audit-tools 0.31.3 → 0.32.0

package/wrapper/remediate-code-wrapper-install-renderers.mjs

@@ -0,0 +1,58 @@
+/**
+ * Per-host asset render functions for remediate-code install.
+ *
+ * Every host asset is derived from the ONE canonical loader prompt body via the
+ * shared `renderHostAsset` helper (`audit-tools/shared`). These functions are
+ * thin wrappers that pass the canonical body through with the right `kind` and
+ * `toolName`; they do NOT re-author per-host loader prose. That makes it
+ * impossible for a host asset to drift out of sync with the canonical body — to
+ * silently drop the next-step capability handshake (including `--host-models`) or
+ * to embed a wrong in-repo entrypoint. A no-drift guard test enforces this.
+ */
+
+import { renderHostAsset } from 'audit-tools/shared';
+
+export const INSTALLED_PROMPT_FILENAME = 'remediate-code.import.md';
+
+const TOOL_NAME = 'remediate-code';
+const ASSET_DESCRIPTION =
+  'Autonomous local-loop remediation — loads one backend-rendered remediation step at a time';
+
+/** Render the VS Code remediator agent markdown file from the canonical body. */
+export function renderVSCodeAgentFile(promptBody) {
+  return renderHostAsset('vscode-agent', {
+    promptBody,
+    toolName: TOOL_NAME,
+    description:
+      'Plan and orchestrate /remediate-code through the next-step machine before making code changes.',
+  });
+}
+
+/** Render the Codex re-run automation recipe markdown from the canonical body. */
+export function renderCodexAutomationRecipe(promptBody) {
+  return renderHostAsset('codex-recipe', {
+    promptBody,
+    toolName: TOOL_NAME,
+  });
+}
+
+/** Render the Antigravity planning-mode guide from the canonical body. */
+export function renderAntigravityPlanningGuide(promptBody) {
+  return renderHostAsset('antigravity-guide', {
+    promptBody,
+    toolName: TOOL_NAME,
+  });
+}
+
+/**
+ * Render the Gemini/Antigravity slash command TOML for a given prompt body.
+ * Escapes backslashes and double-quotes so the TOML multi-line basic string
+ * is valid regardless of prompt content.
+ */
+export function renderGeminiCommandToml(promptBody) {
+  return renderHostAsset('gemini-toml', {
+    promptBody,
+    toolName: TOOL_NAME,
+    description: ASSET_DESCRIPTION,
+  });
+}

package/wrapper/remediate-code-wrapper-io.mjs

@@ -0,0 +1,145 @@
+import { access, mkdir, readFile, readdir, stat, writeFile } from 'node:fs/promises';
+import { constants } from 'node:fs';
+import { dirname } from 'node:path';
+
+export async function fileExists(path) {
+  try {
+    await access(path, constants.F_OK);
+    return true;
+  } catch {
+    return false;
+  }
+}
+
+export async function newestMtimeMs(path) {
+  const stats = await stat(path);
+  if (!stats.isDirectory()) {
+    return stats.mtimeMs;
+  }
+
+  let newest = stats.mtimeMs;
+  const entries = await readdir(path, { withFileTypes: true });
+  for (const entry of entries) {
+    const childPath = `${path}/${entry.name}`;
+    if (entry.isDirectory()) {
+      newest = Math.max(newest, await newestMtimeMs(childPath));
+      continue;
+    }
+    if (entry.isFile()) {
+      newest = Math.max(newest, (await stat(childPath)).mtimeMs);
+    }
+  }
+  return newest;
+}
+
+export async function readTextIfExists(path) {
+  try {
+    return await readFile(path, 'utf8');
+  } catch {
+    return null;
+  }
+}
+
+export async function readJson(path, description) {
+  const content = await readFile(path, 'utf8');
+  try {
+    return JSON.parse(content);
+  } catch (error) {
+    throw new Error(
+      `${description} is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+}
+
+export async function writeGeneratedMarkdown(targetPath, content) {
+  const existed = await fileExists(targetPath);
+  await mkdir(dirname(targetPath), { recursive: true });
+  await writeFile(targetPath, content, 'utf8');
+  return {
+    path: targetPath,
+    mode: existed ? 'updated' : 'created',
+  };
+}
+
+export async function writeGeneratedJson(targetPath, value) {
+  const existed = await fileExists(targetPath);
+  await mkdir(dirname(targetPath), { recursive: true });
+  await writeFile(targetPath, JSON.stringify(value, null, 2) + '\n', 'utf8');
+  return {
+    path: targetPath,
+    mode: existed ? 'updated' : 'created',
+  };
+}
+
+async function readJsonObjectIfExists(targetPath, description) {
+  if (!(await fileExists(targetPath))) {
+    return {};
+  }
+
+  let parsed;
+  try {
+    parsed = JSON.parse(await readFile(targetPath, 'utf8'));
+  } catch (error) {
+    throw new Error(
+      `${description} exists but is not valid JSON: ${error instanceof Error ? error.message : String(error)}`,
+    );
+  }
+
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+    throw new Error(`${description} must be a JSON object when it already exists.`);
+  }
+
+  return parsed;
+}
+
+export async function writeMergedGeneratedJson(targetPath, description, buildValue) {
+  const existed = await fileExists(targetPath);
+  const existing = await readJsonObjectIfExists(targetPath, description);
+  await mkdir(dirname(targetPath), { recursive: true });
+  await writeFile(
+    targetPath,
+    JSON.stringify(buildValue(existing), null, 2) + '\n',
+    'utf8',
+  );
+  return {
+    path: targetPath,
+    mode: existed ? 'updated' : 'created',
+  };
+}
+
+const INSTALL_MARKER_START = '<!-- remediate-code:begin -->';
+const INSTALL_MARKER_END = '<!-- remediate-code:end -->';
+
+function normalizeNewlines(value) {
+  return value.replace(/\r\n/g, '\n');
+}
+
+function upsertManagedBlock(existingContent, blockContent) {
+  const normalized = normalizeNewlines(existingContent);
+  const blockPattern = new RegExp(
+    `${INSTALL_MARKER_START}[\\s\\S]*?${INSTALL_MARKER_END}`,
+    'u',
+  );
+
+  if (blockPattern.test(normalized)) {
+    return normalized.replace(blockPattern, blockContent);
+  }
+
+  if (normalized.trim().length === 0) {
+    return `${blockContent}\n`;
+  }
+
+  return `${normalized.replace(/\s+$/u, '')}\n\n${blockContent}\n`;
+}
+
+export async function writeManagedMarkdown(targetPath, blockContent) {
+  const existed = await fileExists(targetPath);
+  const existingContent = existed ? await readFile(targetPath, 'utf8') : '';
+  const nextContent = upsertManagedBlock(existingContent, blockContent);
+  await mkdir(dirname(targetPath), { recursive: true });
+  await writeFile(targetPath, nextContent, 'utf8');
+  return {
+    path: targetPath,
+    mode: existed ? 'updated' : 'created',
+  };
+}

package/wrapper/remediate-code-wrapper-legacy.mjs

@@ -0,0 +1,125 @@
+import { readdir, unlink } from 'node:fs/promises';
+import { join } from 'node:path';
+import { readTextIfExists } from './remediate-code-wrapper-io.mjs';
+
+function normalizeNewlines(value) {
+  return value.replace(/\r\n/g, '\n');
+}
+
+function looksLikeRemediateCodeSkill(content) {
+  const normalized = normalizeNewlines(content);
+  return (
+    /^name:\s*remediate-code\b/mu.test(normalized)
+    || normalized.includes('Conversation-first remediation of audit findings or feedback.')
+    || normalized.includes('The canonical entrypoint is `/remediate-code` in conversation.')
+  );
+}
+
+function looksLikeRemediateCodePrompt(content) {
+  const normalized = normalizeNewlines(content);
+  return (
+    normalized.includes('# `/remediate-code`')
+    && (
+      normalized.includes('remediate-code orchestrator')
+      || normalized.includes('Autonomous local-loop remediation')
+      || normalized.includes('Conversation-first remediation')
+    )
+  );
+}
+
+function looksLikeRemediateCodeInterfaceMetadata(content) {
+  const normalized = normalizeNewlines(content);
+  return (
+    normalized.includes('remediate-code')
+    && (
+      normalized.includes('display_name:')
+      || normalized.includes('short_description:')
+      || normalized.includes('default_prompt:')
+    )
+    && (
+      normalized.includes('/remediate-code')
+      || normalized.includes('Start /remediate-code')
+    )
+  );
+}
+
+export async function buildLegacyRemediateCodeSurfaceTargets(root) {
+  const targets = [
+    {
+      host: 'codex',
+      surface: 'skill',
+      path: join(root, '.codex', 'skills', 'remediate-code', 'SKILL.md'),
+      matches: looksLikeRemediateCodeSkill,
+    },
+    {
+      host: 'codex',
+      surface: 'prompt',
+      path: join(root, '.codex', 'skills', 'remediate-code', 'remediate-code.prompt.md'),
+      matches: looksLikeRemediateCodePrompt,
+    },
+    {
+      host: 'opencode',
+      surface: 'command',
+      path: join(root, '.opencode', 'commands', 'remediate-code.md'),
+      matches: looksLikeRemediateCodePrompt,
+    },
+    {
+      host: 'opencode',
+      surface: 'skill',
+      path: join(root, '.opencode', 'skills', 'remediate-code', 'SKILL.md'),
+      matches: looksLikeRemediateCodeSkill,
+    },
+    {
+      host: 'opencode',
+      surface: 'prompt',
+      path: join(root, '.opencode', 'skills', 'remediate-code', 'remediate-code.prompt.md'),
+      matches: looksLikeRemediateCodePrompt,
+    },
+    {
+      host: 'claude',
+      surface: 'command',
+      path: join(root, '.claude', 'commands', 'remediate-code.md'),
+      matches: looksLikeRemediateCodePrompt,
+    },
+  ];
+
+  const codexAgentDir = join(root, '.codex', 'skills', 'remediate-code', 'agents');
+  const codexAgentEntries = await readdir(codexAgentDir).catch(() => []);
+  for (const entry of codexAgentEntries) {
+    targets.push({
+      host: 'codex',
+      surface: 'interface-metadata',
+      path: join(codexAgentDir, entry),
+      matches: looksLikeRemediateCodeInterfaceMetadata,
+    });
+  }
+
+  return targets;
+}
+
+export async function findLegacyRemediateCodeSurfaceFiles(root) {
+  const matches = [];
+  for (const target of await buildLegacyRemediateCodeSurfaceTargets(root)) {
+    const existing = await readTextIfExists(target.path);
+    if (existing !== null && target.matches(existing)) {
+      matches.push(target.path);
+    }
+  }
+  return matches;
+}
+
+export async function removeLegacyRemediateCodeSurfaceFiles(root) {
+  const removed = [];
+  for (const target of await buildLegacyRemediateCodeSurfaceTargets(root)) {
+    const existing = await readTextIfExists(target.path);
+    if (existing === null || !target.matches(existing)) {
+      continue;
+    }
+    await unlink(target.path);
+    removed.push({
+      path: target.path,
+      mode: 'removed',
+    });
+  }
+  return removed;
+}

package/wrapper/remediate-code-wrapper-opencode.mjs

@@ -0,0 +1,201 @@
+// Best-effort import of shared OpenCode permission helpers.
+// On a fresh checkout before `npm run build`, the dist may not exist yet;
+// buildMergedOpenCodeProjectConfig throws a clear error in that case.
+let mergeOpenCodeAgentPermissionRule;
+let withoutOpenCodeWildcard;
+export let sharedOpenCodePermissions = false;
+
+try {
+  const shared = await import('audit-tools/shared');
+  mergeOpenCodeAgentPermissionRule = shared.mergeOpenCodeAgentPermissionRule;
+  withoutOpenCodeWildcard = shared.withoutOpenCodeWildcard;
+  sharedOpenCodePermissions = true;
+} catch {
+  // shared not yet built — callers that need merge logic will throw below
+}
+
+export const OPENCODE_REMEDIATE_EDIT_PERMISSION = {
+  '*': 'ask',
+  '.remediate-code/**': 'allow',
+  '.audit-tools/**': 'allow',
+};
+
+export const OPENCODE_REMEDIATE_EXTERNAL_DIRECTORY_PERMISSION = { '*': 'allow' };
+
+// Subcommands allowed for both the global bin and the dev wrapper.
+// Adding or removing a subcommand here applies to both invocation forms.
+const REMEDIATE_CODE_ALLOWED_SUBCOMMANDS = [
+  'ensure*',
+  'next-step*',
+  'prepare-implement-dispatch*',
+  'merge-implement-results*',
+  'accept-node*',
+  'validate*',
+];
+
+function buildRemediateBashPermissions() {
+  /** @type {Record<string, 'allow' | 'deny'>} */
+  const perm = { '*': 'allow' };
+  // Allow rules: bare bin and each subcommand for both the global bin and wrapper.
+  perm['remediate-code'] = 'allow';
+  for (const sub of REMEDIATE_CODE_ALLOWED_SUBCOMMANDS) {
+    perm[`remediate-code ${sub}`] = 'allow';
+    perm[`*remediate-code.mjs* ${sub}`] = 'allow';
+  }
+  perm['*remediate-code.mjs'] = 'allow';
+  perm['git status*'] = 'allow';
+  perm['git diff*'] = 'allow';
+  perm['grep *'] = 'allow';
+  perm['Select-String *'] = 'allow';
+  perm['rm *'] = 'deny';
+  return perm;
+}
+
+export const OPENCODE_REMEDIATE_BASH_PERMISSION = buildRemediateBashPermissions();
+
+function renderOpenCodeExternalDirectoryPermission() {
+  return { '*': 'allow' };
+}
+
+export function renderOpenCodePermissionConfig() {
+  return {
+    read: 'allow',
+    glob: 'allow',
+    grep: 'allow',
+    external_directory: renderOpenCodeExternalDirectoryPermission(),
+    edit: { ...OPENCODE_REMEDIATE_EDIT_PERMISSION },
+    bash: { ...OPENCODE_REMEDIATE_BASH_PERMISSION },
+  };
+}
+
+export function renderOpenCodeProjectConfig(_root) {
+  const remediatePermission = renderOpenCodePermissionConfig();
+  return {
+    $schema: 'https://opencode.ai/config.json',
+    permission: remediatePermission,
+    agent: {
+      remediator: {
+        description:
+          'Remediation orchestration agent for the /remediate-code workflow.',
+        permission: {
+          ...remediatePermission,
+          'remediator_*': 'allow',
+          question: 'allow',
+          task: 'allow',
+        },
+      },
+    },
+  };
+}
+
+function objectValue(value) {
+  return value && typeof value === 'object' && !Array.isArray(value)
+    ? value
+    : {};
+}
+
+export function removeManagedOpenCodeCommand(commandConfig) {
+  const command = objectValue(commandConfig);
+  const { 'remediate-code': _managedRemediateCodeCommand, ...remaining } = command;
+  return remaining;
+}
+
+export function assertOpenCodeRemediatePermissionConfig(permissionConfig, label) {
+  for (const tool of ['read', 'glob', 'grep']) {
+    if (permissionConfig?.[tool] !== 'allow') {
+      throw new Error(`OpenCode ${label}.${tool} must be allow. Run "remediate-code install --host opencode".`);
+    }
+  }
+  const externalDirectory = permissionConfig?.external_directory;
+  if (!externalDirectory || typeof externalDirectory !== 'object' || Array.isArray(externalDirectory)) {
+    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "remediate-code install --host opencode".`);
+  }
+  if (externalDirectory['*'] !== 'allow') {
+    throw new Error(`OpenCode ${label}.external_directory must set "*" to "allow". Run "remediate-code install --host opencode".`);
+  }
+  const edit = permissionConfig?.edit;
+  const bash = permissionConfig?.bash;
+  if (!edit || typeof edit !== 'object' || Array.isArray(edit)) {
+    throw new Error(`OpenCode ${label}.edit must allow remediate-owned file paths. Run "remediate-code install --host opencode".`);
+  }
+  for (const pattern of ['.remediate-code/**', '.audit-tools/**']) {
+    if (edit[pattern] !== 'allow') {
+      throw new Error(`OpenCode ${label}.edit must allow ${pattern}. Run "remediate-code install --host opencode".`);
+    }
+  }
+  if (!bash || typeof bash !== 'object' || Array.isArray(bash)) {
+    throw new Error(`OpenCode ${label}.bash must allow remediate-code commands. Run "remediate-code install --host opencode".`);
+  }
+  for (const pattern of [
+    'remediate-code',
+    'remediate-code ensure*',
+    'remediate-code next-step*',
+    'remediate-code prepare-implement-dispatch*',
+    'remediate-code merge-implement-results*',
+    'remediate-code accept-node*',
+    '*remediate-code.mjs',
+    '*remediate-code.mjs* next-step*',
+    '*remediate-code.mjs* merge-implement-results*',
+    '*remediate-code.mjs* accept-node*',
+  ]) {
+    if (bash[pattern] !== 'allow') {
+      throw new Error(`OpenCode ${label}.bash must allow ${pattern}. Run "remediate-code install --host opencode".`);
+    }
+  }
+}
+
+function mergePermissionBlock(existingPermission, generatedPermission) {
+  const existing = objectValue(existingPermission);
+  return {
+    ...generatedPermission,
+    ...existing,
+    read: generatedPermission.read,
+    glob: generatedPermission.glob,
+    grep: generatedPermission.grep,
+    external_directory: mergeOpenCodeAgentPermissionRule(
+      existing.external_directory,
+      generatedPermission.external_directory,
+      OPENCODE_REMEDIATE_EXTERNAL_DIRECTORY_PERMISSION,
+    ),
+    edit: mergeOpenCodeAgentPermissionRule(
+      existing.edit,
+      generatedPermission.edit,
+      withoutOpenCodeWildcard(OPENCODE_REMEDIATE_EDIT_PERMISSION),
+    ),
+    bash: mergeOpenCodeAgentPermissionRule(
+      existing.bash,
+      generatedPermission.bash,
+      withoutOpenCodeWildcard(OPENCODE_REMEDIATE_BASH_PERMISSION),
+    ),
+  };
+}
+
+export function buildMergedOpenCodeProjectConfig(existing, root) {
+  if (!sharedOpenCodePermissions) {
+    throw new Error(
+      'audit-tools/shared is not available. Run "npm run build" before deploying OpenCode config.',
+    );
+  }
+  const generated = renderOpenCodeProjectConfig(root);
+  const mergedMcp = objectValue(existing.mcp);
+  delete mergedMcp.remediator;
+  const existingRemediator = objectValue(objectValue(existing.agent).remediator);
+  return {
+    ...existing,
+    $schema: existing.$schema ?? generated.$schema,
+    command: removeManagedOpenCodeCommand(existing.command),
+    mcp: mergedMcp,
+    permission: mergePermissionBlock(existing.permission, generated.permission),
+    agent: {
+      ...objectValue(existing.agent),
+      remediator: {
+        ...existingRemediator,
+        ...generated.agent.remediator,
+        permission: mergePermissionBlock(
+          existingRemediator.permission,
+          generated.agent.remediator.permission,
+        ),
+      },
+    },
+  };
+}