@neurcode-ai/cli 0.8.9 → 0.8.14

package/dist/commands/verify.js

@@ -41,6 +41,7 @@ Object.defineProperty(exports, "__esModule", { value: true });
 exports.verifyCommand = verifyCommand;
 const child_process_1 = require("child_process");
 const diff_parser_1 = require("@neurcode-ai/diff-parser");
+const policy_engine_1 = require("@neurcode-ai/policy-engine");
 const config_1 = require("../config");
 const api_client_1 = require("../api-client");
 const path_1 = require("path");
@@ -48,6 +49,7 @@ const fs_1 = require("fs");
 const state_1 = require("../utils/state");
 const ROILogger_1 = require("../utils/ROILogger");
 const box_1 = require("../utils/box");
+const ignore_1 = require("../utils/ignore");
 // Import chalk with fallback
 let chalk;
 try {
@@ -112,6 +114,67 @@ function isExcludedFile(filePath) {
     }
     return false;
 }
+/**
+ * Map a dashboard custom policy (natural language) to a policy-engine Rule.
+ * Supports "No console.log", "No debugger", and generic line patterns.
+ */
+function customPolicyToRule(p) {
+    const sev = p.severity === 'high' ? 'block' : 'warn';
+    const text = (p.rule_text || '').trim().toLowerCase();
+    if (!text)
+        return null;
+    // Known patterns -> suspicious-keywords (checks added lines for these strings)
+    if (/console\.log|no\s+console\.log|do not use console\.log|ban console\.log/.test(text)) {
+        return {
+            id: `custom-${p.id}`,
+            name: 'No console.log',
+            description: p.rule_text,
+            enabled: true,
+            severity: sev,
+            type: 'suspicious-keywords',
+            keywords: ['console.log'],
+        };
+    }
+    if (/debugger|no\s+debugger|do not use debugger/.test(text)) {
+        return {
+            id: `custom-${p.id}`,
+            name: 'No debugger',
+            description: p.rule_text,
+            enabled: true,
+            severity: sev,
+            type: 'suspicious-keywords',
+            keywords: ['debugger'],
+        };
+    }
+    if (/eval\s*\(|no\s+eval|do not use eval/.test(text)) {
+        return {
+            id: `custom-${p.id}`,
+            name: 'No eval',
+            description: p.rule_text,
+            enabled: true,
+            severity: sev,
+            type: 'suspicious-keywords',
+            keywords: ['eval('],
+        };
+    }
+    // Fallback: line-pattern on added lines using a safe regex from the rule text
+    // Use first quoted phrase or first alphanumeric phrase as pattern
+    const quoted = /['"`]([^'"`]+)['"`]/.exec(p.rule_text);
+    const phrase = quoted?.[1] ?? p.rule_text.replace(/^(no|don't|do not use|ban|avoid)\s+/i, '').trim().slice(0, 80);
+    if (!phrase)
+        return null;
+    const escaped = phrase.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return {
+        id: `custom-${p.id}`,
+        name: `Custom: ${p.rule_text.slice(0, 50)}`,
+        description: p.rule_text,
+        enabled: true,
+        severity: sev,
+        type: 'line-pattern',
+        pattern: escaped,
+        matchType: 'added',
+    };
+}
 async function verifyCommand(options) {
     try {
         // Load configuration
@@ -187,8 +250,10 @@ async function verifyCommand(options) {
             else {
                 console.log(JSON.stringify({
                     grade: 'F',
-                    adherenceScore: 0,
+                    score: 0,
                     verdict: 'FAIL',
+                    violations: [],
+                    adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
                     plannedFilesModified: 0,
@@ -201,12 +266,17 @@ async function verifyCommand(options) {
         }
         // Parse the diff
         const allDiffFiles = (0, diff_parser_1.parseDiff)(diffText);
+        console.log('DEBUG: Raw Diff Files:', JSON.stringify(allDiffFiles.map(f => f.path), null, 2));
         // Filter out internal/system files before analysis
         // This prevents self-interference where the tool flags its own files as bloat
         const diffFiles = allDiffFiles.filter(file => {
             // Check both path and oldPath (for renames) against exclusion list
             const excludePath = isExcludedFile(file.path);
             const excludeOldPath = file.oldPath ? isExcludedFile(file.oldPath) : false;
+            if (excludePath)
+                console.log(`DEBUG: System Excluded: ${file.path}`);
+            if (excludeOldPath)
+                console.log(`DEBUG: System Excluded (oldPath): ${file.oldPath}`);
             return !excludePath && !excludeOldPath;
         });
         const summary = (0, diff_parser_1.getDiffSummary)(diffFiles);
@@ -217,8 +287,10 @@ async function verifyCommand(options) {
             else {
                 console.log(JSON.stringify({
                     grade: 'F',
-                    adherenceScore: 0,
+                    score: 0,
                     verdict: 'FAIL',
+                    violations: [],
+                    adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
                     plannedFilesModified: 0,
@@ -229,11 +301,99 @@ async function verifyCommand(options) {
             }
             process.exit(0);
         }
+        const ignoreFilter = (0, ignore_1.loadIgnore)(process.cwd());
         if (!options.json) {
             console.log(chalk.cyan('\n📊 Analyzing changes against plan...'));
             console.log(chalk.dim(`   Found ${summary.totalFiles} file(s) changed`));
             console.log(chalk.dim(`   ${summary.totalAdded} lines added, ${summary.totalRemoved} lines removed\n`));
         }
+        // ============================================
+        // --policy-only: General Governance (policy only, no plan enforcement)
+        // ============================================
+        if (options.policyOnly) {
+            if (!options.json) {
+                console.log(chalk.cyan('🛡️  General Governance mode (policy only, no plan linked)\n'));
+            }
+            let policyViolations = [];
+            let policyDecision = 'allow';
+            const defaultPolicy = (0, policy_engine_1.createDefaultPolicy)();
+            let allRules = [...defaultPolicy.rules];
+            if (config.apiKey) {
+                try {
+                    const customPolicies = await client.getActiveCustomPolicies();
+                    const customRules = [];
+                    for (const p of customPolicies) {
+                        const r = customPolicyToRule(p);
+                        if (r)
+                            customRules.push(r);
+                    }
+                    allRules = [...defaultPolicy.rules, ...customRules];
+                    if (!options.json && customRules.length > 0) {
+                        console.log(chalk.dim(`   Evaluating ${customRules.length} custom policy rule(s) from dashboard`));
+                    }
+                }
+                catch {
+                    if (!options.json) {
+                        console.log(chalk.dim('   Could not load custom policies, using default policy only'));
+                    }
+                }
+            }
+            const diffFilesForPolicy = diffFiles.filter((f) => {
+                const ignored = ignoreFilter(f.path);
+                if (ignored)
+                    console.log(`DEBUG: User Ignored: ${f.path}`);
+                return !ignored;
+            });
+            console.log('DEBUG: Files sending to Policy Engine:', JSON.stringify(diffFilesForPolicy.map(f => f.path), null, 2));
+            const policyResult = (0, policy_engine_1.evaluateRules)(diffFilesForPolicy, allRules);
+            policyViolations = (policyResult.violations || []);
+            policyViolations = policyViolations.filter((v) => !ignoreFilter(v.file));
+            policyDecision = policyViolations.length > 0 ? policyResult.decision : 'allow';
+            const effectiveVerdict = policyDecision === 'block' ? 'FAIL' : policyDecision === 'warn' ? 'WARN' : 'PASS';
+            const grade = effectiveVerdict === 'PASS' ? 'A' : effectiveVerdict === 'WARN' ? 'C' : 'F';
+            const score = effectiveVerdict === 'PASS' ? 100 : effectiveVerdict === 'WARN' ? 50 : 0;
+            const violationsOutput = policyViolations.map((v) => ({
+                file: v.file,
+                rule: v.rule,
+                severity: v.severity,
+                message: v.message,
+                ...(v.line != null ? { startLine: v.line } : {}),
+            }));
+            const message = effectiveVerdict === 'PASS'
+                ? '✅ Policy check passed (General Governance mode)'
+                : policyViolations.length > 0
+                    ? `Policy violations: ${policyViolations.map((v) => `${v.file}: ${v.message || v.rule}`).join('; ')}`
+                    : 'Policy check completed';
+            if (options.json) {
+                console.log(JSON.stringify({
+                    grade,
+                    score,
+                    verdict: effectiveVerdict,
+                    violations: violationsOutput,
+                    message,
+                    scopeGuardPassed: true, // N/A in policy-only mode
+                    bloatCount: 0,
+                    bloatFiles: [],
+                    plannedFilesModified: 0,
+                    totalPlannedFiles: 0,
+                    adherenceScore: score,
+                    policyOnly: true,
+                }, null, 2));
+            }
+            else {
+                if (effectiveVerdict === 'PASS') {
+                    console.log(chalk.green('✅ Policy check passed'));
+                }
+                else {
+                    console.log(chalk.red(`❌ Policy violations detected: ${policyViolations.length}`));
+                    policyViolations.forEach((v) => {
+                        console.log(chalk.red(`   • ${v.file}: ${v.message || v.rule}`));
+                    });
+                }
+                console.log(chalk.dim(`\n${message}`));
+            }
+            process.exit(effectiveVerdict === 'FAIL' ? 2 : effectiveVerdict === 'WARN' ? 1 : 0);
+        }
         // Get planId: Priority 1: options flag, Priority 2: state file (.neurcode/config.json), Priority 3: legacy config
         let planId = options.planId;
         if (!planId) {
@@ -278,8 +438,10 @@ async function verifyCommand(options) {
             else {
                 console.log(JSON.stringify({
                     grade: 'F',
-                    adherenceScore: 0,
+                    score: 0,
                     verdict: 'FAIL',
+                    violations: [],
+                    adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
                     plannedFilesModified: 0,
@@ -353,19 +515,28 @@ async function verifyCommand(options) {
             // Step C: The Intersection Logic
             const approvedSet = new Set([...planFiles, ...allowedFiles]);
             const violations = modifiedFiles.filter(f => !approvedSet.has(f));
-            // Step D: The Block
-            if (violations.length > 0) {
+            const filteredViolations = violations.filter((p) => !ignoreFilter(p));
+            // Step D: The Block (only report scope violations for non-ignored files)
+            if (filteredViolations.length > 0) {
                 if (options.json) {
-                    // Output JSON for scope violation BEFORE exit
+                    // Output JSON for scope violation BEFORE exit. Must include violations for GitHub Action annotations.
+                    const violationsOutput = filteredViolations.map((file) => ({
+                        file,
+                        rule: 'scope_guard',
+                        severity: 'block',
+                        message: 'File modified outside the plan',
+                    }));
                     const jsonOutput = {
                         grade: 'F',
-                        adherenceScore: 0,
+                        score: 0,
                         verdict: 'FAIL',
-                        bloatCount: violations.length,
-                        bloatFiles: violations,
+                        violations: violationsOutput,
+                        adherenceScore: 0,
+                        bloatCount: filteredViolations.length,
+                        bloatFiles: filteredViolations,
                         plannedFilesModified: 0,
                         totalPlannedFiles: planFiles.length,
-                        message: `Scope violation: ${violations.length} file(s) modified outside the plan`,
+                        message: `Scope violation: ${filteredViolations.length} file(s) modified outside the plan`,
                         scopeGuardPassed: false,
                     };
                     // CRITICAL: Print JSON first, then exit
@@ -378,12 +549,12 @@ async function verifyCommand(options) {
                     console.log(chalk.red('━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━'));
                     console.log(chalk.red('The following files were modified but are not in the plan:'));
                     console.log('');
-                    violations.forEach(file => {
+                    filteredViolations.forEach(file => {
                         console.log(chalk.red(`   • ${file}`));
                     });
                     console.log('');
                     console.log(chalk.yellow('To unblock these files, run:'));
-                    violations.forEach(file => {
+                    filteredViolations.forEach(file => {
                         console.log(chalk.dim(`   neurcode allow ${file}`));
                     });
                     console.log('');
@@ -424,8 +595,10 @@ async function verifyCommand(options) {
             else {
                 console.log(JSON.stringify({
                     grade: 'N/A',
-                    adherenceScore: 0,
+                    score: 0,
                     verdict: 'INFO',
+                    violations: [],
+                    adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
                     plannedFilesModified: 0,
@@ -437,6 +610,39 @@ async function verifyCommand(options) {
             }
             process.exit(0);
         }
+        let policyViolations = [];
+        let policyDecision = 'allow';
+        if (config.apiKey) {
+            try {
+                const customPolicies = await client.getActiveCustomPolicies();
+                const defaultPolicy = (0, policy_engine_1.createDefaultPolicy)();
+                const customRules = [];
+                for (const p of customPolicies) {
+                    const r = customPolicyToRule(p);
+                    if (r)
+                        customRules.push(r);
+                }
+                const allRules = [...defaultPolicy.rules, ...customRules];
+                const diffFilesForPolicy = diffFiles.filter((f) => {
+                    const ignored = ignoreFilter(f.path);
+                    if (ignored)
+                        console.log(`DEBUG: User Ignored: ${f.path}`);
+                    return !ignored;
+                });
+                console.log('DEBUG: Files sending to Policy Engine:', JSON.stringify(diffFilesForPolicy.map(f => f.path), null, 2));
+                const policyResult = (0, policy_engine_1.evaluateRules)(diffFilesForPolicy, allRules);
+                policyViolations = policyResult.violations.filter((v) => !ignoreFilter(v.file));
+                policyDecision = policyViolations.length > 0 ? policyResult.decision : 'allow';
+                if (!options.json && customRules.length > 0) {
+                    console.log(chalk.dim(`   Evaluating ${customRules.length} custom policy rule(s) from dashboard`));
+                }
+            }
+            catch {
+                if (!options.json) {
+                    console.log(chalk.dim('   Could not load custom policies, continuing without them'));
+                }
+            }
+        }
         // Prepare diff stats and changed files for API
         const diffStats = {
             totalAdded: summary.totalAdded,
@@ -478,7 +684,13 @@ async function verifyCommand(options) {
             }
             // Call verifyPlan with intentConstraints
             const verifyResult = await client.verifyPlan(finalPlanId, diffStats, changedFiles, projectId, intentConstraints);
-            // Calculate grade from verdict and score
+            // Apply custom policy verdict: block from dashboard overrides API verdict
+            const policyBlock = policyDecision === 'block' && policyViolations.length > 0;
+            const effectiveVerdict = policyBlock ? 'FAIL' : verifyResult.verdict;
+            const effectiveMessage = policyBlock
+                ? `Custom policy violations: ${policyViolations.map(v => `${v.file}: ${v.message || v.rule}`).join('; ')}. ${verifyResult.message}`
+                : verifyResult.message;
+            // Calculate grade from effective verdict and score
             // CRITICAL: 0/0 planned files = 'F' (Incomplete), not 'B'
             // Bloat automatically drops grade by at least one letter
             let grade;
@@ -486,7 +698,7 @@ async function verifyCommand(options) {
             if (verifyResult.totalPlannedFiles === 0 && verifyResult.plannedFilesModified === 0) {
                 grade = 'F';
             }
-            else if (verifyResult.verdict === 'PASS') {
+            else if (effectiveVerdict === 'PASS') {
                 grade = 'A';
                 // Log ROI event for PASS verification (Grade A) - non-blocking
                 try {
@@ -503,7 +715,7 @@ async function verifyCommand(options) {
                     // Silently ignore - ROI logging should never block user workflows
                 }
             }
-            else if (verifyResult.verdict === 'WARN') {
+            else if (effectiveVerdict === 'WARN') {
                 // Base grade calculation
                 let baseGrade = verifyResult.adherenceScore >= 70 ? 'B' : verifyResult.adherenceScore >= 50 ? 'C' : 'D';
                 // Bloat drops grade by one letter (B -> C, C -> D, D -> F)
@@ -522,49 +734,82 @@ async function verifyCommand(options) {
             }
             // If JSON output requested, output JSON and exit
             if (options.json) {
+                const filteredBloatFiles = (verifyResult.bloatFiles || []).filter((f) => !ignoreFilter(f));
+                const scopeViolations = filteredBloatFiles.map((file) => ({
+                    file,
+                    rule: 'scope_guard',
+                    severity: 'block',
+                    message: 'File modified outside the plan',
+                }));
+                const policyViolationItems = policyViolations.map((v) => ({
+                    file: v.file,
+                    rule: v.rule,
+                    severity: v.severity,
+                    message: v.message,
+                    ...(v.line != null ? { startLine: v.line } : {}),
+                }));
+                const violations = [...scopeViolations, ...policyViolationItems];
                 const jsonOutput = {
                     grade,
+                    score: verifyResult.adherenceScore,
+                    verdict: effectiveVerdict,
+                    violations,
+                    message: effectiveMessage,
                     adherenceScore: verifyResult.adherenceScore,
-                    verdict: verifyResult.verdict,
-                    bloatCount: verifyResult.bloatCount,
-                    bloatFiles: verifyResult.bloatFiles,
+                    scopeGuardPassed,
+                    bloatCount: filteredBloatFiles.length,
+                    bloatFiles: filteredBloatFiles,
                     plannedFilesModified: verifyResult.plannedFilesModified,
                     totalPlannedFiles: verifyResult.totalPlannedFiles,
-                    message: verifyResult.message,
-                    scopeGuardPassed,
+                    ...(policyViolations.length > 0 && { policyDecision }),
                 };
                 console.log(JSON.stringify(jsonOutput, null, 2));
                 // Report to Neurcode Cloud if --record flag is set (after JSON output)
                 if (options.record && config.apiKey) {
-                    const violations = verifyResult.bloatFiles.map(file => ({
-                        rule: 'scope_guard',
-                        file: file,
-                        severity: 'block',
-                        message: 'File modified outside the plan',
-                    }));
+                    const violations = [
+                        ...filteredBloatFiles.map((file) => ({
+                            rule: 'scope_guard',
+                            file: file,
+                            severity: 'block',
+                            message: 'File modified outside the plan',
+                        })),
+                        ...policyViolations.map(v => ({
+                            rule: v.rule,
+                            file: v.file,
+                            severity: v.severity,
+                            message: v.message,
+                        })),
+                    ];
                     // Report in background (don't await to avoid blocking JSON output)
                     reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, true // jsonMode = true
                     ).catch(() => {
                         // Error already logged in reportVerification
                     });
                 }
-                // Exit based on verdict (same logic as below)
-                if (scopeGuardPassed) {
+                // Exit based on effective verdict (same logic as below)
+                if (scopeGuardPassed && !policyBlock) {
                     process.exit(0);
                 }
-                if (verifyResult.verdict === 'FAIL') {
+                if (effectiveVerdict === 'FAIL') {
                     process.exit(2);
                 }
-                else if (verifyResult.verdict === 'WARN') {
+                else if (effectiveVerdict === 'WARN') {
                     process.exit(1);
                 }
                 else {
                     process.exit(0);
                 }
             }
-            // Display results (only if not in json mode)
+            // Display results (only if not in json mode; exclude ignored paths from bloat)
             if (!options.json) {
-                displayVerifyResults(verifyResult);
+                const displayBloatFiles = (verifyResult.bloatFiles || []).filter((f) => !ignoreFilter(f));
+                displayVerifyResults({
+                    ...verifyResult,
+                    verdict: effectiveVerdict,
+                    message: effectiveMessage,
+                    bloatFiles: displayBloatFiles,
+                    bloatCount: displayBloatFiles.length,
+                }, policyViolations);
             }
             // Report to Neurcode Cloud if --record flag is set
             if (options.record) {
@@ -575,23 +820,30 @@ async function verifyCommand(options) {
                     }
                 }
                 else {
-                    // Extract violations from scope guard check or create empty array
-                    // Note: For plan verifications, violations are typically scope-related
-                    // We'll create a simplified violations array based on bloat files
-                    const violations = verifyResult.bloatFiles.map(file => ({
-                        rule: 'scope_guard',
-                        file: file,
-                        severity: 'block',
-                        message: 'File modified outside the plan',
-                    }));
+                    // Include scope bloat and custom policy violations in the report (excluding .neurcodeignore'd paths)
+                    const filteredBloatForReport = (verifyResult.bloatFiles || []).filter((f) => !ignoreFilter(f));
+                    const violations = [
+                        ...filteredBloatForReport.map((file) => ({
+                            rule: 'scope_guard',
+                            file: file,
+                            severity: 'block',
+                            message: 'File modified outside the plan',
+                        })),
+                        ...policyViolations.map(v => ({
+                            rule: v.rule,
+                            file: v.file,
+                            severity: v.severity,
+                            message: v.message,
+                        })),
+                    ];
                     await reportVerification(grade, violations, verifyResult, config.apiKey, config.apiUrl, projectId || undefined, false // jsonMode = false
                     );
                 }
             }
             // Governance takes priority over Grading
-            // If Scope Guard passed (all files approved or allowed), always PASS
-            if (scopeGuardPassed) {
-                if (verifyResult.verdict === 'FAIL' || verifyResult.verdict === 'WARN') {
+            // If Scope Guard passed (all files approved or allowed) and no policy block, always PASS
+            if (scopeGuardPassed && !policyBlock) {
+                if ((verifyResult.verdict === 'FAIL' || verifyResult.verdict === 'WARN') && policyViolations.length === 0) {
                     if (!options.json) {
                         console.log(chalk.yellow('\n⚠️  Plan deviation allowed'));
                         console.log(chalk.dim('   Some files were modified outside the plan, but they were explicitly allowed.'));
@@ -600,12 +852,12 @@ async function verifyCommand(options) {
                 }
                 process.exit(0);
             }
-            // If scope guard didn't pass (or failed to check), use AI verdict
-            // Exit with appropriate code based on AI verification
-            if (verifyResult.verdict === 'FAIL') {
+            // If scope guard didn't pass (or failed to check) or policy blocked, use effective verdict
+            // Exit with appropriate code based on AI verification and custom policies
+            if (effectiveVerdict === 'FAIL') {
                 process.exit(2);
             }
-            else if (verifyResult.verdict === 'WARN') {
+            else if (effectiveVerdict === 'WARN') {
                 process.exit(1);
             }
             else {
@@ -617,8 +869,10 @@ async function verifyCommand(options) {
                 const errorMessage = error instanceof Error ? error.message : 'Unknown error';
                 console.log(JSON.stringify({
                     grade: 'F',
-                    adherenceScore: 0,
+                    score: 0,
                     verdict: 'FAIL',
+                    violations: [],
+                    adherenceScore: 0,
                     bloatCount: 0,
                     bloatFiles: [],
                     plannedFilesModified: 0,
@@ -650,8 +904,10 @@ async function verifyCommand(options) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';
             console.log(JSON.stringify({
                 grade: 'F',
-                adherenceScore: 0,
+                score: 0,
                 verdict: 'FAIL',
+                violations: [],
+                adherenceScore: 0,
                 bloatCount: 0,
                 bloatFiles: [],
                 plannedFilesModified: 0,
@@ -812,7 +1068,7 @@ async function reportVerification(grade, violations, verifyResult, apiKey, apiUr
 /**
  * Display verification results in a formatted report card
  */
-function displayVerifyResults(result) {
+function displayVerifyResults(result, policyViolations) {
     // Calculate grade/score
     // CRITICAL: 0/0 planned files = 'F' (Incomplete)
     // Bloat automatically drops grade by at least one letter
@@ -898,6 +1154,19 @@ function displayVerifyResults(result) {
         console.log('');
         console.log(chalk.green('✅ No bloat detected - all changes match the plan'));
     }
+    // Display custom policy violations from dashboard
+    if (policyViolations && policyViolations.length > 0) {
+        console.log('');
+        const blockCount = policyViolations.filter(v => v.severity === 'block').length;
+        const label = blockCount > 0
+            ? chalk.bold.red(`🚫 Custom Policy Violations: ${policyViolations.length} (${blockCount} blocking)`)
+            : chalk.bold.yellow(`⚠️  Custom Policy Warnings: ${policyViolations.length}`);
+        console.log(label);
+        policyViolations.forEach(v => {
+            const lineColor = v.severity === 'block' ? chalk.red : chalk.yellow;
+            console.log(lineColor(`     • ${v.file}: ${v.message || v.rule}`));
+        });
+    }
     console.log('');
     console.log('━'.repeat(50));
     console.log(chalk.dim(result.message));