@alexcodeplace/slopgate 0.3.0 → 0.3.3

package/README.md

@@ -93,6 +93,28 @@ slopgate baseline --prune --config .slopgate/config.toml
 slopgate --self-test --config "$(npm root -g)/slopgate/rules/baseline/selftest.config.toml"
 ```
 
+### Run immutable full-repository CI gate:
+```bash
+slopgate scan --scope repo --tier commit --format github --config .slopgate/config.toml
+```
+
+### Record reviewer defects and enforce rule harvesting:
+```bash
+slopgate defect record --class missing-button-type --file src/app.tsx --line 42 --source code-review --config .slopgate/config.toml
+slopgate harvest --check --config .slopgate/config.toml
+```
+
+Second distinct occurrence requires `.slopgate/rules/ast/<class>.yml` plus `.slopgate/fixtures/<class>.invalid.ts[x]` and `<class>.valid.ts[x]`. `--self-test` proves rule fires on configured fixtures.
+
+### Reusable GitHub gate:
+```yaml
+jobs:
+  slopgate:
+    uses: alexcodeplace/slopgate/.github/workflows/slopgate.yml@v1
+```
+
+Self-hosted jobs reject fork pull requests before checkout. Use repository-owned branches or isolated disposable runners for untrusted forks.
+
 ### Install or reinstall hooks:
 ```bash
 slopgate install-hooks --config .slopgate/config.toml
@@ -701,12 +723,10 @@ Tool crash / timeout → `⚠ skipped: <id> (<reason>)` warning, gate continues
 
 - **Git-only** — no other VCS support
 - **No auto-fix** — violations are reported, not automatically corrected
-- **No CI integration yet** — hooks are local and Claude Code only; CI layer is future work
 - **`slopgate audit` command** — planned for v2 (non-gating architecture-health report: hotspots, module shape, co-change coupling, ratchet progress tracking)
 - **Embeddings-based semantic duplicate detection** — planned, not in v1
 - **API-surface diff gate** — track breaking changes to public exports (future)
 - **LLM-judge skill** — on-demand deep review of architectural debt (separate sub-project)
-- **Rule harvesting** — auto-generate rules from repeated violations (separate sub-project)
 
 ---
 

package/hooks/commit-hook.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Slopgate PreToolUse hook — runs --staged before a git commit. Exit 1 → commit blocked.
 TOOL_JSON=$(cat)
-CMD=$(node -e "
+CMD=$(/usr/bin/bun -e "
 let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{process.stdout.write(JSON.parse(d).tool_input?.command||'')}catch{process.stdout.write('')}});" <<< "$TOOL_JSON" 2>/dev/null)
 echo "$CMD" | grep -qE 'git[[:space:]]+commit' || exit 0
 
@@ -9,4 +9,4 @@ ROOT=$(git rev-parse --show-toplevel 2>/dev/null) || exit 0
 CONFIG="$ROOT/.slopgate/config.toml"
 [ -f "$CONFIG" ] || exit 0
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-exec node "$HERE/../bin/slopgate" --staged --config "$CONFIG"
+exec /usr/bin/bun "$HERE/../bin/slopgate" --staged --config "$CONFIG"

package/hooks/edit-hook.sh

@@ -2,7 +2,7 @@
 # Slopgate PostToolUse hook — single-file scan after Edit/Write.
 # Exit 2 → stderr feeds back into the agent turn. FAIL-OPEN: any error/timeout → exit 0.
 TOOL_JSON=$(cat)
-FILE=$(node -e "
+FILE=$(/usr/bin/bun -e "
 let d='';process.stdin.on('data',c=>d+=c).on('end',()=>{try{process.stdout.write(JSON.parse(d).tool_input?.file_path||'')}catch{process.stdout.write('')}});" <<< "$TOOL_JSON" 2>/dev/null) || exit 0
 [ -n "$FILE" ] || exit 0
 case "$FILE" in *.test.ts|*.test.tsx) exit 0 ;; *.ts|*.tsx|*.astro) ;; *) exit 0 ;; esac
@@ -14,6 +14,6 @@ CONFIG="$ROOT/.slopgate/config.toml"
 [ -f "$CONFIG" ] || exit 0
 
 HERE="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
-OUT=$(timeout 5 node "$HERE/../bin/slopgate" --file "$FILE" --config "$CONFIG" 2>&1)
+OUT=$(timeout 5 /usr/bin/bun "$HERE/../bin/slopgate" --file "$FILE" --config "$CONFIG" 2>&1)
 [ "$?" -eq 1 ] && { echo "$OUT" >&2; exit 2; }
 exit 0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alexcodeplace/slopgate",
-  "version": "0.3.0",
+  "version": "0.3.3",
   "type": "module",
   "description": "Global code-quality / anti-slop gate — engine shared, rules per-project.",
   "license": "MIT",
@@ -22,7 +22,6 @@
     "rules",
     "skills",
     "vendor",
-    "!rules/baseline/fixtures",
     "!bin/slopgate-rs"
   ],
   "engines": {

package/rules/baseline/fixtures/checker-outputs/depcruise.expected.json

@@ -0,0 +1,5 @@
+[
+  { "rule": "no-circular", "severity": "error", "from": "src/a.ts", "to": "src/b.ts" },
+  { "rule": "no-orphans", "severity": "warn", "from": "src/orphan.ts", "to": "src/orphan.ts" },
+  { "rule": "fyi-only", "severity": "info", "from": "src/ui/page.ts", "to": "src/db/client.ts" }
+]

package/rules/baseline/fixtures/checker-outputs/depcruise.json

@@ -0,0 +1,11 @@
+{
+  "summary": {
+    "violations": [
+      { "type": "cycle", "from": "src/a.ts", "to": "src/b.ts", "rule": { "severity": "error", "name": "no-circular" } },
+      { "type": "module", "from": "src/orphan.ts", "to": "src/orphan.ts", "rule": { "severity": "warn", "name": "no-orphans" } },
+      { "type": "dependency", "from": "src/ui/page.ts", "to": "src/db/client.ts", "rule": { "severity": "info", "name": "fyi-only" } }
+    ],
+    "error": 1, "warn": 1, "info": 1
+  },
+  "modules": []
+}

package/rules/baseline/fixtures/checker-outputs/jscpd.expected.json

@@ -0,0 +1,3 @@
+[
+  { "firstFile": "src/features/a.ts", "firstStart": 10, "firstEnd": 27, "secondFile": "src/features/b.ts", "secondStart": 40, "secondEnd": 57, "lines": 18 }
+]

package/rules/baseline/fixtures/checker-outputs/jscpd.json

@@ -0,0 +1,13 @@
+{
+  "duplicates": [
+    {
+      "format": "typescript",
+      "lines": 18,
+      "tokens": 120,
+      "firstFile": { "name": "src/features/a.ts", "start": 10, "end": 27, "startLoc": { "line": 10, "column": 1 }, "endLoc": { "line": 27, "column": 2 } },
+      "secondFile": { "name": "src/features/b.ts", "start": 40, "end": 57, "startLoc": { "line": 40, "column": 1 }, "endLoc": { "line": 57, "column": 2 } },
+      "fragment": "function dup() { /* body */ }"
+    }
+  ],
+  "statistics": {}
+}

package/rules/baseline/fixtures/checker-outputs/knip.expected.json

@@ -0,0 +1,6 @@
+[
+  { "type": "files", "file": "src/orphan.ts", "line": 1, "name": "src/orphan.ts" },
+  { "type": "exports", "file": "src/util.ts", "line": 14, "name": "unusedHelper" },
+  { "type": "types", "file": "src/util.ts", "line": 2, "name": "UnusedType" },
+  { "type": "dependencies", "file": "package.json", "line": 12, "name": "left-pad" }
+]

package/rules/baseline/fixtures/checker-outputs/knip.json

@@ -0,0 +1,31 @@
+{
+  "files": ["src/orphan.ts"],
+  "issues": [
+    {
+      "file": "src/util.ts",
+      "dependencies": [],
+      "devDependencies": [],
+      "optionalPeerDependencies": [],
+      "unlisted": [],
+      "binaries": [],
+      "unresolved": [],
+      "exports": [{ "name": "unusedHelper", "line": 14, "col": 14, "pos": 300 }],
+      "types": [{ "name": "UnusedType", "line": 2, "col": 13, "pos": 30 }],
+      "enumMembers": {},
+      "duplicates": []
+    },
+    {
+      "file": "package.json",
+      "dependencies": [{ "name": "left-pad", "line": 12, "col": 6, "pos": 200 }],
+      "devDependencies": [],
+      "optionalPeerDependencies": [],
+      "unlisted": [],
+      "binaries": [],
+      "unresolved": [],
+      "exports": [],
+      "types": [],
+      "enumMembers": {},
+      "duplicates": []
+    }
+  ]
+}

package/rules/baseline/fixtures/checker-outputs/tsc.expected.json

@@ -0,0 +1,5 @@
+[
+  { "file": "src/a.ts", "line": 12, "code": "TS2322", "message": "Type 'string' is not assignable to type 'number'." },
+  { "file": "src/b.tsx", "line": 3, "code": "TS2304", "message": "Cannot find name 'foo'." },
+  { "file": "src/long.ts", "line": 7, "code": "TS2345", "message": "Argument of type '{ a: string; }' is not assignable to parameter of type 'Opts'. Property 'b' is missing in type '{ a: string; }' but required in type 'Opts'." }
+]

package/rules/baseline/fixtures/checker-outputs/tsc.txt

@@ -0,0 +1,4 @@
+src/a.ts(12,5): error TS2322: Type 'string' is not assignable to type 'number'.
+src/b.tsx(3,1): error TS2304: Cannot find name 'foo'.
+src/long.ts(7,9): error TS2345: Argument of type '{ a: string; }' is not assignable to parameter of type 'Opts'.
+  Property 'b' is missing in type '{ a: string; }' but required in type 'Opts'.

package/rules/baseline/fixtures/checker-outputs/type-coverage.expected.json

@@ -0,0 +1,5 @@
+[
+  { "file": "src/api/handler.ts", "line": 42, "name": "data" },
+  { "file": "src/api/handler.ts", "line": 55, "name": "response" },
+  { "file": "src/legacy/blob.ts", "line": 7, "name": "payload" }
+]

package/rules/baseline/fixtures/checker-outputs/type-coverage.txt

@@ -0,0 +1,5 @@
+/repo/src/api/handler.ts:42:18: data
+/repo/src/api/handler.ts:55:3: response
+src/legacy/blob.ts:7:10: payload
+2912 / 2930 99.38%
+type-coverage success.

package/rules/baseline/fixtures/src/canary.tsx

@@ -0,0 +1,25 @@
+// Fixture for slopgate self-test. Contains deliberate canary tokens.
+// no-stubs SHOULD match stub markers (not bare placeholder UI/i18n tokens):
+// placeholder for now
+// TODO: implement later
+// not implemented
+export const x = __SLOPGATE_AST_CANARY__;
+// negative: must NOT match no-stubs — placeholder={...}, placeholder: class, i18n keys
+const _neg = <input placeholder={t('x')} className="placeholder:text-ink" />;
+const _titleKey = admin.incidents.titlePlaceholder;
+const namePlaceholder = 1;
+// ts-suppress SHOULD match @ts-* only (not eslint-disable):
+// @ts-ignore
+/* eslint-disable zync/no-raw-html-in-pages */
+// changed from foo to bar
+function bad(el: HTMLElement) { el.innerHTML = '<b>hi</b>'; }
+// live-secrets canary:
+const _sk = "sk_live_aaaaaaaaaaaa";
+// eval-ban canary:
+// eval(userCode);  — commented to avoid actual eval in fixture
+const _evalStr = 'eval(userCode)';
+// pii-logs canary:
+console.log(user.phone, user.email);
+// weak-hash canary:
+// createHash('md5') — weak hash
+const _wh = "createHash('md5').update(data)";

package/rules/baseline/fixtures/src/components/window-in-render.tsx

@@ -0,0 +1,4 @@
+export function Loc() {
+  const href = window.location.href;
+  return <span>{href}</span>;
+}

package/rules/baseline/fixtures/src/empty-catch.ts

@@ -0,0 +1,3 @@
+export function swallow(fn: () => void) {
+  try { fn(); } catch (e) {}
+}

package/rules/baseline/fixtures/src/empty-catch.tsx

@@ -0,0 +1,4 @@
+export function Swallow({ fn }: { fn: () => void }) {
+  try { fn(); } catch (e) {}
+  return <div />;
+}

package/rules/baseline/fixtures/src/target-blank.tsx

@@ -0,0 +1,3 @@
+export function Link() {
+  return <a target="_blank" href="https://example.com">x</a>;
+}

package/rules/baseline/fixtures/src/ux-ast.tsx

@@ -0,0 +1,43 @@
+// Fixtures for the UX module ast rules. Each construct below must trigger
+// exactly the rule named in its comment (selftest asserts every yml fires).
+// Parsed syntactically by ast-grep — no imports / type-checking involved.
+
+// triggers ux-div-onclick — onClick on a non-semantic element, no role
+export const ClickyDiv = () => <div onClick={onThing}>Open</div>;
+
+// triggers ux-img-no-dimensions — <img> with alt but no width/height
+export const Hero = () => <img src="/hero.png" alt="hero" />;
+
+// triggers ux-img-no-alt — <img> with dimensions but no alt
+export const NoAlt = () => <img src="/x.png" width={32} height={32} />;
+
+// triggers ux-anchor-no-href — <a onClick> with no href
+export const FakeLink = () => <a onClick={onThing}>go</a>;
+
+// triggers ux-button-no-type — <button> with no explicit type
+export const BareButton = () => <button onClick={onThing}>Save</button>;
+
+// triggers ux-media-no-dimensions — <iframe> with no width/height
+export const Embed = () => <iframe src="/player" />;
+
+// triggers ux-async-onclick-no-disable — async onClick, no disabled (type set so
+// it does NOT also trip ux-button-no-type)
+export const AsyncSave = () => <button type="button" onClick={async () => save()}>Save</button>;
+
+// triggers ux-modal-no-close — Dialog with no onClose/onDismiss/onOpenChange
+export const Sheet = ({ open }) => <Dialog open={open}>body</Dialog>;
+
+// negative: all of these are correct and must NOT trigger anything
+export const Ok = () => (
+  <>
+    <button type="button" onClick={onThing}>Open</button>
+    <button type="button" disabled onClick={async () => save()}>Save</button>
+    <a href="/page" onClick={onThing}>real link</a>
+    <img src="/ok.png" alt="ok" width={320} height={200} />
+    <Dialog open onOpenChange={onThing}>ok</Dialog>
+  </>
+);
+
+function onThing() {}
+function save() {}
+declare const Dialog: (props: Record<string, unknown>) => unknown;