thanhnvandClaude Opus 4.8
664bd1f00c
Physically move the pure-code subtrees out of .specify into the package, leaving compat symlinks at the old .specify/<dir> paths so every existing reference (internal CASAN_HARNESS_ROOT + external CI/docker/mjs) keeps resolving. Runtime state stays put. Moved (git mv): scripts/ tests/ security/ templates/ config/ governance/ memory/ .specify/<dir> -> packages/casan-harness/<dir> (+ .specify/<dir> symlink) Stays in .specify (state/governance/domain, handled later): logs/ agentops/ level5/ init-options.json traceability-map.json Python `.resolve()` self-location followed the compat symlink into packages and lost the app root; generate-casan-demo-context.py, generate-agentops-dashboard.py and dashboard-server.py now walk UP for the `.specify` state marker instead of a fixed parent depth (fixes "missing trace files" in run-casan4). Full gate: PASS=64 FAIL=0 SKIP=3 (CASAN_CI_STEP_TIMEOUT_SEC=1200 — track-a ~450s runs close to the 600s default and can tip over under load; this is timing variance, not a regression — it passed cleanly with headroom). Runtime log/audit artifacts kept unstaged. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
106 lines
4.3 KiB
PowerShell
106 lines
4.3 KiB
PowerShell
#!/usr/bin/env pwsh
|
|
# CASAN unified harness wrapper - PowerShell port of casan-harness.sh
|
|
# Usage:
|
|
# casan-harness.ps1 <input-file> <output-file> [action-name] [-- <command> [args...]]
|
|
#
|
|
# Runs: H4-input → H5-governance → H6-metrics(real cmd) → H4-output
|
|
# Includes idempotency caching without bypassing H4/H5/H4-output gates.
|
|
|
|
param(
|
|
[Parameter(Mandatory=$true, Position=0)][string]$InputFile,
|
|
[Parameter(Mandatory=$true, Position=1)][string]$FinalOutput,
|
|
[Parameter(Position=2)][string]$ActionName = "agent_step",
|
|
[Parameter(ValueFromRemainingArguments=$true)][string[]]$RemainingArgs
|
|
)
|
|
|
|
$ErrorActionPreference = "Stop"
|
|
|
|
$scriptDir = Split-Path $MyInvocation.MyCommand.Path -Parent
|
|
$projectRoot = (Resolve-Path (Join-Path $scriptDir "../../..")).Path
|
|
$tmpDir = Join-Path $projectRoot ".specify/logs/tmp"
|
|
$cacheDir = Join-Path $projectRoot ".specify/logs/idempotency"
|
|
|
|
foreach ($d in @($tmpDir, $cacheDir, (Split-Path $FinalOutput -Parent))) {
|
|
if ($d -and !(Test-Path $d)) { New-Item -ItemType Directory -Force -Path $d | Out-Null }
|
|
}
|
|
|
|
function Get-Sha256 ([string]$text) {
|
|
$bytes = [System.Text.Encoding]::UTF8.GetBytes($text)
|
|
$hash = [System.Security.Cryptography.SHA256]::Create().ComputeHash($bytes)
|
|
return ($hash | ForEach-Object { $_.ToString("x2") }) -join ""
|
|
}
|
|
|
|
# Strip "--" separator
|
|
$cmdArgs = $RemainingArgs
|
|
if ($cmdArgs -and $cmdArgs[0] -eq "--") { $cmdArgs = $cmdArgs[1..($cmdArgs.Count-1)] }
|
|
|
|
# ── Idempotency check ──────────────────────────────────────────────────────
|
|
$inputContent = Get-Content $InputFile -Raw -Encoding UTF8
|
|
if (!$inputContent) { $inputContent = "" }
|
|
$cmdStr = if ($cmdArgs) { $cmdArgs -join " " } else { "no_cmd" }
|
|
$inputHash = Get-Sha256 $inputContent
|
|
$cmdHash = Get-Sha256 $cmdStr
|
|
$idemKey = Get-Sha256 "$inputHash|$cmdHash|$ActionName"
|
|
|
|
$cacheMeta = Join-Path $cacheDir "$idemKey.json"
|
|
$cacheOut = Join-Path $cacheDir "$idemKey.output"
|
|
|
|
# ── Normal flow ────────────────────────────────────────────────────────────
|
|
$suffix = "$(Get-Date -Format 'yyyyMMddHHmmss')-$PID"
|
|
$safeInput = Join-Path $tmpDir "security-input-$suffix.txt"
|
|
$approvedIn = Join-Path $tmpDir "governance-approved-$suffix.txt"
|
|
$rawOutput = Join-Path $tmpDir "raw-output-$suffix.txt"
|
|
|
|
# H4 input security
|
|
& "$scriptDir/security-check.ps1" $InputFile $safeInput input
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
|
|
# H5 governance
|
|
& "$scriptDir/governance-check.ps1" $safeInput $approvedIn $ActionName
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
|
|
# H6 metrics around real command or cached output.
|
|
if ((Test-Path $cacheMeta) -and (Test-Path $cacheOut)) {
|
|
Copy-Item -Path $cacheOut -Destination $rawOutput -Force
|
|
$metricsExit = 0
|
|
$cacheStatus = "cached"
|
|
} elseif ($cmdArgs -and $cmdArgs.Count -gt 0) {
|
|
& "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput "--" @cmdArgs
|
|
$metricsExit = $LASTEXITCODE
|
|
$cacheStatus = "stored"
|
|
} else {
|
|
& "$scriptDir/agent-metrics.ps1" $approvedIn $rawOutput
|
|
$metricsExit = $LASTEXITCODE
|
|
$cacheStatus = "stored"
|
|
}
|
|
|
|
# H4 output security
|
|
& "$scriptDir/security-check.ps1" $rawOutput $FinalOutput output
|
|
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
|
|
|
|
# ── Save idempotency cache ─────────────────────────────────────────────────
|
|
$outputContent = Get-Content $FinalOutput -Raw -Encoding UTF8
|
|
if (!$outputContent) { $outputContent = "" }
|
|
$outputHash = Get-Sha256 $outputContent
|
|
|
|
if ($cacheStatus -eq "stored") {
|
|
@"
|
|
{
|
|
"idempotency_key": "$idemKey",
|
|
"timestamp": "$($(Get-Date).ToUniversalTime().ToString("yyyy-MM-ddTHH:mm:ssZ"))",
|
|
"action": "$ActionName",
|
|
"command": "$(($cmdStr -replace '"','\"'))",
|
|
"output_hash": "$outputHash"
|
|
}
|
|
"@ | Set-Content -Path $cacheMeta -Encoding UTF8
|
|
Copy-Item -Path $FinalOutput -Destination $cacheOut -Force
|
|
}
|
|
|
|
# Clean up tmp files
|
|
foreach ($f in @($safeInput, $approvedIn, $rawOutput)) {
|
|
if (Test-Path $f) { Remove-Item $f -Force -ErrorAction SilentlyContinue }
|
|
}
|
|
|
|
Write-Output "CASAN_HARNESS_COMPLETE cache=$cacheStatus key=$idemKey output=$FinalOutput"
|
|
exit $metricsExit
|