@h-rig/cli 0.0.6-alpha.90 → 0.0.6-alpha.92

package/dist/src/commands/repo-git-harness.d.ts

@@ -1,5 +1,5 @@
 import { type RunnerContext } from "../runner";
-import type { CommandOutcome } from "@rig/runtime/control-plane/runtime/types";
+import type { CommandOutcome } from "@rig/runtime";
 export declare function executeRepo(context: RunnerContext, args: string[]): Promise<CommandOutcome>;
 export declare function executeGit(context: RunnerContext, args: string[]): Promise<CommandOutcome>;
 export declare function executeHarness(context: RunnerContext, args: string[]): Promise<CommandOutcome>;

package/dist/src/commands/repo-git-harness.js

@@ -100,23 +100,67 @@ function withMutedConsole(mute, fn) {
 }
 
 // packages/cli/src/commands/_policy.ts
-import { appendFileSync, mkdirSync } from "fs";
+import { appendFileSync, existsSync, mkdirSync, readFileSync } from "fs";
+import { resolve as resolve2 } from "path";
+
+// packages/cli/src/commands/_paths.ts
 import { resolve } from "path";
-import { evaluate as evaluate2, loadPolicy as loadPolicy2, resolveAction as resolveAction2 } from "@rig/runtime/control-plane/runtime/guard";
-import { resolveHarnessPaths } from "@rig/runtime/control-plane/native/utils";
+import { resolveMonorepoRoot } from "@rig/runtime/layout";
+function resolveControlPlaneHostStateRoot(projectRoot) {
+  return resolve(projectRoot, ".rig");
+}
+function resolveControlPlaneHostLogsDir(projectRoot) {
+  return resolve(resolveControlPlaneHostStateRoot(projectRoot), "logs");
+}
+function resolveControlPlaneDefinitionRoot(projectRoot) {
+  return resolve(projectRoot, "rig");
+}
+
+// packages/cli/src/commands/_policy.ts
+function loadPolicyFile(projectRoot) {
+  const policyPath = resolve2(resolveControlPlaneDefinitionRoot(projectRoot), "policy", "policy.json");
+  if (!existsSync(policyPath)) {
+    return { mode: "observe", rules: [] };
+  }
+  try {
+    const parsed = JSON.parse(readFileSync(policyPath, "utf8"));
+    const mode = parsed.mode === "off" || parsed.mode === "observe" || parsed.mode === "enforce" ? parsed.mode : "observe";
+    const rules = Array.isArray(parsed.rules) ? parsed.rules.filter((value) => Boolean(value && typeof value === "object" && !Array.isArray(value))).map((value, index) => ({
+      id: typeof value.id === "string" && value.id.trim() ? value.id.trim() : `rule-${index + 1}`,
+      reason: typeof value.reason === "string" && value.reason.trim() ? value.reason.trim() : undefined,
+      match: typeof value.match === "string" && value.match.trim() ? value.match.trim() : undefined,
+      command: typeof value.command === "string" && value.command.trim() ? value.command.trim() : undefined
+    })) : [];
+    return { mode, rules };
+  } catch {
+    return { mode: "observe", rules: [] };
+  }
+}
+function matchingRules(command, rules) {
+  return rules.filter((rule) => {
+    const rawPattern = rule.command ?? rule.match;
+    if (!rawPattern)
+      return false;
+    try {
+      return new RegExp(rawPattern, "i").test(command);
+    } catch {
+      return command.includes(rawPattern);
+    }
+  });
+}
 function resolveEffectivePolicyMode(context) {
   const envMode = process.env.RIG_BASH_MODE;
   if (envMode === "off" || envMode === "observe" || envMode === "enforce") {
     return envMode;
   }
-  return context.policyMode || loadPolicy2(context.projectRoot).mode;
+  return context.policyMode ?? loadPolicyFile(context.projectRoot).mode;
 }
 function appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action) {
   if (mode === "off") {
     return;
   }
-  const logsDir = resolveHarnessPaths(context.projectRoot).logsDir;
-  const logFile = resolve(logsDir, "controlled-bash.jsonl");
+  const logsDir = resolveControlPlaneHostLogsDir(context.projectRoot);
+  const logFile = resolve2(logsDir, "controlled-bash.jsonl");
   mkdirSync(logsDir, { recursive: true });
   const payload = {
     timestamp: new Date().toISOString(),
@@ -137,25 +181,24 @@ function appendControlledBashAudit(context, mode, command, args, matchedRuleIds,
 async function enforceNativeCommandPolicy(context, args, options) {
   const mode = resolveEffectivePolicyMode(context);
   const command = formatCommand([options.commandPrefix, ...args]);
-  const decision = evaluate2({
-    projectRoot: context.projectRoot,
-    evaluation: { type: "command", command }
-  });
-  const action = resolveAction2(mode, decision.matchedRules);
-  const matchedRuleIds = decision.matchedRules.map((rule) => rule.id);
+  const rules = matchingRules(command, loadPolicyFile(context.projectRoot).rules);
+  const matchedRuleIds = rules.map((rule) => rule.id);
+  const action = rules.length === 0 ? "allow" : mode === "enforce" ? "block" : "warn";
   await context.emitEvent("policy.decision", {
     target: "command",
     command,
     mode,
     allowed: action !== "block",
     matchedRuleIds,
-    reasons: decision.matchedRules.map((rule) => rule.reason)
+    reasons: rules.map((rule) => rule.reason).filter(Boolean)
   });
   if (options.writeAuditLog) {
     appendControlledBashAudit(context, mode, command, args, matchedRuleIds, action === "block" ? "blocked" : action === "warn" ? "warn" : undefined);
   }
   if (action === "block") {
-    throw new CliError(`Policy blocked command: ${command}`, 126, { hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block." });
+    throw new CliError(`Policy blocked command: ${command}`, 126, {
+      hint: "Review rig/policy/policy.json, or re-run with `--policy-mode observe` to log instead of block."
+    });
   }
 }
 

package/dist/src/commands/run.d.ts

@@ -1,3 +1,21 @@
 import { type RunnerContext } from "../runner";
-import type { CommandOutcome } from "@rig/runtime/control-plane/runtime/types";
-export declare function executeRun(context: RunnerContext, args: string[]): Promise<CommandOutcome>;
+import type { CommandOutcome } from "@rig/runtime";
+import { type RigExtensionTask, type RunControl } from "./_run-bridge";
+import { type RunJoinTarget, type RunProjectionRecord } from "./_run-projection";
+export type RunTaskLike = RigExtensionTask & Record<string, unknown>;
+export interface RunExecutorDeps {
+    readonly listRuns?: (projectRoot: string) => Promise<RunProjectionRecord[]>;
+    readonly getRun?: (projectRoot: string, runId: string) => Promise<RunProjectionRecord | null>;
+    readonly resolveJoin?: (projectRoot: string, runId: string) => Promise<RunJoinTarget | null>;
+    readonly dispatch?: (input: {
+        readonly projectRoot: string;
+        readonly taskId: string;
+        readonly title?: string | null;
+    }) => Promise<{
+        readonly runId: string;
+    }>;
+    readonly listTasks?: (projectRoot: string) => Promise<readonly RunTaskLike[]>;
+    readonly appendLocal?: (record: RunProjectionRecord, text: string) => Promise<void>;
+    readonly deliverRemote?: (projectRoot: string, runId: string, control: RunControl) => Promise<void>;
+}
+export declare function executeRun(context: RunnerContext, args: string[], deps?: RunExecutorDeps): Promise<CommandOutcome>;