witnora 0.13.0 → 0.13.2

package/dist/cli.js

@@ -37,6 +37,7 @@ import { importGenericEval, renderGenericEvalReport } from "./generic-eval.js";
 import { runDesignPartnerCommand } from "./design-partner-v02.js";
 import { runOnboard } from "./onboard.js";
 import { inspectRepository } from "./onboard.js";
+import { renderReleaseEvaluation, runReleaseEvaluation } from "./release-evaluation.js";
 import { runPrivateCapabilityDiscovery } from "./private-discovery.js";
 import { doctorCustomerGateway, initializeCustomerGateway, readManagedCustomerGatewayLogs, renderGatewayDoctor, renderManagedGatewayStatus, restartManagedCustomerGateway, runCustomerGateway, startManagedCustomerGateway, statusManagedCustomerGateway, stopManagedCustomerGateway, } from "./gateway.js";
 import { verifyEvidencePacketV02 } from "./evidence-v02.js";
@@ -158,6 +159,29 @@ else if (command === "onboard") {
         openBrowser: readBoolFlag("--no-browser") ? async () => { } : undefined,
     });
 }
+else if (command === "release") {
+    const action = process.argv[3] ?? "help";
+    if (action !== "evaluate")
+        throw new Error("Use witnora release evaluate --case <assurance-case-id>.");
+    const assuranceCaseId = readFlag("--case");
+    if (!assuranceCaseId)
+        throw new Error("--case <assurance-case-id> is required.");
+    const connection = await resolveConnection({
+        name: readFlag("--connection"),
+        server: readFlag("--server"),
+        projectId: readFlag("--project"),
+        apiKey: readFlag("--api-key"),
+    });
+    const result = await runReleaseEvaluation({
+        connection,
+        assuranceCaseId,
+        repository: readFlag("--repo") ?? process.cwd(),
+        outDir: readFlag("--out"),
+    });
+    process.stdout.write(renderReleaseEvaluation(result));
+    if (!result.passed)
+        process.exitCode = 1;
+}
 else if (command === "gateway") {
     const action = process.argv[3] ?? "help";
     if (action === "init") {

package/dist/command-help.js

@@ -1,6 +1,27 @@
 export function renderCommandHelp(command) {
     if (command === "sandbox" || command === "browser-adapter")
         return undefined;
+    if (command === "release")
+        return `Usage:
+  witnora release evaluate --case <assurance-case-id>
+
+Runs one allowlisted release-evaluation script already defined by this repository,
+writes a Witnora evidence bundle, and attaches it to the selected self-service
+release assurance case. Hosted configuration cannot supply executable commands.
+
+Script selection order:
+  witnora:release, evals:run, test:ci, test
+
+Options:
+  --case <id>             Self-service release assurance case (required)
+  --connection <name>    Saved Hosted connection
+  --repo <directory>     Agent repository (default: current directory)
+  --out <directory>      Evidence output directory
+  --server <url>         Hosted Witnora base URL
+  --project <id>         Hosted project ID
+  --api-key <key>        Project API key (prefer the saved connection or secret manager)
+  --help, -h             Show this help
+`;
     if (command === "discover")
         return `Usage:
   witnora discover [--connection <name>] [--repo <directory>]

package/dist/control-plane.js

@@ -100,6 +100,8 @@ export async function pushEvidenceToControlPlane(options) {
         schemaVersion: bundle.schemaVersion,
         runId: run.id,
     });
+    if (options.releaseAssuranceCaseId)
+        query.set("assuranceCaseId", options.releaseAssuranceCaseId);
     const evidence = await requestJson(request, `${projectUrl}/evidence?${query}`, {
         method: "POST",
         headers: { ...headers, "content-type": "application/json" },

package/dist/release-evaluation.js

@@ -0,0 +1,331 @@
+import { spawn } from "node:child_process";
+import { createHash, randomUUID } from "node:crypto";
+import { mkdir, readFile, writeFile } from "node:fs/promises";
+import { join, relative, resolve } from "node:path";
+import { withArtifactManifest } from "./artifact-manifest.js";
+import { buildEvidenceBundle } from "./bundle.js";
+import { collectCompanionArtifacts } from "./companion-artifacts.js";
+import { pushEvidenceToControlPlane } from "./control-plane.js";
+const RELEASE_SCRIPT_CANDIDATES = ["witnora:release", "evals:run", "test:ci", "test"];
+const DEFAULT_TIMEOUT_MS = 10 * 60 * 1000;
+const MAX_OUTPUT_BYTES = 1024 * 1024;
+export async function runReleaseEvaluation(options) {
+    const repository = resolve(options.repository ?? process.cwd());
+    const assuranceCase = await loadReleaseAssuranceCase(options.connection, options.assuranceCaseId, options.fetch ?? fetch);
+    assertEvaluatingSelfServiceCase(assuranceCase);
+    const script = await detectReleaseScript(repository);
+    const timeoutMs = normalizeTimeout(options.timeoutMs);
+    const executedAt = (options.now ?? (() => new Date()))();
+    const execution = await (options.runner ?? runNpmScript)({ repository, script, timeoutMs });
+    const outputDirectory = resolve(options.outDir ?? join(repository, ".witnora", "release", assuranceCase.id));
+    await mkdir(outputDirectory, { recursive: true });
+    const logPath = join(outputDirectory, "evaluation.log");
+    const evaluationArtifactPath = join(outputDirectory, "evaluation-output.json");
+    const evidencePath = join(outputDirectory, "agentcert-evidence.json");
+    await writeFile(logPath, renderEvaluationLog(script, execution), "utf8");
+    await writeFile(evaluationArtifactPath, `${JSON.stringify(renderEvaluationArtifact(script, execution), null, 2)}\n`, "utf8");
+    const result = releaseEvaluationResult({
+        assuranceCase,
+        script,
+        execution,
+        timestamp: executedAt.toISOString(),
+        runId: (options.randomId ?? randomUUID)(),
+        artifactPath: relative(repository, evaluationArtifactPath).replaceAll("\\", "/"),
+    });
+    let bundle = buildEvidenceBundle([result], assuranceCase.subject.name, assuranceCase.subject.kind);
+    bundle.runId = `witnora_release_${result.runId}`;
+    bundle.generatedAt = executedAt.toISOString();
+    const companions = await collectCompanionArtifacts(bundle, repository);
+    bundle = withArtifactManifest(bundle, companions.artifacts);
+    const evidenceBytes = new TextEncoder().encode(`${JSON.stringify(bundle, null, 2)}\n`);
+    await writeFile(evidencePath, evidenceBytes);
+    const hosted = await (options.push ?? pushEvidenceToControlPlane)({
+        baseUrl: options.connection.server,
+        projectId: options.connection.projectId,
+        apiKey: options.connection.apiKey,
+        bundle,
+        evidenceBytes,
+        fileName: "agentcert-evidence.json",
+        companionArtifacts: companions.artifacts,
+        skippedCompanionArtifacts: companions.skipped,
+        releaseAssuranceCaseId: assuranceCase.id,
+    });
+    return {
+        assuranceCaseId: assuranceCase.id,
+        script,
+        passed: execution.exitCode === 0 && !execution.timedOut,
+        exitCode: execution.exitCode,
+        timedOut: execution.timedOut,
+        evidencePath,
+        logPath,
+        hostedRunId: hosted.runId,
+        hostedEvidenceId: hosted.evidenceId,
+    };
+}
+export function renderReleaseEvaluation(outcome) {
+    const status = outcome.passed ? "PASSED" : "FAILED";
+    return [
+        `Release evaluation: ${status}`,
+        `Local script: npm run ${outcome.script}`,
+        `Evidence: ${outcome.evidencePath}`,
+        `Log: ${outcome.logPath}`,
+        `Hosted run: ${outcome.hostedRunId}`,
+        `Attached to release assurance case: ${outcome.assuranceCaseId}`,
+        outcome.passed
+            ? "Next: return to Release Assurance. Witnora will enable customer review after the attached evidence is verified."
+            : "Next: inspect the log, fix the failing evaluation, and run the same command again. The failed evidence remains part of the audit trail.",
+        "",
+    ].join("\n");
+}
+async function loadReleaseAssuranceCase(connection, caseId, request) {
+    const response = await request(`${connection.server.replace(/\/$/, "")}/v1/projects/${encodeURIComponent(connection.projectId)}/assurance-cases/${encodeURIComponent(caseId)}`, { headers: { authorization: `Bearer ${connection.apiKey}` } });
+    if (!response.ok) {
+        const body = await response.text();
+        let message = body || `HTTP ${response.status}`;
+        try {
+            const parsed = JSON.parse(body);
+            message = parsed.error ?? parsed.message ?? message;
+        }
+        catch {
+            // Preserve the plain response body.
+        }
+        throw new Error(`Could not load release assurance case ${caseId}: ${message}`);
+    }
+    const payload = await response.json();
+    if (!payload.assuranceCase)
+        throw new Error(`Release assurance case ${caseId} was not returned by Hosted.`);
+    return payload.assuranceCase;
+}
+function assertEvaluatingSelfServiceCase(assuranceCase) {
+    if (assuranceCase.engagement) {
+        throw new Error("This case is managed by an independent review engagement. Use the reviewer evidence workflow instead.");
+    }
+    if (assuranceCase.status !== "evaluating") {
+        throw new Error(`Release assurance case ${assuranceCase.id} is ${assuranceCase.status}, not evaluating.`);
+    }
+}
+async function detectReleaseScript(repository) {
+    let raw;
+    try {
+        raw = await readFile(join(repository, "package.json"), "utf8");
+    }
+    catch (error) {
+        if (error.code === "ENOENT") {
+            throw new Error("No package.json was found. Add a local `witnora:release` npm script that runs the repository's existing release evaluation.");
+        }
+        throw error;
+    }
+    let packageJson;
+    try {
+        packageJson = JSON.parse(raw);
+    }
+    catch {
+        throw new Error("package.json is not valid JSON.");
+    }
+    const script = RELEASE_SCRIPT_CANDIDATES.find((candidate) => typeof packageJson.scripts?.[candidate] === "string");
+    if (!script) {
+        throw new Error("No supported release evaluation script was found. Add `witnora:release`, or expose an existing `evals:run`, `test:ci`, or `test` npm script.");
+    }
+    return script;
+}
+async function runNpmScript(input) {
+    return new Promise((resolveRun, rejectRun) => {
+        const launch = buildReleaseEvaluationLaunch(input.script);
+        const child = spawn(launch.command, launch.arguments, {
+            cwd: input.repository,
+            detached: launch.detached,
+            shell: false,
+            windowsHide: true,
+            stdio: ["ignore", "pipe", "pipe"],
+        });
+        let stdout = "";
+        let stderr = "";
+        let timedOut = false;
+        let settled = false;
+        let forceTimer;
+        const finish = (result) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (forceTimer)
+                clearTimeout(forceTimer);
+            resolveRun(result);
+        };
+        const timer = setTimeout(() => {
+            timedOut = true;
+            terminateProcessTree(child.pid);
+            forceTimer = setTimeout(() => {
+                terminateProcessTree(child.pid, true);
+                finish({ exitCode: 1, stdout, stderr, timedOut: true });
+            }, 5_000);
+        }, input.timeoutMs);
+        child.stdout.on("data", (chunk) => { stdout = appendBounded(stdout, chunk); });
+        child.stderr.on("data", (chunk) => { stderr = appendBounded(stderr, chunk); });
+        child.once("error", (error) => {
+            if (settled)
+                return;
+            settled = true;
+            clearTimeout(timer);
+            if (forceTimer)
+                clearTimeout(forceTimer);
+            rejectRun(error);
+        });
+        child.once("close", (code) => {
+            finish({ exitCode: code ?? 1, stdout, stderr, timedOut });
+        });
+    });
+}
+export function buildReleaseEvaluationLaunch(script, platform = process.platform, env = process.env) {
+    if (!RELEASE_SCRIPT_CANDIDATES.includes(script)) {
+        throw new Error(`Unsupported release evaluation script: ${script}`);
+    }
+    if (platform === "win32") {
+        const command = env.ComSpec ?? env.COMSPEC;
+        if (!command) {
+            throw new Error("Windows command processor is unavailable because ComSpec is not set.");
+        }
+        return {
+            command,
+            arguments: ["/d", "/s", "/c", "npm.cmd", "run", script],
+            detached: false,
+        };
+    }
+    return {
+        command: "npm",
+        arguments: ["run", script],
+        detached: true,
+    };
+}
+function terminateProcessTree(pid, force = false) {
+    if (!pid)
+        return;
+    if (process.platform === "win32") {
+        const taskkill = spawn("taskkill", ["/pid", String(pid), "/t", "/f"], {
+            shell: false,
+            windowsHide: true,
+            stdio: "ignore",
+        });
+        taskkill.on("error", () => undefined);
+        return;
+    }
+    try {
+        process.kill(-pid, force ? "SIGKILL" : "SIGTERM");
+    }
+    catch {
+        // The process may have exited between the timeout and termination attempt.
+    }
+}
+function appendBounded(current, chunk) {
+    if (Buffer.byteLength(current) >= MAX_OUTPUT_BYTES)
+        return current;
+    const remaining = MAX_OUTPUT_BYTES - Buffer.byteLength(current);
+    return current + chunk.subarray(0, remaining).toString("utf8");
+}
+function normalizeTimeout(value) {
+    const timeout = value ?? DEFAULT_TIMEOUT_MS;
+    if (!Number.isSafeInteger(timeout) || timeout < 1_000 || timeout > 30 * 60 * 1000) {
+        throw new Error("Release evaluation timeout must be between 1 second and 30 minutes.");
+    }
+    return timeout;
+}
+function renderEvaluationLog(script, result) {
+    return [
+        `command=npm run ${script}`,
+        `exitCode=${result.exitCode}`,
+        `timedOut=${result.timedOut}`,
+        "",
+        "[stdout]",
+        result.stdout,
+        "",
+        "[stderr]",
+        result.stderr,
+        "",
+    ].join("\n");
+}
+function renderEvaluationArtifact(script, result) {
+    const stdout = redactEvaluationOutput(result.stdout);
+    const stderr = redactEvaluationOutput(result.stderr);
+    return {
+        schemaVersion: "witnora.release_evaluation_output.v0.1",
+        command: { executable: "npm", arguments: ["run", script] },
+        exitCode: result.exitCode,
+        timedOut: result.timedOut,
+        stdout: outputDescriptor(result.stdout, stdout.value),
+        stderr: outputDescriptor(result.stderr, stderr.value),
+        redaction: {
+            policyVersion: "witnora.release_output_redaction.v0.1",
+            replacements: stdout.replacements + stderr.replacements,
+            rawOutputRetainedLocally: true,
+        },
+    };
+}
+function outputDescriptor(raw, redacted) {
+    return {
+        sha256: createHash("sha256").update(raw).digest("hex"),
+        byteLength: Buffer.byteLength(raw),
+        excerpt: redacted,
+    };
+}
+function redactEvaluationOutput(value) {
+    const patterns = [
+        /\bsk-(?:proj-|live_|test_)?[A-Za-z0-9_-]{16,}\b/g,
+        /\brk_(?:live|test)_[A-Za-z0-9]{12,}\b/g,
+        /\bnpm_[A-Za-z0-9]{16,}\b/g,
+        /\bac_(?:live|test)_[A-Za-z0-9_-]{12,}\b/g,
+        /\bBearer\s+[A-Za-z0-9._~+/=-]{12,}\b/gi,
+    ];
+    let redacted = value;
+    let replacements = 0;
+    for (const pattern of patterns) {
+        redacted = redacted.replace(pattern, () => {
+            replacements += 1;
+            return "[REDACTED_SECRET]";
+        });
+    }
+    return { value: redacted, replacements };
+}
+function releaseEvaluationResult(input) {
+    const passed = input.execution.exitCode === 0 && !input.execution.timedOut;
+    return {
+        schemaVersion: "1",
+        product: "agentcert-cli",
+        runId: input.runId,
+        timestamp: input.timestamp,
+        phase: "pre-release",
+        score: passed ? 100 : 0,
+        passed,
+        summary: passed
+            ? `The repository's existing ${input.script} evaluation completed successfully.`
+            : `The repository's existing ${input.script} evaluation failed${input.execution.timedOut ? " after timing out" : ""}.`,
+        evidenceStrength: {
+            schemaVersion: "agentcert.evidence_strength.v0.1",
+            level: "reported",
+            claims: ["A customer-owned repository evaluation produced a captured process result."],
+            limitations: ["This local command result is not independent outcome verification or an independent Witnora review."],
+            trustVector: {
+                schemaVersion: "witnora.evidence_trust_vector.v0.1",
+                capture: "self_reported",
+                mediation: "none",
+                outcome: "unverified",
+                completeness: "partial",
+                attestation: "unsigned",
+                review: "none",
+                limitations: ["The repository controls the evaluated script and its reported outcome."],
+            },
+        },
+        artifacts: { evaluationOutput: input.artifactPath },
+        evidence: [{
+                id: `release-evaluation-${input.runId}`,
+                kind: "release_evaluation",
+                severity: passed ? "info" : "high",
+                message: passed
+                    ? `npm run ${input.script} completed with exit code 0.`
+                    : `npm run ${input.script} completed with exit code ${input.execution.exitCode}${input.execution.timedOut ? " after timing out" : ""}.`,
+                source: "witnora-cli",
+                artifactPath: input.artifactPath,
+                suggestedFix: passed ? undefined : "Inspect the complete local evaluation log and the uploaded redacted summary, correct the failure, and rerun this release evaluation.",
+                metadata: { assuranceCaseId: input.assuranceCase.id, script: input.script, timedOut: input.execution.timedOut },
+            }],
+    };
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "witnora",
-  "version": "0.13.0",
+  "version": "0.13.2",
   "description": "Independent assurance for covered agent action paths across models and frameworks.",
   "type": "module",
   "license": "Apache-2.0",