codictator 0.1.2 → 0.2.0

package/dist/features/testing/scenarios.js

@@ -42,6 +42,54 @@ function reachableModules(test, importMap) {
     }
     return reached;
 }
+function coversChangedModule(input, globs, test, changed) {
+    if (!globs.some((glob) => globMatch(glob, test.path))) {
+        return false;
+    }
+    const reached = reachableModules(test, input.importMap);
+    return [...changed].some((module) => reached.has(module));
+}
+function coveringTests(input, kind, changed) {
+    const globs = input.kindGlobs[kind] ?? [];
+    return input.changedTests.filter((test) => coversChangedModule(input, globs, test, changed));
+}
+function architectureFinding(input, changed) {
+    const unmapped = [...changed].filter((module) => !input.mappedModules.includes(module));
+    if (unmapped.length === 0) {
+        return undefined;
+    }
+    return kindFinding(`architecture test missing: ${unmapped.join(", ")} map to no architecture module`, `Map ${unmapped.join(", ")} in config.architecture so the arch guard covers them.`);
+}
+function missingKindFinding(input, kind, changed) {
+    const globs = input.kindGlobs[kind] ?? [];
+    return kindFinding(`${kind} test missing for changed ${[...changed].join(", ") || "files"}`, `Add a ${kind} test under ${globs.join(", ") || "its kind globs"} importing a changed module.`);
+}
+function budgetFindings(kind, covering, budgets) {
+    const findings = [];
+    for (const test of covering) {
+        if (budgets[test.path] !== true) {
+            findings.push(kindFinding(`${kind} test without a budget line: ${test.path}`, `Declare a codictator:budget line (p95, p99, rps or maxMs) in ${test.path}.`));
+        }
+    }
+    return findings;
+}
+function collectKindFindings(input, kind, changed, findings) {
+    if (kind === "architecture") {
+        const missing = architectureFinding(input, changed);
+        if (missing !== undefined) {
+            findings.push(missing);
+        }
+        return;
+    }
+    const covering = coveringTests(input, kind, changed);
+    if (covering.length === 0) {
+        findings.push(missingKindFinding(input, kind, changed));
+        return;
+    }
+    if (kind === "stress" || kind === "load") {
+        findings.push(...budgetFindings(kind, covering, input.budgets));
+    }
+}
 // A kind is satisfied by a changed test file under its kind globs that
 // imports (transitively, depth 2) a changed module. Architecture is
 // satisfied when config.architecture maps every changed module, because
@@ -51,33 +99,7 @@ export function checkTestKinds(input) {
     const findings = [];
     const changed = new Set(input.changedModules);
     for (const kind of input.required) {
-        if (kind === "architecture") {
-            const unmapped = [...changed].filter((module) => !input.mappedModules.includes(module));
-            if (unmapped.length === 0) {
-                continue;
-            }
-            findings.push(kindFinding(`architecture test missing: ${unmapped.join(", ")} map to no architecture module`, `Map ${unmapped.join(", ")} in config.architecture so the arch guard covers them.`));
-            continue;
-        }
-        const globs = input.kindGlobs[kind] ?? [];
-        const covering = input.changedTests.filter((test) => {
-            if (!globs.some((glob) => globMatch(glob, test.path))) {
-                return false;
-            }
-            const reached = reachableModules(test, input.importMap);
-            return [...changed].some((module) => reached.has(module));
-        });
-        if (covering.length === 0) {
-            findings.push(kindFinding(`${kind} test missing for changed ${[...changed].join(", ") || "files"}`, `Add a ${kind} test under ${globs.join(", ") || "its kind globs"} importing a changed module.`));
-            continue;
-        }
-        if (kind === "stress" || kind === "load") {
-            for (const test of covering) {
-                if (input.budgets[test.path] !== true) {
-                    findings.push(kindFinding(`${kind} test without a budget line: ${test.path}`, `Declare a codictator:budget line (p95, p99, rps or maxMs) in ${test.path}.`));
-                }
-            }
-        }
+        collectKindFindings(input, kind, changed, findings);
     }
     return findings;
 }

package/dist/features/testing/tap-parser.js

@@ -48,33 +48,36 @@ function recordResult(stack, indent, name, passed, outcomes) {
     });
     return false;
 }
-export function parseTap(tap, filePath) {
-    const stack = [];
-    const outcomes = [];
-    for (const rawLine of tap.split("\n")) {
-        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
-        const trimmed = line.trimStart();
-        if (trimmed.startsWith("# Subtest: ")) {
-            openChild(stack);
-            stack.push({
-                name: unescapeTapName(trimmed.slice("# Subtest: ".length).trimEnd()),
-                indent: countIndent(line),
-                hasChildren: false,
-            });
-            continue;
-        }
-        if (trimmed.startsWith("#")) {
-            continue;
-        }
-        const match = /^( *)(not )?ok [0-9]+ - (.*)$/.exec(line);
-        if (match === null) {
-            continue;
-        }
-        const indent = (match[1] ?? "").length;
-        const passed = match[2] === undefined;
-        const name = unescapeTapName((match[3] ?? "").trimEnd());
-        recordResult(stack, indent, name, passed, outcomes);
+// The result pattern lives at module scope so its quantifiers never count
+// as branches of the function that applies it.
+const TAP_RESULT_PATTERN = /^( *)(not )?ok [0-9]+ - (.*)$/;
+function recordTapResult(stack, outcomes, line) {
+    const match = TAP_RESULT_PATTERN.exec(line);
+    if (match === null) {
+        return;
+    }
+    const indent = (match[1] ?? "").length;
+    const passed = match[2] === undefined;
+    const name = unescapeTapName((match[3] ?? "").trimEnd());
+    recordResult(stack, indent, name, passed, outcomes);
+}
+function recordTapLine(stack, outcomes, line) {
+    const trimmed = line.trimStart();
+    if (trimmed.startsWith("# Subtest: ")) {
+        openChild(stack);
+        stack.push({
+            name: unescapeTapName(trimmed.slice("# Subtest: ".length).trimEnd()),
+            indent: countIndent(line),
+            hasChildren: false,
+        });
+        return;
+    }
+    if (trimmed.startsWith("#")) {
+        return;
     }
+    recordTapResult(stack, outcomes, line);
+}
+function finishTapFile(outcomes, filePath) {
     const leaves = outcomes.filter((outcome) => outcome.title !== filePath);
     const fileLevelFailed = outcomes.some((outcome) => outcome.title === filePath && !outcome.passed);
     return {
@@ -82,3 +85,12 @@ export function parseTap(tap, filePath) {
         loadFailed: fileLevelFailed && leaves.length === 0,
     };
 }
+export function parseTap(tap, filePath) {
+    const stack = [];
+    const outcomes = [];
+    for (const rawLine of tap.split("\n")) {
+        const line = rawLine.endsWith("\r") ? rawLine.slice(0, -1) : rawLine;
+        recordTapLine(stack, outcomes, line);
+    }
+    return finishTapFile(outcomes, filePath);
+}

package/dist/features/workflow/phases.js

@@ -58,53 +58,56 @@ function e606TwoTasks(open, task) {
 }
 // SPEC §4.12.2 exit gates: the evidence each phase owes before the next
 // phase opens. Implementation and integrate owe no exit evidence.
+function missingDiscoveryEvidence(task) {
+    const missing = [];
+    if (task.spec.length === 0) {
+        missing.push("spec refs");
+    }
+    if (task.type === "fix" && (task.diagnosis ?? "").length === 0) {
+        missing.push("diagnosis");
+    }
+    return missing;
+}
+function missingPlanningEvidence(task) {
+    const missing = [];
+    if (task.files.allow.length === 0) {
+        missing.push("files.allow globs");
+    }
+    if (task.acceptanceCriteria.length === 0) {
+        missing.push("acceptance criteria");
+    }
+    if ((task.tests ?? []).length === 0) {
+        missing.push("declared tests");
+    }
+    if (task.redProof === undefined) {
+        missing.push("red proof");
+    }
+    return missing;
+}
+function missingRecordEvidence(task) {
+    const missing = [];
+    if (task.historyStaged !== true) {
+        missing.push("staged history entry");
+    }
+    if (task.type === "fix" && task.bugRowUpdated !== true) {
+        missing.push("bug row update");
+    }
+    return missing;
+}
 function missingExitEvidence(task, phase) {
     switch (phase) {
-        case "discovery": {
-            const missing = [];
-            if (task.spec.length === 0) {
-                missing.push("spec refs");
-            }
-            if (task.type === "fix" && (task.diagnosis ?? "").length === 0) {
-                missing.push("diagnosis");
-            }
-            return missing;
-        }
-        case "planning": {
-            const missing = [];
-            if (task.files.allow.length === 0) {
-                missing.push("files.allow globs");
-            }
-            if (task.acceptanceCriteria.length === 0) {
-                missing.push("acceptance criteria");
-            }
-            if ((task.tests ?? []).length === 0) {
-                missing.push("declared tests");
-            }
-            if (task.redProof === undefined) {
-                missing.push("red proof");
-            }
-            return missing;
-        }
-        case "validation": {
+        case "discovery":
+            return missingDiscoveryEvidence(task);
+        case "planning":
+            return missingPlanningEvidence(task);
+        case "validation":
             return task.greenProof === undefined ? ["green proof"] : [];
-        }
-        case "review": {
+        case "review":
             return missingReviewEvidence(task);
-        }
-        case "record": {
-            const missing = [];
-            if (task.historyStaged !== true) {
-                missing.push("staged history entry");
-            }
-            if (task.type === "fix" && task.bugRowUpdated !== true) {
-                missing.push("bug row update");
-            }
-            return missing;
-        }
-        default: {
+        case "record":
+            return missingRecordEvidence(task);
+        default:
             return [];
-        }
     }
 }
 function missingReviewEvidence(task) {

package/dist/features/workflow/review.js

@@ -1,20 +1,27 @@
 const SEVERITIES = ["blocker", "major", "minor", "nit"];
+function invalidFindingReason(finding) {
+    if (typeof finding.id !== "string" ||
+        typeof finding.severity !== "string" ||
+        typeof finding.path !== "string" ||
+        typeof finding.message !== "string" ||
+        finding.id.length === 0 ||
+        finding.message.length === 0) {
+        return "a finding misses id, severity, path or message";
+    }
+    if (!SEVERITIES.includes(finding.severity)) {
+        return `severity "${finding.severity}" is not blocker, major, minor or nit`;
+    }
+    return undefined;
+}
 function malformedReason(file) {
     if (!Array.isArray(file.findings)) {
         return "findings is not a list";
     }
     const seen = new Set();
     for (const finding of file.findings) {
-        if (typeof finding.id !== "string" ||
-            typeof finding.severity !== "string" ||
-            typeof finding.path !== "string" ||
-            typeof finding.message !== "string" ||
-            finding.id.length === 0 ||
-            finding.message.length === 0) {
-            return "a finding misses id, severity, path or message";
-        }
-        if (!SEVERITIES.includes(finding.severity)) {
-            return `severity "${finding.severity}" is not blocker, major, minor or nit`;
+        const reason = invalidFindingReason(finding);
+        if (reason !== undefined) {
+            return reason;
         }
         if (seen.has(finding.id)) {
             return `duplicate finding id "${finding.id}"`;

package/dist/kernel/git.js

@@ -84,7 +84,10 @@ export class NodeGit {
         return ok(result.stdout);
     }
     async show(rev, path) {
-        const result = await this.exec(["git", "show", `${rev}:${path}`]);
+        // Assembled off the call: an inline template inside exec( trips the
+        // exec-template pattern (SPEC §6.1), while argv entries never run a shell.
+        const revPath = `${rev}:${path}`;
+        const result = await this.exec(["git", "show", revPath]);
         const failure = procFailure("show", result);
         if (failure !== undefined) {
             return err(failure);

package/dist/kernel/pattern.js

@@ -18,99 +18,133 @@ function backreferenceError() {
 function invalidError() {
     return err(makeError("CDX-E902", "pattern has unbalanced parentheses", "Balance every opening parenthesis before using the pattern."));
 }
-// SPEC §9.2: scan with escape and character-class awareness so an escaped
-// parenthesis or a bracketed quantifier cannot hide a nested quantifier.
-export function checkPattern(pattern) {
-    if (pattern.length > MAX_PATTERN_LENGTH) {
-        return tooLongError();
+// The brace-quantifier pattern lives at module scope so its quantifiers
+// never count as branches of the function that applies it.
+const BRACE_QUANTIFIER_PATTERN = /^\{\d+(,\d*)?\}/;
+function scanPatternEscape(pattern, state) {
+    const next = pattern.charAt(state.index + 1);
+    if (next !== "" && next >= "1" && next <= "9") {
+        return backreferenceError();
     }
-    const groups = [];
-    let quantifiedInside = false;
-    let index = 0;
-    while (index < pattern.length) {
-        const current = pattern.charAt(index);
-        if (current === "\\") {
-            const next = pattern.charAt(index + 1);
-            if (next !== "" && next >= "1" && next <= "9") {
-                return backreferenceError();
-            }
-            if (next === "k") {
-                return backreferenceError();
-            }
-            index += 2;
-            continue;
-        }
-        if (current === "[") {
-            index += 1;
-            if (pattern.charAt(index) === "^") {
-                index += 1;
-            }
-            if (pattern.charAt(index) === "]") {
-                index += 1;
-            }
-            while (index < pattern.length && pattern.charAt(index) !== "]") {
-                if (pattern.charAt(index) === "\\") {
-                    index += 1;
-                }
-                index += 1;
-            }
-            index += 1;
-            continue;
-        }
-        if (current === "(") {
-            groups.push({ quantifiedInside });
-            quantifiedInside = false;
-            index += 1;
-            // SPEC §9.2: a ? directly after ( opens a non-capturing or
-            // lookaround group; it quantifies nothing.
-            if (pattern.charAt(index) === "?") {
-                index += 1;
-                const marker = pattern.charAt(index);
-                if (marker === ":" || marker === "=" || marker === "!") {
-                    index += 1;
-                }
-                else if (marker === "<") {
-                    const close = pattern.indexOf(">", index);
-                    if (close >= 0) {
-                        index = close + 1;
-                    }
-                }
-            }
-            continue;
-        }
-        if (current === ")") {
-            const frame = groups.pop();
-            if (frame === undefined) {
-                return invalidError();
-            }
-            const quantifier = pattern.charAt(index + 1);
-            const groupQuantified = quantifier === "+" || quantifier === "*" || quantifier === "?";
-            const braceQuantified = quantifier === "{";
-            if ((groupQuantified || braceQuantified) && quantifiedInside) {
-                return nestedError();
-            }
-            quantifiedInside =
-                frame.quantifiedInside || groupQuantified || braceQuantified;
+    if (next === "k") {
+        return backreferenceError();
+    }
+    state.index += 2;
+    return undefined;
+}
+function scanPatternClass(pattern, state) {
+    let index = state.index + 1;
+    if (pattern.charAt(index) === "^") {
+        index += 1;
+    }
+    if (pattern.charAt(index) === "]") {
+        index += 1;
+    }
+    while (index < pattern.length && pattern.charAt(index) !== "]") {
+        if (pattern.charAt(index) === "\\") {
             index += 1;
-            continue;
         }
-        if (current === "+" || current === "*" || current === "?") {
-            quantifiedInside = true;
-            index += 1;
-            continue;
+        index += 1;
+    }
+    state.index = index + 1;
+}
+function openPatternGroup(pattern, state) {
+    state.groups.push({ quantifiedInside: state.quantifiedInside });
+    state.quantifiedInside = false;
+    const afterParen = state.index + 1;
+    // SPEC §9.2: a ? directly after ( opens a non-capturing or
+    // lookaround group; it quantifies nothing.
+    if (pattern.charAt(afterParen) !== "?") {
+        state.index = afterParen;
+        return;
+    }
+    const marker = pattern.charAt(afterParen + 1);
+    if (marker === ":" || marker === "=" || marker === "!") {
+        state.index = afterParen + 2;
+        return;
+    }
+    if (marker === "<") {
+        const close = pattern.indexOf(">", afterParen + 1);
+        state.index = close >= 0 ? close + 1 : afterParen + 1;
+        return;
+    }
+    state.index = afterParen + 1;
+}
+function isGroupQuantifier(quantifier) {
+    return (quantifier === "+" ||
+        quantifier === "*" ||
+        quantifier === "?" ||
+        quantifier === "{");
+}
+function closePatternGroup(pattern, state) {
+    const frame = state.groups.pop();
+    if (frame === undefined) {
+        return invalidError();
+    }
+    const quantified = isGroupQuantifier(pattern.charAt(state.index + 1));
+    if (quantified && state.quantifiedInside) {
+        return nestedError();
+    }
+    state.quantifiedInside = frame.quantifiedInside || quantified;
+    state.index += 1;
+    return undefined;
+}
+function markPatternQuantifier(pattern, state) {
+    const current = pattern.charAt(state.index);
+    if (current === "{") {
+        if (BRACE_QUANTIFIER_PATTERN.test(pattern.slice(state.index))) {
+            state.quantifiedInside = true;
         }
-        if (current === "{") {
-            const rest = pattern.slice(index);
-            if (/^\{\d+(,\d*)?\}/.test(rest)) {
-                quantifiedInside = true;
-            }
-            index += 1;
-            continue;
+    }
+    else {
+        state.quantifiedInside = true;
+    }
+    state.index += 1;
+}
+function isQuantifierStart(current) {
+    return (current === "+" || current === "*" || current === "?" || current === "{");
+}
+function scanPatternStep(pattern, state) {
+    const current = pattern.charAt(state.index);
+    if (current === "\\") {
+        return scanPatternEscape(pattern, state);
+    }
+    if (current === "[") {
+        scanPatternClass(pattern, state);
+        return undefined;
+    }
+    if (current === "(") {
+        openPatternGroup(pattern, state);
+        return undefined;
+    }
+    if (current === ")") {
+        return closePatternGroup(pattern, state);
+    }
+    if (isQuantifierStart(current)) {
+        markPatternQuantifier(pattern, state);
+        return undefined;
+    }
+    state.index += 1;
+    return undefined;
+}
+function scanPatternBody(pattern) {
+    const state = { groups: [], quantifiedInside: false, index: 0 };
+    while (state.index < pattern.length) {
+        const failed = scanPatternStep(pattern, state);
+        if (failed !== undefined) {
+            return failed;
         }
-        index += 1;
     }
-    if (groups.length > 0) {
+    if (state.groups.length > 0) {
         return invalidError();
     }
     return ok(undefined);
 }
+// SPEC §9.2: scan with escape and character-class awareness so an escaped
+// parenthesis or a bracketed quantifier cannot hide a nested quantifier.
+export function checkPattern(pattern) {
+    if (pattern.length > MAX_PATTERN_LENGTH) {
+        return tooLongError();
+    }
+    return scanPatternBody(pattern);
+}

package/dist/kernel/secret-paths.js

@@ -15,37 +15,51 @@ export const DEFAULT_FIXTURE_GLOBS = [
     "**/test-data/**",
     "**/*.fixture.*",
 ];
+// The home-prefix patterns live at module scope so their quantifiers
+// never count as branches of the function that applies them.
+const HOME_PREFIX_PATTERNS = [
+    /^~[/\\]?/,
+    /^\$home[/\\]?/,
+    /^\$\{home\}[/\\]?/,
+    /^%userprofile%[/\\]?/,
+];
+function isEnvSecretFile(base) {
+    return (base === ".env" || (base.startsWith(".env.") && base !== ".env.example"));
+}
+function isKeyMaterialFile(base) {
+    return (base.endsWith(".pem") ||
+        base.endsWith(".key") ||
+        base.endsWith(".p12") ||
+        base.endsWith(".pfx") ||
+        base.startsWith("id_rsa") ||
+        base.startsWith("id_ed25519"));
+}
+function homeRelativePath(slashed) {
+    let relative = slashed.toLowerCase();
+    for (const pattern of HOME_PREFIX_PATTERNS) {
+        relative = relative.replace(pattern, "");
+    }
+    return relative;
+}
+function isSecretDirPath(slashed) {
+    const segments = homeRelativePath(slashed).split("/");
+    return (segments.some((segment) => SECRET_DIR_SEGMENTS.has(segment)) ||
+        (segments[0] === ".config" && segments[1] === "gh"));
+}
 // SPEC §4.7.1: the secret-read guard paths.
 export function isSecretReadPath(path) {
     const slashed = path.replace(/\\/g, "/");
     const base = slashed.split("/").pop() ?? "";
-    if (base === ".env" ||
-        (base.startsWith(".env.") && base !== ".env.example")) {
+    if (isEnvSecretFile(base)) {
         return true;
     }
-    if (base.endsWith(".pem") ||
-        base.endsWith(".key") ||
-        base.endsWith(".p12") ||
-        base.endsWith(".pfx") ||
-        base.startsWith("id_rsa") ||
-        base.startsWith("id_ed25519")) {
+    if (isKeyMaterialFile(base)) {
         return true;
     }
     if (SECRET_BASENAMES.has(base)) {
         return true;
     }
-    const lowered = slashed.toLowerCase();
-    const homeRelative = lowered
-        .replace(/^~[/\\]?/, "")
-        .replace(/^\$home[/\\]?/, "")
-        .replace(/^\$\{home\}[/\\]?/, "")
-        .replace(/^%userprofile%[/\\]?/, "");
-    const segments = homeRelative.split("/");
-    if (segments.some((segment) => SECRET_DIR_SEGMENTS.has(segment)) ||
-        (segments[0] === ".config" && segments[1] === "gh")) {
-        return true;
-    }
-    return false;
+    return isSecretDirPath(slashed);
 }
 // SPEC §4.7.1: placeholder credentials and test vectors under a declared
 // fixture glob are allowlisted. The kernel default covers the common

package/dist/kernel/shell-cmd.js

@@ -85,6 +85,25 @@ function skipFlagValues(words, valueFlags) {
     }
     return kept;
 }
+const SUDO_VALUE_FLAGS = new Set([
+    "-u",
+    "--user",
+    "-g",
+    "--group",
+]);
+function stripSudoPrefix(rest) {
+    const skipped = skipFlagValues(rest.slice(1), SUDO_VALUE_FLAGS);
+    if (skipped.length > 0 &&
+        (skipped[0] === "-c" || skipped[0] === "--command")) {
+        const script = skipped[1];
+        return {
+            rest: [],
+            scripts: script === undefined ? [] : [script],
+            bare: true,
+        };
+    }
+    return { rest: skipped, scripts: [], bare: false };
+}
 function stripPrefixes(words) {
     let rest = [...words];
     let raised = false;
@@ -100,13 +119,11 @@ function stripPrefixes(words) {
         }
         const lowered = baseName(head).toLowerCase();
         if (lowered === "sudo" || lowered === "su") {
+            const sudo = stripSudoPrefix(rest);
             raised = true;
-            rest = skipFlagValues(rest.slice(1), new Set(["-u", "--user", "-g", "--group"]));
-            if (rest.length > 0 && (rest[0] === "-c" || rest[0] === "--command")) {
-                const script = rest[1];
-                if (script !== undefined) {
-                    scripts.push(script);
-                }
+            rest = [...sudo.rest];
+            scripts.push(...sudo.scripts);
+            if (sudo.bare) {
                 return { rest: [], raised, scripts, bare: true };
             }
             continue;