@dev-loops/core 1.0.0 → 1.0.2-pre.0

package/src/loop/ui-e2e-scoping.mjs

@@ -39,6 +39,7 @@ export const REGISTERED_ARTIFACT_PATHS = Object.freeze([
   "docs/presentations/introducing-dev-loops.html",
   "docs/presentations/dev-loops-deep-dive.html",
   "docs/presentations/how-dev-loops-decided-itself.html",
+  "docs/presentations/state-graph-surface.html",
   "docs/articles/introducing-dev-loops.html",
   "docs/articles/dev-loops-deep-dive.html",
   "docs/articles/how-dev-loops-decided-itself.html",

package/src/loop/worktree-guard.mjs

@@ -192,6 +192,61 @@ export function isWorktreeCoreIsolated(cwd, worktreePaths) {
 }
 
 
+/**
+ * Realpath-normalize a path that MAY NOT EXIST yet.
+ *
+ * `realpathSync` throws ENOENT on a nonexistent leaf — which is exactly a `Write`
+ * creating a NEW file. Resolving only the roots (worktree/main) while leaving the
+ * target un-normalized makes an under-a-symlinked-ancestor comparison asymmetric,
+ * so a wrong-checkout new-file write could be misclassified. This resolves the
+ * realpath of the target's NEAREST EXISTING ancestor and rejoins the nonexistent
+ * tail, so the returned path shares the same symlink-resolved prefix the roots do.
+ *
+ * @param {string} p - Absolute or relative path (possibly not yet existing).
+ * @returns {string} A realpath-normalized absolute path (forward-slash, no trailing slash).
+ */
+export function realpathNearestExisting(p) {
+  const abs = path.resolve(p);
+  let dir = abs;
+  const tail = [];
+  // Walk up to the nearest existing ancestor.
+  for (;;) {
+    try {
+      const real = realpathSync(dir);
+      const joined = tail.length ? path.join(real, ...tail) : real;
+      return joined.replace(/\\/g, "/").replace(/\/+$/u, "");
+    } catch {
+      const parent = path.dirname(dir);
+      if (parent === dir) {
+        // Reached the filesystem root without an existing ancestor — fall back
+        // to the literal resolved path (nothing to realpath against).
+        return abs.replace(/\\/g, "/").replace(/\/+$/u, "");
+      }
+      tail.unshift(path.basename(dir));
+      dir = parent;
+    }
+  }
+}
+
+/**
+ * Map a `git check-ignore -q` outcome to whether a MAIN-checkout target must be
+ * treated as a guarded (non-gitignored) file, failing SAFE on an unresolvable
+ * outcome.
+ *
+ * `git check-ignore -q` exits 0 when the path IS gitignored and 1 when it is NOT.
+ * Any other exit (git error, missing binary) is UNRESOLVABLE: the wrong-checkout
+ * guard must not silently allow a write it cannot classify, so an unresolvable
+ * outcome is treated as guarded (deny) rather than ignored (allow).
+ *
+ * @param {number|null|undefined} checkIgnoreStatus - The `git check-ignore -q` exit status (null when it could not run).
+ * @returns {boolean} true when the target should be guarded (not-ignored, or unresolvable → fail-safe); false only when it is confirmed gitignored (exit 0).
+ */
+export function resolveTrackedFromCheckIgnore(checkIgnoreStatus) {
+  if (checkIgnoreStatus === 0) return false; // confirmed gitignored — not guarded
+  if (checkIgnoreStatus === 1) return true; // confirmed not-ignored — guarded
+  return true; // unresolvable — fail safe (AC4)
+}
+
 
 // ---------------------------------------------------------------------------
 // Subagent availability

package/src/projects/list-queue-items.mjs

@@ -1,6 +1,6 @@
 import { runChild as _runChild } from "../cli/primitives.mjs";
 import { resolveProjectSelector, findProject } from "./resolve-project.mjs";
-import { ghGraphql } from "../github/gh.mjs";
+import { ghGraphql, resolveOwner } from "../github/gh.mjs";
 
 // ── Validation ───────────────────────────────────────────────────────────
 
@@ -32,18 +32,6 @@ function validateRepo(repo) {
 
 // ── GraphQL fragments ────────────────────────────────────────────────────
 
-const GET_USER_ID = [
-  "query($login:String!) {",
-  "  user(login:$login) { id }",
-  "}"
-].join("\n");
-
-const GET_ORG_ID = [
-  "query($login:String!) {",
-  "  organization(login:$login) { id }",
-  "}"
-].join("\n");
-
 const LIST_USER_PROJECTS = [
   "query($login:String!, $after:String) {",
   "  user(login:$login) {",
@@ -111,23 +99,6 @@ const GET_PROJECT_ITEMS = [
   "}"
 ].join("\n");
 
-// ── Owner resolution ────────────────────────────────────────────────────
-
-async function resolveOwner(login, env, runChild) {
-  const userPayload = await ghGraphql(GET_USER_ID, { login }, env, runChild);
-  if (userPayload?.data?.user?.id) {
-    return { id: userPayload.data.user.id, kind: "user" };
-  }
-  const orgPayload = await ghGraphql(GET_ORG_ID, { login }, env, runChild);
-  if (orgPayload?.data?.organization?.id) {
-    return { id: orgPayload.data.organization.id, kind: "org" };
-  }
-  throw Object.assign(
-    new Error(`Could not resolve owner ID for "${login}"`),
-    { code: "NO_USER_ID" },
-  );
-}
-
 // ── Paginated project listing ────────────────────────────────────────────
 
 async function listAllProjects(login, kind, env, runChild) {

package/src/projects/move-queue-item.mjs

@@ -2,7 +2,7 @@ import { runChild as _runChild } from "../cli/primitives.mjs";
 import { runPickupRefinementGate } from "../loop/issue-refinement-artifact.mjs";
 import { loadStateColumnMap, LOGICAL_COLUMN } from "../loop/queue-board-sync.mjs";
 import { resolveProjectSelector, findProject, parseItemRef } from "./resolve-project.mjs";
-import { ghGraphql } from "../github/gh.mjs";
+import { ghGraphql, resolveOwner } from "../github/gh.mjs";
 
 // ── Validation ───────────────────────────────────────────────────────────
 
@@ -31,18 +31,6 @@ function validateRepo(repo) {
 
 // ── GraphQL fragments ────────────────────────────────────────────────────
 
-const GET_USER_ID = [
-  "query($login:String!) {",
-  "  user(login:$login) { id }",
-  "}"
-].join("\n");
-
-const GET_ORG_ID = [
-  "query($login:String!) {",
-  "  organization(login:$login) { id }",
-  "}"
-].join("\n");
-
 const LIST_USER_PROJECTS = [
   "query($login:String!, $after:String) {",
   "  user(login:$login) {",
@@ -120,23 +108,6 @@ const UPDATE_ITEM_FIELD = [
   "}"
 ].join("\n");
 
-// ── Owner resolution ────────────────────────────────────────────────────
-
-async function resolveOwner(login, env, runChild) {
-  const userPayload = await ghGraphql(GET_USER_ID, { login }, env, runChild);
-  if (userPayload?.data?.user?.id) {
-    return { id: userPayload.data.user.id, kind: "user" };
-  }
-  const orgPayload = await ghGraphql(GET_ORG_ID, { login }, env, runChild);
-  if (orgPayload?.data?.organization?.id) {
-    return { id: orgPayload.data.organization.id, kind: "org" };
-  }
-  throw Object.assign(
-    new Error(`Could not resolve owner ID for "${login}"`),
-    { code: "NO_USER_ID" },
-  );
-}
-
 // ── Paginated project listing ────────────────────────────────────────────
 
 async function listAllProjects(login, kind, env, runChild) {

package/src/projects/resolve-project.mjs

@@ -6,9 +6,9 @@ import { parse as parseYaml } from "yaml";
 // resolution used by ensure-queue-board.mjs. Returns { project }, { title },
 // and/or { olderThanDays } when configured; never throws on a missing/bad file.
 //
-// `tracker.board` (issue #1408, the tracker-agnostic seam) takes priority over
-// the deprecated `queue.board` — same precedence as loadBoardConfig in
-// ../loop/queue-board-sync.mjs and resolveTrackerBoard in ../config/config.mjs.
+// The board resolves from `tracker.board` (issue #1408, the tracker-agnostic
+// seam) — same source as loadBoardConfig in ../loop/queue-board-sync.mjs and
+// resolveTrackerBoard in ../config/config.mjs.
 function resolveSettings(cwd) {
   const basePath = path.join(cwd, ".devloops");
   const extensions = ["", ".yaml", ".yml", ".json"];
@@ -18,7 +18,7 @@ function resolveSettings(cwd) {
       const settings = ext === ".json" ? JSON.parse(raw) : parseYaml(raw);
       const queue = settings?.queue;
       const out = {};
-      const board = settings?.tracker?.board ?? queue?.board;
+      const board = settings?.tracker?.board;
       if (board && typeof board === "object") {
         if (typeof board.number === "number" && Number.isInteger(board.number) && board.number > 0) {
           out.project = board.number;
@@ -139,7 +139,7 @@ function resolveProjectSelector(args) {
     : null;
   if (!projectRef && !projectTitle) {
     throw Object.assign(
-      new Error("--project is required (or set tracker.board — or the deprecated queue.board — number / title in .devloops)"),
+      new Error("--project is required (or set tracker.board number / title in .devloops)"),
       { code: "INVALID_PROJECT" },
     );
   }
@@ -178,7 +178,7 @@ function findProject(projects, { projectRef, projectTitle }, owner) {
 }
 
 // Apply .devloops board settings when --project was not passed. Precedence:
-// explicit --project flag > queue.board.number/queue.board.title. Mutates args.
+// explicit --project flag > tracker.board.number/tracker.board.title. Mutates args.
 function applyDevloopsBoard(args, cwd) {
   if (args.project === undefined) {
     const settings = resolveSettings(cwd);

package/src/security/secret-scan.mjs

@@ -322,7 +322,19 @@ export function parseAddedLines(diffText) {
 export function scanDiffText(diffText) {
   const findings = [];
   for (const entry of parseAddedLines(diffText)) {
-    for (const hit of scanLineText(entry.text)) {
+    // Bun's generated text lock ends registry dependency tuples with a public
+    // Subresource Integrity digest. Ignore only that exact generated field in
+    // bun.lock; the same high-entropy value in source, another file, or another
+    // position on the lock line remains visible to every detector.
+    const text = entry.file === "bun.lock"
+      ? entry.text
+        .replace(/, "sha(?:256|384|512)-[A-Za-z0-9+/]+={0,2}"\],?$/u, ", \"<registry-integrity>\"]")
+        // Bun expands this dependency's published platform package family in
+        // both tuple keys and optional-dependency metadata. Several legitimate
+        // names cross the generic entropy threshold despite containing no value.
+        .replace(/@mariozechner\/clipboard-[a-z0-9-]+/gu, "<clipboard-platform-package>")
+      : entry.text;
+    for (const hit of scanLineText(text)) {
       findings.push({ file: entry.file, line: entry.line, ...hit });
     }
   }