update first - 84

2026-06-30 02:21:39 +09:00
commit 07ac1bdcdd
561 changed files with 88164 additions and 0 deletions
@@ -0,0 +1,105 @@
+#!/usr/bin/env pwsh
+# CASAN unified harness wrapper - PowerShell port of casan-harness.sh
+# Usage:
+#   casan-harness.ps1 <input-file> <output-file> [action-name] [-- <command> [args...]]
+#
+# Runs: H4-input → H5-governance → H6-metrics(real cmd) → H4-output
+# Includes idempotency caching without bypassing H4/H5/H4-output gates.
+
+param(
+    [Parameter(Mandatory=$true, Position=0)][string]$InputFile,
+    [Parameter(Mandatory=$true, Position=1)][string]$FinalOutput,
+    [Parameter(Position=2)][string]$ActionName = "agent_step",
+    [Parameter(ValueFromRemainingArguments=$true)][string[]]$RemainingArgs
+)
+
+$ErrorActionPreference = "Stop"
+
+$scriptDir   = Split-Path $MyInvocation.MyCommand.Path -Parent
+$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
+$tmpDir      = Join-Path $projectRoot ".specify/logs/tmp"
+$cacheDir    = Join-Path $projectRoot ".specify/logs/idempotency"
+
+foreach ($d in @($tmpDir, $cacheDir, (Split-Path $FinalOutput -Parent))) {
+    if ($d -and !(Test-Path $d)) { New-Item -ItemType Directory -Force -Path $d | Out-Null }
+}
+
+function Get-Sha256 ([string]$text) {
+    $bytes = [System.Text.Encoding]::UTF8.GetBytes($text)
+    $hash  = [System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes)
+    return ($hash | ForEach-Object { $_.ToString("x2") }) -join ""
+}
+
+# Strip "--" separator
+$cmdArgs = $RemainingArgs
+if ($cmdArgs -and $cmdArgs[0] -eq "--") { $cmdArgs = $cmdArgs[1..($cmdArgs.Count-1)] }
+
+# ── Idempotency check ──────────────────────────────────────────────────────
+$inputContent = Get-Content $InputFile -Raw -Encoding UTF8
+if (!$inputContent) { $inputContent = "" }
+$cmdStr       = if ($cmdArgs) { $cmdArgs -join " " } else { "no_cmd" }
+$inputHash    = Get-Sha256 $inputContent
+$cmdHash      = Get-Sha256 $cmdStr
+$idemKey      = Get-Sha256 "$inputHash|$cmdHash|$ActionName"
+
+$cacheMeta = Join-Path $cacheDir "$idemKey.json"
+$cacheOut  = Join-Path $cacheDir "$idemKey.output"
+
+# ── Normal flow ────────────────────────────────────────────────────────────
+$suffix       = "$(Get-Date -Format 'yyyyMMddHHmmss')-$PID"
+$safeInput    = Join-Path $tmpDir "security-input-$suffix.txt"
+$approvedIn   = Join-Path $tmpDir "governance-approved-$suffix.txt"
+$rawOutput    = Join-Path $tmpDir "raw-output-$suffix.txt"
+
+# H4 input security
+& "$scriptDir/security-check.ps1" $InputFile $safeInput input
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+# H5 governance
+& "$scriptDir/governance-check.ps1" $safeInput $approvedIn $ActionName
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+# H6 metrics around real command or cached output.
+if ((Test-Path $cacheMeta) -and (Test-Path $cacheOut)) {
+    Copy-Item -Path $cacheOut -Destination $rawOutput -Force
+    $metricsExit = 0
+    $cacheStatus = "cached"
+} elseif ($cmdArgs -and $cmdArgs.Count -gt 0) {
+    & "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput "--" @cmdArgs
+    $metricsExit = $LASTEXITCODE
+    $cacheStatus = "stored"
+} else {
+    & "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput
+    $metricsExit = $LASTEXITCODE
+    $cacheStatus = "stored"
+}
+
+# H4 output security
+& "$scriptDir/security-check.ps1" $rawOutput $FinalOutput output
+if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+
+# ── Save idempotency cache ─────────────────────────────────────────────────
+$outputContent = Get-Content $FinalOutput -Raw -Encoding UTF8
+if (!$outputContent) { $outputContent = "" }
+$outputHash = Get-Sha256 $outputContent
+
+if ($cacheStatus -eq "stored") {
+@"
+{
+  "idempotency_key": "$idemKey",
+  "timestamp": "$($(Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ"))",
+  "action": "$ActionName",
+  "command": "$(($cmdStr -replace '"','\"'))",
+  "output_hash": "$outputHash"
+}
+"@ | Set-Content -Path $cacheMeta -Encoding UTF8
+    Copy-Item -Path $FinalOutput -Destination $cacheOut -Force
+}
+
+# Clean up tmp files
+foreach ($f in @($safeInput, $approvedIn, $rawOutput)) {
+    if (Test-Path $f) { Remove-Item $f -Force -ErrorAction SilentlyContinue }
+}
+
+Write-Output "CASAN_HARNESS_COMPLETE cache=$cacheStatus key=$idemKey output=$FinalOutput"
+exit $metricsExit