@matt82198/aesop 0.1.0-beta.3 → 0.1.0-beta.5

package/tools/prepublish_scan.py

@@ -0,0 +1,84 @@
+#!/usr/bin/env python3
+"""
+prepublish_scan.py — Pre-publish gate for public repos: scans full git history + staged changes.
+
+Usage:
+  prepublish_scan.py [--repo PATH]  Scan full history and staged changes before publishing
+
+Exit codes: 0=clean, 1=findings, 2=usage error
+Output: CLEAR-TO-PUBLISH or STOP with offending commits/files
+
+This gate runs TWO scans (both must pass for CLEAR-TO-PUBLISH):
+  1. Full git history (--history mode): detects secrets in any prior commit
+  2. Staged changes (--staged mode): detects secrets in uncommitted changes
+"""
+
+import argparse
+import os
+import sys
+import subprocess
+from pathlib import Path
+
+
+def run_secret_scan(mode, repo_path):
+    """Run secret_scan.py in the specified mode; return (exit_code, output, stderr)."""
+    scripts_dir = Path(__file__).parent
+    secret_scan_path = scripts_dir / "secret_scan.py"
+
+    try:
+        cmd = [sys.executable, str(secret_scan_path), mode, "--repo", repo_path]
+        result = subprocess.run(
+            cmd,
+            capture_output=True,
+            text=True,
+            timeout=120
+        )
+        return result.returncode, result.stdout, result.stderr
+    except subprocess.TimeoutExpired:
+        return 1, "", "secret_scan.py timed out"
+    except Exception as e:
+        return 1, "", f"Error running secret_scan.py: {e}"
+
+
+def main():
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument(
+        "--repo",
+        default=os.getcwd(),
+        help="Git repo path (default: current directory)",
+    )
+    args = parser.parse_args()
+
+    repo_path = args.repo
+
+    print("[1/2] Scanning full git history for secrets...")
+    history_exit, history_out, history_err = run_secret_scan("--history", repo_path)
+
+    print("[2/2] Scanning staged changes for secrets...")
+    staged_exit, staged_out, staged_err = run_secret_scan("--staged", repo_path)
+
+    # Combine outputs
+    print("\n=== History Scan ===")
+    print(history_out)
+    if history_err:
+        print(history_err, file=sys.stderr)
+
+    print("\n=== Staged Scan ===")
+    print(staged_out)
+    if staged_err:
+        print(staged_err, file=sys.stderr)
+
+    # Verdict
+    print("\n" + "=" * 50)
+    if history_exit == 0 and staged_exit == 0:
+        print("CLEAR-TO-PUBLISH: Full history and staged changes are clean")
+        sys.exit(0)
+    else:
+        print("STOP: Secrets found in history or staged changes")
+        sys.exit(1)
+
+
+if __name__ == "__main__":
+    main()

package/tools/proposals.mjs

@@ -0,0 +1,248 @@
+#!/usr/bin/env node
+/**
+ * proposals.mjs — Proposal lifecycle management tool
+ *
+ * Commands:
+ *   list [--file PATH]              List all pending proposals (signal key + status)
+ *   accept <signal-key> [--file PATH]  Move proposal to PROPOSALS-LOG.md as ACCEPTED
+ *   reject <signal-key> [--file PATH]  Move proposal to PROPOSALS-LOG.md as REJECTED
+ *
+ * Default file: monitor/PROPOSALS.md
+ * Log file (auto): same directory as PROPOSALS.md, named PROPOSALS-LOG.md
+ *
+ * Lock behavior (P0 wave-8 fix): fail-closed with exponential backoff + stale lock breaking.
+ * On lock timeout (default 30s), throws error instead of proceeding unlocked.
+ * Stale locks (>10min) are detected and broken with warning.
+ */
+
+import fs from 'node:fs';
+import path from 'node:path';
+import { acquireLock, releaseLock } from './lock.mjs';
+
+// === Arg parsing ===
+const args = process.argv.slice(2);
+let command = '';
+let signalKey = '';
+let proposalsFile = 'monitor/PROPOSALS.md';
+
+// Parse args: command [arg] [--file path]
+if (args.length === 0) {
+  usage();
+  process.exit(1);
+}
+
+command = args[0];
+
+// Find --file flag
+let fileIdx = args.indexOf('--file');
+if (fileIdx !== -1 && fileIdx + 1 < args.length) {
+  proposalsFile = args[fileIdx + 1];
+}
+
+// Extract signal key for accept/reject
+if (command === 'accept' || command === 'reject') {
+  // Find first non-flag arg after command
+  for (let i = 1; i < args.length; i++) {
+    if (!args[i].startsWith('--')) {
+      signalKey = args[i];
+      break;
+    }
+  }
+  if (!signalKey) {
+    console.error(`Error: ${command} requires a signal-key argument`);
+    process.exit(1);
+  }
+}
+
+if (command !== 'list' && command !== 'accept' && command !== 'reject') {
+  console.error(`Error: unknown command '${command}'`);
+  usage();
+  process.exit(1);
+}
+
+// === Core functions ===
+
+/**
+ * Parse PROPOSALS.md into proposal objects
+ * Format per monitor/collect-signals.mjs:
+ * ## <signal-key> — <timestamp>
+ * **Signal:** <signal-key>
+ * **Problem:** <problem>
+ * **Suggested change:** <change>
+ * ---
+ */
+function parseProposals(content) {
+  const proposals = [];
+  // Split on line containing only "---" (handle both LF and CRLF)
+  const blocks = content.split(/\r?\n---\r?\n/);
+
+  for (let i = 0; i < blocks.length; i++) {
+    const block = blocks[i];
+    const trimmed = block.trim();
+    if (!trimmed) continue;
+
+    // Extract signal key from "**Signal:** <key>" line
+    const signalMatch = trimmed.match(/\*\*Signal:\*\*\s+(\S+)/);
+    if (!signalMatch) continue;
+
+    const key = signalMatch[1];
+    const firstLine = trimmed.split('\n')[0]; // e.g., "## signal-key — timestamp"
+
+    proposals.push({
+      key,
+      firstLine,
+      block: trimmed, // Store trimmed block (without leading/trailing whitespace)
+      originalBlock: block, // Store original block with original whitespace
+    });
+  }
+
+  return proposals;
+}
+
+/**
+ * List proposals
+ */
+function listProposals() {
+  let content = '';
+  try {
+    content = fs.readFileSync(proposalsFile, 'utf8');
+  } catch {
+    console.log('No proposals file found.');
+    process.exit(0);
+  }
+
+  const proposals = parseProposals(content);
+  if (proposals.length === 0) {
+    console.log('No proposals.');
+    process.exit(0);
+  }
+
+  console.log(`Found ${proposals.length} proposal(s):\n`);
+  for (const p of proposals) {
+    console.log(`  ${p.key}`);
+    console.log(`    ${p.firstLine}`);
+    console.log(`    Status: PENDING`);
+  }
+}
+
+/**
+ * Move proposal from PROPOSALS.md to PROPOSALS-LOG.md (with atomic locking for multi-writer safety)
+ * P0 wave-8 fix: fail-closed lock acquisition with exponential backoff.
+ * On timeout, throws error (does not fall through to unlocked write).
+ */
+function moveProposal(status) {
+  // Acquire lock with fail-closed behavior (throws on timeout)
+  let lockDir;
+  try {
+    lockDir = acquireLock(proposalsFile);
+  } catch (e) {
+    console.error(`Error: ${e.message}`);
+    process.exit(1);
+  }
+
+  try {
+    // ATOMIC READ: re-read to ensure we have latest content (guard against concurrent appends)
+    let content = '';
+    try {
+      content = fs.readFileSync(proposalsFile, 'utf8');
+    } catch {
+      console.error(`Error: Could not read ${proposalsFile}`);
+      process.exit(1);
+    }
+
+    // Check if already in log (idempotency check first)
+    const logFile = path.join(path.dirname(proposalsFile), 'PROPOSALS-LOG.md');
+    let logContent = '';
+    if (fs.existsSync(logFile)) {
+      try {
+        logContent = fs.readFileSync(logFile, 'utf8');
+      } catch {
+        // Log file not readable; continue
+      }
+    }
+
+    if (logContent.includes(`**Signal:** ${signalKey}`)) {
+      console.log(`Notice: Signal key '${signalKey}' already moved to log; no-op.`);
+      process.exit(0);
+    }
+
+    const proposals = parseProposals(content);
+    const proposal = proposals.find(p => p.key === signalKey);
+
+    if (!proposal) {
+      console.error(`Error: Signal key '${signalKey}' not found in ${proposalsFile}`);
+      process.exit(1);
+    }
+
+    // Remove proposal from source by rebuilding without this proposal
+    // Split on separators and filter out the matching proposal (handle both LF and CRLF)
+    const blocks = content.split(/\r?\n---\r?\n/);
+    const filteredBlocks = blocks.filter(block => {
+      const trimmed = block.trim();
+      if (!trimmed) return true; // Keep empty blocks
+      const signalMatch = trimmed.match(/\*\*Signal:\*\*\s+(\S+)/);
+      if (!signalMatch) return true; // Keep non-proposal blocks
+      return signalMatch[1] !== signalKey; // Filter out matching proposal
+    });
+
+    // Rebuild content with separators
+    const updatedContent = filteredBlocks.map((b, i) => {
+      if (i < filteredBlocks.length - 1 && b.trim()) {
+        return b.trim();
+      }
+      return b.trim();
+    }).filter(b => b).join('\n\n---\n\n');
+
+    // ATOMIC WRITE: write to temp file, then rename (atomic on all platforms)
+    const tmpFile = proposalsFile + '.tmp';
+    try {
+      fs.writeFileSync(tmpFile, updatedContent.trim() ? updatedContent + '\n' : '', 'utf8');
+      fs.renameSync(tmpFile, proposalsFile);
+    } catch (e) {
+      // Clean up temp file if it exists
+      try { fs.unlinkSync(tmpFile); } catch { }
+      console.error(`Error: Could not write ${proposalsFile}: ${e.message}`);
+      process.exit(1);
+    }
+
+    // Append to log with status heading
+    const timestamp = new Date().toISOString();
+    const logEntry = `## ${status} ${timestamp}\n\n${proposal.block}\n\n---\n`;
+
+    try {
+      if (!logContent) {
+        fs.writeFileSync(logFile, logEntry, 'utf8');
+      } else {
+        fs.appendFileSync(logFile, logEntry, 'utf8');
+      }
+    } catch (e) {
+      console.error(`Error: Could not write ${logFile}: ${e.message}`);
+      process.exit(1);
+    }
+
+    console.log(`✓ Moved signal '${signalKey}' to ${status} in ${path.basename(logFile)}`);
+  } finally {
+    releaseLock(lockDir);
+  }
+}
+
+// === Main ===
+if (command === 'list') {
+  listProposals();
+} else if (command === 'accept') {
+  moveProposal('ACCEPTED');
+} else if (command === 'reject') {
+  moveProposal('REJECTED');
+}
+
+function usage() {
+  console.error(`
+Usage:
+  node proposals.mjs list [--file <path>]
+  node proposals.mjs accept <signal-key> [--file <path>]
+  node proposals.mjs reject <signal-key> [--file <path>]
+
+Default file: monitor/PROPOSALS.md
+Log file: same directory as PROPOSALS.md, named PROPOSALS-LOG.md
+`);
+}