oxe-cc 0.9.3 → 1.2.1

package/lib/runtime/audit/audit-trail.js

@@ -0,0 +1,154 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.AuditTrail = void 0;
+exports.createQuota = createQuota;
+exports.checkQuota = checkQuota;
+exports.consumeQuota = consumeQuota;
+const crypto_1 = __importDefault(require("crypto"));
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+const ACTION_SEVERITY = {
+    run_started: 'info',
+    run_completed: 'info',
+    run_paused: 'info',
+    run_recovered: 'warn',
+    gate_requested: 'warn',
+    gate_resolved: 'info',
+    policy_denied: 'warn',
+    plugin_registered: 'info',
+    plugin_invoked: 'info',
+    secret_accessed: 'critical',
+    infra_mutation: 'critical',
+    pr_created: 'info',
+    merge_approved: 'warn',
+    merge_blocked: 'warn',
+};
+class AuditTrail {
+    constructor(projectRoot, remoteSink) {
+        this.projectRoot = projectRoot;
+        this.remoteSink = remoteSink;
+    }
+    record(action, actor, options = {}) {
+        const entry = {
+            audit_id: `aud-${crypto_1.default.randomBytes(4).toString('hex')}`,
+            action,
+            severity: ACTION_SEVERITY[action],
+            run_id: options.runId ?? null,
+            work_item_id: options.workItemId ?? null,
+            actor,
+            resource: options.resource ?? null,
+            detail: options.detail ?? {},
+            timestamp: new Date().toISOString(),
+        };
+        this.append(entry);
+        return entry;
+    }
+    query(filter = {}) {
+        return this.load().filter((e) => {
+            if (filter.action && e.action !== filter.action)
+                return false;
+            if (filter.severity && e.severity !== filter.severity)
+                return false;
+            if (filter.runId && e.run_id !== filter.runId)
+                return false;
+            if (filter.since && e.timestamp < filter.since)
+                return false;
+            return true;
+        });
+    }
+    critical() {
+        return this.query({ severity: 'critical' });
+    }
+    metrics() {
+        const entries = this.load();
+        const by_action = {};
+        const actorSet = new Set();
+        let oldest = null;
+        let newest = null;
+        let critical_count = 0;
+        let warn_count = 0;
+        for (const e of entries) {
+            by_action[e.action] = (by_action[e.action] ?? 0) + 1;
+            actorSet.add(e.actor);
+            if (e.severity === 'critical')
+                critical_count++;
+            if (e.severity === 'warn')
+                warn_count++;
+            if (!oldest || e.timestamp < oldest)
+                oldest = e.timestamp;
+            if (!newest || e.timestamp > newest)
+                newest = e.timestamp;
+        }
+        return {
+            total_entries: entries.length,
+            critical_count,
+            warn_count,
+            by_action,
+            actors: [...actorSet],
+            oldest,
+            newest,
+        };
+    }
+    append(entry) {
+        const p = this.trailPath();
+        fs_1.default.mkdirSync(path_1.default.dirname(p), { recursive: true });
+        fs_1.default.appendFileSync(p, JSON.stringify(entry) + '\n', 'utf8');
+        // Fire-and-forget remote sink (failures are non-fatal)
+        if (this.remoteSink) {
+            this.remoteSink.write(entry).catch(() => { });
+        }
+    }
+    load() {
+        const p = this.trailPath();
+        if (!fs_1.default.existsSync(p))
+            return [];
+        try {
+            return fs_1.default
+                .readFileSync(p, 'utf8')
+                .split('\n')
+                .filter(Boolean)
+                .map((line) => JSON.parse(line));
+        }
+        catch {
+            return [];
+        }
+    }
+    trailPath() {
+        return path_1.default.join(this.projectRoot, '.oxe', 'AUDIT-TRAIL.ndjson');
+    }
+}
+exports.AuditTrail = AuditTrail;
+// ─── RunQuota ─────────────────────────────────────────────────────────────────
+function createQuota(runId, limits = {}) {
+    return {
+        run_id: runId,
+        max_work_items: limits.max_work_items ?? Infinity,
+        max_mutations: limits.max_mutations ?? Infinity,
+        max_retries_total: limits.max_retries_total ?? Infinity,
+        consumed_work_items: 0,
+        consumed_mutations: 0,
+        consumed_retries: 0,
+    };
+}
+function checkQuota(quota) {
+    if (quota.consumed_work_items > quota.max_work_items) {
+        return { quota_type: 'work_items', limit: quota.max_work_items, consumed: quota.consumed_work_items };
+    }
+    if (quota.consumed_mutations > quota.max_mutations) {
+        return { quota_type: 'mutations', limit: quota.max_mutations, consumed: quota.consumed_mutations };
+    }
+    if (quota.consumed_retries > quota.max_retries_total) {
+        return { quota_type: 'retries', limit: quota.max_retries_total, consumed: quota.consumed_retries };
+    }
+    return null;
+}
+function consumeQuota(quota, type, amount = 1) {
+    switch (type) {
+        case 'work_items': return { ...quota, consumed_work_items: quota.consumed_work_items + amount };
+        case 'mutations': return { ...quota, consumed_mutations: quota.consumed_mutations + amount };
+        case 'retries': return { ...quota, consumed_retries: quota.consumed_retries + amount };
+    }
+}

package/lib/runtime/audit/index.d.ts

@@ -0,0 +1,2 @@
+export * from './audit-trail';
+export * from './policy-pack';

package/lib/runtime/audit/index.js

@@ -0,0 +1,18 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./audit-trail"), exports);
+__exportStar(require("./policy-pack"), exports);

package/lib/runtime/audit/policy-pack.d.ts

@@ -0,0 +1,15 @@
+import type { PolicyRule, EnvironmentGuardrail } from '../policy/policy-engine';
+import { PolicyEngine } from '../policy/policy-engine';
+export interface PolicyPack {
+    pack_id: string;
+    org_id: string;
+    name: string;
+    version: string;
+    policies: PolicyRule[];
+    guardrail: EnvironmentGuardrail;
+    created_at: string;
+}
+export declare function savePolicyPack(projectRoot: string, pack: PolicyPack): void;
+export declare function loadPolicyPack(projectRoot: string, packId: string): PolicyPack | null;
+export declare function listPolicyPacks(projectRoot: string): PolicyPack[];
+export declare function applyPolicyPack(engine: PolicyEngine, pack: PolicyPack): PolicyEngine;

package/lib/runtime/audit/policy-pack.js

@@ -0,0 +1,57 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.savePolicyPack = savePolicyPack;
+exports.loadPolicyPack = loadPolicyPack;
+exports.listPolicyPacks = listPolicyPacks;
+exports.applyPolicyPack = applyPolicyPack;
+const path_1 = __importDefault(require("path"));
+const fs_1 = __importDefault(require("fs"));
+function packDir(projectRoot) {
+    return path_1.default.join(projectRoot, '.oxe', 'policy-packs');
+}
+function packFilePath(projectRoot, packId) {
+    return path_1.default.join(packDir(projectRoot), `${packId}.json`);
+}
+function savePolicyPack(projectRoot, pack) {
+    const dir = packDir(projectRoot);
+    fs_1.default.mkdirSync(dir, { recursive: true });
+    fs_1.default.writeFileSync(packFilePath(projectRoot, pack.pack_id), JSON.stringify(pack, null, 2), 'utf8');
+}
+function loadPolicyPack(projectRoot, packId) {
+    const p = packFilePath(projectRoot, packId);
+    if (!fs_1.default.existsSync(p))
+        return null;
+    try {
+        return JSON.parse(fs_1.default.readFileSync(p, 'utf8'));
+    }
+    catch {
+        return null;
+    }
+}
+function listPolicyPacks(projectRoot) {
+    const dir = packDir(projectRoot);
+    if (!fs_1.default.existsSync(dir))
+        return [];
+    return fs_1.default
+        .readdirSync(dir)
+        .filter((f) => f.endsWith('.json'))
+        .map((f) => {
+        try {
+            return JSON.parse(fs_1.default.readFileSync(path_1.default.join(dir, f), 'utf8'));
+        }
+        catch {
+            return null;
+        }
+    })
+        .filter((p) => p !== null);
+}
+function applyPolicyPack(engine, pack) {
+    let result = engine.withGuardrail(pack.guardrail);
+    for (const rule of pack.policies) {
+        result = result.withRule(rule);
+    }
+    return result;
+}

package/lib/runtime/compiler/graph-compiler.d.ts

@@ -0,0 +1,83 @@
+import type { WorkspaceStrategy } from '../models/workspace';
+export interface ParsedTask {
+    id: string;
+    title: string;
+    wave: number | null;
+    dependsOn: string[];
+    files: string[];
+    verifyCommand: string | null;
+    aceite: string[];
+    done: boolean;
+    meta?: Record<string, unknown> | null;
+}
+export interface ParsedSpecCriterion {
+    id: string;
+    criterion: string;
+    howToVerify: string;
+}
+export interface ParsedSpec {
+    objective: string | null;
+    criteria: ParsedSpecCriterion[];
+}
+export interface ParsedPlan {
+    tasks: ParsedTask[];
+    waves: Record<number, string[]>;
+    totalTasks: number;
+}
+export interface Action {
+    type: 'read_code' | 'generate_patch' | 'run_tests' | 'run_lint' | 'collect_evidence' | 'custom';
+    command?: string;
+    targets?: string[];
+}
+export interface VerifyContract {
+    must_pass: string[];
+    acceptance_refs: string[];
+    command: string | null;
+}
+export interface NodePolicy {
+    requires_human_approval: boolean;
+    max_retries: number;
+}
+export interface GraphNode {
+    id: string;
+    title: string;
+    wave: number;
+    depends_on: string[];
+    workspace_strategy: WorkspaceStrategy;
+    mutation_scope: string[];
+    actions: Action[];
+    verify: VerifyContract;
+    policy: NodePolicy;
+}
+export interface GraphEdge {
+    from: string;
+    to: string;
+    type: 'dependency' | 'wave_sequence';
+}
+export interface Wave {
+    wave_number: number;
+    node_ids: string[];
+}
+export interface ExecutionGraphMetadata {
+    compiled_at: string;
+    plan_hash: string;
+    spec_hash: string;
+    node_count: number;
+    wave_count: number;
+}
+export interface ExecutionGraph {
+    nodes: Map<string, GraphNode>;
+    edges: GraphEdge[];
+    waves: Wave[];
+    metadata: ExecutionGraphMetadata;
+}
+export interface CompilerOptions {
+    default_workspace_strategy?: WorkspaceStrategy;
+    default_max_retries?: number;
+    require_approval_for_all?: boolean;
+    skip_done_tasks?: boolean;
+}
+export declare function compile(plan: ParsedPlan, spec: ParsedSpec, options?: CompilerOptions): ExecutionGraph;
+export declare function validateGraph(graph: ExecutionGraph): string[];
+export declare function toSerializable(graph: ExecutionGraph): Record<string, unknown>;
+export declare function fromSerializable(raw: Record<string, unknown>): ExecutionGraph;

package/lib/runtime/compiler/graph-compiler.js

@@ -0,0 +1,135 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.compile = compile;
+exports.validateGraph = validateGraph;
+exports.toSerializable = toSerializable;
+exports.fromSerializable = fromSerializable;
+const crypto_1 = __importDefault(require("crypto"));
+function compile(plan, spec, options = {}) {
+    const { default_workspace_strategy = 'git_worktree', default_max_retries = 2, require_approval_for_all = false, skip_done_tasks = false, } = options;
+    const nodes = new Map();
+    const edges = [];
+    const waveMap = new Map();
+    for (const task of plan.tasks) {
+        if (skip_done_tasks && task.done)
+            continue;
+        const waveNumber = task.wave ?? 1;
+        const node = {
+            id: task.id,
+            title: task.title,
+            wave: waveNumber,
+            depends_on: task.dependsOn,
+            workspace_strategy: default_workspace_strategy,
+            mutation_scope: task.files,
+            actions: buildActions(task),
+            verify: {
+                must_pass: task.verifyCommand ? ['tests'] : [],
+                acceptance_refs: task.aceite,
+                command: task.verifyCommand,
+            },
+            policy: {
+                requires_human_approval: require_approval_for_all,
+                max_retries: default_max_retries,
+            },
+        };
+        nodes.set(task.id, node);
+        for (const dep of task.dependsOn) {
+            edges.push({ from: dep, to: task.id, type: 'dependency' });
+        }
+        if (!waveMap.has(waveNumber))
+            waveMap.set(waveNumber, []);
+        waveMap.get(waveNumber).push(task.id);
+    }
+    const waves = Array.from(waveMap.entries())
+        .sort(([a], [b]) => a - b)
+        .map(([wave_number, node_ids]) => ({ wave_number, node_ids }));
+    return {
+        nodes,
+        edges,
+        waves,
+        metadata: {
+            compiled_at: new Date().toISOString(),
+            plan_hash: hashObject(plan),
+            spec_hash: hashObject(spec),
+            node_count: nodes.size,
+            wave_count: waves.length,
+        },
+    };
+}
+function validateGraph(graph) {
+    const errors = [];
+    const nodeIds = new Set(graph.nodes.keys());
+    for (const [id, node] of graph.nodes) {
+        for (const dep of node.depends_on) {
+            if (!nodeIds.has(dep)) {
+                errors.push(`Node ${id} depends on unknown node ${dep}`);
+            }
+        }
+    }
+    // Detect cycles using DFS
+    const visited = new Set();
+    const inStack = new Set();
+    function hasCycle(nodeId) {
+        if (inStack.has(nodeId))
+            return true;
+        if (visited.has(nodeId))
+            return false;
+        visited.add(nodeId);
+        inStack.add(nodeId);
+        const node = graph.nodes.get(nodeId);
+        if (node) {
+            for (const dep of node.depends_on) {
+                if (hasCycle(dep))
+                    return true;
+            }
+        }
+        inStack.delete(nodeId);
+        return false;
+    }
+    for (const id of nodeIds) {
+        if (hasCycle(id)) {
+            errors.push(`Cycle detected involving node ${id}`);
+            break;
+        }
+    }
+    return errors;
+}
+function toSerializable(graph) {
+    return {
+        nodes: Object.fromEntries(graph.nodes),
+        edges: graph.edges,
+        waves: graph.waves,
+        metadata: graph.metadata,
+    };
+}
+function fromSerializable(raw) {
+    const nodes = new Map(Object.entries(raw.nodes));
+    return {
+        nodes,
+        edges: raw.edges,
+        waves: raw.waves,
+        metadata: raw.metadata,
+    };
+}
+function buildActions(task) {
+    const actions = [];
+    if (task.files.length > 0) {
+        actions.push({ type: 'read_code', targets: task.files });
+    }
+    actions.push({ type: 'generate_patch' });
+    if (task.verifyCommand) {
+        actions.push({ type: 'run_tests', command: task.verifyCommand });
+    }
+    actions.push({ type: 'collect_evidence' });
+    return actions;
+}
+function hashObject(obj) {
+    return crypto_1.default
+        .createHash('sha256')
+        .update(JSON.stringify(obj))
+        .digest('hex')
+        .slice(0, 12);
+}

package/lib/runtime/compiler/index.d.ts

@@ -0,0 +1 @@
+export * from './graph-compiler';

package/lib/runtime/compiler/index.js

@@ -0,0 +1,17 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __exportStar = (this && this.__exportStar) || function(m, exports) {
+    for (var p in m) if (p !== "default" && !Object.prototype.hasOwnProperty.call(exports, p)) __createBinding(exports, m, p);
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+__exportStar(require("./graph-compiler"), exports);

package/lib/runtime/context/context-pack-builder.d.ts

@@ -0,0 +1,51 @@
+import type { WorkItem } from '../models/work-item';
+import type { Evidence } from '../models/evidence';
+import type { RunState } from '../reducers/run-state-reducer';
+import type { ContextProfile } from './context-profiles';
+import type { AutonomyTier } from '../policy/policy-engine';
+export interface ContextArtifact {
+    id: string;
+    kind: 'evidence' | 'lesson' | 'file' | 'summary';
+    content: string;
+    relevanceScore: number;
+    tags: string[];
+}
+export interface LessonMetric {
+    lesson_id: string;
+    title: string;
+    tags: string[];
+    embedding?: number[];
+    content: string;
+}
+export interface ContextPackOptions {
+    maxArtifacts?: number;
+    maxTokensEstimate?: number;
+    deduplicateThreshold?: number;
+}
+export interface ContextPack {
+    work_item_id: string;
+    artifacts: ContextArtifact[];
+    total_artifacts_considered: number;
+    redundancy_removed: number;
+    built_at: string;
+}
+export interface ContextQualityScore {
+    completeness: number;
+    relevance_mean: number;
+    redundancy: number;
+    recency_score: number;
+    overall: number;
+}
+export declare function scorePackQuality(pack: ContextPack, profile: ContextProfile): ContextQualityScore;
+export declare class ContextPackBuilder {
+    private readonly opts;
+    constructor(opts?: ContextPackOptions);
+    build(workItem: WorkItem, state: RunState, evidenceItems: Evidence[], evidenceContents: Map<string, string>, lessons: LessonMetric[]): ContextPack;
+    /** Convenience: build with no evidence, just lessons and state summary */
+    buildLightweight(workItem: WorkItem, state: RunState, lessons: LessonMetric[]): ContextPack;
+    /**
+     * Filter artifacts to those whose path-like tags are within mutation_scope.
+     * L0/L1 tiers apply the filter; L2/L3 skip it (full access).
+     */
+    filterByMutationScope(artifacts: ContextArtifact[], mutationScope: string[], autonomyTier: AutonomyTier): ContextArtifact[];
+}