swarm-orchestrator 7.0.0-alpha.0

package/dist/src/sarif-formatter.js

@@ -0,0 +1,140 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.formatSarif = formatSarif;
+const SARIF_SCHEMA = 'https://raw.githubusercontent.com/oasis-tcs/sarif-spec/main/sarif-2.1/schema/sarif-schema-2.1.0.json';
+const SARIF_VERSION = '2.1.0';
+const TOOL_NAME = 'swarm-orchestrator';
+/** Maps gate IDs to their SARIF rule descriptions. */
+const RULE_DESCRIPTIONS = {
+    'scaffold-defaults': 'Generated code contains TODO comments, placeholder text, or default scaffold values',
+    'duplicate-blocks': 'Code block duplicated beyond configured threshold',
+    'hardcoded-config': 'Configuration value hardcoded instead of externalized',
+    'readme-claims': 'README claim does not match implemented functionality',
+    'test-isolation': 'Test depends on shared mutable state',
+    'test-coverage': 'Test coverage below configured threshold',
+    'accessibility': 'Missing accessibility attribute or semantic element',
+    'runtime-checks': 'Code fails build or test execution',
+};
+/**
+ * Convert a GateStatus to the corresponding SARIF level.
+ * Gates that pass produce no results; only fail and skip are mapped.
+ * @param status - The gate status from the quality gates pipeline
+ * @returns The SARIF severity level
+ */
+function statusToLevel(status) {
+    return status === 'fail' ? 'error' : 'note';
+}
+/**
+ * Normalize a file path to a forward-slash relative URI with no leading "./".
+ * @param filePath - Absolute or relative file path from a gate issue
+ * @returns SARIF-compliant relative URI
+ */
+function normalizeUri(filePath) {
+    const normalized = filePath.replace(/\\/g, '/');
+    return normalized.replace(/^\.\//, '');
+}
+/**
+ * Build a SARIF physical location from a gate issue.
+ * Populates region.startLine when the issue references a specific line.
+ * @param issue - The gate issue with optional file and line info
+ * @returns Physical location for the SARIF result
+ */
+function buildLocation(issue) {
+    const uri = issue.filePath ? normalizeUri(issue.filePath) : '.';
+    const location = {
+        artifactLocation: { uri },
+    };
+    if (issue.line && issue.line > 0) {
+        location.region = { startLine: issue.line };
+    }
+    return location;
+}
+/**
+ * Build SARIF rules array from gate results.
+ * One rule per gate that produced results (fail or skip with issues).
+ * @param gateResults - Array of gate results from the pipeline
+ * @returns Deduplicated SARIF rules
+ */
+function buildRules(gateResults) {
+    const seen = new Set();
+    const rules = [];
+    for (const gate of gateResults) {
+        const ruleId = `swarm/${gate.id}`;
+        if (seen.has(ruleId))
+            continue;
+        seen.add(ruleId);
+        rules.push({
+            id: ruleId,
+            shortDescription: {
+                text: RULE_DESCRIPTIONS[gate.id] || gate.title,
+            },
+        });
+    }
+    return rules;
+}
+/**
+ * Convert gate results into SARIF result entries.
+ * Only gates with status 'fail' produce error-level results.
+ * Gates with status 'skip' produce note-level entries if they have issues.
+ * Gates with status 'pass' are omitted entirely.
+ * @param gateResults - Array of gate results from the pipeline
+ * @returns SARIF result entries
+ */
+function buildResults(gateResults) {
+    const results = [];
+    for (const gate of gateResults) {
+        if (gate.status === 'pass')
+            continue;
+        if (gate.status === 'skip' && gate.issues.length === 0)
+            continue;
+        const ruleId = `swarm/${gate.id}`;
+        const level = statusToLevel(gate.status);
+        if (gate.issues.length === 0) {
+            // Gate failed/skipped but has no specific issues; emit a single project-level entry
+            results.push({
+                ruleId,
+                message: { text: gate.title },
+                level,
+                locations: [{ physicalLocation: { artifactLocation: { uri: '.' } } }],
+            });
+            continue;
+        }
+        for (const issue of gate.issues) {
+            results.push({
+                ruleId,
+                message: { text: issue.message },
+                level,
+                locations: [{ physicalLocation: buildLocation(issue) }],
+            });
+        }
+    }
+    return results;
+}
+/**
+ * Format quality gate results as a SARIF 2.1.0 JSON log.
+ * Produces output compatible with GitHub code scanning upload.
+ * @param runResult - The complete gate run result from the pipeline
+ * @param toolVersion - The swarm-orchestrator version from package.json
+ * @returns SARIF JSON string
+ */
+function formatSarif(runResult, toolVersion) {
+    const allGates = runResult.results;
+    const reportableGates = allGates.filter(g => g.status === 'fail' || (g.status === 'skip' && g.issues.length > 0));
+    const sarifLog = {
+        $schema: SARIF_SCHEMA,
+        version: SARIF_VERSION,
+        runs: [
+            {
+                tool: {
+                    driver: {
+                        name: TOOL_NAME,
+                        version: toolVersion,
+                        rules: buildRules(reportableGates),
+                    },
+                },
+                results: buildResults(allGates),
+            },
+        ],
+    };
+    return JSON.stringify(sarifLog, null, 2);
+}

package/dist/src/scheduling/dependency-analyzer.js

@@ -0,0 +1,178 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.analyzeStepTouchpoints = analyzeStepTouchpoints;
+exports.analyzePlanDependencies = analyzePlanDependencies;
+exports.canRunTogether = canRunTogether;
+const path = __importStar(require("path"));
+const FILE_REF_RE = /\b(?:[\w.-]+\/)+(?:[\w.-]+|\*)\.(?:[cm]?[jt]sx?|py|java|go|rs|json|ya?ml|toml|md|css|html|sh|sql|dockerignore)\b/g;
+const DIRECTORY_REF_RE = /\b(?:src|test|tests|lib|app|server|client|config|scripts|docs|benchmarks|agents|\.github|\.swarm)\/(?:[\w./-]+\/?)?/g;
+const BARE_FILE_RE = /\b(?:Dockerfile|Makefile|package\.json|package-lock\.json|pnpm-lock\.yaml|yarn\.lock|tsconfig\.json|README\.md|\.env(?:\.\w+)?|\.dockerignore)\b/g;
+/**
+ * Conservatively infer file and state touchpoints from task text.
+ *
+ * Empty touchpoints make a step conservative, which means it conflicts with
+ * other ready steps unless an explicit path is present in both tasks.
+ */
+function analyzeStepTouchpoints(step) {
+    const text = [step.task, ...step.expectedOutputs].join('\n');
+    const touchpoints = new Set();
+    collectMatches(text, FILE_REF_RE, touchpoints);
+    collectMatches(text, DIRECTORY_REF_RE, touchpoints);
+    collectMatches(text, BARE_FILE_RE, touchpoints);
+    const sharedState = new Set();
+    if (/\b(database|db|migration|schema|sqlite|postgres|mysql|redis)\b/i.test(text)) {
+        sharedState.add('state:database');
+    }
+    if (/\b(auth|session|cookie|token|login|logout)\b/i.test(text)) {
+        sharedState.add('state:auth');
+    }
+    if (/\b(env|environment|secret|config var|configuration)\b/i.test(text)) {
+        sharedState.add('state:environment');
+    }
+    if (/\b(test setup|test fixture|mock|seed data|global state)\b/i.test(text)) {
+        sharedState.add('state:test-fixtures');
+    }
+    const normalized = Array.from(touchpoints)
+        .map(normalizeTouchpoint)
+        .filter(Boolean)
+        .sort();
+    return {
+        stepNumber: step.stepNumber,
+        touchpoints: unique(normalized),
+        sharedState: Array.from(sharedState).sort(),
+        conservative: normalized.length === 0,
+    };
+}
+/**
+ * Build a conflict graph for all plan steps.
+ *
+ * Steps conflict when touchpoints overlap, shared state overlaps, or either
+ * step lacks enough static evidence to prove independence.
+ */
+function analyzePlanDependencies(plan) {
+    const steps = new Map();
+    const conflicts = new Map();
+    for (const step of plan.steps) {
+        const analysis = analyzeStepTouchpoints(step);
+        steps.set(step.stepNumber, analysis);
+        conflicts.set(step.stepNumber, new Set());
+    }
+    for (let i = 0; i < plan.steps.length; i += 1) {
+        for (let j = i + 1; j < plan.steps.length; j += 1) {
+            const a = steps.get(plan.steps[i].stepNumber);
+            const b = steps.get(plan.steps[j].stepNumber);
+            if (stepsConflict(a, b)) {
+                conflicts.get(a.stepNumber).add(b.stepNumber);
+                conflicts.get(b.stepNumber).add(a.stepNumber);
+            }
+        }
+    }
+    return {
+        steps,
+        conflicts,
+        parallelizable: hasIndependentPair(plan.steps, conflicts),
+    };
+}
+function canRunTogether(analysis, stepA, stepB) {
+    return !(analysis.conflicts.get(stepA)?.has(stepB));
+}
+function collectMatches(text, regex, out) {
+    for (const match of text.matchAll(regex)) {
+        if (isExcludedReference(text, match.index ?? 0))
+            continue;
+        if (match[0])
+            out.add(match[0]);
+    }
+}
+function isExcludedReference(text, index) {
+    const before = text.slice(Math.max(0, index - 80), index).toLowerCase();
+    const lastBoundary = Math.max(before.lastIndexOf('\n'), before.lastIndexOf(';'));
+    const phrase = before.slice(lastBoundary + 1);
+    return /\b(excluding|exclude|excluded|ignore|ignoring|omit|omitting|skip|skipping)\b/.test(phrase);
+}
+function normalizeTouchpoint(value) {
+    const stripped = value.replace(/^[`'"]|[`'",.;:)]+$/g, '');
+    const normalized = stripped.replace(/\\/g, '/').replace(/^\.\//, '');
+    if (!normalized)
+        return '';
+    if (normalized.endsWith('/'))
+        return normalized;
+    if (!path.extname(normalized) && normalized.includes('/'))
+        return `${normalized}/`;
+    return normalized;
+}
+function stepsConflict(a, b) {
+    if (a.conservative || b.conservative)
+        return true;
+    if (a.sharedState.some(state => b.sharedState.includes(state)))
+        return true;
+    for (const left of a.touchpoints) {
+        for (const right of b.touchpoints) {
+            if (touchpointsOverlap(left, right))
+                return true;
+        }
+    }
+    return false;
+}
+function touchpointsOverlap(a, b) {
+    if (a === b)
+        return true;
+    const aIsDir = a.endsWith('/');
+    const bIsDir = b.endsWith('/');
+    if (aIsDir && bIsDir)
+        return a.startsWith(b) || b.startsWith(a);
+    if (aIsDir)
+        return b.startsWith(a);
+    if (bIsDir)
+        return a.startsWith(b);
+    return false;
+}
+function hasIndependentPair(steps, conflicts) {
+    for (let i = 0; i < steps.length; i += 1) {
+        for (let j = i + 1; j < steps.length; j += 1) {
+            const a = steps[i];
+            const b = steps[j];
+            if (!a.dependencies.includes(b.stepNumber) && !b.dependencies.includes(a.stepNumber)) {
+                if (!(conflicts.get(a.stepNumber)?.has(b.stepNumber)))
+                    return true;
+            }
+        }
+    }
+    return false;
+}
+function unique(values) {
+    return Array.from(new Set(values));
+}

package/dist/src/scheduling/work-stealing-queue.js

@@ -0,0 +1,123 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.WorkStealingQueue = void 0;
+const dependency_analyzer_1 = require("./dependency-analyzer");
+/**
+ * Dependency-aware queue for orchestrator steps.
+ *
+ * It is deliberately conservative: the static analyzer must prove that two
+ * ready steps do not conflict before they can be dispatched together.
+ */
+class WorkStealingQueue {
+    plan;
+    analysis;
+    pending = new Set();
+    running = new Set();
+    completed = new Set();
+    failed = new Set();
+    maxWorkers;
+    constructor(plan, options = {}) {
+        this.plan = plan;
+        this.analysis = (0, dependency_analyzer_1.analyzePlanDependencies)(plan);
+        this.maxWorkers = Math.max(1, options.maxWorkers ?? 1);
+        for (const step of plan.steps)
+            this.pending.add(step.stepNumber);
+    }
+    syncPlan(plan) {
+        this.plan = plan;
+        this.analysis = (0, dependency_analyzer_1.analyzePlanDependencies)(plan);
+        const activeNumbers = new Set(plan.steps.map(step => step.stepNumber));
+        for (const step of plan.steps) {
+            if (!this.completed.has(step.stepNumber) && !this.failed.has(step.stepNumber) && !this.running.has(step.stepNumber)) {
+                this.pending.add(step.stepNumber);
+            }
+        }
+        for (const stepNumber of Array.from(this.pending)) {
+            if (!activeNumbers.has(stepNumber))
+                this.pending.delete(stepNumber);
+        }
+    }
+    nextDispatches() {
+        const capacity = this.maxWorkers - this.running.size;
+        if (capacity <= 0)
+            return [];
+        const ready = this.readySteps();
+        const selected = [];
+        for (const stepNumber of ready) {
+            if (selected.length >= capacity)
+                break;
+            if (!this.canRunWithCurrentBatch(stepNumber, selected))
+                continue;
+            selected.push(stepNumber);
+        }
+        return selected;
+    }
+    markRunning(stepNumber) {
+        this.pending.delete(stepNumber);
+        this.running.add(stepNumber);
+    }
+    markCompleted(stepNumber) {
+        this.running.delete(stepNumber);
+        this.completed.add(stepNumber);
+    }
+    markFailed(stepNumber) {
+        this.running.delete(stepNumber);
+        this.failed.add(stepNumber);
+    }
+    setMaxWorkers(maxWorkers) {
+        this.maxWorkers = Math.max(1, maxWorkers);
+    }
+    hasPendingWork() {
+        return this.pending.size > 0 || this.running.size > 0;
+    }
+    isBlocked() {
+        return this.pending.size > 0 && this.running.size === 0 && this.readySteps().length === 0;
+    }
+    blockedSteps() {
+        return Array.from(this.pending).sort((a, b) => a - b);
+    }
+    stats() {
+        return {
+            pending: this.pending.size,
+            running: this.running.size,
+            completed: this.completed.size,
+            failed: this.failed.size,
+            maxWorkers: this.maxWorkers,
+            parallelEnabled: this.parallelEnabled(),
+        };
+    }
+    getAnalysis() {
+        return this.analysis;
+    }
+    readySteps() {
+        const ready = [];
+        for (const stepNumber of this.pending) {
+            const step = this.plan.steps.find(candidate => candidate.stepNumber === stepNumber);
+            if (!step)
+                continue;
+            if (step.dependencies.some(dep => this.failed.has(dep)))
+                continue;
+            if (step.dependencies.every(dep => this.completed.has(dep)))
+                ready.push(stepNumber);
+        }
+        return ready.sort((a, b) => a - b);
+    }
+    canRunWithCurrentBatch(stepNumber, selected) {
+        if (!this.parallelEnabled()) {
+            return this.running.size === 0 && selected.length === 0;
+        }
+        for (const running of this.running) {
+            if (!(0, dependency_analyzer_1.canRunTogether)(this.analysis, stepNumber, running))
+                return false;
+        }
+        for (const candidate of selected) {
+            if (!(0, dependency_analyzer_1.canRunTogether)(this.analysis, stepNumber, candidate))
+                return false;
+        }
+        return true;
+    }
+    parallelEnabled() {
+        return this.maxWorkers > 1 && this.analysis.parallelizable;
+    }
+}
+exports.WorkStealingQueue = WorkStealingQueue;

package/dist/src/secret-redactor.js

@@ -0,0 +1,90 @@
+"use strict";
+// Strips known secret values from strings and files so credentials
+// never persist in transcripts, session state, or log artifacts.
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.REDACTABLE_KEYS = void 0;
+exports.redactString = redactString;
+exports.redactFile = redactFile;
+const fs = __importStar(require("fs"));
+// Keys checked against process.env for values to redact.
+// Ordering does not matter; every key with a non-empty value is applied.
+const REDACTABLE_KEYS = [
+    'ANTHROPIC_API_KEY',
+    'OPENAI_API_KEY',
+    'GITHUB_TOKEN',
+    'COPILOT_TOKEN',
+    'GOOGLE_APPLICATION_CREDENTIALS',
+];
+exports.REDACTABLE_KEYS = REDACTABLE_KEYS;
+function buildRedactionList() {
+    const entries = [];
+    for (const key of REDACTABLE_KEYS) {
+        const value = process.env[key];
+        if (value && value.length > 0) {
+            entries.push({ keyName: key, value });
+        }
+    }
+    return entries;
+}
+/**
+ * Replace all occurrences of known secret values in the input string
+ * with `[REDACTED:<KEY_NAME>]` placeholders. Returns the sanitized string.
+ */
+function redactString(input) {
+    const entries = buildRedactionList();
+    let result = input;
+    for (const entry of entries) {
+        // Split/join is safe for literal replacement without regex escaping
+        while (result.includes(entry.value)) {
+            result = result.split(entry.value).join(`[REDACTED:${entry.keyName}]`);
+        }
+    }
+    return result;
+}
+/**
+ * Redact known secret values in-place from a file on disk.
+ * No-ops silently if the file does not exist (already cleaned up).
+ */
+function redactFile(filePath) {
+    if (!fs.existsSync(filePath))
+        return;
+    const original = fs.readFileSync(filePath, 'utf8');
+    const redacted = redactString(original);
+    // Only write back if something actually changed
+    if (redacted !== original) {
+        fs.writeFileSync(filePath, redacted, 'utf8');
+    }
+}