@ashlr/hub 3.13.0 → 3.14.0

package/dist/build-identity.json

@@ -1,7 +1,7 @@
 {
   "schemaVersion": 1,
-  "packageVersion": "3.13.0",
-  "revision": "2d748fec0e41c3e05a5a4e19847f2418ed08e37b",
+  "packageVersion": "3.14.0",
+  "revision": "54c7e0401bab260405f157bb1d8d1306b92dcf92",
   "dirty": false,
   "provenance": "git"
 }

package/dist/cli/authority.js

@@ -368,12 +368,48 @@ async function cmdStatus(parsed, deps) {
         const merging = status.policy.repos.filter((repo) => repo.stage === 'merge').map((repo) => repo.nameWithOwner);
         deps.out(`Policy: ${status.policy.repos.length} repos (${merging.length} merging), engines ${status.policy.engines.join(', ')}, caps ${status.policy.merge.maxFiles}/${status.policy.merge.maxLines}`);
     }
+    for (const line of await enforcementStatusLines(deps))
+        deps.out(line);
     deps.out(`Ledger: ${status.ledger.state}${status.ledger.head ? `, ${status.ledger.head.seq + 1} entries, head ${status.ledger.head.hash.slice(0, 12)}` : ''}${status.ledger.reason ? ` — ${status.ledger.reason}` : ''}`);
     const c = status.custody;
     const yn = (v) => (v === null ? 'unknown' : v ? 'yes' : 'no');
     deps.out(`Custody: installed ${yn(c.installed)}, key ${yn(c.keyInitialized)}, GitHub App ${yn(c.githubApp)}, Claude token ${yn(c.claudeToken)}`);
     return 0;
 }
+/**
+ * `status`: does GitHub still enforce what the installed grant says? Only the
+ * grant's `server` repos are read (local ones need nothing from GitHub). A
+ * mismatch is REPORTED, never fixed here — the signed grant is only ever
+ * changed by a re-approval, which switches such a repo to local enforcement.
+ */
+async function enforcementStatusLines(deps) {
+    const { readInstalledGrant } = await import('../core/authority/standing-grant.js');
+    const installed = readInstalledGrant();
+    if (installed.state !== 'ok')
+        return [];
+    const grant = installed.envelope.payload;
+    const server = grant.repos.filter((repo) => repo.enforcement === 'server');
+    if (server.length === 0)
+        return [];
+    const { enforcementMismatch, probeServerEnforcementAll } = await import('../core/authority/server-enforcement.js');
+    const probes = await probeServerEnforcementAll(server.map((repo) => repo.nameWithOwner), ghGet(deps));
+    const lines = [];
+    const unread = [];
+    let enforced = 0;
+    for (const repo of server) {
+        const probe = probes.get(repo.nameWithOwner.toLowerCase());
+        const mismatch = enforcementMismatch(repo, probe, grant.grantSeq);
+        if (mismatch)
+            lines.push(`  ${mismatch}`);
+        else if (probe?.state === 'enforced')
+            enforced += 1;
+        else
+            unread.push(repo.nameWithOwner);
+    }
+    const head = `Enforcement: ${enforced}/${server.length} server-enforced repo(s) protected by GitHub` +
+        `${unread.length > 0 ? `; could not check ${shortList(unread)}` : ''}${lines.length > 0 ? ` — ${lines.length} mismatch${lines.length === 1 ? '' : 'es'}:` : ''}`;
+    return [head, ...lines];
+}
 const SWITCHES = ['off', 'propose', 'autonomous'];
 async function cmdSwitch(to, deps) {
     if (!to || !SWITCHES.includes(to)) {
@@ -453,7 +489,7 @@ async function cmdRevoke(parsed, deps) {
 async function cmdDraft(parsed, deps) {
     const { buildStandingGrantDraft } = await import('../core/verse/authority-api.js');
     const kind = parsed.flags.has('--new') ? 'new' : parsed.flags.has('--reapprove') ? 'reapprove' : 'auto';
-    const draft = await buildStandingGrantDraft(kind);
+    const draft = await buildStandingGrantDraft(kind, Date.now(), { githubGet: ghGet(deps) });
     if (parsed.flags.has('--json')) {
         deps.out(JSON.stringify({ kind: draft.kind, digest: draft.digest, payload: draft.payload }, null, 2));
         return 0;
@@ -501,7 +537,7 @@ async function cmdGrant(parsed, deps, kind) {
     }
     else {
         const { buildStandingGrantDraft } = await import('../core/verse/authority-api.js');
-        payload = (await buildStandingGrantDraft(kind)).payload;
+        payload = (await buildStandingGrantDraft(kind, Date.now(), { githubGet: ghGet(deps) })).payload;
     }
     deps.out(kind === 'new' ? 'You are about to sign this standing grant:' : 'You are about to re-approve (continue) this standing grant:');
     for (const line of describeGrantScope(payload))
@@ -639,6 +675,10 @@ export function buildFleetRuleset(requiredChecks) {
         ],
     };
 }
+/** A `gh api <path>` GET through the CLI's runner (tests inject it; the Verse probe's runner is read-only). */
+function ghGet(deps) {
+    return async (path) => deps.run('gh', ['api', path]);
+}
 async function ghJson(deps, args) {
     const result = await deps.run('gh', args);
     if (result.status !== 0)
@@ -738,8 +778,9 @@ export function rulesetMatches(desired, actual) {
 /**
  * The repos the fleet works in: the installed grant's, or — before the first
  * grant — the ones it would name (every enrolled checkout's GitHub repo plus
- * the canary; authority-api draftRepos), which are server-enforced until a
- * grant says otherwise. Read-only: no draft is built and the ledger is not
+ * the canary; authority-api draftRepos), whose enforcement is not known yet
+ * (null): the draft names `server` only where GitHub then enforces required
+ * checks (authority/server-enforcement.ts). Read-only: no draft is built and the ledger is not
  * touched, so a dry run (and Verse's checklist) can ask it freely.
  */
 async function setupTargetRepos() {
@@ -757,7 +798,7 @@ async function setupTargetRepos() {
             for (const path of registry.repos) {
                 const nameWithOwner = repoIdentityOfPath(path);
                 if (nameWithOwner && !byKey.has(nameWithOwner.toLowerCase()))
-                    byKey.set(nameWithOwner.toLowerCase(), { nameWithOwner, enforcement: 'server' });
+                    byKey.set(nameWithOwner.toLowerCase(), { nameWithOwner, enforcement: null });
             }
         }
     }
@@ -765,7 +806,7 @@ async function setupTargetRepos() {
         // An unreadable registry leaves the canary alone on the list.
     }
     if (!byKey.has(FLEET_CANARY_REPO))
-        byKey.set(FLEET_CANARY_REPO, { nameWithOwner: FLEET_CANARY_REPO, enforcement: 'server' });
+        byKey.set(FLEET_CANARY_REPO, { nameWithOwner: FLEET_CANARY_REPO, enforcement: null });
     return [...byKey.values()];
 }
 /** Read-only: what `protect --apply` would do for each repo (every gh call here is a GET). */
@@ -785,15 +826,57 @@ async function protectPlans(parsed, deps, given) {
     if (byGrant)
         for (const r of targets)
             grantMembers.add(r.nameWithOwner.toLowerCase());
+    const grantEnforcement = new Map();
+    if (installed.state === 'ok')
+        for (const r of installed.envelope.payload.repos)
+            grantEnforcement.set(r.nameWithOwner.toLowerCase(), r.enforcement);
+    const grantSeq = installed.state === 'ok' ? installed.envelope.payload.grantSeq : null;
+    const { classifyGithubReadFailure, describeGithubReadFailure, enforcementMismatch } = await import('../core/authority/server-enforcement.js');
+    const unreadable = (repo, error) => {
+        const message = error.message;
+        return { repo, skipped: `could not read it from GitHub (${describeGithubReadFailure(classifyGithubReadFailure({ message }))}): ${message}`, checks: [], ruleset: null, existingId: null, upToDate: false };
+    };
     let fleetApp;
     const plans = [];
     for (const { nameWithOwner: repo, enforcement } of targets) {
         if (enforcement === 'local') {
-            plans.push({ repo, skipped: 'local enforcement (private free-plan repo: GitHub rulesets unavailable) — the daemon enforces its gates', checks: [], ruleset: null, existingId: null, upToDate: false });
+            plans.push({ repo, skipped: `local enforcement in the grant — GitHub protects nothing here; the daemon enforces its gates and G7 requires the App's host-verified ${ASHLR_VERIFY_CHECK}`, checks: [], ruleset: null, existingId: null, upToDate: false });
             continue;
         }
+        let info;
         try {
-            const info = await ghJson(deps, ['api', `repos/${repo}`]);
+            info = await ghJson(deps, ['api', `repos/${repo}`]);
+        }
+        catch (error) {
+            plans.push(unreadable(repo, error));
+            continue;
+        }
+        // Rulesets before anything else: on GitHub Free a PRIVATE repo has neither
+        // rulesets nor classic branch protection (both answer 403 "Upgrade to
+        // GitHub Pro or make this repository public…", verified live), which is a
+        // plan limit — not a permission problem and not a network error — so it is
+        // reported as such, and only `local` enforcement can work there.
+        const listed = await deps.run('gh', ['api', `repos/${repo}/rulesets`]);
+        if (listed.status !== 0 && classifyGithubReadFailure({ message: listed.stderr }) === 'plan-unavailable') {
+            const kind = info?.private === false ? 'repo' : 'private repo';
+            const mismatch = grantEnforcement.get(repo.toLowerCase()) === 'server'
+                ? enforcementMismatch({ nameWithOwner: repo, enforcement: 'server' }, { nameWithOwner: repo, state: 'unavailable', private: info?.private ?? null, failure: 'plan-unavailable', detail: '' }, grantSeq)
+                : null;
+            plans.push({
+                repo,
+                skipped: mismatch ?? `rulesets unavailable on this plan for ${kind} ${repo} — using local enforcement with ${ASHLR_VERIFY_CHECK}`,
+                checks: [],
+                ruleset: null,
+                existingId: null,
+                upToDate: false,
+                unavailable: true,
+                mismatch,
+            });
+            continue;
+        }
+        try {
+            if (listed.status !== 0)
+                throw new Error(`gh api repos/${repo}/rulesets failed: ${listed.stderr.trim().slice(0, 200)}`);
             let verifyAppId = null;
             let verifyNote = null;
             if (grantMembers.has(repo.toLowerCase())) {
@@ -811,7 +894,7 @@ async function protectPlans(parsed, deps, given) {
             }
             const required = await discoverChecks(deps, repo, info?.default_branch ?? 'main', verifyAppId);
             const checks = required.map((check) => check.context);
-            const existing = await ghJson(deps, ['api', `repos/${repo}/rulesets`]);
+            const existing = JSON.parse(listed.stdout || 'null');
             const match = Array.isArray(existing) ? existing.find((r) => r.name === FLEET_RULESET_NAME) : undefined;
             const existingId = typeof match?.id === 'number' && Number.isSafeInteger(match.id) ? match.id : null;
             const ruleset = buildFleetRuleset(required);
@@ -829,7 +912,7 @@ async function protectPlans(parsed, deps, given) {
             });
         }
         catch (error) {
-            plans.push({ repo, skipped: `could not read it from GitHub: ${error.message}`, checks: [], ruleset: null, existingId: null, upToDate: false });
+            plans.push(unreadable(repo, error));
         }
     }
     return plans;
@@ -1692,9 +1775,16 @@ async function runSetup(parsed, deps, opts) {
             const stale = plans.filter((plan) => !plan.skipped && !plan.upToDate);
             const inPlace = plans.filter((plan) => !plan.skipped && plan.upToDate).length;
             const unreadable = plans.filter((plan) => plan.skipped?.startsWith('could not read')).map((plan) => plan.repo);
-            const byHand = plans.filter((plan) => plan.skipped && !plan.skipped.startsWith('could not read')).length;
+            const unavailable = plans.filter((plan) => plan.unavailable === true);
+            const mismatches = unavailable.map((plan) => plan.mismatch).filter((m) => typeof m === 'string');
+            const byHand = plans.filter((plan) => plan.skipped && !plan.unavailable && !plan.skipped.startsWith('could not read')).length;
             const unread = unreadable.length > 0 ? `; could not read ${shortList(unreadable)} from GitHub` : '';
-            const left = byHand > 0 ? `; ${byHand} left to you (local enforcement or no CI)` : '';
+            // A plan limit is not a read failure: say which repos only local enforcement can protect.
+            const noRulesets = unavailable.length > 0
+                ? `; rulesets unavailable on this plan for private ${shortList(unavailable.map((plan) => plan.repo))} — ${mismatches.length > 0 ? mismatches.join('; ') : `using local enforcement with ${ASHLR_VERIFY_CHECK}`}`
+                : '';
+            const left = `${byHand > 0 ? `; ${byHand} left to you (local enforcement or no CI)` : ''}${noRulesets}`;
+            const inPlaceText = inPlace > 0 ? `the fleet ruleset is in place on ${inPlace === 1 ? '1 repo' : `${inPlace} repos`}` : 'no repo has the fleet ruleset';
             if (plans.length === 0) {
                 // Nothing to look at yet — never "in place on 0 repos".
                 if (canaryExists)
@@ -1706,19 +1796,23 @@ async function runSetup(parsed, deps, opts) {
                 const where = shortList(stale.map((plan) => plan.repo));
                 if (await ask(`Apply the fleet ruleset to ${stale.length} repo(s) where it is missing or different (${where})?`)) {
                     const failures = await applyProtectPlans(stale, deps);
-                    note('rulesets', failures > 0 ? 'failed' : unreadable.length > 0 ? 'waiting-on-you' : 'done', failures === 0
+                    note('rulesets', failures > 0 ? 'failed' : unreadable.length > 0 || mismatches.length > 0 ? 'waiting-on-you' : 'done', failures === 0
                         ? `applied to ${where}${inPlace > 0 ? `; ${inPlace} already in place` : ''}${unread}${left}`
-                        : `${failures} of ${stale.length} failed (see above)${unread}`);
+                        : `${failures} of ${stale.length} failed (see above)${unread}${noRulesets}`);
                 }
                 else {
-                    note('rulesets', dryRun ? 'skipped' : 'waiting-on-you', `${stale.length} repo(s) need the fleet ruleset (${where})${unread} — run \`ashlr authority protect --print\`, then \`--apply\``);
+                    note('rulesets', dryRun ? 'skipped' : 'waiting-on-you', `${stale.length} repo(s) need the fleet ruleset (${where})${unread}${noRulesets} — run \`ashlr authority protect --print\`, then \`--apply\``);
                 }
             }
             else if (unreadable.length > 0) {
-                note('rulesets', 'waiting-on-you', `could not read ${shortList(unreadable)} from GitHub — check \`gh auth status\`, then rerun setup${inPlace > 0 ? ` (${inPlace} already in place)` : ''}`);
+                note('rulesets', 'waiting-on-you', `could not read ${shortList(unreadable)} from GitHub — check \`gh auth status\`, then rerun setup${inPlace > 0 ? ` (${inPlace} already in place)` : ''}${noRulesets}`);
+            }
+            else if (mismatches.length > 0) {
+                // The signed grant is never rewritten here: only a re-approval (Touch ID) switches the repo.
+                note('rulesets', 'waiting-on-you', `${inPlaceText}${left}`, { command: 'ashlr authority re-approve' });
             }
             else {
-                note('rulesets', 'already', `the fleet ruleset is in place on ${inPlace === 1 ? '1 repo' : `${inPlace} repos`}${left}`);
+                note('rulesets', 'already', `${inPlaceText}${left}`);
             }
         }
         // 8. Retire the burned activation directory.
@@ -1781,7 +1875,7 @@ async function runSetup(parsed, deps, opts) {
         else if (await ask('Sign the first standing grant now (Touch ID)?')) {
             try {
                 const { buildStandingGrantDraft } = await import('../core/verse/authority-api.js');
-                const draft = await buildStandingGrantDraft('auto');
+                const draft = await buildStandingGrantDraft('auto', Date.now(), { githubGet: ghGet(deps) });
                 for (const line of draft.summary)
                     deps.out(`    ${line}`);
                 const signed = await signAndInstall(draft.payload, deps);