builder-assistant-engineer 0.2.0

package/dist/gates/gate.js

@@ -0,0 +1,315 @@
+import { join } from "node:path";
+import { bashPath } from "../core/bash.js";
+import { UserError } from "../core/errors.js";
+import { readTextIfExists } from "../core/fs.js";
+import { isTestFile } from "../digest/baseline.js";
+import { t } from "../i18n/index.js";
+import { countIntegrity, hasComparableCounts, testsGrew } from "../review/integrity.js";
+import { capturedTask, formatFindings, reviewTask } from "../review/run.js";
+import { reductionPaths } from "../review/scope.js";
+import { allowlistProblems, trivialityProblems } from "../tasks/checks.js";
+import { logLines, MAX_LOG_LINES } from "../tasks/handoff.js";
+import { parseTask } from "../tasks/schema.js";
+import { findUnsafe, runVerification } from "../tasks/verify.js";
+import { enforceContract } from "./enforce.js";
+import { checkRegressions, formatCounts, runSuite, } from "./regression.js";
+import { guardState } from "./state-guard.js";
+const OUTPUT_TAIL = 4_000;
+export async function runGate(ctx, run) {
+    const { capture, checks, approval, acceptance } = run;
+    const skips = [...capture.skips];
+    const fail = (stage, report, reason, retryable = true) => ({
+        passed: false,
+        retryable,
+        report,
+        stage,
+        ...(reason ? { reason } : {}),
+        regressions: [],
+        skips,
+    });
+    const tampered = run.tampered.splice(0);
+    if (tampered.length > 0) {
+        const reason = t("state.tampered", { files: tampered.join(", ") });
+        ctx.prompter.warn(reason);
+        const restored = await enforceContract(ctx, capture, acceptance);
+        return fail("contract", joinSections([`## ${t("contract.title")}\n\n${reason}`, restored.report]), reason);
+    }
+    const contract = await enforceContract(ctx, capture, acceptance);
+    if (contract.blocked)
+        return fail("contract", contract.report, t("contract.failed"));
+    const recheck = async () => {
+        const changed = await guard.verify();
+        const again = await enforceContract(ctx, capture, acceptance);
+        if (changed.length === 0 && !again.blocked)
+            return undefined;
+        const state = changed.length > 0 ? t("state.tampered", { files: changed.join(", ") }) : "";
+        if (state)
+            ctx.prompter.warn(state);
+        return joinSections([state, again.report]);
+    };
+    const bash = await bashPath();
+    const refused = refusal(checks, {
+        unattended: run.unattended,
+        allow: capture.config.verify.allow,
+        ...(bash ? { bash } : {}),
+    });
+    if (refused || !bash) {
+        const reason = refused ?? t("verify.noBash");
+        ctx.prompter.warn(reason);
+        return fail("refused", reason, reason, false);
+    }
+    const baseline = suiteBaseline(capture);
+    const excluded = new Set(baseline?.excluded ?? []);
+    const suite = baseline?.skipped ? [] : checks.suite.filter((item) => !excluded.has(item.command));
+    if (!approval.granted) {
+        const all = [...new Set([...checks.commands, ...suite.map((item) => item.command)])];
+        ctx.prompter.note(all.map((command) => `$ ${command}`).join("\n"), t("verify.commands"));
+        for (const item of findUnsafe(all))
+            ctx.prompter.warn(t("verify.unsafeWarning", item));
+        if (!ctx.flags.yes && !(await ctx.prompter.confirm(t("verify.confirm"), true))) {
+            ctx.prompter.warn(t("verify.declined"));
+            return fail("declined", t("verify.declined"), t("verify.declined"), false);
+        }
+        approval.granted = true;
+    }
+    const fix = capturedTask(capture).meta.tests === "fix";
+    let guard = await guardState(ctx.cwd);
+    const regression = suite.length > 0
+        ? await regressionStage(ctx, suite, baseline, {
+            fix,
+            allowSkip: run.allowSkip,
+            timeout: capture.config.gates.timeoutMinutes * 60_000,
+        })
+        : undefined;
+    if (run.allowSkip) {
+        for (const item of regression?.unread ?? []) {
+            const what = t("regression.unreadSkipped", { command: item.command });
+            skips.push(`regression: ${what}`);
+            ctx.prompter.warn(t("skip.used", { what }));
+        }
+    }
+    const sections = [contract.report, regression?.report];
+    const afterSuite = await recheck();
+    if (afterSuite)
+        return fail("contract", joinSections([...sections, afterSuite]), t("contract.failed"));
+    if (regression && !regression.passed) {
+        return {
+            ...fail("regression", joinSections(sections), t("regression.failed")),
+            regressions: regression.regressions.map((check) => check.command),
+        };
+    }
+    const checksRun = regression?.checks ?? [];
+    const planned = reductionPaths(capturedTask(capture)).some((path) => isTestFile(path));
+    const integrity = countIntegrity(checksRun, acceptance, planned);
+    if (integrity.length > 0) {
+        const list = formatFindings(integrity);
+        ctx.prompter.note(list, t("integrity.title"));
+        sections.push(`## ${t("integrity.title")}\n\n${list}`);
+    }
+    if (integrity.some((finding) => finding.severity === "blocker")) {
+        return fail("integrity", joinSections(sections), t("integrity.failed"));
+    }
+    const known = new Map(checksRun.map((check) => [check.command, check]));
+    const excused = new Set([
+        ...(fix ? [] : (regression?.preexisting ?? []).map((check) => check.command)),
+        ...excluded,
+    ]);
+    guard = await guardState(ctx.cwd);
+    const verification = await runVerification(ctx.cwd, checks.script, {
+        bash,
+        timeoutMs: capture.config.gates.timeoutMinutes * 60_000,
+        onOutput: ctx.print,
+        known,
+        excused,
+    });
+    sections.push(verificationReport(verification));
+    const afterVerification = await recheck();
+    if (afterVerification) {
+        return fail("contract", joinSections([...sections, afterVerification]), t("contract.failed"));
+    }
+    if (!verification.passed) {
+        const reason = t("verify.failed", {
+            command: verification.failed ?? "Verification",
+            code: verification.exitCode,
+        });
+        ctx.prompter.warn(reason);
+        return fail("verification", joinSections(sections), reason);
+    }
+    ctx.prompter.success(t("verify.passed"));
+    const handoff = handoffProblem(await currentTask(ctx, capture));
+    if (handoff) {
+        ctx.prompter.warn(handoff);
+        sections.push(`## Handoff note\n\n${handoff}`);
+    }
+    else {
+        ctx.prompter.success(t("handoff.passed"));
+    }
+    const notes = [...stillFailing(verification, known), ...contract.notes];
+    const review = await safeReview(ctx, capture, notes, acceptance, {
+        testsGrew: testsGrew(checksRun),
+        counted: hasComparableCounts(checksRun),
+        secrets: capture.config.secrets,
+    }, evidence(checksRun, verification));
+    if (review.reason)
+        ctx.prompter.warn(review.reason);
+    const findings = formatFindings(review.findings);
+    if (findings)
+        ctx.prompter.note(findings, t("review.findings"));
+    sections.push(`## Review\n\n${review.status}\n\n${findings}`.trim(), acceptedReport(acceptance));
+    if (review.status === "fail")
+        return fail("review", joinSections(sections), review.reason);
+    if (review.status !== "pass") {
+        const reason = review.reason ?? t("review.noVerdict");
+        if (!run.allowSkip) {
+            return fail("review", joinSections([...sections, reason]), reason, review.status === "error");
+        }
+        skips.push(`review: ${reason}`);
+        ctx.prompter.warn(t("skip.used", { what: reason }));
+    }
+    if (review.status === "pass")
+        ctx.prompter.success(t("review.passed"));
+    return {
+        passed: true,
+        retryable: false,
+        report: joinSections([...sections, skippedReport(skips)]),
+        regressions: [],
+        skips,
+    };
+}
+export function refusal(checks, policy) {
+    if (checks.commands.length === 0)
+        return t("verify.none");
+    if (!policy.bash)
+        return t("verify.noBash");
+    const suite = checks.suite.map((item) => item.command);
+    const lines = [
+        ...trivialityProblems(checks.script).map((problem) => problemText(problem, "verify")),
+        ...(policy.unattended
+            ? [
+                ...allowlistProblems(checks.script, policy.allow).map((problem) => problemText(problem, "verify")),
+                ...allowlistProblems(suite, policy.allow).map((problem) => problemText(problem, "regression")),
+            ]
+            : []),
+    ];
+    return lines.length > 0 ? lines.join("\n") : undefined;
+}
+function problemText(problem, source) {
+    const vars = { command: problem.command };
+    if (problem.reason === "masks")
+        return t("verify.masks", vars);
+    if (problem.reason === "trivial")
+        return t("verify.trivial", vars);
+    const why = t(problem.reason === "dynamic" ? "verify.dynamic" : "verify.unknown");
+    return t(source === "verify" ? "verify.notAllowed" : "regression.notAllowed", {
+        ...vars,
+        why,
+    });
+}
+async function safeReview(ctx, capture, notes, acceptance, facts, proof) {
+    try {
+        return await reviewTask(ctx, capture, notes, acceptance, facts, proof);
+    }
+    catch (error) {
+        if (!(error instanceof UserError))
+            throw error;
+        return { status: "error", findings: [], reason: t("review.error", { details: error.message }) };
+    }
+}
+async function regressionStage(ctx, suite, baseline, options) {
+    const results = await runSuite(ctx.cwd, suite, ctx.print, options.timeout);
+    const check = checkRegressions(results, baseline, options.fix, options.allowSkip);
+    for (const item of check.regressions)
+        ctx.prompter.warn(regressionMessage(item));
+    for (const item of check.preexisting) {
+        ctx.prompter.info(t("regression.stillFailing", { command: item.command, code: item.exitCode }));
+    }
+    if (check.passed)
+        ctx.prompter.success(t("regression.passed"));
+    return check;
+}
+function regressionMessage(check) {
+    const vars = { command: check.command, code: check.exitCode };
+    if (check.verdict === "mustPass")
+        return t("regression.mustPass", vars);
+    if (check.verdict === "unknown") {
+        return t(check.unrecognized ? "regression.unknownRunner" : "regression.unknown", vars);
+    }
+    if (check.verdict === "uncomparable")
+        return t("regression.uncomparable", vars);
+    if (check.verdict === "regression" && check.before && check.before.exitCode !== 0) {
+        return t("regression.worse", {
+            command: check.command,
+            now: check.counts ? formatCounts(check.counts) : "",
+            before: check.before.counts ? formatCounts(check.before.counts) : "",
+        });
+    }
+    return t("regression.found", vars);
+}
+function suiteBaseline(capture) {
+    if (capture.config.gates.regression !== "full")
+        return undefined;
+    return capture.baseline;
+}
+function acceptedReport(acceptance) {
+    if (acceptance.accepted.length === 0)
+        return "";
+    return `## ${t("findings.acceptedTitle")}\n\n${formatFindings(acceptance.accepted)}`;
+}
+function skippedReport(skips) {
+    if (skips.length === 0)
+        return "";
+    return `## ${t("skip.title")}\n\n${skips.map((skip) => `- ${skip}`).join("\n")}`;
+}
+function evidence(checks, verification) {
+    const suite = checks.map((check) => {
+        const counts = check.counts ? `; ${formatCounts(check.counts)}` : "";
+        return `- \`${check.command}\` (${check.key}): exit ${check.exitCode}${counts}; ${check.verdict}`;
+    });
+    const excused = verification.tolerated.map((command) => `- \`${command}\`: already failed before the task`);
+    return [
+        suite.length > 0 ? `Project commands:\n${suite.join("\n")}` : "",
+        `Verification block, run as one bash script with set -Eeuo pipefail, exit ${verification.exitCode}${verification.passed ? " (every line exited 0)" : ""}:\n\`\`\`sh\n${verification.script}\n\`\`\``,
+        excused.length > 0
+            ? `Lines excused because they already failed before the task:\n${excused.join("\n")}`
+            : "",
+    ]
+        .filter(Boolean)
+        .join("\n\n");
+}
+function verificationReport(verification) {
+    const output = verification.output.slice(-OUTPUT_TAIL).trim();
+    return [
+        "## Verification",
+        `\`\`\`sh\n${verification.script}\n\`\`\``,
+        `exit ${verification.exitCode}`,
+        `\`\`\`text\n${output}\n\`\`\``,
+    ].join("\n\n");
+}
+function stillFailing(verification, known) {
+    return verification.tolerated.map((command) => ({
+        severity: "minor",
+        message: t("verify.stillFailing", { command, code: known.get(command)?.exitCode ?? 1 }),
+    }));
+}
+async function currentTask(ctx, capture) {
+    const fallback = capturedTask(capture);
+    const text = await readTextIfExists(join(ctx.cwd, ...capture.path.split("/")));
+    if (text === undefined)
+        return fallback;
+    try {
+        return parseTask(capture.path, text);
+    }
+    catch {
+        return fallback;
+    }
+}
+function handoffProblem(task) {
+    const count = logLines(task).length;
+    const vars = { path: task.path, max: MAX_LOG_LINES, count };
+    if (count === 0)
+        return t("handoff.missing", vars);
+    return count > MAX_LOG_LINES ? t("handoff.tooLong", vars) : undefined;
+}
+function joinSections(sections) {
+    return sections.filter(Boolean).join("\n\n");
+}

package/dist/gates/ignore-rules.js

@@ -0,0 +1,104 @@
+import { readdir } from "node:fs/promises";
+import { homedir } from "node:os";
+import { isAbsolute, join } from "node:path";
+import ignore, {} from "ignore";
+import { readTextIfExists } from "../core/fs.js";
+import { git, gitPaths } from "../core/git.js";
+const IGNORE_CASE = process.platform !== "linux";
+export async function captureIgnore(cwd) {
+    const globalFile = await globalExcludes(cwd);
+    const infoFile = (await git(cwd, ["rev-parse", "--git-path", "info/exclude"]))?.trim();
+    const listed = (await gitPaths(cwd, [
+        "ls-files",
+        "--cached",
+        "--others",
+        "--exclude-standard",
+        "--",
+        ":(glob)**/.gitignore",
+    ])) ?? [];
+    const perDirectory = await Promise.all([...new Set(listed)].map(async (path) => ({
+        dir: path.split("/").slice(0, -1).join("/"),
+        text: (await readTextIfExists(join(cwd, ...path.split("/")))) ?? "",
+    })));
+    const shared = await Promise.all([globalFile, infoFile && (isAbsolute(infoFile) ? infoFile : join(cwd, infoFile))].map(async (path) => ({ dir: "", text: (path && (await readTextIfExists(path))) || "" })));
+    return [...shared, ...perDirectory.sort((a, b) => depth(a.dir) - depth(b.dir))].filter((source) => source.text.trim() !== "");
+}
+export function ignoreMatcher(sources) {
+    const layers = sources.map((source) => ({
+        dir: source.dir,
+        matcher: ignore({ allowRelativePaths: true, ignorecase: IGNORE_CASE }).add(source.text),
+    }));
+    const decide = (path, isDir) => {
+        let ignored = false;
+        for (const layer of layers) {
+            if (layer.dir && !path.startsWith(`${layer.dir}/`))
+                continue;
+            const relative = layer.dir ? path.slice(layer.dir.length + 1) : path;
+            const result = layer.matcher.test(isDir ? `${relative}/` : relative);
+            if (result.ignored)
+                ignored = true;
+            else if (result.unignored)
+                ignored = false;
+        }
+        return ignored;
+    };
+    return (path, isDir) => {
+        const parts = path.split("/");
+        for (let index = 1; index < parts.length; index++) {
+            if (decide(parts.slice(0, index).join("/"), true))
+                return true;
+        }
+        return decide(path, isDir);
+    };
+}
+export async function untrackedFiles(cwd, isIgnored) {
+    const entries = await gitPaths(cwd, ["ls-files", "--others", "--directory", "--", "."]);
+    if (!entries)
+        return undefined;
+    const found = [];
+    for (const entry of entries) {
+        if (!entry.endsWith("/")) {
+            if (!isIgnored(entry, false))
+                found.push(entry);
+            continue;
+        }
+        const dir = entry.slice(0, -1);
+        if (!isIgnored(dir, true))
+            found.push(...(await walk(cwd, dir, isIgnored)));
+    }
+    return found.sort();
+}
+async function walk(cwd, dir, isIgnored) {
+    const entries = await listDir(join(cwd, ...dir.split("/")));
+    const found = [];
+    for (const entry of entries) {
+        const path = `${dir}/${entry.name}`;
+        if (entry.isDirectory()) {
+            if (entry.name !== ".git" && !isIgnored(path, true)) {
+                found.push(...(await walk(cwd, path, isIgnored)));
+            }
+        }
+        else if ((entry.isFile() || entry.isSymbolicLink()) && !isIgnored(path, false)) {
+            found.push(path);
+        }
+    }
+    return found;
+}
+async function globalExcludes(cwd) {
+    const configured = (await git(cwd, ["config", "--path", "--get", "core.excludesFile"]))?.trim();
+    if (configured)
+        return configured;
+    const base = process.env.XDG_CONFIG_HOME || join(homedir(), ".config");
+    return join(base, "git", "ignore");
+}
+async function listDir(path) {
+    try {
+        return await readdir(path, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+}
+function depth(dir) {
+    return dir === "" ? 0 : dir.split("/").length;
+}