Add workspace policy checker (#179)

Author: chubes4

package.json

@@ -34,6 +34,7 @@
     "package-distribution-smoke": "tsx scripts/package-distribution-smoke.ts",
     "release:package": "tsx scripts/package-release-artifact.ts",
     "policy-validation-smoke": "tsx scripts/policy-validation-smoke.ts",
+    "workspace-policy-smoke": "tsx scripts/workspace-policy-smoke.ts",
     "artifact-contract-smoke": "tsx scripts/artifact-contract-smoke.ts",
     "external-adapter-contract-smoke": "tsx scripts/external-adapter-contract-smoke.ts",
     "runtime-episode-smoke": "tsx scripts/runtime-episode-smoke.ts",
@@ -57,7 +58,7 @@
     "recipe-staged-files-smoke": "tsx scripts/recipe-staged-files-smoke.ts",
     "wp-codebox": "node packages/cli/dist/index.js",
     "wordpress-plugin-smoke": "php tests/smoke-wordpress-plugin.php",
-    "check": "npm run build && npm run discovery-command-smoke && npm run theme-check-normalization-smoke && npm run agent-sandbox-code-smoke && npm run policy-validation-smoke && npm run wordpress-plugin-smoke && npm run package-distribution-smoke && npm run artifact-contract-smoke && npm run external-adapter-contract-smoke && npm run runtime-episode-smoke && npm run core-phpunit-command-smoke && npm run plugin-check-normalization-smoke && npm run recipe-bench-smoke && npm run recipe-dry-run-smoke && npm run recipe-workflow-phases-smoke && npm run recipe-site-seed-smoke && npm run recipe-staged-files-smoke && npm run preview-port-smoke && npm run preview-public-url-canonical-smoke && npm run preview-response-body-smoke && npm run boot-preview-smoke && npm run blueprint-validation-smoke && npm run browser-probe-artifact-smoke && npm run wp-codebox -- run --mount ./examples/simple-plugin:/wordpress/wp-content/plugins/simple-plugin --command wordpress.run-php --arg code-file=./examples/simple-plugin/probe.php --artifacts ./artifacts --json"
+    "check": "npm run build && npm run discovery-command-smoke && npm run theme-check-normalization-smoke && npm run agent-sandbox-code-smoke && npm run policy-validation-smoke && npm run workspace-policy-smoke && npm run wordpress-plugin-smoke && npm run package-distribution-smoke && npm run artifact-contract-smoke && npm run external-adapter-contract-smoke && npm run runtime-episode-smoke && npm run core-phpunit-command-smoke && npm run plugin-check-normalization-smoke && npm run recipe-bench-smoke && npm run recipe-dry-run-smoke && npm run recipe-workflow-phases-smoke && npm run recipe-site-seed-smoke && npm run recipe-staged-files-smoke && npm run preview-port-smoke && npm run preview-public-url-canonical-smoke && npm run preview-response-body-smoke && npm run boot-preview-smoke && npm run blueprint-validation-smoke && npm run browser-probe-artifact-smoke && npm run wp-codebox -- run --mount ./examples/simple-plugin:/wordpress/wp-content/plugins/simple-plugin --command wordpress.run-php --arg code-file=./examples/simple-plugin/probe.php --artifacts ./artifacts --json"
   },
   "workspaces": [
     "packages/*"

packages/cli/src/index.ts

@@ -8,7 +8,7 @@ import { basename, dirname, join, resolve } from "node:path"
 import { Readable } from "node:stream"
 import { pipeline } from "node:stream/promises"
 import { promisify } from "node:util"
-import { SANDBOX_DMC_PARENT_ONLY_ABILITIES, SANDBOX_DMC_SAFE_ABILITIES, SANDBOX_WORKSPACE_ROOT, createRuntime, validateRuntimePolicy, type ArtifactBundle, type ExecutionResult, type MountSpec, type Runtime, type RuntimeInfo, type RuntimePolicy, type SandboxWorkspaceContract, type SandboxWorkspaceMode, type WorkspaceRecipe, type WorkspaceRecipeExtraPlugin, type WorkspaceRecipeSiteSeed, type WorkspaceRecipeStagedFile, type WorkspaceRecipeWorkspace } from "@chubes4/wp-codebox-core"
+import { SANDBOX_DMC_PARENT_ONLY_ABILITIES, SANDBOX_DMC_SAFE_ABILITIES, SANDBOX_WORKSPACE_ROOT, checkWorkspacePolicy, createRuntime, validateRuntimePolicy, type ArtifactBundle, type ExecutionResult, type MountSpec, type Runtime, type RuntimeInfo, type RuntimePolicy, type SandboxWorkspaceContract, type SandboxWorkspaceMode, type WorkspacePolicyResult, type WorkspaceRecipe, type WorkspaceRecipeExtraPlugin, type WorkspaceRecipeSiteSeed, type WorkspaceRecipeStagedFile, type WorkspaceRecipeWorkspace } from "@chubes4/wp-codebox-core"
 import { createPlaygroundRuntimeBackend } from "@chubes4/wp-codebox-playground"
 import { agentRuntimeProbeCode, agentSandboxRunCode, resolveSandboxTaskCode } from "./agent-code.js"
 import { captureStdout, printBatchHumanOutput, printBlueprintValidateHumanOutput, printBootHumanOutput, printCommandCatalogHumanOutput, printHelp, printHumanOutput, printRecipeHumanOutput, printRecipeSchemaHumanOutput, printRecipeValidateHumanOutput, serializeError } from "./output.js"
@@ -130,6 +130,14 @@ interface RecipeValidateOptions {
   json: boolean
 }
 
+interface WorkspacePolicyOptions {
+  workspaceRoot: string
+  writableRoots: string[]
+  hiddenPaths: string[]
+  gitBacked: boolean
+  json: boolean
+}
+
 interface RecipeValidationIssue {
   code: string
   path: string
@@ -943,6 +951,30 @@ async function main(args: string[]): Promise<number> {
     return output.success ? 0 : 1
   }
 
+  if (command === "workspace-policy") {
+    const subcommand = args.shift()
+    if (subcommand !== "check") {
+      console.error(`Unknown workspace-policy command: ${subcommand ?? ""}`)
+      printHelp()
+      return 1
+    }
+
+    const options = parseWorkspacePolicyOptions(args)
+    const output = await checkWorkspacePolicy({
+      workspaceRoot: options.workspaceRoot,
+      writableRoots: options.writableRoots,
+      hiddenPaths: options.hiddenPaths,
+      gitBacked: options.gitBacked,
+    })
+    if (!options.json) {
+      printWorkspacePolicyHumanOutput(output)
+      return output.passed ? 0 : 1
+    }
+
+    process.stdout.write(`${JSON.stringify(output, null, 2)}\n`)
+    return output.passed ? 0 : 1
+  }
+
   if (command === "commands") {
     const json = parseDiscoveryJsonOption(args)
     const output = commandCatalogOutput()
@@ -1061,6 +1093,74 @@ function parseDiscoveryJsonOption(args: string[]): boolean {
   return json
 }
 
+function parseWorkspacePolicyOptions(args: string[]): WorkspacePolicyOptions {
+  const options: WorkspacePolicyOptions = {
+    workspaceRoot: process.cwd(),
+    writableRoots: [],
+    hiddenPaths: [],
+    gitBacked: false,
+    json: false,
+  }
+
+  while (args.length > 0) {
+    const arg = args.shift()
+    if (!arg) {
+      continue
+    }
+
+    if (arg === "--json") {
+      options.json = true
+      continue
+    }
+    if (arg === "--git") {
+      options.gitBacked = true
+      continue
+    }
+
+    const value = args.shift()
+    if (!value) {
+      throw new Error(`Missing value for ${arg}`)
+    }
+
+    switch (arg) {
+      case "--workspace":
+      case "--workspace-root":
+        options.workspaceRoot = resolve(value)
+        break
+      case "--writable-root":
+      case "--writable":
+        options.writableRoots.push(value)
+        break
+      case "--hidden-path":
+      case "--hidden":
+        options.hiddenPaths.push(value)
+        break
+      default:
+        throw new Error(`Unknown option: ${arg}`)
+    }
+  }
+
+  if (options.writableRoots.length === 0) {
+    throw new Error("At least one --writable-root is required")
+  }
+
+  return options
+}
+
+function printWorkspacePolicyHumanOutput(output: WorkspacePolicyResult): void {
+  console.log(output.passed ? "Workspace policy passed" : "Workspace policy failed")
+  console.log(`Policy: ${output.policy_sha256}`)
+  if (output.violations.length === 0) {
+    return
+  }
+
+  console.log("Violations:")
+  for (const violation of output.violations) {
+    console.log(`- ${violation.code}: ${violation.path}`)
+    console.log(`  ${violation.message}`)
+  }
+}
+
 function commandCatalogOutput(): CommandCatalogOutput {
   return {
     schema: "wp-codebox/command-catalog/v1",

packages/cli/src/output.ts

@@ -231,6 +231,7 @@ export function printHelp(): void {
   console.log(`Usage:
   wp-codebox commands [--json]
   wp-codebox schema recipe [--json]
+  wp-codebox workspace-policy check --workspace-root <path> --writable-root <path> [options]
   wp-codebox recipe validate --recipe <path> [--json]
   wp-codebox validate-blueprint --blueprint <json|file> [options]
   wp-codebox recipe-run --recipe <path> [options]
@@ -259,6 +260,14 @@ Options:
   --dry-run            Validate recipe-run and emit a resolved JSON plan without booting Playground or writing temp workspaces.
   --json               Emit machine-readable JSON.
 
+Workspace policy:
+  --workspace-root <dir>
+                       Workspace root to inspect. Defaults to the current directory.
+  --writable-root <path>
+                       Relative path that may be changed. Repeatable.
+  --hidden-path <path> Relative path that must not be changed or exposed. Repeatable.
+  --git                Use git status metadata, including ignored and unmerged entries.
+
 Discovery:
   commands             Print supported runtime and recipe command metadata.
   schema recipe        Print the wp-codebox/workspace-recipe/v1 JSON Schema.

packages/runtime-core/src/index.ts

@@ -1,3 +1,5 @@
+export * from "./workspace-policy.js"
+
 export type RuntimeBackendKind = "wordpress-playground" | (string & {})
 
 export const SANDBOX_WORKSPACE_ROOT = "/workspace"