@tea-agent/loop-agent 0.24.11-beta.0 → 0.25.1

package/dist/verification/maven/plan-commands.js

@@ -0,0 +1,421 @@
+import { createHash } from "node:crypto";
+import { existsSync } from "node:fs";
+import path from "node:path";
+import { MAVEN_CACHE_SCHEMA_VERSION, MAVEN_PLANNER_VERSION, MavenPlanError, } from "./types.js";
+const MAVEN_LAUNCHERS = new Set([
+    "mvn",
+    "mvnw",
+    "./mvnw",
+    ".\\mvnw",
+    ".\\mvnw.cmd",
+    "mvnw.cmd",
+    "mvnw.bat",
+    "./mvnw.cmd",
+    "./mvnw.bat",
+]);
+function toPosix(value) {
+    return value.replace(/\\/g, "/");
+}
+export function isMavenLauncherToken(token) {
+    const normalized = token.replace(/\\/g, "/");
+    if (MAVEN_LAUNCHERS.has(token) || MAVEN_LAUNCHERS.has(normalized)) {
+        return true;
+    }
+    const base = path.posix.basename(normalized).toLowerCase();
+    return base === "mvn" || base === "mvnw" || base === "mvnw.cmd" || base === "mvnw.bat";
+}
+const ENV_ASSIGNMENT_RE = /^[A-Za-z_][A-Za-z0-9_]*=.*$/;
+/** Detect shell metacharacters that make silent rewrite unsafe. */
+export function assertSafeMavenShellPayload(script) {
+    // Strip quoted segments so quoted pipes/redirects do not false-positive,
+    // but unquoted operators remain visible.
+    const withoutQuotes = script
+        .replace(/'[^']*'/g, " ")
+        .replace(/"[^"]*"/g, " ");
+    if (/[|;&><`]/.test(withoutQuotes) || /\n/.test(script)) {
+        throw new MavenPlanError(`Unsafe compound shell payload around Maven (pipeline/redirect/control): ${script}`, { code: "maven-unsafe-shell-payload" });
+    }
+    if (/\$\(|\$\{/.test(withoutQuotes)) {
+        throw new MavenPlanError(`Unsupported shell expansion around Maven: ${script}`, { code: "maven-unsafe-shell-payload" });
+    }
+}
+function splitEnvPrefix(tokens) {
+    const envPrefix = [];
+    let i = 0;
+    while (i < tokens.length && ENV_ASSIGNMENT_RE.test(tokens[i])) {
+        envPrefix.push(tokens[i]);
+        i += 1;
+    }
+    return { envPrefix, remaining: tokens.slice(i) };
+}
+function tokenizeShellLike(command) {
+    const tokens = [];
+    let current = "";
+    let quote = null;
+    for (let i = 0; i < command.length; i += 1) {
+        const ch = command[i];
+        if (quote) {
+            if (ch === quote) {
+                quote = null;
+            }
+            else {
+                current += ch;
+            }
+            continue;
+        }
+        if (ch === "'" || ch === '"') {
+            quote = ch;
+            continue;
+        }
+        if (/\s/.test(ch)) {
+            if (current) {
+                tokens.push(current);
+                current = "";
+            }
+            continue;
+        }
+        current += ch;
+    }
+    if (current)
+        tokens.push(current);
+    return tokens;
+}
+function joinShellTokens(tokens) {
+    return tokens
+        .map((token) => {
+        if (token.length === 0)
+            return "''";
+        if (/^[A-Za-z0-9_./:=,@%+-]+$/.test(token))
+            return token;
+        return `'${token.replace(/'/g, `'\\''`)}'`;
+    })
+        .join(" ");
+}
+/**
+ * Detect Maven invocations in VerifyCommand args.
+ * Supports direct `mvn ...` and `bash -lc 'mvn ...'`.
+ */
+export function parseMavenInvocation(command) {
+    const args = command.args;
+    if (args.length === 0)
+        return null;
+    // bash -lc "mvn ..."
+    if (args.length >= 3 &&
+        /^(bash|sh|zsh)$/.test(args[0] ?? "") &&
+        (args[1] === "-lc" || args[1] === "-c")) {
+        const script = args[2] ?? "";
+        assertSafeMavenShellPayload(script);
+        const tokens = tokenizeShellLike(script);
+        const launcherIndex = tokens.findIndex(isMavenLauncherToken);
+        if (launcherIndex < 0)
+            return null;
+        const beforeLauncher = tokens.slice(0, launcherIndex);
+        const { envPrefix, remaining } = splitEnvPrefix(beforeLauncher);
+        if (remaining.length > 0) {
+            throw new MavenPlanError(`Unsupported shell prefix before Maven launcher: ${remaining.join(" ")}`, { code: "maven-unsafe-shell-payload", candidates: remaining });
+        }
+        return {
+            prefix: args.slice(0, 2),
+            envPrefix,
+            embeddedShell: true,
+            embedArgIndex: 2,
+            launcher: tokens[launcherIndex],
+            mavenArgs: tokens.slice(launcherIndex + 1),
+            kind: "bash-lc",
+        };
+    }
+    const launcherIndex = args.findIndex(isMavenLauncherToken);
+    if (launcherIndex < 0)
+        return null;
+    const beforeLauncher = args.slice(0, launcherIndex);
+    const { envPrefix, remaining } = splitEnvPrefix(beforeLauncher);
+    if (remaining.length > 0) {
+        // Non-env prefix tokens on direct argv are preserved as outer prefix
+        // (e.g. env wrappers). Only pure env assignments become envPrefix.
+        return {
+            prefix: beforeLauncher,
+            envPrefix: [],
+            embeddedShell: false,
+            launcher: args[launcherIndex],
+            mavenArgs: args.slice(launcherIndex + 1),
+            kind: "direct",
+        };
+    }
+    return {
+        prefix: [],
+        envPrefix,
+        embeddedShell: false,
+        launcher: args[launcherIndex],
+        mavenArgs: args.slice(launcherIndex + 1),
+        kind: "direct",
+    };
+}
+export function commandContainsMaven(command) {
+    return parseMavenInvocation(command) !== null;
+}
+function extractMavenFlags(mavenArgs) {
+    const rest = [];
+    let explicitFile;
+    let explicitPl;
+    let explicitAm = false;
+    for (let i = 0; i < mavenArgs.length; i += 1) {
+        const arg = mavenArgs[i];
+        if (arg === "-f" || arg === "--file") {
+            const value = mavenArgs[i + 1];
+            if (!value) {
+                throw new MavenPlanError(`Maven ${arg} is missing a path argument`, {
+                    code: "maven-flag-missing-value",
+                });
+            }
+            explicitFile = toPosix(value);
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("-f=") || arg.startsWith("--file=")) {
+            explicitFile = toPosix(arg.slice(arg.indexOf("=") + 1));
+            continue;
+        }
+        if (arg === "-pl" || arg === "--projects") {
+            const value = mavenArgs[i + 1];
+            if (!value) {
+                throw new MavenPlanError(`Maven ${arg} is missing a value`, {
+                    code: "maven-flag-missing-value",
+                });
+            }
+            explicitPl = value;
+            i += 1;
+            continue;
+        }
+        if (arg.startsWith("-pl=") || arg.startsWith("--projects=")) {
+            explicitPl = arg.slice(arg.indexOf("=") + 1);
+            continue;
+        }
+        if (arg === "-am" || arg === "--also-make") {
+            explicitAm = true;
+            continue;
+        }
+        rest.push(arg);
+    }
+    return { explicitFile, explicitPl, explicitAm, rest };
+}
+/** Return explicit -f/--file value from maven args, if present. */
+export function extractExplicitMavenFile(mavenArgs) {
+    return extractMavenFlags(mavenArgs).explicitFile;
+}
+function assertInRepoFile(repoRoot, relPath, baseCwd) {
+    const raw = toPosix(relPath);
+    const absolute = path.isAbsolute(raw)
+        ? path.normalize(raw)
+        : path.resolve(baseCwd ?? repoRoot, raw);
+    const rel = path.relative(repoRoot, absolute);
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new MavenPlanError(`Maven -f path escapes repository root: ${relPath}`, { code: "maven-file-outside-repo", candidates: [relPath] });
+    }
+    if (!existsSync(absolute)) {
+        throw new MavenPlanError(`Maven -f path does not exist: ${toPosix(rel)}`, {
+            code: "maven-file-missing",
+            candidates: [toPosix(rel)],
+        });
+    }
+    return toPosix(rel);
+}
+function groupTargetsByBuild(targets) {
+    // reactorRoot -> modules; independent -> each own entry
+    const reactorGroups = new Map();
+    const independents = [];
+    for (const target of targets) {
+        if (target.reactorRootPomPath && target.moduleCoordinate) {
+            const list = reactorGroups.get(target.reactorRootPomPath) ?? [];
+            list.push(target.moduleCoordinate);
+            reactorGroups.set(target.reactorRootPomPath, list);
+        }
+        else if (target.reactorRootPomPath && !target.moduleCoordinate) {
+            // Selecting the reactor root itself
+            if (!reactorGroups.has(target.reactorRootPomPath)) {
+                reactorGroups.set(target.reactorRootPomPath, []);
+            }
+        }
+        else {
+            independents.push(target.pomPath);
+        }
+    }
+    const builds = [];
+    for (const [root, modules] of reactorGroups.entries()) {
+        const uniqueModules = [...new Set(modules)];
+        if (uniqueModules.length === 0) {
+            builds.push({ filePom: root, plModules: [], useAm: false });
+        }
+        else {
+            builds.push({
+                filePom: root,
+                plModules: uniqueModules,
+                useAm: true,
+            });
+        }
+    }
+    for (const pom of independents) {
+        builds.push({ filePom: pom, plModules: [], useAm: false });
+    }
+    // Stable output ordered by filePom path for determinism (not used as selection).
+    builds.sort((a, b) => a.filePom.localeCompare(b.filePom));
+    return builds;
+}
+function buildMavenArgList(input) {
+    const args = ["-f", input.filePom];
+    if (input.plModules.length > 0) {
+        args.push("-pl", input.plModules.join(","));
+    }
+    if (input.useAm) {
+        args.push("-am");
+    }
+    args.push(...input.rest);
+    return args;
+}
+function rebuildCommand(input) {
+    if (input.parsed.kind === "bash-lc" && input.parsed.embeddedShell) {
+        const script = joinShellTokens([
+            ...input.parsed.envPrefix,
+            input.parsed.launcher,
+            ...input.mavenArgs,
+        ]);
+        const args = [...input.original.args];
+        args[input.parsed.embedArgIndex ?? 2] = script;
+        return {
+            ...input.original,
+            args,
+        };
+    }
+    return {
+        ...input.original,
+        args: [
+            ...input.parsed.prefix,
+            ...input.parsed.envPrefix,
+            input.parsed.launcher,
+            ...input.mavenArgs,
+        ],
+    };
+}
+function digestCommand(command) {
+    return createHash("sha256")
+        .update(JSON.stringify({ label: command.label, args: command.args }))
+        .digest("hex");
+}
+function digestInputs(input) {
+    return createHash("sha256")
+        .update(JSON.stringify({
+        commands: input.commands.map((c) => ({
+            label: c.label,
+            args: c.args,
+        })),
+        targets: input.targets,
+        scope: {
+            allowedPaths: input.scope.allowedPaths,
+            writeSet: input.scope.writeSet ?? [],
+            sourcePaths: input.scope.sourcePaths ?? [],
+        },
+        plannerVersion: MAVEN_PLANNER_VERSION,
+    }))
+        .digest("hex");
+}
+/**
+ * Rewrite Maven VerifyCommands for the resolved targets.
+ * Non-Maven commands pass through unchanged.
+ */
+export function planMavenCommands(input) {
+    const builds = groupTargetsByBuild(input.targets);
+    const planned = [];
+    for (const command of input.commands) {
+        const parsed = parseMavenInvocation(command);
+        if (!parsed) {
+            planned.push(command);
+            continue;
+        }
+        const flags = extractMavenFlags(parsed.mavenArgs);
+        if (flags.explicitFile) {
+            const filePom = assertInRepoFile(input.repoRoot, flags.explicitFile, command.cwd ?? input.repoRoot);
+            // Explicit -f: respect user target; still forbid conflicting auto -pl when
+            // the file is an independent module pom without those modules.
+            if (flags.explicitPl || flags.explicitAm) {
+                const node = input.graph.nodes.find((n) => n.pomPath === filePom);
+                const isReactorRoot = input.graph.reactors.some((r) => r.rootPomPath === filePom);
+                if (!isReactorRoot) {
+                    throw new MavenPlanError(`Explicit -pl/-am conflicts with automatic planning for non-reactor POM -f ${filePom}`, {
+                        code: "maven-explicit-pl-conflict",
+                        candidates: [filePom, flags.explicitPl ?? "-am"],
+                    });
+                }
+                // When user already provided full -f/-pl/-am, keep rest + their flags.
+                const mavenArgs = buildMavenArgList({
+                    filePom,
+                    plModules: flags.explicitPl
+                        ? flags.explicitPl.split(",").map((s) => s.trim()).filter(Boolean)
+                        : [],
+                    useAm: flags.explicitAm,
+                    rest: flags.rest,
+                });
+                // Avoid double -f from buildMavenArgList — already correct.
+                planned.push(rebuildCommand({
+                    original: command,
+                    parsed,
+                    mavenArgs,
+                }));
+                continue;
+            }
+            // Explicit -f without -pl: keep that single target.
+            const mavenArgs = buildMavenArgList({
+                filePom,
+                plModules: [],
+                useAm: false,
+                rest: flags.rest,
+            });
+            planned.push(rebuildCommand({ original: command, parsed, mavenArgs }));
+            continue;
+        }
+        if (flags.explicitPl || flags.explicitAm) {
+            throw new MavenPlanError("Existing -pl/-am without a validated -f conflicts with automatic Maven planning; provide an explicit in-repo -f or remove -pl/-am.", {
+                code: "maven-explicit-pl-conflict",
+                candidates: [
+                    flags.explicitPl ?? "",
+                    flags.explicitAm ? "-am" : "",
+                ].filter(Boolean),
+            });
+        }
+        // Auto plan: expand one original command into one command per build group.
+        for (const build of builds) {
+            const mavenArgs = buildMavenArgList({
+                filePom: build.filePom,
+                plModules: build.plModules,
+                useAm: build.useAm,
+                rest: flags.rest,
+            });
+            planned.push(rebuildCommand({
+                original: {
+                    ...command,
+                    label: builds.length > 1
+                        ? `${command.label}:${build.filePom}`
+                        : command.label,
+                },
+                parsed,
+                mavenArgs,
+            }));
+        }
+    }
+    const plan = {
+        schemaVersion: MAVEN_CACHE_SCHEMA_VERSION,
+        plannerVersion: MAVEN_PLANNER_VERSION,
+        fingerprint: input.graph.fingerprint,
+        inputDigest: digestInputs({
+            commands: input.commands,
+            targets: input.targets,
+            scope: input.scope,
+        }),
+        targets: input.targets,
+        commandDigests: planned.map(digestCommand),
+        plannedCommands: planned.map((command) => ({
+            label: command.label,
+            args: command.args,
+        })),
+        workspaceManifest: input.graph.manifest,
+    };
+    return { commands: planned, plan };
+}

package/dist/verification/maven/pom-static.js

@@ -0,0 +1,136 @@
+import { readFileSync } from "node:fs";
+import path from "node:path";
+import { MavenPlanError } from "./types.js";
+function toPosix(value) {
+    return value.replace(/\\/g, "/");
+}
+function decodeXmlEntities(value) {
+    return value
+        .replace(/&lt;/g, "<")
+        .replace(/&gt;/g, ">")
+        .replace(/&amp;/g, "&")
+        .replace(/&quot;/g, '"')
+        .replace(/&apos;/g, "'");
+}
+function stripCommentsAndCdataNoise(xml) {
+    return xml
+        .replace(/<!--[\s\S]*?-->/g, "")
+        .replace(/<!\[CDATA\[([\s\S]*?)\]\]>/g, "$1");
+}
+function firstTagText(xml, tag) {
+    const re = new RegExp(`<${tag}(?:\\s[^>]*)?>([\\s\\S]*?)</${tag}>`, "i");
+    const match = xml.match(re);
+    if (!match)
+        return undefined;
+    const text = decodeXmlEntities(match[1] ?? "").trim();
+    return text.length > 0 ? text : undefined;
+}
+/**
+ * Extract text of a direct child tag under the root <project> element.
+ * Nested blocks such as <parent> are ignored so parent artifactId/groupId
+ * cannot shadow the project-level fields.
+ */
+function projectDirectChildText(xml, tag) {
+    const projectMatch = xml.match(/<project(?:\s[^>]*)?>([\s\S]*)<\/project>/i);
+    const body = projectMatch?.[1] ?? xml;
+    // Strip nested element blocks so only project-level direct children remain.
+    const withoutNested = body.replace(/<(parent|dependency|plugin|profile|modules|dependencies|build|properties|reporting|repositories|pluginRepositories|developers|contributors|licenses|scm|organization|issueManagement|ciManagement|distributionManagement|dependencyManagement|profiles)(?:\s[^>]*)?>[\s\S]*?<\/\1>/gi, "");
+    return firstTagText(withoutNested, tag);
+}
+function collectModuleTexts(xml) {
+    const modulesBlock = xml.match(/<modules(?:\s[^>]*)?>([\s\S]*?)<\/modules>/i);
+    if (!modulesBlock)
+        return [];
+    const body = modulesBlock[1] ?? "";
+    const modules = [];
+    const re = /<module(?:\s[^>]*)?>([\s\S]*?)<\/module>/gi;
+    let match;
+    while ((match = re.exec(body)) !== null) {
+        const text = decodeXmlEntities(match[1] ?? "").trim();
+        if (!text)
+            continue;
+        // Reject property-style module paths that cannot be proven statically.
+        if (text.includes("${")) {
+            throw new MavenPlanError(`POM module path is not statically provable: ${text}`, { code: "maven-pom-unresolvable-module" });
+        }
+        modules.push(toPosix(text));
+    }
+    return modules;
+}
+function parentBlockBody(xml) {
+    const parentBlock = xml.match(/<parent(?:\s[^>]*)?>([\s\S]*?)<\/parent>/i);
+    return parentBlock?.[1];
+}
+function parentRelativePath(xml) {
+    const body = parentBlockBody(xml);
+    if (body === undefined)
+        return undefined;
+    const relative = firstTagText(body, "relativePath");
+    if (relative === undefined)
+        return undefined;
+    if (relative.includes("${")) {
+        throw new MavenPlanError(`POM parent relativePath is not statically provable: ${relative}`, { code: "maven-pom-unresolvable-parent" });
+    }
+    return toPosix(relative);
+}
+/**
+ * Parse only the static POM fields required to build reactor relationships.
+ * Does not execute Maven and does not resolve the effective POM.
+ */
+export function parseStaticPomXml(xml, sourceLabel) {
+    const cleaned = stripCommentsAndCdataNoise(xml);
+    const artifactId = projectDirectChildText(cleaned, "artifactId");
+    if (!artifactId) {
+        throw new MavenPlanError(`POM is missing <artifactId>: ${sourceLabel}`, { code: "maven-pom-missing-artifactId" });
+    }
+    if (artifactId.includes("${")) {
+        throw new MavenPlanError(`POM artifactId is not statically provable: ${sourceLabel}`, { code: "maven-pom-unresolvable-artifactId" });
+    }
+    // Prefer project-level groupId; fall back to parent groupId when present.
+    let groupId = projectDirectChildText(cleaned, "groupId");
+    if (!groupId || groupId.includes("${")) {
+        const parentBody = parentBlockBody(cleaned);
+        if (parentBody) {
+            const parentGroup = firstTagText(parentBody, "groupId");
+            if (parentGroup && !parentGroup.includes("${")) {
+                groupId = parentGroup;
+            }
+            else {
+                groupId = undefined;
+            }
+        }
+        else {
+            groupId = undefined;
+        }
+    }
+    const packaging = projectDirectChildText(cleaned, "packaging");
+    const modules = collectModuleTexts(cleaned);
+    const parentRel = parentRelativePath(cleaned);
+    return {
+        artifactId,
+        groupId,
+        packaging: packaging && !packaging.includes("${") ? packaging : undefined,
+        modules,
+        parentRelativePath: parentRel,
+    };
+}
+export function readStaticPomFile(absolutePomPath) {
+    let xml;
+    try {
+        xml = readFileSync(absolutePomPath, "utf8");
+    }
+    catch (error) {
+        throw new MavenPlanError(`Unable to read POM: ${absolutePomPath}`, {
+            code: "maven-pom-read-error",
+            cause: error,
+        });
+    }
+    return parseStaticPomXml(xml, path.basename(absolutePomPath));
+}
+export function repoRelativePosix(repoRoot, absolutePath) {
+    const rel = path.relative(repoRoot, absolutePath);
+    if (!rel || rel.startsWith("..") || path.isAbsolute(rel)) {
+        throw new MavenPlanError(`Path escapes repository root: ${absolutePath}`, { code: "maven-path-outside-repo" });
+    }
+    return toPosix(rel);
+}