@intutic/cli 1.9.0 → 1.10.1

package/dist/lib/sopFrontMatter.js

@@ -0,0 +1,129 @@
+/**
+ * Split a local SOP file's front matter from its body, and pull out the
+ * three fields `intutic sops push`/`pull` can carry faithfully today
+ * (title, risk_tier, version) — declarative enforcement keys (deny_tools,
+ * requires_before, scope_paths, ...) have no `sop_registry` column to land
+ * in, so they stay embedded in `body` verbatim, exactly as the proxy's own
+ * file-plane parser leaves them for a human or the proxy to read, never the
+ * control plane.
+ *
+ * Deliberately not a YAML parser, mirroring `packages/proxy/src/sops.rs`'s
+ * own `parse_front_matter`: the front-matter block only ever needs
+ * `key: value` scalar lines here, and taking a YAML dependency to read three
+ * of them is a poor trade for a CLI that ships as a single binary.
+ *
+ * @module
+ */
+import { createHash } from 'node:crypto';
+const VALID_RISK_TIERS = ['LOW', 'MEDIUM', 'HIGH', 'CRITICAL'];
+/** One `key:` scalar line's value, trimmed and unquoted — `null` if the key never appears. */
+function scalar(front, key) {
+    for (const line of front.split('\n')) {
+        const trimmedLine = line.trim();
+        if (!trimmedLine.startsWith(key))
+            continue;
+        const value = trimmedLine.slice(key.length).trim().replace(/^['"]|['"]$/g, '').trim();
+        return value.length > 0 ? value : null;
+    }
+    return null;
+}
+export function parseSopFile(raw) {
+    const trimmed = raw.trimStart();
+    let front = '';
+    let body = raw.trim();
+    if (trimmed.startsWith('---')) {
+        const rest = trimmed.slice(3);
+        const end = rest.indexOf('\n---');
+        // No closing fence: the whole thing is body, matching sops.rs's
+        // `FrontMatter::body_only` fallback for an unterminated fence.
+        if (end !== -1) {
+            front = rest.slice(0, end);
+            body = rest.slice(end + 4).replace(/^[ \t]*\n/, '').trim();
+        }
+    }
+    const riskRaw = scalar(front, 'risk_tier:')?.toUpperCase() ?? null;
+    const riskTier = riskRaw && VALID_RISK_TIERS.includes(riskRaw)
+        ? riskRaw
+        : null;
+    let title = scalar(front, 'title:');
+    if (!title) {
+        const h1 = body.match(/^#\s+(.+)$/m);
+        if (h1)
+            title = h1[1].trim();
+    }
+    return {
+        title,
+        riskTier,
+        version: scalar(front, 'version:'),
+        contentHash: scalar(front, 'content_hash:'),
+        body,
+    };
+}
+/**
+ * Render a pulled SOP back into a front-matter-carrying file, with
+ * `content_hash:` recording `sha256(body)` at write time — the marker
+ * `runSopsPull` compares against on a later pull to tell "the DB changed
+ * upstream" (safe to overwrite) from "a human hand-edited this file since
+ * the last pull" (refuse without `--force`).
+ */
+export function renderSopFile(sop) {
+    const hash = createHash('sha256').update(sop.body, 'utf8').digest('hex');
+    return [
+        '---',
+        `title: ${sop.title}`,
+        `risk_tier: ${sop.riskTier}`,
+        `version: ${sop.version}`,
+        `content_hash: ${hash}`,
+        '---',
+        '',
+        sop.body,
+        '',
+    ].join('\n');
+}
+/** `Deploy Checklist` / `deploy checklist!!` → `deploy-checklist`. */
+export function slugifyTitle(title) {
+    const slug = title
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug.length > 0 ? slug : 'untitled';
+}
+/** `postgres-migration` → `Postgres Migration`; `deploy_checklist.md` → `Deploy Checklist`. */
+export function titleFromFileName(fileName) {
+    const stem = fileName.replace(/\.md$/i, '');
+    return stem
+        .split(/[-_]/)
+        .filter((w) => w.length > 0)
+        .map((w) => w.charAt(0).toUpperCase() + w.slice(1))
+        .join(' ');
+}
+/**
+ * Add `intutic sops pull`'s `content_hash:` marker to a file that already
+ * carries its own front matter — a projected guardrail, whose fence holds
+ * the enforcing keys the proxy reads (LLD #71, Wave 9).
+ *
+ * Not `renderSopFile`: that wraps a second fence around the text, and the
+ * proxy reads only the first, so the enforcing keys would become body prose
+ * and the rule would load, be listed, and never fire. The marker goes INSIDE
+ * the existing fence, as the last line before it closes; the hash is over
+ * what `parseSopFile` will read back as `body`, so the dirty check is the
+ * same one `sops pull` runs. A file with no fence gets one holding only the
+ * marker. Unknown keys are inert to the proxy, so enforcement is unchanged.
+ */
+export function withContentHash(raw) {
+    const trimmed = raw.trimStart();
+    const body = parseSopFile(raw).body;
+    const hash = createHash('sha256').update(body, 'utf8').digest('hex');
+    if (trimmed.startsWith('---')) {
+        const rest = trimmed.slice(3);
+        const end = rest.indexOf('\n---');
+        if (end !== -1) {
+            const front = rest.slice(0, end).split('\n').filter((l) => !l.trim().startsWith('content_hash:')).join('\n');
+            const after = rest.slice(end);
+            return `---${front}\ncontent_hash: ${hash}${after}`;
+        }
+    }
+    return ['---', `content_hash: ${hash}`, '---', '', body, ''].join('\n');
+}
+//# sourceMappingURL=sopFrontMatter.js.map

package/dist/lib/sopFrontMatter.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sopFrontMatter.js","sourceRoot":"","sources":["../../src/lib/sopFrontMatter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAA;AAIxC,MAAM,gBAAgB,GAA2B,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,CAAC,CAAA;AAmBtF,8FAA8F;AAC9F,SAAS,MAAM,CAAC,KAAa,EAAE,GAAW;IACxC,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;QAC/B,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC1C,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QACrF,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACxC,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,GAAW;IACtC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,IAAI,KAAK,GAAG,EAAE,CAAA;IACd,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,EAAE,CAAA;IAErB,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,gEAAgE;QAChE,+DAA+D;QAC/D,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAA;YAC1B,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAA;QAC5D,CAAC;IACH,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,CAAA;IAClE,MAAM,QAAQ,GAAG,OAAO,IAAK,gBAAsC,CAAC,QAAQ,CAAC,OAAO,CAAC;QACnF,CAAC,CAAE,OAAuB;QAC1B,CAAC,CAAC,IAAI,CAAA;IAER,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACnC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;QACpC,IAAI,EAAE;YAAE,KAAK,GAAG,EAAE,CAAC,CAAC,CAAE,CAAC,IAAI,EAAE,CAAA;IAC/B,CAAC;IAED,OAAO;QACL,KAAK;QACL,QAAQ;QACR,OAAO,EAAE,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;QAClC,WAAW,EAAE,MAAM,CAAC,KAAK,EAAE,eAAe,CAAC;QAC3C,IAAI;KACL,CAAA;AACH,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAK7B;IACC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACxE,OAAO;QACL,KAAK;QACL,UAAU,GAAG,CAAC,KAAK,EAAE;QACrB,cAAc,GAAG,CAAC,QAAQ,EAAE;QAC5B,YAAY,GAAG,CAAC,OAAO,EAAE;QACzB,iBAAiB,IAAI,EAAE;QACvB,KAAK;QACL,EAAE;QACF,GAAG,CAAC,IAAI;QACR,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACd,CAAC;AAED,sEAAsE;AACtE,MAAM,UAAU,YAAY,CAAC,KAAa;IACxC,MAAM,IAAI,GAAG,KAAK;SACf,IAAI,EAAE;SACN,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAA;IAC1B,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,UAAU,CAAA;AAC5C,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,iBAAiB,CAAC,QAAgB;IAChD,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAA;IAC3C,OAAO,IAAI;SACR,KAAK,CAAC,MAAM,CAAC;SACb,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SAC3B,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;SAClD,IAAI,CAAC,GAAG,CAAC,CAAA;AACd,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,MAAM,OAAO,GAAG,GAAG,CAAC,SAAS,EAAE,CAAA;IAC/B,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,CAAA;IACnC,MAAM,IAAI,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAA;IACpE,IAAI,OAAO,CAAC,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;QAC7B,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;QACjC,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;YACf,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,UAAU,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YAC5G,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;YAC7B,OAAO,MAAM,KAAK,mBAAmB,IAAI,GAAG,KAAK,EAAE,CAAA;QACrD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,KAAK,EAAE,iBAAiB,IAAI,EAAE,EAAE,KAAK,EAAE,EAAE,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;AACzE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@intutic/cli",
-  "version": "1.9.0",
+  "version": "1.10.1",
   "description": "Intutic CLI — sync daemon, harness detection, and workspace management",
   "type": "module",
   "bin": {
@@ -30,22 +30,27 @@
     "node": ">=20.19.0"
   },
   "dependencies": {
+    "@opentelemetry/api": "^1.9.1",
+    "@opentelemetry/core": "^2.10.0",
+    "@clack/prompts": "^1.7.0",
     "chokidar": "^5.0.0",
     "commander": "^13",
     "ioredis": "^5.11.1",
     "picocolors": "^1",
-    "@intutic/id": "1.9.0",
-    "@intutic/logger": "1.9.0",
-    "@intutic/shared-types": "1.9.0",
-    "@intutic/sync-daemon": "1.9.0"
+    "@intutic/shared-types": "1.10.1",
+    "@intutic/id": "1.10.1",
+    "@intutic/logger": "1.10.1",
+    "@intutic/sync-daemon": "1.10.1"
   },
   "devDependencies": {
     "typescript": "^5.5",
     "tsx": "^4",
     "@types/node": "^22",
-    "vitest": "^3"
+    "vitest": "^4",
+    "@yao-pkg/pkg": "6.22.0"
   },
   "scripts": {
+    "lint": "eslint src",
     "build": "rm -rf dist && tsc -p tsconfig.build.json",
     "dev": "tsc -w -p tsconfig.build.json",
     "typecheck": "tsc --noEmit",