devcouncil 0.3.1 → 0.4.0

package/src/devcouncil/verification/checks/wiring.py

@@ -0,0 +1,216 @@
+"""Unwired-file gate: flag newly added modules nothing (non-test) imports.
+
+Diff-scoped — only files this task *added*. Requires an importer outside the
+task's added set that is not a test file. Shares exemptions/entry-roots with
+``indexing/wiring.py``. Never raises.
+"""
+
+from __future__ import annotations
+
+import logging
+from pathlib import Path
+from typing import Callable, List, Optional, Set
+
+from devcouncil.domain.gap import Gap
+from devcouncil.domain.task import Task
+from devcouncil.indexing.wiring import (
+    ALLOW_UNWIRED,
+    build_dynamic_import_index,
+    entry_roots,
+    has_allow_unwired,
+    is_liveness_code_file,
+    is_test_path,
+    reference_cleared,
+    structural_exemptions,
+)
+from devcouncil.verification.checks.orphan_diff import classify_change_paths
+
+logger = logging.getLogger(__name__)
+
+
+def _norm(path: str) -> str:
+    s = path.replace("\\", "/")
+    while s.startswith("./"):
+        s = s[2:]
+    return s
+
+
+def added_files_from_diff(diff_content: str) -> Set[str]:
+    """Paths introduced via ``--- /dev/null`` / ``+++ b/...`` headers."""
+    added: Set[str] = set()
+    pending_new = False
+    for raw in (diff_content or "").splitlines():
+        if raw.startswith("--- "):
+            target = raw[4:].strip()
+            pending_new = target == "/dev/null"
+            continue
+        if raw.startswith("+++ ") and pending_new:
+            target = raw[4:].strip()
+            pending_new = False
+            if target == "/dev/null":
+                continue
+            path = target[2:] if target.startswith(("a/", "b/")) else target
+            added.add(_norm(path))
+    return added
+
+
+def collect_added_files(
+    *,
+    project_root: Path,
+    changed_files: List[str],
+    diff_content: str,
+    get_untracked_files: Callable[[], List[str]],
+    classify_fn: Callable[[List[str]], tuple[List[str], List[str]]] | None = None,
+) -> Set[str]:
+    """Union of classify_change_paths added set and committed-diff ``/dev/null`` headers.
+
+    Restricted to paths that appear in the change set or are currently untracked
+    (new) so stray diff headers outside the task's change set are dropped.
+    """
+    if classify_fn is not None:
+        classified, _ = classify_fn(changed_files)
+        added = set(classified)
+    else:
+        classified, _ = classify_change_paths(project_root, changed_files, get_untracked_files)
+        added = set(classified)
+    added |= added_files_from_diff(diff_content)
+    changed_norm = {_norm(p) for p in changed_files}
+    try:
+        untracked_norm = {_norm(p) for p in get_untracked_files()}
+    except Exception:
+        untracked_norm = set()
+    return {
+        _norm(p) for p in added
+        if _norm(p) in changed_norm or _norm(p) in untracked_norm
+    }
+
+
+def detect_unwired_file_gaps(
+    *,
+    task: Task,
+    project_root: Path,
+    changed_files: List[str],
+    diff_content: str,
+    get_untracked_files: Callable[[], List[str]],
+    next_gap_id: Callable[[str, str], str],
+    unwired_enabled: bool = True,
+    unwired_blocking: bool = False,
+    classify_fn: Callable[[List[str]], tuple[List[str], List[str]]] | None = None,
+    git_files: Optional[List[str]] = None,
+) -> List[Gap]:
+    """Flag added Python/JS/TS files with no external non-test importer."""
+    gaps: List[Gap] = []
+    if not unwired_enabled:
+        return gaps
+    try:
+        added = collect_added_files(
+            project_root=project_root,
+            changed_files=changed_files,
+            diff_content=diff_content,
+            get_untracked_files=get_untracked_files,
+            classify_fn=classify_fn,
+        )
+        candidates = sorted(p for p in added if is_liveness_code_file(p))
+        if not candidates:
+            return gaps
+
+        from devcouncil.indexing.repo_mapper import RepoMapper
+
+        mapper = RepoMapper(project_root)
+        # Include untracked/new files in the edge graph so same-task imports resolve.
+        if git_files is None:
+            try:
+                tracked = mapper.get_git_files()
+            except Exception:
+                tracked = []
+        else:
+            tracked = list(git_files)
+        all_files = sorted(set(tracked) | added | {_norm(p) for p in changed_files})
+        dependents = mapper.dependents_for(all_files)
+        roots = set(entry_roots(project_root, all_files))
+        added_set = set(candidates)
+        dyn_index = build_dynamic_import_index(project_root, all_files)
+
+        for path in candidates:
+            if path in roots or structural_exemptions(path):
+                continue
+
+            if has_allow_unwired(project_root, path):
+                # Marker always clears the blocking gap; still emit an advisory so
+                # intentional unwired files stay visible in the repair loop.
+                gaps.append(Gap(
+                    id=next_gap_id(task.id, f"UNWIREDDECL-{path}"),
+                    severity="medium",
+                    gap_type="unwired_file",
+                    task_id=task.id,
+                    description=(
+                        f"Intentional unwired file declared at {path} "
+                        f"({ALLOW_UNWIRED})."
+                    ),
+                    evidence=[path, ALLOW_UNWIRED],
+                    recommended_fix=(
+                        "Review declared unwired files before marking done; wire each "
+                        "into its intended caller when scaffolding is complete."
+                    ),
+                    blocking=False,
+                    file=path,
+                ))
+                continue
+
+            importers = dependents.get(path, set())
+            external_non_test = {
+                i for i in importers
+                if i not in added_set and not is_test_path(i)
+            }
+            if external_non_test:
+                continue
+
+            if reference_cleared(
+                project_root,
+                path,
+                skip_files=added_set,
+                git_files=all_files,
+                dynamic_index=dyn_index,
+            ):
+                continue
+
+            only_test = {i for i in importers if is_test_path(i) and i not in added_set}
+            only_same_task = {i for i in importers if i in added_set}
+            if only_test and not only_same_task:
+                desc = (
+                    f"New file {path} is only imported by test files "
+                    f"({', '.join(sorted(only_test)[:3])}); production code must import it."
+                )
+            elif only_same_task and not only_test:
+                desc = (
+                    f"New file {path} is only imported by other files added in this task "
+                    f"({', '.join(sorted(only_same_task)[:3])}); a pre-existing non-test "
+                    "caller must import it (same-task island rule)."
+                )
+            elif importers:
+                desc = (
+                    f"New file {path} has no external non-test importer "
+                    f"(importers: {', '.join(sorted(importers)[:5])})."
+                )
+            else:
+                desc = f"New file {path} is never imported by any other module."
+
+            gaps.append(Gap(
+                id=next_gap_id(task.id, f"UNWIRED-{path}"),
+                severity="high" if unwired_blocking else "medium",
+                gap_type="unwired_file",
+                task_id=task.id,
+                description=desc,
+                evidence=[path],
+                recommended_fix=(
+                    f"Import or register `{path}` from its intended non-test caller "
+                    f"(append the caller with `dev scope update {task.id} --lease-token "
+                    f"<token> --planned-file <caller>` if needed), or delete the unused file."
+                ),
+                blocking=unwired_blocking,
+                file=path,
+            ))
+    except Exception:
+        logger.debug("detect_unwired_file_gaps failed; degrading to zero gaps", exc_info=True)
+        return []
+    return gaps

package/src/devcouncil/verification/claims/__init__.py

@@ -0,0 +1,23 @@
+"""Claim lie-detector: map completion text → assertions → independent checks."""
+
+from __future__ import annotations
+
+from devcouncil.verification.claims.checks import execute_checks
+from devcouncil.verification.claims.mapper import map_claims
+from devcouncil.verification.claims.models import Assertion, CheckResult, Kind, Status
+from devcouncil.verification.claims.transcript import last_assistant_text, last_assistant_sentence
+from devcouncil.verification.claims.verdict import ClaimVerdict, decide_claims, summary_line
+
+__all__ = [
+    "Assertion",
+    "CheckResult",
+    "ClaimVerdict",
+    "Kind",
+    "Status",
+    "decide_claims",
+    "execute_checks",
+    "last_assistant_sentence",
+    "last_assistant_text",
+    "map_claims",
+    "summary_line",
+]

package/src/devcouncil/verification/claims/checks.py

@@ -0,0 +1,395 @@
+"""Independent re-execution of configured commands and git/fs cross-checks.
+
+Commands come from DevCouncil ``config.commands`` (test/lint/typecheck), never
+from claim text — except COMMAND_SUCCEEDED matching a configured command.
+Timeouts yield UNVERIFIABLE (never block).
+"""
+
+from __future__ import annotations
+
+import shlex
+import shutil
+import subprocess
+import sys
+import time
+from dataclasses import dataclass
+from pathlib import Path
+
+from devcouncil.verification.claims.models import Assertion, CheckResult, Kind, Status
+
+TAIL_LINES = 50
+
+
+@dataclass
+class ClaimCheckBudget:
+    """Timeouts for claim command re-runs."""
+
+    per_command_timeout: int = 90
+    total_timeout: int = 120
+
+
+@dataclass
+class CommandOutcome:
+    exit_code: int | None
+    output_tail: str
+    duration: float
+    timed_out: bool
+
+
+def _tail(*chunks: str | bytes | None) -> str:
+    parts: list[str] = []
+    for chunk in chunks:
+        if chunk is None:
+            continue
+        if isinstance(chunk, bytes):
+            chunk = chunk.decode("utf-8", errors="replace")
+        if chunk.strip():
+            parts.append(chunk)
+    combined = "\n".join(parts)
+    lines = combined.splitlines()
+    return "\n".join(lines[-TAIL_LINES:])
+
+
+def _argv_to_shell(cmd: list[str] | str) -> str:
+    if isinstance(cmd, str):
+        return cmd
+    return shlex.join(cmd)
+
+
+def run_command(cmd: str, cwd: Path, timeout: int) -> CommandOutcome:
+    try:
+        argv = shlex.split(cmd)
+    except ValueError:
+        argv = []
+    if argv and argv[0] in {"python", "python3"} and shutil.which(argv[0]) is None:
+        # Configs commonly use the portable `python` spelling even when macOS
+        # exposes only the interpreter running DevCouncil. Preserve the rest of
+        # the shell command while resolving that launcher deterministically.
+        cmd = f"{shlex.quote(sys.executable)}{cmd[len(argv[0]):]}"
+    start = time.monotonic()
+    try:
+        proc = subprocess.run(
+            cmd,
+            shell=True,
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            errors="replace",
+            timeout=timeout,
+        )
+        return CommandOutcome(
+            exit_code=proc.returncode,
+            output_tail=_tail(proc.stdout, proc.stderr),
+            duration=time.monotonic() - start,
+            timed_out=False,
+        )
+    except subprocess.TimeoutExpired as exc:
+        return CommandOutcome(
+            exit_code=None,
+            output_tail=_tail(exc.stdout, exc.stderr),
+            duration=time.monotonic() - start,
+            timed_out=True,
+        )
+    except OSError as exc:
+        return CommandOutcome(
+            exit_code=None,
+            output_tail=f"failed to launch command: {exc}",
+            duration=time.monotonic() - start,
+            timed_out=False,
+        )
+
+
+def _git_output(cwd: Path, *args: str) -> str | None:
+    try:
+        proc = subprocess.run(
+            ["git", *args],
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            errors="replace",
+            timeout=15,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    return proc.stdout if proc.returncode == 0 else None
+
+
+def git_toplevel(cwd: Path) -> Path | None:
+    out = _git_output(cwd, "rev-parse", "--show-toplevel")
+    return Path(out.strip()) if out and out.strip() else None
+
+
+def last_commit_paths(cwd: Path) -> set[str]:
+    out = _git_output(cwd, "log", "-1", "--name-only", "--pretty=format:")
+    if not out:
+        return set()
+    return {line.strip().strip('"') for line in out.splitlines() if line.strip()}
+
+
+def git_changed_files(cwd: Path) -> dict[str, str] | None:
+    try:
+        proc = subprocess.run(
+            ["git", "status", "--porcelain", "-uall"],
+            cwd=str(cwd),
+            capture_output=True,
+            text=True,
+            errors="replace",
+            timeout=15,
+        )
+    except (OSError, subprocess.TimeoutExpired):
+        return None
+    if proc.returncode != 0:
+        return None
+    changed: dict[str, str] = {}
+    for line in proc.stdout.splitlines():
+        if len(line) < 4:
+            continue
+        status, path = line[:2], line[3:]
+        if " -> " in path:
+            path = path.split(" -> ", 1)[1]
+        changed[path.strip().strip('"')] = status
+    return changed
+
+
+def _normalize(path: str) -> str:
+    return path.replace("\\", "/").strip("/").lower()
+
+
+def _in_changed(rel_path: str, changed: dict[str, str]) -> bool:
+    target = _normalize(rel_path)
+    return any(_normalize(p) == target for p in changed)
+
+
+class _Runner:
+    def __init__(self, budget: ClaimCheckBudget, cwd: Path):
+        self.budget = budget
+        self.cwd = cwd
+        self.deadline = time.monotonic() + budget.total_timeout
+        self.cache: dict[str, CommandOutcome] = {}
+
+    def run(self, cmd: str) -> CommandOutcome | None:
+        if cmd in self.cache:
+            return self.cache[cmd]
+        remaining = self.deadline - time.monotonic()
+        if remaining <= 0:
+            return None
+        outcome = run_command(
+            cmd, self.cwd, timeout=int(min(self.budget.per_command_timeout, max(remaining, 1)))
+        )
+        self.cache[cmd] = outcome
+        return outcome
+
+
+_NOT_FOUND_MARKERS = (
+    "is not recognized as an internal or external command",
+    "is not recognized as a name of a cmdlet",
+    "command not found",
+    "commandnotfoundexception",
+    "no such file or directory",
+    "failed to launch command",
+)
+
+
+def _command_not_found(outcome: CommandOutcome) -> bool:
+    if outcome.exit_code in (127, 9009):
+        return True
+    tail = outcome.output_tail.lower()
+    return outcome.exit_code != 0 and any(marker in tail for marker in _NOT_FOUND_MARKERS)
+
+
+def _command_result(assertion: Assertion, cmd: str | None, label: str, runner: _Runner) -> CheckResult:
+    if not cmd:
+        return CheckResult(assertion, Status.UNVERIFIABLE, f"no {label} command configured")
+    outcome = runner.run(cmd)
+    if outcome is None:
+        return CheckResult(assertion, Status.SKIPPED, "verification budget exhausted")
+    if outcome.timed_out:
+        return CheckResult(
+            assertion, Status.UNVERIFIABLE, f"`{cmd}` timed out after {outcome.duration:.0f}s"
+        )
+    if _command_not_found(outcome):
+        return CheckResult(
+            assertion,
+            Status.UNVERIFIABLE,
+            f"`{cmd}` could not be launched (command not found) — fix the configured {label} command",
+        )
+    if outcome.exit_code == 0:
+        return CheckResult(assertion, Status.PASS, f"`{cmd}` exited 0 in {outcome.duration:.1f}s")
+    return CheckResult(
+        assertion,
+        Status.FAIL,
+        f"`{cmd}` exited with exit code {outcome.exit_code}.\nOutput tail:\n{outcome.output_tail}",
+    )
+
+
+def _resolve_in_repo(target: str, cwd: Path) -> Path | None:
+    candidate = Path(target)
+    if not candidate.is_absolute():
+        candidate = cwd / candidate
+    try:
+        resolved = candidate.resolve()
+        if not resolved.is_relative_to(cwd.resolve()):
+            return None
+        return resolved
+    except OSError:
+        return None
+
+
+@dataclass
+class _GitInfo:
+    toplevel: Path
+    changed: dict[str, str]
+    last_commit: set[str]
+
+
+def _git_info(cwd: Path) -> _GitInfo | None:
+    toplevel = git_toplevel(cwd)
+    if toplevel is None:
+        return None
+    changed = git_changed_files(cwd) or {}
+    return _GitInfo(toplevel=toplevel, changed=changed, last_commit=last_commit_paths(cwd))
+
+
+def _find_unique_basename(name: str, cwd: Path, git: _GitInfo | None) -> Path | None:
+    if git is None:
+        return None
+    tracked = _git_output(cwd, "ls-files")
+    pool = set(tracked.splitlines() if tracked else []) | set(git.changed) | git.last_commit
+    matches = {p for p in pool if p.strip() and _normalize(p).rsplit("/", 1)[-1] == _normalize(name)}
+    if len(matches) != 1:
+        return None
+    return git.toplevel / matches.pop()
+
+
+def _changed_status(rel_path: str, changed: dict[str, str]) -> str:
+    target = _normalize(rel_path)
+    for path, status in changed.items():
+        if _normalize(path) == target:
+            return status.strip() or status
+    return "?"
+
+
+def _file_result(assertion: Assertion, cwd: Path, git: _GitInfo | None) -> CheckResult:
+    target = assertion.target or ""
+    resolved = _resolve_in_repo(target, cwd)
+    if resolved is None:
+        return CheckResult(
+            assertion, Status.UNVERIFIABLE, f"claimed path `{target}` is outside the working directory"
+        )
+
+    if not resolved.exists() and "/" not in target and "\\" not in target:
+        alt = _find_unique_basename(target, cwd, git)
+        if alt is not None and alt.exists():
+            resolved = alt.resolve()
+
+    if not resolved.exists():
+        return CheckResult(assertion, Status.FAIL, f"claimed file `{target}` does not exist")
+
+    if git is None:
+        return CheckResult(assertion, Status.PASS, f"`{target}` exists")
+
+    try:
+        rel = resolved.relative_to(git.toplevel.resolve()).as_posix()
+    except ValueError:
+        return CheckResult(assertion, Status.PASS, f"`{target}` exists (outside the git repo)")
+
+    if _in_changed(rel, git.changed):
+        return CheckResult(
+            assertion,
+            Status.PASS,
+            f"`{target}` exists (git status: {_changed_status(rel, git.changed)})",
+        )
+    if any(_normalize(p) == _normalize(rel) for p in git.last_commit):
+        return CheckResult(
+            assertion, Status.PASS, f"`{target}` exists (touched by the most recent commit)"
+        )
+    return CheckResult(
+        assertion,
+        Status.UNVERIFIABLE,
+        f"`{target}` exists but git shows no recent change to it; cannot confirm it was "
+        "created/modified in this session",
+    )
+
+
+@dataclass
+class ResolvedCommands:
+    test: str | None = None
+    build: str | None = None  # typecheck in DevCouncil
+    lint: str | None = None
+
+
+def resolve_commands_from_config(commands_cfg: object) -> ResolvedCommands:
+    """Map DevCouncil CommandsConfig lists to shell command strings."""
+    def first(attr: str) -> str | None:
+        value = getattr(commands_cfg, attr, None) or []
+        if isinstance(value, str) and value.strip():
+            return value.strip()
+        if isinstance(value, list) and value:
+            first_cmd = value[0]
+            if isinstance(first_cmd, list):
+                return _argv_to_shell(first_cmd)
+            if isinstance(first_cmd, str) and first_cmd.strip():
+                return first_cmd.strip()
+        return None
+
+    return ResolvedCommands(test=first("test"), build=first("typecheck"), lint=first("lint"))
+
+
+def _matching_config_command(target: str, resolved: ResolvedCommands) -> str | None:
+    wanted = " ".join(target.split()).lower()
+    for cmd in (resolved.test, resolved.build, resolved.lint):
+        if cmd and wanted == " ".join(cmd.split()).lower():
+            return cmd
+    return None
+
+
+def execute_checks(
+    assertions: list[Assertion],
+    *,
+    cwd: Path,
+    commands: ResolvedCommands,
+    budget: ClaimCheckBudget | None = None,
+) -> list[CheckResult]:
+    """Independently verify each assertion against the real environment."""
+    runner = _Runner(budget or ClaimCheckBudget(), cwd)
+    git = _git_info(cwd)
+    results: list[CheckResult] = []
+
+    for assertion in assertions:
+        kind = assertion.kind
+        if kind is Kind.TESTS_PASS:
+            results.append(_command_result(assertion, commands.test, "test", runner))
+        elif kind is Kind.BUILD_SUCCEEDS:
+            results.append(_command_result(assertion, commands.build, "typecheck/build", runner))
+        elif kind is Kind.LINT_CLEAN:
+            results.append(_command_result(assertion, commands.lint, "lint", runner))
+        elif kind in (Kind.FILE_CREATED, Kind.FILE_UPDATED):
+            results.append(_file_result(assertion, cwd, git))
+        elif kind is Kind.COMMAND_SUCCEEDED:
+            cmd = _matching_config_command(assertion.target or "", commands)
+            if cmd is None:
+                results.append(
+                    CheckResult(
+                        assertion,
+                        Status.UNVERIFIABLE,
+                        f"claimed command `{assertion.target}` does not match any configured "
+                        "command; not re-running arbitrary commands",
+                    )
+                )
+            else:
+                results.append(_command_result(assertion, cmd, "matched", runner))
+        elif kind is Kind.GENERIC_DONE:
+            if commands.test:
+                results.append(_command_result(assertion, commands.test, "test", runner))
+            else:
+                results.append(
+                    CheckResult(
+                        assertion,
+                        Status.UNVERIFIABLE,
+                        "generic completion claim with no configured checks",
+                    )
+                )
+        else:
+            results.append(CheckResult(assertion, Status.UNVERIFIABLE, f"no checker for kind {kind}"))
+
+    return results