devrites 7.2.8 → 7.3.0

package/engine/internal/lib/packet_integrity.go

@@ -0,0 +1,179 @@
+package lib
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// Binary patches can exceed the candidate's raw-byte bound; stream verification.
+const maxFrozenDiffBytes = 4 * maxCandidateTotalBytes
+
+type frozenDiffBinding struct {
+	name   string
+	digest string
+}
+
+func frozenDiffBindings(raw []byte) ([]frozenDiffBinding, error) {
+	var bindings []frozenDiffBinding
+	for _, line := range strings.Split(string(raw), "\n") {
+		fields := strings.Fields(line)
+		if len(fields) == 0 || fields[0] != "diff" {
+			continue
+		}
+		if len(fields) != 3 || len(fields[1]) != sha256.Size*2 || diffPathRE.FindString(fields[2]) != fields[2] {
+			return nil, errors.New("malformed diff checksum; use diff <SHA256> <path.diff|path.patch>")
+		}
+		if _, err := hex.DecodeString(fields[1]); err != nil {
+			return nil, errors.New("malformed diff SHA256 checksum")
+		}
+		bindings = append(bindings, frozenDiffBinding{name: fields[2], digest: strings.ToLower(fields[1])})
+	}
+	return bindings, nil
+}
+
+func verifyFrozenDiff(name, expected string) error {
+	before, err := os.Lstat(name)
+	if err != nil {
+		return err
+	}
+	if !before.Mode().IsRegular() || before.Size() <= 0 {
+		return errors.New("frozen candidate diff must be a non-empty regular file")
+	}
+	if before.Size() > maxFrozenDiffBytes {
+		return errors.New("frozen candidate diff exceeds 1 GiB limit")
+	}
+	// #nosec G304 -- validated regular artifact, bounded streaming read below
+	file, err := os.Open(name)
+	if err != nil {
+		return err
+	}
+	defer func() { _ = file.Close() }()
+	opened, err := file.Stat()
+	if err != nil {
+		return err
+	}
+	if !opened.Mode().IsRegular() || !os.SameFile(before, opened) || before.Size() != opened.Size() || !before.ModTime().Equal(opened.ModTime()) {
+		return errors.New("frozen candidate diff changed while opening")
+	}
+	digest := sha256.New()
+	count, err := io.Copy(digest, io.LimitReader(file, maxFrozenDiffBytes+1))
+	if err != nil {
+		return err
+	}
+	after, err := file.Stat()
+	if err != nil {
+		return err
+	}
+	current, err := os.Lstat(name)
+	if err != nil {
+		return err
+	}
+	if count != before.Size() || !os.SameFile(opened, current) || after.Size() != count || current.Size() != count || !opened.ModTime().Equal(after.ModTime()) || !opened.ModTime().Equal(current.ModTime()) {
+		return errors.New("frozen candidate diff changed while reading")
+	}
+	if hex.EncodeToString(digest.Sum(nil)) != expected {
+		return errors.New("frozen candidate diff SHA256 mismatch; freeze the intended bytes under a new wave")
+	}
+	return nil
+}
+
+func resolvePacketDiff(root, slug, name string) (string, error) {
+	clean := filepath.Clean(filepath.FromSlash(name))
+	if clean == ".." || strings.HasPrefix(clean, ".."+string(filepath.Separator)) || clean != filepath.FromSlash(name) {
+		return "", fmt.Errorf("unsafe frozen candidate diff path %q", name)
+	}
+	dirs := []string{projectDir(root), featureDir(root, slug)}
+	// Freeze's checksum rows use this workspace-relative namespace, never a product packets/ directory.
+	if strings.HasPrefix(name, "packets/") {
+		dirs = []string{featureDir(root, slug)}
+	}
+	if filepath.IsAbs(name) {
+		parent, err := filepath.EvalSymlinks(filepath.Dir(name))
+		if err != nil {
+			return "", err
+		}
+		dirs = []string{parent}
+		name = filepath.Base(name)
+	}
+	for _, dir := range dirs {
+		info, exists, err := candidatePathInfo(dir, filepath.ToSlash(name))
+		if err != nil {
+			return "", err
+		}
+		if exists {
+			if !info.Mode().IsRegular() {
+				return "", errors.New("frozen candidate diff is not a regular file")
+			}
+			parent, err := filepath.EvalSymlinks(dir)
+			if err != nil {
+				return "", err
+			}
+			return filepath.Join(parent, filepath.FromSlash(name)), nil
+		}
+	}
+	return "", fmt.Errorf("frozen candidate diff %q does not exist", name)
+}
+
+// Caller may already hold the feature lock (dispatch); never acquire it here.
+func lintPacketDiffs(root, slug, packet string, required bool) error {
+	raw, err := readBoundedRegularFile(packet, maxContractBytes)
+	if err != nil {
+		return fmt.Errorf("reviewer packet %s: %w", packet, err)
+	}
+	bindings, err := frozenDiffBindings(raw)
+	if err != nil {
+		return err
+	}
+	bound := make(map[string]string, len(bindings))
+	for _, binding := range bindings {
+		path, err := resolvePacketDiff(root, slug, binding.name)
+		if err != nil {
+			return err
+		}
+		if prior, ok := bound[path]; ok {
+			if prior != binding.digest {
+				return fmt.Errorf("conflicting diff checksums for %s", binding.name)
+			}
+			continue
+		}
+		if err := verifyFrozenDiff(path, binding.digest); err != nil {
+			return fmt.Errorf("%s: %w", binding.name, err)
+		}
+		bound[path] = binding.digest
+	}
+	var names []string
+	for _, line := range strings.Split(string(raw), "\n") {
+		if entry, candidate := strings.CutPrefix(line, "file "); candidate {
+			identity, path, complete := strings.Cut(entry, " ")
+			// Candidate file identities describe product paths, not reviewer inputs.
+			if complete && path != "" {
+				if identity == "absent" {
+					continue
+				}
+				if digest, err := hex.DecodeString(identity); err == nil && len(digest) == sha256.Size {
+					continue
+				}
+			}
+		}
+		names = append(names, diffPathRE.FindAllString(line, -1)...)
+	}
+	if required && len(names) == 0 {
+		return errors.New("a Review or Seal reviewer packet must name the frozen candidate diff and bind its bytes with diff <SHA256> <path.diff|path.patch>")
+	}
+	for _, name := range names {
+		path, err := resolvePacketDiff(root, slug, name)
+		if err != nil {
+			return err
+		}
+		if _, ok := bound[path]; !ok {
+			return fmt.Errorf("unbound frozen candidate diff %s; add diff <SHA256> %s to the packet", name, name)
+		}
+	}
+	return nil
+}

package/engine/internal/lib/perturb.go

@@ -180,7 +180,7 @@ func pathSetIdentity(project string, paths []string) (candidateIdentity, error)
 	if err != nil {
 		return candidateIdentity{}, err
 	}
-	digest, err := hashCandidate(project, rows)
+	digest, err := hashCandidate(project, rows, false)
 	return candidateIdentity{digest: digest, rows: rows}, err
 }
 
@@ -244,7 +244,7 @@ func runPerturbProbe(project string, identity candidateIdentity, gate *acceptanc
 		probe.reason = "candidate copy failed: " + oneLine(err.Error())
 		return probe
 	}
-	if probe.copyStart, err = hashCandidate(base, rows); err != nil || probe.copyStart != identity.digest {
+	if probe.copyStart, err = hashCandidate(base, rows, false); err != nil || probe.copyStart != identity.digest {
 		probe.reason = "the isolated copy does not hash to the candidate digest"
 		return probe
 	}
@@ -267,7 +267,7 @@ func runPerturbProbe(project string, identity candidateIdentity, gate *acceptanc
 		return probe
 	}
 	if err := validateCandidateRows(base, rows); err == nil {
-		probe.copyRestored, _ = hashCandidate(base, rows)
+		probe.copyRestored, _ = hashCandidate(base, rows, false)
 	}
 	if probe.copyRestored != identity.digest {
 		probe.reason = "the reverted copy does not hash to the candidate digest"

package/engine/internal/lib/slicecheck.go

@@ -7,6 +7,7 @@ import (
 	"regexp"
 	"strings"
 
+	"github.com/devrites/devrites/internal/markdowntext"
 	"github.com/devrites/devrites/internal/state"
 )
 
@@ -21,7 +22,7 @@ import (
 //	0  contract holds    2  usage error    3  blocked: problems listed
 
 var (
-	sliceFieldRe     = regexp.MustCompile(`(?m)^([A-Za-z][A-Za-z /_-]*):\s*(.*)$`)
+	sliceFieldRe     = regexp.MustCompile(`(?m)^([A-Za-z][A-Za-z /_-]*):[ \t]*(.*)$`)
 	sliceACRe        = regexp.MustCompile(`\bAC-\d+\b`)
 	pathGlobCharRe   = regexp.MustCompile(`[*?\[\]{}]`)
 	pathTraversalRe  = regexp.MustCompile(`(^|/)\.\.(/|$)`)
@@ -48,6 +49,11 @@ func sliceSizeAdvisory(block string) (int, bool) {
 // sliceFields extracts the single-line `Field: value` pairs of a slice block.
 func sliceFields(block string) map[string]string {
 	fields := map[string]string{}
+	structural, err := markdowntext.Structural([]byte(block))
+	if err != nil {
+		return fields
+	}
+	block = string(structural)
 	for _, m := range sliceFieldRe.FindAllStringSubmatch(block, -1) {
 		key := strings.ToLower(strings.TrimSpace(m[1]))
 		if _, seen := fields[key]; !seen {

package/engine/internal/lib/taskgraph.go

@@ -201,34 +201,10 @@ func PrecheckSkips(root, slug, slice string, gateIDs []string) (map[string]strin
 // manifest and lockfile when it declares external dependencies. root is the
 // .devrites directory.
 func planReady(root, slug string) ([]parallel.SlicePaths, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "tasks.md")
-	if err != nil {
-		return nil, err
-	}
-	graph := ParseTaskGraph(raw)
-	if len(graph.Problems) > 0 {
-		return nil, fmt.Errorf("tasks.md: %s", strings.Join(graph.Problems, "; "))
-	}
-	built, err := builtSlices(root, slug)
-	if err != nil {
-		return nil, err
-	}
-	isBuilt := func(id string) bool { return built[sliceNumber(id)] }
-	paths, _ := sliceWritePaths(raw, graph)
-	project := filepath.Dir(root)
-	var ready []parallel.SlicePaths
-	for _, s := range graph.Slices {
-		if isBuilt(s.ID) || slices.ContainsFunc(s.Dependencies, func(dep string) bool { return !isBuilt(dep) }) {
-			continue
-		}
-		if len(paths[s.ID]) == 0 {
-			return nil, fmt.Errorf("%s has no Writer allowlist or Files likely touched", s.ID)
-		}
-		block, _ := state.ExtractTaskSlice(raw, s.ID)
-		external, _ := fieldValue(sliceFields(block), "external dependencies")
-		ready = append(ready, parallel.SlicePaths{ID: s.ID, Paths: withManifests(project, paths[s.ID], external)})
-	}
-	return ready, nil
+	ready, _, err := workspacePlanReady(root, slug, false, func(name string) ([]byte, error) {
+		return readWorkspaceArtifact(root, slug, name)
+	})
+	return ready, err
 }
 
 // builtWordRe marks a checked state.md item as a built checkpoint.
@@ -240,7 +216,13 @@ var builtWordRe = regexp.MustCompile(`(?i)\bbuilt\b`)
 // was checkpointed and whose section has a `Checkpoint: <sha>` line — a missed
 // checkbox must not keep dependents out of the ready set.
 func builtSlices(root, slug string) (map[string]bool, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "state.md")
+	return builtSlicesFrom(func(name string) ([]byte, error) {
+		return readWorkspaceArtifact(root, slug, name)
+	})
+}
+
+func builtSlicesFrom(read func(string) ([]byte, error)) (map[string]bool, error) {
+	raw, err := read("state.md")
 	if err != nil {
 		return nil, err
 	}
@@ -257,7 +239,7 @@ func builtSlices(root, slug string) (map[string]bool, error) {
 			built[strings.TrimLeft(m[1], "0")] = true
 		}
 	}
-	extra, err := evidenceBuilt(root, slug)
+	extra, err := evidenceBuiltFrom(read)
 	if err != nil {
 		return nil, err
 	}
@@ -273,9 +255,9 @@ var (
 	checkpointSHARe       = regexp.MustCompile(`(?m)^[ \t]*Checkpoint: [0-9a-fA-F]{7,40}\b`)
 )
 
-// evidenceBuilt reads evidence.md checkpoint sections. A missing file is none.
-func evidenceBuilt(root, slug string) (map[string]bool, error) {
-	raw, err := readWorkspaceArtifact(root, slug, "evidence.md")
+// evidenceBuiltFrom reads evidence.md checkpoint sections. A missing file is none.
+func evidenceBuiltFrom(read func(string) ([]byte, error)) (map[string]bool, error) {
+	raw, err := read("evidence.md")
 	if err != nil {
 		if errors.Is(err, os.ErrNotExist) {
 			return map[string]bool{}, nil
@@ -421,9 +403,11 @@ func planBatch(root, slug string, capN int) (eligible, batch []string, err error
 		return nil, nil, err
 	}
 	ids := func(in []parallel.SlicePaths) []string {
-		out := make([]string, len(in))
-		for i, s := range in {
-			out[i] = s.ID
+		var out []string
+		for _, s := range in {
+			if s.Workspace == "" || s.Workspace == slug {
+				out = append(out, s.ID)
+			}
 		}
 		return out
 	}

package/engine/internal/lib/triggers.go

@@ -1,9 +1,8 @@
 package lib
 
 import (
-	"io"
+	"errors"
 	"os"
-	"path/filepath"
 	"regexp"
 	"slices"
 	"sort"
@@ -82,8 +81,7 @@ var triggerSignals = []struct {
 
 // suggestTriggers returns declared, unselected trigger names whose firing facts
 // hold in this workspace. Sorted for stable output.
-func suggestTriggers(manifest loadsManifest, root, featureDir string, opts contextOpts) []string {
-	facts := gatherTriggerFacts(root, featureDir, opts.role)
+func suggestTriggers(manifest loadsManifest, opts contextOpts, facts triggerFacts) []string {
 	var suggested []string
 	for name := range manifest.Triggers {
 		if slices.Contains(opts.triggers, name) {
@@ -101,45 +99,46 @@ func suggestTriggers(manifest loadsManifest, root, featureDir string, opts conte
 	return suggested
 }
 
-func gatherTriggerFacts(root, featureDir, role string) triggerFacts {
+func gatherTriggerFacts(root, role string, sources *contextSources) (triggerFacts, error) {
 	facts := triggerFacts{role: roleBase(role)}
 	if root != "" {
-		afkPath := filepath.Join(root, "AFK")
-		if info, err := os.Stat(afkPath); err == nil && info.Mode().IsRegular() {
-			facts.afk = true
-			if data, err := os.ReadFile(afkPath); err == nil { // #nosec G304 -- .devrites/AFK sentinel
-				facts.afkParallel = afkAllowsParallel(string(data))
-			}
+		sentinels := contextSources{dir: root}
+		data, err := sentinels.read("AFK")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
-		if info, err := os.Stat(filepath.Join(root, "principles.md")); err == nil && info.Mode().IsRegular() {
-			facts.principles = true
+		facts.afk = err == nil
+		facts.afkParallel = afkAllowsParallel(string(data))
+		_, err = sentinels.read("principles.md")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
+		facts.principles = err == nil
 	}
-	if featureDir != "" {
-		if info, err := os.Stat(filepath.Join(featureDir, "ai-spec.md")); err == nil && info.Mode().IsRegular() {
-			facts.aiSpec = true
+	if sources.dir != "" {
+		_, err := sources.read("ai-spec.md")
+		if err != nil && !errors.Is(err, os.ErrNotExist) {
+			return facts, err
 		}
+		facts.aiSpec = err == nil
 		var corpus strings.Builder
 		for _, name := range triggerEvidenceFiles {
-			path := filepath.Join(featureDir, name)
-			info, err := os.Stat(path)
-			if err != nil || !info.Mode().IsRegular() {
-				continue
-			}
-			f, err := os.Open(path) // #nosec G304 -- workspace artifact; read is capped below
+			data, err := sources.read(name)
 			if err != nil {
-				continue
+				if errors.Is(err, os.ErrNotExist) {
+					continue
+				}
+				return facts, err
 			}
-			data, err := io.ReadAll(io.LimitReader(f, triggerEvidenceFileCap))
-			_ = f.Close()
-			if err == nil {
-				corpus.Write(data)
-				corpus.WriteByte('\n')
+			if len(data) > triggerEvidenceFileCap {
+				data = data[:triggerEvidenceFileCap]
 			}
+			corpus.Write(data)
+			corpus.WriteByte('\n')
 		}
 		facts.corpus = strings.ToLower(corpus.String())
 	}
-	return facts
+	return facts, nil
 }
 
 var afkParallelRe = regexp.MustCompile(`(?m)^\s*max_parallel\s*:\s*([0-9]+)\s*$`)