model-eol 0.2.4 → 0.4.0

package/bot/lib/common.mjs

@@ -0,0 +1,122 @@
+import crypto from 'node:crypto'
+import path from 'node:path'
+
+export { matchesAnyGlob, matchesGlob } from '../../lib/glob.mjs'
+
+export const sha256 = value => crypto.createHash('sha256').update(value).digest('hex')
+
+const stableValue = value => {
+  if (Array.isArray(value)) return value.map(stableValue)
+  if (value && typeof value === 'object') {
+    return Object.fromEntries(Object.keys(value).sort().map(key => [key, stableValue(value[key])]))
+  }
+  return value
+}
+
+export const stableJson = value => JSON.stringify(stableValue(value))
+
+export const sortedJsonDigest = values => {
+  const sorted = values.slice().sort((a, b) => stableJson(a).localeCompare(stableJson(b)))
+  return sha256(stableJson(sorted))
+}
+
+const safeSegment = value => {
+  const result = String(value ?? '')
+    .toLowerCase()
+    .replace(/[^a-z0-9._-]/g, '-')
+    .replace(/-+/g, '-')
+    .replace(/^-+|-+$/g, '')
+  return result || 'model'
+}
+
+export const slugFor = id => {
+  const slug = safeSegment(id).slice(0, 40).replace(/^-+|-+$/g, '')
+  return slug || 'model'
+}
+
+export const branchFor = (publisher, id, via = null) =>
+  `model-eol/${safeSegment(publisher)}${via ? `/${safeSegment(via)}` : ''}/${slugFor(id)}-${sha256(String(id)).slice(0, 8)}`
+
+export const daysRemaining = (shutdown, now = new Date()) => {
+  if (!shutdown) return null
+  return Math.ceil((new Date(`${shutdown}T00:00:00Z`) - now) / 86400000)
+}
+
+export const repoPath = (file, root) => {
+  const absolute = path.isAbsolute(file) ? file : path.resolve(root, file)
+  const relative = path.relative(root, absolute)
+  return relative.split(path.sep).join('/').replace(/^\.\//, '')
+}
+
+export const metadataLine = metadata => `<!-- model-eol ${JSON.stringify(metadata).replaceAll('-->', '\\u002d\\u002d\\u003e')} -->`
+
+export const hasMetadataMarker = body => String(body ?? '').includes('<!-- model-eol')
+
+export const parseMetadata = body => {
+  const firstLine = String(body ?? '').split(/\r?\n/, 1)[0]
+  const match = firstLine.match(/^<!-- model-eol (\{.*\}) -->$/)
+  if (!match) return null
+  try {
+    const metadata = JSON.parse(match[1])
+    if (!metadata || typeof metadata !== 'object' || Array.isArray(metadata)) return null
+    if (metadata.schema !== 'model-eol.bot/0.1') return null
+    if (typeof metadata.id !== 'string' || !metadata.id) return null
+    if (typeof metadata.publisher !== 'string' || !metadata.publisher) return null
+    if (!Object.hasOwn(metadata, 'shutdown') || (metadata.shutdown !== null && typeof metadata.shutdown !== 'string')) return null
+    if (metadata.via !== undefined && metadata.via !== null && typeof metadata.via !== 'string') return null
+    if (metadata.replacement !== undefined && metadata.replacement !== null && typeof metadata.replacement !== 'string') return null
+    if (metadata.replacement_options !== undefined && (!Array.isArray(metadata.replacement_options) || metadata.replacement_options.some(option => typeof option !== 'string'))) return null
+    if (metadata.replacement_note !== undefined && metadata.replacement_note !== null && typeof metadata.replacement_note !== 'string') return null
+    if (metadata.base_sha !== undefined && metadata.base_sha !== null && (typeof metadata.base_sha !== 'string' || !/^[0-9a-f]{40,64}$/.test(metadata.base_sha))) return null
+    if (metadata.stale_closed !== undefined && metadata.stale_closed !== true) return null
+    if (typeof metadata.feed_digest !== 'string' || !metadata.feed_digest) return null
+    if (!Object.hasOwn(metadata, 'head_sha') || (metadata.head_sha !== null && typeof metadata.head_sha !== 'string')) return null
+    if (metadata.channel !== undefined && (typeof metadata.channel !== 'string' || !metadata.channel)) return null
+    return metadata
+  } catch {
+    return null
+  }
+}
+
+export const itemDigest = items => sortedJsonDigest(items)
+
+const entityMap = new Map([
+  ['&', '&amp;'],
+  ['<', '&lt;'],
+  ['>', '&gt;'],
+  ['`', '&#96;'],
+  ['\\', '&#92;'],
+  ['[', '&#91;'],
+  [']', '&#93;'],
+  ['(', '&#40;'],
+  [')', '&#41;'],
+  ['#', '&#35;'],
+  ['*', '&#42;'],
+  ['_', '&#95;'],
+  ['~', '&#126;'],
+  ['!', '&#33;'],
+])
+
+export const markdownText = value => String(value ?? '')
+  .replaceAll('\r\n', '\n')
+  .replaceAll('\r', '\n')
+  .replace(/[&<>`\\[\]()#*_~!]/g, character => entityMap.get(character))
+  .split('\n')
+  .map(line => line.replace(/^(\s*)([-+>]\s|\d+\.\s)/, '$1&#45; '))
+  .join('\n')
+
+export const markdownCode = value => `\`${markdownText(value)}\``
+
+export const markdownLink = (label, value) => {
+  const text = String(value ?? '')
+  try {
+    const url = new URL(text)
+    if (url.protocol !== 'http:' && url.protocol !== 'https:') return markdownText(text)
+    const href = url.toString().replaceAll('\\', '%5C').replaceAll('(', '%28').replaceAll(')', '%29')
+    return `[${markdownText(label)}](${href})`
+  } catch {
+    return markdownText(text)
+  }
+}
+
+export const markdownFenceText = value => String(value ?? '').replaceAll('`', '')

package/bot/lib/config.mjs

@@ -0,0 +1 @@
+export { DEFAULT_CONFIG, loadConfig, normalizeConfig } from '../../lib/config.mjs'

package/bot/lib/eval.mjs

@@ -0,0 +1,103 @@
+import fs from 'node:fs'
+import { spawnSync } from 'node:child_process'
+import { markdownFenceText } from './common.mjs'
+
+const truncateReport = (bytes, limit, truncated) => {
+  if (!truncated) return bytes.toString('utf8')
+  const marker = Buffer.from('\n[model-eol: report truncated]', 'utf8')
+  if (limit <= marker.length) return marker.subarray(0, limit).toString('utf8')
+  return Buffer.concat([bytes.subarray(0, limit - marker.length), marker]).subarray(0, limit).toString('utf8')
+}
+
+export const capReport = (report, limit) => {
+  if (report === null || report === undefined) return null
+  const bytes = Buffer.from(String(report), 'utf8')
+  return truncateReport(bytes, Math.max(0, limit), bytes.length > limit)
+}
+
+export const readReportCapped = (file, limit) => {
+  const cap = Math.max(0, limit)
+  let lstat
+  try {
+    lstat = fs.lstatSync(file)
+  } catch (error) {
+    if (error.code === 'ENOENT') return { missing: true, report: null }
+    throw error
+  }
+  if (!lstat.isFile() || lstat.isSymbolicLink()) throw new Error(`${file} is not a regular non-symlink file`)
+  let fd
+  try {
+    fd = fs.openSync(file, fs.constants.O_RDONLY | (fs.constants.O_NOFOLLOW ?? 0))
+  } catch (error) {
+    if (error.code === 'ENOENT') return { missing: true, report: null }
+    throw error
+  }
+  try {
+    if (!fs.fstatSync(fd).isFile()) throw new Error(`${file} is not a regular non-symlink file`)
+  } catch (error) {
+    fs.closeSync(fd)
+    throw error
+  }
+  try {
+    const buffer = Buffer.alloc(cap + 1)
+    const bytesRead = fs.readSync(fd, buffer, 0, buffer.length, 0)
+    return {
+      missing: false,
+      report: truncateReport(buffer.subarray(0, Math.min(bytesRead, cap)), cap, bytesRead > cap),
+    }
+  } finally {
+    fs.closeSync(fd)
+  }
+}
+
+export const runEvalHook = ({ command, timeoutMs, maxReportBytes, passEnv = [], cwd, oldId, newId, planPath, reportPath }) => {
+  if (fs.existsSync(reportPath)) fs.rmSync(reportPath, { force: true })
+  const env = {}
+  for (const key of ['PATH', 'HOME', 'TMPDIR', 'LANG', 'USER', 'SHELL']) {
+    if (process.env[key] !== undefined) env[key] = process.env[key]
+  }
+  for (const key of passEnv) {
+    if (process.env[key] !== undefined) env[key] = process.env[key]
+  }
+  env.MODEL_EOL_OLD_ID = oldId
+  env.MODEL_EOL_NEW_ID = newId
+  env.MODEL_EOL_PLAN = planPath
+  env.MODEL_EOL_REPORT = reportPath
+
+  const result = spawnSync(command, {
+    cwd,
+    env,
+    shell: true,
+    timeout: timeoutMs,
+    encoding: 'utf8',
+    stdio: ['ignore', 'ignore', 'ignore'],
+    detached: true,
+  })
+  const timedOut = result.error?.code === 'ETIMEDOUT'
+    || result.error?.code === 'ERR_CHILD_PROCESS_STDIO_MAXBUFFER'
+  if (timedOut && Number.isInteger(result.pid)) {
+    try {
+      process.kill(-result.pid, 'SIGKILL')
+    } catch (error) {
+      if (error.code !== 'ESRCH') throw new Error(`could not kill eval process group: ${error.message}`)
+    }
+  }
+  const exitCode = Number.isInteger(result.status) ? result.status : null
+  let status = timedOut ? 'timeout' : exitCode === 0 ? 'pass' : 'fail'
+  let report = null
+  try {
+    const artifact = readReportCapped(reportPath, maxReportBytes)
+    if (artifact.missing && status === 'pass') {
+      status = 'fail'
+      report = 'eval report artifact is missing'
+    } else {
+      report = artifact.report
+    }
+  } catch (error) {
+    if (status === 'pass') status = 'fail'
+    report = `eval report artifact is unreadable: ${error.message}`
+  }
+  return { status, exit_code: exitCode, report }
+}
+
+export const reportForBody = report => markdownFenceText(report)

package/bot/lib/feeds.mjs

@@ -0,0 +1,48 @@
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+
+import { assertValidFeed } from '../../lib/validate-feed.mjs'
+
+const responseText = async response => {
+  if (typeof response?.text === 'function') return response.text()
+  if (typeof response?.body === 'string') return response.body
+  if (response?.data !== undefined) return JSON.stringify(response.data)
+  return JSON.stringify(response)
+}
+
+export const downloadFeeds = async ({
+  urls = [],
+  fetchImpl = globalThis.fetch,
+  vendoredDir,
+  allowVendoredFallback = false,
+  warn = console.error,
+}) => {
+  if (!urls.length) return { dir: vendoredDir, cleanup: () => {} }
+  const tempDir = fs.mkdtempSync(path.join(os.tmpdir(), 'model-eol-feeds-'))
+  try {
+    for (const [index, url] of urls.entries()) {
+      if (typeof fetchImpl !== 'function') throw new Error('feed fetch transport is not callable')
+      const response = await fetchImpl(url)
+      const status = typeof response?.status === 'number' ? response.status : 200
+      if (status >= 400 || response?.ok === false) throw new Error(`${url} returned HTTP ${status}`)
+      let value
+      try {
+        value = JSON.parse(await responseText(response))
+      } catch (error) {
+        throw new Error(`${url} was not valid JSON: ${error.message}`)
+      }
+      assertValidFeed(value, url)
+      fs.writeFileSync(path.join(tempDir, `feed-${index}.json`), JSON.stringify(value, null, 2))
+    }
+    return {
+      dir: tempDir,
+      cleanup: () => fs.rmSync(tempDir, { recursive: true, force: true }),
+    }
+  } catch (error) {
+    fs.rmSync(tempDir, { recursive: true, force: true })
+    if (!allowVendoredFallback) throw new Error(`feed download failed: ${error.message}`)
+    warn(`model-eol: warning: feed download failed (${error.message}); using vendored feeds in degraded report-only mode`)
+    return { dir: vendoredDir, cleanup: () => {}, degraded: true }
+  }
+}

package/bot/lib/git.mjs

@@ -0,0 +1,131 @@
+import fs from 'node:fs'
+import path from 'node:path'
+import { spawnSync } from 'node:child_process'
+
+export const BOT_IDENTITY_EMAIL = 'model-eol[bot]@users.noreply.github.com'
+
+const environmentFor = auth => auth
+  ? {
+      ...process.env,
+      GIT_CONFIG_COUNT: '1',
+      GIT_CONFIG_KEY_0: auth.key,
+      GIT_CONFIG_VALUE_0: auth.value,
+      GIT_TERMINAL_PROMPT: '0',
+      GIT_TRACE_REDACT: '1',
+    }
+  : process.env
+
+const run = (cwd, args, allowFailure = false, auth = null) => {
+  const result = spawnSync('git', args, {
+    cwd,
+    env: environmentFor(auth),
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  })
+  if (!result.error && result.status === 0) return result.stdout.trim()
+  if (allowFailure) return null
+  const detail = result.error?.message || result.stderr?.trim() || `exit ${result.status}`
+  throw new Error(`git ${args.join(' ')} failed: ${detail}`)
+}
+
+export const git = run
+
+export const gitAuthentication = (source, token, apiUrl = 'https://api.github.com') => {
+  if (!token) return null
+  let url
+  let api
+  try {
+    url = new URL(source)
+    api = new URL(apiUrl)
+  } catch {
+    return null
+  }
+  if (url.protocol !== 'https:') return null
+  const expectedHost = api.host === 'api.github.com' ? 'github.com' : api.host
+  if (api.protocol !== 'https:' || url.host !== expectedHost) return null
+  const scope = `${url.protocol}//${url.host}/`
+  const credential = Buffer.from(`x-access-token:${token}`).toString('base64')
+  return {
+    key: `http.${scope}.extraheader`,
+    value: `AUTHORIZATION: basic ${credential}`,
+  }
+}
+
+export const originFor = targetDir =>
+  run(targetDir, ['remote', 'get-url', 'origin'], true) || targetDir
+
+export const cloneRepository = (source, destination, auth = null) => {
+  fs.mkdirSync(path.dirname(destination), { recursive: true })
+  run(null, ['clone', '--quiet', '--', source, destination], false, auth)
+  return destination
+}
+
+export const defaultBranch = (cwd, auth = null) => {
+  const remoteHead = run(cwd, ['symbolic-ref', '--quiet', '--short', 'refs/remotes/origin/HEAD'], true)
+  if (remoteHead?.startsWith('origin/')) return remoteHead.slice('origin/'.length)
+  const current = run(cwd, ['symbolic-ref', '--quiet', '--short', 'HEAD'], true)
+  if (current) return current
+  const remoteShow = run(cwd, ['remote', 'show', 'origin'], true, auth)
+  const match = remoteShow?.match(/HEAD branch:\s*(\S+)/)
+  if (match) return match[1]
+  return 'main'
+}
+
+export const prepareBranch = (cwd, branch, base, auth = null) => {
+  run(cwd, ['fetch', 'origin', '--prune'], false, auth)
+  const remoteBase = run(cwd, ['rev-parse', '--verify', `refs/remotes/origin/${base}`], true)
+  run(cwd, ['checkout', '-B', branch, remoteBase ? `origin/${base}` : base])
+}
+
+export const configureIdentity = cwd => {
+  run(cwd, ['config', 'user.name', 'model-eol[bot]'])
+  run(cwd, ['config', 'user.email', BOT_IDENTITY_EMAIL])
+}
+
+export const commitAll = (cwd, files, message) => {
+  const unique = [...new Set(files)]
+  if (unique.length) run(cwd, ['add', '--', ...unique])
+  run(cwd, ['commit', '--allow-empty', '-m', message])
+  return run(cwd, ['rev-parse', 'HEAD'])
+}
+
+export const verifyBotBranch = (cwd, branch, expectedHead, auth = null) => {
+  try {
+    run(cwd, ['fetch', 'origin', '--prune'], false, auth)
+  } catch (error) {
+    return { head: null, committerEmail: null, safe: false, error: error.message }
+  }
+  const head = run(cwd, ['rev-parse', '--verify', `refs/remotes/origin/${branch}`], true)
+  const committerEmail = head ? run(cwd, ['show', '-s', '--format=%cE', head], true) : null
+  return {
+    head,
+    committerEmail,
+    safe: head === expectedHead && committerEmail === BOT_IDENTITY_EMAIL,
+    error: null,
+  }
+}
+
+export const pushBranch = (cwd, branch, expectedHead = null, auth = null, { allowMissing = false } = {}) => {
+  const destination = `HEAD:refs/heads/${branch}`
+  if (expectedHead !== null) {
+    const state = verifyBotBranch(cwd, branch, expectedHead, auth)
+    if (!state.safe && !(allowMissing && !state.error && state.head === null)) {
+      const error = new Error(state.error || `refusing force-push: branch head ${state.head || 'missing'} or committer email ${state.committerEmail || 'missing'} failed bot lease checks`)
+      error.code = 'MODEL_EOL_BRANCH_STAND_DOWN'
+      error.currentHead = state.head
+      error.committerEmail = state.committerEmail
+      throw error
+    }
+    if (state.head === null) run(cwd, ['push', 'origin', destination], false, auth)
+    else {
+      run(cwd, [
+        'push',
+        `--force-with-lease=refs/heads/${branch}:${expectedHead}`,
+        'origin',
+        destination,
+      ], false, auth)
+    }
+  } else {
+    run(cwd, ['push', 'origin', destination], false, auth)
+  }
+}

package/bot/lib/github.mjs

@@ -0,0 +1,187 @@
+const linkFor = (headers, relation) => {
+  const value = headers?.get?.('link') || headers?.get?.('Link') || headers?.link || headers?.Link || ''
+  const match = value.split(',').map(part => part.trim()).find(part => part.endsWith(`rel="${relation}"`))
+  return match?.match(/^<([^>]+)>/)?.[1] ?? null
+}
+
+const bodyFromResponse = async response => {
+  if (response === null || response === undefined) return null
+  if (Array.isArray(response)) return response
+  if (typeof response.json === 'function') {
+    try {
+      return await response.json()
+    } catch (error) {
+      if (response.status === 204) return null
+      throw error
+    }
+  }
+  if (response.data !== undefined) return response.data
+  if (response.body !== undefined) {
+    if (typeof response.body === 'string') {
+      try { return JSON.parse(response.body) } catch { return response.body }
+    }
+    return response.body
+  }
+  return response
+}
+
+const MODEL_EOL_LABEL = {
+  name: 'model-eol',
+  color: 'b60205',
+  description: 'AI model lifecycle migration tracked by model-eol',
+}
+
+export class GitHubClient {
+  constructor({ repo, apiUrl = 'https://api.github.com', token, transport = globalThis.fetch, warn = console.error }) {
+    this.repo = repo
+    this.apiUrl = apiUrl.replace(/\/$/, '')
+    this.token = token
+    this.transport = transport
+    this.warn = warn
+    this.modelEolLabelAvailable = true
+  }
+
+  url(value) {
+    return value.startsWith('http://') || value.startsWith('https://')
+      ? value
+      : `${this.apiUrl}${value}`
+  }
+
+  async request(method, endpoint, body = undefined) {
+    if (typeof this.transport !== 'function') throw new Error('GitHub transport is not callable')
+    const headers = {
+      accept: 'application/vnd.github+json',
+      authorization: `Bearer ${this.token}`,
+      'x-github-api-version': '2022-11-28',
+    }
+    const options = { method, headers }
+    if (body !== undefined) {
+      headers['content-type'] = 'application/json'
+      options.body = JSON.stringify(body)
+    }
+    const response = await this.transport(this.url(endpoint), options)
+    const status = typeof response?.status === 'number' ? response.status : 200
+    const data = await bodyFromResponse(response)
+    if (status >= 400 || response?.ok === false) {
+      const detail = typeof data === 'string' ? data : JSON.stringify(data)
+      const error = new Error(`GitHub ${method} ${endpoint} failed (${status}): ${detail}`)
+      error.status = status
+      error.data = data
+      throw error
+    }
+    return { data, response }
+  }
+
+  async ensureModelEolLabel() {
+    const endpoint = `/repos/${this.repo}/labels/${encodeURIComponent(MODEL_EOL_LABEL.name)}`
+    try {
+      await this.request('GET', endpoint)
+      this.modelEolLabelAvailable = true
+      return true
+    } catch (error) {
+      if (error.status !== 404) {
+        this.modelEolLabelAvailable = false
+        this.warn(`model-eol: warning: could not check the model-eol label; refusing to publish untrusted work (${error.message})`)
+        return false
+      }
+    }
+    try {
+      await this.request('POST', `/repos/${this.repo}/labels`, MODEL_EOL_LABEL)
+      this.modelEolLabelAvailable = true
+      return true
+    } catch (error) {
+      if (error.status === 422) {
+        try {
+          await this.request('GET', endpoint)
+          this.modelEolLabelAvailable = true
+          return true
+        } catch {
+          // Fall through to the warning below. Another writer may have raced us,
+          // but ownership must be confirmed before publishing work.
+        }
+      }
+      this.modelEolLabelAvailable = false
+      this.warn(`model-eol: warning: could not create the model-eol label; refusing to publish untrusted work (${error.message})`)
+      return false
+    }
+  }
+
+  async addModelEolLabel(number) {
+    if (!this.modelEolLabelAvailable) return false
+    try {
+      await this.request('POST', `/repos/${this.repo}/issues/${number}/labels`, { labels: [MODEL_EOL_LABEL.name] })
+      return true
+    } catch (error) {
+      this.modelEolLabelAvailable = false
+      this.warn(`model-eol: warning: could not label #${number}; refusing to leave it open as trusted bot work (${error.message})`)
+      return false
+    }
+  }
+
+  async listAll(resource) {
+    const result = []
+    let endpoint = `${resource}?state=all&per_page=100&page=1`
+    for (let page = 0; page < 1000; page++) {
+      const { data, response } = await this.request('GET', endpoint)
+      if (!Array.isArray(data)) throw new Error(`GitHub ${resource} response was not an array`)
+      result.push(...data)
+      const next = linkFor(response?.headers, 'next')
+      if (next) {
+        endpoint = next
+        continue
+      }
+      if (data.length < 100) break
+      const nextPage = page + 2
+      endpoint = `${resource}?state=all&per_page=100&page=${nextPage}`
+    }
+    return result
+  }
+
+  async listPulls() {
+    return this.listAll(`/repos/${this.repo}/pulls`)
+  }
+
+  async listPullsByHead(branch) {
+    const owner = this.repo.split('/')[0]
+    const head = encodeURIComponent(`${owner}:${branch}`)
+    const { data } = await this.request('GET', `/repos/${this.repo}/pulls?state=all&head=${head}&per_page=100&page=1`)
+    if (!Array.isArray(data)) throw new Error(`GitHub pull request head query response was not an array`)
+    return data
+  }
+
+  async listIssues() {
+    const issues = await this.listAll(`/repos/${this.repo}/issues`)
+    return issues.filter(issue => !issue.pull_request)
+  }
+
+  async createPull(payload) {
+    const { data } = await this.request('POST', `/repos/${this.repo}/pulls`, payload)
+    if (data?.number === undefined) throw new Error('GitHub pull request response did not contain a number')
+    if (!await this.addModelEolLabel(data.number)) {
+      try { await this.updatePull(data.number, { state: 'closed' }) } catch {}
+      throw new Error(`refusing unlabeled bot pull request #${data.number}; it was closed because ownership could not be established`)
+    }
+    return data
+  }
+
+  async updatePull(number, payload) {
+    return (await this.request('PATCH', `/repos/${this.repo}/pulls/${number}`, payload)).data
+  }
+
+  async comment(number, body) {
+    return (await this.request('POST', `/repos/${this.repo}/issues/${number}/comments`, { body })).data
+  }
+
+  async createIssue(payload) {
+    if (!this.modelEolLabelAvailable) throw new Error('refusing unlabeled bot issue; model-eol label is unavailable')
+    return (await this.request('POST', `/repos/${this.repo}/issues`, payload)).data
+  }
+
+  async updateIssue(number, payload) {
+    return (await this.request('PATCH', `/repos/${this.repo}/issues/${number}`, payload)).data
+  }
+}
+
+export const labelNames = item => (item.labels ?? []).map(label => typeof label === 'string' ? label : label?.name).filter(Boolean)
+
+export const hasModelEolLabel = item => labelNames(item).includes('model-eol')