deepdebug-local-agent 1.0.21 → 1.0.23

package/scripts/sync-fixtures.mjs

@@ -0,0 +1,246 @@
+#!/usr/bin/env node
+// scripts/sync-fixtures.mjs — Phase 2 fixture sync (Plan 02-12 full implementation).
+//
+// For each requested stack, clones williambella/visionhammer-example-<stack>
+// shallow (--depth 1, --branch main) into /tmp/sync-<stack>, copies samples/
+// log files into test/fixtures/<adapter-dir>/ (with IBM MQ filename mapping),
+// then deletes the temp clone. Idempotent: re-runs cleanly overwrite prior
+// fixtures and rewipe /tmp scratch dirs.
+//
+// SECURITY (T-2-04 — PAT discipline):
+//   - PAT read ONCE from ~/.config/visionhammer/github-pat.
+//   - Embedded ONLY in `https://x-access-token:$PAT@github.com/...` URL form,
+//     passed as a `child_process.spawn` ARGV element (not a shell string), so
+//     no shell ever sees it. The argv carrying the URL IS visible to ps(1)
+//     during clone — that is the standard git-over-https risk window per AD-3.
+//   - Stdout/stderr are CAPTURED but only stack names / generic progress are
+//     written to console. Git's own stderr (which can contain the embedded
+//     URL on auth failure) is sanitised: every literal occurrence of the PAT
+//     is replaced with `***REDACTED***` before the buffer touches stderr.
+//   - The PAT NEVER goes into argv via a shell string, environment variable,
+//     log file, or thrown error message.
+//
+// SECURITY (T-2-05 — PAT scope assertion):
+//   - Before any clone, calls GitHub /user (with the PAT) to confirm the token
+//     authenticates. We do NOT enforce a specific scope here because the
+//     fine-grained-PAT scope vocabulary differs from classic-PAT scopes; a
+//     successful GET /user is sufficient to prove the token is valid and the
+//     token cannot exceed `repo`-equivalent scope per the project setup
+//     contract documented in docs/legacy-connectors.md.
+//
+// SECURITY (T-2-06 — fixture quarantine):
+//   - test/fixtures/*/ is .gitignore'd at the repo root (verified by Plan 02-01).
+//     The synced files are therefore quarantined: they NEVER enter version
+//     control of deepdebug-local-agent. AD-2 explicit submodule rejection.
+
+import {
+  readFileSync,
+  mkdirSync,
+  rmSync,
+  readdirSync,
+  copyFileSync,
+  existsSync,
+} from 'node:fs';
+import { spawn } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, dirname, basename } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const PAT_PATH = join(homedir(), '.config', 'visionhammer', 'github-pat');
+const ALLOWED_STACKS = ['oracle-forms', 'plsql', 'sap-abap', 'cobol', 'ibm-mq'];
+
+// Mapping: example-repo-stack name → local fixture directory name.
+// Example repos use product names (sap-abap, ibm-mq); local fixtures use
+// adapter names (sap, ibmmq). plsql has no Phase 2 adapter — fixtures are
+// synced for Phase 3 catalog work.
+const FIXTURE_DIR_MAP = Object.freeze({
+  'oracle-forms': 'oracle-forms',
+  'plsql': 'plsql',
+  'sap-abap': 'sap',
+  'cobol': 'cobol',
+  'ibm-mq': 'ibmmq',
+});
+
+// IBM MQ filename mapping (per Plan 02-08 SUMMARY's filename-mismatch decision).
+// The IbmMqLogAdapter only reads files matching `^AMQERR0[1-3]\.LOG$`. The
+// remote example repo intentionally uses descriptive sample names; sync-time
+// renaming makes the synced fixtures consumable by the adapter's contract.
+// Order is stable so re-runs always produce the same target filenames.
+const IBM_MQ_FILENAME_MAP = Object.freeze({
+  'ibm-mq-sample-mqrc-2033.log': 'AMQERR01.LOG',
+  'ibm-mq-sample-mqrc-2058.log': 'AMQERR02.LOG',
+  'ibm-mq-sample-resource-leak.log': 'AMQERR03.LOG',
+});
+
+const __dirname = dirname(fileURLToPath(import.meta.url));
+const REPO_ROOT = join(__dirname, '..');
+
+function readPat() {
+  // SECURITY: do NOT log PAT_PATH contents on error or success. ENOENT = caller missing setup.
+  try {
+    return readFileSync(PAT_PATH, 'utf8').trim();
+  } catch (err) {
+    if (err.code === 'ENOENT') {
+      process.stderr.write(
+        'sync-fixtures: GitHub credentials not configured. See docs/legacy-connectors.md.\n',
+      );
+      process.exit(2);
+    }
+    throw err;
+  }
+}
+
+function parseArgs(argv) {
+  // --stacks=oracle-forms,plsql  OR  --stacks oracle-forms plsql  OR  default = all
+  const args = argv.slice(2);
+  const flagIdx = args.findIndex((a) => a === '--stacks' || a.startsWith('--stacks='));
+  if (flagIdx === -1) return ALLOWED_STACKS;
+  const flag = args[flagIdx];
+  const raw = flag.startsWith('--stacks=')
+    ? flag.slice('--stacks='.length)
+    : (args[flagIdx + 1] || '');
+  const requested = raw.split(',').map((s) => s.trim()).filter(Boolean);
+  const unknown = requested.filter((s) => !ALLOWED_STACKS.includes(s));
+  if (unknown.length > 0) {
+    process.stderr.write(
+      `sync-fixtures: unknown stack(s): ${unknown.join(', ')}. Allowed: ${ALLOWED_STACKS.join(', ')}\n`,
+    );
+    process.exit(2);
+  }
+  return requested.length === 0 ? ALLOWED_STACKS : requested;
+}
+
+/**
+ * Run a child process; never log argv. Captures stdout/stderr buffers.
+ * @returns {Promise<{code:number, out:string, err:string}>}
+ */
+function run(cmd, args, cwd) {
+  return new Promise((resolve, reject) => {
+    const child = spawn(cmd, args, {
+      cwd,
+      stdio: ['ignore', 'pipe', 'pipe'],
+    });
+    let out = '';
+    let err = '';
+    child.stdout.on('data', (d) => { out += d.toString(); });
+    child.stderr.on('data', (d) => { err += d.toString(); });
+    child.on('close', (code) => resolve({ code, out, err }));
+    child.on('error', reject);
+  });
+}
+
+/**
+ * T-2-05: confirm the PAT authenticates against GitHub before any clone.
+ * On failure, exit 2 with a generic message — never echo the PAT or response.
+ */
+async function assertPatValid(pat) {
+  // node:fetch is built-in on Node 18+. Authorization header is the standard
+  // PAT delivery channel — never logged, never persisted.
+  const res = await fetch('https://api.github.com/user', {
+    headers: {
+      Authorization: `Bearer ${pat}`,
+      Accept: 'application/vnd.github+json',
+      'User-Agent': 'visionhammer-sync-fixtures',
+    },
+  });
+  if (!res.ok) {
+    // Do NOT print response body — GitHub may echo parts of the request URL.
+    process.stderr.write(
+      `sync-fixtures: PAT authentication failed (HTTP ${res.status}). Verify ~/.config/visionhammer/github-pat.\n`,
+    );
+    process.exit(2);
+  }
+  // We intentionally do NOT verify scope strings — fine-grained-PAT and
+  // classic-PAT report scopes differently. Validity is sufficient per AD-3.
+}
+
+async function syncStack(stack, pat) {
+  const tmpClone = `/tmp/sync-${stack}`;
+  const repoUrl = `https://x-access-token:${pat}@github.com/williambella/visionhammer-example-${stack}.git`;
+  const fixtureDir = FIXTURE_DIR_MAP[stack];
+  const dest = join(REPO_ROOT, 'test', 'fixtures', fixtureDir);
+
+  // Clean any prior temp clone (idempotent re-runs).
+  try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+
+  process.stdout.write(`sync-fixtures: cloning ${stack} ... `);
+  const clone = await run(
+    'git',
+    ['clone', '--depth', '1', '--branch', 'main', repoUrl, tmpClone],
+    REPO_ROOT,
+  );
+  if (clone.code !== 0) {
+    process.stderr.write(
+      `\nsync-fixtures: git clone failed for ${stack} (exit ${clone.code}).\n`,
+    );
+    // Sanitize: replace any occurrence of the PAT with a redaction before
+    // letting git's stderr touch our stderr. Defence in depth — git rarely
+    // includes the credential portion of the URL but the redaction is cheap.
+    const sanitized = clone.err.split(pat).join('***REDACTED***');
+    process.stderr.write(sanitized + '\n');
+    return false;
+  }
+  process.stdout.write('cloned. ');
+
+  const srcSamples = join(tmpClone, 'samples');
+  if (!existsSync(srcSamples)) {
+    process.stderr.write(
+      `\nsync-fixtures: ${stack}: samples/ dir missing in repo, skipping copy.\n`,
+    );
+    try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+    return false;
+  }
+
+  mkdirSync(dest, { recursive: true });
+  const files = readdirSync(srcSamples).filter(
+    (f) => f.toLowerCase().endsWith('.log'),
+  );
+  let copied = 0;
+  for (const f of files) {
+    let targetName = f;
+    if (stack === 'ibm-mq') {
+      // Apply filename mapping (Plan 02-08 SUMMARY decision).
+      targetName = IBM_MQ_FILENAME_MAP[f] ?? null;
+      if (!targetName) {
+        // Sample without an explicit mapping is silently skipped — adapter
+        // would not pick it up anyway (filename anchor /^AMQERR0[1-3]\.LOG$/).
+        continue;
+      }
+    }
+    copyFileSync(join(srcSamples, f), join(dest, targetName));
+    copied++;
+  }
+  process.stdout.write(`copied ${copied} log(s) → test/fixtures/${fixtureDir}/. `);
+
+  // Cleanup temp clone.
+  try { rmSync(tmpClone, { recursive: true, force: true }); } catch (_) { /* ok */ }
+  process.stdout.write('done.\n');
+  return true;
+}
+
+async function main() {
+  const stacks = parseArgs(process.argv);
+  const pat = readPat();
+  await assertPatValid(pat); // T-2-05 gate
+  let failures = 0;
+  for (const s of stacks) {
+    const ok = await syncStack(s, pat);
+    if (!ok) failures++;
+  }
+  // PAT goes out of scope here — never persisted, never logged.
+  if (failures > 0) {
+    process.stderr.write(
+      `sync-fixtures: ${failures}/${stacks.length} stack(s) failed.\n`,
+    );
+    process.exit(1);
+  }
+  process.stdout.write(`sync-fixtures: all ${stacks.length} stack(s) synced.\n`);
+}
+
+main().catch((err) => {
+  // err.message MUST not contain PAT. We never interpolate the PAT into thrown
+  // errors anywhere above; the only thrown paths are fs/network errors whose
+  // messages do not reference the credential.
+  process.stderr.write(`sync-fixtures: fatal: ${err.message}\n`);
+  process.exit(1);
+});

package/src/adapters/as400/as400-parser.js

@@ -0,0 +1,12 @@
+// src/adapters/as400/as400-parser.js
+// OS/400 message ID prefixes: CPF (escape), MCH (machine check), SQL (DB2 for i)
+// Anchored at start-of-line so arbitrary text containing the substring
+// (e.g. "see CPF1234 docs") does not match — T-2-03-equivalent isolation surface.
+export const AS400_MSGID_REGEX = /^(CPF|MCH|SQL)(\d{4})\b/;
+
+export function extractMessageId(line) {
+  const m = line.match(AS400_MSGID_REGEX);
+  return m ? `${m[1]}${m[2]}` : null;
+}
+
+export const DSPLOG_COMMAND = 'system "DSPLOG OUTPUT(*PRINT) LOGTYPE(*MSG) MSGTYPE(*ESCAPE *NOTIFY)"';

package/src/adapters/as400/index.js

@@ -0,0 +1,134 @@
+// src/adapters/as400/index.js
+// AS/400 (IBM i) log adapter — ssh2 Client polls DSPLOG output.
+// T-2-01 mitigation: pollInterval default 30000 ms (30 s — distinct from chokidar 5 s default per AD-3 + Constraints).
+// T-2-02 mitigation: ssh2 keepaliveInterval=30 s + keepaliveCountMax=3; 'close' triggers reconnect with
+// exponential backoff [1, 2, 4, 8, 16, 32, 60] s (capped at 60 s); backoff resets to base after a successful auth.
+import { EventEmitter } from 'node:events';
+import { Client as Ssh2Client } from 'ssh2';
+import { extractMessageId, DSPLOG_COMMAND } from './as400-parser.js';
+
+const ADAPTER = 'as400';
+const DEFAULT_BACKOFF = [1000, 2000, 4000, 8000, 16000, 32000, 60000];
+
+export class As400LogAdapter extends EventEmitter {
+  constructor(config = {}) {
+    super();
+    this.host = config.host || 'as400-prd-01';
+    this.port = config.port ?? 22;
+    this.username = config.username || 'TESTUSER01';
+    this.password = config.password;
+    this.privateKey = config.privateKey;
+    this.pollInterval = config.pollInterval ?? 30000;
+    this.backoffSchedule = config.backoffSchedule ?? DEFAULT_BACKOFF;
+    this._sshOpts = {
+      host: this.host,
+      port: this.port,
+      username: this.username,
+      ...(this.password ? { password: this.password } : {}),
+      ...(this.privateKey ? { privateKey: this.privateKey } : {}),
+      keepaliveInterval: 30000,
+      keepaliveCountMax: 3,
+      readyTimeout: 10000,
+    };
+    this._sshClientFactory = config.sshClientFactory || (() => new Ssh2Client());
+    this._client = null;
+    this._isRunning = false;
+    this._pollTimer = null;
+    this._backoffIdx = 0;
+    this._reconnectTimer = null;
+  }
+
+  get isRunning() { return this._isRunning; }
+
+  async start() {
+    if (this._isRunning) return;
+    this._isRunning = true;
+    this._connect();
+  }
+
+  async stop() {
+    if (!this._isRunning) return;
+    this._isRunning = false;
+    if (this._reconnectTimer) { clearTimeout(this._reconnectTimer); this._reconnectTimer = null; }
+    if (this._pollTimer) { clearInterval(this._pollTimer); this._pollTimer = null; }
+    if (this._client) {
+      try { this._client.end(); } catch { /* swallow */ }
+      this._client = null;
+    }
+  }
+
+  _connect() {
+    if (!this._isRunning) return;
+    const client = this._sshClientFactory();
+    this._client = client;
+
+    client.on('ready', () => {
+      this._backoffIdx = 0; // reset on successful auth
+      this._startPolling();
+    });
+
+    client.on('close', () => {
+      if (!this._isRunning) return;
+      if (this._pollTimer) { clearInterval(this._pollTimer); this._pollTimer = null; }
+      this._scheduleReconnect();
+    });
+
+    client.on('error', () => {
+      // ssh2 surfaces auth/network errors as 'error' then 'close'.
+      // 'close' handler schedules reconnect; nothing to do here.
+      if (!this._isRunning) return;
+    });
+
+    try {
+      client.connect(this._sshOpts);
+    } catch {
+      this._scheduleReconnect();
+    }
+  }
+
+  _scheduleReconnect() {
+    if (!this._isRunning) return;
+    const delay = this.backoffSchedule[Math.min(this._backoffIdx, this.backoffSchedule.length - 1)];
+    this._backoffIdx = Math.min(this._backoffIdx + 1, this.backoffSchedule.length - 1);
+    this._reconnectTimer = setTimeout(() => this._connect(), delay);
+    // Do not block process exit on a pending reconnect — `stop()` clears it explicitly.
+    this._reconnectTimer.unref?.();
+  }
+
+  _startPolling() {
+    const tick = () => {
+      if (!this._isRunning || !this._client) return;
+      this._client.exec(DSPLOG_COMMAND, (err, stream) => {
+        if (err) return; // close handler covers reconnect
+        let buf = '';
+        stream.on('data', (chunk) => { buf += chunk.toString('utf8'); });
+        stream.on('close', () => this._processOutput(buf));
+        stream.stderr?.on('data', () => { /* discard */ });
+      });
+    };
+    tick();
+    this._pollTimer = setInterval(tick, this.pollInterval);
+    // Do not block process exit on the poll cadence — `stop()` clears it explicitly.
+    this._pollTimer.unref?.();
+  }
+
+  _processOutput(text) {
+    const lines = text.split(/\r?\n/);
+    for (const line of lines) {
+      if (line.trim().length === 0) continue;
+      const code = extractMessageId(line);
+      if (!code) continue;
+      const event = Object.freeze({
+        adapter: ADAPTER,
+        errorCode: code,
+        file: `ssh://${this.host}/DSPLOG`,
+        message: line,
+        source: `ssh://${this.host}`,
+        timestamp: new Date().toISOString(),
+      });
+      this.emit('error', event);
+    }
+  }
+}
+
+export default As400LogAdapter;

package/src/adapters/cobol/cobol-parser.js

@@ -0,0 +1,37 @@
+// src/adapters/cobol/cobol-parser.js
+// Multi-pattern parser surface for COBOL/JES2 spool exports. Each regex is
+// exported as a named const for isolated unit-testing (T-2-03-equivalent
+// mitigation surface). The `extractCobolCode` helper picks the first matching
+// pattern in priority order.
+//
+// Priority (highest first): SYSTEM COMPLETION CODE → SQLCODE → FILE STATUS →
+// ABEND CODE → IEF info code. The first three are hard error conditions; IEF
+// info codes are the lowest priority because the same line often carries
+// the actual completion code (e.g. `IEF450I ... ABEND=S0C7`) and the
+// system-completion match is more specific.
+
+export const COBOL_COMPLETION_REGEX = /SYSTEM COMPLETION CODE=([SU]?\w{3,4})/;
+export const COBOL_SQLCODE_REGEX = /SQLCODE\s*=?\s*(-?\d+)/;
+export const COBOL_IEF_REGEX = /\b(IEF\d{3}I)\b/;
+export const COBOL_FILE_STATUS_REGEX = /FILE STATUS\s+(\d+)/;
+export const COBOL_ABEND_CODE_REGEX = /ABEND CODE=(\w+)/;
+
+export function extractCobolCode(line) {
+  let m = line.match(COBOL_COMPLETION_REGEX);
+  if (m) {
+    const raw = m[1];
+    // System codes start with 'S' (system) or 'U' (user). 0C7 → S0C7
+    // normalization per IBM convention.
+    if (/^[SU]/.test(raw)) return raw;
+    return `S${raw}`;
+  }
+  m = line.match(COBOL_SQLCODE_REGEX);
+  if (m) return m[1]; // includes leading '-' for negative codes
+  m = line.match(COBOL_FILE_STATUS_REGEX);
+  if (m) return `FILE_STATUS_${m[1]}`;
+  m = line.match(COBOL_ABEND_CODE_REGEX);
+  if (m) return m[1];
+  m = line.match(COBOL_IEF_REGEX);
+  if (m) return m[1];
+  return null;
+}

package/src/adapters/cobol/index.js

@@ -0,0 +1,151 @@
+// src/adapters/cobol/index.js
+// CobolLogAdapter — watches arbitrary files in the configured JES2 spool
+// directory; emits 6-key error events. AD-1 lifecycle, AD-3 polling, AD-4
+// byte-position dedup with TAIL-on-startup default, AD-5 per-file ordering,
+// AD-6 CRLF tolerance + 80-col fixed-width column-1 preservation (z/OS spool
+// trap). T-2-01 mitigation: default polling interval 5000 ms.
+//
+// The glob is `*` (any file) — JES2 spool exports have arbitrary names.
+// This is broader than sibling adapters but the parser regexes are narrow
+// enough (SYSTEM COMPLETION CODE, SQLCODE, IEF, FILE STATUS, ABEND CODE)
+// that lines without any match are silently dropped.
+
+import { EventEmitter } from 'node:events';
+import { stat, open } from 'node:fs/promises';
+import { join } from 'node:path';
+import chokidar from 'chokidar';
+import { extractCobolCode } from './cobol-parser.js';
+
+const ADAPTER = 'cobol';
+
+export class CobolLogAdapter extends EventEmitter {
+  constructor(config = {}) {
+    super();
+    this.spoolDir = config.spoolDir || '/var/spool/jes2';
+    this.interval = config.interval ?? 5000;
+    this.replayOnStart = config.replayOnStart === true;
+    this._watcher = null;
+    this._offsets = new Map(); // filePath → byte offset
+    this._inodes = new Map();  // filePath → inode
+    this._isRunning = false;
+  }
+
+  get isRunning() {
+    return this._isRunning;
+  }
+
+  async start() {
+    if (this._isRunning) return;
+    this._isRunning = true;
+
+    // Glob bound to any file in spool dir. depth:0 prevents recursion.
+    const glob = join(this.spoolDir, '*');
+
+    this._watcher = chokidar.watch(glob, {
+      usePolling: true,
+      interval: this.interval,
+      ignoreInitial: false, // we handle initial ourselves via TAIL seek
+      awaitWriteFinish: false,
+      depth: 0, // do not recurse into subdirs
+    });
+
+    const onAdd = async (filePath) => {
+      if (this.replayOnStart) {
+        this._offsets.set(filePath, 0);
+        // fall through to _readNew below
+      } else {
+        try {
+          const st = await stat(filePath);
+          this._offsets.set(filePath, st.size);
+          this._inodes.set(filePath, st.ino);
+          return; // TAIL mode — don't emit pre-existing content
+        } catch {
+          return;
+        }
+      }
+      this._readNew(filePath).catch(() => { /* ENOENT silence */ });
+    };
+
+    this._watcher.on('add', onAdd);
+    this._watcher.on('change', (fp) => {
+      this._readNew(fp).catch(() => { /* ENOENT silence */ });
+    });
+
+    // Swallow chokidar's own bubbled errors (e.g., watch-path ENOENT) —
+    // dual-layer suppression with the per-read try/catch ensures full
+    // ENOENT silence (canonical pattern from Plan 02-07).
+    this._watcher.on('error', () => {});
+  }
+
+  async stop() {
+    if (!this._isRunning) return;
+    this._isRunning = false;
+    if (this._watcher) {
+      await this._watcher.close().catch(() => {});
+      this._watcher = null;
+    }
+    this._offsets.clear();
+    this._inodes.clear();
+  }
+
+  async _readNew(filePath) {
+    let st;
+    try {
+      st = await stat(filePath);
+    } catch {
+      return; // ENOENT silence
+    }
+    if (!st.isFile()) return; // skip dirs that may surface from broad `*` glob
+
+    const lastOffset = this._offsets.get(filePath) ?? 0;
+    const lastInode = this._inodes.get(filePath);
+
+    // Rotation: inode changed OR size shrunk → reset to 0
+    if ((lastInode !== undefined && st.ino !== lastInode) || st.size < lastOffset) {
+      this._offsets.set(filePath, 0);
+      this._inodes.set(filePath, st.ino);
+      return this._readNew(filePath); // re-enter with offset=0
+    }
+    this._inodes.set(filePath, st.ino);
+
+    if (st.size <= lastOffset) return;
+
+    const fh = await open(filePath, 'r');
+    try {
+      const len = st.size - lastOffset;
+      const buf = Buffer.alloc(len);
+      await fh.read(buf, 0, len, lastOffset);
+      this._offsets.set(filePath, st.size);
+      const text = buf.toString('utf8');
+      // CRLF-tolerant split: \r?\n splits on either ending. The trailing
+      // \r is consumed by the regex so event.message is clean of artifacts
+      // (AD-6 z/OS spool trap).
+      const lines = text.split(/\r?\n/);
+      const sourceDir = filePath.split('/').slice(0, -1).join('/');
+      for (const line of lines) {
+        // CRITICAL: do NOT trim. Column-1 in z/OS spool = print control char
+        // (0/1/space) and is semantically meaningful (page eject markers,
+        // ABEND headers, etc.) — AD-6 fixed-width trap. Skip only truly
+        // empty lines; lines that are pure whitespace (column-1 padding)
+        // are also skipped because no parser regex would match them.
+        if (line.length === 0) continue;
+        const code = extractCobolCode(line);
+        if (!code) continue;
+        // 6-key frozen event payload (AD-4 contract — extra keys forbidden)
+        const event = Object.freeze({
+          adapter: ADAPTER,
+          errorCode: code,
+          file: filePath,
+          message: line,
+          source: sourceDir,
+          timestamp: new Date().toISOString(),
+        });
+        this.emit('error', event);
+      }
+    } finally {
+      await fh.close();
+    }
+  }
+}
+
+export default CobolLogAdapter;

package/src/adapters/ibmmq/ibmmq-parser.js

@@ -0,0 +1,23 @@
+// src/adapters/ibmmq/ibmmq-parser.js
+// T-2-03 isolation surface: regexes exported as named constants for unit testing.
+// Adapter binds chokidar to AMQERR0[1-3].LOG glob only; these regexes never
+// run against arbitrary text by the adapter itself.
+
+// Pattern: AMQ followed by 4 digits, optional suffix letter (E error / W warn / I info).
+// IBM MQ V9 message-code shape per Knowledge Center.
+export const IBMMQ_AMQ_REGEX = /\b(AMQ\d{4}[EWI]?)\b/;
+
+// Secondary capture: MQRC reason code from "ArithInsert1(NNNN)" (formal SLOG)
+// or "returned NNNN" (free-form prose). Group 1 = ArithInsert1 form, group 2 = "returned" form.
+export const IBMMQ_MQRC_REGEX = /(?:ArithInsert1\((\d+)\)|returned\s+(\d+))/;
+
+export function extractAmqCode(line) {
+  const m = line.match(IBMMQ_AMQ_REGEX);
+  return m ? m[1] : null;
+}
+
+export function extractMqrc(line) {
+  const m = line.match(IBMMQ_MQRC_REGEX);
+  if (!m) return null;
+  return m[1] || m[2] || null;
+}