@tea-agent/loop-agent 0.24.11-beta.0 → 0.25.0

package/dist/verification/maven/pom-static.js

@@ -0,0 +1,136 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { MavenPlanError } from "./types.js";
+function toPosix(value) {
+    return value.replace(/\\/g, "/");
+}
+function decodeXmlEntities(value) {
+    return value
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&amp;/g, "&")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'");
+}
+function stripCommentsAndCdataNoise(xml) {
+    return xml
+        .replace(/<!--[\s\S]*?-->/g, "")
+        .replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, "$1");
+}
+function firstTagText(xml, tag) {
+    const re = new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, "i");
+    const match = xml.match(re);
+    if (!match)
+        return undefined;
+    const text = decodeXmlEntities(match[1] ?? "").trim();
+    return text.length > 0 ? text : undefined;
+}
+/**
+ * Extract text of a direct child tag under the root <project> element.
+ * Nested blocks such as <parent> are ignored so parent artifactId/groupId
+ * cannot shadow the project-level fields.
+ */
+function projectDirectChildText(xml, tag) {
+    const projectMatch = xml.match(/<project(?:\s[^>]*)?>([\s\S]*)<\/project>/i);
+    const body = projectMatch?.[1] ?? xml;
+    // Strip nested element blocks so only project-level direct children remain.
+    const withoutNested = body.replace(/<(parent|dependency|plugin|profile|modules|dependencies|build|properties|reporting|repositories|pluginRepositories|developers|contributors|licenses|scm|organization|issueManagement|ciManagement|distributionManagement|dependencyManagement|profiles)(?:\s[^>]*)?>[\s\S]*?<\/\1>/gi, "");
+    return firstTagText(withoutNested, tag);
+}
+function collectModuleTexts(xml) {
+    const modulesBlock = xml.match(/<modules(?:\s[^>]*)?>([\s\S]*?)<\/modules>/i);
+    if (!modulesBlock)
+        return [];
+    const body = modulesBlock[1] ?? "";
+    const modules = [];
+    const re = /<module(?:\s[^>]*)?>([\s\S]*?)<\/module>/gi;
+    let match;
+    while ((match = re.exec(body)) !== null) {
+        const text = decodeXmlEntities(match[1] ?? "").trim();
+        if (!text)
+            continue;
+        // Reject property-style module paths that cannot be proven statically.
+        if (text.includes("${")) {
+            throw new MavenPlanError(`POM module path is not statically provable: ${text}`, { code: "maven-pom-unresolvable-module" });
+        }
+        modules.push(toPosix(text));
+    }
+    return modules;
+}
+function parentBlockBody(xml) {
+    const parentBlock = xml.match(/<parent(?:\s[^>]*)?>([\s\S]*?)<\/parent>/i);
+    return parentBlock?.[1];
+}
+function parentRelativePath(xml) {
+    const body = parentBlockBody(xml);
+    if (body === undefined)
+        return undefined;
+    const relative = firstTagText(body, "relativePath");
+    if (relative === undefined)
+        return undefined;
+    if (relative.includes("${")) {
+        throw new MavenPlanError(`POM parent relativePath is not statically provable: ${relative}`, { code: "maven-pom-unresolvable-parent" });
+    }
+    return toPosix(relative);
+}
+/**
+ * Parse only the static POM fields required to build reactor relationships.
+ * Does not execute Maven and does not resolve the effective POM.
+ */
+export function parseStaticPomXml(xml, sourceLabel) {
+    const cleaned = stripCommentsAndCdataNoise(xml);
+    const artifactId = projectDirectChildText(cleaned, "artifactId");
+    if (!artifactId) {
+        throw new MavenPlanError(`POM is missing <artifactId>: ${sourceLabel}`, { code: "maven-pom-missing-artifactId" });
+    }
+    if (artifactId.includes("${")) {
+        throw new MavenPlanError(`POM artifactId is not statically provable: ${sourceLabel}`, { code: "maven-pom-unresolvable-artifactId" });
+    }
+    // Prefer project-level groupId; fall back to parent groupId when present.
+    let groupId = projectDirectChildText(cleaned, "groupId");
+    if (!groupId || groupId.includes("${")) {
+        const parentBody = parentBlockBody(cleaned);
+        if (parentBody) {
+            const parentGroup = firstTagText(parentBody, "groupId");
+            if (parentGroup && !parentGroup.includes("${")) {
+                groupId = parentGroup;
+            }
+            else {
+                groupId = undefined;
+            }
+        }
+        else {
+            groupId = undefined;
+        }
+    }
+    const packaging = projectDirectChildText(cleaned, "packaging");
+    const modules = collectModuleTexts(cleaned);
+    const parentRel = parentRelativePath(cleaned);
+    return {
+        artifactId,
+        groupId,
+        packaging: packaging && !packaging.includes("${") ? packaging : undefined,
+        modules,
+        parentRelativePath: parentRel,
+    };
+}
+export function readStaticPomFile(absolutePomPath) {
+    let xml;
+    try {
+        xml = readFileSync(absolutePomPath, "utf8");
+    }
+    catch (error) {
+        throw new MavenPlanError(`Unable to read POM: ${absolutePomPath}`, {
+            code: "maven-pom-read-error",
+            cause: error,
+        });
+    }
+    return parseStaticPomXml(xml, path.basename(absolutePomPath));
+}
+export function repoRelativePosix(repoRoot, absolutePath) {
+    const rel = path.relative(repoRoot, absolutePath);
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new MavenPlanError(`Path escapes repository root: ${absolutePath}`, { code: "maven-path-outside-repo" });
+    }
+    return toPosix(rel);
+}

package/dist/verification/maven/scope-resolve.js

@@ -0,0 +1,153 @@
+import path from "node:path";
+import { MavenPlanError, } from "./types.js";
+function toPosix(value) {
+    return value.replace(/\\/g, "/").replace(/^\.\//, "");
+}
+function stripGlobSuffix(pattern) {
+    let p = toPosix(pattern.trim());
+    // Normalize common task globs to directory prefixes.
+    p = p.replace(/\/\*\*$/, "");
+    p = p.replace(/\/\*$/, "");
+    p = p.replace(/\*\*$/, "");
+    p = p.replace(/\*$/, "");
+    p = p.replace(/\/+$/, "");
+    return p;
+}
+function isPathInside(parent, child) {
+    const p = toPosix(parent);
+    const c = toPosix(child);
+    if (p === "")
+        return true;
+    if (c === p)
+        return true;
+    return c.startsWith(`${p}/`);
+}
+/**
+ * A module is proven when at least one scope path is strictly inside that
+ * module directory tree (or equals the module dir). Sibling name similarity is
+ * never evidence. Broad "**" alone does not prove any module.
+ */
+function scopePathProvesModule(scopePath, moduleDir) {
+    const scope = stripGlobSuffix(scopePath);
+    if (scope === "" || scope === "**" || scope === ".") {
+        return false;
+    }
+    const mod = toPosix(moduleDir);
+    if (mod === "") {
+        // Root module: only proven by explicit root-ish paths, not by "**".
+        return scope === "" || scope === "." || scope === "pom.xml";
+    }
+    // Scope prefix falls inside module, or module falls inside a write/source path
+    // that is more specific than the module parent.
+    if (isPathInside(mod, scope))
+        return true;
+    // writeSet file under module
+    if (isPathInside(mod, scope))
+        return true;
+    return false;
+}
+function collectScopePaths(scope) {
+    const values = [
+        ...(scope.allowedPaths ?? []),
+        ...(scope.writeSet ?? []),
+        ...(scope.sourcePaths ?? []),
+    ];
+    return values.map(toPosix).filter((value) => value.length > 0);
+}
+function nodeDir(node) {
+    return toPosix(node.dir);
+}
+function targetForNode(graph, node) {
+    const reactorRoot = graph.reactorRootByPomPath[node.pomPath];
+    if (reactorRoot && reactorRoot !== node.pomPath) {
+        const reactor = graph.reactors.find((r) => r.rootPomPath === reactorRoot);
+        // Prefer reactor-root-relative module path for -pl (nested aggregators).
+        const coordinate = reactor?.modulePathByPomPath?.[node.pomPath] ??
+            reactor?.artifactIdByPomPath[node.pomPath] ??
+            node.artifactId;
+        return {
+            pomPath: node.pomPath,
+            artifactId: node.artifactId,
+            reactorRootPomPath: reactorRoot,
+            moduleCoordinate: coordinate,
+        };
+    }
+    // Root of a reactor selected itself, or independent POM.
+    return {
+        pomPath: node.pomPath,
+        artifactId: node.artifactId,
+        reactorRootPomPath: reactorRoot === node.pomPath ? reactorRoot : undefined,
+    };
+}
+/**
+ * Resolve uniquely proven Maven targets from task scope.
+ * Never uses depth, lexical order, or first-match as selection heuristics.
+ */
+export function resolveMavenTargets(input) {
+    const scopePaths = collectScopePaths(input.scope);
+    if (scopePaths.length === 0) {
+        throw new MavenPlanError("Maven verification requires task scope paths to prove a unique target; no allowedPaths/writeSet/sourcePaths were provided.", { code: "maven-scope-empty" });
+    }
+    const proven = [];
+    for (const node of input.graph.nodes) {
+        const dir = nodeDir(node);
+        const provenBy = scopePaths.some((scopePath) => scopePathProvesModule(scopePath, dir));
+        if (provenBy) {
+            proven.push(node);
+        }
+    }
+    if (proven.length === 0) {
+        const candidates = input.graph.nodes.map((n) => n.pomPath).sort();
+        throw new MavenPlanError(`Unable to uniquely prove a Maven target from task scope. Candidates: ${candidates.join(", ") || "(none)"}`, { code: "maven-scope-no-target", candidates });
+    }
+    // If multiple modules are proven, keep them only when each is independently
+    // proven by scope — never drop by sorting.
+    // Prefer more specific modules over their reactor ancestors when both match
+    // because a child path also matches the parent prefix.
+    const provenDirs = new Set(proven.map((n) => nodeDir(n)));
+    const filtered = proven.filter((node) => {
+        const dir = nodeDir(node);
+        // Drop ancestor modules when a descendant module is also proven.
+        for (const other of proven) {
+            if (other.pomPath === node.pomPath)
+                continue;
+            const otherDir = nodeDir(other);
+            if (otherDir !== dir && isPathInside(dir, otherDir)) {
+                return false;
+            }
+        }
+        return provenDirs.has(dir);
+    });
+    if (filtered.length === 0) {
+        const candidates = proven.map((n) => n.pomPath).sort();
+        throw new MavenPlanError(`Ambiguous Maven target after filtering ancestors. Candidates: ${candidates.join(", ")}`, { code: "maven-scope-ambiguous", candidates });
+    }
+    // Wide "**" only scope that still matched nothing specific is already handled.
+    // If still multiple independent modules and the only scope paths are broad
+    // globs that equally cover all of them without nested proof, fail.
+    const specificProof = scopePaths.some((scopePath) => {
+        const stripped = stripGlobSuffix(scopePath);
+        return stripped !== "" && stripped !== "**" && stripped !== ".";
+    });
+    if (!specificProof && filtered.length > 1) {
+        const candidates = filtered.map((n) => n.pomPath).sort();
+        throw new MavenPlanError(`Ambiguous Maven task scope matches multiple modules without unique proof. Candidates: ${candidates.join(", ")}`, { code: "maven-scope-ambiguous", candidates });
+    }
+    // Deduplicate by pom path without sorting-based selection.
+    const byPom = new Map();
+    for (const node of filtered) {
+        byPom.set(node.pomPath, targetForNode(input.graph, node));
+    }
+    const targets = [...byPom.values()];
+    if (targets.length === 0) {
+        throw new MavenPlanError("No Maven targets remained after scope resolution.", {
+            code: "maven-scope-no-target",
+        });
+    }
+    return targets;
+}
+export function moduleDirFromPomPath(pomPath) {
+    const posix = toPosix(pomPath);
+    const dir = path.posix.dirname(posix);
+    return dir === "." ? "" : dir;
+}

package/dist/verification/maven/stale.js

@@ -0,0 +1,130 @@
+import { createHash } from "node:crypto";
+import { isCachedGraphStillFresh } from "./cache.js";
+import { MAVEN_CACHE_SCHEMA_VERSION, MAVEN_PLANNER_VERSION, MavenPlanStaleError, } from "./types.js";
+import { buildMavenWorkspaceGraph } from "./workspace-graph.js";
+function digestCommand(command) {
+    return createHash("sha256")
+        .update(JSON.stringify({ label: command.label, args: command.args }))
+        .digest("hex");
+}
+function digestShellCommand(command) {
+    return createHash("sha256").update(command).digest("hex");
+}
+function commandsMatchPlan(plan, commands) {
+    if (plan.plannedCommands && plan.plannedCommands.length > 0) {
+        if (commands.length !== plan.plannedCommands.length)
+            return false;
+        for (let i = 0; i < commands.length; i += 1) {
+            const planned = plan.plannedCommands[i];
+            const actual = commands[i];
+            if (planned.label !== actual.label)
+                return false;
+            if (planned.args.length !== actual.args.length)
+                return false;
+            for (let j = 0; j < planned.args.length; j += 1) {
+                if (planned.args[j] !== actual.args[j])
+                    return false;
+            }
+        }
+        return true;
+    }
+    if (plan.commandDigests && plan.commandDigests.length > 0) {
+        if (commands.length !== plan.commandDigests.length)
+            return false;
+        for (let i = 0; i < commands.length; i += 1) {
+            if (digestCommand(commands[i]) !== plan.commandDigests[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+    return true;
+}
+function shellCommandsMatchPlan(plan, shellCommands) {
+    if (plan.shellCommandDigests && plan.shellCommandDigests.length > 0) {
+        if (shellCommands.length !== plan.shellCommandDigests.length)
+            return false;
+        for (let i = 0; i < shellCommands.length; i += 1) {
+            if (digestShellCommand(shellCommands[i]) !== plan.shellCommandDigests[i]) {
+                return false;
+            }
+        }
+        return true;
+    }
+    // No frozen shell digests — cannot prove drift; treat as matching.
+    return true;
+}
+function assertWorkspaceFresh(repoRoot, plan) {
+    // Prefer lightweight stat-only check against the frozen manifest.
+    if (plan.workspaceManifest) {
+        const probe = {
+            schemaVersion: plan.schemaVersion,
+            plannerVersion: plan.plannerVersion,
+            fingerprint: plan.fingerprint,
+            pomPaths: [],
+            wrapperPaths: [],
+            nodes: [],
+            reactors: [],
+            reactorRootByPomPath: {},
+            manifest: plan.workspaceManifest,
+        };
+        if (isCachedGraphStillFresh(repoRoot, probe)) {
+            return;
+        }
+        // Metadata changed: confirm via content fingerprint (targeted rebuild).
+        const graph = buildMavenWorkspaceGraph(repoRoot);
+        if (graph.fingerprint !== plan.fingerprint) {
+            throw new MavenPlanStaleError("verification-plan-stale: Maven POM/wrapper fingerprint drifted since DAG generation; regenerate/validate the DAG before running Maven");
+        }
+        // Directory metadata also changes for normal implementation work (for
+        // example, adding a Java source directory). The full static rebuild above
+        // proves the Maven inputs are unchanged, so the frozen plan remains valid.
+        return;
+    }
+    // Legacy plans without manifest: full static fingerprint re-check.
+    const graph = buildMavenWorkspaceGraph(repoRoot);
+    if (graph.fingerprint !== plan.fingerprint) {
+        throw new MavenPlanStaleError("verification-plan-stale: Maven POM/wrapper fingerprint drifted since DAG generation; regenerate/validate the DAG before running Maven");
+    }
+}
+/**
+ * Re-check frozen plan against workspace + optional execution command sequence.
+ * Lightweight path only stats paths recorded in the frozen workspaceManifest.
+ * Throws MavenPlanStaleError (code verification-plan-stale) on drift.
+ */
+export function assertMavenPlanFresh(repoRoot, plan, commands) {
+    if (plan.schemaVersion !== MAVEN_CACHE_SCHEMA_VERSION) {
+        throw new MavenPlanStaleError(`verification-plan-stale: plan schemaVersion ${plan.schemaVersion} != ${MAVEN_CACHE_SCHEMA_VERSION}; regenerate the DAG`);
+    }
+    if (plan.plannerVersion !== MAVEN_PLANNER_VERSION) {
+        throw new MavenPlanStaleError(`verification-plan-stale: plan plannerVersion ${plan.plannerVersion} != ${MAVEN_PLANNER_VERSION}; regenerate the DAG`);
+    }
+    if (commands) {
+        if (Array.isArray(commands)) {
+            const normalized = commands.map((command) => ({
+                label: command.label,
+                args: command.args,
+            }));
+            if (!commandsMatchPlan(plan, normalized)) {
+                throw new MavenPlanStaleError("verification-plan-stale: planned Maven command sequence/digests drifted since DAG generation; regenerate/validate the DAG before running Maven");
+            }
+        }
+        else {
+            if (commands.verifyCommands) {
+                const normalized = commands.verifyCommands.map((command) => ({
+                    label: command.label,
+                    args: command.args,
+                }));
+                if (!commandsMatchPlan(plan, normalized)) {
+                    throw new MavenPlanStaleError("verification-plan-stale: planned Maven command sequence/digests drifted since DAG generation; regenerate/validate the DAG before running Maven");
+                }
+            }
+            if (commands.shellCommands) {
+                if (!shellCommandsMatchPlan(plan, commands.shellCommands)) {
+                    throw new MavenPlanStaleError("verification-plan-stale: shell.commands sequence drifted from frozen Maven verification plan; regenerate/validate the DAG before running Maven");
+                }
+            }
+        }
+    }
+    assertWorkspaceFresh(repoRoot, plan);
+}

package/dist/verification/maven/types.js

@@ -0,0 +1,23 @@
+/** Bump when planner decision rules change (invalidates cache). */
+export const MAVEN_PLANNER_VERSION = "1.1.1";
+/** Bump when on-disk cache JSON shape changes. */
+export const MAVEN_CACHE_SCHEMA_VERSION = 2;
+export class MavenPlanError extends Error {
+    code;
+    candidates;
+    constructor(message, options) {
+        super(message, options?.cause ? { cause: options.cause } : undefined);
+        this.name = "MavenPlanError";
+        this.code = options?.code ?? "maven-plan-error";
+        this.candidates = options?.candidates;
+    }
+}
+export class MavenPlanStaleError extends MavenPlanError {
+    constructor(message, options) {
+        super(message, {
+            code: "verification-plan-stale",
+            cause: options?.cause,
+        });
+        this.name = "MavenPlanStaleError";
+    }
+}