@neurcode-ai/cli 0.9.29 → 0.9.31

package/dist/commands/ship.js

@@ -13,6 +13,7 @@ const config_1 = require("../config");
 const project_root_1 = require("../utils/project-root");
 const state_1 = require("../utils/state");
 const breakage_simulator_1 = require("../utils/breakage-simulator");
+const manual_approvals_1 = require("../utils/manual-approvals");
 let chalk;
 try {
     chalk = require('chalk');
@@ -108,6 +109,7 @@ function createShipCheckpoint(input) {
             requirePass: input.requirePass,
             requirePolicyLock: input.requirePolicyLock,
             skipPolicyLock: input.skipPolicyLock,
+            manualApproveHighRisk: input.options.manualApproveHighRisk === true,
             publishCard: input.options.publishCard !== false,
         },
         baselineDirtyPaths: [],
@@ -542,6 +544,152 @@ function parseVerifyPayload(output) {
             };
         })()
         : undefined;
+    const contextPolicy = record.contextPolicy && typeof record.contextPolicy === 'object' && !Array.isArray(record.contextPolicy)
+        ? (() => {
+            const raw = record.contextPolicy;
+            const violations = Array.isArray(raw.violations)
+                ? raw.violations
+                    .filter((item) => !!item && typeof item === 'object')
+                    .map((item) => ({
+                    file: typeof item.file === 'string' ? item.file : 'unknown',
+                    rule: typeof item.rule === 'string' ? item.rule : 'unknown',
+                    reason: typeof item.reason === 'string' ? item.reason : '',
+                }))
+                : [];
+            return {
+                deniedModifyTouched: Array.isArray(raw.deniedModifyTouched)
+                    ? raw.deniedModifyTouched.filter((item) => typeof item === 'string')
+                    : [],
+                violations,
+            };
+        })()
+        : undefined;
+    const blastRadius = record.blastRadius && typeof record.blastRadius === 'object' && !Array.isArray(record.blastRadius)
+        ? (() => {
+            const raw = record.blastRadius;
+            const risk = typeof raw.riskScore === 'string' ? raw.riskScore.toLowerCase() : 'low';
+            const riskScore = risk === 'high' || risk === 'medium' ? risk : 'low';
+            return {
+                filesChanged: typeof raw.filesChanged === 'number' ? raw.filesChanged : 0,
+                functionsAffected: typeof raw.functionsAffected === 'number' ? raw.functionsAffected : 0,
+                modulesAffected: Array.isArray(raw.modulesAffected)
+                    ? raw.modulesAffected.filter((item) => typeof item === 'string')
+                    : [],
+                dependenciesAdded: Array.isArray(raw.dependenciesAdded)
+                    ? raw.dependenciesAdded.filter((item) => typeof item === 'string')
+                    : [],
+                riskScore: riskScore,
+            };
+        })()
+        : undefined;
+    const suspiciousChange = record.suspiciousChange && typeof record.suspiciousChange === 'object' && !Array.isArray(record.suspiciousChange)
+        ? (() => {
+            const raw = record.suspiciousChange;
+            const confidenceRaw = typeof raw.confidence === 'string' ? raw.confidence.toLowerCase() : 'low';
+            const confidence = confidenceRaw === 'high' || confidenceRaw === 'medium' ? confidenceRaw : 'low';
+            return {
+                expectedFiles: typeof raw.expectedFiles === 'number' ? raw.expectedFiles : 0,
+                actualFiles: typeof raw.actualFiles === 'number' ? raw.actualFiles : 0,
+                unexpectedFiles: Array.isArray(raw.unexpectedFiles)
+                    ? raw.unexpectedFiles.filter((item) => typeof item === 'string')
+                    : [],
+                flagged: raw.flagged === true,
+                confidence: confidence,
+            };
+        })()
+        : undefined;
+    const changeJustification = record.changeJustification && typeof record.changeJustification === 'object' && !Array.isArray(record.changeJustification)
+        ? (() => {
+            const raw = record.changeJustification;
+            return {
+                task: typeof raw.task === 'string' ? raw.task : '',
+                changes: Array.isArray(raw.changes)
+                    ? raw.changes
+                        .filter((item) => !!item && typeof item === 'object')
+                        .map((item) => ({
+                        file: typeof item.file === 'string' ? item.file : 'unknown',
+                        reason: typeof item.reason === 'string' ? item.reason : '',
+                    }))
+                    : [],
+            };
+        })()
+        : undefined;
+    const governanceDecision = record.governanceDecision && typeof record.governanceDecision === 'object' && !Array.isArray(record.governanceDecision)
+        ? (() => {
+            const raw = record.governanceDecision;
+            const decisionRaw = typeof raw.decision === 'string' ? raw.decision.toLowerCase() : 'allow';
+            const decision = decisionRaw === 'warn' || decisionRaw === 'manual_approval' || decisionRaw === 'block'
+                ? decisionRaw
+                : 'allow';
+            return {
+                decision: decision,
+                reasonCodes: Array.isArray(raw.reasonCodes)
+                    ? raw.reasonCodes.filter((item) => typeof item === 'string')
+                    : [],
+                summary: typeof raw.summary === 'string' ? raw.summary : undefined,
+                averageRelevanceScore: typeof raw.averageRelevanceScore === 'number' ? raw.averageRelevanceScore : undefined,
+                lowRelevanceFiles: Array.isArray(raw.lowRelevanceFiles)
+                    ? raw.lowRelevanceFiles
+                        .filter((item) => !!item && typeof item === 'object')
+                        .map((item) => ({
+                        file: typeof item.file === 'string' ? item.file : 'unknown',
+                        relevanceScore: typeof item.relevanceScore === 'number' ? item.relevanceScore : 0,
+                        planLink: typeof item.planLink === 'string' ? item.planLink : 'unknown',
+                    }))
+                    : undefined,
+                requiresManualApproval: raw.requiresManualApproval === true,
+            };
+        })()
+        : undefined;
+    const aiChangeLog = record.aiChangeLog && typeof record.aiChangeLog === 'object' && !Array.isArray(record.aiChangeLog)
+        ? (() => {
+            const raw = record.aiChangeLog;
+            const integrityRaw = raw.integrity && typeof raw.integrity === 'object' && !Array.isArray(raw.integrity)
+                ? raw.integrity
+                : null;
+            return {
+                path: typeof raw.path === 'string' ? raw.path : undefined,
+                auditPath: typeof raw.auditPath === 'string' ? raw.auditPath : undefined,
+                integrity: integrityRaw
+                    ? {
+                        valid: integrityRaw.valid === true,
+                        required: integrityRaw.required === true,
+                        signed: integrityRaw.signed === true,
+                        issues: Array.isArray(integrityRaw.issues)
+                            ? integrityRaw.issues.filter((item) => typeof item === 'string')
+                            : [],
+                        payloadHash: typeof integrityRaw.payloadHash === 'string' ? integrityRaw.payloadHash : null,
+                        chainHash: typeof integrityRaw.chainHash === 'string' ? integrityRaw.chainHash : null,
+                    }
+                    : undefined,
+            };
+        })()
+        : undefined;
+    const policySources = record.policySources && typeof record.policySources === 'object' && !Array.isArray(record.policySources)
+        ? (() => {
+            const raw = record.policySources;
+            const modeRaw = typeof raw.mode === 'string' ? raw.mode.toLowerCase() : 'local';
+            const mode = modeRaw === 'merged' || modeRaw === 'org_only' ? modeRaw : 'local';
+            return {
+                localPolicy: raw.localPolicy !== false,
+                orgPolicy: raw.orgPolicy === true,
+                mode: mode,
+            };
+        })()
+        : undefined;
+    const orgGovernance = record.orgGovernance && typeof record.orgGovernance === 'object' && !Array.isArray(record.orgGovernance)
+        ? (() => {
+            const raw = record.orgGovernance;
+            return {
+                requireSignedAiLogs: raw.requireSignedAiLogs === true,
+                requireManualApproval: raw.requireManualApproval !== false,
+                minimumManualApprovals: typeof raw.minimumManualApprovals === 'number'
+                    ? Math.max(1, Math.min(5, Math.floor(raw.minimumManualApprovals)))
+                    : 1,
+                updatedAt: typeof raw.updatedAt === 'string' ? raw.updatedAt : null,
+            };
+        })()
+        : undefined;
     return {
         grade: record.grade,
         score: typeof record.score === 'number' ? record.score : 0,
@@ -561,6 +709,14 @@ function parseVerifyPayload(output) {
         policyLock,
         policyExceptions,
         policyGovernance,
+        contextPolicy,
+        blastRadius,
+        suspiciousChange,
+        changeJustification,
+        governanceDecision,
+        aiChangeLog,
+        policySources,
+        orgGovernance,
     };
 }
 function parsePlanPayload(output) {
@@ -644,6 +800,20 @@ function runGit(cwd, args) {
         stderr: result.stderr || '',
     };
 }
+function getHeadSha(cwd) {
+    const head = runGit(cwd, ['rev-parse', 'HEAD']);
+    if (head.code !== 0)
+        return null;
+    const value = head.stdout.trim().toLowerCase();
+    return value || null;
+}
+function resolveDistinctManualApprovers(cwd, commitSha) {
+    const approvals = (0, manual_approvals_1.getManualApprovalsForCommit)(cwd, commitSha);
+    return {
+        approvals,
+        distinctApprovers: (0, manual_approvals_1.countDistinctApprovers)(approvals),
+    };
+}
 function getPrimaryGitRemoteUrl(cwd) {
     const remote = runGit(cwd, ['remote', 'get-url', 'origin']);
     if (remote.code !== 0)
@@ -1613,8 +1783,64 @@ async function shipCommand(goal, options) {
         });
     }
     const finalVerifyPayload = verifyPayload;
-    const verifyPassedFinal = verifyExitCode === 0 &&
+    let verifyPassedFinal = verifyExitCode === 0 &&
         (finalVerifyPayload.verdict === 'PASS' || (!requirePass && isInfoOnlyGovernanceResult(finalVerifyPayload)));
+    const manualApprovalBypass = options.manualApproveHighRisk === true || process.env.NEURCODE_MANUAL_APPROVE_HIGH_RISK === '1';
+    const governanceDecision = finalVerifyPayload.governanceDecision?.decision;
+    const orgGovernance = finalVerifyPayload.orgGovernance || null;
+    const orgManualApprovalRequired = orgGovernance?.requireManualApproval === true;
+    const minimumManualApprovals = orgGovernance
+        ? Math.max(1, Math.min(5, Math.floor(orgGovernance.minimumManualApprovals || 1)))
+        : 1;
+    const approvalHeadSha = getHeadSha(cwd);
+    const manualApprovalState = approvalHeadSha
+        ? resolveDistinctManualApprovers(cwd, approvalHeadSha)
+        : { approvals: [], distinctApprovers: 0 };
+    if (verifyPassedFinal && governanceDecision === 'block') {
+        verifyPassedFinal = false;
+        verifyExitCode = verifyExitCode === 0 ? 2 : verifyExitCode;
+        remediationActions.push('governance_decision_block');
+        const summary = finalVerifyPayload.governanceDecision?.summary || 'Governance decision matrix returned BLOCK.';
+        finalVerifyPayload.message = `${finalVerifyPayload.message || 'Governance verification completed.'} ${summary}`;
+        console.log(chalk.red('\n⛔ Ship blocked by governance decision matrix (BLOCK).'));
+        if (finalVerifyPayload.governanceDecision?.reasonCodes?.length) {
+            console.log(chalk.dim(`   Reasons: ${finalVerifyPayload.governanceDecision.reasonCodes.join(', ')}`));
+        }
+    }
+    const requiresManualApproval = governanceDecision === 'manual_approval' ||
+        (!governanceDecision && finalVerifyPayload.blastRadius?.riskScore === 'high');
+    let effectiveDistinctApprovers = manualApprovalState.distinctApprovers;
+    if (orgManualApprovalRequired && manualApprovalBypass) {
+        // Backward-compatible flag counts as the current operator approval in enterprise mode.
+        effectiveDistinctApprovers += 1;
+    }
+    const manualApprovalSatisfied = orgManualApprovalRequired
+        ? effectiveDistinctApprovers >= minimumManualApprovals
+        : manualApprovalBypass;
+    if (verifyPassedFinal && requiresManualApproval && !manualApprovalSatisfied) {
+        verifyPassedFinal = false;
+        verifyExitCode = verifyExitCode === 0 ? 2 : verifyExitCode;
+        remediationActions.push('governance_manual_approval_required');
+        const summary = finalVerifyPayload.governanceDecision?.summary ||
+            'High blast-radius risk requires manual approval before ship can continue.';
+        finalVerifyPayload.message = `${finalVerifyPayload.message || 'Governance verification completed.'} ${summary}`;
+        console.log(chalk.red('\n⛔ Ship blocked: governance requires manual approval before deploy.'));
+        if (orgManualApprovalRequired) {
+            const recordedCount = manualApprovalState.distinctApprovers;
+            console.log(chalk.dim(`   Manual approvals required: ${minimumManualApprovals}, recorded: ${recordedCount}${manualApprovalBypass ? ' (+1 current operator flag)' : ''}`));
+            if (approvalHeadSha) {
+                console.log(chalk.dim(`   Commit: ${approvalHeadSha}`));
+            }
+            console.log(chalk.dim('   Record approvals with `neurcode approve --reason "<review context>"`.'));
+            console.log(chalk.dim('   Then re-run `neurcode ship ...` to continue.'));
+        }
+        else {
+            console.log(chalk.dim('   Re-run with --manual-approve-high-risk after manual review.'));
+        }
+        if (typeof finalVerifyPayload.governanceDecision?.averageRelevanceScore === 'number') {
+            console.log(chalk.dim(`   Avg relevance score: ${finalVerifyPayload.governanceDecision.averageRelevanceScore}`));
+        }
+    }
     if (verifyPassedFinal && !options.skipTests) {
         testsAttempts += 1;
         if (!testCommand) {
@@ -2182,6 +2408,7 @@ async function shipResumeCommand(runId, options) {
         requirePass: options.requirePass ?? checkpoint.options.requirePass,
         requirePolicyLock: options.requirePolicyLock ?? checkpoint.options.requirePolicyLock,
         skipPolicyLock: options.skipPolicyLock ?? checkpoint.options.skipPolicyLock,
+        manualApproveHighRisk: options.manualApproveHighRisk ?? checkpoint.options.manualApproveHighRisk,
         publishCard: options.publishCard ?? checkpoint.options.publishCard,
         json: options.json === true,
         resumeRunId: checkpoint.runId,