@nathapp/nax 0.50.2 → 0.51.0

package/src/config/merge.ts

@@ -1,106 +0,0 @@
-/**
- * Per-Package Config Merge Utility (MW-008, v0.49.0 expansion)
- *
- * Merges a package-level partial config override into a root config.
- * Covers all fields that make sense at the per-package level.
- * Root-only fields (models, autoMode, routing, agent, etc.) are unchanged.
- */
-
-import type { NaxConfig } from "./schema";
-
-/**
- * Merge a package-level partial config override into a root config.
- *
- * Mergeable sections:
- * - execution: smartTestRunner, regressionGate (deep), verificationTimeoutSeconds
- * - review: enabled, checks, commands (deep), pluginMode
- * - acceptance: enabled, generateTests, testPath
- * - quality: requireTests, requireTypecheck, requireLint, commands (deep), testing (deep)
- * - context: testCoverage (deep)
- *
- * All other sections (models, autoMode, routing, agent, generate, tdd,
- * decompose, plan, constitution, interaction) remain root-only.
- *
- * @param root - Full root NaxConfig (already validated)
- * @param packageOverride - Partial package-level override
- * @returns New merged NaxConfig (immutable — does not mutate inputs)
- */
-export function mergePackageConfig(root: NaxConfig, packageOverride: Partial<NaxConfig>): NaxConfig {
-  const hasAnyMergeableField =
-    packageOverride.execution !== undefined ||
-    packageOverride.review !== undefined ||
-    packageOverride.acceptance !== undefined ||
-    packageOverride.quality !== undefined ||
-    packageOverride.context !== undefined;
-
-  if (!hasAnyMergeableField) {
-    return root;
-  }
-
-  return {
-    ...root,
-    execution: {
-      ...root.execution,
-      ...packageOverride.execution,
-      smartTestRunner: packageOverride.execution?.smartTestRunner ?? root.execution.smartTestRunner,
-      regressionGate: {
-        ...root.execution.regressionGate,
-        ...packageOverride.execution?.regressionGate,
-      },
-      verificationTimeoutSeconds:
-        packageOverride.execution?.verificationTimeoutSeconds ?? root.execution.verificationTimeoutSeconds,
-    },
-    review: {
-      ...root.review,
-      ...packageOverride.review,
-      commands: {
-        ...root.review.commands,
-        // PKG-006: Bridge quality.commands → review.commands for per-package overrides.
-        // Users naturally put per-package commands in quality.commands (the intuitive
-        // place), but the review runner reads review.commands. Bridge them here so
-        // packages don't need to define the same commands in two places.
-        // Explicit review.commands still take precedence (applied after).
-        ...(packageOverride.quality?.commands?.lint !== undefined && {
-          lint: packageOverride.quality.commands.lint,
-        }),
-        ...(packageOverride.quality?.commands?.lintFix !== undefined && {
-          lintFix: packageOverride.quality.commands.lintFix,
-        }),
-        ...(packageOverride.quality?.commands?.typecheck !== undefined && {
-          typecheck: packageOverride.quality.commands.typecheck,
-        }),
-        ...(packageOverride.quality?.commands?.test !== undefined && {
-          test: packageOverride.quality.commands.test,
-        }),
-        // Explicit review.commands override bridged quality values
-        ...packageOverride.review?.commands,
-      },
-    },
-    acceptance: {
-      ...root.acceptance,
-      ...packageOverride.acceptance,
-    },
-    quality: {
-      ...root.quality,
-      requireTests: packageOverride.quality?.requireTests ?? root.quality.requireTests,
-      requireTypecheck: packageOverride.quality?.requireTypecheck ?? root.quality.requireTypecheck,
-      requireLint: packageOverride.quality?.requireLint ?? root.quality.requireLint,
-      commands: {
-        ...root.quality.commands,
-        ...packageOverride.quality?.commands,
-      },
-      // ENH-010: deep-merge testing config so per-package overrides work
-      testing:
-        packageOverride.quality?.testing !== undefined
-          ? { ...root.quality.testing, ...packageOverride.quality.testing }
-          : root.quality.testing,
-    },
-    context: {
-      ...root.context,
-      testCoverage: {
-        ...root.context.testCoverage,
-        ...packageOverride.context?.testCoverage,
-      },
-    },
-  };
-}

package/src/config/merger.ts

@@ -1,147 +0,0 @@
-/**
- * Configuration Merger Utility
- *
- * Deep merge utility for NaxConfig with special handling:
- * - Arrays: replace (not merge)
- * - Null values: remove keys
- * - Hooks: concatenate from both configs
- * - Constitution content: concatenate with newline separator
- */
-
-import type { NaxConfig } from "./schema";
-
-/**
- * Deep merge two configuration objects.
- *
- * Rules:
- * - Objects are merged recursively
- * - Arrays replace (override completely replaces base)
- * - Null values in override remove the key from result
- * - Undefined values in override are skipped
- * - Hooks are concatenated (both base and override hooks preserved)
- * - Constitution content is concatenated with newline separator
- *
- * @param base - Base configuration object
- * @param override - Override configuration object
- * @returns New merged configuration (immutable - does not mutate inputs)
- */
-export function deepMergeConfig<T = NaxConfig>(base: Record<string, unknown>, override: Record<string, unknown>): T {
-  // Start with a clone of base to ensure immutability
-  const result: Record<string, unknown> = { ...base };
-
-  for (const key of Object.keys(override)) {
-    const overrideValue = override[key];
-
-    // Skip undefined values
-    if (overrideValue === undefined) {
-      continue;
-    }
-
-    // Handle null values - remove key from result
-    if (overrideValue === null) {
-      delete result[key];
-      continue;
-    }
-
-    const baseValue = result[key];
-
-    // Special case: hooks concatenation
-    if (key === "hooks" && isPlainObject(baseValue) && isPlainObject(overrideValue)) {
-      const baseHooks = baseValue as Record<string, unknown>;
-      const overrideHooks = overrideValue as Record<string, unknown>;
-      const merged: Record<string, unknown> = { ...baseHooks };
-
-      // Merge the nested hooks object
-      if (isPlainObject(baseHooks.hooks) && isPlainObject(overrideHooks.hooks)) {
-        const baseHookDefs = baseHooks.hooks as Record<string, unknown>;
-        const overrideHookDefs = overrideHooks.hooks as Record<string, unknown>;
-        const mergedHookDefs: Record<string, unknown> = {};
-
-        // Collect all hook event names
-        const allHookNames = new Set([...Object.keys(baseHookDefs), ...Object.keys(overrideHookDefs)]);
-
-        // For each hook event, concatenate hooks into an array
-        for (const hookName of allHookNames) {
-          const baseHook = baseHookDefs[hookName];
-          const overrideHook = overrideHookDefs[hookName];
-
-          if (baseHook && overrideHook) {
-            // Both exist - create array with both
-            mergedHookDefs[hookName] = [baseHook, overrideHook];
-          } else if (overrideHook) {
-            // Only override exists
-            mergedHookDefs[hookName] = overrideHook;
-          } else {
-            // Only base exists
-            mergedHookDefs[hookName] = baseHook;
-          }
-        }
-
-        merged.hooks = mergedHookDefs;
-      } else if (overrideHooks.hooks) {
-        merged.hooks = overrideHooks.hooks;
-      }
-
-      // Handle other hook config fields (e.g., skipGlobal)
-      for (const hookKey of Object.keys(overrideHooks)) {
-        if (hookKey !== "hooks") {
-          merged[hookKey] = overrideHooks[hookKey];
-        }
-      }
-
-      result[key] = merged;
-      continue;
-    }
-
-    // Special case: constitution content concatenation
-    if (key === "constitution" && isPlainObject(baseValue) && isPlainObject(overrideValue)) {
-      const baseConst = baseValue as Record<string, unknown>;
-      const overrideConst = overrideValue as Record<string, unknown>;
-
-      const baseContent = typeof baseConst.content === "string" ? baseConst.content : "";
-      const overrideContent = typeof overrideConst.content === "string" ? overrideConst.content : "";
-
-      // Merge constitution object, but concatenate content field
-      const mergedConstitution = deepMergeConfig(baseConst, overrideConst);
-
-      // Concatenate content if both exist
-      if (baseContent && overrideContent) {
-        (mergedConstitution as unknown as Record<string, unknown>).content = `${baseContent}\n\n${overrideContent}`;
-      } else if (overrideContent) {
-        (mergedConstitution as unknown as Record<string, unknown>).content = overrideContent;
-      } else if (baseContent) {
-        (mergedConstitution as unknown as Record<string, unknown>).content = baseContent;
-      }
-
-      result[key] = mergedConstitution;
-      continue;
-    }
-
-    // Arrays replace completely (no merging)
-    if (Array.isArray(overrideValue)) {
-      result[key] = [...overrideValue];
-      continue;
-    }
-
-    // Recursive merge for plain objects
-    if (isPlainObject(overrideValue) && isPlainObject(baseValue)) {
-      result[key] = deepMergeConfig(baseValue as Record<string, unknown>, overrideValue as Record<string, unknown>);
-      continue;
-    }
-
-    // Default: override replaces base
-    result[key] = overrideValue;
-  }
-
-  return result as T;
-}
-
-/**
- * Check if value is a plain object (not null, not array, not class instance).
- *
- * @param value - Value to check
- * @returns True if value is a plain object
- */
-function isPlainObject(value: unknown): value is Record<string, unknown> {
-  return typeof value === "object" && value !== null && !Array.isArray(value) && value.constructor === Object;
-}

package/src/config/path-security.ts

@@ -1,121 +0,0 @@
-/**
- * Path Security Utilities
- *
- * Prevents path traversal attacks by validating and resolving paths.
- */
-
-import { existsSync, lstatSync, realpathSync } from "node:fs";
-import { isAbsolute, normalize, resolve } from "node:path";
-
-/** Maximum directory depth to prevent infinite loops */
-export const MAX_DIRECTORY_DEPTH = 10;
-
-/**
- * Validate and resolve a directory path safely
- * @param dirPath - The directory path to validate
- * @param baseDir - Optional base directory to check bounds (if provided, dirPath must be within baseDir)
- * @returns Resolved absolute path
- * @throws Error if path is invalid, not a directory, or outside bounds
- */
-export function validateDirectory(dirPath: string, baseDir?: string): string {
-  // Resolve to absolute path
-  const resolved = resolve(dirPath);
-
-  // Check if path exists
-  if (!existsSync(resolved)) {
-    throw new Error(`Directory does not exist: ${dirPath}`);
-  }
-
-  // Get real path (resolves symlinks)
-  let realPath: string;
-  try {
-    realPath = realpathSync(resolved);
-  } catch (error) {
-    throw new Error(`Failed to resolve path: ${dirPath} (${(error as Error).message})`);
-  }
-
-  // Check if it's a directory
-  try {
-    const stats = lstatSync(realPath);
-    if (!stats.isDirectory()) {
-      throw new Error(`Not a directory: ${dirPath}`);
-    }
-  } catch (error) {
-    throw new Error(`Failed to stat path: ${dirPath} (${(error as Error).message})`);
-  }
-
-  // If baseDir provided, ensure realPath is within baseDir
-  if (baseDir) {
-    const resolvedBase = resolve(baseDir);
-    const realBase = existsSync(resolvedBase) ? realpathSync(resolvedBase) : resolvedBase;
-
-    if (!isWithinDirectory(realPath, realBase)) {
-      throw new Error(`Path is outside allowed directory: ${dirPath} (resolved to ${realPath}, base: ${realBase})`);
-    }
-  }
-
-  return realPath;
-}
-
-/**
- * Check if a path is within a base directory (prevents path traversal)
- * @param targetPath - The path to check (must be absolute)
- * @param basePath - The base directory (must be absolute)
- * @returns true if targetPath is within basePath
- */
-export function isWithinDirectory(targetPath: string, basePath: string): boolean {
-  const normalizedTarget = normalize(targetPath);
-  const normalizedBase = normalize(basePath);
-
-  // Ensure both are absolute
-  if (!isAbsolute(normalizedTarget) || !isAbsolute(normalizedBase)) {
-    return false;
-  }
-
-  // Add trailing slash to base to prevent partial matches
-  const baseWithSlash = normalizedBase.endsWith("/") ? normalizedBase : `${normalizedBase}/`;
-  const targetWithSlash = normalizedTarget.endsWith("/") ? normalizedTarget : `${normalizedTarget}/`;
-
-  // Check if target starts with base
-  return targetWithSlash.startsWith(baseWithSlash) || normalizedTarget === normalizedBase;
-}
-
-/**
- * Validate file path and ensure it's within a base directory
- * @param filePath - The file path to validate
- * @param baseDir - Base directory (filePath must be within this directory)
- * @returns Resolved absolute path
- * @throws Error if path is invalid or outside bounds
- */
-export function validateFilePath(filePath: string, baseDir: string): string {
-  const resolved = resolve(filePath);
-
-  // Get real path (resolves symlinks)
-  let realPath: string;
-  try {
-    // For non-existent files, use parent directory's real path
-    if (!existsSync(resolved)) {
-      const parent = resolve(resolved, "..");
-      if (existsSync(parent)) {
-        const realParent = realpathSync(parent);
-        realPath = resolve(realParent, filePath.split("/").pop() || "");
-      } else {
-        realPath = resolved;
-      }
-    } else {
-      realPath = realpathSync(resolved);
-    }
-  } catch (error) {
-    throw new Error(`Failed to resolve path: ${filePath} (${(error as Error).message})`);
-  }
-
-  // Ensure realPath is within baseDir
-  const resolvedBase = resolve(baseDir);
-  const realBase = existsSync(resolvedBase) ? realpathSync(resolvedBase) : resolvedBase;
-
-  if (!isWithinDirectory(realPath, realBase)) {
-    throw new Error(`Path is outside allowed directory: ${filePath} (resolved to ${realPath}, base: ${realBase})`);
-  }
-
-  return realPath;
-}

package/src/config/paths.ts

@@ -1,27 +0,0 @@
-/**
- * Configuration Path Utilities
- *
- * Provides path resolution for global and project-level config directories.
- */
-
-import { homedir } from "node:os";
-import { join, resolve } from "node:path";
-
-/**
- * Returns the global config directory path (~/.nax).
- *
- * @returns Absolute path to global config directory
- */
-export function globalConfigDir(): string {
-  return join(homedir(), ".nax");
-}
-
-/**
- * Returns the project config directory path (projectRoot/nax).
- *
- * @param projectRoot - Absolute or relative path to project root
- * @returns Absolute path to project config directory
- */
-export function projectConfigDir(projectRoot: string): string {
-  return join(resolve(projectRoot), "nax");
-}

package/src/config/permissions.ts

@@ -1,63 +0,0 @@
-/**
- * Permission Resolver — Single Source of Truth
- *
- * All adapters call resolvePermissions() to determine permission mode.
- * No local fallbacks allowed elsewhere in the codebase.
- *
- * Phase 1: permissionProfile field + legacy boolean backward compat.
- * Phase 2: per-stage scoped allowlists (stub below).
- */
-
-import type { NaxConfig } from "./schema";
-
-export type PermissionProfile = "unrestricted" | "safe" | "scoped";
-
-export type PipelineStage =
-  | "plan"
-  | "run"
-  | "verify"
-  | "review"
-  | "rectification"
-  | "regression"
-  | "acceptance"
-  | "complete";
-
-export interface ResolvedPermissions {
-  /** ACP permission mode string */
-  mode: "approve-all" | "approve-reads" | "default";
-  /** CLI adapter: whether to pass --dangerously-skip-permissions */
-  skipPermissions: boolean;
-  /** Future: scoped tool allowlist (Phase 2) */
-  allowedTools?: string[];
-}
-
-/**
- * Resolve permissions for a given pipeline stage.
- * Single source of truth — all adapters call this.
- *
- * Precedence: permissionProfile > dangerouslySkipPermissions boolean > safe default.
- */
-export function resolvePermissions(config: NaxConfig | undefined, _stage: PipelineStage): ResolvedPermissions {
-  const profile: PermissionProfile =
-    config?.execution?.permissionProfile ?? (config?.execution?.dangerouslySkipPermissions ? "unrestricted" : "safe");
-
-  switch (profile) {
-    case "unrestricted":
-      return { mode: "approve-all", skipPermissions: true };
-    case "safe":
-      return { mode: "approve-reads", skipPermissions: false };
-    case "scoped":
-      return resolveScopedPermissions(config, _stage);
-    default:
-      return { mode: "approve-reads", skipPermissions: false };
-  }
-}
-
-/**
- * Phase 2 stub — resolves per-stage permissions from config block.
- * Returns safe defaults until Phase 2 is implemented.
- */
-function resolveScopedPermissions(_config: NaxConfig | undefined, _stage: PipelineStage): ResolvedPermissions {
-  // Phase 2 implementation goes here
-  return { mode: "approve-reads", skipPermissions: false };
-}