@lovrozagar/grunt 0.1.0

package/scripts/check-globals.mjs

@@ -0,0 +1,98 @@
+#!/usr/bin/env node
+/** Assert home Grok globals match SSOT; project config has no [features]/[agent]. */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parse as parseToml } from "smol-toml";
+
+const APPLY_HINT = "npm run sync:globals:apply";
+const PROJECT_REL = ".grok/config.toml";
+const HOME_REL = ".grok/config.toml";
+
+function isPlainObject(v) {
+  return v != null && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
+}
+
+function parseTomlFile(abs, label) {
+  let raw;
+  try {
+    raw = fs.readFileSync(abs, "utf8");
+  } catch (err) {
+    if (err && err.code === "ENOENT") return { ok: false, missing: true };
+    return { ok: false, error: `unreadable ${label}` };
+  }
+  try {
+    const v = parseToml(raw);
+    if (!isPlainObject(v)) return { ok: false, error: `invalid ${label}` };
+    return { ok: true, value: v };
+  } catch {
+    return { ok: false, error: `unreadable ${label}` };
+  }
+}
+
+export function checkGlobals({ home, workspaceRoot } = {}) {
+  const homeDir = home || process.env.HOME;
+  const ws = workspaceRoot || process.cwd();
+  if (!homeDir) {
+    return { ok: false, error: `HOME required; ${APPLY_HINT}` };
+  }
+  const homeConfig = path.join(homeDir, HOME_REL);
+  const homeParsed = parseTomlFile(homeConfig, "home ~/.grok/config.toml");
+  if (!homeParsed.ok) {
+    if (homeParsed.missing) {
+      return { ok: false, error: `missing ~/.grok/config.toml; ${APPLY_HINT}` };
+    }
+    return { ok: false, error: `${homeParsed.error}; ${APPLY_HINT}` };
+  }
+  const agentName = homeParsed.value.agent && homeParsed.value.agent.name;
+  const compaction =
+    homeParsed.value.features && homeParsed.value.features.two_pass_compaction;
+  if (agentName !== "orchestrator" || compaction !== true) {
+    return {
+      ok: false,
+      error: `home [agent].name must be orchestrator and [features].two_pass_compaction must be true; ${APPLY_HINT}`,
+    };
+  }
+
+  const projectConfig = path.join(ws, PROJECT_REL);
+  const projectParsed = parseTomlFile(projectConfig, "project .grok/config.toml");
+  if (!projectParsed.ok) {
+    if (projectParsed.missing) {
+      return { ok: false, error: "missing project .grok/config.toml" };
+    }
+    return { ok: false, error: projectParsed.error };
+  }
+  if (
+    Object.prototype.hasOwnProperty.call(projectParsed.value, "features") ||
+    Object.prototype.hasOwnProperty.call(projectParsed.value, "agent")
+  ) {
+    return {
+      ok: false,
+      error: "project .grok/config.toml must not set [features] or [agent]",
+    };
+  }
+  return { ok: true };
+}
+
+function main() {
+  try {
+    const result = checkGlobals({
+      home: process.env.HOME,
+      workspaceRoot: process.cwd(),
+    });
+    if (!result.ok) {
+      process.stderr.write((result.error || "check-globals failed") + "\n");
+      return 1;
+    }
+    return 0;
+  } catch (err) {
+    process.stderr.write(String(err && err.message ? err.message : err) + "\n");
+    return 1;
+  }
+}
+
+const thisFile = fileURLToPath(import.meta.url);
+const invoked = process.argv[1] ? path.resolve(process.argv[1]) : "";
+if (invoked === thisFile || import.meta.url === pathToFileURL(invoked).href) {
+  process.exit(main());
+}

package/scripts/emit-mcp-policy.mjs

@@ -0,0 +1,434 @@
+#!/usr/bin/env node
+/** Emit host MCP deny-default artifacts from .rulesync/mcp-policy.jsonc. */
+import fs from "node:fs";
+import path from "node:path";
+import { fileURLToPath, pathToFileURL } from "node:url";
+import { parse as parseToml, stringify as stringifyToml } from "smol-toml";
+
+export const POLICY_REL = ".rulesync/mcp-policy.jsonc";
+const GROK_REL = ".grok/config.toml";
+const CLAUDE_SETTINGS_REL = ".claude/settings.json";
+const MCP_JSON_REL = ".mcp.json";
+const CODEX_REL = ".codex/config.toml";
+const AGENTS_MCP_REL = ".agents/mcp_config.json";
+const AGENT_IDS = ["orchestrator", "implementer", "thinker", "grunt"];
+const MCP_DENY = "mcp__*";
+const GROK_HEADER =
+  "# Generated by emit-mcp-policy.mjs from .rulesync/mcp-policy.jsonc.\n";
+
+function isPlainObject(v) {
+  return v != null && typeof v === "object" && !Array.isArray(v) && !(v instanceof Date);
+}
+
+export function stripJsonc(text) {
+  return String(text ?? "")
+    .replace(/\/\*[\s\S]*?\*\//g, "")
+    .replace(/\/\/.*$/gm, "");
+}
+
+export function parseArgv(argv) {
+  const args = Array.isArray(argv) ? argv : [];
+  let check = false;
+  for (const a of args) {
+    if (a === "--check") {
+      check = true;
+      continue;
+    }
+    return { ok: false, error: `unknown flag: ${a}` };
+  }
+  return { ok: true, check };
+}
+
+function deepEqual(a, b) {
+  if (Object.is(a, b)) return true;
+  if (typeof a !== typeof b) return false;
+  if (a == null || b == null) return a === b;
+  if (Array.isArray(a)) {
+    if (!Array.isArray(b) || a.length !== b.length) return false;
+    return a.every((v, i) => deepEqual(v, b[i]));
+  }
+  if (typeof a === "object") {
+    if (!isPlainObject(a) || !isPlainObject(b)) return false;
+    const ak = Object.keys(a);
+    const bk = Object.keys(b);
+    if (ak.length !== bk.length) return false;
+    return ak.every((k) => Object.prototype.hasOwnProperty.call(b, k) && deepEqual(a[k], b[k]));
+  }
+  return false;
+}
+
+/** desired keys must be present on disk; extra disk keys allowed. */
+export function requiredDeepMatch(disk, desired) {
+  if (Array.isArray(desired)) return deepEqual(disk, desired);
+  if (desired != null && typeof desired === "object") {
+    if (!isPlainObject(disk)) return false;
+    for (const [k, v] of Object.entries(desired)) {
+      if (!requiredDeepMatch(disk[k], v)) return false;
+    }
+    return true;
+  }
+  return deepEqual(disk, desired);
+}
+
+function readText(abs) {
+  try {
+    return fs.readFileSync(abs, "utf8");
+  } catch (err) {
+    if (err && err.code === "ENOENT") return null;
+    throw err;
+  }
+}
+
+function parseJsonFile(raw, fallback) {
+  if (raw == null || !String(raw).trim()) return fallback;
+  const v = JSON.parse(raw);
+  return isPlainObject(v) ? v : fallback;
+}
+
+function parseTomlFile(raw, fallback) {
+  if (raw == null || !String(raw).trim()) return fallback;
+  const v = parseToml(String(raw));
+  return isPlainObject(v) ? v : fallback;
+}
+
+function jsonOut(obj) {
+  return JSON.stringify(obj, null, 2) + "\n";
+}
+
+function tomlOut(obj) {
+  const body = stringifyToml(obj);
+  const text = body.endsWith("\n") ? body : body + "\n";
+  return GROK_HEADER + text;
+}
+
+function cloneJson(v) {
+  return v == null ? v : JSON.parse(JSON.stringify(v));
+}
+
+function pickServers(servers, allow) {
+  const src = isPlainObject(servers) ? servers : {};
+  const out = {};
+  for (const name of allow) {
+    if (Object.prototype.hasOwnProperty.call(src, name)) {
+      out[name] = cloneJson(src[name]);
+    }
+  }
+  return out;
+}
+
+export function loadPolicy(workspaceRoot) {
+  const ws = workspaceRoot || process.cwd();
+  const p = path.join(ws, POLICY_REL);
+  const raw = fs.readFileSync(p, "utf8");
+  const policy = JSON.parse(stripJsonc(raw));
+  if (!isPlainObject(policy)) {
+    throw new Error("invalid policy");
+  }
+  return policy;
+}
+
+export function validatePolicy(policy) {
+  if (!isPlainObject(policy)) return { ok: false, error: "invalid policy" };
+  if (policy.default !== "deny") {
+    return { ok: false, error: 'default must be "deny"' };
+  }
+  if (!Array.isArray(policy.allow)) {
+    return { ok: false, error: "allow must be an array" };
+  }
+  for (const name of policy.allow) {
+    if (typeof name !== "string" || !name) {
+      return { ok: false, error: "allow names must be non-empty strings" };
+    }
+  }
+  const servers = policy.servers;
+  if (servers != null && !isPlainObject(servers)) {
+    return { ok: false, error: "servers must be an object" };
+  }
+  const serverKeys = isPlainObject(servers) ? Object.keys(servers) : [];
+  if (serverKeys.length > 0 && policy.allow.length > 0) {
+    const missing = policy.allow.filter((n) => !Object.prototype.hasOwnProperty.call(servers, n));
+    if (missing.length) {
+      return { ok: false, error: `allow names missing from servers: ${missing.join(", ")}` };
+    }
+  }
+  if (policy.agents != null) {
+    if (!isPlainObject(policy.agents)) {
+      return { ok: false, error: "agents must be an object" };
+    }
+    for (const id of AGENT_IDS) {
+      const row = policy.agents[id];
+      if (row != null && (!isPlainObject(row) || row.inherit !== false)) {
+        return { ok: false, error: `agents.${id}.inherit must be false` };
+      }
+    }
+  }
+  return { ok: true };
+}
+
+function stringList(v) {
+  return Array.isArray(v) ? v.filter((s) => typeof s === "string") : [];
+}
+
+function isMcpToolRule(s) {
+  return s === "MCPTool" || s.startsWith("MCPTool(");
+}
+
+function desiredGrok(disk, policy) {
+  const obj = isPlainObject(disk) ? { ...disk } : {};
+  delete obj.features;
+  delete obj.permissions;
+
+  const plugins = isPlainObject(obj.plugins) ? { ...obj.plugins } : {};
+  delete plugins.deny_default;
+  if (policy.plugins && policy.plugins.denyDefault === true) {
+    plugins.enabled = [];
+    obj.plugins = plugins;
+  } else if (Object.keys(plugins).length) {
+    obj.plugins = plugins;
+  } else {
+    delete obj.plugins;
+  }
+
+  const allow = Array.isArray(policy.allow) ? policy.allow : [];
+  const perm = isPlainObject(obj.permission) ? { ...obj.permission } : {};
+  const denyKeep = stringList(perm.deny).filter((s) => s !== "MCPTool");
+  perm.deny = [...denyKeep, "MCPTool"];
+  const allowKeep = stringList(perm.allow).filter((s) => !isMcpToolRule(s));
+  const mcpAllows = allow.map((name) => `MCPTool(${name}__*)`);
+  const nextAllow = [...mcpAllows, ...allowKeep];
+  if (nextAllow.length) perm.allow = nextAllow;
+  else delete perm.allow;
+  obj.permission = perm;
+
+  if (isPlainObject(obj.mcp)) {
+    const mcp = { ...obj.mcp };
+    delete mcp.servers;
+    if (Object.keys(mcp).length) obj.mcp = mcp;
+    else delete obj.mcp;
+  }
+
+  const allowSet = new Set(allow);
+  const native = isPlainObject(obj.mcp_servers) ? { ...obj.mcp_servers } : {};
+  const nested =
+    isPlainObject(disk) && isPlainObject(disk.mcp) && isPlainObject(disk.mcp.servers) ? disk.mcp.servers : {};
+  const leftoverNames = new Set([...Object.keys(native), ...Object.keys(nested)]);
+  const servers = {};
+  for (const name of leftoverNames) {
+    const prev = isPlainObject(native[name])
+      ? native[name]
+      : isPlainObject(nested[name])
+        ? nested[name]
+        : {};
+    servers[name] = allowSet.has(name) ? { ...prev } : { ...prev, enabled: false };
+  }
+  const picked = pickServers(policy.servers, allow);
+  for (const [name, spec] of Object.entries(picked)) {
+    servers[name] = isPlainObject(spec) ? { ...spec } : spec;
+  }
+  if (Object.keys(servers).length === 0) {
+    delete obj.mcp_servers;
+  } else {
+    obj.mcp_servers = servers;
+  }
+  return obj;
+}
+
+function desiredClaudeSettings(disk, policy) {
+  const obj = isPlainObject(disk) ? { ...disk } : {};
+  obj.enableAllProjectMcpServers = false;
+  obj.enabledMcpjsonServers = [...policy.allow];
+  const permissions = isPlainObject(obj.permissions) ? { ...obj.permissions } : {};
+  const deny = Array.isArray(permissions.deny) ? [...permissions.deny] : [];
+  if (!deny.includes(MCP_DENY)) deny.push(MCP_DENY);
+  permissions.deny = deny;
+  obj.permissions = permissions;
+  return obj;
+}
+
+function desiredMcpJson(policy) {
+  return { mcpServers: pickServers(policy.servers, policy.allow) };
+}
+
+function desiredCodex(disk, policy) {
+  const obj = isPlainObject(disk) ? { ...disk } : {};
+  if (!isPlainObject(obj.agents)) {
+    obj.agents = { max_depth: 1 };
+  } else {
+    obj.agents = { ...obj.agents };
+    if (obj.agents.max_depth == null) obj.agents.max_depth = 1;
+  }
+  if (!policy.allow.length) {
+    delete obj.mcp_servers;
+  } else {
+    obj.mcp_servers = pickServers(policy.servers, policy.allow);
+  }
+  return obj;
+}
+
+function desiredAgentsMcp(policy) {
+  return { mcpServers: pickServers(policy.servers, policy.allow) };
+}
+
+function grokCheckOk(disk, desired, policy) {
+  if (!isPlainObject(disk)) return false;
+  if (Object.prototype.hasOwnProperty.call(disk, "features")) return false;
+  if (Array.isArray(disk.permissions)) return false;
+  if (isPlainObject(disk.plugins) && Object.prototype.hasOwnProperty.call(disk.plugins, "deny_default")) {
+    return false;
+  }
+  if (isPlainObject(disk.mcp) && Object.prototype.hasOwnProperty.call(disk.mcp, "servers")) {
+    return false;
+  }
+  const deny = isPlainObject(disk.permission) && Array.isArray(disk.permission.deny)
+    ? disk.permission.deny
+    : [];
+  if (!deny.includes("MCPTool")) return false;
+  const allow = isPlainObject(disk.permission) && Array.isArray(disk.permission.allow)
+    ? disk.permission.allow
+    : [];
+  for (const name of policy.allow) {
+    if (!allow.includes(`MCPTool(${name}__*)`)) return false;
+  }
+  if (policy.plugins && policy.plugins.denyDefault === true) {
+    if (!requiredDeepMatch(disk, { plugins: { enabled: [] } })) return false;
+  }
+  if (desired.mcp_servers) {
+    if (!requiredDeepMatch(disk, { mcp_servers: desired.mcp_servers })) return false;
+  } else if (isPlainObject(disk.mcp_servers) && Object.keys(disk.mcp_servers).length > 0) {
+    return false;
+  }
+  return true;
+}
+
+function claudeCheckOk(disk, desired) {
+  if (!isPlainObject(disk)) return false;
+  if (disk.enableAllProjectMcpServers !== false) return false;
+  if (!deepEqual(disk.enabledMcpjsonServers, desired.enabledMcpjsonServers)) return false;
+  const deny = disk.permissions && Array.isArray(disk.permissions.deny) ? disk.permissions.deny : [];
+  return deny.includes(MCP_DENY);
+}
+
+function writeOrCheck({ check, abs, nextText, diskRaw }) {
+  if (check) {
+    return diskRaw === nextText;
+  }
+  fs.mkdirSync(path.dirname(abs), { recursive: true });
+  fs.writeFileSync(abs, nextText);
+  return true;
+}
+
+export function emitMcpPolicy({ workspaceRoot, check = false } = {}) {
+  const ws = workspaceRoot || process.cwd();
+  const policy = loadPolicy(ws);
+  const valid = validatePolicy(policy);
+  if (!valid.ok) {
+    return { ok: false, check, error: valid.error };
+  }
+
+  const grokAbs = path.join(ws, GROK_REL);
+  const claudeAbs = path.join(ws, CLAUDE_SETTINGS_REL);
+  const mcpAbs = path.join(ws, MCP_JSON_REL);
+  const codexAbs = path.join(ws, CODEX_REL);
+  const agentsAbs = path.join(ws, AGENTS_MCP_REL);
+
+  const grokRaw = readText(grokAbs);
+  const claudeRaw = readText(claudeAbs);
+  const mcpRaw = readText(mcpAbs);
+  const codexRaw = readText(codexAbs);
+  const agentsRaw = readText(agentsAbs);
+
+  const grokDisk = parseTomlFile(grokRaw, {});
+  const claudeDisk = parseJsonFile(claudeRaw, {});
+  const mcpDisk = mcpRaw == null ? null : parseJsonFile(mcpRaw, {});
+  const codexDisk = parseTomlFile(codexRaw, {});
+  const agentsDisk = agentsRaw == null ? null : parseJsonFile(agentsRaw, {});
+
+  const grokDesired = desiredGrok(grokDisk, policy);
+  const claudeDesired = desiredClaudeSettings(claudeDisk, policy);
+  const mcpDesired = desiredMcpJson(policy);
+  const codexDesired = desiredCodex(codexDisk, policy);
+  const agentsDesired = desiredAgentsMcp(policy);
+
+  if (check) {
+    const drift = [];
+    if (grokRaw == null || !grokCheckOk(grokDisk, grokDesired, policy)) drift.push(GROK_REL);
+    if (claudeRaw == null || !claudeCheckOk(claudeDisk, claudeDesired)) drift.push(CLAUDE_SETTINGS_REL);
+    if (mcpDisk == null || !deepEqual(mcpDisk, mcpDesired)) drift.push(MCP_JSON_REL);
+    const codexOk =
+      codexRaw != null &&
+      requiredDeepMatch(codexDisk, {
+        agents: { max_depth: codexDesired.agents.max_depth },
+      }) &&
+      (policy.allow.length
+        ? deepEqual(codexDisk.mcp_servers, codexDesired.mcp_servers)
+        : !Object.prototype.hasOwnProperty.call(codexDisk, "mcp_servers"));
+    if (!codexOk) drift.push(CODEX_REL);
+    if (agentsDisk == null || !deepEqual(agentsDisk, agentsDesired)) drift.push(AGENTS_MCP_REL);
+    if (drift.length) {
+      return { ok: false, check: true, error: `drift: ${drift.join(", ")}`, drift };
+    }
+    return { ok: true, check: true, drift: [] };
+  }
+
+  writeOrCheck({
+    check: false,
+    abs: grokAbs,
+    nextText: tomlOut(grokDesired),
+    diskRaw: grokRaw,
+  });
+  writeOrCheck({
+    check: false,
+    abs: claudeAbs,
+    nextText: jsonOut(claudeDesired),
+    diskRaw: claudeRaw,
+  });
+  writeOrCheck({
+    check: false,
+    abs: mcpAbs,
+    nextText: jsonOut(mcpDesired),
+    diskRaw: mcpRaw,
+  });
+  const codexBody = stringifyToml(codexDesired);
+  const codexText = codexBody.endsWith("\n") ? codexBody : codexBody + "\n";
+  writeOrCheck({
+    check: false,
+    abs: codexAbs,
+    nextText: codexText,
+    diskRaw: codexRaw,
+  });
+  writeOrCheck({
+    check: false,
+    abs: agentsAbs,
+    nextText: jsonOut(agentsDesired),
+    diskRaw: agentsRaw,
+  });
+  return { ok: true, check: false };
+}
+
+function main() {
+  try {
+    const parsed = parseArgv(process.argv.slice(2));
+    if (!parsed.ok) {
+      process.stderr.write((parsed.error || "invalid argv") + "\n");
+      return 1;
+    }
+    const result = emitMcpPolicy({
+      workspaceRoot: process.cwd(),
+      check: parsed.check,
+    });
+    if (!result.ok) {
+      process.stderr.write((result.error || "emit failed") + "\n");
+      return 1;
+    }
+    return 0;
+  } catch (err) {
+    process.stderr.write(String(err && err.message ? err.message : err) + "\n");
+    return 1;
+  }
+}
+
+const thisFile = fileURLToPath(import.meta.url);
+const invoked = process.argv[1] ? path.resolve(process.argv[1]) : "";
+if (invoked === thisFile || import.meta.url === pathToFileURL(invoked).href) {
+  process.exit(main());
+}