novahiz 0.1.0

package/src/commands/context.ts

@@ -0,0 +1,130 @@
+import { existsSync, mkdirSync, readFileSync, readdirSync, chmodSync } from "node:fs";
+import { resolve as resolvePath, join } from "node:path";
+import { homedir } from "node:os";
+import { fileURLToPath } from "node:url";
+import type { Spec } from "../spec.ts";
+
+export interface Parsed {
+  positionals: string[];
+  flags: Record<string, string | boolean>;
+}
+
+export function parse(argv: string[]): Parsed {
+  const flags: Record<string, string | boolean> = {};
+  const positionals: string[] = [];
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (!arg.startsWith("--")) {
+      positionals.push(arg);
+      continue;
+    }
+    const equals = arg.indexOf("=");
+    if (equals !== -1) {
+      flags[arg.slice(2, equals)] = arg.slice(equals + 1);
+      continue;
+    }
+    const next = argv[index + 1];
+    if (next !== undefined && !next.startsWith("--")) {
+      flags[arg.slice(2)] = next;
+      index += 1;
+    } else {
+      flags[arg.slice(2)] = true;
+    }
+  }
+  return { positionals, flags };
+}
+
+export function asString(value: unknown): string {
+  if (value === undefined || value === null) return "";
+  if (typeof value === "string") return value;
+  return String(value);
+}
+
+export function splitList(value: string | boolean | undefined): string[] {
+  if (typeof value !== "string" || value.length === 0) return [];
+  return value.split(",").map((v) => v.trim()).filter(Boolean);
+}
+
+export function print(output: unknown): void {
+  const record = (typeof output === "object" && output !== null ? output : {}) as Record<string, unknown>;
+  if (typeof record.name === "string" && Array.isArray(record.commands)) {
+    console.log(record.name);
+    for (const cmd of record.commands) console.log("  " + cmd);
+  } else {
+    process.stdout.write(JSON.stringify(output) + "\n");
+  }
+}
+
+export function flagOn(parsed: Parsed, name: string): boolean {
+  const value = parsed.flags[name];
+  if (value === true) return true;
+  if (value === false) return false;
+  if (typeof value === "string" && value.length > 0) return true;
+  return false;
+}
+
+export function humanMode(parsed: Parsed): boolean {
+  process.stdout.write("Plan mode: read-only. No application files will be written.\n");
+  return true;
+}
+
+export function emit(parsed: Parsed, value: unknown, textFn: () => string): void {
+  const format = String(parsed.flags.format ?? "").toLowerCase();
+  const asJson = format === "json" || parsed.flags.json === true;
+  if (asJson) {
+    process.stdout.write(JSON.stringify(value, null, 2) + "\n");
+  } else {
+    process.stdout.write(textFn() + "\n");
+  }
+}
+
+export function confirm(question: string): boolean {
+  process.stdout.write(question + " [y/N] ");
+  const answer = process.stdin.read()?.toString().trim().toLowerCase();
+  return answer === "y" || answer === "yes" || answer === "oui";
+}
+
+export function safeJsonArray(value: string): unknown[] {
+  return JSON.parse(value);
+}
+
+export function dbPathFor(root: string, spec: Spec): string {
+  return resolvePath(root, spec.config.dbPath);
+}
+
+export function readStdin(): string {
+  // A single synchronous stdin read races with pipe delivery and can return null even when input was provided.
+  if (process.stdin.isTTY) return "";
+  try {
+    return readFileSync(0, 'utf8');
+  } catch {
+    return "";
+  }
+}
+
+export function numberFlag(
+  parsed: Parsed,
+  name: string,
+  opts: { min?: number; integer?: boolean; label?: string } = {},
+): number | undefined {
+  const raw = parsed.flags[name];
+  if (raw === undefined || raw === false) return undefined;
+  const label = opts.label ?? name;
+  const num = Number(raw);
+  if (Number.isNaN(num)) {
+    process.stderr.write(`Valeur invalide pour --${label}: "${raw}" n'est pas un nombre.\n`);
+    process.exitCode = 1;
+    return undefined;
+  }
+  if (opts.integer && !Number.isInteger(num)) {
+    process.stderr.write(`Valeur invalide pour --${label}: un nombre entier est requis, pas "${raw}".\n`);
+    process.exitCode = 1;
+    return undefined;
+  }
+  if (opts.min !== undefined && num < opts.min) {
+    process.stderr.write(`Valeur invalide pour --${label}: ${num} est inferieur a la limite minimale de ${opts.min}.\n`);
+    process.exitCode = 1;
+    return undefined;
+  }
+  return num;
+}

package/src/commands/doctor.ts

@@ -0,0 +1,191 @@
+import { existsSync, readFileSync, statSync } from "node:fs";
+import { spawnSync } from "node:child_process";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { dbPathFor, emit, type Parsed } from "./context.ts";
+import { loadSpec, novahizHome } from "../spec.ts";
+import { openDb, SCHEMA_VERSION } from "../db.ts";
+import { loadInstalledSkills } from "../catalog.ts";
+import { evaluateGate } from "../gate.ts";
+import * as ui from "../render.ts";
+
+type DoctorCheck = { id: string; label: string; ok: boolean; detail: string; blocking: boolean };
+
+const SKILL_CLI: Record<string, string> = { defuddle: "defuddle" };
+
+function hasCommand(name: string): boolean {
+  const probe = process.platform === "win32" ? "where" : "which";
+  const result = spawnSync(probe, [name], { encoding: "utf8", shell: false });
+  return result.status === 0;
+}
+
+export function grantsQuestionIn(agentFile: string): boolean {
+  return /^\s*question:\s*allow\s*$/m.test(agentFile);
+}
+
+function referencedSkills(spec: ReturnType<typeof loadSpec>): string[] {
+  const ids = new Set<string>();
+  for (const category of spec.categories) {
+    for (const skill of category.defaultSkills ?? []) ids.add(skill);
+    for (const step of category.roadmap?.steps ?? []) {
+      for (const skill of step.requireSkills ?? []) ids.add(skill);
+    }
+  }
+  for (const rule of spec.rules) for (const skill of rule.require) ids.add(skill);
+  for (const provider of spec.providers) if (provider.kind === "skill") ids.add(provider.id);
+  return [...ids].sort();
+}
+
+export function commandDoctor(parsed: Parsed): void {
+  const root = novahizHome();
+  const spec = loadSpec(root);
+  const checks: DoctorCheck[] = [];
+
+  const parts = process.versions.node.split(".").map((value) => Number(value));
+  const nodeOk = parts[0] > 22 || (parts[0] === 22 && parts[1] >= 18);
+  checks.push({ id: "node", label: "Node 22.18+", ok: nodeOk, detail: `v${process.versions.node}`, blocking: true });
+  checks.push({ id: "npx", label: "npx disponible", ok: hasCommand("npx"), detail: "requis par les providers MCP", blocking: true });
+
+  const index = loadInstalledSkills(spec);
+  checks.push({
+    id: "index",
+    label: "Index des skills",
+    ok: index.available,
+    detail: index.available ? `${index.skills.size} skills` : "build/installed-skills.json illisible, lance novahiz sync",
+    blocking: true
+  });
+
+  const referenced = referencedSkills(spec);
+  const absent = index.available ? referenced.filter((id) => !index.skills.has(id)) : [];
+  checks.push({
+    id: "referenced",
+    label: "Skills referencees",
+    ok: absent.length === 0,
+    detail: absent.length === 0 ? `${referenced.length} presentes` : `absentes de l'index: ${absent.join(", ")}`,
+    blocking: absent.length > 0
+  });
+
+  const missingCli = Object.entries(SKILL_CLI)
+    .filter(([skill]) => referenced.includes(skill) && !hasCommand(skill))
+    .map(([, cli]) => cli);
+  checks.push({
+    id: "cli",
+    label: "CLI externes requises",
+    ok: missingCli.length === 0,
+    detail: missingCli.length === 0 ? "toutes presentes" : `introuvables: ${missingCli.join(", ")}`,
+    blocking: missingCli.length > 0
+  });
+
+  const probe = evaluateGate({
+    tool: "edit",
+    filePath: "README.md",
+    content: "texte",
+    categories: [],
+    loadedSkills: [],
+    installedSkills: index.skills,
+    installedIndexAvailable: index.available,
+    spec
+  });
+  const gateOk = spec.rules.length > 0 && probe.allow === false && probe.missingSkills.length > 0;
+  checks.push({
+    id: "gate",
+    label: "Gate operationnel",
+    ok: gateOk,
+    detail: gateOk ? `bloque une ecriture sans skill chargee (${probe.missingSkills.join(", ")})` : "n'a pas bloque une ecriture sans skill chargee",
+    blocking: true
+  });
+
+  const dbFile = dbPathFor(root, spec);
+  let dbOk = false;
+  let dbDetail = "absente";
+  try {
+    const size = statSync(dbFile).size;
+    const db = openDb(dbFile);
+    db.prepare("SELECT COUNT(*) AS n FROM enforcement_log").get();
+    db.close();
+    dbOk = true;
+    dbDetail = ui.bytes(size);
+  } catch (error) {
+    dbDetail = `illisible: ${(error as Error).message}`;
+  }
+  checks.push({ id: "db", label: "Base du registre", ok: dbOk, detail: dbDetail, blocking: false });
+
+  // Informational only: openDb migrates on open, so the stored version always
+  // matches by the time this reads it. The value is read so a future migration
+  // has something to branch on, and so a database from an older build shows up.
+  let schemaDetail = "base illisible";
+  try {
+    const db = openDb(dbFile);
+    const row = db.prepare("PRAGMA user_version").get() as { user_version?: number } | undefined;
+    const version = Number(row?.user_version ?? 0);
+    db.close();
+    schemaDetail = `version ${version} (attendue ${SCHEMA_VERSION})`;
+  } catch (error) {
+    schemaDetail = `illisible: ${(error as Error).message}`;
+  }
+  checks.push({ id: "schema", label: "Version du schema", ok: true, detail: schemaDetail, blocking: false });
+
+  const adapterSource = join(root, "adapters", "opencode", "novahiz.ts");
+  const opencodeDir =
+    process.env.OPENCODE_CONFIG_DIR && process.env.OPENCODE_CONFIG_DIR.length > 0
+      ? process.env.OPENCODE_CONFIG_DIR
+      : join(homedir(), ".config", "opencode");
+  const adapterInstalled = join(opencodeDir, "plugins", "novahiz.ts");
+  let adapterOk = true;
+  let adapterDetail = "aucune copie installee";
+  if (existsSync(adapterSource) && existsSync(adapterInstalled)) {
+    adapterOk = readFileSync(adapterSource, "utf8") === readFileSync(adapterInstalled, "utf8");
+    adapterDetail = adapterOk ? "copie harnais a jour" : "copie harnais perimee, relance l'installeur puis redemarre opencode";
+  }
+  checks.push({ id: "adapter", label: "Copie harnais du plugin", ok: adapterOk, detail: adapterDetail, blocking: false });
+
+  const agentSource = join(root, "adapters", "opencode", "agent", "novahiz-agent.md");
+  const agentInstalled = join(opencodeDir, "agent", "novahiz-agent.md");
+  let agentOk = true;
+  let agentDetail = "aucune copie installee";
+  if (existsSync(agentSource) && existsSync(agentInstalled)) {
+    const installed = readFileSync(agentInstalled, "utf8");
+    const inSync = installed === readFileSync(agentSource, "utf8");
+    const grantsQuestion = grantsQuestionIn(installed);
+    agentOk = inSync && grantsQuestion;
+    agentDetail = !inSync
+      ? "copie harnais perimee, relance l'installeur puis redemarre opencode"
+      : grantsQuestion
+        ? "copie harnais a jour, question autorise"
+        : "la copie harnais n'autorise pas question: le pipeline ne peut pas interroger";
+  }
+  checks.push({ id: "agent", label: "Copie harnais de l'agent", ok: agentOk, detail: agentDetail, blocking: false });
+
+  const failing = checks.filter((check) => !check.ok);
+  const blocking = failing.filter((check) => check.blocking);
+  const value = {
+    home: root,
+    node: process.versions.node,
+    platform: process.platform,
+    checks,
+    failing: failing.map((check) => check.id),
+    blocking: blocking.map((check) => check.id)
+  };
+
+  emit(parsed, value, () =>
+    [
+      ui.heading("Novahiz doctor"),
+      ui.kv([
+        ["Maison", root],
+        ["Plateforme", process.platform]
+      ]),
+      "",
+      ui.table(
+        ["controle", "etat", "detail"],
+        checks.map((check) => [check.label, check.ok ? ui.status(true) : ui.status(false), check.detail])
+      ),
+      "",
+      blocking.length > 0
+        ? ui.style("red", `${blocking.length} anomalie(s) bloquante(s): ${blocking.map((check) => check.id).join(", ")}`)
+        : ui.style("green", "Aucune anomalie bloquante.")
+    ].join("\n")
+  );
+
+  if (blocking.length > 0) process.exitCode = 1;
+}
+

package/src/commands/gate.ts

@@ -0,0 +1,192 @@
+import { join } from "node:path";
+import { asString, dbPathFor, parse, print, readStdin, splitList, type Parsed } from "./context.ts";
+import { loadSpec, novahizHome } from "../spec.ts";
+import { openDb } from "../db.ts";
+import { loadInstalledSkills } from "../catalog.ts";
+import { changeText } from "../content.ts";
+import { evaluateGate } from "../gate.ts";
+import { extractTargetPaths } from "../targets.ts";
+import { activeTask, recordEdit, reviewDue, traceCheck } from "../ledger.ts";
+
+export function commandGate(parsed: Parsed): void {
+  const root = novahizHome();
+  const spec = loadSpec(root);
+  const gateConfig = spec.config.gate;
+  const tool = asString(parsed.flags.tool) || "edit";
+  const categories = splitList(parsed.flags.categories);
+  let loaded = splitList(parsed.flags.loaded);
+  const session = asString(parsed.flags.session);
+  if (loaded.length === 0 && session.length > 0) {
+    const db = openDb(dbPathFor(root, spec));
+    const rows = db.prepare("SELECT skill FROM skill_invocations WHERE session_id = ?").all(session) as { skill: string }[];
+    db.close();
+    loaded = rows.map((row) => row.skill);
+  }
+
+  if (gateConfig.enabled === false) {
+    print({ allow: true, disabled: true, tool });
+    return;
+  }
+  const escapeValue = (process.env[gateConfig.envEscape] || "").toLowerCase();
+  if (["off", "0", "false", "no", "disabled"].includes(escapeValue)) {
+    print({ allow: true, disabled: true });
+    return;
+  }
+
+  const gated = gateConfig.tools.includes(tool);
+  if (!gated) {
+    print({ allow: true, tool, reason: "tool is not gated" });
+    return;
+  }
+
+  const single = asString(parsed.flags.file);
+  let content = asString(parsed.flags.content);
+  let paths: string[];
+  if (single.length > 0) {
+    paths = [single];
+  } else if (parsed.flags["args-stdin"]) {
+    let args: unknown = {};
+    const raw = readStdin().trim();
+    if (raw.length > 0) {
+      try {
+        args = JSON.parse(raw);
+      } catch {
+        process.stderr.write("Novahiz: invalid JSON on stdin for --args-stdin\n");
+        process.exitCode = 1;
+        return;
+      }
+    }
+    paths = extractTargetPaths(tool, args);
+    if (content.length === 0) content = changeText(tool, args);
+  } else {
+    process.stderr.write("Novahiz: gate requires --file <path> or --args-stdin\n");
+    process.exitCode = 1;
+    return;
+  }
+
+  if (paths.length === 0) {
+    const writeTools = ["edit", "write", "patch", "apply_patch"];
+    if (writeTools.includes(tool)) {
+      print({
+        allow: false,
+        tool,
+        targets: [],
+        requiredSkills: [],
+        missingSkills: [],
+        reasons: ["no target path for a write tool"]
+      });
+      if (gateConfig.mode === "block") process.exitCode = 2;
+      return;
+    }
+    print({ allow: true, tool, targets: [], requiredSkills: [], missingSkills: [], reason: "no target path" });
+    return;
+  }
+
+  const index = loadInstalledSkills(spec);
+  const results = paths.map((filePath) => ({
+    path: filePath,
+    ...evaluateGate({
+      tool,
+      filePath,
+      content,
+      categories,
+      loadedSkills: loaded,
+      installedSkills: index.skills,
+      installedIndexAvailable: index.available,
+      spec
+    })
+  }));
+
+  const reasons: string[] = [];
+  const traceConfig = gateConfig.trace;
+  const traceRequired =
+    traceConfig?.enabled === true &&
+    session.length > 0 &&
+    categories.some((category) => traceConfig.categories.includes(category));
+  if (traceRequired) {
+    const db = openDb(dbPathFor(root, spec));
+    for (const entry of results) {
+      const trace = traceCheck(db, { sessionId: session, filePath: entry.path, required: true });
+      if (!trace.ok) {
+        entry.allow = false;
+        reasons.push(trace.reason);
+      }
+    }
+    db.close();
+  }
+
+  const ledgerConfig = spec.config.ledger;
+  if (ledgerConfig?.enabled !== false) {
+    const db = openDb(dbPathFor(root, spec));
+    const task = activeTask(db, session || undefined);
+    if (task) {
+      if (["edit", "write", "patch", "apply_patch"].includes(tool)) recordEdit(db, task.id);
+      const due = reviewDue(db, task.id, ledgerConfig.review);
+      if (due.due) {
+        for (const entry of results) entry.allow = false;
+        reasons.push(due.reason);
+      }
+    }
+    db.close();
+  }
+
+  const allow = results.every((entry) => entry.allow);
+  const requiredSkills = [...new Set(results.flatMap((entry) => entry.requiredSkills))];
+  const missingSkills = [...new Set(results.flatMap((entry) => entry.missingSkills))];
+  const unmatchedRequired = [...new Set(results.flatMap((entry) => entry.unmatchedRequired))];
+  const indexMissing = results.some((entry) => entry.indexMissing);
+
+  const warnings: string[] = [];
+  if (unmatchedRequired.length > 0) {
+    warnings.push(
+      `skills requises absentes de l'index, donc non appliquees : ${unmatchedRequired.join(", ")}. Relance novahiz sync pour realigner l'index.`
+    );
+  }
+  if (indexMissing) {
+    warnings.push("index des skills illisible : toutes les skills requises sont exigees.");
+  }
+
+  if (session.length > 0) {
+    const db = openDb(dbPathFor(root, spec));
+    db.prepare(
+      "INSERT INTO enforcement_log (session_id, tool, file_path, file_class, decision, missing, matched_rules, logged_at) VALUES (?, ?, ?, ?, ?, ?, ?, ?)"
+    ).run(
+      session,
+      tool,
+      paths.join(","),
+      results[0]?.fileClass ?? "other",
+      allow ? "allow" : gateConfig.mode === "block" ? "block" : gateConfig.mode,
+      JSON.stringify(missingSkills),
+      JSON.stringify(results.flatMap((entry) => entry.matchedRules)),
+      new Date().toISOString()
+    );
+    db.close();
+  }
+
+  print({
+    allow,
+    tool,
+    mode: gateConfig.mode,
+    indexMissing,
+    requiredSkills,
+    missingSkills,
+    unmatchedRequired,
+    warnings,
+    reasons,
+    targets: results.map((entry) => ({
+      path: entry.path,
+      fileClass: entry.fileClass,
+      ignored: entry.ignored,
+      roadmap: entry.roadmap,
+      requiredSkills: entry.requiredSkills,
+      missingSkills: entry.missingSkills,
+      unmatchedRequired: entry.unmatchedRequired,
+      placeholder: entry.placeholder,
+      reasons: entry.reasons,
+      matchedRules: entry.matchedRules
+    }))
+  });
+
+  if (!allow && gateConfig.mode === "block") process.exitCode = 2;
+}
+