@guardsmith/cli 0.5.0 → 0.6.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.ja.md +43 -17
- package/README.md +41 -14
- package/package.json +2 -2
package/README.ja.md
CHANGED
|
@@ -42,23 +42,39 @@ npx @guardsmith/cli init
|
|
|
42
42
|
# 契約見出しの破壊、資格情報の混入、drift など)
|
|
43
43
|
npx @guardsmith/cli lint
|
|
44
44
|
|
|
45
|
-
#
|
|
46
|
-
npx @guardsmith/cli sync
|
|
47
|
-
npx @guardsmith/cli
|
|
45
|
+
# 標準更新で何が変わるかを表示し、取り込む
|
|
46
|
+
npx @guardsmith/cli sync # dry-run(衝突があれば exit 1)
|
|
47
|
+
npx @guardsmith/cli bump v0.7.0 # 適用 + extends タグと vars ファイルの更新
|
|
48
|
+
|
|
49
|
+
# guardsmith.vars.yaml がまだ無い既存 PJ は先に生成する
|
|
50
|
+
npx @guardsmith/cli sync --init-vars
|
|
48
51
|
|
|
49
52
|
# ルールの説明 / バージョン表示
|
|
50
53
|
npx @guardsmith/cli explain claude-md/thin-diff
|
|
51
54
|
npx @guardsmith/cli version
|
|
52
55
|
```
|
|
53
56
|
|
|
54
|
-
| コマンド | 主なフラグ
|
|
55
|
-
| ------------------------- |
|
|
56
|
-
| `guard new <dir>` | —
|
|
57
|
-
| `guard init` | —
|
|
58
|
-
| `guard lint` | `--root`、`--policy`、`--format console\|sarif\|json`、`--out`、`--no-cache`、`--no-gitignore`
|
|
59
|
-
| `guard sync` | `--root`、`--policy`、`--write`、`--no-cache`、`--no-gitignore`
|
|
60
|
-
| `guard
|
|
61
|
-
| `guard
|
|
57
|
+
| コマンド | 主なフラグ |
|
|
58
|
+
| ------------------------- | ---------------------------------------------------------------------------------------------------- |
|
|
59
|
+
| `guard new <dir>` | — |
|
|
60
|
+
| `guard init` | — |
|
|
61
|
+
| `guard lint` | `--root`、`--policy`、`--format console\|sarif\|json`、`--out`、`--no-cache`、`--no-gitignore` |
|
|
62
|
+
| `guard sync` | `--root`、`--policy`、`--write`、`--no-cache`、`--no-gitignore`、`--conflict-markers`、`--init-vars` |
|
|
63
|
+
| `guard bump <tag>` | `--root`、`--policy`、`--repo <owner>/<repo>`、`--no-cache`、`--no-gitignore`、`--conflict-markers` |
|
|
64
|
+
| `guard explain <rule-id>` | — |
|
|
65
|
+
| `guard version` | — |
|
|
66
|
+
|
|
67
|
+
`guard sync` / `guard bump` は標準リリースを **3-way マージ**で取り込みます。PJ が乗っている
|
|
68
|
+
タグのマスターが base、新タグのマスターが theirs、PJ リポジトリが ours なので、PJ 固有の記述は
|
|
69
|
+
そのまま残ります。PJ の編集と標準の変更が重なったファイルは**衝突**として報告され、無変更のまま
|
|
70
|
+
残ります(`--conflict-markers` を付けると `<<<<<<<` / `|||||||` / `=======` / `>>>>>>>` マーカー
|
|
71
|
+
入りで書き出します)。どちらも終了コードは、衝突なしで `0`、1 ファイルでも衝突すれば `1`
|
|
72
|
+
(このとき `guard bump` は policy を含め何も書きません)、実行エラーは `2` です。
|
|
73
|
+
|
|
74
|
+
マージが読む PJ のプレースホルダ置換値は `guardsmith.vars.yaml`(PJ ルート・コミット対象・
|
|
75
|
+
秘密情報は書かない)にあります。`guard new` が雛形を生成し、既存 PJ は
|
|
76
|
+
`guard sync --init-vars` で生成します。`drift3` ルールを持たないポリシーでは、従来どおり
|
|
77
|
+
`guard sync --write` が節単位で復元します。
|
|
62
78
|
|
|
63
79
|
各 check は「**コミットされうるファイル**」を対象にします。既定で `.gitignore`(入れ子も)に
|
|
64
80
|
追従し、`.git/` は常に除外するため、`secret-scan` は `.claude/settings.local.json` の中身を
|
|
@@ -66,6 +82,16 @@ npx @guardsmith/cli version
|
|
|
66
82
|
`ignore`(glob)を除外し、除外対象は結果フィルタではなく走査の時点で枝刈りします。
|
|
67
83
|
`--no-gitignore` で全走査に戻せます。
|
|
68
84
|
|
|
85
|
+
`guard lint` は `CLAUDE.md` の常駐量も測ります。`import-budget` は起点ファイルと `@path`
|
|
86
|
+
インポートで到達する全ファイルを合算し、必ず `info` を1件出します
|
|
87
|
+
(`resident context: N files, X chars (≈Y tokens, rough estimate)` + ファイル別内訳。
|
|
88
|
+
トークン数は `chars / 4` の粗い目安)。走査ルートの外は読みません。パッケージ名は
|
|
89
|
+
`` `@scope/pkg` `` と書いてください — `@` はファイル中のどこでも有効なので、裸で書くと
|
|
90
|
+
インポートとみなされ `unresolved import` として報告されます。
|
|
91
|
+
|
|
92
|
+
ポリシースキーマは厳格です。`with` の未知キーとルール直下の未知キーは、黙って捨てられる
|
|
93
|
+
のではなく該当パス付きの **parse エラー**になります。
|
|
94
|
+
|
|
69
95
|
`guard new` の後は Claude Code でプロジェクトを開いてください — 同梱の `init-project`
|
|
70
96
|
スキルがインタビューを行い、テンプレートを具体化します。初期化が本当に完了すると
|
|
71
97
|
`guard lint` が PASS します。
|
|
@@ -77,12 +103,12 @@ npx @guardsmith/cli version
|
|
|
77
103
|
version: 1
|
|
78
104
|
target: claude-code
|
|
79
105
|
extends:
|
|
80
|
-
- github:novexar/guardsmith//presets/baseline.yaml@v0.
|
|
81
|
-
#
|
|
82
|
-
# - github:novexar/guardsmith//presets/frontend.yaml@v0.
|
|
106
|
+
- github:novexar/guardsmith//presets/baseline.yaml@v0.7.0 # タグ固定は必須
|
|
107
|
+
# フロントエンドを持つプロジェクトはさらに:
|
|
108
|
+
# - github:novexar/guardsmith//presets/frontend.yaml@v0.7.0
|
|
83
109
|
ignore: [] # 全走査から除外する glob(extends 間で連結される)
|
|
84
|
-
rules: [] #
|
|
85
|
-
exemptions: [] #
|
|
110
|
+
rules: [] # 追加・上書き(同じ id の再定義=上書き)
|
|
111
|
+
exemptions: [] # 期限付き例外(reason + approved_by + expires 必須)
|
|
86
112
|
```
|
|
87
113
|
|
|
88
114
|
`extends` は OSS baseline → private 組織 overlay → PJ ごとのポリシー、と合成されます。
|
|
@@ -96,7 +122,7 @@ GitHub の外に出ることはありません。期限切れの例外(exemption
|
|
|
96
122
|
workflow に 1 行追加:
|
|
97
123
|
|
|
98
124
|
```yaml
|
|
99
|
-
- uses: novexar/Guardsmith@v0.
|
|
125
|
+
- uses: novexar/Guardsmith@v0.7.0
|
|
100
126
|
```
|
|
101
127
|
|
|
102
128
|
違反した PR はサマリコメントと SARIF レポート付きで失敗します。閉域網などの環境では
|
package/README.md
CHANGED
|
@@ -42,23 +42,40 @@ npx @guardsmith/cli init
|
|
|
42
42
|
# broken contract headings, leaked credentials, drift, ...)
|
|
43
43
|
npx @guardsmith/cli lint
|
|
44
44
|
|
|
45
|
-
# Show
|
|
46
|
-
npx @guardsmith/cli sync
|
|
47
|
-
npx @guardsmith/cli
|
|
45
|
+
# Show what a standards update would change, then take it in
|
|
46
|
+
npx @guardsmith/cli sync # dry-run (exit 1 = something conflicts)
|
|
47
|
+
npx @guardsmith/cli bump v0.7.0 # apply + move the extends tags and the vars file
|
|
48
|
+
|
|
49
|
+
# Existing project with no guardsmith.vars.yaml yet — generate it first
|
|
50
|
+
npx @guardsmith/cli sync --init-vars
|
|
48
51
|
|
|
49
52
|
# Explain a rule / show versions
|
|
50
53
|
npx @guardsmith/cli explain claude-md/thin-diff
|
|
51
54
|
npx @guardsmith/cli version
|
|
52
55
|
```
|
|
53
56
|
|
|
54
|
-
| Command | Key flags
|
|
55
|
-
| ------------------------- |
|
|
56
|
-
| `guard new <dir>` | —
|
|
57
|
-
| `guard init` | —
|
|
58
|
-
| `guard lint` | `--root`, `--policy`, `--format console\|sarif\|json`, `--out`, `--no-cache`, `--no-gitignore`
|
|
59
|
-
| `guard sync` | `--root`, `--policy`, `--write`, `--no-cache`, `--no-gitignore`
|
|
60
|
-
| `guard
|
|
61
|
-
| `guard
|
|
57
|
+
| Command | Key flags |
|
|
58
|
+
| ------------------------- | ---------------------------------------------------------------------------------------------------- |
|
|
59
|
+
| `guard new <dir>` | — |
|
|
60
|
+
| `guard init` | — |
|
|
61
|
+
| `guard lint` | `--root`, `--policy`, `--format console\|sarif\|json`, `--out`, `--no-cache`, `--no-gitignore` |
|
|
62
|
+
| `guard sync` | `--root`, `--policy`, `--write`, `--no-cache`, `--no-gitignore`, `--conflict-markers`, `--init-vars` |
|
|
63
|
+
| `guard bump <tag>` | `--root`, `--policy`, `--repo <owner>/<repo>`, `--no-cache`, `--no-gitignore`, `--conflict-markers` |
|
|
64
|
+
| `guard explain <rule-id>` | — |
|
|
65
|
+
| `guard version` | — |
|
|
66
|
+
|
|
67
|
+
`guard sync` and `guard bump` take a standards release in as a **three-way merge**: the
|
|
68
|
+
master at the tag the project sits on is the base, the master at the new tag is theirs, and
|
|
69
|
+
your repository is ours, so project-specific wording survives. A file where your edits and
|
|
70
|
+
the standards change overlap is reported as a **conflict** and left untouched
|
|
71
|
+
(`--conflict-markers` writes it out with `<<<<<<<` / `|||||||` / `=======` / `>>>>>>>`
|
|
72
|
+
markers instead). Both exit `0` with no conflicts, `1` when anything conflicts — `guard bump`
|
|
73
|
+
then writes nothing at all, not even the policy — and `2` on a run-time error.
|
|
74
|
+
|
|
75
|
+
The merge reads the project's placeholder substitutions from `guardsmith.vars.yaml`
|
|
76
|
+
(project root, committed, no secrets). `guard new` writes the skeleton; an existing project
|
|
77
|
+
generates one with `guard sync --init-vars`. A policy with no `drift3` rule keeps the old
|
|
78
|
+
section-level `guard sync --write` behaviour.
|
|
62
79
|
|
|
63
80
|
Checks operate on **files that could be committed**: `.gitignore` (nested files included)
|
|
64
81
|
is honoured by default and `.git/` is always excluded, so `secret-scan` never reports a
|
|
@@ -67,6 +84,16 @@ as missing. The policy's `ignore` globs are excluded on top of that, and exclude
|
|
|
67
84
|
pruned during traversal rather than filtered afterwards. `--no-gitignore` restores the full
|
|
68
85
|
scan when you want to audit ignored files.
|
|
69
86
|
|
|
87
|
+
`guard lint` also measures how much context a `CLAUDE.md` keeps resident: `import-budget`
|
|
88
|
+
adds up the entry file plus every file reached through its `@path` imports and always
|
|
89
|
+
reports one `info` (`resident context: N files, X chars (≈Y tokens, rough estimate)` plus a
|
|
90
|
+
per-file breakdown; the token figure is a rough `chars / 4` estimate). Nothing outside the
|
|
91
|
+
scan root is read. Write package names as `` `@scope/pkg` `` — `@` is an import anywhere in
|
|
92
|
+
the file, so a bare `@scope/pkg` is read as one and reported as `unresolved import`.
|
|
93
|
+
|
|
94
|
+
The policy schema is strict: unknown keys under `with` or on a rule are **parse errors**
|
|
95
|
+
naming the offending path, not silently dropped fields.
|
|
96
|
+
|
|
70
97
|
After `guard new`, open the project with Claude Code — the bundled `init-project` skill
|
|
71
98
|
interviews you and concretizes the templates. `guard lint` passes once initialization
|
|
72
99
|
is genuinely complete.
|
|
@@ -78,9 +105,9 @@ is genuinely complete.
|
|
|
78
105
|
version: 1
|
|
79
106
|
target: claude-code
|
|
80
107
|
extends:
|
|
81
|
-
- github:novexar/guardsmith//presets/baseline.yaml@v0.
|
|
108
|
+
- github:novexar/guardsmith//presets/baseline.yaml@v0.7.0 # tag pinning is mandatory
|
|
82
109
|
# Projects with a frontend also add:
|
|
83
|
-
# - github:novexar/guardsmith//presets/frontend.yaml@v0.
|
|
110
|
+
# - github:novexar/guardsmith//presets/frontend.yaml@v0.7.0
|
|
84
111
|
ignore: [] # globs excluded from every scan (concatenated across extends layers)
|
|
85
112
|
rules: [] # add or override (redefining an id overrides it)
|
|
86
113
|
exemptions: [] # time-boxed waivers: reason + approved_by + expires required
|
|
@@ -97,7 +124,7 @@ Add one line to your workflow using the
|
|
|
97
124
|
[GuardSmith Lint Action](https://github.com/marketplace/actions/guardsmith-lint):
|
|
98
125
|
|
|
99
126
|
```yaml
|
|
100
|
-
- uses: novexar/Guardsmith@v0.
|
|
127
|
+
- uses: novexar/Guardsmith@v0.7.0
|
|
101
128
|
```
|
|
102
129
|
|
|
103
130
|
Violating PRs fail with a summary comment and a SARIF report. Air-gapped environments can
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@guardsmith/cli",
|
|
3
|
-
"version": "0.
|
|
3
|
+
"version": "0.6.0",
|
|
4
4
|
"description": "GuardSmith CLI — the guard binary (init / lint / sync / new / explain)",
|
|
5
5
|
"license": "Apache-2.0",
|
|
6
6
|
"repository": {
|
|
@@ -19,6 +19,6 @@
|
|
|
19
19
|
"bin"
|
|
20
20
|
],
|
|
21
21
|
"dependencies": {
|
|
22
|
-
"@guardsmith/core": "^0.
|
|
22
|
+
"@guardsmith/core": "^0.6.0"
|
|
23
23
|
}
|
|
24
24
|
}
|