decision-guardian 1.1.0

package/dist/core/rule-evaluator.js

@@ -0,0 +1,186 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuleEvaluator = void 0;
+/**
+ * Rule Evaluator - Evaluates decision rules against file diffs
+ */
+const minimatch_1 = require("minimatch");
+const rule_types_1 = require("./rule-types");
+const content_matchers_1 = require("./content-matchers");
+class RuleEvaluator {
+    contentMatchers;
+    logger;
+    constructor(logger) {
+        this.logger = logger;
+        this.contentMatchers = new content_matchers_1.ContentMatchers(logger);
+    }
+    /**
+     * Evaluate if a changeset matches the decision rules
+     */
+    async evaluate(rules, fileDiffs, depth = 0) {
+        // Depth safety check
+        if (depth > rule_types_1.MAX_RULE_DEPTH) {
+            return {
+                matched: false,
+                matchedPatterns: [],
+                matchedFiles: [],
+                ruleDepth: depth,
+                error: `Rule nesting exceeds max depth of ${rule_types_1.MAX_RULE_DEPTH}`,
+            };
+        }
+        const matchMode = rules.match_mode || 'any';
+        // Check if this is a single-rule case
+        if (rules.pattern && !rules.conditions) {
+            return this.evaluateSingleRule(rules, fileDiffs, depth);
+        }
+        if (!rules.conditions || rules.conditions.length === 0) {
+            return {
+                matched: false,
+                matchedPatterns: [],
+                matchedFiles: [],
+                ruleDepth: depth,
+            };
+        }
+        const settlement = await Promise.allSettled(rules.conditions.map((condition) => {
+            if ((0, rule_types_1.isFileRule)(condition)) {
+                return this.evaluateSingleRule(condition, fileDiffs, depth + 1);
+            }
+            else {
+                return this.evaluate(condition, fileDiffs, depth + 1);
+            }
+        }));
+        const results = settlement.map((r) => r.status === 'fulfilled'
+            ? r.value
+            : {
+                matched: false,
+                matchedPatterns: [],
+                matchedFiles: [],
+                ruleDepth: depth + 1,
+                error: `Condition evaluation failed: ${r.reason}`,
+            });
+        const matched = matchMode === 'all'
+            ? results.every((r) => r.matched) // AND
+            : results.some((r) => r.matched); // OR
+        const matchedPatterns = results.flatMap((r) => r.matchedPatterns).sort();
+        const matchedFiles = [...new Set(results.flatMap((r) => r.matchedFiles))].sort();
+        const errors = results
+            .map((r) => r.error)
+            .filter(Boolean)
+            .join('; ');
+        return {
+            matched,
+            matchedPatterns,
+            matchedFiles,
+            ruleDepth: depth,
+            error: errors || undefined,
+        };
+    }
+    /**
+     * Evaluate a single file rule with error boundary
+     */
+    async evaluateSingleRule(rule, fileDiffs, depth) {
+        try {
+            const matchingFiles = fileDiffs.filter((file) => {
+                const matches = (0, minimatch_1.minimatch)(file.filename, rule.pattern, {
+                    dot: true,
+                    matchBase: false,
+                    nocase: false,
+                });
+                if (matches && rule.exclude) {
+                    // Handle both string and string[] exclude patterns
+                    const excludePatterns = Array.isArray(rule.exclude) ? rule.exclude : [rule.exclude];
+                    const isExcluded = excludePatterns.some((pattern) => (0, minimatch_1.minimatch)(file.filename, pattern, {
+                        dot: true,
+                        matchBase: false,
+                        nocase: false,
+                    }));
+                    return !isExcluded;
+                }
+                return matches;
+            });
+            if (matchingFiles.length === 0) {
+                this.logger.debug(`RuleEvaluator: No files matched pattern '${rule.pattern}'`);
+                return {
+                    matched: false,
+                    matchedPatterns: [],
+                    matchedFiles: [],
+                    ruleDepth: depth,
+                };
+            }
+            if (!rule.content_rules || rule.content_rules.length === 0) {
+                this.logger.debug(`RuleEvaluator: File '${rule.pattern}' matched ${matchingFiles.length} files: ${matchingFiles.map((f) => f.filename).join(', ')}`);
+                return {
+                    matched: true,
+                    matchedPatterns: [rule.pattern],
+                    matchedFiles: matchingFiles.map((f) => f.filename),
+                    ruleDepth: depth,
+                };
+            }
+            this.logger.debug(`RuleEvaluator: File '${rule.pattern}' matched ${matchingFiles.length} files, checking content rules...`);
+            const allMatchedPatterns = [];
+            const allMatchedFiles = [];
+            for (const file of matchingFiles) {
+                const contentResult = await this.evaluateContentRules(rule.content_rules, file);
+                if (contentResult.matched) {
+                    allMatchedPatterns.push(...contentResult.matchedPatterns);
+                    allMatchedFiles.push(file.filename);
+                }
+            }
+            return {
+                matched: allMatchedFiles.length > 0,
+                matchedPatterns: [...new Set(allMatchedPatterns)].sort(),
+                matchedFiles: allMatchedFiles.sort(),
+                ruleDepth: depth,
+            };
+        }
+        catch (error) {
+            const message = error instanceof Error ? error.message : String(error);
+            this.logger.warning(`Rule evaluation failed for pattern "${rule.pattern}": ${message}`);
+            return {
+                matched: false,
+                matchedPatterns: [],
+                matchedFiles: [],
+                ruleDepth: depth,
+                error: message,
+            };
+        }
+    }
+    /**
+     * Evaluate content rules against a file diff
+     */
+    async evaluateContentRules(rules, file) {
+        const allMatchedPatterns = [];
+        for (const rule of rules) {
+            let result;
+            switch (rule.mode) {
+                case 'string':
+                    result = this.contentMatchers.matchString(rule, file);
+                    break;
+                case 'regex':
+                    result = await this.contentMatchers.matchRegex(rule, file);
+                    break;
+                case 'line_range':
+                    result = this.contentMatchers.matchLineRange(rule, file);
+                    break;
+                case 'full_file':
+                    result = this.contentMatchers.matchFullFile(file);
+                    break;
+                case 'json_path':
+                    result = this.contentMatchers.matchJsonPath(rule, file);
+                    break;
+                default: {
+                    const _exhaustiveCheck = rule.mode;
+                    throw new Error(`Unhandled content match mode: ${_exhaustiveCheck}`);
+                }
+            }
+            if (result.matched) {
+                allMatchedPatterns.push(...result.matchedPatterns);
+            }
+        }
+        return {
+            matched: allMatchedPatterns.length > 0,
+            matchedPatterns: allMatchedPatterns.sort(),
+        };
+    }
+}
+exports.RuleEvaluator = RuleEvaluator;

package/dist/core/rule-parser.js

@@ -0,0 +1,211 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.RuleParser = void 0;
+/**
+ * Rule Parser - Extracts JSON rules from markdown decision blocks
+ */
+const fs = __importStar(require("fs/promises"));
+const safe_regex_1 = __importDefault(require("safe-regex"));
+const path = __importStar(require("path"));
+const rule_types_1 = require("./rule-types");
+class RuleParser {
+    /**
+     * Extract JSON rules from markdown content
+     * Supports:
+     * 1. Inline JSON: **Rules**: followed by ```json ... ```
+     * 2. External File: **Rules**: [Link](./path) or just path
+     */
+    async extractRules(content, sourceFilePath) {
+        // 1. Try inline JSON first
+        const rulesMatch = content.match(/\*\*Rules\*\*:\s*```json\s+([\s\S]+?)\s+```/i);
+        if (rulesMatch) {
+            try {
+                const parsed = JSON.parse(rulesMatch[1]);
+                const validated = this.validate(parsed, 0);
+                return { rules: validated };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    rules: null,
+                    error: `Failed to parse inline JSON rules: ${message}`,
+                };
+            }
+        }
+        // 2. Try external file reference
+        // Matches: **Rules**: [Label](path) or **Rules**: path/to/file.json
+        const linkMatch = content.match(/\*\*Rules\*\*:\s*(?:\[.*?\]\((.*?)\)|(\S+\.json))/i);
+        if (linkMatch) {
+            const relPath = linkMatch[1] || linkMatch[2];
+            try {
+                const workspaceRoot = process.env.GITHUB_WORKSPACE || process.cwd();
+                const sourceDir = path.dirname(sourceFilePath);
+                // Resolve path relative to the decision file
+                const resolvedPath = path.resolve(sourceDir, relPath);
+                const normalizedWorkspace = path.normalize(workspaceRoot);
+                const normalizedPath = path.normalize(resolvedPath);
+                // Security check: Reject paths outside workspace (Path Traversal protection)
+                // We also strictly reject Windows-specific absolute paths (like C:\...) on non-Windows platforms
+                // to prevent them from being interpreted as relative filenames
+                const isWindowsSpecificAbsolute = path.win32.isAbsolute(relPath) && !path.posix.isAbsolute(relPath);
+                const isCrossPlatformAbsolute = process.platform !== 'win32' && isWindowsSpecificAbsolute;
+                if ((!resolvedPath.startsWith(normalizedWorkspace + path.sep) &&
+                    resolvedPath !== normalizedWorkspace) ||
+                    isCrossPlatformAbsolute) {
+                    return {
+                        rules: null,
+                        error: `Security Error: External rule file '${relPath}' resolves to a path outside the workspace. ` +
+                            `Only files within the workspace are allowed. ` +
+                            `Resolved: ${normalizedPath}, Workspace: ${normalizedWorkspace}`,
+                    };
+                }
+                const fileContent = await fs.readFile(resolvedPath, 'utf-8');
+                const parsed = JSON.parse(fileContent);
+                const validated = this.validate(parsed, 0);
+                return { rules: validated };
+            }
+            catch (error) {
+                const message = error instanceof Error ? error.message : String(error);
+                return {
+                    rules: null,
+                    error: `Failed to load external rules from ${relPath}: ${message}`,
+                };
+            }
+        }
+        return { rules: null };
+    }
+    /**
+     * Validate rule structure with depth tracking
+     */
+    validate(rules, depth) {
+        if (depth > rule_types_1.MAX_RULE_DEPTH) {
+            throw new Error(`Rule nesting exceeds max depth of ${rule_types_1.MAX_RULE_DEPTH}`);
+        }
+        if (!rules.match_mode) {
+            rules.match_mode = 'any';
+        }
+        if (rules.pattern && !rules.conditions) {
+            this.validateFileRule(rules);
+            return rules;
+        }
+        if (rules.conditions && Array.isArray(rules.conditions)) {
+            for (const condition of rules.conditions) {
+                if ((0, rule_types_1.isFileRule)(condition)) {
+                    this.validateFileRule(condition);
+                }
+                else {
+                    this.validate(condition, depth + 1);
+                }
+            }
+        }
+        return rules;
+    }
+    /**
+     * Validate a file rule
+     */
+    validateFileRule(rule) {
+        if (!rule.pattern) {
+            throw new Error('FileRule must have a pattern');
+        }
+        if (rule.content_rules && Array.isArray(rule.content_rules)) {
+            for (const contentRule of rule.content_rules) {
+                this.validateContentRule(contentRule);
+            }
+        }
+    }
+    /**
+     * Validate a content rule
+     */
+    validateContentRule(rule) {
+        const validModes = ['string', 'regex', 'line_range', 'full_file', 'json_path'];
+        if (!validModes.includes(rule.mode)) {
+            throw new Error(`Invalid content rule mode: ${rule.mode}`);
+        }
+        switch (rule.mode) {
+            case 'string': {
+                if (!rule.patterns || !Array.isArray(rule.patterns)) {
+                    throw new Error('String mode requires patterns array');
+                }
+                break;
+            }
+            case 'regex': {
+                if (!rule.pattern) {
+                    throw new Error('Regex mode requires pattern');
+                }
+                let isSafe;
+                try {
+                    isSafe = (0, safe_regex_1.default)(rule.pattern);
+                }
+                catch (e) {
+                    throw new Error(`Invalid regex pattern (safe-check failed): ${rule.pattern}`);
+                }
+                if (!isSafe) {
+                    throw new Error(`Unsafe regex pattern: ${rule.pattern}`);
+                }
+                const ALLOWED_FLAGS = /^[gimsuy]*$/;
+                if (rule.flags && !ALLOWED_FLAGS.test(rule.flags)) {
+                    throw new Error(`Invalid regex flags: ${rule.flags}`);
+                }
+                try {
+                    new RegExp(rule.pattern, rule.flags || '');
+                }
+                catch (e) {
+                    throw new Error(`Invalid regex pattern syntax: ${rule.pattern}`);
+                }
+                break;
+            }
+            case 'line_range':
+                if (typeof rule.start !== 'number' || typeof rule.end !== 'number') {
+                    throw new Error('Line range mode requires start and end numbers');
+                }
+                if (rule.start > rule.end) {
+                    throw new Error('Line range start must be <= end');
+                }
+                break;
+            case 'json_path':
+                if (!rule.paths || !Array.isArray(rule.paths)) {
+                    throw new Error('JSON path mode requires paths array');
+                }
+                break;
+            case 'full_file':
+                break;
+        }
+    }
+}
+exports.RuleParser = RuleParser;

package/dist/core/rule-types.js

@@ -0,0 +1,22 @@
+"use strict";
+/**
+ * Rule Types for Advanced Decision Rules System
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.MAX_RULE_DEPTH = void 0;
+exports.isFileRule = isFileRule;
+exports.isRuleCondition = isRuleCondition;
+/** Safety limit for nested rules to prevent stack overflow */
+exports.MAX_RULE_DEPTH = 10;
+/**
+ * Type guard to check if a condition is a FileRule
+ */
+function isFileRule(condition) {
+    return (condition.type === 'file' && typeof condition.pattern === 'string');
+}
+/**
+ * Type guard to check if a condition is a nested RuleCondition
+ */
+function isRuleCondition(condition) {
+    return Array.isArray(condition.conditions);
+}

package/dist/core/trie.js

@@ -0,0 +1,83 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PatternTrie = void 0;
+class PatternTrie {
+    root;
+    constructor(decisions) {
+        this.root = this.createNode();
+        for (const decision of decisions) {
+            for (const pattern of decision.files) {
+                if (!pattern.startsWith('!')) {
+                    this.insert(pattern, decision);
+                }
+            }
+        }
+    }
+    createNode() {
+        return {
+            children: new Map(),
+            decisions: [],
+            wildcardDecisions: [],
+        };
+    }
+    insert(pattern, decision) {
+        const parts = pattern.split('/');
+        this.insertRecursive(this.root, parts, decision);
+    }
+    insertRecursive(node, parts, decision) {
+        if (parts.length === 0) {
+            node.decisions.push(decision);
+            return;
+        }
+        const part = parts[0];
+        const remaining = parts.slice(1);
+        if (part === '**') {
+            node.wildcardDecisions.push(decision);
+            if (remaining.length > 0) {
+                this.insertRecursive(node, remaining, decision);
+            }
+            return;
+        }
+        if (part.includes('*') ||
+            part.includes('?') ||
+            part.includes('{') ||
+            part.includes('}') ||
+            part.includes('[') ||
+            part.includes(']')) {
+            node.wildcardDecisions.push(decision);
+            return;
+        }
+        let child = node.children.get(part);
+        if (!child) {
+            child = this.createNode();
+            node.children.set(part, child);
+        }
+        this.insertRecursive(child, remaining, decision);
+    }
+    /**
+     * Returns a set of unique decisions that *might* match the given file path.
+     */
+    findCandidates(file) {
+        const parts = file.split('/');
+        const candidates = new Set();
+        this.collectCandidates(this.root, parts, candidates);
+        return candidates;
+    }
+    collectCandidates(node, parts, candidates) {
+        for (const decision of node.wildcardDecisions) {
+            candidates.add(decision);
+        }
+        if (parts.length === 0) {
+            for (const decision of node.decisions) {
+                candidates.add(decision);
+            }
+            return;
+        }
+        const part = parts[0];
+        const child = node.children.get(part);
+        if (child) {
+            this.collectCandidates(child, parts.slice(1), candidates);
+        }
+    }
+}
+exports.PatternTrie = PatternTrie;

package/dist/core/types.js

@@ -0,0 +1,2 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });