@indigoai-us/hq-cli 5.312.2-beta.0 → 5.314.0

package/assets/scaffold/core/scripts/eval-trigger.sh

@@ -1,193 +0,0 @@
-#!/bin/bash
-# eval-trigger.sh — evaluate a policy `when:` boolean expression against a fact set.
-#
-# Usage:
-#   eval-trigger.sh "<expr>" "<space-separated facts>"
-#   eval-trigger.sh --check < "<id>\t<expr>" lines   → "<id>\tok|malformed"
-#
-# Expression grammar (tiny boolean algebra over open identifiers):
-#   expr   := or
-#   or     := and ( '||' and )*
-#   and    := not ( '&&' not )*
-#   not    := '!' not | atom
-#   atom   := '(' or ')' | identifier
-#   identifier := [A-Za-z0-9_./][A-Za-z0-9_./-]*
-#                 Letters, digits, _ . / - . May start with `.` or `/`, so a
-#                 filename (`.mcp.json`, `settings.json`) or a slash-command
-#                 (`/brainstorm`) is a single literal token. Operators
-#                 (`&& || ! ( )`) and whitespace are the only delimiters.
-#
-# Tokens are OPEN — no vocabulary. Identifiers are compared with the fact set
-# case-insensitively; absent or misspelled identifiers are FALSE.
-#
-# Exit codes:
-#   0 — expression is TRUE  given the facts
-#   1 — expression is FALSE given the facts
-#   2 — expression is empty / malformed / unsafe  → caller should FAIL OPEN
-#
-# Safety: each identifier is substituted with 1/0 by fact membership, then the
-# result must contain ONLY `0 1 & | ! ( )` and spaces. Anything else (quotes,
-# backticks, `$`, letters left over, etc.) yields exit 2 — the expression is
-# never eval'd by a shell, only by awk's own boolean operators. Dots, slashes,
-# and dashes are part of the identifier charset, so they are consumed by the
-# substitution and never survive to the gate; quotes/backticks/$ still do, and
-# still fail open.
-
-set -euo pipefail
-
-# --check: batch SYNTAX mode. Reads `<id><TAB><expr>` lines on stdin and prints
-# `<id><TAB>ok` or `<id><TAB>malformed`, one line per input. Validity does not
-# depend on the fact set — every identifier substitutes to 0 — so this is the
-# same parse the single-expression mode runs, just without a process per
-# expression. Callers linting a whole tree use this; there is deliberately no
-# second implementation of the grammar to drift from.
-if [ "${1-}" = "--check" ]; then
-  awk -F'\t' '
-    function skip() { while (substr(E, pos, 1) ~ /[ \t]/) pos++ }
-    function parseOr(  v) {
-      v = parseAnd(); skip()
-      while (valid && substr(E, pos, 2) == "||") {
-        pos += 2
-        rhs = parseAnd()
-        v = (v || rhs)
-        skip()
-      }
-      return v
-    }
-    function parseAnd(  v) {
-      v = parseNot(); skip()
-      while (valid && substr(E, pos, 2) == "&&") {
-        pos += 2
-        rhs = parseNot()
-        v = (v && rhs)
-        skip()
-      }
-      return v
-    }
-    function parseNot(  c) {
-      skip(); c = substr(E, pos, 1)
-      if (c == "!") { pos++; return (parseNot() ? 0 : 1) }
-      return parseAtom()
-    }
-    function parseAtom(  v, c) {
-      skip(); c = substr(E, pos, 1)
-      if (c == "(") {
-        pos++; v = parseOr(); skip()
-        if (substr(E, pos, 1) != ")") { valid = 0; return 0 }
-        pos++; return v
-      }
-      if (c == "0" || c == "1") { pos++; return (c == "1") ? 1 : 0 }
-      valid = 0; return 0
-    }
-    function check(expr,   e, s, out, tok) {
-      e = expr; gsub(/[ \t]/, "", e)
-      if (e == "") return 0
-      s = expr; out = ""
-      while (match(s, "[A-Za-z0-9_./][A-Za-z0-9_./-]*")) {
-        tok = substr(s, RSTART, RLENGTH)
-        out = out substr(s, 1, RSTART - 1) "0"
-        s = substr(s, RSTART + RLENGTH)
-      }
-      out = out s
-      if (out ~ /[^01&|!() \t]/) return 0
-      E = out; pos = 1; valid = 1
-      parseOr()
-      skip()
-      if (!valid || pos <= length(E)) return 0 # trailing garbage / bad atom
-      return 1
-    }
-    # The first tab separates the caller id from the expression. Rejoin any
-    # remaining fields so tabs inside an expression retain their documented
-    # whitespace meaning instead of being silently discarded by the awk field
-    # separator.
-    {
-      expr = $2
-      for (field = 3; field <= NF; field++) expr = expr "\t" $field
-      print $1 "\t" (check(expr) ? "ok" : "malformed")
-    }
-  '
-  exit 0
-fi
-
-EXPR="${1-}"
-FACTS="${2-}"
-
-# Empty expression → nothing to evaluate; caller fails open.
-case "$EXPR" in
-  ''|*[!\ ]*) : ;;  # has at least one non-space char → continue
-esac
-# (the case above is a readability no-op; the real empty check is in awk)
-
-awk -v expr="$EXPR" -v facts="$FACTS" '
-function skip() { while (substr(E, pos, 1) ~ /[ \t]/) pos++ }
-function parseOr(  v) {
-  v = parseAnd(); skip()
-  while (valid && substr(E, pos, 2) == "||") {
-    pos += 2
-    rhs = parseAnd()
-    v = (v || rhs)
-    skip()
-  }
-  return v
-}
-function parseAnd(  v) {
-  v = parseNot(); skip()
-  while (valid && substr(E, pos, 2) == "&&") {
-    pos += 2
-    rhs = parseNot()
-    v = (v && rhs)
-    skip()
-  }
-  return v
-}
-function parseNot(  c) {
-  skip(); c = substr(E, pos, 1)
-  if (c == "!") { pos++; return (parseNot() ? 0 : 1) }
-  return parseAtom()
-}
-function parseAtom(  v, c) {
-  skip(); c = substr(E, pos, 1)
-  if (c == "(") {
-    pos++; v = parseOr(); skip()
-    if (substr(E, pos, 1) != ")") { valid = 0; return 0 }
-    pos++; return v
-  }
-  if (c == "0" || c == "1") { pos++; return (c == "1") ? 1 : 0 }
-  valid = 0; return 0
-}
-BEGIN {
-  # empty / whitespace-only expression → fail open
-  e = expr; gsub(/[ \t]/, "", e)
-  if (e == "") exit 2
-
-  # build fact membership set
-  n = split(facts, fa, /[ ,]+/)
-  for (i = 1; i <= n; i++) if (fa[i] != "") have[fa[i]] = 1
-
-  # substitute identifiers -> 1/0 by membership
-  s = expr; out = ""
-  while (match(s, "[A-Za-z0-9_./][A-Za-z0-9_./-]*")) {
-    tok = substr(s, RSTART, RLENGTH)
-    out = out substr(s, 1, RSTART - 1) ((tolower(tok) in have) ? "1" : "0")
-    s = substr(s, RSTART + RLENGTH)
-  }
-  out = out s
-
-  # safety gate: only 0 1 & | ! ( ) and spaces may remain
-  if (out ~ /[^01&|!() \t]/) exit 2
-
-  # evaluate
-  E = out; pos = 1; valid = 1
-  v = parseOr()
-
-  # The parse must consume the WHOLE expression. Recursive descent stops at the
-  # first token it cannot continue from, so `merge || pull request` would parse
-  # as `merge || pull` and silently discard everything after the bare space —
-  # the policy then fires (or fails to) on a prefix nobody authored. Leftover
-  # input means the expression is malformed, not shorter.
-  skip()
-  if (!valid || pos <= length(E)) exit 2
-
-  exit (v ? 0 : 1)
-}
-'

package/assets/scaffold/core/scripts/git-pack-extension-check.sh

@@ -1,164 +0,0 @@
-#!/usr/bin/env bash
-# hq-core: public
-# git-pack-extension-check.sh — find pack files that have lost their extension.
-#
-# A git packfile set is three files sharing one basename:
-#
-#   pack-<sha>.pack   the objects           (magic "PACK")
-#   pack-<sha>.idx    the index into them   (magic "\377tOc")
-#   pack-<sha>.rev    reverse index         (magic "RIDX")
-#
-# Git pairs them BY EXTENSION. Strip the extension off any one of them and git
-# stops seeing the set entirely: the objects are still on disk, byte for byte,
-# but they become unreachable. The repo then fails in a way that reads like
-# catastrophic history loss rather than a filename problem:
-#
-#   fatal: unable to read tree (<sha>)
-#   error: bad tree object HEAD
-#   error: refs/heads/<branch>: invalid sha1 pointer <sha>
-#
-# `git fsck` reports the objects as missing and `git gc` cannot help, because
-# nothing is actually corrupt — the bytes are intact and the repair is a
-# rename. That mismatch between how it presents and what it is makes this
-# failure expensive to diagnose from the error text alone, which is why this
-# check exists as a deterministic probe.
-#
-# Git never writes an extensionless `pack-*` file, so finding one is
-# unambiguous. Observed in the wild on a macOS HQ root where a folder-level
-# sync/backup agent had been walking the tree; the mechanism that drops the
-# extension is not established.
-#
-# Usage:
-#   git-pack-extension-check.sh [--root <path>] [--fix] [--quiet]
-#
-#   --root <path>   Repository to check (default: current directory).
-#   --fix           Rename each orphan back to the extension its magic bytes
-#                   prove it should carry. Without this the script only
-#                   reports.
-#   --quiet         Suppress the healthy-case line; findings still print.
-#
-# Exit codes:
-#   0  healthy, or every orphan was repaired under --fix
-#   1  usage error, or the root is not a git repository
-#   2  orphans found and left in place (report-only, or unrepairable)
-#
-# The repair is a rename and nothing else. It never deletes, never rewrites
-# file contents, never touches refs or the index, and refuses to overwrite an
-# existing target. A file whose magic bytes are not a known pack signature is
-# reported and left alone — this script will not guess.
-
-set -uo pipefail
-
-ROOT="."
-FIX=0
-QUIET=0
-
-while [[ $# -gt 0 ]]; do
-  case "$1" in
-    --root)
-      [[ $# -ge 2 ]] || { echo "git-pack-extension-check: --root needs a path" >&2; exit 1; }
-      ROOT="$2"; shift 2 ;;
-    --fix)   FIX=1; shift ;;
-    --quiet) QUIET=1; shift ;;
-    -h|--help)
-      sed -n '2,50p' "$0" | sed 's/^# \{0,1\}//'
-      exit 0 ;;
-    *)
-      echo "git-pack-extension-check: unknown argument '$1'" >&2
-      exit 1 ;;
-  esac
-done
-
-if [[ ! -d "$ROOT" ]]; then
-  echo "git-pack-extension-check: not a directory: $ROOT" >&2
-  exit 1
-fi
-
-# Packs live in the COMMON git dir, not the per-worktree one — a linked
-# worktree shares the main object store, so checking either resolves to the
-# same place. `--path-format=absolute` needs git 2.31+; the fallback keeps
-# this working on older hosts by resolving the (possibly relative) path
-# against the repo root itself.
-GIT_COMMON="$(git -C "$ROOT" rev-parse --path-format=absolute --git-common-dir 2>/dev/null || true)"
-if [[ -z "$GIT_COMMON" ]]; then
-  GIT_COMMON="$(git -C "$ROOT" rev-parse --git-common-dir 2>/dev/null || true)"
-  if [[ -z "$GIT_COMMON" ]]; then
-    echo "git-pack-extension-check: not a git repository: $ROOT" >&2
-    exit 1
-  fi
-  if [[ "$GIT_COMMON" != /* ]]; then
-    GIT_COMMON="$(cd "$ROOT" && cd "$GIT_COMMON" 2>/dev/null && pwd || true)"
-  fi
-fi
-
-PACK_DIR="$GIT_COMMON/objects/pack"
-if [[ ! -d "$PACK_DIR" ]]; then
-  [[ "$QUIET" == "1" ]] || echo "git-pack-extension-check: no pack directory, nothing to check"
-  exit 0
-fi
-
-# The magic bytes are read with `od` rather than compared as shell strings:
-# a packfile is binary and its first bytes can include NUL, which a shell
-# variable cannot hold.
-magic_of() {
-  od -A n -t x1 -N 4 "$1" 2>/dev/null | tr -d ' \n'
-}
-
-FOUND=0
-REPAIRED=0
-UNREPAIRED=0
-
-# NUL-delimited: a mangled filename is exactly the case where a newline in a
-# name would split the list and corrupt the scan.
-while IFS= read -r -d '' orphan; do
-  base="$(basename "$orphan")"
-  hex="$(magic_of "$orphan")"
-  case "$hex" in
-    5041434b) ext="pack" ;;   # "PACK"
-    ff744f63) ext="idx"  ;;   # "\377tOc"
-    52494458) ext="rev"  ;;   # "RIDX"
-    *)        ext="" ;;
-  esac
-
-  FOUND=$((FOUND + 1))
-
-  if [[ -z "$ext" ]]; then
-    echo "git-pack-extension-check: FOUND $base — extensionless, but its magic bytes (${hex:-empty}) are not a pack/idx/rev signature; leaving it alone" >&2
-    UNREPAIRED=$((UNREPAIRED + 1))
-    continue
-  fi
-
-  target="$orphan.$ext"
-  if [[ -e "$target" ]]; then
-    echo "git-pack-extension-check: FOUND $base — should be $base.$ext, but that file already exists; resolve by hand" >&2
-    UNREPAIRED=$((UNREPAIRED + 1))
-    continue
-  fi
-
-  if [[ "$FIX" != "1" ]]; then
-    echo "git-pack-extension-check: FOUND $base — lost its .$ext extension; git cannot see this pack set. Re-run with --fix to rename it." >&2
-    UNREPAIRED=$((UNREPAIRED + 1))
-    continue
-  fi
-
-  if mv -n "$orphan" "$target" 2>/dev/null && [[ -e "$target" && ! -e "$orphan" ]]; then
-    echo "git-pack-extension-check: REPAIRED $base -> $base.$ext"
-    REPAIRED=$((REPAIRED + 1))
-  else
-    echo "git-pack-extension-check: FAILED to rename $base -> $base.$ext" >&2
-    UNREPAIRED=$((UNREPAIRED + 1))
-  fi
-done < <(find "$PACK_DIR" -maxdepth 1 -type f -name 'pack-*' ! -name '*.*' -print0 2>/dev/null)
-
-if [[ "$FOUND" -eq 0 ]]; then
-  [[ "$QUIET" == "1" ]] || echo "git-pack-extension-check: ok — no extensionless pack files in $PACK_DIR"
-  exit 0
-fi
-
-if [[ "$UNREPAIRED" -gt 0 ]]; then
-  echo "git-pack-extension-check: ${FOUND} orphan(s), ${REPAIRED} repaired, ${UNREPAIRED} still broken" >&2
-  exit 2
-fi
-
-echo "git-pack-extension-check: ${REPAIRED} pack file(s) repaired — re-run 'git fsck' to confirm"
-exit 0