@homeflare/config 0.9.0 → 0.11.0

package/dist/hooks.js

@@ -16,10 +16,23 @@ async function run(cmd, isolated = false) {
   return await proc.exited;
 }
 async function capture(cmd) {
+  return (await probe(cmd)).stdout;
+}
+async function probe(cmd) {
   const proc = Bun.spawn([...cmd], { stdout: "pipe", stderr: "ignore" });
-  const text = await new Response(proc.stdout).text();
-  await proc.exited;
-  return text;
+  const stdout = await new Response(proc.stdout).text();
+  return { code: await proc.exited, stdout };
+}
+async function runLane(command, root) {
+  const env = withoutGitEnv();
+  env["PATH"] = `${root}/node_modules/.bin:${env["PATH"] ?? ""}`;
+  const proc = Bun.spawn(["sh", "-c", command], {
+    cwd: root,
+    env,
+    stdout: "inherit",
+    stderr: "inherit"
+  });
+  return await proc.exited;
 }
 function tool(root, name) {
   const local = `${root}/node_modules/.bin/${name}`;
@@ -44,12 +57,243 @@ function fail(hook, what, fix) {
   process.exit(1);
 }
 
+// src/hooks/activate.ts
+function inCi(env) {
+  const ci = env["CI"];
+  return ci !== undefined && ci !== "" && ci !== "0" && ci.toLowerCase() !== "false";
+}
+async function activateHooks(root, env = process.env) {
+  if (inCi(env))
+    return { active: false, message: "CI is set \u2014 hooks stay off; CI runs the gate" };
+  const where = await probe(["git", "-C", root, "rev-parse", "--show-prefix"]);
+  if (where.code !== 0)
+    return { active: false, message: "not a git work tree \u2014 nothing to do" };
+  const tracked = await Promise.all(["pre-commit", "pre-push"].map((name) => Bun.file(`${root}/.husky/${name}`).exists()));
+  if (!tracked.some(Boolean)) {
+    return { active: false, message: "no .husky/pre-commit or .husky/pre-push to point git at" };
+  }
+  const want = `${where.stdout.trim()}.husky`;
+  const current = (await probe(["git", "-C", root, "config", "--get", "core.hooksPath"])).stdout.trim();
+  if (current === want)
+    return { active: true, message: `core.hooksPath is already ${want}` };
+  const set = await probe(["git", "-C", root, "config", "core.hooksPath", want]);
+  if (set.code !== 0)
+    return { active: false, message: "git config core.hooksPath failed" };
+  const was = current === "" ? "unset" : current;
+  return {
+    active: true,
+    message: `core.hooksPath ${was} \u2192 ${want}, for every worktree of this clone`
+  };
+}
+
+// src/hooks/gates.ts
+import { existsSync } from "fs";
+
+// src/hooks/push-plan.ts
+var LEFT_TO_CI = /^(build|smoke)(:|$)/;
+var MAX_DEPTH = 8;
+function andChain(script) {
+  const parts = [];
+  let quote;
+  let current = "";
+  for (let i = 0;i < script.length; i++) {
+    const char = script[i] ?? "";
+    if (quote !== undefined) {
+      if (char === quote)
+        quote = undefined;
+      current += char;
+      continue;
+    }
+    if (char === '"' || char === "'") {
+      quote = char;
+      current += char;
+      continue;
+    }
+    if (char === "&" && script[i + 1] === "&") {
+      parts.push(current.trim());
+      current = "";
+      i += 1;
+      continue;
+    }
+    if ("|;&<>`".includes(char) || char === "$" && script[i + 1] === "(")
+      return;
+    current += char;
+  }
+  if (quote !== undefined)
+    return;
+  parts.push(current.trim());
+  return parts.some((part) => part === "") ? undefined : parts;
+}
+function scriptRef(segment, scripts) {
+  const words = segment.split(/\s+/);
+  if (words.length === 2 && words[0] === "npm" && words[1] === "test")
+    return "test";
+  const [runner, verb, name] = words;
+  if (words.length !== 3 || verb !== "run" || name === undefined)
+    return;
+  if (runner !== "bun" && runner !== "npm")
+    return;
+  return Object.hasOwn(scripts, name) ? name : undefined;
+}
+var isBunTest = (segment) => /^bun\s+test(\s|$)/.test(segment);
+function testLane(segment, base) {
+  return base === undefined ? { kind: "test", label: segment, command: segment, scoped: false } : { kind: "test", label: segment, command: `${segment} --changed=${base}`, scoped: true };
+}
+function expand(script, scripts, base, depth) {
+  const segments = andChain(script);
+  if (segments === undefined || depth > MAX_DEPTH)
+    return;
+  const lanes = [];
+  for (const segment of segments) {
+    if (isBunTest(segment)) {
+      lanes.push(testLane(segment, base));
+      continue;
+    }
+    const name = scriptRef(segment, scripts);
+    if (name === undefined) {
+      lanes.push({ kind: "run", label: segment, command: segment });
+      continue;
+    }
+    if (LEFT_TO_CI.test(name)) {
+      lanes.push({ kind: "skip", label: segment, why: "CI runs it on every pull request" });
+      continue;
+    }
+    const inner = expand(scripts[name] ?? "", scripts, base, depth + 1);
+    if (inner !== undefined && inner.some((lane) => lane.kind !== "run")) {
+      lanes.push(...inner);
+    } else if (/^test(:|$)/.test(name)) {
+      lanes.push({ kind: "test", label: segment, command: segment, scoped: false });
+    } else {
+      lanes.push({ kind: "run", label: segment, command: segment });
+    }
+  }
+  return lanes;
+}
+function planLanes(scripts, base) {
+  const check = scripts["check"];
+  if (check === undefined)
+    return [];
+  const whole = {
+    kind: "test",
+    label: "bun run check",
+    command: "bun run check",
+    scoped: false
+  };
+  return expand(check, scripts, base, 0) ?? [whole];
+}
+
+// src/hooks/push-range.ts
+var ZERO = /^0+$/;
+function parsePushRefs(stdin) {
+  const refs = [];
+  for (const line2 of stdin.split(`
+`)) {
+    const [localRef, localSha, remoteRef, remoteSha] = line2.trim().split(/\s+/);
+    if (localRef && localSha && remoteRef && remoteSha) {
+      refs.push({ localRef, localSha, remoteRef, remoteSha });
+    }
+  }
+  return refs;
+}
+var short = (sha) => sha.slice(0, 9);
+async function ok2(root, args) {
+  return (await probe(["git", "-C", root, ...args])).code === 0;
+}
+async function out(root, args) {
+  const result = await probe(["git", "-C", root, ...args]);
+  return result.code === 0 ? result.stdout.trim() : undefined;
+}
+async function defaultBranch(root, remote) {
+  const head = await out(root, ["symbolic-ref", "--quiet", `refs/remotes/${remote}/HEAD`]);
+  if (head !== undefined && head !== "")
+    return head;
+  for (const name of ["main", "master"]) {
+    const ref = `refs/remotes/${remote}/${name}`;
+    if (await ok2(root, ["rev-parse", "--verify", "--quiet", ref]))
+      return ref;
+  }
+  return;
+}
+async function baseFor(root, remote, ref) {
+  const { localSha, remoteSha } = ref;
+  if (!ZERO.test(remoteSha) && await ok2(root, ["cat-file", "-e", `${remoteSha}^{commit}`]) && await ok2(root, ["merge-base", "--is-ancestor", remoteSha, localSha])) {
+    return { base: remoteSha, why: `since ${short(remoteSha)}, what ${remote} has now` };
+  }
+  const branch = await defaultBranch(root, remote);
+  if (branch === undefined)
+    return { why: `no ${remote}/main or ${remote}/master to measure from` };
+  const mergeBase = await out(root, ["merge-base", localSha, branch]);
+  if (mergeBase === undefined || mergeBase === "") {
+    return { why: `no merge base with ${branch} (a shallow clone, or unrelated history)` };
+  }
+  const name = branch.replace(/^refs\/remotes\//, "");
+  return { base: mergeBase, why: `since ${short(mergeBase)}, where this branch left ${name}` };
+}
+async function pushScope(root, remote, refs) {
+  const pushed = refs.filter((ref2) => !ZERO.test(ref2.localSha));
+  if (refs.length > 0 && pushed.length === 0) {
+    return { kind: "empty", why: "this push only deletes refs" };
+  }
+  const head = await out(root, ["rev-parse", "HEAD"]);
+  const atHead = pushed.find((ref2) => ref2.localSha === head);
+  const others = pushed.filter((ref2) => ref2 !== atHead).map((ref2) => ref2.localRef);
+  if (pushed.length > 0 && atHead === undefined) {
+    return {
+      kind: "elsewhere",
+      why: `pushing ${others.join(", ")}, but the checkout is at ${short(head ?? "?")}`
+    };
+  }
+  const ref = atHead ?? {
+    localRef: "HEAD",
+    localSha: head ?? "HEAD",
+    remoteRef: "",
+    remoteSha: "0".repeat(40)
+  };
+  const found = await baseFor(root, remote, ref);
+  const also = others.length > 0 ? `; ${others.join(", ")} not checked here` : "";
+  if (!("base" in found))
+    return { kind: "unscoped", why: `${found.why}${also}` };
+  const diff = await probe([
+    "git",
+    "-C",
+    root,
+    "diff",
+    "--name-only",
+    "-z",
+    found.base,
+    ref.localSha
+  ]);
+  if (diff.code !== 0)
+    return { kind: "unscoped", why: `git diff ${short(found.base)} failed` };
+  const changed = diff.stdout.split("\x00").filter((path) => path !== "");
+  if (changed.length === 0)
+    return { kind: "empty", why: `no file differs ${found.why}${also}` };
+  return { kind: "scoped", base: found.base, changed, why: `${found.why}${also}` };
+}
+function changesEverything(path) {
+  const name = path.split("/").pop() ?? "";
+  return /^(package\.json|bun\.lockb?|bunfig\.toml|tsconfig.*\.json)$/.test(name);
+}
+
+// src/hooks/secrets.ts
+var INSTALL = "brew install gitleaks \u2014 Linux: https://github.com/gitleaks/gitleaks/releases";
+async function scanStagedSecrets() {
+  if (Bun.which("gitleaks") === null) {
+    fail("pre-commit", "gitleaks is not installed, so the staged changes were NOT scanned", INSTALL);
+  }
+  const code = await run(["gitleaks", "git", "--staged", "--redact", "--no-banner", "."]);
+  if (code !== 0) {
+    fail("pre-commit", "gitleaks found a secret in the staged changes", "remove it, then ROTATE it \u2014 assume anything committed is already compromised");
+  }
+  ok("pre-commit: gitleaks found no secret in the staged changes");
+}
+
 // src/hooks/staged.ts
 var FORMATTABLE = /\.(ts|tsx|js|jsx|mjs|cjs|json|jsonc|md)$/;
 var CODE = /\.(ts|tsx|js|jsx|mjs|cjs)$/;
 async function names(args) {
-  const out = await capture(["git", ...args, "-z"]);
-  return out.split("\x00").filter((line2) => line2.length > 0);
+  const out2 = await capture(["git", ...args, "-z"]);
+  return out2.split("\x00").filter((line2) => line2.length > 0);
 }
 async function staged() {
   const indexed = await names(["diff", "--cached", "--name-only", "--diff-filter=ACMR"]);
@@ -62,18 +306,27 @@ async function staged() {
   };
 }
 async function fingerprints(files) {
-  const out = new Map;
+  const out2 = new Map;
   for (const file of files) {
     const handle = Bun.file(file);
     if (!await handle.exists())
       continue;
-    out.set(file, String(Bun.hash(await handle.arrayBuffer())));
+    out2.set(file, String(Bun.hash(await handle.arrayBuffer())));
   }
-  return out;
+  return out2;
 }
 
 // src/hooks/gates.ts
+function installed(root, hook) {
+  if (existsSync(`${root}/node_modules`))
+    return true;
+  note(`${hook}: no node_modules in this worktree \u2014 run 'bun install'; skipping the rest`);
+  return false;
+}
 async function preCommit(root) {
+  await scanStagedSecrets();
+  if (!installed(root, "pre-commit"))
+    return;
   const oxfmt = tool(root, "oxfmt");
   const { formattable, code, partial } = await staged();
   if (partial.length > 0) {
@@ -103,40 +356,82 @@ async function preCommit(root) {
   }
   ok(`pre-commit: ${formattable.length} staged file(s) formatted and linted`);
 }
-async function prePush(root) {
+function describe(lane) {
+  if (lane.kind === "skip")
+    return `skip ${lane.label} \u2014 ${lane.why}`;
+  if (lane.kind === "test" && lane.scoped)
+    return `run  ${lane.command}  (only the tests the push can reach)`;
+  if (lane.kind === "test")
+    return `run  ${lane.command}  (IN FULL)`;
+  return `run  ${lane.command}`;
+}
+async function prePush(root, args, stdin) {
   const manifest = Bun.file(`${root}/package.json`);
   const pkg = await manifest.exists() ? await manifest.json() : {};
-  if (pkg.scripts?.["check"] === undefined) {
+  const scripts = pkg.scripts ?? {};
+  if (scripts["check"] === undefined) {
     note("pre-push: no `check` script declared in package.json; nothing to run");
     return;
   }
-  note("pre-push: running `bun run check` \u2014 the same gate CI runs");
+  if (!installed(root, "pre-push"))
+    return;
+  const scope = await pushScope(root, args[0] ?? "origin", parsePushRefs(stdin));
+  if (scope.kind === "empty") {
+    ok(`pre-push: ${scope.why} \u2014 nothing to check`);
+    return;
+  }
+  if (scope.kind === "elsewhere") {
+    note(`pre-push: ${scope.why} \u2014 the working tree is not what is being pushed`);
+    note("  NOT CHECKED here; CI checks it. To check it locally, check it out and push from there.");
+    return;
+  }
+  let base;
+  if (scope.kind === "unscoped") {
+    note(`pre-push: ${scope.why} \u2014 every lane runs, tests in full`);
+  } else {
+    const global = scope.changed.filter(changesEverything);
+    note(`pre-push: ${String(scope.changed.length)} file(s) changed ${scope.why}`);
+    if (global.length > 0)
+      note(`  ${global.join(", ")} changes what every test runs on \u2014 tests in full`);
+    else
+      base = scope.base;
+  }
+  const lanes = planLanes(scripts, base);
   const started = Bun.nanoseconds();
-  if (await run(["bun", "run", "check"], true) !== 0) {
-    fail("pre-push", "bun run check failed \u2014 CI would fail the same way, on a shared runner", "bun run lint:fix, then bun run check until it is green");
+  let ran = 0;
+  for (const lane of lanes) {
+    note(describe(lane));
+    if (lane.kind === "skip")
+      continue;
+    if (await runLane(lane.command, root) !== 0) {
+      fail("pre-push", `\`${lane.label}\` failed`, `${lane.command} \u2014 until it is green`);
+    }
+    ran += 1;
   }
-  ok(`pre-push: bun run check passed in ${((Bun.nanoseconds() - started) / 1e9).toFixed(1)}s`);
+  const seconds = ((Bun.nanoseconds() - started) / 1e9).toFixed(1);
+  ok(`pre-push: ${String(ran)} lane(s) of \`check\` passed in ${seconds}s \u2014 CI runs the full gate`);
 }
 
 // src/hooks/install.ts
-import { chmod, mkdir } from "fs/promises";
+import { chmod, mkdir, stat } from "fs/promises";
 var HOOK_NAMES = ["pre-commit", "pre-push"];
 var RUNNER = "node_modules/@homeflare/config/bin/hooks.ts";
+var PREPARE = `bun ${RUNNER} activate`;
 var HUSKY_HOOK = `# HomeFlare shared git hook. The behaviour lives in @homeflare/config, not in this file,
 # and the same bytes are installed as .husky/pre-commit and .husky/pre-push \u2014 the hook
-# name comes from $0.
+# name comes from $0, and git's arguments and stdin pass straight through.
 #
-# \u26A0\uFE0F A hook is a local convenience, not a gate: it is skippable with --no-verify and does
-#   not exist in a fresh clone until \`bun install\` runs the \`prepare\` script. The
-#   required checks on main stay the gate.
+# \u26A0\uFE0F A hook is a local convenience, not a gate: it is skippable with --no-verify, and a
+#   worktree runs it only once \`bun install\` has run there. The required checks on main
+#   stay the gate.
 #
 # Regenerate this file with: bun ${RUNNER} install
 hook="${RUNNER}"
 if [ ! -f "$hook" ]; then
-  echo "husky: $hook is missing \u2014 run 'bun install' to enable the HomeFlare hooks; skipping"
+  echo "homeflare hooks: $hook is missing \u2014 run 'bun install' in this worktree; skipping" >&2
   exit 0
 fi
-exec bun "$hook" "$(basename "$0")"
+exec bun "$hook" "$(basename "$0")" "$@"
 `;
 async function installHooks(projectDir) {
   await mkdir(`${projectDir}/.husky`, { recursive: true });
@@ -155,14 +450,16 @@ async function problemsInHooks(projectDir) {
   if (!await manifest.exists())
     return ["package.json: missing"];
   const pkg = await manifest.json();
-  if (!(pkg.scripts?.["prepare"] ?? "").includes("husky")) {
-    problems.push('package.json: no "prepare": "husky" script \u2014 a fresh clone installs no hooks');
+  const prepare = pkg.scripts?.["prepare"] ?? "";
+  if (!/bin\/hooks\.ts activate/.test(prepare)) {
+    problems.push(`package.json: "prepare" does not run \`${PREPARE}\` \u2014 no clone or worktree gets hooks`);
   }
-  if (pkg.devDependencies?.["husky"] === undefined) {
-    problems.push("package.json: husky is not a devDependency");
+  if (/\bhusky\b/.test(prepare)) {
+    problems.push('package.json: "prepare" still runs husky, which re-points core.hooksPath at .husky/_');
   }
   for (const name of HOOK_NAMES) {
-    const file = Bun.file(`${projectDir}/.husky/${name}`);
+    const path = `${projectDir}/.husky/${name}`;
+    const file = Bun.file(path);
     if (!await file.exists()) {
       problems.push(`.husky/${name}: missing \u2014 run \`bun ${RUNNER} install\``);
       continue;
@@ -170,33 +467,44 @@ async function problemsInHooks(projectDir) {
     if (await file.text() !== HUSKY_HOOK) {
       problems.push(`.husky/${name}: differs from the @homeflare/config wrapper \u2014 run \`bun ${RUNNER} install\`, or change it in the package`);
     }
+    if (((await stat(path)).mode & 73) === 0) {
+      problems.push(`.husky/${name}: not executable, so git ignores it \u2014 chmod +x it and commit`);
+    }
   }
   return problems;
 }
 
 // src/hooks.ts
 function isCommand(value) {
-  return value === "pre-commit" || value === "pre-push" || value === "install";
+  return ["pre-commit", "pre-push", "install", "activate"].includes(value);
 }
-async function runCommand(command, root) {
+async function runCommand(command, root, args = [], stdin = "") {
   if (command === "install") {
     const written = await installHooks(root);
     ok(`wrote ${written.join(", ")} \u2014 commit them`);
-    note("they do nothing until `bun install` runs `prepare` (husky)");
+    note(`then set "prepare": "${PREPARE}" so every install activates them`);
+    return;
+  }
+  if (command === "activate") {
+    const result = await activateHooks(root);
+    (result.active ? ok : note)(`homeflare hooks: ${result.message}`);
     return;
   }
   if (command === "pre-commit")
     return await preCommit(root);
-  return await prePush(root);
+  return await prePush(root, args, stdin);
 }
 export {
   HOOK_NAMES,
   HUSKY_HOOK,
+  PREPARE,
+  activateHooks,
   installHooks,
   isCommand,
+  planLanes,
   problemsInHooks,
   runCommand
 };
 
-//# debugId=3480C5F48A0E1AD864756E2164756E21
+//# debugId=F70ED1E9F00E0B1964756E2164756E21
 //# sourceMappingURL=hooks.js.map