@nurix/nustack 0.23.12 → 0.23.14

package/dist/vendor/harness/rules/sessionWalls.js

@@ -0,0 +1,31 @@
+/** Anchored at statement boundaries, so quoted text never trips a screen and a command on its own line never slips one. */
+const AT_STATEMENT = String.raw `(?:^|\n|&&|;|\|)\s*(?:sudo\s+)?(?:npx\s+(?:--yes\s+)?)?`;
+const statement = (body) => new RegExp(AT_STATEMENT + body);
+const BRANCH_CREATE = statement(String.raw `git\s+(checkout\s+-b|switch\s+-c|branch\s+(?!-)\S+|worktree\s+add)`);
+const LIVE_COMMAND = statement(String.raw `wrangler(?:@\S+)?\b.*(\bd1\s+execute\b.*--remote|\bsecret\s+(put|bulk)\b|\bdeploy\b)`);
+const missing = (id, what) => [{ id: `${id}.context_missing`, message: `${id} needs ${what}, which the caller did not pass` }];
+export function branchWorktreeRule(ctx) {
+    if (!ctx.action)
+        return missing('branch-worktree', 'the Bash command');
+    return BRANCH_CREATE.test(ctx.action.command) ? [{ id: 'branch-worktree.create', message: 'the command creates a branch or worktree; policy allows that only when the person asked for one' }] : [];
+}
+export function liveCommandRule(ctx) {
+    if (!ctx.action)
+        return missing('live-command', 'the Bash command');
+    const command = ctx.action.command;
+    return LIVE_COMMAND.test(command) && !/--dry-run\b|--local\b/.test(command) ? [{ id: 'live-command.live', message: 'the command deploys, writes a remote database or sets a secret' }] : [];
+}
+/** A rule over one session fact: missing when the fact is absent, a finding when `judge` says so. */
+function factRule(id, key, judge) {
+    return (ctx) => {
+        const value = ctx.session?.[key];
+        if (value === undefined)
+            return missing(id, `the session fact ${String(key)}`);
+        return judge(value);
+    };
+}
+export const commitClaimRule = factRule('commit-claim', 'commitClaimHolder', (holder) => (holder ? [{ id: 'commit-claim.held', message: `another session (${holder}) holds the commit claim` }] : []));
+export const foreignClaimRule = factRule('foreign-claim', 'foreignTouches', (touches) => (touches ?? []).map((touch) => ({ id: 'foreign-claim.touched', path: touch.path, message: `${touch.path} was touched by another live session (${touch.holder})` })));
+export const openDenialsRule = factRule('open-denials', 'unresolvedDenials', (denials) => (denials ?? []).length ? [{ id: 'open-denials.unresolved', message: `${denials.length} gate denial(s) have no resolved line: ${denials.join('; ')}` }] : []);
+export const exitStopRule = factRule('exit-stop', 'exitBlock', (block) => (block ? [{ id: 'exit-stop.blocked', message: block }] : []));
+export const queueRule = factRule('queue', 'openObligations', (count) => ((count ?? 0) > 0 ? [{ id: 'queue.open_obligations', message: `${count} open obligation(s) in the session's queue` }] : []));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nurix/nustack",
-  "version": "0.23.12",
+  "version": "0.23.14",
   "description": "The nustack CLI — bootstrap NuStack services into a repo via the NuStack discovery plane.",
   "type": "module",
   "private": false,
@@ -21,7 +21,6 @@
   },
   "dependencies": {
     "@clack/prompts": "^0.11.0",
-    "@nurix/etna": "0.20.25",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^14.0.0"
@@ -35,15 +34,16 @@
     "@types/node": "^22.19.20",
     "typescript": "^5.7.2",
     "vitest": "^4.1.11",
+    "@nurix/contracts": "2.0.1",
     "@nurix/nustack.studio": "0.0.0",
-    "@nurix/nustack.ui": "0.0.0",
-    "@nurix/contracts": "2.0.1"
+    "@nurix/harness": "0.0.0",
+    "@nurix/nustack.ui": "0.0.0"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "build": "tsc && node scripts/copy_schema.mjs",
+    "build": "tsc && node scripts/copy_schema.mjs && node scripts/copy_harness.mjs",
     "dev": "tsc --watch",
     "typecheck": "tsc --noEmit && tsc --noEmit -p tsconfig.tests.json",
     "test": "vitest run",