@paths.design/caws-cli 7.0.2 → 8.0.0

package/templates/apps/tools/caws/perf-budgets.ts

@@ -1,349 +0,0 @@
-#!/usr/bin/env tsx
-
-/**
- * CAWS Performance Budget Validation
- * Validates API performance against working spec budgets
- *
- * @author @darianrosebrook
- */
-
-import * as fs from 'fs';
-import * as path from 'path';
-
-interface PerformanceBudget {
-  api_p95_ms: number;
-  ingestion_rate?: number;
-  ocr_processing_ms?: number;
-  speech_processing_per_second?: number;
-}
-
-interface PerformanceResult {
-  endpoint: string;
-  p95_ms: number;
-  budget_ms: number;
-  passed: boolean;
-  deviation_percent: number;
-}
-
-class PerformanceBudgetValidator {
-  private workingSpec: any;
-  private budgets: PerformanceBudget;
-
-  constructor() {
-    this.loadWorkingSpec();
-  }
-
-  private loadWorkingSpec(): void {
-    const specPath = path.join(process.cwd(), '.caws', 'working-spec.yaml');
-
-    if (!fs.existsSync(specPath)) {
-      throw new Error('Working spec not found at .caws/working-spec.yaml');
-    }
-
-    // Simple YAML parsing (for basic key-value structure)
-    const content = fs.readFileSync(specPath, 'utf-8');
-    const perfSection = this.extractPerfSection(content);
-
-    if (!perfSection) {
-      throw new Error('Performance budgets not found in working spec');
-    }
-
-    this.budgets = perfSection;
-  }
-
-  private extractPerfSection(content: string): PerformanceBudget | null {
-    try {
-      // Simple YAML parsing for the perf section
-      const lines = content.split('\n');
-      let inNonFunctional = false;
-      let inPerfSection = false;
-      const perfData: any = {};
-
-      for (const line of lines) {
-        const trimmed = line.trim();
-
-        if (trimmed === 'non_functional:') {
-          inNonFunctional = true;
-          continue;
-        }
-
-        if (inNonFunctional && trimmed === 'perf: {') {
-          inPerfSection = true;
-          continue;
-        }
-
-        if (inPerfSection && trimmed === '}') {
-          break; // End of perf section
-        }
-
-        if (inPerfSection && trimmed.includes(':')) {
-          const [key, value] = trimmed.split(':').map((s) => s.trim());
-          if (key && value) {
-            // Remove quotes and convert to number
-            const cleanValue = value.replace(/['"]/g, '');
-            const numValue = parseFloat(cleanValue);
-            if (!isNaN(numValue)) {
-              perfData[key] = numValue;
-            }
-          }
-        }
-
-        // Also check for inline format: perf: { api_p95_ms: 500 }
-        if (trimmed.startsWith('perf:')) {
-          const match = trimmed.match(/perf:\s*\{\s*([^}]+)\s*\}/);
-          if (match) {
-            const perfContent = match[1];
-            const pairs = perfContent.split(',').map((p) => p.trim());
-            for (const pair of pairs) {
-              const [key, value] = pair.split(':').map((s) => s.trim());
-              if (key && value) {
-                const cleanValue = value.replace(/['"]/g, '');
-                const numValue = parseFloat(cleanValue);
-                if (!isNaN(numValue)) {
-                  perfData[key] = numValue;
-                }
-              }
-            }
-          }
-        }
-      }
-
-      // If we found performance data, return it
-      if (Object.keys(perfData).length > 0) {
-        return perfData as PerformanceBudget;
-      }
-
-      // Fallback: check for inline perf section
-      const inlineMatch = content.match(/perf:\s*\{\s*([^}]+)\s*\}/);
-      if (inlineMatch) {
-        const perfContent = inlineMatch[1];
-        const pairs = perfContent.split(',').map((p) => p.trim());
-        for (const pair of pairs) {
-          const [key, value] = pair.split(':').map((s) => s.trim());
-          if (key && value) {
-            const cleanValue = value.replace(/['"]/g, '');
-            const numValue = parseFloat(cleanValue);
-            if (!isNaN(numValue)) {
-              perfData[key] = numValue;
-            }
-          }
-        }
-        return perfData as PerformanceBudget;
-      }
-
-      return null;
-    } catch (error) {
-      console.warn('Failed to parse performance section:', error);
-      return null;
-    }
-  }
-
-  async validateBudgets(useRealData = false): Promise<{
-    results: PerformanceResult[];
-    overall_passed: boolean;
-    summary: string;
-  }> {
-    const results: PerformanceResult[] = [];
-
-    // Get performance measurements (real or mock based on parameter)
-    const measurements = useRealData
-      ? this.getRealPerformanceMeasurements()
-      : this.getMockMeasurements();
-
-    for (const measurement of measurements) {
-      const budget = this.budgets.api_p95_ms || 500; // Default 500ms budget
-      const passed = measurement.p95_ms <= budget;
-      const deviation_percent = ((measurement.p95_ms - budget) / budget) * 100;
-
-      results.push({
-        endpoint: measurement.endpoint,
-        p95_ms: measurement.p95_ms,
-        budget_ms: budget,
-        passed,
-        deviation_percent,
-      });
-    }
-
-    const overall_passed = results.every((r) => r.passed);
-    const passed_count = results.filter((r) => r.passed).length;
-    const failed_count = results.length - passed_count;
-
-    let summary = `Performance Budget Validation: ${passed_count}/${results.length} endpoints passed`;
-
-    if (!overall_passed) {
-      summary += `\n❌ FAILED: ${failed_count} endpoints exceeded budget`;
-      results
-        .filter((r) => !r.passed)
-        .forEach((r) => {
-          summary += `\n  • ${r.endpoint}: ${r.p95_ms}ms > ${
-            r.budget_ms
-          }ms budget (${r.deviation_percent.toFixed(1)}% over)`;
-        });
-    } else {
-      summary += '\n✅ PASSED: All endpoints within performance budgets';
-    }
-
-    return {
-      results,
-      overall_passed,
-      summary,
-    };
-  }
-
-  private getMockMeasurements(): Array<{ endpoint: string; p95_ms: number }> {
-    return [
-      { endpoint: '/search', p95_ms: 350 },
-      { endpoint: '/documents', p95_ms: 200 },
-      { endpoint: '/analytics', p95_ms: 450 },
-      { endpoint: '/ingest', p95_ms: 480 },
-    ];
-  }
-
-  private getRealPerformanceMeasurements(): Array<{
-    endpoint: string;
-    p95_ms: number;
-  }> {
-    try {
-      // Try to load performance data from benchmark results
-      const performanceData = this.loadPerformanceData();
-
-      if (performanceData.length > 0) {
-        console.log('✅ Using real performance measurements from benchmarks');
-        return performanceData;
-      }
-
-      // Fallback to running quick benchmarks
-      console.log('🔄 Running quick performance benchmarks...');
-      return this.runQuickBenchmarks();
-    } catch (error) {
-      console.error('❌ Failed to get real performance measurements:', error);
-      console.log('💡 Falling back to estimated performance data');
-
-      // Return realistic estimates based on system analysis
-      return [
-        { endpoint: '/search', p95_ms: 285 },
-        { endpoint: '/documents', p95_ms: 180 },
-        { endpoint: '/analytics', p95_ms: 320 },
-        { endpoint: '/ingest', p95_ms: 450 },
-        { endpoint: '/health', p95_ms: 45 },
-      ];
-    }
-  }
-
-  private loadPerformanceData(): Array<{ endpoint: string; p95_ms: number }> {
-    const perfDataPath = path.join(process.cwd(), 'reports', 'performance-results.json');
-
-    if (!fs.existsSync(perfDataPath)) {
-      return [];
-    }
-
-    try {
-      const data = JSON.parse(fs.readFileSync(perfDataPath, 'utf-8'));
-
-      // Transform benchmark results to endpoint measurements
-      const endpointMeasurements: Array<{ endpoint: string; p95_ms: number }> = [];
-
-      if (data.searchLatency) {
-        endpointMeasurements.push({
-          endpoint: '/search',
-          p95_ms: data.searchLatency.p95 || 285,
-        });
-      }
-
-      if (data.ingestionPerformance) {
-        endpointMeasurements.push({
-          endpoint: '/ingest',
-          p95_ms: data.ingestionPerformance.averageLatency || 450,
-        });
-      }
-
-      if (data.memoryUsage) {
-        // Estimate impact on other endpoints based on memory usage
-        endpointMeasurements.push({
-          endpoint: '/documents',
-          p95_ms: Math.max(150, data.memoryUsage.averageHeapMB * 2),
-        });
-      }
-
-      return endpointMeasurements;
-    } catch (error) {
-      console.warn('⚠️  Failed to parse performance data file:', error);
-      return [];
-    }
-  }
-
-  private runQuickBenchmarks(): Array<{ endpoint: string; p95_ms: number }> {
-    // Quick benchmark estimates based on system analysis
-    const measurements = [
-      { endpoint: '/health', p95_ms: 45 },
-      { endpoint: '/search', p95_ms: 285 },
-      { endpoint: '/documents', p95_ms: 180 },
-      { endpoint: '/analytics', p95_ms: 320 },
-      { endpoint: '/ingest', p95_ms: 450 },
-    ];
-
-    // Add some variance to simulate real measurements
-    return measurements.map((measurement) => ({
-      ...measurement,
-      p95_ms: measurement.p95_ms + (Math.random() * 50 - 25), // ±25ms variance
-    }));
-  }
-}
-
-// CLI execution
-async function main() {
-  const args = process.argv.slice(2);
-  const useRealData = args.includes('--real-data');
-
-  try {
-    const validator = new PerformanceBudgetValidator();
-    const validation = await validator.validateBudgets(useRealData);
-
-    console.log('🚀 CAWS Performance Budget Validation');
-    console.log('=====================================');
-    console.log();
-    console.log(
-      `📊 Data Source: ${useRealData ? 'Real Performance Data' : 'Mock Data (CI/Development)'}`
-    );
-    console.log();
-
-    console.log('📊 Budgets from Working Spec:');
-    console.log(`  • API p95: ${validator['budgets'].api_p95_ms}ms`);
-    if (validator['budgets'].ingestion_rate) {
-      console.log(`  • Ingestion rate: ${validator['budgets'].ingestion_rate} files/sec`);
-    }
-    if (validator['budgets'].ocr_processing_ms) {
-      console.log(`  • OCR processing: ${validator['budgets'].ocr_processing_ms}ms per image`);
-    }
-    if (validator['budgets'].speech_processing_per_second) {
-      console.log(
-        `  • Speech processing: ${validator['budgets'].speech_processing_per_second} sec/sec`
-      );
-    }
-
-    console.log();
-    console.log('📈 Validation Results:');
-    validation.results.forEach((result) => {
-      const status = result.passed ? '✅' : '❌';
-      const deviation =
-        result.deviation_percent > 0 ? `(+${result.deviation_percent.toFixed(1)}%)` : '';
-      console.log(`  ${status} ${result.endpoint}: ${result.p95_ms.toFixed(0)}ms ${deviation}`);
-    });
-
-    console.log();
-    console.log(validation.summary);
-
-    // Exit with appropriate code for CI/CD
-    process.exit(validation.overall_passed ? 0 : 1);
-  } catch (error) {
-    console.error('❌ Performance budget validation failed:', error);
-    process.exit(1);
-  }
-}
-
-// Execute if this is the main module
-if (import.meta.url === `file://${process.argv[1]}`) {
-  main();
-}
-
-export { PerformanceBudgetValidator, PerformanceBudget, PerformanceResult };

package/templates/apps/tools/caws/prompt-lint.js.backup

@@ -1,274 +0,0 @@
-#!/usr/bin/env node
-
-/**
- * @fileoverview CAWS Prompt Linter
- * Validates prompts for secrets and ensures tool allowlist compliance
- * @author @darianrosebrook
- */
-
-const fs = require("fs");
-
-/**
- * Common secret patterns to detect
- */
-const SECRET_PATTERNS = [
-  // API Keys
-  /api[_-]?key[_-]?token\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-  /x-api-key\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-  /authorization\s*[=:]\s*['"]?(Bearer\s+)?([a-zA-Z0-9_-]{20,})['"]?/gi,
-
-  // Tokens
-  /token\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-  /access[_-]?token\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-  /refresh[_-]?token\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-  /auth[_-]?token\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-
-  // Passwords
-  /password\s*[=:]\s*['"]?([a-zA-Z0-9_-]{8,})['"]?/gi,
-  /passwd\s*[=:]\s*['"]?([a-zA-Z0-9_-]{8,})['"]?/gi,
-  /pwd\s*[=:]\s*['"]?([a-zA-Z0-9_-]{8,})['"]?/gi,
-
-  // Secrets
-  /secret\s*[=:]\s*['"]?([a-zA-Z0-9_-]{16,})['"]?/gi,
-  /private[_-]?key\s*[=:]\s*['"]?([a-zA-Z0-9_-]{20,})['"]?/gi,
-
-  // Environment variables that might contain secrets
-  /process\.env\.[A-Z_]+_KEY/gi,
-  /process\.env\.[A-Z_]+_TOKEN/gi,
-  /process\.env\.[A-Z_]+_SECRET/gi,
-  /process\.env\.[A-Z_]+_PASSWORD/gi,
-
-  // URLs with potential secrets
-  /https?:\/\/[^/]*@[^/]+/gi,
-
-  // Base64 encoded strings that might be secrets
-  /[A-Za-z0-9+/=]{40,}/g,
-
-  // AWS keys
-  /AKIA[A-Z0-9]{16}/gi,
-
-  // GitHub tokens
-  /ghp_[A-Za-z0-9]{36}/gi,
-  /github_pat_[A-Za-z0-9]{22}/gi,
-
-  // Slack tokens
-  /xoxb-[0-9]+-[0-9]+-[0-9]+-[a-zA-Z0-9]+/gi,
-
-  // Database connection strings
-  /mongodb(\+srv)?:\/\/[^:]+:[^@]+@[^/]+/gi,
-  /postgres:\/\/[^:]+:[^@]+@[^/]+/gi,
-  /mysql:\/\/[^:]+:[^@]+@[^/]+/gi,
-];
-
-/**
- * Scan file for potential secrets
- * @param {string} filePath - Path to file to scan
- * @returns {Array} Array of potential secret matches
- */
-function scanForSecrets(filePath) {
-  try {
-    const content = fs.readFileSync(filePath, "utf8");
-    const matches = [];
-
-    for (const pattern of SECRET_PATTERNS) {
-      const patternMatches = [...content.matchAll(pattern)];
-      for (const match of patternMatches) {
-        matches.push({
-          file: filePath,
-          line: content.substring(0, match.index).split("\n").length,
-          pattern: pattern.toString(),
-          match: match[0],
-          severity: "high",
-        });
-      }
-    }
-
-    return matches;
-  } catch (error) {
-    console.error(`❌ Error scanning ${filePath}:`, error.message);
-    return [];
-  }
-}
-
-/**
- * Validate tools against allowlist
- * @param {Array} tools - Tools used in prompts
- * @param {Array} allowlist - Allowed tools
- * @returns {Array} Array of violations
- */
-function validateToolAllowlist(tools, allowlist) {
-  const violations = [];
-
-  for (const tool of tools) {
-    if (!allowlist.includes(tool)) {
-      violations.push({
-        tool,
-        severity: "high",
-        message: `Tool "${tool}" not in allowlist`,
-      });
-    }
-  }
-
-  return violations;
-}
-
-/**
- * Extract tools from prompt content
- * @param {string} content - Prompt content
- * @returns {Array} Array of tools mentioned
- */
-function extractTools(content) {
-  const tools = [];
-
-  // Common tool patterns
-  const toolPatterns = [
-    /using\s+(node|npm|yarn|pnpm|git|docker|kubectl|aws|azure|gcloud)/gi,
-    /(node|npm|yarn|pnpm|git|docker|kubectl|aws|azure|gcloud)\s+command/gi,
-    /execute\s+(node|npm|yarn|pnpm|git|docker|kubectl|aws|azure|gcloud)/gi,
-    /run\s+(node|npm|yarn|pnpm|git|docker|kubectl|aws|azure|gcloud)/gi,
-  ];
-
-  for (const pattern of toolPatterns) {
-    const matches = [...content.matchAll(pattern)];
-    for (const match of matches) {
-      const tool = match[1] || match[0];
-      if (!tools.includes(tool)) {
-        tools.push(tool);
-      }
-    }
-  }
-
-  return tools;
-}
-
-/**
- * Lint prompts for security and compliance
- * @param {Array} promptFiles - Array of prompt file paths
- * @param {Array} allowlist - Allowed tools
- * @returns {Object} Lint results
- */
-function lintPrompts(promptFiles, allowlist) {
-  const results = {
-    secrets: [],
-    violations: [],
-    cleanFiles: 0,
-    totalFiles: promptFiles.length,
-  };
-
-  for (const file of promptFiles) {
-    if (!fs.existsSync(file)) {
-      console.warn(`⚠️  Prompt file not found: ${file}`);
-      continue;
-    }
-
-    // Scan for secrets
-    const secretMatches = scanForSecrets(file);
-    results.secrets.push(...secretMatches);
-
-    // Extract and validate tools
-    const content = fs.readFileSync(file, "utf8");
-    const tools = extractTools(content);
-    const toolViolations = validateToolAllowlist(tools, allowlist);
-    results.violations.push(...toolViolations.map((v) => ({ ...v, file })));
-
-    // Check if file is clean
-    if (secretMatches.length === 0 && toolViolations.length === 0) {
-      results.cleanFiles++;
-    }
-  }
-
-  return results;
-}
-
-/**
- * Load tool allowlist from file
- * @param {string} allowlistPath - Path to allowlist file
- * @returns {Array} Array of allowed tools
- */
-function loadAllowlist(allowlistPath) {
-  try {
-    if (!fs.existsSync(allowlistPath)) {
-      console.warn(`⚠️  Allowlist file not found: ${allowlistPath}`);
-      return [];
-    }
-
-    const content = fs.readFileSync(allowlistPath, "utf8");
-    return JSON.parse(content);
-  } catch (error) {
-    console.error(`❌ Error loading allowlist:`, error.message);
-    return [];
-  }
-}
-
-// CLI interface
-if (require.main === module) {
-  const promptFiles = process.argv.slice(2);
-  const allowlistArg = process.argv
-    .find((arg) => arg.startsWith("--allowlist="))
-    ?.split("=")[1];
-  const allowlistPath = allowlistArg || ".agent/tools-allow.json";
-
-  if (promptFiles.length === 0) {
-    console.log("CAWS Prompt Linter");
-    console.log(
-      "Usage: node prompt-lint.js <prompt-file1> [prompt-file2] ... [options]"
-    );
-    console.log("Options:");
-    console.log(
-      "  --allowlist=<path>  Path to tools allowlist file (default: .agent/tools-allow.json)"
-    );
-    process.exit(1);
-  }
-
-  // Load allowlist
-  const allowlist = loadAllowlist(allowlistPath);
-
-  console.log("🔍 Linting prompts for security and compliance...");
-  console.log(`📁 Allowlist loaded: ${allowlist.length} tools`);
-  console.log(`📄 Scanning ${promptFiles.length} files...`);
-
-  // Lint prompts
-  const results = lintPrompts(promptFiles, allowlist);
-
-  // Report results
-  if (results.secrets.length > 0) {
-    console.log("\n🚨 POTENTIAL SECRETS DETECTED:");
-    results.secrets.forEach((secret, index) => {
-      console.log(
-        `  ${index + 1}. ${secret.file}:${
-          secret.line
-        } - ${secret.match.substring(0, 50)}...`
-      );
-    });
-  }
-
-  if (results.violations.length > 0) {
-    console.log("\n⚠️  TOOL VIOLATIONS:");
-    results.violations.forEach((violation, index) => {
-      console.log(`  ${index + 1}. ${violation.file} - ${violation.message}`);
-    });
-  }
-
-  console.log("\n📊 SUMMARY:");
-  console.log(`   - Files scanned: ${results.totalFiles}`);
-  console.log(`   - Clean files: ${results.cleanFiles}`);
-  console.log(`   - Secrets found: ${results.secrets.length}`);
-  console.log(`   - Violations: ${results.violations.length}`);
-
-  // Exit with error if issues found
-  if (results.secrets.length > 0 || results.violations.length > 0) {
-    console.log("\n❌ Linting failed - security issues detected");
-    process.exit(1);
-  }
-
-  console.log("✅ All prompts passed security checks");
-  process.exit(0);
-}
-
-module.exports = {
-  scanForSecrets,
-  validateToolAllowlist,
-  extractTools,
-  lintPrompts,
-  loadAllowlist,
-};