@saulwade/swl-ses 2.6.1 → 2.8.0

package/scripts/lib/jaccard-similarity.js

@@ -1,98 +1,98 @@
-'use strict';
-
-/**
- * jaccard-similarity.js — Métrica de Jaccard sobre conjuntos de tokens.
- *
- * Patrón adoptado de `temp/agentmemory-main/src/functions/auto-forget.ts`
- * para detectar memorias contradictorias/duplicadas con vocabulario compartido.
- *
- * Jaccard(A, B) = |A ∩ B| / |A ∪ B|
- *
- * Propiedades:
- *   - Rango [0, 1]: 0 = sin overlap, 1 = idénticos.
- *   - Simétrico: J(A, B) = J(B, A).
- *   - Independiente de longitudes absolutas (ambos cortos pueden ser 1.0).
- *
- * Sin dependencias — Node stdlib only. Funciones puras.
- *
- * @module scripts/lib/jaccard-similarity
- */
-
-// ── constantes ────────────────────────────────────────────────────────────────
-
-/** Longitud mínima de un token para ser considerado significativo. */
-const MIN_TOKEN_LENGTH = 3;
-
-/** Stop words en español que se excluyen del análisis. */
-const STOP_WORDS = new Set([
-  'que', 'los', 'las', 'del', 'una', 'por', 'con', 'para', 'como',
-  'sin', 'mas', 'sus', 'lo', 'le', 'la', 'el', 'al', 'no', 'es',
-  'se', 'de', 'en', 'un', 'a', 'y', 'o', 'pero', 'cuando',
-  'donde', 'porque', 'desde', 'hasta', 'sobre', 'bajo', 'entre',
-  'esta', 'este', 'esto', 'esa', 'ese', 'eso', 'tras', 'durante',
-  'mediante', 'segun', 'asi', 'tan', 'ya', 'aun', 'aunque',
-  // English equivalents (frequently mixed in technical text)
-  'the', 'and', 'for', 'with', 'this', 'that', 'have', 'from',
-  'are', 'was', 'will', 'not', 'has', 'had', 'but', 'can',
-]);
-
-// ── funciones puras ───────────────────────────────────────────────────────────
-
-/**
- * Convierte un texto en un Set de tokens significativos (lowercase, sin stop
- * words, longitud mínima). Preserva acentos.
- *
- * @param {string} text
- * @returns {Set<string>}
- */
-function tokenize(text) {
-  if (!text || typeof text !== 'string') return new Set();
-  return new Set(
-    String(text)
-      .toLowerCase()
-      .replace(/[`*_~\[\](){}<>#"'\-.,;:!?\/\\]/g, ' ')
-      .split(/\s+/)
-      .filter(t => t.length >= MIN_TOKEN_LENGTH && !STOP_WORDS.has(t)),
-  );
-}
-
-/**
- * Jaccard similarity entre dos Sets.
- *
- * @param {Set} setA
- * @param {Set} setB
- * @returns {number} en [0, 1]
- */
-function jaccard(setA, setB) {
-  if (!(setA instanceof Set) || !(setB instanceof Set)) return 0;
-  if (setA.size === 0 && setB.size === 0) return 0;
-  if (setA.size === 0 || setB.size === 0) return 0;
-
-  let intersection = 0;
-  for (const token of setA) {
-    if (setB.has(token)) intersection++;
-  }
-  const union = setA.size + setB.size - intersection;
-  return union === 0 ? 0 : intersection / union;
-}
-
-/**
- * Conveniencia: jaccard sobre dos textos.
- *
- * @param {string} a
- * @param {string} b
- * @returns {number} en [0, 1]
- */
-function similarity(a, b) {
-  return jaccard(tokenize(a), tokenize(b));
-}
-
-// ── exports ───────────────────────────────────────────────────────────────────
-
-module.exports = {
-  tokenize,
-  jaccard,
-  similarity,
-  MIN_TOKEN_LENGTH,
-  STOP_WORDS,
-};
+'use strict';
+
+/**
+ * jaccard-similarity.js — Métrica de Jaccard sobre conjuntos de tokens.
+ *
+ * Patrón adoptado de `temp/agentmemory-main/src/functions/auto-forget.ts`
+ * para detectar memorias contradictorias/duplicadas con vocabulario compartido.
+ *
+ * Jaccard(A, B) = |A ∩ B| / |A ∪ B|
+ *
+ * Propiedades:
+ *   - Rango [0, 1]: 0 = sin overlap, 1 = idénticos.
+ *   - Simétrico: J(A, B) = J(B, A).
+ *   - Independiente de longitudes absolutas (ambos cortos pueden ser 1.0).
+ *
+ * Sin dependencias — Node stdlib only. Funciones puras.
+ *
+ * @module scripts/lib/jaccard-similarity
+ */
+
+// ── constantes ────────────────────────────────────────────────────────────────
+
+/** Longitud mínima de un token para ser considerado significativo. */
+const MIN_TOKEN_LENGTH = 3;
+
+/** Stop words en español que se excluyen del análisis. */
+const STOP_WORDS = new Set([
+  'que', 'los', 'las', 'del', 'una', 'por', 'con', 'para', 'como',
+  'sin', 'mas', 'sus', 'lo', 'le', 'la', 'el', 'al', 'no', 'es',
+  'se', 'de', 'en', 'un', 'a', 'y', 'o', 'pero', 'cuando',
+  'donde', 'porque', 'desde', 'hasta', 'sobre', 'bajo', 'entre',
+  'esta', 'este', 'esto', 'esa', 'ese', 'eso', 'tras', 'durante',
+  'mediante', 'segun', 'asi', 'tan', 'ya', 'aun', 'aunque',
+  // English equivalents (frequently mixed in technical text)
+  'the', 'and', 'for', 'with', 'this', 'that', 'have', 'from',
+  'are', 'was', 'will', 'not', 'has', 'had', 'but', 'can',
+]);
+
+// ── funciones puras ───────────────────────────────────────────────────────────
+
+/**
+ * Convierte un texto en un Set de tokens significativos (lowercase, sin stop
+ * words, longitud mínima). Preserva acentos.
+ *
+ * @param {string} text
+ * @returns {Set<string>}
+ */
+function tokenize(text) {
+  if (!text || typeof text !== 'string') return new Set();
+  return new Set(
+    String(text)
+      .toLowerCase()
+      .replace(/[`*_~\[\](){}<>#"'\-.,;:!?\/\\]/g, ' ')
+      .split(/\s+/)
+      .filter(t => t.length >= MIN_TOKEN_LENGTH && !STOP_WORDS.has(t)),
+  );
+}
+
+/**
+ * Jaccard similarity entre dos Sets.
+ *
+ * @param {Set} setA
+ * @param {Set} setB
+ * @returns {number} en [0, 1]
+ */
+function jaccard(setA, setB) {
+  if (!(setA instanceof Set) || !(setB instanceof Set)) return 0;
+  if (setA.size === 0 && setB.size === 0) return 0;
+  if (setA.size === 0 || setB.size === 0) return 0;
+
+  let intersection = 0;
+  for (const token of setA) {
+    if (setB.has(token)) intersection++;
+  }
+  const union = setA.size + setB.size - intersection;
+  return union === 0 ? 0 : intersection / union;
+}
+
+/**
+ * Conveniencia: jaccard sobre dos textos.
+ *
+ * @param {string} a
+ * @param {string} b
+ * @returns {number} en [0, 1]
+ */
+function similarity(a, b) {
+  return jaccard(tokenize(a), tokenize(b));
+}
+
+// ── exports ───────────────────────────────────────────────────────────────────
+
+module.exports = {
+  tokenize,
+  jaccard,
+  similarity,
+  MIN_TOKEN_LENGTH,
+  STOP_WORDS,
+};

package/scripts/lib/legacy-gate-migration.js

@@ -0,0 +1,324 @@
+'use strict';
+
+/** Migración one-shot de PLAN legacy hacia un lock G1 explícito y anclado. */
+
+const crypto = require('node:crypto');
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { atomicWriteSync } = require('../../hooks/lib/atomic-write');
+const contract = require('./policy-contract');
+const signed = require('./signed-envelope');
+const { leerEstado, resolverLockPath } = require('./plan-lock');
+
+const LEGACY_MIGRATION_CUTOFF = '2027-01-15T00:00:00.000Z';
+const APPROVAL_SCOPE = 'migrate_legacy_gate';
+const EVENT_TYPE = 'migration.legacy-gate';
+const SHA256 = /^[a-f0-9]{64}$/u;
+const IDENTIFIER = /^[A-Za-z0-9][A-Za-z0-9._:-]{0,127}$/u;
+const PHASE = /^0[1-8]$/u;
+const CLAIM_KEYS = [
+  'kind', 'schemaVersion', 'capability', 'migrationId', 'phaseId',
+  'planPath', 'contextPath', 'planDigest', 'contextDigest', 'createdAt',
+  'reason', 'evidenceDigests', 'cutoff', 'issuedAt', 'expiresAt', 'nonce',
+];
+const MIGRATION_PAYLOAD_KEYS = [
+  'schemaVersion', 'migrationId', 'approvalDigest', 'approvalKeyId',
+  'approvalSignerDigest', 'phaseId', 'planPath', 'contextPath', 'planDigest',
+  'contextDigest', 'createdAt', 'reason', 'evidenceDigests', 'cutoff',
+  'issuedAt', 'expiresAt', 'nonce',
+];
+const OPTION_KEYS = [
+  'approvalRaw', 'dependencies', 'expectedPhaseId', 'trustContext', 'workspaceRoot',
+];
+
+function fail(code, message) {
+  const error = new Error(message);
+  error.code = code;
+  throw error;
+}
+
+function isPlainObject(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+
+function exactKeys(value, expected, code, label) {
+  if (!isPlainObject(value)) fail(code, `${label} inválido`);
+  const actual = Object.keys(value).sort();
+  const wanted = [...expected].sort();
+  if (actual.length !== wanted.length || actual.some((key, index) => key !== wanted[index])) {
+    fail(code, `${label} contiene campos ausentes o desconocidos`);
+  }
+}
+
+function sha256(bytes) {
+  return crypto.createHash('sha256').update(bytes).digest('hex');
+}
+
+function validateText(value, label, maximum) {
+  if (typeof value !== 'string' || value.length === 0 || value.length > maximum
+      || value.normalize('NFC') !== value || /[\u0000-\u001F\u007F]/u.test(value)) {
+    fail('LEGACY_MANIFEST_INVALID', `${label} inválido`);
+  }
+}
+
+function validateEvidence(digests) {
+  if (!Array.isArray(digests) || digests.length === 0 || digests.length > 64
+      || !digests.every((digest) => SHA256.test(digest))) {
+    fail('LEGACY_MANIFEST_INVALID', 'evidenceDigests inválido');
+  }
+  const canonical = [...digests].sort();
+  if (new Set(digests).size !== digests.length || canonical.join() !== digests.join()) {
+    fail('LEGACY_MANIFEST_INVALID', 'evidenceDigests duplicado o desordenado');
+  }
+}
+
+function validateTimes(claims, now) {
+  for (const field of ['createdAt', 'issuedAt', 'expiresAt', 'cutoff']) {
+    signed.validarTimestampIso(claims[field], `legacy ${field}`);
+  }
+  if (claims.cutoff !== LEGACY_MIGRATION_CUTOFF
+      || claims.createdAt > claims.cutoff || claims.issuedAt > claims.cutoff
+      || claims.expiresAt > claims.cutoff) {
+    fail('LEGACY_CUTOFF_INVALID', 'manifiesto fuera del cutoff code-owned');
+  }
+  if (claims.issuedAt >= claims.expiresAt
+      || claims.issuedAt > now || claims.expiresAt < now) {
+    fail('LEGACY_APPROVAL_EXPIRED', 'approval legacy fuera de vigencia');
+  }
+}
+
+function validateClaims(claims, now) {
+  exactKeys(claims, CLAIM_KEYS, 'LEGACY_MANIFEST_INVALID', 'manifiesto legacy');
+  if (claims.kind !== 'legacy-gate-migration' || claims.schemaVersion !== '1.0.0'
+      || claims.capability !== 'migrate_legacy_gate') {
+    fail('LEGACY_CAPABILITY_INVALID', 'capability legacy ausente o inválida');
+  }
+  if (!IDENTIFIER.test(claims.migrationId) || !IDENTIFIER.test(claims.nonce)
+      || !PHASE.test(claims.phaseId)) {
+    fail('LEGACY_MANIFEST_INVALID', 'identidad de migración inválida');
+  }
+  validateText(claims.reason, 'reason', 512);
+  validateEvidence(claims.evidenceDigests);
+  validateTimes(claims, now);
+}
+
+function assertRelativePath(value, expected) {
+  if (value !== expected) {
+    fail('LEGACY_PATH_INVALID', 'path legacy no canónico');
+  }
+}
+
+function samePath(left, right) {
+  return path.normalize(left) === path.normalize(right);
+}
+
+function resolveRegularArtifact(workspaceRoot, relativePath) {
+  const expected = path.resolve(workspaceRoot, ...relativePath.split('/'));
+  let stat;
+  try {
+    stat = fs.lstatSync(expected);
+  } catch {
+    fail('LEGACY_ARTIFACT_MISSING', 'artefacto legacy ausente');
+  }
+  if (!stat.isFile() || stat.isSymbolicLink()) {
+    fail('LEGACY_PATH_INVALID', 'artefacto legacy no es archivo regular');
+  }
+  if (!samePath(fs.realpathSync(expected), expected)) {
+    fail('LEGACY_PATH_INVALID', 'artefacto legacy atraviesa un symlink');
+  }
+  return expected;
+}
+
+function resolveArtifacts(workspaceRoot, claims) {
+  const expectedPlan = `.planning/fases/${claims.phaseId}-PLAN.md`;
+  const expectedContext = `.planning/fases/${claims.phaseId}-CONTEXTO.md`;
+  assertRelativePath(claims.planPath, expectedPlan);
+  assertRelativePath(claims.contextPath, expectedContext);
+  const canonicalRoot = fs.realpathSync(workspaceRoot);
+  const planPath = resolveRegularArtifact(canonicalRoot, claims.planPath);
+  const contextPath = resolveRegularArtifact(canonicalRoot, claims.contextPath);
+  return { contextPath, planPath };
+}
+
+function assertArtifactDigests(artifacts, claims) {
+  const planBytes = fs.readFileSync(artifacts.planPath);
+  const contextBytes = fs.readFileSync(artifacts.contextPath);
+  if (!SHA256.test(claims.planDigest) || sha256(planBytes) !== claims.planDigest
+      || !SHA256.test(claims.contextDigest) || sha256(contextBytes) !== claims.contextDigest) {
+    fail('LEGACY_HASH_MISMATCH', 'hash legacy no coincide con artefactos');
+  }
+  if (leerEstado(planBytes.toString('utf8')) !== 'aprobado') {
+    fail('LEGACY_PLAN_INVALID', 'PLAN legacy no está aprobado explícitamente');
+  }
+}
+
+function approvalDigest(envelope) {
+  return sha256(Buffer.from(signed.canonicalizarIJson({
+    type: envelope.type,
+    keyId: envelope.keyId,
+    signerPublicKeyDigest: envelope.signerPublicKeyDigest,
+    trustEpoch: envelope.trustEpoch,
+    trustDigest: envelope.trustDigest,
+    claims: envelope.claims,
+  }), 'utf8'));
+}
+
+function verifyManifest(options, authority) {
+  const envelope = signed.verificarEnvelope(options.approvalRaw, {
+    trustContext: options.trustContext,
+    expectedType: 'approval',
+    requiredScope: APPROVAL_SCOPE,
+    now: authority.observedAt,
+  });
+  validateClaims(envelope.claims, authority.observedAt);
+  if (envelope.claims.phaseId !== options.expectedPhaseId) {
+    fail('LEGACY_PHASE_MISMATCH', 'fase solicitada no coincide con manifiesto firmado');
+  }
+  if (envelope.trustEpoch !== authority.trustEpoch
+      || envelope.trustDigest !== authority.trustDigest
+      || envelope.rootKeyDigest !== authority.rootKeyDigest) {
+    fail('LEGACY_TRUST_INVALID', 'approval legacy ligada a otra autoridad');
+  }
+  return { digest: approvalDigest(envelope), envelope };
+}
+
+function migrationPayload(verified) {
+  const { claims } = verified.envelope;
+  return {
+    schemaVersion: '1.0.0',
+    migrationId: claims.migrationId,
+    approvalDigest: verified.digest,
+    approvalKeyId: verified.envelope.keyId,
+    approvalSignerDigest: verified.envelope.signerPublicKeyDigest,
+    phaseId: claims.phaseId,
+    planPath: claims.planPath,
+    contextPath: claims.contextPath,
+    planDigest: claims.planDigest,
+    contextDigest: claims.contextDigest,
+    createdAt: claims.createdAt,
+    reason: claims.reason,
+    evidenceDigests: [...claims.evidenceDigests],
+    cutoff: claims.cutoff,
+    issuedAt: claims.issuedAt,
+    expiresAt: claims.expiresAt,
+    nonce: claims.nonce,
+  };
+}
+
+function collidesWithMigration(stored, payload) {
+  return stored.phaseId === payload.phaseId
+    || stored.migrationId === payload.migrationId
+    || stored.nonce === payload.nonce;
+}
+
+function findMigration(state, payload) {
+  for (const event of state.events) {
+    if (event.eventType !== EVENT_TYPE || !isPlainObject(event.payload)
+        || !collidesWithMigration(event.payload, payload)) continue;
+    exactKeys(
+      event.payload, MIGRATION_PAYLOAD_KEYS,
+      'LEGACY_LEDGER_EVENT_INVALID', 'evento legacy'
+    );
+    return event;
+  }
+  return undefined;
+}
+
+function assertRecoverable(event, payload) {
+  if (!event) return false;
+  if (event.payload.approvalDigest !== payload.approvalDigest
+      || event.payload.planDigest !== payload.planDigest
+      || event.payload.contextDigest !== payload.contextDigest) {
+    fail('LEGACY_ALREADY_MIGRATED', 'fase o approval legacy ya consumida');
+  }
+  return true;
+}
+
+function migratedLock(artifacts, payload, event) {
+  return {
+    version: 2,
+    archivo: path.basename(artifacts.planPath),
+    sha256: payload.planDigest,
+    firmadoEn: payload.issuedAt,
+    firmadoPor: 'swl:migrar-gates-legacy',
+    migration: {
+      migrationId: payload.migrationId,
+      approvalDigest: payload.approvalDigest,
+      eventSequence: event.sequence,
+      eventHeadHash: event.eventHash,
+      contextDigest: payload.contextDigest,
+      cutoff: payload.cutoff,
+    },
+  };
+}
+
+function publishLock(artifacts, payload, event) {
+  const lockPath = resolverLockPath(artifacts.planPath);
+  const lock = migratedLock(artifacts, payload, event);
+  atomicWriteSync(lockPath, `${JSON.stringify(lock, null, 2)}\n`, 'utf8');
+  return lockPath;
+}
+
+function validateOptions(options) {
+  exactKeys(options, OPTION_KEYS, 'LEGACY_OPTIONS_INVALID', 'opciones migración');
+  if (!contract.isKernelDependencies(options.dependencies)
+      || !signed.esTrustContextVerificado(options.trustContext)
+      || !PHASE.test(options.expectedPhaseId)
+      || typeof options.workspaceRoot !== 'string' || !path.isAbsolute(options.workspaceRoot)) {
+    fail('LEGACY_AUTHORITY_INVALID', 'autoridad del kernel no verificada');
+  }
+}
+
+function appendMigration(ledger, state, payload) {
+  const receipt = ledger.append({
+    expectedSequence: state.sequence,
+    expectedHeadHash: state.headHash,
+    eventType: EVENT_TYPE,
+    payload,
+  });
+  return {
+    sequence: receipt.sequence,
+    eventHash: receipt.headHash,
+    payload,
+  };
+}
+
+function migrateLegacyGate(options) {
+  validateOptions(options);
+  const ledger = options.dependencies.integrityLedger;
+  const authority = ledger.readAuthority();
+  const verified = verifyManifest(options, authority);
+  const claims = verified.envelope.claims;
+  const artifacts = resolveArtifacts(options.workspaceRoot, claims);
+  assertArtifactDigests(artifacts, claims);
+  const lockPath = resolverLockPath(artifacts.planPath);
+  if (lockPath && fs.existsSync(lockPath)) {
+    fail('LEGACY_ALREADY_MIGRATED', 'PLAN ya tiene lock; no se permite remigrar');
+  }
+  const payload = migrationPayload(verified);
+  const state = ledger.read();
+  const existing = findMigration(state, payload);
+  const event = assertRecoverable(existing, payload)
+    ? existing
+    : appendMigration(ledger, state, payload);
+  const publishedLock = publishLock(artifacts, payload, event);
+  return Object.freeze({
+    ok: true,
+    approvalDigest: payload.approvalDigest,
+    eventHeadHash: event.eventHash,
+    eventSequence: event.sequence,
+    lockPath: publishedLock,
+    phaseId: payload.phaseId,
+    recovered: Boolean(existing),
+  });
+}
+
+module.exports = {
+  APPROVAL_SCOPE,
+  EVENT_TYPE,
+  LEGACY_MIGRATION_CUTOFF,
+  migrateLegacyGate,
+};

package/scripts/lib/limpiar-basura-global.js

@@ -114,9 +114,50 @@ function esUserlandVacio(dir) {
   return contarArchivosReales(userland) === 0;
 }
 
+/**
+ * ¿El `.planning/` de `dir` contiene un PROYECTO real? Señal: al menos un
+ * marcador con contenido propio (ni vacío ni la huella del scaffold de doctor).
+ * Es el invariante de seguridad: distingue un proyecto legítimo (que se
+ * preserva) de basura (scaffold, backups del install, telemetría mal dirigida).
+ *
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function planningTieneProyectoReal(dir) {
+  const planning = path.join(dir, '.planning');
+  return MARCADORES.some((m) => {
+    try {
+      const contenido = fs.readFileSync(path.join(planning, m), 'utf8');
+      return contenido.trim().length > 0 && !contenido.includes(HUELLA_SCAFFOLD_DOCTOR);
+    } catch (_) {
+      return false;
+    }
+  });
+}
+
+/**
+ * ¿El `.planning/` en el HOME es removible? Existe pero NO es un proyecto real.
+ * Cubre: scaffold de doctor (huella), backups del install (`backups/` sin
+ * marcadores), telemetría mal dirigida de hooks, o dir vacío. El HOME nunca es
+ * un proyecto de trabajo — un `.planning` ahí sin proyecto real es basura.
+ *
+ * @param {string} dir
+ * @returns {boolean}
+ */
+function esPlanningRemovibleEnHome(dir) {
+  const planning = path.join(dir, '.planning');
+  try {
+    if (!fs.statSync(planning).isDirectory()) return false;
+  } catch (_) {
+    return false; // no existe
+  }
+  return !planningTieneProyectoReal(dir);
+}
+
 /**
  * Elimina los directorios basura de una instalación global en el HOME:
- *   - `.planning/` espurio sembrado por doctor (huella del scaffold).
+ *   - `.planning/` sin proyecto real (scaffold de doctor, backups del install,
+ *     telemetría mal dirigida o vacío).
  *   - `_userland/` vacío (scaffold sin plugins del usuario).
  * Idempotente: si no hay basura, no hace nada. Conservador: cada objetivo tiene
  * su invariante de seguridad y NUNCA borra contenido real (proyecto o plugins).
@@ -134,7 +175,7 @@ function limpiarBasuraGlobal(opts = {}) {
   const eliminados = [];
 
   const objetivos = [
-    { detectar: () => esPlanningEspurio(home), ruta: path.join(home, '.planning') },
+    { detectar: () => esPlanningRemovibleEnHome(home), ruta: path.join(home, '.planning') },
     { detectar: () => esUserlandVacio(home), ruta: path.join(home, '_userland') },
   ];
 
@@ -156,6 +197,8 @@ function limpiarBasuraGlobal(opts = {}) {
 module.exports = {
   limpiarBasuraGlobal,
   esPlanningEspurio,
+  esPlanningRemovibleEnHome,
+  planningTieneProyectoReal,
   esUserlandVacio,
   HUELLA_SCAFFOLD_DOCTOR,
 };