avorelo 0.1.0

package/scripts/lib/adapter-safety-boundaries.js

@@ -0,0 +1,335 @@
+"use strict";
+
+// ── Adapter Safety Boundaries ─────────────────────────────────────────────────
+// Contract: avorelo.adapterSafetyBoundaries.v1
+// Answers: "Are adapter safety contracts enforced? No cross-adapter state leaks?
+// Hook timeout respected? MCP isolation verified?"
+// Reads configs and artifacts. Does NOT mutate. Does NOT run hooks.
+
+const fs = require("fs");
+const path = require("path");
+const { nowIso } = require("./fsx");
+const { appendProductLearningEvent } = require("./product-learning-events");
+
+const CONTRACT = "avorelo.adapterSafetyBoundaries.v1";
+const SCHEMA_VERSION = 1;
+const ARTIFACT_DIR_REL = ".claude/cco/orchestration/adapter-readiness";
+const ARTIFACT_REL = ARTIFACT_DIR_REL + "/latest-adapter-safety-boundaries.json";
+
+function safeReadJson(absPath) {
+  try {
+    if (!fs.existsSync(absPath)) return null;
+    return JSON.parse(fs.readFileSync(absPath, "utf8").replace(/^/, ""));
+  } catch { return null; }
+}
+
+function safeReadText(absPath, maxChars) {
+  try {
+    if (!fs.existsSync(absPath)) return null;
+    const fd = fs.openSync(absPath, "r");
+    const buf = Buffer.alloc(maxChars || 8000);
+    const n = fs.readSync(fd, buf, 0, buf.length, 0);
+    fs.closeSync(fd);
+    return buf.slice(0, n).toString("utf8");
+  } catch { return null; }
+}
+
+function pass(id, label, evidence, detail) {
+  return { id, label, status: "pass", evidence: evidence || null, detail: detail || null, safeNextAction: null };
+}
+function warn(id, label, safeNextAction, evidence, detail) {
+  return { id, label, status: "warn", evidence: evidence || null, detail: detail || null, safeNextAction: safeNextAction || "Review and resolve." };
+}
+function blocked(id, label, safeNextAction, evidence, detail) {
+  return { id, label, status: "blocked", evidence: evidence || null, detail: detail || null, safeNextAction: safeNextAction || "Fix blocker before proceeding." };
+}
+
+// ── Safety Checks ─────────────────────────────────────────────────────────────
+
+function checkNoCrossAdapterStateLeak(cwd) {
+  // Check that state directories are per-host isolated
+  const hostsStateDir = path.join(cwd, ".claude/cco/state/hosts");
+  if (!fs.existsSync(hostsStateDir)) {
+    return pass("no_cross_adapter_state_leak", "No cross-adapter state found (hosts state dir absent)",
+      { hostsStateDirExists: false }, "Host state isolation not needed until multi-host session detected.");
+  }
+
+  // Check if host state files exist and that they have distinct ids (not sharing state)
+  let hostFiles = [];
+  try { hostFiles = fs.readdirSync(hostsStateDir).filter(function(f) { return f.endsWith(".json"); }); } catch { /* ignore */ }
+
+  const hostIds = new Set();
+  let hasConflict = false;
+  for (const f of hostFiles) {
+    const data = safeReadJson(path.join(hostsStateDir, f));
+    if (data && data.id) {
+      if (hostIds.has(data.id)) { hasConflict = true; break; }
+      hostIds.add(data.id);
+    }
+  }
+
+  if (hasConflict) {
+    return blocked("no_cross_adapter_state_leak", "Cross-adapter state conflict detected",
+      "Remove duplicate host state files from .claude/cco/state/hosts/.",
+      { hostFileCount: hostFiles.length });
+  }
+
+  return pass("no_cross_adapter_state_leak", "No cross-adapter state conflict",
+    { hostFileCount: hostFiles.length, hostIds: Array.from(hostIds) });
+}
+
+function checkHookTimeoutRespected(cwd) {
+  const settingsPath = path.join(cwd, ".claude/settings.json");
+  const settings = safeReadJson(settingsPath);
+  if (!settings) {
+    return warn("hook_timeout_respected", "No .claude/settings.json found",
+      "Run: node bin/avorelo activate to generate settings.json with hook timeout config.",
+      null, ".claude/settings.json not found.");
+  }
+
+  // Check if hooks have timeout configured
+  const hooks = settings.hooks || {};
+  const hookEntries = Object.values(hooks);
+  const allHaveTimeout = hookEntries.length === 0 || hookEntries.every(function(h) {
+    const hooksArr = Array.isArray(h) ? h : [h];
+    return hooksArr.every(function(entry) {
+      return !entry || entry.timeout !== undefined || entry.timeoutMs !== undefined;
+    });
+  });
+
+  if (!allHaveTimeout) {
+    return warn("hook_timeout_respected", "Some hooks may lack explicit timeout",
+      "Add timeoutMs to hook definitions in .claude/settings.json.",
+      { hookCount: hookEntries.length });
+  }
+
+  return pass("hook_timeout_respected", "Hook configuration present",
+    { hookCount: hookEntries.length, settingsPresent: true });
+}
+
+function checkMcpIsolation(cwd) {
+  const settingsPath = path.join(cwd, ".claude/settings.json");
+  const settings = safeReadJson(settingsPath);
+  if (!settings) {
+    return warn("mcp_isolation", "No .claude/settings.json found for MCP config check",
+      "Run: node bin/avorelo activate to initialize settings.",
+      null);
+  }
+
+  // Check for dangerouslyAllowUnrestrictedMcpTools or similar unsafe flags
+  const settingsText = safeReadText(settingsPath, 5000) || "";
+  if (/dangerouslyAllowUnrestrictedMcpTools.*true|skipMcpValidation.*true/i.test(settingsText)) {
+    return blocked("mcp_isolation", "Unsafe MCP config flag detected",
+      "Remove dangerouslyAllowUnrestrictedMcpTools or skipMcpValidation from settings.",
+      { flagFound: true });
+  }
+
+  return pass("mcp_isolation", "No unsafe MCP isolation flags found",
+    { settingsChecked: true });
+}
+
+function checkNoTokenInAdapterConfig(cwd) {
+  const pathsToCheck = [
+    ".claude/settings.json",
+    ".claude/settings.local.json",
+    ".cursor/settings.json",
+    ".windsurf/settings.json",
+  ];
+
+  const issues = [];
+  for (const relPath of pathsToCheck) {
+    const absPath = path.join(cwd, relPath);
+    const text = safeReadText(absPath, 5000);
+    if (text && /token|secret|password|_authToken/i.test(text)) {
+      // Filter out false positives from non-credential fields
+      if (/["']?(?:token|secret|password|_authToken)["']?\s*[:=]\s*["'][^"']{6,}/i.test(text)) {
+        issues.push(relPath);
+      }
+    }
+  }
+
+  if (issues.length > 0) {
+    return blocked("no_token_in_adapter_config", "Token/secret found in adapter config",
+      "Remove tokens from adapter config files: " + issues.join(", "),
+      { files: issues });
+  }
+
+  return pass("no_token_in_adapter_config", "No tokens found in adapter config files",
+    { checked: pathsToCheck });
+}
+
+function checkHookSafetyBoundaryArtifact(cwd) {
+  const artifactPath = path.join(cwd, ".claude/cco/orchestration/full-readiness/latest-hook-safety-boundary.json");
+  const artifact = safeReadJson(artifactPath);
+  if (!artifact) {
+    // Check alternate path
+    const altPath = path.join(cwd, ".claude/cco/orchestration/hook-safety-boundary/latest-hook-safety-boundary-readiness.json");
+    const altArtifact = safeReadJson(altPath);
+    if (!altArtifact) {
+      return warn("hook_safety_boundary_artifact", "Hook safety boundary artifact not found",
+        "Run: node bin/avorelo hook-safety --json to generate hook safety boundary.",
+        null, "Artifact not found.");
+    }
+    return pass("hook_safety_boundary_artifact", "Hook safety boundary artifact present",
+      { path: altPath });
+  }
+  return pass("hook_safety_boundary_artifact", "Hook safety boundary artifact present",
+    { path: artifactPath });
+}
+
+function checkNoAutoApplyWithoutApproval(cwd) {
+  const settingsPath = path.join(cwd, ".claude/settings.json");
+  const text = safeReadText(settingsPath, 8000);
+  if (!text) {
+    return warn("no_auto_apply_without_approval", "Cannot verify auto-apply policy — settings.json missing",
+      "Run: node bin/avorelo activate to initialize settings.",
+      null);
+  }
+
+  // Check for auto-apply patterns that skip user approval
+  if (/autoApply.*true|autoHookApply.*true|skipApproval.*true/i.test(text)) {
+    return blocked("no_auto_apply_without_approval", "Auto-apply without approval found in settings",
+      "Remove autoApply/autoHookApply/skipApproval flags. All hook config changes require explicit approval.",
+      { flagFound: true });
+  }
+
+  return pass("no_auto_apply_without_approval", "No auto-apply without approval found",
+    { settingsChecked: true });
+}
+
+// ── Build Adapter Safety Boundaries ───────────────────────────────────────────
+
+function buildAdapterSafetyBoundaries(cwd, options) {
+  const checks = [
+    checkNoCrossAdapterStateLeak(cwd),
+    checkHookTimeoutRespected(cwd),
+    checkMcpIsolation(cwd),
+    checkNoTokenInAdapterConfig(cwd),
+    checkHookSafetyBoundaryArtifact(cwd),
+    checkNoAutoApplyWithoutApproval(cwd),
+  ];
+
+  const blockers = checks.filter(function(c) { return c.status === "blocked"; });
+  const warnings = checks.filter(function(c) { return c.status === "warn"; });
+
+  var status;
+  if (blockers.length > 0) {
+    status = "blocked";
+  } else if (warnings.length > 0) {
+    status = "warn";
+  } else {
+    status = "pass";
+  }
+
+  const safeNextAction = blockers.length > 0
+    ? "Fix safety boundary blockers immediately. Remove tokens from configs. Remove auto-apply flags."
+    : warnings.length > 0
+    ? "Review safety warnings. Ensure hook timeout and MCP isolation config is in place."
+    : "All adapter safety boundaries verified. Proceed to host support context.";
+
+  return {
+    contract: CONTRACT,
+    schemaVersion: SCHEMA_VERSION,
+    generatedAt: nowIso(),
+    status,
+    checks,
+    blockerCount: blockers.length,
+    warningCount: warnings.length,
+    approvalRequiredBeforeApply: true,
+    safeNextAction,
+    noPublicLaunchClaim: true,
+    redacted: true,
+  };
+}
+
+// ── Write ─────────────────────────────────────────────────────────────────────
+
+function writeAdapterSafetyBoundaries(cwd, boundaries) {
+  const dir = path.join(cwd, ARTIFACT_DIR_REL);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(cwd, ARTIFACT_REL), JSON.stringify(boundaries, null, 2));
+}
+
+// ── Surface ───────────────────────────────────────────────────────────────────
+
+function buildAdapterSafetyBoundariesSurface(cwd, options) {
+  const boundaries = buildAdapterSafetyBoundaries(cwd, options);
+  writeAdapterSafetyBoundaries(cwd, boundaries);
+  try {
+    appendProductLearningEvent(cwd, {
+      event: "adapter_safety_boundaries_built",
+      contract: CONTRACT,
+      status: boundaries.status,
+      blockerCount: boundaries.blockerCount,
+    });
+  } catch { /* non-fatal */ }
+  return {
+    status: boundaries.status,
+    blockerCount: boundaries.blockerCount,
+    warningCount: boundaries.warningCount,
+    approvalRequiredBeforeApply: true,
+    noPublicLaunchClaim: true,
+  };
+}
+
+// ── Format ────────────────────────────────────────────────────────────────────
+
+function formatAdapterSafetyBoundariesText(boundaries) {
+  var lines = [
+    "Adapter Safety Boundaries [" + (boundaries.status || "?").toUpperCase() + "]",
+    "  Approval required before apply: true",
+    "  Blockers: " + (boundaries.blockerCount || 0),
+    "  Warnings: " + (boundaries.warningCount || 0),
+  ];
+  if (boundaries.checks) {
+    boundaries.checks.forEach(function(c) {
+      if (c.status === "blocked" || c.status === "warn") {
+        lines.push("  [" + c.status.toUpperCase() + "] " + c.label + (c.safeNextAction ? " → " + c.safeNextAction : ""));
+      }
+    });
+  }
+  lines.push("  Next: " + (boundaries.safeNextAction || "Review adapter safety boundaries."));
+  return lines.join("\n");
+}
+
+// ── Validate Host Safety Boundaries ──────────────────────────────────────────
+// Per-host validation wrapper used by PR #163 cross-host checks.
+
+function validateHostSafetyBoundaries(cwd, hostId, options) {
+  options = options || {};
+  const boundaries = buildAdapterSafetyBoundaries(cwd, options);
+  // Filter checks relevant to this host (most checks are host-agnostic)
+  const hostChecks = boundaries.checks.filter(function(c) {
+    // All checks apply to detected hosts; filter only if host-specific id patterns
+    return true;
+  });
+  const blockers = hostChecks.filter(function(c) { return c.status === "blocked"; });
+  const warnings = hostChecks.filter(function(c) { return c.status === "warn"; });
+  const status = blockers.length > 0 ? "blocked" : warnings.length > 0 ? "warn" : "pass";
+  return {
+    hostId: hostId || "unknown",
+    status,
+    checks: hostChecks,
+    blockerCount: blockers.length,
+    warningCount: warnings.length,
+    approvalRequiredBeforeApply: true,
+    safeNextAction: boundaries.safeNextAction,
+  };
+}
+
+module.exports = {
+  CONTRACT,
+  SCHEMA_VERSION,
+  ARTIFACT_REL,
+  buildAdapterSafetyBoundaries,
+  writeAdapterSafetyBoundaries,
+  buildAdapterSafetyBoundariesSurface,
+  formatAdapterSafetyBoundariesText,
+  checkNoCrossAdapterStateLeak,
+  checkHookTimeoutRespected,
+  checkMcpIsolation,
+  checkNoTokenInAdapterConfig,
+  checkHookSafetyBoundaryArtifact,
+  checkNoAutoApplyWithoutApproval,
+  validateHostSafetyBoundaries,
+};

package/scripts/lib/adapter-technical-readiness-gate.js

@@ -0,0 +1,205 @@
+"use strict";
+
+// ── Adapter Technical Readiness Gate ─────────────────────────────────────────
+// Contract: avorelo.adapterTechnicalReadinessGate.v1
+// Answers: "Are all plugin/adapter technical readiness signals green? Is it safe
+// to proceed to alpha launch with multi-host adapter support?"
+// Aggregates: host-capability-matrix, cross-host-install, cross-host-value-flow,
+//   adapter-safety-boundaries, host-support-context, browser-proof-preflight
+// Read-only. Does NOT write to any adapter config. Does NOT launch browsers.
+
+const fs = require("fs");
+const path = require("path");
+const { nowIso } = require("./fsx");
+const { appendProductLearningEvent } = require("./product-learning-events");
+const { buildHostCapabilityMatrix } = require("./host-capability-matrix");
+const { buildCrossHostInstallReadiness } = require("./cross-host-install-readiness");
+const { buildCrossHostValueFlow } = require("./cross-host-value-flow");
+const { buildAdapterSafetyBoundaries } = require("./adapter-safety-boundaries");
+const { buildHostSupportContext } = require("./host-support-context");
+const { buildBrowserProofPreflight } = require("./browser-proof-preflight");
+
+const CONTRACT = "avorelo.adapterTechnicalReadinessGate.v1";
+const SCHEMA_VERSION = 1;
+const ARTIFACT_DIR_REL = ".claude/cco/orchestration/adapter-readiness";
+const ARTIFACT_REL = ARTIFACT_DIR_REL + "/latest-technical-gate.json";
+
+// ── Score Weights ─────────────────────────────────────────────────────────────
+// Each sub-module contributes a portion of the total score (100 pts total).
+// Safety boundaries are weighted highest — a blocker there is critical.
+const SCORE_WEIGHTS = {
+  adapter_safety_boundaries:    25,  // Safety is highest priority
+  cross_host_value_flow:        20,  // Value must flow across hosts
+  host_capability_matrix:       15,  // Know what each host can do
+  cross_host_install:           15,  // Install path must work
+  host_support_context:         15,  // Support must be diagnosable per host
+  browser_proof_preflight:      10,  // Browser preflight: local-first verified
+};
+
+const STATUS_SCORE = { pass: 1.0, warn: 0.5, blocked: 0.0, info: 1.0 };
+
+function scoreSignal(moduleName, status) {
+  const weight = SCORE_WEIGHTS[moduleName] || 0;
+  const factor = STATUS_SCORE[status] != null ? STATUS_SCORE[status] : 0.5;
+  return Math.round(weight * factor);
+}
+
+// ── Build Gate ────────────────────────────────────────────────────────────────
+
+function buildAdapterTechnicalReadinessGate(cwd, options) {
+  // Run all sub-modules (read-only, no side effects)
+  const hostMatrix      = buildHostCapabilityMatrix(cwd, options);
+  const crossInstall    = buildCrossHostInstallReadiness(cwd, options);
+  const valueFlow       = buildCrossHostValueFlow(cwd, options);
+  const safetyBoundaries = buildAdapterSafetyBoundaries(cwd, options);
+  const supportContext  = buildHostSupportContext(cwd, options);
+  const browserPreflight = buildBrowserProofPreflight(cwd, options);
+
+  // Summary per sub-module
+  const signals = {
+    host_capability_matrix:    { status: hostMatrix.status,       blockers: hostMatrix.blockerCount,       warnings: hostMatrix.warningCount },
+    cross_host_install:        { status: crossInstall.status,     blockers: crossInstall.blockerCount,     warnings: crossInstall.warningCount },
+    cross_host_value_flow:     { status: valueFlow.status,        blockers: valueFlow.blockerCount,        warnings: valueFlow.warningCount },
+    adapter_safety_boundaries: { status: safetyBoundaries.status, blockers: safetyBoundaries.blockerCount, warnings: safetyBoundaries.warningCount },
+    host_support_context:      { status: supportContext.status,   blockers: supportContext.blockerCount,   warnings: supportContext.warningCount },
+    browser_proof_preflight:   { status: browserPreflight.status, blockers: browserPreflight.blockerCount, warnings: browserPreflight.warningCount, browserRequired: false, noBrowserLaunch: true },
+  };
+
+  // Score
+  var score = 0;
+  Object.keys(signals).forEach(function(k) {
+    score += scoreSignal(k, signals[k].status);
+  });
+
+  // Overall status
+  const anyBlocked = Object.values(signals).some(function(s) { return s.status === "blocked"; });
+  const anyWarn    = Object.values(signals).some(function(s) { return s.status === "warn"; });
+
+  var status;
+  if (anyBlocked) {
+    status = "blocked";
+  } else if (anyWarn) {
+    status = "warn";
+  } else {
+    status = "pass";
+  }
+
+  // Counts
+  const totalBlockers = Object.values(signals).reduce(function(n, s) { return n + (s.blockers || 0); }, 0);
+  const totalWarnings = Object.values(signals).reduce(function(n, s) { return n + (s.warnings || 0); }, 0);
+
+  // Safe next action
+  var safeNextAction;
+  if (anyBlocked) {
+    const blockedModules = Object.entries(signals)
+      .filter(function([, s]) { return s.status === "blocked"; })
+      .map(function([k]) { return k; });
+    safeNextAction = "Fix adapter readiness blockers in: " + blockedModules.join(", ") + ". Resolve before alpha launch.";
+  } else if (anyWarn) {
+    safeNextAction = "Review adapter readiness warnings. Run bounded tasks to populate proof/ledger/support-bundle artifacts.";
+  } else {
+    safeNextAction = "Adapter Technical Readiness gate passed (score " + score + "/100). Multi-host adapter support verified. Safe to proceed to alpha launch candidate prep.";
+  }
+
+  // Verdict for company loop
+  var verdict;
+  if (score >= 90) {
+    verdict = "adapter_ready";
+  } else if (score >= 60) {
+    verdict = "adapter_partial";
+  } else {
+    verdict = "adapter_not_ready";
+  }
+
+  return {
+    contract: CONTRACT,
+    schemaVersion: SCHEMA_VERSION,
+    generatedAt: nowIso(),
+    status,
+    score,
+    verdict,
+    signals,
+    totalBlockers,
+    totalWarnings,
+    blockerCount: totalBlockers,
+    warningCount: totalWarnings,
+    safeNextAction,
+    browserRequired: false,
+    noBrowserLaunch: true,
+    noWorksEverywhereClaim: true,
+    noPublicLaunchClaim: true,
+    redacted: true,
+  };
+}
+
+// ── Write ─────────────────────────────────────────────────────────────────────
+
+function writeAdapterTechnicalReadinessGate(cwd, gate) {
+  const dir = path.join(cwd, ARTIFACT_DIR_REL);
+  if (!fs.existsSync(dir)) fs.mkdirSync(dir, { recursive: true });
+  fs.writeFileSync(path.join(cwd, ARTIFACT_REL), JSON.stringify(gate, null, 2));
+}
+
+// ── Surface ───────────────────────────────────────────────────────────────────
+
+function buildAdapterTechnicalReadinessSurface(cwd, options) {
+  const gate = buildAdapterTechnicalReadinessGate(cwd, options);
+  writeAdapterTechnicalReadinessGate(cwd, gate);
+  try {
+    appendProductLearningEvent(cwd, {
+      event: "adapter_technical_readiness_gate_run",
+      contract: CONTRACT,
+      status: gate.status,
+      score: gate.score,
+      verdict: gate.verdict,
+      totalBlockers: gate.totalBlockers,
+      browserRequired: false,
+    });
+  } catch { /* non-fatal */ }
+  return {
+    status: gate.status,
+    score: gate.score,
+    verdict: gate.verdict,
+    signals: gate.signals,
+    blockerCount: gate.blockerCount,
+    warningCount: gate.warningCount,
+    browserRequired: false,
+    noBrowserLaunch: true,
+    noPublicLaunchClaim: true,
+  };
+}
+
+// ── Format ────────────────────────────────────────────────────────────────────
+
+function formatAdapterTechnicalReadinessText(gate) {
+  var lines = [
+    "Adapter Technical Readiness Gate [" + (gate.status || "?").toUpperCase() + "] score=" + (gate.score || 0) + "/100 verdict=" + (gate.verdict || "?"),
+    "  Browser required: no | Browser launched: no",
+  ];
+  if (gate.signals) {
+    Object.entries(gate.signals).forEach(function([k, s]) {
+      var suffix = "";
+      if (s.blockers > 0) suffix += " (" + s.blockers + " blocker" + (s.blockers !== 1 ? "s" : "") + ")";
+      if (s.warnings > 0) suffix += " (" + s.warnings + " warning" + (s.warnings !== 1 ? "s" : "") + ")";
+      lines.push("  " + k + ": " + s.status + suffix);
+    });
+  }
+  lines.push(
+    "  Total blockers: " + (gate.totalBlockers || 0),
+    "  Total warnings: " + (gate.totalWarnings || 0),
+    "  Next: " + (gate.safeNextAction || "Review adapter technical readiness.")
+  );
+  return lines.join("\n");
+}
+
+module.exports = {
+  CONTRACT,
+  SCHEMA_VERSION,
+  ARTIFACT_REL,
+  SCORE_WEIGHTS,
+  buildAdapterTechnicalReadinessGate,
+  writeAdapterTechnicalReadinessGate,
+  buildAdapterTechnicalReadinessSurface,
+  formatAdapterTechnicalReadinessText,
+  scoreSignal,
+};