@jwilger/pi-development-system 0.8.1 → 0.8.2

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@jwilger/pi-development-system",
-  "version": "0.8.1",
+  "version": "0.8.2",
   "description": "A pi extension package representing a seasoned approach to software development using a full AI SDLC.",
   "keywords": [
     "pi-package"

package/skills/delivery-discipline/SKILL.md

@@ -41,7 +41,8 @@ check now uses expiry; clock-skew tolerance is deliberately not added.
 
 Do not start unrelated work while trunk CI is red. Fix it first; a red build
 hides every later failure. A push to a red trunk is a hard stop unless the
-commit is `fix(ci): ...` and its diff only repairs the failing build. If `gh`
+commit is a `fix` and Jev reads its diff as only repairing the failing run (it needs
+the failing log and Jev online; otherwise the push is a hard stop). If `gh`
 is missing or unauthenticated, CI reads as unknown and the push is allowed:
 check CI by other means before relying on it.
 

package/src/core/commit-command.ts

@@ -10,15 +10,17 @@ const HEREDOC =
   /<<-?[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\1[^\n]*\n([\s\S]*?)\n[ \t]*\2[ \t]*(?:\n|$)/g;
 
 /** Heredoc bodies are data: take them out so their quotes cannot confuse line splitting. */
-function stripHeredocs(command: string): { rest: string; bodies: string[] } {
-  const bodies: string[] = [];
-  const rest = command.replace(HEREDOC, (_all, _quote, _tag, body: string) => {
-    bodies.push(body);
+function stripHeredocs(command: string): { rest: string; bodies: Heredoc[] } {
+  const bodies: Heredoc[] = [];
+  const rest = command.replace(HEREDOC, (...m: unknown[]) => {
+    bodies.push({ body: String(m[3]), at: Number(m[m.length - 2]) });
     return "\n";
   });
   return { rest, bodies };
 }
 
+type Heredoc = { readonly body: string; readonly at: number };
+
 type Options = {
   messages: string[];
   trailers: string[];
@@ -39,12 +41,26 @@ const LONG: ReadonlyArray<readonly [string, Parsed["kind"]]> = [
   ["--trailer", "trailer"],
 ];
 
+/** The option a `--name`/`--na=value` spelling means; git accepts any unambiguous prefix (3+ chars). */
+function longOption(arg: string): { kind: Parsed["kind"]; inline: string | undefined } | undefined {
+  if (!arg.startsWith("--")) return undefined;
+  const eq = arg.indexOf("=");
+  const name = eq < 0 ? arg : arg.slice(0, eq);
+  if (name.length < 5) return undefined;
+  const hit = LONG.find(([long]) => long.startsWith(name));
+  return hit === undefined
+    ? undefined
+    : { kind: hit[1], inline: eq < 0 ? undefined : arg.slice(eq + 1) };
+}
+
 /** Reads the message/file/trailer option starting at args[i], in any of its spellings. */
 function parseArg(args: readonly string[], i: number): Parsed | undefined {
   const a = args[i] ?? "";
-  for (const [name, kind] of LONG) {
-    if (a === name) return { kind, value: args[i + 1], next: i + 2 };
-    if (a.startsWith(`${name}=`)) return { kind, value: a.slice(name.length + 1), next: i + 1 };
+  const long = longOption(a);
+  if (long !== undefined) {
+    return long.inline === undefined
+      ? { kind: long.kind, value: args[i + 1], next: i + 2 }
+      : { kind: long.kind, value: long.inline, next: i + 1 };
   }
   if (a === "-F") return { kind: "file", value: args[i + 1], next: i + 2 };
   if (/^-F./.test(a)) return { kind: "file", value: a.slice(2), next: i + 1 };
@@ -75,24 +91,44 @@ const unknown = (trailers: readonly string[] = []): CommitExtraction => ({
   trailers,
 });
 
-/** The commit message a `git commit` shell command will use, or why it cannot be known. */
-export function extractCommit(command: string): CommitExtraction {
-  const { rest, bodies } = stripHeredocs(command);
-  const heredoc = bodies[0]?.trim();
-  const resolution = resolveGit(rest);
-  const commit = resolution.invocations.find((g) => g.sub === "commit");
-  if (commit === undefined) {
-    return resolution.opaque && /\bcommit\b/.test(command) ? unknown() : { kind: "not-commit" };
-  }
-  const options = readOptions(commit.args);
-  if (options.file === "-" && heredoc !== undefined) return { kind: "message", message: heredoc };
-  if (options.file !== undefined) return { kind: "file", path: options.file };
-  if (options.opaque) {
+const STDIN_PATHS = new Set(["-", "/dev/stdin", "/proc/self/fd/0"]);
+
+/** The heredoc that is this commit's input: the first one written after the word `commit`. */
+const heredocFor = (command: string, bodies: readonly Heredoc[]): string | undefined => {
+  const from = command.search(/\bcommit\b/);
+  return bodies.find((h) => h.at >= from)?.body.trim();
+};
+
+function extractOne(args: readonly string[], heredoc: string | undefined): CommitExtraction {
+  const options = readOptions(args);
+  if (options.file !== undefined && STDIN_PATHS.has(options.file)) {
     return heredoc === undefined
       ? unknown(options.trailers)
       : { kind: "message", message: heredoc };
   }
-  if (options.messages.length === 0) return unknown(options.trailers);
+  if (options.file !== undefined) return { kind: "file", path: options.file };
+  const parts = [...options.messages];
+  if (options.opaque) {
+    if (heredoc === undefined) return unknown(options.trailers);
+    parts.push(heredoc);
+  }
+  if (parts.length === 0) return unknown(options.trailers);
   const trailers = options.trailers.length === 0 ? "" : `\n\n${options.trailers.join("\n")}`;
-  return { kind: "message", message: `${options.messages.join("\n\n")}${trailers}` };
+  return { kind: "message", message: `${parts.join("\n\n")}${trailers}` };
+}
+
+/** One extraction per `git commit` in the command (empty when it commits nothing). */
+export function extractCommits(command: string): CommitExtraction[] {
+  const { rest, bodies } = stripHeredocs(command);
+  const resolution = resolveGit(rest);
+  const heredoc = heredocFor(command, bodies);
+  const commits = resolution.invocations.filter((g) => g.sub === "commit");
+  const found = commits.map((g) => extractOne(g.args, heredoc));
+  const hidden = resolution.opaque && /\bcommit\b/.test(command);
+  return hidden ? [...found, unknown()] : found;
+}
+
+/** The first commit a shell command makes: its message, or why it cannot be known. */
+export function extractCommit(command: string): CommitExtraction {
+  return extractCommits(command)[0] ?? { kind: "not-commit" };
 }

package/src/core/commit-message.ts

@@ -93,13 +93,36 @@ export function findForbiddenTrailers(
     });
 }
 
+const AI_TRAILER_ANYWHERE = /(?:co-authored-by|generated-by)\s*[:=]/gi;
+
+/** AI-attribution trailer keys anywhere in free text (command lines, quoted strings, printf bodies). */
+export function findForbiddenTrailerKeys(text: string): string[] {
+  return [...text.matchAll(AI_TRAILER_ANYWHERE)].map((m) => m[0].trim());
+}
+
 const isBullets = (paragraph: string): boolean =>
   paragraph.split("\n").every((line) => /^\s*(?:[-*+]|\d+[.)])\s/.test(line));
 
 const wordCount = (text: string): number => text.split(/\s+/).filter((w) => w !== "").length;
 
+const PROSE_TRAILER_WORDS = 5;
+
+/** A trailer-shaped line whose value is a sentence ("Reason: the cache was stale…") is prose. */
+const isProseTrailer = (line: string): boolean => {
+  const m = TRAILER.exec(line.trim());
+  return m !== null && m[1] !== "BREAKING CHANGE" && wordCount(m[2] ?? "") >= PROSE_TRAILER_WORDS;
+};
+
 /** A body needs at least one prose paragraph (not a file list) that says more than a few words. */
 export function hasRationaleBody(message: string): boolean {
-  const { body } = split(message);
-  return body.some((paragraph) => !isBullets(paragraph) && wordCount(paragraph) >= 5);
+  const { body, trailers } = split(message);
+  const trailerBlockLines =
+    withoutComments(message)
+      .split(/\n\s*\n/)
+      .at(-1)
+      ?.split("\n") ?? [];
+  const proseTrailer = trailers.length > 0 && trailerBlockLines.some(isProseTrailer);
+  return (
+    proseTrailer || body.some((paragraph) => !isBullets(paragraph) && wordCount(paragraph) >= 5)
+  );
 }

package/src/core/git-intent.ts

@@ -106,7 +106,15 @@ export const DATA_ONLY = new Set([
 ]);
 export const SHELLS = new Set(["bash", "sh", "zsh", "dash", "ksh"]);
 export const OPAQUE = new Set(["xargs", "ssh", "find", "parallel", "watch"]);
-export const GLOBAL_WITH_VALUE = new Set(["-c", "-C", "--git-dir", "--work-tree", "--namespace"]);
+export const GLOBAL_WITH_VALUE = new Set([
+  "-c",
+  "-C",
+  "--git-dir",
+  "--work-tree",
+  "--namespace",
+  "--config-env",
+  "--super-prefix",
+]);
 const HOOK_SKIP_ENV = new Set(["LEFTHOOK=0", "HUSKY=0"]);
 
 export const basename = (path: string): string => path.slice(path.lastIndexOf("/") + 1);

package/src/core/git-invocations.ts

@@ -14,7 +14,12 @@ import {
   WRAPPERS,
 } from "./git-intent.ts";
 
-export type GitInvocation = { readonly sub: string; readonly args: readonly string[] };
+export type GitInvocation = {
+  readonly sub: string;
+  readonly args: readonly string[];
+  /** Directory the command runs in, relative to the starting one (from `cd` and `git -C`), when it moved. */
+  readonly dir?: string;
+};
 
 export type GitResolution = {
   readonly invocations: readonly GitInvocation[];
@@ -22,7 +27,7 @@ export type GitResolution = {
   readonly opaque: boolean;
 };
 
-type Collector = { invocations: GitInvocation[]; opaque: boolean };
+type Collector = { invocations: GitInvocation[]; opaque: boolean; dir: string | undefined };
 
 const firstCommand = (tokens: readonly string[]): number => {
   const at = tokens.findIndex((t) => !(isAssignment(t) || WRAPPERS.has(t) || KEYWORDS.has(t)));
@@ -32,16 +37,24 @@ const firstCommand = (tokens: readonly string[]): number => {
 const gitIndex = (tokens: readonly string[]): number =>
   tokens.findIndex((t) => basename(t) === "git");
 
+const joinDir = (base: string | undefined, next: string): string =>
+  next.startsWith("/") || base === undefined ? next : `${base}/${next}`;
+
 /** `git [global options] <sub> <args…>` (tokens start at the word after `git`). */
 function visitGit(rest: readonly string[], into: Collector): void {
   let j = 0;
+  let dir = into.dir;
   while (j < rest.length && (rest[j] ?? "").startsWith("-")) {
+    if (rest[j] === "-C") dir = joinDir(dir, rest[j + 1] ?? ".");
     j += GLOBAL_WITH_VALUE.has(rest[j] ?? "") ? 2 : 1;
   }
   const sub = rest[j];
   if (sub === undefined) return;
   if (sub.startsWith("$")) into.opaque = true;
-  else into.invocations.push({ sub, args: rest.slice(j + 1) });
+  else {
+    const args = rest.slice(j + 1);
+    into.invocations.push(dir === undefined ? { sub, args } : { sub, args, dir });
+  }
 }
 
 /** A shell or `eval`: its script is more command text to resolve. */
@@ -55,12 +68,20 @@ function visitScript(base: string, rest: readonly string[], into: Collector): vo
   if (script !== undefined) merge(into, resolveGit(script));
 }
 
+/** `cd <dir>`: later git commands run there (a `$`-built target is unknowable, so it is ignored). */
+function visitCd(rest: readonly string[], into: Collector): void {
+  const target = rest.find((t) => !t.startsWith("-"));
+  if (target === undefined || /[$`]/.test(target) || target === "-") return;
+  into.dir = joinDir(into.dir, target);
+}
+
 function visitSegment(tokens: readonly string[], into: Collector): void {
   const head = tokens[firstCommand(tokens)];
   if (head === undefined) return;
   const rest = tokens.slice(firstCommand(tokens) + 1);
   const base = basename(head);
   if (head.startsWith("$")) into.opaque = true;
+  else if (base === "cd") visitCd(rest, into);
   else if (SHELLS.has(base) || base === "eval") visitScript(base, rest, into);
   else if (OPAQUE.has(base)) into.opaque = into.opaque || gitIndex(rest) >= 0;
   else if (base === "git") visitGit(rest, into);
@@ -80,7 +101,7 @@ function merge(into: Collector, other: GitResolution): void {
  * `timeout`, `if … then`), `bash -c`/`eval` scripts and `$(…)` substitutions. Heredoc bodies are data.
  */
 export function resolveGit(command: string): GitResolution {
-  const into: Collector = { invocations: [], opaque: false };
+  const into: Collector = { invocations: [], opaque: false, dir: undefined };
   let heredocEnd: string | undefined;
   for (const line of splitLines(command)) {
     if (heredocEnd !== undefined) {

package/src/core/push-command.ts

@@ -5,6 +5,8 @@ export type PushTarget = {
   /** Destination branch names named by refspecs; empty means "the current branch's default". */
   readonly branches: readonly string[];
   readonly allBranches: boolean;
+  /** Where the push runs when `cd`/`git -C` moved it away from the session's directory. */
+  readonly dir?: string | undefined;
 };
 
 const VALUE_OPTIONS = new Set(["--repo", "-o", "--push-option", "--receive-pack", "--exec"]);
@@ -12,7 +14,7 @@ const isDynamic = (refspec: string): boolean => /[$`*?[]/.test(refspec);
 
 const destination = (refspec: string): string => {
   const dst = refspec.includes(":") ? refspec.slice(refspec.lastIndexOf(":") + 1) : refspec;
-  return dst.replace(/^\+/, "").replace(/^refs\/heads\//, "");
+  return dst.replace(/^\+/, "").replace(/^(?:refs\/)?heads\//, "");
 };
 
 type ParsedArgs = { positional: string[]; all: boolean; repo: string | undefined };
@@ -34,7 +36,7 @@ function positionalArgs(args: readonly string[]): ParsedArgs {
   return parsed;
 }
 
-const toTarget = (args: readonly string[]): PushTarget => {
+const toTarget = (args: readonly string[], dir: string | undefined): PushTarget => {
   const { positional, all, repo } = positionalArgs(args);
   // With --repo, every positional argument is a refspec.
   const [remote, ...refspecs] = repo === undefined ? positional : [repo, ...positional];
@@ -44,6 +46,7 @@ const toTarget = (args: readonly string[]): PushTarget => {
     remote,
     branches: destinations.filter(named),
     allBranches: all || destinations.some(isDynamic),
+    ...(dir === undefined ? {} : { dir }),
   };
 };
 
@@ -51,7 +54,7 @@ const toTarget = (args: readonly string[]): PushTarget => {
 export function pushTargets(command: string): PushTarget[] {
   const resolution = resolveGit(command);
   const targets = resolution.invocations.flatMap((g) =>
-    g.sub === "push" ? [toTarget(g.args)] : [],
+    g.sub === "push" ? [toTarget(g.args, g.dir)] : [],
   );
   // git run through something opaque (xargs, `$CMD`): a push cannot be ruled out, so assume the worst.
   const opaquePush = resolution.opaque && /\bpush\b/.test(command);

package/src/core/redact.ts

@@ -15,11 +15,15 @@ export function redactSecrets(text: string): string {
       "$1$2[redacted]$2",
     )
     .replace(
-      /\b(\w*(?:token|key|secret|password|passwd|pwd)\w*\s*(?::=|[:=])[ \t]*)[^\s"'`,;]{4,}/gi,
+      /\b(\w*(?:token|key|secret|password|passwd|passphrase|pwd)\w*\s*(?::=|[:=])[ \t]*)[^\s"'`,;]{4,}/gi,
       "$1[redacted]",
     )
     .replace(/\bsk-[A-Za-z0-9_-]{16,}/g, "[redacted]")
     .replace(/\bAKIA[0-9A-Z]{16}\b/g, "[redacted]")
+    .replace(/\b[sr]k_(?:live|test)_[A-Za-z0-9]{16,}/g, "[redacted]")
+    .replace(/\bAIza[0-9A-Za-z_-]{35}/g, "[redacted]")
+    .replace(/(\s-u\s+[^\s:]+:)\S+/g, "$1[redacted]")
+    .replace(/\b(Cookie:\s*)[^\n]+/gi, "$1[redacted]")
     .replace(/\bxox[abprs]-[A-Za-z0-9-]{10,}/g, "[redacted]")
     .replace(/\bglpat-[A-Za-z0-9_-]{16,}/g, "[redacted]")
     .replace(/\bnpm_[A-Za-z0-9]{30,}/g, "[redacted]")

package/src/gates/commit-guard.ts

@@ -1,12 +1,13 @@
-import { readFileSync } from "node:fs";
+import { readFileSync, statSync } from "node:fs";
 import { resolve } from "node:path";
 import {
   type ExtensionAPI,
   type ExtensionContext,
   isToolCallEventType,
 } from "@earendil-works/pi-coding-agent";
-import { type CommitExtraction, extractCommit } from "../core/commit-command.ts";
+import { type CommitExtraction, extractCommits } from "../core/commit-command.ts";
 import {
+  findForbiddenTrailerKeys,
   findForbiddenTrailers,
   hasRationaleBody,
   parseConventionalCommit,
@@ -38,7 +39,9 @@ const MIXED = gateId("commit.mixed-change");
 
 const readMessageFile = (cwd: string, path: string): string | undefined => {
   try {
-    return readFileSync(resolve(cwd, path), "utf8");
+    const file = resolve(cwd, path);
+    if (!statSync(file).isFile()) return undefined; // never read a FIFO or device (it can block)
+    return readFileSync(file, "utf8");
   } catch {
     return undefined;
   }
@@ -108,34 +111,52 @@ const blockReason = (need: Need): string =>
   `departing is deliberate call devsys_record_departure with gate "${need.gate}", what you are doing ` +
   "instead, why, and the cost if wrong; then retry.";
 
+const forbiddenReason = (found: readonly string[]): string =>
+  `commit.forbidden-trailer: this commit carries an AI attribution (${found.join("; ")}). ` +
+  "Commits in this repository have no Co-Authored-By or generated-by trailers and this is not " +
+  "something to depart from. Remove the trailer and commit again.";
+
+/** AI trailers in any message, --trailer value, or the command text itself (heredocs, printf, echo). */
+function forbiddenIn(
+  command: string,
+  extractions: readonly CommitExtraction[],
+  messages: readonly (string | undefined)[],
+): string[] {
+  const trailers = extractions.flatMap((e) => (e.kind === "unknown" ? e.trailers : []));
+  const text = [...messages, ...trailers].join("\n");
+  return [...findForbiddenTrailers(text), ...findForbiddenTrailerKeys(command)];
+}
+
+async function needsOf(
+  deps: CommitGuardDeps,
+  ctx: ExtensionContext,
+  message: string,
+): Promise<Need[]> {
+  const needs = messageNeeds(message);
+  const bodyPresent = !needs.some((n) => n.why.startsWith("the message has no body"));
+  const viaJev = await jevNeeds(deps, ctx, message, bodyPresent);
+  return [...needs, ...viaJev.filter((n) => !needs.some((m) => m.gate === n.gate))];
+}
+
 /** Soft gates on `git commit`: rationale, Conventional shape, structural/behavioural separation; AI trailers are refused. */
 export function registerCommitGuard(deps: CommitGuardDeps): void {
   deps.pi.on("tool_call", async (event, ctx) => {
     if (!isToolCallEventType("bash", event)) return undefined;
     const command = event.input.command;
-    const extracted = extractCommit(command);
-    if (extracted.kind === "not-commit") return undefined;
-    const message = messageOf(extracted, ctx.cwd);
-
-    // Safety net: whatever the message source, the command text itself must not carry an AI trailer
-    // (heredocs written to a file first, --trailer values on amends, messages built elsewhere).
-    const trailers = extracted.kind === "unknown" ? extracted.trailers.join("\n") : "";
-    const forbidden = findForbiddenTrailers(`${message ?? ""}\n${trailers}\n${command}`);
-    if (forbidden.length > 0) {
-      return {
-        block: true,
-        reason:
-          `commit.forbidden-trailer: this message carries an AI attribution (${forbidden.join("; ")}). ` +
-          "Commits in this repository have no Co-Authored-By or generated-by trailers and this is not " +
-          "something to depart from. Remove the trailer and commit again.",
-      };
-    }
-    if (message === undefined) return undefined;
+    const extractions = extractCommits(command);
+    if (extractions.length === 0) return undefined;
+    const messages = extractions.map((e) => messageOf(e, ctx.cwd));
+
+    const forbidden = forbiddenIn(command, extractions, messages);
+    if (forbidden.length > 0) return { block: true, reason: forbiddenReason(forbidden) };
 
-    const needs = messageNeeds(message);
-    const bodyPresent = !needs.some((n) => n.why.startsWith("the message has no body"));
-    const viaJev = await jevNeeds(deps, ctx, message, bodyPresent);
-    const all = [...needs, ...viaJev.filter((n) => !needs.some((m) => m.gate === n.gate))];
+    const known = messages.flatMap((m) => (m === undefined ? [] : [m]));
+    const all: Need[] = [];
+    for (const message of known) {
+      for (const need of await needsOf(deps, ctx, message)) {
+        if (!all.some((n) => n.gate === need.gate)) all.push(need);
+      }
+    }
     const uses = all.map((need) => ({ need, use: departureUse(deps.state, need.gate) }));
     const uncovered = uses.find(({ use }) => !use.hasOpen());
     if (uncovered !== undefined) return { block: true, reason: blockReason(uncovered.need) };

package/src/gates/push-guard.ts

@@ -1,3 +1,4 @@
+import { resolve } from "node:path";
 import {
   type ExtensionAPI,
   type ExtensionContext,
@@ -52,7 +53,8 @@ async function pushesTrunk(
 ): Promise<boolean> {
   for (const t of targets) {
     if (t.allBranches || t.branches.includes(trunk)) return true;
-    if (t.branches.length === 0 && (await currentBranch(exec, cwd)) === trunk) return true;
+    const where = t.dir === undefined ? cwd : resolve(cwd, t.dir);
+    if (t.branches.length === 0 && (await currentBranch(exec, where)) === trunk) return true;
   }
   return false;
 }
@@ -73,9 +75,11 @@ async function repairsRedTrunk(
   const range = `${config.delivery.remote}/${config.delivery.trunk}..HEAD`;
   const diff = await deps.exec("git", ["diff", range], { cwd: ctx.cwd, timeout: 10_000 });
   if (diff.code !== 0 || diff.stdout.trim() === "") return false;
+  const failingLog = await getFailureLog(deps.exec, ctx.cwd, runId);
+  if (failingLog.trim() === "") return false; // nothing to compare the diff against: fail closed
   const judged = await judgeFixRelated(deps.jev(ctx), {
     diff: diff.stdout,
-    failingLog: await getFailureLog(deps.exec, ctx.cwd, runId),
+    failingLog,
     message: message.stdout,
   });
   return judged.ok && judged.value >= FIX_RELATED_THRESHOLD;