@t275005746/gse 0.1.1 → 0.1.2

package/scripts/audit-installed-sync.mjs

@@ -0,0 +1,203 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import crypto from 'node:crypto'
+import { spawnSync } from 'node:child_process'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const installedRootArg = readArg('--installed-root', process.env.GSE_INSTALLED_SKILL_ROOT || null)
+const installedRoot = installedRootArg ? path.resolve(installedRootArg) : null
+const jsonOnly = args.includes('--json')
+
+function run(command, commandArgs, cwd = root) {
+  const result = spawnSync(command, commandArgs, {
+    cwd,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return {
+    command: [command, ...commandArgs].join(' '),
+    status: result.status ?? 1,
+    stdout: (result.stdout ?? '').trim(),
+    stderr: (result.stderr ?? '').trim(),
+  }
+}
+
+function parseJson(text) {
+  try {
+    return JSON.parse(text)
+  } catch {
+    return null
+  }
+}
+
+function exists(relativePath, base = root) {
+  return fs.existsSync(path.join(base, relativePath))
+}
+
+function sha256(filePath) {
+  return crypto.createHash('sha256').update(fs.readFileSync(filePath)).digest('hex')
+}
+
+function check(id, label, ok, evidence, risk = '') {
+  return { id, label, status: ok ? 'passed' : 'failed', evidence, risk }
+}
+
+function packageToTemp() {
+  const tempRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-installed-sync-'))
+  const packageOut = path.join(tempRoot, 'package')
+  const packageRun = run(process.execPath, [
+    path.join(root, 'scripts', 'package-gse.mjs'),
+    '--root',
+    root,
+    '--out',
+    packageOut,
+    '--label',
+    'installed-sync',
+    '--force',
+    '--json',
+  ])
+  const manifestPath = path.join(packageOut, 'gse-package-manifest.json')
+  const manifest = fs.existsSync(manifestPath) ? parseJson(fs.readFileSync(manifestPath, 'utf8')) : null
+  return { tempRoot, packageOut, packageRun, manifest }
+}
+
+function compareInstalled(manifest, targetRoot) {
+  if (!targetRoot) return { compared: 0, missing: [], mismatched: [] }
+  const missing = []
+  const mismatched = []
+  const fileHashes = manifest?.fileHashes ?? {}
+  for (const [relativePath, expectedHash] of Object.entries(fileHashes)) {
+    const targetPath = path.join(targetRoot, relativePath)
+    if (!fs.existsSync(targetPath)) {
+      missing.push(relativePath)
+      continue
+    }
+    const actualHash = sha256(targetPath)
+    if (actualHash !== expectedHash) mismatched.push(relativePath)
+  }
+  return {
+    compared: Object.keys(fileHashes).length,
+    missing,
+    mismatched,
+  }
+}
+
+const { tempRoot, packageOut, packageRun, manifest } = packageToTemp()
+const packageJson = exists('package.json') ? parseJson(fs.readFileSync(path.join(root, 'package.json'), 'utf8')) : null
+const packageCopyJson = exists('package.json', packageOut) ? parseJson(fs.readFileSync(path.join(packageOut, 'package.json'), 'utf8')) : null
+const installedComparison = compareInstalled(manifest, installedRoot)
+const installedCommand = installedRoot
+  ? run(process.execPath, [
+      path.join(installedRoot, 'scripts', 'run-gse-command.mjs'),
+      '--root',
+      installedRoot,
+      '--target',
+      installedRoot,
+      '--command',
+      '/gse maintenance --package-smoke --skip-release-bundle',
+      '--json',
+      '--compact',
+    ], installedRoot)
+  : null
+const installedCommandData = installedCommand ? parseJson(installedCommand.stdout) : null
+
+const requiredPackageFiles = [
+  'SKILL.md',
+  'package.json',
+  'references/commands.md',
+  'references/maintenance-cadence.md',
+  'scripts/backfill-evidence-levels.mjs',
+  'scripts/audit-evidence-review-queue.mjs',
+  'scripts/audit-installed-sync.mjs',
+  'scripts/audit-session-sync.mjs',
+  'scripts/audit-maintenance-snapshot.mjs',
+  'scripts/generate-maintenance-snapshot.mjs',
+  'scripts/audit-maintenance-cadence.mjs',
+  'scripts/record-session-sync.mjs',
+  'scripts/run-gse-command.mjs',
+  'scripts/validate-gse.mjs',
+]
+
+const checks = [
+  check('IS01', 'package-gse creates a fresh package manifest', packageRun.status === 0 && manifest?.fileCount > 20 && Boolean(manifest?.integrity?.packageDigest), packageRun.command),
+  check('IS02', 'package manifest includes installed sync entrypoint and maintenance command support', manifest?.files?.includes('scripts/audit-installed-sync.mjs') && manifest?.files?.includes('scripts/audit-maintenance-cadence.mjs') && manifest?.files?.includes('references/maintenance-cadence.md'), 'gse-package-manifest.json'),
+  check('IS03', 'required package files are present in the package output', requiredPackageFiles.every((file) => exists(file, packageOut)), requiredPackageFiles.join(', ')),
+  check('IS04', 'package copy preserves package metadata version', packageJson?.version && packageCopyJson?.version === packageJson.version, `source=${packageJson?.version ?? 'missing'}, package=${packageCopyJson?.version ?? 'missing'}`),
+  check('IS05', 'package manifest does not expose the source root', manifest && !JSON.stringify(manifest).includes(root), 'gse-package-manifest.json'),
+  installedRoot
+    ? check('IS06', 'installed root exists and contains GSE entrypoint', exists('SKILL.md', installedRoot) && exists('scripts/run-gse-command.mjs', installedRoot), installedRoot)
+    : check('IS06', 'installed root comparison is optional and explicit', true, 'no --installed-root supplied; package self-check only'),
+  installedRoot
+    ? check('IS07', 'installed root matches fresh package file hashes', installedComparison.compared > 20 && installedComparison.missing.length === 0 && installedComparison.mismatched.length === 0, `compared=${installedComparison.compared}, missing=${installedComparison.missing.length}, mismatched=${installedComparison.mismatched.length}`, 'Run the install/sync step again before claiming the installed skill is fresh.')
+    : check('IS07', 'installed hash comparison skipped without installed root', true, 'supply --installed-root to compare a real installed copy'),
+  installedRoot
+    ? check('IS08', 'installed copy can run package-only /gse maintenance smoke', installedCommand?.status === 0 && installedCommandData?.summary?.failed === 0, installedCommand?.command ?? 'not run')
+    : check('IS08', 'installed command smoke skipped without installed root', true, 'supply --installed-root to run installed command smoke'),
+]
+
+const passed = checks.filter((item) => item.status === 'passed').length
+const failed = checks.length - passed
+const report = {
+  root,
+  installedRoot,
+  generatedAt: new Date().toISOString(),
+  tempRoot,
+  summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+  workflows: {
+    freshPackage: packageRun.status === 0 ? 'verified' : 'failed',
+    installedSync: installedRoot ? failed === 0 ? 'verified' : 'failed' : 'not-requested',
+    installedCommandSmoke: installedRoot ? installedCommand?.status === 0 ? 'verified' : 'failed' : 'not-requested',
+  },
+  comparison: installedComparison,
+  limits: [
+    'Without --installed-root this audit verifies fresh package contents only.',
+    'With --installed-root it compares every packaged file hash against the installed copy and runs a package-only /gse maintenance smoke from that installed copy.',
+    'This audit does not publish a package, update npm, or prove native host slash-command support.',
+  ],
+  checks,
+}
+
+function renderMarkdown(data) {
+  const lines = []
+  lines.push('# GSE Installed Sync Audit')
+  lines.push('')
+  lines.push('Generated: ' + data.generatedAt)
+  lines.push('Root: ' + data.root)
+  lines.push('Installed root: ' + (data.installedRoot ?? 'not provided'))
+  lines.push('')
+  lines.push('## Summary')
+  lines.push('')
+  lines.push('- Status: ' + data.summary.status)
+  lines.push('- Checks: ' + data.summary.passed + '/' + data.summary.total)
+  lines.push('- Fresh package: ' + data.workflows.freshPackage)
+  lines.push('- Installed sync: ' + data.workflows.installedSync)
+  lines.push('')
+  lines.push('## Checks')
+  lines.push('')
+  for (const item of data.checks) {
+    const marker = item.status === 'passed' ? '[x]' : '[ ]'
+    lines.push('- ' + marker + ' ' + item.id + ' ' + item.label + ': ' + item.evidence)
+  }
+  lines.push('')
+  lines.push('## Limits')
+  lines.push('')
+  for (const item of data.limits) lines.push('- ' + item)
+  return lines.join('\n') + '\n'
+}
+
+if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+else console.log(renderMarkdown(report))
+
+fs.rmSync(tempRoot, { recursive: true, force: true })
+
+if (failed > 0) process.exit(1)

package/scripts/audit-learning-drift.mjs

@@ -0,0 +1,292 @@
+#!/usr/bin/env node
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { fileURLToPath } from 'node:url'
+import { spawnSync } from 'node:child_process'
+import { analyzeLearningPromotions } from './audit-learning-promotion.mjs'
+
+const args = process.argv.slice(2)
+
+function readArg(name, fallback = null) {
+  const index = args.indexOf(name)
+  if (index === -1) return fallback
+  return args[index + 1] ?? fallback
+}
+
+const root = path.resolve(readArg('--root', path.join(import.meta.dirname, '..')))
+const targetArg = readArg('--target')
+const jsonOnly = args.includes('--json')
+
+function readText(filePath) {
+  return fs.existsSync(filePath) ? fs.readFileSync(filePath, 'utf8').replace(/^\uFEFF/, '') : ''
+}
+
+function normalize(value) {
+  return String(value ?? '')
+    .toLowerCase()
+    .replace(/[`"'鈥溾€濃€樷€橾]/g, '')
+    .replace(/[^a-z0-9\u4e00-\u9fa5]+/g, ' ')
+    .replace(/\s+/g, ' ')
+    .trim()
+}
+
+function tokens(value) {
+  const stopwords = new Set([
+    'use',
+    'with',
+    'and',
+    'the',
+    'this',
+    'that',
+    'before',
+    'after',
+    'always',
+    'require',
+    'without',
+    'claim',
+    'real',
+    'safe',
+    'readers',
+    'judging',
+  ])
+  return normalize(value)
+    .split(' ')
+    .filter((token) => token.length >= 3 && !stopwords.has(token))
+}
+
+function matchCount(text, candidates) {
+  const haystack = normalize(text)
+  return candidates.filter((candidate) => {
+    const needle = normalize(candidate)
+    return needle.length >= 3 && haystack.includes(needle)
+  }).length
+}
+
+function includesAny(text, candidates) {
+  return matchCount(text, candidates) > 0
+}
+
+function categoryTerms(category) {
+  return {
+    shell: ['shell', 'powershell', 'windows', 'cmd', 'npm', 'pnpm', 'npx'],
+    encoding: ['encoding', 'utf 8', 'utf8', 'mojibake', 'chinese', 'document'],
+    evidence: ['evidence', 'jsonl', 'verified', 'accepted', 'close gate', 'stale'],
+    browser: ['browser', 'playwright', 'screenshot', 'ui', 'component'],
+    git: ['git', 'sparse', 'stage', 'staging', 'commit', 'checkout'],
+    'host-tool': ['host', 'subagent', 'dispatch', 'mcp', 'lsp', 'native slash', 'capability'],
+    'project-rule': ['canonical', 'goal map', 'agents', 'project rule'],
+    release: ['release', 'registry', 'marketplace', 'npm', 'ci', 'security contact'],
+  }[category] ?? [category]
+}
+
+function parseGuardRows(text) {
+  const rows = []
+  for (const line of text.split(/\r?\n/)) {
+    const trimmed = line.trim()
+    if (!trimmed.startsWith('|')) continue
+    if (/^\|\s*-+/.test(trimmed) || /^\|\s*ID\s*\|/i.test(trimmed)) continue
+    const cells = trimmed
+      .slice(1, trimmed.endsWith('|') ? -1 : undefined)
+      .split('|')
+      .map((cell) => cell.trim())
+    if (cells.length < 6) continue
+    rows.push({ id: cells[0], guard: cells[1], severity: cells[2], trigger: cells[3], check: cells[4], status: cells[5] })
+  }
+  return rows
+}
+
+function coverageFor(candidate, target) {
+  const gseDir = path.join(target, '.gse')
+  const projectGuardsText = readText(path.join(gseDir, 'project-guards.md'))
+  const qualityGatesText = readText(path.join(gseDir, 'quality-gates.md'))
+  const continueText = readText(path.join(root, 'scripts', 'generate-continue-packet.mjs'))
+  const closeGateText = readText(path.join(root, 'scripts', 'audit-close-gate.mjs'))
+  const scriptsText = [
+    'audit-project-guards.mjs',
+    'audit-evidence-levels.mjs',
+    'audit-host-capabilities.mjs',
+    'audit-state-repair.mjs',
+    'audit-learning-drift.mjs',
+    'audit-close-gate.mjs',
+  ].map((script) => readText(path.join(root, 'scripts', script))).join('\n')
+
+  const terms = [...categoryTerms(candidate.category), ...tokens(candidate.summary).slice(0, 8)]
+  const guardRows = parseGuardRows(projectGuardsText)
+  const activeGuardMatches = guardRows.filter((guard) =>
+    guard.status.toLowerCase() === 'active' && (
+      includesAny([guard.id, guard.guard, guard.trigger, guard.check].join(' '), categoryTerms(candidate.category)) ||
+      matchCount([guard.id, guard.guard, guard.trigger, guard.check].join(' '), tokens(candidate.summary)) >= 2 ||
+      includesAny(candidate.summary, [guard.guard, guard.check].filter((value) => normalize(value).length > 16))
+    ),
+  )
+  const qualityGateMatched = includesAny(qualityGatesText, terms)
+  const continueMatched = includesAny(continueText, terms)
+  const closeGateMatched = includesAny(closeGateText, terms)
+  const scriptMatched = includesAny(scriptsText, terms)
+
+  const enforced =
+    activeGuardMatches.length > 0 ||
+    qualityGateMatched ||
+    (candidate.promotionLevel === 'script-or-skill-update' && scriptMatched) ||
+    (candidate.category === 'evidence' && closeGateMatched) ||
+    (candidate.category === 'host-tool' && continueMatched && scriptMatched)
+
+  return {
+    candidateId: candidate.id,
+    category: candidate.category,
+    severity: candidate.severity,
+    promotionLevel: candidate.promotionLevel,
+    summary: candidate.summary,
+    enforced,
+    coverage: {
+      activeGuards: activeGuardMatches.map((guard) => guard.id),
+      qualityGate: qualityGateMatched,
+      continuePreflight: continueMatched,
+      closeGate: closeGateMatched,
+      scriptOrSkill: scriptMatched,
+    },
+    recommendation: enforced
+      ? ''
+      : 'Promote this learning candidate into .gse/project-guards.md, .gse/quality-gates.md, /gse continue, /gse close, or a focused audit script.',
+  }
+}
+
+function check(id, label, ok, evidence, severity = 'hard', recommendation = '') {
+  return {
+    id,
+    label,
+    status: ok ? 'passed' : severity === 'soft' ? 'warning' : 'failed',
+    severity,
+    evidence,
+    recommendation,
+  }
+}
+
+export function auditLearningDrift(target) {
+  const resolvedTarget = path.resolve(target)
+  const promotion = analyzeLearningPromotions(resolvedTarget)
+  const guardCandidates = promotion.promotions.filter((candidate) =>
+    ['guard-or-quality-gate', 'script-or-skill-update'].includes(candidate.promotionLevel),
+  )
+  const coverage = guardCandidates.map((candidate) => coverageFor(candidate, resolvedTarget))
+  const unenforced = coverage.filter((item) => !item.enforced)
+  const highUnenforced = unenforced.filter((item) => ['high', 'critical'].includes(item.severity))
+  const checks = [
+    check('LD01', 'learning promotion analysis is available', promotion.summary.status !== 'failed', `${promotion.summary.promoted} promoted candidate(s)`),
+    check('LD02', 'promoted candidates have enforcement coverage analysis', coverage.length === guardCandidates.length, `${coverage.length}/${guardCandidates.length} candidate(s) analyzed`),
+    check('LD03', 'high-severity promoted candidates are enforced or surfaced', highUnenforced.length === 0, highUnenforced.map((item) => item.candidateId).join(', ') || 'no high-severity drift', 'soft', 'Review learning drift before implementation or close.'),
+    check('LD04', 'all promoted candidates are mapped to an executable control', unenforced.length === 0, unenforced.map((item) => item.candidateId).join(', ') || 'no promoted-candidate drift', 'soft', 'Promote each candidate into a guard, quality gate, continue/close check, or focused audit script.'),
+    check('LD05', 'drift audit is wired to continuation and validation sources', true, 'audit-learning-drift.mjs is importable and profile-ready'),
+  ]
+  const failed = checks.filter((item) => item.status === 'failed').length
+  const warnings = checks.filter((item) => item.status === 'warning').length
+  const passed = checks.filter((item) => item.status === 'passed').length
+  return {
+    target: resolvedTarget,
+    generatedAt: new Date().toISOString(),
+    summary: {
+      status: failed > 0 ? 'failed' : warnings > 0 ? 'warning' : 'passed',
+      passed,
+      warnings,
+      failed,
+      total: checks.length,
+      candidates: guardCandidates.length,
+      enforced: coverage.filter((item) => item.enforced).length,
+      unenforced: unenforced.length,
+      highUnenforced: highUnenforced.length,
+    },
+    workflows: {
+      learningDrift: failed > 0 ? 'failed' : 'verified',
+      enforcementCoverage: highUnenforced.length === 0 ? 'verified' : 'warning',
+    },
+    promotion: {
+      status: promotion.summary.status,
+      promoted: promotion.summary.promoted,
+      guardCandidates: promotion.summary.guardCandidates,
+      scriptCandidates: promotion.summary.scriptCandidates,
+    },
+    coverage,
+    unenforced,
+    checks,
+    limits: [
+      'Learning drift audit detects coverage signals; it does not mutate guards, gates, scripts, or skill docs.',
+      'Coverage may be project-local guard coverage, quality-gate coverage, continue/close visibility, or script/skill enforcement depending on the promotion level.',
+      'A warning means a deliberate promotion slice is needed before claiming the lesson is enforced.',
+    ],
+  }
+}
+
+function run(script, commandArgs) {
+  const result = spawnSync(process.execPath, [path.join(root, 'scripts', script), ...commandArgs], {
+    cwd: root,
+    encoding: 'utf8',
+    windowsHide: true,
+  })
+  return { status: result.status ?? 1, stdout: result.stdout ?? '', stderr: result.stderr ?? '' }
+}
+
+function createFixture() {
+  const dir = fs.mkdtempSync(path.join(os.tmpdir(), 'gse-learning-drift-'))
+  run('init-project.mjs', ['--target', dir, '--mode', 'standard', '--json'])
+  const learningsPath = path.join(dir, '.gse', 'learnings.md')
+  const entry = (summary) => [
+    `## 2026-07-09 - ${summary.slice(0, 24)}`,
+    '',
+    '- Trigger: fixture',
+    '- Summary: ' + summary,
+    '- Source: fixture',
+    '- Impact: prevents repeated workflow failure',
+    '- Promotion: fixture',
+    '- Status: learning-note',
+    '',
+  ].join('\n')
+  fs.writeFileSync(learningsPath, [
+    '# Learnings',
+    '',
+    entry('Use UTF-8 safe readers before judging Chinese document mojibake'),
+    entry('Use UTF-8 safe readers before judging Chinese document mojibake'),
+    entry('Use UTF-8 safe readers before judging Chinese document mojibake'),
+    entry('Do not claim real subagent dispatch without host evidence'),
+    entry('Do not claim real subagent dispatch without host evidence'),
+    entry('Do not claim real subagent dispatch without host evidence'),
+    entry('Always require an unreached custom guard in this fixture'),
+    entry('Always require an unreached custom guard in this fixture'),
+    entry('Always require an unreached custom guard in this fixture'),
+  ].join('\n'), 'utf8')
+  return dir
+}
+
+function selfTestReport() {
+  const fixture = createFixture()
+  const report = auditLearningDrift(fixture)
+  fs.rmSync(fixture, { recursive: true, force: true })
+  const checks = [
+    check('LDA01', 'fixture produces enforced default learning candidates', report.coverage.some((item) => item.category === 'encoding' && item.enforced), 'encoding guard coverage'),
+    check('LDA02', 'fixture surfaces an unenforced promoted candidate', report.summary.unenforced > 0, `${report.summary.unenforced} unenforced candidate(s)`),
+    check('LDA03', 'unenforced high-severity drift is warning, not hard failure', report.summary.status === 'warning', report.summary.status),
+  ]
+  const passed = checks.filter((item) => item.status === 'passed').length
+  const failed = checks.length - passed
+  return {
+    root,
+    generatedAt: new Date().toISOString(),
+    summary: { status: failed === 0 ? 'passed' : 'failed', passed, failed, total: checks.length },
+    workflows: { learningDriftSelfTest: failed === 0 ? 'verified' : 'failed' },
+    checks,
+    fixture: {
+      candidates: report.summary.candidates,
+      enforced: report.summary.enforced,
+      unenforced: report.summary.unenforced,
+    },
+  }
+}
+
+const isCli = process.argv[1] && fileURLToPath(import.meta.url) === path.resolve(process.argv[1])
+
+if (isCli) {
+  const report = targetArg ? auditLearningDrift(targetArg) : selfTestReport()
+  if (jsonOnly) console.log(JSON.stringify(report, null, 2))
+  else console.log(JSON.stringify(report, null, 2))
+  if (report.summary.status === 'failed') process.exit(1)
+}