playwright-intelligence-engine 0.0.0-stage → 2.0.0

package/src/repair/workspace-promoter.ts

@@ -0,0 +1,313 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import crypto from 'node:crypto';
+import { ApprovalService, ApprovalTokenPayload } from './approval-service.js';
+import { WorktreeManager } from '../sandbox/worktree-manager.js';
+
+export interface PromotionResult {
+  success: boolean;
+  targetFilePath: string;
+  bytesWritten: number;
+  finalHash: string;
+  error?: string | undefined;
+}
+
+interface LockFilePayload {
+  pid: number;
+  timestamp: number;
+}
+
+/**
+ * WorkspacePromoter handles safe, atomic, compare-before-write promotion of
+ * verified worktree repairs into the developer's active workspace.
+ *
+ * Enforces:
+ * 1. Canonical realpath containment inside the approved workspace.
+ * 2. Cross-process and in-process cooperative file locks.
+ * 3. Compare-And-Swap (CAS) hash verification of original source before mutation.
+ * 4. Patch diff and content hash validation against cryptographic approval token.
+ * 5. Safe temporary file write in the same directory.
+ * 6. Recoverable backup creation for fail-closed rollback.
+ * 7. Verification of post-promotion content hash.
+ * 8. Elimination of unvalidated direct-write fallbacks.
+ */
+export class WorkspacePromoter {
+  private static activeLocks = new Set<string>();
+
+  /**
+   * Promotes an approved patch to the active workspace with CAS hash verification,
+   * filesystem locks, and atomic rename.
+   */
+  public static async promote(params: {
+    targetFilePath: string;
+    workspaceRoot: string;
+    patchedContent: string;
+    approvalTokenPayload: ApprovalTokenPayload;
+  }): Promise<PromotionResult> {
+    const { targetFilePath, workspaceRoot, patchedContent, approvalTokenPayload } = params;
+
+    // 1. Resolve canonical target path
+    if (!fs.existsSync(targetFilePath)) {
+      return {
+        success: false,
+        targetFilePath,
+        bytesWritten: 0,
+        finalHash: '',
+        error: `Target file does not exist: '${targetFilePath}'`,
+      };
+    }
+
+    const canonicalTarget = fs.realpathSync(targetFilePath);
+    const canonicalWorkspace = fs.realpathSync(workspaceRoot);
+
+    // 2. Verify workspace containment
+    const relative = path.relative(canonicalWorkspace, canonicalTarget);
+    if (relative.startsWith('..') || path.isAbsolute(relative)) {
+      return {
+        success: false,
+        targetFilePath: canonicalTarget,
+        bytesWritten: 0,
+        finalHash: '',
+        error: `Security Violation: Target path '${canonicalTarget}' escapes workspace root '${canonicalWorkspace}'.`,
+      };
+    }
+
+    // Verify target matches token binding
+    if (canonicalTarget !== approvalTokenPayload.targetFilePath) {
+      return {
+        success: false,
+        targetFilePath: canonicalTarget,
+        bytesWritten: 0,
+        finalHash: '',
+        error: `Approval Token Target Mismatch: Token bound to '${approvalTokenPayload.targetFilePath}', received '${canonicalTarget}'.`,
+      };
+    }
+
+    // 3. Acquire per-file in-process and cross-process lock
+    const lockKey = canonicalTarget.toLowerCase();
+    if (WorkspacePromoter.activeLocks.has(lockKey)) {
+      return {
+        success: false,
+        targetFilePath: canonicalTarget,
+        bytesWritten: 0,
+        finalHash: '',
+        error: `Conflict: Another promotion is currently active for '${canonicalTarget}'.`,
+      };
+    }
+
+    const lockFilePath = `${canonicalTarget}.pie-promote.lock`;
+    const lockAcquired = WorkspacePromoter.acquireCrossProcessLock(lockFilePath);
+    if (!lockAcquired.success) {
+      return {
+        success: false,
+        targetFilePath: canonicalTarget,
+        bytesWritten: 0,
+        finalHash: '',
+        error: lockAcquired.error,
+      };
+    }
+
+    WorkspacePromoter.activeLocks.add(lockKey);
+
+    const targetDir = path.dirname(canonicalTarget);
+    const tempFile = path.join(targetDir, `.pie-promo-${process.pid}-${crypto.randomBytes(8).toString('hex')}.tmp`);
+    const backupFile = path.join(targetDir, `.pie-backup-${process.pid}-${crypto.randomBytes(8).toString('hex')}.bak`);
+
+    try {
+      // 4 & 5. Read current file and calculate hash
+      const currentContent = await fs.promises.readFile(canonicalTarget, 'utf-8');
+      const currentHash = ApprovalService.hashContent(currentContent);
+
+      // 6 & 7. Compare hash (CAS check)
+      if (currentHash !== approvalTokenPayload.originalSourceHash) {
+        return {
+          success: false,
+          targetFilePath: canonicalTarget,
+          bytesWritten: 0,
+          finalHash: currentHash,
+          error: `Concurrent Modification Detected: File '${canonicalTarget}' has been modified since approval (current: ${currentHash.slice(0, 8)}, expected: ${approvalTokenPayload.originalSourceHash.slice(0, 8)}). Promotion aborted.`,
+        };
+      }
+
+      // Verify patchedContent matches token patchedSourceHash
+      const contentHash = ApprovalService.hashContent(patchedContent);
+      if (approvalTokenPayload.patchedSourceHash && contentHash !== approvalTokenPayload.patchedSourceHash) {
+        return {
+          success: false,
+          targetFilePath: canonicalTarget,
+          bytesWritten: 0,
+          finalHash: contentHash,
+          error: `Patch Content Corrupted: Content hash does not match approved patchedSourceHash.`,
+        };
+      }
+
+      // P0 TOCTOU Fix: Verify and atomically consume approval token strictly INSIDE the locked critical section
+      const tokenConsumption = ApprovalService.getInstance().verifyAndConsumeToken({
+        tokenId: approvalTokenPayload.tokenId,
+        targetFilePath: canonicalTarget,
+        currentSourceContent: currentContent,
+        targetClassName: approvalTokenPayload.targetClassName,
+        targetMemberName: approvalTokenPayload.targetMemberName,
+        patchHash: approvalTokenPayload.replacementAstHash,
+        fullDiffHash: approvalTokenPayload.fullDiffHash,
+      });
+
+      if (!tokenConsumption.isValid) {
+        return {
+          success: false,
+          targetFilePath: canonicalTarget,
+          bytesWritten: 0,
+          finalHash: currentHash,
+          error: `Security Violation: Token authorization denied under lock: ${tokenConsumption.reason}`,
+        };
+      }
+
+      // 8. Create safety rollback backup
+      await fs.promises.copyFile(canonicalTarget, backupFile);
+
+      // 9. Write to secure temporary file in the same directory
+      await fs.promises.writeFile(tempFile, patchedContent, 'utf-8');
+      const tempContent = await fs.promises.readFile(tempFile, 'utf-8');
+      const writtenHash = ApprovalService.hashContent(tempContent);
+      if (writtenHash !== contentHash) {
+        throw new Error(`Integrity check failed: written temporary content hash mismatch.`);
+      }
+
+      // 10. Atomic replace with retry for Windows transient scanner locks
+      let replaced = false;
+      for (let attempt = 0; attempt < 5; attempt++) {
+        try {
+          fs.renameSync(tempFile, canonicalTarget);
+          replaced = true;
+          break;
+        } catch {
+          // Brief backoff for Windows anti-virus or indexer lock
+          await new Promise((r) => setTimeout(r, 50));
+        }
+      }
+
+      if (!replaced) {
+        // Safe rollback from backup: never do unvalidated overwrite
+        await fs.promises.copyFile(backupFile, canonicalTarget).catch(() => {});
+        throw new Error(`Failed to atomically replace '${canonicalTarget}' after multiple attempts.`);
+      }
+
+      // 11. Verify resulting file hash
+      const verifiedContent = await fs.promises.readFile(canonicalTarget, 'utf-8');
+      const finalHash = ApprovalService.hashContent(verifiedContent);
+
+      if (finalHash !== contentHash) {
+        // Rollback immediately if final hash mismatches expected
+        await fs.promises.copyFile(backupFile, canonicalTarget).catch(() => {});
+        return {
+          success: false,
+          targetFilePath: canonicalTarget,
+          bytesWritten: 0,
+          finalHash,
+          error: `Post-promotion verification failed: final file hash did not match expected hash. Rolled back from backup.`,
+        };
+      }
+
+      // 12. Cleanup safety backup on success
+      if (fs.existsSync(backupFile)) {
+        await fs.promises.unlink(backupFile).catch(() => {});
+      }
+
+      return {
+        success: true,
+        targetFilePath: canonicalTarget,
+        bytesWritten: Buffer.byteLength(verifiedContent, 'utf-8'),
+        finalHash,
+      };
+    } catch (err: any) {
+      // Clean up temporary file and restore from backup if necessary
+      if (fs.existsSync(tempFile)) {
+        try { fs.unlinkSync(tempFile); } catch {}
+      }
+      if (fs.existsSync(backupFile)) {
+        try {
+          await fs.promises.copyFile(backupFile, canonicalTarget);
+          await fs.promises.unlink(backupFile);
+        } catch {}
+      }
+      return {
+        success: false,
+        targetFilePath: canonicalTarget,
+        bytesWritten: 0,
+        finalHash: '',
+        error: `Promotion I/O Error: ${err?.message ?? String(err)}`,
+      };
+    } finally {
+      // 13. Release in-process and cross-process lock
+      WorkspacePromoter.activeLocks.delete(lockKey);
+      WorkspacePromoter.releaseCrossProcessLock(lockFilePath);
+      if (fs.existsSync(tempFile)) {
+        try { fs.unlinkSync(tempFile); } catch {}
+      }
+      if (fs.existsSync(backupFile)) {
+        try { fs.unlinkSync(backupFile); } catch {}
+      }
+    }
+  }
+
+  /**
+   * Acquires a cross-process lock using exclusive file creation ('wx').
+   * If a lock exists, verifies whether the owning process is still alive.
+   * If the owner is dead or the lock is older than 30s, the stale lock is safely reclaimed.
+   */
+  private static acquireCrossProcessLock(lockFilePath: string): { success: boolean; error?: string } {
+    const maxTries = 3;
+    for (let i = 0; i < maxTries; i++) {
+      try {
+        const payload: LockFilePayload = {
+          pid: process.pid,
+          timestamp: Date.now(),
+        };
+        fs.writeFileSync(lockFilePath, JSON.stringify(payload), { flag: 'wx' });
+        return { success: true };
+      } catch (err: any) {
+        if (err.code === 'EEXIST') {
+          // Check if lock is stale
+          try {
+            const raw = fs.readFileSync(lockFilePath, 'utf-8');
+            const existing: LockFilePayload = JSON.parse(raw);
+            const isAlive = WorktreeManager.isProcessAlive(existing.pid);
+
+            // P1: Never steal lock from a living process regardless of elapsed time
+            if (!isAlive) {
+              // Owning process has terminated: safely reclaim dead lock
+              try { fs.unlinkSync(lockFilePath); } catch {}
+              continue;
+            }
+
+            return {
+              success: false,
+              error: `Conflict: Another active PIE process (PID ${existing.pid}) holds the promotion lock for this file.`,
+            };
+          } catch {
+            // Malformed lock file: reclaim
+            try { fs.unlinkSync(lockFilePath); } catch {}
+            continue;
+          }
+        }
+        return {
+          success: false,
+          error: `Cross-process lock failure: ${err.message}`,
+        };
+      }
+    }
+
+    return {
+      success: false,
+      error: `Could not acquire promotion lock for '${lockFilePath}' after ${maxTries} attempts.`,
+    };
+  }
+
+  private static releaseCrossProcessLock(lockFilePath: string): void {
+    try {
+      if (fs.existsSync(lockFilePath)) {
+        fs.unlinkSync(lockFilePath);
+      }
+    } catch {}
+  }
+}

package/src/reproduce/diagnostic-rerunner.ts

@@ -0,0 +1,287 @@
+import * as path from 'path';
+import * as fs from 'fs';
+import { WorktreeManager } from '../sandbox/worktree-manager.js';
+import { ExecutionRunner } from '../sandbox/execution-runner.js';
+import { ErrorCollector } from '../collectors/error-collector.js';
+import { StaticAstCollector } from '../collectors/static-ast-collector.js';
+import { GitDiffCollector } from '../collectors/git-diff-collector.js';
+import { EnvironmentCollector } from '../collectors/environment-collector.js';
+import { TraceCollector } from '../collectors/trace-collector.js';
+import { EvidenceNormalizer } from '../evidence/evidence-normalizer.js';
+import { EvidenceScorecard, UnifiedEvidenceRecord } from '../evidence/evidence-model.js';
+import { EvidenceRedactor } from '../evidence/evidence-redactor.js';
+import { DiagnosticContext } from '../core/types/diagnostic-context.js';
+import { EvidenceCorrelator } from '../diagnostics/evidence-correlator.js';
+import { DiagnosticReportGenerator } from '../diagnostics/diagnostic-report.js';
+import { DirectBrowserInvestigator } from './direct-browser-investigator.js';
+import { LocatorPlan } from '../selector/candidate-extractor.js';
+import { BrowserOperationExecutionResult } from '../repair/browser-operation-executor.js';
+
+export interface DiagnosticRerunOptions {
+  specFilePath: string;
+  workspaceRoot: string;
+  testNamePattern?: string;
+  timeoutMs?: number;
+  useWorktree?: boolean;
+  enableLiveEscalation?: boolean;
+  operation?: unknown;
+  operationTargetPlan?: LocatorPlan | undefined;
+  operationReplacementPlan?: LocatorPlan | undefined;
+  operationOverlayPlan?: LocatorPlan | undefined;
+  allowInteraction?: boolean | undefined;
+}
+
+export interface DiagnosticRerunResult {
+  passed: boolean;
+  exitCode: number;
+  stdout: string;
+  stderr: string;
+  scorecard: EvidenceScorecard;
+  unifiedEvidence: UnifiedEvidenceRecord[];
+  context: DiagnosticContext;
+  report: string;
+  executedInWorktree: boolean;
+  targetSpecPath: string;
+  browserOperationResult?: BrowserOperationExecutionResult | undefined;
+}
+
+export class DiagnosticRerunner {
+  /**
+   * Mode A: Executes the failing Playwright test inside an isolated Git worktree (AUDIT-11 / B2).
+   * Canonicalizes paths, guarantees worktree containment, captures multi-source evidence,
+   * enforces central redaction, and escalates to live browser investigation if trace is absent.
+   */
+  public static async rerunAndDiagnose(options: DiagnosticRerunOptions): Promise<DiagnosticRerunResult> {
+    const executionId = `rerun-${Date.now()}`;
+    const worktreeManager = new WorktreeManager(options.workspaceRoot);
+    let targetDir = options.workspaceRoot;
+    let worktreeId: string | undefined;
+
+    // 1. Resolve canonical workspace root (AUDIT-05)
+    if (!fs.existsSync(options.workspaceRoot)) {
+      throw new Error(`Workspace root does not exist: '${options.workspaceRoot}'`);
+    }
+    const canonicalWorkspace = fs.realpathSync(options.workspaceRoot);
+
+    // 2. Fix absolute spec path bug (AUDIT-11 / B2): Calculate worktree-relative spec path
+    let relativeSpec = options.specFilePath;
+    if (path.isAbsolute(options.specFilePath)) {
+      if (!fs.existsSync(options.specFilePath)) {
+        throw new Error(`Spec file not found: '${options.specFilePath}'`);
+      }
+      const canonicalSpec = fs.realpathSync(options.specFilePath);
+      const rel = path.relative(canonicalWorkspace, canonicalSpec);
+      if (rel.startsWith('..') || path.isAbsolute(rel)) {
+        throw new Error(
+          `Security Violation: Spec file '${options.specFilePath}' escapes workspace root '${canonicalWorkspace}'.`
+        );
+      }
+      relativeSpec = rel;
+    }
+
+    if (options.useWorktree !== false) {
+      worktreeId = `reproduce-${Date.now().toString(36)}`;
+      const info = await worktreeManager.createWorktree(worktreeId);
+      targetDir = info.worktreePath;
+    }
+
+    try {
+      const allRecords: UnifiedEvidenceRecord[] = [];
+      const addRedacted = (records: UnifiedEvidenceRecord[]) => {
+        for (const rec of records) {
+          allRecords.push(EvidenceRedactor.redactRecord(rec));
+        }
+      };
+
+      // 1. Environment Evidence
+      const envCollector = new EnvironmentCollector();
+      const envRecords = await envCollector.collect({
+        workspaceRoot: targetDir,
+        executionId,
+      });
+      addRedacted(envRecords);
+
+      // 2. Git Diff Evidence
+      const gitCollector = new GitDiffCollector();
+      const gitRecords = await gitCollector.collect({
+        workspaceRoot: targetDir,
+        executionId,
+      });
+      addRedacted(gitRecords);
+
+      // 3. Static AST Evidence of the failing spec strictly inside the worktree
+      const worktreeTargetSpec = path.resolve(targetDir, relativeSpec);
+      const astCollector = new StaticAstCollector();
+      const astRecords = await astCollector.collect({
+        targetFilePath: fs.existsSync(worktreeTargetSpec) ? worktreeTargetSpec : options.specFilePath,
+        executionId,
+      });
+      addRedacted(astRecords);
+
+      // 4. Execute Playwright test strictly targeting the worktree copy with --trace on (forward slashes for Windows regex matcher)
+      const playwrightArgs = ['playwright', 'test', relativeSpec.replace(/\\/g, '/'), '--trace', 'on'];
+      if (options.testNamePattern) {
+        playwrightArgs.push('-g', options.testNamePattern);
+      }
+
+      const runStartTime = Date.now();
+      const runResult = await ExecutionRunner.run('npx', {
+        cwd: targetDir,
+        args: playwrightArgs,
+        timeoutMs: options.timeoutMs ?? 60000,
+        env: {
+          PW_INTELLIGENCE_REPRODUCE: '1',
+          CI: '1',
+        },
+      });
+      const passed = runResult.exitCode === 0;
+
+      // 5. Ingest trace artifacts from test-results with freshness filtering (eliminates stale trace risk)
+      let traceCaptured = false;
+      const testResultsDir = path.join(targetDir, 'test-results');
+      if (fs.existsSync(testResultsDir)) {
+        const traceFiles = this.findTraceFiles(testResultsDir, runStartTime - 5000);
+        if (traceFiles.length > 0 && traceFiles[0]) {
+          const traceCollector = new TraceCollector();
+          const traceRecords = await traceCollector.collect({
+            archivePath: traceFiles[0],
+            executionId,
+          });
+          addRedacted(traceRecords);
+          traceCaptured = traceRecords.length > 0;
+        }
+      }
+
+      // 6. Collect error evidence on failure
+      if (!passed) {
+        const errorCollector = new ErrorCollector();
+        const errorRecords = await errorCollector.collect({
+          errorMessage: runResult.stderr || runResult.stdout || 'Playwright test execution failed',
+          errorStack: runResult.stderr,
+          testFile: relativeSpec,
+          executionId,
+        });
+        addRedacted(errorRecords);
+      }
+
+      // Check if trace records contain failure-point DOM snapshot (prevents Rule R-015 INCOMPLETE_EVIDENCE)
+      const hasDomSnapshot = allRecords.some((r) => r.evidenceType === 'dom-snapshot');
+
+      // Extract failing action selector if any from test output
+      let failingSelector: string | undefined;
+      let browserOperationResult: BrowserOperationExecutionResult | undefined;
+      const selectorMatch = (runResult.stdout + '\n' + runResult.stderr).match(/locator\(['"]([^'"]+)['"]\)/);
+      if (selectorMatch && selectorMatch[1]) {
+        failingSelector = selectorMatch[1];
+      }
+
+      // 7. Tiered Escalation: If execution failed and (trace was absent OR trace lacked DOM snapshot), trigger Mode B DirectBrowserInvestigator
+      if (!passed && (!traceCaptured || !hasDomSnapshot) && options.enableLiveEscalation !== false) {
+        try {
+          // Attempt to extract target URL from AST records or test stdout/stderr
+          let discoveredUrl: string | undefined;
+          const urlMatch = (runResult.stdout + '\n' + runResult.stderr).match(/https?:\/\/[^\s"'`)]+/);
+          if (urlMatch && urlMatch[0]) {
+            discoveredUrl = urlMatch[0];
+          } else {
+            // Check AST records for page.goto calls
+            for (const rec of astRecords) {
+              const strPayload = JSON.stringify(rec.payload ?? {});
+              const astUrlMatch = strPayload.match(/https?:\/\/[^\s"'`)]+/);
+              if (astUrlMatch && astUrlMatch[0]) {
+                discoveredUrl = astUrlMatch[0];
+                break;
+              }
+            }
+          }
+
+          if (discoveredUrl) {
+            const directRes = await DirectBrowserInvestigator.investigateUrl({
+              url: discoveredUrl,
+              actionSelector: failingSelector,
+              intendedAction: 'click',
+              executionId,
+              timeoutMs: 10000,
+              operation: options.operation,
+              operationTargetPlan: options.operationTargetPlan,
+              operationReplacementPlan: options.operationReplacementPlan,
+              operationOverlayPlan: options.operationOverlayPlan,
+              allowInteraction: options.allowInteraction,
+            });
+            browserOperationResult = directRes.browserOperationResult;
+
+            // AUDIT FIX: Only accept live browser evidence if action genuinely failed (REPRODUCED) or captured failure DOM
+            if (directRes.success && (directRes.status === 'REPRODUCED' || directRes.domSnapshotRecord)) {
+              if (directRes.domSnapshotRecord) {
+                addRedacted([directRes.domSnapshotRecord]);
+              }
+              if (directRes.ariaSnapshotRecord) {
+                addRedacted([directRes.ariaSnapshotRecord]);
+              }
+              if (directRes.status === 'REPRODUCED' && directRes.records.length > 0) {
+                addRedacted(directRes.records);
+              }
+            }
+          }
+        } catch {
+          // Graceful fallback if headless chromium cannot launch
+        }
+      }
+
+      // 8. Normalize multi-source evidence to DiagnosticContext
+      const context = EvidenceNormalizer.toDiagnosticContext(allRecords);
+      const scorecard = EvidenceNormalizer.calculateScorecard(allRecords);
+
+      // 9. Correlate and generate report
+      const correlated = EvidenceCorrelator.correlate(context);
+      const report = DiagnosticReportGenerator.generateTerminalReport(correlated, scorecard);
+
+      return {
+        passed,
+        exitCode: runResult.exitCode,
+        stdout: runResult.stdout,
+        stderr: runResult.stderr,
+        scorecard,
+        unifiedEvidence: allRecords,
+        context,
+        report,
+        executedInWorktree: options.useWorktree !== false,
+        targetSpecPath: worktreeTargetSpec,
+        browserOperationResult,
+      };
+    } finally {
+      if (worktreeId) {
+        await worktreeManager.destroyWorktree(worktreeId).catch(() => {});
+      }
+    }
+  }
+
+  private static findTraceFiles(dir: string, minMtimeMs?: number): string[] {
+    const results: Array<{ filePath: string; mtimeMs: number }> = [];
+    const scan = (currentDir: string) => {
+      try {
+        const entries = fs.readdirSync(currentDir, { withFileTypes: true });
+        for (const entry of entries) {
+          const fullPath = path.join(currentDir, entry.name);
+          if (entry.isDirectory()) {
+            scan(fullPath);
+          } else if (entry.isFile() && entry.name.endsWith('trace.zip')) {
+            try {
+              const stat = fs.statSync(fullPath);
+              if (!minMtimeMs || stat.mtimeMs >= minMtimeMs) {
+                results.push({ filePath: fullPath, mtimeMs: stat.mtimeMs });
+              }
+            } catch {
+              results.push({ filePath: fullPath, mtimeMs: 0 });
+            }
+          }
+        }
+      } catch {
+        // Ignore directory read errors
+      }
+    };
+    scan(dir);
+    // Sort descending by modification time (freshest trace first)
+    return results.sort((a, b) => b.mtimeMs - a.mtimeMs).map((r) => r.filePath);
+  }
+}