📦 deps(thirdparty): update snapshots

2026-06-18 16:04:36 +00:00
parent 71b421806e
commit dd4c084042
416 changed files with 35467 additions and 3065 deletions
@@ -8,12 +8,12 @@

 import assert from "node:assert/strict";
 import { execFileSync } from "node:child_process";
-import { writeFileSync, mkdtempSync, rmSync } from "node:fs";
+import { readFileSync, writeFileSync, mkdtempSync, rmSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 import path from "node:path";
 import os from "node:os";
 import { assembleSystemPrompt, VALID_MODES } from "./assemble-prompt.mjs";
-import { readHistory, appendHistory, getTrend } from "./history.mjs";
+import { readHistory, appendHistory, getTrend, normalizeMode, sparkline, renderHistory } from "./history.mjs";
 import {
  parseFrontmatterBooks,
  countBookSections,
@@ -23,6 +23,10 @@ import {
  extractGuideStepLabels,
 } from "./frontmatter.mjs";
 import { extractRiskCodes, classify } from "./eval-utils.mjs";
+import { parseFindings, countFindings, extractLocation } from "./report-parse.mjs";
+import { reportToSarif } from "./sarif.mjs";
+import { severityBreached, isRegression } from "./ci-gate.mjs";
+import { summarize } from "./benchmark.mjs";

 const __dirname = path.dirname(fileURLToPath(import.meta.url));

@@ -371,6 +375,76 @@ test("ignores records for other modes", () => {
  assert.equal(trend.runCount, 2);
 });

+test("matches a canonical query against display-name records", () => {
+  // Regression: ci-review.mjs queries with the canonical mode ("review") while
+  // records written by the model are stored as display names ("PR Review").
+  const history = [{ mode: "PR Review", score: 88 }];
+  const trend = getTrend(history, "review");
+  assert.equal(trend.lastScore, 88);
+  assert.equal(trend.runCount, 1);
+});
+
+// ── normalizeMode ────────────────────────────────────────────────────────────
+
+console.log("\nnormalizeMode");
+
+test("maps display names to canonical modes", () => {
+  assert.equal(normalizeMode("PR Review"), "review");
+  assert.equal(normalizeMode("Architecture Audit"), "audit");
+  assert.equal(normalizeMode("Tech Debt Assessment"), "debt");
+  assert.equal(normalizeMode("Full Sweep"), "sweep");
+});
+
+test("passes canonical names through unchanged", () => {
+  assert.equal(normalizeMode("review"), "review");
+  assert.equal(normalizeMode("health"), "health");
+});
+
+test("is case- and whitespace-insensitive", () => {
+  assert.equal(normalizeMode("  pr review  "), "review");
+});
+
+test("passes non-string input through unchanged", () => {
+  assert.equal(normalizeMode(undefined), undefined);
+});
+
+// ── sparkline ────────────────────────────────────────────────────────────────
+
+console.log("\nsparkline");
+
+test("maps score extremes to the lowest and highest bars", () => {
+  assert.equal(sparkline([0]), "▁");
+  assert.equal(sparkline([100]), "█");
+});
+
+test("renders one bar per score and clamps out-of-range values", () => {
+  assert.equal(sparkline([0, 50, 100]).length, 3);
+  assert.equal(sparkline([150]), "█");
+  assert.equal(sparkline([-10]), "▁");
+});
+
+// ── renderHistory ────────────────────────────────────────────────────────────
+
+console.log("\nrenderHistory");
+
+test("reports no history for an empty array", () => {
+  assert.equal(renderHistory([]), "No history found.");
+});
+
+test("summarizes a single record as one run", () => {
+  const out = renderHistory([{ mode: "PR Review", score: 88 }]);
+  assert.match(out, /review/);
+  assert.match(out, /1 run/);
+});
+
+test("collapses display-name and canonical records into one mode line", () => {
+  const out = renderHistory([
+    { mode: "PR Review", score: 70 },
+    { mode: "review", score: 90 },
+  ]);
+  assert.match(out, /\+20 over 2 runs/);
+});
+
 // ── extractRiskCodes ───────────────────────────────────────────────────────

 console.log("\nextractRiskCodes");
@@ -441,6 +515,294 @@ test("returns 'fail' when codes found but Iron Law terms absent", () => {
  assert.equal(classify(scenario, aiText), "fail");
 });

+// ── report-parse: parseFindings / countFindings / extractLocation ──────────
+
+const SAMPLE_REPORT = [
+  "# Brooks-Lint Review",
+  "",
+  "**Health Score:** 62/100",
+  "",
+  "## Findings",
+  "",
+  "### 🔴 Critical",
+  "",
+  "**Change Propagation — Divergent change**",
+  "Symptom: src/services/UserService.ts:42 handles auth, email, and billing.",
+  "Source: Refactoring — Divergent Change",
+  "Consequence: Every feature touches the same class.",
+  "Remedy: Split into focused collaborators.",
+  "",
+  "### 🟡 Warning",
+  "",
+  "**Cognitive Overload (R1) — God method**",
+  "Symptom: generate() in report_gen.py takes nine positional parameters.",
+  "Source: A Philosophy of Software Design — shallow modules",
+  "Consequence: Callers must understand the whole signature.",
+  "Remedy: Introduce a ReportOptions object.",
+  "",
+  "### 🟢 Suggestion",
+  "",
+  "**Knowledge Duplication — Shipping rule copied**",
+  "Symptom: the free-shipping threshold appears in cart.js and checkout.js.",
+  "Source: The Pragmatic Programmer — DRY",
+  "Consequence: A policy change must be made in two places.",
+  "Remedy: Extract a single shippingPolicy module.",
+  "",
+  "## Summary",
+  "",
+  "**Bold prose, not a finding** — should be ignored.",
+].join("\n");
+
+console.log("\nparseFindings");
+
+test("parses one finding per severity group", () => {
+  assert.equal(parseFindings(SAMPLE_REPORT).length, 3);
+});
+
+test("maps risk name to code and keeps severity", () => {
+  const [crit, warn, sug] = parseFindings(SAMPLE_REPORT);
+  assert.deepEqual([crit.riskCode, crit.severity], ["R2", "critical"]);
+  assert.deepEqual([warn.riskCode, warn.severity], ["R1", "warning"]);
+  assert.deepEqual([sug.riskCode, sug.severity], ["R3", "suggestion"]);
+});
+
+test("resolves an explicit (R1) code in the title", () => {
+  const warn = parseFindings(SAMPLE_REPORT)[1];
+  assert.equal(warn.riskName, "Cognitive Overload");
+  assert.equal(warn.title, "God method");
+});
+
+test("extracts file and line from the Symptom", () => {
+  const crit = parseFindings(SAMPLE_REPORT)[0];
+  assert.equal(crit.file, "src/services/UserService.ts");
+  assert.equal(crit.line, 42);
+});
+
+test("ignores bold text outside any severity group", () => {
+  // The Summary's bold line must not be counted as a finding.
+  assert.ok(parseFindings(SAMPLE_REPORT).every((f) => f.title !== ""));
+  assert.equal(parseFindings(SAMPLE_REPORT).length, 3);
+});
+
+test("empty report yields no findings", () => {
+  assert.deepEqual(parseFindings(""), []);
+  assert.deepEqual(parseFindings(null), []);
+});
+
+const VARIANT_REPORT = [
+  "## Findings",
+  "",
+  "### 🔴 Critical Issues",
+  "",
+  "**Dependency Disorder: models import services**",
+  "Symptom: a cyclic import exists.",
+  "Source: Clean Architecture — the Dependency Rule",
+  "Consequence: the build in app/core/wiring.ts breaks.",
+  "Remedy: invert the dependency toward an interface.",
+  "",
+  "### 🟡 Warnings",
+  "",
+  "**Coverage Illusion — green but hollow**",
+  "Symptom: the suite asserts nothing meaningful.",
+  "Source: How Google Tests Software — coverage signal",
+  "Consequence: regressions slip through unnoticed.",
+  "Remedy: assert on observable outcomes.",
+].join("\n");
+
+test("tolerates plural / qualified severity headers", () => {
+  // `### 🔴 Critical Issues` and `### 🟡 Warnings` must still register as groups.
+  const f = parseFindings(VARIANT_REPORT);
+  assert.equal(f.length, 2);
+  assert.deepEqual([f[0].severity, f[1].severity], ["critical", "warning"]);
+});
+
+test("splits a colon-separated title and resolves its code", () => {
+  const first = parseFindings(VARIANT_REPORT)[0];
+  assert.equal(first.riskCode, "R5");
+  assert.equal(first.riskName, "Dependency Disorder");
+  assert.equal(first.title, "models import services");
+});
+
+test("falls back to Consequence for the location when Symptom has none", () => {
+  const first = parseFindings(VARIANT_REPORT)[0];
+  assert.equal(first.file, "app/core/wiring.ts");
+});
+
+console.log("\ncountFindings");
+
+test("counts findings by severity", () => {
+  assert.deepEqual(countFindings(SAMPLE_REPORT), { critical: 1, warning: 1, suggestion: 1 });
+});
+
+test("empty report counts all zero", () => {
+  assert.deepEqual(countFindings(""), { critical: 0, warning: 0, suggestion: 0 });
+});
+
+console.log("\nextractLocation");
+
+test("captures path with line number", () => {
+  assert.deepEqual(extractLocation("see app/models/order.rb:128 only"), {
+    file: "app/models/order.rb",
+    line: 128,
+  });
+});
+
+test("captures bare filename without a line", () => {
+  assert.deepEqual(extractLocation("generate() in report_gen.py"), {
+    file: "report_gen.py",
+    line: null,
+  });
+});
+
+test("does not mistake prose for a file reference", () => {
+  assert.deepEqual(extractLocation("nothing here, e.g. no path"), { file: null, line: null });
+  assert.deepEqual(extractLocation("see line 3 (i.e. nowhere)"), { file: null, line: null });
+});
+
+// ── sarif: reportToSarif ───────────────────────────────────────────────────
+
+console.log("\nreportToSarif");
+
+test("emits a SARIF 2.1.0 envelope", () => {
+  const log = reportToSarif(SAMPLE_REPORT, { mode: "review", toolVersion: "1.3.0" });
+  assert.equal(log.version, "2.1.0");
+  assert.ok(log.$schema.includes("sarif-2.1.0"));
+  assert.equal(log.runs[0].tool.driver.name, "brooks-lint");
+  assert.equal(log.runs[0].tool.driver.version, "1.3.0");
+});
+
+test("declares a deduped, PascalCased rule per risk code", () => {
+  const rules = reportToSarif(SAMPLE_REPORT).runs[0].tool.driver.rules;
+  assert.deepEqual(rules.map((r) => r.id), ["R2", "R1", "R3"]);
+  assert.equal(rules[0].name, "ChangePropagation");
+});
+
+test("maps severities to SARIF levels", () => {
+  const results = reportToSarif(SAMPLE_REPORT).runs[0].results;
+  assert.deepEqual(results.map((r) => r.level), ["error", "warning", "note"]);
+});
+
+test("attaches a physical location when a file is known", () => {
+  const first = reportToSarif(SAMPLE_REPORT).runs[0].results[0];
+  const loc = first.locations[0].physicalLocation;
+  assert.equal(loc.artifactLocation.uri, "src/services/UserService.ts");
+  assert.equal(loc.region.startLine, 42);
+  assert.ok(first.message.text.includes("Remedy:"));
+});
+
+test("fingerprints are stable across runs", () => {
+  const a = reportToSarif(SAMPLE_REPORT).runs[0].results[0].partialFingerprints.brooksLint;
+  const b = reportToSarif(SAMPLE_REPORT).runs[0].results[0].partialFingerprints.brooksLint;
+  assert.equal(a, b);
+});
+
+test("empty report yields no rules or results", () => {
+  const log = reportToSarif("");
+  assert.deepEqual(log.runs[0].tool.driver.rules, []);
+  assert.deepEqual(log.runs[0].results, []);
+});
+
+test("routes T-code helpUri off the guide (no #t anchor) and R-code onto it", () => {
+  const rules = reportToSarif(VARIANT_REPORT).runs[0].tool.driver.rules;
+  const r5 = rules.find((r) => r.id === "R5");
+  const t5 = rules.find((r) => r.id === "T5");
+  assert.ok(r5.helpUri.endsWith("guide.html#r5"));
+  assert.ok(t5.helpUri.includes("test-decay-risks.md"));
+  assert.ok(!t5.helpUri.includes("#t5"));
+});
+
+test("declares a BL000 rule when a finding is unmapped", () => {
+  const unmapped = [
+    "## Findings",
+    "",
+    "### 🔴 Critical",
+    "",
+    "**Some Unknown Smell — mystery**",
+    "Symptom: something odd in foo.ts.",
+    "Consequence: unclear impact.",
+    "Remedy: investigate.",
+  ].join("\n");
+  const run = reportToSarif(unmapped).runs[0];
+  assert.equal(run.results[0].ruleId, "BL000");
+  assert.ok(run.tool.driver.rules.some((r) => r.id === "BL000"));
+});
+
+// ── ci-gate: severityBreached / isRegression ───────────────────────────────
+
+console.log("\nseverityBreached");
+
+test("fail-on critical trips only on a critical finding", () => {
+  assert.equal(severityBreached({ critical: 1, warning: 0, suggestion: 0 }, "critical"), true);
+  assert.equal(severityBreached({ critical: 0, warning: 5, suggestion: 9 }, "critical"), false);
+});
+
+test("fail-on warning trips on critical or warning", () => {
+  assert.equal(severityBreached({ critical: 0, warning: 1, suggestion: 0 }, "warning"), true);
+  assert.equal(severityBreached({ critical: 2, warning: 0, suggestion: 0 }, "warning"), true);
+  assert.equal(severityBreached({ critical: 0, warning: 0, suggestion: 3 }, "warning"), false);
+});
+
+test("fail-on none never trips", () => {
+  assert.equal(severityBreached({ critical: 9, warning: 9, suggestion: 9 }, "none"), false);
+});
+
+test("missing or partial findings are treated as zero", () => {
+  assert.equal(severityBreached(undefined, "critical"), false);
+  assert.equal(severityBreached({}, "warning"), false);
+});
+
+console.log("\nisRegression");
+
+test("only a negative numeric delta is a regression", () => {
+  assert.equal(isRegression(-1), true);
+  assert.equal(isRegression(0), false);
+  assert.equal(isRegression(5), false);
+  assert.equal(isRegression(null), false);
+  assert.equal(isRegression(undefined), false);
+});
+
+// ── Parser-fidelity benchmark on the FROZEN real-report corpus ─────────────
+// Deterministic regression guard: the shipped parser must reproduce the
+// independently-graded finding inventory of 30 real model-generated reports.
+// This is the non-circular counterpart to the synthetic SAMPLE_REPORT tests
+// above — the reports here are real model output, the truth was graded by a
+// separate pass and spot-checked by hand. See scripts/benchmark.mjs.
+
+console.log("\nparser-fidelity benchmark (frozen real-report corpus)");
+
+const CORPUS = JSON.parse(readFileSync(path.join(__dirname, "..", "evals", "benchmark-corpus.json"), "utf8"));
+const BENCH = summarize(CORPUS);
+
+test("corpus has >= 30 real reports spanning all six modes", () => {
+  assert.ok(CORPUS.samples.length >= 30, `expected >=30 samples, got ${CORPUS.samples.length}`);
+  const modes = new Set(CORPUS.samples.map((s) => s.mode));
+  for (const m of VALID_MODES) assert.ok(modes.has(m), `corpus is missing mode ${m}`);
+});
+
+test("corpus composition matches the documented numbers (30 total, 9 false-positive)", () => {
+  // These exact counts are published in the README "Reproducible benchmarks"
+  // section — fail loudly if a corpus regen changes them without a docs update.
+  assert.equal(CORPUS.samples.length, 30);
+  assert.equal(CORPUS.samples.filter((s) => s.isFP).length, 9);
+});
+
+test("parser reproduces the graded severity counts on every report", () => {
+  const bad = BENCH.rows.filter((r) => !r.countMatch).map((r) => `${r.id}: truth ${r.truth} vs parser ${r.parser}`);
+  assert.equal(bad.length, 0, `count mismatches: ${bad.join("; ")}`);
+});
+
+test("every report emits valid SARIF 2.1.0", () => {
+  const bad = BENCH.rows.filter((r) => !r.sarifValid).map((r) => r.id);
+  assert.equal(bad.length, 0, `invalid SARIF for: ${bad.join(", ")}`);
+});
+
+test("risk-code extraction has zero false positives / negatives on the corpus", () => {
+  assert.equal(BENCH.fp, 0, `${BENCH.fp} false-positive code(s)`);
+  assert.equal(BENCH.fn, 0, `${BENCH.fn} false-negative code(s)`);
+  assert.equal(BENCH.precision, 1);
+  assert.equal(BENCH.recall, 1);
+});
+
 // ── Integration: validate-repo.mjs passes against current repo ─────────────

 console.log("\nvalidate-repo integration");