jorgex-stack 1.4.0 → 1.6.0

package/dist/chunk-IO2FFZOH.js

@@ -0,0 +1,496 @@
+#!/usr/bin/env node
+
+// src/lib/paths.ts
+import os from "os";
+import path from "path";
+import { existsSync } from "fs";
+import { fileURLToPath } from "url";
+var HOME = os.homedir();
+function stackRoot() {
+  let dir = path.dirname(fileURLToPath(import.meta.url));
+  for (let i = 0; i < 6; i++) {
+    const candidate = path.join(dir, "stack");
+    if (existsSync(path.join(candidate, "system-prompt", "AGENTS.md"))) return candidate;
+    dir = path.dirname(dir);
+  }
+  throw new Error("No se encontr\xF3 stack/ relativa al CLI \u2014 instalaci\xF3n rota.");
+}
+function dataDir() {
+  return path.join(HOME, ".jorgex-stack");
+}
+function samePath(a, b) {
+  const resolvedA = path.resolve(a);
+  const resolvedB = path.resolve(b);
+  if (process.platform === "win32") return resolvedA.toLowerCase() === resolvedB.toLowerCase();
+  return resolvedA === resolvedB;
+}
+
+// src/lib/quality-policy.ts
+var QUALITY_PROFILES = ["routine", "elevated", "high", "release"];
+function hasText(value) {
+  return typeof value === "string" && value.trim() !== "";
+}
+function isQualityProfile(value) {
+  return typeof value === "string" && QUALITY_PROFILES.includes(value);
+}
+function mergeStatus(current, next) {
+  if (current === "fail" || next === "fail") return "fail";
+  if (current === "incomplete" || next === "incomplete") return "incomplete";
+  return "pass";
+}
+function resultStatus(result) {
+  switch (result.status) {
+    case "fail":
+      return "fail";
+    case "incomplete":
+      return "incomplete";
+    case "not-applicable":
+      return "pass";
+    case "pass":
+      return hasText(result.evidence) ? "pass" : "incomplete";
+    default:
+      return "incomplete";
+  }
+}
+function evaluateQualityPolicy(input) {
+  const requestedProfile = input.profile === void 0 ? "routine" : input.profile;
+  if (!isQualityProfile(requestedProfile)) {
+    throw new Error(`Unknown quality profile: ${String(requestedProfile)}`);
+  }
+  const controls = /* @__PURE__ */ new Map();
+  let status = "pass";
+  let hasRequired = false;
+  for (const control of input.controls) {
+    if (!hasText(control.id) || control.requirement !== "required" && control.requirement !== "optional" || controls.has(control.id)) {
+      status = mergeStatus(status, "incomplete");
+      continue;
+    }
+    controls.set(control.id, control);
+    if (control.requirement === "required") hasRequired = true;
+  }
+  const results = /* @__PURE__ */ new Map();
+  for (const result of input.results) {
+    const control = controls.get(result.controlId);
+    if (!control || results.has(result.controlId)) {
+      status = mergeStatus(status, "incomplete");
+    }
+    if (control && !results.has(result.controlId)) {
+      results.set(result.controlId, result);
+    }
+    if (control && result.status === "not-applicable") {
+      const validException = control.requirement === "optional" && control.notApplicable === true && hasText(result.reason);
+      status = mergeStatus(status, validException ? "pass" : "incomplete");
+      continue;
+    }
+    if (control) status = mergeStatus(status, resultStatus(result));
+  }
+  if (!hasRequired) status = mergeStatus(status, "incomplete");
+  for (const control of controls.values()) {
+    if (control.requirement !== "required") continue;
+    const result = results.get(control.id);
+    if (!result) {
+      status = mergeStatus(status, "incomplete");
+      continue;
+    }
+    if (result.status === "not-applicable") {
+      status = mergeStatus(status, "incomplete");
+    } else {
+      status = mergeStatus(status, resultStatus(result));
+    }
+  }
+  return { profile: requestedProfile, status };
+}
+
+// src/lib/quality-receipt.ts
+import { createHash } from "crypto";
+var QUALITY_RECEIPT_NAMESPACE = "jorgex.quality.receipt";
+var QUALITY_RECEIPT_VERSION = 1;
+var COMMIT_SHA_PATTERN = /^[0-9a-f]{40}$/i;
+var SHA256_PATTERN = /^[0-9a-f]{64}$/i;
+var MAX_EXCERPT_LENGTH = 512;
+var REDACTED = "[REDACTED]";
+var QUALITY_RESULT_STATUSES = [
+  "pass",
+  "fail",
+  "incomplete",
+  "not-applicable"
+];
+var SENSITIVE_FLAG_PATTERN = /^(?:-{1,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))$/i;
+var SENSITIVE_ASSIGNMENT_PATTERN = /^(?:-{0,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))\s*[=:]\s*.+$/i;
+var SENSITIVE_OUTPUT_PATTERN = /((?:authorization\s*:\s*bearer\s+|bearer\s+))[^\s,;]+/gi;
+var SENSITIVE_KEY_VALUE_PATTERN = /((?:^|(?<=[^\w.-]))(?:-{0,2})(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))\s*[=:]\s*)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
+var SENSITIVE_SEPARATE_FLAG_PATTERN = /((?:^|(?<=[^\w.-]))-{1,2}(?:(?:[a-z][a-z0-9_.-]*[-_]?)?(?:access[-_]?token|api[-_]?key|auth(?:orization)?|client[-_]?secret|credential|pass(?:word|wd)?|refresh[-_]?token|secret|token))[ \t]+)(?:"[^"]*"|'[^']*'|[^\r\n,;]+)/gi;
+var SENSITIVE_STRUCTURED_VALUE_PATTERN = /((?:"|')?(?:token|password|api[-_]?key|access[-_]?token|_?auth(?:orization)?(?:[-_.]?token)?|aws[-_]?secret[-_]?access[-_]?key|private[-_]?key)(?:"|')?\s*:\s*)("(?:\\.|[^"\\])*"|'(?:\\.|[^'\\])*')/gi;
+function isRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function hasOwn(value, key) {
+  return Object.prototype.hasOwnProperty.call(value, key);
+}
+function isDenseStringArray(value) {
+  if (!Array.isArray(value)) return false;
+  for (let index = 0; index < value.length; index += 1) {
+    if (!hasOwn(value, String(index)) || typeof value[index] !== "string") return false;
+  }
+  return true;
+}
+function assertExactKeys(value, allowed, label) {
+  const allowedKeys = new Set(allowed);
+  const unexpected = Object.keys(value).find((key) => !allowedKeys.has(key));
+  if (unexpected !== void 0) {
+    throw new Error(`Unexpected ${label} field: ${unexpected}`);
+  }
+}
+function requireRecord(value, label) {
+  if (!isRecord(value)) throw new Error(`Invalid ${label}`);
+  return value;
+}
+function requireText(value, label) {
+  if (typeof value !== "string" || value.trim() === "") {
+    throw new Error(`Invalid ${label}`);
+  }
+  return value;
+}
+function isQualityProfile2(value) {
+  return QUALITY_PROFILES.includes(value);
+}
+function isQualityReceiptResultStatus(value) {
+  return QUALITY_RESULT_STATUSES.includes(value);
+}
+function requireSha(value, label, pattern) {
+  const text = requireText(value, label);
+  if (!pattern.test(text)) throw new Error(`Invalid ${label}`);
+  return text;
+}
+function redactText(value) {
+  return value.replace(SENSITIVE_STRUCTURED_VALUE_PATTERN, (_match, prefix, quotedValue) => {
+    const quote = quotedValue[0];
+    return `${prefix}${quote}${REDACTED}${quote}`;
+  }).replace(SENSITIVE_OUTPUT_PATTERN, (_match, prefix) => {
+    const normalizedPrefix = prefix.toLowerCase().startsWith("authorization") ? prefix.slice(0, prefix.toLowerCase().indexOf("bearer") + "bearer".length) : "Bearer ";
+    return `${normalizedPrefix}${REDACTED}`;
+  }).replace(SENSITIVE_KEY_VALUE_PATTERN, `$1${REDACTED}`).replace(SENSITIVE_SEPARATE_FLAG_PATTERN, `$1${REDACTED}`);
+}
+function redactAssignment(value) {
+  const separator = value.indexOf("=") >= 0 ? "=" : ":";
+  const name = value.slice(0, value.indexOf(separator));
+  return `${name}${separator}${REDACTED}`;
+}
+function redactArgv(argv) {
+  if (!isDenseStringArray(argv)) throw new Error("Invalid argv: sparse or non-string array");
+  let redactNext = false;
+  return argv.map((argument) => {
+    if (redactNext) {
+      redactNext = false;
+      return REDACTED;
+    }
+    if (SENSITIVE_FLAG_PATTERN.test(argument)) {
+      redactNext = true;
+      return argument;
+    }
+    if (SENSITIVE_ASSIGNMENT_PATTERN.test(argument)) {
+      return redactAssignment(argument);
+    }
+    return redactText(argument);
+  });
+}
+function excerptFor(output) {
+  const stdout = redactText(output.stdout);
+  const stderr = redactText(output.stderr);
+  const combined = [stdout, stderr].filter((part) => part !== "").join("\n");
+  return Array.from(combined).slice(0, MAX_EXCERPT_LENGTH).join("");
+}
+function outputDigestFor(output) {
+  const sanitized = {
+    stdout: redactText(output.stdout),
+    stderr: redactText(output.stderr)
+  };
+  return sha256(canonicalJson(sanitized));
+}
+function normalizeCommand(command) {
+  return {
+    commandId: command.commandId,
+    executable: command.executable,
+    argv: redactArgv(command.argv),
+    exitCode: command.exitCode,
+    durationMs: command.durationMs,
+    excerpt: excerptFor(command.output),
+    outputDigest: outputDigestFor(command.output)
+  };
+}
+function normalizeResult(result) {
+  if (result.status === "pass") {
+    return {
+      controlId: result.controlId,
+      status: "pass",
+      evidence: result.evidence,
+      ...result.reason === void 0 ? {} : { reason: result.reason }
+    };
+  }
+  return {
+    controlId: result.controlId,
+    status: result.status,
+    ...result.evidence === void 0 ? {} : { evidence: result.evidence },
+    ...result.reason === void 0 ? {} : { reason: result.reason }
+  };
+}
+function normalizeProvenance(provenance) {
+  return {
+    issuer: provenance.issuer,
+    executionId: provenance.executionId,
+    evidenceLocator: provenance.evidenceLocator,
+    evidenceDigest: provenance.evidenceDigest
+  };
+}
+function canonicalValue(value) {
+  if (value === null) return "null";
+  switch (typeof value) {
+    case "string": {
+      const result = JSON.stringify(value);
+      if (result === void 0) throw new Error("Unable to canonicalize string");
+      return result;
+    }
+    case "boolean":
+      return value ? "true" : "false";
+    case "number": {
+      if (!Number.isFinite(value)) throw new Error("Cannot canonicalize non-finite number");
+      const result = JSON.stringify(value);
+      if (result === void 0) throw new Error("Unable to canonicalize number");
+      return result;
+    }
+    case "object": {
+      if (Array.isArray(value)) {
+        for (let index = 0; index < value.length; index += 1) {
+          if (!hasOwn(value, String(index))) {
+            throw new Error("Cannot canonicalize sparse array");
+          }
+        }
+        return `[${value.map((item) => canonicalValue(item)).join(",")}]`;
+      }
+      const prototype = Object.getPrototypeOf(value);
+      if (prototype !== Object.prototype && prototype !== null) {
+        throw new Error("Cannot canonicalize non-plain object");
+      }
+      const object = value;
+      return `{${Object.keys(object).sort().map((key) => {
+        return `${JSON.stringify(key)}:${canonicalValue(object[key])}`;
+      }).join(",")}}`;
+    }
+    default:
+      throw new Error(`Cannot canonicalize ${typeof value}`);
+  }
+}
+function canonicalJson(value) {
+  return canonicalValue(value);
+}
+function sha256(value) {
+  return createHash("sha256").update(value, "utf8").digest("hex");
+}
+function validateIdentity(value, expected) {
+  const identity = requireRecord(value, "identity");
+  assertExactKeys(identity, ["profile", "baseSha", "headSha", "policyDigest"], "identity");
+  const profile = requireText(identity.profile, "identity.profile");
+  if (!isQualityProfile2(profile)) throw new Error(`Invalid identity.profile: ${profile}`);
+  const baseSha = requireSha(identity.baseSha, "identity.baseSha", COMMIT_SHA_PATTERN);
+  const headSha = requireSha(identity.headSha, "identity.headSha", COMMIT_SHA_PATTERN);
+  const policyDigest = requireSha(identity.policyDigest, "identity.policyDigest", SHA256_PATTERN);
+  const actual = { profile, baseSha, headSha, policyDigest };
+  if (expected !== void 0) {
+    for (const field of ["profile", "baseSha", "headSha", "policyDigest"]) {
+      if (actual[field] !== expected[field]) {
+        throw new Error(`Quality receipt identity mismatch: ${field}`);
+      }
+    }
+  }
+  return actual;
+}
+function validateProvenance(value) {
+  const provenance = requireRecord(value, "provenance");
+  assertExactKeys(provenance, ["issuer", "executionId", "evidenceLocator", "evidenceDigest"], "provenance");
+  const issuer = requireText(provenance.issuer, "provenance.issuer");
+  const executionId = requireText(provenance.executionId, "provenance.executionId");
+  const evidenceLocator = requireText(provenance.evidenceLocator, "provenance.evidenceLocator");
+  if (!/^https?:\/\/\S+$/.test(evidenceLocator)) {
+    throw new Error("Invalid provenance.evidenceLocator");
+  }
+  try {
+    const parsed = new URL(evidenceLocator);
+    if (parsed.protocol !== "http:" && parsed.protocol !== "https:") {
+      throw new Error("unsupported locator protocol");
+    }
+  } catch {
+    throw new Error("Invalid provenance.evidenceLocator");
+  }
+  const evidenceDigest = requireSha(provenance.evidenceDigest, "provenance.evidenceDigest", SHA256_PATTERN);
+  return { issuer, executionId, evidenceLocator, evidenceDigest };
+}
+function validateCommand(value, index) {
+  const command = requireRecord(value, `commands[${index}]`);
+  assertExactKeys(
+    command,
+    ["commandId", "executable", "argv", "exitCode", "durationMs", "excerpt", "outputDigest"],
+    `commands[${index}]`
+  );
+  const commandId = requireText(command.commandId, `commands[${index}].commandId`);
+  const executable = requireText(command.executable, `commands[${index}].executable`);
+  if (!isDenseStringArray(command.argv)) {
+    throw new Error(`Invalid commands[${index}].argv`);
+  }
+  if (typeof command.exitCode !== "number" || !Number.isInteger(command.exitCode)) {
+    throw new Error(`Invalid commands[${index}].exitCode`);
+  }
+  if (typeof command.durationMs !== "number" || !Number.isFinite(command.durationMs) || command.durationMs < 0) {
+    throw new Error(`Invalid commands[${index}].durationMs`);
+  }
+  if (!hasOwn(command, "excerpt") || typeof command.excerpt !== "string") {
+    throw new Error(`Invalid commands[${index}].excerpt`);
+  }
+  const excerpt = command.excerpt;
+  if (Array.from(excerpt).length > MAX_EXCERPT_LENGTH) throw new Error(`Invalid commands[${index}].excerpt`);
+  if (redactText(excerpt) !== excerpt) {
+    throw new Error(`Invalid commands[${index}].excerpt: contains an unredacted secret`);
+  }
+  const argv = [...command.argv];
+  const sanitizedArgv = redactArgv(argv);
+  if (sanitizedArgv.some((argument, argumentIndex) => argument !== argv[argumentIndex])) {
+    throw new Error(`Invalid commands[${index}].argv: contains an unredacted secret`);
+  }
+  const outputDigest = requireSha(command.outputDigest, `commands[${index}].outputDigest`, SHA256_PATTERN);
+  return {
+    commandId,
+    executable,
+    argv,
+    exitCode: command.exitCode,
+    durationMs: command.durationMs,
+    excerpt,
+    outputDigest
+  };
+}
+function validateResult(value, index) {
+  const result = requireRecord(value, `results[${index}]`);
+  assertExactKeys(result, ["controlId", "status", "evidence", "reason"], `results[${index}]`);
+  const controlId = requireText(result.controlId, `results[${index}].controlId`);
+  const status = result.status;
+  if (typeof status !== "string" || !isQualityReceiptResultStatus(status)) {
+    throw new Error(`Invalid results[${index}].status`);
+  }
+  let evidence;
+  if (hasOwn(result, "evidence")) {
+    if (typeof result.evidence !== "string") {
+      throw new Error(`Invalid results[${index}].evidence`);
+    }
+    evidence = result.evidence;
+  }
+  let reason;
+  if (hasOwn(result, "reason")) {
+    if (typeof result.reason !== "string") {
+      throw new Error(`Invalid results[${index}].reason`);
+    }
+    reason = result.reason;
+  }
+  if (status === "pass") {
+    if (evidence === void 0 || evidence.trim() === "") {
+      throw new Error(`Invalid results[${index}].evidence: pass requires evidence`);
+    }
+    return {
+      controlId,
+      status,
+      evidence,
+      ...reason === void 0 ? {} : { reason }
+    };
+  }
+  return {
+    controlId,
+    status,
+    ...evidence === void 0 ? {} : { evidence },
+    ...reason === void 0 ? {} : { reason }
+  };
+}
+function validateQualityReceipt(value, expectedIdentity) {
+  const receipt = requireRecord(value, "quality receipt");
+  if (receipt.namespace !== QUALITY_RECEIPT_NAMESPACE) {
+    throw new Error(`Invalid quality receipt namespace: ${String(receipt.namespace)}`);
+  }
+  if (receipt.version !== QUALITY_RECEIPT_VERSION) {
+    throw new Error(`Unsupported quality receipt version: ${String(receipt.version)}`);
+  }
+  assertExactKeys(receipt, ["namespace", "version", "authority", "identity", "commands", "results", "provenance"], "receipt");
+  if (receipt.authority !== "local" && receipt.authority !== "enforced") {
+    throw new Error(`Invalid quality receipt authority: ${String(receipt.authority)}`);
+  }
+  const identity = validateIdentity(receipt.identity, expectedIdentity);
+  if (!Array.isArray(receipt.commands)) throw new Error("Invalid quality receipt commands");
+  if (!Array.isArray(receipt.results)) throw new Error("Invalid quality receipt results");
+  for (let index = 0; index < receipt.commands.length; index += 1) {
+    validateCommand(receipt.commands[index], index);
+  }
+  for (let index = 0; index < receipt.results.length; index += 1) {
+    validateResult(receipt.results[index], index);
+  }
+  const hasProvenance = hasOwn(receipt, "provenance");
+  if (receipt.authority === "enforced" && (!hasProvenance || receipt.provenance === void 0)) {
+    throw new Error("Enforced quality receipts require provenance");
+  }
+  if (hasProvenance) {
+    if (receipt.provenance === void 0) throw new Error("Invalid quality receipt provenance");
+    validateProvenance(receipt.provenance);
+  }
+  void identity;
+}
+function createQualityReceipt(input) {
+  const authority = input.authority;
+  if (authority !== "local" && authority !== "enforced") {
+    throw new Error(`Invalid quality receipt authority: ${String(authority)}`);
+  }
+  if (input.authority === "enforced" && input.provenance === void 0) {
+    throw new Error("Enforced quality receipts require provenance");
+  }
+  const base = {
+    namespace: QUALITY_RECEIPT_NAMESPACE,
+    version: QUALITY_RECEIPT_VERSION,
+    identity: {
+      profile: input.identity.profile,
+      baseSha: input.identity.baseSha,
+      headSha: input.identity.headSha,
+      policyDigest: input.identity.policyDigest
+    },
+    commands: input.commands.map(normalizeCommand),
+    results: input.results.map(normalizeResult)
+  };
+  let receipt;
+  if (input.authority === "enforced") {
+    const provenance = input.provenance;
+    if (provenance === void 0) throw new Error("Enforced quality receipts require provenance");
+    receipt = {
+      ...base,
+      authority: "enforced",
+      provenance: normalizeProvenance(provenance)
+    };
+  } else {
+    receipt = {
+      ...base,
+      authority: "local",
+      ...input.provenance === void 0 ? {} : { provenance: normalizeProvenance(input.provenance) }
+    };
+  }
+  validateQualityReceipt(receipt);
+  return receipt;
+}
+function serializeQualityReceipt(receipt) {
+  validateQualityReceipt(receipt);
+  return canonicalJson(receipt);
+}
+
+export {
+  HOME,
+  stackRoot,
+  dataDir,
+  samePath,
+  QUALITY_PROFILES,
+  evaluateQualityPolicy,
+  canonicalJson,
+  sha256,
+  validateQualityReceipt,
+  createQualityReceipt,
+  serializeQualityReceipt
+};

package/dist/cli.d.ts

@@ -0,0 +1,41 @@
+/**
+ * Contrato central del proyecto (PRD §5): cada runtime implementa un Adapter
+ * que declara DÓNDE va cada cosa y CÓMO se escribe. Los componentes
+ * (src/components/) iteran (componente × adapter) sin switches por runtime.
+ */
+
+type RuntimeId = "claude-code" | "codex" | "opencode";
+type SelectableRuntimeId = RuntimeId | "pi";
+
+declare const COMMANDS: readonly ["install", "sync", "models", "update", "doctor", "restore", "uninstall", "quality"];
+type Command = (typeof COMMANDS)[number];
+interface Flags {
+    agents: SelectableRuntimeId[];
+    targetDir?: string;
+    dryRun: boolean;
+    yes: boolean;
+    mode?: string;
+    subagentConcurrency?: string;
+    help: boolean;
+    version: boolean;
+    list: boolean;
+    check: boolean;
+    removeEngram: boolean;
+    playwright: boolean;
+    removePlaywright: boolean;
+    devtools: boolean;
+    noDevtools: boolean;
+    receipt?: string;
+    positional: string[];
+    unknownFlags: string[];
+}
+interface ParsedCli {
+    action: "run" | "help" | "version" | "unknown" | "unknown-flags";
+    command: Command;
+    flags: Flags;
+    unknownCommand?: string;
+}
+declare function parseFlags(args: string[], allowReceipt?: boolean): Flags;
+declare function parseCliArgs(argv: string[]): ParsedCli;
+
+export { type Command, type Flags, type ParsedCli, parseCliArgs, parseFlags };