@orion-agents/orion-code 0.3.26 → 0.3.28

package/dist/services/code-review/snapshot.js

@@ -0,0 +1,330 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ReviewSnapshotError = void 0;
+exports.reviewUnifiedDiffArgs = reviewUnifiedDiffArgs;
+exports.captureReviewSnapshot = captureReviewSnapshot;
+exports.createContainedWorktreeReader = createContainedWorktreeReader;
+/**
+ * v0.3.27 PR1 — the minimal shared Git snapshot reader for code review
+ * (plan §4.2). One reader, two scopes:
+ *
+ *  - `worktree`: staged, unstaged and untracked changes are recorded as
+ *    separate sources for the same path and are never merged into one
+ *    composite diff.
+ *  - `base`: the ref, HEAD and merge-base are resolved to immutable OIDs at
+ *    admission; later ref movement cannot change the frozen input.
+ *
+ * Security posture (§4.2.7): git runs with argument arrays through the read
+ * profile, never a shell; external diff drivers and textconv are disabled;
+ * blobs are read by OID; untracked working files are read directly under the
+ * same sensitive/binary/boundary policies as everything else. No optional
+ * locks, no arbitrary subcommands exposed to the model.
+ */
+const crypto_1 = require("crypto");
+const fs_1 = require("fs");
+const promises_1 = require("fs/promises");
+const path_1 = require("path");
+const redaction_1 = require("../redaction");
+const contract_1 = require("./contract");
+class ReviewSnapshotError extends Error {
+    constructor(message, code) {
+        super(message);
+        this.code = code;
+        this.name = 'ReviewSnapshotError';
+    }
+}
+exports.ReviewSnapshotError = ReviewSnapshotError;
+function sha256(value) {
+    return (0, crypto_1.createHash)('sha256').update(value, 'utf8').digest('hex');
+}
+function assertSafePath(value) {
+    if (!value ||
+        value.length > 1024 ||
+        value.startsWith('/') ||
+        value.includes('\0') ||
+        value.split('/').includes('..')) {
+        throw new ReviewSnapshotError(`Unsafe review path: ${value}`, 'path_invalid');
+    }
+    return value;
+}
+/** Parses `git diff --name-status -z` records into status/path groups. */
+function parseNameStatusZ(records) {
+    const parsed = [];
+    let index = 0;
+    while (index < records.length) {
+        const record = records[index];
+        if (!record) {
+            index += 1;
+            continue;
+        }
+        const status = record.slice(0, 1);
+        const paths = [];
+        if (status === 'R' || status === 'C') {
+            paths.push(records[index + 1] ?? '', records[index + 2] ?? '');
+            index += 3;
+        }
+        else {
+            paths.push(records[index + 1] ?? '');
+            index += 2;
+        }
+        parsed.push({ status, paths });
+    }
+    return parsed;
+}
+function parseDiffHunks(diffText) {
+    const files = [];
+    let current;
+    const HUNK = /^@@ -(\d+)(?:,(\d+))? \+(\d+)(?:,(\d+))? @@(.*)$/;
+    for (const line of diffText.split('\n')) {
+        if (line.startsWith('diff --git ')) {
+            const rest = line.slice('diff --git '.length);
+            const split = rest.indexOf(' b/');
+            current = {
+                path: split >= 0 ? rest.slice(split + 3) : rest,
+                hunks: [],
+                diffBytes: 0,
+            };
+            files.push(current);
+            continue;
+        }
+        if (!current)
+            continue;
+        current.diffBytes += line.length + 1;
+        const header = HUNK.exec(line);
+        if (header) {
+            current.hunks.push({
+                oldStart: Number(header[1]),
+                oldLines: header[2] === undefined ? 1 : Number(header[2]),
+                newStart: Number(header[3]),
+                newLines: header[4] === undefined ? 1 : Number(header[4]),
+                header: line,
+            });
+        }
+    }
+    return files;
+}
+function pathMatches(path, requestedPaths) {
+    if (requestedPaths.length === 0)
+        return true;
+    return requestedPaths.some(filter => path === filter || path.startsWith(`${filter}/`));
+}
+/** The read-only git arguments for the scope's unified diff. Exported so the
+ *  v0.3.28 runner captures the exact same diff the snapshot froze instead of
+ *  re-deriving OIDs after admission. */
+function reviewUnifiedDiffArgs(selector, oids) {
+    return selector.kind === 'base'
+        ? ['diff', '--no-ext-diff', '--no-textconv', oids.baseOid, oids.headOid]
+        : ['diff', '--no-ext-diff', '--no-textconv', 'HEAD'];
+}
+/** Resolves the selector to a frozen snapshot. Every OID and digest in the
+ *  returned object was taken at admission time; callers persist the returned
+ *  digest as the review's input identity. */
+async function captureReviewSnapshot(options) {
+    const budgets = { ...contract_1.DEFAULT_REVIEW_BUDGETS, ...options.budgets };
+    const { runGit } = options;
+    const requestedPaths = (options.selector.paths ?? []).map(assertSafePath);
+    let baseOid = null;
+    let headOid = null;
+    let nameStatusArgs;
+    let unifiedArgs;
+    if (options.selector.kind === 'base') {
+        headOid = (await runGit(['rev-parse', '--verify', 'HEAD'])).trim();
+        const refOid = (await runGit(['rev-parse', '--verify', `${options.selector.ref}^{commit}`]).catch(() => '')).trim();
+        if (!refOid) {
+            throw new ReviewSnapshotError(`Review base ref could not be resolved: ${options.selector.ref}`, 'ref_unresolved');
+        }
+        baseOid = (await runGit(['merge-base', refOid, headOid]).catch(() => '')).trim();
+        if (!baseOid) {
+            throw new ReviewSnapshotError(`No merge base between ${options.selector.ref} and HEAD`, 'no_merge_base');
+        }
+        nameStatusArgs = [
+            'diff',
+            '--no-ext-diff',
+            '--no-textconv',
+            '--find-renames',
+            '--name-status',
+            '-z',
+            baseOid,
+            headOid,
+        ];
+        unifiedArgs = reviewUnifiedDiffArgs(options.selector, { baseOid, headOid });
+    }
+    else {
+        nameStatusArgs = [
+            'diff',
+            '--no-ext-diff',
+            '--no-textconv',
+            '--find-renames',
+            '--name-status',
+            '-z',
+            'HEAD',
+        ];
+        unifiedArgs = reviewUnifiedDiffArgs(options.selector, { baseOid, headOid });
+    }
+    const nameStatusRaw = await runGit(nameStatusArgs);
+    const changed = parseNameStatusZ(nameStatusRaw.split('\0')).filter(entry => {
+        const path = entry.paths.at(-1);
+        return Boolean(path) && pathMatches(path, requestedPaths);
+    });
+    const files = [];
+    const skipped = [];
+    const seenPaths = new Set();
+    for (const entry of changed) {
+        const path = assertSafePath(entry.paths.at(-1));
+        if (seenPaths.has(path))
+            continue;
+        if (files.length >= budgets.maxFiles) {
+            skipped.push({ path, reason: 'over_budget_files' });
+            continue;
+        }
+        seenPaths.add(path);
+        const oldPath = entry.status === 'R' || entry.status === 'C' ? (entry.paths[0] ?? null) : null;
+        const sensitive = (0, redaction_1.isSensitiveFilePath)(path) || (oldPath ? (0, redaction_1.isSensitiveFilePath)(oldPath) : false);
+        if (sensitive) {
+            skipped.push({ path, reason: 'sensitive' });
+            continue;
+        }
+        if (entry.status === 'B') {
+            skipped.push({ path, reason: 'binary' });
+            continue;
+        }
+        files.push({
+            fileKey: sha256(`${entry.status}:${oldPath ?? ''}:${path}`).slice(0, 16),
+            path,
+            oldPath,
+            sensitive: false,
+            sides: [],
+            hunks: [],
+        });
+    }
+    const parsedFiles = parseDiffHunks(await runGit(unifiedArgs));
+    for (const file of files) {
+        const match = parsedFiles.find(candidate => candidate.path === file.path);
+        if (match)
+            file.hunks.push(...match.hunks);
+    }
+    for (const file of files) {
+        const totalDiff = file.hunks.reduce((sum, hunk) => sum + hunk.oldLines + hunk.newLines, 0);
+        if (totalDiff * 128 > budgets.maxDiffBytes) {
+            skipped.push({ path: file.path, reason: 'over_budget_bytes' });
+            continue;
+        }
+        if (options.selector.kind === 'base') {
+            const headOidForPath = (await runGit(['rev-parse', '--verify', `${headOid}:${file.path}`]).catch(() => '')).trim();
+            const baseOidForPath = (await runGit([
+                'rev-parse',
+                '--verify',
+                `${baseOid}:${file.oldPath ?? file.path}`,
+            ]).catch(() => '')).trim();
+            if (headOidForPath) {
+                file.sides.push({
+                    source: 'head',
+                    oid: headOidForPath,
+                    contentDigest: headOidForPath,
+                    byteSize: Number((await runGit(['cat-file', '-s', headOidForPath])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+            if (baseOidForPath) {
+                file.sides.push({
+                    source: 'base',
+                    oid: baseOidForPath,
+                    contentDigest: baseOidForPath,
+                    byteSize: Number((await runGit(['cat-file', '-s', baseOidForPath])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+        }
+        else {
+            const indexOid = (await runGit(['ls-files', '-s', '-z', '--', file.path]).then(raw => {
+                const record = raw.split('\0').find(item => item.length > 0);
+                return record ? (record.split(' ')[1] ?? '') : '';
+            })).trim();
+            if (indexOid) {
+                file.sides.push({
+                    source: 'staged',
+                    oid: indexOid,
+                    contentDigest: indexOid,
+                    byteSize: Number((await runGit(['cat-file', '-s', indexOid])).trim()) || 0,
+                    truncated: false,
+                });
+            }
+            if (options.readWorktreeFile) {
+                const before = await options.readWorktreeFile(file.path);
+                if (before === null) {
+                    file.sides.push({
+                        source: 'unstaged',
+                        oid: null,
+                        contentDigest: sha256(''),
+                        byteSize: 0,
+                        truncated: false,
+                    });
+                }
+                else {
+                    const beforeDigest = sha256(before);
+                    const after = await options.readWorktreeFile(file.path);
+                    if (after === null || sha256(after) !== beforeDigest) {
+                        throw new ReviewSnapshotError(`Working file changed while snapshotting: ${file.path}`, 'worktree_changed');
+                    }
+                    file.sides.push({
+                        source: 'unstaged',
+                        oid: null,
+                        contentDigest: beforeDigest,
+                        byteSize: Buffer.byteLength(before, 'utf8'),
+                        truncated: before.length > budgets.maxBodyBytes,
+                    });
+                }
+            }
+        }
+    }
+    const manifest = {
+        kind: options.selector.kind,
+        baseOid,
+        headOid,
+        requestedPaths,
+        files: files.map(file => ({
+            fileKey: file.fileKey,
+            path: file.path,
+            oldPath: file.oldPath,
+            sides: file.sides.map(side => ({ source: side.source, contentDigest: side.contentDigest })),
+        })),
+    };
+    const inputSnapshotDigest = sha256(JSON.stringify(manifest));
+    const snapshotId = `${options.snapshotIdPrefix ?? 'rev'}-${inputSnapshotDigest.slice(0, 16)}`;
+    return Object.freeze({
+        schemaVersion: 1,
+        snapshotId,
+        kind: options.selector.kind,
+        baseOid,
+        headOid,
+        requestedPaths,
+        files: Object.freeze(files.map(file => Object.freeze({
+            ...file,
+            sides: Object.freeze(file.sides),
+            hunks: Object.freeze(file.hunks),
+        }))),
+        inputSnapshotDigest,
+        skipped: Object.freeze(skipped),
+    });
+}
+/** Reads one working-tree file for review purposes, refusing to leave the
+ *  repository root (same containment discipline as the v0.3.25 conflict
+ *  reader). Returns null when the file is missing or unreadable. */
+function createContainedWorktreeReader(rootInput) {
+    const root = (0, fs_1.realpathSync)(rootInput);
+    return async (relativePath) => {
+        try {
+            const absolute = (0, path_1.resolve)(root, relativePath);
+            const fileReal = (0, fs_1.realpathSync)(absolute);
+            if (fileReal !== root && !fileReal.startsWith(root + path_1.sep))
+                return null;
+            if (!(0, fs_1.statSync)(fileReal).isFile())
+                return null;
+            return await (0, promises_1.readFile)(fileReal, 'utf8');
+        }
+        catch {
+            return null;
+        }
+    };
+}
+//# sourceMappingURL=snapshot.js.map

package/npm-shrinkwrap.json

@@ -1,12 +1,12 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "lockfileVersion": 3,
   "requires": true,
   "packages": {
     "": {
       "name": "@orion-agents/orion-code",
-      "version": "0.3.26",
+      "version": "0.3.28",
       "license": "MIT",
       "dependencies": {
         "@clack/prompts": "^0.7.0",
@@ -4293,9 +4293,9 @@
       "license": "ISC"
     },
     "node_modules/follow-redirects": {
-      "version": "1.16.0",
-      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.0.tgz",
-      "integrity": "sha512-y5rN/uOsadFT/JfYwhxRS5R7Qce+g3zG97+JrtFZlC9klX/W5hD7iiLzScI4nZqUS7DNUdhPgw4xI8W2LuXlUw==",
+      "version": "1.16.1",
+      "resolved": "https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.16.1.tgz",
+      "integrity": "sha512-FNvFGzoMLWmE6Yj9spb/zjd7yiNCHiAW9/Tg9CXrQ8wuu32HtlJOwWO11OJafl5FfY3DxTdQ0vj42zU1kvv5jg==",
       "funding": [
         {
           "type": "individual",
@@ -4563,13 +4563,13 @@
       "license": "MIT"
     },
     "node_modules/handlebars": {
-      "version": "4.7.9",
-      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.9.tgz",
-      "integrity": "sha512-4E71E0rpOaQuJR2A3xDZ+GM1HyWYv1clR58tC8emQNeQe3RH7MAzSbat+V0wG78LQBo6m6bzSG/L4pBuCsgnUQ==",
+      "version": "4.7.10",
+      "resolved": "https://registry.npmjs.org/handlebars/-/handlebars-4.7.10.tgz",
+      "integrity": "sha512-P5VJMVM7qgBn6vjXMw8WG9uVI+ncf2pi72j4de4yz5ZULLj2RGqLYaKOYGsgyrViQ0tePOVlN1tDCCXXtFqXKg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "minimist": "^1.2.5",
+        "minimist": "^1.2.8",
         "neo-async": "^2.6.2",
         "source-map": "^0.6.1",
         "wordwrap": "^1.0.0"
@@ -7147,9 +7147,9 @@
       }
     },
     "node_modules/source-map-js": {
-      "version": "1.2.1",
-      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.1.tgz",
-      "integrity": "sha512-UXWMKhLOwVKb728IUtQPXxfYU+usdybtUrK/8uGE8CQMvrhOpwvzDBwj0QhSL7MQc7vIsISBG8VQ8+IDQxpfQA==",
+      "version": "1.2.2",
+      "resolved": "https://registry.npmjs.org/source-map-js/-/source-map-js-1.2.2.tgz",
+      "integrity": "sha512-KGj/8Y43x35aZVDtt+J4mK1hoLGHULMYfSkODJNQjNDC3oW1PqPoxMwo0pLUsWM/UEGzON/NxeHywEfNXNP3Vw==",
       "dev": true,
       "license": "BSD-3-Clause",
       "engines": {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@orion-agents/orion-code",
-  "version": "0.3.26",
+  "version": "0.3.28",
   "description": "Orion Code - local-first goal-driven coding agent for terminal and Web.",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",