@poetic-ai/poetic 1.42.1-bootstrap.0

package/dist/chunk-JEV6UI7H.js

@@ -0,0 +1,537 @@
+import {
+  aggregateResolverOutcomes,
+  classifyResolverCommand
+} from "./chunk-UKMAFG7A.js";
+import {
+  buildTargetWorktreeExecutionScope
+} from "./chunk-MFADRRTR.js";
+import {
+  buildProjectVerificationGuidance
+} from "./chunk-MCPQNJMK.js";
+import {
+  parseJsonWithContext
+} from "./chunk-QVZMFDYG.js";
+import {
+  runVerificationCommand
+} from "./chunk-FEQ4HXL7.js";
+import {
+  selectFallbacksForCommand
+} from "./chunk-4BIPZBT7.js";
+
+// src/core/execution/quality-gate.ts
+import { execa } from "execa";
+
+// src/core/execution/quality-gate-resolver-shadow.ts
+function formatRanCommand(step) {
+  if (!step) {
+    return "";
+  }
+  return [step.command, ...step.args].join(" ").trim();
+}
+function buildCoverageComparison(step, capabilities) {
+  const ranCommand = formatRanCommand(step);
+  const resolverEquivalent = [...capabilities.verification.coverage ?? []];
+  const divergence = resolverEquivalent.length > 0 ? "match" : "resolver-absent";
+  return { ranCommand, resolverEquivalent, divergence };
+}
+function buildLintComparison(step, capabilities) {
+  const ranCommand = formatRanCommand(step);
+  const typecheck = capabilities.verification.typecheck;
+  const lint = capabilities.verification.lint;
+  const resolverEquivalent = [...typecheck, ...lint];
+  let divergence;
+  if (resolverEquivalent.length === 0) {
+    divergence = "resolver-absent";
+  } else if (lint.length > 0) {
+    divergence = "resolver-richer";
+  } else {
+    divergence = "match";
+  }
+  return { ranCommand, resolverEquivalent, divergence };
+}
+function buildSecurityComparison(step, capabilities) {
+  const ranCommand = formatRanCommand(step);
+  const resolverEquivalent = [...capabilities.verification.audit ?? []];
+  const divergence = resolverEquivalent.length > 0 ? "match" : "resolver-absent";
+  return { ranCommand, resolverEquivalent, divergence };
+}
+function resolverHasAnyVerification(capabilities) {
+  const v = capabilities.verification;
+  return v.format.length > 0 || v.build.length > 0 || v.typecheck.length > 0 || v.lint.length > 0 || v.test.length > 0 || // Optional buckets added this epic: any derived audit/coverage command also
+  // means the resolver could verify this target. Read with `?? []`.
+  (v.audit ?? []).length > 0 || (v.coverage ?? []).length > 0;
+}
+function buildSummary(languages, resolverWouldVerify, gates) {
+  const languageLabel = languages.length > 0 ? languages.join(", ") : "unknown";
+  const divergences = Object.keys(gates).map((id) => `${id}=${gates[id].divergence}`).join(", ");
+  const verifyLabel = resolverWouldVerify ? "resolver could verify this target" : "resolver detected no verification commands";
+  return `Resolver shadow (observation-only): languages=${languageLabel}; ${verifyLabel}; gate divergence: ${divergences}.`;
+}
+function computeResolverShadow(input) {
+  const { ranSteps, capabilities } = input;
+  const stepById = /* @__PURE__ */ new Map();
+  for (const step of ranSteps) {
+    stepById.set(step.id, step);
+  }
+  const gates = {
+    coverage: buildCoverageComparison(stepById.get("coverage"), capabilities),
+    lint: buildLintComparison(stepById.get("lint"), capabilities),
+    security: buildSecurityComparison(stepById.get("security"), capabilities)
+  };
+  const languages = [...capabilities.languages];
+  const resolverWouldVerify = resolverHasAnyVerification(capabilities);
+  const summary = buildSummary(languages, resolverWouldVerify, gates);
+  return {
+    applied: false,
+    languages,
+    gates,
+    resolverWouldVerify,
+    summary
+  };
+}
+
+// src/core/execution/quality-gate.ts
+var NON_BLOCKING_QUALITY_GATE_SKIP_MARKERS = [
+  "skipped by configuration",
+  "not applicable to this target",
+  // Legacy Node applicability-skip markers (no longer emitted by the runner;
+  // retained for defensive back-compat — see doc above).
+  "package.json not found",
+  "no supported lockfile",
+  "has no typecheck script",
+  "has no test:coverage script",
+  "packagemanager is"
+];
+var NodeCommandRunner = class {
+  async run(command, args, options = {}) {
+    const start = Date.now();
+    const result = await execa(command, args, {
+      cwd: options.cwd,
+      env: options.env,
+      timeout: options.timeoutMs,
+      reject: false,
+      all: false
+    });
+    return {
+      exitCode: result.exitCode ?? null,
+      stdout: result.stdout ?? "",
+      stderr: result.stderr ?? "",
+      timedOut: result.timedOut,
+      durationMs: Date.now() - start
+    };
+  }
+};
+var QualityGateRunner = class {
+  /**
+   * The constructor still accepts an injectable {@link CommandRunner} for API
+   * compatibility, but post-collapse the runner NO LONGER dispatches any command
+   * through it: every gate flows through the resolver-backed path, which executes
+   * via `runVerificationCommand`. An injected runner is therefore never invoked
+   * (tests rely on this to assert the old hardcoded Node path is dead). The
+   * parameter is intentionally unused.
+   */
+  // biome-ignore lint/complexity/noUselessConstructor: retained for API/test compatibility; the injectable runner is intentionally never invoked post-collapse (proves the hardcoded Node path is dead).
+  constructor(_commandRunner = new NodeCommandRunner()) {
+  }
+  /**
+   * Execute the configured set of quality gates and report the overall outcome.
+   *
+   * SINGLE PATH (backlog 20260627T191653Z-0dc1083f21dc): every target language —
+   * Node and non-Node alike — flows through the resolver-backed path. Commands
+   * are read from the language-neutral resolver
+   * ({@link ProjectCapabilities.verification}, never hardcoded) and classified by
+   * the single fail-closed classifier {@link classifyResolverCommand}. The former
+   * Node fork (hardcoded `npm run test:coverage` / `npm run typecheck` /
+   * `npm audit` gates, evaluated by their own exit-code/JSON logic) is gone.
+   */
+  async run(options = {}) {
+    const shadowSteps = buildShadowBaselineSteps(options);
+    const results = [];
+    const cwd = options.cwd ?? process.cwd();
+    const scopeResult = buildTargetWorktreeExecutionScope({
+      root: cwd,
+      confirmedRoot: true
+    });
+    if (scopeResult.status === "fail") {
+      for (const step of shadowSteps) {
+        results.push(createScopeFailureResult(step, scopeResult.reason));
+      }
+      const shadow2 = this.buildResolverShadow(shadowSteps, void 0, cwd);
+      return { success: false, results, ...shadow2 ? { shadow: shadow2 } : {} };
+    }
+    if (scopeResult.status === "unavailable") {
+      for (const step of shadowSteps) {
+        results.push(createUnavailableResult(step.id, cwd, scopeResult.reason));
+      }
+      const shadow2 = this.buildResolverShadow(shadowSteps, void 0, cwd);
+      return { success: this.summarizeSuccess(results), results, ...shadow2 ? { shadow: shadow2 } : {} };
+    }
+    const capabilities = scopeResult.value.capabilities;
+    const resolverResults = await this.runResolverBackedGates(capabilities, cwd, options);
+    const shadow = this.buildResolverShadow(shadowSteps, capabilities, cwd);
+    return {
+      success: this.summarizeSuccess(resolverResults),
+      results: resolverResults,
+      ...shadow ? { shadow } : {}
+    };
+  }
+  /**
+   * Compute the observation-only resolver shadow comparison. STRICTLY ADDITIVE:
+   * any failure here is swallowed and the shadow is omitted so the gate result is
+   * never affected.
+   *
+   * @param steps - The npm steps the runner built.
+   * @param capabilities - Resolver capabilities, when already available in scope.
+   *   When omitted, capabilities are derived via buildProjectVerificationGuidance.
+   * @param cwd - Working directory used to derive capabilities when not supplied.
+   */
+  buildResolverShadow(steps, capabilities, cwd) {
+    try {
+      const resolvedCapabilities = capabilities ?? buildProjectVerificationGuidance(cwd).capabilities;
+      return computeResolverShadow({
+        ranSteps: steps.map((step) => ({
+          id: step.id,
+          command: step.command,
+          args: step.args
+        })),
+        capabilities: resolvedCapabilities
+      });
+    } catch {
+      return void 0;
+    }
+  }
+  /**
+   * Run REAL verification gates for ANY target language using resolver-derived
+   * commands, fail-closed. This is the SINGLE [B6] language-neutral path (no Node
+   * fork): commands are read from {@link ProjectCapabilities.verification} (never
+   * hardcoded) and classified by the single fail-closed classifier
+   * {@link classifyResolverCommand} (which mirrors the deterministic test gate,
+   * src/core/judge/test-gate.ts runCapabilityTestCommand).
+   *
+   * Gate-id mapping onto the 3-value {@link QualityGateId} union (NOT widened):
+   *  - `coverage` <- resolver `coverage` bucket when present (Node's
+   *    `npm run test:coverage`, Go's `go test -cover`, ...); else FALL BACK to the
+   *    primary `test` bucket (+`testFallback`). This preserves the pre-collapse
+   *    non-Node behavior (a pytest/go-test project with no dedicated coverage
+   *    command still verifies via its `test` runner) while routing Node's real
+   *    coverage command (now modeled in the `coverage` bucket) here too.
+   *  - `lint` <- resolver `lint` + `typecheck` + `format` (static-analysis family).
+   *  - `security` <- resolver `audit` bucket (Node `npm audit ...`, Go
+   *    `govulncheck`, Rust `cargo audit`, Python `pip-audit`). The audit command's
+   *    pass/fail is decided by the SAME exit-code classifier as every other
+   *    command. ENUMERATED INTENTIONAL DIFFERENCE vs the deleted hardcoded Node
+   *    security gate: that gate produced a richer per-severity summary message via
+   *    parseSecurityOutput, whereas the classifier emits a generic message. The
+   *    PASS/FAIL verdict is byte-identical because `npm audit --audit-level=high`
+   *    exits NONZERO iff a high/critical (blocking) vulnerability exists (low/
+   *    moderate -> exit 0), exactly the blocking-count condition parseSecurityOutput
+   *    enforced. The audit JSON is preserved on the gate result's `stdout`, so the
+   *    downstream {@link countBlockingVulnerabilities} consumer
+   *    (autonomous-loop-controller security-regression count) keeps working.
+   *
+   * Per-gate aggregation (a gate id may collect several resolver commands, e.g.
+   * lint+typecheck both map to `lint`) is FAIL-CLOSED for the whole bucket: every
+   * command is executed with a shared remaining timeout budget. Dominance order
+   * (A8): real failure/error > timeout > unavailable > passed. The gate FAILS if
+   * any command ran-and-failed; else TIMEOUT if any timed out / budget exhausted;
+   * else UNAVAILABLE if ANY command is tool-unavailable (a required verification
+   * kind we could not run cannot be certified — a passing ruff must not mask an
+   * unavailable mypy); it PASSES only when EVERY command ran and passed.
+   *
+   * Honesty contract for an ABSENT bucket: when a requested gate has NO resolver
+   * command (e.g. a Node project with no test:coverage script, a docs-only target,
+   * a pnpm project that cannot run `npm audit`), the gate is emitted as
+   * {@link createUnavailableResult} ({ skipped:true, unavailable:true,
+   * success:false }) — never a silent pass. summarizeSuccess (>=1 EXECUTED gate
+   * that succeeded) therefore drives the overall run FALSE for an all-unavailable
+   * target, preserving the pre-collapse fail-closed outcome.
+   *
+   * Caller gate-skip options are honored: options.coverage/lint/security === false
+   * emits a success:true skipped entry (createSkippedResult) and the corresponding
+   * bucket is NOT run, so summarizeSuccess filters it out (neither passes nor fails
+   * the run).
+   *
+   * The coverage `test`-fallback path honors the resolver `testFallback` contract:
+   * a fallback command is tried ONLY when the primary `test` command reports its
+   * tool unavailable; fallbacks are never additional gates.
+   */
+  async runResolverBackedGates(capabilities, cwd, options) {
+    const verification = capabilities.verification;
+    const results = [];
+    let remainingTimeoutMs = typeof options.timeoutMs === "number" && Number.isFinite(options.timeoutMs) ? Math.max(0, Math.floor(options.timeoutMs)) : void 0;
+    const runOne = async (command) => {
+      if (remainingTimeoutMs !== void 0 && remainingTimeoutMs <= 0) {
+        return {
+          // Shared channel/run budget exhausted: timeout tier (never a pass), ranked
+          // below real failures and above unavailable in aggregate dominance.
+          classification: "timeout",
+          command,
+          message: "Resolver gate skipped: autoloop timebox exhausted.",
+          stdout: "",
+          stderr: "",
+          durationMs: 0,
+          parsed: false
+        };
+      }
+      const stepTimeoutMs = remainingTimeoutMs !== void 0 ? Math.max(1, remainingTimeoutMs) : void 0;
+      const start = Date.now();
+      try {
+        const result = await runVerificationCommand(command, { cwd, timeoutMs: stepTimeoutMs });
+        const durationMs = Date.now() - start;
+        if (remainingTimeoutMs !== void 0) {
+          remainingTimeoutMs = Math.max(0, remainingTimeoutMs - durationMs);
+        }
+        return classifyResolverCommand(command, result, durationMs);
+      } catch (error) {
+        const durationMs = Date.now() - start;
+        if (remainingTimeoutMs !== void 0) {
+          remainingTimeoutMs = Math.max(0, remainingTimeoutMs - durationMs);
+        }
+        const detail = error instanceof Error ? error.message : String(error);
+        return {
+          classification: "failed",
+          command,
+          message: `Verification command "${command}" threw before completing: ${detail}`,
+          stdout: "",
+          stderr: detail,
+          durationMs,
+          parsed: false
+        };
+      }
+    };
+    const useCoverageBucket = (verification.coverage ?? []).length > 0;
+    const coverageCommands = useCoverageBucket ? verification.coverage ?? [] : verification.test;
+    const lintCommands = [...verification.lint, ...verification.typecheck, ...verification.format];
+    const auditCommands = verification.audit ?? [];
+    const anyGateHasCommands = coverageCommands.length > 0 || lintCommands.length > 0 || auditCommands.length > 0;
+    if (options.coverage === false) {
+      results.push(
+        createSkippedResult("coverage", "Test coverage check skipped by configuration.")
+      );
+    } else if (coverageCommands.length > 0) {
+      const allowFallback = !useCoverageBucket;
+      const outcomes = [];
+      for (const command of coverageCommands) {
+        let outcome = await runOne(command);
+        if (allowFallback && outcome.classification === "unavailable") {
+          const fallbacks = selectFallbacksForCommand(command, verification.testFallback);
+          for (const fallback of fallbacks) {
+            const fallbackOutcome = await runOne(fallback);
+            if (fallbackOutcome.classification !== "unavailable") {
+              outcome = fallbackOutcome;
+              break;
+            }
+          }
+        }
+        outcomes.push(outcome);
+      }
+      results.push(aggregateResolverGate("coverage", outcomes));
+    } else if (!anyGateHasCommands) {
+      results.push(createUnavailableResult("coverage", cwd, void 0, true));
+    }
+    if (options.lint === false) {
+      results.push(createSkippedResult("lint", "Linting skipped by configuration."));
+    } else if (lintCommands.length > 0) {
+      const outcomes = [];
+      for (const command of lintCommands) {
+        outcomes.push(await runOne(command));
+      }
+      results.push(aggregateResolverGate("lint", outcomes));
+    } else if (!anyGateHasCommands) {
+      results.push(createUnavailableResult("lint", cwd, void 0, true));
+    }
+    if (options.security === false) {
+      results.push(createSkippedResult("security", "Security audit skipped by configuration."));
+    } else if (auditCommands.length > 0) {
+      const outcomes = [];
+      for (const command of auditCommands) {
+        outcomes.push(await runOne(command));
+      }
+      results.push(aggregateResolverGate("security", outcomes));
+    } else if (anyGateHasCommands) {
+      if (options.securityNotModeled === "not-applicable") {
+        results.push({
+          ...createSkippedResult(
+            "security",
+            "Security audit not applicable to this target: no audit command was detected."
+          ),
+          notApplicable: true
+        });
+      } else if (options.security === true) {
+        results.push(
+          createUnavailableResult("security", cwd, "no security audit command was detected", true)
+        );
+      }
+    } else if (!anyGateHasCommands) {
+      results.push(createUnavailableResult("security", cwd, void 0, true));
+    }
+    return results;
+  }
+  summarizeSuccess(results) {
+    const executedResults = results.filter((res) => res.skipped !== true);
+    return executedResults.length > 0 && results.every((res) => res.success);
+  }
+};
+function buildShadowBaselineSteps(options) {
+  const npmCommand = getNpmCommand();
+  const steps = [];
+  if (options.coverage !== false) {
+    steps.push({
+      id: "coverage",
+      title: "Test Coverage",
+      command: npmCommand,
+      args: ["run", "test:coverage"],
+      description: "Run the test suite with coverage reporting."
+    });
+  }
+  if (options.lint !== false) {
+    steps.push({
+      id: "lint",
+      title: "Static Analysis",
+      command: npmCommand,
+      args: ["run", "typecheck"],
+      description: "Type-driven linting using the project TypeScript configuration."
+    });
+  }
+  if (options.security !== false) {
+    steps.push({
+      id: "security",
+      title: "Dependency Security Audit",
+      command: npmCommand,
+      args: ["audit", "--omit=dev", "--audit-level=high", "--json"],
+      description: "Check production dependencies for known vulnerabilities using npm audit."
+    });
+  }
+  return steps;
+}
+function isSeverityBlocking(level) {
+  const normalized = level.toLowerCase();
+  return normalized === "critical" || normalized === "high";
+}
+function countBlockingVulnerabilities(stdout) {
+  const output = stdout.trim();
+  if (!output) {
+    return null;
+  }
+  try {
+    const parsed = parseJsonWithContext(output, "security scan output");
+    const parsedObj = parsed;
+    const metadata = parsedObj?.metadata;
+    const vulnerabilities = metadata?.vulnerabilities;
+    if (!vulnerabilities) {
+      return null;
+    }
+    return Object.entries(vulnerabilities).reduce((acc, [level, count]) => {
+      const numeric = typeof count === "number" && Number.isFinite(count) ? count : 0;
+      return isSeverityBlocking(level) ? acc + numeric : acc;
+    }, 0);
+  } catch {
+    return null;
+  }
+}
+function getNpmCommand() {
+  return process.platform === "win32" ? "npm.cmd" : "npm";
+}
+function aggregateResolverGate(gate, outcomes) {
+  const aggregate = aggregateResolverOutcomes(outcomes);
+  const representative = aggregate.representative;
+  if (aggregate.classification === "failed" || aggregate.classification === "timeout") {
+    return {
+      gate,
+      success: false,
+      message: representative?.message ?? (aggregate.classification === "timeout" ? `Resolver ${gate} gate timed out.` : `Resolver ${gate} gate failed.`),
+      command: representative?.command ?? "",
+      args: [],
+      stdout: representative?.stdout ?? "",
+      stderr: representative?.stderr ?? "",
+      durationMs: representative?.durationMs ?? 0
+    };
+  }
+  if (aggregate.classification === "unavailable") {
+    const zeroTestsNoEvidence = outcomes.some((outcome) => outcome.zeroTestsNoEvidence === true) || representative?.zeroTestsNoEvidence === true;
+    return {
+      gate,
+      success: false,
+      skipped: true,
+      unavailable: true,
+      zeroTestsNoEvidence: zeroTestsNoEvidence || void 0,
+      message: representative ? representative.message : `Resolver ${gate} gate unavailable: no verification tool was found.`,
+      command: representative?.command ?? "",
+      args: [],
+      stdout: representative?.stdout ?? "",
+      stderr: representative?.stderr ?? "",
+      durationMs: representative?.durationMs ?? 0
+    };
+  }
+  return {
+    gate,
+    success: true,
+    message: representative?.message ?? `Resolver ${gate} gate passed.`,
+    command: representative?.command ?? "",
+    args: [],
+    stdout: representative?.stdout ?? "",
+    stderr: representative?.stderr ?? "",
+    durationMs: representative?.durationMs ?? 0
+  };
+}
+function createSkippedResult(gate, message) {
+  return {
+    gate,
+    success: true,
+    skipped: true,
+    message,
+    command: "",
+    args: [],
+    stdout: "",
+    stderr: "",
+    durationMs: 0
+  };
+}
+function createScopeFailureResult(step, reason) {
+  return {
+    gate: step.id,
+    success: false,
+    message: `Quality gate scope setup failed: ${reason}`,
+    command: step.command,
+    args: step.args,
+    stdout: "",
+    stderr: "",
+    durationMs: 0
+  };
+}
+function createUnavailableResult(gate, cwd, reason = "target project is not a Node package", notApplicable = false) {
+  let detail;
+  try {
+    const guidance = buildProjectVerificationGuidance(cwd);
+    const languages = guidance.capabilities.languages.join(", ");
+    const commandSummary = guidance.commands.length > 0 ? `Detected verification commands: ${guidance.commands.slice(0, 3).map((command) => command.command).join("; ")}${guidance.commands.length > 3 ? "; ..." : ""}.` : 'No deterministic verification command was detected. Hint: declare one in .poetic/config/poetic.config.jsonc under a "verification" object (keys: format, build, typecheck, lint, test; each a string or array of strings), e.g. verification.test, so Poetic can run it automatically.';
+    detail = `Detected target languages: ${languages}. ${commandSummary}`;
+  } catch (error) {
+    const message = error instanceof Error ? error.message : String(error);
+    detail = `Project verification guidance unavailable: ${message}`;
+  }
+  return {
+    gate,
+    success: false,
+    skipped: true,
+    unavailable: true,
+    ...notApplicable ? { notApplicable: true } : {},
+    message: `${capitalizeGateId(gate)} gate unavailable: ${reason}. ${detail}`,
+    command: "",
+    args: [],
+    stdout: "",
+    stderr: "",
+    durationMs: 0
+  };
+}
+function capitalizeGateId(gate) {
+  return gate.charAt(0).toUpperCase() + gate.slice(1);
+}
+
+export {
+  NON_BLOCKING_QUALITY_GATE_SKIP_MARKERS,
+  NodeCommandRunner,
+  QualityGateRunner,
+  countBlockingVulnerabilities
+};
+//# sourceMappingURL=chunk-JEV6UI7H.js.map