@ikon85/agent-workflow-kit 0.20.0 → 0.22.0

package/scripts/wrapup-land.py

@@ -20,6 +20,7 @@ no --no-verify; the caller diagnoses.
 from __future__ import annotations
 
 import argparse
+import importlib.util
 import json
 import os
 import re
@@ -90,6 +91,44 @@ def load_profile() -> dict:
         return {}
 
 
+def load_worktree_cleanup_core():
+    path = Path(__file__).resolve().parent / "worktree-lifecycle" / "core.py"
+    module_dir = str(path.parent)
+    if module_dir not in sys.path:
+        sys.path.insert(0, module_dir)
+    spec = importlib.util.spec_from_file_location("_wrapup_worktree_lifecycle", path)
+    if spec is None or spec.loader is None:
+        raise Stop("cleanup", f"cannot load shared cleanup core from {path}")
+    module = importlib.util.module_from_spec(spec)
+    sys.modules[spec.name] = module
+    spec.loader.exec_module(module)
+    return module
+
+
+def ensure_worktree_removable(wt: str, main_tree: str):
+    profile_path = Path(main_tree) / "docs/agents/workflow-capabilities.json"
+    if not profile_path.is_file():
+        return None
+    core = load_worktree_cleanup_core()
+    try:
+        profile = core.load_profile(profile_path)
+        assessment = core.cleanup_assessment(
+            profile,
+            Path(main_tree),
+            Path(wt),
+            merge_target="origin/main",
+        )
+    except core.LifecycleError as error:
+        raise Stop("cleanup", f"shared cleanup guard failed: {error}") from error
+    if assessment.reasons:
+        raise Stop(
+            "cleanup",
+            "shared cleanup guard refused worktree removal",
+            "; ".join(assessment.reasons),
+        )
+    return assessment
+
+
 # ---------- drift log (ANNAHMEN.md) ----------
 
 def parse_annahmen(text: str, default_section: str) -> tuple[list[dict], list[str]]:
@@ -428,6 +467,12 @@ def cmd_land(args) -> dict:
 
     # Step 2 — kill the worktree's dev server, then Step 4 — teardown
     if wt_exists:
+        git(["fetch", "origin", "main"], cwd=main_tree, check=True)
+        cleanup = ensure_worktree_removable(wt, main_tree)
+        report["cleanup_guard"] = {
+            "active": cleanup is not None,
+            "assumptions_read": bool(cleanup and cleanup.assumptions),
+        }
         report["killed_processes"] = kill_worktree_processes(wt)
         p = git(["worktree", "remove", wt], cwd=main_tree)
         if p.returncode != 0:

package/src/lib/bundle.mjs

@@ -48,9 +48,12 @@ export const HELPER_FILES = [
   { path: 'scripts/release-parity.mjs', kind: 'script', mode: 0o644 },
   { path: 'scripts/release-state.mjs', kind: 'script', mode: 0o644 },
   // Consumer-owned project release profiles use these read-only shared
-  // primitives before any apply/commit/tag action is allowed.
+  // primitives before any apply/commit/tag action is allowed. The thin CLI
+  // owns only repository-fact collection and delegates to the same engine.
   { path: 'src/lib/semver.mjs', kind: 'script', mode: 0o644 },
   { path: 'src/lib/release-preview.mjs', kind: 'script', mode: 0o644 },
+  { path: 'src/lib/release-apply.mjs', kind: 'script', mode: 0o644 },
+  { path: 'scripts/project-release.mjs', kind: 'script', mode: 0o755 },
   // GitHub-consumer automation: invokes the existing update command, then owns
   // only the stable tested branch/pull-request upsert.
   { path: 'scripts/kit-update-pr.mjs', kind: 'script', mode: 0o755 },
@@ -71,6 +74,7 @@ export const HELPER_FILES = [
   { path: 'scripts/worktree-lifecycle/core.py', kind: 'script', mode: 0o644 },
   { path: 'scripts/worktree-lifecycle/profile.py', kind: 'script', mode: 0o644 },
   { path: 'scripts/worktree-lifecycle/setup.py', kind: 'script', mode: 0o755 },
+  { path: 'scripts/worktree-lifecycle/cleanup.py', kind: 'script', mode: 0o755 },
   { path: 'scripts/worktree-lifecycle/capabilities.json', kind: 'doc', mode: 0o644 },
   { path: 'scripts/worktree-lifecycle/README.md', kind: 'doc', mode: 0o644 },
   // Shared hook utility imported by the shipped hooks (drift-guard,
@@ -84,6 +88,7 @@ export const HELPER_FILES = [
   { path: '.claude/hooks/enforce-worktree.py', kind: 'hook', mode: 0o755 },
   { path: '.claude/hooks/enforce-worktree-cwd.py', kind: 'hook', mode: 0o755 },
   { path: '.claude/hooks/enforce-worktree-discipline.py', kind: 'hook', mode: 0o755 },
+  { path: '.claude/hooks/slice-handoff-hint.py', kind: 'hook', mode: 0o755 },
   { path: '.claude/hooks/drift-guard.py', kind: 'hook', mode: 0o755 },
   // SessionStart skill-freshness drift-hint (audit-skills names it). For each
   // <skill>/SOURCES.txt it flags sources newer in git than the SKILL.md. Imports

package/src/lib/release-apply.mjs

@@ -0,0 +1,81 @@
+import { createHash } from 'node:crypto';
+import { lstat, readFile, realpath } from 'node:fs/promises';
+import { isAbsolute, join, relative, resolve } from 'node:path';
+import { writeAtomic } from './atomicWrite.mjs';
+
+const sha256 = (body) => createHash('sha256').update(body).digest('hex');
+
+async function readSnapshot(consumerRoot, snapshot) {
+  return Promise.all(snapshot.map(async ({ path }) => {
+    const body = await readFile(join(consumerRoot, path), 'utf8');
+    return { path, body, version: JSON.parse(body).version, sha256: sha256(body) };
+  }));
+}
+
+const escapes = (root, target) => {
+  const path = relative(root, target);
+  return path === '..' || path.startsWith(`..${process.platform === 'win32' ? '\\' : '/'}`)
+    || isAbsolute(path);
+};
+
+export async function assertSafeReleaseTargets(consumerRoot, paths) {
+  const canonicalRoot = await realpath(consumerRoot);
+  for (const path of paths) {
+    const target = resolve(consumerRoot, path);
+    if (isAbsolute(path) || escapes(resolve(consumerRoot), target)) {
+      throw new Error(`release target is outside consumer root: ${path}`);
+    }
+    if ((await lstat(target)).isSymbolicLink()) {
+      throw new Error(`symlinked release target is not allowed: ${path}`);
+    }
+    if (escapes(canonicalRoot, await realpath(target))) {
+      throw new Error(`release target resolves outside consumer root: ${path}`);
+    }
+  }
+}
+
+export async function applyProjectRelease(options) {
+  const { consumerRoot, preview, confirmation } = options;
+  const write = options.write ?? writeAtomic;
+  if (preview.status !== 'ready') throw new Error('release preview is blocked');
+  if (confirmation !== preview.confirmation) {
+    throw new Error('release confirmation does not match preview');
+  }
+  await assertSafeReleaseTargets(
+    consumerRoot, preview.snapshot.map(({ path }) => path),
+  );
+  const current = await readSnapshot(consumerRoot, preview.snapshot);
+  if (current.every(({ version }) => version === preview.summary.targetVersion)) {
+    throw new Error(`release already prepared at ${preview.summary.targetVersion}`);
+  }
+  for (const expected of preview.snapshot) {
+    const actual = current.find(({ path }) => path === expected.path);
+    if (actual.sha256 !== expected.sha256) {
+      throw new Error(`release target changed after preview: ${expected.path}`);
+    }
+  }
+  const version = preview.summary.targetVersion;
+  const candidates = current.map((file) => {
+    const body = JSON.parse(file.body);
+    body.version = version;
+    return { ...file, next: `${JSON.stringify(body, null, 2)}\n` };
+  });
+  const written = [];
+  try {
+    for (const file of candidates) {
+      await write(join(consumerRoot, file.path), file.next);
+      written.push(file);
+    }
+  } catch (error) {
+    for (const file of written.reverse()) {
+      await writeAtomic(join(consumerRoot, file.path), file.body);
+    }
+    throw error;
+  }
+  return {
+    status: 'prepared',
+    version,
+    updated: candidates.map(({ path }) => path),
+    plannedTag: preview.actions.find(({ type }) => type === 'tag').name,
+  };
+}