devrites 5.11.0 → 5.13.0

package/engine/internal/overhaul/admit/admit_test.go

@@ -0,0 +1,170 @@
+package admit
+
+import (
+	"bytes"
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+type J = map[string]any
+type L = []any
+
+func write(t *testing.T, path string, v any) string {
+	t.Helper()
+	if err := os.MkdirAll(filepath.Dir(path), 0o755); err != nil {
+		t.Fatal(err)
+	}
+	b, ok := v.(string)
+	if !ok {
+		raw, err := json.Marshal(v)
+		if err != nil {
+			t.Fatal(err)
+		}
+		b = string(raw)
+	}
+	if err := os.WriteFile(path, []byte(b), 0o644); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func run(args ...string) (int, string, string) {
+	var out, errb bytes.Buffer
+	code := Run(args, &out, &errb)
+	return code, out.String(), errb.String()
+}
+
+func newRun(t *testing.T) string {
+	dir := filepath.Join(t.TempDir(), "run")
+	write(t, filepath.Join(dir, "CURRENT"), "g0001\n")
+	write(t, filepath.Join(dir, "g0001/run.json"), J{"run_id": "run-1",
+		"revisions": J{"plan": J{"rev": 1, "file": "revisions/plan-r1.json"}}})
+	write(t, filepath.Join(dir, "g0001/dispatch.json"), J{"attempts": L{
+		J{"task_id": "T-1", "attempt_id": "A0", "role": "implementer", "lane": "fix", "snapshot": "s1", "status": "admitted"},
+		J{"task_id": "T-1", "attempt_id": "A1", "role": "implementer", "lane": "fix", "snapshot": "s1", "status": "running"},
+		J{"task_id": "R-1", "attempt_id": "A1", "role": "reviewer", "lane": "security", "snapshot": "s1", "status": "running"},
+	}})
+	write(t, filepath.Join(dir, "revisions/plan-r1.json"), J{"rev": 1, "tasks": L{
+		J{"id": "T-1", "allowed_paths": L{"src/a.py"}}, J{"id": "T-2", "allowed_paths": L{"src/b.py"}}}})
+	return dir
+}
+
+func writerReceipt() J {
+	return J{"schema": "overhaul.receipt/1", "run_id": "run-1", "task_id": "T-1", "attempt_id": "A1",
+		"role": "implementer", "lane": "fix", "snapshot": "s1", "started_at": "t0", "finished_at": "t1",
+		"outcome": "patch", "changed_paths": L{"src/a.py"}}
+}
+
+func TestReceipt(t *testing.T) {
+	cases := []struct {
+		name     string
+		mutate   func(J)
+		observed string // "-" means no --observed flag
+		code     int
+		want     string
+	}{
+		{"writer admissible", func(J) {}, "src/a.py\n\n", 0, `{"verdict": "ADMISSIBLE", "reasons": []}`},
+		{"observed differs", func(J) {}, "src/b.py\n", 1, "observed paths ['src/b.py'] differ from claimed ['src/a.py']"},
+		{"claimed outside contract", func(r J) { r["changed_paths"] = L{"src/a.py", "src/c.py"} }, "src/a.py\nsrc/c.py\n", 1, "changed paths outside contract: ['src/c.py']"},
+		{"writer needs observed", func(J) {}, "-", 1, "writer receipt needs observed changed paths (--observed)"},
+		{"snapshot mismatch", func(r J) { r["snapshot"] = "s2" }, "src/a.py\n", 1, "snapshot differs from the dispatch packet"},
+		{"bad outcome", func(r J) { r["outcome"] = "done" }, "src/a.py\n", 1, "outcome must be one of ['findings', 'gap', 'no-findings', 'patch', 'verdict']"},
+		{"missing finished_at", func(r J) { delete(r, "finished_at") }, "src/a.py\n", 1, "missing finished_at"},
+		{"wrong run", func(r J) { r["run_id"] = "run-2" }, "src/a.py\n", 1, "wrong schema or run"},
+		{"unknown attempt", func(r J) { r["attempt_id"] = "A9" }, "-", 1, "no such dispatched attempt"},
+		{"duplicate or late", func(r J) { r["attempt_id"] = "A0" }, "src/a.py\n", 3, `{"verdict": "DUPLICATE_OR_LATE", "attempt_status": "admitted"}`},
+		{"reviewer no-findings without inspected", func(r J) {
+			r["task_id"], r["role"], r["lane"], r["outcome"] = "R-1", "reviewer", "security", "no-findings"
+			delete(r, "changed_paths")
+		}, "-", 1, "no-findings without inspected ranges is malformed"},
+		{"reviewer admissible", func(r J) {
+			r["task_id"], r["role"], r["lane"], r["outcome"], r["inspected"] = "R-1", "reviewer", "security", "no-findings", L{"src/a.py:1-9"}
+		}, "-", 0, "ADMISSIBLE"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			dir := newRun(t)
+			rc := writerReceipt()
+			c.mutate(rc)
+			args := []string{"receipt", dir, write(t, filepath.Join(dir, "receipts/r.json"), rc)}
+			if c.observed != "-" {
+				args = append(args, "--observed", write(t, filepath.Join(dir, "observed.txt"), c.observed))
+			}
+			code, out, errs := run(args...)
+			if code != c.code || !strings.Contains(out, c.want) {
+				t.Fatalf("want %d with %q, got %d:\n%s%s", c.code, c.want, code, out, errs)
+			}
+		})
+	}
+}
+
+func TestReceiptIOError(t *testing.T) {
+	dir := newRun(t)
+	if code, _, errs := run("receipt", dir, filepath.Join(dir, "missing.json")); code != 2 || !strings.HasPrefix(errs, "ERROR: ") {
+		t.Fatalf("got %d %s", code, errs)
+	}
+	if code, _, _ := run("receipt", dir, "x.json", "--observed"); code != 2 {
+		t.Fatalf("dangling --observed exit %d", code)
+	}
+	if code, _, _ := run("anchor"); code != 2 {
+		t.Fatalf("usage exit %d", code)
+	}
+}
+
+func TestAnchor(t *testing.T) {
+	loc := func(path string, start, end int, quote string) J {
+		return J{"path": path, "start": start, "end": end, "quote": quote}
+	}
+	cases := []struct {
+		name     string
+		findings L
+		code     int
+		want     string
+	}{
+		{"match", L{J{"id": "F-1", "locations": L{loc("src/a.py", 2, 2, "  return   request.user ")}}}, 0, `{"verdict": "ANCHORED", "reasons": []}`},
+		{"multi-line match", L{J{"id": "F-1", "locations": L{loc("src/a.py", 1, 2, "(request): return request")}}}, 0, "ANCHORED"},
+		{"wrong quote", L{J{"id": "F-1", "locations": L{loc("src/a.py", 2, 2, "return request.admin")}}}, 1, "F-1: quote not found at src/a.py:2-2"},
+		{"lines outside file", L{J{"id": "F-1", "locations": L{loc("src/a.py", 2, 9, "return request.user")}}}, 1, "F-1: src/a.py lines 2-9 outside file (3 lines)"},
+		{"path escape", L{J{"id": "F-1", "locations": L{loc("../secret.py", 1, 1, "top secret value")}}}, 1, "F-1: ../secret.py is not a file under the reviewed tree"},
+		{"directory", L{J{"id": "F-1", "locations": L{loc("src", 1, 1, "whatever long")}}}, 1, "is not a file under"},
+		{"too short", L{J{"id": "F-1", "locations": L{loc("src/a.py", 2, 2, "return")}}}, 1, "F-1: quote at src/a.py:2 is too short to anchor; quote the whole line"},
+		{"short quote equal to window", L{J{"id": "F-1", "locations": L{loc("src/a.py", 3, 3, "x = 1")}}}, 0, "ANCHORED"},
+		{"no locations", L{J{"id": "F-2"}}, 1, "F-2: no locations to anchor"},
+	}
+	for _, c := range cases {
+		t.Run(c.name, func(t *testing.T) {
+			dir := t.TempDir()
+			tree := filepath.Join(dir, "tree")
+			write(t, filepath.Join(tree, "src/a.py"), "def handler(request):\n    return request.user\nx = 1\n")
+			write(t, filepath.Join(dir, "secret.py"), "top secret value\n")
+			code, out, errs := run("anchor", tree, write(t, filepath.Join(dir, "p.json"), J{"findings": c.findings}))
+			if code != c.code || !strings.Contains(out, c.want) {
+				t.Fatalf("want %d with %q, got %d:\n%s%s", c.code, c.want, code, out, errs)
+			}
+		})
+	}
+}
+
+func TestAnchorBadInput(t *testing.T) {
+	dir := t.TempDir()
+	for _, doc := range []any{J{"findings": L{}}, L{}, J{"items": L{J{"id": "F-1"}}}} {
+		code, _, errs := run("anchor", dir, write(t, filepath.Join(dir, "p.json"), doc))
+		if code != 2 || !strings.Contains(errs, `expected {"findings": [...]} with at least one finding`) {
+			t.Fatalf("%v: got %d %s", doc, code, errs)
+		}
+	}
+}
+
+func TestSplitlines(t *testing.T) {
+	got := splitlines("a\r\nb\rc\n\nd\u2028e")
+	want := []string{"a", "b", "c", "", "d", "e"}
+	if strings.Join(got, "|") != strings.Join(want, "|") {
+		t.Fatalf("splitlines = %q", got)
+	}
+	if pyJSON("é\"<\x01") != `"\u00e9\"<\u0001"` {
+		t.Fatalf("pyJSON = %s", pyJSON("é\"<\x01"))
+	}
+}

package/engine/internal/overhaul/admit/run.go

@@ -0,0 +1,416 @@
+// Package admit implements the /overhaul admit tool: read-only admission
+// checks for worker output.
+//
+//	receipt RUN RECEIPT [--observed FILE]   receipt vs its dispatch packet; writers vs observed paths
+//	anchor ROOT PROPOSALS                   every quoted location matches its file lines (ROOT = snapshot tree or repo)
+//
+// Exit: 0 admissible, 1 reject (reasons listed), 2 usage/IO error, 3 duplicate
+// or late receipt. Nothing here edits canonical records; the coordinator
+// records the verdict in a staged generation.
+package admit
+
+import (
+	"encoding/json"
+	"fmt"
+	"io"
+	"math"
+	"os"
+	"path/filepath"
+	"slices"
+	"sort"
+	"strconv"
+	"strings"
+	"unicode/utf16"
+	"unicode/utf8"
+
+	"github.com/devrites/devrites/internal/overhaul/ovio"
+	"github.com/devrites/devrites/internal/overhaul/records"
+)
+
+const usage = `usage: overhaul admit <command> ...
+
+  receipt RUN RECEIPT [--observed FILE]   receipt vs its dispatch packet; writers vs observed paths
+  anchor ROOT PROPOSALS                   every quoted location matches its file lines (ROOT = snapshot tree or repo)
+Exit: 0 admissible, 1 reject (reasons listed), 2 usage/IO error, 3 duplicate or late receipt.
+`
+
+var (
+	writers  = map[string]bool{"implementer": true}
+	outcomes = []string{"findings", "gap", "no-findings", "patch", "verdict"} // sorted
+)
+
+// Run executes the tool with its arguments (tool name excluded).
+func Run(args []string, stdout, stderr io.Writer) int {
+	var code int
+	var err error
+	switch {
+	case len(args) >= 3 && args[0] == "receipt":
+		observed, hasObserved := "", false
+		for i, a := range args {
+			if a == "--observed" {
+				if i+1 >= len(args) {
+					fmt.Fprint(stderr, usage)
+					return 2
+				}
+				observed, hasObserved = args[i+1], true
+				break
+			}
+		}
+		code, err = receipt(args[1], args[2], observed, hasObserved, stdout)
+	case len(args) >= 3 && args[0] == "anchor":
+		code, err = anchor(args[1], args[2], stdout, stderr)
+	default:
+		fmt.Fprint(stderr, usage)
+		return 2
+	}
+	if err != nil {
+		fmt.Fprintf(stderr, "ERROR: %v\n", err)
+		return 2
+	}
+	return code
+}
+
+// join mirrors os.path.join: an absolute part replaces everything before it.
+func join(base, rel string) string {
+	switch {
+	case strings.HasPrefix(rel, "/"):
+		return rel
+	case base == "" || strings.HasSuffix(base, "/"):
+		return base + rel
+	}
+	return base + "/" + rel
+}
+
+func realpath(p string) string {
+	abs, err := filepath.Abs(p)
+	if err != nil {
+		abs = p
+	}
+	return ovio.Resolve(abs)
+}
+
+// pyJSON renders s like Python's json.dumps (ensure_ascii=True).
+func pyJSON(s string) string {
+	var b strings.Builder
+	b.WriteByte('"')
+	for _, r := range s {
+		switch r {
+		case '"':
+			b.WriteString(`\"`)
+		case '\\':
+			b.WriteString(`\\`)
+		case '\n':
+			b.WriteString(`\n`)
+		case '\r':
+			b.WriteString(`\r`)
+		case '\t':
+			b.WriteString(`\t`)
+		case '\b':
+			b.WriteString(`\b`)
+		case '\f':
+			b.WriteString(`\f`)
+		default:
+			switch {
+			case r > 0xffff:
+				r1, r2 := utf16.EncodeRune(r)
+				fmt.Fprintf(&b, `\u%04x\u%04x`, r1, r2)
+			case r < 0x20 || r > 0x7e:
+				fmt.Fprintf(&b, `\u%04x`, r)
+			default:
+				b.WriteRune(r)
+			}
+		}
+	}
+	b.WriteByte('"')
+	return b.String()
+}
+
+func pyValue(v any) string {
+	switch x := v.(type) {
+	case string:
+		return pyJSON(x)
+	case []string:
+		parts := make([]string, len(x))
+		for i, s := range x {
+			parts[i] = pyJSON(s)
+		}
+		return "[" + strings.Join(parts, ", ") + "]"
+	}
+	b, _ := json.Marshal(v)
+	return string(b)
+}
+
+// verdict prints {"verdict": v, <key>: val} exactly as Python's json.dumps does.
+func verdict(w io.Writer, v, key string, val any) {
+	fmt.Fprintf(w, "{\"verdict\": %s, %s: %s}\n", pyJSON(v), pyJSON(key), pyValue(val))
+}
+
+func keyed(m any, k string) (any, error) {
+	o, ok := m.(map[string]any)
+	if !ok {
+		return nil, fmt.Errorf("'%s': parent is not an object", k)
+	}
+	v, ok := o[k]
+	if !ok {
+		return nil, fmt.Errorf("'%s'", k)
+	}
+	return v, nil
+}
+
+// strSet collects string members keyed by records.Repr (non-strings never match paths).
+func strSet(vals []any) map[string]any {
+	s := map[string]any{}
+	for _, v := range vals {
+		s[records.Repr(v)] = v
+	}
+	return s
+}
+
+func sortedVals(s map[string]any) []any {
+	out := make([]any, 0, len(s))
+	for _, v := range s {
+		out = append(out, v)
+	}
+	sort.Slice(out, func(i, j int) bool { return records.PyStr(out[i]) < records.PyStr(out[j]) })
+	return out
+}
+
+func receipt(run, path, observed string, hasObserved bool, stdout io.Writer) (int, error) {
+	cur, err := os.ReadFile(join(run, "CURRENT"))
+	if err != nil {
+		return 0, err
+	}
+	gen := join(run, strings.TrimSpace(string(cur)))
+	rj, err := ovio.LoadObject(join(gen, "run.json"))
+	if err != nil {
+		return 0, err
+	}
+	disp, err := ovio.LoadObject(join(gen, "dispatch.json"))
+	if err != nil {
+		return 0, err
+	}
+	rc, err := ovio.LoadObject(path)
+	if err != nil {
+		return 0, err
+	}
+	eq := func(a, b any) bool { return records.Repr(a) == records.Repr(b) }
+	var why []string
+	var x map[string]any
+	for _, it := range ovio.List(disp["attempts"]) {
+		if a := ovio.Obj(it); eq(a["task_id"], rc["task_id"]) && eq(a["attempt_id"], rc["attempt_id"]) {
+			x = a
+			break
+		}
+	}
+	if ovio.Str(rc["schema"]) != "overhaul.receipt/1" || !eq(rc["run_id"], rj["run_id"]) {
+		why = append(why, "wrong schema or run")
+	}
+	if x == nil {
+		why = append(why, "no such dispatched attempt")
+	} else {
+		if s := ovio.Str(x["status"]); s == "admitted" || s == "rejected" || s == "cancelled" {
+			verdict(stdout, "DUPLICATE_OR_LATE", "attempt_status", x["status"])
+			return 3, nil
+		}
+		for _, k := range []string{"role", "lane", "snapshot"} {
+			if !eq(rc[k], x[k]) {
+				why = append(why, k+" differs from the dispatch packet")
+			}
+		}
+		for _, k := range []string{"started_at", "finished_at"} {
+			if !ovio.Truthy(rc[k]) {
+				why = append(why, "missing "+k)
+			}
+		}
+		if !slices.Contains(outcomes, ovio.Str(rc["outcome"])) {
+			why = append(why, "outcome must be one of "+records.Repr(outcomes))
+		}
+		if ovio.Str(rc["outcome"]) == "no-findings" && !ovio.Truthy(rc["inspected"]) {
+			why = append(why, "no-findings without inspected ranges is malformed")
+		}
+		if writers[ovio.Str(x["role"])] {
+			v, err := keyed(rj, "revisions")
+			if err == nil {
+				v, err = keyed(v, "plan")
+			}
+			if err == nil {
+				v, err = keyed(v, "file")
+			}
+			if err != nil {
+				return 0, err
+			}
+			plan, err := ovio.LoadObject(join(run, ovio.Str(v)))
+			if err != nil {
+				return 0, err
+			}
+			allowed := map[string]any{}
+			for _, t := range ovio.List(plan["tasks"]) {
+				if tm := ovio.Obj(t); eq(tm["id"], x["task_id"]) {
+					for k, p := range strSet(ovio.List(tm["allowed_paths"])) {
+						allowed[k] = p
+					}
+				}
+			}
+			claimed := strSet(ovio.List(rc["changed_paths"]))
+			outside := map[string]any{}
+			for k, p := range claimed {
+				if _, ok := allowed[k]; !ok {
+					outside[k] = p
+				}
+			}
+			if len(outside) > 0 {
+				why = append(why, "changed paths outside contract: "+records.Repr(sortedVals(outside)))
+			}
+			if !hasObserved {
+				why = append(why, "writer receipt needs observed changed paths (--observed)")
+			} else {
+				b, err := os.ReadFile(observed) // #nosec G304 -- observed-paths file is an explicit operator argument
+				if err != nil {
+					return 0, err
+				}
+				text := strings.NewReplacer("\r\n", "\n", "\r", "\n").Replace(string(b)) // universal newlines
+				seen := map[string]any{}
+				for _, ln := range strings.Split(text, "\n") {
+					if ln = strings.TrimSpace(ln); ln != "" {
+						seen[records.Repr(ln)] = ln
+					}
+				}
+				same := len(seen) == len(claimed)
+				for k := range seen {
+					if _, ok := claimed[k]; !ok {
+						same = false
+					}
+				}
+				if !same {
+					why = append(why, fmt.Sprintf("observed paths %s differ from claimed %s",
+						records.Repr(sortedVals(seen)), records.Repr(sortedVals(claimed))))
+				}
+			}
+		}
+	}
+	return result(stdout, why, "ADMISSIBLE"), nil
+}
+
+func result(stdout io.Writer, why []string, ok string) int {
+	if why == nil {
+		why = []string{}
+	}
+	if len(why) > 0 {
+		verdict(stdout, "REJECT", "reasons", why)
+		return 1
+	}
+	verdict(stdout, ok, "reasons", why)
+	return 0
+}
+
+// splitlines is Python's str.splitlines().
+func splitlines(s string) []string {
+	var out []string
+	start := 0
+	for i := 0; i < len(s); {
+		r, size := utf8.DecodeRuneInString(s[i:])
+		i += size
+		switch r {
+		case '\n', '\r', '\v', '\f', 0x1c, 0x1d, 0x1e, 0x85, 0x2028, 0x2029:
+			out = append(out, s[start:i-size])
+			if r == '\r' && i < len(s) && s[i] == '\n' {
+				i++
+			}
+			start = i
+		}
+	}
+	if start < len(s) {
+		out = append(out, s[start:])
+	}
+	return out
+}
+
+// pyInt is Python's int() on a decoded JSON value.
+func pyInt(v any) (int, error) {
+	switch x := v.(type) {
+	case json.Number:
+		if i, err := x.Int64(); err == nil {
+			return int(i), nil
+		}
+		f, err := x.Float64()
+		if err != nil || math.IsInf(f, 0) || math.IsNaN(f) {
+			return 0, fmt.Errorf("invalid line number %s", x)
+		}
+		return int(f), nil
+	case string:
+		i, err := strconv.Atoi(strings.TrimSpace(x))
+		if err != nil {
+			return 0, fmt.Errorf("invalid literal for int() with base 10: %s", records.Repr(x))
+		}
+		return i, nil
+	case bool:
+		if x {
+			return 1, nil
+		}
+		return 0, nil
+	}
+	return 0, fmt.Errorf("int() argument must be a string or a number, not %s", records.Repr(v))
+}
+
+func anchor(root, path string, stdout, stderr io.Writer) (int, error) {
+	doc, err := ovio.LoadJSON(path)
+	if err != nil {
+		return 0, err
+	}
+	items, ok := ovio.Obj(doc)["findings"].([]any)
+	if !ok || len(items) == 0 {
+		fmt.Fprintln(stderr, `ERROR: expected {"findings": [...]} with at least one finding`)
+		return 2, nil
+	}
+	why := []string{}
+	base := realpath(root)
+	for _, it := range items {
+		f := ovio.Obj(it)
+		id := records.PyStr(f["id"])
+		if !ovio.Truthy(f["locations"]) {
+			why = append(why, id+": no locations to anchor")
+		}
+		for _, l := range ovio.List(f["locations"]) {
+			loc := ovio.Obj(l)
+			rel, quote := ovio.Str(loc["path"]), ovio.Str(loc["quote"])
+			full := realpath(join(base, rel))
+			if fi, err := os.Stat(full); !strings.HasPrefix(full, base+string(os.PathSeparator)) || err != nil || !fi.Mode().IsRegular() {
+				why = append(why, fmt.Sprintf("%s: %s is not a file under the reviewed tree", id, rel))
+				continue
+			}
+			b, err := os.ReadFile(full) // #nosec G304 -- anchor path checked to stay inside the reviewed tree
+			if err != nil {
+				return 0, err
+			}
+			lines := splitlines(strings.ToValidUTF8(string(b), "�"))
+			start, ok := loc["start"]
+			if !ok {
+				start = json.Number("0")
+			}
+			end, ok := loc["end"]
+			if !ok {
+				end = start
+			}
+			s, err := pyInt(start)
+			if err != nil {
+				return 0, err
+			}
+			e, err := pyInt(end)
+			if err != nil {
+				return 0, err
+			}
+			if !(1 <= s && s <= e && e <= len(lines)) {
+				why = append(why, fmt.Sprintf("%s: %s lines %d-%d outside file (%d lines)", id, rel, s, e, len(lines)))
+				continue
+			}
+			q := strings.Join(strings.Fields(quote), " ")
+			w := strings.Join(strings.Fields(strings.Join(lines[s-1:e], " ")), " ")
+			if q == "" || !strings.Contains(w, q) {
+				why = append(why, fmt.Sprintf("%s: quote not found at %s:%d-%d", id, rel, s, e))
+			} else if utf8.RuneCountInString(strings.ReplaceAll(q, " ", "")) < 8 && q != w {
+				why = append(why, fmt.Sprintf("%s: quote at %s:%d is too short to anchor; quote the whole line", id, rel, s))
+			}
+		}
+	}
+	return result(stdout, why, "ANCHORED"), nil
+}