@imdeadpool/guardex 7.0.41 → 7.1.0

package/src/cli/shared/repo-env.js

@@ -0,0 +1,161 @@
+// Shared environment / repo-toggle / origin-introspection helpers used by
+// multiple subcommand modules. Pure code-motion from src/cli/main.js — no
+// behavior changes.
+const {
+  fs,
+  path,
+  GUARDEX_REPO_TOGGLE_ENV,
+  envFlagIsTruthy,
+} = require('../../context');
+const { run } = require('../../core/runtime');
+const { readGitConfig } = require('../../git');
+
+function todayDateStamp() {
+  return new Date().toISOString().slice(0, 10);
+}
+
+function inferGithubRepoFromOrigin(repoRoot) {
+  const rawOrigin = readGitConfig(repoRoot, 'remote.origin.url');
+  if (!rawOrigin) return '';
+
+  const httpsMatch = rawOrigin.match(/github\.com[:/](.+?)(?:\.git)?$/i);
+  if (!httpsMatch) return '';
+  const slug = (httpsMatch[1] || '').replace(/^\/+/, '').trim();
+  if (!slug || !slug.includes('/')) return '';
+  return `github.com/${slug}`;
+}
+
+function inferGithubRepoSlug(rawValue) {
+  const raw = String(rawValue || '').trim();
+  if (!raw) return '';
+  const match = raw.match(/github\.com[:/](.+?)(?:\.git)?$/i);
+  if (!match) return '';
+  const slug = String(match[1] || '')
+    .replace(/^\/+/, '')
+    .replace(/^github\.com\//i, '')
+    .trim();
+  if (!slug || !slug.includes('/')) return '';
+  return slug;
+}
+
+function originRemoteLooksLikeGithub(repoRoot) {
+  const originUrl = readGitConfig(repoRoot, 'remote.origin.url');
+  if (!originUrl) {
+    return false;
+  }
+  return /github\.com[:/]/i.test(originUrl);
+}
+
+function isInteractiveTerminal() {
+  return Boolean(process.stdin.isTTY && process.stdout.isTTY);
+}
+
+function legacyDefaultStatusEnabled() {
+  return envFlagIsTruthy(process.env.GUARDEX_LEGACY_STATUS);
+}
+
+function defaultCockpitDisabled() {
+  const raw = process.env.GUARDEX_DEFAULT_COCKPIT;
+  if (raw == null) return false;
+  const normalized = String(raw).trim().toLowerCase();
+  return ['0', 'false', 'no', 'off'].includes(normalized);
+}
+
+function parseAutoApproval(name) {
+  const raw = process.env[name];
+  if (raw == null) return null;
+  const normalized = String(raw).trim().toLowerCase();
+  if (['1', 'true', 'yes', 'y', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'n', 'off'].includes(normalized)) return false;
+  return null;
+}
+
+function parseBooleanLike(raw) {
+  if (raw == null) return null;
+  const normalized = String(raw).trim().toLowerCase();
+  if (!normalized) return null;
+  if (['1', 'true', 'yes', 'y', 'on'].includes(normalized)) return true;
+  if (['0', 'false', 'no', 'n', 'off'].includes(normalized)) return false;
+  return null;
+}
+
+function parseDotenvAssignmentValue(raw) {
+  let value = String(raw || '').trim();
+  if (!value) return '';
+  if ((value.startsWith('"') && value.endsWith('"')) || (value.startsWith('\'') && value.endsWith('\''))) {
+    return value.slice(1, -1).trim();
+  }
+  value = value.replace(/\s+#.*$/, '').trim();
+  return value;
+}
+
+function readRepoDotenvValue(repoRoot, name) {
+  const envPath = path.join(repoRoot, '.env');
+  if (!fs.existsSync(envPath)) return null;
+  const pattern = new RegExp(`^\\s*(?:export\\s+)?${name.replace(/[.*+?^${}()|[\]\\]/g, '\\$&')}\\s*=\\s*(.*)$`);
+  const lines = fs.readFileSync(envPath, 'utf8').split(/\r?\n/);
+  for (const line of lines) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith('#')) continue;
+    const match = line.match(pattern);
+    if (!match) continue;
+    return parseDotenvAssignmentValue(match[1]);
+  }
+  return null;
+}
+
+function resolveGuardexRepoToggle(repoRoot, env = process.env) {
+  const envRaw = env[GUARDEX_REPO_TOGGLE_ENV];
+  const envEnabled = parseBooleanLike(envRaw);
+  if (envEnabled !== null) {
+    return {
+      enabled: envEnabled,
+      source: 'process environment',
+      raw: String(envRaw).trim(),
+    };
+  }
+
+  const dotenvRaw = readRepoDotenvValue(repoRoot, GUARDEX_REPO_TOGGLE_ENV);
+  const dotenvEnabled = parseBooleanLike(dotenvRaw);
+  if (dotenvEnabled !== null) {
+    return {
+      enabled: dotenvEnabled,
+      source: 'repo .env',
+      raw: String(dotenvRaw).trim(),
+    };
+  }
+
+  return {
+    enabled: true,
+    source: 'default',
+    raw: '',
+  };
+}
+
+function describeGuardexRepoToggle(toggle) {
+  if (!toggle || toggle.source === 'default') {
+    return 'default enabled mode';
+  }
+  return `${toggle.source} (${GUARDEX_REPO_TOGGLE_ENV}=${toggle.raw})`;
+}
+
+function isCommandAvailable(commandName) {
+  return run('which', [commandName]).status === 0;
+}
+
+module.exports = {
+  todayDateStamp,
+  inferGithubRepoFromOrigin,
+  inferGithubRepoSlug,
+  originRemoteLooksLikeGithub,
+  isInteractiveTerminal,
+  legacyDefaultStatusEnabled,
+  defaultCockpitDisabled,
+  parseAutoApproval,
+  parseBooleanLike,
+  parseDotenvAssignmentValue,
+  readRepoDotenvValue,
+  resolveGuardexRepoToggle,
+  describeGuardexRepoToggle,
+  isCommandAvailable,
+};

package/src/cli/shared/sandbox.js

@@ -0,0 +1,417 @@
+// Sandbox/parent-workspace/protected-base helpers used by setup + doctor when
+// a write would land on a protected base branch. Pure code-motion from
+// src/cli/main.js — no behavior changes.
+const {
+  fs,
+  path,
+  TOOL_NAME,
+  SHORT_TOOL_NAME,
+  LOCK_FILE_RELATIVE,
+  AGENT_WORKTREE_RELATIVE_DIRS,
+  defaultAgentWorktreeRelativeDir,
+} = require('../../context');
+const {
+  resolveRepoRoot,
+  gitRefExists,
+  currentBranchName,
+  readProtectedBranches,
+  ensureSetupProtectedBranches,
+  ensureSubmoduleAutoSync,
+  ensureRepoBranch,
+} = require('../../git');
+const sandboxModule = require('../../sandbox');
+// These helpers are identical to sandbox/index.js; delegate to keep one source.
+const {
+  protectedBaseWriteBlock,
+  extractAgentBranchStartMetadata,
+  resolveSandboxTarget,
+  isSpawnFailure,
+  cleanupProtectedBaseSandbox,
+} = sandboxModule;
+const doctorModule = require('../../doctor');
+const { prepareAgentWorktree } = require('../../scaffold/agent-worktree-prep');
+
+function formatWorktreePrepOps(operations) {
+  if (!operations || operations.length === 0) return '';
+  return operations
+    .map((op) => `[agent-branch-start] worktree-prep ${op.status} ${op.file}${op.note ? ' — ' + op.note : ''}`)
+    .join('\n') + '\n';
+}
+const {
+  run,
+  runPackageAsset,
+} = require('../../core/runtime');
+const { printOperations } = require('../../scaffold');
+const {
+  appendForceArgs,
+  runInstallInternal,
+  runFixInternal,
+  runScanInternal,
+  printScanResult,
+  printWorktreePruneSummary,
+} = require('./scaffolding');
+
+function normalizeWorkspacePath(relativePath) {
+  return String(relativePath || '.').replace(/\\/g, '/');
+}
+
+function buildParentWorkspaceView(repoRoot) {
+  const parentDir = path.dirname(repoRoot);
+  const workspaceFileName = `${path.basename(repoRoot)}-branches.code-workspace`;
+  const workspacePath = path.join(parentDir, workspaceFileName);
+  const repoRelativePath = normalizeWorkspacePath(path.relative(parentDir, repoRoot) || '.');
+
+  return {
+    workspacePath,
+    payload: {
+      folders: [
+        { path: repoRelativePath },
+        ...AGENT_WORKTREE_RELATIVE_DIRS.map((relativeDir) => ({
+          path: normalizeWorkspacePath(path.join(repoRelativePath === '.' ? '' : repoRelativePath, relativeDir)),
+        })),
+      ],
+      settings: {
+        'scm.alwaysShowRepositories': true,
+      },
+    },
+  };
+}
+
+function ensureParentWorkspaceView(repoRoot, dryRun) {
+  const { workspacePath, payload } = buildParentWorkspaceView(repoRoot);
+  const operationFile = path.relative(repoRoot, workspacePath) || path.basename(workspacePath);
+  const nextContent = `${JSON.stringify(payload, null, 2)}\n`;
+  const note = 'parent VS Code workspace view';
+
+  if (!fs.existsSync(workspacePath)) {
+    if (!dryRun) {
+      fs.writeFileSync(workspacePath, nextContent, 'utf8');
+    }
+    return { status: dryRun ? 'would-create' : 'created', file: operationFile, note };
+  }
+
+  const currentContent = fs.readFileSync(workspacePath, 'utf8');
+  if (currentContent === nextContent) {
+    return { status: 'unchanged', file: operationFile, note };
+  }
+
+  if (!dryRun) {
+    fs.writeFileSync(workspacePath, nextContent, 'utf8');
+  }
+  return { status: dryRun ? 'would-update' : 'updated', file: operationFile, note };
+}
+
+function hasGuardexBootstrapFiles(repoRoot) {
+  const required = [
+    'AGENTS.md',
+    '.githooks/pre-commit',
+    '.githooks/pre-push',
+    LOCK_FILE_RELATIVE,
+  ];
+  return required.every((relativePath) => fs.existsSync(path.join(repoRoot, relativePath)));
+}
+
+function assertProtectedMainWriteAllowed(options, commandName) {
+  return sandboxModule.assertProtectedMainWriteAllowed(options, commandName);
+}
+
+function runSetupBootstrapInternal(options) {
+  const installPayload = runInstallInternal(options);
+  installPayload.operations.push(
+    ensureSetupProtectedBranches(installPayload.repoRoot, Boolean(options.dryRun)),
+  );
+  installPayload.operations.push(
+    ...ensureSubmoduleAutoSync(installPayload.repoRoot, Boolean(options.dryRun)),
+  );
+
+  let parentWorkspace = null;
+  if (options.parentWorkspaceView) {
+    installPayload.operations.push(
+      ensureParentWorkspaceView(installPayload.repoRoot, Boolean(options.dryRun)),
+    );
+    if (!options.dryRun) {
+      parentWorkspace = buildParentWorkspaceView(installPayload.repoRoot);
+    }
+  }
+
+  const fixPayload = runFixInternal({
+    target: installPayload.repoRoot,
+    dryRun: options.dryRun,
+    force: options.force,
+    forceManagedPaths: options.forceManagedPaths,
+    dropStaleLocks: true,
+    skipAgents: options.skipAgents,
+    skipPackageJson: options.skipPackageJson,
+    skipGitignore: options.skipGitignore,
+    allowProtectedBaseWrite: options.allowProtectedBaseWrite,
+    contract: options.contract,
+  });
+
+  return {
+    installPayload,
+    fixPayload,
+    parentWorkspace,
+  };
+}
+
+function buildSandboxSetupArgs(options, sandboxTarget) {
+  const args = ['setup', '--target', sandboxTarget, '--no-global-install', '--no-recursive'];
+  appendForceArgs(args, options);
+  if (options.skipAgents) args.push('--skip-agents');
+  if (options.skipPackageJson) args.push('--skip-package-json');
+  if (options.skipGitignore) args.push('--no-gitignore');
+  if (options.dryRun) args.push('--dry-run');
+  if (options.contract) args.push('--contract');
+  return args;
+}
+
+function protectedBaseSandboxBranchPrefix() {
+  const now = new Date();
+  const stamp = [
+    now.getUTCFullYear(),
+    String(now.getUTCMonth() + 1).padStart(2, '0'),
+    String(now.getUTCDate()).padStart(2, '0'),
+  ].join('') + '-' + [
+    String(now.getUTCHours()).padStart(2, '0'),
+    String(now.getUTCMinutes()).padStart(2, '0'),
+    String(now.getUTCSeconds()).padStart(2, '0'),
+  ].join('');
+  return `agent/gx/${stamp}`;
+}
+
+function protectedBaseSandboxWorktreePath(repoRoot, branchName) {
+  return path.join(repoRoot, defaultAgentWorktreeRelativeDir(), branchName.replace(/\//g, '__'));
+}
+
+function resolveProtectedBaseSandboxStartRef(repoRoot, baseBranch) {
+  run('git', ['-C', repoRoot, 'fetch', 'origin', baseBranch, '--quiet'], { timeout: 20_000 });
+  if (gitRefExists(repoRoot, `refs/remotes/origin/${baseBranch}`)) {
+    return `origin/${baseBranch}`;
+  }
+  if (gitRefExists(repoRoot, `refs/heads/${baseBranch}`)) {
+    return baseBranch;
+  }
+  if (currentBranchName(repoRoot) === baseBranch) {
+    return null;
+  }
+  throw new Error(`Unable to find base ref for sandbox bootstrap: ${baseBranch}`);
+}
+
+function startProtectedBaseSandboxFallback(blocked, sandboxSuffix) {
+  const branchPrefix = protectedBaseSandboxBranchPrefix();
+  let selectedBranch = '';
+  let selectedWorktreePath = '';
+
+  for (let attempt = 0; attempt < 30; attempt += 1) {
+    const suffix = attempt === 0 ? sandboxSuffix : `${attempt + 1}-${sandboxSuffix}`;
+    const candidateBranch = `${branchPrefix}-${suffix}`;
+    const candidateWorktreePath = protectedBaseSandboxWorktreePath(blocked.repoRoot, candidateBranch);
+    if (gitRefExists(blocked.repoRoot, `refs/heads/${candidateBranch}`)) {
+      continue;
+    }
+    if (fs.existsSync(candidateWorktreePath)) {
+      continue;
+    }
+    selectedBranch = candidateBranch;
+    selectedWorktreePath = candidateWorktreePath;
+    break;
+  }
+
+  if (!selectedBranch || !selectedWorktreePath) {
+    throw new Error('Unable to allocate unique sandbox branch/worktree');
+  }
+
+  fs.mkdirSync(path.dirname(selectedWorktreePath), { recursive: true });
+  const startRef = resolveProtectedBaseSandboxStartRef(blocked.repoRoot, blocked.branch);
+  const addArgs = startRef
+    ? ['-C', blocked.repoRoot, 'worktree', 'add', '-b', selectedBranch, selectedWorktreePath, startRef]
+    : ['-C', blocked.repoRoot, 'worktree', 'add', '--orphan', selectedWorktreePath];
+  const addResult = run('git', addArgs);
+  if (isSpawnFailure(addResult)) {
+    throw addResult.error;
+  }
+  if (addResult.status !== 0) {
+    throw new Error((addResult.stderr || addResult.stdout || 'failed to create sandbox').trim());
+  }
+
+  if (!startRef) {
+    const renameResult = run(
+      'git',
+      ['-C', selectedWorktreePath, 'branch', '-m', selectedBranch],
+      { timeout: 20_000 },
+    );
+    if (isSpawnFailure(renameResult)) {
+      throw renameResult.error;
+    }
+    if (renameResult.status !== 0) {
+      throw new Error(
+        (renameResult.stderr || renameResult.stdout || 'failed to name orphan sandbox branch').trim(),
+      );
+    }
+  }
+
+  const prepOps = prepareAgentWorktree(blocked.repoRoot, selectedWorktreePath);
+  return {
+    metadata: {
+      branch: selectedBranch,
+      worktreePath: selectedWorktreePath,
+    },
+    stdout:
+      `[agent-branch-start] Created branch: ${selectedBranch}\n` +
+      `[agent-branch-start] Worktree: ${selectedWorktreePath}\n` +
+      formatWorktreePrepOps(prepOps),
+    stderr: addResult.stderr || '',
+  };
+}
+
+function startProtectedBaseSandbox(blocked, { taskName, sandboxSuffix }) {
+  if (sandboxSuffix === 'gx-doctor') {
+    return startProtectedBaseSandboxFallback(blocked, sandboxSuffix);
+  }
+
+  const startResult = runPackageAsset('branchStart', [
+    '--task',
+    taskName,
+    '--agent',
+    SHORT_TOOL_NAME,
+    '--base',
+    blocked.branch,
+  ], { cwd: blocked.repoRoot });
+  if (isSpawnFailure(startResult)) {
+    throw startResult.error;
+  }
+  if (startResult.status !== 0) {
+    return startProtectedBaseSandboxFallback(blocked, sandboxSuffix);
+  }
+
+  const metadata = extractAgentBranchStartMetadata(startResult.stdout);
+  const currentBranch = currentBranchName(blocked.repoRoot);
+  const worktreePath = metadata.worktreePath ? path.resolve(metadata.worktreePath) : '';
+  const repoRootPath = path.resolve(blocked.repoRoot);
+  const hasSafeWorktree = Boolean(worktreePath) && worktreePath !== repoRootPath;
+  const branchChanged = Boolean(currentBranch) && currentBranch !== blocked.branch;
+
+  if (!hasSafeWorktree || branchChanged) {
+    const restoreResult = ensureRepoBranch(blocked.repoRoot, blocked.branch);
+    if (!restoreResult.ok) {
+      const detail = [restoreResult.stderr, restoreResult.stdout].filter(Boolean).join('\n').trim();
+      throw new Error(
+        `sandbox startup switched protected base checkout and could not restore '${blocked.branch}'.` +
+        (detail ? `\n${detail}` : ''),
+      );
+    }
+    return startProtectedBaseSandboxFallback(blocked, sandboxSuffix);
+  }
+
+  const worktreePathResolved = metadata.worktreePath
+    ? path.resolve(metadata.worktreePath)
+    : '';
+  const prepOps = prepareAgentWorktree(blocked.repoRoot, worktreePathResolved);
+  return {
+    metadata,
+    stdout: (startResult.stdout || '') + formatWorktreePrepOps(prepOps),
+    stderr: startResult.stderr || '',
+  };
+}
+
+function runSetupInSandbox(options, blocked, repoLabel = '') {
+  const startResult = startProtectedBaseSandbox(blocked, {
+    taskName: `${SHORT_TOOL_NAME}-setup`,
+    sandboxSuffix: 'gx-setup',
+  });
+  const metadata = startResult.metadata;
+
+  if (startResult.stdout) process.stdout.write(startResult.stdout);
+  if (startResult.stderr) process.stderr.write(startResult.stderr);
+  console.log(
+    `[${TOOL_NAME}] setup blocked on protected branch '${blocked.branch}' in an initialized repo; ` +
+    'refreshing through a sandbox worktree and syncing managed bootstrap files back locally.',
+  );
+
+  const sandboxTarget = resolveSandboxTarget(blocked.repoRoot, metadata.worktreePath, options.target);
+  const mainScriptPath = require.resolve('../main.js');
+  const nestedResult = run(
+    process.execPath,
+    [mainScriptPath, ...buildSandboxSetupArgs(options, sandboxTarget)],
+    { cwd: metadata.worktreePath, env: { GUARDEX_DOCTOR_SANDBOX: '1' } },
+  );
+  if (isSpawnFailure(nestedResult)) {
+    throw nestedResult.error;
+  }
+  if (nestedResult.status !== 0) {
+    if (nestedResult.stdout) process.stdout.write(nestedResult.stdout);
+    if (nestedResult.stderr) process.stderr.write(nestedResult.stderr);
+    throw new Error(
+      `sandboxed setup failed for protected branch '${blocked.branch}'. ` +
+      `Inspect sandbox at ${metadata.worktreePath}`,
+    );
+  }
+
+  const syncOptions = {
+    ...options,
+    target: blocked.repoRoot,
+    recursive: false,
+    allowProtectedBaseWrite: true,
+  };
+  const { installPayload, fixPayload, parentWorkspace } = runSetupBootstrapInternal(syncOptions);
+  printOperations(`Setup/install${repoLabel}`, installPayload, syncOptions.dryRun);
+  printOperations(`Setup/fix${repoLabel}`, fixPayload, syncOptions.dryRun);
+  if (!syncOptions.dryRun && parentWorkspace) {
+    console.log(`[${TOOL_NAME}] Parent workspace view: ${parentWorkspace.workspacePath}`);
+  }
+
+  const scanResult = runScanInternal({ target: blocked.repoRoot, json: false });
+  const currentBaseBranch = currentBranchName(scanResult.repoRoot);
+  const autoFinishSummary = doctorModule.autoFinishReadyAgentBranches(scanResult.repoRoot, {
+    baseBranch: currentBaseBranch,
+    dryRun: syncOptions.dryRun,
+  });
+  printScanResult(scanResult, false);
+  if (autoFinishSummary.enabled) {
+    console.log(
+      `[${TOOL_NAME}] Auto-finish sweep (base=${currentBaseBranch}): attempted=${autoFinishSummary.attempted}, completed=${autoFinishSummary.completed}, skipped=${autoFinishSummary.skipped}, failed=${autoFinishSummary.failed}`,
+    );
+    for (const detail of autoFinishSummary.details) {
+      console.log(`[${TOOL_NAME}]   ${detail}`);
+    }
+  } else if (autoFinishSummary.details.length > 0) {
+    console.log(`[${TOOL_NAME}] ${autoFinishSummary.details[0]}`);
+  }
+
+  const prunePayload = doctorModule.pruneStaleAgentWorktrees(scanResult.repoRoot, {
+    baseBranch: currentBaseBranch,
+    dryRun: syncOptions.dryRun,
+  });
+  printWorktreePruneSummary(prunePayload, { baseBranch: currentBaseBranch });
+
+  const cleanupResult = cleanupProtectedBaseSandbox(blocked.repoRoot, metadata);
+  console.log(
+    `[${TOOL_NAME}] Protected-base setup sandbox cleanup: ${cleanupResult.note} ` +
+    `(worktree=${cleanupResult.worktree}, branch=${cleanupResult.branch}).`,
+  );
+
+  return {
+    scanResult,
+  };
+}
+
+module.exports = {
+  normalizeWorkspacePath,
+  buildParentWorkspaceView,
+  ensureParentWorkspaceView,
+  hasGuardexBootstrapFiles,
+  protectedBaseWriteBlock,
+  assertProtectedMainWriteAllowed,
+  runSetupBootstrapInternal,
+  extractAgentBranchStartMetadata,
+  resolveSandboxTarget,
+  buildSandboxSetupArgs,
+  isSpawnFailure,
+  protectedBaseSandboxBranchPrefix,
+  protectedBaseSandboxWorktreePath,
+  resolveProtectedBaseSandboxStartRef,
+  startProtectedBaseSandboxFallback,
+  startProtectedBaseSandbox,
+  cleanupProtectedBaseSandbox,
+  runSetupInSandbox,
+};