vibecodedshit 0.0.0-stage → 0.3.0

package/dist/route/order.js

@@ -0,0 +1,22 @@
+/**
+ * The fixed order Slices are written in (ADR 0001): secrets and known vulnerabilities, then the repo installs, builds
+ * and verifies, then the safety net, then types and lint, then CI and docs. Structural refactors and major upgrades
+ * (3.x, 4.x, 5.2) come last. It is advice about working order, so it lives here and not in the methodology YAML.
+ */
+const PRECEDENCE = [
+    '5.4', '5.1',
+    '6.1', '5.3', '5.5', '6.2', '6.5',
+    '1.1', '1.4', '1.2', '1.3', '1.5',
+    '2.1', '2.2', '2.5', '2.3', '2.4',
+    '6.4', '6.6', '6.3',
+];
+const LAST_GROUPS = ['3', '4'];
+/** Lower ranks are written first. Parameters not in the list go last: 3.x, then 4.x, then everything else (5.2). */
+export function precedenceRank(id) {
+    const listed = PRECEDENCE.indexOf(id);
+    if (listed >= 0)
+        return listed;
+    const [dimension = '', index = '0'] = id.split('.');
+    const group = LAST_GROUPS.indexOf(dimension);
+    return PRECEDENCE.length + (group >= 0 ? group : LAST_GROUPS.length) * 100 + Number(index);
+}

package/dist/route/select.js

@@ -0,0 +1,114 @@
+import { roundHalfUp } from '../scoring/aggregate.js';
+import { healthWith, nextCandidate } from '../scoring/what-if.js';
+import { precedenceRank } from './order.js';
+export const PREVIEW_LINE = 'Install Docker for a full run to get your Route';
+/** Vibe-coded and Fragile aim at Stable, Stable at Agent-ready, Agent-ready at nothing. The bounds come from the YAML. */
+export function targetBand(current, methodology) {
+    const bands = [...methodology.bands].sort((a, b) => a.min - b.min);
+    const stable = bands.findIndex((b) => b.key === 'stable');
+    const at = bands.findIndex((b) => b.key === current);
+    if (stable < 0 || at < 0 || at > stable)
+        return null;
+    return at < stable ? (bands[stable] ?? null) : (bands[stable + 1] ?? null);
+}
+function currentScore(run, id, overrides) {
+    const override = overrides.get(id);
+    if (override !== undefined)
+        return override;
+    const param = run.parameters.find((p) => p.id === id);
+    if (param?.status === 'failed')
+        return 0;
+    if (param?.status === 'measured')
+        return param.score ?? 0;
+    return null;
+}
+/** The greedy Steps: each is the one that raises the displayed health most, until the Target band is reached or no Step adds health. */
+function selectSteps(run, methodology, target) {
+    const overrides = new Map();
+    const steps = [];
+    for (;;) {
+        const base = healthWith(run, methodology, overrides);
+        if (base.health === null)
+            return { steps, reached: false };
+        const displayed = roundHalfUp(base.health);
+        if (displayed >= target.min)
+            return { steps, reached: true };
+        let best = null;
+        for (const dim of methodology.dimensions) {
+            for (const def of dim.parameters) {
+                const score = currentScore(run, def.id, overrides);
+                if (score === null)
+                    continue;
+                const candidate = nextCandidate(def, score);
+                if (!candidate)
+                    continue;
+                const after = healthWith(run, methodology, new Map([...overrides, [def.id, candidate.score]])).health;
+                if (after === null || after - base.health <= 1e-9)
+                    continue;
+                const entry = {
+                    step: { id: def.id, name: def.name, dimensionId: dim.id, fromScore: score, toScore: candidate.score, descriptor: candidate.descriptor },
+                    rise: roundHalfUp(after) - displayed,
+                    precise: after - base.health,
+                    dimensionScore: base.dimension.get(dim.id) ?? 0,
+                };
+                if (!best ||
+                    entry.rise > best.rise ||
+                    (entry.rise === best.rise &&
+                        (entry.precise > best.precise + 1e-9 ||
+                            (Math.abs(entry.precise - best.precise) <= 1e-9 &&
+                                (entry.dimensionScore < best.dimensionScore || (entry.dimensionScore === best.dimensionScore && entry.step.id.localeCompare(best.step.id, 'en', { numeric: true }) < 0)))))) {
+                    best = entry;
+                }
+            }
+        }
+        if (!best)
+            return { steps, reached: false };
+        overrides.set(best.step.id, best.step.toScore);
+        steps.push(best.step);
+    }
+}
+/** The Route for a run: Steps chosen by Gain, then written as Slices in the fixed precedence with the health after each. */
+export function buildRoute(run, methodology) {
+    if (!run.health)
+        return { kind: 'none' };
+    const target = targetBand(run.health.band, methodology);
+    if (!target)
+        return { kind: 'none' };
+    if (run.mode === 'preview')
+        return { kind: 'preview' };
+    const { steps, reached } = selectSteps(run, methodology, target);
+    const ordered = [...steps].sort((a, b) => precedenceRank(a.id) - precedenceRank(b.id) || a.toScore - b.toScore);
+    const overrides = new Map();
+    let before = run.health.displayed;
+    const slices = ordered.map((step, i) => {
+        overrides.set(step.id, step.toScore);
+        const after = roundHalfUp(healthWith(run, methodology, overrides).health ?? before);
+        const slice = { ...step, position: i + 1, healthBefore: before, healthAfter: after };
+        before = after;
+        return slice;
+    });
+    return {
+        kind: 'route',
+        target,
+        from: run.health.displayed,
+        to: before,
+        reached,
+        unmeasured: run.parameters.filter((p) => p.status === 'not_measured').map((p) => p.id),
+        slices,
+    };
+}
+/** The stdout lines: the summary, plus the out-of-reach line when the Target band is not reached. A preview gets its one line, Agent-ready nothing. */
+export function routeLines(plan) {
+    if (plan.kind === 'preview')
+        return [PREVIEW_LINE];
+    if (plan.kind === 'none')
+        return [];
+    const lines = [`Route to ${plan.target.name}: ${plan.slices.length} Slices, ${plan.from} -> ${plan.to}`];
+    if (!plan.reached)
+        lines.push(outOfReachLine(plan));
+    return lines;
+}
+export function outOfReachLine(plan) {
+    const reason = plan.unmeasured.length > 0 ? `until ${plan.unmeasured.join(', ')} are measured` : 'with the parameters measured, because no further Step adds health';
+    return `${plan.target.name} is out of reach ${reason}; this Route gets you to ${plan.to}`;
+}

package/dist/route/write.js

@@ -0,0 +1,13 @@
+import { mkdirSync, readdirSync, rmSync, writeFileSync } from 'node:fs';
+import path from 'node:path';
+import { ROUTE_FILE, SLICE_FILE } from './files.js';
+/** Deletes the earlier ROUTE.md and Slice files in `dir` (nothing else), then writes the new ones. */
+export function writeRouteFiles(dir, files) {
+    mkdirSync(dir, { recursive: true });
+    for (const name of readdirSync(dir)) {
+        if (name === ROUTE_FILE || SLICE_FILE.test(name))
+            rmSync(path.join(dir, name), { force: true });
+    }
+    for (const file of files)
+        writeFileSync(path.join(dir, file.name), file.content, 'utf8');
+}

package/dist/run/read.js

@@ -0,0 +1,89 @@
+import { readFileSync } from 'node:fs';
+import { z } from 'zod';
+export class RunReadError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = 'RunReadError';
+    }
+}
+const nullableScore = z.number().nullable();
+/** The fields `report` and `diff` read. Unknown fields pass through untouched. */
+const runFileSchema = z.looseObject({
+    schemaVersion: z.literal(1),
+    valid: z.boolean(),
+    invalidReason: z.string().optional(),
+    warnings: z.array(z.string()),
+    methodology: z.looseObject({ version: z.string() }),
+    mode: z.enum(['preview', 'full']),
+    comparable: z.boolean(),
+    comparableReason: z.string().optional(),
+    asOf: z.string(),
+    layers: z.array(z.enum(['static', 'execution'])),
+    repo: z.looseObject({ path: z.string(), headCommit: z.string().nullable(), treeHash: z.string().nullable() }),
+    tools: z.record(z.string(), z.unknown()),
+    execution: z
+        .looseObject({
+        feedbackLoop: z.looseObject({ typecheckSeconds: z.number(), lintSeconds: z.number(), testSeconds: z.number(), totalSeconds: z.number() }),
+        roots: z
+            .array(z.looseObject({
+            dir: z.string(),
+            group: z.string(),
+            install: z.enum(['ok', 'failed', 'timeout']).nullable(),
+            exitCode: z.number().nullable(),
+        }))
+            .optional(),
+    })
+        .optional(),
+    reportOnly: z.record(z.string(), z.unknown()).optional(),
+    ignoreSet: z.looseObject({
+        healthignoreSha256: z.string().nullable(),
+        gitleaksignoreSha256: z.string().nullable(),
+        excludedLinesPercent: z.number(),
+    }),
+    scope: z.looseObject({ logicFiles: z.number(), logicLines: z.number(), sourceLines: z.number(), packages: z.array(z.string()) }),
+    parameters: z.array(z.looseObject({
+        id: z.string(),
+        status: z.enum(['measured', 'not_applicable', 'not_measured', 'failed']),
+        reason: z.string().optional(),
+        weight: z.number(),
+        raw: z.looseObject({ kind: z.enum(['ratio', 'level', 'number', 'components', 'failed']) }).nullable().optional(),
+        score: z.number().optional(),
+        units: z.array(z.looseObject({ package: z.string(), group: z.string(), weight: z.number(), raw: z.looseObject({}), score: z.number() })).optional(),
+    })),
+    dimensions: z.array(z.looseObject({ id: z.number(), key: z.string(), score: nullableScore })),
+    breakdown: z.looseObject({
+        byPackage: z.record(z.string(), z.record(z.string(), nullableScore)),
+        byGroup: z.record(z.string(), z.record(z.string(), nullableScore)),
+    }),
+    health: z.looseObject({ score: z.number(), displayed: z.number(), band: z.string() }).nullable(),
+});
+/** Parse a run.json document. Throws RunReadError naming the file for anything but a valid version 1 run. */
+export function parseRun(text, file) {
+    let doc;
+    try {
+        doc = JSON.parse(text);
+    }
+    catch (err) {
+        throw new RunReadError(`${file}: not valid JSON (${err instanceof Error ? err.message : String(err)})`);
+    }
+    if (typeof doc === 'object' && doc !== null && 'schemaVersion' in doc && doc.schemaVersion !== 1) {
+        throw new RunReadError(`${file}: unsupported schemaVersion ${JSON.stringify(doc.schemaVersion)} (this CLI reads 1)`);
+    }
+    const result = runFileSchema.safeParse(doc);
+    if (!result.success) {
+        const issue = result.error.issues[0];
+        const where = issue && issue.path.length > 0 ? issue.path.join('.') : '(root)';
+        throw new RunReadError(`${file}: not a run.json: ${where}: ${issue?.message ?? 'invalid'}`);
+    }
+    return result.data;
+}
+export function readRun(file) {
+    let text;
+    try {
+        text = readFileSync(file, 'utf8');
+    }
+    catch (err) {
+        throw new RunReadError(`${file}: cannot read (${err instanceof Error ? err.message : String(err)})`);
+    }
+    return parseRun(text, file);
+}

package/dist/run/recompute.js

@@ -0,0 +1,19 @@
+import { poolParameter } from '../scoring/pool.js';
+import { dimensionScores, healthFrom } from './score-run.js';
+/** Re-derive every score from the stored raw values. */
+export function recompute(run, methodology) {
+    const defs = new Map(methodology.dimensions.flatMap((d) => d.parameters).map((p) => [p.id, p]));
+    const parameters = run.parameters.map((param) => {
+        const def = defs.get(param.id);
+        if (!def)
+            throw new Error(`run.json names unknown parameter ${param.id}`);
+        if (param.status === 'failed')
+            return { ...param, score: 0 };
+        if (param.status !== 'measured')
+            return param;
+        const pooled = poolParameter(def, param.units ?? []);
+        return { ...param, raw: pooled.raw, score: pooled.score, units: pooled.units };
+    });
+    const dimensions = dimensionScores(methodology, parameters);
+    return { parameters, dimensions, health: healthFrom(methodology, dimensions) };
+}

package/dist/run/scan.js

@@ -0,0 +1,196 @@
+import { spawnSync } from 'node:child_process';
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import ts from 'typescript';
+import { createDockerRunner, imageDigest } from '../exec/docker.js';
+import { runExecution } from '../exec/run.js';
+import { executionRoots, failedRootDirs } from '../exec/roots.js';
+import { feedbackLoop } from '../measure/p6-3.js';
+import { measurers as allMeasurers } from '../measure/registry.js';
+import { computeHotspots } from '../report-only/hotspots.js';
+import { loadMethodology, packageRoot } from '../methodology/load.js';
+import { buildScope } from '../scope/build.js';
+import { poolParameter } from '../scoring/pool.js';
+import { createImageToolKit } from '../tools/image.js';
+import { createToolKit } from '../tools/kit.js';
+import { breakdownFor, dimensionScores, healthFrom } from './score-run.js';
+export class NoLogicFilesError extends Error {
+    constructor() {
+        super('The repository has no logic file, so it is not scored');
+        this.name = 'NoLogicFilesError';
+    }
+}
+function git(repoPath, args) {
+    const result = spawnSync('git', ['-C', repoPath, ...args], { encoding: 'utf8' });
+    return result.error || result.status !== 0 ? null : result.stdout.trim();
+}
+function healthVersion() {
+    const pkg = JSON.parse(readFileSync(path.join(packageRoot, 'package.json'), 'utf8'));
+    return pkg.version;
+}
+function baseRun(opts) {
+    const repoPath = path.resolve(opts.repoPath);
+    const gitVersion = spawnSync('git', ['--version'], { encoding: 'utf8' }).stdout.trim().replace(/^git version /, '');
+    return {
+        schemaVersion: 1,
+        valid: true,
+        warnings: [],
+        methodology: { version: opts.methodologyVersion },
+        mode: opts.mode,
+        comparable: false,
+        comparableReason: 'preview, not comparable',
+        asOf: opts.asOf,
+        layers: ['static'],
+        repo: {
+            path: repoPath,
+            headCommit: git(repoPath, ['rev-parse', '--verify', '-q', 'HEAD']),
+            treeHash: git(repoPath, ['rev-parse', '--verify', '-q', 'HEAD^{tree}']),
+        },
+        tools: { health: healthVersion(), node: process.version, typescript: ts.version, git: gitVersion },
+    };
+}
+/** A run for a tool error: marked invalid, with no scores and no health. */
+export function invalidRun(opts, reason) {
+    return {
+        ...baseRun(opts),
+        valid: false,
+        invalidReason: reason,
+        ignoreSet: { healthignoreSha256: null, gitleaksignoreSha256: null, excludedLinesPercent: 0 },
+        scope: { logicFiles: 0, logicLines: 0, sourceLines: 0, packages: [] },
+        parameters: [],
+        dimensions: [],
+        breakdown: { byPackage: {}, byGroup: {} },
+        health: null,
+    };
+}
+export async function runScan(opts, preloaded) {
+    const methodology = preloaded ?? loadMethodology(opts.methodologyVersion, opts.rootDir);
+    const repoPath = path.resolve(opts.repoPath);
+    const scope = await buildScope(repoPath, methodology);
+    if (scope.logicFiles === 0)
+        throw new NoLogicFilesError();
+    let exec;
+    let cleanup;
+    if (opts.mode === 'full') {
+        const tag = methodology.execution.runner.image;
+        ({ results: exec, cleanup } = await runExecution({
+            repoPath,
+            methodology,
+            scope,
+            runner: opts.execRunner ?? createDockerRunner(methodology.execution.runner, opts.dockerSpawn),
+            image: { tag, digest: opts.imageDigest ?? (await imageDigest(tag, opts.dockerSpawn)) },
+        }));
+    }
+    try {
+        return await measureAll(opts, methodology, repoPath, scope, exec);
+    }
+    finally {
+        await cleanup?.();
+    }
+}
+/** Every measurer, then scoring. The execution work copy (`exec.workDir`) still exists while this runs. */
+async function measureAll(opts, methodology, repoPath, scope, exec) {
+    const tools = opts.tools
+        ?? (opts.mode === 'full'
+            ? createImageToolKit({ runner: methodology.execution.runner, repoPath, ...(opts.dockerSpawn ? { spawn: opts.dockerSpawn } : {}) })
+            : createToolKit());
+    const warnings = [...scope.warnings];
+    const reportOnly = {};
+    const parameters = [];
+    for (const dimension of methodology.dimensions) {
+        for (const def of dimension.parameters) {
+            if (def.layer === 'execution' && opts.mode === 'preview') {
+                parameters.push({
+                    id: def.id,
+                    status: 'not_measured',
+                    reason: 'execution layer, not run in preview',
+                    weight: def.weight,
+                });
+                continue;
+            }
+            const measurer = (opts.measurers ?? allMeasurers).find((m) => m.id === def.id);
+            if (!measurer) {
+                parameters.push({ id: def.id, status: 'not_measured', reason: 'not implemented yet', weight: def.weight });
+                continue;
+            }
+            const measurement = await measurer.measure({
+                methodology,
+                param: def,
+                scope,
+                repoPath,
+                asOf: opts.asOf,
+                mode: opts.mode,
+                tools,
+                ...(exec ? { exec } : {}),
+            });
+            if (measurement.status === 'measured') {
+                Object.assign(reportOnly, measurement.reportOnly);
+                warnings.push(...(measurement.warnings ?? []));
+                const pooled = poolParameter(def, measurement.units);
+                const failedDirs = exec ? failedRootDirs(exec, scope, measurement.units) : [];
+                parameters.push({
+                    id: def.id,
+                    status: 'measured',
+                    ...(failedDirs.length > 0 ? { reason: `install failed in ${failedDirs.join(', ')}` } : {}),
+                    weight: def.weight,
+                    raw: pooled.raw,
+                    score: pooled.score,
+                    units: pooled.units,
+                });
+            }
+            else if (measurement.status === 'not_measured') {
+                parameters.push({ id: def.id, status: 'not_measured', reason: measurement.reason, weight: def.weight });
+            }
+            else if (measurement.status === 'failed') {
+                parameters.push({ id: def.id, status: 'failed', reason: measurement.reason, weight: def.weight, score: 0 });
+            }
+            else {
+                parameters.push({ id: def.id, status: 'not_applicable', reason: measurement.reason, weight: def.weight });
+            }
+        }
+    }
+    const complexityByFile = reportOnly.complexityByFile;
+    if (Array.isArray(complexityByFile)) {
+        const hotspots = computeHotspots(repoPath, opts.asOf, complexityByFile);
+        reportOnly.hotspots = hotspots.hotspots;
+        warnings.push(...hotspots.warnings);
+    }
+    reportOnly.pythonInScope = scope.files.some((f) => f.language === 'python');
+    const dimensions = dimensionScores(methodology, parameters);
+    const base = baseRun(opts);
+    const unmeasured = parameters.filter((p) => p.status === 'not_measured').map((p) => `${p.id} (${p.reason})`);
+    return {
+        ...base,
+        ...(opts.mode === 'full'
+            ? {
+                layers: ['static', 'execution'],
+                comparable: unmeasured.length === 0,
+                comparableReason: unmeasured.length === 0 ? 'all parameters measured' : `not comparable, not measured: ${unmeasured.join(', ')}`,
+            }
+            : {}),
+        warnings,
+        tools: {
+            ...base.tools,
+            ...(exec ? { image: exec.image } : {}),
+            ...(scope.pythonVersion === undefined ? {} : { python: scope.pythonVersion }),
+            ...(Object.keys(tools.versions()).length === 0 ? {} : { static: tools.versions() }),
+        },
+        ...(exec ? { execution: { feedbackLoop: feedbackLoop(exec), roots: executionRoots(exec) } } : {}),
+        ...(Object.keys(reportOnly).length === 0 ? {} : { reportOnly }),
+        ignoreSet: {
+            healthignoreSha256: scope.healthignoreSha256,
+            gitleaksignoreSha256: scope.gitleaksignoreSha256,
+            excludedLinesPercent: scope.excludedLinesPercent,
+        },
+        scope: {
+            logicFiles: scope.logicFiles,
+            logicLines: scope.logicLines,
+            sourceLines: scope.sourceLines,
+            packages: scope.packages,
+        },
+        parameters,
+        dimensions,
+        breakdown: breakdownFor(methodology, parameters),
+        health: healthFrom(methodology, dimensions),
+    };
+}

package/dist/run/schema.js

@@ -0,0 +1 @@
+export {};

package/dist/run/score-run.js

@@ -0,0 +1,42 @@
+import { bandFor, dimensionScore, healthScore, roundHalfUp } from '../scoring/aggregate.js';
+import { poolParameter } from '../scoring/pool.js';
+function liveScore(def, param, units) {
+    if (!param)
+        return null;
+    if (param.status === 'failed')
+        return 0;
+    if (param.status !== 'measured')
+        return null;
+    return poolParameter(def, units ?? param.units ?? []).score;
+}
+export function dimensionScores(methodology, parameters, filter) {
+    return methodology.dimensions.map((dimension) => {
+        const weighted = dimension.parameters.map((def) => {
+            const param = parameters.find((p) => p.id === def.id);
+            if (filter && param?.status === 'measured') {
+                const units = (param.units ?? []).filter(filter);
+                // A package or language with no units for a parameter has no data for it.
+                return { weight: def.weight, score: units.length === 0 ? null : liveScore(def, param, units) };
+            }
+            return { weight: def.weight, score: liveScore(def, param) };
+        });
+        return { id: dimension.id, key: dimension.key, score: dimensionScore(weighted) };
+    });
+}
+export function healthFrom(methodology, dimensions) {
+    const score = healthScore(dimensions.map((d) => d.score), methodology.capMargin);
+    if (score === null)
+        return null;
+    const displayed = roundHalfUp(score);
+    return { score, displayed, band: bandFor(displayed, methodology.bands).key };
+}
+export function breakdownFor(methodology, parameters) {
+    const units = parameters.flatMap((p) => p.units ?? []);
+    const packages = [...new Set(units.map((u) => u.package))].sort();
+    const groups = [...new Set(units.map((u) => u.group))].sort();
+    const toRecord = (dims) => Object.fromEntries(dims.map((d) => [String(d.id), d.score]));
+    return {
+        byPackage: Object.fromEntries(packages.map((pkg) => [pkg, toRecord(dimensionScores(methodology, parameters, (u) => u.package === pkg))])),
+        byGroup: Object.fromEntries(groups.map((group) => [group, toRecord(dimensionScores(methodology, parameters, (u) => u.group === group))])),
+    };
+}

package/dist/run/write.js

@@ -0,0 +1,4 @@
+import { writeFileSync } from 'node:fs';
+export function writeRun(file, run) {
+    writeFileSync(file, `${JSON.stringify(run, null, 2)}\n`, 'utf8');
+}