@nathapp/nax 0.80.1 → 0.81.0-canary.2

package/flows/nax-finish/steps/context.ts

@@ -1,158 +0,0 @@
-import { FinishError } from "../errors";
-import { runArgv } from "../exec";
-import type { AcceptanceGroup, RunFn } from "../types";
-
-export const _contextDeps: { run: RunFn } = { run: runArgv };
-
-export async function detectBaseBranch(workdir: string): Promise<string> {
-  const res = await _contextDeps.run(["git", "remote", "show", "origin"], { cwd: workdir });
-  const m = res.stdout.match(/HEAD branch:\s*(\S+)/);
-  if (m) return `origin/${m[1]}`;
-  const main = await _contextDeps.run(["git", "rev-parse", "--verify", "origin/main"], { cwd: workdir });
-  return main.exitCode === 0 ? "origin/main" : "origin/master";
-}
-
-/**
- * The acceptance resolutions this flow knows how to route on, as emitted by
- * `resolveFeatureAcceptance` (`src/cli/features-acceptance.ts`).
- *
- * A closed set, not `string`: `steps/gates.ts` branches on all three by literal
- * — `disabled` decides whether the acceptance gate runs at all — and a typo in
- * any of those comparisons against a `string` compiles cleanly and silently
- * stops a gate from firing.
- */
-export type AcceptanceStatus = "ok" | "no-prd" | "disabled";
-
-const ACCEPTANCE_STATUSES: readonly AcceptanceStatus[] = ["ok", "no-prd", "disabled"];
-
-/**
- * Narrow the resolver's status, degrading anything unrecognised to `no-prd`.
- *
- * A status this flow cannot interpret is not a licence to proceed: it is
- * neither the explicit opt-out nor a resolution to trust. `no-prd` routes to
- * `escalate`, which is the honest answer and matches the existing default for
- * a status that is missing entirely.
- */
-export function toAcceptanceStatus(raw: unknown): AcceptanceStatus {
-  return ACCEPTANCE_STATUSES.find((s) => s === raw) ?? "no-prd";
-}
-
-export interface FeatureResolution {
-  specPath: string;
-  specKind: "markdown" | "prd";
-  acceptanceStatus: AcceptanceStatus;
-  groups: AcceptanceGroup[];
-  /**
-   * Test-file classification regexes, as sources, from `nax features resolve`
-   * (the ADR-009 SSOT). Empty when the CLI is older than the field or could not
-   * resolve them — callers must treat empty as "cannot classify", never as
-   * "nothing is a test file".
-   */
-  testFileRegex: string[];
-}
-
-/**
- * One `nax features resolve` call for the whole flow — it yields both the spec
- * source (for the review prompts) and the acceptance groups (for the gate), so
- * `load_ctx` resolves once and the acceptance node reads the groups off
- * `ctx.outputs.load_ctx` instead of shelling out a second time.
- */
-export async function resolveFeature(feature: string, workdir: string): Promise<FeatureResolution> {
-  const res = await _contextDeps.run(["nax", "features", "resolve", feature, "--json"], { cwd: workdir });
-  let parsed: {
-    specSource?: { kind: "markdown" | "prd"; path: string };
-    acceptance?: { status?: string; groups?: AcceptanceGroup[] };
-    testPatterns?: { regex?: string[] };
-  };
-  try {
-    parsed = JSON.parse(res.stdout);
-  } catch (cause) {
-    throw new FinishError(
-      `nax features resolve returned unparseable JSON for "${feature}"`,
-      "FINISH_RESOLVE_UNPARSEABLE",
-      { stage: "finish-context", feature, exitCode: res.exitCode, cause },
-    );
-  }
-  if (!parsed.specSource) {
-    throw new FinishError(`nax features resolve returned no specSource for "${feature}"`, "FINISH_SPEC_NOT_FOUND", {
-      stage: "finish-context",
-      feature,
-    });
-  }
-  return {
-    specPath: parsed.specSource.path,
-    specKind: parsed.specSource.kind,
-    acceptanceStatus: toAcceptanceStatus(parsed.acceptance?.status),
-    groups: parsed.acceptance?.groups ?? [],
-    testFileRegex: parsed.testPatterns?.regex ?? [],
-  };
-}
-
-/**
- * Split paths into test and non-test, using the regexes `nax features resolve`
- * reported.
- *
- * With no patterns (older nax, or a config the resolver choked on) every path is
- * reported as non-test. That is the safe direction for the one caller: the gate
- * loop skips its re-review only for a test-only change, so "cannot classify"
- * must mean "review it", never "skip it".
- *
- * An unparseable regex source is skipped rather than thrown — a bad pattern in
- * one config entry must not take the flow down mid-loop.
- */
-export function partitionTestFiles(paths: string[], regexSources: string[]): { test: string[]; nonTest: string[] } {
-  const matchers: RegExp[] = [];
-  for (const src of regexSources) {
-    try {
-      matchers.push(new RegExp(src));
-    } catch {
-      // Skip — see the doc comment above.
-    }
-  }
-  const test: string[] = [];
-  const nonTest: string[] = [];
-  for (const p of paths) {
-    (matchers.some((re) => re.test(p)) ? test : nonTest).push(p);
-  }
-  return { test, nonTest };
-}
-
-export interface PreflightOutcome {
-  commitsAhead: number;
-  route: "proceed" | "nothing-to-finish" | "escalate";
-  /** Set only on `escalate` — why the count could not be trusted. */
-  reason?: string;
-}
-
-/**
- * How far ahead of the base branch this branch is.
- *
- * A failed count must never be reported as zero. `base` reaches here from
- * `detectBaseBranch`, whose last-resort `origin/master` is returned without
- * being verified — so a repo whose base ref is not fetched locally makes
- * `rev-list` exit non-zero with empty stdout. `Number.parseInt("") || 0` turned
- * that into `0`, indistinguishable from "this branch has no new commits", and
- * the flow reported `nothing-to-finish` having reviewed, verified and pushed
- * nothing. Both the non-zero exit and unreadable output escalate instead: a
- * human can fetch the base, and no fix node can.
- */
-export async function preflight(workdir: string, base: string): Promise<PreflightOutcome> {
-  const res = await _contextDeps.run(["git", "rev-list", "--count", `${base}..HEAD`], { cwd: workdir });
-  if (res.exitCode !== 0) {
-    const detail = res.stderr.trim() || res.stdout.trim() || `exit ${res.exitCode}`;
-    return {
-      commitsAhead: 0,
-      route: "escalate",
-      reason: `Could not count commits against "${base}" — git rev-list failed: ${detail}. The base branch may not exist locally; nax-finish will not treat that as "nothing to finish".`,
-    };
-  }
-  const commitsAhead = Number.parseInt(res.stdout.trim(), 10);
-  if (!Number.isFinite(commitsAhead)) {
-    return {
-      commitsAhead: 0,
-      route: "escalate",
-      reason: `git rev-list --count ${base}..HEAD exited 0 but printed no readable count: "${res.stdout.trim()}".`,
-    };
-  }
-  return { commitsAhead, route: commitsAhead > 0 ? "proceed" : "nothing-to-finish" };
-}

package/flows/nax-finish/steps/escalate.ts

@@ -1,93 +0,0 @@
-import { FinishError } from "../errors";
-import { runArgv } from "../exec";
-import type { Finding, RunFn } from "../types";
-import { detectForge, extractUrl, viewArgv } from "./forge";
-
-export const _escalateDeps: { run: RunFn } = { run: runArgv };
-
-export function buildEscalationComment(feature: string, escalationReason: string, findings: Finding[]): string {
-  const lines = [
-    `## nax-finish escalation — \`${feature}\``,
-    "",
-    "This feature needs human judgment before it can ship. nax-finish stopped rather than guess.",
-    "",
-    `**Needs judgment:** ${escalationReason}`,
-    "",
-    "### Findings",
-    ...findings.map((f) => `- **[${f.severity}] ${f.title}** — ${f.problem}\n  - Suggested: ${f.fix}`),
-  ];
-  return lines.join("\n");
-}
-
-export interface EscalationOutcome {
-  url?: string;
-  /** Where the "needs judgment" message was delivered. */
-  channel: "telegram" | "pr-comment";
-}
-
-/**
- * Deliver an escalation.
- *
- * `preferTelegram` (set by the plugin only when Telegram is both enabled and
- * credentialed) makes Telegram the sole channel: the flow posts no comment and
- * — critically — opens no draft PR to hold one, matching the design's
- * "prefer Telegram when configured, else fall back to a PR/MR comment". The
- * plugin sends the message itself after reading the result file. It still reads
- * any existing PR/MR so the notification can carry a link, which is a read-only
- * lookup with no side effect.
- */
-export async function postEscalation(
-  repoRoot: string,
-  branch: string,
-  comment: string,
-  opts: { preferTelegram?: boolean } = {},
-): Promise<EscalationOutcome> {
-  const forge = await detectForge(_escalateDeps.run, repoRoot, "finish-escalate");
-  const view = await _escalateDeps.run(viewArgv(forge, branch, "url"), { cwd: repoRoot });
-  const existingUrl = view.exitCode === 0 ? extractUrl(view.stdout) : undefined;
-
-  if (opts.preferTelegram) {
-    return { url: existingUrl, channel: "telegram" };
-  }
-
-  if (view.exitCode === 0) {
-    const commentCmd =
-      forge === "github"
-        ? ["gh", "pr", "comment", branch, "--body", comment]
-        : ["glab", "mr", "note", branch, "--message", comment];
-    const commented = await _escalateDeps.run(commentCmd, { cwd: repoRoot });
-    if (commented.exitCode !== 0) {
-      throw new FinishError(
-        `Failed to post escalation comment on "${branch}": ${commented.stderr.trim() || `exit ${commented.exitCode}`}`,
-        "FINISH_ESCALATION_COMMENT_FAILED",
-        { stage: "finish-escalate", branch },
-      );
-    }
-    return { url: existingUrl, channel: "pr-comment" };
-  }
-
-  const createCmd =
-    forge === "github"
-      ? ["gh", "pr", "create", "--draft", "--title", `nax-finish: ${branch}`, "--body", comment, "--head", branch]
-      : [
-          "glab",
-          "mr",
-          "create",
-          "--draft",
-          "--title",
-          `nax-finish: ${branch}`,
-          "--description",
-          comment,
-          "--source-branch",
-          branch,
-        ];
-  const create = await _escalateDeps.run(createCmd, { cwd: repoRoot });
-  if (create.exitCode !== 0) {
-    throw new FinishError(
-      `Failed to open a draft to hold the escalation for "${branch}": ${create.stderr.trim() || `exit ${create.exitCode}`}`,
-      "FINISH_ESCALATION_DRAFT_FAILED",
-      { stage: "finish-escalate", branch },
-    );
-  }
-  return { url: extractUrl(create.stdout), channel: "pr-comment" };
-}

package/flows/nax-finish/steps/forge.ts

@@ -1,93 +0,0 @@
-/**
- * Shared forge (GitHub / GitLab) helpers for the nax-finish flow.
- *
- * `run` is passed in by the caller rather than held here so each step keeps a
- * single injectable `_deps` object for tests.
- */
-import { FinishError } from "../errors";
-import type { RunFn } from "../types";
-
-/** Matches the first http(s) URL on a line — `gh`/`glab` print the URL on stdout. */
-const URL_REGEX = /https?:\/\/\S+/;
-
-export type Forge = "github" | "gitlab";
-
-/**
- * Host of a git remote, for both URL forms git accepts:
- * `git@host:path` (scp-like) and `scheme://[user@]host[:port]/path`.
- */
-export function remoteHost(remoteUrl: string): string {
-  const scp = remoteUrl.match(/^[^/]*@([^:/]+):/);
-  if (scp?.[1]) return scp[1].toLowerCase();
-  const url = remoteUrl.match(/^[a-z][a-z0-9+.-]*:\/\/(?:[^@/]*@)?([^:/]+)/i);
-  return url?.[1]?.toLowerCase() ?? "";
-}
-
-/**
- * Classify by host name.
- *
- * Matching the host (not a substring of the whole URL) is what makes
- * self-hosted instances work: `"gitlab.mycorp.com".includes("gitlab.com")` is
- * false, so the previous check rejected every self-hosted forge. GitHub is
- * tested first purely for determinism on an absurd host naming both.
- */
-function forgeFromHost(host: string): Forge | null {
-  if (host.includes("github")) return "github";
-  if (host.includes("gitlab")) return "gitlab";
-  return null;
-}
-
-/**
- * Last resort for an enterprise host that names neither forge (`git.corp.com`):
- * ask which CLI is installed. Only decisive when exactly one is — with both or
- * neither present a guess would send `gh` at a GitLab remote.
- */
-async function forgeFromCli(run: RunFn, repoRoot: string): Promise<Forge | null> {
-  const [gh, glab] = await Promise.all([
-    run(["gh", "--version"], { cwd: repoRoot }),
-    run(["glab", "--version"], { cwd: repoRoot }),
-  ]);
-  const hasGh = gh.exitCode === 0;
-  const hasGlab = glab.exitCode === 0;
-  if (hasGh && !hasGlab) return "github";
-  if (hasGlab && !hasGh) return "gitlab";
-  return null;
-}
-
-export async function detectForge(run: RunFn, repoRoot: string, stage: string): Promise<Forge> {
-  const remote = await run(["git", "remote", "get-url", "origin"], { cwd: repoRoot });
-  const remoteUrl = remote.stdout.trim();
-  const host = remoteHost(remoteUrl);
-
-  const byHost = forgeFromHost(host);
-  if (byHost) return byHost;
-
-  const byCli = await forgeFromCli(run, repoRoot);
-  if (byCli) return byCli;
-
-  throw new FinishError(
-    `Unable to determine forge for remote host "${host || remoteUrl}" — its name matches neither github nor gitlab, and the gh/glab probe was inconclusive`,
-    "FINISH_UNKNOWN_FORGE",
-    { stage, remoteUrl, host },
-  );
-}
-
-/** Best-effort URL extraction: try `{url}` JSON first, fall back to a raw URL regex. */
-export function extractUrl(stdout: string): string | undefined {
-  try {
-    const parsed = JSON.parse(stdout) as { url?: string; web_url?: string };
-    if (parsed.url) return parsed.url;
-    if (parsed.web_url) return parsed.web_url;
-  } catch {
-    // fall through to regex extraction
-  }
-  const match = stdout.match(URL_REGEX);
-  return match ? match[0] : undefined;
-}
-
-/** Argv for reading the branch's existing PR/MR as JSON. */
-export function viewArgv(forge: Forge, branch: string, githubFields: string): string[] {
-  return forge === "github"
-    ? ["gh", "pr", "view", branch, "--json", githubFields]
-    : ["glab", "mr", "view", branch, "--output", "json"];
-}

package/flows/nax-finish/steps/gates.ts

@@ -1,183 +0,0 @@
-/**
- * The two gate nodes — `acceptance` and `quality_gates`.
- *
- * Split out of `nax-finish.flow.ts`, which sits against the 600-line source
- * cap. They belong together: both answer the same question ("did anything
- * actually verify this tree?"), both enforce the same rule that **nothing ran
- * is not a pass**, and both route on the shared `MAX_FIX_ATTEMPTS` cap.
- *
- * Keeping them out of the flow file also makes them callable in tests without
- * reaching through `flow.nodes.*`.
- */
-import { fixAttemptCount, inputOf, loadCtxOf } from "../flow-ctx";
-import { MAX_FIX_ATTEMPTS } from "../verdict";
-import { runAcceptanceGate } from "./acceptance";
-import { type QualityCommands, loadQualityCommands, runQualityGates } from "./quality";
-
-/** The slice of an acpx `FlowNodeContext` these nodes read. */
-export interface GateNodeCtx {
-  input: unknown;
-  outputs: unknown;
-  state: { steps: { nodeId: string }[] };
-}
-
-export interface AcceptanceNodeOutput {
-  route: string;
-  reason?: string;
-  output: string;
-}
-
-export interface QualityGatesNodeOutput {
-  route: string;
-  reason?: string;
-  ran: string[];
-  failing: string[];
-  output: string;
-}
-
-/** The repo's explicit opt-out, as reported by `nax features resolve`. */
-function acceptanceDisabled(ctx: GateNodeCtx): boolean {
-  return loadCtxOf(ctx).acceptanceStatus === "disabled";
-}
-
-/**
- * Re-run the acceptance gate, routing on the shared fix-cap rules.
- *
- * "Nothing ran" is not a pass — the same rule `quality_gates` applies to an
- * unconfigured repo. `nax features resolve` reports `groups: []` for `no-prd`,
- * for `disabled`, **and** for an `ok` resolution whose PRD grouped to no
- * package at all; it reports `exists: false` for a group whose test was
- * expected at its canonical path but never generated. Treating any of those as
- * green let the flow open a ready PR having verified nothing about the
- * feature's own contract (#1398). Only `disabled` — the repo's explicit opt-out
- * — skips cleanly.
- */
-export async function acceptanceGateNode(ctx: GateNodeCtx): Promise<AcceptanceNodeOutput> {
-  const i = inputOf(ctx);
-  const { groups = [], acceptanceStatus } = loadCtxOf(ctx);
-  if (acceptanceStatus === "disabled") {
-    return { route: "proceed", output: "[acceptance] disabled in .nax/config.json — skipping" };
-  }
-  if (acceptanceStatus === "no-prd") {
-    return {
-      route: "escalate",
-      reason: `Acceptance targets could not be computed (status: no-prd) — nothing was verified for "${i.feature}".`,
-      output: "[acceptance] no prd.json resolved — acceptance targets unknown",
-    };
-  }
-
-  const r = await runAcceptanceGate(i.workdir, groups, { timeoutMs: i.timeouts?.acceptanceMs });
-  if (r.passed) {
-    // A real failure below routes to the fix loop, which is more actionable;
-    // the coverage hole is only reported once the runnable groups are green.
-    if (r.missing.length > 0) {
-      return {
-        route: "escalate",
-        reason: `Acceptance test never generated for: ${r.missing.join(", ")} — that package's contract is unverified.`,
-        output: r.output,
-      };
-    }
-    // Passed, nothing missing, and nothing ran: the resolver produced no group
-    // to run at all. `status: "ok"` does NOT imply a target exists — it means
-    // the PRD loaded — so this is the one remaining way an empty gate reports
-    // green. Escalating matches what `runQualityGates` does for a repo with no
-    // configured commands: an LLM fix node cannot invent the missing target.
-    if (r.ran === 0) {
-      return {
-        route: "escalate",
-        reason: `No acceptance test target resolved for "${i.feature}" (status: ${acceptanceStatus ?? "unknown"}) — nothing verified its contract.`,
-        output: r.output,
-      };
-    }
-    return { route: "proceed", output: r.output };
-  }
-  const attempts = fixAttemptCount(ctx, "fix_acceptance");
-  if (attempts >= MAX_FIX_ATTEMPTS) {
-    return {
-      route: "escalate",
-      reason: `Acceptance tests still failing after ${attempts} fix attempts.`,
-      output: r.output,
-    };
-  }
-  return { route: "fix", output: r.output };
-}
-
-/**
- * Acceptance is gate zero here, not just at the `acceptance` node.
- *
- * Both fix loops that run after it — quality review and this gate — edit code,
- * and the repo-root `test` command does not cover the feature's acceptance
- * tests: they live under `<pkg>/.nax/features/<f>/` and usually need their own
- * runner config. Re-running them here is what makes "nothing reaches open_pr
- * without the feature's own contract passing against the tree as it will ship"
- * true on every path (#1398).
- *
- * Unconditional apart from the repo's own opt-out, though the common green path
- * re-runs a gate that already passed: acceptance is the cheapest gate in the
- * pipeline, and a conditional skip derived from step history would be a check
- * that can be *wrong* — a silent false green, the failure mode this exists to
- * prevent. The `disabled` skip is not such a derivation: it is the same
- * resolver field the `acceptance` node already honours, and the two nodes
- * disagreeing about who owns the opt-out is its own bug.
- *
- * `missing` is deliberately ignored: groups are resolved once at load_ctx, so a
- * coverage hole was already escalated by the acceptance node and cannot appear
- * here.
- */
-async function reverifyAcceptance(ctx: GateNodeCtx): Promise<QualityGatesNodeOutput | null> {
-  if (acceptanceDisabled(ctx)) return null;
-  const i = inputOf(ctx);
-  const acc = await runAcceptanceGate(i.workdir, loadCtxOf(ctx).groups ?? [], {
-    timeoutMs: i.timeouts?.acceptanceMs,
-  });
-  if (acc.passed) return null;
-  // Short-circuit: the repo gates are re-run next round anyway, and skipping
-  // them keeps this out of the "nothing configured" branch below, which would
-  // otherwise misreport configured-but-skipped commands as absent.
-  const attempts = fixAttemptCount(ctx, "fix_gate");
-  const failing = ["acceptance"];
-  if (attempts >= MAX_FIX_ATTEMPTS) {
-    return {
-      route: "escalate",
-      reason: `A later fix broke the feature's own contract: acceptance still failing after ${attempts} fix attempts.`,
-      ran: [],
-      failing,
-      output: acc.output,
-    };
-  }
-  return { route: "fix", ran: [], failing, output: acc.output };
-}
-
-export async function qualityGatesNode(ctx: GateNodeCtx): Promise<QualityGatesNodeOutput> {
-  const i = inputOf(ctx);
-
-  const accFailure = await reverifyAcceptance(ctx);
-  if (accFailure) return accFailure;
-
-  const cmds: QualityCommands = await loadQualityCommands(i.workdir);
-  const r = await runQualityGates(i.workdir, cmds, { timeoutMs: i.timeouts?.gateMs });
-  if (r.passed) return { route: "green", ran: r.ran, failing: r.failing, output: r.output };
-  // Nothing configured is not a pass — escalate immediately rather than open a
-  // "ready" PR having verified nothing. An LLM fix node cannot invent the
-  // repo's build/test commands.
-  if (r.ran.length === 0) {
-    return {
-      route: "escalate",
-      reason: "No quality.commands configured in .nax/config.json — nax-finish verified nothing.",
-      ran: r.ran,
-      failing: r.failing,
-      output: r.output,
-    };
-  }
-  const attempts = fixAttemptCount(ctx, "fix_gate");
-  if (attempts >= MAX_FIX_ATTEMPTS) {
-    return {
-      route: "escalate",
-      reason: `Quality gates still failing after ${attempts} fix attempts (${r.failing.join(", ")}).`,
-      ran: r.ran,
-      failing: r.failing,
-      output: r.output,
-    };
-  }
-  return { route: "fix", ran: r.ran, failing: r.failing, output: r.output };
-}

package/flows/nax-finish/steps/git.ts

@@ -1,130 +0,0 @@
-/**
- * Branch synchronisation for the nax-finish flow.
- *
- * Every fix node edits the working tree in place, which two different consumers
- * would otherwise miss:
- *
- * - The **reviewers** read `git diff <base>...HEAD` — committed history only.
- *   With the fixes uncommitted, every re-review re-read the pre-fix code and
- *   re-reported findings the fix node had already resolved, so the loop could
- *   never converge and always escalated at the fix cap (issue #1397). Each
- *   `commit_*` node calls `commitFixes` for this reason.
- * - The **forge**: `gh pr create --head <branch>` opens a PR from the *remote*
- *   branch, and an escalation comment would describe state nobody else can see.
- *   Both terminal nodes call `commitAndPush` before touching the forge.
- */
-import { FinishError } from "../errors";
-import { runArgv } from "../exec";
-import type { RunFn } from "../types";
-
-export const _gitDeps: { run: RunFn } = { run: runArgv };
-
-export interface SyncOutcome {
-  /** True when the flow's fixes produced a new commit. */
-  committed: boolean;
-  /** True when the branch was pushed (always attempted, so the forge sees HEAD). */
-  pushed: boolean;
-}
-
-async function isDirty(repoRoot: string): Promise<boolean> {
-  const status = await _gitDeps.run(["git", "status", "--porcelain"], { cwd: repoRoot });
-  if (status.exitCode !== 0) {
-    throw new FinishError(
-      `git status failed in "${repoRoot}": ${status.stderr.trim() || `exit ${status.exitCode}`}`,
-      "FINISH_GIT_STATUS_FAILED",
-      { stage: "finish-git", repoRoot },
-    );
-  }
-  return status.stdout.trim().length > 0;
-}
-
-/**
- * Commit the working tree, if it has anything in it, without pushing.
- *
- * Called by the `commit_*` nodes after every fix node so the next reviewer's
- * `git diff <base>...HEAD` contains the fix. `git add -A` (not `-u`) because a
- * fix routinely adds a *new* test file, and an untracked file is invisible to
- * that diff — which is also why committing beats widening the reviewer's diff
- * to include the working tree.
- *
- * `skipHooks` (used by every mid-loop `commit_*` node) adds `--no-verify`. Those
- * commits are internal checkpoints, not shipped history: a repo whose
- * pre-commit hook runs lint or typecheck would otherwise reject an intermediate
- * state — a lint error the gate loop was about to fix — and take the whole flow
- * down with it, with no result file. Nothing is lost by skipping them, because
- * `quality_gates` runs the repo's own build/typecheck/lint/test and no PR opens
- * unless they are green. The terminal `commitAndPush` leaves hooks enabled.
- *
- * A failing commit still throws: the fix is then unreviewable, and continuing
- * would silently reproduce the stale-diff bug this exists to fix.
- */
-/** Current HEAD sha, or null outside a repo / on an unborn branch. */
-async function headSha(repoRoot: string): Promise<string | null> {
-  const res = await _gitDeps.run(["git", "rev-parse", "HEAD"], { cwd: repoRoot });
-  return res.exitCode === 0 ? res.stdout.trim() || null : null;
-}
-
-/**
- * Repo-root-relative paths touched by a commit.
- *
- * `--format=` suppresses the header so the output is just the file list.
- * Failure yields `[]`, which the gate loop reads as "cannot tell what changed"
- * and therefore reviews — see `partitionTestFiles`.
- */
-export async function filesInCommit(repoRoot: string, sha: string): Promise<string[]> {
-  const res = await _gitDeps.run(["git", "show", "--name-only", "--format=", sha], { cwd: repoRoot });
-  if (res.exitCode !== 0) return [];
-  return res.stdout
-    .split("\n")
-    .map((l) => l.trim())
-    .filter((l) => l.length > 0);
-}
-
-export async function commitFixes(
-  repoRoot: string,
-  message: string,
-  opts: { skipHooks?: boolean } = {},
-): Promise<{ committed: boolean; shaBefore: string | null; shaAfter: string | null }> {
-  const shaBefore = await headSha(repoRoot);
-  if (!(await isDirty(repoRoot))) return { committed: false, shaBefore, shaAfter: shaBefore };
-
-  const add = await _gitDeps.run(["git", "add", "-A"], { cwd: repoRoot });
-  if (add.exitCode !== 0) {
-    throw new FinishError(
-      `git add failed in "${repoRoot}": ${add.stderr.trim() || `exit ${add.exitCode}`}`,
-      "FINISH_GIT_ADD_FAILED",
-      { stage: "finish-git", repoRoot },
-    );
-  }
-  const commitArgv = ["git", "commit", "-m", message, ...(opts.skipHooks ? ["--no-verify"] : [])];
-  const commit = await _gitDeps.run(commitArgv, { cwd: repoRoot });
-  if (commit.exitCode !== 0) {
-    throw new FinishError(
-      `git commit failed in "${repoRoot}": ${commit.stderr.trim() || commit.stdout.trim() || `exit ${commit.exitCode}`}`,
-      "FINISH_GIT_COMMIT_FAILED",
-      { stage: "finish-git", repoRoot },
-    );
-  }
-  return { committed: true, shaBefore, shaAfter: await headSha(repoRoot) };
-}
-
-/**
- * Commit any outstanding fixes and push the branch to `origin`.
- *
- * The push is unconditional — even with nothing new to commit the local branch
- * may be ahead of its remote (nax's own run commits, or the `commit_*` nodes'
- * per-round commits), and the PR must reflect HEAD.
- */
-export async function commitAndPush(repoRoot: string, branch: string, message: string): Promise<SyncOutcome> {
-  const { committed } = await commitFixes(repoRoot, message);
-
-  const push = await _gitDeps.run(["git", "push", "--set-upstream", "origin", branch], { cwd: repoRoot });
-  if (push.exitCode !== 0) {
-    throw new FinishError(
-      `git push of "${branch}" failed: ${push.stderr.trim() || `exit ${push.exitCode}`}`,
-      "FINISH_GIT_PUSH_FAILED",
-      { stage: "finish-git", repoRoot, branch, committed },
-    );
-  }
-  return { committed, pushed: true };
-}

package/flows/nax-finish/steps/index.ts

@@ -1,13 +0,0 @@
-export * from "./context";
-export * from "./acceptance";
-export * from "./quality";
-export * from "./gates";
-export * from "./escalate";
-export * from "./forge";
-export * from "./git";
-export * from "./pr";
-export * from "./pr-narrative";
-export * from "./commit-round";
-export * from "./result";
-export * from "./review-audit";
-export * from "./review-round";