@bhargavvc/sdd-cc 1.30.1 → 1.42.3

package/scripts/changeset/cli.cjs

@@ -0,0 +1,269 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * CLI wrapper for the changeset-fragment workflow (#2975).
+ *
+ * Subcommands:
+ *   render --repo <dir> --version V --date D [--json]   Fold .changeset/*.md
+ *                                                       into CHANGELOG.md;
+ *                                                       delete consumed fragments.
+ *
+ * `--json` emits a structured report on stdout — the only contract tests
+ * assert against. Per CONTRIBUTING.md "Prohibited: Raw Text Matching on
+ * Test Outputs", the human formatter is operator-only.
+ */
+
+const fs = require('node:fs');
+const path = require('node:path');
+
+const { parseFragment, FRAGMENT_ERROR } = require('./parse.cjs');
+const { renderChangelog } = require('./render.cjs');
+const { serializeChangelog } = require('./serialize.cjs');
+const { renderGithubReleaseNotes } = require('./github-release-notes.cjs');
+
+function parseArgs(argv) {
+  const opts = {
+    cmd: null,
+    repo: process.cwd(),
+    version: null,
+    date: null,
+    fromRef: null,
+    toRef: null,
+    output: null,
+    repoSlug: 'bhargavvc/sdd-cc',
+    installCommand: 'npx @bhargavvc/sdd-cc@latest',
+    json: false,
+  };
+  if (argv.length === 0) return { ok: true, opts };
+  opts.cmd = argv[0];
+
+  // Pull a value for a value-taking flag, validating that the next token
+  // exists and is not itself another flag (which is the silently-misparsed
+  // case CR called out: e.g. `--repo --json` would consume `--json` as the
+  // repo path).
+  const requireValue = (flag, i) => {
+    const v = argv[i + 1];
+    if (v === undefined || v.startsWith('--')) {
+      return { ok: false, error: `missing value for ${flag}` };
+    }
+    return { ok: true, value: v };
+  };
+
+  for (let i = 1; i < argv.length; i++) {
+    const a = argv[i];
+    if (a === '--json') { opts.json = true; continue; }
+    if (
+      a === '--repo' ||
+      a === '--version' ||
+      a === '--date' ||
+      a === '--from' ||
+      a === '--to' ||
+      a === '--output' ||
+      a === '--repo-slug' ||
+      a === '--install-command'
+    ) {
+      const r = requireValue(a, i);
+      if (!r.ok) return { ok: false, error: r.error };
+      if (a === '--repo') opts.repo = r.value;
+      else if (a === '--version') opts.version = r.value;
+      else if (a === '--date') opts.date = r.value;
+      else if (a === '--from') opts.fromRef = r.value;
+      else if (a === '--to') opts.toRef = r.value;
+      else if (a === '--output') opts.output = r.value;
+      else if (a === '--repo-slug') opts.repoSlug = r.value;
+      else if (a === '--install-command') opts.installCommand = r.value;
+      i++;
+      continue;
+    }
+    return { ok: false, error: `unknown argument: ${a}` };
+  }
+  return { ok: true, opts };
+}
+
+function listFragmentFiles(changesetDir) {
+  if (!fs.existsSync(changesetDir)) return [];
+  return fs.readdirSync(changesetDir)
+    .filter((f) => f.endsWith('.md') && f !== 'README.md')
+    .map((f) => path.join(changesetDir, f));
+}
+
+function splitChangelog(text) {
+  // Split off the top-level "# Changelog" heading + lead matter (everything
+  // before the first "## [version]" block) from the rest. The rest is the
+  // priorChangelog passed into renderChangelog. The "## [Unreleased]" block,
+  // if present, is dropped (the new release replaces it).
+  const lines = text.split(/\r?\n/);
+  const firstReleaseIdx = lines.findIndex((l) => /^##\s+\[/.test(l));
+  if (firstReleaseIdx === -1) {
+    return { lead: text.replace(/\s+$/, ''), prior: '' };
+  }
+  const lead = lines.slice(0, firstReleaseIdx).join('\n').replace(/\s+$/, '');
+  let priorStart = firstReleaseIdx;
+  // Skip the [Unreleased] block if present — it's a placeholder, not a release.
+  if (/^##\s+\[Unreleased\]/i.test(lines[firstReleaseIdx])) {
+    let j = firstReleaseIdx + 1;
+    while (j < lines.length && !/^##\s+\[/.test(lines[j])) j++;
+    priorStart = j;
+  }
+  const prior = lines.slice(priorStart).join('\n').trimStart();
+  return { lead, prior };
+}
+
+function cmdRender(opts) {
+  const repo = path.resolve(opts.repo);
+  const changesetDir = path.join(repo, '.changeset');
+  const changelogPath = path.join(repo, 'CHANGELOG.md');
+  const fragmentFiles = listFragmentFiles(changesetDir);
+
+  const fragments = [];
+  const failures = [];
+  for (const file of fragmentFiles) {
+    const src = fs.readFileSync(file, 'utf8');
+    const r = parseFragment(src);
+    if (r.ok) fragments.push({ ...r.fragment, file });
+    else failures.push({ file: path.relative(repo, file), reason: r.reason, detail: r.detail || null });
+  }
+
+  if (failures.length > 0) {
+    return { exitCode: 1, report: { consumed: 0, failures } };
+  }
+  if (fragments.length === 0) {
+    return { exitCode: 0, report: { consumed: 0, failures: [] } };
+  }
+
+  const priorText = fs.existsSync(changelogPath) ? fs.readFileSync(changelogPath, 'utf8') : '';
+  const { lead, prior } = splitChangelog(priorText);
+
+  const ir = renderChangelog({
+    fragments,
+    version: opts.version,
+    date: opts.date,
+    priorChangelog: prior || null,
+  });
+  const releaseBlock = serializeChangelog(ir);
+  const out = [
+    lead || '# Changelog',
+    '',
+    '## [Unreleased]',
+    '',
+    releaseBlock.replace(/\s+$/, ''),
+    '',
+  ].join('\n');
+
+  fs.writeFileSync(changelogPath, out);
+
+  // Delete consumed fragments. If any unlink fails the changelog is written
+  // but the fragment is still on disk, so a re-run would double-consume it.
+  // Surface the partial-failure as exitCode=1 with structured detail so the
+  // operator can manually clean up before retrying.
+  const deleteFailures = [];
+  for (const f of fragments) {
+    try {
+      fs.unlinkSync(f.file);
+    } catch (e) {
+      deleteFailures.push({
+        file: path.relative(repo, f.file),
+        reason: 'fail_fragment_delete',
+        detail: e.code || e.message,
+      });
+    }
+  }
+
+  return {
+    exitCode: deleteFailures.length > 0 ? 1 : 0,
+    report: {
+      consumed: fragments.length - deleteFailures.length,
+      failures: deleteFailures,
+      release: { version: opts.version, date: opts.date },
+    },
+  };
+}
+
+function cmdGithubReleaseNotes(opts) {
+  const repo = path.resolve(opts.repo);
+  const report = renderGithubReleaseNotes({
+    repo,
+    fromRef: opts.fromRef,
+    toRef: opts.toRef,
+    repoSlug: opts.repoSlug,
+    installCommand: opts.installCommand,
+  });
+
+  if (!report.ok) {
+    return {
+      exitCode: 1,
+      report: {
+        consumed: 0,
+        failures: report.failures,
+        release: { from: opts.fromRef, to: opts.toRef },
+      },
+    };
+  }
+
+  if (opts.output) {
+    fs.writeFileSync(path.resolve(opts.output), report.body);
+  }
+
+  return {
+    exitCode: 0,
+    report: {
+      consumed: report.fragments.length,
+      failures: [],
+      release: { from: opts.fromRef, to: opts.toRef },
+      output: opts.output || null,
+      body: opts.output ? null : report.body,
+    },
+  };
+}
+
+function usage() {
+  return [
+    'usage:',
+    '  changeset/cli.cjs render --repo <dir> --version V --date D [--json]',
+    '  changeset/cli.cjs github-release-notes --repo <dir> --from REF --to REF [--output FILE] [--repo-slug OWNER/REPO] [--install-command CMD] [--json]',
+    '',
+  ].join('\n');
+}
+
+function main() {
+  const parsed = parseArgs(process.argv.slice(2));
+  if (!parsed.ok) {
+    process.stderr.write(`${parsed.error}\n`);
+    process.stderr.write(usage());
+    process.exit(2);
+  }
+  const { opts } = parsed;
+  if (opts.cmd !== 'render' && opts.cmd !== 'github-release-notes') {
+    process.stderr.write(usage());
+    process.exit(2);
+  }
+  if (opts.cmd === 'render' && (!opts.version || !opts.date)) {
+    process.stderr.write('--version and --date are required for render\n');
+    process.exit(2);
+  }
+  if (opts.cmd === 'github-release-notes' && (!opts.fromRef || !opts.toRef)) {
+    process.stderr.write('--from and --to are required for github-release-notes\n');
+    process.exit(2);
+  }
+
+  const { exitCode, report } = opts.cmd === 'render' ? cmdRender(opts) : cmdGithubReleaseNotes(opts);
+  if (opts.json) {
+    process.stdout.write(JSON.stringify(report, null, 2) + '\n');
+  } else if (opts.cmd === 'github-release-notes' && report.body) {
+    process.stdout.write(report.body);
+  } else {
+    process.stdout.write(`Consumed: ${report.consumed} fragment(s)\n`);
+    if (report.failures.length > 0) {
+      process.stdout.write(`Failures: ${report.failures.length}\n`);
+      for (const f of report.failures) {
+        process.stdout.write(`  ${f.file}: ${f.reason}${f.detail ? ` (${f.detail})` : ''}\n`);
+      }
+    }
+  }
+  process.exit(exitCode);
+}
+
+if (require.main === module) main();
+
+module.exports = { cmdRender, cmdGithubReleaseNotes, parseArgs, splitChangelog, listFragmentFiles, usage };

package/scripts/changeset/github-release-notes.cjs

@@ -0,0 +1,198 @@
+'use strict';
+
+const cp = require('node:child_process');
+const path = require('node:path');
+
+const { parseFragment } = require('./parse.cjs');
+
+const SECTION_ORDER = ['Fixed', 'Added', 'Changed', 'Deprecated', 'Removed', 'Security'];
+
+const FIXED_GROUPS = [
+  {
+    title: 'Verification, update & review safety',
+    pattern: /\b(verifier|verification|verify|probe|probes|debt|tbd|fixme|xxx|detect-custom-files|review|summary|blocker|critical)\b/i,
+  },
+  {
+    title: 'State, planning & execution',
+    pattern: /\b(state|planning|planner|plan-phase|phase|roadmap|execute|executor|worktree|worktrees|resolve-model|init\.progress|model override|human_needed|ship preflight)\b/i,
+  },
+  {
+    title: 'Install & runtime conversion',
+    pattern: /\b(install|installer|runtime|windows|powershell|codex|gemini|antigravity|hook|hooks|sdd-sdk|sdk readiness|cjs|model-catalog|path|shim)\b/i,
+  },
+];
+
+const REMOVED_GROUPS = [
+  {
+    title: 'Intel updater',
+    pattern: /\b(intel|sdd-intel-updater|layout detection)\b/i,
+  },
+];
+
+function runGit(repo, args) {
+  return cp.execFileSync('git', args, {
+    cwd: repo,
+    encoding: 'utf8',
+    stdio: ['ignore', 'pipe', 'pipe'],
+  });
+}
+
+function validateGitRef({ repo, ref, label }) {
+  if (typeof ref !== 'string' || ref.trim() !== ref || ref.length === 0) {
+    throw new Error(`Invalid git ref for ${label}: expected a non-empty trimmed string`);
+  }
+  if (
+    ref.startsWith('-') ||
+    ref.includes('..') ||
+    ref.includes('//') ||
+    !/^[A-Za-z0-9._/-]+$/.test(ref)
+  ) {
+    throw new Error(`Invalid git ref for ${label}: ${ref}`);
+  }
+  runGit(repo, ['rev-parse', '--verify', `${ref}^{commit}`]);
+  return ref;
+}
+
+function changedFragmentPaths({ repo, fromRef, toRef }) {
+  const from = validateGitRef({ repo, ref: fromRef, label: 'fromRef' });
+  const to = validateGitRef({ repo, ref: toRef, label: 'toRef' });
+  const out = runGit(repo, ['diff', '--name-only', `${from}..${to}`, '--', '.changeset']);
+  return out
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .filter((file) => /^\.changeset\/[^/]+\.md$/.test(file));
+}
+
+function readFileAtRef({ repo, ref, file }) {
+  return runGit(repo, ['show', `${ref}:${file}`]);
+}
+
+function loadFragmentsFromRange({ repo, fromRef, toRef }) {
+  const files = changedFragmentPaths({ repo, fromRef, toRef });
+  const fragments = [];
+  const failures = [];
+
+  for (const file of files) {
+    try {
+      const src = readFileAtRef({ repo, ref: toRef, file });
+      const parsed = parseFragment(src);
+      if (parsed.ok) {
+        fragments.push({
+          ...parsed.fragment,
+          file,
+          slug: path.basename(file, '.md'),
+        });
+      } else {
+        failures.push({ file, reason: parsed.reason, detail: parsed.detail || null });
+      }
+    } catch (e) {
+      failures.push({ file, reason: 'read_failed', detail: e.message });
+    }
+  }
+
+  return { fragments, failures };
+}
+
+function classifyGroup(fragment) {
+  const haystack = `${fragment.slug || ''}\n${fragment.body || ''}`;
+  const groups = fragment.type === 'Removed' ? REMOVED_GROUPS : FIXED_GROUPS;
+  const match = groups.find((group) => group.pattern.test(haystack));
+  if (match) return match.title;
+  if (fragment.type === 'Removed') return 'Removed';
+  if (fragment.type === 'Fixed') return 'Other fixes';
+  return fragment.type;
+}
+
+function buildGithubReleaseNotesIr({ fragments }) {
+  const sections = [];
+  for (const type of SECTION_ORDER) {
+    const typed = fragments.filter((fragment) => fragment.type === type);
+    if (typed.length === 0) continue;
+
+    const groupMap = new Map();
+    for (const fragment of typed) {
+      const groupTitle = classifyGroup(fragment);
+      if (!groupMap.has(groupTitle)) groupMap.set(groupTitle, []);
+      groupMap.get(groupTitle).push(fragment);
+    }
+
+    sections.push({
+      type,
+      groups: Array.from(groupMap, ([title, bullets]) => ({ title, bullets })),
+    });
+  }
+  return { sections };
+}
+
+function formatBullet(fragment) {
+  if (!Number.isInteger(fragment.pr) || fragment.pr <= 0) {
+    throw new Error(`Fragment ${fragment.slug || fragment.file || '<unknown>'} missing valid pr field`);
+  }
+  const body = `${fragment.body.trim()} (#${fragment.pr})`;
+  const lines = body.split(/\r?\n/);
+  return lines.map((line, index) => (index === 0 ? `- ${line}` : `  ${line}`)).join('\n');
+}
+
+function compareUrl({ repoSlug, fromRef, toRef }) {
+  const normalizedSlug = String(repoSlug || '').trim();
+  if (!/^[A-Za-z0-9._-]+\/[A-Za-z0-9._-]+$/.test(normalizedSlug)) {
+    throw new Error(`Invalid repoSlug format: ${repoSlug} (expected "owner/repo")`);
+  }
+  return `https://github.com/${normalizedSlug}/compare/${fromRef}...${toRef}`;
+}
+
+function serializeGithubReleaseNotes({
+  ir,
+  fromRef,
+  toRef,
+  repoSlug = 'bhargavvc/sdd-cc',
+  installCommand = 'npx @bhargavvc/sdd-cc@latest',
+}) {
+  if (installCommand.includes('`')) {
+    throw new Error('installCommand cannot contain backtick characters');
+  }
+  const lines = [];
+  for (const section of ir.sections) {
+    lines.push(`## ${section.type}`);
+    lines.push('');
+    for (const group of section.groups) {
+      lines.push(`### ${group.title}`);
+      for (const bullet of group.bullets) {
+        lines.push(formatBullet(bullet));
+      }
+      lines.push('');
+    }
+  }
+  lines.push('---');
+  lines.push('');
+  lines.push(`Install/upgrade: \`${installCommand}\``);
+  lines.push('');
+  lines.push(`**Full Changelog**: ${compareUrl({ repoSlug, fromRef, toRef })}`);
+  lines.push('');
+  return lines.join('\n');
+}
+
+function renderGithubReleaseNotes(options) {
+  const { fragments, failures } = loadFragmentsFromRange(options);
+  if (failures.length > 0) {
+    return { ok: false, fragments, failures, body: null };
+  }
+  const ir = buildGithubReleaseNotesIr({ fragments });
+  return {
+    ok: true,
+    fragments,
+    failures: [],
+    ir,
+    body: serializeGithubReleaseNotes({ ir, ...options }),
+  };
+}
+
+module.exports = {
+  changedFragmentPaths,
+  loadFragmentsFromRange,
+  buildGithubReleaseNotesIr,
+  serializeGithubReleaseNotes,
+  renderGithubReleaseNotes,
+  classifyGroup,
+  validateGitRef,
+};

package/scripts/changeset/lint.cjs

@@ -0,0 +1,110 @@
+#!/usr/bin/env node
+'use strict';
+
+/**
+ * Changeset-fragment lint (#2975).
+ *
+ * Pure verdict function evaluateLint({ changedFiles, labels }) returns
+ * { ok, reason } using the LINT_REASON enum. The CLI wrapper calls it with
+ * the PR diff (via `git diff --name-only origin/main...HEAD` or the GitHub
+ * Actions event payload) and the labels list (via the GitHub event).
+ *
+ * Tests assert on the typed verdict, never on free text.
+ */
+
+const LINT_REASON = Object.freeze({
+  OK_FRAGMENT_PRESENT: 'ok_fragment_present',
+  OK_OPT_OUT_LABEL: 'ok_opt_out_label',
+  OK_NO_USER_FACING_CHANGES: 'ok_no_user_facing_changes',
+  FAIL_MISSING_FRAGMENT: 'fail_missing_fragment',
+});
+
+const OPT_OUT_LABEL = 'no-changelog';
+
+// Files counted as "user-facing" — touching any of these requires either a
+// fragment or an explicit opt-out label. Test/CI/docs/lock files do not.
+const USER_FACING_PREFIXES = [
+  'bin/',
+  'sdd/',
+  'agents/',
+  'commands/',
+  'hooks/',
+  'sdk/src/',
+  'sdk/prompts/',
+];
+
+// Exact-match user-facing files. Any direct edit to one of these without a
+// fragment also fails the lint — closes the bypass where a contributor edits
+// CHANGELOG.md directly to sneak past the new workflow.
+const USER_FACING_FILES = new Set(['CHANGELOG.md']);
+
+function isUserFacing(file) {
+  if (USER_FACING_FILES.has(file)) return true;
+  return USER_FACING_PREFIXES.some((p) => file.startsWith(p));
+}
+
+function isFragment(file) {
+  return /^\.changeset\/[^/]+\.md$/.test(file) && !file.endsWith('/README.md');
+}
+
+function evaluateLint({ changedFiles, labels }) {
+  if (changedFiles.some(isFragment)) {
+    return { ok: true, reason: LINT_REASON.OK_FRAGMENT_PRESENT };
+  }
+  if (labels.includes(OPT_OUT_LABEL)) {
+    return { ok: true, reason: LINT_REASON.OK_OPT_OUT_LABEL };
+  }
+  if (!changedFiles.some(isUserFacing)) {
+    return { ok: true, reason: LINT_REASON.OK_NO_USER_FACING_CHANGES };
+  }
+  return { ok: false, reason: LINT_REASON.FAIL_MISSING_FRAGMENT };
+}
+
+function main() {
+  const fs = require('node:fs');
+  const cp = require('node:child_process');
+  // GitHub Actions event payload path
+  const eventPath = process.env.GITHUB_EVENT_PATH;
+  let labels = [];
+  if (eventPath && fs.existsSync(eventPath)) {
+    try {
+      const event = JSON.parse(fs.readFileSync(eventPath, 'utf8'));
+      labels = (event.pull_request?.labels || []).map((l) => l.name);
+    } catch { /* fall through */ }
+  }
+  const base = process.env.GITHUB_BASE_REF || 'main';
+  let changedFiles = [];
+  try {
+    // Use execFileSync with an argv array — the base ref is interpolated
+    // into a refspec argument, but execFileSync does not invoke a shell, so
+    // even a malicious GITHUB_BASE_REF cannot inject shell syntax. The
+    // refspec-bound metacharacters that git itself rejects (e.g. spaces in
+    // ref names) are caught by git's own arg parser.
+    const out = cp.execFileSync(
+      'git',
+      ['diff', '--name-only', `origin/${base}...HEAD`],
+      { encoding: 'utf8' },
+    );
+    changedFiles = out.split('\n').filter(Boolean);
+  } catch (e) {
+    process.stderr.write(`could not compute diff: ${e.message}\n`);
+    process.exit(2);
+  }
+
+  const verdict = evaluateLint({ changedFiles, labels });
+  if (process.argv.includes('--json')) {
+    process.stdout.write(JSON.stringify({ ...verdict, changedFiles, labels }, null, 2) + '\n');
+  } else if (verdict.ok) {
+    process.stdout.write(`ok changeset-lint: ${verdict.reason}\n`);
+  } else {
+    process.stderr.write(`\nERROR changeset-lint: ${verdict.reason}\n`);
+    process.stderr.write(`PR touches user-facing files but does not include a .changeset/*.md fragment.\n`);
+    process.stderr.write(`Run \`npm run changeset\` to create one, or add the \`${OPT_OUT_LABEL}\` label\n`);
+    process.stderr.write(`if this PR genuinely has no user-facing impact (test refactor, CI tweak, etc.).\n`);
+  }
+  process.exit(verdict.ok ? 0 : 1);
+}
+
+if (require.main === module) main();
+
+module.exports = { evaluateLint, LINT_REASON, OPT_OUT_LABEL, isUserFacing, isFragment };