forge-workflow 0.1.0-beta.4 → 0.1.0-beta.6

package/lib/audit-evidence.js

@@ -1,6 +1,16 @@
-const { execFileSync } = require('node:child_process');
-const fs = require('node:fs');
 const path = require('node:path');
+const { randomUUID } = require('node:crypto');
+const { appendCappedJsonlRecord } = require('./capped-jsonl-log');
+
+/**
+ * Subagent evidence lands in the local append-only log D25 specifies, now that
+ * the Beads audit CLI is retired along with the rest of the Beads runtime. The
+ * log is the only copy of an entry, so a record carries the prompt and response
+ * the Beads entry used to hold; it is capped like the protected-state log so a
+ * long dev run cannot grow it unbounded.
+ */
+const AUDIT_EVIDENCE_LOG = '.forge/log.jsonl';
+const AUDIT_EVIDENCE_MAX_RECORDS = 500;
 
 const VERDICT_LABELS = {
 	PASS: 'good',
@@ -40,15 +50,6 @@ const SECRET_TEXT_PATTERNS = [
 	/\bsk-[A-Za-z0-9_-]{8,}\b/g,
 ];
 
-function defaultRunCommand(command, args, options = {}) {
-	return execFileSync(command, args, {
-		cwd: options.cwd || process.cwd(),
-		encoding: 'utf8',
-		input: options.input,
-		timeout: options.timeout || 120000,
-	});
-}
-
 function redactString(value) {
 	return SECRET_TEXT_PATTERNS.reduce(
 		(current, entry) => {
@@ -132,96 +133,62 @@ function buildSubagentAuditPayload(event) {
 	};
 }
 
-function parseRecordId(output, { requireJson = false } = {}) {
-	if (!output) return null;
+/**
+ * Best-effort: a failed append is reported back to the caller, never thrown, so
+ * losing the evidence can never fail the command that produced it.
+ */
+function appendAuditRecord(record, options) {
+	const logPath = path.resolve(options.cwd || process.cwd(), AUDIT_EVIDENCE_LOG);
+	const appendRecord = options.appendRecord || appendCappedJsonlRecord;
+
 	try {
-		const parsed = JSON.parse(output);
-		return typeof parsed.id === 'string' ? parsed.id : null;
-	} catch (_error) {
-		if (requireJson) return null;
-		const match = /\bint-[A-Za-z0-9_-]+\b/.exec(String(output));
-		return match ? match[0] : null;
+		appendRecord(logPath, record, options.maxRecords || AUDIT_EVIDENCE_MAX_RECORDS);
+		return { success: true, logPath };
+	} catch (error) {
+		return { success: false, logPath, error: error.message };
 	}
 }
 
-function hasAuditMetaJsonSupport(runCommand = defaultRunCommand, options = {}) {
-	const output = runCommand('bd', ['audit', 'record', '--help'], options);
-	return String(output).includes('--meta-json');
-}
-
-function writeFallbackMetadata(payload, entryId, options) {
-	if (!entryId || !payload.metadata || Object.keys(payload.metadata).length === 0) {
-		return null;
-	}
-
-	const cwd = options.cwd || process.cwd();
-	const fsImpl = options.fs || fs;
-	const forgeDir = path.join(cwd, '.forge').replace(/\\/g, '/');
-	const logPath = path.join(forgeDir, 'log.jsonl').replace(/\\/g, '/');
-	const line = {
+function buildAuditEvidenceRecord(payload, entryId, recordedAt) {
+	return {
 		kind: 'forge.auditEvidence',
-		sourceOfTruth: 'beads',
-		beadsEntryId: entryId,
+		sourceOfTruth: 'forge_log',
+		entryId,
+		recordedAt,
 		command: redact(payload.command),
+		issueId: redact(payload.issueId),
 		role: redact(payload.role),
 		phase: redact(payload.phase),
 		taskId: redact(payload.taskId),
 		taskTitle: redact(payload.taskTitle),
-		metadata: redact(payload.metadata),
+		model: redact(payload.model),
+		verdict: payload.verdict,
+		// Already redacted by buildSubagentAuditPayload.
+		prompt: payload.prompt,
+		response: payload.response,
+		metadata: payload.metadata,
 	};
-
-	try {
-		fsImpl.mkdirSync(forgeDir, { recursive: true });
-		fsImpl.appendFileSync(logPath, `${JSON.stringify(line)}\n`);
-		return { path: logPath, line };
-	} catch (error) {
-		return { path: logPath, line, skipped: true, error: error.message };
-	}
 }
 
 function recordSubagentAuditEvent(event, options = {}) {
 	const payload = buildSubagentAuditPayload(event);
-	const runCommand = options.runCommand || defaultRunCommand;
-	const metaJsonSupported =
-		typeof options.metaJsonSupported === 'boolean'
-			? options.metaJsonSupported
-			: hasAuditMetaJsonSupport(runCommand, { cwd: options.cwd || process.cwd() });
-	const args = [
-		'audit',
-		'record',
-		'--json',
-		'--kind',
-		'llm_call',
-	];
-
-	if (payload.issueId) {
-		args.push('--issue-id', payload.issueId);
-	}
-
-	args.push(
-		'--model',
-		payload.model,
-		'--prompt',
-		payload.prompt,
-		'--response',
-		payload.response,
+	const entryId = (options.newId || randomUUID)();
+	const record = buildAuditEvidenceRecord(
+		payload,
+		entryId,
+		options.now || new Date().toISOString(),
 	);
+	const written = appendAuditRecord(record, options);
 
-	if (metaJsonSupported && Object.keys(payload.metadata).length > 0) {
-		args.push('--meta-json', JSON.stringify(payload.metadata));
-	}
-
-	const output = runCommand('bd', args, { cwd: options.cwd || process.cwd() });
-	const entryId = parseRecordId(output, { requireJson: true });
-	const fallback = metaJsonSupported ? null : writeFallbackMetadata(payload, entryId, options);
-
-	return {
-		success: Boolean(entryId),
-		entryId,
-		output,
+	const result = {
+		success: written.success,
+		entryId: written.success ? entryId : null,
+		record,
 		payload,
-		fallback,
+		logPath: written.logPath,
 	};
+	if (!written.success) result.error = written.error;
+	return result;
 }
 
 function labelSubagentAuditEvent(entryId, event, options = {}) {
@@ -233,36 +200,29 @@ function labelSubagentAuditEvent(entryId, event, options = {}) {
 		return { skipped: true };
 	}
 
-	const runCommand = options.runCommand || defaultRunCommand;
-	const reason = `${role} verdict: ${verdict}`;
-	let output;
-	try {
-		output = runCommand('bd', [
-			'audit',
-			'label',
-			entryId,
-			'--json',
-			'--label',
-			label,
-			'--reason',
-			reason,
-		], { cwd: options.cwd || process.cwd() });
-	} catch (error) {
-		return {
-			success: false,
-			label,
-			error: error.message,
-		};
-	}
-
-	const labeledEntryId = parseRecordId(output, { requireJson: true });
+	// A label is its own record rather than a rewrite of the recorded entry: the
+	// log is append-only, so a verdict is read by joining on entryId.
+	const record = {
+		kind: 'forge.auditEvidenceLabel',
+		sourceOfTruth: 'forge_log',
+		entryId,
+		recordedAt: options.now || new Date().toISOString(),
+		role,
+		verdict,
+		label,
+		reason: `${role} verdict: ${verdict}`,
+	};
+	const written = appendAuditRecord(record, options);
 
-	return {
-		success: labeledEntryId === entryId,
+	const result = {
+		success: written.success,
 		label,
-		entryId: labeledEntryId,
-		output,
+		entryId: written.success ? entryId : null,
+		record,
+		logPath: written.logPath,
 	};
+	if (!written.success) result.error = written.error;
+	return result;
 }
 
 function recordAndLabelSubagentAuditEvent(event, options = {}) {
@@ -272,11 +232,12 @@ function recordAndLabelSubagentAuditEvent(event, options = {}) {
 }
 
 module.exports = {
+	AUDIT_EVIDENCE_LOG,
+	AUDIT_EVIDENCE_MAX_RECORDS,
 	VERDICT_LABELS,
 	buildSubagentAuditPayload,
 	recordSubagentAuditEvent,
 	labelSubagentAuditEvent,
 	recordAndLabelSubagentAuditEvent,
-	hasAuditMetaJsonSupport,
 	redact,
 };

package/lib/base-remote.js

@@ -0,0 +1,138 @@
+'use strict';
+
+const { execFileSync } = require('node:child_process');
+
+const BASE_REMOTE_CANDIDATES = ['upstream', 'origin'];
+const DEFAULT_BRANCH_CANDIDATES = ['main', 'master'];
+const GIT_PROBE_TIMEOUT_MS = 120000;
+
+/**
+ * Quiet git probe options. `stdio: 'pipe'` keeps failed probes from leaking to
+ * the terminal — these are speculative queries, not user-facing commands.
+ *
+ * @param {string} cwd - Working directory for the probe.
+ * @returns {object} execFileSync options.
+ */
+function getQuietProbeOptions(cwd) {
+	return { encoding: 'utf8', cwd, timeout: GIT_PROBE_TIMEOUT_MS, stdio: 'pipe' };
+}
+
+/**
+ * Resolve `refs/remotes/<remote>/HEAD` to the ref it points at, verifying the
+ * target actually exists.
+ *
+ * @param {Function} [exec] - Injected execFileSync.
+ * @param {string} [cwd] - Repository directory.
+ * @param {string} [remoteName] - Remote to probe.
+ * @returns {string|null} Fully-qualified ref, or null.
+ */
+function resolveRemoteHeadTarget(exec = execFileSync, cwd = process.cwd(), remoteName = undefined) {
+	if (!remoteName) {
+		return null;
+	}
+	try {
+		const symbolicRef = exec('git', ['symbolic-ref', `refs/remotes/${remoteName}/HEAD`], getQuietProbeOptions(cwd)).trim();
+		if (!symbolicRef) {
+			return null;
+		}
+		exec('git', ['rev-parse', '--verify', symbolicRef], getQuietProbeOptions(cwd));
+		return symbolicRef;
+	} catch (_error) { // NOSONAR S2486 - intentional: missing ref is the expected probe failure
+		void _error;
+		return null;
+	}
+}
+
+/**
+ * True when the remote has fetched tracking refs we can treat as a base:
+ * a recorded HEAD, or one of the conventional default branches.
+ *
+ * @param {Function} [exec] - Injected execFileSync.
+ * @param {string} [cwd] - Repository directory.
+ * @param {string} [remoteName] - Remote to probe.
+ * @returns {boolean} Whether a usable tracking base exists.
+ */
+function remoteHasTrackingBase(exec = execFileSync, cwd = process.cwd(), remoteName = undefined) {
+	if (!remoteName) {
+		return false;
+	}
+	if (resolveRemoteHeadTarget(exec, cwd, remoteName)) {
+		return true;
+	}
+
+	for (const candidate of DEFAULT_BRANCH_CANDIDATES) {
+		try {
+			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietProbeOptions(cwd));
+			return true;
+		} catch (_error) { // NOSONAR S2486 - intentional: speculative probe, try next candidate
+			void _error;
+			// Probe next candidate.
+		}
+	}
+
+	return false;
+}
+
+/**
+ * Resolve the remote that owns the integration base. `upstream` wins over
+ * `origin` so a fork-style checkout resolves the official repository rather
+ * than the contributor's fork.
+ *
+ * @param {Function} [exec] - Injected execFileSync.
+ * @param {string} [cwd] - Repository directory.
+ * @returns {string} Remote name ('origin' when nothing else qualifies).
+ */
+function resolveBaseRemote(exec = execFileSync, cwd = process.cwd()) {
+	for (const candidate of BASE_REMOTE_CANDIDATES) {
+		try {
+			exec('git', ['remote', 'get-url', candidate], getQuietProbeOptions(cwd));
+			if (remoteHasTrackingBase(exec, cwd, candidate)) {
+				return candidate;
+			}
+		} catch (_error) { // NOSONAR S2486 - intentional: speculative probe, try next candidate
+			void _error;
+			// Probe next candidate.
+		}
+	}
+
+	return 'origin';
+}
+
+/**
+ * Resolve the base remote's default branch name.
+ *
+ * @param {Function} [exec] - Injected execFileSync.
+ * @param {string} [cwd] - Repository directory.
+ * @param {string} [remoteName] - Remote to probe; defaults to the base remote.
+ * @returns {string} Branch name ('master' when nothing else resolves).
+ */
+function resolveBaseBranch(exec = execFileSync, cwd = process.cwd(), remoteName = resolveBaseRemote(exec, cwd)) {
+	const symbolicRef = resolveRemoteHeadTarget(exec, cwd, remoteName);
+	if (symbolicRef) {
+		const match = new RegExp(`^refs/remotes/${remoteName}/(.+)$`).exec(symbolicRef);
+		if (match?.[1]) {
+			return match[1];
+		}
+	}
+
+	for (const candidate of DEFAULT_BRANCH_CANDIDATES) {
+		try {
+			exec('git', ['rev-parse', '--verify', `refs/remotes/${remoteName}/${candidate}`], getQuietProbeOptions(cwd));
+			return candidate;
+		} catch (_error) { // NOSONAR S2486 - intentional: speculative probe, try next candidate
+			void _error;
+			// Probe next candidate.
+		}
+	}
+
+	return 'master';
+}
+
+module.exports = {
+	BASE_REMOTE_CANDIDATES,
+	DEFAULT_BRANCH_CANDIDATES,
+	resolveRemoteHeadTarget,
+	remoteHasTrackingBase,
+	resolveBaseRemote,
+	resolveBaseBranch,
+};