Codex
663 lines
26 KiB
TypeScript
663 lines
26 KiB
TypeScript
// SPEC: PJ2026-01060508 Web哨兵 draft-2026-06-25-p0-web-probe-sentinel.
|
|
// SPEC: PJ2026-01060508 Web哨兵 draft-2026-06-26-p9-multi-web-probe-sentinel.
|
|
// Responsibility: Redacted YAML configRef graph for web-probe sentinel plan/status.
|
|
import { readFileSync } from "node:fs";
|
|
import { rootPath } from "./config";
|
|
import { readWebProbeSentinelConfigRef } from "./hwlab-node-web-sentinel-config-ref";
|
|
import { HWLAB_WEB_PROBE_SENTINEL_CONFIG_REF_KEYS, type HwlabRuntimeLaneSpec, type HwlabRuntimeWebProbeSentinelConfigRefKey } from "./hwlab-node-lanes";
|
|
import { effectiveWebProbeSentinelPublicExposure, resolveWebProbeSentinel, webProbeSentinelRegistryRows, type WebProbeSentinelRegistryRow } from "./hwlab-node-web-sentinel-resolver";
|
|
import type { RenderedCliResult } from "./output";
|
|
|
|
export type WebProbeSentinelConfigAction = "plan" | "status";
|
|
|
|
export interface WebProbeSentinelConfigPlan {
|
|
readonly ok: boolean;
|
|
readonly command: string;
|
|
readonly status: "ready" | "blocked" | "disabled";
|
|
readonly node: string;
|
|
readonly lane: string;
|
|
readonly rootPath: string;
|
|
readonly sentinelId: string | null;
|
|
readonly enabled: boolean;
|
|
readonly sentinels: readonly WebProbeSentinelRegistryRow[];
|
|
readonly refs: readonly WebProbeSentinelConfigRefStatus[];
|
|
readonly conflicts: readonly string[];
|
|
readonly next: Record<string, string>;
|
|
readonly valuesRedacted: true;
|
|
}
|
|
|
|
export interface WebProbeSentinelConfigRefStatus {
|
|
readonly key: HwlabRuntimeWebProbeSentinelConfigRefKey;
|
|
readonly ref: string;
|
|
readonly file: string;
|
|
readonly path: string;
|
|
readonly present: boolean;
|
|
readonly targetPresent: boolean;
|
|
readonly targetKind: "object" | "array" | "scalar" | "null" | "missing";
|
|
readonly sha256: string | null;
|
|
readonly byteCount: number | null;
|
|
readonly missingFields: readonly string[];
|
|
readonly conflicts: readonly string[];
|
|
readonly summary: string;
|
|
readonly error: string | null;
|
|
}
|
|
|
|
interface InternalConfigRefStatus extends WebProbeSentinelConfigRefStatus {
|
|
readonly target: unknown;
|
|
}
|
|
|
|
interface RequiredTargetShape {
|
|
readonly kind: "object" | "array";
|
|
readonly requiredPaths: readonly string[];
|
|
}
|
|
|
|
const REQUIRED_TARGET_SHAPES: Record<HwlabRuntimeWebProbeSentinelConfigRefKey, RequiredTargetShape> = {
|
|
runtime: {
|
|
kind: "object",
|
|
requiredPaths: [
|
|
"target.node",
|
|
"target.lane",
|
|
"target.publicOriginRef",
|
|
"target.observeWrapperRef",
|
|
"namespace",
|
|
"serviceAccountName",
|
|
"deploymentName",
|
|
"serviceName",
|
|
"listenHost",
|
|
"servicePort",
|
|
"pvcName",
|
|
"pvcStorage",
|
|
"stateRoot",
|
|
"imageRef",
|
|
"replicas",
|
|
"healthPath",
|
|
"metricsPath",
|
|
"scheduler.intervalMs",
|
|
"scheduler.heartbeatStaleSeconds",
|
|
"scheduler.maxConcurrentRuns",
|
|
"sqlite.path",
|
|
"sqlite.busyTimeoutMs",
|
|
],
|
|
},
|
|
scenarios: {
|
|
kind: "array",
|
|
requiredPaths: [
|
|
"id",
|
|
"enabled",
|
|
"cadence",
|
|
"observeTargetPath",
|
|
"sampleIntervalMs",
|
|
"screenshotIntervalMs",
|
|
"maxRunSeconds",
|
|
"providerProfile",
|
|
"providerProfileMode",
|
|
"promptSetRef",
|
|
"reportViewRef",
|
|
"commandSequence[0].type",
|
|
],
|
|
},
|
|
promptSet: {
|
|
kind: "object",
|
|
requiredPaths: ["id", "providerProfile", "providerProfileMode", "promptSourceRef", "promptSourceKey", "promptCount", "redaction"],
|
|
},
|
|
reportViews: {
|
|
kind: "object",
|
|
requiredPaths: ["defaultView", "views[0]", "pageSize", "maxPageSize", "rawAccess", "checkCatalogRef", "detailMemory.maxPages", "detailMemory.maxSamplesPerPage", "redaction.prompt", "redaction.secrets"],
|
|
},
|
|
publicExposure: {
|
|
kind: "object",
|
|
requiredPaths: [
|
|
"enabled",
|
|
"mode",
|
|
"publicBaseUrl",
|
|
"hostname",
|
|
"expectedA",
|
|
"frpc.deploymentName",
|
|
"frpc.image",
|
|
"frpc.serverAddr",
|
|
"frpc.serverPort",
|
|
"frpc.tokenSourceRef",
|
|
"frpc.tokenSourceKey",
|
|
"frpc.secretName",
|
|
"frpc.secretKey",
|
|
"frpc.httpProxy.name",
|
|
"frpc.httpProxy.localIP",
|
|
"frpc.httpProxy.localPort",
|
|
"caddy.route",
|
|
"caddy.configPath",
|
|
"caddy.serviceName",
|
|
"caddy.managedBlockOwner",
|
|
],
|
|
},
|
|
cicd: {
|
|
kind: "object",
|
|
requiredPaths: [
|
|
"controlPlaneConfigRef",
|
|
"source.repository",
|
|
"source.branch",
|
|
"source.gitMirrorReadUrl",
|
|
"source.buildContext",
|
|
"source.entrypoint",
|
|
"sourceAuthority.mode",
|
|
"sourceAuthority.resolver",
|
|
"sourceAuthority.allowHostGit",
|
|
"sourceAuthority.allowGithubDirectInPipeline",
|
|
"sourceSnapshot.stageRefPrefix",
|
|
"sourceSnapshot.missingObjectPolicy",
|
|
"sourceSnapshot.refreshPolicy",
|
|
"sourceSnapshot.cacheRef",
|
|
"gitopsPath",
|
|
"argo.namespace",
|
|
"argo.projectName",
|
|
"argo.applicationName",
|
|
"argo.repoURL",
|
|
"argo.targetRevision",
|
|
"image.repository",
|
|
"image.tagSource",
|
|
"image.baseImageRef",
|
|
"image.envRecipeRef",
|
|
"maintenance.startCommand",
|
|
"maintenance.stopCommand",
|
|
"confirmWait.maxSeconds",
|
|
"targetValidation.scenarioId",
|
|
"targetValidation.maxSeconds",
|
|
"targetValidation.serviceUnavailablePolicy",
|
|
],
|
|
},
|
|
secrets: {
|
|
kind: "object",
|
|
requiredPaths: [
|
|
"sources[0].purpose",
|
|
"sources[0].sourceRef",
|
|
"sources[0].sourceKey",
|
|
"runtimeSecrets[0].name",
|
|
"runtimeSecrets[0].namespace",
|
|
"runtimeSecrets[0].data[0].sourcePurpose",
|
|
"runtimeSecrets[0].data[0].targetKey",
|
|
],
|
|
},
|
|
};
|
|
|
|
export function webProbeSentinelConfigPlan(spec: HwlabRuntimeLaneSpec, action: WebProbeSentinelConfigAction, sentinelId: string | null = null): WebProbeSentinelConfigPlan {
|
|
const command = `web-probe sentinel ${action} --node ${spec.nodeId} --lane ${spec.lane}${sentinelId === null ? "" : ` --sentinel ${sentinelId}`}`;
|
|
const registry = webProbeSentinelRegistryRows(spec);
|
|
const registryPath = `config/hwlab-node-lanes.yaml#lanes.${spec.lane}.targets.${spec.nodeId}.observability.webProbe.sentinels`;
|
|
if (sentinelId === null && registry.length > 1) {
|
|
const enabled = registry.some((item) => item.enabled);
|
|
return {
|
|
ok: enabled,
|
|
command,
|
|
status: enabled ? "ready" : "disabled",
|
|
node: spec.nodeId,
|
|
lane: spec.lane,
|
|
rootPath: registryPath,
|
|
sentinelId: null,
|
|
enabled,
|
|
sentinels: registry,
|
|
refs: [],
|
|
conflicts: [],
|
|
next: sentinelNext(spec.nodeId, spec.lane, registry[0]?.id ?? null),
|
|
valuesRedacted: true,
|
|
};
|
|
}
|
|
if (registry.length === 0) {
|
|
return {
|
|
ok: false,
|
|
command,
|
|
status: "blocked",
|
|
node: spec.nodeId,
|
|
lane: spec.lane,
|
|
rootPath: registryPath,
|
|
sentinelId,
|
|
enabled: false,
|
|
sentinels: [],
|
|
refs: [],
|
|
conflicts: [`${registryPath} is missing`],
|
|
next: sentinelNext(spec.nodeId, spec.lane, sentinelId),
|
|
valuesRedacted: true,
|
|
};
|
|
}
|
|
|
|
const selected = resolveWebProbeSentinel(spec, sentinelId);
|
|
const refs = HWLAB_WEB_PROBE_SENTINEL_CONFIG_REF_KEYS
|
|
.map((key) => readSentinelConfigRef(spec, key, selected.configRefs[key]))
|
|
.map((ref) => effectiveConfigRefStatus(spec, selected.id, ref));
|
|
const conflicts = selected.enabled ? crossReferenceConflicts(spec, refs) : [];
|
|
const refBlocked = refs.some((ref) => !ref.present || !ref.targetPresent || ref.missingFields.length > 0 || ref.conflicts.length > 0 || ref.error !== null);
|
|
const ok = selected.enabled && !refBlocked && conflicts.length === 0;
|
|
return {
|
|
ok,
|
|
command,
|
|
status: selected.enabled ? ok ? "ready" : "blocked" : "disabled",
|
|
node: spec.nodeId,
|
|
lane: spec.lane,
|
|
rootPath: selected.rootPath,
|
|
sentinelId: selected.id,
|
|
enabled: selected.enabled,
|
|
sentinels: registry,
|
|
refs: refs.map(stripInternalTarget),
|
|
conflicts,
|
|
next: sentinelNext(spec.nodeId, spec.lane, selected.id),
|
|
valuesRedacted: true,
|
|
};
|
|
}
|
|
|
|
function effectiveConfigRefStatus(spec: HwlabRuntimeLaneSpec, sentinelId: string, ref: InternalConfigRefStatus): InternalConfigRefStatus {
|
|
if (ref.key !== "publicExposure" || !isRecord(ref.target)) return ref;
|
|
const target = effectiveWebProbeSentinelPublicExposure(spec, sentinelId, ref.target);
|
|
return {
|
|
...ref,
|
|
targetKind: targetKindOf(target),
|
|
missingFields: missingFieldsForTarget(ref.key, target),
|
|
summary: summarizeTarget(ref.key, target),
|
|
target,
|
|
};
|
|
}
|
|
|
|
export function withWebProbeSentinelConfigRendered(value: WebProbeSentinelConfigPlan): RenderedCliResult {
|
|
return {
|
|
ok: value.ok,
|
|
command: value.command,
|
|
contentType: "text/plain",
|
|
renderedText: renderWebProbeSentinelConfigPlan(value),
|
|
};
|
|
}
|
|
|
|
function readSentinelConfigRef(spec: HwlabRuntimeLaneSpec, key: HwlabRuntimeWebProbeSentinelConfigRefKey, ref: string): InternalConfigRefStatus {
|
|
try {
|
|
const resolved = readWebProbeSentinelConfigRef(spec, ref);
|
|
const target = resolved.target;
|
|
const targetKind = target === undefined ? "missing" : targetKindOf(target);
|
|
const missingFields = target === undefined ? ["target"] : missingFieldsForTarget(key, target);
|
|
return {
|
|
key,
|
|
ref,
|
|
file: resolved.file,
|
|
path: resolved.path,
|
|
present: true,
|
|
targetPresent: target !== undefined,
|
|
targetKind,
|
|
sha256: resolved.sha256,
|
|
byteCount: resolved.byteCount,
|
|
missingFields,
|
|
conflicts: [],
|
|
summary: summarizeTarget(key, target),
|
|
error: null,
|
|
target,
|
|
};
|
|
} catch (error) {
|
|
const message = error instanceof Error ? error.message : String(error);
|
|
return emptyRefStatus(key, ref, "", "", message);
|
|
}
|
|
}
|
|
|
|
function emptyRefStatus(key: HwlabRuntimeWebProbeSentinelConfigRefKey, ref: string, file: string, path: string, error: string): InternalConfigRefStatus {
|
|
return {
|
|
key,
|
|
ref,
|
|
file,
|
|
path,
|
|
present: false,
|
|
targetPresent: false,
|
|
targetKind: "missing",
|
|
sha256: null,
|
|
byteCount: null,
|
|
missingFields: ["target"],
|
|
conflicts: [],
|
|
summary: "-",
|
|
error,
|
|
target: undefined,
|
|
};
|
|
}
|
|
|
|
function missingFieldsForTarget(key: HwlabRuntimeWebProbeSentinelConfigRefKey, target: unknown): string[] {
|
|
const shape = REQUIRED_TARGET_SHAPES[key];
|
|
if (shape.kind === "array") {
|
|
const items = key === "scenarios" && isRecord(target) ? [target] : Array.isArray(target) ? target : null;
|
|
if (items === null) return [`expected ${shape.kind}`];
|
|
if (items.length === 0) return ["[0]"];
|
|
return items.flatMap((item, index) => shape.requiredPaths
|
|
.filter((path) => valueAtPath(item, path) === undefined)
|
|
.map((path) => `[${index}].${path}`));
|
|
}
|
|
if (!isRecord(target)) return [`expected ${shape.kind}`];
|
|
return shape.requiredPaths.filter((path) => valueAtPath(target, path) === undefined);
|
|
}
|
|
|
|
function crossReferenceConflicts(spec: HwlabRuntimeLaneSpec, refs: readonly InternalConfigRefStatus[]): string[] {
|
|
const byKey = new Map(refs.map((ref) => [ref.key, ref]));
|
|
const conflicts: string[] = [];
|
|
const runtime = recordTarget(byKey.get("runtime"));
|
|
const scenarios = scenarioTargets(byKey.get("scenarios"));
|
|
const promptSet = recordTarget(byKey.get("promptSet"));
|
|
const reportViews = recordTarget(byKey.get("reportViews"));
|
|
const cicd = recordTarget(byKey.get("cicd"));
|
|
const secrets = recordTarget(byKey.get("secrets"));
|
|
|
|
if (runtime !== null) {
|
|
requireEquals(conflicts, byKey.get("runtime"), "target.node", spec.nodeId, `selected node ${spec.nodeId}`);
|
|
requireEquals(conflicts, byKey.get("runtime"), "target.lane", spec.lane, `selected lane ${spec.lane}`);
|
|
requireEquals(conflicts, byKey.get("runtime"), "namespace", spec.runtimeNamespace, `selected namespace ${spec.runtimeNamespace}`);
|
|
}
|
|
|
|
const scenarioIds = new Set<string>();
|
|
const scenarioProviders = new Set<string>();
|
|
for (const [index, scenario] of scenarios.entries()) {
|
|
const id = stringAt(scenario, "id");
|
|
if (id !== null) scenarioIds.add(id);
|
|
const provider = stringAt(scenario, "providerProfile");
|
|
if (provider !== null) scenarioProviders.add(provider);
|
|
requireReadableConfigRef(spec, conflicts, byKey.get("scenarios"), `[${index}].promptSetRef`, scenario.promptSetRef);
|
|
requireReadableConfigRef(spec, conflicts, byKey.get("scenarios"), `[${index}].reportViewRef`, scenario.reportViewRef);
|
|
}
|
|
|
|
const promptProvider = promptSet === null ? null : stringAt(promptSet, "providerProfile");
|
|
if (promptProvider !== null && scenarioProviders.size > 0 && !scenarioProviders.has(promptProvider)) {
|
|
conflicts.push(`${byKey.get("promptSet")?.file}#${byKey.get("promptSet")?.path}.providerProfile=${promptProvider} does not match scenario providerProfile set ${Array.from(scenarioProviders).join(",")}`);
|
|
}
|
|
|
|
const validationScenarioId = cicd === null ? null : stringAt(cicd, "targetValidation.scenarioId");
|
|
if (validationScenarioId !== null && !scenarioIds.has(validationScenarioId)) {
|
|
conflicts.push(`${byKey.get("cicd")?.file}#${byKey.get("cicd")?.path}.targetValidation.scenarioId=${validationScenarioId} is not declared in scenarios`);
|
|
}
|
|
|
|
validateReportViewsCheckCatalog(spec, conflicts, byKey.get("reportViews"), reportViews);
|
|
|
|
const runtimeNamespace = runtime === null ? null : stringAt(runtime, "namespace");
|
|
const runtimeSecrets = secrets === null ? [] : arrayAt(secrets, "runtimeSecrets");
|
|
if (runtimeNamespace !== null) {
|
|
for (const [index, item] of runtimeSecrets.entries()) {
|
|
const namespace = stringAt(item, "namespace");
|
|
if (namespace !== null && namespace !== runtimeNamespace) {
|
|
conflicts.push(`${byKey.get("secrets")?.file}#${byKey.get("secrets")?.path}.runtimeSecrets[${index}].namespace=${namespace} does not match runtime namespace ${runtimeNamespace}`);
|
|
}
|
|
}
|
|
}
|
|
return conflicts;
|
|
}
|
|
|
|
function validateReportViewsCheckCatalog(spec: HwlabRuntimeLaneSpec, conflicts: string[], ref: InternalConfigRefStatus | undefined, reportViews: Record<string, unknown> | null): void {
|
|
if (reportViews === null) return;
|
|
const catalogRef = stringAt(reportViews, "checkCatalogRef");
|
|
if (catalogRef === null) {
|
|
conflicts.push(`${ref?.file ?? "-"}#${ref?.path ?? "-"}.checkCatalogRef is required`);
|
|
return;
|
|
}
|
|
let catalog: Record<string, unknown>;
|
|
try {
|
|
const target = readWebProbeSentinelConfigRef(spec, catalogRef).target;
|
|
catalog = isRecord(target) ? target : {};
|
|
} catch (error) {
|
|
conflicts.push(`${ref?.file ?? "-"}#${ref?.path ?? "-"}.checkCatalogRef=${catalogRef} is not readable: ${error instanceof Error ? error.message : String(error)}`);
|
|
return;
|
|
}
|
|
const items = arrayAt(catalog, "items");
|
|
if (items.length === 0) {
|
|
conflicts.push(`${catalogRef}.items is empty`);
|
|
return;
|
|
}
|
|
const byId = new Map<string, Record<string, unknown>>();
|
|
const codes = new Set<string>();
|
|
for (const [index, item] of items.entries()) {
|
|
const itemId = stringAt(item, "id");
|
|
const code = stringAt(item, "code");
|
|
if (itemId === null) conflicts.push(`${catalogRef}.items[${index}].id is required`);
|
|
else if (byId.has(itemId)) conflicts.push(`${catalogRef}.items id duplicated: ${itemId}`);
|
|
else byId.set(itemId, item);
|
|
if (code === null) conflicts.push(`${catalogRef}.items[${index}].code is required`);
|
|
else if (codes.has(code)) conflicts.push(`${catalogRef}.items code duplicated: ${code}`);
|
|
else codes.add(code);
|
|
for (const field of ["titleZh", "summaryZh", "actionZh"]) {
|
|
const text = stringAt(item, field);
|
|
if (text === null) {
|
|
conflicts.push(`${catalogRef}.items[${index}].${field} is required`);
|
|
} else if (!containsChinese(text)) {
|
|
conflicts.push(`${catalogRef}.items[${index}].${field} must contain Chinese text`);
|
|
}
|
|
}
|
|
}
|
|
const requiredIds = knownWebProbeFindingIds();
|
|
const missing = requiredIds.filter((id) => !byId.has(id));
|
|
if (missing.length > 0) {
|
|
conflicts.push(`${catalogRef}.items missing analyzer finding ids: ${missing.slice(0, 24).join(",")}${missing.length > 24 ? `,+${missing.length - 24}` : ""}`);
|
|
}
|
|
}
|
|
|
|
function knownWebProbeFindingIds(): string[] {
|
|
const ids = new Set<string>();
|
|
for (const file of [
|
|
"scripts/src/hwlab-node-web-observe-analyzer-source.ts",
|
|
"scripts/src/hwlab-node-web-sentinel-p5-observe.ts",
|
|
]) {
|
|
let source = "";
|
|
try {
|
|
source = readFileSync(rootPath(file), "utf8");
|
|
} catch {
|
|
continue;
|
|
}
|
|
for (const match of source.matchAll(/\bid:\s*["`]([A-Za-z0-9_.:-]+)["`]/gu)) ids.add(match[1]);
|
|
}
|
|
return Array.from(ids).sort();
|
|
}
|
|
|
|
function containsChinese(value: string): boolean {
|
|
return /[\u3400-\u9fff]/u.test(value);
|
|
}
|
|
|
|
function requireReadableConfigRef(spec: HwlabRuntimeLaneSpec, conflicts: string[], ref: InternalConfigRefStatus | undefined, path: string, value: unknown): void {
|
|
if (typeof value !== "string" || value.length === 0) return;
|
|
try {
|
|
readWebProbeSentinelConfigRef(spec, value);
|
|
} catch (error) {
|
|
conflicts.push(`${ref?.file ?? "-"}#${ref?.path ?? "-"}.${path}=${value} is not readable: ${error instanceof Error ? error.message : String(error)}`);
|
|
}
|
|
}
|
|
|
|
function requireEquals(conflicts: string[], ref: InternalConfigRefStatus | undefined, path: string, expected: string, expectedLabel: string): void {
|
|
if (ref === undefined) return;
|
|
const actual = stringAt(ref.target, path);
|
|
if (actual !== null && actual !== expected) {
|
|
conflicts.push(`${ref.file}#${ref.path}.${path}=${actual} does not match ${expectedLabel}`);
|
|
}
|
|
}
|
|
|
|
function stripInternalTarget(ref: InternalConfigRefStatus): WebProbeSentinelConfigRefStatus {
|
|
return {
|
|
key: ref.key,
|
|
ref: ref.ref,
|
|
file: ref.file,
|
|
path: ref.path,
|
|
present: ref.present,
|
|
targetPresent: ref.targetPresent,
|
|
targetKind: ref.targetKind,
|
|
sha256: ref.sha256,
|
|
byteCount: ref.byteCount,
|
|
missingFields: ref.missingFields,
|
|
conflicts: ref.conflicts,
|
|
summary: ref.summary,
|
|
error: ref.error,
|
|
};
|
|
}
|
|
|
|
function summarizeTarget(key: HwlabRuntimeWebProbeSentinelConfigRefKey, target: unknown): string {
|
|
if (target === undefined) return "target=missing";
|
|
if (key === "scenarios") {
|
|
const items = isRecord(target) ? [target] : Array.isArray(target) ? target : [];
|
|
const ids = items.map((item) => stringAt(item, "id")).filter((item): item is string => item !== null).slice(0, 4);
|
|
const cadences = items.map((item) => stringAt(item, "cadence")).filter((item): item is string => item !== null).slice(0, 4);
|
|
const checks = items.flatMap((item) => arrayAt(item, "sessionInvarianceChecks"));
|
|
const afterRounds = checks
|
|
.map((item) => {
|
|
const value = isRecord(item) ? item.afterRound : null;
|
|
return typeof value === "number" ? String(value) : null;
|
|
})
|
|
.filter((item): item is string => item !== null)
|
|
.slice(0, 8);
|
|
return `items=${items.length} ids=${ids.join(",") || "-"} cadence=${cadences.join(",") || "-"} sessionInvarianceChecks=${checks.length} afterRound=${afterRounds.join(",") || "-"}`;
|
|
}
|
|
if (!isRecord(target)) return `kind=${targetKindOf(target)}`;
|
|
if (key === "runtime") return `namespace=${textAt(target, "namespace")} service=${textAt(target, "serviceName")} image=${short(textAt(target, "imageRef"), 48)}`;
|
|
if (key === "promptSet") return `id=${textAt(target, "id")} provider=${textAt(target, "providerProfile")} prompts=${textAt(target, "promptCount")} markers=${arrayAt(target, "expectedMarkers").slice(0, 12).join(",") || "-"} source=${textAt(target, "promptSourceRef")}:${textAt(target, "promptSourceKey")}`;
|
|
if (key === "reportViews") return `default=${textAt(target, "defaultView")} views=${arrayAt(target, "views").length}`;
|
|
if (key === "publicExposure") {
|
|
const monitorRoot = textAt(target, "monitorRoot.enabled");
|
|
const rootOrder = textAt(target, "caddy.rootOrder");
|
|
const suffix = [
|
|
...(monitorRoot === "-" ? [] : [`monitorRoot=${monitorRoot}`]),
|
|
...(rootOrder === "-" ? [] : [`rootOrder=${rootOrder}`]),
|
|
].join(" ");
|
|
return `enabled=${textAt(target, "enabled")} mode=${textAt(target, "mode")} url=${textAt(target, "publicBaseUrl")}${suffix.length === 0 ? "" : ` ${suffix}`}`;
|
|
}
|
|
if (key === "cicd") return `gitops=${textAt(target, "gitopsPath")} image=${textAt(target, "image.repository")}:${textAt(target, "image.tagSource")} confirmWait=${textAt(target, "confirmWait.maxSeconds")} targetValidation=${textAt(target, "targetValidation.maxSeconds")}`;
|
|
if (key === "secrets") return `sources=${arrayAt(target, "sources").length} runtimeSecrets=${arrayAt(target, "runtimeSecrets").length}`;
|
|
return `keys=${Object.keys(target).length}`;
|
|
}
|
|
|
|
function renderWebProbeSentinelConfigPlan(value: WebProbeSentinelConfigPlan): string {
|
|
const blocked = value.ok ? [] : [
|
|
"",
|
|
"Blocked detail:",
|
|
sentinelTable(["KIND", "VALUE"], [
|
|
...value.conflicts.map((item) => ["conflict", short(item, 140)]),
|
|
...value.refs.flatMap((ref) => [
|
|
...(ref.error === null ? [] : [[`${ref.key}.error`, short(ref.error, 140)]]),
|
|
...(ref.missingFields.length === 0 ? [] : [[`${ref.key}.missing`, short(ref.missingFields.join(","), 140)]]),
|
|
...(ref.conflicts.length === 0 ? [] : [[`${ref.key}.conflict`, short(ref.conflicts.join(" | "), 140)]]),
|
|
]),
|
|
]),
|
|
];
|
|
return [
|
|
`web-probe sentinel ${commandAction(value.command)} (${value.status})`,
|
|
"",
|
|
sentinelTable(["NODE", "LANE", "SENTINEL", "ENABLED", "OK", "ROOT"], [[value.node, value.lane, value.sentinelId ?? "registry", value.enabled, value.ok, value.rootPath]]),
|
|
...(value.sentinels.length === 0 ? [] : [
|
|
"",
|
|
sentinelTable(
|
|
["SENTINEL", "ENABLED", "ROOT", "CONFIG_REF"],
|
|
value.sentinels.map((item) => [item.id, item.enabled, item.monitorRoot ? "monitor-root" : "-", short(item.configRef, 110)]),
|
|
),
|
|
]),
|
|
...(value.refs.length === 0 ? [
|
|
"",
|
|
"DRILL_DOWN",
|
|
...value.sentinels.map((item) => ` ${item.id}: bun scripts/cli.ts web-probe sentinel ${commandAction(value.command)} --node ${value.node} --lane ${value.lane} --sentinel ${item.id}`),
|
|
] : [
|
|
"",
|
|
sentinelTable(
|
|
["KEY", "PRESENT", "TARGET", "TYPE", "HASH", "MISSING", "SUMMARY"],
|
|
value.refs.map((ref) => [
|
|
ref.key,
|
|
ref.present,
|
|
ref.targetPresent,
|
|
ref.targetKind,
|
|
ref.sha256 === null ? "-" : `${ref.sha256.slice(0, 19)}...`,
|
|
ref.missingFields.length === 0 ? "-" : short(ref.missingFields.join(","), 52),
|
|
short(ref.summary, 90),
|
|
]),
|
|
),
|
|
"",
|
|
sentinelTable(
|
|
["KEY", "FILE", "PATH", "BYTES"],
|
|
value.refs.map((ref) => [ref.key, ref.file, ref.path, ref.byteCount ?? "-"]),
|
|
),
|
|
]),
|
|
...blocked,
|
|
"",
|
|
"NEXT",
|
|
` plan: ${value.next.plan}`,
|
|
` status: ${value.next.status}`,
|
|
"DISCLOSURE",
|
|
" valuesRedacted=true; secret values and full YAML objects are not printed.",
|
|
].join("\n");
|
|
}
|
|
|
|
function sentinelNext(node: string, lane: string, sentinelId: string | null): Record<string, string> {
|
|
const suffix = sentinelId === null ? "" : ` --sentinel ${sentinelId}`;
|
|
return {
|
|
plan: `bun scripts/cli.ts web-probe sentinel plan --node ${node} --lane ${lane}${suffix} --dry-run`,
|
|
status: `bun scripts/cli.ts web-probe sentinel status --node ${node} --lane ${lane}${suffix}`,
|
|
};
|
|
}
|
|
|
|
function valueAtPath(value: unknown, path: string): unknown {
|
|
let current: unknown = value;
|
|
for (const segment of path.split(".")) {
|
|
if (segment.length === 0) return undefined;
|
|
const match = /^(?:([A-Za-z0-9_-]+))?(?:\[(\d+)\])?$/u.exec(segment);
|
|
if (match === null) return undefined;
|
|
if (match[1] !== undefined) {
|
|
if (!isRecord(current)) return undefined;
|
|
current = current[match[1]];
|
|
}
|
|
if (match[2] !== undefined) {
|
|
if (!Array.isArray(current)) return undefined;
|
|
current = current[Number(match[2])];
|
|
}
|
|
}
|
|
return current;
|
|
}
|
|
|
|
function stringAt(value: unknown, path: string): string | null {
|
|
const found = valueAtPath(value, path);
|
|
return typeof found === "string" && found.length > 0 ? found : null;
|
|
}
|
|
|
|
function textAt(value: unknown, path: string): string {
|
|
const found = valueAtPath(value, path);
|
|
if (typeof found === "string") return found;
|
|
if (typeof found === "number" || typeof found === "boolean") return String(found);
|
|
return "-";
|
|
}
|
|
|
|
function arrayAt(value: unknown, path: string): unknown[] {
|
|
const found = valueAtPath(value, path);
|
|
return Array.isArray(found) ? found : [];
|
|
}
|
|
|
|
function recordTarget(ref: InternalConfigRefStatus | undefined): Record<string, unknown> | null {
|
|
return ref !== undefined && isRecord(ref.target) ? ref.target : null;
|
|
}
|
|
|
|
function arrayTarget(ref: InternalConfigRefStatus | undefined): Record<string, unknown>[] {
|
|
return ref !== undefined && Array.isArray(ref.target) ? ref.target.filter(isRecord) : [];
|
|
}
|
|
|
|
function scenarioTargets(ref: InternalConfigRefStatus | undefined): Record<string, unknown>[] {
|
|
if (ref === undefined) return [];
|
|
if (Array.isArray(ref.target)) return ref.target.filter(isRecord);
|
|
return isRecord(ref.target) ? [ref.target] : [];
|
|
}
|
|
|
|
function isRecord(value: unknown): value is Record<string, unknown> {
|
|
return typeof value === "object" && value !== null && !Array.isArray(value);
|
|
}
|
|
|
|
function targetKindOf(value: unknown): "object" | "array" | "scalar" | "null" {
|
|
if (value === null) return "null";
|
|
if (Array.isArray(value)) return "array";
|
|
if (isRecord(value)) return "object";
|
|
return "scalar";
|
|
}
|
|
|
|
function commandAction(command: string): string {
|
|
return command.includes(" status ") ? "status" : "plan";
|
|
}
|
|
|
|
function sentinelTable(headers: string[], rows: unknown[][]): string {
|
|
const normalized = [headers, ...rows.map((row) => row.map((cell) => sentinelText(cell)))];
|
|
const widths = headers.map((_, index) => Math.max(...normalized.map((row) => sentinelText(row[index] ?? "").length)));
|
|
return normalized.map((row) => row.map((cell, index) => sentinelText(cell).padEnd(widths[index])).join(" ").trimEnd()).join("\n");
|
|
}
|
|
|
|
function sentinelText(value: unknown): string {
|
|
if (value === null || value === undefined || value === "") return "-";
|
|
if (typeof value === "boolean") return value ? "true" : "false";
|
|
return String(value).replace(/\s+/gu, " ").trim();
|
|
}
|
|
|
|
function short(value: string, maxLength: number): string {
|
|
if (value.length <= maxLength) return value;
|
|
if (maxLength <= 1) return value.slice(0, maxLength);
|
|
return `${value.slice(0, maxLength - 1)}~`;
|
|
}
|