platformforge 0.1.0__py3-none-any.whl

platformforge/rtk/parsers.py

@@ -0,0 +1,199 @@
+"""RTK parsers — one function per command family + a structured fallback.
+
+Each parser returns dict fragments merged into CompactResult. Contract:
+never lose error codes, resource ids, file:line, exit status, security
+warnings, failed assertions.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from typing import Any
+
+ERR_RE = re.compile(r"(?i)\b(error|fatal|panic|failed|FAIL(?:ED)?|denied|"
+                    r"forbidden|unauthorized|timeout)\b")
+WARN_RE = re.compile(r"(?i)\b(warn(?:ing)?|deprecated|caution)\b")
+FILELINE_RE = re.compile(r"([\w./\-]+\.\w+):(\d+)(?::(\d+))?")
+RESOURCE_RE = re.compile(r"\b((?:arn:aws:[\w\-]+:[\w\-]*:\d*:[\w/=+,.@-]+)|"
+                         r"(?:[a-z0-9\-]+\.)?[a-z0-9\-]+\.[a-z0-9\-_]+)\b")
+
+
+def _grep_lines(lines: list[str], rx: re.Pattern) -> list[str]:
+    return [l for l in lines if rx.search(l)]
+
+
+def _fileline(text: str) -> dict[str, Any] | None:
+    m = FILELINE_RE.search(text)
+    if not m:
+        return None
+    return {"file": m.group(1), "line": int(m.group(2)),
+            "col": int(m.group(3)) if m.group(3) else None}
+
+
+def fallback(lines: list[str], **_kw) -> dict[str, Any]:
+    errors = _grep_lines(lines, ERR_RE)
+    warnings = _grep_lines(lines, WARN_RE)
+    errs = []
+    for e in errors[:100]:
+        entry: dict[str, Any] = {"line": e.strip()}
+        if fl := _fileline(e):
+            entry.update(fl)
+        errs.append(entry)
+    return {
+        "summary": {"lines": len(lines)},
+        "errors": errs,
+        "warnings": [w.strip() for w in warnings[:50]],
+    }
+
+
+def git_status(lines: list[str], **_kw) -> dict[str, Any]:
+    staged = [l[3:] for l in lines if l[:1] in "MADR" and l[1:2] == " "]
+    unstaged = [l[3:] for l in lines if len(l) > 2 and l[1] in "MD"]
+    untracked = [l[3:] for l in lines if l.startswith("??")]
+    return {"summary": {"staged": len(staged), "unstaged": len(unstaged),
+                        "untracked": len(untracked)},
+            "changed": staged + unstaged + untracked}
+
+
+def git_diff(lines: list[str], **_kw) -> dict[str, Any]:
+    files = [l.split(" b/")[-1] for l in lines if l.startswith("diff --git")]
+    adds = sum(1 for l in lines if l.startswith("+") and not l.startswith("+++"))
+    dels = sum(1 for l in lines if l.startswith("-") and not l.startswith("---"))
+    return {"summary": {"files_changed": len(files), "added": adds,
+                        "removed": dels}, "changed": files}
+
+
+def git_log(lines: list[str], **_kw) -> dict[str, Any]:
+    commits = [l.split()[1] for l in lines if l.startswith("commit ")]
+    return {"summary": {"commits": len(commits)}, "interesting": commits[:20]}
+
+
+_PYTEST_SUM = re.compile(r"=+\s*(.*?)\s*=+\s*$")
+_PYTEST_FAIL = re.compile(r"^(FAILED|ERROR)\s+(\S+)(?:\s+-\s+(.*))?$")
+
+
+def pytest(lines: list[str], **_kw) -> dict[str, Any]:
+    summary_line = next((m.group(1) for l in reversed(lines)
+                         if (m := _PYTEST_SUM.match(l.strip()))), "")
+    failures = [{"test": m.group(2), "reason": m.group(3) or ""}
+                for l in lines if (m := _PYTEST_FAIL.match(l.strip()))]
+    return {"summary": {"result": summary_line},
+            "errors": [f["test"] for f in failures],
+            "interesting": failures}
+
+
+_TF_PLAN = re.compile(r"Plan:\s*(\d+)\s*to add,\s*(\d+)\s*to change,\s*(\d+)\s*to destroy")
+_TF_RES = re.compile(r"#\s+([\w.\[\]\"-]+)\s+(will be|must be|is)\s+([\w-]+)")
+
+
+def terraform_plan(lines: list[str], **_kw) -> dict[str, Any]:
+    m = next((x for l in reversed(lines) if (x := _TF_PLAN.search(l))), None)
+    summary = ({"add": int(m.group(1)), "change": int(m.group(2)),
+                "destroy": int(m.group(3))} if m else {})
+    changed = [f"{m.group(1)} {m.group(3)}" for l in lines
+               if (m := _TF_RES.search(l))]
+    errors = _grep_lines(lines, ERR_RE)
+    return {"summary": summary, "changed": changed[:200],
+            "errors": [e.strip() for e in errors[:50]],
+            "warnings": [w.strip() for w in _grep_lines(lines, WARN_RE)[:50]]}
+
+
+def terraform_validate(lines: list[str], **_kw) -> dict[str, Any]:
+    errors = [l.strip() for l in lines if "Error:" in l]
+    return {"summary": {"valid": not errors},
+            "errors": errors[:50]}
+
+
+def kubectl_get(lines: list[str], **_kw) -> dict[str, Any]:
+    header = lines[0] if lines else ""
+    rows = [l.split() for l in lines[1:] if l.strip()]
+    not_ready = [r[0] for r in rows if len(r) > 1 and
+                 re.search(r"0/|CrashLoop|Error|Pending|ImagePull|Evicted", " ".join(r))]
+    return {"summary": {"header": header.strip(), "objects": len(rows),
+                        "not_ready": len(not_ready)},
+            "interesting": not_ready[:100]}
+
+
+def kubectl_describe(lines: list[str], **_kw) -> dict[str, Any]:
+    warnings = [l.strip() for l in lines if re.search(r"(?i)\bWarning\b", l)]
+    reasons = re.findall(r"Reason:\s*(\w+)", "\n".join(lines))
+    return {"summary": {"reasons": sorted(set(reasons))},
+            "warnings": warnings[:100],
+            "errors": [e.strip() for e in _grep_lines(lines, ERR_RE)[:50]]}
+
+
+def kubectl_logs(lines: list[str], **_kw) -> dict[str, Any]:
+    errors = _grep_lines(lines, ERR_RE)
+    exceptions = [l.strip() for l in lines
+                  if re.search(r"(Traceback|Exception|panic:|FATAL)", l)]
+    return {"summary": {"lines": len(lines)},
+            "errors": [e.strip() for e in (exceptions + errors)[:100]]}
+
+
+def trivy(lines: list[str], **_kw) -> dict[str, Any]:
+    counts = dict(re.findall(r"(CRITICAL|HIGH|MEDIUM|LOW|UNKNOWN):\s*(\d+)",
+                             "\n".join(lines)))
+    cves = re.findall(r"\b(CVE-\d{4}-\d{4,7})\b", "\n".join(lines))
+    return {"summary": {"severities": {k: int(v) for k, v in counts.items()},
+                        "unique_cves": len(set(cves))},
+            "interesting": sorted(set(cves))[:200]}
+
+
+def checkov(lines: list[str], **_kw) -> dict[str, Any]:
+    failed = [l.strip() for l in lines if "FAILED" in l]
+    passed = sum(1 for l in lines if "PASSED" in l)
+    return {"summary": {"passed": passed, "failed": len(failed)},
+            "errors": failed[:200]}
+
+
+def go_test(lines: list[str], **_kw) -> dict[str, Any]:
+    fails = [l.strip() for l in lines if l.startswith(("FAIL", "--- FAIL"))]
+    ok = sum(1 for l in lines if l.startswith("ok "))
+    return {"summary": {"packages_ok": ok, "failed": len(fails)},
+            "errors": fails[:100]}
+
+
+def npm_out(lines: list[str], **_kw) -> dict[str, Any]:
+    errs = _grep_lines(lines, re.compile(r"npm error|ERR!"))
+    vulns = re.search(r"(\d+) vulnerabilities", "\n".join(lines))
+    return {"summary": {"vulnerabilities": int(vulns.group(1)) if vulns else 0},
+            "errors": [e.strip() for e in errs[:100]]}
+
+
+def json_kv(lines: list[str], **_kw) -> dict[str, Any]:
+    """Generic JSON output: summarize shape + errors keys."""
+    try:
+        doc = json.loads("\n".join(lines))
+    except json.JSONDecodeError:
+        return fallback(lines)
+    summary = {"type": type(doc).__name__}
+    if isinstance(doc, list):
+        summary["items"] = len(doc)
+    elif isinstance(doc, dict):
+        summary["keys"] = list(doc)[:50]
+        for k in ("error", "errors", "Error", "message"):
+            if k in doc:
+                summary.setdefault("error_keys", []).append(k)
+    return {"summary": summary}
+
+
+PARSERS = {
+    "git status": git_status, "git diff": git_diff, "git log": git_log,
+    "git show": git_diff,
+    "pytest": pytest, "py.test": pytest, "python -m pytest": pytest,
+    "go test": go_test,
+    "terraform plan": terraform_plan, "tofu plan": terraform_plan,
+    "terraform validate": terraform_validate, "tofu validate": terraform_validate,
+    "terraform show": fallback, "tofu show": fallback,
+    "kubectl get": kubectl_get, "kubectl describe": kubectl_describe,
+    "kubectl logs": kubectl_logs, "kubectl events": kubectl_describe,
+    "kubectl diff": git_diff,
+    "helm template": fallback, "helm diff": git_diff,
+    "kustomize build": fallback,
+    "argocd app get": kubectl_describe, "argocd app diff": git_diff,
+    "docker": fallback, "podman": fallback,
+    "trivy": trivy, "checkov": checkov,
+    "npm": npm_out, "pnpm": npm_out, "mvn": fallback, "gradle": fallback,
+    "aws": json_kv, "az": json_kv, "gcloud": json_kv,
+}

platformforge/rules/__init__.py

@@ -0,0 +1,5 @@
+"""Executable rule catalog — conditions evaluate over facts, never decorative YAML."""
+
+from platformforge.rules.engine import Rule, RuleEngine, load_catalog
+
+__all__ = ["Rule", "RuleEngine", "load_catalog"]

platformforge/rules/engine.py

@@ -0,0 +1,345 @@
+"""Executable rules over facts.
+
+A rule = applicability + conditions over fact attrs. Conditions support a
+closed operator vocabulary; anything unparseable fails loudly at catalog load,
+not silently at judge time.
+"""
+
+from __future__ import annotations
+
+import re
+from collections.abc import Iterable
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+import yaml
+
+from platformforge.models import Fact, Finding
+
+OPS = {
+    "absent", "present", "equals", "not_equals", "gt", "gte", "lt", "lte",
+    "contains", "not_contains", "matches", "in", "empty", "not_empty",
+}
+
+
+def _parse_version(v: str) -> tuple[int, ...]:
+    parts = re.findall(r"\d+", str(v))
+    return tuple(int(p) for p in parts) if parts else ()
+
+
+def _validate_constraint(rule_id: str, component: str,
+                         constraint: Any) -> None:
+    """Fail loudly on vacuous/garbage version constraints — a malformed
+    constraint must never silently produce a strong verdict."""
+    if not isinstance(constraint, str) or not constraint.strip():
+        raise ValueError(
+            f"{rule_id}: versions.{component} must be a non-empty "
+            f"constraint string, got {constraint!r}")
+    parsed = 0
+    for cond in constraint.split():
+        m = re.match(r"(>=|<=|==|!=|>|<)?(.+)", cond)
+        if not m or not m.group(2).strip():
+            raise ValueError(
+                f"{rule_id}: malformed version constraint "
+                f"{constraint!r} (token {cond!r})")
+        if not _parse_version(m.group(2)):
+            raise ValueError(
+                f"{rule_id}: unparseable version operand "
+                f"{m.group(2)!r} in {constraint!r}")
+        parsed += 1
+    if not parsed:
+        raise ValueError(
+            f"{rule_id}: vacuous version constraint {constraint!r}")
+
+
+def version_satisfies(version: str | None, constraint: str | None) -> bool | None:
+    """True/False when decidable, None when version unknown."""
+    if not constraint:
+        return True
+    if not version:
+        return None
+    have = _parse_version(version)
+    if not have:
+        return None
+    for cond in str(constraint).split():
+        m = re.match(r"(>=|<=|==|!=|>|<)?\s*(.+)", cond)
+        if not m:
+            continue
+        op, want_s = m.group(1) or "==", m.group(2)
+        want = _parse_version(want_s)
+        n = max(len(have), len(want))
+        a, b = have + (0,) * (n - len(have)), want + (0,) * (n - len(want))
+        ok = {
+            "==": a == b, "!=": a != b, ">=": a >= b,
+            "<=": a <= b, ">": a > b, "<": a < b,
+        }[op]
+        if not ok:
+            return False
+    return True
+
+
+def _values_at(obj: Any, path: str) -> list[Any]:
+    """Resolve `a.b[*].c` over dicts/lists → list of candidate values.
+    Missing keys yield [MISSING]."""
+    nodes = [obj]
+    for part in path.split("."):
+        nxt: list[Any] = []
+        many = part.endswith("[*]")
+        key = part[:-3] if many else part
+        for node in nodes:
+            if isinstance(node, dict):
+                node = node.get(key, MISSING)
+            else:
+                node = MISSING
+            if many and isinstance(node, list):
+                nxt.extend(node)
+            else:
+                nxt.append(node)
+        nodes = nxt
+    return nodes
+
+
+class _Missing:
+    def __repr__(self) -> str:  # pragma: no cover
+        return "<missing>"
+
+
+MISSING = _Missing()
+
+
+def _eval_op(value: Any, op: str, expected: Any = None) -> bool:
+    if op == "absent":
+        return value is MISSING or value is None
+    if op == "present":
+        return value is not MISSING and value is not None
+    if value is MISSING:
+        return False
+    if op == "equals":
+        return value == expected
+    if op == "not_equals":
+        return value != expected
+    if op == "gt":
+        return _num(value) is not None and _num(value) > _num(expected)
+    if op == "gte":
+        return _num(value) is not None and _num(value) >= _num(expected)
+    if op == "lt":
+        return _num(value) is not None and _num(value) < _num(expected)
+    if op == "lte":
+        return _num(value) is not None and _num(value) <= _num(expected)
+    if op == "contains":
+        return expected in value if isinstance(value, (list, dict, str)) else False
+    if op == "not_contains":
+        return expected not in value if isinstance(value, (list, dict, str)) else True
+    if op == "matches":
+        return bool(re.search(str(expected), str(value)))
+    if op == "in":
+        return value in (expected or [])
+    if op == "empty":
+        return value in ("", [], {}, None)
+    if op == "not_empty":
+        return value not in ("", [], {}, None)
+    raise ValueError(f"unknown op: {op}")
+
+
+def _num(v: Any) -> float | None:
+    try:
+        return float(v)
+    except (TypeError, ValueError):
+        return None
+
+
+@dataclass
+class Rule:
+    rule_id: str
+    title: str
+    domain: str
+    severity: str
+    conditions: dict[str, Any]          # {"all": [...], "any": [...], "none": [...]}
+    applies_to: dict[str, Any] = field(default_factory=dict)  # {fact_kind: ...}
+    versions: dict[str, str] = field(default_factory=dict)
+    scope: str = "fact"                 # fact | aggregate
+    evidence_requirements: list[str] = field(default_factory=list)
+    sources: list[str] = field(default_factory=list)      # canonical registry ids
+    source_refs: dict[str, str] = field(default_factory=dict)  # id → doc path/anchor
+    action: dict[str, Any] = field(default_factory=dict)
+    message: str = ""
+    enabled: bool = True
+
+    @classmethod
+    def from_dict(cls, d: dict[str, Any]) -> Rule:
+        conds = d.get("conditions", {})
+        for group in ("all", "any", "none"):
+            for pred in conds.get(group, []) or []:
+                if pred.get("op") not in OPS:
+                    raise ValueError(
+                        f"{d.get('rule_id')}: unknown op {pred.get('op')!r} "
+                        f"(allowed: {sorted(OPS)})"
+                    )
+        for comp, cons in (d.get("versions") or {}).items():
+            _validate_constraint(d.get("rule_id", "?"), comp, cons)
+        return cls(
+            rule_id=d["rule_id"], title=d.get("title", ""), domain=d.get("domain", ""),
+            severity=d.get("severity", "medium"), conditions=conds,
+            applies_to=d.get("applies_to", {}), versions=d.get("versions", {}),
+            scope=d.get("scope", "fact"),
+            evidence_requirements=d.get("evidence_requirements", []),
+            sources=d.get("sources", []),
+            source_refs=d.get("source_refs", {}) or {},
+            action=d.get("action", {}),
+            message=d.get("message", ""), enabled=d.get("enabled", True),
+        )
+
+
+def load_catalog(*dirs: str | Path) -> list[Rule]:
+    """Load all rule YAML files from catalog dirs (sorted → deterministic).
+    Missing dirs warn (a silent empty catalog masks packaging bugs);
+    duplicate rule_ids are rejected — two rules sharing an id could emit
+    contradictory verdicts for the same check."""
+    import warnings
+    rules: list[Rule] = []
+    seen: set[str] = set()
+    for d in dirs:
+        p = Path(d)
+        if not p.is_dir():
+            warnings.warn(f"catalog dir missing: {p}", stacklevel=2)
+            continue
+        for f in sorted(p.rglob("*.yaml")) + sorted(p.rglob("*.yml")):
+            doc = yaml.safe_load(f.read_text()) or {}
+            for entry in doc.get("rules", doc if isinstance(doc, list) else []):
+                rid = entry.get("rule_id")
+                if rid in seen:
+                    raise ValueError(f"duplicate rule_id {rid!r} ({f})")
+                seen.add(rid)
+                rules.append(Rule.from_dict(entry))
+    return rules
+
+
+def catalog_provenance_report(*dirs: str | Path) -> dict[str, Any]:
+    """§10 — every rule must name at least one dated source. Reports
+    coverage; a rule without sources is not skipped but is flagged as
+    unverifiable until linked."""
+    rules = load_catalog(*dirs)
+    missing = [r.rule_id for r in rules if not r.sources]
+    return {"total": len(rules), "with_sources": len(rules) - len(missing),
+            "missing_sources": sorted(missing),
+            "coverage": (len(rules) - len(missing)) / len(rules) if rules else 1.0}
+
+
+class RuleEngine:
+    def __init__(self, rules: Iterable[Rule], versions: dict[str, str] | None = None):
+        self.rules = [r for r in rules if r.enabled]
+        self.versions = versions or {}
+
+    def _version_gate(self, rule: Rule) -> tuple[str, list[dict[str, Any]]]:
+        """→ (state, requirements) — state ∈ {decidable, unresolved, incompatible}.
+
+        - decidable: every required version known and satisfying (or the rule
+          has no version requirements) → normal passed/violated verdicts.
+        - incompatible: a required version is known and violates the
+          constraint → explicit ``version-mismatch`` skip (auditable, never
+          silent).
+        - unresolved: ≥1 required version unknown → ``unresolved`` findings
+          carrying refusal metadata; the rule must never emit a strong
+          verdict without its required version.
+        """
+        reqs: list[dict[str, Any]] = []
+        state = "decidable"
+        for product, constraint in rule.versions.items():
+            declared = self.versions.get(product)
+            reqs.append({"product": product, "constraint": constraint,
+                         "declared": declared})
+            sat = version_satisfies(declared, constraint)
+            if sat is False:
+                return "incompatible", reqs
+            if sat is None:
+                state = "unresolved"
+        return state, reqs
+
+    def _eval_predicates(self, fact: Fact, conds: dict[str, Any]) -> bool:
+        doc = {"kind": fact.kind, "source": fact.source, "location": fact.location,
+               "tier": int(fact.tier), "observed": fact.observed,
+               "attrs": fact.attrs, "measures": fact.measures}
+
+        def pred_ok(p: dict[str, Any]) -> bool:
+            values = _values_at(doc, p["path"])
+            # quantifier: exists (default) — any candidate satisfies
+            if p.get("quantifier") == "for_all":
+                return bool(values) and all(
+                    _eval_op(v, p["op"], p.get("value")) for v in values)
+            return any(_eval_op(v, p["op"], p.get("value")) for v in values)
+
+        all_ok = all(pred_ok(p) for p in conds.get("all", []) or [])
+        any_list = conds.get("any", []) or []
+        any_ok = (any(pred_ok(p) for p in any_list)) if any_list else True
+        none_ok = not any(pred_ok(p) for p in conds.get("none", []) or [])
+        return all_ok and any_ok and none_ok
+
+    def evaluate(self, facts: list[Fact]) -> tuple[list[Finding], list[dict[str, Any]]]:
+        """→ (findings, skipped) — skipped rules carry reason, not silence."""
+        findings: list[Finding] = []
+        skipped: list[dict[str, Any]] = []
+        for rule in self.rules:
+            state, reqs = self._version_gate(rule)
+            if state == "incompatible":
+                skipped.append({"rule_id": rule.rule_id,
+                                "reason": "version-mismatch",
+                                "requirements": reqs})
+                continue
+            if rule.scope == "aggregate":
+                skipped.append({"rule_id": rule.rule_id,
+                                "reason": "aggregate-scope-not-implemented"})
+                continue
+            spec = rule.applies_to
+            kinds = spec.get("fact_kind")
+            kinds = [kinds] if isinstance(kinds, str) else (kinds or [])
+            prefix = spec.get("fact_kind_prefix")
+            targets = [f for f in facts
+                       if (not kinds or f.kind in kinds)
+                       and (not prefix or f.kind.startswith(prefix))]
+            if (kinds or prefix) and not targets:
+                skipped.append({"rule_id": rule.rule_id,
+                                "reason": f"no facts of kind "
+                                          f"{kinds or prefix}",
+                                "version_state": state})
+            if state == "unresolved":
+                unres = [r for r in reqs if version_satisfies(
+                    r["declared"], r["constraint"]) is None]
+                for fact in targets:
+                    primary = unres[0] if unres else reqs[0]
+                    attrs = dict(rule.action)
+                    attrs["refusal_code"] = "platform.version.unresolved"
+                    attrs["required_version"] = primary["product"]
+                    attrs["constraint"] = primary["constraint"]
+                    attrs["requirements"] = reqs
+                    attrs["unlock"] = (
+                        f"declare the {primary['product']} version "
+                        f"(e.g. --versions '{{\"{primary['product']}\": "
+                        f"\"x.y.z\"}}')")
+                    if rule.sources:
+                        attrs["sources"] = list(rule.sources)
+                    if rule.source_refs:
+                        attrs["source_refs"] = dict(rule.source_refs)
+                    findings.append(Finding(
+                        rule_id=rule.rule_id, severity=rule.severity,
+                        status="unresolved", evidence=[fact.fact_id],
+                        title=rule.title,
+                        message=rule.message or rule.title,
+                        location=fact.location, attrs=attrs,
+                    ))
+                continue
+            for fact in targets:
+                violated = self._eval_predicates(fact, rule.conditions)
+                status = "violated" if violated else "passed"
+                attrs = dict(rule.action)
+                if rule.sources:
+                    attrs["sources"] = list(rule.sources)
+                if rule.source_refs:
+                    attrs["source_refs"] = dict(rule.source_refs)
+                findings.append(Finding(
+                    rule_id=rule.rule_id, severity=rule.severity, status=status,
+                    evidence=[fact.fact_id], title=rule.title,
+                    message=rule.message or rule.title,
+                    location=fact.location, attrs=attrs,
+                ))
+        return findings, skipped

platformforge/sandbox/__init__.py

@@ -0,0 +1,7 @@
+"""Sandbox — §86. Copy tree → apply diff → analyze before/after → compare.
+Never mutates the original tree."""
+
+from platformforge.sandbox.env import Sandbox, compare_runs, sandbox_analyze
+from platformforge.sandbox.review import review_change
+
+__all__ = ["Sandbox", "compare_runs", "review_change", "sandbox_analyze"]