@sanity/ailf 2.0.0 → 2.0.2

package/dist/artifact-capture/filesystem-collector.js

@@ -0,0 +1,237 @@
+/**
+ * FilesystemArtifactCollector — writes captured artifacts to a local directory.
+ *
+ * Accumulates artifact entries in memory during pipeline execution.
+ * On flush(), creates a structured directory with one subdirectory per
+ * step, writes all artifacts, and generates a manifest.json.
+ *
+ * Design principles:
+ * - capture() and captureFile() are synchronous (no I/O during step execution)
+ * - flush() does all I/O at pipeline end
+ * - Failures in capture/captureFile are swallowed (P5: non-blocking)
+ */
+import { execFileSync } from "node:child_process";
+import { copyFileSync, mkdirSync, readFileSync, rmSync, statSync, writeFileSync, } from "node:fs";
+import path from "node:path";
+import { redactArtifactData } from "./redact-artifact.js";
+// ---------------------------------------------------------------------------
+// Timestamp-prefixed capture ID (same shape as report-store.ts IDs)
+// ---------------------------------------------------------------------------
+function generateCaptureId() {
+    const now = Date.now();
+    const uuid = crypto.randomUUID();
+    const hex = now.toString(16).padStart(12, "0");
+    return (hex.slice(0, 8) +
+        "-" +
+        hex.slice(8, 12) +
+        "-7" +
+        uuid.slice(15, 18) +
+        "-" +
+        uuid.slice(19, 23) +
+        "-" +
+        uuid.slice(24));
+}
+function formatTimestamp(date) {
+    const y = date.getFullYear();
+    const m = String(date.getMonth() + 1).padStart(2, "0");
+    const d = String(date.getDate()).padStart(2, "0");
+    const h = String(date.getHours()).padStart(2, "0");
+    const min = String(date.getMinutes()).padStart(2, "0");
+    const s = String(date.getSeconds()).padStart(2, "0");
+    return `${y}${m}${d}-${h}${min}${s}`;
+}
+function detectFormat(entry) {
+    if (entry.filePath) {
+        const ext = path.extname(entry.filePath).toLowerCase();
+        if (ext === ".json")
+            return "json";
+        if (ext === ".md")
+            return "markdown";
+        if (ext === ".yaml" || ext === ".yml")
+            return "text";
+        return "text";
+    }
+    // In-memory data — if it's an object/array, it's JSON
+    if (typeof entry.data === "object" && entry.data !== null)
+        return "json";
+    return "text";
+}
+function fileExtension(format) {
+    switch (format) {
+        case "json":
+            return ".json";
+        case "markdown":
+            return ".md";
+        default:
+            return ".txt";
+    }
+}
+// ---------------------------------------------------------------------------
+// Collector
+// ---------------------------------------------------------------------------
+export class FilesystemArtifactCollector {
+    enabled = true;
+    extrasEnabled;
+    entries = [];
+    captureId;
+    outputDir;
+    startedAt;
+    options;
+    constructor(options) {
+        this.options = options;
+        this.extrasEnabled = options.extras;
+        this.captureId = generateCaptureId();
+        this.startedAt = new Date().toISOString();
+        // Use the last 4 hex chars (from the random UUID portion) — the first
+        // chars are timestamp-derived and change too slowly to disambiguate.
+        const shortId = this.captureId.replace(/-/g, "").slice(-4);
+        const timestamp = formatTimestamp(new Date());
+        this.outputDir = path.join(options.captureDir, `${options.mode}-${timestamp}-${shortId}`);
+    }
+    capture(step, type, data, meta) {
+        try {
+            this.entries.push({
+                step,
+                type,
+                data,
+                meta,
+                capturedAt: new Date().toISOString(),
+            });
+        }
+        catch {
+            // P5: non-blocking — swallow capture errors
+        }
+    }
+    captureFile(step, type, filePath, meta) {
+        try {
+            this.entries.push({
+                step,
+                type,
+                filePath,
+                meta,
+                capturedAt: new Date().toISOString(),
+            });
+        }
+        catch {
+            // P5: non-blocking — swallow capture errors
+        }
+    }
+    async flush() {
+        const manifestEntries = [];
+        let totalBytes = 0;
+        // Create the root output directory
+        mkdirSync(this.outputDir, { recursive: true });
+        for (const entry of this.entries) {
+            try {
+                const format = detectFormat(entry);
+                const ext = entry.filePath
+                    ? path.extname(entry.filePath)
+                    : fileExtension(format);
+                const relativePath = path.join(entry.step, `${entry.type}${ext}`);
+                const absolutePath = path.join(this.outputDir, relativePath);
+                // Ensure step subdirectory exists
+                mkdirSync(path.dirname(absolutePath), { recursive: true });
+                // Write the artifact — JSON artifacts are redacted before persistence
+                let bytes;
+                if (entry.filePath && format === "json") {
+                    // JSON file on disk: read → parse → redact → write
+                    const raw = readFileSync(entry.filePath, "utf-8");
+                    try {
+                        const parsed = JSON.parse(raw);
+                        const redacted = redactArtifactData(parsed);
+                        const content = JSON.stringify(redacted, null, 2);
+                        writeFileSync(absolutePath, content, "utf-8");
+                        bytes = Buffer.byteLength(content, "utf-8");
+                    }
+                    catch {
+                        // Unparseable JSON — copy as-is (comparator will scan it later)
+                        copyFileSync(entry.filePath, absolutePath);
+                        bytes = statSync(absolutePath).size;
+                    }
+                }
+                else if (entry.filePath) {
+                    // Non-JSON file: copy as-is
+                    copyFileSync(entry.filePath, absolutePath);
+                    bytes = statSync(absolutePath).size;
+                }
+                else {
+                    let content;
+                    if (format === "json") {
+                        try {
+                            content = JSON.stringify(redactArtifactData(entry.data), null, 2);
+                        }
+                        catch {
+                            // Fallback: serialize unredacted (e.g., circular references)
+                            content = JSON.stringify(entry.data, null, 2);
+                        }
+                    }
+                    else {
+                        content = String(entry.data ?? "");
+                    }
+                    writeFileSync(absolutePath, content, "utf-8");
+                    bytes = Buffer.byteLength(content, "utf-8");
+                }
+                totalBytes += bytes;
+                manifestEntries.push({
+                    step: entry.step,
+                    type: entry.type,
+                    path: relativePath,
+                    capturedAt: entry.capturedAt,
+                    bytes,
+                    format,
+                    ...(entry.meta ? { meta: entry.meta } : {}),
+                });
+            }
+            catch {
+                // P5: skip individual artifact failures, continue with the rest
+            }
+        }
+        // Write manifest
+        const manifest = {
+            version: 1,
+            captureId: this.captureId,
+            startedAt: this.startedAt,
+            completedAt: new Date().toISOString(),
+            pipeline: {
+                mode: this.options.mode,
+                ...(this.options.pipeline?.variant
+                    ? { variant: this.options.pipeline.variant }
+                    : {}),
+                ...(this.options.pipeline?.source
+                    ? { source: this.options.pipeline.source }
+                    : {}),
+                ...(this.options.pipeline?.areas
+                    ? { areas: this.options.pipeline.areas }
+                    : {}),
+            },
+            artifacts: manifestEntries,
+        };
+        const manifestContent = JSON.stringify(manifest, null, 2);
+        writeFileSync(path.join(this.outputDir, "manifest.json"), manifestContent, "utf-8");
+        // Compress to tar.gz if configured
+        if (this.options.compress) {
+            try {
+                const archivePath = `${this.outputDir}.tar.gz`;
+                const parentDir = path.dirname(this.outputDir);
+                const dirName = path.basename(this.outputDir);
+                execFileSync("tar", ["-czf", archivePath, "-C", parentDir, dirName]);
+                rmSync(this.outputDir, { recursive: true });
+                return {
+                    artifactCount: manifestEntries.length,
+                    destination: archivePath,
+                    totalBytes,
+                    compressed: true,
+                };
+            }
+            catch {
+                // Non-blocking: compression failed, keep the raw directory
+            }
+        }
+        return {
+            artifactCount: manifestEntries.length,
+            destination: this.outputDir,
+            totalBytes,
+            compressed: false,
+        };
+    }
+}

package/dist/artifact-capture/redact-artifact.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Artifact redaction — strips sensitive data from captured artifacts before
+ * they are written to disk.
+ *
+ * Applied during FilesystemArtifactCollector.flush() so that secrets
+ * (resolved env vars, auth headers, session cookies) never reach storage.
+ *
+ * Two-layer approach:
+ * 1. **Header stripping** — known-sensitive HTTP header keys are replaced
+ *    with "[REDACTED]" regardless of value.
+ * 2. **Value-pattern redaction** — string values anywhere in the JSON tree
+ *    that match known secret formats are replaced with "[REDACTED]".
+ */
+/**
+ * Deep-clone and redact a parsed JSON artifact.
+ *
+ * Safe to call on any artifact format — non-object inputs are returned
+ * as-is (nothing to redact in a plain string or number).
+ */
+export declare function redactArtifactData(data: unknown): unknown;

package/dist/artifact-capture/redact-artifact.js

@@ -0,0 +1,115 @@
+/**
+ * Artifact redaction — strips sensitive data from captured artifacts before
+ * they are written to disk.
+ *
+ * Applied during FilesystemArtifactCollector.flush() so that secrets
+ * (resolved env vars, auth headers, session cookies) never reach storage.
+ *
+ * Two-layer approach:
+ * 1. **Header stripping** — known-sensitive HTTP header keys are replaced
+ *    with "[REDACTED]" regardless of value.
+ * 2. **Value-pattern redaction** — string values anywhere in the JSON tree
+ *    that match known secret formats are replaced with "[REDACTED]".
+ */
+// ---------------------------------------------------------------------------
+// Sensitive HTTP header keys (case-insensitive)
+// ---------------------------------------------------------------------------
+/**
+ * HTTP headers that should always be redacted in captured artifacts.
+ *
+ * Stored lower-cased; lookup is done after lower-casing the key. This is
+ * intentionally a blocklist rather than an allowlist so that debugging-useful
+ * headers (x-request-id, content-type, etc.) are preserved.
+ */
+const SENSITIVE_HEADER_KEYS = new Set([
+    "authorization",
+    "proxy-authorization",
+    "cookie",
+    "set-cookie",
+    "x-api-key",
+    "x-auth-token",
+]);
+// ---------------------------------------------------------------------------
+// Secret value patterns (same family as comparator + telemetry redactor)
+// ---------------------------------------------------------------------------
+const SECRET_VALUE_PATTERNS = [
+    /^Bearer\s+\S{20,}/, // Authorization header values
+    /^Basic\s+[A-Za-z0-9+/=]{20,}/, // Basic auth
+    /^sk-[a-zA-Z0-9_-]{20,}/, // OpenAI-style keys
+    /^sk[A-Z][a-zA-Z0-9]{20,}/, // Sanity-style tokens
+    /^sk-ant-[a-zA-Z0-9_-]{20,}/, // Anthropic keys
+    /^xoxb-/, // Slack bot tokens
+    /^ghp_/, // GitHub personal tokens
+    /^ghs_/, // GitHub server-to-server tokens
+    /^AKIA[A-Z0-9]{12,}/, // AWS access keys
+];
+const REDACTED = "[REDACTED]";
+// ---------------------------------------------------------------------------
+// Public API
+// ---------------------------------------------------------------------------
+/**
+ * Deep-clone and redact a parsed JSON artifact.
+ *
+ * Safe to call on any artifact format — non-object inputs are returned
+ * as-is (nothing to redact in a plain string or number).
+ */
+export function redactArtifactData(data) {
+    if (data === null || data === undefined)
+        return data;
+    if (typeof data !== "object") {
+        // Scalar — check value patterns
+        if (typeof data === "string")
+            return redactStringValue(data);
+        return data;
+    }
+    // Deep-clone first so we never mutate the original
+    return walkAndRedact(JSON.parse(JSON.stringify(data)));
+}
+// ---------------------------------------------------------------------------
+// Internals
+// ---------------------------------------------------------------------------
+function redactStringValue(value) {
+    for (const pattern of SECRET_VALUE_PATTERNS) {
+        if (pattern.test(value))
+            return REDACTED;
+    }
+    return value;
+}
+/** Returns true if the key is a known-sensitive HTTP header name. */
+function isSensitiveHeaderKey(key) {
+    return SENSITIVE_HEADER_KEYS.has(key.toLowerCase());
+}
+function walkAndRedact(node) {
+    if (node === null || node === undefined)
+        return node;
+    if (typeof node === "string") {
+        return redactStringValue(node);
+    }
+    if (Array.isArray(node)) {
+        for (let i = 0; i < node.length; i++) {
+            node[i] = walkAndRedact(node[i]);
+        }
+        return node;
+    }
+    if (typeof node === "object") {
+        const obj = node;
+        for (const key of Object.keys(obj)) {
+            // Layer 1: strip sensitive HTTP headers by key name
+            if (isSensitiveHeaderKey(key)) {
+                const val = obj[key];
+                if (typeof val === "string") {
+                    obj[key] = REDACTED;
+                }
+                else if (Array.isArray(val)) {
+                    // Some HTTP parsers serialize set-cookie as string[]
+                    obj[key] = val.map((v) => (typeof v === "string" ? REDACTED : v));
+                }
+                continue;
+            }
+            // Layer 2: recurse and apply value-pattern redaction
+            obj[key] = walkAndRedact(obj[key]);
+        }
+        return obj;
+    }
+    return node;
+}

package/dist/assertions/source-isolation.d.ts

@@ -10,7 +10,7 @@
  * The assertion has weight: 0 — it doesn't affect scores. It surfaces
  * as an advisory pass/fail signal in results.
  *
- * @see docs/exec-plans/source-aware-eval-isolation.md (Phase 3b)
+ * @see docs/archive/exec-plans/source-aware-eval-isolation.md (Phase 3b)
  */
 export interface SourceIsolationReport {
     blocked: number;

package/dist/assertions/source-isolation.js

@@ -10,7 +10,7 @@
  * The assertion has weight: 0 — it doesn't affect scores. It surfaces
  * as an advisory pass/fail signal in results.
  *
- * @see docs/exec-plans/source-aware-eval-isolation.md (Phase 3b)
+ * @see docs/archive/exec-plans/source-aware-eval-isolation.md (Phase 3b)
  */
 import { isAllowedOrigin } from "../sources.js";
 /**

package/dist/cli.js

@@ -137,6 +137,8 @@ program.addCommand(createPublishCommand().helpGroup(CommandGroup.CoreWorkflow));
 // ── Analysis & Reports ────────────────────────────────────────────────
 import { createReadinessReportCommand } from "./commands/readiness-report.js";
 program.addCommand(createReadinessReportCommand().helpGroup(CommandGroup.AnalysisReports));
+import { createChronicFailuresCommand } from "./commands/chronic-failures.js";
+program.addCommand(createChronicFailuresCommand().helpGroup(CommandGroup.AnalysisReports));
 import { createCoverageAuditCommand } from "./commands/coverage-audit.js";
 program.addCommand(createCoverageAuditCommand().helpGroup(CommandGroup.AnalysisReports));
 import { createDiscoveryReportCommand } from "./commands/discovery-report.js";
@@ -173,6 +175,8 @@ program.addCommand(createLookupDocCommand().helpGroup(CommandGroup.PipelineInter
 import { createWebhookServerCommand } from "./commands/webhook-server.js";
 program.addCommand(createWebhookServerCommand().helpGroup(CommandGroup.PipelineInternals));
 // ── Developer Tools ───────────────────────────────────────────────────
+import { createCaptureCommand } from "./commands/capture.js";
+program.addCommand(createCaptureCommand().helpGroup(CommandGroup.DeveloperTools));
 import { createInteractiveCommand } from "./commands/interactive.js";
 program.addCommand(createInteractiveCommand().helpGroup(CommandGroup.DeveloperTools));
 // Shell completion — must be registered last (needs full program tree)

package/dist/commands/calculate-scores.js

@@ -20,6 +20,7 @@ export function createCalculateScoresCommand() {
         try {
             const ctx = createAppContext({
                 rootDir: ROOT,
+                outputDir: resolve(ROOT, "results", "latest"),
                 mode: "literacy",
                 noAutoScope: false,
                 skipFetch: true,

package/dist/commands/capture-compare.d.ts

@@ -0,0 +1,15 @@
+/**
+ * capture compare — compare two pipeline capture directories.
+ *
+ * Reads manifest.json from both captures, runs compareCaptures(),
+ * and prints a human-readable table or JSON diff report.
+ *
+ * Supports both raw directories and .tar.gz archives.
+ *
+ * Exit codes:
+ *   0 — captures are equivalent
+ *   1 — differences found
+ *   2 — error (missing files, invalid manifest, etc.)
+ */
+import { Command } from "commander";
+export declare function createCaptureCompareCommand(): Command;