weavatrix 0.2.19 → 0.3.0

package/src/security/advisory-store.js

@@ -1,221 +1,173 @@
-// Local advisory cache for supply-chain scanning. SCANS are 100% offline (read this store only);
-// REFRESH is an explicit, user-triggered online call to OSV.dev (it necessarily sends the installed
-// package names+versions — surfaced in the UI, never automatic). OSV is the single source: CVE/GHSA
-// vulnerabilities AND OSSF malicious-package records (MAL-*) come through one schema/one matcher.
-//
-// Storage is a JSON file, not SQLite — deliberate P4 deviation from the plan: we cache advisories for
-// THIS machine's installed packages (hundreds of records), not the full npm snapshot (that's what
-// needed SQLite), and better-sqlite3 here is built for Electron's ABI so plain-node tests couldn't
-// load it. Same API surface; swap to SQLite if/when a full baked snapshot ships (P6).
-import { existsSync, readFileSync, writeFileSync, mkdirSync } from "node:fs";
-import { join, dirname } from "node:path";
-import { homedir } from "node:os";
-import { createHash } from "node:crypto";
-import { uniqueBy } from "../util.js";
+// Offline advisory cache. The MIT core plans source-free OSV coordinates, validates returned
+// records and reads/writes the local cache, but never performs network I/O. A connector extension
+// owns remote transport and passes bounded response data to commitAdvisoryRefresh().
+import {existsSync, readFileSync, writeFileSync, mkdirSync} from 'node:fs'
+import {join, dirname} from 'node:path'
+import {homedir} from 'node:os'
+import {createHash} from 'node:crypto'
+import {uniqueBy} from '../util.js'
 
-export const DEFAULT_STORE = join(homedir(), ".weavatrix", "advisories.json");
-const OSV_BATCH_URL = "https://api.osv.dev/v1/querybatch";
-const OSV_VULN_URL = "https://api.osv.dev/v1/vulns/";
-const DEFAULT_FETCH_TIMEOUT_MS = Number(process.env.WEAVATRIX_OSV_TIMEOUT_MS || 20000);
-export const OSV_SUPPORTED_ECOSYSTEMS = new Set(["npm", "PyPI", "Go", "Maven", "crates.io"]);
+export const DEFAULT_STORE = join(homedir(), '.weavatrix', 'advisories.json')
+export const OSV_SUPPORTED_ECOSYSTEMS = new Set(['npm', 'PyPI', 'Go', 'Maven', 'crates.io'])
 
-const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === "PyPI" ? String(name).toLowerCase().replace(/[-_.]+/g, "-") : name}`;
+const keyOf = (ecosystem, name) => `${ecosystem}|${ecosystem === 'PyPI' ? String(name).toLowerCase().replace(/[-_.]+/g, '-') : name}`
+const uniquePackages = (packages) => uniqueBy(packages, (item) => `${item.ecosystem}|${item.name}|${item.version}`)
 
-const uniquePackages = (pkgs) => uniqueBy(pkgs, (p) => `${p.ecosystem}|${p.name}|${p.version}`);
-
-export function advisoryQueryFingerprint(installed = []) {
-  const rows = uniquePackages(installed.filter((p) => p?.ecosystem && p?.name && p?.version && OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)))
-    .map((p) => `${p.ecosystem}|${p.name}|${p.version}`)
-    .sort();
-  return createHash("sha256").update(rows.join("\n"), "utf8").digest("hex");
+export function createAdvisoryQueryPlan(installed = []) {
+  const pinned = installed.filter((item) => item?.ecosystem && item?.name && item?.version)
+  const unsupported = pinned.filter((item) => !OSV_SUPPORTED_ECOSYSTEMS.has(item.ecosystem)).length
+  const packages = uniquePackages(pinned.filter((item) => OSV_SUPPORTED_ECOSYSTEMS.has(item.ecosystem)))
+    .map(({ecosystem, name, version}) => ({ecosystem, name, version}))
+  return Object.freeze({packages: Object.freeze(packages), unsupported})
 }
 
-async function fetchJson(fetcher, url, options, timeoutMs) {
-  const timeout = Math.max(50, Number(timeoutMs) || DEFAULT_FETCH_TIMEOUT_MS);
-  const ctrl = typeof AbortController === "function" ? new AbortController() : null;
-  let timer;
-  try {
-    const request = fetcher(url, ctrl ? { ...options, signal: ctrl.signal } : options);
-    const timeoutPromise = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        try { ctrl?.abort(); } catch { /* ignore */ }
-        reject(new Error(`OSV request timed out after ${Math.round(timeout / 1000)}s`));
-      }, timeout);
-    });
-    const res = await Promise.race([request, timeoutPromise]);
-    if (!res || typeof res.json !== "function") throw new Error("invalid response from OSV");
-    if (res.ok === false) throw new Error(`HTTP ${res.status || "error"} from OSV`);
-    return await res.json();
-  } catch (error) {
-    if (error?.name === "AbortError") throw new Error(`OSV request timed out after ${Math.round(timeout / 1000)}s`);
-    throw error;
-  } finally {
-    if (timer) clearTimeout(timer);
-  }
+export function advisoryQueryFingerprint(installed = []) {
+  const rows = createAdvisoryQueryPlan(installed).packages
+    .map((item) => `${item.ecosystem}|${item.name}|${item.version}`)
+    .sort()
+  return createHash('sha256').update(rows.join('\n'), 'utf8').digest('hex')
 }
 
 export function loadStore(storePath = DEFAULT_STORE) {
   try {
-    const s = JSON.parse(readFileSync(storePath, "utf8"));
-    if (s && typeof s === "object" && s.records) return s;
-  } catch { /* missing/corrupt → empty */ }
-  return { meta: { fetched_at: null }, records: {} };
+    const store = JSON.parse(readFileSync(storePath, 'utf8'))
+    if (store && typeof store === 'object' && store.records) return store
+  } catch { /* missing/corrupt -> empty */ }
+  return {meta: {fetched_at: null}, records: {}}
 }
 
-export function queryStore(store, ecosystem, name) {
-  return (store && store.records && store.records[keyOf(ecosystem, name)]) || [];
-}
+export const queryStore = (store, ecosystem, name) => (store?.records?.[keyOf(ecosystem, name)]) || []
 
 export function storeMeta(storePath = DEFAULT_STORE) {
-  const s = loadStore(storePath);
-  return { fetchedAt: s.meta?.fetched_at || null, advisoryCount: Object.values(s.records || {}).reduce((n, l) => n + l.length, 0) };
+  const store = loadStore(storePath)
+  return {
+    fetchedAt: store.meta?.fetched_at || null,
+    advisoryCount: Object.values(store.records || {}).reduce((total, records) => total + records.length, 0),
+  }
 }
 
-// GHSA-style labels + CVSS score → our severity scale. MAL-* records are always critical.
-function severityOf(rec) {
-  if (String(rec.id || "").startsWith("MAL-")) return "critical";
-  const label = String(rec.database_specific?.severity || "").toLowerCase();
-  if (label === "critical") return "critical";
-  if (label === "high") return "high";
-  if (label === "moderate" || label === "medium") return "medium";
-  if (label === "low") return "low";
-  let best = 0;
-  for (const s of rec.severity || []) {
-    const m = String(s.score || "").match(/CVSS:[\d.]+\/.*?\bA[VC]?:/i) ? null : String(s.score || "").match(/^(\d+(\.\d+)?)$/);
-    if (m) best = Math.max(best, Number(m[1]));
+function severityOf(record) {
+  if (String(record.id || '').startsWith('MAL-')) return 'critical'
+  const label = String(record.database_specific?.severity || '').toLowerCase()
+  if (label === 'critical') return 'critical'
+  if (label === 'high') return 'high'
+  if (label === 'moderate' || label === 'medium') return 'medium'
+  if (label === 'low') return 'low'
+  let best = 0
+  for (const severity of record.severity || []) {
+    const value = String(severity.score || '')
+    const match = /CVSS:[\d.]+\/.*?\bA[VC]?:/i.test(value) ? null : value.match(/^(\d+(?:\.\d+)?)$/)
+    if (match) best = Math.max(best, Number(match[1]))
   }
-  if (best >= 9) return "critical";
-  if (best >= 7) return "high";
-  if (best >= 4) return "medium";
-  return "medium"; // unknown → medium, never silently info
+  if (best >= 9) return 'critical'
+  if (best >= 7) return 'high'
+  return 'medium'
 }
 
-// One normalized row per (record × matching affected entry): everything the matcher/UI needs, nothing else.
-function normalizeRecord(rec, ecosystem, name) {
-  const affected = (rec.affected || []).find((a) => a?.package && a.package.ecosystem === ecosystem && keyOf(ecosystem, a.package.name) === keyOf(ecosystem, name));
-  if (!affected) return null;
-  const fixed = [];
-  for (const r of affected.ranges || []) for (const e of r.events || []) if (e.fixed) fixed.push(e.fixed);
+export function normalizeOsvAdvisory(record, ecosystem, name) {
+  const affected = (record?.affected || []).find((item) => item?.package
+    && item.package.ecosystem === ecosystem
+    && keyOf(ecosystem, item.package.name) === keyOf(ecosystem, name))
+  if (!affected) return null
+  const fixed = []
+  for (const range of affected.ranges || []) for (const event of range.events || []) if (event.fixed) fixed.push(event.fixed)
   return {
-    id: rec.id,
-    kind: String(rec.id || "").startsWith("MAL-") ? "malicious" : "vuln",
-    severity: severityOf(rec),
-    summary: String(rec.summary || rec.details || "").slice(0, 300),
-    url: `https://osv.dev/vulnerability/${rec.id}`,
-    modified: rec.modified || "",
-    aliases: (rec.aliases || []).slice(0, 6),
+    id: record.id,
+    kind: String(record.id || '').startsWith('MAL-') ? 'malicious' : 'vuln',
+    severity: severityOf(record),
+    summary: String(record.summary || record.details || '').slice(0, 300),
+    url: `https://osv.dev/vulnerability/${record.id}`,
+    modified: record.modified || '',
+    aliases: (record.aliases || []).slice(0, 6),
     fixedIn: [...new Set(fixed)].slice(0, 4),
-    affected: { versions: affected.versions || [], ranges: affected.ranges || [] },
-  };
+    affected: {versions: affected.versions || [], ranges: affected.ranges || []},
+  }
 }
 
-// Refresh the cache from OSV for the given installed set. fetcher is injectable for tests.
-// Returns { queried, vulnerable, fetched, saved, errors }.
-export async function refreshAdvisories({ installed = [], storePath = DEFAULT_STORE, fetcher = globalThis.fetch, batchSize = 100, repoKey = "", repoKeys = [], timeoutMs = DEFAULT_FETCH_TIMEOUT_MS } = {}) {
-  if (typeof fetcher !== "function") return { ok: false, error: "no fetch available" };
-  const withVersions = installed.filter((p) => p && p.ecosystem && p.name && p.version);
-  const unsupported = withVersions.filter((p) => !OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)).length;
-  const pkgs = uniquePackages(withVersions.filter((p) => OSV_SUPPORTED_ECOSYSTEMS.has(p.ecosystem)));
-  if (!pkgs.length) {
-    return {
-      ok: false,
-      queried: 0,
-      unsupported,
-      error: "No OSV-supported pinned package versions found to check. Weavatrix queries OSV for npm, PyPI, Go, Maven/Gradle, and crates.io packages with concrete versions.",
-    };
+// idsByPackage is an array parallel to plan.packages; advisoryRecords is an id-keyed plain object.
+// Remote failures arrive explicitly in errors. A zero-response failure never stamps the cache fresh.
+export function commitAdvisoryRefresh({
+  plan,
+  idsByPackage = [],
+  advisoryRecords = {},
+  queriedOk = 0,
+  errors: initialErrors = [],
+  storePath = DEFAULT_STORE,
+  repoKey = '',
+  repoKeys = [],
+} = {}) {
+  const packages = plan?.packages || []
+  const unsupported = Number(plan?.unsupported) || 0
+  if (!packages.length) return {ok: false, queried: 0, unsupported, error: 'No OSV-supported pinned package versions found to check.'}
+  const errors = [...initialErrors.map(String)]
+  if (errors.length && queriedOk === 0) {
+    return {ok: false, queried: packages.length, unsupported, error: `advisory refresh failed: ${errors[0]}`, errors}
   }
-  const store = loadStore(storePath);
-  const idsByPkg = new Map(); // pkgIndex -> [vuln ids]
-  const errors = [];
-  let queriedOk = 0;
 
-  for (let i = 0; i < pkgs.length; i += batchSize) {
-    const batch = pkgs.slice(i, i + batchSize);
-    try {
-      const json = await fetchJson(fetcher, OSV_BATCH_URL, {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ queries: batch.map((p) => ({ package: { ecosystem: p.ecosystem, name: p.name }, version: p.version })) }),
-      }, timeoutMs);
-      if (!Array.isArray(json?.results) || json.results.length !== batch.length) {
-        throw new Error(`OSV querybatch returned ${Array.isArray(json?.results) ? json.results.length : "no"} result(s) for ${batch.length} query item(s)`);
-      }
-      for (const [resultIndex, result] of json.results.entries()) {
-        if (!result || typeof result !== "object" || Array.isArray(result)) {
-          throw new Error(`OSV querybatch result ${resultIndex + 1} is not an object`);
-        }
-        if (result.vulns !== undefined && !Array.isArray(result.vulns)) {
-          throw new Error(`OSV querybatch result ${resultIndex + 1} has a non-array vulns field`);
-        }
-        if (Array.isArray(result.vulns) && result.vulns.some((v) => !v || typeof v.id !== "string" || !v.id.trim())) {
-          throw new Error(`OSV querybatch result ${resultIndex + 1} contains an advisory without a valid id`);
-        }
-      }
-      queriedOk += batch.length;
-      json.results.forEach((r, j) => { if (r && Array.isArray(r.vulns) && r.vulns.length) idsByPkg.set(i + j, r.vulns.map((v) => v.id)); });
-    } catch (error) {
-      errors.push(`querybatch ${Math.floor(i / batchSize) + 1}/${Math.ceil(pkgs.length / batchSize)}: ${error.message}`);
+  const store = loadStore(storePath)
+  const wanted = new Map()
+  idsByPackage.forEach((ids, index) => {
+    for (const id of Array.isArray(ids) ? ids : []) {
+      if (!wanted.has(id)) wanted.set(id, [])
+      wanted.get(id).push(packages[index])
     }
-  }
-
-  const wanted = new Map(); // id -> [pkg,...] (an id can hit several packages)
-  for (const [pi, ids] of idsByPkg) for (const id of ids) (wanted.get(id) || wanted.set(id, []).get(id)).push(pkgs[pi]);
+  })
 
-  let fetched = 0;
-  for (const [id, pkgList] of wanted) {
-    try {
-      const rec = await fetchJson(fetcher, OSV_VULN_URL + encodeURIComponent(id), {}, timeoutMs);
-      if (!rec || typeof rec.id !== "string" || !rec.id) throw new Error("OSV detail response is missing its advisory id");
-      if (rec.id !== id) throw new Error(`OSV detail id mismatch (expected ${id}, received ${rec.id})`);
-      let normalized = 0;
-      for (const p of pkgList) {
-        const row = normalizeRecord(rec, p.ecosystem, p.name);
-        if (!row) {
-          errors.push(`${id}: OSV detail does not describe ${p.ecosystem}:${p.name} reported by querybatch`);
-          continue;
-        }
-        normalized++;
-        const key = keyOf(p.ecosystem, p.name);
-        const list = store.records[key] || (store.records[key] = []);
-        const at = list.findIndex((x) => x.id === row.id);
-        if (at >= 0) list[at] = row; else list.push(row);
+  let fetched = 0
+  for (const [id, packageList] of wanted) {
+    const record = advisoryRecords[id]
+    if (!record || record.id !== id) {
+      errors.push(`${id}: advisory detail response is missing or has a mismatched id`)
+      continue
+    }
+    let normalized = 0
+    for (const item of packageList) {
+      const row = normalizeOsvAdvisory(record, item.ecosystem, item.name)
+      if (!row) {
+        errors.push(`${id}: advisory detail does not describe ${item.ecosystem}:${item.name}`)
+        continue
       }
-      // Count a detail response as fetched only after at least one package-specific row was
-      // validated. A malformed or unrelated response must never make coverage look complete.
-      if (normalized > 0) fetched++;
-    } catch (error) {
-      errors.push(`${id}: ${error.message}`);
+      normalized++
+      const key = keyOf(item.ecosystem, item.name)
+      const records = store.records[key] || (store.records[key] = [])
+      const index = records.findIndex((existing) => existing.id === row.id)
+      if (index >= 0) records[index] = row
+      else records.push(row)
     }
+    if (normalized) fetched++
   }
 
-  // A refresh where NOTHING was fetched but errors occurred (offline, OSV blocked) must NOT stamp
-  // fetched_at — that would turn an empty cache into "No known vulnerabilities as of <today>".
-  if (errors.length && queriedOk === 0) {
-    return { ok: false, queried: pkgs.length, unsupported, error: `advisory refresh failed: ${errors[0]}${errors.length > 1 ? ` (+${errors.length - 1} more)` : ""}`, errors };
-  }
-  store.meta.fetched_at = new Date().toISOString();
-  const status = errors.length ? "PARTIAL" : "OK";
-  // per-repo stamp: the cache only covers packages that were QUERIED — a repo that never refreshed must
-  // show "fetch advisories", not "0 vulnerabilities as of <someone else's date>" (false assurance).
-  // repoKeys[] lets one online pass (a "refresh all repos") stamp every repo whose packages it covered.
-  const stampRepos = [...new Set([repoKey, ...repoKeys].filter(Boolean))];
+  const fetchedAt = new Date().toISOString()
+  const status = errors.length ? 'PARTIAL' : 'OK'
+  store.meta.fetched_at = fetchedAt
+  const stampRepos = [...new Set([repoKey, ...repoKeys].filter(Boolean))]
   if (stampRepos.length) {
-    store.meta.repos = store.meta.repos || {};
-    for (const k of stampRepos) store.meta.repos[k] = {
-      fetched_at: store.meta.fetched_at,
+    store.meta.repos ||= {}
+    for (const key of stampRepos) store.meta.repos[key] = {
+      fetched_at: fetchedAt,
       status,
-      queried: pkgs.length,
+      queried: packages.length,
       queried_ok: queriedOk,
       unsupported,
       error_count: errors.length,
-      query_fingerprint: advisoryQueryFingerprint(pkgs),
-    };
+      query_fingerprint: advisoryQueryFingerprint(packages),
+    }
   }
   try {
-    mkdirSync(dirname(storePath), { recursive: true });
-    writeFileSync(storePath, JSON.stringify(store), "utf8");
+    mkdirSync(dirname(storePath), {recursive: true})
+    writeFileSync(storePath, JSON.stringify(store), 'utf8')
   } catch (error) {
-    return { ok: false, error: `store write failed: ${error.message}`, errors };
+    return {ok: false, error: `store write failed: ${error.message}`, errors}
+  }
+  return {
+    ok: true,
+    status,
+    queried: packages.length,
+    queriedOk,
+    unsupported,
+    vulnerable: wanted.size,
+    fetched,
+    saved: existsSync(storePath),
+    errors,
   }
-  return { ok: true, status, queried: pkgs.length, queriedOk, unsupported, vulnerable: wanted.size, fetched, saved: existsSync(storePath), errors };
 }

package/src/security/rust-advisory-report.js

@@ -0,0 +1,60 @@
+import { existsSync, readFileSync } from "node:fs";
+import { createRepoBoundary } from "../repo-path.js";
+
+const REPORT_PATHS = [
+  ".weavatrix/reports/cargo-audit.json",
+  ".weavatrix/cargo-audit.json",
+  "cargo-audit.json",
+];
+
+const warningEntries = (warnings) => Object.entries(warnings || {}).flatMap(([kind, value]) =>
+  (Array.isArray(value) ? value : value?.list || []).map((item) => ({ kind, ...item })));
+
+// Imports an explicitly generated `cargo audit --json` report. Core never runs Cargo, downloads the
+// RustSec database, or executes repository code; an absent/stale report remains visibly incomplete.
+export function loadRustAdvisoryReport(repoPath, { now = Date.now(), maxAgeDays = 30 } = {}) {
+  const boundary = createRepoBoundary(repoPath);
+  if (!boundary.root) return { status: "ERROR", detail: "Repository boundary is unavailable.", findings: [] };
+  const found = REPORT_PATHS.map((file) => ({ file, resolved: boundary.resolve(file) }))
+    .find((item) => item.resolved.ok && existsSync(item.resolved.path));
+  if (!found) return {
+    status: "NOT_CHECKED",
+    detail: "No saved cargo audit --json report was found; Cargo.lock OSV matching is separate evidence.",
+    findings: [],
+  };
+  try {
+    const report = JSON.parse(readFileSync(found.resolved.path, "utf8"));
+    const vulnerabilities = report?.vulnerabilities?.list;
+    if (!Array.isArray(vulnerabilities)) throw new Error("vulnerabilities.list is missing");
+    const checkedAt = report?.database?.["last-updated"] || report?.database?.lastUpdated || report?.generatedAt || null;
+    const ageMs = checkedAt ? now - new Date(checkedAt).getTime() : Number.POSITIVE_INFINITY;
+    const stale = !Number.isFinite(ageMs) || ageMs > maxAgeDays * 86_400_000;
+    const findings = vulnerabilities.map((item) => ({
+      kind: "vulnerability",
+      id: item.advisory?.id || "RUSTSEC-UNKNOWN",
+      title: item.advisory?.title || item.advisory?.description || "RustSec advisory",
+      url: item.advisory?.url || "",
+      package: item.package?.name || item.advisory?.package || "unknown-crate",
+      version: item.package?.version || "",
+      patched: item.versions?.patched || [],
+    }));
+    findings.push(...warningEntries(report?.warnings).map((item) => ({
+      kind: item.kind || "warning",
+      id: item.advisory?.id || `cargo-audit-${item.kind || "warning"}`,
+      title: item.advisory?.title || item.message || `Cargo audit ${item.kind || "warning"}`,
+      url: item.advisory?.url || "",
+      package: item.package?.name || item.advisory?.package || "unknown-crate",
+      version: item.package?.version || "",
+      patched: item.versions?.patched || [],
+    })));
+    return {
+      status: stale ? "PARTIAL" : "OK",
+      detail: `${stale ? "Imported stale/undated" : "Imported"} cargo-audit report ${found.file}: ${vulnerabilities.length} vulnerability/vulnerabilities and ${findings.length - vulnerabilities.length} warning(s).`,
+      checkedAt,
+      file: found.file,
+      findings,
+    };
+  } catch (error) {
+    return { status: "ERROR", detail: `Could not read ${found.file}: ${error instanceof Error ? error.message : String(error)}`, file: found.file, findings: [] };
+  }
+}

package/src/mcp/actions/advisories.mjs

@@ -1,17 +0,0 @@
-import {refreshAdvisories, storeMeta, DEFAULT_STORE} from '../../security/advisory-store.js'
-import {collectInstalled} from '../../security/installed.js'
-
-export async function tRefreshAdvisories(g, args, ctx) {
-    if (!ctx.repoRoot) return 'No repo root — cannot collect installed packages.'
-    const {installed} = collectInstalled(ctx.repoRoot)
-    if (!installed.length) return 'No pinned packages found in supported manifests/lockfiles (npm/yarn/pip/poetry/uv/go/Maven/Gradle/Cargo) — nothing to query.'
-    const res = await refreshAdvisories({installed, repoKey: ctx.repoRoot, timeoutMs: Number(args.timeout_ms) || undefined})
-    if (res.ok === false) return `Advisory refresh failed: ${res.error}`
-    const meta = storeMeta()
-    return [
-        `Advisory store ${res.status === 'PARTIAL' ? 'partially refreshed' : 'refreshed'} from OSV.dev: ${res.queriedOk ?? res.queried}/${res.queried} package versions queried successfully, ${res.vulnerable} with known advisories (${res.fetched} advisory records fetched).`,
-        res.unsupported ? `${res.unsupported} packages skipped (ecosystem not OSV-queryable — supported: npm/PyPI/Go/Maven/crates.io).` : null,
-        res.errors?.length ? `Partial: ${res.errors.length} request error(s), first: ${res.errors[0]}` : null,
-        `Store: ${DEFAULT_STORE} (${meta.advisoryCount} advisories, fetched ${meta.fetchedAt}). run_audit now reflects it — offline.`,
-    ].filter(Boolean).join('\n')
-}

package/src/mcp/actions/graph-sync.mjs

@@ -1,195 +0,0 @@
-import {createHash} from 'node:crypto'
-import {readFileSync, statSync} from 'node:fs'
-import {graphStaleness} from '../graph-context.mjs'
-import {graphHomeDir, graphOutDirForRepo} from '../../graph/layout.js'
-import {registerRepository, repositoryRecord} from '../../graph/repo-registry.js'
-import {createSyncPayload, createSyncPayloadV3, MAX_SYNC_BODY_BYTES} from '../sync-payload.mjs'
-import {createEvidenceSnapshot} from '../evidence-snapshot.mjs'
-import {toolResult} from '../tool-result.mjs'
-
-const MAX_SYNC_GRAPH_FILE_BYTES = 64 * 1024 * 1024
-const SYNC_PREVIEW_TTL_MS = 5 * 60 * 1000
-const MAX_SYNC_PREVIEWS = 4
-const syncPreviews = new Map()
-
-function syncRepoLabel(repoRoot) {
-    const basename = String(repoRoot || '').replace(/[\\/]+$/, '').split(/[\\/]/).pop() || 'repo'
-    const safe = basename.normalize('NFKC').replace(/[^a-z0-9._-]+/gi, '-').replace(/^-+|-+$/g, '')
-    return (safe || 'repo').slice(0, 128)
-}
-
-export function syncDestination(raw) {
-    let url
-    try { url = new URL(raw) } catch { throw new Error('WEAVATRIX_SYNC_URL is invalid') }
-    if (!['http:', 'https:'].includes(url.protocol)) throw new Error('WEAVATRIX_SYNC_URL must use HTTPS (or HTTP for loopback development)')
-    if (url.username || url.password) throw new Error('WEAVATRIX_SYNC_URL must not contain embedded credentials; use WEAVATRIX_SYNC_TOKEN')
-    if (url.hash) throw new Error('WEAVATRIX_SYNC_URL must not contain a fragment')
-    const loopback = ['localhost', '127.0.0.1', '[::1]', '::1'].includes(url.hostname.toLowerCase())
-    if (url.protocol !== 'https:' && !loopback) throw new Error('WEAVATRIX_SYNC_URL must use HTTPS unless the destination is loopback')
-    const display = `${url.origin}${url.pathname}${url.search ? ' (query redacted)' : ''}`
-    return {url: url.toString(), display}
-}
-
-function pruneSyncPreviews(now = Date.now()) {
-    for (const [token, preview] of syncPreviews) if (preview.expiresAt <= now) syncPreviews.delete(token)
-    while (syncPreviews.size >= MAX_SYNC_PREVIEWS) syncPreviews.delete(syncPreviews.keys().next().value)
-}
-
-function confirmationToken({url, repositoryId, payloadVersion, bodyHash}) {
-    return createHash('sha256')
-        .update(`weavatrix-sync-preview-v1\0${url}\0${repositoryId}\0${payloadVersion}\0${bodyHash}`)
-        .digest('hex').slice(0, 24)
-}
-
-function syncSectionSummary(payload) {
-    if (payload.syncPayloadV !== 3) return 'graph topology only (explicit V2 compatibility mode)'
-    const sections = payload.evidence?.sections || {}
-    const names = Object.entries(sections).map(([name, section]) => `${name}:${section?.state || section?.verdict || 'included'}`)
-    return names.join(', ') || 'bounded architecture/health/stack/package/duplicate evidence'
-}
-
-function syncPreviewText(preview, {expired = false} = {}) {
-    return [
-        `SYNC PREVIEW${expired ? ' (the supplied confirmation was missing, expired, or did not match)' : ''} — no network request was made.`,
-        `Destination: ${preview.destinationDisplay}.`,
-        `Repository: ${preview.repoName}; opaque repository UUID: ${preview.repositoryId}.`,
-        `Payload V${preview.payload.syncPayloadV}: ${preview.payload.nodes.length} nodes / ${preview.payload.links.length} edges, ${Math.round(preview.bodyBytes / 1024)} KB; body SHA-256 ${preview.bodyHash.slice(0, 12)}.`,
-        `Payload fields: ${Object.keys(preview.payload).sort().join(', ')}.`,
-        `Included sections: ${syncSectionSummary(preview.payload)}.`,
-        'Excluded by the wire allowlist: source bodies, snippets, absolute host paths, environment values, credentials, Git remotes, and unknown fields.',
-        `After the user approves this exact destination and summary, call sync_graph again within 5 minutes with dry_run:false and confirm_token: "${preview.token}".`,
-    ].join('\n')
-}
-
-async function sendSyncPreview(preview, timeoutMs) {
-    try {
-        const res = await fetch(preview.url, {
-            method: 'POST',
-            headers: {
-                'content-type': 'application/json',
-                'x-weavatrix-payload-version': String(preview.payload.syncPayloadV),
-                'x-weavatrix-repo': preview.repoName,
-                'x-weavatrix-repository-id': preview.repositoryId,
-                ...(process.env.WEAVATRIX_SYNC_TOKEN ? {authorization: `Bearer ${process.env.WEAVATRIX_SYNC_TOKEN}`} : {}),
-            },
-            body: preview.body,
-            signal: AbortSignal.timeout(timeoutMs),
-        })
-        if (!res.ok) {
-            const accepted = res.headers?.get?.('x-weavatrix-accept-payload-versions')
-            const compatibility = (res.status === 415 || res.status === 422) && accepted
-                ? ` Endpoint accepts payload version(s) ${accepted}; create and approve a new V2 preview only if graph-only sync is intentional.`
-                : ''
-            return `Sync endpoint ${preview.destinationDisplay} answered HTTP ${res.status} — graph NOT accepted.${compatibility}`
-        }
-        syncPreviews.delete(preview.token)
-        const evidenceNote = preview.payload.syncPayloadV === 3
-            ? ` + evidence ${preview.payload.evidence?.snapshotHash?.slice(0, 12) || 'unknown'}`
-            : ''
-        return `Graph for ${preview.repoName} (${preview.payload.nodes.length} nodes / ${preview.payload.links.length} edges${evidenceNote}, ${Math.round(preview.bodyBytes / 1024)} KB) pushed to approved destination ${preview.destinationDisplay}.`
-    } catch (error) {
-        return `Sync failed: ${error.message} — the graph stays local; the approved preview remains retryable until it expires.`
-    }
-}
-
-async function buildSyncPreview(g, args, ctx) {
-    const configuredUrl = process.env.WEAVATRIX_SYNC_URL
-    if (!configuredUrl) {
-        return 'Graph sync is not configured (optional feature). Set WEAVATRIX_SYNC_URL to the upload endpoint'
-            + ' (and WEAVATRIX_SYNC_TOKEN for bearer auth) in the MCP registration env, then call again.'
-    }
-    let destination
-    try { destination = syncDestination(configuredUrl) }
-    catch (error) { return `Graph sync is not configured safely: ${error.message}.` }
-    if (!g) return 'No graph loaded — build one first (open_repo / rebuild_graph).'
-    let raw
-    try {
-        const size = statSync(ctx.graphPath).size
-        if (size > MAX_SYNC_GRAPH_FILE_BYTES) {
-            return `Cannot sync: graph.json is ${Math.ceil(size / 1024 / 1024)} MB; the local safety limit is ${MAX_SYNC_GRAPH_FILE_BYTES / 1024 / 1024} MB.`
-        }
-        raw = JSON.parse(readFileSync(ctx.graphPath, 'utf8'))
-    } catch (e) { return `Cannot read ${ctx.graphPath}: ${e.message}` }
-    const requestedVersion = Number(args.payload_version) === 2 ? 2 : 3
-    let payload
-    try {
-        if (requestedVersion === 2) {
-            payload = createSyncPayload(raw)
-        } else {
-            if (!ctx.repoRoot) return 'Cannot build evidence: no repository root is active.'
-            if (graphStaleness(ctx).stale) {
-                return 'Cannot sync evidence from a stale graph. Run rebuild_graph, then call sync_graph again.'
-            }
-            const evidence = await createEvidenceSnapshot({repoRoot: ctx.repoRoot, graph: raw})
-            payload = createSyncPayloadV3(raw, evidence)
-        }
-    } catch (e) {
-        return `Cannot sync: ${e.message}. Run rebuild_graph once before sync_graph.`
-    }
-    const body = JSON.stringify(payload)
-    const bodyBytes = Buffer.byteLength(body)
-    if (bodyBytes > MAX_SYNC_BODY_BYTES) {
-        return `Cannot sync: payload is ${Math.ceil(bodyBytes / 1024)} KB; the hosted safety limit is ${MAX_SYNC_BODY_BYTES / 1024} KB. Narrow the graph scope and rebuild before retrying.`
-    }
-    const repoName = syncRepoLabel(ctx.repoRoot)
-    const registry = repositoryRecord(ctx.repoRoot, graphHomeDir())
-        || registerRepository({repoPath: ctx.repoRoot, graphDir: graphOutDirForRepo(ctx.repoRoot), graphHome: graphHomeDir()})
-    const bodyHash = createHash('sha256').update(body).digest('hex')
-    const token = confirmationToken({url: destination.url, repositoryId: registry.repositoryId, payloadVersion: payload.syncPayloadV, bodyHash})
-    const preview = {
-        token, url: destination.url, destinationDisplay: destination.display,
-        graphPath: ctx.graphPath, repoName, repositoryId: registry.repositoryId,
-        payload, body, bodyBytes, bodyHash, expiresAt: Date.now() + SYNC_PREVIEW_TTL_MS,
-    }
-    syncPreviews.set(token, preview)
-    return preview
-}
-
-function previewResult(preview, {expired = false} = {}) {
-    if (typeof preview === 'string') return preview
-    return toolResult(syncPreviewText(preview, {expired}), {
-        status: 'PREVIEW_READY', networkRequestMade: false,
-        destination: preview.destinationDisplay, repository: preview.repoName,
-        repositoryId: preview.repositoryId, payloadVersion: preview.payload.syncPayloadV,
-        nodes: preview.payload.nodes.length, links: preview.payload.links.length,
-        bodyBytes: preview.bodyBytes, bodyHash: preview.bodyHash,
-        payloadFields: Object.keys(preview.payload).sort(), sections: syncSectionSummary(preview.payload),
-        expiresAt: new Date(preview.expiresAt).toISOString(), confirmToken: preview.token,
-    }, {completeness: {status: 'COMPLETE', reason: 'exact allowlisted payload serialized locally; no network request made'}})
-}
-
-// Build the exact upload body and approval token without any network request. Kept separate from the
-// mutating tool so safety layers and humans can approve a local preview without authorizing egress.
-export async function tPreviewSyncGraph(g, args, ctx) {
-    pruneSyncPreviews()
-    return previewResult(await buildSyncPreview(g, args, ctx))
-}
-
-// Push the exact payload previously approved through preview_sync. The old dry_run form remains a
-// compatibility alias for one release, but can never send unless dry_run:false and the token matches.
-export async function tSyncGraph(g, args, ctx) {
-    if (args.dry_run !== false) {
-        pruneSyncPreviews()
-        const preview = await buildSyncPreview(g, args, ctx)
-        if (typeof preview === 'string') return preview
-        const suppliedToken = String(args.confirm_token || '').trim()
-        const exact = suppliedToken && suppliedToken === preview.token
-        return `${syncPreviewText(preview, {expired: !!suppliedToken && !exact})}${exact ? '\nConfirmation token recognized, but dry_run is still true; no network request was made.' : ''}`
-    }
-    const configuredUrl = process.env.WEAVATRIX_SYNC_URL
-    if (!configuredUrl) return 'Graph sync is not configured (optional feature). Set WEAVATRIX_SYNC_URL first.'
-    let destination
-    try { destination = syncDestination(configuredUrl) }
-    catch (error) { return `Graph sync is not configured safely: ${error.message}.` }
-    pruneSyncPreviews()
-    const suppliedToken = String(args.confirm_token || '').trim()
-    const approved = suppliedToken ? syncPreviews.get(suppliedToken) : null
-    if (approved && approved.expiresAt > Date.now()
-        && approved.url === destination.url && approved.graphPath === ctx.graphPath) {
-        const timeoutMs = Math.min(120000, Math.max(1000, Number(args.timeout_ms) || 30000))
-        return sendSyncPreview(approved, timeoutMs)
-    }
-    const preview = await buildSyncPreview(g, args, ctx)
-    return typeof preview === 'string' ? preview : syncPreviewText(preview, {expired: true})
-}
-