@getripple/cli 1.0.9 → 1.0.10

package/dist/index.js

@@ -544,6 +544,19 @@ function parseCliArgs(argv) {
             options.base = token.slice("--base=".length);
             continue;
         }
+        if (token === "--sha") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --sha");
+            }
+            options.sha = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--sha=")) {
+            options.sha = token.slice("--sha=".length);
+            continue;
+        }
         if (token === "--budget") {
             const value = argv[i + 1];
             if (!value || value.startsWith("-")) {
@@ -627,18 +640,21 @@ function rippleDirectRunnerHookLines() {
 const GITHUB_ACTIONS_WORKFLOW_PATH = core_1.RIPPLE_CI_WORKFLOW_PATH;
 function githubActionsWorkflow() {
     return [
-        "name: Ripple",
+        "name: Ripple Enterprise Gate",
         "",
         "on:",
         "  pull_request:",
+        "  push:",
+        "    branches: [main, master]",
         "",
         "permissions:",
         "  contents: read",
         "  pull-requests: read",
+        "  checks: write",
         "",
         "jobs:",
         "  ripple:",
-        "    name: Ripple architecture gate",
+        "    name: Ripple authorization gate",
         "    runs-on: ubuntu-latest",
         "    steps:",
         "      - name: Checkout",
@@ -649,8 +665,11 @@ function githubActionsWorkflow() {
         "        uses: actions/setup-node@v4",
         "        with:",
         "          node-version: 20",
-        "      - name: Ripple CI",
-        `        run: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations`,
+        "      - name: Ripple CI gate",
+        `        run: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations --sha \${{ github.sha }}`,
+        "        env:",
+        "          RIPPLE_API_KEY: ${{ secrets.RIPPLE_API_KEY }}",
+        "          RIPPLE_CLOUD_URL: ${{ secrets.RIPPLE_CLOUD_URL }}",
         "",
     ].join("\n");
 }
@@ -3416,6 +3435,59 @@ async function gateCommand(options) {
     else {
         printGateSummary(gate);
     }
+    // ─── Ripple Cloud Sync ───────────────────────────────────────────────────
+    // Records the gate decision to ripple-cloud for the compliance audit trail.
+    // Runs on EVERY gate call — including the pre-commit hook blocking scenario.
+    // Never blocks. Never throws. The commit result is unaffected by cloud sync.
+    if (process.env.RIPPLE_API_KEY) {
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const commitSha = (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: audit.intent.id,
+            decision: cloudDecision,
+            commitSha,
+            branch,
+            actor,
+            source: "cli",
+            payload: {
+                // Identity
+                intentId: audit.intent.id,
+                commitSha,
+                branch,
+                actor,
+                source: "pre-commit-gate",
+                // Intent declared scope — what the developer said they would change
+                task: audit.intent.task,
+                targetFile: audit.intent.targetFile,
+                controlMode: audit.intent.controlMode,
+                boundaryRisk: audit.intent.boundaryRisk,
+                humanGate: audit.intent.humanGate,
+                // Gate verdict — what Ripple actually decided
+                decision: cloudDecision,
+                status: gate.status,
+                canContinue: gate.canContinue,
+                mustStop: gate.mustStop,
+                needsHuman: gate.needsHuman,
+                // Evidence — what actually changed
+                blockingReasons: audit.blockingReasons ?? [],
+                changedFiles: audit.changedFiles ?? [],
+                changedOutsideBoundaryFiles: audit.stagedCheck?.intentValidation?.boundaryVerdict?.changedOutsideBoundaryFiles ?? [],
+            },
+        });
+        if (!options.json && !options.agent) {
+            if (cloudResult.sent) {
+                const icon = cloudDecision === "continue" ? "✓" : "⛔";
+                console.log(`\n[Ripple Cloud] ${icon} Gate decision recorded: ${cloudDecision} (${commitSha.slice(0, 7)})`);
+            }
+            else if (cloudResult.error) {
+                console.warn(`\n[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+            }
+        }
+    }
+    // ────────────────────────────────────────────────────────────────────────
     applyStrictExit(options.strict && !gate.canContinue);
 }
 function approveCommand(options) {
@@ -3684,6 +3756,31 @@ async function ciCommand(options) {
             printGithubPolicyAuditAnnotations(summary, policySync);
         }
         writeGithubPolicyAuditStepSummary(summary, policySync);
+        // FOUNDER FIX: Add Cloud Sync to the Policy Audit Path
+        if (process.env.RIPPLE_API_KEY) {
+            const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+            const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+            const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+            const syntheticIntentId = `ci-policy-${commitSha.slice(0, 16)}`;
+            const cloudResult = await (0, core_1.syncAuditToCloud)({
+                protocol: 'ripple-audit', // FOUNDER FIX: Satisfy the strict Zod Cloud Schema
+                intentId: syntheticIntentId,
+                decision: 'continue',
+                commitSha,
+                branch,
+                actor,
+                source: 'ci',
+                payload: { mode: 'policy-audit', commitSha, branch, actor },
+            });
+            if (!options.json && !options.agent) {
+                if (cloudResult.sent) {
+                    console.log(`\n[Ripple Cloud] ✓ Policy audit synced (${commitSha.slice(0, 7)})`);
+                }
+                else if (cloudResult.error) {
+                    console.warn(`\n[Ripple Cloud] ⚠ Sync failed: ${cloudResult.error}`);
+                }
+            }
+        }
         return;
     }
     let intent;
@@ -3760,6 +3857,44 @@ async function ciCommand(options) {
         printGithubAuditAnnotations(audit);
     }
     writeGithubAuditStepSummary(audit);
+    // ─── Ripple Cloud Sync ──────────────────────────────────────────────────
+    // Sends the audit result to ripple-cloud so the GitHub App can verify it.
+    // Only runs when RIPPLE_API_KEY is set. Never blocks or throws.
+    if (process.env.RIPPLE_API_KEY) {
+        const gate = (0, core_1.buildRippleGateSummary)(audit);
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: intent.id,
+            decision: cloudDecision,
+            commitSha,
+            branch,
+            actor,
+            source: "ci",
+            payload: {
+                intentId: intent.id,
+                commitSha,
+                branch,
+                actor,
+                decision: cloudDecision,
+                gate,
+                violations: audit.violations?.length ?? 0,
+                riskLevel: audit.riskLevel ?? "unknown",
+            },
+        });
+        if (!options.json && !options.agent) {
+            if (cloudResult.sent) {
+                console.log(`[Ripple Cloud] ✓ Audit synced (${commitSha.slice(0, 7)})`);
+            }
+            else if (cloudResult.error) {
+                console.warn(`[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+            }
+        }
+    }
+    // ────────────────────────────────────────────────────────────────────────
     applyStrictExit(options.strict && strictAuditShouldFail(audit));
 }
 async function doctorCommand(options) {
@@ -4030,11 +4165,11 @@ fi
 
 set +e
 
-ripple_run() {
-${rippleDirectRunnerHookLines().join("\n")}
-}
-
-if [ -f ".ripple/intents/latest.json" ]; then
+ripple_run() {
+${rippleDirectRunnerHookLines().join("\n")}
+}
+
+if [ -f ".ripple/intents/latest.json" ]; then
   echo "[Ripple] Active local intent found. Checking staged changes against approved boundary..."
   ripple_run gate --staged --intent latest --agent --strict
   status=$?
@@ -4086,9 +4221,64 @@ function ripplePreCommitHookScript() {
 function ripplePostCommitHookBlock() {
     return [
         RIPPLE_POST_COMMIT_HOOK_START,
-        `# Local intents are consumed after a successful commit to avoid ghost-intent blocks.
+        `# Local intents are consumed after a successful commit.
+# If RIPPLE_API_KEY is set, the commit is synced to ripple-cloud for GitHub App verification.
 set +e
 
+COMMIT_SHA=$(git rev-parse HEAD 2>/dev/null || echo "unknown")
+BRANCH=$(git branch --show-current 2>/dev/null || echo "unknown")
+ACTOR=$(git config user.name 2>/dev/null || git config user.email 2>/dev/null || echo "unknown")
+CLOUD_URL=\${RIPPLE_CLOUD_URL:-https://your-ripple-cloud.vercel.app}
+
+INTENT_FILE=""
+for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
+  if [ -f "$intent_file" ]; then
+    INTENT_FILE="$intent_file"
+    break
+  fi
+done
+
+# Cloud sync — only if API key is set and we have an intent to sync
+if [ -n "$RIPPLE_API_KEY" ] && [ -n "$INTENT_FILE" ]; then
+  INTENT_ID=$(node -e "try{const d=require('fs').readFileSync(process.argv[1],'utf8');console.log(JSON.parse(d).id||'')}catch(e){console.log('')}" "$INTENT_FILE" 2>/dev/null || echo "")
+  if [ -n "$INTENT_ID" ]; then
+    node -e "
+const https = require('https');
+const http = require('http');
+const url = new URL(process.env.CLOUD_URL + '/api/audit');
+const isHttps = url.protocol === 'https:';
+const body = JSON.stringify({
+  intentId: process.env.INTENT_ID,
+  decision: 'continue',
+  commitSha: process.env.COMMIT_SHA,
+  branch: process.env.BRANCH,
+  actor: process.env.ACTOR,
+  source: 'cli',
+  payload: { commitSha: process.env.COMMIT_SHA, source: 'post-commit-hook', branch: process.env.BRANCH }
+});
+const lib = isHttps ? https : http;
+const req = lib.request({
+  hostname: url.hostname,
+  port: url.port || (isHttps ? 443 : 80),
+  path: url.pathname,
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Authorization': 'Bearer ' + process.env.RIPPLE_API_KEY,
+    'Content-Length': Buffer.byteLength(body)
+  }
+}, res => {
+  if (res.statusCode < 300) process.stdout.write('[Ripple Cloud] Commit synced (' + process.env.COMMIT_SHA.slice(0,7) + ')\\n');
+});
+req.setTimeout(3000, () => req.destroy());
+req.on('error', () => {});
+req.write(body);
+req.end();
+" 2>/dev/null || true
+  fi
+fi
+
+# Clear the local intent after sync
 cleared=0
 for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
   if [ -f "$intent_file" ]; then