shakers-cli 0.0.0-stage → 0.14.0

package/src/git-activity.js

@@ -0,0 +1,124 @@
+'use strict';
+
+const { execFileSync } = require('child_process');
+const path = require('path');
+
+const { takePrefetchedGitLog } = require('./git-log-prefetch');
+
+const GIT_TIMEOUT_MS = 15000;
+const MAX_FILE_TYPES = 50;
+
+// The one history read behind the activity numbers (\x01 = commit marker, \x1f = field sep).
+const GIT_ACTIVITY_LOG_ARGS = ['log', '--no-merges', '--numstat', '--pretty=format:\x01%ae\x1f%at'];
+
+function runGit(root, args) {
+  try {
+    return execFileSync('git', ['-C', root, ...args], {
+      encoding: 'utf8',
+      timeout: GIT_TIMEOUT_MS,
+      stdio: ['ignore', 'pipe', 'ignore'],
+      maxBuffer: 64 * 1024 * 1024,
+    });
+  } catch {
+    return null;
+  }
+}
+
+function isGitRepo(root) {
+  return runGit(root, ['rev-parse', '--is-inside-work-tree']) !== null;
+}
+
+function extensionOf(rawPath) {
+  let p = rawPath;
+  const arrow = p.indexOf('=>');
+  if (arrow !== -1) {
+    p = p
+      .slice(arrow + 2)
+      .replace(/[{}]/g, '')
+      .trim();
+  }
+  const base = path.basename(p.trim());
+  const ext = path.extname(base).replace(/^\./, '').toLowerCase();
+  return ext || 'none';
+}
+
+function bumpFileType(filesByType, ext) {
+  if (Object.prototype.hasOwnProperty.call(filesByType, ext)) {
+    filesByType[ext] += 1;
+    return;
+  }
+  if (Object.keys(filesByType).length >= MAX_FILE_TYPES) return;
+  filesByType[ext] = 1;
+}
+
+function round2(n) {
+  return Math.round(n * 100) / 100;
+}
+
+// Deterministic git-activity signals for the project where `shakers ai-usage` runs (hybrid evaluation, Slice 1).
+function collectGitActivity(root, verifiedEmail) {
+  if (!isGitRepo(root)) return null;
+
+  const sep = String.fromCharCode(1);
+  const unit = String.fromCharCode(31);
+  const prefetchedLog = takePrefetchedGitLog(root, GIT_ACTIVITY_LOG_ARGS);
+  const log = prefetchedLog !== undefined ? prefetchedLog : runGit(root, GIT_ACTIVITY_LOG_ARGS);
+  if (log === null) return null;
+
+  const target = String(verifiedEmail || '')
+    .trim()
+    .toLowerCase();
+
+  let commitCount = 0;
+  let authoredCommitCount = 0;
+  let linesAdded = 0;
+  let linesDeleted = 0;
+  let minTs = null;
+  let maxTs = null;
+  const filesByType = {};
+
+  for (const rawLine of log.split('\n')) {
+    if (rawLine.startsWith(sep)) {
+      commitCount += 1;
+      const [email, atRaw] = rawLine.slice(1).split(unit);
+      if (target && String(email || '').trim().toLowerCase() === target) {
+        authoredCommitCount += 1;
+      }
+      const ts = Number.parseInt(atRaw, 10);
+      if (Number.isFinite(ts)) {
+        if (minTs === null || ts < minTs) minTs = ts;
+        if (maxTs === null || ts > maxTs) maxTs = ts;
+      }
+      continue;
+    }
+    const line = rawLine.trim();
+    if (!line) continue;
+    const parts = line.split('\t');
+    if (parts.length < 3) continue;
+    const [addedRaw, deletedRaw] = parts;
+    const filePath = parts.slice(2).join('\t');
+    if (addedRaw !== '-') linesAdded += Number.parseInt(addedRaw, 10) || 0;
+    if (deletedRaw !== '-') linesDeleted += Number.parseInt(deletedRaw, 10) || 0;
+    bumpFileType(filesByType, extensionOf(filePath));
+  }
+
+  if (commitCount === 0) return null;
+
+  const spanDays =
+    minTs !== null && maxTs !== null
+      ? Math.max(0, Math.floor((maxTs - minTs) / 86400))
+      : 0;
+  const velocity = round2(commitCount / Math.max(spanDays, 1));
+
+  return {
+    commitCount,
+    authoredCommitCount,
+    linesAdded,
+    linesDeleted,
+    filesByType,
+    velocity,
+    spanDays,
+  };
+}
+
+module.exports = { collectGitActivity, extensionOf, isGitRepo, GIT_ACTIVITY_LOG_ARGS };

package/src/git-log-prefetch.js

@@ -0,0 +1,53 @@
+'use strict';
+
+const { execFile } = require('child_process');
+
+// Runs the aggregation's per-repo git logs concurrently with the collectors' exact args; each result is taken once and expires.
+
+const GIT_TIMEOUT_MS = 15000;
+const GIT_MAX_BUFFER = 64 * 1024 * 1024;
+const MAX_CONCURRENT = 8;
+const TTL_MS = 60 * 1000;
+
+const prefetched = new Map();
+
+const keyOf = (root, args) => JSON.stringify([root, args]);
+
+function runAsync(root, args) {
+  return new Promise((resolve) => {
+    execFile(
+      'git',
+      ['-C', root, ...args],
+      { encoding: 'utf8', timeout: GIT_TIMEOUT_MS, maxBuffer: GIT_MAX_BUFFER },
+      (err, stdout) => resolve(err ? null : stdout),
+    );
+  });
+}
+
+// Runs every (root, args) pair, at most MAX_CONCURRENT at a time. Never throws.
+async function prefetchGitLogs(roots, argSets) {
+  const jobs = [];
+  for (const root of roots || []) {
+    for (const args of argSets) jobs.push({ root, args });
+  }
+  let next = 0;
+  const worker = async () => {
+    while (next < jobs.length) {
+      const { root, args } = jobs[next++];
+      const out = await runAsync(root, args);
+      if (out !== null) prefetched.set(keyOf(root, args), { out, at: Date.now() });
+    }
+  };
+  await Promise.all(Array.from({ length: Math.min(MAX_CONCURRENT, jobs.length) }, worker));
+}
+
+// The prefetched stdout for exactly this command, once; `undefined` on a miss.
+function takePrefetchedGitLog(root, args) {
+  const key = keyOf(root, args);
+  const hit = prefetched.get(key);
+  if (!hit) return undefined;
+  prefetched.delete(key);
+  return Date.now() - hit.at <= TTL_MS ? hit.out : undefined;
+}
+
+module.exports = { prefetchGitLogs, takePrefetchedGitLog };

package/src/graph-certs.js

@@ -0,0 +1,58 @@
+'use strict';
+
+// graph-certs.js — report-store → `map` cert-drawer payload adapter.
+
+const { getCatalog } = require('./i18n');
+const { scoreBand, skillLevelForScore } = require('./render-certification');
+const { sanitizeRenderText } = require('./sanitize-network-text');
+
+function levelInfoFromCombinedLevel(combinedLevel) {
+  const key = typeof combinedLevel === 'string' ? combinedLevel.trim().toLowerCase() : '';
+  if (key === 'expert') return { key: 'expert', band: 'high' };
+  if (key === 'senior') return { key: 'senior', band: 'mid' };
+  if (key === 'middle') return { key: 'middle', band: 'low' };
+  return null;
+}
+
+// buildCertsPayload(project, lang) -> cert drawer payload | null `project` is a report-store project entry (state.projects[absRoot]).
+function buildCertsPayload(project, lang) {
+  const t = getCatalog(lang);
+
+  const certObj = (project && project.certifications) || {};
+  const skills = Object.values(certObj)
+    .map((e) => e && e.item)
+    .filter(Boolean)
+    .map((item) => {
+      const res = item.result || {};
+      // `skillName` and `technology` both come off the wire (the service's certifiable list / verdict), and `technology` was one of the two fields issue 055 was opened for.
+      const base = sanitizeRenderText(item.skillName) || (item.skillId != null ? String(item.skillId) : 'Skill');
+      const name = item.technology ? `${base} · ${sanitizeRenderText(item.technology)}` : base;
+      // ADR-016: named level (Middle/Senior/Expert) instead of the numeric grade.
+      const skillReport = (t.certify && t.certify.report) || {};
+      const skillLevelNames = skillReport.skillLevels || {};
+      const { key: levelKey, band } = levelInfoFromCombinedLevel(res.combinedLevel) || skillLevelForScore(res.score);
+      return {
+        name,
+        band, // retained for the badge colour (unchanged palette)
+        levelKey,
+        levelName: levelKey ? (skillLevelNames[levelKey] || levelKey) : (skillLevelNames.na || '—'),
+        // Model-written text off the wire; sanitised (issue 055 — left raw by 052).
+        rationale: typeof res.rationale === 'string' ? sanitizeRenderText(res.rationale) : '',
+        improvements: Array.isArray(res.improvements)
+          ? res.improvements.map((i) => (typeof i === 'string' ? sanitizeRenderText(i) : i))
+          : [],
+      };
+    });
+
+  if (!skills.length) return null;
+
+  const labels = {
+    skillsTitle: lang === 'es' ? 'Skills evaluadas' : 'Skills evaluated',
+    empty: lang === 'es' ? 'Aún no hay certificaciones para este proyecto.' : 'No certifications for this project yet.',
+    improvements: lang === 'es' ? 'Mejoras sugeridas' : 'Suggested improvements',
+  };
+
+  return { labels, skills };
+}
+
+module.exports = { buildCertsPayload, levelInfoFromCombinedLevel };

package/src/graph-generator.js

@@ -0,0 +1,230 @@
+'use strict';
+
+// graph-generator.js — HYBRID generation of the foglamp graph contract.
+
+const KINDS = new Set(['entry', 'cron', 'agent', 'model', 'tool', 'service', 'store', 'external']);
+const LLM_INTRODUCIBLE = new Set(['entry', 'cron', 'service', 'store']);
+const EDGE_KINDS = new Set(['calls', 'reads', 'writes', 'triggers']);
+
+const CAPS = {
+  nodes: 60,
+  edges: 120,
+  topModels: 3,
+  topTools: 10,
+  topIntegrations: 10,
+  label: 28,
+  sub: 40,
+  edgeLabel: 24,
+  detail: 200,
+};
+
+function clampStr(s, max) {
+  if (s == null) return undefined;
+  s = String(s);
+  return s.length > max ? s.slice(0, max - 1) + '…' : s;
+}
+
+// Secret-ish patterns; the structural summary should never carry these, but we
+// belt-and-braces scrub every string that leaves the machine toward the LLM.
+const SECRET_RE = [
+  /(?:sk|pk|ghp|gho|xox[baprs]|AKIA|ya29)[-_][A-Za-z0-9]{6,}/g, // known key prefixes
+  /[A-Za-z0-9_-]{32,}\.[A-Za-z0-9_-]{16,}\.[A-Za-z0-9_-]{16,}/g, // JWT-ish
+  // long base64 blobs — excludes '/' so file PATHS (many slashes) are NOT
+  // mistaken for secrets; real token blobs are contiguous/URL-safe.
+  /\b[A-Za-z0-9+]{40,}={0,2}\b/g,
+  /(?:password|secret|token|api[_-]?key|bearer)\s*[:=]\s*\S+/gi,
+];
+
+function scrubString(s) {
+  if (s == null) return s;
+  let out = String(s);
+  for (const re of SECRET_RE) out = out.replace(re, '[redacted]');
+  return out;
+}
+
+// DETERMINISTIC assembly.
+function assembleDeterministic(scan) {
+  const nodes = [];
+  const edges = [];
+  const seen = new Set();
+  const push = (n) => {
+    if (!n.id || seen.has(n.id) || !KINDS.has(n.kind)) return;
+    seen.add(n.id);
+    nodes.push({
+      id: n.id,
+      label: clampStr(n.label || n.id, CAPS.label),
+      kind: n.kind,
+      ...(n.sub ? { sub: clampStr(n.sub, CAPS.sub) } : {}),
+      ...(n.domain ? { domain: n.domain } : {}),
+      ...(n.group ? { group: clampStr(n.group, CAPS.label) } : {}),
+      ...(n.detail ? { detail: clampStr(n.detail, CAPS.detail) } : {}),
+      ...(n.sourceRef ? { sourceRef: n.sourceRef } : {}),
+    });
+  };
+
+  (scan.models || []).forEach((m) => push({ ...m, kind: 'model' }));
+  (scan.tools || []).forEach((t) => push({ ...t, kind: 'tool' }));
+  (scan.integrations || []).forEach((i) => push({ ...i, kind: 'external' }));
+  (scan.agents || []).forEach((a) => {
+    push({ id: a.id, label: a.label, kind: 'agent', sub: a.sub, group: a.group, detail: a.detail, sourceRef: a.sourceRef });
+    // deterministic call edge agent -> model|tool (we know what each agent calls)
+    const target = a.model || a.toolId || a.tool;
+    if (target && seen.has(target)) edges.push({ from: a.id, to: target, kind: 'calls' });
+  });
+  // orchestrator -> subagent hierarchy (parent triggers child), deterministic
+  (scan.agents || []).forEach((a) => {
+    if (a.parent && seen.has(a.parent) && seen.has(a.id) && a.parent !== a.id) {
+      edges.push({ from: a.parent, to: a.id, kind: 'triggers' });
+    }
+  });
+
+  const stats = {
+    agents: (scan.agents || []).length,
+    models: (scan.models || []).length,
+    tools: (scan.tools || []).length,
+    integrations: (scan.integrations || []).length,
+  };
+  const topModels = (scan.models || []).slice(0, CAPS.topModels).map((m) => ({ id: m.id, label: m.label, ...(m.domain ? { domain: m.domain } : {}) }));
+  const topTools = (scan.tools || []).slice(0, CAPS.topTools).map((t) => ({ id: t.id, label: t.label, ...(t.domain ? { domain: t.domain } : {}) }));
+  const topIntegrations = (scan.integrations || []).slice(0, CAPS.topIntegrations).map((i) => ({ id: i.id, label: i.label, ...(i.domain ? { domain: i.domain } : {}) }));
+
+  return { nodes, edges, stats, topModels, topTools, topIntegrations };
+}
+
+// Build the CONTENT-FREE structural summary handed to the LLM.
+function buildScrubbedSummary(scan, base) {
+  return {
+    project: { name: scrubString(scan.project.name), slug: scan.project.slug },
+    nodes: base.nodes.map((n) => ({
+      id: n.id,
+      label: scrubString(n.label),
+      kind: n.kind,
+      ...(n.sub ? { sub: scrubString(n.sub) } : {}),
+      ...(n.group ? { group: n.group } : {}),
+      ...(n.sourceRef ? { sourceRef: scrubString(n.sourceRef) } : {}),
+    })),
+    detectedEdges: base.edges.map((e) => ({ from: e.from, to: e.to, kind: e.kind })),
+    hints: {
+      entrypoints: (scan.entrypoints || []).map((p) => scrubString(p)),
+      stores: (scan.stores || []).map((s) => scrubString(s)),
+      technologies: scan.technologies || [],
+    },
+  };
+}
+
+// MERGE + VALIDATE the LLM enrichment onto the deterministic base.
+function mergeEnrichment(base, enrichment) {
+  const byId = new Map(base.nodes.map((n) => [n.id, n]));
+  const nodes = base.nodes.slice();
+
+  for (const raw of (enrichment && enrichment.nodes) || []) {
+    if (!raw || !raw.id) continue;
+    const existing = byId.get(raw.id);
+    if (existing) {
+      // may only FILL missing group/detail/sub — never override kind
+      if (!existing.group && raw.group) existing.group = clampStr(raw.group, CAPS.label);
+      if (!existing.detail && raw.detail) existing.detail = clampStr(raw.detail, CAPS.detail);
+      if (!existing.sub && raw.sub) existing.sub = clampStr(raw.sub, CAPS.sub);
+      continue;
+    }
+    // new node: only entry/cron/service/store are LLM-introducible
+    if (!LLM_INTRODUCIBLE.has(raw.kind)) continue;
+    const n = {
+      id: raw.id,
+      label: clampStr(raw.label || raw.id, CAPS.label),
+      kind: raw.kind,
+      ...(raw.sub ? { sub: clampStr(raw.sub, CAPS.sub) } : {}),
+      ...(raw.group ? { group: clampStr(raw.group, CAPS.label) } : {}),
+      ...(raw.detail ? { detail: clampStr(raw.detail, CAPS.detail) } : {}),
+      ...(raw.sourceRef ? { sourceRef: raw.sourceRef } : {}),
+    };
+    byId.set(n.id, n);
+    nodes.push(n);
+    if (nodes.length >= CAPS.nodes) break;
+  }
+
+  // edges: deterministic first, then valid LLM edges; dedupe; cap
+  const edges = [];
+  const edgeSeen = new Set();
+  const addEdge = (e) => {
+    if (!e || !byId.has(e.from) || !byId.has(e.to)) return;
+    if (e.from === e.to) return;
+    const kind = EDGE_KINDS.has(e.kind) ? e.kind : 'calls';
+    const key = e.from + '>' + e.to + '>' + kind;
+    if (edgeSeen.has(key)) return;
+    edgeSeen.add(key);
+    edges.push({ from: e.from, to: e.to, kind, ...(e.label ? { label: clampStr(e.label, CAPS.edgeLabel) } : {}) });
+  };
+  base.edges.forEach(addEdge);
+  for (const e of (enrichment && enrichment.edges) || []) {
+    if (edges.length >= CAPS.edges) break;
+    addEdge(e);
+  }
+
+  return { nodes: nodes.slice(0, CAPS.nodes), edges: edges.slice(0, CAPS.edges) };
+}
+
+async function generateGraph({ scan, llm = null, onTrace = null } = {}) {
+  if (!scan || !scan.project) throw new Error('graph-generator: scan.project required');
+  const base = assembleDeterministic(scan);
+
+  let enrichment = { nodes: [], edges: [] };
+  if (llm && typeof llm.inferGraph === 'function') {
+    const summary = buildScrubbedSummary(scan, base);
+    const started = Date.now();
+    try {
+      const res = await llm.inferGraph(summary);
+      enrichment = res && typeof res === 'object' ? res : enrichment;
+      emitTrace(onTrace, {
+        event: 'graph.infer',
+        ok: true,
+        model: (res && res.__model) || (llm.model) || 'unknown',
+        inputTokens: res && res.__inputTokens,
+        outputTokens: res && res.__outputTokens,
+        costUsd: res && res.__costUsd,
+        latencyMs: Date.now() - started,
+        contentFree: true,
+      });
+    } catch (err) {
+      // enrichment is best-effort; a failed LLM pass yields the deterministic
+      // graph, never a crash and never a fabricated flow.
+      emitTrace(onTrace, { event: 'graph.infer', ok: false, error: err && err.name, latencyMs: Date.now() - started, contentFree: true });
+    }
+  }
+
+  const graph = mergeEnrichment(base, enrichment);
+  return {
+    version: 1,
+    project: {
+      name: clampStr(scan.project.name, 60),
+      slug: scan.project.slug,
+      ...(scan.project.tagline ? { tagline: clampStr(scan.project.tagline, 120) } : {}),
+      ...(scan.project.iconDomain ? { iconDomain: scan.project.iconDomain } : {}),
+      date: scan.project.date || new Date().toISOString().slice(0, 10),
+    },
+    stats: base.stats,
+    topModels: base.topModels,
+    topTools: base.topTools,
+    topIntegrations: base.topIntegrations,
+    graph,
+  };
+}
+
+function emitTrace(onTrace, evt) {
+  if (typeof onTrace === 'function') {
+    try { onTrace(evt); } catch { /* instrumentation must never break generation */ }
+  }
+}
+
+module.exports = {
+  generateGraph,
+  assembleDeterministic,
+  buildScrubbedSummary,
+  mergeEnrichment,
+  scrubString,
+  clampStr,
+  CAPS,
+  KINDS,
+  EDGE_KINDS,
+  LLM_INTRODUCIBLE,
+};