@midhunxavier/code-flow 0.0.0-stage → 0.1.0-preview.3

package/src/preview.js

@@ -0,0 +1,230 @@
+import { randomBytes } from "node:crypto";
+import { readFileSync } from "node:fs";
+import { createServer, request } from "node:http";
+import { connect } from "node:net";
+import { brotliDecompressSync, gunzipSync, inflateSync } from "node:zlib";
+import { logWarn } from "./log.js";
+const LOCAL = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+const MAX_PREVIEWS = 20;
+const OVERLAY_PATH = "/__codeflow/overlay.js";
+const overlaySource = readFileSync(new URL("./preview-overlay.js", import.meta.url), "utf8");
+const DROPPED = /* @__PURE__ */ new Set(["content-security-policy-report-only", "x-frame-options", "cross-origin-opener-policy", "cross-origin-embedder-policy"]);
+const OWN_COOKIE = /^codeflow_/;
+const DECODE = { gzip: gunzipSync, "x-gzip": gunzipSync, deflate: inflateSync, br: brotliDecompressSync };
+function previewTarget(address) {
+  let url;
+  try {
+    url = new URL(address);
+  } catch {
+    return void 0;
+  }
+  if (url.protocol !== "http:" || !LOCAL.has(url.hostname)) return void 0;
+  const port = Number(url.port || 80);
+  if (!Number.isInteger(port) || port < 1 || port > 65535) return void 0;
+  return { hostname: url.hostname, port, path: `${url.pathname}${url.search}${url.hash}` };
+}
+class Previews {
+  /** The origins code-flow's own page can have: the overlay takes commands only from them, and only they may frame a preview. */
+  constructor(parents, ownPorts, remoteConnect, overlay = true) {
+    this.parents = parents;
+    this.ownPorts = ownPorts;
+    this.remoteConnect = remoteConnect;
+    this.overlay = overlay;
+  }
+  open = /* @__PURE__ */ new Map();
+  async ready(address) {
+    const target = previewTarget(address);
+    if (!target || this.ownPorts().includes(target.port)) throw new Error("Choose a local HTTP app other than code-flow");
+    if (this.remoteConnect) throw new Error("Local readiness checks are unavailable for a forwarded preview");
+    try {
+      const response = await fetch(`http://${target.hostname}:${target.port}/`, { method: "HEAD", redirect: "manual", signal: AbortSignal.timeout(2e3) });
+      return response.status >= 200 && response.status < 500;
+    } catch {
+      return false;
+    }
+  }
+  /**
+   * The preview for a local app: its address on the proxy. The same app keeps its port. `host`
+   * is the Host code-flow's page was asked for with; the preview uses the same host name.
+   */
+  async show(address, host = "") {
+    const target = previewTarget(address);
+    if (!target) throw new Error("The preview shows apps on this computer: an http://localhost:<port> address");
+    if (this.ownPorts().includes(target.port)) throw new Error("That's code-flow itself");
+    const key = `${target.hostname}:${target.port}`;
+    let entry = this.open.get(key);
+    if (!entry) {
+      if (this.open.size >= MAX_PREVIEWS) this.closeOldest();
+      const sockets = /* @__PURE__ */ new Set();
+      const server = this.proxy(target, sockets);
+      const port = await new Promise((resolve, reject) => {
+        server.once("error", reject);
+        server.listen(0, "127.0.0.1", () => resolve(server.address().port));
+      });
+      entry = { port, server, usedAt: Date.now(), sockets };
+      this.open.set(key, entry);
+    }
+    entry.usedAt = Date.now();
+    const hostname = host.split(":")[0] === "localhost" ? "localhost" : "127.0.0.1";
+    const origin = `http://${hostname}:${entry.port}`;
+    return { url: `${origin}${target.path}`, origin };
+  }
+  closeAll() {
+    for (const preview of this.open.values()) stop(preview);
+    this.open.clear();
+  }
+  closeOldest() {
+    const [key, oldest] = [...this.open.entries()].sort((a, b) => a[1].usedAt - b[1].usedAt)[0];
+    stop(oldest);
+    this.open.delete(key);
+  }
+  proxy(target, sockets) {
+    const upstreamHost = target.hostname.replace(/^\[|\]$/g, "");
+    const targetOrigin = `http://${target.hostname}:${target.port}`;
+    const server = createServer((req, res) => {
+      const own = ownHost(req, server);
+      if (!own) return refuse(res, 403, "Bad Host header");
+      if (!ownOrigin(req, server)) return refuse(res, 403, "Requests from other sites don't reach the app through its preview");
+      if (this.overlay && req.url?.startsWith(OVERLAY_PATH)) {
+        res.writeHead(200, { "content-type": "text/javascript; charset=utf-8", "cache-control": "no-store" });
+        return res.end(overlaySource.replace("__PARENTS__", JSON.stringify(this.parents())));
+      }
+      const headers = forwardHeaders(req, target, targetOrigin, own);
+      headers["accept-encoding"] = "identity";
+      const upstream = request({ host: upstreamHost, port: target.port, method: req.method, path: req.url, headers, ...this.remoteConnect ? { createConnection: () => this.remoteConnect(target) } : {} }, (up) => {
+        up.on("error", () => res.destroy());
+        const nonce = randomBytes(16).toString("base64");
+        const out = {};
+        for (const [name, value] of Object.entries(up.headers)) {
+          if (value === void 0 || DROPPED.has(name)) continue;
+          if (name === "location" && typeof value === "string") out[name] = value.replace(targetOrigin, `http://${own}`);
+          else if (name === "set-cookie") {
+            const cookies = [value].flat().filter((c) => !OWN_COOKIE.test(c.trimStart()));
+            if (cookies.length) out[name] = cookies;
+          } else out[name] = value;
+        }
+        const policy = framedPolicy(up.headers["content-security-policy"], this.parents(), nonce);
+        out["content-security-policy"] = policy;
+        const encoding = String(up.headers["content-encoding"] ?? "identity").trim().toLowerCase();
+        const decode = encoding === "identity" ? (body) => body : DECODE[encoding];
+        const html = String(up.headers["content-type"] ?? "").includes("text/html") && req.method !== "HEAD";
+        if (!html || !decode || !this.overlay) {
+          res.writeHead(up.statusCode ?? 502, out);
+          up.pipe(res);
+          return;
+        }
+        const chunks = [];
+        up.on("data", (c) => chunks.push(c));
+        up.on("end", () => {
+          const body = Buffer.concat(chunks);
+          let page;
+          try {
+            page = injectOverlay(decode(body).toString("utf8"), policy.includes(`'nonce-${nonce}'`) ? nonce : void 0);
+          } catch {
+            res.writeHead(up.statusCode ?? 502, out);
+            return res.end(body);
+          }
+          delete out["content-length"];
+          delete out["content-encoding"];
+          delete out["etag"];
+          res.writeHead(up.statusCode ?? 502, { ...out, "cache-control": "no-store" });
+          res.end(page);
+        });
+      });
+      upstream.on("error", (err) => refuse(res, 502, `The app at ${targetOrigin} didn't answer (${err.code ?? err.message}). Is it running?`));
+      res.on("close", () => {
+        if (!res.writableFinished) upstream.destroy();
+      });
+      req.pipe(upstream);
+    });
+    server.on("upgrade", (req, socket, head) => {
+      const own = ownHost(req, server);
+      if (!own || !ownOrigin(req, server)) return socket.destroy();
+      const up = this.remoteConnect ? this.remoteConnect(target) : connect(target.port, upstreamHost);
+      const connected = () => {
+        const headers = forwardHeaders(req, target, targetOrigin, own);
+        const lines = [`${req.method} ${req.url} HTTP/1.1`, ...Object.entries(headers).flatMap(([k, v]) => Array.isArray(v) ? v.map((x) => `${k}: ${x}`) : v === void 0 ? [] : [`${k}: ${v}`])];
+        up.write(`${lines.join("\r\n")}\r
+\r
+`);
+        if (head.length) up.write(head);
+        socket.pipe(up).pipe(socket);
+      };
+      if (this.remoteConnect) queueMicrotask(connected);
+      else up.once("connect", connected);
+      up.on("error", () => socket.destroy());
+      socket.on("error", () => up.destroy());
+      for (const side of [socket, up]) {
+        sockets.add(side);
+        side.on("close", () => sockets.delete(side));
+      }
+    });
+    server.on("clientError", (_err, socket) => socket.destroy());
+    server.on("error", (err) => logWarn(`Preview of ${targetOrigin}: ${err.message}`));
+    return server;
+  }
+}
+function stop(preview) {
+  preview.server.close();
+  preview.server.closeAllConnections();
+  for (const socket of preview.sockets) socket.destroy();
+}
+function ownHost(req, server) {
+  const port = server.address()?.port;
+  const host = req.headers.host ?? "";
+  return host === `127.0.0.1:${port}` || host === `localhost:${port}` ? host : void 0;
+}
+function ownOrigin(req, server) {
+  const origin = req.headers.origin;
+  if (origin === void 0 || origin === "null") return true;
+  const port = server.address()?.port;
+  return origin === `http://127.0.0.1:${port}` || origin === `http://localhost:${port}`;
+}
+function forwardHeaders(req, target, targetOrigin, own) {
+  const headers = { ...req.headers, host: `${target.hostname}:${target.port}` };
+  if (typeof headers.origin === "string" && headers.origin !== "null") headers.origin = targetOrigin;
+  if (typeof headers.referer === "string") headers.referer = headers.referer.replace(`http://${own}`, targetOrigin);
+  const cookies = String(req.headers.cookie ?? "").split(";").map((c) => c.trim()).filter((c) => c && !OWN_COOKIE.test(c));
+  if (cookies.length) headers.cookie = cookies.join("; ");
+  else delete headers.cookie;
+  return headers;
+}
+function framedPolicy(appPolicy, parents, nonce) {
+  const policies = [appPolicy ?? []].flat().flatMap((header) => header.split(",")).map((policy) => framedDirectives(policy, nonce)).filter(Boolean);
+  return [...policies, `frame-ancestors 'self' ${parents.join(" ")}`].join(", ");
+}
+function framedDirectives(policy, nonce) {
+  const directives = /* @__PURE__ */ new Map();
+  for (const directive of policy.split(";")) {
+    const [name = "", ...sources] = directive.trim().split(/\s+/);
+    if (name && !directives.has(name.toLowerCase())) directives.set(name.toLowerCase(), sources);
+  }
+  directives.delete("frame-ancestors");
+  const fallback = directives.get("default-src");
+  const script = directives.has("script-src-elem") ? "script-src-elem" : "script-src";
+  const scripts = directives.get(script) ?? fallback;
+  if (scripts) {
+    const inline = scripts.some((s) => s.toLowerCase() === "'unsafe-inline'") && !scripts.some((s) => /^'(nonce-|sha(256|384|512)-|strict-dynamic')/i.test(s));
+    directives.set(script, [...scripts, inline ? "'self'" : `'nonce-${nonce}'`]);
+  }
+  const images = directives.get("img-src") ?? fallback;
+  if (images) directives.set("img-src", [...images, "data:"]);
+  return [...directives].map(([name, sources]) => [name, ...sources].join(" ")).join("; ");
+}
+const LEAD = /^\uFEFF?(?:\s|<\?[\s\S]*?\?>|<!--[\s\S]*?-->|<!doctype[^>]*>|<html(?:[\s/][^>]*)?>|<head(?:[\s/][^>]*)?>)*/i;
+function injectOverlay(page, nonce) {
+  const tag = `<script src="${OVERLAY_PATH}"${nonce ? ` nonce="${nonce}"` : ""}></script>`;
+  const at = LEAD.exec(page)?.[0].length ?? 0;
+  return page.slice(0, at) + tag + page.slice(at);
+}
+function refuse(res, status, message) {
+  if (res.headersSent || res.destroyed) return res.destroy();
+  res.writeHead(status, { "content-type": "text/plain; charset=utf-8" });
+  res.end(message);
+}
+export {
+  Previews,
+  framedPolicy,
+  injectOverlay,
+  previewTarget
+};

package/src/privacy.js

@@ -0,0 +1,23 @@
+import { privateEnvironmentValues } from "./env.js";
+function redactText(text, secrets = environmentSecrets()) {
+  let result = text.replace(/\b([a-z][a-z0-9+.-]*:\/\/)[^\s/@]+@/gi, "$1[REDACTED]@").replace(/-----BEGIN (?:[A-Z ]+ )?PRIVATE KEY-----[\s\S]*?-----END (?:[A-Z ]+ )?PRIVATE KEY-----/g, "[REDACTED PRIVATE KEY]").replace(/\b(?:sk-[A-Za-z0-9_-]{16,}|gh[pousr]_[A-Za-z0-9]{20,}|github_pat_[A-Za-z0-9_]{20,})\b/g, "[REDACTED TOKEN]").replace(/(\bBearer\s+)[A-Za-z0-9._~+\/-]{12,}=*/gi, "$1[REDACTED]").replace(/([?&](?:token|key|secret|password|signature)=)[^&#\s]+/gi, "$1[REDACTED]").replace(/((?:api[_-]?key|access[_-]?token|password|client[_-]?secret)\s*[=:]\s*["']?)[^\s"',;}]+/gi, "$1[REDACTED]");
+  for (const secret of secrets) if (secret.length >= 8) result = result.split(secret).join("[REDACTED]");
+  return result;
+}
+function environmentSecrets() {
+  return [...privateEnvironmentValues(), ...Object.entries(process.env).filter(([key, value]) => /(?:TOKEN|SECRET|PASSWORD|API_KEY|PRIVATE_KEY)$/.test(key) && value && value.length >= 8).map(([, value]) => value)];
+}
+function redactExport(value) {
+  const secrets = environmentSecrets();
+  const visit = (item, key = "") => {
+    if (typeof item === "string") return /^(?:token|controlToken|authorization|cookie|password|secret|apiKey|capability)$/i.test(key) ? "[REDACTED]" : redactText(item, secrets);
+    if (Array.isArray(item)) return item.map((entry) => visit(entry));
+    if (item && typeof item === "object") return Object.fromEntries(Object.entries(item).map(([name, entry]) => [name, visit(entry, name)]));
+    return item;
+  };
+  return visit(value);
+}
+export {
+  redactExport,
+  redactText
+};

package/src/project-report.js

@@ -0,0 +1,22 @@
+import { reviewReason } from "./review-inbox.js";
+import { encodeRunCursor } from "./run-history.js";
+import { matchesHistoryFilter, runPassed } from "./run-status.js";
+function projectReport(runs, now = Date.now()) {
+  const week = runs.filter((run) => run.createdAt > now - 7 * 864e5);
+  const archived = runs.filter((run) => run.archived).length;
+  const section = (name, limit) => {
+    const matches = runs.filter((run) => matchesHistoryFilter(run, { section: name }));
+    const selected = matches.slice(0, limit);
+    return { runs: structuredClone(selected), total: matches.length, nextCursor: matches.length > limit ? encodeRunCursor(selected.at(-1)) : void 0 };
+  };
+  return {
+    live: runs.length - archived,
+    archived,
+    pending: runs.filter((run) => reviewReason(run) !== void 0).length,
+    week: { runs: week.length, passed: week.filter(runPassed).length, costUsd: week.reduce((sum, run) => sum + (run.usage?.costUsd ?? 0), 0) },
+    sections: { waiting: section("waiting", 100), running: section("running", 100), results: section("results", 8) }
+  };
+}
+export {
+  projectReport
+};

package/src/project-team-budget.js

@@ -0,0 +1,22 @@
+function projectTeamUsage(team, now = Date.now()) {
+  const week = 7 * 24 * 60 * 6e4;
+  return team.cycles.flatMap((c) => c.launches).reduce((total, launch) => {
+    const usage = launch.usage;
+    if (usage ? usage.endedAt <= now - week : launch.state === "settled" && launch.at <= now - week) return total;
+    total.calls += usage?.calls ?? (launch.state === "settled" ? launch.usedCalls ?? launch.calls : launch.calls);
+    total.minutes += usage ? Math.ceil(usage.durationMs / 6e4) : launch.minutes;
+    if (!usage) {
+      total.reservedCalls += launch.calls;
+      total.reservedMinutes += launch.minutes;
+    }
+    return total;
+  }, { calls: 0, minutes: 0, reservedCalls: 0, reservedMinutes: 0 });
+}
+function allowance(team, now = Date.now()) {
+  const used = projectTeamUsage(team, now);
+  return { calls: team.mission.budget.weeklyCalls - used.calls, minutes: team.mission.budget.weeklyMinutes - used.minutes };
+}
+export {
+  allowance,
+  projectTeamUsage
+};

package/src/project-team-model.js

@@ -0,0 +1,225 @@
+import { sensitiveContextPath } from "./context-inspection.js";
+import { redactText } from "./privacy.js";
+import { createHash } from "node:crypto";
+import { isAbsolute } from "node:path";
+import { validateAgentSettings } from "./adapters/index.js";
+import { validateSchedule } from "./automation.js";
+import { validateVerificationProfile } from "./verification.js";
+import { providerEligibility } from "./provider-eligibility.js";
+const projectTeamsEnabled = () => process.env.CODEFLOW_PROJECT_TEAMS_ENABLED === "true";
+const WEEK = 7 * 24 * 60 * 6e4;
+const PT_LIMITS = { bytes: 16 * 1024 * 1024, cycles: 100, opportunities: 200, decisions: 2e3, operations: 2e3, open: 12, pending: 2 };
+const digest = (value) => createHash("sha256").update(JSON.stringify(value, (_key, item) => item && typeof item === "object" && !Array.isArray(item) ? Object.fromEntries(Object.entries(item).sort(([a], [b]) => a.localeCompare(b))) : item)).digest("hex");
+const object = (v) => !!v && typeof v === "object" && !Array.isArray(v);
+function closed(v, keys, label) {
+  if (!object(v) || Object.keys(v).some((key) => !keys.includes(key))) throw new Error(`Invalid ${label} fields`);
+  return v;
+}
+function text(v, max, label) {
+  if (typeof v !== "string" || !v.trim() || v.length > max || v.includes("\0")) throw new Error(`Invalid ${label}`);
+  return v.trim();
+}
+function integer(v, min, max, label) {
+  if (!Number.isSafeInteger(v) || Number(v) < min || Number(v) > max) throw new Error(`Invalid ${label}: use ${min}\u2013${max}`);
+  return Number(v);
+}
+function strings(v, max, label) {
+  if (!Array.isArray(v) || v.length > max) throw new Error(`Invalid ${label}`);
+  return [...new Set(v.map((s) => text(s, 1e3, label)))];
+}
+const safePath = (p) => p === "*" || p.length <= 500 && !p.startsWith("-") && !p.includes("\\") && !p.includes(":") && !/[\x00-\x1f]/.test(p) && !p.split("/").some((part) => !part || part === "." || part === ".." || part === ".git" || part.includes("*"));
+const containsPath = (scope, path) => scope === "*" || path === scope || path.startsWith(`${scope}/`);
+const CATEGORIES = ["bug", "usability", "performance", "tests", "docs", "experiment"];
+function missionSchedule(value) {
+  const schedule = validateSchedule(value);
+  if (!schedule) throw new Error("Choose a schedule");
+  if ("at" in schedule && !schedule.timezone) throw new Error("Choose an explicit schedule time zone");
+  return schedule;
+}
+function missionPolicy(mission) {
+  const { schedule: _schedule, ...policy } = mission;
+  return policy;
+}
+function teamConfiguration(value) {
+  return { coordinator: value.coordinator, pool: value.pool, agentSettings: value.agentSettings, ...value.roleSettings && Object.keys(value.roleSettings).length ? { roleSettings: value.roleSettings } : {} };
+}
+function validateTeamConfiguration(value) {
+  const r = closed(value, ["coordinator", "pool", "agentSettings", "roleSettings"], "agent team configuration");
+  const coordinator = text(r.coordinator, 100, "coordinator"), pool = strings(r.pool, 8, "provider pool");
+  if (!pool.length) throw new Error("Select a worker and reviewer provider pool");
+  for (const id of [coordinator, ...pool]) {
+    const reason = providerEligibility(id, { trust: "standard", unattended: true, projectTeam: true });
+    if (reason) throw new Error(reason);
+  }
+  const roleSettings = {};
+  for (const [role, settings] of Object.entries(closed(r.roleSettings ?? {}, ["coordinator", "pool"], "team role settings"))) {
+    const valid = validateAgentSettings(settings);
+    if (Object.keys(valid).some((id) => !(role === "coordinator" ? [coordinator] : pool).includes(id))) throw new Error("Role settings must use the selected providers");
+    if (Object.keys(valid).length) roleSettings[role] = valid;
+  }
+  return { coordinator, pool, agentSettings: validateAgentSettings(r.agentSettings ?? {}), ...Object.keys(roleSettings).length ? { roleSettings } : {} };
+}
+function validateTeamSnapshot(value) {
+  const r = closed(value, ["id", "revision", "name", "configuration"], "agent team snapshot");
+  if (!/^at-[a-f0-9]{24}$/.test(r.id) || !Number.isSafeInteger(r.revision) || r.revision < 1) throw new Error("Invalid agent team version");
+  return { id: r.id, revision: r.revision, name: text(r.name, 80, "team name"), configuration: validateTeamConfiguration(r.configuration) };
+}
+function validateMission(value) {
+  const r = closed(value, ["mission", "users", "priorities", "exclusions", "baseBranch", "mode", "categories", "paths", "excludedPaths", "coordinator", "pool", "agentSettings", "roleSettings", "trust", "check", "setup", "verification", "schedule", "maxFiles", "maxLines", "rescanDays", "budget"], "project mission");
+  const paths = strings(r.paths ?? ["*"], 32, "included paths"), excludedPaths = strings(r.excludedPaths ?? [".codeflow", ".github/workflows"], 32, "excluded paths");
+  if (!paths.length || [...paths, ...excludedPaths].some((p) => !safePath(p))) throw new Error("Choose safe repository-relative paths");
+  const coordinator = text(r.coordinator, 100, "coordinator"), pool = strings(r.pool, 8, "provider pool");
+  if (!pool.length) throw new Error("Select a worker and reviewer provider pool");
+  const trust = r.trust ?? "standard";
+  if (!["safe", "standard", "trusted"].includes(trust)) throw new Error("Project teams cannot use Full access");
+  for (const id of [coordinator, ...pool]) {
+    const reason = providerEligibility(id, { trust, unattended: true, projectTeam: true });
+    if (reason) throw new Error(reason);
+  }
+  const mode = r.mode ?? "build-within-scope";
+  if (!["propose", "build-within-scope"].includes(mode)) throw new Error("Choose proposals only or build within scope");
+  const categories = strings(r.categories ?? ["bug", "usability", "performance", "tests", "docs"], 6, "categories");
+  if (!categories.length || categories.some((c) => !CATEGORIES.includes(c))) throw new Error("Choose supported improvement categories");
+  const branch = text(r.baseBranch, 200, "base branch");
+  if (branch === "HEAD" || branch.startsWith("-") || /[\s~^:?*\[\\]/.test(branch) || branch.includes("..") || branch.includes("@{")) throw new Error("Choose an explicit named base branch");
+  const schedule = missionSchedule(r.schedule);
+  const check = typeof r.check === "string" ? r.check.trim() : "", setup = typeof r.setup === "string" ? r.setup.trim() : "";
+  if (check.length > 4e3 || setup.length > 4e3 || `${check}${setup}`.includes("\0")) throw new Error("Invalid verification commands");
+  const verification = r.verification ? validateVerificationProfile(r.verification) : check ? validateVerificationProfile({ name: "Project team checks", checks: [{ id: "primary", kind: "custom", command: check, required: true }] }) : void 0;
+  if (mode === "build-within-scope" && !verification?.checks.some((c) => c.required)) throw new Error("Automatic implementation requires a required verification check");
+  const b = closed(r.budget ?? {}, ["discoveryCalls", "discoveryMinutes", "buildCalls", "buildMinutes", "weeklyCalls", "weeklyMinutes"], "budget");
+  const budget = { discoveryCalls: integer(b.discoveryCalls ?? 8, 8, 40, "discovery calls"), discoveryMinutes: integer(b.discoveryMinutes ?? 15, 1, 60, "discovery minutes"), buildCalls: integer(b.buildCalls ?? 16, 4, 80, "build calls"), buildMinutes: integer(b.buildMinutes ?? 45, 1, 120, "build minutes"), weeklyCalls: integer(b.weeklyCalls ?? 48, 4, 500, "weekly calls"), weeklyMinutes: integer(b.weeklyMinutes ?? 120, 1, 1440, "weekly minutes") };
+  return { mission: text(r.mission, 6e3, "mission"), users: text(r.users, 2e3, "intended users"), priorities: strings(r.priorities ?? [], 12, "priorities"), exclusions: strings(r.exclusions ?? [], 24, "exclusions"), baseBranch: branch, mode, categories, paths, excludedPaths, ...validateTeamConfiguration({ coordinator, pool, agentSettings: r.agentSettings, roleSettings: r.roleSettings }), trust, check, setup, verification, schedule, maxFiles: integer(r.maxFiles ?? 8, 1, 100, "changed files"), maxLines: integer(r.maxLines ?? 400, 1, 1e4, "changed lines"), rescanDays: integer(r.rescanDays ?? 28, 1, 90, "rescan days"), budget };
+}
+const stringSchema = { type: "string" };
+const stringsSchema = { type: "array", items: stringSchema };
+const obj = (properties) => ({ type: "object", additionalProperties: false, properties, required: Object.keys(properties) });
+const DISCOVERY_REPORT_SCHEMA = obj({ version: { type: "integer", enum: [1] }, summary: stringSchema, candidates: { type: "array", items: obj({ key: stringSchema, title: stringSchema, category: { type: "string", enum: [...CATEGORIES] }, problem: stringSchema, users: stringSchema, proposal: stringSchema, benefit: stringSchema, evidence: { type: "array", items: obj({ path: stringSchema, quote: stringSchema }) }, paths: stringsSchema, acceptance: stringsSchema, kind: { type: "string", enum: ["observed", "hypothesis"] }, risk: { type: "string", enum: ["low", "medium", "high"] }, alignment: { type: "integer" }, impact: { type: "integer" }, confidence: { type: "integer" }, effort: { type: "integer" }, rationale: stringSchema }) } });
+function validateReport(value) {
+  if (redactText(JSON.stringify(value)) !== JSON.stringify(value)) throw new Error("Discovery report contains sensitive text; return evidence without credentials");
+  const r = closed(value, ["version", "summary", "candidates"], "discovery report");
+  if (r.version !== 1 || !Array.isArray(r.candidates) || r.candidates.length > 3) throw new Error("A discovery report contains at most three opportunities");
+  const candidates = r.candidates.map((value2) => validateCandidate(value2));
+  if (new Set(candidates.map((c) => c.key)).size !== candidates.length) throw new Error("Duplicate problem keys in discovery report");
+  return { version: 1, candidates, summary: text(r.summary, 4e3, "discovery summary") };
+}
+function validateCandidate(value, ownerAssigned = false) {
+  const c = closed(value, Object.keys(DISCOVERY_REPORT_SCHEMA.properties.candidates.items.properties), "opportunity");
+  if (!CATEGORIES.includes(c.category) || !["observed", "hypothesis"].includes(c.kind) || !["low", "medium", "high"].includes(c.risk)) throw new Error("Invalid opportunity category or evidence classification");
+  if (!Array.isArray(c.evidence) || !ownerAssigned && !c.evidence.length || c.evidence.length > 8) throw new Error("Provide one to eight code evidence references");
+  const evidence = c.evidence.map((v) => {
+    const e = closed(v, ["path", "quote"], "evidence");
+    const path = text(e.path, 500, "evidence path");
+    if (!safePath(path) || path === "*" || sensitiveContextPath(path)) throw new Error("Invalid evidence path");
+    return { path, quote: text(e.quote, 2e3, "evidence quote") };
+  });
+  const paths = strings(c.paths, ownerAssigned ? 32 : 16, "opportunity paths"), acceptance = strings(c.acceptance, 12, "acceptance criteria");
+  if (!paths.length || paths.some((p) => !safePath(p)) || !acceptance.length) throw new Error("Opportunities need paths and acceptance criteria");
+  return { key: text(c.key, 150, "problem key").toLowerCase(), title: text(c.title, 180, "title"), category: c.category, problem: text(c.problem, 3e3, "problem"), users: text(c.users, 1e3, "users"), proposal: text(c.proposal, 3e3, "proposal"), benefit: text(c.benefit, 1500, "benefit"), evidence, paths, acceptance, kind: c.kind, risk: c.risk, alignment: integer(c.alignment, 0, 3, "alignment"), impact: integer(c.impact, 0, 3, "impact"), confidence: integer(c.confidence, 0, 3, "confidence"), effort: integer(c.effort, 1, 3, "effort"), rationale: text(c.rationale, 1500, "rationale") };
+}
+const ACTIVE_CYCLES = ["requested", "discovering", "selecting", "building", "unknown"];
+import { allowance } from "./project-team-budget.js";
+function pathPermitted(scope, path) {
+  return safePath(path) && !sensitiveContextPath(path) && scope.paths.some((p) => containsPath(p, path)) && !scope.excludedPaths.some((p) => containsPath(p, path));
+}
+function candidateProblem(c, mission) {
+  if (c.origin !== "owner" && !c.evidenceVerified) return "Evidence could not be verified at the pinned commit";
+  if (!mission.categories.includes(c.category)) return "Outside allowed categories";
+  if (c.risk !== "low" || c.confidence < 2 || c.alignment < 2) return "Needs an owner decision about risk, evidence or mission alignment";
+  if (c.kind === "hypothesis" && c.category !== "experiment") return "Product benefit needs evidence before automatic implementation";
+  if (c.paths.some((p) => !pathPermitted(mission, p))) return "Outside allowed paths";
+  if (!mission.verification?.checks.some((c2) => c2.required)) return "Configure a required verification check";
+}
+const score = (c) => c.alignment * 4 + c.impact * 3 + c.confidence * 2 - c.effort * 2;
+function validateTeamDocument(v) {
+  if (!object(v) || v.version !== 1 || !/^pt-[a-f0-9]{24}$/.test(v.id) || !isAbsolute(v.repo) || !Number.isSafeInteger(v.revision) || v.revision < 1 || !["draft", "active", "paused", "archived"].includes(v.status)) throw new Error("Invalid standing team document");
+  validateMission(v.mission);
+  for (const key of ["missions", "cycles", "opportunities", "decisions", "operations"]) if (!Array.isArray(v[key])) throw new Error(`Invalid team ${key}`);
+  if (v.cycles.length > PT_LIMITS.cycles || v.opportunities.length > PT_LIMITS.opportunities || v.decisions.length > PT_LIMITS.decisions || v.operations.length > PT_LIMITS.operations) throw new Error("Standing team history is full; archive this team and retain its decisions before creating another");
+  const validTime = (value) => Number.isSafeInteger(value) && Number(value) >= 0;
+  const validHash = (value) => typeof value === "string" && /^[a-f0-9]{64}$/.test(value);
+  const commit = (value) => typeof value === "string" && /^[a-f0-9]{40,64}$/.test(value);
+  const unique = (items, field) => new Set(items.map((item) => item[field])).size === items.length;
+  if (v.repositoryId !== void 0 && !validHash(v.repositoryId)) throw new Error("Invalid repository identity");
+  if (v.schedule !== void 0) missionSchedule(v.schedule);
+  if (v.scheduleEnabled !== void 0 && typeof v.scheduleEnabled !== "boolean") throw new Error("Invalid scheduling setting");
+  if (v.definition && digest(validateTeamSnapshot(v.definition).configuration) !== digest(teamConfiguration(v.mission))) throw new Error("Assignment differs from its pinned team configuration");
+  if (typeof v.projectId !== "string" || !v.projectId || typeof v.name !== "string" || !v.name || !validTime(v.createdAt) || !validTime(v.updatedAt) || !Number.isSafeInteger(v.missionRevision) || v.missionRevision < 1 || !unique(v.missions, "revision") || !unique(v.cycles, "id") || !unique(v.opportunities, "id") || !unique(v.operations, "id")) throw new Error("Invalid standing team identity or history");
+  for (const m of v.missions) {
+    if (!object(m) || !Number.isSafeInteger(m.revision) || m.revision < 1) throw new Error("Invalid mission revision");
+    validateMission(m.value);
+  }
+  if (!v.missions.some((m) => m.revision === v.missionRevision && digest(m.value) === digest(v.mission))) throw new Error("Current mission differs from its revision history");
+  for (const c of v.cycles) {
+    if (!object(c) || !/^pc-[a-f0-9]{24}$/.test(c.id) || !commit(c.baseCommit) || !validHash(c.sourceDigest) || !validHash(c.fingerprint) || !validTime(c.at) || c.endedAt !== void 0 && !validTime(c.endedAt) || typeof c.context !== "string" || c.context.length > 2e5 || !Array.isArray(c.launches) || c.launches.length > 2 || !unique(c.launches, "claimId") || !unique(c.launches, "phase") || ![...ACTIVE_CYCLES, "completed", "no-op", "skipped", "blocked", "failed", "cancelled"].includes(c.status)) throw new Error("Invalid cycle accounting");
+    if (!v.missions.some((m) => m.revision === c.missionRevision && digest(m.value) === digest(c.mission))) throw new Error("Cycle mission is not an immutable saved revision");
+    if (c.definition && digest(validateTeamSnapshot(c.definition).configuration) !== digest(teamConfiguration(c.mission))) throw new Error("Cycle differs from its pinned team configuration");
+    for (const l of c.launches) if (!object(l) || !/^claim-[a-f0-9]{24}$/.test(l.claimId) || !["discovery", "implementation"].includes(l.phase) || !Number.isSafeInteger(l.attempt) || l.attempt < 1 || l.attempt > 2 || !validHash(l.inputHash) || !Number.isSafeInteger(l.calls) || l.calls < 4 || l.calls > 80 || !Number.isSafeInteger(l.minutes) || l.minutes < 1 || l.minutes > 120 || !validTime(l.at) || !["claimed", "running", "settled", "unknown"].includes(l.state) || l.usedCalls !== void 0 && (!Number.isSafeInteger(l.usedCalls) || l.usedCalls < 0 || l.usedCalls > l.calls) || l.runId !== void 0 && (typeof l.runId !== "string" || !/^[\w.-]{1,120}$/.test(l.runId)) || ["running", "settled"].includes(l.state) && !l.runId) throw new Error("Invalid launch reservation or usage");
+    for (const l of c.launches) if (l.usage) {
+      const u = closed(l.usage, ["version", "calls", "durationMs", "endedAt", "recordedAt", "digest"], "usage receipt");
+      if (u.version !== 1 || !l.runId || !Number.isSafeInteger(u.calls) || u.calls < 0 || u.calls > l.calls || !validTime(u.durationMs) || u.durationMs > l.minutes * 6e4 || !validTime(u.endedAt) || u.endedAt < l.at || !validTime(u.recordedAt) || !validHash(u.digest)) throw new Error("Invalid terminal usage receipt");
+    }
+    if (c.report) {
+      validateReport(c.report.report);
+      if (digest(c.report.report) !== c.report.digest || !commit(c.report.head)) throw new Error("Invalid report receipt");
+    }
+  }
+  for (const o of v.opportunities) {
+    if (!object(o) || !/^po-[a-f0-9]{24}$/.test(o.id) || !Number.isSafeInteger(o.revision) || o.revision < 1 || !commit(o.baseCommit) || !validTime(o.createdAt) || typeof o.evidenceVerified !== "boolean" || !v.cycles.some((c) => c.id === o.cycleId) || !["proposed", "selected", "implementing", "ready", "accepted", "shipped", "deferred", "rejected", "blocked", "expired"].includes(o.status)) throw new Error("Invalid opportunity history");
+    if (o.origin !== void 0 && o.origin !== "owner") throw new Error("Invalid task origin");
+    const candidate = Object.fromEntries(Object.keys(DISCOVERY_REPORT_SCHEMA.properties.candidates.items.properties).map((k) => [k, o[k]]));
+    if (o.origin === "owner") validateCandidate(candidate, true);
+    else validateReport({ version: 1, summary: "stored", candidates: [candidate] });
+    if (o.result && (!commit(o.result.head) || !validHash(o.result.reportHash) || typeof o.result.runId !== "string" || typeof o.result.branch !== "string")) throw new Error("Invalid result identity");
+    if (["ready", "accepted", "shipped"].includes(o.status) && !o.result) throw new Error("Result evidence is missing");
+    if (o.status === "deferred" && !validTime(o.deferUntil)) throw new Error("Invalid defer date");
+  }
+  for (const d of v.decisions) if (!object(d) || typeof d.id !== "string" || typeof d.note !== "string" || d.note.length > 4e3 || d.actor !== "owner" || !["approve", "reject", "defer", "build", "revise"].includes(d.action) || !Number.isSafeInteger(d.revision) || !validTime(d.at) || !v.opportunities.some((o) => o.id === d.opportunityId)) throw new Error("Invalid owner decision history");
+  for (const o of v.operations) if (!object(o) || typeof o.id !== "string" || !o.id || o.id.length > 150 || !validHash(o.hash) || !validTime(o.at)) throw new Error("Invalid operation history");
+  return v;
+}
+function disableRestoredProjectTeam(value) {
+  const team = structuredClone(validateTeamDocument(value));
+  if (team.status !== "archived") team.status = "paused";
+  team.revision++;
+  team.updatedAt = Date.now();
+  for (const opportunity of team.opportunities) if (["ready", "accepted", "selected", "implementing"].includes(opportunity.status)) {
+    opportunity.status = "blocked";
+    opportunity.reason = "Restored result requires a new verified run before approval";
+    opportunity.revision++;
+  }
+  team.error = "Restored from backup. Inspect repository membership, launch receipts and budgets before activating.";
+  for (const cycle of team.cycles) if (ACTIVE_CYCLES.includes(cycle.status)) {
+    cycle.status = "cancelled";
+    cycle.endedAt = Date.now();
+    cycle.reason = "Cancelled during restore; unresolved launch reservations retained";
+  }
+  return team;
+}
+export {
+  ACTIVE_CYCLES,
+  CATEGORIES,
+  DISCOVERY_REPORT_SCHEMA,
+  PT_LIMITS,
+  WEEK,
+  allowance,
+  candidateProblem,
+  closed,
+  containsPath,
+  digest,
+  disableRestoredProjectTeam,
+  missionPolicy,
+  missionSchedule,
+  object,
+  pathPermitted,
+  projectTeamsEnabled,
+  safePath,
+  score,
+  teamConfiguration,
+  text,
+  validateMission,
+  validateReport,
+  validateTeamConfiguration,
+  validateTeamDocument,
+  validateTeamSnapshot
+};

package/src/project-team-policy.js

@@ -0,0 +1,42 @@
+import { lstat, readFile } from "node:fs/promises";
+import { join } from "node:path";
+import { git } from "./git.js";
+import { digest, pathPermitted } from "./project-team-model.js";
+function managedPlanProblem(plan, contract) {
+  if (!contract) return;
+  if (contract.phase === "discovery" && plan.tasks.some((t) => t.kind !== "investigation" || t.owner === "coordinator")) return "Project discovery permits investigation tasks only";
+  if (contract.phase === "implementation" && plan.tasks.some((t) => t.kind === "implementation" && t.paths.some((p) => !pathPermitted(contract.scope, p)))) return "Task ownership exceeds the saved project-team scope";
+}
+const managedRevisionProblem = (revision, contract) => managedPlanProblem({ tasks: revision.addTasks }, contract);
+async function assertProjectTeamChanges(at, run) {
+  const c = run.projectTeam;
+  if (!c) return;
+  if (digest(run.loop.verification ?? null) !== c.verificationHash) throw new Error("The managed verification profile changed");
+  const commands = [["diff", "--no-ext-diff", "--no-textconv", "--no-renames", "--name-only", "-z", run.baseRef, "--"], ["ls-files", "--others", "--exclude-standard", "-z"], ["diff", "--no-ext-diff", "--no-textconv", "--no-renames", "--numstat", run.baseRef, "--"]];
+  const results = await Promise.all(commands.map((args) => git(args, at)));
+  if (results.some((r) => r.code !== 0)) throw new Error("Cannot establish the managed result's changed files");
+  const untracked = results[1].stdout.split("\0").filter(Boolean);
+  const files = [...new Set([...results[0].stdout.split("\0"), ...untracked].filter(Boolean))];
+  if (c.phase === "discovery" && files.length) throw new Error("Discovery produced source changes");
+  if (files.some((p) => !pathPermitted(c.scope, p))) throw new Error(`Changes outside the project-team scope: ${files.filter((p) => !pathPermitted(c.scope, p)).join(", ")}`);
+  if (files.length > c.scope.maxFiles) throw new Error("Change exceeds the saved file limit");
+  let lines = 0;
+  for (const line of results[2].stdout.split("\n").filter(Boolean)) {
+    const [a, d] = line.split("	");
+    if (!/^\d+$/.test(a ?? "") || !/^\d+$/.test(d ?? "")) throw new Error("Binary changes require an owner-directed task");
+    lines += Number(a) + Number(d);
+  }
+  for (const path of untracked) {
+    const file = join(at, path), stat = await lstat(file);
+    if (!stat.isFile() || stat.size > 1024 * 1024) throw new Error("Untracked file cannot be admitted within the project-team limits");
+    const bytes = await readFile(file);
+    if (bytes.includes(0)) throw new Error("Binary changes require an owner-directed task");
+    lines += bytes.toString().split("\n").length;
+  }
+  if (lines > c.scope.maxLines) throw new Error("Change exceeds the saved line limit");
+}
+export {
+  assertProjectTeamChanges,
+  managedPlanProblem,
+  managedRevisionProblem
+};