@gitgov/core 2.6.0 → 2.7.0

package/dist/src/github.js

@@ -1,4 +1,5 @@
 import picomatch from 'picomatch';
+import path from 'path';
 
 // src/file_lister/github/github_file_lister.ts
 
@@ -935,10 +936,10 @@ var GitHubGitModule = class {
       });
       const treeSha = commitData.tree.sha;
       const treeEntries = [];
-      for (const [path, content] of this.stagingBuffer) {
+      for (const [path2, content] of this.stagingBuffer) {
         if (content === null) {
           treeEntries.push({
-            path,
+            path: path2,
             mode: "100644",
             type: "blob",
             sha: null
@@ -951,7 +952,7 @@ var GitHubGitModule = class {
             encoding: "base64"
           });
           treeEntries.push({
-            path,
+            path: path2,
             mode: "100644",
             type: "blob",
             sha: blobData.sha
@@ -1154,12 +1155,12 @@ var GitHubConfigStore = class {
    * [EARS-B2] Caches SHA from response for subsequent saveConfig.
    */
   async loadConfig() {
-    const path = `${this.basePath}/config.json`;
+    const path2 = `${this.basePath}/config.json`;
     try {
       const { data } = await this.octokit.rest.repos.getContent({
         owner: this.owner,
         repo: this.repo,
-        path,
+        path: path2,
         ref: this.ref
       });
       if (Array.isArray(data) || data.type !== "file") {
@@ -1179,7 +1180,7 @@ var GitHubConfigStore = class {
       if (isOctokitRequestError(error) && error.status === 404) {
         return null;
       }
-      throw mapOctokitError(error, `loadConfig ${this.owner}/${this.repo}/${path}`);
+      throw mapOctokitError(error, `loadConfig ${this.owner}/${this.repo}/${path2}`);
     }
   }
   /**
@@ -1193,13 +1194,13 @@ var GitHubConfigStore = class {
    * [EARS-C3] Throws SERVER_ERROR on 5xx.
    */
   async saveConfig(config) {
-    const path = `${this.basePath}/config.json`;
+    const path2 = `${this.basePath}/config.json`;
     const content = Buffer.from(JSON.stringify(config, null, 2)).toString("base64");
     try {
       const { data } = await this.octokit.rest.repos.createOrUpdateFileContents({
         owner: this.owner,
         repo: this.repo,
-        path,
+        path: path2,
         message: "chore(config): update gitgov config.json",
         content,
         branch: this.ref,
@@ -1210,11 +1211,651 @@ var GitHubConfigStore = class {
       }
       return { commitSha: data.commit.sha };
     } catch (error) {
-      throw mapOctokitError(error, `saveConfig ${this.owner}/${this.repo}/${path}`);
+      throw mapOctokitError(error, `saveConfig ${this.owner}/${this.repo}/${path2}`);
     }
   }
 };
 
+// src/sync_state/sync_state.types.ts
+var SYNC_DIRECTORIES = [
+  "tasks",
+  "cycles",
+  "actors",
+  "agents",
+  "feedbacks",
+  "executions",
+  "changelogs",
+  "workflows"
+];
+var SYNC_ROOT_FILES = [
+  "config.json"
+];
+var SYNC_ALLOWED_EXTENSIONS = [".json"];
+var SYNC_EXCLUDED_PATTERNS = [
+  /\.key$/,
+  // Private keys (e.g., keys/*.key)
+  /\.backup$/,
+  // Backup files from lint
+  /\.backup-\d+$/,
+  // Numbered backup files
+  /\.tmp$/,
+  // Temporary files
+  /\.bak$/
+  // Backup files
+];
+var LOCAL_ONLY_FILES = [
+  "index.json",
+  // Generated index, rebuilt on each machine
+  ".session.json",
+  // Local session state for current user/agent
+  "gitgov"
+  // Local binary/script
+];
+
+// src/sync_state/sync_state.utils.ts
+function shouldSyncFile(filePath) {
+  const fileName = path.basename(filePath);
+  const ext = path.extname(filePath);
+  if (!SYNC_ALLOWED_EXTENSIONS.includes(ext)) {
+    return false;
+  }
+  for (const pattern of SYNC_EXCLUDED_PATTERNS) {
+    if (pattern.test(fileName)) {
+      return false;
+    }
+  }
+  if (LOCAL_ONLY_FILES.includes(fileName)) {
+    return false;
+  }
+  const normalizedPath = filePath.replace(/\\/g, "/");
+  const parts = normalizedPath.split("/");
+  const gitgovIndex = parts.findIndex((p) => p === ".gitgov");
+  let relativeParts;
+  if (gitgovIndex !== -1) {
+    relativeParts = parts.slice(gitgovIndex + 1);
+  } else {
+    const syncDirIndex = parts.findIndex(
+      (p) => SYNC_DIRECTORIES.includes(p)
+    );
+    if (syncDirIndex !== -1) {
+      relativeParts = parts.slice(syncDirIndex);
+    } else if (SYNC_ROOT_FILES.includes(fileName)) {
+      return true;
+    } else {
+      return false;
+    }
+  }
+  if (relativeParts.length === 1) {
+    return SYNC_ROOT_FILES.includes(relativeParts[0]);
+  } else if (relativeParts.length >= 2) {
+    const dirName = relativeParts[0];
+    return SYNC_DIRECTORIES.includes(dirName);
+  }
+  return false;
+}
+
+// src/sync_state/github_sync_state/github_sync_state.ts
+var GithubSyncStateModule = class {
+  deps;
+  lastKnownSha = null;
+  constructor(deps) {
+    this.deps = deps;
+  }
+  // ==================== Block A: Branch Management ====================
+  /**
+   * [EARS-GS-A3] Returns the configured state branch name.
+   */
+  async getStateBranchName() {
+    return "gitgov-state";
+  }
+  /**
+   * [EARS-GS-A1] Creates gitgov-state branch if it does not exist.
+   * [EARS-GS-A2] Idempotent — no-op if branch already exists.
+   */
+  async ensureStateBranch() {
+    const branchName = await this.getStateBranchName();
+    try {
+      await this.deps.octokit.rest.repos.getBranch({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        branch: branchName
+      });
+      return;
+    } catch (error) {
+      if (!isOctokitRequestError(error) || error.status !== 404) {
+        throw error;
+      }
+    }
+    const { data: repoData } = await this.deps.octokit.rest.repos.get({
+      owner: this.deps.owner,
+      repo: this.deps.repo
+    });
+    const defaultBranch = repoData.default_branch;
+    const { data: refData } = await this.deps.octokit.rest.git.getRef({
+      owner: this.deps.owner,
+      repo: this.deps.repo,
+      ref: `heads/${defaultBranch}`
+    });
+    await this.deps.octokit.rest.git.createRef({
+      owner: this.deps.owner,
+      repo: this.deps.repo,
+      ref: `refs/heads/${branchName}`,
+      sha: refData.object.sha
+    });
+  }
+  // ==================== Block B: Push State ====================
+  /**
+   * [EARS-GS-B1..B5] Push local .gitgov/ state to gitgov-state branch via API.
+   *
+   * Uses the 6-step atomic commit pattern:
+   * getRef → getCommit → createBlob → createTree → createCommit → updateRef
+   *
+   * Optimistic concurrency: if remote ref advanced since our read, updateRef
+   * fails with 422 → return conflictDetected: true.
+   */
+  async pushState(options) {
+    const branchName = await this.getStateBranchName();
+    const sourceBranch = options.sourceBranch ?? "main";
+    try {
+      const { data: stateRefData } = await this.deps.octokit.rest.git.getRef({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        ref: `heads/${branchName}`
+      });
+      const currentSha = stateRefData.object.sha;
+      const { data: sourceTree } = await this.deps.octokit.rest.git.getTree({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        tree_sha: sourceBranch,
+        recursive: "true"
+      });
+      const sourceFiles = (sourceTree.tree ?? []).filter(
+        (item) => item.type === "blob" && item.path?.startsWith(".gitgov/") && shouldSyncFile(item.path)
+      );
+      const { data: targetCommit } = await this.deps.octokit.rest.git.getCommit({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        commit_sha: currentSha
+      });
+      const { data: targetTree } = await this.deps.octokit.rest.git.getTree({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        tree_sha: targetCommit.tree.sha,
+        recursive: "true"
+      });
+      const targetFileMap = /* @__PURE__ */ new Map();
+      for (const item of targetTree.tree ?? []) {
+        if (item.type === "blob" && item.path && item.sha) {
+          targetFileMap.set(item.path, item.sha);
+        }
+      }
+      const delta = [];
+      const treeEntries = [];
+      for (const sourceFile of sourceFiles) {
+        if (!sourceFile.path || !sourceFile.sha) continue;
+        const statePath = sourceFile.path.replace(/^\.gitgov\//, "");
+        const targetSha = targetFileMap.get(statePath);
+        if (targetSha !== sourceFile.sha) {
+          delta.push({
+            status: targetSha ? "M" : "A",
+            file: statePath
+          });
+          treeEntries.push({
+            path: statePath,
+            mode: "100644",
+            type: "blob",
+            sha: sourceFile.sha
+          });
+        }
+        targetFileMap.delete(statePath);
+      }
+      for (const [deletedPath] of targetFileMap) {
+        if (shouldSyncFile(deletedPath)) {
+          delta.push({ status: "D", file: deletedPath });
+          treeEntries.push({
+            path: deletedPath,
+            mode: "100644",
+            type: "blob",
+            sha: null
+          });
+        }
+      }
+      if (delta.length === 0) {
+        return {
+          success: true,
+          filesSynced: 0,
+          sourceBranch,
+          commitHash: null,
+          commitMessage: null,
+          conflictDetected: false
+        };
+      }
+      if (options.dryRun) {
+        return {
+          success: true,
+          filesSynced: delta.length,
+          sourceBranch,
+          commitHash: null,
+          commitMessage: `[dry-run] gitgov sync: ${delta.length} files`,
+          conflictDetected: false
+        };
+      }
+      const { data: newTreeData } = await this.deps.octokit.rest.git.createTree({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        base_tree: targetCommit.tree.sha,
+        tree: treeEntries
+      });
+      const commitMessage = `gitgov sync: ${delta.length} files from ${sourceBranch}`;
+      const { data: newCommitData } = await this.deps.octokit.rest.git.createCommit({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        message: commitMessage,
+        tree: newTreeData.sha,
+        parents: [currentSha]
+      });
+      try {
+        await this.deps.octokit.rest.git.updateRef({
+          owner: this.deps.owner,
+          repo: this.deps.repo,
+          ref: `heads/${branchName}`,
+          sha: newCommitData.sha
+        });
+      } catch (error) {
+        if (isOctokitRequestError(error) && (error.status === 422 || error.status === 409)) {
+          return {
+            success: false,
+            filesSynced: 0,
+            sourceBranch,
+            commitHash: null,
+            commitMessage: null,
+            conflictDetected: true,
+            conflictInfo: {
+              type: "rebase_conflict",
+              affectedFiles: delta.map((d) => d.file),
+              message: "Remote gitgov-state ref has advanced since last read. Pull and retry.",
+              resolutionSteps: [
+                "Call pullState() to fetch latest remote state",
+                "Retry pushState() with updated parent SHA"
+              ]
+            }
+          };
+        }
+        throw error;
+      }
+      this.lastKnownSha = newCommitData.sha;
+      return {
+        success: true,
+        filesSynced: delta.length,
+        sourceBranch,
+        commitHash: newCommitData.sha,
+        commitMessage,
+        conflictDetected: false
+      };
+    } catch (error) {
+      if (isOctokitRequestError(error)) {
+        return {
+          success: false,
+          filesSynced: 0,
+          sourceBranch,
+          commitHash: null,
+          commitMessage: null,
+          conflictDetected: false,
+          error: `GitHub API error (${error.status}): ${error.message}`
+        };
+      }
+      const msg = error instanceof Error ? error.message : String(error);
+      return {
+        success: false,
+        filesSynced: 0,
+        sourceBranch,
+        commitHash: null,
+        commitMessage: null,
+        conflictDetected: false,
+        error: msg
+      };
+    }
+  }
+  // ==================== Block C: Pull State ====================
+  /**
+   * [EARS-GS-C1..C4] Pull remote state from gitgov-state branch.
+   *
+   * Fetches tree + blobs, updates lastKnownSha, triggers re-indexing.
+   */
+  async pullState(options) {
+    const branchName = await this.getStateBranchName();
+    let remoteSha;
+    try {
+      const { data: refData } = await this.deps.octokit.rest.git.getRef({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        ref: `heads/${branchName}`
+      });
+      remoteSha = refData.object.sha;
+    } catch (error) {
+      if (isOctokitRequestError(error) && error.status === 404) {
+        return {
+          success: true,
+          hasChanges: false,
+          filesUpdated: 0,
+          reindexed: false,
+          conflictDetected: false
+        };
+      }
+      throw error;
+    }
+    if (this.lastKnownSha === remoteSha && !options?.forceReindex) {
+      return {
+        success: true,
+        hasChanges: false,
+        filesUpdated: 0,
+        reindexed: false,
+        conflictDetected: false
+      };
+    }
+    const { data: commitData } = await this.deps.octokit.rest.git.getCommit({
+      owner: this.deps.owner,
+      repo: this.deps.repo,
+      commit_sha: remoteSha
+    });
+    const { data: treeData } = await this.deps.octokit.rest.git.getTree({
+      owner: this.deps.owner,
+      repo: this.deps.repo,
+      tree_sha: commitData.tree.sha,
+      recursive: "true"
+    });
+    const syncableFiles = (treeData.tree ?? []).filter(
+      (item) => item.type === "blob" && item.path && shouldSyncFile(item.path)
+    );
+    const filesUpdated = syncableFiles.length;
+    this.lastKnownSha = remoteSha;
+    let reindexed = false;
+    if (filesUpdated > 0 || options?.forceReindex) {
+      try {
+        await this.deps.indexer.computeProjection();
+        reindexed = true;
+      } catch {
+        reindexed = false;
+      }
+    }
+    return {
+      success: true,
+      hasChanges: filesUpdated > 0,
+      filesUpdated,
+      reindexed,
+      conflictDetected: false
+    };
+  }
+  // ==================== Block D: Change Detection ====================
+  /**
+   * [EARS-GS-D1..D3] Calculate file delta between known state and current remote.
+   */
+  async calculateStateDelta(_sourceBranch) {
+    const branchName = await this.getStateBranchName();
+    let currentSha;
+    try {
+      const { data: refData } = await this.deps.octokit.rest.git.getRef({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        ref: `heads/${branchName}`
+      });
+      currentSha = refData.object.sha;
+    } catch (error) {
+      if (isOctokitRequestError(error) && error.status === 404) {
+        return [];
+      }
+      throw error;
+    }
+    if (this.lastKnownSha === currentSha) {
+      return [];
+    }
+    if (this.lastKnownSha === null) {
+      const { data: commitData } = await this.deps.octokit.rest.git.getCommit({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        commit_sha: currentSha
+      });
+      const { data: treeData } = await this.deps.octokit.rest.git.getTree({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        tree_sha: commitData.tree.sha,
+        recursive: "true"
+      });
+      return (treeData.tree ?? []).filter((item) => item.type === "blob" && item.path && shouldSyncFile(item.path)).map((item) => ({
+        status: "A",
+        file: item.path
+      }));
+    }
+    const { data: comparison } = await this.deps.octokit.rest.repos.compareCommits({
+      owner: this.deps.owner,
+      repo: this.deps.repo,
+      base: this.lastKnownSha,
+      head: currentSha
+    });
+    return (comparison.files ?? []).filter((file) => shouldSyncFile(file.filename)).map((file) => ({
+      status: file.status === "added" ? "A" : file.status === "removed" ? "D" : "M",
+      file: file.filename
+    }));
+  }
+  /**
+   * Always empty — no local pending changes in API mode.
+   * In API mode there is no local filesystem; all state is remote.
+   */
+  async getPendingChanges() {
+    return [];
+  }
+  // ==================== Block E: Conflict Handling ====================
+  /**
+   * Always false — no rebase in API mode.
+   */
+  async isRebaseInProgress() {
+    return false;
+  }
+  /**
+   * Always empty — no conflict markers in API mode.
+   */
+  async checkConflictMarkers(_filePaths) {
+    return [];
+  }
+  /**
+   * Empty diff — no git-level conflict markers in API mode.
+   */
+  async getConflictDiff(_filePaths) {
+    return {
+      files: [],
+      message: "No conflict markers in API mode. Conflicts are SHA-based.",
+      resolutionSteps: [
+        "Call pullState() to fetch latest remote state",
+        "Retry pushState() with updated records"
+      ]
+    };
+  }
+  /**
+   * [EARS-GS-E1..E2] Resolve conflict by pulling latest and retrying push.
+   */
+  async resolveConflict(options) {
+    const pullResult = await this.pullState({ forceReindex: false });
+    if (!pullResult.success) {
+      return {
+        success: false,
+        rebaseCommitHash: "",
+        resolutionCommitHash: "",
+        conflictsResolved: 0,
+        resolvedBy: options.actorId,
+        reason: options.reason,
+        error: `Pull failed during conflict resolution: ${pullResult.error}`
+      };
+    }
+    const pushResult = await this.pushState({
+      actorId: options.actorId
+    });
+    if (!pushResult.success || pushResult.conflictDetected) {
+      const errorMsg = pushResult.conflictDetected ? "Content conflict: same file modified by both sides. Manual resolution required." : pushResult.error ?? "Unknown push error";
+      return {
+        success: false,
+        rebaseCommitHash: "",
+        resolutionCommitHash: "",
+        conflictsResolved: 0,
+        resolvedBy: options.actorId,
+        reason: options.reason,
+        error: errorMsg
+      };
+    }
+    return {
+      success: true,
+      rebaseCommitHash: this.lastKnownSha ?? "",
+      resolutionCommitHash: pushResult.commitHash ?? "",
+      conflictsResolved: pushResult.filesSynced,
+      resolvedBy: options.actorId,
+      reason: options.reason
+    };
+  }
+  /**
+   * No integrity violations in API mode (no rebase commits).
+   */
+  async verifyResolutionIntegrity() {
+    return [];
+  }
+  // ==================== Block F: Audit ====================
+  /**
+   * [EARS-GS-F1..F2] Audit the remote gitgov-state branch.
+   */
+  async auditState(options) {
+    const branchName = await this.getStateBranchName();
+    const scope = options?.scope ?? "all";
+    let totalCommits = 0;
+    try {
+      const { data: commits } = await this.deps.octokit.rest.repos.listCommits({
+        owner: this.deps.owner,
+        repo: this.deps.repo,
+        sha: branchName,
+        per_page: 100
+      });
+      totalCommits = commits.length;
+    } catch (error) {
+      if (isOctokitRequestError(error) && error.status === 404) {
+        return {
+          passed: true,
+          scope,
+          totalCommits: 0,
+          rebaseCommits: 0,
+          resolutionCommits: 0,
+          integrityViolations: [],
+          summary: "Branch gitgov-state does not exist. No audit needed."
+        };
+      }
+      throw error;
+    }
+    const rebaseCommits = 0;
+    const resolutionCommits = 0;
+    const integrityViolations = [];
+    let lintReport;
+    if (options?.verifySignatures !== false || options?.verifyChecksums !== false) {
+      try {
+        const { data: refData } = await this.deps.octokit.rest.git.getRef({
+          owner: this.deps.owner,
+          repo: this.deps.repo,
+          ref: `heads/${branchName}`
+        });
+        const { data: commitData } = await this.deps.octokit.rest.git.getCommit({
+          owner: this.deps.owner,
+          repo: this.deps.repo,
+          commit_sha: refData.object.sha
+        });
+        const { data: treeData } = await this.deps.octokit.rest.git.getTree({
+          owner: this.deps.owner,
+          repo: this.deps.repo,
+          tree_sha: commitData.tree.sha,
+          recursive: "true"
+        });
+        const treeItems = (treeData.tree ?? []).filter((item) => item.type === "blob" && item.path && item.sha && shouldSyncFile(item.path));
+        const startTime = Date.now();
+        const allResults = [];
+        let filesChecked = 0;
+        for (const item of treeItems) {
+          try {
+            const { data: blobData } = await this.deps.octokit.rest.git.getBlob({
+              owner: this.deps.owner,
+              repo: this.deps.repo,
+              file_sha: item.sha
+            });
+            const content = Buffer.from(blobData.content, "base64").toString("utf-8");
+            const record = JSON.parse(content);
+            const entityType = pathToEntityType(item.path);
+            if (entityType) {
+              const results = this.deps.lint.lintRecord(record, {
+                recordId: item.path.split("/").pop()?.replace(".json", "") ?? item.path,
+                entityType,
+                filePath: item.path
+              });
+              allResults.push(...results);
+            }
+            filesChecked++;
+          } catch {
+          }
+        }
+        if (filesChecked > 0) {
+          lintReport = {
+            summary: {
+              filesChecked,
+              errors: allResults.filter((r) => r.level === "error").length,
+              warnings: allResults.filter((r) => r.level === "warning").length,
+              fixable: allResults.filter((r) => r.fixable).length,
+              executionTime: Date.now() - startTime
+            },
+            results: allResults,
+            metadata: {
+              timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+              options: {},
+              version: "1.0.0"
+            }
+          };
+        }
+      } catch {
+      }
+    }
+    const lintPassed = !lintReport || lintReport.summary.errors === 0;
+    const passed = integrityViolations.length === 0 && lintPassed;
+    const lintErrors = lintReport?.summary.errors ?? 0;
+    let summary;
+    if (passed) {
+      summary = `Audit passed. ${totalCommits} commits analyzed, 0 violations.`;
+    } else if (integrityViolations.length > 0 && lintErrors > 0) {
+      summary = `Audit failed. ${integrityViolations.length} integrity violations, ${lintErrors} lint errors.`;
+    } else if (lintErrors > 0) {
+      summary = `Audit failed. ${lintErrors} lint errors found.`;
+    } else {
+      summary = `Audit failed. ${integrityViolations.length} integrity violations found.`;
+    }
+    const report = {
+      passed,
+      scope,
+      totalCommits,
+      rebaseCommits,
+      resolutionCommits,
+      integrityViolations,
+      summary
+    };
+    if (lintReport) {
+      report.lintReport = lintReport;
+    }
+    return report;
+  }
+};
+function pathToEntityType(filePath) {
+  const dirMap = {
+    tasks: "task",
+    cycles: "cycle",
+    actors: "actor",
+    agents: "agent",
+    feedbacks: "feedback",
+    executions: "execution",
+    changelogs: "changelog"
+  };
+  const firstSegment = filePath.split("/")[0] ?? "";
+  return dirMap[firstSegment];
+}
+
 // src/github.ts
 var GitHubApiError = class _GitHubApiError extends Error {
   constructor(message, code, statusCode) {
@@ -1276,6 +1917,6 @@ function mapOctokitError(error, context) {
   return new GitHubApiError(`Network error: ${message}`, "NETWORK_ERROR");
 }
 
-export { GitHubApiError, GitHubConfigStore, GitHubFileLister, GitHubGitModule, GitHubRecordStore, isOctokitRequestError, mapOctokitError };
+export { GitHubApiError, GitHubConfigStore, GitHubFileLister, GitHubGitModule, GitHubRecordStore, GithubSyncStateModule, isOctokitRequestError, mapOctokitError };
 //# sourceMappingURL=github.js.map
 //# sourceMappingURL=github.js.map