@neurcode-ai/cli 0.16.4 → 0.16.6

package/dist/commands/session.js

@@ -54,6 +54,8 @@ exports.waiveGovernanceObligationCommand = waiveGovernanceObligationCommand;
 exports.listRuntimeSessionsCommand = listRuntimeSessionsCommand;
 exports.showRuntimeSessionCommand = showRuntimeSessionCommand;
 exports.aiChangeRecordCommand = aiChangeRecordCommand;
+exports.exportAIChangeRecordForCli = exportAIChangeRecordForCli;
+exports.verifyAIChangeRecordForCli = verifyAIChangeRecordForCli;
 exports.structuralUnderstandingCommand = structuralUnderstandingCommand;
 exports.listSessionsCommand = listSessionsCommand;
 exports.endSessionCommand = endSessionCommand;
@@ -73,6 +75,7 @@ const session_continuity_1 = require("../utils/session-continuity");
 const runtime_evidence_1 = require("../utils/runtime-evidence");
 const v0_governance_1 = require("../utils/v0-governance");
 const runtime_connection_1 = require("../utils/runtime-connection");
+const runtime_connection_2 = require("../utils/runtime-connection");
 const runtime_live_1 = require("../utils/runtime-live");
 const session_allowlist_rules_1 = require("../utils/session-allowlist-rules");
 const runtime_outbox_1 = require("../utils/runtime-outbox");
@@ -187,6 +190,15 @@ function resolveUnderstandingDiff(repoRoot, options) {
 function loadLocalGovernanceSession(repoRoot, sessionId) {
     return sessionId ? (0, governance_runtime_1.loadSession)(repoRoot, sessionId) : (0, governance_runtime_1.loadActiveSession)(repoRoot);
 }
+function normalizeApprovalPathForCloudMatch(repoRoot, inputPath) {
+    const normalized = inputPath.trim().replace(/\\/g, '/');
+    if (!normalized)
+        return normalized;
+    if ((0, node_path_1.isAbsolute)(normalized)) {
+        return (0, node_path_1.relative)(repoRoot, normalized).replace(/\\/g, '/').replace(/^\.\//, '');
+    }
+    return normalized.replace(/^\.\//, '').replace(/^\//, '');
+}
 function latestEventTimestamp(session) {
     return [...session.events]
         .reverse()
@@ -635,20 +647,64 @@ async function approveGovernanceSessionCommand(options = {}) {
     }
     const repoRoot = (0, v0_governance_1.resolveRepoRoot)(options.dir || process.cwd());
     try {
-        const result = (0, governance_runtime_1.approveSession)(repoRoot, path, options.reason, options.sessionId);
+        const sessionId = options.sessionId || (0, governance_runtime_1.loadActiveSession)(repoRoot)?.sessionId;
+        const normalizedPath = normalizeApprovalPathForCloudMatch(repoRoot, path);
+        const discoveredCloudApproval = sessionId
+            ? await (0, runtime_live_1.findRuntimeLiveApprovalRequest)(repoRoot, sessionId, normalizedPath)
+            : null;
+        const explicitCloudApproval = options.requestId && sessionId
+            ? {
+                id: options.requestId,
+                sessionId,
+                path: normalizedPath,
+                reason: options.reason || 'Operator approved exact path',
+                status: 'requested',
+                requestedBy: 'local_operator',
+                expiresAt: undefined,
+            }
+            : null;
+        const matchingCloudApproval = discoveredCloudApproval || explicitCloudApproval;
+        const result = (0, governance_runtime_1.approveSession)(repoRoot, path, {
+            reason: options.reason,
+            sessionId: options.sessionId,
+            source: matchingCloudApproval ? 'dashboard' : 'local_cli',
+            approvedBy: matchingCloudApproval?.requestedBy || null,
+            requestId: matchingCloudApproval?.id || null,
+            expiresAt: matchingCloudApproval?.expiresAt || undefined,
+        });
+        if (matchingCloudApproval?.id) {
+            (0, runtime_live_1.queueRuntimeLiveApprovalAppliedAck)(repoRoot, result.sessionId, matchingCloudApproval, {
+                appliedPath: result.approvedPath,
+                expiresAt: result.expiresAt,
+            });
+        }
         const session = (0, governance_runtime_1.loadSession)(repoRoot, result.sessionId);
         if (session) {
             (0, session_allowlist_rules_1.refreshSessionScopeRules)({ dir: repoRoot, sessionId: session.sessionId });
             await (0, runtime_live_1.publishRuntimeLiveStatus)(repoRoot, session);
         }
         if (options.json) {
-            console.log(JSON.stringify({ ok: true, repoRoot, ...result }, null, 2));
+            console.log(JSON.stringify({
+                ok: true,
+                repoRoot,
+                ...result,
+                runtimeApprovalRequest: matchingCloudApproval?.id
+                    ? {
+                        id: matchingCloudApproval.id,
+                        source: discoveredCloudApproval ? 'matched' : 'explicit',
+                        acknowledgementQueued: true,
+                    }
+                    : null,
+            }, null, 2));
             return;
         }
         console.log('');
         console.log(chalk.green(`Approved: ${result.approvedPath}`));
         console.log(chalk.dim(`Session:  ${result.sessionId}`));
         console.log(chalk.dim(`Approved paths: ${compactList(result.approvedPaths, 12)}`));
+        if (matchingCloudApproval?.id) {
+            console.log(chalk.dim(`Runtime request: ${matchingCloudApproval.id} (${discoveredCloudApproval ? 'matched' : 'explicit'})`));
+        }
         console.log('');
     }
     catch (error) {
@@ -898,6 +954,7 @@ function renderAIChangeRecord(record, recordPath) {
     const pendingAmendments = record.plan.pendingAmendments.length;
     const consequenceImpacts = topConsequenceImpactsFromRecord(record.understanding.latest?.consequenceUnderstanding);
     const consequenceFindings = topConsequenceFindingsFromRecord(record.understanding.latest?.consequenceUnderstanding);
+    const reuseFindings = reuseFindingsFromRecord(record.understanding.latest);
     console.log('');
     console.log(chalk.bold(`AI Change Record ${record.session.sessionId}`));
     console.log(chalk.dim('-'.repeat(76)));
@@ -912,6 +969,22 @@ function renderAIChangeRecord(record, recordPath) {
     console.log(`Checks:    ok=${counts.ok} warn=${counts.warn} block=${counts.block} approvals=${counts.approval}`);
     console.log(`Oblig:     ${record.architecture.summary.satisfied}/${record.architecture.summary.total} satisfied${record.architecture.summary.blockingPending ? chalk.yellow(` · ${record.architecture.summary.blockingPending} blocking`) : ''}`);
     console.log(`Approvals: ${activeApprovals.length} active · ${record.approvals.length} lifecycle entr${record.approvals.length === 1 ? 'y' : 'ies'}`);
+    if (record.accountability) {
+        const facts = record.accountability.facts;
+        console.log('');
+        console.log(chalk.bold('Change accountability'));
+        console.log(`Asked:    ${chalk.white(truncate(facts.agentGoal, 120))}`);
+        console.log(`Touched:  ${chalk.dim(compactList(facts.touchedPaths, 8))}`);
+        console.log(`Allowed:  ${chalk.dim(compactList(facts.allowedPaths, 6))}`);
+        console.log(`Blocked:  ${facts.blockedBoundaries.length > 0 ? chalk.yellow(compactList(facts.blockedBoundaries, 6)) : chalk.dim('none')}`);
+        console.log(`Owners:   ${facts.boundaryOwners.length > 0 ? chalk.white(compactList(facts.boundaryOwners, 6)) : chalk.dim('not recorded')}`);
+        console.log(`Approval: ${facts.approvalRequired ? chalk.yellow('required') : chalk.dim('not required')} · ${facts.exactPathApprovalOnly ? 'exact-path only' : 'no exact approval applied'}`);
+        console.log(`Neighbor: ${facts.neighboringSensitiveFilesBlocked ? chalk.green('contained') : chalk.dim('not observed')}`);
+        console.log(`Receipt:  ${chalk.dim(facts.evidenceReceipt)} · source excluded=${facts.sourceExcluded ? 'yes' : 'no'}`);
+        if (record.accountability.assumptions.length > 0) {
+            console.log(`Assume:   ${chalk.dim(compactList(record.accountability.assumptions, 2))}`);
+        }
+    }
     if (record.understanding.latest) {
         const understanding = record.understanding.latest;
         console.log(`Understand: ${understanding.changedSymbolCount} changed symbols · ` +
@@ -955,6 +1028,13 @@ function renderAIChangeRecord(record, recordPath) {
                 console.log(chalk.dim(`  ${finding.rank}. ${truncate(finding.summary, 140)}${consumers}${reasons ? ` · ${reasons}` : ''}`));
             }
         }
+        if (reuseFindings.length > 0) {
+            console.log(`Reuse:     ${reuseFindings.length} advisory finding${reuseFindings.length === 1 ? '' : 's'}`);
+            for (const finding of reuseFindings.slice(0, 5)) {
+                console.log(chalk.dim(`  ${finding.changed.file}#${finding.changed.name} resembles ` +
+                    `${finding.existing.file}#${finding.existing.name} · ${finding.matchType} · ${finding.confidence}`));
+            }
+        }
     }
     if (blocked.length > 0) {
         console.log('');
@@ -1039,6 +1119,17 @@ function topConsequenceFindingsFromRecord(value) {
         return [{ rank, summary, consumerCount, nonTestConsumerCount, testConsumerCount, reasonCodes }];
     }).sort((a, b) => a.rank - b.rank || a.summary.localeCompare(b.summary));
 }
+function reuseFindingsFromRecord(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return [];
+    const raw = value.reuseFindings;
+    return Array.isArray(raw)
+        ? raw.filter((item) => Boolean(item) &&
+            typeof item === 'object' &&
+            !Array.isArray(item) &&
+            item.schemaVersion === 'neurcode.reuse-finding.v1')
+        : [];
+}
 function aiChangeRecordCommand(options = {}) {
     const repoRoot = (0, v0_governance_1.resolveRepoRoot)(options.dir || process.cwd());
     const session = resolveAIChangeRecordSession(repoRoot, options);
@@ -1072,6 +1163,144 @@ function aiChangeRecordCommand(options = {}) {
     }
     renderAIChangeRecord(record, path.replace(`${repoRoot}/`, ''));
 }
+const PUBLIC_AI_CHANGE_RECORD_DIR = '.neurcode-ai-record';
+function publicAIChangeRecordPath(repoRoot, sessionId) {
+    if (!/^[A-Za-z0-9._-]+$/.test(sessionId)) {
+        throw new Error('AI Change Record session id is not safe for an artifact filename');
+    }
+    return (0, node_path_1.join)(repoRoot, PUBLIC_AI_CHANGE_RECORD_DIR, `${sessionId}.json`);
+}
+function writeJsonFile(path, value) {
+    const dir = (0, node_path_1.dirname)(path);
+    if (!(0, node_fs_1.existsSync)(dir))
+        (0, node_fs_1.mkdirSync)(dir, { recursive: true });
+    (0, node_fs_1.writeFileSync)(path, JSON.stringify(value, null, 2) + '\n', 'utf8');
+}
+function readJsonFile(path) {
+    return JSON.parse((0, node_fs_1.readFileSync)(path, 'utf8'));
+}
+function extractRecordAndReceipt(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return { record: null, receipt: null };
+    const obj = value;
+    const record = obj.record && typeof obj.record === 'object' && obj.record.recordType === 'ai-change-accountability-record'
+        ? obj.record
+        : obj.recordType === 'ai-change-accountability-record'
+            ? obj
+            : null;
+    const receipt = obj.receipt && typeof obj.receipt === 'object'
+        ? obj.receipt
+        : obj.backendReceipt && typeof obj.backendReceipt === 'object'
+            ? obj.backendReceipt
+            : obj.schemaVersion === 'neurcode.ai-change-record-receipt.v1'
+                ? obj
+                : null;
+    return { record, receipt };
+}
+async function exportAIChangeRecordForCli(options = {}) {
+    const repoRoot = (0, v0_governance_1.resolveRepoRoot)(options.dir || process.cwd());
+    const session = resolveAIChangeRecordSession(repoRoot, options);
+    if (!session) {
+        throw new Error(options.sessionId
+            ? `No local governance session found for ${options.sessionId}`
+            : 'No local governance sessions found');
+    }
+    const { record, path: localPath } = (0, governance_runtime_1.writeAIChangeRecord)(repoRoot, session);
+    let receipt = null;
+    let verification = null;
+    const warnings = [];
+    let trustLevel = record.integrity.trustLevel;
+    if (options.signed) {
+        try {
+            const config = (0, config_1.loadConfig)();
+            const connection = (0, runtime_connection_1.loadRuntimeConnection)(repoRoot);
+            const metadata = (0, runtime_connection_2.collectRuntimeRepoMetadata)(repoRoot);
+            const client = new api_client_1.ApiClient(config);
+            const response = await client.signAIChangeRecord({
+                repoId: connection?.repo.id ?? null,
+                repoKey: connection?.repo.repoKey ?? metadata.remoteHash ?? metadata.rootHash,
+                sessionId: record.session.sessionId,
+                recordHash: record.integrity.recordHash,
+                recordSchemaVersion: record.schemaVersion,
+                recordGeneratedAt: record.generatedAt,
+            });
+            receipt = response.receipt || null;
+            verification = response.verification || null;
+            trustLevel = String(verification?.trustLevel || (response.ok ? 'backend_signed_verified' : 'backend_signed_invalid'));
+            if (!response.ok) {
+                warnings.push('Backend signing returned a non-valid verification result; exported as signed evidence needing review.');
+            }
+        }
+        catch (error) {
+            warnings.push(`Backend signing unavailable; exported self-attested record only: ${error instanceof Error ? error.message : String(error)}`);
+            trustLevel = 'self_attested';
+        }
+    }
+    const envelope = {
+        schemaVersion: 'neurcode.ai-change-record-export.v1',
+        generatedAt: new Date().toISOString(),
+        trustLevel,
+        record,
+        ...(receipt ? { receipt } : {}),
+        ...(verification ? { verification } : {}),
+        warnings,
+        privacy: {
+            sourceUploaded: false,
+            sourceFree: true,
+            excludes: ['source code', 'diff hunks', 'patch bodies', 'raw prompts', 'secrets', 'raw file contents'],
+        },
+    };
+    const publicPath = options.output ? (0, node_path_1.resolve)(repoRoot, options.output) : publicAIChangeRecordPath(repoRoot, record.session.sessionId);
+    writeJsonFile(publicPath, envelope);
+    return {
+        ok: true,
+        repoRoot,
+        sessionId: record.session.sessionId,
+        localPath,
+        publicPath,
+        publicRelativePath: (0, node_path_1.relative)(repoRoot, publicPath).replace(/\\/g, '/'),
+        recordHash: record.integrity.recordHash,
+        trustLevel,
+        receipt: {
+            present: Boolean(receipt),
+            receiptId: typeof receipt?.receiptId === 'string' ? receipt.receiptId : null,
+            keyId: typeof receipt?.signingKeyId === 'string' ? receipt.signingKeyId : null,
+            verificationStatus: String(verification?.trustLevel || verification?.status || (receipt ? 'backend_signed_unverified' : 'self_attested')),
+        },
+        warnings,
+    };
+}
+function verifyAIChangeRecordForCli(options = {}) {
+    if (!options.record)
+        throw new Error('--record is required');
+    const recordPayload = readJsonFile((0, node_path_1.resolve)(options.record));
+    const recordParts = extractRecordAndReceipt(recordPayload);
+    const receiptPayload = options.receipt ? readJsonFile((0, node_path_1.resolve)(options.receipt)) : recordPayload;
+    const receiptParts = extractRecordAndReceipt(receiptPayload);
+    const record = recordParts.record;
+    const receipt = receiptParts.receipt;
+    if (!record)
+        throw new Error('No AI Change Record found in --record JSON');
+    if (!receipt)
+        throw new Error('No AI Change Record receipt found; pass --receipt or provide an export envelope');
+    const verification = (0, governance_runtime_1.verifyAIChangeRecordReceipt)({
+        recordHash: record.integrity.recordHash,
+        receipt,
+        signingSecret: process.env.NEURCODE_AI_CHANGE_RECORD_SIGNING_SECRET || null,
+        expectedSigningKeyId: process.env.NEURCODE_AI_CHANGE_RECORD_SIGNING_KEY_ID || null,
+    });
+    return {
+        ok: verification.valid,
+        recordHash: record.integrity.recordHash,
+        receiptId: verification.receiptId,
+        trustLevel: verification.trustLevel,
+        verification,
+        privacy: {
+            sourceUploaded: false,
+            sourceFree: true,
+        },
+    };
+}
 function referenceLabel(ref) {
     const owner = ref.referencingSymbol
         ? `${ref.referencingFile}#${ref.referencingSymbol}:${ref.line}`
@@ -1101,6 +1330,8 @@ function structuralEventDetail(artifact, artifactPath, repoRoot) {
         })),
         suppressedArtifacts: artifact.suppressedArtifacts,
         digest: artifact.digest,
+        repoSymbolIndex: artifact.repoSymbolIndex,
+        reuseFindings: artifact.reuseFindings,
         consequenceUnderstanding: artifact.consequenceUnderstanding,
         planAlignment: artifact.planAlignment,
         boundaryImpact: artifact.boundaryImpact,
@@ -1172,6 +1403,16 @@ function renderStructuralUnderstanding(artifact, artifactPath, repoRoot) {
             }
         }
     }
+    if (artifact.reuseFindings.length > 0) {
+        console.log('');
+        console.log(chalk.bold('Reuse governance advisories'));
+        console.log(chalk.dim(`  ${artifact.reuseFindings.length} advisory finding${artifact.reuseFindings.length === 1 ? '' : 's'} from ` +
+            `${artifact.repoSymbolIndex.indexedSymbolCount} indexed TS/JS symbol${artifact.repoSymbolIndex.indexedSymbolCount === 1 ? '' : 's'}.`));
+        for (const finding of artifact.reuseFindings.slice(0, 8)) {
+            console.log(chalk.dim(`  ${finding.changed.file}#${finding.changed.name} -> ${finding.existing.file}#${finding.existing.name}` +
+                ` · ${finding.matchType} · ${finding.confidence}`));
+        }
+    }
     if (artifact.digest.topReferences.length > 0 || artifact.digest.topSymbols.length > 0) {
         console.log('');
         console.log(chalk.bold('Structural digest'));