@cruxy/cli 0.22.1 → 0.24.0

package/dist/vcs/service.js

@@ -1,4 +1,5 @@
-import { usageError } from "../errors/index.js";
+import path from "node:path";
+import { usageError, vcsRemoteChanged } from "../errors/index.js";
 import { commit, currentBranch, diffAgainst, ensureFeatureBranch, hasChanges, isProtectedBranch, push, stageAll, } from "./git.js";
 /** Build a PR service from its dependencies. */
 export function createPrService(deps) {
@@ -8,6 +9,7 @@ export function createPrService(deps) {
 }
 async function openPullRequest(deps, opts) {
     const { cwd, config, forge, generate, requestApproval } = deps;
+    const rootName = deps.rootName ?? path.basename(cwd);
     const protectedExtra = config.git.protectedBranches;
     const branchNow = currentBranch(cwd);
     if (branchNow === null) {
@@ -36,8 +38,14 @@ async function openPullRequest(deps, opts) {
         body: opts.body,
     });
     // ── the one gate: show the whole publish plan before anything mutates ──────────
+    // `repo` is the target parsed from `origin` NOW; it is both shown to the human
+    // (⚖︎JC-4 — root name AND resolved owner/repo) and captured as the approved
+    // target that the wrong-repo guard re-checks before the API call.
     const decision = await requestApproval({
         kind: "vcs",
+        // C.26 Step 4: the acting root, named exactly as the caller selected it — the
+        // checkpoint gate attributes the run's git side effects to this root.
+        root: rootName,
         preview: {
             type: "pr",
             branch: content.branchName,
@@ -46,6 +54,7 @@ async function openPullRequest(deps, opts) {
             commitBody: content.commitBody,
             prTitle: content.prTitle,
             prBody: content.prBody,
+            target: { host: repo.host, owner: repo.owner, repo: repo.repo },
         },
     });
     if (!decision.allow) {
@@ -61,6 +70,18 @@ async function openPullRequest(deps, opts) {
         commit(cwd, content.commitSubject, content.commitBody, protectedExtra);
     }
     push(cwd, head, protectedExtra);
+    // ── wrong-repo guard (⚖︎JC-2 take A): re-resolve the origin identity LOCALLY and
+    // compare it to what the human approved, immediately before the API call. A
+    // concurrent `git remote set-url` on the mutable .git/config would otherwise open
+    // the PR against a repo the user never saw. Mismatch → refuse (never open); we do
+    // NOT re-gate or warn-and-proceed. The tiny window between this re-check and the
+    // HTTP send is an unclosable residual without a lock — named, not chased. (Git
+    // pushed to `origin` by name above; the guarded surface here is the API's
+    // owner/repo target, which is the value the human actually approved.)
+    const current = forge.resolveRepoIdentity(cwd);
+    if (!sameIdentity(repo, current)) {
+        throw vcsRemoteChanged(repo, current, rootName);
+    }
     const pr = await forge.createPullRequest(repo, {
         title: content.prTitle,
         body: content.prBody,
@@ -77,3 +98,14 @@ async function openPullRequest(deps, opts) {
         alreadyExists: pr.alreadyExists,
     };
 }
+/**
+ * Are two forge identities the same repository? Host/owner/repo compared
+ * case-insensitively, because GitHub treats them so — a case-only remote rewrite
+ * is the same repo and must not trip the wrong-repo guard with a false positive.
+ */
+function sameIdentity(a, b) {
+    const norm = (s) => s.toLowerCase();
+    return (norm(a.host) === norm(b.host) &&
+        norm(a.owner) === norm(b.owner) &&
+        norm(a.repo) === norm(b.repo));
+}

package/dist/vcs/types.d.ts

@@ -3,14 +3,21 @@
  * interface is the swap seam — GitHub ships first, GitLab/Bitbucket slot in later
  * without touching call sites (same discipline as `VectorStore`/`Embedder`).
  */
-/** Where a repository lives and who owns it, parsed from the `origin` remote. */
-export interface RepoInfo {
+/**
+ * The forge-target identity parsed from the `origin` remote — just host/owner/repo,
+ * no network lookup. This is the value the C.26 Step-4 wrong-repo guard compares
+ * across the preview→API-call window (see {@link ForgeProvider.resolveRepoIdentity}).
+ */
+export interface RepoIdentity {
     /** Forge host, e.g. `github.com`. */
     readonly host: string;
     /** Repository owner (user or org). */
     readonly owner: string;
     /** Repository name (no `.git` suffix). */
     readonly repo: string;
+}
+/** Where a repository lives and who owns it, parsed from the `origin` remote. */
+export interface RepoInfo extends RepoIdentity {
     /** Default branch, when the provider can resolve it (PR base fallback). */
     readonly defaultBranch?: string;
 }
@@ -40,6 +47,15 @@ export interface ForgeProvider {
     readonly id: string;
     /** Parse the repository's `origin` remote into structured {@link RepoInfo}. */
     getRepoInfo(cwd: string): Promise<RepoInfo>;
+    /**
+     * Re-parse just the `origin` remote's {@link RepoIdentity} — LOCAL only, no
+     * network. The C.26 Step-4 wrong-repo guard calls this immediately before the
+     * pull-request API call and compares it against the identity shown at approval;
+     * a mismatch (a mid-run `git remote set-url`) refuses the PR. It stays local so
+     * the re-check is cheap and cannot fail on a network hiccup. Throws the same
+     * coded usage errors as {@link getRepoInfo} when there is no parseable `origin`.
+     */
+    resolveRepoIdentity(cwd: string): RepoIdentity;
     /** Open a pull request and return its URL (idempotent on already-exists). */
     createPullRequest(repo: RepoInfo, spec: PullRequestSpec): Promise<PullRequestResult>;
 }

package/dist/workspace/add-root.d.ts

@@ -0,0 +1,27 @@
+import type { RootSpec } from "./types.js";
+import { Workspace } from "./workspace.js";
+/**
+ * The interactive add-root path (C.26 step 5). Adding a workspace root is an
+ * EXPLICIT HUMAN act — it grows the trust surface (a new root can carry its own
+ * hooks / MCP / project memory), so it is:
+ *
+ *   - reachable ONLY from the REPL command and the CLI, never as a model tool.
+ *     The model can act only through the tool registry (`registry.get(name)`),
+ *     and no tool is registered for this — the allowlist argument is unchanged.
+ *   - TTY-only: refused (coded) when there is no interactive human to vouch.
+ *   - held to the SAME validation as `--root`: the new root must exist, be a
+ *     directory, have a unique name, and NOT nest/overlap an existing root
+ *     (CRUXY_E_ROOT_OVERLAP) — reusing {@link buildWorkspace}, the single
+ *     Workspace constructor from user input.
+ *
+ * Returns the NEW immutable Workspace (the root set only ever grows by
+ * constructing a new one). A freshly added root starts UNTRUSTED; its hooks and
+ * project memory stay inert until explicitly trusted.
+ */
+export interface AddRootOptions {
+    /** Base dir for resolving a relative `path` (the session's primary root). */
+    cwd: string;
+    /** Whether stdin is a TTY — add-root is refused without an interactive human. */
+    tty: boolean;
+}
+export declare function addRootToWorkspace(current: Workspace, spec: RootSpec, opts: AddRootOptions): Promise<Workspace>;

package/dist/workspace/add-root.js

@@ -0,0 +1,16 @@
+import { usageError } from "../errors/index.js";
+import { buildWorkspace } from "./workspace.js";
+export async function addRootToWorkspace(current, spec, opts) {
+    if (!opts.tty) {
+        throw usageError("adding a workspace root is an interactive action and needs a TTY", ["declare it up front with `--root name=path` instead"]);
+    }
+    // Rebuild from the existing roots (as specs) + the new one, so EVERY
+    // buildWorkspace guard — existence, directory, name uniqueness, and the
+    // nested/overlap refusal — applies to the addition. Existing roots keep their
+    // names, absolute paths, and order (the primary stays first).
+    const specs = [
+        ...current.roots().map((r) => ({ name: r.name, path: r.absPath })),
+        spec,
+    ];
+    return buildWorkspace(specs, { cwd: opts.cwd });
+}

package/dist/workspace/index.d.ts

@@ -1,5 +1,6 @@
 export type { DeclaredRoot, RootSpec } from "./types.js";
-export { Workspace, buildWorkspace, singleRootWorkspace } from "./workspace.js";
+export { Workspace, buildWorkspace, sessionWorkspace } from "./workspace.js";
 export { PathEscapeError, confineToRoot, isInside, resolveInWorkspace, } from "./resolve.js";
 export { selectRoot } from "./select.js";
 export type { RootRef, SelectedRoot } from "./select.js";
+export { addRootToWorkspace, type AddRootOptions } from "./add-root.js";

package/dist/workspace/index.js

@@ -1,3 +1,4 @@
-export { Workspace, buildWorkspace, singleRootWorkspace } from "./workspace.js";
+export { Workspace, buildWorkspace, sessionWorkspace } from "./workspace.js";
 export { PathEscapeError, confineToRoot, isInside, resolveInWorkspace, } from "./resolve.js";
 export { selectRoot } from "./select.js";
+export { addRootToWorkspace } from "./add-root.js";

package/dist/workspace/workspace.d.ts

@@ -49,8 +49,13 @@ export declare function buildWorkspace(specs: readonly RootSpec[], opts?: {
     cwd?: string;
 }): Promise<Workspace>;
 /**
- * Build a trivial single-root workspace from one absolute path — the back-compat
- * bridge for the many call sites that still pass a single `cwd`. The one root is
- * primary and named by its basename.
+ * Build THE session's workspace from a single absolute path — the trivial
+ * single-root case. This is a *session construction* primitive, not a per-call
+ * fallback: after C.26 Step 6 it is called ONLY at the two CLI entry points that
+ * turn argv into a session (`cli/commands/run.ts`, `cli/onboard.ts`), never in the
+ * middle of a subsystem. Synthesizing one elsewhere would silently scope that
+ * subsystem to its own cwd while the fan tools see N roots (a split-brain) — the
+ * `no-split-brain` guard fails on any `sessionWorkspace(` outside those two files.
+ * The one root is primary and named by its basename.
  */
-export declare function singleRootWorkspace(absPath: string): Workspace;
+export declare function sessionWorkspace(absPath: string): Workspace;

package/dist/workspace/workspace.js

@@ -168,11 +168,16 @@ export async function buildWorkspace(specs, opts = {}) {
     return new Workspace(declared);
 }
 /**
- * Build a trivial single-root workspace from one absolute path — the back-compat
- * bridge for the many call sites that still pass a single `cwd`. The one root is
- * primary and named by its basename.
+ * Build THE session's workspace from a single absolute path — the trivial
+ * single-root case. This is a *session construction* primitive, not a per-call
+ * fallback: after C.26 Step 6 it is called ONLY at the two CLI entry points that
+ * turn argv into a session (`cli/commands/run.ts`, `cli/onboard.ts`), never in the
+ * middle of a subsystem. Synthesizing one elsewhere would silently scope that
+ * subsystem to its own cwd while the fan tools see N roots (a split-brain) — the
+ * `no-split-brain` guard fails on any `sessionWorkspace(` outside those two files.
+ * The one root is primary and named by its basename.
  */
-export function singleRootWorkspace(absPath) {
+export function sessionWorkspace(absPath) {
     const abs = path.resolve(absPath);
     return new Workspace([
         { name: path.basename(abs) || "root", absPath: abs, primary: true },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@cruxy/cli",
-  "version": "0.22.1",
+  "version": "0.24.0",
   "description": "an agentic coding CLI",
   "type": "module",
   "bin": {