@pareto4/pp-core 1.10.0 → 1.11.0

package/pp-core/bin/lib/vault-write-back.cjs

@@ -11,9 +11,12 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *   `scanForSecrets`) plus the preflight guard chain (`promotePreflight`)
  *   that runs before any git subprocess exists in this module: the
  *   activation gate, the Phase 24 format validator reused verbatim, the
- *   secret scan, and the frozen `assertVaultWriteTarget` write-target
- *   check. Every stage emits the uniform refusal contract (D-16) via the
- *   `refusal` helper.
+ *   secret scan, and the `assertVaultWriteTarget` write-target check. That
+ *   guard's identity is now the resolved `(repo, host)` pair for both
+ *   tiers (Phase 31, CFG-02/D-10) — it gained a required target-host
+ *   parameter, and this arm passes one derived from the coordinate
+ *   resolver rather than a config-only host chain. Every stage emits the
+ *   uniform refusal contract (D-16) via the `refusal` helper.
  *
  * Deliberately a NEW module (not folded into `src/vault.cts` or
  * `src/vault-command-router.cts`) — the name is load-bearing: it forms a
@@ -62,7 +65,10 @@ var __importDefault = (this && this.__importDefault) || function (mod) {
  *     validator in the write path (D-03). Reused verbatim, never
  *     re-derived.
  *   - `./vault.cjs` (`cfgGet`, `readBindings`, `assertVaultWriteTarget`) —
- *     `assertVaultWriteTarget` is called verbatim and unmodified (D-05).
+ *     this module delegates to `assertVaultWriteTarget` and reimplements
+ *     none of it (D-05); the guard's signature gained a required target
+ *     host in Phase 31 (D-10), which this call site passes from the
+ *     coordinate resolver.
  *   - `./io.cjs` (`ERROR_REASON`) — the typed refusal reason codes added
  *     alongside this module.
  *
@@ -81,6 +87,8 @@ const node_os_1 = __importDefault(require("node:os"));
 const node_path_1 = __importDefault(require("node:path"));
 const node_crypto_1 = __importDefault(require("node:crypto"));
 const shell_command_projection_cjs_1 = require("./shell-command-projection.cjs");
+const git_provider_cjs_1 = require("./git-provider.cjs");
+const vault_coordinates_cjs_1 = require("./vault-coordinates.cjs");
 // eslint-disable-next-line @typescript-eslint/no-require-imports
 const io = require("./io.cjs");
 const { ERROR_REASON } = io;
@@ -266,17 +274,76 @@ function promotePreflight({ cwd, filePath, _vault, _practices }) {
             'Fix it in .platform-bindings.json and run the promotion again.');
     }
     const targetRef = client && typeof client.vaultRef === 'string' && client.vaultRef.trim() ? client.vaultRef.trim() : 'main';
-    const platformHost = vault.cfgGet(cwd, 'platform.host', null);
-    const targetHost = client && typeof client.vaultHost === 'string' && client.vaultHost.trim()
-        ? client.vaultHost.trim()
-        : typeof platformHost === 'string' && platformHost.trim()
-            ? platformHost.trim()
-            : 'gitlab.com';
-    // 6. Write-target guard — assertVaultWriteTarget is called verbatim and
-    // unmodified (D-05); this arm never re-derives, wraps, relaxes, or
-    // reimplements any of its three refusals.
+    // Resolve the provider ONCE, here in the preflight (PROV-02/T-30-16) — both
+    // previewPromotion and confirmPromotion re-run this preflight and read the
+    // same `provider` field back off the result, so they cannot compose two
+    // different remotes for the same promotion. Moved ahead of target-host
+    // resolution (Phase 31, D-10): the host now comes from the coordinate
+    // resolver below, which itself takes the provider as an argument.
+    const providerResolution = (0, git_provider_cjs_1.resolveProvider)(cwd);
+    const provider = providerResolution.provider;
+    const providerWarnings = providerResolution.warnings.slice();
+    // Target host — from the coordinate resolver (Phase 31, D-10), not a
+    // config-only host chain. `client.vaultHost` wins when set; otherwise
+    // `.platform-bindings.json`'s `platform.host` (D-09), warned; otherwise
+    // the provider's default host. The `.planning/config.json`-only
+    // `platform.host` read this preflight used to fall back to last is gone
+    // — leaving it in place beside the resolver would not fix D-09, it would
+    // add a third disagreeing source of the same value.
+    const clientCoord = (0, vault_coordinates_cjs_1.resolveClientCoordinates)(cwd, provider);
+    const targetHost = clientCoord.host;
+    if (clientCoord.warnings.length > 0)
+        providerWarnings.push(...clientCoord.warnings);
+    // Shared-tier coordinates — resolved ONCE here in the preflight (D-09,
+    // T-31-09), carried forward on the success shape below rather than
+    // resolved a second time by `previewPromotion`. This is the same
+    // construction already used for `provider` and for `clientCoord` above:
+    // both `previewPromotion` and `confirmPromotion` re-run this preflight and
+    // read fields back off its result, so a promotion cannot end up resolving
+    // two disagreeing answers for its own shared-shadow lookup.
+    //
+    // `applyBuiltInDefault: false` is load-bearing, not a stylistic default.
+    // This path has never applied the built-in shared-vault default — it used
+    // to read `vault.fallback_repo` with an empty-string fallback, so a
+    // project that never set the key performed no shared-shadow clone at all.
+    // Passing `true` here would give every existing gitlab install a shared
+    // clone it does not perform today, breaking ROADMAP SC3. The read-path
+    // ladder and `assertVaultWriteTarget` both pass `true` because both of
+    // them already apply the built-in default today (they always have) — this
+    // is the one caller that deliberately withholds it.
+    const sharedCoord = (0, vault_coordinates_cjs_1.resolveSharedCoordinates)(cwd, provider, { applyBuiltInDefault: false });
+    if (sharedCoord.warnings.length > 0)
+        providerWarnings.push(...sharedCoord.warnings);
+    // D-13/WR-01: read the resolver's OWN verdict straight off `sharedCoord`
+    // — no local re-derivation. Before this fix, `sharedCoord.suppressed` was
+    // unconditionally `false` on this call regardless of provider, because
+    // withholding the built-in default (`applyBuiltInDefault: false`, above)
+    // also disabled the resolver's suppression branch. The resolver now
+    // reports `suppressed`/`suppressedKind` correctly even with the built-in
+    // default withheld, so this module no longer needs to (and must not)
+    // approximate the fact from `sharedRepo`/`provider` itself — that
+    // approximation was exactly the WR-01 defect (PROJECT.md: an operator who
+    // deliberately disabled the shared tier via an empty `vault.fallback_repo`
+    // was shown a note asking them to set the very key they already set,
+    // because this module could not tell that apart from "never configured").
+    const sharedSuppressed = sharedCoord.suppressed;
+    const sharedSuppressedKind = sharedCoord.suppressedKind;
+    // Any warning composing the primary clone target for THIS
+    // provider/repo/host (an operator-supplied `.git` suffix under azure) is
+    // folded in here too, alongside the provider and coordinate warnings
+    // already collected above, so a single `notes` push in the preview
+    // surfaces all of them.
+    if (!(0, git_provider_cjs_1.isLiteralCloneTarget)(targetRepo.trim())) {
+        const composedForWarnings = (0, git_provider_cjs_1.composeCloneTarget)(provider, targetRepo, targetHost);
+        if (composedForWarnings.warnings.length > 0)
+            providerWarnings.push(...composedForWarnings.warnings);
+    }
+    // 6. Write-target guard (D-05, D-10) — this arm delegates to
+    // assertVaultWriteTarget and never re-derives, wraps, relaxes, or
+    // reimplements any of its three refusals; it passes the resolved target
+    // repo and target host straight through.
     try {
-        vault.assertVaultWriteTarget(cwd, targetRepo);
+        vault.assertVaultWriteTarget(cwd, targetRepo, targetHost);
     }
     catch (e) {
         const msg = (e instanceof Error ? e.message : String(e)).replace(/^vault write refused:\s*/, '');
@@ -293,6 +360,13 @@ function promotePreflight({ cwd, filePath, _vault, _practices }) {
         ref: targetRef,
         host: targetHost,
         destination,
+        provider,
+        providerWarnings,
+        sharedRepo: sharedCoord.repo,
+        sharedRef: sharedCoord.ref,
+        sharedHost: sharedCoord.host,
+        sharedSuppressed,
+        sharedSuppressedKind,
     };
 }
 // ─── Preview (read-only half of the write path) ─────────────────────────────────
@@ -319,70 +393,31 @@ function buildExpectToken(localRaw, remoteBaseline) {
  * never reads or writes the project's own vault read cache (a fresh
  * mkdtemp working copy is used and always removed, even on a thrown error).
  */
-/**
- * True when `value` is already something git can clone directly.
- *
- * MUST mirror `isLiteralCloneTarget` in `src/vault.cts`.
- *
- * Security (T-29-26): a value that git would read as an OPTION must never take
- * the verbatim branch. Two rules enforce that:
- *   - the scheme test is anchored at the START (`^scheme://`). An earlier
- *     version used `value.includes('://')`, so `--upload-pack=…#x://` — a git
- *     option carrying `://` anywhere — passed through untouched and reached
- *     `git clone` as a flag.
- *   - the scp-style test may not begin with `-`. `[\w.-]+@` accepted a leading
- *     hyphen, so `--config=core.sshCommand=…@x` matched too.
- * A leading `-` is additionally refused outright by `flagShapedRepoRefusal`, and
- * every clone call site passes `--` before the target, so all three would have
- * to fail together for an option to reach git.
- */
-function isLiteralCloneTarget(value) {
-    if (value.startsWith('-'))
-        return false;
-    return (/^[A-Za-z][A-Za-z0-9+.-]*:\/\//.test(value) ||
-        /^[\w.][\w.-]*@/.test(value) ||
-        value.startsWith('/') ||
-        value.startsWith('./') ||
-        value.startsWith('../') ||
-        value.startsWith('~') ||
-        /^[A-Za-z]:[\\/]/.test(value));
-}
-/**
- * Resolve a configured vault repo value into something `git clone` can reach.
- *
- * `client.vaultRepo` carries two legitimate shapes, and before this resolver
- * existed only the first one worked on the write path:
- *
- *   - a literal clone target — an absolute path, a `file://`/`https://`/`ssh://`
- *     URL, or scp-style `git@host:group/project` — used verbatim. Every test
- *     fixture and every disposable bare-repo harness uses this shape, which is
- *     why the gap below stayed invisible to the suite.
- *   - a `group/project` slug, which is the ONLY shape
- *     `schemas/platform-bindings.schema.json` (`vaultRepo.pattern`) and its own
- *     documented example `pareto4-clients/acme/acme-vault` actually permit. A
- *     slug handed straight to `git clone` is read as a RELATIVE PATH and fails
- *     with "repository does not exist" — so the write-back arm could never
- *     reach a real client vault, and the refusal blamed the operator's access.
- *
- * The URL built for a slug mirrors `cloneTier` in `src/vault.cts` byte for byte
- * (`https://<host>/<repo>.git`), so the read and write paths address the same
- * remote instead of disagreeing about what `client.vaultRepo` means.
- */
-function resolveCloneTarget(repo, host) {
-    const value = repo.trim();
-    if (isLiteralCloneTarget(value))
-        return value;
-    return `https://${host}/${value}.git`;
-}
+// `isLiteralCloneTarget` and clone-target composition — the single
+// definitions live in `src/git-provider.cts` (imported above) and are shared
+// with the read path (`src/vault.cts`, 30-02). Do NOT reintroduce a local
+// copy of either here: a read/write divergence in this predicate was defect
+// P-1 in Phase 29 (the write path used `client.vaultRepo` verbatim while the
+// read path always composed a URL, so a slug broke writing and a path broke
+// reading) — duplicating the fix a second time is exactly how that class of
+// bug recurs.
 function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
     const gitExec = _exec ?? shell_command_projection_cjs_1.execGit;
     // 1. Run the full preflight guard chain; refuse unchanged with no clone.
     const pre = promotePreflight({ cwd, filePath, _vault, _practices });
     if (pre.status !== 'ok')
         return pre;
-    // eslint-disable-next-line @typescript-eslint/no-require-imports, @typescript-eslint/no-unsafe-assignment
-    const vault = _vault ?? require('./vault.cjs');
+    // No local `./vault.cjs` handle is needed here any more (Phase 31,
+    // Task 1): the shared-shadow lookup below reads its coordinates off `pre`
+    // instead of calling `vault.cfgGet` directly, so this function no longer
+    // touches the vault module at all — `_vault` is still threaded through to
+    // `promotePreflight` above for the test-seam injection convention.
     const notes = [];
+    // Surface any warning resolving the provider or composing the primary
+    // clone target produced (an unrecognized `vault.provider` value, or an
+    // operator-supplied `.git` suffix under azure) — visible in the preview an
+    // operator reads before confirming, never a silent degrade.
+    notes.push(...pre.providerWarnings);
     // The disposable working copy is a fresh mkdtemp directory — never the
     // read cache, which is often a shallow/sparse clone from a different tier
     // and is refreshed independently after a push. Removed on every exit path.
@@ -391,10 +426,19 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
         cloneDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pp-vault-promote-'));
         // 2. Clone the resolved client repo at the resolved ref — a full
         // single-branch clone (no shallow-depth flag: the confirmed path needs
-        // real history to fast-forward against). The target goes through
-        // resolveCloneTarget so a `group/project` slug becomes a real URL on the
-        // resolved host instead of a relative path git cannot find.
-        const cl = gitExec(['clone', '--branch', pre.ref, '--single-branch', '--', resolveCloneTarget(pre.repo, pre.host), cloneDir], { timeout: 120_000 });
+        // real history to fast-forward against). The target goes through the
+        // provider seam's composeCloneTarget so a `group/project` slug becomes a
+        // real URL on the resolved host and provider, instead of a relative path
+        // git cannot find.
+        const cl = gitExec([
+            'clone',
+            '--branch',
+            pre.ref,
+            '--single-branch',
+            '--',
+            (0, git_provider_cjs_1.composeCloneTarget)(pre.provider, pre.repo, pre.host).url,
+            cloneDir,
+        ], { timeout: 120_000 });
         if (cl.exitCode !== 0) {
             const cause = boundedToken((cl.stderr || '').split(/\r?\n/)[0] || 'unknown error');
             return refusal(PROMOTE_GUARD.TRANSPORT, ERROR_REASON.VAULT_PROMOTE_TRANSPORT_FAILED, `This practice was not pushed: git could not reach the vault (${cause}). Check your access to the vault and run the promotion again.`);
@@ -422,28 +466,41 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
         else {
             content = pre.raw;
         }
-        // 6. Shared-shadow lookup — resolve through the vault module's cfgGet so
-        // the existing defaults apply. Skipped entirely (flag stays false) when
-        // the shared repo is unset or equals the client repo.
+        // 6. Shared-shadow lookup — the shared coordinates are resolved exactly
+        // ONCE, in the preflight above, with the built-in default explicitly
+        // withheld (D-09, T-31-09); this function reads them back off `pre`
+        // rather than resolving them a second time. Skipped entirely (flag stays
+        // false) when no shared repo resolved, or it equals the client repo —
+        // the same skip shape as before, now expressed against the resolved
+        // field: a `null` `pre.sharedRepo` is treated the way the empty string
+        // used to be treated.
+        //
+        // The shared vault is addressed on the resolved shared host, in D-03's
+        // order: `vault.fallback_host` first, then the authoritative
+        // `platform.host` (`.platform-bindings.json` first, `.planning/config.json`
+        // as a warned fallback per D-09), then the provider-derived default —
+        // never the client's own `client.vaultHost`, mirroring the fallback tier
+        // in `src/vault.cts`'s `cloneTier` so a client with a custom vaultHost
+        // never sends the shared-shadow lookup to their own host. Composed under
+        // the SAME resolved provider as the client clone (deliberate and
+        // symmetric with `cloneTier`'s one-provider-per-fetch rule).
+        //
+        // Per-tier provider selection does NOT arrive with this phase's CFG-01:
+        // D-01 answered that with a deliberate, permanent no. One provider per
+        // project stands — a client does not straddle two providers — and the
+        // fix for the azure-composing-a-gitlab-URL hazard is that the shared
+        // coordinates became per-client config, which is exactly what resolving
+        // them once in the preflight, above, does.
         let sharedShadow = false;
         let sharedShadowNote = null;
-        const sharedRepoRaw = vault.cfgGet(cwd, 'vault.fallback_repo', '');
-        const sharedRefRaw = vault.cfgGet(cwd, 'vault.fallback_ref', 'main');
-        const sharedRepo = typeof sharedRepoRaw === 'string' ? sharedRepoRaw : '';
-        const sharedRef = typeof sharedRefRaw === 'string' && sharedRefRaw ? sharedRefRaw : 'main';
+        const sharedRepo = pre.sharedRepo;
+        const sharedRef = pre.sharedRef;
+        const sharedHost = pre.sharedHost;
         if (sharedRepo && sharedRepo !== pre.repo) {
             let sharedDir = null;
             try {
                 sharedDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pp-vault-shared-'));
                 // Shallow single-branch: only file presence matters, no history needed.
-                // The shared vault is addressed on the PLATFORM host, not the client's
-                // — mirroring the fallback tier in src/vault.cts's cloneTier, so a
-                // client with a custom vaultHost never sends the shared-shadow lookup
-                // to their own host.
-                const sharedPlatformHostRaw = vault.cfgGet(cwd, 'platform.host', null);
-                const sharedHost = typeof sharedPlatformHostRaw === 'string' && sharedPlatformHostRaw.trim()
-                    ? sharedPlatformHostRaw.trim()
-                    : 'gitlab.com';
                 const sc = gitExec([
                     'clone',
                     '--depth',
@@ -452,7 +509,7 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
                     sharedRef,
                     '--single-branch',
                     '--',
-                    resolveCloneTarget(sharedRepo, sharedHost),
+                    (0, git_provider_cjs_1.composeCloneTarget)(pre.provider, sharedRepo, sharedHost).url,
                     sharedDir,
                 ], { timeout: 120_000 });
                 if (sc.exitCode === 0) {
@@ -476,6 +533,27 @@ function previewPromotion({ cwd, filePath, _exec, _vault, _practices }) {
                     node_fs_1.default.rmSync(sharedDir, { recursive: true, force: true });
             }
         }
+        // Suppression note (D-02, D-11, D-13/WR-01) — pushed ONLY when the
+        // shared resolution reports suppression AND the kind is
+        // 'provider-default-unavailable'. A gitlab project with no
+        // `vault.fallback_repo` resolves `sharedSuppressed: false` (nothing was
+        // suppressed — no built-in default was withheld from a provider that
+        // would otherwise have gotten one) and emits nothing here, exactly as it
+        // did before this phase — this note is SC3-safe by construction.
+        //
+        // D-13/WR-01: an operator who set `vault.fallback_repo` to an empty
+        // string deliberately disabled the shared tier — `sharedSuppressedKind`
+        // is `'explicit-opt-out'` for that case, and telling them to set the key
+        // they already set is exactly the defect this closes. NO second note is
+        // added for the opt-out case: silence is the correct output for a
+        // choice the operator already made, and inventing a new note would be
+        // new behaviour rather than a fix. D-11's requirement to surface the
+        // skipped shared check is already met by the write guard's own refusal
+        // sentence (plan 03); this note additionally explains why, in the
+        // read-only preview an operator reads before confirming.
+        if (pre.sharedSuppressed && pre.sharedSuppressedKind === 'provider-default-unavailable') {
+            notes.push(`No shared vault is configured for the ${pre.provider} provider — the built-in Pareto shared default applies only to the gitlab provider. Set vault.fallback_repo to enable the shared tier.`);
+        }
         // 7 & 8. Pin both sides in the opaque expect token, then return.
         const expect = buildExpectToken(pre.raw, baseline);
         return {
@@ -558,7 +636,15 @@ function confirmPromotion({ cwd, filePath, expect, _exec, _vault, _practices })
     let cloneDir = null;
     try {
         cloneDir = node_fs_1.default.mkdtempSync(node_path_1.default.join(node_os_1.default.tmpdir(), 'pp-vault-confirm-'));
-        const cl = gitExec(['clone', '--branch', pre.ref, '--single-branch', '--', resolveCloneTarget(pre.repo, pre.host), cloneDir], { timeout: 120_000 });
+        const cl = gitExec([
+            'clone',
+            '--branch',
+            pre.ref,
+            '--single-branch',
+            '--',
+            (0, git_provider_cjs_1.composeCloneTarget)(pre.provider, pre.repo, pre.host).url,
+            cloneDir,
+        ], { timeout: 120_000 });
         if (cl.exitCode !== 0)
             return transportRefusal(cl);
         // 6. Fetch the resolved ref from origin, then absorb any unrelated