@getripple/cli 1.0.10 → 1.0.11

package/dist/index.js

@@ -3059,12 +3059,30 @@ function intentCommand(action, options) {
         intentStatusCommand(options);
         return;
     }
+    if (action === "push") {
+        void intentPushCommand(options);
+        return;
+    }
     if (action === "close") {
         closeIntentCommand(options);
         return;
     }
     throw new Error("Usage: ripple intent status [--intent latest|path] or ripple intent close --reason <text> [--intent latest|path]");
 }
+async function intentPushCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const intentRef = options.intent ?? "latest";
+    const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+    console.log(`[Ripple] Pushing active intent '${intent.id}' to Ripple Cloud...`);
+    const result = await (0, core_1.pushIntentToCloud)(intent);
+    if (result.sent) {
+        console.log("✅ Intent pushed successfully. This is now the active boundary for CI checks.");
+    }
+    else {
+        console.error(`❌ Failed to push intent: ${result.error}`);
+        process.exitCode = 1;
+    }
+}
 function intentStatusCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const intentRef = options.intent ?? "latest";
@@ -3393,6 +3411,8 @@ async function auditCommand(options) {
     }
     applyStrictExit(options.strict && strictAuditShouldFail(audit));
 }
+// in: ripple-main/packages/cli/src/index.ts
+// REPLACE THE ENTIRE OLD `gateCommand` FUNCTION WITH THIS:
 async function gateCommand(options) {
     if (selectedChangeModeCount(options) > 1) {
         throw new Error("Choose one gate/audit mode: --staged, --worktree, or --changed --base <ref>");
@@ -3401,8 +3421,9 @@ async function gateCommand(options) {
     const intentRef = options.intent ?? "latest";
     const mode = selectedChangeMode(options);
     const baseRef = options.base ?? "HEAD";
+    const intentPath = resolveCliIntentPath(workspaceRoot, intentRef);
     try {
-        (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+        (0, core_1.loadChangeIntent)(workspaceRoot, intentPath);
     }
     catch (err) {
         const block = (0, core_1.buildRippleGateIntentBlockSummary)({
@@ -3424,7 +3445,7 @@ async function gateCommand(options) {
         applyStrictExit(true);
         return;
     }
-    const audit = await buildAuditFromCliOptions(options);
+    const audit = await buildAuditFromCliOptions({ ...options, intent: intentPath });
     const gate = (0, core_1.buildRippleGateSummary)(audit);
     if (options.json) {
         printJson(gate);
@@ -3435,16 +3456,43 @@ async function gateCommand(options) {
     else {
         printGateSummary(gate);
     }
-    // ─── Ripple Cloud Sync ───────────────────────────────────────────────────
-    // Records the gate decision to ripple-cloud for the compliance audit trail.
-    // Runs on EVERY gate call — including the pre-commit hook blocking scenario.
-    // Never blocks. Never throws. The commit result is unaffected by cloud sync.
+    // Consume intent on pass to prevent "ghost intents" if commit is aborted.
+    if (gate.canContinue && intentRef === "latest" && mode === "staged") {
+        try {
+            const consumedIntentCachePath = path.join(workspaceRoot, ".ripple", ".cache", "consumed-intent.json");
+            if (fs.existsSync(consumedIntentCachePath)) {
+                fs.unlinkSync(consumedIntentCachePath);
+            }
+            fs.renameSync(intentPath, consumedIntentCachePath);
+            console.log("\n[Ripple] Intent validated and consumed by gate. Ready for commit.");
+        }
+        catch (err) {
+            const errorDetail = err instanceof Error ? err.message : String(err);
+            console.warn(`[Ripple] CRITICAL WARNING: Could not consume intent file. To prevent a future 'ghost intent' block, manually delete '${intentPath}' after your commit. Error: ${errorDetail}`);
+        }
+    }
+    // Sync a redacted, privacy-safe audit receipt to the cloud.
     if (process.env.RIPPLE_API_KEY) {
         const cloudDecision = gate.canContinue ? "continue" :
             gate.needsHuman ? "human-review" : "blocked";
-        const commitSha = (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
         const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
         const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const redactedPayload = {
+            decision: gate.decision,
+            status: gate.status,
+            risk: {
+                level: gate.risk.level,
+                score: gate.risk.score,
+                summary: gate.risk.summary,
+            },
+            auditStatus: audit.status,
+            approvalStatus: audit.approvalStatus.status,
+            intent: audit.intent,
+            mode: audit.mode,
+            baseRef: audit.baseRef,
+            blockingReasons: audit.blockingReasons,
+        };
         const cloudResult = await (0, core_1.syncAuditToCloud)({
             intentId: audit.intent.id,
             decision: cloudDecision,
@@ -3452,42 +3500,16 @@ async function gateCommand(options) {
             branch,
             actor,
             source: "cli",
-            payload: {
-                // Identity
-                intentId: audit.intent.id,
-                commitSha,
-                branch,
-                actor,
-                source: "pre-commit-gate",
-                // Intent declared scope — what the developer said they would change
-                task: audit.intent.task,
-                targetFile: audit.intent.targetFile,
-                controlMode: audit.intent.controlMode,
-                boundaryRisk: audit.intent.boundaryRisk,
-                humanGate: audit.intent.humanGate,
-                // Gate verdict — what Ripple actually decided
-                decision: cloudDecision,
-                status: gate.status,
-                canContinue: gate.canContinue,
-                mustStop: gate.mustStop,
-                needsHuman: gate.needsHuman,
-                // Evidence — what actually changed
-                blockingReasons: audit.blockingReasons ?? [],
-                changedFiles: audit.changedFiles ?? [],
-                changedOutsideBoundaryFiles: audit.stagedCheck?.intentValidation?.boundaryVerdict?.changedOutsideBoundaryFiles ?? [],
-            },
+            payload: redactedPayload,
         });
-        if (!options.json && !options.agent) {
-            if (cloudResult.sent) {
-                const icon = cloudDecision === "continue" ? "✓" : "⛔";
-                console.log(`\n[Ripple Cloud] ${icon} Gate decision recorded: ${cloudDecision} (${commitSha.slice(0, 7)})`);
-            }
-            else if (cloudResult.error) {
-                console.warn(`\n[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
-            }
+        if (cloudResult.sent) {
+            const icon = cloudDecision === "continue" ? "✓" : "⛔";
+            console.log(`\n[Ripple Cloud] ${icon} Gate decision recorded: ${cloudDecision} (${commitSha.slice(0, 7)})`);
+        }
+        else if (cloudResult.error) {
+            console.warn(`\n[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
         }
     }
-    // ────────────────────────────────────────────────────────────────────────
     applyStrictExit(options.strict && !gate.canContinue);
 }
 function approveCommand(options) {
@@ -3692,14 +3714,21 @@ function approvalCommand(options) {
     }
     printApprovalStatus(status);
 }
+// REPLACE WITH THIS NEW FUNCTION
+// in: ripple-main/packages/cli/src/index.ts
+// REPLACE THE ENTIRE OLD `ciCommand` FUNCTION WITH THIS:
 async function ciCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const baseRef = options.base ?? defaultCiBaseRef();
-    const hasExplicitIntent = Boolean(options.intent);
-    const intentRef = options.intent ?? "latest";
     const files = (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef);
     const emitGithubAnnotations = shouldEmitGithubAnnotations(options);
-    if (!hasExplicitIntent) {
+    const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+    // FETCH THE AUTHORITATIVE INTENT FROM THE CLOUD.
+    const intent = await (0, core_1.fetchActiveIntentForCommit)(commitSha);
+    if (!intent) {
+        // If no active intent is found in the cloud, run a policy-only audit.
+        // This provides a baseline check without enforcing a specific boundary.
+        console.log("[Ripple CI] No active cloud intent found. Running in policy-only audit mode.");
         const summary = await buildCheckSummaryForFiles({
             workspaceRoot,
             files,
@@ -3708,130 +3737,20 @@ async function ciCommand(options) {
             tokenBudget: options.budget,
         });
         const policySync = buildPolicySyncSummary(workspaceRoot);
-        if (options.json) {
-            printJson({
-                ...summary,
-                protocol: "ripple-ci-policy-audit",
-                version: 1,
-                auditMode: true,
-                blocking: false,
-                intentRequired: false,
-                policySync,
-            });
-        }
-        else if (options.agent) {
-            printAgentStagedCheckSummary(summary);
-            console.log("");
-            console.log("ci_mode: policy-audit");
-            console.log("blocking: false");
-            console.log("intent_required: false");
-            console.log(`policy_sync: ${policySync.status}`);
-            if (policySync.missingRules.length > 0) {
-                console.log("policy_sync_missing_rules:");
-                policySync.missingRules.slice(0, 12).forEach((rule) => {
-                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
-                });
-            }
-            console.log("next_required_action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
-        }
-        else {
-            console.log("Ripple CI policy audit");
-            console.log("Status: audit");
-            console.log("Blocking: false");
-            console.log("Intent: none (local intents are not required in CI audit mode)");
-            console.log(`Policy sync: ${policySync.status}`);
-            if (policySync.missingRules.length > 0) {
-                console.log("");
-                console.log("Policy may be missing risky repo surfaces:");
-                policySync.missingRules.slice(0, 12).forEach((rule) => {
-                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
-                });
-            }
-            console.log("");
-            printStagedCheckSummary(summary);
-            console.log("");
-            console.log("Next action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
-        }
-        if (emitGithubAnnotations && !options.json) {
+        if (emitGithubAnnotations) {
             printGithubPolicyAuditAnnotations(summary, policySync);
-        }
-        writeGithubPolicyAuditStepSummary(summary, policySync);
-        // FOUNDER FIX: Add Cloud Sync to the Policy Audit Path
-        if (process.env.RIPPLE_API_KEY) {
-            const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
-            const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
-            const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
-            const syntheticIntentId = `ci-policy-${commitSha.slice(0, 16)}`;
-            const cloudResult = await (0, core_1.syncAuditToCloud)({
-                protocol: 'ripple-audit', // FOUNDER FIX: Satisfy the strict Zod Cloud Schema
-                intentId: syntheticIntentId,
-                decision: 'continue',
-                commitSha,
-                branch,
-                actor,
-                source: 'ci',
-                payload: { mode: 'policy-audit', commitSha, branch, actor },
-            });
-            if (!options.json && !options.agent) {
-                if (cloudResult.sent) {
-                    console.log(`\n[Ripple Cloud] ✓ Policy audit synced (${commitSha.slice(0, 7)})`);
-                }
-                else if (cloudResult.error) {
-                    console.warn(`\n[Ripple Cloud] ⚠ Sync failed: ${cloudResult.error}`);
-                }
-            }
-        }
-        return;
-    }
-    let intent;
-    try {
-        intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
-    }
-    catch (err) {
-        const summary = await buildCheckSummaryForFiles({
-            workspaceRoot,
-            files,
-            mode: "changed",
-            baseRef,
-            tokenBudget: options.budget,
-        });
-        const message = intentLoadFailureMessage(intentRef, err);
-        if (options.json) {
-            printJson({
-                ...summary,
-                nextRequiredPhase: MISSING_INTENT_NEXT_REQUIRED_PHASE,
-                nextRequiredAction: MISSING_INTENT_NEXT_REQUIRED_ACTION,
-                intentLoadError: {
-                    intent: intentRef,
-                    message,
-                    nextRequiredPhase: MISSING_INTENT_NEXT_REQUIRED_PHASE,
-                    nextRequiredAction: MISSING_INTENT_NEXT_REQUIRED_ACTION,
-                },
+            printGithubNoticeAnnotation({
+                title: "Ripple: Policy Audit Mode",
+                message: "No active intent was found in Ripple Cloud for this commit. To enable strict boundary checks, run `ripple intent push` locally after creating a plan.",
             });
         }
-        else if (options.agent) {
-            printAgentStagedCheckSummary(summary);
-            console.log("");
-            console.log(`next_required_phase: ${MISSING_INTENT_NEXT_REQUIRED_PHASE}`);
-            console.log(`next_required_action: ${MISSING_INTENT_NEXT_REQUIRED_ACTION}`);
-            console.log("");
-            console.log("intent_error:");
-            console.log(`- ${message}`);
-        }
-        else {
-            printStagedCheckSummary(summary);
-            console.log("");
-            console.log(`Next required phase: ${MISSING_INTENT_NEXT_REQUIRED_PHASE}`);
-            console.log(`Next required action: ${MISSING_INTENT_NEXT_REQUIRED_ACTION}`);
-            console.log(`Intent error: ${message}`);
-        }
-        if (emitGithubAnnotations && !options.json) {
-            printGithubIntentLoadError(message);
-        }
-        writeGithubStepSummary({ summary, intentLoadError: message });
-        applyStrictExit(options.strict);
+        writeGithubPolicyAuditStepSummary(summary, policySync);
+        // Policy-only audits do not block the build unless strict mode is on.
+        applyStrictExit(options.strict && summary.requiresAttention);
         return;
     }
+    // An active intent was found. Run the full, strict audit against the cloud boundary.
+    console.log(`[Ripple CI] Active intent '${intent.id}' found in cloud. Running full boundary check.`);
     const audit = await buildAuditForFiles({
         workspaceRoot,
         files,
@@ -3839,13 +3758,10 @@ async function ciCommand(options) {
         baseRef,
         tokenBudget: options.budget,
         intent,
-        currentPolicyExplanation: currentPolicyExplanationForIntent(workspaceRoot, intent),
+        currentPolicyExplanation: (0, core_1.explainRipplePolicyForIntent)((0, core_1.loadRipplePolicy)(workspaceRoot), intent),
     });
     if (options.json) {
-        printJson({
-            ...audit,
-            gate: (0, core_1.buildRippleGateSummary)(audit),
-        });
+        printJson({ ...audit, gate: (0, core_1.buildRippleGateSummary)(audit) });
     }
     else if (options.agent) {
         printAgentAuditSummary(audit);
@@ -3857,45 +3773,46 @@ async function ciCommand(options) {
         printGithubAuditAnnotations(audit);
     }
     writeGithubAuditStepSummary(audit);
-    // ─── Ripple Cloud Sync ──────────────────────────────────────────────────
-    // Sends the audit result to ripple-cloud so the GitHub App can verify it.
-    // Only runs when RIPPLE_API_KEY is set. Never blocks or throws.
+    // Sync the final audit result back to the cloud for the webhook to read.
     if (process.env.RIPPLE_API_KEY) {
         const gate = (0, core_1.buildRippleGateSummary)(audit);
         const cloudDecision = gate.canContinue ? "continue" :
             gate.needsHuman ? "human-review" : "blocked";
-        const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
         const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
         const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const redactedPayload = {
+            decision: gate.decision,
+            status: gate.status,
+            risk: {
+                level: gate.risk.level,
+                score: gate.risk.score,
+                summary: gate.risk.summary,
+            },
+            auditStatus: audit.status,
+            approvalStatus: audit.approvalStatus.status,
+            intent: audit.intent,
+            mode: audit.mode,
+            baseRef: audit.baseRef,
+            blockingReasons: audit.blockingReasons,
+        };
         const cloudResult = await (0, core_1.syncAuditToCloud)({
             intentId: intent.id,
             decision: cloudDecision,
-            commitSha,
-            branch,
-            actor,
-            source: "ci",
-            payload: {
-                intentId: intent.id,
-                commitSha,
-                branch,
-                actor,
-                decision: cloudDecision,
-                gate,
-                violations: audit.violations?.length ?? 0,
-                riskLevel: audit.riskLevel ?? "unknown",
-            },
+            commitSha: commitSha,
+            branch: branch,
+            actor: actor,
+            source: 'ci',
+            payload: redactedPayload,
         });
-        if (!options.json && !options.agent) {
-            if (cloudResult.sent) {
-                console.log(`[Ripple Cloud] ✓ Audit synced (${commitSha.slice(0, 7)})`);
-            }
-            else if (cloudResult.error) {
-                console.warn(`[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
-            }
+        if (cloudResult.sent) {
+            console.log(`[Ripple Cloud] ✓ Audit synced (${commitSha.slice(0, 7)})`);
+        }
+        else if (cloudResult.error) {
+            console.warn(`[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
         }
     }
-    // ────────────────────────────────────────────────────────────────────────
-    applyStrictExit(options.strict && strictAuditShouldFail(audit));
+    // Exit with a non-zero code if the audit did not pass, failing the CI job.
+    applyStrictExit(!audit.canProceed);
 }
 async function doctorCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
@@ -4218,77 +4135,20 @@ function ripplePreCommitHookScript() {
         "",
     ].join("\n");
 }
+// ripple-main/packages/cli/src/index.ts
+// ... (keep all existing functions)
 function ripplePostCommitHookBlock() {
     return [
         RIPPLE_POST_COMMIT_HOOK_START,
-        `# Local intents are consumed after a successful commit.
-# If RIPPLE_API_KEY is set, the commit is synced to ripple-cloud for GitHub App verification.
+        `# After a successful commit, this hook cleans up the consumed intent marker
+# left by the 'ripple gate' command. This prevents old intents from being
+# reused accidentally if a commit is amended or rebased.
 set +e
 
-COMMIT_SHA=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
-BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
-ACTOR=$(git config user.name 2>/dev/null || git config user.email 2>/dev/null || echo "unknown")
-CLOUD_URL=\${RIPPLE_CLOUD_URL:-https://your-ripple-cloud.vercel.app}
-
-INTENT_FILE=""
-for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
-  if [ -f "$intent_file" ]; then
-    INTENT_FILE="$intent_file"
-    break
-  fi
-done
-
-# Cloud sync — only if API key is set and we have an intent to sync
-if [ -n "$RIPPLE_API_KEY" ] && [ -n "$INTENT_FILE" ]; then
-  INTENT_ID=$(node -e "try{const d=require('fs').readFileSync(process.argv[1],'utf8');console.log(JSON.parse(d).id||'')}catch(e){console.log('')}" "$INTENT_FILE" 2>/dev/null || echo "")
-  if [ -n "$INTENT_ID" ]; then
-    node -e "
-const https = require('https');
-const http = require('http');
-const url = new URL(process.env.CLOUD_URL + '/api/audit');
-const isHttps = url.protocol === 'https:';
-const body = JSON.stringify({
-  intentId: process.env.INTENT_ID,
-  decision: 'continue',
-  commitSha: process.env.COMMIT_SHA,
-  branch: process.env.BRANCH,
-  actor: process.env.ACTOR,
-  source: 'cli',
-  payload: { commitSha: process.env.COMMIT_SHA, source: 'post-commit-hook', branch: process.env.BRANCH }
-});
-const lib = isHttps ? https : http;
-const req = lib.request({
-  hostname: url.hostname,
-  port: url.port || (isHttps ? 443 : 80),
-  path: url.pathname,
-  method: 'POST',
-  headers: {
-    'Content-Type': 'application/json',
-    'Authorization': 'Bearer ' + process.env.RIPPLE_API_KEY,
-    'Content-Length': Buffer.byteLength(body)
-  }
-}, res => {
-  if (res.statusCode < 300) process.stdout.write('[Ripple Cloud] Commit synced (' + process.env.COMMIT_SHA.slice(0,7) + ')\\n');
-});
-req.setTimeout(3000, () => req.destroy());
-req.on('error', () => {});
-req.write(body);
-req.end();
-" 2>/dev/null || true
-  fi
-fi
-
-# Clear the local intent after sync
-cleared=0
-for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
-  if [ -f "$intent_file" ]; then
-    rm "$intent_file"
-    cleared=1
-  fi
-done
-
-if [ "$cleared" -eq 1 ]; then
-  echo "[Ripple] Consumed and cleared local intent."
+CONSUMED_INTENT_FILE=".ripple/.cache/consumed-intent.json"
+if [ -f "$CONSUMED_INTENT_FILE" ]; then
+  rm "$CONSUMED_INTENT_FILE"
+  echo "[Ripple] Cleaned up consumed intent marker."
 fi`,
         RIPPLE_POST_COMMIT_HOOK_END,
         "",