@dougharness/cli 1.4.0 → 1.6.0

package/node_modules/@dougharness/gates/lib/baseline.mjs

@@ -258,6 +258,15 @@ export function writeAgentStart(dir, cfg, sessionId, agentId) {
   try {
     const fp = treeFingerprint(dir, cfg, changedFiles(dir));
     if (!fp) return;
+    // card worktree-skip-origin-at-start: origin/HEAD's sha at start (null when unset), for the worktree skip.
+    let originHead = null;
+    try {
+      const o = execFileSync("git", ["rev-parse", "--verify", "-q", "refs/remotes/origin/HEAD^{commit}"], { cwd: dir, encoding: "utf8", stdio: ["ignore", "pipe", "ignore"], timeout: 5000 }).trim();
+      if (/^[0-9a-f]{7,64}$/.test(o)) originHead = o;
+    } catch {
+      originHead = null;
+    }
+    fp.originHead = originHead;
     const file = agentStartFile(dir, sessionId, agentId);
     mkdirSync(join(file, ".."), { recursive: true });
     writeFileSync(file, JSON.stringify(fp));

package/node_modules/@dougharness/gates/lib/block-ledger.mjs

@@ -110,13 +110,15 @@ export function failingTestFilesFrom(output, dir) {
 //    them is in the standing tests_red_by_design claim (`redByDesignClaimFiles`).
 // 2. 'load-timeout' — at least one command timed out or was dropped for budget, and no failed command's
 //    captured output names a failing test file.
-// 3. 'race' — the working tree (`changedFiles(dir)`, as a set) differs now from `changedAtStart`. Either
+// 3. 'test-count' — the test-count ratchet is the block's only problem (`countProblems > 0` and it equals
+//    `totalProblems`).
+// 4. 'race' — the working tree (`changedFiles(dir)`, as a set) differs now from `changedAtStart`. Either
 //    side being unknown (null: no git, or git unavailable) is never a race. Skipped entirely once
 //    `budgetDeadline` (the gate's own hook-timeout deadline, gateBudget() in stop-gate.mjs) has already
 //    passed (review pass 2, item 4): a second `git status` here is exactly the kind of extra work that
 //    could push a slow gate past the platform's own hook timeout, discarding its block message (F1) — a
 //    deadline already blown is not worth spending on a label, so this falls through to 'real' instead.
-// 4. 'real' — otherwise.
+// 5. 'real' — otherwise.
 //
 // Never throws (review pass 2, item 2 MAJOR): this call sits between the gate's decision to block and the
 // blockStop call that carries it out (stop-gate.mjs), so an unguarded throw here would fail the *whole gate*
@@ -141,10 +143,10 @@ export function classifyFinalBlock({ countProblems, totalProblems, preVerificati
       if (allNamed.every((f) => claimSet.has(f))) return "expected-red";
     }
 
-    // card block-ledger-failing-output: the test-count ratchet is the block's only problem.
     const timedOutOrDropped = (Array.isArray(results) ? results : []).some((r) => r.timedOut || r.skipped === "budget");
     if (timedOutOrDropped && allNamed.length === 0) return "load-timeout";
 
+    // card block-ledger-failing-output: the test-count ratchet is the block's only problem.
     if (typeof countProblems === "number" && countProblems > 0 && totalProblems === countProblems) return "test-count";
 
     if (Array.isArray(changedAtStart) && !(typeof budgetDeadline === "number" && Date.now() >= budgetDeadline)) {
@@ -213,6 +215,7 @@ export function appendBlockLine(dir, { hook, agent, reason, class: cls, session,
         class: cls,
         session: session ?? null,
         ...plain,
+        files: Array.isArray(plain.files) ? plain.files : [],
       }) + "\n";
     mkdirSync(join(dir, ".doug/.state"), { recursive: true });
     appendFileSync(join(dir, BLOCKS_RELPATH), line);

package/node_modules/@dougharness/gates/lib/gate-lock.mjs

@@ -1,9 +1,11 @@
 // The gate.lock helpers shared by the Stop gate (scripts/stop-gate.mjs) and verify.mjs (card
 // verify-takes-gate-lock). Moved verbatim from stop-gate.mjs; the Stop gate's behaviour is unchanged.
 
-import { accessSync, constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { execFileSync } from "node:child_process";
+import { accessSync, constants, existsSync, mkdirSync, readFileSync, realpathSync, unlinkSync, writeFileSync } from "node:fs";
+import { execFileSync, spawnSync } from "node:child_process";
 import { dirname, join, resolve } from "node:path";
+import { pathToFileURL } from "node:url";
+import { loadConfig } from "./config.mjs";
 
 // Single-runner lock (card stop-gate-process-storm, goal 3): only one gate runs the verification commands
 // at a time per project, so concurrent SubagentStops share one suite instead of each starting its own (the
@@ -72,10 +74,10 @@ export function pidIsLive(pid) {
 
 // Creates gate.lock exclusively (throws EEXIST when one is already there, or any other fs error). The
 // caller decides what a failure means.
-export function writeGateLock(dir, sessionId) {
+export function writeGateLock(dir, sessionId, pid = process.pid) {
   const p = gateLockPath(dir);
   mkdirSync(dirname(p), { recursive: true });
-  writeFileSync(p, JSON.stringify({ pid: process.pid, session: sessionId, at: Date.now() }), { flag: "wx" });
+  writeFileSync(p, JSON.stringify({ pid, session: sessionId, at: Date.now() }), { flag: "wx" });
 }
 
 // Overwrites gate.lock with this gate's own pid/session, whether it was stale (a dead pid) or its holder
@@ -92,6 +94,48 @@ export function takeOverGateLock(dir, sessionId) {
   }
 }
 
+// Card gate-load-timeouts: exclusive acquisition for a waiter that saw the lock released, dead or stale. The
+// old path overwrote it, so two waiters leaving the wait loop together both ran their suites (ledger blocks 425
+// and 426). Creates with wx; a stale lock is removed only while the content judged stale is still in place, and
+// EEXIST reports "busy" so the caller keeps waiting. Returns "acquired", "busy" or "unwritable" (the lock cannot
+// be written at all: run unlocked). Never throws.
+export function acquireGateLock(dir, sessionId, hookTimeoutMs, pid = process.pid) {
+  try {
+    const p = gateLockPath(dir);
+    for (let attempt = 0; attempt < 3; attempt++) {
+      try {
+        writeGateLock(dir, sessionId, pid);
+        return "acquired";
+      } catch (err) {
+        if (!err || err.code !== "EEXIST") return "unwritable";
+      }
+      let raw;
+      try {
+        raw = readFileSync(p, "utf8");
+      } catch {
+        continue; // released between the create and the read: try the create again
+      }
+      let lock = null;
+      try {
+        const o = JSON.parse(raw);
+        lock = o && typeof o === "object" && Number.isInteger(o.pid) && o.pid > 0 ? o : null;
+      } catch {
+        lock = null;
+      }
+      if (lock && pidIsLive(lock.pid) && !lockStaleByAge(lock, hookTimeoutMs)) return "busy";
+      try {
+        if (readFileSync(p, "utf8") !== raw) return "busy"; // someone else replaced it meanwhile
+        unlinkSync(p);
+      } catch {
+        // already gone, or not removable: the next create decides
+      }
+    }
+    return "busy";
+  } catch {
+    return "unwritable";
+  }
+}
+
 // Card stop-gate-budget-under-hook-timeout: cfg.stopGate.hookTimeoutSec must equal the platform's own
 // Stop/SubagentStop hook `timeout` (hooks.json/settings.json), but a hook reader never throws (F6), so a
 // missing, non-number, or non-positive value reads as the platform's own default, 600.
@@ -124,3 +168,130 @@ export function normalizedTimeoutMs(cfg) {
 export function lockWaitBoundMs(perCommandMs, commandCount) {
   return perCommandMs * Math.max(1, commandCount);
 }
+
+// Card gate-load-timeouts: CLI for .githooks/pre-commit, so a commit's suites queue on the same gate.lock as the
+// Stop gate and verify.mjs (ledger blocks 422, 432, 435 had a lock-free pre-commit suite next to a gate's).
+// `node gate-lock.mjs run -- <command> [args...]`, run from the repo top level: waits on a live lock up to
+// stopGate.timeoutMs (default 300000), then runs anyway; a stale lock is taken at once; a lock that cannot be
+// written runs unlocked. Leading NAME=VALUE arguments set the command's env; one remaining argument runs via `sh -c`.
+// Holds the lock while the command runs, releases it, exits with the command's status.
+function isMain() {
+  try {
+    return !!process.argv[1] && import.meta.url === pathToFileURL(realpathSync(process.argv[1])).href;
+  } catch {
+    return false;
+  }
+}
+if (isMain()) {
+  const args = process.argv.slice(2);
+  const dir = process.cwd();
+  const sub = args[0];
+  if (sub === "acquire" || sub === "release") {
+    // Card gate-lock-takeover-exclusive: one lock for a whole shell hook, held under the hook shell's own pid
+    // (`--pid $$`, alive for the whole hook). `acquire` waits like `run` and exits 0 whether it owns the lock,
+    // gave up waiting, or the lock is unwritable (the hook then runs unlocked); a non-zero exit is a runner
+    // failure. `release` removes the lock only when it names that pid, and never fails.
+    const pidArg = args.indexOf("--pid") === -1 ? NaN : Number(args[args.indexOf("--pid") + 1]);
+    if (!Number.isInteger(pidArg) || pidArg <= 0) {
+      process.stderr.write(`usage: gate-lock.mjs ${sub} --pid <pid>\n`);
+      process.exit(2);
+    }
+    if (sub === "release") {
+      try {
+        const lock = readGateLock(dir);
+        if (lock && lock.pid === pidArg) unlinkSync(gateLockPath(dir));
+      } catch {
+        // never fail a release
+      }
+      process.exit(0);
+    }
+    let waitMs = 300000;
+    let hookTimeoutMs = 600000;
+    try {
+      const cfg = loadConfig(dir);
+      waitMs = normalizedTimeoutMs(cfg) ?? waitMs;
+      hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
+    } catch {
+      // defaults
+    }
+    const deadline = Date.now() + waitMs;
+    const nap = new Int32Array(new SharedArrayBuffer(4));
+    while (true) {
+      const r = acquireGateLock(dir, "pre-commit", hookTimeoutMs, pidArg);
+      if (r !== "busy") break;
+      if (Date.now() >= deadline) {
+        process.stderr.write(`[doug] pre-commit: gate.lock still held after ${waitMs} ms; running anyway.\n`);
+        break;
+      }
+      Atomics.wait(nap, 0, 0, 200);
+    }
+    process.exit(0);
+  }
+  const sep = args.indexOf("--");
+  const cmd = sep === -1 ? [] : args.slice(sep + 1);
+  if (args[0] !== "run" || cmd.length === 0) {
+    process.stderr.write("usage: gate-lock.mjs run -- <command> [args...]\n");
+    process.exit(2);
+  }
+  let owned = false;
+  const release = () => {
+    try {
+      if (!owned) return;
+      owned = false;
+      const lock = readGateLock(dir);
+      if (lock && lock.pid === process.pid) unlinkSync(gateLockPath(dir));
+    } catch {
+      // never throw from a release
+    }
+  };
+  process.on("exit", release);
+  for (const sig of ["SIGINT", "SIGTERM", "SIGHUP"]) process.on(sig, () => process.exit(128));
+  try {
+    let waitMs = 300000;
+    let hookTimeoutMs = 600000;
+    try {
+      const cfg = loadConfig(dir);
+      waitMs = normalizedTimeoutMs(cfg) ?? waitMs;
+      hookTimeoutMs = resolveHookTimeoutSec(cfg) * 1000;
+    } catch {
+      // defaults
+    }
+    const deadline = Date.now() + waitMs;
+    const nap = new Int32Array(new SharedArrayBuffer(4));
+    while (true) {
+      const r = acquireGateLock(dir, "pre-commit", hookTimeoutMs);
+      if (r === "acquired") {
+        owned = true;
+        break;
+      }
+      if (r === "unwritable") break;
+      if (Date.now() >= deadline) {
+        process.stderr.write(`[doug] pre-commit: gate.lock still held after ${waitMs} ms; running ${cmd[0]} anyway.\n`);
+        break;
+      }
+      Atomics.wait(nap, 0, 0, 200);
+    }
+  } catch {
+    // run unlocked rather than block a commit on a lock fault
+  }
+  // Card gate-lock-run-shell-forms: leading NAME=VALUE arguments go into the child's environment, a single
+  // remaining argument runs through `sh -c` (a quoted compound command), and several arguments spawn as argv
+  // unchanged. A command that cannot be spawned says so on stderr and exits 127 instead of a silent 1.
+  const env = { ...process.env };
+  let argv = cmd;
+  while (argv.length > 1 && /^[A-Za-z_][A-Za-z0-9_]*=/.test(argv[0])) {
+    const eq = argv[0].indexOf("=");
+    env[argv[0].slice(0, eq)] = argv[0].slice(eq + 1);
+    argv = argv.slice(1);
+  }
+  const res =
+    argv.length === 1
+      ? spawnSync("sh", ["-c", argv[0]], { stdio: "inherit", env })
+      : spawnSync(argv[0], argv.slice(1), { stdio: "inherit", env });
+  release();
+  if (res.error) {
+    process.stderr.write(`[doug] gate-lock run: cannot run ${argv[0]}: ${res.error.message}\n`);
+    process.exit(127);
+  }
+  process.exit(res.status === null ? 1 : res.status);
+}

package/node_modules/@dougharness/gates/lib/test-totals.mjs

@@ -5,7 +5,7 @@
 //   - Counts cannot see delete-one-add-one: a session that removes a test and adds an unrelated one keeps
 //     every number level and passes.
 //   - The verified-unchanged skip runs no test command, so there is no output to count there; no count check
-//     happens on it. (The pre-commit credit path is counted from the totals the hook records in last-run.json.)
+//     happens on it. (The credited path is counted from the totals the verified-tree record carries.)
 //   - The baseline is the number of `Tests` summaries a command prints plus their sum (ADR 0013): a session
 //     that adds or removes a package changes the number of summaries and blocks with no waiver until a new
 //     baseline is taken.

package/node_modules/@dougharness/gates/lib/verified-tree.mjs

@@ -17,6 +17,7 @@ import { copyFileSync, existsSync, mkdirSync, readFileSync, realpathSync, rename
 import { join, resolve } from "node:path";
 import { randomBytes } from "node:crypto";
 import { pathToFileURL } from "node:url";
+import { readSummaries } from "./test-totals.mjs";
 
 export const RECORD_RELPATH = ".doug/.state/verified-tree.json";
 export const EXCLUDED = [".doug/.state", ".claude/worktrees", ".doug/anchor.md"];
@@ -108,6 +109,37 @@ export function validRecord(r) {
   }
 }
 
+// Test totals depend on the environment (a worktree without a built dist skips tests), not only the tree. A record
+// stamps `ranIn` (realpath of the directory its commands ran in); its totals count as evidence only for that directory.
+// Never throws: any failure, or a record with no ranIn (legacy), is false (the commands run).
+export function totalsUsable(record, dir) {
+  try {
+    return !!record && typeof record.ranIn === "string" && realpathSync(record.ranIn) === realpathSync(dir);
+  } catch {
+    return false;
+  }
+}
+
+// A record from another checkout (or a legacy one with no ranIn) credits exit codes only when none of its recorded
+// totals reports skipped tests: a dist-less worktree skips tests that could fail here. Absent or unreadable entries
+// do not count. Never throws: any failure is false.
+export function exitCreditUsable(record, dir) {
+  try {
+    if (!record || typeof record !== "object") return false;
+    if (totalsUsable(record, dir)) return true;
+    const totals = record.totals;
+    if (!totals || typeof totals !== "object") return true;
+    for (const entry of Object.values(totals)) {
+      const sums = readSummaries(entry);
+      if (!sums) continue;
+      if (sums.reduce((n, s) => n + (s.skipped || 0), 0) > 0) return false;
+    }
+    return true;
+  } catch {
+    return false;
+  }
+}
+
 export function readRecord(dir) {
   try {
     const r = JSON.parse(readFileSync(join(dir, RECORD_RELPATH), "utf8"));
@@ -214,6 +246,7 @@ if (isMain()) {
           node: process.version,
           at: new Date().toISOString(),
           by: "pre-commit",
+          ranIn: realpathSync(dir),
           commands: commands.map((cm) => ({ name: cm.name, command: cm.command, exit: cm.exit, durationMs: cm.durationMs })),
           totals,
         });

package/node_modules/@dougharness/gates/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dougharness/gates",
-  "version": "1.4.0",
+  "version": "1.6.0",
   "private": true,
   "description": "Deterministic Claude Code hooks: protected paths, bash guard, secret scan on edits and commands, format on edit, edit-loop detection, stop gate, re-anchor after compaction.",
   "type": "module",