@maycombhq/atticus 2.0.0-beta.2 → 2.0.0-beta.21

package/dist/chunk-G6IQYM25.js

@@ -0,0 +1,339 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  denyHashesAt
+} from "./chunk-LPV6T362.js";
+import {
+  estateRepos,
+  outsideProfileSystems
+} from "./chunk-4SLBCEPD.js";
+import {
+  denyListHits
+} from "./chunk-CPK7QSBG.js";
+import {
+  RepoManifest,
+  SHARED_MAP_SCHEMA_VERSION,
+  SharedMapFile,
+  factsDirOf,
+  factsFileOf,
+  isAdopted,
+  isSecretPath,
+  loadOrgPack,
+  orgPackDirOf,
+  parseFactsLines,
+  readSharedMaps,
+  redactSecrets,
+  require_dist,
+  serializeFacts,
+  sharedDirOf,
+  sharedRelOf
+} from "./chunk-PAINMSID.js";
+import {
+  writeFileAtomic
+} from "./chunk-ODMBPDDV.js";
+import {
+  __toESM
+} from "./chunk-TV45EUGM.js";
+
+// packages/cli/dist/shared-commands.js
+var import_yaml = __toESM(require_dist(), 1);
+import { readdir, readFile, rm, mkdir, stat } from "node:fs/promises";
+import { isAbsolute, join, relative, resolve } from "node:path";
+var SLUG = /^[a-z0-9][a-z0-9_-]*$/;
+var SHA = /^[0-9a-f]{7,64}$/;
+var SECRET_WORD = /(password|passwd|secret|token|api[-_]?key|access[-_]?key|private[-_]?key|credential)/i;
+var posix = (p) => p.split("\\").join("/");
+async function headCommitOf(dir) {
+  let git = join(dir, ".git");
+  const s = await stat(git).catch(() => void 0);
+  if (!s)
+    return void 0;
+  if (s.isFile()) {
+    const m = /^gitdir:\s*(.+)$/m.exec(await readFile(git, "utf8"));
+    if (!m)
+      return void 0;
+    git = resolve(dir, m[1].trim());
+  }
+  const head = (await readFile(join(git, "HEAD"), "utf8").catch(() => "")).trim();
+  if (SHA.test(head))
+    return head;
+  const ref = /^ref:\s*(.+)$/.exec(head)?.[1]?.trim();
+  if (!ref)
+    return void 0;
+  const common = (await readFile(join(git, "commondir"), "utf8").catch(() => "")).trim();
+  for (const g of [git, ...common ? [resolve(git, common)] : []]) {
+    const loose = (await readFile(join(g, ...ref.split("/")), "utf8").catch(() => "")).trim();
+    if (SHA.test(loose))
+      return loose;
+    const packed = await readFile(join(g, "packed-refs"), "utf8").catch(() => "");
+    for (const line of packed.split(/\r?\n/)) {
+      const [sha, name] = line.trim().split(/\s+/);
+      if (name === ref && sha && SHA.test(sha))
+        return sha;
+    }
+  }
+  return void 0;
+}
+async function theirManifest(dir) {
+  const out = /* @__PURE__ */ new Map();
+  const profiles = join(orgPackDirOf(dir), "profiles");
+  for (const p of (await readdir(profiles).catch(() => [])).sort()) {
+    const text = await readFile(join(profiles, p, "repos.manifest.yaml"), "utf8").catch(() => void 0);
+    if (text === void 0)
+      continue;
+    let raw;
+    try {
+      raw = (0, import_yaml.parse)(text);
+    } catch {
+      continue;
+    }
+    const m = RepoManifest.safeParse(raw);
+    if (m.success) {
+      for (const r of m.data.repos)
+        if (!out.has(r.id))
+          out.set(r.id, r);
+    }
+  }
+  return out;
+}
+function kept(f) {
+  const q = f.cite.quote;
+  if (q === void 0)
+    return { fact: f, redacted: false };
+  const red = isSecretPath(f.cite.file) ? void 0 : redactSecrets(q);
+  const quote = red !== void 0 && red === q && SECRET_WORD.test(q) ? void 0 : red;
+  if (quote === q)
+    return { fact: f, redacted: false };
+  const { quote: _q, ...cite } = f.cite;
+  return { fact: { ...f, cite: quote ? { ...cite, quote } : cite }, redacted: true };
+}
+async function readTheirMap(root, dir, o) {
+  if (!SLUG.test(o.team))
+    return {
+      ok: false,
+      message: `${o.team} isn't a team id: use a lowercase slug, e.g. forge-risk-team.`
+    };
+  const op = await loadOrgPack(orgPackDirOf(root));
+  const systems = outsideProfileSystems(op);
+  const system = systems.find((s) => s.id === o.system);
+  if (!system)
+    return {
+      ok: false,
+      message: `${o.system} isn't a system of your profiles that no estate repo belongs to (${systems.map((s) => s.id).join(", ") || "none"}). Add their system to a profile, boundary internal, with its host as an alias, then import again.`
+    };
+  const others = (await readSharedMaps(root)).maps.filter((m) => m.system === o.system && m.team !== o.team);
+  if (others.length)
+    return {
+      ok: false,
+      message: `${o.system} already has ${others[0].name}'s map (shared/${others[0].team}/): one map per system.`
+    };
+  const from = resolve(dir);
+  const st = await stat(from).catch(() => void 0);
+  if (!st?.isDirectory())
+    return { ok: false, message: `${dir} isn't a folder.` };
+  const commit = o.commit ?? await headCommitOf(from);
+  if (!commit || !SHA.test(commit))
+    return {
+      ok: false,
+      message: o.commit ? `${o.commit} isn't a commit sha.` : `${dir} isn't a git clone Atticus can read the commit of: say which commit of their metarepo these files are at with --commit <sha>.`
+    };
+  const theirFacts = isAdopted(from) || await stat(factsDirOf(from)).catch(() => void 0) ? factsDirOf(from) : from;
+  const names = (await readdir(theirFacts).catch(() => [])).sort();
+  const files = names.flatMap((n) => {
+    const f = factsFileOf(n);
+    return f?.facts ? [f.repo] : [];
+  });
+  if (!files.length)
+    return {
+      ok: false,
+      message: `No facts files (<repo>.jsonl) in ${dir}: give their metarepo, or the folder their facts are in.`
+    };
+  const ours = new Set(estateRepos(op).map((r) => r.id));
+  const clash = files.filter((r) => ours.has(r));
+  if (clash.length)
+    return {
+      ok: false,
+      message: `${clash.join(", ")} ${clash.length === 1 ? "is a repo" : "are repos"} of your estate: a shared map holds only another team's repos.`
+    };
+  const manifest = await theirManifest(from);
+  const leftOut = { other: 0, unverified: 0, bad: 0, redacted: 0 };
+  const facts = {};
+  const repos = [];
+  for (const repo of files) {
+    const { facts: read, bad } = parseFactsLines(await readFile(join(theirFacts, `${repo}.jsonl`), "utf8"));
+    leftOut.bad += bad.length;
+    const list = [];
+    for (const f of read) {
+      if (f.kind !== "entry" || f.repo !== repo)
+        leftOut.other++;
+      else if (f.verified === "none")
+        leftOut.unverified++;
+      else {
+        const k = kept(f);
+        if (k.redacted)
+          leftOut.redacted++;
+        list.push(k.fact);
+      }
+    }
+    const m = manifest.get(repo);
+    const hosts = [
+      .../* @__PURE__ */ new Set([...m?.hosts ?? [], ...(m?.modules ?? []).flatMap((x) => x.hosts)])
+    ].sort();
+    const codeCommit = list.map((f) => f.commit).sort()[0];
+    facts[repo] = list;
+    repos.push({
+      repo,
+      ...m?.component ? { component: m.component } : {},
+      ...codeCommit ? { commit: codeCommit } : {},
+      hosts,
+      ...m?.basePath ? { basePath: m.basePath } : {},
+      entries: list.length
+    });
+  }
+  const rel = posix(relative(root, from));
+  const inside = !!rel && rel !== ".." && !rel.startsWith("../") && !isAbsolute(rel);
+  const file = SharedMapFile.parse({
+    schemaVersion: SHARED_MAP_SCHEMA_VERSION,
+    team: o.team,
+    name: o.name ?? o.team,
+    system: o.system,
+    ...inside ? { source: rel } : {},
+    commit,
+    importedAt: (o.now ?? /* @__PURE__ */ new Date()).toISOString(),
+    repos
+  });
+  const deny = await denyHashesAt(root);
+  if (deny.size) {
+    for (const [repo, list] of Object.entries(facts)) {
+      const hits = denyListHits(list.length ? serializeFacts(list) : "", deny);
+      if (hits.length)
+        return {
+          ok: false,
+          message: `Refused: the deny-list names a word in ${repo}'s entries (line${hits.length === 1 ? "" : "s"} ${hits.join(", ")} as they would be kept). Nothing was written.`
+        };
+    }
+    if (denyListHits((0, import_yaml.stringify)(file), deny).length)
+      return {
+        ok: false,
+        message: "Refused: the deny-list names a word in the map's own file. Nothing was written."
+      };
+  }
+  const was = (await readSharedMaps(root)).maps.find((m) => m.team === o.team);
+  return { ok: true, file, facts, leftOut, ...was ? { replaced: was.commit } : {} };
+}
+async function writeTheirMap(root, r) {
+  const dir = join(sharedDirOf(root), r.file.team);
+  await rm(join(dir, "facts"), { recursive: true, force: true });
+  await mkdir(join(dir, "facts"), { recursive: true });
+  for (const [repo, list] of Object.entries(r.facts))
+    await writeFileAtomic(join(dir, "facts", `${repo}.jsonl`), list.length ? serializeFacts(list) : "");
+  await writeFileAtomic(join(dir, "map.yaml"), `# ${r.file.name}'s Atticus map, read-only (ADR 0160): their entries at their commit. Theirs to
+# change: import it again (atticus join shared refresh ${r.file.team}); never edit it here.
+${(0, import_yaml.stringify)(r.file)}`);
+  return `${sharedRelOf(root)}/${r.file.team}`;
+}
+function sayImported(r, where, io) {
+  const f = r.file;
+  const entries = f.repos.reduce((n, x) => n + x.entries, 0);
+  io.out(`${r.replaced && r.replaced !== f.commit ? `Replaced ${f.name}'s map at ${r.replaced.slice(0, 7)} with` : r.replaced ? `Imported ${f.name}'s map again,` : `Imported ${f.name}'s map,`} their commit ${f.commit.slice(0, 7)}: ${entries} entr${entries === 1 ? "y" : "ies"} from ${f.repos.length} repo${f.repos.length === 1 ? "" : "s"} (${f.repos.map((x) => `${x.repo} ${x.entries}`).join(", ")}), standing for ${f.system}. Written to ${where}/.`);
+  const lo = r.leftOut;
+  const parts = [
+    lo.other ? `${lo.other} fact${lo.other === 1 ? "" : "s"} that aren't entries` : "",
+    lo.unverified ? `${lo.unverified} entr${lo.unverified === 1 ? "y" : "ies"} their verify didn't confirm` : "",
+    lo.bad ? `${lo.bad} line${lo.bad === 1 ? "" : "s"} that don't read as facts` : ""
+  ].filter(Boolean);
+  if (parts.length)
+    io.out(`  Left out: ${parts.join(", ")}.`);
+  if (lo.redacted)
+    io.out(`  ${lo.redacted} quote${lo.redacted === 1 ? "" : "s"} naming a secret-looking key redacted or dropped.`);
+  if (!f.source)
+    io.out(`  Their folder is outside this metarepo, so where it is isn't recorded: refresh with atticus join shared refresh ${f.team} <folder>.`);
+  io.out(`  Their entries stay theirs: never verified, corrected or reported on here. Review ${where}/ in a pull request, then atticus verify --all --write joins the calls to ${f.system} to them.`);
+}
+async function sharedImport(root, dir, o, io) {
+  if (!dir || !o.team || !o.system) {
+    io.err("Usage: atticus join shared import <their metarepo or facts folder> --team <id> --system <our profile's system id> [--name <team name>] [--commit <sha>] [--json]");
+    return 2;
+  }
+  const r = await readTheirMap(root, dir, o);
+  if (!r.ok) {
+    io.err(r.message);
+    return 1;
+  }
+  const where = await writeTheirMap(root, r);
+  if (o.json)
+    io.out(JSON.stringify({ written: where, map: r.file, leftOut: r.leftOut }, null, 2));
+  else
+    sayImported(r, where, io);
+  return 0;
+}
+async function sharedRefresh(root, team, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  for (const p of problems)
+    io.err(p.message);
+  const which = team ? maps.filter((m) => m.team === team) : maps;
+  if (team && !which.length) {
+    io.err(`No shared map for ${team} in ${sharedRelOf(root)}/: import it first (atticus join shared import).`);
+    return 1;
+  }
+  if (o.dir && which.length !== 1) {
+    io.err("Give the team with a new folder: atticus join shared refresh <team> <folder>.");
+    return 2;
+  }
+  let failed = 0;
+  let noFolder = 0;
+  for (const m of which) {
+    const source = m.file.source;
+    if (!o.dir && !source) {
+      io.err(`${m.team}'s map doesn't record where it came from (its folder was outside this metarepo): give the folder, atticus join shared refresh ${m.team} <folder>.`);
+      noFolder++;
+      continue;
+    }
+    const src = o.dir ?? (isAbsolute(source) ? source : join(root, ...source.split("/")));
+    const r = await readTheirMap(root, src, {
+      team: m.team,
+      name: m.name,
+      system: m.system,
+      ...o.commit ? { commit: o.commit } : {},
+      ...o.now ? { now: o.now } : {}
+    });
+    if (!r.ok) {
+      io.err(`${m.team}: ${r.message}`);
+      failed++;
+      continue;
+    }
+    sayImported(r, await writeTheirMap(root, r), io);
+  }
+  if (!which.length)
+    io.out(`No shared maps in ${sharedRelOf(root)}/.`);
+  return failed ? 1 : noFolder ? 2 : 0;
+}
+async function sharedList(root, o, io) {
+  const { maps, problems } = await readSharedMaps(root);
+  if (o.json) {
+    io.out(JSON.stringify({ maps: maps.map((m) => m.file), problems }, null, 2));
+    return problems.length ? 1 : 0;
+  }
+  for (const p of problems)
+    io.err(p.message);
+  if (!maps.length) {
+    io.out(`No shared maps in ${sharedRelOf(root)}/. Import another team's: atticus join shared import <their metarepo> --team <id> --system <id>.`);
+    return problems.length ? 1 : 0;
+  }
+  for (const m of maps) {
+    const n = m.file.repos.reduce((k, r) => k + r.entries, 0);
+    io.out(`${m.team}: ${m.name}'s map for ${m.system}, their commit ${m.commit.slice(0, 7)}, imported ${m.file.importedAt.slice(0, 10)} from ${m.file.source ?? "a folder outside the metarepo"}: ${n} entr${n === 1 ? "y" : "ies"} in ${m.file.repos.map((r) => r.repo).join(", ")}.`);
+  }
+  return problems.length ? 1 : 0;
+}
+
+export {
+  headCommitOf,
+  readTheirMap,
+  sharedImport,
+  sharedRefresh,
+  sharedList
+};

package/dist/chunk-G6X4YL4D.js

@@ -0,0 +1,161 @@
+import { createRequire as __atticusCreateRequire } from "node:module";
+import { fileURLToPath as __atticusFileURLToPath } from "node:url";
+var require = __atticusCreateRequire(import.meta.url);
+var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
+var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
+import {
+  ABOUT_RULE,
+  ASSISTANT_FORMATS,
+  AssistantFilesError,
+  BEGIN_RE,
+  COPILOT_AGENTS,
+  COPILOT_RULES,
+  END,
+  FACT_RULES,
+  FACT_RULES_HASH,
+  FACT_RULE_PARTS,
+  FINISH,
+  FRAMEWORK_TOPICS,
+  GUARD,
+  MODELS_RULE,
+  OrgCommandMeta,
+  PROBE_DIR,
+  PROBE_SCHEMA_VERSION,
+  PROBE_STALE_DAYS,
+  PROPOSAL_SHAPE,
+  ProbeResult,
+  RULE_SETS,
+  RULE_TOPICS,
+  SPEC_KIT_VERSION,
+  UNRECORDED_LACKS,
+  agentFile,
+  assistantTier,
+  atticusTaskCommand,
+  body,
+  buildEngineFor,
+  claudeCodePluginFiles,
+  claudeCommandContent,
+  copilotAgentFiles,
+  describeStep,
+  factRulesFor,
+  factsReference,
+  fileText,
+  findSection,
+  generateAssistantFiles,
+  headerLine,
+  loadOrgCommands,
+  mapBatchInstructions,
+  mapCommand,
+  metarepoCommands,
+  parseHeader,
+  probeCommand,
+  probeFileOf,
+  probeTier,
+  probedAssistant,
+  proposeCommand,
+  protocolFor,
+  readProbes,
+  renderAssistantFiles,
+  renderSection,
+  ruleSetKinds,
+  ruleSetsNow,
+  rulesLacking,
+  rulesNow,
+  serializeProbe,
+  sha256,
+  smokeCheck,
+  specKitCommands,
+  specifyFiles,
+  step,
+  stepCommands,
+  taughtFrameworksText,
+  tierLine,
+  tierSource,
+  tierWords,
+  topUpWords,
+  whatRunsWhere,
+  withHeader,
+  writeAssistantFiles,
+  writeProbe,
+  zeroInstallCommands
+} from "./chunk-3AQ2R5NL.js";
+import "./chunk-XOL3GFW2.js";
+import "./chunk-PAINMSID.js";
+import "./chunk-ODMBPDDV.js";
+import "./chunk-TV45EUGM.js";
+export {
+  ABOUT_RULE,
+  ASSISTANT_FORMATS,
+  AssistantFilesError,
+  BEGIN_RE,
+  COPILOT_AGENTS,
+  COPILOT_RULES,
+  END,
+  FACT_RULES,
+  FACT_RULES_HASH,
+  FACT_RULE_PARTS,
+  FINISH,
+  FRAMEWORK_TOPICS,
+  GUARD,
+  MODELS_RULE,
+  OrgCommandMeta,
+  PROBE_DIR,
+  PROBE_SCHEMA_VERSION,
+  PROBE_STALE_DAYS,
+  PROPOSAL_SHAPE,
+  ProbeResult,
+  RULE_SETS,
+  RULE_TOPICS,
+  SPEC_KIT_VERSION,
+  UNRECORDED_LACKS,
+  agentFile,
+  assistantTier,
+  atticusTaskCommand,
+  body,
+  buildEngineFor,
+  claudeCodePluginFiles,
+  claudeCommandContent,
+  copilotAgentFiles,
+  describeStep,
+  factRulesFor,
+  factsReference,
+  fileText,
+  findSection,
+  generateAssistantFiles,
+  headerLine,
+  loadOrgCommands,
+  mapBatchInstructions,
+  mapCommand,
+  metarepoCommands,
+  parseHeader,
+  probeCommand,
+  probeFileOf,
+  probeTier,
+  probedAssistant,
+  proposeCommand,
+  protocolFor,
+  readProbes,
+  renderAssistantFiles,
+  renderSection,
+  ruleSetKinds,
+  ruleSetsNow,
+  rulesLacking,
+  rulesNow,
+  serializeProbe,
+  sha256,
+  smokeCheck,
+  specKitCommands,
+  specifyFiles,
+  step,
+  stepCommands,
+  taughtFrameworksText,
+  tierLine,
+  tierSource,
+  tierWords,
+  topUpWords,
+  whatRunsWhere,
+  withHeader,
+  writeAssistantFiles,
+  writeProbe,
+  zeroInstallCommands
+};

package/dist/{chunk-SJRGMG6A.js → chunk-GC2VK3JT.js}

@@ -5,38 +5,38 @@ var __atticusUrl = (p) => new URL("./" + p, import.meta.url).href;
 var __atticusPath = (p) => __atticusFileURLToPath(__atticusUrl(p));
 import {
   setupSteps
-} from "./chunk-YY6ZQQBP.js";
-import "./chunk-B2WLAWNJ.js";
+} from "./chunk-GK4PYVEC.js";
 import {
   doctorChecks
-} from "./chunk-AIOQPLA5.js";
+} from "./chunk-HGHRSF3E.js";
+import "./chunk-4B6BT75O.js";
+import "./chunk-FY3QIRTL.js";
 import "./chunk-3G4YI4ZU.js";
-import "./chunk-YISXLPHN.js";
-import "./chunk-GDLULHTC.js";
-import "./chunk-IPKHE5D6.js";
-import "./chunk-CKSITVS4.js";
-import "./chunk-L6SGQIR3.js";
-import "./chunk-3HI6Z55Y.js";
+import "./chunk-2HTEMYTB.js";
+import "./chunk-3AQ2R5NL.js";
+import "./chunk-BEPCKDCP.js";
+import "./chunk-HWD4JPU7.js";
+import "./chunk-5WERBKLE.js";
+import "./chunk-K332XW7K.js";
 import {
   changeStore
-} from "./chunk-XY3P7JW7.js";
-import "./chunk-4AK7IBVP.js";
-import "./chunk-7JUKDRSZ.js";
-import "./chunk-27NKUS3X.js";
-import "./chunk-L24C55VN.js";
-import "./chunk-PAMPPUR6.js";
-import "./chunk-23W7VWKR.js";
-import "./chunk-7EKXJZ2Y.js";
-import "./chunk-MC3H7736.js";
-import "./chunk-T6AIP7H5.js";
+} from "./chunk-HSZMPH5T.js";
+import "./chunk-D2WSW4GU.js";
+import "./chunk-4KNOJC6J.js";
+import "./chunk-4SLBCEPD.js";
+import "./chunk-64AADMTW.js";
+import "./chunk-JYMIB5XY.js";
+import "./chunk-CPK7QSBG.js";
+import "./chunk-YO2PKTXT.js";
+import "./chunk-TWQRPM76.js";
 import {
   VERSION
-} from "./chunk-RZPYKDWS.js";
+} from "./chunk-VUVGX5L2.js";
 import {
   loadRepos
-} from "./chunk-EFHQ3TWP.js";
-import "./chunk-GQ4N4WKF.js";
-import "./chunk-CNUKCS2T.js";
+} from "./chunk-XOL3GFW2.js";
+import "./chunk-QHJJMZLX.js";
+import "./chunk-7AB6OWTV.js";
 import {
   API_VERSION,
   catalogDirOf,
@@ -45,13 +45,13 @@ import {
   loadOrgPack,
   orgPackDirOf,
   zip
-} from "./chunk-S2A7YC3Q.js";
+} from "./chunk-PAINMSID.js";
 import {
   SCHEMA_VERSION,
   logFileOf,
   redactText,
   writeFileAtomic
-} from "./chunk-D3PO4DOZ.js";
+} from "./chunk-ODMBPDDV.js";
 import "./chunk-TV45EUGM.js";
 
 // packages/cli/dist/support.js