chainlesschain 0.81.0 → 0.132.0

package/src/commands/hardening.js

@@ -16,6 +16,32 @@ import {
   getAuditReport,
   runConfigAudit,
   deployCheck,
+  // V2 (Phase 29)
+  AUDIT_STATUS_V2,
+  BASELINE_STATUS_V2,
+  SEVERITY_V2,
+  HARDENING_DEFAULT_MAX_CONCURRENT_AUDITS,
+  HARDENING_DEFAULT_BASELINE_RETENTION_MS,
+  HARDENING_DEFAULT_AUDIT_TIMEOUT_MS,
+  setMaxConcurrentAudits,
+  getMaxConcurrentAudits,
+  setBaselineRetentionMs,
+  getBaselineRetentionMs,
+  setAuditTimeoutMs,
+  getAuditTimeoutMs,
+  getRunningAuditCount,
+  registerAuditV2,
+  startAudit,
+  completeAudit,
+  setAuditStatusV2,
+  getAuditStatusV2,
+  autoTimeoutAudits,
+  createBaselineV2,
+  getBaselineStatusV2,
+  setBaselineStatusV2,
+  activateBaseline,
+  autoArchiveStaleBaselines,
+  getHardeningStatsV2,
 } from "../lib/hardening-manager.js";
 
 export function registerHardeningCommand(program) {
@@ -337,4 +363,389 @@ export function registerHardeningCommand(program) {
         process.exit(1);
       }
     });
+
+  /* ── V2 (Phase 29) ──────────────────────────────── */
+
+  hardening
+    .command("audit-statuses-v2")
+    .description("List V2 audit lifecycle statuses")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const out = Object.values(AUDIT_STATUS_V2);
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      for (const s of out) console.log(`  ${s}`);
+    });
+
+  hardening
+    .command("baseline-statuses-v2")
+    .description("List V2 baseline lifecycle statuses")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const out = Object.values(BASELINE_STATUS_V2);
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      for (const s of out) console.log(`  ${s}`);
+    });
+
+  hardening
+    .command("severities-v2")
+    .description("List V2 severity buckets")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const out = Object.values(SEVERITY_V2);
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      for (const s of out) console.log(`  ${s}`);
+    });
+
+  hardening
+    .command("default-max-concurrent-audits")
+    .description("Default concurrent audit cap")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      if (opts.json)
+        return console.log(
+          JSON.stringify(HARDENING_DEFAULT_MAX_CONCURRENT_AUDITS),
+        );
+      console.log(HARDENING_DEFAULT_MAX_CONCURRENT_AUDITS);
+    });
+
+  hardening
+    .command("max-concurrent-audits")
+    .description("Current concurrent audit cap")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const n = getMaxConcurrentAudits();
+      if (opts.json) return console.log(JSON.stringify(n));
+      console.log(n);
+    });
+
+  hardening
+    .command("set-max-concurrent-audits <n>")
+    .description("Set concurrent audit cap")
+    .option("--json", "JSON output")
+    .action((n, opts) => {
+      setMaxConcurrentAudits(Number(n));
+      const out = { maxConcurrentAudits: getMaxConcurrentAudits() };
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      console.log(`maxConcurrentAudits = ${out.maxConcurrentAudits}`);
+    });
+
+  hardening
+    .command("default-baseline-retention-ms")
+    .description("Default baseline retention in ms")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      if (opts.json)
+        return console.log(
+          JSON.stringify(HARDENING_DEFAULT_BASELINE_RETENTION_MS),
+        );
+      console.log(HARDENING_DEFAULT_BASELINE_RETENTION_MS);
+    });
+
+  hardening
+    .command("baseline-retention-ms")
+    .description("Current baseline retention in ms")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const n = getBaselineRetentionMs();
+      if (opts.json) return console.log(JSON.stringify(n));
+      console.log(n);
+    });
+
+  hardening
+    .command("set-baseline-retention-ms <ms>")
+    .description("Set baseline retention in ms")
+    .option("--json", "JSON output")
+    .action((ms, opts) => {
+      setBaselineRetentionMs(Number(ms));
+      const out = { baselineRetentionMs: getBaselineRetentionMs() };
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      console.log(`baselineRetentionMs = ${out.baselineRetentionMs}`);
+    });
+
+  hardening
+    .command("default-audit-timeout-ms")
+    .description("Default audit timeout in ms")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      if (opts.json)
+        return console.log(JSON.stringify(HARDENING_DEFAULT_AUDIT_TIMEOUT_MS));
+      console.log(HARDENING_DEFAULT_AUDIT_TIMEOUT_MS);
+    });
+
+  hardening
+    .command("audit-timeout-ms")
+    .description("Current audit timeout in ms")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const n = getAuditTimeoutMs();
+      if (opts.json) return console.log(JSON.stringify(n));
+      console.log(n);
+    });
+
+  hardening
+    .command("set-audit-timeout-ms <ms>")
+    .description("Set audit timeout in ms")
+    .option("--json", "JSON output")
+    .action((ms, opts) => {
+      setAuditTimeoutMs(Number(ms));
+      const out = { auditTimeoutMs: getAuditTimeoutMs() };
+      if (opts.json) return console.log(JSON.stringify(out, null, 2));
+      console.log(`auditTimeoutMs = ${out.auditTimeoutMs}`);
+    });
+
+  hardening
+    .command("running-audit-count")
+    .description("Number of currently RUNNING audits")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const n = getRunningAuditCount();
+      if (opts.json) return console.log(JSON.stringify(n));
+      console.log(n);
+    });
+
+  hardening
+    .command("register-audit-v2 <name>")
+    .description("Register a V2 audit entry (PENDING)")
+    .option("-t, --type <type>", "Audit type", "generic")
+    .option(
+      "-s, --severity <severity>",
+      "critical|high|medium|low|info",
+      "medium",
+    )
+    .option("-m, --metadata <json>", "Metadata JSON")
+    .option("--json", "JSON output")
+    .action(async (name, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const metadata = opts.metadata ? JSON.parse(opts.metadata) : undefined;
+        const r = registerAuditV2(db, {
+          name,
+          type: opts.type,
+          severity: opts.severity,
+          metadata,
+        });
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`Registered audit ${r.audit_id} (${r.status})`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("start-audit <audit-id>")
+    .description("Start a PENDING audit (enforces concurrency cap)")
+    .option("--json", "JSON output")
+    .action(async (auditId, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const r = startAudit(db, auditId);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`${auditId} → ${r.status}`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("complete-audit <audit-id>")
+    .description("Complete a RUNNING audit")
+    .option("-p, --passed <n>", "Passed check count", parseInt)
+    .option("-f, --failed <n>", "Failed check count", parseInt)
+    .option("-w, --warning-threshold <n>", "Score threshold for WARNING (0–1)")
+    .option("--json", "JSON output")
+    .action(async (auditId, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const warningThreshold = opts.warningThreshold
+          ? Number(opts.warningThreshold)
+          : undefined;
+        const r = completeAudit(db, auditId, {
+          passed: opts.passed ?? 0,
+          failed: opts.failed ?? 0,
+          warningThreshold,
+        });
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`${auditId} → ${r.status} (score: ${r.score})`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("set-audit-status-v2 <audit-id> <status>")
+    .description("Transition audit to a new status")
+    .option("-e, --error-message <msg>")
+    .option("-m, --metadata <json>")
+    .option("--json", "JSON output")
+    .action(async (auditId, status, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const patch = {};
+        if (opts.errorMessage !== undefined)
+          patch.errorMessage = opts.errorMessage;
+        if (opts.metadata !== undefined)
+          patch.metadata = JSON.parse(opts.metadata);
+        const r = setAuditStatusV2(db, auditId, status, patch);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`${auditId} → ${r.status}`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("audit-status-v2 <audit-id>")
+    .description("Get V2 audit status")
+    .option("--json", "JSON output")
+    .action((auditId, opts) => {
+      const r = getAuditStatusV2(auditId);
+      if (opts.json) return console.log(JSON.stringify(r, null, 2));
+      if (!r) return console.log("(not found)");
+      console.log(`${auditId}: ${r.status}`);
+    });
+
+  hardening
+    .command("auto-timeout-audits")
+    .description("Bulk-fail RUNNING audits past auditTimeoutMs")
+    .option("--json", "JSON output")
+    .action(async (opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const r = autoTimeoutAudits(db);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`Timed out ${r.length} audit(s)`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("create-baseline-v2 <name>")
+    .description("Create a V2 baseline (DRAFT)")
+    .option("-v, --version <ver>", "Version", "1.0.0")
+    .option("-m, --metadata <json>", "Metadata JSON")
+    .option("--json", "JSON output")
+    .action(async (name, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const metadata = opts.metadata ? JSON.parse(opts.metadata) : undefined;
+        const r = createBaselineV2(db, {
+          name,
+          version: opts.version,
+          metadata,
+        });
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`Baseline ${r.baseline_id} (${r.status})`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("activate-baseline <baseline-id>")
+    .description("Activate a DRAFT baseline (supersedes previous ACTIVE)")
+    .option("--json", "JSON output")
+    .action(async (baselineId, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const r = activateBaseline(db, baselineId);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`${baselineId} → ${r.status}`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("set-baseline-status-v2 <baseline-id> <status>")
+    .description("Transition baseline to a new status")
+    .option("-r, --reason <reason>")
+    .option("-m, --metadata <json>")
+    .option("--json", "JSON output")
+    .action(async (baselineId, status, opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const patch = {};
+        if (opts.reason !== undefined) patch.reason = opts.reason;
+        if (opts.metadata !== undefined)
+          patch.metadata = JSON.parse(opts.metadata);
+        const r = setBaselineStatusV2(db, baselineId, status, patch);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`${baselineId} → ${r.status}`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("baseline-status-v2 <baseline-id>")
+    .description("Get V2 baseline status")
+    .option("--json", "JSON output")
+    .action((baselineId, opts) => {
+      const r = getBaselineStatusV2(baselineId);
+      if (opts.json) return console.log(JSON.stringify(r, null, 2));
+      if (!r) return console.log("(not found)");
+      console.log(`${baselineId}: ${r.status}`);
+    });
+
+  hardening
+    .command("auto-archive-stale-baselines")
+    .description("Bulk-archive SUPERSEDED baselines past retention")
+    .option("--json", "JSON output")
+    .action(async (opts) => {
+      try {
+        const { db } = await bootstrap();
+        ensureHardeningTables(db);
+        const r = autoArchiveStaleBaselines(db);
+        if (opts.json) console.log(JSON.stringify(r, null, 2));
+        else console.log(`Archived ${r.length} baseline(s)`);
+        await shutdown();
+      } catch (err) {
+        logger.error(`Failed: ${err.message}`);
+        process.exit(1);
+      }
+    });
+
+  hardening
+    .command("stats-v2")
+    .description("V2 hardening statistics")
+    .option("--json", "JSON output")
+    .action((opts) => {
+      const s = getHardeningStatsV2();
+      if (opts.json) return console.log(JSON.stringify(s, null, 2));
+      console.log(`Audits: ${s.totalAudits} (running=${s.runningAudits})`);
+      for (const [st, n] of Object.entries(s.auditsByStatus)) {
+        if (n > 0) console.log(`  ${st.padEnd(10)} ${n}`);
+      }
+      console.log(
+        `Baselines: ${s.totalBaselines} (active=${s.activeBaselines})`,
+      );
+      console.log(
+        `config: maxConcurrentAudits=${s.maxConcurrentAudits} baselineRetentionMs=${s.baselineRetentionMs} auditTimeoutMs=${s.auditTimeoutMs}`,
+      );
+    });
 }

package/src/commands/hook.js

@@ -334,4 +334,152 @@ export function registerHookCommand(program) {
         logger.log(`  ${chalk.cyan(ev)}`);
       }
     });
+
+  // ===== V2 governance subcommands (hook-manager V2) =====
+  hook
+    .command("maturities-v2")
+    .description("List hook profile maturity states (V2)")
+    .action(async () => {
+      const m = await import("../lib/hook-manager.js");
+      console.log(JSON.stringify(m.HOOK_PROFILE_MATURITY_V2, null, 2));
+    });
+  hook
+    .command("exec-lifecycle-v2")
+    .description("List hook exec lifecycle states (V2)")
+    .action(async () => {
+      const m = await import("../lib/hook-manager.js");
+      console.log(JSON.stringify(m.HOOK_EXEC_LIFECYCLE_V2, null, 2));
+    });
+  hook
+    .command("stats-v2")
+    .description("Show hook-manager V2 stats")
+    .action(async () => {
+      const m = await import("../lib/hook-manager.js");
+      console.log(JSON.stringify(m.getHookManagerStatsV2(), null, 2));
+    });
+  hook
+    .command("config-v2")
+    .description("Show hook-manager V2 config")
+    .action(async () => {
+      const m = await import("../lib/hook-manager.js");
+      console.log(
+        JSON.stringify(
+          {
+            maxActiveHooksPerOwner: m.getMaxActiveHooksPerOwnerV2(),
+            maxPendingExecsPerHook: m.getMaxPendingExecsPerHookV2(),
+            hookIdleMs: m.getHookIdleMsV2(),
+            hookExecStuckMs: m.getHookExecStuckMsV2(),
+          },
+          null,
+          2,
+        ),
+      );
+    });
+  hook
+    .command("register-profile-v2 <id> <owner> [event]")
+    .action(async (id, owner, event) => {
+      const m = await import("../lib/hook-manager.js");
+      console.log(
+        JSON.stringify(m.registerHookProfileV2({ id, owner, event }), null, 2),
+      );
+    });
+  hook.command("activate-profile-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.activateHookProfileV2(id), null, 2));
+  });
+  hook.command("disable-profile-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.disableHookProfileV2(id), null, 2));
+  });
+  hook.command("retire-profile-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.retireHookProfileV2(id), null, 2));
+  });
+  hook.command("touch-profile-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.touchHookProfileV2(id), null, 2));
+  });
+  hook.command("get-profile-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.getHookProfileV2(id), null, 2));
+  });
+  hook.command("list-profiles-v2").action(async () => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.listHookProfilesV2(), null, 2));
+  });
+  hook.command("create-exec-v2 <id> <hookId>").action(async (id, hookId) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.createHookExecV2({ id, hookId }), null, 2));
+  });
+  hook.command("start-exec-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.startHookExecV2(id), null, 2));
+  });
+  hook.command("complete-exec-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.completeHookExecV2(id), null, 2));
+  });
+  hook.command("fail-exec-v2 <id> [reason]").action(async (id, reason) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.failHookExecV2(id, reason), null, 2));
+  });
+  hook.command("cancel-exec-v2 <id> [reason]").action(async (id, reason) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.cancelHookExecV2(id, reason), null, 2));
+  });
+  hook.command("get-exec-v2 <id>").action(async (id) => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.getHookExecV2(id), null, 2));
+  });
+  hook.command("list-execs-v2").action(async () => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.listHookExecsV2(), null, 2));
+  });
+  hook.command("auto-disable-idle-v2").action(async () => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.autoDisableIdleHooksV2(), null, 2));
+  });
+  hook.command("auto-fail-stuck-v2").action(async () => {
+    const m = await import("../lib/hook-manager.js");
+    console.log(JSON.stringify(m.autoFailStuckHookExecsV2(), null, 2));
+  });
+  hook.command("set-max-active-hooks-v2 <n>").action(async (n) => {
+    const m = await import("../lib/hook-manager.js");
+    m.setMaxActiveHooksPerOwnerV2(parseInt(n, 10));
+    console.log(
+      JSON.stringify(
+        { maxActiveHooksPerOwner: m.getMaxActiveHooksPerOwnerV2() },
+        null,
+        2,
+      ),
+    );
+  });
+  hook.command("set-max-pending-execs-v2 <n>").action(async (n) => {
+    const m = await import("../lib/hook-manager.js");
+    m.setMaxPendingExecsPerHookV2(parseInt(n, 10));
+    console.log(
+      JSON.stringify(
+        { maxPendingExecsPerHook: m.getMaxPendingExecsPerHookV2() },
+        null,
+        2,
+      ),
+    );
+  });
+  hook.command("set-hook-idle-ms-v2 <n>").action(async (n) => {
+    const m = await import("../lib/hook-manager.js");
+    m.setHookIdleMsV2(parseInt(n, 10));
+    console.log(JSON.stringify({ hookIdleMs: m.getHookIdleMsV2() }, null, 2));
+  });
+  hook.command("set-hook-exec-stuck-ms-v2 <n>").action(async (n) => {
+    const m = await import("../lib/hook-manager.js");
+    m.setHookExecStuckMsV2(parseInt(n, 10));
+    console.log(
+      JSON.stringify({ hookExecStuckMs: m.getHookExecStuckMsV2() }, null, 2),
+    );
+  });
+  hook.command("reset-state-v2").action(async () => {
+    const m = await import("../lib/hook-manager.js");
+    m._resetStateHookManagerV2();
+    console.log(JSON.stringify({ ok: true }, null, 2));
+  });
 }