@mettlelabs/mettle 0.0.0-beta.1-linux-arm64 → 0.0.0-beta.10

package/bin/mettle

@@ -1,4 +0,0 @@
-[diffend] Oversized file quarantined before diffing.
-name: package/bin/mettle
-size: 100649256 bytes
-sha256: 23bbc6e76a1f3c103e121e0cdf01325cf6ec66a5e8e6626ab38a0b99cd96fa61

package/harness/audit-investigation.mjs

@@ -1,203 +0,0 @@
-import {
-  HarnessError,
-  publicError,
-  sha256,
-  captureEvidence
-} from "./chunk-2gt4cy7x.mjs";
-import {
-  privateDirectory,
-  createJournalPool
-} from "./chunk-7bg2gnv2.mjs";
-import"./chunk-zvkxtj82.mjs";
-import {
-  databaseConfig
-} from "./chunk-5cvb1jnb.mjs";
-import {
-  uuid
-} from "./chunk-1sygmp11.mjs";
-
-// apps/harness/src/audit.ts
-import { randomUUID } from "node:crypto";
-import { constants } from "node:fs";
-import { mkdir, open, rename, rm, writeFile } from "node:fs/promises";
-import { homedir } from "node:os";
-import { join } from "node:path";
-import { setTimeout as sleep } from "node:timers/promises";
-async function readRunAudit(pool, selector) {
-  if (selector !== "latest")
-    uuid().parse(selector);
-  const client = await pool.connect();
-  try {
-    await client.query("BEGIN ISOLATION LEVEL REPEATABLE READ READ ONLY");
-    const found = await client.query("SELECT r.id,r.target,r.config->>'model' AS model,r.started_at,r.finished_at,r.seq,r.spent_tokens,r.spent_nanousd::text,r.active_ms::text,r.terminal FROM harness_mastra.runs r WHERE NOT r.chat AND ($1::uuid IS NULL OR r.id=$1) ORDER BY r.started_at DESC,r.id DESC LIMIT 1", [selector === "latest" ? null : selector]);
-    const run = found.rows[0];
-    if (!run)
-      throw new HarnessError("run_not_found", "No matching investigation exists in this database.");
-    const events = await client.query("SELECT payload FROM harness_mastra.events WHERE run_id=$1 ORDER BY seq", [run.id]);
-    const actions = await client.query("SELECT a.call_id,a.tool,a.state,a.args_digest,a.child_id,a.artifact_ref,e.sha256,e.manifest,e.envelope,e.bytes FROM harness_mastra.actions a LEFT JOIN harness_mastra.artifacts e ON e.run_id=a.run_id AND e.ref=a.artifact_ref WHERE a.run_id=$1 ORDER BY a.call_id", [run.id]);
-    const models = await client.query("SELECT request_id,child_id,provider,requested_model,state,failure_code,provider_observation,final_usage_known,reserved_tokens,reserved_nanousd::text,observed_input_tokens,observed_output_tokens,observed_nanousd::text,charged_nanousd::text,response->>'content' AS commentary,response->'toolCalls' AS proposed_tool_calls FROM harness_mastra.model_dispatches WHERE run_id=$1 ORDER BY request_id", [run.id]);
-    const network = await client.query("SELECT id,call_id,state,bytes,request_digest,response_digest,dispatched_at FROM harness_mastra.web_requests WHERE run_id=$1 ORDER BY dispatched_at,id", [run.id]);
-    const sandboxes = await client.query("SELECT call_id,worker_id,container_id,image,state,created_at,removed_at FROM harness_mastra.sandboxes WHERE run_id=$1 ORDER BY created_at,call_id", [run.id]);
-    const stages = await client.query("SELECT stage_key,input_digest FROM harness_mastra.investigation_stages WHERE run_id=$1 ORDER BY stage_key", [run.id]);
-    const findings = await client.query("SELECT id,status,result,finding FROM harness_mastra.findings WHERE run_id=$1 ORDER BY id", [run.id]);
-    await client.query("COMMIT");
-    const clean = (value) => captureEvidence(value).value;
-    return {
-      capturedAt: new Date().toISOString(),
-      source: "PostgreSQL committed records; read-only snapshot",
-      run: {
-        ...run,
-        started_at: run.started_at.toISOString(),
-        finished_at: run.finished_at?.toISOString() ?? null,
-        target: clean(run.target)
-      },
-      usage: {
-        tokens: run.spent_tokens,
-        usd: Number(run.spent_nanousd) / 1e9,
-        wallSec: Number(run.active_ms) / 1000
-      },
-      stages: stages.rows,
-      events: events.rows.map(({ payload }) => ({
-        seq: payload.seq,
-        type: payload.type,
-        record: clean(payload)
-      })),
-      actions: actions.rows.map(({ bytes, ...action }) => ({
-        ...action,
-        evidenceHashMatches: typeof bytes === "string" ? sha256(bytes) === action.sha256 : null,
-        outputExcerpt: typeof bytes === "string" ? clean(bytes.slice(0, 8192)) : null,
-        outputTruncated: typeof bytes === "string" && bytes.length > 8192
-      })),
-      models: models.rows.map(clean),
-      network: network.rows.map((row) => ({
-        ...row,
-        dispatched_at: row.dispatched_at.toISOString()
-      })),
-      sandboxes: sandboxes.rows.map((row) => ({
-        ...row,
-        created_at: row.created_at.toISOString(),
-        removed_at: row.removed_at?.toISOString() ?? null
-      })),
-      findings: findings.rows.map(clean),
-      limitsOfThisExport: [
-        "Model commentary and proposed tool calls are not execution proof; match them to committed actions and evidence.",
-        "Reserved model cost is not a charge. Dispatched network bytes may still be held reservations.",
-        "Output excerpts are redacted and bounded. Full artifacts remain in the evidence store; external objects are not downloaded here.",
-        "Inline artifact hashes are compared; this export does not independently verify evidence signatures or vulnerability claims.",
-        "An unchanged event sequence or heartbeat alone does not prove forward progress."
-      ]
-    };
-  } catch (error) {
-    await client.query("ROLLBACK");
-    throw error;
-  } finally {
-    client.release();
-  }
-}
-async function atomic(path, value) {
-  const temporary = `${path}.${randomUUID()}.tmp`;
-  try {
-    await writeFile(temporary, value, { flag: "wx", mode: 384 });
-    await rename(temporary, path);
-  } finally {
-    await rm(temporary, { force: true });
-  }
-}
-async function saveRunAudit(root, audit, after = -1, writeStatus = true) {
-  uuid().parse(audit.run.id);
-  await mkdir(root, { recursive: true, mode: 448 });
-  const base = await privateDirectory(root);
-  const directory = join(base, audit.run.id);
-  await mkdir(directory, { mode: 448 }).catch((error) => {
-    if (error.code !== "EEXIST")
-      throw error;
-  });
-  await privateDirectory(directory);
-  const path = join(directory, "progress.log");
-  const file = await open(path, constants.O_CREAT | constants.O_WRONLY | constants.O_APPEND | constants.O_NOFOLLOW | constants.O_NONBLOCK, 384);
-  try {
-    const info = await file.stat();
-    if (!info.isFile() || info.uid !== process.getuid?.() || info.mode & 63)
-      throw new HarnessError("private_file", "The audit log must be a private operator-owned regular file.");
-    const fresh = audit.events.filter((event) => event.seq > after);
-    const lines = fresh.map((event) => `[observed ${audit.capturedAt}] ${event.type === "step" ? "MODEL/STAGE NOTE" : "JOURNAL"} ${JSON.stringify(event.record)}`);
-    const latest = audit.events.at(-1);
-    const lastErrorEvent = [...audit.events].reverse().find((event) => event.type === "error");
-    const lastError = lastErrorEvent && typeof lastErrorEvent.record.message === "string" ? lastErrorEvent.record.message.slice(0, 200) : null;
-    if (writeStatus)
-      lines.push(`[observed ${audit.capturedAt}] STATUS ${JSON.stringify({ runId: audit.run.id, seq: audit.run.seq, usage: audit.usage, terminal: audit.run.terminal, completedStages: audit.stages.map((stage) => stage.stage_key), modelCalls: audit.models.length, toolActions: audit.actions.length, httpRequests: audit.network.length, containersPendingRemoval: audit.sandboxes.filter((container) => container.state !== "removed").length, lastEvent: latest?.type ?? null, lastError, stalled: fresh.length === 0 && !audit.run.terminal })}`);
-    if (lines.length)
-      await file.appendFile(`${lines.join(`
-`)}
-`, "utf8");
-  } finally {
-    await file.close();
-  }
-  await atomic(join(directory, "audit.json"), `${JSON.stringify(audit, null, 2)}
-`);
-  if (after < 0)
-    await atomic(join(base, "latest.txt"), `${directory}
-`);
-  return directory;
-}
-async function auditInvestigation(args) {
-  const [selector, flag] = args;
-  if (!selector || args.length > 2 || flag !== undefined && flag !== "--watch")
-    throw new HarnessError("audit_usage", "Use investigation:audit <RUN_ID|latest> [--watch]. Latest selects the newest investigation once.");
-  if (selector !== "latest")
-    uuid().parse(selector);
-  const pool = createJournalPool(databaseConfig(), "investigation-audit-read-only");
-  const leaving = new AbortController;
-  const stop = () => leaving.abort();
-  process.once("SIGINT", stop);
-  process.once("SIGTERM", stop);
-  let runId = selector;
-  let after = -1;
-  let lastStatusSeq = -2;
-  let polls = 0;
-  try {
-    while (!leaving.signal.aborted) {
-      const audit = await readRunAudit(pool, runId);
-      runId = audit.run.id;
-      polls += 1;
-      const writeStatus = audit.run.seq !== lastStatusSeq || polls % 15 === 0;
-      if (writeStatus)
-        lastStatusSeq = audit.run.seq;
-      const directory = await saveRunAudit(join(homedir(), ".mettle", "audits"), audit, after, writeStatus);
-      console.log(JSON.stringify({
-        directory,
-        runId,
-        seq: audit.run.seq,
-        usage: audit.usage,
-        terminal: audit.run.terminal,
-        providerCallsByAudit: 0
-      }));
-      after = audit.run.seq;
-      if (flag !== "--watch" || audit.run.terminal)
-        break;
-      await sleep(2000, undefined, { signal: leaving.signal }).catch((error) => {
-        if (!leaving.signal.aborted)
-          throw error;
-      });
-    }
-  } finally {
-    process.off("SIGINT", stop);
-    process.off("SIGTERM", stop);
-    try {
-      if (leaving.signal.aborted && runId !== "latest") {
-        const final = await readRunAudit(pool, runId);
-        await saveRunAudit(join(homedir(), ".mettle", "audits"), final, after);
-      }
-    } finally {
-      await pool.end();
-    }
-  }
-}
-
-// apps/harness/scripts/audit-investigation.ts
-try {
-  await auditInvestigation(process.argv.slice(2));
-} catch (error) {
-  console.error(publicError(error));
-  process.exitCode = 1;
-}