synapse-hub 2.2.4 → 2.4.0

package/tools/telemetry_correlator.py

@@ -219,6 +219,12 @@ def run_correlation_analysis(
             "db_pool_correlation": round(corr_db, 3),
             "disk_correlation": round(corr_disk, 3)
         },
+        "otel_metrics": {
+            "http.server.request.duration.p95_ms": round(max_p95, 2),
+            "system.cpu.utilization_ratio": round(max_cpu / 100.0, 4),
+            "system.memory.utilization_ratio": round(max_mem / 100.0, 4),
+            "system.db_pool.utilization_ratio": round(max_db / 100.0, 4),
+        },
         "root_causes": root_causes
     }
 
@@ -274,6 +280,7 @@ def main():
     parser.add_argument("--server-metrics", "-s", help="Path to Server Telemetry CSV (timestamp, cpu_pct, memory_pct, db_pool_pct).")
     parser.add_argument("--markdown", "-m", help="Path to export Markdown RCA report.")
     parser.add_argument("--json", "-j", help="Path to export structured JSON diagnostics.")
+    parser.add_argument("--otel", action="store_true", help="Export OpenTelemetry ResourceMetrics payload format.")
     parser.add_argument("--sample", action="store_true", help="Generate synthetic client & server telemetry dataset for verification.")
 
     args = parser.parse_args()
@@ -333,6 +340,44 @@ def main():
         print(f"    👉 Recommendation: {c['recommendation']}")
     print("=" * 80 + "\n")
 
+    if args.otel:
+        otel_metrics = {
+            "resourceMetrics": [
+                {
+                    "resource": {
+                        "attributes": [
+                            {"key": "service.name", "value": {"stringValue": "synapse-backend-under-test"}},
+                            {"key": "telemetry.sdk.name", "value": {"stringValue": "synapse-correlator"}},
+                        ]
+                    },
+                    "scopeMetrics": [
+                        {
+                            "scope": {"name": "synapse.telemetry.correlator", "version": "1.0.0"},
+                            "metrics": [
+                                {
+                                    "name": "http.server.request.duration",
+                                    "unit": "ms",
+                                    "gauge": {"dataPoints": [{"value": analysis["metrics_summary"]["max_p95_ms"]}]}
+                                },
+                                {
+                                    "name": "system.cpu.utilization",
+                                    "unit": "1",
+                                    "gauge": {"dataPoints": [{"value": round(analysis["metrics_summary"]["max_cpu_pct"] / 100.0, 4)}]}
+                                },
+                                {
+                                    "name": "system.memory.utilization",
+                                    "unit": "1",
+                                    "gauge": {"dataPoints": [{"value": round(analysis["metrics_summary"]["max_memory_pct"] / 100.0, 4)}]}
+                                },
+                            ]
+                        }
+                    ]
+                }
+            ]
+        }
+        print(json.dumps(otel_metrics, indent=2))
+        return
+
     if args.markdown:
         md = format_rca_markdown(analysis)
         os.makedirs(os.path.dirname(os.path.abspath(args.markdown)) or ".", exist_ok=True)

package/tools/test_impact.py

@@ -16,6 +16,7 @@ import os
 import sys
 import json
 import glob
+import re
 import argparse
 import subprocess
 
@@ -84,7 +85,7 @@ def build_fallback_graph(repo_root):
             with open(f, "r", encoding="utf-8", errors="ignore") as fp:
                 content = fp.read()
             for other_cls in class_map:
-                if other_cls != cls_name and other_cls in content:
+                if other_cls != cls_name and re.search(r"\b" + re.escape(other_cls) + r"\b", content):
                     edges.append({"source": cls_name, "target": other_cls})
         except Exception:
             pass
@@ -112,7 +113,9 @@ def build_fallback_graph(repo_root):
                 with open(f, "r", encoding="utf-8", errors="ignore") as fp:
                     content = fp.read()
                 for cls_name in class_map:
-                    if cls_name in content:
+                    # Word-boundary match: "BorrowPage" must not hit inside
+                    # "ApprovalBorrowPage" (substring match over-counted).
+                    if re.search(r"\b" + re.escape(cls_name) + r"\b", content):
                         edges.append({"source": rel_path, "target": cls_name})
             except Exception:
                 pass
@@ -120,20 +123,48 @@ def build_fallback_graph(repo_root):
     return {"nodes": nodes, "edges": edges}
 
 
+def merge_graphs(primary, fallback):
+    """Unions two graph dicts (nodes by id, edges by (source, target)).
+
+    The Graphify graph can silently miss edges (its Groovy extractor fails on
+    GString/closure-heavy files), so the grep-based fallback graph is always
+    merged in. Over-inclusion is the safe direction for impact analysis.
+    """
+    merged = {"nodes": [], "edges": []}
+    seen_nodes, seen_edges = set(), set()
+    for node in list(primary.get("nodes", [])) + list(fallback.get("nodes", [])):
+        node_id = node.get("id")
+        if node_id and node_id not in seen_nodes:
+            seen_nodes.add(node_id)
+            merged["nodes"].append(node)
+    for edge in list(primary.get("edges", [])) + list(fallback.get("edges", [])):
+        key = (edge.get("source"), edge.get("target"))
+        if key not in seen_edges:
+            seen_edges.add(key)
+            merged["edges"].append(edge)
+    return merged
+
+
 def load_graph(repo_root=None):
     root = repo_root or HUB_ROOT
+    graph_data = None
     graph_path = os.path.join(root, "graphify-out", "graph.json")
     if os.path.exists(graph_path):
         with open(graph_path, "r", encoding="utf-8") as fp:
-            return json.load(fp)
-
-    hub_graph = os.path.join(HUB_ROOT, "graphify-out", "graph.json")
-    if os.path.exists(hub_graph):
-        with open(hub_graph, "r", encoding="utf-8") as fp:
-            return json.load(fp)
-
-    # Dynamic fallback graph
-    return build_fallback_graph(root)
+            graph_data = json.load(fp)
+    else:
+        hub_graph = os.path.join(HUB_ROOT, "graphify-out", "graph.json")
+        if os.path.exists(hub_graph):
+            with open(hub_graph, "r", encoding="utf-8") as fp:
+                graph_data = json.load(fp)
+
+    # Always union the ground-truth fallback graph: when the target repo has a
+    # (possibly incomplete) graphify-out/graph.json the grep scan below is the
+    # only thing guaranteeing script->class edges actually exist.
+    fallback = build_fallback_graph(root)
+    if graph_data is None:
+        return fallback
+    return merge_graphs(graph_data, fallback)
 
 
 def get_git_modified_files(repo_root=None):
@@ -175,7 +206,15 @@ def get_total_test_cases(workspace_dir=None, graph_data=None, override_total=Non
     for pat in test_patterns:
         files.update(glob.glob(pat, recursive=True))
     if files:
-        return len(files)
+        # Katalon-style repos list one TC twice (Scripts/<TC_x>/ScriptN.groovy
+        # AND Test Cases/.../TC_x.tc) — dedupe by the TC identifier so the
+        # denominator counts logical test cases, not file copies.
+        identities = set()
+        for f in files:
+            rel = os.path.relpath(f, root).replace("\\", "/")
+            match = re.search(r"TC[_-]\d+", rel)
+            identities.add(("tc", match.group(0)) if match else ("file", rel))
+        return len(identities)
 
     # 2. Count test case nodes in graph if available
     if graph_data and "nodes" in graph_data:

package/tools/tms_sync_bridge.py

@@ -44,10 +44,21 @@ class TMSBridge:
 
     def __init__(self, provider: str = "jira", base_url: str = "", api_token: str = "", user_email: str = ""):
         self.provider = provider.lower()
-        self.base_url = base_url or os.getenv("JIRA_URL") or os.getenv("TESTRAIL_URL") or "https://mock-alm.enterprise.local"
-        self.api_token = api_token or os.getenv("JIRA_API_TOKEN") or os.getenv("TESTRAIL_API_KEY") or "mock_token_12345"
-        self.user_email = user_email or os.getenv("JIRA_USER_EMAIL") or "qa-agent@enterprise.local"
-        self.is_mock = "mock" in self.base_url or not os.getenv("JIRA_URL")
+        resolved_url = base_url or os.getenv("JIRA_URL") or os.getenv("TESTRAIL_URL") or ""
+        resolved_token = api_token or os.getenv("JIRA_API_TOKEN") or os.getenv("TESTRAIL_API_KEY") or ""
+        resolved_email = user_email or os.getenv("JIRA_USER_EMAIL") or ""
+
+        # Only use mock simulation if URL is omitted, mock is specified, or token is absent
+        if not resolved_url or "mock" in resolved_url or not resolved_token:
+            self.base_url = "https://mock-alm.enterprise.local"
+            self.api_token = "mock_token_12345"
+            self.user_email = resolved_email or "qa-agent@enterprise.local"
+            self.is_mock = True
+        else:
+            self.base_url = resolved_url
+            self.api_token = resolved_token
+            self.user_email = resolved_email
+            self.is_mock = False
 
     # -------------------------------------------------------------------------
     # 1. PULL MODE: Extract User Story & Acceptance Criteria
@@ -173,12 +184,17 @@ class TMSBridge:
                 "timestamp": datetime.now().isoformat()
             },
             "status": "Created",
-            "mode": "MOCK_SIMULATION" if self.is_mock else "LIVE_JIRA"
+            "mode": "MOCK_SIMULATION" if self.is_mock else f"LIVE_{self.provider.upper()}"
         }
 
         if self.is_mock:
             return ticket_payload
 
+        if self.provider != "jira":
+            raise NotImplementedError(
+                f"TMS provider '{self.provider}' is not implemented yet. Supported live provider: 'jira'."
+            )
+
         # Live Jira Bug Creation
         try:
             import urllib.request

package/tools/universal_ir.py

@@ -271,6 +271,9 @@ class PageClassIR:
 
 @dataclass
 class TestCaseIR:
+    # IR model, not a pytest test class - prefix "Test" must not trigger collection.
+    __test__ = False
+
     id: str
     title: str
     steps: List[StepIR] = field(default_factory=list)

package/tools/update_sentinel.py

@@ -65,8 +65,8 @@ def get_local_version():
         try:
             with open(pkg_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "2.1.1")
-        except Exception:
+                return data.get("version", "2.3.0")
+        except (OSError, json.JSONDecodeError):
             pass
 
     manifest_file = os.path.join(HUB_ROOT, "skills_manifest.json")
@@ -74,11 +74,11 @@ def get_local_version():
         try:
             with open(manifest_file, "r", encoding="utf-8") as f:
                 data = json.load(f)
-                return data.get("version", "2.1.1")
-        except Exception:
+                return data.get("version", "2.3.0")
+        except (OSError, json.JSONDecodeError):
             pass
 
-    return "2.1.1"
+    return "2.3.0"
 
 
 def fetch_remote_version():
@@ -92,7 +92,7 @@ def fetch_remote_version():
             data = json.loads(resp.read().decode("utf-8"))
             if "version" in data:
                 return data["version"], "npm"
-    except Exception:
+    except (urllib.error.URLError, TimeoutError, OSError, json.JSONDecodeError, KeyError):
         pass
 
     # 2. Secondary fallback: GitHub raw package.json
@@ -103,7 +103,7 @@ def fetch_remote_version():
             data = json.loads(resp.read().decode("utf-8"))
             if "version" in data:
                 return data["version"], "github"
-    except Exception:
+    except (urllib.error.URLError, TimeoutError, OSError, json.JSONDecodeError, KeyError):
         pass
 
     return None, None
@@ -114,7 +114,7 @@ def read_update_cache():
         try:
             with open(CACHE_FILE, "r", encoding="utf-8") as f:
                 return json.load(f)
-        except Exception:
+        except (OSError, json.JSONDecodeError):
             pass
     return {}
 
@@ -124,7 +124,7 @@ def write_update_cache(data):
         os.makedirs(GLOBAL_DIR, exist_ok=True)
         with open(CACHE_FILE, "w", encoding="utf-8") as f:
             json.dump(data, f, indent=2)
-    except Exception:
+    except OSError:
         pass
 
 
@@ -132,7 +132,16 @@ def check_for_updates(force=False, notify=True):
     """
     Checks if a newer version exists upstream.
     Uses a 24-hour file cache to prevent network overhead during daily workflows.
+    Air-gapped offline guard: strictly bypasses all network checks when AGENT_QA_OFFLINE is set.
     """
+    if (
+        os.environ.get("AGENT_QA_OFFLINE") in ("1", "true", "TRUE")
+        or os.environ.get("SYNAPSE_OFFLINE") in ("1", "true", "TRUE")
+        or os.environ.get("CI") in ("1", "true", "TRUE")
+        or os.environ.get("GITHUB_ACTIONS")
+    ):
+        return False, get_local_version(), None
+
     cache = read_update_cache()
     now = time.time()
     last_check = cache.get("last_check_timestamp", 0)
@@ -177,6 +186,54 @@ def print_update_banner(local_ver, remote_ver):
     print(banner)
 
 
+def _is_trusted_remote(cwd):
+    """Verifies that git remote origin points to official Synapse Hub repository."""
+    try:
+        res = subprocess.run(
+            ["git", "remote", "get-url", "origin"],
+            cwd=cwd,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            timeout=3.0
+        )
+        if res.returncode == 0:
+            url = res.stdout.strip().lower()
+            return "github.com/teevee998/synapse-hub" in url or "github.com/teevee998/agent-skills" in url
+    except (subprocess.SubprocessError, OSError):
+        pass
+    return False
+
+
+def verify_git_provenance(cwd):
+    """
+    Supply-chain security guard: Verifies that commits pulled into the agent environment
+    originate from trusted upstream and do not contain forged signatures.
+    """
+    if not _is_trusted_remote(cwd):
+        return True, "Local or fork repository (trusted upstream check bypassed)"
+    try:
+        res = subprocess.run(
+            ["git", "log", "-1", "--format=%H %G? %an"],
+            cwd=cwd,
+            stdout=subprocess.PIPE,
+            stderr=subprocess.PIPE,
+            text=True,
+            timeout=3.0
+        )
+        if res.returncode == 0:
+            parts = res.stdout.strip().split()
+            commit_sha = parts[0] if parts else "unknown"
+            sig_status = parts[1] if len(parts) > 1 else "N"
+            author = " ".join(parts[2:]) if len(parts) > 2 else "Unknown"
+            if sig_status == "B":
+                return False, f"Cryptographic integrity alert: Bad/forged signature on commit {commit_sha[:8]}"
+            return True, f"Verified commit {commit_sha[:8]} by {author} (sig: {sig_status})"
+    except Exception as e:
+        return False, str(e)
+    return True, "Provenance verified"
+
+
 def perform_update():
     """
     Executes 1-click update:
@@ -212,13 +269,27 @@ def perform_update():
                 cwd=HUB_ROOT,
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
-                text=True
+                text=True,
+                timeout=30.0
             )
             if res.returncode == 0:
                 print(f"  {GREEN}[OK] Git pull successful:{RESET}")
                 for line in res.stdout.strip().splitlines():
                     print(f"     {line}")
+                ok, msg = verify_git_provenance(HUB_ROOT)
+                if not ok:
+                    print(f"  {RED}⚠️ Provenance Warning: {msg}{RESET}")
+                else:
+                    print(f"  {GREEN}[OK] {msg}{RESET}")
                 updated = True
+                # If this is the first pull, show the welcome landing page
+                try:
+                    import welcome_page
+                    if welcome_page.is_first_run(HUB_ROOT):
+                        welcome_page.generate_welcome_page(target_repo=HUB_ROOT, open_browser=True)
+                        welcome_page.mark_first_run_completed(HUB_ROOT)
+                except (ImportError, OSError):
+                    pass
             else:
                 print(f"  ⚠️ Git pull notice: {res.stderr.strip() or res.stdout.strip()}")
         except Exception as e:
@@ -230,12 +301,13 @@ def perform_update():
                 ["npm", "install", "-g", "synapse-hub@latest"],
                 stdout=subprocess.PIPE,
                 stderr=subprocess.PIPE,
-                text=True
+                text=True,
+                timeout=60.0
             )
             if res.returncode == 0:
                 print(f"  {GREEN}[OK] Global NPM package updated to latest!{RESET}")
                 updated = True
-        except Exception:
+        except (subprocess.SubprocessError, OSError):
             pass
 
     # 2. Check Global Plugin
@@ -244,9 +316,9 @@ def perform_update():
         plugin_git = os.path.join(GLOBAL_PLUGIN_DIR, ".git")
         if os.path.exists(plugin_git):
             try:
-                subprocess.run(["git", "pull", "--ff-only"], cwd=GLOBAL_PLUGIN_DIR, stdout=subprocess.DEVNULL)
+                subprocess.run(["git", "pull", "--ff-only"], cwd=GLOBAL_PLUGIN_DIR, stdout=subprocess.DEVNULL, timeout=30.0)
                 print(f"  {GREEN}[OK] Updated Global Plugin repository: {GLOBAL_PLUGIN_DIR}{RESET}")
-            except Exception:
+            except (subprocess.SubprocessError, OSError):
                 pass
         else:
             # Refresh plugin.json in global plugin
@@ -257,7 +329,7 @@ def perform_update():
                 if os.path.exists(src_pkg):
                     shutil.copy2(src_pkg, dst_pkg)
                     print(f"  {GREEN}[OK] Refreshed plugin.json in: {GLOBAL_PLUGIN_DIR}{RESET}")
-            except Exception:
+            except OSError:
                 pass
 
     # 3. Re-initialize SQLite Memory Cache

package/tools/verify_all.ps1

@@ -0,0 +1,13 @@
+# Enterprise Single-Command DoD Verification Wrapper (Windows PowerShell)
+$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
+$pythonCmd = Get-Command python -ErrorAction SilentlyContinue
+if (-not $pythonCmd) { $pythonCmd = Get-Command py -ErrorAction SilentlyContinue }
+if (-not $pythonCmd) { $pythonCmd = Get-Command python3 -ErrorAction SilentlyContinue }
+
+if ($pythonCmd) {
+    & $pythonCmd.Source "$scriptDir\verify_all.py" $args
+    exit $LASTEXITCODE
+} else {
+    Write-Error "Python 3 is required to run verify_all. Please install Python from https://python.org"
+    exit 1
+}