avorelo 0.1.0 → 0.3.0

package/scripts/lib/adapter-safety-boundaries.js

@@ -1,335 +0,0 @@
-"use strict";
-
-// ── Adapter Safety Boundaries ─────────────────────────────────────────────────
-// Contract: avorelo.adapterSafetyBoundaries.v1
-// Answers: "Are adapter safety contracts enforced? No cross-adapter state leaks?
-// Hook timeout respected? MCP isolation verified?"
-// Reads configs and artifacts. Does NOT mutate. Does NOT run hooks.
-
-const fs = require("fs");
-const path = require("path");
-const { nowIso } = require("./fsx");
-const { appendProductLearningEvent } = require("./product-learning-events");
-
-const CONTRACT = "avorelo.adapterSafetyBoundaries.v1";
-const SCHEMA_VERSION = 1;
-const ARTIFACT_DIR_REL = ".claude/cco/orchestration/adapter-readiness";
-const ARTIFACT_REL = ARTIFACT_DIR_REL + "/latest-adapter-safety-boundaries.json";
-
-function safeReadJson(absPath) {
-  try {
-    if (!fs.existsSync(absPath)) return null;
-    return JSON.parse(fs.readFileSync(absPath, "utf8").replace(/^/, ""));
-  } catch { return null; }
-}
-
-function safeReadText(absPath, maxChars) {
-  try {
-    if (!fs.existsSync(absPath)) return null;
-    const fd = fs.openSync(absPath, "r");
-    const buf = Buffer.alloc(maxChars || 8000);
-    const n = fs.readSync(fd, buf, 0, buf.length, 0);
-    fs.closeSync(fd);
-    return buf.slice(0, n).toString("utf8");
-  } catch { return null; }
-}
-
-function pass(id, label, evidence, detail) {
-  return { id, label, status: "pass", evidence: evidence || null, detail: detail || null, safeNextAction: null };
-}
-function warn(id, label, safeNextAction, evidence, detail) {
-  return { id, label, status: "warn", evidence: evidence || null, detail: detail || null, safeNextAction: safeNextAction || "Review and resolve." };
-}
-function blocked(id, label, safeNextAction, evidence, detail) {
-  return { id, label, status: "blocked", evidence: evidence || null, detail: detail || null, safeNextAction: safeNextAction || "Fix blocker before proceeding." };
-}
-
-// ── Safety Checks ─────────────────────────────────────────────────────────────
-
-function checkNoCrossAdapterStateLeak(cwd) {
-  // Check that state directories are per-host isolated
-  const hostsStateDir = path.join(cwd, ".claude/cco/state/hosts");
-  if (!fs.existsSync(hostsStateDir)) {
-    return pass("no_cross_adapter_state_leak", "No cross-adapter state found (hosts state dir absent)",
-      { hostsStateDirExists: false }, "Host state isolation not needed until multi-host session detected.");
-  }
-
-  // Check if host state files exist and that they have distinct ids (not sharing state)
-  let hostFiles = [];
-  try { hostFiles = fs.readdirSync(hostsStateDir).filter(function(f) { return f.endsWith(".json"); }); } catch { /* ignore */ }
-
-  const hostIds = new Set();
-  let hasConflict = false;
-  for (const f of hostFiles) {
-    const data = safeReadJson(path.join(hostsStateDir, f));
-    if (data && data.id) {
-      if (hostIds.has(data.id)) { hasConflict = true; break; }
-      hostIds.add(data.id);
-    }
-  }
-
-  if (hasConflict) {
-    return blocked("no_cross_adapter_state_leak", "Cross-adapter state conflict detected",
-      "Remove duplicate host state files from .claude/cco/state/hosts/.",
-      { hostFileCount: hostFiles.length });
-  }
-
-  return pass("no_cross_adapter_state_leak", "No cross-adapter state conflict",
-    { hostFileCount: hostFiles.length, hostIds: Array.from(hostIds) });
-}
-
-function checkHookTimeoutRespected(cwd) {
-  const settingsPath = path.join(cwd, ".claude/settings.json");
-  const settings = safeReadJson(settingsPath);
-  if (!settings) {
-    return warn("hook_timeout_respected", "No .claude/settings.json found",
-      "Run: node bin/avorelo activate to generate settings.json with hook timeout config.",
-      null, ".claude/settings.json not found.");
-  }
-
-  // Check if hooks have timeout configured
-  const hooks = settings.hooks || {};
-  const hookEntries = Object.values(hooks);
-  const allHaveTimeout = hookEntries.length === 0 || hookEntries.every(function(h) {
-    const hooksArr = Array.isArray(h) ? h : [h];
-    return hooksArr.every(function(entry) {
-      return !entry || entry.timeout !== undefined || entry.timeoutMs !== undefined;
-    });
-  });
-
-  if (!allHaveTimeout) {
-    return warn("hook_timeout_respected", "Some hooks may lack explicit timeout",
-      "Add timeoutMs to hook definitions in .claude/settings.json.",
-      { hookCount: hookEntries.length });
-  }
-
-  return pass("hook_timeout_respected", "Hook configuration present",
-    { hookCount: hookEntries.length, settingsPresent: true });
-}
-
-function checkMcpIsolation(cwd) {
-  const settingsPath = path.join(cwd, ".claude/settings.json");
-  const settings = safeReadJson(settingsPath);
-  if (!settings) {
-    return warn("mcp_isolation", "No .claude/settings.json found for MCP config check",
-      "Run: node bin/avorelo activate to initialize settings.",
-      null);
-  }
-
-  // Check for dangerouslyAllowUnrestrictedMcpTools or similar unsafe flags
-  const settingsText = safeReadText(settingsPath, 5000) || "";
-  if (/dangerouslyAllowUnrestrictedMcpTools.*true|skipMcpValidation.*true/i.test(settingsText)) {
-    return blocked("mcp_isolation", "Unsafe MCP config flag detected",
-      "Remove dangerouslyAllowUnrestrictedMcpTools or skipMcpValidation from settings.",
-      { flagFound: true });
-  }
-
-  return pass("mcp_isolation", "No unsafe MCP isolation flags found",
-    { settingsChecked: true });
-}
-
-function checkNoTokenInAdapterConfig(cwd) {
-  const pathsToCheck = [
-    ".claude/settings.json",
-    ".claude/settings.local.json",
-    ".cursor/settings.json",
-    ".windsurf/settings.json",
-  ];
-
-  const issues = [];
-  for (const relPath of pathsToCheck) {
-    const absPath = path.join(cwd, relPath);
-    const text = safeReadText(absPath, 5000);
-    if (text && /token|secret|password|_authToken/i.test(text)) {
-      // Filter out false positives from non-credential fields
-      if (/["']?(?:token|secret|password|_authToken)["']?\s*[:=]\s*["'][^"']{6,}/i.test(text)) {
-        issues.push(relPath);
-      }
-    }
-  }
-
-  if (issues.length > 0) {
-    return blocked("no_token_in_adapter_config", "Token/secret found in adapter config",
-      "Remove tokens from adapter config files: " + issues.join(", "),
-      { files: issues });
-  }
-
-  return pass("no_token_in_adapter_config", "No tokens found in adapter config files",
-    { checked: pathsToCheck });
-}
-
-function checkHookSafetyBoundaryArtifact(cwd) {
-  const artifactPath = path.join(cwd, ".claude/cco/orchestration/full-readiness/latest-hook-safety-boundary.json");
-  const artifact = safeReadJson(artifactPath);
-  if (!artifact) {
-    // Check alternate path
-    const altPath = path.join(cwd, ".claude/cco/orchestration/hook-safety-boundary/latest-hook-safety-boundary-readiness.json");
-    const altArtifact = safeReadJson(altPath);
-    if (!altArtifact) {
-      return warn("hook_safety_boundary_artifact", "Hook safety boundary artifact not found",
-        "Run: node bin/avorelo hook-safety --json to generate hook safety boundary.",
-        null, "Artifact not found.");
-    }
-    return pass("hook_safety_boundary_artifact", "Hook safety boundary artifact present",
-      { path: altPath });
-  }
-  return pass("hook_safety_boundary_artifact", "Hook safety boundary artifact present",
-    { path: artifactPath });
-}
-
-function checkNoAutoApplyWithoutApproval(cwd) {
-  const settingsPath = path.join(cwd, ".claude/settings.json");
-  const text = safeReadText(settingsPath, 8000);
-  if (!text) {
-    return warn("no_auto_apply_without_approval", "Cannot verify auto-apply policy — settings.json missing",
-      "Run: node bin/avorelo activate to initialize settings.",
-      null);
-  }
-
-  // Check for auto-apply patterns that skip user approval
-  if (/autoApply.*true|autoHookApply.*true|skipApproval.*true/i.test(text)) {
-    return blocked("no_auto_apply_without_approval", "Auto-apply without approval found in settings",
-      "Remove autoApply/autoHookApply/skipApproval flags. All hook config changes require explicit approval.",
-      { flagFound: true });
-  }
-
-  return pass("no_auto_apply_without_approval", "No auto-apply without approval found",
-    { settingsChecked: true });
-}
-
-// ── Build Adapter Safety Boundaries ───────────────────────────────────────────
-
-function buildAdapterSafetyBoundaries(cwd, options) {
-  const checks = [
-    checkNoCrossAdapterStateLeak(cwd),
-    checkHookTimeoutRespected(cwd),
-    checkMcpIsolation(cwd),
-    checkNoTokenInAdapterConfig(cwd),
-    checkHookSafetyBoundaryArtifact(cwd),
-    checkNoAutoApplyWithoutApproval(cwd),
-  ];
-
-  const blockers = checks.filter(function(c) { return c.status === "blocked"; });
-  const warnings = checks.filter(function(c) { return c.status === "warn"; });
-
-  var status;
-  if (blockers.length > 0) {
-    status = "blocked";
-  } else if (warnings.length > 0) {
-    status = "warn";
-  } else {
-    status = "pass";
-  }
-
-  const safeNextAction = blockers.length > 0
-    ? "Fix safety boundary blockers immediately. Remove tokens from configs. Remove auto-apply flags."
-    : warnings.length > 0
-    ? "Review safety warnings. Ensure hook timeout and MCP isolation config is in place."
-    : "All adapter safety boundaries verified. Proceed to host support context.";
-
-  return {
-    contract: CONTRACT,
-    schemaVersion: SCHEMA_VERSION,
-    generatedAt: nowIso(),
-    status,
-    checks,
-    blockerCount: blockers.length,
-    warningCount: warnings.length,
-    approvalRequiredBeforeApply: true,
-    safeNextAction,
-    noPublicLaunchClaim: true,
-    redacted: true,
-  };
-}
-
-// ── Write ─────────────────────────────────────────────────────────────────────
-
-function writeAdapterSafetyBoundaries(cwd, boundaries) {
-  const dir = path.join(cwd, ARTIFACT_DIR_REL);
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(path.join(cwd, ARTIFACT_REL), JSON.stringify(boundaries, null, 2));
-}
-
-// ── Surface ───────────────────────────────────────────────────────────────────
-
-function buildAdapterSafetyBoundariesSurface(cwd, options) {
-  const boundaries = buildAdapterSafetyBoundaries(cwd, options);
-  writeAdapterSafetyBoundaries(cwd, boundaries);
-  try {
-    appendProductLearningEvent(cwd, {
-      event: "adapter_safety_boundaries_built",
-      contract: CONTRACT,
-      status: boundaries.status,
-      blockerCount: boundaries.blockerCount,
-    });
-  } catch { /* non-fatal */ }
-  return {
-    status: boundaries.status,
-    blockerCount: boundaries.blockerCount,
-    warningCount: boundaries.warningCount,
-    approvalRequiredBeforeApply: true,
-    noPublicLaunchClaim: true,
-  };
-}
-
-// ── Format ────────────────────────────────────────────────────────────────────
-
-function formatAdapterSafetyBoundariesText(boundaries) {
-  var lines = [
-    "Adapter Safety Boundaries [" + (boundaries.status || "?").toUpperCase() + "]",
-    "  Approval required before apply: true",
-    "  Blockers: " + (boundaries.blockerCount || 0),
-    "  Warnings: " + (boundaries.warningCount || 0),
-  ];
-  if (boundaries.checks) {
-    boundaries.checks.forEach(function(c) {
-      if (c.status === "blocked" || c.status === "warn") {
-        lines.push("  [" + c.status.toUpperCase() + "] " + c.label + (c.safeNextAction ? " → " + c.safeNextAction : ""));
-      }
-    });
-  }
-  lines.push("  Next: " + (boundaries.safeNextAction || "Review adapter safety boundaries."));
-  return lines.join("\n");
-}
-
-// ── Validate Host Safety Boundaries ──────────────────────────────────────────
-// Per-host validation wrapper used by PR #163 cross-host checks.
-
-function validateHostSafetyBoundaries(cwd, hostId, options) {
-  options = options || {};
-  const boundaries = buildAdapterSafetyBoundaries(cwd, options);
-  // Filter checks relevant to this host (most checks are host-agnostic)
-  const hostChecks = boundaries.checks.filter(function(c) {
-    // All checks apply to detected hosts; filter only if host-specific id patterns
-    return true;
-  });
-  const blockers = hostChecks.filter(function(c) { return c.status === "blocked"; });
-  const warnings = hostChecks.filter(function(c) { return c.status === "warn"; });
-  const status = blockers.length > 0 ? "blocked" : warnings.length > 0 ? "warn" : "pass";
-  return {
-    hostId: hostId || "unknown",
-    status,
-    checks: hostChecks,
-    blockerCount: blockers.length,
-    warningCount: warnings.length,
-    approvalRequiredBeforeApply: true,
-    safeNextAction: boundaries.safeNextAction,
-  };
-}
-
-module.exports = {
-  CONTRACT,
-  SCHEMA_VERSION,
-  ARTIFACT_REL,
-  buildAdapterSafetyBoundaries,
-  writeAdapterSafetyBoundaries,
-  buildAdapterSafetyBoundariesSurface,
-  formatAdapterSafetyBoundariesText,
-  checkNoCrossAdapterStateLeak,
-  checkHookTimeoutRespected,
-  checkMcpIsolation,
-  checkNoTokenInAdapterConfig,
-  checkHookSafetyBoundaryArtifact,
-  checkNoAutoApplyWithoutApproval,
-  validateHostSafetyBoundaries,
-};

package/scripts/lib/adapter-technical-readiness-gate.js

@@ -1,205 +0,0 @@
-"use strict";
-
-// ── Adapter Technical Readiness Gate ─────────────────────────────────────────
-// Contract: avorelo.adapterTechnicalReadinessGate.v1
-// Answers: "Are all plugin/adapter technical readiness signals green? Is it safe
-// to proceed to alpha launch with multi-host adapter support?"
-// Aggregates: host-capability-matrix, cross-host-install, cross-host-value-flow,
-//   adapter-safety-boundaries, host-support-context, browser-proof-preflight
-// Read-only. Does NOT write to any adapter config. Does NOT launch browsers.
-
-const fs = require("fs");
-const path = require("path");
-const { nowIso } = require("./fsx");
-const { appendProductLearningEvent } = require("./product-learning-events");
-const { buildHostCapabilityMatrix } = require("./host-capability-matrix");
-const { buildCrossHostInstallReadiness } = require("./cross-host-install-readiness");
-const { buildCrossHostValueFlow } = require("./cross-host-value-flow");
-const { buildAdapterSafetyBoundaries } = require("./adapter-safety-boundaries");
-const { buildHostSupportContext } = require("./host-support-context");
-const { buildBrowserProofPreflight } = require("./browser-proof-preflight");
-
-const CONTRACT = "avorelo.adapterTechnicalReadinessGate.v1";
-const SCHEMA_VERSION = 1;
-const ARTIFACT_DIR_REL = ".claude/cco/orchestration/adapter-readiness";
-const ARTIFACT_REL = ARTIFACT_DIR_REL + "/latest-technical-gate.json";
-
-// ── Score Weights ─────────────────────────────────────────────────────────────
-// Each sub-module contributes a portion of the total score (100 pts total).
-// Safety boundaries are weighted highest — a blocker there is critical.
-const SCORE_WEIGHTS = {
-  adapter_safety_boundaries:    25,  // Safety is highest priority
-  cross_host_value_flow:        20,  // Value must flow across hosts
-  host_capability_matrix:       15,  // Know what each host can do
-  cross_host_install:           15,  // Install path must work
-  host_support_context:         15,  // Support must be diagnosable per host
-  browser_proof_preflight:      10,  // Browser preflight: local-first verified
-};
-
-const STATUS_SCORE = { pass: 1.0, warn: 0.5, blocked: 0.0, info: 1.0 };
-
-function scoreSignal(moduleName, status) {
-  const weight = SCORE_WEIGHTS[moduleName] || 0;
-  const factor = STATUS_SCORE[status] != null ? STATUS_SCORE[status] : 0.5;
-  return Math.round(weight * factor);
-}
-
-// ── Build Gate ────────────────────────────────────────────────────────────────
-
-function buildAdapterTechnicalReadinessGate(cwd, options) {
-  // Run all sub-modules (read-only, no side effects)
-  const hostMatrix      = buildHostCapabilityMatrix(cwd, options);
-  const crossInstall    = buildCrossHostInstallReadiness(cwd, options);
-  const valueFlow       = buildCrossHostValueFlow(cwd, options);
-  const safetyBoundaries = buildAdapterSafetyBoundaries(cwd, options);
-  const supportContext  = buildHostSupportContext(cwd, options);
-  const browserPreflight = buildBrowserProofPreflight(cwd, options);
-
-  // Summary per sub-module
-  const signals = {
-    host_capability_matrix:    { status: hostMatrix.status,       blockers: hostMatrix.blockerCount,       warnings: hostMatrix.warningCount },
-    cross_host_install:        { status: crossInstall.status,     blockers: crossInstall.blockerCount,     warnings: crossInstall.warningCount },
-    cross_host_value_flow:     { status: valueFlow.status,        blockers: valueFlow.blockerCount,        warnings: valueFlow.warningCount },
-    adapter_safety_boundaries: { status: safetyBoundaries.status, blockers: safetyBoundaries.blockerCount, warnings: safetyBoundaries.warningCount },
-    host_support_context:      { status: supportContext.status,   blockers: supportContext.blockerCount,   warnings: supportContext.warningCount },
-    browser_proof_preflight:   { status: browserPreflight.status, blockers: browserPreflight.blockerCount, warnings: browserPreflight.warningCount, browserRequired: false, noBrowserLaunch: true },
-  };
-
-  // Score
-  var score = 0;
-  Object.keys(signals).forEach(function(k) {
-    score += scoreSignal(k, signals[k].status);
-  });
-
-  // Overall status
-  const anyBlocked = Object.values(signals).some(function(s) { return s.status === "blocked"; });
-  const anyWarn    = Object.values(signals).some(function(s) { return s.status === "warn"; });
-
-  var status;
-  if (anyBlocked) {
-    status = "blocked";
-  } else if (anyWarn) {
-    status = "warn";
-  } else {
-    status = "pass";
-  }
-
-  // Counts
-  const totalBlockers = Object.values(signals).reduce(function(n, s) { return n + (s.blockers || 0); }, 0);
-  const totalWarnings = Object.values(signals).reduce(function(n, s) { return n + (s.warnings || 0); }, 0);
-
-  // Safe next action
-  var safeNextAction;
-  if (anyBlocked) {
-    const blockedModules = Object.entries(signals)
-      .filter(function([, s]) { return s.status === "blocked"; })
-      .map(function([k]) { return k; });
-    safeNextAction = "Fix adapter readiness blockers in: " + blockedModules.join(", ") + ". Resolve before alpha launch.";
-  } else if (anyWarn) {
-    safeNextAction = "Review adapter readiness warnings. Run bounded tasks to populate proof/ledger/support-bundle artifacts.";
-  } else {
-    safeNextAction = "Adapter Technical Readiness gate passed (score " + score + "/100). Multi-host adapter support verified. Safe to proceed to alpha launch candidate prep.";
-  }
-
-  // Verdict for company loop
-  var verdict;
-  if (score >= 90) {
-    verdict = "adapter_ready";
-  } else if (score >= 60) {
-    verdict = "adapter_partial";
-  } else {
-    verdict = "adapter_not_ready";
-  }
-
-  return {
-    contract: CONTRACT,
-    schemaVersion: SCHEMA_VERSION,
-    generatedAt: nowIso(),
-    status,
-    score,
-    verdict,
-    signals,
-    totalBlockers,
-    totalWarnings,
-    blockerCount: totalBlockers,
-    warningCount: totalWarnings,
-    safeNextAction,
-    browserRequired: false,
-    noBrowserLaunch: true,
-    noWorksEverywhereClaim: true,
-    noPublicLaunchClaim: true,
-    redacted: true,
-  };
-}
-
-// ── Write ─────────────────────────────────────────────────────────────────────
-
-function writeAdapterTechnicalReadinessGate(cwd, gate) {
-  const dir = path.join(cwd, ARTIFACT_DIR_REL);
-  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
-  fs.writeFileSync(path.join(cwd, ARTIFACT_REL), JSON.stringify(gate, null, 2));
-}
-
-// ── Surface ───────────────────────────────────────────────────────────────────
-
-function buildAdapterTechnicalReadinessSurface(cwd, options) {
-  const gate = buildAdapterTechnicalReadinessGate(cwd, options);
-  writeAdapterTechnicalReadinessGate(cwd, gate);
-  try {
-    appendProductLearningEvent(cwd, {
-      event: "adapter_technical_readiness_gate_run",
-      contract: CONTRACT,
-      status: gate.status,
-      score: gate.score,
-      verdict: gate.verdict,
-      totalBlockers: gate.totalBlockers,
-      browserRequired: false,
-    });
-  } catch { /* non-fatal */ }
-  return {
-    status: gate.status,
-    score: gate.score,
-    verdict: gate.verdict,
-    signals: gate.signals,
-    blockerCount: gate.blockerCount,
-    warningCount: gate.warningCount,
-    browserRequired: false,
-    noBrowserLaunch: true,
-    noPublicLaunchClaim: true,
-  };
-}
-
-// ── Format ────────────────────────────────────────────────────────────────────
-
-function formatAdapterTechnicalReadinessText(gate) {
-  var lines = [
-    "Adapter Technical Readiness Gate [" + (gate.status || "?").toUpperCase() + "] score=" + (gate.score || 0) + "/100 verdict=" + (gate.verdict || "?"),
-    "  Browser required: no | Browser launched: no",
-  ];
-  if (gate.signals) {
-    Object.entries(gate.signals).forEach(function([k, s]) {
-      var suffix = "";
-      if (s.blockers > 0) suffix += " (" + s.blockers + " blocker" + (s.blockers !== 1 ? "s" : "") + ")";
-      if (s.warnings > 0) suffix += " (" + s.warnings + " warning" + (s.warnings !== 1 ? "s" : "") + ")";
-      lines.push("  " + k + ": " + s.status + suffix);
-    });
-  }
-  lines.push(
-    "  Total blockers: " + (gate.totalBlockers || 0),
-    "  Total warnings: " + (gate.totalWarnings || 0),
-    "  Next: " + (gate.safeNextAction || "Review adapter technical readiness.")
-  );
-  return lines.join("\n");
-}
-
-module.exports = {
-  CONTRACT,
-  SCHEMA_VERSION,
-  ARTIFACT_REL,
-  SCORE_WEIGHTS,
-  buildAdapterTechnicalReadinessGate,
-  writeAdapterTechnicalReadinessGate,
-  buildAdapterTechnicalReadinessSurface,
-  formatAdapterTechnicalReadinessText,
-  scoreSignal,
-};