@ionivetech/mugiwara 0.6.5 → 0.6.6

package/scripts/coverage-gate.ts

@@ -0,0 +1,179 @@
+#!/usr/bin/env bun
+// scripts/coverage-gate.ts — enforce the `coverage_new` / `coverage_modified`
+// thresholds declared in `.mugiwara/config` against the files THIS diff adds
+// and changes, not against a global project number. Two keys exist precisely
+// because the two populations are judged differently (mugiwara-gates SKILL.md
+// §Coverage gate); a global percentage would collapse them into one and let an
+// untested new file hide behind an old well-tested one.
+//
+// Run: bun scripts/coverage-gate.ts            enforce (gate step)
+//      bun scripts/coverage-gate.ts --base X   compare against ref X
+//      bun scripts/coverage-gate.ts --show     print per-file numbers, never fail
+//
+// Exit 0 = pass or recorded SKIP. Exit 1 = a threshold was missed.
+// A repo with no coverage tooling or no test suite records a SKIP with its
+// reason — never a fake pass (decision log row 50).
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { execFileSync, spawnSync } from 'node:child_process';
+import { homedir } from 'node:os';
+import { join, relative, sep } from 'node:path';
+
+const root = join(import.meta.dirname, '..');
+const SHOW = process.argv.includes('--show');
+
+/** `.mugiwara/config` → project, then `~`. Returns undefined if the key is set nowhere. */
+function config(key: string): string | undefined {
+  for (const base of [root, homedir()]) {
+    const file = join(base, '.mugiwara', 'config');
+    if (!existsSync(file)) continue;
+    // \r?\n: a config written on Windows is still a config
+    for (const line of readFileSync(file, 'utf8').split(/\r?\n/)) {
+      const t = line.trim();
+      if (!t || t.startsWith('#')) continue;
+      const eq = t.indexOf('=');
+      if (eq === -1) continue;
+      if (t.slice(0, eq).trim() !== key) continue;
+      return t.slice(eq + 1).trim();
+    }
+  }
+  return undefined;
+}
+
+/** Documented defaults: new >= 90, modified >= 80. A key set to 0 = no threshold. */
+function threshold(key: string, fallback: number): number {
+  const raw = config(key);
+  if (raw === undefined || raw === '') return fallback;
+  const n = Number(raw);
+  if (!Number.isFinite(n) || n < 0 || n > 100) {
+    console.log(`coverage-gate: ignoring unparseable ${key}="${raw}", using ${fallback}`);
+    return fallback;
+  }
+  return n;
+}
+
+function skip(reason: string): never {
+  console.log(`coverage-gate: SKIP — ${reason}`);
+  process.exit(0);
+}
+
+function git(args: string[]): string {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+}
+
+// ---- 1. is there anything to measure at all? -------------------------------
+
+const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8'));
+const deps = { ...pkg.dependencies, ...pkg.devDependencies };
+if (!deps['@vitest/coverage-v8'] && !deps['@vitest/coverage-istanbul'])
+  skip('no coverage tooling installed (no @vitest/coverage-* in package.json)');
+if (!existsSync(join(root, 'test')))
+  skip('no test suite found (no test/ directory)');
+
+// ---- 2. which files does this diff add and change? ------------------------
+
+const baseArg = process.argv.indexOf('--base');
+let base = baseArg !== -1 ? process.argv[baseArg + 1] : process.env.MUGIWARA_COVERAGE_BASE;
+if (!base) {
+  // the mission's own recorded base_sha is the truthful diff origin
+  const stateDir = join(root, '.mugiwara', 'state');
+  if (existsSync(stateDir)) {
+    for (const m of readdirSync(stateDir)) {
+      const f = join(stateDir, m, 'state.json');
+      if (!existsSync(f)) continue;
+      const sha = JSON.parse(readFileSync(f, 'utf8')).base_sha;
+      if (sha) { base = sha; break; }
+    }
+  }
+}
+if (!base) {
+  for (const ref of ['origin/main', 'main', 'origin/master', 'master']) {
+    try { base = git(['merge-base', 'HEAD', ref]); break; } catch { /* next */ }
+  }
+}
+if (!base) skip('no diff base could be resolved (no state base_sha, no main/master ref)');
+
+let changed: Array<{ status: string; path: string }>;
+try {
+  changed = git(['diff', '--name-status', '--diff-filter=AMR', '-M', `${base}`, 'HEAD'])
+    .split(/\r?\n/)
+    .filter(Boolean)
+    .map((l) => {
+      const parts = l.split('\t');
+      // rename rows are `R096\told\tnew` — the new path is the one to judge
+      return { status: parts[0][0], path: parts[parts.length - 1] };
+    });
+} catch (e) {
+  skip(`git diff against ${base} failed (${(e as Error).message})`);
+}
+
+if (!changed.length) skip(`no added or modified files between ${base.slice(0, 7)} and HEAD`);
+
+// ---- 3. measure ------------------------------------------------------------
+
+const summaryPath = join(root, 'coverage', 'coverage-summary.json');
+const needsRun =
+  !existsSync(summaryPath) ||
+  statSync(summaryPath).mtimeMs < Math.max(...changed
+    .map((c) => join(root, c.path))
+    .filter(existsSync)
+    .map((p) => statSync(p).mtimeMs), 0);
+
+if (needsRun) {
+  console.log('coverage-gate: measuring (vitest run --coverage)...');
+  const r = spawnSync('npx', ['vitest', 'run', '--coverage', '--silent'], {
+    cwd: root, stdio: 'inherit', shell: process.platform === 'win32',
+  });
+  if (r.status !== 0) {
+    console.log('coverage-gate: FAIL — test run did not pass, coverage is not measurable');
+    process.exit(1);
+  }
+}
+if (!existsSync(summaryPath))
+  skip('coverage run produced no coverage-summary.json (json-summary reporter not configured)');
+
+const summary = JSON.parse(readFileSync(summaryPath, 'utf8'));
+// keys are absolute OS paths; normalise to repo-relative posix to match git
+const measured = new Map<string, number>();
+for (const [k, v] of Object.entries<any>(summary)) {
+  if (k === 'total') continue;
+  measured.set(relative(root, k).split(sep).join('/'), v.lines?.pct ?? 0);
+}
+
+// ---- 4. apply the two thresholds ------------------------------------------
+
+const NEW = threshold('coverage_new', 90);
+const MOD = threshold('coverage_modified', 80);
+
+const rows = changed.map((c) => {
+  const isNew = c.status === 'A';
+  return {
+    path: c.path,
+    kind: isNew ? 'new' : 'modified',
+    limit: isNew ? NEW : MOD,
+    pct: measured.get(c.path),
+  };
+});
+
+const scoped = rows.filter((r) => r.pct !== undefined);
+const unscoped = rows.filter((r) => r.pct === undefined);
+
+console.log(`coverage-gate: base ${base.slice(0, 7)} · thresholds new>=${NEW || 'off'} modified>=${MOD || 'off'}`);
+console.log(`  ${changed.length} changed file(s), ${scoped.length} within coverage scope, ${unscoped.length} outside it`);
+
+const failures = scoped.filter((r) => r.limit > 0 && (r.pct as number) < r.limit);
+
+for (const r of scoped.sort((a, b) => (a.pct as number) - (b.pct as number))) {
+  const bad = r.limit > 0 && (r.pct as number) < r.limit;
+  if (SHOW || bad || (r.pct as number) < 100)
+    console.log(`  ${bad ? '✗' : '✓'} ${r.path} — ${(r.pct as number).toFixed(2)}% ${r.kind} (limit ${r.limit || 'off'})`);
+}
+if (SHOW && unscoped.length)
+  console.log(unscoped.map((r) => `  · ${r.path} — outside coverage scope (not a measured source file)`).join('\n'));
+
+if (SHOW) process.exit(0);
+if (failures.length) {
+  console.log(`\ncoverage-gate: FAIL — ${failures.length} file(s) below their threshold`);
+  console.log('Do not lower the thresholds or exclude files to pass: add the missing tests.');
+  process.exit(1);
+}
+console.log('\ncoverage-gate: PASS');

package/scripts/install.ps1

@@ -2,12 +2,13 @@
 $ErrorActionPreference = 'Stop'
 
 if (-not (Get-Command node -ErrorAction SilentlyContinue)) {
-  Write-Error 'mugiwara requires Node.js >= 20. Install it from https://nodejs.org first.'
+  Write-Error 'mugiwara requires Node.js >= 20.11. Install it from https://nodejs.org first.'
 }
 
-$major = [int](node -p 'process.versions.node.split(".")[0]')
-if ($major -lt 20) {
-  Write-Error "mugiwara requires Node.js >= 20 (found $(node --version))."
+# floor must match package.json "engines.node" exactly, and install.sh
+node -e 'const [a,b]=process.versions.node.split(".").map(Number);process.exit(a>20||(a===20&&b>=11)?0:1)'
+if ($LASTEXITCODE -ne 0) {
+  Write-Error "mugiwara requires Node.js >= 20.11 (found $(node --version))."
 }
 
 npx -y @ionivetech/mugiwara@latest @args

package/scripts/install.sh

@@ -4,13 +4,13 @@ set -euo pipefail
 PKG="@ionivetech/mugiwara"
 
 if ! command -v node >/dev/null 2>&1; then
-  echo "mugiwara requires Node.js >= 20. Install it first: https://nodejs.org" >&2
+  echo "mugiwara requires Node.js >= 20.11. Install it first: https://nodejs.org" >&2
   exit 1
 fi
 
-MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
-if [ "$MAJOR" -lt 20 ]; then
-  echo "mugiwara requires Node.js >= 20 (found $(node --version))." >&2
+# floor must match package.json "engines.node" exactly, and install.ps1
+if ! node -e 'const [a,b]=process.versions.node.split(".").map(Number);process.exit(a>20||(a===20&&b>=11)?0:1)'; then
+  echo "mugiwara requires Node.js >= 20.11 (found $(node --version))." >&2
   exit 1
 fi
 

package/scripts/lane.sh

@@ -19,9 +19,13 @@ if ! git rev-parse "$BASE" >/dev/null 2>&1; then
   [ -n "$ALT" ] && BASE="$ALT" || BASE="HEAD~1"
 fi
 
-CHANGED=$(git diff --name-only "$BASE"..HEAD 2>/dev/null || git diff --name-only --cached 2>/dev/null || true)
+# union of committed + staged + unstaged + untracked (F) — see patterns.sh
+CHANGED=$(changed_files "$BASE")
 FILE_COUNT=0
 [ -n "$CHANGED" ] && FILE_COUNT=$(echo "$CHANGED" | wc -l | tr -d ' ')
+read -r ADDED_INS ADDED_DEL <<EOF
+$(changed_loc "$BASE")
+EOF
 
 SENSITIVE=$(echo "$CHANGED" | grep -E "$SENSITIVE_PATS" 2>/dev/null | tr '\n' ',' | sed 's/,$//' || true)
 HAS_SENSITIVE=0
@@ -35,7 +39,7 @@ if [ "$FILE_COUNT" -eq 0 ] 2>/dev/null; then
   LANE="direct"
   REASON="no changed files"
 elif [ "$FILE_COUNT" -le 1 ] 2>/dev/null; then
-  ADDED=$(git diff --numstat "$BASE"..HEAD 2>/dev/null | awk '{s+=$1} END {print s+0}' || echo 0)
+  ADDED="${ADDED_INS:-0}"
   if [ "$ADDED" -lt 20 ] 2>/dev/null; then
     LANE="direct"
     REASON="1 file, <20 LOC"

package/scripts/lib/patterns.sh

@@ -19,3 +19,87 @@ SENSITIVE_PATS="auth/|oauth2?/|payment/|payments/|billing/|crypto/|secrets/|cred
 # outside this surface are docs/config/asset and never escalate to full on
 # count alone (path-weighted sizing).
 PRODUCT_PAT="^content/|^src/|^scripts/|^test/|^hooks/|^\.opencode/|^\.claude/|^evals/"
+
+# Installed-harness rules dirs — what `mugiwara install` writes into a project
+# (~50 files across the 9 targets). In a CONSUMER project these are installed
+# config, no different from the crew's own .mugiwara/ bookkeeping: the first
+# savepoint after an install counted them and sized every fresh mission Lane 3
+# before a single line of the user's own work existed. In MUGIWARA'S OWN repo
+# the same dirs are the product surface (they are in PRODUCT_PAT), so the
+# exclusion is conditional on the repo identity, never unconditional.
+# Unanchored on purpose — call sites anchor with ^ (name lists) or a tab
+# (numstat rows).
+HARNESS_PAT="\.claude/|\.opencode/|\.github/(instructions|agents)/|\.gemini/mugiwara/|\.codex/mugiwara/|\.devin/rules/|\.clinerules/|\.kilo/rules/|\.agents/rules/"
+
+# harness_excluded — true (exit 0) when harness rules dirs must NOT count
+# toward mission sizing, i.e. this repo is not mugiwara itself. Identity comes
+# from the repo root package.json name ("mugiwara" or "@scope/mugiwara"), the
+# same manifest savepoint already trusts for skill_version.
+harness_excluded() {
+  local root
+  root=$(git rev-parse --show-toplevel 2>/dev/null || echo .)
+  ! grep -qE '"name"[[:space:]]*:[[:space:]]*"(@[^"/]+/)?mugiwara"' "$root/package.json" 2>/dev/null
+}
+
+# drop_harness <anchor> — filter stdin, dropping harness paths in consumer
+# repos and passing everything through in mugiwara's own.
+drop_harness() {
+  if harness_excluded; then grep -vE "$1($HARNESS_PAT)" || true; else cat; fi
+}
+
+# --- working-tree-aware change set (F) -------------------------------------
+# `git diff BASE..HEAD` alone is blind to uncommitted work, and the old
+# `|| git diff --cached` fallback was dead code (|| fires on non-zero exit,
+# never on empty output). With auto_commit=off nothing is committed, so lane
+# sizing and files_touched read 0 while the tree holds real changes.
+# These two helpers are the single source of truth for BOTH lane.sh and
+# savepoint.sh so the two can never drift (lane-integrity case 15).
+
+# Path of the crew's bookkeeping dir, relative to the repo root. MUGIWARA_DIR
+# may be absolute (the harness passes a full path); git reports repo-relative
+# paths, so normalize before comparing.
+mugiwara_rel() {
+  local d="${MUGIWARA_DIR:-.mugiwara}" root
+  case "$d" in
+    /*) root=$(git rev-parse --show-toplevel 2>/dev/null || true)
+        [ -n "$root" ] && d="${d#"$root"/}"
+        # symlinked repo roots (/var vs /private/var on macOS) defeat the
+        # prefix strip; fall back to the leaf name, which is what git reports.
+        case "$d" in /*) d=$(basename "$d") ;; esac ;;
+  esac
+  printf '%s' "$d"
+}
+
+# changed_files <base-ref> — union of committed (BASE..HEAD), staged, unstaged
+# and untracked files. .gitignore'd files are excluded (git status default),
+# and so is the crew's own .mugiwara/ bookkeeping: savepoint writes state on
+# every wave, and mission state must never size the mission it measures.
+changed_files() {
+  local base="${1:-}"
+  {
+    if [ -n "$base" ] && [ "$base" != "unknown" ]; then
+      git diff --name-only "$base"..HEAD 2>/dev/null || true
+    fi
+    # porcelain covers staged + unstaged + untracked in one pass; strip the
+    # 2-char status + space, and keep the destination side of a rename.
+    git status --porcelain --untracked-files=all 2>/dev/null | sed 's/^...//; s/^.* -> //' || true
+  } | grep -v '^[[:space:]]*$' | grep -v "^$(mugiwara_rel)/" | drop_harness '^' | sort -u
+}
+
+# changed_loc <base-ref> — echoes "<insertions> <deletions>" over the same
+# union. Untracked files count every line as an insertion.
+changed_loc() {
+  local base="${1:-}" MUGI_REL
+  MUGI_REL=$(mugiwara_rel)
+  {
+    if [ -n "$base" ] && [ "$base" != "unknown" ]; then
+      git diff --numstat "$base"..HEAD 2>/dev/null || true
+    fi
+    git diff --numstat HEAD 2>/dev/null || true
+    git ls-files --others --exclude-standard 2>/dev/null | while IFS= read -r f; do
+      [ -f "$f" ] || continue
+      case "$f" in "$MUGI_REL"/*) continue ;; esac
+      printf '%s\t0\t%s\n' "$(wc -l < "$f" 2>/dev/null | tr -d ' ' || echo 0)" "$f"
+    done
+  } | grep -v "	$MUGI_REL/" | drop_harness '	' | awk '{ if ($1 ~ /^[0-9]+$/) i+=$1; if ($2 ~ /^[0-9]+$/) d+=$2 } END { print (i+0)" "(d+0) }'
+}

package/scripts/mission-report.sh

@@ -70,11 +70,12 @@ const now = new Date().toISOString().slice(0, 10);
 const reportFile = path.join(reportDir, now + "-" + mission + ".md");
 const lane = val(s, 'lane', 'n/a');
 const lanePeak = val(s, 'lane_peak', 'n/a');
+const laneRose = val(s, 'lane_rose', false);
 const laneReason = val(s, 'lane_reason', 'n/a');
 const mode = val(s, 'mode', 'n/a');
 const actor = val(s, 'actor', 'n/a');
 const branch = val(s, 'branch', 'n/a');
-const wave = val(s, 'wave', 'n/a');
+const wave = val(s, 'flow', val(s, 'wave', 'n/a'));
 const filesTouched = val(s, 'files_touched', 0);
 const locDelta = val(s, 'loc_delta', 0);
 const locChurn = val(s, 'loc_churn', 0);
@@ -91,12 +92,12 @@ const updated = val(s, 'updated_at', now);
 
 // --- wave artifact scan: results/<mission>/NN-*.md with verdict sniffing ---
 const WAVE_LABEL = {
-  "01-execution": "Execute (Wave 3)",
-  "02-audit": "Checkpoint (Wave 4)",
-  "03-quality": "Quality (Wave 5)",
-  "04-gates": "Gates (Wave 6)",
-  "05-healing": "Healing (Wave 8)",
-  "06-closure": "Closure (Wave 9)",
+  "01-execution": "Execute (Flow 3)",
+  "02-audit": "Checkpoint (Flow 4)",
+  "03-quality": "Quality (Flow 5)",
+  "04-gates": "Gates (Flow 6)",
+  "05-healing": "Healing (Flow 8)",
+  "06-closure": "Closure (Flow 9)",
   "07-pr-verdict": "PR material",
 };
 
@@ -227,11 +228,11 @@ let report = "# Mission: " + mission + " . " + now + "\n\n";
 report += "## Mission header\n\n| Field | Value |\n|-------|-------|\n";
 report += "| Mission | " + mission + " |\n";
 report += "| Branch | " + branch + " |\n";
-report += "| Lane | " + lane + " |\n";
+report += "| Lane | " + lane + (laneRose ? " ⬆ ROSE" : "") + " |\n";
 report += "| Lane peak | " + lanePeak + " |\n";
 report += "| Lane reason | " + laneReason + " |\n";
 report += "| Mode | " + mode + " |\n";
-report += "| Wave | " + wave + " |\n";
+report += "| Flow | " + wave + " |\n";
 report += "| Actor | " + actor + " |\n\n";
 
 report += "## Token budget\n\n| Field | Value |\n|-------|-------|\n";
@@ -252,7 +253,7 @@ report += filesTouched + " files, +" + locDelta + " LOC (" + locChurn + " churn)
 if (sensitive.length) report += "\nSensitive paths: " + sensitive.join(", ");
 report += "\n\n";
 
-report += "## Waves\n\n| Wave | Artifact | Verdict |\n|------|----------|---------|";
+report += "## Flow stages\n\n| Flow stage | Artifact | Verdict |\n|------|----------|---------|";
 if (waveRows.length) {
   for (const r of waveRows) report += "\n| " + r.label + " | `" + r.file + "` | " + r.verdict + " |";
 } else {
@@ -277,7 +278,7 @@ report += "Blocker ledger rows: " + issueRows.length + (issueRows.length ? "\n"
 report += "\n\n";
 
 report += "## State\n\n| Field | Value |\n|-------|-------|\n";
-report += "| Wave | " + wave + " |\n";
+report += "| Flow | " + wave + " |\n";
 report += "| Tasks | " + (tasks.done || 0) + "/" + (tasks.total || 0) + " done |\n";
 report += "| Blockers open | " + blockers + " |\n";
 report += "| Heal cycles | " + healCycle + " |\n";