codictator 0.0.0-stage → 0.1.2

package/dist/features/packs/enforcers/health-measures.js

@@ -0,0 +1,214 @@
+import { readErrorFinding, readLossyText, selectFiles, tunableNumber, } from "./binding.js";
+import { blankCode } from "./health-lex.js";
+import { extractLiteralSpecifiers } from "./health-lex-imports.js";
+import { isMarkerFile, parseMarkerInt, parseMarkers, } from "./health-markers.js";
+function lineStartsFor(text) {
+    const starts = [0];
+    for (let index = 0; index < text.length; index += 1) {
+        if (text.charAt(index) === "\n") {
+            starts.push(index + 1);
+        }
+    }
+    return starts;
+}
+function lineAtIndex(starts, index) {
+    let low = 0;
+    let high = starts.length - 1;
+    while (low < high) {
+        const mid = (low + high + 1) >> 1;
+        if ((starts[mid] ?? 0) <= index) {
+            low = mid;
+        }
+        else {
+            high = mid - 1;
+        }
+    }
+    return low + 1;
+}
+// SPEC §6.1: 1 + `if`, `for`, `while`, `case`, `catch`, `&&`, `||`, `??`
+// and the ternary `?` (excluding `?.`, `??` and `?:`). Patterns live at
+// module scope so the branch words they name never count as branches of
+// the function that applies them.
+const WORDS_PATTERN = /\b(if|for|while|case|catch)\b/g;
+const ANDS_PATTERN = /&&/g;
+const ORS_PATTERN = /\|\|/g;
+const NULLISH_PATTERN = /\?\?/g;
+const TERNARY_PATTERN = /\?(?![?.:])/g;
+function countMatches(blanked, pattern) {
+    return blanked.match(pattern)?.length ?? 0;
+}
+export function countCyclomatic(blanked) {
+    const words = countMatches(blanked, WORDS_PATTERN);
+    const ands = countMatches(blanked, ANDS_PATTERN);
+    const ors = countMatches(blanked, ORS_PATTERN);
+    const nullish = countMatches(blanked, NULLISH_PATTERN);
+    const withoutNullish = blanked.split("??").join("  ");
+    const ternary = countMatches(withoutNullish, TERNARY_PATTERN);
+    return 1 + words + ands + ors + nullish + ternary;
+}
+function matchBrace(blanked, open) {
+    let depth = 0;
+    for (let index = open; index < blanked.length; index += 1) {
+        const char = blanked.charAt(index);
+        if (char === "{") {
+            depth += 1;
+        }
+        else if (char === "}") {
+            depth -= 1;
+            if (depth === 0) {
+                return index;
+            }
+        }
+    }
+    return -1;
+}
+// SPEC §6.1: size by brace matching from `function`, method and arrow
+// starts. One span per body, judged on its own.
+// SPEC §6.1: size by brace matching from `function`, method and arrow-body
+// starts. One span per body; a body brace that closes on its own line is an
+// object literal or a default value, not a body, so the search skips it. An
+// arrow or function with no body brace after it is one line; an unbalanced
+// brace is skipped. Bodies on a later line are missed (biome formats bodies
+// same-line).
+function bodyBrace(blanked, starts, from) {
+    const stop = blanked.indexOf("\n", from);
+    const limit = stop < 0 ? blanked.length : stop;
+    let open = blanked.indexOf("{", from);
+    while (open >= 0 && open < limit) {
+        const close = matchBrace(blanked, open);
+        if (close < 0) {
+            return undefined;
+        }
+        if (lineAtIndex(starts, close) > lineAtIndex(starts, open)) {
+            return { open, close };
+        }
+        open = blanked.indexOf("{", open + 1);
+    }
+    return undefined;
+}
+export function measureFunctionSpans(text) {
+    const blanked = blankCode(text);
+    const starts = lineStartsFor(text);
+    const froms = [];
+    for (const match of blanked.matchAll(/\bfunction\b|=>/g)) {
+        froms.push({ index: match.index ?? -1, arrow: match[0] === "=>" });
+    }
+    const spans = [];
+    for (const from of froms) {
+        if (from.index < 0) {
+            continue;
+        }
+        if (blanked.indexOf("{", from.index) < 0) {
+            spans.push({ line: lineAtIndex(starts, from.index), lines: 1 });
+            continue;
+        }
+        const body = bodyBrace(blanked, starts, from.index);
+        if (body === undefined) {
+            // A braceless arrow is one logical line; an unbalanced
+            // `function` body is skipped instead (the self-test pins both).
+            if (from.arrow) {
+                spans.push({ line: lineAtIndex(starts, from.index), lines: 1 });
+            }
+            continue;
+        }
+        spans.push({
+            line: lineAtIndex(starts, from.index),
+            lines: lineAtIndex(starts, body.close) - lineAtIndex(starts, from.index) + 1,
+        });
+    }
+    return spans.sort((a, b) => a.line - b.line);
+}
+export async function loadScopeText(ports, binding, file, findings) {
+    const loaded = await readLossyText(ports.fs, file);
+    if (!loaded.ok) {
+        findings.push(readErrorFinding(binding, file, loaded.error, "read"));
+        return undefined;
+    }
+    return loaded.value.text;
+}
+// SPEC §5.12/§5.1: the gate and steering marker evaluators share one
+// scope-text reader over the self-test marker reports (§4.4.1
+// sample.txt files), so each guard file stays a pure move of resolvers.
+export async function scopeMarkerTexts(ports, binding, ctx, findings) {
+    const out = [];
+    for (const file of selectFiles(ctx.scope.files, binding.scopeGlobs)) {
+        // Marker reports live in sample.txt fixtures; other files carry no
+        // markers, so reading them only pays a parse for nothing. Real
+        // files still surface read errors through loadScopeText callers
+        // that judge them.
+        if (!isMarkerFile(file)) {
+            continue;
+        }
+        const text = await loadScopeText(ports, binding, file, findings);
+        if (text === undefined) {
+            continue;
+        }
+        out.push({ file, markers: parseMarkers(text) });
+    }
+    return out;
+}
+export function baseEnforcer(rule, binding, decl, check) {
+    return {
+        id: rule.id,
+        kinds: binding.triggers,
+        budgetMs: decl.budgetMs,
+        check,
+    };
+}
+export function limitOf(binding, name, fallback) {
+    return tunableNumber(binding, name) ?? fallback;
+}
+const TS_EXTENSIONS = [
+    ".ts",
+    ".tsx",
+    ".js",
+    ".jsx",
+    ".mjs",
+    ".cjs",
+    ".mts",
+    ".cts",
+];
+export { isMarkerFile, parseMarkerInt, parseMarkers };
+export function isTsFile(path) {
+    const lowered = path.toLowerCase();
+    return TS_EXTENSIONS.some((extension) => lowered.endsWith(extension));
+}
+export function exportedNamesOf(blanked) {
+    const names = [];
+    for (const match of blanked.matchAll(/\bexport\s+(?:default\b|(?:async\s+)?(?:function\s*\*?\s*|class\s+|interface\s+|type\s+|enum\s+|const\s+|let\s+|var\s+)([A-Za-z_$][\w$]*))/g)) {
+        const name = match[1] ?? "";
+        if (name !== "") {
+            names.push(name);
+        }
+    }
+    for (const match of blanked.matchAll(/\bexport\s*\{([^}]*)\}/g)) {
+        for (const part of (match[1] ?? "").split(",")) {
+            const identifier = part.trim().match(/([A-Za-z_$][\w$]*)$/);
+            if (identifier !== null) {
+                names.push(identifier[1] ?? "");
+            }
+        }
+    }
+    return [...new Set(names)].sort();
+}
+function baseNameOf(path) {
+    const slash = path.lastIndexOf("/");
+    const base = slash < 0 ? path : path.slice(slash + 1);
+    const dot = base.lastIndexOf(".");
+    return dot < 0 ? base : base.slice(0, dot);
+}
+export function isEntryFile(path) {
+    const base = baseNameOf(path).toLowerCase();
+    return (base === "main" ||
+        base === "index" ||
+        base === "cli" ||
+        path.includes(".test."));
+}
+export function fileImportsTarget(importing, target) {
+    const needle = baseNameOf(target);
+    return extractLiteralSpecifiers(importing).some((ref) => {
+        const last = ref.spec.split("/").pop() ?? "";
+        const stem = last.replace(/\.(ts|tsx|js|jsx|mjs|cjs|mts|cts)$/, "");
+        return stem === needle;
+    });
+}

package/dist/features/packs/enforcers/health-refs.d.ts

@@ -0,0 +1,6 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveDeadCode(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/health-refs.js

@@ -0,0 +1,61 @@
+import { ok } from "../../../kernel/index.js";
+import { bindRule, findingFor, selectFiles } from "./binding.js";
+import { blankCode } from "./health-lex.js";
+import { baseEnforcer, exportedNamesOf, fileImportsTarget, isEntryFile, isMarkerFile, isTsFile, loadScopeText, parseMarkerInt, parseMarkers, } from "./health-measures.js";
+// SPEC §5.6 core/dead-code: no unused exports or members. The pack
+// measure is an exported name in a non-entry file with no importer.
+export function resolveDeadCode(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        const files = selectFiles(ctx.scope.files, binding.scopeGlobs);
+        const texts = new Map();
+        for (const file of files) {
+            const text = await loadScopeText(ports, binding, file, findings);
+            if (text !== undefined) {
+                texts.set(file, text);
+            }
+        }
+        for (const file of files) {
+            const text = texts.get(file);
+            if (text === undefined) {
+                continue;
+            }
+            if (isMarkerFile(file)) {
+                const markers = parseMarkers(text);
+                const importers = parseMarkerInt(markers, "importers") ?? 1;
+                const exported = markers.get("exported") ?? "export";
+                if (importers === 0) {
+                    findings.push(findingFor(binding, {
+                        path: file,
+                        line: 1,
+                        message: `unused export ${exported} in ${file}`,
+                        vars: { path: file, line: "1", value: exported },
+                    }));
+                }
+                continue;
+            }
+            if (!isTsFile(file) || isEntryFile(file)) {
+                continue;
+            }
+            const exported = exportedNamesOf(blankCode(text));
+            if (exported.length === 0) {
+                continue;
+            }
+            const imported = [...texts.entries()].some(([other, otherText]) => other !== file &&
+                isTsFile(other) &&
+                fileImportsTarget(otherText, file));
+            if (!imported) {
+                for (const name of exported) {
+                    findings.push(findingFor(binding, {
+                        path: file,
+                        line: 1,
+                        message: `unused export ${name} in ${file}`,
+                        vars: { path: file, line: "1", value: name },
+                    }));
+                }
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/integrity-guards-repo.d.ts

@@ -0,0 +1,6 @@
+import { type Ports, type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveNoBypass(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveRepoHygiene(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;

package/dist/features/packs/enforcers/integrity-guards-repo.js

@@ -0,0 +1,189 @@
+// SPEC §4.14.2/§4.14.3 + §5.11: repo-integrity enforcers. Split from the
+// test-integrity guards (integrity-guards) by responsibility: hook bypass
+// and committed hygiene here, test vectors there.
+import { analyseShell, isProtectedPath, matchBypassCommand, ok, scanBypassRawText, } from "../../../kernel/index.js";
+import { bindRule, findingFor } from "./binding.js";
+import { baseEnforcer, scopeMarkerTexts } from "./health-measures.js";
+// SPEC §4.14.3 command table: the shells whose bare remainder is a command
+// of its own. A bare `bash git commit -n` parses as one argv, so the text
+// past the shell name is evaluated as its own candidate, the text form of
+// checkSelfProtection's argv candidates (self-protection.ts).
+const BARE_SHELLS = new Set([
+    "bash",
+    "sh",
+    "dash",
+    "zsh",
+    "env",
+    "sudo",
+    "doas",
+]);
+function bareRemainder(cmd) {
+    const lowered = cmd.name.replaceAll("\\", "/").split("/").pop()?.toLowerCase() ?? "";
+    if (!BARE_SHELLS.has(lowered)) {
+        return undefined;
+    }
+    if (cmd.argv.includes("-c") || cmd.argv.includes("--command")) {
+        return undefined;
+    }
+    return cmd.argv.length > 0 ? cmd.argv.join(" ") : undefined;
+}
+// SPEC §4.7.2: wrappers do not hide bypasses, so one shell text fans out to
+// its payloads: the -c/--command scripts and bare-shell remainders the
+// analyser collected, transitively. Unparseable candidates are skipped
+// here; the caller blocks them fail-closed instead of allowing.
+function shellCandidates(text) {
+    const seen = new Set([text]);
+    const out = [text];
+    const queue = [text];
+    while (queue.length > 0) {
+        const current = queue.pop() ?? "";
+        const parsed = analyseShell(current);
+        if (!parsed.ok) {
+            continue;
+        }
+        for (const pipeline of parsed.value.pipelines) {
+            for (const cmd of pipeline.commands) {
+                const extras = [
+                    ...cmd.embedded,
+                    bareRemainder(cmd),
+                ];
+                for (const extra of extras) {
+                    if (extra !== undefined && extra !== "" && !seen.has(extra)) {
+                        seen.add(extra);
+                        out.push(extra);
+                        queue.push(extra);
+                    }
+                }
+            }
+        }
+    }
+    return out;
+}
+function firstWord(text) {
+    const trimmed = text.trimStart();
+    const space = trimmed.search(/\s/);
+    return space < 0 ? trimmed : trimmed.slice(0, space);
+}
+function unparseableFinding() {
+    return {
+        ruleId: "core/dangerous-shell",
+        code: "CDX-E306",
+        message: "shell command in tool input is unparseable",
+        remediation: "Rewrite the command with balanced quotes and retry (§4.7.2).",
+    };
+}
+// SPEC §4.14.3 L1: the shellCommand text is judged like checkSelfProtection
+// judges argv — structured match first, raw-text backstop second (env-prefix
+// stripping hides HUSKY=0 from the parse, so the raw scan stays).
+function checkShellCommand(binding, command) {
+    const findings = [];
+    for (const candidate of shellCandidates(command)) {
+        const parsed = analyseShell(candidate);
+        if (!parsed.ok) {
+            continue;
+        }
+        for (const pipeline of parsed.value.pipelines) {
+            for (const cmd of pipeline.commands) {
+                const hit = matchBypassCommand(cmd);
+                if (hit !== undefined) {
+                    findings.push(findingFor(binding, {
+                        message: `${hit} in tool input`,
+                        vars: { path: "tool input" },
+                    }));
+                    return findings;
+                }
+            }
+        }
+    }
+    const raw = scanBypassRawText(command);
+    if (raw !== undefined) {
+        findings.push(findingFor(binding, {
+            message: `${raw} in tool input`,
+            vars: { path: "tool input" },
+        }));
+    }
+    return findings;
+}
+// SPEC §4.14.3 target rows: a tool-form write carries proposed content, so
+// the lexical proposed paths are write targets and guardrail paths block.
+// Reads carry no content and stay allowed; L0 still reads guardrail state.
+function checkProposedWrites(binding, scope) {
+    const findings = [];
+    if (scope.proposedContent === undefined) {
+        return findings;
+    }
+    for (const target of [...(scope.proposedPaths ?? [])].sort()) {
+        if (isProtectedPath(target)) {
+            findings.push(findingFor(binding, {
+                path: target,
+                message: `agent write of protected guardrail path ${target}`,
+                vars: { path: target },
+            }));
+        }
+    }
+    return findings;
+}
+// SPEC §4.14.3 L1: the live hook scope carries the one tool call, so the
+// enforcer judges it alongside the marker report. Parse failure alone never
+// becomes an allow: an unparseable shell-looking command blocks CDX-E306.
+function checkLiveBypass(binding, ctx) {
+    const findings = checkProposedWrites(binding, ctx.scope);
+    const command = ctx.scope.shellCommand;
+    if (command === undefined || command === "") {
+        return findings;
+    }
+    findings.push(...checkShellCommand(binding, command));
+    if (!analyseShell(command).ok) {
+        const head = firstWord(command).toLowerCase();
+        if (BARE_SHELLS.has(head) || /[;|&$`()]/.test(command)) {
+            findings.push(unparseableFinding());
+        }
+    }
+    return findings;
+}
+// SPEC §4.14.2/§4.14.3 core/no-bypass: the live L1 command shapes above,
+// plus a commit that skips the hooks (--no-verify) flags at L4. The marker
+// mirror below answers from the case report.
+export function resolveNoBypass(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
+            if ((markers.get("commit") ?? "").includes("--no-verify")) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: "commit skips the hooks with --no-verify",
+                    vars: { path: file },
+                }));
+            }
+        }
+        findings.push(...checkLiveBypass(binding, ctx));
+        return findings;
+    }));
+}
+// SPEC §5.11 core/repo-hygiene: committed build output or caches flag. The
+// .gitattributes and root-allowlist reads stay in the integrity module;
+// the marker mirror judges only the reported committed paths, matched on
+// whole segments so src/dist-info stays quiet.
+const OUTPUT_DIR_PATTERN = /(^|\/)(node_modules|dist|build|bin|obj|__pycache__|\.venv|coverage)(\/|$)/i;
+export function resolveRepoHygiene(decl, rule, ports) {
+    const binding = bindRule(rule);
+    return ok(baseEnforcer(rule, binding, decl, async (ctx) => {
+        const findings = [];
+        for (const { file, markers } of await scopeMarkerTexts(ports, binding, ctx, findings)) {
+            const committed = (markers.get("committed") ?? "")
+                .split(",")
+                .map((entry) => entry.trim())
+                .filter((entry) => entry !== "");
+            const bad = committed.find((entry) => OUTPUT_DIR_PATTERN.test(entry));
+            if (bad !== undefined) {
+                findings.push(findingFor(binding, {
+                    path: file,
+                    message: `committed build output or cache: ${bad}`,
+                    vars: { path: bad },
+                }));
+            }
+        }
+        return findings;
+    }));
+}

package/dist/features/packs/enforcers/integrity-guards.d.ts

@@ -0,0 +1,12 @@
+import type { Ports } from "../../../kernel/index.ts";
+import { type Result } from "../../../kernel/index.ts";
+import type { Enforcer } from "../../engine/index.ts";
+import type { PackRule } from "../index.ts";
+import type { EnforcerDecl } from "../manifest.ts";
+export declare function resolveNoAssertionLoss(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoSkippedTests(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoNewSuppressions(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoFixtureShrink(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoThresholdLowering(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveTestCommandIntact(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;
+export declare function resolveNoBaselineRaise(decl: EnforcerDecl, rule: PackRule, ports: Ports): Result<Enforcer>;