vibecheck-ai 2.0.1 → 5.0.0

package/bin/runners/lib/agent-firewall/enforcement/orchestrator.js

@@ -0,0 +1,484 @@
+/**
+ * Firewall Orchestrator - Main Enforcement Entry Point
+ * 
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * AGENT FIREWALL™ - ENFORCEMENT ORCHESTRATOR
+ * ═══════════════════════════════════════════════════════════════════════════════
+ * 
+ * The Agent Firewall is a mandatory enforcement layer that intercepts AI-generated
+ * actions and BLOCKS them unless they are:
+ * 
+ * 1) Explicitly aligned with declared user INTENT
+ * 2) Structurally valid (routes, env vars, permissions exist)
+ * 3) Proven real at runtime via Reality Mode
+ * 
+ * If proof is missing → the action MUST NOT SHIP.
+ * 
+ * This is enforcement infrastructure, not developer guidance.
+ * 
+ * @module enforcement/orchestrator
+ * @version 2.0.0
+ */
+
+"use strict";
+
+const path = require("path");
+const fs = require("fs");
+const crypto = require("crypto");
+
+// Intent system
+const { IntentStore } = require("../intent/store");
+const { checkAlignmentBatch, VIOLATION_CODES } = require("../intent/alignment-engine");
+const { verifyIntentIntegrity, isIntentExpired } = require("../intent/schema");
+
+// Verdict system
+const { generateVerdict, VERDICT, OBSERVATION, MODE, createVerdictManifest } = require("./verdict-v2");
+
+// Proof system
+const { ProofCollection, determineRequiredProofs, PROOF_STATUS } = require("./proof-artifact");
+
+// Mode system
+const { ModeConfig, createModeEvent, formatModeBanner } = require("./mode");
+
+// Existing components
+const { resolveEvidence } = require("../evidence/resolver");
+const { evaluatePolicy } = require("../policy/engine");
+const { buildChangePacket, buildMultiFileChangePacket } = require("../change-packet/builder");
+
+/**
+ * Change Event types
+ */
+const CHANGE_EVENT_TYPE = {
+  FILE_WRITE: "file_write",
+  FILE_CREATE: "file_create",
+  FILE_DELETE: "file_delete",
+  ROUTE_ADD: "route_add",
+  ROUTE_MODIFY: "route_modify",
+  ENV_REF: "env_ref",
+  PERMISSION_CHANGE: "permission_change",
+  UI_STATE: "ui_state",
+  CONFIG_CHANGE: "config_change",
+};
+
+/**
+ * Normalize a raw change into a Change Event
+ * @param {Object} rawChange - Raw change from interception
+ * @returns {Object} Normalized Change Event
+ */
+function normalizeChangeEvent(rawChange) {
+  return {
+    type: rawChange.type || CHANGE_EVENT_TYPE.FILE_WRITE,
+    location: rawChange.path || rawChange.file || rawChange.location,
+    diff: rawChange.diff || null,
+    content: rawChange.content || rawChange.diff?.after || null,
+    resource: rawChange.resource || rawChange.path || null,
+    domain: rawChange.domain || classifyDomain(rawChange.path),
+    claims: rawChange.claims || [],
+    method: rawChange.method || null,
+    env_exists: rawChange.env_exists,
+    includes_tests: rawChange.includes_tests || false,
+    file_count: rawChange.file_count || 1,
+    timestamp: rawChange.timestamp || new Date().toISOString(),
+  };
+}
+
+/**
+ * Classify file domain
+ * @param {string} filePath - File path
+ * @returns {string} Domain
+ */
+function classifyDomain(filePath) {
+  if (!filePath) return "general";
+  const s = filePath.toLowerCase();
+  if (s.includes("auth")) return "auth";
+  if (s.includes("stripe") || s.includes("payment")) return "payments";
+  if (s.includes("routes") || s.includes("router") || s.includes("api")) return "routes";
+  if (s.includes("schema") || s.includes("contract")) return "contracts";
+  if (s.includes("ui") || s.includes("components") || s.includes("pages")) return "ui";
+  if (s.includes("database") || s.includes("prisma") || s.includes("migration")) return "database";
+  return "general";
+}
+
+/**
+ * Firewall Orchestrator
+ * 
+ * Main entry point for all enforcement operations.
+ */
+class FirewallOrchestrator {
+  constructor(projectRoot) {
+    this.projectRoot = projectRoot;
+    this.intentStore = new IntentStore(projectRoot);
+    this.modeConfig = new ModeConfig(projectRoot);
+    this.runId = crypto.randomBytes(8).toString("hex");
+    this.startTime = Date.now();
+  }
+  
+  /**
+   * Main enforcement entry point
+   * 
+   * @param {Object} params - Enforcement parameters
+   * @param {Object[]} params.changes - Array of raw changes
+   * @param {string} params.agentId - Agent identifier
+   * @param {Object} params.proposal - Structured proposal (optional)
+   * @param {Object} params.options - Options
+   * @returns {Promise<Object>} Enforcement result with verdict
+   */
+  async enforce({ changes, agentId, proposal = null, options = {} }) {
+    const mode = this.modeConfig.getMode();
+    const result = {
+      runId: this.runId,
+      mode,
+      blocked: false,
+      verdict: null,
+      violations: [],
+      proofs: [],
+      intent_hash: null,
+      timestamp: new Date().toISOString(),
+    };
+    
+    try {
+      // Step 1: Get and validate intent
+      const intent = this.intentStore.getCurrent();
+      result.intent_hash = intent?.hash || null;
+      
+      // Verify intent integrity
+      if (intent) {
+        const integrityCheck = verifyIntentIntegrity(intent);
+        if (!integrityCheck.valid) {
+          result.violations.push({
+            code: VIOLATION_CODES.INTENT_CORRUPTED,
+            rule: "intent_integrity",
+            message: `Intent integrity check failed: ${integrityCheck.reason}`,
+            resource: "intent",
+            intent_ref: "system",
+            severity: "block",
+          });
+        }
+        
+        // Check expiration
+        if (isIntentExpired(intent)) {
+          result.violations.push({
+            code: VIOLATION_CODES.INTENT_EXPIRED,
+            rule: "intent_expiration",
+            message: "Intent has expired",
+            resource: "intent",
+            intent_ref: "system",
+            severity: "block",
+          });
+        }
+      }
+      
+      // Step 2: Normalize change events
+      const changeEvents = changes.map(normalizeChangeEvent);
+      
+      // Step 3: Run intent alignment check
+      const alignmentResult = checkAlignmentBatch(intent, changeEvents);
+      result.violations.push(...alignmentResult.violations);
+      
+      // Step 4: Extract claims and resolve evidence (existing system)
+      const allClaims = changeEvents.flatMap(e => e.claims || []);
+      const evidence = resolveEvidence(this.projectRoot, allClaims);
+      
+      // Step 5: Run policy engine (existing rules)
+      const policyResult = await evaluatePolicy({
+        policy: this.loadPolicy(),
+        claims: allClaims,
+        evidence,
+        files: changeEvents.map(e => ({ path: e.location, domain: e.domain })),
+        intent: intent?.summary || "",
+      });
+      
+      // Convert policy violations to v2 format
+      if (policyResult.violations) {
+        const policyViolations = policyResult.violations.map(v => ({
+          code: v.rule?.toUpperCase().replace(/-/g, "_") || "POLICY_VIOLATION",
+          rule: v.rule || "unknown",
+          message: v.message || "Policy violation",
+          resource: v.claimId || v.file || "unknown",
+          intent_ref: "policy",
+          severity: "block",
+        }));
+        result.violations.push(...policyViolations);
+      }
+      
+      // Step 6: Collect proofs (if required)
+      const proofCollection = new ProofCollection();
+      const requiredProofs = determineRequiredProofs(allClaims, intent);
+      
+      for (const proofType of requiredProofs) {
+        proofCollection.require(proofType);
+      }
+      
+      // In reality mode, we'd run actual verification here
+      // For now, mark proofs based on evidence
+      for (const e of evidence) {
+        if (e.result === "PROVEN") {
+          proofCollection.add({
+            id: `prf-${e.claimId}`,
+            type: this.claimTypeToProofType(allClaims.find(c => c.type === e.type)?.type),
+            status: PROOF_STATUS.VERIFIED,
+            target: e.pointer || e.claimId,
+            trace: e.sources?.[0]?.pointer,
+          });
+        } else if (e.result === "UNPROVEN" || e.result === "CONTRADICTS") {
+          proofCollection.add({
+            id: `prf-${e.claimId}`,
+            type: this.claimTypeToProofType(allClaims.find(c => c.type === e.type)?.type),
+            status: PROOF_STATUS.FAILED,
+            target: e.pointer || e.claimId,
+            error: e.reason || "Could not verify claim",
+          });
+        }
+      }
+      
+      result.proofs = proofCollection.getAll();
+      
+      // Step 7: Generate final verdict
+      result.verdict = generateVerdict({
+        alignmentResult: { violations: result.violations },
+        proofs: result.proofs,
+        mode,
+        intent_hash: result.intent_hash,
+      });
+      
+      result.blocked = result.verdict.blocked;
+      
+      // Step 8: Store change packet for audit
+      const packet = buildMultiFileChangePacket({
+        agentId,
+        intent: intent?.summary || "NO INTENT",
+        changes: changes.map((c, i) => ({
+          filePath: changeEvents[i].location,
+          diff: c.diff,
+          claims: changeEvents[i].claims,
+        })),
+        evidence,
+        verdict: {
+          decision: result.verdict.decision,
+          violations: result.violations,
+          message: result.verdict.summary,
+        },
+        policy: this.loadPolicy(),
+        proposal,
+      });
+      
+      this.storePacket(packet);
+      
+      // Step 9: Store verdict manifest
+      const manifest = createVerdictManifest(result.verdict, {
+        runId: this.runId,
+        agentId,
+        fileCount: changes.length,
+      });
+      this.storeVerdictManifest(manifest);
+      
+      return result;
+      
+    } catch (error) {
+      // On error, default to BLOCK
+      result.violations.push({
+        code: "ENFORCEMENT_ERROR",
+        rule: "system",
+        message: `Enforcement error: ${error.message}`,
+        resource: "system",
+        intent_ref: "system",
+        severity: "block",
+      });
+      
+      result.verdict = generateVerdict({
+        alignmentResult: { violations: result.violations },
+        proofs: [],
+        mode,
+        intent_hash: result.intent_hash,
+      });
+      
+      result.blocked = true;
+      
+      return result;
+    }
+  }
+  
+  /**
+   * Quick check - fast path for single file changes
+   * @param {Object} change - Single change
+   * @returns {Object} Quick check result
+   */
+  quickCheck(change) {
+    const intent = this.intentStore.getCurrent();
+    const changeEvent = normalizeChangeEvent(change);
+    const alignmentResult = checkAlignmentBatch(intent, [changeEvent]);
+    
+    return {
+      allowed: alignmentResult.aligned,
+      decision: alignmentResult.decision,
+      violations: alignmentResult.violations,
+      intent_hash: intent?.hash || null,
+    };
+  }
+  
+  /**
+   * Map claim type to proof type
+   * @param {string} claimType - Claim type
+   * @returns {string} Proof type
+   */
+  claimTypeToProofType(claimType) {
+    const mapping = {
+      route: "route",
+      auth_boundary: "auth",
+      ui_success_claim: "ui",
+      http_call: "integration",
+      env_used: "env",
+      data_contract: "contract",
+    };
+    return mapping[claimType] || "integration";
+  }
+  
+  /**
+   * Load policy configuration
+   * @returns {Object} Policy config
+   */
+  loadPolicy() {
+    const policyPath = path.join(this.projectRoot, ".vibecheck", "policy.json");
+    
+    if (fs.existsSync(policyPath)) {
+      try {
+        return JSON.parse(fs.readFileSync(policyPath, "utf-8"));
+      } catch {
+        // Return default policy
+      }
+    }
+    
+    return {
+      version: "2.0.0",
+      profile: "strict",
+      mode: this.modeConfig.getMode(),
+      rules: {},
+    };
+  }
+  
+  /**
+   * Store change packet
+   * @param {Object} packet - Change packet
+   */
+  storePacket(packet) {
+    const date = new Date().toISOString().split("T")[0];
+    const packetDir = path.join(this.projectRoot, ".vibecheck", "packets", date);
+    
+    if (!fs.existsSync(packetDir)) {
+      fs.mkdirSync(packetDir, { recursive: true });
+    }
+    
+    const packetPath = path.join(packetDir, `${packet.id}.json`);
+    fs.writeFileSync(packetPath, JSON.stringify(packet, null, 2));
+  }
+  
+  /**
+   * Store verdict manifest
+   * @param {Object} manifest - Verdict manifest
+   */
+  storeVerdictManifest(manifest) {
+    const verdictDir = path.join(this.projectRoot, ".vibecheck", "verdicts");
+    
+    if (!fs.existsSync(verdictDir)) {
+      fs.mkdirSync(verdictDir, { recursive: true });
+    }
+    
+    const verdictPath = path.join(verdictDir, `${manifest.verdict.id}.json`);
+    fs.writeFileSync(verdictPath, JSON.stringify(manifest, null, 2));
+    
+    // Also write latest
+    const latestPath = path.join(verdictDir, "latest.json");
+    fs.writeFileSync(latestPath, JSON.stringify(manifest, null, 2));
+  }
+  
+  /**
+   * Get latest verdict
+   * @returns {Object|null} Latest verdict manifest
+   */
+  getLatestVerdict() {
+    const latestPath = path.join(this.projectRoot, ".vibecheck", "verdicts", "latest.json");
+    
+    if (fs.existsSync(latestPath)) {
+      try {
+        return JSON.parse(fs.readFileSync(latestPath, "utf-8"));
+      } catch {
+        return null;
+      }
+    }
+    
+    return null;
+  }
+  
+  /**
+   * Format enforcement result for output
+   * @param {Object} result - Enforcement result
+   * @param {Object} options - Output options
+   * @returns {string} Formatted output
+   */
+  formatResult(result, options = {}) {
+    const { ansi = {} } = options;
+    const r = ansi.reset || "";
+    const b = ansi.bold || "";
+    const g = ansi.green || "";
+    const y = ansi.yellow || "";
+    const red = ansi.red || "";
+    const d = ansi.dim || "";
+    
+    const lines = [];
+    
+    // Mode banner
+    lines.push(formatModeBanner(result.mode, ansi));
+    
+    // Verdict
+    const verdictColor = result.verdict?.decision === "PASS" || result.verdict?.decision === "WOULD_PASS" ? g : red;
+    lines.push(`\n${b}Verdict:${r} ${verdictColor}${result.verdict?.decision}${r}`);
+    
+    // Summary
+    if (result.verdict?.summary) {
+      lines.push(`${d}${result.verdict.summary}${r}`);
+    }
+    
+    // Violations
+    if (result.violations.length > 0) {
+      lines.push(`\n${b}Violations (${result.violations.length}):${r}`);
+      for (const v of result.violations.slice(0, 5)) {
+        lines.push(`  ${red}•${r} [${v.code}] ${v.message}`);
+        lines.push(`    ${d}Resource: ${v.resource}${r}`);
+        lines.push(`    ${d}Intent ref: ${v.intent_ref}${r}`);
+      }
+      if (result.violations.length > 5) {
+        lines.push(`  ${d}... and ${result.violations.length - 5} more${r}`);
+      }
+    }
+    
+    // Proofs
+    if (result.proofs.length > 0) {
+      const verified = result.proofs.filter(p => p.status === "verified").length;
+      const failed = result.proofs.filter(p => p.status === "failed").length;
+      lines.push(`\n${b}Proofs:${r} ${g}${verified} verified${r}, ${red}${failed} failed${r}`);
+    }
+    
+    // Intent
+    lines.push(`\n${d}Intent hash: ${result.intent_hash || "NONE"}${r}`);
+    lines.push(`${d}Run ID: ${result.runId}${r}`);
+    
+    return lines.join("\n");
+  }
+}
+
+/**
+ * Create orchestrator instance
+ * @param {string} projectRoot - Project root
+ * @returns {FirewallOrchestrator} Orchestrator instance
+ */
+function createOrchestrator(projectRoot) {
+  return new FirewallOrchestrator(projectRoot);
+}
+
+module.exports = {
+  FirewallOrchestrator,
+  createOrchestrator,
+  normalizeChangeEvent,
+  classifyDomain,
+  CHANGE_EVENT_TYPE,
+};