@decohere/ci-tools 0.0.1-dev.108 → 0.0.1-dev.11

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@decohere/ci-tools",
-  "version": "0.0.1-dev.108",
+  "version": "0.0.1-dev.11",
   "description": "CI utility scripts for badge generation, coverage reporting, pages artifact assembly, and GitHub API tooling",
   "keywords": [
     "typescript",
@@ -18,25 +18,20 @@
     "./lib/lcov": "./src/lib/lcov.mjs",
     "./coverage/badge": "./src/coverage/badge.mjs",
     "./coverage/report": "./src/coverage/report.mjs",
+    "./coverage/enforce-thresholds": "./src/coverage/enforce-thresholds.mjs",
     "./badges/ci-status": "./src/badges/ci-status.mjs",
     "./pages/artifact": "./src/pages/artifact.mjs",
     "./pages/smoke": "./src/pages/smoke.mjs",
-    "./audit/format": "./src/audit/format.mjs",
     "./audit/summarize": "./src/audit/summarize.mjs",
     "./audit/enforce": "./src/audit/enforce.mjs",
     "./audit/upsert-issue": "./src/audit/upsert-issue.mjs",
-    "./audit/upsert-clickup": "./src/audit/upsert-clickup.mjs",
     "./bench/bench": "./src/bench/bench.mjs",
     "./bench/trace": "./src/bench/trace.mjs",
     "./changeset/aggregate-changelog": "./src/changeset/aggregate-changelog.mjs",
     "./changeset/check-status": "./src/changeset/check-status.mjs",
     "./github/create-issue": "./src/github/create-issue.mjs",
     "./github/ensure-metadata": "./src/github/ensure-metadata.mjs",
-    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs",
-    "./github/publish-verify": "./src/github/publish-verify.mjs",
-    "./github/credential-nudge": "./src/github/credential-nudge.mjs",
-    "./github/oidc-bootstrap-nudge": "./src/github/oidc-bootstrap-nudge.mjs",
-    "./github/smoke-create-launcher": "./src/github/smoke-create-launcher.mjs"
+    "./github/create-or-update-pr": "./src/github/create-or-update-pr.mjs"
   },
   "scripts": {
     "test": "vitest run"

package/src/audit/enforce.mjs

@@ -1,5 +1,4 @@
 import { readFileSync } from "node:fs";
-import { formatLog, highCritical, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
@@ -11,13 +10,12 @@ try {
 	process.exit(1);
 }
 
-const parsed = parseAudit(data);
-const blocking = highCritical(parsed);
+const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+const high = vulnerabilities.high ?? 0;
+const critical = vulnerabilities.critical ?? 0;
 
-if (blocking.length > 0) {
-	console.error(
-		`Security gate failed: high=${parsed.high}, critical=${parsed.critical}\n${formatLog({ ...parsed, advisories: blocking })}`,
-	);
+if (high > 0 || critical > 0) {
+	console.error(`Security gate failed: high=${high}, critical=${critical}`);
 	process.exit(1);
 }
 

package/src/audit/summarize.mjs

@@ -1,24 +1,46 @@
 import { appendFileSync, readFileSync } from "node:fs";
-import { formatLog, formatMarkdown, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 
-function writeSummary(text) {
+function writeSummary(lines) {
+	const summaryText = `${lines.join("\n")}\n`;
 	if (process.env.GITHUB_STEP_SUMMARY) {
-		appendFileSync(process.env.GITHUB_STEP_SUMMARY, text);
+		appendFileSync(process.env.GITHUB_STEP_SUMMARY, summaryText);
+		return;
 	}
+	process.stdout.write(summaryText);
 }
 
 let data = null;
 try {
 	data = JSON.parse(readFileSync(auditFilePath, "utf8"));
 } catch {
-	const msg = `npm audit output could not be parsed (${auditFilePath}).\n`;
-	process.stderr.write(msg);
-	writeSummary(`## Security Audit\n\n- ${msg}`);
-	process.exit(1);
+	writeSummary([
+		"## Security Audit",
+		"",
+		"- npm audit output could not be parsed.",
+		`- See uploaded \`${auditFilePath}\` artifact for raw output.`,
+	]);
+	process.exit(0);
 }
 
-const parsed = parseAudit(data);
-process.stdout.write(formatLog(parsed));
-writeSummary(formatMarkdown(parsed));
+const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+const info = vulnerabilities.info ?? 0;
+const low = vulnerabilities.low ?? 0;
+const moderate = vulnerabilities.moderate ?? 0;
+const high = vulnerabilities.high ?? 0;
+const critical = vulnerabilities.critical ?? 0;
+const total = vulnerabilities.total ?? info + low + moderate + high + critical;
+
+writeSummary([
+	"## Security Audit",
+	"",
+	`| Severity  | Count |`,
+	`|-----------|-------|`,
+	`| Critical  | ${critical} |`,
+	`| High      | ${high} |`,
+	`| Moderate  | ${moderate} |`,
+	`| Low       | ${low} |`,
+	`| Info      | ${info} |`,
+	`| **Total** | **${total}** |`,
+]);

package/src/audit/upsert-issue.mjs

@@ -2,7 +2,6 @@ import { spawnSync } from "node:child_process";
 import { existsSync, readFileSync, writeFileSync } from "node:fs";
 import os from "node:os";
 import path from "node:path";
-import { formatMarkdown, parseAudit } from "./format.mjs";
 
 const auditFilePath = process.argv[2] ?? "npm-audit.json";
 const ISSUE_TITLE = "security(ci): npm audit vulnerabilities detected";
@@ -15,15 +14,40 @@ function runGh(args) {
 	return result.stdout;
 }
 
-function runUrl() {
-	if (
-		process.env.GITHUB_SERVER_URL &&
-		process.env.GITHUB_REPOSITORY &&
-		process.env.GITHUB_RUN_ID
-	) {
-		return `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`;
-	}
-	return "(run URL unavailable)";
+function readAuditSummary(filePath) {
+	const data = JSON.parse(readFileSync(filePath, "utf8"));
+	const vulnerabilities = data.metadata?.vulnerabilities ?? {};
+	const info = vulnerabilities.info ?? 0;
+	const low = vulnerabilities.low ?? 0;
+	const moderate = vulnerabilities.moderate ?? 0;
+	const high = vulnerabilities.high ?? 0;
+	const critical = vulnerabilities.critical ?? 0;
+	const total = vulnerabilities.total ?? info + low + moderate + high + critical;
+	return { total, critical, high, moderate, low, info };
+}
+
+function buildBody(summary) {
+	const runUrl =
+		process.env.GITHUB_SERVER_URL && process.env.GITHUB_REPOSITORY && process.env.GITHUB_RUN_ID
+			? `${process.env.GITHUB_SERVER_URL}/${process.env.GITHUB_REPOSITORY}/actions/runs/${process.env.GITHUB_RUN_ID}`
+			: "(run URL unavailable)";
+	const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
+
+	return [
+		"## npm audit detected vulnerabilities",
+		"",
+		`- Total: ${summary.total}`,
+		`- Critical: ${summary.critical}`,
+		`- High: ${summary.high}`,
+		`- Moderate: ${summary.moderate}`,
+		`- Low: ${summary.low}`,
+		`- Info: ${summary.info}`,
+		"",
+		`- Commit: ${sha}`,
+		`- Workflow run: ${runUrl}`,
+		"",
+		"This issue is managed by CI and will be updated on subsequent main-branch runs while vulnerabilities remain.",
+	].join("\n");
 }
 
 function findExistingIssueNumber() {
@@ -46,22 +70,13 @@ if (!existsSync(auditFilePath)) {
 	process.exit(0);
 }
 
-const parsed = parseAudit(JSON.parse(readFileSync(auditFilePath, "utf8")));
-if (parsed.total === 0) {
+const summary = readAuditSummary(auditFilePath);
+if (summary.total === 0) {
 	console.log("No vulnerabilities found; skipping issue create/update.");
 	process.exit(0);
 }
 
-const sha = process.env.GITHUB_SHA ? process.env.GITHUB_SHA.slice(0, 12) : "unknown";
-const body = [
-	formatMarkdown(parsed).trim(),
-	"",
-	`- Commit: \`${sha}\``,
-	`- Workflow run: ${runUrl()}`,
-	"",
-	"This issue is managed by CI and will be updated on subsequent main-branch runs while vulnerabilities remain.",
-].join("\n");
-
+const body = buildBody(summary);
 const tempFile = path.join(os.tmpdir(), `npm-audit-issue-${Date.now()}.md`);
 writeFileSync(tempFile, body, "utf8");
 

package/src/bench/bench.mjs

@@ -34,8 +34,8 @@ const HISTORY_FILE = join(
 	"projects/ci-tools/dist/ci/bench/bench-history.json",
 );
 const VITEST_BIN = join(WORKSPACE_ROOT, "node_modules/.bin/vitest");
-const BENCH_FILE = "projects/cli/e2e/build.benchmark.bench.ts";
-const CONFIG = join(WORKSPACE_ROOT, "vitest.config.ts");
+const BENCH_FILE = "projects/terminal/e2e/build.benchmark.bench.ts";
+const CONFIG = join(WORKSPACE_ROOT, "vitest.e2e.config.ts");
 const TRACE_LOG_DIR = join(WORKSPACE_ROOT, ".decohere", "logs");
 const MAX_RUNS = 10;
 const command = process.argv[2] ?? "run";
@@ -326,17 +326,7 @@ const outJson = join(tmpDir, "output.json");
 try {
 	const result = spawnSync(
 		VITEST_BIN,
-		[
-			"bench",
-			"--config",
-			CONFIG,
-			"--project",
-			"e2e",
-			"--run",
-			"--outputJson",
-			outJson,
-			BENCH_FILE,
-		],
+		["bench", "--config", CONFIG, "--run", "--outputJson", outJson, BENCH_FILE],
 		{
 			cwd: WORKSPACE_ROOT,
 			stdio: traceEnabled ? "pipe" : "inherit",

package/src/bench/trace.mjs

@@ -6,8 +6,8 @@ import { join } from "node:path";
 
 const WORKSPACE_ROOT = process.cwd();
 const VITEST_BIN = join(WORKSPACE_ROOT, "node_modules/.bin/vitest");
-const CONFIG = join(WORKSPACE_ROOT, "vitest.config.ts");
-const TRACE_SPEC = "projects/cli/e2e/build.trace.e2e.spec.ts";
+const CONFIG = join(WORKSPACE_ROOT, "vitest.e2e.config.ts");
+const TRACE_SPEC = "projects/terminal/e2e/build.trace.e2e.spec.ts";
 const TRACE_LOG_DIR = join(WORKSPACE_ROOT, ".decohere", "logs");
 
 function truthy(value, defaultValue = false) {
@@ -149,23 +149,19 @@ if (traceLogPath != null) {
 	mkdirSync(TRACE_LOG_DIR, { recursive: true });
 }
 
-const result = spawnSync(
-	VITEST_BIN,
-	["run", "--config", CONFIG, "--project", "e2e", TRACE_SPEC],
-	{
-		cwd: WORKSPACE_ROOT,
-		stdio: "pipe",
-		encoding: "utf8",
-		maxBuffer: 1024 * 1024 * 200,
-		env: {
-			...process.env,
-			NODE_OPTIONS: "",
-			FORGE_TRACE: "1",
-			FORGE_TRACE_STRUCTURED: "1",
-			LOG_LEVEL: process.env.LOG_LEVEL ?? "trace",
-		},
+const result = spawnSync(VITEST_BIN, ["run", "--config", CONFIG, TRACE_SPEC], {
+	cwd: WORKSPACE_ROOT,
+	stdio: "pipe",
+	encoding: "utf8",
+	maxBuffer: 1024 * 1024 * 200,
+	env: {
+		...process.env,
+		NODE_OPTIONS: "",
+		FORGE_TRACE: "1",
+		FORGE_TRACE_STRUCTURED: "1",
+		LOG_LEVEL: process.env.LOG_LEVEL ?? "trace",
 	},
-);
+});
 
 const stdout = typeof result.stdout === "string" ? result.stdout : "";
 const stderr = typeof result.stderr === "string" ? result.stderr : "";

package/src/coverage/enforce-thresholds.mjs

@@ -0,0 +1,144 @@
+import { existsSync, readdirSync, readFileSync } from "node:fs";
+import { resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { parseLcovByProject } from "../lib/lcov.mjs";
+
+function parseArgs(argv) {
+	const options = {
+		lcov: ".forge/coverage/lcov.info",
+		thresholds: null,
+		thresholdsModule: null,
+		projectsDir: "projects",
+	};
+
+	for (let index = 0; index < argv.length; index += 1) {
+		const arg = argv[index];
+		if (arg === "--lcov") {
+			options.lcov = argv[index + 1] ?? options.lcov;
+			index += 1;
+			continue;
+		}
+		if (arg === "--thresholds") {
+			options.thresholds = argv[index + 1] ?? options.thresholds;
+			index += 1;
+			continue;
+		}
+		if (arg === "--thresholds-module") {
+			options.thresholdsModule = argv[index + 1] ?? options.thresholdsModule;
+			index += 1;
+			continue;
+		}
+		if (arg === "--projectsDir") {
+			options.projectsDir = argv[index + 1] ?? options.projectsDir;
+			index += 1;
+		}
+	}
+
+	return options;
+}
+
+async function resolveThresholds(options) {
+	if (options.thresholdsModule) {
+		const moduleUrl = pathToFileURL(resolve(options.thresholdsModule)).href;
+		const mod = await import(moduleUrl);
+		const thresholds = mod.projectCoverageThresholds;
+		if (typeof thresholds !== "object" || thresholds == null) {
+			console.error(
+				`Module ${options.thresholdsModule} must export a 'projectCoverageThresholds' object.`,
+			);
+			process.exit(1);
+		}
+		return thresholds;
+	}
+
+	const path = options.thresholds ?? "coverage.config.json";
+	if (!existsSync(path)) {
+		console.error(`Thresholds config not found: ${path}`);
+		process.exit(1);
+	}
+	const parsed = JSON.parse(readFileSync(path, "utf8"));
+	if (typeof parsed !== "object" || parsed == null) {
+		console.error(
+			"Thresholds config must be a JSON object mapping project => minimum coverage percentage.",
+		);
+		process.exit(1);
+	}
+	return parsed;
+}
+
+function formatPct(value) {
+	return `${value.toFixed(2)}%`;
+}
+
+async function main() {
+	const options = parseArgs(process.argv.slice(2));
+	const lcovPath = resolve(options.lcov);
+	const projectsDirPath = resolve(options.projectsDir);
+
+	if (!existsSync(lcovPath)) {
+		console.error(`LCOV file not found: ${lcovPath}`);
+		console.error("Run coverage first (example: npm run test:coverage)");
+		process.exit(1);
+	}
+
+	if (!existsSync(projectsDirPath)) {
+		console.error(`Projects directory not found: ${projectsDirPath}`);
+		process.exit(1);
+	}
+
+	const thresholds = await resolveThresholds(options);
+	const projectDirs = readdirSync(projectsDirPath, { withFileTypes: true })
+		.filter((entry) => entry.isDirectory())
+		.map((entry) => entry.name)
+		.sort((left, right) => left.localeCompare(right));
+
+	const coverageByProject = parseLcovByProject(readFileSync(lcovPath, "utf8"));
+
+	const missingThresholds = projectDirs.filter(
+		(projectName) => thresholds[projectName] == null,
+	);
+	if (missingThresholds.length > 0) {
+		console.error("Missing coverage thresholds for projects:");
+		for (const projectName of missingThresholds) console.error(`- ${projectName}`);
+		console.error(
+			"Update projectCoverageThresholds in vitest.config.ts to include all project directories.",
+		);
+		process.exit(1);
+	}
+
+	const failures = [];
+	console.log("Project line coverage thresholds");
+
+	for (const projectName of projectDirs) {
+		const projectCoverage = coverageByProject.get(projectName) ?? {
+			totalLines: 0,
+			coveredLines: 0,
+		};
+		const currentPct =
+			projectCoverage.totalLines === 0
+				? 0
+				: (projectCoverage.coveredLines / projectCoverage.totalLines) * 100;
+		const minimumPct = Number(thresholds[projectName]);
+		const passed = Number.isFinite(minimumPct) && currentPct >= minimumPct;
+
+		console.log(
+			`${passed ? "✅" : "❌"} ${projectName}: ${formatPct(currentPct)} (min ${formatPct(minimumPct)})`,
+		);
+
+		if (!passed) failures.push({ projectName, currentPct, minimumPct });
+	}
+
+	if (failures.length > 0) {
+		console.error("\nCoverage threshold check failed:");
+		for (const failure of failures) {
+			console.error(
+				`- ${failure.projectName}: ${formatPct(failure.currentPct)} is below ${formatPct(failure.minimumPct)}`,
+			);
+		}
+		process.exit(1);
+	}
+
+	console.log("\nAll project coverage thresholds passed.");
+}
+
+main();

package/src/pages/clear-bench-history.mjs

@@ -0,0 +1,27 @@
+#!/usr/bin/env node
+
+// Clear benchmark history for this publish (workflow_dispatch with clear-history=true)
+
+import { writeFileSync } from "node:fs";
+import { mkdir } from "node:fs/promises";
+
+const HISTORY_DIR = "projects/ci-tools/dist/ci/bench";
+const HISTORY_FILE = `${HISTORY_DIR}/bench-history.json`;
+
+try {
+	await mkdir(HISTORY_DIR, { recursive: true });
+	writeFileSync(
+		HISTORY_FILE,
+		JSON.stringify(
+			{
+				runs: {},
+			},
+			null,
+			2,
+		),
+	);
+	console.log("✓ Cleared benchmark history");
+} catch (error) {
+	console.error("Error clearing benchmark history:", error.message);
+	process.exit(1);
+}

package/src/release/sync-dependencies.mjs

@@ -7,9 +7,10 @@
 import { execSync } from "node:child_process";
 
 const DRY_RUN = process.env.DRY_RUN === "true";
+const TERMINAL_CLI = process.env.TERMINAL_CLI || "dist/debug/projects/terminal/src/cli.js";
 const DECOHERE_CONFIG = process.env.DECOHERE_CONFIG || ".decohere.js";
 
-const baseCmd = `pnpm forge --log-level info --config-file "${DECOHERE_CONFIG}" dependencies --configuration release sync`;
+const baseCmd = `node "${TERMINAL_CLI}" --log-level trace --config-file "${DECOHERE_CONFIG}" forge dependencies --configuration release sync`;
 
 try {
 	if (DRY_RUN) {

package/src/audit/format.mjs

@@ -1,133 +0,0 @@
-/**
- * Shared npm/pnpm audit JSON helpers.
- *
- * Supports pnpm's classic `{ advisories }` report and npm audit v2
- * `{ auditReportVersion: 2, vulnerabilities }` (pnpm 9+/10).
- */
-
-const SEVERITY_ORDER = ["critical", "high", "moderate", "low", "info"];
-
-function ghsaFromUrl(url) {
-	return typeof url === "string" ? (url.match(/GHSA-[a-z0-9-]+/i)?.[0] ?? "") : "";
-}
-
-function fromClassicAdvisories(data) {
-	return Object.values(data?.advisories ?? {}).map((raw) => {
-		const paths = (raw.findings ?? []).flatMap((f) => f.paths ?? []);
-		const url = raw.url ?? "";
-		return {
-			id: raw.id,
-			module: raw.module_name ?? "(unknown)",
-			severity: String(raw.severity ?? "info").toLowerCase(),
-			title: raw.title ?? "",
-			url,
-			vulnerable: raw.vulnerable_versions ?? "",
-			patched: raw.patched_versions ?? "",
-			cves: raw.cves ?? [],
-			ghsa: ghsaFromUrl(url),
-			paths: paths.slice(0, 3),
-		};
-	});
-}
-
-function fromNpmV2(data) {
-	const byKey = new Map();
-	for (const vuln of Object.values(data?.vulnerabilities ?? {})) {
-		const vias = Array.isArray(vuln.via) ? vuln.via : [];
-		for (const via of vias) {
-			if (via == null || typeof via !== "object") continue;
-			const url = via.url ?? "";
-			const key = url || `${via.name ?? vuln.name}:${via.title ?? ""}`;
-			const existing = byKey.get(key);
-			const node = Array.isArray(vuln.nodes) ? vuln.nodes[0] : undefined;
-			if (existing) {
-				if (node && existing.paths.length < 3 && !existing.paths.includes(node)) {
-					existing.paths.push(node);
-				}
-				continue;
-			}
-			byKey.set(key, {
-				id: via.source,
-				module: via.name ?? vuln.name ?? "(unknown)",
-				severity: String(via.severity ?? vuln.severity ?? "info").toLowerCase(),
-				title: via.title ?? "",
-				url,
-				vulnerable: via.range ?? vuln.range ?? "",
-				patched: "",
-				cves: [],
-				ghsa: ghsaFromUrl(url),
-				paths: node ? [node] : [],
-			});
-		}
-	}
-	return [...byKey.values()];
-}
-
-export function parseAudit(data) {
-	const counts = data?.metadata?.vulnerabilities ?? {};
-	const info = counts.info ?? 0;
-	const low = counts.low ?? 0;
-	const moderate = counts.moderate ?? 0;
-	const high = counts.high ?? 0;
-	const critical = counts.critical ?? 0;
-	const total = counts.total ?? info + low + moderate + high + critical;
-
-	const classic = data?.advisories != null && Object.keys(data.advisories).length > 0;
-	const advisories = classic ? fromClassicAdvisories(data) : fromNpmV2(data);
-
-	advisories.sort((a, b) => {
-		const d = SEVERITY_ORDER.indexOf(a.severity) - SEVERITY_ORDER.indexOf(b.severity);
-		if (d !== 0) return d;
-		return String(a.module).localeCompare(String(b.module));
-	});
-
-	return { total, critical, high, moderate, low, info, advisories };
-}
-
-export function formatLog(parsed) {
-	const lines = [
-		`npm audit: total=${parsed.total} critical=${parsed.critical} high=${parsed.high} moderate=${parsed.moderate} low=${parsed.low} info=${parsed.info}`,
-	];
-	for (const a of parsed.advisories) {
-		const id = a.ghsa || a.cves[0] || a.id;
-		lines.push(
-			`  [${a.severity}] ${a.module} ${id}: ${a.title} (vulnerable ${a.vulnerable}; patched ${a.patched})`,
-		);
-		if (a.url) lines.push(`    ${a.url}`);
-		if (a.paths[0]) lines.push(`    ${a.paths[0]}`);
-	}
-	return `${lines.join("\n")}\n`;
-}
-
-export function formatMarkdown(parsed) {
-	const lines = [
-		"## npm audit",
-		"",
-		"| Severity | Count |",
-		"|---|---|",
-		`| Critical | ${parsed.critical} |`,
-		`| High | ${parsed.high} |`,
-		`| Moderate | ${parsed.moderate} |`,
-		`| Low | ${parsed.low} |`,
-		`| Info | ${parsed.info} |`,
-		`| **Total** | **${parsed.total}** |`,
-		"",
-	];
-	if (parsed.advisories.length === 0) {
-		lines.push("No advisories.");
-		return `${lines.join("\n")}\n`;
-	}
-	lines.push("### Advisories", "");
-	for (const a of parsed.advisories) {
-		const id = a.ghsa || a.cves.join(", ") || a.id;
-		const link = a.url ? `[${id}](${a.url})` : id;
-		lines.push(`- **${a.severity}** \`${a.module}\` ${link} — ${a.title}`);
-		lines.push(`  - vulnerable: \`${a.vulnerable}\`; patched: \`${a.patched}\``);
-		if (a.paths[0]) lines.push(`  - ${a.paths[0]}`);
-	}
-	return `${lines.join("\n")}\n`;
-}
-
-export function highCritical(parsed) {
-	return parsed.advisories.filter((a) => a.severity === "high" || a.severity === "critical");
-}