bootproof 0.3.0 → 0.4.0

package/dist/diagnosis.js

@@ -1,3 +1,4 @@
+import { classifyFailure, extractMissingEnvNames, safeLocalEnvValue } from "./taxonomy.js";
 function packageManagerMismatch(evidence, inference) {
     const expected = evidence?.match(/expected version:\s*([^\n]+)/i)?.[1]?.trim() ?? inference?.packageManagerVersion ?? "the declared version";
     const actual = evidence?.match(/Got:\s*([^\n]+)/i)?.[1]?.trim() ?? "a different version";
@@ -15,7 +16,48 @@ function packageManagerMismatch(evidence, inference) {
     };
 }
 export function diagnoseFailure(failureClass, evidence, explanation, inference) {
+    const classified = evidence ? classifyFailure(evidence) : null;
+    const precise = classified?.class === failureClass ? classified : null;
+    const preciseFailure = (whyRefused, fallbackSafeNextStep) => ({
+        whatHappened: precise?.explanation ?? explanation,
+        whyRefused,
+        safeNextStep: precise?.safeNextStep ?? fallbackSafeNextStep,
+    });
     switch (failureClass) {
+        case "missing_ruby_version":
+            return preciseFailure("BootProof cannot execute the repository with a Ruby version that is not installed.", "Install the repository-required Ruby version with rbenv, then rerun BootProof.");
+        case "missing_php_runtime":
+            return preciseFailure("BootProof cannot execute the repository without a supported PHP runtime.", "Install a PHP version supported by the repository, then rerun BootProof.");
+        case "missing_composer":
+            return preciseFailure("BootProof cannot install the repository's PHP dependencies without Composer.", "Install Composer using its documented installation method, then rerun BootProof.");
+        case "unsupported_php_version_for_composer_lock":
+            return preciseFailure("Composer refused the locked dependency set because the available PHP version is unsupported.", "Use a PHP version compatible with composer.lock, then rerun composer install.");
+        case "missing_php_vendor_autoload":
+            return preciseFailure("The PHP dependency autoloader is absent, so the application cannot start reliably.", "Resolve any PHP or Composer version issue first, then run composer install to generate vendor/autoload.php.");
+        case "laravel_sqlite_database_missing":
+            return preciseFailure("Laravel cannot use the configured SQLite connection because its local database file is absent.", "After review, create database/database.sqlite and run php artisan migrate. Both steps mutate local state and require explicit approval.");
+        case "laravel_migrations_required":
+            return preciseFailure("Laravel started, but its required database tables are absent.", "Run php artisan migrate only after explicit approval because it mutates local database state.");
+        case "missing_build_tool":
+            return preciseFailure("The dependency installation cannot complete without the required native build tool.", "Install the reported build tool, then rerun BootProof.");
+        case "native_extension_compile_failed":
+            return preciseFailure("A required gem did not install, so the application cannot be started reliably.", "Inspect the preserved compiler output, install the required native dependencies, then rerun BootProof.");
+        case "missing_database_config":
+            return preciseFailure("The application has no usable database configuration, so a verified boot is impossible.", "Create config/database.yml from the repository's documented example, review it, then rerun BootProof.");
+        case "missing_required_config":
+            return preciseFailure("A repository-required configuration file is absent.", "Restore the reported file from the repository's documented example, review it, then rerun BootProof.");
+        case "postgres_unavailable":
+            return preciseFailure("The application could not reach the PostgreSQL service required for boot.", "Start PostgreSQL, verify its configured host and port, then rerun BootProof.");
+        case "postgres_role_missing":
+            return preciseFailure("PostgreSQL was reachable, but the configured role does not exist.", "Create the reported PostgreSQL role or configure an existing role, then rerun BootProof.");
+        case "database_schema_missing":
+            return preciseFailure("The database is reachable but its required schema is absent or incomplete.", "Run the repository's documented migration or database setup command, then rerun BootProof.");
+        case "unsupported_database_version":
+            return preciseFailure("The installed database version does not satisfy the repository's requirement.", "Install or select a supported PostgreSQL version, then rerun BootProof.");
+        case "unsupported_database_config":
+            return preciseFailure("The repository's database configuration contains names the application does not support.", "Update config/database.yml to use only supported database names, then rerun BootProof.");
+        case "redis_unavailable":
+            return preciseFailure("The application could not reach the Redis service required for boot.", "Start Redis, verify its configured host and port, then rerun BootProof.");
         case "package_manager_version_mismatch":
             return packageManagerMismatch(evidence, inference);
         case "dependency_install_skipped":
@@ -30,12 +72,38 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "BootProof cannot yet orchestrate that multi-step application safely enough to claim a verified boot.",
                 safeNextStep: "Review the detected setup and service commands, complete the repository's documented initialization, then rerun when orchestration support is available.",
             };
+        case "laravel_vite_ci_hmr_blocked":
+            return preciseFailure("Laravel's Vite integration blocked the HMR asset server in CI. That asset server is not proof that the Laravel application booted.", "For local verification: rerun with LARAVEL_BYPASS_ENV_CHECK=1 only if intentionally testing the Vite dev server. For CI verification: use production asset build instead of Vite HMR. For Laravel app verification: run the Laravel app server, not only the Vite asset server.");
         case "orchestration_not_supported":
             return {
                 whatHappened: explanation,
                 whyRefused: "The detected application requires backend/frontend or repository-specific orchestration that BootProof cannot yet execute safely.",
                 safeNextStep: "Use the repository's documented runbook. Treat this attestation as diagnosis only, not proof of a localhost boot.",
             };
+        case "go_service_orchestration_not_supported":
+            return {
+                whatHappened: explanation,
+                whyRefused: "A Go service was detected, but repository evidence did not establish one safe runnable service command and health contract.",
+                safeNextStep: "Use the repository's documented service command, or rerun with an explicit reviewed --command and health port. Treat this attestation as diagnosis only.",
+            };
+        case "host_execution_not_acknowledged":
+            return {
+                whatHappened: explanation,
+                whyRefused: "Host execution was selected without the required explicit acknowledgement.",
+                safeNextStep: "Review the inferred commands, then rerun with --provider local --unsafe-local only if you accept host execution.",
+            };
+        case "auth_required":
+            return {
+                whatHappened: explanation,
+                whyRefused: "The external endpoint requires authentication, so its response is not sufficient public health evidence.",
+                safeNextStep: "Provide a separate unauthenticated health endpoint, or verify authentication manually without exposing credentials to BootProof.",
+            };
+        case "external_health_unreachable":
+            return {
+                whatHappened: explanation,
+                whyRefused: "BootProof did not observe a successful HTTP response from the externally managed service.",
+                safeNextStep: "Confirm the external service and endpoint are reachable, then rerun the external health verification.",
+            };
         case "workspace_ambiguous":
             if (/multiple workspaces in parallel|starts multiple workspaces in parallel/i.test(explanation)) {
                 return {
@@ -61,12 +129,20 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "A responding server is not a verified healthy boot when the observed response is a server error.",
                 safeNextStep: "Inspect the application logs and failing health route, fix the server error, then rerun BootProof.",
             };
+        case "health_preoccupied":
+            return {
+                whatHappened: explanation,
+                whyRefused: "The healthy response existed before BootProof started the application, so BootProof cannot attribute it to this repository.",
+                safeNextStep: "Stop the existing service and rerun BootProof, or verify the already-running service explicitly with bootproof verify-url <url>.",
+            };
         case "health_check_timeout":
             return {
                 whatHappened: "No successful HTTP response was observed before the health timeout.",
                 whyRefused: "A running process alone is not proof that the application became reachable and healthy.",
                 safeNextStep: "Check the reported health candidates and application logs, then rerun with the correct port or a longer --timeout if justified.",
             };
+        case "health_candidate_port_mismatch":
+            return preciseFailure("The supervised process advertised a different port from the inferred application health URL.", "Confirm the primary application command and intended health port. For Laravel verification, run the Laravel app server rather than only the Vite asset server.");
         case "postgres_auth_env_missing":
             return {
                 whatHappened: "Postgres was reached, but authentication or database environment configuration did not match.",
@@ -91,6 +167,12 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "BootProof cannot execute the repository's explicit run path without its declared runtime or build tool.",
                 safeNextStep: "Install the required tool at a version supported by the repository, then rerun BootProof.",
             };
+        case "go_runtime_missing":
+            return preciseFailure("BootProof cannot execute the selected Go service command without the Go runtime.", "Install a Go version supported by the repository, then rerun BootProof.");
+        case "go_build_failed":
+            return preciseFailure("The selected Go service did not compile or its declared modules could not be resolved.", "Inspect the preserved Go compiler or module evidence, resolve the reported issue, then rerun BootProof.");
+        case "missing_project_cli":
+            return preciseFailure("The selected package script depends on a repository CLI that is not available in the current development environment.", "Prepare the repository's documented development environment or bootstrap services so its project CLI is available, then rerun BootProof.");
         case "runtime_engine_mismatch":
             return {
                 whatHappened: "The available Node.js runtime does not satisfy the repository's declared engine requirement.",
@@ -98,6 +180,17 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 safeNextStep: "Switch to a compatible Node.js version, then rerun BootProof.",
             };
         case "missing_env_var":
+            {
+                const missing = extractMissingEnvNames(evidence ?? explanation);
+                const safeValue = missing.length === 1 ? safeLocalEnvValue(missing[0]) : null;
+                if (safeValue) {
+                    return {
+                        whatHappened: `Missing variable: ${missing[0]}. Safe local value: ${safeValue}.`,
+                        whyRefused: "The application exited before BootProof could observe healthy HTTP behavior.",
+                        safeNextStep: `${missing[0]}=${safeValue} bootproof up . --provider local --unsafe-local --install`,
+                    };
+                }
+            }
             return {
                 whatHappened: explanation,
                 whyRefused: "BootProof will not invent secrets or write protected .env files to force startup.",
@@ -121,27 +214,19 @@ export function diagnoseFailure(failureClass, evidence, explanation, inference)
                 whyRefused: "BootProof cannot trust an application boot when its declared dependency installation failed.",
                 safeNextStep: "Inspect the preserved install evidence, fix the underlying package or environment problem, then rerun BootProof.",
             };
-        case "app_exited_early":
+        case "app_exited_early": {
+            const processOutput = explanation.includes("Last process output")
+                ? explanation.slice(explanation.indexOf("Last process output"))
+                : "";
             return {
-                whatHappened: "The application process exited before any health response was observed.",
+                whatHappened: processOutput
+                    ? `The application process exited before any health response was observed.\n${processOutput}`
+                    : "The application process exited before any health response was observed.",
                 whyRefused: "No live application health signal was available to verify.",
                 safeNextStep: "Inspect the preserved process output, fix the startup error, then rerun BootProof.",
             };
+        }
         default:
-            if (/cloned .* but will not execute remote repository code/i.test(explanation)) {
-                return {
-                    whatHappened: explanation,
-                    whyRefused: "A remote clone is untrusted code, and BootProof requires explicit acknowledgement before running it on the host.",
-                    safeNextStep: "Review the cloned repository, then rerun with --provider local --unsafe-local only if you accept host execution.",
-                };
-            }
-            if (/Local provider runs repository code directly/i.test(explanation)) {
-                return {
-                    whatHappened: explanation,
-                    whyRefused: "Host execution was selected without the required explicit acknowledgement.",
-                    safeNextStep: "Review the inferred commands, then rerun with --provider local --unsafe-local only if you accept host execution.",
-                };
-            }
             return {
                 whatHappened: explanation,
                 whyRefused: "BootProof did not observe enough evidence to issue a verified boot result.",

package/dist/diff.d.ts

@@ -0,0 +1,29 @@
+export type DiffRiskLevel = "low" | "medium" | "high";
+export interface DiffChange {
+    source: string;
+    before: string | null;
+    after: string | null;
+}
+export interface DiffResult {
+    schema: "bootproof/diff-result/v1";
+    base: string;
+    head: string;
+    changedFiles: string[];
+    addedServices: string[];
+    removedServices: string[];
+    addedPorts: string[];
+    removedPorts: string[];
+    addedEnvVars: string[];
+    removedEnvVars: string[];
+    changedCommands: DiffChange[];
+    changedPackageManagers: DiffChange[];
+    riskLevel: DiffRiskLevel;
+    proofRequired: boolean;
+    suggestedReviewNotes: string[];
+    redactionsApplied: string[];
+}
+export declare function validateDiffResult(value: unknown): string[];
+export declare function diffRefs(repoPath: string, options?: {
+    base?: string;
+    head?: string;
+}): DiffResult;