@praneeth_54/agentdoctor 2.0.0 → 2.0.1

package/dist/storage/sqlite.js

@@ -0,0 +1,77 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { resolveRepoRoot } from "../utils/path.js";
+/**
+ * SQLite-backed StorageProvider using Node's built-in `node:sqlite` (DatabaseSync).
+ * Available on Node 22+; feature-detected at runtime.
+ */
+export class SqliteStorageProvider {
+    kind = "sqlite";
+    db;
+    dbPath;
+    constructor(db, dbPath) {
+        this.db = db;
+        this.dbPath = dbPath;
+        this.db.exec(`
+      CREATE TABLE IF NOT EXISTS kv (
+        key TEXT PRIMARY KEY,
+        value TEXT NOT NULL
+      );
+    `);
+    }
+    get path() {
+        return this.dbPath;
+    }
+    async get(key) {
+        const row = this.db.prepare("SELECT value FROM kv WHERE key = ?").get(key);
+        return row?.value ?? null;
+    }
+    async set(key, value) {
+        this.db
+            .prepare("INSERT INTO kv (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.value")
+            .run(key, value);
+    }
+    async delete(key) {
+        this.db.prepare("DELETE FROM kv WHERE key = ?").run(key);
+    }
+    async list(prefix) {
+        const rows = this.db
+            .prepare("SELECT key FROM kv WHERE key LIKE ? ORDER BY key")
+            .all(`${prefix}%`);
+        return rows.map((r) => r.key);
+    }
+    close() {
+        this.db.close();
+    }
+}
+/**
+ * Create SQLite storage at `.agentdoctor/storage.sqlite` when `node:sqlite` is available.
+ */
+export async function tryCreateSqliteStorage(rootInput) {
+    let DatabaseSync;
+    try {
+        const mod = await import("node:sqlite");
+        if (!mod || typeof mod.DatabaseSync !== "function") {
+            return { error: "node:sqlite DatabaseSync is not available in this Node runtime" };
+        }
+        DatabaseSync = mod.DatabaseSync;
+    }
+    catch (error) {
+        return {
+            error: `SQLite storage requires Node.js with node:sqlite (typically Node 22+): ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+    try {
+        const root = resolveRepoRoot(rootInput);
+        const dir = path.join(root, ".agentdoctor");
+        await fs.mkdir(dir, { recursive: true });
+        const dbPath = path.join(dir, "storage.sqlite");
+        const db = new DatabaseSync(dbPath);
+        return new SqliteStorageProvider(db, dbPath);
+    }
+    catch (error) {
+        return {
+            error: `Failed to open SQLite storage: ${error instanceof Error ? error.message : String(error)}`,
+        };
+    }
+}

package/dist/team/auth.js

@@ -9,7 +9,7 @@ export async function registerLocalDevUser(options) {
     const storage = options.storage ?? new FilesystemStorageProvider(options.root, ".agentdoctor/team");
     const salt = randomBytes(16).toString("hex");
     const user = {
-        id: `user_${createHash("sha1").update(options.username).digest("hex").slice(0, 10)}`,
+        id: `user_${createHash("sha256").update(options.username).digest("hex").slice(0, 10)}`,
         username: options.username,
         passwordHash: hashPassword(options.password, salt),
         salt,

package/dist/workspace/index.d.ts

@@ -0,0 +1,69 @@
+export declare const WORKSPACE_SCHEMA_VERSION: "1.0.0";
+export interface WorkspaceModel {
+    schemaVersion: typeof WORKSPACE_SCHEMA_VERSION;
+    id: string;
+    name: string;
+    /** Absolute, resolved repository roots that belong to this workspace. */
+    repositoryRoots: string[];
+    /**
+     * When false (default), operations scoped to repo A must not read paths under repo B
+     * even if both are members of the same workspace.
+     */
+    allowCrossRead: boolean;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface WorkspacePathAccess {
+    allowed: boolean;
+    reason: string;
+    workspaceId?: string;
+    requestedRoot?: string;
+    targetRoot?: string;
+}
+export declare function initWorkspace(options: {
+    controlRoot: string;
+    name: string;
+    repositoryRoot?: string;
+    id?: string;
+    allowCrossRead?: boolean;
+}): Promise<WorkspaceModel>;
+export declare function loadWorkspace(controlRoot: string, id: string): Promise<WorkspaceModel | null>;
+export declare function listWorkspaces(controlRoot: string): Promise<WorkspaceModel[]>;
+export declare function addRepositoryToWorkspace(options: {
+    controlRoot: string;
+    workspaceId: string;
+    repositoryRoot: string;
+}): Promise<WorkspaceModel>;
+export declare function removeWorkspace(controlRoot: string, id: string): Promise<boolean>;
+export declare function workspaceStatus(controlRoot: string, id: string): Promise<{
+    ok: boolean;
+    workspace?: WorkspaceModel;
+    missingRoots: string[];
+    error?: string;
+}>;
+/**
+ * Isolation gate: a path may be read only when it is inside the operation's own
+ * repositoryRoot, OR (allowCrossRead && both roots are members of the same workspace).
+ */
+export declare function assertWorkspacePathAccess(options: {
+    workspace: WorkspaceModel | null;
+    operationRoot: string;
+    targetPath: string;
+}): WorkspacePathAccess;
+/**
+ * Read a file only when workspace isolation allows it.
+ */
+export declare function readFileWithinWorkspace(options: {
+    workspace: WorkspaceModel | null;
+    operationRoot: string;
+    targetPath: string;
+    maxBytes?: number;
+}): Promise<{
+    ok: true;
+    content: string;
+    access: WorkspacePathAccess;
+} | {
+    ok: false;
+    access: WorkspacePathAccess;
+    error: string;
+}>;

package/dist/workspace/index.js

@@ -0,0 +1,220 @@
+import { createHash, randomUUID } from "node:crypto";
+import fs from "node:fs/promises";
+import path from "node:path";
+import { atomicWriteTextFile } from "../utils/fs.js";
+import { isPathInsideRoot, resolveRepoRoot } from "../utils/path.js";
+export const WORKSPACE_SCHEMA_VERSION = "1.0.0";
+function workspacesDir(controlRoot) {
+    return path.join(resolveRepoRoot(controlRoot), ".agentdoctor", "workspaces");
+}
+function workspaceFile(controlRoot, id) {
+    if (!/^[a-zA-Z0-9_-]{1,64}$/.test(id)) {
+        throw new Error("invalid workspace id");
+    }
+    return path.join(workspacesDir(controlRoot), `${id}.json`);
+}
+function normalizeRoot(rootInput) {
+    return resolveRepoRoot(rootInput);
+}
+export async function initWorkspace(options) {
+    const controlRoot = resolveRepoRoot(options.controlRoot);
+    const id = options.id ??
+        `ws_${createHash("sha256").update(`${options.name}:${randomUUID()}`).digest("hex").slice(0, 12)}`;
+    const now = new Date().toISOString();
+    const roots = [];
+    if (options.repositoryRoot) {
+        roots.push(normalizeRoot(options.repositoryRoot));
+    }
+    const model = {
+        schemaVersion: WORKSPACE_SCHEMA_VERSION,
+        id,
+        name: options.name.trim() || id,
+        repositoryRoots: roots,
+        allowCrossRead: options.allowCrossRead === true,
+        createdAt: now,
+        updatedAt: now,
+    };
+    await fs.mkdir(workspacesDir(controlRoot), { recursive: true });
+    const target = workspaceFile(controlRoot, id);
+    try {
+        await fs.access(target);
+        throw new Error(`workspace already exists: ${id}`);
+    }
+    catch (error) {
+        if (error instanceof Error && error.message.startsWith("workspace already exists")) {
+            throw error;
+        }
+    }
+    await atomicWriteTextFile(target, `${JSON.stringify(model, null, 2)}\n`);
+    return model;
+}
+export async function loadWorkspace(controlRoot, id) {
+    try {
+        const raw = await fs.readFile(workspaceFile(controlRoot, id), "utf8");
+        const parsed = JSON.parse(raw);
+        if (!parsed ||
+            parsed.schemaVersion !== WORKSPACE_SCHEMA_VERSION ||
+            !Array.isArray(parsed.repositoryRoots)) {
+            return null;
+        }
+        return {
+            ...parsed,
+            allowCrossRead: parsed.allowCrossRead === true,
+            repositoryRoots: parsed.repositoryRoots.map((r) => normalizeRoot(r)),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+export async function listWorkspaces(controlRoot) {
+    const dir = workspacesDir(controlRoot);
+    let entries;
+    try {
+        entries = await fs.readdir(dir);
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const name of entries) {
+        if (!name.endsWith(".json"))
+            continue;
+        const id = name.slice(0, -".json".length);
+        const ws = await loadWorkspace(controlRoot, id);
+        if (ws)
+            out.push(ws);
+    }
+    return out.sort((a, b) => a.id.localeCompare(b.id));
+}
+export async function addRepositoryToWorkspace(options) {
+    const ws = await loadWorkspace(options.controlRoot, options.workspaceId);
+    if (!ws)
+        throw new Error(`workspace not found: ${options.workspaceId}`);
+    const root = normalizeRoot(options.repositoryRoot);
+    if (!ws.repositoryRoots.includes(root)) {
+        ws.repositoryRoots.push(root);
+        ws.updatedAt = new Date().toISOString();
+        await atomicWriteTextFile(workspaceFile(options.controlRoot, ws.id), `${JSON.stringify(ws, null, 2)}\n`);
+    }
+    return ws;
+}
+export async function removeWorkspace(controlRoot, id) {
+    try {
+        await fs.unlink(workspaceFile(controlRoot, id));
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export async function workspaceStatus(controlRoot, id) {
+    const ws = await loadWorkspace(controlRoot, id);
+    if (!ws)
+        return { ok: false, missingRoots: [], error: "workspace not found" };
+    const missingRoots = [];
+    for (const root of ws.repositoryRoots) {
+        try {
+            const st = await fs.stat(root);
+            if (!st.isDirectory())
+                missingRoots.push(root);
+        }
+        catch {
+            missingRoots.push(root);
+        }
+    }
+    return { ok: missingRoots.length === 0, workspace: ws, missingRoots };
+}
+/**
+ * Isolation gate: a path may be read only when it is inside the operation's own
+ * repositoryRoot, OR (allowCrossRead && both roots are members of the same workspace).
+ */
+export function assertWorkspacePathAccess(options) {
+    const operationRoot = normalizeRoot(options.operationRoot);
+    const target = path.resolve(options.targetPath);
+    if (isPathInsideRoot(operationRoot, target)) {
+        return {
+            allowed: true,
+            reason: "inside operation repository root",
+            requestedRoot: operationRoot,
+            targetRoot: operationRoot,
+            ...(options.workspace ? { workspaceId: options.workspace.id } : {}),
+        };
+    }
+    if (!options.workspace) {
+        return {
+            allowed: false,
+            reason: "path outside operation root and no workspace context",
+            requestedRoot: operationRoot,
+        };
+    }
+    const members = options.workspace.repositoryRoots.map(normalizeRoot);
+    if (!members.includes(operationRoot)) {
+        return {
+            allowed: false,
+            reason: "operation root is not a member of the workspace",
+            workspaceId: options.workspace.id,
+            requestedRoot: operationRoot,
+        };
+    }
+    const targetMember = members.find((root) => isPathInsideRoot(root, target));
+    if (!targetMember) {
+        return {
+            allowed: false,
+            reason: "target path is not under any workspace member root",
+            workspaceId: options.workspace.id,
+            requestedRoot: operationRoot,
+        };
+    }
+    if (targetMember === operationRoot) {
+        return {
+            allowed: true,
+            reason: "inside operation repository root",
+            workspaceId: options.workspace.id,
+            requestedRoot: operationRoot,
+            targetRoot: targetMember,
+        };
+    }
+    if (!options.workspace.allowCrossRead) {
+        return {
+            allowed: false,
+            reason: "cross-repo read denied: target is under another workspace member and allowCrossRead=false",
+            workspaceId: options.workspace.id,
+            requestedRoot: operationRoot,
+            targetRoot: targetMember,
+        };
+    }
+    return {
+        allowed: true,
+        reason: "allowCrossRead enabled for same-workspace member",
+        workspaceId: options.workspace.id,
+        requestedRoot: operationRoot,
+        targetRoot: targetMember,
+    };
+}
+/**
+ * Read a file only when workspace isolation allows it.
+ */
+export async function readFileWithinWorkspace(options) {
+    const access = assertWorkspacePathAccess({
+        workspace: options.workspace,
+        operationRoot: options.operationRoot,
+        targetPath: options.targetPath,
+    });
+    if (!access.allowed) {
+        return { ok: false, access, error: access.reason };
+    }
+    try {
+        const buf = await fs.readFile(path.resolve(options.targetPath));
+        const max = options.maxBytes ?? 1024 * 1024;
+        const content = buf.subarray(0, max).toString("utf8");
+        return { ok: true, content, access };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            access,
+            error: error instanceof Error ? error.message : String(error),
+        };
+    }
+}

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@praneeth_54/agentdoctor",
-  "version": "2.0.0",
-  "description": "Codebase intelligence, repository analysis, safety controls, and MCP tools for developers and engineering teams.",
+  "version": "2.0.1",
+  "description": "Engineering assurance for AI coding agents — repository intelligence, change evidence, safety controls, and MCP tools.",
   "type": "module",
   "bin": {
     "agentdoctor": "./dist/cli/index.js"
@@ -40,7 +40,7 @@
     "validate:project-brain": "tsx validation/project-brain/run.ts",
     "validate:project-brain:real-world": "tsx validation/project-brain/real-world-run.ts",
     "benchmark:project-brain": "tsx validation/project-brain/benchmark.ts",
-    "verify": "npm run typecheck && npm run lint && npm run format:check && npm test && npm run build",
+    "verify": "npm run typecheck && npm run lint && npm run format:check && npm run build && npm test",
     "verify:understanding": "npm run typecheck && npm run test:understanding",
     "verify:project-brain": "npm run typecheck && npm run test:understanding && npm run validate:project-brain && npm run benchmark:project-brain",
     "verify:mcp": "npm run typecheck && npm run test:mcp",
@@ -59,6 +59,9 @@
     "gemini",
     "aider",
     "mcp",
+    "change-assurance",
+    "evidence",
+    "engineering-assurance",
     "security",
     "linter",
     "cli",
@@ -80,7 +83,10 @@
   },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.30.0",
+    "@types/pg": "^8.23.1",
     "commander": "^14.0.3",
+    "jose": "^6.2.12",
+    "pg": "^8.23.0",
     "picocolors": "^1.1.1",
     "typescript": "^5.9.3"
   },