cohorte 3.0.0-dev.1 → 3.0.0-dev.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/assets/manifest.json +1 -1
- package/dist/bundle-manifest.json +18 -18
- package/dist/chunks/{auth-CYOh60KG.mjs → auth-RuhYgTI7.mjs} +50 -2
- package/dist/chunks/auth-RuhYgTI7.mjs.map +1 -0
- package/dist/chunks/{catalogue-BvwSrM_j.mjs → catalogue-B5uFqfzJ.mjs} +2 -2
- package/dist/chunks/{catalogue-BvwSrM_j.mjs.map → catalogue-B5uFqfzJ.mjs.map} +1 -1
- package/dist/chunks/{compose-Dvxunpto.mjs → compose-D8rro98O.mjs} +24 -17
- package/dist/chunks/{compose-Dvxunpto.mjs.map → compose-D8rro98O.mjs.map} +1 -1
- package/dist/chunks/{diff-Qw0II0sj.mjs → diff-D_0hBwHl.mjs} +2 -2
- package/dist/chunks/{diff-Qw0II0sj.mjs.map → diff-D_0hBwHl.mjs.map} +1 -1
- package/dist/chunks/{doctor-B-H2UK5e.mjs → doctor-CginW8y8.mjs} +4 -4
- package/dist/chunks/{doctor-B-H2UK5e.mjs.map → doctor-CginW8y8.mjs.map} +1 -1
- package/dist/chunks/{policy-DUIgzF3W.mjs → policy-Clypo20s.mjs} +3 -3
- package/dist/chunks/{policy-DUIgzF3W.mjs.map → policy-Clypo20s.mjs.map} +1 -1
- package/dist/chunks/{src-CfAOde7C.mjs → src-DZazJCp1.mjs} +2 -2
- package/dist/chunks/{src-CfAOde7C.mjs.map → src-DZazJCp1.mjs.map} +1 -1
- package/dist/chunks/{src-CId6kMsY.mjs → src-r0ECB1UJ.mjs} +2 -2
- package/dist/chunks/{src-CId6kMsY.mjs.map → src-r0ECB1UJ.mjs.map} +1 -1
- package/dist/cli.mjs +6 -6
- package/dist/cli.mjs.map +1 -1
- package/package.json +1 -1
- package/dist/chunks/auth-CYOh60KG.mjs.map +0 -1
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { n as sha256Hex } from "./canonical-C8UxeEmB.mjs";
|
|
2
2
|
import "./src-Cu3TxNob.mjs";
|
|
3
|
-
import { mkdir, writeFile } from "node:fs/promises";
|
|
4
3
|
import { execFile } from "node:child_process";
|
|
4
|
+
import { mkdir, writeFile } from "node:fs/promises";
|
|
5
5
|
import { promisify } from "node:util";
|
|
6
6
|
//#region src/commands/diff/index.ts
|
|
7
7
|
const exec = promisify(execFile);
|
|
@@ -98,4 +98,4 @@ const diff = {
|
|
|
98
98
|
//#endregion
|
|
99
99
|
export { diff as default };
|
|
100
100
|
|
|
101
|
-
//# sourceMappingURL=diff-
|
|
101
|
+
//# sourceMappingURL=diff-D_0hBwHl.mjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"diff-
|
|
1
|
+
{"version":3,"file":"diff-D_0hBwHl.mjs","names":[],"sources":["../../../../apps/cli/src/commands/diff/index.ts"],"sourcesContent":["import { execFile } from 'node:child_process';\nimport { mkdir, writeFile } from 'node:fs/promises';\nimport { promisify } from 'node:util';\nimport { sha256Hex } from '@cohorte/base';\nimport type { CommandModule } from '../../contract/index.ts';\n\nconst exec = promisify(execFile);\ntype GitRow = { path: string; op: 'create' | 'modify' | 'delete'; added: number; removed: number };\n\nasync function git(cwd: string, args: string[]): Promise<string> {\n const result = await exec('git', args, { cwd, maxBuffer: 4 * 1024 * 1024 });\n return result.stdout;\n}\n\nfunction parseNumstat(text: string): GitRow[] {\n return text\n .split('\\n')\n .filter(Boolean)\n .map((line) => {\n const [addedText, removedText, ...pathParts] = line.split('\\t');\n const path = pathParts.join('\\t');\n const added = addedText === '-' ? 0 : Number(addedText);\n const removed = removedText === '-' ? 0 : Number(removedText);\n return {\n path,\n op: added === 0 && removed > 0 ? 'delete' : added > 0 && removed === 0 ? 'create' : 'modify',\n added,\n removed,\n };\n });\n}\n\nconst diff: CommandModule = {\n verb: 'diff',\n async run(ctx, args) {\n const runId = args.positionals[0];\n if (!runId) return 2;\n const store = await ctx.openStore();\n try {\n const tree = await store.readRunTree(runId as never);\n const run = tree.run;\n const worktree =\n tree.worktrees.find((item) => item.slot === (args.positionals[1] ?? '_integration')) ?? tree.worktrees[0];\n if (!worktree || !run.baseSha) return 3;\n const base = run.baseSha;\n const head = run.integrationHead ?? (await git(worktree.path, ['rev-parse', 'HEAD'])).trim();\n const rows = parseNumstat(await git(worktree.path, ['diff', '--numstat', `${base}..${head}`]));\n const patch = await git(worktree.path, ['diff', '--binary', `${base}..${head}`]);\n const artifactId = ctx.ids.next<'ArtifactId'>('art');\n const artifactDir = `${ctx.cwd}/.cohorte/runs/${runId}/artifacts`;\n const relativePatch = `.cohorte/runs/${runId}/artifacts/${artifactId}.patch`;\n await mkdir(artifactDir, { recursive: true, mode: 0o700 });\n await writeFile(`${ctx.cwd}/${relativePatch}`, patch, 'utf8');\n const document = {\n documentVersion: 1,\n runId,\n base: { branch: run.baseBranch, sha: base },\n head: {\n branch: run.integrationBranch ?? worktree.branch ?? 'HEAD',\n sha: head,\n treeDigest: (await git(worktree.path, ['rev-parse', `${head}^{tree}`])).trim(),\n },\n surfaces: [\n {\n surface: args.positionals[1] ?? 'shared',\n files: rows.map((row) => ({ path: row.path, op: row.op })),\n stat: {\n added: rows.reduce((sum, row) => sum + row.added, 0),\n removed: rows.reduce((sum, row) => sum + row.removed, 0),\n },\n patch: {\n artifactId,\n kind: 'patch',\n path: relativePatch,\n sha256: sha256Hex(patch),\n bytes: Buffer.byteLength(patch),\n },\n },\n ],\n };\n if (args.json) ctx.stdio.stdout.write(`${JSON.stringify(document)}\\n`);\n else ctx.stdio.stdout.write(patch);\n return 0;\n } finally {\n await store.close();\n }\n },\n};\n\nexport default diff;\n"],"mappings":";;;;;;AAMA,MAAM,OAAO,UAAU,QAAQ;AAG/B,eAAe,IAAI,KAAa,MAAiC;CAE/D,QAAO,MADc,KAAK,OAAO,MAAM;EAAE;EAAK,WAAW;CAAgB,CAAC,EAAA,CAC5D;AAChB;AAEA,SAAS,aAAa,MAAwB;CAC5C,OAAO,KACJ,MAAM,IAAI,CAAC,CACX,OAAO,OAAO,CAAC,CACf,KAAK,SAAS;EACb,MAAM,CAAC,WAAW,aAAa,GAAG,aAAa,KAAK,MAAM,GAAI;EAC9D,MAAM,OAAO,UAAU,KAAK,GAAI;EAChC,MAAM,QAAQ,cAAc,MAAM,IAAI,OAAO,SAAS;EACtD,MAAM,UAAU,gBAAgB,MAAM,IAAI,OAAO,WAAW;EAC5D,OAAO;GACL;GACA,IAAI,UAAU,KAAK,UAAU,IAAI,WAAW,QAAQ,KAAK,YAAY,IAAI,WAAW;GACpF;GACA;EACF;CACF,CAAC;AACL;AAEA,MAAM,OAAsB;CAC1B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,QAAQ,KAAK,YAAY;EAC/B,IAAI,CAAC,OAAO,OAAO;EACnB,MAAM,QAAQ,MAAM,IAAI,UAAU;EAClC,IAAI;GACF,MAAM,OAAO,MAAM,MAAM,YAAY,KAAc;GACnD,MAAM,MAAM,KAAK;GACjB,MAAM,WACJ,KAAK,UAAU,MAAM,SAAS,KAAK,UAAU,KAAK,YAAY,MAAM,eAAe,KAAK,KAAK,UAAU;GACzG,IAAI,CAAC,YAAY,CAAC,IAAI,SAAS,OAAO;GACtC,MAAM,OAAO,IAAI;GACjB,MAAM,OAAO,IAAI,oBAAoB,MAAM,IAAI,SAAS,MAAM,CAAC,aAAa,MAAM,CAAC,EAAA,CAAG,KAAK;GAC3F,MAAM,OAAO,aAAa,MAAM,IAAI,SAAS,MAAM;IAAC;IAAQ;IAAa,GAAG,KAAK,IAAI;GAAM,CAAC,CAAC;GAC7F,MAAM,QAAQ,MAAM,IAAI,SAAS,MAAM;IAAC;IAAQ;IAAY,GAAG,KAAK,IAAI;GAAM,CAAC;GAC/E,MAAM,aAAa,IAAI,IAAI,KAAmB,KAAK;GACnD,MAAM,cAAc,GAAG,IAAI,IAAI,iBAAiB,MAAM;GACtD,MAAM,gBAAgB,iBAAiB,MAAM,aAAa,WAAW;GACrE,MAAM,MAAM,aAAa;IAAE,WAAW;IAAM,MAAM;GAAM,CAAC;GACzD,MAAM,UAAU,GAAG,IAAI,IAAI,GAAG,iBAAiB,OAAO,MAAM;GAC5D,MAAM,WAAW;IACf,iBAAiB;IACjB;IACA,MAAM;KAAE,QAAQ,IAAI;KAAY,KAAK;IAAK;IAC1C,MAAM;KACJ,QAAQ,IAAI,qBAAqB,SAAS,UAAU;KACpD,KAAK;KACL,aAAa,MAAM,IAAI,SAAS,MAAM,CAAC,aAAa,GAAG,KAAK,QAAQ,CAAC,EAAA,CAAG,KAAK;IAC/E;IACA,UAAU,CACR;KACE,SAAS,KAAK,YAAY,MAAM;KAChC,OAAO,KAAK,KAAK,SAAS;MAAE,MAAM,IAAI;MAAM,IAAI,IAAI;KAAG,EAAE;KACzD,MAAM;MACJ,OAAO,KAAK,QAAQ,KAAK,QAAQ,MAAM,IAAI,OAAO,CAAC;MACnD,SAAS,KAAK,QAAQ,KAAK,QAAQ,MAAM,IAAI,SAAS,CAAC;KACzD;KACA,OAAO;MACL;MACA,MAAM;MACN,MAAM;MACN,QAAQ,UAAU,KAAK;MACvB,OAAO,OAAO,WAAW,KAAK;KAChC;IACF,CACF;GACF;GACA,IAAI,KAAK,MAAM,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,QAAQ,EAAE,GAAG;QAChE,IAAI,MAAM,OAAO,MAAM,KAAK;GACjC,OAAO;EACT,UAAU;GACR,MAAM,MAAM,MAAM;EACpB;CACF;AACF"}
|
|
@@ -3,10 +3,10 @@ import "./src-Cu3TxNob.mjs";
|
|
|
3
3
|
import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
|
|
4
4
|
import "./contract-BkMjU1kR.mjs";
|
|
5
5
|
import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
|
|
6
|
-
import { _ as probeSandbox } from "./src-
|
|
7
|
-
import { l as verifyProjectionAgainstEvents } from "./src-
|
|
8
|
-
import { join } from "node:path";
|
|
6
|
+
import { _ as probeSandbox } from "./src-r0ECB1UJ.mjs";
|
|
7
|
+
import { l as verifyProjectionAgainstEvents } from "./src-DZazJCp1.mjs";
|
|
9
8
|
import { execFile } from "node:child_process";
|
|
9
|
+
import { join } from "node:path";
|
|
10
10
|
import { promisify } from "node:util";
|
|
11
11
|
//#region src/contract/doctor.ts
|
|
12
12
|
/** DESIGN §9 doctor capabilities + F-1 (ripgrep backend) + F-3 (sandbox availability) + 6.3 (protected roots). */
|
|
@@ -219,4 +219,4 @@ const doctor = {
|
|
|
219
219
|
//#endregion
|
|
220
220
|
export { doctor as default };
|
|
221
221
|
|
|
222
|
-
//# sourceMappingURL=doctor-
|
|
222
|
+
//# sourceMappingURL=doctor-CginW8y8.mjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"doctor-B-H2UK5e.mjs","names":[],"sources":["../../../../apps/cli/src/contract/doctor.ts","../../../../apps/cli/src/doctor/checks/auth/index.ts","../../../../apps/cli/src/doctor/index.ts","../../../../apps/cli/src/commands/doctor/index.ts"],"sourcesContent":["// apps/cli/src/contract/doctor.ts — the frozen list of doctor check modules (PLAN PC-4 \"DoctorCheck + the frozen\n// list of doctor check modules\"). `doctor/index.ts` (area barrel, U4.05) runs every id of `DOCTOR_CHECK_IDS`\n// through `doctor/checks/<id>/index.ts`; only `auth` is a Wave-0 owned stub (`apps/cli/src/doctor/checks/auth`,\n// filled by U5.05) — the rest are created, under the same shape, by U4.05.\nimport type { DOCTOR_CHECK_STATUSES } from '@cohorte/protocol';\nimport type { CliContext } from './context.ts';\n\nexport type DoctorCheckStatus = (typeof DOCTOR_CHECK_STATUSES)[number];\n\nexport interface DoctorCheckResult {\n readonly id: string;\n readonly status: DoctorCheckStatus;\n readonly summary: string;\n readonly remediation?: string;\n}\n\nexport interface DoctorCheck {\n readonly id: string;\n readonly description: string;\n run(ctx: CliContext): Promise<DoctorCheckResult>;\n}\n\n/** DESIGN §9 doctor capabilities + F-1 (ripgrep backend) + F-3 (sandbox availability) + 6.3 (protected roots). */\nexport const DOCTOR_CHECK_IDS = [\n 'node-version',\n 'git',\n 'sqlite',\n 'search-backend',\n 'sandbox',\n 'auth',\n 'install',\n 'config',\n 'worktree-root',\n] as const;\nexport type DoctorCheckId = (typeof DOCTOR_CHECK_IDS)[number];\n","// apps/cli/src/doctor/checks/auth/index.ts — the `auth` doctor check (spec 10 \"auth status\"). Wave-0 typed stub:\n// filled by `U5.05`, which owns `apps/cli/src/doctor/checks/auth/**`.\nimport type { DoctorCheck } from '../../../contract/index.ts';\n\nconst authDoctorCheck: DoctorCheck = {\n id: 'auth',\n description: \"Checks that the configured provider's authentication is usable, without reading the token.\",\n async run(ctx) {\n try {\n const statuses = await ctx.runtime.resolve().authStatus([]);\n const usable = statuses.every((status) => status.state !== 'absent' && status.state !== 'unknown-transient');\n const accountNote = statuses.some((status) => status.accountLabel === undefined)\n ? '; account: not exposed by the engine'\n : '';\n return {\n id: 'auth',\n status: usable ? 'ok' : 'warning',\n summary: `${usable ? 'runtime authentication is available' : 'runtime authentication needs attention'}${accountNote}`,\n };\n } catch (error) {\n return { id: 'auth', status: 'error', summary: `authentication status unavailable: ${String(error)}` };\n }\n },\n};\n\nexport default authDoctorCheck;\n","// apps/cli/src/doctor/index.ts — AREA barrel: runs every `DOCTOR_CHECK_IDS` entry (contract/doctor.ts) through\n// `doctor/checks/<id>/index.ts` and assembles a `DoctorReport`. Wave-0 stub: filled by `U4.05`, which owns\n// `apps/cli/src/doctor/**` (this file included); only `checks/auth/**` is carved out to `U5.05`.\nimport { execFile } from 'node:child_process';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\nimport { sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { verifyProjectionAgainstEvents } from '@cohorte/core';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport { probeSandbox } from '@cohorte/security/exec';\nimport { type CliContext, DOCTOR_CHECK_IDS, type DoctorCheck, type DoctorCheckResult } from '../contract/index.ts';\nimport authDoctorCheck from './checks/auth/index.ts';\n\nconst exec = promisify(execFile);\nconst result = (id: string, summary: string, status: DoctorCheckResult['status'] = 'ok'): DoctorCheckResult => ({\n id,\n summary,\n status,\n});\n\nfunction versionAtLeast(value: string, required: [number, number]): boolean {\n const [major = 0, minor = 0] = value.split('.').map((part) => Number.parseInt(part, 10));\n return major > required[0] || (major === required[0] && minor >= required[1]);\n}\n\nexport async function runDoctor(\n ctx: CliContext,\n options: { readonly verifyState?: boolean } = {},\n): Promise<readonly DoctorCheckResult[]> {\n const checks: DoctorCheck[] = [\n {\n id: 'node-version',\n description: 'Node',\n run: async () =>\n versionAtLeast(process.versions.node, [24, 16])\n ? result('node-version', `Node ${process.versions.node}`)\n : result('node-version', `Node ${process.versions.node} is below 24.16`, 'error'),\n },\n {\n id: 'git',\n description: 'Git',\n run: async () => {\n try {\n const { stdout } = await exec('git', ['--version']);\n const version = stdout.match(/(\\d+\\.\\d+(?:\\.\\d+)?)/)?.[1] ?? '0.0.0';\n return versionAtLeast(version, [2, 38])\n ? result('git', `Git ${version}`)\n : result('git', `Git ${version} is below 2.38`, 'error');\n } catch (error) {\n return result('git', `git unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'sqlite',\n description: 'SQLite',\n run: async () => {\n try {\n const store = await ctx.openStore();\n const info = await store.open();\n const migration = await store.migrate('check');\n await store.close();\n return migration.pending.length === 0\n ? result('sqlite', `${info.kind} schema ${info.schemaVersion}`)\n : result('sqlite', `${migration.pending.length} migration(s) pending`, 'warning');\n } catch (error) {\n return result('sqlite', `state store unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'search-backend',\n description: 'Search',\n run: async () => {\n try {\n const { stdout } = await exec('rg', ['--version']);\n return result('search-backend', `ripgrep ${stdout.split(/\\s+/u)[1] ?? 'available'}`);\n } catch {\n try {\n await exec('git', ['grep', '--version']);\n return result('search-backend', 'git grep fallback');\n } catch {\n return result('search-backend', 'neither rg nor git grep is available', 'error');\n }\n }\n },\n },\n {\n id: 'sandbox',\n description: 'Sandbox',\n run: async () => {\n const capabilities = await probeSandbox();\n return result(\n 'sandbox',\n `level=${capabilities.level}, backend=${capabilities.backend}, filesystem=${capabilities.filesystem}, network=${capabilities.network}`,\n capabilities.level === 'L0-process' ? 'warning' : 'ok',\n );\n },\n },\n authDoctorCheck,\n {\n id: 'install',\n description: 'Install',\n run: async () => {\n try {\n const verified = await ctx.assets.verify();\n return verified.ok\n ? result('install', `${ctx.install.installDir()} (assets verified)`)\n : result('install', `asset verification failed: ${verified.error.message}`, 'error');\n } catch (error) {\n return result('install', `asset verification unavailable: ${String(error)}`, 'warning');\n }\n },\n },\n {\n id: 'config',\n description: 'Config',\n run: async () => {\n try {\n const home = ctx.env.HOME ?? ctx.cwd;\n const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n const loaded = await loadConfig({ cwd: ctx.cwd, home });\n const resolved = await resolveConfig(loaded, {\n trustStore,\n projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n });\n return resolved.status === 'resolved'\n ? result('config', `project configuration resolved at ${loaded.projectRoot}`)\n : result('config', `project policy requires trust: ${resolved.loosenedKeys.join(', ')}`, 'warning');\n } catch (error) {\n return result('config', `configuration unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'worktree-root',\n description: 'Worktree',\n run: async () =>\n typeof process.getuid === 'function' && process.getuid() === 0\n ? result('worktree-root', 'refusing to operate as uid 0', 'error')\n : result('worktree-root', ctx.cwd),\n },\n ];\n if (options.verifyState) {\n checks.push({\n id: 'verify-state',\n description: 'State verification',\n run: async () => {\n const store = await ctx.openStore();\n try {\n const runs = await store.listRuns({ limit: 100_000, offset: 0 });\n for (const run of runs) {\n const chain = await store.verifyChain(run.runId);\n if (!chain.ok) return result('verify-state', `run ${run.runId}: event chain is broken`, 'error');\n try {\n await verifyProjectionAgainstEvents(store, run);\n } catch (error) {\n return result('verify-state', `run ${run.runId}: projection mismatch (${String(error)})`, 'error');\n }\n }\n return result('verify-state', `verified ${runs.length} run(s)`);\n } finally {\n await store.close();\n }\n },\n });\n }\n const byId = new Map(checks.map((check) => [check.id, check]));\n return Promise.all(\n DOCTOR_CHECK_IDS.map(async (id) => byId.get(id)?.run(ctx) ?? result(id, 'check unavailable', 'skipped')),\n );\n}\n","// apps/cli/src/commands/doctor/index.ts — DESIGN §9 verb `doctor` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/doctor/**`.\nimport { probeSandbox } from '@cohorte/security/exec';\nimport type { CommandModule } from '../../contract/index.ts';\nimport { runDoctor } from '../../doctor/index.ts';\n\nconst doctor: CommandModule = {\n verb: 'doctor',\n async run(ctx, args) {\n const checks = await runDoctor(ctx, { verifyState: args.positionals.includes('--verify-state') });\n if (args.json) {\n let sandbox: unknown = {};\n let runtimeCapabilities: unknown = {};\n try {\n sandbox = await probeSandbox();\n } catch {\n // The corresponding check already reports the diagnostic; keep JSON stable.\n }\n try {\n runtimeCapabilities = ctx.runtime.capabilities?.() ?? { provider: ctx.runtime.resolve().id };\n } catch {\n // A provider may be unavailable while the rest of doctor remains useful.\n }\n ctx.stdio.stdout.write(\n `${JSON.stringify({ documentVersion: 1, cohorteVersion: '3.0.0', generatedAt: ctx.clock.now(), ok: checks.every((check) => check.status === 'ok' || check.status === 'skipped'), checks, sandbox, runtimeCapabilities })}\\n`,\n );\n } else\n for (const check of checks) ctx.stdio.stdout.write(`${check.status.padEnd(7)} ${check.id}: ${check.summary}\\n`);\n return checks.some((check) => check.status === 'error') ? 1 : 0;\n },\n};\n\nexport default doctor;\n"],"mappings":";;;;;;;;;;;;AAuBA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AC7BA,MAAM,kBAA+B;CACnC,IAAI;CACJ,aAAa;CACb,MAAM,IAAI,KAAK;EACb,IAAI;GACF,MAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC;GAC1D,MAAM,SAAS,SAAS,OAAO,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,mBAAmB;GAC3G,MAAM,cAAc,SAAS,MAAM,WAAW,OAAO,iBAAiB,KAAA,CAAS,IAC3E,yCACA;GACJ,OAAO;IACL,IAAI;IACJ,QAAQ,SAAS,OAAO;IACxB,SAAS,GAAG,SAAS,wCAAwC,2CAA2C;GAC1G;EACF,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAQ,QAAQ;IAAS,SAAS,sCAAsC,OAAO,KAAK;GAAI;EACvG;CACF;AACF;;;ACTA,MAAM,OAAO,UAAU,QAAQ;AAC/B,MAAM,UAAU,IAAY,SAAiB,SAAsC,UAA6B;CAC9G;CACA;CACA;AACF;AAEA,SAAS,eAAe,OAAe,UAAqC;CAC1E,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;CACvF,OAAO,QAAQ,SAAS,MAAO,UAAU,SAAS,MAAM,SAAS,SAAS;AAC5E;AAEA,eAAsB,UACpB,KACA,UAA8C,CAAC,GACR;CACvC,MAAM,SAAwB;EAC5B;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,eAAe,QAAQ,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,IAC1C,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,MAAM,IACtD,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,KAAK,kBAAkB,OAAO;EACtF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC;KAClD,MAAM,UAAU,OAAO,MAAM,sBAAsB,CAAC,GAAG,MAAM;KAC7D,OAAO,eAAe,SAAS,CAAC,GAAG,EAAE,CAAC,IAClC,OAAO,OAAO,OAAO,SAAS,IAC9B,OAAO,OAAO,OAAO,QAAQ,iBAAiB,OAAO;IAC3D,SAAS,OAAO;KACd,OAAO,OAAO,OAAO,oBAAoB,OAAO,KAAK,KAAK,OAAO;IACnE;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,QAAQ,MAAM,IAAI,UAAU;KAClC,MAAM,OAAO,MAAM,MAAM,KAAK;KAC9B,MAAM,YAAY,MAAM,MAAM,QAAQ,OAAO;KAC7C,MAAM,MAAM,MAAM;KAClB,OAAO,UAAU,QAAQ,WAAW,IAChC,OAAO,UAAU,GAAG,KAAK,KAAK,UAAU,KAAK,eAAe,IAC5D,OAAO,UAAU,GAAG,UAAU,QAAQ,OAAO,wBAAwB,SAAS;IACpF,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,4BAA4B,OAAO,KAAK,KAAK,OAAO;IAC9E;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC;KACjD,OAAO,OAAO,kBAAkB,WAAW,OAAO,MAAM,MAAM,CAAC,CAAC,MAAM,aAAa;IACrF,QAAQ;KACN,IAAI;MACF,MAAM,KAAK,OAAO,CAAC,QAAQ,WAAW,CAAC;MACvC,OAAO,OAAO,kBAAkB,mBAAmB;KACrD,QAAQ;MACN,OAAO,OAAO,kBAAkB,wCAAwC,OAAO;KACjF;IACF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,MAAM,eAAe,MAAM,aAAa;IACxC,OAAO,OACL,WACA,SAAS,aAAa,MAAM,YAAY,aAAa,QAAQ,eAAe,aAAa,WAAW,YAAY,aAAa,WAC7H,aAAa,UAAU,eAAe,YAAY,IACpD;GACF;EACF;EACA;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,WAAW,MAAM,IAAI,OAAO,OAAO;KACzC,OAAO,SAAS,KACZ,OAAO,WAAW,GAAG,IAAI,QAAQ,WAAW,EAAE,mBAAmB,IACjE,OAAO,WAAW,8BAA8B,SAAS,MAAM,WAAW,OAAO;IACvF,SAAS,OAAO;KACd,OAAO,OAAO,WAAW,mCAAmC,OAAO,KAAK,KAAK,SAAS;IACxF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;KACjC,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;KACzE,MAAM,aAAa,iBAAiB;MAAE,WAAW,KAAK,MAAM,YAAY,OAAO;MAAG;KAAK,CAAC;KACxF,MAAM,SAAS,MAAM,WAAW;MAAE,KAAK,IAAI;MAAK;KAAK,CAAC;KACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;MAC3C;MACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;KACzD,CAAC;KACD,OAAO,SAAS,WAAW,aACvB,OAAO,UAAU,qCAAqC,OAAO,aAAa,IAC1E,OAAO,UAAU,kCAAkC,SAAS,aAAa,KAAK,IAAI,KAAK,SAAS;IACtG,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,KAAK,OAAO;IAChF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,OAAO,QAAQ,WAAW,cAAc,QAAQ,OAAO,MAAM,IACzD,OAAO,iBAAiB,gCAAgC,OAAO,IAC/D,OAAO,iBAAiB,IAAI,GAAG;EACvC;CACF;CACA,IAAI,QAAQ,aACV,OAAO,KAAK;EACV,IAAI;EACJ,aAAa;EACb,KAAK,YAAY;GACf,MAAM,QAAQ,MAAM,IAAI,UAAU;GAClC,IAAI;IACF,MAAM,OAAO,MAAM,MAAM,SAAS;KAAE,OAAO;KAAS,QAAQ;IAAE,CAAC;IAC/D,KAAK,MAAM,OAAO,MAAM;KAEtB,IAAI,EAAC,MADe,MAAM,YAAY,IAAI,KAAK,EAAA,CACpC,IAAI,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,0BAA0B,OAAO;KAC/F,IAAI;MACF,MAAM,8BAA8B,OAAO,GAAG;KAChD,SAAS,OAAO;MACd,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,yBAAyB,OAAO,KAAK,EAAE,IAAI,OAAO;KACnG;IACF;IACA,OAAO,OAAO,gBAAgB,YAAY,KAAK,OAAO,QAAQ;GAChE,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;CACF,CAAC;CAEH,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;CAC7D,OAAO,QAAQ,IACb,iBAAiB,IAAI,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,KAAK,OAAO,IAAI,qBAAqB,SAAS,CAAC,CACzG;AACF;;;ACrKA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,SAAS,MAAM,UAAU,KAAK,EAAE,aAAa,KAAK,YAAY,SAAS,gBAAgB,EAAE,CAAC;EAChG,IAAI,KAAK,MAAM;GACb,IAAI,UAAmB,CAAC;GACxB,IAAI,sBAA+B,CAAC;GACpC,IAAI;IACF,UAAU,MAAM,aAAa;GAC/B,QAAQ,CAER;GACA,IAAI;IACF,sBAAsB,IAAI,QAAQ,eAAe,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG;GAC7F,QAAQ,CAER;GACA,IAAI,MAAM,OAAO,MACf,GAAG,KAAK,UAAU;IAAE,iBAAiB;IAAG,gBAAgB;IAAS,aAAa,IAAI,MAAM,IAAI;IAAG,IAAI,OAAO,OAAO,UAAU,MAAM,WAAW,QAAQ,MAAM,WAAW,SAAS;IAAG;IAAQ;IAAS;GAAoB,CAAC,EAAE,GAC3N;EACF,OACE,KAAK,MAAM,SAAS,QAAQ,IAAI,MAAM,OAAO,MAAM,GAAG,MAAM,OAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,MAAM,QAAQ,GAAG;EAChH,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,OAAO,IAAI,IAAI;CAChE;AACF"}
|
|
1
|
+
{"version":3,"file":"doctor-CginW8y8.mjs","names":[],"sources":["../../../../apps/cli/src/contract/doctor.ts","../../../../apps/cli/src/doctor/checks/auth/index.ts","../../../../apps/cli/src/doctor/index.ts","../../../../apps/cli/src/commands/doctor/index.ts"],"sourcesContent":["// apps/cli/src/contract/doctor.ts — the frozen list of doctor check modules (PLAN PC-4 \"DoctorCheck + the frozen\n// list of doctor check modules\"). `doctor/index.ts` (area barrel, U4.05) runs every id of `DOCTOR_CHECK_IDS`\n// through `doctor/checks/<id>/index.ts`; only `auth` is a Wave-0 owned stub (`apps/cli/src/doctor/checks/auth`,\n// filled by U5.05) — the rest are created, under the same shape, by U4.05.\nimport type { DOCTOR_CHECK_STATUSES } from '@cohorte/protocol';\nimport type { CliContext } from './context.ts';\n\nexport type DoctorCheckStatus = (typeof DOCTOR_CHECK_STATUSES)[number];\n\nexport interface DoctorCheckResult {\n readonly id: string;\n readonly status: DoctorCheckStatus;\n readonly summary: string;\n readonly remediation?: string;\n}\n\nexport interface DoctorCheck {\n readonly id: string;\n readonly description: string;\n run(ctx: CliContext): Promise<DoctorCheckResult>;\n}\n\n/** DESIGN §9 doctor capabilities + F-1 (ripgrep backend) + F-3 (sandbox availability) + 6.3 (protected roots). */\nexport const DOCTOR_CHECK_IDS = [\n 'node-version',\n 'git',\n 'sqlite',\n 'search-backend',\n 'sandbox',\n 'auth',\n 'install',\n 'config',\n 'worktree-root',\n] as const;\nexport type DoctorCheckId = (typeof DOCTOR_CHECK_IDS)[number];\n","// apps/cli/src/doctor/checks/auth/index.ts — the `auth` doctor check (spec 10 \"auth status\"). Wave-0 typed stub:\n// filled by `U5.05`, which owns `apps/cli/src/doctor/checks/auth/**`.\nimport type { DoctorCheck } from '../../../contract/index.ts';\n\nconst authDoctorCheck: DoctorCheck = {\n id: 'auth',\n description: \"Checks that the configured provider's authentication is usable, without reading the token.\",\n async run(ctx) {\n try {\n const statuses = await ctx.runtime.resolve().authStatus([]);\n const usable = statuses.every((status) => status.state !== 'absent' && status.state !== 'unknown-transient');\n const accountNote = statuses.some((status) => status.accountLabel === undefined)\n ? '; account: not exposed by the engine'\n : '';\n return {\n id: 'auth',\n status: usable ? 'ok' : 'warning',\n summary: `${usable ? 'runtime authentication is available' : 'runtime authentication needs attention'}${accountNote}`,\n };\n } catch (error) {\n return { id: 'auth', status: 'error', summary: `authentication status unavailable: ${String(error)}` };\n }\n },\n};\n\nexport default authDoctorCheck;\n","// apps/cli/src/doctor/index.ts — AREA barrel: runs every `DOCTOR_CHECK_IDS` entry (contract/doctor.ts) through\n// `doctor/checks/<id>/index.ts` and assembles a `DoctorReport`. Wave-0 stub: filled by `U4.05`, which owns\n// `apps/cli/src/doctor/**` (this file included); only `checks/auth/**` is carved out to `U5.05`.\nimport { execFile } from 'node:child_process';\nimport { join } from 'node:path';\nimport { promisify } from 'node:util';\nimport { sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport { verifyProjectionAgainstEvents } from '@cohorte/core';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport { probeSandbox } from '@cohorte/security/exec';\nimport { type CliContext, DOCTOR_CHECK_IDS, type DoctorCheck, type DoctorCheckResult } from '../contract/index.ts';\nimport authDoctorCheck from './checks/auth/index.ts';\n\nconst exec = promisify(execFile);\nconst result = (id: string, summary: string, status: DoctorCheckResult['status'] = 'ok'): DoctorCheckResult => ({\n id,\n summary,\n status,\n});\n\nfunction versionAtLeast(value: string, required: [number, number]): boolean {\n const [major = 0, minor = 0] = value.split('.').map((part) => Number.parseInt(part, 10));\n return major > required[0] || (major === required[0] && minor >= required[1]);\n}\n\nexport async function runDoctor(\n ctx: CliContext,\n options: { readonly verifyState?: boolean } = {},\n): Promise<readonly DoctorCheckResult[]> {\n const checks: DoctorCheck[] = [\n {\n id: 'node-version',\n description: 'Node',\n run: async () =>\n versionAtLeast(process.versions.node, [24, 16])\n ? result('node-version', `Node ${process.versions.node}`)\n : result('node-version', `Node ${process.versions.node} is below 24.16`, 'error'),\n },\n {\n id: 'git',\n description: 'Git',\n run: async () => {\n try {\n const { stdout } = await exec('git', ['--version']);\n const version = stdout.match(/(\\d+\\.\\d+(?:\\.\\d+)?)/)?.[1] ?? '0.0.0';\n return versionAtLeast(version, [2, 38])\n ? result('git', `Git ${version}`)\n : result('git', `Git ${version} is below 2.38`, 'error');\n } catch (error) {\n return result('git', `git unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'sqlite',\n description: 'SQLite',\n run: async () => {\n try {\n const store = await ctx.openStore();\n const info = await store.open();\n const migration = await store.migrate('check');\n await store.close();\n return migration.pending.length === 0\n ? result('sqlite', `${info.kind} schema ${info.schemaVersion}`)\n : result('sqlite', `${migration.pending.length} migration(s) pending`, 'warning');\n } catch (error) {\n return result('sqlite', `state store unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'search-backend',\n description: 'Search',\n run: async () => {\n try {\n const { stdout } = await exec('rg', ['--version']);\n return result('search-backend', `ripgrep ${stdout.split(/\\s+/u)[1] ?? 'available'}`);\n } catch {\n try {\n await exec('git', ['grep', '--version']);\n return result('search-backend', 'git grep fallback');\n } catch {\n return result('search-backend', 'neither rg nor git grep is available', 'error');\n }\n }\n },\n },\n {\n id: 'sandbox',\n description: 'Sandbox',\n run: async () => {\n const capabilities = await probeSandbox();\n return result(\n 'sandbox',\n `level=${capabilities.level}, backend=${capabilities.backend}, filesystem=${capabilities.filesystem}, network=${capabilities.network}`,\n capabilities.level === 'L0-process' ? 'warning' : 'ok',\n );\n },\n },\n authDoctorCheck,\n {\n id: 'install',\n description: 'Install',\n run: async () => {\n try {\n const verified = await ctx.assets.verify();\n return verified.ok\n ? result('install', `${ctx.install.installDir()} (assets verified)`)\n : result('install', `asset verification failed: ${verified.error.message}`, 'error');\n } catch (error) {\n return result('install', `asset verification unavailable: ${String(error)}`, 'warning');\n }\n },\n },\n {\n id: 'config',\n description: 'Config',\n run: async () => {\n try {\n const home = ctx.env.HOME ?? ctx.cwd;\n const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n const loaded = await loadConfig({ cwd: ctx.cwd, home });\n const resolved = await resolveConfig(loaded, {\n trustStore,\n projectKeyId: sha256Hex(loaded.projectRoot).slice(0, 24),\n });\n return resolved.status === 'resolved'\n ? result('config', `project configuration resolved at ${loaded.projectRoot}`)\n : result('config', `project policy requires trust: ${resolved.loosenedKeys.join(', ')}`, 'warning');\n } catch (error) {\n return result('config', `configuration unavailable: ${String(error)}`, 'error');\n }\n },\n },\n {\n id: 'worktree-root',\n description: 'Worktree',\n run: async () =>\n typeof process.getuid === 'function' && process.getuid() === 0\n ? result('worktree-root', 'refusing to operate as uid 0', 'error')\n : result('worktree-root', ctx.cwd),\n },\n ];\n if (options.verifyState) {\n checks.push({\n id: 'verify-state',\n description: 'State verification',\n run: async () => {\n const store = await ctx.openStore();\n try {\n const runs = await store.listRuns({ limit: 100_000, offset: 0 });\n for (const run of runs) {\n const chain = await store.verifyChain(run.runId);\n if (!chain.ok) return result('verify-state', `run ${run.runId}: event chain is broken`, 'error');\n try {\n await verifyProjectionAgainstEvents(store, run);\n } catch (error) {\n return result('verify-state', `run ${run.runId}: projection mismatch (${String(error)})`, 'error');\n }\n }\n return result('verify-state', `verified ${runs.length} run(s)`);\n } finally {\n await store.close();\n }\n },\n });\n }\n const byId = new Map(checks.map((check) => [check.id, check]));\n return Promise.all(\n DOCTOR_CHECK_IDS.map(async (id) => byId.get(id)?.run(ctx) ?? result(id, 'check unavailable', 'skipped')),\n );\n}\n","// apps/cli/src/commands/doctor/index.ts — DESIGN §9 verb `doctor` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/doctor/**`.\nimport { probeSandbox } from '@cohorte/security/exec';\nimport type { CommandModule } from '../../contract/index.ts';\nimport { runDoctor } from '../../doctor/index.ts';\n\nconst doctor: CommandModule = {\n verb: 'doctor',\n async run(ctx, args) {\n const checks = await runDoctor(ctx, { verifyState: args.positionals.includes('--verify-state') });\n if (args.json) {\n let sandbox: unknown = {};\n let runtimeCapabilities: unknown = {};\n try {\n sandbox = await probeSandbox();\n } catch {\n // The corresponding check already reports the diagnostic; keep JSON stable.\n }\n try {\n runtimeCapabilities = ctx.runtime.capabilities?.() ?? { provider: ctx.runtime.resolve().id };\n } catch {\n // A provider may be unavailable while the rest of doctor remains useful.\n }\n ctx.stdio.stdout.write(\n `${JSON.stringify({ documentVersion: 1, cohorteVersion: '3.0.0', generatedAt: ctx.clock.now(), ok: checks.every((check) => check.status === 'ok' || check.status === 'skipped'), checks, sandbox, runtimeCapabilities })}\\n`,\n );\n } else\n for (const check of checks) ctx.stdio.stdout.write(`${check.status.padEnd(7)} ${check.id}: ${check.summary}\\n`);\n return checks.some((check) => check.status === 'error') ? 1 : 0;\n },\n};\n\nexport default doctor;\n"],"mappings":";;;;;;;;;;;;AAuBA,MAAa,mBAAmB;CAC9B;CACA;CACA;CACA;CACA;CACA;CACA;CACA;CACA;AACF;;;AC7BA,MAAM,kBAA+B;CACnC,IAAI;CACJ,aAAa;CACb,MAAM,IAAI,KAAK;EACb,IAAI;GACF,MAAM,WAAW,MAAM,IAAI,QAAQ,QAAQ,CAAC,CAAC,WAAW,CAAC,CAAC;GAC1D,MAAM,SAAS,SAAS,OAAO,WAAW,OAAO,UAAU,YAAY,OAAO,UAAU,mBAAmB;GAC3G,MAAM,cAAc,SAAS,MAAM,WAAW,OAAO,iBAAiB,KAAA,CAAS,IAC3E,yCACA;GACJ,OAAO;IACL,IAAI;IACJ,QAAQ,SAAS,OAAO;IACxB,SAAS,GAAG,SAAS,wCAAwC,2CAA2C;GAC1G;EACF,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAQ,QAAQ;IAAS,SAAS,sCAAsC,OAAO,KAAK;GAAI;EACvG;CACF;AACF;;;ACTA,MAAM,OAAO,UAAU,QAAQ;AAC/B,MAAM,UAAU,IAAY,SAAiB,SAAsC,UAA6B;CAC9G;CACA;CACA;AACF;AAEA,SAAS,eAAe,OAAe,UAAqC;CAC1E,MAAM,CAAC,QAAQ,GAAG,QAAQ,KAAK,MAAM,MAAM,GAAG,CAAC,CAAC,KAAK,SAAS,OAAO,SAAS,MAAM,EAAE,CAAC;CACvF,OAAO,QAAQ,SAAS,MAAO,UAAU,SAAS,MAAM,SAAS,SAAS;AAC5E;AAEA,eAAsB,UACpB,KACA,UAA8C,CAAC,GACR;CACvC,MAAM,SAAwB;EAC5B;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,eAAe,QAAQ,SAAS,MAAM,CAAC,IAAI,EAAE,CAAC,IAC1C,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,MAAM,IACtD,OAAO,gBAAgB,QAAQ,QAAQ,SAAS,KAAK,kBAAkB,OAAO;EACtF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,OAAO,CAAC,WAAW,CAAC;KAClD,MAAM,UAAU,OAAO,MAAM,sBAAsB,CAAC,GAAG,MAAM;KAC7D,OAAO,eAAe,SAAS,CAAC,GAAG,EAAE,CAAC,IAClC,OAAO,OAAO,OAAO,SAAS,IAC9B,OAAO,OAAO,OAAO,QAAQ,iBAAiB,OAAO;IAC3D,SAAS,OAAO;KACd,OAAO,OAAO,OAAO,oBAAoB,OAAO,KAAK,KAAK,OAAO;IACnE;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,QAAQ,MAAM,IAAI,UAAU;KAClC,MAAM,OAAO,MAAM,MAAM,KAAK;KAC9B,MAAM,YAAY,MAAM,MAAM,QAAQ,OAAO;KAC7C,MAAM,MAAM,MAAM;KAClB,OAAO,UAAU,QAAQ,WAAW,IAChC,OAAO,UAAU,GAAG,KAAK,KAAK,UAAU,KAAK,eAAe,IAC5D,OAAO,UAAU,GAAG,UAAU,QAAQ,OAAO,wBAAwB,SAAS;IACpF,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,4BAA4B,OAAO,KAAK,KAAK,OAAO;IAC9E;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,EAAE,WAAW,MAAM,KAAK,MAAM,CAAC,WAAW,CAAC;KACjD,OAAO,OAAO,kBAAkB,WAAW,OAAO,MAAM,MAAM,CAAC,CAAC,MAAM,aAAa;IACrF,QAAQ;KACN,IAAI;MACF,MAAM,KAAK,OAAO,CAAC,QAAQ,WAAW,CAAC;MACvC,OAAO,OAAO,kBAAkB,mBAAmB;KACrD,QAAQ;MACN,OAAO,OAAO,kBAAkB,wCAAwC,OAAO;KACjF;IACF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,MAAM,eAAe,MAAM,aAAa;IACxC,OAAO,OACL,WACA,SAAS,aAAa,MAAM,YAAY,aAAa,QAAQ,eAAe,aAAa,WAAW,YAAY,aAAa,WAC7H,aAAa,UAAU,eAAe,YAAY,IACpD;GACF;EACF;EACA;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,WAAW,MAAM,IAAI,OAAO,OAAO;KACzC,OAAO,SAAS,KACZ,OAAO,WAAW,GAAG,IAAI,QAAQ,WAAW,EAAE,mBAAmB,IACjE,OAAO,WAAW,8BAA8B,SAAS,MAAM,WAAW,OAAO;IACvF,SAAS,OAAO;KACd,OAAO,OAAO,WAAW,mCAAmC,OAAO,KAAK,KAAK,SAAS;IACxF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YAAY;IACf,IAAI;KACF,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;KACjC,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;KACzE,MAAM,aAAa,iBAAiB;MAAE,WAAW,KAAK,MAAM,YAAY,OAAO;MAAG;KAAK,CAAC;KACxF,MAAM,SAAS,MAAM,WAAW;MAAE,KAAK,IAAI;MAAK;KAAK,CAAC;KACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;MAC3C;MACA,cAAc,UAAU,OAAO,WAAW,CAAC,CAAC,MAAM,GAAG,EAAE;KACzD,CAAC;KACD,OAAO,SAAS,WAAW,aACvB,OAAO,UAAU,qCAAqC,OAAO,aAAa,IAC1E,OAAO,UAAU,kCAAkC,SAAS,aAAa,KAAK,IAAI,KAAK,SAAS;IACtG,SAAS,OAAO;KACd,OAAO,OAAO,UAAU,8BAA8B,OAAO,KAAK,KAAK,OAAO;IAChF;GACF;EACF;EACA;GACE,IAAI;GACJ,aAAa;GACb,KAAK,YACH,OAAO,QAAQ,WAAW,cAAc,QAAQ,OAAO,MAAM,IACzD,OAAO,iBAAiB,gCAAgC,OAAO,IAC/D,OAAO,iBAAiB,IAAI,GAAG;EACvC;CACF;CACA,IAAI,QAAQ,aACV,OAAO,KAAK;EACV,IAAI;EACJ,aAAa;EACb,KAAK,YAAY;GACf,MAAM,QAAQ,MAAM,IAAI,UAAU;GAClC,IAAI;IACF,MAAM,OAAO,MAAM,MAAM,SAAS;KAAE,OAAO;KAAS,QAAQ;IAAE,CAAC;IAC/D,KAAK,MAAM,OAAO,MAAM;KAEtB,IAAI,EAAC,MADe,MAAM,YAAY,IAAI,KAAK,EAAA,CACpC,IAAI,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,0BAA0B,OAAO;KAC/F,IAAI;MACF,MAAM,8BAA8B,OAAO,GAAG;KAChD,SAAS,OAAO;MACd,OAAO,OAAO,gBAAgB,OAAO,IAAI,MAAM,yBAAyB,OAAO,KAAK,EAAE,IAAI,OAAO;KACnG;IACF;IACA,OAAO,OAAO,gBAAgB,YAAY,KAAK,OAAO,QAAQ;GAChE,UAAU;IACR,MAAM,MAAM,MAAM;GACpB;EACF;CACF,CAAC;CAEH,MAAM,OAAO,IAAI,IAAI,OAAO,KAAK,UAAU,CAAC,MAAM,IAAI,KAAK,CAAC,CAAC;CAC7D,OAAO,QAAQ,IACb,iBAAiB,IAAI,OAAO,OAAO,KAAK,IAAI,EAAE,CAAC,EAAE,IAAI,GAAG,KAAK,OAAO,IAAI,qBAAqB,SAAS,CAAC,CACzG;AACF;;;ACrKA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,MAAM,SAAS,MAAM,UAAU,KAAK,EAAE,aAAa,KAAK,YAAY,SAAS,gBAAgB,EAAE,CAAC;EAChG,IAAI,KAAK,MAAM;GACb,IAAI,UAAmB,CAAC;GACxB,IAAI,sBAA+B,CAAC;GACpC,IAAI;IACF,UAAU,MAAM,aAAa;GAC/B,QAAQ,CAER;GACA,IAAI;IACF,sBAAsB,IAAI,QAAQ,eAAe,KAAK,EAAE,UAAU,IAAI,QAAQ,QAAQ,CAAC,CAAC,GAAG;GAC7F,QAAQ,CAER;GACA,IAAI,MAAM,OAAO,MACf,GAAG,KAAK,UAAU;IAAE,iBAAiB;IAAG,gBAAgB;IAAS,aAAa,IAAI,MAAM,IAAI;IAAG,IAAI,OAAO,OAAO,UAAU,MAAM,WAAW,QAAQ,MAAM,WAAW,SAAS;IAAG;IAAQ;IAAS;GAAoB,CAAC,EAAE,GAC3N;EACF,OACE,KAAK,MAAM,SAAS,QAAQ,IAAI,MAAM,OAAO,MAAM,GAAG,MAAM,OAAO,OAAO,CAAC,EAAE,GAAG,MAAM,GAAG,IAAI,MAAM,QAAQ,GAAG;EAChH,OAAO,OAAO,MAAM,UAAU,MAAM,WAAW,OAAO,IAAI,IAAI;CAChE;AACF"}
|
|
@@ -2,8 +2,8 @@ import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
|
|
|
2
2
|
import { N as errorOf, j as CohorteError } from "./src-Cu3TxNob.mjs";
|
|
3
3
|
import { n as createKeyStore, r as createTrustStore } from "./auth-BT5oVp76.mjs";
|
|
4
4
|
import { i as resolveConfig, n as loadConfig } from "./src-DcU4IXMe.mjs";
|
|
5
|
-
import "./src-
|
|
6
|
-
import { a as buildPolicySnapshot, c as createCommandPolicy, i as createGlobMatcher, l as createProgramResolver, n as toolIntrospection, o as createPolicyEngine, r as createPathResolver, s as explainPolicy } from "./catalogue-
|
|
5
|
+
import "./src-r0ECB1UJ.mjs";
|
|
6
|
+
import { a as buildPolicySnapshot, c as createCommandPolicy, i as createGlobMatcher, l as createProgramResolver, n as toolIntrospection, o as createPolicyEngine, r as createPathResolver, s as explainPolicy } from "./catalogue-B5uFqfzJ.mjs";
|
|
7
7
|
import { join, resolve } from "node:path";
|
|
8
8
|
import { realpathSync } from "node:fs";
|
|
9
9
|
//#region src/commands/policy/index.ts
|
|
@@ -136,4 +136,4 @@ const policy = {
|
|
|
136
136
|
//#endregion
|
|
137
137
|
export { policy as default };
|
|
138
138
|
|
|
139
|
-
//# sourceMappingURL=policy-
|
|
139
|
+
//# sourceMappingURL=policy-Clypo20s.mjs.map
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"policy-
|
|
1
|
+
{"version":3,"file":"policy-Clypo20s.mjs","names":[],"sources":["../../../../apps/cli/src/commands/policy/index.ts"],"sourcesContent":["// apps/cli/src/commands/policy/index.ts — DESIGN §9 verb `policy` (PLAN §3 rule 3 \"later units fill\n// stub files that lie inside their owned paths; they never edit ... the registry\"). Wave-0 stub: exits with the\n// documented not-available error (spec 24 `configuration/phase-not-available`); filled by the Wave-4/5\n// unit that owns `apps/cli/src/commands/policy/**`.\nimport { realpathSync } from 'node:fs';\nimport { join, resolve } from 'node:path';\nimport { CohorteError, canonicalJson, errorOf, sha256Hex } from '@cohorte/base';\nimport { loadConfig, resolveConfig } from '@cohorte/config';\nimport {\n buildPolicySnapshot,\n createCommandPolicy,\n createGlobMatcher,\n createPathResolver,\n createPolicyEngine,\n createProgramResolver,\n explainPolicy,\n} from '@cohorte/security';\nimport { createKeyStore, createTrustStore } from '@cohorte/security/auth';\nimport type { AgentGrant, GateCall, PolicyPorts } from '@cohorte/security/contract';\nimport { toolIntrospection } from '@cohorte/tools/catalogue';\nimport type { CommandModule } from '../../contract/index.ts';\n\nfunction canonical(path: string): string {\n const absolute = resolve(path);\n try {\n return realpathSync.native(absolute);\n } catch {\n return absolute;\n }\n}\n\nfunction grantFor(root: string, argv: readonly string[]): AgentGrant {\n const tools = ['run_command'];\n const digest = sha256Hex(canonicalJson({ root, argv: [...argv] }));\n return {\n agentId: 'agt_policy_explain' as AgentGrant['agentId'],\n role: 'policy-explain',\n digest,\n tools,\n roots: { workspace: root as AgentGrant['roots']['workspace'], readOnly: [] },\n read: { include: ['**'], exclude: [] },\n write: { include: ['**'], exclude: [] },\n denyRead: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n denyWrite: { include: ['**/.cohorte/**', '**/.git/**'], exclude: [] },\n commands: { default: 'deny', rules: [] },\n secrets: [],\n temporary: [],\n limits: {\n maxToolCalls: 1,\n maxCallsPerMinute: 1,\n perTool: { run_command: { timeoutMs: 120_000, maxOutputBytes: 1024 * 1024 } },\n },\n };\n}\n\nconst policy: CommandModule = {\n verb: 'policy',\n async run(ctx, args) {\n if (args.subVerb !== 'explain') return 2;\n const argv = args.positionals.filter((value) => value !== '--');\n if (argv.length === 0) return 2;\n\n const home = ctx.env.HOME ?? ctx.cwd;\n const projectKeyId = sha256Hex(ctx.cwd).slice(0, 24);\n const keys = createKeyStore({ directory: join(home, '.cohorte', 'keys') });\n const trustStore = createTrustStore({ directory: join(home, '.cohorte', 'trust'), keys });\n const loaded = await loadConfig({ cwd: ctx.cwd, home });\n const resolved = await resolveConfig(loaded, { trustStore, projectKeyId });\n if (resolved.status === 'untrusted') {\n throw new CohorteError(\n errorOf(\n 'security/project-policy-untrusted',\n `project policy is untrusted (${resolved.loosenedKeys.join(', ') || 'unknown key'})`,\n ),\n );\n }\n\n const root = canonical(loaded.projectRoot);\n const pathResolver = createPathResolver({\n roots: [root as never],\n protectedRoots: [canonical(join(root, '.cohorte')) as never],\n symlinks: resolved.config.policy.symlinks,\n });\n const pathDirs = (ctx.env.PATH ?? '').split(':').filter(Boolean).map(canonical);\n const programs = createProgramResolver({ pathDirs });\n const branches: PolicyPorts['branches'] = {\n branchOf: () => ({ kind: 'detached-or-unknown', protected: true }),\n };\n const commands = createCommandPolicy({ programs, branches });\n const engine = createPolicyEngine({ tools: toolIntrospection, globs: createGlobMatcher(), commands });\n const policySnapshot = buildPolicySnapshot(resolved.config, loaded.ownership, { sandboxLevel: 'L0-process' });\n const ports: PolicyPorts = {\n paths: pathResolver,\n branches,\n budgets: { remaining: () => ({}), callsInLastMinute: () => 0 },\n programs,\n clock: ctx.clock,\n };\n const call: GateCall = {\n runId: 'run_policy_explain' as GateCall['runId'],\n agentId: 'agt_policy_explain' as GateCall['agentId'],\n incarnation: 1,\n toolCallId: 'tool_policy_explain' as GateCall['toolCallId'],\n tool: 'run_command',\n input: { argv, cwd: root, timeoutMs: 120_000 },\n phase: 'PREFLIGHT',\n role: 'policy-explain',\n };\n const verdict = explainPolicy(engine, call, grantFor(root, argv), policySnapshot, ports);\n ctx.stdio.stdout.write(`${JSON.stringify(verdict)}\\n`);\n return 0;\n },\n};\n\nexport default policy;\n"],"mappings":";;;;;;;;;AAsBA,SAAS,UAAU,MAAsB;CACvC,MAAM,WAAW,QAAQ,IAAI;CAC7B,IAAI;EACF,OAAO,aAAa,OAAO,QAAQ;CACrC,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,SAAS,MAAc,MAAqC;CACnE,MAAM,QAAQ,CAAC,aAAa;CAE5B,OAAO;EACL,SAAS;EACT,MAAM;EACN,QAJa,UAAU,cAAc;GAAE;GAAM,MAAM,CAAC,GAAG,IAAI;EAAE,CAAC,CAIzD;EACL;EACA,OAAO;GAAE,WAAW;GAA0C,UAAU,CAAC;EAAE;EAC3E,MAAM;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACrC,OAAO;GAAE,SAAS,CAAC,IAAI;GAAG,SAAS,CAAC;EAAE;EACtC,UAAU;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACnE,WAAW;GAAE,SAAS,CAAC,kBAAkB,YAAY;GAAG,SAAS,CAAC;EAAE;EACpE,UAAU;GAAE,SAAS;GAAQ,OAAO,CAAC;EAAE;EACvC,SAAS,CAAC;EACV,WAAW,CAAC;EACZ,QAAQ;GACN,cAAc;GACd,mBAAmB;GACnB,SAAS,EAAE,aAAa;IAAE,WAAW;IAAS,gBAAgB;GAAY,EAAE;EAC9E;CACF;AACF;AAEA,MAAM,SAAwB;CAC5B,MAAM;CACN,MAAM,IAAI,KAAK,MAAM;EACnB,IAAI,KAAK,YAAY,WAAW,OAAO;EACvC,MAAM,OAAO,KAAK,YAAY,QAAQ,UAAU,UAAU,IAAI;EAC9D,IAAI,KAAK,WAAW,GAAG,OAAO;EAE9B,MAAM,OAAO,IAAI,IAAI,QAAQ,IAAI;EACjC,MAAM,eAAe,UAAU,IAAI,GAAG,CAAC,CAAC,MAAM,GAAG,EAAE;EACnD,MAAM,OAAO,eAAe,EAAE,WAAW,KAAK,MAAM,YAAY,MAAM,EAAE,CAAC;EACzE,MAAM,aAAa,iBAAiB;GAAE,WAAW,KAAK,MAAM,YAAY,OAAO;GAAG;EAAK,CAAC;EACxF,MAAM,SAAS,MAAM,WAAW;GAAE,KAAK,IAAI;GAAK;EAAK,CAAC;EACtD,MAAM,WAAW,MAAM,cAAc,QAAQ;GAAE;GAAY;EAAa,CAAC;EACzE,IAAI,SAAS,WAAW,aACtB,MAAM,IAAI,aACR,QACE,qCACA,gCAAgC,SAAS,aAAa,KAAK,IAAI,KAAK,cAAc,EACpF,CACF;EAGF,MAAM,OAAO,UAAU,OAAO,WAAW;EACzC,MAAM,eAAe,mBAAmB;GACtC,OAAO,CAAC,IAAa;GACrB,gBAAgB,CAAC,UAAU,KAAK,MAAM,UAAU,CAAC,CAAU;GAC3D,UAAU,SAAS,OAAO,OAAO;EACnC,CAAC;EACD,MAAM,YAAY,IAAI,IAAI,QAAQ,GAAA,CAAI,MAAM,GAAG,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,IAAI,SAAS;EAC9E,MAAM,WAAW,sBAAsB,EAAE,SAAS,CAAC;EACnD,MAAM,WAAoC,EACxC,iBAAiB;GAAE,MAAM;GAAuB,WAAW;EAAK,GAClE;EACA,MAAM,WAAW,oBAAoB;GAAE;GAAU;EAAS,CAAC;EAC3D,MAAM,SAAS,mBAAmB;GAAE,OAAO;GAAmB,OAAO,kBAAkB;GAAG;EAAS,CAAC;EACpG,MAAM,iBAAiB,oBAAoB,SAAS,QAAQ,OAAO,WAAW,EAAE,cAAc,aAAa,CAAC;EAC5G,MAAM,QAAqB;GACzB,OAAO;GACP;GACA,SAAS;IAAE,kBAAkB,CAAC;IAAI,yBAAyB;GAAE;GAC7D;GACA,OAAO,IAAI;EACb;EAWA,MAAM,UAAU,cAAc,QAAQ;GATpC,OAAO;GACP,SAAS;GACT,aAAa;GACb,YAAY;GACZ,MAAM;GACN,OAAO;IAAE;IAAM,KAAK;IAAM,WAAW;GAAQ;GAC7C,OAAO;GACP,MAAM;EAEiC,GAAG,SAAS,MAAM,IAAI,GAAG,gBAAgB,KAAK;EACvF,IAAI,MAAM,OAAO,MAAM,GAAG,KAAK,UAAU,OAAO,EAAE,GAAG;EACrD,OAAO;CACT;AACF"}
|
|
@@ -1,7 +1,7 @@
|
|
|
1
1
|
import { n as sha256Hex, t as canonicalJson } from "./canonical-C8UxeEmB.mjs";
|
|
2
2
|
import { E as SpecId, I as isErrorCode, M as NotImplemented, N as errorOf, P as toErrorInfo, S as IsoInstant, T as Sha256, j as CohorteError, k as isSafeId, o as err, s as ok } from "./src-Cu3TxNob.mjs";
|
|
3
3
|
import { f as HALTED_STATES, h as TERMINAL_STATES, i as canonicalCommandBody, l as ACTIVE_PIPELINE_STATES, m as SUSPENDED_STATES, n as isDurableEventType, p as PipelineProfile, t as catalogue } from "./src-s7YRvk0t.mjs";
|
|
4
|
-
import { d as SandboxCapabilities, g as createRedactor, p as DEFAULT_DENY_GLOBS, r as RuntimePin, u as RuntimeCapabilities } from "./src-
|
|
4
|
+
import { d as SandboxCapabilities, g as createRedactor, p as DEFAULT_DENY_GLOBS, r as RuntimePin, u as RuntimeCapabilities } from "./src-r0ECB1UJ.mjs";
|
|
5
5
|
import { Type } from "typebox";
|
|
6
6
|
import { Compile } from "typebox/compile";
|
|
7
7
|
//#region ../../packages/core/src/agents/lifecycle.ts
|
|
@@ -5400,4 +5400,4 @@ function createPhaseExecutor(deps) {
|
|
|
5400
5400
|
//#endregion
|
|
5401
5401
|
export { resolveTable as _, createToolHost as a, createApprovalService as b, createResumer as c, createPipelineGuards as d, createFactCollector as f, createEngine as g, createEventWriter as h, createRunSnapshotter as i, verifyProjectionAgainstEvents as l, createGrantComputer as m, createAgentSupervisor as n, createTransitionEffectRunner as o, createPhaseContracts as p, createProvisioner as r, createWorktreeService as s, createPhaseExecutor as t, initialRunState as u, createLeaseManager as v, createToolHostReplay as x, createEffectJournal as y };
|
|
5402
5402
|
|
|
5403
|
-
//# sourceMappingURL=src-
|
|
5403
|
+
//# sourceMappingURL=src-DZazJCp1.mjs.map
|