ai-maestro 1.0.0

package/src/runner.mjs

@@ -0,0 +1,243 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { CONFIG } from './config.mjs';
+import { pathExists } from './files.mjs';
+import { stampSchemaVersion, validateRunEntry } from './schema.mjs';
+import { redactCredentials, redactObject } from './format.mjs';
+
+const runsFilePath = path.join(CONFIG.maestroPath, 'RUNS.jsonl');
+const latestRunPath = path.join(CONFIG.maestroPath, 'latest-run.json');
+
+function makeRunId() {
+  return Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 10);
+}
+
+function artifactPath(kind, runId) {
+  const dir = kind === 'report' ? 'reports' : 'logs';
+  const ext = kind === 'report' ? '.md' : '.log';
+  return path.join(CONFIG.maestroPath, dir, 'run-' + runId + ext);
+}
+
+function publicPath(filePath) {
+  return filePath.split(path.sep).join('/');
+}
+
+async function writeAtomicUtf8(filePath, content) {
+  await fs.mkdir(path.dirname(filePath), { recursive: true });
+  const tempPath = filePath + '.tmp-' + process.pid + '-' + Date.now();
+  await fs.writeFile(tempPath, content, { encoding: 'utf8' });
+  await fs.rename(tempPath, filePath);
+}
+
+async function readLatestRunIndex() {
+  try {
+    return JSON.parse(await fs.readFile(latestRunPath, 'utf-8'));
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) {
+      return { latest: null, byTask: {}, byRunId: {} };
+    }
+    throw error;
+  }
+}
+
+async function writeLatestRunIndex(entry) {
+  const index = await readLatestRunIndex();
+  const safeEntry = redactObject(entry);
+  const next = {
+    latest: safeEntry,
+    byTask: {
+      ...(index.byTask || {}),
+      [String(entry.taskId)]: safeEntry
+    },
+    byRunId: {
+      ...(index.byRunId || {}),
+      [entry.runId]: safeEntry
+    }
+  };
+  await writeAtomicUtf8(latestRunPath, JSON.stringify(next, null, 2) + '\n');
+  return next;
+}
+
+function buildRunLog({ run, fullStdout = '', fullStderr = '' }) {
+  return redactCredentials([
+    'AI Maestro run ' + run.runId,
+    'Task: #' + run.taskId,
+    'Status: ' + run.status,
+    'Strategy: ' + (run.strategy || 'none'),
+    'Exit code: ' + (run.exitCode === undefined ? 'n/a' : run.exitCode),
+    'Started: ' + (run.startTime || 'n/a'),
+    'Ended: ' + (run.endTime || 'n/a'),
+    '',
+    '--- stdout ---',
+    fullStdout || '',
+    '',
+    '--- stderr ---',
+    fullStderr || ''
+  ].join('\n'));
+}
+
+function buildRunReport({ run, fullStdout = '', fullStderr = '', diffText = '' }) {
+  const changed = [
+    ...(run.changedFiles || []),
+    ...(run.createdFiles || []),
+    ...(run.deletedFiles || [])
+  ];
+  return redactCredentials([
+    '# AI Maestro Run Report',
+    '',
+    '- RunId: ' + run.runId,
+    '- Task: #' + run.taskId,
+    '- Status: ' + run.status,
+    '- Strategy: ' + (run.strategy || 'none'),
+    '- Exit code: ' + (run.exitCode === undefined ? 'n/a' : run.exitCode),
+    '- Started: ' + (run.startTime || 'n/a'),
+    '- Ended: ' + (run.endTime || 'n/a'),
+    '',
+    '## Warnings',
+    '',
+    (run.warnings && run.warnings.length ? run.warnings.map(item => '- ' + item).join('\n') : '- none'),
+    '',
+    '## Changed Files',
+    '',
+    (changed.length ? changed.map(item => '- ' + item).join('\n') : '- none'),
+    '',
+    '## Diff',
+    '',
+    diffText || '(no diff captured)',
+    '',
+    '## stdout',
+    '',
+    '```text',
+    fullStdout || '',
+    '```',
+    '',
+    '## stderr',
+    '',
+    '```text',
+    fullStderr || '',
+    '```',
+    ''
+  ].join('\n'));
+}
+
+export async function logRun(runDetails) {
+  const {
+    fullStdout = runDetails.stdout || '',
+    fullStderr = runDetails.stderr || '',
+    diffText = '',
+    ...publicRunDetails
+  } = runDetails;
+  const runId = publicRunDetails.runId || makeRunId();
+  const logPath = artifactPath('log', runId);
+  const reportPath = artifactPath('report', runId);
+  const stamped = redactObject(stampSchemaVersion({
+    ...publicRunDetails,
+    runId,
+    logPath: publicPath(logPath),
+    reportPath: publicPath(reportPath)
+  }));
+  const result = validateRunEntry(stamped);
+  if (!result.ok) {
+    console.warn('Run entry for task #' + stamped.taskId + ' failed schema validation: ' + result.errors.join(', '));
+  }
+  await writeAtomicUtf8(logPath, buildRunLog({ run: stamped, fullStdout, fullStderr }));
+  await writeAtomicUtf8(reportPath, buildRunReport({ run: stamped, fullStdout, fullStderr, diffText }));
+  await writeLatestRunIndex({
+    runId,
+    taskId: stamped.taskId,
+    logPath: publicPath(logPath),
+    reportPath: publicPath(reportPath),
+    status: stamped.status,
+    updatedAt: stamped.endTime || new Date().toISOString()
+  });
+  if (await pathExists(runsFilePath)) {
+    await fs.copyFile(runsFilePath, runsFilePath + '.bak');
+  }
+  await fs.appendFile(runsFilePath, JSON.stringify(stamped) + '\n', { encoding: 'utf8' });
+  return stamped;
+}
+
+export async function getRecentRuns(limit = 5) {
+  try {
+    const content = await fs.readFile(runsFilePath, 'utf-8');
+    return content
+      .split(/\r?\n/)
+      .filter(Boolean)
+      .slice(-limit)
+      .map(line => {
+        try {
+          return JSON.parse(line);
+        } catch (error) {
+          return { parseError: error.message, raw: line };
+        }
+      });
+  } catch (error) {
+    if (error.code === 'ENOENT') {
+      return [];
+    }
+    throw error;
+  }
+}
+
+export async function getLatestRunForTask(taskId) {
+  const runs = await getRecentRuns(Infinity);
+  for (let i = runs.length - 1; i >= 0; i--) {
+    if (String(runs[i].taskId) === String(taskId)) {
+      return runs[i];
+    }
+  }
+  return null;
+}
+
+export async function resolveRunArtifact({ kind, runId, taskId, latest = false }) {
+  const index = await readLatestRunIndex();
+  let entry = null;
+  if (latest && taskId !== undefined && taskId !== null) {
+    entry = index.byTask ? index.byTask[String(taskId)] : null;
+    if (!entry) {
+      throw new Error('No run found for task #' + taskId + '.');
+    }
+  } else if (runId) {
+    entry = index.byRunId ? index.byRunId[runId] : null;
+    if (!entry) {
+      const candidate = artifactPath(kind, runId);
+      if (await pathExists(candidate)) {
+        entry = { runId, taskId: null, logPath: publicPath(artifactPath('log', runId)), reportPath: publicPath(artifactPath('report', runId)) };
+      } else {
+        throw new Error('Run "' + runId + '" not found. Use "maestro task show <id>" or "maestro run-log --task <id> --latest".');
+      }
+    }
+  } else {
+    const command = kind === 'log' ? 'run-log' : 'report';
+    throw new Error('Missing run id. Usage: maestro ' + command + ' <run-id> or maestro ' + command + ' --task <id> --latest.');
+  }
+  const selectedPath = kind === 'report' ? entry.reportPath : entry.logPath;
+  if (!selectedPath) {
+    throw new Error('Run "' + entry.runId + '" has no ' + kind + ' path in .maestro/latest-run.json.');
+  }
+  if (!(await pathExists(selectedPath))) {
+    throw new Error('Run "' + entry.runId + '" ' + kind + ' file is missing: ' + selectedPath);
+  }
+  return { ...entry, path: selectedPath };
+}
+
+export function selectArtifactLines(content, { lines, tail = false } = {}) {
+  if (!lines) {
+    return content;
+  }
+  const allLines = String(content).split(/\r?\n/);
+  while (tail && allLines.length && allLines[allLines.length - 1] === '') {
+    allLines.pop();
+  }
+  const selected = tail ? allLines.slice(-lines) : allLines.slice(0, lines);
+  return selected.join('\n');
+}
+
+export async function readRunArtifact({ kind, runId, taskId, latest = false, lines, tail = false }) {
+  const resolved = await resolveRunArtifact({ kind, runId, taskId, latest });
+  const content = redactCredentials(await fs.readFile(resolved.path, 'utf-8'));
+  return {
+    ...resolved,
+    content: selectArtifactLines(content, { lines, tail })
+  };
+}

package/src/safety.mjs

@@ -0,0 +1,116 @@
+import fs from 'fs/promises';
+import path from 'path';
+import { CONFIG } from './config.mjs';
+import { detectAffirmativeDeploymentIntent } from './orchestration/deployment-intent.mjs';
+
+const STALE_DEPLOY_PATTERNS = new Set(['\\bdeploy\\b', '\\bpublish\\b.*\\bprod']);
+
+const defaultSafety = {
+  protectedFiles: [
+    '\\.env\\b',
+    '\\.env$',
+    '\\.env\\.',
+    'id_rsa$',
+    'id_ed25519$',
+    'known_hosts$',
+    '\\.pem$',
+    '\\.ssh\\\\',
+    'sshd_config$'
+  ],
+  dangerousPatterns: [
+    'rm\\s+-rf',
+    'Remove-Item.*-Recurse.*-Force',
+    'rd\\s+/s\\s*/q',
+    'del\\s+/s\\s*/q',
+    'DROP\\s+TABLE',
+    'DROP\\s+DATABASE',
+    'DELETE\\s+FROM',
+    'TRUNCATE\\s+TABLE',
+    'git\\s+push.*--force',
+    'git\\s+reset\\s+--hard',
+    'git\\s+clean\\s+-f',
+    'terraform\\s+destroy',
+    'kubectl\\s+delete',
+    'docker\\s+system\\s+prune',
+    'docker\\s+volume\\s+rm',
+    'format\\s+[a-zA-Z]:',
+    '\\.ssh\\\\config',
+    'sshd_config',
+    'shutdown\\s+/',
+    'Stop-Computer',
+    'Restart-Computer'
+  ]
+};
+
+export function checkDeploymentSafety(text) {
+  const normalizedText = String(text || '');
+  const hasProductionTarget = /\bprod/i.test(normalizedText);
+  if (hasProductionTarget && detectAffirmativeDeploymentIntent(normalizedText)) {
+    return { blocked: true, reason: 'affirmative deploy intent targeting production' };
+  }
+  return { blocked: false, reason: null };
+}
+
+export function migrateSafetyConfig(safetyConfig) {
+  const source = safetyConfig && typeof safetyConfig === 'object' ? safetyConfig : {};
+  const dangerousPatterns = Array.isArray(source.dangerousPatterns) ? source.dangerousPatterns : [];
+  const migratedPatterns = dangerousPatterns.filter(pattern => !STALE_DEPLOY_PATTERNS.has(pattern));
+  const changed = migratedPatterns.length !== dangerousPatterns.length;
+  return {
+    changed,
+    config: {
+      ...source,
+      protectedFiles: Array.isArray(source.protectedFiles) ? source.protectedFiles : defaultSafety.protectedFiles,
+      dangerousPatterns: migratedPatterns
+    }
+  };
+}
+
+export async function ensureSafetyConfig() {
+  await fs.mkdir(CONFIG.maestroPath, { recursive: true });
+  const safetyPath = path.join(CONFIG.maestroPath, 'safety.json');
+  try {
+    const existing = JSON.parse(await fs.readFile(safetyPath, 'utf-8'));
+    const migration = migrateSafetyConfig(existing);
+    if (migration.changed) {
+      await fs.writeFile(safetyPath, JSON.stringify(migration.config, null, 2));
+    }
+  } catch (error) {
+    if (error.code !== 'ENOENT') {
+      throw error;
+    }
+    await fs.writeFile(safetyPath, JSON.stringify(defaultSafety, null, 2));
+  }
+  return safetyPath;
+}
+
+export async function checkTaskSafety(text) {
+  const safetyPath = await ensureSafetyConfig();
+  const safety = JSON.parse(await fs.readFile(safetyPath, 'utf-8'));
+  const findings = [];
+  for (const pattern of safety.dangerousPatterns || []) {
+    if (new RegExp(pattern, 'i').test(text)) {
+      findings.push('dangerous pattern: ' + pattern);
+    }
+  }
+  const deployment = checkDeploymentSafety(text);
+  if (deployment.blocked) {
+    findings.push('dangerous pattern: affirmative deploy intent: ' + deployment.reason);
+  }
+  for (const pattern of safety.protectedFiles || []) {
+    if (new RegExp(pattern, 'i').test(text)) {
+      findings.push('protected file: ' + pattern);
+    }
+  }
+  return { ok: findings.length === 0, findings, safetyPath };
+}
+
+export async function executeTaskWithSafety(task, workerFn, onBlocked = async () => {}) {
+  const text = [task.title || '', task.description || ''].join('\n');
+  const safety = await checkTaskSafety(text);
+  if (!safety.ok) {
+    await onBlocked({ task, safety });
+    return { blocked: true, safety };
+  }
+  return { blocked: false, result: await workerFn() };
+}