codetrellis 0.0.0-stage → 0.2.0

package/src/backend/services/commit-edges.js

@@ -0,0 +1,99 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var commit_edges_exports = {};
+__export(commit_edges_exports, {
+  MAX_PARSED: () => MAX_PARSED,
+  clearCommitEdgeCache: () => clearCommitEdgeCache,
+  commitEdges: () => commitEdges
+});
+module.exports = __toCommonJS(commit_edges_exports);
+var import_node_path = __toESM(require("node:path"));
+const MAX_PARSED = 400;
+const IMPORT_CACHE_MAX = 2e4;
+const importCache = /* @__PURE__ */ new Map();
+function clearCommitEdgeCache() {
+  importCache.clear();
+}
+function commitEdges(input, deps) {
+  const { projectPath, files, oids, live } = input;
+  const liveOut = /* @__PURE__ */ new Map();
+  for (const e of live.edges) {
+    const i = e.indexOf("->");
+    if (i === -1) continue;
+    const src = e.slice(0, i);
+    const list = liveOut.get(src);
+    if (list) list.push(e.slice(i + 2));
+    else liveOut.set(src, [e.slice(i + 2)]);
+  }
+  const edges = /* @__PURE__ */ new Set();
+  const toParse = [];
+  for (const [rel, { hash }] of files) {
+    const same = live.files.get(rel)?.hash === hash;
+    const targets = liveOut.get(rel) ?? [];
+    if (same && targets.every((t) => files.has(t))) {
+      for (const t of targets) edges.add(`${rel}->${t}`);
+    } else {
+      toParse.push(rel);
+    }
+  }
+  if (toParse.length > MAX_PARSED) {
+    return {
+      ok: false,
+      reason: `${toParse.length} files differ from the working tree at this commit, more than the ${MAX_PARSED} parsed to find its dependencies.`
+    };
+  }
+  const uncached = [...new Set(toParse.map((rel) => oids.get(rel)).filter((o) => !!o && !importCache.has(o)))];
+  const blobs = uncached.length ? deps.readBlobs(uncached) : /* @__PURE__ */ new Map();
+  const knownFiles = new Set([...files.keys()].map((rel) => import_node_path.default.join(projectPath, rel)));
+  for (const rel of toParse) {
+    const oid = oids.get(rel);
+    if (!oid) continue;
+    const abs = import_node_path.default.join(projectPath, rel);
+    if (!importCache.has(oid)) {
+      const content = blobs.get(oid);
+      if (content === void 0) continue;
+      if (importCache.size >= IMPORT_CACHE_MAX) importCache.clear();
+      importCache.set(oid, deps.parseImports(abs, content));
+    }
+    const parsed = importCache.get(oid);
+    if (!parsed) continue;
+    for (const imp of parsed.imports) {
+      const target = deps.resolve(parsed.language, imp.source, abs, knownFiles, imp.isRelative);
+      if (!target || target === abs) continue;
+      const targetRel = deps.relative(target);
+      if (files.has(targetRel)) edges.add(`${rel}->${targetRel}`);
+    }
+  }
+  return { ok: true, edges, parsed: toParse.length };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  MAX_PARSED,
+  clearCommitEdgeCache,
+  commitEdges
+});

package/src/backend/services/confined-fs.js

@@ -0,0 +1,241 @@
+var __create = Object.create;
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __getProtoOf = Object.getPrototypeOf;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
+  // If the importer is in node compatibility mode or this is not an ESM
+  // file that has been converted to a CommonJS file using a Babel-
+  // compatible transform (i.e. "__esModule" has not been set), then set
+  // "default" to the CommonJS "module.exports" for node compatibility.
+  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
+  mod
+));
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var confined_fs_exports = {};
+__export(confined_fs_exports, {
+  ConfinementError: () => ConfinementError,
+  canonicalRoot: () => canonicalRoot,
+  isInside: () => isInside,
+  isWithin: () => isWithin,
+  openReadStreamWithin: () => openReadStreamWithin,
+  readFileWithin: () => readFileWithin,
+  readTextWithin: () => readTextWithin,
+  removeWithin: () => removeWithin,
+  resolveWithin: () => resolveWithin,
+  writeFileWithin: () => writeFileWithin
+});
+module.exports = __toCommonJS(confined_fs_exports);
+var fs = __toESM(require("node:fs"));
+var path = __toESM(require("node:path"));
+const HAS_NOFOLLOW = typeof fs.constants.O_NOFOLLOW === "number" && process.platform !== "win32";
+class ConfinementError extends Error {
+  code = "EOUTSIDE_ROOT";
+  constructor(message) {
+    super(message);
+    this.name = "ConfinementError";
+  }
+}
+function canonicalRoot(root) {
+  if (!root || typeof root !== "string") {
+    throw new ConfinementError("A containment root is required");
+  }
+  try {
+    return fs.realpathSync.native(path.resolve(root));
+  } catch (err) {
+    throw new ConfinementError(
+      `Cannot canonicalise the containment root "${root}": ${err.message}`
+    );
+  }
+}
+function resolveWithin(root, candidate, label = "path") {
+  if (typeof candidate !== "string" || candidate.length === 0) {
+    throw new ConfinementError(`${label}: a path is required`);
+  }
+  if (candidate.includes("\0")) {
+    throw new ConfinementError(`${label}: path contains a NUL byte`);
+  }
+  const canonRoot = canonicalRoot(root);
+  const joined = path.resolve(canonRoot, candidate);
+  let existing = joined;
+  const missing = [];
+  while (!fs.existsSync(existing)) {
+    const parent = path.dirname(existing);
+    if (parent === existing) break;
+    missing.unshift(path.basename(existing));
+    existing = parent;
+  }
+  assertNoSymlinkOnPath(canonRoot, existing, label);
+  let canonExisting;
+  try {
+    canonExisting = fs.realpathSync.native(existing);
+  } catch (err) {
+    throw new ConfinementError(`${label}: cannot resolve "${candidate}": ${err.message}`);
+  }
+  if (!isInside(canonRoot, canonExisting)) {
+    throw new ConfinementError(
+      `${label}: resolves outside the permitted directory (resolved to ${canonExisting}, which is not inside ${canonRoot})`
+    );
+  }
+  return missing.length ? path.join(canonExisting, ...missing) : canonExisting;
+}
+function isInside(root, target) {
+  if (target === root) return true;
+  const rel = path.relative(root, target);
+  return rel.length > 0 && !rel.startsWith("..") && !path.isAbsolute(rel);
+}
+function assertNoSymlinkOnPath(root, target, label) {
+  let current = target;
+  while (current !== root && current.length > root.length) {
+    let st;
+    try {
+      st = fs.lstatSync(current);
+    } catch {
+      return;
+    }
+    if (st.isSymbolicLink()) {
+      throw new ConfinementError(
+        `${label}: "${current}" is a symbolic link. Links are not followed at this boundary.`
+      );
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+  }
+}
+function readFileWithin(root, candidate, label = "path") {
+  const target = resolveWithin(root, candidate, label);
+  const flags = HAS_NOFOLLOW ? fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW : fs.constants.O_RDONLY;
+  let fd = null;
+  try {
+    fd = fs.openSync(target, flags);
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) {
+      throw new ConfinementError(`${label}: not a regular file`);
+    }
+    return fs.readFileSync(fd);
+  } catch (err) {
+    if (err instanceof ConfinementError) throw err;
+    const e = err;
+    if (e.code === "ELOOP") {
+      throw new ConfinementError(`${label}: refused to follow a symbolic link`);
+    }
+    throw err;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function openReadStreamWithin(root, candidate, opts = {}, label = "path") {
+  const target = resolveWithin(root, candidate, label);
+  const flags = HAS_NOFOLLOW ? fs.constants.O_RDONLY | fs.constants.O_NOFOLLOW : fs.constants.O_RDONLY;
+  let fd = null;
+  try {
+    fd = fs.openSync(target, flags);
+    const st = fs.fstatSync(fd);
+    if (!st.isFile()) {
+      throw new ConfinementError(`${label}: not a regular file`);
+    }
+    const stream = fs.createReadStream("", { fd, start: opts.start, end: opts.end, autoClose: true });
+    fd = null;
+    return { stream, size: st.size, mtimeMs: st.mtimeMs };
+  } catch (err) {
+    if (err instanceof ConfinementError) throw err;
+    const e = err;
+    if (e.code === "ELOOP") {
+      throw new ConfinementError(`${label}: refused to follow a symbolic link`);
+    }
+    throw err;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+      }
+    }
+  }
+}
+function readTextWithin(root, candidate, label = "path") {
+  return readFileWithin(root, candidate, label).toString("utf-8");
+}
+function writeFileWithin(root, candidate, data, label = "path") {
+  const target = resolveWithin(root, candidate, label);
+  const dir = path.dirname(target);
+  fs.mkdirSync(dir, { recursive: true });
+  const canonDir = resolveWithin(root, dir, `${label} (directory)`);
+  const tmp = path.join(canonDir, `.tmp-${process.pid}-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`);
+  let fd = null;
+  try {
+    fd = fs.openSync(tmp, fs.constants.O_WRONLY | fs.constants.O_CREAT | fs.constants.O_EXCL, 384);
+    fs.writeFileSync(fd, data);
+    fs.fsyncSync(fd);
+    fs.closeSync(fd);
+    fd = null;
+    try {
+      const st = fs.lstatSync(target);
+      if (st.isSymbolicLink()) {
+        throw new ConfinementError(`${label}: destination is a symbolic link; refusing to write through it`);
+      }
+    } catch (err) {
+      if (err instanceof ConfinementError) throw err;
+    }
+    fs.renameSync(tmp, target);
+    return target;
+  } finally {
+    if (fd !== null) {
+      try {
+        fs.closeSync(fd);
+      } catch {
+      }
+    }
+    try {
+      if (fs.existsSync(tmp)) fs.unlinkSync(tmp);
+    } catch {
+    }
+  }
+}
+function removeWithin(root, candidate, opts = {}, label = "path") {
+  const target = resolveWithin(root, candidate, label);
+  if (target === canonicalRoot(root)) {
+    throw new ConfinementError(`${label}: refusing to delete the containment root itself`);
+  }
+  fs.rmSync(target, { recursive: opts.recursive === true, force: false });
+}
+function isWithin(root, candidate) {
+  try {
+    resolveWithin(root, candidate);
+    return true;
+  } catch {
+    return false;
+  }
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  ConfinementError,
+  canonicalRoot,
+  isInside,
+  isWithin,
+  openReadStreamWithin,
+  readFileWithin,
+  readTextWithin,
+  removeWithin,
+  resolveWithin,
+  writeFileWithin
+});

package/src/backend/services/conformity-gate.js

@@ -0,0 +1,132 @@
+var __defProp = Object.defineProperty;
+var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
+var __getOwnPropNames = Object.getOwnPropertyNames;
+var __hasOwnProp = Object.prototype.hasOwnProperty;
+var __export = (target, all) => {
+  for (var name in all)
+    __defProp(target, name, { get: all[name], enumerable: true });
+};
+var __copyProps = (to, from, except, desc) => {
+  if (from && typeof from === "object" || typeof from === "function") {
+    for (let key of __getOwnPropNames(from))
+      if (!__hasOwnProp.call(to, key) && key !== except)
+        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
+  }
+  return to;
+};
+var __toCommonJS = (mod) => __copyProps(__defProp({}, "__esModule", { value: true }), mod);
+var conformity_gate_exports = {};
+__export(conformity_gate_exports, {
+  checkChanges: () => checkChanges,
+  cleanChanged: () => cleanChanged
+});
+module.exports = __toCommonJS(conformity_gate_exports);
+var import_node_child_process = require("node:child_process");
+var import_breakpoint_service = require("./breakpoint-service");
+var import_grounding = require("./tests/grounding");
+var import_plan_service = require("./plan-service");
+var import_plan_item_service = require("./plan-item-service");
+var import_criteria_service = require("./criteria-service");
+var import_system_docs_service = require("./system-docs-service");
+var import_rule_changes = require("./rule-changes");
+var import_check_words = require("../../shared/lib/check-words");
+const MAX_FILES = 500;
+function cleanChanged(paths) {
+  const out = /* @__PURE__ */ new Set();
+  for (const raw of paths) {
+    const p = raw.trim().replace(/\\/g, "/").replace(/^\.\/+/, "");
+    if (!p || p.startsWith("/") || p.split("/").includes("..")) continue;
+    out.add(p);
+  }
+  return [...out].slice(0, MAX_FILES);
+}
+function changedSince(root, commit) {
+  try {
+    const out = (0, import_node_child_process.execFileSync)("git", ["-C", root, "diff", "--name-only", commit, "--"], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] });
+    return new Set(out.split("\n").map((s) => s.trim()).filter(Boolean));
+  } catch {
+    return null;
+  }
+}
+async function checkChanges(root, changed, checkCriterion, checkRules, rulebook = [], notes = [], strict = false, scoped = false, ratchet = []) {
+  const files = cleanChanged(changed);
+  const says = [];
+  const said = [...notes];
+  for (const c of rulebook) (c.effect === "loosens" && !c.approval?.ok ? says : said).push((0, import_rule_changes.changeWords)(c));
+  const breakpoints = [];
+  const code = scoped ? [] : (0, import_breakpoint_service.listBreakpoints)().filter((b) => b.kind === "code" && b.projectRoot === root);
+  for (const f of files) {
+    for (const b of code) {
+      if (!(0, import_breakpoint_service.codeCovers)(b.target, f)) continue;
+      breakpoints.push({ path: f, breakpoint: b.id, note: b.note, by: b.createdBy });
+      says.push(`\u25A0 ${f}: ${b.createdBy} set a breakpoint on ${b.target === f ? "it" : b.target}${b.note ? ` (\u201C${b.note}\u201D)` : ""}; ask them before changing it`);
+    }
+  }
+  const found = files.length && checkRules ? await checkRules(files) : [];
+  const rules = found ?? [];
+  for (const r of rules) {
+    const line = (0, import_check_words.findingLine)(r);
+    if (r.strength === "block" || strict) says.push(`\u2717 ${line}`);
+    else said.push(`\u26A0 ${line} (the rule warns; it does not fail the check)`);
+  }
+  const said1 = new Set(rules.map((r) => `${r.path}>${r.imports}`));
+  for (const f of ratchet) {
+    if (f.kind === "breach" && said1.has(`${f.from}>${f.to}`)) continue;
+    if (f.kind === "fell" || f.kind === "breach" && f.strength === "warn" && !strict) said.push(f.words);
+    else says.push(f.words);
+  }
+  const tests = [];
+  for (const f of scoped ? [] : files) {
+    let g;
+    try {
+      g = (0, import_grounding.groundingOf)(root, f);
+    } catch {
+      continue;
+    }
+    if (g.state === "failing" || g.state === "stale") {
+      tests.push({ path: f, state: g.state, says: g.words });
+      says.push(`${f}: ${g.words}`);
+    }
+  }
+  const criteria = [];
+  for (const plan of scoped ? [] : (0, import_plan_service.listPlans)(root)) {
+    if (plan.status === "archived") continue;
+    for (const item of (0, import_plan_item_service.listItemSummaries)(plan.uid)) {
+      if (item.status !== "done") continue;
+      for (const c of (0, import_criteria_service.listCriteria)(item.uid)) {
+        const r = await checkCriterion(c.uid).catch(() => null);
+        if (!r || r.ok) continue;
+        const findings = r.findings.filter((x) => x.status === "fail").map((x) => x.message);
+        criteria.push({ itemUid: item.uid, task: item.title, criterion: c.text, findings });
+        says.push(`\u2717 "${item.title}" is marked done, but its criterion "${c.text}" fails${findings.length ? `: ${findings.join("; ")}` : ""}`);
+      }
+    }
+  }
+  const docs = [];
+  const seen = /* @__PURE__ */ new Map();
+  const diffs = /* @__PURE__ */ new Map();
+  for (const f of scoped ? [] : files) {
+    for (const ref of (0, import_system_docs_service.findDocsByReferencedFile)(root, f)) {
+      const doc = (0, import_system_docs_service.getSystemDoc)(ref.uid);
+      if (!doc?.capturedAgainstCommit || !(doc.references.files ?? []).some((x) => x.replace(/^\.\/+/, "") === f)) continue;
+      const stamp = doc.capturedAgainstCommit;
+      if (!diffs.has(stamp)) diffs.set(stamp, changedSince(root, stamp));
+      if (!diffs.get(stamp)?.has(f)) continue;
+      const at = seen.get(doc.uid);
+      if (at) {
+        at.files.push(f);
+        continue;
+      }
+      const entry = { uid: doc.uid, title: doc.title, slug: doc.slug, verifiedAt: stamp.slice(0, 7), files: [f] };
+      seen.set(doc.uid, entry);
+      docs.push(entry);
+    }
+  }
+  for (const d of docs) says.push(`\u26A0 The system doc "${d.title}" describes ${d.files.join(", ")}, which changed after it was verified at ${d.verifiedAt}`);
+  return { ok: says.length === 0, says, files, breakpoints, tests, criteria, docs, rules, rulesChecked: found !== null, rulebook: [...rulebook], notes: said, ratchet: ratchet.map(({ strength: _s, ...f }) => f) };
+}
+// Annotate the CommonJS export names for ESM import in node:
+0 && (module.exports = {
+  checkChanges,
+  cleanChanged
+});