agentic-workflow-manager 9.2.1 → 9.4.0

package/dist/src/core/currentness/check.js

@@ -0,0 +1,224 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.checkCurrentness = checkCurrentness;
+exports.sanitizeSource = sanitizeSource;
+const child_process_1 = require("child_process");
+const util_1 = require("util");
+const cli_version_1 = require("../cli-version");
+const registries_1 = require("../registries");
+const config_1 = require("../../utils/config");
+const execFileAsync = (0, util_1.promisify)(child_process_1.execFile);
+const TIMEOUT_MS = 2_000;
+const MAX_OUTPUT_BYTES = 64 * 1024;
+const NPM_SOURCE = `https://registry.npmjs.org/${cli_version_1.CLI_PACKAGE_NAME}`;
+const STRICT_SEMVER = /^v?(0|[1-9]\d*)\.(0|[1-9]\d*)\.(0|[1-9]\d*)$/;
+function deadline(operation, timeoutMs = TIMEOUT_MS) {
+    let timer;
+    const timeout = new Promise((_resolve, reject) => {
+        timer = setTimeout(() => reject(new Error('currentness transport timed out')), timeoutMs);
+    });
+    return Promise.race([operation, timeout]).finally(() => {
+        if (timer)
+            clearTimeout(timer);
+    });
+}
+function bounded(value, limit = 512) {
+    return value.length <= limit ? value : `${value.slice(0, limit - 1)}…`;
+}
+function authoritativeSource(value) {
+    try {
+        const url = new URL(value);
+        // HTTPS userinfo is a credential-bearing transport URL. Reject it before
+        // constructing any Git argv, rather than merely redacting it for output.
+        if (url.protocol === 'https:' && url.hostname && !url.username && !url.password && !url.search && !url.hash) {
+            return bounded(`https://${url.host}${url.pathname}`);
+        }
+        if (url.protocol === 'ssh:' && url.hostname && !url.password && !url.search && !url.hash) {
+            return bounded(`ssh://${url.host}${url.pathname}`);
+        }
+        return null;
+    }
+    catch {
+        // SCP-style Git remotes have no URL parser representation. Permit only an
+        // intentionally narrow grammar and remove the optional userinfo; all other
+        // schemes fail closed.
+        const match = /^(?:[A-Za-z0-9._-]+@)?([A-Za-z0-9.-]+):([A-Za-z0-9._/-]+)$/.exec(value);
+        return match
+            ? bounded(`${match[1]}:${match[2]}`)
+            : null;
+    }
+}
+function sanitizeSource(value) {
+    return authoritativeSource(value) ?? '[configured remote]';
+}
+function parseVersion(value) {
+    const match = STRICT_SEMVER.exec(value.trim());
+    if (!match)
+        return null;
+    return [match[1], match[2], match[3]];
+}
+function compareNumericIdentifier(a, b) {
+    if (a.length !== b.length)
+        return a.length < b.length ? -1 : 1;
+    return a < b ? -1 : a > b ? 1 : 0;
+}
+function compareStrict(a, b) {
+    const av = parseVersion(a);
+    const bv = parseVersion(b);
+    if (!av || !bv)
+        return null;
+    return compareNumericIdentifier(av[0], bv[0])
+        || compareNumericIdentifier(av[1], bv[1])
+        || compareNumericIdentifier(av[2], bv[2]);
+}
+function iso(now) {
+    const value = now();
+    if (!Number.isFinite(value))
+        throw new Error('currentness clock must return a finite timestamp');
+    return new Date(value).toISOString();
+}
+const defaultGit = async (cwd, args, options) => {
+    const result = await execFileAsync('git', args, {
+        cwd,
+        timeout: options.timeoutMs,
+        maxBuffer: options.maxOutputBytes,
+        windowsHide: true,
+    });
+    return result.stdout;
+};
+function unavailable(component, source, checkedAt, installed, pin) {
+    return {
+        component, installed, latest: null, channel: 'stable', source, ...(pin ? { pin } : {}), checkedAt,
+        status: 'unverifiable', detail: 'Authoritative currentness could not be verified.',
+        remedy: 'Restore source access and rerun strict preflight.',
+    };
+}
+async function latestCli(fetchImpl) {
+    const controller = new AbortController();
+    const timer = setTimeout(() => controller.abort(), TIMEOUT_MS);
+    try {
+        const response = await deadline(fetchImpl(NPM_SOURCE, { signal: controller.signal }));
+        if (!response.ok)
+            return null;
+        const text = await deadline(response.text());
+        if (Buffer.byteLength(text, 'utf8') > MAX_OUTPUT_BYTES)
+            return null;
+        const body = JSON.parse(text);
+        if (!body || typeof body !== 'object')
+            return null;
+        const tags = body['dist-tags'];
+        const latest = tags && typeof tags === 'object' ? tags.latest : undefined;
+        return typeof latest === 'string' && parseVersion(latest) ? latest : null;
+    }
+    catch {
+        return null;
+    }
+    finally {
+        clearTimeout(timer);
+    }
+}
+function latestStableTag(output) {
+    if (Buffer.byteLength(output, 'utf8') > MAX_OUTPUT_BYTES)
+        return null;
+    const tags = new Map();
+    for (const line of output.split(/\r?\n/)) {
+        const match = /^([0-9a-fA-F]{40,64})\trefs\/tags\/(v?\d+\.\d+\.\d+)(\^\{\})?$/.exec(line);
+        if (!match)
+            continue;
+        const tag = tags.get(match[2]) ?? { sha: '' };
+        if (match[3])
+            tag.peeled = match[1];
+        else
+            tag.sha = match[1];
+        tags.set(match[2], tag);
+    }
+    let latest = null;
+    for (const [tag, ref] of tags) {
+        if (!ref.sha)
+            continue;
+        if (!latest || (compareStrict(tag, latest.tag) ?? -1) > 0)
+            latest = { sha: ref.peeled ?? ref.sha, tag };
+    }
+    return latest;
+}
+async function registryComponent(registry, git, prefs, checkedAt) {
+    const authorizedSource = authoritativeSource(registry.remote);
+    const source = authorizedSource ?? '[configured remote]';
+    const pin = prefs.pins?.[registry.name];
+    if (!authorizedSource)
+        return unavailable(`registry:${registry.name}`, source, checkedAt, null, pin);
+    let origin;
+    let head;
+    let exactTag;
+    let remoteTags;
+    try {
+        [origin, head, exactTag, remoteTags] = await Promise.all([
+            deadline(git(registry.contentRoot, ['remote', 'get-url', 'origin'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+            deadline(git(registry.contentRoot, ['rev-parse', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+            deadline(git(registry.contentRoot, ['describe', '--tags', '--exact-match', 'HEAD'], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+            deadline(git(registry.contentRoot, ['ls-remote', '--tags', registry.remote], { timeoutMs: TIMEOUT_MS, maxOutputBytes: MAX_OUTPUT_BYTES })),
+        ]);
+    }
+    catch {
+        return unavailable(`registry:${registry.name}`, source, checkedAt, null, pin);
+    }
+    const installed = exactTag.trim();
+    const latest = latestStableTag(remoteTags);
+    const localHead = head.trim();
+    const installedVersion = parseVersion(installed);
+    if (!installedVersion || !latest || !/^[0-9a-fA-F]{40,64}$/.test(localHead) || origin.trim() !== registry.remote) {
+        return unavailable(`registry:${registry.name}`, source, checkedAt, installedVersion ? installed : null, pin);
+    }
+    const relation = compareStrict(installed, latest.tag);
+    if (relation === null)
+        return unavailable(`registry:${registry.name}`, source, checkedAt, installed, pin);
+    if (relation === 0 && localHead === latest.sha) {
+        return { component: `registry:${registry.name}`, installed, latest: latest.tag, channel: 'stable', source, ...(pin ? { pin } : {}), checkedAt, status: 'current', detail: 'Exact stable tag and configured origin match the authoritative remote.', remedy: 'No action required.' };
+    }
+    if (relation < 0) {
+        return {
+            component: `registry:${registry.name}`, installed, latest: latest.tag, channel: 'stable', source, ...(pin ? { pin } : {}), checkedAt,
+            status: pin ? 'pinned-behind' : 'stale', detail: 'Installed stable tag is behind the authoritative remote.',
+            remedy: pin ? `awm unpin ${registry.name} && awm update --yes` : 'awm update --yes',
+        };
+    }
+    return unavailable(`registry:${registry.name}`, source, checkedAt, installed, pin);
+}
+/** Strict, read-only remote currentness check. It intentionally never reads/writes update cache. */
+async function checkCurrentness(cwd, deps = {}) {
+    if (!cwd || typeof cwd !== 'string')
+        throw new Error('currentness cwd must be a non-empty string');
+    const now = deps.now ?? Date.now;
+    const checkedAt = iso(now);
+    const getCliVersion = deps.cliVersion ?? cli_version_1.cliVersion;
+    const fetchImpl = deps.fetch ?? fetch;
+    const git = deps.git ?? defaultGit;
+    const preferences = (deps.readPreferences ?? config_1.readPreferences)();
+    const installedCli = getCliVersion();
+    const latest = await latestCli(fetchImpl);
+    const cli = !parseVersion(installedCli) || !latest || compareStrict(installedCli, latest) === null
+        ? unavailable('cli', NPM_SOURCE, checkedAt, parseVersion(installedCli) ? installedCli : null)
+        : compareStrict(installedCli, latest) === 0
+            ? { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'current', detail: 'Installed version equals npm dist-tags.latest.', remedy: 'No action required.' }
+            : { component: 'cli', installed: installedCli, latest, channel: 'stable', source: NPM_SOURCE, checkedAt, status: 'stale', detail: 'Installed version is behind npm dist-tags.latest.', remedy: `npm i -g ${cli_version_1.CLI_PACKAGE_NAME}@latest && rerun in a fresh process` };
+    const components = [cli];
+    let registries;
+    try {
+        registries = (deps.listRegistries ?? registries_1.listRegistries)();
+        if (!Array.isArray(registries))
+            throw new Error('currentness registry inventory must be an array');
+    }
+    catch {
+        components.push({
+            ...unavailable('registry:inventory', '[configured registry inventory]', checkedAt, null),
+            remedy: 'Repair the local registry inventory and rerun strict preflight.',
+        });
+        return { checkedAt, components, compatibility: { status: 'not-checked' } };
+    }
+    if (registries.length === 0)
+        components.push(unavailable('registry:none', '[configured remote]', checkedAt, null));
+    else
+        for (const registry of registries)
+            components.push(await registryComponent(registry, git, preferences, checkedAt));
+    return { checkedAt, components, compatibility: { status: 'not-checked' } };
+}

package/dist/src/core/currentness/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });

package/dist/src/core/plan/json.js

@@ -0,0 +1,111 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.parseJsonNoDuplicate = parseJsonNoDuplicate;
+/** Parses JSON after rejecting duplicate object keys without runtime dependencies. */
+function parseJsonNoDuplicate(text) {
+    if (typeof text !== 'string')
+        throw new Error('JSON input must be a string');
+    let index = 0;
+    const fail = (message) => { throw new Error(`invalid JSON: ${message}`); };
+    const whitespace = () => { while (/\s/.test(text[index] ?? ''))
+        index++; };
+    const string = () => {
+        if (text[index++] !== '"')
+            fail('expected string');
+        let out = '';
+        while (index < text.length) {
+            const char = text[index++];
+            if (char === '"')
+                return out;
+            if (char === '\\') {
+                const escape = text[index++];
+                if (!escape)
+                    fail('unterminated escape');
+                if (escape === 'u') {
+                    const hex = text.slice(index, index + 4);
+                    if (!/^[0-9a-fA-F]{4}$/.test(hex))
+                        fail('invalid unicode escape');
+                    out += String.fromCharCode(Number.parseInt(hex, 16));
+                    index += 4;
+                }
+                else {
+                    const decoded = { '"': '"', '\\': '\\', '/': '/', b: '\b', f: '\f', n: '\n', r: '\r', t: '\t' };
+                    if (!(escape in decoded))
+                        fail('invalid escape');
+                    out += decoded[escape];
+                }
+            }
+            else {
+                if (char < ' ')
+                    fail('control character in string');
+                out += char;
+            }
+        }
+        return fail('unterminated string');
+    };
+    const value = () => {
+        whitespace();
+        const char = text[index];
+        if (char === '"') {
+            string();
+            return;
+        }
+        if (char === '{') {
+            object();
+            return;
+        }
+        if (char === '[') {
+            array();
+            return;
+        }
+        if (text.startsWith('true', index) || text.startsWith('false', index) || text.startsWith('null', index)) {
+            index += text.startsWith('true', index) ? 4 : text.startsWith('false', index) ? 5 : 4;
+            return;
+        }
+        const match = text.slice(index).match(/^-?(?:0|[1-9]\d*)(?:\.\d+)?(?:[eE][+-]?\d+)?/);
+        if (!match)
+            return fail('expected value');
+        index += match[0].length;
+    };
+    const array = () => { index++; whitespace(); if (text[index] === ']') {
+        index++;
+        return;
+    } while (true) {
+        value();
+        whitespace();
+        if (text[index] === ']') {
+            index++;
+            return;
+        }
+        if (text[index++] !== ',')
+            fail('expected comma');
+    } };
+    const object = () => { index++; const keys = new Set(); whitespace(); if (text[index] === '}') {
+        index++;
+        return;
+    } while (true) {
+        whitespace();
+        if (text[index] !== '"')
+            fail('expected object key');
+        const key = string();
+        if (keys.has(key))
+            fail(`duplicate key ${JSON.stringify(key)}`);
+        keys.add(key);
+        whitespace();
+        if (text[index++] !== ':')
+            fail('expected colon');
+        value();
+        whitespace();
+        if (text[index] === '}') {
+            index++;
+            return;
+        }
+        if (text[index++] !== ',')
+            fail('expected comma');
+    } };
+    value();
+    whitespace();
+    if (index !== text.length)
+        fail('trailing content');
+    return JSON.parse(text);
+}

package/dist/src/core/plan/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });