xtask/patterns/

checks.rs

use anyhow::Result;
use std::{fs, path::Path};
use walkdir::WalkDir;

use super::{
    reporter::PatternReporter,
    util::{
        contains_top_level_json_key, display_path, effective_loc, is_size_exempt, is_test_file,
        read_file, size_limit,
    },
};

const REQUIRED_PATTERN_FILES: &[&str] = &[
    "crates/soma/client/src/client.rs",
    "crates/soma/application/src/service.rs",
    // actions.rs/config.rs moved from crates/soma/contracts to
    // crates/soma/domain / crates/soma/config (plan section 6.2; PR 13);
    // app.rs/service.rs moved from crates/soma/service into
    // crates/soma/application (PR 19). Both legacy crates are deleted;
    // check the real canonical locations, not the removed facades.
    "crates/soma/domain/src/actions.rs",
    "crates/soma/mcp/src/lib.rs",
    "crates/soma/mcp/src/tools.rs",
    "crates/soma/mcp/src/schemas.rs",
    "crates/soma/mcp/src/rmcp_server.rs",
    "apps/soma/src/http.rs",
    "crates/soma/mcp/src/prompts.rs",
    "crates/soma/config/src/config.rs",
    "crates/soma/cli/src/lib.rs",
    "apps/soma/src/bin/soma.rs",
    "apps/soma/src/lib.rs",
    "apps/soma/tests/tool_dispatch.rs",
    "config.soma.toml",
    "taplo.toml",
    "lefthook.yml",
    "install.sh",
    "entrypoint.sh",
    "server.json",
];

const FORBIDDEN_SHIM_TOKENS: &[&str] = &[
    "reqwest::",
    "hyper::Client",
    "sqlx::",
    "rusqlite::",
    "tokio::fs",
    "std::fs",
    "std::process::Command",
    "Command::new",
];

pub(super) fn required_files(reporter: &mut PatternReporter) {
    let missing = REQUIRED_PATTERN_FILES
        .iter()
        .copied()
        .filter(|path| !Path::new(path).is_file())
        .collect::<Vec<_>>();

    if missing.is_empty() {
        reporter.ok(
            "required-files",
            format!("{} expected files present", REQUIRED_PATTERN_FILES.len()),
        );
    } else {
        reporter.fail(
            "required-files",
            format!("missing pattern files: {}", missing.join(", ")),
        );
    }
}

pub(super) fn no_mod_rs(reporter: &mut PatternReporter) {
    let mod_files = WalkDir::new(".")
        .into_iter()
        .filter_entry(|entry| {
            let name = entry.file_name().to_string_lossy();
            !matches!(name.as_ref(), ".git" | "target")
        })
        .filter_map(|entry| entry.ok())
        .filter(|entry| entry.file_type().is_file() && entry.file_name() == "mod.rs")
        .map(|entry| display_path(entry.path()))
        .collect::<Vec<_>>();

    if mod_files.is_empty() {
        reporter.ok("modern-rust", "no mod.rs files found");
    } else {
        reporter.fail(
            "modern-rust",
            format!("mod.rs files are prohibited: {}", mod_files.join(", ")),
        );
    }
}

pub(super) fn file_sizes(reporter: &mut PatternReporter) -> Result<()> {
    let output = crate::run_cmd_output("git", &["ls-files", "*.rs", "*.ts", "*.tsx"])?;
    let mut warnings = Vec::new();
    let mut failures = Vec::new();

    for line in output.lines().filter(|line| !line.trim().is_empty()) {
        let path = Path::new(line);
        if !path.exists() {
            continue;
        }
        if is_test_file(path) {
            continue;
        }
        if is_size_exempt(path) {
            continue;
        }
        let Some(limit) = size_limit(path) else {
            continue;
        };
        let loc = effective_loc(path)?;
        if loc > limit * 2 {
            failures.push(format!(
                "{}: {loc} effective lines (hard limit {})",
                display_path(path),
                limit * 2
            ));
        } else if loc > limit {
            warnings.push(format!(
                "{}: {loc} effective lines (target {limit})",
                display_path(path)
            ));
        }
    }

    if !failures.is_empty() {
        reporter.fail(
            "file-size",
            format!(
                "module size hard-limit violation(s): {}",
                failures.join("; ")
            ),
        );
    }
    if !warnings.is_empty() {
        reporter.warn(
            "file-size",
            format!(
                "above PATTERNS.md target; split opportunistically: {}. Hint: move unrelated UI, CLI, or handler concerns into focused modules.",
                warnings.join("; ")
            ),
        );
    }
    if failures.is_empty() && warnings.is_empty() {
        reporter.ok(
            "file-size",
            "source files are within PATTERNS.md size targets",
        );
    }
    Ok(())
}

pub(super) fn thin_shims(reporter: &mut PatternReporter) {
    let policies = [
        (
            "crates/soma/mcp/src/tools.rs",
            &["state.application()", ".execute_action("][..],
            FORBIDDEN_SHIM_TOKENS,
        ),
        (
            "crates/soma/cli/src/lib.rs",
            &["SomaApplication", ".execute_action("][..],
            &["reqwest::", "hyper::Client", "sqlx::", "rusqlite::"][..],
        ),
        (
            "crates/soma/api/src/api.rs",
            &[".application()", ".execute_action("][..],
            FORBIDDEN_SHIM_TOKENS,
        ),
    ];

    for (path, required, forbidden) in policies {
        let text = read_file(path);
        let missing = required
            .iter()
            .copied()
            .filter(|token| !text.contains(token))
            .collect::<Vec<_>>();
        let found_forbidden = forbidden
            .iter()
            .copied()
            .filter(|token| text.contains(token))
            .collect::<Vec<_>>();

        if !missing.is_empty() {
            reporter.warn(
                "thin-shim",
                format!(
                    "{path} does not contain expected delegation token(s): {}. Hint: shims should parse inputs and delegate to SomaApplication.",
                    missing.join(", ")
                ),
            );
        }
        if !found_forbidden.is_empty() {
            reporter.fail(
                "thin-shim",
                format!(
                    "{path} contains forbidden implementation token(s): {}. Hint: move network, filesystem, and business logic into service/client layers.",
                    found_forbidden.join(", ")
                ),
            );
        }
        if missing.is_empty() && found_forbidden.is_empty() {
            reporter.ok("thin-shim", format!("{path} looks like a delegation shim"));
        }
    }
}

pub(super) fn routes(reporter: &mut PatternReporter) {
    let routes = read_file("apps/soma/src/http.rs");
    let missing = ["\"/mcp\"", "\"/health\"", "\"/status\""]
        .iter()
        .copied()
        .filter(|route| !routes.contains(route))
        .collect::<Vec<_>>();

    if missing.is_empty() {
        reporter.ok("routes", "MCP, health, and status routes are wired");
    } else {
        reporter.fail(
            "routes",
            format!("missing expected HTTP route(s): {}", missing.join(", ")),
        );
    }
}

pub(super) fn plugins(reporter: &mut PatternReporter) {
    let manifests = WalkDir::new("plugins")
        .into_iter()
        .filter_map(|entry| entry.ok())
        .filter(|entry| entry.file_type().is_file() && entry.file_name() == "plugin.json")
        .map(|entry| entry.into_path())
        .collect::<Vec<_>>();

    let failures = manifests
        .iter()
        .filter_map(|manifest| {
            let text = fs::read_to_string(manifest).ok()?;
            contains_top_level_json_key(&text, "version").then(|| {
                format!(
                    "{} contains forbidden version field",
                    display_path(manifest)
                )
            })
        })
        .collect::<Vec<_>>();

    if failures.is_empty() {
        reporter.ok(
            "plugins",
            format!("{} plugin manifest(s) omit version", manifests.len()),
        );
    } else {
        reporter.fail("plugins", failures.join("; "));
    }

    let hook_path = Path::new("plugins/soma/hooks/hooks.json");
    if hook_path.exists() {
        let hook = read_file("plugins/soma/hooks/hooks.json");
        // The hook must call the installed PATH binary directly (no plugin-setup.sh wrapper).
        if hook.contains("plugin-setup.sh") {
            reporter.fail(
                "plugins",
                "hooks.json must not reference the removed plugin-setup.sh wrapper",
            );
        } else if !hook.contains("soma setup plugin-hook") {
            reporter.fail(
                "plugins",
                "hooks.json must call `soma setup plugin-hook` directly",
            );
        } else {
            reporter.ok(
                "plugins",
                "plugin hooks call the binary's setup plugin-hook directly",
            );
        }
    }
}

pub(super) fn config_and_auth(reporter: &mut PatternReporter) {
    let gitignore = read_file(".gitignore");
    if gitignore.contains(".env") {
        reporter.ok("config", ".env is ignored");
    } else {
        reporter.fail("config", ".gitignore should ignore .env secrets");
    }

    let server = read_file("crates/soma/runtime/src/server.rs");
    // config.rs moved from crates/soma/contracts to crates/soma/config
    // (plan section 3.18; PR 13). crates/soma/contracts was deleted in PR 19.
    let config = read_file("crates/soma/config/src/config.rs");
    if !server.contains("LoopbackDev") || !server.contains("Mounted") {
        reporter.fail(
            "auth",
            "AuthPolicy should include LoopbackDev and Mounted states",
        );
    } else if !config.contains("no_auth") || !config.contains("allowed_hosts") {
        reporter.warn(
            "auth",
            "config.rs may be missing no_auth/allowed_hosts policy wiring. Hint: keep bind/auth safety checks centralized in config/server setup.",
        );
    } else {
        reporter.ok("auth", "auth policy states and config toggles are present");
    }
}

pub(super) fn tooling(reporter: &mut PatternReporter) {
    let lefthook = read_file("lefthook.yml");
    let taplo = read_file("taplo.toml");
    let mut missing = Vec::new();

    // Check that the scripts CI relies on for enforcement actually exist.
    // Checking scripts rather than Justfile targets means this passes even when
    // the Justfile is restructured, and fails when a script is accidentally deleted.
    for script in [
        "scripts/check-schema-docs.py",
        "scripts/check-openapi.py",
        "scripts/check-scaffold-intent-contract.py",
        "scripts/validate-plugin-layout.sh",
        "scripts/test-soma-features.sh",
    ] {
        if !Path::new(script).is_file() {
            missing.push(script.to_string());
        }
    }

    if !lefthook.contains("taplo check") {
        missing.push("lefthook.yml:taplo check".to_string());
    }
    if !taplo.contains("column_width") {
        missing.push("taplo.toml:formatting".to_string());
    }

    if missing.is_empty() {
        reporter.ok(
            "tooling",
            "CI enforcement scripts, lefthook, and taplo config are present",
        );
    } else {
        reporter.fail(
            "tooling",
            format!(
                "missing expected tooling component(s): {}",
                missing.join(", ")
            ),
        );
    }
}