@williambeto/ai-workflow 2.7.1 → 2.8.0

package/chunk-AINIR25D.js

@@ -0,0 +1,120 @@
+// src/core/gates/branch-gate.ts
+import { execSync } from "child_process";
+import fs from "fs";
+import path from "path";
+function slugify(value = "task") {
+  return String(value).toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 48) || "task";
+}
+var BranchGate = class {
+  protectedBranches;
+  logPath;
+  cwd;
+  constructor({ protectedBranches = ["main", "master"], memoryDir, cwd = process.cwd() } = {}) {
+    this.protectedBranches = protectedBranches;
+    this.logPath = memoryDir ? path.join(memoryDir, "GATE_ALERTS.log") : null;
+    this.cwd = cwd;
+  }
+  run(command) {
+    return execSync(command, {
+      cwd: this.cwd,
+      encoding: "utf8",
+      stdio: ["ignore", "pipe", "pipe"]
+    }).trim();
+  }
+  log(event) {
+    if (!this.logPath) return;
+    const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+    const logEntry = `[${timestamp}] ${event}
+`;
+    try {
+      if (!fs.existsSync(path.dirname(this.logPath))) fs.mkdirSync(path.dirname(this.logPath), { recursive: true });
+      fs.appendFileSync(this.logPath, logEntry);
+    } catch (error) {
+      console.error(`Failed to write to gate log: ${error.message}`);
+    }
+  }
+  getDirtyState() {
+    const lines = this.run("git status --short").split("\n").filter(Boolean);
+    const tracked = lines.filter((line) => !line.startsWith("??"));
+    const untracked = lines.filter((line) => line.startsWith("??"));
+    return { clean: lines.length === 0, tracked, untracked, lines };
+  }
+  createScopedBranch(taskSlug) {
+    const base = `feat/${slugify(taskSlug)}`;
+    let candidate = base;
+    let suffix = 2;
+    while (true) {
+      try {
+        this.run(`git show-ref --verify --quiet refs/heads/${candidate}`);
+        candidate = `${base}-${suffix++}`;
+      } catch {
+        break;
+      }
+    }
+    this.run(`git switch -c ${candidate}`);
+    return candidate;
+  }
+  getCurrentBranch() {
+    try {
+      return this.run("git branch --show-current") || this.run("git symbolic-ref --short HEAD") || "unknown";
+    } catch {
+      try {
+        return this.run("git symbolic-ref --short HEAD") || "unknown";
+      } catch {
+        return "unknown";
+      }
+    }
+  }
+  /**
+   * Strictly verifies branch safety without any override bypasses.
+   */
+  check(overrideIgnored = "", { taskSlug = "implementation", readOnly = false } = {}) {
+    if (readOnly) {
+      const currentBranch = this.getCurrentBranch();
+      return { blocked: false, branch: currentBranch, recovered: false, readOnly: true };
+    }
+    try {
+      try {
+        this.run("git rev-parse --is-inside-work-tree");
+      } catch (e) {
+        const reason = "Git is unavailable or not inside a Git repository. Implementation work is blocked.";
+        this.log(`BLOCKED: ${reason}`);
+        return { blocked: true, branch: "unknown", reason };
+      }
+      const currentBranch = this.getCurrentBranch();
+      if (!currentBranch || currentBranch === "unknown" || currentBranch.trim() === "") {
+        const reason = "Could not determine current Git branch name. Implementation work is blocked.";
+        this.log(`BLOCKED: ${reason}`);
+        return { blocked: true, branch: "unknown", reason };
+      }
+      const isProtected = this.protectedBranches.includes(currentBranch);
+      if (!isProtected) {
+        return { blocked: false, branch: currentBranch, recovered: false };
+      }
+      const dirty = this.getDirtyState();
+      if (!dirty.clean) {
+        const reason = `Direct writes to protected branch '${currentBranch}' are prohibited and the branch is dirty (has changes).`;
+        this.log(`BLOCKED: ${reason}`);
+        return { blocked: true, branch: currentBranch, reason, dirtyState: dirty };
+      }
+      const recoveredBranch = this.createScopedBranch(taskSlug);
+      this.log(`AUTO-RECOVERED '${currentBranch}' -> '${recoveredBranch}'`);
+      return {
+        blocked: false,
+        branch: recoveredBranch,
+        branchBefore: currentBranch,
+        recovered: true,
+        dirtyState: dirty
+      };
+    } catch (error) {
+      const reason = `Git command failure on branch gate check: ${error.message}`;
+      this.log(`BLOCKED: ${reason}`);
+      return { blocked: true, branch: "unknown", error: error.message, reason, recovered: false };
+    }
+  }
+};
+
+export {
+  BranchGate
+};
+//# sourceMappingURL=chunk-AINIR25D.js.map

package/chunk-AY33SA5W.js

@@ -0,0 +1,46 @@
+// src/core/backup.ts
+import fs from "fs/promises";
+import path from "path";
+function escapeRelativePath(relativePath) {
+  return relativePath.replace(/[\\/]/g, "__");
+}
+async function createManagedBackup(filePath, { cwd, backupRoot, maxPerFile = 20 }) {
+  const relativePath = path.relative(cwd, filePath);
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupName = `${escapeRelativePath(relativePath)}.${stamp}.bak`;
+  const absoluteBackupRoot = path.join(cwd, backupRoot);
+  const backupPath = path.join(absoluteBackupRoot, backupName);
+  await fs.mkdir(absoluteBackupRoot, { recursive: true });
+  await fs.copyFile(filePath, backupPath);
+  const prefix = `${escapeRelativePath(relativePath)}.`;
+  const entries = await fs.readdir(absoluteBackupRoot);
+  const matching = entries.filter((entry) => entry.startsWith(prefix) && entry.endsWith(".bak")).sort();
+  if (matching.length > maxPerFile) {
+    const excess = matching.slice(0, matching.length - maxPerFile);
+    await Promise.all(excess.map((entry) => fs.unlink(path.join(absoluteBackupRoot, entry))));
+  }
+  return backupPath;
+}
+async function createManagedPathBackup(targetPath, { cwd, backupRoot, maxPerFile = 20 }) {
+  const relativePath = path.relative(cwd, targetPath);
+  const stamp = (/* @__PURE__ */ new Date()).toISOString().replace(/[:.]/g, "-");
+  const backupName = `${escapeRelativePath(relativePath)}.${stamp}.bak`;
+  const absoluteBackupRoot = path.join(cwd, backupRoot);
+  const backupPath = path.join(absoluteBackupRoot, backupName);
+  await fs.mkdir(absoluteBackupRoot, { recursive: true });
+  await fs.rename(targetPath, backupPath);
+  const prefix = `${escapeRelativePath(relativePath)}.`;
+  const entries = await fs.readdir(absoluteBackupRoot);
+  const matching = entries.filter((entry) => entry.startsWith(prefix) && entry.endsWith(".bak")).sort();
+  if (matching.length > maxPerFile) {
+    const excess = matching.slice(0, matching.length - maxPerFile);
+    await Promise.all(excess.map((entry) => fs.rm(path.join(absoluteBackupRoot, entry), { recursive: true, force: true })));
+  }
+  return backupPath;
+}
+
+export {
+  createManagedBackup,
+  createManagedPathBackup
+};
+//# sourceMappingURL=chunk-AY33SA5W.js.map

package/{evidence-validator-76ZQQYDU.js → chunk-FNT7DN3N.js}

@@ -6552,10 +6552,12 @@ var EvidenceValidator = class {
   cwd;
   skipFileCheck;
   skipGitCheck;
-  constructor({ cwd = process.cwd(), skipFileCheck = false, skipGitCheck = false } = {}) {
+  requireWorkflowEvidence;
+  constructor({ cwd = process.cwd(), skipFileCheck = false, skipGitCheck = false, requireWorkflowEvidence = false } = {}) {
     this.cwd = cwd;
     this.skipFileCheck = skipFileCheck;
     this.skipGitCheck = skipGitCheck;
+    this.requireWorkflowEvidence = requireWorkflowEvidence;
   }
   async validate() {
     const evidencePath = path.join(this.cwd, "EVIDENCE.json");
@@ -6595,6 +6597,21 @@ var EvidenceValidator = class {
     } catch (e) {
       return { valid: false, reason: `Evidence schema validation failed: ${e.message}` };
     }
+    if (this.requireWorkflowEvidence) {
+      const phases = evidence.phaseOrder || [];
+      const actors = evidence.confirmedActors || [];
+      const hashes = evidence.artifactHashes || {};
+      if (!evidence.workflowId || !evidence.baseSha || !hashes.approved || !hashes.technicalPlan) {
+        return { valid: false, reason: "Required executable SDD evidence fields are missing." };
+      }
+      if (phases.join(",") !== "specification,planning,implementation" && phases.join(",") !== "planning,implementation") {
+        return { valid: false, reason: "Executable SDD phase order is invalid." };
+      }
+      const expectedActors = phases.map((phase) => phase === "specification" ? "Nexus" : phase === "planning" ? "Orion" : "Astra");
+      if (actors.length !== expectedActors.length || actors.some((actor, index) => actor.requested !== expectedActors[index] || actor.applied !== expectedActors[index])) {
+        return { valid: false, reason: "Executable SDD confirmed actor evidence is incomplete or out of order." };
+      }
+    }
     const changedFiles = evidence.changedFiles || [];
     const resolvedCwd = path.resolve(this.cwd);
     for (const file of changedFiles) {
@@ -6655,7 +6672,10 @@ var EvidenceValidator = class {
     return { valid: true };
   }
 };
+
 export {
+  require_codegen,
+  require_ajv,
   EvidenceValidator
 };
-//# sourceMappingURL=evidence-validator-76ZQQYDU.js.map
+//# sourceMappingURL=chunk-FNT7DN3N.js.map