@gmickel/gno 1.24.0 → 1.26.0

package/src/core/folder-setup-planning.ts

@@ -24,13 +24,7 @@ import { isCanonicalPathContained, validateCollectionRoot } from "./validation";
 
 const INVALID_NAME_CHARS = /[^a-z0-9_-]/g;
 const LEADING_NON_ALPHANUMERIC = /^[^a-z0-9]+/;
-const SECRET_FILE_PATTERNS = [
-  /^\.env(?:\.|$)/,
-  /^credentials?(?:\.|$)/,
-  /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.|$)/,
-  /^secrets?(?:\.|$)/,
-  /\.(?:key|pem|p12|pfx)$/i,
-];
+import { hasLikelySecretPath, matchesCollectionExclusion } from "./path-rules";
 
 export type FolderSetupErrorCode =
   | "folder_not_found"
@@ -110,18 +104,6 @@ export function setupInjectedFailure(checkpoint: string): FolderSetupError {
   );
 }
 
-function isExcluded(relPath: string, excludes: string[]): boolean {
-  const parts = relPath.split("/");
-  return excludes.some(
-    (exclude) => parts.includes(exclude) || relPath.startsWith(`${exclude}/`)
-  );
-}
-
-function hasSecretRisk(relPath: string): boolean {
-  const fileName = basename(relPath).toLowerCase();
-  return SECRET_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
-}
-
 async function listFolderFiles(folder: string): Promise<string[]> {
   const files: string[] = [];
   const glob = new Bun.Glob("**/*");
@@ -345,7 +327,7 @@ export async function preflightFolder(
   let files: string[];
   try {
     files = (await listFolderFiles(folder)).filter(
-      (path) => !isExcluded(path, excludes)
+      (path) => !matchesCollectionExclusion(path, excludes)
     );
   } catch {
     return setupError(
@@ -361,7 +343,10 @@ export async function preflightFolder(
       "Add supported documents or choose another folder."
     );
   }
-  if (!secretRiskAuthorized && files.some((path) => hasSecretRisk(path))) {
+  if (
+    !secretRiskAuthorized &&
+    files.some((path) => hasLikelySecretPath(path))
+  ) {
     return setupError(
       "secret_risk",
       `Folder contains likely credential or secret files: ${folder}`,

package/src/core/folder-setup.ts

@@ -12,6 +12,7 @@ import { DEFAULT_EXCLUDES, loadConfig } from "../config";
 import { defaultSyncService, withContentTypeRules } from "../ingestion";
 import { verifyLexicalActivation } from "./activation-verifier";
 import { applyConfigChange } from "./config-mutation";
+import { getConfigWriteLockPath } from "./config-write-lock";
 import {
   type CollectionSelection,
   type FolderSetupError,
@@ -60,6 +61,11 @@ export interface FolderSetupOptions {
   name?: string;
   exclude?: string[];
   secretRiskAuthorized?: boolean;
+  /**
+   * Preserve store-only recovery state while projecting the selected
+   * collection. Project-profile setup uses this after its own additive apply.
+   */
+  additiveStoreProjection?: boolean;
   /** Test-only deterministic interruption hook. */
   failureInjection?: FolderSetupFailurePoint;
   /** Test-only concurrency seam before the serialized config boundary. */
@@ -149,7 +155,7 @@ export async function setupFolder(
     indexName: storeIdentity.indexName,
     folderRealpath: folder,
   });
-  const configLockPath = `${options.configPath}.setup.lock`;
+  const configLockPath = await getConfigWriteLockPath(options.configPath);
   const unsafeOutput = await validateSetupOutputPaths(folder, [
     { label: "Data directory", path: options.dataDir },
     { label: "Setup receipt", path: receiptPath },
@@ -250,7 +256,6 @@ export async function setupFolder(
       {
         store: options.store,
         configPath: options.configPath,
-        writeLockPath: configLockPath,
         onConfigUpdated: (config) => {
           activeConfig = config;
         },
@@ -292,6 +297,29 @@ export async function setupFolder(
             throw new SetupAbort(storeReceiptFailure);
           }
         },
+        projectStore: options.additiveStoreProjection
+          ? async (store, config) => {
+              const selected = activeSelection;
+              if (!selected) {
+                return {
+                  ok: false,
+                  error: "Setup collection selection was not established",
+                };
+              }
+              const collectionResult = await store.upsertCollections([
+                selected.collection,
+              ]);
+              if (!collectionResult.ok) {
+                return { ok: false, error: collectionResult.error.message };
+              }
+              const contextResult = await store.upsertContexts(
+                config.contexts ?? []
+              );
+              return contextResult.ok
+                ? { ok: true }
+                : { ok: false, error: contextResult.error.message };
+            }
+          : undefined,
       },
       async (config) => {
         const fresh = await selectFolderCollection(

package/src/core/path-rules.ts

@@ -0,0 +1,53 @@
+/**
+ * Shared path-rule semantics for profile validation, setup preflight, and
+ * ingestion. Paths use repository-relative POSIX form at this boundary.
+ *
+ * @module src/core/path-rules
+ */
+
+const GLOB_META_PATTERN = /[*?[\]{}]/;
+const SECRET_FILE_PATTERNS = [
+  /^\.env(?:\.|$)/i,
+  /^credentials?(?:\.|$)/i,
+  /^id_(?:rsa|dsa|ecdsa|ed25519)(?:\.|$)/i,
+  /^secrets?(?:\.|$)/i,
+  /\.(?:key|pem|p12|pfx)$/i,
+];
+
+export function hasLikelySecretPath(path: string): boolean {
+  const normalized = path.replaceAll("\\", "/");
+  const fileName = normalized.slice(normalized.lastIndexOf("/") + 1);
+  return SECRET_FILE_PATTERNS.some((pattern) => pattern.test(fileName));
+}
+
+export function hasGlobMeta(pattern: string): boolean {
+  return GLOB_META_PATTERN.test(pattern);
+}
+
+/**
+ * Bare values preserve historical component/prefix semantics. Values with
+ * glob metacharacters match the complete normalized relative path.
+ */
+export function matchesCollectionExclusion(
+  relPath: string,
+  excludes: readonly string[]
+): boolean {
+  const normalizedPath = relPath.replaceAll("\\", "/");
+  const parts = normalizedPath.split("/");
+
+  for (const rawPattern of excludes) {
+    const pattern = rawPattern.replaceAll("\\", "/");
+    if (hasGlobMeta(pattern)) {
+      if (new Bun.Glob(pattern).match(normalizedPath)) return true;
+      continue;
+    }
+    if (
+      parts.includes(pattern) ||
+      normalizedPath === pattern ||
+      normalizedPath.startsWith(`${pattern}/`)
+    ) {
+      return true;
+    }
+  }
+  return false;
+}

package/src/core/project-affinity-surface.ts

@@ -10,7 +10,10 @@
 import type { Config, ProjectAffinityInput } from "../config/types";
 import type { ProjectAffinityScoringInput } from "../pipeline/project-affinity";
 
+import { PROJECT_AFFINITY_MAX_CONTRIBUTION } from "../config/types";
 import { resolveProjectAffinity } from "./project-affinity";
+import { compileProjectProfileYaml } from "./project-profile";
+import { discoverProjectProfile } from "./project-profile-discovery";
 
 export const MAX_PROJECT_AFFINITY_INPUTS = 16;
 
@@ -19,6 +22,12 @@ export interface CliProjectAffinityRequest {
   projectRoots?: string[];
 }
 
+export interface ProjectProfileAffinityDefaults {
+  contribution: number;
+  enabled: boolean;
+  profileRoot: string;
+}
+
 export class ProjectAffinityInputError extends Error {
   constructor(message: string) {
     super(message);
@@ -66,12 +75,54 @@ const scoringInput = async (
   }),
 });
 
+/**
+ * Resolve only the nearest trusted local profile's compiled affinity defaults.
+ * Invalid/missing profiles are a fallback signal, not a retrieval failure.
+ * Profile content never supplies identity: discovery's canonical profile root
+ * is the sole project root.
+ */
+export const resolveProjectProfileAffinityDefaults = async (
+  cwd: string,
+  config: Config
+): Promise<ProjectProfileAffinityDefaults | null> => {
+  const discovery = await discoverProjectProfile({
+    channel: "local",
+    cwd,
+  });
+  if (
+    discovery.summary.status !== "found" ||
+    !discovery.profilePath ||
+    !discovery.profileRoot
+  ) {
+    return null;
+  }
+
+  try {
+    const profileYaml = await Bun.file(discovery.profilePath).text();
+    const compiled = await compileProjectProfileYaml(profileYaml, {
+      profileRoot: discovery.profileRoot,
+      config,
+    });
+    if (!compiled.ok) return null;
+    return {
+      ...compiled.value.desiredState.affinityDefaults,
+      profileRoot: discovery.profileRoot,
+    };
+  } catch {
+    return null;
+  }
+};
+
 export const resolveCliProjectAffinity = async (
   config: Config,
   options: {
     cwd: string;
     disabled?: boolean;
     projectRoots?: readonly string[];
+    resolveProfileDefaults?: (
+      cwd: string,
+      config: Config
+    ) => Promise<ProjectProfileAffinityDefaults | null>;
   }
 ): Promise<ProjectAffinityScoringInput | undefined> => {
   const projectRoots = normalizeProjectAffinityValues(
@@ -83,16 +134,60 @@ export const resolveCliProjectAffinity = async (
       "--no-project-affinity cannot be combined with --project-root"
     );
   }
-  if (options.disabled || config.projectAffinity?.enabled === false) return;
+  if (options.disabled) return;
 
-  const roots =
-    projectRoots.length > 0
-      ? projectRoots.map((path) => ({
+  if (projectRoots.length > 0) {
+    return scoringInput(
+      {
+        roots: projectRoots.map((path) => ({
           path,
           source: "cli_explicit" as const,
-        }))
-      : [{ path: options.cwd, source: "cli_cwd" as const }];
-  return scoringInput({ roots }, config, "local");
+        })),
+      },
+      {
+        ...config,
+        projectAffinity: {
+          enabled: true,
+          contribution:
+            config.projectAffinity?.contribution ??
+            PROJECT_AFFINITY_MAX_CONTRIBUTION,
+        },
+      },
+      "local"
+    );
+  }
+
+  const profileDefaults = await (
+    options.resolveProfileDefaults ?? resolveProjectProfileAffinityDefaults
+  )(options.cwd, config);
+  if (profileDefaults) {
+    if (!profileDefaults.enabled) return;
+    return scoringInput(
+      {
+        roots: [
+          {
+            path: profileDefaults.profileRoot,
+            source: "project_profile",
+          },
+        ],
+      },
+      {
+        ...config,
+        projectAffinity: {
+          enabled: profileDefaults.enabled,
+          contribution: profileDefaults.contribution,
+        },
+      },
+      "local"
+    );
+  }
+
+  if (config.projectAffinity?.enabled === false) return;
+  return scoringInput(
+    { roots: [{ path: options.cwd, source: "cli_cwd" }] },
+    config,
+    "local"
+  );
 };
 
 export const resolveRemoteProjectAffinity = async (

package/src/core/project-profile-apply-state.ts

@@ -0,0 +1,268 @@
+/**
+ * Pure create/update-only config projection for project profile apply.
+ *
+ * @module src/core/project-profile-apply-state
+ */
+
+import type { Config, ProjectProfileBinding } from "../config/types";
+import type { ProjectProfileDesiredState } from "./project-profile";
+import type { ProjectProfileDiff } from "./project-profile-diff";
+
+import { getPreset } from "../llm/registry";
+import { normalizePersistedContextText } from "./context-identity";
+import {
+  canonicalProjectProfileJson,
+  projectProfileIncludePattern,
+} from "./project-profile";
+
+export type ProjectProfileApplyDisposition =
+  | "created"
+  | "reused"
+  | "updated"
+  | "skipped";
+
+export interface ProjectProfileApplyResource {
+  kind:
+    | "capability"
+    | "collection"
+    | "content_type"
+    | "contexts"
+    | "profile_binding"
+    | "project_affinity"
+    | "stale_mapping";
+  id: string;
+  disposition: ProjectProfileApplyDisposition;
+  pendingIndexing: boolean;
+}
+
+const compareCodeUnits = (left: string, right: string): number =>
+  left < right ? -1 : left > right ? 1 : 0;
+
+export const canonicalProfileStateEqual = (
+  left: unknown,
+  right: unknown
+): boolean =>
+  canonicalProjectProfileJson(left) === canonicalProjectProfileJson(right);
+
+const collectionModels = (
+  config: Config,
+  presetId: string | undefined
+): Config["collections"][number]["models"] | undefined => {
+  if (!presetId) return undefined;
+  const preset = getPreset(config, presetId);
+  if (!preset) return undefined;
+  return {
+    embed: preset.embed,
+    rerank: preset.rerank,
+    ...(preset.expand ? { expand: preset.expand } : {}),
+    gen: preset.gen,
+  };
+};
+
+export function applyProjectProfileDesiredState(
+  config: Config,
+  desired: ProjectProfileDesiredState,
+  collectionRoot: string,
+  profileBinding: ProjectProfileBinding
+): Config {
+  const existingIndex = config.collections.findIndex(
+    (collection) => collection.name === desired.collection.name
+  );
+  const existing =
+    existingIndex >= 0 ? config.collections[existingIndex] : undefined;
+  const models = collectionModels(config, desired.collection.modelPreset);
+  const nextCollection: Config["collections"][number] = {
+    name: desired.collection.name,
+    path: collectionRoot,
+    pattern: projectProfileIncludePattern(desired.collection.include),
+    include: [],
+    exclude: desired.collection.exclude,
+    ...(existing?.updateCmd ? { updateCmd: existing.updateCmd } : {}),
+    ...(desired.collection.languageHint
+      ? { languageHint: desired.collection.languageHint }
+      : existing?.languageHint
+        ? { languageHint: existing.languageHint }
+        : {}),
+    ...(models
+      ? { models }
+      : existing?.models
+        ? { models: existing.models }
+        : {}),
+  };
+  const collections = [...config.collections];
+  if (existingIndex >= 0) collections[existingIndex] = nextCollection;
+  else collections.push(nextCollection);
+
+  const contexts = [...config.contexts];
+  const configuredContexts = new Set(
+    contexts
+      .filter(
+        (context) =>
+          context.scopeType === "collection" &&
+          context.scopeKey === `${desired.collection.name}:`
+      )
+      .map((context) => normalizePersistedContextText(context.text))
+  );
+  for (const context of desired.contexts) {
+    const normalizedText = normalizePersistedContextText(context.text);
+    if (!configuredContexts.has(normalizedText)) {
+      contexts.push({
+        scopeType: context.scopeType,
+        scopeKey: context.scopeKey,
+        text: normalizedText,
+      });
+      configuredContexts.add(normalizedText);
+    }
+  }
+
+  const contentTypes = [...(config.contentTypes ?? [])];
+  for (const desiredRule of desired.contentTypes) {
+    const index = contentTypes.findIndex((rule) => rule.id === desiredRule.id);
+    if (index >= 0) contentTypes[index] = desiredRule;
+    else contentTypes.push(desiredRule);
+  }
+
+  const projectProfileBindings = [...(config.projectProfileBindings ?? [])];
+  const bindingIndex = projectProfileBindings.findIndex(
+    (binding) => binding.path === profileBinding.path
+  );
+  if (bindingIndex >= 0) projectProfileBindings[bindingIndex] = profileBinding;
+  else projectProfileBindings.push(profileBinding);
+  projectProfileBindings.sort((left, right) =>
+    compareCodeUnits(left.path, right.path)
+  );
+
+  return {
+    ...config,
+    collections,
+    contexts,
+    contentTypes,
+    projectProfileBindings,
+  };
+}
+
+export function buildProjectProfileResources(
+  before: Config,
+  after: Config,
+  diff: ProjectProfileDiff,
+  desired: ProjectProfileDesiredState,
+  profileBinding: ProjectProfileBinding
+): ProjectProfileApplyResource[] {
+  const resources: ProjectProfileApplyResource[] = [];
+  const beforeCollection = before.collections.find(
+    (collection) => collection.name === desired.collection.name
+  );
+  const afterCollection = after.collections.find(
+    (collection) => collection.name === desired.collection.name
+  );
+  resources.push({
+    kind: "collection",
+    id: desired.collection.name,
+    disposition: beforeCollection
+      ? canonicalProfileStateEqual(beforeCollection, afterCollection)
+        ? "reused"
+        : "updated"
+      : "created",
+    pendingIndexing: !canonicalProfileStateEqual(
+      beforeCollection,
+      afterCollection
+    ),
+  });
+
+  const beforeContextTexts = new Set(
+    before.contexts
+      .filter(
+        (context) =>
+          context.scopeType === "collection" &&
+          context.scopeKey === `${desired.collection.name}:`
+      )
+      .map((context) => normalizePersistedContextText(context.text))
+  );
+  const missingContexts = desired.contexts.filter(
+    (context) =>
+      !beforeContextTexts.has(normalizePersistedContextText(context.text))
+  );
+  resources.push({
+    kind: "contexts",
+    id: `${desired.collection.name}:`,
+    disposition:
+      desired.contexts.length === 0
+        ? "skipped"
+        : missingContexts.length === 0
+          ? "reused"
+          : beforeContextTexts.size === 0
+            ? "created"
+            : "updated",
+    pendingIndexing: false,
+  });
+
+  const beforeContentTypes = new Map(
+    (before.contentTypes ?? []).map((rule) => [rule.id, rule])
+  );
+  for (const rule of desired.contentTypes) {
+    const previous = beforeContentTypes.get(rule.id);
+    const disposition = previous
+      ? canonicalProfileStateEqual(previous, rule)
+        ? "reused"
+        : "updated"
+      : "created";
+    resources.push({
+      kind: "content_type",
+      id: rule.id,
+      disposition,
+      pendingIndexing: disposition !== "reused",
+    });
+  }
+  if (desired.contentTypes.length === 0) {
+    resources.push({
+      kind: "content_type",
+      id: "(none declared)",
+      disposition: "skipped",
+      pendingIndexing: false,
+    });
+  }
+
+  resources.push({
+    kind: "profile_binding",
+    id: profileBinding.collection,
+    disposition: (() => {
+      const previous = before.projectProfileBindings?.find(
+        (binding) => binding.path === profileBinding.path
+      );
+      if (!previous) return "created";
+      return canonicalProfileStateEqual(previous, profileBinding)
+        ? "reused"
+        : "updated";
+    })(),
+    pendingIndexing: false,
+  });
+
+  resources.push({
+    kind: "project_affinity",
+    id: "profile",
+    disposition: "skipped",
+    pendingIndexing: false,
+  });
+  for (const capability of desired.recommendedCapabilities) {
+    resources.push({
+      kind: "capability",
+      id: capability,
+      disposition: "skipped",
+      pendingIndexing: false,
+    });
+  }
+  for (const mapping of diff.staleMappings) {
+    resources.push({
+      kind: "stale_mapping",
+      id: mapping.collection,
+      disposition: "skipped",
+      pendingIndexing: false,
+    });
+  }
+  return resources.sort(
+    (left, right) =>
+      compareCodeUnits(left.kind, right.kind) ||
+      compareCodeUnits(left.id, right.id) ||
+      compareCodeUnits(left.disposition, right.disposition)
+  );
+}

package/src/core/project-profile-apply-validation.ts

@@ -0,0 +1,95 @@
+/**
+ * Runtime validation for project-profile apply receipts crossing command
+ * composition boundaries.
+ *
+ * @module src/core/project-profile-apply-validation
+ */
+
+import { z } from "zod";
+
+import type { ProjectProfileApplyReceipt } from "./project-profile-apply";
+
+const diagnosticSchema = z
+  .object({
+    code: z.literal("STALE_PROFILE_MAPPING"),
+    severity: z.literal("warning"),
+    path: z.string(),
+    message: z.string().min(1),
+    remediation: z.string().min(1),
+  })
+  .strict();
+
+const diffSchema = z
+  .object({
+    status: z.enum(["in_sync", "changes_required"]),
+    changes: z.array(
+      z
+        .object({
+          action: z.enum(["add", "update", "repair", "review"]),
+          field: z.string().min(1),
+          destructive: z.literal(false),
+          summary: z.string().min(1),
+        })
+        .strict()
+    ),
+    staleMappings: z.array(
+      z
+        .object({
+          collection: z.string().min(1),
+          reason: z.enum(["name_changed", "root_changed"]),
+          choices: z.tuple([
+            z.literal("repair"),
+            z.literal("remove_explicitly"),
+          ]),
+        })
+        .strict()
+    ),
+  })
+  .strict();
+
+const resourceSchema = z
+  .object({
+    kind: z.enum([
+      "capability",
+      "collection",
+      "content_type",
+      "contexts",
+      "profile_binding",
+      "project_affinity",
+      "stale_mapping",
+    ]),
+    id: z.string().min(1),
+    disposition: z.enum(["created", "reused", "updated", "skipped"]),
+    pendingIndexing: z.boolean(),
+  })
+  .strict();
+
+export const projectProfileApplyReceiptSchema: z.ZodType<ProjectProfileApplyReceipt> =
+  z
+    .object({
+      schemaVersion: z.literal("1.0"),
+      command: z.literal("apply"),
+      status: z.enum(["applied", "unchanged"]),
+      profile: z
+        .object({
+          fingerprint: z.string().regex(/^[a-f0-9]{64}$/),
+        })
+        .strict(),
+      diff: diffSchema,
+      resources: z.array(resourceSchema),
+      pendingIndexing: z.array(z.string().min(1)),
+      diagnostics: z.array(diagnosticSchema),
+    })
+    .strict()
+    .refine(
+      (receipt) =>
+        new Set(receipt.pendingIndexing).size ===
+        receipt.pendingIndexing.length,
+      { path: ["pendingIndexing"], message: "Entries must be unique." }
+    );
+
+export function isProjectProfileApplyReceipt(
+  value: unknown
+): value is ProjectProfileApplyReceipt {
+  return projectProfileApplyReceiptSchema.safeParse(value).success;
+}