of text.split(/(?<=\n)/u)) {
+      const ended = fragment.endsWith('\n');
+      if (!dropping) pending += fragment;
+      if (Buffer.byteLength(pending) > 64 * 1024) {
+        pending = '';
+        dropping = true;
+        truncated = true;
+      }
+      if (ended) {
+        retain(dropping ? '[oversized stderr line omitted]\n' : pending);
+        pending = '';
+        dropping = false;
+      }
+    }
+  };
+  const sample = () => {
+    attempt(() => writeFileSync(join(directory, 'opencode-stderr.log'), tail, { mode: 0o600 }));
+    const counters = {};
+    for (const name of [
+      'memory.current',
+      'memory.peak',
+      'memory.max',
+      'memory.events',
+      'pids.current',
+      'pids.max',
+      'pids.events',
+      'cpu.stat',
+    ]) {
+      try {
+        const value = readFileSync(`/sys/fs/cgroup/${name}`, 'utf8').trim();
+        counters[name] = /^(?:[a-z_]+ )?(?:\d+|max)(?:\n[a-z_]+ \d+)*$/u.test(value) ? value : null;
+      } catch {
+        counters[name] = null;
+      }
+    }
+    const line = `${JSON.stringify({ at: new Date().toISOString(), counters })}\n`;
+    if (resourceBytes + Buffer.byteLength(line) <= limit) {
+      attempt(() => appendFileSync(join(directory, 'resources.jsonl'), line, { mode: 0o600 }));
+      resourceBytes += Buffer.byteLength(line);
+    }
+    return counters;
+  };
+  attempt(() => mkdirSync(directory, { recursive: true, mode: 0o700 }));
+  sample();
+  const timer = setInterval(sample, 5000);
+  timer.unref();
+  return {
+    errors,
+    stderr(chunk) {
+      if (!finished) consume(typeof chunk === 'string' ? chunk : decoder.write(chunk));
+    },
+    finish(exit) {
+      if (finished) return;
+      finished = true;
+      clearInterval(timer);
+      consume(decoder.end());
+      if (pending) retain(pending);
+      const counters = sample();
+      attempt(() => writeFileSync(join(directory, 'opencode-stderr.log'), tail, { mode: 0o600 }));
+      attempt(() =>
+        writeFileSync(
+          join(directory, 'process.json'),
+          JSON.stringify(
+            {
+              started_at: startedAt,
+              finished_at: new Date().toISOString(),
+              ...exit,
+              truncated,
+              final_counters: counters,
+              capture_errors: errors,
+            },
+            null,
+            2,
+          ),
+          { mode: 0o600 },
+        ),
+      );
+    },
+  };
+}

package/dist/generation/scripts/stage-timings.mjs

@@ -0,0 +1,53 @@
+import { readFile, writeFile } from 'node:fs/promises';
+
+const NAMES = new Set([
+  'starter_verification',
+  'source_analysis',
+  'source_validation',
+  'lead_input_preparation',
+  'lead_execution',
+  'generator_input_preparation',
+  'generator_execution',
+  'preliminary_help',
+  'skill_finalization',
+  'candidate_verification',
+  'independent_review',
+]);
+const OUTCOMES = new Set(['passed', 'failed', 'cancelled', 'timed_out']);
+
+async function read(path) {
+  try {
+    const value = JSON.parse(await readFile(path, 'utf8'));
+    if (!value || !Array.isArray(value.stages)) throw new TypeError('Stage timings are invalid');
+    return value;
+  } catch (error) {
+    if (error && error.code === 'ENOENT') return { schema_version: '1.0.0', stages: [] };
+    throw error;
+  }
+}
+
+async function update(path, stage, outcome) {
+  if (!NAMES.has(stage)) throw new TypeError('Stage name is invalid');
+  const value = await read(path);
+  const now = new Date();
+  if (!outcome) {
+    if (value.stages.some((item) => item.name === stage && !item.finished_at))
+      throw new TypeError('Stage is already running');
+    value.stages.push({ name: stage, started_at: now.toISOString() });
+  } else {
+    if (!OUTCOMES.has(outcome)) throw new TypeError('Stage outcome is invalid');
+    const item = [...value.stages]
+      .reverse()
+      .find((entry) => entry.name === stage && !entry.finished_at);
+    if (!item) throw new TypeError('Stage has not started');
+    item.finished_at = now.toISOString();
+    item.duration_ms = Math.max(0, now.getTime() - Date.parse(item.started_at));
+    item.outcome = outcome;
+  }
+  await writeFile(path, `${JSON.stringify(value, null, 2)}\n`);
+}
+
+const [command, path, stage, outcome] = process.argv.slice(2);
+if (!path || !stage || (command !== 'start' && command !== 'finish'))
+  throw new TypeError('Expected start|finish, timings path and stage');
+await update(path, stage, command === 'finish' ? outcome : undefined);