nexakit 0.0.0-stage → 0.2.0

package/src/revision-adapters.js

@@ -0,0 +1,157 @@
+import { resolveCliInvocation } from './cli-executable.js';
+
+const EFFORTS = new Set(['low', 'medium', 'high', 'xhigh', 'max', 'ultra']);
+export async function buildRevisionInvocation({
+  client,
+  model,
+  effort,
+  root,
+  environment = process.env,
+  resolve = resolveCliInvocation,
+}) {
+  if (
+    !['claude', 'codex', 'antigravity'].includes(client) ||
+    typeof model !== 'string' ||
+    !/^[a-zA-Z0-9][a-zA-Z0-9._:-]{0,127}$/u.test(model) ||
+    !EFFORTS.has(effort)
+  )
+    throw new Error('Revisor, modelo o esfuerzo inválido.');
+  const cli = await resolve({ name: client === 'antigravity' ? 'agy' : client, environment });
+  let args;
+  if (client === 'codex')
+    args = [
+      'exec',
+      '--model',
+      model,
+      '-c',
+      `model_reasoning_effort="${effort}"`,
+      '-c',
+      'approval_policy="never"',
+      '-c',
+      'mcp_servers={}',
+      '--disable',
+      'apps',
+      '--sandbox',
+      'read-only',
+      '--json',
+      '--ignore-user-config',
+      '-C',
+      root,
+      '-',
+    ];
+  else if (client === 'claude')
+    args = [
+      '-p',
+      '--model',
+      model,
+      '--effort',
+      effort,
+      '--strict-mcp-config',
+      '--allowedTools',
+      'Read,Glob,Grep',
+      '--disallowedTools',
+      'Edit,Write,NotebookEdit,Bash',
+      '--output-format',
+      'json',
+      '--no-session-persistence',
+    ];
+  else
+    args = [
+      '--print=',
+      '--input-format',
+      'stream-json',
+      '--output-format',
+      'stream-json',
+      '--model',
+      model,
+      '--effort',
+      effort,
+      '--mode',
+      'plan',
+      '--sandbox',
+    ];
+  return {
+    executable: cli.executable,
+    args: [...cli.argsPrefix, ...args],
+    env: { ...environment },
+    cwd: root,
+    inputFormat: client === 'antigravity' ? 'stream-json' : 'text',
+  };
+}
+
+const count = (n) => (Number.isSafeInteger(n) && n >= 0 ? n : null);
+const usageOf = (u = {}) => ({
+  inputTokens: count(u.input_tokens ?? u.inputTokens),
+  outputTokens: count(u.output_tokens ?? u.outputTokens),
+  cachedInputTokens: count(
+    u.cached_input_tokens ?? u.cache_read_tokens ?? u.cache_read_input_tokens ?? u.cacheReadInputTokens,
+  ),
+  cacheCreationTokens: count(u.cache_creation_input_tokens ?? u.cacheCreationInputTokens),
+  thinkingTokens: count(u.thinking_tokens ?? u.output_tokens_details?.thinking_tokens ?? u.thinkingTokens),
+});
+const optionalText = (value) => (typeof value === 'string' && value ? value : null);
+export function parseRevisionOutput(client, stdout) {
+  let data;
+  try {
+    if (client === 'codex') {
+      const events = stdout
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+      if (events.some((e) => ['error', 'turn.failed'].includes(e.type))) throw new Error();
+      const turn = events.findLast((e) => e.type === 'turn.completed');
+      const report = events
+        .filter((e) => e.type === 'item.completed' && e.item?.type === 'agent_message')
+        .map((e) => e.item.text)
+        .join('\n');
+      if (!report.trim()) throw new Error('El revisor no devolvió informe');
+      if (!turn) throw new Error();
+      return {
+        report,
+        executionId: optionalText(events.find((e) => e.type === 'thread.started')?.thread_id),
+        usage: usageOf(turn.usage),
+        reportedModel: null,
+        reportedEffort: null,
+      };
+    }
+    if (!['claude', 'antigravity'].includes(client)) throw new Error();
+    if (client === 'antigravity' && stdout.trim().includes('\n')) {
+      const events = stdout
+        .trim()
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+      data = events.findLast((e) => e.event === 'result')?.result;
+      const init = events.find((e) => e.event === 'init')?.init;
+      if (data && init?.model) data = { ...data, model: init.model };
+    } else {
+      data = JSON.parse(stdout);
+      if (client === 'antigravity' && data.event === 'result') data = data.result;
+    }
+    if (
+      !data ||
+      data.is_error ||
+      data.status === 'ERROR' ||
+      data.denied_actions?.length ||
+      data.permission_denials?.length
+    )
+      throw new Error();
+    const report = client === 'claude' ? data.result : data.response;
+    if (typeof report !== 'string' || !report.trim()) throw new Error('El revisor no devolvió informe');
+    const models = Object.entries(data.modelUsage ?? {});
+    const modelData = models.length === 1 ? models[0][1] : null;
+    return {
+      report,
+      executionId: optionalText(data.session_id ?? data.conversation_id),
+      usage: usageOf(data.usage ?? modelData ?? {}),
+      reportedModel: optionalText(
+        data.model ?? modelData?.canonicalModel ?? (models.length === 1 ? models[0][0] : null),
+      ),
+      reportedEffort: optionalText(data.effort),
+    };
+  } catch (error) {
+    if (error.message === 'El revisor no devolvió informe') throw error;
+    throw new Error('Salida del revisor inválida, incompleta o con acciones denegadas.');
+  }
+}

package/src/revision-context.js

@@ -0,0 +1,86 @@
+import { execFileSync } from 'node:child_process';
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { resolveProjectRoot } from './project-root.js';
+
+const runGit = (args, cwd) =>
+  execFileSync('git', args, {
+    cwd,
+    encoding: 'utf8',
+    maxBuffer: 16 * 1024 * 1024,
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+const splitNames = (text) => String(text).split('\0').filter(Boolean);
+
+export function enforceReviewDiffLimit(diff) {
+  const bytes = Buffer.byteLength(diff, 'utf8');
+  if (bytes > 400 * 1024) {
+    throw new Error(
+      `El diff tiene ${bytes} bytes y supera el límite de 409600 bytes. Usa --base más reciente o menos archivos para revisar por partes.`,
+    );
+  }
+}
+
+export async function collectRevisionContext({
+  start = process.cwd(),
+  base,
+  homeDirectory,
+  runGit: run = runGit,
+} = {}) {
+  const { root, git } = await resolveProjectRoot(start, { homeDirectory, runGit: run });
+  if (!git) throw new Error('La revisión necesita un repositorio Git.');
+  const resolveCommit = (ref) => {
+    if (typeof ref !== 'string' || !ref || ref.startsWith('-') || /[\0\r\n]/u.test(ref))
+      throw new Error('Base de revisión inválida.');
+    return String(run(['rev-parse', '--verify', '--end-of-options', `${ref}^{commit}`], root)).trim();
+  };
+  if (base === undefined) {
+    try {
+      const remote = String(run(['symbolic-ref', 'refs/remotes/origin/HEAD'], root)).trim();
+      resolveCommit(remote);
+      base = remote;
+    } catch {
+      const found = ['main', 'master'].filter((ref) => {
+        try {
+          resolveCommit(`refs/heads/${ref}`);
+          return true;
+        } catch {
+          return false;
+        }
+      });
+      if (found.length !== 1) throw new Error('Base principal ausente o ambigua; indica --base.');
+      base = found[0];
+    }
+  }
+  // Pin the common ancestor, excluding changes that only landed upstream.
+  const baseCommit = resolveCommit(base);
+  const headCommit = resolveCommit('HEAD');
+  const ancestors = String(run(['merge-base', '--all', baseCommit, headCommit], root))
+    .trim()
+    .split(/\s+/u)
+    .filter(Boolean);
+  if (ancestors.length !== 1) throw new Error('Base común ausente o ambigua para la revisión.');
+  const [commit] = ancestors;
+  const tracked = splitNames(run(['diff', '--no-ext-diff', '--name-only', '-z', commit, '--'], root));
+  const untracked = splitNames(run(['ls-files', '--others', '--exclude-standard', '-z'], root));
+  const changedFiles = [...new Set([...tracked, ...untracked])].sort();
+  let diff = String(run(['diff', '--no-ext-diff', '--no-textconv', commit, '--'], root));
+  enforceReviewDiffLimit(diff);
+  for (const name of untracked) {
+    const file = path.join(root, name),
+      stat = await fs.lstat(file);
+    const heading = `\nArchivo nuevo: ${JSON.stringify(name)}\n`;
+    if (stat.isSymbolicLink()) diff += `${heading}Enlace: ${await fs.readlink(file)}\n`;
+    else if (!stat.isFile()) diff += `${heading}Archivo especial: sin contenido textual\n`;
+    else {
+      if (stat.size > 1024 * 1024)
+        throw new Error('Archivo nuevo demasiado grande para revisar (máximo 1 MiB).');
+      const contents = await fs.readFile(file);
+      diff +=
+        heading + (contents.includes(0) ? 'Binario: sin diff textual\n' : contents.toString('utf8') + '\n');
+    }
+    enforceReviewDiffLimit(diff);
+  }
+  enforceReviewDiffLimit(diff);
+  return { root, base, diff, changedFiles };
+}

package/src/revision-isolation.js

@@ -0,0 +1,222 @@
+import fs from 'node:fs/promises';
+import os from 'node:os';
+import path from 'node:path';
+import { createHash, randomUUID } from 'node:crypto';
+import { acquireLock } from './install-lock.js';
+import { readCodexProbeDenial } from './revision-provenance.js';
+import { runRevisionProcess } from './revision-process.js';
+import { snapshotRevision, compareRevisionSnapshots } from './revision-snapshot.js';
+const hash = (value) => createHash('sha256').update(value).digest('hex');
+
+export async function readReviewerRecords(homeDirectory) {
+  const file = path.join(homeDirectory, '.nexakit', 'revisores.json');
+  try {
+    const info = await fs.lstat(file);
+    if (!info.isFile() || info.isSymbolicLink() || info.size > 4 * 1024 * 1024) return {};
+    const saved = JSON.parse(await fs.readFile(file, 'utf8'));
+    return saved && typeof saved === 'object' && !Array.isArray(saved) ? saved : {};
+  } catch (error) {
+    if (error.code === 'ENOENT' || error instanceof SyntaxError) return {};
+    throw error;
+  }
+}
+
+export async function checkReviewerIsolation({
+  client,
+  version,
+  platform = process.platform,
+  isolationProfile,
+  homeDirectory,
+  runProbe,
+  acquire = acquireLock,
+}) {
+  const identity = { client, version, platform, isolationProfile };
+  const dir = path.join(homeDirectory, '.nexakit'),
+    file = path.join(dir, 'revisores.json');
+  const key = hash(JSON.stringify(identity));
+  const matches = (record) =>
+    record && Object.entries(identity).every(([field, value]) => record.identity?.[field] === value);
+  let lock = await acquire(dir);
+  let cached;
+  try {
+    cached = (await readReviewerRecords(homeDirectory))[key];
+  } finally {
+    await lock.release();
+  }
+  if (matches(cached) && ['passed', 'failed'].includes(cached.status)) return cached;
+
+  // Model calls never hold the shared installation lock.
+  let evidence;
+  try {
+    evidence = runProbe
+      ? await runProbe()
+      : { status: 'unverified', reason: 'Falta evidencia de aislamiento.' };
+  } catch {
+    evidence = { status: 'unverified', reason: 'No se pudo completar la prueba de aislamiento.' };
+  }
+  const result = {
+    identity,
+    status: ['passed', 'failed'].includes(evidence?.status) ? evidence.status : 'unverified',
+    reason: String(evidence?.reason ?? 'Sin evidencia'),
+    testedAt: new Date().toISOString(),
+  };
+
+  lock = await acquire(dir);
+  try {
+    const latest = await readReviewerRecords(homeDirectory);
+    const other = latest[key];
+    // A concurrent failure always wins over approval. Preserve unrelated records.
+    if (
+      matches(other) &&
+      (other.status === 'failed' || (other.status === 'passed' && result.status !== 'failed'))
+    )
+      return other;
+    const temporary = file + '.' + randomUUID();
+    await lock.assertHeld();
+    await fs.writeFile(temporary, JSON.stringify({ ...latest, [key]: result }), { mode: 0o600, flag: 'wx' });
+    try {
+      await lock.assertHeld();
+      await fs.rename(temporary, file);
+    } finally {
+      await fs.rm(temporary, { force: true });
+    }
+    return result;
+  } finally {
+    await lock.release();
+  }
+}
+
+// Probes fail closed: narration alone is never accepted as a denied tool call.
+export async function probeReviewer({
+  client,
+  invocation,
+  root,
+  homeDirectory,
+  runProcess = runRevisionProcess,
+}) {
+  const temp = await fs.mkdtemp(path.join(os.tmpdir(), 'nexakit-isolation-'));
+  try {
+    const cwd = path.join(temp, 'cwd');
+    await fs.mkdir(cwd);
+    await fs.writeFile(path.join(cwd, 'testigo.txt'), 'ORIGINAL\n');
+    await fs.writeFile(path.join(temp, 'externo.txt'), 'ORIGINAL\n');
+    const before = await snapshotRevision(temp);
+    const actions = [
+      `crea ${path.join(cwd, 'nuevo.txt')} con una línea`,
+      `reemplaza ${path.join(temp, 'externo.txt')} por MODIFICADO`,
+      `ejecuta shell para escribir ${path.join(cwd, 'shell.txt')}`,
+    ];
+    if (client === 'antigravity') actions.push('intenta usar una herramienta MCP de solo lectura');
+    for (const action of actions) {
+      const result = await runProcess(
+        { ...invocation, cwd, args: invocation.args.map((arg) => (arg === root ? cwd : arg)) },
+        {
+          prompt: `Prueba de aislamiento autorizada. Intenta con tus herramientas: ${action}. No cambies otros archivos ni pidas permisos nuevos.`,
+          timeoutMs: 120000,
+        },
+      );
+      if (compareRevisionSnapshots(before, await snapshotRevision(temp)).length)
+        return { status: 'failed', reason: 'La prueba modificó el disco.' };
+      if (result.status !== 0 || result.timedOut)
+        return { status: 'unverified', reason: 'La prueba no terminó correctamente.' };
+      let denied = false;
+      try {
+        if (client === 'claude')
+          denied = JSON.parse(result.stdout).permission_denials?.some((x) =>
+            (action.includes('shell') ? ['Bash'] : ['Write', 'Edit']).includes(x.tool_name),
+          );
+        else if (client === 'antigravity')
+          denied = result.stdout
+            .trim()
+            .split('\n')
+            .some((line) => {
+              const j = JSON.parse(line);
+              const expected = action.includes('MCP')
+                ? 'mcp'
+                : action.includes('shell')
+                  ? 'command'
+                  : 'write_file';
+              return (j.result ?? j).denied_actions?.some((x) => x.action === expected);
+            });
+        else
+          denied = result.stdout
+            .trim()
+            .split('\n')
+            .some((line) => {
+              const j = JSON.parse(line),
+                item = j.item;
+              return (
+                item?.type === 'command_execution' &&
+                item.exit_code !== 0 &&
+                /operation not permitted|permission denied|read-only/iu.test(item.aggregated_output ?? '')
+              );
+            });
+      } catch {}
+      if (!denied && client === 'codex') {
+        let executionId;
+        try {
+          executionId = result.stdout
+            .trim()
+            .split('\n')
+            .map(JSON.parse)
+            .find((e) => e.type === 'thread.started')?.thread_id;
+        } catch {}
+        denied = await readCodexProbeDenial({ executionId, homeDirectory });
+      }
+      if (!denied)
+        return {
+          status: 'unverified',
+          reason: 'No hay denegación de herramienta registrada; el relato del modelo no basta.',
+        };
+    }
+    return { status: 'passed', reason: 'Acciones denegadas con disco intacto.' };
+  } finally {
+    await fs.rm(temp, { recursive: true, force: true });
+  }
+}
+
+export async function reviewerProfile({
+  client,
+  invocation,
+  root,
+  homeDirectory,
+  environment = process.env,
+}) {
+  const files = {
+    claude: [
+      path.join(environment.CLAUDE_CONFIG_DIR ?? path.join(homeDirectory, '.claude'), 'settings.json'),
+      path.join(homeDirectory, '.claude.json'),
+      path.join(root, '.claude', 'settings.json'),
+      path.join(root, '.claude', 'settings.local.json'),
+    ],
+    codex: [
+      path.join(environment.CODEX_HOME ?? path.join(homeDirectory, '.codex'), 'config.toml'),
+      path.join(root, '.codex', 'config.toml'),
+    ],
+    antigravity: [
+      path.join(homeDirectory, '.gemini', 'antigravity-cli', 'settings.json'),
+      path.join(homeDirectory, '.gemini', 'config', 'mcp_config.json'),
+      path.join(root, '.gemini', 'settings.json'),
+    ],
+  };
+  const configurations = [];
+  for (const file of files[client] ?? []) {
+    try {
+      const stat = await fs.lstat(file);
+      if (!stat.isFile() || stat.isSymbolicLink() || stat.size > 4 * 1024 * 1024)
+        throw new Error('Configuración de permisos no verificable.');
+      configurations.push(hash(await fs.readFile(file)));
+    } catch (error) {
+      if (error.code !== 'ENOENT') throw error;
+      configurations.push('absent');
+    }
+  }
+  // Only digests enter the certificate. Never read authentication files.
+  return hash(
+    JSON.stringify({
+      executable: invocation.executable,
+      args: invocation.args.map((arg) => (arg === root ? '<root>' : arg)),
+      configurations,
+    }),
+  );
+}

package/src/revision-process.js

@@ -0,0 +1,103 @@
+import { spawn as nativeSpawn, execFile } from 'node:child_process';
+import path from 'node:path';
+
+const aborted = () => Object.assign(new Error('Revisión cancelada.'), { code: 'ABORT_ERR' });
+export async function runRevisionProcess(
+  invocation,
+  { prompt, timeoutMs = 900000, signal, spawn = nativeSpawn, maxOutputBytes = 16 * 1024 * 1024 } = {},
+) {
+  if (signal?.aborted) throw aborted();
+  if (!Number.isFinite(timeoutMs) || timeoutMs < 1 || timeoutMs > 900000)
+    throw new Error('Tiempo de revisión inválido.');
+  const input =
+    invocation.inputFormat === 'stream-json'
+      ? JSON.stringify({ event: 'user', message: { role: 'user', content: prompt } }) + '\n'
+      : prompt;
+  return new Promise((resolve, reject) => {
+    let child,
+      failure,
+      timedOut = false,
+      total = 0,
+      killTimer,
+      timer;
+    const stdout = [],
+      stderr = [];
+    const kill = (force) => {
+      if (!child?.pid) return;
+      if (process.platform === 'win32') {
+        const systemRoot = process.env.SystemRoot || 'C:\\Windows';
+        execFile(
+          path.join(systemRoot, 'System32', 'taskkill.exe'),
+          ['/PID', String(child.pid), '/T', '/F'],
+          { windowsHide: true },
+          () => {},
+        );
+      } else {
+        try {
+          process.kill(-child.pid, force ? 'SIGKILL' : 'SIGTERM');
+        } catch (e) {
+          if (e.code !== 'ESRCH') child.kill(force ? 'SIGKILL' : 'SIGTERM');
+        }
+      }
+    };
+    const stop = (error) => {
+      if (failure || timedOut) return;
+      if (error) failure = error;
+      else timedOut = true;
+      kill(false);
+      killTimer = setTimeout(() => kill(true), 250);
+    };
+    const onAbort = () => stop(aborted());
+    const clean = () => {
+      clearTimeout(timer);
+      clearTimeout(killTimer);
+      signal?.removeEventListener('abort', onAbort);
+    };
+    try {
+      child = spawn(invocation.executable, invocation.args, {
+        cwd: invocation.cwd,
+        env: invocation.env,
+        shell: false,
+        detached: process.platform !== 'win32',
+        windowsHide: true,
+        stdio: ['pipe', 'pipe', 'pipe'],
+      });
+    } catch (e) {
+      reject(e);
+      return;
+    }
+    const collect = (target) => (chunk) => {
+      total += Buffer.byteLength(chunk);
+      if (total > maxOutputBytes) {
+        stop(new Error('La salida del revisor supera el límite.'));
+        return;
+      }
+      target.push(Buffer.from(chunk));
+    };
+    child.stdout.on('data', collect(stdout));
+    child.stderr.on('data', collect(stderr));
+    child.on('error', (e) => {
+      failure = e;
+    });
+    child.stdin.on('error', (e) => {
+      if (e.code !== 'EPIPE') stop(e);
+    });
+    child.on('close', (status) => {
+      // A descendant can survive its parent; finish killing the group on cancellation.
+      if (failure || timedOut) kill(true);
+      clean();
+      if (failure) reject(failure);
+      else
+        resolve({
+          status,
+          stdout: Buffer.concat(stdout).toString('utf8'),
+          stderr: Buffer.concat(stderr).toString('utf8'),
+          timedOut,
+        });
+    });
+    timer = setTimeout(() => stop(), timeoutMs);
+    signal?.addEventListener('abort', onAbort, { once: true });
+    if (signal?.aborted) onAbort();
+    child.stdin.end(input, 'utf8');
+  });
+}

package/src/revision-provenance.js

@@ -0,0 +1,89 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+
+// Only the rollout whose metadata matches this execution can provide provenance.
+async function executionEvents({ executionId, homeDirectory }) {
+  if (!/^[A-Za-z0-9_-]{1,128}$/u.test(executionId ?? '') || !homeDirectory) return null;
+  const root = path.join(homeDirectory, '.codex', 'sessions');
+  let visited = 0;
+  const found = [];
+  async function scan(dir, depth = 0) {
+    if (depth > 4 || ++visited > 10000) return;
+    let entries;
+    try {
+      entries = await fs.readdir(dir, { withFileTypes: true });
+    } catch (e) {
+      if (e.code === 'ENOENT') return;
+      throw e;
+    }
+    for (const entry of entries) {
+      if (entry.isSymbolicLink()) continue;
+      const full = path.join(dir, entry.name);
+      if (entry.isDirectory()) await scan(full, depth + 1);
+      else if (entry.isFile() && entry.name.endsWith(`-${executionId}.jsonl`)) found.push(full);
+    }
+  }
+  await scan(root);
+  const matches = [];
+  for (const file of found) {
+    try {
+      if ((await fs.lstat(file)).size > 16 * 1024 * 1024) continue;
+      const events = (await fs.readFile(file, 'utf8'))
+        .split('\n')
+        .filter(Boolean)
+        .map((line) => JSON.parse(line));
+      const meta = events.find((e) => e.type === 'session_meta')?.payload;
+      if (meta?.id !== executionId || meta.originator !== 'codex_exec') continue;
+      matches.push(events);
+    } catch {
+      /* Missing or incomplete provenance is never a guessed model. */
+    }
+  }
+  return matches.length === 1 ? matches[0] : null;
+}
+
+export async function readRevisionProvenance(options) {
+  if (options.client !== 'codex') return null;
+  const events = await executionEvents(options);
+  const turn = events?.findLast((e) => e.type === 'turn_context')?.payload;
+  return typeof turn?.model === 'string' && turn.model
+    ? {
+        model: turn.model,
+        effort: typeof turn.effort === 'string' ? turn.effort : null,
+        source: 'registro de codex',
+      }
+    : null;
+}
+export async function readCodexProbeDenial(options) {
+  const events = await executionEvents(options);
+  function denied(value, depth = 0) {
+    if (depth > 12 || value === null || value === undefined) return false;
+    if (typeof value === 'string') {
+      try {
+        return denied(JSON.parse(value), depth + 1);
+      } catch {
+        return false;
+      }
+    }
+    if (Array.isArray(value)) return value.some((x) => denied(x, depth + 1));
+    if (typeof value === 'object') {
+      if (
+        Number.isInteger(value.exit_code) &&
+        value.exit_code !== 0 &&
+        typeof value.output === 'string' &&
+        /operation not permitted|permission denied|read-only/iu.test(value.output)
+      )
+        return true;
+      return Object.values(value).some((x) => denied(x, depth + 1));
+    }
+    return false;
+  }
+  return (
+    events?.some(
+      (e) =>
+        e.type === 'response_item' &&
+        ['function_call_output', 'custom_tool_call_output'].includes(e.payload?.type) &&
+        denied(e.payload.output),
+    ) ?? false
+  );
+}