@nurix/nustack 0.23.12 → 0.23.13

package/dist/vendor/harness/rules/ownership.js

@@ -0,0 +1,178 @@
+// packages/harness/src/rules/ownership.ts - The `ownership` rule and the ownership helpers over a RuleTree: dead owns:
+// globs, equal-specificity overlaps and dangling doc edges. Ported from etna harness/code/hooks/check-ownership.mjs
+// and lib/ownership.mjs, each helper taking a tree where etna took a project directory.
+// docs/architecture/systems/harness-records.md speaks for it (Status check and enforcement).
+import { asList, field, frontmatter } from '../lib/frontmatter.js';
+import { waiverCovers } from './context.js';
+import { resolveDocsRoot } from './docsRoot.js';
+/** Folders under the docs root that never hold an owning document: frozen history and unharvested research. */
+const NON_OWNING_DIRS = new Set(['history', 'research']);
+const SKIP_DIRS = new Set(['node_modules', '.git', 'dist', 'build', '.claude', '.codex']);
+const markdownUnder = (tree, root) => tree.list(`${root}/`).filter((path) => path.endsWith('.md'));
+/** One entry per document under the docs root that declares owns:, history/, research/ and .bkp. files aside. */
+export function scanOwningDocs(tree, docsRoot = resolveDocsRoot(tree)) {
+    const docs = [];
+    for (const path of markdownUnder(tree, docsRoot)) {
+        if (path.includes('.bkp.') || NON_OWNING_DIRS.has(path.slice(docsRoot.length + 1).split('/')[0]))
+            continue;
+        const block = frontmatter(tree.read(path) ?? '');
+        if (!block)
+            continue;
+        const owns = asList(field(block, 'owns'));
+        if (owns.length === 0)
+            continue;
+        docs.push({
+            doc: path,
+            owns,
+            module: String(field(block, 'module') || '—'),
+            keywords: asList(field(block, 'keywords')),
+            objects: asList(field(block, 'objects')),
+            status: String(field(block, 'status') || 'active').toLowerCase(),
+        });
+    }
+    return docs;
+}
+/** Every file of the tree outside the heavy and machine-local folders. */
+export function listRepoFiles(tree) {
+    return tree.list('').filter((path) => !path.split('/').some((segment) => SKIP_DIRS.has(segment)));
+}
+/** One owns:-style glob (`**` any depth, `*` within a segment) as a RegExp; `a/**` also matches `a`. */
+export function globToRegExp(glob) {
+    const g = glob.replace(/\\/g, '/').replace(/\/+$/, '');
+    const escaped = g.replace(/[\\^$.|?+()[\]{}]/g, '\\$&');
+    const re = escaped
+        .replace(/\/\*\*$/, '\0TAIL\0')
+        .replace(/\*\*\//g, '\0LEAD\0')
+        .replace(/\*\*/g, '\0ANY\0')
+        .replace(/\*/g, '[^/]*')
+        .replace(/\0TAIL\0/g, '(?:/.*)?')
+        .replace(/\0LEAD\0/g, '(?:.*/)?')
+        .replace(/\0ANY\0/g, '.*');
+    return new RegExp(`^${re}$`);
+}
+/** A glob's specificity as literal and wildcard segment counts; only an exact tie leaves an owner ambiguous. */
+export function specificity(glob) {
+    let literal = 0;
+    let wildcard = 0;
+    for (const segment of String(glob).split('/')) {
+        if (segment === '')
+            continue;
+        if (segment.includes('*') || segment.includes('?'))
+            wildcard++;
+        else
+            literal++;
+    }
+    return { literal, wildcard };
+}
+export function owningDocs(tree, relPath, docs = scanOwningDocs(tree)) {
+    return docs.filter((entry) => entry.status !== 'deprecated' && entry.owns.some((glob) => globToRegExp(glob).test(relPath)));
+}
+/** The one owning doc for a path, most specific glob first, with every doc tied at that specificity. */
+export function owningDoc(tree, relPath, docs) {
+    const matches = owningDocs(tree, relPath, docs);
+    if (matches.length <= 1)
+        return matches.length ? { doc: matches[0], glob: null, tied: [] } : null;
+    const scored = [];
+    for (const entry of matches) {
+        let best = null;
+        for (const glob of entry.owns) {
+            if (!globToRegExp(glob).test(relPath))
+                continue;
+            const s = specificity(glob);
+            if (!best || s.literal > best.s.literal || (s.literal === best.s.literal && s.wildcard < best.s.wildcard))
+                best = { glob, s };
+        }
+        if (best)
+            scored.push({ entry, ...best });
+    }
+    if (!scored.length)
+        return null;
+    scored.sort((a, b) => b.s.literal - a.s.literal || a.s.wildcard - b.s.wildcard);
+    const top = scored[0];
+    const tied = scored.filter((x) => x !== top && x.s.literal === top.s.literal && x.s.wildcard === top.s.wildcard);
+    return { doc: top.entry, glob: top.glob, tied: tied.map((x) => x.entry) };
+}
+/** Globs across all owning docs that match no file. */
+export function deadGlobs(tree, repoFiles = listRepoFiles(tree), docs = scanOwningDocs(tree)) {
+    const dead = [];
+    for (const entry of docs) {
+        if (entry.status === 'deprecated')
+            continue;
+        for (const glob of entry.owns) {
+            const re = globToRegExp(glob);
+            if (!repoFiles.some((file) => re.test(file)))
+                dead.push({ glob, doc: entry.doc });
+        }
+    }
+    return dead;
+}
+/** Two globs of different docs matching one file at equal specificity, one example per glob pair. */
+export function overlaps(tree, repoFiles = listRepoFiles(tree), docs = scanOwningDocs(tree)) {
+    const owners = [];
+    for (const entry of docs) {
+        if (entry.status === 'deprecated')
+            continue;
+        for (const glob of entry.owns) {
+            const s = specificity(glob);
+            owners.push({ doc: entry.doc, glob, key: `${s.literal}/${s.wildcard}`, re: globToRegExp(glob) });
+        }
+    }
+    const found = [];
+    const seen = new Set();
+    for (const file of repoFiles) {
+        const here = owners.filter((owner) => owner.re.test(file));
+        for (let i = 0; i < here.length; i++) {
+            for (let j = i + 1; j < here.length; j++) {
+                const a = here[i];
+                const b = here[j];
+                if (a.doc === b.doc || a.key !== b.key)
+                    continue;
+                const pair = `${a.doc}·${a.glob}·${b.doc}·${b.glob}`;
+                if (seen.has(pair))
+                    continue;
+                seen.add(pair);
+                found.push({ a: { doc: a.doc, glob: a.glob }, b: { doc: b.doc, glob: b.glob }, example: file });
+            }
+        }
+    }
+    return found;
+}
+/** Every `verifies:` edge declared under the docs root, with whether its target is absent. */
+export function scanDocEdges(tree, docsRoot = resolveDocsRoot(tree)) {
+    const edges = [];
+    for (const path of markdownUnder(tree, docsRoot)) {
+        if (path.includes('.bkp.'))
+            continue;
+        const block = frontmatter(tree.read(path) ?? '');
+        if (!block)
+            continue;
+        for (const to of asList(field(block, 'verifies'))) {
+            const target = to.trim();
+            if (!target)
+                continue;
+            edges.push({ from: path, kind: 'verifies', to: target, missing: tree.read(target) === null && tree.list(`${target.replace(/\/+$/, '')}/`).length === 0 });
+        }
+    }
+    return edges;
+}
+export function ownershipRule(ctx, docsRoot) {
+    const tree = ctx.head;
+    const files = listRepoFiles(tree);
+    const docs = scanOwningDocs(tree, docsRoot);
+    const waivers = ctx.waivers ?? [];
+    const findings = [];
+    for (const dead of deadGlobs(tree, files, docs)) {
+        if (!waiverCovers(waivers, 'dead-glob', dead.glob, ctx.today))
+            findings.push({ id: 'ownership.dead_glob', path: dead.doc, message: `${dead.glob} → ${dead.doc} matches no file` });
+    }
+    for (const overlap of overlaps(tree, files, docs)) {
+        if (!waiverCovers(waivers, 'ownership-overlap', overlap.example, ctx.today)) {
+            findings.push({ id: 'ownership.overlap', path: overlap.example, message: `${overlap.example} is owned at equal specificity by ${overlap.a.glob} → ${overlap.a.doc} and ${overlap.b.glob} → ${overlap.b.doc}` });
+        }
+    }
+    for (const edge of scanDocEdges(tree, docsRoot).filter((candidate) => candidate.missing)) {
+        if (!waiverCovers(waivers, 'dangling-edge', edge.to, ctx.today))
+            findings.push({ id: 'ownership.dangling_edge', path: edge.from, message: `${edge.from} ${edge.kind}: ${edge.to}, which does not exist` });
+    }
+    return findings;
+}

package/dist/vendor/harness/rules/packageTable.js

@@ -0,0 +1,113 @@
+// packages/harness/src/rules/packageTable.ts - The `package-table` rule: a dependency a change set adds that the
+// approved-packages table rejects, named with that row's replacement. Ported from etna harness/code/hooks/lib/approved.mjs
+// and compliance.mjs packageGate. docs/architecture/systems/harness-records.md speaks for it (Status check and enforcement).
+import { basenamePosix } from '../lib/paths.js';
+export const APPROVED_TABLE_PATH = '.claude/hooks/approved-packages.md';
+export const PACKAGE_RULE_SOURCES = [APPROVED_TABLE_PATH, '.claude/rules/general.md', '.claude/rules/testing.md'];
+function approvedPart(line, banColumn) {
+    if (line.trimStart().startsWith('|')) {
+        if (banColumn < 0)
+            return line;
+        return line
+            .split('|')
+            .filter((_, index) => index !== banColumn)
+            .join('|');
+    }
+    const ban = line.search(/\*\*never\*\*|❌/i);
+    return ban === -1 ? line : line.slice(0, ban);
+}
+function banColumnOf(line, current) {
+    if (!line.trimStart().startsWith('|'))
+        return -1;
+    const header = line.split('|').findIndex((cell) => /don'?t use|never use/i.test(cell));
+    return header === -1 ? current : header;
+}
+/** Package names the table, general.md and testing.md approve; empty when no rules file is present. */
+export function approvedPackages(tree) {
+    const names = new Set();
+    for (const source of PACKAGE_RULE_SOURCES) {
+        let banColumn = -1;
+        for (const line of (tree.read(source) ?? '').split('\n')) {
+            banColumn = banColumnOf(line, banColumn);
+            for (const match of approvedPart(line, banColumn).matchAll(/`(@?[a-z0-9][\w./-]*)`/g))
+                names.add(match[1]);
+        }
+    }
+    return names;
+}
+/** Every rejected package with the row it points at: the table's Don't-use cells, then testing.md's framework bans. */
+export function rejectedPackages(tree) {
+    const rejected = new Map();
+    for (const line of (tree.read(APPROVED_TABLE_PATH) ?? '').split('\n')) {
+        const cells = line.split('|');
+        if (cells.length < 6)
+            continue;
+        const pkg = /`([^`]+)`/.exec(cells[1] ?? '');
+        if (!pkg || pkg[1] === 'Package' || pkg[1] === '---')
+            continue;
+        const version = /`?([^`|]+)`?/.exec((cells[2] ?? '').trim())?.[1] ?? '';
+        for (const match of (cells[4] ?? '').matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+            if (match[1] === pkg[1])
+                continue;
+            rejected.set(match[1], { use: pkg[1], version: version.trim(), purpose: (cells[3] ?? '').trim() });
+        }
+    }
+    let banColumn = -1;
+    for (const line of (tree.read('.claude/rules/testing.md') ?? '').split('\n')) {
+        banColumn = banColumnOf(line, banColumn);
+        if (banColumn < 0 || !line.trimStart().startsWith('|'))
+            continue;
+        for (const match of (line.split('|')[banColumn] ?? '').matchAll(/`(@?[a-z0-9][\w./-]*)`/g)) {
+            if (!rejected.has(match[1]))
+                rejected.set(match[1], { rule: 'testing.md § Frameworks by stack' });
+        }
+    }
+    return rejected;
+}
+const DEPENDENCY_FIELDS = ['dependencies', 'devDependencies', 'optionalDependencies', 'peerDependencies'];
+function dependencies(text) {
+    const out = new Map();
+    if (!text)
+        return out;
+    try {
+        const manifest = JSON.parse(text);
+        for (const fieldName of DEPENDENCY_FIELDS) {
+            const block = manifest[fieldName];
+            if (block && typeof block === 'object')
+                for (const name of Object.keys(block))
+                    out.set(name, (out.get(name) ?? new Set()).add(fieldName));
+        }
+    }
+    catch {
+        /* an unparsable package.json adds nothing the table can judge */
+    }
+    return out;
+}
+export function packageTableRule(ctx) {
+    const manifests = (ctx.changes ?? []).filter((change) => change.status !== 'D' && basenamePosix(change.path) === 'package.json');
+    if (manifests.length === 0)
+        return [];
+    const approved = approvedPackages(ctx.head);
+    if (approved.size === 0)
+        return [];
+    const rejected = rejectedPackages(ctx.head);
+    const approvedScopes = new Set([...approved].filter((name) => name.startsWith('@')).map((name) => name.split('/')[0]));
+    approvedScopes.add('@types');
+    const findings = [];
+    for (const change of manifests) {
+        const before = dependencies(ctx.base?.read(change.from ?? change.path) ?? null);
+        for (const [pkg, fields] of dependencies(ctx.head.read(change.path))) {
+            if (before.has(pkg) || approved.has(pkg))
+                continue;
+            const isDev = fields.size === 1 && fields.has('devDependencies');
+            if (isDev && pkg.startsWith('@') && approvedScopes.has(pkg.split('/')[0]))
+                continue;
+            const no = rejected.get(pkg);
+            if (!no)
+                continue;
+            const instead = no.use ? `use \`${no.use}\`${no.version ? ` ${no.version}` : ''}${no.purpose ? ` — ${no.purpose}` : ''}` : `the prescribed choice is in ${no.rule}`;
+            findings.push({ id: 'package-table.rejected', path: change.path, message: `${change.path} adds \`${pkg}\`, which ${APPROVED_TABLE_PATH} rejects: ${instead}` });
+        }
+    }
+    return findings;
+}

package/dist/vendor/harness/rules/plans.js

@@ -0,0 +1,96 @@
+// packages/harness/src/rules/plans.ts - The one reader of the plans folder and of a plan's two ledgers, over a
+// RuleTree. Ported from etna harness/code/hooks/lib/plans.mjs and lib/ledger.mjs.
+// docs/architecture/systems/harness-records.md speaks for it (Status check and enforcement).
+import { backtickTokens, markdownIn } from './context.js';
+import { globToRegExp } from './ownership.js';
+/** A plan's scope: the path-shaped backticked tokens of its `## Proposed Changes` section. */
+export function planScopePaths(text) {
+    const section = /^##\s+Proposed Changes\s*$([\s\S]*?)(?=^##\s|(?![\s\S]))/m.exec(text);
+    if (!section)
+        return [];
+    return backtickTokens(section[1]).filter((token) => token.includes('/'));
+}
+/** True when `rel` falls inside a scope entry: a glob, a folder (its subtree), or an exact file. */
+export function inPlanScope(rel, scope) {
+    return scope.some((entry) => {
+        if (entry.includes('*'))
+            return globToRegExp(entry).test(rel);
+        if (entry.endsWith('/'))
+            return rel === entry.slice(0, -1) || rel.startsWith(entry);
+        return rel === entry || rel.startsWith(`${entry}/`);
+    });
+}
+export const plansFolder = (docsRoot) => `${docsRoot}/history/plans`;
+export function listPlans(tree, docsRoot) {
+    const plans = [];
+    for (const path of markdownIn(tree, plansFolder(docsRoot))) {
+        const text = tree.read(path) ?? '';
+        const status = /^\*\*Status:\*\*\s*(.+)$/m.exec(text)?.[1]?.trim() ?? null;
+        if (!status)
+            continue;
+        plans.push({
+            file: path.slice(path.lastIndexOf('/') + 1),
+            path,
+            status,
+            gates: /^\*\*Gates:\*\*\s*(.+)$/m.exec(text)?.[1]?.trim() ?? null,
+            scope: planScopePaths(text),
+            hasLedger: /^##\s+Test Obligations\b/m.test(text),
+            hasDocLedger: /^##\s+Doc Obligations\b/m.test(text),
+        });
+    }
+    return plans;
+}
+/** Open plans carrying a `Gates:` line; plans without one are legacy and pass every plan gate. */
+export const openGatedPlans = (tree, docsRoot) => listPlans(tree, docsRoot).filter((plan) => !/Complete|Abandoned/.test(plan.status) && plan.gates);
+const OUTCOME = /^(satisfied|owes nothing|blocked)\b/i;
+const DOC_OUTCOME = /^(updated|owes nothing|blocked)\b/i;
+/** One table row's cells, split on unescaped pipes. */
+const splitRow = (line) => line.split(/(?<!\\)\|/).map((cell) => cell.replace(/\\\|/g, '|').trim());
+function sectionTable(planText, heading) {
+    const start = (planText || '').search(new RegExp(`^##\\s+${heading}\\b`, 'm'));
+    if (start === -1)
+        return null;
+    const body = [];
+    for (const line of planText.slice(start).split('\n').slice(1)) {
+        if (/^##\s/.test(line))
+            break;
+        body.push(line);
+    }
+    const rows = body.filter((line) => /^\s*\|/.test(line));
+    if (rows.length < 3)
+        return null;
+    const header = splitRow(rows[0]).map((cell) => cell.toLowerCase());
+    const col = header.indexOf('outcome');
+    return { rows: rows.slice(2).map(splitRow), col: col === -1 ? null : col };
+}
+/** Row ids of every Test Obligations row whose Outcome is empty or off-vocabulary. */
+export function undischargedRows(planText) {
+    const table = sectionTable(planText, 'Test Obligations');
+    if (!table || table.col === null)
+        return [];
+    const out = [];
+    for (const cells of table.rows) {
+        if (!/^\d+[a-z]?$/i.test(cells[1] ?? ''))
+            continue;
+        const outcome = (cells[table.col] ?? '').replace(/\*/g, '').trim();
+        if (!OUTCOME.test(outcome))
+            out.push(cells[1]);
+    }
+    return out;
+}
+/** Doc names of every Doc Obligations row whose Outcome is empty or off-vocabulary. */
+export function undischargedDocRows(planText) {
+    const table = sectionTable(planText, 'Doc Obligations');
+    if (!table || table.col === null)
+        return [];
+    const out = [];
+    for (const cells of table.rows) {
+        const doc = (cells[1] ?? '').replace(/`/g, '');
+        if (!doc || /^-+$/.test(doc))
+            continue;
+        const outcome = (cells[table.col] ?? '').replace(/\*/g, '').trim();
+        if (!DOC_OUTCOME.test(outcome))
+            out.push(doc);
+    }
+    return out;
+}

package/dist/vendor/harness/rules/sessionWalls.js

@@ -0,0 +1,31 @@
+/** Anchored at statement boundaries, so quoted text never trips a screen and a command on its own line never slips one. */
+const AT_STATEMENT = String.raw `(?:^|\n|&&|;|\|)\s*(?:sudo\s+)?(?:npx\s+(?:--yes\s+)?)?`;
+const statement = (body) => new RegExp(AT_STATEMENT + body);
+const BRANCH_CREATE = statement(String.raw `git\s+(checkout\s+-b|switch\s+-c|branch\s+(?!-)\S+|worktree\s+add)`);
+const LIVE_COMMAND = statement(String.raw `wrangler(?:@\S+)?\b.*(\bd1\s+execute\b.*--remote|\bsecret\s+(put|bulk)\b|\bdeploy\b)`);
+const missing = (id, what) => [{ id: `${id}.context_missing`, message: `${id} needs ${what}, which the caller did not pass` }];
+export function branchWorktreeRule(ctx) {
+    if (!ctx.action)
+        return missing('branch-worktree', 'the Bash command');
+    return BRANCH_CREATE.test(ctx.action.command) ? [{ id: 'branch-worktree.create', message: 'the command creates a branch or worktree; policy allows that only when the person asked for one' }] : [];
+}
+export function liveCommandRule(ctx) {
+    if (!ctx.action)
+        return missing('live-command', 'the Bash command');
+    const command = ctx.action.command;
+    return LIVE_COMMAND.test(command) && !/--dry-run\b|--local\b/.test(command) ? [{ id: 'live-command.live', message: 'the command deploys, writes a remote database or sets a secret' }] : [];
+}
+/** A rule over one session fact: missing when the fact is absent, a finding when `judge` says so. */
+function factRule(id, key, judge) {
+    return (ctx) => {
+        const value = ctx.session?.[key];
+        if (value === undefined)
+            return missing(id, `the session fact ${String(key)}`);
+        return judge(value);
+    };
+}
+export const commitClaimRule = factRule('commit-claim', 'commitClaimHolder', (holder) => (holder ? [{ id: 'commit-claim.held', message: `another session (${holder}) holds the commit claim` }] : []));
+export const foreignClaimRule = factRule('foreign-claim', 'foreignTouches', (touches) => (touches ?? []).map((touch) => ({ id: 'foreign-claim.touched', path: touch.path, message: `${touch.path} was touched by another live session (${touch.holder})` })));
+export const openDenialsRule = factRule('open-denials', 'unresolvedDenials', (denials) => (denials ?? []).length ? [{ id: 'open-denials.unresolved', message: `${denials.length} gate denial(s) have no resolved line: ${denials.join('; ')}` }] : []);
+export const exitStopRule = factRule('exit-stop', 'exitBlock', (block) => (block ? [{ id: 'exit-stop.blocked', message: block }] : []));
+export const queueRule = factRule('queue', 'openObligations', (count) => ((count ?? 0) > 0 ? [{ id: 'queue.open_obligations', message: `${count} open obligation(s) in the session's queue` }] : []));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.23.12",
+  "version": "0.23.13",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,
@@ -21,7 +21,6 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",
-    "@nurix/etna": "0.20.25",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^14.0.0"
@@ -35,6 +34,7 @@
     "@types/node": "^22.19.20",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11",
+    "@nurix/harness": "0.0.0",
     "@nurix/nustack.studio": "0.0.0",
     "@nurix/nustack.ui": "0.0.0",
     "@nurix/contracts": "2.0.1"
@@ -43,7 +43,7 @@
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy_schema.mjs",
+    "build": "tsc && node scripts/copy_schema.mjs && node scripts/copy_harness.mjs",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json",
     "test": "vitest run",