@attalabs/vinaya 0.2.0 → 0.3.0

package/dist/index.js

@@ -1470,11 +1470,79 @@ function installSignalForwarding() {
   process.on("SIGINT", () => forward("SIGINT", 130));
   process.on("SIGTERM", () => forward("SIGTERM", 143));
 }
-async function runOne(spec, timeoutMs) {
+var ENV_BASELINE_KEYS = ["PATH", "LANG", "HOME", "HTTPS_PROXY", "HTTP_PROXY", "NO_PROXY", "TMPDIR"];
+function buildCheckEnv(env, callerEnv = process.env) {
+  const out = {};
+  for (const key of ENV_BASELINE_KEYS) {
+    const value = callerEnv[key];
+    if (value !== undefined)
+      out[key] = value;
+  }
+  if (!env)
+    return out;
+  for (const [key, decl] of Object.entries(env)) {
+    if (decl === true || typeof decl === "object" && "optional" in decl) {
+      const value = callerEnv[key];
+      if (value !== undefined)
+        out[key] = value;
+    } else if (typeof decl === "object" && "anyOf" in decl) {
+      for (const member of decl.anyOf) {
+        const value = callerEnv[member];
+        if (value !== undefined)
+          out[member] = value;
+      }
+    } else if (typeof decl === "string") {
+      out[key] = decl;
+    }
+  }
+  return out;
+}
+function missingEnvErrors(spec, callerEnv) {
+  if (!spec.env)
+    return [];
+  const errors = [];
+  for (const [key, decl] of Object.entries(spec.env)) {
+    if (decl === true) {
+      if (callerEnv[key] === undefined) {
+        errors.push({
+          schema: CHECK_SCHEMA_VERSION,
+          check: spec.name,
+          severity: "error",
+          message: `Could not run check "${spec.name}": required environment variable \`${key}\` is not set.`,
+          agent_recovery_prompt: `Set \`${key}\` in the environment before re-running \`vinaya check ${spec.name}\`, or relax its declaration to \`{ optional: true }\` in its \`env\` registration if the check can tolerate absence.`
+        });
+      }
+    } else if (typeof decl === "object" && decl !== null && "anyOf" in decl) {
+      const satisfied = decl.anyOf.some((member) => callerEnv[member] !== undefined);
+      if (!satisfied) {
+        errors.push({
+          schema: CHECK_SCHEMA_VERSION,
+          check: spec.name,
+          severity: "error",
+          message: `Could not run check "${spec.name}": none of its required environment variables (${decl.anyOf.join(", ")}) are set.`,
+          agent_recovery_prompt: `Set one of ${decl.anyOf.join(", ")} in the environment before re-running \`vinaya check ${spec.name}\`.`
+        });
+      }
+    }
+  }
+  return errors;
+}
+async function runOne(spec, timeoutMs, callerEnv) {
   const start = performance.now();
+  const envErrors = missingEnvErrors(spec, callerEnv);
+  if (envErrors.length > 0) {
+    return {
+      name: spec.name,
+      status: "error",
+      exitCode: null,
+      errors: envErrors,
+      durationMs: performance.now() - start
+    };
+  }
   const proc = spawn(spec.run, spec.args ?? [], {
     stdio: ["ignore", "pipe", "pipe"],
-    detached: true
+    detached: true,
+    env: buildCheckEnv(spec.env, callerEnv)
   });
   function killTree(signal) {
     const pid = proc.pid;
@@ -1590,6 +1658,7 @@ async function runOne(spec, timeoutMs) {
   return { name: spec.name, status, exitCode, errors, durationMs };
 }
 async function runChecks(specs, opts) {
+  const callerEnv = opts.callerEnv ?? process.env;
   const results = new Array(specs.length);
   const toRun = [];
   for (let i = 0;i < specs.length; i++) {
@@ -1606,7 +1675,7 @@ async function runChecks(specs, opts) {
       const idx = toRun[cursor];
       cursor += 1;
       const spec = specs[idx];
-      results[idx] = await runOne(spec, spec.timeoutMs ?? opts.defaultTimeoutMs);
+      results[idx] = await runOne(spec, spec.timeoutMs ?? opts.defaultTimeoutMs, callerEnv);
     }
   };
   const workerCount = Math.max(1, Math.min(opts.parallel, toRun.length));
@@ -1781,31 +1850,6 @@ function loadConfigChecked() {
   return { ok: true, config: parsed.data };
 }
 
-// src/lib/env-lint.ts
-import { existsSync as existsSync5, readFileSync as readFileSync2 } from "node:fs";
-var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
-function checksMissingEnvDeclaration(specs) {
-  const names = [];
-  for (const spec of specs) {
-    if (spec.env)
-      continue;
-    if (!existsSync5(spec.run))
-      continue;
-    let source;
-    try {
-      source = readFileSync2(spec.run, "utf8");
-    } catch {
-      continue;
-    }
-    if (ENV_READ_PATTERN.test(source))
-      names.push(spec.name);
-  }
-  return names;
-}
-function envDeclarationWarning(name) {
-  return `check "${name}" reads environment variables directly but declares no \`env\` — it will lose environment access at the next minor. Declare \`env\` for it (CheckSpec['env'] in src/checks/contract.ts, or vinaya.config.json's checks.<name>.env).`;
-}
-
 // src/commands/check.ts
 function git(args) {
   try {
@@ -1868,9 +1912,6 @@ async function checkCommand(args) {
     console.error(`Unknown check: ${requestedName}`);
     process.exit(2);
   }
-  for (const name of checksMissingEnvDeclaration(specsToRun)) {
-    console.error(`⚠ ${envDeclarationWarning(name)}`);
-  }
   const changed = diffOnly ? changedFiles() : null;
   const outcomes = specsToRun.length > 0 ? await runChecks(specsToRun, {
     parallel: requestedParallel ?? defaultParallelism(),
@@ -1901,7 +1942,7 @@ async function checkCommand(args) {
 
 // src/commands/demo.ts
 import { execFileSync as execFileSync5, spawnSync } from "node:child_process";
-import { existsSync as existsSync6, readFileSync as readFileSync3, rmSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { existsSync as existsSync5, readFileSync as readFileSync2, rmSync, unlinkSync, writeFileSync as writeFileSync2 } from "node:fs";
 import { isAbsolute, join as join5 } from "node:path";
 var DEMO_BRANCH_PREFIX = "vinaya/demo-break-";
 var FIXTURE_PATH = ".vinaya-demo-brief.md";
@@ -1944,9 +1985,9 @@ function gitDirAbs(repoRoot) {
 function recoverFromCrash(repoRoot, statePath) {
   const currentBranch = currentBranchName(repoRoot);
   let state = null;
-  if (existsSync6(statePath)) {
+  if (existsSync5(statePath)) {
     try {
-      state = JSON.parse(readFileSync3(statePath, "utf-8"));
+      state = JSON.parse(readFileSync2(statePath, "utf-8"));
     } catch {
       state = null;
     }
@@ -2016,14 +2057,14 @@ function cleanup(repoRoot, originalBranch, demoBranch, statePath) {
   gitCapture(repoRoot, ["clean", "-fd"]);
   gitCapture(repoRoot, ["checkout", originalBranch]);
   gitCapture(repoRoot, ["branch", "-D", demoBranch]);
-  if (existsSync6(statePath))
+  if (existsSync5(statePath))
     rmSync(statePath, { force: true });
 }
 async function runDemoBreak(repoRoot, args) {
   const keep = args.includes("--keep");
   const hookDir = resolveHookDir(repoRoot);
   const hookPath = join5(repoRoot, hookDir, "pre-commit");
-  if (!existsSync6(hookPath)) {
+  if (!existsSync5(hookPath)) {
     console.error("Vinaya hooks are not installed in this repo. Run `vinaya init` first.");
     return 1;
   }
@@ -2081,7 +2122,7 @@ Attempting to commit…
   process.stdout.write(`✓ Commit passed — the fix worked.
 `);
   if (keep) {
-    if (existsSync6(statePath))
+    if (existsSync5(statePath))
       unlinkSync(statePath);
     process.stdout.write(`
 --keep: leaving \`${demoBranch}\` checked out for you to inspect. Clean up with:
@@ -2477,6 +2518,31 @@ function buildInitProductOps(name) {
   ];
 }
 
+// src/lib/env-lint.ts
+import { existsSync as existsSync6, readFileSync as readFileSync3 } from "node:fs";
+var ENV_READ_PATTERN = /\b(?:process\.env|Bun\.env|Deno\.env)\b/;
+function checksMissingEnvDeclaration(specs) {
+  const names = [];
+  for (const spec of specs) {
+    if (spec.env)
+      continue;
+    if (!existsSync6(spec.run))
+      continue;
+    let source;
+    try {
+      source = readFileSync3(spec.run, "utf8");
+    } catch {
+      continue;
+    }
+    if (ENV_READ_PATTERN.test(source))
+      names.push(spec.name);
+  }
+  return names;
+}
+function envDeclarationWarning(name) {
+  return `check "${name}" reads environment variables directly but declares no \`env\` — it will lose environment access at the next minor. Declare \`env\` for it (CheckSpec['env'] in src/checks/contract.ts, or vinaya.config.json's checks.<name>.env).`;
+}
+
 // src/lib/ops.ts
 import { chmodSync, existsSync as existsSync7, mkdirSync as mkdirSync2, readFileSync as readFileSync4, rmSync as rmSync2, writeFileSync as writeFileSync3 } from "node:fs";
 import { dirname as dirname3, join as join7, resolve, sep } from "node:path";
@@ -4300,7 +4366,7 @@ var COMMANDS = [
       { flag: "--parallel[=n]", description: "Concurrency cap (default: cpu-derived)" }
     ],
     details: [
-      "Warns (stderr, every output mode, never affecting the exit code) for any check whose executable reads `process.env`/`Bun.env`/`Deno.env` directly with no `env` declared on its `CheckSpec` — those checks will lose environment access once the env allowlist is wired as the spawn default in a later minor. Declare `env` (a core check's own registration, or `vinaya.config.json`'s `checks.<name>.env` for a custom one) to silence the warning ahead of that flip."
+      "Each spawned check's child process sees only a fixed baseline (`PATH`, `LANG`, `HOME`, `HTTPS_PROXY`, `HTTP_PROXY`, `NO_PROXY`, `TMPDIR`) plus whatever its `CheckSpec['env']` declaration explicitly forwards — never the full parent environment. A required (`true`) or unsatisfied `anyOf` declaration missing from the caller's environment synthesizes a `CheckError` before the check ever spawns. Declare `env` (a core check's own registration, or `vinaya.config.json`'s `checks.<name>.env` for a custom one) for any check that reads `process.env`/`Bun.env`/`Deno.env` directly — `vinaya doctor` carries the permanent diagnostic for one that doesn't."
     ],
     status: "shipped"
   },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@attalabs/vinaya",
-  "version": "0.2.0",
+  "version": "0.3.0",
   "description": "Vinaya — Agentic Engineering Harness. Deterministic checks every AI coding agent must satisfy before merge.",
   "type": "module",
   "license": "Apache-2.0",