@afokapu/atdd-bun 0.10.99 → 0.10.100

package/integrity.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.10.99",
+  "version": "0.10.100",
   "files": {
     "HOOK_AUDIT.md": "5329d840db37671b1918f688ead26865473b87db73dbc75f7c8b2a8bbe8d6d43",
     "PLANNER_PORT.md": "fb5935bac8b7ac18994de21e43ace3a5ef8cd55f85b0e3349fca261280054f11",
@@ -1261,7 +1261,7 @@
     "src/cli.ts": "d93c3aebb78e752fd96347a5b177c0ed0697010c6e2533e116de93e772cd65a8",
     "src/docs-capability.ts": "bdeeb414649049b1cd4fa8008cada3a576318be51c43bec91bfa46a8e250c270",
     "src/enforce.ts": "e0c10519aeecd7080f2900ea230fad2f09482af47c1cee885d5de71573e29732",
-    "src/hooks.ts": "b96b5fee3a03c2f4c317d6725d6d21ed3133db18d0cdcdda72183cf05c7b6639",
+    "src/hooks.ts": "8194c2dec14afc307b5ce9e90f64d8659210c579d8f427492823293f302e2876",
     "src/index.ts": "4081f8b08d1d3ee9e15a9964143e53d9cfb94a5616ab3e58a180d24cc16dc381",
     "src/integrity.ts": "f1ede7cb04924ae88e11917047277e264af6596b9759e381bd9c497cd34a797d",
     "src/journey-docs.ts": "994d229376244c84212cff951032823068a76565dd2fd427b9d44e341bd14853",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@afokapu/atdd-bun",
-  "version": "0.10.99",
+  "version": "0.10.100",
   "repository": {
     "type": "git",
     "url": "git+https://github.com/afokapu/atdd-bun.git"

package/src/hooks.ts

@@ -61,44 +61,49 @@ async function ratchetCommitGate(root: string, staged: string[], registryChanged
   try { candidateConfig = Bun.YAML.parse(stagedConfig.out) as Record<string, unknown>; policy = parseRatchetPolicy(candidateConfig); }
   catch (error) { return bad(`ratchet activation commit gate configuration is invalid: ${String(error)}`); }
   if (policy?.mode !== "reject-new" || !Array.isArray(candidateConfig.profiles) || !candidateConfig.profiles.every(profile => typeof profile === "string")) return null;
-  if ((await git(root, ["diff", "--quiet"])).code !== 0 || (await git(root, ["ls-files", "--others", "--exclude-standard"])).out) return bad("ratchet activation commit gate requires no unstaged or untracked candidate state");
   const head = await git(root, ["rev-parse", "--verify", "HEAD^{commit}"]);
   if (head.code || !/^[0-9a-f]{40}$/i.test(head.out)) return bad("ratchet activation commit gate requires an exact committed HEAD base");
-  const scratch = await mkdtemp(join(tmpdir(), "atdd-ratchet-commit-gate-"));
+  let scratch: string | undefined;
   try {
+    scratch = await mkdtemp(join(tmpdir(), "atdd-ratchet-commit-gate-"));
     const added = await git(root, ["worktree", "add", "--detach", "--no-checkout", scratch, head.out]);
-    if (added.code) return bad(`could not materialize ratchet activation base: ${added.err || added.out}`);
+    if (added.code) throw new Error(`could not materialize ratchet activation base: ${added.err || added.out}`);
     const checkedOut = await git(scratch, ["checkout", "--detach", head.out]);
-    if (checkedOut.code) return bad(`could not checkout ratchet activation base: ${checkedOut.err || checkedOut.out}`);
+    if (checkedOut.code) throw new Error(`could not checkout ratchet activation base: ${checkedOut.err || checkedOut.out}`);
     const baseConfig = await configAt(scratch), candidateProfiles = stable(candidateConfig.profiles.map(normalizeProfileName));
     const baseProfiles = stable(await enabledProfiles(scratch));
     const policyMatches = stable(policy.profiles.map(normalizeProfileName)).join(",") === candidateProfiles.join(",");
     const activation = isStrictProfileExpansion(baseProfiles, candidateProfiles) && activationContextDigest(baseConfig) === activationContextDigest(candidateConfig);
     const unchanged = baseProfiles.join(",") === candidateProfiles.join(",") && contextDigest(baseConfig, baseProfiles) === contextDigest(candidateConfig, candidateProfiles);
     if (candidateProfiles.some(profile => !concreteProfiles.includes(profile as typeof concreteProfiles[number])) || !policyMatches || (!activation && !unchanged)) return bad("ratchet reject-new requires either unchanged explicit profiles/context or an explicit monotonic profile expansion with identical non-profile context");
-    const selectedProfiles = activation || staged.some(needsFullCommitRatchetProfiles) ? candidateProfiles : (await affectedProfiles(root, staged, registryChanged)).filter(profile => candidateProfiles.includes(profile));
     const tree = await git(root, ["write-tree"]);
     if (tree.code || !/^[0-9a-f]{40}$/i.test(tree.out)) return bad(`could not identify staged ratchet activation candidate: ${tree.err || tree.out}`);
     const baseTree = await git(root, ["rev-parse", "--verify", `${head.out}^{tree}`]);
     if (baseTree.code || !/^[0-9a-f]{40}$/i.test(baseTree.out)) return bad(`could not identify ratchet activation base tree: ${baseTree.err || baseTree.out}`);
-    const normalize = (findings: Awaited<ReturnType<typeof enforce>>) => findings.map(finding => ({ ...finding, file: canonicalFindingPath(scratch, finding.file) }));
-    // Scan and cache the unpatched HEAD before materializing the staged candidate; both keys remain exact Git trees.
-    const cacheDirectory = await findingsCacheDirectory(root), toolkit = await toolkitIdentity().catch(() => null);
-    const findingsAt = async (treeId: string) => cachedFindings(cacheDirectory, treeId, toolkit, selectedProfiles, async () => normalize(await enforce({ root: scratch, profiles: selectedProfiles as any })));
-    const baseFindings = selectedProfiles.length ? await findingsAt(baseTree.out) : [];
-    const patch = await git(root, ["diff", "--cached", "--binary"], undefined, true);
-    if (patch.code) return bad(`could not read staged ratchet activation candidate: ${patch.err || patch.out}`);
-    const applied = await git(scratch, ["apply", "--whitespace=nowarn"], patch.out);
-    if (applied.code) return bad(`could not materialize staged ratchet activation candidate: ${applied.err || applied.out}`);
+    // Scan only exact Git trees in private scratch: live unstaged/untracked bytes never enter, and cache keys stay tree IDs.
+    const materialize = async (treeId: string, label: string) => {
+      const reset = await git(scratch!, ["read-tree", "--reset", "-u", treeId]);
+      if (reset.code) throw new Error(`could not materialize ${label}: ${reset.err || reset.out}`);
+      const exact = await git(scratch!, ["write-tree"]);
+      if (exact.code || exact.out !== treeId) throw new Error(`${label} did not materialize exactly: ${exact.err || exact.out}`);
+    };
+    await materialize(tree.out, "staged ratchet activation candidate");
     const materialized = await configAt(scratch), materializedProfiles = stable(await enabledProfiles(scratch));
     const materializedContext = activation ? activationContextDigest(materialized) === activationContextDigest(candidateConfig) : materializedProfiles.join(",") === candidateProfiles.join(",") && contextDigest(materialized, materializedProfiles) === contextDigest(candidateConfig, candidateProfiles);
     if (!materializedContext) return bad("staged ratchet candidate did not materialize exactly");
+    const selectedProfiles = activation || staged.some(needsFullCommitRatchetProfiles) ? candidateProfiles : (await affectedProfiles(scratch, staged, registryChanged)).filter(profile => candidateProfiles.includes(profile));
+    const normalize = (findings: Awaited<ReturnType<typeof enforce>>) => findings.map(finding => ({ ...finding, file: canonicalFindingPath(scratch!, finding.file) }));
+    const cacheDirectory = await findingsCacheDirectory(root), toolkit = await toolkitIdentity().catch(() => null);
+    const findingsAt = async (treeId: string) => cachedFindings(cacheDirectory, treeId, toolkit, selectedProfiles, async () => normalize(await enforce({ root: scratch, profiles: selectedProfiles as any })));
+    await materialize(baseTree.out, "ratchet activation base tree");
+    const baseFindings = selectedProfiles.length ? await findingsAt(baseTree.out) : [];
+    await materialize(tree.out, "staged ratchet activation candidate");
     const candidateFindings = selectedProfiles.length ? await findingsAt(tree.out) : [];
     const delta = compareFindings(baseFindings, candidateFindings);
     const report = JSON.stringify({ schema: "atdd-bun.ratchet-report/v1", mode: policy.mode, base: head.out, candidate: tree.out, profiles: selectedProfiles, context: contextDigest(candidateConfig, candidateProfiles), ...delta });
     return { ok: delta.new.length === 0, message: report };
   } catch (error) { return bad(`ratchet activation commit gate failed closed: ${String(error)}`); }
-  finally { await git(root, ["worktree", "remove", "--force", scratch]); await rm(scratch, { recursive: true, force: true }); }
+  finally { if (scratch) { await git(root, ["worktree", "remove", "--force", scratch]); await rm(scratch, { recursive: true, force: true }); } }
 }
 
 /** A pushed reject-new candidate is judged from its immutable object IDs, never the hook's checkout or index. */