switchboard-cli 0.1.0-alpha.3 → 0.1.0-alpha.5

package/node_modules/@switchboard/core/src/codex-audit.ts

@@ -1,301 +0,0 @@
-import type {
-  AuditFinding,
-  AuditResult,
-  AuditTrigger,
-  ProjectContract,
-  ReturnReport,
-} from "./types";
-import { auditResultSchema } from "./types";
-import { randomBytes } from "crypto";
-
-// ---------------------------------------------------------------------------
-// Sensitive system detection — drives audit requirements
-// ---------------------------------------------------------------------------
-
-const SENSITIVE_FILE_PATTERNS: [RegExp, AuditTrigger][] = [
-  [/auth|permission|role|session|jwt|oauth|token/i, "auth_logic"],
-  [/payment|billing|credit|charge|stripe|subscription/i, "payment_logic"],
-  [/migration|\.sql$|schema/i, "database_migration"],
-];
-
-function detectAuditTriggers(
-  changedFiles: string[],
-  complexityMode: string | null,
-  operatorRequested: boolean,
-): AuditTrigger[] {
-  const triggers = new Set<AuditTrigger>();
-
-  for (const file of changedFiles) {
-    for (const [pattern, trigger] of SENSITIVE_FILE_PATTERNS) {
-      if (pattern.test(file)) triggers.add(trigger);
-    }
-  }
-
-  if (complexityMode === "governance") triggers.add("dangerous_mode");
-  if (operatorRequested) triggers.add("operator_requested");
-
-  return [...triggers];
-}
-
-// ---------------------------------------------------------------------------
-// Audit requirement check
-// ---------------------------------------------------------------------------
-
-/**
- * Pre-promotion check — determines whether a return needs audit before
- * canonical advancement.
- *
- * This is NOT a Codex API call. It is a deterministic, pattern-based check
- * that surfaces audit findings for operator review. The operator decides
- * whether to send findings to Codex for deeper audit. This matches the
- * locked founder decision: "manual audit surface first."
- *
- * ALL code-touching promotable impl returns require the check.
- * Sensitive triggers (auth, payment, migration) escalate severity.
- */
-export function shouldRequireAudit(input: {
-  report: ReturnReport;
-  complexityMode: string | null;
-  taskType: string;
-  operatorRequested?: boolean;
-}): { required: boolean; triggers: AuditTrigger[] } {
-  const { report, complexityMode, taskType, operatorRequested } = input;
-
-  // No file changes + no artifacts = nothing to audit
-  if (report.changed_files.length === 0 && report.artifacts_created.filter(Boolean).length === 0) {
-    return { required: false, triggers: [] };
-  }
-
-  // Only implementation/repo-bound task types require audit
-  if (taskType !== "implementation-request" && taskType !== "repo-bound-shaping") {
-    return { required: false, triggers: [] };
-  }
-
-  // ALL code-touching impl returns are audited — sensitive triggers escalate severity
-  const triggers = detectAuditTriggers(
-    report.changed_files,
-    complexityMode,
-    operatorRequested ?? false,
-  );
-
-  // Code-touching impl work ALWAYS requires audit, even without sensitive triggers
-  return { required: true, triggers };
-}
-
-// ---------------------------------------------------------------------------
-// Deterministic audit checks — no LLM, pattern-based
-// ---------------------------------------------------------------------------
-
-function auditAuthLogic(report: ReturnReport): AuditFinding[] {
-  const findings: AuditFinding[] = [];
-  const authFiles = report.changed_files.filter(f => /auth|permission|role|session|jwt|oauth|token/i.test(f));
-
-  if (authFiles.length > 0) {
-    // Check: did verification cover auth?
-    const hasAuthTest = report.verification_run.some(v => /auth|permission|role|session/i.test(v));
-    if (!hasAuthTest) {
-      findings.push({
-        check: "auth_verification_coverage",
-        severity: "caution",
-        detail: `${authFiles.length} auth-related file(s) changed but no verification check mentions auth.`,
-        files_affected: authFiles,
-      });
-    }
-
-    // Check: did evidence mention auth?
-    const hasAuthEvidence = report.evidence.some(e => /auth|permission|role|session/i.test(e));
-    if (!hasAuthEvidence) {
-      findings.push({
-        check: "auth_evidence_present",
-        severity: "caution",
-        detail: "Auth files changed but no evidence item references auth behavior.",
-        files_affected: authFiles,
-      });
-    }
-  }
-
-  return findings;
-}
-
-function auditPaymentLogic(report: ReturnReport): AuditFinding[] {
-  const findings: AuditFinding[] = [];
-  const paymentFiles = report.changed_files.filter(f => /payment|billing|credit|charge|stripe|subscription/i.test(f));
-
-  if (paymentFiles.length > 0) {
-    // Payment changes without verification are always blockers
-    const hasPaymentTest = report.verification_run.some(v => /payment|billing|charge|stripe/i.test(v));
-    if (!hasPaymentTest) {
-      findings.push({
-        check: "payment_verification_required",
-        severity: "blocker",
-        detail: `${paymentFiles.length} payment-related file(s) changed with no payment verification. Audit blocks promotion.`,
-        files_affected: paymentFiles,
-      });
-    }
-  }
-
-  return findings;
-}
-
-function auditDatabaseMigration(report: ReturnReport): AuditFinding[] {
-  const findings: AuditFinding[] = [];
-  const migrationFiles = report.changed_files.filter(f => /migration|\.sql$|schema/i.test(f));
-
-  if (migrationFiles.length > 0) {
-    // Check: any evidence of migration testing?
-    const hasMigrationEvidence = report.evidence.some(e => /migration|schema|table|database/i.test(e)) ||
-      report.verification_run.some(v => /migration|schema|sql/i.test(v));
-
-    if (!hasMigrationEvidence) {
-      findings.push({
-        check: "migration_evidence_required",
-        severity: "caution",
-        detail: `${migrationFiles.length} migration file(s) changed but no evidence of migration testing.`,
-        files_affected: migrationFiles,
-      });
-    }
-  }
-
-  return findings;
-}
-
-function auditDangerousMode(report: ReturnReport): AuditFinding[] {
-  const findings: AuditFinding[] = [];
-
-  // In dangerous mode, every file change gets scrutiny
-  if (report.changed_files.length > 10) {
-    findings.push({
-      check: "dangerous_mode_blast_radius",
-      severity: "caution",
-      detail: `${report.changed_files.length} files changed in dangerous-mode project. Review blast radius.`,
-      files_affected: report.changed_files.slice(0, 5),
-    });
-  }
-
-  if (report.verification_run.length === 0) {
-    findings.push({
-      check: "dangerous_mode_no_verification",
-      severity: "blocker",
-      detail: "Dangerous-mode project with zero verification checks. Audit blocks promotion.",
-      files_affected: [],
-    });
-  }
-
-  return findings;
-}
-
-// ---------------------------------------------------------------------------
-// Compute audit result
-// ---------------------------------------------------------------------------
-
-// Baseline check — runs for ALL code-touching returns
-function auditBaseline(report: ReturnReport): AuditFinding[] {
-  const findings: AuditFinding[] = [];
-
-  // All code-touching returns need at least one verification check
-  if (report.changed_files.length > 0 && report.verification_run.length === 0) {
-    findings.push({
-      check: "code_change_no_verification",
-      severity: "caution",
-      detail: `${report.changed_files.length} file(s) changed with no verification checks run.`,
-      files_affected: report.changed_files.slice(0, 5),
-    });
-  }
-
-  // All code-touching returns need evidence
-  if (report.changed_files.length > 0 && report.evidence.length === 0) {
-    findings.push({
-      check: "code_change_no_evidence",
-      severity: "caution",
-      detail: `${report.changed_files.length} file(s) changed with no evidence items.`,
-      files_affected: [],
-    });
-  }
-
-  return findings;
-}
-
-export function computeAuditResult(input: {
-  report: ReturnReport;
-  triggers: AuditTrigger[];
-  returnId: string;
-}): AuditResult {
-  const { report, triggers, returnId } = input;
-
-  // Baseline check runs for ALL code-touching returns
-  const allFindings: AuditFinding[] = [...auditBaseline(report)];
-
-  // Sensitive trigger checks run on top
-  for (const trigger of triggers) {
-    switch (trigger) {
-      case "auth_logic":
-        allFindings.push(...auditAuthLogic(report));
-        break;
-      case "payment_logic":
-        allFindings.push(...auditPaymentLogic(report));
-        break;
-      case "database_migration":
-        allFindings.push(...auditDatabaseMigration(report));
-        break;
-      case "dangerous_mode":
-        allFindings.push(...auditDangerousMode(report));
-        break;
-      case "operator_requested":
-        allFindings.push(...auditAuthLogic(report));
-        allFindings.push(...auditPaymentLogic(report));
-        allFindings.push(...auditDatabaseMigration(report));
-        break;
-    }
-  }
-
-  const blockerCount = allFindings.filter(f => f.severity === "blocker").length;
-  const cautionCount = allFindings.filter(f => f.severity === "caution").length;
-
-  let outcome: "pass" | "pass_with_cautions" | "blocker";
-  if (blockerCount > 0) outcome = "blocker";
-  else if (cautionCount > 0) outcome = "pass_with_cautions";
-  else outcome = "pass";
-
-  // Collect systems audited
-  const systemsAudited = [...new Set(triggers.map(t => {
-    switch (t) {
-      case "auth_logic": return "Auth";
-      case "payment_logic": return "Payment";
-      case "database_migration": return "Database";
-      case "dangerous_mode": return "All (dangerous mode)";
-      case "operator_requested": return "All (operator)";
-    }
-  }))];
-
-  return auditResultSchema.parse({
-    audit_id: `aud-${randomBytes(8).toString("hex")}`,
-    return_id: returnId,
-    triggered_by: triggers,
-    audit_required: true,
-    outcome,
-    findings: allFindings,
-    blocker_count: blockerCount,
-    caution_count: cautionCount,
-    systems_audited: systemsAudited,
-    checked_at: new Date().toISOString(),
-  });
-}
-
-// ---------------------------------------------------------------------------
-// No-audit result — when audit is not required
-// ---------------------------------------------------------------------------
-
-export function noAuditRequired(returnId: string): AuditResult {
-  return auditResultSchema.parse({
-    audit_id: "",
-    return_id: returnId,
-    triggered_by: [],
-    audit_required: false,
-    outcome: "not_required",
-    findings: [],
-    blocker_count: 0,
-    caution_count: 0,
-    systems_audited: [],
-    checked_at: new Date().toISOString(),
-  });
-}

package/node_modules/@switchboard/core/src/codex-executor.ts

@@ -1,22 +0,0 @@
-/**
- * Codex execution readiness + configuration.
- * The actual CLI dispatch lives in apps/web where the subprocess is spawned.
- *
- * This mirrors claude-executor.ts: core exports readiness checks and
- * configuration, apps/web handles the actual execution.
- */
-
-export function getCodexExecutionModel(): string {
-  return process.env.SWITCHBOARD_CODEX_MODEL || "o4-mini";
-}
-
-export function isCodexExecutionReady(): {
-  ready: boolean;
-  missing: string[];
-} {
-  const missing: string[] = [];
-  if (!process.env.OPENAI_API_KEY) {
-    missing.push("OPENAI_API_KEY");
-  }
-  return { ready: missing.length === 0, missing };
-}

package/node_modules/@switchboard/core/src/compiler-adapter.ts

@@ -1,284 +0,0 @@
-import type {
-  ArtifactStatus,
-  CandidateArtifact,
-  CompilerSelection,
-  CompilerType,
-  ComplexityClassification,
-  LoopContract,
-  ProjectContract,
-  ReconcileReport,
-  SynthesizedSeed,
-} from "./types";
-import { candidateArtifactSchema, compilerSelectionSchema } from "./types";
-
-// ---------------------------------------------------------------------------
-// Compiler adapter interface
-// ---------------------------------------------------------------------------
-
-export interface CompilerAdapter {
-  type: CompilerType;
-  name: string;
-  description: string;
-}
-
-export const COMPILER_ADAPTERS: Record<CompilerType, CompilerAdapter> = {
-  "fidelity-first": {
-    type: "fidelity-first",
-    name: "ChatGPT (fidelity-first)",
-    description:
-      "Best for preserving user voice, intent fidelity, and producing a brief that reads like the builder's own project.",
-  },
-  "execution-first": {
-    type: "execution-first",
-    name: "Claude Code (execution-first)",
-    description:
-      "Best for producing an execution-ready build brief with concrete acceptance criteria and deployment targets.",
-  },
-  "internal-fallback": {
-    type: "internal-fallback",
-    name: "Switchboard internal synthesis",
-    description:
-      "Switchboard's own heuristic compilation. Used as fallback or for seed extraction and scope judgment.",
-  },
-};
-
-// ---------------------------------------------------------------------------
-// Compiler selection logic
-// ---------------------------------------------------------------------------
-
-export function selectCompiler(
-  complexity: ComplexityClassification,
-  seed: SynthesizedSeed,
-): CompilerSelection {
-  if (complexity.mode === "minimal") {
-    return compilerSelectionSchema.parse({
-      compiler_type: "internal-fallback",
-      recommended_surface: "chatgpt",
-      rationale: "Simple project — internal synthesis is sufficient.",
-    });
-  }
-
-  if (complexity.mode === "governance") {
-    return compilerSelectionSchema.parse({
-      compiler_type: "fidelity-first",
-      recommended_surface: "chatgpt",
-      rationale: "Dangerous complexity — fidelity-first compilation preserves intent while narrowing scope.",
-    });
-  }
-
-  const hasExplicitSlice = seed.first_build_slice.length > 20;
-  const hasLowUncertainty = seed.open_questions.length <= 2 && seed.missing_inputs.length === 0;
-
-  if (hasExplicitSlice && hasLowUncertainty && seed.confidence === "high") {
-    return compilerSelectionSchema.parse({
-      compiler_type: "execution-first",
-      recommended_surface: "claude-code",
-      rationale: "Standard complexity with clear first slice and high confidence — execution-first compilation.",
-    });
-  }
-
-  return compilerSelectionSchema.parse({
-    compiler_type: "fidelity-first",
-    recommended_surface: "chatgpt",
-    rationale: "Standard complexity with open questions — fidelity-first compilation preserves intent.",
-  });
-}
-
-// ---------------------------------------------------------------------------
-// Fidelity-first external compiler prompt generation
-//
-// This generates the exact prompt a user would paste into a fresh ChatGPT
-// session to get a fidelity-first compilation. The prompt embeds the seed,
-// non-goals, open questions, and constraints so the external compiler has
-// full context without needing to re-extract from the raw idea.
-// ---------------------------------------------------------------------------
-
-export function generateFidelityFirstPrompt(
-  seed: SynthesizedSeed,
-  contract: ProjectContract,
-  rawIdea: string,
-  constraints: string,
-): string {
-  const nonGoals = contract.non_goals.map((g) => `- ${g}`).join("\n");
-  const openQuestions =
-    [...seed.missing_inputs, ...seed.open_questions].length > 0
-      ? [...seed.missing_inputs, ...seed.open_questions].map((q) => `- ${q}`).join("\n")
-      : "- None identified.";
-
-  return `You are a product compiler. Your job is to take the project seed below and produce a strong, execution-ready build brief.
-
-Core principle: Maximum Aligned Build-Out.
-Maximize execution-readiness and justified detail without drifting from the original problem, target user, desired outcome, or non-goals. More depth is good. More scope is not.
-
-No major addition without a parent.
-Every meaningful addition must trace to: explicit user input, explicit research finding, or explicit execution requirement.
-
-## Project seed (already extracted — do not re-extract from raw idea)
-
-**Title**: ${seed.title}
-**One-liner**: ${seed.one_liner}
-**Problem**: ${seed.problem}
-**Proposed solution**: ${seed.proposed_solution}
-**Target user**: ${seed.target_user}
-**V1 outcome**: ${seed.v1_outcome}
-**Confidence**: ${seed.confidence}
-
-**Non-goals** (must be preserved):
-${nonGoals}
-
-**Open questions** (must be surfaced honestly):
-${openQuestions}
-
-${seed.first_build_slice ? `**First build slice** (from user's own V1 imagination):\n${seed.first_build_slice}\n` : ""}
-**Constraints**: ${constraints || "None stated."}
-
-## Raw idea (for reference — the seed above is the source of truth)
-
-${rawIdea}
-
-## What to produce
-
-Write a structured build brief with these sections:
-1. What this product is
-2. Who it is for
-3. The problem (in the user's voice)
-4. The proposed solution
-5. V1 promise
-6. Scope in (concrete, tied to the first build slice)
-7. Scope out (anchored to non-goals)
-8. First build slice (decomposed into steps)
-9. Acceptance criteria (product-centric, testable)
-10. Open questions (preserve the user's actual uncertainties)
-11. What must not change (intent anchors)
-12. Key risks / unknowns
-
-Rules:
-- Preserve the user's voice. Do not flatten into generic product-speak.
-- Keep the brief under 800 words.
-- Do not add features, audiences, or goals the user did not express.
-- Do not resolve open questions — surface them honestly.
-- Make the brief specific enough that a developer could start building from it tomorrow.`;
-}
-
-// ---------------------------------------------------------------------------
-// Execution-first external compiler prompt generation
-//
-// This generates a bounded implementation prompt for Claude Code derived
-// from the accepted canonical brief and current loop contract. The prompt
-// includes hard scope boundaries, acceptance criteria, and a return contract.
-// ---------------------------------------------------------------------------
-
-export function generateExecutionFirstPrompt(input: {
-  spec_markdown: string;
-  contract: ProjectContract;
-  loop: LoopContract;
-}): string {
-  const nonGoals = input.contract.non_goals.map((g) => `- ${g}`).join("\n");
-  const scopeIn = input.loop.scope_in.map((s) => `- ${s}`).join("\n");
-  const scopeOut = input.loop.scope_out.map((s) => `- ${s}`).join("\n");
-  const doneWhen = input.loop.done_when.map((s) => `- ${s}`).join("\n");
-  const successCriteria = input.loop.success_criteria.map((s) => `- ${s}`).join("\n");
-  const verifyWith = input.loop.verify_with.map((s) => `- ${s}`).join("\n");
-  const blockerEscalation = input.loop.blocker_escalation.map((s) => `- ${s}`).join("\n");
-
-  return `You are executing a bounded implementation loop. Your job is to build exactly what the brief and loop contract specify, nothing more.
-
-## Project identity
-
-**Title**: ${input.contract.title}
-**Target user**: ${input.contract.target_user}
-**V1 outcome**: ${input.contract.desired_v1_outcome}
-
-## Canonical brief (this is the accepted project truth — do not rewrite it)
-
-${input.spec_markdown}
-
-## Bounded loop contract
-
-**Objective**: ${input.loop.objective}
-**Execution shape**: ${input.loop.execution_shape}
-
-**Scope in** (build only this):
-${scopeIn}
-
-**Scope out** (do not build this):
-${scopeOut}
-
-**Non-goals** (hard boundaries — do not cross):
-${nonGoals}
-
-**Done-when**:
-${doneWhen}
-
-**Success criteria**:
-${successCriteria}
-
-**Verify-with**:
-${verifyWith}
-
-**Return when**: ${input.loop.return_when}
-
-**Blocker escalation** (return immediately if any of these occur):
-${blockerEscalation}
-
-## Return contract
-
-When you are done, produce a structured return report with these exact fields:
-
-- **status**: done | partial | blocked
-- **objective_met**: yes | partial | no
-- **done_when_met**: yes | partial | no
-- **summary**: what you accomplished (1-2 sentences)
-- **changed_files**: list of files created or modified
-- **decisions_made**: list of implementation decisions (each must trace to scope_in or project contract)
-- **blockers**: anything that prevented completion
-- **escalations**: anything that triggered a blocker escalation rule
-- **evidence**: concrete proof of what was built (test results, verification output)
-- **success_criteria_met**: which success criteria you satisfied
-- **verification_run**: what checks you ran
-- **artifacts_created**: what deliverables were produced
-- **recommended_next_step**: what should happen next (must stay aligned with the V1 outcome)
-
-## Rules
-
-- Build only what scope_in specifies. Do not add features.
-- Respect scope_out and non-goals as hard boundaries.
-- If you encounter a decision not covered by the loop contract, make a conservative choice and document it in decisions_made.
-- If scope expands unexpectedly, return immediately with status: blocked.
-- If a product decision becomes unclear, return immediately with status: blocked.
-- Preserve the project's target user, V1 outcome, and non-goals in every implementation choice.`;
-}
-
-// ---------------------------------------------------------------------------
-// Candidate artifact creation and promotion
-// ---------------------------------------------------------------------------
-
-export function createCandidateArtifact(
-  specMarkdown: string,
-  source: CompilerType,
-): CandidateArtifact {
-  return candidateArtifactSchema.parse({
-    spec_markdown: specMarkdown,
-    source,
-    status: "candidate" as ArtifactStatus,
-  });
-}
-
-export function promoteCandidate(
-  candidate: CandidateArtifact,
-  reconcile: ReconcileReport,
-): CandidateArtifact {
-  if (reconcile.recommendation === "review-required") {
-    return candidateArtifactSchema.parse({
-      ...candidate,
-      status: "candidate" as ArtifactStatus,
-      reconcile,
-    });
-  }
-
-  return candidateArtifactSchema.parse({
-    ...candidate,
-    status: "canonical" as ArtifactStatus,
-    reconcile,
-  });
-}