carson 2.9.0 → 2.11.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 45443353a34297748fec8177c152d898dabb8cf7f1641d7870b7aff59d9a2f6c
-  data.tar.gz: 627bdc81dcf78ad41998840796a3427512c39b6b2e80e2b961895bdf4423a456
+  metadata.gz: ef5d5bfa64c8a8b7f4d2b4893dd5a3cab05ab2f154bd12ab926837ae396c2fe2
+  data.tar.gz: 106a0dc1a54c05e59ba9fe4eb0d01f647c420ac305d92a5d70cbc3c606300006
 SHA512:
-  metadata.gz: 96a9e858b5d934d5e5570443e25b79e28255cfe54279623be8d44474e55d592a7c9cd3161da8611d84fd24141cd10a98b6922fb364609630d843f651858bf78c
-  data.tar.gz: ee85efae91e54e07d872c560ad7305553b3d45246f9ec502b6fef5b7d1e6e843c8a03787629adb55190541cf5101be76a3f3ee625ec31540876b718905013ba4
+  metadata.gz: 1c1d53528fa822f8d7e4850234a039459f56053762ed8ed1982e7a27c2b1f7fd7820f6565afc2a8cda596971ce4dfab2e2288aeabf8b92e54e2cc5e9266ab213
+  data.tar.gz: 04755a262052a630f8200089d03ff1f5a7c48ab8e68f50097fcdd206a8672da988d51c5f041384752a7d97712854b054aa4fd85b2b7268989190ea248d33bf1f

data/API.md

@@ -95,6 +95,7 @@ Environment overrides:
 - `CARSON_REVIEW_DISPOSITION_PREFIX`
 - `CARSON_REVIEW_SWEEP_WINDOW_DAYS`
 - `CARSON_REVIEW_SWEEP_STATES`
+- `CARSON_WORKFLOW_STYLE`
 - `CARSON_RUBY_INDENTATION`
 
 `lint.languages` schema:

data/MANUAL.md

@@ -212,6 +212,7 @@ Common environment overrides:
 | `CARSON_REVIEW_DISPOSITION_PREFIX` | Required prefix for disposition comments. |
 | `CARSON_REVIEW_SWEEP_WINDOW_DAYS` | Lookback window for review sweep. |
 | `CARSON_REVIEW_SWEEP_STATES` | PR states to include in sweep. |
+| `CARSON_WORKFLOW_STYLE` | Workflow style override (`branch` or `trunk`). |
 | `CARSON_RUBY_INDENTATION` | Ruby indentation policy (`tabs`, `spaces`, or `either`). |
 
 For the full configuration schema and `lint.languages` definition, see `API.md`.

data/RELEASE.md

@@ -5,6 +5,31 @@ Release-note scope rule:
 - `RELEASE.md` records only version deltas, breaking changes, and migration actions.
 - Operational usage guides live in `MANUAL.md` and `API.md`.
 
+## 2.11.0 — Self-Diagnosing Audit and Duplicate-Remote Prevention
+
+### What changed
+
+- **Audit concise output now names the remote and suggests recovery actions.** "Main sync (origin): ahead by 1 — git fetch origin, or carson setup to switch remote." instead of the opaque "Main sync: ahead by 1 — reset local drift." The remote name is visible; the fix is embedded.
+- **Setup warns when multiple remotes share the same URL.** Interactive mode annotates duplicates with `[duplicate]` and prints a warning. Silent mode logs a `duplicate_remotes:` verbose line. URL normalisation treats SSH and HTTPS variants as equal (`git@github.com:user/repo.git` matches `https://github.com/user/repo`).
+
+### What users must do now
+
+1. Upgrade Carson to `2.11.0`.
+2. If you have duplicate remotes (e.g. both `origin` and `github` pointing to the same URL), remove the stale one with `git remote remove <name>`.
+
+## 2.10.0 — Lower Ruby Requirement to 3.4
+
+### What changed
+
+- **Minimum Ruby version lowered from 4.0 to 3.4.** Carson uses no Ruby 4.0-specific features. Lowering to 3.4 widens compatibility to the current stable Ruby series while enabling the `it` implicit block parameter.
+- **Removed `# frozen_string_literal: true` pragma** from the one file that had it (`lib/carson/policy/ruby/lint.rb`). Ruby 4.0 freezes strings by default; the pragma is unnecessary.
+- **Default workflow style now actually `branch` in code.** The 2.9.0 release notes documented this change, but the hooks and config default were not updated. Now fixed: hooks fall back to `branch`, config default is `branch`, and `CARSON_WORKFLOW_STYLE` env override is documented.
+
+### What users must do now
+
+1. Upgrade Carson to `2.10.0`.
+2. Ruby 3.4 or later is now sufficient — Ruby 4.0 is no longer required.
+
 ## 2.9.0 — Concise UX for All Commands
 
 ### What changed
@@ -14,16 +39,19 @@ Release-note scope rule:
 - **Audit concise output.** A healthy audit prints one line (`Audit: ok`). Problems print only actionable summaries (e.g. `Hooks: mismatch — run carson prepare.`).
 - **Refresh concise output.** Prints ~5 lines: hooks installed, templates in sync, audit result, done.
 - **All other commands.** `prepare`, `inspect`, `offboard`, `template check/apply`, `prune`, `review gate/sweep`, `govern`, `lint setup`, `setup`, and `housekeep` all follow the same concise/verbose pattern.
+- **Default workflow style changed from `trunk` to `branch`.** All governed repositories now enforce PR-only merges by default. Direct commits, merge commits, and pushes to protected branches (`main`/`master`) are blocked by hooks unless explicitly opted out.
 
 ### What users must do now
 
 1. Upgrade Carson to `2.9.0`.
 2. Use `--verbose` when you need full diagnostics (debugging, CI troubleshooting).
+3. If you rely on direct commits to main, re-run `carson setup` and choose `trunk`, or set `CARSON_WORKFLOW_STYLE=trunk` in your environment.
 
 ### Breaking or removed behaviour
 
 - Default output is now concise. Scripts that parse Carson's key-value diagnostic lines must add `--verbose`.
 - Removed `@concise` internal flag (replaced by `--verbose` opt-in pattern).
+- Default `workflow.style` changed from `trunk` to `branch`. Repositories that previously relied on the implicit `trunk` default will now block direct commits to protected branches. Escape hatches: run `carson setup` to choose `trunk`, or set `CARSON_WORKFLOW_STYLE=trunk`.
 
 ### Upgrade steps
 
@@ -41,16 +69,14 @@ carson version
 - **Concise onboard output.** `carson onboard` now prints a clean 8-line summary instead of verbose internal state (hook paths, template statuses, config lines). Tells users what happened, what needs attention, and what to do next.
 - **Graceful handling of fresh repos.** Onboard no longer fails with a fatal error on repositories with no commits yet.
 - **Suppressed RubyGems PATH warning.** The misleading `WARNING: You don't have ... in your PATH, gem executables will not run` message from `gem install --user-install` is now suppressed during installation. Carson symlinks the executable to `~/.carson/bin`, making the gem bin directory irrelevant.
-- **Default workflow style changed from `trunk` to `branch`.** All governed repositories now enforce PR-only merges by default. Direct commits, merge commits, and pushes to protected branches (`main`/`master`) are blocked by hooks unless explicitly opted out.
 
 ### What users must do now
 
 1. Upgrade Carson to `2.8.1`.
-2. If you rely on direct commits to main, re-run `carson setup` and choose `trunk`, or set `CARSON_WORKFLOW_STYLE=trunk` in your environment.
 
 ### Breaking or removed behaviour
 
-- Default `workflow.style` changed from `trunk` to `branch`. Repositories that previously relied on the implicit `trunk` default will now block direct commits to protected branches. Escape hatches: run `carson setup` to choose `trunk`, or set `CARSON_WORKFLOW_STYLE=trunk`.
+- None.
 
 ### Upgrade steps
 

data/VERSION

@@ -1 +1 @@
-2.9.0
+2.11.0

data/carson.gemspec

@@ -11,7 +11,7 @@ Gem::Specification.new do |spec|
 	spec.description = "Carson runs outside host repositories and applies governance checks, review gates, and managed GitHub-native files."
 	spec.homepage = "https://github.com/wanghailei/carson"
 	spec.license = "MIT"
-	spec.required_ruby_version = ">= 4.0"
+	spec.required_ruby_version = ">= 3.4"
 	spec.metadata = {
 		"source_code_uri" => "https://github.com/wanghailei/carson",
 		"changelog_uri" => "https://github.com/wanghailei/carson/blob/main/RELEASE.md",

data/hooks/pre-merge-commit

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 hooks_dir="$(cd "$(dirname "$0")" && pwd)"
-style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "trunk")"
+style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "branch")"
 [ "$style" = "trunk" ] && exit 0
 
 branch_name="$(git rev-parse --abbrev-ref HEAD)"

data/hooks/pre-push

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 hooks_dir="$(cd "$(dirname "$0")" && pwd)"
-style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "trunk")"
+style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "branch")"
 [ "$style" = "trunk" ] && exit 0
 
 remote_name="${1:-unknown}"

data/hooks/prepare-commit-msg

@@ -2,7 +2,7 @@
 set -euo pipefail
 
 hooks_dir="$(cd "$(dirname "$0")" && pwd)"
-style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "trunk")"
+style="$(cat "$hooks_dir/workflow_style" 2>/dev/null || echo "branch")"
 [ "$style" = "trunk" ] && exit 0
 
 branch_name="$(git rev-parse --abbrev-ref HEAD)"

data/lib/carson/config.rb

@@ -53,7 +53,7 @@ module Carson
 					"languages" => default_lint_languages_data
 				},
 				"workflow" => {
-					"style" => "trunk"
+					"style" => "branch"
 				},
 				"review" => {
 					"bot_usernames" => [],

data/lib/carson/policy/ruby/lint.rb

@@ -1,5 +1,4 @@
 #!/usr/bin/env ruby
-# frozen_string_literal: true
 
 require "open3"
 

data/lib/carson/runtime/audit.rb

@@ -46,13 +46,13 @@ module Carson
 					puts_verbose "main_vs_remote_main_behind: #{behind_count}"
 					puts_verbose "ACTION: local #{config.main_branch} is ahead of #{config.git_remote}/#{config.main_branch} by #{ahead_count} commit#{plural_suffix( count: ahead_count )}; reset local drift before commit/push workflows."
 					audit_state = "block"
-					audit_concise_problems << "Main sync: ahead by #{ahead_count} — reset local drift."
+					audit_concise_problems << "Main sync (#{config.git_remote}): ahead by #{ahead_count} — git fetch #{config.git_remote}, or carson setup to switch remote."
 				elsif behind_count.positive?
 					puts_verbose "main_vs_remote_main_ahead: #{ahead_count}"
 					puts_verbose "main_vs_remote_main_behind: #{behind_count}"
 					puts_verbose "ACTION: local #{config.main_branch} is behind #{config.git_remote}/#{config.main_branch} by #{behind_count} commit#{plural_suffix( count: behind_count )}; run carson sync."
 					audit_state = "attention" if audit_state == "ok"
-					audit_concise_problems << "Main sync: behind by #{behind_count} — run carson sync."
+					audit_concise_problems << "Main sync (#{config.git_remote}): behind by #{behind_count} — run carson sync."
 				else
 					puts_verbose "main_vs_remote_main_ahead: 0"
 					puts_verbose "main_vs_remote_main_behind: 0"

data/lib/carson/runtime/setup.rb

@@ -1,3 +1,6 @@
+require "set"
+require "uri"
+
 module Carson
 	class Runtime
 		module Setup
@@ -51,6 +54,15 @@ module Carson
 					puts_verbose "detected_remote: none"
 				end
 
+				remotes = list_git_remotes
+				duplicates = duplicate_remote_groups( remotes: remotes )
+				unless duplicates.empty?
+					duplicates.each_value do |group|
+						names = group.map { it.fetch( :name ) }.join( " and " )
+						puts_verbose "duplicate_remotes: #{names} share the same URL"
+					end
+				end
+
 				branch = detect_main_branch
 				if branch && branch != config.main_branch
 					choices[ "git.main_branch" ] = branch
@@ -69,9 +81,18 @@ module Carson
 					return nil
 				end
 
+				duplicates = duplicate_remote_groups( remotes: remotes )
+				duplicate_names = duplicates.values.flatten.map { it.fetch( :name ) }.to_set
+				unless duplicates.empty?
+					duplicates.each_value do |group|
+						names = group.map { it.fetch( :name ) }.join( " and " )
+						puts_line "Remotes #{names} share the same URL. Consider removing the duplicate."
+					end
+				end
+
 				puts_line ""
 				puts_line "Git remote"
-				options = build_remote_options( remotes: remotes )
+				options = build_remote_options( remotes: remotes, duplicate_names: duplicate_names )
 				options << { label: "Other (enter name)", value: :other }
 
 				default_index = 0
@@ -151,12 +172,13 @@ module Carson
 				value.empty? ? nil : value
 			end
 
-			def build_remote_options( remotes: )
+			def build_remote_options( remotes:, duplicate_names: Set.new )
 				sorted = sort_remotes( remotes: remotes )
 				sorted.map do |entry|
 					name = entry.fetch( :name )
 					url = entry.fetch( :url )
-					{ label: "#{name} (#{url})", value: name }
+					tag = duplicate_names.include?( name ) ? " [duplicate]" : ""
+					{ label: "#{name} (#{url})#{tag}", value: name }
 				end
 			end
 
@@ -173,6 +195,35 @@ module Carson
 				well_known.sort_by { |e| WELL_KNOWN_REMOTES.index( e.fetch( :name ) ) || 999 } + others.sort_by { |e| e.fetch( :name ) }
 			end
 
+			# Normalises a remote URL so SSH and HTTPS variants of the same host/path compare equal.
+			# Strips trailing .git, lowercases, converts git@host:path to https://host/path.
+			def normalise_remote_url( url: )
+				text = url.to_s.strip
+				return "" if text.empty?
+
+				# Convert SSH shorthand (git@host:owner/repo) to HTTPS form.
+				if text.match?( /\A[\w.-]+@[\w.-]+:/ )
+					text = text.sub( /\A[\w.-]+@([\w.-]+):/, 'https://\1/' )
+				end
+
+				text = text.delete_suffix( ".git" )
+				text = text.chomp( "/" )
+				text.downcase
+			end
+
+			# Groups remotes that share the same normalised URL. Returns a hash of
+			# normalised_url => [remote entries] for groups with more than one member.
+			def duplicate_remote_groups( remotes: )
+				by_url = {}
+				remotes.each do |entry|
+					key = normalise_remote_url( url: entry.fetch( :url ) )
+					next if key.empty?
+
+					( by_url[ key ] ||= [] ) << entry
+				end
+				by_url.select { |_url, entries| entries.length > 1 }
+			end
+
 			def build_main_branch_options
 				options = []
 				main_exists = branch_exists_locally_or_remote?( branch: "main" )

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: carson
 version: !ruby/object:Gem::Version
-  version: 2.9.0
+  version: 2.11.0
 platform: ruby
 authors:
 - Hailei Wang
@@ -88,7 +88,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: '4.0'
+      version: '3.4'
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="