@growthagent/ci 0.4.0 → 0.6.0

package/dist/cli.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
 
 // src/cli.ts
-import { execFileSync, spawnSync } from "node:child_process";
-import { cpSync, existsSync as existsSync2, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
-import path5 from "node:path";
+import { execFileSync, spawnSync as spawnSync2 } from "node:child_process";
+import { cpSync, existsSync as existsSync3, mkdirSync, readFileSync, writeFileSync as writeFileSync2 } from "node:fs";
+import path6 from "node:path";
 import { fileURLToPath } from "node:url";
 
 // ../github/src/app.ts
@@ -53,6 +53,34 @@ import path3 from "node:path";
 import { promisify } from "node:util";
 var run = promisify(execFile);
 
+// src/lockfiles.ts
+import { spawnSync } from "node:child_process";
+import { existsSync as existsSync2, rmSync as rmSync2 } from "node:fs";
+import path4 from "node:path";
+var LOCKFILES = [
+  "pnpm-lock.yaml",
+  "package-lock.json",
+  "yarn.lock",
+  "bun.lockb",
+  "bun.lock",
+  "npm-shrinkwrap.json"
+];
+function discardLockfileChanges(cwd = process.cwd()) {
+  const git = (args) => spawnSync("git", args, { cwd, encoding: "utf8", stdio: ["ignore", "pipe", "pipe"] });
+  const touched = [];
+  for (const lockfile of LOCKFILES) {
+    if (!existsSync2(path4.join(cwd, lockfile))) continue;
+    const tracked = git(["ls-files", "--error-unmatch", "--", lockfile]).status === 0;
+    if (tracked) {
+      git(["restore", "--staged", "--worktree", "--", lockfile]);
+    } else {
+      rmSync2(path4.join(cwd, lockfile), { force: true });
+    }
+    touched.push(lockfile);
+  }
+  return touched;
+}
+
 // src/patch.ts
 var MAX_CAPTURED_LINES = 400;
 var ALLOWED_DEPENDENCIES = ["posthog-js", "posthog-node"];
@@ -100,6 +128,7 @@ var FORBIDDEN_PATTERNS = [
   { pattern: /^\.github\//i, why: "workflow and CI configuration" },
   { pattern: /^\.git(\/|$)/i, why: "git internals" },
   { pattern: /(^|\/)\.env(\.|$)/i, why: "environment files" },
+  // except the examples below
   { pattern: /(^|\/)\.npmrc$|(^|\/)\.yarnrc(\.yml)?$|(^|\/)\.pypirc$/i, why: "registry credentials" },
   { pattern: /(^|\/)(package-lock\.json|pnpm-lock\.yaml|yarn\.lock|bun\.lockb?|Cargo\.lock|poetry\.lock|Gemfile\.lock|composer\.lock)$/i, why: "dependency lockfiles" },
   { pattern: /(^|\/)(Dockerfile|docker-compose\.ya?ml|Procfile)$/i, why: "build and deployment configuration" },
@@ -111,6 +140,44 @@ var FORBIDDEN_PATTERNS = [
   { pattern: /\.(pem|p12|pfx|key|keystore|jks)$/i, why: "key material" },
   { pattern: /(^|\/)node_modules\//i, why: "installed dependencies" }
 ];
+var EXAMPLE_ENV = /(^|\/)\.env(\.[\w-]+)*\.(example|sample|template)$/i;
+var CREDENTIAL_PREFIXES = [
+  "sk-",
+  "sk_live",
+  "sk_test",
+  "pk_live",
+  "rk_live",
+  "whsec_",
+  "phc_",
+  "ghp_",
+  "gho_",
+  "ghs_",
+  "github_pat_",
+  "AKIA",
+  "AIza",
+  "xox",
+  "eyJ",
+  "-----BEGIN"
+];
+function secretishEnvLine(line) {
+  const text = line.trim();
+  if (!text || text.startsWith("#")) return null;
+  const eq = text.indexOf("=");
+  if (eq < 0) return null;
+  const key = text.slice(0, eq).replace(/^export\s+/, "").trim();
+  const value = text.slice(eq + 1).trim().replace(/^["']|["']$/g, "").trim();
+  if (!value) return null;
+  if (/^https?:\/\//i.test(value)) return null;
+  for (const prefix of CREDENTIAL_PREFIXES) {
+    if (value.startsWith(prefix)) {
+      return `${key} carries what looks like a real credential`;
+    }
+  }
+  if (value.length >= 20 && /^[A-Za-z0-9_\-.]+$/.test(value)) {
+    return `${key} carries a ${value.length}-character opaque value, not a placeholder`;
+  }
+  return null;
+}
 var SYMLINK_MODE = "120000";
 var EXECUTABLE_MODE = "100755";
 function parsePatch(patch) {
@@ -183,6 +250,7 @@ function forbiddenReason(filePath) {
     return "an absolute path";
   }
   if (normalised.split("/").includes("..")) return "a parent-directory escape";
+  if (EXAMPLE_ENV.test(normalised)) return null;
   for (const { pattern, why } of FORBIDDEN_PATTERNS) {
     if (pattern.test(normalised)) return why;
   }
@@ -210,6 +278,20 @@ function validatePatch(patch, limits = DEFAULT_PATCH_LIMITS) {
         return { ok: false, reason: `the patch changes ${candidate}, which is ${why} \u2014 never modifiable by the agent` };
       }
     }
+    if (EXAMPLE_ENV.test(file.path)) {
+      if (file.addedLines > file.added.length) {
+        return {
+          ok: false,
+          reason: `the patch adds ${file.addedLines} lines to ${file.path}, more than can be checked for credentials`
+        };
+      }
+      for (const line of file.added) {
+        const why = secretishEnvLine(line);
+        if (why) {
+          return { ok: false, reason: `the patch writes a secret into ${file.path}: ${why}` };
+        }
+      }
+    }
     if (/(^|\/)package\.json$/i.test(file.path)) {
       const why = manifestChangeReason(file);
       if (why) {
@@ -238,11 +320,11 @@ function validatePatch(patch, limits = DEFAULT_PATCH_LIMITS) {
 // src/provider-config.ts
 import { mkdtempSync as mkdtempSync2, writeFileSync } from "node:fs";
 import { tmpdir as tmpdir3 } from "node:os";
-import path4 from "node:path";
+import path5 from "node:path";
 var RUN_TOKEN_ENV = "GX_RUN_TOKEN";
 function writeGoogleProviderConfig(model) {
   const gateway = (process.env.GX_GATEWAY_URL ?? "").replace(/\/$/, "");
-  const dir = mkdtempSync2(path4.join(tmpdir3(), "growth-agent-pi-"));
+  const dir = mkdtempSync2(path5.join(tmpdir3(), "growth-agent-pi-"));
   const config = {
     providers: {
       "growthagent-google": {
@@ -253,7 +335,7 @@ function writeGoogleProviderConfig(model) {
       }
     }
   };
-  writeFileSync(path4.join(dir, "models.json"), JSON.stringify(config, null, 2));
+  writeFileSync(path5.join(dir, "models.json"), JSON.stringify(config, null, 2));
   return dir;
 }
 
@@ -362,14 +444,14 @@ function buildPrompt(fields, briefing) {
 }
 
 // src/cli.ts
-var HERE = path5.dirname(fileURLToPath(import.meta.url));
+var HERE = path6.dirname(fileURLToPath(import.meta.url));
 var PATCH_FILE = "growth-agent.patch";
 function assetsDir() {
-  const packaged = path5.join(HERE, "assets", "skills");
-  return existsSync2(packaged) ? packaged : path5.join(HERE, "..", "assets", "skills");
+  const packaged = path6.join(HERE, "assets", "skills");
+  return existsSync3(packaged) ? packaged : path6.join(HERE, "..", "assets", "skills");
 }
 function sh(cmd, args, opts = {}) {
-  const r = spawnSync(cmd, args, { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] });
+  const r = spawnSync2(cmd, args, { encoding: "utf8", stdio: ["inherit", "pipe", "inherit"] });
   if (r.status !== 0 && !opts.allowFail) {
     throw new Error(`${cmd} ${args.join(" ")} exited ${r.status}`);
   }
@@ -493,7 +575,7 @@ async function implement() {
   console.log(
     meta.kind === "instrumentation" ? `\u25B8 instrumentation request #${issue.number}` : `\u25B8 change request #${issue.number} \u2014 flag ${meta.flagKey} on ${meta.surface}`
   );
-  const skillsDir = path5.resolve(process.cwd(), ".pi", "skills");
+  const skillsDir = path6.resolve(process.cwd(), ".pi", "skills");
   mkdirSync(skillsDir, { recursive: true });
   cpSync(assetsDir(), skillsDir, { recursive: true });
   const prompt = buildPrompt(meta, extractBriefing(issue.body));
@@ -509,7 +591,7 @@ async function implement() {
   console.log(`\u25B8 running pi (${piProvider}/${model})`);
   let piStatus;
   try {
-    const pi = spawnSync(
+    const pi = spawnSync2(
       "pi",
       ["-p", prompt, "--provider", piProvider, "--model", model, "--thinking", "high"],
       {
@@ -537,8 +619,13 @@ async function implement() {
     console.error("pi exited non-zero \u2014 no patch produced");
     return 1;
   }
-  sh("git", ["checkout", "--", ".pi"], { allowFail: true });
-  sh("git", ["clean", "-fd", ".pi"], { allowFail: true });
+  const piTracked = sh("git", ["ls-files", "--", ".pi"], { allowFail: true });
+  if (piTracked) sh("git", ["checkout", "--", ".pi"], { allowFail: true });
+  sh("git", ["clean", "-fdq", ".pi"], { allowFail: true });
+  const discarded = discardLockfileChanges();
+  if (discarded.length) {
+    console.log(`\u25B8 discarded the model's ${discarded.join(", ")}; the trusted job derives it`);
+  }
   sh("git", ["add", "-A"]);
   const patch = sh("git", ["diff", "--staged"]);
   if (!patch.trim()) {
@@ -564,9 +651,9 @@ function regenerateLockfile() {
     { lockfile: "yarn.lock", bin: "yarn", args: ["install", "--mode=update-lockfile"] }
   ];
   for (const m of managers) {
-    if (!existsSync2(m.lockfile)) continue;
+    if (!existsSync3(m.lockfile)) continue;
     console.log(`\u25B8 regenerating ${m.lockfile} from the manifest`);
-    const result = spawnSync(m.bin, m.args, { stdio: ["ignore", "inherit", "inherit"] });
+    const result = spawnSync2(m.bin, m.args, { stdio: ["ignore", "inherit", "inherit"] });
     if (result.status !== 0) {
       console.error(
         `Could not regenerate ${m.lockfile} (${m.bin} exited ${result.status}). The dependency change is in package.json but the lockfile is stale \u2014 run the install locally on this branch before merging.`
@@ -586,7 +673,7 @@ function apply() {
   const meta = validatedMeta(issue);
   const title = safeTitle(issue);
   const branch = branchFor(issue, meta.slug);
-  if (!existsSync2(PATCH_FILE)) {
+  if (!existsSync3(PATCH_FILE)) {
     console.error(`No ${PATCH_FILE} was produced by the implementer job.`);
     return 1;
   }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@growthagent/ci",
-  "version": "0.4.0",
+  "version": "0.6.0",
   "private": false,
   "type": "module",
   "bin": {