@williambeto/ai-workflow 2.2.7 → 2.3.1

package/src/core/validation/validation-planner.js

@@ -0,0 +1,134 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import { StackDetector } from "./stack-detector.js";
+
+export class ValidationPlanner {
+  constructor({ cwd = process.cwd(), qualityGuard } = {}) {
+    this.cwd = cwd;
+    this.qualityGuard = qualityGuard;
+    this.stackDetector = new StackDetector({ cwd });
+  }
+
+  async plan(profile = "generic") {
+    const stacks = await this.stackDetector.detect();
+    const tasks = [];
+
+    const changedFiles = this.qualityGuard.getChangedFiles().filter((file) => {
+      return !/(^|\/)(node_modules|vendor|dist|coverage|\.cache)(\/|$)/.test(String(file).replaceAll("\\", "/"));
+    });
+    const executableBehavior = await this.qualityGuard.hasExecutableBehaviorChanges();
+
+    // Node Stack Planning
+    if (stacks.includes("node")) {
+      try {
+        const pkg = JSON.parse(await fs.readFile(path.join(this.cwd, "package.json"), "utf8"));
+        const scripts = pkg.scripts || {};
+
+        this.addNodeScriptTask(tasks, scripts, "lint", ["npm", "run", "lint"]);
+        this.addNodeScriptTask(tasks, scripts, "test", ["npm", "test"], { rejectNoOp: executableBehavior });
+        this.addNodeScriptTask(tasks, scripts, "build", ["npm", "run", "build"]);
+        this.addNodeScriptTask(tasks, scripts, "typecheck", ["npm", "run", "typecheck"]);
+
+        if (scripts.validate && !String(scripts.validate).includes("ai-workflow collect-evidence")) {
+          this.addNodeScriptTask(tasks, scripts, "validate", ["npm", "run", "validate"]);
+        }
+
+        const hasTs = changedFiles.some((file) => /\.(ts|tsx)$/.test(file)) ||
+                      await fs.access(path.join(this.cwd, "tsconfig.json")).then(() => true).catch(() => false);
+        if (hasTs && !scripts.typecheck) {
+          tasks.push({
+            name: "typecheck",
+            command: ["npm", "run", "typecheck"],
+            kind: "typecheck",
+            presetStatus: "FAIL_QUALITY_GATE",
+            summary: "TypeScript detected but no typecheck script is configured."
+          });
+        }
+      } catch {
+        // Fallback or ignore if pkg read fails
+      }
+    }
+
+    // Python Stack Planning
+    if (stacks.includes("python")) {
+      const pythonFiles = changedFiles.filter(f => f.endsWith(".py"));
+
+      // Compiler syntax check for changed python files
+      if (pythonFiles.length > 0) {
+        tasks.push({
+          name: "python-syntax",
+          command: ["python", "-m", "py_compile", ...pythonFiles],
+          kind: "lint"
+        });
+      }
+
+      // Check if testing is needed
+      if (executableBehavior) {
+        // Check if pytest or unittest is configured
+        const hasPytestConfig = await fs.access(path.join(this.cwd, "pytest.ini")).then(() => true).catch(() => false) ||
+                                await fs.access(path.join(this.cwd, "pyproject.toml")).then(() => true).catch(() => false);
+        
+        if (hasPytestConfig || pythonFiles.length > 0) {
+          tasks.push({
+            name: "python-test",
+            command: ["pytest"],
+            kind: "test"
+          });
+        }
+      }
+    }
+
+    // PHP Stack Planning
+    if (stacks.includes("php")) {
+      const phpFiles = changedFiles.filter(f => f.endsWith(".php") || f.endsWith(".inc"));
+
+      // Compiler syntax check for each changed PHP file - split into separate tasks
+      if (phpFiles.length > 0) {
+        for (const file of phpFiles) {
+          tasks.push({
+            name: `php-syntax:${file}`,
+            command: ["php", "-l", file],
+            kind: "lint"
+          });
+        }
+      }
+
+      // Check if testing is needed
+      if (executableBehavior) {
+        const hasPhpUnitXml = await fs.access(path.join(this.cwd, "phpunit.xml")).then(() => true).catch(() => false) ||
+                              await fs.access(path.join(this.cwd, "phpunit.xml.dist")).then(() => true).catch(() => false);
+        if (hasPhpUnitXml || phpFiles.length > 0) {
+          tasks.push({
+            name: "php-test",
+            command: ["vendor/bin/phpunit"],
+            kind: "test"
+          });
+        }
+      }
+    }
+
+    return tasks;
+  }
+
+  addNodeScriptTask(tasks, scripts, name, command, { rejectNoOp = false } = {}) {
+    const script = scripts[name];
+    if (!script) return;
+    if (!rejectNoOp && name === "test" && this.isNoOpScript(script)) return;
+    if (rejectNoOp && this.isNoOpScript(script)) {
+      tasks.push({
+        name,
+        command,
+        kind: name === "test" ? "test" : name,
+        presetStatus: "FAIL_QUALITY_GATE",
+        summary: `Configured ${name} script is a no-op: ${script}`
+      });
+      return;
+    }
+    tasks.push({ name, command, kind: name === "test" ? "test" : name });
+  }
+
+  isNoOpScript(script = "") {
+    const value = String(script).trim().toLowerCase();
+    return /^(echo\b|true$|exit\s+0$|node\s+-e\s+["']?console\.log)/.test(value) || value.includes("tests-pass");
+  }
+}

package/src/core/workspace/read-only-workspace.js

@@ -0,0 +1,119 @@
+import fs from "node:fs/promises";
+import path from "node:path";
+import os from "node:os";
+import crypto from "node:crypto";
+
+async function copyDirectory(src, dest) {
+  const entries = await fs.readdir(src, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name === ".git" || entry.name === "node_modules" || entry.name === "tmp") {
+      continue;
+    }
+    const srcPath = path.join(src, entry.name);
+    const destPath = path.join(dest, entry.name);
+
+    if (entry.isDirectory()) {
+      await fs.mkdir(destPath, { recursive: true });
+      await copyDirectory(srcPath, destPath);
+    } else if (entry.isFile()) {
+      await fs.copyFile(srcPath, destPath);
+    }
+  }
+}
+
+async function captureHashSnapshot(dir) {
+  const snapshot = {};
+  await scanDir(dir, dir, snapshot);
+  return snapshot;
+}
+
+async function scanDir(baseDir, currentDir, snapshot) {
+  const entries = await fs.readdir(currentDir, { withFileTypes: true });
+  for (const entry of entries) {
+    if (entry.name === "opencode.jsonc" || entry.name === "node_modules" || entry.name === ".git" || entry.name === "EVIDENCE.json" || entry.name === "tmp") {
+      continue;
+    }
+    const fullPath = path.join(currentDir, entry.name);
+    const relPath = path.relative(baseDir, fullPath);
+
+    if (entry.isDirectory()) {
+      await scanDir(baseDir, fullPath, snapshot);
+    } else if (entry.isFile()) {
+      try {
+        const content = await fs.readFile(fullPath);
+        const hash = crypto.createHash("sha256").update(content).digest("hex");
+        snapshot[relPath] = hash;
+      } catch {
+        // ignore
+      }
+    }
+  }
+}
+
+/**
+ * Runs a function inside a temporary copy of the workspace.
+ * Mutating the workspace inside this temp directory will trigger a BLOCKED result.
+ */
+export async function runInReadOnlyWorkspace(originalCwd, runFn) {
+  const tempDir = await fs.mkdtemp(path.join(os.tmpdir(), "opencode-ro-"));
+  
+  try {
+    // 1. Copy repository files recursively (excluding git/node_modules/tmp)
+    await copyDirectory(originalCwd, tempDir);
+
+    // 2. Write the required opencode.jsonc permission config file
+    const opencodeConfig = {
+      permission: {
+        edit: "deny",
+        external_directory: "deny",
+        bash: {
+          "*": "deny",
+          "git status*": "allow",
+          "git diff*": "allow",
+          "git log*": "allow",
+          "grep *": "allow",
+          "find *": "allow"
+        }
+      }
+    };
+    await fs.writeFile(
+      path.join(tempDir, "opencode.jsonc"),
+      JSON.stringify(opencodeConfig, null, 2)
+    );
+
+    // 3. Capture initial file hash snapshot
+    const snapshotBefore = await captureHashSnapshot(tempDir);
+
+    // 4. Execute the callback function inside the temp directory
+    const runResult = await runFn(tempDir);
+
+    // 5. Capture post-run snapshot and verify no file mutations occurred
+    const snapshotAfter = await captureHashSnapshot(tempDir);
+
+    const mutated = [];
+    for (const [file, hash] of Object.entries(snapshotAfter)) {
+      if (snapshotBefore[file] !== hash) {
+        mutated.push(file);
+      }
+    }
+    for (const file of Object.keys(snapshotBefore)) {
+      if (snapshotAfter[file] === undefined) {
+        mutated.push(file);
+      }
+    }
+
+    if (mutated.length > 0) {
+      return {
+        success: false,
+        error: `Read-only confinement violation: mutating changes detected inside temporary workspace: ${mutated.join(", ")}`,
+        commandsRun: runResult.commandsRun || [],
+        eventCount: runResult.eventCount || 0
+      };
+    }
+
+    return runResult;
+  } finally {
+    // 6. Delete the temporary workspace copy
+    await fs.rm(tempDir, { recursive: true, force: true }).catch(() => {});
+  }
+}