@erclx/aitk 3.47.1 → 3.48.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "aitk",
3
3
  "description": "Automated governance, versioning, and discovery tools for Claude Code.",
4
- "version": "3.47.1",
4
+ "version": "3.48.0",
5
5
  "author": {
6
6
  "name": "Eric Le",
7
7
  "url": "https://github.com/erclx"
@@ -134,6 +134,9 @@ session when one did. Nothing tests the reply for either rule, since the scan
134
134
  below reads it for banned characters and phase labels alone, so both halves hold
135
135
  while a run applies them.
136
136
 
137
+ The `pull_request` check the git-pr surface carries reads a pull request's own
138
+ title and body, not a reply comment, so the scan below stays the only gate here.
139
+
137
140
  When step 5 rebased the branch, say so in the summary sentence and name which
138
141
  files were resolved by hand and which the regen rebuilt. The next review is a
139
142
  full pass rather than a delta, and the reader is owed the reason.
@@ -82,7 +82,7 @@ A reader deciding whether the entry still holds starts from the code paths the e
82
82
 
83
83
  Quote node labels containing spaces or special characters with double quotes (`A["Web shell"]`). Avoid parentheses inside labels, they break some renderers. Use `<br/>` for line breaks inside labels.
84
84
 
85
- Run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the whole file, including inside mermaid `subgraph` labels and node text. The file lands in the repository rather than on a remote, so the scan's destination scoping leaves the character checks and not the phase-label one. A colon also works as a replacement inside a label. The pedagogical voice the diagram standard asks for is a yield on voice alone and buys no exemption from these bans.
85
+ Run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the whole file, including inside mermaid `subgraph` labels and node text. The file lands in the repository rather than on a remote, so the scan's destination scoping leaves the character checks and not the phase-label one, and the `pull_request` check the git-pr surface carries reads only a pull request's own title and body, never a file the diff carries. A colon also works as a replacement inside a label. The pedagogical voice the diagram standard asks for is a yield on voice alone and buys no exemption from these bans.
86
86
 
87
87
  Nothing enforces the ban inside the diagram. The standards-audit hook toggles on a fence and skips every line within it, so a label carrying an em dash passes silently while the same character in the explanation paragraph below is caught. Check the labels by reading them. This is the one place in the file where the author is the only gate.
88
88
 
@@ -29,7 +29,7 @@ reader scanning the thread finds the current verdict where the last one sat.
29
29
 
30
30
  ## Step 1: resolve the PR and read context
31
31
 
32
- Resolve the PR: `gh pr view --json number,headRefName,headRefOid,title` for the current branch, or use a PR number the user names. The first seven characters of `headRefOid` are `<short-sha>`, which names the body file in Step 4.
32
+ Resolve the PR: `gh pr view --json number,headRefName,headRefOid,title,body` for the current branch, or use a PR number the user names. The first seven characters of `headRefOid` are `<short-sha>`, which names the body file in Step 4.
33
33
 
34
34
  Read these in parallel from the project root, skipping any that do not exist:
35
35
 
@@ -160,6 +160,8 @@ X critical, Y should-fix, Z minor. Reviewed against project docs and the board.
160
160
 
161
161
  A stale ticked box goes in a `**PR body**` block, in place of a `**`path/to/file.ext`**` block and ahead of every one of those, since it precedes the code the diff carries rather than sitting inside it.
162
162
 
163
+ Run `aitk labels scan --title "<title>" --body "<body>" --head <headRefName>` against the PR under review, since Step 1 already holds all three and this pass is the last human-shaped gate before merge. A hit lands in the same `**PR body**` block, `should-fix`, naming each token the scan returns. This reads the pull request being reviewed, distinct from the comment this pass is about to post, which the scan later in this step still covers.
164
+
163
165
  A later pass carrying findings keeps that shape and changes only the summary line:
164
166
 
165
167
  ```markdown
@@ -36,7 +36,7 @@ A missing tracking ref is no longer a guard. An open pull request proves the bra
36
36
  - A body a person edited by hand between rounds gets no special handling: judge it against the tree the same way regardless of who wrote it last, since a hand-edit the fix commit has made stale is the exact drift this sync exists to close.
37
37
  7. Route on the invocation and the comment count for the reply alone.
38
38
  - When invoked with `reply-owned`, skip this step: the caller posts its own reply.
39
- - Otherwise, if the count is above zero, the followup addresses review feedback: post a one-line summary of the fix with `gh pr comment --body`, first running the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against it, since the hook does not see an inline comment body.
39
+ - Otherwise, if the count is above zero, the followup addresses review feedback: post a one-line summary of the fix with `gh pr comment --body`, first running the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against it, since the hook does not see an inline comment body. The `pull_request` check the git-pr surface carries triggers on a push or an open rather than a plain edit, so neither this comment nor the title and body step 6 synced reaches it.
40
40
  - If it is zero, nothing further runs. The sync in step 6 already did this branch's job.
41
41
 
42
42
  ## After completion
@@ -41,6 +41,8 @@ After outputting the preview, execute the final command immediately. Claude Code
41
41
 
42
42
  Before running the final command, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the title and body. The title and body go straight to the remote with nothing checking them on the way, so this scan is the only gate. It covers the phase-label check as well as the characters, since both go to a reader who has no task board. It applies on top of the banned phrases in `${CLAUDE_SKILL_DIR}/../../standards/issue.md`.
43
43
 
44
+ The `pull_request` check the git-pr surface carries reads a pull request's own title and body alone, so an issue reaches no check behind this scan either.
45
+
44
46
  ### Final command
45
47
 
46
48
  Map a bug to `--label bug` and a task to `--label enhancement`.
@@ -70,7 +70,9 @@ Leave a box unchecked only for the human-only cases the reference defines, and n
70
70
 
71
71
  ### Pre-publish scan
72
72
 
73
- Before running the final command, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the PR title and body. The title and body go straight to the remote with nothing checking them on the way, so this scan is the only gate. It covers the phase-label check as well as the characters, since both go to a reader who has no task board. It applies on top of the banned phrases in `${CLAUDE_SKILL_DIR}/../../standards/pr.md`.
73
+ Before running the final command, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against the PR title and body. The title and body go straight to the remote with nothing checking them on the way, so run the scan regardless of what backs it downstream. It covers the phase-label check as well as the characters, since both go to a reader who has no task board. It applies on top of the banned phrases in `${CLAUDE_SKILL_DIR}/../../standards/pr.md`.
74
+
75
+ A `pull_request` workflow job now backs the phase-label half for this repository, running `aitk labels scan` against the opened title and body. A project holding an older `aitk` carries no such job and reaches no check at all, so the scan above stays required rather than optional.
74
76
 
75
77
  ### Resolving the pull request
76
78
 
@@ -69,7 +69,7 @@ If Mode is Independent, append this line to the preview:
69
69
 
70
70
  After outputting the preview, execute the final commands immediately. Claude Code's tool permission dialog is the confirmation gate. Do not wait for user input.
71
71
 
72
- Before running them, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against every title and body. Each body stages under `.claude/.tmp/` and leaves through `gh`, so the hook sees neither and this scan is the only gate.
72
+ Before running them, run the scan in `${CLAUDE_SKILL_DIR}/../../standards/publish.md` against every title and body. Each body stages under `.claude/.tmp/` and leaves through `gh`, so the hook sees neither and this scan is the only gate. Each resulting branch reaches the `pull_request` check the git-pr surface carries once its own pull request opens, but not before, so this scan is what catches a leak ahead of that.
73
73
 
74
74
  ### Final commands
75
75
 
@@ -58,6 +58,7 @@ Full help: `aitk <command> --help`. Behavior notes for the install and sync verb
58
58
  | `aitk secrets scan` | Report credential-shaped values in the tree the package ships, keyed on issued values rather than on words (`--json`) |
59
59
  | `aitk deps audit` | Report published advisories against the resolved dependency set, refusing rather than reporting clean when the index is unreachable (`--json`) |
60
60
  | `aitk labels audit` | Report the labels a changed set earns from the pull request label map and the paths no row reaches (`--json`) |
61
+ | `aitk labels scan` | Fail a pull request whose title or body carries a phase label, sorting a release pull request's tokens as semver rather than as a leak (`--event`, `--json`) |
61
62
  | `aitk census [path]` | Report tracked file count, a breakdown by extension, and a line total that skips whatever reads as binary (`--json`) |
62
63
  | `aitk audits run` | Run every audit as one set, report per check under one verdict, and compare each count to the recorded baseline (`--json`, `--record`) |
63
64
  | `aitk audits list` | List every audit the set runs, with the corpus each reads and whether it gates (`--json`) |
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "@erclx/aitk",
3
3
  "type": "module",
4
- "version": "3.47.1",
4
+ "version": "3.48.0",
5
5
  "description": "Infrastructure and quality tooling for developer workflows",
6
6
  "license": "MIT",
7
7
  "bin": {
@@ -1,7 +1,9 @@
1
+ import { readFileSync } from 'node:fs'
1
2
  import { resolve } from 'node:path'
2
3
  import type { Command } from 'commander'
3
4
  import { type LabelAuditRefusal, auditLabels } from '@/labels/audit'
4
5
  import { MAP_REL } from '@/labels/map'
6
+ import { scanPhaseLabels } from '@/labels/phase'
5
7
  import { intro, logInfo, logStep, logWarn, outro, plural } from '@/ui'
6
8
 
7
9
  interface AuditOptions {
@@ -10,6 +12,14 @@ interface AuditOptions {
10
12
  readonly json?: boolean
11
13
  }
12
14
 
15
+ interface ScanOptions {
16
+ readonly event?: string
17
+ readonly title?: string
18
+ readonly body?: string
19
+ readonly head?: string
20
+ readonly json?: boolean
21
+ }
22
+
13
23
  /** What a reader does about each way the audit produced no reading. */
14
24
  const REFUSALS: Record<LabelAuditRefusal, string> = {
15
25
  // An answer rather than a fault. A project declaring no map is labelled
@@ -76,6 +86,46 @@ export function register(program: Command): void {
76
86
  .action(async (paths: string[], opts: AuditOptions) => {
77
87
  process.exitCode = await runAudit(paths, opts)
78
88
  })
89
+
90
+ labels
91
+ .command('scan')
92
+ .description(
93
+ 'Fail a pull request whose title or body carries a phase label',
94
+ )
95
+ .helpOption('-h, --help', 'Show this help message')
96
+ .option(
97
+ '--event <path>',
98
+ 'GitHub pull_request event payload to read, such as $GITHUB_EVENT_PATH',
99
+ )
100
+ .option('--title <text>', 'Title to scan, overriding the event payload')
101
+ .option('--body <text>', 'Body to scan, overriding the event payload')
102
+ .option('--head <ref>', 'Head branch, overriding the event payload')
103
+ .option('--json', 'Add a machine-readable record on stdout')
104
+ .addHelpText(
105
+ 'after',
106
+ [
107
+ '',
108
+ 'Reads aitk standards versioning for the two namespaces and sorts every',
109
+ 'version-shaped token this pull request carries into the one the pull',
110
+ 'request is allowed to hold. A release-please pull request, read off its',
111
+ 'own fixed head branch and title, may carry semver references. Every',
112
+ 'other pull request may carry neither, so any token found there is a',
113
+ 'leaked phase label.',
114
+ '',
115
+ 'Exit codes:',
116
+ ' 0 no phase label found',
117
+ ' 1 refused, with the reason on stderr or in the JSON record',
118
+ ' 2 the title or body carries a phase label',
119
+ '',
120
+ 'Examples:',
121
+ ' aitk labels scan --event "$GITHUB_EVENT_PATH"',
122
+ ' aitk labels scan --title "feat: x" --body "planned under v68.5" --head feat/x',
123
+ '',
124
+ ].join('\n'),
125
+ )
126
+ .action(async (opts: ScanOptions) => {
127
+ process.exitCode = await runScan(opts)
128
+ })
79
129
  }
80
130
 
81
131
  async function runAudit(paths: string[], opts: AuditOptions): Promise<number> {
@@ -164,3 +214,148 @@ async function runAudit(paths: string[], opts: AuditOptions): Promise<number> {
164
214
 
165
215
  return coverage.uncovered.length === 0 ? 0 : 2
166
216
  }
217
+
218
+ /** Why `runScan` had no title and body to hand `scanPhaseLabels`. */
219
+ type ScanInputRefusal = 'no-input' | 'unreadable-event' | 'not-a-pull-request'
220
+
221
+ type ResolvedScanInput =
222
+ | {
223
+ readonly kind: 'resolved'
224
+ readonly title: string
225
+ readonly body: string
226
+ readonly headRefName: string
227
+ }
228
+ | {
229
+ readonly kind: 'refused'
230
+ readonly reason: ScanInputRefusal
231
+ readonly message: string
232
+ }
233
+
234
+ /**
235
+ * Reads a title, a body, and a head branch from explicit flags first and the
236
+ * named event payload second, so a caller testing the wiring by hand never
237
+ * needs a real GitHub event file on disk.
238
+ */
239
+ function resolveScanInput(opts: ScanOptions): ResolvedScanInput {
240
+ let title = opts.title
241
+ let body = opts.body
242
+ let headRefName = opts.head
243
+
244
+ if (opts.event !== undefined) {
245
+ let raw: string
246
+ try {
247
+ raw = readFileSync(opts.event, 'utf8')
248
+ } catch {
249
+ return {
250
+ kind: 'refused',
251
+ reason: 'unreadable-event',
252
+ message: `${opts.event} could not be read, so no payload was there to scan.`,
253
+ }
254
+ }
255
+
256
+ let payload: unknown
257
+ try {
258
+ payload = JSON.parse(raw)
259
+ } catch {
260
+ return {
261
+ kind: 'refused',
262
+ reason: 'unreadable-event',
263
+ message: `${opts.event} is not valid JSON, so no payload was there to scan.`,
264
+ }
265
+ }
266
+
267
+ const pullRequest =
268
+ typeof payload === 'object' && payload !== null
269
+ ? (payload as Record<string, unknown>).pull_request
270
+ : undefined
271
+
272
+ if (typeof pullRequest !== 'object' || pullRequest === null) {
273
+ return {
274
+ kind: 'refused',
275
+ reason: 'not-a-pull-request',
276
+ message: `${opts.event} carries no pull_request, so no title or body exists to scan.`,
277
+ }
278
+ }
279
+
280
+ const record = pullRequest as Record<string, unknown>
281
+ const head = record.head
282
+ title ??= typeof record.title === 'string' ? record.title : undefined
283
+ body ??= typeof record.body === 'string' ? record.body : undefined
284
+ headRefName ??=
285
+ typeof head === 'object' &&
286
+ head !== null &&
287
+ typeof (head as Record<string, unknown>).ref === 'string'
288
+ ? ((head as Record<string, unknown>).ref as string)
289
+ : undefined
290
+ }
291
+
292
+ if (title === undefined) {
293
+ return {
294
+ kind: 'refused',
295
+ reason: 'no-input',
296
+ message:
297
+ 'No --event, --title, or --body given, so there is nothing to scan.',
298
+ }
299
+ }
300
+
301
+ return {
302
+ kind: 'resolved',
303
+ title,
304
+ body: body ?? '',
305
+ headRefName: headRefName ?? '',
306
+ }
307
+ }
308
+
309
+ async function runScan(opts: ScanOptions): Promise<number> {
310
+ const emitJson = opts.json ?? false
311
+
312
+ intro('aitk labels scan')
313
+
314
+ const resolved = resolveScanInput(opts)
315
+
316
+ if (resolved.kind === 'refused') {
317
+ logStep('Refused')
318
+ logWarn(resolved.message)
319
+ outro()
320
+
321
+ if (emitJson) {
322
+ process.stdout.write(
323
+ `${JSON.stringify({ reason: resolved.reason, message: resolved.message })}\n`,
324
+ )
325
+ }
326
+ return 1
327
+ }
328
+
329
+ const result = scanPhaseLabels(resolved)
330
+
331
+ logStep('Pull request')
332
+ logInfo(
333
+ result.cutsRelease
334
+ ? 'reads as a release-please pull request'
335
+ : 'reads as an ordinary pull request',
336
+ )
337
+
338
+ logStep(result.phaseLabels.length === 0 ? 'Clean' : 'Phase label found')
339
+ if (result.phaseLabels.length === 0) {
340
+ logInfo('no phase label in the title or body')
341
+ } else {
342
+ logWarn(
343
+ `${plural(result.phaseLabels.length, 'phase label')} in the title or body. Describe the change itself and drop the internal label before publishing.`,
344
+ )
345
+ for (const label of result.phaseLabels) logWarn(label)
346
+ }
347
+
348
+ outro()
349
+
350
+ if (emitJson) {
351
+ process.stdout.write(
352
+ `${JSON.stringify({
353
+ cutsRelease: result.cutsRelease,
354
+ phaseLabels: result.phaseLabels,
355
+ semverTags: result.semverTags,
356
+ })}\n`,
357
+ )
358
+ }
359
+
360
+ return result.phaseLabels.length === 0 ? 0 : 2
361
+ }
@@ -0,0 +1,95 @@
1
+ import { linesOutsideFences, maskCodeSpans } from '@/markdown/scan'
2
+
3
+ /**
4
+ * The two version namespaces `standards/versioning.md` keeps apart, and why a
5
+ * pull request cannot be sorted between them by pattern alone.
6
+ *
7
+ * A phase label (`v68.5`) and a semver reference (`v3.44`) both match
8
+ * `v<digits>(.<digits>){1,2}`, so a shape-only scan cannot tell them apart. The
9
+ * first measurement of this defect tried exactly that and returned 28 of 60
10
+ * correct. What separates the two is not the token but the pull request: a
11
+ * release-please pull request legitimately carries version numbers in its
12
+ * generated body, and every other pull request does not.
13
+ */
14
+ export interface PhaseScanInput {
15
+ readonly title: string
16
+ readonly body: string
17
+ readonly headRefName: string
18
+ }
19
+
20
+ export interface PhaseScanResult {
21
+ /** Whether this pull request is release-please's own, per its fixed shape. */
22
+ readonly cutsRelease: boolean
23
+ readonly phaseLabels: readonly string[]
24
+ readonly semverTags: readonly string[]
25
+ }
26
+
27
+ const VERSION_TOKEN = /\bv\d+(?:\.\d+){1,2}\b/g
28
+
29
+ /**
30
+ * The head branch release-please opens every release pull request under.
31
+ *
32
+ * `release-please-config.json` names the package `aitk`, so the observed
33
+ * branch is `release-please--branches--main--components--aitk`. The prefix
34
+ * stops short of the component segment, since that segment moves with the
35
+ * package name and the branch segment does not.
36
+ */
37
+ const RELEASE_HEAD_PREFIX = 'release-please--branches--main'
38
+
39
+ const RELEASE_TITLE_PREFIX = 'chore(main): release '
40
+
41
+ /**
42
+ * Two fixed signals rather than one, because either alone is a string an
43
+ * author's own pull request could reproduce. A title starting with the
44
+ * release commit type is plain conventional-commit text, and a head branch is
45
+ * exactly what a PR renamed for review would want to imitate to slip a real
46
+ * phase label past this check. Together they name release-please's own act of
47
+ * opening the pull request, which nothing else on the remote can perform.
48
+ */
49
+ function isReleasePullRequest(input: PhaseScanInput): boolean {
50
+ return (
51
+ input.headRefName.startsWith(RELEASE_HEAD_PREFIX) &&
52
+ input.title.startsWith(RELEASE_TITLE_PREFIX)
53
+ )
54
+ }
55
+
56
+ /**
57
+ * Drops a fenced block outright and blanks a code span inside what remains,
58
+ * so a token quoted rather than written is read the way a reader reads it:
59
+ * shown, not asserted.
60
+ *
61
+ * `aitk markdown audit` excludes a fenced block and a code span from its own
62
+ * ban scan over the same kind of text, and this reuses that reading rather
63
+ * than inventing a second one. `#1208` is the corpus case that forced it: a
64
+ * backticked span quoting a test fixture's own version-shaped name, which the
65
+ * shape-only scan below cannot tell from a leak on its own.
66
+ *
67
+ * A link destination stays unmasked, unlike the ban scan's own reading. A
68
+ * release-please body's real semver reference sits inside the generated
69
+ * compare link's URL, and masking it would empty `semverTags` on the one
70
+ * pull request this check exists to pass, trading the corpus's one code-span
71
+ * leak for a hole in every release.
72
+ */
73
+ function readable(text: string): string {
74
+ return linesOutsideFences(text).map(maskCodeSpans).join('\n')
75
+ }
76
+
77
+ /**
78
+ * Reads a title and a body for version-shaped tokens and sorts every one
79
+ * found into the namespace this pull request is allowed to carry.
80
+ *
81
+ * The split runs on the pull request rather than on each token. A release
82
+ * pull request's tokens are read as the semver references its generated body
83
+ * legitimately carries, and every other pull request's tokens are read as
84
+ * leaked phase labels, which is what `standards/versioning.md` names the
85
+ * defect this exists to catch.
86
+ */
87
+ export function scanPhaseLabels(input: PhaseScanInput): PhaseScanResult {
88
+ const text = readable(`${input.title}\n${input.body}`)
89
+ const tokens = [...new Set(text.match(VERSION_TOKEN) ?? [])]
90
+ const cutsRelease = isReleasePullRequest(input)
91
+
92
+ return cutsRelease
93
+ ? { cutsRelease, phaseLabels: [], semverTags: tokens }
94
+ : { cutsRelease, phaseLabels: tokens, semverTags: [] }
95
+ }
@@ -150,6 +150,18 @@ function blank(match: string): string {
150
150
  return ' '.repeat(match.length)
151
151
  }
152
152
 
153
+ /**
154
+ * Blanks an inline code span alone, holding its width.
155
+ *
156
+ * Split from `maskDisplayed` for a reader who wants the narrower exclusion.
157
+ * A link destination often carries the one thing such a reader is after, such
158
+ * as a version-shaped token inside a generated compare link, where a code
159
+ * span is uniformly a quotation and never the claim itself.
160
+ */
161
+ export function maskCodeSpans(text: string): string {
162
+ return text.replace(CODE_SPAN, blank)
163
+ }
164
+
153
165
  /**
154
166
  * Replaces displayed spans with spaces of equal width.
155
167
  *
@@ -158,8 +170,7 @@ function blank(match: string): string {
158
170
  * everything masked ahead of it on the line.
159
171
  */
160
172
  export function maskDisplayed(text: string): string {
161
- return text
162
- .replace(CODE_SPAN, blank)
173
+ return maskCodeSpans(text)
163
174
  .replace(LINK_DESTINATION, blank)
164
175
  .replace(AUTOLINK, blank)
165
176
  }