agentrinse 0.0.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (174) hide show
  1. package/LICENSE +21 -0
  2. package/README.md +153 -0
  3. package/dist/adapters/artifacts/adapter.d.ts +24 -0
  4. package/dist/adapters/artifacts/adapter.d.ts.map +1 -0
  5. package/dist/adapters/artifacts/adapter.js +342 -0
  6. package/dist/adapters/artifacts/adapter.js.map +1 -0
  7. package/dist/adapters/docker/adapter.d.ts +15 -0
  8. package/dist/adapters/docker/adapter.d.ts.map +1 -0
  9. package/dist/adapters/docker/adapter.js +121 -0
  10. package/dist/adapters/docker/adapter.js.map +1 -0
  11. package/dist/adapters/git/adapter.d.ts +15 -0
  12. package/dist/adapters/git/adapter.d.ts.map +1 -0
  13. package/dist/adapters/git/adapter.js +156 -0
  14. package/dist/adapters/git/adapter.js.map +1 -0
  15. package/dist/adapters/git/porcelain.d.ts +11 -0
  16. package/dist/adapters/git/porcelain.d.ts.map +1 -0
  17. package/dist/adapters/git/porcelain.js +54 -0
  18. package/dist/adapters/git/porcelain.js.map +1 -0
  19. package/dist/adapters/provider-adapter.d.ts +22 -0
  20. package/dist/adapters/provider-adapter.d.ts.map +1 -0
  21. package/dist/adapters/provider-adapter.js +178 -0
  22. package/dist/adapters/provider-adapter.js.map +1 -0
  23. package/dist/adapters/provider-specs.d.ts +16 -0
  24. package/dist/adapters/provider-specs.d.ts.map +1 -0
  25. package/dist/adapters/provider-specs.js +157 -0
  26. package/dist/adapters/provider-specs.js.map +1 -0
  27. package/dist/adapters/registry.d.ts +4 -0
  28. package/dist/adapters/registry.d.ts.map +1 -0
  29. package/dist/adapters/registry.js +28 -0
  30. package/dist/adapters/registry.js.map +1 -0
  31. package/dist/cli.d.ts +3 -0
  32. package/dist/cli.d.ts.map +1 -0
  33. package/dist/cli.js +8 -0
  34. package/dist/cli.js.map +1 -0
  35. package/dist/commands/adapters.d.ts +2 -0
  36. package/dist/commands/adapters.d.ts.map +1 -0
  37. package/dist/commands/adapters.js +17 -0
  38. package/dist/commands/adapters.js.map +1 -0
  39. package/dist/commands/apply.d.ts +15 -0
  40. package/dist/commands/apply.d.ts.map +1 -0
  41. package/dist/commands/apply.js +63 -0
  42. package/dist/commands/apply.js.map +1 -0
  43. package/dist/commands/audit.d.ts +13 -0
  44. package/dist/commands/audit.d.ts.map +1 -0
  45. package/dist/commands/audit.js +22 -0
  46. package/dist/commands/audit.js.map +1 -0
  47. package/dist/commands/plan.d.ts +12 -0
  48. package/dist/commands/plan.d.ts.map +1 -0
  49. package/dist/commands/plan.js +19 -0
  50. package/dist/commands/plan.js.map +1 -0
  51. package/dist/config/defaults.d.ts +3 -0
  52. package/dist/config/defaults.d.ts.map +1 -0
  53. package/dist/config/defaults.js +29 -0
  54. package/dist/config/defaults.js.map +1 -0
  55. package/dist/config/load.d.ts +3 -0
  56. package/dist/config/load.d.ts.map +1 -0
  57. package/dist/config/load.js +31 -0
  58. package/dist/config/load.js.map +1 -0
  59. package/dist/config/schema.d.ts +84 -0
  60. package/dist/config/schema.d.ts.map +1 -0
  61. package/dist/config/schema.js +108 -0
  62. package/dist/config/schema.js.map +1 -0
  63. package/dist/contracts/action.d.ts +109 -0
  64. package/dist/contracts/action.d.ts.map +1 -0
  65. package/dist/contracts/action.js +37 -0
  66. package/dist/contracts/action.js.map +1 -0
  67. package/dist/contracts/adapter.d.ts +21 -0
  68. package/dist/contracts/adapter.d.ts.map +1 -0
  69. package/dist/contracts/adapter.js +2 -0
  70. package/dist/contracts/adapter.js.map +1 -0
  71. package/dist/contracts/diagnostic.d.ts +21 -0
  72. package/dist/contracts/diagnostic.d.ts.map +1 -0
  73. package/dist/contracts/diagnostic.js +11 -0
  74. package/dist/contracts/diagnostic.js.map +1 -0
  75. package/dist/contracts/finding.d.ts +123 -0
  76. package/dist/contracts/finding.d.ts.map +1 -0
  77. package/dist/contracts/finding.js +35 -0
  78. package/dist/contracts/finding.js.map +1 -0
  79. package/dist/contracts/plan.d.ts +53 -0
  80. package/dist/contracts/plan.d.ts.map +1 -0
  81. package/dist/contracts/plan.js +56 -0
  82. package/dist/contracts/plan.js.map +1 -0
  83. package/dist/contracts/report.d.ts +177 -0
  84. package/dist/contracts/report.d.ts.map +1 -0
  85. package/dist/contracts/report.js +29 -0
  86. package/dist/contracts/report.js.map +1 -0
  87. package/dist/contracts/resource.d.ts +72 -0
  88. package/dist/contracts/resource.d.ts.map +1 -0
  89. package/dist/contracts/resource.js +33 -0
  90. package/dist/contracts/resource.js.map +1 -0
  91. package/dist/contracts/run.d.ts +108 -0
  92. package/dist/contracts/run.d.ts.map +1 -0
  93. package/dist/contracts/run.js +35 -0
  94. package/dist/contracts/run.js.map +1 -0
  95. package/dist/core/apply.d.ts +29 -0
  96. package/dist/core/apply.d.ts.map +1 -0
  97. package/dist/core/apply.js +120 -0
  98. package/dist/core/apply.js.map +1 -0
  99. package/dist/core/artifact-executor.d.ts +39 -0
  100. package/dist/core/artifact-executor.d.ts.map +1 -0
  101. package/dist/core/artifact-executor.js +200 -0
  102. package/dist/core/artifact-executor.js.map +1 -0
  103. package/dist/core/artifact-revalidation.d.ts +22 -0
  104. package/dist/core/artifact-revalidation.d.ts.map +1 -0
  105. package/dist/core/artifact-revalidation.js +113 -0
  106. package/dist/core/artifact-revalidation.js.map +1 -0
  107. package/dist/core/audit.d.ts +12 -0
  108. package/dist/core/audit.d.ts.map +1 -0
  109. package/dist/core/audit.js +41 -0
  110. package/dist/core/audit.js.map +1 -0
  111. package/dist/core/digest.d.ts +7 -0
  112. package/dist/core/digest.d.ts.map +1 -0
  113. package/dist/core/digest.js +21 -0
  114. package/dist/core/digest.js.map +1 -0
  115. package/dist/core/measure.d.ts +16 -0
  116. package/dist/core/measure.d.ts.map +1 -0
  117. package/dist/core/measure.js +79 -0
  118. package/dist/core/measure.js.map +1 -0
  119. package/dist/core/mount-boundaries.d.ts +21 -0
  120. package/dist/core/mount-boundaries.d.ts.map +1 -0
  121. package/dist/core/mount-boundaries.js +72 -0
  122. package/dist/core/mount-boundaries.js.map +1 -0
  123. package/dist/core/plan-verification.d.ts +10 -0
  124. package/dist/core/plan-verification.d.ts.map +1 -0
  125. package/dist/core/plan-verification.js +42 -0
  126. package/dist/core/plan-verification.js.map +1 -0
  127. package/dist/core/plan.d.ts +6 -0
  128. package/dist/core/plan.d.ts.map +1 -0
  129. package/dist/core/plan.js +40 -0
  130. package/dist/core/plan.js.map +1 -0
  131. package/dist/core/process-ownership.d.ts +27 -0
  132. package/dist/core/process-ownership.d.ts.map +1 -0
  133. package/dist/core/process-ownership.js +140 -0
  134. package/dist/core/process-ownership.js.map +1 -0
  135. package/dist/core/safety.d.ts +7 -0
  136. package/dist/core/safety.d.ts.map +1 -0
  137. package/dist/core/safety.js +50 -0
  138. package/dist/core/safety.js.map +1 -0
  139. package/dist/index.d.ts +9 -0
  140. package/dist/index.d.ts.map +1 -0
  141. package/dist/index.js +9 -0
  142. package/dist/index.js.map +1 -0
  143. package/dist/main.d.ts +4 -0
  144. package/dist/main.d.ts.map +1 -0
  145. package/dist/main.js +59 -0
  146. package/dist/main.js.map +1 -0
  147. package/dist/output.d.ts +4 -0
  148. package/dist/output.d.ts.map +1 -0
  149. package/dist/output.js +35 -0
  150. package/dist/output.js.map +1 -0
  151. package/dist/state/json-file.d.ts +4 -0
  152. package/dist/state/json-file.d.ts.map +1 -0
  153. package/dist/state/json-file.js +36 -0
  154. package/dist/state/json-file.js.map +1 -0
  155. package/dist/state/layout.d.ts +12 -0
  156. package/dist/state/layout.d.ts.map +1 -0
  157. package/dist/state/layout.js +20 -0
  158. package/dist/state/layout.js.map +1 -0
  159. package/dist/state/lock.d.ts +9 -0
  160. package/dist/state/lock.d.ts.map +1 -0
  161. package/dist/state/lock.js +93 -0
  162. package/dist/state/lock.js.map +1 -0
  163. package/dist/state/run-journal.d.ts +10 -0
  164. package/dist/state/run-journal.d.ts.map +1 -0
  165. package/dist/state/run-journal.js +57 -0
  166. package/dist/state/run-journal.js.map +1 -0
  167. package/dist/version.d.ts +2 -0
  168. package/dist/version.d.ts.map +1 -0
  169. package/dist/version.js +2 -0
  170. package/dist/version.js.map +1 -0
  171. package/package.json +73 -0
  172. package/schemas/audit.schema.json +424 -0
  173. package/schemas/plan.schema.json +184 -0
  174. package/schemas/run.schema.json +161 -0
@@ -0,0 +1,121 @@
1
+ import { execFile } from "node:child_process";
2
+ import { promisify } from "node:util";
3
+ import { sha256 } from "../../core/digest.js";
4
+ const execFileAsync = promisify(execFile);
5
+ async function defaultDockerRunner(args) {
6
+ const result = await execFileAsync("docker", args, {
7
+ encoding: "utf8",
8
+ maxBuffer: 8 * 1024 * 1024,
9
+ timeout: 10_000,
10
+ });
11
+ return result.stdout;
12
+ }
13
+ function parseJsonLines(input) {
14
+ return input
15
+ .split("\n")
16
+ .map((line) => line.trim())
17
+ .filter((line) => line !== "")
18
+ .map((line) => JSON.parse(line));
19
+ }
20
+ function stringField(record, key) {
21
+ const value = record[key];
22
+ return typeof value === "string" && value !== "" ? value : undefined;
23
+ }
24
+ export class DockerAuditAdapter {
25
+ runDocker;
26
+ id = "docker";
27
+ constructor(runDocker = defaultDockerRunner) {
28
+ this.runDocker = runDocker;
29
+ }
30
+ async probe(_context) {
31
+ try {
32
+ const dockerContext = (await this.runDocker(["context", "show"])).trim();
33
+ const version = (await this.runDocker(["version", "--format", "{{.Server.Version}}"])).trim();
34
+ return {
35
+ adapter: this.id,
36
+ status: "available",
37
+ version,
38
+ detail: `Docker daemon available through context ${dockerContext}`,
39
+ diagnostics: [],
40
+ };
41
+ }
42
+ catch (error) {
43
+ return {
44
+ adapter: this.id,
45
+ status: "degraded",
46
+ detail: "Docker daemon is unavailable",
47
+ diagnostics: [
48
+ {
49
+ severity: "warning",
50
+ code: "DOCKER_DAEMON_UNAVAILABLE",
51
+ message: error instanceof Error ? error.message : String(error),
52
+ adapter: this.id,
53
+ },
54
+ ],
55
+ };
56
+ }
57
+ }
58
+ async collect(context, probe) {
59
+ if (probe.status !== "available") {
60
+ return { resources: [], diagnostics: [] };
61
+ }
62
+ const images = parseJsonLines(await this.runDocker(["image", "ls", "--no-trunc", "--format", "{{json .}}"]));
63
+ const containers = parseJsonLines(await this.runDocker(["container", "ls", "-a", "--no-trunc", "--format", "{{json .}}"]));
64
+ return {
65
+ resources: [
66
+ ...images.flatMap((image) => this.toResource(context, "docker-image", image, "ID", "Repository")),
67
+ ...containers.flatMap((container) => this.toResource(context, "docker-container", container, "ID", "Names")),
68
+ ],
69
+ diagnostics: [],
70
+ };
71
+ }
72
+ toResource(context, kind, facts, idField, nameField) {
73
+ const externalId = stringField(facts, idField);
74
+ if (externalId === undefined) {
75
+ return [];
76
+ }
77
+ const canonicalKey = `docker:${kind}:${externalId}`;
78
+ return [
79
+ {
80
+ resource: {
81
+ id: `docker:${kind}:${sha256(canonicalKey)}`,
82
+ adapter: this.id,
83
+ kind,
84
+ canonicalKey,
85
+ displayName: stringField(facts, nameField) ?? externalId,
86
+ externalId,
87
+ },
88
+ observedAt: context.now.toISOString(),
89
+ exists: true,
90
+ facts: {
91
+ ...facts,
92
+ reportOnly: true,
93
+ },
94
+ },
95
+ ];
96
+ }
97
+ async classify(context, resource) {
98
+ const observedAt = context.now.toISOString();
99
+ return {
100
+ schemaVersion: 1,
101
+ findingId: `${resource.resource.id}:${sha256(context.auditId)}`,
102
+ auditId: context.auditId,
103
+ observedAt,
104
+ resource: resource.resource,
105
+ state: "protected",
106
+ confidence: "certain",
107
+ roots: [
108
+ {
109
+ code: "docker-audit-only",
110
+ source: "docker",
111
+ observedAt,
112
+ detail: "The Docker adapter inventories resources but cannot prune them.",
113
+ },
114
+ ],
115
+ facts: resource.facts,
116
+ candidateActions: [],
117
+ warnings: [],
118
+ };
119
+ }
120
+ }
121
+ //# sourceMappingURL=adapter.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/adapters/docker/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAE9C,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAI1C,KAAK,UAAU,mBAAmB,CAAC,IAAc;IAC/C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE;QACjD,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QAC1B,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,OAAO,KAAK;SACT,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,EAAE,CAAC;SAC7B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAA4B,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,WAAW,CAAC,MAA+B,EAAE,GAAW;IAC/D,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC;AACvE,CAAC;AAED,MAAM,OAAO,kBAAkB;IAGA,SAAS;IAF7B,EAAE,GAAG,QAAQ,CAAC;IAEvB,YAA6B,SAAS,GAAiB,mBAAmB;yBAA7C,SAAS;IAAuC,CAAC;IAE9E,KAAK,CAAC,KAAK,CAAC,QAAsB;QAChC,IAAI,CAAC;YACH,MAAM,aAAa,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YACzE,MAAM,OAAO,GAAG,CAAC,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;YAE9F,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,WAAW;gBACnB,OAAO;gBACP,MAAM,EAAE,2CAA2C,aAAa,EAAE;gBAClE,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,8BAA8B;gBACtC,WAAW,EAAE;oBACX;wBACE,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,2BAA2B;wBACjC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC/D,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB,EAAE,KAAmB;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YACjC,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,cAAc,CAC3B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CAC9E,CAAC;QACF,MAAM,UAAU,GAAG,cAAc,CAC/B,MAAM,IAAI,CAAC,SAAS,CAAC,CAAC,WAAW,EAAE,IAAI,EAAE,IAAI,EAAE,YAAY,EAAE,UAAU,EAAE,YAAY,CAAC,CAAC,CACxF,CAAC;QAEF,OAAO;YACL,SAAS,EAAE;gBACT,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC1B,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,IAAI,EAAE,YAAY,CAAC,CACpE;gBACD,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAClC,IAAI,CAAC,UAAU,CAAC,OAAO,EAAE,kBAAkB,EAAE,SAAS,EAAE,IAAI,EAAE,OAAO,CAAC,CACvE;aACF;YACD,WAAW,EAAE,EAAE;SAChB,CAAC;IACJ,CAAC;IAEO,UAAU,CAChB,OAAqB,EACrB,IAAkB,EAClB,KAA8B,EAC9B,OAAe,EACf,SAAiB;QAEjB,MAAM,UAAU,GAAG,WAAW,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;QAC/C,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;YAC7B,OAAO,EAAE,CAAC;QACZ,CAAC;QAED,MAAM,YAAY,GAAG,UAAU,IAAI,IAAI,UAAU,EAAE,CAAC;QACpD,OAAO;YACL;gBACE,QAAQ,EAAE;oBACR,EAAE,EAAE,UAAU,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE;oBAC5C,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,IAAI;oBACJ,YAAY;oBACZ,WAAW,EAAE,WAAW,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,UAAU;oBACxD,UAAU;iBACX;gBACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;gBACrC,MAAM,EAAE,IAAI;gBACZ,KAAK,EAAE;oBACL,GAAG,KAAK;oBACR,UAAU,EAAE,IAAI;iBACjB;aACF;SACF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,QAA0B;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,mBAAmB;oBACzB,MAAM,EAAE,QAAQ;oBAChB,UAAU;oBACV,MAAM,EAAE,iEAAiE;iBAC1E;aACF;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;CACF"}
@@ -0,0 +1,15 @@
1
+ import type { AuditAdapter, AuditContext, CollectionResult } from "../../contracts/adapter.js";
2
+ import type { Finding } from "../../contracts/finding.js";
3
+ import type { AdapterProbe } from "../../contracts/report.js";
4
+ import type { ResourceSnapshot } from "../../contracts/resource.js";
5
+ export type GitRunner = (args: string[]) => Promise<string>;
6
+ export declare class GitWorktreeAuditAdapter implements AuditAdapter {
7
+ private readonly root;
8
+ private readonly runGit;
9
+ readonly id = "git";
10
+ constructor(root: string | undefined, runGit?: GitRunner);
11
+ probe(_context: AuditContext): Promise<AdapterProbe>;
12
+ collect(context: AuditContext, probe: AdapterProbe): Promise<CollectionResult>;
13
+ classify(context: AuditContext, resource: ResourceSnapshot): Promise<Finding>;
14
+ }
15
+ //# sourceMappingURL=adapter.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"adapter.d.ts","sourceRoot":"","sources":["../../../src/adapters/git/adapter.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC/F,OAAO,KAAK,EAAE,OAAO,EAAgB,MAAM,4BAA4B,CAAC;AACxE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AAC9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,6BAA6B,CAAC;AAMpE,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,MAAM,CAAC,CAAC;AAiB5D,qBAAa,uBAAwB,YAAW,YAAY;IAIxD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,MAAM;IAJzB,QAAQ,CAAC,EAAE,SAAS;IAEpB,YACmB,IAAI,EAAE,MAAM,GAAG,SAAS,EACxB,MAAM,GAAE,SAA4B,EACnD;IAEE,KAAK,CAAC,QAAQ,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CA6CzD;IAEK,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CA+CnF;IAEK,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CA0ClF;CACF"}
@@ -0,0 +1,156 @@
1
+ import { execFile } from "node:child_process";
2
+ import { lstat } from "node:fs/promises";
3
+ import { resolve } from "node:path";
4
+ import { promisify } from "node:util";
5
+ import { sha256 } from "../../core/digest.js";
6
+ import { parseWorktreePorcelain } from "./porcelain.js";
7
+ const execFileAsync = promisify(execFile);
8
+ async function defaultGitRunner(args) {
9
+ const result = await execFileAsync("git", args, {
10
+ encoding: "utf8",
11
+ maxBuffer: 4 * 1024 * 1024,
12
+ timeout: 10_000,
13
+ });
14
+ return result.stdout;
15
+ }
16
+ function isMissing(error) {
17
+ return (error instanceof Error && "code" in error && error.code === "ENOENT");
18
+ }
19
+ export class GitWorktreeAuditAdapter {
20
+ root;
21
+ runGit;
22
+ id = "git";
23
+ constructor(root, runGit = defaultGitRunner) {
24
+ this.root = root;
25
+ this.runGit = runGit;
26
+ }
27
+ async probe(_context) {
28
+ if (this.root === undefined) {
29
+ return {
30
+ adapter: this.id,
31
+ status: "degraded",
32
+ detail: "Git audit requires an explicit repository root",
33
+ diagnostics: [
34
+ {
35
+ severity: "warning",
36
+ code: "GIT_ROOT_REQUIRED",
37
+ message: "Set adapters.git.root to an explicit repository.",
38
+ adapter: this.id,
39
+ },
40
+ ],
41
+ };
42
+ }
43
+ const requestedRoot = resolve(this.root);
44
+ try {
45
+ const root = (await this.runGit(["-C", requestedRoot, "rev-parse", "--show-toplevel"])).trim();
46
+ return {
47
+ adapter: this.id,
48
+ status: "available",
49
+ root,
50
+ detail: "Git repository found",
51
+ diagnostics: [],
52
+ };
53
+ }
54
+ catch (error) {
55
+ return {
56
+ adapter: this.id,
57
+ status: "degraded",
58
+ root: requestedRoot,
59
+ detail: "Git repository could not be inspected",
60
+ diagnostics: [
61
+ {
62
+ severity: "warning",
63
+ code: "GIT_PROBE_FAILED",
64
+ message: error instanceof Error ? error.message : String(error),
65
+ adapter: this.id,
66
+ },
67
+ ],
68
+ };
69
+ }
70
+ }
71
+ async collect(context, probe) {
72
+ if (probe.status !== "available" || probe.root === undefined) {
73
+ return { resources: [], diagnostics: [] };
74
+ }
75
+ const output = await this.runGit(["-C", probe.root, "worktree", "list", "--porcelain", "-z"]);
76
+ const records = parseWorktreePorcelain(output);
77
+ const resources = [];
78
+ for (const record of records) {
79
+ let exists = true;
80
+ try {
81
+ const stats = await lstat(record.path);
82
+ exists = stats.isDirectory() && !stats.isSymbolicLink();
83
+ }
84
+ catch (error) {
85
+ if (!isMissing(error)) {
86
+ throw error;
87
+ }
88
+ exists = false;
89
+ }
90
+ const canonicalKey = `git:git-worktree:${resolve(record.path)}`;
91
+ resources.push({
92
+ resource: {
93
+ id: `git:git-worktree:${sha256(canonicalKey)}`,
94
+ adapter: this.id,
95
+ kind: "git-worktree",
96
+ canonicalKey,
97
+ displayName: record.path === probe.root ? "Main worktree" : "Linked worktree",
98
+ path: resolve(record.path),
99
+ },
100
+ observedAt: context.now.toISOString(),
101
+ exists,
102
+ facts: {
103
+ isMain: resolve(record.path) === resolve(probe.root),
104
+ head: record.head,
105
+ branch: record.branch,
106
+ detached: record.detached,
107
+ bare: record.bare,
108
+ locked: record.locked,
109
+ prunable: record.prunable,
110
+ reportOnly: true,
111
+ },
112
+ });
113
+ }
114
+ return { resources, diagnostics: [] };
115
+ }
116
+ async classify(context, resource) {
117
+ const observedAt = context.now.toISOString();
118
+ const roots = [];
119
+ if (resource.facts.isMain === true) {
120
+ roots.push({
121
+ code: "main-worktree",
122
+ source: "git",
123
+ observedAt,
124
+ detail: "The main worktree is always protected.",
125
+ });
126
+ }
127
+ if (resource.facts.locked !== undefined) {
128
+ roots.push({
129
+ code: "git-lock",
130
+ source: "git",
131
+ observedAt,
132
+ detail: "Git reports this worktree as locked.",
133
+ });
134
+ }
135
+ roots.push({
136
+ code: "git-audit-only",
137
+ source: "git",
138
+ observedAt,
139
+ detail: "The Git adapter does not yet prove dirty, process, session, or push state.",
140
+ });
141
+ return {
142
+ schemaVersion: 1,
143
+ findingId: `${resource.resource.id}:${sha256(context.auditId)}`,
144
+ auditId: context.auditId,
145
+ observedAt,
146
+ resource: resource.resource,
147
+ state: resource.exists ? "protected" : "unknown",
148
+ confidence: resource.exists ? "certain" : "unknown",
149
+ roots,
150
+ facts: resource.facts,
151
+ candidateActions: [],
152
+ warnings: [],
153
+ };
154
+ }
155
+ }
156
+ //# sourceMappingURL=adapter.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"adapter.js","sourceRoot":"","sources":["../../../src/adapters/git/adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAMtC,OAAO,EAAE,MAAM,EAAE,MAAM,sBAAsB,CAAC;AAC9C,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AAExD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAI1C,KAAK,UAAU,gBAAgB,CAAC,IAAc;IAC5C,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;QAC9C,QAAQ,EAAE,MAAM;QAChB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;QAC1B,OAAO,EAAE,MAAM;KAChB,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,uBAAuB;IAIf,IAAI;IACJ,MAAM;IAJhB,EAAE,GAAG,KAAK,CAAC;IAEpB,YACmB,IAAwB,EACxB,MAAM,GAAc,gBAAgB;oBADpC,IAAI;sBACJ,MAAM;IACtB,CAAC;IAEJ,KAAK,CAAC,KAAK,CAAC,QAAsB;QAChC,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC5B,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,UAAU;gBAClB,MAAM,EAAE,gDAAgD;gBACxD,WAAW,EAAE;oBACX;wBACE,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,mBAAmB;wBACzB,OAAO,EAAE,kDAAkD;wBAC3D,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB;iBACF;aACF,CAAC;QACJ,CAAC;QAED,MAAM,aAAa,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACzC,IAAI,CAAC;YACH,MAAM,IAAI,GAAG,CACX,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,CAAC,CAAC,CACzE,CAAC,IAAI,EAAE,CAAC;YACT,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,WAAW;gBACnB,IAAI;gBACJ,MAAM,EAAE,sBAAsB;gBAC9B,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,UAAU;gBAClB,IAAI,EAAE,aAAa;gBACnB,MAAM,EAAE,uCAAuC;gBAC/C,WAAW,EAAE;oBACX;wBACE,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,kBAAkB;wBACxB,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC/D,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB,EAAE,KAAmB;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,aAAa,EAAE,IAAI,CAAC,CAAC,CAAC;QAC9F,MAAM,OAAO,GAAG,sBAAsB,CAAC,MAAM,CAAC,CAAC;QAC/C,MAAM,SAAS,GAAuB,EAAE,CAAC;QAEzC,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;YAC7B,IAAI,MAAM,GAAG,IAAI,CAAC;YAClB,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;gBACvC,MAAM,GAAG,KAAK,CAAC,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;YAC1D,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACtB,MAAM,KAAK,CAAC;gBACd,CAAC;gBACD,MAAM,GAAG,KAAK,CAAC;YACjB,CAAC;YAED,MAAM,YAAY,GAAG,oBAAoB,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAChE,SAAS,CAAC,IAAI,CAAC;gBACb,QAAQ,EAAE;oBACR,EAAE,EAAE,oBAAoB,MAAM,CAAC,YAAY,CAAC,EAAE;oBAC9C,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,IAAI,EAAE,cAAc;oBACpB,YAAY;oBACZ,WAAW,EAAE,MAAM,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,iBAAiB;oBAC7E,IAAI,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC;iBAC3B;gBACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;gBACrC,MAAM;gBACN,KAAK,EAAE;oBACL,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC;oBACpD,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,IAAI,EAAE,MAAM,CAAC,IAAI;oBACjB,MAAM,EAAE,MAAM,CAAC,MAAM;oBACrB,QAAQ,EAAE,MAAM,CAAC,QAAQ;oBACzB,UAAU,EAAE,IAAI;iBACjB;aACF,CAAC,CAAC;QACL,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;IACxC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,QAA0B;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAmB,EAAE,CAAC;QAEjC,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACnC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,eAAe;gBACrB,MAAM,EAAE,KAAK;gBACb,UAAU;gBACV,MAAM,EAAE,wCAAwC;aACjD,CAAC,CAAC;QACL,CAAC;QAED,IAAI,QAAQ,CAAC,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACxC,KAAK,CAAC,IAAI,CAAC;gBACT,IAAI,EAAE,UAAU;gBAChB,MAAM,EAAE,KAAK;gBACb,UAAU;gBACV,MAAM,EAAE,sCAAsC;aAC/C,CAAC,CAAC;QACL,CAAC;QAED,KAAK,CAAC,IAAI,CAAC;YACT,IAAI,EAAE,gBAAgB;YACtB,MAAM,EAAE,KAAK;YACb,UAAU;YACV,MAAM,EAAE,4EAA4E;SACrF,CAAC,CAAC;QAEH,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS;YAChD,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;YACnD,KAAK;YACL,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,EAAE;YACpB,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;CACF"}
@@ -0,0 +1,11 @@
1
+ export type GitWorktreeRecord = {
2
+ path: string;
3
+ head?: string;
4
+ branch?: string;
5
+ detached: boolean;
6
+ bare: boolean;
7
+ locked?: string;
8
+ prunable?: string;
9
+ };
10
+ export declare function parseWorktreePorcelain(input: string): GitWorktreeRecord[];
11
+ //# sourceMappingURL=porcelain.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"porcelain.d.ts","sourceRoot":"","sources":["../../../src/adapters/git/porcelain.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,iBAAiB,GAAG;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,IAAI,EAAE,OAAO,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB,CAAC;AAEF,wBAAgB,sBAAsB,CAAC,KAAK,EAAE,MAAM,GAAG,iBAAiB,EAAE,CAmDzE"}
@@ -0,0 +1,54 @@
1
+ export function parseWorktreePorcelain(input) {
2
+ const records = [];
3
+ let current;
4
+ const pushCurrent = () => {
5
+ if (current !== undefined) {
6
+ records.push(current);
7
+ current = undefined;
8
+ }
9
+ };
10
+ for (const token of input.split("\0")) {
11
+ if (token === "") {
12
+ continue;
13
+ }
14
+ if (token.startsWith("worktree ")) {
15
+ pushCurrent();
16
+ current = {
17
+ path: token.slice("worktree ".length),
18
+ detached: false,
19
+ bare: false,
20
+ };
21
+ continue;
22
+ }
23
+ if (current === undefined) {
24
+ throw new Error(`worktree porcelain field before record: ${token}`);
25
+ }
26
+ if (token.startsWith("HEAD ")) {
27
+ current.head = token.slice("HEAD ".length);
28
+ }
29
+ else if (token.startsWith("branch ")) {
30
+ current.branch = token.slice("branch ".length);
31
+ }
32
+ else if (token === "detached") {
33
+ current.detached = true;
34
+ }
35
+ else if (token === "bare") {
36
+ current.bare = true;
37
+ }
38
+ else if (token === "locked") {
39
+ current.locked = "";
40
+ }
41
+ else if (token.startsWith("locked ")) {
42
+ current.locked = token.slice("locked ".length);
43
+ }
44
+ else if (token === "prunable") {
45
+ current.prunable = "";
46
+ }
47
+ else if (token.startsWith("prunable ")) {
48
+ current.prunable = token.slice("prunable ".length);
49
+ }
50
+ }
51
+ pushCurrent();
52
+ return records;
53
+ }
54
+ //# sourceMappingURL=porcelain.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"porcelain.js","sourceRoot":"","sources":["../../../src/adapters/git/porcelain.ts"],"names":[],"mappings":"AAUA,MAAM,UAAU,sBAAsB,CAAC,KAAa;IAClD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,OAAsC,CAAC;IAE3C,MAAM,WAAW,GAAG,GAAG,EAAE;QACvB,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACtB,OAAO,GAAG,SAAS,CAAC;QACtB,CAAC;IACH,CAAC,CAAC;IAEF,KAAK,MAAM,KAAK,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACtC,IAAI,KAAK,KAAK,EAAE,EAAE,CAAC;YACjB,SAAS;QACX,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAClC,WAAW,EAAE,CAAC;YACd,OAAO,GAAG;gBACR,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC;gBACrC,QAAQ,EAAE,KAAK;gBACf,IAAI,EAAE,KAAK;aACZ,CAAC;YACF,SAAS;QACX,CAAC;QAED,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAC;QACtE,CAAC;QAED,IAAI,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9B,OAAO,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC7C,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,IAAI,CAAC;QAC1B,CAAC;aAAM,IAAI,KAAK,KAAK,MAAM,EAAE,CAAC;YAC5B,OAAO,CAAC,IAAI,GAAG,IAAI,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC;QACtB,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YACvC,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QACjD,CAAC;aAAM,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;YAChC,OAAO,CAAC,QAAQ,GAAG,EAAE,CAAC;QACxB,CAAC;aAAM,IAAI,KAAK,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QACrD,CAAC;IACH,CAAC;IAED,WAAW,EAAE,CAAC;IACd,OAAO,OAAO,CAAC;AACjB,CAAC"}
@@ -0,0 +1,22 @@
1
+ import type { AuditAdapter, AuditContext, CollectionResult } from "../contracts/adapter.js";
2
+ import type { Finding } from "../contracts/finding.js";
3
+ import type { AdapterProbe } from "../contracts/report.js";
4
+ import type { ResourceSnapshot } from "../contracts/resource.js";
5
+ import type { ProviderSpec } from "./provider-specs.js";
6
+ export type ProviderAdapterOptions = {
7
+ root?: string;
8
+ platform?: NodeJS.Platform;
9
+ measureBytes: boolean;
10
+ maxEntries: number;
11
+ };
12
+ export declare class ProviderAuditAdapter implements AuditAdapter {
13
+ private readonly spec;
14
+ private readonly options;
15
+ readonly id: string;
16
+ constructor(spec: ProviderSpec, options: ProviderAdapterOptions);
17
+ private root;
18
+ probe(context: AuditContext): Promise<AdapterProbe>;
19
+ collect(context: AuditContext, probe: AdapterProbe): Promise<CollectionResult>;
20
+ classify(context: AuditContext, resource: ResourceSnapshot): Promise<Finding>;
21
+ }
22
+ //# sourceMappingURL=provider-adapter.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"provider-adapter.d.ts","sourceRoot":"","sources":["../../src/adapters/provider-adapter.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,YAAY,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAE5F,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,wBAAwB,CAAC;AAC3D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAGjE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAExD,MAAM,MAAM,sBAAsB,GAAG;IACnC,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAQF,qBAAa,oBAAqB,YAAW,YAAY;IAIrD,OAAO,CAAC,QAAQ,CAAC,IAAI;IACrB,OAAO,CAAC,QAAQ,CAAC,OAAO;IAJ1B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IAEpB,YACmB,IAAI,EAAE,YAAY,EAClB,OAAO,EAAE,sBAAsB,EAGjD;IAED,OAAO,CAAC,IAAI;IAON,KAAK,CAAC,OAAO,EAAE,YAAY,GAAG,OAAO,CAAC,YAAY,CAAC,CAwExD;IAEK,OAAO,CAAC,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,YAAY,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAoEnF;IAEK,QAAQ,CAAC,OAAO,EAAE,YAAY,EAAE,QAAQ,EAAE,gBAAgB,GAAG,OAAO,CAAC,OAAO,CAAC,CAuBlF;CACF"}
@@ -0,0 +1,178 @@
1
+ import { lstat } from "node:fs/promises";
2
+ import { join, resolve } from "node:path";
3
+ import { sha256 } from "../core/digest.js";
4
+ import { measurePath } from "../core/measure.js";
5
+ function isMissing(error) {
6
+ return (error instanceof Error && "code" in error && error.code === "ENOENT");
7
+ }
8
+ export class ProviderAuditAdapter {
9
+ spec;
10
+ options;
11
+ id;
12
+ constructor(spec, options) {
13
+ this.spec = spec;
14
+ this.options = options;
15
+ this.id = spec.id;
16
+ }
17
+ root(context) {
18
+ return resolve(this.options.root ??
19
+ this.spec.defaultRoot(context.home, this.options.platform ?? process.platform));
20
+ }
21
+ async probe(context) {
22
+ const root = this.root(context);
23
+ try {
24
+ const stats = await lstat(root);
25
+ if (stats.isSymbolicLink()) {
26
+ return {
27
+ adapter: this.id,
28
+ status: "degraded",
29
+ root,
30
+ detail: `${this.spec.displayName} root is a symlink; audit is blocked`,
31
+ diagnostics: [
32
+ {
33
+ severity: "warning",
34
+ code: "PROVIDER_ROOT_SYMLINK",
35
+ message: "Provider roots must resolve without following symlinks.",
36
+ adapter: this.id,
37
+ },
38
+ ],
39
+ };
40
+ }
41
+ if (!stats.isDirectory()) {
42
+ return {
43
+ adapter: this.id,
44
+ status: "degraded",
45
+ root,
46
+ detail: `${this.spec.displayName} root is not a directory`,
47
+ diagnostics: [
48
+ {
49
+ severity: "warning",
50
+ code: "PROVIDER_ROOT_NOT_DIRECTORY",
51
+ message: "The configured provider root is not a directory.",
52
+ adapter: this.id,
53
+ },
54
+ ],
55
+ };
56
+ }
57
+ return {
58
+ adapter: this.id,
59
+ status: "available",
60
+ root,
61
+ detail: `${this.spec.displayName} data root found`,
62
+ diagnostics: [],
63
+ };
64
+ }
65
+ catch (error) {
66
+ if (isMissing(error)) {
67
+ return {
68
+ adapter: this.id,
69
+ status: "absent",
70
+ root,
71
+ detail: `${this.spec.displayName} data root not found`,
72
+ diagnostics: [],
73
+ };
74
+ }
75
+ return {
76
+ adapter: this.id,
77
+ status: "degraded",
78
+ root,
79
+ detail: `${this.spec.displayName} data root could not be inspected`,
80
+ diagnostics: [
81
+ {
82
+ severity: "warning",
83
+ code: "PROVIDER_ROOT_UNREADABLE",
84
+ message: error instanceof Error ? error.message : String(error),
85
+ adapter: this.id,
86
+ },
87
+ ],
88
+ };
89
+ }
90
+ }
91
+ async collect(context, probe) {
92
+ if (probe.status !== "available" || probe.root === undefined) {
93
+ return { resources: [], diagnostics: [] };
94
+ }
95
+ const resources = [];
96
+ const diagnostics = [];
97
+ for (const candidate of this.spec.resources) {
98
+ context.signal?.throwIfAborted();
99
+ const path = candidate.relativePath === "." ? probe.root : join(probe.root, candidate.relativePath);
100
+ try {
101
+ const stats = await lstat(path);
102
+ if (stats.isSymbolicLink()) {
103
+ diagnostics.push({
104
+ severity: "warning",
105
+ code: "RESOURCE_SYMLINK_SKIPPED",
106
+ message: "A provider resource symlink was not followed.",
107
+ adapter: this.id,
108
+ });
109
+ continue;
110
+ }
111
+ const measurement = this.options.measureBytes
112
+ ? await measurePath(path, {
113
+ maxEntries: this.options.maxEntries,
114
+ ...(context.signal === undefined ? {} : { signal: context.signal }),
115
+ })
116
+ : undefined;
117
+ const canonicalKey = `${this.id}:${candidate.kind}:${resolve(path)}`;
118
+ const resourceId = `${this.id}:${candidate.kind}:${sha256(canonicalKey)}`;
119
+ resources.push({
120
+ resource: {
121
+ id: resourceId,
122
+ adapter: this.id,
123
+ kind: candidate.kind,
124
+ canonicalKey,
125
+ displayName: candidate.displayName,
126
+ path: resolve(path),
127
+ },
128
+ observedAt: context.now.toISOString(),
129
+ exists: true,
130
+ ...(measurement === undefined ? {} : { measuredBytes: measurement.bytes }),
131
+ facts: {
132
+ reportOnly: true,
133
+ entries: measurement?.entries,
134
+ symlinksSkipped: measurement?.symlinksSkipped,
135
+ measurementTruncated: measurement?.truncated,
136
+ },
137
+ });
138
+ }
139
+ catch (error) {
140
+ if (isMissing(error)) {
141
+ continue;
142
+ }
143
+ diagnostics.push({
144
+ severity: "warning",
145
+ code: "RESOURCE_INSPECTION_FAILED",
146
+ message: error instanceof Error ? error.message : String(error),
147
+ adapter: this.id,
148
+ });
149
+ }
150
+ }
151
+ return { resources, diagnostics };
152
+ }
153
+ async classify(context, resource) {
154
+ const observedAt = context.now.toISOString();
155
+ return {
156
+ schemaVersion: 1,
157
+ findingId: `${resource.resource.id}:${sha256(context.auditId)}`,
158
+ auditId: context.auditId,
159
+ observedAt,
160
+ resource: resource.resource,
161
+ state: "protected",
162
+ confidence: "certain",
163
+ roots: [
164
+ {
165
+ code: "provider-owned-report-only",
166
+ source: this.id,
167
+ observedAt,
168
+ detail: "This adapter inventories provider state but does not clean it.",
169
+ },
170
+ ],
171
+ facts: resource.facts,
172
+ candidateActions: [],
173
+ ...(resource.measuredBytes === undefined ? {} : { measuredBytes: resource.measuredBytes }),
174
+ warnings: [],
175
+ };
176
+ }
177
+ }
178
+ //# sourceMappingURL=provider-adapter.js.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"provider-adapter.js","sourceRoot":"","sources":["../../src/adapters/provider-adapter.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,kBAAkB,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAO1C,OAAO,EAAE,MAAM,EAAE,MAAM,mBAAmB,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAUjD,SAAS,SAAS,CAAC,KAAc;IAC/B,OAAO,CACL,KAAK,YAAY,KAAK,IAAI,MAAM,IAAI,KAAK,IAAK,KAA+B,CAAC,IAAI,KAAK,QAAQ,CAChG,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,oBAAoB;IAIZ,IAAI;IACJ,OAAO;IAJjB,EAAE,CAAS;IAEpB,YACmB,IAAkB,EAClB,OAA+B;oBAD/B,IAAI;uBACJ,OAAO;QAExB,IAAI,CAAC,EAAE,GAAG,IAAI,CAAC,EAAE,CAAC;IACpB,CAAC;IAEO,IAAI,CAAC,OAAqB;QAChC,OAAO,OAAO,CACZ,IAAI,CAAC,OAAO,CAAC,IAAI;YACf,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC,CACjF,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK,CAAC,OAAqB;QAC/B,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAEhC,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;YAChC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;gBAC3B,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,MAAM,EAAE,UAAU;oBAClB,IAAI;oBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,sCAAsC;oBACtE,WAAW,EAAE;wBACX;4BACE,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,uBAAuB;4BAC7B,OAAO,EAAE,yDAAyD;4BAClE,OAAO,EAAE,IAAI,CAAC,EAAE;yBACjB;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC;gBACzB,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,MAAM,EAAE,UAAU;oBAClB,IAAI;oBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,0BAA0B;oBAC1D,WAAW,EAAE;wBACX;4BACE,QAAQ,EAAE,SAAS;4BACnB,IAAI,EAAE,6BAA6B;4BACnC,OAAO,EAAE,kDAAkD;4BAC3D,OAAO,EAAE,IAAI,CAAC,EAAE;yBACjB;qBACF;iBACF,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,WAAW;gBACnB,IAAI;gBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,kBAAkB;gBAClD,WAAW,EAAE,EAAE;aAChB,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;gBACrB,OAAO;oBACL,OAAO,EAAE,IAAI,CAAC,EAAE;oBAChB,MAAM,EAAE,QAAQ;oBAChB,IAAI;oBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,sBAAsB;oBACtD,WAAW,EAAE,EAAE;iBAChB,CAAC;YACJ,CAAC;YAED,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,EAAE;gBAChB,MAAM,EAAE,UAAU;gBAClB,IAAI;gBACJ,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,CAAC,WAAW,mCAAmC;gBACnE,WAAW,EAAE;oBACX;wBACE,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,0BAA0B;wBAChC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;wBAC/D,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB;iBACF;aACF,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,OAAO,CAAC,OAAqB,EAAE,KAAmB;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YAC7D,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,WAAW,EAAE,EAAE,EAAE,CAAC;QAC5C,CAAC;QAED,MAAM,SAAS,GAAuB,EAAE,CAAC;QACzC,MAAM,WAAW,GAAiB,EAAE,CAAC;QAErC,KAAK,MAAM,SAAS,IAAI,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC5C,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,CAAC;YACjC,MAAM,IAAI,GACR,SAAS,CAAC,YAAY,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,SAAS,CAAC,YAAY,CAAC,CAAC;YAEzF,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;gBAChC,IAAI,KAAK,CAAC,cAAc,EAAE,EAAE,CAAC;oBAC3B,WAAW,CAAC,IAAI,CAAC;wBACf,QAAQ,EAAE,SAAS;wBACnB,IAAI,EAAE,0BAA0B;wBAChC,OAAO,EAAE,+CAA+C;wBACxD,OAAO,EAAE,IAAI,CAAC,EAAE;qBACjB,CAAC,CAAC;oBACH,SAAS;gBACX,CAAC;gBAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,YAAY;oBAC3C,CAAC,CAAC,MAAM,WAAW,CAAC,IAAI,EAAE;wBACtB,UAAU,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU;wBACnC,GAAG,CAAC,OAAO,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;qBACpE,CAAC;oBACJ,CAAC,CAAC,SAAS,CAAC;gBACd,MAAM,YAAY,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;gBACrE,MAAM,UAAU,GAAG,GAAG,IAAI,CAAC,EAAE,IAAI,SAAS,CAAC,IAAI,IAAI,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBAE1E,SAAS,CAAC,IAAI,CAAC;oBACb,QAAQ,EAAE;wBACR,EAAE,EAAE,UAAU;wBACd,OAAO,EAAE,IAAI,CAAC,EAAE;wBAChB,IAAI,EAAE,SAAS,CAAC,IAAI;wBACpB,YAAY;wBACZ,WAAW,EAAE,SAAS,CAAC,WAAW;wBAClC,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC;qBACpB;oBACD,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE;oBACrC,MAAM,EAAE,IAAI;oBACZ,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,WAAW,CAAC,KAAK,EAAE,CAAC;oBAC1E,KAAK,EAAE;wBACL,UAAU,EAAE,IAAI;wBAChB,OAAO,EAAE,WAAW,EAAE,OAAO;wBAC7B,eAAe,EAAE,WAAW,EAAE,eAAe;wBAC7C,oBAAoB,EAAE,WAAW,EAAE,SAAS;qBAC7C;iBACF,CAAC,CAAC;YACL,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,SAAS;gBACX,CAAC;gBAED,WAAW,CAAC,IAAI,CAAC;oBACf,QAAQ,EAAE,SAAS;oBACnB,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBAC/D,OAAO,EAAE,IAAI,CAAC,EAAE;iBACjB,CAAC,CAAC;YACL,CAAC;QACH,CAAC;QAED,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,OAAqB,EAAE,QAA0B;QAC9D,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,EAAE,CAAC;QAC7C,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,SAAS,EAAE,GAAG,QAAQ,CAAC,QAAQ,CAAC,EAAE,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE;YAC/D,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,UAAU;YACV,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,KAAK,EAAE,WAAW;YAClB,UAAU,EAAE,SAAS;YACrB,KAAK,EAAE;gBACL;oBACE,IAAI,EAAE,4BAA4B;oBAClC,MAAM,EAAE,IAAI,CAAC,EAAE;oBACf,UAAU;oBACV,MAAM,EAAE,gEAAgE;iBACzE;aACF;YACD,KAAK,EAAE,QAAQ,CAAC,KAAK;YACrB,gBAAgB,EAAE,EAAE;YACpB,GAAG,CAAC,QAAQ,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,QAAQ,CAAC,aAAa,EAAE,CAAC;YAC1F,QAAQ,EAAE,EAAE;SACb,CAAC;IACJ,CAAC;CACF"}
@@ -0,0 +1,16 @@
1
+ import type { AdapterId } from "../config/schema.js";
2
+ import type { ResourceKind } from "../contracts/resource.js";
3
+ export type ProviderAdapterId = Exclude<AdapterId, "git" | "docker">;
4
+ export type ProviderResourceSpec = {
5
+ relativePath: string;
6
+ displayName: string;
7
+ kind: ResourceKind;
8
+ };
9
+ export type ProviderSpec = {
10
+ id: ProviderAdapterId;
11
+ displayName: string;
12
+ defaultRoot(home: string, platform: NodeJS.Platform): string;
13
+ resources: ProviderResourceSpec[];
14
+ };
15
+ export declare const PROVIDER_SPECS: Record<ProviderAdapterId, ProviderSpec>;
16
+ //# sourceMappingURL=provider-specs.d.ts.map
@@ -0,0 +1 @@
1
+ {"version":3,"file":"provider-specs.d.ts","sourceRoot":"","sources":["../../src/adapters/provider-specs.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,qBAAqB,CAAC;AACrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,0BAA0B,CAAC;AAE7D,MAAM,MAAM,iBAAiB,GAAG,OAAO,CAAC,SAAS,EAAE,KAAK,GAAG,QAAQ,CAAC,CAAC;AAErE,MAAM,MAAM,oBAAoB,GAAG;IACjC,YAAY,EAAE,MAAM,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,YAAY,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,iBAAiB,CAAC;IACtB,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC;IAC7D,SAAS,EAAE,oBAAoB,EAAE,CAAC;CACnC,CAAC;AAMF,eAAO,MAAM,cAAc,EAAE,MAAM,CAAC,iBAAiB,EAAE,YAAY,CAuJlE,CAAC"}