agentic-workflow-manager 9.21.0 → 9.22.1

package/dist/src/commands/sensors/prepare.js

@@ -33,9 +33,19 @@ function validateRunOptions(opts) {
         throw new Error('run option base must be a nonempty string');
     if (opts.readOnly !== undefined && typeof opts.readOnly !== 'boolean')
         throw new Error('run option readOnly must be a boolean');
+    if (opts.slice !== undefined && typeof opts.slice !== 'boolean')
+        throw new Error('run option slice must be a boolean');
+    if (opts.useCache !== undefined && typeof opts.useCache !== 'boolean')
+        throw new Error('run option useCache must be a boolean');
     if (opts.changed && opts.ignoreBaseline) {
         throw new Error('refusing to combine --changed with a baseline capture: a partial run cannot define the accepted set');
     }
+    if (opts.slice && opts.all) {
+        throw new Error('refusing to combine --slice with --all: slice already selects the non-closureOnly set');
+    }
+    if (opts.slice && opts.slow) {
+        throw new Error('refusing to combine --slice with --slow: use a full gate for closureOnly/slow sensors');
+    }
 }
 /** Expand the one declared file placeholder into literal structured argv entries. */
 function expandFileInput(command, files) {

package/dist/src/commands/sensors/result-cache.js

@@ -0,0 +1,278 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.cacheFileName = cacheFileName;
+exports.canCacheRawResult = canCacheRawResult;
+exports.computeSensorFingerprint = computeSensorFingerprint;
+exports.toCacheRaw = toCacheRaw;
+exports.writeResultCache = writeResultCache;
+exports.readResultCache = readResultCache;
+const crypto_1 = __importDefault(require("crypto"));
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const atomic_file_1 = require("../../core/atomic-file");
+const text_safety_1 = require("../../core/changes/text-safety");
+const MAX_CACHE_BYTES = 1024 * 1024;
+const CACHE_SCHEMA = 1;
+function runsDir(root) {
+    return path_1.default.join(root, '.awm', 'sensors', 'runs');
+}
+function assertNoSymlinkChain(root) {
+    let current = root;
+    for (const segment of ['.awm', 'sensors', 'runs']) {
+        current = path_1.default.join(current, segment);
+        try {
+            if (fs_1.default.lstatSync(current).isSymbolicLink())
+                throw new Error(`refusing to use symlinked path ${(0, text_safety_1.esc)(current)}`);
+        }
+        catch (error) {
+            if (error.code === 'ENOENT')
+                return;
+            throw error;
+        }
+    }
+}
+function ensureRunsIgnore(root) {
+    const file = path_1.default.join(runsDir(root), '.gitignore');
+    try {
+        const stat = fs_1.default.lstatSync(file);
+        if (stat.isFile() && fs_1.default.readFileSync(file, 'utf8') === '*\n')
+            return;
+    }
+    catch (error) {
+        if (error.code !== 'ENOENT')
+            throw error;
+    }
+    (0, atomic_file_1.writeFileAtomic)(file, '*\n', 0o644);
+}
+function cacheKeyHash(lookup) {
+    return crypto_1.default.createHash('sha256')
+        .update([lookup.projectKey, lookup.sensorId, lookup.sensorFingerprint, lookup.inputDigest].join('\0'))
+        .digest('hex');
+}
+function cacheFileName(lookup) {
+    return `cache-${cacheKeyHash(lookup)}.json`;
+}
+/** RF-2.4: store only clean pass, or fail+findings with errors.length > 0 (and not incomplete). */
+function canCacheRawResult(result) {
+    if (!result || typeof result !== 'object')
+        return false;
+    if (result.incomplete)
+        return false;
+    if (!Array.isArray(result.errors))
+        return false;
+    if (result.status === 'pass') {
+        // Planted pass+errors / pass+failureKind must never cache (or read as a hit).
+        return result.errors.length === 0 && result.failureKind === undefined;
+    }
+    if (result.status !== 'fail')
+        return false;
+    if (result.failureKind !== 'findings')
+        return false;
+    return result.errors.length > 0;
+}
+function computeSensorFingerprint(parts, opts) {
+    if (!parts || typeof parts !== 'object')
+        throw new Error('fingerprint parts must be an object');
+    if (typeof parts.cliVersion !== 'string' || parts.cliVersion.length === 0)
+        throw new Error('cliVersion must be a nonempty string');
+    if (!Array.isArray(parts.inputs) || parts.inputs.some((g) => typeof g !== 'string'))
+        throw new Error('inputs must be string[]');
+    const allowMissing = opts?.allowMissingLiveVersions === true;
+    const toolOk = typeof parts.toolVersion === 'string' && parts.toolVersion.length > 0;
+    const runtimeOk = typeof parts.runtimeVersion === 'string' && parts.runtimeVersion.length > 0;
+    if (!allowMissing && (!toolOk || !runtimeOk))
+        return null;
+    const canonical = JSON.stringify({
+        variantId: parts.variantId,
+        command: parts.command,
+        changedCommand: parts.changedCommand ?? null,
+        cliVersion: parts.cliVersion,
+        inputs: [...parts.inputs].sort(),
+        toolVersion: toolOk ? parts.toolVersion : null,
+        runtimeVersion: runtimeOk ? parts.runtimeVersion : null,
+    });
+    return `sha256:${crypto_1.default.createHash('sha256').update(canonical).digest('hex')}`;
+}
+function isSensorError(value) {
+    if (value === null || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const e = value;
+    if (typeof e.message !== 'string' || !(0, text_safety_1.isSingleLine)(e.message))
+        return false;
+    if (e.file !== undefined && (typeof e.file !== 'string' || !(0, text_safety_1.isSingleLine)(e.file)))
+        return false;
+    if (e.line !== undefined && (!Number.isSafeInteger(e.line) || e.line < 0))
+        return false;
+    if (e.column !== undefined && (!Number.isSafeInteger(e.column) || e.column < 0))
+        return false;
+    if (e.rule !== undefined && typeof e.rule !== 'string')
+        return false;
+    return true;
+}
+function validateRaw(raw) {
+    if (raw === null || typeof raw !== 'object' || Array.isArray(raw))
+        return 'raw must be an object';
+    const r = raw;
+    if (typeof r.name !== 'string' || r.name.length === 0)
+        return 'raw.name invalid';
+    if (r.status !== 'pass' && r.status !== 'fail')
+        return 'raw.status invalid';
+    if (!Array.isArray(r.errors) || !r.errors.every(isSensorError))
+        return 'raw.errors invalid';
+    if (r.failureKind !== undefined
+        && r.failureKind !== 'findings'
+        && r.failureKind !== 'missing-binary'
+        && r.failureKind !== 'exit-code')
+        return 'raw.failureKind invalid';
+    if (r.status === 'pass') {
+        if (r.errors.length !== 0)
+            return 'raw.pass must have errors.length===0';
+        if (r.failureKind !== undefined)
+            return 'raw.pass must not carry failureKind';
+    }
+    if (r.incomplete !== undefined && typeof r.incomplete !== 'string')
+        return 'raw.incomplete invalid';
+    if (r.skipReason !== undefined && typeof r.skipReason !== 'string')
+        return 'raw.skipReason invalid';
+    if (r.certification !== undefined
+        && r.certification !== 'certified'
+        && r.certification !== 'operational-unverified'
+        && r.certification !== 'project-declared')
+        return 'raw.certification invalid';
+    return null;
+}
+function cacheProblem(x) {
+    if (x === null || typeof x !== 'object' || Array.isArray(x))
+        return 'cache must be an object';
+    const r = x;
+    if (r.schema !== CACHE_SCHEMA)
+        return 'schema must be 1';
+    if (typeof r.sensorId !== 'string' || r.sensorId.length === 0)
+        return 'sensorId invalid';
+    if (typeof r.projectKey !== 'string' || r.projectKey.length === 0)
+        return 'projectKey invalid';
+    if (typeof r.sensorFingerprint !== 'string' || !r.sensorFingerprint.startsWith('sha256:'))
+        return 'sensorFingerprint invalid';
+    if (typeof r.inputDigest !== 'string' || !r.inputDigest.startsWith('sha256:'))
+        return 'inputDigest invalid';
+    if (r.originCommit !== null && (typeof r.originCommit !== 'string' || !/^[0-9a-f]{40}$|^[0-9a-f]{64}$/.test(r.originCommit))) {
+        return 'originCommit invalid';
+    }
+    if (typeof r.originDirty !== 'boolean')
+        return 'originDirty invalid';
+    return validateRaw(r.raw);
+}
+function toCacheRaw(result) {
+    if (!result || typeof result !== 'object')
+        throw new Error('cache raw requires a sensor result');
+    if (result.status !== 'pass' && result.status !== 'fail') {
+        throw new Error(`toCacheRaw refuses non-pass/fail status (${result.status}); only pass|fail may be cached`);
+    }
+    if (!canCacheRawResult(result)) {
+        throw new Error('toCacheRaw refuses uncacheable raw (RF-2.4)');
+    }
+    return {
+        name: result.name,
+        status: result.status,
+        errors: result.errors,
+        ...(result.failureKind ? { failureKind: result.failureKind } : {}),
+        ...(result.incomplete ? { incomplete: result.incomplete } : {}),
+        ...(result.certification ? { certification: result.certification } : {}),
+        ...(result.skipReason ? { skipReason: result.skipReason } : {}),
+    };
+}
+function writeResultCache(gitRoot, record) {
+    if (typeof gitRoot !== 'string' || gitRoot.length === 0)
+        throw new Error('cache root must be a nonempty string');
+    const problem = cacheProblem(record);
+    if (problem !== null)
+        throw new Error(`invalid result cache: ${problem}`);
+    if (record.raw.name !== record.sensorId) {
+        throw new Error('refusing to write result cache: raw.name must match sensorId');
+    }
+    const asResult = {
+        name: record.raw.name,
+        status: record.raw.status,
+        errors: record.raw.errors,
+        ...(record.raw.failureKind ? { failureKind: record.raw.failureKind } : {}),
+        ...(record.raw.incomplete ? { incomplete: record.raw.incomplete } : {}),
+        ...(record.raw.certification ? { certification: record.raw.certification } : {}),
+        ...(record.raw.skipReason ? { skipReason: record.raw.skipReason } : {}),
+    };
+    if (!canCacheRawResult(asResult)) {
+        throw new Error('refusing to write uncacheable result cache entry (RF-2.4)');
+    }
+    const lookup = {
+        sensorId: record.sensorId,
+        projectKey: record.projectKey,
+        sensorFingerprint: record.sensorFingerprint,
+        inputDigest: record.inputDigest,
+    };
+    const content = JSON.stringify(record, null, 2) + '\n';
+    if (Buffer.byteLength(content) > MAX_CACHE_BYTES)
+        throw new Error('invalid result cache: larger than the size read accepts');
+    assertNoSymlinkChain(gitRoot);
+    fs_1.default.mkdirSync(runsDir(gitRoot), { recursive: true, mode: 0o700 });
+    assertNoSymlinkChain(gitRoot);
+    ensureRunsIgnore(gitRoot);
+    const file = path_1.default.join(runsDir(gitRoot), cacheFileName(lookup));
+    (0, atomic_file_1.writeFileAtomic)(file, content, 0o600);
+    fs_1.default.chmodSync(file, 0o600);
+    return file;
+}
+/** Validated cache read (RF-2.15). Any invalid/tampered entry is a miss. */
+function readResultCache(gitRoot, lookup) {
+    if (typeof gitRoot !== 'string' || gitRoot.length === 0)
+        return null;
+    if (!lookup || typeof lookup !== 'object')
+        return null;
+    if (typeof lookup.sensorId !== 'string' || typeof lookup.projectKey !== 'string')
+        return null;
+    if (typeof lookup.sensorFingerprint !== 'string' || typeof lookup.inputDigest !== 'string')
+        return null;
+    let raw;
+    try {
+        assertNoSymlinkChain(gitRoot);
+        const file = path_1.default.join(runsDir(gitRoot), cacheFileName(lookup));
+        const stat = fs_1.default.lstatSync(file);
+        if (!stat.isFile() || stat.size > MAX_CACHE_BYTES)
+            return null;
+        raw = fs_1.default.readFileSync(file, 'utf8');
+    }
+    catch {
+        return null;
+    }
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch {
+        return null;
+    }
+    if (cacheProblem(parsed) !== null)
+        return null;
+    const record = parsed;
+    if (record.sensorId !== lookup.sensorId
+        || record.projectKey !== lookup.projectKey
+        || record.sensorFingerprint !== lookup.sensorFingerprint
+        || record.inputDigest !== lookup.inputDigest)
+        return null;
+    if (record.raw.name !== record.sensorId || record.raw.name !== lookup.sensorId)
+        return null;
+    // RF-2.15/2.4: structural validity is not enough — reject uncacheable raw payloads.
+    const asResult = {
+        name: record.raw.name,
+        status: record.raw.status,
+        errors: record.raw.errors,
+        ...(record.raw.failureKind ? { failureKind: record.raw.failureKind } : {}),
+        ...(record.raw.incomplete ? { incomplete: record.raw.incomplete } : {}),
+        ...(record.raw.certification ? { certification: record.raw.certification } : {}),
+        ...(record.raw.skipReason ? { skipReason: record.raw.skipReason } : {}),
+    };
+    if (!canCacheRawResult(asResult))
+        return null;
+    return record;
+}

package/dist/src/commands/sensors/result.js

@@ -77,6 +77,9 @@ function scoped(result, prepared) {
         ...(prepared.effectiveScope === 'changed' ? { scope: 'changed' } : {}),
     };
 }
+function withFailureKind(result, kind) {
+    return result.status === 'fail' ? { ...result, failureKind: kind } : result;
+}
 /** Interpret one raw bounded process result without knowing its manifest format. */
 function interpretResult(prepared, raw) {
     validatePrepared(prepared);
@@ -90,13 +93,15 @@ function interpretResult(prepared, raw) {
         execution,
     });
     const format = formatterFor(prepared.name, prepared.formatter);
-    if (raw.spawnError)
-        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `sensor could not be started: ${raw.spawnError.message}` }] });
+    if (raw.spawnError) {
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors: [{ message: `sensor could not be started: ${raw.spawnError.message}` }] }, 'missing-binary'));
+    }
     if (raw.timedOut || raw.overflowed) {
         const reason = raw.timedOut ? `timeout after ${prepared.timeoutMs}ms` : `output exceeded ${MAX_BUFFER} bytes`;
         const errors = format(raw.stdout + raw.stderr);
-        if (errors.length > 0)
-            return withEvidence({ name: prepared.name, status: 'fail', errors, incomplete: `${reason} — findings below are from partial output; the run did not finish` });
+        if (errors.length > 0) {
+            return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors, incomplete: `${reason} — findings below are from partial output; the run did not finish` }, 'findings'));
+        }
         return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: reason });
     }
     if (raw.code === 0) {
@@ -104,27 +109,31 @@ function interpretResult(prepared, raw) {
             return withEvidence({ name: prepared.name, status: 'pass', errors: [] });
         }
         const errors = format(raw.stdout);
-        return withEvidence({ name: prepared.name, status: errors.length ? 'fail' : 'pass', errors });
+        if (errors.length === 0)
+            return withEvidence({ name: prepared.name, status: 'pass', errors: [] });
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors }, 'findings'));
     }
     const output = raw.stdout + raw.stderr;
     if (prepared.formatter === 'exit-code' || format === parseExitCodeOutput) {
         const combined = output.trim();
         const evidence = truncateEvidence(combined.length > 0 ? combined : `exit ${raw.code}`);
-        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: evidence }] });
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors: [{ message: evidence }] }, 'exit-code'));
     }
     const errors = format(output);
     if (errors.length > 0)
-        return withEvidence({ name: prepared.name, status: 'fail', errors });
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors }, 'findings'));
     const lower = output.toLowerCase();
     const toolMissing = raw.code === 127
         || lower.includes('command not found')
         || lower.includes('is not recognized as an internal or external command')
         || lower.includes('enoent')
         || lower.includes('could not determine executable');
-    if (toolMissing)
-        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `sensor tool not available: ${truncateEvidence(output)}` }] });
-    if (prepared.name === 'test')
-        return withEvidence({ name: prepared.name, status: 'fail', errors: [{ message: `SENSOR[${prepared.name}] failed (exit ${raw.code})` }] });
+    if (toolMissing) {
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors: [{ message: `sensor tool not available: ${truncateEvidence(output)}` }] }, 'missing-binary'));
+    }
+    if (prepared.name === 'test') {
+        return withEvidence(withFailureKind({ name: prepared.name, status: 'fail', errors: [{ message: `SENSOR[${prepared.name}] failed (exit ${raw.code})` }] }, 'exit-code'));
+    }
     return withEvidence({ name: prepared.name, status: 'inconclusive', errors: [], skipReason: `exit ${raw.code}: ${truncateEvidence(output)}` });
 }
 /** Execute a validated prepared command, or render its deliberate synthetic result. */
@@ -154,5 +163,15 @@ function applyBaseline(result, accepted) {
     const { newErrors, suppressed } = (0, baseline_1.partition)(result.name, result.errors, accepted);
     if (suppressed === 0)
         return result;
-    return { ...result, errors: newErrors, status: newErrors.length > 0 ? 'fail' : 'pass', newCount: newErrors.length, baselineCount: suppressed };
+    const status = newErrors.length > 0 ? 'fail' : 'pass';
+    const { failureKind: _drop, ...rest } = result;
+    return {
+        ...rest,
+        errors: newErrors,
+        status,
+        // failureKind only applies to fail; a baseline-suppressed pass must not keep it (QA-4).
+        ...(status === 'fail' && result.failureKind ? { failureKind: result.failureKind } : {}),
+        newCount: newErrors.length,
+        baselineCount: suppressed,
+    };
 }