@mmerterden/multi-agent-pipeline 20.2.1 → 20.3.1

package/pipeline/scripts/_pre-existing.mjs

@@ -0,0 +1,294 @@
+/**
+ * _pre-existing.mjs  -  "this was already broken" is a claim about the base
+ * commit, so it is checked against the base commit.
+ *
+ * Calling a finding or a failing test pre-existing is how a review moves it out
+ * of the run's responsibility: triage defers or rejects it, and nothing makes
+ * the run fix it. That is right when it is true and a free pass when it is not,
+ * and the model that makes the claim has every reason to make it. So in an
+ * unattended run a claim holds only with baseline evidence behind it:
+ *
+ *   - `baselineEvidence.sha` names the base commit (or an ancestor of it).
+ *   - a code finding: it cites a line, the line is not one this run added or
+ *     changed (the diff from that commit to the head maps it to an unchanged
+ *     base line; the same text elsewhere in the base file does not count), and
+ *     the line says something: a blank or punctuation-only line never
+ *     qualifies, because it matches everywhere and proves nothing.
+ *   - a failing test (`baselineEvidence.testId`): the id is in
+ *     `state.baseline.tests.failing` (Phase 0's test baseline), or
+ *     `baselineEvidence.logPath` is a log inside the checkout or the run's
+ *     state directory that names the test and shows a failure by the stack
+ *     adapter's markers (every adapter's, when the stack is unknown).
+ *
+ * A claim is an item marked `preExisting: true`, or a deferred / rejected item
+ * whose reason says so. The base is `--base`, else `state.baseline.sha`, else
+ * the merge-base of HEAD with `state.baseBranch`, else HEAD itself: the
+ * pipeline commits only in Phase 4, so during review HEAD is the commit the
+ * run started from.
+ *
+ * @module pipeline/scripts/_pre-existing
+ */
+
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { isAbsolute, join, relative } from "node:path";
+
+import { compileMarkers, getAdapter, loadAdapters, resolveStack } from "./_stack-adapter.mjs";
+
+export const CLAIM_TEXT =
+  /\bpre-?existing\b|\balready (?:failing|broken|present|there)\b|\binherited\b|\bexisted before\b|\bon the base branch\b/i;
+
+function git(repo, args) {
+  const r = spawnSync("git", ["-C", repo, ...args], {
+    encoding: "utf8",
+    timeout: 30000,
+    maxBuffer: 64 * 1024 * 1024,
+  });
+  return { ok: r.status === 0, out: (r.stdout || "").trim(), raw: r.stdout || "" };
+}
+
+const norm = (s) => String(s).replace(/\s+/g, " ").trim();
+
+function commitOf(repo, ref) {
+  const r = git(repo, ["rev-parse", "--verify", "--quiet", `${ref}^{commit}`]);
+  return r.ok && r.out ? r.out : null;
+}
+
+/**
+ * The base commit claims are judged against, or null.
+ * @param {string} repo
+ * @param {object|null} state
+ * @param {string|null} explicit
+ */
+export function resolveBase(repo, state, explicit = null) {
+  if (explicit) return commitOf(repo, explicit);
+  if (state?.baseline?.sha) return commitOf(repo, state.baseline.sha);
+  const branch = typeof state?.baseBranch === "string" ? state.baseBranch : "";
+  for (const ref of branch ? [`origin/${branch}`, branch] : []) {
+    if (!commitOf(repo, ref)) continue;
+    const mb = git(repo, ["merge-base", "HEAD", ref]);
+    if (mb.ok && mb.out) return mb.out;
+  }
+  return commitOf(repo, "HEAD");
+}
+
+/**
+ * Every pre-existing claim in a reviewer or triage document.
+ * @param {object} doc
+ * @returns {{where: string, finding: object, evidence: object|null}[]}
+ */
+export function claimsIn(doc) {
+  const out = [];
+  if (!doc || typeof doc !== "object") return out;
+  for (const key of ["findings", "accepted", "deferred", "rejected"]) {
+    for (const [i, item] of (Array.isArray(doc[key]) ? doc[key] : []).entries()) {
+      if (!item || typeof item !== "object") continue;
+      const f = item.finding && typeof item.finding === "object" ? item.finding : item;
+      const flagged = item.preExisting === true || f.preExisting === true;
+      const said =
+        (key === "deferred" || key === "rejected") &&
+        typeof item.reason === "string" &&
+        CLAIM_TEXT.test(item.reason);
+      if (!flagged && !said) continue;
+      const evidence = item.baselineEvidence || f.baselineEvidence || null;
+      out.push({ where: `${key}[${i}]`, finding: f, evidence });
+    }
+  }
+  return out;
+}
+
+const TRIVIAL_WORDS = /^(?:\}?\s*else\s*\{?|end|fi|done|esac|break;?|continue;?|return;?)$/i;
+
+/** A line that matches everywhere and so proves nothing about the base. */
+export function trivialLine(text) {
+  const t = norm(text);
+  return !/[A-Za-z0-9]/.test(t) || TRIVIAL_WORDS.test(t);
+}
+
+/**
+ * Head line numbers the diff from `sha` adds or changes in `file`, or null
+ * when git cannot say.
+ */
+export function changedLines(repo, sha, rev, file) {
+  const args = ["diff", "-U0", "--no-color", "--no-ext-diff", sha];
+  if (rev) args.push(rev);
+  args.push("--", file);
+  const r = git(repo, args);
+  if (!r.ok) return null;
+  const out = new Set();
+  for (const m of r.raw.matchAll(/^@@ -\d+(?:,\d+)? \+(\d+)(?:,(\d+))? @@/gm)) {
+    const start = Number(m[1]);
+    const count = m[2] === undefined ? 1 : Number(m[2]);
+    for (let i = 0; i < count; i++) out.add(start + i);
+  }
+  return out;
+}
+
+function real(p) {
+  try {
+    return realpathSync(p);
+  } catch {
+    return p;
+  }
+}
+
+function inside(root, p) {
+  if (!root) return false;
+  const rel = relative(real(root), real(p));
+  return rel === "" || (!rel.startsWith("..") && !isAbsolute(rel));
+}
+
+function failureMarkers(repo) {
+  const out = [];
+  try {
+    const doc = loadAdapters();
+    let ids = resolveStack(repo, { doc })
+      .adapters.map((a) => a.id)
+      .filter((id) => id !== "unknown");
+    if (!ids.length) ids = Object.keys(doc.adapters || {});
+    for (const id of ids) {
+      const m = compileMarkers(getAdapter(id, { doc }), "test");
+      if (m) out.push(...m.failure);
+    }
+  } catch {
+    // No adapter file: the generic markers below still apply.
+  }
+  out.push(/\bFAILED\b|✗|\b[1-9][0-9]*\s+(?:failures?|failing|failed)\b|^not ok\b/m);
+  return out;
+}
+
+/**
+ * Does the log show `testId` failing? Inside the checkout or the state dir,
+ * non-empty, naming the test (its full id or its last segment), and carrying
+ * a failure marker.
+ *
+ * @returns {string|null} the reason it does not, or null
+ */
+export function logBacksFailure(logPath, testId, { repo, stateDir }) {
+  if (typeof logPath !== "string" || !logPath) return "no base-run log named";
+  const abs = isAbsolute(logPath) ? logPath : join(repo, logPath);
+  if (!existsSync(abs)) return `log ${logPath} does not exist`;
+  if (!inside(repo, abs) && !inside(stateDir, abs)) {
+    return `log ${logPath} is outside the checkout and the run's state directory`;
+  }
+  let body;
+  try {
+    if (!statSync(abs).isFile()) return `log ${logPath} is not a file`;
+    body = readFileSync(abs, "utf8");
+  } catch (err) {
+    return `log ${logPath} is unreadable: ${err.message}`;
+  }
+  if (!body.trim()) return `log ${logPath} is empty`;
+  const leaf =
+    testId
+      .split(/[./#:\s]/)
+      .filter(Boolean)
+      .at(-1) || testId;
+  if (!body.includes(testId) && !(leaf.length >= 3 && body.includes(leaf))) {
+    return `log ${logPath} does not name ${testId}`;
+  }
+  if (!failureMarkers(repo).some((re) => re.test(body))) {
+    return `log ${logPath} shows no failure marker`;
+  }
+  return null;
+}
+
+function headLine(repo, rev, file, line) {
+  let text;
+  if (rev) {
+    const r = git(repo, ["show", `${rev}:${file}`]);
+    text = r.ok ? r.raw : null;
+  } else {
+    try {
+      text = readFileSync(join(repo, file), "utf8");
+    } catch {
+      text = null;
+    }
+  }
+  if (text === null) return null;
+  return text.split("\n")[line - 1] ?? null;
+}
+
+/**
+ * Judge every claim.
+ *
+ * @param {{doc: object, repo: string, rev: string|null, state: object|null, base: string|null,
+ *          stateDir?: string|null}} p
+ * @returns {{claims: number, base: string|null, rejected: object[]}}
+ */
+export function checkPreExisting({ doc, repo, rev, state, base, stateDir = null }) {
+  const claims = claimsIn(doc);
+  const rejected = [];
+  const reject = (c, reason) =>
+    rejected.push({ where: c.where, file: c.finding.file, line: c.finding.line, reason });
+
+  for (const c of claims) {
+    const ev = c.evidence;
+    if (!base) {
+      reject(c, "no base commit to check a pre-existing claim against");
+      continue;
+    }
+    if (!ev || typeof ev.sha !== "string" || !ev.sha) {
+      reject(c, "claimed pre-existing with no baseline SHA evidence");
+      continue;
+    }
+    const sha = commitOf(repo, ev.sha);
+    const isBase =
+      sha && (sha === base || git(repo, ["merge-base", "--is-ancestor", sha, base]).ok);
+    if (!isBase) {
+      reject(
+        c,
+        `baseline SHA ${ev.sha} is not the base (${base.slice(0, 12)}) or an ancestor of it`,
+      );
+      continue;
+    }
+
+    if (typeof ev.testId === "string" && ev.testId) {
+      const tests = state?.baseline?.tests;
+      const inBaseline =
+        tests?.status === "red" &&
+        Array.isArray(tests.failing) &&
+        tests.failing.includes(ev.testId);
+      if (inBaseline) continue;
+      const why = logBacksFailure(ev.logPath, ev.testId, { repo, stateDir });
+      if (why) {
+        reject(c, `test ${ev.testId} is not in state.baseline.tests.failing and ${why}`);
+      }
+      continue;
+    }
+
+    const file = c.finding.file;
+    const line = Number(c.finding.line);
+    if (typeof file !== "string" || !file) {
+      reject(c, "a pre-existing claim needs the finding's file");
+      continue;
+    }
+    const atBase = git(repo, ["show", `${sha}:${file}`]);
+    if (!atBase.ok) {
+      reject(c, `${file} does not exist at ${sha.slice(0, 12)}`);
+      continue;
+    }
+    if (!Number.isInteger(line) || line < 1) {
+      reject(c, "a pre-existing code claim needs the cited line");
+      continue;
+    }
+    const content = headLine(repo, rev, file, line);
+    if (content === null) {
+      reject(c, `${file}:${line} does not resolve at the head`);
+      continue;
+    }
+    if (trivialLine(content)) {
+      reject(c, `${file}:${line} is a blank or trivial line; it cannot show what the base held`);
+      continue;
+    }
+    const changed = changedLines(repo, sha, rev, file);
+    if (changed === null) {
+      reject(c, `cannot diff ${file} against ${sha.slice(0, 12)}`);
+      continue;
+    }
+    if (changed.has(line)) {
+      reject(c, `${file}:${line} is not present at ${sha.slice(0, 12)}; this run added it`);
+    }
+  }
+  return { claims: claims.length, base, rejected };
+}

package/pipeline/scripts/_redact.mjs

@@ -0,0 +1,77 @@
+/**
+ * @file _redact.mjs  -  the one rule for what a contract output may not carry.
+ *
+ * Every JSON surface a client reads marks its fields `x-sensitivity: none` or
+ * `local`. `--redact` drops the `local` ones, and free text that survives (a
+ * summary, a phase's `now` line) goes through `scrub`, because text written by
+ * a person or a tool can name a host, an address or a home directory whatever
+ * field it sits in.
+ *
+ * A bare host name (no scheme, no path) is recognised when its last label is a
+ * known public or internal TLD, or when it carries a port. A dotted word under
+ * any other suffix is left alone, because file names (`package.json`,
+ * `deploy.sh`) and code paths (`self.view.frame`) have the same shape and are
+ * the text a phase line most often carries. A host under an unlisted TLD with
+ * no port therefore passes through; IPv4 addresses are always replaced.
+ *
+ * @module pipeline/scripts/_redact
+ */
+
+const SCHEME_LINK = /\b[a-z][a-z0-9+.-]*:\/\/\S+/gi;
+const WWW_LINK = /\bwww\.\S+/gi;
+const EMAIL = /[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}/g;
+/** host.tld[:port]/path with no scheme, as people paste it from an address bar. */
+const BARE_LINK =
+  /(?<![\w@.\-/])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}(?::[0-9]{1,5})?\/\S*/gi;
+const OCTET = "(?:25[0-5]|2[0-4]\\d|1\\d\\d|[1-9]?\\d)";
+const IPV4 = new RegExp(
+  `(?<![\\w.])(?:${OCTET}\\.){3}${OCTET}(?::[0-9]{1,5})?(?![\\w]|\\.\\d)`,
+  "g",
+);
+/** A dotted name with an optional port; `hostOrSelf` decides whether it is a host. */
+const DOTTED_NAME =
+  /(?<![\w@.\-/])(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+([a-z]{2,63})(:[0-9]{1,5})?(?![\w-]|\.[a-z0-9])/gi;
+const HOST_TLDS = new Set(
+  (
+    "com net org edu gov mil int info biz io dev cloud co " +
+    "internal local localdomain lan corp intra intranet arpa example invalid " +
+    "tr uk de fr nl eu ca jp cn ru br au ch se fi dk es pt pl ie cz gr hu ro " +
+    "il kr tw hk sg nz za mx ar"
+  ).split(" "),
+);
+/** A mixed-case suffix (`failed.Next`) is a missing space, not a TLD. */
+const hostOrSelf = (match, tld, port) =>
+  port ||
+  (HOST_TLDS.has(tld.toLowerCase()) && (tld === tld.toLowerCase() || tld === tld.toUpperCase()))
+    ? "[host]"
+    : match;
+
+/** Machine-specific roots: mounted volumes, temp and system directories. */
+const SYSTEM_PATH = /(?<![\w.~\-/])\/(?:Volumes|private|var|opt|tmp)(?![\w.-])\S*/g;
+/** Any user's home directory, reduced to ~ so the rest of the path still reads. */
+const HOME_PATH = /(?<![\w.~\-/])\/(?:Users|home)(?:\/[^\s/)"'\]]+)?(?![\w.-])/g;
+
+/**
+ * Free text with URLs (with or without a scheme), e-mail addresses, IPv4
+ * addresses, host names, absolute machine paths and home directories replaced
+ * by markers.
+ */
+export function scrub(text) {
+  return String(text ?? "")
+    .replace(SCHEME_LINK, "[link]")
+    .replace(WWW_LINK, "[link]")
+    .replace(EMAIL, "[email]")
+    .replace(BARE_LINK, "[link]")
+    .replace(IPV4, "[host]")
+    .replace(DOTTED_NAME, hostOrSelf)
+    .replace(SYSTEM_PATH, "[path]")
+    .replace(HOME_PATH, "~")
+    .trim();
+}
+
+/** A copy of `obj` without `keys`. */
+export function omit(obj, keys) {
+  const out = { ...obj };
+  for (const k of keys) delete out[k];
+  return out;
+}

package/pipeline/scripts/_run-paths.mjs

@@ -28,9 +28,10 @@
  * @module pipeline/scripts/_run-paths
  */
 
-import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, statSync } from "node:fs";
+import { existsSync, lstatSync, readdirSync, realpathSync, statSync } from "node:fs";
 import { join } from "node:path";
 import { homedir } from "node:os";
+import { readRegularFile } from "../lib/regular-file.mjs";
 
 /**
  * Files that mark a directory as a run directory rather than a project
@@ -50,6 +51,7 @@ export const RESERVED_DIRS = new Set([
   "shadow-git",
   "_analysis-jira",
   "prompts",
+  "contract-server",
 ]);
 
 /**
@@ -294,7 +296,7 @@ function readProjectHint(dir) {
     ? join(dir, "agent-state.json")
     : join(dir, ARTIFACTS_SUBDIR, "agent-state.json");
   try {
-    const s = JSON.parse(readFileSync(statePath, "utf-8"));
+    const s = JSON.parse(readRegularFile(statePath));
     const cands = [s.projectSlug, s.project?.name, s.project, s.projects?.[0]?.name];
     for (const c of cands) if (typeof c === "string" && c.trim()) return c.trim();
   } catch {