@impeccable/reviews 0.1.25 → 0.1.27

package/dist/leftovers.js

@@ -1,7 +1,7 @@
 import { execFileSync } from 'node:child_process';
 import { createHash } from 'node:crypto';
-import { existsSync, lstatSync, readFileSync, realpathSync, rmdirSync, unlinkSync, writeFileSync } from 'node:fs';
-import { dirname, isAbsolute, relative, sep } from 'node:path';
+import { existsSync, lstatSync, readdirSync, readFileSync, realpathSync, rmdirSync, unlinkSync, writeFileSync } from 'node:fs';
+import { dirname, isAbsolute, join, relative, sep } from 'node:path';
 import { gitEnvironment } from './sandbox.js';
 const digest = (bytes) => createHash('sha256').update(bytes).digest('hex');
 /** Up to three paths, then how many more. */
@@ -9,6 +9,14 @@ export const listPaths = (paths) => `${paths.slice(0, 3).join(', ')}${paths.leng
 /** A pathspec git reads as the path itself, never a pattern. */
 const literal = (path) => `:(literal)${path}`;
 const them = (paths, one, more) => (paths.length === 1 ? one : more);
+/** Ignored folders that hold installs, caches or a host's link, which the run's commands change on purpose: never compared. */
+const UNWATCHED = new Set(['node_modules', 'bower_components', '.venv', 'venv', 'vendor', '__pycache__', '.pnpm-store', '.yarn', '.gradle', '.cache', '.turbo', '.parcel-cache', '.vercel', '.netlify', '.wrangler']);
+const unwatched = (rel) => rel.split('/').some((part, i, parts) => UNWATCHED.has(part) || (part === 'cache' && parts[i - 1] === '.next'));
+/** How much of the ignored files is read, folders counted as entries: past either, a folder is left uncompared rather than half seen. */
+const IGNORED_ENTRIES = 5000;
+const IGNORED_BYTES = 64 * 1024 * 1024;
+/** Files up to this size are compared by their bytes, larger ones by their size and time. */
+const HASHED = 1024 * 1024;
 export function checkoutJournal(checkoutRoot) {
     const root = realpathSync(checkoutRoot);
     // As the person, outside the sandbox, as backToStartBranch runs it: no hooks, no fsmonitor.
@@ -60,7 +68,68 @@ export function checkoutJournal(checkoutRoot) {
         const rel = relative(root, path);
         return !rel || rel === '..' || rel.startsWith(`..${sep}`) || isAbsolute(rel) ? null : rel.split(sep).join('/');
     };
+    /**
+     * The files git ignores, outside UNWATCHED, each with what it holds (`seen`), and the ignored folders too large to read
+     * (`unseen`); null when git could not list them.
+     */
+    const ignored = () => {
+        let listed;
+        try {
+            listed = git(['ls-files', '-z', '--others', '--ignored', '--exclude-standard', '--directory']).split('\0').filter((rel) => rel && !unwatched(rel.replace(/\/$/, '')));
+        }
+        catch {
+            return null;
+        }
+        const seen = new Map();
+        const unseen = [];
+        let count = 0, bytes = 0;
+        for (const top of listed) {
+            const found = new Map();
+            const look = (rel) => {
+                const path = join(root, rel);
+                let stat;
+                try {
+                    stat = lstatSync(path);
+                }
+                catch {
+                    return true;
+                }
+                if (++count > IGNORED_ENTRIES)
+                    return false;
+                if (stat.isDirectory()) {
+                    let names;
+                    try {
+                        names = readdirSync(path);
+                    }
+                    catch {
+                        return false;
+                    }
+                    return names.every((name) => unwatched(`${rel}/${name}`) || look(`${rel}/${name}`));
+                }
+                if (!stat.isFile() || stat.size > HASHED)
+                    found.set(rel, `${stat.mode}:${stat.size}:${stat.mtimeMs}`);
+                else {
+                    if ((bytes += stat.size) > IGNORED_BYTES)
+                        return false;
+                    try {
+                        found.set(rel, digest(readFileSync(path)));
+                    }
+                    catch {
+                        return false;
+                    }
+                }
+                return true;
+            };
+            if (look(top.replace(/\/$/, '')))
+                for (const [rel, held] of found)
+                    seen.set(rel, held);
+            else
+                unseen.push(top);
+        }
+        return { seen, unseen };
+    };
     const atStart = untracked();
+    const ignoredAtStart = ignored();
     const files = new Map();
     const dirs = new Set();
     const current = (path) => {
@@ -259,13 +328,23 @@ export function checkoutJournal(checkoutRoot) {
             removeEmptyDirs();
             return lines(kept, failed);
         },
-        appeared() {
+        appeared(branch) {
             const now = untracked();
-            if (!atStart || !now)
-                return [];
             const mine = new Set([...files.keys()].map(named));
-            const fresh = [...now].filter((path) => !atStart.has(path) && !mine.has(path));
-            return fresh.length ? [`${listPaths(fresh)} appeared in your checkout during the setup, from a command it ran or from you, so ${them(fresh, 'it stays', 'they stay')}.`] : [];
+            const fresh = atStart && now ? [...now].filter((path) => !atStart.has(path) && !mine.has(path)) : [];
+            const ignoredNow = ignoredAtStart && ignored();
+            // git status shows none of these: a build's output is the usual one, which the person may serve as it is.
+            let changed = [];
+            if (ignoredAtStart && ignoredNow) {
+                const unseen = [...ignoredAtStart.unseen, ...ignoredNow.unseen];
+                changed = [...new Set([...ignoredAtStart.seen.keys(), ...ignoredNow.seen.keys()])]
+                    .filter((rel) => ignoredAtStart.seen.get(rel) !== ignoredNow.seen.get(rel) && !mine.has(rel) && !unseen.some((top) => rel === top || rel.startsWith(top.endsWith('/') ? top : `${top}/`)))
+                    .sort();
+            }
+            return [
+                ...(fresh.length ? [`${listPaths(fresh)} appeared in your checkout during the setup, from a command it ran or from you, so ${them(fresh, 'it stays', 'they stay')}.`] : []),
+                ...(changed.length ? [`${listPaths(changed)}, which git ignores, changed during the setup: if ${them(changed, "it is", "they are")} a build's output, rebuild${branch ? ` on ${branch}` : ''} to put ${them(changed, 'it', 'them')} back.`] : []),
+            ];
         },
     };
 }

package/dist/main.js

@@ -123,7 +123,7 @@ export async function main(argv) {
         backToStart = () => {
             const kept = journal.undo();
             const branch = backToStartBranch(checkout.root, startBranch);
-            return [...kept, ...(branch ? [branch] : []), ...journal.appeared()];
+            return [...kept, ...(branch ? [branch] : []), ...journal.appeared(startBranch)];
         };
         // From the checkout's top, where the sandbox lays its own protections of a checkout.
         process.chdir(checkout.root);

package/dist/playbook/cases/live-app-address.md

@@ -6,10 +6,10 @@ Every run that saves a preview method, for the state's `before` item: the addres
 
 1. **Find the address**: the `production` address a host tool answered (impeccable_netlify_previews, the Netlify site's own; impeccable_cloudflare_previews, the Pages project's, `https://<project>.pages.dev`; impeccable_hosted_previews, the linked Vercel project's own domain where GitHub records a production deployment of it; impeccable_vercel_connect's `productionUrl` where production exists), else the live-site line the item's `proposal` read in the README, checked against the file, when it is the site's or project's own address on one of the hosts (an address elsewhere is only the host tools' to name). A project or site created in this run has no live app yet. Done when you have one address, or know there is none.
 2. **Prove it** with impeccable_prove_preview, under the status line *"Opening the live app"*: that address, or a page on it a visitor opens without signing in, and words the page shows that the checkout holds. A key the run already got in place (Vercel's bypass secret, Netlify's site password, Cloudflare's service token) goes with it where the lock is the same project's or site's. Done when it answers `proven: true`. **An address no key opens is not set**: a `gate`, the app's own sign-in on every page, or no answer leaves the item as it is, and the report says what the address answered.
-3. **Save it** with impeccable_write to `preview`: `beforeUrl` the proven address, in the same write as the method where the proof came before it (`{"intendedMethod": "preview-deploy", "beforeUrl": "https://…"}`), else in a write of its own; `appKey` the app's on a repository of several apps, one address per app. Done when the answer carries `beforeUrl`; its `beforeCheck.access` says how Impeccable's own check opened it: `ok`; `auth-wall`, the app's sign-in, which the saved test accounts get past; anything else goes under "What is not verified".
+3. **Save it** with impeccable_write to `preview`: `beforeUrl` the proven address's root, `https://<host>` with no path, whatever page the proof opened (a login page is one role's, and the review signs in as another; impeccable_write saves the root either way), in the same write as the method where the proof came before it (`{"intendedMethod": "preview-deploy", "beforeUrl": "https://…"}`), else in a write of its own; `appKey` the app's on a repository of several apps, one address per app. Done when the answer carries `beforeUrl`; its `beforeCheck.access` says how Impeccable's own check opened it: `ok`; `auth-wall`, the app's sign-in, which the saved test accounts get past; anything else goes under "What is not verified".
 
 ### Reference
 
-- **The report** names the address under "What was configured, and by whom" (*The live app's address, https://…, as the before of every review, by the setup agent.*), or, with none set, says under "What was skipped, and why" what stopped it: no live app yet, no address known, or what the address answered.
+- **The report** names the address under "What was configured, and by whom" (*The live app's address, https://…, as the before of every review, by the setup agent.*; where the proof opened a page other than the root, what the root does next, such as *A signed-out visit there lands on the login page.*, so that page never reads as the before), or, with none set, says under "What was skipped, and why" what stopped it: no live app yet, no address known, or what the address answered.
 - Never save a preview's address (one deployment's, with a hash or a branch in its name), a placeholder, or an address the proof did not answer with this app: impeccable_write refuses an unproven one. Clear nothing: an address the person saved stays.
 - **Status lines** belong to the Preview method task.

package/dist/playbook.js

@@ -20,7 +20,7 @@ This run was started with --signed-in-test-drive: the test drive changes a page
 - **Accounts first**: set up the sign-in as the sign-in case says before the test drive's push, even where a host's case goes to pull-requests' step 4 earlier. The fence pushes and opens a test drive only for an app with a test account saved.
 - **No account saved** (the app has no sign-in of its own, or every account was skipped): the flag cannot be honoured. Push and open no test drive, on a public page or any other: mark the Test drive task failed and say why under "What was skipped, and why"; impeccable_report opens the report with the flag's line itself.
 - **The page** (step 2): the new page sits behind the sign-in, guarded as the app guards its other signed-in pages, and is linked from a page every role reaches once signed in, such as the page they land on; a login page or a page a visitor opens signed out holds no link. Where no page reaches every role, link it from one role's page and name that role in the test drive's body.
-- **The proof** (step 4): prove the preview on a page it shows a visitor signed out, the login page where the test drive's page sends that visitor to the sign-in.
+- **The proof** (step 4): prove the preview on a page it shows a visitor signed out, the login page where the test drive's page sends that visitor to the sign-in. That proves the preview, not the before: the before stays the live app's root, as live-app-address says.
 - **The body** (step 5): it says the page is behind the sign-in, and which roles reach it.`;
 /** The system prompt: the setup, its steps, then the reference and the cases. The instructions JSON carries every write shape and the fence decides what runs; this restates neither. */
 export function playbook(repo) {

package/dist/tools.js

@@ -2676,7 +2676,8 @@ export function createTools(ctx) {
                 }
             }
             const testAccounts = target.url.endsWith('/test-accounts');
-            let body = p.body;
+            // The before is the live app's root, whatever page the proof opened: a login page there is one role's, and the review, signed in as another, met it as a wall (#429).
+            let body = target.url.endsWith('/preview') && saved && typeof saved.beforeUrl === 'string' ? { ...saved, beforeUrl: new URL(saved.beforeUrl).origin } : p.body;
             if (testAccounts) {
                 // Only what the person typed into a hidden question is ever sent as a password.
                 const list = object(body)?.accounts;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@impeccable/reviews",
-  "version": "0.1.25",
+  "version": "0.1.27",
   "description": "Set up a repository for Impeccable for PRs from your terminal.",
   "license": "SEE LICENSE IN LICENSE",
   "private": false,