@h-rig/cli-surface-plugin 0.0.6-alpha.146

package/dist/src/commands/repo-git-harness.js

@@ -0,0 +1,282 @@
+// @bun
+// packages/cli-surface-plugin/src/runner.ts
+import { EventBus } from "@rig/runtime/control-plane/runtime/events";
+import { CliError as RuntimeCliError } from "@rig/runtime/control-plane/errors";
+import { evaluate, loadPolicy, resolveAction } from "@rig/runtime/control-plane/runtime/guard";
+import { buildBinary } from "@rig/runtime/control-plane/runtime/isolation";
+
+class CliError extends RuntimeCliError {
+  hint;
+  constructor(message, exitCode = 1, options = {}) {
+    super(message, exitCode);
+    if (options.hint?.trim()) {
+      this.hint = options.hint.trim();
+    }
+  }
+}
+function formatCommand(parts) {
+  return parts.map((part) => /[^a-zA-Z0-9_./:-]/.test(part) ? JSON.stringify(part) : part).join(" ");
+}
+function takeFlag(args, flag) {
+  const rest = [];
+  let value = false;
+  for (const arg of args) {
+    if (arg === flag) {
+      value = true;
+      continue;
+    }
+    rest.push(arg);
+  }
+  return { value, rest };
+}
+function takeOption(args, option) {
+  const rest = [];
+  let value;
+  for (let index = 0;index < args.length; index += 1) {
+    const current = args[index];
+    if (current === option) {
+      const next = args[index + 1];
+      if (!next || next.startsWith("-")) {
+        throw new CliError(`Missing value for ${option}`, 1, { hint: `Provide a value after ${option}, e.g. \`${option} <value>\`.` });
+      }
+      value = next;
+      index += 1;
+      continue;
+    }
+    if (current !== undefined) {
+      rest.push(current);
+    }
+  }
+  return { value, rest };
+}
+function requireNoExtraArgs(args, usage) {
+  if (args.length > 0) {
+    throw new CliError(`Unexpected arguments: ${args.join(" ")}
+Usage: ${usage}`);
+  }
+}
+
+// packages/cli-surface-plugin/src/commands/repo-git-harness.ts
+import { executeHarnessCommand } from "@rig/runtime/control-plane/native/harness-cli";
+import { repoEnsure, resetBaseline } from "@rig/runtime/control-plane/native/repo-ops";
+
+// packages/cli-surface-plugin/src/withMutedConsole.ts
+function isPromise(value) {
+  if (typeof value !== "object" && typeof value !== "function") {
+    return false;
+  }
+  return value !== null && typeof value.then === "function";
+}
+function withMutedConsole(mute, fn) {
+  if (!mute) {
+    return fn();
+  }
+  const originalLog = console.log;
+  const originalWarn = console.warn;
+  const originalInfo = console.info;
+  const restore = () => {
+    console.log = originalLog;
+    console.warn = originalWarn;
+    console.info = originalInfo;
+  };
+  console.log = () => {};
+  console.warn = () => {};
+  console.info = () => {};
+  try {
+    const result = fn();
+    if (isPromise(result)) {
+      return result.finally(restore);
+    }
+    restore();
+    return result;
+  } catch (error) {
+    restore();
+    throw error;
+  } finally {
+    if (console.log === originalLog) {
+      restore();
+    }
+  }
+}
+
+// packages/cli-surface-plugin/src/commands/_policy.ts
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
+
+// packages/cli-surface-plugin/src/commands/_paths.ts
+import { resolve } from "path";
+import { resolveMonorepoRoot } from "@rig/runtime/layout";
+function resolveControlPlaneHostStateRoot(projectRoot) {
+  return resolve(projectRoot, ".rig");
+}
+function resolveControlPlaneHostLogsDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "logs");
+}
+function resolveControlPlaneDefinitionRoot(projectRoot) {
+  return resolve(projectRoot, "rig");
+}
+
+// packages/cli-surface-plugin/src/commands/_policy.ts
+function loadPolicyFile(projectRoot) {
+  const policyPath = resolve2(resolveControlPlaneDefinitionRoot(projectRoot), "policy", "policy.json");
+  if (!existsSync(policyPath)) {
+    return { mode: "observe", rules: [] };
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(policyPath, "utf8"));
+    const mode = parsed.mode === "off" || parsed.mode === "observe" || parsed.mode === "enforce" ? parsed.mode : "observe";
+    const rules = Array.isArray(parsed.rules) ? parsed.rules.filter((value) => Boolean(value && typeof value === "object" && !Array.isArray(value))).map((value, index) => {
+      const rule = {
+        id: typeof value.id === "string" && value.id.trim() ? value.id.trim() : `rule-${index + 1}`
+      };
+      const reason = typeof value.reason === "string" && value.reason.trim() ? value.reason.trim() : null;
+      const match = typeof value.match === "string" && value.match.trim() ? value.match.trim() : null;
+      const command = typeof value.command === "string" && value.command.trim() ? value.command.trim() : null;
+      if (reason)
+        return { ...rule, reason };
+      if (match && command)
+        return { ...rule, match, command };
+      if (match)
+        return { ...rule, match };
+      if (command)
+        return { ...rule, command };
+      return rule;
+    }) : [];
+    return { mode, rules };
+  } catch {
+    return { mode: "observe", rules: [] };
+  }
+}
+function matchingRules(command, rules) {
+  return rules.filter((rule) => {
+    const rawPattern = rule.command ?? rule.match;
+    if (!rawPattern)
+      return false;
+    try {
+      return new RegExp(rawPattern, "i").test(command);
+    } catch {
+      return command.includes(rawPattern);
+    }
+  });
+}
+function resolveEffectivePolicyMode(context) {
+  const envMode = process.env.RIG_BASH_MODE;
+  if (envMode === "off" || envMode === "observe" || envMode === "enforce") {
+    return envMode;
+  }
+  return context.policyMode ?? loadPolicyFile(context.projectRoot).mode;
+}
+function appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action) {
+  if (mode === "off") {
+    return;
+  }
+  const logsDir = resolveControlPlaneHostLogsDir(context.projectRoot);
+  const logFile = resolve2(logsDir, "controlled-bash.jsonl");
+  mkdirSync(logsDir, { recursive: true });
+  const payload = {
+    timestamp: new Date().toISOString(),
+    mode,
+    cwd: process.cwd(),
+    pid: process.pid,
+    ppid: process.ppid,
+    argv: args,
+    command,
+    matchedRuleIds
+  };
+  if (action) {
+    payload.action = action;
+  }
+  appendFileSync(logFile, `${JSON.stringify(payload)}
+`, "utf-8");
+}
+async function enforceNativeCommandPolicy(context, args, options) {
+  const mode = resolveEffectivePolicyMode(context);
+  const command = formatCommand([options.commandPrefix, ...args]);
+  const rules = matchingRules(command, loadPolicyFile(context.projectRoot).rules);
+  const matchedRuleIds = rules.map((rule) => rule.id);
+  const action = rules.length === 0 ? "allow" : mode === "enforce" ? "block" : "warn";
+  await context.emitEvent("policy.decision", {
+    target: "command",
+    command,
+    mode,
+    allowed: action !== "block",
+    matchedRuleIds,
+    reasons: rules.map((rule) => rule.reason).filter(Boolean)
+  });
+  if (options.writeAuditLog) {
+    appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
+  }
+  if (action === "block") {
+    throw new CliError(`Policy blocked command: ${command}`, 126, {
+      hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block."
+    });
+  }
+}
+
+// packages/cli-surface-plugin/src/commands/repo-git-harness.ts
+async function executeRepo(context, args) {
+  const [command = "sync", ...rest] = args;
+  switch (command) {
+    case "sync": {
+      const { value: task, rest: remaining } = takeOption(rest, "--task");
+      requireNoExtraArgs(remaining, "rig repo sync [--task <task-id>]");
+      withMutedConsole(context.outputMode === "json", () => repoEnsure(context.projectRoot, task || undefined));
+      return { ok: true, group: "repo", command, details: { task: task || null } };
+    }
+    case "reset-baseline": {
+      const { value: keepTaskStatusFlag, rest: remaining } = takeFlag(rest, "--keep-task-status");
+      requireNoExtraArgs(remaining, "rig repo reset-baseline [--keep-task-status]");
+      withMutedConsole(context.outputMode === "json", () => resetBaseline(context.projectRoot, keepTaskStatusFlag));
+      return { ok: true, group: "repo", command, details: { keepTaskStatus: keepTaskStatusFlag } };
+    }
+    default:
+      throw new CliError(`Unknown repo command: ${command}`, 1, { hint: "Run `rig repo --help` \u2014 commands are sync|reset-baseline." });
+  }
+}
+async function executeGit(context, args) {
+  if (args.length === 0) {
+    throw new CliError("Usage: rig git <git-flow args...>");
+  }
+  await enforceNativeCommandPolicy(context, args, {
+    commandPrefix: "rig-agent git",
+    writeAuditLog: false
+  });
+  if (context.dryRun) {
+    if (context.outputMode === "text") {
+      console.log(`[dry-run] rig git ${args.join(" ")}`);
+    }
+    return { ok: true, group: "git", command: args[0] ?? "git" };
+  }
+  try {
+    await executeHarnessCommand(context.projectRoot, ["git", ...args]);
+  } catch (error) {
+    throw new CliError(error instanceof Error ? error.message : String(error), 2);
+  }
+  return { ok: true, group: "git", command: args[0] ?? "git" };
+}
+async function executeHarness(context, args) {
+  if (args.length === 0) {
+    throw new CliError("Usage: rig harness <harness args...>");
+  }
+  await enforceNativeCommandPolicy(context, args, {
+    commandPrefix: "rig-agent",
+    writeAuditLog: true
+  });
+  if (context.dryRun) {
+    if (context.outputMode === "text") {
+      console.log(`[dry-run] rig harness ${args.join(" ")}`);
+    }
+    return { ok: true, group: "harness", command: args[0] ?? "harness" };
+  }
+  try {
+    await executeHarnessCommand(context.projectRoot, args);
+  } catch (error) {
+    throw new CliError(error instanceof Error ? error.message : String(error), 2);
+  }
+  return { ok: true, group: "harness", command: args[0] ?? "harness" };
+}
+export {
+  executeRepo,
+  executeHarness,
+  executeGit
+};

package/dist/src/commands/run.d.ts

@@ -0,0 +1,22 @@
+import type { CommandOutcome } from "@rig/runtime";
+import type { RunControl, RunJoinTarget, RunRecord, TaskLike } from "@rig/client";
+import { type RunnerContext } from "../runner";
+export type RunTaskLike = TaskLike & Record<string, unknown>;
+export interface RunExecutorDeps {
+    readonly listRuns?: (projectRoot: string) => Promise<RunRecord[]>;
+    readonly getRun?: (projectRoot: string, runId: string) => Promise<RunRecord | null>;
+    readonly resolveJoin?: (projectRoot: string, runId: string) => Promise<RunJoinTarget | null>;
+    readonly dispatch?: (input: {
+        readonly projectRoot: string;
+        readonly taskId: string;
+        readonly title?: string | null;
+        readonly force?: boolean;
+        readonly model?: string | null;
+        readonly prompt?: string | null;
+    }) => Promise<{
+        readonly runId: string;
+    }>;
+    readonly listTasks?: (projectRoot: string) => Promise<readonly RunTaskLike[]>;
+    readonly deliverRemote?: (projectRoot: string, target: RunRecord, control: RunControl) => Promise<void>;
+}
+export declare function executeRun(context: RunnerContext, args: string[], deps?: RunExecutorDeps): Promise<CommandOutcome>;