@arjunkhera/atlas 0.4.44 → 0.4.45

package/.claude-plugin/plugin.json

@@ -1,6 +1,6 @@
 {
   "name": "atlas",
-  "version": "0.4.44",
+  "version": "0.4.45",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, for any repository.",
   "author": {
     "name": "Arjun Khera"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@arjunkhera/atlas",
-  "version": "0.4.44",
+  "version": "0.4.45",
   "description": "Atlas: the delivery lifecycle, its crews and the Atlas tools, as a Claude Code plugin for any repository.",
   "type": "module",
   "license": "UNLICENSED",

package/shape/check.mjs

@@ -38,7 +38,7 @@ export const sha256 = (text) => createHash('sha256').update(String(text ?? ''),
 // Whether a copy is current or behind is not decided here. CI has no package
 // and no network. The session verb decides it, from the release list that
 // ships beside this file in the package, shape/releases.json.
-export const CHECK_VERSION = 8;
+export const CHECK_VERSION = 9;
 
 // ---------------------------------------------------------------------------
 // The spec. One object per version. The check reads a version it has here and
@@ -1550,6 +1550,33 @@ export function counts(files) {
 // check version 6 five cases switched the rule off and printed a warning that
 // a person merges the file. Nothing switches it off now. The base copy scores,
 // and the base kind and spec score both trees, so no case needs to.
+// A head whose atlas.yaml names a spec that this copy of the check cannot
+// read. A head with no spec, or with an atlas.yaml that does not read, is not
+// one: those stay errors.
+export function headSpecUnread(facts) {
+  const spec = facts?.spec;
+  return spec !== undefined && spec !== null && spec !== '' && !Object.hasOwn(SPECS, String(spec));
+}
+
+// The head of a move to a newer spec: no part is scored, but every file the
+// newer spec can read for facts is swept for secrets. That is atlas.yaml, each
+// file under atlas/, and each facts file that atlas.yaml points to by a plain
+// path. The trust checks of the pattern list and the owner_only checks run as
+// in scan, so a newer spec cannot turn either of them from red into owner.
+export function sweepHead({ root, repoId = null, secretPatterns: patterns = secretPatterns() }) {
+  const { facts } = readFacts(root);
+  const errors = [...ownerOnlyErrors(facts)];
+  const usable = Array.isArray(patterns) && patterns.every((pattern) => pattern instanceof RegExp) ? patterns : [];
+  if (!usable.length) errors.push('the secret pattern list is empty or is not a list of patterns, so a credential value could not be caught; this check cannot be trusted');
+  const missed = canaryMisses();
+  if (missed.length) errors.push(`${missed.length} secret pattern(s) no longer catch their own canary: ${missed.join(', ')}; this check cannot be trusted`);
+  const context = { root, secretPatterns: usable, errors };
+  const files = facts?.files && typeof facts.files === 'object' && !Array.isArray(facts.files) ? facts.files : {};
+  const pointed = Object.values(files).filter((path) => plainPath(path) && isFile(root, path));
+  for (const path of new Set(['atlas.yaml', ...walk(root, 'atlas'), ...pointed])) secretIn(context, path, readText(root, path));
+  return { ok: false, check_version: CHECK_VERSION, repo: repoId, kind: null, spec: facts?.spec ?? null, swept_only: true, files: [], by_reference: [], counts: counts([]), errors };
+}
+
 export const OWNER_CASES = Object.freeze(['check-file', 'workflow', 'kind', 'spec', 'moved', 'first-run']);
 
 const fileHash = (root, path) => { const text = readText(root, path); return text === null ? null : sha256(text); };
@@ -1633,8 +1660,9 @@ export function noLoss({ headRoot, baseRoot, baseSha = null, baseCommit = null,
   if (String(out.head_facts.kind) !== String(scoreAs.kind)) {
     owner('kind', `atlas.yaml names kind "${scoreAs.kind}" at the base and "${out.head_facts.kind}" at the head; this pull request changes which parts the repo needs`);
   }
+  const unread = Object.hasOwn(SPECS, String(scoreAs.spec)) && headSpecUnread(headRead.facts);
   if (String(out.head_facts.spec) !== String(scoreAs.spec)) {
-    owner('spec', `atlas.yaml names spec "${scoreAs.spec}" at the base and "${out.head_facts.spec}" at the head; this pull request changes what the spec version means`);
+    owner('spec', `atlas.yaml names spec "${scoreAs.spec}" at the base and "${out.head_facts.spec}" at the head; this pull request changes what the spec version means${unread ? `; this copy of the check, check version ${CHECK_VERSION}, cannot read spec "${out.head_facts.spec}", so it did not score the head and only swept it for secrets` : ''}`);
   }
 
   // 3. Does the diff change the gate itself? The base copy judges, so the
@@ -1645,6 +1673,12 @@ export function noLoss({ headRoot, baseRoot, baseSha = null, baseCommit = null,
     }
   }
 
+  // A head on a spec this copy cannot read is a move to a newer spec. This
+  // copy has no yardstick for the head, so it compares nothing. The spec row
+  // above sends it to the owner, and the gate still sweeps the head for
+  // secrets (roadmap R62: the base copy judged the move to spec 3 red).
+  if (unread) return out;
+
   // 4. Score both trees, by the same yardstick, and compare part by part. The
   // head is scored twice: at its own pointers, and at the base's.
   const base = scan({ root: baseRoot, repoId, secretPatterns: patterns, scoreAs });
@@ -1988,7 +2022,9 @@ export function gateFromGit({ git, baseCommit, headCommit, repoId = null, trees
     }
     mkdirSync(baseRoot, { recursive: true });
     mkdirSync(headRoot, { recursive: true });
-    const report = scan({ root: headRoot, repoId, secretPatterns: patterns });
+    const baseFacts = readFacts(baseRoot).facts;
+    const swept = baseFacts && Object.hasOwn(SPECS, String(baseFacts.spec)) && headSpecUnread(readFacts(headRoot).facts);
+    const report = swept ? sweepHead({ root: headRoot, repoId, secretPatterns: patterns }) : scan({ root: headRoot, repoId, secretPatterns: patterns });
     const state = noLoss({ headRoot, baseRoot, baseCommit: mergeBase, repoId, secretPatterns: patterns });
     // A link or a submodule that the head adds or changes is never read, so the
     // check cannot judge it. The owner reads it.

package/shape/releases.json

@@ -47,6 +47,11 @@
       "check_version": 8,
       "sha256": "8cf521f6e8f89ae65a257c521c583281e0c3c27ef968b4bd96eb336a8d095795",
       "workflow_sha256": "fcddebef030e6564f97e1a5fb81c8ad1b3084ebef9622167c6565698312dcdd7"
+    },
+    {
+      "check_version": 9,
+      "sha256": "87896abfc09afd22724cfa645bbb5ef029d83887caf70f38b88d00b21cddef02",
+      "workflow_sha256": "fcddebef030e6564f97e1a5fb81c8ad1b3084ebef9622167c6565698312dcdd7"
     }
   ]
 }