vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/agent-firewall/enforcement/index.js

@@ -0,0 +1,98 @@
+/**
+ * Agent Firewall Enforcement Module Index
+ * 
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * AGENT FIREWALL™ - ENFORCEMENT EXPORTS
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * 
+ * This is THE single entry point for all enforcement operations.
+ * All code should import from here, not individual submodules.
+ * 
+ * @module enforcement
+ * @version 3.0.0
+ */
+
+"use strict";
+
+// Core gateway
+const gateway = require("./gateway");
+
+// Legacy orchestrator (for backward compatibility)
+const orchestrator = require("./orchestrator");
+
+// Verdict system
+const verdict = require("./verdict-v2");
+
+// Proof system
+const proof = require("./proof-artifact");
+
+// Mode system
+const mode = require("./mode");
+
+// ═══════════════════════════════════════════════════════════════════════════════
+// UNIFIED EXPORTS
+// ═══════════════════════════════════════════════════════════════════════════════
+
+module.exports = {
+  // ═══════════════════════════════════════════════════════════════════════════
+  // PRIMARY API (Use these!)
+  // ═══════════════════════════════════════════════════════════════════════════
+  
+  // Gateway (preferred entry point)
+  EnforcementGateway: gateway.EnforcementGateway,
+  createGateway: gateway.createGateway,
+  intercept: gateway.intercept,
+  quickCheck: gateway.quickCheck,
+  
+  // Change event building
+  buildChangeEvent: gateway.buildChangeEvent,
+  analyzeCodeQuality: gateway.analyzeCodeQuality,
+  classifyDomain: gateway.classifyDomain,
+  
+  // Constants
+  MODE: gateway.MODE,
+  VERDICT: gateway.VERDICT,
+  BLOCK_PATTERNS: gateway.BLOCK_PATTERNS,
+  
+  // ═══════════════════════════════════════════════════════════════════════════
+  // VERDICT SYSTEM
+  // ═══════════════════════════════════════════════════════════════════════════
+  
+  generateVerdict: verdict.generateVerdict,
+  generateVerdictId: verdict.generateVerdictId,
+  computeVerdictHash: verdict.computeVerdictHash,
+  verifyVerdictIntegrity: verdict.verifyVerdictIntegrity,
+  formatBlockMessage: verdict.formatBlockMessage,
+  createVerdictManifest: verdict.createVerdictManifest,
+  convertLegacyVerdict: verdict.convertLegacyVerdict,
+  
+  // Legacy verdict constants (for compatibility)
+  OBSERVATION: verdict.OBSERVATION,
+  
+  // ═══════════════════════════════════════════════════════════════════════════
+  // PROOF SYSTEM
+  // ═══════════════════════════════════════════════════════════════════════════
+  
+  ProofCollection: proof.ProofCollection,
+  determineRequiredProofs: proof.determineRequiredProofs,
+  PROOF_STATUS: proof.PROOF_STATUS,
+  PROOF_TYPE: proof.PROOF_TYPE,
+  
+  // ═══════════════════════════════════════════════════════════════════════════
+  // MODE SYSTEM
+  // ═══════════════════════════════════════════════════════════════════════════
+  
+  ModeConfig: mode.ModeConfig,
+  createModeEvent: mode.createModeEvent,
+  formatModeBanner: mode.formatModeBanner,
+  
+  // ═══════════════════════════════════════════════════════════════════════════
+  // LEGACY API (For backward compatibility)
+  // ═══════════════════════════════════════════════════════════════════════════
+  
+  // Orchestrator (use gateway instead for new code)
+  FirewallOrchestrator: orchestrator.FirewallOrchestrator,
+  createOrchestrator: orchestrator.createOrchestrator,
+  normalizeChangeEvent: orchestrator.normalizeChangeEvent,
+  CHANGE_EVENT_TYPE: orchestrator.CHANGE_EVENT_TYPE,
+};

package/bin/runners/lib/agent-firewall/enforcement/mode.js

@@ -0,0 +1,318 @@
+/**
+ * Mode System - Explicit Firewall Operation Modes
+ * 
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * AGENT FIREWALL™ - MODE SWITCHING
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * 
+ * Modes of operation:
+ * - OBSERVE (default when no intent): log + warn only - SEAMLESS VIBECODING
+ * - ENFORCE: block on violation (when intent declared)
+ * - CI: fail pipeline on BLOCK
+ * - IDE: real-time interception
+ * 
+ * SEAMLESS UX: When no intent is declared, default to OBSERVE mode.
+ * This allows vibecoders to work freely, with changes logged for later review.
+ * 
+ * @module enforcement/mode
+ * @version 2.1.0
+ */
+
+"use strict";
+
+const fs = require("fs");
+const path = require("path");
+
+/**
+ * Firewall modes
+ */
+const MODE = {
+  ENFORCE: "ENFORCE",  // Default - block violations
+  OBSERVE: "OBSERVE",  // Log only - don't block
+  CI: "CI",            // CI/CD - fail pipeline
+  IDE: "IDE",          // Real-time interception
+};
+
+/**
+ * Mode descriptions
+ */
+const MODE_DESCRIPTIONS = {
+  [MODE.ENFORCE]: "Enforcement mode - violations are BLOCKED",
+  [MODE.OBSERVE]: "Observe mode - violations are LOGGED but not blocked",
+  [MODE.CI]: "CI mode - violations fail the pipeline with non-zero exit",
+  [MODE.IDE]: "IDE mode - real-time interception of file writes",
+};
+
+/**
+ * Mode capabilities
+ */
+const MODE_CAPABILITIES = {
+  [MODE.ENFORCE]: {
+    blocks: true,
+    logs: true,
+    exitOnViolation: false,
+    interceptsWrites: false,
+  },
+  [MODE.OBSERVE]: {
+    blocks: false,
+    logs: true,
+    exitOnViolation: false,
+    interceptsWrites: false,
+  },
+  [MODE.CI]: {
+    blocks: true,
+    logs: true,
+    exitOnViolation: true,
+    interceptsWrites: false,
+  },
+  [MODE.IDE]: {
+    blocks: true,
+    logs: true,
+    exitOnViolation: false,
+    interceptsWrites: true,
+  },
+};
+
+/**
+ * Mode configuration
+ */
+class ModeConfig {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+    this.configPath = path.join(projectRoot, ".vibecheck", "firewall-mode.json");
+    this._intentStore = null;
+  }
+  
+  /**
+   * Lazy-load intent store
+   */
+  _getIntentStore() {
+    if (!this._intentStore) {
+      try {
+        const { IntentStore } = require("../intent");
+        this._intentStore = new IntentStore(this.projectRoot);
+      } catch {
+        this._intentStore = null;
+      }
+    }
+    return this._intentStore;
+  }
+  
+  /**
+   * Check if a valid intent exists
+   * @returns {boolean} True if intent exists and is valid
+   */
+  hasValidIntent() {
+    const store = this._getIntentStore();
+    if (!store) return false;
+    
+    if (!store.hasIntent()) return false;
+    
+    const intent = store.getCurrent({ allowMissing: true });
+    if (!intent) return false;
+    
+    // Check if it's the blocking intent (no real intent declared)
+    if (intent.summary?.includes("NO INTENT DECLARED")) return false;
+    
+    return true;
+  }
+  
+  /**
+   * Get current mode
+   * SEAMLESS UX: Returns OBSERVE when no intent exists
+   * @param {Object} options - Options
+   * @param {boolean} options.ignoreIntent - If true, don't check intent status
+   * @returns {string} Current mode
+   */
+  getMode(options = {}) {
+    // Check environment override first
+    const envMode = process.env.VIBECHECK_FIREWALL_MODE;
+    if (envMode && MODE[envMode.toUpperCase()]) {
+      return MODE[envMode.toUpperCase()];
+    }
+    
+    // Check CI environment
+    if (process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true") {
+      return MODE.CI;
+    }
+    
+    // Check stored config
+    if (fs.existsSync(this.configPath)) {
+      try {
+        const config = JSON.parse(fs.readFileSync(this.configPath, "utf-8"));
+        if (config.mode && MODE[config.mode]) {
+          return config.mode;
+        }
+      } catch {
+        // Ignore errors, use smart default
+      }
+    }
+    
+    // SEAMLESS UX: If no intent exists, default to OBSERVE
+    // This allows vibecoders to work freely without upfront intent declaration
+    if (!options.ignoreIntent && !this.hasValidIntent()) {
+      return MODE.OBSERVE;
+    }
+    
+    // Intent exists - use ENFORCE
+    return MODE.ENFORCE;
+  }
+  
+  /**
+   * Get smart default mode (intent-aware)
+   * @returns {string} Default mode based on intent status
+   */
+  getSmartDefault() {
+    return this.hasValidIntent() ? MODE.ENFORCE : MODE.OBSERVE;
+  }
+  
+  /**
+   * Set mode
+   * @param {string} mode - Mode to set
+   * @returns {boolean} Success
+   */
+  setMode(mode) {
+    if (!MODE[mode]) {
+      throw new Error(`Invalid mode: ${mode}. Valid modes: ${Object.keys(MODE).join(", ")}`);
+    }
+    
+    const dir = path.dirname(this.configPath);
+    if (!fs.existsSync(dir)) {
+      fs.mkdirSync(dir, { recursive: true });
+    }
+    
+    const config = {
+      mode,
+      set_at: new Date().toISOString(),
+      set_by: process.env.USER || process.env.USERNAME || "unknown",
+    };
+    
+    fs.writeFileSync(this.configPath, JSON.stringify(config, null, 2));
+    
+    return true;
+  }
+  
+  /**
+   * Get mode capabilities
+   * @returns {Object} Capabilities for current mode
+   */
+  getCapabilities() {
+    return MODE_CAPABILITIES[this.getMode()];
+  }
+  
+  /**
+   * Check if blocking is enabled
+   * @returns {boolean} True if blocking
+   */
+  isBlocking() {
+    return this.getCapabilities().blocks;
+  }
+  
+  /**
+   * Check if in CI mode
+   * @returns {boolean} True if CI mode
+   */
+  isCI() {
+    return this.getMode() === MODE.CI;
+  }
+  
+  /**
+   * Check if in observe mode
+   * @returns {boolean} True if observe mode
+   */
+  isObserve() {
+    return this.getMode() === MODE.OBSERVE;
+  }
+  
+  /**
+   * Get mode status for display
+   * @returns {Object} Status object
+   */
+  getStatus() {
+    const mode = this.getMode();
+    return {
+      mode,
+      description: MODE_DESCRIPTIONS[mode],
+      capabilities: MODE_CAPABILITIES[mode],
+      source: this.getModeSource(),
+    };
+  }
+  
+  /**
+   * Get where the mode was set from
+   * @returns {string} Mode source
+   */
+  getModeSource() {
+    if (process.env.VIBECHECK_FIREWALL_MODE) {
+      return "environment variable (VIBECHECK_FIREWALL_MODE)";
+    }
+    if (process.env.CI === "true" || process.env.GITHUB_ACTIONS === "true") {
+      return "CI environment detected";
+    }
+    if (fs.existsSync(this.configPath)) {
+      return `config file (${this.configPath})`;
+    }
+    // Smart default based on intent
+    if (!this.hasValidIntent()) {
+      return "smart default (OBSERVE - no intent declared)";
+    }
+    return "smart default (ENFORCE - intent exists)";
+  }
+}
+
+/**
+ * Mode event for logging
+ * @param {string} mode - Current mode
+ * @param {string} event - Event type
+ * @param {Object} data - Event data
+ * @returns {Object} Log entry
+ */
+function createModeEvent(mode, event, data = {}) {
+  return {
+    timestamp: new Date().toISOString(),
+    mode,
+    event,
+    data,
+    blocking: MODE_CAPABILITIES[mode]?.blocks || false,
+  };
+}
+
+/**
+ * Format mode banner for CLI output
+ * @param {string} mode - Current mode
+ * @param {Object} ansi - ANSI color codes
+ * @returns {string} Formatted banner
+ */
+function formatModeBanner(mode, ansi = {}) {
+  const c = ansi.cyan || "";
+  const r = ansi.reset || "";
+  const b = ansi.bold || "";
+  const y = ansi.yellow || "";
+  const g = ansi.green || "";
+  const d = ansi.dim || "";
+  
+  const modeColors = {
+    [MODE.ENFORCE]: g,
+    [MODE.OBSERVE]: y,
+    [MODE.CI]: c,
+    [MODE.IDE]: c,
+  };
+  
+  const color = modeColors[mode] || c;
+  const caps = MODE_CAPABILITIES[mode];
+  
+  return `
+${d}┌─────────────────────────────────────────┐${r}
+${d}│${r} ${b}AGENT FIREWALL™${r} - ${color}${mode}${r} mode          ${d}│${r}
+${d}│${r} ${d}Blocking: ${caps.blocks ? g + "ON" : y + "OFF"}${r}${d.padEnd(28)}${d}│${r}
+${d}└─────────────────────────────────────────┘${r}`;
+}
+
+module.exports = {
+  MODE,
+  MODE_DESCRIPTIONS,
+  MODE_CAPABILITIES,
+  ModeConfig,
+  createModeEvent,
+  formatModeBanner,
+};