ai-foreman 1.7.19 → 1.7.21

package/dist/graph/boundary.d.ts

@@ -0,0 +1,15 @@
+import type { BuilderAdapter } from "../adapters/types.js";
+export declare const GRAPH_CHANGE_SIGNAL = "RAFI_GRAPH_MAINTENANCE: meaningful-indexed-change";
+export interface GraphPendingTask {
+    version: 1;
+    state: "pending" | "attempted";
+    scope: string;
+    workspace: string;
+    logicalTaskId: string;
+    reason: string;
+    outcome?: unknown;
+}
+/** A completed editing assignment plus host-observed source change is required.
+ * Changed bytes alone are deliberately insufficient to establish this trigger. */
+export declare function queueGraphMaintenance(root: string, workspace: string, logicalTaskId: string, response: string, sourceChanged: boolean): void;
+export declare function maintainGraphTask(root: string, workspace: string, logicalTaskId: string, host: BuilderAdapter): Promise<unknown>;

package/dist/graph/boundary.js

@@ -0,0 +1,50 @@
+import { WorkflowDb } from "../workflowDb.js";
+import { withActivityPhase } from "../activity.js";
+import { loadGraphConfig } from "./config.js";
+import { graphScope } from "./read.js";
+import { refreshGraph } from "./maintenance.js";
+import { graphSemanticHost } from "./host.js";
+import { digest } from "./util.js";
+export const GRAPH_CHANGE_SIGNAL = "RAFI_GRAPH_MAINTENANCE: meaningful-indexed-change";
+/** A completed editing assignment plus host-observed source change is required.
+ * Changed bytes alone are deliberately insufficient to establish this trigger. */
+export function queueGraphMaintenance(root, workspace, logicalTaskId, response, sourceChanged) {
+    if (!sourceChanged || !response.split(/\r?\n/).some(line => line.trim() === GRAPH_CHANGE_SIGNAL))
+        return;
+    const effective = loadGraphConfig(root);
+    if (!effective.enabled || effective.config?.maintenance !== "selective")
+        return;
+    const scope = graphScope(workspace), id = digest("pending-task", { scope, logicalTaskId, policy: effective.policyDigest });
+    const db = new WorkflowDb(root);
+    try {
+        const store = db.graphStore();
+        if (!store.get("job", id))
+            store.put("job", id, { version: 1, state: "pending", scope, workspace, logicalTaskId, reason: "Completed editing agent declared indexed relationships or behavior changed; host observed source change" });
+    }
+    finally {
+        db.close();
+    }
+}
+export async function maintainGraphTask(root, workspace, logicalTaskId, host) {
+    const effective = loadGraphConfig(root);
+    if (!effective.enabled || effective.config?.maintenance !== "selective")
+        return;
+    const scope = graphScope(workspace), id = digest("pending-task", { scope, logicalTaskId, policy: effective.policyDigest });
+    const db = new WorkflowDb(root);
+    try {
+        const store = db.graphStore(), pending = store.get("job", id);
+        if (!pending || pending.value.state !== "pending")
+            return;
+        // Reserve the attempt before awaiting any child; duplicate consumers cannot
+        // each start semantic/provider work for this same editing boundary.
+        store.put("job", id, { ...pending.value, state: "attempted" }, pending.revision);
+        const outcome = await withActivityPhase("updating scoped Graphify evidence", () => refreshGraph(root, workspace, logicalTaskId, { semanticHost: graphSemanticHost(root, host) }));
+        store.put("job", id, { ...pending.value, state: "attempted", outcome });
+        if (outcome.state !== "published")
+            console.error(`rafi graph: maintenance ${outcome.state}: ${outcome.reason ?? "inspect graph status for recovery"}`);
+        return outcome;
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/graph/bridge.d.ts

@@ -0,0 +1,9 @@
+/** Resolve existing tools only. Never executes discovery commands which can install. */
+export declare function graphPythonCandidates(): string[];
+export declare function resolveGraphPython(): Promise<string>;
+export declare function runBridge<T>(python: string, input: unknown, options?: {
+    timeoutMs?: number;
+    maxOutputBytes?: number;
+    cwd?: string;
+    signal?: AbortSignal;
+}): Promise<T>;

package/dist/graph/bridge.js

@@ -0,0 +1,146 @@
+import { spawn } from "node:child_process";
+import { existsSync, readFileSync, realpathSync } from "node:fs";
+import { delimiter, dirname, join } from "node:path";
+import { fileURLToPath } from "node:url";
+const asset = fileURLToPath(new URL("./bridge.py", import.meta.url));
+/** Resolve existing tools only. Never executes discovery commands which can install. */
+export function graphPythonCandidates() {
+    const candidates = [];
+    if (process.env.RAFI_GRAPH_PYTHON)
+        candidates.push(process.env.RAFI_GRAPH_PYTHON);
+    for (const dir of (process.env.PATH ?? "").split(delimiter).filter(Boolean)) {
+        const bin = join(dir, process.platform === "win32" ? "graphify.exe" : "graphify");
+        if (existsSync(bin)) {
+            if (process.platform === "win32")
+                candidates.push(join(dirname(dirname(bin)), "python.exe"));
+            else {
+                const line = readFileSync(realpathSync(bin), "utf8").split(/\r?\n/, 1)[0];
+                if (line?.startsWith("#!/") && !line.slice(2).includes("\0") && !line.includes("/env "))
+                    candidates.push(line.slice(2).trim());
+            }
+        }
+    }
+    candidates.push(process.platform === "win32" ? "python" : "python3");
+    return [...new Set(candidates)];
+}
+function dispatchBridge(python, input, options = {}) {
+    if (options.signal?.aborted)
+        return Promise.reject(new Error("Graph operation cancelled"));
+    const serialized = JSON.stringify(input);
+    if (Buffer.byteLength(serialized) > 128 * 1024 * 1024)
+        return Promise.reject(new Error("Graph bridge input budget exceeded"));
+    return new Promise((resolve, reject) => {
+        const env = { PATH: process.env.PATH, SystemRoot: process.env.SystemRoot, WINDIR: process.env.WINDIR, PYTHONDONTWRITEBYTECODE: "1", PYTHONNOUSERSITE: "1", PYTHONHASHSEED: "0" };
+        const child = spawn(python, ["-I", "-B", asset], { cwd: options.cwd, env, stdio: ["pipe", "pipe", "pipe"], windowsHide: true, detached: process.platform !== "win32" });
+        let done = false, size = 0, errorBytes = 0;
+        const chunks = [];
+        const stop = () => {
+            try {
+                if (process.platform !== "win32" && child.pid)
+                    process.kill(-child.pid, "SIGKILL");
+                else
+                    child.kill("SIGKILL");
+            }
+            catch {
+                child.kill("SIGKILL");
+            }
+        };
+        const finish = (error, result) => {
+            if (done)
+                return;
+            done = true;
+            clearTimeout(timer);
+            options.signal?.removeEventListener("abort", aborted);
+            if (error) {
+                stop();
+                reject(error);
+            }
+            else
+                resolve(result);
+        };
+        const aborted = () => finish(new Error("Graph operation cancelled"));
+        const timer = setTimeout(() => finish(new Error("Graph bridge deadline exceeded")), options.timeoutMs ?? 15000);
+        options.signal?.addEventListener("abort", aborted, { once: true });
+        if (options.signal?.aborted)
+            aborted();
+        child.on("error", error => finish(error));
+        child.stdout.on("data", (chunk) => {
+            size += chunk.length;
+            if (size > (options.maxOutputBytes ?? 1024 * 1024))
+                finish(new Error("Graph bridge output limit exceeded"));
+            else
+                chunks.push(chunk);
+        });
+        child.stderr.on("data", (chunk) => {
+            errorBytes += chunk.length;
+            if (errorBytes > 64 * 1024)
+                finish(new Error("Graph bridge diagnostic limit exceeded"));
+        });
+        child.stdin.on("error", error => finish(error));
+        child.on("close", code => {
+            if (done)
+                return;
+            try {
+                const result = JSON.parse(Buffer.concat(chunks).toString("utf8"));
+                if (code !== 0 || result.ok !== true)
+                    throw new Error(result.error ?? `Graph bridge exited ${code}`);
+                finish(undefined, result.result);
+            }
+            catch (error) {
+                finish(error instanceof Error ? error : new Error(String(error)));
+            }
+        });
+        child.stdin.end(serialized);
+    });
+}
+export async function resolveGraphPython() {
+    const errors = [];
+    for (const candidate of graphPythonCandidates()) {
+        try {
+            await runBridge(candidate, { action: "probe" }, { timeoutMs: 5000 });
+            return candidate;
+        }
+        catch (error) {
+            errors.push(String(error));
+        }
+    }
+    throw new Error(`Compatible graphifyy==0.9.82 unavailable. Run graph adopt to repair an authorized installation. ${errors.at(-1) ?? ""}`);
+}
+let activeWorkers = 0;
+const workerWaiters = [];
+export async function runBridge(python, input, options = {}) {
+    const deadline = Date.now() + (options.timeoutMs ?? 15000);
+    if (options.signal?.aborted)
+        throw new Error("Graph operation cancelled");
+    if (activeWorkers >= 2)
+        await new Promise((resolve, reject) => {
+            const cleanup = () => { clearTimeout(timer); options.signal?.removeEventListener("abort", abort); };
+            const ready = () => { cleanup(); resolve(); };
+            const fail = (message) => {
+                const index = workerWaiters.indexOf(ready);
+                if (index < 0)
+                    return;
+                workerWaiters.splice(index, 1);
+                cleanup();
+                reject(new Error(message));
+            };
+            const abort = () => fail("Graph operation cancelled while waiting for worker capacity");
+            const timer = setTimeout(() => fail("Graph worker capacity deadline exceeded"), Math.max(1, deadline - Date.now()));
+            workerWaiters.push(ready);
+            options.signal?.addEventListener("abort", abort, { once: true });
+            if (options.signal?.aborted)
+                abort();
+        });
+    else
+        activeWorkers++;
+    try {
+        return await dispatchBridge(python, input, { ...options, timeoutMs: Math.max(1, deadline - Date.now()) });
+    }
+    finally {
+        const next = workerWaiters.shift();
+        if (next)
+            next(); // Transfer the occupied slot directly to the queued caller.
+        else
+            activeWorkers--;
+    }
+}

package/dist/graph/bridge.py

@@ -0,0 +1,205 @@
+"""Pinned Graphify adapter. One bounded JSON request on stdin, one JSON result.
+
+Read requests never call Graphify's CLI/server loaders, query logging or detectors.
+The audit hook denies filesystem writes, subprocesses and networking in read mode.
+"""
+import sys
+sys.dont_write_bytecode = True
+import json
+import os
+import importlib.metadata
+from pathlib import Path
+
+# OS address-space cap where supported; conservative collection admission below
+# also applies on platforms without resource controls.
+resource_controls = {"addressSpaceBytes": None, "cpuSeconds": None,
+                     "memoryEnforcement": "collection-admission-only"}
+try:
+    import resource
+    try:
+        resource.setrlimit(resource.RLIMIT_AS, (512 * 1024 * 1024, 512 * 1024 * 1024))
+        resource_controls["addressSpaceBytes"] = 512 * 1024 * 1024
+        resource_controls["memoryEnforcement"] = "os-address-space-limit"
+    except (ValueError, OSError):
+        pass
+    try:
+        resource.setrlimit(resource.RLIMIT_CPU, (300, 300))
+        resource_controls["cpuSeconds"] = 300
+    except (ValueError, OSError):
+        pass
+except ImportError:
+    pass
+MAX_WIRE = 128 * 1024 * 1024
+raw = sys.stdin.buffer.read(MAX_WIRE + 1)
+if len(raw) > MAX_WIRE:
+    raise ValueError("bridge input limit exceeded")
+request = json.loads(raw)
+write_root = Path(request["staging"]).resolve() if request.get("action") == "extract" else None
+
+
+def audit(event, args):
+    if event.startswith(("socket.", "subprocess.", "os.system", "os.exec", "os.spawn", "os.fork", "os.posix_spawn")):
+        raise PermissionError("graph bridge cannot start processes or use network")
+    paths = []
+    if event == "open":
+        path, mode, flags = args
+        writing = isinstance(mode, str) and any(c in mode for c in "wax+")
+        writing = writing or isinstance(flags, int) and bool(flags & (os.O_WRONLY | os.O_RDWR | os.O_CREAT | os.O_TRUNC | os.O_APPEND))
+        if writing:
+            paths = [path]
+    elif event in ("os.mkdir", "os.remove", "os.rmdir", "os.chmod", "os.utime", "os.truncate"):
+        paths = [args[0]]
+    elif event in ("os.rename", "os.link", "os.symlink"):
+        paths = list(args[:2])
+    for path in paths:
+        # fdopen on an already confined tempfile descriptor is safe: this child
+        # inherits only stdio and all path-based writable opens pass this hook.
+        if write_root and isinstance(path, int):
+            continue
+        if not write_root or not isinstance(path, (str, bytes)) or not Path(os.fsdecode(path)).resolve().is_relative_to(write_root):
+            raise PermissionError("graph bridge write outside authorized staging")
+
+
+sys.addaudithook(audit)
+
+
+def main():
+    version = importlib.metadata.version("graphifyy")
+    if version != "0.9.82":
+        raise ValueError("incompatible Graphify version: " + version)
+    if request.get("action") == "probe":
+        import graphify.serve
+        return {"version": version, "schema": 1, "python": sys.version.split()[0]}
+    if request.get("action") == "extract":
+        from graphify.extract import extract
+        from graphify.build import build_from_json
+        from networkx.readwrite import json_graph
+        root = write_root / "input"
+        paths = []
+        for relative in request["paths"]:
+            path = (root / relative).resolve()
+            if not path.is_relative_to(root) or path.is_symlink():
+                raise ValueError("escaped captured input")
+            paths.append(path)
+        # Copy only content/version-keyed AST entries for the current capture.
+        # Upstream rebases portable cached IDs onto this immutable input root.
+        import hashlib
+        from graphify import cache
+        copied = 0
+        parent = request.get("parentCache")
+        expected = request.get("cacheChecksums", {})
+        if parent:
+            namespace = "graphify-out/cache/ast/v" + version + "-s" + str(cache._AST_CACHE_SCHEMA)
+            for path in paths:
+                key = cache.file_hash(path, root, cache_root=write_root)
+                relative = namespace + "/" + key + ".json"
+                previous = Path(parent) / relative
+                if relative not in expected or not previous.is_file() or previous.is_symlink():
+                    continue
+                if previous.stat().st_size > 8 * 1024 * 1024:
+                    raise ValueError("AST cache item budget exceeded")
+                content = previous.read_bytes()
+                if hashlib.sha256(content).hexdigest() != expected[relative]:
+                    raise ValueError("AST cache checksum mismatch")
+                target = write_root / relative
+                target.parent.mkdir(parents=True, exist_ok=True)
+                target.write_bytes(content)
+                copied += 1
+        # All caches and parser work remain inside owned staging; no worker pool.
+        result = extract(paths, root=root, cache_root=write_root, parallel=False)
+        if result.get("failed_sources"):
+            raise ValueError("AST failed inputs: " + repr(result["failed_sources"][:20]))
+        # Never persist staging-directory identities as portable provenance.
+        def portable(value):
+            if isinstance(value, str):
+                return value.replace(str(root) + os.sep, "")
+            if isinstance(value, list):
+                return [portable(v) for v in value]
+            if isinstance(value, dict):
+                return {k: portable(v) for k, v in value.items()}
+            return value
+        result = portable(result)
+        semantic = request.get("semantic", {"nodes": [], "edges": []})
+        result["nodes"].extend(semantic.get("nodes", []))
+        result["edges"].extend(semantic.get("edges", []))
+        graph = build_from_json(result, root=root, directed=True)
+        from graphify.export import to_html
+        if not to_html(graph, {}, str(write_root / "graph.html"), learning_overlay={}):
+            raise ValueError("Required graph visualization was not written")
+        data = json_graph.node_link_data(graph, edges="links")
+        data.setdefault("graph", {}).update(schema_version=1, graphify_version=version)
+        cache_files = {}
+        cache_base = write_root / "graphify-out" / "cache" / "ast"
+        if cache_base.exists():
+            for cached in cache_base.rglob("*.json"):
+                cache_files[cached.relative_to(write_root).as_posix()] = hashlib.sha256(cached.read_bytes()).hexdigest()
+        return {"graph": data, "extraction": result, "cacheFiles": cache_files, "reusedAstInputs": copied}
+
+    import networkx as nx
+    from networkx.readwrite import json_graph
+    from graphify import serve
+    # Optional jieba lazily writes a tokenizer cache. Use the pure fallback.
+    serve._jieba = None
+    data = request["graph"]
+    if data.get("graph", {}).get("schema_version") != 1:
+        raise ValueError("incompatible graph schema")
+    nodes = data.get("nodes")
+    links = data.get("links", data.get("edges"))
+    if not isinstance(nodes, list) or not isinstance(links, list):
+        raise ValueError("invalid graph collections")
+    if len(nodes) > 100000 or len(links) > 300000:
+        raise ValueError("graph memory admission limit exceeded")
+    ids = {n["id"] for n in nodes}
+    if len(ids) != len(nodes) or any(not isinstance(i, str) for i in ids):
+        raise ValueError("invalid or duplicate node identity")
+    if any(e.get("source") not in ids or e.get("target") not in ids or e.get("_src", e["source"]) not in ids or e.get("_tgt", e["target"]) not in ids for e in links):
+        raise ValueError("dangling graph endpoint")
+    graph = json_graph.node_link_graph({**data, "links": links, "directed": True}, edges="links")
+    graph.graph["_logical_directed"] = bool(data.get("directed"))
+    op = request["operation"]
+    seeds = []
+    ambiguous = False
+    for seed in op.get("seeds", []):
+        found = [seed] if seed in graph else serve._find_node(graph, seed)
+        ambiguous = ambiguous or len(found) > 1
+        seeds.extend(found[:16])
+    if op["operation"] == "query":
+        terms = serve._query_terms(op["query"])
+        scores = serve._score_query(graph, terms, collect_per_term_seeds=True)
+        seeds = serve._pick_seeds(scores.ranked, G=graph, best_seed_by_term=scores.best_seed_by_term)[:16]
+    direction = op.get("direction", "both")
+    view = serve._path_search_graph(graph, direction == "both")
+    if direction == "incoming":
+        view = view.reverse(copy=False)
+    selected = set(seeds)
+    if op["operation"] == "path" and len(seeds) == 1 and not ambiguous:
+        targets = [op["target"]] if op["target"] in graph else serve._find_node(graph, op["target"])
+        ambiguous = len(targets) > 1
+        if len(targets) == 1:
+            try:
+                selected = set(nx.shortest_path(view, seeds[0], targets[0]))
+            except nx.NetworkXNoPath:
+                selected = set()
+        else:
+            selected = set(targets)
+    elif op["operation"] not in ("node", "status") and not ambiguous and seeds:
+        selected, _ = serve._bfs(view, seeds, op.get("depth", 2))
+    if op["operation"] == "status":
+        selected = set()
+    selected_order = list(dict.fromkeys([n for n in seeds if n in selected] + sorted(selected)))[:500]
+    kept = set(selected_order)
+    edges = [e for e in links if e["source"] in kept and e["target"] in kept]
+    return {"nodes": [{"id": n, **dict(graph.nodes[n])} for n in selected_order], "edges": edges[:1000], "ambiguous": ambiguous,
+            "truncated": len(selected) > len(kept) or len(edges) > 1000, "nodeCount": len(nodes), "edgeCount": len(links)}
+
+
+try:
+    # Libraries occasionally print extraction diagnostics. Keep stdout framed.
+    import contextlib
+    with contextlib.redirect_stdout(sys.stderr):
+        result = main()
+    result["resourceControls"] = resource_controls
+    sys.stdout.write(json.dumps({"ok": True, "result": result}, ensure_ascii=False))
+except Exception as error:
+    sys.stdout.write(json.dumps({"ok": False, "error": str(error)[:2000]}))
+    sys.exit(1)

package/dist/graph/config.d.ts

@@ -0,0 +1,11 @@
+import { DEFAULT_GRAPH_LIMITS, type GraphAdoptionV1, type GraphConfigV1 } from "rafi-spec";
+export interface EffectiveGraphConfig {
+    config?: GraphConfigV1;
+    adoption?: GraphAdoptionV1;
+    enabled: boolean;
+    reason: string;
+    policyDigest: string;
+    projectRef: string;
+    limits: typeof DEFAULT_GRAPH_LIMITS;
+}
+export declare function loadGraphConfig(configRoot: string): EffectiveGraphConfig;

package/dist/graph/config.js

@@ -0,0 +1,40 @@
+import { existsSync, realpathSync } from "node:fs";
+import { join } from "node:path";
+import { parse } from "yaml";
+import { assertGraphConfig, DEFAULT_GRAPH_LIMITS } from "rafi-spec";
+import { WorkflowReader } from "../workflowReader.js";
+import { digest, readBounded } from "./util.js";
+export function loadGraphConfig(configRoot) {
+    const root = realpathSync(configRoot);
+    const projectRef = digest("project", root);
+    let config;
+    for (const name of ["rafi-config.yaml", "project.yaml"]) {
+        const path = join(root, name);
+        if (!existsSync(path))
+            continue;
+        const raw = parse(readBounded(path, 4 * 1024 * 1024).toString("utf8"));
+        if (raw?.graph !== undefined) {
+            assertGraphConfig(raw.graph);
+            config = raw.graph;
+        }
+        break;
+    }
+    const reader = new WorkflowReader(root);
+    let adoption;
+    try {
+        adoption = reader.graphRecord("adoption", "project")?.value;
+    }
+    finally {
+        reader.close();
+    }
+    if (adoption) {
+        if (adoption.version !== 1)
+            throw new Error("Unsupported graph adoption version");
+        assertGraphConfig(adoption.config);
+    }
+    config ??= adoption?.config;
+    const policyDigest = digest("policy", config ?? null);
+    const enabled = Boolean(config?.enabled && adoption && adoption.policyDigest === policyDigest && adoption.projectRef === projectRef);
+    const reason = !config?.enabled ? "disabled" : !adoption ? "unadopted" : adoption.projectRef !== projectRef ? "destination-adoption-required" : adoption.policyDigest !== policyDigest ? "policy-acceptance-required" : "adopted";
+    return { config, adoption, enabled, reason, policyDigest, projectRef, limits: { ...DEFAULT_GRAPH_LIMITS, ...config?.limits } };
+}

package/dist/graph/corpus.d.ts

@@ -0,0 +1,16 @@
+import type { GraphInputV1, GraphSourceBindingV1 } from "rafi-spec";
+import type { EffectiveGraphConfig } from "./config.js";
+export interface CapturedGraphCorpus {
+    inputs: GraphInputV1[];
+    bytes: Map<string, Buffer>;
+    corpusDigest: string;
+    binding: GraphSourceBindingV1;
+    exclusionsDigest: string;
+}
+export declare function globMatch(path: string, pattern: string): boolean;
+export declare function graphExclusions(workspace: string, inputPaths?: string[]): {
+    text: string;
+    patterns: string[];
+};
+export declare function graphPathAllowed(path: string, config: EffectiveGraphConfig, patterns: string[]): boolean;
+export declare function captureGraphCorpus(workspace: string, configRoot: string, config: EffectiveGraphConfig, sourceRef?: string): CapturedGraphCorpus;