@williambeto/ai-workflow 2.2.7 → 2.3.0

package/src/core/runtime/opencode-adapter.js

@@ -1,4 +1,4 @@
-import { spawn, execSync } from "node:child_process";
+import { spawn, spawnSync } from "node:child_process";
 import readline from "node:readline";
 
 /**
@@ -9,86 +9,161 @@ export class OpenCodeAdapter {
     this.cwd = cwd;
   }
 
+  /**
+   * Inspects the availability and capability of the OpenCode CLI.
+   * @returns {Promise<{available: boolean, supports: {run: boolean, formatJson: boolean, agent: boolean, model: boolean}}>}
+   */
+  async inspect() {
+    try {
+      const cliHelp = spawnSync("opencode", ["--help"], { encoding: "utf8" });
+      const runHelp = spawnSync("opencode", ["run", "--help"], { encoding: "utf8" });
+
+      const available = cliHelp.status === 0 && runHelp.status === 0;
+      if (!available) {
+        return {
+          available: false,
+          supports: { run: false, formatJson: false, agent: false, model: false }
+        };
+      }
+
+      return {
+        available: true,
+        supports: {
+          run: /\brun\b/.test(cliHelp.stdout),
+          formatJson: /--format/.test(runHelp.stdout),
+          agent: /--agent/.test(runHelp.stdout),
+          model: /--model/.test(runHelp.stdout),
+        }
+      };
+    } catch {
+      return {
+        available: false,
+        supports: { run: false, formatJson: false, agent: false, model: false }
+      };
+    }
+  }
+
   /**
    * Runs opencode with a prompt and options.
    * @param {string} message - The message prompt.
-   * @param {Object} options - CLI options (e.g. agent, model, dangerouslySkipPermissions).
-   * @returns {Promise<{success: boolean, commandsRun: string[], eventCount: number}>}
+   * @param {Object} options - CLI options (e.g. agent, model, readOnly).
+   * @returns {Promise<{success: boolean, commandsRun: string[], eventCount: number, error?: string}>}
    */
-  async execute(message, { agent = null, model = null, dangerouslySkipPermissions = false } = {}) {
-    return new Promise((resolve) => {
-      const args = ["run", message, "--format", "json"];
-      if (agent) {
-        args.push("--agent", agent);
-      }
-      if (model) {
-        args.push("--model", model);
-      }
-      if (dangerouslySkipPermissions) {
-        args.push("--dangerously-skip-permissions");
-      }
+  async execute(message, { agent = null, model = null, readOnly = false } = {}) {
+    const inspection = await this.inspect();
+    if (!inspection.available) {
+      return {
+        success: false,
+        commandsRun: [],
+        eventCount: 0,
+        error: "OpenCode CLI is not installed or not available in the system PATH."
+      };
+    }
+
+    const runInWorkspace = async (targetCwd) => {
+      return new Promise((resolve) => {
+        const args = ["run", message];
+        if (inspection.supports.formatJson) {
+          args.push("--format", "json");
+        }
+        if (agent && inspection.supports.agent) {
+          args.push("--agent", agent);
+        }
+        if (model && inspection.supports.model) {
+          args.push("--model", model);
+        }
 
-      console.log(`[RUNTIME] Delegating to OpenCode: opencode ${args.map(a => a.includes(" ") ? `"${a}"` : a).join(" ")}`);
+        console.log(`[RUNTIME] Delegating to OpenCode: opencode ${args.map(a => a.includes(" ") ? `"${a}"` : a).join(" ")}`);
 
-      const child = spawn("opencode", args, {
-        cwd: this.cwd,
-        shell: true,
-        stdio: ["ignore", "pipe", "inherit"] // Inherit stderr to show warnings directly
-      });
+        const child = spawn("opencode", args, {
+          cwd: targetCwd,
+          stdio: ["ignore", "pipe", "inherit"] // Inherit stderr to show warnings directly
+        });
 
-      const rl = readline.createInterface({
-        input: child.stdout,
-        terminal: false
-      });
+        const rl = readline.createInterface({
+          input: child.stdout,
+          terminal: false
+        });
 
-      const commandsRun = [];
-      let eventCount = 0;
+        const commandsRun = [];
+        let eventCount = 0;
 
-      rl.on("line", (line) => {
-        const trimmed = line.trim();
-        if (!trimmed) return;
+        rl.on("line", (line) => {
+          const trimmed = line.trim();
+          if (!trimmed) return;
 
-        try {
-          const event = JSON.parse(trimmed);
-          eventCount++;
+          try {
+            const event = JSON.parse(trimmed);
+            eventCount++;
 
-          // 1. Stream agent output text in real-time to user
-          if (event.type === "text" && event.part?.text) {
-            process.stdout.write(event.part.text);
-          }
+            // 1. Stream agent output text in real-time to user
+            if (event.type === "text" && event.part?.text) {
+              process.stdout.write(event.part.text);
+            }
 
-          // 2. Capture tool executions/commands
-          if (event.type === "step_start" && event.part?.toolCalls) {
-            for (const call of event.part.toolCalls) {
-              if (call.name === "run_command" && call.args?.CommandLine) {
-                commandsRun.push(call.args.CommandLine);
+            // 2. Capture tool executions/commands
+            if (event.type === "step_start" && event.part?.toolCalls) {
+              for (const call of event.part.toolCalls) {
+                if (call.name === "run_command" && call.args?.CommandLine) {
+                  commandsRun.push(call.args.CommandLine);
+                }
+                if (readOnly) {
+                  const name = call.name || "";
+                  const isWriteTool = name.startsWith("write_") || name.includes("write") || name.includes("replace") || name.includes("edit") || name.includes("delete") || name.includes("remove");
+                  let isDestructiveGit = false;
+                  if (name === "run_command" && call.args?.CommandLine) {
+                    const cmd = call.args.CommandLine;
+                    const destPattern = /\b(git\s+(commit|add|push|merge|reset|rm|branch|checkout|switch|stash|init)|touch|rm|mkdir|cp|mv|chmod|chown|tee|sed|awk)\b|>>|>/;
+                    if (destPattern.test(cmd)) {
+                      isDestructiveGit = true;
+                    }
+                  }
+                  if (isWriteTool || isDestructiveGit) {
+                    console.error(`\n[SECURITY WARNING] Read-only execution blocked attempt to write/modify workspace: tool '${name}' or command detected.`);
+                    child.kill();
+                    resolve({
+                      success: false,
+                      commandsRun,
+                      eventCount,
+                      error: `Read-only confinement violation: tool '${name}' or command attempted write/modify operation during read-only task.`
+                    });
+                    return;
+                  }
+                }
               }
             }
+          } catch {
+            // If a line is not valid JSON (e.g. starting/finishing logs), print it directly
+            console.log(trimmed);
           }
-        } catch {
-          // If a line is not valid JSON (e.g. starting/finishing logs), print it directly
-          console.log(trimmed);
-        }
-      });
+        });
 
-      child.on("close", (code) => {
-        console.log("\n[RUNTIME] OpenCode finished execution.");
-        resolve({
-          success: code === 0,
-          commandsRun,
-          eventCount
+        child.on("close", (code) => {
+          console.log("\n[RUNTIME] OpenCode finished execution.");
+          resolve({
+            success: code === 0,
+            commandsRun,
+            eventCount
+          });
         });
-      });
 
-      child.on("error", (err) => {
-        console.error(`\n[RUNTIME] Failed to launch opencode: ${err.message}`);
-        resolve({
-          success: false,
-          commandsRun,
-          eventCount: 0,
-          error: err.message
+        child.on("error", (err) => {
+          console.error(`\n[RUNTIME] Failed to launch opencode: ${err.message}`);
+          resolve({
+            success: false,
+            commandsRun,
+            eventCount: 0,
+            error: err.message
+          });
         });
       });
-    });
+    };
+
+    if (readOnly) {
+      const { runInReadOnlyWorkspace } = await import("../workspace/read-only-workspace.js");
+      return runInReadOnlyWorkspace(this.cwd, runInWorkspace);
+    } else {
+      return runInWorkspace(this.cwd);
+    }
   }
 }

package/src/core/validation/evidence-collector.js

@@ -42,22 +42,45 @@ export class EvidenceCollector {
     if (task.presetStatus) {
       return { name: task.name, command: task.command, kind, status: task.presetStatus, exitCode: null, summary: task.summary, output: "" };
     }
+
+    let cmd = task.command;
+    let args = [];
+    if (Array.isArray(cmd)) {
+      const [c, ...a] = cmd;
+      cmd = c;
+      args = a;
+    } else if (typeof cmd === "string") {
+      const parts = cmd.split(/\s+/);
+      cmd = parts[0];
+      args = parts.slice(1);
+    }
+
     const isWin32 = process.platform === "win32";
     const isUncPath = typeof this.cwd === "string" && (this.cwd.startsWith("\\\\") || this.cwd.startsWith("//"));
-    const shellOption = isWin32 && isUncPath ? "powershell.exe" : true;
+    const shellOption = isWin32 && isUncPath ? "powershell.exe" : (isWin32 ? true : false);
 
-    const result = spawnSync(task.command, {
+    const result = spawnSync(cmd, args, {
       cwd: this.cwd,
       shell: shellOption,
       encoding: "utf8",
       timeout: this.timeout
     });
+
     let status = result.status === 0 ? "PASS" : "FAIL";
+    if (result.error) {
+      status = "FAIL";
+      if (result.error.code === "ETIMEDOUT") {
+        status = "BLOCKED";
+      }
+    }
+
     let summary = status === "PASS" ? "Command completed successfully." : "Command failed.";
     if (result.error?.code === "ETIMEDOUT") {
-      status = "BLOCKED";
       summary = `Command timed out after ${this.timeout / 1000}s.`;
+    } else if (result.error) {
+      summary = `Command execution error: ${result.error.message}`;
     }
+
     const rawOutput = `${result.stdout || ""}${result.stderr || ""}`.trim();
     const output = rawOutput.length > this.maxLogLength ? `${rawOutput.slice(0, this.maxLogLength)}\n... [TRUNCATED]` : rawOutput;
     return { name: task.name, command: task.command, kind, status, exitCode: result.status, signal: result.signal, summary, output };

package/src/core/validation/stack-detector.js

@@ -0,0 +1,65 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+
+export class StackDetector {
+  constructor({ cwd = process.cwd() } = {}) {
+    this.cwd = cwd;
+  }
+
+  async detect() {
+    const stacks = [];
+
+    // 1. Node check
+    const packageJsonExists = await fs.access(path.join(this.cwd, "package.json")).then(() => true).catch(() => false);
+    if (packageJsonExists) {
+      stacks.push("node");
+    }
+
+    // 2. Python check
+    const pyprojectExists = await fs.access(path.join(this.cwd, "pyproject.toml")).then(() => true).catch(() => false) ||
+                             await fs.access(path.join(this.cwd, "requirements.txt")).then(() => true).catch(() => false) ||
+                             await fs.access(path.join(this.cwd, "setup.py")).then(() => true).catch(() => false) ||
+                             await fs.access(path.join(this.cwd, "Pipfile")).then(() => true).catch(() => false);
+    
+    let hasPythonFiles = pyprojectExists;
+    if (!hasPythonFiles) {
+      hasPythonFiles = await this.hasFileWithExtension(this.cwd, ".py");
+    }
+    if (hasPythonFiles) {
+      stacks.push("python");
+    }
+
+    // 3. PHP check
+    const composerExists = await fs.access(path.join(this.cwd, "composer.json")).then(() => true).catch(() => false);
+    let hasPhpFiles = composerExists;
+    if (!hasPhpFiles) {
+      hasPhpFiles = await this.hasFileWithExtension(this.cwd, ".php");
+    }
+    if (hasPhpFiles) {
+      stacks.push("php");
+    }
+
+    return stacks;
+  }
+
+  async hasFileWithExtension(dir, ext) {
+    try {
+      const entries = await fs.readdir(dir, { withFileTypes: true });
+      for (const entry of entries) {
+        if (entry.isDirectory()) {
+          if (["node_modules", "vendor", ".git", "dist", "build", ".cache"].includes(entry.name)) {
+            continue;
+          }
+          const subPath = path.join(dir, entry.name);
+          const found = await this.hasFileWithExtension(subPath, ext);
+          if (found) return true;
+        } else if (entry.isFile() && entry.name.endsWith(ext)) {
+          return true;
+        }
+      }
+    } catch {
+      // ignore
+    }
+    return false;
+  }
+}

package/src/core/validation/validation-planner.js

@@ -0,0 +1,134 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { StackDetector } from "./stack-detector.js";
+
+export class ValidationPlanner {
+  constructor({ cwd = process.cwd(), qualityGuard } = {}) {
+    this.cwd = cwd;
+    this.qualityGuard = qualityGuard;
+    this.stackDetector = new StackDetector({ cwd });
+  }
+
+  async plan(profile = "generic") {
+    const stacks = await this.stackDetector.detect();
+    const tasks = [];
+
+    const changedFiles = this.qualityGuard.getChangedFiles().filter((file) => {
+      return !/(^|\/)(node_modules|vendor|dist|coverage|\.cache)(\/|$)/.test(String(file).replaceAll("\\", "/"));
+    });
+    const executableBehavior = await this.qualityGuard.hasExecutableBehaviorChanges();
+
+    // Node Stack Planning
+    if (stacks.includes("node")) {
+      try {
+        const pkg = JSON.parse(await fs.readFile(path.join(this.cwd, "package.json"), "utf8"));
+        const scripts = pkg.scripts || {};
+
+        this.addNodeScriptTask(tasks, scripts, "lint", ["npm", "run", "lint"]);
+        this.addNodeScriptTask(tasks, scripts, "test", ["npm", "test"], { rejectNoOp: executableBehavior });
+        this.addNodeScriptTask(tasks, scripts, "build", ["npm", "run", "build"]);
+        this.addNodeScriptTask(tasks, scripts, "typecheck", ["npm", "run", "typecheck"]);
+
+        if (scripts.validate && !String(scripts.validate).includes("ai-workflow collect-evidence")) {
+          this.addNodeScriptTask(tasks, scripts, "validate", ["npm", "run", "validate"]);
+        }
+
+        const hasTs = changedFiles.some((file) => /\.(ts|tsx)$/.test(file)) ||
+                      await fs.access(path.join(this.cwd, "tsconfig.json")).then(() => true).catch(() => false);
+        if (hasTs && !scripts.typecheck) {
+          tasks.push({
+            name: "typecheck",
+            command: ["npm", "run", "typecheck"],
+            kind: "typecheck",
+            presetStatus: "FAIL_QUALITY_GATE",
+            summary: "TypeScript detected but no typecheck script is configured."
+          });
+        }
+      } catch {
+        // Fallback or ignore if pkg read fails
+      }
+    }
+
+    // Python Stack Planning
+    if (stacks.includes("python")) {
+      const pythonFiles = changedFiles.filter(f => f.endsWith(".py"));
+
+      // Compiler syntax check for changed python files
+      if (pythonFiles.length > 0) {
+        tasks.push({
+          name: "python-syntax",
+          command: ["python", "-m", "py_compile", ...pythonFiles],
+          kind: "lint"
+        });
+      }
+
+      // Check if testing is needed
+      if (executableBehavior) {
+        // Check if pytest or unittest is configured
+        const hasPytestConfig = await fs.access(path.join(this.cwd, "pytest.ini")).then(() => true).catch(() => false) ||
+                                await fs.access(path.join(this.cwd, "pyproject.toml")).then(() => true).catch(() => false);
+        
+        if (hasPytestConfig || pythonFiles.length > 0) {
+          tasks.push({
+            name: "python-test",
+            command: ["pytest"],
+            kind: "test"
+          });
+        }
+      }
+    }
+
+    // PHP Stack Planning
+    if (stacks.includes("php")) {
+      const phpFiles = changedFiles.filter(f => f.endsWith(".php") || f.endsWith(".inc"));
+
+      // Compiler syntax check for each changed PHP file - split into separate tasks
+      if (phpFiles.length > 0) {
+        for (const file of phpFiles) {
+          tasks.push({
+            name: `php-syntax:${file}`,
+            command: ["php", "-l", file],
+            kind: "lint"
+          });
+        }
+      }
+
+      // Check if testing is needed
+      if (executableBehavior) {
+        const hasPhpUnitXml = await fs.access(path.join(this.cwd, "phpunit.xml")).then(() => true).catch(() => false) ||
+                              await fs.access(path.join(this.cwd, "phpunit.xml.dist")).then(() => true).catch(() => false);
+        if (hasPhpUnitXml || phpFiles.length > 0) {
+          tasks.push({
+            name: "php-test",
+            command: ["vendor/bin/phpunit"],
+            kind: "test"
+          });
+        }
+      }
+    }
+
+    return tasks;
+  }
+
+  addNodeScriptTask(tasks, scripts, name, command, { rejectNoOp = false } = {}) {
+    const script = scripts[name];
+    if (!script) return;
+    if (!rejectNoOp && name === "test" && this.isNoOpScript(script)) return;
+    if (rejectNoOp && this.isNoOpScript(script)) {
+      tasks.push({
+        name,
+        command,
+        kind: name === "test" ? "test" : name,
+        presetStatus: "FAIL_QUALITY_GATE",
+        summary: `Configured ${name} script is a no-op: ${script}`
+      });
+      return;
+    }
+    tasks.push({ name, command, kind: name === "test" ? "test" : name });
+  }
+
+  isNoOpScript(script = "") {
+    const value = String(script).trim().toLowerCase();
+    return /^(echo\b|true$|exit\s+0$|node\s+-e\s+["']?console\.log)/.test(value) || value.includes("tests-pass");
+  }
+}

package/src/core/workspace/read-only-workspace.js

@@ -0,0 +1,119 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import crypto from "node:crypto";
+
+async function copyDirectory(src, dest) {
+  const entries = await fs.readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name === ".git" || entry.name === "node_modules" || entry.name === "tmp") {
+      continue;
+    }
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+
+    if (entry.isDirectory()) {
+      await fs.mkdir(destPath, { recursive: true });
+      await copyDirectory(srcPath, destPath);
+    } else if (entry.isFile()) {
+      await fs.copyFile(srcPath, destPath);
+    }
+  }
+}
+
+async function captureHashSnapshot(dir) {
+  const snapshot = {};
+  await scanDir(dir, dir, snapshot);
+  return snapshot;
+}
+
+async function scanDir(baseDir, currentDir, snapshot) {
+  const entries = await fs.readdir(currentDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name === "opencode.jsonc" || entry.name === "node_modules" || entry.name === ".git" || entry.name === "EVIDENCE.json" || entry.name === "tmp") {
+      continue;
+    }
+    const fullPath = path.join(currentDir, entry.name);
+    const relPath = path.relative(baseDir, fullPath);
+
+    if (entry.isDirectory()) {
+      await scanDir(baseDir, fullPath, snapshot);
+    } else if (entry.isFile()) {
+      try {
+        const content = await fs.readFile(fullPath);
+        const hash = crypto.createHash("sha256").update(content).digest("hex");
+        snapshot[relPath] = hash;
+      } catch {
+        // ignore
+      }
+    }
+  }
+}
+
+/**
+ * Runs a function inside a temporary copy of the workspace.
+ * Mutating the workspace inside this temp directory will trigger a BLOCKED result.
+ */
+export async function runInReadOnlyWorkspace(originalCwd, runFn) {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "opencode-ro-"));
+  
+  try {
+    // 1. Copy repository files recursively (excluding git/node_modules/tmp)
+    await copyDirectory(originalCwd, tempDir);
+
+    // 2. Write the required opencode.jsonc permission config file
+    const opencodeConfig = {
+      permission: {
+        edit: "deny",
+        external_directory: "deny",
+        bash: {
+          "*": "deny",
+          "git status*": "allow",
+          "git diff*": "allow",
+          "git log*": "allow",
+          "grep *": "allow",
+          "find *": "allow"
+        }
+      }
+    };
+    await fs.writeFile(
+      path.join(tempDir, "opencode.jsonc"),
+      JSON.stringify(opencodeConfig, null, 2)
+    );
+
+    // 3. Capture initial file hash snapshot
+    const snapshotBefore = await captureHashSnapshot(tempDir);
+
+    // 4. Execute the callback function inside the temp directory
+    const runResult = await runFn(tempDir);
+
+    // 5. Capture post-run snapshot and verify no file mutations occurred
+    const snapshotAfter = await captureHashSnapshot(tempDir);
+
+    const mutated = [];
+    for (const [file, hash] of Object.entries(snapshotAfter)) {
+      if (snapshotBefore[file] !== hash) {
+        mutated.push(file);
+      }
+    }
+    for (const file of Object.keys(snapshotBefore)) {
+      if (snapshotAfter[file] === undefined) {
+        mutated.push(file);
+      }
+    }
+
+    if (mutated.length > 0) {
+      return {
+        success: false,
+        error: `Read-only confinement violation: mutating changes detected inside temporary workspace: ${mutated.join(", ")}`,
+        commandsRun: runResult.commandsRun || [],
+        eventCount: runResult.eventCount || 0
+      };
+    }
+
+    return runResult;
+  } finally {
+    // 6. Delete the temporary workspace copy
+    await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
+  }
+}