@bugb-technologies/bravos 0.0.0-stage → 1.0.1

package/dist/uninstall.js

@@ -0,0 +1,192 @@
+import { existsSync, lstatSync, readFileSync, readdirSync, readlinkSync, rmdirSync, rmSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { LOCK_PATH, readLock, sha256 } from './lock.js';
+import { BravosError } from './types.js';
+const isObject = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+// Any command bravos registers: the per-repo relative forms and the user-level absolute one.
+const isBravosCommand = (c) => typeof c === 'string' && /\.bravos\/hooks\/(session-start|pre-pr|autopilot)\.mjs/.test(c);
+function readJson(root, rel) {
+    const abs = join(root, rel);
+    if (!existsSync(abs))
+        return null;
+    let parsed;
+    try {
+        parsed = JSON.parse(readFileSync(abs, 'utf8'));
+    }
+    catch {
+        throw new BravosError(`${rel} is not valid JSON; fix it or remove it, nothing was removed`);
+    }
+    if (!isObject(parsed))
+        throw new BravosError(`${rel} is not a JSON object; fix it or remove it, nothing was removed`);
+    return parsed;
+}
+/** Removes bravos's commands from a Claude Code / Codex hooks file; returns the new document, or null when nothing changed. */
+function stripHooks(doc) {
+    if (!isObject(doc.hooks))
+        return null;
+    let changed = false;
+    const hooks = {};
+    for (const [event, groups] of Object.entries(doc.hooks)) {
+        if (!Array.isArray(groups)) {
+            hooks[event] = groups;
+            continue;
+        }
+        const kept = groups
+            .map((g) => {
+            if (!isObject(g) || !Array.isArray(g.hooks))
+                return g;
+            const left = g.hooks.filter((h) => !(isObject(h) && isBravosCommand(h.command)));
+            if (left.length !== g.hooks.length)
+                changed = true;
+            return { ...g, hooks: left };
+        })
+            .filter((g) => !(isObject(g) && Array.isArray(g.hooks) && g.hooks.length === 0));
+        if (kept.length > 0)
+            hooks[event] = kept;
+    }
+    if (!changed)
+        return null;
+    const out = { ...doc, hooks };
+    if (Object.keys(hooks).length === 0)
+        delete out.hooks;
+    return out;
+}
+function writeOrDelete(root, rel, doc, dryRun) {
+    if (dryRun)
+        return;
+    const abs = join(root, rel);
+    if (Object.keys(doc).length === 0)
+        unlinkSync(abs);
+    else
+        writeFileSync(abs, JSON.stringify(doc, null, 2) + '\n');
+}
+/** Removes now-empty folders from `rel`'s parent up to (not including) the root. */
+function pruneEmpty(root, rel) {
+    let dir = dirname(rel);
+    while (dir && dir !== '.' && dir !== '/') {
+        const abs = join(root, dir);
+        try {
+            if (!lstatSync(abs).isDirectory() || readdirSync(abs).length > 0)
+                return;
+            rmdirSync(abs);
+        }
+        catch {
+            return;
+        }
+        dir = dirname(dir);
+    }
+}
+// @comment -- "Removes what bravos installed under root: every file its lock records that is unchanged (edited ones are kept and listed unless --force), bravos's hook entries in .claude/settings.json and .codex/hooks.json, its group in .agents/hooks.json, its pre_pr entry in .guardlink/config.json, and .bravos/ itself; with home set, also the ~/.agents/skills/bravos* links. Never removes guardlink's own files, a reviewed scope.yaml, or MCP entries (which may predate bravos); those are listed. Hooks files are validated before anything is removed."
+export function uninstall(root, opts = {}) {
+    const dryRun = !!opts.dryRun;
+    const report = { removed: [], kept: [], unregistered: [], notes: [] };
+    if (!existsSync(join(root, '.bravos'))) {
+        throw new BravosError(`bravos is not installed in ${root} (no .bravos/ folder); nothing was removed`);
+    }
+    // Validate every structured file first, so a malformed one stops the run before any removal.
+    const hookFiles = ['.claude/settings.json', '.codex/hooks.json'];
+    const docs = new Map(hookFiles.map((f) => [f, readJson(root, f)]));
+    const agy = opts.home ? null : readJson(root, '.agents/hooks.json');
+    const glConfig = opts.home ? null : readJson(root, '.guardlink/config.json');
+    const lock = readLock(root);
+    for (const [rel, hash] of Object.entries(lock.files).sort(([a], [b]) => a.localeCompare(b))) {
+        if (rel.startsWith('.guardlink/')) {
+            report.kept.push({ path: rel, reason: 'guardlink data (a reviewed scope is the team\'s); delete it yourself if unwanted' });
+            continue;
+        }
+        const abs = join(root, rel);
+        let st = null;
+        try {
+            st = lstatSync(abs);
+        }
+        catch {
+            continue;
+        }
+        if (!st.isFile())
+            continue;
+        if (!opts.force && sha256(readFileSync(abs)) !== hash) {
+            report.kept.push({ path: rel, reason: 'edited since bravos wrote it (use --force to remove)' });
+            continue;
+        }
+        report.removed.push(rel);
+        if (!dryRun) {
+            unlinkSync(abs);
+            pruneEmpty(root, rel);
+        }
+    }
+    for (const f of hookFiles) {
+        const doc = docs.get(f);
+        if (!doc)
+            continue;
+        const next = stripHooks(doc);
+        if (!next)
+            continue;
+        report.unregistered.push(f);
+        writeOrDelete(root, f, next, dryRun);
+    }
+    if (agy && Object.hasOwn(agy, 'bravos')) {
+        const { bravos: _j, ...rest } = agy;
+        report.unregistered.push('.agents/hooks.json');
+        writeOrDelete(root, '.agents/hooks.json', rest, dryRun);
+    }
+    if (glConfig && Array.isArray(glConfig.pre_pr)) {
+        const left = glConfig.pre_pr.filter((e) => !(isObject(e) && isBravosCommand(e.command)));
+        if (left.length !== glConfig.pre_pr.length) {
+            report.unregistered.push('.guardlink/config.json (pre_pr)');
+            if (!dryRun)
+                writeFileSync(join(root, '.guardlink/config.json'), JSON.stringify({ ...glConfig, pre_pr: left }, null, 2) + '\n');
+            report.notes.push('run guardlink sync to drop the gate from the agent instruction files');
+        }
+    }
+    if (opts.home) {
+        const dir = join(root, '.agents', 'skills');
+        let entries = [];
+        try {
+            entries = lstatSync(dir).isSymbolicLink() ? [] : readdirSync(dir);
+        }
+        catch {
+            entries = [];
+        }
+        for (const name of entries.filter((n) => n === 'bravos' || n.startsWith('bravos-'))) {
+            const link = join(dir, name);
+            try {
+                if (lstatSync(link).isSymbolicLink() && readlinkSync(link) === `../../.claude/skills/${name}`) {
+                    report.removed.push(`.agents/skills/${name} (link)`);
+                    if (!dryRun)
+                        unlinkSync(link);
+                }
+            }
+            catch {
+                /* gone already */
+            }
+        }
+    }
+    // @comment -- "Removes only what the install wrote under .bravos/ (the hook scripts, removed above when unchanged, and the lock), never the folder itself: .bravos/ is shared with the Python bravos CLI's committed templates and identities, and with this CLI's own reports, SAST runs, watch log and workspace snapshot, none of which an uninstall owns."
+    const keptInBravos = report.kept.some((k) => k.path.startsWith('.bravos/'));
+    if (!keptInBravos) {
+        report.removed.push(LOCK_PATH);
+        if (!dryRun) {
+            rmSync(join(root, LOCK_PATH), { force: true });
+            rmSync(join(root, '.bravos', 'hooks'), { recursive: true, force: true });
+            pruneEmpty(root, join('.bravos', 'x'));
+        }
+    }
+    else
+        report.notes.push('.bravos/hooks kept because a hook script in it was edited');
+    const leftover = ['reports', 'sast', 'watch', 'workspace', 'review'].filter((d) => existsSync(join(root, '.bravos', d)));
+    if (leftover.length)
+        report.notes.push(`.bravos/{${leftover.join(',')}} kept: reports, runs and snapshots are yours, not the install's`);
+    try {
+        if (!opts.home && lstatSync(join(root, '.agents', 'skills')).isSymbolicLink()) {
+            report.notes.push('.agents/skills is still a link to .claude/skills (from --link-skills); remove it if no other agent needs it');
+        }
+    }
+    catch {
+        /* no link */
+    }
+    const mcp = opts.home ? ['.codex/config.toml'] : ['.mcp.json', '.codex/config.toml', 'opencode.json'];
+    const withMcp = mcp.filter((f) => existsSync(join(root, f)));
+    if (withMcp.length)
+        report.notes.push(`MCP entries (guardlink, cxg, codegraph) are left in ${withMcp.join(', ')}; they may predate bravos`);
+    return report;
+}

package/dist/versions.js

@@ -0,0 +1,8 @@
+// @comment -- "The versions of the two binary bundles this CLI installs. Pinned here, not read from the network: a bravos release names the analyzer and code-graph builds it was tested with, and bravos setup fetches exactly those."
+/** The licensed analyzer bundle (bravos-cli plus gitleaks, osv-scanner, kics, zizmor and the rules), published by specter-v1's analyzer-release workflow. */
+export const ANALYZER_VERSION = '0.6.1';
+/** The code graph binaries (codegraph-build, codegraph-mcp), published by specter-v1's codegraph-release workflow. */
+export const CODEGRAPH_VERSION = '0.1.0';
+/** Pins for the two free CLIs bravos setup --tools installs. */
+export const GUARDLINK_VERSION = '2.5.0';
+export const CXG_VERSION = '1.7.0';