@geraldmaron/construct 1.1.1 → 1.2.1

package/lib/health-check.mjs

@@ -10,6 +10,7 @@ import { spawnSync } from 'node:child_process';
 import os from 'node:os';
 import path from 'node:path';
 import { existsSync, readFileSync } from 'node:fs';
+import { extractOpRef, hasAnySecret, hasSecret } from './providers/secret-resolver.mjs';
 
 const isWindows = os.platform() === 'win32';
 
@@ -165,37 +166,73 @@ export async function checkPrerequisites(options = {}) {
 }
 
 /**
- * Get a value from shell env by checking common sources.
- * Looks in process.env → project .env → ~/.env → ~/.construct/config.env
- * → shell rc files for op:// refs (resolved via 'op read').
+ * Read a credential raw value from dotenv files and shell rc without invoking
+ * `op read`. Returns op:// references as-is so callers can persist or report
+ * presence without biometric prompts (ADR-0042).
  */
-function getEnvFromShell(varName, homeDir) {
+function readCredentialRaw(varName, homeDir) {
   if (process.env[varName]) return process.env[varName];
 
-  const projectEnv = path.join(process.cwd(), '.env');
-  if (existsSync(projectEnv)) {
+  for (const envPath of [
+    path.join(process.cwd(), '.env'),
+    path.join(homeDir, '.env'),
+    path.join(homeDir, '.construct', 'config.env'),
+  ]) {
+    if (!existsSync(envPath)) continue;
     try {
-      const content = readFileSync(projectEnv, 'utf8');
+      const content = readFileSync(envPath, 'utf8');
       const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
       if (m) return m[1].trim();
     } catch { /* skip */ }
   }
 
-  const homeEnv = path.join(homeDir, '.env');
-  if (existsSync(homeEnv)) {
+  const shellFiles = [
+    path.join(homeDir, '.zshrc'),
+    path.join(homeDir, '.bashrc'),
+    path.join(homeDir, '.bash_profile'),
+    path.join(homeDir, '.profile'),
+  ];
+  for (const rcPath of shellFiles) {
+    if (!existsSync(rcPath)) continue;
     try {
-      const content = readFileSync(homeEnv, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
-      if (m) return m[1].trim();
+      const content = readFileSync(rcPath, 'utf8');
+      const opRe = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
+      const opMatch = content.match(opRe);
+      if (opMatch) return opMatch[1];
+      const directRe = new RegExp(`^\\s*export\\s+${varName}=(.+)$`, 'm');
+      const directMatch = content.match(directRe);
+      if (directMatch) return directMatch[1].trim().replace(/^["']|["']$/g, '');
     } catch { /* skip */ }
   }
 
-  const cfgPath = path.join(homeDir, '.construct', 'config.env');
-  if (existsSync(cfgPath)) {
+  return null;
+}
+
+/**
+ * Describe where a credential is configured without resolving op:// refs.
+ */
+export function describeCredentialPresence(varName, { homeDir = os.homedir(), cwd = process.cwd() } = {}) {
+  const sources = [];
+  const direct = process.env[varName];
+  if (direct) {
+    const ref = extractOpRef(direct);
+    sources.push(ref ? `process.env (op:// ref)` : `process.env (plain value)`);
+  }
+
+  for (const envPath of [
+    path.join(cwd, '.env'),
+    path.join(homeDir, '.env'),
+    path.join(homeDir, '.construct', 'config.env'),
+  ]) {
+    if (!existsSync(envPath)) continue;
     try {
-      const content = readFileSync(cfgPath, 'utf8');
-      const m = content.match(new RegExp(`^${varName}=(.+)$`, 'm'));
-      if (m) return m[1].trim();
+      const content = readFileSync(envPath, 'utf8');
+      const m = content.match(new RegExp(`^${varName}=["']?(.+?)["']?$`, 'm'));
+      if (m) {
+        const ref = extractOpRef(m[1]);
+        const label = envPath.replace(homeDir, '~');
+        sources.push(ref ? `${label} (op:// ref)` : `${label} (plain value)`);
+      }
     } catch { /* skip */ }
   }
 
@@ -209,47 +246,18 @@ function getEnvFromShell(varName, homeDir) {
     if (!existsSync(rcPath)) continue;
     try {
       const content = readFileSync(rcPath, 'utf8');
-      const re = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
-      const m = content.match(re);
-      if (m) {
-        const opRef = m[1];
-        try {
-          const result = spawnSync('op', ['read', opRef], {
-            encoding: 'utf8',
-            stdio: ['pipe', 'pipe', 'pipe'],
-            timeout: 5000,
-          });
-          if (result.status === 0) return result.stdout.trim();
-        } catch { /* op read failed */ }
+      const opRe = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
+      if (opRe.test(content)) {
+        sources.push(`${rcPath.replace(homeDir, '~')} (op read in rc — use op:// in config.env instead)`);
       }
-    } catch { /* skip unreadable files */ }
-  }
-
-  // If we found an op:// reference but couldn't read it, log the error
-  // for diagnostic purposes when DEBUG is on.
-  if (process.env.CONSTRUCT_DEBUG_CREDENTIALS === '1') {
-    for (const rcPath of shellFiles) {
-      if (!existsSync(rcPath)) continue;
-      try {
-        const content = readFileSync(rcPath, 'utf8');
-        const re = new RegExp(`export\\s+${varName}=["']?\\$\\(op read '([^']+)'\\)["']?`, 'm');
-        const m = content.match(re);
-        if (m) {
-          try {
-            const result = spawnSync('op', ['read', m[1]], { encoding: 'utf8', timeout: 5000 });
-            if (result.status !== 0) {
-              const errMsg = (result.stderr || '').trim().slice(0, 200);
-              process.stderr.write(`[credentials] ${varName}: op read '${m[1]}' failed: ${errMsg}\n`);
-            }
-          } catch (e) {
-            process.stderr.write(`[credentials] ${varName}: op CLI error: ${e.message}\n`);
-          }
-        }
-      } catch { /* skip */ }
-    }
+      const directRe = new RegExp(`^\\s*export\\s+${varName}=`, 'm');
+      if (directRe.test(content) && !sources.some((s) => s.includes(rcPath.replace(homeDir, '~')))) {
+        sources.push(`${rcPath.replace(homeDir, '~')} (export found)`);
+      }
+    } catch { /* skip */ }
   }
 
-  return null;
+  return { configured: hasSecret(varName, { env: process.env, cwd }), sources };
 }
 
 /**
@@ -287,30 +295,34 @@ const CREDENTIAL_VARS = [
 ];
 
 /**
- * Resolve all known credentials from env, .env files, and 1Password.
+ * Link discovered credential references into ~/.construct/config.env without
+ * invoking `op read`. Plain values and op:// refs are persisted as found.
  * @param {Object} options
  * @param {string} options.homeDir
- * @param {boolean} options.writeConfig - Write resolved keys to config.env (default: true)
- * @returns {Promise<Record<string, string>>} resolved key-value pairs
+ * @param {boolean} options.writeConfig - Write keys to config.env (default: false)
+ * @returns {Promise<Record<string, string>>} raw values linked (never plaintext from op)
  */
 export async function resolveCredentials(options = {}) {
-  const { homeDir = os.homedir(), writeConfig = true } = options;
-  const resolved = {};
+  const { homeDir = os.homedir(), writeConfig = false } = options;
+  const linked = {};
+  const { parseEnvFile, getUserEnvPath, writeEnvValues } = await import('./env-config.mjs');
+  const existing = parseEnvFile(getUserEnvPath(homeDir));
 
   for (const varName of CREDENTIAL_VARS) {
-    const value = getEnvFromShell(varName, homeDir);
-    if (value) resolved[varName] = value;
+    if (existing[varName]) continue;
+    const raw = readCredentialRaw(varName, homeDir);
+    if (!raw) continue;
+    const ref = extractOpRef(raw);
+    linked[varName] = ref || raw;
   }
 
-  // Write resolved keys to config.env so subprocesses and the dashboard find them
-  if (writeConfig && Object.keys(resolved).length > 0) {
+  if (writeConfig && Object.keys(linked).length > 0) {
     try {
-      const { writeEnvValues, getUserEnvPath } = await import('./env-config.mjs');
-      writeEnvValues(getUserEnvPath(homeDir), resolved);
+      writeEnvValues(getUserEnvPath(homeDir), linked);
     } catch { /* best effort */ }
   }
 
-  return resolved;
+  return linked;
 }
 
 /**
@@ -327,22 +339,24 @@ export function detectCredentials(options = {}) {
   const ghAuth = spawnSync('gh', ['auth', 'status'], { encoding: 'utf8', stdio: ['pipe', 'pipe', 'pipe'] });
   found.github_cli = ghAuth.status === 0;
 
-  // GitHub Copilot (check VS Code extension state)
+  // GitHub Copilot: a device-flow credential (Construct's own store or the shared
+  // github-copilot store) is the usable signal; the VS Code extension and the
+  // copilot CLI are softer fallbacks.
+  const copilotAuthStore = existsSync(path.join(homeDir, '.construct', 'auth', 'github-copilot.json')) ||
+    existsSync(path.join(homeDir, '.config', 'github-copilot', 'apps.json')) ||
+    existsSync(path.join(homeDir, '.config', 'github-copilot', 'hosts.json'));
   const copilotDir = path.join(homeDir, '.vscode', 'extensions');
   const copilotExists = existsSync(copilotDir) && existsSync(path.join(homeDir, '.config', 'Code', 'User', 'globalStorage', 'github.copilot'));
-  found.copilot = copilotExists || commandExists('copilot');
+  found.copilot = copilotAuthStore || copilotExists || commandExists('copilot');
 
   // OpenRouter API key
-  found.openrouter_key = !!getEnvFromShell('OPENROUTER_API_KEY', homeDir);
+  found.openrouter_key = hasAnySecret(['OPENROUTER_API_KEY', 'OPEN_ROUTER_API_KEY'], { env: process.env, cwd: process.cwd() });
 
-  // Anthropic API key
-  found.anthropic_key = !!getEnvFromShell('ANTHROPIC_API_KEY', homeDir);
+  found.anthropic_key = hasAnySecret(['ANTHROPIC_API_KEY'], { env: process.env, cwd: process.cwd() });
 
-  // OpenAI API key
-  found.openai_key = !!getEnvFromShell('OPENAI_API_KEY', homeDir);
+  found.openai_key = hasAnySecret(['OPENAI_API_KEY'], { env: process.env, cwd: process.cwd() });
 
-  // GitHub token
-  found.github_token = !!getEnvFromShell('GITHUB_TOKEN', homeDir) || !!getEnvFromShell('GH_TOKEN', homeDir);
+  found.github_token = hasAnySecret(['GITHUB_TOKEN', 'GH_TOKEN'], { env: process.env, cwd: process.cwd() });
 
   // VS Code installed
   found.vscode = commandExists('code');

package/lib/hooks/artifact-release-gate.mjs

@@ -0,0 +1,43 @@
+#!/usr/bin/env node
+/**
+ * lib/hooks/artifact-release-gate.mjs — PostToolUse advisory structure/visual gate for typed docs.
+ *
+ * Runs after Write/Edit/MultiEdit on docs/** and .cx/research/** markdown artifacts.
+ * Surfaces manifest structure and visual violations on stderr during drafting; does not
+ * block the edit (full release gate runs via `construct artifact validate` and CI).
+ *
+ * Notice-only: suppressed when stderr is not a TTY, CI=true, or NODE_ENV=test.
+ *
+ * @lifecycle PostToolUse
+ * @matcher  Write|Edit|MultiEdit
+ * @p95ms 80
+ * @maxBlockingScope none (PostToolUse, non-blocking)
+ * @exits 0 = pass
+ */
+
+import { readFileSync } from 'node:fs';
+import { checkArtifactGateNotice, formatArtifactGateNotice } from '../artifact-gate-notice.mjs';
+
+function shouldEmitNotice() {
+  if (process.env.CI === 'true') return false;
+  if (process.env.NODE_ENV === 'test') return false;
+  if (!process.stderr.isTTY) return false;
+  return true;
+}
+
+let filePath = process.env.TOOL_INPUT_FILE_PATH;
+let cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+if (!filePath) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    filePath = input?.tool_input?.file_path || input?.tool_input?.path;
+    if (input?.cwd) cwd = input.cwd;
+  } catch { /* no stdin */ }
+}
+if (!filePath) process.exit(0);
+
+const result = checkArtifactGateNotice(filePath, { cwd });
+if (!result || !shouldEmitNotice()) process.exit(0);
+
+process.stderr.write(formatArtifactGateNotice(result));
+process.exit(0);

package/lib/hooks/brand-prose-lint.mjs

@@ -0,0 +1,38 @@
+#!/usr/bin/env node
+/**
+ * lib/hooks/brand-prose-lint.mjs — PostToolUse hook: block brand drift at write time.
+ *
+ * Enforces marketing voice, retired typography, and Construct/cli naming on governed
+ * markdown and template surfaces. Mirrors scripts/audit/03d-brand.mjs scope.
+ *
+ * @lifecycle PostToolUse
+ * @matcher  Write|Edit|MultiEdit
+ * @p95ms 40
+ * @maxBlockingScope PostToolUse
+ * @exits 0 = pass | 2 = block tool call
+ */
+
+import { readFileSync } from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { formatBrandViolations, lintFile } from '../brand-prose.mjs';
+
+let filePath = process.env.TOOL_INPUT_FILE_PATH;
+if (!filePath) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    filePath = input?.tool_input?.file_path || input?.tool_input?.path;
+  } catch {}
+}
+if (!filePath) process.exit(0);
+
+const rootDir = path.resolve(fileURLToPath(import.meta.url), '..', '..', '..');
+const result = lintFile(filePath, { rootDir });
+if (!result.violations.length) process.exit(0);
+
+const output = formatBrandViolations([result]);
+process.stderr.write(`${output}\n`);
+process.stderr.write(
+  '\nBrand policy blocked this edit (marketing voice, retired fonts, or Construct/cli naming). See docs/reference/branding.md and docs/STYLE.md.\n',
+);
+process.exit(2);

package/lib/hooks/graph-impact-advisory.mjs

@@ -0,0 +1,62 @@
+#!/usr/bin/env node
+/**
+ * lib/hooks/graph-impact-advisory.mjs — PostToolUse hook: test-impact advisory on code edits.
+ *
+ * On Write|Edit under lib/, bin/, tests/, or src/, runs forward change-impact
+ * over the dependency graph and surfaces affected tests on stderr. Non-blocking;
+ * complements `construct impact` CLI and the doctor graph-staleness watcher.
+ *
+ * @p95ms 50
+ * @maxBlockingScope none (PostToolUse, non-blocking)
+ *
+ * @lifecycle PostToolUse
+ * @matcher  Write|Edit|MultiEdit
+ * @exits 0 = pass
+ */
+
+import { readFileSync } from 'node:fs';
+
+import { computeImpact } from '../graph/impact.mjs';
+import { checkGraphStaleness } from '../graph/staleness.mjs';
+
+const CODE_RE = /^(lib|bin|src|tests)\/.*\.(?:m?js|jsx?|tsx?|cjs)$/;
+
+let filePath = process.env.TOOL_INPUT_FILE_PATH;
+let cwd = process.env.CLAUDE_PROJECT_DIR || process.cwd();
+if (!filePath) {
+  try {
+    const input = JSON.parse(readFileSync(0, 'utf8'));
+    filePath = input?.tool_input?.file_path || input?.tool_input?.path;
+    if (input?.cwd) cwd = input.cwd;
+  } catch { /* stdin optional */ }
+}
+if (!filePath) process.exit(0);
+
+const rel = filePath.startsWith(cwd)
+  ? filePath.slice(cwd.length).replace(/^\/+/, '')
+  : filePath;
+
+if (!CODE_RE.test(rel)) process.exit(0);
+
+const stale = checkGraphStaleness(cwd);
+if (stale.stale) {
+  process.stderr.write(
+    `[graph-impact] dependency graph stale (${stale.staleReason}). Run \`construct graph build\` before trusting impact output.\n`,
+  );
+}
+
+const impact = computeImpact({ rootDir: cwd, changedFiles: [rel] });
+if (!impact.graphPresent) {
+  process.stderr.write('[graph-impact] no .cx/graph/ present — run `construct graph build` to enable test-impact advisories.\n');
+  process.exit(0);
+}
+
+if (impact.affectedTests.length > 0) {
+  const preview = impact.affectedTests.slice(0, 5).map((t) => t.replace(/^test:/, '')).join(', ');
+  const more = impact.affectedTests.length > 5 ? ` (+${impact.affectedTests.length - 5} more)` : '';
+  process.stderr.write(`[graph-impact] ${rel} may affect: ${preview}${more}\n`);
+} else if (impact.coverageGaps.length > 0) {
+  process.stderr.write(`[graph-impact] ${rel} has no capability edge in the dependency graph (coverage gap).\n`);
+}
+
+process.exit(0);