novahiz 0.3.2 → 0.3.3

package/dist/commands/inspect.js

@@ -0,0 +1,314 @@
+import { join } from "node:path";
+import { asString, dbPathFor, flagOn, numberFlag, print, readStdin, safeJsonArray } from "./context.js";
+import { loadSpec, NovahizHome } from "../spec.js";
+import { getMeta, openDb, setMeta } from "../db.js";
+import { loadCatalog, loadInstalledSkills, persistCatalog, scanSkills, writeCatalog, writeSkillIndex } from "../catalog.js";
+import { rankSkills } from "../relevance.js";
+import { buildMcpEntries, enabledProviders, installCommands } from "../providers.js";
+import { bootstrapFor, checkDependencies, missingPrerequisites } from "../deps.js";
+import { classify } from "../classify.js";
+import { runCommand, runScript } from "../exec.js";
+import { activeTask, buildWorkPackets, getTask } from "../ledger.js";
+export function commandCheck() {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const index = loadInstalledSkills(spec);
+    const db = openDb(dbPathFor(root, spec));
+    const lastSync = getMeta(db, "last_sync");
+    db.close();
+    print({
+        home: root,
+        categories: spec.categories.length,
+        rules: spec.rules.length,
+        skillRoots: spec.config.skillRoots.length,
+        installedSkills: index.skills.size,
+        indexAvailable: index.available,
+        lastSync,
+        gate: spec.config.gate,
+        classify: spec.config.classify
+    });
+}
+export function commandSync() {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const scanErrors = [];
+    const skills = scanSkills(spec, scanErrors);
+    const indexFile = writeSkillIndex(spec, skills);
+    const catalogFile = writeCatalog(spec, skills);
+    const db = openDb(dbPathFor(root, spec));
+    persistCatalog(db, spec, skills);
+    const lastSync = new Date().toISOString();
+    setMeta(db, "last_sync", lastSync);
+    db.close();
+    print({ root, scanned: skills.length, index: indexFile, catalog: catalogFile, lastSync, scanErrors });
+}
+export function commandClassify(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    // P0-B: --stdin keeps the prompt off argv — argv allowed option injection
+    // (--home), broke past the Windows 32k limit, and leaked the prompt into
+    // the process list. The slice bounds a hostile stdin (full fix in P2-C).
+    const raw = flagOn(parsed, "stdin")
+        ? readStdin().slice(0, 200_000)
+        : parsed.positionals.slice(1).join(" ") || asString(parsed.flags.text);
+    const text = raw.trim();
+    if (text.length === 0) {
+        throw new Error("classify needs a prompt: pass it as an argument or with --text");
+    }
+    const result = classify(spec, text, {
+        minScore: numberFlag(parsed, "min-score", { min: 0 }),
+        maxCategories: numberFlag(parsed, "max-categories", { min: 1, integer: true })
+    });
+    print({ prompt: text, ...result });
+}
+export function commandSkills(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const db = openDb(dbPathFor(root, spec));
+    const rows = db.prepare("SELECT id, name, power, stars, tags, categories FROM skills ORDER BY power DESC, id ASC").all();
+    db.close();
+    const category = asString(parsed.flags.category);
+    const filtered = category.length > 0 ? rows.filter((row) => safeJsonArray(row.categories).includes(category)) : rows;
+    print(filtered.map((row) => ({
+        id: row.id,
+        name: row.name,
+        power: row.power,
+        stars: row.stars,
+        tags: safeJsonArray(row.tags),
+        categories: safeJsonArray(row.categories)
+    })));
+}
+export function commandCategories() {
+    print(loadSpec().categories);
+}
+export function commandRules() {
+    print(loadSpec().rules);
+}
+export function commandSessionLoad(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const session = asString(parsed.flags.session);
+    const skill = asString(parsed.flags.skill);
+    if (session.length === 0 || skill.length === 0) {
+        print({ error: "session-load requires --session and --skill" });
+        process.exitCode = 1;
+        return;
+    }
+    // M12: basic session ID format validation (alphanumeric, hyphens, underscores)
+    if (!/^[a-zA-Z0-9_-]+$/.test(session)) {
+        print({ error: `invalid session ID format: "${session}" (expected alphanumeric, hyphens, underscores)` });
+        process.exitCode = 1;
+        return;
+    }
+    // P0-B: the plugin joins recorded names with commas and the gate re-splits
+    // them — a loose name could inject extra "loaded" skills.
+    if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,127}$/.test(skill)) {
+        print({ error: `invalid skill name format: "${skill.slice(0, 64)}"` });
+        process.exitCode = 1;
+        return;
+    }
+    // P0-B: only skills present in the installed index may count as loaded.
+    // An unreadable index cannot verify anything — accept the record (the gate
+    // degrades on its own side via indexMissing).
+    const installed = loadInstalledSkills(spec);
+    if (installed.available && !installed.skills.has(skill)) {
+        print({ error: `unknown skill "${skill}" — not in the installed index. Run "novahiz sync" to rebuild it.` });
+        process.exitCode = 1;
+        return;
+    }
+    const db = openDb(dbPathFor(root, spec));
+    // H5: ensure session exists for FK compliance
+    const ts = new Date().toISOString();
+    db.prepare("INSERT OR IGNORE INTO sessions (id, categories, required_skills, updated_at) VALUES (?, '[]', '[]', ?)").run(session, ts);
+    db.prepare("INSERT OR IGNORE INTO skill_invocations (session_id, skill, invoked_at) VALUES (?, ?, ?)").run(session, skill, new Date().toISOString());
+    db.close();
+    print({ session, loaded: skill });
+}
+export function commandSessionState(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const session = asString(parsed.flags.session);
+    if (session.length === 0) {
+        print({ error: "session-state requires --session <id>" });
+        process.exitCode = 1;
+        return;
+    }
+    // H6: validate session ID format
+    if (!/^[a-zA-Z0-9_-]+$/.test(session)) {
+        print({ error: `invalid session ID format: "${session}" (expected alphanumeric, hyphens, underscores)` });
+        process.exitCode = 1;
+        return;
+    }
+    const db = openDb(dbPathFor(root, spec));
+    const loaded = db.prepare("SELECT skill FROM skill_invocations WHERE session_id = ?").all(session).map((row) => row.skill);
+    const state = db.prepare("SELECT categories, required_skills FROM sessions WHERE id = ?").get(session);
+    db.close();
+    print({ session, loaded, categories: state ? safeJsonArray(state.categories) : [], requiredSkills: state ? safeJsonArray(state.required_skills) : [] });
+}
+export function commandCatalog(parsed) {
+    const spec = loadSpec();
+    const query = parsed.positionals.slice(1).join(" ") || asString(parsed.flags.query);
+    const limitRaw = numberFlag(parsed, "limit", { min: 1, integer: true });
+    const limit = limitRaw !== undefined && limitRaw > 0 ? limitRaw : 10;
+    const catalog = loadCatalog(spec);
+    const results = rankSkills(catalog, query, limit);
+    const hint = catalog.length === 0 ? "catalog is empty; run `novahiz sync` to build it" : undefined;
+    print({ query, total: catalog.length, results, ...(hint ? { hint } : {}) });
+}
+export function commandRoadmap(parsed) {
+    const spec = loadSpec();
+    const categoryId = asString(parsed.flags.category);
+    const query = parsed.positionals.slice(1).join(" ") || asString(parsed.flags.query);
+    let category = categoryId ? spec.categories.find((entry) => entry.id === categoryId) : undefined;
+    if (!category && query.length > 0) {
+        const result = classify(spec, query);
+        category = spec.categories.find((entry) => entry.id === result.primary);
+    }
+    if (!category) {
+        print({ error: "roadmap requires --category <id> or a query" });
+        process.exitCode = 1;
+        return;
+    }
+    print({ category: category.id, roadmap: category.roadmap ?? null });
+}
+export function commandStep(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const session = asString(parsed.flags.session);
+    const done = asString(parsed.flags.done);
+    if (session.length === 0) {
+        print({ error: "step requires --session <id>" });
+        process.exitCode = 1;
+        return;
+    }
+    // H6: validate session ID format
+    if (!/^[a-zA-Z0-9_-]+$/.test(session)) {
+        print({ error: `invalid session ID format: "${session}" (expected alphanumeric, hyphens, underscores)` });
+        process.exitCode = 1;
+        return;
+    }
+    const db = openDb(dbPathFor(root, spec));
+    if (done.length > 0) {
+        const ts = new Date().toISOString();
+        // roadmap_progress.session_id has a foreign key to sessions(id):
+        // ensure the session row exists before recording a step.
+        db.prepare("INSERT OR IGNORE INTO sessions (id, categories, required_skills, updated_at) VALUES (?, '[]', '[]', ?)").run(session, ts);
+        db.prepare("INSERT INTO roadmap_progress (session_id, step_id, status, updated_at) VALUES (?, ?, 'done', ?) ON CONFLICT(session_id, step_id) DO UPDATE SET status = 'done', updated_at = excluded.updated_at").run(session, done, new Date().toISOString());
+    }
+    const steps = db.prepare("SELECT step_id, status, updated_at FROM roadmap_progress WHERE session_id = ? ORDER BY updated_at").all(session);
+    db.close();
+    print({ session, steps });
+}
+export function commandProviders(parsed) {
+    const spec = loadSpec();
+    if (parsed.flags["mcp-json"]) {
+        print(buildMcpEntries(spec));
+        return;
+    }
+    if (parsed.flags.install) {
+        const results = [];
+        for (const entry of installCommands(spec)) {
+            const [command, ...args] = entry.command;
+            const result = runCommand(command, args);
+            process.stdout.write(`${result.ok ? "ok  " : "fail"} ${entry.id} (${entry.kind}) ${entry.command.join(" ")}\n`);
+            if (!result.ok && result.stderr)
+                process.stderr.write(result.stderr);
+            results.push({ id: entry.id, kind: entry.kind, source: entry.source, command: entry.command.join(" "), ok: result.ok, error: result.error ?? null });
+        }
+        print(results);
+        return;
+    }
+    const category = asString(parsed.flags.category);
+    const query = parsed.positionals.slice(1).join(" ") || asString(parsed.flags.query);
+    let list = spec.providers;
+    if (category.length > 0) {
+        list = list.filter((provider) => (provider.categories ?? []).includes(category));
+    }
+    else if (query.length > 0) {
+        const ids = new Set(classify(spec, query).providers);
+        list = list.filter((provider) => ids.has(provider.id));
+    }
+    const enabled = new Set(enabledProviders(spec).map((provider) => provider.id));
+    print(list.map((provider) => ({
+        id: provider.id,
+        label: provider.label,
+        kind: provider.kind,
+        transport: provider.transport ?? null,
+        purpose: provider.purpose ?? "",
+        categories: provider.categories ?? [],
+        source: provider.source ?? "",
+        enabled: enabled.has(provider.id)
+    })));
+}
+export function commandDeps(parsed) {
+    const spec = loadSpec();
+    const status = checkDependencies(spec);
+    if (!parsed.flags.install) {
+        print({ node: process.version, platform: process.platform, dependencies: status });
+        return;
+    }
+    const run = (command, label) => {
+        const [bin, ...args] = command;
+        const result = runCommand(bin, args);
+        process.stdout.write(`${result.ok ? "ok  " : "fail"} ${label}\n`);
+        if (!result.ok && result.stderr)
+            process.stderr.write(result.stderr);
+        if (result.error)
+            process.stderr.write(`${result.error}\n`);
+        return result.ok;
+    };
+    const runBootstrap = (argv, label) => {
+        const result = runScript(argv);
+        process.stdout.write(`${result.ok ? "ok  " : "fail"} ${label}\n`);
+        if (!result.ok && result.stderr)
+            process.stderr.write(result.stderr);
+        if (result.error)
+            process.stderr.write(`${result.error}\n`);
+        return result.ok;
+    };
+    const results = [];
+    for (const entry of missingPrerequisites(spec)) {
+        const bootstrap = bootstrapFor(entry.provider);
+        if (!bootstrap || bootstrap.length === 0) {
+            results.push({ provider: entry.provider.id, step: "bootstrap", ok: false, note: `missing ${entry.missing.join(", ")}` });
+            continue;
+        }
+        results.push({ provider: entry.provider.id, step: "bootstrap", command: bootstrap.join(" "), ok: runBootstrap(bootstrap, `bootstrap ${entry.provider.id}`) });
+    }
+    for (const entry of installCommands(spec)) {
+        results.push({ provider: entry.id, step: "install", command: entry.command.join(" "), ok: run(entry.command, `install ${entry.id}`) });
+    }
+    print(results);
+}
+export function commandDispatch(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const session = asString(parsed.flags.session);
+    const db = openDb(dbPathFor(root, spec));
+    try {
+        const taskId = asString(parsed.flags.task) || activeTask(db, session || undefined)?.id;
+        if (!taskId) {
+            print({ error: "dispatch requires --task or an active task" });
+            process.exitCode = 1;
+            return;
+        }
+        const packets = buildWorkPackets(db, taskId);
+        const ownership = new Map();
+        for (const packet of packets) {
+            for (const file of packet.files) {
+                ownership.set(file, [...(ownership.get(file) ?? []), packet.todo]);
+            }
+        }
+        const conflicts = [...ownership.entries()]
+            .filter(([, owners]) => owners.length > 1)
+            .map(([file, owners]) => ({ file, todos: owners }));
+        print({ task: getTask(db, taskId), packets, conflicts });
+    }
+    catch (error) {
+        print({ error: String(error?.message ?? error) });
+        process.exitCode = 1;
+    }
+    finally {
+        db.close();
+    }
+}

package/dist/commands/report.js

@@ -0,0 +1,87 @@
+import { join } from "node:path";
+import { asString, dbPathFor, emit, parse } from "./context.js";
+import { loadSpec, NovahizHome } from "../spec.js";
+import { openDb } from "../db.js";
+import * as ui from "../render.js";
+export function commandReport(parsed) {
+    const root = NovahizHome();
+    const spec = loadSpec(root);
+    const db = openDb(dbPathFor(root, spec));
+    const total = db.prepare("SELECT COUNT(*) AS n FROM enforcement_log").get().n;
+    const decisions = db.prepare("SELECT decision, COUNT(*) AS n FROM enforcement_log GROUP BY decision").all();
+    const byTool = db.prepare("SELECT tool, COUNT(*) AS n FROM enforcement_log GROUP BY tool ORDER BY n DESC").all();
+    const byClass = db.prepare("SELECT file_class, COUNT(*) AS n FROM enforcement_log GROUP BY file_class ORDER BY n DESC").all();
+    const missingRows = db.prepare("SELECT missing FROM enforcement_log").all();
+    const invocations = db.prepare("SELECT COUNT(*) AS n FROM skill_invocations").get().n;
+    const topSkills = db.prepare("SELECT skill, COUNT(*) AS n FROM skill_invocations GROUP BY skill ORDER BY n DESC LIMIT 10").all();
+    const roadmapDone = db.prepare("SELECT COUNT(*) AS n FROM roadmap_progress").get().n;
+    const roadmapBySession = db.prepare("SELECT session_id, COUNT(*) AS n FROM roadmap_progress GROUP BY session_id ORDER BY n DESC LIMIT 10").all();
+    const taskCount = db.prepare("SELECT COUNT(*) AS n FROM tasks").get().n;
+    const activeTasks = db.prepare("SELECT COUNT(*) AS n FROM tasks WHERE status = 'active'").get().n;
+    const todoCount = db.prepare("SELECT COUNT(*) AS n FROM todos").get().n;
+    const completedTodos = db.prepare("SELECT COUNT(*) AS n FROM todos WHERE status = 'done'").get().n;
+    db.close();
+    const counts = {};
+    for (const row of missingRows) {
+        let list = [];
+        try {
+            list = JSON.parse(row.missing);
+        }
+        catch {
+            list = [];
+        }
+        for (const skill of list)
+            counts[skill] = (counts[skill] ?? 0) + 1;
+    }
+    const topMissing = Object.entries(counts)
+        .sort((a, b) => b[1] - a[1] || (a[0] < b[0] ? -1 : 1))
+        .slice(0, 10)
+        .map(([skill, n]) => ({ skill, n }));
+    const report = { total, invocations, roadmapDone, tasks: taskCount, activeTasks, todos: todoCount, completedTodos, providers: spec.providers.map((provider) => provider.id), decisions, byTool, byClass, topMissing, topSkills, roadmapBySession };
+    if (asString(parsed.flags.format) === "markdown") {
+        const lines = [
+            "# novahiz report",
+            "",
+            `Enforcement entries: ${total}`,
+            `Skill invocations: ${invocations}`,
+            `Roadmap steps done: ${roadmapDone}`,
+            `Tasks: ${taskCount} (${activeTasks} active)`,
+            `Todos: ${todoCount} (${completedTodos} done)`,
+            "",
+            "## Decisions",
+            ...decisions.map((row) => `- ${row.decision}: ${row.n}`),
+            "",
+            "## Top missing skills",
+            ...topMissing.map((entry) => `- ${entry.skill}: ${entry.n}`),
+            "",
+            "## Top loaded skills",
+            ...topSkills.map((row) => `- ${row.skill}: ${row.n}`),
+            ""
+        ];
+        process.stdout.write(`${lines.join("\n")}\n`);
+        return;
+    }
+    emit(parsed, report, () => [
+        ui.heading("novahiz report"),
+        ui.kv([
+            ["Enforcement log", String(total)],
+            ["Skill invocations", String(invocations)],
+            ["Roadmap steps completed", String(roadmapDone)],
+            ["Tasks", `${taskCount} (${activeTasks} active)`],
+            ["Todos", `${todoCount} (${completedTodos} done)`],
+            ["Providers", String(spec.providers.length)]
+        ]),
+        "",
+        ui.heading("Decisions"),
+        ui.table(["decision", "n"], decisions.map((row) => [row.decision, String(row.n)])),
+        "",
+        ui.heading("Tools"),
+        ui.table(["tool", "n"], byTool.map((row) => [String(row.tool), String(row.n)])),
+        "",
+        ui.heading("Most expected skills"),
+        ui.table(["skill", "n"], topMissing.map((entry) => [entry.skill, String(entry.n)])),
+        "",
+        ui.heading("Most loaded skills"),
+        ui.table(["skill", "n"], topSkills.map((row) => [row.skill, String(row.n)]))
+    ].join("\n"));
+}