thevoidforge 21.0.0

package/dist/wizard/lib/autonomy-controller.js

@@ -0,0 +1,183 @@
+/**
+ * Autonomy Controller — Tier 2 supervised + Tier 3 full autonomy (v12.3-v12.4).
+ *
+ * Manages the autonomous execution loop: proposal → delay → execute/veto.
+ * Implements circuit breakers, kill switch, deploy freeze, strategic sync.
+ *
+ * PRD Reference: ROADMAP v12.3-v12.4, DEEP_CURRENT.md Autonomy Tiers + Security
+ */
+import { existsSync } from 'node:fs';
+import { readFile, open, rename, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { DEEP_CURRENT_DIR } from './deep-current.js';
+const AUTONOMY_STATE_PATH = join(DEEP_CURRENT_DIR, 'autonomy-state.json');
+const DEFAULT_STATE = {
+    tier: 1,
+    active: false,
+    stopped: false,
+    campaignsRun: 0,
+    consecutiveCampaigns: 0,
+    lastHumanReview: new Date().toISOString(),
+    lastStrategicSync: new Date().toISOString(),
+    circuitBreakers: {
+        driftScore: 0,
+        consecutiveCriticals: 0,
+        spendIncreaseStreak: 0,
+        roasBelow1: 0,
+    },
+    deployFreezeWindows: [],
+};
+// ── State Persistence ─────────────────────────────────
+export async function loadAutonomyState() {
+    if (!existsSync(AUTONOMY_STATE_PATH))
+        return { ...DEFAULT_STATE };
+    try {
+        const content = await readFile(AUTONOMY_STATE_PATH, 'utf-8');
+        return JSON.parse(content);
+    }
+    catch {
+        return { ...DEFAULT_STATE };
+    }
+}
+// IG-R4 LOKI-001: Serialization queue prevents concurrent write corruption
+let writeQueue = Promise.resolve();
+function serialized(fn) {
+    const result = writeQueue.then(fn, () => fn());
+    writeQueue = result.then(() => { }, () => { });
+    return result;
+}
+export function saveAutonomyState(state) {
+    return serialized(async () => {
+        await mkdir(DEEP_CURRENT_DIR, { recursive: true });
+        // IG-R4 LOKI-001: Atomic write — temp+fsync+rename prevents kill switch reset on crash
+        const tmpPath = AUTONOMY_STATE_PATH + '.tmp';
+        const fh = await open(tmpPath, 'w', 0o600);
+        try {
+            await fh.writeFile(JSON.stringify(state, null, 2));
+            await fh.sync();
+        }
+        finally {
+            await fh.close();
+        }
+        await rename(tmpPath, AUTONOMY_STATE_PATH);
+    });
+}
+/**
+ * Check all circuit breakers. Returns whether autonomous operation should continue.
+ */
+export function checkCircuitBreakers(state) {
+    // Kill switch
+    if (state.stopped) {
+        return { safe: false, reason: 'Kill switch engaged (/current --stop)', action: 'stop' };
+    }
+    // Strategic drift > 30%
+    if (state.circuitBreakers.driftScore > 30) {
+        return { safe: false, reason: `Strategic drift score ${state.circuitBreakers.driftScore}% exceeds 30% threshold`, action: 'pause' };
+    }
+    // 3+ consecutive campaigns with increasing Criticals
+    if (state.circuitBreakers.consecutiveCriticals >= 3) {
+        return { safe: false, reason: `${state.circuitBreakers.consecutiveCriticals} consecutive campaigns with increasing Critical findings`, action: 'downgrade_to_tier1' };
+    }
+    // 7 consecutive days of increasing spend
+    if (state.circuitBreakers.spendIncreaseStreak >= 7) {
+        return { safe: false, reason: '7 consecutive days of increasing daily spend — human review required', action: 'pause' };
+    }
+    // ROAS < 1.0x for 7+ days
+    if (state.circuitBreakers.roasBelow1 >= 7) {
+        return { safe: false, reason: 'Blended ROAS below 1.0x for 7+ days — losing money', action: 'pause' };
+    }
+    // 30-day strategic sync overdue
+    const syncAge = Date.now() - new Date(state.lastStrategicSync).getTime();
+    const thirtyDays = 30 * 24 * 60 * 60 * 1000;
+    if (syncAge > thirtyDays) {
+        return { safe: false, reason: '30-day mandatory strategic sync overdue', action: 'pause' };
+    }
+    // 10-campaign human checkpoint (Tier 3 only)
+    if (state.tier === 3 && state.consecutiveCampaigns >= 10) {
+        return { safe: false, reason: '10 autonomous campaigns since last human review', action: 'pause' };
+    }
+    // Deploy freeze window check
+    if (isInDeployFreeze(state)) {
+        return { safe: false, reason: 'Currently in deploy freeze window', action: 'pause' };
+    }
+    return { safe: true };
+}
+function isInDeployFreeze(state) {
+    if (state.deployFreezeWindows.length === 0)
+        return false;
+    const now = new Date();
+    const dayOfWeek = now.getUTCDay();
+    const hour = now.getUTCHours();
+    return state.deployFreezeWindows.some(w => w.dayOfWeek === dayOfWeek && hour >= w.startHour && hour < w.endHour);
+}
+// ── Tier 2: Supervised Autonomy ───────────────────────
+/**
+ * Queue a proposal for Tier 2 execution (24h delay).
+ */
+export function queueProposal(state, proposal) {
+    const proposedAt = new Date();
+    const executeAt = new Date(proposedAt.getTime() + 24 * 60 * 60 * 1000); // 24h delay
+    state.pendingProposal = {
+        proposal,
+        proposedAt: proposedAt.toISOString(),
+        executeAt: executeAt.toISOString(),
+        vetoed: false,
+    };
+    return state;
+}
+/**
+ * Check if a pending Tier 2 proposal is ready to execute.
+ */
+export function isProposalReady(state) {
+    if (!state.pendingProposal)
+        return false;
+    if (state.pendingProposal.vetoed)
+        return false;
+    if (state.tier === 3)
+        return true; // Tier 3: immediate execution
+    // Tier 2: execute after delay
+    return Date.now() >= new Date(state.pendingProposal.executeAt).getTime();
+}
+/**
+ * Veto a pending Tier 2 proposal.
+ */
+export function vetoProposal(state) {
+    if (state.pendingProposal) {
+        state.pendingProposal.vetoed = true;
+    }
+    return state;
+}
+// ── Kill Switch ───────────────────────────────────────
+export function engageKillSwitch(state) {
+    state.stopped = true;
+    state.active = false;
+    state.pendingProposal = undefined;
+    return state;
+}
+export function disengageKillSwitch(state) {
+    state.stopped = false;
+    return state;
+}
+// ── Strategic Sync ────────────────────────────────────
+export function recordStrategicSync(state) {
+    state.lastStrategicSync = new Date().toISOString();
+    state.lastHumanReview = new Date().toISOString();
+    state.consecutiveCampaigns = 0;
+    return state;
+}
+export function recordCampaignComplete(state) {
+    state.campaignsRun += 1;
+    state.consecutiveCampaigns += 1;
+    state.pendingProposal = undefined;
+    return state;
+}
+const DEFAULT_SOFT_LIMITS = {
+    maxConsecutiveMissions: 5,
+    maxDeploysPerDay: 1,
+    aggregateDailySpendCeiling: 5000,
+    strategicDriftThreshold: 30,
+    explorationBudgetPercent: 10,
+    lessonDecayHalfLifeDays: 90,
+    minRoasBeforeFreeze: 1.0,
+};
+export { DEFAULT_STATE, DEFAULT_SOFT_LIMITS, AUTONOMY_STATE_PATH };

package/dist/wizard/lib/body-parser.d.ts

@@ -0,0 +1,2 @@
+import type { IncomingMessage } from 'node:http';
+export declare function parseJsonBody(req: IncomingMessage): Promise<unknown>;

package/dist/wizard/lib/body-parser.js

@@ -0,0 +1,36 @@
+const MAX_BODY_SIZE = 1024 * 1024; // 1MB
+export function parseJsonBody(req) {
+    return new Promise((resolve, reject) => {
+        const chunks = [];
+        let size = 0;
+        req.on('data', (chunk) => {
+            size += chunk.length;
+            if (size > MAX_BODY_SIZE) {
+                req.destroy();
+                reject(new Error('Request body too large'));
+                return;
+            }
+            chunks.push(chunk);
+        });
+        req.on('end', () => {
+            const body = Buffer.concat(chunks).toString('utf-8');
+            if (!body) {
+                resolve({});
+                return;
+            }
+            try {
+                const parsed = JSON.parse(body);
+                // IG-R2: Reject non-object bodies (null, arrays, strings, numbers) at the parser level
+                if (typeof parsed !== 'object' || parsed === null || Array.isArray(parsed)) {
+                    reject(new Error('Request body must be a JSON object'));
+                    return;
+                }
+                resolve(parsed);
+            }
+            catch {
+                reject(new Error('Invalid JSON'));
+            }
+        });
+        req.on('error', reject);
+    });
+}

package/dist/wizard/lib/build-analytics.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Build analytics — tracks metrics across projects for trend analysis.
+ * Stored at ~/.voidforge/analytics.json. No external dependencies.
+ *
+ * Wong guards the knowledge. The Sanctum grows.
+ */
+export interface PhaseMetric {
+    phase: string;
+    findingsCount: number;
+    fixesApplied: number;
+    /** Duration in seconds (optional — only if measurable) */
+    durationSeconds?: number;
+}
+export interface BuildRecord {
+    projectName: string;
+    framework: string;
+    database: string;
+    deployTarget: string;
+    timestamp: string;
+    version: string;
+    phases: PhaseMetric[];
+    totalFindings: number;
+    totalFixes: number;
+    testCount?: number;
+    lessonsExtracted: number;
+}
+export interface AnalyticsStore {
+    builds: BuildRecord[];
+}
+/** Record a completed build. */
+export declare function recordBuild(record: BuildRecord): Promise<void>;
+/** Surface trends across past builds. Returns human-readable insights. */
+export declare function surfaceTrends(currentFramework?: string): Promise<string[]>;
+/** Get a summary of all recorded builds. */
+export declare function getBuildHistory(): Promise<{
+    count: number;
+    frameworks: string[];
+    latestBuild: string | null;
+}>;

package/dist/wizard/lib/build-analytics.js

@@ -0,0 +1,91 @@
+/**
+ * Build analytics — tracks metrics across projects for trend analysis.
+ * Stored at ~/.voidforge/analytics.json. No external dependencies.
+ *
+ * Wong guards the knowledge. The Sanctum grows.
+ */
+import { readFile, writeFile, mkdir } from 'node:fs/promises';
+import { join } from 'node:path';
+import { homedir } from 'node:os';
+const ANALYTICS_DIR = join(homedir(), '.voidforge');
+const ANALYTICS_FILE = join(ANALYTICS_DIR, 'analytics.json');
+async function ensureDir() {
+    try {
+        await mkdir(ANALYTICS_DIR, { recursive: true });
+    }
+    catch { /* exists */ }
+}
+async function loadStore() {
+    try {
+        const raw = await readFile(ANALYTICS_FILE, 'utf-8');
+        return JSON.parse(raw);
+    }
+    catch {
+        return { builds: [] };
+    }
+}
+async function saveStore(store) {
+    await ensureDir();
+    await writeFile(ANALYTICS_FILE, JSON.stringify(store, null, 2), 'utf-8');
+}
+/** Record a completed build. */
+export async function recordBuild(record) {
+    const store = await loadStore();
+    store.builds.push(record);
+    // Keep last 100 builds to prevent unbounded growth
+    if (store.builds.length > 100) {
+        store.builds = store.builds.slice(-100);
+    }
+    await saveStore(store);
+}
+/** Surface trends across past builds. Returns human-readable insights. */
+export async function surfaceTrends(currentFramework) {
+    const store = await loadStore();
+    const builds = store.builds;
+    if (builds.length < 2)
+        return [];
+    const insights = [];
+    // Finding hotspots — which phases consistently produce the most findings?
+    const phaseFindings = {};
+    for (const build of builds) {
+        for (const phase of build.phases) {
+            if (!phaseFindings[phase.phase])
+                phaseFindings[phase.phase] = [];
+            phaseFindings[phase.phase].push(phase.findingsCount);
+        }
+    }
+    for (const [phase, counts] of Object.entries(phaseFindings)) {
+        const avg = counts.reduce((a, b) => a + b, 0) / counts.length;
+        if (avg > 5 && counts.length >= 2) {
+            insights.push(`Phase "${phase}" averages ${avg.toFixed(1)} findings across ${counts.length} builds — consider proactive checks in earlier phases.`);
+        }
+    }
+    // Framework-specific patterns
+    if (currentFramework) {
+        const frameworkBuilds = builds.filter(b => b.framework === currentFramework);
+        if (frameworkBuilds.length >= 2) {
+            const avgFindings = frameworkBuilds.reduce((a, b) => a + b.totalFindings, 0) / frameworkBuilds.length;
+            insights.push(`Your ${currentFramework} projects average ${avgFindings.toFixed(0)} findings per build (${frameworkBuilds.length} builds).`);
+        }
+    }
+    // Fix-to-finding ratio trend
+    const ratios = builds.map(b => b.totalFindings > 0 ? b.totalFixes / b.totalFindings : 1);
+    const recentRatios = ratios.slice(-5);
+    const avgRatio = recentRatios.reduce((a, b) => a + b, 0) / recentRatios.length;
+    if (avgRatio < 0.8) {
+        insights.push(`Fix-to-finding ratio is ${(avgRatio * 100).toFixed(0)}% — some findings are being deferred. Consider addressing all findings in each build.`);
+    }
+    // Lessons trend
+    const totalLessons = builds.reduce((a, b) => a + b.lessonsExtracted, 0);
+    if (totalLessons > 0) {
+        insights.push(`${totalLessons} lessons extracted across ${builds.length} builds. The forge is learning.`);
+    }
+    return insights;
+}
+/** Get a summary of all recorded builds. */
+export async function getBuildHistory() {
+    const store = await loadStore();
+    const frameworks = [...new Set(store.builds.map(b => b.framework))];
+    const latest = store.builds.length > 0 ? store.builds[store.builds.length - 1].timestamp : null;
+    return { count: store.builds.length, frameworks, latestBuild: latest };
+}

package/dist/wizard/lib/build-step.d.ts

@@ -0,0 +1,21 @@
+/**
+ * Pre-deploy build step — framework-aware build before upload/push.
+ * Runs AFTER provisioning, BEFORE deploy actions (SSH/S3/platform).
+ * Uses exec.ts for process execution (ADR-013, ADR-016).
+ */
+import type { ProvisionEmitter } from './provisioners/types.js';
+export interface BuildStepResult {
+    success: boolean;
+    outputDir: string;
+    error?: string;
+}
+/**
+ * Run a framework-aware build step in the project directory.
+ * Returns success if the build output directory exists after the build.
+ */
+export declare function runBuildStep(projectDir: string, framework: string, emit: ProvisionEmitter, abortSignal?: AbortSignal): Promise<BuildStepResult>;
+/**
+ * Get the expected build output directory for a framework.
+ * Used by deploy steps that need to know where to find build artifacts.
+ */
+export declare function getBuildOutputDir(framework: string): string;

package/dist/wizard/lib/build-step.js

@@ -0,0 +1,104 @@
+/**
+ * Pre-deploy build step — framework-aware build before upload/push.
+ * Runs AFTER provisioning, BEFORE deploy actions (SSH/S3/platform).
+ * Uses exec.ts for process execution (ADR-013, ADR-016).
+ */
+import { existsSync } from 'node:fs';
+import { join } from 'node:path';
+import { execCommand } from './exec.js';
+/** Framework → build configuration mapping. */
+const FRAMEWORK_BUILDS = {
+    'next.js': { command: 'npm', args: ['run', 'build'], outputDir: '.next' },
+    'express': { command: 'npm', args: ['run', 'build'], outputDir: 'dist' },
+    'vite': { command: 'npm', args: ['run', 'build'], outputDir: 'dist' },
+    'nuxt': { command: 'npm', args: ['run', 'build'], outputDir: '.output' },
+    'remix': { command: 'npm', args: ['run', 'build'], outputDir: 'build' },
+    'svelte': { command: 'npm', args: ['run', 'build'], outputDir: 'build' },
+    'sveltekit': { command: 'npm', args: ['run', 'build'], outputDir: 'build' },
+    'astro': { command: 'npm', args: ['run', 'build'], outputDir: 'dist' },
+    'gatsby': { command: 'npm', args: ['run', 'build'], outputDir: 'public' },
+    'django': { command: 'python', args: ['manage.py', 'collectstatic', '--noinput'], outputDir: 'staticfiles' },
+    'rails': { command: 'bundle', args: ['exec', 'rails', 'assets:precompile'], outputDir: 'public/assets' },
+};
+/** Default for unknown Node-based frameworks. */
+const DEFAULT_BUILD = { command: 'npm', args: ['run', 'build'], outputDir: 'dist' };
+/** Frameworks where the build step should be skipped. */
+const SKIP_BUILD_FRAMEWORKS = new Set(['flask']);
+/**
+ * Run a framework-aware build step in the project directory.
+ * Returns success if the build output directory exists after the build.
+ */
+export async function runBuildStep(projectDir, framework, emit, abortSignal) {
+    if (SKIP_BUILD_FRAMEWORKS.has(framework)) {
+        emit({ step: 'build', status: 'skipped', message: `${framework} — no build step required` });
+        return { success: true, outputDir: '' };
+    }
+    const config = FRAMEWORK_BUILDS[framework] || DEFAULT_BUILD;
+    const fullOutputDir = join(projectDir, config.outputDir);
+    // If output dir already exists, skip build (user may have built manually)
+    if (existsSync(fullOutputDir)) {
+        emit({ step: 'build', status: 'done', message: `Build output already exists at ${config.outputDir} — skipping build` });
+        return { success: true, outputDir: config.outputDir };
+    }
+    emit({ step: 'build', status: 'started', message: `Building project: ${config.command} ${config.args.join(' ')}` });
+    try {
+        // Check if package.json exists for Node-based builds
+        if (config.command === 'npm' && !existsSync(join(projectDir, 'package.json'))) {
+            emit({ step: 'build', status: 'skipped', message: 'No package.json found — skipping build' });
+            return { success: true, outputDir: '' };
+        }
+        // Install dependencies first for Node projects
+        if (config.command === 'npm' && existsSync(join(projectDir, 'package.json'))) {
+            emit({ step: 'build-deps', status: 'started', message: 'Installing dependencies (npm ci)' });
+            try {
+                await execCommand('npm', ['ci'], {
+                    cwd: projectDir,
+                    timeout: 300_000,
+                    abortSignal,
+                });
+                emit({ step: 'build-deps', status: 'done', message: 'Dependencies installed' });
+            }
+            catch (depErr) {
+                // Fall back to npm install if npm ci fails (no lock file)
+                await execCommand('npm', ['install'], {
+                    cwd: projectDir,
+                    timeout: 300_000,
+                    abortSignal,
+                });
+                emit({ step: 'build-deps', status: 'done', message: 'Dependencies installed (via npm install)' });
+            }
+        }
+        await execCommand(config.command, config.args, {
+            cwd: projectDir,
+            timeout: 300_000, // 5 minutes for builds
+            abortSignal,
+        });
+        // Verify output directory was created
+        if (existsSync(fullOutputDir)) {
+            emit({ step: 'build', status: 'done', message: `Build complete — output at ${config.outputDir}` });
+            return { success: true, outputDir: config.outputDir };
+        }
+        // Output dir doesn't exist — check common alternatives
+        const alternatives = ['dist', 'build', 'out', '.next', 'public'];
+        for (const alt of alternatives) {
+            if (existsSync(join(projectDir, alt))) {
+                emit({ step: 'build', status: 'done', message: `Build complete — output found at ${alt} (expected ${config.outputDir})` });
+                return { success: true, outputDir: alt };
+            }
+        }
+        emit({ step: 'build', status: 'error', message: `Build command succeeded but output directory "${config.outputDir}" not found` });
+        return { success: false, outputDir: config.outputDir, error: `Build output directory "${config.outputDir}" not found after build` };
+    }
+    catch (err) {
+        const message = err.message;
+        emit({ step: 'build', status: 'error', message: 'Build failed', detail: message });
+        return { success: false, outputDir: config.outputDir, error: message };
+    }
+}
+/**
+ * Get the expected build output directory for a framework.
+ * Used by deploy steps that need to know where to find build artifacts.
+ */
+export function getBuildOutputDir(framework) {
+    return (FRAMEWORK_BUILDS[framework] || DEFAULT_BUILD).outputDir;
+}

package/dist/wizard/lib/campaign-proposer.d.ts

@@ -0,0 +1,39 @@
+/**
+ * Tuvok's Campaign Proposer — generates data-driven campaign proposals (v12.1).
+ *
+ * Takes the situation model (with Seven's gap analysis) and generates a
+ * complete campaign proposal: name, missions, predicted impact, risk, alternatives.
+ *
+ * PRD Reference: ROADMAP v12.1, DEEP_CURRENT.md PROPOSE step
+ */
+import type { SituationModel } from './deep-current.js';
+interface CampaignProposal {
+    id: string;
+    name: string;
+    generatedAt: string;
+    trigger: string;
+    dimension: string;
+    dimensionScore: number;
+    theCase: string;
+    missions: ProposedMission[];
+    expectedImpact: string;
+    riskAssessment: string;
+    alternativesConsidered: string[];
+    autonomyRecommendation: 1 | 2 | 3;
+    estimatedSessions: number;
+}
+interface ProposedMission {
+    number: number;
+    name: string;
+    objective: string;
+    estimatedFiles: number;
+}
+/**
+ * Generate a campaign proposal targeting the weakest dimension.
+ */
+export declare function generateProposal(model: SituationModel): CampaignProposal;
+/**
+ * Save a proposal to disk as markdown.
+ */
+export declare function saveProposal(proposal: CampaignProposal): Promise<string>;
+export type { CampaignProposal, ProposedMission };