jev-agent-tools 0.1.4 → 0.3.0

package/dist/adapters/ask-files.js

@@ -0,0 +1,198 @@
+import { readdir, stat } from "node:fs/promises";
+import { dirname, isAbsolute, matchesGlob, relative, resolve } from "node:path";
+import { CONCURRENCY, MAX_FILES, TIMEOUT_MS } from "../constants.js";
+import { checkFileAdmission, collectFiles, resolveInsideRepo, } from "./files.js";
+const excludedDirectories = new Set(["node_modules", ".git", "dist", "build"]);
+const lockfile = /(?:^|\/)(?:package-lock\.json|npm-shrinkwrap\.json|yarn\.lock|pnpm-lock\.yaml|bun\.lockb?|Cargo\.lock|Gemfile\.lock|poetry\.lock|uv\.lock|composer\.lock|Pipfile\.lock|go\.sum)$/;
+export async function collectAskFiles(cwd, paths, signal, exec) {
+    if (!paths.length)
+        return {
+            ok: false,
+            error: "Provide at least one path, directory or glob.",
+        };
+    for (const path of paths) {
+        if (/^[a-z][a-z0-9+.-]*:\/\//i.test(path))
+            return {
+                ok: false,
+                error: `Internal URLs are not files; use read for ${path}.`,
+            };
+        if (isAbsolute(path) || path.split(/[\\/]/).includes(".."))
+            return {
+                ok: false,
+                error: `Path must remain inside the repository: ${path}.`,
+            };
+    }
+    const skipped = new Set();
+    const secret = new Set();
+    const candidates = new Set();
+    try {
+        let inventory;
+        if (exec) {
+            const result = await exec("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], { cwd, timeout: TIMEOUT_MS, signal });
+            if (result.code === 0)
+                inventory = new Set(result.stdout.split("\0").filter(Boolean));
+        }
+        const add = async (path) => {
+            const admission = await checkFileAdmission(cwd, path, exec, signal, inventory);
+            if (!admission.ok) {
+                const entry = `${path} (${admission.error})`;
+                skipped.add(entry);
+                if (admission.cause === "secret_pattern")
+                    secret.add(entry);
+                return;
+            }
+            if (path.split("/").some((part) => excludedDirectories.has(part)))
+                skipped.add(`${path} (build output or dependencies)`);
+            else if (lockfile.test(path))
+                skipped.add(`${path} (lockfile)`);
+            else
+                candidates.add(path);
+        };
+        const walk = async (directory, pattern) => {
+            signal?.throwIfAborted();
+            const safe = await resolveInsideRepo(cwd, directory);
+            if (!safe.ok) {
+                skipped.add(`${directory} (${safe.error})`);
+                return;
+            }
+            const entries = await readdir(safe.abs, { withFileTypes: true });
+            await Promise.all(entries.map(async (entry) => {
+                const path = relative(cwd, resolve(cwd, directory, entry.name)).replaceAll("\\", "/");
+                if (entry.isSymbolicLink()) {
+                    skipped.add(`${path} (symbolic link)`);
+                    return;
+                }
+                if (entry.isDirectory()) {
+                    if (excludedDirectories.has(entry.name)) {
+                        skipped.add(`${path}/ (build output or dependencies)`);
+                        return;
+                    }
+                    await walk(path, pattern);
+                    return;
+                }
+                if (entry.isFile() &&
+                    (!pattern ||
+                        matchesGlob(path
+                            .split("/")
+                            .map((part) => part.startsWith(".") ? `__dot__${part.slice(1)}` : part)
+                            .join("/"), pattern
+                            .split("/")
+                            .map((part) => part.startsWith(".") ? `__dot__${part.slice(1)}` : part)
+                            .join("/"))))
+                    await add(path);
+            }));
+        };
+        for (const input of paths) {
+            signal?.throwIfAborted();
+            const safe = await resolveInsideRepo(cwd, input);
+            const info = safe.ok
+                ? await stat(safe.abs).catch(() => undefined)
+                : undefined;
+            if (info && safe.ok) {
+                if (info.isFile()) {
+                    const admission = await checkFileAdmission(cwd, safe.rel, exec, signal, inventory);
+                    if (!admission.ok)
+                        return admission;
+                }
+                if (input.split("/").some((part) => excludedDirectories.has(part))) {
+                    skipped.add(`${input} (build output or dependencies)`);
+                    continue;
+                }
+                if (info.isDirectory())
+                    await walk(safe.rel || ".");
+                else if (info.isFile()) {
+                    const admission = await checkFileAdmission(cwd, safe.rel, exec, signal, inventory);
+                    if (!admission.ok)
+                        return admission;
+                    await add(safe.rel);
+                }
+                else
+                    skipped.add(`${input} (not a regular file)`);
+            }
+            else {
+                const parts = input.split("/");
+                const wildcard = parts.findIndex((part) => /[?*[\]{}]/.test(part));
+                if (wildcard < 0) {
+                    if (!safe.ok && !safe.error.includes("ENOENT"))
+                        return safe;
+                    skipped.add(`${input} (missing)`);
+                    continue;
+                }
+                const prefix = parts.slice(0, wildcard).join("/") || ".";
+                const prefixLocation = await resolveInsideRepo(cwd, prefix);
+                if (!prefixLocation.ok)
+                    return prefixLocation;
+                const pattern = input.replace(/^\.\//, "");
+                if (inventory) {
+                    for (const path of inventory) {
+                        const dotPath = path
+                            .split("/")
+                            .map((part) => part.startsWith(".") ? `__dot__${part.slice(1)}` : part)
+                            .join("/");
+                        const dotPattern = pattern
+                            .split("/")
+                            .map((part) => part.startsWith(".") ? `__dot__${part.slice(1)}` : part)
+                            .join("/");
+                        if (matchesGlob(dotPath, dotPattern))
+                            await add(path);
+                    }
+                }
+                else
+                    await walk(prefix, pattern);
+            }
+        }
+        const files = [];
+        const sorted = [...candidates].sort();
+        const contributions = new Map();
+        for (const path of sorted) {
+            const directory = dirname(path);
+            contributions.set(directory, (contributions.get(directory) ?? 0) + 1);
+        }
+        let accepted = 0;
+        for (let i = 0; i < sorted.length; i += CONCURRENCY) {
+            const rows = await Promise.all(sorted.slice(i, i + CONCURRENCY).map(async (path) => {
+                const result = await collectFiles(cwd, [path], signal, {
+                    exec,
+                    inventory,
+                });
+                if (!result.ok) {
+                    skipped.add(`${path} (${result.error})`);
+                    return;
+                }
+                const identity = result.identities[0];
+                if (!identity)
+                    return;
+                if (identity.content.includes("\0") ||
+                    identity.readSha256 !== identity.insertedSha256) {
+                    skipped.add(`${path} (binary or invalid UTF-8)`);
+                    return;
+                }
+                return { path, content: identity.content, identity };
+            }));
+            for (const file of rows)
+                if (file) {
+                    accepted++;
+                    if (files.length < MAX_FILES)
+                        files.push(file);
+                }
+            if (accepted > MAX_FILES) {
+                const largest = [...contributions]
+                    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))
+                    .slice(0, 5);
+                return {
+                    ok: false,
+                    error: `At least ${accepted} files exceeds MAX_FILES=${MAX_FILES}; narrow paths. Largest expanded directories: ${largest.map(([path, count]) => `${path}: ${count}`).join(", ")}.`,
+                };
+            }
+        }
+        return {
+            ok: true,
+            files,
+            skipped: [...skipped].sort(),
+            secret: [...secret].sort(),
+        };
+    }
+    catch (error) {
+        return { ok: false, error: `Cannot expand paths: ${String(error)}` };
+    }
+}

package/dist/adapters/ask-proof.js

@@ -0,0 +1,200 @@
+import { isAbsolute, relative, resolve } from "node:path";
+import { STATE_MAX_CHARS, TIMEOUT_MS } from "../constants.js";
+import { checkFileAdmission, collectFiles } from "./files.js";
+import { verifyGitUtf8 } from "./utf8.js";
+export async function collectAskRepository(exec, cwd, base, signal) {
+    try {
+        const options = { cwd, timeout: TIMEOUT_MS, signal };
+        const location = await exec("git", ["rev-parse", "--show-toplevel"], options);
+        if (location.code !== 0 || location.killed)
+            return {
+                ok: false,
+                error: location.stderr || "Cannot resolve repository root.",
+            };
+        const root = location.stdout.trimEnd();
+        const gitOptions = { ...options, cwd: root };
+        const [listed, ignored, revision] = await Promise.all([
+            exec("git", ["ls-files", "--cached", "--others", "--exclude-standard", "-z"], gitOptions),
+            exec("git", ["ls-files", "--cached", "--ignored", "--exclude-standard", "-z"], gitOptions),
+            base === undefined
+                ? undefined
+                : exec("git", ["rev-parse", "--verify", "--end-of-options", `${base}^{commit}`], gitOptions),
+        ]);
+        if (listed.code !== 0 || listed.killed)
+            return {
+                ok: false,
+                error: listed.stderr || "Cannot list repository paths.",
+            };
+        if (revision && (revision.code !== 0 || revision.killed))
+            return { ok: false, error: revision.stderr || "Cannot resolve base." };
+        if (ignored.code !== 0 || ignored.killed)
+            return {
+                ok: false,
+                error: ignored.stderr || "Cannot list ignored repository paths.",
+            };
+        const known = new Set(listed.stdout.split("\0").filter(Boolean));
+        for (const path of ignored.stdout.split("\0"))
+            known.delete(path);
+        const baseSha = revision?.stdout.trim();
+        const basePaths = baseSha
+            ? await exec("git", ["ls-tree", "-r", "-z", baseSha], gitOptions)
+            : undefined;
+        if (basePaths && (basePaths.code !== 0 || basePaths.killed))
+            return {
+                ok: false,
+                error: basePaths.stderr || "Cannot list base paths.",
+            };
+        const beforeEntries = new Map((basePaths?.stdout.split("\0").filter(Boolean) ?? []).map((entry) => [
+            entry.slice(entry.indexOf("\t") + 1),
+            entry,
+        ]));
+        const beforeKnown = new Set(beforeEntries.keys());
+        const reads = new Map();
+        const beforeReads = new Map();
+        return {
+            ok: true,
+            root,
+            known,
+            beforeKnown,
+            baseSha,
+            read(path) {
+                let pending = reads.get(path);
+                if (!pending) {
+                    pending = (async () => {
+                        if (!known.has(path))
+                            return {
+                                ok: false,
+                                error: `${path}: not in repository inventory`,
+                            };
+                        const loaded = await collectFiles(root, [path], signal, {
+                            allowEmpty: true,
+                            exec,
+                            inventory: known,
+                        });
+                        return loaded.ok
+                            ? { ok: true, path, text: loaded.files[path] ?? "" }
+                            : loaded;
+                    })();
+                    reads.set(path, pending);
+                }
+                return pending;
+            },
+            readBefore(path) {
+                let pending = beforeReads.get(path);
+                if (!pending) {
+                    pending = (async () => {
+                        try {
+                            if (isAbsolute(path) || path.split(/[\\/]/).includes(".."))
+                                return {
+                                    ok: false,
+                                    cause: "forbidden_path",
+                                    error: `Path must remain inside the repository: ${path}.`,
+                                };
+                            const admission = await checkFileAdmission(root, path);
+                            if (!admission.ok)
+                                return admission;
+                            const ignoredPath = await exec("git", ["check-ignore", "--no-index", "--", path], gitOptions);
+                            if (ignoredPath.killed || ![0, 1].includes(ignoredPath.code))
+                                return {
+                                    ok: false,
+                                    cause: "git_failure",
+                                    error: `${path}: historical admission unavailable`,
+                                };
+                            if (ignoredPath.code === 0)
+                                return {
+                                    ok: false,
+                                    cause: "ignored_path",
+                                    error: `${path}: gitignored: not sent to Jev`,
+                                };
+                            if (!baseSha)
+                                return {
+                                    ok: false,
+                                    error: `${path}: comparison base unavailable`,
+                                };
+                            if (!beforeKnown.has(path))
+                                return known.has(path)
+                                    ? { ok: true, text: null }
+                                    : {
+                                        ok: false,
+                                        error: `${path}: not in current or comparison base inventory`,
+                                    };
+                            const entry = beforeEntries.get(path) ?? "";
+                            if (!/^(?:100644|100755) blob /.test(entry))
+                                return {
+                                    ok: false,
+                                    cause: entry.startsWith("120000 ")
+                                        ? "symlink"
+                                        : "file_unavailable",
+                                    error: `${path}: not a regular file at comparison base: not sent to Jev`,
+                                };
+                            const object = await exec("git", [
+                                "rev-parse",
+                                "--verify",
+                                "--end-of-options",
+                                `${baseSha}:${path}`,
+                            ], gitOptions);
+                            if (object.code !== 0 || object.killed)
+                                return {
+                                    ok: false,
+                                    error: `before evidence unavailable for ${path}`,
+                                };
+                            const id = object.stdout.trim();
+                            const sizeResult = await exec("git", ["cat-file", "-s", id], gitOptions);
+                            const size = Number(sizeResult.stdout);
+                            if (sizeResult.code !== 0 ||
+                                sizeResult.killed ||
+                                !Number.isFinite(size) ||
+                                size > STATE_MAX_CHARS * 4)
+                                return {
+                                    ok: false,
+                                    error: `before evidence unavailable for ${path}`,
+                                };
+                            const loaded = await exec("git", [
+                                "show",
+                                "--no-ext-diff",
+                                "--no-textconv",
+                                "--end-of-options",
+                                id,
+                            ], gitOptions);
+                            if (loaded.code !== 0 ||
+                                loaded.killed ||
+                                loaded.stdout.length > STATE_MAX_CHARS)
+                                return {
+                                    ok: false,
+                                    error: `before evidence unavailable for ${path}`,
+                                };
+                            if (loaded.stdout.includes("\0"))
+                                return {
+                                    ok: false,
+                                    cause: "binary_or_non_utf8",
+                                    error: `${path}: binary content: not sent to Jev`,
+                                };
+                            const decoded = verifyGitUtf8(loaded.stdout, id, size);
+                            return decoded.ok
+                                ? decoded
+                                : {
+                                    ok: false,
+                                    cause: "binary_or_non_utf8",
+                                    error: `${path}: ${decoded.error}`,
+                                };
+                        }
+                        catch (error) {
+                            return { ok: false, error: String(error) };
+                        }
+                    })();
+                    beforeReads.set(path, pending);
+                }
+                return pending;
+            },
+        };
+    }
+    catch (error) {
+        return {
+            ok: false,
+            error: `Cannot collect repository proof: ${String(error)}`,
+        };
+    }
+}
+export function repositoryPath(root, cwd, path) {
+    return relative(root, resolve(cwd, path)).split("\\").join("/");
+}