@getripple/cli 1.0.9 → 1.0.11

package/dist/index.js

@@ -544,6 +544,19 @@ function parseCliArgs(argv) {
             options.base = token.slice("--base=".length);
             continue;
         }
+        if (token === "--sha") {
+            const value = argv[i + 1];
+            if (!value || value.startsWith("-")) {
+                throw new Error("Missing value for --sha");
+            }
+            options.sha = value;
+            i++;
+            continue;
+        }
+        if (token.startsWith("--sha=")) {
+            options.sha = token.slice("--sha=".length);
+            continue;
+        }
         if (token === "--budget") {
             const value = argv[i + 1];
             if (!value || value.startsWith("-")) {
@@ -627,18 +640,21 @@ function rippleDirectRunnerHookLines() {
 const GITHUB_ACTIONS_WORKFLOW_PATH = core_1.RIPPLE_CI_WORKFLOW_PATH;
 function githubActionsWorkflow() {
     return [
-        "name: Ripple",
+        "name: Ripple Enterprise Gate",
         "",
         "on:",
         "  pull_request:",
+        "  push:",
+        "    branches: [main, master]",
         "",
         "permissions:",
         "  contents: read",
         "  pull-requests: read",
+        "  checks: write",
         "",
         "jobs:",
         "  ripple:",
-        "    name: Ripple architecture gate",
+        "    name: Ripple authorization gate",
         "    runs-on: ubuntu-latest",
         "    steps:",
         "      - name: Checkout",
@@ -649,8 +665,11 @@ function githubActionsWorkflow() {
         "        uses: actions/setup-node@v4",
         "        with:",
         "          node-version: 20",
-        "      - name: Ripple CI",
-        `        run: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations`,
+        "      - name: Ripple CI gate",
+        `        run: npx -y ${rippleCliPackageSpec()} ci --base origin/\${{ github.base_ref }} --github-annotations --sha \${{ github.sha }}`,
+        "        env:",
+        "          RIPPLE_API_KEY: ${{ secrets.RIPPLE_API_KEY }}",
+        "          RIPPLE_CLOUD_URL: ${{ secrets.RIPPLE_CLOUD_URL }}",
         "",
     ].join("\n");
 }
@@ -3040,12 +3059,30 @@ function intentCommand(action, options) {
         intentStatusCommand(options);
         return;
     }
+    if (action === "push") {
+        void intentPushCommand(options);
+        return;
+    }
     if (action === "close") {
         closeIntentCommand(options);
         return;
     }
     throw new Error("Usage: ripple intent status [--intent latest|path] or ripple intent close --reason <text> [--intent latest|path]");
 }
+async function intentPushCommand(options) {
+    const workspaceRoot = resolveWorkspaceRoot(".");
+    const intentRef = options.intent ?? "latest";
+    const intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+    console.log(`[Ripple] Pushing active intent '${intent.id}' to Ripple Cloud...`);
+    const result = await (0, core_1.pushIntentToCloud)(intent);
+    if (result.sent) {
+        console.log("✅ Intent pushed successfully. This is now the active boundary for CI checks.");
+    }
+    else {
+        console.error(`❌ Failed to push intent: ${result.error}`);
+        process.exitCode = 1;
+    }
+}
 function intentStatusCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const intentRef = options.intent ?? "latest";
@@ -3374,6 +3411,8 @@ async function auditCommand(options) {
     }
     applyStrictExit(options.strict && strictAuditShouldFail(audit));
 }
+// in: ripple-main/packages/cli/src/index.ts
+// REPLACE THE ENTIRE OLD `gateCommand` FUNCTION WITH THIS:
 async function gateCommand(options) {
     if (selectedChangeModeCount(options) > 1) {
         throw new Error("Choose one gate/audit mode: --staged, --worktree, or --changed --base <ref>");
@@ -3382,8 +3421,9 @@ async function gateCommand(options) {
     const intentRef = options.intent ?? "latest";
     const mode = selectedChangeMode(options);
     const baseRef = options.base ?? "HEAD";
+    const intentPath = resolveCliIntentPath(workspaceRoot, intentRef);
     try {
-        (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
+        (0, core_1.loadChangeIntent)(workspaceRoot, intentPath);
     }
     catch (err) {
         const block = (0, core_1.buildRippleGateIntentBlockSummary)({
@@ -3405,7 +3445,7 @@ async function gateCommand(options) {
         applyStrictExit(true);
         return;
     }
-    const audit = await buildAuditFromCliOptions(options);
+    const audit = await buildAuditFromCliOptions({ ...options, intent: intentPath });
     const gate = (0, core_1.buildRippleGateSummary)(audit);
     if (options.json) {
         printJson(gate);
@@ -3416,6 +3456,60 @@ async function gateCommand(options) {
     else {
         printGateSummary(gate);
     }
+    // Consume intent on pass to prevent "ghost intents" if commit is aborted.
+    if (gate.canContinue && intentRef === "latest" && mode === "staged") {
+        try {
+            const consumedIntentCachePath = path.join(workspaceRoot, ".ripple", ".cache", "consumed-intent.json");
+            if (fs.existsSync(consumedIntentCachePath)) {
+                fs.unlinkSync(consumedIntentCachePath);
+            }
+            fs.renameSync(intentPath, consumedIntentCachePath);
+            console.log("\n[Ripple] Intent validated and consumed by gate. Ready for commit.");
+        }
+        catch (err) {
+            const errorDetail = err instanceof Error ? err.message : String(err);
+            console.warn(`[Ripple] CRITICAL WARNING: Could not consume intent file. To prevent a future 'ghost intent' block, manually delete '${intentPath}' after your commit. Error: ${errorDetail}`);
+        }
+    }
+    // Sync a redacted, privacy-safe audit receipt to the cloud.
+    if (process.env.RIPPLE_API_KEY) {
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const redactedPayload = {
+            decision: gate.decision,
+            status: gate.status,
+            risk: {
+                level: gate.risk.level,
+                score: gate.risk.score,
+                summary: gate.risk.summary,
+            },
+            auditStatus: audit.status,
+            approvalStatus: audit.approvalStatus.status,
+            intent: audit.intent,
+            mode: audit.mode,
+            baseRef: audit.baseRef,
+            blockingReasons: audit.blockingReasons,
+        };
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: audit.intent.id,
+            decision: cloudDecision,
+            commitSha,
+            branch,
+            actor,
+            source: "cli",
+            payload: redactedPayload,
+        });
+        if (cloudResult.sent) {
+            const icon = cloudDecision === "continue" ? "✓" : "⛔";
+            console.log(`\n[Ripple Cloud] ${icon} Gate decision recorded: ${cloudDecision} (${commitSha.slice(0, 7)})`);
+        }
+        else if (cloudResult.error) {
+            console.warn(`\n[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+        }
+    }
     applyStrictExit(options.strict && !gate.canContinue);
 }
 function approveCommand(options) {
@@ -3620,14 +3714,21 @@ function approvalCommand(options) {
     }
     printApprovalStatus(status);
 }
+// REPLACE WITH THIS NEW FUNCTION
+// in: ripple-main/packages/cli/src/index.ts
+// REPLACE THE ENTIRE OLD `ciCommand` FUNCTION WITH THIS:
 async function ciCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
     const baseRef = options.base ?? defaultCiBaseRef();
-    const hasExplicitIntent = Boolean(options.intent);
-    const intentRef = options.intent ?? "latest";
     const files = (0, core_1.listGitChangedFiles)(workspaceRoot, baseRef);
     const emitGithubAnnotations = shouldEmitGithubAnnotations(options);
-    if (!hasExplicitIntent) {
+    const commitSha = options.sha ?? (0, core_1.getCurrentCommitSha)(child_process_1.execSync);
+    // FETCH THE AUTHORITATIVE INTENT FROM THE CLOUD.
+    const intent = await (0, core_1.fetchActiveIntentForCommit)(commitSha);
+    if (!intent) {
+        // If no active intent is found in the cloud, run a policy-only audit.
+        // This provides a baseline check without enforcing a specific boundary.
+        console.log("[Ripple CI] No active cloud intent found. Running in policy-only audit mode.");
         const summary = await buildCheckSummaryForFiles({
             workspaceRoot,
             files,
@@ -3636,105 +3737,20 @@ async function ciCommand(options) {
             tokenBudget: options.budget,
         });
         const policySync = buildPolicySyncSummary(workspaceRoot);
-        if (options.json) {
-            printJson({
-                ...summary,
-                protocol: "ripple-ci-policy-audit",
-                version: 1,
-                auditMode: true,
-                blocking: false,
-                intentRequired: false,
-                policySync,
-            });
-        }
-        else if (options.agent) {
-            printAgentStagedCheckSummary(summary);
-            console.log("");
-            console.log("ci_mode: policy-audit");
-            console.log("blocking: false");
-            console.log("intent_required: false");
-            console.log(`policy_sync: ${policySync.status}`);
-            if (policySync.missingRules.length > 0) {
-                console.log("policy_sync_missing_rules:");
-                policySync.missingRules.slice(0, 12).forEach((rule) => {
-                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
-                });
-            }
-            console.log("next_required_action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
-        }
-        else {
-            console.log("Ripple CI policy audit");
-            console.log("Status: audit");
-            console.log("Blocking: false");
-            console.log("Intent: none (local intents are not required in CI audit mode)");
-            console.log(`Policy sync: ${policySync.status}`);
-            if (policySync.missingRules.length > 0) {
-                console.log("");
-                console.log("Policy may be missing risky repo surfaces:");
-                policySync.missingRules.slice(0, 12).forEach((rule) => {
-                    console.log(`- ${rule.paths.join(", ")} risk=${rule.risk ?? "medium"}`);
-                });
-            }
-            console.log("");
-            printStagedCheckSummary(summary);
-            console.log("");
-            console.log("Next action: Review policy-risk findings and policy-sync warnings before merge. Use --intent latest --strict only when you want an intent-bound hard gate.");
-        }
-        if (emitGithubAnnotations && !options.json) {
+        if (emitGithubAnnotations) {
             printGithubPolicyAuditAnnotations(summary, policySync);
-        }
-        writeGithubPolicyAuditStepSummary(summary, policySync);
-        return;
-    }
-    let intent;
-    try {
-        intent = (0, core_1.loadChangeIntent)(workspaceRoot, intentRef);
-    }
-    catch (err) {
-        const summary = await buildCheckSummaryForFiles({
-            workspaceRoot,
-            files,
-            mode: "changed",
-            baseRef,
-            tokenBudget: options.budget,
-        });
-        const message = intentLoadFailureMessage(intentRef, err);
-        if (options.json) {
-            printJson({
-                ...summary,
-                nextRequiredPhase: MISSING_INTENT_NEXT_REQUIRED_PHASE,
-                nextRequiredAction: MISSING_INTENT_NEXT_REQUIRED_ACTION,
-                intentLoadError: {
-                    intent: intentRef,
-                    message,
-                    nextRequiredPhase: MISSING_INTENT_NEXT_REQUIRED_PHASE,
-                    nextRequiredAction: MISSING_INTENT_NEXT_REQUIRED_ACTION,
-                },
+            printGithubNoticeAnnotation({
+                title: "Ripple: Policy Audit Mode",
+                message: "No active intent was found in Ripple Cloud for this commit. To enable strict boundary checks, run `ripple intent push` locally after creating a plan.",
             });
         }
-        else if (options.agent) {
-            printAgentStagedCheckSummary(summary);
-            console.log("");
-            console.log(`next_required_phase: ${MISSING_INTENT_NEXT_REQUIRED_PHASE}`);
-            console.log(`next_required_action: ${MISSING_INTENT_NEXT_REQUIRED_ACTION}`);
-            console.log("");
-            console.log("intent_error:");
-            console.log(`- ${message}`);
-        }
-        else {
-            printStagedCheckSummary(summary);
-            console.log("");
-            console.log(`Next required phase: ${MISSING_INTENT_NEXT_REQUIRED_PHASE}`);
-            console.log(`Next required action: ${MISSING_INTENT_NEXT_REQUIRED_ACTION}`);
-            console.log(`Intent error: ${message}`);
-        }
-        if (emitGithubAnnotations && !options.json) {
-            printGithubIntentLoadError(message);
-        }
-        writeGithubStepSummary({ summary, intentLoadError: message });
-        applyStrictExit(options.strict);
+        writeGithubPolicyAuditStepSummary(summary, policySync);
+        // Policy-only audits do not block the build unless strict mode is on.
+        applyStrictExit(options.strict && summary.requiresAttention);
         return;
     }
+    // An active intent was found. Run the full, strict audit against the cloud boundary.
+    console.log(`[Ripple CI] Active intent '${intent.id}' found in cloud. Running full boundary check.`);
     const audit = await buildAuditForFiles({
         workspaceRoot,
         files,
@@ -3742,13 +3758,10 @@ async function ciCommand(options) {
         baseRef,
         tokenBudget: options.budget,
         intent,
-        currentPolicyExplanation: currentPolicyExplanationForIntent(workspaceRoot, intent),
+        currentPolicyExplanation: (0, core_1.explainRipplePolicyForIntent)((0, core_1.loadRipplePolicy)(workspaceRoot), intent),
     });
     if (options.json) {
-        printJson({
-            ...audit,
-            gate: (0, core_1.buildRippleGateSummary)(audit),
-        });
+        printJson({ ...audit, gate: (0, core_1.buildRippleGateSummary)(audit) });
     }
     else if (options.agent) {
         printAgentAuditSummary(audit);
@@ -3760,7 +3773,46 @@ async function ciCommand(options) {
         printGithubAuditAnnotations(audit);
     }
     writeGithubAuditStepSummary(audit);
-    applyStrictExit(options.strict && strictAuditShouldFail(audit));
+    // Sync the final audit result back to the cloud for the webhook to read.
+    if (process.env.RIPPLE_API_KEY) {
+        const gate = (0, core_1.buildRippleGateSummary)(audit);
+        const cloudDecision = gate.canContinue ? "continue" :
+            gate.needsHuman ? "human-review" : "blocked";
+        const branch = (0, core_1.getCurrentBranch)(child_process_1.execSync);
+        const actor = (0, core_1.getCurrentActor)(child_process_1.execSync);
+        const redactedPayload = {
+            decision: gate.decision,
+            status: gate.status,
+            risk: {
+                level: gate.risk.level,
+                score: gate.risk.score,
+                summary: gate.risk.summary,
+            },
+            auditStatus: audit.status,
+            approvalStatus: audit.approvalStatus.status,
+            intent: audit.intent,
+            mode: audit.mode,
+            baseRef: audit.baseRef,
+            blockingReasons: audit.blockingReasons,
+        };
+        const cloudResult = await (0, core_1.syncAuditToCloud)({
+            intentId: intent.id,
+            decision: cloudDecision,
+            commitSha: commitSha,
+            branch: branch,
+            actor: actor,
+            source: 'ci',
+            payload: redactedPayload,
+        });
+        if (cloudResult.sent) {
+            console.log(`[Ripple Cloud] ✓ Audit synced (${commitSha.slice(0, 7)})`);
+        }
+        else if (cloudResult.error) {
+            console.warn(`[Ripple Cloud] ⚠ Sync failed (non-blocking): ${cloudResult.error}`);
+        }
+    }
+    // Exit with a non-zero code if the audit did not pass, failing the CI job.
+    applyStrictExit(!audit.canProceed);
 }
 async function doctorCommand(options) {
     const workspaceRoot = resolveWorkspaceRoot(".");
@@ -4030,11 +4082,11 @@ fi
 
 set +e
 
-ripple_run() {
-${rippleDirectRunnerHookLines().join("\n")}
-}
-
-if [ -f ".ripple/intents/latest.json" ]; then
+ripple_run() {
+${rippleDirectRunnerHookLines().join("\n")}
+}
+
+if [ -f ".ripple/intents/latest.json" ]; then
   echo "[Ripple] Active local intent found. Checking staged changes against approved boundary..."
   ripple_run gate --staged --intent latest --agent --strict
   status=$?
@@ -4083,22 +4135,20 @@ function ripplePreCommitHookScript() {
         "",
     ].join("\n");
 }
+// ripple-main/packages/cli/src/index.ts
+// ... (keep all existing functions)
 function ripplePostCommitHookBlock() {
     return [
         RIPPLE_POST_COMMIT_HOOK_START,
-        `# Local intents are consumed after a successful commit to avoid ghost-intent blocks.
+        `# After a successful commit, this hook cleans up the consumed intent marker
+# left by the 'ripple gate' command. This prevents old intents from being
+# reused accidentally if a commit is amended or rebased.
 set +e
 
-cleared=0
-for intent_file in .ripple/.cache/latest-intent.json .ripple/intents/latest.json; do
-  if [ -f "$intent_file" ]; then
-    rm "$intent_file"
-    cleared=1
-  fi
-done
-
-if [ "$cleared" -eq 1 ]; then
-  echo "[Ripple] Consumed and cleared local intent."
+CONSUMED_INTENT_FILE=".ripple/.cache/consumed-intent.json"
+if [ -f "$CONSUMED_INTENT_FILE" ]; then
+  rm "$CONSUMED_INTENT_FILE"
+  echo "[Ripple] Cleaned up consumed intent marker."
 fi`,
         RIPPLE_POST_COMMIT_HOOK_END,
         "",